Red Hat Security: Identity Management and Authentication

Instructions

1. Log in to the idm machine as the student user and become the root user.

   [student@workstation ~]$ ssh student@idm
   [student@idm ~]$ sudo -i
   [sudo] password for student: student
   [root@idm ~]#

2. Log in to the LAB.EXAMPLE.COM Kerberos realm as the admin user with RedHat123^ as the password.

   [root@idm ~]# kinit admin@LAB.EXAMPLE.COM
   Password for admin@LAB.EXAMPLE.COM: RedHat123^

3. List the Kerberos principals in the IdM database.

   [root@idm ~]# kadmin.local list_principals
   admin@LAB.EXAMPLE.COM
   K/M@LAB.EXAMPLE.COM
   krbtgt/LAB.EXAMPLE.COM@LAB.EXAMPLE.COM
   kadmin/admin@LAB.EXAMPLE.COM
   kadmin/changepw@LAB.EXAMPLE.COM
   ldap/idm.lab.example.com@LAB.EXAMPLE.COM
   host/idm.lab.example.com@LAB.EXAMPLE.COM
   WELLKNOWN/ANONYMOUS@LAB.EXAMPLE.COM
   dogtag/idm.lab.example.com@LAB.EXAMPLE.COM
   HTTP/idm.lab.example.com@LAB.EXAMPLE.COM
   DNS/idm.lab.example.com@LAB.EXAMPLE.COM
   ipa-dnskeysyncd/idm.lab.example.com@LAB.EXAMPLE.COM

4. Review the attributes of the admin principal.

   [root@idm ~]# kadmin.local get_principal admin
   Principal: admin@LAB.EXAMPLE.COMipa-setup-override-restrictions
   Expiration date: [never]
   Last password change: Fri Jan 27 05:25:31 EST 2023
   Password expiration date: Thu Apr 27 06:25:31 EDT 2023
   Maximum ticket life: 1 day 00:00:00
   Maximum renewable life: 7 days 00:00:00
   Last modified: Fri Jan 27 05:25:31 EST 2023 (root/admin@LAB.EXAMPLE.COM)
   Last successful authentication: [never]
   Last failed authentication: [never]
   Failed password attempts: 0
   Number of keys: 4
   Key: vno 1, aes256-cts-hmac-sha384-192:special
   Key: vno 1, aes128-cts-hmac-sha256-128:special
   Key: vno 1, aes256-cts-hmac-sha1-96:special
   Key: vno 1, aes128-cts-hmac-sha1-96:special
   MKey: vno 1
   Attributes: REQUIRES_PRE_AUTH
   Policy: [none]

5. Add a principal to the default Kerberos realm. View and then delete the principal.

   1. Add the test principal to the current realm with testprincipal123 as the password. You must include the -x ipa-setup-override-restrictions option to override the strict local IdM security restrictions.

      [root@idm ~]# kadmin.local -x ipa-setup-override-restrictions add_principal \
        -pw testprincipal123  test@LAB.EXAMPLE.COM

   2. Verify that the test principal was created.

      [root@idm ~]# kadmin.local get_principal test
      Principal: test@LAB.EXAMPLE.COM
      Expiration date: [never]
      Last password change: Fri Feb 03 04:07:06 EST 2023
      Password expiration date: [never]
      Maximum ticket life: 1 day 00:00:00
      Maximum renewable life: 7 days 00:00:00
      Last modified: Fri Feb 03 04:07:06 EST 2023 (admin/admin@LAB.EXAMPLE.COM)
      ...output omitted...

   3. Remove the test principal.

      [root@idm ~]# kadmin.local -x ipa-setup-override-restrictions \
        delete_principal test
      ...output omitted...

6. Return to the workstation machine as the student user.

   [root@idm ~]# exit
   logout
   [student@idm ~]$ exit
   logout
   [student@workstation ~]$