Integrating Red Hat Enterprise Linux 6 with Microsoft Active Directory Presentation

Integrating

Red Hat Enterprise Linux 6

with Microsoft Active

Directory

Agenda

●

Overview

●

Components

●

Considerations

Configurations

Futures

What is needed?

● Thorough understanding components, interactions

● Awareness of technical, non-technical considerations ● Comparison of configurations, options

● Best practices, guidelines

Windows – Consumer Perception

Windows – Systems Reality

●

Overview

●

Components

●

Considerations

Configurations

Futures

Components - Overview

* Let's examine several core components closer *

Red Hat

Enterprise Linux Active Windows Server 2008 R2 Directory Winbind Kerberos LDAP SSSD NTP DNS NSS Samba SMB/CIFS

Active Directory Domain Services (AD DS)

● Suite of directory services ● Customized versions:

● Kerberos

● Domain Name System (DNS)

● Lightweight Directory Access Protocol (LDAP)

● Object hierarchy – nodes, trees, forests, domains ● Renamed in Windows Server 2008 R2

Samba

● Open source suite of programs ● Provides file and print services ● Includes two daemons:

● smbd (file and print services) ● nmbd (NetBIOS name server)

● Samba v3.5 is current version (RHEL 6)

SMB/CIFS

● Client-server communications protocols

● Server Message Block (SMB) - IBM developed

● Common Internet File System (CIFS) – MS extended ● Both protocols used interchangeably

● SMB older, legacy servers (Windows 2000)

Winbind (1)

● Daemon included with Samba suite

● Unified logon to Active Directory accounts ● Minimizes need for separate accounts

● Primary functions:

● Authentication of user credentials (“Who”)

● ID Tracking/Name Resolution via nsswitch (“Where”) ● ID Mapping of UID/GID <-> SID (“What”)

Winbind (3)

● ID Mapping implemented through “backends” ● ~8 backends available

● ID Mappings classified as:

● Allocating (r/w, local)

● Algorithmic (r/o, calculated, consistent)

● Assigned (r/o, assigned in AD, consistent)

● Each has advantages, disadvantages

SSSD (System Security Services Daemon)

● RHEL systems members of centralized IdM solution

(Active Directory, IPA, LDAP, Kerberos)

● Access to different identity, authentication providers

(e.g. - LDAP native, LDAP w/Kerberos)

● Extensible (new identity, authentication sources) ● Supports off-line caching (clients)

● Reduces load on identity servers

Kerberos

● Current version = V5

● Clients request ticket from trusted third party (KDC)

● Key distribution center (KDC) = AD server

● Behavior configured by /etc/krb5.conf ● Managed by PAM libraries:

● pam_winbind (Samba), pam_sss (SSSD), pam_krb5

Integration best practice:

●

Overview

●

Components

●

Considerations

Configurations

Futures

Non-technical Considerations

● Organizational Alignment ● Expertise Levels

● Scope/Complexity ● Prototype

Technical Considerations – File Sharing

● File sharing required?

● Yes = Samba based configuration ● No = Samba or non-Samba ok

● Where are file shares located?

● Client side? ● Server side?

Technical Considerations –

● Red Hat Enterprise Linux login access required?

● Command Line Interface (CLI)

● Graphical Display Manager (GDM)

● Local vs. Active Directory accounts

● Local accounts = more administration

● Active Directory = centralized administration

Technical Considerations –

● RFC2307/bis

● Extends UNIX ID attributes via LDAP

● Provides more flexibility, control (home dir, shell)

● Enabling in Windows Server

● 2008 R2 => Identity Management for UNIX (IMU) role

● 2008, 2003 R2 => Identity Management for UNIX (IMU) service ● 2003 and earlier => Windows Services for UNIX (SFU) service

Technical Considerations –

● Winbind listing of users, groups in AD domain

● Default behavior during user login, authentication ● More users = longer login time

Integration best practice:

* Disable in environments 20,000+ users *

/etc/samba/smb.conf

[global]

winbind enum users = no winbind enum groups = no

Technical Considerations – LDAP Referrals

● LDAP in Active Directory scales out over time

● Objects relocate across multiple domain controllers

● LDAP referral

● Responding domain controller can't find object

● Clients contact multiple controllers to complete lookup

Integration best practice:

* Disable for performance (if no partial replication) *

/etc/sssd/sssd.conf

●

Overview

●

Components

●

Considerations

Configurations

Futures

Recommended Configurations - Overview

Configuration Services

Provided Features Use Case

1. Samba/Winbind (idmap_rid)

● File sharing ● Login access

● Templated shell, home dirs ● Least intrusive to AD

(No user/group ID attribute changes) ● Algorithmic ID mappings

“Template-driven”

2. Samba/Winbind (idmap_ad)

● File sharing ● Login access

● Customizable shell, home dirs ● Centralized user mgmt

● Assigned ID mappings

● User/group ID attributes set in AD (requires IMU)

“Customizable”

3. SSSD/Kerberos/ LDAP

● Login access ● Advanced authentication, caching ● Reduces client loading on server ● User/group ID attributes set in AD

(requires IMU)

“Enhanced”

4. Kerberos/LDAP ● Login access ● No off-line caching user credentials ● User/group ID attributes set in AD

(requires IMU)

“Legacy”

Configuration 1

Configuration 2

Configuration 3

Configuration 4

●

Overview

●

Components

●

Considerations

Configurations

Futures

Futures

● Winbind idmap_autorid

● New backend for Samba 3.6/RHEL 6.4

● Automatically allocates domain ranges

● SSSD

● Active Directory domain trust support (RHEL 6.4)

● New AD integration capabilites - ID Mapping, etc. (RHEL 6.4+)

● Fully featured, enhanced alternative to Winbind

● Red Hat Enterprise Linux 7

●

Overview

●

Components

●

Considerations

Configurations

Futures

Summary (1)

● First glance deceptively simple

● Second glance appears overwhelming

● Many variables, components, interactions ● Reference Architecture simplifies selection,

deployment and integration:

https://www.redhat.com/resourcelibrary/reference-architectures/ integrating-red-hat-enterprise-linux-6-with-active-directory

● See Customer Portal for additional materials:

Summary (2)

● Select best configuration for your environment, organizational goals

● Hybrid configurations ok to consider ● Third-party products viable alternatives ● Prototype, test in advance

● Most issues have simple causes

“Red Hat Enterprise Linux integrates well with Windows Active Directory”