Skip to content

Ubuntu Server Build & Active Directory Join

Source: BarnesBears Homelab Standard: Ubuntu Server Build & Active Directory Join, v2 (user-supplied document).

Historical build standard — review before reuse

This page preserves the v2 procedure. Some choices predate later home-lab changes. In particular, v2 pins DNS to 192.168.10.28 alone, while the later intended design uses both AD DNS controllers (192.168.10.28 and 192.168.10.29), generally supplied through UniFi DHCP. Verify the host's current network configuration before applying Netplan changes. The v2 passwordless sudo rule also needs deliberate security approval.

1. Networking

The original v2 standard specified DHCP for the address, but overrode DNS supplied by DHCP:

network:
  version: 2
  ethernets:
    ens18: # Replace with the actual interface name
      dhcp4: true
      dhcp4-overrides:
        use-dns: false
      nameservers:
        addresses:
          - 192.168.10.28
        search:
          - barnesbears.xyz

Current design consideration: Later BarnesBears configuration work moved toward distributing both AD DNS resolvers via DHCP. Do not apply the historical one-server override blindly. Inspect ip link, resolvectl status, and the host's Netplan files; use the approved DHCP DNS settings where appropriate.

2. Hostname

Replace servername with the intended short hostname:

sudo hostnamectl set-hostname servername

3. /etc/hosts

The v2 document specifies:

127.0.0.1 localhost
127.0.1.1 servername.barnesbears.xyz servername

Preserve other required entries already present. Check the FQDN:

hostname -f

4. Packages

The original package list:

sudo apt update
sudo apt install realmd sssd sssd-tools adcli krb5-user oddjob oddjob-mkhomedir packagekit samba-common-bin

Package availability and PAM home-directory setup can differ by Ubuntu release; check the target OS before assuming this list is complete.

5. Domain discovery and Kerberos

realm discover barnesbears.xyz
kinit Administrator@BARNESBEARS.XYZ
klist

Use an authorized join account. Avoid recording passwords or tickets in documentation.

6. Join the domain

The v2 command is:

sudo realm join barnesbears.xyz -U Administrator

Confirm the domain and credentials are appropriate for the target host before joining.

7. SSSD

The v2 settings are:

use_fully_qualified_names = False
fallback_homedir = /home/%u

Apply these within the appropriate domain section of the existing /etc/sssd/sssd.conf, preserving the other generated settings. Protect the configuration's permissions, then restart:

sudo systemctl restart sssd

8. SSH Kerberos authentication

The v2 SSH settings:

GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
UsePAM yes

Use the host's managed SSH configuration or an appropriate drop-in, and validate syntax before restarting or reloading. Keep a separate working administrator session open while testing:

sudo sshd -t
sudo systemctl restart ssh

If Ansible manages SSH, coordinate with the sshd role to prevent configuration drift.

9. Home directories

The v2 standard enables Create home directory on login through:

sudo pam-auth-update

Confirm the PAM profile is enabled and test with a designated domain account.

10. Sudo access

The v2 document proposes a sudoers drop-in at /etc/sudoers.d/linux-admins:

%BARNESBEARS\\linux\ admins ALL=(ALL:ALL) NOPASSWD:ALL

Privileged access — verify policy before deployment

This is the historical v2 rule, not a blanket recommendation. It gives members of the matching AD group passwordless root-equivalent sudo privileges. Confirm the exact group name and escaping on the target host, and decide whether NOPASSWD is appropriate. Use visudo to edit/validate and maintain an emergency local administrator account.

Validate syntax:

sudo visudo -c

11. Verification

Replace user and server with a designated test account and target host:

host "$(hostname -f)"
id user
getent passwd user
ssh user@server
sudo whoami

Also check realm list, chronyc tracking, and chronyc sources -v where Chrony is managed. An AD join is not fully validated until identity lookup, login, home-directory creation, and authorized privilege escalation work as expected.