Join the current machine to an Active Directory using OpenLMI
- TODO TODO TODO TODO This page is not done
- Fulfill the prerequisites and make sure your Active Directory domain access works.
- XXX Requirements to satisfy first
- XXX Setup step
- XXX Setup step
- XXX Setup substep
How to test
- XXX Step to run the join command
- XXX Notes about what should be seen
- XXX Press enter to boot and run the installation.
- Check if you are joined to the domain
- The domain should be listed
- Make note of the login format
- Check that domain accounts can be resolved
getent passwd 'AD\User'
- Make sure to use the quotes around the user name.
- You should see an output line that looks like passwd(5) output. It should contain an appropriate home directory, and a shell.
- Use the login-formats you saw above, to build a remote user name. It will be in the form of DOMAIN\User, where DOMAIN is the first part of your full Active Directory domain name.
- Check that you have an appropriate entry in your hosts keytab.
sudo klist -k
- Check that you can use your keytab with kerberos
sudo kinit -k 'HOSTNAME$@AD.EXAMPLE.COM'
- Make sure to use quotes around the argument, because of the characters in there. #: Make sure the hostname and domain are capitalized.
- Use the principal from the output of the klist command above. Use the one that's capitalized and looks like HOSTNAME$@DOMAIN.
- There should be no output from this command.
- Try to log into the machine as a domain account at the console.
- This should automatically create a new home directory for the user, and log into a shell prompt.
More: Try it with FreeIPA
Use a FreeIPA domain with the OpenLMI join.
- RHBZ #XXXXXX If you see SELinux issues see this bug for details.
- Please do this and report all AVC's to the above bug.
$ sudo setenforce permissive ... do the test $ sudo grep realmd /var/log/audit/audit.log