Joining a CentOS server to Active Directory
As the number of CentOS (or Red Hat) machines in your environment grows, you begin to appreciate the need for a central login mechanism. Most workplaces already have a such a login for their Windows workstations in the form of an Active Directory domain. By joining your CentOS machines to the Active Directory domain, you allow users to login with the same credentials as on their Windows machines. Furthermore you do not need to add or remove users when new people join the team or others drop off the team.
For the purposes of these instructions, we will assume the Active Directory server is ad.example.com and the CentOS server is centos.example.com.
As a first step, we install Samba, kerberos and ntpd.
yum install samba samba-client samba-winbind krb5-workstation ntp
We need to install and configure an ntp client because the Kerberos protocol will not work if the two machines' clocks are too far apart. Edit /etc/ntpd.conf remove all the existing server lines and replace them with:
Next start the ntpd server with the command service ntpd start.
I have had issues down the road with trying to synchronize the clocks against the Active Directory server; in those cases I configured the two servers to synchronize against the same third-party server. I suspect the problem was a (presumably temporary) issue with time.windows.com, the default Windows NTP server.
Next we want to be able to refer to machines on the local network using their short names. Add the following to /etc/resolv.conf:
This may not be necessary depending on how the networking of the CentOS server is configured. For example, I have set up all the servers to use DHCP with reservations to keep all the IP configuration in one place. The DHCP server already is configured to have the clients append .example.com to bare host names so the /etc/resolv.conf already contains this line.
If you are using a static IP, add the following to /etc/hosts, replacing the IP address with the IP for your CentOS server and the host names with the proper values:
192.168.0.10 centos centos.example.com
If you do not have a static IP, add the host entries to the existing line for localhost (127.0.0.1).
Next we need to configure Kerberos by making the following edits to /etc/krb5.conf (note that the capitalization is important in this file):
Next edit /etc/samba.conf, changing or adding the following:
# Use the value of your workgroup/domain here
Finally we can initialize Kerberos and join the domain. You will need the credentials of a user allowed to make changes in the domain (in the example we use administrator).
At this point you should be done. You should be able to log into the machine using your Windows credentials.
Once in a while I find it is necessary to re-join the domain. Use the following commands:
# Restart all relevant services
If the last two tests do not come out the way you expect (wbinfo -t should report success and wbinfo -u should list all the users in your domain), you have some googling to do. Let me know how it turns out.