Joining Ubuntu to an Active Directory Domain (Example 2)

Back in 2009, I did a whole lot of messing around with Linux and Active Directory integration, primarily for Apache. Now that Linux is coming to Windows, I figured I’d brush up on my Linux and Windows Integrated Authentication skills to work with Ubuntu, too.

Clients and Servers

Since 2009, it seems that a couple things have changed in the client realm. In particular, winbind fell out of favor to Likewise Open (which I used to <3) which was bought by BeyondTrust and turned into PowerBroker Open. But that’s since fallen out of favor to the SSSD or “System Security Services Daemon“. SSSD seems pretty cool but everyone hates its name and assumes that its name is keeping it from greater adoption.

Sometimes when researching SSSD, you’ll come across a few mentions of FreeIPA which is similar to Active Directory, OpenLDAP, and ApacheDS. Oh, and I recently found out that Samba4 allows Linux servers to join Active Directory as Domain Controllers (!!) but I can’t tell if it can be a forest of its own (reddit review here).

There are other players I’m leaving out but after a bit of casual research, no others seem to stand out. Ultimately, while there are a number of ways to setup AD/Linux authentication with Ubuntu, it appears that SSSD is the current way to go. Let’s go ahead and set that up.

Before We Begin

There’s an official Ubuntu guide for SSSD and Active Directory, but this one is slimmed down. If you have any issues, you can comment here or reference some of the solutions they offer. First, some assumptions.

  • Fresh install of Ubuntu 15.10 Server
  • DNS is set to AD’s DNS servers
  • The Active Directory domain is base.local
  • The test user is base\adadmin, which has domain admin privs on AD

If you’re behind a proxy, apt-get and curl/wget/etc won’t work out of the box. Here’s how to add some proxy variables (kinda like Internet Properties -> Connections -> LAN settings -> Proxy Server) so that you can use these tools.

Also, you’re going to need to make sure that your time is set properly. Kerberos is heavily dependent on time, and will break if your computer is more than 5 minutes skewed from the AD domain.

Joining the domain

Joining an Active Directory in Ubuntu isn’t quite as easy as SUSE, but it’s still decently straight-forward.

  • Install required packages
  • Create and modify sssd.conf
  • Modify smb.conf
  • Restart services
  • Join domain

First, installed the required package using apt-get. I also recommend command-not-found and mlocate, which help you with finding files.

Note, in this tutorial, I use vi. I used to use pico, which became nano, but found that vi could be found across all distributions by default. vi or “vim” can be intimidating, but honestly, I only know about 5 commands and it gets me by. Here’s a nice tutorial on Learning vi progressively.

Next, setup SSSD by creating the file, setting the owner, and changing its permissions

Note that this config only allows 2 users and 2 groups to gain access. If you remove the last 2 lines, anyone can login. There are a few ways to restrict access but it looks like this is the simplest way.

Next, sudo vi /etc/samba/smb.conf and replace the line workgroup = WORKGROUP with the following:

Time to restart services and join the domain! Here’s a screenshot of my Ubuntu server “ubuntunew” joining my domain, base.local:


It’s just these commands, nothing scary:

If you have permissions to add computers to the domain and everything went well, then you should now be able to see your Ubuntu server in Active Directory!


Now that everything is setup all nice, start SSSD to do some caching and interception that makes things much smoother somehow.


If you’re having an issue joining the domain with the error message “Failed to join domain: failed to lookup DC info for domain ‘BASE.LOCAL’ over rpc: An internal error occurred” you can specify the exact domain controller you want to contact (h/t Florent Appointaire).

If you’re getting the error “failed to lookup dc info for domain base rpc undetermined error”, you may have a stale DC. Consider following applicable portions of this tutorial by Microsoft (h/t Rob Sewell)

Login as Windows user

If you’d like to login to the machine as a windows user, as opposed to just grabbing a ticket using kinit, you can either login via SSH or by using su or “substitute user”.

Here’s an example of me using su. First, I logged in to the Linux server as a regular user, then I login as my own Active Directory account “base\ctrlb” by issuing the command su ctrlb. An alternative way is su base\\ctrlb. That extra backslash is intentional, it escapes the second backslash.


Alternatively, you can ssh in directly with ssh or PuTTY.

And that’s it! Want to see this all in one shot? Check out the gist.

Chrissy is a Cloud and Datacenter Management & Data Platform MVP who has worked in IT for over 20 years. She is the creator of the popular SQL PowerShell module dbatools, and holds a number of certifications, including those relating to SQL Server, Linux, SharePoint and network security. You can follow her on Twitter at @cl.

Join to Domain - Easier - (Example 3)

# Join to domain

# Prereqs

apt -y install realmd sssd sssd-tools adcli krb5-user packagekit samba-common samba-common-bin samba-libs resolvconf

sudo nano /etc/network/interfaces


sudo systemctl restart ifup@ens160 resolvconf

sudo nano /etc/pam.d/common-session

   session optional skel=/etc/skel umask=077

realm discover

sudo realm join

sudo realm join -U "admin"

   Password for admin: ...............


id domain\\username

sudo nano /etc/sssd/sssd.conf

  # line 16: change
   use_fully_qualified_names = False
   ad_gpo_access_control = permissive
  # Remove the other %d to just have names without domain
   fallback_homedir = /home/%u

sudo systemctl restart sssd

Work - CentOS Server Build (CNN project)

CentOS Build out for VSLAPP01 (CNN project) Downloaded the CentOS media Deployed server # This allowed me to install screen, mc and other packages sudo yum install -y epel-release #Linux Screen for console changing sudo yum install screen #Midnight Commander for easier file/folder manipulation sudo yum install mc # A few of these are already installed in the install, but ran anywya sudo yum install realmd sssd sssd-tools adcli krb5-user packagekit samba-common samba-common-bin samba-libs # Configure PAM to be able to create home folders for new SNET users sudo nano /etc/pam.d/common-session session optional skel=/etc/skel umask=077 #join the domain realm discover sudo realm join -U "admin" # Check that the domain is available now id chnet\\richlemmermann # Don't remember what this is for, but needed sudo nano /etc/sssd/sssd.conf use_fully_qualified_names = False # Restart the daemon and log in sudo systemctl restart sssd # Configure the AD connection /etc/sssd/sssd.conf [sssd] domains = config_file_version = 2 services = nss, pam [domain/] ad_domain = krb5_realm = DOMAIN.ORG realmd_tags = manages-system joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = False fallback_homedir = /home/%u access_provider = ad #ad_gpo_map_remote_interactive = xrdp-sesman, -ssh ad_gpo_access_control = permissive # Restart for changes sudo service sssd restart # Add users to sudo ability by adding to the wheel group sudo nano /etc/sudoers richlemmermann ALL=(ALL) ALL chadchase ALL=(ALL) ALL mattmahoney ALL=(ALL) ALL aaronarmelino ALL=(ALL) ALL jeffbates ALL=(ALL) ALL keithmoleski ALL=(ALL) ALL zchriseastway ALL=(ALL) ALL # check if firewall is running sudo firewall-cmd --state # First, stop the FirewallD service with: sudo systemctl stop firewalld # Disable the FirewallD service to start automatically on system boot: sudo systemctl disable firewalld # Turn off SSL until John opens up the PA sudo nano /etc/yum.conf sslverify=false # Install xrdp that actually worked sudo dnf install xrdp #When the installation process is complete, start the Xrdp service and enable it at boot: sudo systemctl enable xrdp --now #You can verify that Xrdp is running by typing: sudo systemctl status xrdp # Install xrdp sudo yum -y install xrdp tigervnc-server # Run xrdp as a service sudo systemctl enable xrdp # Allow all users to xrdp in /etc/xrdp/sesman.ini # Comment out the requirements to be ina certain group ;TerminalServerUsers=tsusers ;TerminalServerAdmins=tsadmins Kill Disconnected sessions: true # Restart xrdp for changes to take effect sudo service xrdp restart # Hugh systemctl enable --now cockpit.socket #change IP address. Change BOOTPROTO from dhcp to static and add IPADDR, NETMASK, and GATEWAY sudo nano /etc/sysconfig/network-scripts/ifcfg-ens192 TYPE=Ethernet PROXY_METHOD=none BROWSER_ONLY=no BOOTPROTO=static . . . IPADDR= NETMASK= GATEWAY= # Install this repositity (prepping for PHP 7.4) sudo yum -y install # Remi repsoitory - module stream sudo dnf -y install dnf-utils #module stream sudo dnf module reset php -y # php module 7.4 sudo dnf module install php:remi-7.4 #SUCCESS php -v PHP 7.4.22 (cli) (built: Jul 27 2021 18:08:31) ( NTS ) Copyright (c) The PHP Group Zend Engine v3.4.0, Copyright (c) Zend Technologies # DesktopCentral (Copied binary from it-lemmermannl) sudo sh ./DesktopCentral_LinuxAgent.bin #Sophos Install 1. a. On the Linux server, at a command prompt or in a script, use wget with the link address b. Link address = wget Linux installer link c. Move the installer to the Downloads directory. 2. Run the installer as follows: a. Change to the Downloads directory. b. Change the file permissions to include “execute”: chmod +x c. Run the installer: ./ If you are not signed in as root, run the installer with the sudo command: sudo ./ # MySql Install sudo dnf install mysql-server # phpMyAdmin wget --no-check-certificate unzip sudo mv /usr/share/phpmyadmin cd /usr/share/phpmyadmin sudo mv sudo nano <create the 32 chars key> mkdir /usr/share/phpmyadmin/tmp chown -R apache:apache /usr/share/phpmyadmin sudo chmod 777 /usr/share/phpmyadmin/tmp sudo nano /etc/httpd/conf.d/phpmyadmin.conf Alias /phpmyadmin /usr/share/phpmyadmin <Directory /usr/share/phpmyadmin/> AddDefaultCharset UTF-8 <IfModule mod_authz_core.c> # Apache 2.4 <RequireAny> Require all granted </RequireAny> </IfModule> <IfModule !mod_authz_core.c> # Apache 2.2 Order Deny,Allow Deny from All Allow from Allow from ::1 </IfModule> </Directory> <Directory /usr/share/phpmyadmin/setup/> <IfModule mod_authz_core.c> # Apache 2.4 <RequireAny> Require all granted </RequireAny> </IfModule> <IfModule !mod_authz_core.c> # Apache 2.2 Order Deny,Allow Deny from All Allow from Allow from ::1 </IfModule> </Directory> #restart apache sudo systemctl restart httpd # mysqli extension sudo yum install php-mysqli # mkdir and copy Crouse wildcard certs to sudo mkdir /etc/httpd/ssl sudo cp wildcard.key /etc/httpd/ssl sudo cp /etc/httpd/ssl sudo cp intermdiate.crt /etc/httpd/ssl #make the future home of CNN's home mkdir /var/www/ #copy the configuration to it sudo cp* /etc/httpd/conf sudo service httpd restart # download WordPress (latest version as of this) wget # unzip from tarball tar -xvf latest.tar.gz # Move wordpress to location (i used midnight commander) # create headless ftp user for WP sudo adduser wp_ftp_user --shell=/bin/false --no-create-home sudo passwd wp_ftp_user Crouse8675309$$ #set the default mysql password ALTER USER 'root'@'%' IDENTIFIED BY 'NiceLongPassword'; ALTER USER 'root'@'localhost' IDENTIFIED BY 'NiceLongPassword'; flush privileges; exit; # Configure WordPress DB Database: wp_insider User: wp_insider_user Pass: NiceLongPassword # WordPress Admin: admin Pass: NiceLongPassword # Change permissions on the folder so that WP can edit sudo chown -R apache:root /var/www/* # Edit php.ini upload_max_filesize 100M reboot # make mysqld and httpd start on boot sudo systemctl enable mysqld --now sudo systemctl enable httpd --now