将 Fedora Linux 系统添加到企业域中
活动目录
![](/data/attachment/album/202105/26/120149o01pzllgw119w66l.jpg)


在企业互联网场景中，一般情况下最广泛使用的基于 Linux 的操作系统是 Red Hat Enterprise Linux（RHEL），它主要用于服务器，但也可以用作工作站。Fedora linux 其实也是工作站系统的一个很好的选择，它提供了许多在企业环境中工作的特性，使管理成为一项简单的任务。


当你的工作网络中有许多机器时，你需要一种以集中方式管理用户和机器的方法。[FreeIPA](https://www.freeipa.org/page/Main_Page) 和 <ruby> <a href="https://en.wikipedia.org/wiki/Active_Directory">  活动目录 </a> <rt>  Active Directory </rt></ruby> 就是用于这个任务的技术。它们允许系统管理员使用网络中所有实体的目录来管理大量的机器。


### Fedora 中的活动目录


活动目录在公司环境中非常常见。Fedora 和 RHEL 通过使用 SSSD （<ruby> 系统安全服务守护进程 <rt>  System Security Services Daemon </rt></ruby>）与 FreeIPA 或活动目录等服务很好地集成。SSSD 是一种访问远程目录和身份验证机制的系统服务。使用此软件的计算机能够使用远程凭据进行身份验证，并访问该目录网络中可用的其他服务。


要加入域网络，你需要域管理员的权限才能添加计算机。可以通过在域凭据上设置特殊权限或代表你对该计算机进行预配置。Fedora Linux 有一个在安装时配置机器的选项，叫做<ruby> 企业登录 <rt>  Enterprise Login </rt></ruby>。如果你的计算机网络自动配置为企业域网络，那么你可以直接使用域凭据登录。


![](/data/attachment/album/202105/26/120154yq8an95nfi8zrbx3.png)


如果你的配置不是自动的，或者你已经安装了 Fedora Linux，你可以通过以下几个配置步骤加入一个活动目录域：


1. 设置此计算机的 DNS。要连接到目录服务，首先需要能够解析目录域名。如果你的网络使用 DHCP 设置正确的 DNS，则可以跳过此步骤。
2. 更改你的计算机名称，以反映它将是新域的一部分。编辑文件 `/etc/hostname`，并将机器名更改为 `machinename.my_domain`。
3. 通过执行以下命令加入域：`sudo realm join my_domain -v`（ 用域名称替换 `my_domain`）。


运行此命令后，系统将请求允许加入该域中新计算机的用户的凭据。如果进程中没有错误，则机器将成为域的一部分。


![](/data/attachment/album/202105/26/120154dzc0j91zm0zwjhjh.png)


现在，此计算机已成为你的域的一部分，你可以：


* 使用域用户名登录到计算机
* 获取 kerberos 票据以访问域网络中的不同服务
* 访问其他服务，具体取决于域的配置方式


### 使用 Fleet Commander 管理 Fedora Linux


现在这台计算机已经是你的域的一部分了，你可以使用活动目录的域管理员工具来管理它。由于你的计算机没有运行 Windows，因此你只能进行身份验证以及访问网络和目录服务。无法在此计算机上设置与桌面相关的配置。


幸运的是，Fedora 有个工具叫 [Fleet Commander](https://fleet-commander.org/)。


#### 创建配置


Fleet Commander 是一个管理工具，允许你为网络中的所有 Fedora Linux 机器设置桌面配置文件。


这意味着，你可以简单地为 GNOME 桌面、Firefox、Chrome、LibreOffice 和其他支持的软件设置任何配置，然后在登录到选定的用户/组/计算机时以细粒度的方式应用该配置。


![](/data/attachment/album/202105/26/120154ludxgx4axgdk64uy.png)


要使用这个工具首先安装 `fleet-commander-admin` 软件包：



```
sudo dnf install fleet-commander-admin

```

然后，用浏览器访问 [http://localhost:9090](http://localhost:9090/) 来登录。在左边的菜单中，点击 “Fleet Commander”。


Fleet Commander 有一个工具，可以使用“实时会话”机制直观地设置配置概要文件。它运行一个虚拟机，作为基本机器的模板。你需要手动进行所需的配置更改。然后检查所有配置更改，选择要添加到配置文件中的更改，然后部署它。


#### 管理客户端


在每个 Fedora Linux 或 RHEL 机器中，你都需要安装 Fleet Commander 客户端服务。此服务在用户登录时激活。它在域中搜索应用于当前用户/计算机的配置文件，并应用这个配置。


安装 `fleet-commander-client`：



```
sudo dnf install fleet-commander-client

```

软件将自动检测机器是否是域的一部分。当用户登录时，它将使用应用于该用户的配置文件来设置会话。




---


via: <https://fedoramagazine.org/join-fedora-linux-enterprise-domain/>


作者：[ogutierrez](https://fedoramagazine.org/author/ogutierrez/) 选题：[lujun9972](https://github.com/lujun9972) 译者：[Chao-zhi](https://github.com/Chao-zhi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
When you think about corporate networks, the most widely used Linux-based operating system that comes to mind is Red Hat Enterprise Linux (RHEL), used mostly on servers, but also as workstations. Fedora Linux is also a very good choice for a workstation, and comes packed with lots of features to work in the corporate environment and makes management an easy task.

When you work with many machines in your network you need a way to manage users and machines in a centralized way. That’s why [FreeIPA](https://www.freeipa.org/page/Main_Page) and [Active Directory](https://en.wikipedia.org/wiki/Active_Directory) are the technologies of choice for this task. They allow a sysadmin to manage a huge amount of machines using a directory of all the entities in their network.

## Fedora and Active Directory

Active Directory is very common in corporate environments. Fedora and RHEL integrate well with services such as FreeIPA or Active Directory by using the System Security Services Daemon (SSSD). SSSD is a system service to access remote directories and authentication mechanisms. A machine using this software is able to authenticate with remote credentials and access other services available in that directory network.

To join a domain network, you need the domain administrator’s permission to add the machine. Maybe by setting special permissions on your domain credentials or doing the pre-configuration of that machine on your behalf. Fedora Linux has an option to configure a machine during installation called *Enterprise Login*. If your machine network is automatically configured for the enterprise domain network, then you can login with your domain credentials directly.

In the case your configuration is not automated—or you have Fedora Linux already installed—you can join an Active Directory domain with a few configuration steps:

- Set up the DNS for this machine. To connect to a directory service, you need first to be able to resolve the directory domain name. If your network sets up the correct DNS using DHCP, you can skip this step.
- Change your machine name to reflect it will be part of the new domain. Edit the file
*/etc/hostname*and change the machine name to “machinename.my_domain” - Join the domain by executing this command:
*sudo realm join my_domain -v*(replace “my_domain” with the name of your domain)

After running this command, the system will ask for the credentials of a user allowed to join new machines in that domain. If there are no errors in the process, the machine will become part of the domain.

Now that this machine is part of your domain you can:

- Login with a domain username into the machine
- Get kerberos tickets to access different services in the domain network
- Access other services, depending on how the domain is configured

## Manage Fedora Linux with Fleet Commander

Now the machine is part of your domain, you can manage it with the domain administrator tools for Active Directory. Since your machine is not running Windows, you are limited to authentication and access to network and directory services. You cannot set up things like desktop-related configuration on this machine.

Luckily, Fedora has a tool called [Fleet Commander](https://fleet-commander.org/).

### Create configuration

Fleet Commander is a management tool that allows you to set up desktop configuration profiles for all Fedora Linux machines across your network.

This means, you can set up any configuration for GNOME desktop, Firefox, Chrome, LibreOffice, and other supported software in an easy way, and then make that configuration to be applied on login to the selected users/groups/machines in a granular way.

To use this tool, install the fleet-commander-admin package

sudo dnf install fleet-commander-admin

Next, visit [http://localhost:9090](http://localhost:9090/) in your browser to log in. On the menu to the left, click on *Fleet Commander*.

Fleet Commander has a tool to set up the configuration profiles intuitively using a “live session” mechanism. It runs a VM that serves as a template of your base machines. You have to manually make the configuration changes you want. Then you review all the configuration changes, select the ones you want to add to the profile, and deploy it.

### Manage clients

In each of your Fedora Linux or RHEL machines, you will need to install the Fleet Commander client service. This service activates when a user logs in. It searches the domain for the profiles that apply to current user/machine, and applies the configuration for the session.

To install the fleet-commander-client:

sudo dnf install fleet-commander-client

The software will detect if the machine is part of a domain automatically. When a user logs in, it will set up the session with the profiles that apply to the user.

## Marcelo

Congratulations on the article, very useful to know these resources, thank you.

## Os

Very useful information.

Thanks.

## LavaCreeperKing

Wow did not know about all of this. I don’t have a Windows server(Windows is terrible) to create an active directory with, but there is a tool to create Linux domains with. So I now need to play with setting up a Linux domain.

## MT

I tested it on a stock Fedora 34 Workstation Installation and a Windows Server 2016 Standard Edition.

I have to add “rc4-hmac” in the file “/etc/krb5.conf.d/crypto-policies” on my Fedora Workstation. Then the join succeeded. Without “rc4-hmac” it did not work.

## Muhammad Zamri Bin Muhamad Suharini

Thanks for the info

## René Genz

re-adding “rc4-hmac” is a bad solution considering security, see:

https://bugzilla.redhat.com/show_bug.cgi?id=1839414#c4

better enable AES in Active Directory

## DDG

What would happen if i install this on my laptop, bring said laptop outside with no connection to my FreeIPA/AD boxes at home? Can i still login?

## James

Yes, SSSD caches the last-seen good credentials.

## René Genz

SSSD supports offline login: https://fedoraproject.org/wiki/Features/SSSD#Benefit_to_Fedora

First log in with directory-based account must happen on-site. Fleet Commander client not required for offline login.

## Oliver

Yes. SSSD caches the login information so you can login offline. Fleet Commander Client is not required for login. It just fires after login, and in the case of Active Directory, checks if the directory services are present, downloads the profiles for that user and then apply them. In the case of FreeIPA, the profiles are downloaded and cached by SSSD.

If Fleet Commander is not able to download the profiles in Active Directory and there was a previous login, if will reuse the cached profiles.

## Mike

Yes, SSSD allows for cached credentials. Well it did for my test when I was playing with it a couple years ago.

## Torsten Nielsen

Joining a machine during installation went without a hitch, but I’m wondering how to get admin/root/sudo priviledges after the installation is complete. I didn’t create any local admin account. Logging in with AD-credentials work, but I don’t have sudo rights. Do I have to manage sudo via AD? or am I missing something obvious?

## ogutierrez

We are working on that.

https://gitlab.gnome.org/GNOME/gnome-initial-setup/-/issues/80

## Torsten Nielsen

Thanks!