Joining Linux to Active Directory
You join Linux servers to a Windows domain and handle login with realmd and SSSD, group-based access, sudo, Kerberos keytabs and mixed-estate problems.
Level 501 · 16 lessons · 15 practice labs
Lessons
Joining
- Active Directory for Linux admins
- Prerequisites: DNS, time and naming
- Joining the domain with realm join
- The computer account and keytab
- Short task: join two servers into the right OU
Access
- ID mapping: from SID to UID
- Login permission through AD groups
- sudo rights for AD groups
- Home directories and shell attributes
- Short task: only Linux-Admins may log in and use sudo
Mixed estate
- An alternative join with Samba winbind
- Kerberos for Linux services via AD (HTTP and NFS)
- Group policy on Linux
- Common failures: clock skew, DNS and encryption types
- Short task: domain logins suddenly stopped, find out why
Wrap-up
- Capstone: join a fleet of Linux servers to the domain and manage access through groups
Practice labs
- Run the pre-join checks: Verify the server resolves the domain's DNS records, its clock matches the controller and its name fits, then report.
- Join two servers into the right OU: Join two Linux servers to the domain's servers OU with realm join and verify their computer accounts.
- Repair a broken computer account password: Restore logins on a server whose domain trust broke by renewing its keytab and computer account password.
- Limit logins to one AD group: Use realm permit so only members of a given AD group can log into the server.
- Grant sudo to an AD group: Allow only Linux-Admins to log in and use sudo, and verify another group is refused.
- Solve differing UIDs across servers: Fix NFS ownership broken because the same AD user gets different UIDs on two servers by correcting ID mapping.
- Set AD users' home directory and shell: Configure SSSD to give AD users a short-name home directory and the bash shell, and verify with a new login.
- Find out why domain logins stopped: Read the SSSD, Kerberos and system logs together to find why logins stopped and write a short incident note.
- Renew a broken machine account keytab: On a server where domain logins stopped because the machine password no longer matches, inspect the keytab, renew the machine account and confirm a ticket is issued.
- Fix logins stopped by clock skew: Find the clock skew on a server where domain logins suddenly stopped, fix time sync and verify login.
- Repair a server that cannot find the controller: Fix the DNS settings of a server that cannot resolve SRV records and rediscover the domain with realm discover.
- Resolve an encryption type mismatch: Fix Kerberos logins that fail after a policy change on the controller by examining the encryption types.
- Join a server to the domain with winbind: Join the file server to the domain with Samba winbind and verify AD users can reach the share.
- Add Kerberos single sign-on to an internal site: Create an HTTP service name and keytab for the internal web server and verify domain users get in without a password.
- Manage a Linux fleet's access through groups: Join four servers to the domain, hand out login and sudo rights through role-based AD groups and report the access table.
About this course
You join Linux servers to a Windows domain and handle login with realmd and SSSD, group-based access, sudo, Kerberos keytabs and mixed-estate problems.
What you will learn
- Joining
- Access
- Mixed estate
- Wrap-up
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.