Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Mod 7 part 2 > Day 9 > Flashcards

Day 9 Flashcards

1
Q

Lightweight Directory Access Protocol (LDAP)

A

an open standard protocol for accessing object oriented databases.
LDAP defines how clients acess the directory server and perform database operations over an IP network.
Uses port 389

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

LDAP encompasses 4 models:

A

the information model, naming model, functional model, security model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

information model

A 
objects- most fundamental item in a directory
attributes- characteristics of objects
schema- set of rules or structure that defines objects
classes-logical grouping of objects
container- used for organizing objects, but cannot have ...........group policies linked directly to them
organizational unit (OU)- used for organizing objects ............and can have group policies linked to them
domains-contain OU's, containers, and objects
User Principal Name- May be used as user logon name .........for the domain.  Combines username and DNS ..........name; commonly used as an email address
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

naming model

A 
distinguished name (DN)--  full name--- contains the relative distinguished name (RDN) and location within the LDAP directory.
contains every piece after what is asked for.

Relative distinguished name (RDN) – Common Name– portion of the name that does not relate to the directory strucuture.
portion of the name that applies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

object class identifiers as defined in RFC-1777

A

DC- domain component
OU- Organizational Unit Name
CN- Common Name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

functional model

A

provides information that details what can be done with the database.

authentication—bind is the primary operation
Interrogation–search is the primary operation
update–add, modify, and delete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

security model

A

how directory information is protected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

active directory fundamentals

A

Active Directory is Microsoft’s implementation of LDAP directory services.

AD is contained in the %systemroot%\NTDS\Ntds.dit database file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

benefits of active directory

A 
flexible querying
integration with DNS
extensibility
policy-based administration
scalability
replication
security
interoperability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Domains

A

serve as boundries for authentication and policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

domain controller

A

installing Active Directory on a Windows server makes it a domain controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

member server

A

Window’s servers that do not have AD installed are called member servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

replication

A

required when a domain has multiple domain controllers to maintain data conformity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

sites

A

used to represent the physical topology of the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Benefits of sites

A

Enables clients to efficiently discover services that are close

Enables network traffic control to optimize replication between domain controllers

Enables policy application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Benefits of sites

A

Enables clients to efficiently discover services that are close

Enables network traffic control to optimize replication between domain controllers

Enables policy application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

forest

A

one or more domains sharing a common schema, where the first domain created is the forest’s root domain.
(a collection of tree’s)

18
Q

tree

A

consists of one or more domains that may be grouped together to form a hierarchical structure.
(a hierarchical collection of domains.)
child domains within a tree must have contiguous namespaces that build upon the parents

19
Q

domain controller ports

A

unsecure secure
kerberos 88 464
LDAP 389 636
global catalog 3268 3269

20
Q

member server ports

A 
ftp control       21
SMTP              25
DNS                53
DHCP             67/68
HTTP              80
21
Q

workstation ports

A

RCP 135
NETBios 137, 138, 139
SMB 445

22
Q

trusts

A

a trust relationship established between domains to enable users in one domain to access resources in another domain

23
Q

type of trusts

A

transitive trusts

non-transitive trusts

24
Q

transitive trust

A

automatic
when domain A trusts domain B an ddomain B trusts domain C, then A can access resources in C if they have correct permissions

25
Q

non-transitive trusts

A

external trusts configured manually
forest- between two forests, manually created
shortcut- between two distant child domains; improves login
external- access between two active directory domains located in different forests

26
Q

domain wide queries

A

microsoft implements LDAP as Active directory, so when a client queries for resources within the domain, LDAP port 389 is used.

  1. client queries DNS for LDAP SRV record.
  2. once the LDAP service is identified, client connects to port 389

USER->DNS->SRV->LDAP

27
Q

forest-wide queries

A

requires a global catalog (GC)
uses port 3268 or 3269 (SSL)
GC is implemented on one or more domain controlers.
Uses distinguished names to identify the location of ………..every object in the forest.

28
Q

steps for a forest-wide query

A
  1. client queries DNS for GC SRV record.
  2. client connects to port 3268 or 3269. Connection is made to a domain controller running the GC service.

USER->DNS->SRV->GC

29
Q

domain login

A

adds 4 steps to the workstation login in

  1. LSA uses kerberos.dll to send credentials to domain controller
  2. domain controller lsass.exe uses kdcsvc.dll to verify credentials with AD
  3. if credentials match, KDSVC.dll returns back to workstation.
  4. workstation LSA creates AT

see chart on page 139 for full process

30
Q

kerberos

A

the primary authentication package used in Windows Domain (AD)
based on RFC 1510
uses port 88 on TCP and UDP

31
Q

advantages of kerberos

A

provides faster authentication

provides single sign-on between active directory systems

32
Q

Key Distribution Center (KDC)

A

domain controllers act as KDC’s. The LSA uses kdcsvc.dll to provide two main services, authentication service and ticket granting service

33
Q

authentication service (AS)

A

receives pre-authentication data, consctructs a ticket granting ticket and sends back to client

34
Q

Ticket Granting Ticket (TGT)

A

TGT is a ticket that enables secure transport of credentials between the KDC and the client.
lasts for 10 hours

35
Q

Ticket Granting Service (TGS)

A

TGS receives the TGT and session key from the client.

The TGS constructs a service ticket used for admission to the requested resource/service and returns to client

36
Q

Service Ticket (ST)

A

ST is used to authenticate with services other than TGS and is meant only for requested resource/service

37
Q

krbtgt account

A

krbtgt is the KDC account used to encrypt the TGT

38
Q

Session Key (SK)

A

password hash of the user account is used to encrypt the session key

39
Q

authentication service exchange

Kerberos AS Request (KRB_AS_REQ

A
  1. AS_REQ ———–>

pre-authentication info

40
Q

kerberos AS Response (KRB_AS_REP)

A
41
Q

kerberos TGS Request (KRB_TGS_REQ)

A

TGS_REQ——–>

TGT+Service

42
Q

kerberos TGS Response (KRB_TGS_REP)

A

Mod 7 part 2 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions