Connecting Linux server to Active Directory

IPI Enterprise Server – Connecting Linux server to Active Directory

Edit the file /etc/hosts, add (or edit) the line specifying the FQDN for this host (change it to your host name and <Domain_Name> to the domain name):

127.0.1.1       <hostname>.<Domain_Name>  <hostname>

It may also be necessary to add the FQDN for the AD server depending on the network settings.

<server_ip>       <Server_Name>.<Domain_Name>  <Server_Name>

The AD server must be installed as a DNS server for a correct connection to AD. If DHCP is running on your network, as a rule, the administrator has already assigned the correct settings for your server. You can see a list of current DNS in the resolv.conf file:

cat /etc/resolv.conf

The IP of the AD server will appear as a nameserver. Otherwise, you can manually assign the nameserver. When using DHCP, you cannot modify resolv.conf directly, so it will be necessary to follow a few simple steps.

Ubuntu 18.04

Let`s install resolvconf package

sudo apt update
sudo apt install resolvconf
sudo systemctl enable resolvconf.service

You will then need to edit the /etc/resolvconf/resolv.conf.d/head file. Add the line:

nameserver  <server_ip>

and start

sudo systemctl start resolvconf.service

Centos 7

The following lines should be added

PEERDNS=no
DNS1=<server_ip>

to the file `/etc/sysconfig/network-scripts/ifcfg-* Here you need to replace ifcfg-* with the name of your network interface and restart NetworkManager

sudo systemctl restart  NetworkManager

Check your resolv.conf again to make sure everything is correct

cat /etc/resolv.conf

Check that the domain name resolves. Note: under Centos 7, it may be required to install the bind-utils package:

sudo yum install bind-utils -y

nslookup <Domain_Name>

Install the necessary packages

Ubuntu 18.04

sudo apt install realmd samba-common-bin samba-libs sssd-tools krb5-user adcli

Centos 7

sudo yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-common samba-common-tools krb5-workstation openldap-clients policycoreutils-python -y

You must confirm the domain during the installation of kerberos, and specify the server name. Let's check that our domain is visible on the network:

realm discover <Domain_Name>

Join the machine to a domain:

sudo realm --verbose join <Domain_Name> -U <YourDomainAdmin> --install=/

If there is no error, everything went fine. You can go to the domain controller and check if our linux server appears in the domain. If the Active Directory server uses self-signed certificates, you need to edit the ldap.conf file. In ubuntu it is stored in /etc/ldap/ldap.conf, in Centos - /etc/openldap/ldap.conf. You should specify (add at the end of the file) this parameter:

TLS_REQCERT never

Installation check

For example, to get all users (you have to enter a password):

ldapsearch -x -H "ldaps://<Domain_Name>" -D "<YourDomainAdmin>@<Domain_Name>" -W  -b "dc=<dc>,dc=<dc>, ..." "objectCategory=person" name

In case we have the ipi.example.com domain and an administrator named "administrator", the command would look like this:

ldapsearch -x -H "ldaps://ipi.example.com" -W -D "[e-mail]" -b "dc=ipi,dc=example,dc=com"  "objectCategory=person" name

In case of an error, you can add the -d1 key and read the description of the error.