Ubuntu Login via LDAP integrated AD account

Ubuntu Login via LDAP integrated AD account

Install LIBNSS-LDAPD (automatically installs NSCD, NSLCD), LIBPAM-LDAPD

# Apt-get Install LIBNSS-LDAPD LIBPAM-LDAPD (middle with LDAP section can be directly enter or write casually, the back of the nslcd.conf file can be)

# vi/etc/nsswitch.conf

Passwd:files LDAP

Group:files LDAP

Shadow:files LDAP

: Wq

# vi/etc/nslcd.conf

URI ldap://10.0.1.4:3268

Base dc=ming,dc=com

Binddn cn=adminldap,cn=users,dc=ming,dc=com (Adminldap is AD account, general permissions can be)

BINDPW ****** (Adminldap's password)

Filter passwd (& (Objectclass=user) (Objectclass=person) (! ( Objectclass=computer)))

Map passwd UID CN

Map passwd Uidnumber objectsid:s-1-5-21-3623811015-3361044348-30300820

Map passwd Gidnumber objectsid:s-1-5-21-3623811015-3361044348-30300820

Map passwd homedirectory "/home/$cn"

Map passwd Gecos DisplayName

Map passwd Loginshell "/bin/bash"

Filter Shadow (Objectclass=person)

Map Shadow UID sAMAccountName

Filter Group (| ( Objectclass=group) (Objectclass=person))

Map Group Gidnumber objectsid:s-1-5-21-3623811015-3361044348-30300820

: Wq

Automatically create user home directory after authentication:

# vi/etc/pam.d/common-session

Session Required Pam_mkhomedir.so Skel=/etc/skel umask=0022

: Wq

# Service NSCD Restart

# Service NSLCD Restart

# getent Passwd\shadow\group (see if AD information can be displayed, can be considered normal)

NSLCD Debug Mode (reading the newspaper is wrong, under normal circumstances can be restart)

# Service NSLCD Stop

# nslcd-d

Confirm AD Account Login:

# Su-aa.yang

# SSH [email protected] (that is, by remote SSH, directly write the name, without the domain name)

Give sudo permission (/etc/sudoers)

Whether to create a home directory automatically after the new account login

Bugs that are currently found:

1. The UID of the ad account displayed is inconsistent with the GID and the true UID in the ad.

2, can not pass the ad group to give Sudo permission (gid inconsistent)

This article is from the "Linux" blog, so be sure to keep this source http://yangzhiming.blog.51cto.com/4849999/1907710

Ubuntu Login via LDAP integrated AD account