Central Authentication & Authorization Service For RedHat Environment With Active Directory

This method uses Microsoft Active Directory service for a central authentication & authorization of users.

This method uses Microsoft Active Directory service for a central authentication & authorization of users. When creating account for users in AD, their public key is also stored as a parameter within the AD. When a user tries to login into a Red-hat server using private key, the sshd service checks if user accounts exist by communicating with AD via sssd service. If the user exists, then sshd service runs a script to fetch the public key of that user (stored in a parameter on AD). The user is then authenticated and successfully logged in. The new users can be created, and older user can be disabled from a central location. All other advance AD features can be used with Linux servers as well.

1. Integration of Linux Hosts with Active Directory

Network Changes

Edit the file /etc/resolv.conf and add Active Directory Domain Controller

Add a new entry in the file /etc/hosts

Install Required Packages

Install following packages to connect to Active Directory.

Connection to Domain Controller

Use the following command to connect to Domain

Edit the file /etc/sssd/sssd.conf and add a new service and tag for ssh

Change the following

and add a line at the end

To check the connectivity with Domain, restart sssd service.

Now try to fetch account info from Domain

Configure SSH Authentication

Edit file /etc/ssh/sshd_config and make following changes

To disable password logins

LDAP Script

Create a script as /opt/ldap.sh

The script runs a ldap query against the Domain server to fetch the public key.It needs the password for auth account as well as execute permissions chmod +x /opt/ldap. The auth account needs to be created on AD(with minimum permissions).

Grant Sudo Access

Create a sudoers group on Domain server and edit the file on Linux using

and Add the following entry at the end

Needs to restart sssd & sshd service

2. Public Keys implementation in Active Directory

In Users & Groups Section, Go to the User properties, from the Attribute Editor tab change the paramter userParameters and paste the public key.

To show the Attribute Editor tab look in to the views tab to show Advance features. Puttygen can be used for creating Private/Public Keys.

Troubleshooting Tips

In-case of authentication errors.

Check if you can get the public key by running the script manually.

Check if Se-Linux is blocking your script from running.

Try running ssh with debug option & tail the logs for errors.