Chapter 4. Managing direct connections to AD

Procedure

1. Grant access to all users:

   # realm permit --all

2. Grant access to specific users:

   $ realm permit aduser01@example.com
   $ realm permit 'AD.EXAMPLE.COM\aduser01'

Verification steps

1. Use SSH to log in to the server as the aduser01@example.com user:

   $ ssh aduser01@example.com@server_name
   [aduser01@example.com@server_name ~]$

2. Use the ssh command a second time to access the same server, this time as the aduser02@example.com user:

   $ ssh aduser02@example.com@server_name
   Authentication failed.

Procedure

1. Deny access to all users within the domain:

   # realm deny --all

   This command prevents realm accounts from logging into the local machine. Use realm permit to restrict login to specific accounts.

2. Verify that the domain user’s login-policy is set to deny-any-login:

   [root@replica1 ~]# realm list
   example.net
     type: kerberos
     realm-name: EXAMPLE.NET
     domain-name: example.net
     configured: kerberos-member
     server-software: active-directory
     client-software: sssd
     required-package: oddjob
     required-package: oddjob-mkhomedir
     required-package: sssd
     required-package: adcli
     required-package: samba-common-tools
     login-formats: %U@example.net
     login-policy: deny-any-login

3. Deny access to specific users by using the -x option:

   $ realm permit -x 'AD.EXAMPLE.COM\aduser02'

Procedure

1. Stop the SSSD service.

   [root@server ~]# systemctl stop sssd

2. Open the /etc/sssd/sssd.conf file in a text editor.

3. Set ad_gpo_access_control to permissive in the domain section for the AD domain.

   [domain/example.com]
   ad_gpo_access_control=permissive
   ...

4. Save the /etc/sssd/sssd.conf file.

5. Restart the SSSD service to load configuration changes.

   [root@server ~]# systemctl restart sssd

Procedure

1. Within Active Directory Users and Computers, create an Organizational Unit (OU) to associate with the new GPO:

   1. Right-click on the domain.
   2. Choose New.
   3. Choose Organizational Unit.
2. Click on the name of the Computer Object that represents the RHEL host (created when it joined Active Directory) and drag it into the new OU. By having the RHEL host in its own OU, the GPO targets this host.

3. Within the Group Policy Management Editor, create a new GPO for the OU you created:

   1. Expand Forest.
   2. Expand Domains.
   3. Expand your domain.
   4. Right-click on the new OU.
   5. Choose Create a GPO in this domain.
4. Specify a name for the new GPO, such as Allow SSH access or Allow Console/GUI access and click OK.

5. Edit the new GPO:

   1. Select the OU within the Group Policy Management editor.
   2. Right-click and choose Edit.
   3. Select User Rights Assignment.
   4. Select Computer Configuration
   5. Select Policies.
   6. Select Windows Settings.
   7. Select Security Settings.
   8. Select Local Policies.
   9. Select User Rights Assignment.

6. Assign login permissions:

   1. Double-Click on Allow log on locally to grant local console/GUI access.
   2. Double-click on Allow log on through Remote Desktop Services to grant SSH access.

7. Add the user(s) you want to access either of these policies to the policies themselves:

   1. Click Add User or Group.
   2. Enter the username within the blank field.
   3. Click OK.