Integrating Red Hat Enterprise Linux 6 with Microsoft Active Directory Presentation

Transcription

1 Integrating Red Hat Enterprise Linux 6 with Microsoft Active Directory Presentation

2 Agenda Overview Components Considerations Configurations Futures Summary

3 What is needed? Thorough understanding components, interactions Awareness of technical, non-technical considerations Comparison of configurations, options Best practices, guidelines Assistance in making a selection

4 Windows Consumer Perception To the cloud...yay cloud

5 Windows Systems Reality Help!

6 Overview Components Considerations Configurations Futures Summary

7 Components - Overview Red Hat Enterprise Linux Windows Server 2008 R2 Active Directory Kerberos LDAP SSSD Samba SMB/CIFS Winbind NSS DNS NTP * Let's examine several core components closer *

8 Active Directory Domain Services (AD DS) Suite of directory services Customized versions: Kerberos Domain Name System (DNS) Lightweight Directory Access Protocol (LDAP) Object hierarchy nodes, trees, forests, domains Renamed in Windows Server 2008 R2 * Included Windows Server 2008 R2 (Server Role) *

9 Samba Open source suite of programs Provides file and print services Includes two daemons: smbd (file and print services) nmbd (NetBIOS name server) Samba v3.5 is current version (RHEL 6) * Behavior configured by /etc/samba/smb.conf *

10 SMB/CIFS Client-server communications protocols Server Message Block (SMB) - IBM developed Common Internet File System (CIFS) MS extended Both protocols used interchangeably SMB older, legacy servers (Windows 2000) * Samba supports both protocols *

11 Winbind (1) Daemon included with Samba suite Unified logon to Active Directory accounts Minimizes need for separate accounts Primary functions: Authentication of user credentials ( Who ) ID Tracking/Name Resolution via nsswitch ( Where ) ID Mapping of UID/GID <-> SID ( What )

12 Winbind (2)

13 Winbind (3) ID Mapping implemented through backends ~8 backends available ID Mappings classified as: Allocating (r/w, local) Algorithmic (r/o, calculated, consistent) Assigned (r/o, assigned in AD, consistent) Each has advantages, disadvantages * See Reference Architecture for further details *

14 SSSD (System Security Services Daemon) RHEL systems members of centralized IdM solution (Active Directory, IPA, LDAP, Kerberos) Access to different identity, authentication providers (e.g. - LDAP native, LDAP w/kerberos) Extensible (new identity, authentication sources) Supports off-line caching (clients) Reduces load on identity servers * Extensible, enhanced alternative to Winbind *

15 Kerberos Current version = V5 Clients request ticket from trusted third party (KDC) Key distribution center (KDC) = AD server Behavior configured by /etc/krb5.conf Managed by PAM libraries: pam_winbind (Samba), pam_sss (SSSD), pam_krb5 Integration best practice: * Install krb5-workstation for testing/troubleshooting *

16 Overview Components Considerations Configurations Futures Summary

17 Non-technical Considerations Organizational Alignment Expertise Levels Scope/Complexity Prototype Project Deployment

18 Technical Considerations File Sharing File sharing required? Yes = Samba based configuration No = Samba or non-samba ok Where are file shares located? Client side? Server side? * Red Hat Enterprise Linux supports both roles *

19 Technical Considerations Login Access Red Hat Enterprise Linux login access required? Command Line Interface (CLI) Graphical Display Manager (GDM) Local vs. Active Directory accounts Local accounts = more administration Active Directory = centralized administration * Active Directory accounts require AD integration *

20 Technical Considerations AD ID Attributes RFC2307/bis Extends UNIX ID attributes via LDAP Provides more flexibility, control (home dir, shell) Enabling in Windows Server 2008 R2 => Identity Management for UNIX (IMU) role 2008, 2003 R2 => Identity Management for UNIX (IMU) service 2003 and earlier => Windows Services for UNIX (SFU) service * Organizational policy may restrict use *

21 Technical Considerations Enumeration Winbind listing of users, groups in AD domain Default behavior during user login, authentication More users = longer login time Integration best practice: * Disable in environments 20,000+ users * /etc/samba/smb.conf [global] winbind enum users = no winbind enum groups = no

22 Technical Considerations LDAP Referrals LDAP in Active Directory scales out over time Objects relocate across multiple domain controllers LDAP referral Responding domain controller can't find object Clients contact multiple controllers to complete lookup Integration best practice: * Disable for performance (if no partial replication) * /etc/sssd/sssd.conf ldap_disable_referrals = true

23 Overview Components Considerations Configurations Futures Summary

24 Recommended Configurations - Overview Configuration 1. Samba/Winbind (idmap_rid) 2. Samba/Winbind (idmap_ad) 3. SSSD/Kerberos/ LDAP 4. Kerberos/LDAP Services Provided Features File sharing Login access File sharing Login access Login access Login access Templated shell, home dirs Least intrusive to AD (No user/group ID attribute changes) Algorithmic ID mappings Customizable shell, home dirs Centralized user mgmt Assigned ID mappings User/group ID attributes set in AD (requires IMU) Advanced authentication, caching Reduces client loading on server User/group ID attributes set in AD (requires IMU) No off-line caching user credentials User/group ID attributes set in AD (requires IMU) Use Case Template-driven Customizable Enhanced Legacy * See Reference Architecture for details *

25 Configuration 1 (winbind idmap_rid) Template-driven

26 Configuration 1 (Authentication and ID Components )

27 Configuration 2 (winbind - idmap_ad) Customizable

28 Configuration 2 (Authentication and ID Components )

29 Configuration 3 (SSSD/Kerberos/LDAP) Enhanced

30 Configuration 3 (Authentication and ID Components )

31 Configuration 4 (Kerberos/LDAP) Legacy

32 Configuration 4 (Authentication and ID Components )

33 Overview Components Considerations Configurations Futures Summary

34 Futures Winbind idmap_autorid New backend for Samba 3.6/RHEL 6.4 Automatically allocates domain ranges SSSD Active Directory domain trust support (RHEL 6.4) New AD integration capabilites - ID Mapping, etc. (RHEL 6.4+) Fully featured, enhanced alternative to Winbind Red Hat Enterprise Linux 7 Windows interoperability remains high focus

35 Overview Components Considerations Configurations Futures Summary

36 Summary (1) First glance deceptively simple Second glance appears overwhelming Many variables, components, interactions Reference Architecture simplifies selection, deployment and integration: integrating-red-hat-enterprise-linux-6-with-active-directory See Customer Portal for additional materials:

37 Summary (2) Select best configuration for your environment, organizational goals Hybrid configurations ok to consider Third-party products viable alternatives Prototype, test in advance Most issues have simple causes Red Hat Enterprise Linux integrates well with Windows Active Directory