Changes

OPS235 Lab 6 - CentOS7 - VMware

20 bytes added, 13:52, 25 May 2016

no edit summary

In this lab, you will learn the basics of networking by using your '''Virtual Machines''' and your '''~~c7host~~centos1''' machine. You will first set up a virtual private network among those machines. In addition, you will learn to set up '''network names''' (to associate with server's IP Addresses), '''associate network services with port numbers''' for troubleshooting purposes, and setup '''firewall policies''' via the '''iptables''' command.

Main Objectives

# Configure a private (virtual) network for your '''VMs''' and your '''~~c7host~~centos1''' machine

# Configure network interfaces for your Virtual Machines using both '''graphical''' and '''command-line''' utilities.

# Use '''local hostname resolution''' to resolve simple server names with their corresponding IP Addresses

=INVESTIGATION 1: CONFIGURING A VIRTUAL PRIVATE NETWORK=

For the remainder of this course, we will focus on networking involving our VMs and our ~~c7host~~ centos1 machine. This lab will focus on setting up a virtual private network ('''VPN'''), connecting our VMs and ~~c7host~~ centos1 machine to the VPN, and configuring our VPN to make more convenient to use, troubleshoot and protect. '''Lab 7''' will focus more on configuring SSH and making access to the VPN more secure. Finally, '''lab 8''' will focus on configuring the network for fixed workstations, mobile devices, or both at the same time.

There are several reasons for creating '''VPNs'''. The main reason is to '''safely connect servers together''' (i.e. to safely limit but allow share information among computer network users). This allows for a secure connection of computers yet controlling access to and monitoring (protecting) access to permitted users (discussed in more depth in lab7).

==Part 1: Configuring a Private Network (Via Virtual Machine Manager) ==

[[Image:network-config-centos.png|thumb|600px|right|This diagram shows the current network configuration of your '''~~c7host~~centos1''' machine in relation to your '''Virtual Machines'''. In this section, you will be learning to change the default network settings for both your '''~~c7host~~centos1''' machine and '''VMs''' to belong to a '''virtual network''' using fixed IP Addresses. ]]

If we are going to setup a private network, we must do 2 major operations: First, '''define a new private network in the Virtual Manager application'''; and second, '''configure each of our VMs to connect to this new private network'''. In Part 1, we will be perform the first operation. In parts 2, 3, and 4, we will be performing the second operation for all VMS (graphical and command-line).

# Perform this section in your '''~~c7host~~centos1''' machine. '''NOTE:''' Before configuring our network we want to '''turn off dynamic network configuration for our Virtual Machines''' by turning off the '''"default"''' virtual network. We will then define our virtual private network. Follow the steps in order to perform these operations.

# Make certain that '''ALL''' virtual machines are powered off.

# In the Virtual Machine Manager dialog box, Select '''Edit'''-> '''Connection Details'''.

# In the '''~~c7host~~ centos1 Connection Details''' dialog box, select the '''Virtual Networks''' tab

# Disable the default configuration from starting at boot by '''deselecting''' '''Autostart (on boot)''' check-box and click the '''Apply''' button.

# Then Stop the default network configuration by clicking on the '''stop''' button at the bottom left-side of the dialog box.

<li value="13">We will now reconfigure each of our VMs to use our new virtual network '''network1'''

<li value="1">Let's start with our '''~~centos1~~ centos2 VM'''. Double-click on your '''~~centos1~~centos2''' VM, but instead of running the VM, click on the '''view''' menu, and select: '''Details''' (Note: the Virtual Machine window will appear - do not start virtual machine)</li>

<li>In the '''left pane''' of the Virtual Machine window, select '''NIC:''' and note that this NIC is on the "default" virtual network</li>

<li>Change it to '''Virtual Network network1: NAT''' (i.e. the VPN that you just created) and click the '''Apply''' button.</li>

</ol>

</li>

<li>Repeat the same steps for your '''~~centos2~~centos3''' and '''~~centos3~~centos4''' VMs!</li>

</li>

</ol>

== Part 2: Configuring VM Network Setup Graphically ('''system-config-network''')==

For Parts 2 and 3 of this investigation, we will be using a graphical tool to connect our '''~~centos1~~centos2''' and '''~~centos2~~centos3''' VMs to our private network.

[[Image:new_network_dialog.png|right|thumb|250px|Although the private network has been setup via the '''Virtual Machine Manager''', each virtual machine requires to change its own network setting individually (either '''graphically''' or by '''command line''').]]

# On your '''~~c7host~~centos1''' machine, run ifconfig and make note of the IP address assigned to the '''virbr1''' (i.e. "Virtual Bridge) interface. This will be the default gateway and DNS server for your VMs.# Start your '''~~centos1~~centos2''' VM and login.# Within your ~~centos1~~ centos2 VM, click '''Applications''' menu, then select '''System Tools''', and then '''Settings'''.

# In the ''Settings'' Dialog Box, click on the '''Network''' icon.

# For the '''Wired''' connection, click the '''settings''' button (The icon appears as a gear located at the bottom right-hand corner of the dialog box).

# When finished, check your settings, and then click the '''Apply''' button.

# Open a terminal and issue the '''ifconfig''' command to confirm the IP ADDRESS settings change.

# Verify that '''~~centos1~~centos2'''VM is now connected to the VPN by issuing the following command from your '''~~c7host~~centos1''' machine: <code>ping 192.168.235.11</code>

'''Answer Part 2 observations / questions in your lab log book.'''

== Part 3: Backing up Only Recent File Changes ==

This part is a repeat of part2, except we will be demonstrating how to use the '''find''' command to backup recent changes to files. In this case, we will save date/time stamp information in a file, configure to connect '''~~centos2~~centos3''' to the network, run the '''find''' command, and prove that the incremental backup worked (showing the files created as a result of the configuration of ~~centos1~~ centos2 to the VPN).

{| width="40%" align="right" cellpadding="10"

|}

# Keep your '''~~centos1~~centos2''' VM running (you will need it running later in this lab).# Start the '''~~centos2~~centos3''' VM and login# Before we configure ~~centos2~~ centos3 network configuration, we should create a timestamp file that can be used to see which files have changed as a result of using the GUI tool. Issue the following command:

#: <code>date > /tmp/timestamp</code>

# Run the network configuration tool and enter the following static configuration in the same way that you configured '''~~centos1~~centos2'''.

#* IP Address: '''192.168.235.12'''

#* Subnetmask: '''255.255.255.0'''

# Save and exit the network configuration tool.

# You may have to restart the network using the correct command.

# Verify the configuration by pinging the VMs and ~~c7host~~ centos1 using their IP addresses.

# We will now create an '''Incremental Backup'''. Run the following Linux command as root:

#: <code>find /etc -newer /tmp/timestamp > /root/netcfg.lst</code>

'''Answer Part 3 observations / questions in your lab log book.'''

== Part 4: Configuring VM Network Setup via Command Line ('''~~centos3~~centos4''') ==

Our ~~centos3~~ centos4 VM is a '''text-based only''' system, thus we cannot use a graphical tool to configure ~~centos3~~ centos4 to connect to our private network. Therefore we will learn how to perform this task by using command-line tools.

# Leave your '''~~centos1~~centos2''' and '''~~centos2~~centos3''' VM running, but start your '''~~centos3~~centos4''' VM, login, and su to '''root'''.

# Use the command '''ifconfig''' to list active interfaces, you should see one with a name of '''eth0''' or a similar name.

# To configure your card with a static address use the following command:

#: <code>ifconfig</code>

#:<code>route -n</code>

#: <code>ping</code> (your other VM's and ~~c7host~~centos1)

#: <code>ssh</code> ( to your Seneca's Matrix account to test your DNS)

# Restart the <code>~~centos3~~centos4</code> VM, or just wait a few minutes.

# Login and test your configuration again. What happened?

# While we can configure network settings from the command line those settings are not persistent. To configure persistent network configurations we need to edit the configuration files.

# Change to the '''/etc/sysconfig/network-scripts''' directory [[Image:new-network-config.png|thumb|300px|right|This diagram should show the newer network configuration of your '''~~c7host~~centos1''' machine in relation to your '''Virtual Machines'''.]]

# List the contents of this directory. You should see 2 different types of files, network config scripts and network configuration files.

# Look for the configuration file for your original interface, it should be named '''ifcfg-eth0'''

# Save the file and then restart the network connection by issuing the commands: <code>ifdown eth0</code> and then <code>ifup eth0</code>

# Verify your configuration as you did before.

# Restart the '''~~centos3~~centos4''' VM.

# Login and attempt to '''ssh''' to your matrix account to verify the settings.

After setting up a private network, it can be hard to try to remember IP addresses. In this section, we will setup your network to associate easy-to-remember server names with IP ADDRESSES.

# Complete this investigation on '''all of your VMs''' and the '''~~c7host~~centos1''' machine.# Use the <code>hostname</code> and <code>ifconfig</code> commands on your ~~c7host~~ centos1 machine and all of your 3 VM's to gather the information needed to configure the '''/etc/hosts''' file on all of your Linux systems.

# Edit the '''/etc/hosts''' file on each of the '''virtual machines and host machine'''. Add the following contents to the bottom of the '''/etc/hosts''' file:

#::192.168.235.1 ~~c7host~~centos1#::192.168.235.11 ~~centos1~~centos2#::192.168.235.12 ~~centos2~~centos3#::192.168.235.13 ~~centos3~~centos4

#Confirm that each host can ping all three of the other hosts by name.

When our CentOS system provides any services on a network, those services are accessible through a port number. All network services are configured to be accessed on a particular port number. By examining which ports are active on our system we can know what services (and points of attack) are available on our system. The ability to examine this information is important for troubleshooting network services and securing our systems. One great tool for this is the '''netstat''' command.

# Perform this section on your '''~~c7host~~centos1''' machine.

# On the centos host '''ping''' each of your VM's

# Examine the contents of the ARP cache by using the command: <code>arp</code>

# For the remainder of this section, use your '''~~c7host~~centos1''' machine.

# As root on the CentOS host enter the following commands at the prompt:

#: <code>iptables -L</code>

<li>This entry in the OUTPUT policy will therefore log all packets being sent out of the machine.</li>

<li>Try to access the Internet again. Because the policies have been set to DROP, you should be unsuccessful. However, every packet of data that your PC attempted to send out was logged. Let's have a look at the log file and analyze the data: <code>tail /var/log/messages</code></li>

<li>This command shows us the last 10 lines of the file. While there are many things being logged to this file, the last thing we did was try to access the Internet so we should be able to see the data we need. Look for a line that looks similar to the following: <blockquote><code>Jun 24 12:41:26 ~~c7host~~ centos1 kernel: IN= OUT=lo SRC=127.0.0.1 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=16442 DF PROTO=TCP SPT=57151 DPT=5902 WINDOW=1024 RES=0x00 ACK URGP=0</code></blockquote></li>

<li>Your IP, host names and date will be different, but the one thing that should be the same is the DPT=80 value.</li>

<li>When your computer tried to send OUT a request to connect to the Internet using the WWW, the computer used a destination port of 80. This is the standard port for the WWW. Because we have set the default policy to DROP it drops these packets. The problem is we are dropping all packets. What if we just want to drop the WWW packets?</li>

<li>Confirm that your rule works by testing from your VM's</li>

<li>Does iptables close the port? Check using '''netstat'''</li>

<li>Now insert a rule on the CentOS host that would ACCEPT connections from the ~~centos2~~ centos3 VM only.</li>

<li>Fully test your configuration.</li>

</ol>

'''Arrange proof of the following on the screen:'''

<ol><li>✓ '''~~centos2~~centos3''' VM:<blockquote><ul><li>Contents of '''/tmp/lab6''' directory.</li><li>'''ssh''' from ~~centos2~~ centos3 to the CentOS host</li></ul></blockquote></li></li><li>✓ '''All VMs''':<blockquote><ul><li>'''ifconfig''' information</li><li>Contents of '''/etc/hosts''' file</li></ul></blockquote></li><li>✓'''~~c7host~~centos1''' machine<blockquote><ul><li>'''arp''' cache information</li><li>Contents of '''/etc/hosts''' file</li><li>Proof of backup</li><li>A list of your '''iptables''' rules</li></ul></blockquote></li><li>✓ '''Lab6''' log-book filled out.</li></ol>

= Practice For Quizzes, Tests, Midterm & Final Exam =

Msaul

Administrators

13,420

edits

CDOT Wiki β

Changes

OPS235 Lab 6 - CentOS7 - VMware

CDOT Wiki ^β