SAML

Download SAML Tech article

SAML

How to enable SSL connection in the Active Directory Server?

Certificate Services

Certificate Services is included with Windows Server 2003 but not installed by default. The service is used to issue and manage certificates for a Public Key Infrastructure (PKI).

Certificate Services allows a computer running Windows Server 2003 to receive requests for certificates from users and computers, verify the identity of a requestor, issue and revoke certificates, and publish a Certificate Revocation List (CRL).

Install the IIS Service

In order to install the CA you will first need to install IIS on a Windows Server 2003 computer.

1. Click Start > Control Panel > Add or Remove Programs.

2. In Add or Remove Programs, click Add/Remove Windows Components.

3. Under Components, click on Application Server (but do NOT select it) and press on the Details button.

4. In the Application Server window click to select IIS and click Ok.

5. Click Next

Enabling LDAP SSL Connection through Certificates:-

1. Log on as a member of both the Enterprise Admins group and the root domain's Domain Admins group.(Administrator)

2. Go to Settings > Control Panel > Select Add/Remove Programs > Click Add/Remove Windows Components.

3. In the Windows Components Wizard, select the Certificate Services check box. A dialog box appears to inform you that the computer cannot be renamed and that the computer cannot be joined to or removed from a domain after Certificate Services is installed. Click Yes, and then click Next

4. Click Enterprise root CA and then click next

5. Give the common name (LDAPCertificate) for the CA, and then click next

6. In the Certificate Database Settings page, Click next

If you have IIS Server then the Pop up will be displayed to stop IIS Service. Click “Yes” Enable ASP Pages, by click “Yes”

7. When the installation process is completed click Finish.

8. Restart your machine (DC)

Download Microsoft Support Tools from the Microsoft site.

Download: http://www.microsoft.com/downloads/details.aspx?FamilyId=6EC50B78-8BE1-4E81-B3BE-4E7AC4F0912D&displaylang=en

Install Microsoft tools and Go to Start > Run > cmd > ldp.exe > Open

Server: DC Machine Address Port: 636, SSL

2. How to establish a connection between LDAP clients to AD Server?

We can establish SSL connection between LDAP client and AD Server with the help of importing trusted root CA certificate into the client’s environment.

AD Server Side:

1. Start Microsoft Management Console (MMC).

2. Add the Certificates snap-in that manages certificates on the local computer

3. Expand Certificates (Local Computer), expand Trusted Root Certificate authorities

4. Select LDAPCertificate > Right Click > select All Tasks ( Export )

5. “Welcome to Certificate export Wizard” , click next

6. Select Cryptographic Message Syntax Standard PKCS #6 Certificates (.P7B format) , select include all certificates in the certification path if possible option , Click Next

7. Give the file name ( LDAP ) ,Click Next button

8. Click finish export wizard

Client:

1. Copy LDAP.p7b file from AD Server and paste it in the Client machine

2. Double click to open P7b certificate and select LDAPCertificate

3. do right click and select install option to install Third party certificate authority

4. Follow the instruction to complete the process.

Install Microsoft tools and Go to Start > Run > cmd > ldp.exe > Open

SSL Connection works …!

Turning off ping responses in RHEL5

There are so many processes to block ICMP ping in RHEL5. This process is about “How to block ICMP packets through Kernel Configuration?”

Persistent system configuration : sysctl -a (Lists all current kernel settings)
Settings a /proc value dynamically : sysctl –w (Kernel settings)
Reloading Kernel settings : sysctl –p

To block ICMP packets : /proc/sys/net/ipv4/icmp_echo_ignore_all
: Search for sysctl –a grep net।ipv4।icmp_echo_ignore_all

set the value
Sysctl –w net.ipv4.icmp_echo_ignore_all=1

Ping “IPAddress”
PING 192.168.x.x (192.168.x.x) 56(84) bytes of data.
No response...

Sysctl –w net.ipv4.icmp_echo_ignore_all=0

PING 192.168.x.x (192.168.x.x) 56(84) bytes of data.
64 bytes from 192.168.x.x: icmp_seq=1 ttl=64 time=0.889 ms

--- 192.168.x.x ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4002ms
rtt min/avg/max/mdev = 0.079/0.261/0.889/0.315 ms

If you want to make this persistent across reboots..!

Edit /etc/sysctl.conf
Search for net.ipv4.icmp_echo_ignore_all
Change the value to 1 or 0 as per your requirement.
Update your system kernel settings : Sysctl –p
Shutdown –r now

Ping “IPAddress”
PING 192.168.x.x (192.168.x.x) 56(84) bytes of data.
No response ...

Creating a Private Repository In RHEL5 and installing Packages with yum

To create a private repositroy in RHEL5 the following package should be installed in your system.

Createrepo *.rpm file - To know the package is installed in your system or not ?
rpm –qa grep createrepo* (or) rpm-q createrepo
To install it : rpm –ivh createrepo*।rpm

rpm –qa grep yum* (or) rpm-q yum
To install it : rpm –ivh yum*.rpm (All Packages)


Run command createrepo –v /package/RPMS
(Put all your packages in /var/www/html/(Create Directory for RPM packages) and start your http server by executing the command service httpd start or chkconfig –level 12345 httpd on
Or
Put all your packages in var/ftp/pub/RPMS and start your ftp server with service vsftpd start or chkconfig –level 35 vsftpd on)

Ex:- createrepo –v /var/www/html/RPMS
Do http://localhost/RPMS/ (firefox)

You have created a repoistory.

Configuring yum package manager

Create a file in /etc/yum।repos.d for your repository.

Enter the following infromation
[RHEL RPM Repositroy ]
Name = private
Baseurl= URL of RPM packages (http://localhost/RPMS)
Enabled=1
Gpgcheck=0 or 1 (local system 0 ) or (GNU Public license if gpgcheck is 1)

Test it with ...yum list anypackage
You can install your packages by typing ....yum install *anypackage*

Troubleshooting concepts: Linux: Setting up a static IPAddress

System to configure static networking rather than Dynamic IPAddress
Before going to set static addressing , Please note down the following things in your network

1. IP Address of the machine
2. NETMASK and GATEWAY
3. Routing ( Default via 192.168.1.x dev eth0)
4. nameserver in the /etc/resolv.conf

1. search domain.com
2. nameserver 192.168.1.x

Bring down your network .....with ifdown eth0
Change the contents of /etc/sysconfig/network-scripts/ifcfg-eth0

Device=eth0
BOOTPROTO=None #( Don’t forget to change it from dhcp to none)
ONBOOT=yes

#Add IPAddress here :
IPADDR=192.168.1.x
#Add NETMASK
NETMASK=255.255.255.0
#Add GATEWAY
GATEWAY: 192.168.1.x

Make sure that your hostname is correct.
Open your /etc/sysconfig/network and check your hostname
HOSTNAME=Example

Verify that hostname can be resolved with out using DNS
127.0.0.1 localhost.localdomain localhost
192.168.1.2 example example.example.com

Bring up eth0 ...............ping machine...............it works ...!
Restart your machine with : shutdown -r now
ping machine.........it works...!