Kerberos and Ubuntu 18
up vote
1
down vote
favorite
I am trying to configure a automated join to domain on my Ubuntu workstations. I have everything in place (I at least I believe so as the following command works fine)
net ads join -U <username>
Now I have two questions. Could someone explain to me what the option -k or --kerberos does and when could it be used ?
And also has anyone sucesfully automated this process ? I so far have puppet setup to deploy all config files (krb, sssd, samba. All of those are configured and working when done manually) and run the net ads join at the end however it seems to fail (no surprise as I dont provide it with credentials) someone has mentioned to me to run the above command with -k option however that seems to fail too.
18.04 active-directory kerberos
asked Dec 12 at 16:52
Oskar L
775
New contributor
Oskar L is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
up vote
1
down vote
favorite
I am trying to configure a automated join to domain on my Ubuntu workstations. I have everything in place (I at least I believe so as the following command works fine)
net ads join -U <username>
Now I have two questions. Could someone explain to me what the option -k or --kerberos does and when could it be used ?
And also has anyone sucesfully automated this process ? I so far have puppet setup to deploy all config files (krb, sssd, samba. All of those are configured and working when done manually) and run the net ads join at the end however it seems to fail (no surprise as I dont provide it with credentials) someone has mentioned to me to run the above command with -k option however that seems to fail too.
18.04 active-directory kerberos
asked Dec 12 at 16:52
Oskar L
775
New contributor
Oskar L is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1
Have you set up Kerberos on your realm, or have it set up for you? If not, this is a pretty tall order for a single question. Standard ref: help.ubuntu.com/lts/serverguide/kerberos.html
– jdv
Dec 12 at 17:26
Yes, sorry I have setup kerberos as well as I have all configuration files in place for sssd and samba. Everything works fine manually I've even setup network hares to mount automatically. However I am looking for a way to automate this specific part. I know I can write a script to do this and either save the credentials or provide them at this point or before hand but I was wondering if there is a way of automating this fully.
– Oskar L
Dec 13 at 9:03
1
You should say this in the question, not a comment. Edit the question and make sure everything someone needs to help you is in there.
– jdv
Dec 13 at 14:37
add a comment |
up vote
1
down vote
favorite
up vote
1
down vote
favorite
I am trying to configure a automated join to domain on my Ubuntu workstations. I have everything in place (I at least I believe so as the following command works fine)
net ads join -U <username>
Now I have two questions. Could someone explain to me what the option -k or --kerberos does and when could it be used ?
And also has anyone sucesfully automated this process ? I so far have puppet setup to deploy all config files (krb, sssd, samba. All of those are configured and working when done manually) and run the net ads join at the end however it seems to fail (no surprise as I dont provide it with credentials) someone has mentioned to me to run the above command with -k option however that seems to fail too.
18.04 active-directory kerberos
asked Dec 12 at 16:52
Oskar L
775
New contributor
Oskar L is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I am trying to configure a automated join to domain on my Ubuntu workstations. I have everything in place (I at least I believe so as the following command works fine)
net ads join -U <username>
Now I have two questions. Could someone explain to me what the option -k or --kerberos does and when could it be used ?
And also has anyone sucesfully automated this process ? I so far have puppet setup to deploy all config files (krb, sssd, samba. All of those are configured and working when done manually) and run the net ads join at the end however it seems to fail (no surprise as I dont provide it with credentials) someone has mentioned to me to run the above command with -k option however that seems to fail too.
18.04 active-directory kerberos
18.04 active-directory kerberos
asked Dec 12 at 16:52
Oskar L
775
New contributor
Oskar L is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Dec 12 at 16:52
Oskar L
775
New contributor
Oskar L is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited Dec 13 at 14:48
asked Dec 12 at 16:52
Oskar L
775
New contributor
Oskar L is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Dec 12 at 16:52
Oskar L
775
asked Dec 12 at 16:52
Oskar L
775
775
New contributor
Oskar L is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Oskar L is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Oskar L is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1
Have you set up Kerberos on your realm, or have it set up for you? If not, this is a pretty tall order for a single question. Standard ref: help.ubuntu.com/lts/serverguide/kerberos.html
– jdv
Dec 12 at 17:26
Yes, sorry I have setup kerberos as well as I have all configuration files in place for sssd and samba. Everything works fine manually I've even setup network hares to mount automatically. However I am looking for a way to automate this specific part. I know I can write a script to do this and either save the credentials or provide them at this point or before hand but I was wondering if there is a way of automating this fully.
– Oskar L
Dec 13 at 9:03
1
You should say this in the question, not a comment. Edit the question and make sure everything someone needs to help you is in there.
– jdv
Dec 13 at 14:37
add a comment |
1
Have you set up Kerberos on your realm, or have it set up for you? If not, this is a pretty tall order for a single question. Standard ref: help.ubuntu.com/lts/serverguide/kerberos.html
– jdv
Dec 12 at 17:26
Yes, sorry I have setup kerberos as well as I have all configuration files in place for sssd and samba. Everything works fine manually I've even setup network hares to mount automatically. However I am looking for a way to automate this specific part. I know I can write a script to do this and either save the credentials or provide them at this point or before hand but I was wondering if there is a way of automating this fully.
– Oskar L
Dec 13 at 9:03
1
You should say this in the question, not a comment. Edit the question and make sure everything someone needs to help you is in there.
– jdv
Dec 13 at 14:37
1
1
Have you set up Kerberos on your realm, or have it set up for you? If not, this is a pretty tall order for a single question. Standard ref: help.ubuntu.com/lts/serverguide/kerberos.html
– jdv
Dec 12 at 17:26
Have you set up Kerberos on your realm, or have it set up for you? If not, this is a pretty tall order for a single question. Standard ref: help.ubuntu.com/lts/serverguide/kerberos.html
– jdv
Dec 12 at 17:26
Yes, sorry I have setup kerberos as well as I have all configuration files in place for sssd and samba. Everything works fine manually I've even setup network hares to mount automatically. However I am looking for a way to automate this specific part. I know I can write a script to do this and either save the credentials or provide them at this point or before hand but I was wondering if there is a way of automating this fully.
– Oskar L
Dec 13 at 9:03
Yes, sorry I have setup kerberos as well as I have all configuration files in place for sssd and samba. Everything works fine manually I've even setup network hares to mount automatically. However I am looking for a way to automate this specific part. I know I can write a script to do this and either save the credentials or provide them at this point or before hand but I was wondering if there is a way of automating this fully.
– Oskar L
Dec 13 at 9:03
1
1
You should say this in the question, not a comment. Edit the question and make sure everything someone needs to help you is in there.
– jdv
Dec 13 at 14:37
You should say this in the question, not a comment. Edit the question and make sure everything someone needs to help you is in there.
– jdv
Dec 13 at 14:37
add a comment |
1 Answer
1
active
oldest
votes
up vote
1
down vote
-k will use kerberos authentication, so if you have a ticket from a principal that can create computer objects in AD, the net ads join command will work without providing any further credentials.
The process would be:
get ticket:
kinit <user>, where<user>is e. g. a Domain Admin accountexecute the join:
net ads join -k
You can do this from within a script. You can even consider using msktutil to do this, in case you do not want to have all the samba stuff installed on the client. The msktutil would replace the net ads join command.
As to fully automating that is a bit of a vague question, but the key concept would be to have some way to pre-create the computer accounts in the AD (you can use msktuil, net ads or the Windows GUI for this), then use one of the tools to actually join the client using some default password.
If you have a separate admin group managing the AD they will probably pre-create the computer objects for you. If you have to do that yourself I do not see much usefulness in automating this anyway, as it won't save you any work.
answered Dec 13 at 18:17
Sebastian Stark
4,808938
Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
– Oskar L
Dec 14 at 9:11
check thecreatecomputeroption for net ads join for the OU.
– Sebastian Stark
Dec 15 at 21:13
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Oskar L is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1100385%2fkerberos-and-ubuntu-18%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
1
down vote
-k will use kerberos authentication, so if you have a ticket from a principal that can create computer objects in AD, the net ads join command will work without providing any further credentials.
The process would be:
get ticket:
kinit <user>, where<user>is e. g. a Domain Admin accountexecute the join:
net ads join -k
You can do this from within a script. You can even consider using msktutil to do this, in case you do not want to have all the samba stuff installed on the client. The msktutil would replace the net ads join command.
As to fully automating that is a bit of a vague question, but the key concept would be to have some way to pre-create the computer accounts in the AD (you can use msktuil, net ads or the Windows GUI for this), then use one of the tools to actually join the client using some default password.
If you have a separate admin group managing the AD they will probably pre-create the computer objects for you. If you have to do that yourself I do not see much usefulness in automating this anyway, as it won't save you any work.
answered Dec 13 at 18:17
Sebastian Stark
4,808938
Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
– Oskar L
Dec 14 at 9:11
check thecreatecomputeroption for net ads join for the OU.
– Sebastian Stark
Dec 15 at 21:13
add a comment |
up vote
1
down vote
-k will use kerberos authentication, so if you have a ticket from a principal that can create computer objects in AD, the net ads join command will work without providing any further credentials.
The process would be:
get ticket:
kinit <user>, where<user>is e. g. a Domain Admin accountexecute the join:
net ads join -k
You can do this from within a script. You can even consider using msktutil to do this, in case you do not want to have all the samba stuff installed on the client. The msktutil would replace the net ads join command.
As to fully automating that is a bit of a vague question, but the key concept would be to have some way to pre-create the computer accounts in the AD (you can use msktuil, net ads or the Windows GUI for this), then use one of the tools to actually join the client using some default password.
If you have a separate admin group managing the AD they will probably pre-create the computer objects for you. If you have to do that yourself I do not see much usefulness in automating this anyway, as it won't save you any work.
answered Dec 13 at 18:17
Sebastian Stark
4,808938
Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
– Oskar L
Dec 14 at 9:11
check thecreatecomputeroption for net ads join for the OU.
– Sebastian Stark
Dec 15 at 21:13
add a comment |
up vote
1
down vote
up vote
1
down vote
-k will use kerberos authentication, so if you have a ticket from a principal that can create computer objects in AD, the net ads join command will work without providing any further credentials.
The process would be:
get ticket:
kinit <user>, where<user>is e. g. a Domain Admin accountexecute the join:
net ads join -k
You can do this from within a script. You can even consider using msktutil to do this, in case you do not want to have all the samba stuff installed on the client. The msktutil would replace the net ads join command.
As to fully automating that is a bit of a vague question, but the key concept would be to have some way to pre-create the computer accounts in the AD (you can use msktuil, net ads or the Windows GUI for this), then use one of the tools to actually join the client using some default password.
If you have a separate admin group managing the AD they will probably pre-create the computer objects for you. If you have to do that yourself I do not see much usefulness in automating this anyway, as it won't save you any work.
answered Dec 13 at 18:17
Sebastian Stark
4,808938
-k will use kerberos authentication, so if you have a ticket from a principal that can create computer objects in AD, the net ads join command will work without providing any further credentials.
The process would be:
get ticket:
kinit <user>, where<user>is e. g. a Domain Admin accountexecute the join:
net ads join -k
You can do this from within a script. You can even consider using msktutil to do this, in case you do not want to have all the samba stuff installed on the client. The msktutil would replace the net ads join command.
As to fully automating that is a bit of a vague question, but the key concept would be to have some way to pre-create the computer accounts in the AD (you can use msktuil, net ads or the Windows GUI for this), then use one of the tools to actually join the client using some default password.
If you have a separate admin group managing the AD they will probably pre-create the computer objects for you. If you have to do that yourself I do not see much usefulness in automating this anyway, as it won't save you any work.
answered Dec 13 at 18:17
Sebastian Stark
4,808938
edited Dec 15 at 21:11
answered Dec 13 at 18:17
Sebastian Stark
4,808938
answered Dec 13 at 18:17
Sebastian Stark
4,808938
answered Dec 13 at 18:17
Sebastian Stark
4,808938
4,808938
Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
– Oskar L
Dec 14 at 9:11
check thecreatecomputeroption for net ads join for the OU.
– Sebastian Stark
Dec 15 at 21:13
add a comment |
Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
– Oskar L
Dec 14 at 9:11
check thecreatecomputeroption for net ads join for the OU.
– Sebastian Stark
Dec 15 at 21:13
Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
– Oskar L
Dec 14 at 9:11
Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
– Oskar L
Dec 14 at 9:11
check the
createcomputer option for net ads join for the OU.– Sebastian Stark
Dec 15 at 21:13
check the
createcomputer option for net ads join for the OU.– Sebastian Stark
Dec 15 at 21:13
add a comment |
Oskar L is a new contributor. Be nice, and check out our Code of Conduct.
Oskar L is a new contributor. Be nice, and check out our Code of Conduct.
Oskar L is a new contributor. Be nice, and check out our Code of Conduct.
Oskar L is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1100385%2fkerberos-and-ubuntu-18%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Have you set up Kerberos on your realm, or have it set up for you? If not, this is a pretty tall order for a single question. Standard ref: help.ubuntu.com/lts/serverguide/kerberos.html
– jdv
Dec 12 at 17:26
Yes, sorry I have setup kerberos as well as I have all configuration files in place for sssd and samba. Everything works fine manually I've even setup network hares to mount automatically. However I am looking for a way to automate this specific part. I know I can write a script to do this and either save the credentials or provide them at this point or before hand but I was wondering if there is a way of automating this fully.
– Oskar L
Dec 13 at 9:03
1
You should say this in the question, not a comment. Edit the question and make sure everything someone needs to help you is in there.
– jdv
Dec 13 at 14:37