Chapter 2. Connecting RHEL systems directly to AD using Samba Winbind

Procedure

1. If your AD requires the deprecated RC4 encryption type for Kerberos authentication, enable support for these ciphers in RHEL:

   # update-crypto-policies --set DEFAULT:AD-SUPPORT

   Copy to Clipboard Toggle word wrap

2. Install the following packages:

   # yum install realmd oddjob-mkhomedir oddjob samba-winbind-clients \
          samba-winbind samba-common-tools samba-winbind-krb5-locator krb5-workstation

   Copy to Clipboard Toggle word wrap

3. To share directories or printers on the domain member, install the samba package:

   # yum install samba

   Copy to Clipboard Toggle word wrap

4. Backup the existing /etc/samba/smb.conf Samba configuration file:

   # mv /etc/samba/smb.conf /etc/samba/smb.conf.bak

   Copy to Clipboard Toggle word wrap

5. Join the domain. For example, to join a domain named ad.example.com:

   # realm join --membership-software=samba --client-software=winbind ad.example.com

   Copy to Clipboard Toggle word wrap

   Using the previous command, the realm utility automatically:

   • Creates a /etc/samba/smb.conf file for a membership in the ad.example.com domain
   • Adds the winbind module for user and group lookups to the /etc/nsswitch.conf file
   • Updates the Pluggable Authentication Module (PAM) configuration files in the /etc/pam.d/ directory
   • Starts the winbind service and enables the service to start when the system boots

6. Optional: Set an alternative ID mapping back end or customized ID mapping settings in the /etc/samba/smb.conf file.

   For details, see the Understanding and configuring Samba ID mapping

7. Edit the /etc/krb5.conf file and add the following section:

   [plugins]
       localauth = {
           module = winbind:/usr/lib64/samba/krb5/winbind_krb5_localauth.so
           enable_only = winbind
       }

   Copy to Clipboard Toggle word wrap

8. Verify that the winbind service is running:

   # systemctl status winbind
   ...
      Active: active (running) since Tue 2018-11-06 19:10:40 CET; 15s ago

   Copy to Clipboard Toggle word wrap
   Important

   To enable Samba to query domain user and group information, the winbind service must be running before you start smb.

9. If you installed the samba package to share directories and printers, enable and start the smb service:

   # systemctl enable --now smb

   Copy to Clipboard Toggle word wrap

Verification

1. Display an AD user’s details, such as the AD administrator account in the AD domain:

   # getent passwd "AD\administrator"
   AD\administrator:*:10000:10000::/home/administrator@AD:/bin/bash

   Copy to Clipboard Toggle word wrap

2. Query the members of the domain users group in the AD domain:

   # getent group "AD\Domain Users"
       AD\domain users:x:10000:user1,user2

   Copy to Clipboard Toggle word wrap

3. Optional: Verify that you can use domain users and groups when you set permissions on files and directories. For example, to set the owner of the /srv/samba/example.txt file to AD\administrator and the group to AD\Domain Users:

   # chown "AD\administrator":"AD\Domain Users" /srv/samba/example.txt

   Copy to Clipboard Toggle word wrap

4. Verify that Kerberos authentication works as expected:

   1. On the AD domain member, obtain a ticket for the administrator@AD.EXAMPLE.COM principal:

      # kinit administrator@AD.EXAMPLE.COM

      Copy to Clipboard Toggle word wrap

   2. Display the cached Kerberos ticket:

      # klist
      Ticket cache: KCM:0
      Default principal: administrator@AD.EXAMPLE.COM
      
      Valid starting       Expires              Service principal
      01.11.2018 10:00:00  01.11.2018 20:00:00  krbtgt/AD.EXAMPLE.COM@AD.EXAMPLE.COM
              renew until 08.11.2018 05:00:00

      Copy to Clipboard Toggle word wrap

5. Display the available domains:

   # wbinfo --all-domains
   BUILTIN
   SAMBA-SERVER
   AD

   Copy to Clipboard Toggle word wrap