Ubuntu加入AD域

这几天在公司捣鼓了Ubuntu加入AD域的方法，结合了几篇文档和配置中出现的错误，准备了一份比较全的配置。
依照如下配置基本完成加入AD域和离线AD域账户登录的功能。

环境

• 域DNS地址

10.20.3.244

• 域名

EXAMPLEAD.NET

• 域DC

DC1.EXAMPLEAD.NET

Configure NTP and DNS

sudo apt-get install ntpdate
sudo ntpdate 10.20.3.244
sudo vim /etc/network/interfaces
dns-nameserver 10.20.3.244

Save and reboot

Install the required packages

sudo apt-get install winbind samba
sudo apt-get install libnss-winbind libpam-winbind
sudo apt-get install krb5-user

When asked to fill in the table , using this :

Default RELAM:

EXAMPLEAD.NET

Kerberos servers for realm:

DC1.EXAMPLEAD.NET

Administrative server for your kerberos realm:

DC1.EXAMPLEAD.NET

Configure the server

• Edit /etc/krb5.conf

    [libdefaults]
    default_realm = EXAMPLEAD.NET
    krb4_config = /etc/krb.conf
    krb4_realms = /etc/krb.realms
    kdc_timesync = 1
    ccache_type = 4
    forwardable = true
    proxiable = true
    [realms]
    EXAMPLEAD.NET = {
        kdc = DC1.EXAMPLEAD.NET
        admin_server = DC1.EXAMPLEAD.NET
    }
    [domain_realm]
    .examplead.net = EXAMPLEAD.NET
    examplead.net = EXAMPLEAD.NET

• Edit /etc/samba/smb.conf

    [global]
    workgroup = EXAMPLEAD
    security = ads
    netbios name = MLSZLAP031 //change the value for different client
    realm = EXAMPLEAD.NET 
    password server = DC1.EXAMPLEAD.NET 
    idmap uid = 500-10000000
    idmap gid = 500-10000000
    winbind separator = +
    idmap backend = tdb
    passdb backend = tdbsam
    winbind enum users = yes
    winbind enum groups = yes
    winbind use default domain = yes
    template homedir = /home/%D/%U
    template shell = /bin/bash
    client use spnego = yes
    domain master = no 
    winbind nested groups = yes
    winbind refresh tickets = yes
    winbind offline logon = true

• Edit /etc/nsswitch.conf

// /etc/nsswitch.conf
// Example configuration of GNU Name Service Switch functionality.
// If you have the glibc-doc-reference and info packages installed, try:
// info libc "Name Service Switch"' for information about this file.
passwd:         compat  winbind
group:          compat  winbind
shadow:         compat  winbind
gshadow:        files
hosts:          files mdns4_minimal [NOTFOUND=return] dns       wins
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup:       nis

• Edit /etc/pam.d/common-account

account [success=2 new_authtok_reqd=done default=ignore]        pam_unix.so
account [success=1 new_authtok_reqd=done default=ignore]        pam_winbind.so
account sufficient    pam_winbind.so
account required    pam_unix.so

• /etc/pam.d/common-auth

auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    [success=1 default=ignore]      pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login try_first_pass
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so

• Modify the /etc/pam.d/common-password

password   required   pam_unix.so nullok obscure min=4 max=50 md5password   required   pam_unix.so nullok obscure min=4 max=50 md5

• /etc/pam.d/common-session

session required        pam_mkhomedir.so umask=0022 skel=/etc/skelsession required        pam_mkhomedir.so umask=0022 skel=/etc/skel

Initialize Kerberos

sudo kinit [email protected]
sudo klist
malongit@MLSZLAP031:~$ sudo klist 
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [email protected]
Valid starting       Expires              Service principal
2017-09-01T10:17:22  2017-09-01T20:17:22  krbtgt/[email protected]
        renew until 2017-09-02T10:17:12

Join Domain

sudo net ads join -U [email protected]
sudo reboot

Configure SUDO

/etc/sudoers

%Group ALL=(ALL) ALL

Show infomation about user and group

Show user

wbinfo -u
getent passwd

Show group

wbinfo -g
getent group
```
## User manual login in Lightdm

edit /etc/lightdm/lightdm.conf.d/50-unity-greeter.conf

```
[SeatDefaults]
greeter-show-manual-login=true
greeter-hide-users=true
```