How to Join an Ubuntu Linux Machine to a Windows Active Directory Domain using SSSD

Unifying Authentication in Hybrid Environments

In enterprise environments, Microsoft Active Directory (AD) is the undisputed standard for managing user identities, passwords, and access control policies. However, as organizations deploy more Linux servers, maintaining separate local user accounts on every Linux machine becomes an administrative nightmare and a major security risk.

The modern, standard solution to this problem is the System Security Services Daemon (SSSD) in conjunction with realmd. SSSD allows a Linux machine to directly query Active Directory for user authentication, translating Windows SIDs and groups into native Linux UIDs and GIDs. This allows employees to log into Linux servers via SSH using their standard Windows AD credentials.

Prerequisites

Before beginning, ensure the following requirements are met:

• An Ubuntu 24.04 server with network access to the Domain Controllers.
• The Ubuntu server must use the Active Directory Domain Controllers as its primary DNS servers. AD relies heavily on SRV records in DNS to locate authentication services.
• Domain Administrator credentials, or an account with rights to join machines to the domain.

Step 1: Installing Required Packages

Open a terminal on your Ubuntu server and install the necessary software packages using APT:

sudo apt update
sudo apt install realmd sssd sssd-tools libnss-sss libpam-sss adcli samba-common-bin -y

The realmd package simplifies the domain join process by automatically configuring SSSD and Kerberos, rather than forcing you to write complex configuration files by hand.

Step 2: Discovering and Joining the Domain

Before joining, verify that your Ubuntu machine can resolve and communicate with the Active Directory domain using the realm discover command:

sudo realm discover company.local

If the DNS is configured correctly, it will output the domain details, indicating it is “configured: no”.

To join the domain, use the realm join command, passing the Domain Admin username:

sudo realm join -U Administrator company.local

You will be prompted for the Administrator’s password. Once entered, realmd will automatically create a computer object in Active Directory and generate the Kerberos keytab file at /etc/krb5.keytab.

Step 3: Configuring SSSD Behavior

By default, AD users must log in using their fully qualified domain name (e.g., [email protected]). This is cumbersome. You can configure SSSD to assume the default domain name so users can simply log in as jdoe.

Edit the SSSD configuration file located at /etc/sssd/sssd.conf:

sudo nano /etc/sssd/sssd.conf

Find the line use_fully_qualified_names = True and change it to:

use_fully_qualified_names = False

Save the file and restart the SSSD service to apply the changes:

sudo systemctl restart sssd

Step 4: Restricting SSH Access (Optional but Recommended)

By default, joining the domain allows any active user in Active Directory to log into the Ubuntu server via SSH. For security, you should restrict access to specific AD groups, such as a “LinuxAdmins” group.

Use the realm deny and realm permit commands to configure access controls:

sudo realm deny --all
sudo realm permit -g LinuxAdmins

Step 5: Enabling Automatic Home Directory Creation

When an AD user logs in for the first time, Linux needs to create their home directory (e.g., /home/jdoe). Enable the PAM module that handles this automatically:

sudo pam-auth-update --enable mkhomedir

Your Ubuntu server is now fully integrated into Active Directory. You can test the integration by querying an AD user from the Linux command line using the id command (e.g., id jdoe). SSSD will dynamically assign a UID and list the user’s AD groups, demonstrating a seamless bridge between Linux and Windows authentication.