3

We currently have our CentOS 5.5 servers authenticating against our Active Directory environment (Windows 2003 R2) utilizing Samba & Winbind. It's served us well but we need something more robust and someone has suggested utilizing LDAP & Kerberos to authenticate directly against AD. The main motivation behind this push is we have disparate UID/GID where a single user (bob) on one server will have UID 501 and on the other 531 and it's affecting permissions for SMB mounted directories.

It's my understanding (speaking as a Linux newb) that the Unix attributes in AD can be read, therefore centralizing and standardizing our UID/GID across the environment? I'd like this environment to be as stable as possible and don't think the Samba/Winbind solution is scaling well, so if I can do this strictly by pointing to AD as an LDAP server that would be ideal.

Any suggestions are greatly appreciated and will keep me from pulling my hair out further.

Improve this question

2 Answers 2

Reset to default
3

First off, don't forget to install the "Identity Management for UNIX" windows component under "Active Directory Services", in the "Add/Remove Windows Components" window.

An Active Directory DC will supply you with 2 services:

  1. User enumeration (UID/GID/Home Dir/etc.) via LDAP
  2. User Authentication via Kerberos

On CentOS servers, you will need to configure LDAP user enumeration through /etc/ldap.conf, your Kerberos configuration goes in /etc/krb5.conf and to make use of the users, you need to update /etc/nsswitch.conf.

To enable Kerberos authentication, you will need to edit the /etc/pam.d/system-auth file.

A few gottachs:

  • Make sure your time is synced from a reliable source, on the DC and clients
  • Make sure you have proper resolving and back resolving
  • Must guides will show you how to bind to the DC with a user/pass, a more secure way will be using a Kerberos ticket for DC authentication (For user enumeration/authentication)
  • It will probably not work on the first shot, leave a root user logged in as long as possible to allow for quick fixes without needing to go into Rescue mode (after you've blocked yourself out of a machine).

A quick search came up with the following guide. After that works, I would try Kerberos binding to the DC. The guide is for RHEL5, but will work all the same on CentOS5

Improve this answer
1

If your only problem with winbind is the UID mismatch among servers, then make sure winbind uses the Active Directory RID to generate its UIDs, and they'll be consistent. This earlier question should have enough details to get you started. I've never yet needed any of the Unix extensions for AD, and the linked method is working for me on a few dozen separate servers, all mounting the same central NFS share without mismatches.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .