Authenticating Active Directory Users on Linux: Clients + Samba Shares
In this video I will demonstrate how to have Linux machines authenticate users using Active Directory. I will show how to add an Ubuntu client to your Windows Domain as well as showing you how to create samba shares on a Debian server whilst authenticating users with Active Directory credentials.
This video has been made for the course "Linux Operating Systems" in my Bachelor's Degree Program NMCT.
http://www.nmct.be
Sssd vs Winbind:
http://rhelblog.redhat.com/2015/04/02...
sssd.conf on Ubuntu:
====================
[sssd]
services = nss, pam
config_file_version = 2
domains = EXAMPLE.COM
[domain/EXAMPLE.COM]
id_provider = ad
access_provider = ad
Use this if users are being logged in at /.
This example specifies /home/DOMAIN-FQDN/user as $HOME. Use with pam_mkhomedir.so
override_homedir = /home/%d/%u
Uncomment if the client machine hostname doesn't match the computer object on the DC.
ad_hostname = mymachine.example.com
Uncomment if DNS SRV resolution is not working
ad_server = dc.example.com
Uncomment if the AD domain is named differently than the Samba domain
ad_domain = EXAMPLE.COM
Enumeration is discouraged for performance reasons.
enumerate = true
====================
Krb5.conf on Debian:
====================
[libdefaults]
ticket_lifetime = 24h
default_realm = EXAMPLE.COM
forwardable = true
[realms]
EXAMPLE.COM = {
kdc = 192.168.100.2
default_domain = EXAMPLE.COM
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
[kdc]
profile = /etc/krb5kdc/kdc.conf
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
[logging]
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log
default = FILE:/var/log/krb5lib.log
====================
smb.conf on Debian:
====================
[global]
No .tld
workgroup = EXAMPLE
Active Directory System
security = ads
With .tld
realm = EXAMPLE.COM
Just a member server
domain master = no
local master = no
preferred master = no
Disable printing error log messages when CUPS is not installed.
printcap name = /etc/printcap
load printers = no
Works both in samba 3.2 and 3.6.
idmap backend = tdb
idmap uid = 10000-99999
idmap gid = 10000-99999
no .tld
idmap config EXAMPLE:backend = rid
idmap config EXAMPLE:range = 10000-99999
winbind enum users = yes
winbind enum groups = yes
This way users log in with username instead of [email protected]
winbind use default domain = yes
Inherit groups in groups
winbind nested groups = yes
winbind refresh tickets = yes
winbind offline logon = true
Becomes /home/example/username
template homedir = /home/%D/%U
No shell access
template shell = /bin/false
client use spnego = yes
client ntlmv2 auth = yes
encrypt passwords = yes
restrict anonymous = 2
log file = /var/log/samba/samba.log
log level = 2
[Private]
comment = For dlgprivatefileusers only
path = /shares/private
valid users = @EXAMPLE\dlgprivatefileusers
force group = "domain users"
writable = yes
read only = no
force create mode = 0660
create mask = 0777
directory mask = 0777
force directory mode = 0770
access based share enum = yes
hide unreadable = yes
[Public]
comment = For all domain users
path = /shares/public
valid users = "@EXAMPLE\Domain Users"
force group = "domain users"
writable = yes
read only = no
force create mode = 0660
create mask = 0777
directory mask = 0777
force directory mode = 0770
access based share enum = yes
hide unreadable = yes