Linux AD Authentication dACL Runbook

dsource d000 dev/network

# ISE Deployment Nodes
netapi ise api-call openapi GET '/api/v1/deployment/node' | \
  jq -r '.response[] | "\(.hostname) - \(.roles | join(", "))"'

ise-01 - PrimaryAdmin, PrimaryMonitoring

# Policy Sets with status indicators and hit counts
echo -e "\e[1;37m  #  POLICY SET                    HITS    STATE\e[0m"
echo -e "\e[90m  ─────────────────────────────────────────────────\e[0m"
netapi ise api-call openapi GET '/api/v1/policy/network-access/policy-set' | \
  jq -r '.response[] | "\(.rank)|\(.name)|\(.hitCounts // 0)|\(.state)"' | \
  while IFS='|' read rank name hits state; do
    if [[ "$state" == "enabled" ]]; then
      printf "  \e[1;33m%d\e[0m  \e[1;36m%-28s\e[0m \e[1;32m%6s\e[0m  \e[1;32m●\e[0m\n" "$rank" "$name" "$hits"
    else
      printf "  \e[90m%d\e[0m  \e[90m%-28s\e[0m \e[90m%6s\e[0m  \e[1;31m○\e[0m\n" "$rank" "$name" "$hits"
    fi
  done

  #  POLICY SET                    HITS    STATE
  ─────────────────────────────────────────────────
  0  Domus-Wired MAB                  15  ●
  1  Domus-Wired 802.1X              103  ●
  2  Default                           1  ●

# List all dACLs (ERS API)
netapi ise api-call ers GET '/ers/config/downloadableacl' | \
  jq -r '.SearchResult.resources[] | .name'

DACL_Discovery
DACL_Research_Onboard
DENY_ALL_DACL
PERMIT_ALL_DACL

# List Authorization Profiles (ERS API, filtered)
netapi ise api-call ers GET '/ers/config/authorizationprofile' | \
  jq -r '.SearchResult.resources[] | select(.name | startswith("Domus") or startswith("Linux")) | .name'

Domus-Wired-Base
Linux-Research-AD-Auth

# Get endpoint MAC address (Linux - ISE format with dashes)
ip link show | awk '/state UP/{getline; print toupper($2)}' | tr ':' '-' | head -1

# If domain-joined, get DC from realm
realm list | grep -A5 "domain-name"

# Or from DNS SRV records
host -t SRV _ldap._tcp.inside.domusdigitalis.dev

# --- DISCOVERED VALUES (from Phase 0) ---
MAC="14:F6:D8:7B:31:80"              # From 0.6 - endpoint MAC
DC_IP="10.50.1.50"                   # From 0.7 - domain controller IP
POLICY_SET="Wired_802.1X_Closed"      # From 0.3 - target policy set

# --- dACLs (2 required) ---
DACL_ONBOARD="DACL_Research_Onboard"        # MAB onboarding - broad access
DACL_EAPTLS="Linux-Research-AD-Auth"         # EAP-TLS - AD auth, zero-trust

# --- Authorization Profiles ---
AUTHZ_ONBOARD="Linux_Research_Onboard"
AUTHZ_EAPTLS="Linux-Research-AD-Auth"

# --- LOGGING ---
LOGFILE="/tmp/ise-dacl-validation-$(date +%Y%m%d-%H%M%S).log"

echo "Variables set | ISE: $ISE_PAN_IP | MAC: $MAC"
echo "  dACLs: $DACL_ONBOARD (onboard), $DACL_EAPTLS (eaptls)"
echo "  Log: $LOGFILE"

Variables set | ISE: 10.50.1.20 | MAC: 14:F6:D8:7B:31:80
  dACLs: DACL_Research_Onboard (onboard), Linux-Research-AD-Auth (eaptls)
  Log: /tmp/ise-dacl-validation-20260213-143052.log

echo "=== ISE dACL Validation Log ===" | tee "$LOGFILE"
echo "Started: $(date)" | tee -a "$LOGFILE"
echo "Target: $MAC | DC: $DC_IP | Policy Set: $POLICY_SET" | tee -a "$LOGFILE"
echo "" | tee -a "$LOGFILE"

echo "=== 1.1 Policy Sets ===" | tee -a "$LOGFILE"
netapi ise get-policy-sets 2>&1 | tee -a "$LOGFILE"

echo "" | tee -a "$LOGFILE"
netapi ise get-policy-set "$POLICY_SET" 2>&1 | tee -a "$LOGFILE"

DNS (53/tcp)....... OK
Kerberos (88/tcp).. OK
LDAP (389/tcp)..... OK
LDAPS (636/tcp).... OK
GC (3268/tcp)...... OK
SMB (445/tcp)...... OK

echo "" | tee -a "$LOGFILE"
echo "=== 1.3 ISE Object Pre-Flight ===" | tee -a "$LOGFILE"
{
  echo "--- dACLs (2 required) ---"
  for dacl in "$DACL_ONBOARD" "$DACL_EAPTLS"; do
    echo -n "  $dacl... "
    if netapi ise get-dacl "$dacl" >/dev/null 2>&1; then
      echo "EXISTS"
    else
      echo "NOT FOUND (will create)"
    fi
  done

  echo "--- Authorization Profiles ---"
  for profile in "$AUTHZ_ONBOARD" "$AUTHZ_EAPTLS"; do
    echo -n "  $profile... "
    if netapi ise get-authz-profile "$profile" >/dev/null 2>&1; then
      echo "EXISTS"
    else
      echo "NOT FOUND (will create)"
    fi
  done

  echo "--- Authz Rule in $POLICY_SET ---"
  echo -n "  Rule for $AUTHZ_EAPTLS... "
  if netapi ise get-authz-rules "$POLICY_SET" 2>/dev/null | grep -q "$AUTHZ_EAPTLS"; then
    echo "EXISTS"
  else
    echo "NOT FOUND (will create)"
  fi
} 2>&1 | tee -a "$LOGFILE"

echo "" | tee -a "$LOGFILE"
echo "=== 1.4 Endpoint Session ===" | tee -a "$LOGFILE"
netapi ise mnt session "$MAC" 2>&1 | tee -a "$LOGFILE"

echo "" | tee -a "$LOGFILE"
echo "--- Auth History ---" | tee -a "$LOGFILE"
netapi ise dc auth-history "$MAC" --limit 5 2>&1 | tee -a "$LOGFILE"

echo "" | tee -a "$LOGFILE_EP"
echo "=== 1.5 Domain Join ===" | tee -a "$LOGFILE_EP"
realm list 2>&1 | tee -a "$LOGFILE_EP"

sudo realm join inside.domusdigitalis.dev -U Administrator

echo "" | tee -a "$LOGFILE_EP"
echo "=== 1.7 Certificate ===" | tee -a "$LOGFILE_EP"
HOSTNAME=$(hostname -s)
openssl x509 -in /etc/ssl/certs/$<your-hostname>-eaptls.pem -noout -subject -issuer -dates 2>&1 | tee -a "$LOGFILE_EP"

echo "" | tee -a "$LOGFILE_EP"
echo "=== 1.8 802.1X Status ===" | tee -a "$LOGFILE_EP"
nmcli connection show --active 2>&1 | tee -a "$LOGFILE_EP"

echo "" | tee -a "$LOGFILE"
echo "=== 1.9 ISE Connectivity ===" | tee -a "$LOGFILE"
netapi ise mnt version 2>&1 | tee -a "$LOGFILE"

echo "" | tee -a "$LOGFILE"
echo "--- Active Sessions ---" | tee -a "$LOGFILE"
netapi ise mnt sessions 2>&1 | tee -a "$LOGFILE"

echo "" | tee -a "$LOGFILE"
echo "=== 2.3 Create dACLs ===" | tee -a "$LOGFILE"

# --- Create Onboard dACL ---
if netapi ise get-dacl "$DACL_ONBOARD" >/dev/null 2>&1; then
  echo "SKIP: $DACL_ONBOARD already exists" | tee -a "$LOGFILE"
else
  netapi ise create-dacl "$DACL_ONBOARD" \
    --file /tmp/dacl-onboard.txt \
    --descr "MAB onboarding - broad access for domain join" 2>&1 | tee -a "$LOGFILE"
  echo "Created: $DACL_ONBOARD" | tee -a "$LOGFILE"
fi

# --- Create EAP-TLS dACL ---
if netapi ise get-dacl "$DACL_EAPTLS" >/dev/null 2>&1; then
  echo "SKIP: $DACL_EAPTLS already exists" | tee -a "$LOGFILE"
else
  netapi ise create-dacl "$DACL_EAPTLS" \
    --file /tmp/dacl-eaptls.txt \
    --descr "EAP-TLS zero-trust - AD auth, no lateral movement" 2>&1 | tee -a "$LOGFILE"
  echo "Created: $DACL_EAPTLS" | tee -a "$LOGFILE"
fi

echo "" | tee -a "$LOGFILE"
echo "=== 2.4 Verify dACLs ===" | tee -a "$LOGFILE"

for dacl in "$DACL_ONBOARD" "$DACL_EAPTLS"; do
  echo "--- $dacl ---" | tee -a "$LOGFILE"
  netapi ise get-dacl "$dacl" 2>&1 | tee -a "$LOGFILE"
  echo "" | tee -a "$LOGFILE"
done

echo "" | tee -a "$LOGFILE"
echo "=== 2.5 Create Authz Profiles ===" | tee -a "$LOGFILE"

# --- Onboard Profile ---
if netapi ise get-authz-profile "$AUTHZ_ONBOARD" >/dev/null 2>&1; then
  echo "SKIP: $AUTHZ_ONBOARD already exists" | tee -a "$LOGFILE"
else
  echo "-> Creating: $AUTHZ_ONBOARD..." | tee -a "$LOGFILE"
  netapi ise create-authz-profile "$AUTHZ_ONBOARD" \
    --vlan DATA_VLAN \
    --dacl "$DACL_ONBOARD" \
    --descr "MAB onboarding - broad access for domain join" 2>&1 | tee -a "$LOGFILE"
fi

# --- EAP-TLS Profile ---
if netapi ise get-authz-profile "$AUTHZ_EAPTLS" >/dev/null 2>&1; then
  echo "SKIP: $AUTHZ_EAPTLS already exists" | tee -a "$LOGFILE"
else
  echo "-> Creating: $AUTHZ_EAPTLS..." | tee -a "$LOGFILE"
  netapi ise create-authz-profile "$AUTHZ_EAPTLS" \
    --vlan DATA_VLAN \
    --dacl "$DACL_EAPTLS" \
    --descr "EAP-TLS zero-trust - AD auth only" 2>&1 | tee -a "$LOGFILE"
fi

echo "" | tee -a "$LOGFILE"
echo "=== 2.6 Verify Authz Profiles ===" | tee -a "$LOGFILE"

for profile in "$AUTHZ_ONBOARD" "$AUTHZ_EAPTLS"; do
  echo "--- $profile ---" | tee -a "$LOGFILE"
  netapi ise get-authz-profile "$profile" 2>&1 | tee -a "$LOGFILE"
  echo "" | tee -a "$LOGFILE"
done

echo "" | tee -a "$LOGFILE"
echo "=== 2.7 Existing Authz Rules ===" | tee -a "$LOGFILE"
netapi ise get-authz-rules "$POLICY_SET" 2>&1 | tee -a "$LOGFILE"

echo "" | tee -a "$LOGFILE"
echo "=== 2.8 Add Authz Rule (Dry Run) ===" | tee -a "$LOGFILE"
netapi ise add-authz-rule "$POLICY_SET" \
  "$AUTHZ_EAPTLS" \
  "$AUTHZ_EAPTLS" \
  --rank 0 \
  --dry-run 2>&1 | tee -a "$LOGFILE"

echo -n "Apply authorization rule at rank 0? [y/N] "
read REPLY
if [ "$REPLY" = "y" ] || [ "$REPLY" = "Y" ]; then
  netapi ise add-authz-rule "$POLICY_SET" \
    "$AUTHZ_EAPTLS" \
    "$AUTHZ_EAPTLS" \
    --rank 0 2>&1 | tee -a "$LOGFILE"
  echo "Rule created" | tee -a "$LOGFILE"
fi

echo "" | tee -a "$LOGFILE"
echo "=== 2.9 Verify Authz Rule ===" | tee -a "$LOGFILE"
netapi ise get-authz-rules "$POLICY_SET" 2>&1 | grep -E "$AUTHZ_EAPTLS|Rank" | tee -a "$LOGFILE"

# Check switch AAA configuration for CoA
netapi ios exec "show run aaa | section dynamic-author"

aaa server radius dynamic-author
 client 10.50.1.20 server-key <key>
 client 10.50.1.21 server-key <key>
 auth-type any

aaa server radius dynamic-author
 client 10.50.1.20 server-key <shared-secret>
 client 10.50.1.21 server-key <shared-secret>
 auth-type any

echo "" | tee -a "$LOGFILE"
echo "=== 3.1 Issue CoA ===" | tee -a "$LOGFILE"
echo "-> Forcing CoA for $MAC..." | tee -a "$LOGFILE"
netapi ise mnt coa "$MAC" 2>&1 | tee -a "$LOGFILE"

echo "Waiting 10 seconds for reauthentication..." | tee -a "$LOGFILE"
sleep 10

echo "" | tee -a "$LOGFILE"
echo "=== 3.2 New Session ===" | tee -a "$LOGFILE"
netapi ise mnt session "$MAC" 2>&1 | tee -a "$LOGFILE"

echo "" | tee -a "$LOGFILE"
echo "=== 3.3 DC Session ===" | tee -a "$LOGFILE"
netapi ise dc session "$MAC" 2>&1 | tee -a "$LOGFILE"

echo "" | tee -a "$LOGFILE_EP"
echo "=== 4.1 AD Connectivity (Post-dACL) ===" | tee -a "$LOGFILE_EP"
echo "DNS:" | tee -a "$LOGFILE_EP"
host inside.domusdigitalis.dev 10.50.1.50 2>&1 | tee -a "$LOGFILE_EP"

echo "" | tee -a "$LOGFILE_EP"
echo "Kerberos:" | tee -a "$LOGFILE_EP"
kinit Evan@INSIDE.DOMUSDIGITALIS.DEV 2>&1 | tee -a "$LOGFILE_EP"

echo "Ticket:" | tee -a "$LOGFILE_EP"
klist 2>&1 | tee -a "$LOGFILE_EP"

# From admin workstation, SSH to modestus-aw with AD account
echo "" | tee -a "$LOGFILE"
echo "=== 4.2 SSH with AD Account ===" | tee -a "$LOGFILE"
echo "Testing: ssh Evan@inside.domusdigitalis.dev@modestus-aw" | tee -a "$LOGFILE"
ssh Evan@inside.domusdigitalis.dev@modestus-aw whoami 2>&1 | tee -a "$LOGFILE"

echo "" | tee -a "$LOGFILE_EP"
echo "=== 4.3 Zero-Trust Validation ===" | tee -a "$LOGFILE_EP"
{
  echo "=== PERMITTED (should PASS) ==="
  echo -n "DNS to DC....... "; timeout 3 bash -c "</dev/tcp/10.50.1.50/53" 2>/dev/null && echo "PASS" || echo "FAIL"
  echo -n "Kerberos........ "; timeout 3 bash -c "</dev/tcp/10.50.1.50/88" 2>/dev/null && echo "PASS" || echo "FAIL"
  echo -n "LDAP............ "; timeout 3 bash -c "</dev/tcp/10.50.1.50/389" 2>/dev/null && echo "PASS" || echo "FAIL"
  echo -n "Internet........ "; curl -s -o /dev/null -w "%{http_code}" https://google.com | grep -q 200 && echo "PASS" || echo "FAIL"
  echo ""
  echo "=== BLOCKED (should FAIL) ==="
  echo -n "Switch SSH...... "; timeout 3 bash -c "</dev/tcp/10.50.1.10/22" 2>/dev/null && echo "SECURITY ISSUE!" || echo "BLOCKED (good)"
  echo -n "VyOS............ "; timeout 3 bash -c "</dev/tcp/10.50.1.1/443" 2>/dev/null && echo "SECURITY ISSUE!" || echo "BLOCKED (good)"
  echo -n "NAS SSH......... "; timeout 3 bash -c "</dev/tcp/10.50.1.70/22" 2>/dev/null && echo "SECURITY ISSUE!" || echo "BLOCKED (good)"
} 2>&1 | tee -a "$LOGFILE_EP"

echo "" | tee -a "$LOGFILE"
echo "========================================" | tee -a "$LOGFILE"
echo "Validation Complete: $(date)" | tee -a "$LOGFILE"
echo "Log saved to: $LOGFILE" | tee -a "$LOGFILE"
echo "========================================" | tee -a "$LOGFILE"

# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (for management)
sudo ufw allow ssh

# Enable firewall
sudo ufw --force enable

# Verify
echo "=== UFW STATUS ==="
sudo ufw status verbose

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere

echo "=== BLOCK DEVICES ==="
lsblk -f

echo ""
echo "=== LUKS PARTITIONS ==="
lsblk -f | grep -q crypto_LUKS && echo "OK: LUKS encryption detected" || echo "ISSUE: No LUKS detected"

echo ""
echo "=== CRYPTTAB ==="
[ -f /etc/crypttab ] && cat /etc/crypttab || echo "ISSUE: /etc/crypttab missing"

# Create sudoers file for domain admins group
sudo tee /etc/sudoers.d/domain-admins > /dev/null << 'EOF'
# Domain Admins - Full sudo access
%domain\ admins@inside.domusdigitalis.dev ALL=(ALL:ALL) ALL
EOF

sudo chmod 440 /etc/sudoers.d/domain-admins

# Verify syntax
sudo visudo -c

# Verify sudoers configuration
echo "=== SUDOERS.D ==="
ls -la /etc/sudoers.d/

echo ""
echo "=== DOMAIN ADMINS RULE ==="
sudo cat /etc/sudoers.d/domain-admins

# Check current access provider
echo "=== SSSD ACCESS CONTROL ==="
sudo grep -E "access_provider|simple_allow" /etc/sssd/sssd.conf

# If not configured, add to [domain/inside.domusdigitalis.dev] section:
# access_provider = simple
# simple_allow_groups = domain admins@inside.domusdigitalis.dev

echo "=== SECURITY HARDENING CHECKLIST ==="

# UFW
ufw status 2>/dev/null | grep -q "Status: active" \
  && echo "[PASS] UFW firewall active" \
  || echo "[FAIL] UFW firewall NOT active"

ufw status verbose 2>/dev/null | grep -q "deny (incoming)" \
  && echo "[PASS] UFW default deny incoming" \
  || echo "[FAIL] UFW default policy not set"

# LUKS
lsblk -f 2>/dev/null | grep -q "crypto_LUKS" \
  && echo "[PASS] LUKS encryption present" \
  || echo "[FAIL] LUKS encryption NOT detected"

# Sudoers
[ -f /etc/sudoers.d/domain-admins ] \
  && echo "[PASS] Domain admins sudoers file exists" \
  || echo "[FAIL] Domain admins sudoers file missing"

# SSSD access control
sudo grep -q "access_provider.*simple" /etc/sssd/sssd.conf 2>/dev/null \
  && echo "[PASS] SSSD access control configured" \
  || echo "[WARN] SSSD access control not restricted"

# Keytab permissions
PERMS=$(stat -c '%a' /etc/krb5.keytab 2>/dev/null)
[ "$PERMS" = "600" ] \
  && echo "[PASS] Keytab permissions 600" \
  || echo "[FAIL] Keytab permissions: $PERMS (expected 600)"

# Private key permissions
PERMS=$(stat -c '%a' /etc/ssl/private/modestus-aw-eaptls.key 2>/dev/null)
[ "$PERMS" = "600" ] \
  && echo "[PASS] Private key permissions 600" \
  || echo "[FAIL] Private key permissions: $PERMS (expected 600)"

netapi ise delete-authz-rule "$POLICY_SET" "$AUTHZ_EAPTLS" --force
netapi ise mnt coa "$MAC"

# 1. Delete authorization rule
netapi ise delete-authz-rule "$POLICY_SET" "$AUTHZ_EAPTLS" --force

# 2. Delete authorization profiles (both)
netapi ise delete-authz-profile "$AUTHZ_ONBOARD" --force
netapi ise delete-authz-profile "$AUTHZ_EAPTLS" --force

# 3. Delete dACLs (both)
netapi ise delete-dacl "$DACL_ONBOARD" --force
netapi ise delete-dacl "$DACL_EAPTLS" --force

# 4. Force CoA to revert to default policy
netapi ise mnt coa "$MAC"

# Show specific line range
awk 'NR>=10 && NR<=20' /etc/sssd/sssd.conf

# Show line with line number
awk 'NR==73 {print NR": "$0}' /etc/ssh/sshd_config

# Find pattern and show surrounding context
awk '/GSSAPIAuthentication/{print NR": "$0}' /etc/ssh/sshd_config

# Show Host block from match until next Host or empty line (range pattern)
awk '/^Host.*modestus-aw/,/^Host [^*]|^$/' ~/.ssh/config

# Find Host entry and show N lines after (context capture)
awk '/modestus-aw/{found=NR} found && NR<=found+5' ~/.ssh/config

# Find IP pattern and print with line numbers
awk '/10\.50\.40/{print NR": "$0}' ~/.ssh/config

# Find all Host entries with their line numbers
awk '/^Host /{print NR": "$0}' ~/.ssh/config

# Show specific Host block with HostName, User, IdentityFile
awk '/^Host modestus-aw$/,/^Host [^*]/' ~/.ssh/config | head -10

Host modestus-aw
    HostName 10.50.10.138
    User evanusmodestus
    IdentityFile ~/.ssh/id_ed25519_sk_rk_d000
    IdentityFile ~/.ssh/id_ed25519_sk_rk_d000_secondary
    IdentityFile ~/.ssh/id_ed25519_d000

# Update HostName ONLY within modestus-aw block
sed -i '/^Host modestus-aw$/,/^Host /s/HostName .*/HostName 10.50.10.130/' ~/.ssh/config

# 1. Check current IP on target (on target machine)
ip -4 -o addr show | awk '{print $2, $4}' | grep -E "^(enp|eth|wlan)"

# 2. Find current HostName in config (on admin workstation)
awk '/modestus-aw/{found=1} found && /HostName/{print NR": "$0; exit}' ~/.ssh/config

# 3. Apply range-scoped edit
sed -i '/^Host modestus-aw$/,/^Host /s/HostName .*/HostName 10.50.10.130/' ~/.ssh/config

# 4. Verify change
awk '/modestus-aw/{found=NR} found && NR<=found+2' ~/.ssh/config

# 5. Test connectivity
timeout 3 bash -c "</dev/tcp/10.50.10.130/22" && echo "OPEN" || echo "BLOCKED"

# IP addresses (clean output)
ip -4 -o addr show | awk '{print $2, $4}' | grep -v "^lo"

# Filter to physical interfaces only
ip -4 -o addr show | awk '{print $2, $4}' | grep -E "^(enp|eth|wlan)"

# Listening ports (clean)
ss -tlnp | awk '{print $4}' | sort -u

# TCP connections with state
ss -tnp | awk 'NR>1 {print $1, $4, $5}' | column -t

# Port connectivity test (no nc required) - Kerberos to DC
timeout 3 bash -c "</dev/tcp/10.50.1.50/88" && echo "OK" || echo "BLOCKED"

# Verify line before change
sed -n '73p' /etc/ssh/sshd_config

# In-place edit specific line
sed -i '73s/#GSSAPIAuthentication no/GSSAPIAuthentication yes/' /etc/ssh/sshd_config

# Insert after specific line
sed -i '47a\
    GSSAPIAuthentication yes\
    GSSAPIDelegateCredentials yes' ~/.ssh/config

# Uncomment a line
sed -i 's/^#\(GSSAPIAuthentication\)/\1/' /etc/ssh/sshd_config

# Comment a line
sed -i 's/^\(PasswordAuthentication\)/#\1/' /etc/ssh/sshd_config

# Replace in specific line range only
sed -i '10,20s/old/new/g' /etc/sssd/sssd.conf

# View passwd/group/shadow lines
awk 'NR>=4 && NR<=6' /etc/nsswitch.conf

# Add sss to passwd line
sed -i '4s/passwd: files systemd/passwd: files sss systemd/' /etc/nsswitch.conf

# Add sss to all auth lines
sed -i '4s/passwd: files/passwd: files sss/' /etc/nsswitch.conf
sed -i '5s/group: files/group: files sss/' /etc/nsswitch.conf
sed -i '6s/shadow: files/shadow: files sss/' /etc/nsswitch.conf

# sshd effective config
sudo sshd -T | grep -E "gssapi|pubkey|password"

# SSSD domain status
sudo sssctl domain-status inside.domusdigitalis.dev

# Kerberos ticket status
klist | awk '/Default principal|Expires/{print}'

# Check if service offers GSSAPI
ssh -v user@host 2>&1 | awk '/Authentications that can continue/{print}'

# Compare two configs
diff <(sudo sshd -T 2>/dev/null | sort) <(cat /etc/ssh/sshd_config.bak | grep -v '^#' | sort)

# Run on remote and parse locally
ssh target "cat /etc/sssd/sssd.conf" | awk '/ad_server/{print $3}'

# Multiple commands with error handling
{ cmd1 && cmd2 && cmd3; } || echo "Failed at step $?"

# Conditional insert (idempotent)
grep -q "^GSSAPIAuthentication yes" /etc/ssh/sshd_config || echo "GSSAPIAuthentication yes" | sudo tee -a /etc/ssh/sshd_config

# Find which profile uses a specific dACL
for p in Linux_EAPTLS_Admins Linux_EAPTLS_Permit Linux_Posture_Compliant; do
  dacl=$(netapi ise get-authz-profile "$p" 2>/dev/null | awk '/daclName/{print $NF}')
  echo "$p -> ${dacl:-NONE}"
done

Linux_EAPTLS_Admins -> LINUX_EAPTLS_PERMIT_ALL
Linux_EAPTLS_Permit -> LINUX_RESEARCH_ZERO_TRUST_V2
Linux_Posture_Compliant -> LINUX_EAPTLS_PERMIT_ALL

# Search ALL profiles for a specific dACL pattern
# (List profile names explicitly for reliability)
PROFILES="Linux_EAPTLS_Admins Linux_EAPTLS_Permit Linux_Posture_Compliant \
  Linux_Posture_NonCompliant Linux_Posture_Unknown Domus_Research_Profile \
  Research_Onboard Domus_Secure_Profile Domus_Admin_Profile"

for p in $PROFILES; do
  dacl=$(netapi ise get-authz-profile "$p" 2>/dev/null | awk '/daclName/{print $NF}')
  [[ "$dacl" == *"ZERO_TRUST"* ]] && echo "FOUND: $p -> $dacl"
done

# 1. Find profile using the dACL
for p in Linux_EAPTLS_Admins Linux_EAPTLS_Permit Linux_Posture_Compliant; do
  dacl=$(netapi ise get-authz-profile "$p" 2>/dev/null | awk '/daclName/{print $NF}')
  [[ "$dacl" == "LINUX_RESEARCH_ZERO_TRUST_V2" ]] && echo "FOUND: $p"
done

# 2. Detach dACL from profile (set to empty)
netapi ise update-authz-profile "Linux_EAPTLS_Permit" --dacl ""

# 3. Delete old dACL
netapi ise delete-dacl "Linux_Research_Zero_Trust_v2" --force

# 4. Create updated dACL with new rules
netapi ise create-dacl "Linux_Research_Zero_Trust_v2" \
  --file /tmp/dacl-research-v3.txt \
  --descr "Zero-trust + SSH management"

# 5. Reattach dACL to profile
netapi ise update-authz-profile "Linux_EAPTLS_Permit" --dacl "Linux_Research_Zero_Trust_v2"

# 6. Apply via CoA
netapi ise mnt coa "08:92:04:38:11:9c"

remark ICMP hardening - block internal ping
deny icmp any 10.0.0.0 0.255.255.255
deny icmp any 172.16.0.0 0.15.255.255
deny icmp any 192.168.0.0 0.0.255.255
permit icmp any any
remark DNS
permit udp any host 10.50.1.50 eq 53
permit udp any host 10.50.1.1 eq 53
remark NTP
permit udp any host 10.50.1.1 eq 123
remark AD/Kerberos - auth and password change
permit tcp any host 10.50.1.50 eq 88
permit udp any host 10.50.1.50 eq 88
permit tcp any host 10.50.1.50 eq 464
permit udp any host 10.50.1.50 eq 464
permit tcp any host 10.50.1.50 eq 389
permit tcp any host 10.50.1.50 eq 636
permit tcp any host 10.50.1.50 eq 445
permit tcp any host 10.50.1.50 eq 3268
remark ISE Posture
permit tcp any host 10.50.1.20 eq 8443
permit tcp any host 10.50.1.20 eq 8905
remark SSH management
permit tcp any any eq 22
permit tcp any eq 22 any
remark Internet egress
permit tcp any any eq 80
permit tcp any any eq 443
remark Zero-trust deny
deny ip any 10.0.0.0 0.255.255.255
deny ip any 172.16.0.0 0.15.255.255
deny ip any 192.168.0.0 0.0.255.255

# 1. Valid Kerberos ticket?
klist | head -5

# 2. If expired, get new ticket
kinit <username>@INSIDE.DOMUSDIGITALIS.DEV

# 3. Can you get a service ticket?
kvno host/<target-host>.inside.domusdigitalis.dev@INSIDE.DOMUSDIGITALIS.DEV

# 4. Verify krb5.conf has default_realm
awk '/default_realm/' /etc/krb5.conf

# 1. GSSAPI enabled in sshd?
sudo sshd -T | grep -i gssapi
# Expected: gssapiauthentication yes

# 2. Keytab has correct SPNs?
sudo klist -k /etc/krb5.keytab | grep host
# Expected: host/<hostname>.inside.domusdigitalis.dev@INSIDE.DOMUSDIGITALIS.DEV

# 3. use_fully_qualified_names = False?
awk '/use_fully_qualified/' /etc/sssd/sssd.conf
# MUST be False for GSSAPI to work

# 4. krb5 renewal settings configured?
sudo awk '/krb5_renew|krb5_renewable/' /etc/sssd/sssd.conf
# Expected: krb5_renewable_lifetime = 7d, krb5_renew_interval = 60

# 5. Watch auth attempts in real-time
sudo journalctl -u sshd -f

# Full GSSAPI debug
ssh -F /dev/null -o GSSAPIAuthentication=yes -o PreferredAuthentications=gssapi-with-mic -vvv user@host 2>&1 | grep -iE "gssapi|krb|auth"

Authorization Policy: Domus-Wired MAB >> Default
Authorization Result: DenyAccess

# Check current endpoint group
netapi ise get-endpoint "14:F6:D8:7B:31:80"

# Move to Research_Onboard (or appropriate group)
netapi ise update-endpoint-group "14:F6:D8:7B:31:80" "Research_Onboard"

# Force CoA to apply new group membership
netapi ise mnt coa "14:F6:D8:7B:31:80"

# Verify endpoint is in correct group with static assignment
netapi ise get-endpoint "14:F6:D8:7B:31:80"

Identity Group
  Group                   Research_Onboard
  Static Assignment       True

# List MAB authorization rules
netapi ise get-authz-rules "Domus-Wired MAB"

# 1. Check ISE Live Logs for dual auth events (dot1x + MAB)
#    Look for: same MAC, different authentication methods

# 2. If MAB shows DenyAccess, check endpoint group
netapi ise get-endpoint "<mac>"

# 3. Compare group with MAB policy rules
netapi ise get-authz-rules "Domus-Wired MAB"

# 4. If group doesn't match any rule, add endpoint to correct group
netapi ise update-endpoint-group "<mac>" "Research_Onboard"
netapi ise mnt coa "<mac>"

# 5. Verify fix
netapi ise dc auth-history "<mac>" --limit 5

# Quick status with awk
vault status | awk '/Sealed/{print "Sealed:", $2} /Unseal Progress/{print "Progress:", $3}'

Sealed: true
Progress: 0/2

Sealed: false

# Unseal loop - prompts for keys until unsealed
while vault status | awk '/Sealed/ {exit ($2=="true")}'; do
  echo "Unsealing..."
  vault operator unseal
done && echo "Vault unsealed!"

# Issue cert using role (e.g., domus-client-users)
vault write -format=json pki_int/issue/domus-client-users \
  common_name="<hostname>.inside.domusdigitalis.dev" \
  ttl="8760h" > /tmp/<hostname>-cert.json

vault write -format=json pki_int/issue/domus-client-users \
  common_name="modestus-p50.inside.domusdigitalis.dev" \
  ttl="8760h" > /tmp/modestus-p50-cert.json

jq -r '.data.certificate' /tmp/<hostname>-cert.json > /tmp/<hostname>-eaptls.crt
jq -r '.data.private_key' /tmp/<hostname>-cert.json > /tmp/<hostname>-eaptls.key
jq -r '.data.ca_chain[]' /tmp/<hostname>-cert.json > /tmp/domus-ca-chain.crt

# Extract O=/OU=/CN= fields from certificate
openssl x509 -in /tmp/<hostname>-eaptls.crt -noout -subject | \
  awk -F', ' '{gsub(/^subject=/, "", $1); for(i=1;i<=NF;i++) print $i}'

O=Domus-Infrastructure
OU=Domus-Users
CN=modestus-p50.inside.domusdigitalis.dev

vault operator seal