Add Linux Active Directory enrollment bootstrap
This commit is contained in:
Executable
+233
@@ -0,0 +1,233 @@
|
||||
#!/usr/bin/env bash
|
||||
# Enroll-SguLinuxDomainClient.sh
|
||||
#
|
||||
# Idempotently joins a Debian/Ubuntu or RHEL-family Linux workstation to the
|
||||
# SGU Active Directory laboratory. The join password is always requested by
|
||||
# realmd; this script never accepts, logs, or stores it.
|
||||
|
||||
set -Eeuo pipefail
|
||||
IFS=$'\n\t'
|
||||
|
||||
DOMAIN_NAME='lci.lasalle.mx'
|
||||
DOMAIN_CONTROLLER=''
|
||||
DOMAIN_DNS=''
|
||||
COMPUTER_OU='OU=Laboratorio,DC=lci,DC=lasalle,DC=mx'
|
||||
JOIN_USER='Administrator'
|
||||
DOMAIN_INTERFACE=''
|
||||
DOMAIN_ADDRESS=''
|
||||
COMPUTER_NAME=''
|
||||
ALLOW_GROUP=''
|
||||
ENABLE_SSH=false
|
||||
|
||||
usage() {
|
||||
cat <<'EOF'
|
||||
Usage:
|
||||
sudo ./Enroll-SguLinuxDomainClient.sh --domain-controller <IPv4-or-FQDN> [options]
|
||||
|
||||
Required:
|
||||
--domain-controller VALUE Fixed IPv4 address or DNS name of the AD controller.
|
||||
|
||||
Options:
|
||||
--domain-name VALUE AD DNS domain (default: lci.lasalle.mx).
|
||||
--domain-dns VALUE DNS server for the AD network (default: domain controller).
|
||||
--computer-ou DN Destination computer OU.
|
||||
--join-user USER AD account permitted to join computers (default: Administrator).
|
||||
--computer-name NAME NetBIOS host name; its FQDN becomes NAME.DOMAIN.
|
||||
--domain-interface IFACE Private NIC connected to the AD network.
|
||||
--domain-address CIDR Static IPv4 address for --domain-interface, e.g. 192.168.50.12/24.
|
||||
--allow-group GROUP Restrict Linux sign-in to this AD group after joining.
|
||||
--enable-ssh Install, enable, and (when active) permit OpenSSH in the local firewall.
|
||||
--help Show this help.
|
||||
|
||||
Network safety:
|
||||
--domain-interface and --domain-address must be supplied together. The selected
|
||||
interface must not own the default route, so the command cannot replace the
|
||||
Internet route while attaching a private AD NIC.
|
||||
|
||||
The AD password is requested interactively by realmd. It is never accepted as an
|
||||
argument or written to a file, log, or command line.
|
||||
EOF
|
||||
}
|
||||
|
||||
fail() {
|
||||
printf 'ERROR: %s\n' "$*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
need_command() {
|
||||
command -v "$1" >/dev/null 2>&1 || fail "Required command is unavailable: $1"
|
||||
}
|
||||
|
||||
while (($#)); do
|
||||
case "$1" in
|
||||
--domain-controller) DOMAIN_CONTROLLER=${2:?Missing value for --domain-controller}; shift 2 ;;
|
||||
--domain-name) DOMAIN_NAME=${2:?Missing value for --domain-name}; shift 2 ;;
|
||||
--domain-dns) DOMAIN_DNS=${2:?Missing value for --domain-dns}; shift 2 ;;
|
||||
--computer-ou) COMPUTER_OU=${2:?Missing value for --computer-ou}; shift 2 ;;
|
||||
--join-user) JOIN_USER=${2:?Missing value for --join-user}; shift 2 ;;
|
||||
--computer-name) COMPUTER_NAME=${2:?Missing value for --computer-name}; shift 2 ;;
|
||||
--domain-interface) DOMAIN_INTERFACE=${2:?Missing value for --domain-interface}; shift 2 ;;
|
||||
--domain-address) DOMAIN_ADDRESS=${2:?Missing value for --domain-address}; shift 2 ;;
|
||||
--allow-group) ALLOW_GROUP=${2:?Missing value for --allow-group}; shift 2 ;;
|
||||
--enable-ssh) ENABLE_SSH=true; shift ;;
|
||||
--help|-h) usage; exit 0 ;;
|
||||
*) fail "Unknown argument: $1. Use --help for usage." ;;
|
||||
esac
|
||||
done
|
||||
|
||||
[[ ${EUID} -eq 0 ]] || fail 'Run this command with sudo or as root.'
|
||||
[[ -n $DOMAIN_CONTROLLER ]] || fail '--domain-controller is required.'
|
||||
|
||||
if [[ -z $DOMAIN_DNS ]]; then
|
||||
DOMAIN_DNS=$DOMAIN_CONTROLLER
|
||||
fi
|
||||
|
||||
if [[ -n $DOMAIN_INTERFACE || -n $DOMAIN_ADDRESS ]]; then
|
||||
[[ -n $DOMAIN_INTERFACE && -n $DOMAIN_ADDRESS ]] || \
|
||||
fail '--domain-interface and --domain-address must be supplied together.'
|
||||
fi
|
||||
|
||||
if [[ -z $COMPUTER_NAME ]]; then
|
||||
COMPUTER_NAME=$(hostname -s)
|
||||
fi
|
||||
COMPUTER_NAME=${COMPUTER_NAME^^}
|
||||
HOST_FQDN="${COMPUTER_NAME,,}.${DOMAIN_NAME,,}"
|
||||
|
||||
install_prerequisites() {
|
||||
local -a packages=()
|
||||
if command -v apt-get >/dev/null 2>&1; then
|
||||
packages=(realmd sssd sssd-tools adcli libnss-sss libpam-sss krb5-user packagekit samba-common-bin)
|
||||
if [[ $ENABLE_SSH == true ]]; then
|
||||
packages+=(openssh-server)
|
||||
fi
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-get update
|
||||
apt-get install -y "${packages[@]}"
|
||||
pam-auth-update --enable mkhomedir --force
|
||||
return
|
||||
fi
|
||||
|
||||
if command -v dnf >/dev/null 2>&1; then
|
||||
packages=(realmd sssd sssd-tools adcli oddjob oddjob-mkhomedir samba-common-tools krb5-workstation)
|
||||
if [[ $ENABLE_SSH == true ]]; then
|
||||
packages+=(openssh-server)
|
||||
fi
|
||||
dnf install -y "${packages[@]}"
|
||||
authselect select sssd with-mkhomedir --force
|
||||
return
|
||||
fi
|
||||
|
||||
fail 'Supported package managers are apt-get (Debian/Ubuntu) and dnf (RHEL/Fedora/Rocky/AlmaLinux).'
|
||||
}
|
||||
|
||||
configure_private_ad_interface() {
|
||||
[[ -n $DOMAIN_INTERFACE ]] || return
|
||||
need_command nmcli
|
||||
ip link show "$DOMAIN_INTERFACE" >/dev/null 2>&1 || \
|
||||
fail "Network interface does not exist: $DOMAIN_INTERFACE"
|
||||
|
||||
local default_interface
|
||||
default_interface=$(ip route show default | awk 'NR == 1 { print $5 }')
|
||||
if [[ $default_interface == "$DOMAIN_INTERFACE" ]]; then
|
||||
fail "Refusing to reconfigure $DOMAIN_INTERFACE because it owns the default route. Use the private AD NIC."
|
||||
fi
|
||||
|
||||
local connection_name="SGU-Lab-AD-${DOMAIN_INTERFACE}"
|
||||
if ! nmcli -t -f NAME connection show | grep -Fxq "$connection_name"; then
|
||||
nmcli connection add type ethernet ifname "$DOMAIN_INTERFACE" con-name "$connection_name"
|
||||
fi
|
||||
nmcli connection modify "$connection_name" \
|
||||
connection.autoconnect yes \
|
||||
ipv4.method manual \
|
||||
ipv4.addresses "$DOMAIN_ADDRESS" \
|
||||
ipv4.dns "$DOMAIN_DNS" \
|
||||
ipv4.dns-search "$DOMAIN_NAME" \
|
||||
ipv4.never-default yes \
|
||||
ipv6.method ignore
|
||||
nmcli connection up "$connection_name"
|
||||
}
|
||||
|
||||
enable_sssd_dyndns() {
|
||||
[[ -n $DOMAIN_INTERFACE ]] || return
|
||||
local configuration_directory='/etc/sssd/conf.d'
|
||||
local configuration_path="${configuration_directory}/90-sgu-dyndns.conf"
|
||||
local temporary_path
|
||||
temporary_path=$(mktemp)
|
||||
printf '%s\n' \
|
||||
"[domain/${DOMAIN_NAME,,}]" \
|
||||
"ad_hostname = ${HOST_FQDN}" \
|
||||
'dyndns_update = True' \
|
||||
'dyndns_update_ptr = True' \
|
||||
"dyndns_iface = ${DOMAIN_INTERFACE}" \
|
||||
'dyndns_refresh_interval = 43200' >"$temporary_path"
|
||||
install -d -o root -g root -m 700 "$configuration_directory"
|
||||
install -o root -g root -m 600 "$temporary_path" "$configuration_path"
|
||||
rm -f "$temporary_path"
|
||||
}
|
||||
|
||||
enable_ssh() {
|
||||
[[ $ENABLE_SSH == true ]] || return
|
||||
local service_name='sshd'
|
||||
if systemctl list-unit-files ssh.service >/dev/null 2>&1; then
|
||||
service_name='ssh'
|
||||
fi
|
||||
systemctl enable --now "$service_name"
|
||||
if command -v ufw >/dev/null 2>&1 && ufw status | grep -q '^Status: active'; then
|
||||
ufw allow OpenSSH
|
||||
elif command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld; then
|
||||
firewall-cmd --permanent --add-service=ssh
|
||||
firewall-cmd --reload
|
||||
fi
|
||||
}
|
||||
|
||||
verify_domain_connectivity() {
|
||||
need_command getent
|
||||
getent ahostsv4 "$DOMAIN_CONTROLLER" >/dev/null || \
|
||||
fail "Could not resolve the domain controller: $DOMAIN_CONTROLLER"
|
||||
if command -v resolvectl >/dev/null 2>&1; then
|
||||
resolvectl query --type=SRV "_ldap._tcp.dc._msdcs.${DOMAIN_NAME}" >/dev/null || \
|
||||
fail "AD DNS does not provide _ldap._tcp.dc._msdcs.${DOMAIN_NAME}."
|
||||
fi
|
||||
}
|
||||
|
||||
configure_private_ad_interface
|
||||
install_prerequisites
|
||||
verify_domain_connectivity
|
||||
|
||||
# Establish a canonical host name before adcli creates or refreshes the
|
||||
# computer object, SPNs, and keytab entries.
|
||||
hostnamectl set-hostname "$HOST_FQDN"
|
||||
|
||||
if realm list --name-only 2>/dev/null | grep -Fxqi "$DOMAIN_NAME"; then
|
||||
printf 'Computer is already joined to %s; validating and refreshing configuration.\n' "$DOMAIN_NAME"
|
||||
else
|
||||
realm discover "$DOMAIN_NAME" >/dev/null
|
||||
printf 'Joining %s. realmd will request the password for %s interactively.\n' "$DOMAIN_NAME" "$JOIN_USER"
|
||||
realm join \
|
||||
--membership-software=adcli \
|
||||
--client-software=sssd \
|
||||
--computer-ou="$COMPUTER_OU" \
|
||||
--user="$JOIN_USER" \
|
||||
"$DOMAIN_NAME"
|
||||
fi
|
||||
|
||||
enable_sssd_dyndns
|
||||
systemctl enable --now sssd
|
||||
sssctl config-check
|
||||
systemctl restart sssd
|
||||
adcli update --domain="$DOMAIN_NAME" --host-fqdn="$HOST_FQDN" --computer-name="$COMPUTER_NAME"
|
||||
adcli testjoin --domain="$DOMAIN_NAME"
|
||||
|
||||
if [[ -n $ALLOW_GROUP ]]; then
|
||||
realm deny --all
|
||||
realm permit --groups "$ALLOW_GROUP"
|
||||
fi
|
||||
|
||||
enable_ssh
|
||||
|
||||
printf '\nLinux enrollment completed.\n'
|
||||
printf ' Host: %s\n' "$HOST_FQDN"
|
||||
printf ' Domain: %s\n' "$DOMAIN_NAME"
|
||||
printf ' OU: %s\n' "$COMPUTER_OU"
|
||||
printf ' Login format: %%U@%s\n' "$DOMAIN_NAME"
|
||||
realm list
|
||||
Reference in New Issue
Block a user