Red Hat Security: Identity Management and Authentication

Instructions

1. Use the IdM web UI to create a user according to the following information:

   Field	Value
   User login	idmuser07
   First name	idmuser07
   Last name	idm
   New Password and Verify Password	RedHat123^

   1. On workstation, open a browser and navigate to the IdM web UI at https://idm.lab.example.com. Authenticate as the admin user with RedHat123^ as the password.

   2. As the admin user, navigate to Identity → Users → Active users and then click Add.

      Create the user according to the following information. Leave all other fields untouched.

      Field	Value
      User login	idmuser07
      First name	idmuser07
      Last name	idm
      New Password and Verify Password	RedHat123^

      Click Add to create the user.

   Hide Solution

2. On the client machine, change the idmuser07 user shell to /bin/bash.

   1. Authenticate to IdM as the admin user, using RedHat123^ as password:

      [student@workstation ~]$ ssh client
      [student@client ~]$ kinit admin
      Password for admin@LAB.EXAMPLE.COM: RedHat123^

   2. Modify the idmuser07 user login shell:

      [student@client ~]$ ipa user-mod --shell=/bin/bash idmuser07
      -------------------------
      Modified user "idmuser07"
      -------------------------
        User login: idmuser07
        First name: idmuser07
        Last name: idm
        Home directory: /home/idmuser07
        Login shell: /bin/bash
        Principal name: idmuser07@LAB.EXAMPLE.COM
        Principal alias: idmuser07@LAB.EXAMPLE.COM
        Email address: idmuser07@lab.example.com
      ...output omitted...

   3. Log out from the client machine:

      [student@client ~]$ logout
      Connection to client closed.

   Hide Solution

3. Create a host-based access control (HBAC) rule called allow_ssh that allows the idmuser07 user SSH access to the client machine. Make sure that the allow_all rule is disabled.

   1. In the IdM web UI navigate to Policy → Host Based Access Control → HBAC Rules and click Add to create a rule.

      When prompted, create a rule named allow_ssh and then click Add and Edit to edit the HBAC rule.

   2. In the Who section, ensure that Specified Users and Groups is selected and then click Add.

   3. Select the idmuser07 user and then click Add to move the user to the Prospective column. Click Add to update the users list.

      In the Accessing section, ensure that Specified Hosts and Groups is selected and then click Add. Select the client.lab.example.com host from the Available list and move the host to the Prospective column.

      Click Add to update the hosts list.

   4. In the Via Service section, ensure that Specified Services and Groups is selected and then click Add. Enter ssh into the search field and then click Filter. Select the sshd entry and click the Add arrow to move the service to the Prospective column. Click Add.

   5. Ensure that the allow_all rule is disabled. Navigate to Policy → Host Based Access Control → HBAC Rules. If necessary, select the allow_all rule, click Disable, and then click OK.

   Hide Solution

4. Ensure that the idmuser07 user can log in to the client machine. Authenticate to IdM using RedHat123^ as the password.

   1. Log in to the client machine as the idmuser07 user. Request a Kerberos ticket for the idmuser07 user. When prompted, enter RedHat123^ as the password:

      [student@workstation ~]# ssh idmuser07@client
      [idmuser07@client ~]$ kinit idmuser07
      Password for idmuser07@LAB.EXAMPLE.COM: RedHat123^

   2. Log out from the client machine:

      [idmuser07@client ~]$ logout
      Connection to client closed.

   Hide Solution

5. On the client machine, authenticate to IdM as the admin user. Create the mgmt group and add the idmuser07 user as a member. Create a Mgmt attr delegation for the mgmt group so that the members of this group can modify the manager and employeetype attributes of the idmgroup02 group.

   1. Log in to the idm machine and authenticate to IdM as the admin user. Use RedHat123^ as the password:

      [student@workstation ~]$ ssh client
      [student@client ~]$ kinit admin
      Password for admin@LAB.EXAMPLE.COM: RedHat123^

   2. Create the mgmt group:

      [student@client ~]$ ipa group-add mgmt
      ------------------
      Added group "mgmt"
      ------------------
        Group name: mgmt
        GID: 1285800015

   3. Add the idmuser07 user to the mgmt group:

      [student@client ~]$ ipa group-add-member \
        --users=idmuser07 mgmt
        Group name: mgmt
        GID: 1285800015
        Member users: idmuser07
      -------------------------
      Number of members added 1
      -------------------------

   4. Add a new delegation for the mgmt group so that members of this group can modify attributes of members of the idmgroup02 group:

      [student@client ~]$ ipa delegation-add "Mgmt attr" \
        --attrs=manager --attrs=employeetype \
        --group=mgmt --membergroup=idmgroup02
      --------------------------------
      Added delegation "Mgmt attr"
      --------------------------------
        Delegation name: Mgmt attr
        Permissions: write
        Attributes: manager, employeetype
        Member user group: idmgroup02
        User group: mgmt

   Hide Solution

6. Create a staged user account for a new user, and set the authentication type to otp. Use the following information to create the account:

   Field	Value
   User login	idmuser08
   First name	idmuser08
   Last name	idm
   New Password and Verify Password	RedHat123^

   1. Add the new staged user:

      [student@client ~]$ ipa stageuser-add idmuser08 \
        --first=idmuser08 \
        --last=idm \
        --password
      Password: RedHat123^
      Enter Password again to verify: RedHat123^
      -----------------------------
      Added stage user "idmuser08"
      -----------------------------
        User login: idmuser08
        First name: idmuser08
        Last name: idm
        Full name: idmuser08 idm
        Display name: idmuser08 idm
        Initials: ii
        Home directory: /home/idmuser08
        GECOS: idmuser08 idm
        Login shell: /bin/sh
        Principal name: idmuser08@LAB.EXAMPLE.COM
        Principal alias: idmuser08@LAB.EXAMPLE.COM
        Email address: idmuser08@lab.example.com
      ...output omitted...
        Password: True
        Kerberos keys available: True

   2. Set the authentication type to otp.

      [root@idm ~]# ipa stageuser-mod --user-auth-type=otp idmuser08
      --------------------------------
      Modified stage user "idmuser08"
      --------------------------------
        User login: idmuser08
        First name: idmuser08
        Last name: idm
        Home directory: /home/idmuser08
        Login shell: /bin/sh
        Principal name: idmuser08@LAB.EXAMPLE.COM
        Principal alias: idmuser08@LAB.EXAMPLE.COM
      ...output omitted...
        User authentication types: otp
        Password: True
        Kerberos keys available: True

   3. Log out from the client machine:

      [student@client ~]$ logout
      Connection to client closed.

   Hide Solution