Join a Linux machine to the Active Directory
Tags: linux, devops, security, tutorial
Published: 2023-07-14 12:14:25

Step-by-step guide to configure a Linux machine in an Active Directory domain:

<h2>Preparations and package installation</h2>
Start by updating the packages already present on the machine, and then proceed to install only what we actually need.

Update the dependencies using the command:

Debian<br>
<code>sudo apt update</code>

RHEL<br>
<code>sudo yum update</code>

And proceed with the installation of the packages:

Debian<br>
<code>sudo apt install -y realmd libnss-sss sssd sssd-tools adcli samba-common-bin oddjob oddjob-	mkhomedir packagekit</code>

RHEL<br>
<code>sudo dnf install realmd sssd oddjob oddjob-mkhomedir adcli samba-common-tools -y</code>

<h2>Configuring the realm</h2>
In short, Realm helps us discover and manage the domains we have on the machine.

To start, we first need to discover the domain we are looking for.

Use the following command:

<code>realm discover DOMAIN-NAME</code>

We will have a response similar to this.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y9i457beq0pyavlv4n3r.png)

Now that we have discovered the domain, we will need to log in to it with a user. Use the following command:

<code>sudo realm join -U USUARIO DOMINIO</code>

If no errors have occurred so far, we can verify if we are indeed connected by using the following command to check the user's permissions and groups.

<code>id USUARIO@DOMINIO</code>

Another method to verify if everything is going correctly is the following:

<code>realm list</code>

This way, we can verify if we are already connected to the desired domain.

<h2>Pam-configs (ubuntu)</h2>

The pam-configs configuration was only necessary on Ubuntu to ensure that the user's folder is created upon logging into the system.

You just need to execute the command:

<code>sudo pam-auth-update --enable mkhomedir</code>

<h2>Configuring SSSD</h2>

We need to access the file <code>/etc/sssd/sssd.conf</code> to make the modifications. In this file, we will change the <code>use_fully_qualified_names</code> option from <code>False</code> to <code>True</code>. With this option enabled, users will be in the format user@domain instead of just user.

In our case, we will change it to True since we have only one AD. However, please note that this change should only be made if you are certain that no other domain will be added to the AD forest.

In <code>fallback_homedir = /home/%u@%d</code>, we will modify it to <code>fallback_homedir = /home/%u</code>. By removing the "@%d" part, the user's folder will be created with only the username.

In the <code>access_provider = ad</code> option, change it to <code>access_provider = simple</code>.

Now let's add an option that is not present in our file, which is <code>simple_allow_groups</code>. In this option, we will add the groups we have in AD and want to grant access to the Linux machine.

In our case, we have two groups: linuxuser and linuxadmin. To add them, we should include <code>simple_allow_groups = linuxuser, linuxadmin</code> in the file.

As a result, the file will look like this:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cc1u45kakvjkvdln3gyn.png)

Note: in the places where it says 'Domain.local', you should use the domain you are integrating with the system. And in 'simple_allow_users = groups, linuxuser, linuxadmin', it is an option that will be added automatically in the next item.

Thus, concluding the SSSD configuration process, we will allow access for users who are in the groups we added in simple_allow_groups. Use the following commands:

<code>realm permit [group]</code>

Example:

<code>realm permit linuxuser</code>

<code>realm permit linuxadmin</code>

<h2>SUDOERS</h2>

With the processes performed in the above steps, we will be able to access the machine using the AD user. However, the user won't have root access to the system. To solve this, we need to add the groups to the /etc/sudoers file. The result will be as follows:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/agt7h6amrr4ykwkujxt8.png)

We added the %linuxuser group to allow all users in the linuxuser group to access the machine and obtain root access.

---
<h2>Conclusion</h2>
By following these steps, Active Directory users will be able to authenticate on the Linux machine and have the appropriate privileges. Always ensure to follow best security practices when performing these configurations.