13,420
edits
Changes
no edit summary
[[Category:OPS335]][[Category:OPS335 Labs]]
== OBJECTIVE & PREPARATION==
=== Online Resources===
*Log into both '''vm3''' as the new user. Note how they require different passwords on different machines.
*Log out, and log back in as '''root''' (or use your normal user and '''su''') to continue.
*Install ypbind on your vm3.
* You may wish to follow the logs on vm3. In addition to your normal log in, ssh from the host to vm3 and get a continuous feed from the logs with:
tail -f /var/log/messages
*Edit /etc/yp.conf adding the following line:
domain <learnid>.org server 192.168.x.1
*Start the ypbind server with the command.
systemctl start ypbind.service
*Looking at your logs ensure that ypbind is registered with rpcbind, if it is unable your firewall may need to be adjusted.
*Now when you run the following command:
ypcat passwd
*You should be able to see the users from the server.
*If you added a mismatched user, you must update the map files on the server by running make again.
*Edit the /etc/nsswitch.conf file (on the VM only) and change the following lines so they appear as below:
passwd: nis files
shadow: nis files
group: nis files
*Save and exit the file.
*Ensure ypbind will start at boot and restart the vm.
*Note that a recent bug is making machines with ypbind running take extraodinarily long to shut down.
*Log into vm3 as the new user. You should now be able to use the password stored on '''host'''.
*Back on '''host''' change the password for the new user and rebuild the maps. Try to log into '''vm3''' with the old password; it should now require the changed password.
=== Encrypting Postfix with Transport Layer Security (TLS) =INVESTIGATION 3: ADDING THE OTHER VMS == '''Perform the following steps:''' #Let's start with the "sending" SMTP server we *When you have successfully made this change on VM2. Run the following, replacing <u>andrewsmith.org</u> with '''<u>your</u> domain namevm3''': <source lang="bash">mkdir -p /root/postfix-keys /etc/ssl/{private,certs}cd /root/postfix-keysopenssl genrsa -des3 -out vm2.andrewsmith.org.key 2048chmod 600 vm2.andrewsmith.org.keyopenssl req -new -key vm2.andrewsmith.org.key -out vm2.andrewsmith.org.csropenssl x509 -req -days 365 -in vm2.andrewsmith.org.csr -signkey vm2.andrewsmith.org.key -out vm2.andrewsmith.org.crtopenssl rsa -in vm2.andrewsmith.org.key -out vm2.andrewsmith.org.key.nopassmv vm2.andrewsmith.org.key.nopass vm2.andrewsmith.org.keyopenssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650chmod 600 vm2.andrewsmith.org.key cakey.pemcp vm2.andrewsmith.org.key cakey.pem /etc/ssl/privatecp vm2.andrewsmith.org.crt cacert.pem /etc/ssl/certs</source> ::repeat these steps so that '''NOTE:vm1''' Those commands will create a certificate, a certificate signing request, a certificate authority, and sign your certificate with your certificate authority.<br>This would be the same as in the real world except there you would contact a real CA, here you're making up your own. <ol><li value="2">Now, configure Postfix to use the generated certificate, by adding the following to your '''main.cf''' file:</li></ol> <pre># Settings to enable secure SMTP using my self-signed certificate:smtpd_tls_auth_only = nosmtpd_use_tls = yessmtp_use_tls = yessmtpd_tls_key_file = /etc/ssl/private/vm2.andrewsmith.org.keysmtpd_tls_cert_file = /etc/ssl/certs/vm2.andrewsmith.org.crtsmtpd_tls_CAfile = /etc/ssl/certs/cacert.pemtls_random_source = dev:/dev/urandomsmtpd_tls_loglevel = 1</pre> === Setting Up and Testing Encryption with Thunderbird === '[''Perform the following steps:''' #Currently your Thunderbird is set up to will also use '''vm2.yoursenecaid.org''' NIS for an SMTP server, with <u>no</u> security. Change that to use '''STARTTLS''' instead (you can change it under '''account settings --> Outgoing Server''').# We haven't set up any user authentication, just an encrypted channel;therefore, leave the '''authentication method''' at the value: '''none'''.#When you try to send an email Thunderbird will warn you about the self-signed certificate. You obviously know it's your certificate so you can tell Thunderbird to trust it: [[Image:SMTP-certificate-warning.png]] ::'''NOTE:''' Your message may look slightly different (This author, that created the diagram above, made a little mistake when generating the certificate). <ol><li value="4">After you confirm that security exception, send another email to yourself and make sure you receive it.</li><li> Notice that from the user's point of view nothing is different. But if you were an evildoer trying to steal an identity (the difference is huge). Before it was trivial and now it's computationally prohibitive.</li></ol> === Encryption Dovecot with Secure Socket layer (SSL) === Now we will ensure that our '''Dovecot''' connection is secure, and enforce that policy. With SMTP, you will need to allow plain text connections since that is the only method to pass email identification from server-to-server. With IMAP, there is no server-to-server interaction, but rather only client-to-server interaction. The reason to have an unencrypted IMAP connection would be if your '''IMAP server''' and '''IMAP client''' were the <u>same</u> machine. '''Perform the following steps:''' # Let's start by generating a new certificate for Dovecot files located on your vm3 machine by issuing the following commands:<source lang="bash">mkdir /etc/ssl/{private,certs}openssl genrsa -des3 -out vm3.andrewsmith.org.key 2048chmod 600 vm3.andrewsmith.org.keyopenssl req -new -key vm3.andrewsmith.org.key -out vm3.andrewsmith.org.csropenssl x509 -req -days 365 -in vm3.andrewsmith.org.csr -signkey vm3.andrewsmith.org.key -out vm3.andrewsmith.org.crtopenssl rsa -in vm3.andrewsmith.org.key -out vm3.andrewsmith.org.key.nopassmv vm3.andrewsmith.org.key.nopass vm3.andrewsmith.org.keyopenssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650chmod 600 vm3.andrewsmith.org.key cakey.pemcp vm3.andrewsmith.org.key cakey.pem /etc/ssl/privatecp vm3.andrewsmith.org.crt cacert.pem /etc/ssl/certs</source> ::'''NOTE:host''' This process is identical to what you've done for the vm2 certificate. In fact if your IMAP and SMTP servers are on the same machine you can share the certificate between them. In our case, they are not on the same machine. <ol><li value="2">Next, we need to configure Dovecot to use this for encrypted connections and not allow any kind of plain text connections. Edit the '''10-auth.conf''', <u>and</u> '''10-ssl.conf''' files and change the following settings (note**Warning: these parameters already exist in those files, just find them and set them to the correct value):</li></ol> <source lang="bash">ssl = requiredssl_cert = <path_to_your_crt_filessl_key = <path_to_your_key_filedisable_plaintext_auth = yes</source> <ol><li value="3">Now, we will disable normal imap connections, leaving only imaps (secured imap) allowed. Edit the '''10-master.conf''' file and set the port number in '''inet_listener imap''' to '''0'''.</li><li>Your key/certificate doesn't have a '''.pem''' extension but they are PEM-encoded files. You can confirm that using the '''file''' command. If you're interested, learning more about When configuring Dovecot for SSL, refer to the following documentation: [http://wiki2.dovecot.org/SSL/DovecotConfiguration Dovecot SSL configuration].</li></ol> === Verifying that Mail Messages are Encrypted=== '''Perform the following steps:''' #Use the '''ss''' command to confirm you're only listening on the '''imaps''' port, and not location of the plain imap port.#Next, reconfigure your account settings in Thunderbird to use the '''SSL/TLS''' connection security with your IMAP NIS server, leaving the password as '''Normal Password'''. ::'''NOTE:''' When you send your test email, you will get another warning because you're using a self-signed certificate on '''vm3'''. Make certain to authorize the exception. '''Record steps, commands, and your observations on this investigation in your OPS335 lab log-book''' == INVESTIGATION 2: INSTALL, CONFIGURE & RUN WEBMAIL APPLICATION (Roundcube Mail) =={|cellpadding="15" width="40%" align="right" |- valign="top" |width="10%" | [[Image:Roundcube.png|thumb|right|200px|'''Roundcube''' webmail application Logo<br>GPL,<br> https://commons.wikimedia.org/w/index.php?curid=1772791]] |width="10%" |[[Image:roundcube-pic.png|thumb|right|300px|Screencapture of '''roundcube''' webmail application running in order bind to send and receive mail messages via a web-browser.]] |} In the investigation, we will simply install, configure and run the '''roundcube''' webmail application. '''Perform the following steps on vm1:''' *Perform a search on the roundcube application in order to access the website.*Either Download the "zipped tarball" from their website from a direct link or use the wget command to download directly from a download link (This part may take some effort depending on the Sourceforge website).*Extract the "zipped tarball" and rename the generated directory that contains download source code to: '''webmail'''.::* Use the '''--no-same-owner''' option when extracting the tar achive to ensure that the files do not keep the original owner (who will not exist on your system).*Change the ownership ip address instead of the '''temp''' and '''logs''' directories so they belong to apache.*This service needs to be able to write to several directories ('''temp''' and '''logs''') that SELinux prevents write access tohostname. If you are in a section that has SELinux set to '''enforcing''', run When the following commands to let it know that apache should be allowed to write to files in those directories.<source lang="bash">semanage fcontext -a -t httpd_log_t '/var/www/html/webmail/temp(/.*)?'semanage fcontext -a -t httpd_log_t '/var/www/html/webmail/logs(/.*)?'restorecon -v -R /var/www/html/webmail</source>::*If your machine does not have the semage command, use yum to install the policycoreutils-python package.*In the directory now named "webmail"is booting, there will be a file named '''INSTALL''' which will walk you through the rest of the Roundcube installation.<br /><br />Some installation tips to consider: ::* Be careful about copying & pasting the MySQL setup part: take time and pay attention to detail: do not try to "rush it".::* You will need to install additional Apache modules including: '''php-xml''' and '''php-mbstring'''.::* Don't forget to set the password in the roundcube configuration. *Note have no guarantee that both of your IMAP and SMTP servers are on different machines (i.e. not on vm1). Therefore, you will need to set the following options for Roundcube: ::* '''$config[named'smtp_server']'''::* starts before '''$config[ypbind'default_host']'''::* '''$config['default_port']''' :::'''NOTE:''' The last <u>two</u> entries above refer to your IMAP server *You should be able to test the configuration in your Roundcube installer after completing Step 3.</li><li>Try to test if the roundcube webmail application is working by sending and receiving e-mail messages.*
{{Admon/important |Backup your VMs!|You MUST perform a '''full backup''' of ALL of your VMs whenever you complete your '''OPS335 labs''' or when working on your '''OPS335 assignments'''. You should be using the dump command, and you should use the Bash shell script that you were adviced to create in order to backup all of your VMs.}}
'''Depending on your professor you will either be asked to submit the lab in class, or online. Follow the appropriate set of instructions below.'''
===Online Submission (Peter Callaghan's Classes only)===
Follow the instructions for lab 8 7 on moodle.
===In Class Submission===
::*For '''Peter's classes''', follow his Online Submission instructions in Moodle.
::*For '''Murray's classes''', run command (piping to the '''more''' command) and show output to instructor.
::<span style="color:green;font-size:1.5em;">✓</span>Completed Lab8 Lab7 log-book notes. ==EXPLORATION QUESTIONS==
== EXPLORATION QUESTIONS ==#Briefly define What is the term '''TSL'''.purpose of the rpcinfo command?#Briefly define Explain the term '''SSL'''.#List purpose of the steps to setup Encryption for Postfix with TLS.#List make command in the steps to setup Encryption for Dovecot with SSL.lab - what does it do?#List Explain the steps to setup Encryption for purpose of the Thunderbird application/var/yp/securenets file.#Provide a brief description What is the function of the following terms as they relate to mail servers:#*'''Open Relay'''#*'''SPF'''#*'''DKIM'''# How does a webmail application differ from using another MUA like Thunderbirdportmapper service?# List the additional Apache modules that are required in order What ports did you need to run the Roundcube web applicationopen on your firewall?