Join CentOS 6.x server to Windows 2012 AD domain using Likewise Open (PowerBroker Identity Services)

I've used the Likewise Open package for AD integration of Linux machines before, but never for CentOS 6.x.

I'm not too sure, nor do I really care all that much, but it seems that it seems that the package is not called Likewise Open anymore, but rather PowerBroker Identity Services, at any rate, these are the instructions needed to join a CentOS 6.x to a Windows 2012 AD Domain.

Firstly, ensure that domain name resolution is working, at a minimum the CentOS box must be able to ping the domain controller by name. Example /etc/resolv.conf file below, where there is a dns server on 192.168.1.65 for domain dev.com:

search dev.com
nameserver 192.168.1.65

1. Download the package from here (Although there is no support for CentOS 6.1 or higher it works fine):

http://www.beyondtrust.com/Technical-Support/Downloads/PowerBroker-Identity-Services-Open-Edition/?Pass=True



2. Disable SELinux. This is required by the installer 

setenforce 0

3. Install package:

sh pbis-open-7.0.4.918.linux.x86_64.rpm.sh

4. Join AD domain:

domainjoin-cli join dev.com Administrator

5. Create DNS entry:

/opt/pbis/bin/update-dns

6. Create SELinux Policy Module (see this link). Alternatively, disable SELinux altogether by editing the /etc/selinux/config file.

I must say that while using this product makes it simpler than my labour intensive way, I feel somewhat reticent to recommend this. It just feels like a cop out, maybe I'm a masochist who knows.

Join Ubuntu 12.10 (Quantal Quetzal) server to a Windows 2012 Active Directory domain

In this post I will show you how to join a Ubuntu 12.10 server to a Windows 2012 Server Active Directory domain using using Likewise Open. I've not tried using this method for CentOS/RHEL 6.x but Likewise Open is supported, so stay tuned.

In theory, this method should work for Windows 2003/2008 (R2) domains, but I've only tried it for  Windows 2012 Server.

I won't dwell on setting up the domain and DNS servers, see this previous post for details [it's for the Beta version but it still applies], all I will say is that ensure that name resolution works from the Ubuntu server, e.g. make sure that at least you can ping the DC by hostname and fully qualified domainname. An example /etc/resolv.conf file is shown below for a domain called dev.com and DNS server with ip address (192.168.1.65), this should be set up automatically from your DHCP server, if not you'll need to edit /etc/networking/interfaces (note that the options are different to those in /etc/resolv.conf, see man page for resolvconf):

search dev.com
nameserver 192.168.1.65

Install Likewise Open:

sudo apt-get install likewise-open5

You can now join the domain with this command (where dev.com is the domain and Administrator is an account with Admin access to the domain):

sudo domainjoin-cli join dev.com Administrator

Since I'm running a default server version of Ubuntu with no GUI, there is no need to reboot the server to be able to login to the server with domain accounts.

In order to login remember that you will need to use a valid username of this form domain\username.

I've not managed to get this command to add an entry for the server to the DNS server so I had to issue this command:

sudo lw-update-dns

Finally, in order to allow domain users to use sudo, you can add this line to the /etc/sudoers file, remember to edit this file with visudo. The first will allow sudo to all domain users, the second line will only allow domain admins sudo access.

%dev\\domain^users ALL=(ALL) ALL 

%dev\\domain^admins ALL=(ALL) ALL

Another upside of using Likewise Open is that users don't need to have their Unix attributes set, which I guess means that it's probably not necessary to install the Identity Management for UNIX components on the domain controller.

My post on how to set SSH single sign-on for Ubuntu 12.04, applies for 12.10 so I won't bother with a new post for single sign-on.