sudo pacman -S sssd samba krb5
yay -S realmd adcli

sudo apt install sssd sssd-tools realmd adcli krb5-user samba-common-bin oddjob oddjob-mkhomedir

# 1. Packages installed (see above)

# 2. Discover realm
realm discover inside.domusdigitalis.dev

# 3. Join domain (will prompt for Administrator password)
sudo realm join -U Administrator inside.domusdigitalis.dev

# 4. Verify join
realm list
id evan@inside.domusdigitalis.dev

sudo adcli create-user USERNAME --domain=inside.domusdigitalis.dev -U Administrator

Set-ADAccountPassword -Identity USERNAME -Reset -NewPassword (ConvertTo-SecureString "ComplexPass123!" -AsPlainText -Force)

Enable-ADAccount -Identity USERNAME
Add-ADGroupMember -Identity "Linux-Cert-Enrollers" -Members USERNAME

New-ADUser -Name "USERNAME" -SamAccountName "USERNAME" -UserPrincipalName "USERNAME@inside.domusdigitalis.dev" -Enabled $true -AccountPassword (ConvertTo-SecureString "PASSWORD" -AsPlainText -Force) -ChangePasswordAtLogon $true
Add-ADGroupMember -Identity "Linux-Cert-Enrollers" -Members USERNAME
Get-ADUser USERNAME

openssl x509 -in /etc/ssl/certs/modestus-p50-eaptls.pem -noout -subject -issuer -dates -serial

network={
    ssid="Domus-Secure"
    key_mgmt=WPA-EAP
    eap=TLS
    identity="modestus-p50.inside.domusdigitalis.dev"
    ca_cert="/etc/ssl/certs/HOME-ROOT-CA.pem"
    client_cert="/etc/ssl/certs/modestus-p50-eaptls.pem"
    private_key="/etc/ssl/private/modestus-p50-eaptls.key"
    priority=10
}

sudo sed -i '/^auth include sssd-arch/a account include sssd-arch' /etc/pam.d/system-auth

sudo su - gabriel@inside.domusdigitalis.dev

sudo mount -t nfs nas-01.inside.domusdigitalis.dev:/volume1/borg_backups /mnt/synology
mount.nfs: failed to prepare mount: No such device

uname -r
# Output: 6.18.2-arch2-1

lsmod | grep nfs
# Output: (empty - module not loaded)

# After reboot:
sudo modprobe nfs && echo "nfs" | sudo tee /etc/modules-load.d/nfs.conf
sudo mount -t nfs nas-01.inside.domusdigitalis.dev:/volume1/borg_backups /mnt/synology

sign_and_send_pubkey: signing failed for ED25519-SK ".../id_ed25519_sk_rk_d000" from agent: agent refused operation

SSH_AUTH_SOCK= ssh -v -i ~/.ssh/id_ed25519_sk_rk_d000 gabriel@10.50.10.103 2>&1 | grep FIDO
# debug1: sk_try: fido_dev_get_assert: FIDO_ERR_NO_CREDENTIALS

fido2-token -L
# /dev/hidraw3: vendor=0x1050, product=0x0407 (Yubico YubiKey OTP+FIDO+CCID)

ssh-keygen -K  # Successfully downloads resident keys

lsmod | grep nfs        # Should show nfs module
ssh modestus-p50        # Should work with PRIMARY YubiKey plugged in

# Check if OU exists
Get-ADOrganizationalUnit -Filter 'Name -eq "Linux"'

# Check existing groups
Get-ADGroup -Filter 'Name -like "Linux*"' | Select Name, GroupScope

# Check Linux-Cert-Enrollers members
Get-ADGroupMember -Identity "Linux-Cert-Enrollers"

# Check if Linux-Admins exists
Get-ADGroup -Identity "Linux-Admins" -ErrorAction SilentlyContinue

# Check users
Get-ADUser evanusmodestus
Get-ADUser gabriel

# Create OU for Linux systems
New-ADOrganizationalUnit -Name "Linux" -Path "DC=inside,DC=domusdigitalis,DC=dev"

# Create security group for research Linux devices
New-ADGroup -Name "Linux-Research-Devices" `
    -GroupCategory Security `
    -GroupScope Global `
    -Path "OU=Linux,DC=inside,DC=domusdigitalis,DC=dev" `
    -Description "Linux research workstations - allowed domain login"

# Create group for Linux admins (gets sudo)
New-ADGroup -Name "Linux-Admins" `
    -GroupCategory Security `
    -GroupScope Global `
    -Path "OU=Linux,DC=inside,DC=domusdigitalis,DC=dev" `
    -Description "Linux administrators - sudo access"

# Add users
Add-ADGroupMember -Identity "Linux-Admins" -Members "evanusmodestus"
Add-ADGroupMember -Identity "Linux-Cert-Enrollers" -Members "evanusmodestus"

# Check domain membership
realm list

# Check if user resolves
id evanusmodestus@inside.domusdigitalis.dev

# Check PAM auth (currently broken)
su - evanusmodestus@inside.domusdigitalis.dev

systemctl enable wpa_supplicant-wired@enp0s31f6  # Wired 802.1X
systemctl enable wpa_supplicant-wifi@wlan0       # WiFi 802.1X
systemctl enable dhcpcd                          # DHCP for all interfaces
systemctl disable iwd                            # Disabled - conflicts with wpa_supplicant

# Interface Recovery (when wlan0 disappears)
modprobe -r iwlmvm iwlwifi   # Unload Intel WiFi drivers
modprobe iwlwifi             # Reload drivers
ip link                      # Verify wlan0 returns

# DHCP Recovery
pkill -9 dhcpcd              # Kill all dhcpcd processes
dhcpcd -d -B wlan0           # Run foreground with debug

# Status Verification
wpa_cli -i wlan0 status      # Check auth state (should show COMPLETED)
ip addr show wlan0           # Check IP assignment
systemctl is-enabled iwd     # Confirm iwd disabled

uv run netapi ise mnt sessions
uv run netapi ise mnt sessions --details
uv run netapi ise mnt session <MAC>
uv run netapi ise mnt count
uv run netapi ise mnt version
uv run netapi ise mnt failed

uv run netapi ise dc test
uv run netapi ise dc stats
uv run netapi ise dc session C8:5B:76:C6:59:62  # Full session view
uv run netapi ise dc recent --hours 4 --limit 50
uv run netapi ise dc failed --hours 48

uv run netapi wlc get-info
uv run netapi wlc get-health
uv run netapi wlc get-aps
uv run netapi wlc get-clients
uv run netapi wlc get-wlans

uv run netapi ios show radius-servers
uv run netapi ios show aaa-groups
uv run netapi ios show vlans
uv run netapi ios exec "show access-session"

# ISE MnT
declare -a c=('ise mnt sessions' 'ise mnt count' 'ise mnt version'); for i in "${c[@]}"; do echo "--- ${i} ---"; bash -c "uv run netapi ${i}"; done

# WLC
declare -a c=('wlc get-info' 'wlc get-health' 'wlc get-aps' 'wlc get-clients' 'wlc get-wlans'); for i in "${c[@]}"; do echo "--- ${i} ---"; bash -c "uv run netapi ${i}"; done

# All policy sets with full details
for ps in "Corp WIFI" "Wired Dot1X Closed" "Guest WIFI" "IoT WIFI"; do
    uv run netapi ise get-policy-set "$ps" --rules
done

# Audit all authz profiles
for profile in Domus_Secure_Profile iPSK-Auth DenyAccess PermitAccess; do
    uv run netapi ise get-authz-profile "$profile"
done

# Check multiple endpoints
for mac in "70:15:FB:F8:47:EC" "14:F6:D8:7B:31:80"; do
    uv run netapi ise get-endpoint "$mac"
done

# Force reauth on switch
clear access-session mac 001c.2c61.9006

# Verify IP assigned
show access-session mac 00:1C:2C:61:90:06 d | include IPv4

❯ ls -la /etc/pam.d/su*
-rw-r--r-- 1 root root 495 Jan 22 15:23 /etc/pam.d/su
-rw-r--r-- 1 root root 500 Dec 15 07:26 /etc/pam.d/su-l   ← THIS IS THE PROBLEM!

echo -e "#%PAM-1.0\nauth            sufficient      pam_rootok.so\nauth            include         system-auth\naccount         include         system-auth\nsession         include         system-auth\npassword        include         system-auth" | sudo tee /etc/pam.d/su-l

❯ su - gabriel@inside.domusdigitalis.dev
Password:
[gabriel@inside.domusdigitalis.dev@modestus-p50 ~]$

# Load credentials
dsource d000 dev/network

# List posture conditions
netapi ise get-conditions --dict Session

# Create compliant check
netapi ise create-posture-condition "My_Compliant_Check" \
    --attr PostureStatus --value Compliant

# Verify creation
netapi ise get-conditions --dict Session

# Clean up
netapi ise delete-condition "My_Compliant_Check"

GM, I've AP down in Duq 2nd Floor, IP:
IP address: 10.238.1.27
MAC address: 00:50:C2:39:F1:4B
NAS IP: 10.193.144.124
NAS Port: GigabitEthernet4/0/37

#[switch logs]

DUQUE-2-1-9300>en
Password:
DUQUE-2-1-9300#show mac add add 00:50:C2:39:F1:4B
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
DUQUE-2-1-9300#show interf
DUQUE-2-1-9300#show interfaces GigabitEthernet4/0/37 status

Port         Name               Status       Vlan       Duplex  Speed Type
Gi4/0/37     User               connected    651        a-full  a-100 10/100/1000BaseTX
DUQUE-2-1-9300#show access-sessio
DUQUE-2-1-9300#show access-session int
DUQUE-2-1-9300#show access-session interface GigabitEthernet4/0/37 de
DUQUE-2-1-9300#show access-session interface GigabitEthernet4/0/37 details
No sessions match supplied criteria.

DUQUE-2-1-9300#show run int
DUQUE-2-1-9300#show run interface GigabitEthernet4/0/37
Building configuration...

Current configuration : 467 bytes
!
interface GigabitEthernet4/0/37
 description User
 switchport access vlan 651
 switchport mode access
 switchport nonegotiate
 switchport voice vlan 424
 device-tracking attach-policy DT_POLICY
 ip flow monitor IPv4_NETFLOW input
 dot1x timeout tx-period 7
 dot1x max-reauth-req 3
 source template DefaultWiredDot1xClosedAuth
 spanning-tree portfast
 spanning-tree bpduguard enable
 service-policy input QoS_Edge_Ingress
 service-policy output QoS_Edge_Egress
end

DUQUE-2-1-9300#show vlan id 651

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
651  CHLA-Medical-Devices             active    Gi1/0/6, Gi1/0/33, Gi1/0/43, Te1/1/1
                                                Gi2/0/9, Gi2/0/28, Te2/1/1, Gi3/0/8
                                                Gi4/0/11, Gi4/0/15, Gi4/0/32, Gi4/0/33
                                                Gi4/0/37, Gi5/0/4, Gi5/0/11, Gi5/0/15
                                                Gi5/0/24

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
651  enet  100651     1500  -      -      -        -    -        0      0

Remote SPAN VLAN
----------------
Disabled

Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------

DUQUE-2-1-9300#


DUQUE-2-1-9300##[devices in wrong vlan] should be IOT
DUQUE-2-1-9300#show vlan id 751

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
751  CHLA-IoT                         active    Gi1/0/40, Te1/1/1, Gi2/0/23, Gi2/0/24
                                                Gi2/0/37, Gi2/0/48, Te2/1/1, Gi3/0/31
                                                Gi3/0/36, Gi3/0/39, Gi3/0/48, Gi4/0/17
                                                Gi5/0/25

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
751  enet  100751     1500  -      -      -        -    -        0      0

Remote SPAN VLAN
----------------
Disabled

Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------

DUQUE-2-1-9300#


# add device to connect VLAN
conf t
interface GigabitEthernet4/0/37
switchport access vlan 751
exit
exit

# validate VLAN port assignment
show vlan id 751 | inc Gi4/0/37


# check for and access session
show access-session interface GigabitEthernet4/0/37 detail

DUQUE-2-1-9300#show access-session interface GigabitEthernet4/0/37 detail
            Interface:  GigabitEthernet4/0/37
               IIF-ID:  0x1DB3CCD2
          MAC Address:  0050.c239.f14b
         IPv6 Address:  Unknown
         IPv4 Address:  10.238.1.27
            User-Name:  00-50-C2-39-F1-4B
               Status:  Authorized
               Domain:  DATA
       Oper host mode:  multi-auth
     Oper control dir:  in
      Session timeout:  N/A
  Acct update timeout:  172800s (local), Remaining: 172719s
    Common Session ID:  7C90C10A000091B9EBD6F815
      Acct Session ID:  0x0000a9dd
               Handle:  0x5500083c
       Current Policy:  PMAP_DefaultWiredDot1xClosedAuth_1X_MAB


Server Policies:
           Vlan Group:  Vlan: 751
              ACS ACL: xACSACLx-IP-TEST_Medical_Temp_Monitor-697290bb


Method status list:
       Method           State
        dot1x           Stopped
          mab           Authc Success

DUQUE-2-1-9300#

# validate device responds to ping
ping -c 2 10.238.1.27
PING 10.238.1.27 (10.238.1.27) 56(84) bytes of data.
64 bytes from 10.238.1.27: icmp_seq=1 ttl=58 time=9.84 ms
64 bytes from 10.238.1.27: icmp_seq=2 ttl=58 time=18.8 ms
--- 10.238.1.27 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 9.837/14.338/18.840/4.501 ms


## [bonus netapi]

 uv run netapi ise mnt session 00-50-C2-39-F1-4B
╭───────────────────────────── ISE Session Details ─────────────────────────────╮
│ Session: 00-50-C2-39-F1-4B  |  Status: PASSED                                 │
╰───────────────────────────────────────────────────────────────────────────────╯
                      Authentication
  Username                  00:50:C2:39:F1:4B
  Method                    mab
  Protocol                  Lookup
  Timestamp                 2026-01-23T09:12:01.168-08:00
  ISE Node                  psn-1
  Session ID                7C90C10A000091B9EBD6F815

                       Network
  Client MAC                00:50:C2:39:F1:4B
  Client IPv4               10.238.1.27
  NAD IP                    10.193.144.124
  NAD Name                  DUQUE-2-1-9300
  Port                      GigabitEthernet4/0/37
  Device Type               All Device Types#SWITCH

                 Accounting
  Session ID                0000a9dd
  Status                    Interim-Update
  RX Bytes                  128
  TX Bytes                  0

                                 Endpoint
  Profiled As               medigate_Guardian_Isensix_Temperature_Sensor

-- Find all sessions for a MAC in last 7 days
SELECT * FROM RADIUS_AUTHENTICATION
WHERE calling_station_id = '00:11:22:33:44:55'
AND timestamp > SYSDATE - 7;

-- Find auth failures preceding success (brute force)
SELECT * FROM RADIUS_AUTHENTICATION
WHERE calling_station_id = '00:11:22:33:44:55'
ORDER BY timestamp DESC;

-- All devices that hit a specific policy
SELECT calling_station_id, framed_ip_address, nas_ip_address
FROM RADIUS_AUTHENTICATION
WHERE authorization_policy = 'Suspicious_Device_Policy';

# ISE - check MnT for logging config (API)
# Or SSH to ISE and check /opt/CSCOcpm/logs/

# Switches - run on core switches
show logging
show run | sec logging

# WLC
show logging

# FMC - check via GUI or API
# System > Configuration > Logging