Linux Active Directory How-To - Revision history

NeilArmstrong: Added a Glossary link to Configuration~

2012-12-04T06:01:39Z

Added a Glossary link to Configuration~

← Older revision		Revision as of 06:01, 4 December 2012
Line 25:		Line 25:
	==Referenced Documents==		==Referenced Documents==

	* Chapter 6. Domain membership part II, Server configuration basics: HTTP://us4.samba.org/samba/docs/man/samba-howto-collection/domain-member.html#ads-member		* Chapter 6. Domain membership part II, Server [[configuration~\|Configuration]] basics: HTTP://us4.samba.org/samba/docs/man/samba-howto-collection/domain-member.html#ads-member

	* Chapter 24. Winbind: Use of Domain Accounts Part III. Advanced Configuration, HTTP://us4.samba.org/samba/docs/man/samba-howto-collection/winbind.html		* Chapter 24. Winbind: Use of Domain Accounts Part III. Advanced [[Configuration~\|Configuration]], HTTP://us4.samba.org/samba/docs/man/samba-howto-collection/winbind.html

	* Kerberos Administration Guide, HTTP://web.mit.edu/kerberos/krb5-1.3/krb5-1.3/doc/krb5-admin.html		* Kerberos Administration Guide, HTTP://web.mit.edu/kerberos/krb5-1.3/krb5-1.3/doc/krb5-admin.html
Line 33:		Line 33:
	* Linux PAM, HTTP://www.kernel.org/pub/linux/libs/pam3.		* Linux PAM, HTTP://www.kernel.org/pub/linux/libs/pam3.

	==Configuration==		==[[Configuration~\|Configuration]]==

	We want to use the Windows 2003 Active Directory Server (ADS) to authenticate a foreign user and allow him or her to use a Linux machine which is a member of the Windows domain. Initially, the user jdoe doesn't exist on the Linux machine. We want to use Winbind and Samba to assign a UID and GID from a pool of reserve numbers and create a home directory automatically under /home/winnt for this foreign user. This will (hopefully) allow jdoe to walk up to the Linux machine, log in and use it to run X applications, without ever having been manually configured on it.		We want to use the Windows 2003 Active Directory Server (ADS) to authenticate a foreign user and allow him or her to use a Linux machine which is a member of the Windows domain. Initially, the user jdoe doesn't exist on the Linux machine. We want to use Winbind and Samba to assign a UID and GID from a pool of reserve numbers and create a home directory automatically under /home/winnt for this foreign user. This will (hopefully) allow jdoe to walk up to the Linux machine, log in and use it to run X applications, without ever having been manually configured on it.
Line 70:		Line 70:
	Note that Kerberos requires that the clocks of the machines in the domain are synchronized in time. The default maximum skew allowed is 5 minutes. Windows and Linux handle times differently. UNIX is UTC based, and Windows is local time zone based, so be careful. Configuring NTP is necessary, but is also beyond the scope of this document.		Note that Kerberos requires that the clocks of the machines in the domain are synchronized in time. The default maximum skew allowed is 5 minutes. Windows and Linux handle times differently. UNIX is UTC based, and Windows is local time zone based, so be careful. Configuring NTP is necessary, but is also beyond the scope of this document.

	===Nsswitch Configuration===		===Nsswitch [[Configuration~\|Configuration]===

	Verify the following lines in /etc/nsswitch.conf:		Verify the following lines in /etc/nsswitch.conf:
Line 84:		Line 84:
	Since nothing was working at the time, I cannot tell whether that was really a required step.		Since nothing was working at the time, I cannot tell whether that was really a required step.

	===Samba configuration===		===Samba [[configuration~\|Configuration]]===

	Here's the [global] section from smb.conf:		Here's the [global] section from smb.conf:
Line 113:		Line 113:
	The default Windind separator is a backslash, but that doesn't work well, since it is a reserve character on UNIX/Linux. The general rule is to change it to a '+'.		The default Windind separator is a backslash, but that doesn't work well, since it is a reserve character on UNIX/Linux. The general rule is to change it to a '+'.

	===Ethernet configuration===		===Ethernet [[configuration~\|Configuration]]===

	You have to set the ADS machine as (one of) the DNS in /etc/resolv.conf, to enable the Linux machine to find the Kerberos and LDAP servers on the ADS. Verify the ethernet and DNS setting with ifconfig and nslookup.		You have to set the ADS machine as (one of) the DNS in /etc/resolv.conf, to enable the Linux machine to find the Kerberos and LDAP servers on the ADS. Verify the ethernet and DNS setting with ifconfig and nslookup.

Butch: Edited markup, and content

2009-10-30T15:14:41Z

Edited markup, and content

← Older revision		Revision as of 15:14, 30 October 2009
Line 1:		Line 1:
	Linux Active Directory How-To:		Linux Active Directory How-To

	1. Document scope		==Document scope==

	This document briefly describes how to configure a GNU/Linux machine to authenticate users against a		This document briefly describes how to configure a GNU/Linux machine to authenticate users against a
Line 23:		Line 23:
	Note that everything here was tested on Linux, but it should also apply almost directly to Solaris, since Samba is cross platform.		Note that everything here was tested on Linux, but it should also apply almost directly to Solaris, since Samba is cross platform.

	2. Referenced Documents		==Referenced Documents==

	Chapter 6. Domain membership part II, Server configuration basics:		* Chapter 6. Domain membership part II, Server configuration basics: HTTP://us4.samba.org/samba/docs/man/samba-howto-collection/domain-member.html#ads-member
	HTTP://us4.samba.org/samba/docs/man/samba-howto-collection/domain-member.html#ads-member

	Chapter 24. Winbind: Use of Domain Accounts Part III. Advanced Configuration,		* Chapter 24. Winbind: Use of Domain Accounts Part III. Advanced Configuration, HTTP://us4.samba.org/samba/docs/man/samba-howto-collection/winbind.html
	HTTP://us4.samba.org/samba/docs/man/samba-howto-collection/winbind.html

	Kerberos Administration Guide, HTTP://web.mit.edu/kerberos/krb5-1.3/krb5-1.3/doc/krb5-admin.html		* Kerberos Administration Guide, HTTP://web.mit.edu/kerberos/krb5-1.3/krb5-1.3/doc/krb5-admin.html

	Linux PAM, HTTP://www.kernel.org/pub/linux/libs/pam3.		* Linux PAM, HTTP://www.kernel.org/pub/linux/libs/pam3.

	3. Configuration		==Configuration==

	We want to use the Windows 2003 Active Directory Server (ADS) to authenticate a foreign user and allow him or her to use a Linux machine which is a member of the Windows domain. Initially, the user jdoe doesn't exist on the Linux machine. We want to use Winbind and Samba to assign a UID and GID from a pool of reserve numbers and create a home directory automatically under /home/winnt for this foreign user. This will (hopefully) allow jdoe to walk up to the Linux machine, log in and use it to run X applications, without ever having been manually configured on it.		We want to use the Windows 2003 Active Directory Server (ADS) to authenticate a foreign user and allow him or her to use a Linux machine which is a member of the Windows domain. Initially, the user jdoe doesn't exist on the Linux machine. We want to use Winbind and Samba to assign a UID and GID from a pool of reserve numbers and create a home directory automatically under /home/winnt for this foreign user. This will (hopefully) allow jdoe to walk up to the Linux machine, log in and use it to run X applications, without ever having been manually configured on it.
Line 54:		Line 52:
	The MS Windows user name, will become work group+user name on Linux, and the Windows primary group, will become the work group+group name on Linux.		The MS Windows user name, will become work group+user name on Linux, and the Windows primary group, will become the work group+group name on Linux.

	~~3.1~~ Kerberos		===Kerberos===

	Kerberos is configured in the file /etc/krb5.conf. Verify the following lines and not the UPPERCASE domain name:		Kerberos is configured in the file /etc/krb5.conf. Verify the following lines and not the UPPERCASE domain name:
Line 72:		Line 70:
	Note that Kerberos requires that the clocks of the machines in the domain are synchronized in time. The default maximum skew allowed is 5 minutes. Windows and Linux handle times differently. UNIX is UTC based, and Windows is local time zone based, so be careful. Configuring NTP is necessary, but is also beyond the scope of this document.		Note that Kerberos requires that the clocks of the machines in the domain are synchronized in time. The default maximum skew allowed is 5 minutes. Windows and Linux handle times differently. UNIX is UTC based, and Windows is local time zone based, so be careful. Configuring NTP is necessary, but is also beyond the scope of this document.

	~~3.2~~ Nsswitch Configuration		===Nsswitch Configuration===

	Verify the following lines in /etc/nsswitch.conf:		Verify the following lines in /etc/nsswitch.conf:
Line 86:		Line 84:
	Since nothing was working at the time, I cannot tell whether that was really a required step.		Since nothing was working at the time, I cannot tell whether that was really a required step.

	~~3.3~~ Samba configuration		===Samba configuration===

	Here's the [global] section from smb.conf:		Here's the [global] section from smb.conf:
Line 115:		Line 113:
	The default Windind separator is a backslash, but that doesn't work well, since it is a reserve character on UNIX/Linux. The general rule is to change it to a '+'.		The default Windind separator is a backslash, but that doesn't work well, since it is a reserve character on UNIX/Linux. The general rule is to change it to a '+'.

	~~3.4~~ Ethernet configuration		===Ethernet configuration===

	You have to set the ADS machine as (one of) the DNS in /etc/resolv.conf, to enable the Linux machine to find the Kerberos and LDAP servers on the ADS. Verify the ethernet and DNS setting with ifconfig and nslookup.		You have to set the ADS machine as (one of) the DNS in /etc/resolv.conf, to enable the Linux machine to find the Kerberos and LDAP servers on the ADS. Verify the ethernet and DNS setting with ifconfig and nslookup.

	~~3.5~~ Join the Domain		===Join the Domain===

	First restart the network and Samba:		First restart the network and Samba:
Line 154:		Line 152:
	YOURWORKGROUPNAME+winusergrp should be listed.		YOURWORKGROUPNAME+winusergrp should be listed.

	~~3.6~~ Kerberos and error messages		===Kerberos and error messages===

	If you get the message: Cannot find KDC for requested realm, then either the password server in smb.conf is wrong, or the DNS setting in resolv.conf is wrong.		If you get the message: Cannot find KDC for requested realm, then either the password server in smb.conf is wrong, or the DNS setting in resolv.conf is wrong.

Butch: Fixed some formatting

2009-10-26T16:40:58Z

Fixed some formatting

← Older revision		Revision as of 16:40, 26 October 2009
Line 11:		Line 11:

	The whole process is rather complicated and relies on a number of subsystems working together:		The whole process is rather complicated and relies on a number of subsystems working together:
	Pluggable Authentication Modules (PAM)		* Pluggable Authentication Modules (PAM)
	Server Message Block (SMB, Samba)		* Server Message Block (SMB, Samba)
	WinBIND (part of Samba)		* WinBIND (part of Samba)
	Kerberos 5 (By MIT, with Microsoft compatibility hacks)		* Kerberos 5 (By MIT, with Microsoft compatibility hacks)

	The biggest problem is configuring Samba and determining exactly what identifiers and spelling to use where, since Kerberos and NETBIOS are fond of uppercase, while everything else prefers lowercase.		The biggest problem is configuring Samba and determining exactly what identifiers and spelling to use where, since Kerberos and NETBIOS are fond of uppercase, while everything else prefers lowercase.
Line 40:		Line 40:

	This guide assumes that you already have a Windows ADS running. First verify a few things on the Windows ADS machine and note that the NETBIOS work group must be uppercase:		This guide assumes that you already have a Windows ADS running. First verify a few things on the Windows ADS machine and note that the NETBIOS work group must be uppercase:
			<pre>
	NETBIOS Workgroup: YOURWORKGROUPNAME		NETBIOS Workgroup: YOURWORKGROUPNAME
	Domain name: example.com		Domain name: example.com
Line 48:		Line 49:
	Administrator name: Administrator		Administrator name: Administrator
	Administrator password: Supersecret		Administrator password: Supersecret
			</pre>
	This illustrates some weird points. Rather confusingly, the MS Windows NETBIOS work group, is also referred to as the domain name in MS Windows documentation. The NETBIOS work group is actually used more often than the real domain name, so when in doubt, use the NETBIOS work group, since it will usually be the correct one for the occasion.		This illustrates some weird points. Rather confusingly, the MS Windows NETBIOS work group, is also referred to as the domain name in MS Windows documentation. The NETBIOS work group is actually used more often than the real domain name, so when in doubt, use the NETBIOS work group, since it will usually be the correct one for the occasion.

Line 57:		Line 58:
	Kerberos is configured in the file /etc/krb5.conf. Verify the following lines and not the UPPERCASE domain name:		Kerberos is configured in the file /etc/krb5.conf. Verify the following lines and not the UPPERCASE domain name:

			<pre>
	[libdefaults]		[libdefaults]
	default_realm = EXAMPLE.COM		default_realm = EXAMPLE.COM
Line 66:		Line 68:
	[domain_realms]		[domain_realms]
	.kerberos.server = EXAMPLE.COM		.kerberos.server = EXAMPLE.COM
			</pre>

	Note that Kerberos requires that the clocks of the machines in the domain are synchronized in time. The default maximum skew allowed is 5 minutes. Windows and Linux handle times differently. UNIX is UTC based, and Windows is local time zone based, so be careful. Configuring NTP is necessary, but is also beyond the scope of this document.		Note that Kerberos requires that the clocks of the machines in the domain are synchronized in time. The default maximum skew allowed is 5 minutes. Windows and Linux handle times differently. UNIX is UTC based, and Windows is local time zone based, so be careful. Configuring NTP is necessary, but is also beyond the scope of this document.
Line 72:		Line 75:

	Verify the following lines in /etc/nsswitch.conf:		Verify the following lines in /etc/nsswitch.conf:
			<pre>
	passwd: files winbind		passwd: files winbind
	shadow: files winbind		shadow: files winbind
	group: files winbind		group: files winbind
			</pre>
	You may need to run ldconfig to set up the winbind libraries:		You may need to run ldconfig to set up the winbind libraries:

	# ldconfig -v \|grep winbind		user@comp# ldconfig -v \|grep winbind

	Since nothing was working at the time, I cannot tell whether that was really a required step.		Since nothing was working at the time, I cannot tell whether that was really a required step.
Line 87:		Line 90:
	Here's the [global] section from smb.conf:		Here's the [global] section from smb.conf:

			<pre>
	[global]		[global]
	workgroup = YOURWORKGROUPNAME		workgroup = YOURWORKGROUPNAME
Line 106:		Line 110:
	add machine script = /usr/sbin/useradd -d /var/lib/nobody -g 100 -s /bin/false -M %u		add machine script = /usr/sbin/useradd -d /var/lib/nobody -g 100 -s /bin/false -M %u
	password server = msads.example.com		password server = msads.example.com
			</pre>
	The /bin/false shell will prevent foreign domain users from opening a command shell and is recommended for security.		The /bin/false shell will prevent foreign domain users from opening a command shell and is recommended for security.

Line 119:		Line 123:
	First restart the network and Samba:		First restart the network and Samba:

	# service network restart		user@comp # service network restart<br />
	# service smb restart		user@comp # service smb restart<br />

	Verify that smbd and nmbd are running with		Verify that smbd and nmbd are running with

	# ps e		user@comp # ps e

	Try to join the Windows Domain:		Try to join the Windows Domain:

	# net ads join -S msads.example.com -U administrator%Supersecret		user@comp # net ads join -S msads.example.com -U administrator%Supersecret

	You should get the message: "Joined LINUXMACHINE to realm EXAMPLE.COM", at which point most joyful celebrations are in order.		You should get the message: "Joined LINUXMACHINE to realm EXAMPLE.COM", at which point most joyful celebrations are in order.
Line 134:		Line 138:
	You can now start the Winbind daemon with the maximum debug information:		You can now start the Winbind daemon with the maximum debug information:

	# winbindd -d 10		user@comp # winbindd -d 10

	Watch /var/log/messages for errors:		Watch /var/log/messages for errors:

	# tail -f /var/log/messages		user@comp # tail -f /var/log/messages

	You can investigate the domain records with:		You can investigate the domain records with:

	# wbinfo -u		user@comp # wbinfo -u<br />
	# whinfo -g		user@comp # whinfo -g<br />
	# getent password		user@comp # getent password<br />
	# getent group		user@comp # getent group<br />

	With those utilities, you should be able to see the user names and groups in the domain that you just		With those utilities, you should be able to see the user names and groups in the domain that you just joined. User YOURWORKGROUPNAME+jdoe and the group
	joined. User YOURWORKGROUPNAME+jdoe and the group
	YOURWORKGROUPNAME+winusergrp should be listed.		YOURWORKGROUPNAME+winusergrp should be listed.

Butch at 16:27, 26 October 2009

2009-10-26T16:27:38Z

← Older revision		Revision as of 16:27, 26 October 2009
Line 159:		Line 159:
	If you get the message: The workgroup in smb.conf does not match the short domain name obtained from the server, then you did not specify the NETBIOS name properly.		If you get the message: The workgroup in smb.conf does not match the short domain name obtained from the server, then you did not specify the NETBIOS name properly.

	--		--<br />
	[[User:Butch\| Butch Whitby]]		[[User:Butch\| Butch Whitby]]

Butch: Added signature

2009-10-26T16:27:18Z

Added signature

← Older revision		Revision as of 16:27, 26 October 2009
Line 158:		Line 158:

	If you get the message: The workgroup in smb.conf does not match the short domain name obtained from the server, then you did not specify the NETBIOS name properly.		If you get the message: The workgroup in smb.conf does not match the short domain name obtained from the server, then you did not specify the NETBIOS name properly.

			--
			[[User:Butch\| Butch Whitby]]

Butch: Cleaned up markup language, and corrected some spelling errors.

2009-10-26T14:27:56Z

Cleaned up markup language, and corrected some spelling errors.

← Older revision		Revision as of 14:27, 26 October 2009
Line 58:		Line 58:

	[libdefaults]		[libdefaults]
	default_realm = EXAMPLE.COM~~<br />~~		default_realm = EXAMPLE.COM
	[realms]~~<br />~~		[realms]
	EXAMPLE.COM = {~~<br />~~		EXAMPLE.COM =
	kdc = msads.example.com~~>br /~~>		{
	}~~>br />~~		kdc = msads.example.com>
	[domain_realms]~~<br />~~		}
	.kerberos.server = EXAMPLE.COM~~<br />~~		[domain_realms]
			.kerberos.server = EXAMPLE.COM

	Note that Kerberos requires that the clocks of the machines in the domain are synchronized in time.		Note that Kerberos requires that the clocks of the machines in the domain are synchronized in time. The default maximum skew allowed is 5 minutes. Windows and Linux handle times differently. UNIX is UTC based, and Windows is local time zone based, so be careful. Configuring NTP is necessary, but is also beyond the scope of this document.

	The default maximum skew allowed is 5 minutes. Windows and Linux handle times differently.
	UNIX is UTC based, and Windows is local time zone based, so be careful. Configuring NTP is necessary, but is also beyond the scope of this document.

	3.2 Nsswitch Configuration		3.2 Nsswitch Configuration
Line 109:		Line 107:
	password server = msads.example.com		password server = msads.example.com

	The /bin/false shell will prevent foreign domain users from opening a command shell and is		The /bin/false shell will prevent foreign domain users from opening a command shell and is recommended for security.
	recommended for security.
	The default Windind separator is a backslash, but that doesn't work well, since it is a reserve character		The default Windind separator is a backslash, but that doesn't work well, since it is a reserve character on UNIX/Linux. The general rule is to change it to a '+'.
	on UNIX/Linux. The general rule is to change it to a '+'.

	3.4 Ethernet configuration		3.4 Ethernet configuration

	You have to set the ADS machine as (one of) the DNS in /etc/resolv.conf, to enable the Linux machine		You have to set the ADS machine as (one of) the DNS in /etc/resolv.conf, to enable the Linux machine to find the Kerberos and LDAP servers on the ADS. Verify the ethernet and DNS setting with ifconfig and nslookup.
	to find the Kerberos and LDAP servers on the ADS. Verify the ethernet and DNS setting with ifconfig and nslookup.

	3.5 Join the Domain		3.5 Join the Domain
Line 135:		Line 131:

	You should get the message: "Joined LINUXMACHINE to realm EXAMPLE.COM", at which point most joyful celebrations are in order.		You should get the message: "Joined LINUXMACHINE to realm EXAMPLE.COM", at which point most joyful celebrations are in order.

	You can now start the Winbind daemon with the maximum debug information:		You can now start the Winbind daemon with the maximum debug information:

Line 156:		Line 153:
	3.6 Kerberos and error messages		3.6 Kerberos and error messages

	If you get the message: Cannot find KDC for requested realm, then either the password server in		If you get the message: Cannot find KDC for requested realm, then either the password server in smb.conf is wrong, or the DNS setting in resolv.conf is wrong.
	smb.conf is wrong, or the DNS setting in resolv.conf is wrong.
	If you get the message: KRB5 error code 68 while getting the initial credentials, then the Linux		If you get the message: KRB5 error code 68 while getting the initial credentials, then the Linux machine can talk to the ADS machine, but your Kerberos realm name in smb.conf is wrong.
	machine can talk to the ADS machine, but your Kerberos realm name in smb.conf is wrong.
	~~If you get the message: The workgroup in smb.conf does not match the short domain name obtained~~
	~~from the server, then you did not specify the NETBIOS name properly~~.

	~~Hope this helps!~~		If you get the message: The workgroup in smb.conf does not match the short domain name obtained from the server, then you did not specify the NETBIOS name properly.

Butch at 14:18, 26 October 2009

2009-10-26T14:18:25Z

← Older revision		Revision as of 14:18, 26 October 2009
Line 17:		Line 17:

	The biggest problem is configuring Samba and determining exactly what identifiers and spelling to use where, since Kerberos and NETBIOS are fond of uppercase, while everything else prefers lowercase.		The biggest problem is configuring Samba and determining exactly what identifiers and spelling to use where, since Kerberos and NETBIOS are fond of uppercase, while everything else prefers lowercase.

	Of course, nothing works, until every last little detail is correct, so these and other subtleties can lead to many hours of happy debugging and experimenting before everything suddenly begins to work.		Of course, nothing works, until every last little detail is correct, so these and other subtleties can lead to many hours of happy debugging and experimenting before everything suddenly begins to work.
	Just about every imaginable error message was discovered the hard way and they were all documented in the references below. Of course, since you will be following this great guide, you wont ever see them - let's hope anyway.		Just about every imaginable error message was discovered the hard way and they were all documented in the references below. Of course, since you will be following this great guide, you wont ever see them - let's hope anyway.
Line 25:		Line 26:

	Chapter 6. Domain membership part II, Server configuration basics:		Chapter 6. Domain membership part II, Server configuration basics:
	HTTP://us4.samba.org/samba/docs/man/samba-howto-collection/domain-member.html#ads-member		HTTP://us4.samba.org/samba/docs/man/samba-howto-collection/domain-member.html#ads-member

	Chapter 24. Winbind: Use of Domain Accounts Part III. Advanced Configuration,		Chapter 24. Winbind: Use of Domain Accounts Part III. Advanced Configuration,
	HTTP://us4.samba.org/samba/docs/man/samba-howto-collection/winbind.html		HTTP://us4.samba.org/samba/docs/man/samba-howto-collection/winbind.html
	Kerberos Administration Guide, HTTP://web.mit.edu/kerberos/krb5-1.3/krb5-1.3/doc/krb5-admin.html
			Kerberos Administration Guide, HTTP://web.mit.edu/kerberos/krb5-1.3/krb5-1.3/doc/krb5-admin.html

	Linux PAM, HTTP://www.kernel.org/pub/linux/libs/pam3.		Linux PAM, HTTP://www.kernel.org/pub/linux/libs/pam3.

Line 54:		Line 58:

	[libdefaults]		[libdefaults]
	default_realm = EXAMPLE.COM		default_realm = EXAMPLE.COM<br />
	[realms]		[realms]<br />
	EXAMPLE.COM = {		EXAMPLE.COM = {<br />
	kdc = msads.example.com		kdc = msads.example.com>br />
	}		}>br />
	[domain_realms]		[domain_realms]<br />
	.kerberos.server = EXAMPLE.COM		.kerberos.server = EXAMPLE.COM<br />

	Note that Kerberos requires that the clocks of the machines in the domain are synchronized in time.		Note that Kerberos requires that the clocks of the machines in the domain are synchronized in time.

Butch: Linux Active Directory How To

2009-10-26T14:12:38Z

Linux Active Directory How To

New page

Linux Active Directory How-To:

1. Document scope

This document briefly describes how to configure a GNU/Linux machine to authenticate users against a
Microsoft Windows Server 2003 Active Directory Server.

The idea behind this is to use Windows 2003 ADS (and possibly later versions) to authenticate a foreign user and allow him/her to use a Linux machine which is a member of the Windows domain, without having to create a user account manually on the Linux machine. This is very useful when you have large numbers of machines and users.

If everything works as it should, then you only need to configure the users on the Active Directory Server. The users can then walk up to any machine on the network and log on. If a user never used that machine before, a user account will be magically created. The magic trick is known as Single Sign-On (SSO).

The whole process is rather complicated and relies on a number of subsystems working together:
Pluggable Authentication Modules (PAM)
Server Message Block (SMB, Samba)
WinBIND (part of Samba)
Kerberos 5 (By MIT, with Microsoft compatibility hacks)

The biggest problem is configuring Samba and determining exactly what identifiers and spelling to use where, since Kerberos and NETBIOS are fond of uppercase, while everything else prefers lowercase.
Of course, nothing works, until every last little detail is correct, so these and other subtleties can lead to many hours of happy debugging and experimenting before everything suddenly begins to work.
Just about every imaginable error message was discovered the hard way and they were all documented in the references below. Of course, since you will be following this great guide, you wont ever see them - let's hope anyway.

Note that everything here was tested on Linux, but it should also apply almost directly to Solaris, since Samba is cross platform.

2. Referenced Documents

Chapter 6. Domain membership part II, Server configuration basics:
HTTP://us4.samba.org/samba/docs/man/samba-howto-collection/domain-member.html#ads-member
Chapter 24. Winbind: Use of Domain Accounts Part III. Advanced Configuration,
HTTP://us4.samba.org/samba/docs/man/samba-howto-collection/winbind.html
Kerberos Administration Guide, HTTP://web.mit.edu/kerberos/krb5-1.3/krb5-1.3/doc/krb5-admin.html
Linux PAM, HTTP://www.kernel.org/pub/linux/libs/pam3.

3. Configuration

We want to use the Windows 2003 Active Directory Server (ADS) to authenticate a foreign user and allow him or her to use a Linux machine which is a member of the Windows domain. Initially, the user jdoe doesn't exist on the Linux machine. We want to use Winbind and Samba to assign a UID and GID from a pool of reserve numbers and create a home directory automatically under /home/winnt for this foreign user. This will (hopefully) allow jdoe to walk up to the Linux machine, log in and use it to run X applications, without ever having been manually configured on it.

This guide assumes that you already have a Windows ADS running. First verify a few things on the Windows ADS machine and note that the NETBIOS work group must be uppercase:
NETBIOS Workgroup: YOURWORKGROUPNAME
Domain name: example.com
Fully qualified domain host name: msads.example.com
User name defined in ADS: jdoe
User password: jdoe123
User primary group: winusergrp
Administrator name: Administrator
Administrator password: Supersecret

This illustrates some weird points. Rather confusingly, the MS Windows NETBIOS work group, is also referred to as the domain name in MS Windows documentation. The NETBIOS work group is actually used more often than the real domain name, so when in doubt, use the NETBIOS work group, since it will usually be the correct one for the occasion.

The MS Windows user name, will become work group+user name on Linux, and the Windows primary group, will become the work group+group name on Linux.

3.1 Kerberos

Kerberos is configured in the file /etc/krb5.conf. Verify the following lines and not the UPPERCASE domain name:

[libdefaults]
default_realm = EXAMPLE.COM
[realms]
EXAMPLE.COM = {
kdc = msads.example.com
}
[domain_realms]
.kerberos.server = EXAMPLE.COM

Note that Kerberos requires that the clocks of the machines in the domain are synchronized in time.

The default maximum skew allowed is 5 minutes. Windows and Linux handle times differently.
UNIX is UTC based, and Windows is local time zone based, so be careful. Configuring NTP is necessary, but is also beyond the scope of this document.

3.2 Nsswitch Configuration

Verify the following lines in /etc/nsswitch.conf:

passwd: files winbind
shadow: files winbind
group: files winbind

You may need to run ldconfig to set up the winbind libraries:

# ldconfig -v |grep winbind

Since nothing was working at the time, I cannot tell whether that was really a required step.

3.3 Samba configuration

Here's the [global] section from smb.conf:

[global]
workgroup = YOURWORKGROUPNAME
realm = EXAMPLE.COM
preferred master = no
server string = Samba Server
security = ADS
encrypt passwords = yes
log level = 3
log file = /var/log/samba/%m
max log size = 50
winbind separator = +
printcap name = cups
printing = cups
idmap uid = 10000-20000
idmap gid = 10000-20000
template homedir /home/winnt/%D/%U
template shell = /bin/false
add machine script = /usr/sbin/useradd -d /var/lib/nobody -g 100 -s /bin/false -M %u
password server = msads.example.com

The /bin/false shell will prevent foreign domain users from opening a command shell and is
recommended for security.
The default Windind separator is a backslash, but that doesn't work well, since it is a reserve character
on UNIX/Linux. The general rule is to change it to a '+'.

3.4 Ethernet configuration

You have to set the ADS machine as (one of) the DNS in /etc/resolv.conf, to enable the Linux machine
to find the Kerberos and LDAP servers on the ADS. Verify the ethernet and DNS setting with ifconfig and nslookup.

3.5 Join the Domain

First restart the network and Samba:

# service network restart
# service smb restart

Verify that smbd and nmbd are running with

# ps e

Try to join the Windows Domain:

# net ads join -S msads.example.com -U administrator%Supersecret

You should get the message: "Joined LINUXMACHINE to realm EXAMPLE.COM", at which point most joyful celebrations are in order.
You can now start the Winbind daemon with the maximum debug information:

# winbindd -d 10

Watch /var/log/messages for errors:

# tail -f /var/log/messages

You can investigate the domain records with:

# wbinfo -u
# whinfo -g
# getent password
# getent group

With those utilities, you should be able to see the user names and groups in the domain that you just
joined. User YOURWORKGROUPNAME+jdoe and the group
YOURWORKGROUPNAME+winusergrp should be listed.

3.6 Kerberos and error messages

If you get the message: Cannot find KDC for requested realm, then either the password server in
smb.conf is wrong, or the DNS setting in resolv.conf is wrong.
If you get the message: KRB5 error code 68 while getting the initial credentials, then the Linux
machine can talk to the ADS machine, but your Kerberos realm name in smb.conf is wrong.
If you get the message: The workgroup in smb.conf does not match the short domain name obtained
from the server, then you did not specify the NETBIOS name properly.

Hope this helps!