Join Ubuntu to Active Directory for SSH AD Authentication

To join your Ubuntu desktop or server to Active Directory for SSH AD authentication, ensure your machine is on the correct network and can communicate with the domain controller. You'll need an Active Directory user account with sufficient privileges to join the domain.

apt-get -y install winbind libpam-winbind libnss-winbind krb5-config samba-dsdb-modules samba-vfs-modules

When prompted, enter your REALM (example.com) and the AD server hostname (myserver). Once installation is complete, edit the following files:

Edit Configuration Files

smb.conf

vi /etc/samba/smb.conf

Add or alter the following:

workgroup = myserver
realm = example.com
security = ads
idmap config * : backend = tdb
idmap config * : range = 3000-7999
idmap config FD3S01 : backend = rid
idmap config FD3S01 : range = 10000-999999
template homedir = /home/%U
template shell = /bin/bash
winbind use default domain = true
winbind offline logon = false

nsswitch.conf

vi /etc/nsswitch.conf

Add the following at the bottom of the config file:

passwd:     compat systemd winbind
group:     compat systemd winbind

common-session

vi /etc/pam.d/common-session

Add the following to the bottom of the config file:

session optional        pam_mkhomedir.so skel=/etc/skel umask=077

Join the Domain

net ads join -U Administrator

Note that joining a domain requires DNS. Ensure your machine can resolve the domain name and, where possible, add the domain/AD server to the hosts file:

vi /etc/hosts
192.x.x.x myserver example.com

Restart winbind:

systemctl restart winbind

Testing

Use wbinfo to query users or groups:

wbinfo -u
wbinfo -g