Daniel Gemesi zeromindhu

Walk-through to setup Enterprise Wifi with Unifi on Windows Server

Update 14/02/2024 : Added step 3-d - allowing the cert template to be issued by a CA

Why

Quite simply, you will have the ability to log on to your Company Wifi network using your Windows Domain Username and Password. No more remembering someone else's idea of a secure password. A Single Sign-on for all resources.

Re-mastering GRML 2018.12 Small

Nilson Lopes | Thursday, March 12, 2020

It is recommended that you use grml-live to build your own disc.

Loop mount the ISO image:

├── iso      	<-- mount the original iso here

1. Install tools and config IPXE

# Install compiler and dependencies
sudo apt-get install -y git gcc make liblzma-dev

# Grab the source code
git clone https://github.com/ipxe/ipxe.git
cd ipxe/src

# Enable NFS support

##Installing a custom SSL cert on Unifi Controller

Requirements:

Domain certificate (*.crt)
Certificate key (*.key)
Intermediate certificate from CA (*.crt, *.pem)
Permissions to restart the unifi service
Debian or Ubuntu Unifi Controller installation

Instructions how to install Debian using debootstrap. Below instructions were verified to work with debootstrapping Debian 11.

Customize Grml LiveCD (remaster)

This little bash script helps you to build your own customized grml.iso

Features

Include your .ssh/*.pub files into authorized_keys
Inject Grml Cheats
Auto download all necessary files (the ISO and grml2usb)

	iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
	iptables -t nat -A POSTROUTING -s 10.0.2.0/24 -o eth0 -j MASQUERADE
	# allow established sessions to receive traffic
	iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
	# allow your application port
	iptables -I INPUT -p tcp --dport 443 -j ACCEPT
	iptables -I INPUT -p udp --dport 443 -j ACCEPT
	# allow SSH
	iptables -I INPUT -p tcp --dport 22 -j ACCEPT
	# Allow Ping

	### 1: Drop invalid packets ###
	/sbin/iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP

	### 2: Drop TCP packets that are new and are not SYN ###
	/sbin/iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP

	### 3: Drop SYN packets with suspicious MSS value ###
	/sbin/iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP

	### 4: Block packets with bogus TCP flags ###

	!Current Configuration:
	!
	!System Description "EdgeSwitch 24-Port Lite, 1.3.0.4831995, Linux 3.6.5-f4a26ed5"
	!System Software Version "1.3.0.4831995"
	!System Up Time "0 days 9 hrs 54 mins 37 secs"
	!Additional Packages QOS,IPv6 Management,Routing
	!Current SNTP Synchronized Time: SNTP Last Attempt Status Is Not Successful
	!
	network protocol none
	network parms 172.16.4.25 255.255.254.0 172.16.4.1

	#!/bin/sh
	/usr/bin/ldapsearch -o ldif-wrap=no "$@" \| perl -MMIME::Base64 -Mutf8 -pe 's/^([-a-zA-Z0-9;]+):(:\s+)(\S+)$/$1.$2.&decode_base64($3)/e'