“UbuntuHelp:ActiveDirectoryWinbindHowto”的版本间的差异
来自Ubuntu中文
小 |
小 |
||
第1行: | 第1行: | ||
{{From|https://help.ubuntu.com/community/ActiveDirectoryWinbindHowto}} | {{From|https://help.ubuntu.com/community/ActiveDirectoryWinbindHowto}} | ||
{{Languages|UbuntuHelp:ActiveDirectoryWinbindHowto}} | {{Languages|UbuntuHelp:ActiveDirectoryWinbindHowto}} | ||
+ | == Introduction == | ||
This Howto describes how to add a Ubuntu box in a Active Directory domain and to authenticate the users with AD. | This Howto describes how to add a Ubuntu box in a Active Directory domain and to authenticate the users with AD. | ||
− | + | === Used terms === | |
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
{|border="1" cellspacing="0" | {|border="1" cellspacing="0" | ||
|'''term'''||'''definition''' | |'''term'''||'''definition''' | ||
第40行: | 第25行: | ||
|ntp.example.com||timeserver (NTP) | |ntp.example.com||timeserver (NTP) | ||
|} | |} | ||
− | == | + | == Kerberos == |
− | The first step | + | The first step in joining an Active Directory domain is to install and configure Kerberos. See [[UbuntuHelp:Samba/Kerberos|Samba/Kerberos]] for details. |
− | + | == Join AD domain == | |
− | + | === Required software === | |
− | + | You need to install the '''winbind''' and '''samba''' packages. The packages '''smbfs''' and '''smbclient''' are useful for mounting network shares and coping files. | |
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | You need to install the '''winbind''' and '''samba''' packages. | + | |
− | + | ||
https://help.ubuntu.com/community/IconsPage?action=AttachFile&do=get&target=IconNote.png The package ''smbfs'' is optional, but includes useful client utilities, including the '''smbmount''' command. Also useful is the ''smbclient'' package, which includes an FTP-like client for SMB shares. | https://help.ubuntu.com/community/IconsPage?action=AttachFile&do=get&target=IconNote.png The package ''smbfs'' is optional, but includes useful client utilities, including the '''smbmount''' command. Also useful is the ''smbclient'' package, which includes an FTP-like client for SMB shares. | ||
− | + | === Join === | |
+ | The first step in joining the Active Directory domain is to edit <code><nowiki>/etc/samba/smb.conf</nowiki></code>: | ||
file: <code><nowiki> /etc/samba/smb.conf </nowiki></code> | file: <code><nowiki> /etc/samba/smb.conf </nowiki></code> | ||
<pre><nowiki> | <pre><nowiki> | ||
第166行: | 第66行: | ||
Be sure to restart the Samba and Winbind services after changing the <code><nowiki>/etc/samba/smb.conf</nowiki></code> file: | Be sure to restart the Samba and Winbind services after changing the <code><nowiki>/etc/samba/smb.conf</nowiki></code> file: | ||
<pre><nowiki> | <pre><nowiki> | ||
− | + | sudo /etc/init.d/winbind stop | |
− | + | sudo /etc/init.d/samba restart | |
− | + | sudo /etc/init.d/winbind start | |
</nowiki></pre> | </nowiki></pre> | ||
− | Request a valid Kerberos TGT for an account using kinit, which is allowed to join a workstation into the AD domain. | + | Request a valid Kerberos TGT for an account using '''kinit''', which is allowed to join a workstation into the AD domain. |
Now join to the domain, if the ticket was valid you should not need to supply a password - even if prompted you should be able to leave it blank. | Now join to the domain, if the ticket was valid you should not need to supply a password - even if prompted you should be able to leave it blank. | ||
<pre><nowiki> | <pre><nowiki> | ||
− | + | sudo kinit Administrator@EXAMPLE.COM | |
+ | sudo net ads join | ||
Using short domain name – LAB | Using short domain name – LAB | ||
Joined 'linuxwork' to realm 'LAB.EXAMPLE.COM' | Joined 'linuxwork' to realm 'LAB.EXAMPLE.COM' | ||
</nowiki></pre> | </nowiki></pre> | ||
https://help.ubuntu.com/community/IconsPage?action=AttachFile&do=get&target=IconNote.png If the Kerberos auth was valid, you should not get asked for a password. However, if you are not working as root and are instead using sudo to perform the necessary tasks, use the command <code><nowiki>sudo net ads join -U username</nowiki></code> and supply your password when prompted. Otherwise, you will be asked to authenticate as [email protected] instead of a valid account name. | https://help.ubuntu.com/community/IconsPage?action=AttachFile&do=get&target=IconNote.png If the Kerberos auth was valid, you should not get asked for a password. However, if you are not working as root and are instead using sudo to perform the necessary tasks, use the command <code><nowiki>sudo net ads join -U username</nowiki></code> and supply your password when prompted. Otherwise, you will be asked to authenticate as [email protected] instead of a valid account name. | ||
− | + | You can also supply a password if you don't want to get prompted. Just use <code><nowiki>net ads join -U <username>%<password></nowiki></code> for this. Maybe its usefull for unattended installations where you want to add maschines to an AD automatically. | |
+ | === Testing === | ||
+ | == Setup Authentication == | ||
+ | === nsswitch === | ||
+ | file: <code><nowiki>/etc/nsswitch.conf</nowiki></code> | ||
<pre><nowiki> | <pre><nowiki> | ||
− | + | passwd: compat winbind | |
+ | group: compat winbind | ||
+ | shadow: compat | ||
+ | </nowiki></pre> | ||
+ | https://help.ubuntu.com/community/IconsPage?action=AttachFile&do=get&target=IconNote.png I needed to add <code><nowiki>hosts: files dns</nowiki></code> to <code><nowiki>/etc/nsswitch.conf</nowiki></code> to avoid the settings in <code><nowiki>/etc/hosts</nowiki></code> to be ignored. | ||
+ | === Testing === | ||
+ | You can check that the Domain has successfully been joined by: | ||
+ | <pre><nowiki> | ||
+ | wbinfo -u | ||
</nowiki></pre> | </nowiki></pre> | ||
You should get a list of the users of the domain. | You should get a list of the users of the domain. | ||
And a list of the groups. Be patient these queries can take time. | And a list of the groups. Be patient these queries can take time. | ||
<pre><nowiki> | <pre><nowiki> | ||
− | + | wbinfo -g | |
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
− | + | ||
</nowiki></pre> | </nowiki></pre> | ||
− | |||
Check Winbind nsswitch module with '''getent'''. | Check Winbind nsswitch module with '''getent'''. | ||
<pre><nowiki> | <pre><nowiki> | ||
− | + | sudo getent passwd | |
root:x:0:0:root:/root:/bin/bash | root:x:0:0:root:/root:/bin/bash | ||
第207行: | 第111行: | ||
</nowiki></pre> | </nowiki></pre> | ||
<pre><nowiki> | <pre><nowiki> | ||
− | + | sudo getent group | |
root:x:0: | root:x:0: | ||
第220行: | 第124行: | ||
... | ... | ||
</nowiki></pre> | </nowiki></pre> | ||
− | + | === PAM === | |
With this config you can access the workstation with local accounts or with domain accounts. On the first login of a domain user a home directory will be created. This PAM configuration assumes that the system will be used primarily with domain accounts. If the opposite is true (i.e., the system will be used primarily with local accounts), the order of ''pam_winbind.so'' and ''pam_unix.so'' should be reversed. When used with local accounts, the configuration shown here will result in a failed authentication to the Windows/Samba DC for each login and sudo use. This can litter the DC's event log. Likewise, if local accounts are checked first, the /var/log/auth.log will be littered with failed logon attempts each time a domain account is accessed. | With this config you can access the workstation with local accounts or with domain accounts. On the first login of a domain user a home directory will be created. This PAM configuration assumes that the system will be used primarily with domain accounts. If the opposite is true (i.e., the system will be used primarily with local accounts), the order of ''pam_winbind.so'' and ''pam_unix.so'' should be reversed. When used with local accounts, the configuration shown here will result in a failed authentication to the Windows/Samba DC for each login and sudo use. This can litter the DC's event log. Likewise, if local accounts are checked first, the /var/log/auth.log will be littered with failed logon attempts each time a domain account is accessed. | ||
This PAM configuration does not acquire a Kerberos TGT at login. To acquire a ticket, use ''kinit'' after logging in, and consider using ''kdestroy'' in a logout script. | This PAM configuration does not acquire a Kerberos TGT at login. To acquire a ticket, use ''kinit'' after logging in, and consider using ''kdestroy'' in a logout script. | ||
第234行: | 第138行: | ||
auth required pam_deny.so | auth required pam_deny.so | ||
</nowiki></pre> | </nowiki></pre> | ||
+ | https://help.ubuntu.com/community/IconsPage?action=AttachFile&do=get&target=IconNote.png On a Ubuntu 7.10 (Gutsy Gibbon) system, these changes to pam.d/common-auth result in not being able to log in as a local user, for example by ssh. Your luck may be better, but test immediately just in case. | ||
file: <code><nowiki>/etc/pam.d/common-session</nowiki></code> | file: <code><nowiki>/etc/pam.d/common-session</nowiki></code> | ||
<pre><nowiki> | <pre><nowiki> | ||
第247行: | 第152行: | ||
@include common-account | @include common-account | ||
</nowiki></pre> | </nowiki></pre> | ||
− | + | == Final configuration == | |
Each domain needs a directory in /home/. | Each domain needs a directory in /home/. | ||
<pre><nowiki> | <pre><nowiki> | ||
− | + | sudo mkdir /home/LAB | |
</nowiki></pre> | </nowiki></pre> | ||
=== One last thing === | === One last thing === | ||
第289行: | 第194行: | ||
auth required pam_deny.so | auth required pam_deny.so | ||
</nowiki></pre> | </nowiki></pre> | ||
− | + | == Troubleshooting == | |
If the Winbind PAM module in <code><nowiki>/var/log/auth.log</nowiki></code> says, that the AD-user is not existing, restart winbind. Probably it's best to restart the whole workstation. | If the Winbind PAM module in <code><nowiki>/var/log/auth.log</nowiki></code> says, that the AD-user is not existing, restart winbind. Probably it's best to restart the whole workstation. | ||
<pre><nowiki> | <pre><nowiki> | ||
− | + | sudo /etc/init.d/winbind restart | |
</nowiki></pre> | </nowiki></pre> | ||
If when logging into the machine one gets a "no logon servers" error winbind\samba may not be starting properly. Try restarting them manually, and then logging in. | If when logging into the machine one gets a "no logon servers" error winbind\samba may not be starting properly. Try restarting them manually, and then logging in. | ||
第301行: | 第206行: | ||
sudo apt-get remove nscd | sudo apt-get remove nscd | ||
</nowiki></pre> | </nowiki></pre> | ||
− | '''Some names or groups are not resolved with getent, but others are''' | + | '''Some names or groups are not resolved with getent, but others are not''' |
The range of your idmap parameter is not wide enough to encompass all the users or groups | The range of your idmap parameter is not wide enough to encompass all the users or groups | ||
<pre><nowiki> | <pre><nowiki> | ||
第307行: | 第212行: | ||
idmap gid = 16777216-33554431 | idmap gid = 16777216-33554431 | ||
</nowiki></pre> | </nowiki></pre> | ||
− | ==== | + | '''Adding more than one Linux machines to a Windows network''' |
+ | The above procedure allows you to add as many Linux machines as you like. However, the UID assigned to a given user may not be the same across all the machines. It created file ownership & rights issues when files/folders are shared between these machines. See Question #21806 on https://answers.launchpad.net/ubuntu/ for details. Therefore it is advisable to specify the UID mapping method | ||
+ | <pre><nowiki> | ||
+ | idmap backend = rid:YOURDOMAIN=70000-1000000 | ||
+ | idmap uid = 70000-1000000 | ||
+ | idmap gid = 70000-1000000 | ||
+ | winbind use default domain = yes | ||
+ | security = ADS | ||
+ | </nowiki></pre> | ||
+ | == Resources == | ||
Also see | Also see | ||
− | [http://wiki.randompage.org/index.php/Using_Samba_on_Debian_Linux_to_authenticate_against_Active_Directory Using Samba on Debian Linux to authenticate against Active Directory] on randompage.org. It largely mirrors this page but has a little more detail. | + | * [http://wiki.randompage.org/index.php/Using_Samba_on_Debian_Linux_to_authenticate_against_Active_Directory Using Samba on Debian Linux to authenticate against Active Directory] on randompage.org. It largely mirrors this page but has a little more detail. |
− | + | * The [http://wiki.samba.org/index.php/Samba_&_Active_Directory Samba and Active Directory Wiki] contains very detailed instructions. | |
+ | === Automated Methods === | ||
The [[UbuntuHelp:ActiveDirectoryWinbind-SADMS|SADMS]] package allows for automated joining to Active Directory through a GUI interface. | The [[UbuntuHelp:ActiveDirectoryWinbind-SADMS|SADMS]] package allows for automated joining to Active Directory through a GUI interface. | ||
[http://sadms.sourceforge.net/] | [http://sadms.sourceforge.net/] | ||
---- | ---- | ||
+ | '''Note:''' this guide has been tested on Ubuntu 8.04 (Hardy Heron). | ||
---- | ---- | ||
[[category:CategorySecurity]] | [[category:CategorySecurity]] | ||
[[category:UbuntuHelp]] | [[category:UbuntuHelp]] |
2008年4月23日 (三) 10:25的版本
目录
Introduction
This Howto describes how to add a Ubuntu box in a Active Directory domain and to authenticate the users with AD.
Used terms
term | definition |
AD | Active Directory |
DC | Domain Controller |
lab.example.com | AD domain |
win2k3.lab.example.com | DC FQDN |
10.0.0.1 | DC IP |
LAB.EXAMPLE.COM | Kerberos Realm |
linuxwork | computername of the Ubuntu workstation |
linuxwork.lab.example.com | FQDN of the Ubuntu workstation |
ntp.example.com | timeserver (NTP) |
Kerberos
The first step in joining an Active Directory domain is to install and configure Kerberos. See Samba/Kerberos for details.
Join AD domain
Required software
You need to install the winbind and samba packages. The packages smbfs and smbclient are useful for mounting network shares and coping files. The package smbfs is optional, but includes useful client utilities, including the smbmount command. Also useful is the smbclient package, which includes an FTP-like client for SMB shares.
Join
The first step in joining the Active Directory domain is to edit /etc/samba/smb.conf
:
file: /etc/samba/smb.conf
[global] security = ads realm = LAB.EXAMPLE.COM password server = 10.0.0.1 # note that workgroup is the 'short' domain name workgroup = LAB # winbind separator = + idmap uid = 10000-20000 idmap gid = 10000-20000 winbind enum users = yes winbind enum groups = yes template homedir = /home/%D/%U template shell = /bin/bash client use spnego = yes client ntlmv2 auth = yes encrypt passwords = yes winbind use default domain = yes restrict anonymous = 2 # to avoid the workstation from # trying to become a master browser # on your windows network add the # following lines domain master = no local master = no preferred master = no os level = 0
The "winbind use default domain" parameter is useful in single-domain enterprises and makes winbind assume that all user authentications should be performed in the domain to which winbind is joined. Omit this parameter if your environment includes multiple domains or if your account domain differs from the resource domain. The "winbind separator" directive is optional, and the default value is the usual backslash "\" Domain and User separator. You can use "+" if you know of a specific reason "\" will not work in your environment.
Be sure to restart the Samba and Winbind services after changing the /etc/samba/smb.conf
file:
sudo /etc/init.d/winbind stop sudo /etc/init.d/samba restart sudo /etc/init.d/winbind start
Request a valid Kerberos TGT for an account using kinit, which is allowed to join a workstation into the AD domain. Now join to the domain, if the ticket was valid you should not need to supply a password - even if prompted you should be able to leave it blank.
sudo kinit [email protected] sudo net ads join Using short domain name – LAB Joined 'linuxwork' to realm 'LAB.EXAMPLE.COM'
If the Kerberos auth was valid, you should not get asked for a password. However, if you are not working as root and are instead using sudo to perform the necessary tasks, use the command sudo net ads join -U username
and supply your password when prompted. Otherwise, you will be asked to authenticate as [email protected] instead of a valid account name.
You can also supply a password if you don't want to get prompted. Just use net ads join -U <username>%<password>
for this. Maybe its usefull for unattended installations where you want to add maschines to an AD automatically.
Testing
Setup Authentication
nsswitch
file: /etc/nsswitch.conf
passwd: compat winbind group: compat winbind shadow: compat
I needed to add hosts: files dns
to /etc/nsswitch.conf
to avoid the settings in /etc/hosts
to be ignored.
Testing
You can check that the Domain has successfully been joined by:
wbinfo -u
You should get a list of the users of the domain. And a list of the groups. Be patient these queries can take time.
wbinfo -g
Check Winbind nsswitch module with getent.
sudo getent passwd root:x:0:0:root:/root:/bin/bash ... LAB+administrator:x:10000:10000:Administrator:/home/LAB/administrator:/bin/bash LAB+gast:x:10001:10001:Gast:/home/LAB/gast:/bin/bash ...
sudo getent group root:x:0: daemon:x:1: bin:x:2: ... LAB+organisations-admins:x:10005:administrator LAB+domänen-admins:x:10006:manuel,administrator LAB+domänen-benutzer:x:10000: LAB+domänen-gäste:x:10001: LAB+linux-admins:x:10004:manuel ...
PAM
With this config you can access the workstation with local accounts or with domain accounts. On the first login of a domain user a home directory will be created. This PAM configuration assumes that the system will be used primarily with domain accounts. If the opposite is true (i.e., the system will be used primarily with local accounts), the order of pam_winbind.so and pam_unix.so should be reversed. When used with local accounts, the configuration shown here will result in a failed authentication to the Windows/Samba DC for each login and sudo use. This can litter the DC's event log. Likewise, if local accounts are checked first, the /var/log/auth.log will be littered with failed logon attempts each time a domain account is accessed.
This PAM configuration does not acquire a Kerberos TGT at login. To acquire a ticket, use kinit after logging in, and consider using kdestroy in a logout script.
file: /etc/pam.d/common-account
account sufficient pam_winbind.so account required pam_unix.so
file: /etc/pam.d/common-auth
auth sufficient pam_winbind.so auth sufficient pam_unix.so nullok_secure use_first_pass auth required pam_deny.so
On a Ubuntu 7.10 (Gutsy Gibbon) system, these changes to pam.d/common-auth result in not being able to log in as a local user, for example by ssh. Your luck may be better, but test immediately just in case.
file: /etc/pam.d/common-session
session required pam_unix.so session required pam_mkhomedir.so umask=0022 skel=/etc/skel
file: /etc/pam.d/sudo
auth sufficient pam_winbind.so auth sufficient pam_unix.so use_first_pass auth required pam_deny.so @include common-account
Final configuration
Each domain needs a directory in /home/.
sudo mkdir /home/LAB
One last thing
If you want to be able to use an active directory account, to manage your ubuntu box, you need to add it to the sudoers file. For that, you will need to edit the file /etc/group an add your username to the admin group, and whatever other group you need(plugdev,audio,cdrom just to mention a few). it will be like:
....... admin:x:117:olduser,ActiveDirectoryUser .......
Where olduser, is your current linux user, and ActiveDirectoryUser, is the new administrator. Another way to make a Domain Group, a sudoer in your ubuntu, is to edit the file /etc/sudoers (using the command 'visudo') and add the following line
%adgroup ALL=(ALL) ALL
Where adgroup, it's a group from your active directory. take in mind, that spaces in the group name are not allowed, maybe you can use '%Domain\ admins' but i haven't tested.
Usage
Logon with DOMAIN+USERNAME, unless you included "winbind use default domain" in your smb.conf, in which case you may log in using only USERNAME.
login: LAB+manuel Password: ***** ... LAB+manuel@linuxwork:~$
Automatic Kerberos Ticket Refresh
To have pam_winbind automatically refresh the kerberos ticket
Add the winbind refresh tickets
line to smb.conf
:
file: /etc/samba/smb.conf
# winbind separator = + winbind refresh tickets = yes idmap uid = 10000-20000
And modify /etc/pam.d/common-auth
:
file: /etc/pam.d/common-auth
auth sufficient pam_winbind.so krb5_auth krb5_ccache_type=FILE auth sufficient pam_unix.so nullok_secure use_first_pass auth required pam_deny.so
Troubleshooting
If the Winbind PAM module in /var/log/auth.log
says, that the AD-user is not existing, restart winbind. Probably it's best to restart the whole workstation.
sudo /etc/init.d/winbind restart
If when logging into the machine one gets a "no logon servers" error winbind\samba may not be starting properly. Try restarting them manually, and then logging in. -If a manual restart works, then to fix this issue one needs to change scripts S20samba and S20winbind to S25samba and S25winbind in the /etc/rc2.d, rc3.d, rc4.d, rc5.d folders. The understanding is that this causes samba and winbind to startup later in the boot order for each runlevel. So that they start after S24avahi-daemon. If you then find that you must wait a bit before you can log in, you need to set "winbind enum users" and "winbind enum groups" in /etc/samba/smb.conf to 'no'. name service cache daemon The name service cache daemon (nscd) can interfere with winbind, as winbind maintains its own cache. Remove it.
sudo apt-get remove nscd
Some names or groups are not resolved with getent, but others are not The range of your idmap parameter is not wide enough to encompass all the users or groups
idmap uid = 16777216-33554431 idmap gid = 16777216-33554431
Adding more than one Linux machines to a Windows network The above procedure allows you to add as many Linux machines as you like. However, the UID assigned to a given user may not be the same across all the machines. It created file ownership & rights issues when files/folders are shared between these machines. See Question #21806 on https://answers.launchpad.net/ubuntu/ for details. Therefore it is advisable to specify the UID mapping method
idmap backend = rid:YOURDOMAIN=70000-1000000 idmap uid = 70000-1000000 idmap gid = 70000-1000000 winbind use default domain = yes security = ADS
Resources
Also see
- Using Samba on Debian Linux to authenticate against Active Directory on randompage.org. It largely mirrors this page but has a little more detail.
- The Samba and Active Directory Wiki contains very detailed instructions.
Automated Methods
The SADMS package allows for automated joining to Active Directory through a GUI interface. [1]
Note: this guide has been tested on Ubuntu 8.04 (Hardy Heron).