Changes

Jump to: navigation, search

OPS235 Lab 6

143 bytes removed, 15:07, 2 March 2020
LAB PREPARATION
=LAB PREPARATION=
[[Image:my-network.png|thumb|right|350px|Setting up networks is an essential operation for a system administrator. Maintaining network connectivity and securing the network are also essential operations. In this lab, we will '''configure a Virtual Private Network private virtual network using static IP addresses''' (eg. wired workstation connections). We will learn how to setup a DHCP network (eg. for notebook, table and smartphones) in lab 8.]]
===Purpose / Objectives of Lab 6===
In this lab, you will learn the basics of networking by using your '''Virtual Machines'''. You will first set up a '''virtual private network (VPN)''' among those machines. In addition, you will learn to set up '''network names''' (to associate with server's IP Addresses), '''associate network services with port numbers''' for troubleshooting purposes, and use shell scripts with arrays to store network configuration data.
<u>Main Objectives</u>
# Configure a private (virtual) network for your '''VMs''' and your '''c7host''' machine
# Configure network interfaces for your Virtual Machines using both '''graphical''' and '''command-line''' utilities.
# Use '''local hostname resolution''' to resolve simple server names with their corresponding IP Addresses
|style="padding-left:20px;" | Networking Utilities<br>
[http://man7.org/linux/man-pages/man8/ifconfig.8.html ifconfig]<br>
[http://man7.org/linux/man-pages/man8/ip.8.html ip]<br>
[http://www.serverlab.ca/tutorials/linux/administration-linux/configure-centos-6-network-settings/ system-config-network]<br>
[http://man7.org/linux/man-pages/man8/route.8.html route]<br>
[http://man7.org/linux/man-pages/man8/ping.8.html ping]<br>
[http://man7.org/linux/man-pages/man8/arp.8.html arp]<br>
[http://man7.org/linux/man-pages/man8/netstat.8.html netstat]|style="padding-left:20px;" | Networking Configuration Files<br>[httphttps://zenitwww.senecaccentos.onorg/docs/5/html/Deployment_Guide-en-US/s1-networkscripts-interfaces.cahtml Interface Configuration]<br>[https:/wiki/indexlinux.die.phpnet/IPTables iptablesman/5/resolv.conf resolv.conf]<br>
|style="padding-left:20px;" |Additional Utilities<br>
[http://man7.org/linux/man-pages/man1/find.1.html find]<br>
|}
=INVESTIGATION 1: CONFIGURING A VIRTUAL PRIVATE NETWORK (VPN)=
For the remainder of this course, we will focus on networking involving our VMs. This lab will focus on setting up a virtual private network ('''VPN'''), connecting our VMs and c7host machine to the VPNnetwork, and configuring our VPN private network to make more convenient to use, troubleshoot and protect. '''Lab 7''' will focus on configuring SSH and making access to the VPN private network more secure. Finally, '''lab 8''' will focus on configuring mobile (as well as wired devices) via DHCP to automatically assign an IP address.
There are several reasons for creating '''VPNs'''virtual networks. The main reason is to '''safely connect servers together''' (i.e. to safely limit but allow the sharing of information among computer network users). This allows for a secure connection of computers yet controlling access to and monitoring (protecting) access to permitted users (discussed later in '''lab7''').
If we are going to setup a private network, there are a number of steps to perform: First, '''define a new private network in the Virtual Manager application'''; and second, '''configure each of our VMs to connect to this new private network'''. In Part 1, we will be perform the first operation. In part 2, we will be performing the second operation for all VMS (graphical and command-line).
Before configuring our network, we want to '''turn off dynamic network configuration for our Virtual Machines''' by turning off the '''"default"''' virtual network. We will then define our virtual private network.
:'''Perform the following steps:'''
# In the '''Connection Details''' dialog box, select the '''Virtual Networks''' tab
# Click to <u>de-select</u> the '''Autostart (on boot)''' check-box options and click the '''Apply''' button.
# Stop the default network configuration by clicking on the '''stop''' button at the bottom left-side of the dialog box.
# Click the '''add''' button (the button resembles a "plus sign") to add a new network configuration.
# Type the network name called: '''network1''', and then click the '''Forward''' button.
<li value="1">Let's start with our '''centos1 VM'''. Double-click on your '''centos1''' VM, but instead of running the VM, click on the '''view''' menu, and select: '''Details'''<br />(Note: the Virtual Machine window will appear - do not start virtual machine)</li>
<li>In the '''left pane''' of the Virtual Machine window, select '''NIC:''' and note that this NIC is on the "default" virtual network</li>
<li>Change it to '''Virtual Network network1: NAT''' (i.e. the VPN network that you just created) and click the '''Apply''' button.</li>
</ol>
</li>
[[Image:new_network_dialog.png|right|thumb|300px|Although the private network has been setup via the '''Virtual Machine Manager''', each virtual machine requires to change its own network setting individually (either '''graphically''' or by '''command line''').]]
 
=== Part 2: Configuring Network For centos1 VM===
# When finished, check your settings, and then click the '''Apply''' button.
# Open a terminal and issue the '''ifconfig''' command to confirm the IP ADDRESS settings change.
# Verify that '''centos1'''VM is now connected to the VPN private network by issuing the following command from your '''c7host''' machine:<br><b><code><span style="color:#3366CC;font-size:1.2em;">ping 192.168.235.11</span></code></b>
[[Image:network-scripts.png|thumb|right|250px|Although you can use the '''ifconfig''' command to temporarily create a static IP address connection to a network, you need to add the network settings in the '''/etc/sysconfig/network-scripts''' directory to automatically connect to the network upon Linux system boot-up.]]
 
=== Part 3: Configuring VM Network Setup via Command Line ('''centos3''' and '''centos2''') ===
# Configure your '''centos3''' VM (in the '''View''' -> '''Details''' menu of Virtual Machine Manager) to configure the NIC interface to '''network1''', click '''Apply''', and switch your centos3 VM view from ''details'' to '''console'''.
# Start your '''centos3''' VM, login, and su to '''root'''.
# Use the command called: '''ifconfig''' to list active interfaces, you should see one with a name of '''eth0''' or a similar name.<br><br>NOTE: If the '''ifconfig''' command is NOT available in your centos3 vm, issue the command:<br>'''yum install net-tools'''<br><br>
# To configure your card with a static address use the following command:
#:<b><code><span style="color:#3366CC;font-size:1.2em;">ifconfig eth0 192.168.235.13 netmask 255.255.255.0</span></code></b>
# List the contents of this directory. You should see 2 different types of files, network config scripts and network configuration files.
# Look for the configuration file for your original interface, it should be named '''ifcfg-eth0'''
# Edit the new file for you your interface and give it the following settings (or create a brand new file, might be easier than editing the old one):
#::DEVICE=eth0
#::IPADDR=192.168.235.13
'''Answer INVESTIGATION 1 observations / questions in your lab log book.'''
 
=INVESTIGATION 2: MANAGING YOUR NEWLY-CREATED NETWORK=
Creating private networks are an important task, but a system administrator also needs to manage the network to make it '''convenient to use''', make it '''safer from unauthorized access''', and '''troubleshoot''' network connectivity problems.
This investigation will expose you to useful "tweaks" and utilities to help accomplish this task. '''Lab 7''' requires that you understand these concepts and have a good general understanding how to use these troubleshooting utilities (like '''netstat''' and '''iptables''').
{| width="40%" align="right" cellpadding="10"
|{{Admon/note | Hosts files vs. the Domain Name System | On large public networks like the Internet or even large private networks we use a network service called [http://en.wikipedia.org/wiki/Domain_Name_System Domain Name System (DNS)] to resolve the human friendly hostnames like '''centos.org''' to the numeric addresses used by the IP protocol. On smaller networks we can use the <code>/etc/hosts</code> on each system to resolve names to addresses.}}
|}
=== Part 1: Using /etc/host hosts File for Local Hostname Resolution ===
After setting up a private network, it can be hard to try to remember IP addresses. In this section, we will setup your network to associate easy-to-remember server names with IP ADDRESSES.
#Verify that you can now ping any VM by their hostname instead of the IPADDR.
 
 
=== Part 2: Network Connectivity &amp; Network Service Troubleshooting Utilities===
{| width="40%" align="right" cellpadding="10"
|- valign="top"
|
<table cellspacing="0" cellpadding="5" style="border-top: thin solid black;margin-left:60px;">
<caption>'''Common Network Troubleshooting Tools'''</caption>
<tr valign="top>
 
<td style="border-bottom: thin solid black;font-weight:bold;background-color:#ffffff;">Purpose</td>
<td style="border-bottom: thin solid black;font-weight:bold;background-color:#ffffff;padding-left:100px;">Command(s)</td>
 
</tr>
<tr valign="top">
<td style="border-bottom: thin solid black;">Network Connectivity</td>
<td style="border-bottom: thin solid black;padding-left:100px;"><b><code><span style="color:#3366CC;font-size:1.2em;">ping</span></code></b><br><b><code><span style="color:#3366CC;font-size:1.2em;">arp</span></code></b><br><b><code><span style="color:#3366CC;font-size:1.2em;">ifconfig</span></code></b></td>
</tr>
<tr valign="top">
<td style="border-bottom: thin solid black;">Network Service Status</td>
<td style="border-bottom: thin solid black;padding-left:100px;"><b><code><span style="color:#3366CC;font-size:1.2em;">netstat'''</span></code></b></td>
</tr>
 
</table>
|}
 
 
Troubleshooting network problems is an extremely important and frequent task for a Linux/Unix system administrator. Since network services (such as file-server, print-servers, web-servers, and email-servers) depend on network connectivity, as Linux/Unix sysadmin must be able to quickly and effectively pin-point sources of network problems in order to resolve them.
 
Network service problems may not be entirely related to a "broken" network connection, but a service that is not running or not running correctly. The following table lists the most common listing of utilities to assist with detection of network connectivity or network service problems to help correct the problem.
 
 
:'''Perform the following steps:'''
 
#Switch to your '''c7host''' machine.
#Issue the '''ping''' command to test connectivity to your '''centos1''', '''centos2''', and '''centos3''' VMs.
#Examine the contents of the ARP cache by using the command: <b><code><span style="color:#3366CC;font-size:1.2em;">arp</span></code></b> What is the purpose of ARP?
#Check the contents of the cache again by using the command: <b><code><span style="color:#3366CC;font-size:1.2em;">arp -n</span></code></b> What was the difference in output?
#Issue the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">netstat -at</span></code></b> This command will list all active TCP ports. Note the state of your ports.
 
'''TCP''' is a connection oriented protocol that uses a handshaking mechanism to establish a connection. Those ports that show a state of LISTEN are waiting for connection requests to a particular service. For example you should see the ssh service in a LISTEN state as it is waiting for connections.
 
<ol><li value="6">From one of your VM's login to your host using the '''ssh''' command.</li>
<li>On your c7host VM rerun the <b><code><span style="color:#3366CC;font-size:1.2em;">netstat -at</span></code></b> command and in addition to the '''LISTEN''' port it should list a 2nd entry with a state of ESTABLISHED. This shows that there is a current connection to your ssh server.</li>
<li>Exit your ssh connection from the VM and rerun the command on the CentOS host. Instead of '''ESTABLISHED''' it should now show a state of '''CLOSE_WAIT'''. Indicating that the TCP connection is being closed.</li>
<li>On your c7host VM, try the command: <b><code><span style="color:#3366CC;font-size:1.2em;">netstat -atn</span></code></b> How is this output different?
Without the -n option netstat attempts to resolve IP addresses to host names (using /etc/hosts) and port numbers to service names (using /etc/services)</li>
<li>Examine the '''/etc/services''' file and find which ports are used for the services: ssh, sftp, http</li>
<li>Now execute the command netstat -au What is the difference between the options: -at and -au? When examining UDP ports why is there no state?</li>
</ol>
 
 
 
===Part 3: Using Arrays to Collect VM Network Information===
{|width="40%" align="right" cellpadding="10"
|- valign="top"
</li></ul>'''<u>Working with Temporary Files</u>'''<br><br><ul><li>When creating temporary files, it is important NOT to store on a user's account (to avoid overwriting their existing files). Instead, temporary files can be created in the '''/tmp''' directory.<br><br></li><li>The $$ variable can be used as the filename extension which assigns the current PID of the shell script running to make the filename unique, and allow easy removal at the end of the shell script by deleting ALL files in the /tmp directory with the extension: .$$<br><br></li><li>Example:<br><br>''ls -lR &gt; /tmp/temp-file.$$''<br>''grep secret /tmp/temp-file.$$''<br>''rm /tmp.$$''<br></li></ul> }}
|}
===Part 2: Using Arrays to Collect VM Network Information===
 
We finish shell scripting by using arrays by reading and storing networking information for each VM (centos1, centos2, and centos3) to be stored in a report in your c7host machine. We will use the ssh command in order to grab the network information (one VM at a time), and store the network setup into an Associative array in our c7host machine.
&#35;<br>
&#35; Purpose: Creates system info report<br>
&#35;<br>&#35; USAGE: ./network-info.bash [full pathname to ifcfg-eno* eth0 file]<br>
<br>
if [ $USER != "root" ] # only runs if logged in as root<br>
if [ $# -ne 1 ]<br>
then<br>
&nbsp;echo "You need to provide the full pathname to ifcfg-eno eth0 file (eg eno1 or eno followed by numbers)" >&2<br>&nbsp;echo "USAGE: $0 [full pathname to ifcfg-eno* eth0 file]" >&2<br>
&nbsp;exit 0<br>
fi
</code>
<br><br>
<ol><li value="7">Give this shell script execute permissions and run this shell script.</li><li>You will need to determine the full pathname of the '''ifcfg-en0ens33''' file in the /etc/sysconfig/network-scripts directory to use as an argument for this shell script.</li><li>Run the shell script. What do you notice from the report that the shell script generated?</li><li>The the Then use wget command to download another variation of the network-info.bash shell script using the awk command to separate the variables and values into separate columns:<br><b><code><span style="color:#3366CC;font-size:1.2em;">httphttps://csict.senecac.onsenecacollege.ca/~murray.saulops235/labs/network-info-2.bash</span></code></b><br></li></ol>
 
{| width="40%" align="right" cellpadding="10"
|- valign="top"
|
<table cellspacing="0" cellpadding="5" style="border-top: thin solid black;margin-left:60px;">
<caption>'''Common Network Troubleshooting Tools'''</caption>
<tr valign="top>
 
<td style="border-bottom: thin solid black;font-weight:bold;background-color:#ffffff;">Purpose</td>
<td style="border-bottom: thin solid black;font-weight:bold;background-color:#ffffff;padding-left:100px;">Command(s)</td>
 
</tr>
<tr valign="top">
<td style="border-bottom: thin solid black;">Network Connectivity</td>
<td style="border-bottom: thin solid black;padding-left:100px;"><b><code><span style="color:#3366CC;font-size:1.2em;">ping</span></code></b><br><b><code><span style="color:#3366CC;font-size:1.2em;">arp</span></code></b><br><b><code><span style="color:#3366CC;font-size:1.2em;">ifconfig</span></code></b></td>
</tr>
<tr valign="top">
<td style="border-bottom: thin solid black;">Network Service Status</td>
<td style="border-bottom: thin solid black;padding-left:100px;"><b><code><span style="color:#3366CC;font-size:1.2em;">netstat'''</span></code></b></td>
</tr>
 
<tr valign="top">
<td style="border-bottom: thin solid black;">Firewall Status</td>
<td style="border-bottom: thin solid black;padding-left:100px;"><b><code><span style="pointer-events: none;cursor: default;color:#3366CC;font-size:1.2em;">iptables</span></code></b></td>
</tr>
</table>
|}
=== Part 3: Network Connectivity &amp; Network Service Troubleshooting Utilities===
 
Troubleshooting network problems is an extremely important and frequent task for a Linux/Unix system administrator. Since network services (such as file-server, print-servers, web-servers, and email-servers) depend on network connectivity, as Linux/Unix sysadmin must be able to quickly and effectively pin-point sources of network problems in order to resolve them.
 
Network service problems may not be entirely related to a "broken" network connection, but a service that is not running or not running correctly. The following table lists the most common listing of utilities to assist with detection of network connectivity or network service problems to help correct the problem.
 
 
:'''Perform the following steps:'''
 
#Switch to your '''c7host''' machine.
#Issue the '''ping''' command to test connectivity to your '''centos1''', '''centos2''', and '''centos3''' VMs.
#Examine the contents of the ARP cache by using the command: <b><code><span style="color:#3366CC;font-size:1.2em;">arp</span></code></b>arp What is the purpose of ARP?
#Check the contents of the cache again by using the command: <b><code><span style="color:#3366CC;font-size:1.2em;">arp -n</span></code></b> What was the difference in output?
#Issue the following command: <b><code><span style="color:#3366CC;font-size:1.2em;">netstat -at</span></code></b> This command will list all active TCP ports. Note the state of your ports.
 
'''TCP''' is a connection oriented protocol that uses a handshaking mechanism to establish a connection. Those ports that show a state of LISTEN are waiting for connection requests to a particular service. For example you should see the ssh service in a LISTEN state as it is waiting for connections.
 
<ol><li value="6">From one of your VM's login to your host using the '''ssh''' command.</li>
<li>On your c7host VM rerun the <b><code><span style="color:#3366CC;font-size:1.2em;">netstat -at</span></code></b> command and in addition to the '''LISTEN''' port it should list a 2nd entry with a state of ESTABLISHED. This shows that there is a current connection to your ssh server.</li>
<li>Exit your ssh connection from the VM and rerun the command on the CentOS host. Instead of '''ESTABLISHED''' it should now show a state of '''CLOSE_WAIT'''. Indicating that the TCP connection is being closed.</li>
<li>On your c7host VM, try the command: <b><code><span style="color:#3366CC;font-size:1.2em;">netstat -atn</span></code></b> How is this output different?
Without the -n option netstat attempts to resolve IP addresses to host names (using /etc/hosts) and port numbers to service names (using /etc/services)</li>
<li>Examine the '''/etc/services''' file and find which ports are used for the services: ssh, sftp, http</li>
<li>Now execute the command netstat -au What is the difference between the options: -at and -au? When examining UDP ports why is there no state?</li>
</ol>
'''Answer INVESTIGATION 2 observations / questions in your lab log book.'''
 
= LAB 6 SIGN-OFF (SHOW INSTRUCTOR) =
# Switch to your '''c7host''' VM.
# Change to the '''/root/bin''' directory.
# Issue the Linux command: <b><code><span style="color:#3366CC;font-size:1.2em;">wget httphttps://matrixict.senecac.onsenecacollege.ca/~murray.saulops235/ops235labs/lab6-check.bash</span></code></b>
# Give the '''lab6-check.bash''' file execute permissions (for the file owner).
# Run the shell script and if any warnings, make fixes and re-run shell script until you receive "congratulations" message.
#Arrange proof of the following on the screen:<br><blockquote><span style="color:green;font-size:1.5em;">&#x2713;</span> '''centos2''' VM:<blockquote><ul><li>'''ssh''' from '''centos2''' to '''c7host''' VM.</li></ul></blockquote><span style="color:green;font-size:1.5em;">&#x2713;</span>'''c7host''' machine<blockquote><ul><li>A list of your '''iptables''' rules</li><li>Output from running the '''network-info.bash''' shell script</li><li>Run the '''lab6-check.bash''' script in front of your instructor (must have all <b><code><span style="color:#66cc00;border:thin solid black;font-size:1.2em;">&nbsp;OK&nbsp;</span></code></b> messages)</li></ul></blockquote><span style="color:green;font-size:1.5em;">&#x2713;</span> '''Lab6''' log-book filled out.
= Practice For Quizzes, Tests, Midterm &amp; Final Exam =
# What is a port?
# What command will set your IP configuration to 192.168.55.22/255.255.255.0 ?
# What file contains the systems <code>iptables</code> rules?
# What is the difference between UDP and TCP?
# What port number is used for DHCP servers?
# What is the function of the file <code>/etc/services</code> ?
# What is the function of the file <code>/etc/hosts</code> ?
# What is the purpose of the file <code>/etc/sysconfig/network-scripts/ifcfg-eth0</code> ?
[[Category:OPS235]]
[[Category:OPS235 Labs]]
[[Category:CentOS 7]]
[[Category:SSD2]]

Navigation menu