Wednesday, December 14, 2011

Dealing with a expired Windows CA CRL

Right-clicked CA server name --> Properties --> Extensions
Select extension: CRL Distribution Point (CDP)
Added : C:\Windows\System32\certsrv\CertEnroll\.crl
Checked the following:
Publish CRLs to this location
Publish Delta CRLs to this location.
Rebooted just because.. everything is good now!

using mod_auth_kerb and Windows 2000/2003/2008R2 as KDC

using mod_auth_kerb and Windows 2000/2003/2008R2 as KDC

Tuesday, December 6, 2011

Linux join AD Domain

Intsall kerberos, apt-get install  krb5-user libkrb53
configure kerberos , [ NOTE: Windows domain name in CAPS]




















Test with the following commands:
kinit Administrator
klist

install Samba and Winbind:

apt-get install samba winbind

winbind is a component of samba which allows UNIX systems to be full members of an Active Directory domain. Winbind shares the configuration file of samba, which is /etc/samba/smb.conf.

After installing, we'll modify the /etc/samba/smb.conf file 

join the domain using the command:


net ads join -U Administrator

Restart winbind and samba and you should be able to use winbind to list the users and groups using:

wbinfo -u
wbinfo -g
You are still not able to do anything other than list users. If you want to log into the system with the accounts, you'll need to modify the /etc/nsswitch.conf file to look outside of the local databases. To do this, modify the file as shown:
passwd: files winbind
group: files winbind
shadow: files winbind

Next, we'll have to modify the AAA settings of the system to use winbind as well. The files to modify are:

/etc/pam.d/common-account
/etc/pam.d/common-auth
/etc/pam.d/common-session

For account, we'll add the line above the current rule:

account sufficient pam_winbind.so


Do the same for auth and session, changing the "account" keyword to "auth" and "session" accordingly. At this point you should be able to log into the system by using the domain\username convention. For example, to log into the Administrator account, simply use syraxius\Administrator as the username
Additional Links:http://www.finnie.org/text/debian-domain-auth.html