OPS235 Lab 6 - CentOS7 - SSD
Contents
- 1 LAB PREPARATION
- 2 INVESTIGATION 1: CONFIGURING A VIRTUAL PRIVATE NETWORK (VPN)
- 3 INVESTIGATION 2: MANAGING YOUR NEWLY-CREATED NETWORK
- 4 LAB 6 SIGN-OFF (SHOW INSTRUCTOR)
- 5 Practice For Quizzes, Tests, Midterm & Final Exam
LAB PREPARATION
Purpose / Objectives of Lab 6
In this lab, you will learn the basics of networking by using your Virtual Machines and your c7host machine. You will first set up a virtual private network among those machines. In addition, you will learn to set up network names (to associate with server's IP Addresses), associate network services with port numbers for troubleshooting purposes, and setup firewall policies via the iptables command.
Main Objectives
- Configure a private (virtual) network for your VMs and your c7host machine
- Configure network interfaces for your Virtual Machines using both graphical and command-line utilities.
- Use local hostname resolution to resolve simple server names with their corresponding IP Addresses
- Backup more recent files (eg. incremental backup) using the find command and a date/time-stamp file
- Use common networking utilities to associate network services with port numbers for troubleshooting purposes
- Gain initial exposure to the iptables command used to configure and maintain a firewall for protection and troubleshooting
- Configure iptables to allow/disallow/forward different types of network traffic
Minimum Required Materials |
Linux Command Reference | |||
|
Networking Utilities ifconfig |
Additional Utilities |
INVESTIGATION 1: CONFIGURING A VIRTUAL PRIVATE NETWORK (VPN)
For the remainder of this course, we will focus on networking involving our VMs and our c7host machine. This lab will focus on setting up a virtual private network (VPN), connecting our VMs and c7host machine to the VPN, and configuring our VPN to make more convenient to use, troubleshoot and protect. Lab 7 will focus more on configuring SSH and making access to the VPN more secure. Finally, lab 8 will focus on configuring the network for fixed workstations, mobile devices, or both at the same time.
There are several reasons for creating VPNs. The main reason is to safely connect servers together (i.e. to safely limit but allow share information among computer network users). This allows for a secure connection of computers yet controlling access to and monitoring (protecting) access to permitted users (discussed in more depth in lab7).
Part 1: Configuring a Private Network (Via Virtual Machine Manager)
If we are going to setup a private network, we must do 2 major operations: First, define a new private network in the Virtual Manager application; and second, configure each of our VMs to connect to this new private network. In Part 1, we will be perform the first operation. In parts 2, 3, and 4, we will be performing the second operation for all VMS (graphical and command-line).
Perform the following steps:
- Perform this section in your c7host machine.
NOTE: Before configuring our network we want to turn off dynamic network configuration for our Virtual Machines by turning off the "default" virtual network. We will then define our virtual private network. Follow the steps in order to perform these operations. - Make certain that ALL virtual machines are powered off.
- In the Virtual Machine Manager dialog box, Select Edit-> Connection Details.
- In the c7host Connection Details dialog box, select the Virtual Networks tab
- Disable the default configuration from starting at boot by deselecting Autostart (on boot) check-box and click the Apply button.
- Then Stop the default network configuration by clicking on the stop button at the bottom left-side of the dialog box.
- Click the add button (the button resembles a "plus sign") to add a new network configuration.
- Give your new network a name (i.e. network1) then click the Forward button.
- In the next screen, enter in the new network IP address space:
- 192.168.235.0/24
- Disable DHCP4 by deselecting the check box and click the Forward button twice (accepting the defaults).
- Enable Network Forwarding by Selecting Forwarding to physical network, the destination should be Any physical device and the mode should be NAT
- Proceed with changes, and click Finish.
- We will now reconfigure each of our VMs to use our new virtual network network1
- Let's start with our centos1 VM. Double-click on your centos1 VM, but instead of running the VM, click on the view menu, and select: Details
(Note: the Virtual Machine window will appear - do not start virtual machine) - In the left pane of the Virtual Machine window, select NIC: and note that this NIC is on the "default" virtual network
- Change it to Virtual Network network1: NAT (i.e. the VPN that you just created) and click the Apply button.
- Let's start with our centos1 VM. Double-click on your centos1 VM, but instead of running the VM, click on the view menu, and select: Details
- Repeat the same steps for your centos2 and centos3 VMs!
Part 2: Configuring Network For centos1 & centos2 VMs
In this section, we will be using a graphical tool to connect our centos1 and centos2 VMs to our private network.
Perform the following steps:
- On your c7host machine, run ifconfig and make note of the IP address assigned to the virbr1 (i.e. "Virtual Bridge) interface. This will be the default gateway and DNS server for your VMs.
- Start your centos1 VM and login.
- Within your centos1 VM, click Applications menu, then select System Tools, and then Settings.
- In the Settings Dialog Box, click on the Network icon.
- For the Wired connection, click the settings button (The icon appears as a gear located at the bottom right-hand corner of the dialog box).
- Select the IPv4 tab. Change Address from Automatic (DHCP) to Manual.
- Edit the existing wired connection, using the information displayed below:
- In the IPv4 Settings tab change the method from "Automatic (DHCP)" to "Manual".
- In the Addresses section, enter the following information:
- IP Address: 192.168.235.11
- Subnet Mask: 255.255.255.0
- Default Gateway: The IP address of virbr1 on your centos host.
- Click on the DNS' field and add The IP address (virbr1 on your centos host) as the primary DNS server.
- When finished, check your settings, and then click the Apply button.
- Open a terminal and issue the ifconfig command to confirm the IP ADDRESS settings change.
- Verify that centos1VM is now connected to the VPN by issuing the following command from your c7host machine:
ping 192.168.235.11
- Switch to your centos2 VM.
- Run the network configuration tool and enter the following static configuration for your centos2 VM:
- IP Address: 192.168.235.12
- Subnetmask: 255.255.255.0
- Default Gateway: 192.168.235.1
- DNS Server: 192.168.235.1
- Save and exit the network configuration tool.
- You may have to restart the network using the correct command.
- Verify the configuration by pinging the other VMs and c7host using their IP addresses.
Part 3: Configuring VM Network Setup via Command Line (centos3)
Our centos3 VM is a text-based only system, thus we cannot use a graphical tool to configure centos3 to connect to our private network. Therefore we will learn how to perform this task by using command-line tools.
Perform the following steps:
- Leave your centos1 and centos2 VM running, but start your centos3 VM, login, and su to root.
- Use the command ifconfig to list active interfaces, you should see one with a name of eth0 or a similar name.
- To configure your card with a static address use the following command:
ifconfig eth0 192.168.235.13 netmask 255.255.255.0
- To configure a default gateway for that interface enter the command:
-
route add default gw 192.168.235.1
-
- To configure a DNS server for this VM, edit the file /etc/resolv.conf. Change the nameserver line to read:
- nameserver 192.168.235.1
- Save your editing session.
- Confirm your settings work by doing the following (you might need to do the steps 3 and 4 a few times before it works; keep checking with the commands below and wait a bit before each attempt):
-
ifconfig
route -n
-
ping
(your other VM's and c7host) -
ssh
( to your Seneca's Matrix account to test your DNS)
-
- Restart the
centos3
VM, or just wait a few minutes. - Login and test your configuration again. What happened?
- While we can configure network settings from the command line those settings are not persistent. To configure persistent network configurations we need to edit the configuration files.
- Change to the /etc/sysconfig/network-scripts directory
- List the contents of this directory. You should see 2 different types of files, network config scripts and network configuration files.
- Look for the configuration file for your original interface, it should be named ifcfg-eth0
- Edit the new file for you interface and give it the following settings (or create a brand new file, might be easier than editing the old one):
- DEVICE="eth0"
- IPADDR="192.168.235.13"
- NETMASK="255.255.255.0"
- GATEWAY="192.168.235.1"
- HWADDR="52:54:00:3f:5c:fa" <-- DO NOT COPY THIS VALUE! Use MAC address for YOUR interface using:
ifconfig eth0
- DNS1="192.168.235.1"
- BOOTPROTO="static"
- ONBOOT="yes"
- NM_CONTROLLED="yes"
- IPV6INIT="no"
- Save the file and then restart the network connection by issuing the commands:
ifdown eth0
and thenifup eth0
- Verify your configuration as you did before.
- Restart the centos3 VM.
- Login and attempt to ssh to your matrix account to verify the settings.
Answer INVESTIGATION 1 observations / questions in your lab log book.
INVESTIGATION 2: MANAGING YOUR NEWLY-CREATED NETWORK
Connecting a private network is an important task, but a system administrator also needs to manage the network to make it convenient to use, make it safer from unauthorized access, and troubleshoot network connectivity problems.
This investigation will expose you to useful "tweaks" and utilities to help accomplish this task. Lab 7 requires that you understand these concepts and have a good general understanding how to use these troubleshooting utilities (like netstat and iptables).
Part 1: Using /etc/host File for Local Hostname Resolution
After setting up a private network, it can be hard to try to remember IP addresses. In this section, we will setup your network to associate easy-to-remember server names with IP ADDRESSES.
Perform the following steps:
- Complete this investigation on all of your VMs and the c7host machine.
- Use the
hostname
andifconfig
commands on your c7host machine and all of your 3 VM's to gather the information needed to configure the /etc/hosts file on all of your Linux systems. - Edit the /etc/hosts file on each of the virtual machines and host machine. Add the following contents to the bottom of the /etc/hosts file:
- 192.168.235.1 c7host
- 192.168.235.11 centos1
- 192.168.235.12 centos2
- 192.168.235.13 centos3
- Confirm that each host can ping all three of the other hosts by name.
Part 2: Using Arrays to Collect VM Network Information
We finish shell scripting by using arrays by reading and storing networking information for each VM (centos1, centos2, and centos3) to be stored in a report in your c7host machine. We will use the ssh command in order to grab the network information (one VM at a time), and store the network setup into an Associative array in our c7host machine.
If you do not entirely understand the script that you will enter, just realize that we are using these "special storage variables" in order to make this work.
Perform the following steps:
- Perform this section in your c7host machine.
- Open a shell terminal and login as root.
- Change to the /root/bin directory.
- Using a text editor, create a Bash shell script called network-info.bash and enter the following content below:
#!/bin/bash
# Author: *** INSERT YOUR NAME ***
# Date: *** CURRENT DATE ***
#
# Purpose: Creates system info report
#
# USAGE: ./myreport.bash
if [ $USER != "root" ] # only runs if logged in as root
then
echo "You must be logged in as root." >&2
exit 1
fi
- We will now use an Associative Array along with the ssh command in order to get and store networking configuration from the centos1, centos2, and centos3 VMs. Add the following content to your shell script editing session:
set centos1 centos2 centos3
for x
do
read -p "Enter regular username for \"$x\" server: " userName[$x]
ssh ${userName[$x]}@$x "cat /etc/network/interfaces" > /tmp/network-$x.$$
index=0 # load each line into an array for VM
while read line
do<br<
$x[$index]="$line"
index=$(($index+1))
done < /tmp/network-$x.$$
done
- Finally, we will use a loop to printout the results of the data (stored in the Associative Arrays) in a report file called: /root/network-info.txt The command at the end is a trick to remove all temporary files that have the same extension as the current PID number, therefore, it is unique. Add the following content to your shell script editing session:
for x
do
echo "Network Information for: \"$x\":" > /root/network-info.txt
printf '%s\n' "${$x[@]}" | tail -n +2 > /root/network-info.txt
echo > /root/network-info.txt
done
rm /tmp/*.$$
- Give this shell script execute permissions and run this shell script. What do you notice from the report that the shell script generated?
- The the wget command to download, set permissions and run the following script to see the usefulness of arrays: URL
|
Part 3: Network Connectivity & Network Service Troubleshooting Utilities
Troubleshooting network problems is an extremely important and frequent task that a Linux/Unix system administrator performs on a daily basis! Since network services (such as file-server, print-servers, web-servers, and email-servers) depend on network connectivity, as Linux/Unix sysadmin must be able to quickly and effectively pin-point sources of network problems in order to resolve them.
Network service problems may not be entirely related to a "broken" network connection, but a service that is not running or not running correctly. The following table lists the most common listing of utilities to assist with detection of network connectivity or network service problems to help correct the problem.
Perform the following steps:
- Perform this section on your c7host machine.
- x
Using Firewalls in Linux (iptables)
Since Linux servers may be connected to the Internet, it is very important to run a firewall to control what comes into the computer system, what goes out of the computer system, and what may be forwarded to another computer. A utility called iptables can be used to set the firewall rules on a Linux server.
Basically, there is a list (chain) of policy rules that packets must pass-through in order to handle packets. If a packet matches a rule, then an action is taken (some examples include: ACCEPT, DROP, REJECT, or LOG). If the packet passes through the chain of rules without a match, then the packet is directed to the default policy chain (for example: ACCEPT, REJECT, or DROP).
You can create your own customized chains (which you will learn in OPS335 course) but to keep thing simple, we only deal with 3 common predefined chains:
- INPUT: Packets coming into current Linux server
- OUTPUT: Packets leaving current Linux server
- FORWARD: Packets being routed between Linux servers
Perform the following steps:
- Issue the following command to list the existing iptables policy rules:
iptables -L
. - Were there already iptables policy rules that already existed by default?
- Issue the following command to reset the iptables policy rules:
iptables -F
. - Issue a command to list the existing iptables policy rules to verify they have been reset.
Setting Default Policy and Policy Exceptions with iptables
Usually when setting policy rules with iptables, a general "overall" policy is set (default policy chain), and then set policy rules in other chains which act as exceptions to the default policy. Usually, a general policy would apply to ALL types of packets (tcp, udp, icmp) and all communication port numbers (80, 22, etc).
Examples:
iptables -P INPUT DROP iptables -P OUTPUT DROP
After the overall default policy is set, then you can create policy rules that are "exceptions" to the default policy rules.
+++ Show iptables command to create policy exceptions +++
Perform the following steps:
- x
Making iptables Policies Persistent
x
Perform the following steps:
- Make a backup of the file /etc/sysconfig/iptables by issuing the command:
iptables-save > /etc/sysconfig/iptables.bk
- To make the iptables rules persistent (i.e. keeps rules when system restarts), you issue the command:
iptables-save > /etc/sysconfig/iptables
- Verify that the file /etc/sysconfig/iptables exists.
- Restart your iptables service and test your configuration.
Answer INVESTIGATION 2 observations / questions in your lab log book.
LAB 6 SIGN-OFF (SHOW INSTRUCTOR)
Perform the Following Steps:
- Switch to your c7host VM.
- Issue the Linux command:
wget http://matrix.senecac.on.ca/~murray.saul/ops235/lab5-check.bash
- Give the lab6-check.bash file execute permissions (for the file owner).
- Run the shell script and if any warnings, make fixes and re-run shell script until you receive "congratulations" message.
- Arrange proof of the following on the screen:
✓ centos2 VM:
✓ All VMs:- ssh from centos2 to c7host VM.
✓c7host machine- ifconfig information
- Contents of /etc/hosts file
✓ Lab6 log-book filled out.- arp cache information
- A list of your iptables rules
- Output from running the network-info.bash shell script
- Output from running the lab6-check.bash script with all OK messages
Practice For Quizzes, Tests, Midterm & Final Exam
- What is a port?
- What command will set your IP configuration to 192.168.55.22/255.255.255.0 ?
- What file contains the systems
iptables
rules? - What is the difference between UDP and TCP?
- What port number is used for DHCP servers?
- What is the function of the file
/etc/services
? - What is the function of the file
/etc/hosts
? - What is the purpose of the file
/etc/sysconfig/network-scripts/ifcfg-eth0
? - What tool is used to show you a list of current TCP connections?