{"id":68,"date":"2012-03-31T00:13:51","date_gmt":"2012-03-31T00:13:51","guid":{"rendered":"http:\/\/tech.moosaico.com\/blog\/?p=68"},"modified":"2014-02-25T15:37:26","modified_gmt":"2014-02-25T15:37:26","slug":"authenticating-linux-users-against-microsoft-active-directory","status":"publish","type":"post","link":"https:\/\/thejoyofstick.com\/blog\/2012\/03\/31\/authenticating-linux-users-against-microsoft-active-directory\/","title":{"rendered":"Authenticating Linux users against Microsoft Active Directory"},"content":{"rendered":"<p>If you work in a company with Microsoft Windows focused IT this is a great way to delegate your Linux users authentication. No more &#8220;I forgot my password&#8221;. With this configuration you are free of that. However you still can create <i>local<\/i> users without this centralized authentication.<\/p>\n<p>This was tested with Ubuntu 8.04, 10.04 and 12.04<\/p>\n<h2>Active Directory credentials<\/h2>\n<p>The first step is to ask the Active Directory guys permission to use their authentication service. They will give you:<\/p>\n<ol>\n<li>The network address of the Active Directory (one or more, usually by IP address)<\/li>\n<li>A base DN<\/li>\n<li>A bind DN user<\/li>\n<li>A bind DN password<\/li>\n<\/ol>\n<p>This bind designated name will permit your systems to use the Active Directory. The base DN is the top level of the Active Directory (LDAP) directory tree.<\/p>\n<h2>The LDAP client configuration<\/h2>\n<p>You should install these modules. Usually it will ask for LDAP parameters during the installation. You can just ignore them at this time.<\/p>\n<pre lang=\"linux\">\r\nsudo apt-get install libpam-ldap\r\nsudo apt-get install libpam-modules\r\n<\/pre>\n<p>Now just edit your <code>\/etc\/ldap.conf<\/code> with the information you got in the previous section<\/p>\n<pre lang=\"linux\">\r\nhost 10.11.12.13\r\nbase ou=ACME,dc=example,dc=com\r\nldap version 3\r\nbinddn cn=Linux Auth System,ou=ACMEServiceAccounts,dc=example,dc=com\r\nbindpw uwegyjus\r\npam_login_attribute sAMAccountName\r\n<\/pre>\n<h2>Adapting the <code>pam<\/code> modules<\/h2>\n<p>Now make sure all the <code>\/etc\/pam.d\/common-*<\/code> files are like these<\/p>\n<p><code>\/etc\/pam.d\/common-account<\/code><\/p>\n<pre lang=\"linux\">\r\naccount    [success=2 new_authtok_reqd=done default=ignore] pam_unix.so\r\naccount    [success=1 default=ignore] pam_ldap.so\r\naccount    requisite pam_deny.so\r\naccount    required pam_permit.so\r\n<\/pre>\n<p><code>\/etc\/pam.d\/common-auth<\/code><\/p>\n<pre lang=\"linux\">\r\nauth    [success=2 default=ignore]    pam_unix.so nullok_secure\r\nauth    [success=1 default=ignore]    pam_ldap.so use_first_pass\r\nauth    requisite                     pam_deny.so\r\nauth    required                      pam_permit.so\r\n<\/pre>\n<p><code>\/etc\/pam.d\/common-password<\/code><\/p>\n<pre lang=\"linux\">\r\npassword    [success=2 default=ignore]    pam_unix.so obscure sha512\r\npassword    [success=1 user_unknown=ignore default=die]    pam_ldap.so use_authtok try_first_pass\r\npassword    requisite                     pam_deny.so\r\npassword    required                      pam_permit.so\r\n<\/pre>\n<p><code>\/etc\/pam.d\/common-session<\/code><\/p>\n<pre lang=\"linux\">\r\nsession    [default=1]    pam_permit.so\r\nsession    requisite      pam_deny.so\r\nsession    required       pam_permit.so\r\nsession    required       pam_unix.so\r\nsession    optional       pam_ldap.so\r\nsession    required       pam_mkhomedir.so umask=0022\r\n<\/pre>\n<p>But every authentication will fail. Your system doesn&#8217;t know anything about these <i>new<\/i> users. You have to add each user first :-)<\/p>\n<h2>Adding Linux users<\/h2>\n<p>You may have a framework to deploy users among several machines, but we will just add one:<\/p>\n<pre lang=\"linux\">sudo addgroup acme<\/pre>\n<p>By default all these <em>foreign<\/em> accounts will belong to the <code>acme<\/code> group.<\/p>\n<pre lang=\"linux\">sudo addusers --no-create-home --ingroup acme pkdick<\/pre>\n<p>and you just add to one of your systems user <code>pkdick<\/code> belonging to group <code>acme<\/code>. The <code>\/home\/pkdick<\/code> creation will be performed automatically by the <code>pam<\/code> system (<code>pam_mkhomedir.so<\/code>) and not by the <code>addusers<\/code> command.<\/p>\n<h2>So&#8230;<\/h2>\n<ul>\n<li>Get the authorization to deal with Active Directory<\/li>\n<li>Install <code>libpam-ldap<\/code> &plus; <code>libpam-modules<\/code><\/li>\n<li>Update <code>\/etc\/ldap.conf<\/code> and check <code>\/etc\/pam-d\/common-*<\/code><\/li>\n<li>Create the Linux users with the same user name from the Windows Domain.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>If you work in a company with Microsoft Windows focused IT this is a great way to delegate your Linux users authentication. No more &#8220;I forgot my password&#8221;. With this configuration you are free of that. However you still can&hellip; <a href=\"https:\/\/thejoyofstick.com\/blog\/2012\/03\/31\/authenticating-linux-users-against-microsoft-active-directory\/\" class=\"more-link\">Continue Reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[12,3,4],"tags":[23,15,21,24,20,22],"class_list":["post-68","post","type-post","status-publish","format-standard","hentry","category-auth","category-linux","category-ubuntu","tag-active-directory","tag-authentication","tag-linux-2","tag-pam","tag-ubuntu-2","tag-windows"],"jetpack_shortlink":"https:\/\/wp.me\/pcmwlL-16","jetpack_sharing_enabled":true,"jetpack_likes_enabled":false,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/posts\/68","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/comments?post=68"}],"version-history":[{"count":44,"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/posts\/68\/revisions"}],"predecessor-version":[{"id":604,"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/posts\/68\/revisions\/604"}],"wp:attachment":[{"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/media?parent=68"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/categories?post=68"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thejoyofstick.com\/blog\/wp-json\/wp\/v2\/tags?post=68"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}