Login or Register to Ask a Question and Join Our Community


Windows & DOS: Issues & Discussions

Integrate RHEL with Active Directory

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Special Forums Windows & DOS: Issues & Discussions Integrate RHEL with Active Directory
# 1  
Old 01-17-2014
Display Integrate RHEL with Active Directory
Hi All,

I have been given the task of integrating Linux (RedHat, Ubuntu, CentOS and Mac OSX) with a Windows Server 2012 A.D.

if anyone has done this before help would be very much appreciated, I have been looking at using either Samba with Win-bind or SSSD, if anyone has tested this please let me know the best and easiest way they have done this successfully whereby utilizing SSSD it picks up GPO.

Thanks
Stuart
# 2  
Old 01-17-2014
Hi Stuart,

Currently running SSSD on Centos and RHEL with GFS for authentication against AD without any issues, took a little time to setup. But there were no major gotcha's.

Regards

Gull04
# 3  
Old 01-17-2014
Gull,

is SSSD picking up GP from AD? have you got a technical diagram of how your using it within your network or could you describe this to me?

I.E
Windows replication between 2 DCS:
Windows 2012 DC1 - ADDS, DHCP, DNS
Windows 2012 DC2 - ADDS, DHCP, DNS

Windows 7 machine picks up from above

CentOS - DC3 GFS
RHEL - DC4 SSSD

Ubuntu machine, gets DHCP, DNS from Windows environment then looks through RHEL environment from SSSD in to Windows authentication?

Sorry is this totally wrong?

Stuart
Last edited by Scott; 01-17-2014 at 11:12 AM.. Reason: Changed "Rehl" references to RHEL
# 4  
Old 01-17-2014
Hi Stuart,

It's working against the AD for all of it's stuff, possibly better if I incorporate the sssd,conf file here.

We are running a very similar setup to yours, with an 18 node cluster using GFS at the back end with automount for home directories etc.

Code:
[15:06 sc386dm@ekbvcad301 data] > cat orig.sssd.conf
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = XXXXXXXXXXXXX

[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3

[pam]
reconnection_retries = 3
#ldap_schema = rfc2307bis
ldap_schema = rfc2307
ldap_user_search_base = cn=Users,dc=xxx,dc=xxxxx,dc=com
ldap_group_search_base = cn=Users,dc=xxx,dc=xxxxx,dc=com
ldap_default_bind_dn = cn=admintest,cn=Users,dc=xxx,dc=xxxxx,dc=com
ldap_default_authtok_type = password
ldap_default_authtok = XXXXXXXX
ldap_force_upper_case_realm = True

[domain/EKB.ATMEL.COM]
description = LDAP auth to AD2003
min_id = 100
id_provider = ldap
auth_provider = ldap
ldap_uri = ldap://kdc1.xxx.xxxxx.com
ldap_schema = rfc2307bis
ldap_search_base = cn=Users,dc=xxx,dc=xxxxx,dc=com
ldap_default_bind_dn = cn=admintest,cn=Users,dc=xxx,dc=xxxxx,dc=com
ldap_default_authtok_type = password
ldap_default_authtok = XXXXXXXX
ldap_user_object_class = user
ldap_group_object_class = group
ldap_user_home_directory = unixHomeDirectory
ldap_user_gecos = displayName
enumerate = true
chpass_provider = krb5
auth_provider = krb5
krb5_kdcip = 10.143.253.183
krb5_realm = XXX.XXXXX.COM
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
krb5_auth_timeout = 15

#cache_credentials = True
#ldap_id_use_start_tls = False
debug_level = 9
krb5_kpasswd = kdc1.xxx.xxxxx.com:749
#ldap_search_base = cn=Users,dc=xxx,dc=xxxxx,dc=com
#krb5_realm = XXX.XXXXX.COM
#chpass_provider = krb5
#krb5_kdcip = kdc1.xxx.xxxxx.com:88
#ldap_tls_cacertdir = /etc/openldap/cacerts
[15:10 sc386dm@ekbvcad301 data] >

Anywhere you see 'x' or 'X' you'll have to substitute your own stuff - I have to leave now - but will check back when I get home (5 Hours).

Regards

Gull04
# 5  
Old 01-17-2014
so am I right in saying the following:
You setup the SSSD within centos
have the GFS file system in Rehl
use Windows for Authentication of creating users and use GPO from A.D to restrict users from doing most things?
also do you have a mixture of desktop OS I.E Mac OSX, Windows, Ubuntu?
# 6  
Old 01-18-2014
Hi Stuart,

Our set-up is a bit unusual, we have 2 control nodes, running the GFS software on RHEL (for various reasons we had to back port the GFS code to an older version of RHEL) with 8 other nodes with NFS mounts of the GFS file systems.

These are exported again to a further 8 nodes - all are equal in the cluster.

Our desktop estate covers Windows XP, Windows 7, Mac OS/X and Centos - these authenticate against the active directory and if they login to any of the nodes then SSSD authenticates.

Regards

Gull04
# 7  
Old 01-18-2014
Thanks for your response again Gul

May I ask why you chose specifically SSSD over winbind and Samba?

Stuart
Login or Register to Ask a Question

Previous Thread | Next Thread

7 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

Active Directory OR LDAP

Hi, How can we check users added through LDAP or AD. Users added through a group of AD or LDAP group. (2 Replies)
Discussion started by: Nishit
2 Replies

2. UNIX for Advanced & Expert Users

Active Directory with 6.1

Is there anyone who is utilizing Active Directory (2008R2) for AIX user account management? If yes or if AD is possible with AIX systems, can you please share what to be done to get there? Please advise. (1 Reply)
Discussion started by: Daniel Gate
1 Replies

3. Red Hat

ldap and active directory

Hi Friends, I need your help to get some solution of one of my problem. Ours is a mixed domain. Most of the servers are windows and very little linux servers. We are using the MS AD for authentication. My problem is, I want to authenticate linux servers against AD. I donot want to use any... (1 Reply)
Discussion started by: arumon
1 Replies

4. HP-UX

HP-UX authenticating to Active Directory

Hey, I've asked questions about this project here before and gotten lots of help so I figured I'd give it another try. I've recently set up my HP-UX environment to authenticate to a Windows Active Directory server (Windows Server 2003 R2). I setup an account on Active Directory which works... (2 Replies)
Discussion started by: Rike255
2 Replies

5. UNIX for Dummies Questions & Answers

setup active directory

i would like to ask about unix with active directory..actually my situation is at ny place there already have dns server in unix based,i want to implement an active directory to the network..from what i read about active directory we have to used bind dns...some say that bind could not handle in... (1 Reply)
Discussion started by: nour
1 Replies

6. UNIX for Dummies Questions & Answers

Active Directory and UNIX

Hello - I have a very vague question, which will probably result in vague answers because I don't have a lot of detailed information and I don't know a whole lot about active directory. Our Windows/NT admin has been rolling out Active Directory over the past several weeks and as time goes on,... (1 Reply)
Discussion started by: rm -r *
1 Replies

7. Windows & DOS: Issues & Discussions

unix and active directory

Hi Does anybody know the steps and requirements of the installation process of Windows Active Directory using Unix/Linux Bind DNS. I will appreciate if somebody gives the answer. (1 Reply)
Discussion started by: Darwin Rodrigue
1 Replies
Login or Register to Ask a Question