SSSD for Linux Authentication with Active Directory Frank Penrose, Casey Coughlen – Engineering IT Erik Coleman, Devin Gengelbach – Technology Services

Linux Authentication with AD Brief History Recent developments and plans Best practices Sample configs Open discussion on what is needed next

Brief History of Linux Auth w/AD

Brief History of Linux Auth w/AD

Homage to Our Linux Friends… David Anderson 1974-2012 Andrew Hurt 1976-2017

Active Directory – Linux Support What we’ve done so far POSIX (RFC 2307) Attribute Schema uidNumber generation for netids gidGroups for users

Active Directory – Linux Support What we’ve got left to do  Pre-populate homeDirectory: /home/netid  Pre-populate loginShell: /bin/bash

Best Practices Populate your created user and group objects with uidNumber and gidNumber less than 100000 Restrict your search bases for users and groups to only the campus OUs and OUs that are COMPLETELY within your control Put the group name for your own created groups into extensionAttribute12 If you use Kerberos for authentication, you should join your Linux computers to the Active Directory domain (Ask me why Engineering does NOT) Set a minimum allowed uidNumber and gidNumber above 500 Use allowed groups and restricted groups in conjunction with access.conf and TEST TEST TEST Monitor SSSD configurations over a few days before making production to ensure that caching is not running amok in the background

Sample Configurations Illinois Wiki Space – Book of Engineering Linux-> SSSD https://wiki.illinois.edu/wiki/display/boeli/SSSD Config review and Demo Time

Active Directory – Linux Support Other Issues NIS Groups UID numbers under 100000 Uniqueness of uidNumber / gidNumber Bear in mind IAMU role in this—providing authN/authZ infrastructure. We aren't going to be forcing ways to do things. That said, we have to caution the use of OUs as security boundaries

Give us your Feedback! What are we missing? What do you want to see? What about NIS Groups Global uidNumber  plan (< 100,000)