Windows Accounts to work on Linux Servers

[McChikenhanger]

Hi guys,

 

I run a Windows Network based on Server2012R2, but I also have a few servers running Linux for a few services that can'e be run from a Windows machine.

 

My question is what is the easiest way of getting my Windows Logins to work with the Linux servers? This way I don't have to remember or make the root password the same on all of the Linux servers. I have playes around with the UNIX extensions within AD, but this has not had the desired effect yet.

 

Many thanks for any help provided.

[jinnantonnixx]

realmd might be what you're looking for. It's available on recent Redhat/Centos releases, as well as Ubuntu/Debian. It's quick and easy to set up.

https://outsideit.net/realmd-sssd-ad-authentication/

 

The full manual is comprehensive, but it's operation is quite straighforward.

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Windows_Integration_Guide/ch-Configuring_Authentication.html

 

 

My notes for joining Ubuntu 14.04 to AD:

Joining Ubuntu to Active Directory using realmd

refeence: http://www.mylesgray.com/infrastructure/utilising-kerberosad-auth-ubuntu-14-04-realmd/

 

 

realm discover [domain]

 

realm -v join [domain] -U user

e.g.

realm -v join MYDOMAIN.SOMETHING.UK -U myusername

 

Edit config files

Edit /etc/pam.d/common-session

 

Add this line at the end

session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

 

 

 

Edit /etc/sssd/sssd.conf

Comment this line to allow short username entry.

#use_fully_qualified_names = True

 

 

Configure Ubuntu greeter to allow free-text manual log-in

 

Edit /usr/share/lightdm/lightdm.conf.d/50-ubuntu.conf

 

[seatDefaults]

user-session=ubuntu

greeter-show-manual-login=true

Edited April 10, 2017 by jinnantonnixx

[McChikenhanger]

You know what, I was just reading about that on this webpage;

 

https://freedesktop.org/software/realmd/docs/index.html

 

I've already got SSSD installed, but I was finding all of the configuration by hand to be problematic.

 

Thank you, I will give this one a try.

[jinnantonnixx]

You know what, I was just reading about that on this webpage;

 

https://freedesktop.org/software/realmd/docs/index.html

 

I've already got SSSD installed, but I was finding all of the configuration by hand to be problematic.

 

Thank you, I will give this one a try.

 

You'll like realmd. Once it's installed, it just works and you can forget about it.

[McChikenhanger]

OK thank you. Just trying it now. One more thing. Do I need to restart the linux machine after I install realmd? Reason why I ask is that I'm invoking the realm command but the console doesn't recognise the command.

[jinnantonnixx]

OK thank you. Just trying it now. One more thing. Do I need to restart the linux machine after I install realmd? Reason why I ask is that I'm invoking the realm command but the console doesn't recognise the command.

 

No, you shouldn't need to reboot (it's not Windows!)

 

Which distro are you using? Maybe realm is in the secure /sbin directory. Try /sbin/realm

[McChikenhanger]

That's what I thought, but better ask. I'm using TurnKey which is a Debian based distro. I've looked under /sbin/ but realm is not there :/

 

Thanks.

[jinnantonnixx]

I ran realm through an strace on my system and got this:

~$ strace realm
execve("/usr/sbin/realm", ["realm"], [/* 62 vars */]) = 0

so it's running from /usr/sbin

 

Mine's Ubuntu, so yours should be pretty close.

 

Try /usr/sbin/realm

[McChikenhanger]

Oh you the man. Yeap, found realm installed under /usr/sbin

 

It still gives an error when running realm list command, but it could be because it was under the domain before. Let me try removing it from the domain and re-adding it, see if this fixes the issue.

 

Thanks

[McChikenhanger]

Mmmmm, I sill get the following error if I try to run it from command line.

 

realm: Couldn't connect to system bus: Could not connect: No such file or directory

 

But if I run "realm list --install=/" for example, it runs without any issues. Apart from that, Windows Users can log in to the Linux machine now, so I am happy with that

 

Thank you for the advice jinnantonnixx couldn't have done it without you

[jinnantonnixx]

Ah. In this case a reboot might be necessary as realmd might not have restarted the services properly.

See if that helps.

[Geoff]

I'm using sssd on Ubuntu 16.04.2 LTS. My sssd.conf looks like this:

 

[nss]
filter_groups = root
filter_users = root, admin
reconnection_retries = 3

[pam]
reconnection_retries = 3

[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = domain.co.uk

[domain/domain.co.uk]
#With this as false, a simple "getent passwd" for testing won't work. You must do getent passwd [email protected]
enumerate = false
cache_credentials = true

case_sensitive = false

id_provider = ldap
access_provider = ldap
auth_provider = krb5
chpass_provider = krb5

ldap_uri = ldaps://dc1.domain.co.uk,ldaps://dc2.domain.co.uk
ldap_search_base = dc=domain,dc=co,dc=uk
ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt

#This parameter requires that the DC present a completely validated certificate chain. If you're testing or don't care, use 'allow' or 'never'.
ldap_tls_reqcert = allow

krb5_realm = DOMAIN.CO.UK
dns_discovery_domain = DOMAIN.CO.UK

ldap_schema = rfc2307bis
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true

ldap_user_search_base = dc=domain,dc=co,dc=uk
ldap_group_search_base = dc=domain,dc=co,dc=uk
ldap_user_object_class = user
ldap_user_name = sAMAccountName
ldap_user_fullname = displayName
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_group_object_class = group
ldap_group_name = sAMAccountName
#Bind credentials
ldap_default_bind_dn = cn=~sssd,cn=Users,dc=domain,dc=co,dc=uk
ldap_default_authtok = Secret Password

 

Change the LDAP server names, the ldap search dn's, bind dn, bind password, kerberos realm and DNS domain to match your AD config.

 

On the Windows AD side I have Services for Unix installed. So you get an extra tab in the AD properties for users / groups. You must configure these for the above config to work. You must also configure at least one group with NIS properties. If you don't do this, you'll have no shell and no primary unix group.

 

 

You'll also discover once you have the above setup you don't have a home directory. use pam_mount with the following config:

 

 

And you'll find you have a working home directory mapped to you windows user share (correct the path as appropriate for your environment).

[McChikenhanger]

Thank you Geoff. I will play around with that too. I had the UNIX attributes installed on AD already, but wasn't really sure why they were there for