ubuntu. Domain join attempt 4

it is sufficient to remove "[NOTFOUND=return]". However, we will not use zeroconf anyway. Additionally, we should add name resolution via WINS. Therefore, let's transform this line into something like this:

hosts: files dns wins mdns4_minimal mdns4

WINS settings will follow later, in the /etc/samba/smb.conf file.

Configuring time synchronization with the domain controller.

Edit /etc/default/ntpdate and set the following values

NTPSERVERS="dc.mydomain.local" # откуда брать время, на контроллере домена по умолчанию имеестя NTP-сервер
NTPDATE_USE_NTP_CONF=no

Configuring SSH access.

We will need to install openssh-server. (Before installing packages, it is useful to configure Ubuntu to cache repository updates, as described in the article). The default configuration file will suffice for now. (Later, it might be worth reconfiguring it to use a key or certificate, or binding it to AD)

Installing samba and winbind.

After installation, these two services are added to the startup automatically.

In the /etc/samba/smb.conf file, delete everything and write this

[global]
	log file = /var/log/samba/log.%m
	max log size = 50
	hosts allow = 192.168. # подсети, которые разрешаются к использованию
	socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
	wins server = 192.168.3.200 # тут айпишник вашего сервера WINS (у меня то же, что и dc.mydomain.local, но айпишник предпочтительней)
	unix charset = UTF8
	dos charset = cp866

	workgroup = MYDOMAIN
	security = ADS
	realm = MYDOMAIN.LOCAL
	password server = dc.mydomain.local
	encrypt passwords = yes
	pam password change = yes
	# netbios name = firstubuntu
	auth methods = winbind guest
	lanman auth = no
	client lanman auth = no
	client ntlmv2 auth = yes
	min protocol = NT1
	auth methods = winbind
	server string = %h server (Samba, Ubuntu)
	preferred master = no
	dns proxy = no
	panic action = /usr/share/samba/panic-action %d
	name resolve order = lmhosts host wins bcast

        idmap backend = rid:MYDOMAIN.LOCAL=10000-19999
;	idmap domains = MYDOMAIN.LOCAL
;	idmap config MYDOMAIN.LOCAL:backend = rid
;	idmap config MYDOMAIN.LOCAL:range = 10000-19999
	idmap uid = 10000-19999
	idmap gid = 10000-19999
	winbind use default domain = yes
;	winbind nested groups = yes
	winbind refresh tickets = yes
	winbind enum groups = yes
	winbind enum users = yes
	template shell = /bin/bash
;	template homedir = /home/%D/%U

	usershare path = /var/lib/samba/usershares/
	usershare max shares = 100
	usershare allow guests = yes
	usershare owner only = yes

[printers]
	comment = All Printers
	browseable = no
	path = /var/spool/samba
	printable = yes
;	guest ok = no
;	read only = yes
	create mask = 0700

[print$]
	comment = Printer Drivers
	path = /var/lib/samba/printers
;	browseable = yes
;	read only = yes
;	guest ok = no
;   write list = root, @ntadmin

Joining the computer to the domain.

net ads join -U Administrator

After entering the command, a password will be requested. You will need an account with the right to add computers to the domain, for example, the domain administrator account MYDOMAIN\Administrator. Restart winbind and samba

/etc/init.d/winbind restart
/etc/init.d/samba restart

Reconfiguring /etc/nsswitch.conf

nsswitch.conf, among other things, specifies the sources for account information. Our accounts will now reside on the domain controller, and winbind will serve as the source of information about them. Edit

passwd:         files winbind
group:          files winbind
shadow:         files winbind

Leave the other lines as they are. Now, to verify that our winbind has connected to the controller and is functioning normally, run

getent passwd

As a result, we should see our local accounts and a long list of our domain accounts. If you don't see them, look for errors in the previous steps.

Configuring PAM.

Be careful when editing PAM configuration files - there is a risk of locking yourself out of login. When editing these files, it is recommended to keep a couple of terminals with root logged in just in case.

Edit /etc/pam.d/common-auth

auth        required      pam_env.so
auth        sufficient    pam_unix.so likeauth nullok try_first_pass
auth        sufficient    pam_winbind.so use_first_pass krb5_auth krb5_ccache_type=FILE
auth        required      pam_deny.so

Edit /etc/pam.d/common-account

account     sufficient    pam_winbind.so
account     required      pam_unix.so

Edit /etc/pam.d/common-session

session     optional      pam_mkhomedir.so skel=/etc/skel/ umask=0077
session     optional      pam_ck_connector.so nox11
session     required      pam_limits.so
session     required      pam_env.so
session     required      pam_unix.so

In newer distributions, you may need to comment out pam_ck_connector due to changes in consolekit. In my freshly updated Gentoo, it caused automounting to fail. It seems that in newer versions of GNOME, the session in consolekit is created using its own mechanisms.

Edit /etc/pam.d/common-password

## password    required      pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
password    sufficient    pam_unix.so try_first_pass use_authtok nullok sha512 shadow
## password    sufficient    pam_winbind.so use_authtok
password    sufficient    pam_winbind.so
password    required      pam_deny.so

With this configuration, during authentication, Ubuntu will first try to contact the domain controller via winbind, and then attempt to use local accounts. From now on, when logging into the system, we will be able to authenticate using a domain account. A home directory will be created, and a Kerberos ticket granting access to network resources will be saved for the duration of the session.

In the console, let's check if we succeeded by switching the current user to a domain user

su IvanovSV

If nothing worked, look for errors in the previous steps. If it worked, you can reboot and log into GNOME directly with your domain user account.

To add a domain account to a local group (for example, audio), edit the /etc/groups file and add the account name at the end of the line corresponding to the desired group.

Winbind startup order.

Because the winbind service starts by default before the network is configured, winbind's first attempts to connect to the domain controller fail, and winbind waits a long time before retrying. Therefore, the user will not be able to log in immediately but only after waiting a few minutes. Fix this by moving the winbind startup to the very end of the boot process. To do this, rename symbolic links of the form /etc/rcX.d/S20winbind to S99winbind, where X is the runlevel number. For example, like this

 for i in `seq 2 5`; do mv /etc/rc$i.d/S20winbind /etc/rc$i.d/S99winbind; done;