"읽기 전용 도메인 컨트롤러" 인증의 이해
???? : Understanding “Read Only Domain Controller” authentication
?????? ???. ? ????(Bob Drake)???. ??? Windows Server 2008? "?? ?? ??? ????(RODC)"? Windows Server 2003? Windows Server 2008 standard ??? ????? ??? ??? ???? ????? ??? ????. "?? ?? ??? ????"? Windows Server 2008?? ?? ???? ???? WAN(wide area network)? ?? ??? ??? ??? ??? ??? ????? ???? ??? ???? ?? ?? ???? ??? ??? ????? ??? ?????. Windows Server 2008 RODC? ??? ??? "???? ?? ??"?? RODC? ??? ????? ???? ??? ?? ?????.
?? ??? ????? RODC? ????? ??? ???? ???, TechNet? "??? ????"? "Kerberos ??"? ??? ??? ????. ??? ??? ?(??? ????)??, Winlogon? ??? ????? ?? ??? ????? ???? Kerberos? ???? LSA(local security authority)? ?????. ??? ????? ?? ??? LSA?? ??? ??? ???? LSA? ??? ??? ??? ?????. Kerberos ??? ??? ??? ?? ? ? ????.(Kerberos ?? ??? ??)
????? ??? ???, Netmon3.1 (?? Wireshark, Ethereal, Packetyzer) ?? ???? ?? ?? ????? ??? ??? ????. ??? ???? ????, ????? ??? ??? ????? ???? "KRB_AS_REP"? "KRB_TGS_REP"? ?? ??? ?? ?? ? ? ????.
"???? ?? ??"? ???? RODC ?? ????? ?????. RODC ?? ???, 4?? ??? ??? RODC ??? ???? ?? ??? ??? ????.
l msDS-Reveal-OnDemandGroup. ? ??? ??? ???? DN(distinguished name)? ?????. ??? ??? ??? ????? RODC? ??? ?????.
l msDS-NeverRevealGroup. ? ??? RODC? ??? ??? ?? ??? DN(distinguished name)? ?????. ??? ??? RODC? ?? ???? ?? ?? ???? ??? ?? ????. RODC? ??? ??? ??? ????? ???? ????. ?? ??? ?? ???? ????? RODC? ???? ????. ??? ???? RODC? ?????.
l msDS-RevealedList. ? ??? ????? RODC? ???? ?? ?? ??? ??????.
l msDS-AuthenticatedToAccountList. ? ??? RODC? ??? ?? ???? ?? ?? ???? ?????. ??? ?? ???? ???? ???? ?? RODC? ????? ???? ? ? ??? ?? ????. ???? RODC? ???? ?? ??? ????? ??? ? ??? ???.
------------------
l Allowed RODC Password Replication Group. ? ??? msDS-Reveal-OnDemandGroup? ?????.
l Denied RODC Password Replication Group. ? ??? msDS-NeverRevealGroup? ?????.
?? : "RODC ???? ?? ?? ??"? ????? ??? ??, "RODC ???? ?? ?? ??"? ?? 'VIP' ??? ?????(Enterprise Administrators, Cert Publishers, Schema Administrators, ?). ???? ??? ??? ??? ????.
"Repadmin.exe" ???? ???? ???? ???? ?? ?? ??? ??? ? ????. ??? ???? ?? ?? PRP? ??? ??? ?? ?????.
Repadmin /prp view <RODC> {<List_Name >|<User>}
??? RODC?? ??? ??? ?? ??? ???? ?? ?????.
??? ??? ????! ?? ??? ???? ???(msDS-RevealOnDemand)? ?? ??? ???? ???(msDS-NeverRevealGroup), ?? ??? ???? ????(msDS-RevealedList), ?? RODC?? ??????(msDS-AuthenticatedToAccountlist) ? ? ????.
???? ?? ??? ??? ? ??????. Active Directory ??? ? ??? ???? ?? ??? ????? OU? ?? RODC? ?????. "???? ?? ??" ?? ? ?? ??? ????. "RODC ???? ?? ?? ??"? "RODC ???? ?? ?? ??"???. ??? ??? ???? ??? ? ????.
?? ?? ??? "Prepopulate the password cache for an RODC" ?????. ? ??(??)? ???? RODC? ??? ???? ?? ???? ?? ?????.
???? ???? ??? ???? ?? "Repadmin" ????? ??? ?? ??? ? ????.
Repadmin /rodcpwdrepl [DSA_LIST] <Hub DC> <User1 Distinguished Name> [<Computer1 Distinguished name> <User2 Distinguished Name>…].
?? ???? "Ned Pyle"? Repadmin? ?? ????? ??? ?? ? ? ????.
??? ??? ??? RODC? ??? ???? ???? RODC? ??? ? ????? ???? ??? ?????. ????? ???? ???, RODC? ??? ??? ???? ?????. ??? ????? ???? ?? ???, RODC? ?? ??? ?? ??? Windows Server 2008 ??? ????? ???? ??? ???? RODC? ????? ?????. ?? ??? ??? ????, RODC? ??? ????? ??? ??? ????? ??? ????? ??? ?? ?? ??? ????.
??? ?? ??? ??? ?? ?? ? ? ????. NetMon 3.1 ??? ???, RODC? ????? ???? ?? ??? ??? ??????. ???? RODC(2k3DOM2k8DC2)? ???? RODC? ?? ??? ??? ????(2k3DOM2k8DC)? ??? ?????. ??? ????? ???? ?? ??? ???? ???? ? ? ????.
??? ???? ???? ?? ??? ??? ????? ????? ??????. ??? ?? ?? RODC? ??? ???? ????, ??? ??? ?? ????. ??? RODC? ??? ????? ????? ???? ?? ? ? ???, ??? ????? ???? ??? ??? ?? ? ? ?? ???.
?? : (WAN)Wide Area Network? ???? ??? ??? ????? ???? ????, ??? ??? ??? ?????.
????, ??? ??? ???? ???, RODC? ??? ?? ??? ??? ????? ??? ?? ?????. ??? ????? ??? ??????, RODC? ?? ??? ?? ??? ??? ????. ?? ???? ????, ????? ????, ??? ???? RODC? ???? ?????. ????? RODC? ??? ??? WAN ???? ???? ???, ??? ????? ??? ???? ???? ???? ???? ?? ??? ??? ???. ?? ?????? ? ????? ?? ?? ?? ???? ???? ?? ? ?? ???? ?????.
-Bob Drake