A subinacl is Windows command line utility used to manage Share and NTFS permissions.
I used AMDT tool to migrate users, groups,shares and computer objects from one domain to another, during computer migration, i choose to retain old and to add new permissions so users from both domains can access to shares during migration process.
In my case source domain is source.local and destination domain is destination.local and i had shared and NTFS permsissions from both domains.
We first need to export shared and NTFS permissions to file
In order to issue SSL certificate on behalf of another user we first need Enrollment Agent Certificate,in order to create it, we need to copy Enrollment Agent certificate template.
Creating and issuing of Enrollment Agent Certificate
In Certification authority console, under Certificates templates, right click on Certificate templates-Manage
Right click “Enrollment Agent”-Duplicate template
Under Cryptography tab make sure Microsoft Enhanced Cryptography Provider V1.O is selected,minimum key size:2048
Under Request handling, check “Allow private key to be exported”
Under security tab make sure Authenticated users have rights “Read” and “Enroll”.
Right click Certificate Templates-New-Certificate Template to Issue
Select template and click OK.
Configuring certificate template for enrollment
On certificate which should be enrolled to users, right click-Properties-Issuance requirements tab
This number of authorized signatures:1
Policy type required in signature:Application policy
Application policy:Certificate request agent
Enrollment of Enrollment Agent Certificate
On your workstation machine open Certificate console,Expand Personal,right click on Certificates-All tasks-Request New Certificate
Click Next twice and select certificate we just issued-Enroll
Issuing certificate for other user
On your workstation machine open Certificate console,Expand Personal,right click on Certificates-All tasks-Advanced operations-Enroll of behalf of
In signing certificate page click browse-certificate should pop-up automatically
Select certificate you want to issue to user.
When asked for user click browse, in Location specify domain and type user for which you need to issue certificate. You can issue cert only for one user.
Enrollment agents
Enrollment agents are users who can issue certificates for other users.
On CA machine, open Certification Authority console, right click on machine name-Properties-Enrollment agents.
Here you can specify who can issue specific templates.
Powershell script for issuing multiple SSL certificates
This script issues certificated for multiple enabled AD users (search filter can be modified)
In order for user to be able to make VPN with global protect, SSL certificate needs to be installed on machine, also, username specified in certificate subject must exist on On-premise domain controller.
In this example certificates are issued from internal Certificate authority.
Generating certificate for PaloAlto firewall
We need SSL to issue certificate assigned to public DNS name of firewall.
Device-certificates-device certificates-generate
Click the checkbox next to the Certificate Name or any whitespace on that line to select it and click export certificate
File with csr extension will be created, copy that file to Certification authority machine, open cmd and run certreq -submit -attrib "CertificateTemplate:template_name" where “template_name” is the name of Certification template.
You’ll be prompted for csr file
Then select certification authority
Certificate will be created with cer extension.
Copy certificate to machine on which you created certificate request. Now
click on Device-certificates-device certificates on PaloAlto web interface, click import in bottom panel.
In the Import Certificate dialog, type the name of the pending certificate. It must match exactly the name we used when created certificate request
Importing CA root certificate
On Certificate authority open MMC-Local computer-Trusted root Certification Authority-Certificates-right click on CA certificate-all tasks-export-select Base-64 encoded
Save file with cer.extension
On PaloAlto Device-certificates-device certificates-import
Creating LDAP profile
Specify Domain controllers for user authentication
Device-server profile-Add-type:active-directory, specify Domain controllers,base DN for user search and service account and password for searching AD.
Creating Authentication profile
Device-Authentication profile-Add
Specify Login Active directory Attribute, select LDAP as type and select LDAP profile created in previous step
In Username field select Subject Alt and select Email or UserPrincipal name, this means that PaloAlto get username from SSL certificate and it will be automatically populated in GlobalProtect username field.
In Advanced tab select Security group for VPN users. Users who need VPN need to be members of this group.
Creating SSL/TLS profiles
This profile defines which SSL certificate will be used and SSL version
Device-Certificate management-SSL/TLS Service profile-Add
Specify PaloAlto SSL certificate we generated and uploaded in one of previous steps and minimal TLS version.
GlobalProtect portal configuration
Network-GlobalProtect-Portals-Add
On general page select publicy accessible interface and IP address
In Authentication tab specify SSL/TLS Service profile we created in previous step,Certificate profile and click Add
Specify authentication profile
In Agent tab,uder Agent,click Add
In Authentication tab,For Client Certificate select Local and select PaloAlto FW certificate
In External tab specify DNS name of PaloAlto firewall
Click OK, now under Agent tab-Under Trusted Root CA click Add
Network-GlobalProtect-Gateways-Add and add CA root certificate we created earlier.
Configuring GlobalProtect Gateway
Network-GlobalProtect-Portals-Gateways-Add
Specify PaloAlto firewall publicly accessible interface and IP address
Under Authentication tab select SSL/TLS Service profile and certificate profile and click Add
Select Authentication profile, set name and click OK
Under Agent tab specify tunnel settings
Under Client setting specify IP pools and Access routes
Under Network Services specify primary and secondary DNS servers
Commit changes
Generating user certificates
Now we need to create and issue SSL certificates for users who will connect to VPN using global protect
On Issuing certificate authority, in Certification authority console, right click on Certificate templates-Manage
Certification Templates console will launch, right click on template User-duplicate template.
In tab Subject Name make sure settings are as in picture bellow
In General tab select validity period, once done,click OK.
In security tab, make sure Domain users have rights to Enroll and Read.
Once all is set click OK, right click Certificate Templates-New-Certificate Template to Issue
Select template and click OK.
Installing SSL certificate on user computers
To use VPN, install GlobalProtect software,.
Open Local computer certificate store (start-run-certlm.msc).Expand Personal,right click on Certificates-All tasks-Request New certificate,select Certificate template and install certificate
Rsync, which stands for “remote sync”, is a remote and local file synchronization tool. It uses an algorithm that minimizes the amount of data copied by only moving the portions of files that have changed.It’s native linux command, but thanks to Cygwin, we can use it on Windows too.
Installing Cygwin on Windows
Cygwin is a Unix-like environment and command-line interface for Microsoft Windows.It’s a repository of open source software compiled with this dll. In other words, it’s package manager of Linux command line tools which can be run on Windows.
Download cygwin and run installation, in View select Full, in searchbox type rsync, and select rsync under Net category, check Src, and choose version under New
Do the same for openssh (Windows 10 and Server 2019 have this package shipped)
Click next to install both packages.
By default, cygwin is installed on C:\cygwin64 folder, tools are in bin folder
Creating SSH keys (keypair) on Windows
In order to copy files from Windows to Linux we need to authenticate on Linux box, either using credentials or ssh keys. I find ssh more convenient authentication type, so we need to create private and public key on Windows and copy public key to linux machine.
Creating ssh keys
Open Cygwin
Create keys
ssh-keygen
Copy content of C:\cygwin64\home\Administrator.ssh\id_rsa.pub to linux box (/root/.ssh/authorized_keys file)
In cygwin terminal type
ssh-copy-id
Test access from Windows to linux. In this example 192.168.1.11 is IP of Linux machine, userame root
ssh root@192.168.1.11
Copy files from Windows to Linux
In this example we’ll copy content of C:\inetpub folder to /data folder on Linux box
Simple copy usually is not enough, we need to set ownership and permission on the destination.
There are three basic file system permissions, or modes, to files and directories:
read (r)
write
execute (x)
Each mode can be applied to these classes:
user (u)
group (g)
other (o)
The user is the account that owns the file. The group that owns the file may have other accounts on the system as members. The remaining class, other (sometimes referred to as world), means all other accounts on the system.
To see all permissions on files and folder use following command: ls -l /folder
Following command sets read (r) for user (u),and read (r),write and execute (x) for group (g ) and set ownership to user root and group root.
rsync -avm --chmod=u=r --chown=root:root //localhost/c$/inetpub/ root@192.168.1.11:/data
ls -l /data/
total 0
dr--rwx--- 3 root root 19 Jun 22 10:22 custerr
dr-------- 4 root root 64 Jun 22 10:24 history
dr--rwx--- 3 root root 22 Jun 22 10:22 temp
dr--rwx--- 2 root root 44 Jun 22 10:22 wwwroot
Following command will give user (u) and group (g) read (r) and execute (x) permission on destination folder, and set ownership to user root and group root.
rsync -avm --chmod=ug=rx --chown=root:root //localhost/c$/inetpub/ root@192.168.1.11:/data
ls -l /data/
total 0
dr-xr-x--- 3 root root 19 Jun 22 10:22 custerr
dr-xr-x--- 4 root root 64 Jun 22 10:24 history
dr-xr-x--- 3 root root 22 Jun 22 10:22 temp
dr-xr-x--- 2 root root 44 Jun 22 10:22 wwwroot
Following command will set read (r) and write permissions to user (u),group(g) and all (o) group, ownership to user root and password root
rsync -avm --chmod=ugo=rw --chown=root:root //localhost/c$/inetpub/ root@192.168.1.11:/data
ls -l /data/
total 0
drw-rw-rw- 3 root root 19 Jun 22 10:22 custerr
drw-rw-rw- 4 root root 64 Jun 22 10:24 history
drw-rw-rw- 3 root root 22 Jun 22 10:22 temp
drw-rw-rw- 2 root root 44 Jun 22 10:22 wwwroot
To avoid copying permissions to destination, it’s enough to omit -a switch in rsync command. To copy empty directories use –rWH switches and omit -m switch.
In order to execute above command from command prompt/Powershell, add C:\cygwin64\bin to system path environmental variable
By default, LDAP communications (port 389) between client and server applications are not encrypted. This means that it would be possible to use a network monitoring device or software and view the communications traveling between LDAP client and server computers. LDAP over SSL/TLS (LDAPS-port 636) is automatically enabled when you install an Public key (PKI) infrastructure, (Certificate Authority-CA). In this post i wan’t cover installing and configuring PKI infrastructure, i’ll concentrate on enabling LDAPS on windows and configuring secure connection to Windows Domain controllers from linux machines using SSL certificates.
Creating Certificate templates
On Issuing certificate authority, in Certification authority console right click on Certificate templates-Manage
Certification Templates console will launch, right click on template Kerberos Authentication-duplicate template
In compatibility tab,make sure that for Compatibility settings Windows Server 2003 is specified
In Request handling tab, make sure Signature and encryption is selected for purpose
If you plan to import the certificate into the Active Directory Domain Services certificate store, then should also mark the private key as exportable.
In general tab, specify validity period and template name
In subject name tab make sure DNS name and Service principal nane (SPN) are checked in.
In security tab, make sure Domain controllers are added and Enroll, Read and Autoenroll (if you want this template is enrolled automatically) are set to Allow
Once all is set click OK, right click Certificate Templates-New-Certificate Template to Issue
On CA machine we issued certificate, name of this CA will be written in that certificate, so we need to export personal certificate of this CA and transfer it to Linux machine.This certificate will be used to validate certificate of Domain controller we are going to enroll in next steps.
Open Local computer certificate store (start-run-certlm.msc)
Expand Personal,right click on Certificates-All tasks-Export
Select No, do not export private key, for format select Base-64 encoded X.509 (.CER)
Save certificate to file with cer extension and move it to Linux machine
Enrolling certificate to Domain Controller
Now we need to enroll Certificate we just issued on Certification Authority machine.Go to Domain controller,open Local computer certificate store (start-run-certlm.msc)
Expand Personal,right click on Certificates-All tasks-Request New Certificate
Click Next twice and select certificate we just issued-Enroll
Exporting Domain controller certificate to Linux machine
Now we need to export this enrolled certificate to Linux machine.
Right click on certificate we just enrolled-All tasks-Export
Select No, do not export private key, for format select Base-64 encoded X.509 (.CER)
Save certificate as cer file and move it to linux machine
In case you’re using intermediate CA (as in my case), you need to export Trusted Root certification authority certificate also, again, in Computer certificate store, expand Trusted root certification authorities-click Certificates-right click om Root certificate-export
Export in same way as in previous steps
Testing LDAPS connection – Windows
Before moving to linux, let’s first test LDAP over SSL connection.
On Domain controler from command prompt, type ldp.exe, click on Connection tab-Connect..
Certification authority certificate is exported to /etc/pki/tls/certs/issuingca.cer,domain controller certificate is exported to /etc/pki/tls/certs/dc.cer and trusted root CA to /etc/pki/tls/certs/ca.cer
Add CA Root and issuing CA certs to Linux (CentOS) ca store
A “Certificate Signing Request” (CSR) is generated using the public key and some information about the identity.
The certification authority uses information from the CSR, its own public key, authorization information, and a “signature” generated by its private key to issue a certificate.
On linux machine, create certification request including subject alternate name:
Netplan is based on YAML based configuration system that makes configuration process very simple. Netplan has replaced the old configuration file /etc/network/interfaces that we previously used for configuring network interfaces in Ubuntu.
As result, i wasn’t able to set Ubuntu 18.04 VM IP address from Hyper-V host.
/usr/sbin/hv_set_ifconfig is python script which accepts IP, address, default gateway, network mask and DNS server as input parameters from Hyper-V host and edit /etc/network/interfaces file. I tried changing python script to edit /etc/netplan/50-cloud-init.yaml but it doesn’t work from Hyper-V host, so i disabled netplan completely
Edit /etc/default/grub file and add following line:
vi /etc/network/interfaces
auto eth0
iface eth0 inet static
address 192.168.0.10
netmask 255.255.255.0
gateway 192.168.0.1
broadcst 192.168.0.255
dns-nameservers 192.168.0.2 192.168.0.3
dns-search lan
Although we specified DNS servers in /etc/network/interfaces, it will be overwritten on reboot, to set DNS server permanently, edit /etc/systemd/resolved.conf :
Let’s presume we have some PowerShell script for editing DNS entry, and we need to run it as Scheduled Task under some service account .
Add service account “Log on As Batch Job” right by using GPO:
Click START and type Group Policy then click on Group Policy ManagementEither edit the existing GPO that contains existing USER RIGHTS ASSIGNMENT (likely Default Domain Policy) or right click and CREATE AND EDIT a new policy
Expand Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment node
Double click Log on as a batch job
Click the Add User or Group button and add your service account user
In case you still get “This Task Requires That The User Account Specified Has Log On As Batch Job Rights” warning in task scheduler, add user to Backup Operators group.
Then add user to DNSAdmins group.
If script needs to be executed from remote machine:
Enabling Remote Management
add service account to WinRMRemoteWMIUsers__ on the DNS Server/DC.
On the Windows desktop, right-click Windows PowerShell on the taskbar, and then click Run as Administrator.
On the Windows start screen, right-click Windows PowerShell, and then on the app bar, click Run as Administrator.
type the following, and then press Enter to enable all required firewall rule exceptions.
Configure-SMremoting.exe -enable
Open Computer Management: start > run > compmgmt.msc
Expand Services and Applications – right click WMI Control – Properties – Security tab – click Security
Add service account
In the applies to, choose “this namespace and subnamespace” and Click “Allow” for Execute Methods and Enable Account.
If script needs to be run remotely, click “Allow” also for Remote Enable
For remote access:
In WMI Control expand root – cimv2 – Security
Add the group WinRMRemoteWMIUsers__ as the principal, then click ok.
In the applies to, choose “this namespace and subnamespace”
Add service account and Click “Allow” for Execute Methods, Enable Account and Enable Remote
Restart Windows Management Instrumentation service
Choose Generation 2 because legacy hardware, like the tulip NIC are no longer supported, gen 2 will avoid the use of legacy hardware emulation.
Specify Memory, Disk and VM name, after machine is create it will be turned off. Right click VM – Settings.. – Security Secoore Boot Enabled Select Microsoft UEFI Certificate Authority under Template
Start VM
Select “Edition” you want to install
VM will be installed
Server 2012 R2
Specify Generation 2, allocate memory and HDD space,don’t turn on VM. While VM is turned off, in VM properties select Firmware-Secure Boot, uncheck “Enable Secure Boot
