Join Debian 10 in Active Directory Domain

Prerequisites

Active Directory is installed including DHCP server.

Installing of required packages

Login as root

$ apt -y install realmd sssd sssd-tools adcli krb5-user packagekit samba-common samba-common-bin samba-libs 

# DHCP server is running, select [Yes]
 +----------------------+ Samba server and utilities +-----------------------+
 |                                                                           |
 | If your computer gets IP address information from a DHCP server on the    |
 | network, the DHCP server may also provide information about WINS servers  |
 | ("NetBIOS name servers") present on the network.  This requires a change  |
 | to your smb.conf file so that DHCP-provided WINS settings will            |
 | automatically be read from /var/lib/samba/dhcp.conf.                      |
 |                                                                           |
 | The dhcp-client package must be installed to take advantage of this       |
 | feature.                                                                  |
 |                                                                           |
 | Modify smb.conf to use WINS settings from DHCP?                           |
 |                                                                           |
 |                    <Yes>                       <No>                       |
 |                                                                           |
 +---------------------------------------------------------------------------+

# specify Realm Name
 +------------------+ Configuring Kerberos Authentication +------------------+
 | When users attempt to use Kerberos and specify a principal or user name   |
 | without specifying what administrative Kerberos realm that principal      |
 | belongs to, the system appends the default realm.  The default realm may  |
 | also be used as the realm of a Kerberos service running on the local      |
 | machine.  Often, the default realm is the uppercase version of the local  |
 | DNS domain.                                                               |
 |                                                                           |
 | Default Kerberos version 5 realm:                                         |
 |                                                                           |
 | TRAININGX.NET____________________________________________________________ |
 |                                                                           |
 |                                  <Ok>                                     |
 |                                                                           |
 +---------------------------------------------------------------------------+

Specify AD DS Hostname
 +------------------+ Configuring Kerberos Authentication +------------------+
 | Enter the hostnames of Kerberos servers in the TRAININGX.NET Kerberos     |
 | realm separated by spaces.                                                |
 |                                                                           |
 | Kerberos servers for your realm:                                          |
 |                                                                           |
 | adX1.trainingX.net_______________________________________________________ |
 |                                                                           |
 |                                  <Ok>                                     |
 |                                                                           |
 +---------------------------------------------------------------------------+

# specify AD DS Hostname
 +------------------+ Configuring Kerberos Authentication +------------------+
 | Enter the hostname of the administrative (password changing) server for   |
 | the TRAININGX.NET Kerberos realm.                                         |
 |                                                                           |
 | Administrative server for your Kerberos realm:                            |
 |                                                                           |
 | adX1.trainingX.net_______________________________________________________ |
 |                                                                           |
 |                                  >Ok<                                     |
 |                                                                           |
 +---------------------------------------------------------------------------+

Join in Active Directory Domain

DNS server

The Linux server that has to be integrated into the Active Directory must use the Active Directory DNS server. Windows DNS server has to be registered into the resolv.conf file.

$ nano /etc/resolv.conf
nameserver 192.168.X0.254

Discover Active Directory domain

$ realm discover TRAININGX.NET
  trainingX.net
  type: kerberos
  realm-name: TRAININGX.NET
  domain-name: trainingX.net
  configured: no
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: libnss-sss
  required-package: libpam-sss
  required-package: adcli
  required-package: samba-common-bin

Join in Active Directory domain

$ realm join TRAININGX.NET
Password for Administrator:

Configure additionally

Creation of home directory automatically at initial login

$ nano /etc/pam.d/common-session 

# add to the end if need (create home directory automatically at initial login)
session optional        pam_mkhomedir.so skel=/etc/skel umask=077

Control who can log in

At this point, we should be able to log in with any AD user ID. We can control who can log in and who can't.

$ realm deny --all
$ realm permit administrator
$realm permit -g 'Domain Admins'
$realm list
trainingX.net
  type: kerberos
  realm-name: TRAININGX.NET
  domain-name: trainingx.net
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: libnss-sss
  required-package: libpam-sss
  required-package: adcli
  required-package: samba-common-bin
  login-formats: %U@trainingX.net
  login-policy: allow-permitted-logins
  permitted-logins: administrator
  permitted-groups: Domain Admins

Internet resources:

https://www.server-world.info/en/note?os=Debian_10&p=realmd

https://www.elastic2ls.com/linux-active-directory-authentication/