Day 9 Flashcards
Lightweight Directory Access Protocol (LDAP)
an open standard protocol for accessing object oriented databases.
LDAP defines how clients acess the directory server and perform database operations over an IP network.
Uses port 389
LDAP encompasses 4 models:
the information model, naming model, functional model, security model
information model
objects- most fundamental item in a directory attributes- characteristics of objects schema- set of rules or structure that defines objects classes-logical grouping of objects container- used for organizing objects, but cannot have ...........group policies linked directly to them organizational unit (OU)- used for organizing objects ............and can have group policies linked to them domains-contain OU's, containers, and objects User Principal Name- May be used as user logon name .........for the domain. Combines username and DNS ..........name; commonly used as an email address
naming model
distinguished name (DN)-- full name--- contains the relative distinguished name (RDN) and location within the LDAP directory. contains every piece after what is asked for.
Relative distinguished name (RDN) – Common Name– portion of the name that does not relate to the directory strucuture.
portion of the name that applies
object class identifiers as defined in RFC-1777
DC- domain component
OU- Organizational Unit Name
CN- Common Name
functional model
provides information that details what can be done with the database.
authentication—bind is the primary operation
Interrogation–search is the primary operation
update–add, modify, and delete
security model
how directory information is protected
active directory fundamentals
Active Directory is Microsoft’s implementation of LDAP directory services.
AD is contained in the %systemroot%\NTDS\Ntds.dit database file
benefits of active directory
flexible querying integration with DNS extensibility policy-based administration scalability replication security interoperability
Domains
serve as boundries for authentication and policy
domain controller
installing Active Directory on a Windows server makes it a domain controller
member server
Window’s servers that do not have AD installed are called member servers
replication
required when a domain has multiple domain controllers to maintain data conformity
sites
used to represent the physical topology of the network
Benefits of sites
Enables clients to efficiently discover services that are close
Enables network traffic control to optimize replication between domain controllers
Enables policy application
Benefits of sites
Enables clients to efficiently discover services that are close
Enables network traffic control to optimize replication between domain controllers
Enables policy application
forest
one or more domains sharing a common schema, where the first domain created is the forest’s root domain.
(a collection of tree’s)
tree
consists of one or more domains that may be grouped together to form a hierarchical structure.
(a hierarchical collection of domains.)
child domains within a tree must have contiguous namespaces that build upon the parents
domain controller ports
unsecure secure
kerberos 88 464
LDAP 389 636
global catalog 3268 3269
member server ports
ftp control 21 SMTP 25 DNS 53 DHCP 67/68 HTTP 80
workstation ports
RCP 135
NETBios 137, 138, 139
SMB 445
trusts
a trust relationship established between domains to enable users in one domain to access resources in another domain
type of trusts
transitive trusts
non-transitive trusts
transitive trust
automatic
when domain A trusts domain B an ddomain B trusts domain C, then A can access resources in C if they have correct permissions
non-transitive trusts
external trusts configured manually
forest- between two forests, manually created
shortcut- between two distant child domains; improves login
external- access between two active directory domains located in different forests
domain wide queries
microsoft implements LDAP as Active directory, so when a client queries for resources within the domain, LDAP port 389 is used.
- client queries DNS for LDAP SRV record.
- once the LDAP service is identified, client connects to port 389
USER->DNS->SRV->LDAP
forest-wide queries
requires a global catalog (GC)
uses port 3268 or 3269 (SSL)
GC is implemented on one or more domain controlers.
Uses distinguished names to identify the location of ………..every object in the forest.
steps for a forest-wide query
- client queries DNS for GC SRV record.
- client connects to port 3268 or 3269. Connection is made to a domain controller running the GC service.
USER->DNS->SRV->GC
domain login
adds 4 steps to the workstation login in
- LSA uses kerberos.dll to send credentials to domain controller
- domain controller lsass.exe uses kdcsvc.dll to verify credentials with AD
- if credentials match, KDSVC.dll returns back to workstation.
- workstation LSA creates AT
see chart on page 139 for full process
kerberos
the primary authentication package used in Windows Domain (AD)
based on RFC 1510
uses port 88 on TCP and UDP
advantages of kerberos
provides faster authentication
provides single sign-on between active directory systems
Key Distribution Center (KDC)
domain controllers act as KDC’s. The LSA uses kdcsvc.dll to provide two main services, authentication service and ticket granting service
authentication service (AS)
receives pre-authentication data, consctructs a ticket granting ticket and sends back to client
Ticket Granting Ticket (TGT)
TGT is a ticket that enables secure transport of credentials between the KDC and the client.
lasts for 10 hours
Ticket Granting Service (TGS)
TGS receives the TGT and session key from the client.
The TGS constructs a service ticket used for admission to the requested resource/service and returns to client
Service Ticket (ST)
ST is used to authenticate with services other than TGS and is meant only for requested resource/service
krbtgt account
krbtgt is the KDC account used to encrypt the TGT
Session Key (SK)
password hash of the user account is used to encrypt the session key
authentication service exchange
Kerberos AS Request (KRB_AS_REQ
- AS_REQ ———–>
pre-authentication info
kerberos AS Response (KRB_AS_REP)
kerberos TGS Request (KRB_TGS_REQ)
TGS_REQ——–>
TGT+Service
kerberos TGS Response (KRB_TGS_REP)
