1,234
edits
Changes
Created page with 'Category:OPS235 {{Admon/caution|Draft Lab|This lab has NOT been released for regular distribution. When the lab is ready to be released, this caution banner will disappear.}}…'
[[Category:OPS235]]
{{Admon/caution|Draft Lab|This lab has NOT been released for regular distribution. When the lab is ready to be released, this caution banner will disappear.}}
= Configuring a Network Using Virtual Machines =
==Overview==
* In this lab, you will learn the basics of networking by using your Virtual Machines and your f17host machine.
* In addition, you will learn to associate network services with port numbers, and learn how to backup files by date/time.
== Objectives ==
# Configure a virtual network for Virtual Machines
# Use the Fedora GUI program to configure network interfaces with static IP configuration and host name resolution
# Use the <code>find</code> command to locate the configuration files modified by the GUI network configuration program
# To examine some of the Linux's TCP/IP configuration files in the <code>/etc/</code> directory
# To configure a Fedora host with static network configuration without a GUI tool
# To configure the linux firewall <code>iptables</code> to allow/disallow/forward different types of network traffic using simple rules
==Required Materials (Bring to All Labs)==
* Fedora 17 LIVE CD
* Fedora 17 x86_64 Installation DVD
* SATA Hard Disk (in removable disk tray)
* USB Memory Stick
* Lab Logbook
==Prerequisites==
* Completion and Instructor "Sign-off" of Lab 5: [[OPS235 Lab 5]]
==Linux Command Online Reference==
Each Link below displays online manpages for each command (via [http://linuxmanpages.com/ http://linuxmanpages.com]):
{|width="100%" cellpadding="5" width="50%"
|'''Networking Utilities:'''
|'''Additional Utilities:'''
|
|- valign="top"
|
*[http://linuxmanpages.com/man8/ifconfig.8.php ifconfig]
*[http://fedoramobile.org/Members/MrHappy/system-config-network system-config-network]
*[http://linuxmanpages.com/man8/route.8.php route]
*[http://linuxmanpages.com/man8/ping.8.php ping]
*[http://linuxmanpages.com/man8/arp.8.php arp]
*[http://linuxmanpages.com/man8/netstat.8.php netstat]
*[http://linuxmanpages.com/man8/iptables.8.php iptables]
|
*[http://www.linuxcertif.com/man/1/systemctl/ systemctl]
*[http://linuxmanpages.com/man1/find.1.php find]
*[http://linuxmanpages.com/man1/tail.1.php tail]
*[http://linuxmanpages.com/man1/cp.1.php cp]
|}
==Resources on the web==
Additional links to tutorials and HOWTOs:
* [http://en.wikipedia.org/wiki/Virtual_network Virtual Network - Definition]
* [http://www.reallylinux.com/docs/networkingadmin.shtml Important Linux Networking Commands] (Also refer to lab 6 notes)
* [http://www.yolinux.com/TUTORIALS/LinuxTutorialNetworking.html Linux Network Configuration]
* [[IPTables]] Reference
* Lab6 Notes: [http://zenit.senecac.on.ca/wiki/index.php/OPS235_Lab_6#Investigation_8:_How_do_I_view_and_configure_the_IPTABLES_firewall.3F_--_Basic_Function.2FConfiguration IPTABLES Firewall]
== Current Configuration ==
Currently you should have the following network configuration:<br /><br />[[Image:network-config1.png]]
* '''Fedora host''' has 1 active network interface (probably <code>'''em1'''</code>) that receives IP configuration from the School's DHCP server.
* '''Fedora host''' has 1 active network interface (<code>'''virbr0'''</code>) that has a static default configuration of '''192.168.122.1/255.255.255.0'''
* '''Fedora1 VM''' has 1 active interface (<code>'''eth0'''</code>) that receives a dynamic configuration from your Fedora Host
* '''Fedora2 VM''' has 1 active interface (<code>'''eth0'''</code>) that receives a dynamic configuration from your Fedora Host
* '''Fedora3 VM''' has 1 active interface (<code>'''eth0'''</code>) that receives a dynamic configuration from your Fedora Host
== Lab Preparation ==
{{Admon/important | Live disc installations and system-config-network | The '''fedora1''' VM was installed from Live CD. It is missing the GUI Network Configuration tool we will be using. Use the command <code>yum install system-config-network</code> to install it.}}
{{Admon/important | Backup your VMs before proceeding | Stop all of your VMs and backup your VM disk images. Do not start the VMs until told to start them.}}
== Configuring a Network Using Virtual Machines ==
=== Investigation 1: How do you create a new virtual network. ===
{{Admon/note | Use the f17host | Complete the following steps on your '''f17host''' computer system.}}
Before configuring our network we want to turn off dynamic network configuration for our Virtual Machines by turning off the "default" virtual network.
# On your '''f17host''' machine start Virtual Machine Manager
# In the Virtual Machine Manager dialog box, Select '''Edit'''-> '''Connection Details'''.
# In the '''Hosts''' Details dialog box, select the '''Virtual Networks''' tab
# Disable the default configuration from starting at boot by '''deselecting''' '''"Autostart"''' (on boot) checkbox.
# Stop the default network configuration by clicking on the '''stop''' button at the bottom left-side of the dialog box.
# Click the '''add''' button (the button resembles a "plus sign") to add a new network configuration.
# Give your new network a name (i.e. '''network1''')
# Enter in the new network IP address space:
#*'''192.168.235.0/24'''
# Disable DHCP by '''deselecting''' the check box.
# Enable Network Forwarding by Selecting '''Forwarding to physical network'''
# The destination should be '''Any physical device''' and the mode should be '''NAT'''
# Proceed with changes, and select '''Finish'''.
# Before proceeding, check the "<u>default</u>" network connection (in the Virtual Networks section) to verify '''Autostart''' is disabled, and that you have created the '''network1''' configuration. You might be required to click Apply when the default '''Autostart''' option is deselected. If you have any problems launching your VMs, then it is recommend to reboot your main system.
# '''Close''' the Virtual Manager, '''reboot''' your f16host, '''log-back into your f16host computer''', and '''restart''' the Virtual Machine Manager.
{{Admon/note | Repeat these steps for each VM | Complete the following steps on <u>each</u> of your virtual machines.}}
<ol>
<li value="15">Now we need to add our new virtual network '''network1''' to the 3 VM's
<ol type="a" style="margin-left:2cm">
<li value="1">Select the '''fedora1''' VM and edit the '''Virtual Machine Details'''<br />(Note: the Virtual Machine window will appear - do not start virtual machine)</li>
<li>Under View select '''Details'''</li>
<li>In the '''left pane''' of the Virtual Machine window, select '''NIC:''' and note that this NIC is on the "default" virtual network</li>
<li>Click on the '''Remove''' button at the bottom right-side of the dialog box.</li>
<li>Click on '''Add Hardware''' on the bottom left-side of the dialog box and add a new network</li>
<li>For the host device, locate and select '''Virtual Network network1''' : NAT</li>
<li>Click finish to exit the Virtual Machine Details dialog box.</li>
</ol>
</li>
<li value="16">Repeat steps '''a - g''' for '''fedora2''' and '''fedora3''' VM's.</li>
</ol>
'''Answer the Investigation 1 observations / questions in your lab log book.'''
=== Investigation 2: How do you configure a static network using <code>system-config-network</code>. ===
{{Admon/note | Use fedora2 | Complete this investigation on your fedora2 VM.}}
# Start '''fedora2''' VM and login
# On your '''fedora host''' run <code>ifconfig</code> and make note of the IP address assigned to the <code>virbr1</code> interface. This will be your default gateway for your Vm's.[[Image:new_network_dialog.png|thumb|350px]]
# Make certain to return to your fedora2 VM.
# To configure a new interface on fedora2 go to '''Applications'''->'''Other'''->'''Network Connections'''.
# Make certain there are no '''"Wired"''' connections (even if you have to click on the connection name and click the '''Delete''' button.
# Create a new wired connection, with the "Connection Name" at the top to read '''eth1'''
# Click on the '''Add''' button, and select the '''IPv4 Settings''' tab.
# Change the method from "Automatic (DHCP)" to '''"Manual"'''.
# In the '''Addresses section''', click '''"Add"'''.
# Manually set the IP configuration to:
#: IP Address '''192.168.235.12'''
#: Subnet Mask '''255.255.255.0'''
#: Default Gateway '''192.168.235.1''' (The IP address of <code>virbr1</code> on your fedora host.)
# Click on the '''DNS''' field and add '''192.168.235.1''' as the primary DNS server.
# Click '''Save''' to Finish, and exit the Network Connections dialog box.
# Your network connection may connect (view the Network Manager applet in the gnome panel at the top of the screen). If there is no connection after a few minutes, you should be able to right-click on the applet and click "eth1" to connect.
# You should be able to use the systemctl command to restart your network.
#'''Restart your network''' on fedora2 by issuing the commands:
#*<code>systemctl stop NetworkManager.service</code>
#*<code>systemctl start NetworkManager.service</code>
# Verify your new interface by examining the output of <code>ifconfig</code>
# To verify that fedora2 has the correct default gateway configured, enter the command: <code>route -n</code>
# Verify the network by using: <code>ping 192.168.235.1</code>
'''Answer the Investigation 2 observations / questions in your lab log book.'''
=== Investigation 3: What files does the <code>system-config-network</code> GUI tool change?. ===
{{Admon/note | Use fedora1 | Complete this investigation on your fedora1 VM.}}
{{Admon/note | Backing up Files |One very important aspect of system admin is performing backups. There are many methods for backing up the data on a a computer system.<br />The following is an example of a common backup system used in Business Unix/Linux systems:<br /><br />'''Full Backup''': Backup all specified files (eg. configuration, data files, etc)<br />'''Incremental Backup''': Backup of only files that have changed since last (full) backup<br /><br />When the system is required to be fully restored, then the '''full backup''' is recovered, followed by each .<br />In this investigation, you will learn how to perform an '''incremental backup''' using the <code>find</code> utility|}}
# Start '''fedora1''' VM and login
# Before we configure fedora1 we should create a timestamp file that can be used to see which files have changed as a result of using the GUI tool.
#* <code>date > /tmp/timestamp</code>
# Run the network configuration tool and enter the following static configuration in the same way that you configured '''fedora2'''.
#* IP Address: '''192.168.235.11'''
#* Subnetmask: '''255.255.255.0'''
#* Default Gateway: '''192.168.235.1'''
#* DNS Server: '''192.168.235.1'''
# Save and exit the network configuration tool.
# Restart the NetworkManager service.
# Verify the configuration by pinging fedora host ('''192.168.235.1''') and fedora2 ('''192.168.235.12''')
# To verify that fedora1 has the correct default gateway configured, enter the command <code>route -n</code>
{{Admon/note | Creating an Incremental Backup |
We will now be using the <code>find</code> command to:
:*Locate the configuration files (contained in the <code>/etc</code> directory) that were modified by the GUI network configuration program
:*Copy those configuration files to a "specified" directory for backup purposes
Previously, you created a file called <code>/tmp/timestamp</code> that just contains the current date and time prior to running the network configuration toool for fedora2.. Any files that were modified by the GUI network configuration program should have a timestamp later (or newer) than the "timestamp" file you created. All the Linux TCP/IP configuration files are stored under the '''/etc''' directory or its sub-directories. The <code>find</code> command (using the correct options) can be used to only list those files that have been recently created since the timestamp date contained in the <code>/tmp/timestamp</code> file.|}}
<ol>
<li value="8">Run the following Linux command:
<ul>
<li><code>find /etc -newer /tmp/timestamp > /root/netcfg.lst</code></li>
</ul>
</li>
<li>View the <code>/root/netcfg.lst</code> file. What does it contain?</li>
<li>Create a new directory called: <code>/tmp/lab6</code></li>
<li>Issue the following commands:
<ul>
<li><code>mkdir -p /tmp/lab6</code></li>
<li><code>find /etc -newer /tmp/timestamp -exec cp {} /tmp/lab6 \;</code></li>
</ul>
</li>
<li>View the contents of the <code>/tmp/lab6</code> directory. What does it contain?</li>
</ol>
{{Admon/tip | Tip | Just for interest, it is relatively simple to automate your backups. You just create a Bash Shell script file using the <code>find</code> command above, give the shell script executable permissions, and use the <code>crontab</code> command to schedule when this script is to be run. If you want to learn more about shell scripting, you can take or refer to the course called '''OPS435''' .}}
'''Answer the Investigation 3 observations / questions in your lab log book.'''
=== Investigation 4: How do I configure the network without a GUI tool? ===
{{Admon/note | Use fedora3 | Complete this investigation on your fedora3 VM.}}
# Start '''fedora3''' VM and login as root
# Use the command <code>ifconfig</code> to list active interfaces, you should see one with a name of <code>eth0</code> or a similar name.
# To configure your card with a static address use the following command:
#* <code>ifconfig eth0 192.168.235.13 netmask 255.255.255.0</code>
# To configure a default gateway for that interface enter the command:
#* <code>route add default gw 192.168.235.1</code>
# To configure your DNS server edit the file <code>/etc/resolv.conf</code>. Change the <code>nameserver</code> line to be:
#* <code>nameserver 192.168.235.1</code>
# Confirm your settings work by doing the following:
#* <code>ifconfig</code>
#* <code>route -n</code>
#* <code>ping</code> your other VM's and fedora host.
#* <code>ssh</code> to your matrix account to test DNS
# Restart the <code>fedora3</code> VM
# Login and test your configuration again. What happened?
# While we can configure network settings from the command line those settings are not persistent. To configure persistent network configurations we need to edit the configuration files:
#* Change to the <code>/etc/sysconfig/network-scripts</code> directory on <code>fedora3</code>
#* List the contents of the directory and you should see 2 different types of files, network config scripts and network configuration files.
#* look for the config file for your original interface, it should be named <code>ifcfg-eth0</code>
#* Copy that file to <code>ifcfg-eth<b>N</b></code> where <b>N</b> relates to your current eth interface number (we will use <b>eth1</b> as an example).
#* Edit the new file for you interface and give it the following settings:
#**DEVICE="eth1" <-- '''or the interface name YOU have '''
#**IPADDR="192.168.235.13"
#**NETMASK="255.255.255.0"
#**GATEWAY="192.168.235.1"
#**HWADDR="52:54:00:3f:5c:fa" <-- '''use the HWADDR for YOUR interface
#**DNS1="192.168.235.1" '''
#**BOOTPROTO="static"
#**ONBOOT="yes"
#**NM_CONTROLLED="yes"
#**IPV6INIT="no"
# Save the file and then restart the network connection by issuing the commands: <code>ifdown eth1</code> and then <code>ifup eth1</code><br /><br ><b>NOTE: </b>If there are errors, check that the hardware address in the config file matches the hardware address of the device its configuring<br /><br />
# Verify your configuration as you did before.
# Finally the kickstart file used to install this VM did not set the hostname. Edit the file <code>/etc/sysconfig/network</code> and set the hostname to <code>fedora3</code>
# Restart the <code>fedora3</code> VM.
# Login and attempt to <code>ssh</code> to your matrix account to verify the settings.
'''Answer the Investigation 4 observations / questions in your lab log book.'''
=== Investigation 5: How do I setup local hostname resolution? ===
{{Admon/note | Use each machine | Complete this investigation on all of your VM's and the Fedora host.}}
{{Admon/note | Hosts files vs. the Domain Name System | On large public networks like the Internet or even large private networks we use a network service called [http://en.wikipedia.org/wiki/Domain_Name_System Domain Name System (DNS)] to resolve the human friendly hostnames like '''fedoraproject.org''' to the numeric addresses used by the IP protocol. On smaller networks we can use the <code>/etc/hosts</code> on each system to resolve names to addresses.}}
# Use the <code>hostname</code> and <code>ifconfig</code> commands on your fedora host and all 3 VM's to gather the information needed to configure the <code>/etc/hosts</code> file on the fedora host and the 3 VM's.
# Edit the <code>/etc/hosts</code> file on <u>each</u> of the '''virtual machines and the fedora host'''. Refer to the table below for information to enter in the <code>/etc/hosts</code> file.
{|class="collapsible" style="background: #c0c0c0" width="50%"
!Sample /etc/hosts file
|-
|
<pre>
# hostname fedora1 added to /etc/hosts by anaconda
127.0.0.1 localhost.localdomain localhost fedora1
::1 localhost6.localdomain6 localhost6 fedora1
192.168.235.1 f17host
192.168.235.11 fedora1
192.168.235.12 fedora2
192.168.235.13 fedora3
</pre>
|}
<ol>
<li value="3">Confirm that each host can ping all three of the other hosts by name.</li>
</ol>
'''Answer the Investigation 5 observations / questions in your lab log book.'''
== Obtaining MAC Address / Service Port / Firewall Information ==
=== Investigation 6: How do I collect the MAC (Hardware) addresses of computers on my network? ===
{{Admon/note | Use your Fedora Host | Complete this investigation on your Fedora host.}}
{{Admon/note | Obtaining Remote MAC Addresses| The term '''MAC''' address stands for '''Media Access Control''' address, which provides a unique ID to prevent confusion among computer systems within a network. While we use '''32bit IP addresse'''s to communicate over an internetwork, on the local ethernet network packets are delivered to a '''48bit hardware address''' (sometimes called a MAC address). The '''ARP''' protocol resolves 32bit IP addresses to 48bit MAC addresses by using a broadcast and caching the results. We can examine the ARP cache to get the MAC addresses of other computers on our local network.<br /><br />Being able to determine remote MAC address information is useful from troubleshooting networking programs to using '''WOL''' (Wake up on Lan) to automatically boot remote workstations via the network. In this investigation, you will learn how to obtain MAC address information for various network cards.}}
# On the fedora host <code>ping</code> each of your VM's
# Examine the contents of the ARP cache by using the command <code>arp</code>
# Check the contents of the cache again by using the command <code>arp -n</code>
# What was the difference in output?
'''Answer the Investigation 6 observations / questions in your lab log book.'''
=== Investigation 7: How can I see what network services or ports are active on my Fedora system? ===
{{Admon/note | Use All Machines | Complete this investigation on all of your VM's and the Fedora host.}}
{{Admon/note | Network Ports | When our Fedora system provides any services on a network, those services are accessible through a port number. All network services are configured to be accessed on a particular port number. By examining which ports are active on our system we can know what services (and points of attack) are available on our system. The ability to examine this information is important for troubleshooting network services and securing our systems. One great tool for this is the <code>netstat</code> command.}}
# On your fedora host execute the command: <code>netstat -at</code>
# This command will list all active TCP ports. Note the state of your ports.
# TCP is a connection oriented protocol that uses a handshaking mechanism to establish a connection. Those ports that show a state of LISTEN are waiting for connection requests to a particular service. For example you should see the <code>ssh</code> service in a LISTEN state as it is waiting for connections.
# From one of your VM's login to your host using <code>ssh</code>
# On the fedora host rerun the command and in addition to the LISTEN port it should list a 2nd entry with a state of ESTABLISHED. This shows that there is a current connection to your ssh server.
# Exit your ssh connection from the VM and rerun the command on the fedora host. Instead of ESTABLISHED it should now show a state of CLOSE_WAIT. Indicating that the TCP connection is being closed.
# On your fedora host try the command <code>netstat -atn</code>. How is this output different?
# Without the <code>-n</code> option <code>netstat</code> attempts to resolve IP addresses to host names (using /etc/hosts) and port numbers to service names (using /etc/services)
# Examine the <code>/etc/services</code> file and find which ports are used for the services: <code>ssh, ftp, http</code>
# Now execute the command <code>netstat -au</code> What is the difference between <code>-at</code> and <code>-au</code>?
# When examining UDP ports why is there no state?
# Using the <code>netstat</code> man page and experimentation make sure you understand how the following options work.
#* -at
#* -au
#* -atp
#* -aup
#* -atn
#* -aun
#* -autnp
'''Answer the Investigation 7 observations / questions in your lab log book.'''
=== Investigation 8: How do I view and configure the IPTABLES firewall? -- Basic Function/Configuration ===
{{Admon/note | Use the f17host | Complete the following steps on your '''f17host''' computer system.}}
{{Admon/note | | [http://en.wikipedia.org/wiki/Iptables Iptables] is the built-in firewall for LINUX. While this program can be controlled by different GUI's, we are going to investigate the powerful command line interface for this program to choose what data is allowed into, out of and through our computer.
Essentially, Iptables is a list of rules. Each rule is placed into a particular chain and when data is sent into, out of or through a PC the data is checked against these rules. If the data matches a particular rule, it then must “jump” to a condition. Simple conditions include ACCEPT, DROP and LOG but there are also more complex conditions that can be applied and there is even the option to create your own conditions.
Iptables consists of multiple tables, each containing one or more chains of rules. For firewall purposes, the FILTER table is important; it contains these three chains: – INPUT, OUTPUT and FORWARD. Here as brief explanation of these chains.
'''OUTPUT''' – When you want to do some research on the Web for something, you open a browser on your PC and navigate to http://www.google.ca. When you do you are attempting to establish an HTTP or HTTPS session with the web server at http://www.google.ca. A data packet is built with appropriate IP and TCP information and sent out of your computer but before it goes out to the Internet it will be compared to all of the rules in the OUTPUT chain to see if this data is allowed to go “out” of the PC. If it is not allowed then the packet is dropped.
'''INPUT''' – If your data was allowed out and a request was sent to http://www.google.ca, this web server will send data back to your PC with an acknowledgement. Before this data can be processed by your browser, it must first be checked against the INPUT chain to see if it is allowed into the PC. If it is, your browser will process the data and move to it's next task. If it is not, the packet will be dropped.
'''FORWARD''' – LINUX PC's are often used as routers or gateways for other PC's. This means that data may have to be passed through this LINUX box, but the data is not intended for the LINUX PC nor is it being sent by the LINUX PC. Even though the data will go into this PC and it will exit this PC, the INPUT and OUTPUT chains do not apply here. Because the PC is acting as a router it does not actually send or receive data, it FORWARDS data from one machine to another. When this process happens, the data is checked against the FORWARD chain to see if it is allowed through. If it is the router will forward the data to it's destination. If not, the packet is dropped.}}
{{Admon/important | Non-Persistent Changes to your Host System | Complete this lab on your host system (f16host).
It should be noted that all of the commands that we do here with iptables will not be persistent unless you have your configuration. That means if you re-boot, the default iptables configuration will be loaded.}}
# As root on the fedora host enter the following commands at the prompt:
#* <code>iptables -F</code> (This flushes out or clears all of your rules from the chains)
#* <code>iptables -L</code>
# You should see something similar to this:<br /><br />Chain INPUT (policy ACCEPT)<br /><br />target prot opt source destination<br /><br />Chain FORWARD (policy ACCEPT)<br /><br />target prot opt source destination<br /><br />Chain OUTPUT (policy ACCEPT)<br /><br />target prot opt source destination<br /><br />
# Set the default policy for the INPUT chain to DROP:
#* <code>iptables -P INPUT DROP</code>
# Now try on your own to change the default policies for the OUPUT and FORWARD chains to DROP
# Write the commands you executed in your lab book.
# Can we mix these policies? Try to set the FORWARD chain policy to ACCEPT. Did it work?
{{Admon/note | Chain Policies | Each chain has a default policy. In my example here the default policy is ACCEPT. This means that if data packets are checked and there is no rule that matches that packet in the chain the data will be allowed to pass to it's destination. Conversely, if the policy is set to DROP then the packet will be dropped if there is no match. Flushing the table (<code>iptables -F</code>) when an ACCEPT policy is in place will cause all packets to be accepted; flushing the table when an DENY policy is in place will cause all packets to be dropped.}}
==== Testing policies ====
# Execute the command <code>iptables -L</code> and check that the policies on your INPUT and OUTPUT chain are set to DROP
# Open a browser and attempt to access the Internet. Were you successful?
# Using the commands you have learned so far, change the policies on the INPUT and OUTPUT chains to ACCEPT
# Open your browser and attempt to access the Internet again. Were you successful?
# Change the policies on all of the chains to DROP
# In the OUTPUT chain, add the following rule:
#* <code>iptables -A OUTPUT -j LOG</code>
# The above rule tells <code>iptables</code> to log packets and relevant information to <code>/var/log/messages</code>.
# This entry in the OUTPUT policy will therefore log all packets being sent out of the machine.
# Try to access the Internet again. Because the policies have been set to DROP, you should be unsuccessful. However, every packet of data that your PC attempted to send out was logged. Let's have a look at the log file and analyze the data.
#* <code>tail /var/log/messages</code>
# This command shows us the last 10 lines of the file. While there are many things being logged to this file, the last thing we did was try to access the Internet so we should be able to see the data we need. Look for a line that looks similar to the following:<br /><br /><blockquote><code>Mar 3 09:21:03 koala-laptop kernel: [90775.407304] IN= OUT=wlan0 SRC=192.168.1.107 DST=66.249.90.104 LEN=1470 TOS=0x00 PREC=0x00 TTL=64 ID=19752 DF PROTO=TCP SPT=45431 DPT=80 WINDOW=108 RES=0x00 ACK PSH URGP=0</code></blockquote>
# Your IP, host names and date will be different, but the one thing that should be the same is the DPT=80 value.
# When your computer tried to send OUT a request to connect to the Internet using the WWW, the computer used a destination port of 80. This is the standard port for the WWW. Because we have set the default policy to DROP it drops these packets. The problem is we are dropping all packets. What if we just want to drop the WWW packets?
# Using the commands we already know, change the default policies on all of your chains to ACCEPT.
# Open a browser and confirm that you can access the world wide web.
# Enter the command:
#* <code>iptables -I OUTPUT -p tcp -s0/0 -d 0/0 --dport 80 -j DROP</code>
# Try to access the Web. If you have done everything right, you should not have been successful.
# After you have completed the test execute the following command:
#* <code>iptables -F</code>
{{Admon/note| Interpreting iptables commands |Here is the command you just used:
iptables -I OUTPUT -p tcp -s0/0 -d 0/0 --dport 80 -j DROP
Which can be read like this: Insert a rule into the iptables OUTPUT chain that will match any tcp packet, with any a source address, any destination address, and a deistination port of 80. Any packet that matches will be dropped.
Let's break down the command to see how it works.
The '''-I''' switch tells iptables to INSERT this line into the OUTPUT policy. This means it will be the first line in the policy. If we used a -A switch it would have appended the line and it would be the last line of the policy. If you are writing complex iptables rules where multiple matches can occur, it is important that the lines go in the right order. If you follow the -I with a number, the new rule will be inserted at that location in the chain (for example, <code>-I 3 OUTPUT</code> will insert the rule into the 3rd position in the OUTPUT chain, moving the existing rules down as necessary (the old rule #3 will become the new rule #4, for example).
The '''-p tcp''' switch tells iptables to only match TCP packets. Alternately, the protocol could be set to udp, icmp, or all.
The '''-s0/0''' switch specifies the source IP address. 0/0 means a source address of “anywhere.” this has been put into the lab because your ip address will change because it is dynamically assigned. You can change this value if you want to the IP address that has been specifically assigned to your PC.
The '''-d0/0''' switch specifies the destination address. It makes sense that this address is set to “anywhere” because if we want to block all requests to the WWW, we will never know the specific IP address of web server that is trying to be accessed.
The switch '''--dport 80''' tells iptables to look at the destination port in the packet and see if it is equal to 80. Alternately, you can filter based on source addresses using the <code>--sport</code> switch.
'''-j''' means jump to a particular target – Basic targets are ACCEPT, DROP, REJECT, and LOG. The available targets depend on which table contains the chain.
'''DROP''' means drop the packet – make it disappear - and do not continue processing rules. '''REJECT''' is similar, but causes an error packet to be sent back to the source host. '''ACCEPT''' causes the packet to be processed. '''LOG''' causes an entry to be made in the system logs showing that the packet was processed. Note that the LOG target is the only one that does not stop rule-checking in the chain - so you can log a packet with one rule, and then use a later rule in the chain to DROP, REJECT, or ACCEPT it.
}}
{{Admon/note|0/0 Addresses|Source and destination addresses of 0/0 will match all addresses. Therefore, they '''don't do anything''' and can be removed:
iptables -I OUTPUT -p tcp -s0/0 -d 0/0 --dport 80 -j DROP
is equivalent to:
iptables -I OUTPUT -p tcp --dport 80 -j DROP
}}
==== Final Tasks ====
# Using the information you have learned, try on your own to achieve the same goal as above (block www access to your computer) by using the INPUT chain instead of the OUTPUT chain.
# After you have completed this task, flush the iptables again.
# Make sure that your ssh server is running on the host machine and try to access it from a virtual machine of your choice.
# Once you have confirmed that ssh is running on the host machine, insert an iptables rule on the host machine to prevent access to the ssh server from all VM's on the virtual network.
# Confirm that your rule works by testing from your VM's
# Does iptables close the port? Check using <code>netstat</code>
# Now insert a rule on the fedora host that would ACCEPT connections from the fedora2 VM only.
# Fully test your configuration.
{{Admon/note | iptables Service |When your iptables service starts or at boot time it has to load the rules from the file <code>/etc/sysconfig/iptables</code>.}}
<ol>
<li value="9">'''Make a backup of the file <code>/etc/sysconfig/iptables</code>'''</li>
<li>Examine the file to see how rules are added.</li>
<li>Issue the command: <code>iptables-save > /etc/sysconfig/iptables</code> to save the rules you added with the iptables command, above.</li>
<li>Verify that the file <code>/etc/sysconfig/iptables</code> was updated with your new rules.</li>
<li>Restart your iptables service and test your configuration. </li>
<li>Write a short bash script to add a rule allowing the fedora1 and fedora3 VM's to connect to <code>ssh</code> on the fedora host.</li>
</ol>
'''Answer the Investigation 8 observations / questions in your lab log book.'''
== New Configuration ==
Now you should have the following network configuration:<br /><br />
[[Image:network-config2.png]]
* '''Fedora host''' has 1 active network interface (probably <code>'''em1'''</code>)that receives IP configuration from the School's DHCP server.
* '''Fedora host''' has 1 active network interface (<code>'''virbr1'''</code>) that has a static default configuration of '''192.168.235.1/255.255.255.0'''
* '''Fedora1''' VM has 1 active interface (<code>'''eth1'''</code>) that has a static configuration of '''192.168.235.11/255.255.255.0'''
* '''Fedora2''' VM has 1 active interface (<code>'''eth1'''</code>) that has a static configuration of '''192.168.235.12/255.255.255.0'''
* '''Fedora3''' VM has 1 active interface (<code>'''eth1'''</code>) that has a static configuration of '''192.168.235.13/255.255.255.0'''
== Completing the lab ==
{{Admon/important|Time for a new backup!|If you have successfully completed this lab, make a new backup of your virtual machines.}}
Arrange proof of the following on the screen:
# A list of your <code>iptables</code> rules.
# The contents of your <code>arp</code> cache.
# <code>ssh</code> from fedora2 to fedora host.
# <code>ifconfig</code> from all 3 VM's
# Contents of <code>/tmp/lab6</code> directory.
# Fresh backup of the virtual machines.
== Preparing for Quizzes ==
# What is a port?
# What command will set your IP configuration to 192.168.55.22/255.255.255.0 ?
# What file contains the systems <code>iptables</code> rules?
# What is the difference between UDP and TCP?
# What port number is used for DHCP servers?
# What is the function of the file <code>/etc/services</code> ?
# What is the function of the file <code>/etc/hosts</code> ?
# What is the purpose of the file <code>/etc/sysconfig/network-scripts/ifcfg-eth0</code> ?
# What tool is used to show you a list of current TCP connections?
{{Admon/caution|Draft Lab|This lab has NOT been released for regular distribution. When the lab is ready to be released, this caution banner will disappear.}}
= Configuring a Network Using Virtual Machines =
==Overview==
* In this lab, you will learn the basics of networking by using your Virtual Machines and your f17host machine.
* In addition, you will learn to associate network services with port numbers, and learn how to backup files by date/time.
== Objectives ==
# Configure a virtual network for Virtual Machines
# Use the Fedora GUI program to configure network interfaces with static IP configuration and host name resolution
# Use the <code>find</code> command to locate the configuration files modified by the GUI network configuration program
# To examine some of the Linux's TCP/IP configuration files in the <code>/etc/</code> directory
# To configure a Fedora host with static network configuration without a GUI tool
# To configure the linux firewall <code>iptables</code> to allow/disallow/forward different types of network traffic using simple rules
==Required Materials (Bring to All Labs)==
* Fedora 17 LIVE CD
* Fedora 17 x86_64 Installation DVD
* SATA Hard Disk (in removable disk tray)
* USB Memory Stick
* Lab Logbook
==Prerequisites==
* Completion and Instructor "Sign-off" of Lab 5: [[OPS235 Lab 5]]
==Linux Command Online Reference==
Each Link below displays online manpages for each command (via [http://linuxmanpages.com/ http://linuxmanpages.com]):
{|width="100%" cellpadding="5" width="50%"
|'''Networking Utilities:'''
|'''Additional Utilities:'''
|
|- valign="top"
|
*[http://linuxmanpages.com/man8/ifconfig.8.php ifconfig]
*[http://fedoramobile.org/Members/MrHappy/system-config-network system-config-network]
*[http://linuxmanpages.com/man8/route.8.php route]
*[http://linuxmanpages.com/man8/ping.8.php ping]
*[http://linuxmanpages.com/man8/arp.8.php arp]
*[http://linuxmanpages.com/man8/netstat.8.php netstat]
*[http://linuxmanpages.com/man8/iptables.8.php iptables]
|
*[http://www.linuxcertif.com/man/1/systemctl/ systemctl]
*[http://linuxmanpages.com/man1/find.1.php find]
*[http://linuxmanpages.com/man1/tail.1.php tail]
*[http://linuxmanpages.com/man1/cp.1.php cp]
|}
==Resources on the web==
Additional links to tutorials and HOWTOs:
* [http://en.wikipedia.org/wiki/Virtual_network Virtual Network - Definition]
* [http://www.reallylinux.com/docs/networkingadmin.shtml Important Linux Networking Commands] (Also refer to lab 6 notes)
* [http://www.yolinux.com/TUTORIALS/LinuxTutorialNetworking.html Linux Network Configuration]
* [[IPTables]] Reference
* Lab6 Notes: [http://zenit.senecac.on.ca/wiki/index.php/OPS235_Lab_6#Investigation_8:_How_do_I_view_and_configure_the_IPTABLES_firewall.3F_--_Basic_Function.2FConfiguration IPTABLES Firewall]
== Current Configuration ==
Currently you should have the following network configuration:<br /><br />[[Image:network-config1.png]]
* '''Fedora host''' has 1 active network interface (probably <code>'''em1'''</code>) that receives IP configuration from the School's DHCP server.
* '''Fedora host''' has 1 active network interface (<code>'''virbr0'''</code>) that has a static default configuration of '''192.168.122.1/255.255.255.0'''
* '''Fedora1 VM''' has 1 active interface (<code>'''eth0'''</code>) that receives a dynamic configuration from your Fedora Host
* '''Fedora2 VM''' has 1 active interface (<code>'''eth0'''</code>) that receives a dynamic configuration from your Fedora Host
* '''Fedora3 VM''' has 1 active interface (<code>'''eth0'''</code>) that receives a dynamic configuration from your Fedora Host
== Lab Preparation ==
{{Admon/important | Live disc installations and system-config-network | The '''fedora1''' VM was installed from Live CD. It is missing the GUI Network Configuration tool we will be using. Use the command <code>yum install system-config-network</code> to install it.}}
{{Admon/important | Backup your VMs before proceeding | Stop all of your VMs and backup your VM disk images. Do not start the VMs until told to start them.}}
== Configuring a Network Using Virtual Machines ==
=== Investigation 1: How do you create a new virtual network. ===
{{Admon/note | Use the f17host | Complete the following steps on your '''f17host''' computer system.}}
Before configuring our network we want to turn off dynamic network configuration for our Virtual Machines by turning off the "default" virtual network.
# On your '''f17host''' machine start Virtual Machine Manager
# In the Virtual Machine Manager dialog box, Select '''Edit'''-> '''Connection Details'''.
# In the '''Hosts''' Details dialog box, select the '''Virtual Networks''' tab
# Disable the default configuration from starting at boot by '''deselecting''' '''"Autostart"''' (on boot) checkbox.
# Stop the default network configuration by clicking on the '''stop''' button at the bottom left-side of the dialog box.
# Click the '''add''' button (the button resembles a "plus sign") to add a new network configuration.
# Give your new network a name (i.e. '''network1''')
# Enter in the new network IP address space:
#*'''192.168.235.0/24'''
# Disable DHCP by '''deselecting''' the check box.
# Enable Network Forwarding by Selecting '''Forwarding to physical network'''
# The destination should be '''Any physical device''' and the mode should be '''NAT'''
# Proceed with changes, and select '''Finish'''.
# Before proceeding, check the "<u>default</u>" network connection (in the Virtual Networks section) to verify '''Autostart''' is disabled, and that you have created the '''network1''' configuration. You might be required to click Apply when the default '''Autostart''' option is deselected. If you have any problems launching your VMs, then it is recommend to reboot your main system.
# '''Close''' the Virtual Manager, '''reboot''' your f16host, '''log-back into your f16host computer''', and '''restart''' the Virtual Machine Manager.
{{Admon/note | Repeat these steps for each VM | Complete the following steps on <u>each</u> of your virtual machines.}}
<ol>
<li value="15">Now we need to add our new virtual network '''network1''' to the 3 VM's
<ol type="a" style="margin-left:2cm">
<li value="1">Select the '''fedora1''' VM and edit the '''Virtual Machine Details'''<br />(Note: the Virtual Machine window will appear - do not start virtual machine)</li>
<li>Under View select '''Details'''</li>
<li>In the '''left pane''' of the Virtual Machine window, select '''NIC:''' and note that this NIC is on the "default" virtual network</li>
<li>Click on the '''Remove''' button at the bottom right-side of the dialog box.</li>
<li>Click on '''Add Hardware''' on the bottom left-side of the dialog box and add a new network</li>
<li>For the host device, locate and select '''Virtual Network network1''' : NAT</li>
<li>Click finish to exit the Virtual Machine Details dialog box.</li>
</ol>
</li>
<li value="16">Repeat steps '''a - g''' for '''fedora2''' and '''fedora3''' VM's.</li>
</ol>
'''Answer the Investigation 1 observations / questions in your lab log book.'''
=== Investigation 2: How do you configure a static network using <code>system-config-network</code>. ===
{{Admon/note | Use fedora2 | Complete this investigation on your fedora2 VM.}}
# Start '''fedora2''' VM and login
# On your '''fedora host''' run <code>ifconfig</code> and make note of the IP address assigned to the <code>virbr1</code> interface. This will be your default gateway for your Vm's.[[Image:new_network_dialog.png|thumb|350px]]
# Make certain to return to your fedora2 VM.
# To configure a new interface on fedora2 go to '''Applications'''->'''Other'''->'''Network Connections'''.
# Make certain there are no '''"Wired"''' connections (even if you have to click on the connection name and click the '''Delete''' button.
# Create a new wired connection, with the "Connection Name" at the top to read '''eth1'''
# Click on the '''Add''' button, and select the '''IPv4 Settings''' tab.
# Change the method from "Automatic (DHCP)" to '''"Manual"'''.
# In the '''Addresses section''', click '''"Add"'''.
# Manually set the IP configuration to:
#: IP Address '''192.168.235.12'''
#: Subnet Mask '''255.255.255.0'''
#: Default Gateway '''192.168.235.1''' (The IP address of <code>virbr1</code> on your fedora host.)
# Click on the '''DNS''' field and add '''192.168.235.1''' as the primary DNS server.
# Click '''Save''' to Finish, and exit the Network Connections dialog box.
# Your network connection may connect (view the Network Manager applet in the gnome panel at the top of the screen). If there is no connection after a few minutes, you should be able to right-click on the applet and click "eth1" to connect.
# You should be able to use the systemctl command to restart your network.
#'''Restart your network''' on fedora2 by issuing the commands:
#*<code>systemctl stop NetworkManager.service</code>
#*<code>systemctl start NetworkManager.service</code>
# Verify your new interface by examining the output of <code>ifconfig</code>
# To verify that fedora2 has the correct default gateway configured, enter the command: <code>route -n</code>
# Verify the network by using: <code>ping 192.168.235.1</code>
'''Answer the Investigation 2 observations / questions in your lab log book.'''
=== Investigation 3: What files does the <code>system-config-network</code> GUI tool change?. ===
{{Admon/note | Use fedora1 | Complete this investigation on your fedora1 VM.}}
{{Admon/note | Backing up Files |One very important aspect of system admin is performing backups. There are many methods for backing up the data on a a computer system.<br />The following is an example of a common backup system used in Business Unix/Linux systems:<br /><br />'''Full Backup''': Backup all specified files (eg. configuration, data files, etc)<br />'''Incremental Backup''': Backup of only files that have changed since last (full) backup<br /><br />When the system is required to be fully restored, then the '''full backup''' is recovered, followed by each .<br />In this investigation, you will learn how to perform an '''incremental backup''' using the <code>find</code> utility|}}
# Start '''fedora1''' VM and login
# Before we configure fedora1 we should create a timestamp file that can be used to see which files have changed as a result of using the GUI tool.
#* <code>date > /tmp/timestamp</code>
# Run the network configuration tool and enter the following static configuration in the same way that you configured '''fedora2'''.
#* IP Address: '''192.168.235.11'''
#* Subnetmask: '''255.255.255.0'''
#* Default Gateway: '''192.168.235.1'''
#* DNS Server: '''192.168.235.1'''
# Save and exit the network configuration tool.
# Restart the NetworkManager service.
# Verify the configuration by pinging fedora host ('''192.168.235.1''') and fedora2 ('''192.168.235.12''')
# To verify that fedora1 has the correct default gateway configured, enter the command <code>route -n</code>
{{Admon/note | Creating an Incremental Backup |
We will now be using the <code>find</code> command to:
:*Locate the configuration files (contained in the <code>/etc</code> directory) that were modified by the GUI network configuration program
:*Copy those configuration files to a "specified" directory for backup purposes
Previously, you created a file called <code>/tmp/timestamp</code> that just contains the current date and time prior to running the network configuration toool for fedora2.. Any files that were modified by the GUI network configuration program should have a timestamp later (or newer) than the "timestamp" file you created. All the Linux TCP/IP configuration files are stored under the '''/etc''' directory or its sub-directories. The <code>find</code> command (using the correct options) can be used to only list those files that have been recently created since the timestamp date contained in the <code>/tmp/timestamp</code> file.|}}
<ol>
<li value="8">Run the following Linux command:
<ul>
<li><code>find /etc -newer /tmp/timestamp > /root/netcfg.lst</code></li>
</ul>
</li>
<li>View the <code>/root/netcfg.lst</code> file. What does it contain?</li>
<li>Create a new directory called: <code>/tmp/lab6</code></li>
<li>Issue the following commands:
<ul>
<li><code>mkdir -p /tmp/lab6</code></li>
<li><code>find /etc -newer /tmp/timestamp -exec cp {} /tmp/lab6 \;</code></li>
</ul>
</li>
<li>View the contents of the <code>/tmp/lab6</code> directory. What does it contain?</li>
</ol>
{{Admon/tip | Tip | Just for interest, it is relatively simple to automate your backups. You just create a Bash Shell script file using the <code>find</code> command above, give the shell script executable permissions, and use the <code>crontab</code> command to schedule when this script is to be run. If you want to learn more about shell scripting, you can take or refer to the course called '''OPS435''' .}}
'''Answer the Investigation 3 observations / questions in your lab log book.'''
=== Investigation 4: How do I configure the network without a GUI tool? ===
{{Admon/note | Use fedora3 | Complete this investigation on your fedora3 VM.}}
# Start '''fedora3''' VM and login as root
# Use the command <code>ifconfig</code> to list active interfaces, you should see one with a name of <code>eth0</code> or a similar name.
# To configure your card with a static address use the following command:
#* <code>ifconfig eth0 192.168.235.13 netmask 255.255.255.0</code>
# To configure a default gateway for that interface enter the command:
#* <code>route add default gw 192.168.235.1</code>
# To configure your DNS server edit the file <code>/etc/resolv.conf</code>. Change the <code>nameserver</code> line to be:
#* <code>nameserver 192.168.235.1</code>
# Confirm your settings work by doing the following:
#* <code>ifconfig</code>
#* <code>route -n</code>
#* <code>ping</code> your other VM's and fedora host.
#* <code>ssh</code> to your matrix account to test DNS
# Restart the <code>fedora3</code> VM
# Login and test your configuration again. What happened?
# While we can configure network settings from the command line those settings are not persistent. To configure persistent network configurations we need to edit the configuration files:
#* Change to the <code>/etc/sysconfig/network-scripts</code> directory on <code>fedora3</code>
#* List the contents of the directory and you should see 2 different types of files, network config scripts and network configuration files.
#* look for the config file for your original interface, it should be named <code>ifcfg-eth0</code>
#* Copy that file to <code>ifcfg-eth<b>N</b></code> where <b>N</b> relates to your current eth interface number (we will use <b>eth1</b> as an example).
#* Edit the new file for you interface and give it the following settings:
#**DEVICE="eth1" <-- '''or the interface name YOU have '''
#**IPADDR="192.168.235.13"
#**NETMASK="255.255.255.0"
#**GATEWAY="192.168.235.1"
#**HWADDR="52:54:00:3f:5c:fa" <-- '''use the HWADDR for YOUR interface
#**DNS1="192.168.235.1" '''
#**BOOTPROTO="static"
#**ONBOOT="yes"
#**NM_CONTROLLED="yes"
#**IPV6INIT="no"
# Save the file and then restart the network connection by issuing the commands: <code>ifdown eth1</code> and then <code>ifup eth1</code><br /><br ><b>NOTE: </b>If there are errors, check that the hardware address in the config file matches the hardware address of the device its configuring<br /><br />
# Verify your configuration as you did before.
# Finally the kickstart file used to install this VM did not set the hostname. Edit the file <code>/etc/sysconfig/network</code> and set the hostname to <code>fedora3</code>
# Restart the <code>fedora3</code> VM.
# Login and attempt to <code>ssh</code> to your matrix account to verify the settings.
'''Answer the Investigation 4 observations / questions in your lab log book.'''
=== Investigation 5: How do I setup local hostname resolution? ===
{{Admon/note | Use each machine | Complete this investigation on all of your VM's and the Fedora host.}}
{{Admon/note | Hosts files vs. the Domain Name System | On large public networks like the Internet or even large private networks we use a network service called [http://en.wikipedia.org/wiki/Domain_Name_System Domain Name System (DNS)] to resolve the human friendly hostnames like '''fedoraproject.org''' to the numeric addresses used by the IP protocol. On smaller networks we can use the <code>/etc/hosts</code> on each system to resolve names to addresses.}}
# Use the <code>hostname</code> and <code>ifconfig</code> commands on your fedora host and all 3 VM's to gather the information needed to configure the <code>/etc/hosts</code> file on the fedora host and the 3 VM's.
# Edit the <code>/etc/hosts</code> file on <u>each</u> of the '''virtual machines and the fedora host'''. Refer to the table below for information to enter in the <code>/etc/hosts</code> file.
{|class="collapsible" style="background: #c0c0c0" width="50%"
!Sample /etc/hosts file
|-
|
<pre>
# hostname fedora1 added to /etc/hosts by anaconda
127.0.0.1 localhost.localdomain localhost fedora1
::1 localhost6.localdomain6 localhost6 fedora1
192.168.235.1 f17host
192.168.235.11 fedora1
192.168.235.12 fedora2
192.168.235.13 fedora3
</pre>
|}
<ol>
<li value="3">Confirm that each host can ping all three of the other hosts by name.</li>
</ol>
'''Answer the Investigation 5 observations / questions in your lab log book.'''
== Obtaining MAC Address / Service Port / Firewall Information ==
=== Investigation 6: How do I collect the MAC (Hardware) addresses of computers on my network? ===
{{Admon/note | Use your Fedora Host | Complete this investigation on your Fedora host.}}
{{Admon/note | Obtaining Remote MAC Addresses| The term '''MAC''' address stands for '''Media Access Control''' address, which provides a unique ID to prevent confusion among computer systems within a network. While we use '''32bit IP addresse'''s to communicate over an internetwork, on the local ethernet network packets are delivered to a '''48bit hardware address''' (sometimes called a MAC address). The '''ARP''' protocol resolves 32bit IP addresses to 48bit MAC addresses by using a broadcast and caching the results. We can examine the ARP cache to get the MAC addresses of other computers on our local network.<br /><br />Being able to determine remote MAC address information is useful from troubleshooting networking programs to using '''WOL''' (Wake up on Lan) to automatically boot remote workstations via the network. In this investigation, you will learn how to obtain MAC address information for various network cards.}}
# On the fedora host <code>ping</code> each of your VM's
# Examine the contents of the ARP cache by using the command <code>arp</code>
# Check the contents of the cache again by using the command <code>arp -n</code>
# What was the difference in output?
'''Answer the Investigation 6 observations / questions in your lab log book.'''
=== Investigation 7: How can I see what network services or ports are active on my Fedora system? ===
{{Admon/note | Use All Machines | Complete this investigation on all of your VM's and the Fedora host.}}
{{Admon/note | Network Ports | When our Fedora system provides any services on a network, those services are accessible through a port number. All network services are configured to be accessed on a particular port number. By examining which ports are active on our system we can know what services (and points of attack) are available on our system. The ability to examine this information is important for troubleshooting network services and securing our systems. One great tool for this is the <code>netstat</code> command.}}
# On your fedora host execute the command: <code>netstat -at</code>
# This command will list all active TCP ports. Note the state of your ports.
# TCP is a connection oriented protocol that uses a handshaking mechanism to establish a connection. Those ports that show a state of LISTEN are waiting for connection requests to a particular service. For example you should see the <code>ssh</code> service in a LISTEN state as it is waiting for connections.
# From one of your VM's login to your host using <code>ssh</code>
# On the fedora host rerun the command and in addition to the LISTEN port it should list a 2nd entry with a state of ESTABLISHED. This shows that there is a current connection to your ssh server.
# Exit your ssh connection from the VM and rerun the command on the fedora host. Instead of ESTABLISHED it should now show a state of CLOSE_WAIT. Indicating that the TCP connection is being closed.
# On your fedora host try the command <code>netstat -atn</code>. How is this output different?
# Without the <code>-n</code> option <code>netstat</code> attempts to resolve IP addresses to host names (using /etc/hosts) and port numbers to service names (using /etc/services)
# Examine the <code>/etc/services</code> file and find which ports are used for the services: <code>ssh, ftp, http</code>
# Now execute the command <code>netstat -au</code> What is the difference between <code>-at</code> and <code>-au</code>?
# When examining UDP ports why is there no state?
# Using the <code>netstat</code> man page and experimentation make sure you understand how the following options work.
#* -at
#* -au
#* -atp
#* -aup
#* -atn
#* -aun
#* -autnp
'''Answer the Investigation 7 observations / questions in your lab log book.'''
=== Investigation 8: How do I view and configure the IPTABLES firewall? -- Basic Function/Configuration ===
{{Admon/note | Use the f17host | Complete the following steps on your '''f17host''' computer system.}}
{{Admon/note | | [http://en.wikipedia.org/wiki/Iptables Iptables] is the built-in firewall for LINUX. While this program can be controlled by different GUI's, we are going to investigate the powerful command line interface for this program to choose what data is allowed into, out of and through our computer.
Essentially, Iptables is a list of rules. Each rule is placed into a particular chain and when data is sent into, out of or through a PC the data is checked against these rules. If the data matches a particular rule, it then must “jump” to a condition. Simple conditions include ACCEPT, DROP and LOG but there are also more complex conditions that can be applied and there is even the option to create your own conditions.
Iptables consists of multiple tables, each containing one or more chains of rules. For firewall purposes, the FILTER table is important; it contains these three chains: – INPUT, OUTPUT and FORWARD. Here as brief explanation of these chains.
'''OUTPUT''' – When you want to do some research on the Web for something, you open a browser on your PC and navigate to http://www.google.ca. When you do you are attempting to establish an HTTP or HTTPS session with the web server at http://www.google.ca. A data packet is built with appropriate IP and TCP information and sent out of your computer but before it goes out to the Internet it will be compared to all of the rules in the OUTPUT chain to see if this data is allowed to go “out” of the PC. If it is not allowed then the packet is dropped.
'''INPUT''' – If your data was allowed out and a request was sent to http://www.google.ca, this web server will send data back to your PC with an acknowledgement. Before this data can be processed by your browser, it must first be checked against the INPUT chain to see if it is allowed into the PC. If it is, your browser will process the data and move to it's next task. If it is not, the packet will be dropped.
'''FORWARD''' – LINUX PC's are often used as routers or gateways for other PC's. This means that data may have to be passed through this LINUX box, but the data is not intended for the LINUX PC nor is it being sent by the LINUX PC. Even though the data will go into this PC and it will exit this PC, the INPUT and OUTPUT chains do not apply here. Because the PC is acting as a router it does not actually send or receive data, it FORWARDS data from one machine to another. When this process happens, the data is checked against the FORWARD chain to see if it is allowed through. If it is the router will forward the data to it's destination. If not, the packet is dropped.}}
{{Admon/important | Non-Persistent Changes to your Host System | Complete this lab on your host system (f16host).
It should be noted that all of the commands that we do here with iptables will not be persistent unless you have your configuration. That means if you re-boot, the default iptables configuration will be loaded.}}
# As root on the fedora host enter the following commands at the prompt:
#* <code>iptables -F</code> (This flushes out or clears all of your rules from the chains)
#* <code>iptables -L</code>
# You should see something similar to this:<br /><br />Chain INPUT (policy ACCEPT)<br /><br />target prot opt source destination<br /><br />Chain FORWARD (policy ACCEPT)<br /><br />target prot opt source destination<br /><br />Chain OUTPUT (policy ACCEPT)<br /><br />target prot opt source destination<br /><br />
# Set the default policy for the INPUT chain to DROP:
#* <code>iptables -P INPUT DROP</code>
# Now try on your own to change the default policies for the OUPUT and FORWARD chains to DROP
# Write the commands you executed in your lab book.
# Can we mix these policies? Try to set the FORWARD chain policy to ACCEPT. Did it work?
{{Admon/note | Chain Policies | Each chain has a default policy. In my example here the default policy is ACCEPT. This means that if data packets are checked and there is no rule that matches that packet in the chain the data will be allowed to pass to it's destination. Conversely, if the policy is set to DROP then the packet will be dropped if there is no match. Flushing the table (<code>iptables -F</code>) when an ACCEPT policy is in place will cause all packets to be accepted; flushing the table when an DENY policy is in place will cause all packets to be dropped.}}
==== Testing policies ====
# Execute the command <code>iptables -L</code> and check that the policies on your INPUT and OUTPUT chain are set to DROP
# Open a browser and attempt to access the Internet. Were you successful?
# Using the commands you have learned so far, change the policies on the INPUT and OUTPUT chains to ACCEPT
# Open your browser and attempt to access the Internet again. Were you successful?
# Change the policies on all of the chains to DROP
# In the OUTPUT chain, add the following rule:
#* <code>iptables -A OUTPUT -j LOG</code>
# The above rule tells <code>iptables</code> to log packets and relevant information to <code>/var/log/messages</code>.
# This entry in the OUTPUT policy will therefore log all packets being sent out of the machine.
# Try to access the Internet again. Because the policies have been set to DROP, you should be unsuccessful. However, every packet of data that your PC attempted to send out was logged. Let's have a look at the log file and analyze the data.
#* <code>tail /var/log/messages</code>
# This command shows us the last 10 lines of the file. While there are many things being logged to this file, the last thing we did was try to access the Internet so we should be able to see the data we need. Look for a line that looks similar to the following:<br /><br /><blockquote><code>Mar 3 09:21:03 koala-laptop kernel: [90775.407304] IN= OUT=wlan0 SRC=192.168.1.107 DST=66.249.90.104 LEN=1470 TOS=0x00 PREC=0x00 TTL=64 ID=19752 DF PROTO=TCP SPT=45431 DPT=80 WINDOW=108 RES=0x00 ACK PSH URGP=0</code></blockquote>
# Your IP, host names and date will be different, but the one thing that should be the same is the DPT=80 value.
# When your computer tried to send OUT a request to connect to the Internet using the WWW, the computer used a destination port of 80. This is the standard port for the WWW. Because we have set the default policy to DROP it drops these packets. The problem is we are dropping all packets. What if we just want to drop the WWW packets?
# Using the commands we already know, change the default policies on all of your chains to ACCEPT.
# Open a browser and confirm that you can access the world wide web.
# Enter the command:
#* <code>iptables -I OUTPUT -p tcp -s0/0 -d 0/0 --dport 80 -j DROP</code>
# Try to access the Web. If you have done everything right, you should not have been successful.
# After you have completed the test execute the following command:
#* <code>iptables -F</code>
{{Admon/note| Interpreting iptables commands |Here is the command you just used:
iptables -I OUTPUT -p tcp -s0/0 -d 0/0 --dport 80 -j DROP
Which can be read like this: Insert a rule into the iptables OUTPUT chain that will match any tcp packet, with any a source address, any destination address, and a deistination port of 80. Any packet that matches will be dropped.
Let's break down the command to see how it works.
The '''-I''' switch tells iptables to INSERT this line into the OUTPUT policy. This means it will be the first line in the policy. If we used a -A switch it would have appended the line and it would be the last line of the policy. If you are writing complex iptables rules where multiple matches can occur, it is important that the lines go in the right order. If you follow the -I with a number, the new rule will be inserted at that location in the chain (for example, <code>-I 3 OUTPUT</code> will insert the rule into the 3rd position in the OUTPUT chain, moving the existing rules down as necessary (the old rule #3 will become the new rule #4, for example).
The '''-p tcp''' switch tells iptables to only match TCP packets. Alternately, the protocol could be set to udp, icmp, or all.
The '''-s0/0''' switch specifies the source IP address. 0/0 means a source address of “anywhere.” this has been put into the lab because your ip address will change because it is dynamically assigned. You can change this value if you want to the IP address that has been specifically assigned to your PC.
The '''-d0/0''' switch specifies the destination address. It makes sense that this address is set to “anywhere” because if we want to block all requests to the WWW, we will never know the specific IP address of web server that is trying to be accessed.
The switch '''--dport 80''' tells iptables to look at the destination port in the packet and see if it is equal to 80. Alternately, you can filter based on source addresses using the <code>--sport</code> switch.
'''-j''' means jump to a particular target – Basic targets are ACCEPT, DROP, REJECT, and LOG. The available targets depend on which table contains the chain.
'''DROP''' means drop the packet – make it disappear - and do not continue processing rules. '''REJECT''' is similar, but causes an error packet to be sent back to the source host. '''ACCEPT''' causes the packet to be processed. '''LOG''' causes an entry to be made in the system logs showing that the packet was processed. Note that the LOG target is the only one that does not stop rule-checking in the chain - so you can log a packet with one rule, and then use a later rule in the chain to DROP, REJECT, or ACCEPT it.
}}
{{Admon/note|0/0 Addresses|Source and destination addresses of 0/0 will match all addresses. Therefore, they '''don't do anything''' and can be removed:
iptables -I OUTPUT -p tcp -s0/0 -d 0/0 --dport 80 -j DROP
is equivalent to:
iptables -I OUTPUT -p tcp --dport 80 -j DROP
}}
==== Final Tasks ====
# Using the information you have learned, try on your own to achieve the same goal as above (block www access to your computer) by using the INPUT chain instead of the OUTPUT chain.
# After you have completed this task, flush the iptables again.
# Make sure that your ssh server is running on the host machine and try to access it from a virtual machine of your choice.
# Once you have confirmed that ssh is running on the host machine, insert an iptables rule on the host machine to prevent access to the ssh server from all VM's on the virtual network.
# Confirm that your rule works by testing from your VM's
# Does iptables close the port? Check using <code>netstat</code>
# Now insert a rule on the fedora host that would ACCEPT connections from the fedora2 VM only.
# Fully test your configuration.
{{Admon/note | iptables Service |When your iptables service starts or at boot time it has to load the rules from the file <code>/etc/sysconfig/iptables</code>.}}
<ol>
<li value="9">'''Make a backup of the file <code>/etc/sysconfig/iptables</code>'''</li>
<li>Examine the file to see how rules are added.</li>
<li>Issue the command: <code>iptables-save > /etc/sysconfig/iptables</code> to save the rules you added with the iptables command, above.</li>
<li>Verify that the file <code>/etc/sysconfig/iptables</code> was updated with your new rules.</li>
<li>Restart your iptables service and test your configuration. </li>
<li>Write a short bash script to add a rule allowing the fedora1 and fedora3 VM's to connect to <code>ssh</code> on the fedora host.</li>
</ol>
'''Answer the Investigation 8 observations / questions in your lab log book.'''
== New Configuration ==
Now you should have the following network configuration:<br /><br />
[[Image:network-config2.png]]
* '''Fedora host''' has 1 active network interface (probably <code>'''em1'''</code>)that receives IP configuration from the School's DHCP server.
* '''Fedora host''' has 1 active network interface (<code>'''virbr1'''</code>) that has a static default configuration of '''192.168.235.1/255.255.255.0'''
* '''Fedora1''' VM has 1 active interface (<code>'''eth1'''</code>) that has a static configuration of '''192.168.235.11/255.255.255.0'''
* '''Fedora2''' VM has 1 active interface (<code>'''eth1'''</code>) that has a static configuration of '''192.168.235.12/255.255.255.0'''
* '''Fedora3''' VM has 1 active interface (<code>'''eth1'''</code>) that has a static configuration of '''192.168.235.13/255.255.255.0'''
== Completing the lab ==
{{Admon/important|Time for a new backup!|If you have successfully completed this lab, make a new backup of your virtual machines.}}
Arrange proof of the following on the screen:
# A list of your <code>iptables</code> rules.
# The contents of your <code>arp</code> cache.
# <code>ssh</code> from fedora2 to fedora host.
# <code>ifconfig</code> from all 3 VM's
# Contents of <code>/tmp/lab6</code> directory.
# Fresh backup of the virtual machines.
== Preparing for Quizzes ==
# What is a port?
# What command will set your IP configuration to 192.168.55.22/255.255.255.0 ?
# What file contains the systems <code>iptables</code> rules?
# What is the difference between UDP and TCP?
# What port number is used for DHCP servers?
# What is the function of the file <code>/etc/services</code> ?
# What is the function of the file <code>/etc/hosts</code> ?
# What is the purpose of the file <code>/etc/sysconfig/network-scripts/ifcfg-eth0</code> ?
# What tool is used to show you a list of current TCP connections?
