INGRESSAR DEBIAN NO DOMINIO ACTIVE DIRECTORY
Instalar o software necessário
Instale os seguintes pacotes:
# apt install sssd-ad sssd-tools realmd adcli
Após instalar os pacotes desabilite a NAT temporariamente para não atrapalhar o
DNS.
Pré-requisitos e configurações de rede
Edite o [Link] (etc/[Link]) e o hosts /etc/hosts. Adicione as informações
do servidor DNS do AD (ip e domínio) no resolv e ip, fqdn e hostname do servidor
AD e do server que será engressado no domínio.
# nano /etc/[Link]
# nano /etc/hosts
Teste e juntando-se ao domínio AD
Usaremos o comando realm do realmd para ingressar no domínio e criar a
configuração do SSSD.
Vamos antes testar verificar se o domínio pode ser descoberto via DNS:
# sudo realm -v discover [Link]
Isso executa várias verificações e determina a melhor pilha de software para usar
com o SSSD. O SSSD pode instalar os pacotes ausentes via packagekit, mas já os
instalamos na etapa anterior.
Aparecerá igual acima se ok para encontrar o domínio do AD
Agora vamos engressar o Linux no domínio:
Se quiser definir o nome do usuário Administrador na linha de comando faça:
# realm Join -v -U Administrador [Link]
Coloque a senha do Administrator (Us) ou Administrdor (Br)
* Resolving: _ldap._tcp. [Link]
* Performing LDAP DSE lookup on: [Link]
* Successfully discovered: [Link]
* LANG=C /usr/sbin/adcli join --verbose --domain [Link] --domain-realm
[Link] --domain-controller [Link] --login-type user --login-user
Administrator --stdin-password
* Using domain name: [Link]
* Calculated computer account name from fqdn: AD-CLIENT
* Using domain realm: [Link]
* Sending NetLogon ping to domain controller: [Link]
* Received NetLogon info from: [Link]
* Wrote out [Link] snippet to /var/cache/realmd/adcli-krb5-
hUfTUg/krb5.d/adcli-krb5-conf-hv2kzi
* Authenticated as user: Administrator@[Link]
* Looked up short domain name: AD1
* Looked up domain SID: S-1-5-21-2660147319-831819607-3409034899
* Using fully qualified name: [Link]
* Using domain name: [Link]
* Using computer account name: AD-CLIENT
* Using domain realm: [Link]
* Calculated computer account name from fqdn: AD-CLIENT
* Generated 120 character computer password
* Using keytab: FILE:/etc/[Link]
* Found computer account for AD-CLIENT$ at: CN=
* Sending NetLogon ping to domain controller: [Link]
* Received NetLogon info from: [Link]
* Set computer password
* Retrieved kvno '3' for computer account in directory: CN=
* Checking RestrictedKrbHost/[Link]
* Added RestrictedKrbHost/[Link]
* Checking RestrictedKrbHost/AD-CLIENT
* Added RestrictedKrbHost/AD-CLIENT
* Checking host/[Link]
* Added host/[Link]
* Checking host/AD-CLIENT
* Added host/AD-CLIENT
* Discovered which keytab salt to use
* Added the entries to the keytab: AD-CLIENT$@[Link]:
FILE:/etc/[Link]
* Added the entries to the keytab: host/AD-CLIENT@[Link]:
FILE:/etc/[Link]
* Added the entries to the keytab: host/ad-
[Link]@[Link]: FILE:/etc/[Link]
* Added the entries to the keytab: RestrictedKrbHost/AD-
CLIENT@[Link]: FILE:/etc/[Link]
* Added the entries to the keytab: RestrictedKrbHost/ad-
[Link]@[Link]: FILE:/etc/[Link]
* /usr/sbin/update-rc.d sssd enable
* /usr/sbin/service sssd restart
* Successfully enrolled machine in realm
===================================================
Aparecerá no final igual à:
Se não der Sucesso, verifique o [Link], o arquivo hosts e a comunicação
de ip, hostname e fqdn usando o ping e claro a senha do servidor com o AD
(Administrador).
O Server AD será o DNS Server do Linux
Pronto pode ir no AD e verificar no Contêiner Computers e o Linux estará lá!