16

we use a lot of Linux-Servers with active-directory membership for user-authentication. This are made with the likewise-open packet. We tested the beta-Version of ubuntu Server 14.04 LTS. Everything works fine after one minute (install, domain-join, import registry, edit sudoers, done). Now, from beta to production-release likewise-open is removed from repository.

Is there any equivalent easy way for AD-domain-join and (AD-)group-based login-management (without manually installing and editing config-files for samba, winbind, nsswitch, pam etc....?

thanks a lot Silvio

6 Answers 6

16

Using Powerbroker instead of likewise

do as steps below

1- download powerbroker frome here http://download1.beyondtrust.com/Technical-Support/Downloads/PowerBroker-Identity-Services-Open-Edition/?Pass=True

2- run it ,

sudo chmod a+x

run by typing it and hitting enter key

 sudo ./pibsfilename.sh

3- join by one of the below commands

 sudo domainjoin-cli join domainname.com [email protected]

or

 sudo domainjoin-cli join --disable ssh domainname.com [email protected]

4- Also, note that you might need to make one minor change to a config file as noted here. Namely, in the file /etc/pam.d/common-session, change the line that reads:

   session sufficient pam_lsass.so

to

   session [success=ok default=ignore] pam_lsass.so

5- run this command to config, like lwconfig in likewise (run from home folder), use caret ^ for spaces in group names

   /opt/pbis/bin/config Requiremembershipof "domainname\\ASecurityGroupFromYourDomain" "domainname\\plus^other^group"
   /opt/pbis/bin/config AssumeDefaultDomain true
   /opt/pbis/bin/config UserDomainPrefix domainname

6- if you want a username to be sudoer do as follows

 sudo nano /etc/sudoers

after root line add the line below

 username ALL=(ALL:ALL) ALL

for group use %:

 %DOMAINNAME\\Power^Users ALL=(ALL:ALL) ALL

7- and finally edit lightdm configuration file

   sudo nano /usr/share/lightdm/lightdm.conf.d/50-unity-greeter.conf

   allow-guest=false
   greeter-show-remote-login=false
   greeter-show-manual-login=true

(60-lightdm-gtk-greeter.conf in Lubuntu 14.04)

8- Reboot

Resources used:

3
  • Thanks a lot. For me I will run with the "realmd" - network authenification that use "sssd" for authentication.
    – user272446
    Apr 24, 2014 at 11:51
  • "disbale" should probably be "disable", yes? Jun 11, 2014 at 20:52
  • For me, tab completion in terminal shells is broken for AD user; from here, I think sudo /opt/pbis/bin/config LoginShellTemplate /bin/bash might fix that (for new users only?). Also there's a note that 50-unity-greeter.conf needs to be edited instead for Lubuntu 14.04. Jun 12, 2014 at 17:36
8

It has simply been rebranded, and removed from official repositories. It is now known as BeyondTrust PowerBroker Identity Services, Open Edition (not as catchy, I know), and can be found here.

Also, note that you might need to make one minor change to a config file as noted here. Namely, in the file /etc/pam.d/common-session, change the line that reads:

session sufficient pam_lsass.so

to

session [success=ok default=ignore] pam_lsass.so

Found this info after a LOT of Googling and pulling out hair. Hope this helps.

1
  • Just in case anyone is looking for a bug report, it's here, with the same fix as your answer. Someone mentioned that he would notify PowerBroker about this, but apparently they haven't fixed PBIS yet.
    – Bart
    Jul 24, 2014 at 14:21
1

The other (and in IMHO the more mature and stable) solution is Centrify Express.

Steps on how to install Centrify Express (and why folks switched to Centrify) can be found at

http://www.question-defense.com/2012/08/31/dpkg-error-processing-likewise-open-configure-join-linux-server-to-windows-domain-controller

http://ninjix.blogspot.com/2011/01/puppet-module-for-centrify-express.html

1
  • Welcome to Ask Ubuntu! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – guntbert
    Apr 23, 2014 at 18:50
1

Thanks a lot. For me (instead of use the PBIS (powerbroker identify service)) i will run with the "realmd - network authenification" that use "sssd". This install and configure all components (Kerberos and the sssd-config) for me (SSSD= System Security Services Daemon). The only thing to do is joining the domain (see realm --help) and manually setup pam (in /etc/pam.d/common-session; add "session required pam_mkhomedir.so umask=077) for auto-create homedirectorys and possibly modify sudoers-file for the ad-users. Take a look of that, I think that is an easy alternative way for AD-Integration and it comes out of the box and use standards.

0

I hope you searched for other options because sudo apt-get install likewise-open didn't work, follow these steps to install likewise in 14.04 , It worked for me.

wget http://de.archive.ubuntu.com/ubuntu/pool/main/l/likewise-open/likewise-open_6.1.0.406-0ubuntu10_i386.deb
wget http://de.archive.ubuntu.com/ubuntu/pool/main/libg/libglade2/libglade2-0_2.6.4-1ubuntu3_i386.deb
wget http://de.archive.ubuntu.com/ubuntu/pool/universe/l/likewise-open/likewise-open-gui_6.1.0.406-0ubuntu10_i386.deb
sudo dpkg -i likewise-open_6.1.0.406-0ubuntu10_i386.deb
sudo dpkg -i libglade2-0_2.6.4-1ubuntu3_i386.deb
sudo dpkg -i likewise-open-gui_6.1.0.406-0ubuntu10_i386.deb
sudo domainjoin-cli join domain_name admin_username

will ask for admin password and you are in.

Hope this will help.

0

I write a short howto for install PowerBroker Identity Services on ubuntu 14.04 lts server. I use for Apache service SSO over AD and Windows 7 client. In french but the command line is write in shell :o) : http://www.cymea.net/sso-apache2-active-direcotry-powerbroker-identity-services/

Nice read

wget http://download.beyondtrust.com/PBISO/8.0.0.2016/linux.deb.x64/pbis-open-8.0.0.2016.linux.x86_64.deb.sh
chmod +x pbis-open-8.0.0.2016.linux.x86_64.deb.sh
./pbis-open-8.0.0.2016.linux.x86_64.deb.sh
domainjoin-cli join TEST.LAN administrateur

Joining to AD Domain:   TEST.LAN
With Computer DNS Name: chronos.TEST.LAN
[email protected]'s password:
...
Your system has been configured to authenticate to Active Directory for the first time.  It is recommended that you restart your system to ensure that all applications recognize the new settings.
SUCCESS
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .