Tips for Likewise Open on Linux

Likewise Open makes it very easy to authenticate users on a Linux machine using Windows Active Directory Domain Services and in today’s mixed Operating System environments it is possible to integrate assorted services across your network.

Once upon a time I was 100% Linux but got frustrated with the ever complicated setup of LDAP for authenticating a few users on my network. I now use Citrix XenServer to host a mixture of Windows and Linux virtual machines and found Windows Server 2008 Active Directory Domain Services to be a good replacement for other authentication services (as a Linux fanboy, that statement was hard to admit for some time).

Here follows a short list of useful tips for using Likewise Open:

1. Windows DNS Server

   Make use of the Windows DNS Server by using its IP and domain within your /etc/resolv.conf or assigning it within your DHCP service.

   # /etc/resolv.conf
   # replace yourdomain.tld with your Active Directory domain
   # replace XXX.XXX.XXX.XXX with your Windows Servers IP address
   domain yourdomain.tld
   search yourdomain.tld
   nameserver XXX.XXX.XXX.XXX

   This makes it easier to use domainjoin-cli or domainjoin-gui to get your Linux machine connected to the Active Directory.

2. Username Formatting and Location of Home Directories

   When logging into your Linux desktop, make sure you use the format YOURDOMAIN\username but if you are logging into a shell, remember to escape the backslash with another backslash as YOURDOMAIN\\username.
   Also Make note that not only uid/gid are different but also the location of home directories (/home/YOURDOMAIN/username or /home/local/YOURDOMAIN/username, although this can be changed).

3. POSIX Friendly Groups

   
   Do feel the need to create a group for any users you add to the active directory, for example:
   I am user ‘martin’ and my Primary Group is ‘martin-group’.
   Doing this is more POSIX friendly and enables you to still have a very secure Linux system when your home directory is chmod rwxrwx--- and chown YOURDOMAIN\\username:YOURDOMAIN\\username-group.

4. Do Things as root

   Missing sudo access?
   Make sure you are a member of ‘Domain Admins’ within the Active Directory and add the group to your /etc/sudoers file:

   # replace YOURDOMAIN with your Active Directory domain
   %YOURDOMAIN\\domain^admins ALL=(ALL) ALL

   Notice that the backslash is escaped with a backslash, Domain Admins is lower-case and space has been replaced with a ‘^’.
   This could also be done by creating a ‘sudo’ group in the active directory, assigning users and adding %YOURDOMAIN\\sudo ALL=(ALL) ALL.
   Referenced from ‘Ubuntu Forums – Re: Likewise-Open User with Sudo permissions?‘

5. Avoid Local Password Errors

   Changing local passwords results in ‘Authentication token manipulation error’!
   I have only tested this in Ubuntu so far and found out that it should be fixed in Ubuntu Lucid (Bug #302026).
   For me (On Jaunty), the following fixed the issue:

   sudo apt-get install libpam-cracklib

6. Use a Samba Server

   I did not get on too well with Windows NFS server or Windows File Sharing for Linux clients, a few days of messing about sent me running back to Linux for a solution.
   I decided to use CentOS for my file server and combine NFS and Samba for both Windows and Linux clients.
   Using this method allows Linux client machines to mount the home directory via NFS as normal (and already well documented) and other windows client users will automatically connect the share via Samba onto the specified device.
   For CentOS, I followed reply #3 in the ‘CentOS forums – Setting up a folder share using Likewise over an Active Directory Network‘ so that Samba played nicely with Active Directory and then I added the following to /etc/samba/smb.conf.

   # replace YOURDOMAIN with your Active Directory domain
   [Users]
   path = /home/local/YOURDOMAIN
   writeable = yes
   browseable = yes
   guest ok = yes
   create mask = 0660
   directory mask = 0770
   admin users = YOURDOMAIN\administrator

   Then you can simply edit your users profile within Active Domain to automatically map Z: to use \\CENTOS\Users\username whenever and wherever they log on and for Linux users, just use NFS (NOTE: YOURDOMAIN\Administrator will still get access to all the home directories in the Samba share, but I am still unsure how to make this play nicely when you install software as a user with ‘Domain Admins’ privileges on a Windows machine when the install wants to use Z:\WINDOWS).

If you have something to add or you feel I have missed some elegant tip out, please leave a your thoughts in the comment section below!