Jul 11

FreeBSD Single Sign on with Active Directory and Access Control

Category: FreeBSD, General B.S.

Introduction

This document describes how to join a FreeBSD box to a Windows domain controller and to control access to the FreeBSD box.  We will be using Samba’s WinBind and Kerberos for authentication.  

This document assumes that you have a functioning FreeBSD sever on a network with internet access.

Install Samba Port

 

1.       Log into FreeBSD Sever

2.       Su to root “su –“

3.      Change to Samba 3 ports directory “cd /usr/ports/net/samba3”

4.       Compile and install Samba 3 “make install”

a.      Select ONLY the following Samba options  in the configuration “LDAP, ADS, WINBIND, ACL_SUPPORT, SYSLOG, UTMP, PAM_SMBPASS, EXP_MODULES, & POPT”

Configure Samba

 

1. To get Samba and Winbind to work on boot up add the following to /etc/rc.conf file:

nmbd_enable=”YES”
smbd_enable=”YES”
winbindd_enable=”YES”

           kerberos5_server_enable=”YES”
           kadmind5_server_enable=”YES”

      2.      Move the orginal smb.conf file “mv /usr/local/etc/smb.conf /usr/local/etc/smb.conf.default”

      3.     Copy the following to smb.conf…

            [global]
            workgroup = YOURDOMAIN
            server string = FreeBSD Server %v
            load printers = no
           encrypt passwords = yes
           socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
           dns proxy = no
           smb ports = 139
           security = ADS
           realm = YOURDOMAIN.COM
           password server = domaincontroler1.yourdomain.com
           password server = domaincontroler2.yourdomain.com
           winbind separator = \
           idmap uid = 10000-20000
           idmap gid = 10000-20000
          winbind enum users = yes
          winbind enum groups = yes
          template homedir = /home/%D/%U
          template shell = /bin/tcsh
          client ntlmv2 auth = yes
          winbind use default domain = yes
          restrict anonymous = 2
          domain master = no
          local master = no
          preferred master = no
         disable netbios = no
         dos charset = ASCII
         unix charset = UTF8
        display charset = UTF8

Configure Kerberos

 

1.     Edit  /etc/krb5.conf (it probably doesn’t exist) and add the following text:

            [logging]
            default = SYSLOG:INFO:LOCAL7

[libdefaults]

   ticket_lifetime = 24000

   clock_skew = 300

   default_realm = YOURDOMAIN.COM

 

[realms]

   domain.LOCAL = {

       kdc = domaincontroler1.yourdomain.com:88
       kdc = domaincontroler2.yourdomain.com:88

       admin_server = domaincontroler1.yourdomain.com:464

       admin_server = domaincontroler2.yourdomain.com:464

       default_domain = yourdomain.com

}

 

[domain_realm]

   .domain.local = YOURDOMAIN.COM

   domain.local = YOURDOMAIN.COM

 

2.      Test Kerberos by typing “kinit <Username>”.   Put a username that is on the domain controller.  You should get a response of “kinit: NOTICE: ticket renewable lifetime is 1 week” and you will know its working.  You can also do a “klist” to see who issued the ticket and verify its from the Smartech domain.

Joining The Domain

 

1.       We should now be able to join the domain, enter the following:

 

/usr/local/bin/net ads join -U domaincontroler1.yourdomain.com -U administrator

 

2.       It will prompt you for the domain controllers administrator password.  If your successful you should see a reply like:

 

Using short domain name — YOURDOMAIN

Joined ‘FBTEST2′ to realm ‘YOURDOMAIN.COM’

 

Turning Samba on and Testing

 

1.       Run “/usr/local/etc/rc.d/samba start”

2.       Your output should look like this:

 

Removing stale Samba tdb files:  done

Starting nmbd.

Starting smbd.

Starting winbindd.

 

3.       Then run “wbinfo -u” and it should list all of the domain users.

4.      Also “wbinfo -g” will show you a list all of the domain groups.

Name Switch Service

 

1.       Now we tell pam to authenticate from the AD server first then failover to local accounts if the domain controller is over.

2.       Edit the “/etc/nsswitch” file.  Make it match the following example.  Notice we only make changes to the group and passwd entries.

 

group: winbind files

group_compat: nis

hosts: files dns

networks: files

passwd: winbind files

passwd_compat: nis

shells: files

services: compat

services_compat: nis

protocols: files

rpc: files

Automatic Creation of Home Directories

 

1.       To make automatic home directories we need to compile and install pam_mkhomedir port.

 

cd  /usr/ports/security/pam_mkhomedir

make install

mkdir /home/YOURDOMAIN.COM

Setup SSHD Authentication with PAM

 

1.       Now  we have to make SSHD authenticate with PAM and WinBind by editing “/etc/pam.d/sshd”.  This will also do the automatic home directory creation.

2.       Add  “auth            sufficient      /usr/local/lib/pam_winbind.so # Allows access to everyone in the domain”  to the 3rd line under  “# auth”

3.       Add  “session         required        /usr/local/lib/pam_mkhomedir.so”  to the 2nd line under “# session # Creates home directories for AD authenticated users.”

4.       You can also run “getent passwd” and “getent group” to get the list of users and groups that combine both the domain controllers user list with the local list and the same for groups.

 

Testing Domain Authentication

 

1.      Try logging into the account with an account on the domain controller and its password.  Once logged in make sure the account has a home directory by typing “pwd” to see your current path.

Setup AD Group Access Restrictions

 

1.       Now we need to restrict the FreeBSD box to particular users.  We do not want everyone to have access.  No now we will need to gather some needed information.

a.       Run “wbinfo -g” to view all of the groups that are in the domain controller or look in the Active Directory Users and Computers.

b.      Note the groups you want to have access to the box.  You are required to add “Domain Admins” as a group to all FreeBSD boxes.

c.       Next we need the SID of each of the groups.

                                                               i.      wbinfo -n “GROUPNAME” ,  will return the SID of the group.

 

fbtest2# wbinfo -n “domain admins”

S-1-5-21-1328793019-4053271937-1264903302-512 Domain Group (2)

 

                                                             ii.     The long number starting with S is the SID, i.e. S-1-5-21-1328793019-4053271937-1264903302-512

2.       Now we need to add the SID’s to /etc/pam.d/sshd to allow those users access and to remove access for everyone.

a.       Comment out  “auth            sufficient      /usr/local/lib/pam_winbind.so # Allows access to everyone in the domain”

b.      Add “auth            sufficient      /usr/local/lib/pam_winbind.so try_first_pass require_membership_of=<SID> # Group: <GROUP NAME>” below it.     

i.e. “auth            sufficient      /usr/local/lib/pam_winbind.so try_first_pass require_membership_of=S-1-5-21-1328793019-4053271937-1264903302-512 # Group: Domain Admins”

c.       Make sure you label the “GROUP NAME” so that we know which group the SID belongs to.

d.      Add the rest of the groups you want to have access to the box.

3.       Add a user to a group on the domain controller and test your loggin.

                                                                               

 

1 comment

Aug 21

Windows Vista - Setting MTU to work with aDSL

Category: General B.S., Windows

I recently purchased a Windows Vista laptop and it worked great, well as soon as I bumped it to 2 gigs of RAM.   I was able to use the laptop at home and at one of my offices, both were on comcast cable.  I then took the laptop to the warehouse which was on Windstream DSL and to my surprise it would hardly cerf the net because my dsl was so slow.  No mater what page I went to some of the page would show up but it would never load an entire page.  I knew right then that it was most likely an MTU problem.  So I did some research and found that Vista tries to make guesses on what it should set your MTU settings for each connection to.  I disabled this and set my MTU manually to 1430 and walla everything worked like a champ.  Here is what I did…

1. You must get into a command prompt as Administrator.  To do this…

  • Click Start and type cmd in the Search box. This should produce a list consisting of one entry: the shortcut to the Windows Command Processor, cmd.
  • Right-click the cmd shortcut and choose Pin to Start Menu.
  • Click Start again. Right-click the Command Prompt shortcut you just added to the Start menu and choose Properties.
  • Click the Advanced button and click to select the Run as administrator check box.
  • Click OK to save your changes.         

2. You must tell vista not to autotune itself and to abide by your MTU setting to do this at the cmd prompt type….

netsh int tcp set global autotuninglevel=disabled

3. And finally you must list set the MTU to each interface you want to change.  At the cmd prompt type….

netsh interface ipv4 set subinterface “Local Area Connection” mtu=1430 store=persistent

If you just want to see what your MTU settings are or find other interface names you can run….

netsh interface ipv4 show subinterfaces

Hope this Helps! 

Chris Edwards

No comments

Jul 23

Subnet Cheat Sheet

Category: Cisco

 

Class C

 
Mask  Notation   Subnets   Hosts 
255.255.255.0 /24 1 256
255.255.255.128 /25 2 128
255.255.255.192 /26 4 64
255.255.255.224 /27 8 32
255.255.255.240 /28 16 16
255.255.255.248 /29 32 8
255.255.255.252 /30 64 4
255.255.255.254 /31 128 2
255.255.255.255 /32 256 1
 

Class B

 
Mask  Notation   Subnets   Hosts 
255.255.0.0 /16 2 65,536
255.255.128.0 /17 2 32,768
255.255.192.0 /18 4 16,384
255.255.224.0 /19 8 8,192
255.255.240.0 /20 16 4,096
255.255.248.0 /21 32 2,048
255.255.252.0 /22 64 1,024
255.255.254.0 /23 128 512
255.255.255.0 /24 256 256
 

Class A

 
Mask  Notation   Subnets   Hosts 
255.0.0.0 /8 1 16,777,216
255.128.0.0 /9 2 8,388,608
255.192.0.0 /10 4 4,194,304
255.224.0.0 /11 8 2,097,152
255.240.0.0 /12 16 1,048,576
255.248.0.0 /13 32 524,288
255.252.0.0 /14 64 262,144
255.254.0.0 /15 128 131,072
255.255.0.0 /16 256 65,536

No comments

Jun 25

Cisco Debugging

Category: Cisco

The “terminal monitor” command directs your cisco to send debugging output to the current session. It’s necessary to turn this on each time you telnet to your router to view debugging information. After that, you must specify the specific types of debugging you wish to turn on; please note that these stay on or off until changed, or until the router reboots, so remember to turn them off when you’re done.

Debugging messages are also logged to a host if you have trap logging enabled on your cisco. You can check this like so:

        sl-panix-1>sh logging
        Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)
            Console logging: level debugging, 66 messages logged
            Monitor logging: level debugging, 0 messages logged
            Trap logging: level debugging, 69 message lines logged
                Logging to 198.7.0.2, 69 message lines logged
        sl-panix-1>

If you have syslog going to a host somewhere and you then set about a nice long debug session from a term your box is doing double work and sending every debug message to your syslog server. Additionally, if you turn on something that provides copious debugging output, be careful that you don’t overflow your disk (“debug ip-rip” is notorious for this).

One solution to this is to only log severity “info” and higher:

        sl-panix-1#conf t
        Enter configuration commands, one per line.  End with CNTL/Z.
        logging trap info

The other solution is to just be careful and remember to turn off debugging. This is easy enough with:

        sl-panix-1#undebug all

If you have a heavily loaded box, you should be aware that debugging can load your router.  The console has a higher priority than a vty so don’t debug from the console; instead, disable console logging:

        cix-west.cix.net#conf t
        Enter configuration commands, one per line.  End with CNTL/Z.
        no logging console

Then always debug from a vty.  If the box is busy and you are a little too vigorous with debugging and the box is starting to sink, quickly run, don’t walk to your console and kill the session on the vty.  If you are on the console your debugging has top prioority and then the only way out is the power switch.  This of course makes remote debugging a real sweaty palms adventure especially on a crowded box. Caveat debugger!

Also, if you for some reason forget what the available debug commands are and don’t have a manual handy, remember that’s what on-line help is for. Under pre 9.21 versions, “debug ?” lists all commands. Under 9.21 and above, that gives you general categories, and you can check for more specific options by specifying the category: “debug ip ?”.

As a warning, the “logging buffered” feature causes all debug streams to be redirected to an in-memory buffer, so be careful using that.

Lastly, if you’re not sure what debugging criteria you need, you can try “debug all”. BE CAREFUL!  It is way useful, but only in a very controlled environment, where you can turn off absolutely everything you’re not interested in.  Saves a lot of thinking.  Turning it on on a busy box can quickly cause meltdown.

This information is reposted from http://www.faqs.org/faqs/cisco-networking-faq/section-9.html

No comments

Jan 19

Crystal Reports - Converting UNIX Time Stamp

Category: General B.S., Linux

I had a heck of a time finding out how to convert a UNIX time stamp in Crystal Reports.  My company has a ecommerce package that stores all sales date in a UNIX time stamp format.  Which means it stores the time and date by storing the number of seconds since 1/1/1970.   So here is the formula I came up with…

dateadd (”s”,{order.date}-18000, #1/1/1970#)

dateadd function does the trick,  the “s” is for seconds, order.date is the table that contains the unix time stamp, -18000 is -5 hours from UTC in seconds because im in the Eastern Time Zone and 1/1/1970 is the base date for dateadd to add the other argument to.

Hope This Helps!

Chris Edwards

5 comments

Jan 10

How To Export and Import Your PuTTY Sessions

Category: Linux

If you want to copy Putty configuration from a Windows computer to another same version Windows computer, here is what to do:

    1. On a model computer, configure Putty to your desire, save and test it to make sure it works the way you want it to.
    2. Start/Run/regedit to run regedit tool
    3. Browse to HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\SshHostKeys
    4. Delete all values under this key EXCEPT the (Default) value
    5. Right click on HKEY_CURRENT_USER\Software\SimonTatham and select Export, then save it as “setup-putty.reg” to a location that you want
    6. Copy setup-putty.reg and the Putty.exe files to a machine that you want to copy Putty configuration to
    7. On this new computer, double click on setup-putty.reg to import Putty configuration
    8. Upon successful configuration import, run Putty.exe. You should see all Putty configuration there. You can safely delete setup-putty.reg since you only need to run it ONCE on each new computer that you want to use Putty with tthe same configuration.
2 comments

Jan 9

Fedora / Linux editing fstab in maintenance mode

Category: Linux

Today was a fun day.  I rebooted one of my IBM Blade servers only to find out that it would only come back online in maintenance mode.  I had added a fstab entry for a USB drive that I was adding to the machine.  I hadn’t taken the time yet to plug the drive in.  So when I rebooted the machine walla… maintenance mode… The server thought the drive was corrupt or bad.  Then I realized the machine booted into READ ONLY while in maintenance mode.  So I hunted the solution and thought I would share it.  The trick is to remount the drive as READ WRITEABLE.   Its an easy solution but may throw you for a loop in a tight spot.  Here ya go….

# mount -n -o remount,rw /

No comments

Oct 27

Spamassassin + Linux + Exchange + Imap

Category: Linux

I have been looking for two days for the following information on how to easily allow my users that use exchange to report their spam to spam assassin. I found the following message from Mike French…

Many thanks to all that replied to my request for information on
implementing IMAP learning through exchange!

Many thanks to all that replied to my request for information on
implementing IMAP learning through exchange!

Special Thanks to Richard Ozer for providing the below which worked much easier then I thought it would! The client doesn’t have to support imap.? What you do is put imap support on your spamassassin server, read the stuff in exchange’s SPAM folder using
imap, and push it to sa-learn.

Here’s something I wrote up a while ago.

***************************************
How to support ad-hoc Bayesian learning with Microsoft Exchange Server and
Outlook

Problem:

Many organizations use Microsoft Exchange, MS Outlook, and Outlook Express with IMAP for their corporate e-mail. Typically, SpamAssassin is running on a Linux box that tags the mail and forwards it to the Exchange server for delivery. One of the challenges in implementing SpamAssassin in this environment has been to provide a seamless mechanism for end users to train the bayesian filter. The reason this is difficult is that neither Outlook nor Outlook Express preserve the original message headers when mail is
forwarded from one mailbox to another. This makes it tedious to send the necessary information to a spam or ham mailbox. Although mainly a training problem, most users are unwilling to take the additional time to manually copy the original headers into a new message, along with the original message body. It’s simply too unwieldy to do so. This often leaves the task of Bayesian training to the mail admin, who receives forwarded spam message from the end users (usually without the pre-requisite headers) and is expected to add the offending email to a blacklist, or to create a new rule.

Solution:
The only time headers are properly preserved in Microsoft Outlook or Outlook Express, is during a drag and drop operation. This suggests a solution that takes advantage of Microsoft Exchange’s public folder capabilities. A “Spam” public folder and “Ham” public folder can be created on the exchange server, allowing users to drag spam or ham into these folders where they will await retrieval by the SpamAssassin host.

A key piece of this puzzle can be found on Nick Burch’s web site at:

http://gagravarr.org/code/

There you will find a perl script called imap-sa-learn.pl. This script will logon to any server supporting IMAP, retrieve any messages located in any arbitrarily named folder, process the contents of that folder as either ham or spam, delete the processed messages, and then run an sa-learn –rebuild. The script is simple to understand, and you need only predicate your public folder name with the “Public Folders” directive. For instance, if you create a public folder called “Spam”, you would set the script variable containing the Spam folder’s path to:
my $defspamfolder = ‘Public Folders/Spam’;

Likewise, you would do something similar for the Ham folder.

On the exchange side, create a domain user called spamassassin with minimal rights and create an exchange mailbox for it… it should never receive any mail. The account is there simply to give the account access to the public folders.

Using Outlook, and while logged in as an administrator, create the Spam and Ham public folders. Right click on each folder, go to the folder properties/permissions tab and make the spamassassin user a folder “Owner”. This will give the spamassassin account the necessary privleges to delete processed messages. The default permissions should allow anyone to post to the folder, and delete only their items.

In Nick’s script, set the login and password to the spamassain user’s account ID and password, and test. By using a non-admin account for the spamassassin, you avoid the risk of having a plain-text administrator name and password sitting inside a perl script.

This mechanism works for both Exchange 5.5 SP4, or Exchange 2000+.

Richard Ozer
Mike French
MIS OnlineServices
www.misonlineservices.com

P.S. Thank Mike for the instructions, now im up and running myself.

No comments

Aug 24

vbSEO - Update

Category: Web Design & SEO

I love VBSEO!  Although I still haven’t seen a great increase in overall traffic I still love vbSEO, here is why…

 The search engines have now index all of my pages and when you do a search for a particular subject on a search engine my actual vbulletin pages show up instead of my archive pages.  Which means, that users get a nice and pretty vbulletin page with all of my adsense ads, moe money, moe money!

No comments

Jul 24

vbSEO - Week 2

Category: Web Design & SEO

I have had vbSEO installed for over a week now and no real sign of increased traffic.  Whats neat is that we are getting new keywords showing up, like we were ranked #1 on Yahoo and MSN for the term “peppermint shrimp” for about a week.

I’ll keep updating.

No comments

Next Page »