apt-get install realmd sssd sssd-tools krb5-user
/etc/sssd/sssd.conf 配置
将 mydomain.com 替换为 AD 域的 DNS 名称。
将 MYDOMAIN.COM 替换为 AD 域的 DNS 名称,全部为大写字母
[sssd]
domains = mydomain.com
config_file_version = 2
services = nss, pam
[domain/mydomain.com]
ad_domain = mydomain.com
krb5_realm = MYDOMAIN.COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False #Use short name for user
fallback_homedir = /home/%u@%d
access_provider = ad
ad_gpo_map_interactive = +gdm-vmwcred #Add this line for SSO
ad_gpo_access_control = permissive #Deactivate GPO access control in the cloned VM
/etc/krb5.conf 配置
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
default_realm = MYDOMAIN.COM
default_ccache_name = KEYRING:persistent:%{uid}
default_tkt_enctypes = rc4-hmac #Add this line to use rc4-hmac encryption only
default_tgs_enctypes = rc4-hmac #Add this line to use rc4-hmac encryption only