How to add a Linux (Lubuntu) machine to a Windows domain

I know about many enterprises, specially in the third world, that need to use Linux machines
because of the price of the software. I always thought that this kind of software is one of the best
options for developing countries to integrate into the international tech community. Of course,
there are some issues to correct when integrating Linux with other proprietary software, such as
Windows. So, I decided to show how to add a Linux machine to a Windows Domain.

Requirements:

 An Active Directory Domain. I used a Windows Server 2008 machine as Domain

Controller.
 A Linux Machine. I used a Lubuntu VM, I really like Lubuntu.
 SSH installed in the Linux machine. You can get it with the following command:

sudo apt-get install openssh-server

Steps:

1. Create an Active Directory Domain. You can follow the instructions here.
2. Download PowerBroker Open Edition. You can get it here. You'll have to fill a short form and
press "Get Started".
3. You'll receive a mail with the download link. Click it.
4. Download the file corresponding with the architecture of your Linux machine. Since I'm using
Lubuntu here, I'll select the version for 32 bits for Ubuntu.

5. Copy the file to your Linux machine in a place that you can access easily.

6. Open a terminal and enter the following commands:

Go to the folder where you have the installer that you downloaded. In my case:

cd /home/jorge/powerbroker

Make the file executable:

chmod +x pbis-open-7.5.2.1527.linux.x86.deb.sh

Execute the file:

sudo ./pbis-open-7.5.2.1527.linux.x86.deb.sh

For the message:

Would you like to install package for legacy links? (i.e. /opt/likewise/bin/lw-find-user-by-name
-> /opt/pbis/bin/find-user-by-name) (yes/no)

Enter "no".

For the message:

Would you like to install now? (yes/no)

Enter "yes".

Now wait for the installation to finish.

7. Now, you'll see a windows like this:

Just minimize for the moment.

8. Go to Start>Preferences>Network Connections
9. Select your connection and click on Edit...

10. Open the IPv4 tab and set Method to Manual. Click on + Add and enter an IP address, a
netmask and a gateway. In DNS Servers enter the IP of the Domain Controller, and in Search
Domains enter the name of the domain. You could use the following image as an example. Then
press Save:
You'll have to enter your password, and then you can ping the Domain Controller just to see if
everything's OK.

11. By now, you should have a user already created in the Domain for the Linux machine. In my
case, I have "Jorge" created:

The user must be in the Administrators group.

12. Remember the window that you minimized? Maximize it and enter the required data and then
click Join Domain.
13. Enter the credentials of the user you created in Active Directory and press OK. If everything
went well, you should see this:

Just press Close.

14. You did it! Now restart your system.

15. Once you restarted the machine, log in with the domain credentials. In my case: test\jorge.
You can check the domain by opening a terminal and typing: dnsdomainname.
Or you can check if the computer was added in Active Directory:

And that's it!! I know it's not as easy as using only Windows machines, but believe me, there are
many reasons to use Linux in this kind of environments.

As a conclusion, there are many other configurations to do in the Linux machines to secure it in
the context of Active Directory, but I will write about it in the next article. Have fun!

Incluir un equipo Ubuntu 14.04 en un

dominio Active Directory de Windows
En este sencillo tutorial vamos a ver cómo incluir un equipo con Ubuntu (14.04 en el
ejemplo) dentro de un dominio Active Directory (servidor con Windows 2k8) utilizando
PowerBroker IS Open Edition, que es el software que ha “jubilado” a Likewise-Open.
Los datos que usaremos para el ejemplo (y que debéis cambiar por los que correspondan en
vuestro caso) son los siguientes:

Dominio: DONNIE.local
DC: SERVIDOR.DONNIE.local
IP: 192.168.100.2

Antes de comenzar mirad que la ip de vuestro equipo esté en el mismo rango que la ip del
servidor. Una vez confirmado esto (si no, configuradlo) comenzaremos.

Descargamos el script correspondiente desde la web oficial y le damos permisos de

ejecución con un chmod +x. Luego nos situamos en la carpeta donde lo guardamos y lo
ejecutamos (cambiad el nombre del archivo por el de la versións que hayáis descargado
vosotros):

1sudo ./pbis-open-8.0.1.2029.linux.x86_64.deb.sh

Tras esto nos unimos al dominio (cambia administrator y el nombre del domino por los que
procedan):

1sudo domainjoin-cli join DONNIE.local administrator

O si lo quieres desactivando ssh por defecto:

1sudo domainjoin-cli join --disable ssh DONNIE.local administrator

En el siguiente paso hay que hacer un pequeño cambio en un archivo de configuración. En

el archivo /etc/pam.d/common-session debes cambiar la línea que pone session sufficient
pam_lsass.so por esta: session [success=ok default=ignore] pam_lsass.so.

Y desde la consola configuramos más datos para el acceso, recordad cambiar el dominio y
el grupo de usuario por el que corresponda en vuestro caso:

1sudo /opt/pbis/bin/config UserDomainPrefix DONNIE

2sudo /opt/pbis/bin/config AssumeDefaultDomain true
3sudo /opt/pbis/bin/config LoginShellTemplate /bin/bash
4sudo /opt/pbis/bin/config HomeDirTemplate %H/%U
5sudo /opt/pbis/bin/config RequireMembershipOf "DONNIE\\Usuarios"

Ahora nos queda configurar lightdm para activar el login manual:

1sudo vi /usr/share/lightdm/lightdm.conf.d/50-unity-greeter.conf
2
3#Añade las siguients líneas (sin la marca de comentario)
#allow-guest=false
4#greeter-show-manual-login=true
5
6##Nota, en Lubuntu 14.04 el archivo a cambiar será 60-lightdm-gtk-
7greeter.conf

Finalmente vamos a darle permisos de sudo al usuario del dominio (ojo, si procede)
editando el archivo correspondiente con un sudo vi /etc/sudoers y añadiendo los datos que
sean necearios siguiendo los ejemplos contenidos en el propio documento.

Tras esto, si reiniciamos el equipo, deberíamos ya poder hacer login con el usuario del
Active Directory de Windows.