Integrating a Linux Machine Into Windows Active Directory Domain

The problem of integrating an Ubuntu workstation with Windows Active directory is quite common. Below we describe the required steps to help DataSunrise users accomplish this task:

1. Specify the name of the configured computer in the /etc/hostname file

Query the current host name:

cat /etc/hostname

If necessary, specify a new host name:

echo myhost > /etc/hostname

Note. Host name cannot be localhost, because localhost is the name for 127.0.0.1 (specified in the /etc/hosts file when you install the operating system).

2. Specify full domain controller name in the /etc/hosts file

Add a static record with full domain controller name in the end of the file /etc/hosts. Translation between IP address and the name of the computer is required so that you could use hostname instead of the IP address.

echo 192.168.1.51 hostname.db.local hostname >> /etc/hosts

3. Set a DNS server on the configured computer

Domain controller should be the first option for search. Add domain controller IP address to /etc/ resolv.conf. In most of distributives resolv.conf is generated automatically, so add the domain controller IP address to the /etc/resolvconf/resolv.conf.d/head.

sudo vim /etc/resolvconf/resolv.conf.d/head

Change the opened file as follows:

domain domain.com
search domain.com
nameserver <domain controller IP address>
nameserver 8.8.8.8

Restart the networking service.

/etc/init.d/networking restart

Use nslookup command to check.

nslookup www.google.com

4. Configure time synchronization

The system time on the machine must be synchronized with the system time on domain controller server. Install the ntp tool and change the ntp.conf file.

sudo apt-get install ntp sudo vim /etc/ntp.conf

Change the file as follows.

# You do need to talk to an NTP server or two (or three).
server dc.domain.com

Restart the ntpd daemon.

sudo /etc/init.d/ntp restart

5. Install a Kerberos client

sudo apt-get install krb5-user libpam-krb5 libpam-ccreds auth-client-config  

6. Install Samba, Winbind and NTP

sudo apt-get install samba winbind ntp

7. Edit the /etc/krb5.conf file to add full domain name, domain controller name and the realm parameter

Important: Do not leave any comments tagged with the “#” sign in the config file.

[libdefaults]
    default_realm       =           DOMAIN.COM    # domain specific parameter (full domain name)
    clockskew           =           300
    ticket_lifetime     =           1d
    forwardable         =           true
    proxiable           =           true
    dns_lookup_realm    =           true
    dns_lookup_kdc      =           true
   
 
   [realms]
        DOMAIN.COM = {
        kdc            =       hostname.domain.com   # domain specific parameter (domain controller name)
        admin_server   =       hostname.domain.com   # domain specific parameter (domain controller name)
        default_domain =       DOMAIN.COM         # domain specific parameter (full domain name)
        }
 
[domain_realm]
        .domain.com = DOMAIN.COM  # domain specific parameter (domain name for dns names)
        domain.com = DOMAIN.COM   # domain specific parameter (domain name for dns names)
 
[appdefaults]
        pam = {
        ticket_lifetime         = 1d
        renew_lifetime          = 1d
        forwardable             = true
        proxiable               = false
        retain_after_close      = false
        minimum_uid             = 0
        debug                   = false
        }

 

8. Edit the /etc/samba/smb.conf file to add short domain name and full domain name:

Important: Do not leave any comments tagged with the “#” sign in the config file.

[global]
   workgroup = DOMAIN                   # domain specific parameter (short domain name)
   realm = DOMAIN.COM                 # domain specific parameter (full domain name)
   security = ADS
   encrypt passwords = true
   socket options = TCP_NODELAY
   domain master = no
   local master = no
   preferred master = no
   os level = 0
   domain logons = 0
   server string = %h server (Samba, Ubuntu)
   dns proxy = no
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d
   server role = standalone server
   passdb backend = tdbsam
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = yes
   map to guest = bad user
   usershare allow guests = yes

 

Note. Before using the config file remove comment lines.

9. Enter the domain:

net ads join -U Administrator

After joining the domain successfully you will be able to ping Active Directory hostnames, e.g.:

vertica@vertica:~/ds$ ping johnny.domain.com PING johnny.domain.com (192.168.1.39) 56(84) bytes of data. 64 bytes from johnny.domain.com (192.168.1.39): icmp_seq=1 ttl=128 time=0.200 ms 64 bytes from johnny.domain.com (192.168.1.39): icmp_seq=2 ttl=128 time=0.560 ms  

10. Verify that authentication for an Active Directory user is successful:

kinit [email protected]

Note. Type the domain name in upper-case letters.

If everything was configured correctly, the ticket will be created.

Make sure that the ticket was created:

klist

And, there you have it – an Ubuntu workstation integrated with Windows Active directory.

Please refer to Active Directory Authentication for MySQL Database if you need more information.

Does your database contain sensitive information that requires protection? Do you need to comply with regulations like GDPR, SOX, or HIPAA? Explore DataSunrise’s comprehensive solution for database auditing, security, and data masking. Try our free trial or schedule an online demo to see how we can safeguard your data and ensure regulatory compliance.