2

I am trying to find a unified authentication scheme for linux servers to authenticate against Active Directory. Mainly these are Ubuntu and CentOS servers.

What I need:

  • Free, stable solution
  • Unified UID/GID such that permissions on a folder is the same, regardless of what server it's mounted from
  • Support for recursive groups, and group mapping (E.G sudo permissions, and login permissions, such that only members of group X are allowed to log in)
  • Home directory crossmount, such that home directory is crossmounted across servers for a unified experience
  • Unified support for at least Ubuntu and CentOS (ideally any flavor)
  • Keep local accounts (at minimum root)
  • Ideally, a solution that doesn't need a computer account, but simply authenticate using LDAP bind, and then do group lookup for authorization (not knowing how this would impact the other requirements)

Alternatives I've found is:

  • PowerBroker® Identity Services Open Edition (Formerly Likewise Open)
  • Centrify Express
  • Winbind

I've had a bad experience with likewise open in the past (authentication was randomly blocking ssh login), but I haven't tested the rebranded version. Centrify I haven't tried, but seems promising, although I haven't found a good resource as to how to accomplish my goals. Winbind I'm guessing is the most customizable one, at least in order to accomplish my last point.

I'm open to whatever solution that will solve my issue, but more than anything, I'm looking for an install guide for how to accomplish all of the above on both Ubuntu and CentOS

Is there any free tool available where I can solve my requirements with relative ease, if so, what's a valid configuration to do so?

2 Answers 2

3

Winbind is likely your best issue (it's what we have running in our infastructure).

The UID/GID's wouldn't necessarily be the same from server to server but you should be able to manage the access to any folders/resources you need through Samba and have it use the domain accounts. In terms of the login and sudo permissions you should be able to manage those with the usual access.conf and sudoers files referencing the windows domain accounts once winbind is set up. I'm not entirely sure about the home directory crossmount (haven't tried to impliment that) but it is supported on both CentOS and Ubuntu. Local accounts will be able to be kept and it wouldn't require a computer account.

I have included some links below to resources that may be able to help you in the implementation.

0
0

Have you researched if FreeIPA meets your needs? Also check this link.

Not the answer you're looking for? Browse other questions tagged .