Chapter 36. Joining RHEL systems to an Active Directory by using RHEL system roles
Chapter 36. Joining RHEL systems to an Active Directory by using RHEL system roles If your organization uses Microsoft Active Directory (AD) to centrally manage users, groups, and other resources, you can join your Red Hat Enterprise Linux (RHEL) host to this AD. For example, AD users can then log into RHEL and you can make services on the RHEL host available for authenticated AD users. By using the ad_integration RHEL system role, you can automate the integration of Red Hat Enterprise Linux system into an Active Directory (AD) domain. Note The ad_integration role is for deployments using direct AD integration without an Identity Management (IdM) environment. For IdM environments, use the ansible-freeipa roles. The ad_integration system role is not included in the ansible-freeipa package. It is part of the rhel-system-roles package. You can install rhel-system-roles on systems with a Red Hat Enterprise Linux Server subscription attached. 36.1. Joining RHEL to an Active Directory domain by using the ad_integration RHEL system role You can use the ad_integration RHEL system role to automate the process of joining RHEL to an Active Directory (AD) domain. Prerequisites You have prepared the control node and the managed nodes You are logged in to the control node as a user who can run playbooks on the managed nodes. The account you use to connect to the managed nodes has sudo permissions on them. The managed node uses a DNS server that can resolve AD DNS entries. Credentials of an AD account which has permissions to join computers to the domain. Ensure that the required ports are open: Ports required for direct integration of RHEL systems into AD using SSSD Procedure Store your sensitive variables in an encrypted file: Create the vault: After the ansible-vault create command opens an editor, enter the sensitive data in the <key> : <value> format: usr: administrator pwd: <password> Save the changes, and close the editor. Ansible encrypts the data in the vault. Create a playbook file, for example ~/playbook.yml , with the following content: --- - name: Active Directory integration hosts: managed-node-01.example.com vars_files: - vault.yml tasks: - name: Join an Active Directory ansible.builtin.include_role: name: rhel-system-roles.ad_integration vars: ad_integration_user: "{{ usr }}" ad_integration_password: "{{ pwd }}" ad_integration_realm: "ad.example.com" ad_integration_allow_rc4_crypto: false ad_integration_timesync_source: "time_server.ad.example.com" The settings specified in the example playbook include the following: ad_integration_allow_rc4_crypto: <true|false> Configures whether the role activates the AD-SUPPORT crypto policy on the managed node. By default, RHEL does not support the weak RC4 encryption but, if Kerberos in your AD still requires RC4, you can enable this encryption type by setting ad_integration_allow_rc4_crypto: true . Omit this the variable or set it to false if Kerberos uses AES encryption. ad_integration_timesync_source: <time_server> Specifies the NTP server to use for time synchronization. Kerberos requires a synchronized time among AD domain controllers and domain members to prevent replay attacks. If you omit this variable, the ad_integration role does not utilize the timesync RHEL system role to configure time synchronization on the managed node. For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.ad_integration/README.md file on the control node. Validate the playbook syntax: Note that this command only validates the syntax and does not protect against a wrong but valid configuration. Run the playbook: Verification Check if AD users, such as administrator , are available locally on the managed node: Additional resources /usr/share/ansible/roles/rhel-system-roles.ad_integration/README.md file /usr/share/doc/rhel-system-roles/ad_integration/ directory Ansible vault
ansible-vault create vault.yml New Vault password: <vault_password> Confirm New Vault password: <vault_password> usr: administrator pwd: <password> --- - name: Active Directory integration hosts: managed-node-01.example.com vars_files: - vault.yml tasks: - name: Join an Active Directory ansible.builtin.include_role: name: rhel-system-roles.ad_integration vars: ad_integration_user: "{{ usr }}" ad_integration_password: "{{ pwd }}" ad_integration_realm: "ad.example.com" ad_integration_allow_rc4_crypto: false ad_integration_timesync_source: "time_server.ad.example.com" ansible-playbook --ask-vault-pass --syntax-check ~/playbook.yml ansible-playbook --ask-vault-pass ~/playbook.yml ansible managed-node-01.example.com -m command -a 'getent passwd administrator@ad.example.com' administrator@ad.example.com:*:1450400500:1450400513:Administrator:/home/administrator@ad.example.com:/bin/bash