Linux authenticates using AD ?

Just wondering if that is even remotely possible.
I did join a Linux server to the domain just fine but I am wondering if there is a way so the linux server replicates the AD User so the user doesn't have to be manually created on the linux server ?

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

Bl8ckr0uter

It's possible. There are several ways to do it. I can't think of the name of the tool that o used to do it but I will find a link and post it.

Bl8ckr0uter

Wait I misread the question on my phone. Disregard what I said.

Claymoore

Services for Unix is a Windows component that used to be a separate MS product but was integrated into Server 2003 R2 and later.
Windows Server 2008 UNIX Interoperability Components

You can sychronize a *Nix NIS directory to AD. I've never used that part of SFU, but I have played with the NFS sharing. For a full Single Sign-On solution you should look at the MIIS/IIFP, ILM and Forefront products.
Should Microsoft Identity Integration Server Be Part of Your Security Plan?
Download details: Identity Integration Feature Pack for Microsoft Windows Server Active Directory with Service Pack 2 (SP2)
Microsoft Identity Lifecycle Manager 2007 FP1
Microsoft Forefront Identity Manager: home page

jibbajabba

Claymoore wrote: »

Services for Unix is a Windows component that used to be a separate MS product but was integrated into Server 2003 R2 and later.
Windows Server 2008 UNIX Interoperability Components

You can sychronize a *Nix NIS directory to AD. I've never used that part of SFU, but I have played with the NFS sharing. For a full Single Sign-On solution you should look at the MIIS/IIFP, ILM and Forefront products.
Should Microsoft Identity Integration Server Be Part of Your Security Plan?
Download details: Identity Integration Feature Pack for Microsoft Windows Server Active Directory with Service Pack 2 (SP2)
Microsoft Identity Lifecycle Manager 2007 FP1
Microsoft Forefront Identity Manager: home page

Seems a bit overkill. Basically I am not trying to sync *nix user to AD, but I need to be able to create a user in AD which is then able to login to *nix server in that domain .. I suppose I could use LDAP on Linux but I never done anything remotely so I don't really know ...

it_consultant

Red Hat and SUSE both support AD integration, either through a traditional LDAP route or through the individual AD supported binaries (I think its called winbind) in either release. I have joined *nix servers to Active Directory domains before, wherein domain accounts were able to log in to the *nix servers.

Active Directory Integration with Samba for RHEL/CentOS 5 ?? Linux Mail Server Setup and Howto Guide

http://www.linuxmail.info/active-directory-single-sign-on/

Bl8ckr0uter

Gomjaba wrote: »

Seems a bit overkill. Basically I am not trying to sync *nix user to AD, but I need to be able to create a user in AD which is then able to login to *nix server in that domain .. I suppose I could use LDAP on Linux but I never done anything remotely so I don't really know ...

Oh I don't think I misread. I used likewise to allow AD users to log into windows machines. It is simple to set up but it does have some outstanding issues (specifically PAM stack issues in debian/ubuntu that makes it impossible to manage local users once likewise is installed).

Likewise Open Source Software that Authenticates Linux, Unix, and Mac systems with Microsoft Active Directory

There are many other ways to do this but this is probably the fastest.

Devilsbane

I've seen linux boxes log into AD. Where I work we have a few Mac machines that login to AD (creates many headaches)

MentholMoose

Likewise is an easy and free option but you have to install it. Another option in winbind which is included by default with Samba in most distributions. If you already joined the server to the domain and you didn't install anything then you are likely using winbind and just need to configure it.

sidsanders

this is what i do: nss_ldap -- set your attribute/object class maps to sfu3/3.5/r2, ldap server is your dc(s). enable pam_krb5 -- set the kdc's to your dc(c) -- config krb5.conf basically. ldap for name lookups, krb5 for auth. only have to install rpms that ship with later linux distros... RH EL< 4, SuSe EL < 10 (9 maybe the cut off, dont recall), you probably have to get rpms, or build from source upgraded openldap libs to do the schema mappings (paged results, more advanced ldap client features).

later RH EL, SuSe EL, centos, oracle EL will all work.

this works for solaris 7-10 (plus opensolaris) as well, older vers < 10 will need some help. the as shipped ldap and krb5 sw is too old. aix, tru64, hpux offer some diff sw to do the same thing.

you can get fancy with extracting principals (from ad using ktpass) for ssh (or any service that uses a host/fqdn@REALM), ftp, etc... you can then use vintela/quest putty to do sso via ssh (nice, though pki works with as well).

Chris:/*

There are many products out there that allow you to completely manage your Unix/Linux systems completely through AD.

Tools such as Quest Authentication Services (formerly know as Vintela AS) are available. I placed this one here as an example not as a the way you should do it. There are some open source versions you can do a google and compare their capabilities.

jibbajabba

MentholMoose wrote: »

Likewise is an easy and free option but you have to install it. Another option in winbind which is included by default with Samba in most distributions. If you already joined the server to the domain and you didn't install anything then you are likely using winbind and just need to configure it.

Heh cheers, just tested it and it just .... works .. executed the rpm, joined domain - done ..

Ta

Bl8ckr0uter

Gomjaba wrote: »

Heh cheers, just tested it and it just .... works .. executed the rpm, joined domain - done ..

Ta

Make sure you take a look and see if it is having any issues. I ran into my first problem with it when I tried to change the root password. Just keep that in mind because I had to format and start over to fix it.

Here is the bug I was talking about:

https://bugs.launchpad.net/ubuntu/+source/likewise-open/+bug/302026

Maybe it is only a ubuntu/debian thing but try to change the local password when you get a chance.

Chris:/*

I guess I misunderstood what you were trying to accomplish.

jibbajabba

Bl8ckr0uter wrote: »

Make sure you take a look and see if it is having any issues. I ran into my first problem with it when I tried to change the root password. Just keep that in mind because I had to format and start over to fix it.

Here is the bug I was talking about:

https://bugs.launchpad.net/ubuntu/+source/likewise-open/+bug/302026

Maybe it is only a ubuntu/debian thing but try to change the local password when you get a chance.

Cheers for the tip. What I now tried is

1. Reboot
2. logged in via SSH using root
3. changed root pw
4. created a new user in AD
5. logged in with that user via SSH
6. reboot
7. logged in via SSH using random AD user

All seems to work fine (using CentOS). I do get "Authentication token manipulation error
" when I try to use passwd in order to change the password of an AD user rather than the local root which makes sense really.