Easy Active Directory integration with Likewise Open

Manual and Automatic

In both cases, Likewise Open handles the configuration work in the background, removing the need for complex manual steps. The software modifies the configurations for user interaction with AD (see Figure 4), including the files required for Kerberos communications with the KDC krb5.conf and the PAM files in /etc/pam.d/*.

To log in using a Linux client domain, users must have a home directory on the client. Likewise creates the directory locally if you modify /-etc/security/pam_lwidentity.conf.

The /--etc/nsswitch.conf file tells Likewise Open to take control again and specify the lwidentity method. The NSS name service checks local files such as /etc/passwd first:

passwd: files lwidentity
group:  files lwidentity

If it fails to find an account, it then accesses the AD. This means that local users can still access the local machine if AD fails.

Careful Configuration

Likewise is careful about configuring the Linux system. It creates backups of any files it modifies, adding a suffix of .lwidentity.bak, and for good reason: Running domainjoin-cli leave as root at the command line or in the GUI removes the machine account.

In this case, Likewise restores any configuration files that have been changed. Likewise uses the /etc/samba/lwiauthd.conf file to let administrators set configuration options for their own Winbind system; you might be familiar with these settings if you use Samba in an AD environment.

Individual Configuration

The template shell parameter sets the login shell centrally for all domain users. The user's home directory is not defined in the AD user database; thus, you will need to specify the path in the configuration file with the Samba template homedir parameter:

template shell   = /bin/bash
template homedir = /home/%D/%U

Likewise-Winbind replaces %D with the short domain name and %U with the domain user.

To avoid name collisions in trust relationships, it makes sense to add the domain to the user's path – and to apply the defaults for user directories. If you do not change the configuration, Likewise Open will use the backslash as the separator between domains and usernames. Of course, the backslash has a special meaning in Unix shells. Experts recommend changing this to, say, the plus character on all your clients by using winbind separator.

If you only have one domain, you can set winbind use default domain = yes to avoid separating the domain and usernames. If you fail to do so, the domain users supplied by Winbind will not work unless you add a domain prefix. Restarting the likewise-open init script applies the changes.

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Linux with Active Directory

    Microsoft's Active Directory system provides centralized user management and single sign-on. If you're ready for a few manual steps, Linux can leverage this potential.

  • FreeIPA

    FreeIPA offers integrated identity management and big ideas for the future.

  • Samba 4

    Samba 4 has been around for more than three years, but some users still shy from it. If you are still sitting on the fence, this tour through some of the new features and capabilities might help you decide whether it is finally time to upgrade.

  • Likewise Open Sees 100,000 Downloads Thanks Open Source Community

    Likewise announced today that over 100,000 organizations have downloaded Likewise Open, its cross-platform integration software used for joining desktops and servers running Linux, Unix and Mac OS X to an organization's existing Active Directory environment.

  • Linux with Active Directory

    We explore some leading tools for integrating your Linux network with an Active Directory environment.

comments powered by Disqus