Linux Kerberos auth

Edit your /etc/krb5.conf with your Windows realm settings. It's probably enough to delete all the example domains and set lookup_kdc to true.

Edit your /etc/samba/smb.conf. Set

security = ads
realm = <KRBREALMNAME.ORG>
workgroup = <NBDOMAINNAME>

At the bare minimum. Also handy:

idmap uid = 10000-99999
idmap gid = 10000-99999
idmap config NBDOMAINNAME : backend = rid
idmap config NBDOMAINNAME : range = 1000-9999
template homedir = /home/%U #%U becomes whatever the username is
template shell = /bin/bash #or whatevs, you know

Generates the UIDs and GIDs from the RIDs, but keeps them the same across linux boxes.

My personal additions:

winbind use default domain = yes
winbind normalize names = yes
winbind nested groups = yes

Normalize names means "Domain Admins" is now "domain_admins"

Hit it the config with a testparm -v and make sure it checks out before moving on.

Next you will need to actually join the domain, so run

net ads join -U <username>

...and make sure all went well with the join.

Now we can get to the fun part. Start up winbind with service winbind start and check the output/logs for any weird errors or warnings you may want to clear up.

Check the machine's connection to the domain and information gathering:

wbinfo -t #checks the domain trust credentials
wbinfo -u #dumps all the usernames, feelsgoodman.jpg
wbinfo -i <username> #should see a passwd-like line indicating idmap works

If all that comes back like it's supposed to, you should be ready to add in AD-based authnz.

Now you can add "winbind" to nsswitch.conf and run

id <domain username here>

This should return a user with a UID that equals the last part of the user's SID (the RID) + 1000 (or whatever the start of your range is)

If it doesn't, check to see if nscd is enabled and running, if so, issue a service nscd stop and run the 'id' command again.

If you get back the right stuff from id, you can enable pam_winbind. How, you ask? Should I edit the files by hand? Nah, waste of time. Just run authconfig or authconfig_tui and flag Winbind as enabled. It's basically just boilerplate stuff anyway.

The real magic happens in /etc/security/pam_winbind.conf. Here you can set the good stuff

krb5_auth = yes #makes it so your user can grab a kerberos ticket on login, handy for CIFS
krb5_ccache_type = FILE #save that kerberos ticket, instead of just check that you were able to get one (which is the default)
require_membership_of = "AD group here" #makes sure the user belongs to this group to control access (handy for servers!)
mkhomedir = yes #Create homedir on login. slick, right?

Now, my child, you can attempt to login to the box with an Active Directory username. The groups are real groups, too. So you can use them with sudo, even with spaces. A line from one of mine:

%Domain\ Admins ALL=(ALL) ALL