In OPS235, you learned how to configure a virtual private network via graphical applications for the your '''centos1vm1''' and , '''centos2vm2''' machines. In the previous lab, you have created and cloned VMs that are text-based only ('''like centos3vm3''')virtual machines. You were required to configure a static network connection for your VMs. All In OPS335, you will also be setting up a static network connection for all of the virtual machines your VMs (which all VMs will be text-based (just like centos3 in OPS235) for this course. All of the services that we are configuring in install and configure for this course '''require a working network connection'''; therefore, it is very important that you know how to set configure a network connection for your VMs, whether via command line for trouble-shooting purposes, or to create a persistent (preferable configurepermanent) a network connection that uses static IP address, default gateway, (as well as your DNS server from the command lineopposed to DHCP).

This lab is a <u>review</u> of the material from labs 6 ( [http://zenit.senecac.on.ca/wiki/index.php/OPS235_Lab_6_-_CentOS7#Part_4:_Configuring_VM_Network_Setup_via_Command_Line_.28centos3.29 CLI Network Configuration] ), but will also show other commands in the processadditional topics.

Remember how you set up the network interfaces in your virtual machines in OPS235? You're are expected to know that ''"inside-be familiar with how to configure and test out"'a VM' by nows network connectivity at this point.

In OPS235 , you have used the deprecated '''ifconfig''' and '''route''' commands. In this course we'll use the '''ip''' command instead (, so that you may 'll be familiar with the old both sets of commands but you're expected to know the new ones as well).

<ol><li value="2">Run the '''ifconfig''' and command on your '''ip addresshost''' commands separatelymachine. Check and record the IPADDR for your default (dhcp) network interface card (possibly eno1) and the virtual bridge. Do you notice any differences between their respective outputs?</li><li>Repeat Issue the same steps for the other set of ''older'ip''' command on your '' vs 'host'newer'' commands listed in machine to determine the tableIPADDR and GATEWAY information (refer to above chart).How are the result similar or different than the ifconfig command?</li><li>Which commands do you prefer to useIssue the ifconfig command on your VMs. what happened?</li><li>Use the '''ip''' command for your VMs to list the IPADDR and GATEWAY information.</li><li>Refer to the man pages or refer to following article [http://www.tecmint.com/ip-command-examples/ 10 Useful ip Commands] to see how to issue the above commands to create a <u>temporary</u> connection to your existing network.</ol> 

If In your OPS235 course, you change your used a series of commands (ifconfig, route, and nameserver) to setup a temporary network settings using connection. You can use the commands ip command (a another command) in the previous section, a similar way to create a temporary network connection. The problem with this network connection method is that those changes will be lost if you restart your Linux machine, although you may want to do that to create a temporary network connection for troubleshooting purposes.

For the IP address, subnet mask, default gateway, and DNS server you edit that file is contained in a directory called: '''network-scripts'''.

# From Change to the ''network-scripts'' directory (see your ''OPS335''/''OPS235''/''ULI101'' notes, issue a command to provide the full path-name of the directory: ''network-scripts''. If that command or utility does not exist, simply install it).

Except for your host machine, all the Virtual Machines in this course will have '''static network configuration''' (as opposed to Automatic or DHCP).Sometimes, you will be required to debug networking problems quickly by changing the network configuration of your VMs. 

<li value="7">Edit the '''ifcfg-''interfacename''''' (most likely ifcfg-eth0) file for each of your VMs to use a static IP address (refer to previous OPS235 lab on networking: [ [httphttps://zenitwiki.senecaccdot.onsenecacollege.ca/wiki/index.php/OPS235_Lab_6_-_CentOS7OPS235_Lab_6#Part_4Part_3:_Configuring_VM_Network_Setup_via_Command_Line_.28centos328centos3_and_centos2.29 Network Config - CLI] ].<br> You should be configuring the BOOTPROTO('''static''' instead of dhcp), IPADDR, PREFIX (or NETMASK), GATEWAY, HWADDR, and DNS1 for this file.Note the following information for this setup:<ul></li>Set your IPADDR for each VM with the following rules:<ol type="a"><li> Your vm1 should IPADDR's third octet will use the first available address last 2 digits in your student number.</li><li> Make certain that the 4th octet for your VMs does not start with '''1''' since that is reserved by your host machine.<br>Use the subnetrecommended fourth octets: '''2 for vm1''', '''3 for vm2 the second''', and '''4 for vm3 the third'''.<br/li>You can refer to your previous lab to obtain this information: [ [http:<//zenit.senecac.on.ca/wiki/index.php/OPS335_Installation_Lab#Configuring_a_VM_host Configuring a VM Host] ]ol></li><li>Don't forget to set the default gateway and DNS server for your VMs. You can use your host's IP address as a gateway and DNS server <br>(''libvirt'' will proxy the requests to the real DNS server).</li><li> You can refer to your previous lab to obtain information for setup of these options: [ [https://wiki.cdot.senecacollege.ca/wiki/OPS335_Installation_Lab#Configuring_a_VM_host Configuring a VM Host] ]<br><br></li></ul><li>Make note of the files used and entries required and note them in your lab log-book.</li><li>Save your editing session, and then restart each VM and run the following command to ensure they still have the network configuration you set:</liul></olli> ::'''ping''' (what is the purpose of this command?). Try to ping matrix and google from your host machine. <br>Try to ping matrix and google from each of your VM's to ensure you can reach the outside world.::</li><li>'''ssh''' (into another server, like Matrix) </li></ul></li><li>After setting the network configuration for EACH VM, then either the the ifdown and ifup commands or reboot each VM, to verify that you can connect to the Internet with the new static IP network configuration. If you cannot connect to the Internet, then check the network configuration file and make corrections until you have a workable network connection for each VM from boot-up.</ol>

# '''Is network on IS THE NETWORK ON VM plugged inPLUGGED IN?''' On a physical network you would check whether the cable is plugged in and the link light is on on your network card. In a virtual network environment, you don't have a physical network adapter. Instead, you will need to check the NIC settings in the <u>'''virtual'''</u> machine details to view and confirm the appropriate network connection.# '''Is the network enabledIS THE NETWORK ENABLED?''' This is a problem more common with virtual networks than physical networks. Check in your :<br> '''VirtManager'''->'''ConnectionDetails'''->'''VirtualNetworks''' that your network is active.# '''Do you have an DO YOU HAVE AN IP addressADDRESS?''' Run '''ip address''' to check.# '''Can you ping the host by CAN YOU PING THE HOST BY IP?''' (by its internal IP address). If not - check all of the above, check if you have an IP address conflict, and check that your subnet mask is correct.# '''Can you ping CAN YOU PING 8.8.8.8?''' If all of the above work - check that your default gateway is set correctly with '''ip route''' and that you can ping the default gateway.# '''Can you resolve CAN YOU RESOLVE google.ca?''' Run '''host google.ca'''. If the output doesn't provide an IP address, check that your DNS server is configured correctly and that you can ping that address.

==== Run Script to Break my network script Network Connection for Troubleshooting ==== You will now download, set execute permissions and run a Bash shell script to try to "break" the network connection for your vm1. This will provide troubleshooting practice to check your network configuration file, look and correct errors and restart your network interface connection. 

Perform the Following Steps: #Move to your '''vm1''' machine and make certain that you are logged in order as '''root'''.#Make certain that the '''wget''' command is available on your VM. If not, install the wget application. Make certain to perform the following trouble-shooting task:<ol type="a"><li>do for ALL of your VMs.#Use the '''wget''' command (with option "--no-check-certificate" ) to download and run the following shell script:<br>http://scs.senecacollege.ca/~murray.saul/ops335/break-network.bash<br><br>'''NOTE: If the wget command is not available with your minimum install vms, then install that command.'''<br><br></li><li>after #When you have run that shell script, it should automatically restart your vm1 machine.</li><li>#Login to your vm1.#Use the commands taught in this lab to confirm if your network connection is broken.</li><li>#Carefully check your configuration to see if there is a change to your settings</li><li>#Try to temporarily connect to the Internet</li><li>#Edit your network settings file to make the changes permanent</li><li>#Test your connectivity (including after a reboot of your vm1.<br><br></li></ol>) '''Note:''' You should be able to go through that troubleshooting process pretty quickly. Setting up the network in this course is never a primary task, but it's almost always a prerequisite for anything else we're going to do. You can't have a working web server (or any other kind of server) if you don't have a working network connection.

== INVESTIGATION 2: Configuring SSH ==

The default (and often the only way) to administer a Linux server is via SSH. Even if you work in a graphical Linux environment, it is very useful to open a terminal and use SSH to monitor and manage your VMs (you can resize the terminal window). Using SSH to connect to remote servers on a network helps to protect your Linux machine from being penetrated. You can also generate a private and public encryption key for the root user, and copy that public key from your host to your VMs in order to allow certain backup programs to run via a scheduling daemon (called cron) without having to be required to enter the password for the remote machine. You will be doing those operations later in this lab.

The SSH server should already be installed and running in your VMs. If it's not installed - , you can install '''openssh-server''' using yum.

<ol><li value="2">Launch your '''vm2''' machine, login to the machine, and open a shell terminal.</li><li>Use one of the commands above to check the status of your SSH server(i.e. service: ''sshd'').</li><li>Issue one of the above commands to stop of the ssh server and run a command to verify that the ssh server is no longer running.</li><li>Issue another one of the above commands to start the SSH server and to verify that it is running.</li><li>Issue a command (not listed above) to confirm that the ssh service will run upon when the next vm2 startupserver restarts (i.e. "enabled").</li></ol>

===Configuring a the SSH Service===*A common, if somewhat blatant, way to try to hack into a machine is to try to ssh as root and brute-force the password.**The root user always exists, meaning the attacker doesn't need to try guessing what user names are on your system.**And if they can get access to root, they can do anything.*To prevent this, we'll edit the configuration file for the ssh service to prevent root from ssh'ing into your host machine.*Use cat to display /etc/ssh/sshd_config on your host.*This file contains the configuration parameters for the ssh service.*Lines that begin with # are comments. Either simple explanations of parameters, or parameters that have not been set.*Open the man page for sshd_config**This lists all the possible parameters in alphabetical order along with a brief explanation of what each one does.**The parameter we are looking for is PermitRootLogin, read its description.*Use an editor (e.g. vi) to open /etc/ssh/sshd_config, and find the line that has PermitRootLogin.**By default it is set to yes, allowing the root user to ssh in to the machine.**Uncomment it, and change it to no.*Now try to use ssh from one of your VMs to log into your host as root.**You'll still be able to. This is because (for most services) the changes you make to the configuration file do not take effect until the service restarts.**Restart the sshd service on your host and try to ssh in again. Now it should prevent you.*The configuration files for most services follow a very similar format. Some use an = between the parameter and its value, some require you to group certain parameters together, and most use # to be a comment. You will get lots of experience working with the configuration files for services in this course.

A common (if somewhat blatant) way to try to hack into a machine is to try to ssh as '''root''' and brute-force root's password. The root user always exists, meaning the attacker doesn't need to try guessing what user names are on your system. If they can get access to root, they can do anything. To prevent this, we will edit the configuration file for the ssh service to prevent root from ssh'ing into your host machine.  '''Perform the following steps:''' #Login to your Centos '''host''' machine for the following steps.#Use the more command to display '''/etc/ssh/sshd_config''' on your host. This file contains the configuration parameters for the ssh service.#Take a few moments to view this file. Lines that begin with # are comments. Either simple explanations of parameters, or parameters that have not been set.#Open the man page for '''sshd_config'''. This lists all the possible parameters in alphabetical order along with a brief explanation of what each one does. The parameter we are looking for is '''PermitRootLogin''', read its description.#Use a text editor to edit the file '''/etc/ssh/sshd_config''', and find the line that has '''PermitRootLogin'''. By default it is set to yes, allowing the root user to ssh in to the machine.# Uncomment '''PermitRootLogin''', and change the value to '''no'''.#Try to use ssh from one of your VMs to log into your host as root. What happened?#This is because (for most services) the '''changes you make to the configuration file will not take effect until the service restarts'''.#Restart the sshd service on your host and try to ssh in again. Now it should prevent you.#The option '''PermitRootLogin''' for '''all of your VMs''' for both labs and assignments MUST be set to '''yes'''. The reason for this is that you have created a virtual network, so you have protected the host from root login, so you don't have to do the same for your VMs. Also, by allowing root login for your VM's will allow you to automatically backup your VMs to your host machine (via a crontab entry) without being prompted for a root password for each VM. '''Note:''' Configuration files for most services follow a very similar format. Some use an = between the parameter and its value, some require you to group certain parameters together, and most use # to be a comment. You will get lots of experience working with the configuration files for services in this course. === SSH KeysKey Concepts===

This needs to be generated on and used on your '''client''' machine (i.e. the user/machine you're connecting '''from''').The private key is the equivalent of === Generating a <u>''password''</u> (that it why it is considered to be <u>''private''</u> - only to be used by ''<u>one<Public/u>'' owner).That is why the private key is stored in Private Key Pair &amp; Sharing the owner's '''~/.ssh/''' directory.Public Key ===

You generate The public/private key pair needs to be generated on and used on your '''host''' machine (i.e. the user/machine you're connecting '''from'''). The private key is the equivalent of a new keypair with this command <u>''password''</u> (press enter for all that is why it is considered to be <u>''private''</u> - only to be used by ''<u>one</u>'' owner). That is why the questions):private key is stored in the owner's '''~/.ssh/''' directory.

When issuing this command, you will end up with the files: '''~/.ssh/id_rsa''' and '''~/.ss/id_rsa.pubPerform the following Steps:''' (private and public keys)

=== Sharing your Public Key on '''NOTE:''' When issuing this command, you will end up with the files: '''~/.ssh/id_rsa''' and '''~/.ssh/id_rsa.pub''' (private and public keys). So far, this topic is generally a Remote server ===repeat of OPS235 lab7. What you may '''<u>not</u>''' know is that by using a '''"trick"''' (the ''magic'' of public key cryptography), you can SSH to a Linux machine without using a password! Learning to perform this trick is <u>'''essential'''</u> in this course and in the industry in general. SSH keys are used everywhere that Linux servers are used.

So farIf you have the private key, this topic you can prove to someone who has your public key that you are indeed the '''actual owner of that public key'''. That is generally how ssh key authentication works. You are then only required to transfer your public key to a repeat of OPS235 lab7remote server.

{{Admon/important|Errors in Copying Public Key from Host to VM|If you have experience an error when copying the private public key, you can prove from your hostmachine to someone who has your public key VM, it is most likely caused from not permitting root login that you are indeed performed in the '''actual owner of that public key'''.That is how ssh key authentication worksprevious section. You are then only required Set to transfer allow login from root for each vm, restart your public key to a remote serversshd service and then re-run the above command.}}

You can transfer the public key to a remote server using After you perform either of the following methods:<ul><li>You are going to share the public key from the root user in your hostname with the root user of your vm1.</li><li>Make certain those operations, you are logged on as '''root'''.</li><li>Copy contents of your '''~/.can then ssh/id_rsa.pub''' from your host machine, and append the contents to '''~/.ssh/authorized_keys''' on each of your Virtual Machine servers</li><li>Simply issue the Linux command '''ssh-copy-id -i ~/.ssh/id_rsa.pub username@server'''<br><br>In your case: ssh-copy-id -i ~/.ssh/id_rsainto a remote vm without a password.pub root@IPADDR_for_vm1</li></ul>

After When performing labs or assignments in this class, if you perform either fail to make backups and something bad occurs and there is loss of those operationsdata, it only affects you can then ssh into . On the other hand, if you are supporting a remote vm without client, or working for a passwordcompany and fail to adequately perform backups and there is loss of data, then other users are affected by failure to backup essential data.

'''NOTE:''' Always remember that these keys are '''per-userA full backup represents backing up of all of the files of a computer machine (in our case, <u>not</u> per machine'''a VM). This means that sharing a user's public key will only work for that specific userA full backup should be performed at the end of each lab or assignment working session.

# Refer to the above notes to allow an ssh connection from Make certain that your virtual machines are NOT running.#Make certain that you are logged in as '''root''' user on your host machine .#Refer to any of OPS235 lab2 on backing up your Virtual Machines (VMs using the '''gzip''' command [https://wiki.cdot.senecacollege.ca/wiki/OPS235_Lab_2_-_CentOS7_-_HD2#Part_1:_Backing_Up_Virtual_Machines OPS235 Lab2 - Backing up VMs]#Make certain that you have performed a full backup for '''vm1''', '''vm2''', and '''vm3'') without requiring a password.# Test each ssh connection between host and each virtual machine to ensure that this works'.

In OPS235, you learned to use <ol><li value="5">Create the sub-directory '''gzip/root/bin/''', </li><li>You should know how to create full backups of your VMs in your OPS235 course. Create a Bash shell script called:<br>'''gunzip/root/bin/fullbackup.bash'''that will backup all of your other vms (i.e. vm1, vm2, and vm3) one at a time using the '''virsh dumpxmlgzip''' / command to your host machine into the directory path-name: '''virsh define/backup/full/''' commands </li><li>Set execute permissions, and run the shell script to verify that you shell script works.</li><li>It is also recommended to backup to your virtual machines USB key as well (qcow2 images and the '''tar''' command as an archiving toolxml config files).</li></ol>

In this labIt will be your responsibility as an administrator of your own Linux system, we will focus on a method to provide automatic backups backup all of your VMs for labs and assignments at the end of your lab session. Learning to create shell scripts to automate routine tasks (such as backups) will be EXTREMELY useful for your host machine as opposed to performing full and NDD430 course. === Performing Incremental Backups === An incremental backups (although it backup is recommended to study these techniques a backup of only files that have changed since they the last backup. In your case, it may be useful at some point in a later lab, and will be useful in later courses)good idea to perform incremental backups of your '''/etc/''' directory for your VMs upon startup. We will now focus on be using the '''rsync ''' command to perform incremental backups for backing up our all of your VMs.

<source lang=bash>mkdir -p /backup/incremental/vm1rsync -avz 192.168.x.x:/etc /backup/incremental/vm1/ # where 192.168.x.x is the IPADDR of your vm1</source> '''NOTE:''' This command will '''NOT''' work if '''permit root access is denied for your VMs''' for your sshd service configuration, so keep it off for now... <ol><li value="4">If rsync prompts for a password, make certain that you completed the '''SSH key''' section above, and that you assigned the keys for the <u>appropriate user</u><br>(in this case, for the '''root user for both the hostname and vm1'''!)</li><li>When the rsync command runs correctly, you should see all the files from vm1 being copied over to your host machine.</li><li>Run the rsync command again. Notice that the second time nothing is copied over to your host machine since none of the files have changed on your vm1 machine.</li><li>Create a new file in vm1's '''/etc/''' directory, and rerun '''rsync'''. Confirm on your '''host machine''' that only that file that was created on your vm1 machine actually got backed up to your host machine.</li><li>Repeat the above steps to create backups for your '''vm2''' and '''vm3''' machines on your host machine as well (for the respective directories: '''/backup/incremental/vm2''' and '''/backup/incremental/vm3''').</li></ol>

<ol><li value="4">If rsync prompts for a password, make certain that you completed the '''SSH key''' section above, and that you assigned the keys for the <u>appropriate user</u><br>== Automating Backups (in this case, for the '''root user for both the hostname and vm1'''!cron)</li><li>When the rsync command runs correctly, you should see all the files from vm1 being copied over to your host machine.</li><li>Run the rsync command again. Notice that the second time nothing is copied over to your host machine since none of the files have changed on your vm1 machine.</li><li>Create a new file in vm1's '''/etc/''' directory, and rerun '''rsync'''. Confirm on your '''host machine''' that only that file that was created on your vm1 machine actually got backed up to your host machine.</li><li>Repeat the above steps to create backups for your '''vm2''' and '''vm3''' machines on your host machine as well (for the respective directories: '''/backup/vm2''' and '''/backup/vm3''').</li></ol>===

=== Scheduling Tasks with '''Cron ''' is a ''daemon'' (Automatic Backupsi.e. a program that runs in the background) ===. The term ''"Cron"'' is short for '''Chronograph''' which was an old fashioned term for a '''stop watch''' or '''timer'''. The role of '''Cron''' is to run tasks periodically. It can run tasks for the system (as root) or for a user (including regular users). Every user has a crontab (Cron Table) which is a list of tasks they want to run periodically. You do not edit this file manually: instead, you edit this table using the command '''crontab -e'''. Once you run the command, you will get an empty file where you have to insert a line like this:

'''Cron''' is a ''daemon'' (i.e. a program that runs in Perform the background). The term 'following steps:'"Cron"'' is short for '''Chronograph''' which was an old fashioned term for a '''stop watch''' or '''timer'''. The role of '''Cron''' is to run tasks periodically. It can run tasks for the system (as root) or for a user (including regular users).

# Refer to the following WIKI to learn how to use cron: [[crontab tutorial]]# In your host machine as root, modify the setting so it will run that echo command every minute by creating a crontab (via '''crontab -e''') entry with the following line:<br><source>* * * * * echo "Cron ran this job at: "`date` >> /tmp/cron.log</source># Save and exit your crontab edit session.# Wait for one minute to pass, and check the '''/tmp/cron.log''' file to see if it was created with the expected contents.<br>(You will get can also check '''/var/log/cron''' file to see what jobs were run).# Perform a Net-search to see how to configure that crontab entry to run every two minutes instead of every minute.# Edit your crontab entry to run same command every two minutes, save and exit, and then confirm by viewing '''/tmp/cron.log''' and '''/var/log/cron ''' files.# Perform a Net-search to see how to run some backup scripts a cron for vms a command for this courseevery hour.# Edit your crontab to '''make automatic backups using the rsync command''' of the '''/etc''' directory from '''vm1''', '''vm2''', and '''vm3''' into '''/backup/incremental/vm1''', but first'''/backup/incremental/vm2''', letand '''s see how Cron works/backup/incremental/vm3''' every hour and overwrite the previous backup.

<pre>10 * * * * echo "Cron ran this job at: "`date` >> {{Admon/tmp/cronimportant |Backup your VMs!|You MUST perform a '''full backup''' of ALL of your VMs whenever you complete your '''OPS335 labs''' or when working on your '''OPS335 assignments'''. You should be using the gzip command, and you should use the Bash shell script that you were adviced to create in order to backup all of your VMs.log</pre>}}

'''Perform == COMPLETING THE LAB == ===Online Submission=== Follow the following steps:'''instructions for lab 1 on blackboard.

# In your host machine as root, edit your crontab and enter the line above. Modify the setting so it will run that echo command every 2 minutes.# Wait for two minutes to pass, and check the '''/tmp/cron.log''' file to see if it was created with the expected contents.<br>(You can also check '''/var/log/cron''' file to see what jobs were run).!--# Edit your crontab to '''make automatic backups''' of the '''/etc''' directory from '''vm1''', '''vm2''', and '''vm3''' into '''/backup/vm1''', '''/backup/vm2''', and '''/backup/vm3''===Andrew' every hour and overwrite the previous backup. s sections===

You'''Record steps, commands, and your observations in INVESTIGATION 2 in ll get the same grade regardless of how you choose to submit your OPS335 lab log-book'''work.

== COMPLETING THE LAB ==[[Image:lab1_signoff.png|thumb|right|300px|Students should be prepared with '''all required commands (system information) displayed in a terminal (or multiple terminals) prior to calling the instructor for signoff'''.]]'''Arrange evidence (command output) for each Expected results of these items on your screen, then ask your instructor to review them and sign off on the this lab's completionare:'''

::<span style="color:green;font-size:1.5em;">&#x2713;</span> Backups Display contents of the three VMsbackup script called: ''' /etcroot/bin/fullbackup.bash'''::<span style="color:green;font-size:1.5em;">&#x2713;</ directories are made automatically in the hostspan> Full and incremental backups of your 3 VMs.::<span style="color:green;font-size:1.5em;">&#x2713;</span> You have notes in your labbook lab-book about what you've learned in this lab.::<span style="color:green;font-size:1.5em;">&#x2713;</span> Run a shell script to submit your lab:<br>:::'''Steps:''' :::*Issue the following command to download the bash shell script:<br>'''wget http://scsmatrix.senecac.senecacollegeon.ca/~andrewmurray.smithsaul/ops335/labcheck_network_backup.sh''':::*Assign execute permissions, and run the script to check your work:<br--> '''labcheck_network_backup.sh''':::*'''NOTE:''' When prompted for the network interface, use the '''virtual interface'''.