{"id":133,"date":"2024-08-26T22:50:21","date_gmt":"2024-08-27T01:50:21","guid":{"rendered":"https:\/\/administracaoderedes.com.br\/?p=133"},"modified":"2024-10-09T21:28:12","modified_gmt":"2024-10-10T00:28:12","slug":"linux-autenticando-no-active-directory-da-microsoft","status":"publish","type":"post","link":"https:\/\/administracaoderedes.com.br\/index.php\/2024\/08\/26\/linux-autenticando-no-active-directory-da-microsoft\/","title":{"rendered":"Linux autenticando no Active Directory da Microsoft (atualizado)"},"content":{"rendered":"\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">N\u00e3o existem d\u00favidas que o Active Directory da Microsoft \u00e9 de longe o melhor servi\u00e7o de diret\u00f3rio do mercado, e que a gest\u00e3o e autentica\u00e7\u00e3o de usu\u00e1rios \u00e9 muito boa, ent\u00e3o, por que n\u00e3o fazer desktops com Linux autenticarem no Active Directory?<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Vamos entender algumas coisas.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Para o Active Directory funcionar corretamente, mesmo em desktops com Windows , \u00e9 necess\u00e1rio que :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>O DNS da rede, seja o Active Directory;<\/li>\n\n\n\n<li>A data e hora das esta\u00e7\u00f5es n\u00e3o podem ter uma diferen\u00e7a maior que 5 minutos;<\/li>\n\n\n\n<li>O hostname das m\u00e1quinas devem ter no m\u00e1ximo 15 Caracteres;<\/li>\n\n\n\n<li>O hostname n\u00e3o pode ser apenas n\u00fameros;<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Recomendamos a leitura das conven\u00e7\u00f5es de forma\u00e7\u00e3o de nome de m\u00e1quinas da Microsoft para o Active Directory em <a href=\"https:\/\/learn.microsoft.com\/pt-br\/troubleshoot\/windows-server\/active-directory\/naming-conventions-for-computer-domain-site-ou\">https:\/\/learn.microsoft.com\/pt-br\/troubleshoot\/windows-server\/active-directory\/naming-conventions-for-computer-domain-site-ou<\/a><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Premissas<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Para melhor entendimento vamos usar as seguintes informa\u00e7\u00f5es :<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rede : 192.168.100.0\/24<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Gateway : 192.168.100.1\/24<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DNS : 192.168.100.10\/24 (Nosso AD)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dom\u00ednio : koruma.lan<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Hostname do Servidor de AD :srv-ad<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Hostname do Desktop :dsk-lnx001<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DistroLinux : xubuntu 24.04<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>M\u00e3os a obra.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A primeiro coisa a ser feita setar o hostname de nossa esta\u00e7\u00e3o usando o dom\u00ednio, para isso usamos o <strong>hostnamectl<\/strong>, veja abaixo<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#<strong>hostnamectl<\/strong>\nStatic hostname: dsk-lnx001.koruma.lan\n       Icon name: computer-vm\n         Chassis: vm \ud83d\uddb4\n      Machine ID: 6c52285e24e049b6ab22d219aa1159dd\n         Boot ID: 9ea803d3207d404a8b813e470f50ca0f\n  Virtualization: kvm\nOperating System: Ubuntu 24.04.1 LTS              \n          Kernel: Linux 6.8.0-45-generic\n    Architecture: x86-64\n Hardware Vendor: QEMU\n  Hardware Model: Standard PC _Q35 + ICH9, 2009_\nFirmware Version: 1.16.3-debian-1.16.3-2\n   Firmware Date: Tue 2014-04-01\n    Firmware Age: 10y 6month 1w 2d  \n\n#<strong>hostnamectl set-hostname <\/strong>dsk-lnx001.koruma.lan\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A segunda coisa a ser feita \u00e9 ter certeza que a esta\u00e7\u00e3o linux est\u00e1 usando como DNS o servidor do AD. Ai vem uma parte realmente chata, cada distribui\u00e7\u00e3o usa uma forma diferente para mudar o DNS , o Xubuntu usa o Networkmanager, que possui um ferramenta muito boa em linha de comando o poderoso &#8220;<strong>nmcli<\/strong>&#8220;.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">usando o <strong>resolvctl<\/strong>, podemos listar nossos servidores de DNS<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$<strong>resolvectl<\/strong>\nGlobal\n         Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=no\/unsupported\n  resolv.conf mode: stub\n\nLink 2 (enp1s0)\n    Current Scopes: DNS\n         Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no\/unsupported\nCurrent DNS Server: 192.168.100.10\n       DNS Servers: 192.168.100.10 8.8.8.8 192.168.100.1\n        DNS Domain: 192.168.100.10\n<\/code><\/pre>\n\n\n\n<div class=\"wp-block-ive-separator aligncenter undefined ive-separator-_e59547-9d\"><div class=\"ive-separator ive-separator-halign-center\"><hr class=\"ive-separator-hr float-xl-center float-lg-center float-sm-center float-center\"\/><\/div><\/div>\n\n\n\n<div class=\"wp-block-ive-separator aligncenter undefined ive-separator-_8459d0-5c\"><div class=\"ive-separator ive-separator-halign-center\"><hr class=\"ive-separator-hr float-xl-center float-lg-center float-sm-center float-center\"\/><\/div><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">no meu caso, usando Qemu, a minha rede de laborat\u00f3rio n\u00e3o seta o DNS no dhcp, para o servidor Microsoft Active Directory, ent\u00e3o tive de fazer alguns acertos usando o <strong>nmcli<\/strong>.<\/p>\n\n\n\n<div class=\"wp-block-ive-separator aligncenter undefined ive-separator-_e075dc-1c\"><div class=\"ive-separator ive-separator-halign-center\"><hr class=\"ive-separator-hr float-xl-center float-lg-center float-sm-center float-center\"\/><\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Mostrando as conex\u00f5es <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#nmcli connection show\nNAME            UUID                                  TYPE      DEVICE \nnetplan-enp1s0  cac41fbe-bc18-3d87-bba7-af2af7f8ffab  ethernet  enp1s0 \nlo              7817e127-f0d3-4230-b2c0-a723b7a24c37  loopback  lo  <\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Colocando o DNS que eu desejo<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#nmcli connection modify netplan-enp1s0 ipv4.dns \"192.168.100.10,192.168.100.1,8.8.8.8\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Desabilitando o DNS via DHCP <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#nmcli connection modify netplan-enp1s0 ipv4.ignore-auto-dns yes<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Fazendo as configura\u00e7\u00f5es funcionarem<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"> <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nmcli connection down netplan-enp1s0\nnmcli connection up netplan-enp1s0<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Para saber se estamos nos comunicando com o DNS do AD em um terminal execute<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># ping srv-ad.koruma.lan -c 4\nPING srv-ad.koruma.lan (192.168.100.10) 56(84) bytes of data.\n64 bytes from 192.168.100.10: icmp_seq=1 ttl=128 time=1.02 ms\n64 bytes from 192.168.100.10: icmp_seq=2 ttl=128 time=0.384 ms\n64 bytes from 192.168.100.10: icmp_seq=3 ttl=128 time=1.09 ms\n64 bytes from 192.168.100.10: icmp_seq=4 ttl=128 time=1.05 ms\n\n--- srv-ad.koruma.lan ping statistics ---\n4 packets transmitted, 4 received, 0% packet loss, time 3015ms\nrtt min\/avg\/max\/mdev = 0.384\/0.883\/1.085\/0.289 ms\nroot@ubx-03-homo:\/home\/ubx-03-homo# \n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Lembre-se de substituir o dom\u00ednio pelo seu. No exemplo acima, o DNS do Active Directory est\u00e1 respondendo prontamente.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Vamos instalar uns pacotes .<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Para funcionar a autentica\u00e7\u00e3o no Active Directory teremos de instalar alguns pacotes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>NTP<\/li>\n\n\n\n<li>NTPSEC-UPDATE<\/li>\n\n\n\n<li>SAMBA<\/li>\n\n\n\n<li>SAMBA-COMMON<\/li>\n\n\n\n<li>KRB5-USER<\/li>\n\n\n\n<li>SSSD<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Mas antes de instalar nossos pacotes, devemos atualizar nossas listas de pacotes e fazer um upgrade do nosso desktop<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo apt update ; sudo apt upgrade -y<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Atualizado com sucesso vamos instalar os pacotes<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install ntp ntpsec-update samba samba-common krb5-user sssd<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Durante a instala\u00e7\u00e3o o krb5-user vai fazer uma pergunta, deixe em branco e v\u00e1 para ok, iremos configurar o Kerberos em breve.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Hosts pra que te quero!<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Vamos editar o nosso arquivo <em>hosts<\/em> para facilitar a nossa vida.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><em>\u00c9 uma boa pr\u00e1tica, antes de editar qualquer arquivo de configura\u00e7\u00e3o, fazer uma c\u00f3pia deste, identificando como o original.<\/em><\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nosso arquivo hosts fica normalmente no \/etc<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$nano \/etc\/hosts\n\n127.0.0.1       localhost\n<strong># Editar esta linha colocando o hostname e dom\u00ednio\n127.0.1.1       dsk-lnx001.koruma.lan dsk-lnx001 <\/strong> \n\n# The following lines are desirable for IPv6 capable hosts\n::1     ip6-localhost ip6-loopback\nfe00::0 ip6-localnet\nff00::0 ip6-mcastprefix\nff02::1 ip6-allnodes\nff02::2 ip6-allrouters\n\n<strong># adicionar o endere\u00e7o do servidor de AD apenas se ele n\u00e3o estiver resolvendo via DNS <\/strong>\n#<strong>192.168.100.10 koruma.lan\n#192.168.100.10 srv-ad.koruma.lan srv-ad<\/strong><\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Hora sempre certa<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Vamos configurar nosso servi\u00e7o de NTP, para sempre sincronizar com o servidor de AD, editando o arquivo \/etc\/ntpsec\/ntp.conf, este local pode variar em algumas distribui\u00e7\u00f5es.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Use Ubuntu's ntp server as a fallback.\n#server ntp.ubuntu.com\n#use o ip do servidor, para n\u00e3o dar nenhum problema\n<strong>server 192.168.100.10<\/strong><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sincronizando com o AD<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#<strong>ntpdate -q<\/strong> 192.168.100.10\n2024-10-09 21:05:21.536230 (-0300) +0.338393 +\/- 0.001094 192.168.100.10 s1 no-leap\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Dan\u00e7ando com o Samba<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Certo, instalamos o samba e o common, agora vamos desabilitar os servi\u00e7os e criar um novo smb.conf<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-cyan-bluish-gray-color\">&lt;&lt;Pare o servi\u00e7o&gt;&gt;<\/mark>\n#<strong>systemctl stop nmbd<\/strong>\n\n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-cyan-bluish-gray-color\">&lt;&lt; Desabilite os servi\u00e7os &gt;&gt;<\/mark>\n#<strong>systemctl disable  nmbd samba samba-ad-dc<\/strong>\n\n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-cyan-bluish-gray-color\">&lt;&lt;C\u00f3pia de seguran\u00e7a do original&gt;&gt;<\/mark>\n#<strong>cp \/etc\/samba\/smb.conf \/etc\/samba\/smb.conf.original<\/strong>\n\n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-cyan-bluish-gray-color\">&lt;&lt;Editar o smb.conf&gt;&gt;<\/mark>\n# <strong>nano \/etc\/samba\/smb.conf <\/strong>\n\n<em># conte\u00fado do smb.conf\n&#91;global]\n  workgroup=<strong>KORUMA<\/strong>\n  client signing = auto\n  client use spnego = yes\n  realm=<strong>KORUMA.LAN<\/strong>\n  security=ads\n  kerberos method = secrets and keytab\n  log file = \/var\/log\/samba\/smbd.log\n  log level = 10\n  max log size = 500\n  load printers = no\n  printing = bsd\n  printcap name = \/dev\/null\n  disable spoolss = yes\n  idmap config * : backend = tdb\n  idmap config * : range = 3000-7999\n  idmap config <strong>KORUMA<\/strong>:backend = ad\n  idmap config <strong>KORUMA<\/strong>:schema_mode = rfc2307\n  idmap config <strong>KORUMA<\/strong>:range = 10000-50000\n  idmap config <strong>KORUMA<\/strong>:unix_nss_info = yes<\/em>\n\n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-cyan-bluish-gray-color\">&lt;&lt; teste o arquivo smb.conf&gt;&gt;<\/mark>\n#<strong>testparm <\/strong>\n \n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-cyan-bluish-gray-color\">&lt;&lt; Reinicie o servi\u00e7os do smbd<\/mark>\n#<strong>systemctl restart smbd<\/strong>\n\n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-cyan-bluish-gray-color\">&lt;&lt;habilite o servi\u00e7o &gt;&gt;<\/mark>\n#<strong>systemctl enable smbd<\/strong>\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Kerberos n\u00e3o me morda<\/strong>!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Vamos editar o arquivo \/etc\/krb5.conf e colocar o seguinte conte\u00fado:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;libdefaults]\n        default_realm = <strong>KORUMA.LAN<\/strong>\n\n# The following krb5.conf variables are only for MIT Kerberos.\n        kdc_timesync = 1\n        ccache_type = 4\n        forwardable = true\n        proxiable = true\n        rdns = false\n\n        dns_lookup_realm = false\n        dns_lookup_kdc = false\n        renew_lifetime = 7d\n\n# The following libdefaults parameters are only for Heimdal Kerberos.\n        fcc-mit-ticketflags = true\n\n&#91;realms]\n        KORUMA.LAN = {\n                kdc =<strong> koruma.lan<\/strong>\n                admin_server = <strong>srv-ad.koruma.lan<\/strong>\n                default_domain = <strong>koruma.lan<\/strong>\n        }\n\n&#91;domain_realm]\n        .koruma.lan = <strong>KORUMA.LAN<\/strong>\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Teste se o kerberos est\u00e1 ok.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#<strong>kinit<\/strong> administrador\nPassword for administrador@KORUMA.LAN: \n\n#<strong>klist<\/strong>\nTicket cache: FILE:\/tmp\/krb5cc_0\nDefault principal: administrador@KORUMA.LAN\n\nValid starting     Expires            Service principal\n10\/09\/24 21:07:30  10\/10\/24 07:07:30  krbtgt\/KORUMA.LAN@KORUMA.LAN\n\trenew until 10\/16\/24 21:07:23\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>SSSD<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Neste passo precisamos criar ou editar o arquivo sssd.conf, que normalmente ficar localizado em \/etc\/sssd\/sssd.conf\/sssd.conf, ele deve ter o seguinte conte\u00fado:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;sssd]\nconfig_file_version = 2\nservices = nss, pam\ndomains = <strong>KORUMA.LAN<\/strong>\n&#91;domain\/<strong>KORUMA.LAN<\/strong>]\nid_provider = ad\naccess_provider = ad\nsudo_provider = none\nldap_id_mapping = true\nfallback_homedir = \/home\/%d\/%u\ndefault_shell = \/bin\/bash\nskel_dir = \/etc\/skel\n\n# When running in an unprivileged Linux container these settings\n# should be uncommented.\n#ldap_idmap_range_min = 10000\n#ldap_idmap_range_max = 50000\n#ldap_idmap_range_size = 1000<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">uma vez criado devemos dar a seguinte permiss\u00e3o para ele : <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#chmod 0600 \/etc\/sssd\/sssd.conf\/sssd.conf<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Agora voc\u00ea precisar\u00e1 verificar \/etc\/nsswitch.conf para garantir que as pesquisas corretas estejam sendo referenciadas ao sssd:<br><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>In\u00edcio da Linha  <\/strong><\/td><td><strong>Deve ter sss? <\/strong><\/td><td><strong> Exemplo<\/strong><\/td><\/tr><tr><td>passwd:<\/td><td>Sim<\/td><td>passwd: compat sss<\/td><\/tr><tr><td>group: <\/td><td>Sim<\/td><td>group: compat sss<\/td><\/tr><tr><td>netgroup:   <\/td><td>Sim<\/td><td>netgroup: nis sss<\/td><\/tr><tr><td>sudoers:<\/td><td>N\u00e3o<\/td><td> sudoers: files<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Observe que se a linha sudoers cont\u00e9m sss na instala\u00e7\u00e3o do sssd; voc\u00ea deve remov\u00ea-la para evitar o envio de e-mails de seguran\u00e7a falsos.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PAM<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Vamos criar um novo config no PAM.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#nano \/usr\/share\/pam-configs\/my-ad\n\n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-cyan-bluish-gray-color\">&lt;&lt;conte\u00fado do arquivo &gt;&gt;<\/mark>\n<em>Name: Guestline AD user home management\nDefault: yes\nPriority: 127\n\nSession-Type: Additional\nSession-Interactive-Only: yes\nSession:\n        required pam_mkhomedir.so skel=\/etc\/skel\/ umask=0022<\/em>\n\n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-cyan-bluish-gray-color\">&lt;&lt;Ap\u00f3s salvar, execute o comando abaixo para usar as configura\u00e7\u00f5es &gt;&gt;<\/mark>\n#\/usr\/sbin\/pam-auth-update --package<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Acabou?! Quase&#8230;<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Segue um script para adicionar o desktop ao AD. feito isso \u00e9 s\u00f3 autenticar no logon usando  <strong>usuario@dominio<\/strong>, a senha \u00e9 a do Active Directory.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Join-ad.sh<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Script to handle the process of joining the domain.\n# Run with username where:\n# username is the SAM name for the domain admins account - e.g. brownm for martin.brown\n#\n# The script produces lots of output to help with debugging any issues. See\n# https:\/\/www.redhat.com\/en\/files\/resources\/en-rhel-intergrating-rhel-6-active-directory.pdf\n# for a full description of the process (albeit RedHat rather than Debian).\n#\n# Note that it is very important that the hostname of the machine is set up correctly!\n\nif &#91; \"$#\" != 1 ]\nthen\n  echo \"Usage: join-ad.sh username\"\n  exit 1\nfi\n\nusername=$1\ndomain=$(hostname --domain)\necho \"Using account ${username} to join domain ${domain}...\"\necho \"\"\n\n# Quit on error\nset -e\n\n# Uncomment to debug\n#set -x\n\n# Upper-case version of the domain name\nupper_domain=$(echo ${domain} | tr &#91;a-z] &#91;A-Z])\n\n# Find the short hostname and get an upper-case version of it\nshort_hostname=$(hostname --short)\nupper_short_hostname=$(echo ${short_hostname} | tr &#91;a-z] &#91;A-Z])\n\n# Log into the domain as the administrator, asking user for password\n# The domain part must be in upper-case\necho \"Logging into domain as the administrator\"\n\/usr\/bin\/kinit \"${username}@${upper_domain}\"\necho \"\"\n\n# List what kerberos sent back\necho \"Listing kerberos tickets for the domain administrator:\"\necho \"------------------------------------------------------------------------\"\nklist\necho \"\"\n\n# Join AD and put the machine credentials in the krb5.keytab\necho \"Requesting domain join using administrator kerberos ticket\"\nnet ads join -k\n\n# List the machine credentials\necho \"Listing kerberos tickets for the machine:\"\necho \"------------------------------------------------------------------------\"\nklist -k\necho \"\"\n\n# Wait for 5s to allow everything to catch up - sometimes 5s isn't enough\necho \"Waiting for everything to catch up...\"\nsleep 5\necho \"\"\n\n# Sign in using the machine credentials\necho \"Signing in using machine credentials ${upper_short_hostname}$\"\nkinit -k ${upper_short_hostname}$\necho \"\"\n\n# Did it work?\njoinedAd=$?\n\nif &#91; $joinedAd -ne 0 ]\nthen\n    echo \"Error: could not join the domain with machine credentials ${upper_short_hostname}$\"\n    exit 1\nelse\n    echo \"Joined the domain using machine credentials ${upper_short_hostname}$\"\n    echo \"\"\n    echo \"Listing kerberos machine ticket:\"\n    echo \"------------------------------------------------------------------------\"\n    klist\n    echo \"\"\n\n    # Now restart SSSD and everything should be happy :-)\n    echo \"Enabling and restarting sssd\"\n    systemctl enable sssd\n    systemctl restart sssd\n    if &#91; $? -ne 0 ]\n    then\n      echo \"Error: could not start the System Security Services Daemon (SSSD)\"\n      exit 1\n    else\n      echo \"System Security Services Daemon (SSSD) restarted and enabled.\"\n      echo \"AD should now be working!\"\n    fi\nfi\n\nexit 0<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Em breve<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Vamos mostrar como criar grupos de usu\u00e1rios do AD que podem executar o Sudo. At\u00e9 Breve!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<div class=\"wp-block-group is-vertical is-layout-flex wp-container-core-group-is-layout-4fc3f8e1 wp-block-group-is-layout-flex\">\n<p class=\"wp-block-paragraph\">fonte prim\u00e1ria: <a href=\"https:\/\/wiki.debian.org\/AuthenticatingLinuxWithActiveDirectorySssd\">https:\/\/wiki.debian.org\/AuthenticatingLinuxWithActiveDirectorySssd<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Homologado no : xubuntu com Microsoft Server 2022.<br><\/p>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>N\u00e3o existem d\u00favidas que o Active Directory da Microsoft \u00e9 de longe o melhor servi\u00e7o de diret\u00f3rio do mercado, e que a gest\u00e3o e autentica\u00e7\u00e3o de usu\u00e1rios \u00e9 muito boa, ent\u00e3o, por que n\u00e3o fazer desktops com Linux autenticarem no Active Directory? Vamos entender algumas coisas. Para o Active Directory funcionar corretamente, mesmo em desktops [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":136,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_regular_price":[],"currency_symbol":[],"pagelayer_contact_templates":[],"_pagelayer_content":"","footnotes":"[]"},"categories":[12],"tags":[36,40,37,39,41],"class_list":["post-133","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tecnico","tag-active-directory","tag-kerberos","tag-microsoft","tag-samba","tag-sssd"],"post_slider_layout_featured_media_urls":{"thumbnail":["https:\/\/administracaoderedes.com.br\/wp-content\/uploads\/2024\/08\/logon-ad-150x150.png",150,150,true],"post_slider_layout_landscape_large":["https:\/\/administracaoderedes.com.br\/wp-content\/uploads\/2024\/08\/logon-ad.png",423,325,false],"post_slider_layout_portrait_large":["https:\/\/administracaoderedes.com.br\/wp-content\/uploads\/2024\/08\/logon-ad.png",423,325,false],"post_slider_layout_square_large":["https:\/\/administracaoderedes.com.br\/wp-content\/uploads\/2024\/08\/logon-ad.png",423,325,false],"post_slider_layout_landscape":["https:\/\/administracaoderedes.com.br\/wp-content\/uploads\/2024\/08\/logon-ad.png",423,325,false],"post_slider_layout_portrait":["https:\/\/administracaoderedes.com.br\/wp-content\/uploads\/2024\/08\/logon-ad.png",423,325,false],"post_slider_layout_square":["https:\/\/administracaoderedes.com.br\/wp-content\/uploads\/2024\/08\/logon-ad.png",423,325,false],"full":["https:\/\/administracaoderedes.com.br\/wp-content\/uploads\/2024\/08\/logon-ad.png",423,325,false]},"_links":{"self":[{"href":"https:\/\/administracaoderedes.com.br\/index.php\/wp-json\/wp\/v2\/posts\/133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/administracaoderedes.com.br\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/administracaoderedes.com.br\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/administracaoderedes.com.br\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/administracaoderedes.com.br\/index.php\/wp-json\/wp\/v2\/comments?post=133"}],"version-history":[{"count":6,"href":"https:\/\/administracaoderedes.com.br\/index.php\/wp-json\/wp\/v2\/posts\/133\/revisions"}],"predecessor-version":[{"id":147,"href":"https:\/\/administracaoderedes.com.br\/index.php\/wp-json\/wp\/v2\/posts\/133\/revisions\/147"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/administracaoderedes.com.br\/index.php\/wp-json\/wp\/v2\/media\/136"}],"wp:attachment":[{"href":"https:\/\/administracaoderedes.com.br\/index.php\/wp-json\/wp\/v2\/media?parent=133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/administracaoderedes.com.br\/index.php\/wp-json\/wp\/v2\/categories?post=133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/administracaoderedes.com.br\/index.php\/wp-json\/wp\/v2\/tags?post=133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}