[[Category:OPS235]][[Category:OPS235 Labs]] ==Overview== * In this lab, you will learn the basics of networking by using your Virtual Machines and your f17host machine.  * In addition, you will learn to associate network services with port numbers, and learn how to backup files by date/time.

* # Configure a virtual network for Virtual Machines* # Use the Fedora GUI program to configure network interfaces with static IP configuration and host name resolution* # Use the <code>find</code> command to locate the configuration files modified by the GUI network configuration program# To examine some of the Linux's TCP/IP configuration files in the <code>/etc/</code> directory# To configure a Fedora host with static network configuration without a GUI tool# To configure the linux firewall <code>iptables</code> to allow/disallow/forward different types of network traffic using simple rules  

==Required Materials (Bring to All Labs)== * Fedora 17 LIVE CD* Fedora 17 x86_64 Installation DVD* SATA Hard Disk (in removable disk tray)* USB Memory Stick* Lab Logbook ==Prerequisites== * To examine some Completion and Instructor "Sign-off" of the Lab 5: [[OPS235 Lab 5]]  ==LinuxCommand Online Reference==Each Link below displays online manpages for each command (via [http://linuxmanpages.com/ http://linuxmanpages.com]): {|width="100%" cellpadding="5" width="50%"|'''Networking Utilities:'''|'''Additional Utilities:'''s TCP||- valign="top"|*[http:/IP configuration files in the <code>/etclinuxmanpages.com/<man8/code> directoryifconfig.8.php ifconfig]* To configure a Fedora host with static [http://fedoramobile.org/Members/MrHappy/system-config-network system-config-network configuration without a GUI tool]* To use and interpret the <code>[http://linuxmanpages.com/man8/route.8.php route]*[http://linuxmanpages.com/man8/ping.8.php ping]*[http://linuxmanpages.com/man8/arp.8.php arp]*[http://linuxmanpages.com/man8/netstat.8.php netstat<]*[http://linuxmanpages.com/code> command to troubleshoot and monitor network servicesman8/iptables.8.php iptables]|*[http://www.linuxcertif.com/man/1/systemctl/ systemctl] *[http://linuxmanpages.com/man1/find.1.php find]*[http://linuxmanpages.com/man1/tail.1.php tail]*[http://linuxmanpages.com/man1/cp.1.php cp]|}

== Reference Resources on the web==Additional links to tutorials and HOWTOs:* [http://en.wikipedia.org/wiki/Virtual_network Virtual Network - Definition]* [http://linuxmanpageswww.reallylinux.com/ man pagesdocs/networkingadmin.shtml Important Linux Networking Commands] for find, ifconfig, ping, netstat, NetworkManager, nslookup, iptables, arp(Also refer to lab 6 notes)* Online reading material for week 8[http://www.yolinux.com/TUTORIALS/LinuxTutorialNetworking.html Linux Network Configuration]* [[IPTables]] Reference* Lab6 Notes: [http://zenit.senecac.on.ca/wiki/index.php/OPS235_Lab_6#Investigation_8:_How_do_I_view_and_configure_the_IPTABLES_firewall.3F_--_Basic_Function.2FConfiguration IPTABLES Firewall]

Currently you should have the following network configuration:<br /><br />[[Image:network-config1.png]]* '''Fedora host ''' has 1 active network interface (probably <code>eth0'''em1'''</code>)that receives IP configuration from the School's DHCP server.* '''Fedora host ''' has 1 active network interface (<code>'''virbr0'''</code>) that has a static default configuration of '''192.168.122.1/255.255.255.0'''* '''Fedora1 VM ''' has 1 active interface (<code>'''eth0'''</code>) that receives a dynamic configuration from your Fedora Host* '''Fedora2 VM ''' has 1 active interface (<code>'''eth0'''</code>) that receives a dynamic configuration from your Fedora Host* '''Fedora3 VM ''' has 1 active interface (<code>'''eth0'''</code>) that receives a dynamic configuration from your Fedora Host 

{{Admon/important | Update your systems | It is advisable to perform a <code>yum update</code> on your Fedora host and all 3 VM's.}}{{Admon/important | Live disc installations and system-config-network | The '''fedora1 ''' VM was installed from Live CD. It is missing the GUI Network Configuration tool we will be using. Use the command <code>yum install system-config-network</code> to install it.}}

== Lab Investigations Configuring a Network Using Virtual Machines ==

{{Admon/note | Use the Fedora Host f17host | Complete the following steps on your main fedora host '''f17host''' computer system (f13host).}}

# On the fedora host your '''f17host''' machine start Virtual Machine Manager# In the Virtual Machine Manager dialog box, Select '''Edit'''-> '''Connection Details'''.# In the '''Hosts ''' Details dialog box, select the '''Virtual Networks ''' tab# Disable the default configuration from starting at boot by '''deselecting the ''' '''"Autostart On Boot" ''' (on boot) checkbox.# Stop the default network configuration by clicking on the '''stop ''' button at the bottom left-side of the windowdialog box.# Click on the '''add ''' button (the button resembles a "plus sign") to add a new network configuration.# Give your new network a name (i.e. '''network1''')

#*'''192.168.235.0/24'''# Disable DHCP by '''deselecting ''' the check box.# Enable Network Forwarding by Selecting "'''Forwarding to physical network"'''# The destination should be "'''Any physical device" ''' and the mode should be "'''NAT"'''# Proceed with changes, and select '''Finish'''.# Before proceeding, check the "<u>default</u>" network connection (in the Virtual Networks section) to verify "'''Autostart On Boot" ''' is disabled, and that you have created the "'''network1" ''' configuration. You might be required to click Apply when the default '''Autostart''' option is deselected. If you have any problems launching your VMs, then it is recommend to reboot your main system.# '''Close''' the Virtual Manager, '''reboot''' your f16host, '''log-back into your f16host computer''', and '''restart''' the Virtual Machine Manager.

# <ol> <li value="15">Now we need to add our new virtual network "'''network1" ''' to the 3 VM's##<ol type="a" style="margin-left:2cm"> <li value="1">Select the '''fedora1 ''' VM and edit the VM details'''Virtual Machine Details'''<br />(Note: the Virtual Machine window will appear - do not start virtual machine)</li>## <li>Under View select '''Details'''</li>## <li>In the '''left pane ''' of the Virtual Machine window, select the '''NIC :''' and note that this NIC is on the "default" virtual network</li>## <li>Click on the '''Remove ''' buttonat the bottom right-side of the dialog box.</li>## <li>Click on "'''Add Hardware" ''' on the bottom left-side of the dialog box and add a new network</li>## <li>For the host device , locate and select "'''Virtual Network network1" ''' : NAT</li> <li>Click finish to exit the Virtual Machine Details dialog box.</li># </ol> </li> <li value="16">Repeat these steps '''a - g''' for '''fedora2 ''' and '''fedora3 ''' VM's.</li></ol> # '''Answer the Investigation 1 question observations / questions in your lab log book.'''

# Start '''fedora2 ''' VM and login# On your '''fedora host''' run <code>ifconfig</code> and make note of the IP address assigned to the <code>virbr1</code> interface. This will be your default gateway for your Vm's.[[Image:new_network_dialog.png|thumb|350px]]# Make certain to return to your fedora2 VM.# To configure a new interface on fedora2 go to System'''Applications'''->Administration'''Other'''->'''Network Connections'''.# Make certain there are no '''"Wired"''' connections (even if you have to click on the connection name and click the '''Delete''' button.# Create a new wired connection, with the "Connection Name" at the top to read '''eth1'''# Click on the '''Add''' button, and select the '''IPv4 Settings''' tab.# Change the method from "Automatic (DHCP)" to '''"NewManual" button'''.# Select Ethernet Device and choose In the network card named <code>eth1</code>'''Addresses section''', click '''"Add"'''.# Statically Manually set the IP configurationto:#: IP Address '''192.168.235.12'''#: Subnet Mask '''255.255.255.0'''#: Default Gateway '''192.168.235.1 ''' (The IP address of <code>virbr1</code> on your fedora host.)# Click on the '''DNS tab ''' field and add '''192.168.235.1 ''' as the primary DNS server.# Select ForwardClick '''Save''' to Finish, and then select Apply exit the Network Connections dialog box.# Your network connection may connect (view the Network Manager applet in the gnome panel at the top of the screen). If there is no connection after a few minutes, you should be able to right-click on the applet and click "eth1" to connect.# You should be able to use the systemctl command to Finishrestart your network.#'''Restart your network ''' on fedora2by issuing the commands:#*<code>systemctl stop NetworkManager. service</code>#*<code>systemctl start NetworkManager.service NetworkManager restart</code>

# To verify that fedora2 has the correct default gateway configured, enter the command : <code>route -n</code># Verify the network by using : <code>ping 192.168.235.1</code># Record '''Answer the answer to Investigation 2 observations / questions in your logbooklab log book.'''

 {{Admon/note | Backing up Files |One very important aspect of system admin is performing backups. There are many methods for backing up the data on a a computer system.<br />The following is an example of a common backup system used in Business Unix/Linux systems:<br /><br />'''Full Backup''': Backup all specified files (eg. configuration, data files, etc)<br />'''Incremental Backup''': Backup of only files that have changed since last (full) backup<br /><br />When the system is required to be fully restored, then the '''full backup''' is recovered, followed by each .<br />In this investigation, you will learn how to perform an '''incremental backup''' using the <code>find</code> utility|}} # Start '''fedora1 ''' VM and login

# Run the network configuration tool and enter the following static configuration in the same way that you configured '''fedora2'''.#* IP Address: '''192.168.235.11'''#* Subnetmask: '''255.255.255.0'''#* Default Gateway: '''192.168.235.1'''#* DNS Server: '''192.168.235.1'''# Save and quit and restart exit the network configuration tool.# Restart the NetworkManagerservice.# Verify the configuration by pinging fedora host ('''192.168.235.1''') and fedora2 ('''192.168.235.12''')

{{Admon/note | Creating an Incremental Backup |We will now be using the <code>find</code> command to::*Locate the configuration files (contained in the <code>/etc</code> directory) that were modified by the GUI network configuration program:*Copy those configuration files to a "specified" directory for backup purposes Previously, you created a file called <code>/tmp/timestamp</code> that just contains the current date and time prior to running the network configuration toool for fedora2.. Any files that were modified by the GUI network configuration program should have a timestamp later (or newer) than the "timestamp" file you created. All the Linux TCP/IP configuration files are stored under the '''/etc''' directory or its sub-directories. The <code>find</code> command (using the correct options) can be used to only list those files that have been recently created since the timestamp date contained in the <code>/tmp/timestamp</code> file.|}} <ol> <li value="8">Run the following Linux command: <ul> <li><code>find /etc -newer /tmp/timestamp &gt; /root/netcfg.lst</code></li> </ul> </li> <li>View the <code>/root/netcfg.lst</code> file. What does it contain?</li> <li>Create a new directory called: <code>/tmp/lab6</code></li> <li>Issue the following commands: <ul> <li><code>mkdir -p /tmp/lab6</code></li> <li><code>find /etc -newer /tmp/timestamp -exec cp {} /tmp/lab6 \;</code></li> </ul> </li> <li>View the contents of the <code>/tmp/lab6</code> directory. What does it contain?</li></ol> {{Admon/tip | Tip | Just for interest, it is relatively simple to automate your backups. You just create a Bash Shell script file using the <code>find</code> command above, give the shell script executable permissions, and use the <code>crontab</code> command to schedule when this script is to be run. If you want to learn more about shell scripting, you can take or refer to the course called '''OPS435''' .}} '''Answer the Investigation 3 observations / questions in your lab log book.''' === Investigation 4: How do I configure the network without a GUI tool?. ===

# Start '''fedora3 ''' VM and login as root# Use the command <code>ifconfig</code> to list active interfaces, you should see one with a name of <code>eth1eth0</code> or a similar name.# To configure your card with a static address use the following command:#* <code>ifconfig eth1 eth0 192.168.235.13 netmask 255.255.255.0</code>

#* Copy that file to <code>ifcfg-eth1eth<b>N</b></code> or whatever name matches where <b>N</b> relates to your current eth interfacenumber (we will use <b>eth1</b> as an example).

#**GATEWAY=192.168.235.1#**DNS1=192.168.235.1#**DEVICE="eth1 " <-- '''<-- or the interface name you YOU have'''#**BOOTPROTOIPADDR=none"192.168.235.13"#**NETMASK="255.255.255.0"#**TYPEGATEWAY=Ethernet"192.168.235.1"#**HWADDR="52:54:00:3f:5c:fa " <-- '''<--use the HWADDR for your YOUR interface'''#**IPADDRDNS1="192.168.235.131" '''#**IPV6INITBOOTPROTO=no"static"#**ONBOOT="yes"#**USERCTLNM_CONTROLLED="yes"#**IPV6INIT="no"# Save the file and then restart the network connection by issuing the commands: <code>ifdown eth1</code> and then <code>NetworkManagerifup eth1</code> service<br /><br ><b>NOTE: </b>If there are errors, check that the hardware address in the config file matches the hardware address of the device its configuring<br /><br />

# '''Answer the Investigation question 4 observations / questions in your logbooklab log book.'''

{{Admon/note | Please take note! Hosts files vs. the Domain Name System | On large public networks like the Internet or even large private networks we use a network service called [http://en.wikipedia.org/wiki/Domain_Name_System Domain Name System (DNS)] to resolve the human friendly hostnames like '''fedoraproject.org''' to the computer friendly 32bit numeric addresses used by the IP protocol. On smaller ad-hoc networks we can use the <code>/etc/hosts</code> on each system to resolve names to addresses.}}

192.168.235.1 f13hostf17host

{{Admon/note | Note! Use your Fedora Host | Complete this investigation on your Fedora host.}}

{{Admon/note | Obtaining Remote MAC Addresses| The term '''MAC''' address stands for '''Media Access Control''' address, which provides a unique ID to prevent confusion among computer systems within a network. While we use '''32bit IP addresses addresse'''s to communicate over an internetwork, on the local ethernet network packets are delivered to a '''48bit hardware address ''' (sometimes called a MAC address). The '''ARP ''' protocol resolves 32bit IP addresses to 48bit MAC addresses by using a broadcast and caching the results. We can examine the ARP cache to get the MAC addresses of other computers on our local network.<br /><br />Being able to determine remote MAC address information is useful from troubleshooting networking programs to using '''WOL''' (Wake up on Lan) to automatically boot remote workstations via the network. In this investigation, you will learn how to obtain MAC address information for various network cards.}}

# '''Answer the investigation question Investigation 6 observations / questions in your logbooklab log book.''' 

{{Admon/note | Note! Use All Machines | Complete this investigation on all of your VM's and the Fedora host.}}

{{Admon/note | Please take note! Network Ports | When our Fedora system provides any services on a network, those services are accessible through a port number. All network services are configured to be accessed on a particular port number. By examining which ports are active on our system we can know what services (and points of attack) are available on our system. The ability to examine this information is important for troubleshooting network services and securing our systems. One great tool for this is the <code>netstat</code> command.}}

# On your fedora host execute the command : <code>netstat -at</code>

# Examine the <code>/etc/services</code> file and find which ports are used for the services : <code>ssh , ftp , http</code>

# '''Answer the investigation Investigation 7 observations / questions in your logbooklab log book.''' 

{{Admon/important | Note! Non-Persistent Changes to your Host System | We will complete Complete this lab on the your host machinesystem (f16host).

It should be noted that all of the commands that we do here with iptables will not be persistentunless you have your configuration. That means if you re-boot, the default iptables configuration will be loaded.}} 

'''==== Testing policies'''====

{{Admon/note| |This command can be read like this, Insert a line into the iptables OUTPUT chain that will look at tcp information and DROP any packet with a source address from anywhere, to a destination address to anywhere if the destination port is 80. Let's break down the command to see how it works.

The '''-I''' switch tells iptables to INSERT this line into the OUTPUT policy. This means it will be the first line in the policy. If we used a -A switch it would have appended the line and it would be the last line of the policy. If you are writing complex iptables rules where multiple matches can occur, it is important that the lines go in the right order. Most people simply write scripts to ensure thisIf you follow the -I with a number, the new rule will be inserted at that location in the chain (for example, <code>-I 3 OUTPUT</code> will insert the rule into the 3rd position in the OUTPUT chain, moving the existing rules down as necessary (the old rule #3 will become the new rule #4, for example).

The '''-p tcp''' switch tells iptables to filter data by looking at only match TCP information in the packets. For nowAlternately, we simply want the protocol could be set to filter data by source and destination TCP ports so we need this switchudp, icmp, or all.

The switch '''--dport 80''' tells iptables to look at the destination port in the packet and see if it is equal to 80. Alternately, you can filter based on source addresses using the <code>--sport</code> switch.

'''-j''' means jump to a particular condition target – Basic conditions targets are ACCEPT, DROP , REJECT, and LOG. There are others and you also have The available targets depend on which table contains the ability to create your ownchain.

'''DROP''' means drop the packet – make it disappear - and do not let continue processing rules. '''REJECT''' is similar, but causes an error packet to be sent back to the source host. '''ACCEPT''' causes the packet to be processed. '''LOG''' causes an entry to be made in the system logs showing that the packet was processed. Note that the LOG target is the only one that does not stop rule-checking in the chain - so you can log a packet with one rule, and then use a later rule in the chain to DROP, REJECT, or ACCEPT it leave the computer.

# Try to access the Web. If you have done everything right, you should not have been successful.# After you have completed the test execute the following command:#* <code>iptables -F</code>I OUTPUT -p tcp --dport 80 -j DROP}}

{{Admon/note | iptables Service |When your iptables service starts or at boot time it has to load the rules from the file <code>/etc/sysconfig/iptables</code>.}}# Make a backup of the file <code>/etc/sysconfig/iptables</code># Examine the file to see how rules are added.# Enter in your 2 new rules created above.

{{Admon<ol> <li value="9">'''Make a backup of the file <code>/etc/sysconfig/important | Carefull! | Remember mistakes in iptables can have a significant impact on your system. Make sure you are </code>'''appending </li> <li>Examine the file to see how rules are added.</li> <li>Issue the command: <code>iptables-save > /etc/sysconfig/iptables</code> to save the INPUT chain'''}}rules you added with the iptables command, above.</li> <li>Verify that the file <code>/etc/sysconfig/iptables</code> was updated with your new rules.</li># <li>Restart your iptables service and test your configuration. </li># <li>Write a short bash script to append add a rule allowing the fedora1 and fedora3 VM's to connect to <code>ssh</code> on the fedora host.</li># </ol> '''Answer the investigation Investigation 8 observations / questions in your logbooklab log book.'''

 Now you should have the following network configuration:<br /><br />

 * '''Fedora host ''' has 1 active network interface (probably <code>eth0'''em1'''</code>)that receives IP configuration from the School's DHCP server.* '''Fedora host ''' has 1 active network interface (<code>'''virbr1'''</code>) that has a static default configuration of '''192.168.235.1/255.255.255.0'''* '''Fedora1 ''' VM has 1 active interface (<code>'''eth1'''</code>) that has a static configuration of '''192.168.235.11/255.255.255.0'''* '''Fedora2 ''' VM has 1 active interface (<code>'''eth1'''</code>) that has a static configuration of '''192.168.235.12/255.255.255.0'''* '''Fedora3 ''' VM has 1 active interface (<code>'''eth1'''</code>) that has a static configuration of '''192.168.235.13/255.255.255.0'''

 == Preparing for the Quizzes ==