Authenticating Linux against Active Directory

When you only have few Linux machines and sysadmins, a simple local machine authentication would do a fairy good job.

Imaging if you have 64 Linux box(and growing) and 4 sysadmins. To keep and maintain sudo access up-to-update would be a daunting task.

Why not get Linux and Windows talk to each other if you already have Active Directory on your environment?

- First you will need to ensure Linux machine A record added to AD DNS server

- create a AD group called linixadmin and add admin user to the group

- Next run the following command on Linux client box

yum install samba-common samba-winbind pam_krb5 sudo authconfig;
chkconfig winbind on;
mkdir /home/[your domain name-mycompany];
chmod 0777 /home/mycompany;
echo "%linuxadmin ALL=(ALL) ALL" >> /etc/sudoers;

authconfig \
--disablecache \
--enablewinbind \
--enablewinbindauth \
--smbsecurity=ads \
--smbworkgroup=MYCOMPANY \
--smbrealm=MYCOMPANY.LOCAL \
--enablewinbindusedefaultdomain \
--winbindtemplatehomedir=/home//%U \
--winbindtemplateshell=/bin/bash \
--enablekrb5 \
--krb5realm=MYCOMPANY.LOCAL \  
--enablekrb5kdcdns \
--enablekrb5realmdns \
--enablelocauthorize \
--enablemkhomedir \
--enablepamaccess \
--updateall \

net ads join -U "AD Admin account i.e. joesoh";
 

service winbind restart

===

Note: MYCOMPANY.LOCAL is your AD domain name

Try logon using you Windows ID and password.

Now who says Windows and Linux don't talk?