- Goal: Create a minimal working setup where a Linux machine retrieves users from Active Directory via LDAP.
- Requirements: Vagrant, VirtualBox.
Put all of the attached files somewhere and switch to that directory.
Generate an SSH key:
ssh-keygen -t rsa -b 4096 -o -a 100 -C "myuser_ldap" -f './id_rsa'
Start vagrant:
vagrant up
Wait until it completes. Note that AD is not getting installed during the Vagrant provisioning (I didn't manage to get it to work).
Create an AD forest:
vagrant winrm dc -c "C:\vagrant\provision_ad_1.ps1"
You might get a WinRMAuthorizationError -- that's ok, just let the machine reboot.
After it is booted, create an AD user and groups:
vagrant winrm dc -c "C:\vagrant\provision_ad_2.ps1"
Ensure that LDAP works on the Linux machine:
$ vagrant ssh ldap -- getent passwd | grep my
myuser:*:20001:20000:myuser:/home/myuser:/bin/bash
So far that myuser cannot login. Linux doesn't understand the AD users' passwords, and we didn't fill the Unix shadow entry for it. We will use ssh keys for authentication instead of the passwords. For that we need to create a custom attribute in AD.
Open RDP:
$ vagrant rdp dc
The vagrant Windows image contains a vagrant user which doesn't have necessary permissions to change the AD schema.
Fix that:
- Press Win
- Search for
Active Directory Users and Computers - Users
vagrant- Properties
- Member of
- Add
Sign out from the account and login back again.
Open cmd as admin, type the following to gain the ability to use the AD schema management snap-in:
regsvr32.exe schmmgmt.dll
Then enter mmc -> Add snap-in -> AD schema.
Select Attributes -> Create Attribute ->
- Common Name: sshPublicKey
- OID: see https://docs.microsoft.com/en-us/windows/desktop/AD/obtaining-an-object-identifier-from-microsoft , the value I used was 1.2.840.113556.1.8000.2554.21570.45726.62644.19815.40515.182734.3613927.1.1
- Syntax: Unicode String
- Multi-Valued (tick)
Select Classes -> posixAccount -> Properties -> Attributes -> Add -> sshPublicKey
Open PowerShell, type this:
Set-ADUser -Identity myuser `
-Add @{sshPublicKey=${C:\vagrant\id_rsa.pub}}
Ensure a local user works:
$ ssh [email protected] -p 2200
...
vagrant@ldap:~$ sudo -i
root@ldap:~#
Now check the LDAP user:
$ ssh -i ./id_rsa [email protected] -p 2200
...
myuser@ldap:~$ sudo -i
root@ldap:~#
Simulate a network partition:
iptables -I INPUT -i eth1 -j DROP
iptables -I OUTPUT -o eth1 -j DROP
Try to connect with an LDAP account:
$ ssh -i ./id_rsa [email protected] -p 2200
[email protected]: Permission denied (publickey).
Now try a local user:
$ ssh [email protected] -p 2200
...
vagrant@ldap:~$
Restore the connectivity:
iptables -D INPUT -i eth1 -j DROP
iptables -D OUTPUT -o eth1 -j DROP
Ensure it works again:
$ ssh -i ./id_rsa [email protected] -p 2200
...
myuser@ldap:~$
Block the account in AD:
Disable-ADAccount -Identity myuser
Ensure that it doesn't work anymore:
$ ssh -i ./id_rsa [email protected] -p 2200
[email protected]: Permission denied (publickey).
Looks like the lab goal is achieved 🎉.