Updated for F8
I see there's posts every now and then about people trying to join a fedora workstation to a domain and different suggestions of how to do it so here's a very easy way to join it and set up automounting network shares at login. This guide also contains other things you might want to do
First I'll answer some questions you may have:
Is this the only way to join fedora workstation to a domain? no.
Is this the best way? I seriously doubt it.
Is this easy? i've seen harder
Should I of put these steps in better order? definitely but they still work.
Does the server need to be modified in any way? NO, put down that keyboard and leave it alone.
Is this the place to ask for other types of network configurations? No, i'm not a network admin and have no clue how to set that stuff up or even how other configs work.
What if you follow these and it doesn't work?
GOOGLE IT.
YOU are responsible for backing up all files you modify and knowing what the originals are if you ever need them. This can be easily done with a command like
For these examples the domain name is
Test.com
Do everything below on your fedora workstation.
Part 1, Joining fedora to the domain
1. You need samba
Code:
yum groupinstall "Windows File Server"
you likely will already have this installed so don't worry if yum does nothing here.
see picture in post #2
2. Set the hostname, run
Code:
system-config-network
Under the dns tab set a name for the computer. Make sure the hostname is unique or else you will suffer the consequences on a later day. Save and exit. What consequenses you're wondering? Well you could overwrite another workstation's account kicking it off the domain.
see picture in post #2
3. Say goodbye to SELinux. run
Code:
system-config-selinux
if it says 'enforcing' change it to 'disabled' or 'permissive'.
If you leave selinux as enforcing, you will not be able to log in on an ads account
see picture in post #2
4. Enter the network settings, run
Code:
system-config-authentication
In the first tab check enable winbind support. Then Under the authorization tab also enable winbind support. Then click on configure and enter the appropriate information for your network.
Winbind domain is your short domain name. For our example domain, enter
test
For security model select
ads
Winbind ADS Realm under our example enter
test.com
Winbind Domain Controllers is your primary domain controller (pdc) if you don't know what this is ask your network admin.
For template shell select
/bin/bash.
5. Caching
(Optional).
Caching allows you to log into a machine with your network account when it is outside the network. This is really only useful for laptops. If you would like this then place a tick where it says "Allow offline login". If you enable both caching and also set up automounting in part 2 of this guide, you will run into difficulties when logging in outside the network. This will result from pam_mount not being able to mount the network shares. As of yet I cannot find a solution for this.
Live with it.
Now hit ok to everything and close the window.
6. In the terminal, as root type
Code:
net ads join -U administrator
where administrator is a network account with permissions to join the computer to the domain, it doesn't actually have to be
administrator.
If you get an error you probably entered some information wrong. Double check and make sure everything is right. If you feel everything is right I suggest searching google for an answer since that is always the fastest way.
7. Modify /etc/pam.d/system-auth and at the bottom add this line
Code:
session required pam_mkhomedir.so skel=/etc/skel umask=0077
8. Set the default login domain to be on your domain. Edit /etc/samba/smb.conf and at line 71 or close to it you'll see the line
Code:
winbind use default domain = false
change the false to true. If you don't see it at line 71 search around. You should see that line around your domain realm and password server information. After making this change you must restart winbind to do this type
Code:
/sbin/service winbind restart
9. (The easiest step) Create the folder /home/TEST where TEST is your domain name in all caps
At this point you should be able to log onto the domain. Test it out in a tty session (ctrl+alt+f[1-6]). Log in with your domain username and password. You'll get messages about the home folder being created, that is good. If it doesn't work make sure you're joined to the domain and the /etc/pam.d/system-auth file is correct. If you are able to login in the terminal make sure you can login in X also (if desired). Also if it doesn't work try logging in as domain\username and see if that works. If that does you did step 8 wrong.
Part 2, Automouting. Skip down if u don't want this
Now let's setup fedora to automount a users network share at login.
This only works if the user's login and password are the same as the one for the share
1. First we need to inall pam_mount
Code:
yum install pam_mount
2. Now we need to allow pam_mount to access the password as you login. Edit /etc/pam.d/system-auth and add the line
Code:
auth required pam_mount.so
There can be no auth lines containing sufficient before the above one, or else it won't work. Then somewhere at the bottom add
Code:
session optional pam_mount.so
3. Edit /etc/security/pam_mount.conf. Scroll down to line 72 where you see the line
Code:
options_require nosuid, nodev
comment that line out by placing a # in front.
4. Scroll down further to line 116 where you see
Code:
# volume <user> [cifs|ncp|nfs|local] <server> <volume> <mount point> <mount options> <fs key cipher> <fs key path>
and using that as your guide add the appropriate line diectly after it. Here's a sample
Code:
volume * cifs server share /home/TEST/&/mountpoint - - -
This is what's called a template and it will only work for all users if they all have access to that share or if the share is the same as their account name. If the share name is the same as their account put a & where it says
share. If this doesn't work for you read the next step. DON"T use smb as since FC5, support was no longer included to mount the smb file system, instead use cifs, it's basically the same thing but a different name.
The * stands for the user logging in and the & is the account name. ~ is replaced by the user's home folder. The mountpoint should be placed in the users home folder as shown so that more than one user can be logged in at a time without causing problems. For more info on options read the entire /etc/security/pam_mount.conf file, it is very detailed and helpful.
5. If you can't use a template then you must create an entry in /etc/security/pam_mount.conf for each user. Use the guide above and only change the * to their account name and the share to their share and have fun if you have many users. Alternatively if you can get their network share from the account name then you can create a script and make them log on, off, and back on the first time. I'll attach an example script. Edit /etc/skel/.bashrc and add an entry to run it something like
Code:
/location_to_script/script.txt
and also change the appropriate values in the script. Then
Code:
chmod a+x script.txt
Also edit /etc/security/pam_mount.conf and at line 38
Code:
luserconf .pam_mount.conf
uncomment it by removing the #. The only downside to using a script is then the user is forced to login, then off, and back on again the very first time.
6. Create the folder
mountpoint in your network account home folder. Then log off and back on in a tty (ctrl+alt+f[1-6]),
NOT X and check if the folder was mounted properly. If it wasn't, scroll up and read all that junk from when you logged in. Specifically see what it says about the share, server and mountpoints and make sure those are all correct and check to see if there are any errors. Once you get it to work edit /etc/security/pam_mount.conf and at line 8 change
to
Also create the
mountpoint folder in /etc/skel/ so each new user automatically has it made for them.
Part 3, Final configuration tips.
1. Set up plugins for firefox or mozilla globally like this
Code:
cd /usr/lib/mozilla/plugins
ln -s /usr/java/jre1.6.0_03/plugin/i386/ns7/libjavaplugin_oji.so
ln -s /usr/local/Adobe/Acrobat8.0/Browser/intellinux/nppdf.so
flash and mplayerplug-in are already installed globally
if you don't have all these plugins but would like them check
FedoraFaq.
2. I like to create a new local user, login and set up kde or gnome if that's your thing, firefox and everything else so it looks how I want it to. Then copy the folders .kde (or appropriate gnome folder) and .mozilla to /etc/skel/.
3. If you feel like it in kde under kcontrol, peripherals, keyboard. Click the box that says to turn numlock on by default. Nothing is more annoying than numlock always being off.
Attachments
Here are some attachments of what the files look like on the machines I use. The script there assumes that your login is first.last and the share is last.first make sure you change the appropriate values in it.
Warning:If you uninstall pam_mount after setting this all up you will NOT be able to log into your system at all. You must undo all the changed made to the files in the /etc/pam.d folder
before uninstalling pam_mount.
Any ideas?
Linear Mode
