How to use Active Directory to authenticate linux users

Question

What are the best-practices for using Active Directory to authenticate users on linux (Debian) boxes?

The way I would like it to work would be to add AD users to a group - say linux administrators or linux webserver, and based on their group membership they would/would not be granted access to a particular server. Ideally the root account would be the only one maintained in the standard way.

My goals in doing this are as follows:

• To allow password changes in one place
• To automatically grant certain people access to the linux servers using their AD credentials
• To consolodate all of our user information into one database

Things I want to avoid are:

• anything difficult/counter-intuitive for our Active Directory administrator to manage
• locking users out if the AD servers are unreachable for some reason (ie - it needs to cache the credentials somehow)
• anything too complex or non-standard that will break the next time I upgrade the server.

Answer 1

Also see http://serverfault.com/questions/12454/linux-clients-on-a-windows-domains and http://serverfault.com/questions/15626/how-practical-is-to-authenticate-a-linux-server-against-ad

Answer 2

The software you are looking for is called Likewise-open.

From their page:

• Joins non-Windows systems to Active Directory domains in a single step from the command line or from a GUI
• Authenticates users with a single user name and password on both Windows and non-Windows
• Enforces the same password policies for non-Windows users and Windows users
• Supports multiple forests with one-way and two-way cross forest trusts
• Caches credentials in case your domain controller goes down
• Provides single sign-on for SSH and Putty
• Next-generation authentication engine that supports Kerberos, NTLM, and SPNEGO
• No schema changes to Active Directory required

We've used it on some machines here and it seems to work well.

http://www.likewise.com/products/likewise_open/

Answer 3

I've used Likewise-Open, and found it to be buggy and not very reliable. Last year I switched to Centrify, both for Linux and for the Mac, and haven't had to mess with it much at all. I far prefer Centrify's conf file configuration to Likewise-Open's registry file configuration that requires manipulation with external tools.

http://www.centrify.com/express/free-active-directory-tools-for-linux-mac.asp

Answer 4

You should evaluate Radius. Configure the linux boxes to use pam-radius and install the MS radius plugin NPS. It will talk to AD. You can get an overview in the pdf eguide here: http://www.wikidsystems.com/learn-more/two-factor-authentication-white-papers (no reg). Just ignore the two-factor authentication bits.