ГРУППА КОМПАНИЙ. Настройка аутентификации в Active Direсtory через Kerberos на прокси.
|
|
|
- Francis Summers
- 7 years ago
- Views:
Transcription
1 ГРУППА КОМПАНИЙ Настройка аутентификации в Active Direсtory через Kerberos на прокси
2 Вступление В доменной среде Active Directory можно настроить Single Sign On аутентификацию для пользователей, работающих через веб-прокси Traffic Inspector Next Generation. Настройка решения описывается ниже. 1. Настройка 1.1 Настройка доменного DNS-сервера В нашем примере, используются следующие сетевые идентификаторы: Устройство IP-адрес DNS-имя контроллер домена adm2.office.local TRAFFIC INSPECTOR NEXT GENERATION ting.office.local На доменном DNS-сервере: добавьте в прямую доменную зону запись типа A, позволяющую осуществлять прямое преобразование DNS-имени устройства TRAFFIC INSPECTOR NEXT GENERATION в его IP-адрес 2
3 добавьте в обратную доменную зону запись типа PTR, позволяющую осуществлять обратное преобразование IP-адреса устройства TRAFFIC INSPECTOR NEXT GENERATION в его DNS-имя Проверьте существование на DNS-сервере: в прямой доменной зоне - записи типа A, позволяющей осуществлять прямое преобразование DNS-имени контроллера домена в его IP-адрес 3
4 в обратной доменной зоне - записи типа PTR, позволяющей осуществлять обратное преобразование IP-адреса контроллера домена в его DNS-имя 1.2 Настройка DNS-параметров устройства Traffic Inspector Next Generation Пройдите в раздел Система -> Настройки -> Общие настройки. В поле Имя хоста укажите полное имя устройства TING. В поле Домен укажите полное DNS-имя домена. В поле DNS-серверы, укажите IP-адрес доменного DNS-сервера. В поле Настройки DNS-сервера, уберите флаг напротив опции Не используйте DNS-форвардер как DNS-сервер для межсетевого экрана Проверка. Подключитесь к шлюзу по SSH. Для этого можно использовать популярный SSH-клиент Putty. Выполните команду: cat /etc/resolv.conf В выводе вы должны увидеть указанный ранее IP-адрес (в нашем примере ), например: nameserver Проверьте прямое и обратное разрешение DNS-записей с устройства TRAFFIC INSPECTOR NEXT GENERATION. Выполните команды: dig ting.office.local Пример успешного результата: ; <<>> DiG P2 <<>> ting.office.local 4
5 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3919 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;ting.office.local. IN A ;; ANSWER SECTION: ting.office.local IN A ;; Query time: 2 msec ;; SERVER: #53( ) ;; WHEN: Tue Sep 27 16:39:46 MSK 2016 ;; MSG SIZE rcvd: 62 dig x Пример успешного результата: ; <<>> DiG P2 <<>> -x ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5615 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ; in-addr.arpa. IN PTR ;; ANSWER SECTION: in-addr.arpa IN PTR ting.office.local. ;; Query time: 7 msec ;; SERVER: #53( ) ;; WHEN: Tue Sep 27 16:42:55 MSK 2016 ;; MSG SIZE rcvd: 83 dig adm2.office.local Пример успешного результата: ; <<>> DiG P2 <<>> adm2.office.local ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp:
6 ;; QUESTION SECTION: ;adm2.office.local. IN A ;; ANSWER SECTION: adm2.office.local IN A ;; Query time: 18 msec ;; SERVER: #53( ) ;; WHEN: Tue Sep 27 16:44:17 MSK 2016 ;; MSG SIZE rcvd: 62 dig x Пример успешного результата: ; <<>> DiG P2 <<>> -x ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ; in-addr.arpa. IN PTR ;; ANSWER SECTION: in-addr.arpa IN PTR adm2.office.local. ;; Query time: 2 msec ;; SERVER: #53( ) ;; WHEN: Tue Sep 27 16:41:54 MSK 2016 ;; MSG SIZE rcvd: 82 6
7 1.3 Настройка сетевого времени Настройка времени на устройстве производится в рамках работы мастера первоначальной настройки Система -> Мастер. Также, настройки времени доступны в разделе Службы -> Сетевое время -> Общие настройки. В поле Серверы времени укажите ваш предпочитаемый сервер времени, например: time.bakulev.ru. 1.4 Настройка LDAP-коннектора Для успешного подключения к базе пользователей Active Directory нужно настроить параметры подключения. Пройдите в раздел Система -> Доступ -> Серверы, в правом верхнем углу нажмите на кнопку Добавить сервер и задайте следующие настройки: Описательное имя AD connector Тип LDAP Имя хоста или IP-адрес Значение порта 389 Транспортный протокол TCP Версия протокола 3 Привязать параметры доступа Уникальное имя пользователя: имя доменной учетной записи с правами чтения из домена Область поиска Контейнеры для аутентификации Начальный шаблон Атрибут присвоения имени пользователю Пароль: пароль для учетной записи Уровень: единичный База поиска: DC = office, DC = local (наш домен имеет DNS-имя office.local) Выберите контейнеры, в которых располагаются доменные учетные записи (например, CN=Users,DC=office,DC=local) Microsoft AD samaccountname 1.5 Настройка Kerberos Пройдите в раздел Службы -> Прокси-сервер -> Администрирование. 7
8 Исходим из того, что начальная настройка прокси-сервера произведена и он слушает порт TCP / В меню Forward Proxy выберите пункт Authentication Settings. В поле Метод аутентификации, выберите ранее созданный LDAP-коннектор AD connector. Установите флаг Enable Kerberos. Проверка. Подключитесь к шлюзу по SSH. Выполните команду: cat /etc/krb5.conf В выводе вы должны увидеть настройки аналогичные приведенным ниже: # Autogenerated config. Do not edit manualy. [libdefaults] default_realm = OFFICE.LOCAL dns_lookup_kdc = no dns_lookup_realm = no ticket_lifetime = 24h default_keytab_name = /usr/local/etc/squid/squid.keytab default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 [realms] 8
9 OFFICE.LOCAL = { kdc = admin_server = default_domain = office.local } [domain_realm].office.local = OFFICE.LOCAL office.local = OFFICE.LOCAL 9
10 Пройдите на вкладку Kerberos Authentication. В поле AD admin login, укажите учетную запись администратора домена. В поле AD admin password, укажите пароль для учетной записи администратора домена. Нажмите на кнопку Create keytab. В поле Output, вы должны увидеть вывод аналогичный тому, который приведен ниже: -- init_password: Wiping the computer password structure -- generate_new_password: Generating a new, random password for the computer account -- generate_new_password: Characters read from /dev/udandom = get_dc_host: Attempting to find a Domain Controller to use (DNS SRV RR TCP) -- get_dc_host: Attempting to find a Domain Controller to use (DNS SRV RR UDP) -- get_dc_host: Attempting to find a Domain Controller to use (DNS domain) -- get_dc_host: Found DC: -- get_dc_host: Canonicalizing DC through forward/reverse lookup get_dc_host: Found Domain Controller: prim3.office.local -- create_fake_krb5_conf: Created a fake krb5.conf file: /tmp/.msktkrb5.conf-h7ccuz -- reload: Reloading Kerberos Context -- finalize_exec: SAM Account Name is: TING-K$ -- try_machine_keytab_princ: Trying to authenticate for TING-K$ from local keytab switch_default_ccache: Using the local credential cache: FILE:/tmp/.mskt_krb5_ccache-bdixiS -- finalize_exec: Authenticated using method 1 -- ldap_connect: Connecting to LDAP server: prim3.office.local try_tls=yes -- ldap_connect: Connecting to LDAP server: prim3.office.local try_tls=no -- ldap_connect: LDAP_OPT_X_SASL_SSF=56 -- ldap_get_base_dn: Determining default LDAP base: dc=office,dc=local -- ldap_check_account: Checking that a computer account for TING-K$ exists -- ldap_check_account: Checking computer account - found -- ldap_check_account: Found useraccountcontrol = 0x
11 -- ldap_check_account: Found supportedencryptiontypes = ldap_check_account: Found dnshostname = ting.office.local -- ldap_check_account: Found Principal: host/ting.office.local -- ldap_check_account: Found Principal: HTTP/TING.office.local -- ldap_check_account: Found User Principal: HTTP/TING.office.local -- ldap_check_account_strings: Inspecting (and updating) computer account attributes -- ldap_simple_set_attr: Calling ldap_modify_ext_s to set userprincipalname to HTTP/TING.office.local@OFFICE.LOCAL -- ldap_simple_set_attr: ldap_modify_ext_s failed (Insufficient access) -- ldap_set_supportedencryptiontypes: No need to change msds-supportedencryptiontypes they are ldap_set_useraccountcontrol_flag: Setting useraccountcontrol bit at 0x to 0x0 -- ldap_set_useraccountcontrol_flag: useraccountcontrol not changed 0x set_password: Attempting to reset computer's password -- set_password: Try using keytab for TING-K$ to change password -- ldap_get_pwdlastset: pwdlastset is set_password: Successfully set password, waiting for it to be reflected in LDAP. -- ldap_get_pwdlastset: pwdlastset is set_password: Successfully reset computer's password -- execute: Updating all entries for ting.office.local in the keytab WRFILE:/usr/local/etc/squid/squid.keytab -- update_keytab: Updating all entires for TING-K$ -- ldap_get_kvno: KVNO is 3 -- add_principal_keytab: Adding principal to keytab: TING-K$ -- add_principal_keytab: Removing entries with kvno < 0 -- add_principal_keytab: Adding entry of enctype 0x17 11
12 -- add_principal_keytab: Adding entry of enctype 0x11 -- add_principal_keytab: Adding entry of enctype 0x12 -- add_principal_keytab: Adding principal to keytab: host/ting.office.local -- add_principal_keytab: Removing entries with kvno < 0 -- add_principal_keytab: Adding entry of enctype 0x17 -- add_principal_keytab: Adding entry of enctype 0x11 -- add_principal_keytab: Adding entry of enctype 0x12 -- add_principal_keytab: Adding principal to keytab: HTTP/TING.office.local -- add_principal_keytab: Removing entries with kvno < 0 -- add_principal_keytab: Adding entry of enctype 0x17 -- add_principal_keytab: Adding entry of enctype 0x11 -- add_principal_keytab: Adding entry of enctype 0x12 -- ~msktutil_exec: Destroying msktutil_exec -- ldap_cleanup: Disconnecting from LDAP server -- init_password: Wiping the computer password structure -- ~KRB5Context: Destroying Kerberos Context Примечание. После генерации keytab, перезагрузите службу squid. 12
13 1.6 Проверка. Нажмите на кнопку Show keytab. В поле Output, вы должны увидеть вывод аналогичный тому, который приведен ниже: /usr/local/etc/squid/squid.keytab: Vno Type Principal Aliases 2 arcfour-hmac-md5 TING-K$@OFFICE.LOCAL 2 aes128-cts-hmac-sha1-96 TING-K$@OFFICE.LOCAL 2 aes256-cts-hmac-sha1-96 TING-K$@OFFICE.LOCAL 2 arcfour-hmac-md5 HTTP/TING.office.local@OFFICE.LOCAL 2 aes128-cts-hmac-sha1-96 HTTP/TING.office.local@OFFICE.LOCAL 2 aes256-cts-hmac-sha1-96 HTTP/TING.office.local@OFFICE.LOCAL 2 arcfour-hmac-md5 host/ting.office.local@office.local 2 aes128-cts-hmac-sha1-96 host/ting.office.local@office.local 2 aes256-cts-hmac-sha1-96 host/ting.office.local@office.local 3 arcfour-hmac-md5 TING-K$@OFFICE.LOCAL 3 aes128-cts-hmac-sha1-96 TING-K$@OFFICE.LOCAL 3 aes256-cts-hmac-sha1-96 TING-K$@OFFICE.LOCAL 3 arcfour-hmac-md5 host/ting.office.local@office.local 3 aes128-cts-hmac-sha1-96 host/ting.office.local@office.local 3 aes256-cts-hmac-sha1-96 host/ting.office.local@office.local 3 arcfour-hmac-md5 HTTP/TING.office.local@OFFICE.LOCAL 3 aes128-cts-hmac-sha1-96 HTTP/TING.office.local@OFFICE.LOCAL 3 aes256-cts-hmac-sha1-96 HTTP/TING.office.local@OFFICE.LOCAL Нажмите на кнопку Test Kerberos login и проведите тестовую аутенитификацию по доменной учетной записи. В поле Output, вы должны увидеть вывод аналогичный тому, который приведен ниже: AF orqweqadcgeaoqsgcsqgsib3egecag== khilchenko@office.local BH quit command 13
Configuring Squid Proxy, Active Directory Authentication and SurfProtect ICAP Access
Configuring Squid Proxy, Active Directory Authentication and SurfProtect ICAP Access Contents Introduction 3 To Configure 4 Squid Server... 4 Windows Domain Controller... 4 Configuration 4 DNS... 4 NTP...
Configure the Application Server User Account on the Domain Server
How to Set up Kerberos Summary This guide guide provides the steps required to set up Kerberos Configure the Application Server User Account on the Domain Server The following instructions are based on
Using OpenSSH in a Single Sign-On Corporate Environment with z/os, Windows and Linux
Using OpenSSH in a Single Sign-On Corporate Environment with z/os, Windows and Linux Dovetailed Technologies February 2016 Edition 2.0.0 For the latest version of this document, see http://dovetail.com/docs/ssh/kerberos_sso.pdf
Single Sign-On Using SPNEGO
Single Sign-On Using SPNEGO Introduction As of Percussion CM Server version 7.0.2, build 201106R01, patch level RX-17069, Windows Single Sign-On (SSO) using SPNEGO is now supported. Through the SSO feature,
Domain Name System. DNS is an example of a large scale client-server application. Copyright 2014 Jim Martin
Domain Name System: DNS Objective: map names to IP addresses (i.e., high level names to low level names) Original namespace was flat, didn t scale.. Hierarchical naming permits decentralization by delegating
Creating a master/slave DNS server combination for your Grid Infrastructure
Creating a master/slave DNS server combination for your Grid Infrastructure When doing a Grid Infrastructure installation, a DNS server is needed to resolve addresses for the cluster- scan addresses. In
ENABLING SINGLE SIGN-ON: SPNEGO AND KERBEROS Technical Bulletin For Use with DSView 3 Management Software
ENABLING SINGLE SIGN-ON: SPNEGO AND KERBEROS Technical Bulletin For Use with DSView 3 Management Software Avocent, the Avocent logo, The Power of Being There and DSView are registered trademarks of Avocent
Local DNS Attack Lab. 1 Lab Overview. 2 Lab Environment. SEED Labs Local DNS Attack Lab 1
SEED Labs Local DNS Attack Lab 1 Local DNS Attack Lab Copyright c 2006 Wenliang Du, Syracuse University. The development of this document was partially funded by the National Science Foundation s Course,
Domain Name System (DNS) Fundamentals
Domain Name System (DNS) Fundamentals Mike Jager Network Startup Resource Center mike.jager@synack.co.nz These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International
Extending Microsoft Windows Active Directory Authentication to Access HP Service Health Reporter
Technical White Paper Extending Microsoft Windows Active Directory Authentication to Access HP Service Health Reporter For the Windows Operation System Software Version 9.40 Table of Contents Introduction...
Setting up Single Sign-On (SSO) with SAP HANA and SAP BusinessObjects XI 4.0
Setting up Single Sign-On (SSO) with SAP HANA and SAP BusinessObjects XI 4.0 February 8, 2013 Version 1.0 Vishal Dhir Customer Solution Adoption (CSA) www.sap.com TABLE OF CONTENTS INTRODUCTION... 3 What
Using Kerberos to Authenticate a Solaris TM 10 OS LDAP Client With Microsoft Active Directory
Using Kerberos to Authenticate a Solaris TM 10 OS LDAP Client With Microsoft Active Directory Wajih Ahmed and Baban Kenkre March 2008 (Updated May 2008) Sun Microsystems, Inc. Please note: This configuration
Univention Corporate Server. Extended domain services documentation
Univention Corporate Server Extended domain services documentation 2 Table of Contents 1. Integration of Ubuntu clients into a UCS domain... 4 1.1. Integration into the LDAP directory and the SSL certificate
Using Active Directory as your Solaris Authentication Source
Using Active Directory as your Solaris Authentication Source The scope of this paper is to document how a newly installed Solaris 10 server can be configured to use an Active Directory directory service
KERBEROS ENVIRONMENT SETUP FOR EMC DOCUMENTUM CENTERSTAGE
White Paper KERBEROS ENVIRONMENT SETUP FOR EMC DOCUMENTUM CENTERSTAGE Abstract This white paper explains how to setup Kerberos environment for CenterStage with Single / Multi-Repository, Multi-Docbase
BusinessObjects 4.0 Windows AD Single Sign on Configuration
TUBusinessObjects 4.0 Single Sign OnUT BusinessObjects 4.0 Single Sign On also called SSO with Windows AD requires few steps to take. Most of the steps are dependent on each other. Certain steps cannot
The following process allows you to configure exacqvision permissions and privileges for accounts that exist on an Active Directory server:
Ubuntu Linux Server & Client and Active Directory 1 Configuration The following process allows you to configure exacqvision permissions and privileges for accounts that exist on an Active Directory server:
Domain Name System (DNS) Session-1: Fundamentals. Ayitey Bulley abulley@ghana.com
Domain Name System (DNS) Session-1: Fundamentals Ayitey Bulley abulley@ghana.com Computers use IP addresses. Why do we need names? Names are easier for people to remember Computers may be moved between
Configuring Integrated Windows Authentication for Oracle WebLogic with SAS 9.2 Web Applications
Configuring Integrated Windows Authentication for Oracle WebLogic with SAS 9.2 Web Applications Copyright Notice The correct bibliographic citation for this manual is as follows: SAS Institute Inc., Configuring
Kerberos and Windows SSO Guide Jahia EE v6.1
Documentation Kerberos and Windows SSO Guide Jahia EE v6.1 Jahia delivers the first Web Content Integration Software by combining Enterprise Web Content Management with Document and Portal Management features.
RHEL Clients to AD Integrating RHEL clients to Active Directory
RHEL Clients to AD Integrating RHEL clients to Active Directory Presenter Dave Sullivan Sr. TAM, Red Hat 2013-09-03 Agenda Review Dmitri Pal and Simo Sorce Preso Legacy RHEL hook to AD RHEL Direct--->sssd--->AD
ACS 5.x and later: Integration with Microsoft Active Directory Configuration Example
ACS 5.x and later: Integration with Microsoft Active Directory Configuration Example Document ID: 113571 Contents Introduction Prerequisites Requirements Components Used Conventions Background Information
Configuring DNS on Cisco Routers
Configuring DNS on Cisco Routers Document ID: 24182 Contents Introduction Prerequisites Requirements Components Used Conventions Setting Up a Router to Use DNS Lookups Troubleshooting You Can Ping a Web
How to Enable Internet for Guest Virtual Machine using Wi-Fi wireless Internet Connection.
How to Enable Internet for Guest Virtual Machine using Wi-Fi wireless Internet Connection. Table of Contents 1) Host, Guest and VBox version.... 2 2) Check your current Host and Guest Details... 3 3) Now
Installing Squid with Active Directory Authentication
Installing Squid with Active Directory Authentication 18May06 Proxy servers are fairly essential devices that should be part of a network s perimeter defense strategy. They are devices that allow clients
netkit lab dns Università degli Studi Roma Tre Dipartimento di Informatica e Automazione Computer Networks Research Group Version Author(s)
Università degli Studi Roma Tre Dipartimento di Informatica e Automazione Computer Networks Research Group netkit lab dns Version Author(s) E-mail Web Description 2.2 G. Di Battista, M. Patrignani, M.
SSSD Active Directory Improvements
FreeIPA Training Series SSSD Active Directory Improvements Jakub Hrozek January 2013 Contents of the presentation 1.Overview of Active Directory related improvements 2.Range attributes support 3.Mapping
Domain Name System Security
Abstract Domain Name System Security Ladislav Hagara hgr@vabo.cz Department of Automated Command Systems and Informatics Military Academy in Brno Brno, Czech Republic Domain Name System (DNS) is one of
INUVIKA TECHNICAL GUIDE
--------------------------------------------------------------------------------------------------- INUVIKA TECHNICAL GUIDE SINGLE SIGN-ON WITH MICROSOFT ACTIVE DIRECTORY USING KERBEROS OVD Enterprise
Security Provider Integration Kerberos Authentication
Security Provider Integration Kerberos Authentication 2015 Bomgar Corporation. All rights reserved worldwide. BOMGAR and the BOMGAR logo are trademarks of Bomgar Corporation; other trademarks shown are
Single sign-on websites with Apache httpd: Integrating with Active Directory for authentication and authorization
Single sign-on websites with Apache httpd: Integrating with Active Directory for authentication and authorization Michael Heldebrant Solutions Architect, Red Hat Outline Authentication overview Basic LDAP
Enabling DNS for IPv6 CSD Fall 2011
Enabling DNS for IPv6 CSD Fall 2011 Team members: Bowei Dai daib@kth.se 15 credits Elis Kullberg elisk@kth.se 18 credits Hannes Junnila haju@kth.se 15 credits Nur Mohammad Rashed nmrashed@kth.se 15 credits
Configuring Integrated Windows Authentication for JBoss with SAS 9.3 Web Applications
Configuring Integrated Windows Authentication for JBoss with SAS 9.3 Web Applications Copyright Notice The correct bibliographic citation for this manual is as follows: SAS Institute Inc., Configuring
Configuring Single Sign-on for SAP HANA
Configuring Single Sign-on for SAP HANA Applies to: SAP BusinessObjects Business Intelligence platform 4.0 Feature Pack 3. For more information, visit the Business Objects homepage. Summary This document
Setting up Single Sign-On (SSO) with SAP HANA and SAP BusinessObjects XI 4.0
Setting up Single Sign-On (SSO) with SAP HANA and SAP BusinessObjects XI 4.0 June 14, 2013 Version 2.0 Vishal Dhir Customer Solution Adoption (CSA) www.sap.com TABLE OF CONTENTS INTRODUCTION... 3 What
Benchmarking Zonemaster Sandoche Balakrichenan (Afnic) & Einar Lonn (IIS)
Benchmarking Zonemaster Sandoche Balakrichenan (Afnic) & Einar Lonn (IIS) 1 1 Health check je n'ai pas eu de retour, peut être que c'était trop sybillin 2 DNS Health check Connectivity Name Server DNSSEC
Configuring Integrated Windows Authentication for JBoss with SAS 9.2 Web Applications
Configuring Integrated Windows Authentication for JBoss with SAS 9.2 Web Applications Copyright Notice The correct bibliographic citation for this manual is as follows: SAS Institute Inc., Configuring
UPGRADING TO XI 3.1 SP6 AND SINGLE SIGN ON. Chad Watson Sr. Business Intelligence Developer
UPGRADING TO XI 3.1 SP6 AND SINGLE SIGN ON Chad Watson Sr. Business Intelligence Developer UPGRADING TO XI 3.1 SP6 What Business Objects Administrators should consider before installing a Service Pack.
How-to: DNS Enumeration
25-04-2010 Author: Mohd Izhar Ali Email: johncrackernet@yahoo.com Website: http://johncrackernet.blogspot.com Table of Contents How-to: DNS Enumeration 1: Introduction... 3 2: DNS Enumeration... 4 3: How-to-DNS
Goal of this session
DNS refresher Overview Goal of this session What is DNS? How is DNS built and how does it work? How does a query work? Record types Caching and Authoritative Delegation: domains vs zones Finding the error:
Author: Joshua Meckler
Author: Joshua Meckler When using Kerberos security with Sybase products such as Adaptive Server Enterprise, Open Client/Open Server, or jconnect, you must perform a series of setup tasks before a successful
Configuring Integrated Windows Authentication for IBM WebSphere with SAS 9.2 Web Applications
Configuring Integrated Windows Authentication for IBM WebSphere with SAS 9.2 Web Applications Copyright Notice The correct bibliographic citation for this manual is as follows: SAS Institute Inc., Configuring
HRSWEB ActiveDirectory How-To
HRSWEB ActiveDirectory How-To Page 1 of 1 Quintessential School Systems HRSWEB ActiveDirectory How-To Quintessential School Systems (QSS), 2011-2012 All Rights Reserved 867 American Street, Second Floor
Windows Enterprise OU Administrator Tips. Integrating RHEL5 Systems with Active Directory
Windows Enterprise OU Administrator Tips Integrating RHEL5 Systems with Active Directory John Dickerson and Beata Pruski Created: December 4, 2009 Last Update: February 4, 2011 This document will show
DNS Pharming Attack Lab
CNT 5410 - Fall 2014 1 DNS Pharming Attack Lab (This is a modified version of the exercise listed below. Modifications are to provide tighter configuration so as to minimize the risk of traffic leaving
File Access and Protocols Management Guide For 7-Mode
Data ONTAP 8.2 File Access and Protocols Management Guide For 7-Mode NetApp, Inc. 495 East Java Drive Sunnyvale, CA 94089 U.S. Telephone: +1(408) 822-6000 Fax: +1(408) 822-4501 Support telephone: +1 (888)
Defeating DNS Amplification Attacks. Ralf Weber Senior Infrastructure Architect
Defeating DNS Amplification Attacks Ralf Weber Senior Infrastructure Architect History DNS amplification attacks aren't new Periodically reemerge as attackers read history books J NANOG 56 Reports of unusual
Kerberos Delegation with SAS 9.4
Paper SAS3443-2016 Kerberos Delegation with SAS 9.4 Stuart J Rogers, SAS Institute Inc., Cary, NC ABSTRACT Do you want to see and experience how to configure SAS Enterprise Miner single sign-on? Are you
EMC Documentum Kerberos SSO Authentication
A Detailed Review Abstract This white paper introduces and describes a Kerberos-based EMC Documentum environment, and explains how to deploy such a system with single sign-on (SSO) on the Documentum platform.
DNS SECURITY TROUBLESHOOTING GUIDE
DNS SECURITY TROUBLESHOOTING GUIDE INTERNET DEPLOYMENT OF DNS SECURITY 27 November 2006 Table of Contents 1. INTRODUCTION...3 2. DNS SECURITY SPECIFIC FAILURE MODES...3 2.1 SIGNATURES...3 2.1.1 Signature
White Paper. Fabasoft on Linux - Preparation Guide for Community ENTerprise Operating System. Fabasoft Folio 2015 Update Rollup 2
White Paper Fabasoft on Linux - Preparation Guide for Community ENTerprise Operating System Fabasoft Folio 2015 Update Rollup 2 Copyright Fabasoft R&D GmbH, Linz, Austria, 2015. All rights reserved. All
Kerberos and Active Directory symmetric cryptography in practice COSC412
Kerberos and Active Directory symmetric cryptography in practice COSC412 Learning objectives Understand the function of Kerberos Explain how symmetric cryptography supports the operation of Kerberos Summarise
Allowing Linux to Authenticate to a Windows 2003 AD Domain. Prepared by. Thomas J. Munn, CISSP 11-May-06
Allowing Linux to Authenticate to a Windows 2003 AD Domain Prepared by Thomas J. Munn, CISSP 11-May-06 Table of Contents: Table of Contents:... 2 Introduction... 3 Requirements... 4 Installing the Necessary
Using Kerberos tickets for true Single Sign On
Using Kerberos tickets for true Single Sign On Table of Contents Introduction This document details the reasoning for, configuration of and experiences from the initial setup of Kerberos tickets for SSO
Secure Unified Authentication for NFS
Technical Report Secure Unified Authentication for NFS Kerberos, NFSv4, and LDAP in Clustered Data ONTAP Justin Parisi, NetApp July 2015 TR-4073 Abstract This document explains how to configure NetApp
KAREL UCAP DNS AND DHCP CONCEPTS MANUAL MADE BY: KAREL ELEKTRONIK SANAYI ve TICARET A.S. Organize Sanayi Gazneliler Caddesi 10
KAREL UCAP DNS AND DHCP CONCEPTS MANUAL MADE BY: KAREL ELEKTRONIK SANAYI ve TICARET A.S. Organize Sanayi Gazneliler Caddesi 10 Sincan 06935 Ankara, Turkey Version Table Manual Version/Date AAA/22.03.2011
Migration of Windows Intranet domain to Linux Domain Moving Linux to a Wider World
Journal of Basic and Applied Engineering Research pp. 55-59 Krishi Sanskriti Publications http://www.krishisanskriti.org/jbaer.html Migration of Windows Intranet domain to Linux Domain Moving Linux to
Table of Contents. Confidential and Proprietary
Table of Contents About Toshiba Strata CIX and Broadvox SIP Trunking... 1 Requirements... 2 Purpose, Scope and Audience... 3 What is SIP Trunking?... 4 Business Advantages of SIP Trunking... 4 Technical
I am an SE at a large storage system vendor
Neil Waybright Presented to UUASC 12/4/2008 I am an SE at a large storage system vendor In a recent previous life I managed the UNIX team at a Ventura County company that is the largest biotech company
Step- by- Step guide to Configure Single sign- on for HTTP requests using SPNEGO web authentication
Step- by- Step guide to Configure Single sign- on for HTTP requests using SPNEGO web authentication Summary STEP- BY- STEP GUIDE TO CONFIGURE SINGLE SIGN- ON FOR HTTP REQUESTS USING SPNEGO WEB AUTHENTICATION
qliqdirect Active Directory Guide
qliqdirect Active Directory Guide qliqdirect is a Windows Service with Active Directory Interface. qliqdirect resides in your network/server and communicates with qliqsoft cloud servers securely. qliqdirect
DNS Resolving using nslookup
DNS Resolving using nslookup Oliver Hohlfeld & Andre Schröder January 8, 2007 Abstract This report belongs to a talk given at the networking course (Institue Eurecom, France) in January 2007. It is based
Plexcel Operator's Manual
Communications Software support@ioplex.com Plexcel 2.7.27 January 5, 2012 Plexcel Operator's Manual Table of Contents Overview 3 Requirements... 3 DNS... 3 Active Directory Sites and Services...3 Testing
CA Performance Center
CA Performance Center Single Sign-On User Guide 2.4 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the Documentation ) is
Integrating OID with Active Directory and WNA
Integrating OID with Active Directory and WNA Hari Muthuswamy CTO, Eagle Business Solutions May 10, 2007 Suncoast Oracle User Group Tampa Convention Center What is SSO? Single Sign-On On (SSO) is a session/user
Here, we will discuss step-by-step procedure for enabling LDAP Authentication.
LDAP Authenticated Web Administration : MailScan 5.x is powered with LDAP Authenticated Web Administration. This gives security enhancement to authenticate users, to check their quarantined and ham emails.
Table of Contents. Red Hat Summit Labs. Lab Overview... 3 Background... 3
Red Hat Summit Labs Table of Contents Lab Overview... 3 Background... 3 Red Hat Enterprise Linux Identity Management Overview... Red Hat Enterprise Linux Identity Management Benefits:... Enhances Security...
SAP SINGLE SIGN-ON AND SECURE CONNECTIONS VIA SNC ADAPTER. Author : Matthias Schlarb, REALTECH system consulting GmbH. matthias.schlarb@realtech.
SAP SINGLE SIGN-ON AND SECURE CONNECTIONS VIA SNC ADAPTER BASED ON KERBEROS V5 Project name : SSO SNC ABAP Our reference : REALTECH Project management : Manfred Stein, SAP AG manfred.stein@sap.com Document
Applications and Services. DNS (Domain Name System)
Applications and Services DNS (Domain Name Service) File Transfer Protocol (FTP) Simple Mail Transfer Protocol (SMTP) Malathi Veeraraghavan Distributed database used to: DNS (Domain Name System) map between
CSE 127: Computer Security. Network Security. Kirill Levchenko
CSE 127: Computer Security Network Security Kirill Levchenko December 4, 2014 Network Security Original TCP/IP design: Trusted network and hosts Hosts and networks administered by mutually trusted parties
Getting Started with Clearlogin A Guide for Administrators V1.01
Getting Started with Clearlogin A Guide for Administrators V1.01 Clearlogin makes secure access to the cloud easy for users, administrators, and developers. The following guide explains the functionality
Forouzan: Chapter 17. Domain Name System (DNS)
Forouzan: Chapter 17 Domain Name System (DNS) Domain Name System (DNS) Need System to map name to an IP address and vice versa We have used a host file in our Linux laboratory. Not feasible for the entire
Thales nshield HSM. Integration Guide for ISC BIND DNSSEC. www.thalesgroup.com/iss
Thales nshield HSM Integration Guide for ISC BIND DNSSEC www.thalesgroup.com/iss Version: 1.1 Date: 15 June 2011 Copyright 2011 Thales e-security Limited. All rights reserved. Copyright in this document
1 Introduction. Ubuntu Linux Server & Client and Active Directory. www.exacq.com Page 1 of 14
Ubuntu Linux Server & Client and Active Directory 1 Introduction For an organization using Active Directory (AD) for user management of information technology services, integrating exacqvision into the
DNS at NLnet Labs. Matthijs Mekking
DNS at NLnet Labs Matthijs Mekking Topics NLnet Labs DNS DNSSEC Recent events NLnet Internet Provider until 1997 The first internet backbone in Holland Funding research and software projects that aid the
QliqDIRECT Active Directory Guide
QliqDIRECT Active Directory Guide QliqDIRECT is a Windows Service with Active Directory Interface. QliqDIRECT resides in your network/server and communicates with Qliq cloud servers securely. QliqDIRECT
Руководство по установке сервера безопасности. SecurEnvoy
Руководство по установке сервера безопасности SecurEnvoy SecurEnvoy 1210 Парквью, Бизнес-Парк Арлингтон, Тиль, Ридинг RG7 4TY Тел: 0845 2600010, Факс: 0845 260014 www.securenvoy.com Сервер безопасности
Table of Contents DNS. How to package DNS messages. Wire? DNS on the wire. Some advanced topics. Encoding of domain names.
Table of Contents DNS Some advanced topics Karst Koymans Informatics Institute University of Amsterdam (version 154, 2015/09/14 10:44:10) Friday, September 11, 2015 DNS on the wire Encoding of domain names
DNS Amplification Attacks as a DDoS Tool and Mitigation Techniques
DNS Amplification Attacks as a DDoS Tool and Mitigation Techniques Klaus Steding-Jessen jessen@cert.br! Computer Emergency Response Team Brazil - CERT.br Network Information Center Brazil - NIC.br Brazilian
DNS, DNSSEC and DDOS. Geoff Huston APNIC February 2014
DNS, DNSSEC and DDOS Geoff Huston APNIC February 2014 The Evolu3on of Evil It used to be that they sent evil packets to their chosen vic3m but this exposed the abacker, and limited the damage they could
FreeIPA 3.3 Trust features
FreeIPA 3.3 features Sumit Bose, Alexander Bokovoy March 2014 FreeIPA and Active Directory FreeIPA and Active Directory both provide identity management solutions on top of the Kerberos infrastructure
How To Attack Isc.Org.Org With A Dnet On A Network With A Pnet On The Same Day As A Dbus On A Pc Or Ipnet On An Ipnet.Org On A 2.5Th Gen.Net
Surviving a DDoS Attack: What every host needs to know Maria Karaivanova, Business Development David Koston, Platform www.cloudflare.com DDoS Attacks are becoming massive, and easier to initiate!2 Major
what s in a name? taking a deeper look at the domain name system mike boylan penn state mac admins conference
what s in a name? taking a deeper look at the domain name system mike boylan penn state mac admins conference whoami work for robert morris university, pittsburgh, pa primarily mac and voip admin @mboylan
v7.8.2 Release Notes for Websense Content Gateway
v7.8.2 Release Notes for Websense Content Gateway Topic 60086 Web Security Gateway and Gateway Anywhere 12-Mar-2014 These Release Notes are an introduction to Websense Content Gateway version 7.8.2. New
DNS Service on Linux. Supawit Wannapila CCNA, RHCE supawit.w@cmu.ac.th
DNS Service on Linux Supawit Wannapila CCNA, RHCE supawit.w@cmu.ac.th Host Name Resolution Common Host Name Service Files (/etc/hosts and /etc/networks) DNS (/etc/resolv.conf) Multiple client-side resolvers:
Switchvox. Technical Application Notes
Switchvox Technical Application Notes Table of Contents About Broadvox... 1 About Switchvox... 1 Purpose, Scope and Audience... 2 Switchvox Deployment Information... 3 Switchvox External IP Address...
VMware Identity Manager Administration
VMware Identity Manager Administration VMware Identity Manager 2.4 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new
TIBCO ActiveMatrix BPM Single Sign-On
Software Release 3.1 November 2014 Two-Second Advantage 2 Important Information SOME TIBCO SOFTWARE EMBEDS OR BUNDLES OTHER TIBCO SOFTWARE. USE OF SUCH EMBEDDED OR BUNDLED TIBCO SOFTWARE IS SOLELY TO ENABLE
Guide to SASL, GSSAPI & Kerberos v.6.0
SYMLABS VIRTUAL DIRECTORY SERVER Guide to SASL, GSSAPI & Kerberos v.6.0 Copyright 2011 www.symlabs.com Chapter 1 Introduction Symlabs has added support for the GSSAPI 1 authentication mechanism, which
FreeIPA v3: Trust Basic trust setup
FreeIPA Training Series FreeIPA v3: Trust Basic trust setup Sumit Bose January 2013 How to set up trust between FreeIPA and AD Enable FreeIPA for Trust # ipa-adtrust-install Add Trust to AD # ipa trust-add...
Centrify Identity and Access Management for Cloudera
Centrify Identity and Access Management for Cloudera Integration Guide Abstract Centrify Server Suite is an enterprise-class solution that secures Cloudera Enterprise Data Hub leveraging an organization
Internet-Praktikum I Lab 3: DNS
Kommunikationsnetze Internet-Praktikum I Lab 3: DNS Mark Schmidt, Andreas Stockmayer Sommersemester 2015 kn.inf.uni-tuebingen.de Motivation for the DNS Problem IP addresses hard to remember for humans
Enter host information:
Active Directory DataSource Configuration for Avaya OSPC OSPC LDAP Integration overview LDAP based data sources like Microsoft s Active Directory (AD) will be a popular integration for the OSPC phonebook
Active Directory network protocols and traffic
samba experience 2005 Göttingen, Germany 4 th May 2005 Active Directory network protocols and traffic Jean-Baptiste Marchand Jean-Baptiste Marchand Introduction Agenda Active
Motivation. Domain Name System (DNS) Flat Namespace. Hierarchical Namespace
Motivation Domain Name System (DNS) IP addresses hard to remember Meaningful names easier to use Assign names to IP addresses Name resolution map names to IP addresses when needed Namespace set of all
Configuring and Using the TMM with LDAP / Active Directory
Configuring and Using the TMM with LDAP / Active Lenovo ThinkServer April 27, 2012 Version 1.0 Contents Configuring and using the TMM with LDAP / Active... 3 Configuring the TMM to use LDAP... 3 Configuring
DNS : Domain Name System
1/30 DNS : Domain Name System Surasak Sanguanpong nguan@.ac.th http://www...ac.th/~nguan Last updated: May 24, 1999 Outline 2/30 DNS basic name space name resolution process protocol configurations Why
Configuring HP Integrated Lights-Out 3 with Microsoft Active Directory
Configuring HP Integrated Lights-Out 3 with Microsoft Active Directory HOWTO, 2 nd edition Introduction... 2 Integration using the Lights-Out Migration Utility... 2 Integration using the ilo web interface...
Field Description Example. IP address of your DNS server. It is used to resolve fully qualified domain names
DataCove DT Active Directory Authentication In Active Directory (AD) authentication mode, the server uses NTLM v2 and LDAP protocols to authenticate users residing in Active Directory. The login procedure
Active Directory and Linux Identity Management
Active Directory and Linux Identity Management Published by the Open Source Software Lab at Microsoft. December 2007. Special thanks to Chris Travers, Contributing Author to the Open Source Software Lab.