AIX Integration in to Active Directory
Integrating an AIX system in to Active Directory is not entirely straight forward. Integration in to an Active Directory domain for user authentication can be done utilizing the following steps (similar to that found in http://us1.samba.org/samba/ftp/Binary_Packages/AIX/README):
- Download and install the krb5.client.rte package for AIX.
- Download the pre-built AIX 5.2 (compatible with AIX 5.3) binaries from the SAMBA web site (http://us1.samba.org/samba/ftp/Binary_Packages/AIX/) to a temporary location.
- Use “gunzip” to decompress each of the files (eg: gunzip opt-samba-base.tar) in the same directory. The result will be a bunch of *.bff files. These are considered “backup files” in AIX, but, essentially, are the same thing as if they were archives.
- Use either:
- installp -agYX -d. all
- Start up “smit” and navigate to “Software Installation and Maintenance”->”Install and Update Software”->”Install Software”
- Enter in the full path to the temporary directory that the .bff files are stored in and hit “enter”
- On the new menu, use the arrow keys to navigate down to the line for “ACCEPT new license agreements” and hit “tab” to change the value to “yes”. Hit enter to start the install.
- Install the /opt/pware/samba/3.0.28/lib/smb.conf file which has all of the configuration necessary to properly join to the domain.
- With the packages now installed, edit /etc/krb5/krb5.conf to look like:
- [libdefaults]
default_realm = AD.DOMAIN
default_keytab_name = FILE:/etc/krb5/krb5.keytab
default_tkt_enctypes = des-cbc-crc des-cbc-md5
default_tgs_enctypes = des-cbc-crc des-cbc-md5[realms]
AD.DOMAIN= {
kdc = ad.server.ad.domain:88
admin_server = ad.server.ad.domain:464
default_domain = AD.DOMAIN
}[domain_realm]
.AD.DOMAIN = AD.DOMAIN
ad.server.ad.domain=AD.DOMAIN[logging]
kdc = FILE:/var/krb5/log/krb5kdc.log
admin_server = FILE:/var/krb5/log/kadmin.log
default = FILE:/var/krb5/log/krb5lib.log
- [libdefaults]
- Run : kinit Administrator@AD.DOMAIN to get a kerberos ticket. You will be prompted to enter the domain administrator account password.
- Join the computer to the windows domain: /opt/pware/samba/3.0.28/bin/net ads join -U Administrator , and enter the domain administrator account password when prompted.
- Start winbind: /opt/pware/samba/3.0.28/sbin/winbindd
- Confirm that you are able to see the active domain users via: wbinfo -u
- To enabled command line login access, edit /etc/security/user. Look for the link that reads “SYSTEM =” in the default: settings. Change it to look like : SYSTEM = “WINBIND”.
- To complete the process, edit /usr/lib/security/user to include the following code at the end:
- WINBIND:
program = /usr/lib/security/WINBIND
options = authonly
- WINBIND:
- Copy the WINBIND security binary in to place: cp /opt/pware/samba/3.0.28/lib/security/WINBIND /usr/lib/security/WINBIND
At this point, without restarting any daemons or anything, you should be able to access and log in as any active directory user. Your home directory probably won’t mount, but you should be able to successfully log in anyhow:
]# telnet aixserverTrying 10.10.10.75...Connected to aixserver.Escape character is '^]'.telnet (aixserver)AIX Version 5Copyright IBM Corporation, 1982, 2007.login: myadaccountmyadaccount's Password:******************************************************************************** ** ** Welcome to AIX Version 5.3! ** ** ** Please see the README file in /usr/lpp/bos for information pertinent to ** this release of the AIX Operating System. ** ** ********************************************************************************3 unsuccessful login attempts since last login.Last unsuccessful login: Thu Sep 4 15:20:34 EDT 2008 on ssh from yourmachine.ad.domainLast login: Thu Sep 4 14:23:23 EDT 2008 on /dev/pts/1 from yourmachine.ad.domain3004-614 Unable to change directory to "/home/ADDOMAIN/myadaccount".You are in "/" instead.-bash-3.00$
2 Comments
theiosx
Yes it works, but is it possible to create home dirs for AD users automaticaly ?
Rich
You’d have to do that on the AIX side by enabling that feature upon login.
chsec -f /etc/security/login.cfg -s usw -a mkhomeatlogin=true
Basically if the user’s home directory does not exist, AIX will create it for them based upon the system skeleton files.