inutility.net



« | »

Debian Squeeze, Active Directory & Samba

[Updated 30/10/2012 to include a configuration option to stop timeout errors]

This originally started as a note to myself should I ever need to revisit this, but I have expanded it a bit to make it a bit more general in case others might find it useful.

I use Debian Squeeze on our Linux servers. I have been trying to get them to authenticate off of our Active Directory/Windows Server 2008. Previously we used OpenLDAP and this worked well, but with AD I’d rather have one authentication system. One password rather than two.

My experience with Winbind has not been favourable. Despite documentation and plenty of blogs with well written examples of how to do it I could not get it to work for me. Most of what is written is from there.

In this blog I will use the following settings on my network which I will use in my examples. You will wish to change them to reflect your own settings:

server1.int.inutility.net – 192.168.188.10 – Windows Active Directory & WINS server
server2.int.inutility.net -  192.168.188.11 – Windows Active Directory server
linux.int.inutility.net – 192.168.188.20 – Debian Linux box to authenticate against AD
INUTILITY – Windows Domain
INT.INUTILITY.NET – Kerberos/AD Realm

Preparation

Active Directory

You can edit this using the “Active Directory Users & Computers” program on your Windows server, finding a user (or group) and going to the “UNIX Attributes” tab. If you do not have this tab then you are missing the “Identify Management for UNIX” role, and you probably want to investigate that before following this.

DNS

If you are just using Windows DNS and Windows DHCP then you are probably already set for this and can probably skip this section.

You need to make sure your domain name is correct.  If you use a mixture of Windows & Linux services (for DHCP & DNS) then you need to make sure your /etc/resolv.conf has the correct “domain” setting to match the DNS of your Windows servers. If not it is possible you may experience a problem later. This may be set manually or automatically from your DHCP server

Secondly you need to make sure your Windows DNS servers are configured. My /etc/resolv.conf is

domain int.inutility.net
search int.inutility.net
nameserver 192.168.188.10
nameserver 192.168.188.11

NTP

It’s good practice to have time syncronised up. My Windows servers both provide NTP service.

apt-get install ntp

Edit the /etc/ntp.conf file, commenting out the existing debian servers and adding in your servers

Line 21

#server 0.debian.pool.ntp.org iburst
#server 1.debian.pool.ntp.org iburst
#server 2.debian.pool.ntp.org iburst
#server 3.debian.pool.ntp.org iburst

server server1.int.inutility.net iburst
server server2.int.inutility.net iburst

You will then need to restart the NTP daemon:

/etc/init.d/ntpd restart

This may take some time to syncronise your Debian server’s clock with that of the Windows Servers’. Check your syslog. ntpd -q will report information on your time servers and syncronisation.

Installation

LDAP Authentication

This allows you to authenticate your users against the Active Directory using LDAP. It allows you to SSH into your server as your AD users and is required to access your server using Samba.

apt-get install libnss-ldapd libpam-ldapd nslcd unscd

This is not to be confused to libpam-ldap and libnss-ldap (no d at the end) which are older methods of LDAP authentication that I have not satisfactorily got working with Active Directory.

It will ask you a few questions while the packages install. For LDAP server URI I entered both my AD servers:

ldap://server1.int.inutility.net/ ldap://server2.int.inutility.net/

You can leave it at one server, or add as many as you want separated by spaces.

You will be asked for your LDAP server search base. It will guess this based on your DNS domain, but sometimes it gets the ending wrong (espcially with country codes). I entered:

dc=int,dc=inutility,dc=net

You will then need to select the Name Services to use with LDAP. Select “group“, “passwd” and “shadow“. It will then finish installation, but there is still a bit to be configured.

It will automatically edit your PAM files (in /etc/pam.d) and your /etc/nsswitch.conf with correct entries so you do not have to unless your set up is a bit unusual. For historical reasons our UIDs start at 500 so I edited the /etc/pam.d/common-* files so the “minimum_uid” entry was 500, not the default 1000.

I use TLS encryption to my servers, using a certificate we have purchased. It requires intermediate certificates which it terms a bundle. You may not require the “tls_cacertfile” entry, but you may require the “ca-certificates” Debian package installed. The “bundle” can be an intermediate chain of Certificate Authorities. Your SSL certificate provider will provide this. Using the “tls_reqcert demand” entry makes sure that if the certificate is not verified the connection will not proceed. Add the following lines to your /etc/nslcd.conf:

# SSL options
ssl starttls
tls_reqcert demand
tls_cacertfile /etc/ssl/certs/bundle.crt

You also require some entries in this file so it knows where to pull all the user information from. Again this is in /etc/nslcd.conf

# Mappings for Active Directory
pagesize 1000
referrals off
filter passwd (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
map    passwd uid              sAMAccountName
map    passwd homeDirectory    unixHomeDirectory
map    passwd gecos            displayName
filter shadow (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
map    shadow uid              sAMAccountName
map    shadow shadowLastChange pwdLastSet
filter group (&(objectClass=group)(gidNumber=*))
map    group  uniqueMember     member

After restarting nslcd you should then be able to check users & groups are listed using the getent tool:

/etc/init.d/nslcd restart
Restarting LDAP connection daemon: nslcd.
getent passwd al
al:*:1000:100:Al:/home/al:/bin/bash

You should now be able to SSH into your machine as your Active Directory users, though they may not have home directories (see also the section “Automatic creation of user’s home directory” towards the bottom of the page).

Kerberos

Install the Kerberos packages:

apt-get install krb5-config krb5-user

Then edit /etc/krb5.conf to include entries for your realm:

[libdefaults]
 default_realm = INT.INUTILITY.NET

and

[realms]
        INT.INUTILITY.NET= {
                kdc = 192.168.188.10:88
                admin_server = 192.168.188.10
                default_domain = int.inutility.net
        }
        ATHENA.MIT.EDU = {

and

[domain_realm]
        .int.inutility.net = INT.INUTILITY.NET
        int.inutility.net = INT.INUTILITY.NET
        .mit.edu = ATHENA.MIT.EDU

Samba

Firstly you’ll need to install the samba packages:

apt-get install samba samba-common samba-common-bin

I was asked only for my “Workgroup/Domain Name” which I entered in as “INUTILITY” during installation.

Then you need to make some edits to your /etc/samba/smb.conf.

Add the Kerberos realm:

# Change this to the workgroup/NT-domain name your Samba server will part of
   workgroup = INUTILITY
   realm = INT.INUTILITY.NET

Add in WINS server:

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
   wins server = 192.168.188.10

To use Active Directory security:

# "security = user" is always a good idea. This will require a Unix account
# in this server for every user accessing the server. See
# /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html
# in the samba-doc package for details.
   security = ads

To configure SAMBA not to be the master browser for the domain.

# Domain Master specifies Samba to be the Domain Master Browser. If this
# machine will be configured as a BDC (a secondary logon server), you
# must set this to 'no'; otherwise, the default behavior is recommended.
   domain master = no
   local master = no
   preferred master = no

Restart the samba services to load these settings.

/etc/init.d/samba restart

Joining the domain

You can not joing the domain with the following command (or another administrator account can be used)

net ads join -U Administrator

This suceeds, but reports:

kerberos_kinit_password LINUX$@INT.INUTILITY.NET failed: Client not found in Kerberos database

This is something I’ve not been able to trace down yet, but everything works as expected. I have been advised that this may in fact be down to our incorrect reverse DNS.

You should now be able to access the machine using \\LINUX as per a normal Windows server.

Other useful things

Automatic creation of user’s home directory

If you edit /etc/pam.d/common-session you can add an entry to automatically create a user’s home directory upon login:

session     required      pam_mkhomedir.so skel=/etc/skel umask=0022 silent

This saves you having to manually copy the /etc/skel files for any users who have not logged into the system before.

Leaving the AD Domain

This can be done using the command below and removes your computer’s entry from the Active Directory:

net ads leave -U Administrator

Update 30/10/2012: LDAP timeouts

Occasionally we get the following messages in our syslog:

ldap_search_ext() failed: Can't contact LDAP server
connected to LDAP server ldap://server1.int.inutility.net/

These seem to be due to the AD server(s) timing out the connection without nslcd noticing this, which while not fatal is annoying and can slow down resolving a username & their groups. AD seems to timeout the connections after 2 minutes.

If you put:

idle_timelimit 60

Into your /etc/nslcd.conf file this will disconnect after a minute and reconnect as needed which is a much faster process than the connection failure it was doing.

 

Posted by on Thursday 4th August 2011.

Tags: , , , , , , ,

Categories: Debian, linux, Work

5 Responses

  1. [...] ssh activedirectory". These links all seem worthwhile, with the first one quite recent: http://inutility.net/work/debian-squ…witcher=mobile http://zeldor.biz/2010/12/debian-join-windows-domain/ [...]

    by Winbind and SSH on Jan 5, 2013 at 4:24 am

  2. You were doing so well and then at “# Mappings for Active Directory” I totally couldn’t figure out *what file* to edit at all.

    by Rudolf on Jan 25, 2013 at 8:31 am

  3. Yes I seem to have omitted that accidentally. The file for “Mappings for Active Directory” and “SSL Options” above it should be in /etc/nslcd.conf. Will have to amend this entry. Thanks!

    by al on Jan 25, 2013 at 10:16 am

  4. Perfect. My AD requires a valid user to do LDAP lookups and had a heck of a time trying to authenticate the openLDAP way until I remembered that it was Windows and it wanted the username@domain.net format. *facepalm*

    Also, I noticed that the home directories in samba default to read only. I needed to add in “read only = no” to the right bits to be able to write.

    by Chris Bachmann on Feb 13, 2013 at 9:31 pm

  5. thank you it was almost perfect map group uniqueMember member I had to # out but it authenticated and my server is now available by name.

    by john on Dec 17, 2013 at 6:26 pm

Leave a Reply

 

« | »




Recent Posts


Pages



About inutility.net

This blog is the random notes, thoughts (and occasional deeds) relating to Debian, working, playing and general living.more →

Switch to our desktop site