Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am attempting to setup a linux client to authenticate with active directory. I tried following this article, but have had no luck authenticating:

I am hoping to authenticate with active directory so that I don't need to re-authenticate when printing and can automatically mount all shares. Will setting this up provide those capabilities for me?

share|improve this question
up vote 2 down vote accepted

If you set up Kerberos authentication using either pam_krb5 or pam_winbind, then yes, you will get password-less authentication to services.

But note that the article is out of date in some places, and plain incorrect in others.

  1. Arch has switched to MIT Kerberos (krb5) long ago. Heimdal is not used. (krb5.conf syntax remains the same.)
  2. Do not put kdc settings in krb5.conf's [realms]. It is better to use DNS SRV records to find this information, which is what Windows does. If the KDCs change, you shouldn't need to edit hundreds of krb5.conf's.
  3. Do not put the KDC addresses in /etc/hosts either. Let DNS handle that.
  4. pam_krb5 does not need to be built manually; it's in the official repositories.
  5. You do not need pam_krb5 if you are using Winbind (which is the recommended way).
  6. allow_weak_crypto should not be necessary; both Heimdal and MIT Kerberos support the RC4-HMAC enctype used by pre-2008 Windows versions.
share|improve this answer
+1 for winbind. its a doddle to setup. – Sirex Oct 14 '11 at 14:41
Is this what I'm looking for:… – Walter White Oct 14 '11 at 16:55
@WalterWhite: This Ubuntu doc page looks fairly good. Also, this Microsoft article‌​... (Sigh. Why is it so that all tutorials only explain what to do, but not why? Even worse that they often suggest entirely opposite practices. Even minor ones, such as using "/lib/security" in PAM config, still bug me... which Linux distros actually do that?) – grawity Oct 14 '11 at 17:29

Have a look at the free Centrify Express product - hopefully there's a package for your flavour of Linux. It took me about 2 mins to setup an Ubuntu desktop machine with it.

Centrify Express is a comprehensive suite of free Active Directory-based integration solutions for authentication, single sign-on, remote access, file-sharing, monitoring The #1 Choice for Active Directory Integration and cloud security for cross-platform systems. It is the quickest and most proven solution for integrating UNIX, Linux and Mac systems with Windows, and delivers more functionality and more to upgrade to when compared to other free offerings.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.