Integrate Ubuntu clients into AD

[Number6]

Is there a way to set up an Ubuntu client so that the user logs in to the domain via the same type of login screen as a Windows client?

 

I'm familiar with setting up Ubuntu with Samba, Winbind, etc but I'd like to be able to set up a box for staff to try that they can log into in a "familiar" fashion.

 

Is this possible in any way?

 

Or with a different Linux flavour?

[srochford]

Likewise Open Source Software that Authenticates Linux, Unix, and Mac systems with Microsoft Active Directory

 

Not quite sure what you're looking to do - this won't look like Windows, you'll still get the Ubuntu login screen but you will log in with your normal Windows credentials.

[Marc]

Likewise works well, much easier than having to configure samba/winbind manually - only thing to note is that it expects the user name in the DOMAIN\user format

[Tyiell]

Agreed with the above, but I found a bug with likewise a few months ago when I last tried this (on Ubuntu 10.4 Karmic, so may have been fixed), installing and configuring Likewise seems to stop passwd command working in terminal. Random but true.

 

It didn't affect me at the time and since then it's been rebuilt using winbind/samba instead so not sure if its still an issue.

[Number6]

Likewise is installed, if I open it from the System > Admin menu it tells me I'm joined to the domain but there's no option that I can see to use it as a login screen.

 

If I attempt to log in as "other" and enter domain\username, it prompts for the password but then gives me an authentication failure.

[dhicks]

Is there a way to set up an Ubuntu client so that the user logs in to the domain via the same type of login screen as a Windows client?

 

Both Samba and Likewise-Open should work. We've been using Likewise-Open, but I was going to try re-installing our Edubuntu server over half term and was planning to use Samba as setting that up has proven to be easier than I remembered.

 

For our current Ubuntu workstations, there seemed to be a problem with Likewise-Open starting properly. I have the in my how-to-set-up-a-workstation notes:

 

Sort authentication
===================
apt-get install likewise-open5
domainjoin-cli join CONVENT.altonconvent.org.uk administrator

If this is a virtual machine, sort the time issue:
echo 1 > /proc/sys/xen/independent_wallclock

edit /etc/rc.local:
add line:
sleep 5
/etc/init.d/lsassd restart

edit /etc/likewise-open5/lsassd.conf:
Uncomment line:
assume-default-domain = yes

edit /etc/sudoers

%CONVENT.altonconvent.org.uk\\domain^admins ALL=(ALL) ALL

Reboot

 

I think it's the "assume-default-domain = yes" in /etc/likewise-open5/lsassd.conf that lets you avoid having to type the domain in to log in, the workstation automatically tries a domain login first.

 

If you tried Samba, was there some problem getting it to work?

 

Don't forget you still need to have an appropriate Windows CAL for your machine to authenticate against the domain controller.

 

--

David Hicks

[Number6]

No, the machine is joined to the domain OK and I can view all the appropriate shares. All I want to do is to have the PC present a login screen that allows entry of the AD username and password.

 

Currently I can only log onto the PC as the local user, albeit that once logged in the PC is a member of the domain but I want to be able to log in as the AD user.

[dhicks]

All I want to do is to have the PC present a login screen that allows entry of the AD username and password.

 

Have you tried adding "assume-default-domain = yes" to /etc/likewise-open5/lsassd.conf?

 

--

David Hicks

[Number6]

Have you tried adding "assume-default-domain = yes" to /etc/likewise-open5/lsassd.conf?

 

--

David Hicks

 

There's no such file on my system.

 

I have a directory called /etc/likewise-open and the only .conf file in there is likewise-krb5-ad.conf

[sideh]

I've just finished implementing this at work. 1 Domain Controller with windows and linux (ubuntu 10.04) clients.

 

With the ubuntu clients, authentication was done against AD like a normal login through gdm. They could change their AD password with the passwd command and a bunch of other stuff. When you say normal login, I take it you mean a login through gdm as you would do with a local account?

 

I did try likewise-open initially but it was awfull. I managed to get it working and after a reboot it broke again. Winbind is farly easy to setup and it's perfectly possible to write a script to join a machine to a domain, something I'm planning on doing as it's all manual at the moment. I used the ubuntu wiki, there's some AD stuff on there.

 

I still have my notes from my install which I can write up if you like.

[dhicks]

With the ubuntu clients, authentication was done against AD like a normal login through gdm.

 

Is this using Samba to join the Windows domain? I've got Samba working for individual Ubuntu 10.04 workstations, but unfortunately I couldn't then get LTSP clients running off a 10.04 server to log in - they seemed to authenticate okay, but after starting to open a session they would return to the LTSP login screen. I posted this a little while ago:

 

http://www.edugeek.net/forums/thin-client-virtual-machines/50757-new-version-ltsp.html#post522975

 

I'm now trying Likewise-Open instead of Samba (I've left the server rebuilding the LTSP boot image overnight). It seems okay so far. As pointed out in that other post, the trick seems to be to install via the commandline utility rather than the GUI.

 

I still have my notes from my install which I can write up if you like.

 

Please do - I could well have missed something in my Samba setup, I'd like to know what I did wrong!

 

--

David Hicks

Edited June 10, 2010 by dhicks

[sideh]

I didn't use samba at all on clients. Just winbind, which uses stuff from /etc/samba/smb.conf. Then added winbind stuff to /etc/nsswitch.conf. There's a bit more to it but I'll get my notes tomorrow and write something up.

[dhicks]

Anyone had any luck getting Ubuntu 10.04, joined to a domain via Likewise-Open, to mount user home folders when they log in? I've found this page:

 

https://help.ubuntu.com/community/UbuntuLTSP/ActiveDirectoryIntegration

 

But that seems to be 9.04 specific - anyone know if it still holds for 10.04? Also, I know I can use a script to run gvfs-mount when the user logs in (i.e. place a line like "gvfs-mount "smb://acsfiles003/My Documents" in a GUI-environment startup script somewhere), but that just gives each user a link to "My Documents" on their desktop, all software still saves locally to the server's harddrive. The server is obviously capable of authenticating properly and mounting a volume, so how do I get /home/$username replaced with a network mount?

 

--

David Hicks

[sideh]

I've written up the winbind stuff here: Ubuntu 10.04 Active Directory Authentication | Run Level 3 Hope it helps.

 

As for mounting home folders why not use nfs? You can export them from an ubuntu server as long as its also joined to the domain so that users ids match.

[dhicks]

As for mounting home folders why not use nfs? You can export them from an ubuntu server as long as its also joined to the domain so that users ids match.

 

"Also joined to the domain" as joined via Likewise-Open rather than Samba? Our file server is currently joined via Samba, so the UIDs and GIDs don't match when seen from a machine joined via Likewise-Open. I assume Likewise-Open automatically gives you a consistent mapping of UIDs/GIDs accross different machines?

 

Edit: the above is actually quite easy to accomplish, I've already re-installed the file server once, I'll just have to wait until a weekend to do it again, so your suggestion is a good one, thanks. Just to warn anyone coming here via Google looking for how to connect an Ubuntu 10.04 machine to an Active Directory server: the above Winbind stuff works fine, but LTSP clients running off a Winbind-connected server don't seem to authenticate/login properly - Likewise-Open seems rather more reliable than that (which, of course, implies that any Linux-based central file server will need to be joined to the domain via Likewise-Open too, as mentioned above).

 

--

David Hicks

Edited June 11, 2010 by dhicks

[sideh]

Yeah, if they're both joined via likewise-open you should be ok. I know winbind uses the last 4 digits of the user's sid in AD so likewise probably does the same, meaning that uids and gids they'll be the same from all machines.

[Guest monkeyx]

Sorry to open a slightly old thread, but I have not been using this site for a while until recently.

 

I have documented how to join Ubuntu 10.04 to AD network (2003 forest functional level). I was having issues with likewise so did it via samba and winbind. We got home drive mappings fine and we did not have to prefix logins with a domain name. I was getting some strange issues with pam authorisation orders that I think could be related to me not using Likewise. Need to do more testing on this, as the documentation is some what contradictory on what to do

 

Looking for feedback from others on whether likewise or samba/windbind is the best method to join Ubuntu 10.04 to AD. ALso has anyone tested this working on 2008r2 forest functional level?

 

Thanks,

 

Tim

[dhicks]

Looking for feedback from others on whether likewise or samba/windbind is the best method to join Ubuntu 10.04 to AD.

 

I had problems getting our LTSP server to authenticate against Active Directory (Server 2008) - this post is most relevant:

 

http://www.edugeek.net/forums/nix/48032-configuring-samba.html#post520684

 

--

David Hicks

[morganw]

There is now also Centrify DirectControl Express to integrate *nix systems with AD. Haven't tested it, but have tested the non-free version and was very impressed.