Kerberos and Ubuntu 18
I am trying to configure a automated join to domain on my Ubuntu workstations. I have everything in place (I at least I believe so as the following command works fine)
net ads join -U <username>
Now I have two questions. Could someone explain to me what the option -k or --kerberos does and when could it be used ?
And also has anyone sucesfully automated this process ? I so far have puppet setup to deploy all config files (krb, sssd, samba. All of those are configured and working when done manually) and run the net ads join at the end however it seems to fail (no surprise as I dont provide it with credentials) someone has mentioned to me to run the above command with -k option however that seems to fail too.
18.04 active-directory kerberos
asked Dec 12 '18 at 16:52
Oskar LOskar L
1178
add a comment |
I am trying to configure a automated join to domain on my Ubuntu workstations. I have everything in place (I at least I believe so as the following command works fine)
net ads join -U <username>
Now I have two questions. Could someone explain to me what the option -k or --kerberos does and when could it be used ?
And also has anyone sucesfully automated this process ? I so far have puppet setup to deploy all config files (krb, sssd, samba. All of those are configured and working when done manually) and run the net ads join at the end however it seems to fail (no surprise as I dont provide it with credentials) someone has mentioned to me to run the above command with -k option however that seems to fail too.
18.04 active-directory kerberos
asked Dec 12 '18 at 16:52
Oskar LOskar L
1178
1
Have you set up Kerberos on your realm, or have it set up for you? If not, this is a pretty tall order for a single question. Standard ref: help.ubuntu.com/lts/serverguide/kerberos.html
– jdv
Dec 12 '18 at 17:26
Yes, sorry I have setup kerberos as well as I have all configuration files in place for sssd and samba. Everything works fine manually I've even setup network hares to mount automatically. However I am looking for a way to automate this specific part. I know I can write a script to do this and either save the credentials or provide them at this point or before hand but I was wondering if there is a way of automating this fully.
– Oskar L
Dec 13 '18 at 9:03
1
You should say this in the question, not a comment. Edit the question and make sure everything someone needs to help you is in there.
– jdv
Dec 13 '18 at 14:37
add a comment |
I am trying to configure a automated join to domain on my Ubuntu workstations. I have everything in place (I at least I believe so as the following command works fine)
net ads join -U <username>
Now I have two questions. Could someone explain to me what the option -k or --kerberos does and when could it be used ?
And also has anyone sucesfully automated this process ? I so far have puppet setup to deploy all config files (krb, sssd, samba. All of those are configured and working when done manually) and run the net ads join at the end however it seems to fail (no surprise as I dont provide it with credentials) someone has mentioned to me to run the above command with -k option however that seems to fail too.
18.04 active-directory kerberos
asked Dec 12 '18 at 16:52
Oskar LOskar L
1178
I am trying to configure a automated join to domain on my Ubuntu workstations. I have everything in place (I at least I believe so as the following command works fine)
net ads join -U <username>
Now I have two questions. Could someone explain to me what the option -k or --kerberos does and when could it be used ?
And also has anyone sucesfully automated this process ? I so far have puppet setup to deploy all config files (krb, sssd, samba. All of those are configured and working when done manually) and run the net ads join at the end however it seems to fail (no surprise as I dont provide it with credentials) someone has mentioned to me to run the above command with -k option however that seems to fail too.
18.04 active-directory kerberos
18.04 active-directory kerberos
asked Dec 12 '18 at 16:52
Oskar LOskar L
1178
asked Dec 12 '18 at 16:52
Oskar LOskar L
1178
edited Dec 13 '18 at 14:48
Oskar L
asked Dec 12 '18 at 16:52
Oskar LOskar L
1178
asked Dec 12 '18 at 16:52
Oskar LOskar L
1178
asked Dec 12 '18 at 16:52
Oskar LOskar L
1178
1178
1
Have you set up Kerberos on your realm, or have it set up for you? If not, this is a pretty tall order for a single question. Standard ref: help.ubuntu.com/lts/serverguide/kerberos.html
– jdv
Dec 12 '18 at 17:26
Yes, sorry I have setup kerberos as well as I have all configuration files in place for sssd and samba. Everything works fine manually I've even setup network hares to mount automatically. However I am looking for a way to automate this specific part. I know I can write a script to do this and either save the credentials or provide them at this point or before hand but I was wondering if there is a way of automating this fully.
– Oskar L
Dec 13 '18 at 9:03
1
You should say this in the question, not a comment. Edit the question and make sure everything someone needs to help you is in there.
– jdv
Dec 13 '18 at 14:37
add a comment |
1
Have you set up Kerberos on your realm, or have it set up for you? If not, this is a pretty tall order for a single question. Standard ref: help.ubuntu.com/lts/serverguide/kerberos.html
– jdv
Dec 12 '18 at 17:26
Yes, sorry I have setup kerberos as well as I have all configuration files in place for sssd and samba. Everything works fine manually I've even setup network hares to mount automatically. However I am looking for a way to automate this specific part. I know I can write a script to do this and either save the credentials or provide them at this point or before hand but I was wondering if there is a way of automating this fully.
– Oskar L
Dec 13 '18 at 9:03
1
You should say this in the question, not a comment. Edit the question and make sure everything someone needs to help you is in there.
– jdv
Dec 13 '18 at 14:37
1
1
Have you set up Kerberos on your realm, or have it set up for you? If not, this is a pretty tall order for a single question. Standard ref: help.ubuntu.com/lts/serverguide/kerberos.html
– jdv
Dec 12 '18 at 17:26
Have you set up Kerberos on your realm, or have it set up for you? If not, this is a pretty tall order for a single question. Standard ref: help.ubuntu.com/lts/serverguide/kerberos.html
– jdv
Dec 12 '18 at 17:26
Yes, sorry I have setup kerberos as well as I have all configuration files in place for sssd and samba. Everything works fine manually I've even setup network hares to mount automatically. However I am looking for a way to automate this specific part. I know I can write a script to do this and either save the credentials or provide them at this point or before hand but I was wondering if there is a way of automating this fully.
– Oskar L
Dec 13 '18 at 9:03
Yes, sorry I have setup kerberos as well as I have all configuration files in place for sssd and samba. Everything works fine manually I've even setup network hares to mount automatically. However I am looking for a way to automate this specific part. I know I can write a script to do this and either save the credentials or provide them at this point or before hand but I was wondering if there is a way of automating this fully.
– Oskar L
Dec 13 '18 at 9:03
1
1
You should say this in the question, not a comment. Edit the question and make sure everything someone needs to help you is in there.
– jdv
Dec 13 '18 at 14:37
You should say this in the question, not a comment. Edit the question and make sure everything someone needs to help you is in there.
– jdv
Dec 13 '18 at 14:37
add a comment |
2 Answers
2
active
oldest
votes
-k will use kerberos authentication, so if you have a ticket from a principal that can create computer objects in AD, the net ads join command will work without providing any further credentials.
The process would be:
get ticket:
kinit <user>, where<user>is e. g. a Domain Admin accountexecute the join:
net ads join -k
You can do this from within a script. You can even consider using msktutil to do this, in case you do not want to have all the samba stuff installed on the client. The msktutil would replace the net ads join command.
As to fully automating that is a bit of a vague question, but the key concept would be to have some way to pre-create the computer accounts in the AD (you can use msktuil, net ads or the Windows GUI for this), then use one of the tools to actually join the client using some default password.
If you have a separate admin group managing the AD they will probably pre-create the computer objects for you. If you have to do that yourself I do not see much usefulness in automating this anyway, as it won't save you any work.
answered Dec 13 '18 at 18:17
Sebastian StarkSebastian Stark
4,846938
Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
– Oskar L
Dec 14 '18 at 9:11
check thecreatecomputeroption for net ads join for the OU.
– Sebastian Stark
Dec 15 '18 at 21:13
add a comment |
Answer to this was to use
net ads join -U username%password
This and a new user on domain that has a single right of adding devices to domain fixed my issue.
answered Feb 1 at 14:28
Oskar LOskar L
1178
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1100385%2fkerberos-and-ubuntu-18%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
-k will use kerberos authentication, so if you have a ticket from a principal that can create computer objects in AD, the net ads join command will work without providing any further credentials.
The process would be:
get ticket:
kinit <user>, where<user>is e. g. a Domain Admin accountexecute the join:
net ads join -k
You can do this from within a script. You can even consider using msktutil to do this, in case you do not want to have all the samba stuff installed on the client. The msktutil would replace the net ads join command.
As to fully automating that is a bit of a vague question, but the key concept would be to have some way to pre-create the computer accounts in the AD (you can use msktuil, net ads or the Windows GUI for this), then use one of the tools to actually join the client using some default password.
If you have a separate admin group managing the AD they will probably pre-create the computer objects for you. If you have to do that yourself I do not see much usefulness in automating this anyway, as it won't save you any work.
answered Dec 13 '18 at 18:17
Sebastian StarkSebastian Stark
4,846938
Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
– Oskar L
Dec 14 '18 at 9:11
check thecreatecomputeroption for net ads join for the OU.
– Sebastian Stark
Dec 15 '18 at 21:13
add a comment |
-k will use kerberos authentication, so if you have a ticket from a principal that can create computer objects in AD, the net ads join command will work without providing any further credentials.
The process would be:
get ticket:
kinit <user>, where<user>is e. g. a Domain Admin accountexecute the join:
net ads join -k
You can do this from within a script. You can even consider using msktutil to do this, in case you do not want to have all the samba stuff installed on the client. The msktutil would replace the net ads join command.
As to fully automating that is a bit of a vague question, but the key concept would be to have some way to pre-create the computer accounts in the AD (you can use msktuil, net ads or the Windows GUI for this), then use one of the tools to actually join the client using some default password.
If you have a separate admin group managing the AD they will probably pre-create the computer objects for you. If you have to do that yourself I do not see much usefulness in automating this anyway, as it won't save you any work.
answered Dec 13 '18 at 18:17
Sebastian StarkSebastian Stark
4,846938
Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
– Oskar L
Dec 14 '18 at 9:11
check thecreatecomputeroption for net ads join for the OU.
– Sebastian Stark
Dec 15 '18 at 21:13
add a comment |
-k will use kerberos authentication, so if you have a ticket from a principal that can create computer objects in AD, the net ads join command will work without providing any further credentials.
The process would be:
get ticket:
kinit <user>, where<user>is e. g. a Domain Admin accountexecute the join:
net ads join -k
You can do this from within a script. You can even consider using msktutil to do this, in case you do not want to have all the samba stuff installed on the client. The msktutil would replace the net ads join command.
As to fully automating that is a bit of a vague question, but the key concept would be to have some way to pre-create the computer accounts in the AD (you can use msktuil, net ads or the Windows GUI for this), then use one of the tools to actually join the client using some default password.
If you have a separate admin group managing the AD they will probably pre-create the computer objects for you. If you have to do that yourself I do not see much usefulness in automating this anyway, as it won't save you any work.
answered Dec 13 '18 at 18:17
Sebastian StarkSebastian Stark
4,846938
-k will use kerberos authentication, so if you have a ticket from a principal that can create computer objects in AD, the net ads join command will work without providing any further credentials.
The process would be:
get ticket:
kinit <user>, where<user>is e. g. a Domain Admin accountexecute the join:
net ads join -k
You can do this from within a script. You can even consider using msktutil to do this, in case you do not want to have all the samba stuff installed on the client. The msktutil would replace the net ads join command.
As to fully automating that is a bit of a vague question, but the key concept would be to have some way to pre-create the computer accounts in the AD (you can use msktuil, net ads or the Windows GUI for this), then use one of the tools to actually join the client using some default password.
If you have a separate admin group managing the AD they will probably pre-create the computer objects for you. If you have to do that yourself I do not see much usefulness in automating this anyway, as it won't save you any work.
answered Dec 13 '18 at 18:17
Sebastian StarkSebastian Stark
4,846938
edited Dec 15 '18 at 21:11
answered Dec 13 '18 at 18:17
Sebastian StarkSebastian Stark
4,846938
answered Dec 13 '18 at 18:17
Sebastian StarkSebastian Stark
4,846938
answered Dec 13 '18 at 18:17
Sebastian StarkSebastian Stark
4,846938
4,846938
Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
– Oskar L
Dec 14 '18 at 9:11
check thecreatecomputeroption for net ads join for the OU.
– Sebastian Stark
Dec 15 '18 at 21:13
add a comment |
Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
– Oskar L
Dec 14 '18 at 9:11
check thecreatecomputeroption for net ads join for the OU.
– Sebastian Stark
Dec 15 '18 at 21:13
Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
– Oskar L
Dec 14 '18 at 9:11
Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
– Oskar L
Dec 14 '18 at 9:11
check the
createcomputer option for net ads join for the OU.– Sebastian Stark
Dec 15 '18 at 21:13
check the
createcomputer option for net ads join for the OU.– Sebastian Stark
Dec 15 '18 at 21:13
add a comment |
Answer to this was to use
net ads join -U username%password
This and a new user on domain that has a single right of adding devices to domain fixed my issue.
answered Feb 1 at 14:28
Oskar LOskar L
1178
add a comment |
Answer to this was to use
net ads join -U username%password
This and a new user on domain that has a single right of adding devices to domain fixed my issue.
answered Feb 1 at 14:28
Oskar LOskar L
1178
add a comment |
Answer to this was to use
net ads join -U username%password
This and a new user on domain that has a single right of adding devices to domain fixed my issue.
answered Feb 1 at 14:28
Oskar LOskar L
1178
Answer to this was to use
net ads join -U username%password
This and a new user on domain that has a single right of adding devices to domain fixed my issue.
answered Feb 1 at 14:28
Oskar LOskar L
1178
answered Feb 1 at 14:28
Oskar LOskar L
1178
answered Feb 1 at 14:28
Oskar LOskar L
1178
answered Feb 1 at 14:28
Oskar LOskar L
1178
1178
add a comment |
add a comment |
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1100385%2fkerberos-and-ubuntu-18%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Have you set up Kerberos on your realm, or have it set up for you? If not, this is a pretty tall order for a single question. Standard ref: help.ubuntu.com/lts/serverguide/kerberos.html
– jdv
Dec 12 '18 at 17:26
Yes, sorry I have setup kerberos as well as I have all configuration files in place for sssd and samba. Everything works fine manually I've even setup network hares to mount automatically. However I am looking for a way to automate this specific part. I know I can write a script to do this and either save the credentials or provide them at this point or before hand but I was wondering if there is a way of automating this fully.
– Oskar L
Dec 13 '18 at 9:03
1
You should say this in the question, not a comment. Edit the question and make sure everything someone needs to help you is in there.
– jdv
Dec 13 '18 at 14:37