# yum install realmd krb5-workstation sssd sssd-ad authconfig openldap-clients oddjob-mkhomedir ntp adcli
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
default_realm = DOMAIN.HU
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
DOMAINEM.HU = {
kdc = ad.domainem.hu
admin_server = ad.domainem.hu
}
[domain_realm]
.ad.domainem.hu = AD.DOMAINEM.HU
ad.domainem.hu = AD.DOMAINEM.HU
# kinit pagoston # realm join -U pagoston -v pcs.hu
[sssd] domains = domainem.hu config_file_version = 2 services = nss, pam [domain/pcs.hu] ad_domain = domainem.hu krb5_realm = DOMAINEM.HU realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True #use_fully_qualified_names = True fallback_homedir = /home/%u@%d access_provider = ad
# authconfig --enablesssdauth --enablesssd --enablemkhomedir --update # systemctl restart sssd
Kivétel a domain alól:
# realm leave ad.example.com
Ellenőrzés:
net ads testjoin
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/windows_integration_guide/sssd-ad https://outsideit.net/realmd-sssd-ad-authentication/