SUSE Linux Enterprise Server in an Active Directory Domain
|
|
|
- Roberta McGee
- 8 years ago
- Views:
Transcription
1 Gábor Nyers Systems SUSE Linux Enterprise Server in an Active Directory Domain
2 Agenda Introduction Practical scenario's for SLES 11 SP2: Participating in an Active Directory Integration of Apache with Active Directory Bleeding Edge Samba 4 Server side copy Prototype implementation of Previous versions Questions 2
3 Introduction
4 Data Center Interoperability The Playfield Platforms Mainframe Observable trends (in general): Legacy Unix holds or declines Mainframe: Linux Windows z/os holds Linux on System z emerging Linux and Windows grow UNIX 4
5 Linux Windows Interoperability The playfield Linux Platforms Mainframe UNIX Windows Interoperability Topics Scope: Services > < Virtualization Systems Management Documents Scripting Languages Porting and running software 5
6 Linux Windows Interoperability Scenario's Practical scenario's 1. SLES Participating in an Active Directory domain 2. Integration of Apache with Active Directory 6
7 Linux Windows Interoperability Scenario's Practical value vs. Maturity Maturity 4 Enterprise SLES Participating in an Active Directory domain Integration of Apache on SLES with Active Directory SLES and Samba as domain controller Windows Remote Desktop on Linux 6 Emerging 5 ODBC connection to MS SQL Practical value 6 Prototype Samba implementation of Recovery Point 7
8 Practical scenario's for SLES 11 SP2
9 Scenario 1: SLES as member server in Active Directory domain PAM / nsswitch / SSH Kerberized application / service 1 2 Active Directory SLES 11 SP2 Mount share 3 Shared folder Windows 2008 R2 Role: Member server AD: ad.demo.lan Hostname: interop01 File share 4 Mapped share Role: AD Domain Controller AD domain name: ad.demo.lan NT-style domain name: INTEROP Hostname: win Mapped share Mapped share See also: more detailleddocumentation Interop Demo appliance 10 Kerberized / SPNEGO enabled application Windows XP (winxp01.ad.demo.lan) Kerberized / SPNEGO enabled application Windows 7 (win764.ad.demo.lan)
10 Scenario 1: Join as member server in Active Directory domain Pre-requisites Correct NTP settings Correct timezone settings Correct DNS name, forward and backward for all hosts Authorized AD service account to join machines (typically Administrator ) Concepts Kerberos Principal / Service Principal Ticket Granting Ticket Keytab file LDAP sssd (System Security Services Daemon) PAM, NSS SASL, GSSAPI, SPNEGO 11
11 Scenario 1: Join as member server in Active Directory domain Steps on Linux opensuse, SUSE Linux Enterprise: Join the AD domain using YaST Windows Domain Membership Other Linux distros: Join the AD domain with the manual procedure (smb.conf; krb5.conf; `net ads join -U Administrator%password`) Required packages on SLES: samba-client, samba-winbind(pam_winbind.so, libnss_winbind.so, idmap) krb5 (libgssapi_krb5) Steps on Active Directory No requisite steps 12
12 Scenario 1: Use Case 1/a: Integrate PAM and nsswitch with AD /etc/pam.d/common-auth interop01:~ # cat /etc/pam.d/common-auth #%PAM-1.0 auth required pam_env.so auth sufficient pam_unix2.so auth required pam_winbind.so use_first_pass interop01:~ # /etc/nsswitch.conf interop01:~ # cat /etc/nsswitch.conf # [...] passwd: winbind compat group: winbind compat # [ ] interop01:~ # 13
13 Scenario 1: Use Case 1/a: Integrate SSHD with AD Configure SSHD interop01:~ # cat /etc/ssh/sshd_config # [...] GSSAPIAuthentication yes GSSAPICleanupCredentials yes ChallengeResponseAuthentication yes # [...] interop01:~ # Login from remote host remote-host:~ $ ssh 'INTEROP\Administrator'@interop02 Password: Creating directory '/home/interop/administrator'. INTEROP\administrator@interop02:~> Kerberos credentials INTEROP\administrator@interop02:~> klist Ticket cache: FILE:/tmp/krb5cc_10000 Default principal: Administrator@AD.DEMO.LAN Valid starting Expires Service principal 04/06/13 10:22:28 04/06/13 20:22:28 krbtgt/ad.demo.lan@ad.demo.lan renew until 04/13/13 10:22:28 04/06/13 10:22:28 04/06/13 20:22:28 INTEROP02$@AD.DEMO.LAN renew until 04/13/13 10:22:28 Kerberos 4 ticket cache: /tmp/tkt10000 klist: You have no tickets cached INTEROP\administrator@interop02:~> 14
![..] interop01:~ # Login from remote host remote-host:~ $ ssh 'INTEROP\Administrator'@interop02 Password: Creating directory '/home/interop/administrator'.](/docs-images/40/8924465/images/page_13.jpg "INTEROP\administrator@interop02:~> Kerberos credentials INTEROP\administrator@interop02:~> klist Ticket cache: FILE:/tmp/krb5cc_10000 Default principal: Administrator@AD.DEMO.")
14 Scenario 1: Use Case 1/b: Restrict shell access to AD group Steps on SLES Manually amend the pam_winbind configuration file to restrict allowed users Steps on Active Directory Add group SLES Shell Users Add user Administrator to SLES Shell Users /etc/security/pam_winbind.conf [global] cached_login = yes krb5_auth = yes krb5_ccache_type = FILE debug = yes require_membership_of = "SLES Shell Users" See also: Interop Demo appliance 15
15 Scenario 1: Use Case 2: Integrate SPNGO enabled applications with AD Applications using GSSAPI, SASL or Java GSS libraries GSSAPI SLES pkg: krb5 (1.6+) C lib: /usr/lib64/libgssapi_krb5.so.2 Java lib: Java GSS Applications: Mod_auth_kerb (Apache), PostgreSQL, etc.. SASL API SLES pkg: cyrus-sasl C lib: /usr/lib64/libsasl2.so.2 Java lib: Java SASL Applications: OpenLDAP2 (Server, clients) Cyrus IMAP, etc... Postfix Libvirt Evolution 16
16 Use Case 2: Integrate SPNGO enabled applications with AD: smbclient Steps Request TGT with kinit or log in as an AD user Access Windows share with smbclient interop01:~ # id uid=0(root) gid=0(root) groups=0(root) interop01:~ # kinit demo@ad.demo.lan Password for demo@ad.demo.lan: <PASSWORD> interop01:/tmp # klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: demo@ad.demo.lan interop01:~ # smbclient -k //win200864/share OS=[Windows Server 2008 R2 Standard 7601 Service Pack 1] Server=[Windows Server 2008 R2 Standard 6.1] smb: \> smb: \> exit interop01:~ # klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: demo@ad.demo.lan Valid starting Expires Service principal 03/07/13 10:08:48 03/07/13 20:08:55 krbtgt/ad.demo.lan@ad.demo.lan renew until 03/08/13 10:08:48 03/07/13 10:10:16 03/07/13 20:08:55 cifs/win200864@ad.demo.lan renew until 03/08/13 10:08:48 Kerberos 4 ticket cache: /tmp/tkt0 klist: You have no tickets cached interop01:~ # Valid starting Expires Service principal 03/07/13 10:08:48 03/07/13 20:08:55 krbtgt/ad.demo.lan@ad.demo.lan renew until 03/08/13 10:08:48 Kerberos 4 ticket cache: /tmp/tkt0 klist: You have no tickets cached 17
![1] smb: \> smb: \> exit interop01:~ # klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: demo@ad.demo.lan Valid starting Expires Service principal 03/07/13 10:08:48 03/07/13 20:08:55 krbtgt/ad.](/docs-images/40/8924465/images/page_16.jpg "demo.lan@ad.demo.lan renew until 03/08/13 10:08:48 03/07/13 10:10:16 03/07/13 20:08:55 cifs/win200864@ad.demo.lan renew until 03/08/13 10:08:48 Kerberos 4 ticket cache: /tmp/tkt0 klist: You have no")
17 Use Case 2: Integrate SPNGO enabled applications with AD: OpenLDAP ldapsearch Steps Request TGT with kinit or log in as an AD user Run ldapsearch interop01:~ # ldapsearch \ -h win b 'cn=users,dc=ad,dc=demo,dc=lan' \ -LLL '(givenname=interop)' \ cn SASL/GSSAPI authentication started SASL username: Administrator@AD.DEMO.LAN SASL SSF: 56 SASL data security layer installed. dn: CN=Interop Demo,CN=Users,DC=ad,DC=demo,DC=lan cn: Interop Demo interop01:~ # 18
18 Scenario 1: Use Case 3: Mount a Windows share Mount manually With plain passwords mount -o username=administrator,password=mysecret //win200864/share /mnt/win share Using Kerberos kinit Administrator mount -o sec=krb5i //win200864/share /mnt/win share Mount at boot from fstab Credentials file //win200864/share /mnt/win share cifs credentials=/root/.smb.credentials 0 0 See also: man 8 mount.cifs 19
19 Scenario 1: Use Case 4: Access a Samba share from Windows Transparently access Samba share Start Run \\interop02<enter> 20
20 Scenario 2: Integration of Apache with Active Directory Apache SLES 11 SP2 mod_kerb_auth / 3 2 Active Directory (LDAP) Kerberos Windows 2008 R2 Role: Member server AD: ad.demo.lan Hostname: interop04 /secure 1 4 Role: AD Domain Controller AD domain name: ad.demo.lan NT-style domain name: INTEROP Hostname: win Firefox Internet Explorer See more detailled documentation Windows 7 (win764.ad.demo.lan) 21
21 Scenario 2: Integration of Apache with Active Directory Configuration steps Steps on SLES Join domain Create/amend keytab Configure Apache Steps on workstations Configure Integrated Authentication for Firefox Steps on Active Directory Add user sles-apache Add group SLES Web Users Add user Administrator to SLES Web Users Internet Explorer See also: HTTP-Based Cross-Platform Authentication by Using the Negotiate Protocol (MSDN) See also: Interop Demo appliance 22
22 Configure Apache for Kerberos authentication file: /etc/apache/conf.d/apache-integration-with-ad.conf LoadModule auth_kerb_module /usr/lib64/apache2/mod_auth_kerb.so LoadModule ldap_module /usr/lib64/apache2/mod_ldap.so LoadModule authnz_ldap_module /usr/lib64/apache2/mod_authnz_ldap.so <Location /secure> # Configuration for auth_kerb AuthName "---Restricted Access, please use your Active Directory credentials---" AuthType Kerberos KrbMethodNegotiate on KrbMethodK5Passwd on Krb5Keytab /etc/krb5.keytab KrbAuthRealms AD.DEMO.LAN KrbServiceName HTTP/interop04.ad.demo.lan@AD.DEMO.LAN KrbLocalUserMapping On # Configuration for authnz_ldap AuthLDAPBindDN cn=sles-apache,cn=users,dc=ad,dc=demo,dc=lan AuthLDAPBindPassword SecretPassword AuthLDAPURL "ldap://win ad.demo.lan:389/dc=ad,dc=demo,dc=lan?samaccountname" AuthLDAPGroupAttribute member Require ldap-group cn=sles Web Users,cn=Users,dc=ad,dc=demo,dc=lan </Location> 23
23 Amend the keytab with HTTP principal # net ads keytab add HTTP -U Administrator Processing principals to add... Enter Administrator's password: # klist -k -e Keytab name: FILE:/etc/krb5.keytab KVNO Principal host/interop04.ad.demo.lan@ad.demo.lan (DES cbc mode with CRC-32) 2 host/interop04.ad.demo.lan@ad.demo.lan (DES cbc mode with RSA-MD5) 2 host/interop04.ad.demo.lan@ad.demo.lan (AES-128 CTS mode with 96-bit SHA-1 HMAC) 2 host/interop04.ad.demo.lan@ad.demo.lan (AES-256 CTS mode with 96-bit SHA-1 HMAC) 2 host/interop04.ad.demo.lan@ad.demo.lan (ArcFour with HMAC/md5) 2 host/interop04@ad.demo.lan (DES cbc mode with CRC-32) 2 host/interop04@ad.demo.lan (DES cbc mode with RSA-MD5) 2 host/interop04@ad.demo.lan (AES-128 CTS mode with 96-bit SHA-1 HMAC) 2 host/interop04@ad.demo.lan (AES-256 CTS mode with 96-bit SHA-1 HMAC) 2 host/interop04@ad.demo.lan (ArcFour with HMAC/md5) 2 INTEROP04$@AD.DEMO.LAN (DES cbc mode with CRC-32) 2 INTEROP04$@AD.DEMO.LAN (DES cbc mode with RSA-MD5) 2 INTEROP04$@AD.DEMO.LAN (AES-128 CTS mode with 96-bit SHA-1 HMAC) 2 INTEROP04$@AD.DEMO.LAN (AES-256 CTS mode with 96-bit SHA-1 HMAC) 2 INTEROP04$@AD.DEMO.LAN (ArcFour with HMAC/md5) 2 HTTP/interop04.ad.demo.lan@AD.DEMO.LAN (DES cbc mode with CRC-32) 2 HTTP/interop04.ad.demo.lan@AD.DEMO.LAN (DES cbc mode with RSA-MD5) 2 HTTP/interop04.ad.demo.lan@AD.DEMO.LAN (AES-128 CTS mode with 96-bit SHA-1 HMAC) 2 HTTP/interop04.ad.demo.lan@AD.DEMO.LAN (AES-256 CTS mode with 96-bit SHA-1 HMAC) 2 HTTP/interop04.ad.demo.lan@AD.DEMO.LAN (ArcFour with HMAC/md5) 2 HTTP/interop04@AD.DEMO.LAN (DES cbc mode with CRC-32) 2 HTTP/interop04@AD.DEMO.LAN (DES cbc mode with RSA-MD5) 2 HTTP/interop04@AD.DEMO.LAN (AES-128 CTS mode with 96-bit SHA-1 HMAC) 2 HTTP/interop04@AD.DEMO.LAN (AES-256 CTS mode with 96-bit SHA-1 HMAC) 2 HTTP/interop04@AD.DEMO.LAN (ArcFour with HMAC/md5) # 24
24 Create separate krb5.keytab for Apache interop02:~ # ktutil ktutil: list slot KVNO Principal ktutil: rkt /etc/krb5.keytab ktutil: list slot KVNO Principal host/interop02.ad.demo.lan@ad.demo.lan HTTP/interop02.ad.demo.lan@AD.DEMO.LAN HTTP/interop02@AD.DEMO.LAN ktutil: delent 1 # repeat sufficient nr. of times to get rid of all but HTTP entries Ktutil: wkt /etc/apache2/conf.d/apache2-krb5.keytab # klist -k -e /etc/apache2/conf.d/apache2-krb5.keytab Keytab name: FILE:/etc/apache2/conf.d/apache2-krb5.keytab KVNO Principal HTTP/interop02.ad.demo.lan@AD.DEMO.LAN (DES cbc mode with CRC-32) 2 HTTP/interop02.ad.demo.lan@AD.DEMO.LAN (DES cbc mode with RSA-MD5) 2 HTTP/interop02.ad.demo.lan@AD.DEMO.LAN (AES-128 CTS mode with 96-bit SHA-1 HMAC) 2 HTTP/interop02.ad.demo.lan@AD.DEMO.LAN (AES-256 CTS mode with 96-bit SHA-1 HMAC) 2 HTTP/interop02.ad.demo.lan@AD.DEMO.LAN (ArcFour with HMAC/md5) 2 HTTP/interop02@AD.DEMO.LAN (DES cbc mode with CRC-32) 2 HTTP/interop02@AD.DEMO.LAN (DES cbc mode with RSA-MD5) 2 HTTP/interop02@AD.DEMO.LAN (AES-128 CTS mode with 96-bit SHA-1 HMAC) 2 HTTP/interop02@AD.DEMO.LAN (AES-256 CTS mode with 96-bit SHA-1 HMAC) 2 HTTP/interop02@AD.DEMO.LAN (ArcFour with HMAC/md5) # 25
25 Configure Firefox for Integrated Authentication 1 Firefox is by default not enabled for the Negotiate authentication 1: Negotiate not enabled 2: Enable Negotiate 2 3 3: Transparent access! 26
26 Example HTTP request header using SPNEGO GET /secure/ HTTP/1.1 Host: interop01.ad.demo.lan User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/ Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive If-Modified-Since: Mon, 11 Mar :37:53 GMT If-None-Match: "b75e-db-4d7a6479f2e40" Cache-Control: max-age=0, max-age=0 Authorization: Negotiate YIIGugYGKwYBBQUCoIIGrjCCBqqgMDAuB... 27
27 28 Configure Firefox for Integrated Authentication
28 29 Configure Firefox for Integrated Authentication
29 Configure IE for Integrated Authentication IE is by default not enabled for the Negotiate authentication 30
30 Configure IE for Integrated Authentication IE is by default not enabled for the Negotiate authentication 31
31 32 Configure IE for Integrated Authentication
32 Bleeding Edge Samba 4 With thanks to David Disseldorp, Samba Team 33
33 Traditional Copy Read Write File data takes disk and network round-trips Duplicate data stored on disk Read Write 34
34 Server-Side Copy Copy Server-Side Network round-trip avoided Server copies file data locally Duplicate data stored on disk Read Write 35
35 Btrfs Enhanced Server-Side Copy Copy Server-Side Data avoids network and disk round-trips No duplication of file data Ideal for hypervisor based workloads Clone Range 36
36 Prototype Samba implementation of Recovery Point Features Through integration of Btrfs, Snapper and Samba, SLES 11 SP2 is providing a file share Automatic snapshots create by Snapper provide Recovery Points for files Through Windows Explorer clients may access older versions of a file Technology components SLES 11 SP2 Btrfs and Snapper(prototype) Samba 4(prototype) Windows XP and 7 See also: Bleeding Edge Samba and Snapper appliance 37
37 Prototype Samba implementation of Recovery Point Automatic snapshots by Snapper Previous versions of test.txt in Explorer File test.txt is changed Samba4 service File share Automated snapshots File test.txt is created Now SLES 11 SP2 Network share Windows 7, Vista or XP 38
38 39 Questions
39 For more information please visit our website: Thank you. 40
40
41 Unpublished Work of SUSE. All Rights Reserved. This work is an unpublished work and contains confidential, proprietary and trade secret information of SUSE. Access to this work is restricted to SUSE employees who have a need to know to perform tasks within the scope of their assignments. No part of this work may be practiced, performed, copied, distributed, revised, modified, translated, abridged, condensed, expanded, collected, or adapted without the prior written consent of SUSE. Any use or exploitation of this work without authorization could subject the perpetrator to criminal and civil liability. General Disclaimer This document is not to be construed as a promise by any participating company to develop, deliver, or market a product. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. SUSE makes no representations or warranties with respect to the contents of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. The development, release, and timing of features or functionality described for SUSE products remains at the sole discretion of SUSE. Further, SUSE reserves the right to revise this document and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. All SUSE marks referenced in this presentation are trademarks or registered trademarks of Novell, Inc. in the United States and other countries. All third-party trademarks are the property of their respective owners.
Kangaroot SUSE TechUpdate Interoperability SUSE Linux Enterprise and Windows
Kangaroot SUSE TechUpdate Interoperability SUSE Linux Enterprise and Windows Gábor Nyers Systems Engineer @SUSE gnyers@suse.com Agenda 14:00 Kangaroot Update SUSE Update Data Center Interoperability the
Single sign-on websites with Apache httpd: Integrating with Active Directory for authentication and authorization
Single sign-on websites with Apache httpd: Integrating with Active Directory for authentication and authorization Michael Heldebrant Solutions Architect, Red Hat Outline Authentication overview Basic LDAP
Implementing Linux Authentication and Authorisation Using SSSD
Implementing Linux Authentication and Authorisation Using SSSD Lawrence Kearney Enterprise Service and Integration Specialist Technology Transfer Partnership (TTP) lawrence.kearney@earthlink.net Mark Robinson
Going in production Winbind in large AD domains today. Günther Deschner gd@samba.org. (Red Hat / Samba Team)
Going in production Winbind in large AD domains today Günther Deschner gd@samba.org (Red Hat / Samba Team) Agenda To go where no one has gone before Winbind scalability Find Domain Controllers Active Directory
Advanced Systems Management with Machinery
Advanced Systems Management with Machinery Andreas Jaeger Thomas Göttlicher Senior Product Manager aj@suse.com Software Engineer tgoettlicher@suse.com Who Are We? Andreas Jaeger Product Manager Thomas
SUSE Customer Center Roadmap
SUSE Customer Center Roadmap Simona Arsene Product Manager Services Artem Chernikov Engineer Cloud & System Management Agenda SCC Today Live Demo of SCC Registration Process New features 2 1 Nov 2012 Alpha
Building Images for the Cloud and Data Center with SUSE Studio
Building Images for the Cloud and Data Center with SUSE Studio Michal Svec James Tan Senior Product Manager msvec@suse.com Engineering Manager jatan@suse.com Agenda From Software to Service SUSE Studio
SSSD Active Directory Improvements
FreeIPA Training Series SSSD Active Directory Improvements Jakub Hrozek January 2013 Contents of the presentation 1.Overview of Active Directory related improvements 2.Range attributes support 3.Mapping
Building Open Source Identity Management with FreeIPA. Martin Kosek mkosek@redhat.com http://www.oss4b.it/
Building Open Source Identity Management with FreeIPA Martin Kosek mkosek@redhat.com http:/// OSS4B 2013 - Open Source Software for Business 19-20 September 2013, Monash University Prato Centre Prato,
INUVIKA TECHNICAL GUIDE
--------------------------------------------------------------------------------------------------- INUVIKA TECHNICAL GUIDE SINGLE SIGN-ON WITH MICROSOFT ACTIVE DIRECTORY USING KERBEROS OVD Enterprise
FreeIPA - Open Source Identity Management in Linux
FreeIPA - Open Source Identity Management in Linux Martin Košek Supervisor, Software Engineering, Red Hat ORS 2013, Karviná 1 Identity Management What is identity management? Identity
Single Sign-On for Kerberized Linux and UNIX Applications
Likewise Enterprise Single Sign-On for Kerberized Linux and UNIX Applications AUTHOR: Manny Vellon Chief Technology Officer Likewise Software Abstract This document describes how Likewise facilitates the
Windows Enterprise OU Administrator Tips. Integrating RHEL5 Systems with Active Directory
Windows Enterprise OU Administrator Tips Integrating RHEL5 Systems with Active Directory John Dickerson and Beata Pruski Created: December 4, 2009 Last Update: February 4, 2011 This document will show
RHEL Clients to AD Integrating RHEL clients to Active Directory
RHEL Clients to AD Integrating RHEL clients to Active Directory Presenter Dave Sullivan Sr. TAM, Red Hat 2013-09-03 Agenda Review Dmitri Pal and Simo Sorce Preso Legacy RHEL hook to AD RHEL Direct--->sssd--->AD
Using btrfs Snapshots for Full System Rollback
Using btrfs Snapshots for Full System Rollback Matthias G. Eckermann Senior Product Manager mge@suse.com Enterprise End User Summit, New York, June 2014 2014-06-20 15:44 UTC Why this? Minimizing Downtime
Linux/Windows Security Interop: Apache with mod_auth_kerb and Windows Server 2003 R2
Linux/Windows Security Interop: Apache with mod_auth_kerb and Windows Server 2003 R2 Published by the Open Source Software Lab at Microsoft. January 2008. Special thanks to Chris Travers, Contributing
Relax-and-Recover. Johannes Meixner. on SUSE Linux Enterprise 12. <jsmeix@suse.com>
Relax-and-Recover on SUSE Linux Enterprise 12 Johannes Meixner Topics What is Relax-and-Recover? What means disaster recovery here? How does disaster recovery work? How does Relax-and-Recover
Running SAP HANA One on SoftLayer Bare Metal with SUSE Linux Enterprise Server CAS19256
Running SAP HANA One on SoftLayer Bare Metal with SUSE Linux Enterprise Server CAS19256 Brad DesAulniers Senior Software Engineer bradd@us.ibm.com @cb_brad Ryan Hodgin Senior IT Architect rhodgin@us.ibm.com
Apache LDAP Configuration
Apache LDAP Configuration using Novell Edirectory and Microsoft Active Directory for the Neanderthal Lawrence Kearney Advisor for Higher Education in the Americas Technology Transfer Partners (TTP) Proposed
Using Kerberos tickets for true Single Sign On
Using Kerberos tickets for true Single Sign On Table of Contents Introduction This document details the reasoning for, configuration of and experiences from the initial setup of Kerberos tickets for SSO
Using SUSE Linux Enterprise Desktop with Microsoft * Active Directory Infrastructure
Technical White Paper DESKTOP www.novell.com Using SUSE Linux Enterprise Desktop with Microsoft * Active Directory Infrastructure * Using SUSE Linux Enterprise Desktop with Microsoft Active Directory Infrastructure
Operating System Security Hardening for SAP HANA
Operating System Security Hardening for SAP HANA Peter Schinagl Technical Architect Global SAP Alliance peters@suse.com Markus Gürtler Architect & Technical Manager SAP Linux Lab mguertler@suse.com Corporate
SUSE Linux uutuudet - kuulumiset SUSECon:sta
SUSE Linux uutuudet - kuulumiset SUSECon:sta Olli Tuominen Technology Specialist olli.tuominen@suse.com 2 SUSECon 13 4 days, 95 Sessions Keynotes, Breakout Sessions,Technology Showcase Case Studies, Technical
Challenges Implementing a Generic Backup-Restore API for Linux
Challenges Implementing a Generic Backup-Restore API for Linux Matthias G. Eckermann Senior Product Manager mge@suse.com Vault, Boston, March 2015 2015-03-12 13:45 UTC Picture: "Escribano" by Jean Le Tavernier
Integrating Red Hat Enterprise Linux 6 with Microsoft Active Directory Presentation
Integrating Red Hat Enterprise Linux 6 with Microsoft Active Directory Presentation Agenda Overview Components Considerations Configurations Futures Summary What is needed? Thorough understanding components,
Using SUSE Linux Enterprise to "Focus In" on Retail Optical Sales
Using SUSE Linux Enterprise to "Focus In" on Retail Optical Sales Patrick Mullin Scott Steele Senior Technical Specialist SUSE Consulting pmullin@suse.com Point of Sale Manager National Vision, Inc. scott.steele@nationalvision.com
Guide to SASL, GSSAPI & Kerberos v.6.0
SYMLABS VIRTUAL DIRECTORY SERVER Guide to SASL, GSSAPI & Kerberos v.6.0 Copyright 2011 www.symlabs.com Chapter 1 Introduction Symlabs has added support for the GSSAPI 1 authentication mechanism, which
Setting up Single Sign-On (SSO) with SAP HANA and SAP BusinessObjects XI 4.0
Setting up Single Sign-On (SSO) with SAP HANA and SAP BusinessObjects XI 4.0 February 8, 2013 Version 1.0 Vishal Dhir Customer Solution Adoption (CSA) www.sap.com TABLE OF CONTENTS INTRODUCTION... 3 What
Integration with Active Directory. Jeremy Allison Samba Team
Integration with Active Directory Jeremy Allison Samba Team Benefits of using Active Directory Unlike the earlier Microsoft Windows NT 4.x Domain directory service which used proprietary DCE/RPC calls,
HO15982 Deploy OpenStack. The SUSE OpenStack Cloud Experience. Alejandro Bonilla. Michael Echavarria. Cameron Seader. Sales Engineer cs@suse.
HO15982 Deploy OpenStack The SUSE OpenStack Cloud Experience Alejandro Bonilla Sales Engineer abonilla@suse.com Michael Echavarria Sales Engineer mechavarria@suse.com Cameron Seader Sales Engineer cs@suse.com
Using SUSE Cloud to Orchestrate Multiple Hypervisors and Storage at ADP
Using SUSE Cloud to Orchestrate Multiple Hypervisors and Storage at ADP Agenda ADP Cloud Vision and Requirements Introduction to SUSE Cloud Overview Whats New VMWare intergration HyperV intergration ADP
Integrating UNIX and Linux with Active Directory. John H Terpstra
Integrating UNIX and Linux with Active Directory John H Terpstra CTO, PrimaStasys Inc. jht@primastasys.com Slide 1 Agenda Definition of the Integration Problem Technical Background Review of Solution Choices
Big Data, SAP HANA. SUSE Linux Enterprise Server for SAP Applications. Kim Aaltonen kim.aaltonen@suse.com
Big Data, SAP HANA SUSE Linux Enterprise Server for SAP Applications Kim Aaltonen kim.aaltonen@suse.com 2 Agenda 3 Big Data SAP HANA Optimized Linux for SAP Why SUSE for SAP? Summary 4 5 Big Data What
Kerberos and Single Sign On with HTTP
Kerberos and Single Sign On with HTTP Joe Orton Senior Software Engineer, Red Hat Overview Introduction The Problem Current Solutions Future Solutions Conclusion Introduction WebDAV: common complaint of
White Paper. Fabasoft on Linux - Preparation Guide for Community ENTerprise Operating System. Fabasoft Folio 2015 Update Rollup 2
White Paper Fabasoft on Linux - Preparation Guide for Community ENTerprise Operating System Fabasoft Folio 2015 Update Rollup 2 Copyright Fabasoft R&D GmbH, Linz, Austria, 2015. All rights reserved. All
Attunity RepliWeb PAM Configuration Guide
Attunity RepliWeb PAM Configuration Guide Software Version 5.2 For Linux and UNIX operating systems June 28, 2012 RepliWeb, Inc., 6441 Lyons Road, Coconut Creek, FL 33073 Tel: (954) 946-2274, Fax: (954)
Installing, Tuning, and Deploying Oracle Database on SUSE Linux Enterprise Server 12 Technical Introduction
Installing, Tuning, and Deploying Oracle Database on SUSE Linux Enterprise Server 12 Technical Introduction Arun Singh Sr. Technical Manager Arun.Singh@suse.com Agenda 2 Introduction SUSE Components Oracle
Kerberos and Single Sign-On with HTTP
Kerberos and Single Sign-On with HTTP Joe Orton Red Hat Introduction The Problem Current Solutions Future Solutions Conclusion Overview Introduction WebDAV: common complaint of poor support for authentication
Univention Corporate Server. Extended domain services documentation
Univention Corporate Server Extended domain services documentation 2 Table of Contents 1. Integration of Ubuntu clients into a UCS domain... 4 1.1. Integration into the LDAP directory and the SSL certificate
SUSE Enterprise Storage Highly Scalable Software Defined Storage. Gábor Nyers Sales Engineer @SUSE gnyers@suse.com
SUSE Enterprise Storage Highly Scalable Software Defined Storage Gábor Nyers Sales Engineer @SUSE gnyers@suse.com Setting the Stage Enterprise Data Capacity Utilization 1-3% 15-20% 20-25% Tier 0 Ultra
GL550 - Enterprise Linux Security Administration
GL550 - Enterprise Linux Security Administration This highly technical course focuses on properly securing machines running the Linux operating systems. A broad range of general security techniques such
How To Make A Cloud Work For You
OpenStack Deep Dive Alan Clark OpenStack, Chairman of the Board Director, SUSE aclark@suse.com Community Size Q2 2014 ECOSYSTEM SIZE (Members + Sponsors + Supporters) 390 Companies Members: 26 Sponsors:
Case Study: University of Dayton and Novell Identity & Security Solutions Rick Wagner
Case Study: University of Dayton and Novell Identity & Security Solutions Rick Wagner Senior Product Manager, Security Management rwagner@novell.com University of Dayton Recognized by US News and World
We are watching SUSE
We are watching SUSE Monitoring at SUSE and in SUSE Linux Enterprise Server 12 Martin Čaj Linux System Administrator Prague Czech Republic mcaj@suse.com Joachim Werner Senior Product Manager Nürnberg Germany
Deploying Hadoop with Manager
Deploying Hadoop with Manager SUSE Big Data Made Easier Peter Linnell / Sales Engineer plinnell@suse.com Alejandro Bonilla / Sales Engineer abonilla@suse.com 2 Hadoop Core Components 3 Typical Hadoop Distribution
High Availability Storage
High Availability Storage High Availability Extensions Goldwyn Rodrigues High Availability Storage Engineer SUSE High Availability Extensions Highly available services for mission critical systems Integrated
Ceph Distributed Storage for the Cloud An update of enterprise use-cases at BMW
Ceph Distributed Storage for the Cloud An update of enterprise use-cases at BMW Andreas Pöschl, BMW Senior Solutions Architect andreas.poeschl@bmw.de Michael Vonderbecke, BMW Solutions Architect michael.vonderbecke@bmwmc.com
Wicked A Network Manager Olaf Kirch
Wicked A Network Manager Olaf Kirch Director SUSE Linux Enterprise okir@suse.com 2 Agenda Why Wicked!? What we want to achieve What Wicked can do today/tomorrow Architecture Wicked little intro Why Wicked!?
SUSE Manager 1.2.x ADS Authentication
Best Practice www.suse.com SUSE Manager 1.2.x ADS Authentication How to use MS-ADS authentiction (Version 0.7 / March 2 nd 2012) P r e f a c e This paper should help to integrate SUSE Manager to an existing
Public Cloud. Build, Use, Manage. Robert Schweikert. Public Cloud Architect rjschwei@suse.com
Public Cloud Build, Use, Manage Robert Schweikert Public Cloud Architect rjschwei@suse.com Public Cloud Build, Use, Manage Introduction About me Disclaimers Build vs. Ready made What do I... Now what?
Single Sign-on (SSO) technologies for the Domino Web Server
Single Sign-on (SSO) technologies for the Domino Web Server Jane Marcus December 7, 2011 2011 IBM Corporation Welcome Participant Passcode: 4297643 2011 IBM Corporation 2 Agenda USA Toll Free (866) 803-2145
Btrfs and Rollback How It Works and How to Avoid Pitfalls
Btrfs and Rollback How It Works and How to Avoid Pitfalls Thorsten Kukuk Senior Architect SUSE Linux Enterprise Server kukuk@suse.com rm -rf /? I will be discussing what is needed for rollback: Btrfs /
Data Center Automation with SUSE Manager Federal Deployment Agency Bundesagentur für Arbeit Data Center Automation Project
Data Center Automation with SUSE Manager Federal Deployment Agency Bundesagentur für Arbeit Data Center Automation Project Ralf Bueker DSE Bundesagentur für Arbeit rbueker@suse.com What is a DSE? DSE means
ENTERPRISE LINUX SECURITY ADMINISTRATION
ENTERPRISE LINUX SECURITY ADMINISTRATION COURSE DESCRIPTION: This highly technical course focuses on properly securing machines running the Linux operating systems. A broad range of general security techniques
Kerberos and Active Directory symmetric cryptography in practice COSC412
Kerberos and Active Directory symmetric cryptography in practice COSC412 Learning objectives Understand the function of Kerberos Explain how symmetric cryptography supports the operation of Kerberos Summarise
Interoperability Update: Red Hat Enterprise Linux 7 beta and Microsoft Windows
Interoperability Update: Red Hat Enterprise 7 beta and Microsoft Windows Mark Heslin Principal Systems Engineer Red Hat Systems Engineering Dmitri Pal Senior Engineering Manager Red Hat Software Engineering
Using OpenSSH in a Single Sign-On Corporate Environment with z/os, Windows and Linux
Using OpenSSH in a Single Sign-On Corporate Environment with z/os, Windows and Linux Dovetailed Technologies February 2016 Edition 2.0.0 For the latest version of this document, see http://dovetail.com/docs/ssh/kerberos_sso.pdf
Novell Cloud Security Service Reducing Risk by Securing the Cloud. Stefan Stiehl Senior Sales Technology Specialist sstiehl@novell.
Novell Cloud Security Service Reducing Risk by Securing the Cloud Stefan Stiehl Senior Sales Technology Specialist sstiehl@novell.com Disclaimer for Product in Development Unpublished Work of Novell, Inc.
ENTERPRISE LINUX SECURITY ADMINISTRATION
ENTERPRISE LINUX SECURITY ADMINISTRATION This highly technical course focuses on properly securing machines running the Linux operating systems. A broad range of general security techniques such as packet
System Security Services Daemon
System Security Services Daemon System Security Services Daemon Manages communication with centralized identity and authentication stores Provides robust, predictable caching for network accounts Can cache
SUSE Linux Enterprise 12 Security Certifications Common Criteria, EAL, FIPS, PCI DSS,... What's All This About?
SUSE Linux Enterprise 12 Security Certifications Common Criteria, EAL, FIPS, PCI DSS,... What's All This About? Matthias G. Eckermann Senior Product Manager SUSE Linux Enterprise mge@suse.com Agenda Evaluation
Proste zarządzanie setkami serwerów SUSE Manager 2.1 I SUSE Virtualization Enterprise Console
Proste zarządzanie setkami serwerów SUSE Manager 2.1 I SUSE Virtualization Enterprise Console Dariusz Puchalak SUSE Certified Instructor Dariusz@Puchalak.net Dariusz Puchalak since november 2014 at OSEC.pl
IceWarp Server - SSO (Single Sign-On)
IceWarp Server - SSO (Single Sign-On) Probably the most difficult task for me is to explain the new SSO feature of IceWarp Server. The reason for this is that I have only little knowledge about it and
Using Single Sign-on with Samba. Appendices. Glossary. Using Single Sign-on with Samba. SonicOS Enhanced
SonicOS Enhanced Using Single Sign-on with Samba Using Single Sign-on with Samba Introduction Recommended Versions Caveats SonicWALL Single Sign-on in Windows SonicWALL Single Sign-on with Samba Checking
TUT5605: Deploying an elastic Hadoop cluster Alejandro Bonilla
TUT5605: Deploying an elastic Hadoop cluster Alejandro Bonilla Sales Engineer abonilla@suse.com Agenda Overview Manual Deployment Orchestration Generic workload autoscaling Sahara Dedicated for Hadoop
Identity Management based on FreeIPA
Identity Management based on FreeIPA SLAC 2014 Thorsten Scherf Red Hat EMEA What is an Identity Management System (IdM) An IdM system is a set of services and rules to manage the users of an organization
DevOps and SUSE From check-in to deployment
DevOps and SUSE From check-in to deployment Rodolfo Bejarano SUSE Systems Engineer rodolfo.bejarano@suse.com Rick Ashford SUSE Systems Engineer rick.ashford@suse.com 2 Agenda 3 Introductions Development
Using Active Directory as your Solaris Authentication Source
Using Active Directory as your Solaris Authentication Source The scope of this paper is to document how a newly installed Solaris 10 server can be configured to use an Active Directory directory service
SUSE Storage. FUT7537 Software Defined Storage Introduction and Roadmap: Getting your tentacles around data growth. Larry Morris
SUSE FUT7537 Software Defined Introduction and Roadmap: Getting your tentacles around data growth Larry Morris Sr. Product Manager lmorris@suse.com AGENDA Enterprise Market SUSE Product SUSE Solutions
Build Platform as a Service (PaaS) with SUSE Studio, WSO2 Middleware, and EC2 Chris Haddad
Build Platform as a Service (PaaS) with SUSE Studio, WSO2 Middleware, and EC2 Chris Haddad VP, Platform Evangelism WSO2 chris@wso2.com Section Break Text Here (32pt) Cloudy Goals Improve efficiency and
Install and Configure an Open Source Identity Server Lab
Install and Configure an Open Source Identity Server Lab SUS05/SUS06 Novell Training Services ATT LIVE 2012 LAS VEGAS www.novell.com Legal Notices Novell, Inc., makes no representations or warranties with
SAP SINGLE SIGN-ON AND SECURE CONNECTIONS VIA SNC ADAPTER. Author : Matthias Schlarb, REALTECH system consulting GmbH. matthias.schlarb@realtech.
SAP SINGLE SIGN-ON AND SECURE CONNECTIONS VIA SNC ADAPTER BASED ON KERBEROS V5 Project name : SSO SNC ABAP Our reference : REALTECH Project management : Manfred Stein, SAP AG manfred.stein@sap.com Document
CAS18543 Migration from a Windows Environment to a SUSE Linux Enterprise based Infrastructure Liberty Christian School
CAS18543 Migration from a Windows Environment to a SUSE Linux Enterprise based Infrastructure Liberty Christian School Don Vosburg Systems Engineer dvosburg@suse.com don.vosburg@libertyonline.org Who is
Faster Time to Market and Technology Innovation Integrated Systems with SUSE. Otto Smits OEM Account Executive EMEA July 9 th 2014
Faster Time to Market and Technology Innovation Integrated Systems with SUSE Otto Smits OEM Account Executive EMEA July 9 th 2014 About SUSE SUSE Part of the Attachmate Group Our Commitments Quality Products
SUSE OpenStack Cloud 4 Private Cloud Platform based on OpenStack. Gábor Nyers Sales Engineer @SUSE gnyers@suse.com
SUSE OpenStack Cloud 4 Private Cloud Platform based on OpenStack Gábor Nyers Sales Engineer @SUSE gnyers@suse.com Introductory video ChalkTalk: SUSE OpenStack Cloud 2 Stetting the Stage for SUSE OpenStack
GL-550: Red Hat Linux Security Administration. Course Outline. Course Length: 5 days
GL-550: Red Hat Linux Security Administration Course Length: 5 days Course Description: This highly technical course focuses on properly securing machines running the Linux operating systems. A broad range
Open Source High Availability Writing Resource Agents for your own services. Lars Marowsky-Brée Team Lead SUSE Labs lmb@suse.de
Open Source High Availability Writing Resource Agents for your own services Lars Marowsky-Brée Team Lead SUSE Labs lmb@suse.de Agenda Introduction Resource Agents in context Basic Resource Agents (+ code)
Charles Firth charles@firthconsulting.com. Managing Macs in a Windows World
Charles Firth charles@firthconsulting.com Managing Macs in a Windows World Prerequisites Familiarity with Windows Active Directory networks Interest in Macintosh OSX integration and support Basic understanding
Unifying Authorization Models
Unifying Authorization Models Merging /etc/group and 'Domain Users' Gerald Carter Centeris jerry@samba.org http://www.samba.org/ Slide 1 Copyright G. Carter, 2006 Outline http://samba.org/~jerry/slides/lwny07_2up.pdf
Leverage Active Directory with Kerberos to Eliminate HTTP Password
Leverage Active Directory with Kerberos to Eliminate HTTP Password PistolStar, Inc. PO Box 1226 Amherst, NH 03031 USA Phone: 603.547.1200 Fax: 603.546.2309 E-mail: salesteam@pistolstar.com Website: www.pistolstar.com
User Source and Authentication Reference
User Source and Authentication Reference ZENworks 11 www.novell.com/documentation Legal Notices Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation,
Mac OS X Directory Services
Mac OS X Directory Services Agenda Open Directory Mac OS X client access Directory services in Mac OS X Server Redundancy and replication Mac OS X access to other directory services Active Directory support
Domain Services for Windows Administration Guide
www.novell.com/documentation Domain Services for Windows Administration Guide Open Enterprise Server 11 SP2 January 2014 Legal Notices Novell, Inc. makes no representations or warranties with respect to
Table 1 shows the LDAP server configuration required for configuring the federated repositories in the Tivoli Integrated Portal server.
Configuring IBM Tivoli Integrated Portal server for single sign-on using Simple and Protected GSSAPI Negotiation Mechanism, and Microsoft Active Directory services Document version 1.0 Copyright International
Open Enterprise Server Product Roadmap Presentation
Novell Open Enterprise Server Product Roadmap Presentation Lothar Wegner SE Manager lwegner@novell.com Nicholas Scholz Product Marketing Manager NScholz@novell.com Madhan P Product Manager pmadhan@novell.com
Configure the Application Server User Account on the Domain Server
How to Set up Kerberos Summary This guide guide provides the steps required to set up Kerberos Configure the Application Server User Account on the Domain Server The following instructions are based on
Using Kerberos to Authenticate a Solaris TM 10 OS LDAP Client With Microsoft Active Directory
Using Kerberos to Authenticate a Solaris TM 10 OS LDAP Client With Microsoft Active Directory Wajih Ahmed and Baban Kenkre March 2008 (Updated May 2008) Sun Microsystems, Inc. Please note: This configuration
ACE Management Server Deployment Guide VMware ACE 2.0
Technical Note ACE Management Server Deployment Guide VMware ACE 2.0 This technical note provides guidelines for the deployment of VMware ACE Management Servers, including capacity planning and best practices.
High Availability and Disaster Recovery for SAP HANA with SUSE Linux Enterprise Server for SAP Applications
High Availability and Disaster Recovery for SAP HANA with SUSE Linux Enterprise Server for SAP Applications Uwe Heinz Product Manager SAP Uwe.Heinz@sap.com Fabian Herschel Senior Architect SAP LinuxLab
Secure Unified Authentication for NFS
Technical Report Secure Unified Authentication for NFS Kerberos, NFSv4, and LDAP in Clustered Data ONTAP Justin Parisi, NetApp July 2015 TR-4073 Abstract This document explains how to configure NetApp
Novell Remote Manager Administration Guide
www.novell.com/documentation Novell Remote Manager Administration Guide Open Enterprise Server 11 SP2 January 2014 Legal Notices Novell, Inc., makes no representations or warranties with respect to the
IGEL Universal Management. Installation Guide
IGEL Universal Management Installation Guide Important Information Copyright This publication is protected under international copyright laws, with all rights reserved. No part of this manual, including
Software Defined Everything
Software Defined Everything, s, Containers, and Storage Pete Chadwick Senior Product Manager pchadwick@suse.com Joachim Werner Senior Product Manager joe@suse.com Data Center History - 1970s One (big)
TIBCO ActiveMatrix BPM Single Sign-On
TIBCO ActiveMatrix BPM Single Sign-On Software Release 4.0 November 2015 Two-Second Advantage 2 Important Information SOME TIBCO SOFTWARE EMBEDS OR BUNDLES OTHER TIBCO SOFTWARE. USE OF SUCH EMBEDDED OR
DameWare Server. Administrator Guide
DameWare Server Administrator Guide About DameWare Contact Information Team Contact Information Sales 1.866.270.1449 General Support Technical Support Customer Service User Forums http://www.dameware.com/customers.aspx
Advancements in Linux Authentication and Authorisation using SSSD
Managing an Enterprise Series and Authorisation using SSSD Lawrence Kearney Enterprise Workgroup and Service Analyst e. lawrence.kearney@earthlink.net w. www.lawrencekearney.com How SSSD came to our infrastructure
SUSE Linux Enterprise 12 Security Certifications
SUSE Linux Enterprise 12 Security Certifications Common Criteria, FIPS, PCI DSS, DISA STIG,... What's All This About? Thomas Biege Team Lead Maintenance/Security thomas@suse.com 2 Evaluation Validation
How an Open Source Cloud Will Help Keep Your Cloud Strategy Options Open
How an Open Source Cloud Will Help Keep Your Cloud Strategy Options Open Simon Briggs Technology Specialist simon@suse.com Open Source = openmind 3 Protect Investment & Work Together 4 Cloud Definitions
Linux w chmurze publicznej SUSE na platformie Microsoft Azure
Linux w chmurze publicznej SUSE na platformie Microsoft Azure Grzegorz Piotrowski Solution Architect C2O C EH, ISO27001-2, ITIL SM, PMI P2, MCT CCEE Virtualization MCSE Private Cloud VCA Cloud Grzegorz.Piotrowski@Alethos.eu
Oracle Products on SUSE Linux Enterprise Server 11
Oracle Products on SUSE Linux Enterprise Server 11 Technical Introduction Arun Singh Sr. Technical Manager Arun.Singh@suse.com Agenda Introduction SUSE Products Oracle Products Road Map Question and Answer