Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to figure out how to use Windows Server 2008 R2 as an LDAP server for Linux clients.

Ideally, users should be able to login to their Linux workstations via pam_ldap authenticating against AD. (winbind is not an option unfortunately)

I've looked at Windows Services for Unix but it seems to be going EOL soon.

Is there any other way to achieve this?

share|improve this question
add comment

5 Answers

up vote 5 down vote accepted

Thanks for the suggestions. As I mentioned in the original post, windows services for Unix is going to be EOL soon but I found the replacement for anyone that's interested.

In Windows Server 2008 R2 you need to install the feature "Subsystem for UNIX-based applications".

Secondly, under Roles > Active Directory Domain Services you need to install "Identity Management for Unix".

Once these are installed each user will have have some extra unix attributes :)

The ldap mapping for /etc/ldap.conf is as follows:

# RFC 2307 (AD) mappings
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_attribute uid sAMAccountName
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute shadowLastChange pwdLastSet
nss_map_objectclass posixGroup group
nss_map_attribute uniqueMember member
pam_login_attribute sAMAccountName
pam_filter objectclass=User
pam_password ad

The joys of interoperability...

share|improve this answer
    
Thanks for the finite details. I guess I should have mentioned it, but I thought SFU->SUA is just a name change. I cannot comment on the differences in functionality. –  ajstein Oct 20 '10 at 8:25
add comment

Likewise Open worked for me - pretty easy to install, and doesn't require any changes to AD. The Free version gives you login functionality. If you pay for the Enterprise version you get Group Policy and a whole host of other things.

share|improve this answer
    
@dunxd Do you use the free or enterprise version? I have been curious about it for a while, and I cannot help from looking at very quick glimpses of the code (and I am an idiot, so caveat emptor) does what Samba ought to do and try to handle guess work and make it easier to configure. The core was samba and winbind last time I checked. –  ajstein Oct 18 '10 at 15:53
    
@alharaka - I'm just using the Open version. I picked up on Likewise only recently as I was using VMware's ESX Management Assistant Server virtual appliance. Since the permissions for managing VMs are set through AD on our system, I needed to allow staff to login to the Assistant Server with their AD logins. It works well for that. As far as I can tell it is using LDAP, and allows login, which is what the OP asked for. Can't comment on the features of Enterprise version, but it seems like a well maintained and documented project. –  dunxd Oct 19 '10 at 7:48
    
@dunxd Very jealous. We only had ESXi, so up to this point I have not been able to test such things. Rumor had it OpenLikewise was to be integrated into the next ESXi release so cheapskates like our team will benefit, but I have not followed up with research or checked recently. –  ajstein Oct 20 '10 at 8:24
    
@alharaka - you can use Management Assistant Server to script your ESXi systems, although of course you won't be able to do vMotion etc, which is when virtualisation really comes into its own. I've seen some hacks out there that give you access to a service console on ESXi, and from there you can install Likewise and join to an AD domain. But I'm not sure why you'd bother. –  dunxd Oct 20 '10 at 9:29
1  
dunxd Thanks for the tips. I do not have access to that ESXi instance anymore, but good to know. Truth be told, I did get my way into the console (so I could SSH to do a quick reboot, and use scp to pull out all etc files). Other than that, and it was more an experiment than anything else, you're "why bother comment" is apt. Anyway, thanks for the good conversation. –  ajstein Oct 20 '10 at 18:21
show 1 more comment

You might try http://www.quest.com/authentication-services/active-directory-for-unix.aspx (former Vintela).

I have no experience in setting it up myself, but my previous employer used this and it worked very well on our Linux workstations.

share|improve this answer
1  
Works, still we've had lots of problems with it. (more on Unix than on Linux though) The support is really good too. –  skinp Oct 18 '10 at 13:13
add comment

You might want to read the Microsoft document using Windows Services for Unix ([W]SfU). This link includes documentation about it apparently. From the link:

Volume 2: Solutions Using Kerberos Authentication (End States 1 and 2). Describes implementation of End States 1 and 2 using different technology approaches. In End State 1, UNIX clients use Active Directory Kerberos for authentication but continue to use an existing UNIX-based data store for authorization. In End State 2, UNIX clients use Active Directory Kerberos for authentication and Active Directory LDAP for authorization.

Let us know if it works for you; I am very interested in implementing such a thing for Linux projects.

share|improve this answer
add comment

Check out Centrify which provides a native agent for connecting directly to AD on hundreds of different flavors of UNIX or Linux (or OS X). There is a free product (Centrify Express) that includes authentication support for PAM, NSS and Kerberos clients. In addition they have a free windows application for deploying to and managing remotely many servers at once.

The for-pay suites include group policy, access control, authorization, privileged user management, reporting, user session recording/audit, encryption/authentication of data on the wire and much more.

Used in production on a big chunk of the Fortune 2000 UNIX and Linux servers.

Corey - a Centrify product manager

share|improve this answer
    
We're actually evaluating Centrify at the moment and it is very nice. Works flawlessly. In this instance however I need a pure ldap solution. –  sideh Oct 19 '10 at 9:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.