Difference between revisions of "OPS235 Lab 6 - CentOS7"
Line 55: | Line 55: | ||
There are several reasons for creating '''VPNs'''. The main reason is to safely connect servers together to limit but allow share information among computer networks. This allows for a secure connection of computers yet controlling access to and monitoring (protecting) access to permitted users (discussed in more depth in lab7). | There are several reasons for creating '''VPNs'''. The main reason is to safely connect servers together to limit but allow share information among computer networks. This allows for a secure connection of computers yet controlling access to and monitoring (protecting) access to permitted users (discussed in more depth in lab7). | ||
+ | |||
==Part 1: Configuring a Private Network (Via Virtual Machine Manager) == | ==Part 1: Configuring a Private Network (Via Virtual Machine Manager) == |
Revision as of 13:33, 18 June 2015
Contents
LAB PREPARATION
Purpose / Objectives of Lab 6
In this lab, you will learn the basics of networking by using your Virtual Machines and your c7host machine. You will first set up a virtual private network among your c7host machine and your Virtual Machines. In addition, you will learn to set up network names (to associate with server's IP Addresses), associate network services with port numbers for troubleshooting purposes, and setup firewall policies via the iptables command.
Main Objectives
- Configure a private (virtual) network for your VMs and your c7host machine
- Configure network interfaces for your Virtual Machines using both graphical and command-line utilities.
- Use local hostname resolution to resolve simple server names with their corresponding IP Addresses
- Backup more recent files (eg. incremental backup) using the find command and a date/time-stamp files
- Use common networking utilities to associate network services with port numbers
- Gain initial exposure to the iptables command used to configure and maintain a firewall for protection and troubleshooting
- Configure iptables to allow/disallow/forward different types of network traffic
Minimum Required Materials
My Toolkit (CLI Reference)
Networking Utilities: | Additional Utilities: | |
INVESTIGATION 1: CONFIGURING A PRIVATE NETWORK
For the remainder of this course, we will focus on networking involving our VMs and our c7host machine. This lab will focus on setting up a virtual private network (VPN), connecting our VMs and c7host machine to the VPN, and configuring our VPN to make more convenient to use, troubleshoot and protect. Lab 7 will focus more on configuring SSH and making access to the VPN more secure. Finally, lab 8 will focus on configuring the network for fixed workstations, mobile devices, or both at the same time.
There are several reasons for creating VPNs. The main reason is to safely connect servers together to limit but allow share information among computer networks. This allows for a secure connection of computers yet controlling access to and monitoring (protecting) access to permitted users (discussed in more depth in lab7).
Part 1: Configuring a Private Network (Via Virtual Machine Manager)
Before configuring our network we want to turn off dynamic network configuration for our Virtual Machines by turning off the "default" virtual network.
- Perform this section in your c7host machine.
- Turn off your virtual machines
- Start Virtual Machine Manager
- In the Virtual Machine Manager dialog box, Select Edit-> Connection Details.
- In the Hosts Details dialog box, select the Virtual Networks tab
- Disable the default configuration from starting at boot by deselecting "Autostart" (on boot) checkbox.
- Stop the default network configuration by clicking on the stop button at the bottom left-side of the dialog box.
- Click the add button (the button resembles a "plus sign") to add a new network configuration.
- Give your new network a name (i.e. network1)
- Enter in the new network IP address space:
- 192.168.235.0/24
- Disable DHCP by deselecting the check box.
- Enable Network Forwarding by Selecting Forwarding to physical network
- The destination should be Any physical device and the mode should be NAT
- Proceed with changes, and select Finish.
- Now we need to reconfigure our 3 VMs to use our new virtual network network1
- Select the centos1 VM and edit the Virtual Machine Details
(Note: the Virtual Machine window will appear - do not start virtual machine) - Under View select Details
- In the left pane of the Virtual Machine window, select NIC: and note that this NIC is on the "default" virtual network
- Change it to Virtual Network network1 : NAT
- Select the centos1 VM and edit the Virtual Machine Details
Answer Part 1 observations / questions in your lab log book.
Part 2: Configuring VM Network Setup Graphically (system-config-network)
- On your centos host run
ifconfig
and make note of the IP address assigned to thevirbr1
interface. This will be the default gateway and DNS server for your VMs. - Start centos2 VM and login
- Edit the existing wired connection
- In the IPv4 Settings tab change the method from "Automatic (DHCP)" to "Manual".
- In the Addresses section, click "Add".
- Manually set the IP configuration to:
- IP Address 192.168.235.12
- Subnet Mask 255.255.255.0
- Default Gateway The IP address of
virbr1
on your centos host.
- Click on the DNS field and add The IP address of
virbr1
on your centos host. as the primary DNS server. - Your network connection may take a couple of minutes to reconfigure connect (view the Network Manager applet in the gnome panel at the top of the screen).
- You should be able to use the service commands to restart your network:
service network stop
service network start
- Verify your new interface by examining the output of
ifconfig
- To verify that centos2 has the correct default gateway configured, use the commands:
route -n
ifconfig
nslookup
ping
Answer Part 2 observations / questions in your lab log book.
Part 3: Backing up Only Recent File Changes
- Start the centos1 VM and login
- Before we configure centos1 we should create a timestamp file that can be used to see which files have changed as a result of using the GUI tool. Issue the following command:
-
date > /tmp/timestamp
-
- Run the network configuration tool and enter the following static configuration in the same way that you configured centos2.
- IP Address: 192.168.235.11
- Subnetmask: 255.255.255.0
- Default Gateway: 192.168.235.1
- DNS Server: 192.168.235.1
- Save and exit the network configuration tool.
- You may have to restart the network using the correct command.
- Verify the configuration by pinging centos host (192.168.235.1) and centos2 (192.168.235.12)
- We will now create an Incremental Backup.
- Run the following Linux command:
-
find /etc -newer /tmp/timestamp > /root/netcfg.lst
-
- View the /root/netcfg.lst file. What does it contain?</li>
- Create a new directory called: /tmp/lab6
- Issue the following commands:
find /etc -newer /tmp/timestamp -exec cp {} /tmp/lab6 \;
- View the contents of the /tmp/lab6 directory. What does it contain?
Answer Part 3 observations / questions in your lab log book.
Part 4: Configuring VM Network Setup via Command Line (centos3)
- Start centos3 VM and login as root
- Use the command
ifconfig
to list active interfaces, you should see one with a name ofeth0
or a similar name. - To configure your card with a static address use the following command:
ifconfig eth0 192.168.235.13 netmask 255.255.255.0
- To configure a default gateway for that interface enter the command:
-
route add default gw 192.168.235.1
-
- To configure a DNS server for this VM, edit the file
/etc/resolv.conf
. Change thenameserver
line to be:-
nameserver 192.168.235.1
-
- Confirm your settings work by doing the following:
-
ifconfig
route -n
-
ping
(your other VM's and centos host) -
ssh
( to your matrix account to test your DNS)
-
- Restart the
centos3
VM, or just wait a few minutes. - Login and test your configuration again. What happened?
- While we can configure network settings from the command line those settings are not persistent. To configure persistent network configurations we need to edit the configuration files. #:* Change to the /etc/sysconfig/network-scripts directory on
- List the contents of the directory and you should see 2 different types of files, network config scripts and network configuration files.
- Look for the configuration file for your original interface, it should be named ifcfg-eth0
- Edit the new file for you interface and give it the following settings (or create a brand new file, might be easier than editing the old one):
- DEVICE="eth0"
- IPADDR="192.168.235.13"
- NETMASK="255.255.255.0"
- GATEWAY="192.168.235.1"
- HWADDR="52:54:00:3f:5c:fa" <-- use the MAC address for YOUR interface
- DNS1="192.168.235.1"
- BOOTPROTO="static"
- ONBOOT="yes"
- NM_CONTROLLED="yes"
- IPV6INIT="no"
- Save the file and then restart the network connection by issuing the commands:
ifdown eth0
and thenifup eth0
- Verify your configuration as you did before.
- Restart the centos3 VM.
- Login and attempt to ssh to your matrix account to verify the settings.
Answer Part 4 observations / questions in your lab log book.
INVESTIGATION 2: CUSTOMIZING THE VIRTUAL NETWORKING ENVIRONMENT
Part 1: Using Local Hostname Resolution
After setting up a private network, it can be hard to try to remember IP addresses. In this section, we will setup your network to associate easy-to-remember server names with IP ADDRESSES.
- Complete this investigation on all of your VMs and the c7host machine.
- Use the
hostname
andifconfig
commands on your c7host machine and all of your 3 VM's to gather the information needed to configure the /etc/hosts file on all of your Linux systems. - Edit the /etc/hosts file on each of the virtual machines and host machine. Add the following contents to the bottom of the /etc/hosts file:
- 192.168.235.1 c7host
- 192.168.235.11 centos1
- 192.168.235.12 centos2
- 192.168.235.13 centos3
- Confirm that each host can ping all three of the other hosts by name.
Answer Part 1 observations / questions in your lab log book.
Part 2: Obtaining MAC (Hardware) addresses on Network Computers
When our CentOS system provides any services on a network, those services are accessible through a port number. All network services are configured to be accessed on a particular port number. By examining which ports are active on our system we can know what services (and points of attack) are available on our system. The ability to examine this information is important for troubleshooting network services and securing our systems. One great tool for this is the netstat command.
- Perform this section on your c7host machine.
- On the centos host ping each of your VM's
- Examine the contents of the ARP cache by using the command:
arp
- Check the contents of the cache again by using the command:
arp -n
- What was the difference in output? For what other command did the option -n have a similar effect?
- On your CentOS host execute the command:
netstat -at
- This command will list all active TCP ports. Note the state of your ports.
- TCP is a connection oriented protocol that uses a handshaking mechanism to establish a connection. Those ports that show a state of LISTEN are waiting for connection requests to a particular service. For example you should see the ssh service in a LISTEN state as it is waiting for connections.
- From one of your VM's login to your host using ssh
- On the CentOS host rerun the command and in addition to the LISTEN port it should list a 2nd entry with a state of ESTABLISHED. This shows that there is a current connection to your ssh server.
- Exit your ssh connection from the VM and rerun the command on the CentOS host. Instead of ESTABLISHED it should now show a state of CLOSE_WAIT. Indicating that the TCP connection is being closed.
- On your CentOS host try the command
netstat -atn
. How is this output different? - Without the
-n
optionnetstat
attempts to resolve IP addresses to host names (using /etc/hosts) and port numbers to service names (using /etc/services) - Examine the /etc/services file and find which ports are used for the services: ssh, sftp, http
- Now execute the command
netstat -au
What is the difference between the options: -at and -au? - When examining UDP ports why is there no state?
Answer Part 2 observations / questions in your lab log book.
Part 3: Introduction to Firewalls: iptables
Since Linux servers may be connected to the Internet, it is very important to run a firewall to control what comes into the computer system, what goes out of the computer system, and what may be forwarded to another computer. Linux uses the command called iptables to set the firewall rules. Although graphical programs can be used to configure iptables, it is important for students of Linux Administration to learn how to use the iptables command for more complex and automated configuration via shell scripting.
- For the remainder of this section, use your c7host machine.
- As root on the CentOS host enter the following commands at the prompt:
-
iptables -L
-
iptables -F
-
- What did those commands issued above do? Refer to the manpages for iptables if not certain.
- Set the default policy for the INPUT chain to DROP by issuing the command:
-
iptables -P INPUT DROP
-
- Now try on your own to change the default policies for the OUTPUT and FORWARD chains to DROP
- Write the commands you executed in your lab book.
- Can we mix these policies? Try to set the FORWARD chain policy to ACCEPT. Did it work?
Testing iptables Policies
- Execute the command
iptables -L
and check that the policies on your INPUT and OUTPUT chain are set to DROP - Open a browser and attempt to access the Internet. Were you successful?
- Using the commands you have learned so far, change the policies on the INPUT and OUTPUT chains to ACCEPT
- Open your browser and attempt to access the Internet again. Were you successful?
- Change the policies on all of the chains to DROP
- In the OUTPUT chain, add the following rule:
iptables -A OUTPUT -j LOG
- The above rule tells iptables to log packets and relevant information to /var/log/messages.
- This entry in the OUTPUT policy will therefore log all packets being sent out of the machine.
- Try to access the Internet again. Because the policies have been set to DROP, you should be unsuccessful. However, every packet of data that your PC attempted to send out was logged. Let's have a look at the log file and analyze the data:
tail /var/log/messages
- This command shows us the last 10 lines of the file. While there are many things being logged to this file, the last thing we did was try to access the Internet so we should be able to see the data we need. Look for a line that looks similar to the following:
Mar 3 09:21:03 koala-laptop kernel: [90775.407304] IN= OUT=wlan0 SRC=192.168.1.107 DST=66.249.90.104 LEN=1470 TOS=0x00 PREC=0x00 TTL=64 ID=19752 DF PROTO=TCP SPT=45431 DPT=80 WINDOW=108 RES=0x00 ACK PSH URGP=0
- Your IP, host names and date will be different, but the one thing that should be the same is the DPT=80 value.
- When your computer tried to send OUT a request to connect to the Internet using the WWW, the computer used a destination port of 80. This is the standard port for the WWW. Because we have set the default policy to DROP it drops these packets. The problem is we are dropping all packets. What if we just want to drop the WWW packets?
- Using the commands we already know, change the default policies on all of your chains to ACCEPT.
- Open a browser and confirm that you can access the world wide web.
- Enter the command:
iptables -I OUTPUT -p tcp -s0/0 -d 0/0 --dport 80 -j DROP
- Try to access the Web. If you have done everything right, you should not have been successful.
- After you have completed the test execute the following command:
iptables -F
- Using the information you have learned, try on your own to achieve the same goal as above (block www access to your computer) by using the INPUT chain instead of the OUTPUT chain.
- After you have completed this task, flush the iptables again.
- Make sure that your ssh server is running on the host machine and try to access it from a virtual machine of your choice.
- Once you have confirmed that ssh is running on the host machine, insert an iptables rule on the host machine to prevent access to the ssh server from all VM's on the virtual network.
- Confirm that your rule works by testing from your VM's
- Does iptables close the port? Check using
netstat
- Now insert a rule on the CentOS host that would ACCEPT connections from the centos2 VM only.
- Fully test your configuration.
Making iptables Policies Persistent
It should be noted that all of the commands that we do here with iptables will not be persistent unless you have your configuration. That means if you re-boot, the default iptables configuration will be loaded. When your iptables service starts or at boot time it has to load the rules from the file /etc/sysconfig/iptables.
The final section below teaches you to make your iptables settings permanent.
- Make a backup of the file /etc/sysconfig/iptables
- Examine the file to see how rules are added.
- Issue the command:
iptables-save > /etc/sysconfig/iptables
to save the rules you added with the iptables command, above. - Verify that the file '/etc/sysconfig/iptables was updated with your new rules.
- Restart your iptables service and test your configuration.
Answer the Part 3 observations / questions in your lab log book.
LAB 6 SIGN-OFF (SHOW INSTRUCTOR)
Arrange proof of the following on the screen:
- ✓ centos1 VM:
- Contents of /tmp/lab6 directory.
- ✓ centos2 VM:
- ssh from centos2 to the CentOS host
- ✓ All VMs:
- ifconfig information
- Contents of /etc/host file
- ✓c7host machine
- arp cache information
- Contents of /etc/host file
- Proof of backup
- A list of your iptables rules
- ✓ Lab6 log-book filled out.
Preparing for Quizzes
- What is a port?
- What command will set your IP configuration to 192.168.55.22/255.255.255.0 ?
- What file contains the systems
iptables
rules? - What is the difference between UDP and TCP?
- What port number is used for DHCP servers?
- What is the function of the file
/etc/services
? - What is the function of the file
/etc/hosts
? - What is the purpose of the file
/etc/sysconfig/network-scripts/ifcfg-eth0
? - What tool is used to show you a list of current TCP connections?