Category:I805 Authentication and Authorization: Difference between revisions

From ICO wiki
Jump to navigationJump to search
Line 106: Line 106:
* wiki - Taavi
* wiki - Taavi
* mailserver - Sheela
* mailserver - Sheela
==Milestone 3==
Service owner has client application configured and knows how to configure them:
* NextCloud - app on smartphone, SPNEGO with web browser
* rocket.chat - app on smartphone, SPNEGO with web browser
* nagios - SPNEGO with web browser
* wiki - SPNEGO with web browser
* mailserver - Evolution with GSSAPI
==Milestone 4==
Manual page created on internal wiki for configuring the client application(s)

Revision as of 16:59, 14 February 2017

Authentication and Authorization

General information

In this course we continue where we left off with Firewalls and VPN/IPsec course.

Relevant topics for research and implementation in the lab. Lectures coming up for most of the topics:

  • File based password stores eg. /etc/shadow, .htaccess
  • Signing and encrypting e-mail using GPG
  • Active Directory protocols: LM, NTLM, Kerberos, GSSAPI, SPNEGO, LDAP
  • More TLS and client side authentication in particular
  • Filesystem permissions: access control lists, selinux, apparmor
  • RADIUS
  • Multi-factor authentication: smartcards, Yubikey, Mobile-ID, etc
  • Contactless cards
  • On the web: Cookies, OAuth, OpenID, iPizza,

Intro slides & video recording:

https://docs.google.com/presentation/d/1NzY8AspqZwrYxoJ3Qi-pBWsMDdiIUeA4lgZnwZGTMVg/edit?usp=sharing

https://echo360.e-ope.ee/ess/echo/presentation/54eb478c-f6ae-4629-b1e3-c43f5a2f6842?ec=true

Biznisplan

Tasks, not necessarily all have to be covered. Pick the one you like the most:

  • Play the red team: Kustas, Ender, Mikus
  • Set up rocket.chat instead of IRC server: Meelis Hass
  • Set up file synchronization with NextCloud: Etienne
  • Set up domain controller on hq Windows server: Mohanad/Madis
  • Set up backup domain controller on rnd: Arti
  • Reconfigure Gogs: <insert your name here>
  • Reconfigure wiki: <insert your name here>
  • Reconfigure mail server: Sheela
  • Reconfigure webserver/MySQL: Joosep
  • Set a blank smartcard as TLS client authentication token: Keijo?
  • NFC card backups: Keijo
  • OpenVPN with Estonian ID-card howto: Ardi Vaba
  • Set up OpenWrt wifi routers as access points with username/password authentication (like eduroam wireless network): <insert your name here>

With Lauri/Belgin from Linux/Windows admin course:

  • Set up domain controller /w MS AD/Samba:
  • Set up fileserver with several shares: <insert your name>
  • Use iMac and HP Probook at 412/411 for joining them to domain. Needs some network rewiring first, ask Lauri.
  • Set up group policies, eg install software and configure VPN for HP Probook

With Viktor from Incident management course:

  • Set up incident management software, configure to authenticate with AD

ECTS: 4

Lecturers: Lauri Võsandi

If you forget (local) Windows password use System Rescue CD to reset the password: http://www.howtogeek.com/howto/windows-vista/change-your-forgotten-windows-password-with-the-linux-system-rescue-cd/

Requirements

Every service should use accounts from Active Directory. To achieve that try to use LDAP protocol first. Via LDAP you can retreieve the data about accounts. If the service machine is not joined to domain create a service account in AD to access LDAP interface first. It really depends on the software how you need to configure it.

For fileserver/SSH/FTP/mail server first join to domain using winbind: https://help.ubuntu.com/community/ActiveDirectoryWinbindHowto#Join_AD_domain For NextCloud, rocket.chat, OwnCloud and most web services configure LDAP plugin to retrieve accounts from AD and LDAP bind authentication.


Milestone 1

Domain controller is working. In the internal network and over VPN connection blah.office.lan DNS requests work as expected.

On a Linux box command line users can authenticate with kerberos client utils:

 kinit username@OFFICE.LAN

On a Linux box command line users can fetch stuff via LDAP:

ldapsearch -b dc=office,dc=lan  -H ldap://dc-hq.office.lan -D lauri@office.lan -W

Also authenitcation with Kerberos should work:

ldapsearch -b dc=office,dc=lan  -H ldap://dc-hq.office.lan -Y GSSAPI

To make life easier configure /etc/ldap/ldap.conf, if properly configured short commands work:

ldapsearch


Milestone 2

Following services are using credentials from AD

  • NextCloud - Etienne
  • rocket.chat - Meelis
  • nagios - Mohanad
  • wiki - Taavi
  • mailserver - Sheela

Milestone 3

Service owner has client application configured and knows how to configure them:

  • NextCloud - app on smartphone, SPNEGO with web browser
  • rocket.chat - app on smartphone, SPNEGO with web browser
  • nagios - SPNEGO with web browser
  • wiki - SPNEGO with web browser
  • mailserver - Evolution with GSSAPI

Milestone 4

Manual page created on internal wiki for configuring the client application(s)

Pages in category "I805 Authentication and Authorization"

This category contains only the following page.