Changes

==SAMBA SERVER RESOURCESOBJECTIVE & PREPARATION==[[Image:lamp.png|thumb|right|300px|To provide additional help make your web resource more dynamic (for web apps such as webmail) several services are also required. A popular acronym to represent these foundations and servers is referred to as '''LAMP'''. It stands for '''Linux''', '''Apache''', '''MySQL''', and '''PHP''' (or ''Python'').<br><br>Image by Shmuel Csaba Otto Traian,<br>https://commons.wikimedia.org/w/index.php?curid=28224098)<br>(via: [http://creativecommons.org/licenses/by-sa/3.0 Commons Attribution-Share Alike 3.0]) ]]In this lab, we will look at several separate technologies that are used with the Apache web server to install, configure and run web applications.

* If we want to add more features for our web-page (Course Notes on Samba Servereg. dynamic functionality, security, e-commerce, etc)*[http://www, your webserver would need additional help.tomsitpro.com/articles/linuxTo provide additional help requires several resources -more than just the web server-configuration-guide-book-excerptitself. A popular acronym to represent these foundations and servers is referred to as '''LAMP'''. It stands for '''Linux''', '''Apache''', '''MySQL''',2-777-2and '''PHP''' (or ''Python'').html Samba Server Setup] (Simple setup guide for samba server]

''"Samba is the standard Windows interoperability suite of programs for Linux and Unix* [http://www. Samba is Free Software licensed under the GNU General Public License, the Samba project is a member of the Software Freedom Conservancyliquidweb."''com/kb/how-to-install-apache-on-centos-7/ Installing Apache Webserver on Centos7]* [http://www.w3schools.com/php/default.asp PHP Tutorial] (w3schools.com)* [http://www.w3schools.com/sql/ MySQL / SQL Language Resources] (w3schools.com)

This lab will first install=== Install, setup, and enable a Samba server. Then another virtual machine will be created for Configure & Run a Windows operating system. Finally, within the Windows virtual machine, users will access files from the Linux Samba server Webserver (both graphically and command lineApache).===

'''Perform the following steps:''' #Make certain you are in your '''VM1''' machine.#Install the Apache package (the name of the package is '''httpd''').#Start the httpd service, and enable this service to start automatically upon system startup.#Using a text browser such as '''lynx''' on vm1 go to http://localhost. You should get the Apache Test Page which indicates your web server is running on the local virtual machine.#Make certain to configure your firewall to allow access to the httpd service (i.e. the Apache serves HTTP traffic which goes over TCP port '''80''') and keep the changes past rebooting.#Open a web-browser in your '''host''' machine and enter the following URL: '''vm1.youruserid.ops'''.<br />If you setup your Apache webserver correctly, you should be able to view the Apache Test page.#Although we will not be exploring webservers in depth, we will have you create a simple webpage for testing purposes, then later setup a web resource for webmail.#The term '''DocumentRoot''' specifies where the Apache webserver will search for documents to serve. Create the file '''index.html''' in your '''DocumentRoot''' directory with the following contents (replace the date with the current one):<br><source>Hello, this is a web page on vm1.youruserid.ops and the current time is Mar 28 22:16:27 EDT 2016!</source><ol><li value="9">If you refresh your web-browser page in your browser, you should see the contents of your ''index.html'' document. If you wish, you can specify the filename index.html in the address, but it is not necessary, since the file index.html is automatically loaded by default when the URL refers to that directory containing that file.</li></ol>  {{Admon/tip |Using the '''index.html''' file|It is considered to be a "best practice" to create '''index.html''' files for newly-created subdirectories within the '''DocumentRoot''' (or users' '''public_html''' directories) to force a display of a web-page, instead of viewing the directories "index" listing of files (from "curious eyes"): that is why the name of the file is called ''"index.html"''.}}  <ol><li value=INVESTIGATION 1"10">Refresh your web-page by issuing the keycombination: INSTALLING &amp; CONFIGURING A SAMBA SERVER'''ctrl-r'''. Notice that the time doesn't change as you refresh the page. This indicates that the page is static (not dynamic) indicating that the page does not change (i.e. boring!).</li></ol> === Creating a PHP Script === In order to allow us to run a webserver application in a web-browser, we need a scripting language that will allow the web-browser to function dynamically (i.e. being able to change frequently, as opposed to being "static" or unchanging). In this section, we will demonstrate how a scripting language (PHP) can be used for the web-browser to react in a more dynamic fashion. {{Admon/tip |PHP Scripting Language|PHP code is considered to be a language that runs on the web-server (i.e. "server-side programming"). PHP code can be embedded in an HTML document (HTML code), and use the resources on the "server-side" to make the web document or resource more dynamic (eg. database access, etc). Although it is not the purpose of this course to learn about and create PHP documents, here is a quick resource on PHP: [http://www.w3schools.com/php/default.asp PHP Tutorial]}} '''Perform the following steps:'''

In this investigation, we will set up a #'''Copy'''Samba serverthe ''' on our index.html'''VM2file as ''' machineindex. We will first installphp''' and modify it to contain:<br><source>Hello, configure and enable the samba server this is a web page on our virtual machine, vm1.youruserid.ops and then we will quickly test to see if the Samba server works.current time is <?php system("date"); ?>!</source>

{{Admon/=== Controlling Access to Pages === For security, it is important|Prerequistites|Due to the changes made in lab3allow access to general areas of your webpage, '''you will now need but also limit access to other sub-directories that contain other webpages or documents. Penetration Testers or hackers may be able to navigate your file systems within your vm1 running (html directory to obtain unauthorised information.  There are many common-sense safeguards, such as the DNS server)''' creating an index.html file in order for any your default directory that will display a webpage instead of your virtual machines the directory index. On the other hand, there are also safeguards that you can setup to be able provide additional protection to use the internetyour data on your web server.}}

#Make certain As the root user on your gateway/host, try to forward incoming http connections that both arrive on your '''VM1''' and '''VM2''' machines are running.#Switch host to your '''VM2''' machine as the '''root''' userweb server on vm1.#Issue the following Linux Use an iptables command to install Samba server utlitysomething like this:<br>'''yum install samba samba-client'''<brsource>#Copy the file '''/etc/samba/smb.conf''' iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to another filename by issuing the following command:<br>'''cp /etc/samba/smb192.conf /etc/samba/smb168.confX.original'''#Clear the contents of the configuration file by running '''cat 2</dev/null source> /etc/samba/smb.conf'''#Edit '''/etc/samba/smb.conf''' so that the file that contains the following lines: [global] workgroup = WORKGROUP server string = "put your real name here without the quotes" encrypt passwords = yes smb passwd file = /etc/samba/smbpasswd [home] comment = "put your real name here without the quotes" path = /home/<yourSenecaID> public = yes writable = yes printable = no create mask = 0765<ol><li value="3">Append OR this (addwhichever works) the following parameter to the bottom of the '''[global] section''' that will limit access to the share so that only machines in your virtual network and those in the lab room will be able to access it:</libr></olsource> hosts allow = iptables -t nat -A PREROUTING -i *externalinterface* -p tcp --dport 80 -j DNAT --to 192.168.x. 127.0.0X.1<ol><li value="4">Append (add) the following parameter to the '''[home] section''' so that only your user account can access that share:</li></ol> valid users = <yourSenecaID><ol><li value="5">Create a Samba account and password for yourSenecaID by issuing the following command:<br>'''smbpasswd -a <yourSenecaID>'''</li>2</olsource>

{{Admon/tipimportant |Changing Existing Samba Account PasswordsDo not save these rules|If you need The PREROUTING rule above will redirect all HTTP requests to change vm1. That will be a user's existing Samba account passwordproblem in the future when you run yum install or yum update, you can issue the following command as root: '''smbpasswd username'''which downloads things over HTTP.}}

<ol><li value="6">Confirm # You will also need to create a rule in the FORWARD chain in the user default table to accept connections to port 80.# To test this setup you created has been added using the following command:<br>'''pdbedit -L -v'''</li><li>Test and review ll need to use another machine outside your configuration with own network. For this purpose you can simply use the command:<br>'''testparm'''</li><li>Use host (machine running Vmware). # Have the external machine view both '''systemctlindex.html''' command to start the smb.service and enable the service to run on boot-up</li><li>If you are in one of the sections with SELinux set to enforcing, you will need to tell it to allow samba access to home directories: '''setsebool -P samba_enable_home_dirs 1index.php'''</li><li>Install the # Create a new directory called ''netstat'private' command by issuing the following command:<br>'''yum install net-tools'''</li><li>Issue the inside your '''netstat -nautpDocumentRoot''' command to see with port Samba is running onand move index.php inside it.# View both files again.</libr><libr>Use You will now modify the information in settings on the previous step web-server to modify prevent machines outside our network from accessing the firewall on VM2 machine to allow samba trafficprivate directory.</libr><libr>Test to see that you can connect # Add the following directory statement to your Samba server (locally) by issuing apache configuration file. The default pathname for the following commandapache configuration file is:<br>'''smbclient -U <yourSenecaID> -L 127.0.0.1'''</li><li>When prompted, enter your Samba account password.<etc/li><li>The output from that issued command show appear similar to example displayed below:<httpd/li><conf/ol> Sharename Type Comment --------- ---- ------- home Disk Your Name IPC$ IPC IPC Service ("Your Name") Domain=[WORKGROUP] OS=[Windows 6.1] Server=[Samba 4.2.3] Server Comment ------ ------- WorkGroup Master --------- ------ <ol><li value="13">To access the Samba client shell on your local Samba share, issue the following command:<br>'''smbclient '\\127httpd.0.0.1\home' -U <yourSenecaID>conf'''</li><li>Enter (NOTE: replace the X with your Samba account password.</li><li>Issue the help command to note common commands (''dir'', ''cd'', ''ls'', ''put'', ''get''own network octet). Note how similar they are to ''sftp'' commands.</li><li>Enter '''exit''' to terminal your local Samba session.</li></ol>:

Although you can use smbclient to access, browse {{Admon/important |Do not overwrite existing settings|There should already be two Directory statements in that file. One for '''/var/www''' and share files within other Linux one for '''/var/www/html'''. Add your new Directory statement after them. Do not overwrite them.}} <source><Directory "/var/www/html/private"> AllowOverride None Require ip 192.168.X.0/24</Directory></source> This sets up separate rules and Windows servers, it is more practical to setup a Samba server to allow MS Windows Users access permissions for that subdirectory. Your should no longer be able to access a common file share on a Linux machineany pages in the private directory (or any sub-directories of it) from external machines, and will be demonstrated in Investigation 2but your internal machines (including your host) should still have access.

==INVESTIGATION 2: CONNECTING TO A LINUX SMB SERVER FROM A LINUX CLIENTSETTING UP AN ONLINE DATABASE==

In this investigation you will explore some The next piece of the different ways puzzle is installing, configuring, and running a database server to access a shared directory from a Linux client machine (VM1)support your webmail application that will be installed and setup later in this lab.

=== Using smbclient ===*Install the '''samba-client''' MySQL is used to allow storage and '''cifs-utils''' packagesretrieval of structured data.*Use the "smbclient" command in SQL is a terminal window. smbclient '\\vm2\home' -U <learnid>*After entering your password you should get a prompt similar to smb: \>*Enter the ls command to see a list of the files in your home directory - you may receive the following error if you are in a section with SELinux Enforcing. smb: \> ls NT_STATUS_ACCESS_DENIED listing \**If you received that error, SELinux will need to be adjusted language (on the samba serverused by scripting languages such as PHP) for this to work. setsebool -P samba_enable_home_dirs 1*Once you have allow programmers to access to the directory use the get and put commands databases contained within a server (similar to ftpor other servers via a network) to move files.*When you are finished close be used within web-based applications via the connection.*Note that this tool only gave temporary access with a limited set of commandsweb-browser.

=== Using We won'mount -t cifs' ===*The next way is to use spend much time learning the mount commanddetails of MySQL configuration but you need a basic server set up.*Use the mount command on '''vm1''' to mount your home directory mkdir /tmp/vm2You may remember when setting up MySQL from OPS235 -home mount -t cifs //vm2/home /tmp/vm2-home -o username=<learnid> ls /tmp/vm2-home*Create a file in that directory, then switch to '''vm2''' to confirm that it was created.*Use umount to unmount that directory.*Note that this tool would leave is basically the directory mounted until the machine rebooted or it was unmounted. It would also allow other users access to the directory, as it effectively became part of the local filesystem. It could even be added to fstab to be mounted on bootsame concept.

'''The following steps require {{Admon/tip |MySQL / SQL Language Resources|Again, MySQL can be a graphical interface; perform them complex topic: Seneca has an entire course that concentrates on your HOST'''using SQL commands! Here is a link to MySQL / SQL Language resources: [http://www.w3schools.com/sql/ MySQL / SQL Language Resources].}}

=== Using Nautilus to browse Samba shares ===*Install the '''samba-client''' and '''cifs-utils''' packages.*Use Perform the "Places" menu from the desktop and open 'Browse Network'.*From the menu in the side-bar of the files tool, choose 'Connect to Server'. *Enter 'smbfollowing steps://vm2/home' as the location, and enter your samba password in the prompt.**Where vm2 is the name of the server, and home is the name of the directory it is sharing.*After you have checked that you can access your files, unmount the share by right-clicking its icon in the side-bar and clicking 'Unmount'.

=== Using a browser ===*You #Install '''mariadb-server'''.<br /><br /> The MySQL and MariaDB are actually two <u>separate</u> projects run by different groups, yet they are compatible; therefore, you can also use a web browser with support for documentation from one to configure the SMB protocol such as Konquerorother.<br><br>**Note #'''NOTE:''' When installing mariadb, make certain that firefox does you have not have such supportjust the '''client''' but also the '''server software'''. *If Konqueror is not installed then install it with #When you start the command: yum install kdebase*Start KonquerorMySQL service, check the web/system log file browser, and in for instructions regarding how to set the address bar enter root password. Even though we will '''not''' configure our MySQL service to be '''accessible over the followingnetwork''', it is accepted as a "best practice" configuring for network access for each MySQL installation. smb#Note that the MySQL service has two root passwords:<ul><li>For the localhost</li><li>For external requests</vm2li></homeul>*Enter your username and password when prompted#Start the mariadb server, then refer to the log file (by running '''journalctl -xe''') to learn how to run the two commands in order to generate the appropriate passwords.*Double click on <br><br>NOTE: Use a file password you have some text in.**Open it with gedit, make some changesup yourself, and save it.**When promptedbut do <u>not</u> use your own secret password, choose to upload the since you will be storing that password in a plain text filefor later reference.*Close Konqueror.*cat #Start the file on your VM2 to service and ensure that it will start automatically every time the changes were properly uploadedmachine boots.

This investigation will configure your VM2 machine to act as a Samba File server to allow Windows OS Users access to '''Perform the Linux Samba server files.following steps:'''

# Modify the Directory statement for your '''private''' directory to prevent any machine other than your vm1 from accessing it.# Re-start the web-server and try to access the page from another machine. Make sure that you can '''not''' do so before you continue.# Install the '''php-mysql''' module so that the installation of php your web server is using can execute sql statements. You will have to restart the service after installing it.#Modify the '''index.php''' page in your '''private''' directory to match the code below. This will test that your web server can connect to the database (replace the <user> and <password> with values appropriate for your machine):<br><source><?php$mysqli ===Accessing Files new mysqli("localhost", "<user>", "<password>");if ($mysqli->connect_errno) { echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error;}echo $mysqli->host_info . "\n";?></source>#Once that page shows a successful connection on a Linux Samba Server your VM ('''Localhost via UNIX socket''' via Windows Explorer ===the '''lynx''' application) this step is complete.

With some additional "tweaking" to your Linux Samba You have now established that the web server configuration file, you should be is able to access files on that file from a Windows machine on run code which can interract with the same networkdatabase. You This will be creating a Samba share for your home directory allow dynamic pages to make use of information stored there when providing resources to your regular user accountusers.

'''Perform the following tasks:Record steps, commands, and your observations in INVESTIGATION 2 in your OPS335 lab log-book'''

# Make certain that both your '''VM2''' and '''Windows''' virtual machines are running.# Power up a Windows system in the lab and login.# Add the prerouting and forwarding rules to your host's iptables necessary to redirect samba traffic from outside your network to your VM 2.# Open the Windows Explorer application.# At the top of the application== INVESTIGATION 3: INSTALL, enter the following:<br>'''\\IPADDR_OF_HOST_MACHINE\home'''CONFIGURE &amp; RUN WEBMAIL APPLICATION (Roundcube Mail) ==

{| cellpadding="15" width="40%" align="right" cellpadding="10"

 |width="10%" |[[Image:samba-loginRoundcube.png|thumb|right|300px200px|You will be prompted (once only) for the Samba user-name and password for your '''VM2Roundcube''' machine)webmail application Logo<br>GPL,<br> https://commons. wikimedia.org/w/index.php?curid=1772791]] |width="10%" |[[Image:samba3roundcube-map-drivepic.png|thumb|right|300px|You can create a Screencapture of '''mapped network drive (z:)roundcube''' for your Linux Samba server network share)webmail application running in order to send and receive mail messages via a web-browser. ]]  

<ol><li value="5"> You In the investigation, we will be prompted to enter your VM2 username simply install, configure and password (one time only)run the '''roundcube''' webmail application. Refer to diagram '''Perform the following steps on right.vm1:'''<brol><brli>Download the lastest '''NOTE:Complete''' It may take approximately 30 seconds to display "zipped tarball" from their website (https://roundcube.net/download/) using wget on the file contentsdownload link .<br><br></li><li>Where Extract the "zipped tarball" and rename the generated directory that contains download source code to: '''webmail'''. Also make sure that '''webmail''' is a sub-directory of your successful? If '''DocumentRoot'''.* Use the '''--no-same-owner''' option when extracting the tar achive to ensure that the files do not, try to troubleshoot keep the problem first, then ask original owner (who will not exist on your lab assistant or instructor for assistancesystem).</li><li>Close Change the Windows Explorer application window.</li><li>Click on ownership of the '''STARTtemp''' menu, and click on '''Computerlogs''' directories so they belong to '''apache'''.</li><li>Click on the Map Network Drive button, If you're not in Andrew's sections and create a you have SELinux enabled: This service needs to be able to write to several directories ('''mapped network drivetemp''' (called it drive and '''Z:logs''') which is that SELinux prevents write access to. If you are in a section that has SELinux set to '''enforcing''', run the following commands to let it know that apache should be allowed to write to files in those directories.<source>semanage fcontext -a -t httpd_log_t '/var/www/html/webmail/temp(/.*)?'semanage fcontext -a Samba share of -t httpd_log_t '/var/www/html/webmail/logs(/.*)?'restorecon -v -R /var/www/html/webmail</source>::NOTE: If your VM2 machine for does not have the '''semanage''' command, use yum to install the home directory'''policycoreutils-python''' package.You will also need to tell selinux to allow the webserver to open connections to the MTAs with <source>setsebool -P httpd_can_network_connect 1</source></li><li>When finishedIn the directory now named "webmail", click on there will be a file named '''NetworkINSTALL''' in Windows file manager to confirm that which will walk you through the rest of the network share is presentRoundcube installation.<br /li><libr />Try Some installation tips to consider:::* Be careful about copying &amp; pasting the MySQL setup part: take time and pay attention to detail: do not try to "rush it".::* You will need to create a file on Windows on your Linux Samba machineinstall additional Apache modules including: '''php-xml''' and '''php-mbstring'''. Were you able ::* Don't forget to create a save a file?set the password in the roundcube configuration.</li><li>Switch to To make things easier, RoundCube has a well configured installation page available through your VM2 machine and check to local web browser (You will see if that a note about it in the '''INSTALL''' file was created in your home directory).</li></ol>

<source>$config['smtp_server']$config['Record steps, commands, and your observations from this INVESTIGATION in your OPS335 lab log-booksmtp_user'] = '';$config['smtp_pass'] = '';$config['default_host']$config['default_port']</source>

</li><li>Now that you have Roundcube installed it is time to test if the roundcube webmail application is working by logging on, then sending and receiving e-mail messages:*Using the Firefox webbrowser, navigate to '''Arrange evidence vm1.<yourdomain>.ops/webmail''' and login (command outputusing the username only) for each .*Use the interface provided to send and receive email.</li><li>If mail sent through roundcube is sending from the wrong domain (i.e. user@vm3.yourdomain.ops instead of these items on your screenuser@yourdomain.ops), then ask your instructor to review them and sign off on each user can override it in the labsettings tab, or you can set:::* 's completion:''$config['mail_domain']'''</li></ol>

::<span style="color:green;font-size:1.5em;">&#x2713;</span> Proof of network share of VM2 machine from Windows VM via Windows Explorer application::<span style="color:green;font-size:1.5em;">&#x2713;</span> Firewall settings on your Windows VM to allow Linux Samba network share::<span style="color:green;font-size:1.5em;">&#x2713;</span> Display contents of '''/etc/samba/smb.confRecord steps, commands, and your observations in INVESTIGATION 3 in your OPS335 lab log-book''' file on VM2 machine::<span style="color:green;font-size:1.5em;">&#x2713;</span> Firewall exceptions (both machines) to allow Samba traffic::<span style="color:green;font-size:1.5em;">&#x2713;</span> Lab logbook completed

 #What does SMBthe term LAMP stand for?Briefly describe the purpose of each of the following items in LAMP.#What is the purpose of the '''testparm''' commandmajor difference between a static web document and a dynamic document?#What does the text inside square brackets in the '''smb.conf''' file term "server-side programming" mean? (e.g., "[home]").#Explain What is the meaning purpose of the line "create mask = 0765" in the smbcreating and using an index.conf html file?#What does is the '''smbpasswd''' command dopurpose of creating and using an index.php file?