عضویت Debian در Active Directory با realmd و SSSD

resolvectl status 2>/dev/null | grep 'DNS Servers' || cat /etc/resolv.conf
sudo apt install -y chrony
echo "server dc01.corp.sahor.ir iburst" | sudo tee /etc/chrony/sources.d/ad.sources
sudo systemctl restart chrony && chronyc sources

sudo apt install -y realmd sssd sssd-tools libnss-sss libpam-sss adcli \
  samba-common-bin oddjob oddjob-mkhomedir krb5-user

sudo realm discover corp.sahor.ir
sudo realm join --user=Administrator --computer-ou="OU=Linux,OU=Servers,DC=corp,DC=sahor,DC=ir" corp.sahor.ir
sudo realm list

[domain/corp.sahor.ir]
use_fully_qualified_names = False
fallback_homedir = /home/%u
default_shell = /bin/bash
ad_gpo_access_control = permissive

sudo pam-auth-update --enable mkhomedir
sudo systemctl restart sssd
id ali

sudo realm deny --all
sudo realm permit -g linux-admins

echo '%linux-admins ALL=(ALL:ALL) ALL' | sudo tee /etc/sudoers.d/ad-admins
sudo chmod 440 /etc/sudoers.d/ad-admins
sudo visudo -cf /etc/sudoers.d/ad-admins

ssh ali@debian01.corp.sahor.ir
sudo sssctl domain-status corp.sahor.ir
sudo sss_cache -E          # clear cache after changing group membership in AD
sudo journalctl -u sssd -n 50 --no-pager