chore(e2e): Added the option to make member server kerberos only (#5997)

* chore(e2e): Added the option to make member server kerberos only

enos/modules/aws_rdp_domain_controller/main.tf

@@ -36,7 +36,9 @@ data "aws_subnets" "infra" {
 }
 
 locals {
-  username = split(":", data.aws_caller_identity.current.user_id)[1]
+  username     = split(":", data.aws_caller_identity.current.user_id)[1]
+  domain_parts = split(".", var.active_directory_domain)
+  domain_sld   = local.domain_parts[0] # second-level domain (example.com --> example)
 }
 
 // We need a keypair to obtain the local administrator credentials to an AWS Windows based EC2 instance. So we generate it locally here
@@ -273,7 +275,7 @@ resource "aws_instance" "domain_controller" {
                   Add-WindowsFeature -name ad-domain-services -IncludeManagementTools
 
                   # causes the instance to reboot
-                  Install-ADDSForest -CreateDnsDelegation:$false -DomainMode 7 -DomainName ${var.active_directory_domain} -DomainNetbiosName ${var.active_directory_netbios_name} -ForestMode 7 -InstallDns:$true -NoRebootOnCompletion:$false -SafeModeAdministratorPassword $password -Force:$true
+                  Install-ADDSForest -CreateDnsDelegation:$false -DomainMode 7 -DomainName ${var.active_directory_domain} -DomainNetbiosName ${local.domain_sld} -ForestMode 7 -InstallDns:$true -NoRebootOnCompletion:$false -SafeModeAdministratorPassword $password -Force:$true
                 </powershell>
               EOF
 

enos/modules/aws_rdp_domain_controller/variables.tf

@@ -46,10 +46,4 @@ variable "active_directory_domain" {
   type        = string
   description = "The name of the Active Directory domain to be created on the Windows Domain Controller."
   default     = "mydomain.com"
-}
-
-variable "active_directory_netbios_name" {
-  type        = string
-  description = "Ostensibly the short-hand for the name of the domain."
-  default     = "mydomain"
-}
+}

enos/modules/aws_rdp_member_server/main.tf

@@ -192,6 +192,12 @@ ${var.domain_admin_password}
                   (Get-WmiObject Win32_ComputerSystem).Domain
                   Get-Process -Name *ssh* -ErrorAction SilentlyContinue
 
+                  # Enable Kerberos only authentication if required
+                  %{if var.kerberos_only~}
+                    Set-ItemProperty  -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0"  -Name RestrictSendingNTLMTraffic -Value 2
+                    Set-ItemProperty  -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0"  -Name RestrictReceivingNTLMTraffic -Value 2
+                  %{endif~}
+
                   # Enable audio
                   Set-Service -Name "Audiosrv" -StartupType Automatic
                   Start-Service -Name "Audiosrv"

enos/modules/aws_rdp_member_server/variables.tf

@@ -71,3 +71,9 @@ variable "domain_controller_sec_group_id_list" {
   type        = list(any)
   description = "ID's of AWS Network Security Groups created during creation of the domain controller."
 }
+
+variable "kerberos_only" {
+  type        = bool
+  description = "Only allow kerberos auth"
+  default     = false
+}