Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a 64-bit Ubuntu 11.04 server I'm setting up, and I would like to configure it to use LDAP for authentication. The LDAP server happens to be an ActiveDirectory server, but I'm not trying to bind the machine to the domain.

I'm Googled and found a few sets of instructions, but none of them produce a working system. Many of them also have different lists of LDAP and PAM related packages to install, which make me suspicious that the instructions out there are half baked.

Can anybody point me to a reputable set of instructions for the current Ubuntu release?

share|improve this question

2 Answers 2

What your looking for is called LDAP Authentication. It requires configuring PAM and NSS to use LDAP as a source for user names and passwords. Pretty much any LDAP server can be used.

Where you will run into a snag is the field names. Linux is configured to use the fields commonly used by UNIX systems, not Windows AD, so you will have to play with the mappings.

Take a look at the Ubuntu 11.10 Server Guide chapter 6 part 1.10 and the ActiveDirectoryHowTo page at Ubuntu's help site. You will want to run an ldapsearch against your AD server to get the field names to use then update file that has the field mappings. In 10.04, the file was /etc/ldap.conf.

share|improve this answer

I found this page helpful in the past: Scott Lowe: Linux-AD Integration

I recommend following Scott's lead and using Kerberos authentication (pam_krb5). This is a bit nicer than LDAP bind authentication (pam_ldap) because Kerberos gives you single sign-on. (For example, if you're logged into a Windows desktop on the same domain and using the latest PuTTY, you can SSH in to a Kerberos-enabled Unix/Linux server without typing in your password again.)

To use Kerberos properly you do need to perform some kind of domain join so that the client knows it can trust the central directory. If you really don't want to join the domain, and you don't mind reduced security, investigate the verify_ap_req_nofail option in krb5.conf.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.