Likewise Open

Likewise Open simplifies the necessary configuration needed to authenticate a Linux™ machine to an Active Directory™ domain. Based on Winbind, the Likewise Open package takes the pain out of integrating Kubuntu™ authentication into an existing Windows™ network.

Instalação

There are two ways to use Likewise Open: likewise-open the command line utility and likewise-open-gui. This section focuses on the command line utility.

To install the likewise-open package, open a terminal and enter:

sudo apt-get install likewise-open

Starting with Kubuntu™ 9.04, likewise-open 5.0 is available in the Universe repository. However, since upgrading from likewise-open 4.1 currently requires the system to leave the domain and re-join, a separate package for version 5 was created.

To install likewise-open 5.0, enter:

sudo apt-get install likewise-open5

Warning

Installing likewise-open5 over an existing likewise-open (4.1) installation will replace it. The domain will have to be rejoined afterward.

Ingressando em um domínio

The main executable file of the likewise-open package is /usr/bin/domainjoin-cli, which is used to join a computer to the domain. Before joining a domain, the following are needed:

  • Access to an Active Directory™ user with appropriate rights to join the domain.

  • The Fully Qualified Domain Name (FQDN) of the domain being joined. If the AD domain does not match a valid domain such as example.com, it is likely that it is in the form of domainname.local.

  • Properly set up DNS for the domain. In a production AD environment, this is typically the case. Proper MicrosoftDNS is needed so that client workstations can determine that the Active Directory™ domain is available.

    If there is not a WindowsDNS server on the network, see the section called “DNS Microsoft” for details.

Para ingressar em um domínio, a partir de um terminal digite:

sudo domainjoin-cli join example.com Administrator

Note

Substitua example.com pelo nome adequado do domínio e Administrator pelo nome do usuário apropriado.

Haverá um prompt para a senha do usuário. Se tudo ocorrer bem, uma mensagem de SUCCESS deverá ser impressa no console.

Note

Após ingressar no domínio, é necessário reiniciar antes de tentar se autenticar no domínio.

After successfully joining a Kubuntu™ machine to an Active Directory™ domain, any valid AD user can be used to authenticate. To log in, the user name must be entered as 'domain\username'. For example, to ssh to a server joined to the domain, enter:

ssh 'example\steve'@hostname

Note

Se estiver configurando uma estação de trabalho, o nome de usuário precisará ser prefixado com o domínio\ no logon gráfico também.

To make Likewise Open use a default domain, the following statement can be added to /etc/samba/lwiauthd.conf:

winbind use default domain = yes

Then restart the Likewise Open daemons:

sudo /etc/init.d/likewise-open restart

Note

Uma vez configurado para um domínio padrão, o 'domínio\' não é mais necessário. Os usuários podem fazer login usando apenas seu nome de usuário.

The domainjoin-cli utility can also be used to leave the domain. From a terminal:

sudo domainjoin-cli leave

Outros utilitários

The likewise-open package comes with a few other utilities that may be useful for gathering information about the Active Directory™ environment. These utilities are used to join the machine to the domain, and are the same as those available in the samba-common and Winbind packages:

  • lwinet: Returns information about the network and the domain.

  • lwimsg: Allows interaction with the likewise-winbindd daemon.

  • lwiinfo: Displays information about various parts of the domain.

Por favor, consulte cada página do man do utilitário para mais detalhes.

Solução de problemas

  • If the client has trouble joining the domain, check that the MicrosoftDNS is listed first in /etc/resolv.conf. For example:

    nameserver 192.168.0.1
    
  • For more information when joining a domain, use the --loglevel verbose or --advanced option of the domainjoin-cli utility:

    sudo domainjoin-cli --loglevel verbose join example.com Administrator
    
    
  • If an Active Directory™ user has trouble logging in, check the /var/log/auth.log for details.

  • When joining a Kubuntu™ Desktop workstation to a domain, it may be necessary to edit /etc/nsswitch.conf if the AD domain uses the .local syntax. In order to join the domain, the "mdns4" entry should be removed from the hosts option. For example:

    hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
    

    Altere o conteúdo acima para:

    hosts: files dns [NOTFOUND=return]
    

    Então, reinicie a rede inserindo:

    sudo /etc/init.d/networking restart
    

    It should now be possible to join the Active Directory™ domain.

DNS Microsoft

The following are instructions for installing DNS on an Active Directory™ domain controller running Windows Server™ 2003, but the instructions should be similar for other versions:

  • Click StartAdministrative ToolsManage Your Server. This will open the Server Role Management utility.

    1. Click Add or remove a role.

    2. Click Next.

    3. Select "DNS Server".

    4. Click Next.

    5. Click Next again to proceed.

    6. Selecione "Criar uma zona de busca" se esta opção não estiver selecionada.

    7. Click Next.

    8. Make sure "This server maintains the zone" is selected and click Next.

    9. Enter the domain name and click Next.

    10. Click Next to "Allow only secure dynamic updates".

    11. Enter the IP for DNS servers to forward queries to, or Select "No, it should not forward queries" and click Next.

    12. Click Finish

    13. Click Finish

    DNS is now installed and can be further configured using the MicrosoftMicrosoft Management Console DNS snap-in.

  • Next, configure the server to use itself for DNS queries:

    1. Click Start

    2. Painel de Controle

    3. Conexões de rede

    4. Clique com o botão direito do mouse em "Conexão Local"

    5. Clique em Propriedades

    6. Double click "Internet Protocol (TCP/IP)"

    7. Enter the server's IP address as the "Preferred DNS server"

    8. Click Ok

    9. Click Ok again to save the settings

Referências

Please refer to the Likewise home page for further information.

For more domainjoin-cli options, see the man page: man domainjoin-cli.