作者 主題: Centos6 join Domain  (閱讀 1450 次)

0 會員 與 1 訪客 正在閱讀本文。

netman

  • 管理員
  • 俺是博士!
  • *****
  • 文章數: 17479
    • 檢視個人資料
    • http://www.study-area.org
Centos6 join Domain
« 於: 2014-12-30 11:24 »
https://akhnoto.wordpress.com/2013/10/18/join-domain-centos-6/

1. Firstly, install the necessary components.
[root@localhost ~]# yum install -y samba-winbind samba-winbind-clients oddjob-mkhomedir pam_krb5 krb5-workstation

2. Make sure OddJobd is running at Startup. This is only for Red Hat Enterprise Linux 6 and other Red Hat based Operating systems.
[root@localhost ~]# chkconfig oddjobd on

Set authconfig to point to the relevant systems for Authentication.
Note: If you do not wish your users to log into your server via a shell, set –winbindtemplateshell to –winbindtemplateshell=/sbin/nologin
[root@localhost ~]# authconfig --update --kickstart --enablewinbind --smbsecurity=ads --smbworkgroup=DOMAIN --smbrealm=DOMAIN.COM --winbindtemplatehomedir=/home/%U --winbindtemplateshell=/bin/bash --enablewinbindusedefaultdomain --enablelocauthorize --enablekrb5 --krb5realm=DOMAIN.COM --enablekrb5kdcdns --enablekrb5realmdns --enablepamaccess

3. Just like in Windows, Add your system to the domain. Here I have used the Domain Administrator account, but any account with enough rights to add a system to the domain will suffice.
[root@localhost ~]# net ads join -U Administrator

4. Add localhost to dns server
[root@localhost ~]# net ads join -U Administrator

5. Restart Winbind service
[root@localhost ~]# service winbind restart

6. Create a Kerberos keytab to enable Single Sign On (SSO)
[root@localhost ~]# net ads keytab create -U Administrator

7. Test configuration. If you receive no output for a known username, then something is wrong.
[root@localhost ~]# getent passwd Administrator
[root@localhost ~]# wbinfo -u
[root@localhost ~]# wbinfo -g

8. This is optional, your home directory will not exist on the system when a new user logs in, run the below command if you with to have the homedir automatically created on first login.
[root@localhost ~]# authconfig --enablemkhomedir --update

biao007h

  • 懷疑的國中生
  • **
  • 文章數: 70
    • 檢視個人資料
Re: Centos6 join Domain
« 回覆 #1 於: 2014-12-30 17:42 »
感谢分享,楼主辛苦了 ;D

netman

  • 管理員
  • 俺是博士!
  • *****
  • 文章數: 17479
    • 檢視個人資料
    • http://www.study-area.org
Re: Centos6 join Domain
« 回覆 #2 於: 2015-03-19 14:48 »
如果不能login并且在 /var/log/secure中發現如下error:
Authentication failure (KDC reply did not match expectations)

請修改 /etc/krb5.conf 確定用大寫表示domain:
[libdefaults]
 default_realm = MY.EXAMPLE.COM
...

[realms]
...
 MY.EXAMPLE.COM = {
  kdc = 192.168.1.1
  kdc = 192.168.1.2
 }
...