{"id":319,"date":"2012-10-28T20:06:04","date_gmt":"2012-10-28T18:06:04","guid":{"rendered":"https:\/\/zz-indigo.mavipet.sk\/?p=319"},"modified":"2019-10-29T18:04:59","modified_gmt":"2019-10-29T18:04:59","slug":"active-directory-a-vek-hesla","status":"publish","type":"post","link":"https:\/\/zz-indigo.mavipet.sk\/?p=319","title":{"rendered":"Active Directory a vek hesla"},"content":{"rendered":"<p>Pre t\u00fdch \u010do rovnako ako ja. Maj\u00fa tu smolu \u017ee\u00a0 na niektor\u00e9 firemn\u00e9 webov\u00e9\u00a0 aplik\u00e1cie pristupuj\u00fa\u00a0 pomocou loginu do MS\u00a0 dom\u00e9ny, ale ako prim\u00e1rny OS maj\u00fa linux. Sa \u010dasto stretn\u00fa z probl\u00e9mom ako dosta\u0165 upozornenie \u017ee je \u010das sa prihl\u00e1si\u0165 k nejak\u00fdm\u00a0 MS Windows a zmeni\u0165 si heslo.<\/p>\n<p><!--more--><\/p>\n<p>Na pomoc si vezmeme ldap klienta &#8222;ldapsearch&#8220; a MS Dokument\u00e1ciu a par inform\u00e1cii od niekoho kto ma pr\u00edstup k dom\u00e9ne \ud83d\ude09<\/p>\n<p>Potrebujeme vedie\u0165 na\u0161e prihlasovacie \u00fadaje z poh\u013eadu ldapu. Vyzera to asi takto: CN=login,CN=users, DC=domena,DC=com.<\/p>\n<p>1. Zistime ak\u00e1 je politika na dom\u00e9ne. \u010dasy s\u00fa v ActiveDirectory ud\u00e1van\u00e9 v 100ns preto v\u00fdsledok adekv\u00e1tne vydel\u00edme. V\u00fdsledkom je po\u010det dni:<\/p>\n<pre>ldapsearch -LLL -s base -H ldap:\/\/nas_domenovy_server -b \"dc=domena,dc=com\" -D \"CN=login,CN=users, DC=domena,DC=com\"=w \"heslo\" maxPwdAge | awk -F- '\/maxPwdAge\/ {print $2\/864000000000}'<\/pre>\n<p>2. AD obsahuje atrib\u00fat ktor\u00fd n\u00e1m pom\u00f4\u017ee zisti\u0165 kedy bolo naposledy heslo menen\u00e9. Ten sa vol\u00e1 PwdLastSet. Z neho zistime kedy bolo heslo nastavene. \u010d\u00edslo je po\u010det 100ns od 1.1.1601 preto ho vhodne vydel\u00edme a od\u010d\u00edtame<\/p>\n<pre>ldapsearch -LLL -H ldap:\/\/nas_domenovy_server -b \"dc=domena,dc=com\" -D \"CN=login,CN=users, DC=domena,DC=com\"=w \"heslo\" \"(sAMAccountName=Login)\" PwdLastSet ) | awk\u00a0 '\/pwdLastSet\/ {print $2\/10000000}'<\/pre>\n<p>3. Na z\u00e1ver e\u0161te jednoduch\u00fd konvertor aktu\u00e1lneho \u010dasu do form\u00e1tu timestampu pou\u017e\u00edvan\u00e9ho v Active Directory<\/p>\n<pre>echo $(expr $(date +%s) + 11644473600)0000000<\/pre>\n<p>Za t\u00fdchto \u00fadajov u\u017e nieje probl\u00e9m zisti\u0165 kedy n\u00e1m heslo vypr\u0161\u00ed. V sekcii Linux\/Unix\/SAN\u00a0 -&gt; OpenLdap \u010doskoro zverejn\u00edm hotov\u00e9 skripty.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Pre t\u00fdch \u010do rovnako ako ja. Maj\u00fa tu smolu \u017ee\u00a0 na niektor\u00e9 firemn\u00e9 webov\u00e9\u00a0 aplik\u00e1cie pristupuj\u00fa\u00a0 pomocou loginu do MS\u00a0 dom\u00e9ny, ale ako prim\u00e1rny OS maj\u00fa linux. Sa \u010dasto stretn\u00fa z probl\u00e9mom ako dosta\u0165 upozornenie \u017ee je \u010das sa prihl\u00e1si\u0165 &hellip; <a href=\"https:\/\/zz-indigo.mavipet.sk\/?p=319\">Pokra\u010dova\u0165 v \u010d\u00edtan\u00ed <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,3,11],"tags":[],"class_list":["post-319","post","type-post","status-publish","format-standard","hentry","category-bezpecnost","category-hw-a-sw","category-utilitky"],"_links":{"self":[{"href":"https:\/\/zz-indigo.mavipet.sk\/index.php?rest_route=\/wp\/v2\/posts\/319","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zz-indigo.mavipet.sk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zz-indigo.mavipet.sk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zz-indigo.mavipet.sk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zz-indigo.mavipet.sk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=319"}],"version-history":[{"count":1,"href":"https:\/\/zz-indigo.mavipet.sk\/index.php?rest_route=\/wp\/v2\/posts\/319\/revisions"}],"predecessor-version":[{"id":2748,"href":"https:\/\/zz-indigo.mavipet.sk\/index.php?rest_route=\/wp\/v2\/posts\/319\/revisions\/2748"}],"wp:attachment":[{"href":"https:\/\/zz-indigo.mavipet.sk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=319"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zz-indigo.mavipet.sk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=319"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zz-indigo.mavipet.sk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=319"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}