Join Linux Servers to Active Directory

If you are a sysadmin managing both Linux and Windows servers, you might have wondered how to join your Linux machines to Active Directory (AD) and enjoy the benefits of a single sign-on and centralized authentication. Well, wonder no more, because, in this, I will show you how to use realmd to easily join your Linux servers to AD in a few simple steps.

Realmd is a service that manages the discovery and enrollment of domains, such as AD or IPA. It configures the necessary components to connect to a domain, such as SSSD or Winbind. It also provides a simple command-line tool called realm to manage the domain membership.

Benefits of joining Linux servers to AD

There are many benefits of joining your Linux servers to AD, such as:

• You can use your AD credentials to log in to your Linux servers, without having to create local accounts or sync passwords.
• You can apply security policies and group memberships to your Linux servers from AD, without configuring them manually on each server.
• You can use Kerberos tickets to access other resources on the network, such as file shares or web applications, without having to enter your password again.
• You can audit and monitor the activity of your Linux servers from AD, using tools like Event Viewer or Splunk.

Real-world use cases

Here are some examples of how joining your Linux servers to AD can help you in real-world scenarios:

• You are a System administrator and you need a way to provision users to Linux servers without creating or removing user accounts each time the company hires or someone leaves.  With this you just have to add them to the ssh allow group, then if they need sudo permissions then to that group then they can connect to it.  On the other hand, once the account is disabled they won't be able to connect to the server.
• You are a database administrator who needs to manage a Linux server that runs a MySQL database. By joining the server to AD, you can use your AD credentials to log in via SSH or MySQL client, without having to create a local account or sync passwords. You can also use AD groups to grant different levels of access to the database, without having to create MySQL users or roles.
• You are a security analyst who needs to investigate suspicious activity on a Linux server that runs a mail server. By joining the server to AD, you can use your AD credentials to log in via SSH or IMAP client, without having to compromise the security of the server by using a shared account or password. You can also use AD logs and tools to trace the source and destination of the activity, without having to parse the mail server logs manually.

How to automate the process with a script

Joining your Linux servers to AD with realmd is easy, but it still requires some manual steps, such as entering the domain name, the administrator password, and the desired hostname. If you have many servers to join, or if you want to standardize the process, you might want to automate it with a script.

This is the script I wrote to automate it.

Make Sure you have added your own domain, SSH allow group and Sudores group to the defined variable section.

You should be able to find more information and how to execute the script in the Github readme.

In this blog post, I have shown you how to join your Linux servers to AD using realmd, what are the benefits of doing so, and how to automate the process with a script. I hope you found it useful and informative. If you have any questions or feedback, feel free to leave a comment below or contact me on Twitter: @rhsameera