Skip to content

Commit c179c28

Browse files
khdowniekhdownie
committed
Files Linux AD Kerberos auth integrity check
1 parent d301a2d commit c179c28

1 file changed

Lines changed: 128 additions & 128 deletions

File tree

‎articles/storage/files/storage-files-identity-auth-linux-kerberos-enable.md‎

Lines changed: 128 additions & 128 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: khdownie
55
ms.service: azure-file-storage
66
ms.custom: linux-related-content
77
ms.topic: how-to
8-
ms.date: 02/23/2026
8+
ms.date: 03/03/2026
99
ms.author: kendownie
1010
# Customer intent: "As a Linux administrator, I want to enable Kerberos authentication for accessing Azure file shares, so that I can securely manage file access using Active Directory and streamline authentication processes for users."
1111
---
@@ -21,14 +21,14 @@ For more information on supported options and considerations, see [Overview of A
2121
- On-premises Windows Active Directory Domain Services (AD DS)
2222
- Microsoft Entra Domain Services
2323

24-
To use AD DS, you must sync your AD DS to Microsoft Entra ID by using Microsoft Entra Connect.
24+
To use AD DS, you must sync your AD DS to Microsoft Entra ID by using [Microsoft Entra Connect Sync](/entra/identity/hybrid/connect/how-to-connect-sync-whatis).
2525

2626
> [!NOTE]
2727
> This article uses Ubuntu for the example steps. Similar configurations work for RHEL and SLES clients, allowing you to mount Azure file shares using Active Directory.
2828
2929
## Linux SMB client limitations
3030

31-
You can't use identity-based authentication to mount Azure File shares on Linux clients at boot time by using `fstab` entries. This ie because the client can't get the Kerberos ticket early enough to mount at boot time. You can use an `fstab` entry and specify the `noauto` option to enable a user to mount the file share after sign in by using a simple mount command without all the parameters. You can also use [`autofs`](storage-how-to-use-files-linux.md?tabs=smb311#dynamically-mount-with-autofs) to mount the share upon access.
31+
You can't use identity-based authentication to mount Azure File shares on Linux clients at boot time by using `fstab` entries. This is because the client can't get the Kerberos ticket early enough to mount at boot time. You can use an `fstab` entry and specify the `noauto` option to enable a user to mount the file share after sign in by using a simple mount command without all the parameters. You can also use [`autofs`](storage-how-to-use-files-linux.md?tabs=smb311#dynamically-mount-with-autofs) to mount the share upon access.
3232

3333
## Prerequisites
3434

@@ -37,7 +37,7 @@ Before you enable Active Directory authentication over SMB for Azure file shares
3737
- A Linux VM running Ubuntu 18.04+, or an equivalent RHEL or SLES VM. If running on Azure, the VM must have at least one network interface on the virtual network containing Microsoft Entra Domain Services. If using an on-premises VM, your AD DS must be synced to Microsoft Entra ID.
3838
- Root user or user credentials to a local user account that has full sudo rights (for this guide, localadmin).
3939
- The Linux VM isn't joined already to another AD domain. If it's already a part of a domain, it must first leave that domain before it can join this domain.
40-
- A Microsoft Entra tenant [fully configured](../../active-directory-domain-services/tutorial-create-instance.md), with domain user already set up.
40+
- A Microsoft Entra tenant [fully configured](/entra/identity/domain-services/tutorial-create-instance), with domain user already set up.
4141

4242
Installing the samba package isn't strictly necessary, but it gives you some useful tools and brings in other packages automatically, such as `samba-common` and `smbclient`. Run the following commands to install it. If you're asked for any input values during installation, leave them blank.
4343

@@ -48,11 +48,11 @@ sudo apt install samba winbind libpam-winbind libnss-winbind krb5-config krb5-us
4848

4949
The `wbinfo` tool is part of the samba suite and is useful for authentication and debugging purposes, such as checking if the domain controller is reachable, checking what domain a machine is joined to, and finding information about users.
5050

51-
Make sure that the Linux host keeps the time synchronized with the domain server. Refer to the documentation for your Linux distribution. For some distros, you can do this [using systemd-timesyncd](https://www.freedesktop.org/software/systemd/man/timesyncd.conf.html). Edit `/etc/systemd/timesyncd.conf` by using your favorite text editor to include the following:
51+
Make sure that the Linux host keeps the time synchronized with the domain server. Refer to the documentation for your Linux distribution. For some distros, you can do this [using systemd-timesyncd](https://www.freedesktop.org/software/systemd/man/timesyncd.conf.html). Edit `/etc/systemd/timesyncd.conf` to include the following. Replace `ntp.server` with the same NTP server hostname or IP address that your domain server uses.
5252

5353
```plaintext
5454
[Time]
55-
NTP=onpremaadint.com
55+
NTP=ntp.server
5656
FallbackNTP=ntp.ubuntu.com
5757
```
5858

@@ -70,127 +70,127 @@ Follow these steps to enable AD Kerberos authentication. [This Samba documentati
7070

7171
1. Make sure that the DNS servers you enter contain the domain server IP addresses.
7272

73-
```bash
74-
systemd-resolve --status
75-
```
76-
77-
```output
78-
Global
79-
DNSSEC NTA: 10.in-addr.arpa
80-
16.172.in-addr.arpa
81-
168.192.in-addr.arpa
82-
17.172.in-addr.arpa
83-
18.172.in-addr.arpa
84-
19.172.in-addr.arpa
85-
20.172.in-addr.arpa
86-
21.172.in-addr.arpa
87-
22.172.in-addr.arpa
88-
23.172.in-addr.arpa
89-
24.172.in-addr.arpa
90-
25.172.in-addr.arpa
91-
26.172.in-addr.arpa
92-
27.172.in-addr.arpa
93-
28.172.in-addr.arpa
94-
29.172.in-addr.arpa
95-
30.172.in-addr.arpa
96-
31.172.in-addr.arpa
97-
corp
98-
d.f.ip6.arpa
99-
home
100-
internal
101-
intranet
102-
lan
103-
local
104-
private
105-
test
106-
107-
Link 2 (eth0)
108-
Current Scopes: DNS
109-
LLMNR setting: yes
110-
MulticastDNS setting: no
111-
DNSSEC setting: no
112-
DNSSEC supported: no
113-
DNS Servers: 10.0.2.5
114-
10.0.2.4
115-
10.0.0.41
116-
DNS Domain: domain1.contoso.com
117-
```
118-
119-
2. If the command works, skip the following steps and proceed to the next section.
120-
121-
3. If the command doesn't work, make sure that you can ping the domain server IP addresses.
122-
123-
```bash
124-
ping 10.0.2.5
125-
```
126-
127-
```output
128-
PING 10.0.2.5 (10.0.2.5) 56(84) bytes of data.
129-
64 bytes from 10.0.2.5: icmp_seq=1 ttl=128 time=0.898 ms
130-
64 bytes from 10.0.2.5: icmp_seq=2 ttl=128 time=0.946 ms
131-
132-
^C
133-
134-
--- 10.0.2.5 ping statistics ---
135-
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
136-
rtt min/avg/max/mdev = 0.898/0.922/0.946/0.024 ms
137-
```
138-
139-
4. If the ping doesn't work, go back to [prerequisites](#prerequisites), and make sure that your VM is on a virtual network that has access to the Entra tenant.
140-
141-
5. If the IP addresses respond to ping but the DNS servers aren't automatically discovered, you can add the DNS servers manually. Edit `/etc/netplan/50-cloud-init.yaml` by using your favorite text editor.
142-
143-
```plaintext
144-
# This file is generated from information provided by the datasource. Changes
145-
# to it will not persist across an instance reboot. To disable cloud-init's
146-
# network configuration capabilities, write a file
147-
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
148-
# network: {config: disabled}
149-
network:
150-
ethernets:
151-
eth0:
152-
dhcp4: true
153-
dhcp4-overrides:
154-
route-metric: 100
155-
dhcp6: false
156-
match:
157-
macaddress: 00:22:48:03:6b:c5
158-
set-name: eth0
159-
nameservers:
160-
addresses: [10.0.2.5, 10.0.2.4]
161-
version: 2
162-
```
163-
164-
Then apply the changes:
165-
166-
```bash
167-
sudo netplan --debug apply
168-
```
169-
170-
6. Winbind assumes that the DHCP server keeps the domain DNS records up-to-date. However, this assumption isn't true for Azure DHCP. To set up the client to make DDNS updates, use [this guide](../../virtual-network/virtual-networks-name-resolution-ddns.md#linux-clients) to create a network script. Here's a sample script that resides at `/etc/dhcp/dhclient-exit-hooks.d/ddns-update`.
171-
172-
```plaintext
173-
#!/bin/sh
174-
175-
# only execute on the primary nic
176-
if [ "$interface" != "eth0" ]
177-
then
178-
return
179-
fi
180-
181-
# When you have a new IP, perform nsupdate
182-
if [ "$reason" = BOUND ] || [ "$reason" = RENEW ] ||
183-
[ "$reason" = REBIND ] || [ "$reason" = REBOOT ]
184-
then
185-
host=`hostname -f`
186-
nsupdatecmds=/var/tmp/nsupdatecmds
187-
echo "update delete $host a" > $nsupdatecmds
188-
echo "update add $host 3600 a $new_ip_address" >> $nsupdatecmds
189-
echo "send" >> $nsupdatecmds
190-
191-
nsupdate $nsupdatecmds
192-
fi
193-
```
73+
```bash
74+
systemd-resolve --status
75+
```
76+
77+
```output
78+
Global
79+
DNSSEC NTA: 10.in-addr.arpa
80+
16.172.in-addr.arpa
81+
168.192.in-addr.arpa
82+
17.172.in-addr.arpa
83+
18.172.in-addr.arpa
84+
19.172.in-addr.arpa
85+
20.172.in-addr.arpa
86+
21.172.in-addr.arpa
87+
22.172.in-addr.arpa
88+
23.172.in-addr.arpa
89+
24.172.in-addr.arpa
90+
25.172.in-addr.arpa
91+
26.172.in-addr.arpa
92+
27.172.in-addr.arpa
93+
28.172.in-addr.arpa
94+
29.172.in-addr.arpa
95+
30.172.in-addr.arpa
96+
31.172.in-addr.arpa
97+
corp
98+
d.f.ip6.arpa
99+
home
100+
internal
101+
intranet
102+
lan
103+
local
104+
private
105+
test
106+
107+
Link 2 (eth0)
108+
Current Scopes: DNS
109+
LLMNR setting: yes
110+
MulticastDNS setting: no
111+
DNSSEC setting: no
112+
DNSSEC supported: no
113+
DNS Servers: 10.0.2.5
114+
10.0.2.4
115+
10.0.0.41
116+
DNS Domain: domain1.contoso.com
117+
```
118+
119+
1. If the command works, skip the following steps and proceed to the [next section](#set-up-hostname-and-fully-qualified-domain-name-fqdn).
120+
121+
1. If the command doesn't work, make sure that you can ping the domain server IP addresses.
122+
123+
```bash
124+
ping 10.0.2.5
125+
```
126+
127+
```output
128+
PING 10.0.2.5 (10.0.2.5) 56(84) bytes of data.
129+
64 bytes from 10.0.2.5: icmp_seq=1 ttl=128 time=0.898 ms
130+
64 bytes from 10.0.2.5: icmp_seq=2 ttl=128 time=0.946 ms
131+
132+
^C
133+
134+
--- 10.0.2.5 ping statistics ---
135+
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
136+
rtt min/avg/max/mdev = 0.898/0.922/0.946/0.024 ms
137+
```
138+
139+
1. If the ping doesn't work, go back to [prerequisites](#prerequisites), and make sure that your VM is on a virtual network that has access to the Entra tenant.
140+
141+
1. If the IP addresses respond to ping but the DNS servers aren't automatically discovered, you can add the DNS servers manually. Edit `/etc/netplan/50-cloud-init.yaml` by using your favorite text editor.
142+
143+
```plaintext
144+
# This file is generated from information provided by the datasource. Changes
145+
# to it will not persist across an instance reboot. To disable cloud-init's
146+
# network configuration capabilities, write a file
147+
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
148+
# network: {config: disabled}
149+
network:
150+
ethernets:
151+
eth0:
152+
dhcp4: true
153+
dhcp4-overrides:
154+
route-metric: 100
155+
dhcp6: false
156+
match:
157+
macaddress: 00:22:48:03:6b:c5
158+
set-name: eth0
159+
nameservers:
160+
addresses: [10.0.2.5, 10.0.2.4]
161+
version: 2
162+
```
163+
164+
Then apply the changes:
165+
166+
```bash
167+
sudo netplan --debug apply
168+
```
169+
170+
1. Winbind assumes that the DHCP server keeps the domain DNS records up-to-date. However, this assumption isn't true for Azure DHCP. To set up the client to make DDNS updates, use [this guide](../../virtual-network/virtual-networks-name-resolution-ddns.md#linux-clients) to create a network script. Here's a sample script that resides at `/etc/dhcp/dhclient-exit-hooks.d/ddns-update`.
171+
172+
```plaintext
173+
#!/bin/sh
174+
175+
# only execute on the primary nic
176+
if [ "$interface" != "eth0" ]
177+
then
178+
return
179+
fi
180+
181+
# When you have a new IP, perform nsupdate
182+
if [ "$reason" = BOUND ] || [ "$reason" = RENEW ] ||
183+
[ "$reason" = REBIND ] || [ "$reason" = REBOOT ]
184+
then
185+
host=`hostname -f`
186+
nsupdatecmds=/var/tmp/nsupdatecmds
187+
echo "update delete $host a" > $nsupdatecmds
188+
echo "update add $host 3600 a $new_ip_address" >> $nsupdatecmds
189+
echo "send" >> $nsupdatecmds
190+
191+
nsupdate $nsupdatecmds
192+
fi
193+
```
194194

195195
<a name='connect-to-azure-ad-ds-and-make-sure-the-services-are-discoverable'></a>
196196

@@ -241,7 +241,7 @@ Using your text editor, update the `/etc/hosts` file with the final FQDN (after
241241
```plaintext
242242
127.0.0.1 contosovm.contosodomain.contoso.com contosovm
243243
#cmd=sudo vim /etc/hosts
244-
#then enter this value instead of localhost "ubuntvm.contosodomain.contoso.com UbuntuVM"
244+
#then enter this value instead of localhost "ubuntuvm.contosodomain.contoso.com UbuntuVM"
245245
```
246246

247247
Now, your hostname should resolve. You can ignore the IP address it resolves to for now. The short hostname should resolve to the FQDN.

0 commit comments

Comments
 (0)