How to join Centos 7/ Rhel 7 servers to Active Directory Domain?

We will need the following packages installed on the CentOS / RHEL server:

  • realmd: This manages enrolment and membership to the Active Directory domains
  • samba: This denotes the Samba services
  • samba-common: This denotes the shared tools for servers and clients
  • oddjob: This is a D-bus service that runs the odd jobs for clients
  • oddjob-mkhomedir: This is used with the odd job services to create home directories for AD accounts if needed
  • sssd: The System Security Services daemon can be used to divert client authentication as required
  • adcli: These are the tools for joining and managing AD domains

Use the following command to install the required packages:

[root@ylclsrv001 ~]# sudo yum install oddjob realmd samba samba-common oddjob-mkhomedir sssd adcli


To discover a Domain Identity we will use the realm discover command, that will return a complete domain configuration and a list of packages that must be installed for the system to be enrolled in the domain.

  [root@ylclsrv001 ~]# realm discover ucartz.local
  ucartz.LOCAL
  type: kerberos
  realm-name: ucartz.LOCAL
  domain-name: ucartz.LOCAL
  configured: no
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common-tools
  ucartz.local
  type: kerberos
  realm-name: UCARTZ.LOCAL
  domain-name: ucartz.local
  configured: no

 To join the AD domain, add the computer to the default folder in the AD domain using the following command:

sudo realm join --user=administrator@ucartz.local ucartz.local
Password for administrator@ucartz.local:

 If you want to add it to a designated Organizational Unit within the Active Directory, you will first need to create the OU, or at least ensure that it exists. The following command we will join the server to AD Domain and add Computer Account to the Linux OU:

[root@ylclsrv001 ~]# sudo realm join --user=administrator@ucartz.local --computer-ou=OU=Linux,OU=Servers,DC=ucartz,DC=LOCAL ucartz.local
Password for administrator@ucartz.local:


 If you got this error ” realm: Couldn’t join realm: Joining the domain UCARTZ.LOCAL failed“, just restart the realm and retry again

 To test the system was successfully joined the domain use the below command:

  [root@ylclsrv001 ~]# realm list
  UCARTZ.LOCAL
  type: kerberos
  realm-name: UCARTZ.LOCAL
  domain-name: ucartz.local
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common-tools
  login-formats: %U@ucartz.local
  login-policy: allow-realm-logins

 To display information about a user from the domain, run the following command:

# id yl01@ucartz.local 
uid=344601106(yl01@UCARTZ.LOCAL) gid=344600513(domain users@UCARTZ.LOCAL) groups=344600513(domain users@UCARTZ.LOCAL),344601107(linuxadmins@UCARTZ.LOCAL)

 To permit only specific accounts from the domain to log in, use the following command: this command will change the mode to only allow logins by specific accounts, and then add the specified accounts to the list of accounts to permit.

[root@ylclsrv001 ~]# realm permit  User1@ucartz.local User2@ucartz.local

 To permit only one Active Directory group to log in using the following command: in this Example, we will allow the Linux admins AD group to login to the system

[root@ylclsrv001 ~]# realm permit -g LinuxAdmins@ucartz.local

 To give sudo permissions to an Active Directory group, in this example we will add LinuxAdmins AD group to sudoers by running the visudo command and add the following line:

# visudo
%LinuxAdmins@ucartz.local        ALL=(ALL)       ALL

 To leave an Active Directory domain, you can use the below command:

# realm leave --user=--user=administrator@ucartz.local ucartz.local


 If you want to leave the domain and to delete the computer Account you can use the additional option –remove at the end of the command

# realm leave --user=--user=administrator@ucartz.local ucartz.local --remove
Password for administrator@ucartz.local:

 
We hope this tutorial was enough Helpful. If you need more information or have any questions, just comment below and we will be glad to assist you!

Was this answer helpful? 0 Users Found This Useful (0 Votes)