Domain Logon

[adiMasher]

I have a W2K Active Directory controlled internal DNS which is great for all the windows boxes that are on it. However we have a wide selection of unix platforms that we would also like to have logon capabilities to the domain such that when a new user is added to Active Directory, they are automatically able to log on to any of the unix boxes as well.

Is there a way to set this up in the startup files and/or the login scripts that authenticate across the network domain in order to gain access.

Thanks,
Martin

 

[cgswong]

I don't recall exactly right now but there are tools availbale for this. You can also check SAMBA out though I'm not sure if it will go as far as you want it to.

Regards.

 

[AndyBo]

The Samba route is an interesting one that would be worth looking into. It may be possible with the latest release of Samba to set it up as a BDC, and then to amend the /etc/pam.d/login file to authenticate against Samba.

An alternative route...

As I understand it, Active Directory is basically "Microsoft does LDAP".

Linux uses PAM to do login authentication.

PAM (at least on the RedHat 7.2 box I just checked) has a pam_ldap module in /lib/security.

So... putting all of this together it may be possible to use the LDAP support in PAM to authenticate logins against an Active Directory server.

There are a couple of resources that may help with this:

http://www.padl.com/pam_ldap.html

This appears to be the home of the PAM LDAP module.

http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam.html

This is the Linux-PAM system admin guide. Pay special attention to the "If something goes wrong" page

I'd have tried setting this up myself, but unfortunately I don't have an Active Directory installation to test against. Please post back here if you have any success.

Good luck!

 

[AndyBo]

I just did some more checking and found a hopeful posting at

http://www.netsys.com/pamldap/2001/09/msg00009.html

This indicates that pam_ldap will authenticate against a Win2K Active Directory, and would be worth a read.