So you have a RHEL system and you want to authenticate it against your active directory. The good news is that Red Hat has made it easy for you to do this. The bad news is that they only get the most basic structure working for you. Here I will show you how to get WinBind authentication working using Authconfig, and how make it a little more seamless than this utility leaves it off.
It should be noted that while this works perfectly well, it is really not the best way to authenticate users against a UNIX host. Given the option, having your users in Open Ldap and PAM authenticating them against that would be a much better option. However, we don’t live in a perfect world, and sometimes we just have to make things work.
Let’s start by using authconfig to join your machine to the domain. This should all be done as the root user.
# authconfig
- Select “Use Winbind” and Use “Winbind Authentication”. Remember to leave “Cache Information”, “Use MD5 Passwords” and “Use Shadow Passwords” selected.
- Select “Next”
- Under “Security Model” select “ads”
- “Domains:” examplead (substatute with the name of your Active Directory)
- “Domain Controllers:” adserver.domain.com (Again, substitute with the name of your Active Directory server)
- “ADS Realm:” ADSERVER.DOMAIN.COM
- “Template Shell:” /bin/bash
- Select “Join Domain”
- Select “OK”
Now your machine should be be on the domain. Test it to make sure you can see your AD users:
# wbinfo -u
You should see your users in the list.
The only problem is that to do anything with them, you have to express their user name in that annoying way Windows likes you to. Something like this:
“EXAMPLEAD\\username”
Not very usefull. To get around this, simply edit “/etc/samba/smb.conf” and change this line:
winbind use default domain = no
to this:
winbind use default domain = yes
You should now be able to express AD usernames without the domain nonsense before it. Try it:
# finger username
Login: username Name: Username
Directory: /home/EXAMPLEAD/username Shell: /bin/bash
Never logged in.
No mail.
No Plan.
Finally check your “/etc/nsswhich.conf” file to make sure RHEL knows to use WinBind. Authconfig should have set this up for you, and it should have lines that look like this:
passwd: files winbind
shadow: files winbind
group: files winbind
That should do it you should be able to create home directories for all your AD users and let them authenticate away. Have fun.
Reply
How does this get the username and password of a domain administrator that has the ability to add the computer to the domain? Or must “net ads join” be used if a username and password is required to add a user?
Thanks,
-Mont
Reply
Hi Mont,
If I remember correctly, authconfig asks for this information before it attempts to join the machine to the domain.
Reply
Thanks, I’ll give it a try. I had specifically read something that had said not to join the domain from within authconfig so I was curious when I saw your post.
Reply
Hey Mont,
Let me know how it goes. I confess that I needed to get this task done quickly, so I saw authconfig as my best bet. I know there is a way to do it on the command line as well. It pretty much just worked for me, so hopefully it will do the same for you
Reply
I’m looking for a way to provide single-sign-on to an environment without having to explicitly configure every single UNIX client to join the domain and auth against the ADS; my thought was to set up an LDAP server which would perform the authentication against the ADS by proxy.
Is this possible? I have Solaris, HP and Linux clients, all of which I wish to be able to use single-sign-on.
Help?
Reply
[...] If you want to avoid entering the logon name as domainnameusername, then it is possible to configure a default domain for Winbind to use. [...]
Reply
how to configure a squid server
all commands step by step
Reply
Follow these instructions to have your users directories automatically created….
http://kbase.redhat.com/faq/FAQ_43_5367.shtm