Table of Contents

CentOS 7 AD Client

Install nslcd and kerberos

yum install -y pam_krb5 krb5-workstation
yum install -y nscd nss-pam-ldapd wget

Enalble nslcd service

systemctl enable nslcd

Configure nslcd

authconfig-tui

select “Use LDAP” and “Use LDAP Authentication” select “Use TLS” 

Server: ldaps://ad1.acm.cs
Base DN: dc=acm,dc=cs

Update nslcd config

/etc/nslcd.conf

uri ldaps://ad1.acm.cs
uri ldaps://ad2.acm.cs
uri ldaps://ad3.acm.cs

ldap_version 3

base dc=acm,dc=cs

binddn apacheacm@acm.cs
bindpw (ask sysadmin)

base   group  ou=ACMGroups,dc=acm,dc=cs
base   passwd ou=ACMUsers,dc=acm,dc=cs
base   shadow ou=ACMUsers,dc=acm,dc=cs

bind_timelimit 3

timelimit 30

ssl on
#ssl start_tls
tls_reqcert never

# Mappings for Active Directory
pagesize 1000
referrals off
idle_timelimit 800
filter passwd (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
map    passwd uid              sAMAccountName
map    passwd homeDirectory    unixHomeDirectory
map    passwd gecos            displayName
filter shadow (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
map    shadow uid              sAMAccountName
map    shadow shadowLastChange pwdLastSet
filter group  (objectClass=group)
nslcd.conf should not be world readable if bindpw is set 

chmod 600 /etc/nslcd.conf

More LDAP Config

make sure that passwd, group and shadow have files and then ldap

/etc/nsswitch.conf

passwd:         files ldap 
group:          files ldap 
shadow:         files ldap

Start nslcd Service

systemctl start nslcd

Testing the configuration

getent passwd

you should see the users form AD 

su - usernameInAd

this should work 

[root@centosimg acmadmin]# su - bmiddha
su: warning: cannot change directory to /home/bmiddha: No such file or directory
-bash-4.2$

Password auth with kerberos

/etc/krb5.conf

[libdefaults]
        default_realm = ACM.CS
        dns_lookup_realm = false
        dns_lookup_kdc = true

[realms]

[domain_realm]
        acm.cs = ACM.CS
        .acm.cs = ACM.CS

[logging]
#       kdc = CONSOLE

Now you should be able to ssh with password

Sudo access to LAN Admins

Create this file

/etc/sudoers.d/AcmLanAdmins

%AcmLanAdmins ALL=(ALL) ALL

Auto create home directories

Run this 

authconfig --enablemkhomedir --updateall

Append File

/etc/pam.d/sshd

.
.
# Create home directories
session         required        pam_mkhomedir.so skel=/etc/skel/

All Done!