2

My company has asked me to look into connecting our CentOS 7 instance's to our Active Directory to make it easier for user management.

I have so far looked at:

Is there any other tool or resource I should look into to do my due diligence?

  • 1
    One thing to look out for is by following the instructions in your first link, all users are in the same default group. I'm working through this now but don't have a great answer. link – doneal24 Feb 28 '18 at 13:28
  • @DougO'Neal I personally did not want all users to be able to log into the sever so in the sshd_config, i added AllowGroups sudoers node_access as is it was missing from the config. i then created a sudoers and node_access file in /etc/sudoers.d/ and set up the group permissions in the respective files. To make this work on my CentOS machine, i had to edit /etc/security/access.conf and add the groups sudoers node_access to the section under # Same, but make sure that really the group wheel and not the user # wheel is used (use nodefgroup argument, too): – Govna Mar 2 '18 at 19:01
2

sssd and realmd was by far the easiest way to get this done. The below steps are what I did to get my CentOS machine on the domain and able to restrict access to only the specific users in the security groups in Active Directory (AD).

NOTE: All steps from the below two links:

Install the packages

$ sudo yum install -y sssd realmd oddjob oddjob-mkhomedir adcli \
   samba-common samba-common-tools krb5-workstation openldap-clients \
   policycoreutils-python

Edit the /etc/resolv.conf file & insert the following two lines:

$ sudo vi /etc/resolv.conf
search <domain>
nameserver <ip>

Joining to AD DOM

Join the Linux machine to the domain to be seen in Active Directory & to view that you are now on the domain:

$ sudo realm join --user=<user with permissions to add users to the domain> <domain>
$ sudo realm list

Edit /etc/sssd/sssd.conf:

From
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
To
use_fully_qualified_names = False
fallback_homedir = /home/%u

Then restart the sssd service:

$ sudo systemctl restart sssd

Setup sudo

Create the groups that will be used in AD in /etc/sudoers.d/<group Name> & edit the file and add the user access:

$ sudo touch /etc/sudoers.d/sudoers
$ sudo vi !$

Insert into sudoers file the permissions you want for this group:

%sudoers    ALL=(ALL)       ALL

NOTE: Have a system admin create the same groups in AD.

Edit which groups or users can access the system via SSH. Edit /etc/ssh/sshd_config and add the groups to the AllowGroups section. You may need to add AllowGroups to config file, I had to:

AllowGroups sudoers node_access

I have two groups, sudoers and node_access. Edit /etc/security/access.conf and add the groups into this file to only allow ssh access for users in the sudoers and node_access group.

Add the groups in ()'s to the below section of the access.conf file:

# Same, but make sure that really the group wheel and not the user
# wheel is used (use nodefgroup argument, too):
#
-:ALL EXCEPT (wheel) shutdown sync:LOCAL (sudoers) (node_access)

Restart the sssd service and test.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.