Fedora 27 Corporate Workstation Installation
On this page
- Contextualization
- Disclaimer
- Resources
- Installing Fedora 27
- Install Additional Repositories and Packages on Fedora 27
- Enable Automatic Security Updates on Fedora 27
- Change Computer name on Fedora 27
- Disable SELinux (Security-Enhanced Linux) on Fedora 27
- Join Fedora 27 on Active Directory or SAMBA 4
- Enable user authentication through SSH with Active Directory (SAMBA 4) Fedora 27
- Sudoers Users and Active Directory (SAMBA 4) Fedora 27
- User login box in the Fedora 27 system session
- Tools for productivity Fedora 27
Linux, independent of its variations, is the operating system most used the word in a server environment, usually, we can see a lot of end users adopting it. Is impossible to miss considerate the effort of the Open Source community contributors to make Linux more friendly and usable for non-Jedi users. This work was written with the focus on corporate end users and a corporate environment (SMB- small-medium business).
Contextualization
The Linux Fedora is one of the best distros and can be considered really stable to use in the production environment for end users, the first release was in 2003 with the name Fedora Core 1 and was based on Red Hat Linux who steel based nowadays.
I chose wrote this article about Fedora because it gave a good experience and results in a real production environment, for advanced and beginners users with a lot of corporate variables, purposes, and activities.
The environment of this article consists of joining a Fedora Workstation on a Domain Controller who can be Samba 4 or Microsoft Active Directory, set up the authentication process for domain users and domain admins on a workstation, local or remotely through ssh.
This article so does mention about some proprietary software for Linux, we must considerate that on the real environment a lot of resources are necessary according to each business needs.
Disclaimer
This article was written with end users focus and I can not guarantee that all settings will work in your environment, but I can try to answer any doubts related. Security is another important subject, but this article does not cover it.
Resources
Is some ways to install Fedora, for test purposes I recommend you use a Virtual Machine, you can use VirtualBox or any other virtualization environment if you prefer, so you can use a physical computer. The pre-requirements for Fedora installation is 1GHz or faster processor, 1GB System Memory, and 10GB unallocated drive space. To complete the configuration you need a domain controller, I recommend Samba 4, but you can use Microsoft Active Directory.
Installing Fedora 27
To download Fedora 27 you can use the direct link (http://fedora.c3sl.ufpr.br/linux/releases/27/Workstation/x86_64/iso/) or choose the best mirror for you at https://getfedora.org/. After the download, you can burn a DVD or create a bootable pen drive with the iso file. Usually, I use Etcher to do this task, you can find this open source software at (https://etcher.io/).
At the first screen choose the option Start Fedora-Workstation-Live 27:
Select the option Install to Hard Drive to start the installation:
Choose your language and the keyboard layout of your computer:
Choose the option Installation Destination and select the HardDrive that you want to install if you have more than one, and mark the option Automatically configure partitioning and press done:
Choose the option Begin installation:
Set up the root password, you don't need to create a user now. A local user will be created later for management proposes, remember, this computer will be joined on a domain, and all users from your network will be able to authenticate in this computer.
Remember, always use a strong password.
When the installation is complete, press Quit button.
Eject the ISO or DVD and reboot your computer. The basic installation is done.
After reboot, the system will login automatically and you can do the additional set-up.
The first screen is related to the basic configuration and every user at the first login is able to define your own Fedora settings.
Choose the language.
Choose the keyboard layout.
Turn on the location services if you need it.
Choose the time zone.
For additional software, turn on Proprietary software sources repositories:
Connect to the online third party services Google, Nextcloud, Microsoft or Facebook.
Create a local user filling the following form. Only for advice, work with root user is not a good practice. For this lab the name of the user is localuser:
Don't use the option Set Up Enterprise Login.
Use a strong password, the administration rights will be given automatically to the new user.
The system is ready for use.
Select Start Using Fedora and log in with localuser to continue the configuration.
The first thing to do after login is open the terminal and update system. Run the followings commands and type the password:
[localuser@localhost ~]$ sudo su
[root@localhost localuser]# dnf update
Press y and press enter. The first system update can be slow, be patient. Usually, I reboot the system after the update is complete.
Install Additional Repositories and Packages on Fedora 27
To meet the purposes of this article, we need install additional software repositories and third-party packages. The repositories needed is listed below, run the following commands to install it:
[localuser@localhost ~]$ sudo su
[root@localhost localuser]# dnf install http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-27.noarch.rpm
[root@localhost localuser]# dnf install https://go.skype.com/skypeforlinux-64.rpm
The commands below are to configure google repository:
[root@localhost localuser]# rpm --import https://dl.google.com/linux/linux_signing_key.pub
[root@localhost localuser]# printf '%s\n' '[google-chrome]' 'name=google-chrome' 'baseurl=http://dl.google.com/linux/chrome/rpm/stable/x86_64' 'enabled=1' 'gpgcheck=1' 'gpgkey=https://dl.google.com/linux/linux_signing_key.pub' >/etc/yum.repos.d/google-chrome.repo
After configuring the repositories, run the command:
[root@localhost localuser]# dnf update
Now, begin to install the list with all packages that we need for this Fedora setup, I will show how to install all packages in an easy way below. At this list, you can see some additional packages that can improve user experience besides system packages who increase the Fedora features, who will be used to join Fedora 27 on the network domain.
samba
realmd
sssd
oddjob
oddjob-mkhomedir
adcli
samba-common-tools
krb5-workstation
openldap-clients
policycoreutils-python
samba-winbind-clients
samba-winbind
gnome-tweak-tool.noarch
java-openjdk
icedtea-web
unzip
thunderbird.x86_64
gimp
vim
gnome-music.x86_64
gnome-photos
p7zip
vlc
curl
cabextract
xorg-x11-font-utils
fontconfig
https://downloads.sourceforge.net/project/mscorefonts2/rpms/msttcore-fonts-installer-2.6-1.noarch.rpm
gscan2pdf.noarch
system-config-printer
tesseract.x86_64
tesseract-langpack-enm.noarch
libreoffice-langpack-en.x86_64
brasero.x86_64
nautilus-extensions.x86_64
brasero-nautilus.x86_64
nautilus-sendto.x86_64
nautilus-font-manager.noarch
gnome-terminal-nautilus.x86_64
nautilus-image-converter.x86_64
nautilus-search-tool.x86_64
sushi.x86_64
raw-thumbnailer.x86_64
Pinta.x86_64
dnf-automatic
dconf-editor
NetworkManager
To install all packages in an easy way, create a file with the list above (one package per line), and run:
[root@localhost localuser]# for i in `cat package.txt`; do dnf install -y $i; done
The installation can be slow, be patient.
Enable Automatic Security Updates on Fedora 27
It’s a best practice enable automatic security updates for an operational system. Its provide a lot of bug fixes and keep your system safer.
To configure only the security updates edit with vim the /etc/dnf/automatic.conf file and change the following params (press insert to edit):
[root@localhost localuser]# vim /etc/dnf/automatic.conf
The config file to look like this content. Change the values for the lines upgrate_type and aply_updates like the lines below:
[commands]
# What kind of upgrade to perform:
# default = all available upgrades
# security = only the security upgrades
upgrade_type = security
random_sleep = 300
# Whether updates should be downloaded when they are available.
download_updates = yes
# Whether updates should be applied when they are available.
# Note that if this is set to no, downloaded packages will be left in the
# cache regardless of the keepcache setting.
apply_updates = yes
[emitters]
# Name to use for this system in messages that are emitted. Default is the
# hostname.
# system_name = my-host
# How to send messages. Valid options are stdio, email and motd. If
# emit_via includes stdio, messages will be sent to stdout; this is useful
# to have cron send the messages. If emit_via includes email, this
# program will send email itself according to the configured options.
# If emit_via includes motd, /etc/motd file will have the messages.
# Default is email,stdio.
emit_via = stdio
[email]
# The address to send email messages from.
email_from = [email protected]
# List of addresses to send messages to.
email_to = root
# Name of the host to connect to send email messages.
email_host = localhost
[base]
# This section overrides dnf.conf
# Use this to filter DNF core messages
debuglevel = 1
To save the changes at vim, press ESC, wq! and Enter.
After changing the file, you need to enable the schedule of automatic security updates:
[root@localhost localuser]# systemctl enable dnf-automatic.timer
[root@localhost localuser]# systemctl start dnf-automatic.timer
Change Computer name on Fedora 27
To change the computer hostname run the following commands (choose the hostname that you want, I used Workstation-Fedora27):
[localuser@localhost ~] sudo su
[root@localhost localuser]# hostnamectl set-hostname --pretty Workstation-Fedora27
[root@localhost localuser]# hostnamectl set-hostname --transient Workstation-Fedora27
[root@localhost localuser]# hostnamectl set-hostname --static Workstation-Fedora27
To verify the changes go to settings and press details.
Also, you can verify on terminal running the following command:
[root@localhost localuser]# hostname
The output must be the hostname, in this case, Workstation-Fedora27.
Disable SELinux (Security-Enhanced Linux) on Fedora 27
SELinux is an acronym for Security-enhanced Linux, It is a security feature of the Linux kernel. To keep this article more friendly, I not cover the setup of SELinux, we disabled it because I found some problems to join the computer at the domain with SELinux enabled. By the way, if you want to know more about security and SELinux, you can find good articles explaining this subject. To disable SELinux, run the command:
[root@Workstation-Fedora27 localuser]# vim /etc/sysconfig/selinux
Change the value enforcing to disabled, save the file and reboot your computer.
Join Fedora 27 on Active Directory or SAMBA 4
To join the Fedora Workstation into Active Directory or Samba 4 you need to pay attention to your network DNS (Domain Server Name), usually, the first DNS from a network is the IP address of the Domain Controller and is delivered to DHCP server (Dynamic Host Configuration Protocol). If your network environment uses a static IP address, you must configure it manually on the Fedora Workstation.
To check the DNS configuration at your network run the following command:
[root@Workstation-Fedora27 localuser]# nmcli device show
The output looks like this:
GENERAL.DEVICE: enp0s3
GENERAL.TYPE: ethernet
GENERAL.HWADDR: 08:00:27:AA:5E:4F
GENERAL.MTU: 1500
GENERAL.STATE: 100 (connected)
GENERAL.CONECTION: enp0s3
GENERAL.CAMINHO CON: /org/freedesktop/NetworkManager/ActiveConnection/0
WIRED-PROPERTIES.CARRIER: active
IP4.ADDRESS[1]: 10.0.2.15/24
IP4.GATEWAY: 10.0.2.2
IP4.DNS[1]: 10.0.2.100 <<<< DOMAIN CONTROLLER IP ADDRESS
IP4.DNS[2]: 10.0.2.101
IP4.DNS[3]: 10.0.2.102
IP6.ADDRESS[1]: fe80::a84e:4e53:d696:ddc9/64
IP6.GATEWAY:
If the output doesn't show DNS IP ADDRESS information, you can add this manually though Network Configuration on System settings or through the terminal. To do this through the terminal, run the following command and insert the information listed above:
[root@Workstation-Fedora27 localuser]# nmtui
Choose the option Edit a Connection and OK.
Fill nmtui IPV4 Configuration according to your network environment information. Another useful test is trying to ping the name of your domain.
[root@Workstation-Fedora27 localuser]# ping mylocaldomain.com
To join the Fedora Workstation at the domain, run the following commands:
[root@Workstation-Fedora27 localuser]# realm join --user=Administrator mylocaldomain.com
Note: The user and domain is an example, at this point you need to use a user with rights to join Fedora at the domain controller. If you want to unjoin Fedora, use the following command:
[root@Workstation-Fedora27 localuser]# realm leave --user=Administrator mylocaldomain.com
Edit the file /etc/samba/smb.conf :
[root@Workstation-Fedora27 localuser]# vim /etc/samba/smb.conf
Add the following lines to the file:
[global]
realm = mylocaldomain.com
workgroup = mylocaldomain
dns forwarder = 10.0.2.100
security = ADS
template shell = /bin/bash
winbind enum groups = Yes
winbind enum users = Yes
winbind nss info = rfc2307
winbind use default domain = Yes
idmap config *:range = 50000-1000000
idmap config * : backend = tdb
store dos attribute = Yes
map acl inherit = Yes
vfs objects = acl_xattr
Save the changes (on vim press ESC and “wq!”).
To enable cache logins you need to configure SSSD (System Security Services Daemon), to do this, edit the file /etc/sssd/sssd.conf.
[root@Workstation-Fedora27 localuser]# vim/etc/sssd/sssd.conf
The main lines that we need to change are:
use_fully_qualified_names = False
fallback_homedir = /home/%[email protected]
The SSSD file looks like this:
domains = mylocaldomain.com
config_file_version = 2
services = nss, pam
[domain/mylocaldomain.com]
ad_domain = mylocaldomain.com
krb5_realm = mylocaldomain.com
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%[email protected]
access_provider = ad
Enable user authentication through SSH with Active Directory (SAMBA 4) Fedora 27
To configure SSH for remote authentication of the domain users, you need to edit the following file /etc/ssh/sshd_config:
[root@Workstation-Fedora27 localuser]# vim /etc/ssh/ssh_config
At the end of the file include the following lines:
AllowGroups wheel domain^admins domain admins domain?admins
UsePAM yes
You can configure the groups how you wish (eg. it_support).
Sudoers Users and Active Directory (SAMBA 4) Fedora 27
To configure domain users as the member of sudoers edit the file /etc/sudoers :
[root@Workstation-Fedora27 localuser]# vim /etc/sudoers
Add the following lines:
%domain\ admins ALL=(ALL) ALL
%[username] ALL=(ALL) ALL
The second line you can fill with the domain users who need administrative rights (eg. %johnwoo ALL=(ALL) ALL).
User login box in the Fedora 27 system session
When we work with Fedora 27 in a domain we encounter an authentication problem when we need to perform activities that require administrative rights in a graphical environment (Gnome). When you try to install an application through the "software" tool, an authentication box is displayed for root or Administrator user authentication. The image below illustrates this issue:
To display the user's username in the authentication box create the file 51.fedora-admin.conf at the directory /etc/polkit-1/localauthority.conf.d/:
[root@Workstation-Fedora27 localuser]# touch /etc/polkit-1/localauthority.conf.d/51.fedora-admin.conf
[root@Workstation-Fedora27 localuser]# vim /etc/polkit-1/localauthority.conf.d/51.fedora-admin.conf
Add the following lines to the file:
[Configuration]
AdminIdentities=unix-group:admin;unix-group:Domain Admins;unix-user:0
After the configuration, the all users of your network will be able to login with the own username and password to execute activities who need special rights. Only users in the sudoers file can execute activities who need special rights.
The authentication of users not listed in the sudoers file will fail.
Tools for productivity Fedora 27
The productivity tools available to use on Fedora 27 are awesome. Since office tools like LibreOffice or Microsoft Office that can be installed through PlayonLinux and can meet the business needs. OCR (Optical Character Recognition ) Resources is available at Gscan2pdf, GimageReader and too at Master PDF, who is the best tool to handle PDF files that I know.
In the communications tools, Fedora 27 has a lot of resources, is available Skype, Empathy, Thunderbird, Facebook, Telegram, Twitter, Gnome Gmail, Ekiga Softphone, etc.
If you work in some area of IT, Fedora is a Swiss Army Knife. There are a lot of tools to work in high level with networking (GNS3, Wireshark), software development (Eclipse, Netbeans), end-user support environments (RDP and VNC Clients), tests, media creating, web design, etc.
By the way, all features and the productivity can be increased through the Gnome Extensions use, that provides a lot of extensions to integrate Gnome environment with a lot of services and installed applications that can be found here https://extensions.gnome.org.