Authenticating Linux clients against MS Active Directory
Contents |
Authenticating Linux clients against MS Active Directory
The page describes the necessary steps to enable Ubuntu 12.04 clients to authenticate users against AIT's Active Directory (AD) server. Groups and settings in DTU-Basen can be used on the clients, as well as, user home directories from dtu-storage.
The setup is heavily inspired by the following manual for RHEL systems: Linux-AD
Install Samba and Kerberos:
$ sudo apt-get install samba krb5-user winbind smbfs
Setup Kerberos (/etc/krb5.conf):
[libdefaults]
default_realm = WIN.DTU.DK
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
WIN.DTU.DK = {
default_domain = win.dtu.dk
}
[domain_realm] .win.dtu.dk = WIN.DTU.DK win.dtu.dk = WIN.DTU.DK
Setup Samba (/etc/samba/smb.conf):
#======================= Global Settings =======================
[global] workgroup = WIN server string = kapok syslog = 0
panic action = /usr/share/samba/panic-action %d
security = ADS realm = WIN.DTU.DK netbios name = elek-aut-01
idmap config * : backend = rid idmap config * : range = 5000-100000000 idmap config * : base_rid = 0 template shell = /bin/bash template homedir = /home/%D/%U winbind use default domain = true winbind offline logon = false winbind enum users = No winbind enum groups = No winbind nested groups = Yes allow trusted domains = No
Add the machine to the AD
Get a Kerberos ticket by issuing:
$ sudo kinit <campusnet-login>@WIN.DTU.DK
Add the PC to the AD domain by issuing:
$ sudo net ads join -U <campusnet-login>
The PC name needs to start with "elek-" (when dealing with DTU-Elektro machines). The name should be the same as "netbios name" in the Samba configuration file. Dual-boot Windows machines that already has an "elek-" name must be given a different name to avoid conflicting AD instances. (Even WinXP and Win7 can't share the same AD instance).
Add Winbind to the nsswitch configuration. (/etc/nsswitch.conf):
passwd: nis compat winbind group: nis compat winbind shadow: nis compat winbind hosts: files dns wins mdns4 networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis
Check that
$ wbinfo -u
gives a list of all AD users. (This might take a while).
Automatic mounting of home directory
By installing "pam_mount" it is possible to automatically mount AD users home directory upon login. The package is installed by:
$ sudo apt-get install libpam-mount
A skeleton homedrive (mount point) can be created using pam_mkhomedir. This is done by adding session required pam_mkhomedir.so skel=/etc/skel umask=0077 to /etc/pam.d/common-session just before pam_mount. Listing of /etc/pam.d/common-session:
session [default=1] pam_permit.so session requisite pam_deny.so session required pam_permit.so session optional pam_umask.so session required pam_unix.so session optional pam_winbind.so session required pam_mkhomedir.so skel=/etc/skel umask=0077 session optional pam_mount.so session optional pam_ck_connector.so nox11
A somewhat working pam_mount configuration is (/etc/security/pam_mount.conf.xml):
<?xml version="1.0" encoding="utf-8" ?> <!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd"> <pam_mount> <debug enable="1" /> <mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" /> <mntoptions require="nosuid,nodev" /> <logout wait="100000" hup="yes" term="yes" kill="no" /> <volume pgrp="domain users" server="dtu-storage.win.dtu.dk" path="" mountpoint="home/WIN" fstype="cifs" /> <cifsmount>mount -t cifs //%(SERVER)/%(USER) %(MNTPT)/%(USER) -o "username=%(USER),uid=%(USERUID),gid=%(USERGID),file_mode=0700,dir_mode=0700%(before=\",\" OPTIONS)" </cifsmount> <umount>umount %(MNTPT)/%(USER)</umount> <mkmountpoint enable="1" remove="false" /> </pam_mount>
There are problems with multiple mounts and mounts that hang upon logout.
