Integrating Ubuntu with Windows Active Directory Domain
Introduction
Integrating an Ubuntu workstation with Windows Active Directory (AD) is a common challenge in mixed environments that use both Linux and Windows systems. Performing a successful ubuntu/linux domain join allows centralized authentication and access control across platforms. For DataSunrise users, this integration enhances security while maintaining unified identity management. This guide outlines each step required to join Ubuntu to a Windows domain and configure it to authenticate against a centralized AD server.
Completing a ubuntu/linux domain join involves configuring the hostname, DNS, Kerberos, Samba, and time synchronization. Once completed, Linux machines can participate in domain-based authentication workflows just like Windows hosts. This enables centralized login, group policy enforcement, and secure access to domain resources.
1. Specify the name of the configured computer in the /etc/hostname file
Query the current host name:
cat /etc/hostname
If necessary, specify a new host name:
echo myhost > /etc/hostname
Note. Host name cannot be localhost, because localhost is the name for 127.0.0.1 (specified in the /etc/hosts file when you install the operating system).
2. Specify full domain controller name in the /etc/hosts file
Add a static record with full domain controller name in the end of the file /etc/hosts. Translation between IP address and the name of the computer is required so that you could use hostname instead of the IP address.
echo 192.168.1.51 hostname.db.local hostname >> /etc/hosts
3. Set a DNS server on the configured computer
Domain controller should be the first option for search. Add domain controller IP address to /etc/resolv.conf. In most of distributives resolv.conf is generated automatically, so add the domain controller IP address to the /etc/resolvconf/resolv.conf.d/head.
sudo vim /etc/resolvconf/resolv.conf.d/head
Change the opened file as follows:
domain domain.com search domain.com nameservernameserver 8.8.8.8
Restart the networking service.
/etc/init.d/networking restart
Use nslookup command to check.
nslookup www.google.com
4. Configure time synchronization
The system time on the machine must be synchronized with the system time on domain controller server. Install the ntp tool and change the ntp.conf file.
sudo apt-get install ntp sudo vim /etc/ntp.conf
Change the file as follows.
server dc.domain.com
Restart the ntpd daemon.
sudo /etc/init.d/ntp restart
5. Install a Kerberos client
sudo apt-get install krb5-user libpam-krb5 libpam-ccreds auth-client-config
6. Install Samba, Winbind and NTP
sudo apt-get install samba winbind ntp
7. Edit the /etc/krb5.conf file to add full domain name, domain controller name and the realm parameter
Important: Do not leave any comments tagged with the “#” sign in the config file.
[libdefaults]
default_realm = DOMAIN.COM
clockskew = 300
ticket_lifetime = 1d
forwardable = true
proxiable = true
dns_lookup_realm = true
dns_lookup_kdc = true
[realms]
DOMAIN.COM = {
kdc = hostname.domain.com
admin_server = hostname.domain.com
default_domain = DOMAIN.COM
}
[domain_realm]
.domain.com = DOMAIN.COM
domain.com = DOMAIN.COM
[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
proxiable = false
retain_after_close = false
minimum_uid = 0
debug = false
}
8. Edit the /etc/samba/smb.conf file to add short domain name and full domain name:
Important: Do not leave any comments tagged with the “#” sign in the config file.
[global] workgroup = DOMAIN realm = DOMAIN.COM security = ADS encrypt passwords = true socket options = TCP_NODELAY domain master = no local master = no preferred master = no os level = 0 domain logons = 0 server string = %h server (Samba, Ubuntu) dns proxy = no log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d server role = standalone server passdb backend = tdbsam obey pam restrictions = yes unix password sync = yes passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . pam password change = yes map to guest = bad user usershare allow guests = yes
Note. Before using the config file remove comment lines.
9. Enter the domain:
net ads join -U Administrator
After joining the domain successfully you will be able to ping Active Directory hostnames, e.g.:
ping johnny.domain.com
10. Verify that authentication for an Active Directory user is successful:
kinit johnny@DOMAIN.COM
Note: Type the domain name in upper-case letters.
If everything was configured correctly, the ticket will be created.
klist
And there you have it — a successful ubuntu/linux domain join that lets your Ubuntu machine authenticate securely with Windows Active Directory.
Please refer to Active Directory Authentication for MySQL Database if you need more information.
Does your database contain sensitive information that requires protection? Do you need to comply with regulations like GDPR, SOX, or HIPAA? Explore DataSunrise’s comprehensive solution for database auditing, security, and data masking. Try our free trial or schedule an online demo to see how we can safeguard your data and ensure regulatory compliance.
