Red Hat Security: Identity Management and Authentication

Instructions

1. Log in to the idm machine as the student user. Authenticate to the IdM domain as the admin user and use RedHat123^ as the password:

   [student@workstation ~]$ ssh idm
   [student@idm ~]$ kinit admin
   Password for admin@LAB.EXAMPLE.COM: RedHat123^

2. List the DNS zones and servers that provide the DNS service. List the DNS records for the lab.example.com zone.

   1. List the DNS zones in the topology:

      [student@idm ~]$ ipa dnszone-find
        Zone name: lab.example.com.
        Active zone: True
        Authoritative nameserver: idm.lab.example.com.
        Administrator e-mail address: hostmaster.lab.example.com.
         ...output omitted...
        BIND update policy: grant LAB.EXAMPLE.COM krb5-self * A; grant LAB.EXAMPLE.COM krb5-self * AAAA; grant LAB.EXAMPLE.COM
                            krb5-self * SSHFP;
        Dynamic update: True
        Allow query: any;
        Allow transfer: none;
      ----------------------------
      Number of entries returned 1
      ----------------------------

   2. List the IdM servers that provide the DNS service:

      [student@idm ~]$ ipa dnsserver-find
      ---------------------
      3 DNS servers matched
      ---------------------
        Server name: idm.lab.example.com
        SOA mname override: idm.lab.example.com.
        Forwarders: 172.25.250.254
        Forward policy: only
      
        Server name: replica1.lab.example.com
        SOA mname override: replica1.lab.example.com.
        Forwarders: 172.25.250.254
        Forward policy: only
      
        Server name: replica2.lab.example.com
        SOA mname override: replica2.lab.example.com.
        Forwarders: 172.25.250.254
        Forward policy: only
      ----------------------------
      Number of entries returned 3
      ----------------------------

   3. List the DNS records in the lab.example.com zone:

      [student@idm ~]$ ipa dnsrecord-find lab.example.com
        Record name: @
        NS record: idm.lab.example.com., replica1.lab.example.com., replica2.lab.example.com.
        ...output omitted...
      
        Record name: _kerberos
        TXT record: "LAB.EXAMPLE.COM"
        ...output omitted...
      
        Record name: _ldap._tcp
        SRV record: 0 100 389 idm.lab.example.com., 0 100 389 replica1.lab.example.com., 0 100 389 replica2.lab.example.com.
        ...output omitted...
      
        Record name: idm
        A record: 172.25.250.8
        ...output omitted...

3. Delete the LDAP SRV from the lab.example.com zone. From the client machine, try to resolve the LDAP record.

   1. Review the LDAP SRV:

      [student@idm ~]$ ipa dnsrecord-show lab.example.com _ldap._tcp
        Record name: _ldap._tcp
        SRV record: 0 100 389 idm.lab.example.com., 0 100 389 replica1.lab.example.com., 0 100 389 replica2.lab.example.com.

   2. Delete the LDAP SRV:

      [student@idm ~]$ ipa dnsrecord-del
      Record name: _ldap._tcp
      Zone name: lab.example.com
      No option to delete specific record provided.
      Delete all? Yes/No (default No): Yes
      ---------------------------
      Deleted record "_ldap._tcp"
      ---------------------------

   3. Open a new terminal tab and log in to the client machine. Try to resolve the _ldap._tcp.lab.example.com SRV.

      The DNS resolution fails because the record does not exit:

      [student@workstation ~]$ ssh client
      [student@client ~]$ dig +short -t SRV _ldap._tcp.lab.example.com
      [student@client ~]$

4. On the idm machine, create the LDAP SRV and verify that you can resolve the LDAP SRV.

   1. On the first terminal tab, add the LDAP SRV:

      [student@idm ~]$ ipa dnsrecord-add lab.example.com \
        _ldap._tcp --srv-rec="0 100 389 idm.lab.EXAMPLE.COM."
        Record name: _ldap._tcp
        SRV record: 0 100 389 idm.lab.example.com.

   2. Verify that the lab.example.com zone shows the LDAP SRV:

      [student@idm ~]$ ipa dnsrecord-find lab.example.com
        Record name: @
        NS record: idm.lab.example.com., replica1.lab.example.com., replica2.lab.example.com.
      
        ...output omitted...
        Record name: _kpasswd._tcp
        SRV record: 0 100 464 idm.lab.example.com., 0 100 464 replica1.lab.example.com., 0 100 464 replica2.lab.example.com.
      
        Record name: _ldap._tcp
        SRV record: 0 100 389 idm.lab.example.com.
        ...output omitted...

   3. On the second tab, verify that you can resolve the LDAP SRV.

      The DNS service resolves the SRV, but shows only the idm machine:

      [student@client ~]$ dig +short -t SRV _ldap._tcp.lab.example.com
      0 100 389 idm.lab.example.com.

5. Ensure that the LDAP SRV is redundant.

   1. On the first tab, add the replica1 and replica2 LDAP SRVs:

      [student@idm ~]$ ipa dnsrecord-add lab.example.com _ldap._tcp \
        --srv-rec="0 100 389 replica1.lab.example.com."
        Record name: _ldap._tcp
        SRV record: 0 100 389 idm.lab.example.com., 0 100 389 replica1.lab.example.com.

      [student@idm ~]$ ipa dnsrecord-add lab.example.com _ldap._tcp \
        --srv-rec="0 100 389 replica2.lab.example.com."
        Record name: _ldap._tcp
        SRV record: 0 100 389 idm.lab.example.com., 0 100 389 replica1.lab.example.com., 0 100 389 replica2.lab.example.com.

   2. On the second tab, verify that the LDAP SRV resolves to the three replica servers:

      [student@client ~]$ dig +short -t SRV _ldap._tcp.lab.example.com
      0 100 389 replica1.lab.example.com.
      0 100 389 idm.lab.example.com.
      0 100 389 replica2.lab.example.com.

   3. Log out from the client machine:

      [student@client ~]$ logout
      Connection to client closed.

   4. Log out from the idm machine:

      [student@idm ~]$ logout
      Connection to idm closed.
      [student@workstation ~]$