I've come across many articles about how to join a linux system to a Microsoft +Active Directory domain and they all work more or less with some tweaking. This is +my article, here describing my own processes for doing it, trying to explain each +bit as it comes.
+Part of a "Using Linux in a Windows Domain" group of posts.
+This article is for desktop Debian Linux - for setting up a PC so it can be used by a standard user of the PC.
A simple battery monitor tool that can notify you on battery status changes for FreeBSD.
-Inspired by but in no way similar to batsignal - inspiring the basic function only.
-Written in pure Nim.
I've come across many articles about how to join a linux system to a Microsoft +Active Directory domain and they all work more or less with some tweaking. This is +my article, here describing my own processes for doing it, trying to explain each +bit as it comes.
+Part of a "Using Linux in a Windows Domain" group of posts.
+This article is for desktop Debian Linux - for setting up a PC so it can be used by a standard user of the PC.
I recently had a issue logged by a client where a room calendar in Microsoft Exchange 365,
+when invited to a meeting, shows the organizer's name in the subject instead of the actual subject.
+This may well be a desirable feature, but in the case it isn't, this is how it can be resolved.
Hello. How are you? I am fine.
-
-You may know me from a few places, but likely on the Fediverse as the person that
-maintains a BirdsiteLIVE instance with the url birdsite.wilde.cloud.
SELECT haiku FROM
-tableHaikus WHERE LEFT(name,
-3) LIKE 'SQL';
-I've come across many articles about how to join a linux system to a Microsoft +Active Directory domain and they all work more or less with some tweaking. This is +my article, here describing my own processes for doing it, trying to explain each +bit as it comes.
+Part of a "Using Linux in a Windows Domain" group of posts.
+This article is for desktop Debian Linux - for setting up a PC so it can be used by a standard user of the PC.
I'll be running through the process I use for joining Debian Linux as a desktop to Active Directory. The steps should be fairly generic as they use packages available in most distributions, so adapt to your distro as required.
+This follows this article quite closely, with some changes.
I use neovim as an editor, aliases to vim. If you use another editor then replace vim with your editor i.e. nano in all cases.
First things first we need the right packages installed. This can be done by the following command:
+# apt install realmd sssd samba-common krb5-user adcli libsss-sudo sssd-tools libsasl2-modules-ldap packagekit libpam-mount
+sssd is a set of services and tools to manage the connection to the domain.pam handles general user authentication, and creation of mounts for network shares etc.realmd is a tool providing a simple way to discover and join domains.krb5 is a kerberos (authentication token) handler amongst other things.*-ldap, adcli are further tools use for domain administration.For the most part, when we say realm we mean your windows "domain name". We'll be using YOURDOMAIN.LOCAL as an example.
This is at its simplest a case of configuring basic krb5 and using realm join to actually join the domain.
Edit the krb5.conf file to set the default realm:
vim /etc/krb5.conf
+[libdefaults]
+default_realm = YOURDOMAIN.LOCAL # Should be in CAPS
+This will allow the krb5 client to identified the default realm. If you don't set this, then a realm will need to be specified with every kerberos request i.e. with kinit.
Realmd handles a massive amount of the work here. It used to be we had to manage a lot of this configuration ourselves, but realm now does a lot of it for us.
+You can discover information about the local domain by issuing the below command
+realm discover
+# or
+realm discover YOURDOMAIN.LOCAL
+If all looks good you can join it
+realm join --user={your administrator account} YOURDOMAIN.LOCAL
+And to check everything is OK
+realm list
+which should output something like
+yourdomain.local
+ type: kerberos
+ realm-name: YOURDOMAIN.LOCAL
+ domain-name: yourdomain.local
+ configured: kerberos-member
+ server-software: active-directory
+ client-software: sssd
+ required-package: sssd-tools
+ required-package: sssd
+ required-package: libnss-sss
+ required-package: libpam-sss
+ required-package: adcli
+ required-package: samba-common-bin
+ login-formats: %U@yourdomain.local
+ login-policy: allow-realm-logins
+Technically now the computer is joined to the domain and can authenticate. You can test with:
+kinit {domain user} # will authenticate as that user
+klist # to show the kerberos token validity
+kdestroy # deauthenticate as that user
+Or, of course, log out and back in as a domain user account.
+Open up your /etc/sssd/sssd.conf file and make a few tweaks
vim /etc/sssd/sssd.conf
+Most of this will already be completed in your file as realmd handled it. But check over +it anyway.
+[sssd]
+domains = yourdomain.local
+config_file_version = 2
+#services = nss, pam # commented out as these are socket units which are dynamically handled by systemd
+implicit_pac_responder = false # having set to true allegedly crashed some SSSD services. It's not essential.
+
+[domain/yourdomain.local]
+access_provider = ad
+id_provider = ad
+default_shell = /bin/bash
+krb5_store_password_if_offline = True
+cache_credentials = True
+krb5_realm = YOURDOMAIN.LOCAL
+krb5_ccachedir = /tmp
+krb5_ccname_template = FILE:%d/.krb5cc_%U
+full_name_format = %1$s
+realmd_tags = manages-system joined-with-adcli
+fallback_homedir = /home/%u@%d
+override_homedir = /home/%u@%d
+ad_domain = yourdomain.local
+use_fully_qualified_names = False
+ldap_id_mapping = True
+dydns_update = False
+
+# This next one was a real fix for me. I had some issues where a Group Policy was unreadable which crashed SSSD and prevented the user from logging in. Windows would silently ignore it, so never an issue. I like the fact it was highlighted to me, but is not ideal for a production machine where people need to log in. So we ignore unreadable GPOs.
+ad_gpo_ignore_unreadable = True
+Now update the PAM modules
+pam-auth-update
+and make sure to check [*] Create home directory on login is enabled.
+This will allow the system to validate the user again the domain, create the user's home directory and mount the user's network shares if set.
There's a chance you may want domain administrators to have sudo privileges. This can be done by adding the following line to /etc/sudoers
%domainadmins ALL=(ALL:ALL) ALL
+Having Samba configured also helps streamline connectivity to network shares.
+vim /etc/samba/smb.conf
+[global]
+ workgroup = yourdomain.local
+ realm = YOURDOMAIN.LOCAL
+ encrypt passwords = yes
+ client protection = encrypt
+There are a couple of further notes regarding GVFS and automatically mounting network shares in the article mentioned at the start, if you need those things in place I recommend checking through that article as well.
+We should be good to go. Let's run some tests.
+systemctl status
+# If the state is `degraded` you can see failed services by running this command
+systemctl list-units --failed
+I experienced some issues with SSSD failing due to unreadable GPOs mentioned above. I discovered SSSD crashed when trying to log in, and adding the SSSD option to ignore unreadable GPOs fixed it.
+Great! We're here. Now we can log in. +Either log in using the desktop login screen, or from a terminal enter:
+login {user name}
+to log in as that user. The home directory should be created during login and everything is ready to go.
+You can edit /etc/security/pam_mount.conf.xml to enable automatic mounting of shared folders at login. I have had mixed success with this, but I'll put it here anyway:
...prefilled content...
+<!-- this should go somewhere before the `<mkmountpoint ... >` block.
+ <volume
+ fstype="cifs"
+ sgrp="domain users"
+ server="yourserver.yourdomain.local"
+ path="share"
+ mountpoint="~/Network Drives/Share"
+ options="vers=3.0,sec=krb5i,cruid=%(USERUID),nodev,nosuid,noexec,rw"
+ />
+...prefilled content...
+I recently had a issue logged by a client where a room calendar in Microsoft Exchange 365,
+when invited to a meeting, shows the organizer's name in the subject instead of the actual subject.
+This may well be a desirable feature, but in the case it isn't, this is how it can be resolved.
Room calendars are useful for booking meetings which will take place in a room in an office. Normally, the process would be for somebody to have delegate permissions on this calendar, allowing them to enter a calendar entry into this calendar and invite the required attendees. In this case, everything works well - the room shows the event, including subject and content and invited parties can accept to reject the event depending on their availability.
+However, sometimes somebody wishes to create an event in their own calendar, and invite the room calendar to that event. In this case, it appears the default option is for the event in the room calendar to have its subject and content replaced by the organisers details. I'm sure this makes sense in some cases, but my client in this case does not find this desirable. Luckily, there is a solution.
+A single Powershell command can be used to set some options on a calendar to change the way that calendars processing works.
+First, connect to Exchange Online:
Connect-ExchangeOnline
+Once connected, you can issue the following command to show the current options for a particular calendar's processing:
+Get-CalendarProcessing - Identity "{The Calendar Name}" | fl
+Which should show something like the below:
+AutomateProcessing : AutoAccept
+AllowConflicts : False
+AllowDistributionGroup : True
+AllowMultipleResources : True
+BookingType : Standard
+BookingWindowInDays : 180
+MaximumDurationInMinutes : 1440
+MinimumDurationInMinutes : 0
+AllowRecurringMeetings : True
+EnforceAdjacencyAsOverlap : False
+EnforceCapacity : False
+EnforceSchedulingHorizon : True
+ScheduleOnlyDuringWorkHours : False
+ConflictPercentageAllowed : 0
+MaximumConflictInstances : 0
+ForwardRequestsToDelegates : True
+DeleteAttachments : True
+DeleteComments : True
+RemovePrivateProperty : True
+DeleteSubject : True
+AddOrganizerToSubject : True
+DeleteNonCalendarItems : True
+TentativePendingApproval : True
+EnableResponseDetails : True
+OrganizerInfo : True
+ResourceDelegates : {**Names of delegates are here**}
+RequestOutOfPolicy : {}
+AllRequestOutOfPolicy : False
+BookInPolicy : {}
+AllBookInPolicy : False
+RequestInPolicy : {}
+AllRequestInPolicy : True
+AddAdditionalResponse : False
+AdditionalResponse :
+RemoveOldMeetingMessages : True
+AddNewRequestsTentatively : True
+ProcessExternalMeetingMessages : False
+RemoveForwardedMeetingNotifications : False
+AutoRSVPConfiguration : Microsoft.Exchange.Data.Storage.AutoRSVPConfiguration
+RemoveCanceledMeetings : False
+EnableAutoRelease : False
+PostReservationMaxClaimTimeInMinutes : 10
+MailboxOwnerId : Room Calendar Name
+Identity : Room Calendar Name
+IsValid : True
+ObjectState : Changed
+You'll see there are a few options set to "True" which could be toggled - Delete Subject, Delete Comments and Delete Attachments - they should be fairly self explanitory.
+You can toggle these options by issuing the following command:
Set-CalendarProcessing -Identity "Room Calendar Name" -DeleteComments $false -DeleteSubject $false -DeleteAttachments $false
+This simply disables those options, so now the subject, comments and attachments will not be deleted when the calendar processes the event.
+There is one further options which may, or may not, be helpful to disable - AddOrganizerToSubject. This option adds the organizer's name to the start of the Subject. This may be useful, but my client also wanted this switched off which can be done with the following command (or, indeed, adding the flag to the previous command).
Set-CalendarProcessing -Identity "Room Calendar Name" -AddOrganizerToSubject $false
+And there we are, new events now will appear in the calendar as desired - with full Subject, Comments and Attachments.
+Previous entries will not update automatically, the organizer must go into each one and re-send it (no need to change anything, just re-send it and press "Send Anyway") which will update the event in the room calendar as desired.
Hello. How are you? I am fine.
+
+You may know me from a few places, but likely on the Fediverse as the person that
+maintains a BirdsiteLIVE instance with the url birdsite.wilde.cloud.
SELECT haiku FROM
+tableHaikus WHERE LEFT(name,
+3) LIKE 'SQL';
+Rate Stuff with Ross, quite simple.
-If you have a bread maker:
-Without a bread maker:
-After a few hours of rising time (longer if you're using sourdough starter) -your dough will, hopefully, have risen enormously. You can now use it. -I'll be adding recipes for pizzas, naans and other -things that use this dough here, eventually.
- -A website directory of all words that can be associated with their letters by not -sounding as their corresponding letter should do.
-If you have a bread maker:
+Without a bread maker:
+After a few hours of rising time (longer if you're using sourdough starter) +your dough will, hopefully, have risen enormously. You can now use it. +I'll be adding recipes for pizzas, naans and other +things that use this dough here, eventually.
+ +A website directory of all words that can be associated with their letters by not +sounding as their corresponding letter should do.
+ +