Changes

= {{Admon/important|This is NOT Assignment 1 Part 1!|This is the '''ROUGH WORK''' for Murray Saul's section for OPS335 Assignment 1 - Part 1 =. These assignment specifications are NOT complete. <br><br>Once the assignment specifications are ready, then a link will appear in the [https://wiki.cdot.senecacollege.ca/wiki/OPS335 Main OPS335 WIKI] .}}<br><br>

For this portion of assignment 1, you will set up the basic functionality for a virtual machine to act as a '''Due Datecloning-source''': During Week 6 to make it easier for the student to create other servers (VMs) in classlater assignments. Whenever you clone another server (in later assignments), you MUST make certain to configure the cloned server in order to make it function in the network correctly and meet the requirements of future assignments. All of the assignments for this course are '''<u>interdependent</u>''' of each other and belong to the same Virtual Private Network called '''335assign'''.

== Purpose General Requirements ==

=== Set-up a Virtual Network (335assign) ===

* Assign a newly-created virtual network the name: '''asg1net335assign''', and set '''forwarding to any physical device'''<br>(refer to [http://zenit.senecac.on.ca/wiki/index.php/OPS335_Installation_Lab#INVESTIGATION_2:_VIRTUAL_MACHINE_INSTALLATION lab setup]. You can have have 2 different network names: "asg1net335assign" and "ops335" without causing any problems).* Addresses in this network will start with '''10172.161''' followed by the ''30.20'last two digits of your student number''' (just as your main virtual network). The subnet mask must be '''255.255.255.0'''

* All the machines for this assignment will be connected to your newly-created virtual network called: '''asg1net335assign''' === Create a "Cloning-Source" VM (335assign Virtual Network) === Create a virtual machine that you will use as a cloning-source. Details for the cloning-source #The name of this cloning-source VM will be called: '''seedling'''.#You should use the options that you used in your lab1 to setup the static network, plus you should use the DOMAIN parameter to set the '''coniferous.trees.ops''' domain for your cloning-source.#The VM should have a command-line interface only.#Configure it to be a good cloning-source, '''making certain that the cloning-source has all the following elements prior to cloning:'''::*Don't make the virtual drive too big: you will need space for it as well as space for the clones you from your cloning-source<br>('''2GB''' should be enough for any cloning-source and clone VM that you create for this assignment).::*The hostname for this server will be called: '''seedling'''::*Make certain that you can login to your cloning-source.::*Configure your network interface for this cloning-source with a '''static''' configuration and is connected to the '''335assign''' network. Refer to the table below for IP address and hostname.<br> {| class="wikitable" | style="margin-left:50px;"! Hostname !! Address !! Purpose|-| '''spruce.coniferous.trees.ops''' (your existing source) || External Facing Address:''' DHCP assigned'''<br>Internal Virtual Bridge (virbr1):''' 172.30.20.1''' || Your '''host''' machine |-| '''seedling.coniferous.trees.ops''' || '''172.30.20.100''' || '''Cloning-source''' used to create other servers for other assignments.|}

# Don't make the virtual drive too big: you will need space for it as well as space for the clones you from your cloning source<brol><li value="5">(2GB should be enough for any cloning source and clone VM that you create for this assignment).# Make certain that you can login to your cloning -sourcecan connect to the Internet using the newer static configuration. The minimum commands required are: </li><li>Run a '''hostyum update''', '''dig''', '''netstat''for this cloning-source.</li><li>Make certain that SELinux is set to ', '''linksenforcing'''.# Do not install software </li><li>Set up an SSH server on your cloning source: you are expected to install other software on your "cloned" VMs instead. For example, if you are required to install bind in a clone, install it in the clone as opposed to the this "cloning -source".# Configure your network with a static configuration. Refer to the table below for IP address and hostname.# </li><li> Make certain sure that you have '''iptablesPermitRootLogin'''is set to '' services enabled and running instead of 'yes'Firewalld''. The default rules should suffice.# If you have created a regular user when you installed the machine, delete that regular user (you are to use only the root account).# Set up an SSH for this server on this "cloning source". </li><li>Make sure ceratin that only the root account is only permitted to log in login using key authentication. If user other users are required to be created in a laterassignment, they should be permitted to log in with a their username and password.# Generate a new </li><li>Copy the same public key pair on (already generated for your '''Host Machine (don't delete '' for your '''root''' account in lab1) to the existing one), called: '''id_rsa_asg1root'''# Make sure account on your cloning-source.</li><li>Test to make certain that you can log in login from your regular user root on your Host Machine host machine to your root account on the cloning-course ("cloning sourceseedling" virtual ) without being prompted for a pass-phrase.</li><li>If you have created a '''regular user''' when you installed this machine using specifically , '''delete that key.# Do not place that newly-generated private key on regular user''' (make certain to '''remove the "cloning source" VMregular user's home directory!''').</li></ol>

== Clone "ns1" VM from "= Set-up Firewall Rules for your Cloning -Source" &amp; Perform Setup Tasks===

#Create a clone called: '''ns1''' from the "cloning source" Make certain that will act as your you have '''master DNS serveriptables''' on the ''services enabled and running instead of 'asg1net'Firewalld'' network. Refer to the table below for address and hostname.#Make certain that your DNS server must has all Modify the records for iptables to meet the zone calledfollowing conditions:::<ul>:: '''ops335a1<li>All outgoing traffic is allowed.org''' listed in that table, including records for machines that do not exist as of yet. It is important </li>::<li>Responses to understand that DNS records live independently from any traffic the machines that they machine sends out are "pointing" toallowed.</li>#A default setup for a master DNS server should be sufficient, but make certain that ::<li>Traffic on the address of your '''admin contact''' loopback interface isallowed.</li>:: '''yoursenecaid@ops335a1.org''', <li>The host machine (and <b>only</b> the host machine) must be able to ssh to that slave DNS servers will check cloning-source VM.</li>::<li>ICMP traffic is allowed if it originated with the <b>local network only</b>.</li>::<li>As this is acting as the secure basis for updated records from this master every 30 minuteslater machines, no other traffic should be allowed.</li>::</ul>

== Clone "ns2" = Create Full and Incremental Backups of cloning-source VM from "Cloning Source" &amp; Perform Setup Tasks ===

# This task is to be performed in your '''host''' machine.# Issue the command '''su -'''#Create a clone Bash shell script called '''ns2/root/bin/assnBackup.bash''' from to perform a '''full backup''' using the '''gzip''' command to backup the entire file system of your cloning -source VM to save the compressed copy to the directory path: '''/backup/full/'''). # This shell script should store any VM image file in the "/var/lib/libvirt/images" directory that will act has the extension ".qcow2" as a positional parameter to be used with a for loop. # Perform a Net-search to use the '''pv''' (''pipe-viewer'') command to show a text-based indicator of backup for EACH VM image file. You need to add the '''EPEL repository''' to install the pv command.# Set execute permissions for this script, and run this Bash shell script prior to exiting your assignment work session to properly backup your cloning source. You should also make a copy of the backup on an external device (such as a USB key).# Set-up via a crontab entry, an '''incremental backup''' of the '''/etc/''' directory of your cloning-source to be performed every hour to the '''/backup/incremental/cloning-source''' directory.  == Assignment Submission == The student is required to prove to their professor that their set-up works correctly during the regularly-scheduled lab period.  ===Assignment Evaluation Details=== *'''slave DNS serverDemonstrate working assignment to your instructor in class:''' <ol type="a"><li>Students need to demonstrate their assignment functionality to their professor during a lab period (like you would for any lab for "sign-off").</li><li>Students are required to prepare everything ahead of time so that you can quickly demonstrate to your instructor that all required parts of your assignment are working.</li><li>Do do proceed to the next step until you have demonstrated your assignment to your instructor to check for errors that may cause problems when running the checking script.<br><br></li></ol> *Download and run a shell script to check your work (Depending on your OPS335 Instructor):  ::'''Peter Callaghan's Classes (Sections C &amp; D):'''<ul><li>Refer to instruction on Moodle to download and run marking shell script</li></ul>  ::'''Murray Saul's Classes (Sections A &amp; B):'''<ol><li>Login as '''root''' on your '''host''' machine.</li><li>Change to the '''asg1net/root/bin''' directory.</li><li>Make certain that your '''cloning-source VM is running''' network. Refer <li>Issue the following command to install e-mail on your '''host''' machine:<source>yum install mailx </source><li>Issue the table below command to download a checking script for address your assignment to your '''host''' machine: <source>wget http://matrix.senecac.on.ca/~murray.saul/ops335/check-assn1-p1.bash</source></li><li>Set execute permissions and hostnamerun the command: '''/root/bin/check-assn1-p1.bash'''<br>(You shell script contents will be mailed to your Seneca email and to your OPS335 instructor's Seneca email. If you do '''NOT''' receive an e-mail message in your Seneca email account, then there is a problem, and you '''MUST''' rerun or contact your OPS335 instructor immediately.<br><br></li></ol>#The *'''Additional Assignment Information:'''<ol type="a"><li>This assignment is to be completed individually. '''ns2Group submissions are not allowed''' .</li><li>Test your machine to make sure it works. If a machine is not accessible (e.g. will serve the same records as not boot, can not be accessed through ssh from your host, etc.), or is otherwise non-functional, you may be told to '''resubmit'''.</li><li>'''ns1Late submissions are a subject to a penalty of 10% per day'''.</li><ol>

== Reference Materials: List of Machines / DNS Records Evaluation Rubric==

All the machines Here is an evaluation rubric (in the table need DNS records, but only the ones in bold need to form) showing you how you will be existing machines evaluated for this assignment.Part of the rubric is marked from professor observation from student demonstration of assignment in class, and the other part is based on output from the results of an assignment checking script that the student will download and run.

{| class="wikitable"width=50%! Name !! Address !! Purpose|-| colspan=2 style="text-align:center;background-color:#cccccc;" |'''Student Demonstration (in class)'''|-| style="font-weight:bold" | Evaluation Item | width=10% style="text-align:right;font-weight:bold" | Mark|-| Created Virtual Network: '''335assign'''<br>(correct settings) | style="text-align:right" | /1|-| Can '''ping cloning-source from host machine''' with '''correct IPADDR'''| style="text-align:right" | /1|-| root account on host machine can '''connect to cloning-source VM''' via ssh application '''without''' password| style="text-align:right" | /1|-| cloning-source VM can connect to the Internet<br>(i.e. '''ping 8.8.8.8''')| style="text-align:right" | /1|-| cloning-source can SSH to student's '''Matrix''' account| style="text-align:right" | /1|-| colspan=2 style="text-align:center;background-color:#cccccc;" |'''Configuration (Checking Script Output)'''|-| style="font-weight:bold;" | Evaluation Item | width=10% style="text-align:right;font-weight:bold" | Mark|-| Hostname set to: '''seedling''' for cloning source | style="text-align:right" | /1|-| '''yum update performed''' | style="text-align:right" | /1|-| '''No regular users on cloning source''' (just root) | style="text-align:right" | /1|-| SELinux status set to: '''enforcing''' | style="text-align:right" | /1|-| firewalld '''stopped''' and '''inactive'''| style="text-align:right" | /1|-| iptables '''active''' and '''enabled'''| style="text-align:right" | /1|-| iptables - '''All outgoing traffic is allowed'''| style="text-align:right" | /1|-| iptables - The '''host machine''' (and only the host machine) must be '''able to ssh to the cloning-source'''| style="text-align:right" | /1|-| iptables - '''ICMP traffic is allowed''' if it originated with the '''local network only'''| style="text-align:right" | /1|-| cloning-source VM can '''connect to the Internet'''| style="text-align:right" | /1

| '''host.ops335a1.orgcorrect static network configuration for cloning-source VM''' <br>(half mark for each network config item)|style="text-align:right" | 10.161.X.1 || Your host machine/5

| permitRootLogin set to '''ns1.ops335a1.orgyes''' for cloning-source VM|style="text-align:right" | 10.161.X./2 || Master name server

| Backup script '''ns2assnBackup.ops335a1.orgbash''' structure|style="text-align:right" | 10.161.X.3 || Slave name server/2

| file.ops335a1.org Proof that '''VM full backup''' was run|style="text-align:right" | 10.161.X.4 || File server/2

| www.ops335a1.org '''Crontab entries executed properly'''|style="text-align:right" | 10.161.X.5 || Web server/2

| '''Incremental Backup''' of '''/etc/''' directory of cloning-source.ops335a1.orgto '''/backup/incremental/cloning-source' '' directory|style="text-align:right" | 10.161.X.254 /2|-| Disk image to clone from when creating new machines.'''TOTAL''' | style="text-align:right" | '''/30'''