I am confused about whether Linux servers using Active Directory (AD) and Kerberos need computer accounts created?
Does the Linux server as a machine need to join an AD domain and in doing so have a computer account to have authentication/authorization services from AD?
Here are some requirements:
- Ability to do user and group membership based authentication using AD from Linux servers.
- Ability to map local linux UID/GID numbers to AD user and group names (today we are using a non AD LDAP server and we reserve UID/GID numbers for user and group accounts. Ideally, I'd like to continue that practice).
- Ability to map linux Sudoer permissions to AD groups.
- Use open source or community tools/plugins like SSSD rather than a paid commercial offering like Centrify.
I'm concerned about the pain of creating/deleting loads of linux computer accounts in AD for private cloud based servers that will likely not be around that long; but I'd like the benefits of a central user account store using AD.
Notes: I am using RHEL and Centos 6-7 linux servers and Windows Server 2012 with AD at 2008R2 functional level.