Bre*_*nt 11 linux debian active-directory authentication
使用 Active Directory 对 linux (Debian) 机器上的用户进行身份验证的最佳做法是什么？
我希望它的工作方式是将 AD 用户添加到一个组中 - 例如linux administrators或linux webserver，并且根据他们的组成员身份，他们将/不会被授予访问特定服务器的权限。理想情况下，root 帐户将是唯一以标准方式维护的帐户。
我这样做的目标如下：
我想避免的事情是：
您没有理由在大多数发行版上使用任何外部软件。
对于 Debian/Ubuntu，您可以使用 libnss-ldap 和 libpam-krb5 来完成。有一些技巧可以使其 100%。这假设您为 Linux 用户填充了“unixHomeDirectory”，您的 Linux 机器使用与您的 Windows 系统通用的 NTP（Kerberos 要求），并且您可以使用纯文本 NSS 查找（不是密码而是组成员信息等 - 您也可以使用 TLS，但设置起来更复杂）。除非您设置为使用 TLS，否则不应将 pam_ldap 作为密码或 PAM 中的身份验证源。
/etc/ldap.conf
# LDAP Configuration for libnss-ldap and libpam-ldap.
# Permit host to continue boot process with out contacting LDAP server
bind_policy soft
# Define LDAP servers to use for queries, these must be Global Catalog servers
uri ldap://ldap.site.company.local
# Define root search location for queries
base dc=company,dc=local
#debug 1
# LDAP version, almost always going to be v3, it is quite mature
ldap_version 3
# Username used to proxy authentication. You can have this in a separate file owned by root for security OR use TLS/SSL (see man page)
# Do NOT use LDAP for authentication if you are using plain text binds, use Kerberos instead (and LDAP for authorization only). See libpam-krb5.
binddn cn=ldap-auth-svc,ou=ldap,ou=services,dc=site,dc=company,dc=local
# Password for proxy acct
bindpw SooperSekeretPazzwerd
# TCP port to perform queries on, 3268 is a Global Catalog port which will reply for all users in *.company.local
port 3268
# Search range scope (sub = all)
scope sub
# Tell the client to close TCP connctions after 30 seconds, Windows will do this on the server side anyways, this will prevent errors from showing up in the logs.
idle_timelimit 30
# Expect queries for group membership to return DN for group members instead of usernames (lets you use MSAD group membership seamlessly)
nss_schema rfc2307bis
# Filters - User accounts must have a UID >= 2000 to be recognized in this configuration and must have a unixHomeDirectory defined.
nss_base_group dc=company,dc=local?sub?&(objectClass=group)(gidNumber=*)
nss_base_user dc=company,dc=local?sub?&(objectClass=user)(!(objectClass=localputer))(uidNumber>=2000)(unixHomeDirectory=*)
nss_base_shadow dc=company,dc=local?sub?&(objectClass=user)(!(objectClass=localputer))(uidNumber>=2000)(unixHomeDirectory=*)
# Object Class mappings. You may want to have the posixAccount to map to "mail" and have users login with their email addresses, i.e. "nss_map_objectclass posixAccount mail".
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_objectclass posixGroup group
# Attribute mappings.
nss_map_attribute uniqueMember member
nss_map_attribute uid sAMAccountName
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute shadowLastChange pwdLastSet
# Attribute in LDAP to query to match the username used by PAM for authentication
pam_login_attribute sAMAccountName
# Filter for objects which are allowed to login via PAM
pam_filter objectclass=User
假设您的 Linux 机器正在使用了解 AD 的 DNS 服务器（具有适当 SRV 记录的 _msdcs 区域是可解析的），您不需要编辑 /etc/krb5.conf
/etc/nsswitch.conf 应该有用户、组、影子的“文件 ldap”。
对于使用 SSSD 的 Red Hat：
/etc/sssd/sssd.conf
[domain/AD]
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
ldap_uri = ldap://ldap.company.local:3268/
ldap_search_base = dc=company,dc=com
ldap_default_bind_dn = cn=ldap-auth-svc,ou=ldap,ou=services,dc=site,dc=company,dc=local
ldap_default_authtok = SooperSekeretPazzwerd
ldap_schema = rfc2307bis
ldap_user_object_class = user
ldap_group_object_class = group
ldap_user_name = sAMAccountName
ldap_user_home_directory = unixHomeDirectory
enumerate = true
ldap_tls_reqcert = never
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_id_use_start_tls = False
cache_credentials = True
krb5_realm = SITE.COMPANY.COM
case_sensitive = false
[sssd]
services = nss, pam
config_file_version = 2
domains = AD
[nss]
filter_users = root,named,avahi,nscd