Join the current machine to an Active Directory using Anaconda's kickstart.
- Fulfill the prerequisites and make sure your Active Directory domain access works.
- Precreate a computer account in the domain with a one time password using adcli:
$ adcli preset-computer --one-time-password=MyPassword --domain ad.example.com anaconda1
- The computer name above must match the name in the ks.cfg file below.
- Replace your domain name.
- Download this ISO file: boot.iso
- Create a new virtual machine withan 8G disk, 1G of RAM, and use the above file as the boot ISO.
- Prepare this kickstart file
- Download this ks.cfg file
- Edit the ks.cfg file, replacing your domain name into the
- Upload the ks.cfg file to your fedorapeople.org account or some other accessible http server.
How to test
- Start your new virtual machine you prepared above
- At the Fedora boot loader install prompt, use the arrow keys to select Install Fedora 19 and press tab.
- Add the following to the end of the command line
- Make sure to use the full path to the location you uploaded your custom ks.cfg file.
- Press enter to boot and run the installation.
- The boot should complete without prompting
- If you watch closely, before install you should see a status line saying that the realm is being discovered
- Again, after installation, you should see a status line joining the domain.
- Reboot the machine after installation
- Log in as root, using the root password in the ks.cfg
- Check if you are joined to the domain
- The domain should be listed
- Make note of the login format
- Check that domain accounts can be resolved
getent passwd 'AD\User'
- Make sure to use the quotes around the user name.
- You should see an output line that looks like passwd(5) output. It should contain an appropriate home directory, and a shell.
- Use the login-formats you saw above, to build a remote user name. It will be in the form of DOMAIN\User, where DOMAIN is the first part of your full Active Directory domain name.
- Check that you have an appropriate entry in your hosts keytab.
sudo klist -k
- Check that you can use your keytab with kerberos
sudo kinit -k 'HOSTNAME$@AD.EXAMPLE.COM'
- Make sure to use quotes around the argument, because of the characters in there. #: Make sure the hostname and domain are capitalized.
- Use the principal from the output of the klist command above. Use the one that's capitalized and looks like HOSTNAME$@DOMAIN.
- There should be no output from this command.
- Try to log into the machine as a domain account at the console.
- This should automatically create a new home directory for the user, and log into a shell prompt.
More: Try it with FreeIPA
Use a FreeIPA domain with kickstart.
Instead of the
adcli preset-computer command, use the FreeIPA Web UI to precreate an account with the appropriate name.
- RHBZ #960887 The sssd service is configured to start automatically after the installation completes. Workaround:
$ sudo systemctl enable sssd.service
- You currently need to use the boot.iso downloaded above, the standard Fedora beta will not work.