Integrating RHEL systems directly with Windows Active Directory Red Hat Enterprise Linux 9 Joining RHEL hosts to AD and accessing resources in AD Red Hat Customer Content Services

Commands:
dnf install samba-common-tools realmd oddjob oddjob-mkhomedir sssd adcli krb5-workstation
realm discover ad.example.com ad.example.com type: kerberos realm-name: AD.EXAMPLE.COM domain-name: ad.example.com configured: no server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common
realm join ad.example.com
getent passwd administrator@ad.example.com administrator@ad.example.com:*:1450400500:1450400513:Administrator:/home/administrator@ad.example.com:/bin/bash
dnf install realmd oddjob oddjob-mkhomedir sssd adcli krb5-workstation
realm join --automatic-id-mapping=no ad.example.com
rm -f /var/lib/sss/db/*
systemctl restart sssd
getent passwd administrator@ad.example.com administrator@ad.example.com:*:10000:10000:Administrator:/home/Administrator:/bin/bash
[domain/ ad.example.com ] id_provider = ad dyndns_refresh_interval = 43200 dyndns_update_ptr = false dyndns_ttl = 3600
systemctl restart sssd
[domain/ ad.example.com ] id_provider = ad dyndns_update = false
[domain/ad.example.com] id_provider = ad ad_site = ExampleSite
systemctl restart sssd
update-crypto-policies --set DEFAULT:AD-SUPPORT
dnf install realmd oddjob-mkhomedir oddjob samba-winbind-clients samba-winbind samba-common-tools samba-winbind-krb5-locator krb5-workstation
dnf install samba
mv /etc/samba/smb.conf /etc/samba/smb.conf.bak
realm join --membership-software=samba --client-software=winbind ad.example.com
[plugins] localauth = { module = winbind:/usr/lib64/samba/krb5/winbind_krb5_localauth.so enable_only = winbind }
systemctl status winbind Active: active (running) since Tue 2018-11-06 19:10:40 CET; 15s ago
systemctl enable --now smb
getent passwd "AD\administrator" AD\administrator:*:10000:10000::/home/administrator@AD:/bin/bash
getent group "AD\Domain Users" AD\domain users:x:10000:user1,user2
chown "AD\administrator":"AD\Domain Users" /srv/samba/example.txt
kinit administrator@AD.EXAMPLE.COM
klist Ticket cache: KCM:0 Default principal: administrator@AD.EXAMPLE.COM Valid starting Expires Service principal 01.11.2018 10:00:00 01.11.2018 20:00:00 krbtgt/AD.EXAMPLE.COM@AD.EXAMPLE.COM renew until 08.11.2018 05:00:00
wbinfo --all-domains BUILTIN SAMBA-SERVER AD
ansible-vault create vault.yml New Vault password: <vault_password> Confirm New Vault password: <vault_password>
usr: administrator pwd: <password>
--- - name: Active Directory integration hosts: managed-node-01.example.com vars_files: - vault.yml tasks: - name: Join an Active Directory ansible.builtin.include_role: name: rhel-system-roles.ad_integration vars: ad_integration_user: "{{ usr }}" ad_integration_password: "{{ pwd }}" ad_integration_realm: "ad.example.com" ad_integration_allow_rc4_crypto: false ad_integration_timesync_source: "time_server.ad.example.com"
ansible-playbook --ask-vault-pass --syntax-check ~/playbook.yml
ansible-playbook --ask-vault-pass ~/playbook.yml
ansible managed-node-01.example.com -m command -a 'getent passwd administrator@ad.example.com' administrator@ad.example.com:*:1450400500:1450400513:Administrator:/home/administrator@ad.example.com:/bin/bash
ad_maximum_machine_account_password_age = value_in_days
systemctl restart sssd
realm leave ad.example.com
realm leave [ ad.example.com ] -U [ AD.EXAMPLE.COM\user ]'
realm discover [ ad.example.com ] ad.example.com type: kerberos realm-name: EXAMPLE.COM domain-name: example.com configured: no server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common-tools
domain_resolution_order = subdomain2.ad.example.com, subdomain1.ad.example.com, ad.example.com
systemctl restart sssd
id <user_from_subdomain2> uid=1916901142(user_from_subdomain2) gid=1916900513(domain users) groups=1916900513(domain users)
realm permit --all
realm permit aduser01@example.com realm permit 'AD.EXAMPLE.COM\aduser01'
ssh aduser01@example.com@ server_name [aduser01@example.com@ server_name ~]USD
ssh aduser02@example.com@ server_name Authentication failed.
realm deny --all
realm list example.net type: kerberos realm-name: EXAMPLE.NET domain-name: example.net configured: kerberos-member server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common-tools login-formats: %U@example.net login-policy: deny-any-login
realm permit -x 'AD.EXAMPLE.COM\aduser02'
ssh aduser01@example.net@ server_name Authentication failed.
Oct 31 03:00:13 client1 sshd[124914]: pam_sss(sshd:account): Access denied for user aduser1: 6 (Permission denied) Oct 31 03:00:13 client1 sshd[124914]: Failed password for aduser1 from 127.0.0.1 port 60509 ssh2 Oct 31 03:00:13 client1 sshd[124914]: fatal: Access denied for user aduser1 by PAM account configuration [preauth]
(Sat Oct 31 03:00:13 2020) [sssd[be[example.com]]] [ad_gpo_perform_hbac_processing] (0x0040): GPO access check failed: [1432158236](Host Access Denied) (Sat Oct 31 03:00:13 2020) [sssd[be[example.com]]] [ad_gpo_cse_done] (0x0040): HBAC processing failed: [1432158236](Host Access Denied} (Sat Oct 31 03:00:13 2020) [sssd[be[example.com]]] [ad_gpo_access_done] (0x0040): GPO-based access control failed.
systemctl stop sssd
[domain/ example.com ] ad_gpo_access_control= permissive
systemctl restart sssd
adcli create-msa --domain=production.example.com
klist -k /etc/krb5.keytab.production.example.com Keytab name: FILE:/etc/krb5.keytab.production.example.com KVNO Principal ---- ------------------------------------------------------------ 2 CLIENT!S3AUSD@PRODUCTION.EXAMPLE.COM (aes256-cts-hmac-sha1-96) 2 CLIENT!S3AUSD@PRODUCTION.EXAMPLE.COM (aes128-cts-hmac-sha1-96)
[domain/ production.example.com ] ldap_sasl_authid = CLIENT!S3AUSD@PRODUCTION.EXAMPLE.COM ldap_krb5_keytab = /etc/krb5.keytab.production.example.com krb5_keytab = /etc/krb5.keytab.production.example.com ad_domain = production.example.com krb5_realm = PRODUCTION.EXAMPLE.COM access_provider = ad
[domain/ ad.example.com/production.example.com ] ldap_sasl_authid = CLIENT!S3AUSD@PRODUCTION.EXAMPLE.COM ldap_krb5_keytab = /etc/krb5.keytab.production.example.com krb5_keytab = /etc/krb5.keytab.production.example.com ad_domain = production.example.com krb5_realm = PRODUCTION.EXAMPLE.COM access_provider = ad
kinit -k -t /etc/krb5.keytab.production.example.com 'CLIENT!S3AUSD' klist Ticket cache: KCM:0:54655 Default principal: CLIENT!S3AUSD@PRODUCTION.EXAMPLE.COM Valid starting Expires Service principal 11/22/2021 15:48:03 11/23/2021 15:48:03 krbtgt/PRODUCTION.EXAMPLE.COM@PRODUCTION.EXAMPLE.COM
klist -k /etc/krb5.keytab.production.example.com Keytab name: FILE:/etc/krb5.keytab.production.example.com KVNO Principal ---- ------------------------------------------------------------ 2 CLIENT!S3AUSD@PRODUCTION.EXAMPLE.COM (aes256-cts-hmac-sha1-96) 2 CLIENT!S3AUSD@PRODUCTION.EXAMPLE.COM (aes128-cts-hmac-sha1-96)
adcli update --domain=production.example.com --host-keytab=/etc/krb5.keytab.production.example.com --computer-password-lifetime=0
klist -k /etc/krb5.keytab.production.example.com Keytab name: FILE:/etc/krb5.keytab.production.example.com KVNO Principal ---- ------------------------------------------------------------ 3 CLIENT!S3AUSD@PRODUCTION.EXAMPLE.COM (aes256-cts-hmac-sha1-96) 3 CLIENT!S3AUSD@PRODUCTION.EXAMPLE.COM (aes128-cts-hmac-sha1-96)