1 of 25

Debian Linux and Active Directory

2 of 25

How to use a Large Language Model to Learn Linux Adminstration

A Windows Admin Guide to Linux

Video Series Part 4

2

3 of 25

Preparing Debian Linux for Active Directory

3

Set the Linux host to sync time to a domain controller

1

Set the Linux host to use domain controllers for it’s DNS

2

Make sure Linux host has a FQDN that includes our AD

    • Ex: Debian.Homelab.TechsavvyProductions.com

3

4 of 25

Two tracks for connecting Linux Hosts to AD

4

5 of 25

Realm + SSSD�(System Security Services Daemon)

5

Best Practice

6 of 25

6

7 of 25

Winbind with Samba�an older but robust method

7

8 of 25

Key concepts to success

8

INSTALL THE SOFTWARE

AND METICULOUSLY ADD TEXT TO CONFIG FILES

9 of 25

Best practice: before editing any config file

  • Always make a habit of backing up a config file prior to editing

9

10 of 25

Keep copies of working config files for future reference

  • /etc/krb5.conf (Kerberos configuration)
    • sudo cp /etc/krb5.conf /etc/krb5.conf.bak
  • /etc/sssd/sssd.conf (SSSD configuration)
    • sudo cp /etc/sssd/sssd.conf /etc/sssd/sssd.conf.bak
  • /etc/hosts Ensure the file has an entry for the hostname and points to the correct IP address
    • sudo cp /etc/hosts /etc/hosts.bak
  • /etc/nsswitch.conf
    • sudo cp /etc/nsswitch.conf /etc/nsswitch.conf.bak

​

10

NSS (Name Service Switch)

11 of 25

Best Practice Centralized backup

  • mkdir -p ~/config-backups (create a central backup folder)
  • sudo cp /etc/krb5.conf ~/config-backups/
  • sudo cp /etc/sssd/sssd.conf ~/config-backups/
  • sudo cp /etc/hosts ~/config-backups/
  • sudo cp /etc/nsswitch.conf ~/config-backups/
  • sudo cp /etc/resolv.conf ~/config-backups/
  • sudo cp /etc/pam.d/common-session ~/config-backups/
  • sudo cp /etc/pam.d/common-session-noninteractive ~/config-backups/

11

12 of 25

Document changes

  • echo "Modified /etc/sssd/sssd.conf for domain.com" >> ~/config-backups/change-log.txt

​

12

13 of 25

Test Configuration Changes:

After editing and restarting services, validate the configuration to ensure no disruptions:

  • sudo systemctl restart sssd
  • sudo realm list
  • id domain_user

13

14 of 25

Debian Documentation

14

15 of 25

PAM is Used in Debian

  • Local Authentication:
  • Service Authentication:
  • Password Policies:
  • Access Control:
  • Session Management:
  • Multi-Factor Authentication (MFA):
  • Automatic Resource Management

​

15

PAM (Pluggable Authentication Modules)

16 of 25

PAM

  • The PAM (Pluggable Authentication Modules) system plays a critical role in the realm + SSSD method for integrating a Debian Linux host into Active Directory (AD).
  • PAM provides the framework for authentication, account management, session setup, and password management, allowing AD users to log in and use Linux hosts seamlessly.

16

17 of 25

17

Authentication Management

  • PAM works with SSSD to authenticate users against Active Directory.
  • When an AD user attempts to log in, PAM modules invoke SSSD to validate credentials using Kerberos and LDAP.
  • PAM ensures that only authenticated users are granted access to the system.

18 of 25

Key Benefits of PAM in Realm + SSSD Integration

  1. Flexibility:
    1. PAM allows modular authentication and session management, making it easy to extend or modify behavior without changing core system components.
  2. Seamless User Experience:
    • Users authenticated by AD can log in to the Linux host using their domain credentials with minimal latency.
  3. Consistency with AD Policies:
    • PAM respects AD password policies, account expiration, and group-based access control.
  4. Automatic Resource Management:
    • PAM ensures user-specific resources (like home directories) are created and initialized automatically.

​

18

19 of 25

19

20 of 25

Please consider becoming a channel member

  • you get an early viewing of all our video content
  • access to the complete series of videos for each subject
  • links to video notes and PowerPoint slide deck both in MS-Word and PDF format
  • Our eBook and resources folder
  • Join our channel membership, it’s $2.99/month); see the “Join” button on our channel homepage. https://www.youtube.com/channel/UCCAXBGYIJnScl0IFKXOIlsQ/join

20

21 of 25

Check out our Asian site: Gan Jing

  • https://gjw.us/mrvanderpool

​

21

22 of 25

Members-only videos

22

23 of 25

CONTACT US�mrvanderpool@techsavvyproductions.com��

SOCIAL MEDIA

​

​

23

24 of 25

We have subtitles for in many languages:

We translate subtitles on our videos into the many languages: عربى, българскиB, 简体中文）, 中國傳統的）, Nederlands, Suomalainen, Pilipino, français, Deutsche, हिंदी , Magyar, bahasa Indonesia, 日本語, 한국어, norsk, Polskie, português, Română, русский, Española, Kiswahili, Svenska, and Tiếng Việt

24

25 of 25

�A BIG THANK YOU TO ALL OF OUR MEMBERS, VIEWERS AND SUBSCRIBERS!�

25