Integrating a Linux Machine Into Windows Active Directory Domain
Integrating an Ubuntu workstation with Windows Active Directory (AD) is a common challenge, especially in mixed environments that use both Linux and Windows systems. For DataSunrise users, this integration allows seamless authentication and access control across platforms. This guide outlines the necessary steps to help you configure Ubuntu to authenticate against a centralized AD server, ensuring efficient security management within your network.
1. Specify the name of the configured computer in the /etc/hostname file
Query the current host name:
cat /etc/hostnameIf necessary, specify a new host name:
echo myhost > /etc/hostnameNote. Host name cannot be localhost, because localhost is the name for 127.0.0.1 (specified in the /etc/hosts file when you install the operating system).
2. Specify full domain controller name in the /etc/hosts file
Add a static record with full domain controller name in the end of the file /etc/hosts. Translation between IP address and the name of the computer is required so that you could use hostname instead of the IP address.
echo 192.168.1.51 hostname.db.local hostname >> /etc/hosts 3. Set a DNS server on the configured computer
Domain controller should be the first option for search. Add domain controller IP address to /etc/ resolv.conf. In most of distributives resolv.conf is generated automatically, so add the domain controller IP address to the /etc/resolvconf/resolv.conf.d/head.
sudo vim /etc/resolvconf/resolv.conf.d/headChange the opened file as follows:
domain domain.com search domain.com nameserver <domain controller IP address> nameserver 8.8.8.8
Restart the networking service.
/etc/init.d/networking restartUse nslookup command to check.
nslookup www.google.com 4. Configure time synchronization
The system time on the machine must be synchronized with the system time on domain controller server. Install the ntp tool and change the ntp.conf file.
sudo apt-get install ntp
sudo vim /etc/ntp.conf Change the file as follows.
# You do need to talk to an NTP server or two (or three). server dc.domain.com
Restart the ntpd daemon.
sudo /etc/init.d/ntp restart 5. Install a Kerberos client
sudo apt-get install krb5-user libpam-krb5 libpam-ccreds auth-client-config 6. Install Samba, Winbind and NTP
sudo apt-get install samba winbind ntp 7. Edit the /etc/krb5.conf file to add full domain name, domain controller name and the realm parameter
Important: Do not leave any comments tagged with the “#” sign in the config file.
[libdefaults]
default_realm = DOMAIN.COM # domain specific parameter (full domain name)
clockskew = 300
ticket_lifetime = 1d
forwardable = true
proxiable = true
dns_lookup_realm = true
dns_lookup_kdc = true
[realms]
DOMAIN.COM = {
kdc = hostname.domain.com # domain specific parameter (domain controller name)
admin_server = hostname.domain.com # domain specific parameter (domain controller name)
default_domain = DOMAIN.COM # domain specific parameter (full domain name)
}
[domain_realm]
.domain.com = DOMAIN.COM # domain specific parameter (domain name for dns names)
domain.com = DOMAIN.COM # domain specific parameter (domain name for dns names)
[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
proxiable = false
retain_after_close = false
minimum_uid = 0
debug = false
} 8. Edit the /etc/samba/smb.conf file to add short domain name and full domain name:
Important: Do not leave any comments tagged with the “#” sign in the config file.
[global] workgroup = DOMAIN # domain specific parameter (short domain name) realm = DOMAIN.COM # domain specific parameter (full domain name) security = ADS encrypt passwords = true socket options = TCP_NODELAY domain master = no local master = no preferred master = no os level = 0 domain logons = 0 server string = %h server (Samba, Ubuntu) dns proxy = no log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d server role = standalone server passdb backend = tdbsam obey pam restrictions = yes unix password sync = yes passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . pam password change = yes map to guest = bad user usershare allow guests = yes
Note. Before using the config file remove comment lines.
9. Enter the domain:
net ads join -U AdministratorAfter joining the domain successfully you will be able to ping Active Directory hostnames, e.g.:
vertica@vertica:~/ds$ ping johnny.domain.com
PING johnny.domain.com (192.168.1.39) 56(84) bytes of data.
64 bytes from johnny.domain.com (192.168.1.39): icmp_seq=1 ttl=128 time=0.200 ms
64 bytes from johnny.domain.com (192.168.1.39): icmp_seq=2 ttl=128 time=0.560 ms 10. Verify that authentication for an Active Directory user is successful:
kinit johnny@DOMAIN.COMNote. Type the domain name in upper-case letters.
If everything was configured correctly, the ticket will be created.
Make sure that the ticket was created:
klistAnd, there you have it – an Ubuntu workstation integrated with Windows Active directory.
Please refer to Active Directory Authentication for MySQL Database if you need more information.
Does your database contain sensitive information that requires protection? Do you need to comply with regulations like GDPR, SOX, or HIPAA? Explore DataSunrise’s comprehensive solution for database auditing, security, and data masking. Try our free trial or schedule an online demo to see how we can safeguard your data and ensure regulatory compliance.
