Introduction
Many services (such as the database server) make use of PAM for authentication. In this tutorial, we will be setting up our primary server to use our Active Directory as a source for PAM.
Edit the /etc/pam.d/service file
We need to modify the /etc/pam.d/service file on our server to make use of the winbind service. We can do that using the following command:
# sudo nano /etc/pam.d/service
We need to edit that file to have the following:
... auth required pam_env.so auth sufficient pam_unix2.so +++ auth required pam_winbind.so use_first_pass account requisite pam_unix2.so +++ account required pam_winbind.so use_first_pass +++ password sufficient pam_winbind.so password requisite pam_pwcheck.so cracklib password required pam_unix2.so use_authtok session required pam_unix2.so +++ session required pam_winbind.so ...
Save the file.
Edit the /etc/security/pam_winbind.conf file
We need to modify the /etc/security/pam_winbind.conf file on our server to configure the winbind service. We can do that using the following command:
# sudo nano /etc/security/pam_winbind.conf
We need to edit that file to have the following:
debug = no # Gives debugging output to syslog. Defaults to "no". debug_state = no # Gives detailed PAM state debugging output to syslog. Defaults to "no". require_membership_of = OFFICE.LAN\users # Must be a member of the '''users''' group to access the server. try_first_pass = yes krb5_auth = yes # authenticate using Kerberos and Active Directory krb5_ccache_type = cached_login = no silent = no mkhomedir = yes warn_pwd_expire = 21
Save the file
PAM should now authenticate to you Active Directory.