Integrate Ubuntu 16.04 to AD as a Domain Member with Samba and Winbind – Part 8

This tutorial describes how to join an Ubuntu machine into a Samba4 Active Directory domain in order to authenticate AD accounts with local ACL for files and directories or to create and map volume shares for domain controller users (act a as file server).

Requirements:

  1. Create an Active Directory Infrastructure with Samba4 on Ubuntu

Step 1: Initial Configurations to Join Ubuntu to Samba4 AD

1. Before starting to join an Ubuntu host into an Active Directory DC you need to assure that some services are configured properly on local machine.

An important aspect of your machine represents the hostname. Setup a proper machine name before joining the domain with the help of hostnamectl command or by manually editing /etc/hostname file.

# hostnamectl set-hostname your_machine_short_name
# cat /etc/hostname
# hostnamectl
Set System Hostname

Set System Hostname

2. On the next step, open and manually edit your machine network settings with the proper IP configurations. The most important settings here are the DNS IP addresses which points back to your domain controller.

Edit /etc/network/interfaces file and add dns-nameservers statement with your proper AD IP addresses and domain name as illustrated on the below screenshot.

Also, make sure that the same DNS IP addresses and the domain name are added to /etc/resolv.conf file.

Configure Network Settings for AD

Configure Network Settings for AD

On the above screenshot, 192.168.1.254 and 192.168.1.253 are the IP addresses of the Samba4 AD DC and Tecmint.lan represents the name of the AD domain which will be queried by all machines integrated into realm.

3. Restart the network services or reboot the machine in order to apply the new network configurations. Issue a ping command against your domain name in order to test if DNS resolution is working as expected.

The AD DC should replay with its FQDN. In case you have configured a DHCP server in your network to automatically assign IP settings for your LAN hosts, make sure you add AD DC IP addresses to the DHCP server DNS configurations.

# systemctl restart networking.service
# ping -c2 your_domain_name

4. The last important configuration required is represented by time synchronization. Install ntpdate package, query and sync time with the AD DC by issuing the below commands.

$ sudo apt-get install ntpdate
$ sudo ntpdate -q your_domain_name
$ sudo ntpdate your_domain_name
Time Synchronization with AD

Time Synchronization with AD

5. On the next step install the software required by Ubuntu machine to be fully integrated into the domain by running the below command.

$ sudo apt-get install samba krb5-config krb5-user winbind libpam-winbind libnss-winbind
Install Samba4 in Ubuntu Client

Install Samba4 in Ubuntu Client

While the Kerberos packages are installing you should be asked to enter the name of your default realm. Use the name of your domain with uppercases and press Enter key to continue the installation.

Add AD Domain Name

Add AD Domain Name

6. After all packages finish installing, test Kerberos authentication against an AD administrative account and list the ticket by issuing the below commands.

# kinit ad_admin_user
# klist
Check Kerberos Authentication with AD

Check Kerberos Authentication with AD

Step 2: Join Ubuntu to Samba4 AD DC

7. The first step in integrating the Ubuntu machine into the Samba4 Active Directory domain is to edit Samba configuration file.

Backup the default configuration file of Samba, provided by the package manager, in order to start with a clean configuration by running the following commands.

# mv /etc/samba/smb.conf /etc/samba/smb.conf.initial
# nano /etc/samba/smb.conf 

On the new Samba configuration file add the below lines:

[global]
        workgroup = TECMINT
        realm = TECMINT.LAN
        netbios name = ubuntu
        security = ADS
        dns forwarder = 192.168.1.1

idmap config * : backend = tdb        
idmap config *:range = 50000-1000000
	
   template homedir = /home/%D/%U
   template shell = /bin/bash
   winbind use default domain = true
   winbind offline logon = false
   winbind nss info = rfc2307
   winbind enum users = yes
   winbind enum groups = yes

  vfs objects = acl_xattr
  map acl inherit = Yes
  store dos attributes = Yes
Configure Samba for AD

Configure Samba for AD

Replace workgroup, realm, netbios name and dns forwarder variables with your own custom settings.

The winbind use default domain parameter causes winbind service to treat any unqualified AD usernames as users of the AD. You should omit this parameter if you have local system accounts names which overlap AD accounts.

8. Now you should restart all samba daemons and stop and remove unnecessary services and enable samba services system-wide by issuing the below commands.

$ sudo systemctl restart smbd nmbd winbind
$ sudo systemctl stop samba-ad-dc
$ sudo systemctl enable smbd nmbd winbind

9. Join Ubuntu machine to Samba4 AD DC by issuing the following command. Use the name of an AD DC account with administrator privileges in order for the binding to realm to work as expected.

$ sudo net ads join -U ad_admin_user
Join Ubuntu to Samba4 AD DC

Join Ubuntu to Samba4 AD DC

10. From a Windows machine with RSAT tools installed you can open AD UC and navigate to Computers container. Here, your Ubuntu joined machine should be listed.

Confirm Ubuntu Client in Windows AD DC

Confirm Ubuntu Client in Windows AD DC

Step 3: Configure AD Accounts Authentication

11. In order to perform authentication for AD accounts on the local machine, you need to modify some services and files on the local machine.

First, open and edit The Name Service Switch (NSS) configuration file.

$ sudo nano /etc/nsswitch.conf

Next append winbind value for passwd and group lines as illustrated on the below excerpt.

passwd:         compat winbind
group:          compat winbind
Configure AD Accounts Authentication

Configure AD Accounts Authentication

12. In order to test if the Ubuntu machine was successfully integrated to realm run wbinfo command to list domain accounts and groups.

$ wbinfo -u
$ wbinfo -g
List AD Domain Accounts and Groups

List AD Domain Accounts and Groups

13. Also, check Winbind nsswitch module by issuing the getent command and pipe the results through a filter such as grep to narrow the output only for specific domain users or groups.

$ sudo getent passwd| grep your_domain_user
$ sudo getent group|grep 'domain admins'
Check AD Domain Users and Groups

Check AD Domain Users and Groups

14. In order to authenticate on Ubuntu machine with domain accounts you need to run pam-auth-update command with root privileges and add all the entries required for winbind service and to automatically create home directories for each domain account at the first login.

Check all entries by pressing [space] key and hit ok to apply configuration.

$ sudo pam-auth-update
Authenticate Ubuntu with Domain Accounts

Authenticate Ubuntu with Domain Accounts

15. On Debian systems you need to manually edit /etc/pam.d/common-account file and the following line in order to automatically create homes for authenticated domain users.

session    required    pam_mkhomedir.so    skel=/etc/skel/    umask=0022
Authenticate Debian with Domain Accounts

Authenticate Debian with Domain Accounts

16. In order for Active Directory users to be able to change password from command line in Linux open /etc/pam.d/common-password file and remove the use_authtok statement from password line to finally look as on the below excerpt.

password       [success=1 default=ignore]      pam_winbind.so try_first_pass
Users Allowed to Change Password

Users Allowed to Change Password

17. To authenticate on Ubuntu host with a Samba4 AD account use the domain username parameter after su – command. Run id command to get extra info about the AD account.

$ su - your_ad_user
Find AD User Information

Find AD User Information

Use pwd command to see your domain user current directory and passwd command if you want to change password.

18. To use a domain account with root privileges on your Ubuntu machine, you need to add the AD username to the sudo system group by issuing the below command:

$ sudo usermod -aG sudo your_domain_user

Login to Ubuntu with the domain account and update your system by running apt-get update command to check if the domain user has root privileges.

Add Sudo User Root Group

Add Sudo User Root Group

19. To add root privileges for a domain group, open end edit /etc/sudoers file using visudo command and add the following line as illustrated on the below screenshot.

%YOUR_DOMAIN\your_domain\  group       		 ALL=(ALL:ALL) ALL
Add Root Privileges to Domain Group

Add Root Privileges to Domain Group

Use backslashes to escape spaces contained into your domain group name or to escape the first backslash. In the above example the domain group for TECMINT realm is named “domain admins”.

The preceding percent sign (%) symbol indicates that we are referring to a group, not a username.

20. In case you are running the graphical version of Ubuntu and you want to login on the system with a domain user, you need to modify LightDM display manager by editing /usr/share/lightdm/lightdm.conf.d/50-ubuntu.conf file, add the following lines and reboot the machine to reflect changes.

greeter-show-manual-login=true
greeter-hide-users=true

It should now be able to perform logins on Ubuntu Desktop with a domain account using either your_domain_username or [email protected]_domain.tld or your_domain\your_domain_username format.

If You Appreciate What We Do Here On TecMint, You Should Consider:

TecMint is the fastest growing and most trusted community site for any kind of Linux Articles, Guides and Books on the web. Millions of people visit TecMint! to search or browse the thousands of published articles available FREELY to all.

If you like what you are reading, please consider buying us a coffee ( or 2 ) as a token of appreciation.

Support Us

We are thankful for your never ending support.

Matei Cezar

I'am a computer addicted guy, a fan of open source and linux based system software, have about 4 years experience with Linux distributions desktop, servers and bash scripting.

Your name can also be listed here. Got a tip? Submit it here to become an TecMint author.

RedHat RHCE and RHCSA Certification Book
Linux Foundation LFCS and LFCE Certification Preparation Guide

You may also like...

72 Responses

  1. armando says:

    Hello, Please i need help..

    [email protected]:/home/mindcaf# [email protected]:/home/mindcaf# /usr/local/samba/bin/samba-tool domain level raise --domain-level=2008_R2
    bash: [email protected]:/home/mindcaf#: No such file or directory
    [email protected]:/home/mindcaf# ERROR: Domain function level can't be smaller than or equal to the actual one!
    > [email protected]:/home/mindcaf#
    
  2. Fcis says:

    I followed this tutorial and have successfully added twenty machines running Ubuntu 16.04 to my ad domain and users in the domain can now login to these machines using their ad credentials. The problem now is that the domain user folders (Documents, Desktop, Downloads,…) are not synched across these machines.

    For example, if ad\userA logged in to the first machine and created a folder named Folder1 in his Documents folder, then logged in to the second machine he won’t find Folder1 in his Documents folder.

    So I wonder how I the domain user account folders can be automatically synched when a user login to any of the other domain connected machines? Any advice please?

  3. elms says:

    All these steps just to add a machine to a domain? One error along the way and its a down a rabbit hole. Keep in mind we all have different distro. This is really frustrating. A part from Linux being free, whats the point of having a domain controlled network if i have to figure 60 computers manually, with all the errors associated?

    I have successfully managed to add a windows machine to a Ubuntu domain server yet i cant do the same to a Linux machine. I have looked around and still cant a find a good GUI to use.

    I’ve given up. I’d rather buy windows and make life easier than this constant medieval way.

  4. James says:

    So I got the packages on Step 5 to install but I never get the screen for the Kerberos Realm Configuration. Is there a way to re-run it?

  5. Manoj says:

    Hi Thanks for this amazing Tutorial. It worked perfectly. I have a small issue though i can’t reset the user password. I am getting below error. I have try thousand passwords.

    [email protected]:~$ passwd
    Changing password for manoj
    (current) NT password:
    Enter new NT password:
    Retype new NT password:
    The password of this user is too recent to change
    Your password must be at least 7 characters; cannot repeat any of your previous 24 passwords; must contain capitals, numerals or punctuation; and cannot contain your account or full name; Please type a different password. Type a password which meets these requirements in both text boxes.
    passwd: Authentication token manipulation error
    passwd: password unchanged
    [email protected]:~$

  6. Fcis says:

    It works successfully and users can login to their AD accounts but then when they try to open Firefox they get this error message “your firefox profile cannot be loaded. it may be missing or inaccessible” any advice?

  7. Andrew Mendelsohn says:

    Followed instructions on Linux Mint 18.1 and I’m able to su to a domain user and authenticate with the domain password and user is created, but no home directory is created.

    I added the suggested line to /etc/pam.d/common-account. This is the only thing that doesn’t seem to work, I can see all the AD users and groups, but the lack of a home dir causes other problems. Any ideas why no home dir creation?

  8. Olha says:

    Thank you for the instructions! Everything works.

  9. Andrew III says:

    I can’t start the winbind after configuring the smb.confg, need help please..

    TOPOLOGY:  
    192.168.1.21 [ lab.mis ]    [ testing(ubununt18) ] 172.16.1.231 
    
    smb.conf:
    [global]
    	workgroup = LAB
    	realm = LAB.MIS
    	netbios name = testing
    	security = ADS
    	dns forwarder = 192.168.1.254   # 
    	idmap config * : backend = tdb        
    	idmap config *:range = 50000-1000000
    
    template homedir = /home/%D/%U
    template shell = /bin/bash
    winbind use default domain = true
    winbind offline logon = false
    winbind nss info = rfc2307
    winbind enum users = yes
    winbind enum groups = yes
    vfs objects = acl_xattr
    map acl inherit = Yes
    store dos attributes = Yes
    ____________________________________________________________
    winbind status
    ● winbind.service - Samba Winbind Daemon
       Loaded: loaded (/lib/systemd/system/winbind.service; enabled; vendor preset: enabled)
       Active: failed (Result: exit-code) since Thu 2018-09-20 13:37:12 +08; 9min ago
         Docs: man:winbindd(8)
               man:samba(7)
               man:smb.conf(5)
      Process: 2217 ExecStart=/usr/sbin/winbindd --foreground --no-process-group 
     $WINBINDOPTIONS (code=exited, status=1/FAILURE)
     Main PID: 2217 (code=exited, status=1/FAILURE)
    
    Sep 20 13:37:11 testing systemd[1]: Starting Samba Winbind Daemon...
    Sep 20 13:37:12 testing winbindd[2217]: [2018/09/20 13:37:12.021429,  
    0] ../source3/winbindd/winbindd_cache.c:3170(initialize_winbindd_cache)
    Sep 20 13:37:12 testing winbindd[2217]:   initialize_winbindd_cache: 
    clearing cache and re-creating with version number 2
    Sep 20 13:37:12 testing winbindd[2217]: [2018/09/20 13:37:12.023319,  0] 
    ../source3/winbindd/winbindd_util.c:891(init_domain_list)
    Sep 20 13:37:12 testing winbindd[2217]:   Could not fetch our SID - did we join?
    Sep 20 13:37:12 testing winbindd[2217]: [2018/09/20 13:37:12.023620,  0] 
    ../source3/winbindd/winbindd.c:1366(winbindd_register_handlers)
    Sep 20 13:37:12 testing winbindd[2217]:   unable to initialize domain list
    Sep 20 13:37:12 testing systemd[1]: winbind.service: Main process exited,
     code=exited, status=1/FAILURE
    Sep 20 13:37:12 testing systemd[1]: winbind.service: Failed with result 'exit-code'.
    Sep 20 13:37:12 testing systemd[1]: Failed to start Samba Winbind Daemon.
    
  10. Shiva says:

    Hi,

    I reinstalled libnss and libpam and winbind packages. from then on the ownership permissions are changed instead of domain users it shows “rtcarchivingdomainservices“. Could anyone please help me on this?

    Or do let me know how to unjoin from domain without affecting the permissions for previous users in that machine.

    Thanks,
    Shiva

Got something to say? Join the discussion.

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.