Chapter 2. Connecting RHEL systems directly to AD using Samba Winbind
Chapter 2. Connecting RHEL systems directly to AD using Samba Winbind To connect a RHEL system to Active Directory (AD), use: Samba Winbind to interact with the AD identity and authentication source realmd to detect available domains and configure the underlying RHEL system services. 2.1. Overview of direct integration using Samba Winbind Samba Winbind emulates a Windows client on a Linux system and communicates with AD servers. You can use the realmd service to configure Samba Winbind by: Configuring network authentication and domain membership in a standard way. Automatically discovering information about accessible domains and realms. Not requiring advanced configuration to join a domain or realm. Note that: Direct integration with Winbind in a multi-forest AD setup requires bidirectional trusts. Remote forests must trust the local forest to ensure that the idmap_ad plug-in handles remote forest users correctly. Samba's winbindd service provides an interface for the Name Service Switch (NSS) and enables domain users to authenticate to AD when logging into the local system. Using winbindd provides the benefit that you can enhance the configuration to share directories and printers without installing additional software. Additional resources Using Samba as a server realmd man page on your system winbindd man page on your system 2.2. Supported Windows platforms for direct integration You can directly integrate your RHEL system with Active Directory forests that use the following forest and domain functional levels: Forest functional level range: Windows Server 2008 - Windows Server 2016 Domain functional level range: Windows Server 2008 - Windows Server 2016 Direct integration has been tested on the following supported operating systems: Windows Server 2022 (RHEL 8.7 or later) Windows Server 2019 Windows Server 2016 Windows Server 2012 R2 Note Windows Server 2019 and Windows Server 2022 do not introduce a new functional level. The highest functional level Windows Server 2019 and Windows Server 2022 use is Windows Server 2016. 2.3. Joining a RHEL system to an AD domain Samba Winbind is an alternative to the System Security Services Daemon (SSSD) for connecting a Red Hat Enterprise Linux (RHEL) system with Active Directory (AD). You can join a RHEL system to an AD domain by using realmd to configure Samba Winbind. Procedure If your AD requires the deprecated RC4 encryption type for Kerberos authentication, enable support for these ciphers in RHEL: Install the following packages: To share directories or printers on the domain member, install the samba package: Backup the existing /etc/samba/smb.conf Samba configuration file: Join the domain. For example, to join a domain named ad.example.com : Using the command, the realm utility automatically: Creates a /etc/samba/smb.conf file for a membership in the ad.example.com domain Adds the winbind module for user and group lookups to the /etc/nsswitch.conf file Updates the Pluggable Authentication Module (PAM) configuration files in the /etc/pam.d/ directory Starts the winbind service and enables the service to start when the system boots Optional: Set an alternative ID mapping back end or customized ID mapping settings in the /etc/samba/smb.conf file. For details, see the Understanding and configuring Samba ID mapping Edit the /etc/krb5.conf file and add the following section: Verify that the winbind service is running: Important To enable Samba to query domain user and group information, the winbind service must be running before you start smb . If you installed the samba package to share directories and printers, enable and start the smb service: Verification Display an AD user's details, such as the AD administrator account in the AD domain: Query the members of the domain users group in the AD domain: Optional: Verify that you can use domain users and groups when you set permissions on files and directories. For example, to set the owner of the /srv/samba/example.txt file to AD\administrator and the group to AD\Domain Users : Verify that Kerberos authentication works as expected: On the AD domain member, obtain a ticket for the administrator@AD.EXAMPLE.COM principal: Display the cached Kerberos ticket: Display the available domains: Additional resources If you do not want to use the deprecated RC4 ciphers, you can enable the AES encryption type in AD. See Enabling the AES encryption type in Active Directory using a GPO realm(8) man page on your system 2.4. realm commands The realmd system has two major task areas: Managing system enrollment in a domain. Controlling which domain users are allowed to access local system resources. In realmd use the command line tool realm to run commands. Most realm commands require the user to specify the action that the utility should perform, and the entity, such as a domain or user account, for which to perform the action. Table 2.1. realmd commands Command Description Realm Commands discover Run a discovery scan for domains on the network. join Add the system to the specified domain. leave Remove the system from the specified domain. list List all configured domains for the system or all discovered and configured domains. Login Commands permit Enable access for specific users or for all users within a configured domain to access the local system. deny Restrict access for specific users or for all users within a configured domain to access the local system. Additional resources realm(8) man page on your system
update-crypto-policies --set DEFAULT:AD-SUPPORT yum install realmd oddjob-mkhomedir oddjob samba-winbind-clients samba-winbind samba-common-tools samba-winbind-krb5-locator krb5-workstation yum install samba mv /etc/samba/smb.conf /etc/samba/smb.conf.bak realm join --membership-software=samba --client-software=winbind ad.example.com [plugins] localauth = { module = winbind:/usr/lib64/samba/krb5/winbind_krb5_localauth.so enable_only = winbind } systemctl status winbind Active: active (running) since Tue 2018-11-06 19:10:40 CET; 15s ago systemctl enable --now smb getent passwd "AD\administrator" AD\administrator:*:10000:10000::/home/administrator@AD:/bin/bash getent group "AD\Domain Users" AD\domain users:x:10000:user1,user2 chown "AD\administrator":"AD\Domain Users" /srv/samba/example.txt kinit administrator@AD.EXAMPLE.COM klist Ticket cache: KCM:0 Default principal: administrator@AD.EXAMPLE.COM Valid starting Expires Service principal 01.11.2018 10:00:00 01.11.2018 20:00:00 krbtgt/AD.EXAMPLE.COM@AD.EXAMPLE.COM renew until 08.11.2018 05:00:00 wbinfo --all-domains BUILTIN SAMBA-SERVER AD