Manage your Active Directory from Linux with adtool

Active Directory is one of those Microsoft tools that so many have no choice but to use. Although I much prefer LDAP because it is so much easier to set up and manage. But for much of the enterprise world Active Directory is the tool used. Does this mean you are locked into managing Active Directory from a Windows machine? No. If you are a creature of the command line you can manage your AD from the Linux command line. It’s not that difficult and, in the end, will give you many more options to keep your AD server managed.

Of course it is not just a matter of working on the Linux end of things. There is one issue to settle on the MS end. You have to activate Secure LDAP on your AD Server. This process goes beyond the scope of this article, but the steps are pretty clear.

Enable SLDAP

Here are the steps to enable Secure LDAP on your Windows 2003 AD server (I will leave out the details):

  1. Create an Active Directory domain controller certificate request.
  2. Create a Certification Authority.
  3. Sign the certificate request by the Certification Authority.
  4. Export the root certificate Certification Authority.
  5. Import the root certificate Certification Authority onto the Domain Controller.
  6. Import the LDAP Server certificate onto the Domain Controller.
  7. Set up the UMRA (LDAP Client) computer.
  8. Verify Secure LDAPS using SSL.

Installing adtool

Fortunately adtool will be found in your distributions’ repositories. So all you have to do is follow these steps:

  1. Fire up Synaptic (or whichever Add/Remove Software utility you use).
  2. Do a search for “adtool” (no quotes).
  3. Mark the results for installation.
  4. Click Apply to install.
  5. Close Synaptic.

Configuring adtool

This is a bit of configuration you need to handle before you can use adtool on your AD server. First create the file (if it doesn’t exist) /etc/adtool.cfg and add the following contents:

uri ldaps://YOUR.DOMAIN.HERE
binddn cn=Administrator,cn=Users,dc=domain,dc=tld
bindpw $PASSWORD
searchbase dc=domain,dc=tld

Where YOUR.DOMAIN.HERE is the actual address to your Active Directory server.

Where PASSWORD is the password for the AD user that has proper permissions to manage the AD server.

You will also need to make sure the following is in your /etc/ldap/ldap.conf file:

BASE dc=YOUR,dc=DOMAIN,dc=HERE
URI ldaps://YOUR.DOMAIN.HERE
TLS_REQCERT allow

Without the above configuration you will not be able to accept the SSL certificates from the server.

Basic usage

The basic usage of the adtool command is simple. Of course you will have to understand Active Directory in order to really understand the usage of this tool. Below I will give you samples of commands to handle the basic tasks for AD. Any information in ALL CAPS would be altered to fit your needs.

Create a new organizational unit:

adtool oucreate ORGANIZATION NAME ou=user,dc=DOMAIN,dc=COM

Add a user:

adtool useradd USER ou=ORGANIZATION ou=user,cd=DOMAIN,dc=COM

Set a user password:

adtool setpass USER PASSWORD

Unlock a user:

adtool unlock USER

Create a group

adtool groupcreate GROUP ou=user,cd=DOMAIN,dc=COM

Add a user to a group:

adtool groupadd allusers USER

Add an email address for the user:

adtool attributereplace USER mail EMAIL@ADDRESS

Comments

Post a Comment

Popular posts from this blog

Microsoft Becomes a Linux Kernel Contributor

You read that right — Microsoft has become a contributor to the Linux kernel. Microsoft and Greg Kroah-Hartman have posted about this in more detail, so I’d encourage you to go read those posts for the full details. The long and short of it, though, is that Microsoft has contributed roughly 20,000 lines of code to the Linux kernel related to their Hyper-V drivers. As Greg says, this is no different from any other company contributing to the Linux kernel — lots of companies are becoming contributors to the kernel, so why not Microsoft? On the other hand, it’s Microsoft , so it is a kind of big deal that they have come 180 degrees to become a kernel contributor. This really underscores the importance of the Linux Driver Project that Greg has been working on. It also underscores the importance of having an open dialog with companies. This week, I’m in San Jose for OSCON. A little more than 10 years ago, I was in San Jose for LinuxWorld Expo, and the idea of Microsoft contributing a k
Read more

Top 3 Linux Burning Apps

Image
1. K3b Not many can argue against this one. K3b is the most popular burning application for Linux, and although it uses KDE3 libraries, many GNOME users prefer it too over native GTK burners. K3b 1.0.5 running in Debian Lenny The version I'm going to talk about is 1.0.5 for KDE3, but K3b 2.0 for KDE4 is in the works, and the second alpha was made available for testing purposes earlier this year. You can read my review of K3b 2.0 Alpha 1 here . K3b can burn anything, from audio CDs to DVDs or ISO images. It allows you to save the projects, it includes a powerful file explorer and an easy to use interface. You can also use K3b to create CD/DVD ISO images, it supports projects, multisession mode and ripping video DVDs. 2. Brasero Brasero is the default GNOME burning application. As usual, it features a simple interface which integrates very well in GNOME, with five large buttons for fast access to the most common actions: - Audio project, to create an audio CD - Data project, to cre
Read more