Questions tagged [active-directory]
The active-directory tag has no usage guidance.
217
questions
0
votes
0
answers
9
views
Default password keyring doesn't automatically unlock at domain user login
We've been using Centrify DirectControl to manage Linux computers ingress in the Active Directory Domain. The users can login using their domain credentials.
This works fine, but after login (using ...
0
votes
1
answer
20
views
bash script for activeDirectory join; facing issues using expect to bypass password entry
Will preface here stating that this is poor practice but I have been requested anyway to store the svc-account credential within the script which will live in vRA for VM template.. not my choice, but ...
1
vote
1
answer
20
views
Linux - Local account, password from AD
I have users defined in AD but because of some overrides, I have to add those accounts in my local /etc/passwd. Precisely, I want to assign a user a different GID then it is defined in AD.
I want to ...
0
votes
0
answers
43
views
Kerberos login with ssh from a sane Windows terminal?
Current setup: gitforwindows.org and the mintty terminal with bash. ssh to Linux with known username/password. Works fine.
New requirement: use the Kerberos ticket in Windows to have password-less ...
1
vote
0
answers
58
views
Check account status as a Samba domain member
I have a Rocky Linux 8.5 machine running as an Active Directory domain member.
I've added it to the domain with net ads join command and I can run several commands to list domain objects as expected. ...
4
votes
1
answer
402
views
How to troubleshoot a LDAP error 53 (WILL_NOT_PERFORM)?
I am trying to make a CentOS 7 server join an AD, but it results in an error:
AD LDAP ERROR: 53 (Server is unwilling to perform): 0000216D: SvcErr: DSID-031A1241, problem 5003 (WILL_NOT_PERFORM), ...
1
vote
0
answers
30
views
Specific domain computer login when integrating with Windows domain
I'm trying to let a user named "linuxuser" can only login to a specific domain computer.
My test environment description:
Windows Server 2016 with Active Directory Service
Ubuntu Server 20....
0
votes
0
answers
12
views
Ldap Authentication, searches, necessity
I currently have a client where I use several sites with ldap authentication using mod_authnz_ldap in apache2
For my understanding it is not relevant to search the authenticated user within the ldap ...
0
votes
0
answers
30
views
Enterprise Linux environments and Active Directory integration - Dumb idea or the right way to go?
I help manage a large Linux environment (6K+ server/workstation) and want to understand better if we should go all-in on Active Directory integration, move to IdM/FreeIPA/Centrify, or stay with what ...
2
votes
0
answers
114
views
Is pam_krb5 affected by Active Directory kerberos changes due to CVE-2021-42287?
I use pam_krb5 to authenticate Linux users against a Microsoft Active Directory. Due to CVE-2021-42287, Microsoft is pushing out updates that will change the way kerberos works in AD. Microsoft's ...
1
vote
0
answers
153
views
Joined linux host to AD server using realmd. Unable to change ad user passwords from the command line
Have a fairly simple setup of one AD server with various linux hosts. We attached the linux hosts to our domain by using:
realm discover domain.example.com
realm join domain.example.com -U user.adm
...
2
votes
0
answers
117
views
Sync LDAP groups and UIDs with Active Directory
Currently, our organization has a working OpenLDAP server that we use to login to our Linux environments. However, due to the increase in Windows devices, the higher-ups have decided to migrate to an ...
1
vote
1
answer
217
views
Linux in Active Directory: Persistent users
I was able to successfully join my Ubuntu 18.04 machine into AD.
For this I'm using SSSD and Kerberos.
I can ssh into in using AD domain credentials. Everything is fine except that those domain users ...
0
votes
1
answer
514
views
How can I get the current time as an LDAP timestamp in Unix?
I want to be able to generate an ActiveDirectory LDAP timestamp in Unix for some tests I need to run. Active Directory stores date/time values as the number of 100-nanosecond intervals that have ...
0
votes
0
answers
25
views
p99 spikes in springboot api which communicates with MS AD
dont know if this question belongs to unix.stackechange/stackoverflow/devops.stackexchange.
I open it here because i think it could be somehow unix/linux related.
We have a custom java/springboot api, ...
2
votes
1
answer
782
views
Is it possible to have a local user with the same name as a domain user
I have a linux box set up with a local user that I've been using. If I join this computer to a domain using realm, will there be a conflict if the AD user I will be logging into has the same username ...
1
vote
1
answer
481
views
CentOS: Can AD id users in domain but AD users can't SSH in
I can join machines to a realm with Ubuntu no problem. So using the exact same steps for CentOS 7.7, I am able to join the domain and id users... but I can't ssh in!
Steps I use only differ with ...
2
votes
0
answers
763
views
SMB mount with Kerberos
I have set up a server with Fedora 33 and joined it to an Active Directory. This worked successful and users can authenticate themselves with their Active Directory user names. I can also see my Linux ...
3
votes
1
answer
8k
views
Samba file server + AD + SSSD without Winbind
Currently have a CentOS8 server AD integrated using SSSD + automatic SID->UID mapping/generation. I would like to setup some file shares to make use of AD groups, but am struggling to get it set up....
1
vote
2
answers
234
views
SUDO successful for Active Directory admin group member using wrong password
Environment:
OS: FreeBSD 12.1-Release-p10
Sudo: 1.9.5p2
Samba: 4.13.1_1
We've recently migrated to an Active Directory backend for DNS, DHCP, and in-house SSO support. I have SSH logins ...
1
vote
0
answers
682
views
Authenticate samba users using AD
So I have an ubuntu 20.04 machine that I want to use as the storage server for my domain using samba. The server is not a DC, but it is joined to the domain as any other computer using realmd and sssd ...
0
votes
1
answer
2k
views
Allowing Active Directory groups to sudo on Ubuntu 20.04
I've joined the domain and set up group login successfully, but can't get sudo to work for members of that group. %DOMAIN\\domain-group ALL=(ALL) ALL in /etc/sudoers doesn't work---users are not ...
1
vote
0
answers
532
views
How do I see which user accounts are available to systemd for launching services on system startup?
I have a systemd service that fails to launch on system startup with error code status=217/USER (see below), which means D001615 (AD user) does not exist according to this answer.
However, if I ...
1
vote
0
answers
130
views
How is folder redirection configured on Linux Clients?
I'm wanting to configure home directories on my Linux clients to be redirected to my samba AD-DC homes share. I tried using fstab to mount the user's home directory in /home, that creates issues for ...
0
votes
0
answers
244
views
Join MINT 20 System to Windows Server 2003 AD fails with "failed to lookup DC: Device Timeout
I've been following the instructions provided in https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member to try and get a Mint Linux 20 machine added to my Windows Server 2003 domain. At ...
1
vote
0
answers
810
views
FreeBSD + SSSD + Samba + Windos Server 2019 AD: Unable to set permissions or create files
I'm using:
FreeBSD 12.1 release p10 amb64
Samba 4.10.17
sssd 1.11.7
I'm about to upgrade Active Directory from Windows 2012R2 to Windows 2019. In my existing setup, I have the unix attributes added ...
0
votes
0
answers
2k
views
SUSE 15 SP2 AD Authentication: Server not found in Kerberos database
I am trying to configure configure Active Directory authentication on a SLE 15 SP2 host.
The AD-domain exists of multiple DCs/AD-servers.
I followed these guides:
https://www.suse.com/c/the-sssd-...
1
vote
0
answers
184
views
CIFS mount locks active directory user
I am configuring a Windows Distributed File share with this fstab entry
//company.local/DFSdata/Office/office_data /mnt/y cifs credentials=/home/user/.smbcredentials,file_mode=0666,dir_mode=...
0
votes
1
answer
168
views
Samba domain has multiple ips associated with it
I have been setting up a samba DC but the same machine has a couple of docker containers running and it picked up the network interfaces as active, now the domain has 5 different ips that aren't what ...
1
vote
1
answer
381
views
Sync OpenLDAP - Active Directory
Today, we have an OpenLDAP that works very well.
We would like to create a Domain & AD (Windows) that would be populated and synchronized by OpenLDAP.
I could read some topics for reverse ...
1
vote
1
answer
195
views
How to use Active Directory (domain groups) for user management in SLURM?
We have a GPU cluster (centOS 8) in our company network which runs SLURM.
Now we would like to realize the SLURM user management via our windows domain controller (active directory).
Every user which ...
0
votes
1
answer
334
views
AD users unable to access Samba Share
I have a RHEL 7.6 server joined to AD using sssd and realm. I am able to SSH into the Linux servers as AD users, but the same users are unable to access the Samba share configured in the server. When ...
0
votes
0
answers
106
views
Can't access CentOS samba file server using IP address but can using domain name in Windows Explorer
I have set up a samba file server on CentOS that is on a domain. AD users can access it through Windows Explorer using its domain name, but they cannot access it through using its IP address. When ...
1
vote
1
answer
188
views
Using autojump / z in combination with pushd popd
Autojump or z let you move around in your filesystem by entering only a part of the entire path (e.g. z foo takes me to /long/long/path/to/foo).
I often want to jump to a path, do something, and get ...
1
vote
0
answers
10k
views
SSSD new groups not added to user, "tsig verify failure ... update failed: REFUSED"?
After adding a user to a group in Active Directory and looking for that group to appear with the user on a linux server linked to AD via SSSD, noticing that the group is not added to the user (even ...
0
votes
1
answer
2k
views
Automate a domain join on linux
I'm new to Linux and searched the whole day on how to automate a domain join and i didn't find anything. This is the code i came up with.
realm join domain.com --user=exampleuser
echo "password"
I ...
1
vote
0
answers
451
views
Why some Active Directory domain users can't connect to the server?
I've been experiencing an issue with a RHEL 7 Server in which relatively newly created Active Directory domain users can't connect to the server.
When I try to login with users which were created ...
1
vote
0
answers
1k
views
Can gpasswd add non-local users to local group?
We use CentrifyDC in our organization.
I have a local group to which I want to add AD users.
# getent passwd aduser
aduser:x:12345:12345:AD User:/home/aduser:/bin/bash
As illustrated, getent ...
1
vote
1
answer
1k
views
SAMBA AD new files group is "domain users" not the Primary Group
We're using samba Acitve Directory (AD) Version 4.3.11-Ubuntu with Windows Active Directory Users and Computers MMC console. The file server (attached to the domain) is Ubuntu 14.04.6 LTS. In this ...
4
votes
1
answer
8k
views
realm join unable to create computer account
Reading man realm I see the following:
--computer-ou=OU=xxx
The distinguished name of an organizational unit to create the computer account. The exact format of the distinguished name depends on ...
0
votes
0
answers
488
views
ldap home directory permission issue on debian/ubuntu
I have joined the debian9 machine to microsoft AD when i run su - test1 it create the home directory but with below permission.
root@debiantest:/home# ls -ltr
drwxr-xr-x 2 test1 data 4096 Sep 18 22:...
5
votes
3
answers
786
views
How can i list a user's groups when their names contain spaces?
Our site uses Active Directory, and many group names contain spaces. This renders the output of groups impossible to parse reliably, even by eye (are there groups "London" and "Developers", or a group ...
1
vote
1
answer
3k
views
Domain Joined Linux - PAM mkhomedir creating homedirs owned as root for SSH
Currently, I have a fleet of linux computers joined to an active directory domain with SSSD for user management - primarily ubuntu, with some Raspian as well.
I'm using pam_mkhomedir.so to create ...
1
vote
1
answer
4k
views
Samba winbind: how to authenticate from trusted AD domain (one-way trust)?
Hello linux newbie here.
What I am trying to achieve: to be able to login to Linux machine with Active Directory credentials from trusted domain.
I have the following setup:
+...
0
votes
0
answers
302
views
How to login as a domain user after using realm join domain
I have made my rhel 8 join Windows Active Directory and it is also visible from the server end. But now how do I login as a user of that domain?
0
votes
1
answer
716
views
How to resolve problems connecting to Samba4 Active Directory Domain Controller on Ubuntu Micro AWS Instance
I'm trying to set up a Active Directory Domain Controller on an Ubuntu 16.04 instance on Amazon's EC2 micro services. I do everything right (following at least three different tutorials) and get all ...
0
votes
1
answer
7k
views
Use AD Groups Instead of Linux Groups
On our file server, we are using a bunch of Linux groups that are still in use and need to be replaced by their counterparts in AD. The groups in AD and /etc/groups have an identical name, so, (I'm ...
2
votes
0
answers
936
views
Samba shares - How to restrict access to Active Directory groups
I'm working in an Active Directory domain environment and am trying to configure some Samba shares so certain directories on a SUSE UNIX server are accessible by Windows clients.
Access to each share ...
6
votes
1
answer
3k
views
Linux clients can't login on samba share while windows and mac can (active directory env)
Setup
server
Centos 7.6
Samba 4.8
Winbind
SSSD
Kerberos
This machine is attached to the company active directory as member server but not domain controller (I followed the RadHat documentation to ...
0
votes
0
answers
420
views
Add all users in AD-Group to the local wheel group
We have limited 'su' to users that are in the wheel group and are now looking to permit certain users that are in a particular AD-Group.
The users that we want to permit to use the program 'su' are ...