Ops535 online a1

Due Date - Friday, Feb 26, 2021

Required VMs

The four VMs assigned to you in the OPS535 Virtual Lab. Please ask your professor for information on how to access those VMs. The following are the general description for those four VMs:

• VM1 - has three virtual network interfaces connected to three different virtual networks, they are
  • ens192, with IP address assigned by the lab DHCP server for connecting to the lab's public network and the Internet.
  • ens224, for connecting to the other three VMs in a private network.
  • ens256, do not use for this assignment.
• VM2, VM3, and VM4 - each has two virtual network interfaces connected to two different virtual networks, they are
  • ens192, with IP address assigned by the lab DHCP server for connecting to the lab's public network and the Internet.
  • ens224, connect to the other three VMs.

Hostname and Private IP addresses for the ens224 NIC

• VM1 - 192.168.v.1, router.<yourdomain>.ops
• VM2 - 192.168.v.2, pri-dns.<yourdomain>.ops
• VM3 - 192.168.v.3, co-nfs.<yourdomain>.ops
• VM4 - 192.168.v.4, rns-ldap.<yourdomain>.ops

VM's server role and software requirements

DNS servers

You need three DNS servers for this assignment:

• Primary DNS server: running on VM2, pri-dns.<yourdomain>.ops, which is authoritative for your domain. It will be non-recursive, and must allow anyone to request DNS queries of your domain.
• Caching-only DNS server: running on VM3, co-nfs.<yourdomain>.ops, which allows DNS queries only from

network devices in your private network. It will perform recursive DNS queries to the appropriate DNS servers.

• Root Name server: running on VM4, rns-ldap.<yourdomain>.ops, which is authoritative for the root

zone only. It will answer queries from anyone to request DNS queries for the entire DNS namespace.

NFS Server - on VM co-nfs

• This machine will centrally host all of your network users’ home directories, allowing remote

access through NFS version 4.

• Use the appropriate export option(s) (pay particular attention to root_squash and

no_root_squash) when exporting network users' home directories.

• Superuser on the other VMs should not have root privilege on the exported directory, with the

exception of the machine that is running the LDAP server.

• Machines outside your assignment network must not be able to contact this service. Every

machine in your network (including ones not created yet) must have access to this service.

• Network users should not have read or write access to other network users' home directories.

LDAP Server - on VM rns-ldap

• LDAP Domain Name – <yourdomain>.ops, where <yourdomain> is your assigned

domain.

• This machine will act as an LDAPs server and provide user and group information to your other

VMs.

• Other students VMs in the virtual lab must not be able to contact this service.

Network, firewall, and SELinux

• All your VMs must be accessible to each other using the private network.
• Do not allow DNS queries from any VMs in your network to any DNS servers in the lab

except your caching-only DNS server. • SELinux must be turned on and run in enforcing mode on all of your VMs. You may need to configure the SELinux booleans accordingly. • You VM1 should use iptables.service and VM2 to VM4 must use firewalld.service as their firewall. For firewalld.service, the ens192 interface should be set up in the 'public' zone and the ens224 interface should be set up in the ‘work’ zone. In addition to ssh traffic, your firewalls should only allow the traffic necessary to fulfil the roles described above.

Workflow

• All the configuration must be done by using one of the following automation framework with:
  • customized bash script with ssh, or
  • fabric tasks, or
  • ansible playbook.

Grading

Shortly before the due date I will post a rubric on blackboard. On the due date I will

• provide a script that will gather information from your VMs and create a tar file from them. You will upload that tar file to blackboard.
• run test script from any machines in the virtual lab to scan and test all the required services you should provided.
• disaster recovery test - one of your VMs will be reset to its baseline condition/configuration and you have 30 minutes to apply your automation script(s) to bring back to the assignment 1 requirement.

Questions

If you have any questions about this assignment, please talk to your professor before the due date.