Ubuntu Wiki

Nasty Hacky Active Directory Integration on Edgy

#run this script as ROOT, you must be root or it will not work
#put your variables in here then run the whole thing
# it will ask you to a kerberos realm., use the same value you entered for AD_DOMAIN
# then it will ask you whether or not to use the defaults form DNS, choose yes
# after kerberos config, the script stops for some reason, but copy & paste everything after dpkg-reconfigure krb5-config
# then it will restart needed services and you can ssh in as domain users to test

export DOMAIN_ADMIN=rcadmin
export DOMAIN_PASS=YOURPASS
export AD_DOMAIN=LABS.AD.UGA.EDU
export AD_SHORTNAME=LABS
export MACHINE_OU=Music

#enable universe for kerberos packages
perl -pi -e 's!# deb http://us.archive.ubuntu.com/ubuntu/ edgy universe!deb http://us.archive.ubuntu.com/ubuntu/ edgy universe!g' /etc/apt/sources.list
perl -pi -e 's!# deb http://security.ubuntu.com/ubuntu edgy-security universe!deb http://security.ubuntu.com/ubuntu edgy-security universe!g' /etc/apt/sources.list
apt-get update
#install samba and winbind
apt-get install samba winbind krb5-user  -y
#configure samba
perl -pi -e  's!   workgroup = MSHOME!
   security = ads
   workgroup = $ENV{'AD_SHORTNAME'}
   realm = $ENV{'AD_DOMAIN'}
   idmap uid = 500-10000000
   idmap gid = 500-10000000
   winbind separator = +
   winbind enum users = no
   winbind enum groups = no
   winbind use default domain = yes
   template homedir = /home/%U
   template shell = /bin/bash
   client use spnego = yes
   domain master = no
!g' /etc/samba/smb.conf
#tell nsswitch to use winbind too
perl -pi -e 's/compat/compat winbind/g' /etc/nsswitch.conf
perl -pi -e 's/dns/dns wins/g' /etc/nsswitch.conf
#setup pam
perl -pi -e's/account\trequired\tpam_unix.so/account\tsufficient\tpam_winbind.so\naccount\trequired\tpam_unix.so/g' /etc/pam.d/common-account
perl -pi -e's/auth\trequired\tpam_unix.so/auth\tsufficient\tpam_winbind.so\nauth\trequired\tpam_unix.so/g' /etc/pam.d/common-auth
perl -pi -e's/max=8/max=50/g' /etc/pam.d/common-password
perl -pi -e's!session\trequired\tpam_unix.so!session\trequired\tpam_unix.so\nsession\trequired\tpam_mkhomedir.so umask=0022 skel=/etc/skel!g' /etc/pam.d/common-session
# configure kerberos
dpkg-reconfigure krb5-config
# synchronize system clock so that times match
ntpdate $AD_DOMAIN
# do the join dont include the last bit if you dont have a sub ou to join
net ads join $MACHINE_OU -U$DOMAIN_ADMIN%$DOMAIN_PASS
# restart things
/etc/init.d/samba stop
/etc/init.d/winbind stop
/etc/init.d/samba start
/etc/init.d/winbind start