Authenticating Linux against AD
-
Have any of you had experience with the various tools out there to be able to bind Linux (CentOS 6.7/7 and Ubuntu 14.04 and soon 16.04)and authenticate against AD? I've seen some very positive things about both winbind and sssd, but I was curious if any of you have had experience and resulting recommendations.
And, just to remove it from the discussion, not authenticating against AD is not on the table. I want to be able to have one central place for managing logins and permissions for all of our platforms (Windows, Linux, and OSX), and AD is the apex of our system.
-
This post is deleted! -
Ubuntu has long supported authenticating against Active Directory. How usable it is I'm not 100% certain it is with the current OS's but I've used it in the past for various projects.
-
Setting it up to authenticate is pretty easy. Ubuntu has an automated process and the CentOS one has a lot of guides available. The one thing I haven't been able to get working yet is setting up SUDO with AD.
-
I've not used Linux against AD much, when I did it was with Centrify.
-
I've set up centrify on my company laptop .
-
@coliver said:
Setting it up to authenticate is pretty easy. Ubuntu has an automated process and the CentOS one has a lot of guides available. The one thing I haven't been able to get working yet is setting up SUDO with AD.
This blog post appears to show how to get winbind to handle sudo in AD: https://mikrocentillion.wordpress.com/2013/06/05/centos-6-authenticate-and-sudo-active-directory-users/.
-
Centrify Express or the paid option?
-
I used centrify express I believe...
edit: it was express, I didnt pay anything.
-
this only works with red hat systems, but is one thing we will be doing in the future. Their Identity Management system will integrate with AD. IdM is set up as its own forest and you can have a trust between the two (pardon my windows jargon if it's incorrect). You can then set up host and user based sudo permissions.
-
@johnhooks said:
this only works with red hat systems, but is one thing we will be doing in the future. Their Identity Management system will integrate with AD. IdM is set up as its own forest and you can have a trust between the two (pardon my windows jargon if it's incorrect). You can then set up host and user based sudo permissions.
Is that for RHEL only, or the derived distros too?
-
@Kelly said:
@johnhooks said:
this only works with red hat systems, but is one thing we will be doing in the future. Their Identity Management system will integrate with AD. IdM is set up as its own forest and you can have a trust between the two (pardon my windows jargon if it's incorrect). You can then set up host and user based sudo permissions.
Is that for RHEL only, or the derived distros too?
All RHEL based as far as I know. I've only tried RHEL, CentOS and Fedora though.
-
@johnhooks said:
@Kelly said:
@johnhooks said:
this only works with red hat systems, but is one thing we will be doing in the future. Their Identity Management system will integrate with AD. IdM is set up as its own forest and you can have a trust between the two (pardon my windows jargon if it's incorrect). You can then set up host and user based sudo permissions.
Is that for RHEL only, or the derived distros too?
All RHEL based as far as I know. I've only tried RHEL, CentOS and Fedora though.
Now I have an interesting quandary. Do I go with something more universally supported so the scientists that love Ubuntu can stay on it, or push for unification on CentOS...
Probably the former given internal culture.
-
@Kelly said:
@johnhooks said:
@Kelly said:
@johnhooks said:
this only works with red hat systems, but is one thing we will be doing in the future. Their Identity Management system will integrate with AD. IdM is set up as its own forest and you can have a trust between the two (pardon my windows jargon if it's incorrect). You can then set up host and user based sudo permissions.
Is that for RHEL only, or the derived distros too?
All RHEL based as far as I know. I've only tried RHEL, CentOS and Fedora though.
Now I have an interesting quandary. Do I go with something more universally supported so the scientists that love Ubuntu can stay on it, or push for unification on CentOS...
Probably the former given internal culture.
Ya we are an all Red Hat shop so it's easy for us.
I don't remember but Landscape might give you this ability for Ubuntu also.
-
-
FWIW on RHEL systems with Cockpit installed, there is a button named Join Domain. What it does I don't know, but I'm guessing it's for this function. I never looked it up.
-
@johnhooks said:
FWIW on RHEL systems with Cockpit installed, there is a button named Join Domain. What it does I don't know, but I'm guessing it's for this function. I never looked it up.
Interesting, never noticed that it had a button like that. have only demo'd it once so have not used Cockpit much, that would be a neat feature.
-
@scottalanmiller said:
@johnhooks said:
FWIW on RHEL systems with Cockpit installed, there is a button named Join Domain. What it does I don't know, but I'm guessing it's for this function. I never looked it up.
Interesting, never noticed that it had a button like that. have only demo'd it once so have not used Cockpit much, that would be a neat feature.
Just got in. Here's what comes up when you click it:
-
@johnhooks So it works as expected (or at least it appears to).
Did you join this system to your domain?
-
@DustinB3403 said:
@johnhooks So it works as expected (or at least it appears to).
Did you join this system to your domain?
No I dont have anything to do with the domain stuff. This pc is also on a different network so I can't join it to our normal domain anyway.
If I feel ambitious I'll try it at home.
