Joining Ubuntu to an Active Directory Domain

Hello, my dear little blog. I've got a new note for you on how to join Ubuntu (tested on 18.04 and 20.04) to an Active Directory domain.

As usual, I haven't invented anything new. It's all out there on the internet already, but now it will be here too. I won't explain why you'd need this, because if you want to do it, you most likely know perfectly well why.

Preparation

First, enable the universe packages. If they aren't enabled yet:

sudo tee -a /etc/apt/sources.list <<EOF
deb http://us.archive.ubuntu.com/ubuntu/ bionic universe
deb http://us.archive.ubuntu.com/ubuntu/ bionic-updates universe
EOF

Now update the apt indexes:

sudo apt -y update

Change the host name:

sudo hostnamectl set-hostname linux-utils.vitaliy.org

and check it - type hostnamectl and get:

    Static hostname: linux-utils.vitaliy.org
          Icon name: computer-vm
            Chassis: vm
         Machine ID: c6eccece18fa4459b843deae2cf5a2aa
            Boot ID: 545b62e60e0d4a72bfc86024bd2e2adc
     Virtualization: microsoft
   Operating System: Ubuntu 20.10
             Kernel: Linux 5.8.0-48-generic
       Architecture: x86-64

Making sure DNS is configured correctly

Remove systemd-resolve and configure /etc/resolv.conf ourselves.

sudo systemctl disable systemd-resolved
sudo systemctl stop systemd-resolved
sudo unlink /etc/resolv.conf
sudo mcedit /etc/resolv.conf

Put in something like this:

search     vitaliy.org
nameserver 192.168.2.1
nameserver 192.168.2.2

Just use your own domain name and DNS servers.

Installation

Install the required packages:

sudo apt -y install realmd libnss-sss libpam-sss sssd sssd-tools adcli samba-common-bin oddjob oddjob-mkhomedir packagekit

Joining the domain

Check that we can "see" our domain:

$ sudo realm discover vitaliy.org
vitaliy.org
  type: kerberos
  realm-name: VITALIY.ORG
  domain-name: vitaliy.org
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: libnss-sss
  required-package: libpam-sss
  required-package: adcli
  required-package: samba-common-bin
  login-formats: %U
  login-policy: allow-permitted-logins
  permitted-logins:
  permitted-groups: Domain Admins

Join the domain:

sudo realm join -U Administrator vitaliy.org

And right away check that everything is fine:

$ realm  list
vitaliy.org
  type: kerberos
  realm-name: VITALIY.ORG
  domain-name: vitaliy.org
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: libnss-sss
  required-package: libpam-sss
  required-package: adcli
  required-package: samba-common-bin
  login-formats: %U
  login-policy: allow-permitted-logins

Enable automatic creation of user home directories:

sudo bash -c "cat > /usr/share/pam-configs/mkhomedir" <<EOF
Name: activate mkhomedir
Default: yes
Priority: 900
Session-Type: Additional
Session:
        required                        pam_mkhomedir.so umask=0022 skel=/etc/skel
EOF

Run:

sudo pam-auth-update

and enable mkhomedir.

Then restart sssd and check that it works:

sudo systemctl restart sssd
systemctl status sssd

Configuring access

Now allow individual users or groups to log on to the computer:

sudo realm permit user1@example.com
sudo realm permit -g 'Domain Users'

You can allow everyone:

sudo realm permit --all

or deny everyone:

sudo realm  deny --all

That's it.

Free bonus:

Members of the Domain Admins group can be added to sudoers. That doesn't happen by default.

Here's how:

sudo mcedit /etc/sudoers.d/domain_admins

Put the following there:

%domain\ admins        ALL=(ALL)     ALL

Now that's really it!