Use Ubuntu Mate as a terminal server with Active Directory users

If you woke up this morning and said to your self “I’m looking for a good remote desktop connection to my Linux machine and can’t find one that is both smooth and clear”, then you are in the right place. (Back by popular demand) Although I have already done several tutorials on the subject, I am going to show how it’s done – all at once (and review the procedures to accommodate for the new software versions).

For this tutorial, I’ll assume that your FQDN is sub.domain.local, and we will start with the XRDP friendly configuration by choosing Ubuntu MATE flavour.

Download and install Ubuntu MATE from their official page. It’s always a good practice to update the newly installed OS, so update your Ubuntu Mate:

Install XRDP on your Ubuntu mate (old procedure described here)

  1. Download keymapping files from here
  2. Unpack the archive and copy the files to /etc/xrdp
  3. Change group and owner to xrdp, and permissions to 644
  4. Restart XRDP

At this point, install the SSH server since it is not here by default on the desktop version of Ubuntu, and you will receive an error when trying to join the AD domain.

Now you have to join your Ubuntu Mate to Active Directory Domain (old procedure for servers described here)

Go to Beyond Trust page, and download PBIS open. You will have to register, and will receive the download link via e-mail upon registration

  1. Download the appropriate file (32bit or 64bit deb file).
  2. Unpack the archive (running it shall suffice)
  3. Switch to the newly created directory, mark as executable and run it

Upon installation, if domainjoin-gui doesn’t start automatically, start it by typing

  1. Enter the FQDN in the first field, and click ‘Join domain’
  2. Provide the username and password of the user with the privileges to join computers into the specified domain and click OK

When complete, run ‘sudo visudo’ and add the your domain user to sudoers.

PowerBroker Identity Services create a user directory on the linux system upon first login by that user. PBIS uses /etc/skel to create these new directories, so create a default .xsession file in /etc/skel, containing the desktop environment that the AD user will see upon first login. Simply create a .xsession file in /etc/skel with the following content:

Xrdp uses PAM to authenticate logins, so in the directory /etc/pam.d , you will notice there is a xrdp-sesman link to sesman file. This file specifies how xrdp uses PAM to authenticate users.
The default one probably won’t authenticate against AD, so you need to change it. Edit the xrdp-sesman file and replace the contents with the following:

The common-* files have all been altered when you installled PBIS to include the necessary bits to authenticate against AD.

  1. Reboot the machine

Your Active Directory users can now log into the OS using the console, RDP or SSH. On the login screen, select ‘other’ and enter your AD credentials in a form SUB\username. XRDP (and SSH) should work in the same manner.

That’s about it. Relatively simple, and very rewarding in most cases.