What is the command line tool that can help to analyze the state of a domain controller?
Microsoft's Active Directory (AD) is the go-to directory service for many organizations. If you and your team are responsible for a mixed Windows and Linux environment, then you probably would like to centralize authentication for both platforms. I'll cover how to add Linux computers to an Active Directory domain. Show
Active Directory and the need for centralized access managementMicrosoft's Active Directory, more popularly known as AD, has held the lion's share of the market for enterprise access management for many years now. It is used by institutions and individuals the world over to centrally control access to resources belonging to the organization. It gives you the ability to manage users, passwords, resources such as computers, and dictate who has access to what. For some of you reading this write-up, especially those who work in large institutions, you have interacted with AD before. Usually, the interaction is using one set of login credentials to log in to any workstation in the organization. That is just the tip of a large iceberg. Imagine a collection of 40 computer systems and 70 users in a firm. Some employees run shifts while others work regular hours. Some have access to printing; others don't. The traditional way of working is to create local user accounts on each computer a user needs to access. Imagine the workload on the end-user support team. When a user changes his password for any reason, that user has to change the password on all computers he previously had access to, to keep things in sync. In no time, there will be mayhem. Now, imagine two members of the staff resign. I do not need to tell you the monotonous work that has to be repeated any time there's a change to the staffing or any workstations. For IT teams, this is a nightmare. Time that could be used for innovative tasks is now spent reinventing the wheel. I have not even spoken about managing access to the printers. This is where a directory service such as Active Directory thrives. It can literally be a lifesaver. With Active Directory, each user is uniquely created as an object in a central database, with a single set of credentials. Each computer system is also created as an object. Automatically, every user can access every workstation with that same set of credentials. Any account changes that need to be made are made once at the central database. Members of staff can access the printers using the same set of credentials. The printers' authentication mechanism can be coupled with AD to achieve that. Happy users, happy IT team. Using groups and organizational units, access to various resources can be tailored and maintained. It gets even better. This directory can store staff phone numbers, email addresses, and can be extended to store other information. What if someone resigns? No problem. Just disable the user's account. That person's access to all resources is nullified on the spot. The bigger the organization, the greater the need for centralized management. It saves time; it saves emotions. At its heart, a directory service is just an organized way of itemizing all the resources in an organization while facilitating easy access to those resources. Basically, AD is a kind of distributed database, which is accessed remotely via the Lightweight Directory Access Protocol (LDAP). LDAP is an open protocol for remotely accessing directory services over a connection-oriented medium such as TCP/IP. AD is not the only directory service based on the x.500 standard, or that can be accessed using LDAP. Other directory services include OpenLDAP and FreeIPA. However, AD is a mature Windows-based service that comes incorporated with Windows Server systems. In other words, it's going to be the automatic winner when your organization has many Windows systems. This is one of the reasons for its ubiquity. Directory services such as FreeIPA are Linux-based and provide an excellent service for a Linux stable. When the rubber hits the road, the choice boils down to which of the two you can set up quickly, given your current environment and your team's skill set. [ Learn how to manage your Linux environment for success by downloading this free eBook. ] But what happens when you choose AD, and you have a few CentOS servers, and you do not want to maintain a separate set of credentials for your Linux users? That overhead is entirely avoidable. What you need to do is join the Linux servers to the AD domain, like you would a Windows server. If that is what you need to do, then read on to find out just how to do it. It is possible to join a Windows system to a FreeIPA domain, but that is outside the scope of this article. PrerequisitesThis article presupposes that you have at least some introductory-level experience with Active Directory, especially around user and computer account management. Aside from that, the following obvious requirements need to be met:
To make this article easier on everyone, here's a list of key details. This is how the lab I used for this write up is set up, so you should modify accordingly.
Packages to installFor this configuration, the essential package to install is
However, for those interested in the details, a quick Google search should be of great help. Realmd (interacting with the domain)Now
that all packages have been installed, the first thing to do is to join the CentOS system to the Active Directory domain. We use the
The space between the user account and the domain account is not a typo. By inserting the corresponding details, we get the following command:
Supply the password when the prompt appears and wait for the process to end. Don't let the short absence of output deceive you. There are a number of operations that go on as part of the process. You can tack on the Have a look at its output: It is also quite trivial to place the newly-created AD computer object in a specific Organizational Unit (OU) from the onset. I'll leave that for further reading, but, as a tip, you can consult the man page. Using the To leave the domain altogether, you need two words: Further configurationSo now that the Linux server is part of the AD domain, domain users can access the server with their usual credentials. We are done, right? Wrong. "What's the problem?" I hear you say. [ Free cheat sheet: Get a list of Linux utilities and commands for managing servers and networks. ] Well, for starters, this is the barebones configuration to get you up and running. But the experience is clunky, to say the least. We need to configure the service further to give it a true AD feel. It should be just like logging on to a domain-joined Windows 10 workstation. Secondly, there is the big elephant in the room for sysadmins called Dynamic DNS Updates (DynDNS). If it is not set up correctly, we create extra overhead by having to maintain DNS records manually. For an environment that relies heavily on DNS, that could be a problem. For Windows systems, joining a system to the domain means two entries are automatically managed and maintained on the DNS server. When IP addresses change, the change is automatically reflected in DNS. This means you can change the IPs of systems without incurring the cost of manual maintenance. This will only make sense to people who already take advantage of DNS in their environments. Aside from the noticeable productivity gains of automation, it helps to have both Windows and Linux environments working the same way. The third issue is DNS Scavenging. In an Active Directory domain, DNS is usually provided by the Domain Controllers. Every system joined to the domain has an automatic DNS entry with a corresponding IP address. This is super convenient. Automatically, at a specified interval, stale DNS records are deleted to prevent misdirected packets and also take care of deleted computer objects. This is known as scavenging, and it is not turned on by default in AD. However, if it is turned on, we need to configure it. Typically, the scavenging interval is seven days. If, after that period, there has been no update to the record, it is deleted, unless it is a static record. For Windows systems, the Dynamic Updates feature is automatically set up. However, with Linux servers, a few modifications need to be made. Without doing that, we will have services going down after a while because their records are deleted from DNS, and no one knows how to reach their component parts. Now that we know some of the potential issues we need to address, let's take a look at some of the things we can tweak to deliver a more seamless experience to the end-user and the sysadmin. SSSD (easier logins and dynamic updates)
Let's have a look at its contents before configuration. Once you join the domain, it is immediately modified to contain the minimum information required for a successful logon. My file looked like this: In order to solve all three of the problems I mentioned earlier, edit your file to look like the one below: Most of the options are self-explanatory, and you can modify yours accordingly while we step through what some of the key options represent. More information on all the options can be
obtained by checking the man page. I think it is well written. Just type First and foremost, the configuration file is separated into two sections. The global section, under [sssd] and the domain-specific options section, [domain/[domain name]]. The global section contains options that affect the general behavior of
The domain-specific section contains parameters that are specific to the domain you have joined. Key parameters are:
Once the configuration is complete, restart
At this point, we are set. We can now login like we would at a Windows workstation or server. Visudo (granting admin privileges)Users that are granted access have unprivileged access to the Linux server. For all intents and purposes, all Active Directory accounts are now accessible to the Linux system, in the same way natively-created local accounts are accessible to the system. You can now do the regular sysadmin tasks of adding them to groups, making them owners of resources, and configure other needed settings. If the user tries any
activity that requires In that light, we can edit the Alternatively, we could have just added the user to the [ Network getting out of control? Check out Network automation for everyone, a free book from Red Hat. ] Wrap upTry this out in your organization or lab environment. It is obvious I just scratched the surface on this topic but this will get you pretty far into the process. Check out the respective documentation if you want to explore options not covered in this article. Joining a Linux system to an Active Directory domain allows you to get the best of both worlds. The process is very simple and can be scripted using Bash or automated using Ansible, especially during the system's initial setup. If you are still managing a group of more than five systems without a directory service and a good reason, please do yourself a favor and get one set up. You can thank me later. What is netdom commandEnables administrators to manage Active Directory domains and trust relationships from the command prompt. Netdom is a command-line tool that is built into Windows Server 2008 and Windows Server 2008 R2. It is available if you have the Active Directory Domain Services (AD DS) server role installed.
What commandThe DSAdd command allows objects to be created in Active Directory. The parameter supported by the command are computer, contact, group, OU, user and quota.
How do I test my domain controller?Use the Dcdiag command-line tool to help you determine whether the domain controller computer is registered with the domain name server (DNS), whether the controller can be pinged, and whether the controller has Lightweight Directory Access Protocol (LDAP) connectivity.
What is the command to find the domain controller?Use the nltest /dsgetdc:domainname command to verify that a domain controller can be located for a specific domain. Use the NSLookup tool to verify that DNS entries are correctly registered in DNS.
|