Difference between revisions of "OPS235 Lab 6 - Fedora17"
(2 intermediate revisions by 2 users not shown) | |||
Line 1: | Line 1: | ||
+ | [[Category:OPS235]] | ||
+ | {{Admon/caution|Draft Lab|This lab has NOT been released for regular distribution. When the lab is ready to be released, this caution banner will disappear.}} | ||
= Configuring a Network Using Virtual Machines = | = Configuring a Network Using Virtual Machines = | ||
− | + | ||
==Overview== | ==Overview== | ||
Line 211: | Line 213: | ||
#* List the contents of the directory and you should see 2 different types of files, network config scripts and network configuration files. | #* List the contents of the directory and you should see 2 different types of files, network config scripts and network configuration files. | ||
#* look for the config file for your original interface, it should be named <code>ifcfg-eth0</code> | #* look for the config file for your original interface, it should be named <code>ifcfg-eth0</code> | ||
− | #* Copy that file to <code>ifcfg-eth<b>N</b></code> where <b>N</b> relates to your current eth interface number. | + | #* Copy that file to <code>ifcfg-eth<b>N</b></code> where <b>N</b> relates to your current eth interface number (we will use <b>eth1</b> as an example). |
#* Edit the new file for you interface and give it the following settings: | #* Edit the new file for you interface and give it the following settings: | ||
− | #**DEVICE=" | + | #**DEVICE="eth1" <-- '''or the interface name YOU have ''' |
#**IPADDR="192.168.235.13" | #**IPADDR="192.168.235.13" | ||
#**NETMASK="255.255.255.0" | #**NETMASK="255.255.255.0" |
Latest revision as of 19:53, 3 January 2014
Contents
- 1 Configuring a Network Using Virtual Machines
- 1.1 Overview
- 1.2 Objectives
- 1.3 Required Materials (Bring to All Labs)
- 1.4 Prerequisites
- 1.5 Linux Command Online Reference
- 1.6 Resources on the web
- 1.7 Current Configuration
- 1.8 Lab Preparation
- 1.9 Configuring a Network Using Virtual Machines
- 1.9.1 Investigation 1: How do you create a new virtual network.
- 1.9.2 Investigation 2: How do you configure a static network using system-config-network.
- 1.9.3 Investigation 3: What files does the system-config-network GUI tool change?.
- 1.9.4 Investigation 4: How do I configure the network without a GUI tool?
- 1.9.5 Investigation 5: How do I setup local hostname resolution?
- 1.10 Obtaining MAC Address / Service Port / Firewall Information
- 1.10.1 Investigation 6: How do I collect the MAC (Hardware) addresses of computers on my network?
- 1.10.2 Investigation 7: How can I see what network services or ports are active on my Fedora system?
- 1.10.3 Investigation 8: How do I view and configure the IPTABLES firewall? -- Basic Function/Configuration
- 1.11 New Configuration
- 1.12 Completing the lab
- 1.13 Preparing for Quizzes
Configuring a Network Using Virtual Machines
Overview
- In this lab, you will learn the basics of networking by using your Virtual Machines and your f17host machine.
- In addition, you will learn to associate network services with port numbers, and learn how to backup files by date/time.
Objectives
- Configure a virtual network for Virtual Machines
- Use the Fedora GUI program to configure network interfaces with static IP configuration and host name resolution
- Use the
find
command to locate the configuration files modified by the GUI network configuration program - To examine some of the Linux's TCP/IP configuration files in the
/etc/
directory - To configure a Fedora host with static network configuration without a GUI tool
- To configure the linux firewall
iptables
to allow/disallow/forward different types of network traffic using simple rules
Required Materials (Bring to All Labs)
- Fedora 17 LIVE CD
- Fedora 17 x86_64 Installation DVD
- SATA Hard Disk (in removable disk tray)
- USB Memory Stick
- Lab Logbook
Prerequisites
- Completion and Instructor "Sign-off" of Lab 5: OPS235 Lab 5
Linux Command Online Reference
Each Link below displays online manpages for each command (via http://linuxmanpages.com):
Networking Utilities: | Additional Utilities: | |
Resources on the web
Additional links to tutorials and HOWTOs:
- Virtual Network - Definition
- Important Linux Networking Commands (Also refer to lab 6 notes)
- Linux Network Configuration
- IPTables Reference
- Lab6 Notes: IPTABLES Firewall
Current Configuration
Currently you should have the following network configuration:
- Fedora host has 1 active network interface (probably
em1
) that receives IP configuration from the School's DHCP server. - Fedora host has 1 active network interface (
virbr0
) that has a static default configuration of 192.168.122.1/255.255.255.0 - Fedora1 VM has 1 active interface (
eth0
) that receives a dynamic configuration from your Fedora Host - Fedora2 VM has 1 active interface (
eth0
) that receives a dynamic configuration from your Fedora Host - Fedora3 VM has 1 active interface (
eth0
) that receives a dynamic configuration from your Fedora Host
Lab Preparation
Configuring a Network Using Virtual Machines
Investigation 1: How do you create a new virtual network.
Before configuring our network we want to turn off dynamic network configuration for our Virtual Machines by turning off the "default" virtual network.
- On your f17host machine start Virtual Machine Manager
- In the Virtual Machine Manager dialog box, Select Edit-> Connection Details.
- In the Hosts Details dialog box, select the Virtual Networks tab
- Disable the default configuration from starting at boot by deselecting "Autostart" (on boot) checkbox.
- Stop the default network configuration by clicking on the stop button at the bottom left-side of the dialog box.
- Click the add button (the button resembles a "plus sign") to add a new network configuration.
- Give your new network a name (i.e. network1)
- Enter in the new network IP address space:
- 192.168.235.0/24
- Disable DHCP by deselecting the check box.
- Enable Network Forwarding by Selecting Forwarding to physical network
- The destination should be Any physical device and the mode should be NAT
- Proceed with changes, and select Finish.
- Before proceeding, check the "default" network connection (in the Virtual Networks section) to verify Autostart is disabled, and that you have created the network1 configuration. You might be required to click Apply when the default Autostart option is deselected. If you have any problems launching your VMs, then it is recommend to reboot your main system.
- Close the Virtual Manager, reboot your f16host, log-back into your f16host computer, and restart the Virtual Machine Manager.
- Now we need to add our new virtual network network1 to the 3 VM's
- Select the fedora1 VM and edit the Virtual Machine Details
(Note: the Virtual Machine window will appear - do not start virtual machine) - Under View select Details
- In the left pane of the Virtual Machine window, select NIC: and note that this NIC is on the "default" virtual network
- Click on the Remove button at the bottom right-side of the dialog box.
- Click on Add Hardware on the bottom left-side of the dialog box and add a new network
- For the host device, locate and select Virtual Network network1 : NAT
- Click finish to exit the Virtual Machine Details dialog box.
- Select the fedora1 VM and edit the Virtual Machine Details
- Repeat steps a - g for fedora2 and fedora3 VM's.
Answer the Investigation 1 observations / questions in your lab log book.
Investigation 2: How do you configure a static network using system-config-network
.
- Start fedora2 VM and login
- On your fedora host run
ifconfig
and make note of the IP address assigned to thevirbr1
interface. This will be your default gateway for your Vm's. - Make certain to return to your fedora2 VM.
- To configure a new interface on fedora2 go to Applications->Other->Network Connections.
- Make certain there are no "Wired" connections (even if you have to click on the connection name and click the Delete button.
- Create a new wired connection, with the "Connection Name" at the top to read eth1
- Click on the Add button, and select the IPv4 Settings tab.
- Change the method from "Automatic (DHCP)" to "Manual".
- In the Addresses section, click "Add".
- Manually set the IP configuration to:
- IP Address 192.168.235.12
- Subnet Mask 255.255.255.0
- Default Gateway 192.168.235.1 (The IP address of
virbr1
on your fedora host.)
- Click on the DNS field and add 192.168.235.1 as the primary DNS server.
- Click Save to Finish, and exit the Network Connections dialog box.
- Your network connection may connect (view the Network Manager applet in the gnome panel at the top of the screen). If there is no connection after a few minutes, you should be able to right-click on the applet and click "eth1" to connect.
- You should be able to use the systemctl command to restart your network.
- Restart your network on fedora2 by issuing the commands:
systemctl stop NetworkManager.service
systemctl start NetworkManager.service
- Verify your new interface by examining the output of
ifconfig
- To verify that fedora2 has the correct default gateway configured, enter the command:
route -n
- Verify the network by using:
ping 192.168.235.1
Answer the Investigation 2 observations / questions in your lab log book.
Investigation 3: What files does the system-config-network
GUI tool change?.
- Start fedora1 VM and login
- Before we configure fedora1 we should create a timestamp file that can be used to see which files have changed as a result of using the GUI tool.
-
date > /tmp/timestamp
-
- Run the network configuration tool and enter the following static configuration in the same way that you configured fedora2.
- IP Address: 192.168.235.11
- Subnetmask: 255.255.255.0
- Default Gateway: 192.168.235.1
- DNS Server: 192.168.235.1
- Save and exit the network configuration tool.
- Restart the NetworkManager service.
- Verify the configuration by pinging fedora host (192.168.235.1) and fedora2 (192.168.235.12)
- To verify that fedora1 has the correct default gateway configured, enter the command
route -n
- Run the following Linux command:
find /etc -newer /tmp/timestamp > /root/netcfg.lst
- View the
/root/netcfg.lst
file. What does it contain? - Create a new directory called:
/tmp/lab6
- Issue the following commands:
mkdir -p /tmp/lab6
find /etc -newer /tmp/timestamp -exec cp {} /tmp/lab6 \;
- View the contents of the
/tmp/lab6
directory. What does it contain?
Answer the Investigation 3 observations / questions in your lab log book.
Investigation 4: How do I configure the network without a GUI tool?
- Start fedora3 VM and login as root
- Use the command
ifconfig
to list active interfaces, you should see one with a name ofeth0
or a similar name. - To configure your card with a static address use the following command:
-
ifconfig eth0 192.168.235.13 netmask 255.255.255.0
-
- To configure a default gateway for that interface enter the command:
-
route add default gw 192.168.235.1
-
- To configure your DNS server edit the file
/etc/resolv.conf
. Change thenameserver
line to be:-
nameserver 192.168.235.1
-
- Confirm your settings work by doing the following:
-
ifconfig
-
route -n
-
ping
your other VM's and fedora host. -
ssh
to your matrix account to test DNS
-
- Restart the
fedora3
VM - Login and test your configuration again. What happened?
- While we can configure network settings from the command line those settings are not persistent. To configure persistent network configurations we need to edit the configuration files:
- Change to the
/etc/sysconfig/network-scripts
directory onfedora3
- List the contents of the directory and you should see 2 different types of files, network config scripts and network configuration files.
- look for the config file for your original interface, it should be named
ifcfg-eth0
- Copy that file to
ifcfg-ethN
where N relates to your current eth interface number (we will use eth1 as an example). - Edit the new file for you interface and give it the following settings:
- DEVICE="eth1" <-- or the interface name YOU have
- IPADDR="192.168.235.13"
- NETMASK="255.255.255.0"
- GATEWAY="192.168.235.1"
- HWADDR="52:54:00:3f:5c:fa" <-- use the HWADDR for YOUR interface
- DNS1="192.168.235.1"
- BOOTPROTO="static"
- ONBOOT="yes"
- NM_CONTROLLED="yes"
- IPV6INIT="no"
- Change to the
- Save the file and then restart the network connection by issuing the commands:
ifdown eth1
and thenifup eth1
NOTE: If there are errors, check that the hardware address in the config file matches the hardware address of the device its configuring - Verify your configuration as you did before.
- Finally the kickstart file used to install this VM did not set the hostname. Edit the file
/etc/sysconfig/network
and set the hostname tofedora3
- Restart the
fedora3
VM. - Login and attempt to
ssh
to your matrix account to verify the settings.
Answer the Investigation 4 observations / questions in your lab log book.
Investigation 5: How do I setup local hostname resolution?
- Use the
hostname
andifconfig
commands on your fedora host and all 3 VM's to gather the information needed to configure the/etc/hosts
file on the fedora host and the 3 VM's. - Edit the
/etc/hosts
file on each of the virtual machines and the fedora host. Refer to the table below for information to enter in the/etc/hosts
file.
Sample /etc/hosts file |
---|
# hostname fedora1 added to /etc/hosts by anaconda 127.0.0.1 localhost.localdomain localhost fedora1 ::1 localhost6.localdomain6 localhost6 fedora1 192.168.235.1 f17host 192.168.235.11 fedora1 192.168.235.12 fedora2 192.168.235.13 fedora3 |
- Confirm that each host can ping all three of the other hosts by name.
Answer the Investigation 5 observations / questions in your lab log book.
Obtaining MAC Address / Service Port / Firewall Information
Investigation 6: How do I collect the MAC (Hardware) addresses of computers on my network?
- On the fedora host
ping
each of your VM's - Examine the contents of the ARP cache by using the command
arp
- Check the contents of the cache again by using the command
arp -n
- What was the difference in output?
Answer the Investigation 6 observations / questions in your lab log book.
Investigation 7: How can I see what network services or ports are active on my Fedora system?
- On your fedora host execute the command:
netstat -at
- This command will list all active TCP ports. Note the state of your ports.
- TCP is a connection oriented protocol that uses a handshaking mechanism to establish a connection. Those ports that show a state of LISTEN are waiting for connection requests to a particular service. For example you should see the
ssh
service in a LISTEN state as it is waiting for connections. - From one of your VM's login to your host using
ssh
- On the fedora host rerun the command and in addition to the LISTEN port it should list a 2nd entry with a state of ESTABLISHED. This shows that there is a current connection to your ssh server.
- Exit your ssh connection from the VM and rerun the command on the fedora host. Instead of ESTABLISHED it should now show a state of CLOSE_WAIT. Indicating that the TCP connection is being closed.
- On your fedora host try the command
netstat -atn
. How is this output different? - Without the
-n
optionnetstat
attempts to resolve IP addresses to host names (using /etc/hosts) and port numbers to service names (using /etc/services) - Examine the
/etc/services
file and find which ports are used for the services:ssh, ftp, http
- Now execute the command
netstat -au
What is the difference between-at
and-au
? - When examining UDP ports why is there no state?
- Using the
netstat
man page and experimentation make sure you understand how the following options work.- -at
- -au
- -atp
- -aup
- -atn
- -aun
- -autnp
Answer the Investigation 7 observations / questions in your lab log book.
Investigation 8: How do I view and configure the IPTABLES firewall? -- Basic Function/Configuration
- As root on the fedora host enter the following commands at the prompt:
-
iptables -F
(This flushes out or clears all of your rules from the chains) -
iptables -L
-
- You should see something similar to this:
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination - Set the default policy for the INPUT chain to DROP:
-
iptables -P INPUT DROP
-
- Now try on your own to change the default policies for the OUPUT and FORWARD chains to DROP
- Write the commands you executed in your lab book.
- Can we mix these policies? Try to set the FORWARD chain policy to ACCEPT. Did it work?
Testing policies
- Execute the command
iptables -L
and check that the policies on your INPUT and OUTPUT chain are set to DROP - Open a browser and attempt to access the Internet. Were you successful?
- Using the commands you have learned so far, change the policies on the INPUT and OUTPUT chains to ACCEPT
- Open your browser and attempt to access the Internet again. Were you successful?
- Change the policies on all of the chains to DROP
- In the OUTPUT chain, add the following rule:
-
iptables -A OUTPUT -j LOG
-
- The above rule tells
iptables
to log packets and relevant information to/var/log/messages
. - This entry in the OUTPUT policy will therefore log all packets being sent out of the machine.
- Try to access the Internet again. Because the policies have been set to DROP, you should be unsuccessful. However, every packet of data that your PC attempted to send out was logged. Let's have a look at the log file and analyze the data.
-
tail /var/log/messages
-
- This command shows us the last 10 lines of the file. While there are many things being logged to this file, the last thing we did was try to access the Internet so we should be able to see the data we need. Look for a line that looks similar to the following:
Mar 3 09:21:03 koala-laptop kernel: [90775.407304] IN= OUT=wlan0 SRC=192.168.1.107 DST=66.249.90.104 LEN=1470 TOS=0x00 PREC=0x00 TTL=64 ID=19752 DF PROTO=TCP SPT=45431 DPT=80 WINDOW=108 RES=0x00 ACK PSH URGP=0
- Your IP, host names and date will be different, but the one thing that should be the same is the DPT=80 value.
- When your computer tried to send OUT a request to connect to the Internet using the WWW, the computer used a destination port of 80. This is the standard port for the WWW. Because we have set the default policy to DROP it drops these packets. The problem is we are dropping all packets. What if we just want to drop the WWW packets?
- Using the commands we already know, change the default policies on all of your chains to ACCEPT.
- Open a browser and confirm that you can access the world wide web.
- Enter the command:
-
iptables -I OUTPUT -p tcp -s0/0 -d 0/0 --dport 80 -j DROP
-
- Try to access the Web. If you have done everything right, you should not have been successful.
- After you have completed the test execute the following command:
-
iptables -F
-
Final Tasks
- Using the information you have learned, try on your own to achieve the same goal as above (block www access to your computer) by using the INPUT chain instead of the OUTPUT chain.
- After you have completed this task, flush the iptables again.
- Make sure that your ssh server is running on the host machine and try to access it from a virtual machine of your choice.
- Once you have confirmed that ssh is running on the host machine, insert an iptables rule on the host machine to prevent access to the ssh server from all VM's on the virtual network.
- Confirm that your rule works by testing from your VM's
- Does iptables close the port? Check using
netstat
- Now insert a rule on the fedora host that would ACCEPT connections from the fedora2 VM only.
- Fully test your configuration.
- Make a backup of the file
/etc/sysconfig/iptables
- Examine the file to see how rules are added.
- Issue the command:
iptables-save > /etc/sysconfig/iptables
to save the rules you added with the iptables command, above. - Verify that the file
/etc/sysconfig/iptables
was updated with your new rules. - Restart your iptables service and test your configuration.
- Write a short bash script to add a rule allowing the fedora1 and fedora3 VM's to connect to
ssh
on the fedora host.
Answer the Investigation 8 observations / questions in your lab log book.
New Configuration
Now you should have the following network configuration:
- Fedora host has 1 active network interface (probably
em1
)that receives IP configuration from the School's DHCP server. - Fedora host has 1 active network interface (
virbr1
) that has a static default configuration of 192.168.235.1/255.255.255.0 - Fedora1 VM has 1 active interface (
eth1
) that has a static configuration of 192.168.235.11/255.255.255.0 - Fedora2 VM has 1 active interface (
eth1
) that has a static configuration of 192.168.235.12/255.255.255.0 - Fedora3 VM has 1 active interface (
eth1
) that has a static configuration of 192.168.235.13/255.255.255.0
Completing the lab
Arrange proof of the following on the screen:
- A list of your
iptables
rules. - The contents of your
arp
cache. -
ssh
from fedora2 to fedora host. -
ifconfig
from all 3 VM's - Contents of
/tmp/lab6
directory. - Fresh backup of the virtual machines.
Preparing for Quizzes
- What is a port?
- What command will set your IP configuration to 192.168.55.22/255.255.255.0 ?
- What file contains the systems
iptables
rules? - What is the difference between UDP and TCP?
- What port number is used for DHCP servers?
- What is the function of the file
/etc/services
? - What is the function of the file
/etc/hosts
? - What is the purpose of the file
/etc/sysconfig/network-scripts/ifcfg-eth0
? - What tool is used to show you a list of current TCP connections?