Revision 1 as of 2018-11-13 18:18:45

Clear message

This page describes the plan to fix Active Directory at UCC, potentially used in place of the previous AD from 2019 onwards.

Note that this document and the system it describes are in an early development stage.

> In a virtually perfect world, our servers will be named after what they do and not after species of fish.

For testing, a subdomain for the "Virtual" AD will be configured as with NETBIOS domain name VUCC, on a separate virtual network using a virtualised Proxmox VE instance (yes, running VMs inside of VMs). The primary DNS server for domain is, which is also the (virtual) Proxmox VE host. The "primary" DC for domain will also be, and a second DC will be Note that whilst RODCs can be configured using Samba, replication makes things just so much cooler (and more prone to inexplicable breakage) so we might be stuck with that for the time being. is delegated using separate zones in Mooneye's /etc/bind/named.conf.local.

  • zone "" {
            type forward;
            forward only;
            forwarders {
          ; // vucc0 (proxmox VM on maltair, running dnsmasq)

dnsmasq on the (virtualised) Proxmox VM host then delegates the domain to the domain controller(s).

Domain Controller Configuration

See NewActiveDirectory/DomainControllers

Client configuration

Windows systems

Just join them to the domain. It Just Works (TM) - thanks Microsoft / Red Hat / IBM?!!

Linux systems

AD wasn't designed for Linux, and since most of our machines run Linux we have made things difficult for ourselves.

This is copied from ActiveDirectory and has not been tested yet, feel free to fix that.

Automatically using realmd

Make sure you can install samba version 4.6 or above, otherwise certain useful features (such as configuring id mapping) may not work.

Thanks to realmd, joining machines to the domain is extremely simple.

  • Install packages: apt install realmd krb5-user

  • Test to make sure you can connect to the domain: realm discover

  • Join to the domain using realm join -v -U <user>

    • realmd defaults to using sssd, which is fine
    • It installs any necessary packages.
      • Except for one thing: comment the line use_fully_qualified_names = True in /etc/sssd/sssd.conf (prefix with a #)

      • Then it works!
  • Done.

Manual Method

Based on the instructions from and Before configuring the domain ensure the following:

  • Install the required packages: apt install samba winbind krb5-user libpam-krb5 libpam-winbind libnss-winbind

  • Ensure the system is configured according to the SOE.

  • edit /etc/krb5.conf to point to the new domain:

  •    [libdefaults]
            default_realm =
            dns_lookup_realm = false
            dns_lookup_kdc = true
  • Make the following /etc/samba/smb.conf:

  • [global]
    # Configure the domain infomation
            security = ads
            realm =
            workgroup = UCCDOMAYNE
    # use winbind to map users and groups
            winbind enum users = yes
            winbind enum groups = yes
            winbind use default domain = yes
            kerberos method = secrets and keytab
    #Config gid/sid mapping based on AD attributes
            winbind nss info = rfc2307
            idmap config * : backend = tdb
            idmap config * : range = 13000-17999
            #idmap config for UCCDOMAYNE
            idmap config UCCDOMAYNE:backend = ad
            idmap config UCCDOMAYNE:schema_mode = rfc2307
            idmap config UCCDOMAYNE:range = 1-999999
            idmap config UCCDOMAYNE:unix_nss_info = yes
            idmap config UCCDOMAYNE:unix_primary_group = yes
  • Join the machine to the domain with: net ads join -U <username>.

  • configure pam using pam-auth-update and enable Winbind NT/AD authentication.

  • configure nsswitch.conf

  • # /etc/nsswitch.conf
    # Example configuration of GNU Name Service Switch functionality.
    # If you have the `glibc-doc-reference' and `info' packages installed, try:
    # `info libc "Name Service Switch"' for information about this file.
    passwd:         compat winbind
    group:          compat winbind
    shadow:         files
    gshadow:        files
    hosts:          files mdns4_minimal [NOTFOUND=return] dns
    networks:       files
    protocols:      db files
    services:       db files 
    ethers:         db files
    rpc:            db files
    netgroup:       nis 
  • start the services:
  • winbindd
  • Make sure the computer can fetch the domain users and groups with:
  • wbinfo -g` and `wbinfo -u`