# Milestone 4

## Milestone 4.1: Active Directory LDAPs SSO Provider

### Active Directory LDAPs SSO Provider

{% code overflow="wrap" %}

```powershell
Install-WindowsFeature Adcs-Cert-Authority -IncludeManagementTools
Install-AdcsCertificationAuthority -CAType EnterpriseRootCa -CryptoProviderName "RSA#Microsoft Software Key Storage Provider" -KeyLength 2048 -HashAlgorithmName SHA1
```

{% endcode %}

<figure><img src="https://lh4.googleusercontent.com/M8nZFaP1SRsO3wH8oj33Les5YPdQqUGbFaytA4Bm7WyI0XH3sL4_uSR5kyiO3xFHXQSViCAGweC_lhc1vwW-wj-A7twxDBhKwJ7wyhCgkuvxkSoijOFmr_jeTE8HduklUpREcxxmV7BGqAXMysmWO5A" alt=""><figcaption><p>Error 0 means it worked thanks Microsoft </p></figcaption></figure>

### Copy CA Cert

```bash
openssl s_client -connect dc1-paul:636 -showcerts
```

<figure><img src="https://lh4.googleusercontent.com/D3OqhtSOVXerU4DiBBBIy3ImmXrVUNPcn3mIkv8XJqskJ-Q1tyL443F8fQiC_cwTeSbH6_F5UTSc2d8ZLv95svcU5DioFvk-9lyG04kMwEGtn8B5L0Bs4zMm8I7TP54b4liiY_dVQy6HwxfWHOZdEGM" alt=""><figcaption></figcaption></figure>

Copy Cert and past in a file called ca.pem

### Connect AD to vSphere

<figure><img src="https://lh3.googleusercontent.com/z9pZfmmQee1yP2T7YLSWaiYnC72vwmK_lWzANS_KncSaCBHhSBe7U_98Oue8k2opXVltoa2dVRG15mbG_EenDNXQ2Ay0VkftHzUP1kU_A_mk-eJQ6aKjxT-vwAbFK37R9teAM2sZcJeRMf7rTbiZ0aI" alt=""><figcaption></figcaption></figure>

<figure><img src="https://lh4.googleusercontent.com/FhF3NeEBVdpRYahZwVOHa879wlBDvrR4IhWkgRcDRGtPQ3ZqMmcKxRlJjy7cdfSoC7rOMcjQYkqab3wINJnMmF5Ibr21KtYrplEB2jXoTrfHqdx5-UbM358wWxS1qmEu3LoutnlJs8A8dxQHKsH78ec" alt=""><figcaption></figcaption></figure>

<figure><img src="https://lh4.googleusercontent.com/rH78py50iwJBv_mD79qsNkWeejpX6ydwaOMoRx3gfF85uDO4SUnxDF2a1QaBdeWIHPglNDnno83Ln0t_n-5gy3sZcFA9A1biQJ7tj0nmV8tD4bvDbuTMTc3sFpb9bKVs4FncxFuZ_UkkHYJesgkUGLk" alt=""><figcaption><p>Login with domain creds</p></figcaption></figure>

Reboot vSphere

<figure><img src="https://lh6.googleusercontent.com/ymTzMqTf2gU_WA5P06LXIHCt0aEe4Jyofxe5_27EECNXH2GqtUsE9qBCQeWCCQ_HQ5JHkMkrMGfVIdR2K3NeQNZlK3WF3Gg0T5P4VHHR_NJGI1958i7gvuVOWg-qV_GvZciHvOi8u-unxsFpSa2tTw0" alt=""><figcaption></figcaption></figure>

Change Identity provider

<figure><img src="https://lh3.googleusercontent.com/1AOazLxobAYpJF0q8cWyO2VA0wBT_weIGcRbohycByGANpZhrGuaW2J-cCEgjfIyccURtCAnjbS3UCMEylwMBKKBgZORdTtH2ZpDN2s3jtPDA7Ba27AwZLaQv9ZyI3S-meIVfla5ktUGFKiGLnN6bOk" alt=""><figcaption></figcaption></figure>

Add Identity Source

<figure><img src="https://lh6.googleusercontent.com/Jqt9pk3y5FBaVjEB0gPtfisVetX5ykBpGfbgHc0tixcIhm5c__mUmUwf8QrYtBx8E0nxpUID3JcnWIl7d5v9mjMSy7wlG0QtIrdDXorz6XIgy-KlgQgcB4BHV5c-Gg9rTqvWYvIRhPoW40a1Fsk8VkI" alt=""><figcaption></figcaption></figure>

### **Create ldap users**

<pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">New-ADOrganizationalUnit -Name "480" -Path "DC=paul,DC=local"
New-ADOrganizationalUnit -Name "Accounts" -Path "OU=480,DC=paul,DC=local"
New-ADOrganizationalUnit -Name "ServiceAccounts" -Path "OU=AccountsOU=480,DC=paul,DC=local"
<strong>New-ADUser -Name "vcenterldap" -Accountpassword (Read-Host -AsSecureString "AccountPassword") -path "OU=ServiceAccounts,OU=AccountsOU=480,DC=paul,DC=local"  -Enabled $true
</strong></code></pre>

Move -adm user through gui and make vcenter-admin group

### Add AD vcenter Group to vSphere administrators

<figure><img src="https://lh4.googleusercontent.com/azkjGFMnaaYQQICMOOplySFhVkR-cXA9uKcrKWxWKs7IiSeLiAACOgzf-82cU6U2FgFJBY_Qu1KQH86OU9_OpfpBxVIR6Uu5YB8DTy2t7q48QoiYHsZA1ncwNCYVRyftpxH3Yme_u25mWbZnPhuH2l4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://lh4.googleusercontent.com/9iIb3I_XUxsyanUlkuaENF20fqxkkNXjBgPiHuHaUDUnAED7yji4XV4ynTjpgaTSugQKsLGweQMiiUQmJahsDVNePgH2vKgwrn4RlCyw8el8TiOKamlhXHubHs62JNgBY-iOdPScHMZVGdOltoApqt8" alt=""><figcaption></figcaption></figure>

## Milestone 4.2: Powershell, PowerCLI and Our First Clone

### Xubuntu install powercli and ansible dependencies

#### Anisble

```bash
sudo apt install sshpass python3-paramiko git
sudo apt-add-repository ppa:ansible/ansible
sudo apt update
sudo apt install ansible
ansible --version
cat >> ~/.ansible.cfg << EOF                                                              
[defaults]
host_key_checking = false
EOF
```

#### Install Powercli and Powershell

```bash
sudo snap install powershell --classic
pwsh
```

```powershell
Write-Host $PSVersionTable
Install-Module VMware.PowerCLI -Scope CurrentUser
Get-Module VMware.PowerCLI -ListAvailable
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore
Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP $false
```

#### Test Connectivity to ESXi Host

```
Connect-VIServer -Server 192.168.7.32
Get-VM
```

<figure><img src="https://lh5.googleusercontent.com/YPe82djwWXP4drx6vCd_3InxwD2RaySPmA8TZrkaEqseK_W5JRE-KJo-Bn-LHecqgJB13rfcGxj-Te7DOfvT6CnVaIYzHsnp0qjtQvyYixDQ4crSu4gGEN9ZF-22O0x-DbUyBxUQH56fH6NdJqWK1w" alt=""><figcaption></figcaption></figure>

Or connect with domain user ($vcenter=”vcenter.paul.local”)

<figure><img src="https://lh3.googleusercontent.com/prfYmbCeV6qw-uca-ClSvuRXHx0mug7--8GhgpzJNE-YDSBh2cmrgRDpDGUxFrb5DxhSBHkrlpE7onLH5ias2j76yDf0PHYz1SeE42SgXfBVU-8NO6tBVY6KZB4fP5fW34v5Vg1DmfGTXAZtEBw3FQ" alt=""><figcaption></figcaption></figure>

Show VM’s

<figure><img src="https://lh4.googleusercontent.com/MCY3y3e6kq09eI5MwQGBQ9dQOLuJ28YW3ZalEmGkU_BdsYaqprXcpw5UUlQf3h65m692XiGOiClFZyu_952zyJQ1WkZuSOn8jKNKEilpsdm2lc0OaxlkvSMm-2f-oUAQWzFoMUOECGIiVJSqkGn5fw" alt=""><figcaption></figcaption></figure>

#### To get vm Snapshot

```powershell
# select vm
$vm = Get-VM -Name DC1
# Get snapshot name
$snapshot = Get-Snapshot -VM $vm -Name “Base”
# Get vmhost
$vmhost = Get-VMHost -Name “192.168.7.32”
# Get Data Store
$ds = Get-Datastore -Name “datastore1-super20”
# The name of the vm replaces {0}
$linkedClone = “{0}.linked” -f $vm.name 
# To create new linked clone
$linkedvm = New-VM -LinkedClone -Name $linkedClone -VM $vm -ReferenceSnapshot $snapshot -VMHost $vmhost -Datastore $ds
# Create full independent version from linked clone
$newvm = New-VM -Name “server.2019.gui.base” -VM $linkedvm -VMHost $vmhost -Datastore $ds
# Create snapshot of new vm
$newvm | New-Shapshot -Name “Base”
# Removed old link
$linkedvm | Remove-VM
```

Made Script: <https://github.com/ChampPG/Tech-Journals/blob/main/SEC-480/cloner.ps1>

## Milestone 4.3: Ubuntu Server Base VM and Linked Clone

### Create a new Ubuntu VM.&#x20;

<figure><img src="https://lh5.googleusercontent.com/vLKG0X6gmpOl0c-YlYPB0dzN9PmQL3Lm1PPiT4o3y7ENKyAdt3pjIjVvUOEyo3_ZTKRbOWfXwuon-RAM-8AHdeXqkLzsqmkKBYN1YQe7beBOGvKkyGCWE4WwXJ5DreJA-i8ry4G0yIUWDXKbucFjCfk" alt=""><figcaption><p>ISO = Live Server Ubuntu</p></figcaption></figure>

Update to the new installer

<figure><img src="https://lh6.googleusercontent.com/IVG7jA4Iwr9jl-G1k5Dkn86hk48oLwxuZIy-zy1trzw5xPbMvvD83A315qfrgQ0al4mr4tOYEKWu_rJS5DKZMFoLIyl2z5ba3yOmuazJSfOGun9AndrNwLBEjXIU0empG5RNEVWVbpT2_ndaDgHlqqI" alt=""><figcaption></figcaption></figure>

Install OpenSSH Server

<figure><img src="https://lh6.googleusercontent.com/pnCv5dmj78QLJRf-mCG7I_79mCi-ZIfasgxAyJc4POLAB5csK4l-Fr3CF8W97131wdqXnJxLf7C9joNEM3Qdn5JtUAz0oLQjHs2l9pt0jn67ZX-E-63LPyNv15MMhtpwZWRfjC4wV9pok9k77r901XE" alt=""><figcaption></figcaption></figure>

Disable IPv6

```bash
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.lo.disable_ipv6=1
```

Modify Script

```bash
#!/bin/sh
#script to prepare ubuntu desktop vm for cloning
apt-get update
apt-get upgrade -y

#open ssh
apt-get install -y open-vm-tools openssh-server
cat /dev/null > /var/log/wtmp 
cat /dev/null > /var/log/lastlog 
rm -rf /tmp/*
rm -rf /var/tmp/*
rm -f /etc/ssh/ssh_host*
rm -f /etc/udev/rules.d/70-persistent-net.rules
cat <<EOL | sudo tee /etc/rc.local
#!/bin/sh -e
test -f /etc/ssh/ssh_host_dsa_key || dpkg-reconfigure openssh-server
exit 0
EOL

# assumption is that the host is already named
#echo ubuntu > /etc/hostname
apt-get clean
history -c
history -w
chmod +x /etc/rc.local
systemctl stop apt-daily-upgrade.timer
systemctl disable apt-daily-upgrade.timer
systemctl stop apt-daily.timer
systemctl disable apt-daily.timer
sudo apt autoremove -y
#truncate the machine id to avoid duplicate dhcp

# Changed lines below
echo -n > /etc/machine-id
sudo rm /var/lib/dbus/machine-id
sudo ln -s /etc/machine-id /var/lib/dbus/machine-id

echo "remove git repo and then issue a shutdown - h now"
```

Download and run script

{% code overflow="wrap" %}

```bash
wget https://raw.githubusercontent.com/ChampPG/Tech-Journals/main/SEC-480/ubuntu-server.sh
chmod +x ./ubuntu-server.sh
Sudo ./ubuntu-server.sh
```

{% endcode %}

Shutdown and take \`Base\` Snapshot

### Script to Create aux

```powershell
###################
#  cloneraux.ps1  #
#   Paul Gleason  #
###################

# Check if connected to server
$connectCheck = $global:defaultviserver | Select-Object Name -ExpandProperty Name

# if not connected prompt to connect
if ( $connectCheck -eq ""){
    #Connect to vcenter
    $vcenterdomain = Read-Host "Please enter domain for vcenter"
    Connect-VISever -Server $vcenterdomain
}

# Show hosts
Write-Host "--VM Host--"
Get-VMHost | Select-Object Name -ExpandProperty Name
Write-Host "-----------"
$vmhostIP = Read-Host "Please enter VM Host IP you would like to use"

# Show VMs
Write-Host "--VMs--"
Get-VM | Select-Object Name -ExpandProperty Name
Write-Host "-------"
$vmname = Read-Host "Please enter VM that you would like to clone"

# Show VM Snapshots
Write-Host "--Snapshots--"
Get-Snapshot -VM $vmname | Select-Object Name -ExpandProperty Name
Write-Host "-------------"
$snapshotName = Read-Host "Enter Snapshot that you would like to clone"

# Show Datastores
Write-Host "--Datastores--"
Get-Datastore | Select-Object Name -ExpandProperty Name
Write-Host "--------------"
$dsName = Read-Host "Select Datastore you would like to use"

#  Get Clone name
$cloneName = Read-Host "Enter the name for the clone"

# Get vmhost
$vmhost = Get-VMHost -Name $vmhostIP
# Get VM
$vm = Get-VM -Name $vmname
# Get snapshot name
$snapshot = Get-Snapshot -VM $vm -Name $snapshotName
# Get Data Store
$ds = Get-Datastore -Name $dsName
# The name of the vm replaces {0}
$linkedClone = $cloneName
# To create new linked clone
$linkedvm = New-VM -LinkedClone -Name $linkedClone -VM $vm -ReferenceSnapshot $snapshot -VMHost $vmhost -Datastore $ds
# Set Adapter
$linkedvm | Get-NetworkAdapter | Set-NetworkAdapter -NetworkName 480-WAN
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://paul-gleason.gitbook.io/sec-480-adv-topics-in-cyber-security-devops/labs/milestone-4.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
