topic Re: Linux Active Directory Authentication in Operating System - Linux

Linux Active Directory Authentication

Michael Williams_6 — Mon, 13 Sep 2004 05:16:01 GMT

Hello people!

I have a very ambitious project to allow an Active Directory domain to authenticate logins to our Linux boxes, but I haven't got a clue where to start.

The howto's only appear to use the OpenLDAP server, which I don't want to use, I want to use my Active Directory server, so if anyone knows any howto's or have their own easy to follow documentation, I'd be more than grateful!!

TIA!

Mike

Re: Linux Active Directory Authentication

Hoefnix — Mon, 13 Sep 2004 05:50:31 GMT

Hi,

Check next 2 thread's, I think they will intrest you.
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=54431

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=54489

HTH,
Peter Geluk

Re: Linux Active Directory Authentication

Alexander Chuzhoy — Mon, 13 Sep 2004 08:58:58 GMT

I don't know if it will work on your version of linux.
On Fedora for instance:
authconfig utility has an option to use winbind for authentication.
select it-then select all necessary settings
including join to domain (pretty simple).When you 'll try to login:
instead of simply enetring username-enter
domainname\username
where domainname is the Microsoft domain's name.

Re: Linux Active Directory Authentication

Michael Williams_6 — Mon, 13 Sep 2004 09:04:33 GMT

Hey thanks guys.

After spending most of the day on this, I'm not sure I am going to be able to get this to work how we need it to.

In short, we are trying to replace our NIS domain with AD Authentication. But the problem here is that it looks as though I can only get logins to work with DOMAIN\USER. Can I do something fancy with smbpasswd to allow us to map a short username and still log in?

Additionally, as it's replacing an already existing NIS domain, I need to be able to map UID and GID's to what they used to be, does anyone know if this is in fact possible?

Thanks for your help!!

Re: Linux Active Directory Authentication

Ragu_3 — Mon, 13 Sep 2004 21:32:18 GMT

> need to be able to map UID and GID's
> to what they used to be, does anyone
> know if this is in fact possible?

Yes, possible using winbind. Winbind is a service to reslove user and group info from Win NT servers. Do use the latest v3.0.7 packages of Samba and Winbind, you can get bacports of these. Reading the excellent tutorial of Terpstra which comes along with samba is a good help!

Re: Linux Active Directory Authentication

Steven E. Protter — Mon, 13 Sep 2004 21:58:56 GMT

This can be done with Samba 3.0.6.

The methodology was discussed to a degree at HP World.

I have yet to find a howto doc, but it can be done.

I'll try and dig up the presentation when I'm at work in the morning and can browse the pdf's from HP World.

SEP

Re: Linux Active Directory Authentication

Michael Williams_6 — Tue, 14 Sep 2004 03:45:15 GMT

Thanks guys, you've both said that it can be done, but I made two points:

Point 1: The user is in the form DOMAIN\USER
Point 2: The UID and GID isn't mappable

Ragu said that I can do Point 2 with winbind (I'm using that already, must look harder!).

What about Point 1? I *have* to have the old usernames working otherwise I'll have to make my own LDAP/NIS implementation from UNIX.

Thanks for your help guys!

Re: Linux Active Directory Authentication

Thomas Bianco — Tue, 14 Sep 2004 11:03:14 GMT

consider services for unix from microsoft. it's now free and allows NIS Passthrough for AD.

http://support.microsoft.com/default.aspx?scid=kb;en-us;324541

Re: Linux Active Directory Authentication

LanRx — Tue, 21 Sep 2004 14:17:32 GMT

It is most certainly possible. First thing that I would do, is I would focus on providing LDAP authentication for your UNIX devices. This can be done by leveraging the nss_ldap software by PADL. Active Directory does support LDAP calls, and for UNIX authentication, in my opinion, it's the best way to go. There are a couple of gotchas as far as some configuration in your LDAP.conf file, particularly if you are using SSL for your LDAP communication between your managed node and your domain controller.

If you would like further assistance, I'd be happy to provide it. I also have some howtos that seemed to get a pretty good response @ another site, available for a small fee @ https://www.lanrx.com/store/

Re: Linux Active Directory Authentication

LanRx — Tue, 21 Sep 2004 14:19:55 GMT

You also will be able to configure and match UID/GID to your existing numbers.

Re: Linux Active Directory Authentication

Emir Faisal — Wed, 22 Sep 2004 01:02:31 GMT

Go for it.

I just setup a samba-3.0.7 running on RH9.0. and it work very well. Now I can either telnet, ssh and cek smb shares using my ActiveDirectory login.

You don't have to worry about DOMAIN\Username since samba3x provide "winbind use default domain" parameter.

I even can manage security on shares on samba using windows explorer (with acl support).

gut lak.

Re: Linux Active Directory Authentication

LanRx — Sun, 26 Sep 2004 08:24:01 GMT

Here is my howto on how to perform Linux authentication against Active Directory. The howto was written using FC1 and Windows Server 2003.

http://www.lanrx.com/index.php?option=articles&Itemid=76&topid=0

Re: Linux Active Directory Authentication

Dsmith_1 — Sun, 05 Feb 2006 10:22:33 GMT

Check Out my blog. My next section which will be done later this month will be using Samba. I currently tell you how to do LDAP and LDAPS. Kerberos Pass-through is also a possiblity. Having issue with LDAP with kerberos via SASL with GSSAPI.

http://empsystech.com/tech_blog/category/technology/active-directory/linux-authentication/

Re: Linux Active Directory Authentication

Luis Valdez — Tue, 07 Mar 2006 17:37:48 GMT

use authconfig and put in your AD information.
works perfect.
/usr/bin/authconfig
RHEL AS3