NT Domain Authentication in Ubuntu HOW-TO
by vizvayu@gmail.com
I'm making this tutorial because I had to set-up Ubuntu to authenticate on my company's NT Domain, so now that it's working I thought I could share my experience.
Any comments, ideas, and even some questions are welcome. There are several tutorials regarding this, but this one is made specially for Ubuntu.
First of all, I'm assuming that you are comfortable editing text files and have a basic undestanding of a linux system, including booting in recovery mode and restoring file backups. Although this procedure is not "dangerous", it could render the authentication system unusable if you make any mistake. So please, be careful and make backups of all the files changed. 
To authenticate on a NT Domain, you need the following extra packets:
If I remeber correctly, the samba package comes with Ubuntu, but you have to download winbind separately from the universal repository.
Ok, now this is a list of the files we are touching, please make backups:
Code:
/etc/login.defs
/etc/nsswitch.conf
/etc/samba/smb.conf
/etc/pam.d/common-account
/etc/pam.d/common-auth
/etc/pam.d/common-password
/etc/pam.d/common-session
/etc/pam.d/sudo
Now, the first thing we are doing is setting up samba/winbind to work with the domain, so do a nano /etc/samba/smb.conf and insert the following lines:
Code:
workgroup = MYDOMAIN
idmap uid = 10000-20000
idmap gid = 10000-20000
template shell = /bin/bash
template homedir = /home/%D/%U
winbind enum users = yes
winbind enum groups = yes
winbind cache time = 10
winbind separator = +
security = domain
password server = *
winbind use default domain = yes
Remeber that this is just and example, you should/can change the values according to your needs.
After that we need to make the system to use winbind. First edit /etc/nsswitch.conf and replace:
Code:
passwd: compat
group: compat
with
Code:
passwd: compat winbind
group: compat winbind
Now go to /etc/pam.d and edit the following files:
common-account:
Code:
#Commented for winbind to work
#account-required pam_unix.so
account-required pam_winbind.so
common-auth:
Code:
auth sufficient pam_winbind.so
auth required pam_unix.so nullok_secure use_first_pass
common-session:
Code:
session required pam_unix.so
session required pam_mkhomedir.so umask=0022 skel=/etc/skel/
sudo:
Code:
auth sufficient pam_winbind.so
auth required pam_unix.so use_first_pass
And this is an extra, not really required, but as I think the default max password lenght of 8 chars sucks (I like to use passphrases), and as we are using md5, I changed it:
/etc/login.defs:
/etc/pam.d/common-password:
Code:
password required pam_unix.so nullok obscure min=4 max=50 md5
Finally, there are only a few things left to do:
Join the domain:
Code:
net rpc join -D MYDOMAIN -U administrator
Test it with:
Code:
wbinfo -u
wbinfo -g
Make the domain home dir (users home dirs will be inside this one, but can be configured in smb.conf):
Code:
mkdir /home/MYDOMAIN
Reboot, and that's it, you should now have domain authentication working in Ubuntu. 
Just a few extra comments:
- Remeber that if you need one user to have administration permissions, you need to include him in the /etc/sudoers list. Use the visudo command to do this. And there's no need to prepend MYDOMAIN+ to the username since winbind is configured to use the configured domain by default.
- If anything goes wrong and you cannot login to the system, you have to reboot in recovery mode (press ESC when grub is starting) and replace the changed files from /etc/pam.d with the backups.
- I use NT4 domains, I don't think a W2k domain in native mode will work. You surely have to make some changes.
- This tutorial is just and example of how things worked for me. It's obviously not the only (or better) way to do things.
