Novell LINUX ENTERPRISE DESKTOP 11, Руководство пользователя, Страница: 88 / 450

5.3 Configuring a Linux Client for
Active Directory
Before your client can join an AD domain, some adjustments must be made to your
network setup to ensure a flawless interaction of client and server.
DNS
Configure your client machine to use a DNS server that can forward DNS requests
to the AD DNS server. Alternatively, configure your machine to use the AD DNS
server as the name service data source.
NTP
To succeed with Kerberos authentication, the client must have have its time set
accurately. It is highly encouraged to use a central NTP time server for this purpose
(this can be also the NTP server running on your Active Directory domain con-
troller). If the clockskew between your Linux host and the domain controller exceeds
a certain limit, Kerberos authentication fails and the client is logged in only using
the weaker NTLM (NT LAN Manager) authentication. For more details about using
active directory for time synchronization, see
Joining an AD Domain (page 75).
DHCP
If your client uses dynamic network configuration with DHCP, configure DHCP
to provide the same IP and hostname to the client. If possible, use static IP addresses
to be on the safe side.
Firewall
To browse your network neighborhood, either disable the firewall entirely or mark
the interface used for browsing as part of the internal zone.
To change the firewall settings on your client, log in as
root
and start the YaST
firewall module. Select Interfaces. Select your network interface from the list of
interfaces and click Change. Select Internal Zone and apply your settings with OK.
Leave the firewall settings with Next > Accept. To disable the firewall, just set
Service Start to Manually and leave the firewall module with Next > Accept.
AD Account
You cannot log in to an AD domain unless the AD administrator has provided you
with a valid user account for this domain. Use the AD username and password to
log in to the AD domain from your Linux client.
74 Security Guide