Installing and configuring PowerBroker Identity Services (PBIS)

PowerBroker Identity Services allows you to extend the reach of Active Directory to Linux, Unix and even Macintosh platforms. This integration facilitates the management and definition of p ===

What is PBIS?

PowerBroker Identity Services allows you to extend the reach of Active Directory to Linux, Unix and even Macintosh platforms.

This integration facilitates the management and definition of centralized Active Directory (GPO) security policies, applying them to all platforms.

It provides a set of tools that allow you to manage security events and ensure compliance with security policies and regulations.

Installation and configuration:

We configure the repositories

Derivatives Debian

BASH

Bash

apt-get install apt-transport-https
wget -O - http://repo.pbis.beyondtrust.com/apt/RPM-GPG-KEY-pbis|sudo apt-key add - 
sudo wget -O /etc/apt/sources.list.d/pbiso.list http://repo.pbis.beyondtrust.com/apt/pbiso.list 
sudo apt-get update

Derivatives redhat

BASH

Bash

sudo wget -O /etc/yum.repos.d/pbiso.repo http://repo.pbis.beyondtrust.com/yum/pbiso.repo

Derivatives Suse

BASH

Bash

sudo wget -O /etc/zypp/repos.d/pbiso.repo http://repo.pbis.beyondtrust.com/yum/pbiso.repo

Software download and installation

Derivatives Debian

BASH

Bash

sudo apt-get install pbis-open

Derivatives Red Hat

BASH

Bash

sudo yum clean all 
sudo yum install pbis-open

Derivatives Suse

BASH

Bash

sudo zypper install pbis-open

Installation using installation script

Debian derivatives:

BASH

Bash

wget http://download.beyondtrust.com/PBISO/8.2.2/linux.deb.x64/pbis-open-8.2.2.2993.linux.x86_64.deb.sh

Red Hat derivatives:

BASH

Bash

wget http://download.beyondtrust.com/PBISO/8.2.2/linux.rpm.x64/pbis-open-8.2.2.2993.linux.x86_64.rpm.sh

We give Permissions to the script once downloaded:

BASH

Bash

chmod +x /tmp/pbis-open-8.2.2.2993.linux.x86_64.rpm.sh

We run the installation script:

CODE

text

/tmp/pbis-open-8.2.2.2993.linux.x86_64.rpm.sh

Creating directory pbis-open-8.2.2.2993.linux.x86_64.rpm
Verifying archive integrity... All good.
Uncompressing pbis-open-8.2.2.2993.linux.x86_64.rpm............
Would you like to install package for legacy links? (i.e.  /opt/likewise/bin/lw-find-user-by-name -> /opt/pbis/bin/find-user-by-name) (yes/no) n
Would you like to install now? (yes/no) y
Installing packages and old packages will be removed
warning: /root/pbis-open-8.2.2.2993.linux.x86_64.rpm/./packages/pbis-open-upgrade-8.2.2-2993.x86_64.rpm: Header V3 DSA/SHA1 Signature, key ID c9ceecef: NOKEY
Preparing...                ########################################### [100%]
1:pbis-open-upgrade      ########################################### [100%]
warning: /root/pbis-open-8.2.2.2993.linux.x86_64.rpm/./packages/pbis-open-8.2.2-2993.x86_64.rpm: Header V3 DSA/SHA1 Signature, key ID c9ceecef: NOKEY
Preparing...                ########################################### [100%]
1:pbis-open              ########################################### [100%]
Setting up SELinux Policy Module

Importing registry...

/opt/pbis/share/config/accounts.reg
/opt/pbis/share/config/dcerpcd.reg
/opt/pbis/share/config/eventlogd.reg
/opt/pbis/share/config/lsassd.reg
/opt/pbis/share/config/lwiod.reg
/opt/pbis/share/config/lwreg.reg
/opt/pbis/share/config/netlogond.reg
/opt/pbis/share/config/privileges.reg
/opt/pbis/share/config/rdr.reg
/opt/pbis/share/config/reapsysl.reg
/opt/pbis/share/config/usermonitor.reg
warning: /root/pbis-open-8.2.2.2993.linux.x86_64.rpm/./packages/pbis-open-gui-8.2.2-2993.x86_64.rpm: Header V3 DSA/SHA1 Signature, key ID c9ceecef: NOKEY
Preparing...                ########################################### [100%]
1:pbis-open-gui          ########################################### [100%]
Installing Packages was successful

New libraries and configurations have been installed for PAM and NSS.
Please reboot so that all processes pick up the new versions.

As root, run domainjoin-gui or domainjoin-cli to join a domain so you can log on
with Active Directory credentials. Example:
domainjoin-cli join MYDOMAIN.COM MyJoinAccount

We add the server to the domain:

CODE

Bash

domainjoin-cli join red-orbita.com rokitoh@red-orbita.com

Once added we proceed to update the DNS records

CODE

text

/opt/pbis/bin/update-dns

We configure the home and the shell that the user will use

CODE

text

/opt/pbis/bin/config AssumeDefaultDomain true
/opt/pbis/bin/config LoginShellTemplate /bin/bash
/opt/pbis/bin/config HomeDirTemplate %H/%D/%U

If we want to limit access only to certain groups of users, we do it as follows:

CODE

text

/opt/pbis/bin/config RequireMembershipOf "red-orbita.com\\admin-app" "red-orbita.com\\domain^admins"

add service to systemd startup

CODE

Bash

cp /etc/pbis/redhat/lwsmd.service /lib/systemd/system/lwsmd.service

systemctl enable lwsmd

systemctl start lwsmd

Remove a server from the domain:

CODE

text

domainjoin-cli leave rokitoh

All the best.

Comments