All of the configuration outlined in Section 4.2, “ Summary of Configuration Files, Options, and Packages” can be done automatically using the authco nfi g utility, with the exception of the DNS configuration. Configuration files can also be backed up by authco nfi g.
4 .3.1. Argument s and Configurat ion Paramet ers of
authco nfi gThe Authentication Configuration utility automatically updates the required configuration files for Samba, Kerberos, and Active Directory integration when it is used to configure Winbind as the authentication store for the local system. Table 4.2, “ authconfig Arguments and Configuration File Parameters” shows what parameters are set with each command option.
T ab le 4 .2. au t h co n f ig Arg u men t s an d Co n f ig u rat io n File Paramet ers
/etc/krb5.conf The KDC in the realm entry (e.g., REALMNAME {...}) in [realms]
Kerberos --krb5realm /etc/krb5.conf The domain entry in
[domain_realm]
NSS --enablewinbind /etc/nsswitch.conf passwd, shadow, group
NSS --enablewins /etc/nsswitch.conf hosts
The value of the --krb5real m option must be identical to the value given in --smbreal m for the domain to be configured properly.
Chapt er 4 . Using Samba, Kerberos, and Winbind
4 .3.2. CLI Configurat ion of Act ive Direct ory Aut hent icat ion wit h
authco nfi g 1. Install the samba-winbind package. It is required for Windows integration features in Sambaservices, but is not installed by default:
[root@ server ~]# yum install samba-winbind
2. Install the krb5-workstation package. It is required to connect to a Kerberos realm and manage principals and tickets:
[root@ server ~]# yum install krb5-workstation
3. Install the samba-winbind-krb5-locator package. It contains a plug-in for the system Kerberos library to allow the local Kerberos library to use the same KDC as Samba and Winbind use.
[root@ server ~]# yum install samba-winbind-krb5-locator
4. Edit the DNS configuration in the /etc/reso l v. co nf file to use the Active Directory domain as a name server and for search:
nameserver 1.2.3.4 search adexample.com
5. The authco nfi g utility does not set any requirements for what options must be invoked at a given time, since it can be used to modify configuration as well as to define new
configuration.
The following example shows all required parameters for Samba, Kerberos, PAM, and NSS. It also includes options for Winbind, which allow offline access, and for the local system, which allow system accounts to continue to work. The example command is split into multiple lines and annotated for better readability.
--smbservers=ad.example.com
--krb5realm=ADEXAMPLE.COM
// winbind
--enablewinbindoffline
--enablewinbindkrb5
--winbindtemplateshell=/bin/sh
// general
--winbindjoin=admin
--update
--enablelocauthorize
--savebackup=/backups
[/usr/bin/net join -w ADEXAMPLE -S ad.example.com -U admin]
The --wi nbi nd jo i n option automatically runs the net jo i n command to add the system to the Active Directory domain.
The --enabl el o cal autho ri ze option sets local authorization operations to check the /etc/passwd file. This allows local accounts to be used to authenticate users as well as the Active Directory domain.
Note
The --savebackup option is recommended but not required. It backs up the configuration files to the specified directory before making the changes. If there is a configuration error or the configuration is later changed, authco nfi g can use the backups to revert the changes.
4 .3.3. Configuring Act ive Direct ory Aut hent icat ion in t he
authco nfi gGUI
There are fewer configuration options in the authco nfi g GUI than are in the CLI. For example, it is possible to configure Samba, NSS, Winbind, and to join the domain, but it does not configure Kerberos or PAM. Those must be configured manually if using the UI.
Note
The authco nfi g command-line utilities are installed by default, but the GUI requires the authconfig-gtk package, which is not available by default.
1. Install the samba-wi nbi nd package. It is required for Windows integration features in Samba services, but is not installed by default.
[root@ se yum install samba-winbind
2. Install the krb5-wo rkstati o n package. It is required to connect to a Kerberos realm and manage principals and tickets.
[root@ se yum install krb5-workstation
3. Configure the Active Directory Kerberos realm as the default realm and KDC for the local system.
[root@ se vim /etc/krb5.conf [libdefaults]
...
default_realm PLE.COM
Chapt er 4 . Using Samba, Kerberos, and Winbind
[realms]
ADEXAMPLE.COM kdc = kdc.adcom }
[domain_realm]
adexample.com =LE.COM .adexample.comMPLE.COM
4. Edit the DNS configuration in the /etc/reso l v. co nf file to use the Active Directory domain as a name server and for search:
nameserver 1.2.3 search adexample
5. Open the Authentication Configuration Tool.
[root2se authconfig-gtk
6. In the Id enti ty & Authenti cati o n tab, select Win b in d in the User Acco unt D atabase drop-down menu.
7. Set the information that is required to connect to the Microsoft Active Directory domain controller.
Wi nbi nd D o mai n gives the Windows work group. The entry inthis field needs to be in the Windows 2000 format, such as D O MAIN.
Chapt er 4 . Using Samba, Kerberos, and Winbind
Securi ty Mo d el sets the security model to use for Samba clients. The correct value is ad s that configures Samba to act as a domain member in an Active Directory Server realm.
Wi nbi nd AD S R eal m gives the Active Directory realm that the Samba server will join.
Wi nbi nd D o mai n C o ntro l l ers gives the host name or IP address of the domain controller to use.
T empl ate Shel l sets which login shell to use for Windows user account settings. This setting is optional.
Al l o w o ffl i ne l o g i n allows authentication information to be stored in a local cache. The cache is referenced when a user attempts to authenticate to system resources while the system is offline.
8. Click the Jo i n D o mai n button to run the net ad s jo i n command and join the
Active Directory domain. This action is to join the domain immediately; the configuration can be saved and then the net ad s jo i n command can be run manually later.
9. Click the Appl y button to save the configuration.