Pages

Things

Authenticating Active Directory users on Linux with Likewise Open

Thursday, 28th of January 2010 at 01:09:35 AM

Historically, if you wanted to use Active Directory to authenticate users on a UNIX box, you were pretty much limited to using LDAP. This works fine for some people, but it’s not particularly elegant – especially if you’re having to create users home directories all the time, which negates some of the point of centralising authentication to begin with.

I’m from a UNIX (mostly Linux) background, so I’m more at home using UNIX-alike platforms. That said, there’s a few things that Microsoft do that are particularly useful, and in my opinion AD is one of them (quiet at the back, there). Handily, there’s a project that can marry the two, and it goes by the name of Likewise.

→ Continue reading ‘Authenticating Active Directory users on Linux with Likewise Open’…

January 28th, 2010 | Tags: , , , , , , , | Category: Linux, Security, UNIX | 20 comments

IPTables: Fun with MARK

Wednesday, 27th of January 2010 at 01:52:45 PM

One thing that’s always bugged me about IPTables is the lack of a way to use groups when writing rules, which can complicate things if you’ve got a potentially large rulebase. One way round this is to use something like fwbuilder, which gives you a graphical interface not unlike Checkpoint‘s SmartDashboard GUI for their Firewall-1 devices. The downside to this, though, is that the resulting IPTables ruleset is far from legible – which, to be fair, isn’t the goal of fwbuilder – and this makes hacking about with the rules nearly impossible.

So what options are there? One way is to repeat the same rule for different sources or destinations, but this can quickly get messy, especially if there’s multiple ports involved. If there was a way we could group things together and keep them tidy, maintaining the rulebase would be a lot easier. This is where MARK comes in.

→ Continue reading ‘IPTables: Fun with MARK’…

January 27th, 2010 | Tags: , , , | Category: IPTables/Netfilter, Security | 7 comments

OpenSSH and OpenSC for Debian and Ubuntu

Wednesday, 23rd of December 2009 at 02:27:04 AM

I’m using OpenSC at the moment so that I can repurpose an otherwise unused Aladdin eToken to hold SSH keys. I could go through the process involved in setting up the token, but as this chap has already done a thorough job, I won’t go into detail.

Unfortunately, the openssh-client package from Debian (and Ubuntu) doesn’t enable OpenSC support. It’s trivial to rebuild the package with OpenSC support, but for those who don’t want to or can’t for some reason, I’ve put my rebuilt, OpenSC-enabled packages here.

Once installed, if your token is set up correctly, you should be able to get your SSH public key from the card with:-

ssh-keygen -D <card>

…which should give you something like:-

ssh-rsa AAAA .. .. .. t8/Q==
1024 65537 14233 .. .. .. 70941

You can then add your private key to a running SSH agent with:-

ssh-add -s <card>

Pop in your PIN, and ssh should function as if you were using a normally-generated key.

December 23rd, 2009 | Tags: , , , , , | Category: Security | One comment

IPTables::Log 0.0004 released

Tuesday, 22nd of December 2009 at 01:40:45 AM

I released version 0.0004 of IPTables::Log early yesterday morning, which mostly consists of test fixes.

If you’re interested, have a look at the entry on CPAN.

December 22nd, 2009 | Tags: , , , , | Category: Perl | Leave a comment
Page 3 of 3123