<h1class="post-title"><ahref="https://paulwilde.uk/ponderings/joining-debian-to-ad-domain/">Joining Debian Linux (Desktop) to an Active Directory Domain</a></h1>
<p>I'll be running through the process I use for joining Debian Linux as a desktop to Active Directory. The steps should be fairly generic as they use packages available in most distributions, so adapt to your distro as required.<br/>
This follows <ahref="https://www.pierreblazquez.com/2024/02/04/how-to-join-debian-12-to-an-active-directory-domain/">this article</a> quite closely, with some changes.</p>
<p>I use <code>neovim</code> as an editor, aliases to <code>vim</code>. If you use another editor then replace <code>vim</code> with your editor i.e. <code>nano</code> in all cases.</p>
<h2id="required-packages">Required Packages</h2>
<p>First things first we need the right packages installed. This can be done by the following command:</p>
<li><code>sssd</code> is a set of services and tools to manage the connection to the domain.</li>
<li><code>pam</code> handles general user authentication, and creation of mounts for network shares etc.</li>
<li><code>realmd</code> is a tool providing a simple way to discover and join domains.</li>
<li><code>krb5</code> is a kerberos (authentication token) handler amongst other things.</li>
<li>The other packages like <code>*-ldap</code>, <code>adcli</code> are further tools use for domain administration.</li>
</ul>
<p>For the most part, when we say <code>realm</code> we mean your windows "domain name". We'll be using <strong>YOURDOMAIN.LOCAL</strong> as an example.</p>
<h2id="joining-the-domain">Joining the Domain</h2>
<p>This is at its simplest a case of configuring basic <code>krb5</code> and using <code>realm join</code> to actually join the domain.</p>
<h3id="configuring-krb5">Configuring krb5</h3>
<p>Edit the <code>krb5.conf</code> file to set the default realm:</p>
</span><spanstyle="color:#f78c6c;">default_realm </span><spanstyle="color:#89ddff;">= </span><spanstyle="color:#f78c6c;">YOURDOMAIN</span><spanstyle="color:#89ddff;">.</span><spanstyle="color:#f78c6c;">LOCAL </span><spanstyle="font-style:italic;color:#4a4a4a;"># Should be in CAPS
</span></code></pre>
<p>This will allow the krb5 client to identified the default realm. If you don't set this, then a realm will need to be specified with every kerberos request i.e. with <code>kinit</code>.</p>
<h3id="realm-join">Realm Join</h3>
<p>Realmd handles a massive amount of the work here. It used to be we had to manage a lot of this configuration ourselves, but realm now does a lot of it for us.</p>
<p>You can discover information about the local domain by issuing the below command</p>
<predata-lang="sh"style="background-color:#212121;color:#eeffff;"class="language-sh "><codeclass="language-sh"data-lang="sh"><spanstyle="color:#82aaff;">realm list
<p>Technically now the computer is joined to the domain and can authenticate. You can test with:</p>
<predata-lang="sh"style="background-color:#212121;color:#eeffff;"class="language-sh "><codeclass="language-sh"data-lang="sh"><spanstyle="color:#82aaff;">kinit </span><spanstyle="color:#89ddff;">{</span><spanstyle="color:#82aaff;">domain user</span><spanstyle="color:#89ddff;">} </span><spanstyle="font-style:italic;color:#4a4a4a;"># will authenticate as that user
</span><spanstyle="color:#82aaff;">klist </span><spanstyle="font-style:italic;color:#4a4a4a;"># to show the kerberos token validity
</span><spanstyle="color:#82aaff;">kdestroy </span><spanstyle="font-style:italic;color:#4a4a4a;"># deauthenticate as that user
</span></code></pre>
<p>Or, of course, log out and back in as a domain user account.</p>
<h3id="tuning-sssd">Tuning SSSD</h3>
<p>Open up your <code>/etc/sssd/sssd.conf</code> file and make a few tweaks</p>
</span><spanstyle="font-style:italic;color:#4a4a4a;">#services = nss, pam # commented out as these are socket units which are dynamically handled by systemd
</span><spanstyle="color:#f78c6c;">implicit_pac_responder </span><spanstyle="color:#89ddff;">= </span><spanstyle="color:#f78c6c;">false </span><spanstyle="font-style:italic;color:#4a4a4a;"># having set to true allegedly crashed some SSSD services. It's not essential.
</span><spanstyle="font-style:italic;color:#4a4a4a;"># This next one was a real fix for me. I had some issues where a Group Policy was unreadable which crashed SSSD and prevented the user from logging in. Windows would silently ignore it, so never an issue. I like the fact it was highlighted to me, but is not ideal for a production machine where people need to log in. So we ignore unreadable GPOs.
<p>and make sure to check <code>[*] Create home directory on login</code> is enabled.<br/>
This will allow the system to validate the user again the domain, create the user's home directory and mount the user's network shares if set.</p>
<h3id="sudo">Sudo</h3>
<p>There's a chance you may want domain administrators to have sudo privileges. This can be done by adding the following line to <code>/etc/sudoers</code></p>
<p>There are a couple of further notes regarding GVFS and automatically mounting network shares in <ahref="https://www.pierreblazquez.com/2024/02/04/how-to-join-debian-12-to-an-active-directory-domain/">the article mentioned at the start</a>, if you need those things in place I recommend checking through that article as well.</p>
<h2id="testing">Testing.</h2>
<p>We should be good to go. Let's run some tests.</p>
<predata-lang="sh"style="background-color:#212121;color:#eeffff;"class="language-sh "><codeclass="language-sh"data-lang="sh"><spanstyle="color:#82aaff;">systemctl status
</span><spanstyle="font-style:italic;color:#4a4a4a;"># If the state is `degraded` you can see failed services by running this command
<p>I experienced some issues with SSSD failing due to unreadable GPOs mentioned above. I discovered SSSD crashed when trying to log in, and adding the SSSD option to ignore unreadable GPOs fixed it.</p>
<h2id="login">Login</h2>
<p>Great! We're here. Now we can log in.
Either log in using the desktop login screen, or from a terminal enter:</p>
<p>You can edit <code>/etc/security/pam_mount.conf.xml</code> to enable automatic mounting of shared folders at login. I have had mixed success with this, but I'll put it here anyway:</p>
