Basics: Centrify Roles 101 - UNIX Role Creation and Assignment

Centrify Roles

The Centrify Suite allows for the implementation of role-based access controls leveraging Active Directory.  In UNIX, these roles are implemented using AD, Authorization Manager, the base agent (dc or adclient) , the authorization client (dz or directauthorize) and Centrify-enhanced sudo.  In Windows (although out of scope for the initial blog postings) it uses the Centrify Agent.

PDCA method and Roles

The Plan-Do-Check-Adjust methodology is a perfect way to implement Centrify roles.  Use this framework to implement and maintain your roles.  Remember:  Access Controls is a CAPABILITY meaning that it's not a "set it and forget it" activity.  The attestation process is a great opportunity to review roles and see what can be done to tweak them.

Business Problem # 1 has a very basic set of roles.  They just need System Administrators and regular users.  You will see that as we implement more problems, we will tweak roles accordingly.

When (plan)ning for a role, ask yourself these questions:

Ask yourself	Comments	Examples
1. What is the role supposed to allowed do?	This is the functionality that you want to enable.  Use cases are great tools to view this.	Contractor DBAs should be able to run the sqlplus command as the oracle account, all their work will be within SQL plus.
2. What is their UNIX experience? (controlled or flexible)	This question will define what kind of shell is provided to them (a white list or just regular commands plus their privilege commands)	Contractor DBAs are regular unix users with one privileged command.
3. What is the role NOT supposed be allowed to do or know?	These are the controls or rules that are required by policy, security, regulation, methodology, etc.	Users should not know the oracle account password
4. Are there any time/day restrictions to this role?	This is the days/times that the role is available.	Contractor DBAs shall not log in over the weekends.
5. How is the role supposed to access the UNIX system?	These are the access protocols allowed.	DBAs should only have access via ssh.
6. Are there any particular platform implications?	These are exceptions based on the UNIX/Linux platform used.	Oracle databases are used on Solaris systems.  The SSH daemon is a fork called sshd-kbinit
7. Are any additional controls required when privileges are used?	Depending on the action or the nature of the role, you may require simple or complex authentication mechanisms to elevate.	Authentication is required to elevate.
8. Is this assignment temporary or permanent?	Is this role effective for a particular length of time?	Contactor DBAs will work from 3 months starting on Jan 1st 2014
9. What is the scope of this assignment?	This is a key question.  You need to determine if this role is applicable to all systems (zone), some systems (computer group), or a single system (system override).	Only Oracle systems.
10. Will this role be audited?	This is to turn capture/replay if required (A topic for Enterprise Edition)	Yes.
11. Will we have a group of people or a single individual have this role?	Ideally you will always leverage AD Groups for role assignments because it just makes life much easier to manage, but there are instances in which performing a user assignment may be needed.	There is a group of 5 contractors, it is expected that this work may go beyond the original contract.

Creating (do) the Role 

1. In ADUC.  Request or create an AD Security group
   In our example, the UNIX administrator has delegated rights and there is a Roles container for those groups.  It's important to have a good naming convention to understand the purpose of the group.  This is a temporary group that will be assigned at the computer role level, so something like:  UNIX Contractor DBAs is very descriptive.  Notice the UNIX in front of the name.  This is because you could have roles for Windows.
2. In Access Manager/Zone/Authorization/UNIX System Rights review the PAM access rights.
   Centrify ships with some ssh PAM access roles, but based in our example, the Oracle ssh daemon is not listed.  This needs to be created.
   
3. In Access Manager/Zone/Authorization/UNIX Commands create the command(s) required for the role.
   In our example, there's only one privileged command, the sqlplus command running as oracle with authentication required.
    
    
   
4. In Access Manager/Zone/Authorization/Role Definitions, right-click Add and Configure the role.
   In our example, the contractors only work during weekdays and have a regular user experience.  Here you need to keep a good naming convention too.  UNIX-ContractorDBAs is a good name.
    
   
5. In Access Manager/Zone/Authorization/Role Definitions, right-click the newly created role and select add rights. 
   Select the SSH PAM access rights and the newly created sqlplus-as-oracle command.
   
6. In Access Manager/Zone/Authorization/Computer Roles.
   Assuming you have the corresponding computer role (in our example: Database servers), expand the group and right click Role-Assignment.
   

 Testing and verifying (Check) the Role

1. Add a test user to the UNIX Contractor DBAs group.
2. Attempt to access the system(s), verify that SSH access is allowed, but not any others.
3. Verify the role by testing the account with dzinfo and dzdo.
   
4. Verify the role by using the reports or User Effective rights facilities in Access Manager 
   

 (Adjust)ing the role

1. Based on review or circumstances:
   E.g "Contractors now shall work on weekends"
2. Change the role accordingly.
3. Review your roles at least twice a year.

 From this point on, the RBAC is managed via AD group memberships, and the role can be tweaked based on the business needs.

Lab # 5: HQ Zone and Computer Roles Creation

In this lab

• We will use Centrify Access Manager to create the HQ Zone
• We will define the Zone UNIX identity defaults
• We will create the Computer Roles for Database and Web Servers

Create the HQ Zone

1. Log on to CLIENT1 with Jessie (UNIX administrator)
2. Open the Centrify Access Manager (on the desktop)
3. On the Connect to forest window, click OK.
4. On the Access Manager console, in the left pane, expand the Centrify Access Manager hive, right-click on Zones and select Create New Zone.
5. In the zone name, type HQ, then click next.
6. In the Agent Compatibility page we will select Hierarchical Zone.
   This blog will never use Classic Zones, click Next
7. In the Management Model window, select Standard Zone, click next and then finish.

 Set up the UNIX Identity zone defaults

1. On the left pane, expand zones, and expand the HQ zone.
2. Right click the HQ zone, select properties and go to the User Defaults tab.
3. On the UID, click the drop-down box and select AutoPrivate group, then go to the Group Defaults tab
4. On the GID, click the drop-down box and select Generate GID from SID
5. Click OK

Note:  These are just the zone defaults,  UNIX identities can always be overridden.

Create the Computer Roles for Database and Web Servers

1. On the left pane, expand zones, and expand the HQ zone and expand the Authorization node.
2. Right click the Computer Roles section and click Create Computer Role
3. In name, type Database Servers
4. Click the drop-down arrow on computers group, and click <...>
5. In the Find Objects window, type UNIX and click Find Now.
6. Double click the UNIX Database Servers group and then press OK
   Repeat the same process for the Web Servers and use the UNX Web Servers group. 

Basics: Centrify Zones

What are zones?

• As per Dictionary.com:
  noun. "Any continuous tract or area that differs in some respect, or is distinguished for some purpose, from adjoining tracts or areas, or within which certain distinctive circumstances exist or are established."
• A marketing name (1, 2, etc.)
• A mechanism to establish a Security Governance model using Active Directory and Centrify technologies across UNIX, Linux and Windows  (yes, Windows).

The third option is the best definition because of the key concept of security governance.  In the context of security, Centrify zones are AD constructs that allow the storage of multi-platform systems, UNIX identity data and Authorization information.  It leverages the RFC 2307 specification, proprietary Centrify techniques and the Windows Authorization Manager API to allow the implementation of the following security principles:

1. The "least access" principle:  an internal control that states that end users shall only have access to the systems based on business need to know.
2. The "least privilege" principle:  an internal control that states that end users shall only have the rights and privileges in systems based on business function.
3. The "separation of duties" principle: an internal control that requires more than one person to perform a function in order to prevent fraud or error. 

All these principles are the basis for Role Based Access Controls (RBAC). 
Zones also allow for flexible Management of UNIX identities (login, UID, GID, login, Shell, etc.) 
Process Reuse
A very overlooked advantage of Zones is that they allow organizations to reuse their current processes for the purpose of UNIX identity provisioning (or deprovisioning), access management and privilege management.  The process is the practice of adding or removing users from Security groups in AD.  For years this process has been used to grant privileges, access to file shares, printers, Exchange Services, SharePoint sites, etc.

What does this mean?
It means that integrating any solution to Centrify for the purposes of UNIX identity provisioning or privilege management is very easy and it doesn't require dedicated connectors or agents.  ANY Identity Management platform or solution has the ability to integrate to AD and to add/remove users into Security Groups.
Regardless of the solution (Oracle, Courion, Microsoft FIM, Sailpoint, etc.) all of them have that capability, and many of them with workflows.

Centrify Zones History
Zones used to be flat constructs (classic zones), this made it very cumbersome for organizations to manage them.  This changed a few years ago when Centrify introduced hierarchical zones.  The real power of zones was unleashed when the authorization components were introduced.  Since version 2013, now zones can be used to segregate and perform privilege management both UNIX/Linux and Windows systems!!!  This has huge implications for organizations that are security and cost conscious.  
Moderation note:  It is the opinion of this author that classic zones should be deprecated.  This blog does not cover them.

What are the design rules for zones?

• A single zone and computer roles should satisfy the needs of most organizations;  however there may be regulatory or legal reasons to implement other zones (for example: European Union Rules, Separation of Divisions, PCI, etc.)
• Each zone used to control UNIX system access has to have a set of defaults for identity data (UID, GID, login, Shell, GECOS).  Access Manager provides multiple options, but the default options are typically fine for a manual provisioning scenario:
  login is the AD samAccountName  (username)
  UID/GID the best option is to generate the UID from the SID - this provides uniqueness.
  GECOS defaults to the AD Display Name.
  Home and Shell use variables to specify the defaults for the system.  These can come very handy.
• For each zone dedicated for UNIX purposes, provisioning mechanisms need to be accounted for.
• Identities shall be provisioned at the zone level.  Identity overrides shall be considered exception.
• RBAC Assignment at the zone or computer level overrides shall be used sparingly.  On the flip side, Computer Role level RBAC assignments are the preferred method.

Like we have previously outlined, zone design is subject to the Plan-Do-Check-Adjust method too.

What is AutoZone Mode?

AutoZone is a mode operation for Centrify Agents that allows the UNIX, Linux or Mac system to be joined to Active Directory with no access restrictions (like any client workstation), therefore any user in the domain (or in a trusted domain) can log in to the system.
AutoZone is the only mode of operation of the Centrify Express for UNIX/Linux.  Although desirable in client scenarios, it is not a proper security practice to allow everyone to log in to sensitive systems.  

Other disadvantages of AutoZone are the following:

• A high-degree of planning is required to deploy in AutoZone mode.  The caching required for all objects (especially) in large domains may affect performance during cache buildup.  The rule of thumb is that the domain is larger than 1500 users, then limits have to be established.
• AutoZone (express) does not allow for Identity Overrides (manipulating login, UID, GID, etc)
• AutoZone does not include the authorization components.  No least access or grouping of systems or Privilege Management (no RBAC)

AutoZone is covered in a very limited basis in this blog.

Lab # 4 - Centrify Standard Suite Installation and Setup

In this lab

• We will install the Centrify Standard Suite Access Manager
• We will initialize Access Manager and specify License and Zone locations
• Verify the ADUC extensions in CLIENT1

   
Install the Centrify Standard Suite Access Manager

1. Log on to CLIENT1 as Bryant Wheeler
2. Open Windows Explorer and connect to \\APP1\Files.  Copy the Centrify Installation folder to CLIENT1's desktop  (this is not to perform the install over the network)
3. Open the folder and navigate to DirectManage64 and run Setup.
4. On the Welcome page, click next, agree to the license terms and click next, type your company's information and click next.
5. In the components page, un-check "Direct Manage Access - Utilities" and click next
6. Click next in the Destination folder
7. Click next in the Disable Publisher verification page  (our lab is not connected to the web)
8. Click next in the summary page, then next to start the installation.  Click finish when done.

Initialize Access Manager

1. Open the Access Manager icon on your desktop.
2. Press OK in the  Connect to forest window.
3. Click Next in the Welcome and User Credentials pages
4. In the Specify Licenses containers page, click browse and specify the Licenses OU under the top-level UNIX OU and press next.  Click yes in the Pop-op dialog-box.
5. In the Install license keys, specify the key given to you by Centrify or select the 30 day evaluation license and click next.
6. In the Default Zone containers page, click browse and specify the Zones OU under the top-level UNIX OU.  Press next.
7. Un-check the check-box in the Delegation page, and press next.
8. Click next in the AD notification handler page
9. Check the box in the Activate Pages page and click next in the summary, then click Finish.

Verify the ADUC property page

1.  Open ADUC
2. Go to the Staff OU and double click Bryant's account.
3. Verify that there's a Centrify Tab in the user object's properties.

Lab # 3 - Active Directory Preparation

In this Lab

1. We will create the top level OU (UNIX) in our Active Directory and we'll delegate control to the UNIX administrator
2. We will create the SubOUs  (Licenses, Zones, Roles, UNIX Groups, Servers and Computer Groups)
3. We will create the AD Security Groups for Roles and Computer Groups

Create the top level OU (UNIX) and delegate control to the UNIX administrator

1. Log on to CLIENT1 with Bryant Wheeler (Windows Administrator)
2. Press Start-All Programs-Administrative Tools and click Active Directory Users and Computers (ADUC)
3. On the left pane, right click the corp.contoso.com domain, select New-Organizational Unit
4. Name it UNIX and Press OK
5. In the View Menu, select Advanced Features (this enables the Security tab)
6. Right-click the UNIX OU and select properties.   Go to the Security tab and click the Advanced button
7. In the Permissions tab, click Add. In the Object name box, type Jessie.Matthews and click check names (this resolves the name) press OK.
8. In the permission entry Window, check the Full Control box under the Allow column, and press OK 3 times.
9. Close ADUC and log off CLIENT1

At this point Jessie the UNIX administrator has delegated access to this OU.  This will allow him to create objects and join systems under that OU. 

Create the SubOUs  (Licenses, Zones, Roles, UNIX Groups, Servers and Computer Groups)

1. Log on to CLIENT1 with Jessie Matthews (UNIX Administrator)
2. Press Start-All Programs-Administrative Tools and click Active Directory Users and Computers (ADUC)
3. On the left pane, expand the corp.contoso.com domain, click the UNIX ou select New-Organizational Unit
4. Name it Licenses and press OK.  Repeat the same steps for these OUs:

Licenses: container to store the Centrify license object  (already created)

Zones: zones are like folders that hold systems, users, groups and authorization data.

Servers:  to store the computer objects and to link the OU.

Roles:  to store the AD security groups that will be assigned roles

UNIX groups:  to store the AD security groups that will map to UNIX groups

Computer Groups:  to store the AD security groups that will group systems.

Create the AD Security Groups for Roles and Computer Groups

1. Right-click the Roles OU (under UNIX) and select New-Group.
2. Name it UNIX Super Users and press OK.
3. Right-click the Roles OU (under UNIX) and select New-Group.
4. Name it UNIX Regular Users and press OK.
5. Right-click the Computer Groups OU (under UNIX) and select New-Group.
6. Name it UNIX Database Servers and press OK.
7.  Right-click the Computer Groups OU (under UNIX) and select New-Group.
8. Name it UNIX Web Servers and press OK.

Lab # 2: Extending the Base Configuration TLG with UNIX and Linux systems

Lab Overview

1. Install CentOS 6.4, SUSE 10 SP3 and Solaris 5.10
2. Set up and verify the TCP/IP properties and SSH daemon on the UNIX/Linux systems.
3. Modify the UNIX/Linux systems to skip the graphical desktop
4. Verify or setup the Name Server Cache Daemon (NSCD) to start automatically
5. Create and modify the corresponding user for each system and enable sudo on Linux systems:
   We will create two users in all systems: centrifying and Jessie Matthews (jmatthews)
   Two users in the Database System (CEN1); Jeremy Silva (jsilva) & Ramon Jimenez (rjimenez)
   Two users in the Web System (SUSE1); Doyle Russell (drussell) & Matt Sims (msims)
   The centrifying and jmatthews users will be added to the wheel group that will be sudo-enabled.
6. Test connectivity from CLIENT1 using PuTTY 
7. Copy the Centrify agents to each corresponding system

Lab Requirements

• The requirements of the base Test Lab Guide (for DC1, APP1 and CLIENT1)
• A Centos 6.5 VM for CEN1
  http://wiki.centos.org/Download
  You may need to download the NSCD package for CentOS.
• A Novell SUSE 10 VM for SUSE
  https://www.suse.com/LinuxPackages/packageRouter.jsp?product=server&version=10&service_pack=sp3&architecture=x86_64&package_name=index_all
• A Solaris 5.10 VM for SOL1
  http://www.oracle.com/technetwork/server-storage/solaris10/downloads/index.html

Install UNIX/Linux Hosts

The platforms we'll be using in this guide are

• CentOS 6.4:  will be assigned IP address 10.0.0.151
• Novell SUSE 10 will be assigned IP address 10.0.0.152
• Solaris 5.10 x86 will be assigned IP address 10.0.0.153  

Configure the UNIX/Linux systems
Follow instructions for each corresponding platform:

On CEN1

1. Log in as a privileged user (or root) and open a terminal
2. Verify that the NetworkManager (NM) service is running
   service NetworkManager status
   NetworkManager (pid ####) is running
   Note:  Follow the appropriate steps if you're not using NM
3. Edit the /etc/sysconfig/network and add:
   HOSTNAME=cen1.corp.contoso.com
4. Copy the interface's MAC address: (Example eth0 with the Mac address 00.0c.29.2b.b7.ca)
   ifconfig eth0 | grep HWaddr
   eth0   Link encap: Ethernet  HWaddr  00:0C:29:2B:B7:CA
5.  Edit (or create) the /etc/sysconfig/network-scripts/ifcfg-<interface> and add (or edit) the following lines:  (using above example and the information about the lab)
   DEVICE=eth0
   NM_CONTROLLED=yes
   ONBOOT=yes
   HWADDR=00:0C:29:2B:B7:CA
   IPADDR=10.0.0.151
   NETMASK=255.255.255.0
   DNS1=10.0.0.1
6. Restart the network service:
   service network restart
7. Verify the configuration  (hostname, DNS configuration, ping test to crl.corp.contoso.com)
   # hostname
   cen1.corp.contoso.com
   # cat /etc/resolv.conf    (look for the two lines below)
   search corp.contoso.com
   nameserver 10.0.0.1
   # ping crl
   PING crl.corp.contoso.com (10.0.0.3) 56(84) bytes of data.
   64 bytes crl.corp.contoso.com (10.0.0.3): icmp_seq=1 ttl=128 time=17.2 ms
8. This verifies that the TCP/IP configuration is correct and that CEN1 is using DC1 for DNS.
9. To make sure that the SSH daemon is running, run
   chkconfig | grep ssh
10. If the sshd service is off at runlevels 3 and 5, enable them with this command
    chkconfig sshd on --level 35
11. Install and enable the NSCD daemon:
    rpm -Uvh nscd-2.12-1.132.el6.x86_64.rpm
    chkconfig nscd on --level 35
    service nscd start
12. Make sure that the SSH daemon configuration is set up for PAM and to allow Challenge Response.  In the /etc/ssh/sshd_config file, make sure these lines are enabled:UsePAM  yes
    ChallengeResponseAuthentication yes
    The opposite entries need to be commented, otherwise the last directive will be the effective setting.
13. Create an administrative user and the DBAs.useradd -m centrifying
    useradd -m -c "Jeremy Silva" jsilva
    useradd -m -c "Ramon Jimenez" rjimenez
    useradd -m -c "Jesse Matthews" jmatthews
14. Add the administrative user (centrifying in my example) user to the wheel group
    usermod -G wheel centrifying
    usermod -G wheel jmatthews
15. Enable sudo in the system
    vi /etc/sudoers
    Uncomment the authenticated section for the wheel group
    %wheel ALL=(ALL)       ALL
    Save the file.

On SUSE1

1. Log in as a privileged user (or root) and open a terminal
2. Edit the /etc/hostname file (create if it doesn't exist) and add the line
   suse1
3. Edit the /etc/hosts file.  Make sure to add the hostname to the corresponding line:
   127.0.0.1       localhost  suse1
4. Edit the /etc/resolv.conf file and add:
   search corp.contoso.com
   nameserver 10.0.0.1
5.  Edit (or create) the /etc/sysconfig/network-scripts/ifcfg-eth-<MAC> and add (or edit) the following lines:  (using above example and the information about the lab)
   DEVICE=eth0
   ONBOOT=yes
   IPADDR=10.0.0.152
   NETMASK=255.255.255.0
6. Restart the network service:
   service network restart
7. Verify the configuration  (hostname, DNS configuration, ping test to crl.corp.contoso.com)
   # hostname
   suse1.corp.contoso.com
   # cat /etc/resolv.conf    (look for the two lines below)
   search corp.contoso.com
   nameserver 10.0.0.1
   # ping crl
   PING crl.corp.contoso.com (10.0.0.3) 56(84) bytes of data.
   64 bytes crl.corp.contoso.com (10.0.0.3): icmp_seq=1 ttl=128 time=17.2 ms
8. This verifies that the TCP/IP configuration is correct and that SUSE1 is using DC1 for DNS.
9. To make sure that the SSH daemon is running, run
   chkconfig | grep ssh
10. If the sshd service is off at runlevels 3 and 5, enable them with this command
    chkconfig sshd on --level 35
11. Make sure that the NSCD daemon is running on levels 3 and 5chkconfig --list | grep nscdnscd      0:off  1:off  2:off  3:on   4:off  5:on   6:off
    If the service is not set to run by default on levels 3 and 5, enable it:
    chkconfig nscd on --level 35
12. Make sure that the SSH daemon configuration is set up for PAM and to allow Challenge Response.  In the /etc/ssh/sshd_config file, make sure these lines are enabled:
13. UsePAM  yes
    ChallengeResponseAuthentication yes
    The opposite entries need to be commented, otherwise the last directive will be the effective setting.
14. Create an administrative user and the Web Administratorsuseradd -m centrifying
    useradd -m -c "Doyle Russell" drussell
    useradd -m -c "Matt Simms" msimms
    useradd -m -c "Jesse Matthews" jmatthews
    Note:  the useradd command is in the /usr/sbin folder in case you don't have it in your path.
15. Add the user to the wheel group
    usermod -G wheel centrifying
    usermod -G wheel jmatthews
16. Enable sudo in the system
    vi /etc/sudoers
    Uncomment the authenticated section for the wheel group
    %wheel ALL=(ALL)       ALL
    Save the file.

On SOL1

In Solaris, you have to edit or review these files to change the configuration:

/etc/nodename

/etc/hostname.interface

/etc/inet/hosts
/etc/inet/ipnodes

/etc/defaultdomain

/etc/netmasks

/etc/defaultrouter 

/etc/resolv.conf 

/etc/nsswitch.conf 

 We won't be configuring a default router for now.

1. Log in as a privileged user (or root) and open a terminal
2. If your computer is set up for DHCP, remove the /etc/dhcp.<interface> (example: e1000g0)
3. Edit the /etc/nodename and add this line
   sol1
4. Edit the /etc/hostname.<interface>  file (e.g e1000g0  /etc/hostname.e1000g0)
   sol1
5. Edit the /etc/inet/ipnodes file and add this line
   10.0.0.153    sol1
6. Edit the  /etc/inet/hosts file and add this line:
   10.0.0.153    sol1
   and also modify this line:
   127.0.0.1 localhost.localdomain localhost sol1
   
7. Edit the /etc/defaultdomain file  (if it doesn't exist, create it), just write this line:
   corp.contoso.com
8.  Edit the /etc/netmasks file and add this line
   10.0.0.0    255.255.255.0
9. Edit the /etc/resolv.conf file and add:
   search corp.contoso.com
   nameserver 10.0.0.1
10. Verify that the /etc/nsswitch.conf is configured to resolve hosts using dns (add if necessary)
    cat /etc/nsswitch.conf | grep dns   You should see results for hosts and ip nodes, if not, add these lines:
    hosts:    files dns
    ipnodes:  files dns
11. You may have to restart the server (if you changed the /etc/nsswitch.conf file or restart the network (svcadm restart physical).
12. Verify the configuration  (hostname, DNS configuration, ping test to crl.corp.contoso.com)
    # hostname
    sol1
    # cat /etc/resolv.conf    (look for the two lines below)
    search corp.contoso.com
    nameserver 10.0.0.1
    # ping crl
    crl is alive
13. This verifies that the TCP/IP configuration is correct and that SOL1 is using DC1 for DNS.
14. Verify that the NSCD daemon is running$ svcs \*name-service-cache\*STATE          STIME    FMRIonline         Dec_24   svc:/system/name-service-cache:default
15. Create a couple of users useradd -m centrifying
    useradd -m -c "Jesse Matthews" jmatthews

Modify the UNIX/Linux to skip the graphical interface

We don't need to run the platforms in graphical mode since these systems are purposed as servers.

On CEN1 and SUSE1

1. Log in as a privileged user (or root) and open a terminal
2. Edit the /etc/inittab
   id:3:initdefault:
3.  Reboot the server to start in Multi-user, server mode.

 On SOL1

1. Log in as a privileged user (or root) and open a terminal
2. Disable the graphical interface
   /usr/dt/bin/dtconfig -d
3.  CDE or Java desktop have been disabled.

 Test connectivity from CLIENT1 using PuTTY

1.  Log on to CLIENT1 with a domain user
2. Open PuTTY and try to connect to the UNIX/Linux hosts.
3. Optional:  Create Saved Connections to each host.

Note:  It is not recommended that you allow root login over SSH in production systems.  If you prefer to dot his in your lab (which you should not, to develop good habits), you nee to make sure that the /etc/ssh/sshd_config file has the PermitRootLogin parameter set to yes.

 Copy the Centrify agent to each system

1.  Open Windows Explorer and browse to \\APP1\Files
2. From CLIENT1, open WinSCP
3.  Connect to CEN1.  Create a temp folder in the root of the filesystem /
4. Open /temp
5. Drag the file centrify-suite-2013.3-rhel3-x86_64.tgz (from the \\APP1\Files explorer window) into the /temp window in WinSCP and click copy.
6. Repeat the process for the next two files:
   centrify-suite-2013.3-sol9-x86.tgz goes into /temp of SOL1
   centrify-suite-2013.3-suse9-x86_64.tgz goes into /temp of SUSE1
7. Log-off CLIENT1

Lab End State

Lab # 1: Modifying the Base Configuration TLG

Lab Overview
In this lab we will modify Microsoft's Base Configuration Test Lab Guide to:

1. Remind customers to change their passwords 30 days before expiration
2. Set up a network login banner for the domain clients
3. Assign the 10.0.0.0/24 Subnet to the Default AD Site
4. Rename the Default AD Site to CorpHQ
5. Create A records for the Unix/Linux hosts
6. Create a Reverse-lookup Zone for the corp.contoso.com  (10.0.0./24)
7. Install and enable the Remote Server Administration Tools (RSAT) for Windows 7 SP1 on CLIENT1
8. Install PuTTY and WinSCP on CLIENT1 
9. Create a sample users
10. Obtain and copy the Centrify Server suite and Agents to the Files share in APP1

The purpose roles of the TLG stay the same:

• DC1 is the domain controller, DNS, DHCP server and Certificate Authority 
• APP1 is the first application server, it hosts the certificate revocation list for the CA (file and web)
• CLIENT1 is a client.  For our purposes, this will be the workstation for Unix/Linux administrators.  They will use PuTTY to access the systems via SSH.  Additionally, the Centrify Access Manager tools will be installed there.

Lab Requirements

• The requirements of the base Test Lab Guide (for DC1, APP1 and CLIENT1)

Modify Domain GPOs and Site

On DC1
To Prompt users to change the password 30 days before it expires

1. Click Start, click Administrative Tools, and then click Group Policy Management.
2. In the console tree, open Forest: corp.contoso.com\Domains\corp.contoso.com.
3. In the details pane, right-click Default Domain Policy, and then click Edit.
4. In the console tree of the Group Policy Management Editor, open Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options
5. In the details pane, double-click Interactive Logon: Prompt user to change password before expiration
6. On the Security Policy Setting tab, select Define this policy setting, type 30 (days) and then click OK.

To Set up a network login banner

1. Double-click the Interactive logon:  Message text for users attempting to log on GPO 
2. Check the box to define the policy and paste the following text:
   "This computer system is for authorized use only. Users have no explicit or implicit expectation of privacy.Any or all uses of this system and all data on this system may be intercepted, monitored, recorded, copied, audited, inspected, and disclosed to authorized sites and law enforcement personnel, as well as authorized officials of other agencies. By using this system, the user consent to such disclosure at the discretion of authorized site personnel"
3. Press OK and close the Group Policy Editor.

To Rename the AD Site

1. Click Start, click Administrative Tools, and then click Active Directory Sites and Services.
2. On the left pane, expand sites and click and right-click Subnets.
3. In the New Object - Subnet window, Under prefix, type: 10.0.0.0/24 and click the "Default-First-Site-Name" then press OK.
4. On the left pane, expand sites, and right click the "Default-First-Site-Name" site, then select Rename.
5. Rename it to CorpHQ
6. Close Active Directory Sites and Services

Create a DNS Reverse-lookup zone for the 10.0.0.0 subnet.

1. Click Start, click Administrative Tools, and then click DNS Manager.
2. On the left pane, expand the DC1 server and right click Reverse-lookup zones and select  New Zones.
3. Click Next on the wizard. and Next on the Zone Type (Primary / Stored in AD), Next in the Replication Scope, Next on the Reverse-lookup Type (IPV4)
4. In the Network ID, type 10.0.0 and click Next
5. Click Next on the Dynamic Update Page and Click Finish.
6. Leave DNS Manager open to perform the next tasks

Create A records for the Unix/Linux hosts

The IP Addresses for the UNIX systems are:

Hostname	IP Address	Role
CEN1	10.0.0.151	Database Server
SUSE1	10.0.0.152	Web Server
SOL1	10.0.0.153	Utilities Server

Click Start, click Administrative Tools, and then click DNS Manager.

1. On the left pane, expand the DC1 server and expand the Forward-lookup Zones
2. On the left pane, right-click on the corp.contoso.com zone and select New Host (A or AAA)
3. In the New Host window, type the name of the UNIX host (e.g. CEN1)
4. Type the IP Address in the corresponding field  (e.g. 10.0.0.151)
5. Check the Create associated pointer (PTR) record and click the Add Host button
6. Repeat until you have created all three records
7. Close DNS Manager and log-off

Install and enable the Remote Server Administration Tools (RSAT) for Windows 7 SP1 on CLIENT1

1. Log on to CLIENT1 with an administrative account from CORP
2. Download the RSAT SP1
   http://download.microsoft.com/download/4/F/7/4F71806A-1C56-4EF2-9B4F-9870C4CFD2EE/Windows6.1-KB958830-x64-RefreshPkg.msu 
3.  Double click the installer and click Yes when prompted.  
4. Click the I Accept button to start the installation.  When the installation is complete, click close.
5. To enable the RSAT Tools  (ADUC, GPMC, etc), open the Control Panel and click Programs and Features
6. On the left pane, click "Turn Windows features on or off
7. Expand Feature Administration Tools and check Group Policy Management
8. Expand the Remote Server Administration Tools/Role Administration Tools/AD DS and AD LDS Tools and check:
   AD DS Snap-ins and command-line tools
   AD LDS Snap-ins and command-line tools
9. Press OK
10. Stay logged into CLIENT1 to complete the next tasks

Download and Install PuTTY and WinSCP on CLIENT1

1.  Download PuTTY
2. Install PuTTY, follow the instructions.
3. In the Select Additional tasks window, check the Create Desktop Icons for all users.
4. Download WinSCP
5. Install WinSCP, follow the instructions.
   Make sure you don't select any component in the Google Chrome page.
6. Stay logged into CLIENT1

Create Sample Users
 First, Create the Staff OU

1. Click Start, click Administrative Tools, and then click Active Directory Users and Computers
2. On the left pane, right click the corp.contoso.com domain, select New->Organizational Unit
3. In the New Object window, Name field, call it Staff and Press OK.

Create the Users in the Staff OU

1. Right-click the Staff OU, select New->User
2. Fill out the First Name, Last Name based on the list below, in the user logon name, use the following format:  <firstname>.<lastname> 
   E.g. bryant.wheeler  and click next.
3. In the next window, set a password and uncheck "user must change password at next logon"
4. Optionally, set it to not expire.
5. Click next and finish.

List of sample users:

Name	Title	AD Groups
Bryant Wheeler	Windows Administrator	Domain Admins Domain Users
Jessie Matthews	UNIX Administrator	Domain Users
Cora Rodriguez	IT Security Analyst	Domain Users
Courtney Larson	IT Manager	Domain Users
Jeremy Silva	DBA UNIX	Domain Users
Ramon Jimenez	DBA UNIX	Domain Users
Doyle Russell	Web Administrator	Domain Users
Matt Sims	Web Administrator	Domain Users
Cassandra Lindsey	External Auditor	Domain Users
Ralph Baldwin	Internal Auditor	Domain Users

 Make Bryant a member of the Domain Admins group.

1. Open the Staff OU
2. Double-click Bryant Wheeler's user and go to the Member of tab.
3. Press the Add button and type Domain Admins in the box and press OK twice.
4. Close Active Directory Users and Computers.

 Obtain and copy the Centrify Server Suite software

1. To obtain access to download the software you have to contact Centrify and request a trial.
2. Download the Centrify Software:
   a) Centrify Consoles:  http://www.centrify.com/support/package-info.asp?fn=centrify-suite-2013.3-mgmt-ent-win64.zip
   b) Agent for CentOS 64bit: http://www.centrify.com/support/download.asp?asset=centrify-suite-2013.3-rhel3-x86_64.tgz
   c) Agent for Solaris x86: http://www.centrify.com/support/download.asp?asset=centrify-suite-2013.3-sol9-x86.tgz
   d) Agent for SUSE 64bit: http://www.centrify.com/support/download.asp?asset=centrify-suite-2013.3-suse9-x86_64.tgz
3. When you have the software, log on to APP1
4. Copy the consoles and agents c:\Files folder.  This will make it available via the \\app1\files share.