Coming soon. This course is planned; lessons and labs are not available yet. No release date has been announced.
Follow a request through local identity lookup and PAM decisions, then through a private Kerberos realm and an SSSD client.
Intermediate ยท Identity systems
Linux users, groups, permissions, services and SSH; DNS and time-source concepts before the Kerberos section.
Locate the layer rejecting an owned test identity, justify a narrow repair, and verify both permitted and denied access while keeping administration reachable.
Follow local PAM decisions, Kerberos tickets and an SSSD/FreeIPA client in isolated practice. Preserve a separate administration path while testing access. Enterprise directory migration and organization-wide access design are beyond this course.
3 planned chapters and 6 lesson outlines.
Distinguish identity lookup, credential checking and account policy while preserving an alternate administration path.
Planned task: Predict where an owned test account will be found and checked, then inspect lookup and PAM evidence without changing the primary remote-login path.
Changed case to investigate: The name resolves but authentication fails; stop treating the lookup result as proof of access.
Planned task: Test a non-primary service's rule order and account policy, make one justified change, and verify allowed, denied and administrator paths plus rollback.
Changed case to investigate: A second account reaches a lockout threshold; diagnose the rule without bypassing policy for all users.
Explain ticket issuance, service identity and dependencies before asking the realm to authenticate anyone.
Planned task: Predict a ticket request in a course-owned MIT Kerberos realm, inspect KDC/client evidence, and keep passwords and keytabs out of transcripts.
Changed case to investigate: A second service principal is absent; distinguish an unknown service from an invalid user credential.
Planned task: Observe a failed ticket or service-authentication path caused by clock skew or a wrong key, then repair only the evidenced dependency.
Changed case to investigate: The client clock is sound but the service keytab is stale; revise the hypothesis and verify a fresh exchange.
Follow an SSSD/FreeIPA client through lookup, authentication and authorization, including a deliberate outage.
Planned task: On an isolated FreeIPA/SSSD client, compare identity lookup, fresh authentication and authorization for allowed and denied test users.
Changed case to investigate: The realm is unavailable but a cached name resolves and a configured offline login succeeds. Distinguish cached credentials, a fresh online ticket exchange and authorization; login success alone does not prove contact with the KDC.
Planned task: Independently diagnose a changed realm/client fault, justify one repair, verify intended and denied access, and demonstrate that the separate admin console remains usable.
Changed case to investigate: A second client has the same symptom from a different cause; use its own evidence rather than copying the first repair.