I'm working on a way to use MS Active Directory for authentication in our linux environment (we are predominantly a Windows shop).

I've configured a test linux box to successfully authenticate to our AD environment. To do this I used the process outlined in this article:

http://technet.microsoft.com/en-us/m....12.linux.aspx

This works great - I am able to sign on to this linux box using an AD account.

The next thing I would like to do is to be able to use AD groups in Linux config files. For example, I'd like to limit SSH logons to only certain AD groups. I've tried adding an AD group to /etc/ssh/sshd_config, but this doesn't seem to work. I've tried adding the group in the domain\group format as well as group@domain format. I'd also like to use AD groups in the sudoers file.

A. Is it possible?
B. If so, how can I do this?

I assume you've reviewed the official Samba documentation at www.samba.org - it's pretty good. My first thought was that AD groups are not supported by Samba, but I've never tried it, so I'm not sure. There are some limits to AD support in Samba and I believe these are pretty well covered in the Samba docs.

Using AD groups in the sudoers file seems like a bad idea, on the surface at least.

Why do you say that using AD groups in the sudoers file seems like a bad idea?

Here's my thinking (keep in mind that I'm a Windows guy trying to deal with Linux here)

We already have AD authentication on this box. So, admins can sign in with their AD account. That saves us from having to manage separate IDs in Linux.

Also, I don't want people to just sign in with their AD account, then su. If I can add AD groups (or less desirably individual AD accounts) to the sudoers file, then they can use sudo from their AD account to do their jobs.

If I'm heading down a bad path here(from a linux perspective) please advise.

I would not be confident in the security of trying to bring an AD group into a Linux sudoers list. But that's just me, probably.

Here's some relevant info group mappings in newer versions of Samba:

http://us1.samba.org/samba/docs/man/...html#id2571717