Difference between revisions of "AD integration - ssh/sudoers using AD accounts"
From Tech-Wiki
| Line 7: | Line 7: | ||
server dc02.domain.local iburst | server dc02.domain.local iburst | ||
| − | systemctl enable chrony ; systemctl restart chrony | + | systemctl enable chrony ; systemctl restart chrony |
| − | timedatectl set-timezone Pacific/Auckland | + | timedatectl set-timezone Pacific/Auckland |
| − | timedatectl ; chronyc makestep | + | timedatectl ; chronyc makestep |
| − | systemctl disable systemd-timesyncd ; systemctl stop system-timesyncd | + | systemctl disable systemd-timesyncd ; systemctl stop system-timesyncd |
Revision as of 16:50, 6 March 2025
Use NTP for time synchronization
apt install chrony # Use AD DCs as NTP source in /etc/chrony/chrony.conf server dc01.domain.local iburst server dc02.domain.local iburst
systemctl enable chrony ; systemctl restart chrony timedatectl set-timezone Pacific/Auckland timedatectl ; chronyc makestep systemctl disable systemd-timesyncd ; systemctl stop system-timesyncd
Allow sudo from required AD group, add to /etc/sudoers.d/ad-admins
%Domain\ Admins ALL=(ALL) ALL
Enable AD auth and DNS registration
yum -y install sssd adcli realmd samba-common-tools oddjob oddjob-mkhomedir apt install sssd-ad sssd-tools realmd adcli realm -v discover domain.local realm join domain.local --user administrator
Add those to /etc/sssd/sssd.conf
access_provider = simple simple_allow_groups = Domain Admins@domain.local use_fully_qualified_names = false dyndns_update = true dyndns_refresh_interval = 43200 dyndns_update_ptr = true dyndns_ttl = 3600 systemctl restart sssd.service
Enable homedir creation
pam-auth-update
Restrict root login from ssh in /etc/ssh/sshd.conf
PermitRootLogin no