Difference between revisions of "OPS335 - Assignment 1 (Part 1)"

From CDOT Wiki
Jump to: navigation, search
(Assignment Evaluation Details)
(General Requirements)
(44 intermediate revisions by 3 users not shown)
Line 7: Line 7:
 
'''Weight''': '''3%''' of the overall grade
 
'''Weight''': '''3%''' of the overall grade
  
'''Due Date''': During '''Week 5''' (in class)
+
'''Due Date (Winter 2019)''': During '''Week 4''' (in class)
  
 
== Detailed Requirements ==
 
== Detailed Requirements ==
Line 16: Line 16:
  
 
* Assign a newly-created virtual network the name: '''335assign''', and set '''forwarding to any physical device'''<br>(refer to [http://zenit.senecac.on.ca/wiki/index.php/OPS335_Installation_Lab#INVESTIGATION_2:_VIRTUAL_MACHINE_INSTALLATION lab setup]. You can have have 2 different network names: "335assign"  and "ops335" without causing any problems).
 
* Assign a newly-created virtual network the name: '''335assign''', and set '''forwarding to any physical device'''<br>(refer to [http://zenit.senecac.on.ca/wiki/index.php/OPS335_Installation_Lab#INVESTIGATION_2:_VIRTUAL_MACHINE_INSTALLATION lab setup]. You can have have 2 different network names: "335assign"  and "ops335" without causing any problems).
* Addresses in this network will start with '''172.17.40'''. The subnet mask must be '''255.255.255.0'''
+
* Addresses in this network will start with '''172.19.1'''. The subnet mask must be '''255.255.255.0'''
 
* There must '''<u>NOT</u>''' be a DHCP server running for this network!
 
* There must '''<u>NOT</u>''' be a DHCP server running for this network!
 
* All the machines for this assignment will be connected to your newly-created virtual network called: '''335assign'''
 
* All the machines for this assignment will be connected to your newly-created virtual network called: '''335assign'''
Line 26: Line 26:
 
Details for the cloning-source
 
Details for the cloning-source
  
#The name of this cloning-source VM will be called: '''minnow'''.
+
#The name of this cloning-source VM will be called: '''blofeld'''.
#You should use the options that you used in your lab1 to setup the static network, plus you should use the DOMAIN parameter to set the '''species.lake.ops''' domain for your cloning-source.
+
#You should use the options that you used in your lab1 to setup the static network, plus you should use the DOMAIN parameter to set the '''bond.villains.ops''' domain for your cloning-source.
 
#The VM should have a command-line interface only.
 
#The VM should have a command-line interface only.
 
#Configure it to be a good cloning-source, '''making certain that the cloning-source has all the following elements prior to cloning:'''
 
#Configure it to be a good cloning-source, '''making certain that the cloning-source has all the following elements prior to cloning:'''
 
::*Don't make the virtual drive too big: you will need space for it as well as space for the clones you from your cloning-source<br>('''5 GB''' should be enough for any cloning-source and clone VM that you create for this assignment).
 
::*Don't make the virtual drive too big: you will need space for it as well as space for the clones you from your cloning-source<br>('''5 GB''' should be enough for any cloning-source and clone VM that you create for this assignment).
::*The hostname for this server will be called: '''minnow'''
+
::*The hostname for this server will be called: '''blofeld'''
 
::*Make certain that you can login to your cloning-source.
 
::*Make certain that you can login to your cloning-source.
 
::*Configure your network interface for this cloning-source with a '''static''' configuration and is connected to the '''335assign''' network. Refer to the table below for IP address and hostname.<br>
 
::*Configure your network interface for this cloning-source with a '''static''' configuration and is connected to the '''335assign''' network. Refer to the table below for IP address and hostname.<br>
Line 42: Line 42:
 
|-
 
|-
 
| style="background-color:#66cccc; border: 2px solid black;" |  (your existing host / source)  
 
| style="background-color:#66cccc; border: 2px solid black;" |  (your existing host / source)  
| style="background-color:#66cccc; border: 2px solid black;" |  External Facing Address:''' DHCP assigned'''<br>Internal Virtual Bridge (virbr1):''' 172.17.40.1'''  
+
| style="background-color:#66cccc; border: 2px solid black;" |  External Facing Address:''' DHCP assigned'''<br>Internal Virtual Bridge (virbr1):''' 172.19.1.1'''  
 
| style="background-color:#66cccc; border: 2px solid black;" |  Your '''host''' machine
 
| style="background-color:#66cccc; border: 2px solid black;" |  Your '''host''' machine
  
 
|-
 
|-
| style="background-color:#66cccc; border: 2px solid black;" |  '''minnow.species.lake.ops'''  
+
| style="background-color:#66cccc; border: 2px solid black;" |  '''blofeld.bond.villains.ops'''  
| style="background-color:#66cccc; border: 2px solid black;" |  '''172.17.40.100'''   
+
| style="background-color:#66cccc; border: 2px solid black;" |  '''172.19.1.100'''   
 
| style="background-color:#66cccc; border: 2px solid black;" |  '''Cloning-source''' used to create other servers for other assignments.
 
| style="background-color:#66cccc; border: 2px solid black;" |  '''Cloning-source''' used to create other servers for other assignments.
 
|}
 
|}
Line 53: Line 53:
  
  
<ol><li value="5">Make certain your cloning-source can connect to the Internet using the newer static configuration.</li><li>Run a '''yum update''' for this cloning-source.</li><li>Make certain that SELinux is set to '''enforcing'''.</li><li>Set up an SSH server on this "cloning-source".</li><li> Make sure that '''PermitRootLogin''' is set to '''yes''' for this server.</li><li>Make certain that only the root account is permitted to login using key authentication. If other users are required to be created in a later assignment, they should be permitted to log in with their username and password.</li><li>Copy the same public key (already generated for your '''Host Machine''' for your '''root''' account in lab1) to the '''root''' account on your cloning-source.</li><li>Test to make certain that you can login from root on your host machine to your root account on the cloning-course ("minnow") without being prompted for a pass-phrase.</li><li>If you have created a '''regular user''' when you installed this machine, '''delete that regular user''' (make certain to '''remove the regular user's home directory!''').</li></ol>
+
<ol><li value="5">Make certain your cloning-source can connect to the Internet using the newer static configuration.</li><li>Run a '''yum update''' for this cloning-source.</li><li>Make certain that SELinux is set to '''enforcing'''.</li><li>Set up an SSH server on this "cloning-source".</li><li> Make sure that '''PermitRootLogin''' is set to '''yes''' for this server.</li><li>Make certain that only the root account is permitted to login using key authentication. If other users are required to be created in a later assignment, they should be permitted to log in with their username and password.</li><li>Copy the same public key (already generated for your '''Host Machine''' for your '''root''' account in lab1) to the '''root''' account on your cloning-source.</li><li>Test to make certain that you can login from root on your host machine to your root account on the cloning-course ("blofeld") without being prompted for a pass-phrase.</li><li>If you have created a '''regular user''' when you installed this machine, '''delete that regular user''' (make certain to '''remove the regular user's home directory!''').</li></ol>
  
 
=== Set-up Firewall Rules for your Cloning-Source===
 
=== Set-up Firewall Rules for your Cloning-Source===
Line 67: Line 67:
 
:::<li>The host machine (and <b>only</b> the host machine) must be able to ssh to that cloning-source VM.</li>
 
:::<li>The host machine (and <b>only</b> the host machine) must be able to ssh to that cloning-source VM.</li>
 
:::<li>ICMP traffic is allowed if it originated with the <b>local network only</b>.</li>
 
:::<li>ICMP traffic is allowed if it originated with the <b>local network only</b>.</li>
:::<li>As this is acting as the secure basis for later machines, no other traffic should be allowed.</li>
+
:::<li>As this is acting as the secure basis for later machines, no other traffic should be allowed, and no response should be sent if any other traffic is received.</li>
 
::</ul>
 
::</ul>
  
Line 90: Line 90:
 
*'''Demonstrate working assignment to your instructor in class:'''<ol type="a"><li>Students need to demonstrate their assignment functionality to their professor during a lab period (like you would for any lab for "sign-off").</li><li>Students are required to prepare everything ahead of time so that you can quickly demonstrate to your instructor that all required parts of your assignment are working.</li><li>'''Do not proceed to the next step''' until you have demonstrated your assignment to your instructor to check for errors that may cause problems when running the checking script.<br><br></li></ol>
 
*'''Demonstrate working assignment to your instructor in class:'''<ol type="a"><li>Students need to demonstrate their assignment functionality to their professor during a lab period (like you would for any lab for "sign-off").</li><li>Students are required to prepare everything ahead of time so that you can quickly demonstrate to your instructor that all required parts of your assignment are working.</li><li>'''Do not proceed to the next step''' until you have demonstrated your assignment to your instructor to check for errors that may cause problems when running the checking script.<br><br></li></ol>
  
*Download and run a shell script to check your work (Depending on your OPS335 Instructor):
+
*Download and run a shell script to check your work:
  
 
+
<ol><li>Login as '''root''' on your '''host''' machine.</li><li>Change to the '''/root/bin''' directory.</li><li>Make certain that your '''cloning-source VM is running'''.</li><li>Make certain that the mailx command has been installed. If not, issue the following command to install e-mail on your '''host''' machine:<source>yum install mailx </source><li>Issue the command to download a checking script for your assignment to your '''host''' machine:<span style="font-family:courier;font-size:1.5em;color:#4d4dff
::'''Peter Callaghan's Classes''' (Section '''D'''):<ul><li>Refer to instruction on blackboard for instructions on how to submit this assignment.</li></ul>
+
">wget https://matrix.senecacollege.ca/~peter.callaghan/files/OPS335/check-assn1-p1.bash</span><br><br>Set execute permissions and run the shell script.<br>(Your shell script contents will be mailed to your OPS335 instructor's Seneca email, and a confirmation message will be emailed to you.<br><br>If you do '''NOT''' receive an e-mail message in your Seneca email account, then there is a problem, and you '''MUST''' rerun or contact your OPS335 instructor immediately.
 
 
 
 
::'''Murray Saul and Colin Yips Classes''' (Sections '''A''' , '''B''' &amp; '''C'''):<ol><li>Login as '''root''' on your '''host''' machine.</li><li>Change to the '''/root/bin''' directory.</li><li>Make certain that your '''cloning-source, primary DNS and secondary VMs are running'''.</li><li>Make certain that the mailx command has been installed. If not, issue the following command to install e-mail on your '''host''' machine:<source>yum install mailx </source><li>Issue the command to download a checking script for your assignment to your '''host''' machine:<br><br>'''Murray Saul's classes (section A):''' wget &nbsp; <span style="text-decoration:none;">https://matrix.senecacollege.ca/~murray.saul/ops335/check-assn1-p1-murray.bash</span>'''<br><br>'''Colin Yip's classes (Section B &amp; C):''' '''TBA'''<br><br>Set execute permissions and run the shell script.<br>(Your shell script contents will be mailed to your Seneca email and to your OPS335 instructor's Seneca email.<br><br>If you do '''NOT''' receive an e-mail message in your Seneca email account, then there is a problem, and you '''MUST''' rerun or contact your OPS335 instructor immediately.
 
  
 
==Evaluation Rubric==
 
==Evaluation Rubric==
Line 130: Line 127:
 
| width=10% style="text-align:right;font-weight:bold" | Mark
 
| width=10% style="text-align:right;font-weight:bold" | Mark
 
|-
 
|-
| Hostname set to: '''minnow''' only, domain name '''species.lake.ops''' set as a network parameter   
+
| Hostname set to: '''blofeld''' only, domain name '''bond.villains.ops''' set as a network parameter   
 
| style="text-align:right" | /1
 
| style="text-align:right" | /1
 
|-
 
|-
Line 157: Line 154:
 
| style="text-align:right" | /1
 
| style="text-align:right" | /1
 
|-
 
|-
| iptables - Other unexpected '''INPUT''' traffic is blocked
+
| iptables - Other unexpected '''INPUT''' traffic is blocked without response
 
| style="text-align:right" | /1
 
| style="text-align:right" | /1
 
|-
 
|-
| iptables - all '''FORWARD''' traffic is blocked
+
| iptables - all '''FORWARD''' traffic is blocked without response
 
| style="text-align:right" | /1
 
| style="text-align:right" | /1
 
|-
 
|-
Line 170: Line 167:
 
|-
 
|-
 
| Backup script '''assnBackup.bash''' structure
 
| Backup script '''assnBackup.bash''' structure
| style="text-align:right" | /2
+
| style="text-align:right" | /1
 +
|-
 +
| Use of '''PV''' command for backup script
 +
| style="text-align:right" | /1
 
|-
 
|-
 
| Proof that '''VM full backup''' was run
 
| Proof that '''VM full backup''' was run

Revision as of 11:07, 20 January 2019

Purpose

For this portion of assignment 1, you will set up the basic functionality for a virtual machine to act as a cloning-source to make it easier for the student to create other servers (VMs) in later assignments. Whenever you clone another server (in later assignments), you MUST make certain to configure the cloned server in order to make it function in the network correctly and meet the requirements of future assignments. All of the assignments for this course are interdependent of each other and belong to the same Virtual Private Network called 335assign.

General Requirements

Weight: 3% of the overall grade

Due Date (Winter 2019): During Week 4 (in class)

Detailed Requirements

Set-up a Virtual Network (335assign)

Create a new virtual network on your Host Machine.

  • Assign a newly-created virtual network the name: 335assign, and set forwarding to any physical device
    (refer to lab setup. You can have have 2 different network names: "335assign" and "ops335" without causing any problems).
  • Addresses in this network will start with 172.19.1. The subnet mask must be 255.255.255.0
  • There must NOT be a DHCP server running for this network!
  • All the machines for this assignment will be connected to your newly-created virtual network called: 335assign

Create a "Cloning-Source" VM (335assign Virtual Network)

Create a virtual machine that you will use as a cloning-source.

Details for the cloning-source

  1. The name of this cloning-source VM will be called: blofeld.
  2. You should use the options that you used in your lab1 to setup the static network, plus you should use the DOMAIN parameter to set the bond.villains.ops domain for your cloning-source.
  3. The VM should have a command-line interface only.
  4. Configure it to be a good cloning-source, making certain that the cloning-source has all the following elements prior to cloning:
  • Don't make the virtual drive too big: you will need space for it as well as space for the clones you from your cloning-source
    (5 GB should be enough for any cloning-source and clone VM that you create for this assignment).
  • The hostname for this server will be called: blofeld
  • Make certain that you can login to your cloning-source.
  • Configure your network interface for this cloning-source with a static configuration and is connected to the 335assign network. Refer to the table below for IP address and hostname.
Hostname / Domain Address Purpose
(your existing host / source) External Facing Address: DHCP assigned
Internal Virtual Bridge (virbr1): 172.19.1.1
Your host machine
blofeld.bond.villains.ops 172.19.1.100 Cloning-source used to create other servers for other assignments.


  1. Make certain your cloning-source can connect to the Internet using the newer static configuration.
  2. Run a yum update for this cloning-source.
  3. Make certain that SELinux is set to enforcing.
  4. Set up an SSH server on this "cloning-source".
  5. Make sure that PermitRootLogin is set to yes for this server.
  6. Make certain that only the root account is permitted to login using key authentication. If other users are required to be created in a later assignment, they should be permitted to log in with their username and password.
  7. Copy the same public key (already generated for your Host Machine for your root account in lab1) to the root account on your cloning-source.
  8. Test to make certain that you can login from root on your host machine to your root account on the cloning-course ("blofeld") without being prompted for a pass-phrase.
  9. If you have created a regular user when you installed this machine, delete that regular user (make certain to remove the regular user's home directory!).

Set-up Firewall Rules for your Cloning-Source

Perform the following steps for this section:

  1. Make certain that you have iptables services enabled and running instead of Firewalld.
  2. Modify the iptables to meet the following conditions:
  • All outgoing traffic is allowed.
  • Responses to any traffic the machine sends out are allowed.
  • Traffic on the loopback interface is allowed.
  • The host machine (and only the host machine) must be able to ssh to that cloning-source VM.
  • ICMP traffic is allowed if it originated with the local network only.
  • As this is acting as the secure basis for later machines, no other traffic should be allowed, and no response should be sent if any other traffic is received.

Create Full and Incremental Backups of cloning-source VM

Perform the following steps for this section:

  1. This task is to be performed in your host machine.
  2. Issue the command su -
  3. Create a Bash shell script called /root/bin/assnBackup.bash to perform a full backup using the gzip command to backup the entire file system of your cloning-source VM to save the compressed copy to the directory path: /backup/full/).
  4. This shell script should store each of any number of VM image files in the /var/lib/libvirt/images directory that has the extension ".qcow2". In this way, this shell script will safely backup any new VMs that are created later in this course, yet backup the existing labs and assignment VMs.
  5. Perform a Net-search to use the pv (pipe-viewer) command to show a text-based indicator of backup for EACH VM image file. You need to add the EPEL repository to install the pv command.
  6. Set execute permissions for this script, and run this Bash shell script prior to exiting your assignment work session to properly backup your cloning source. You should also make a copy of the backup on an external device (such as a USB key).
  7. Set-up via a crontab entry, an incremental backup of the /etc/ directory of your cloning-source to be performed every hour to the /backup/incremental/cloning-source directory.

Assignment Submission

The student is required to prove to their professor that their set-up works correctly during the regularly-scheduled lab period.

Assignment Evaluation Details

  • Demonstrate working assignment to your instructor in class:
    1. Students need to demonstrate their assignment functionality to their professor during a lab period (like you would for any lab for "sign-off").
    2. Students are required to prepare everything ahead of time so that you can quickly demonstrate to your instructor that all required parts of your assignment are working.
    3. Do not proceed to the next step until you have demonstrated your assignment to your instructor to check for errors that may cause problems when running the checking script.

  • Download and run a shell script to check your work:
  1. Login as root on your host machine.
  2. Change to the /root/bin directory.
  3. Make certain that your cloning-source VM is running.
  4. Make certain that the mailx command has been installed. If not, issue the following command to install e-mail on your host machine:
    yum install mailx
  5. Issue the command to download a checking script for your assignment to your host machine:wget https://matrix.senecacollege.ca/~peter.callaghan/files/OPS335/check-assn1-p1.bash

    Set execute permissions and run the shell script.
    (Your shell script contents will be mailed to your OPS335 instructor's Seneca email, and a confirmation message will be emailed to you.

    If you do NOT receive an e-mail message in your Seneca email account, then there is a problem, and you MUST rerun or contact your OPS335 instructor immediately.

    Evaluation Rubric

    Here is an evaluation rubric (in table form) showing you how you will be evaluated for this assignment. Part of the rubric is marked from professor observation from student demonstration of assignment in class, and the other part is based on output from the results of an assignment checking script that the student will download and run.

    Student Demonstration (in class)
    Evaluation Item Mark
    Created Virtual Network: 335assign
    (correct settings)
    /1
    Can ping cloning-source from host machine with correct IPADDR /1
    root account on host machine can connect to cloning-source VM via ssh application without password /1
    cloning-source VM can connect to the Internet
    (i.e. ping 8.8.8.8)
    /1
    cloning-source can SSH to student's Matrix account /1
    Configuration (Checking Script Output)
    Evaluation Item Mark
    Hostname set to: blofeld only, domain name bond.villains.ops set as a network parameter /1
    yum update performed /1
    No regular users on cloning source (just root) /1
    SELinux status set to: enforcing /1
    firewalld stopped and inactive /1
    iptables active and enabled /1
    iptables - All outgoing traffic is allowed /1
    iptables - The host machine (and only the host machine) must be able to ssh to the cloning-source /1
    iptables - ICMP traffic is allowed if it originated with the local network only /1
    iptables - Other unexpected INPUT traffic is blocked without response /1
    iptables - all FORWARD traffic is blocked without response /1
    correct static network configuration for cloning-source VM
    (half mark for each network config item)
    /5
    permitRootLogin set to yes for cloning-source VM /1
    Backup script assnBackup.bash structure /1
    Use of PV command for backup script /1
    Proof that VM full backup was run /2
    Crontab entries executed properly /2
    Incremental Backup of /etc/ directory of cloning-source to /backup/incremental/cloning-source directory /2
    TOTAL /30
    OPS335 - Assignment 1 (Part 1)