{"id":1316,"date":"2024-08-06T11:08:35","date_gmt":"2024-08-06T09:08:35","guid":{"rendered":"https:\/\/ndk.sytes.net\/wordpress\/?p=1316"},"modified":"2025-03-18T13:02:11","modified_gmt":"2025-03-18T12:02:11","slug":"freebsd-as-active-directory-member-with-limited-ssh-access-2-2-2","status":"publish","type":"post","link":"https:\/\/ndk.sytes.net\/wordpress\/?p=1316","title":{"rendered":"Debian 12 as Active Directory member with limited SSH access"},"content":{"rendered":"\n

In order to join Debian 12 to an AD, you need to install Samba and change the default authentication. Please make sure that the network configuration is set up correctly and you are using the AD DNS servers.<\/p>\n\n\n\n

Step 1: Install prerequisities<\/h2>\n\n\n\n
$ apt install samba winbind libnss-winbind libpam-winbind<\/pre>\n\n\n\n
Step 2: Create samba config<\/h2>\n\n\n\n
Create a new file \/etc\/samba\/smb.conf<\/em>  or change the given one with your favourite editor. (VI, NeoVIM, VIM, Nano…) and add following content. If you want the explanation for the config parameter, please visit the Samba Documentation<\/a>.<\/p>\n\n\n\n
[global]\n    netbios name = <my host name here>\n    realm = <my domain here, e.g. domain.local>\n    workgroup = <my domain name without .local>\n    security = ADS\n    local master = no\n    domain master = no\n    allow trusted domains = no\n    winbind use default domain = yes\n    winbind enum groups = yes\n    winbind enum users = yes\n    winbind nss info = rfc2307\n    winbind cache time = 300\n    winbind offline logon = no\n    idmap config * : range = 2000-9999\n    idmap config * : backend = tdb\n    template shell = \/bin\/sh<\/pre>\n\n\n\n
Step 3: Test config, start samba and join the domain<\/h2>\n\n\n\n
Now let us test the samba config and start the SAMBA server only once, starting at boot will come later. If asked for a password, please enter it for the specified user.<\/p>\n\n\n\n
$ testparm\n$ systemctl start nmbd; systemctl start smbd; systemctl start winbind\n$ net ads join -U Administrator\n$ systemctl restart winbind<\/pre>\n\n\n\n
if successful, you can check the AD’s users and groups with wbinfo<\/p>\n\n\n\n
$ wbinfo -u
$ wbinfo -g<\/pre>\n\n\n\n
Basically you should see all users and groups. Hurray, your box is now a domain member!<\/em><\/p>\n\n\n\n
Step 4: Make the system use AD users for authentication<\/h2>\n\n\n\n
Next up,  you need to change the authentication backend. Simply use following command to enable homefolder creation and windows authentication:<\/p>\n\n\n\n
$ pam-auth-update<\/pre>\n\n\n\n
Now check if PAM can read users and groups:<\/p>\n\n\n\n
$ getent passwd
$ getent group<\/pre>\n\n\n\n
You should see all users and groups now. If you have domain trusts, users from other domains are going to be listed as well.<\/p>\n\n\n\n
Step 5: Configure OpenSSH and Sudo<\/h2>\n\n\n\n
Ok, all great so far. Now, let’s change OpenSSH to authenticate with AD and limit login only to domain admins in this case.<\/p>\n\n\n\n
edit \/etc\/ssh\/sshd_config<\/em> and change or add the following lines:<\/p>\n\n\n\n
PasswordAuthentication yes\nAllowGroups \"domain admins\" adm root<\/pre>\n\n\n\n
Next allow domain administrators to “sudo” commands (optional):<\/p>\n\n\n\n
edit \/etc\/sudoers<\/em> and change or add following lines:<\/p>\n\n\n\n
%domain\\ admins ALL=(ALL) NOPASSWD: ALL<\/pre>\n\n\n\n
Please be aware that NOPASSWD is used to suppress password confirmation when executing commands with sudo. It could be that you see that as a security risk. If so, simply remove “PASSWD:” from the line.<\/p>\n\n\n\n
Step 6: Start samba and winbind at boot time<\/p>\n\n\n\n
Last but not least, we need to start SAMBA at boot time. Simply execute following line:<\/p>\n\n\n\n
$ systemctl enable nmbd; systemctl enable smbd; systemctl enable winbind<\/pre>\n\n\n\n
That should be it. Now reboot<\/em><\/strong> and use your box as an AD member.<\/p>\n","protected":false},"excerpt":{"rendered":"
In order to join Debian 12 to an AD, you need to install Samba and change the default authentication. Please make sure that the network configuration is set up correctly and you are using the AD DNS servers. Step 1: Install prerequisities $ apt install samba winbind libnss-winbind libpam-winbind Step 2: Create samba config Create […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,7],"tags":[],"class_list":["post-1316","post","type-post","status-publish","format-standard","hentry","category-linuxunix","category-servers"],"_links":{"self":[{"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/1316","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1316"}],"version-history":[{"count":2,"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/1316\/revisions"}],"predecessor-version":[{"id":1338,"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/1316\/revisions\/1338"}],"wp:attachment":[{"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1316"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1316"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1316"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}