mellow-yellow's questions

In Linux (Ubuntu 18.04 and RHEL) my /etc/resolv.conf says:

nameserver 192.168.0.1
search baz.com

And I get this:

getent hosts www
192.168.0.2 www.baz.com

But I'd like to do this:

getent hosts foo

And get this result:

192.168.0.3 foo-bar.baz.com

Where -bar was appended to foo prior to resolving .baz.com.

This approach fails however:

/etc/resolv.conf
search: -bar.baz.com

getent hosts foo
echo $? # returns 2

Is this possible? It seems that search only appends domain names, not partial matches. Is there a better approach?

In Linux (e.g., Ubuntu 18.04), how can I configure sshd to allow logins using public keys for OS users that do not yet exist?

For example:

1. On server: /etc/ssh/sshd_config has AuthorizedKeysFile: /etc/ssh/keys/%u

2. sudo mkdir -p /etc/ssh/keys

3. sudo tee /etc/ssh/keys/foo <<< "$(cat id_rsa.pub)"

4. sudo systemctl restart sshd

5. On client: ssh foo@server

In this scenario, the server does NOT have a foo account in /etc/passwd, but I'd like to create one automatically and then use pam_mkhomedir to create its home directory -- all because the user can successfully authenticate using a public key.

My attempt:

1. /etc/pam.d/sshd comment out @include common-auth (makes no difference since public keys reportedly bypass this anyway)

2. /etc/pam.d/sshd comment out @include common-account (no difference)

3. /etc/pam.d/sshd add, under #2, account required pam_permit.so (no difference)

4. /etc/ssh/sshd_config LogLevel: DEBUG3 shows

debug1: userauth-request for user foo 
Invalid user foo from 192.168.0.8 port 62083
debug1: PAM: initializing for "foo"
debug1: userauth_pubkey: test whether pkalg/pkblob are acceptable for RSA SHA256:kdI+ALYK88R6zAcoPAIyXctjCLgEkGodgieusIOay0c [preauth]
debug2: userauth_pubkey: disabled because of invalid user [preauth]

In Active Directory, what connects the KDC's principals to their corresponding LDAP entries? For example, my KC principal might be

Name[/Instance]@REALM
john/[email protected]

and my LDAP entry might be:

dn: cn=john,dc=company,dc=com
objectclass: somewhere

but how does Active Directory "connect" the two? SRV records? For example, when I log in (i.e., use Kerberos), how does AD match my Kerberos principal to my LDAP entry?

UPDATE: This MSDN article comes close to answering the question, but doesn't clearly explain the flow: "The Key Distribution Center (KDC) is implemented as a domain service. It uses the Active Directory as its account database and the Global Catalog for directing referrals to KDCs in other domains.. The KDC for a domain is located on a domain controller, as is the Active Directory for the domain. Both services [ sic? probably meant the 3 services of Kerberos: AS, TGS, and password reset ] are started automatically by the domain controller's Local Security Authority (LSA) and run as part of the LSA's process."

I'm new to OpenLDAP (but not Microsoft Active Directory) and reading zytrax's openldap guide. I'm using OpenLDAP 2.4.44 on CentOS 7.4, as shown here:

@(#) $OpenLDAP: slapd 2.4.44 (Aug  4 2017 14:23:27) $
    [email protected]:/builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd

I want to add cosine (and later inetorgperson) schemas, but this fails:

ldapadd -f /etc/openldap/schema/cosine.ldif
ldap_sasl_interactive_bind_s: No such attribute (16)

Whereas this works:

ldapadd -H ldapi:/// -Y EXTERNAL -f /etc/openldap/schema/cosine.ldif

Can anybody explain why? Apparently, ldapi:// -Y EXTERNAL seems to indicate SASL, but I haven't found zytrax's explanation of why/when to use ldapi:// instead of ldapadd commands in OLC.

I need to create an IHS reverse proxy that takes https://server1:6883 and proxies it to https://server2:6883, but unlike other ServerFault questions, the initial connection needs to be https not http. I have the following...

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
Listen 6883
<VirtualHost *:6883>
SSLEnable

SSLProxyEngine On
KeyFile /opt/IBM/HTTPServer/cert/wlpkey.kdb
ProxyPass / https://server2:6883/
</VirtualHost>

but error_log says: SSL0227E: SSL Handshake Failed, Specified label could not be found in the key file. Label='(null)'

I suspect the problem is that I need two KeyFiles: one for proxy recipient and one to enable SSL/TLS.

Question: does AD send a user's access token across the network?

Research: The following two passages contradict themselves--given that TGTs are transmitted across the network by design.

From the 5th Edition of Active Directory by Oreilly:

Most importantly, the user's access token is stored in the TGT. The access token includes important information such as what groups a user is a member of, the user's NT rights, and Dynamic Access Control (DAC) claims.

From Windows Server 2008 Active Directory Resource Kit by Microsoft Press:

The access token is used by the security subsystem whenever a user tries to access a resource. When the user tries to access a local resource, the token is presented by the client workstation to any thread or application that requests security information before allowing access to a resource. The access token is never transmitted across the network to another computer; rather, a local access token is created on each server where the user tries to access a resource. For example, when a user tries to access a mailbox on a server running Exchange Server 2007, an access token is created on the server.

If my web server (latest Apache) has a valid (not expired or revoked) Verisign certificate chain (root -> intermediate -> leaf/my server), then does the server send the entire(?) chain to the client? Does the web client (e.g., latest Chrome) need to look up each of those same certificates online, especially if the client already trusts the root CA?

What happens if the client can't contact Verisign? (e.g., LAMP setup on a laptop without WiFi).

Background: Apache 2.4 (server) and Windows 7 Internet Explorer (client) using PKI; both machines are on a "dark network" (no internet access).

Question: In the SSL handshake, how does the client receive the intermediate CA? Can't it use the Apache-provided one?

My attempt:

Apache serves (1) server's certificate, (2) intermediate CA, (3) root CA to the client

Client attempts to verify the chain via internet, fails, checks locally

Troubleshooting: I have run a Fiddler and netsh trace, and the client tries--though obviously fails--to contact the intermediate CA authority. Ultimately, the SSL connection succeeds. I'm trying to understand how the client verifies the intermediate CA without internet access and without a locally saved certificate.

I'm importing a VMWare OVA whose second disk uses LUKS and configured to use 1TB of space, although its VMDK is only 30GB. I want to shrink this down. I am following the instructions here (https://wiki.archlinux.org/index.php/Resizing_LVM-on-LUKS), but after I'm done, RHEL (the guest VM) sees the 1024GB partition, instead of the smaller version, and can't open it.

Sorry for the multiple screenshots, but this multistep process seems to deserve it.