DCE Secure Core and DFS System Administration;
Lab / Homework Exercise 1:
Establishing and Examining DCE Identities and ACLs

A. Logging in and checking credentials:

  1. login to justdoit.dccs with your Unix username password.
  2. see if you have a DCE identity
  3. dce_login with your DCE username "class/<username>", where <username> is the same as your Unix username, using you DCE password. (yes, "/"'s in usernames are ugly as sin, but doing this will let us do some system administration stuff later -- just try not to send mail to this account. :-) )
  4. now check out your DCE identity, noting your principal and group names. Write down the expiration time for your DCE credentials identity, and the pathname of your credentials file.
  6. familiarize yourself with the basic sanity checks from the notes by running them.

B. Checking Security Junction ACLs:

  1. view the ACL on your principal name, /.:/sec/principal/class/<your username>. Write down your permissions to this object.
  2. Write down the names of all the permission you could have for this object. Feel free to use the help command.
  3. now view the ACL for /.:/sec/principal/class. Note that this is a container that is part of your principal name. How many kinds of ACLs does it have?
  4. Looking at all of the ACLs, which one looks most like the ACL in 1)?

C. Playing Games with Credentials Files

  1. Looking back to A.4), where are the credentials files stored?
  2. How many credentials files can you find that belong to you? What are they called?
  3. Now refresh your DCE credentials. Where are your credentials stored now? Is this the same or different than in A.4)?
  4. enter the Unix command "set" and write down the line for the KRB5CCNAME=FILE environment variable.
  5. exit the dce_login shell with Control-D.
  6. how is your DCE identity doing?
  7. challenge: can you resume (re-obtain) your DCE identity without dce_login?
  8. now destroy your DCE identity, before exiting the dce_login shell.

So ends homework / lab exercise 1. Hope you enjoyed it!

Please send comments and corrections to Noam Arzt, arzt@isc.upenn.edu