AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
trouble with seamless domain join on linux
I've followed this guide to setup seamless domain join for linux. and after launching an amazon linux 2023 instance I'm not able to connect to it via ssh -K.
after troubleshooting for some time I managed to connect via ssh -K but I had to change a lot of settings and I am still not sure how to make it seamless (ie so an AWS Delegated Server Administrator can log into a newly launched instance via ssh -K without having to login as ec2-user via private key).
my main issue is that ssh -K won't allow the login until there exists a .k5login file in the users home directory, and I can't automatically create the file on login because the login doesn't succeed unless the file exists - it's a catch 22. I have tried setting k5login_authoritative = false along with an auth_to_local rule in krb5.conf but it seems to have no effect, the .k5login file must exist or I can't login.
even with the .k5login file in place, after connecting via ssh -K I'm not able to use sudo despite having added %AWS\ Delegated\ Server\ Administrators@mydomain ALL=(ALL:ALL) ALL to /etc/sudoers
for completeness here are some other issues I encountered along the way
- ssm's domainJoin command sets the host on the domain to EC2AMAZ-RANDOMCRAP, I had to modify the command doc to specify keepHostName=true and manually rename the host before associating the domainJoin document
- ssm joins the instance to the domain but fails to register its ip with dns, so the instance is only reachable by ip until we manually run nsupdate -g and send an A record
to me "seamless" means I can launch an instance via the launch wizard, choose "Proceed without a key pair (not recommended)" and login with my AWS Delegated Server Administrator directory credentials. is this possible?
- Language
- English
asked 2 years ago584 views
- Newest
- Most votes
- Most comments
If your principal matches your login id, you don't need a .k5login file.
The issues you're experiencing with seamless domain join on Linux are not uncommon, and there are several factors to consider for a truly seamless experience.
First, it's important to note that the seamless domain join feature is supported for specific Linux distributions, including Amazon Linux 2, but Amazon Linux 2023 is not explicitly mentioned in the supported list. This could be a source of some of your issues.
Regarding the .k5login file issue, this is a known challenge with Kerberos authentication. The file is indeed required for successful login, which creates the catch-22 situation you described. Unfortunately, there isn't a straightforward way to automatically create this file before the first login without manual intervention or custom scripting.
The sudo access problem you're encountering might be related to how group memberships are being applied. Ensure that the AWS Delegated Server Administrators group is correctly mapped to the local Linux groups that have sudo privileges.
The hostname and DNS registration issues you mentioned are not typically part of the standard seamless domain join process. These might require additional configuration or custom scripts to handle automatically.
To achieve a truly "seamless" experience as you described - launching an instance without a key pair and logging in with AWS Delegated Server Administrator directory credentials - you would need to implement additional automation and configuration beyond what the basic seamless domain join provides. This might involve:
- Custom user data scripts that run on instance launch to set up necessary files and configurations.
- Modifying the domain join process to ensure proper hostname setting and DNS registration.
- Implementing a solution to create the .k5login file for users before their first login attempt.
- Ensuring proper group mappings and sudo configurations are in place.
While it's possible to create a more seamless experience, it would require significant customization and testing to achieve. The "seamless" in AWS's seamless domain join primarily refers to automating the process of joining the domain during instance launch, rather than providing a completely friction-free login experience for all scenarios.
For your specific use case, you might need to develop a custom solution that combines the AWS-provided seamless domain join with additional automation steps to address the issues you've encountered.
Sources
Seamlessly joining an Amazon EC2 Linux instance to your AWS Managed Microsoft AD Active Directory - AWS Directory Service
Seamlessly join an Amazon EC2 Linux instance to your Simple AD Active Directory - AWS Directory Service
Seamlessly joining an Amazon EC2 Linux instance to a shared AWS Managed Microsoft AD - AWS Directory Service
Join an Amazon EC2 Linux instance to your Simple AD Active Directory - AWS Directory Service
answered 2 years ago
I was able to get this working by switching from winbind to sssd and making these config changes:
/etc/ssh/sshd_config
GSSAPIStrictAcceptorCheck no
/etc/krb5.conf
includedir /var/lib/sss/pubconf/krb5.include.d/
/etc/sudoers
%AWS\ Delegated\ Server\ Administrators@aws.mydomain.com ALL=(ALL:ALL) NOPASSWD:ALL
/etc/sssd/sssd.conf
ad_access_filter = DOM:aws.mydomain.com:(memberOf:1.2.840.113556.1.4.1941:=CN=AWS Delegated Server Administrators,OU=AWS Delegated Groups,DC=aws,DC=mydomain,DC=com)
ssm's domainjoin command is hardcoded to use winbind and I couldn't figure out how to get any of this working w/winbind so the answer for now unfortunately is don't use seamless domainjoin for linux
answered 2 years ago
Relevant content
asked 4 years ago
asked 10 months ago
the seamless domain join logins don't match the principals exactly, eg: for "me@A.B.C" it creates the login "me@a" - any idea where this is configured?