Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sorry if I am misusing terms here; I actually don't know much about Active Directory and the related technologies. Basically I have a Linux computer and I'd like it (or my user on that computer) to be associated with my user on the Domain, so that I can browse the network and all that stuff windows has.

Is this feasible? What do I need to look into to do something like this?

share|improve this question

6 Answers 6

There are four main options:

  • Kerberos plus LDAP - This is a lower-level option where you set up Linux to use Active Directory's underlying protocols yourself. Described in (this answer)[#76815].
  • Samba - Samba is the de facto standard for joining a Linux machine to a Windows domain.
  • Likewise - Likewise is basically Samba-in-a-box; easier to set up than a full-fledged Samba installation (the GUI should do it for you in under an hour, including time to read its docs), but correspondingly less control. Likewise Open is free of charge; Likewise Enterprise adds features like managing Linux machines via Group Policy.
  • Microsoft Windows Services for Unix includes options for serving usernames to Linux / UNIX via NIS and for synchronizing passwords to Linux / UNIX machines. You'd use this if you wanted to do everything possible from Windows or if you had an existing Linux / UNIX infrastructure you wanted to tie to Windows; for most environments, though, one of the other solutions would be better.
share|improve this answer
    
+1 for Likewise. Likewise Open has saved me hundreds of hours in user administration. I specifically built an AD infrastructure for my Linux boxes. Way, way way way way better. –  Matt Simmons Oct 21 '09 at 17:33

I'd suggest looking at an excellent public domain package called Samba. It might very well be part of the Linux distribution that you have installed.

share|improve this answer

In order to get all the benefits and security of AD, you'll need a solution involving Kerberos (for authentication) and LDAP (for authorization). There's an excellent tutorial here that I've used in the past and it works amazingly well. It's more complex to implement than just using samba/winbindd, but you'll get the benefit of being able to use the UNIX attributes in AD to manage your linux users, groups, uids, gids, etc.

share|improve this answer
1  
I believe that Samba/Winbind can use AD's UNIX attributes as well, using the idmap_ad backend (samba.org/samba/docs/man/manpages-3/idmap_ad.8.html) and the "winbind nss info" smb.conf setting (samba.org/samba/docs/man/manpages-3/smb.conf.5.html#id2564796) setting. –  Josh Kelley Oct 21 '09 at 16:17
    
Heh, news to me :-) That's a nice feature to have. I guess I still prefer the security that Kerberos brings, but for more simple setups, this will probably be just fine. –  EEAA Oct 21 '09 at 16:24

Two ways that I know of. From the linux host you can try this:

root# net ads join -UAdministrator%password

Or you can just create the computer object in active directory.

Like everyone else said, you'll need to add the samba packages to get that to happen.

http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/domain-member.html

share|improve this answer

Samba/Likewise is overkill.

Set up pam_krb5, authenticating to the KDC of the AD domain.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.