Photon OS joining to Active Directory domain

Lubomir Tobek

4 min read

·

Jan 18, 2024

--

Listen

Share

“Photon OS is a free and open-source operating system that is designed and suitable for use in containerized environments. Developed by VMware, it is optimized to run on cloud platforms like vSphere, providing a small, secure, and stable foundation for running containerized applications.”

Greetings. In today’s blog post, I’d like to look at joining Photon OS to a Microsoft Windows Active Directory domain.

The theme looks simple, but it is far from easy. I believe it will help someone.

I set up a small local environment hosted in VMware Fusion at home. The post’s subject will be the MS Windows Server 2022 operating system in the Standard version, which holds the Domain Controller and DNS roles, and the Photon OS v4 operating system.

The installation iso image sources were downloaded from:

https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2022
https://github.com/vmware/photon/wiki/Downloading-Photon-OS

OS: Microsoft Windows Server 21H2, OS Build 20348.587
fqdn: dc.domain.local
ip: 192.168.1.100

OS: VMware Photon OS 4.0 Rev2, build number 2f5aad892
hostname: photon
ip: 192.168.1.131

In the domain name “domain.local” I created a DNS A record for the hostname “photon.”

According to the MS documentation, I opened the appropriate ports for iptables to connect to the domain on Photon OS.

DNS server has Photon OS set to dc.domain.local.

I edited /etc/hosts in Photon OS:

127.0.0.1 localhost
192.168.1.131 photon
192.168.1.100 dc.domain.local

I edited /etc/resolv.conf in Photon OS:

domain domain.local
search domain.local
nameserver 192.168.1.100

I edited /etc/systemd/network/10-eth0-static.network in Photon OS and add record DNS=192.168.1.100

On the domain controller still needs to be set: smb1=false, smb2=true
Get-SmbServerConfiguration | Select EnableSMB1Protocol
Get-SmbServerConfiguration | Select EnableSMB2Protocol

Ref: https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3?tabs=server

root@photon [ ~ ]# tdnf makecache
root@photon [ ~ ]# tdnf -y distro-sync
root@photon [ ~ ]# tdnf update -y

root@photon [ ~ ]# tdnf install likewise-open -y

root@photon [ ~ ]# /opt/likewise/bin/lwregshell set_value '[HKEY_THIS_MACHINE\Services\lwio\Parameters\Drivers\rdr]' Smb2Enabled 1
root@photon [ ~ ]# /opt/likewise/bin/lwsm restart lwio

root@photon [ ~ ]# cat /etc/likewise/likewise-krb5-ad.conf
[libdefaults]
    default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC
    default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC
    preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC
    dns_lookup_kdc = true
    default_realm = dc.domain.local

root@photon [ ~ ]# ldapsearch -x -LLL -H ldap://192.168.1.100 -b "dc=domain,dc=local" -D "cn=administrator,cn=users,dc=domain,dc=local" -w "your-password"

root@photon [ ~ ]# /opt/likewise/bin/domainjoin-cli setname photon

root@photon [ ~ ]# /opt/likewise/bin/domainjoin-cli setname photon && /opt/likewise/bin/domainjoin-cli join --enable hostname --ou "CN=Computers,DC=domain,DC=local" domain.local administrator@domain.local
Joining to AD Domain:   domain.local
With Computer DNS Name: photon.domain.local

administrator@DOMAIN.LOCAL's password: 
SUCCESS


root@photon [ ~ ]# /opt/likewise/bin/lw-get-dc-list domain.local
Got 1 DCs:
===========
DC 1: Name = 'dc.domain.local', Address = '192.168.1.100'


root@photon [ ~ ]# /opt/likewise/bin/lw-get-dc-time domain.local && timedatectl
DC TIME: 2024-01-18 07:01:03 UTC
               Local time: Thu 2024-01-18 07:01:05 UTC
           Universal time: Thu 2024-01-18 07:01:05 UTC
                 RTC time: Thu 2024-01-18 07:01:05    
                Time zone: UTC (UTC, +0000)           
System clock synchronized: yes                        
              NTP service: active                     
          RTC in local TZ: no  

I will test the ssh connection with the new dns name (from local shell to remote Photon OS).

ssh -l administrator@domain.local photon.domain.local

or 

ssh domain.local\\administrator@photon.domain.local

Press enter or click to view image in full size

Registers that display configuration parameters.

root@photon [ ~ ]# /opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers]'
   "LoadOrder" REG_MULTI_SZ[0] "ActiveDirectory"
              REG_MULTI_SZ[1] "VmDir"
              REG_MULTI_SZ[2] "Local"

root@photon [ ~ ]# /opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers\ActiveDirectory]'

DOMAIN\administrator@photon [ / ]$ id
uid=686293492(DOMAIN\administrator) gid=686293505(DOMAIN\domain^users) groups=686293505(DOMAIN\domain^users),1544(BUILTIN\Administrators),1545(BUILTIN\Users),686293504(DOMAIN\domain^admins),686293510(DOMAIN\schema^admins),686293511(DOMAIN\enterprise^admins),686293512(DOMAIN\group^policy^creator^owners),686293564(DOMAIN\denied^rodc^password^replication^group)

DOMAIN\administrator@photon [ / ]$ getent group "BUILTIN\Administrators"
BUILTIN\Administrators:x:1544:PHOTON\Administrator,DOMAIN\administrator

Information from domainjoin-cli log.

root@photon [ ~ ]# /opt/likewise/bin/domainjoin-cli --loglevel verbose --logfile /var/log/domain.log join --assumeDefaultDomain --userDomainPrefix domain domain.local administrator
Joining to AD Domain:   domain.local
With Computer DNS Name: photon.domain.local

administrator@DOMAIN.LOCAL's password: 
SUCCESS

root@photon [ ~ ]# cat /var/log/domain.log

That’s all in a nutshell.