Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want local users to be able to log in to a Linux server using their Windows domain (AD) passwords. (All local accounts have a matching userid in AD).

I've installed libpam-krb5, and the main settings in /etc/krb5.conf seem ok:

default_realm = FOO.COMPANY.COM
kdc = controller.foo.company.com

These settings work fine on another Linux box (Ubuntu); everything should be ok in the AD server.

As I don't know/remember, my question is, what else needs to be tweaked on the Linux server to get AD passwords to work when users try to log in?

The server is running Debian 5.0.3.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Right, got it working with some help from a colleague. The only additional configuration file that needed tweaking was /etc/pam.d/common-auth.

The original configuration was:

auth    required	pam_unix.so nullok_secure

We changed it to:

auth    [success=2 default=ignore]      pam_krb5.so minimum_uid=1000
auth    [success=1 default=ignore]      pam_unix.so nullok_secure try_first_pass
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so

AD passwords now work fine when logging on to the server.

share|improve this answer
    
This page looks like a useful resource btw: developer.novell.com/wiki/index.php/… (It also covers handling all account management in AD, unlike in our case.) –  Jonik Dec 15 '09 at 12:54

use google

http://www.ccs.neu.edu/home/battista/documentation/winbind/index.html
http://www.alethe.com/brad/2005/08/active-directory-authentication/
http://wiki.samba.org/index.php/Samba%5F&%5FActive%5FDirectory
http://blog.scottlowe.org/2007/01/15/active-directory-integration-index/

share|improve this answer
2  
The point of ServerFault is to consolidate knowledge relevant to this field. Eventually "Use Google" should be replaced by "Use ServerFault." –  sh-beta Dec 15 '09 at 12:20
    
@sh-beta: What about when google takes you to serverfault? –  chris Dec 15 '09 at 13:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.