Authenticating Linux against AD



  • Have any of you had experience with the various tools out there to be able to bind Linux (CentOS 6.7/7 and Ubuntu 14.04 and soon 16.04)and authenticate against AD? I've seen some very positive things about both winbind and sssd, but I was curious if any of you have had experience and resulting recommendations.

    And, just to remove it from the discussion, not authenticating against AD is not on the table. I want to be able to have one central place for managing logins and permissions for all of our platforms (Windows, Linux, and OSX), and AD is the apex of our system.



  • This post is deleted!


  • Ubuntu has long supported authenticating against Active Directory. How usable it is I'm not 100% certain it is with the current OS's but I've used it in the past for various projects.



  • Setting it up to authenticate is pretty easy. Ubuntu has an automated process and the CentOS one has a lot of guides available. The one thing I haven't been able to get working yet is setting up SUDO with AD.



  • I've not used Linux against AD much, when I did it was with Centrify.



  • I've set up centrify on my company laptop .



  • @coliver said:

    Setting it up to authenticate is pretty easy. Ubuntu has an automated process and the CentOS one has a lot of guides available. The one thing I haven't been able to get working yet is setting up SUDO with AD.

    This blog post appears to show how to get winbind to handle sudo in AD: https://mikrocentillion.wordpress.com/2013/06/05/centos-6-authenticate-and-sudo-active-directory-users/.



  • Centrify Express or the paid option?



  • I used centrify express I believe...

    edit: it was express, I didnt pay anything.



  • this only works with red hat systems, but is one thing we will be doing in the future. Their Identity Management system will integrate with AD. IdM is set up as its own forest and you can have a trust between the two (pardon my windows jargon if it's incorrect). You can then set up host and user based sudo permissions.



  • @johnhooks said:

    this only works with red hat systems, but is one thing we will be doing in the future. Their Identity Management system will integrate with AD. IdM is set up as its own forest and you can have a trust between the two (pardon my windows jargon if it's incorrect). You can then set up host and user based sudo permissions.

    Is that for RHEL only, or the derived distros too?



  • @Kelly said:

    @johnhooks said:

    this only works with red hat systems, but is one thing we will be doing in the future. Their Identity Management system will integrate with AD. IdM is set up as its own forest and you can have a trust between the two (pardon my windows jargon if it's incorrect). You can then set up host and user based sudo permissions.

    Is that for RHEL only, or the derived distros too?

    All RHEL based as far as I know. I've only tried RHEL, CentOS and Fedora though.



  • @johnhooks said:

    @Kelly said:

    @johnhooks said:

    this only works with red hat systems, but is one thing we will be doing in the future. Their Identity Management system will integrate with AD. IdM is set up as its own forest and you can have a trust between the two (pardon my windows jargon if it's incorrect). You can then set up host and user based sudo permissions.

    Is that for RHEL only, or the derived distros too?

    All RHEL based as far as I know. I've only tried RHEL, CentOS and Fedora though.

    Now I have an interesting quandary. Do I go with something more universally supported so the scientists that love Ubuntu can stay on it, or push for unification on CentOS...

    Probably the former given internal culture.



  • @Kelly said:

    @johnhooks said:

    @Kelly said:

    @johnhooks said:

    this only works with red hat systems, but is one thing we will be doing in the future. Their Identity Management system will integrate with AD. IdM is set up as its own forest and you can have a trust between the two (pardon my windows jargon if it's incorrect). You can then set up host and user based sudo permissions.

    Is that for RHEL only, or the derived distros too?

    All RHEL based as far as I know. I've only tried RHEL, CentOS and Fedora though.

    Now I have an interesting quandary. Do I go with something more universally supported so the scientists that love Ubuntu can stay on it, or push for unification on CentOS...

    Probably the former given internal culture.

    Ya we are an all Red Hat shop so it's easy for us.

    I don't remember but Landscape might give you this ability for Ubuntu also.



  • @Kelly said:

    Centrify Express or the paid option?

    Paid. It was a large installation.



  • FWIW on RHEL systems with Cockpit installed, there is a button named Join Domain. What it does I don't know, but I'm guessing it's for this function. I never looked it up.



  • @johnhooks said:

    FWIW on RHEL systems with Cockpit installed, there is a button named Join Domain. What it does I don't know, but I'm guessing it's for this function. I never looked it up.

    Interesting, never noticed that it had a button like that. have only demo'd it once so have not used Cockpit much, that would be a neat feature.



  • @scottalanmiller said:

    @johnhooks said:

    FWIW on RHEL systems with Cockpit installed, there is a button named Join Domain. What it does I don't know, but I'm guessing it's for this function. I never looked it up.

    Interesting, never noticed that it had a button like that. have only demo'd it once so have not used Cockpit much, that would be a neat feature.

    Just got in. Here's what comes up when you click it:

    0_1460549287675_cockpit.png



  • @johnhooks So it works as expected (or at least it appears to).

    Did you join this system to your domain?



  • @DustinB3403 said:

    @johnhooks So it works as expected (or at least it appears to).

    Did you join this system to your domain?

    No I dont have anything to do with the domain stuff. This pc is also on a different network so I can't join it to our normal domain anyway.

    If I feel ambitious I'll try it at home.



  • I've also been looking at PowerBroker Identity Services from BeyondTrust. It is where Likewise ended up after a series of acquisitions. It looks like I'm going to have to be building a virtual network and trying some of this.

    Have any of you ever tried Zentyal (for the authentication portion, not the email)?



  • No, keep meaning to look at Zentyal but never get around to it.



  • @Kelly said:

    I've also been looking at PowerBroker Identity Services from BeyondTrust. It is where Likewise ended up after a series of acquisitions. It looks like I'm going to have to be building a virtual network and trying some of this.

    Have any of you ever tried Zentyal (for the authentication portion, not the email)?

    I did it one time with a Zentyal VM and an old windows 7 laptop. All I did was join the domain, so other than saying yes it will join I have no idea what management and everything else is like.



  • @Kelly Zentyal uses samba 4, so you basically end up with a compatible Active Directory domain controller. You would still need to use pbis or sssd to authenticate your linux machines to the domain controller. Centrify does not work with a samba 4 domain controller, but as I mentioned before either pbis or setting up sssd works ok.

    As for the managment aspect of Zentyal, you can use the web interface to set most of the things your are used to when managing an ad dc except group policy settings, in order to also have groups policy settings you can use RSAT and manage it exactly the same as a windows ad dc.



  • @Kelly said:

    I've also been looking at PowerBroker Identity Services from BeyondTrust. It is where Likewise ended up after a series of acquisitions. It looks like I'm going to have to be building a virtual network and trying some of this.

    I've used this in multiple companies, from an airline in America to an oil exploration company.

    Works like a champ, it's built on Winbind, but now has actual support versus calling RedHat and hoping for the best.



  • @PSX_Defector said:

    @Kelly said:

    I've also been looking at PowerBroker Identity Services from BeyondTrust. It is where Likewise ended up after a series of acquisitions. It looks like I'm going to have to be building a virtual network and trying some of this.

    I've used this in multiple companies, from an airline in America to an oil exploration company.

    Works like a champ, it's built on Winbind, but now has actual support versus calling RedHat and hoping for the best.

    Did you use PBIS Open or the paid version? The paid version is significantly more than I can afford at about $1,600 per server instance.



  • Any particular reason winbind won't work? That is what we use here.



  • @dafyre said:

    Any particular reason winbind won't work? That is what we use here.

    Nope, I'm just trying to do due diligence and evaluate all the options and what we gain/lose from them. At this point Winbind is looking like a strong contender due to its ability to work with sudo, but I'd like to compare all the possibilities that are in my price range.



  • I use PBIS-Open fairly regularly and it works well. I mostly use it for my developer's workstations. I've got a tutorial for installing and configuring it on Ubuntu 14.04 as a How-To on Spiceworks.

    If you run into any problems testing let me know and I can probably point you in the right direction. It does allow adding AD users to the sudo group. The GIDs and UIDs are created dynamically and are really large compared to normal Linux user accounts. You can use the config tool to access the IDs that the PBIS generates, and then reference those for any permissions/scripting. Usually the usernames and groupnames will work as well.

    It caches credentials for offline use too.



  • Oh and I never use the GUI tool, I always use domainjoin-cli. The one and only time I did try to use it ( 2-ish years ago) it was kinda buggy and didn't work for some reason.