{"id":2635,"date":"2020-06-03T13:33:56","date_gmt":"2020-06-03T11:33:56","guid":{"rendered":"https:\/\/tech.lobobrothers.com\/join-linux-to-active-directory-and-mount-mobile-profile\/"},"modified":"2025-02-06T15:12:36","modified_gmt":"2025-02-06T14:12:36","slug":"join-linux-to-active-directory-and-mount-mobile-profile","status":"publish","type":"post","link":"https:\/\/tech.lobobrothers.com\/en\/join-linux-to-active-directory-and-mount-mobile-profile\/","title":{"rendered":"Join Linux to Active Directory and mount mobile profile"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Easier than it seems<\/h2>\n
<\/div>\n

As with any connection made in a Windows environment, the main thing is to use the DNS of your domain. To do this, we configure the network card with said DNS and domain to use in our case PRUEBAS.LOCAL and IP 192.168.10.45<\/p>\n

We install NTP and configure it so that our time server is the DC<\/p>\n

apt ntp install<\/strong><\/p>\n

nano \/etc\/ntp.conf<\/strong><\/p>\n

and we replace the pools with our DCs<\/p>\n

\"ntp<\/p>\n

We restart ntp service<\/p>\n

service ntp restart<\/strong><\/p>\n

And we verify with ntpq -p that it synchronizes correctly with our DC<\/p>\n

\"show<\/p>\n

Now we proceed to install the necessary packages<\/p>\n

apt -y install realmd sssd adcli libwbclient-sssd krb5-user sssd-tools samba-common packagekit samba-common-bin samba-libs<\/strong><\/p>\n

It will ask us if we want to modify smb.conf to use WINS, where we will indicate that No is the default option.<\/p>\n

\"you<\/p>\n

Next, it will ask us for the Kerberos realm where we will put our domain TESTS.LOCAL, in capital letters, although we are going to put it in lowercase so that you can observe the error that will be given if it is not entered in capital letters.<\/p>\n

\"realm<\/p>\n

and then the servers in our case 192.168.10.45, its the full name of the FQDN server<\/p>\n

\"server<\/p>\n

Same for the administrative server<\/p>\n

\"administrative<\/p>\n

Ok, we already have the main thing installed, be careful in previous versions in some distribution you had to patch the packagekit as in Ubuntu 16.04 from this repository<\/p>\n

add-apt-repository ppa:xtrusia\/packagekit-fix<\/strong><\/p>\n

apt update<\/strong><\/p>\n

apt upgrade packagekit<\/strong><\/p>\n

Our lab machine, as we saw in a previous post, was upgraded to Debian Buster, we will see at the end if we encounter any problems.<\/p>\n

We move on to configure nsswitch, edit \/etc\/nsswitch.conf and add sss in the following sections, in the case of Debian Buster it does it automatically.<\/p>\n

passwd: compat sss<\/strong><\/p>\n

group: compat sss<\/strong><\/p>\n

\u2026.<\/strong><\/p>\n

netgroup: nis sss<\/strong><\/p>\n

sudoers: files sss<\/strong><\/p>\n

But it is very important to modify the line<\/p>\n

hosts: \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0files\u00a0 mdns4_minimal [NOTFOUND=return] dns<\/strong><\/p>\n

for this other one, where the only thing we do is change the order by putting dns after files, without this change the union will fail.<\/p>\n

hosts: \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0files dns mdns4_minimal [NOTFOUND=return]<\/strong><\/p>\n

We create a Kerberos ticket, as follows<\/p>\n

kinit -V usarioadministradordominio<\/strong><\/p>\n

BE CAREFUL without the domain name because it will take it from the default_realm which is the one we put in the installation, you will see that it will fail with the message<\/p>\n

kinit: KDC reply did not match expectations while getting initial credentials<\/strong><\/p>\n

This is the typical error that happens frequently and we wanted to reproduce it in this post, this is because when it asked us for the realm we put it in lowercase to reproduce this typical error, just edit \/etc\/krb5.conf and put it in uppercase both in default_realm and in the realms, in addition to adding at the bottom in the section<\/p>\n

[domain_realm]<\/strong><\/p>\n

pruebas.local = PRUEBAS.LOCAL<\/strong><\/p>\n

.pruebas.local = PRUEBAS.LOCAL<\/strong><\/p>\n

Of course, with your domain<\/p>\n

Once set correctly, we will get<\/p>\n

Authenticated to Kerberos v5<\/strong><\/p>\n

Having the ticket we join our machine to the domain, in the OU that we want and with your domain, in our case we have created an OU called Linux Computers<\/p>\n

realm join pruebas.local –computer-ou=”ou=Linux Computers,dc=pruebas,dc=local” -U usuarioadministradordominio<\/strong><\/p>\n

and we will get<\/p>\n

* Successfully enrolled machine in realm<\/strong><\/p>\n

We already have our machine joined to the domain, now we are going to mount the mobile profiles, for this we first install<\/p>\n

apt install smbclient gvfs-fuse gvfs-backends gvfs-bin cifs-utils libpam-mount<\/strong><\/p>\n

Once installed we edit \/etc\/sssd\/sssd.conf<\/p>\n

nano \/etc\/sssd\/sssd.conf\u00a0<\/strong><\/p>\n

and we put the following line in False leaving it like this<\/p>\n

use_fully_qualified_names = False<\/strong><\/p>\n

We edit the following<\/p>\n

nano \/etc\/security\/pam_mount.conf.xml<\/strong><\/p>\n

and below<\/p>\n

<!– Volume definitions –><\/strong><\/p>\n

We set up the profile by entering the location where we have said user profiles.<\/p>\n

<volume user=”*” fstype=”cifs” server=”servidor” path=”\/%(USER)” mountpoint=”\/home\/%(USER)” options=”sec=ntlm,mfsymlinks,nodev,nosuid” \/><\/strong><\/p>\n

The entire process of joining the domain and setting up the mobile profile in the user’s \/home can be done using scripts, since for example it is very useful when you have a virtual desktop platform, launching said script automatically in the last step of creating the desktop from the broker.<\/p>\n

TL.<\/p>\n

Thanks for reading our posts.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

FAQs<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhat are the benefits of integrating Linux with Active Directory?<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

By integrating Linux with Active Directory, administrators can centrally manage users and permissions, enforce security policies, and facilitate access with single credentials (Single Sign-On).<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhat commands are used to verify Linux integration with Active Directory?<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

Some useful commands are:<\/p>\n