|
| 1 | +--- |
| 2 | +title: 'Azure Active Directory Domain Services: Join an Ubuntu VM to a managed domain | Microsoft Docs' |
| 3 | +description: Join an Ubuntu Linux virtual machine to Azure AD Domain Services |
| 4 | +services: active-directory-ds |
| 5 | +documentationcenter: '' |
| 6 | +author: mahesh-unnikrishnan |
| 7 | +manager: mahesh-unnikrishnan |
| 8 | +editor: curtand |
| 9 | + |
| 10 | +ms.assetid: 804438c4-51a1-497d-8ccc-5be775980203 |
| 11 | +ms.service: active-directory-ds |
| 12 | +ms.workload: identity |
| 13 | +ms.tgt_pltfrm: na |
| 14 | +ms.devlang: na |
| 15 | +ms.topic: article |
| 16 | +ms.date: 10/03/2017 |
| 17 | +ms.author: maheshu |
| 18 | + |
| 19 | +--- |
| 20 | +# Join an Ubuntu virtual machine in Azure to a managed domain |
| 21 | +This article shows you how to join an Ubuntu Linux virtual machine to an Azure AD Domain Services managed domain. |
| 22 | + |
| 23 | + |
| 24 | +## Before you begin |
| 25 | +To perform the tasks listed in this article, you need: |
| 26 | +1. A valid **Azure subscription**. |
| 27 | +2. An **Azure AD directory** - either synchronized with an on-premises directory or a cloud-only directory. |
| 28 | +3. **Azure AD Domain Services** must be enabled for the Azure AD directory. If you haven't done so, follow all the tasks outlined in the [Getting Started guide](active-directory-ds-getting-started.md). |
| 29 | +4. Ensure that you have configured the IP addresses of the managed domain as the DNS servers for the virtual network. For more information, see [how to update DNS settings for the Azure virtual network](active-directory-ds-getting-started-dns.md) |
| 30 | +5. Complete the steps required to [synchronize passwords to your Azure AD Domain Services managed domain](active-directory-ds-getting-started-password-sync.md). |
| 31 | + |
| 32 | + |
| 33 | +## Provision an Ubuntu Linux virtual machine |
| 34 | +Provision an Ubuntu Linux virtual machine in Azure, using any of the following methods: |
| 35 | +* [Azure portal](../virtual-machines/linux/quick-create-portal.md) |
| 36 | +* [Azure CLI](../virtual-machines/linux/quick-create-cli.md) |
| 37 | +* [Azure PowerShell](../virtual-machines/linux/quick-create-powershell.md) |
| 38 | + |
| 39 | +> [!IMPORTANT] |
| 40 | +> * Deploy the virtual machine into the **same virtual network in which you have enabled Azure AD Domain Services**. |
| 41 | +> * Pick a **different subnet** than the one in which you have enabled Azure AD Domain Services. |
| 42 | +> |
| 43 | +
|
| 44 | + |
| 45 | +## Connect remotely to the Ubuntu Linux virtual machine |
| 46 | +The Ubuntu virtual machine has been provisioned in Azure. The next task is to connect remotely to the virtual machine using the local administrator account created while provisioning the VM. |
| 47 | + |
| 48 | +Follow the instructions in the article [How to log on to a virtual machine running Linux](../virtual-machines/linux/mac-create-ssh-keys.md?toc=%2fazure%2fvirtual-machines%2flinux%2ftoc.json). |
| 49 | + |
| 50 | + |
| 51 | +## Configure the hosts file on the Linux virtual machine |
| 52 | +In your SSH terminal, edit the /etc/hosts file and update your machine’s IP address and hostname. |
| 53 | + |
| 54 | +``` |
| 55 | +sudo vi /etc/hosts |
| 56 | +``` |
| 57 | + |
| 58 | +In the hosts file, enter the following value: |
| 59 | + |
| 60 | +``` |
| 61 | +127.0.0.1 contoso-ubuntu.contoso100.com contoso-ubuntu |
| 62 | +``` |
| 63 | +Here, 'contoso100.com' is the DNS domain name of your managed domain. 'contoso-ubuntu' is the hostname of the Ubuntu virtual machine you are joining to the managed domain. |
| 64 | + |
| 65 | + |
| 66 | +## Install required packages on the Linux virtual machine |
| 67 | +Next, install packages required for domain join on the virtual machine. Perform the following steps: |
| 68 | + |
| 69 | +1. In your SSH terminal, type the following command to download the package lists from the repositories. This command updates the package lists to get information on the newest versions of packages and their dependencies. |
| 70 | + |
| 71 | + ``` |
| 72 | + sudo apt-get update |
| 73 | + ``` |
| 74 | +
|
| 75 | +2. Type the following command to install the required packages. |
| 76 | + ``` |
| 77 | + sudo apt-get install krb5-user samba sssd sssd-tools libnss-sss libpam-sss ntp ntpdate realmd adcli |
| 78 | + ``` |
| 79 | +
|
| 80 | +3. During the Kerberos installation, you see a pink screen. The installation of the 'krb5-user' package prompts for the realm name (in ALL UPPERCASE). The installation writes the [realm] and [domain_realm] sections in /etc/krb5.conf. |
| 81 | +
|
| 82 | + > [!TIP] |
| 83 | + > If the name of your managed domain is contoso100.com, enter CONTOSO100.COM as the realm. Remember, the realm name must be specified in UPPERCASE. |
| 84 | + > |
| 85 | + > |
| 86 | +
|
| 87 | +
|
| 88 | +## Configure the NTP (Network Time Protocol) settings on the Linux virtual machine |
| 89 | +The date and time of your Ubuntu VM must synchronize with the managed domain. Add your managed domain's NTP hostname in the /etc/ntp.conf file. |
| 90 | +
|
| 91 | +``` |
| 92 | +sudo vi /etc/ntp.conf |
| 93 | +``` |
| 94 | +
|
| 95 | +In the ntp.conf file, enter the following value and save the file: |
| 96 | +
|
| 97 | +``` |
| 98 | +server contoso100.com |
| 99 | +``` |
| 100 | +Here, 'contoso100.com' is the DNS domain name of your managed domain. |
| 101 | +
|
| 102 | +Now sync the Ubuntu VM's date and time with NTP server and then start the NTP service: |
| 103 | +
|
| 104 | +``` |
| 105 | +sudo systemctl stop ntp |
| 106 | +sudo ntpdate contoso100.com |
| 107 | +sudo systemctl start ntp |
| 108 | +``` |
| 109 | +
|
| 110 | +
|
| 111 | +## Join the Linux virtual machine to the managed domain |
| 112 | +Now that the required packages are installed on the Linux virtual machine, the next task is to join the virtual machine to the managed domain. |
| 113 | +
|
| 114 | +1. Discover the AAD Domain Services managed domain. In your SSH terminal, type the following command: |
| 115 | +
|
| 116 | + ``` |
| 117 | + sudo realm discover CONTOSO100.COM |
| 118 | + ``` |
| 119 | +
|
| 120 | + > [!NOTE] |
| 121 | + > **Troubleshooting:** |
| 122 | + > If *realm discover* is unable to find your managed domain: |
| 123 | + * Ensure that the domain is reachable from the virtual machine (try ping). |
| 124 | + * Check that the virtual machine has indeed been deployed to the same virtual network in which the managed domain is available. |
| 125 | + * Check to see if you have updated the DNS server settings for the virtual network to point to the domain controllers of the managed domain. |
| 126 | + > |
| 127 | +
|
| 128 | +2. Initialize Kerberos. In your SSH terminal, type the following command: |
| 129 | +
|
| 130 | + > [!TIP] |
| 131 | + > * Ensure that you specify a user who belongs to the 'AAD DC Administrators' group. |
| 132 | + > * Specify the domain name in capital letters, else kinit fails. |
| 133 | + > |
| 134 | +
|
| 135 | + ``` |
| 136 | + |
| 137 | + ``` |
| 138 | +
|
| 139 | +3. Join the machine to the domain. In your SSH terminal, type the following command: |
| 140 | +
|
| 141 | + > [!TIP] |
| 142 | + > Use the same user account you specified in the preceding step ('kinit'). |
| 143 | + > |
| 144 | +
|
| 145 | + ``` |
| 146 | + sudo realm join --verbose CONTOSO100.COM -U '[email protected]' --install=/ |
| 147 | + ``` |
| 148 | +
|
| 149 | +You should get a message ("Successfully enrolled machine in realm") when the machine is successfully joined to the managed domain. |
| 150 | +
|
| 151 | +
|
| 152 | +## Update the SSSD configuration and restart the service |
| 153 | +1. In your SSH terminal, type the following command. Open the sssd.conf file and make the following change |
| 154 | + ``` |
| 155 | + sudo vi /etc/sssd/sssd.conf |
| 156 | + ``` |
| 157 | +
|
| 158 | +2. Comment out the line **use_fully_qualified_names = True** and save the file. |
| 159 | + ``` |
| 160 | + # use_fully_qualified_names = True |
| 161 | + ``` |
| 162 | +
|
| 163 | +3. Restart the SSSD service. |
| 164 | + ``` |
| 165 | + sudo service sssd restart |
| 166 | + ``` |
| 167 | +
|
| 168 | +
|
| 169 | +## Configure automatic home directory creation |
| 170 | +To enable automatic creation of the home directory after logging in users, type the following commands in your PuTTY terminal: |
| 171 | +``` |
| 172 | +sudo vi /etc/pam.d/common-session |
| 173 | +``` |
| 174 | + |
| 175 | +Add the following line in this file below the line 'session optional pam_sss.so' and save it: |
| 176 | +``` |
| 177 | +session required pam_mkhomedir.so skel=/etc/skel/ umask=0077 |
| 178 | +``` |
| 179 | +
|
| 180 | +
|
| 181 | +## Verify domain join |
| 182 | +Verify whether the machine has been successfully joined to the managed domain. Connect to the domain joined Ubuntu VM using a different SSH connection. Use a domain user account and then check to see if the user account is resolved correctly. |
| 183 | +
|
| 184 | +1. In your SSH terminal, type the following command to connect to the domain joined Ubuntu virtual machine using SSH. Use a domain account that belongs to the managed domain (for example, '[email protected]' in this case.) |
| 185 | + ``` |
| 186 | + ssh -l [email protected] contoso-ubuntu.contoso100.com |
| 187 | + ``` |
| 188 | +
|
| 189 | +2. In your SSH terminal, type the following command to see if the home directory was initialized correctly. |
| 190 | + ``` |
| 191 | + pwd |
| 192 | + ``` |
| 193 | +
|
| 194 | +3. In your SSH terminal, type the following command to see if the group memberships are being resolved correctly. |
| 195 | + ``` |
| 196 | + id |
| 197 | + ``` |
| 198 | +
|
| 199 | +
|
| 200 | +## Grant the 'AAD DC Administrators' group sudo privileges |
| 201 | +You can grant members of the 'AAD DC Administrators' group administrative privileges on the Ubuntu VM. The sudo file is located at /etc/sudoers. The members of AD groups added in sudoers can perform sudo. |
| 202 | +
|
| 203 | +1. In your SSH terminal, ensure you are logged in with superuser privileges. You can use the local administrator account you specified while creating the VM. Execute the following command: |
| 204 | + ``` |
| 205 | + sudo vi /etc/sudoers |
| 206 | + ``` |
| 207 | +
|
| 208 | +2. Add the following entry to the /etc/sudoers file and save it: |
| 209 | + ``` |
| 210 | + # Add 'AAD DC Administrators' group members as admins. |
| 211 | + %AAD\ DC\ Administrators ALL=(ALL) NOPASSWD:ALL |
| 212 | + ``` |
| 213 | +
|
| 214 | +3. You can now log in as a member of the 'AAD DC Administrators' group and should have administrative privileges on the VM. |
| 215 | +
|
| 216 | +
|
| 217 | +## Troubleshooting domain join |
| 218 | +Refer to the [Troubleshooting domain join](active-directory-ds-admin-guide-join-windows-vm-portal.md#troubleshooting-domain-join) article. |
| 219 | +
|
| 220 | +
|
| 221 | +## Related Content |
| 222 | +* [Azure AD Domain Services - Getting Started guide](active-directory-ds-getting-started.md) |
| 223 | +* [Join a Windows Server virtual machine to an Azure AD Domain Services managed domain](active-directory-ds-admin-guide-join-windows-vm.md) |
| 224 | +* [How to log on to a virtual machine running Linux](../virtual-machines/linux/mac-create-ssh-keys.md?toc=%2fazure%2fvirtual-machines%2flinux%2ftoc.json). |
0 commit comments