Open main menu

CDOT Wiki β

Changes

OPS235 Lab 7

679 bytes added, 15:03, 22 December 2018
LAB 7 SIGN-OFF (SHOW INSTRUCTOR)
[http://man7.org/linux/man-pages/man8/netstat.8.html netstat]<br>
[http://man7.org/linux/man-pages/man8/ifconfig.8.html ifconfig]<br>
[http://man7.org/linux/man-pages/man8/ip.8.html ip]<br>
[http://man7.org/linux/man-pages/man8/ping.8.html ping]<br>
[http://man7.org/linux/man-pages/man8/arp.8.html arp]<br>
|style="padding-left:20px;"|Additional Utilities<br>
[http://man7.org/linux/man-pages/man7/hostname.7.html hostname]<br>
[http://linux.die.net/man/8/restorecon restorecon]<br><br>Managing Services<br>[http://linuxwww.diedsm.netfordham.edu/cgi-bin/man/8/chkconfig chkconfig-cgi.pl?topic=systemctl systemctl]<br><br>
Configuration Files<br>
[httphttps://linuxwww.aboutfreebsd.comorg/librarycgi/cmd/blcmdl5_ssh_configman.htm cgi?query=ssh_config&sektion=5 ssh_config]<br>[httphttps://linuxwww.aboutfreebsd.com/od/commandsorg/lcgi/blcmdl5_sshdconman.htm cgi?sshd_config(5) sshd_config]<br>
|style="padding-left:20px;"|SSH Reference<br>
[http://support.suso.com/supki/SSH_Tutorial_for_Linux A good ssh tutorial]<br>
# Try SSHing from your c7host VM to your centos1 VM as your regular user accountname. Did it work?
# Create another regular user called: '''other'''
# Set the password for the newly-created called called '''other'''
# Try SSHing from your c7host VM to your centos1 VM for the account called '''other'''. Why didn't it work?
# Edit the file '''/etc/ssh/sshd_config''' to add the account '''other''' for the '''AllowUsers''' option (use a space to separate usernames instead of a comma).
'''Answer INVESTIGATION 1 observations / questions in your lab log book.'''
 
=INVESTIGATION 2: ADDITIONAL METHODS TO SECURE YOUR SSH SERVER =
<li>Make <u>certain</u> that you are in your centos2 VM and that you are logged in as a '''regular user''' (i.e. NOT root!) (you have been warned!)</li>
<li>To generate a keypair (public/private keys), issue the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">ssh-keygen</span></code></b></li>
<livalue="14">After generating the keys it prompts you for the location to save the keys. The default is '''~/.ssh''' Your private key will be saved as <b>id_rsa</b> and your public key will be saved as '''id_rsa.pub'''. Press ENTER to accept the default, .</li><li>You will then enter be prompted for a '''pass-phrase used '''. The pass-phrase must be entered in order to establish use your identityprivate key. Pass-phrases are more secure than passwords and should be lengthy, hard to guess and reeasy to remember. For example one pass-enter phrase that meets this criteria might be ''"seneca students like to dance at 4:00am"''. Avoid famous phrases such as ''"to be or not to be"'' as they are easy to guess. It is possible to leave the pass-phrase blank but this is dangerous. It means that if a hacker were able to get into your account they could then use your private key to verifyaccess other systems you use.<br><br>The output should appear similar as what is shown below:</li></ol>
<pre style="font-family:monospace;background-color:white;border-style:none;padding-left:50px;">
</pre>
<ol><li value="15"> After generating the keys it prompts you for the location to save the keys. The default is '''~/.ssh''' Your private key will be saved as <b>id_rsa</b> and your public key will be saved as '''id_rsa.pub'''</li><li>You will then be prompted for a '''pass-phrase'''. The pass-phrase must be entered in order to use your private key. Pass-phrases are more secure than passwords and should be lengthy, hard to guess and easy to remember. For example one pass-phrase that meets this criteria might be ''"seneca students like to dance at 4:00am"''. Avoid famous phrases such as ''"to be or not to be"'' as they are easy to guess. It is possible to leave the pass-phrase blank but this is dangerous. It means that if a hacker were able to get into your account they could then use your private key to access other systems you use.<br><br></li><li16>Now issue the command <b><code><span style="color:#3366CC;font-size:1.2em;">ssh-copy-id -i ~/.ssh/id_rsa.pub ops235@centos3</span></code></b></li>
<li>When prompted for password, enter OPS235's root password</li>
<li>Try using ssh to now log into your '''centos3''' VM <u>from</u> your '''centos2''' VM. What happens? Were you required to use your pass-phrase?</li>
# Issue the following Linux command: <b><code><span style="pointer-events: none;cursor: default;color:#3366CC;font-size:1.2em;">iptables -P INPUT DROP</span></code></b>
# Issue the '''iptables -L''' command. Can you see the policy to DROP all incoming connections?
# Although you have set a default policy to DROP all incoming connections, there is a problem: now, you cannot browse the Internet. You can confirm that by opening a SEPARATE web-browser and perform a Net-search.<br><br>In order to fix that problem, you can make an exception to allow incoming web-based traffic (via port 80). Those iptables commands to create exceptions are more complex since you need to determine: <ul><li>'''Where each rules appears in the chain'''? (order can be important)</li><li>'''Which protocol(s)''' are affected (eg. tcp, udp, icmp)</li><li>'''What source or destination IP Addresses''' are affected?</li><li>'''What port numbers''' are affected?</li><li>'''What action to take''' if all of the above conditions are met? (eg. ACCEPT, REJECT, DROP, or LOG)</li></ul><br>'''iptables Command Structure (for setting exceptions):<br>(NOTE: If element in column is not specified in the iptables command, then rule relates to ALL elements)'''<table width="100%" cellpadding="10" cellspacing="0" border="1"><tr valign="top><td>Place Rule in Chain</td><td>Chain Name</td><td>Specify Protocol</td><td>Source/Destination IPADDR</td><td>Port Number</td><td>Action<br> -&gt;</td><td>Target</td></tr><tr valign="top"><td>'''-A''' (add / Append to bottom of chain)<br>'''-I''' (insert at top of chain)<br>'''-i I CHAIN-NAME 5''' (insert before line 5) </td><td>'''INPUT'''<br>'''OUTPUT'''<br>'''FORWARD'''<br>'''CHAIN-NAME'''</td><td>'''-p tcp''' (tcp packets)<br>'''-p udp''' (datagram packets)<br>'''-p tcp,udp,icmp''' (combined)<br><br>(refer to '''/etc/protocols''' )</td><td>'''-s IPADDR''' (originating IPADDR)<br>'''-d IPADDR''' (destination IPADDR)</td><td>'''<span style="font-family:courier">--</span>sport 22''' (originating port 22 - SSH)<br>'''<span style="font-family:courier">--</span>sport 80''' (originating port 80 - http)<br><br>(refer to '''/etc/services''')</td><td>'''-j''' </td><td>'''ACCEPT'''<br>'''REJECT'''<br>'''DROP'''<br>'''LOG'''</td></tr></table><br># Issue the following Linux commands to ensure the loopback interface is not affected by these rules. The computer should be able to communicate with itself with any state and protocol:<br><b><code><span style="pointer-events: none;cursor: default;color:#3366CC;font-size:1.2em;">iptables -A INPUT -i lo -p all -j ACCEPT</span></code><br><code><span style="pointer-events: none;cursor: default;color:#3366CC;font-size:1.2em;">iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT</span></code></b>
# Issue the following Linux command to ADD an exception to the INPUT chain to allow web-based incoming traffic (ie. port 80):<br><b><code><span style="pointer-events: none;cursor: default;color:#3366CC;font-size:1.2em;">iptables -A INPUT -p tcp --dport 80 -j ACCEPT</span></code></b>
# Issue an iptables command to confirm that their is an exception rule to handle incoming tcp packets over port 80.
# Provide your external facing address, and provide another lab-mate to ping that external facing address. Were they successful?
# Have your lab-mate determine THEIR external facing address and obtain that IP Address.
# Issue the following iptables command to allow an exception for pings from your lab-mate:<br><b><code><span style="pointer-events: none;cursor: default;color:#3366CC;font-size:1.2em;">iptables -A INPUT -p icmp -s {neighbour's exeternal external facing address} -j ACCEPT</span></code></b>
# Have your neighbour repeat pinging your external facing IP Address. What happened? Why?
# Have your neighbour try to SSH into YOUR c7host. Were they Successful?
# List the iptables rules for the INPUT chain. What happened to your iptables rules for the INPUT chain?
# Proceed to the next part to learn how to learn how to make your iptables rules persistent.
 
=== Part 3: Making iptables Policies Persistent ===
# Flush all of your iptables rules by issuing the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">iptables -F</span></code></b>
# Set the default INPUT policy to ACCEPT by issuing the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">iptables -P INPUT ACCEPT</span></code></b>
# Verify there are no iptables rules by issuing the command: <b><code><span style="color:#3366CC;font-size:1.2em;">iptables -L</span></code></b>
# Make a backup of the file '''/etc/sysconfig/iptables''' by issuing the command:<br><b><code><span style="color:#3366CC;font-size:1.2em;">cp /etc/sysconfig/iptables-save > /etc/sysconfig/iptables.bk</span></code></b>
#To make the iptables rules '''persistent''' (i.e. keeps rules when system restarts), you issue the command: <br><b><code><span style="color:#3366CC;font-size:1.2em;">iptables-save > /etc/sysconfig/iptables</span></code></b>
# Verify that the file '''/etc/sysconfig/iptables''' exists.
# Switch to your '''c7host''' VM and '''su -''' into root.
# Change to the '''/root/bin''' directory.
# Issue the Linux command: <b><code><span style="color:#3366CC;font-size:1.2em;">wget http://matrixcs.senecac.onsenecacollege.ca/~murray.saulops235/ops235lab7/lab7-check.bash</span></code></b>
# Give the '''lab7-check.bash''' file execute permissions (for the file owner).
# Run the shell script and if any warnings, make fixes and re-run shell script until you receive "congratulations" message.
#Arrange proof of the following on the screen:<br><blockquote><span style="color:green;font-size:1.5em;">&#x2713;</span> '''centos2''' VM:<blockquote><ul><li>have logged into centos3 VM using '''public key authentication''' (with a pass-phrase)</li></ul></blockquote><span style="color:green;font-size:1.5em;">&#x2713;</span> '''c7host''' Machine:<blockquote><ul><li>have tunneled Xwindows application from '''centos1''' via ssh</li><li>Run the '''lab7-check.bash''' script in front of your instructor (must have all <b><code><span style="color:#66cc00;border:thin solid black;font-size:1.2em;">&nbsp;OK&nbsp;</span></code></b> messages)</li></ul></blockquote><span style="color:green;font-size:1.5em;">&#x2713;</span> '''Lab7''' log-book filled out.
 
= Practice For Quizzes, Tests, Midterm &amp; Final Exam =