Joining a CentOS or Red Hat server to Active Directory lets domain users log in with their AD credentials. This step-by-step guide uses Samba Winbind and authconfig, restricts shell access to admins, creates home folders on first login, and grants sudo to Domain Admins.
1. Install Samba, Winbind, and nscd
yum install nscd samba samba-common samba-client samba-winbind
yum upgrade
Add your domain controller to /etc/hosts:
192.168.1.30 dc.domain.com pdc01
2. Join the Domain with authconfig-tui
- Run
authconfig-tui.
- Under Authentication Configuration, check Cache Information, Use Winbind, Use MD5 Passwords, Use Shadow Passwords, and Use Winbind Authentication.
- Under Winbind Settings, choose ads. Enter the short domain name (for example.com, enter just
example), the FQDN of your domain controllers, the FQDN of the primary DC as the ADS realm, and /bin/bash as the shell.
- Click Join Domain, enter domain administrator credentials, and confirm the server joined successfully.
3. Restrict Shell Access with a Bash Wrapper
Create /usr/local/bin/bash-wrapper so only local wheel members and Domain Admins get a shell:
#!/bin/sh
# This script restricts shell access to privileged users. The "template shell"
# option in the '/etc/samba/smb.conf' file should be set to call this wrapper.
# Get group memberships for this user.
BFN_ID=$(/usr/bin/id)
# Grant shell access to users that are in the local wheel group.
if /bin/echo "$BFN_ID" | /bin/grep -P '[=,][0-9]{1,8}\(wheel\)' > /dev/null
then
exec /bin/bash --login "$@"
fi
# Grant shell access to users that are in the domain administrators group.
if /bin/echo "$BFN_ID" | /bin/grep -P '[=,][0-9]{1,8}\(domain admins\)' > /dev/null
then
exec /bin/bash --login "$@"
fi
# Else print a notice and just exit.
echo "Shell access to this computer is disabled."
# eof
4. Finish the Configuration (Phase 2 Script)
Create /usr/local/bin/ad-phase2.sh. Edit the LDAP base line to match the OU of the users you want to allow before running it.
# ad-phase2.sh - Phase 2
# Description: This script automates the process of joining a linux box
# to an AD domain. The process is divided in two parts.
#
# Please edit the relevant parts of the script below prior running it
# This block doesn't need to be edited
#sed -i 's%protocols: files%protocols: files winbind%g' /etc/nsswitch.conf
#sed -i 's%rpc: files%rpc: files winbind%g' /etc/nsswitch.conf
#sed -i 's%netgroup: files%netgroup: files winbind%g' /etc/nsswitch.conf
#sed -i 's%automount: files%automount: files winbind%g' /etc/nsswitch.conf
# The following line allows users to logon without the EXAMPLE\user syntax
sed -i 's%winbind use default domain = false%winbind use default domain = true%g' /etc/samba/smb.conf
# More parameters to make life easier with UID and GID correspondences
sed -i 's% template shell = /bin/bash% template shell = /usr/local/bin/bash-wrapper%g' /etc/samba/smb.conf
sed -i '/ winbind offline logon = false/a winbind enum users = true' /etc/samba/smb.conf
sed -i '/winbind enum users = true/a winbind enum groups = true' /etc/samba/smb.conf
sed -i '/winbind enum groups = true/a winbind cache time = 5' /etc/samba/smb.conf
sed -i '/winbind cache time = 5/a winbind nested groups = true' /etc/samba/smb.conf
# Create home folders in /home/DOMAIN/username on first login
echo "session optional pam_mkhomedir.so skel=/etc/skel/ umask=0022" >> /etc/pam.d/system-auth
# Allow all users in the Domain Admins group to sudo on the server
echo "%domain admins ALL=(ALL) ALL" >> /etc/sudoers
# Replace "base OU=Users,DC=example,DC=com" with the container of the users you want to allow on the box
sed -i 's%base dc=*******,dc=com%base OU=Users,DC=*******************,DC=com%g' /etc/openldap/ldap.conf
Make both scripts executable, run the phase 2 script, and restart the services:
chmod +x /usr/local/bin/ad-phase2.sh
chmod +x /usr/local/bin/bash-wrapper
/usr/local/bin/ad-phase2.sh
service winbind restart
service nscd restart
Reboot for good measure, then test logging in with a domain account.
