Though Linux hosts has its own local authentication mechanism, as times requirements will arise where Windows Active Directory authentication will be required. For example, if a\u00a0Linux host needs\u00a0access to the NTFS folders shared by a Windows host\u00a0in a Windows domain, Active Directory authentication will be required.<\/p>\n
<\/p>\n
The following lists the steps required to enable a CentOS 7 host use\u00a0Active Directory for authentication. Here the Windows AD domain name used is myntp.local<\/strong><\/em><\/p>\n Add the Linux host in windows AD via the AD Users and Computers management tool.<\/p>\n #] yum -y install authconfig krb5-workstation pam_krb5 samba-common oddjob-mkhomedir sudo ntp samba-winbind-modules<\/strong><\/p>\n #] mkdir \/home\/myntp.local<\/em><\/strong><\/p>\n [NOTE: In the below command all flags are defined using “- -” and not “-“<\/em>]<\/p>\n #] authconfig –disablecache –enablewinbind –enablewinbindauth –smbsecurity=ads –smbworkgroup=MYNTP –smbrealm=MYNTP.LOCAL –enablewinbindusedefaultdomain –winbindtemplatehomedir=\/home\/myntp.local\/%U –winbindtemplateshell=\/bin\/bash –enablekrb5 –krb5realm=MYNTP.LOCAL –enablekrb5kdcdns –enablekrb5realmdns –enablelocauthorize –enablemkhomedir –enablepamaccess –updateall<\/strong><\/p>\n <\/p>\n Note: <\/strong>In the above command the parameters after authconfig is\u00a0“- -” <\/strong>instead of ‘-‘<\/strong><\/p>\n Verify and ensure the\u00a0\/etc\/krb5.conf<\/strong><\/em> looks as below:<\/p>\n #] cat \/etc\/krb5.conf<\/strong><\/p>\n [logging]<\/em> [libdefaults]<\/em> [realms]<\/em> myntp.local\u00a0= {<\/em> [domain_realm]<\/em> <\/p>\n Note: <\/strong>Ensure youo can ping the domian name.<\/p>\n #] kinit domain_admin<\/strong> #] chkconfig oddjobd on<\/strong> <\/p>\n #] useradd <domain user><\/strong><\/p>\n Reboot the host, and try logging with <domain user> name now.<\/p>\n","protected":false},"excerpt":{"rendered":"
\n default = FILE:\/var\/log\/krb5libs.log<\/em>
\n kdc = FILE:\/var\/log\/krb5kdc.log<\/em>
\n admin_server = FILE:\/var\/log\/kadmind.log<\/em><\/p>\n
\n default_realm =\u00a0MYNTP.LOCAL<\/em>
\n dns_lookup_realm = true<\/em>
\n dns_lookup_kdc = true<\/em>
\n ticket_lifetime = 24h<\/em>
\n renew_lifetime = 7d<\/em>
\n forwardable = true<\/em><\/p>\n
\nMYNTP.LOCAL\u00a0= {<\/em>
\n admin_server =\u00a0pdc.myntp.local<\/em>
\n kdc_server = pdc.myntp.local<\/em>
\n }<\/em><\/p>\n
\n }<\/em><\/p>\n
\nmyntp.local = MYNTP.LOCAL<\/em>
\n .myntp.local = MYNTP.LOCAL<\/em><\/p>\n
\n#] ntpdate\u00a0pdc.myntp.local<\/strong>
\n#] net ads join myntp.local\u00a0-U\u00a0domain_admin<\/strong>
\n#] net ads testjoin<\/strong>
\n#] chmod 777 \/home\/myntp.local\/<\/strong><\/p>\n
\n#] chkconfig winbind on<\/strong>
\n#] chkconfig messagebus on<\/strong><\/p>\n