Central identity: LDAP, SSSD and Kerberos
Instead of creating users on every server, you manage them from a central directory: OpenLDAP, the SSSD client, single sign-on with Kerberos and access rules.
Level 401 · 17 lessons · 15 practice labs
Lessons
The directory
- What a directory service is: tree, entries and attributes
- Working with ldapsearch and LDIF
- User and group schema: posixAccount and posixGroup
- Bind types and TLS
- Short task: add a new team and its users to the directory
SSSD
- SSSD architecture and cache
- Connecting a server to LDAP with SSSD
- Access filters: who can log into which server
- sudo rules and SSH keys from the directory
- SSSD troubleshooting: debug levels and clearing the cache
- Short task: move three servers to central login
Kerberos
- How Kerberos works: tickets, KDC and realm
- kinit, klist and keytab files
- Single sign-on for SSH with Kerberos
- Short task: set up hopping between servers without password prompts
Wrap-up
- Offboarding with central identity: switching off in one place
- Capstone: move a ten-server environment onto central identity
Practice labs
- Find a user's groups in the directory: Use ldapsearch to find the posixGroup entries the given user belongs to and submit them.
- Add a new team and its users to the directory: Add a group and three users for a new team to the directory with an LDIF file and confirm there is no UID clash.
- Move a client binding in clear text to TLS: Configure a client that binds with a password in clear text to use StartTLS and show certificate checking works.
- Fix a faulty LDIF file: Fix the missing object class and wrong DN errors in an LDIF that fails to load, then load the entries.
- Serve sudo rules and SSH keys from the directory: Add a sudo rule and a user's SSH public key to the directory and verify the client gets both through SSSD.
- Fail a client over to a replica directory server: Define a second directory server on an SSSD client, stop the first one and prove from the logs that logins keep working.
- Connect a server to the directory with SSSD: Connect the client server to LDAP with SSSD and verify SSH login with a directory user.
- Let only one group log into a server: Use an SSSD access filter so only the database team can log into the database server.
- Fix a group hidden by a stale cache: Find in SSSD debug logs why a group membership added in the directory is missing on the client, and clear the cache.
- Get and inspect a Kerberos ticket: Get a user ticket with kinit, inspect its lifetime and service tickets with klist and submit when it expires.
- Set up hopping between servers without passwords: Set up SSH single sign-on with GSSAPI on two client servers and verify password-free hops with a ticket.
- Repair a keytab with a mismatched key version: Find that service logins suddenly fail because of a key version mismatch in the keytab and generate a new keytab.
- Switch off a leaver's access in one place: Disable the leaver's directory account, remove their group memberships and confirm login is closed on every client.
- Find a local account shadowing a central one: Find a same-named local account that overrides a directory user on one client, remove it and confirm central login works.
- Move three servers to central identity: Move three servers with local accounts to SSSD, fix file ownership to match directory UIDs and verify logins.
About this course
Instead of creating users on every server, you manage them from a central directory: OpenLDAP, the SSSD client, single sign-on with Kerberos and access rules.
What you will learn
- The directory
- SSSD
- Kerberos
- Wrap-up
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.