Linux Authentication with Active Directory 2003 R2

One way of simplifying your authentication environment is to use a single authentication source for all of your nodes - Windows, Linux or Unix. You can authenticate them all against a directroy service such a Active directory or eDirectory. In this article we'll describe how to unify your Linux and Active Directroy environment. with minor changes, this same procedure can be used to authenticate your Linux hosts against eDirectory or any other LDAP compliant Directory Service.

Windows 2003 is nothing but customized version of LDAP and attributes. We can modify and extend schema of windows LDAP to store custome values and attributes. SFU ( Service for Unix) package doing same thing which can extend microsoft ldap schema and make it compatibale to store Linux/Unix POSIX compliant attributes. SFU is freely available for windows 2000/2003 early version but Windows 2003 R2 version as inbuilt Unix managment capability so you do not need to install SFU or extranal software.

Following is my setup to configure Linux to authenticate against active directory.

1. Enable Unix/Linux Identity Managment for Unix in Windows 2003 R2

Start > Settings > Control Panel > Add/Remove Windows Components and select Active Directory Services









2. Once this installed you can see new tab in Active Directory Users and Computers inside User management properties. And select NIS Domain (which is default Domain name) define UID, GID, Home Directory of user which you want at Linux/Unix for users side at logon.












(Notes :- I have created new OU with UNIX name and created three different OU inside UNIX , People, Groups & Computers for easy management. You can use anyname you like)

3. Linux workstation configuration file following.

a. /etc/ldap.conf
b. /etc/nsswitch.conf
c. /etc/krb5.conf
d. /etc/pam.d/system-auth

Following my configuration files.

#cat /etc/ldap.conf










# cat /etc/nsswitch.conf

passwd: file ldap
shadow: file ldap
group: file ldap


# cat /etc/krb5.conf



# cat /etc/pam.d/system-auth
(Notes : Please compile or install latest version of pam_krb5.so. older version has some bug which break your functionality)

I have compiled pam_krb5-2.3.7 which support force password change at next logon.



After done all the above changes you can run getent command to check list of user created in AD.

#getent passwd
#getent group


TEST Configuration:

Create user account with option "User must change password at next logon"



Now try to login at Unix/Linux workstation with user.



Single Sign on (SSO) Configuration with OpenSSH.


Logged into Windows 2003 R2 and run following command to generate keytab file for kerberos services principal.

c:\>ktpass -princ host/linux01.example.com@EXAMPLE.COM -mapuser EXAMPLE\linux01 -crypto rc4-hmac-nt -pass * -ptype KRB5_NT_SRV_HST -out linux01.keytab

(EXAMPLE.COM is a realm of kerberos or Domain name of Windows 2003 it should be Upper letter, and EXAMPLE\linux01 is NetBios name of Domain and workstation of Linux, -pass * command will ask you for workstation password any password which you want to set for workstation)

c:\> setspn linux01

(setspn will Registere ServicePrincipalNames)

Now copy linux01.keytab file securly on linux01 workstation and rename and copy inside /etc/krb5.keytab

Verifiy keytab with following command

#klist -keK /etc/krb5.keytab

TEST SSO Login for SSH.

Loggied into Linux workstation (linux01 in my example)

Get kerberos ticket run following command.

#kinit username

Verifiy kerberos TGT ticket to run following command.

#klist

Run SSH and it will not ask you for password this time because you have kerberos ticket already.

#ssh username@linux01

Best of Luck for your configuration.

Solaris 10 basic commands

useful OS information gathering commands

1. cat /etc/release
2. showrev
3. uname -a

Determine configured memory (includes physical memory)

1. prtconf

Determine installed processor (includes physical/virtual)

1. psrinfo
2. psrinfo -v (list virtual processors and info)
3. psrinfo -pv (list physical and accosiated virtual processors)

Determine processor platform arch and bits

1. isainfo
2. isainfo -bv (more info about processor flags)
3. isalist (list feature of processors)

Determine and change system timestamp

1. date (to reveal current timestamp)
2. date '+DateTime: %m.%d.%y @ %H.%M.%S'
3. date mmddHHMMccYY
i.e : date 050817252009 ( change system time to May 8 17:25:00 EDT 2009)

Determine current running process on system

1. ps, ps -ef
2. pgrep (search process list for matching program i.e pgrep sshd)
3. pkill (searching matching program and kill them unless a different signal is sent : i.e 'HUP')
4. pwdx (list the working directory of specified process)

Nagios 3.0 Enterprise Monitoring.

Nagios is the industry standard in enterprise-class monitoring for good reason. It allows you to gain insight into your network and fix problems before customers know they even exist. It's stable, scalable, supported, and extensible. Most importantly, it works.

I have installed nagios 3.0 and i was monitoring following services.

1.) Sendmail & mail queue
2.) Apache web servers
3.) Bind DNS servers
4.) Netbackup master and media servers
5.) VMware ESX
6.) Dell poweredge server hardware monitoring. (OpenManger plugin)
7.) APC PDU (power unit)
8.) Routers & switches
10.) CPU, Memory & Disk utilization.
11.) NTP servers

This is my first nagios 3.0 implementation nagios status map picture.










Second picture of 3D map of infrastructure.

DimDim Open Source Video Conf. and Presentation

Meet the world's easiest web conference. Dimdim lets anyone deliver synchronized live presentations, whiteboards and web pages and share their voice and video over the Internet - with no download required.

Dimdim is a very simple to use browser-based web conferencing service. You can show presentations, collaborate via whiteboards, chat, talk and broadcast via webcam with absolutely no download required to host, attend or even record meetings*.

Let Try http://www.dimdim.com

EMC Self Study materials

Powerpath Foundations Impact\impact.exe
Replication Manager Foundations Impact\impact.exe
SAN Foundations Impact\impact.exe
SnapView Foundations Impact\impact.exe
SRDF Foundations Impact\impact.exe
SRDF Foundations Impact\Thumbs.db
Symmetrix Foundations Impact\impact.exe
TimeFinder Foundations Impact\impact.exe
VisualSAN and VisualSRM Foundations Impact\impact.exe
playerPRO.zip
Centera Foundations Impact\impact.exe
Centera Foundations Impact\Thumbs.db
CLARiiON Foundations Impact\clariion impact.exe
ControlCenter Foundations Impact\impact.exe
EMC Legato NetWorker Foundations Impact\impact.exe
Mirrorview and SAN Copy Impact\impact.exe
NAS Foundations Impact\impact.exe

Download following files to get CBT

hxxp://rapidshare.com/files/90442494/UP.part1.rar.html
hxxp://rapidshare.com/files/90456600/UP.part2.rar.html