Open main menu

CDOT Wiki β

Changes

OPS235 Lab 6 - Fedora17

3,410 bytes added, 19:53, 3 January 2014
no edit summary
[[Category:OPS235]]{{Admon/caution|DraftLab|This lab has NOT been released for regular distribution. When the lab is ready to be released, this caution banner will disappear.}}= OPS235 Lab6 - Configuring a Network Using Virtual Machines =[[Category:OPS235]][[Category:OPS235 Labs]]
==Overview==
* In this lab, you will learn the basics of networking by using your Virtual Machines and your host f17host machine.  * In addition, you will learn an effective method of backing up file by creation date range. 
* In addition, you will learn to associate network services with port numbers, and learn how to backup files by date/time.
== Objectives ==
==Required Materials (Bring to All Labs)==
* '''Fedora 16 17 LIVE CD''' - You can burn this onto a CD-R in the Open Lab* '''Fedora 16 x_64 17 x86_64 Installation DVD''' - You can burn this onto a DVD-R in the Open Lab (or burn image onto a DVD+R if you are using the Freedom Toaster).* '''SATA Hard Disk''' (in removable disk tray)* '''USB Memory Stick''' (minimum 64M)* '''Lab Logbook (Lab5 Reference Sheet)''' (to make notes and observations). 
==Prerequisites==
Each Link below displays online manpages for each command (via [http://linuxmanpages.com/ http://linuxmanpages.com]):
{|width="100%" cellpadding="5" width="50%"
|'''Networking Utilities:'''
|'''Additional Utilities:'''
*[http://linuxmanpages.com/man8/ping.8.php ping]
*[http://linuxmanpages.com/man8/arp.8.php arp]
*[http://linuxmanpages.com/man8/netstat.8.php netstat]
*[http://linuxmanpages.com/man8/iptables.8.php iptables]
|
*[http://linuxmanpages.com/man1/find.1.php find]
*[http://linuxmanpages.com/man1/tail.1.php tail]
*[http://linuxmanpages.com/man1/cp.1.php cp]
|}
* [http://en.wikipedia.org/wiki/Virtual_network Virtual Network - Definition]
* [http://www.reallylinux.com/docs/networkingadmin.shtml Important Linux Networking Commands] (Also refer to lab 6 notes)
* [http://colwikiwww.orgyolinux.com/Linux_Networking_Services TUTORIALS/LinuxTutorialNetworking.html Linux Networking ServicesNetwork Configuration]* [[IPTables]] Reference* View and Configure Lab6 Notes: [http://zenit.senecac.on.ca/wiki/index.php/OPS235_Lab_6#Investigation_8:_How_do_I_view_and_configure_the_IPTABLES_firewall.3F_--_Basic_Function.2FConfiguration IPTABLES Firewall (refer to lab 6 notes)]
== Current Configuration ==
<span style="background-color:yellow">Currently you should have the following network configuration:<br /span><br />[[Image:network-config1.png]]* '''Fedora host''' has 1 active network interface (probably <code>'''<span style="background-color:yellow">em0</span>em1'''</code>) that receives IP configuration from the School's DHCP server.
* '''Fedora host''' has 1 active network interface (<code>'''virbr0'''</code>) that has a static default configuration of '''192.168.122.1/255.255.255.0'''
* '''Fedora1 VM''' has 1 active interface (<code>'''<span style="background-color:yellow">em0</span>eth0'''</code>) that receives a dynamic configuration from your Fedora Host* '''Fedora2 VM''' has 1 active interface (<code>'''<span style="background-color:yellow">em0</span>eth0'''</code>) that receives a dynamic configuration from your Fedora Host* '''Fedora3 VM''' has 1 active interface (<code>'''<span style="background-color:yellow">em0</span>eth0'''</code>) that receives a dynamic configuration from your Fedora Host
== Lab Preparation ==
{{Admon/important | Update your systems | It is advisable to perform a <code>yum update</code> on your Fedora host and all 3 VM's.}}{{Admon/important | Live disc installations and system-config-network | The '''fedora1 ''' VM was installed from Live CD. It is missing the GUI Network Configuration tool we will be using. Use the command <code>yum install system-config-network</code> to install it.}}
{{Admon/important | Backup your VMs before proceeding | Stop all of your VMs and backup your VM disk images. Do not start the VMs until told to start them.}}
 
== Configuring a Network Using Virtual Machines ==
=== Investigation 1: How do you create a new virtual network. ===
{{Admon/note | Use the Fedora Host f17host | Complete the following steps on your '''f16hostf17host''' computer system.}}
Before configuring our network we want to turn off dynamic network configuration for our Virtual Machines by turning off the "default" virtual network.
# On the fedora host your '''f17host''' machine start Virtual Machine Manager
# In the Virtual Machine Manager dialog box, Select '''Edit'''-> '''Connection Details'''.
# In the '''Hosts''' Details dialog box, select the '''Virtual Networks''' tab
# Disable the default configuration from starting at boot by '''deselecting the ''''''"Autostart On Boot"''' (on boot) checkbox.# Stop the default network configuration by clicking on the '''stop''' button at the bottom left-side of the windowdialog box.# Click the '''add''' button (the button resembles a "plus sign") to add a new network configuration.# Give your new network a name (i.e. '''network1''')
# Enter in the new network IP address space:
#*'''192.168.235.0/24'''
# Disable DHCP by '''deselecting ''' the check box.
# Enable Network Forwarding by Selecting '''Forwarding to physical network'''
# The destination should be '''Any physical device''' and the mode should be '''NAT'''
# Proceed with changes, and select '''Finish'''.
# Before proceeding, check the "<u>default</u>" network connection (in the Virtual Networks section) to verify '''Autostart On Boot''' is disabled, and that you have created the '''network1''' configuration. You might be required to click Apply when the default '''Autostart''' option is deselected. If you have any problems launching your VMs, then it is recommend to reboot your main system.# '''Close''' the Virtual Manager, '''reboot''' your f16host, '''log-back into your f16host computer''', and '''restart''' the Virtual Machine Manager.
{{Admon/note | Repeat these steps for each VM | Complete the following steps on <u>each</u> of your virtual machines.}}
# <ol> <li value="15">Now we need to add our new virtual network '''network1''' to the 3 VM's##<ol type="a" style="margin-left:2cm"> <li value="1">Select the '''fedora1''' VM and edit the VM details'''Virtual Machine Details'''<br />(Note: the Virtual Machine window will appear - do not start virtual machine)</li>## <li>Under View select '''Details'''</li>## <li>In the '''left pane ''' of the Virtual Machine window, select the '''NIC :''' and note that this NIC is on the "default" virtual network</li>## <li>Click on the '''Remove''' buttonat the bottom right-side of the dialog box.</li>## <li>Click on '''Add Hardware''' on the bottom left-side of the dialog box and add a new network</li>## <li>For the host device , locate and select '''Virtual Network network1''' : NAT</li># <li>Click finish to exit the Virtual Machine Details dialog box.</li></ol> </li> <li value="16">Repeat these steps '''a - g''' for '''fedora2''' and '''fedora3''' VM's.</li></ol>
'''Answer the Investigation 1 observations / questions in your lab log book.'''
{{Admon/note | Use fedora2 | Complete this investigation on your fedora2 VM.}}
# Start '''fedora2''' VM and login
# On your '''fedora host''' run <code>ifconfig</code> and make note of the IP address assigned to the <code>virbr1</code> interface. This will be your default gateway for your Vm's.[[Image:new_network_dialog.png|thumb|350px]]# Make certain to return to your fedora2 VM.# To configure a new interface on fedora2 go to '''SystemApplications'''->'''AdministrationOther'''->'''NetworkConnections''' .# Make certain there are no '''"Wired"''' connections (even if you have to click on the connection name and click the '''Delete''' button.# Create a new wired connection, with the "Connection Name" at the top to read '''eth1'''# Click on the '''NewAdd''' button, and select the '''IPv4 Settings''' tab.# Select Change the method from "Automatic (DHCP)" to '''Ethernet Device"Manual"''' and choose .# In the network card named <code><span style='''Addresses section''', click '''"background-color:yellowAdd">em1</span></code>'''.# Statically Manually set the IP configurationto:
#: IP Address '''192.168.235.12'''
#: Subnet Mask '''255.255.255.0'''
#: Default Gateway '''192.168.235.1''' (The IP address of <code>virbr1</code> on your fedora host.)
# Click on the '''DNS''' tab field and add '''192.168.235.1''' as the primary DNS server.# Select Click '''ForwardSave'''to Finish, and then select '''Apply''' exit the Network Connections dialog box.# Your network connection may connect (view the Network Manager applet in the gnome panel at the top of the screen). If there is no connection after a few minutes, you should be able to right-click on the applet and click "eth1" to connect.# You should be able to use the systemctl command to Finishrestart your network.#'''Restart your network''' on fedora2by issuing the commands:#*<code>systemctl stop NetworkManager. service</code>#*<span style="background-color:yellow"code>systemctl start NetworkManager.service NetworkManager restart</span></code>
# Verify your new interface by examining the output of <code>ifconfig</code>
# To verify that fedora2 has the correct default gateway configured, enter the command : <code>route -n</code># Verify the network by using : <code>ping 192.168.235.1</code>
'''Answer the Investigation 2 observations / questions in your lab log book.'''
{{Admon/note | Use fedora1 | Complete this investigation on your fedora1 VM.}}
{{Admon/note | Backing up Files |One very important aspect of system admin is performing backups. There are many methods for backing up the data on a a computer system.<span style="background-colorbr />The following is an example of a common backup system used in Business Unix/Linux systems:yellow"<br /><br />Explain purpose '''Full Backup''': Backup all specified files (eg. configuration, data files, etc)<br />'''Incremental Backup''': Backup of file backupsonly files that have changed since last (full) backup<br /><br />When the system is required to be fully restored, then the '''full backup''' is recovered, followed by each .<br />In this investigation, you will learn how to perform an '''incremental backup''' using the <code>find</spancode>utility|}}
# Start '''fedora1''' VM and login
#* DNS Server: '''192.168.235.1'''
# Save and exit the network configuration tool.
# Restart the NetworkManagerservice.
# Verify the configuration by pinging fedora host ('''192.168.235.1''') and fedora2 ('''192.168.235.12''')
# To verify that fedora1 has the correct default gateway configured, enter the command <code>route -n</code>
# Use {{Admon/note | Creating an Incremental Backup |We will now be using the <code>find</code> command to locate ::*Locate the configuration files (contained in the <code>/etc</code> directory) that were modified by the GUI network configuration program#:* Copy those configuration files to a "specified" directory for backup purposes Previously, you created a file called <code>/tmp/timestamp</code>that just contains the current date and time prior to running the network configuration toool for fedora2.. Any files that were modified by the GUI network configuration program should have a timestamp later (or newer) than the "timestamp" file you created. All the Linux TCP/IP configuration files are stored under the '''/etc''' directory or its sub-directories. The following <code>find</code> command when run as root will give you a (using the correct options) can be used to only list of all those files that have been recently created since the files under timestamp date contained in the <code>/etctmp/timestamp</code> directory with a file modification date newer than the date of the .|}} <ol> <li value="timestamp8" file>Run the following Linux command:#** <ul> <li><code>find /etc -newer /tmp/timestamp&gt; /root/netcfg.lst</code></li> </ul># Capture </li> <li>View the output to a file called <code>/root/netcfg.lst</code> under user root's home directoryfile.What does it contain?</li># <li>Create a new directory called : <code>/tmp/lab6</code> and copy all the files from </li> <li>Issue the following commands: <ul> <li><code>findmkdir -p /tmp/lab6</code> command to it.</li>#* There are a number of ways to accomplish this:#** Edit <li><code>netcfg.lstfind /etc -newer /tmp/timestamp -exec cp {} /tmp/lab6 \;</code> and turn it into a bash script.</li> </ul> </li>#** Copy <li>View the files manually using contents of the <code>cp/tmp/lab6</code> commanddirectory.What does it contain?</li></ol>#** Investigate {{Admon/tip | Tip | Just for interest, it is relatively simple to automate your backups. You just create a Bash Shell script file using the <code>-execfind</code> option of command above, give the shell script executable permissions, and use the <code>findcrontab</code> command to see how schedule when this script is to be run. If you want to learn more about shell scripting, you can take or refer to find and copy the files with a single commandcourse called '''OPS435''' .}}
'''Answer the Investigation 3 observations / questions in your lab log book.'''
=== Investigation 4: How do I configure the network without a GUI tool?. ===
{{Admon/note | Use fedora3 | Complete this investigation on your fedora3 VM.}}
# Start '''fedora3''' VM and login as root
# Use the command <code>ifconfig</code> to list active interfaces, you should see one with a name of <code><span style="background-color:yellow">em1</span>eth0</code> or a similar name.# To configure your card with a static address use the following command:#* <code>ifconfig eth1 eth0 192.168.235.13 netmask 255.255.255.0</code>
# To configure a default gateway for that interface enter the command:
#* <code>route add default gw 192.168.235.1</code>
#* List the contents of the directory and you should see 2 different types of files, network config scripts and network configuration files.
#* look for the config file for your original interface, it should be named <code>ifcfg-eth0</code>
#* Copy that file to <code>ifcfg-eth1eth<b>N</b></code> or whatever name matches where <b>N</b> relates to your current eth interfacenumber (we will use <b>eth1</b> as an example).
#* Edit the new file for you interface and give it the following settings:
#**GATEWAY=192.168.235.1#**DNS1=192.168.235.1#**DEVICE=<span style="background-color:yelloweth1">em1</span> -- '''<-- or the interface name you YOU have'''#**BOOTPROTOIPADDR=none"192.168.235.13"#**NETMASK="255.255.255.0"#**TYPEGATEWAY=Ethernet"192.168.235.1"#**HWADDR="52:54:00:3f:5c:fa " <-- '''<--use the HWADDR for your YOUR interface'''#**IPADDRDNS1="192.168.235.131" '''#**IPV6INITBOOTPROTO=no"static"#**ONBOOT="yes"#**NM_CONTROLLED="yes"#**USERCTLIPV6INIT="no"# Save the file and then restart the network connection by issuing the commands: <code>ifdown eth1</code> and then <code>NetworkManagerifup eth1</code> service<br /><br ><b>NOTE: </b>If there are errors, check that the hardware address in the config file matches the hardware address of the device its configuring<br /><br />
# Verify your configuration as you did before.
# Finally the kickstart file used to install this VM did not set the hostname. Edit the file <code>/etc/sysconfig/network</code> and set the hostname to <code>fedora3</code>
# Restart the <code>fedora3</code> VM.
# Login and attempt to <code>ssh</code> to your matrix account to verify the settings.
 
'''Answer the Investigation 4 observations / questions in your lab log book.'''
::1 localhost6.localdomain6 localhost6 fedora1
192.168.235.1 f13hostf17host
192.168.235.11 fedora1
192.168.235.12 fedora2
</ol>
'''Answer the Investigation 5 observations / questions in your lab log book.'''
 
== Obtaining MAC Address / Service Port / Firewall Information ==
'''Answer the Investigation 5 observations / questions in your lab log book.'''
=== Investigation 6: How do I collect the MAC (Hardware) addresses of computers on my network? ===
{{Admon/note | Use your Fedora Host | Complete this investigation on your Fedora host.}}
<span style="background-color:yellow">{{Admon/note | Obtaining Remote MAC Addresses| The term '''MAC''' address stands for '''Media Access Control''' address, which provides a unique ID to prevent confusion among computer systems within a network. While we use '''32bit IP addresses addresse'''s to communicate over an internetwork, on the local ethernet network packets are delivered to a '''48bit hardware address ''' (sometimes called a MAC address). The '''ARP ''' protocol resolves 32bit IP addresses to 48bit MAC addresses by using a broadcast and caching the results. We can examine the ARP cache to get the MAC addresses of other computers on our local network.<br /><br /span>Being able to determine remote MAC address information is useful from troubleshooting networking programs to using '''WOL''' (Wake up on Lan) to automatically boot remote workstations via the network. In this investigation, you will learn how to obtain MAC address information for various network cards.}}
# On the fedora host <code>ping</code> each of your VM's
# What was the difference in output?
'''Answer the Investigation 6 observations / questions in your lab log book.'''
'''Answer the Investigation 6 observations / questions in your lab log book.'''
=== Investigation 7: How can I see what network services or ports are active on my Fedora system? ===
{{Admon/note | Network Ports | When our Fedora system provides any services on a network, those services are accessible through a port number. All network services are configured to be accessed on a particular port number. By examining which ports are active on our system we can know what services (and points of attack) are available on our system. The ability to examine this information is important for troubleshooting network services and securing our systems. One great tool for this is the <code>netstat</code> command.}}
# On your fedora host execute the command : <code>netstat -at</code>
# This command will list all active TCP ports. Note the state of your ports.
# TCP is a connection oriented protocol that uses a handshaking mechanism to establish a connection. Those ports that show a state of LISTEN are waiting for connection requests to a particular service. For example you should see the <code>ssh</code> service in a LISTEN state as it is waiting for connections.
# On your fedora host try the command <code>netstat -atn</code>. How is this output different?
# Without the <code>-n</code> option <code>netstat</code> attempts to resolve IP addresses to host names (using /etc/hosts) and port numbers to service names (using /etc/services)
# Examine the <code>/etc/services</code> file and find which ports are used for the services : <code>ssh , ftp , http</code>
# Now execute the command <code>netstat -au</code> What is the difference between <code>-at</code> and <code>-au</code>?
# When examining UDP ports why is there no state?
#* -aun
#* -autnp
 
'''Answer the Investigation 7 observations / questions in your lab log book.'''
=== Investigation 8: How do I view and configure the IPTABLES firewall? -- Basic Function/Configuration ===
 
 
{{Admon/note | Use the f17host | Complete the following steps on your '''f17host''' computer system.}}
 
{{Admon/note | | [http://en.wikipedia.org/wiki/Iptables Iptables] is the built-in firewall for LINUX. While this program can be controlled by different GUI's, we are going to investigate the powerful command line interface for this program to choose what data is allowed into, out of and through our computer.
'''FORWARD''' – LINUX PC's are often used as routers or gateways for other PC's. This means that data may have to be passed through this LINUX box, but the data is not intended for the LINUX PC nor is it being sent by the LINUX PC. Even though the data will go into this PC and it will exit this PC, the INPUT and OUTPUT chains do not apply here. Because the PC is acting as a router it does not actually send or receive data, it FORWARDS data from one machine to another. When this process happens, the data is checked against the FORWARD chain to see if it is allowed through. If it is the router will forward the data to it's destination. If not, the packet is dropped.}}
{{Admon/important | Non-Persistent Changes to your Host System | Complete this lab on your host system (f13hostf16host).
It should be noted that all of the commands that we do here with iptables will not be persistent unless you have your configuration. That means if you re-boot, the default iptables configuration will be loaded.}}
}}
==== Additional Exercises Final Tasks ====
# Using the information you have learned, try on your own to achieve the same goal as above (block www access to your computer) by using the INPUT chain instead of the OUTPUT chain.
{{Admon/note | iptables Service |When your iptables service starts or at boot time it has to load the rules from the file <code>/etc/sysconfig/iptables</code>.}}
# '''Make a backup of the file <code>/etc/sysconfig/iptables</code>'''
# Examine the file to see how rules are added.
# Issue the command: <code>service iptables save</code> to save the rules you added with the iptables command, above.
# Verify that the file <code>/etc/sysconfig/iptables</code> was updated with your new rules.
# Restart your iptables service and test your configuration.
# Write a short bash script to add a rule allowing the fedora1 and fedora3 VM's to connect to <code>ssh</code> on the fedora host.
<ol>
<li value="9">'''Make a backup of the file <code>/etc/sysconfig/iptables</code>'''</li>
<li>Examine the file to see how rules are added.</li>
<li>Issue the command: <code>iptables-save > /etc/sysconfig/iptables</code> to save the rules you added with the iptables command, above.</li>
<li>Verify that the file <code>/etc/sysconfig/iptables</code> was updated with your new rules.</li>
<li>Restart your iptables service and test your configuration. </li>
<li>Write a short bash script to add a rule allowing the fedora1 and fedora3 VM's to connect to <code>ssh</code> on the fedora host.</li>
</ol>
'''Answer the Investigation 8 observations / questions in your lab log book.'''
== New Configuration ==
<span style="background-color:yellow">Now you should have the following network configuration:</span><br /><br />
[[Image:network-config2.png]]
* '''Fedora host''' has 1 active network interface (probably <code><span style="background-color:yellow">em0</span>'''em1'''</code>)that receives IP configuration from the School's DHCP server.* '''Fedora host''' has 1 active network interface (<code>'''virbr1'''</code>) that has a static default configuration of '''192.168.235.1/255.255.255.0'''* '''Fedora1''' VM has 1 active interface (<code><span style="background-color:yellow">em1</span>1'''eth1'''</code>) that has a static configuration of '''192.168.235.11/255.255.255.0'''* '''Fedora2''' VM has 1 active interface (<code><span style="background-color:yellow">em1</span>'''eth1'''</code>) that has a static configuration of '''192.168.235.12/255.255.255.0'''* '''Fedora3''' VM has 1 active interface (<code><span style="background-color:yellow">em1</span>'''eth1'''</code>) that has a static configuration of '''192.168.235.13/255.255.255.0'''
# Contents of <code>/tmp/lab6</code> directory.
# Fresh backup of the virtual machines.
# Run your bash script to allow VM's to access <code>ssh</code> on your fedora host.
 == Preparing for the Quizzes ==
# What is a port?
13,420
edits