Air travel. Путешествие по воздуху на английском языке
Собираясь путешествовать на самолете, важно знать о:
Об этом и многом другом вам расскажет специалист в области авиаперелетов Jen Leo. Предлагаем посмотреть следующее видео:
Итак, просмотрим еще раз основные этапы путешествия на самолете:
Вылет (Departure)
Departure board
Приехав в аэропорт (arrive at the airport), вы можете посмотреть на доску информации о вылете (departure board), где показаны номера рейсов (flight numbers), время вылета (departure time) и пункт назначения (destination).
Check-in desk Luggage / baggage
Необходимо зарегистрироваться (to check in). Пройдите к стойке регистрации пассажиров (check-in desk). Там взвесят ваш багаж (luggage), и, если норма бесплатного провоза багажа (weight allowances) превышена (обычно около 20 кг), то придется заплатить за багаж сверх установленной нормы (pay excess baggage). На стойке регистрации проверяют ваш билет и выдают посадочный талон (boarding card / boarding pass) на самолет с номером места.
Boarding card / boarding pass
Хорошо ли вы запомнили новую лексику? Проверьте себя, выполнив следующее задание:
4768(S, F): A Kerberos authentication ticket (TGT) was requested.
Event Description:
This event generates every time Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT).
This event generates only on domain controllers.
If TGT issue fails then you will see Failure event with Result Code field not equal to “0x0”.
This event doesn’t generate for Result Codes: 0x10 and 0x18. Event “4771: Kerberos pre-authentication failed.” generates instead.
For recommendations, see Security Monitoring Recommendations for this event.
Event XML:
Required Server Roles: Active Directory domain controller.
Minimum OS Version: Windows Server 2008.
Event Versions: 0.
Field Descriptions:
Account Information:
Account Name [Type = UnicodeString]: the name of account, for which (TGT) ticket was requested. Computer account name ends with $ character.
User account example: dadmin
Computer account example: WIN81$
Supplied Realm Name [Type = UnicodeString]: the name of the Kerberos Realm that Account Name belongs to. This can appear in a variety of formats, including the following:
Domain NETBIOS name example: CONTOSO
Lowercase full domain name: contoso.local
Uppercase full domain name: CONTOSO.LOCAL
A Kerberos Realm is a set of managed nodes that share the same Kerberos database. The Kerberos database resides on the Kerberos master computer system, which should be kept in a physically secure room. Active Directory domain is the example of Kerberos Realm in the Microsoft Windows Active Directory world.
User ID [Type = SID]: SID of account for which (TGT) ticket was requested. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
For example: CONTOSO\dadmin or CONTOSO\WIN81$.
A security identifier (SID) is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see Security identifiers.
Service Information:
Service Name [Type = UnicodeString]: the name of the service in the Kerberos Realm to which TGT request was sent. Typically has value “krbtgt” for TGT requests, which means Ticket Granting Ticket issuing service.
Service ID [Type = SID]: SID of the service account in the Kerberos Realm to which TGT request was sent. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
Domain controllers have a specific service account (krbtgt) that is used by the Key Distribution Center (KDC) service to issue Kerberos tickets. It has a built-in, pre-defined SID: S-1-5-21-DOMAIN_IDENTIFIER-502.
Network Information:
Client Address [Type = UnicodeString]: IP address of the computer from which the TGT request was received. Formats vary, and include the following:
IPv6 or IPv4 address.
::ffff:IPv4_address.
Client Port [Type = UnicodeString]: source port number of client network connection (TGT request connection).
Additional information:
Ticket Options [Type = HexInt32]: this is a set of different ticket flags in hexadecimal format.
Ticket Options: 0x40810010
Binary view: 01000000100000010000000000010000
Using MSB 0 bit numbering we have bit 1, 8, 15 and 27 set = Forwardable, Renewable, Canonicalize, Renewable-ok.
In the table below “MSB 0” bit numbering is used, because RFC documents use this style. In “MSB 0” style bit numbering begins from left.
The most common values:
Bit
Flag Name
Description
0
Reserved
—
1
Forwardable
(TGT only). Tells the ticket-granting service that it can issue a new TGT—based on the presented TGT—with a different network address based on the presented TGT.
2
Forwarded
Indicates either that a TGT has been forwarded or that a ticket was issued from a forwarded TGT.
3
Proxiable
(TGT only). Tells the ticket-granting service that it can issue tickets with a network address that differs from the one in the TGT.
4
Proxy
Indicates that the network address in the ticket is different from the one in the TGT used to obtain the ticket.
5
Allow-postdate
Postdated tickets SHOULD NOT be supported in KILE (Microsoft Kerberos Protocol Extension).
6
Postdated
Postdated tickets SHOULD NOT be supported in KILE (Microsoft Kerberos Protocol Extension).
7
Invalid
This flag indicates that a ticket is invalid, and it must be validated by the KDC before use. Application servers must reject tickets which have this flag set.
8
Renewable
Used in combination with the End Time and Renew Till fields to cause tickets with long life spans to be renewed at the KDC periodically.
9
Initial
Indicates that a ticket was issued using the authentication service (AS) exchange and not issued based on a TGT.
10
Pre-authent
Indicates that the client was authenticated by the KDC before a ticket was issued. This flag usually indicates the presence of an authenticator in the ticket. It can also flag the presence of credentials taken from a smart card logon.
11
Opt-hardware-auth
This flag was originally intended to indicate that hardware-supported authentication was used during pre-authentication. This flag is no longer recommended in the Kerberos V5 protocol. KDCs MUST NOT issue a ticket with this flag set. KDCs SHOULD NOT preserve this flag if it is set by another KDC.
12
Transited-policy-checked
KILE MUST NOT check for transited domains on servers or a KDC. Application servers MUST ignore the TRANSITED-POLICY-CHECKED flag.
13
Ok-as-delegate
The KDC MUST set the OK-AS-DELEGATE flag if the service account is trusted for delegation.
14
Request-anonymous
KILE not use this flag.
15
Name-canonicalize
In order to request referrals the Kerberos client MUST explicitly request the «canonicalize» KDC option for the AS-REQ or TGS-REQ.
16-25
Unused
—
26
Disable-transited-check
By default the KDC will check the transited field of a TGT against the policy of the local realm before it will issue derivative tickets based on the TGT. If this flag is set in the request, checking of the transited field is disabled. Tickets issued without the performance of this check will be noted by the reset (0) value of the TRANSITED-POLICY-CHECKED flag, indicating to the application server that the transited field must be checked locally. KDCs are encouraged but not required to honor the DISABLE-TRANSITED-CHECK option. Should not be in use, because Transited-policy-checked flag is not supported by KILE.
27
Renewable-ok
The RENEWABLE-OK option indicates that a renewable ticket will be acceptable if a ticket with the requested life cannot otherwise be provided, in which case a renewable ticket may be issued with a renew-till equal to the requested end time. The value of the renew-till field may still be limited by local limits, or limits selected by the individual principal or server.
28
Enc-tkt-in-skey
No information.
29
Unused
—
30
Renew
The RENEW option indicates that the present request is for a renewal. The ticket provided is encrypted in the secret key for the server on which it is valid. This option will only be honored if the ticket to be renewed has its RENEWABLE flag set and if the time in it’s renew-till field has not passed. The ticket to be renewed is passed in the padata field as part of the authentication header.
31
Validate
This option is used only by the ticket-granting service. The VALIDATE option indicates that the request is to validate a postdated ticket. Should not be in use, because postdated tickets are not supported by KILE.
Table 2. Kerberos ticket flags
KILE (Microsoft Kerberos Protocol Extension) – Kerberos protocol extensions used in Microsoft operating systems. These extensions provide additional capability for authorization information including group memberships, interactive logon information, and integrity levels.
Table 3. TGT/TGS issue error codes
Table 4. Kerberos encryption types
Table 5. Kerberos Pre-Authentication types
Type
Type Name
Description
0
—
Logon without Pre-Authentication.
2
PA-ENC-TIMESTAMP
This is a normal type for standard password authentication.
11
PA-ETYPE-INFO
The ETYPE-INFO pre-authentication type is sent by the KDC in a KRB-ERROR indicating a requirement for additional pre-authentication. It is usually used to notify a client of which key to use for the encryption of an encrypted timestamp for the purposes of sending a PA-ENC-TIMESTAMP pre-authentication value. Never saw this Pre-Authentication Type in Microsoft Active Directory environment.
15
PA-PK-AS-REP_OLD
Used for Smart Card logon authentication.
16
PA-PK-AS-REQ
Request sent to KDC in Smart Card authentication scenarios.
17
PA-PK-AS-REP
This type should also be used for Smart Card authentication, but in certain Active Directory environments, it is never seen.
19
PA-ETYPE-INFO2
The ETYPE-INFO2 pre-authentication type is sent by the KDC in a KRB-ERROR indicating a requirement for additional pre-authentication. It is usually used to notify a client of which key to use for the encryption of an encrypted timestamp for the purposes of sending a PA-ENC-TIMESTAMP pre-authentication value. Never saw this Pre-Authentication Type in Microsoft Active Directory environment.
20
PA-SVR-REFERRAL-INFO
Used in KDC Referrals tickets.
138
PA-ENCRYPTED-CHALLENGE
Logon using Kerberos Armoring (FAST). Supported starting from Windows Server 2012 domain controllers and Windows 8 clients.
—
This type shows in Audit Failure events.
Certificate Information:
Certificate Issuer Name [Type = UnicodeString]: the name of the Certification Authority that issued the smart card certificate. Populated in Issued by field in certificate.
Certificate Serial Number [Type = UnicodeString]: smart card certificate’s serial number. Can be found in Serial number field in the certificate.
Certificate Thumbprint [Type = UnicodeString]: smart card certificate’s thumbprint. Can be found in Thumbprint field in the certificate.
Security Monitoring Recommendations
For 4768(S, F): A Kerberos authentication ticket (TGT) was requested.
Type of monitoring required
Recommendation
High-value accounts: You might have high-value domain or local accounts for which you need to monitor each action. Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on.
Monitor this event with the “User ID” that corresponds to the high-value account or accounts.
Anomalies or malicious actions: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours.
When you monitor for anomalies or malicious actions, use the “User ID” (with other information) to monitor how or when a particular account is being used.
Non-active accounts: You might have non-active, disabled, or guest accounts, or other accounts that should never be used.
Monitor this event with the “User ID” that corresponds to the accounts that should never be used.
Account allowlist: You might have a specific allowlist of accounts that are the only ones allowed to perform actions corresponding to particular events.
If this event corresponds to an “allowlist-only” action, review the “User ID” for accounts that are outside the allowlist.
External accounts: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events).
Monitor this event for the “Supplied Realm Name” corresponding to another domain or “external” location.
Account naming conventions: Your organization might have specific naming conventions for account names.
Monitor “User ID” for names that don’t comply with naming conventions.
You can track all 4768 events where the Client Address is not from your internal IP address range or not from private IP address ranges.
If you know that Account Name should be used only from known list of IP addresses, track all Client Address values for this Account Name in 4768 events. If Client Address is not from the allowlist, generate the alert.
All Client Address = ::1 means local authentication. If you know the list of accounts which should log on to the domain controllers, then you need to monitor for all possible violations, where Client Address = ::1 and Account Name is not allowed to log on to any domain controller.
В этом задании необходимо задать вопросы по предложенной Вам картинке. Даются ключевые слова, на основе которых Вы и должны построить вопросы.
Подготовка – 1.5 минуты Время выполнения – 2 минуты Ваши вопросы – по 20 секунд на вопрос Балы за это задание – 5 баллов (по баллу за вопрос)
Task 2
Study the advertisement.
Make your life easier with our new kitchen unit!
You are considering buying the appliance and now you’d like to get more information. In 1.5 minutes you are to ask five direct questions to find out about the following:
