Integrating Linux machines in the Samba-AD domain

Redhat8 servers without graphics layer

  • Install the necessary packages for Redhat:

    yum install realmd sssd oddjob oddjob-mkhomedir adcli samba-common samba-common-tools
    
  • Install the NTP packages and point NTP to a domain controller:

    yum install ntpdate ntpd
    ntpdate -bu srvads1.mydomain.lan
    

Debian / Ubuntu servers without graphic layer

Note

We assume that the machine will have been installed by following this procedure for Debian:

apt-get install realmd sssd oddjob oddjob-mkhomedir adcli samba-common packagekit sssd-tools
  • Install the NTP packages and point NTP to a domain controller:

apt-get install ntpdate ntpd
ntpdate -bu srvads1.mydomain.lan

Joining the Linux machine to the domain

realm join --user=administrator ad.mydomain.lan
  • Edit /etc/sssd/sssd.conf:

    [sssd]
    domains = mydomain.lan
    config_file_version = 2
    services = nss, pam
    
    [domain/mydomain.lan]
    enumerate = true
    ad_domain = mydomain.lan
    krb5_realm = MYDOMAIN.LAN
    realmd_tags = manages-system joined-with-samba
    cache_credentials = True
    id_provider = ad
    krb5_store_password_if_offline = True
    default_shell = /bin/bash
    ldap_id_mapping = True
    use_fully_qualified_names = False
    fallback_homedir = /home/%u@%d
    access_provider = ad
    auth_provider = ad
    override_shell= /bin/bash
    override_homedir = /home/homes/%u
    ad_gpo_access_control = disabled
    enumerate = true
    
  • If you are in RFC2307, add in the section [domain]:

    ldap_id_mapping = False
    
  • If you are in RID, add in the section [domain]:

    ldap_id_mapping = True
    ldap_idmap_autorid_compat = true
    ldap_idmap_range_min = 10000
    
  • Finally, force the removal of the existing mapping:

    rm -f /var/lib/sss/db/cache_mydomain.lan.ldb