If you do not know what Centrify is, most probably you do not need the commands below. However if you are curious, more info can be found on their website: http://www.centrify.com
In a nut shell, Centrify allows UNIX/Linux/OSX machines to join Active Directory. In Centrify enabled environment, you will have only one AD account to connect on all systems, no matter the platform (Windows, Linux, AIX, Solaris, HP-UX, Mac OS X, etc.).
Centrify AD commands:
(if they are not available in your path, you can find them here: /usr/share/centrifydc/bin)
How to see general information about the AD status of AD joined system:
adinfoHow to query user or groups:
adquery user lameuser1If you need to see more info, you can add -A parameter:
adquery user -A lameuser1Example:
$ adquery user lameuser1
lameuser1:x:448725:80000:Lame, User:/home/lameuser1:/usr/bin/ksh
$ adquery group adgroup
adgroup:x:80000:
How to check readiness of machine to join an Active Directory domain:
It is a verification of all requirements before joining a machine. You run this command on the client.
adcheck adgznor.netHow to join a server to Active Directory:
You will need the proper account and password for this command to work.
adjoin adgznor.net -z "Global" -c "adgznor.net/Services/UNIX/Servers" --name `uname -n` -u "SYS_LAMEUSER1@EU.ADGZNOR.NET"How to remove a server from Active Directory:
When doing adleave, it is advised to not use the force flag, otherwise it will clear-up the status only on a server locally, and not on the Centrify side, where it will need to be manually removed afterwards.
You will need the proper account and password for this command to work.
adleave --verbose -u SYS_LAMEUSER1@EU.ADGZNOR.NETHow to check authentication issues (if any):
If the auth.log in your machine is in different location, then replace it in the command below.
grep adclient /var/adm/syslog/auth.logHow to reload centrify configuration:
adreloadHow to flush the centrify local cache:
adflushHow to see AD map (network state):
adinfo -y netstateHow to check if an AD user is locked:
If true, then it is locked.
adquery user -A lameuser1 | grep accountLockedHow to see the preferred site (DC is choosing it):
adinfo -VHow to reset an account's key table and synchronizes its contents with the key distribution center in Active Directory:
Useful if the server gets into disconnected mode (due to computer password issue - that can be verified in logs like auth.log).
You will need the proper account and password for this command to work.
adkeytab -r -u SYS_LAMEUSER1@adgznor.netHow to enable centrifydc debug mode:
You will have to run this command as root or with sudo.
Turn debug on and watch for any errors:
/usr/share/centrifydc/bin/addebug onClear any previous debug log /var/log/centrifydc.log:
/usr/share/centrifydc/bin/addebug clearHow to restart Centrify Agent:
AIX:
date ; ps -ef|grep adcl ; stopsrc -s centrifydc ; sleep 3; startsrc -s centrifydc ; sleep 2; ps -ef|grep adcli ; date ; adinfo ; sleep 1; dzinfo -CLinux:
date ; ps -ef|grep adcl ; service centrifydc stop ; sleep 3; service centrifydc start ; sleep 1; ps -ef|grep adcli ; dateSunOS:
svcadm disable centrifydc; sleep 5; svcadm enable centrifydcsvcs -a|grep -i centrif ; ps -ef|grep adclSunOS v5.8, v5.9:
/etc/init.d/centrifydc stop ; sleep 3; /etc/init.d/centrifydc startCentrify daemon commands:
How to display detailed information about the DirectAuthorize configuration for a specified user on the local computer:
dzinfoHow to verify computer roles (server roles and group membership):
dzinfo -CHow to execute privileged commands as a specified user on the local computer (works like sudo):
dzdohow to list the commands an user can do (with dzdo):
dzinfo -c userHow to see which commands the current logged in user can do:
One output line should be like this: (root) !find * -exec *.
dzdo -lHow to edit a file as another user:
It is similar to using dzdo with the -e option.
dzeditOther related commands:
How to list all users that are managed by CENTRIFY (AD users) in AIX:
lsuser -R CENTRIFYDC ALLHow to list name and GIDs of all groups managed by CENTRIFY (AD groups) in AIX:
(to limit number of groups visible on server us /etc/centrify/group.ovr file)
lsgroup -R CENTRIFYDC -a id ALLCentrify files:
CENTRIFY configuration files location:
/etc/centrifydcCentrify enabled samba configuration files location:
/etc/sambaCentrify DirectControl configuration file:
It contains a set of configuration parameters that specify different aspects of Centrify DirectControl operation for the local computer.
/etc/centrifydc/centrifydc.confGood to know
How to to map a local user to the Active Directory user with the parameter pam.mapuser.localuser from centrifydc.conf config file:
In the example below, we map the localuser lameuser with AD user lame.user.
pam.mapuser.lameuser: lame.userHow to remove the message "it can only run as user root, default to run as root":
This message pose no problems but if you run it under a script, you may want to get rid of it.
You can achieve this by just specifying the user under which you want to run the desired command. Check the example below and you will get it.
lameuser1@gzadcl(/home/lameuser1)$ dzdo cat /etc/sudoers | head -n 2
It can only run as user root, default to run as root
# sudoers file.
#
lameuser1@gzadcl(/home/lameuser1)$ dzdo [b]-u root[/b] cat /etc/sudoers | head -n 2
# sudoers file.
#
- Log in to post comments
- 72340 views