Intégration d’un système GNU/Linux Debian dans un domaine Active Directory

Synchronisation d’horloges

Installation du paquet :

# aptitude install ntp

Configuration du NTP :

# vim /etc/ntp.conf
# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help

driftfile /var/lib/ntp/ntp.drift

# Enable this if you want statistics to be logged.
#statsdir /var/log/ntpstats/

statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable

# You do need to talk to an NTP server or two (or three).
#server ntp.your-provider.example

# maps to about 1000 low-stratum NTP servers.  Your server will
# pick a different set every time it starts up.  Please consider joining the
# pool: <>
server ntp.home.local
#server iburst
#server iburst
#server iburst
#server iburst

# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
# details.  The web page <>
# might also be helpful.
# Note that "restrict" applies to both servers and clients, so a configuration
# that might be intended to block requests from certain clients could also end
# up blocking replies from your own upstream servers.

# By default, exchange time with everybody, but don't allow configuration.
restrict -4 default kod notrap nomodify nopeer noquery
restrict -6 default kod notrap nomodify nopeer noquery

# Local users may interrogate the ntp server more closely.
restrict ::1

# Clients from this (example!) subnet have unlimited access, but only if
# cryptographically authenticated.
#restrict mask notrust

# If you want to provide time to your local subnet, change the next line.
# (Again, the address is an example only.)

# If you want to listen to time broadcasts on your local subnet, de-comment the
# next lines.  Please do this only if you trust everybody on the network!
#disable auth

Prise en compte de la configuration :

# /etc/init.d/ntp restart

Vérification de la synchronisation NTP :

# ntpq -p

Résolution de noms

Configuration des paramètres de résolution de noms :

# vim /etc/resolv.conf
domain home.local
search home.local

Samba / Winbind

Installation des paquets :

# aptitude install winbind samba-common smbclient

Sauvegarde de la configuration d’origine :

# cp /etc/samba/smb.conf /etc/samba/smb.conf.original

Configuration de Samba/Winbind :

# > /etc/samba/smb.conf
# vim /etc/samba/smb.conf
    workgroup = HOME
    realm = HOME.LOCAL
    server string = %h server
    security = ADS
    password server =,,
    client use spnego = yes
    client ntlmv2 auth = yes
    encrypt passwords = yes
    syslog = 0
    log file = /var/log/samba/log.%m
    max log size = 1000
    announce version = 4
    announce as = NT Workstation
    dns proxy = No
    idmap uid = 167771-335549
    idmap gid = 167771-335549
    winbind use default domain = yes
    invalid users = root
    winbind cache time = 60
    winbind enum users = yes
    winbind enum groups = yes
    winbind cache time = 10
    template homedir = /home/%D/%U
    template shell = /bin/bash
    restrict anonymous = 2
    domain master = no
    local master = no
    preferred master = no
    os level = 0

Création du répertoire racine pour les répertoires personnels des utilisateurs du domaine :

# mkdir /home/HOME

Prise en compte de la configuration :

# /etc/init.d/winbind restart


Installation des paquets :

# aptitude install krb5-user krb5-config

Sauvegarde de la configuration d’origine :

# cp /etc/krb5.conf /etc/krb5.conf.original

Configuration de Kerberos :

# > /etc/krb5.conf
# vim /etc/krb5.conf
        default_realm = HOME.LOCAL
        dns_lookup_realm = false
        dns_lookup_kdc = false
# The following krb5.conf variables are only for MIT Kerberos.
        krb4_config = /etc/krb.conf
        krb4_realms = /etc/krb.realms
        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true

# The following encryption type specification will be used by MIT Kerberos
# if uncommented.  In general, the defaults in the MIT Kerberos code are
# correct and overriding these specifications only serves to disable new
# encryption types as they are added, creating interoperability problems.
# Thie only time when you might need to uncomment these lines and change
# the enctypes is if you have local software that will break on ticket
# caches containing ticket encryption types it doesn't know about (such as
# old versions of Sun Java).

#       default_tgs_enctypes = des3-hmac-sha1
#       default_tkt_enctypes = des3-hmac-sha1
#       permitted_enctypes = des3-hmac-sha1

# The following libdefaults parameters are only for Heimdal Kerberos.
#       v4_instance_resolve = false
#       v4_name_convert = {
#               host = {
#                       rcmd = host
#                       ftp = ftp
#               }
#               plain = {
#                       something = something-else
#               }
#       }
#       fcc-mit-ticketflags = true


HOME.LOCAL = { kdc = kdc = kdc = admin_server = }


.home.local = HOME.LOCAL home.local = HOME.LOCAL


krb4_convert = true krb4_get_tickets = false


default = FILE:/var/log/krb5.log kdc = FILE:/var/log/krb5kdc.log admin-server = FILE:/var/log/krb5adm.log


pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false }

Rejoindre le domaine et s’authentifier

Jointure au domaine :

# net -U administrator ads join

(Test) Lister les utilisateurs du domaine :

# wbinfo -u

Modification des paramètres d’authentification :

# vim /etc/nsswitch.conf
# /etc/nsswitch.conf
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat winbind
group:          compat winbind
shadow:         compat winbind

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

Permettre la création du répertoire personnel d’un utilisateur du domaine :

# vim /etc/pam.d/common-session
# /etc/pam.d/common-session - session-related modules common to all services
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
session [default=1]           
# here's the fallback if no module succeeds
session requisite             
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required              
# and here are more per-package modules (the "Additional" block)
session required              
session required               umask=0022 skel=/etc/skel
session optional              
# end of pam-auth-update config

(Test) Lister la base des utilisateurs pouvant s’authentifier :

# getent passwd

N’autorisez que les membres du groupe “GNETWORK” à accéder en SSH au serveur :

# vim /etc/pam.d/sshd
# PAM configuration for the Secure Shell service

# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
auth       required # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
auth       required envfile=/etc/default/locale

# Standard Un*x authentication.
@include common-auth

# Disallow non-root logins when /etc/nologin exists.
account    required

# Only allow GNETWORK Active Directory group  members
account    required user ingroup GNETWORK

# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account  required

# Standard Un*x authorization.
@include common-account

# Standard Un*x session setup and teardown.
@include common-session

# Print the message of the day upon successful login.
session    optional # [1]

# Print the status of the user's mailbox upon successful login.
session    optional standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.
session    required

# Set up SELinux capabilities (need modified pam)
# session  required multiple

# Standard Un*x password updating.
@include common-password

Droits sudo pour le groupe “GNETWORK” :

# vim /etc/sudoers
# /etc/sudoers
# This file MUST be edited with the 'visudo' command as root.
# See the man page for details on how to write a sudoers file.

Defaults        env_reset

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL) ALL

# Allow members of group sudo to execute any command
# (Note that later entries override this, so you might need to move
# it further down)
%sudo ALL=(ALL) ALL
#includedir /etc/sudoers.d

Leave a comment

Your email address will not be published. Required fields are marked *