Centrify for UNIX/Linux/Mac Command Line Cheat Sheet

AD-bridging commands ("ad" commands)
adcheck - check OS, network and AD readiness for Centrify DirectControl

To check the system with domain (e.g. corp.contoso.com)
$ adcheck corp.contoso.com
To only perform OS checks
$ adcheck --test os
To only perform network-related tests
$ adcheck --test net corp.contoso.com
To only perform AD-related tests
$ adcheck --test ad corp.contoso.com
To check the system with a service domain controller (e.g. dc1)
$ adcheck --servername dc1 corp.contoso.com
To check connectivity only with DCs within the site
$ adcheck --siteonly corp.contoso.com
To check only on 3 (or n) DCs in a large domain
$ adcheck --bigdommain 3 corp.contoso.com
To check trust relationships (e.g. with hq.fabrikam.com)
$ adcheck --xdomain corp.contoso.com
To skip NTP checking (if you are not doing sync with AD DCs)
$ adcheck --skip-ntp corp.contoso.com


adinfo:  provides information about the status of the agent

Looking-up Basic Information
To check the general status of the client
$ adinfo
To see the current domain controller the client is using
$ adinfo --server
To see the current domain the agent is joined to
$ adinfo --domain
To see the status (mode) of the agent (connected to ad or in offline mode)
$ adinfo --mode
To see the version of the installed client
$ adinfo --version
To see the corresponding Centrify Suite Version
$ adinfo --suite-version
To view Active Directory connectivity to the current domain
$ adinfo --test
To view the current Active Directory site
$ adinfo --site
To see the current joined Centrify zone
$ adinfo --zone
$ adinfo --zonedn  (in distinguishedName format)

Advanced/Troubleshooting Information
DNS
To check for the "joined-as" name (local host name and joined as name may be different)
$ adinfo --name
To check the status of the DNS cache and stats
$ adinfo --diag dns

Connectivity
To check connectivity with an AD domain
$ adinfo --test [domain.name]
To check network connectivity statistics
$ adinfo --sysinfo neststate
To test connectivity against a specific domain controller
$ adinfo --T --servername [domain.controller.name]

Active Directory
To see the current AD Global Catalog
$ adinfo --gc
To see the domain/forest map
$ adinfo --sysinfo domain
To see the status of the AD computer trust relationship
$ adinfo --sysinfo adagent

Testing a user's password
$ adinfo -A --user [username] 
# this will prompt you for a password, the output is:
Password for user "username" is correct/incorrect

Configuration
To parse the contents of the centrify.conf file
$ adinfo --config
To show the client's in memory configuration parameters
$ adinfo --sysinfo config

Kerberos
To view Kerberos information like supported encryption types, key version and registered SPNs
$ adinfo --computer
To view the updated Kerberos configuration in the local system
$ cat /etc/krb5.conf
To list the principals in the system's krb5.conf file
$ dzdo /usr/share/centrifydc/kerberos/bin/klist -kt /etc/krb5.keytab
To determine the encryption types of the system's cached ticket
$ dzdo /usr/share/centrifydc/kerberos/bin/klist -fe /etc/krb5.ccache

PKI
adcert - centrify Microsoft PKI client

To perform auto-enrollment of Computer PKI certificates (requires elegible template and communications)
Using the computer object to authenticate
$ dzdo /usr/share/centrifydc/sbin/adcert --enroll --machine
Using a user to authenticate
$ dzo /usr/share/centrifydc/sbin/adcert --enroll --user [ADusername]


Dynamic DNS
addns - a dynamic DNS client for AD DNS or RFC 2136-compliant servers

To renew DNS using machine credentials
$ sudo addns --update --machine
To renew DNS using user credentials
$ sudo addns --update --user [ADusername]
To renew DNS only on a specific interface (e.g. eth0)
$ sudo addns --update --machine --interface eth0

Querying Centrify-enabled AD Users and Groups
adquery: provides information about Active Directory users and groups that are UNIX-enabled by Centrify

To view all Centrify UNIX-enabled users
$ adquery user
will show all AD users in Express mode / Only authorized in Zone mode
To view all Centrify UNIX-enabled groups
$ adquery groupwill show all AD groups in Express mode / Only unix-enabled in Zone mode
To view a user's entry (UNIX passwd file style)
$ adquery user [username]
To view a group entry (UNIX group filestyle)
$ adquery group [groupname]
To view only the user or group's AD group memberships
$ adquery user [user] --adgroup
To view all information about a user or group  (including AD object attributes)
$ adquery user|group [user or group] -A
To view the distinguishedName a user or group
$ adquery user|group [user or group] --dn
To view all information and include password expiration, account lockout/enabled state
$ sudo adquery user [user] -A
To view information about a computer
$ adquery user [computername]$ -A
To get results from cache (instead of fetching from AD)
$ adquery user|group [options] --cache-first

Centrify Cache Commands
adflush - clears the Centrify cache in the local computer (dc, gc, credential & dns)

To flush the authorization cache
$ dzdo adflush --auth
To rebind and force a new DC selection
$ dzdo adflush --bindings
To flush the DNS cache
$ dzdo adflush --dns
To expire the information from domain controllers and global catalogs
$ dzdo adflush --expire
To force complete removal/expiration even when disconnected (use carefully)
$ dzdo adflush --force
To refresh the krb5.conf file
$ dzdo adflush --trusts
To clear the health history
$ dzdo adflush --health
To clear the cloud connectors (in MFA scenarios)
$ dzdo adflush --connectors


Group Policy-related Commands
adgpupdate - triggers the group policy refresh interval

To refresh the GPOs in the system
$ adgpupdate
To refresh only computer GPOs
$ adgpupdate --target Computer
To refresh only user GPOs
$ adgpupdate --target User

adgpresult - to view a RSOP (resultant set of policy) to the local system or user

To view the report for computer and user
$ adgpresult
To view the report for the computer
$ adgpresult --computer
To view the report for the current
$ adgpresult --user
To view the report for a particular user
$ dzdo adgpresult --user [user.name]

Joining Active Directory
adjoin - joins an Active Directory domain

To run adjoin successfully, you need
> to be root or sudo
> to have the credentials (or the keytab) of an AD user that can join computers to a container (NOT Domain Admin)
> to know the Distinguished Name (e.g. "ou=servers,ou=unix") of the container that you will place the system in AD
> to know the domain name you're joining
> to have a clear network path to the DC or DCs you're using (dns, global catalog, kerberos, ldap, cifs, ntp).

To join AD in workstation/express mode (AD user must be able to add computers to "ou=workstations,ou=unix")
$ sudo adjoin --workstation --container "ou=workstations,ou=unix" --user [AuthorizedADUser] --verbose [domain.name]
To join AD in Self-Service mode (AD/Centrify admin pre-created the machine ahead of time using AM or Centrify PS)
$ sudo adjoin --selfserve [domain.name]
To join AD in zone mode (e.g. Global zone)
$ sudo adjoin --zone Global --container "ou=servers,ou=unix" --user [AuthorizedADUser] --verbose [domain.name]
To join AD in zone mode and don't initialize (precache)
$ sudo adjoin --noinit --zone Global --container "ou=servers,ou=unix" --user [AuthorizedADUser] --verbose [domain.name]
To join AD and trust the Computer for Delegation (must know what you're doing - security implications)
$ sudo adjoin --trust Global --container "ou=servers,ou=unix" --user [AuthorizedADUser] --verbose [domain.name]
To join AD in workstation mode and specify a workstation license
$ sudo adjoin --licensetype "workstation"--workstation --container "ou=workstations,ou=unix" --user [AuthorizedADUser] --verbose [domain.name]
To use an specific domain controller to join (e.g. dc1.hq.fabrikam.com)
$ sudo adjoin --server dc1.hq.fabrikam.com Global --container "ou=servers,ou=unix" --user [AuthorizedADUser] --verbose [domain.name]
To join a Mac in Workstation mode and instruct Centrify to use the Apple algorighm to generate UID/GID scheme
$ sudo adjoin --enableAppleIDGenScheme --container "ou=macs,ou=unix" --user [AuthorizedADUser] --verbose [domain.name]
To join AD and provide a different "AD name" than the local system name (e.g. adserver vs. localhost)
$ sudo adjoin --name adserver --container "ou=servers,ou=unix" --user [AuthorizedADUser] --verbose [domain.name]
To join AD using keytab (kinit Authorized AD user keytab first, then run adjoin without the --user option)
$ env KRB5_CONFIG=[/path/to/krb5.conf] /usr/share/centrifydc/kerberos/bin/kinit -kt /path/to/keytab [principal]
$ sudo adjoin --zone Global --container "ou=servers,ou=unix" --verbose [domain.name]

Leaving Active Directory
adleave - leaves an Active Directory domain

To run adleave succesfully, you neeed:
> sudo or root
> for online leave, authorized AD user credentials

Leave the domain and disable the computer object (orphan object left behind)
$ dzdo adleave --user [Authorized ADUsername]
Leave the domain and remove computer object (frees license)
$ dzdo adleave --user [Authorized ADUsername] --remove
Offline/forced leave (no AD connectivity required, must clean-up in AD)
$ dzdo adleave --force

Privilege Elevation ("dz" commands)
dzinfo - displays information of the user's access controls

To view self access (all)
$ dzinfo
To view the properties of the role(s), including effectiveness
$ dzinfo --roles
To view how you can access the system (PAM rights)
$ dzinfo --pam
To view the commands you can run
$ dzinfo --commands
To view the computer roles that apply to the system (requires elevation)
$ dzinfo --computer-role
To view authorization information about about another user (requires elevation)
$ dzdo dzinfo [user.name]
To test a command against the role
$ dzinfo --test [path/to/binary] [options]

Centrify-enhanced sudo
dzdo - centrify-enhanced sudo. Uses Centrify zone data in AD for commands, otherwise identical to sudo.

To view version information (as of 2015, based on sudo 1.8.10p3)
$ dzdo -V
Use man sudo or man dzdo for more.

DirectAudit Commands ("da" commands)
dainfo - shows information about the status of the audit agent

To view the audit agent status
$ dainfo
To view status with verbose output
$ dainfo --diag  (or dadiag)
To view contents of the configuration file
$ dainfo --config
To view audited status of another user (must elevate)
$ dzdo dainfo --username lisa.simpson

dacontrol - controls the status/configuration of the directaudit client (requires elevation)

To set the installation (if not set by Group Policy)
$ dzdo dacontrol --installation [installation-name]
To check if the audit agent is enabled
$ dzdo dacontrol --query
To enable direct audit
$ dzdo dacontrol --enable
To disable direct audit
$ dzdo dacontrol --disable

What happens when adjoin is run succesfully?
This activates the DirectControl agent (adclient/CentrifyDC service).
1. Creates a computer object in AD and sets SPNs for http, host, nfs, cifs, afpserver
2. Establishes a secure communication channel between the system and Active Directory
3. A forest/domain/site map is created to locate the nearest DCs
4. The Kerberos environment (krb5.conf, krb5.keytab) are maintained by Centrify (configurable).  A backup is created.
5. Network time is synchronized with AD DCs (configurable)
6. The PAM (Pluggable Authentication Modules) are modified to include Centrify auth, account, password, session modules. A back-up of the previous configuration is made.
7. The NSS (Name Service Switch) providers for users and groups defaults to AD first, then other methods (e.g. files, ldap, etc).  A backup of the previous configuration is made.
Note: in the OS X platform, the PAM/NSS functions are channeled via the Directory Services Plugin API.
8. An Access Control Model is enforced depending on the zone mode:
- In zone mode:  Authorization (RBAC) follows zone rules (defaults to closed, only authorized users can access and enabled groups are visible)
- In express/workstation mode:  Only Authentication is facilitated.  The system is open for all AD users and all groups are visible.
9. Privilege Elevation:  Centrify-enhanced sudo (dzdo) becomes active based on the roles/rights defined.
10. User/Group identity (RFC2307) data in AD is stored within the Centrify zone, NOT with the user/group object.
11. The virtual registry is initialized and group policies are enforced.

What happens when adleave is run succesfully?
1. Online the --remove object:  The object in AD is removed from the container and from the zone (frees license)
2. Online the without --remove object:  The object in AD is marked as disabled.  Must be ovewritten to rejoin.
2. Offline:  The object in AD is left orphaned.  Cleanup must happen via any Centrify API (AM, PowerShell, adedit)
3. The UNIX environment is reset and rolled back (Kerberos, PAM, NSS)
4. The Centrify adclient (CentrifyDC) service is disabled.

Important Files and Folders
/usr/share/centrifydc/ 
/bin > contains user binaries, including centrify-enhanced openldap tools like ldapsearch
/sbin > contains system binaries, including adcert and centrify-enhanced OpenSSH
/samples > sample files for hadoop, adedit and local account management
Note: on OS X El Capitan, things changed to /usr/local/share/centrifydc


/etc/centrifydc
/centrifydc > config files for the DirectControl agent
/centrifyda > config files for the DirectAudit agent
/centrifycc > config files for the Privilege Service CLI Toolkit for AAPM
/openldap > config files for Centrify-enhanced OpenLDAP proxy if installed
/ssh > config files for Centrify-enhanced OpenSSH

/var/centrifydc
kset* files > dynamic information about the environment
reg > virtual registry, contains the computer and user hives  (user GPO disabled on Servers)

/var/centrify
net/certs > location of any Microsoft Certificate Authorithy auto-enrolled certs, keys and trust chain

Security Corner: What is a Kerberos Keytab and why should you use it?

Background

Active Directory provides a Kerberos environment.  We have written extensively about Kerberos capabilities in this blog.  We also have explained that Centrify provides tight integration with Microsoft's Kerberos AD implementation by way of their MIT-Kerberos libraries and tools.  The advantage of using Centrify's tool set is that the tools are extensively tested against Microsoft's implementation.

A Kerberos key table (or "keytab") file is "is a file containing pairs of Kerberos principals and encrypted keys (these are derived from the Kerberos password)."(1).

Kerberos keytab files can help overcome two major issues:

• The security requirement of not having plain-text passwords in scripts or helper files.
• The increasing IT Infrastructure requirement for automation.  The proliferation elastic computing by way of private and public clouds requires that IT adds or reduces capacity on demand in a secure way.

Kerberos Keytabs 101

• In a Kerberos environment, each system has at least one keytab table stored on disk.  The keytab table lists the service principals and provides at least one key for each of those service principals (/etc/krb5.keytab by default).  Remember that principals typically follow the "service@host/REALM" format.
• End-users also have Kerberos files, but they are temporary (by default 10 hours), they are stored as a Kerberos cache file (by default /tmp/krb5cc_<uid of the user>), they list any user principals.
• When working with a Centrified system, the location of the Centrify-enabled Kerberos tools is /etc/centrifydc/kerberos/bin.  
• Quick primer on basic Kerberos tools:
• kinit: is used to obtain a kerberos ticket-granting-ticket
• klist: is used to list the cached tickets.
• kdestroy: destroys kerberos tickets
• The Centrify Kerberos tools documentation is publicly available here.
• Keytabs are Sensitive/Confidential information: A Security Procedure needs to be established for the handling of keytabs, because whoever has the keytab can authenticate as the principal used to create it.  As a tip, this process should be viewed with the same sensitivity as the handling of private keys.

Using Kerberos Tools

Kerberos tools are great for troubleshooting purposes.

1. Testing end-to-end AD connectivity and account availability with kinit (e.g. accunt jerry.seinfeld)
   # /usr/share/centrifydc/kerberos/bin/kinit jerry.seinfeld
   Password for jerry.seinfeld@CORP.CONTOSO.COM:
   You are prompted for the user's password.  The benefit of this test that it bypasses the NSS, PAM and authorization modules.  This means that any user in AD can be tested with kinit.
2. Listing the contents of a keytab or cache file with klist
1. For systems
   # /usr/share/centrifydc/kerberos/bin/klist -kt krb5.keytab
   Keytab name: FILE:krb5.keytab
   KVNO Timestamp         Principal
   ---- ----------------- ----------------------------------
   3 05/17/14 22:22:55 host/cen1@CORP.CONTOSO.COM
   
   Note: By default, during a system join (with adjoin) Centrify will automatically register service principals for  http ftp cifs nfs, this parameter is controlled by the adclient.krb5.service.principals directive of the centrifydc.conf file.
2. For users (user root)
   /usr/share/centrifydc/kerberos/bin/klist
   Ticket cache: FILE:/tmp/krb5cc_0
   Default principal: jerry.seinfeld@CORP.CONTOSO.COM
   
   Valid starting     Expires            Service principal
   08/24/14 14:07:02  08/25/14 00:07:04  krbtgt/CORP.CONTOSO.COM@CORP.CONTOSO.COM
   renew until 08/25/14 14:07:02
   Notice that this is a Kerberos Ticket Granting Ticket (krbtgt).

Ticket-Granting-Tickets vs. Service Tickets

Depending on how the application is using the keytab, it's possible that it will request a ticket-granting ticket (TGT), or a service ticket.  Generally, a TGT is given upon a session log-in;  a service ticket is requested when a user attempts to access a service on the network.  The key here is that a principal without a servicePrincipalName (SPN) can't be used to request a service ticket.  This changes how the AD principal is created.

The example above shows how to request a TGT.  This example, shows how to test a keytab for a service ticket:

First, we check if the account has a servicePrincipalName (e.g. db2inst1)

$ adquery user -A db2inst1

dn:CN=db2inst1,CN=Service-Accounts,DC=centrifyimage,DC=vms

samAccountName:db2inst1

userPrincipalName:db2inst1@CENTRIFYIMAGE.VMS

servicePrincipalName:db2inst1/engcen5.centrifyimage.vms

Second, we attempt to get a service ticket (the keytab is db2inst1.keytab)

$ /usr/share/centrifydc/kerberos/bin/kinit -S db2inst1/engcen5.centrifyimage.vms -kt db2inst1.keytab db2inst1

[db2inst1@engcen5 ~]$ /usr/share/centrifydc/kerberos/bin/klist

Ticket cache: FILE:/tmp/krb5cc_1004

Default principal: db2inst1@CENTRIFYIMAGE.VMS

Valid starting     Expires            Service principal

11/24/14 11:24:46  11/24/14 21:24:47  db2inst1/engcen5.centrifyimage.vms@CENTRIFYIMAGE.VMS

        renew until 11/25/14 11:24:46

Notice that this is not a KRBTGT, but a service ticket.

Using Centrify Tools for Kerberos-related operations

adinfo (with the C option) can be used to review the system service principals, and encryption level. Remember that the latter is set by the domain controller functional level.
$ adinfo -C
Computer Account Diagnostics
  Joined as: cen1
  Trusted for Delegation: false
  Use DES Key Only: false
  Key Version: 6
  Service Principal Names: nfs/cen1.corp.contoso.com
                           nfs/cen1
                           ipp/cen1.corp.contoso.com
                           ipp/cen1
                           http/cen1.corp.contoso.com
                           http/cen1
                           host/cen1.corp.contoso.com
                           host/cen1
                           ftp/cen1.corp.contoso.com
                           ftp/cen1
                           cifs/cen1.corp.contoso.com
                           cifs/cen1
                           afpserver/cen1.corp.contoso.com
                           afpserver/cen1

Supported Encryption Type(s): RC4-HMAC
                              AES128-CTS-HMAC-SHA1-96
                              AES256-CTS-HMAC-SHA1-96

Operating System Version: 6.1:6.5 (Final)

Adkeytab

adkeytab, is arguably one the most powerful command line tools provided by Centrify.  When used in tandem with scripts and the Kerberos tools it can help to increase security and provide flexibility in automation scenarios.  It has the ability to provision, deprovision and modify server and user principals.  Aside from adedit, adkeytab contains the largest command reference.

adkeytab  -  create  and manage Kerberos key tables (*.keytab files)and coordinate changes with the  Kerberos  key  distribution center(KDC) provided by Active Directory.

I will try to highlight some benefits of using adkeytab:

• It can be used to create or adopt AD principals:  adkeytab can create the user in AD for you, or in a separation of duties scenario, the UNIX/Linux admin can adopt the account provided he has the appropriate rights to modify the AD account.
• It randomizes the AD account's password:  The major issue with service accounts it that they are considered a shared account since at least one person (the creator or the user) knows the password.  With adkeytab it's possible to randomize the password of the AD account, effectively minimizing the need for aggressive password rotation.
• Can be fully automated:  adkeytab can be used with your scripts to perform operations.  This helps with elastic or private clouds.
• It's Kerberized!  what that means is that you can use a keytab to use adkeytab - this is great for automation.
• Syntax can be tricky - there are so many options that it can be overwhelming for beginners; my tips are to use the long for options (e.g. --adopt) and verbose output.
• Fixes stale AD computer accounts:  It can be used to reset the machine computer account.  Just elevate to use the adkeytab command with the -C (--change-password).  The output below uses the local system's computer account (--machine) in AD to reset the computer's password in AD.

$ dzdo adkeytab --change-password --machine -V

Attempting bind to centrifyimage.vms site:Demo-Site server:dc.centrifyimage.vms: ccache:FILE:/etc/krb5.ccache

Bind successful to server dc.centrifyimage.vms

Searching for AD Object: filter = (samAccountName=engcen5$), root = DC=centrifyimage,DC=vms

AD Object found: CN=engcen5,OU=UNIX-Servers,OU=Unix,DC=centrifyimage,DC=vms

Key Version = 21

Changing account 'engcen5' password with machine credentials.

Searching for AD Object: filter = (samAccountName=engcen5$), root = DC=centrifyimage,DC=vms

AD Object found: CN=engcen5,OU=UNIX-Servers,OU=Unix,DC=centrifyimage,DC=vms

Key Version = 22

Success: Change Password: Default Key Tab

The posts below, cover scenarios that use Kerberos key table files:

• Big Data (Hadoop)
• DB2 AD Integration and SSO
• MongoDB AD-Integration with Centrify
• Automating system AD joins/removals

(1) Source: Indiana University IT, https://kb.iu.edu/d/aumh

Labs: Testing the Availability Controls of Centrify for UNIX/Linux/Mac

In this Lab:

1. We'll use the dns.block parameter to use the domain controller fail-over capability.
2. We'll simulate a network failure on UBU1 and use the offline cache.
3. We'll attempt to kill the adclient process as a regular user
4. We will corrupt the /etc/nsswitch.conf and krb5.conf files 
5. We'll simulate an abnormal ending of the client process to invoke the watchdog process
6. We'll describe the domain controller telemetry process

Security Corner: Centrify UNIX Agent's Availability controls

Availability is the security principle that states that information should be available when needed and authentication mechanisms are required to be highly available since they are the door to the information that may be needed to make a business decision.

The Centrify agent for UNIX has a great advantage since it enables those platforms to integrate to Active Directory.  Active Directory was created with high-availability in mind and when properly implemented(*) provides:

• Replication:  Changes in the AD database are replicated to other domain controllers.  This process is called convergence.  Replication applies to LDAP objects and files.
• Multi-master:  Unlike NTDS 4.0 that relied on a Primary Domain Controller (PDC) role for write operations, in AD all DCs are writable.  There are some exceptions in what are called Flexible Domain Master Operations roles.  
• Sites and Services and DNS SRV records:  AD leverages DNS to provide the closest-to-client services;  any services that rely on these capabilities will be able to access the best connected service based on network location.

(*) Sadly, on the field (especially on lab environments) we see a lot of single DC environments and improper configuration of AD Sites and Services.  When we see the infamous "Default-First-Site-Name" displayed it decreases the credibility of the environment's maintainer.

One of the biggest concerns for any UNIX/Linux Systems Administrator is not having the ability to do their job because authentication scheme is not available;  as a matter of fact, that is why many of them are biased on using shared accounts (like root), because those accounts are reliably available.  Unfortunately this perpetuates the poor security practice of sharing those sensitive accounts.  The benefit with Centrify is that the mitigation for HA happens automatically without the need to re-target LDAP services or reconfigure krb5.conf files.

How does Centrify mitigate the Availability question?

Any true risk is mitigated by preventative, detective and corrective controls.  The controls deployed by Centrify are:

1. AD Sites and Services compatibility:  this means that the agent will pick an alternative domain controller based on the AD site topology.  (Corrective/Preventative)
2.  Performance Optimizations:  the agent performs its own telemetry calculations to determine if it's talking to the most optimal domain controller. (Preventative)
3. No AD available:  In case of a network-level failure (inability to connect to any DC) the agent provides the offline credential cache. (Corrective)
4. Abnormal termination:  the cdcwatch process is a watchdog that will spawn a new agent process in case of an abnormal termination.  (Corrective)
5. System file corruption:  Any changes in name server switch (NSS) (nsswitch.conf), Kerberos (krb5.conf) or pluggable authentication module (PAM) config files is monitored and rolled-back to proper operational mode if needed. (Corrective/Preventative)
6. Process Protections:  All agent-related processes (and the watchdog) are owned by root. (Preventative)
7. Logs and Core Dumps:  Centrify integrates with the syslog facility and provides its own core dumps in case of an abnormal termination. (Detective)

As you can see, Centrify's agent implements a high-level of controls to ensure high-availability.

When will a privileged system or local account be needed?

In two instances:

a) Normal termination of the Centrify agent process:  The agent has been stopped, therefore there's no communication with AD or the cache.  The authentication stack will continue on.  For example, on your /etc/nsswitch.conf you may see a line for users (or groups like this):

passwd         centrifydc   files

In case the adclient process is not available, any local account will be granted access.  This is the same under normal operations.

b) Single-user mode:  If the system abends and falls into that mode, the only account that can access the system is root.

Command Line Tool tips

The best command to troubleshoot the agent is adinfo.  Use it with the --test option perform connectivity tests.  Sample output:

george@suse1:~> adinfo --test

Domain Diagnostics

  Domain: corp.contoso.com

  Subnet site: CorpHQ

    DNS query for: _ldap._tcp.corp.contoso.com

    Found SRV records:

      dc1.corp.contoso.com:389

  Testing Active Directory connectivity:

    Domain Controller: dc1.corp.contoso.com

      ldap:      389/tcp - good

      ldap:      389/udp - good

      smb:       445/tcp - good

      kdc:        88/tcp - good

      kpasswd:   464/tcp - good

      ntp:       123/udp - good

Tips about conducting Disaster Recovery tests

Disaster recovery with Centrify for Servers can piggyback on the AD infrastructure and work performed for Windows domain members.  Unix/Linux systems just become another "customer of AD" this means:

• If you're performing a total (from scratch) AD recovery, AD DCs and DNS go first, then the Zone data has to be rebuilt.  UNIX/Linux systems rebuild happens in parallel, once ready, load the agent and join the zone; at that point instead of using the root account, you can switch to dzdo.
• If you're performing a partial or restore of existing systems, restore the AD infrastructure first;  you can work in parallel with UNIX/Linux systems  (credentials will be cached up to the moment of the backup or snapshot) and access will be offline - once AD is online the agent will go in connected mode.
• If you're testing with a disaster recovery site that goes online during tests your strategy may vary. In some outfits its not desirable that the agent fails over to the DR site; so using the dns.block parameter (or the Blacklist DNS DC hostnames GPO) to have those DCs blocked during production is desirable.  However, during the disaster, it should be scripted (or automated) that the DR Site DCs will be unblocked so they are eligible for fail-over.  Another variation of this test is to block the production DCs and only allow the DR DC (that is a crude/forced DR test).
• In larger environments, it's quite common that not all trusted sysadmins have had logged on to all target systems, that is why Centrify has the ability to pre-validate (or pre-cache) user credentials.  Prevalidation will be the subject of another posting.

Description of the dns.block parameter

This configuration parameter specifies which DCs should be filtered out of the pool of existing DCs for the domain.  This is useful when a DC is behind a firewall, has been decommissioned but there's a stalled object or for DR tests.

The parameter in the /etc/centrifydc/centrifydc.conf file works by specifying the directive followed by the FQDNs of the DCs in question separated by commas.

dns.block: dc1.corp.contoso.com,exp1.corp.contoso.com

If you prefer to use GPOs, the path is:  Computer Configuration > Policies > Centrify Settings > DirectControl Settings > Network and Cache Settings > Blacklist DNS DC hostnames group policy.

Labs

Utilities: addns and adsmb

addns

This utility is allows the register and update of the system DNS resource record either automatically or manually.  It is very handy especially for UNIX administrators that may not have access to the DNS management snap-in.  addns uses secure DNS dynamic updates.

For example, to update my computer (ubu1), in the corp.contoso.com using jessie's account:

$ ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:0c:29:1f:2c:0a
          inet addr:10.0.0.154  

$ addns -U -u jmatthews  -d corp.contoso.com -n ubu1 -i 10.0.0.154
jmatthews@CORP.CONTOSO.COM's password:
Updating host records for ubu1.corp.contoso.com on 10.0.0.1.
Updated host records ubu1.corp.contoso.com.
Updating reverse lookup records for ubu1.corp.contoso.com on 10.0.0.1.
Updated reverse lookup record  154.0.0.10.in-addr.arpa.

In DNS Manager, I can see my updated record

addns Usage

    addns -U [-u <user> -p <pwd>] [-d <dom>] [-s <svr>] [-n <host>] [(-i <ip>)+]

Or:

    addns -D [-u <user> -p <pwd>] [-d <dom>] [-s <svr>] [-n <host>]

Or:

    addns -A [-u <user> -p <pwd>] [-d <dom>] [-s <svr>] [-n <host>] [(-i <ip>)+]

Or:

    addns -L [-d <dom>] [-s <svr>] [-n <host>] [(-i <ip>)+]

With:

  -U, --update        create or update host's DNS records

  -D, --delete        delete host's DNS records

  -A, --add           just add host's DNS records

  -L, --list          lists DNS record details

  -N, --nocreds       no credential is to be supplied or prompted for (only works when the DNS server is configured for non-secured updates)

  -m, --machine       Use machine credentials (must be root)

  -u, --user          AD user name

  -p, --password      pwd password string, prompts if absent

  -s, --server        svr DNS server to contact. Legal formats include: host<@REALM>, host.domain.com<@REALM>

  -d, --domain        dmn DNS domain name

  -n, --name          hst Host Name

  -i, --ipaddr        ipa IP address

  -f, --force         force update DNS records even if they have not changed

  -r, --refresh       updates unchanged records to refresh TTL

  -t, --ttl           val specify a time to live value in seconds

  -v, --version       print version information and exit

  -V, --verbose       print debug information for each operation

  -h, --help          print this help information and exit

Examples:

    addns -U

    addns -D

    addns -U -d acme.com -s dnssvr@ACME_REALM.COM -n myhost -i 192.168.1.155

    addns -L

adsmb

This is a very cool tool that allows to access windows shares via the command line.  It allows to copy, read and even print!! files from the command line interface to windows shares.  adsmb can use the current machine credentials and even a kerberos keytab to authenticate (great for scripts!)

Folder listing example:  To list the files in the files folder in APP1  (\\APP1\files)

$ adsmb dir -h app1.corp.contoso.com -s files

  10 Sat Dec 14 14:39:38 2013, Wed Dec 18 06:27:39 2013,  Wed Dec 18 06:27:39 2013,  Wed Dec 18 06:27:39 2013,               0 .

  10 Sat Dec 14 14:39:38 2013, Wed Dec 18 06:27:39 2013,  Wed Dec 18 06:27:39 2013,  Wed Dec 18 06:27:39 2013,               0 ..

  10 Sun Dec 15 19:30:14 2013, Sun Dec 15 19:32:08 2013,  Sun Dec 15 19:32:08 2013,  Sun Dec 15 19:32:08 2013,               0 Centrify-Suite-2013.3-mgmt-ent-win64

  20 Wed Dec 18 06:27:39 2013, Wed Dec 18 06:26:06 2013,  Tue Jan 14 18:06:55 2014,  Wed Dec 18 06:27:39 2013,        39118052 centrify-suite-2013.3-rhel3-x86_64.tgz

  20 Wed Dec 18 06:27:39 2013, Wed Dec 18 06:26:22 2013,  Tue Jan 14 18:06:55 2014,  Wed Dec 18 06:27:39 2013,        30561472 centrify-suite-2013.3-sol9-x86.tgz

  20 Wed Dec 18 06:27:39 2013, Wed Dec 18 06:26:38 2013,  Tue Jan 14 18:06:55 2014,  Wed Dec 18 06:27:39 2013,        31055871 centrify-suite-2013.3-suse9-x86_64.tgz

  20 Sat Dec 14 14:40:51 2013, Sat Dec 14 14:40:51 2013,  Tue Jan 14 18:06:55 2014,  Sat Dec 14 14:40:51 2013,              21 example.txt

File get example: to copy example.txt to the Files shared folder in APP1

$ adsmb get -h app1.corp.contoso.com -s files -r example.txt -l example.txt

$ ls -l

total 4

-rw------- 1 jmatthews jmatthews 21 Dec 14 14:40 example.txt

-rw-rw-r-- 1 jmatthews jmatthews  0 Jan 14 17:59 myfile.txt

$ cat example.txt

This is a shared file

jmatthews@ubu1:~$

adsmb Usage

Usage: adsmb <action> [-c credentials] [-d domain] [-h host] -s share [-r file] [-l file ] [-n pattern] [-CmTV]

        action = get, getnew, getmod, put, putnew, print, dir, mkdir, rename, rmdir, delete

        -c credentials = credentials to use

        -h host   = host to connect to. If not given it is the 'best' domain controller

        -d domain = domain to connect to. If not given it is using current joined domain or the domain part from the host

        -s share  = share name

        -r file   = the remote file or remote directory to dir

        -n pattern= pattern to list when listing directory, default is *

        -l file   = the local file

        -C = convert CRLF to LF

        -m = use machine credentials. Requires access to krb5.keytab, typically root

        -T = Machine-readable timestamps

        -V = print debug message

Examples:

        adsmb get -h myserver -s test -r files\\my.txt -l foo.txt

        adsmb dir -s sysvol -mT

        adsmb dir -s homedrive -mT -r krusty\library -n *

        adsmb print -h myserver -s sharedPrinterName -l <-|foo.txt>

Utilities: CLI tools: adinfo and adquery

February 2016 Update

I've created a Centrify CLI Cheat Sheet.  The original January 2014 post will be left as is for historical reasons.

======

Background

Centrify offers a variety of command line utilities for the purposes of information, troubleshooting and automation. In the Utility section we will discuss those tools.

Basic Agent Utilities

adinfo

Adinfo provides information about how the system is integrated to Active Directory.

$ adinfo
Local host name:   cen1
Joined to domain:  corp.contoso.com
Joined as:         cen1.corp.contoso.com
Pre-win2K name:    cen1
Current DC:        dc1.corp.contoso.com
Preferred site:    HQSite
Zone:              corp.contoso.com/Unix/Zones/HQ
CentrifyDC mode:   connected
Licensed Features: Enabled

Some useful switches
-T  (--test) to verify connectivity to the domain
$ adinfo -T
Domain Diagnostics:
  Domain: corp.contoso.com
    DNS query for: _ldap._tcp.corp.contoso.com
    DNS query for: _gc._tcp.corp.contoso.com
  Testing Active Directory connectivity:
    Global Catalog: dc1.corp.contoso.com
      gc:       3268/tcp - good
    Domain Controller: dc1.corp.contoso.com
      ldap:      389/tcp - good
      ldap:      389/udp - good
      smb:       445/tcp - good
      kdc:        88/tcp - good
      kpasswd:   464/tcp - good
      ntp:       123/udp - good

- C (--computer) to verify the computer account information including Kerberos Service Principal Names

$ adinfo -C

Computer Account Diagnostics

  Joined as: cen1

  Trusted for Delegation: false

  Use DES Key Only: false

  Run adinfo as root to examine local key info

  Key Version: 4   (local key version unavailable)

  Service Principal Names: nfs/cen1.corp.contoso.com

                           nfs/cen1

                           ipp/cen1.corp.contoso.com

                           ipp/cen1

                           http/cen1.corp.contoso.com

                           http/cen1

                           host/cen1.corp.contoso.com

                           host/cen1

                           ftp/cen1.corp.contoso.com

                           ftp/cen1

                           cifs/cen1.corp.contoso.com

                           cifs/cen1

                           afpserver/cen1.corp.contoso.com

                           afpserver/cen1

Supported Encryption Type(s): RC4-HMAC

                              AES128-CTS-HMAC-SHA1-96

                              AES256-CTS-HMAC-SHA1-96

Operating System Version: 5.8 (Final)

Adinfo can also be used to collect debug information, or even to map the current domain connectivity in complex environments.

adquery

Adquery is a great tool to make queries via the AD agent.  

To query all users that are UNIX-enabled in the zone with Centrify:

$ adquery user

billmurray:x:1627391067:1627391067:Bill Murray:/home/billmurray:/bin/bash

chevychase:x:1627391070:1627391070:Chevy Chase:/home/chevychase:/bin/bash

chrisrock:x:1627391068:1627391068:Chris Rock:/home/chrisrock:/bin/bash

To view more information about user billmurray

$ adquery user -A billmurray

unixname:billmurray

uid:1627391067

gid:1627391067

gecos:Bill Murray

home:/home/billmurray

shell:/bin/bash

auditLevel:AuditIfPossible

isAlwaysPermitLogin:false

dn:CN=Bill Murray,OU=Marketing,OU=Staff,DC=corp,DC=contoso,DC=com

samAccountName:Bill.Murray

displayName:Bill Murray

sid:S-1-5-21-3571224596-3006733700-3057749774-1115

userPrincipalName:Bill.Murray@corp.contoso.com

canonicalName:corp.contoso.com/Staff/Marketing/Bill Murray

passwordHash:x

zoneEnabled:true

unixGroups:billmurray

memberOf:corp.contoso.com/Groups/Marketing Staff,corp.contoso.com/Groups/Samba-Users,corp.contoso.com/Unix/Provisioning Groups/Unix Users,corp.contoso.com/Users/Domain Users

Reviewing all information about a group:

$ adquery group staff 

staff:x:1:chrisrock,billmurray,chevychase

To view more information about the Staff group

$ adquery group staff -A

unixname:staff

gid:1

required:true

dn:CN=HQ-AIX-Staff-Group,OU=Groups,DC=corp,DC=contoso,DC=com

groupType:global security

samAccountName:HQ-AIX-Staff-Group

sid:S-1-5-21-3571224596-3006733700-3057749774-1232

canonicalName:centrifyimage.vms/Groups/HQ-AIX-Staff-Group

members:corp.contoso.com/Staff/IT/Chevy Chase,corp.contoso.com/Staff/Contractors/Bill Murray,corp.contoso.com/Staff/IT/Chris Rock

unixMembers:chrisrock,billmurray,chevychase

Adquery can be used to troubleshoot issues with accounts, including computer accounts.