Skip to content

Commit 533f0b2

Browse files
JillGrant615JillGrant615
authored
Merge pull request #312557 from khdownie/kendownie030326-3
Files Linux AD Kerberos auth integrity check
2 parents ae75d27 + e958234 commit 533f0b2

1 file changed

Lines changed: 141 additions & 133 deletions

File tree

‎articles/storage/files/storage-files-identity-auth-linux-kerberos-enable.md‎

Lines changed: 141 additions & 133 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: khdownie
55
ms.service: azure-file-storage
66
ms.custom: linux-related-content
77
ms.topic: how-to
8-
ms.date: 02/23/2026
8+
ms.date: 03/03/2026
99
ms.author: kendownie
1010
# Customer intent: "As a Linux administrator, I want to enable Kerberos authentication for accessing Azure file shares, so that I can securely manage file access using Active Directory and streamline authentication processes for users."
1111
---
@@ -21,14 +21,14 @@ For more information on supported options and considerations, see [Overview of A
2121
- On-premises Windows Active Directory Domain Services (AD DS)
2222
- Microsoft Entra Domain Services
2323

24-
To use AD DS, you must sync your AD DS to Microsoft Entra ID by using Microsoft Entra Connect.
24+
To use AD DS, you must sync your AD DS to Microsoft Entra ID by using [Microsoft Entra Connect Sync](/entra/identity/hybrid/connect/how-to-connect-sync-whatis).
2525

2626
> [!NOTE]
2727
> This article uses Ubuntu for the example steps. Similar configurations work for RHEL and SLES clients, allowing you to mount Azure file shares using Active Directory.
2828
2929
## Linux SMB client limitations
3030

31-
You can't use identity-based authentication to mount Azure File shares on Linux clients at boot time by using `fstab` entries. This ie because the client can't get the Kerberos ticket early enough to mount at boot time. You can use an `fstab` entry and specify the `noauto` option to enable a user to mount the file share after sign in by using a simple mount command without all the parameters. You can also use [`autofs`](storage-how-to-use-files-linux.md?tabs=smb311#dynamically-mount-with-autofs) to mount the share upon access.
31+
You can't use identity-based authentication to mount Azure File shares on Linux clients at boot time by using `fstab` entries. This is because the client can't get the Kerberos ticket early enough to mount at boot time. You can use an `fstab` entry and specify the `noauto` option to enable a user to mount the file share after sign in by using a simple mount command without all the parameters. You can also use [`autofs`](storage-how-to-use-files-linux.md?tabs=smb311#dynamically-mount-with-autofs) to mount the share upon access.
3232

3333
## Prerequisites
3434

@@ -37,7 +37,7 @@ Before you enable Active Directory authentication over SMB for Azure file shares
3737
- A Linux VM running Ubuntu 18.04+, or an equivalent RHEL or SLES VM. If running on Azure, the VM must have at least one network interface on the virtual network containing Microsoft Entra Domain Services. If using an on-premises VM, your AD DS must be synced to Microsoft Entra ID.
3838
- Root user or user credentials to a local user account that has full sudo rights (for this guide, localadmin).
3939
- The Linux VM isn't joined already to another AD domain. If it's already a part of a domain, it must first leave that domain before it can join this domain.
40-
- A Microsoft Entra tenant [fully configured](../../active-directory-domain-services/tutorial-create-instance.md), with domain user already set up.
40+
- A Microsoft Entra tenant [fully configured](/entra/identity/domain-services/tutorial-create-instance), with domain user already set up.
4141

4242
Installing the samba package isn't strictly necessary, but it gives you some useful tools and brings in other packages automatically, such as `samba-common` and `smbclient`. Run the following commands to install it. If you're asked for any input values during installation, leave them blank.
4343

@@ -48,11 +48,11 @@ sudo apt install samba winbind libpam-winbind libnss-winbind krb5-config krb5-us
4848

4949
The `wbinfo` tool is part of the samba suite and is useful for authentication and debugging purposes, such as checking if the domain controller is reachable, checking what domain a machine is joined to, and finding information about users.
5050

51-
Make sure that the Linux host keeps the time synchronized with the domain server. Refer to the documentation for your Linux distribution. For some distros, you can do this [using systemd-timesyncd](https://www.freedesktop.org/software/systemd/man/timesyncd.conf.html). Edit `/etc/systemd/timesyncd.conf` by using your favorite text editor to include the following:
51+
Make sure that the Linux host keeps the time synchronized with the domain server. Refer to the documentation for your Linux distribution. For some distros, you can do this [using systemd-timesyncd](https://www.freedesktop.org/software/systemd/man/timesyncd.conf.html). Edit `/etc/systemd/timesyncd.conf` to include the following. Replace `ntp.server` with the same NTP server hostname or IP address that your domain server uses.
5252

5353
```plaintext
5454
[Time]
55-
NTP=onpremaadint.com
55+
NTP=ntp.server
5656
FallbackNTP=ntp.ubuntu.com
5757
```
5858

@@ -64,138 +64,144 @@ sudo systemctl restart systemd-timesyncd.service
6464

6565
## Enable AD Kerberos authentication
6666

67-
Follow these steps to enable AD Kerberos authentication. [This Samba documentation](https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member) might be helpful as a reference.
67+
Follow these steps to enable AD Kerberos authentication using either on-premises AD DS or Microsoft Entra Domain Services. [This Samba documentation](https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member) might be helpful as a reference.
6868

6969
### Make sure the domain server is reachable and discoverable
7070

71-
1. Make sure that the DNS servers you enter contain the domain server IP addresses.
72-
73-
```bash
74-
systemd-resolve --status
75-
```
76-
77-
```output
78-
Global
79-
DNSSEC NTA: 10.in-addr.arpa
80-
16.172.in-addr.arpa
81-
168.192.in-addr.arpa
82-
17.172.in-addr.arpa
83-
18.172.in-addr.arpa
84-
19.172.in-addr.arpa
85-
20.172.in-addr.arpa
86-
21.172.in-addr.arpa
87-
22.172.in-addr.arpa
88-
23.172.in-addr.arpa
89-
24.172.in-addr.arpa
90-
25.172.in-addr.arpa
91-
26.172.in-addr.arpa
92-
27.172.in-addr.arpa
93-
28.172.in-addr.arpa
94-
29.172.in-addr.arpa
95-
30.172.in-addr.arpa
96-
31.172.in-addr.arpa
97-
corp
98-
d.f.ip6.arpa
99-
home
100-
internal
101-
intranet
102-
lan
103-
local
104-
private
105-
test
106-
107-
Link 2 (eth0)
108-
Current Scopes: DNS
109-
LLMNR setting: yes
110-
MulticastDNS setting: no
111-
DNSSEC setting: no
112-
DNSSEC supported: no
113-
DNS Servers: 10.0.2.5
114-
10.0.2.4
115-
10.0.0.41
116-
DNS Domain: domain1.contoso.com
117-
```
118-
119-
2. If the command works, skip the following steps and proceed to the next section.
120-
121-
3. If the command doesn't work, make sure that you can ping the domain server IP addresses.
122-
123-
```bash
124-
ping 10.0.2.5
125-
```
126-
127-
```output
128-
PING 10.0.2.5 (10.0.2.5) 56(84) bytes of data.
129-
64 bytes from 10.0.2.5: icmp_seq=1 ttl=128 time=0.898 ms
130-
64 bytes from 10.0.2.5: icmp_seq=2 ttl=128 time=0.946 ms
131-
132-
^C
133-
134-
--- 10.0.2.5 ping statistics ---
135-
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
136-
rtt min/avg/max/mdev = 0.898/0.922/0.946/0.024 ms
137-
```
138-
139-
4. If the ping doesn't work, go back to [prerequisites](#prerequisites), and make sure that your VM is on a virtual network that has access to the Entra tenant.
71+
The following section assumes you have an existing, on-premises AD DS. If you're using Microsoft Entra Domain Services instead, skip this section and proceed to [Connect to Entra Domain Services and make sure the services are discoverable](#connect-to-microsoft-entra-domain-services-and-make-sure-the-services-are-discoverable).
14072

141-
5. If the IP addresses respond to ping but the DNS servers aren't automatically discovered, you can add the DNS servers manually. Edit `/etc/netplan/50-cloud-init.yaml` by using your favorite text editor.
142-
143-
```plaintext
144-
# This file is generated from information provided by the datasource. Changes
145-
# to it will not persist across an instance reboot. To disable cloud-init's
146-
# network configuration capabilities, write a file
147-
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
148-
# network: {config: disabled}
149-
network:
150-
ethernets:
151-
eth0:
152-
dhcp4: true
153-
dhcp4-overrides:
154-
route-metric: 100
155-
dhcp6: false
156-
match:
157-
macaddress: 00:22:48:03:6b:c5
158-
set-name: eth0
159-
nameservers:
160-
addresses: [10.0.2.5, 10.0.2.4]
161-
version: 2
162-
```
163-
164-
Then apply the changes:
165-
166-
```bash
167-
sudo netplan --debug apply
168-
```
169-
170-
6. Winbind assumes that the DHCP server keeps the domain DNS records up-to-date. However, this assumption isn't true for Azure DHCP. To set up the client to make DDNS updates, use [this guide](../../virtual-network/virtual-networks-name-resolution-ddns.md#linux-clients) to create a network script. Here's a sample script that resides at `/etc/dhcp/dhclient-exit-hooks.d/ddns-update`.
171-
172-
```plaintext
173-
#!/bin/sh
174-
175-
# only execute on the primary nic
176-
if [ "$interface" != "eth0" ]
177-
then
178-
return
179-
fi
180-
181-
# When you have a new IP, perform nsupdate
182-
if [ "$reason" = BOUND ] || [ "$reason" = RENEW ] ||
183-
[ "$reason" = REBIND ] || [ "$reason" = REBOOT ]
184-
then
185-
host=`hostname -f`
186-
nsupdatecmds=/var/tmp/nsupdatecmds
187-
echo "update delete $host a" > $nsupdatecmds
188-
echo "update add $host 3600 a $new_ip_address" >> $nsupdatecmds
189-
echo "send" >> $nsupdatecmds
73+
1. Make sure that the DNS servers you enter contain the domain server IP addresses.
19074

191-
nsupdate $nsupdatecmds
192-
fi
193-
```
75+
```bash
76+
systemd-resolve --status
77+
```
78+
79+
```output
80+
Global
81+
DNSSEC NTA: 10.in-addr.arpa
82+
16.172.in-addr.arpa
83+
168.192.in-addr.arpa
84+
17.172.in-addr.arpa
85+
18.172.in-addr.arpa
86+
19.172.in-addr.arpa
87+
20.172.in-addr.arpa
88+
21.172.in-addr.arpa
89+
22.172.in-addr.arpa
90+
23.172.in-addr.arpa
91+
24.172.in-addr.arpa
92+
25.172.in-addr.arpa
93+
26.172.in-addr.arpa
94+
27.172.in-addr.arpa
95+
28.172.in-addr.arpa
96+
29.172.in-addr.arpa
97+
30.172.in-addr.arpa
98+
31.172.in-addr.arpa
99+
corp
100+
d.f.ip6.arpa
101+
home
102+
internal
103+
intranet
104+
lan
105+
local
106+
private
107+
test
108+
109+
Link 2 (eth0)
110+
Current Scopes: DNS
111+
LLMNR setting: yes
112+
MulticastDNS setting: no
113+
DNSSEC setting: no
114+
DNSSEC supported: no
115+
DNS Servers: 10.0.2.5
116+
10.0.2.4
117+
10.0.0.41
118+
DNS Domain: domain1.contoso.com
119+
```
120+
121+
1. If the command works, skip the following steps and proceed to the [next section](#set-up-hostname-and-fully-qualified-domain-name-fqdn).
122+
123+
1. If the command doesn't work, make sure that you can ping the domain server IP addresses.
124+
125+
```bash
126+
ping 10.0.2.5
127+
```
128+
129+
```output
130+
PING 10.0.2.5 (10.0.2.5) 56(84) bytes of data.
131+
64 bytes from 10.0.2.5: icmp_seq=1 ttl=128 time=0.898 ms
132+
64 bytes from 10.0.2.5: icmp_seq=2 ttl=128 time=0.946 ms
133+
134+
^C
135+
136+
--- 10.0.2.5 ping statistics ---
137+
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
138+
rtt min/avg/max/mdev = 0.898/0.922/0.946/0.024 ms
139+
```
140+
141+
1. If the ping doesn't work, go back to [prerequisites](#prerequisites), and make sure that your VM is on a virtual network that has access to the Entra tenant.
142+
143+
1. If the IP addresses respond to ping but the DNS servers aren't automatically discovered, you can add the DNS servers manually. Edit `/etc/netplan/50-cloud-init.yaml` by using your favorite text editor.
144+
145+
```plaintext
146+
# This file is generated from information provided by the datasource. Changes
147+
# to it will not persist across an instance reboot. To disable cloud-init's
148+
# network configuration capabilities, write a file
149+
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
150+
# network: {config: disabled}
151+
network:
152+
ethernets:
153+
eth0:
154+
dhcp4: true
155+
dhcp4-overrides:
156+
route-metric: 100
157+
dhcp6: false
158+
match:
159+
macaddress: 00:22:48:03:6b:c5
160+
set-name: eth0
161+
nameservers:
162+
addresses: [10.0.2.5, 10.0.2.4]
163+
version: 2
164+
```
165+
166+
Then apply the changes:
167+
168+
```bash
169+
sudo netplan --debug apply
170+
```
171+
172+
1. Winbind assumes that the DHCP server keeps the domain DNS records up-to-date. However, this assumption isn't true for Azure DHCP. To set up the client to make DDNS updates, use [this guide](../../virtual-network/virtual-networks-name-resolution-ddns.md#linux-clients) to create a network script. Here's a sample script that resides at `/etc/dhcp/dhclient-exit-hooks.d/ddns-update`.
173+
174+
```plaintext
175+
#!/bin/sh
176+
177+
# only execute on the primary nic
178+
if [ "$interface" != "eth0" ]
179+
then
180+
return
181+
fi
182+
183+
# When you have a new IP, perform nsupdate
184+
if [ "$reason" = BOUND ] || [ "$reason" = RENEW ] ||
185+
[ "$reason" = REBIND ] || [ "$reason" = REBOOT ]
186+
then
187+
host=`hostname -f`
188+
nsupdatecmds=/var/tmp/nsupdatecmds
189+
echo "update delete $host a" > $nsupdatecmds
190+
echo "update add $host 3600 a $new_ip_address" >> $nsupdatecmds
191+
echo "send" >> $nsupdatecmds
192+
193+
nsupdate $nsupdatecmds
194+
fi
195+
```
196+
197+
Proceed to [set up a hostname and fully qualified domain name](#set-up-hostname-and-fully-qualified-domain-name-fqdn).
194198

195199
<a name='connect-to-azure-ad-ds-and-make-sure-the-services-are-discoverable'></a>
196200

197201
### Connect to Microsoft Entra Domain Services and make sure the services are discoverable
198202

203+
If you're using AD DS and not Microsoft Entra Domain Services, you can skip this section and proceed to [set up a hostname and fully qualified domain name](#set-up-hostname-and-fully-qualified-domain-name-fqdn).
204+
199205
Make sure that you can ping the domain server by the domain name.
200206

201207
```bash
@@ -241,7 +247,7 @@ Using your text editor, update the `/etc/hosts` file with the final FQDN (after
241247
```plaintext
242248
127.0.0.1 contosovm.contosodomain.contoso.com contosovm
243249
#cmd=sudo vim /etc/hosts
244-
#then enter this value instead of localhost "ubuntvm.contosodomain.contoso.com UbuntuVM"
250+
#then enter this value instead of localhost "ubuntuvm.contosodomain.contoso.com UbuntuVM"
245251
```
246252

247253
Now, your hostname should resolve. You can ignore the IP address it resolves to for now. The short hostname should resolve to the FQDN.
@@ -345,7 +351,7 @@ sudo smbcontrol all reload-config
345351

346352
### Join the domain
347353

348-
Use the `net ads join` command to join the host to the Microsoft Entra Domain Services domain. If the command returns an error, see [Troubleshooting samba domain members](https://wiki.samba.org/index.php/Troubleshooting_Samba_Domain_Members) to resolve the problem.
354+
Use the `net ads join` command to join the host to the domain. If the command returns an error, see [Troubleshooting samba domain members](https://wiki.samba.org/index.php/Troubleshooting_Samba_Domain_Members) to resolve the problem.
349355

350356
```bash
351357
sudo net ads join -U contososmbadmin # user - garead
@@ -372,10 +378,10 @@ Name: contosovm.contosodomain.contoso.com
372378
Address: 10.0.0.8
373379
```
374380
375-
If you plan for users to actively sign in to client machines and access the Azure file shares, you need to [set up nsswitch.conf](#set-up-nsswitchconf) and [configure PAM for winbind](#configure-pam-for-winbind). If planned access is limited to applications represented by a user account or computer account that need Kerberos authentication to access the file share, you can skip these steps.
376-
377381
### Set up nsswitch.conf
378382
383+
If you plan for users to actively sign in to client machines and access the Azure file shares, you need to set up nsswitch.conf. If planned access is limited to applications represented by a user account or computer account that need Kerberos authentication to access the file share, you can skip this step.
384+
379385
After you join the host to the domain, add the winbind libraries to the user and group lookup paths. Use your text editor to edit `/etc/nsswitch.conf` and add the following entries:
380386
381387
```plaintext
@@ -449,6 +455,8 @@ wbinfo --ping-dc
449455

450456
### Configure PAM for winbind
451457

458+
If you plan for users to actively sign in to client machines and access the Azure file shares, you need to configure PAM for winbind. If planned access is limited to applications represented by a user account or computer account that need Kerberos authentication to access the file share, you can skip this step.
459+
452460
Place winbind in the authentication stack so that domain users authenticate through winbind by configuring PAM (Pluggable Authentication Module) for winbind. The second command ensures that the system creates the home directory for a domain user upon first login.
453461

454462
```bash
@@ -509,7 +517,7 @@ wbinfo -K 'contososmbadmin%SUPERSECRETPASSWORD'
509517
510518
## Mount the file share
511519
512-
After you enable AD (or Entra ID) Kerberos authentication and domain-join your Linux VM, you can mount the file share.
520+
After you enable Kerberos authentication and domain-join your Linux VM, you can mount the file share.
513521
514522
Use the following mount option with all access control models to enable Kerberos security: `sec=krb5`. Omit the username and password when you use `sec=krb5`. For example:
515523

0 commit comments

Comments
 (0)