Join Linux to a domain using PBIs

Join Linux to a domain using PBIs

Many enterprises have deployed the Active Directory of Microsoft, in order to facilitate management, you can join Linux domain. There are many ways to add Linux to a domain, and it feels more complicated and does not seem to really join the domain. Just finished creating the calculation account. Using the method I mentioned, I can also make Linux a layman to join the Windows Active Directory quickly and log into the system using a domain account. And you can add sudo permissions to different users or groups without having to tell them the root password.

The open edition of PowerBroker Identity Services can be downloaded here to

http://www.beyondtrust.com/

Http://download1.beyondtrust.com/Technical-Support/Downloads/PowerBroker-Identity-Services-Open-Edition/?Pass=True

Here I take CentOS as an example.
First put the download to the installation file on Linux, and then add the permissions to run. I'm used to putting it under the/usr/local directory.
chmod a+x pbis-open-8.2.1.2979.linux.x86_64.rpm.sh
650) this.width=650; "Src=" http://img.blog.csdn.net/20141210134355531?watermark/2/text/ ahr0cdovl2jsb2cuy3nkbi5uzxqvcwlzagluzq==/font/5a6l5l2t/fontsize/400/fill/i0jbqkfcma==/dissolve/70/gravity/ Center "/>
Then run the installation. Enter Y on the installation process several times.
./pbis-open-8.2.1.2979.linux.x86_64.rpm.sh
650) this.width=650; "Src=" http://img.blog.csdn.net/20141210134357676?watermark/2/text/ ahr0cdovl2jsb2cuy3nkbi5uzxqvcwlzagluzq==/font/5a6l5l2t/fontsize/400/fill/i0jbqkfcma==/dissolve/70/gravity/ Center "/>
Then use the command to join the computer to the domain. You will be prompted to enter the DomainAccount password during the process.
/OPT/PBIS/BIN/DOMAINJOIN-CLI Join contoso.com DomainAccount
650) this.width=650; "Src=" http://img.blog.csdn.net/20141210134402855?watermark/2/text/ ahr0cdovl2jsb2cuy3nkbi5uzxqvcwlzagluzq==/font/5a6l5l2t/fontsize/400/fill/i0jbqkfcma==/dissolve/70/gravity/ Center "/>
Change the default shell for a domain account
/opt/pbis/bin/config Loginshelltemplate/bin/bash
650) this.width=650; "Src=" http://img.blog.csdn.net/20141210134405991?watermark/2/text/ ahr0cdovl2jsb2cuy3nkbi5uzxqvcwlzagluzq==/font/5a6l5l2t/fontsize/400/fill/i0jbqkfcma==/dissolve/70/gravity/ Center "/>
Set the user domain prefix
/opt/pbis/bin/config Userdomainprefix contoso.com
650) this.width=650; "Src=" http://img.blog.csdn.net/20141210134409470?watermark/2/text/ ahr0cdovl2jsb2cuy3nkbi5uzxqvcwlzagluzq==/font/5a6l5l2t/fontsize/400/fill/i0jbqkfcma==/dissolve/70/gravity/ Center "/>
Set the default logon domain
/opt/pbis/bin/config Assumedefaultdomain True
650) this.width=650; "Src=" http://img.blog.csdn.net/20141210134416046?watermark/2/text/ ahr0cdovl2jsb2cuy3nkbi5uzxqvcwlzagluzq==/font/5a6l5l2t/fontsize/400/fill/i0jbqkfcma==/dissolve/70/gravity/ Center "/>
Set up users who can log in to this Linux. The user needs to be in this ad group. This requires 2 \ to separate the domain name from the group name.
/opt/pbis/bin/config requiremembershipof "Contoso\\linuxusers"
650) this.width=650; "Src=" http://img.blog.csdn.net/20141210134419454?watermark/2/text/ ahr0cdovl2jsb2cuy3nkbi5uzxqvcwlzagluzq==/font/5a6l5l2t/fontsize/400/fill/i0jbqkfcma==/dissolve/70/gravity/ Center "/>
View Configuration
/opt/pbis/bin/config--dump There are a lot of places that can be configured.
650) this.width=650; "Src=" http://img.blog.csdn.net/20141210134426515?watermark/2/text/ ahr0cdovl2jsb2cuy3nkbi5uzxqvcwlzagluzq==/font/5a6l5l2t/fontsize/400/fill/i0jbqkfcma==/dissolve/70/gravity/ Center "/>
Update DNS, autoenrollment a record
/opt/pbis/bin/update-dns
650) this.width=650; "Src=" http://img.blog.csdn.net/20141210134431234?watermark/2/text/ ahr0cdovl2jsb2cuy3nkbi5uzxqvcwlzagluzq==/font/5a6l5l2t/fontsize/400/fill/i0jbqkfcma==/dissolve/70/gravity/ Center "/>
Next you need to change the settings of sudo to configure which users can use sudo to perform actions that require permissions.
The following symbols in sudo need to be escaped with \: @! = : , ( ) \

Visudo
650) this.width=650; "Src=" http://img.blog.csdn.net/20141210134433634?watermark/2/text/ ahr0cdovl2jsb2cuy3nkbi5uzxqvcwlzagluzq==/font/5a6l5l2t/fontsize/400/fill/i0jbqkfcma==/dissolve/70/gravity/ Center "/>

Where% indicates that this is a group. NOPASSWD indicates that sudo does not have to enter the account password again. The domain name appears to be capitalized when you join the user (I've tried it many times).
If the user is a bit, such as User.Name can write directly. If there is a space in the middle of the group name can be replaced by ^. But there are some articles that need to be escaped with a \ space, \ \ or \^, probably with different Linux.

Restart, you can log in with a domain account.
The login can be contoso\username or direct username. Because the default domain name is already specified earlier.

This article from "Qiyuwei" blog, reproduced please contact the author!

Join Linux to a domain using PBIs