Changes

==SAMBA SERVER RESOURCESOBJECTIVE & PREPARATION==[[Image:lamp.png|thumb|right|300px|To provide additional help make your web resource more dynamic (for web apps such as webmail) several services are also required. A popular acronym to represent these foundations and servers is referred to as '''LAMP'''. It stands for '''Linux''', '''Apache''', '''MySQL''', and '''PHP''' (or ''Python'').<br><br>Image by Shmuel Csaba Otto Traian,<br>https://commons.wikimedia.org/w/index.php?curid=28224098)<br>(via: [http://creativecommons.org/licenses/by-sa/3.0 Commons Attribution-Share Alike 3.0]) ]]In this lab, we will look at several separate technologies that are used with the Apache web server to install, configure and run web applications.

* If we want to add more features for our web-page (Course Notes on Samba Servereg. dynamic functionality, security, e-commerce, etc)*[http://www, your webserver would need additional help.tomsitpro.com/articles/linuxTo provide additional help requires several resources -more than just the web server-configuration-guide-book-excerptitself. A popular acronym to represent these foundations and servers is referred to as '''LAMP'''. It stands for '''Linux''', '''Apache''', '''MySQL''',2-777-2and '''PHP''' (or ''Python'').html Samba Server Setup] (Simple setup guide for samba server]

''"Samba is the standard Windows interoperability suite of programs for Linux and Unix* [http://www. Samba is Free Software licensed under the GNU General Public License, the Samba project is a member of the Software Freedom Conservancyliquidweb."''com/kb/how-to-install-apache-on-centos-7/ Installing Apache Webserver on Centos7]* [http://www.w3schools.com/php/default.asp PHP Tutorial] (w3schools.com)* [http://www.w3schools.com/sql/ MySQL / SQL Language Resources] (w3schools.com)

This lab will first install=== Install, setup, and enable a Samba server. Then another virtual machine will be created for Configure & Run a Windows operating system. Finally, within the Windows virtual machine, users will access files from the Linux Samba server Webserver (both graphically and command lineApache).===

'''Perform the following steps:''' #Make certain you are in your '''VM1''' machine.#Install the Apache package (the name of the package is '''httpd''').#Start the httpd service, and enable this service to start automatically upon system startup.#Using a text browser such as '''lynx''' on vm1 go to http://localhost. You should get the Apache Test Page which indicates your web server is running on the local virtual machine.#Make certain to configure your firewall to allow access to the httpd service (i.e. the Apache serves HTTP traffic which goes over TCP port '''80''') and keep the changes past rebooting.#Open a web-browser in your '''host''' machine and enter the following URL: '''vm1.youruserid.ops'''.<br />If you setup your Apache webserver correctly, you should be able to view the Apache Test page.#Although we will not be exploring webservers in depth, we will have you create a simple webpage for testing purposes, then later setup a web resource for webmail.#The term '''DocumentRoot''' specifies where the Apache webserver will search for documents to serve. Create the file '''index.html''' in your '''DocumentRoot''' directory with the following contents (replace the date with the current one):<br><source>Hello, this is a web page on vm1.youruserid.ops and the current time is Mar 28 22:16:27 EDT 2016!</source><ol><li value="9">If you refresh your web-browser page in your browser, you should see the contents of your ''index.html'' document. If you wish, you can specify the filename index.html in the address, but it is not necessary, since the file index.html is automatically loaded by default when the URL refers to that directory containing that file.</li></ol>  {{Admon/tip |Using the '''index.html''' file|It is considered to be a "best practice" to create '''index.html''' files for newly-created subdirectories within the '''DocumentRoot''' (or users' '''public_html''' directories) to force a display of a web-page, instead of viewing the directories "index" listing of files (from "curious eyes"): that is why the name of the file is called ''"index.html"''.}}  <ol><li value=INVESTIGATION 1"10">Refresh your web-page by issuing the keycombination: INSTALLING &amp; CONFIGURING A SAMBA SERVER=='''ctrl-r'''. Notice that the time doesn't change as you refresh the page. This indicates that the page is static (not dynamic) indicating that the page does not change (i.e. boring!).</li></ol>

In this investigation, we will set up === Creating a '''Samba server''' on our '''VM2''' machine. We will first install, configure and enable the samba server on our virtual machine, and then we will quickly test to see if the Samba server works.PHP Script ===

{{Admon/importanttip |PrerequistitesPHP Scripting Language|Due PHP code is considered to be a language that runs on the changes made web-server (i.e. "server-side programming"). PHP code can be embedded in lab3an HTML document (HTML code), '''you will now need your vm1 running (as and use the resources on the DNS "server-side" to make the web document or resource more dynamic (eg. database access, etc)''' in order for any . Although it is not the purpose of your virtual machines this course to be able to use the internetlearn about and create PHP documents, here is a quick resource on PHP: [http://www.w3schools.com/php/default.asp PHP Tutorial]}}

#Make certain that both your '''VM1''' and '''VM2''' machines are running.#Switch to your ''Copy'VM2''' machine as the '''root''' userindex.#Issue the following Linux command to install Samba server utlity:<br>html'''yum install samba samba-client'''<br>#Copy the file as '''/etc/samba/smbindex.confphp''' and modify it to another filename by issuing the following commandcontain:<br>'''cp /etc/samba/smb.conf /etc/samba/smb.conf.original'''#Clear the contents of the configuration file by running '''cat /dev/null <source> /etc/samba/smbHello, this is a web page on vm1.conf'''#Edit '''/etc/samba/smbyouruserid.conf''' so that ops and the file that contains the following lines: [global] workgroup = WORKGROUP server string = current time is <?php system("put your real name here without the quotesdate" encrypt passwords = yes smb passwd file = ); ?>!</etc/samba/smbpasswd [home] comment = "put your real name here without the quotes" path = /home/<yourSenecaIDsource> public = yes writable = yes printable = no create mask = 0765<ol><li value="32">Append (On your host machine, in the web-browser manually add) the following parameter to the bottom of the '''[global] section/index.php''' . Notice that will limit access to in a web browser the share so that only machines in your virtual network ''index.php'' file isn't treated as a default page and those the contents don't contain the date, but instead are displaying the text in the lab room will be able php code you entered into the index.php file (refer to access it:above code).</li></olli> hosts allow = 192.168The reason this occurs is that the PHP interpreter hasn't been installed on your vm by default.x. 127.0.0.1<ol/li><li value="4">Append (add) the following parameter to Install the '''[home] sectionphp''' so that only package on your vm1 machine, and restart your user account can access that sharewebserver. NOTE:The php package comes with a working default Apache configuration so you don't need to enable it manually.</li></ol> valid users = <yourSenecaID><ol><li value="5">Create a Samba account and password for yourSenecaID by issuing Refresh the webpage in your web-browser on your host machine. You should now notice that you see the date instead of the call to the following date command:<br>'''smbpasswd -. Refresh your webpage several times to see how the time changes. This is simply a "trivial example" of dynamic web content does it does provide a <yourSenecaID>'''simple demonstration of how scripting languages can be used to create more dynamic webpages.</li></ol>

{{Admon/tip|Changing Existing Samba Account Passwords|If you need === Controlling Access to change a user's existing Samba account password, you can issue the following command as root: '''smbpasswd username'''.}}Pages ===

<ol><li value="6">Confirm the user you created has been added using the following command:<br>'''pdbedit -L -v'''</li><li>Test and review your configuration with the command:<br>'''testparm'''</li><li>Use the '''systemctl''' command to start the smb.service and enable the service to run on boot-up</li><li>Install the ''netstat'' command by issuing the following command:<br>'''yum install net-tools'''</li><li>Issue the '''netstat -nautp''' command to see with port Samba For security, it is running on.</li><li>Use the information in the previous step to modify the firewall on VM2 machine important to allow samba traffic.</li><li>Test to see that you can connect access to general areas of your Samba server (locally) by issuing the following command:<br>'''smbclient -U <yourSenecaID> -L 127.0.0.1'''</li><li>When promptedwebpage, enter your Samba account password.</li><li>The output from that issued command show appear similar but also limit access to example displayed below:</li></ol> Sharename Type Comment other sub--------- ---- ------- home Disk Your Name IPC$ IPC IPC Service ("Your Name") Domain=[WORKGROUP] OS=[Windows 6directories that contain other webpages or documents.1] Server=[Samba 4.2.3] Server Comment ------ ------- WorkGroup Master --------- ------ <ol><li value="13">To access the Samba client shell on Penetration Testers or hackers may be able to navigate your local Samba share, issue the following command:<br>'''smbclient '\\127.0.0.1\home' -U <yourSenecaID>'''</li><li>Enter file systems within your Samba account password.</li><li>Issue the help command html directory to note common commands (''dir'', ''cd'', ''ls'', ''put'', ''get''). Note how similar they are to ''sftp'' commands.</li><li>Enter '''exit''' to terminal your local Samba sessionobtain unauthorised information.</li></ol>

Although There are many common-sense safeguards, such as creating an index.html file in your default directory that will display a webpage instead of the directory index. On the other hand, there are also safeguards that you can use smbclient setup to provide additional protection to accessyour data on your web server. '''Perform the following steps:''' # As the root user on your gateway/host, browse and share files within other Linux and Windows serverstry to forward incoming http connections that arrive on your host to the web server on vm1. Use an iptables command something like this:<br><source>iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.X.2</source>OR this (whichever works):<br><source>iptables -t nat -A PREROUTING -i *externalinterface* -p tcp --dport 80 -j DNAT --to 192.168.X.2</source> {{Admon/important |Do not save these rules|The PREROUTING rule above will redirect all HTTP requests to vm1. That will be a problem in the future when you run yum install or yum update, it is more practical which downloads things over HTTP.}} # You will also need to create a rule in the FORWARD chain in the default table to accept connections to port 80.# To test this setup you'll need to use another machine outside your own network. For this purpose you can simply use the host (machine running Vmware). # Have the external machine view both '''index.html''' and '''index.php'''# Create a Samba new directory called '''private''' inside your '''DocumentRoot''' and move index.php inside it.# View both files again.<br><br>You will now modify the settings on the web-server to allow MS Windows Users prevent machines outside our network from accessing the private directory.<br><br># Add the following directory statement to access a common your apache configuration file. The default pathname for the apache configuration file is: '''/etc/httpd/conf/httpd.conf''' (NOTE: replace the X with your own network octet): {{Admon/important |Do not overwrite existing settings|There should already be two Directory statements in that file share on a Linux machine, . One for '''/var/www''' and one for '''/var/www/html'''. Add your new Directory statement after them. Do not overwrite them.}} <source><Directory "/var/www/html/private"> AllowOverride None Require ip 192.168.X.0/24</Directory></source> This sets up separate rules and will access permissions for that subdirectory. Your should no longer be demonstrated able to access any pages in Investigation 2the private directory (or any sub-directories of it) from external machines, but your internal machines (including your host) should still have access.

==INVESTIGATION 2: CONNECTING TO A SAMBA SERVER FROM A WINDOWS CLIENTSETTING UP AN ONLINE DATABASE==

This investigation will configure your VM2 machine to act as The next piece of the puzzle is installing, configuring, and running a Samba File database server to allow Windows OS Users access to the Linux Samba server filessupport your webmail application that will be installed and setup later in this lab.

=== Creating a Windows7 Professional VM Install, Configure and Run MySQL Database Server ===

To demonstrate how MySQL is used to allow storage and retrieval of structured data. SQL is a command language (used by scripting languages such as PHP) to allow programmers to access and share files from databases contained within a remote MS Windows server using (or other servers via a network) to be used within web-based applications via the web-browser. We won'''smbclient''' on your '''host''' machinet spend much time learning the details of MySQL configuration but you need a basic server set up. You may remember when setting up MySQL from OPS235 - it is basically the same concept. {{Admon/tip |MySQL / SQL Language Resources|Again, we will install MySQL can be a Windows7 Professional machine as complex topic: Seneca has an entire course that concentrates on using SQL commands! Here is a virtual machinelink to MySQL / SQL Language resources: [http://www.w3schools.com/sql/ MySQL / SQL Language Resources].}}

#Make certain you are using your Install '''hostmariadb-server''' machine.#Download a version of MS Windows7 Professional ISO file to your host machine. If you have already downloaded an ISO file<br /><br /> The MySQL and MariaDB are actually two <u>separate</u> projects run by different groups, yet they are compatible; therefore, then you can use that (i.e. transfer documentation from one to your host machine)configure the other.<br><br>#'''NOTE:''' You cannot use a CD/DVD since KVM does When installing mariadb, make certain that you have not install by CD/DVD.<br><br>just the '''ALTERNATIVE METHOD:client''' You could but also refer the '''server software'''.#When you start the MySQL service, check the system log file for instructions regarding how to set the following link root password. Even though we will '''not''' configure our MySQL service to download Windows7 OS image: https://inside.senecacollege.ca/its/software/ , <br>select be '''Software Downloadsaccessible over the network''', login with your senecaid and passwordit is accepted as a "best practice" configuring for network access for each MySQL installation.#Note that the MySQL service has two root passwords:<ul><li>For the localhost</li><li>For external requests</li></ul>#Start the mariadb server, select then refer to the log file (by running '''MSDNjournalctl -xe''', and then select a Windows7 Professional iso image ) to learn how to run the two commands in order to downloadgenerate the appropriate passwords.<br>You are <br>NOTE: Use a password you make up yourself, but do <u>not</u> required to obtain a product key use your own secret password, since you will not need to extend be storing that password in a plain text file for later reference.#Start the service and ensure that it will start automatically every time the use of this Windows OS over 60 daysmachine boots.

{{Admon/tip |Rearming the Windows Trial Version|If are your trial period for your Windows machine is nearly over, you can extend the trial period for another 30 days by running a command prompt as the <u>administrator</u> (right-click on '''cmd''' icon) and issuing the command: '''slmgr -rearm'''. Obviously, you are required === Test Connection to perform this operation prior to the termination of the initial trial period.}}MySQL Database Server ===

<ol><li vaLUE="3">Create a new virtual machine (RAM: '''1024 MB''', hard drive sizePerform the following steps: '''20 GB''', accept all other defaults) making certain to specify the location of your downloaded Windows OS iso file.</li><li>Install the Windows OS creating a default user as the administrator.</li><li>Upon successful installation, log into the Windows machine as a regular user, open a command prompt and using the '''ping''' command to confirm that you can connect to your VM2 machine.</li></ol>

# Modify the Directory statement for your '''private''' directory to prevent any machine other than your vm1 from accessing it.# Re-start the web-server and try to access the page from another machine. Make sure that you can '''not''' do so before you continue.# Install the '''php-mysql''' module so that the installation of php your web server is using can execute sql statements. You will have to restart the service after installing it.#Modify the '''index.php''' page in your '''private''' directory to match the code below. This will test that your web server can connect to the database (replace the <user> and <password> with values appropriate for your machine):<br><source><?php$mysqli ===Accessing Files new mysqli("localhost", "<user>", "<password>");if ($mysqli->connect_errno) { echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error;}echo $mysqli->host_info . "\n";?></source>#Once that page shows a successful connection on a Linux Samba Server your VM ('''Localhost via UNIX socket''' via Windows Explorer ===the '''lynx''' application) this step is complete.

With some additional "tweaking" to your Linux Samba You have now established that the web server configuration file, you should be is able to access files on that file from a Windows machine on run code which can interract with the same networkdatabase. You This will be creating a Samba share for your home directory allow dynamic pages to make use of information stored there when providing resources to your regular user accountusers.

'''Perform the following tasks:Record steps, commands, and your observations in INVESTIGATION 2 in your OPS335 lab log-book'''

# Make certain that both your '''VM2''' and '''Windows''' virtual machines are running.# On your Windows VM== INVESTIGATION 3: INSTALL, temporarily turn off the firewall for your Windows machine.# Open the Windows Explorer application.# At the top of the application, enter the following:<br>'''\\IPADDR_OF_VM2_MACHINE\home'''CONFIGURE &amp; RUN WEBMAIL APPLICATION (Roundcube Mail) ==

{| cellpadding="15" width="40%" align="right" cellpadding="10"

 |width="10%" |[[Image:samba-loginRoundcube.png|thumb|right|300px200px|You will be prompted (once only) for the Samba user-name and password for your '''VM2Roundcube''' machine)webmail application Logo<br>GPL,<br> https://commons.wikimedia.org/w/index. php?curid=1772791]] |width="10%" |[[Image:samba3-maproundcube-drivepic.png|thumb|right|300px|You can create a Screencapture of '''mapped network drive (z:)roundcube''' for your Linux Samba server network share). Make certain that '''Reconnect at Login''' option is enabledwebmail application running in order to send and receive mail messages via a web-browser. ]]  

In the investigation, we will simply install, configure and run the '''roundcube''' webmail application.'''Perform the following steps on vm1:'''<ol><li value=>Download the lastest '''Complete''' "5zipped tarball"> You will be prompted to enter your VM2 username and password from their website (one time onlyhttps://roundcube.net/download/). Refer to diagram using wget on rightthe download link .<br/li><brli>Extract the "zipped tarball" and rename the generated directory that contains download source code to: '''webmail'''NOTE:. Also make sure that '''webmail''' is a sub-directory of your '''DocumentRoot'''.* Use the '''--no-same-owner''' It may take approximately 30 seconds option when extracting the tar achive to display ensure that the file contentsfiles do not keep the original owner (who will not exist on your system).<br/li><brli>Change the ownership of the '''temp''' and '''logs''' directories so they belong to '''apache'''.</li><li>Where your successfulIf you're not in Andrew's sections and you have SELinux enabled: This service needs to be able to write to several directories ('''temp''' and '''logs''') that SELinux prevents write access to. If you are in a section that has SELinux set to '''enforcing''', run the following commands to let it know that apache should be allowed to write to files in those directories.<source>semanage fcontext -a -t httpd_log_t '/var/www/html/webmail/temp(/.*)?'semanage fcontext -a -t httpd_log_t '/var/www/html/webmail/logs(/.*)? 'restorecon -v -R /var/www/html/webmail</source>::NOTE: If your machine does nothave the '''semanage''' command, try use yum to troubleshoot install the problem first, then ask your lab assistant or instructor for assistance'''policycoreutils-python''' package.You will also need to tell selinux to allow the webserver to open connections to the MTAs with <source>setsebool -P httpd_can_network_connect 1</source></li><li>Close In the Windows Explorer application windowdirectory now named "webmail", there will be a file named '''INSTALL''' which will walk you through the rest of the Roundcube installation.<br /li><libr />Click on Some installation tips to consider:::* Be careful about copying &amp; pasting the MySQL setup part: take time and pay attention to detail: do not try to "rush it".::* You will need to install additional Apache modules including: '''STARTphp-xml''' menu, and click on '''Computerphp-mbstring'''.::* Don't forget to set the password in the roundcube configuration.</li><li>Click To make things easier, RoundCube has a well configured installation page available through your local web browser (You will see a note about it in the '''INSTALL''' file).</li>  ::* Go onto your host, open Firefox and on the address bar type '''vm1.<yourSenecaID>.ops/webmail/installer''', make sure your dns on host can resolve the web address. Alternatively, instead of "vm1.<yourSenecaID>.ops" you can input the ip address of your vm1, '''192.168.X.2/webmail/installer''', change X to your own IP octet. ::* Inside the Map Network Drive buttonweb browser installer, and create a ensure all required options are "'''mapped network driveok''' (called it drive ", if "'''ZDOM:not ok'''" it means you need to install additional php packages (yum install php-xml php-mbstring) which . Once everything is a Samba share of your VM2 machine for ready (it will not let you continue otherwise) click next go to the next page. ::* On the next page, under the home directory making certain option to '''Reconnect at LoginIMAP settings''' insert ''' is enabledvm3.</liyourSenecaID>.ops''' in '''default_host''' field and '''143''' in '''default_port''' field. Under '''SMTP settings''' insert '''vm2.<liyourSenecaID>When finished.ops''' in '''smtp_server''' field, click on and '''Network25''' in Windows file manager to confirm that '''smtp_port''' field. Ensure '''smtp_user/smtp_pass''' is '''empty''' and '''uncheck''' the "Use the network share is presentcurrent IMAP username and password for SMTP authentication" checkbox.</li><li>Restart ::* Under '''Database setup''' '''db_dsnw''', enter "localhost" as your Windows VM database server, "roundcubemail" for database name. Put "roundcube" as Database user, and confirm the password you set for the roundcube user when you configured that in the network share is activeprevious step for database password. Everything else can be left as default.</li><li>Try ::* Click Next to create a the configuration file on , then download it to your Windows VM on your Linux Samba machine'''host'''. By default it will be saved under '''~yourSenecaID/Downloads'''. Were you able to create a save a Transfer that file?</li><li>Switch '''to your VM2 machine vm1''' using '''scp''' and check place it inside '''/var/www/html/webmail/config''' folder. ::* Go to see test config page if that you are not there already and "Check config file was created " should be ok. "Check DB config" should also be ok, if not check your mysql settings. ::* Make sure your SMTP and IMAP servers are running, then finally test your configuration by sending email using your smtp server through test field provided by webmail installer, you should receive a test email sent by RoundCube. Test your IMAP settings by simply loging in with your home directorySenecaID and vm3 password on the same webpage. ::* If everything works properly you can '''skip to''' step 9. *Remember you can edit the configuration file manually by editing "/var/www/html/webmail/config/config.inc.php".</li><li>Finally, enable Note that both of your Windows VM firewall, but with an exception for a Samba connection IMAP and SMTP servers are on different machines (i.e. not on vm1). Therefore, you should see custom values in the port number obtained from following parameters in the previous investigation).Roundcube configuration file: <source>$config['smtp_server']$config['smtp_user'] = '';$config['smtp_pass'] = '';$config['default_host']$config['default_port']</olsource>

</li><li>Now that you have Roundcube installed it is time to test if the roundcube webmail application is working by logging on, then sending and receiving e-mail messages:*Using the Firefox webbrowser, navigate to '''vm1.<yourdomain>.ops/webmail''' and login (using the username only).*Use the interface provided to send and receive email.</li><li>If mail sent through roundcube is sending from the wrong domain (i.e. user@vm3.yourdomain.ops instead of user@yourdomain.ops), each user can override it in the settings tab, or you can set:::* '''$config['mail_domain']''' </li></ol> '''Record steps, commands, and your observations in INVESTIGATION 2 3 in your OPS335 lab log-book''' {{Admon/important |Backup your VMs!|You MUST perform a '''full backup''' of ALL of your VMs whenever you complete your '''OPS335 labs''' or when working on your '''OPS335 assignments'''. You should be using the dump or rsync command, and you should use the Bash shell script that you were advised to create in order to backup all of your VMs.}}

==COMPLETING THE LAB=Online Submission===Follow the instructions for lab 6 on blackboard.<!--===Andrew's sections===

'''Arrange evidence (command output) for each You may choose to:* Submit screenshots of these items your work on your screenBlackboard, then ask your instructor in which case you don't need to come to the lab.* Or come to review them and sign off on the lab, show me your work, and talk to me about it. I want to hear what you's completion:'''ve learned and answer any questions you have.

::<span style="color:green;font-size:1.5em;">&#x2713;</span> Proof You'll get the same grade regardless of network share of VM2 machine from Windows VM via Windows Explorer application::<span style="color:green;font-size:1.5em;">&#x2713;</span> Firewall settings on how you choose to submit your Windows VM to allow Linux Samba network share::<span style="color:green;font-size:1.5em;">&#x2713;</span> Display contents of '''/etc/samba/smb.conf''' file on VM2 machine::<span style="color:green;font-size:1.5em;">&#x2713;</span> Firewall exceptions (both machines) to allow Samba traffic::<span style="color:green;font-size:1work.5em;">&#x2713;</span> Lab logbook completed

 #What does SMBthe term LAMP stand for?Briefly describe the purpose of each of the following items in LAMP.#What is the purpose of the '''testparm''' commandmajor difference between a static web document and a dynamic document?#What does the text inside square brackets in the '''smb.conf''' file term "server-side programming" mean? (e.g., "[home]").#Explain What is the meaning purpose of the line "create mask = 0765" in the smbcreating and using an index.conf html file?#What does is the '''smbpasswd''' command dopurpose of creating and using an index.php file?