# Milestone 4

## Milestone 4.1: Active Directory LDAPs SSO Provider

### Active Directory LDAPs SSO Provider

{% code overflow="wrap" %}

```powershell
Install-WindowsFeature Adcs-Cert-Authority -IncludeManagementTools
Install-AdcsCertificationAuthority -CAType EnterpriseRootCa -CryptoProviderName "RSA#Microsoft Software Key Storage Provider" -KeyLength 2048 -HashAlgorithmName SHA1
```

{% endcode %}

<figure><img src="https://lh4.googleusercontent.com/M8nZFaP1SRsO3wH8oj33Les5YPdQqUGbFaytA4Bm7WyI0XH3sL4_uSR5kyiO3xFHXQSViCAGweC_lhc1vwW-wj-A7twxDBhKwJ7wyhCgkuvxkSoijOFmr_jeTE8HduklUpREcxxmV7BGqAXMysmWO5A" alt=""><figcaption><p>Error 0 means it worked thanks Microsoft </p></figcaption></figure>

### Copy CA Cert

```bash
openssl s_client -connect dc1-paul:636 -showcerts
```

<figure><img src="https://lh4.googleusercontent.com/D3OqhtSOVXerU4DiBBBIy3ImmXrVUNPcn3mIkv8XJqskJ-Q1tyL443F8fQiC_cwTeSbH6_F5UTSc2d8ZLv95svcU5DioFvk-9lyG04kMwEGtn8B5L0Bs4zMm8I7TP54b4liiY_dVQy6HwxfWHOZdEGM" alt=""><figcaption></figcaption></figure>

Copy Cert and past in a file called ca.pem

### Connect AD to vSphere

<figure><img src="https://lh3.googleusercontent.com/z9pZfmmQee1yP2T7YLSWaiYnC72vwmK_lWzANS_KncSaCBHhSBe7U_98Oue8k2opXVltoa2dVRG15mbG_EenDNXQ2Ay0VkftHzUP1kU_A_mk-eJQ6aKjxT-vwAbFK37R9teAM2sZcJeRMf7rTbiZ0aI" alt=""><figcaption></figcaption></figure>

<figure><img src="https://lh4.googleusercontent.com/FhF3NeEBVdpRYahZwVOHa879wlBDvrR4IhWkgRcDRGtPQ3ZqMmcKxRlJjy7cdfSoC7rOMcjQYkqab3wINJnMmF5Ibr21KtYrplEB2jXoTrfHqdx5-UbM358wWxS1qmEu3LoutnlJs8A8dxQHKsH78ec" alt=""><figcaption></figcaption></figure>

<figure><img src="https://lh4.googleusercontent.com/rH78py50iwJBv_mD79qsNkWeejpX6ydwaOMoRx3gfF85uDO4SUnxDF2a1QaBdeWIHPglNDnno83Ln0t_n-5gy3sZcFA9A1biQJ7tj0nmV8tD4bvDbuTMTc3sFpb9bKVs4FncxFuZ_UkkHYJesgkUGLk" alt=""><figcaption><p>Login with domain creds</p></figcaption></figure>

Reboot vSphere

<figure><img src="https://lh6.googleusercontent.com/ymTzMqTf2gU_WA5P06LXIHCt0aEe4Jyofxe5_27EECNXH2GqtUsE9qBCQeWCCQ_HQ5JHkMkrMGfVIdR2K3NeQNZlK3WF3Gg0T5P4VHHR_NJGI1958i7gvuVOWg-qV_GvZciHvOi8u-unxsFpSa2tTw0" alt=""><figcaption></figcaption></figure>

Change Identity provider

<figure><img src="https://lh3.googleusercontent.com/1AOazLxobAYpJF0q8cWyO2VA0wBT_weIGcRbohycByGANpZhrGuaW2J-cCEgjfIyccURtCAnjbS3UCMEylwMBKKBgZORdTtH2ZpDN2s3jtPDA7Ba27AwZLaQv9ZyI3S-meIVfla5ktUGFKiGLnN6bOk" alt=""><figcaption></figcaption></figure>

Add Identity Source

<figure><img src="https://lh6.googleusercontent.com/Jqt9pk3y5FBaVjEB0gPtfisVetX5ykBpGfbgHc0tixcIhm5c__mUmUwf8QrYtBx8E0nxpUID3JcnWIl7d5v9mjMSy7wlG0QtIrdDXorz6XIgy-KlgQgcB4BHV5c-Gg9rTqvWYvIRhPoW40a1Fsk8VkI" alt=""><figcaption></figcaption></figure>

### **Create ldap users**

<pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">New-ADOrganizationalUnit -Name "480" -Path "DC=paul,DC=local"
New-ADOrganizationalUnit -Name "Accounts" -Path "OU=480,DC=paul,DC=local"
New-ADOrganizationalUnit -Name "ServiceAccounts" -Path "OU=AccountsOU=480,DC=paul,DC=local"
<strong>New-ADUser -Name "vcenterldap" -Accountpassword (Read-Host -AsSecureString "AccountPassword") -path "OU=ServiceAccounts,OU=AccountsOU=480,DC=paul,DC=local"  -Enabled $true
</strong></code></pre>

Move -adm user through gui and make vcenter-admin group

### Add AD vcenter Group to vSphere administrators

<figure><img src="https://lh4.googleusercontent.com/azkjGFMnaaYQQICMOOplySFhVkR-cXA9uKcrKWxWKs7IiSeLiAACOgzf-82cU6U2FgFJBY_Qu1KQH86OU9_OpfpBxVIR6Uu5YB8DTy2t7q48QoiYHsZA1ncwNCYVRyftpxH3Yme_u25mWbZnPhuH2l4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://lh4.googleusercontent.com/9iIb3I_XUxsyanUlkuaENF20fqxkkNXjBgPiHuHaUDUnAED7yji4XV4ynTjpgaTSugQKsLGweQMiiUQmJahsDVNePgH2vKgwrn4RlCyw8el8TiOKamlhXHubHs62JNgBY-iOdPScHMZVGdOltoApqt8" alt=""><figcaption></figcaption></figure>

## Milestone 4.2: Powershell, PowerCLI and Our First Clone

### Xubuntu install powercli and ansible dependencies

#### Anisble

```bash
sudo apt install sshpass python3-paramiko git
sudo apt-add-repository ppa:ansible/ansible
sudo apt update
sudo apt install ansible
ansible --version
cat >> ~/.ansible.cfg << EOF                                                              
[defaults]
host_key_checking = false
EOF
```

#### Install Powercli and Powershell

```bash
sudo snap install powershell --classic
pwsh
```

```powershell
Write-Host $PSVersionTable
Install-Module VMware.PowerCLI -Scope CurrentUser
Get-Module VMware.PowerCLI -ListAvailable
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore
Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP $false
```

#### Test Connectivity to ESXi Host

```
Connect-VIServer -Server 192.168.7.32
Get-VM
```

<figure><img src="https://lh5.googleusercontent.com/YPe82djwWXP4drx6vCd_3InxwD2RaySPmA8TZrkaEqseK_W5JRE-KJo-Bn-LHecqgJB13rfcGxj-Te7DOfvT6CnVaIYzHsnp0qjtQvyYixDQ4crSu4gGEN9ZF-22O0x-DbUyBxUQH56fH6NdJqWK1w" alt=""><figcaption></figcaption></figure>

Or connect with domain user ($vcenter=”vcenter.paul.local”)

<figure><img src="https://lh3.googleusercontent.com/prfYmbCeV6qw-uca-ClSvuRXHx0mug7--8GhgpzJNE-YDSBh2cmrgRDpDGUxFrb5DxhSBHkrlpE7onLH5ias2j76yDf0PHYz1SeE42SgXfBVU-8NO6tBVY6KZB4fP5fW34v5Vg1DmfGTXAZtEBw3FQ" alt=""><figcaption></figcaption></figure>

Show VM’s

<figure><img src="https://lh4.googleusercontent.com/MCY3y3e6kq09eI5MwQGBQ9dQOLuJ28YW3ZalEmGkU_BdsYaqprXcpw5UUlQf3h65m692XiGOiClFZyu_952zyJQ1WkZuSOn8jKNKEilpsdm2lc0OaxlkvSMm-2f-oUAQWzFoMUOECGIiVJSqkGn5fw" alt=""><figcaption></figcaption></figure>

#### To get vm Snapshot

```powershell
# select vm
$vm = Get-VM -Name DC1
# Get snapshot name
$snapshot = Get-Snapshot -VM $vm -Name “Base”
# Get vmhost
$vmhost = Get-VMHost -Name “192.168.7.32”
# Get Data Store
$ds = Get-Datastore -Name “datastore1-super20”
# The name of the vm replaces {0}
$linkedClone = “{0}.linked” -f $vm.name 
# To create new linked clone
$linkedvm = New-VM -LinkedClone -Name $linkedClone -VM $vm -ReferenceSnapshot $snapshot -VMHost $vmhost -Datastore $ds
# Create full independent version from linked clone
$newvm = New-VM -Name “server.2019.gui.base” -VM $linkedvm -VMHost $vmhost -Datastore $ds
# Create snapshot of new vm
$newvm | New-Shapshot -Name “Base”
# Removed old link
$linkedvm | Remove-VM
```

Made Script: <https://github.com/ChampPG/Tech-Journals/blob/main/SEC-480/cloner.ps1>

## Milestone 4.3: Ubuntu Server Base VM and Linked Clone

### Create a new Ubuntu VM.&#x20;

<figure><img src="https://lh5.googleusercontent.com/vLKG0X6gmpOl0c-YlYPB0dzN9PmQL3Lm1PPiT4o3y7ENKyAdt3pjIjVvUOEyo3_ZTKRbOWfXwuon-RAM-8AHdeXqkLzsqmkKBYN1YQe7beBOGvKkyGCWE4WwXJ5DreJA-i8ry4G0yIUWDXKbucFjCfk" alt=""><figcaption><p>ISO = Live Server Ubuntu</p></figcaption></figure>

Update to the new installer

<figure><img src="https://lh6.googleusercontent.com/IVG7jA4Iwr9jl-G1k5Dkn86hk48oLwxuZIy-zy1trzw5xPbMvvD83A315qfrgQ0al4mr4tOYEKWu_rJS5DKZMFoLIyl2z5ba3yOmuazJSfOGun9AndrNwLBEjXIU0empG5RNEVWVbpT2_ndaDgHlqqI" alt=""><figcaption></figcaption></figure>

Install OpenSSH Server

<figure><img src="https://lh6.googleusercontent.com/pnCv5dmj78QLJRf-mCG7I_79mCi-ZIfasgxAyJc4POLAB5csK4l-Fr3CF8W97131wdqXnJxLf7C9joNEM3Qdn5JtUAz0oLQjHs2l9pt0jn67ZX-E-63LPyNv15MMhtpwZWRfjC4wV9pok9k77r901XE" alt=""><figcaption></figcaption></figure>

Disable IPv6

```bash
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.lo.disable_ipv6=1
```

Modify Script

```bash
#!/bin/sh
#script to prepare ubuntu desktop vm for cloning
apt-get update
apt-get upgrade -y

#open ssh
apt-get install -y open-vm-tools openssh-server
cat /dev/null > /var/log/wtmp 
cat /dev/null > /var/log/lastlog 
rm -rf /tmp/*
rm -rf /var/tmp/*
rm -f /etc/ssh/ssh_host*
rm -f /etc/udev/rules.d/70-persistent-net.rules
cat <<EOL | sudo tee /etc/rc.local
#!/bin/sh -e
test -f /etc/ssh/ssh_host_dsa_key || dpkg-reconfigure openssh-server
exit 0
EOL

# assumption is that the host is already named
#echo ubuntu > /etc/hostname
apt-get clean
history -c
history -w
chmod +x /etc/rc.local
systemctl stop apt-daily-upgrade.timer
systemctl disable apt-daily-upgrade.timer
systemctl stop apt-daily.timer
systemctl disable apt-daily.timer
sudo apt autoremove -y
#truncate the machine id to avoid duplicate dhcp

# Changed lines below
echo -n > /etc/machine-id
sudo rm /var/lib/dbus/machine-id
sudo ln -s /etc/machine-id /var/lib/dbus/machine-id

echo "remove git repo and then issue a shutdown - h now"
```

Download and run script

{% code overflow="wrap" %}

```bash
wget https://raw.githubusercontent.com/ChampPG/Tech-Journals/main/SEC-480/ubuntu-server.sh
chmod +x ./ubuntu-server.sh
Sudo ./ubuntu-server.sh
```

{% endcode %}

Shutdown and take \`Base\` Snapshot

### Script to Create aux

```powershell
###################
#  cloneraux.ps1  #
#   Paul Gleason  #
###################

# Check if connected to server
$connectCheck = $global:defaultviserver | Select-Object Name -ExpandProperty Name

# if not connected prompt to connect
if ( $connectCheck -eq ""){
    #Connect to vcenter
    $vcenterdomain = Read-Host "Please enter domain for vcenter"
    Connect-VISever -Server $vcenterdomain
}

# Show hosts
Write-Host "--VM Host--"
Get-VMHost | Select-Object Name -ExpandProperty Name
Write-Host "-----------"
$vmhostIP = Read-Host "Please enter VM Host IP you would like to use"

# Show VMs
Write-Host "--VMs--"
Get-VM | Select-Object Name -ExpandProperty Name
Write-Host "-------"
$vmname = Read-Host "Please enter VM that you would like to clone"

# Show VM Snapshots
Write-Host "--Snapshots--"
Get-Snapshot -VM $vmname | Select-Object Name -ExpandProperty Name
Write-Host "-------------"
$snapshotName = Read-Host "Enter Snapshot that you would like to clone"

# Show Datastores
Write-Host "--Datastores--"
Get-Datastore | Select-Object Name -ExpandProperty Name
Write-Host "--------------"
$dsName = Read-Host "Select Datastore you would like to use"

#  Get Clone name
$cloneName = Read-Host "Enter the name for the clone"

# Get vmhost
$vmhost = Get-VMHost -Name $vmhostIP
# Get VM
$vm = Get-VM -Name $vmname
# Get snapshot name
$snapshot = Get-Snapshot -VM $vm -Name $snapshotName
# Get Data Store
$ds = Get-Datastore -Name $dsName
# The name of the vm replaces {0}
$linkedClone = $cloneName
# To create new linked clone
$linkedvm = New-VM -LinkedClone -Name $linkedClone -VM $vm -ReferenceSnapshot $snapshot -VMHost $vmhost -Datastore $ds
# Set Adapter
$linkedvm | Get-NetworkAdapter | Set-NetworkAdapter -NetworkName 480-WAN
```
