= INVESTIGATION 1: BASIC NETWORK CONFIGURATION = OBJECTIVE & PREPARATION==In OPS235, you learned how to configure a virtual private network for your '''vm1''', '''vm2''' and '''vm3''' virtual machines. You were required to configure a static network connection for your VMs. In OPS335, you will also be setting up a static network connection for all of your VMs (which all VMs will be text-based). All of the services that we install and configure for this course '''require a working network connection'''; therefore, it is very important that you know how to configure a network connection for your VMs, whether via command line for trouble-shooting purposes, or to create a persistent (permanent) network connection that uses static IP address (REVISITEDas opposed to DHCP) =.

Remember how you set up This lab is a <u>review</u> of the network interfaces in your virtual machines in OPS235? You're expected to know that ''"insidematerial from labs 6 ( [http://zenit.senecac.on.ca/wiki/index.php/OPS235_Lab_6_-out"'' by now_CentOS7#Part_4:_Configuring_VM_Network_Setup_via_Command_Line_.28centos3.29 CLI Network Configuration] ), but will also additional topics.

In OPS235, you learned how to configure a virtual private network via graphical applications for the '''centos1''' and '''centos2''' machines*[https://www.tty1. In the previous lab, you have created and cloned VMs that are textnet/blog/2010/ifconfig-ip-based only ('''like centos3''')comparison_en. All of the services that we are configuring in this course require a working network connection; therefore, it is very important that you know html ip vs ifconfig]*[https://www.digitalocean.com/community/tutorials/how -to set (preferable configure) -use-rsync-to-sync-local-and-remote-directories-on-a static IP address, default gateway, as well as your DNS server-vps rsync Howto]*[https://help.ubuntu.com/community/CronHowto Cron HowTo]

This lab is a <u>review</u> of the material from labs 6 ( [http== INVESTIGATION 1://zenit.senecac.on.ca/wiki/index.php/OPS235_Lab_6_-_CentOS7#Part_4:_Configuring_VM_Network_Setup_via_Command_Line_.28centos3.29 CLI Network Configuration] ), but will also show newer BASIC NETWORK CONFIGURATION (more efficientREVISITED) commands in the process.==

=== Checking Your Current Network Settings ===

In OPS235 , you've have used the '''ifconfig''' and '''route ''' commands. In this course we'll use the '''ip''' command instead (, so that you're welcome to use the old ll be familiar with both sets of commands but you're expected to know the new ones too).

# View the table below comparing ''older '' vs ''newer '' methods of obtaining network setting information for a Linux machine.

<tr> <td>Obtain Hostname</td><th>uname -n</th><th>Sameuname -n</th></tr> <tr> <td>See MAC cache</td><th>arp -n</th><th>ip neighbour</th></tr>

<ol><li value="2">Run the '''ifconfig''' command on your '''host''' machine. Check and record the IPADDR for your default (dhcp) network interface card (possibly eno1) and the virtual bridge.</li><li>Issue the '''ip address''' commands separatelycommand on your '''host''' machine to determine the IPADDR and GATEWAY information (refer to above chart). Do you notice any differences between their respective outputsHow are the result similar or different than the ifconfig command?</li><li>Repeat the same steps for other two sets of commands listed in Issue the tableifconfig command on your VMs.what happened?</li><li>Which commands do you prefer Use the '''ip''' command for your VMs to use?list the IPADDR and GATEWAY information.</li><li>Use Refer to the man pages or refer to following article [http://www.tecmint.com/ip-command-examples/ 10 Useful ip Commands] to see how to issue the above commands to create a <u>temporary</u> connection to your existing network.</ol>

== Making Persistent In your OPS235 course, you used a series of commands (Permanentifconfig, route, and nameserver) Network Setting Changes == If you change your to setup a temporary network settings using connection. You can use the commands ip command (a another command) in the previous section, a similar way to create a temporary network connection. The problem with this network connection method is that those changes will be lost if you restart your Linux machine, although you may want to do that to create a temporary network connection for troubleshooting purposes.

For the IP address, subnet mask, default gateway, and DNS server you edit that file is contained in a directory called: '''network-scripts'''.

# From Change to the ''network-scripts'' directory (see your ''OPS335''/''OPS235''/''ULI101'' notes, issue a command to provide the full path-name of the directory: ''network-scripts''# Why do you think that previously issued command can be useful when you want to edit your exiting network settings?).# The name of the file that contains your persistent network settings has the following name format: <br>'''ifcfg-{''interfacename}'''''# Which filename file-name in your network-scripts directory do you think contains your current network settings?# View the contents of the file to see if it contains the IP ADDRESSaddress, subnet mask, and default gateway?.

== Set Except for your host machine, all the Virtual Machines in this course will have '''static IP addresses on vm1, vm2network configuration''' (as opposed to Automatic or DHCP). Sometimes, and vm3 ==you will be required to debug networking problems quickly by changing the network configuration of your VMs.

# Edit each of your VMs If you are uncertain how to use a static IP address: vm1 should use the first available address in the subnet, vm2 the secondperform those above-listed operations by member, and vm3 the third.# Don't forget take time to set the default gateway and DNS server for your VMs. You can use your host's IP address as a DNS server (libvirt will proxy the requests to the real DNS server).# Make note of the files used and entries required and note practice them in your lab log-book.# Restart each VM If everything works and run the following command to ensure they still have the network configuration you set:::'''ping''' (what is the purpose of this command?). Try are comfortable with these operations then you may proceed to ping matrix and google from your host machine. Try to ping matrix and google from each of your VM's to ensure you can reach the outside worldnext section.::'''ssh''' (into another server, like Matrix)

If the network works in your host, but not in your Virtual Machine, you are uncertain how to should perform those above-listed operations by member, take time to practice them.If everything works and you are comfortable with these operations then you may proceed the following routine steps to troubleshoot the next section.network connection:

== Linux There are a number of other problems that could prevent your network connection configuration troubleshooting ==from functioning but the above are the most common problems.

If the network works in your host but not in the VM, the following are the usual steps you go through ==== Run Script to troubleshoot the problem, starting with the first two rules of troubleshooting:Break Network Connection for Troubleshooting ====

# '''Is it plugged in?''' On a physical network you would check whether the cable is plugged in You will now download, set execute permissions and the link light is on on your network card. In run a virtual network environment you don't have that - you'll need Bash shell script to try to check the NIC settings in "break" the virtual machine details. In there it will tell you which virtual network connection for your virtual network card is connected tovm1.# '''Is it turned on?''' This is a problem more common with virtual networks than physical networks. Check in your VirtManager->ConnectionDetails->VirtualNetworks that your network is active.# '''Do you have an IP address?''' Run '''ip address''' will provide troubleshooting practice to check.# '''Can you ping the host by IP?''' (by its internal IP address). If not - check all of the above, check if you have an IP address conflict, check that your subnet mask is correct.# '''Can you ping 8.8.8.8?''' If all of the above work - check that your default gateway is set correctly with '''ip route''' and that you can ping the default gateway.# '''Can you resolve google.ca?''' Run '''host google.ca'''. If it doesn't come back with an IP addressnetwork configuration file, look and all of the above worked - check that your DNS server is configured correctly correct errors and that you can ping it.<br>There are a number of other problems that could prevent restart your network interface connection from functioning but the above are the most common problems.

<ol><li value="7">Move to your vm1 in order to perform Perform the following trouble-shooting taskFollowing Steps:<ol type="a"><li>Use the '''wget''' command to download and run the following shell script:<br>[ link shell script here ]<br><br></li><li>after you have run that shell script, restart your vm1 machine.</li><li>Use the commands taught in this lab to confirm if your network connection is broken.</li><li>Carefully check your configuration to see if there is a change to your settings</li><li>Try to temporarily connect to the Internet</li><li>Edit your network settings file to make the changes permanent</li><li>Test your connectivity (including after a reboot of your vm1.<br><br></li></ol></li></ol><ol><li value="8">'''Note:''' You should be able to go through that troubleshooting process pretty quickly. Setting up the network in this course is never a primary task, but it's almost always a prerequisite for anything else we're going to do. You can't have a working web server (or any other kind of server) if you don't have a working network connection.</li></ol>

'''Record stepsNote:''' You should be able to go through that troubleshooting process pretty quickly. Setting up the network in this course is never a primary task, commands, and your observations in INVESTIGATION 1 in your OPS335 lab log-bookbut it's almost always a prerequisite for anything else we're going to do. You can't have a working web server (or any other kind of server) if you don't have a working network connection.

= '''Record steps, commands, and your observations in INVESTIGATION 2: ADDITIONAL ESSENTIAL SKILLS / BACKUPS =1 in your OPS335 lab log-book'''

== INVESTIGATION 2: Configuring SSH Server ==

The default (and often the onlyway) way to administer a linux Linux server is via SSH. Even if you work in your case where you have a direct console to all your VM screens you may find graphical Linux environment, it helpful is very useful to connect open a terminal and use SSH to monitor and manage your virtual machines using SSH VMs (if nothing else - you can resize the terminal window). Using SSH to connect to remote servers on a network helps to protect your Linux machine from being penetrated. You can also generate a private and public encryption key for the root user, and copy that public key from your host to your VMs in order to allow certain backup programs to run via a scheduling daemon (called cron) without having to be required to enter the password for the remote machine. You will be doing those operations later in this lab.

The SSH server should already be installed and running in your VMs. If it's not installed - , you can install '''openssh-server''' using yum. Whether it It is running or not - you should practice the following commands essential for CNS/CTY students to make sure become comfortable managing services since you know how will need to use themconstantly stop services, change their configuration, you'll need and start them for the configuration changes to take effect in nearly every topic this semester:, and for other courses involving Linux network management.

# Note the following [http://zenit.senecac.on.ca/wiki/index.php/Init_vs_systemd#systemd_Command_Usage systemctl] commands (refer to man pages or the Internet) to learn how to use and become comfortable using them.:

<ol><li value="2">Launch your '''vm2''' machine, loginto the machine, and open a shell terminal.</li><li>Use one of the commands above to check the status of your SSH server(i.e. service: ''sshd'').></li><li>Now, issue Issue one of the above commands to stop of the ssh server and run a command to verify that the ssh server is no longer running.</li><li>Issue another one of the above commands to start the SSH server and to verify that it is running.</li><li>Issue a command not listed above to confirm that the ssh service will run upon when the next vm1 startupvm2 server restarts (i.e. "enabled").</li></ol> ===Configuring the SSH Service=== A common (if somewhat blatant) way to try to hack into a machine is to try to ssh as '''root''' and brute-force root's password. The root user always exists, meaning the attacker doesn't need to try guessing what user names are on your system. If they can get access to root, they can do anything. To prevent this, we will edit the configuration file for the ssh service to prevent root from ssh'ing into your host machine.

#Login to your Centos '''host''' machine for the following steps.#Use the more command to display '''/etc/ssh/sshd_config''' on your host. This file contains the configuration parameters for the ssh service.#Take a few moments to view this file. Lines that begin with # are comments. Either simple explanations of parameters, or parameters that have not been set.#Open the man page for '''sshd_config'''. This lists all the possible parameters in alphabetical order along with a brief explanation of what each one does. The diagram displayed parameter we are looking for is '''PermitRootLogin''', read its description.#Use a text editor to edit the file '''/etc/ssh/sshd_config''', and find the line that has '''PermitRootLogin'''. By default it is set to yes, allowing the root user to ssh in to the machine.# Uncomment '''PermitRootLogin''', and change the value to '''no'''.#Try to use ssh from one of your VMs to log into your host as root. What happened?#This is because (for most services) the '''changes you make to the configuration file will not take effect until the service restarts'''.#Restart the sshd service on your host and try to ssh in again. Now it should prevent you.#The option '''PermitRootLogin''' for '''all of your VMs''' for both labs and assignments MUST be set to '''yes'''. The reason for this is that you have created a virtual network, so you have protected the host from root login, so you don't have to do the same for your VMs. Also, by allowing root login for your VM's will allow you to automatically backup your VMs to your host machine (via a crontab entry) without being prompted for a root password for each VM. '''Note:''' Configuration files for most services follow a very similar format. Some use an = between the parameter and its value, some require you to group certain parameters together, and most use # to be a comment. You will get lots of experience working with the right configuration files for services in this course. === SSH Key Concepts=== After performing lab7 in OPS235, you should have a basic understanding of ssh and public/private key cryptography to create secure connections between servers.<br>The public key can be "shared" with other server accounts, and can be used in conjunction with your private key in order to help encrypt/de-crypt data.  The diagram below is shared from [http://sebastien.saunier.me/blog/2015/05/10/github-public-key-authentication.html Sébastien Saunier's blog].

This needs to be generated on and used on # Make certain you are in your '''clienthost''' machine .# You will be creating a '''key-pair on your host machine with no password''' (i.e. when generating keypair press enter for all prompts including the user/machine password).#Make certain youare logged on as 're connecting ''root'from''')on your host machine.The private # Generate the key is -pair by issuing the equivalent of a command:<ubr>''password''</u> (that it why it is considered to be <u>''private''</usource> ssh-keygen - only to be used by ''<u>onet rsa</usource>'' owner).That is why the private key is stored in the owner's '''~/.ssh/''' directory.

You generate a new keypair '''NOTE:''' When issuing this command, you will end up with the files: '''~/.ssh/id_rsa''' and '''~/.ssh/id_rsa.pub''' (private and public keys). So far, this command topic is generally a repeat of OPS235 lab7. What you may '''<u>not</u>''' know is that by using a '''"trick"''' (press enter for all the questions''magic'' of public key cryptography):, you can SSH to a Linux machine without using a password! Learning to perform this trick is <u>'''essential'''</u> in this course and in the industry in general. SSH keys are used everywhere that Linux servers are used.

<source lang="bash">If you have the private key, you can prove to someone who has your public key that you are indeed the '''actual owner of that public key'''. That is how ssh-keygen -t rsa</source>key authentication works. You are then only required to transfer your public key to a remote server.

When issuing this command, you will end up <ol><li value="5">You are going to share the public key from the '''root user in your host machine''' with the files: '''root user of your vm1 machine'''.</li><li>Copy the contents of your '''~/.ssh/id_rsa.pub''' from your host machine and append to '''~/.ssssh/authorized_keys''' on each of your Virtual Machines. In your case, you will issue the following command 3 times (for each vm IPADDR):<br><source>ssh-copy-id -i ~/.ssh/id_rsa.pubroot@IPADDR_for_vm</source>'''NOTE:''' Press ENTER for all prompted information including the password (private although this may seen counter-intuitive!).<br><br></li><li>Use the ssh command to test each ssh connection between your host and public keys)each virtual machine that you can connect to the VMs without having to use a password. This is essential to create backups from VMs to your hostmachine without being prompted for password.</li></ol>

==== Sharing your {{Admon/important|Errors in Copying Public Key from Host to VM|If you experience an error when copying the public key on a Remote server ====from your hostmachine to your VM, it is most likely caused from not permitting root login that you performed in the previous section. Set to allow login from root for each vm, restart your sshd service and then re-run the above command.}}

What you may '''NOTE:''' Always remember that these keys are '''per-user, <u>not</u>per machine''' know is . This means that by using sharing a user'''"trick"''' (the ''magic'' of s public key cryptography), you can SSH to a Linux machine without using a password!Learning to perform this trick is <u>'''essential'''</u> in this course and in the industry in general. SSH keys are used everywhere will only work for that Linux servers are usedspecific user.

You can do When performing labs or assignments in this two ways:<ul><li>Copy contents class, if you fail to make backups and something bad occurs and there is loss of your '''~/data, it only affects you.ssh/id_rsa.pub''' from your host machineOn the other hand, if you are supporting a client, or working for a company and append the contents fail to '''~/.ssh/authorized_keys''' on each adequately perform backups and there is loss of your Virtual Machine servers</li><li>Simply issue the Linux command '''ssh-copy-id -i ~/.ssh/id_rsadata, then other users are affected by failure to backup essential data.pub username@server'''</li></ul>

After you perform either A full backup represents backing up of those operationsall of the files of a computer machine (in our case, you can then ssh into a remote vm without a passwordVM).NOTE: Always remember that these keys are '''per-user, <u>not</u> per machine'''. This means that sharing a user's public key will only work for that specific userA full backup should be performed at the end of each lab or assignment working session.

#Make certain that your virtual machines are NOT running.#Make certain that you are logged in as '''root''' user on your host machine.# Refer to OPS235 lab2 on backing up your VMs using the above notes '''gzip''' command [https://wiki.cdot.senecacollege.ca/wiki/OPS235_Lab_2_-_CentOS7_-_HD2#Part_1:_Backing_Up_Virtual_Machines OPS235 Lab2 - Backing up VMs]#Make certain that you have performed a full backup for '''vm1''', '''vm2''', and '''vm3'''. It is recommended to create a Bash shell script to allow an ssh connection from automate the backing up of ALL your host machine VMs in sequence. You can do this by running a for loop using a list for vm1, vm2, and vm3 image file pathnames. <ol><li value="5">Create the sub-directory '''/root/bin/'''</li><li>You should know how to any create full backups of your VMs in your OPS235 course. Create a Bash shell script called:<br>'''/root/bin/fullbackup.bash''' that will backup all of your Virtual Machines other vms (i.e. vm1, vm2, and vm3) without requiring one at a passwordtime using the '''gzip''' command to your host machine into the directory path-name: '''/backup/full/'''</li><li>Set execute permissions, and run the shell script to verify that you shell script works.</li><li>It is also recommended to backup to your USB key as well (qcow2 images and xml config files).</li></ol>  # Test each ssh connection between host It will be your responsibility as an administrator of your own Linux system, to backup all of your VMs for labs and each virtual machine assignments at the end of your lab session. Learning to create shell scripts to ensure automate routine tasks (such as backups) will be EXTREMELY useful for your NDD430 course. === Performing Incremental Backups === An incremental backup is a backup of only files that this workshave changed since the last backup. In your case, it may be a good idea to perform incremental backups of your '''/etc/''' directory for your VMs upon startup. We will be using the '''rsync''' command to perform incremental backups for all of your VMs.

{{Admon/important|Rsync is a very versatile backup toolNeeds to be Installed on ALL VMs |Since you select minimum install on your VMs, the rsync command was not installed by default. As You need the name suggests it's used for synchronising files typically across a networkrsync command to be available on your host machine and all of your VMs. It works over Make certain that the SSH protocol so if you have ssh working - you can use '''rsync as well''' command is installed on all your vms.}}

# Make certain that your '''vm1''' machine is running.# Make certain that you are logged in as '''root''' user on your host machine.# On your '''host machine''', run the following commands:

<source lang=bash>mkdir -p /backup/incremental/vm1rsync -avz 192.168.x.2x:/etc /backup/incremental/vm1/ # where 192.168.x.x is the IPADDR of your vm1</source>

If rsync asked '''NOTE:''' This command will '''NOT''' work if '''permit root access is denied for your VMs''' for a password - make sure you completed the SSH keys part of the labyour sshd service configuration, and that you're using the correct userso keep it off for now. If you get a different error - perhaps rsync is not installed. What you should see is all the files from vm1 being copied over.

Rerun <ol><li value="4">If rsync prompts for a password, make certain that you completed the '''SSH key''' section above, and that you assigned the keys for the <u>appropriate user</u><br>(in this case, for the '''root user for both the hostname and vm1'''!)</li><li>When the rsync commandruns correctly, you should see all the files from vm1 being copied over to your host machine.</li><li>Run the rsync command again. Notice that the second time nothing is copied over - that's because there would be no point, to your host machine since none of the files have changed on your vm1 machine.</li><li>Create a new file in vm1's '''/etc/''' directory, and rerun '''rsync'''. Confirm on your '''host machine''' that only that file that was created on your vm1machine actually got backed up to your host machine.</li><li>Repeat the above steps to create backups for your '''vm2''' and '''vm3''' machines on your host machine as well (for the respective directories: '''/backup/incremental/vm2''' and '''/backup/incremental/vm3''').</li></ol>

'''Cron ''' is a ''daemon - '' (i.e. a program that runs in the background). ItThe term ''"Cron"'' is short for '''Chronograph''' which was an old fashioned term for a '''stop watch''' or '''timer'''s . The role of '''Cron''' is to run tasks periodically. It can run tasks for the system (as root) or for a user (any including regular users). Every userhas a crontab (Cron Table). We'll get cron which is a list of tasks they want to run some backup scripts for usperiodically. You do not edit this file manually: instead, but first letyou edit this table using the command '''crontab -e'''s see how it works.Once you run the command, you will get an empty file where you have to insert a line like this:

Every user has a crontab - a list of tasks they want to run periodically. You edit this table using the command '''crontab -e'Perform the following steps:''. Once you run the command you'll get an empty file where you have to insert a line like this:

# Refer to the following WIKI to learn how to use cron: [[crontab tutorial]]# In your host machine as root, modify the setting so it will run that echo command every minute by creating a crontab (via '''crontab -e''') entry with the following line:<prebr><source>10 * * * * * echo "Cron ran this job at: "`date` >> /tmp/cron.log</presource># Save and exit your crontab edit session.# Wait for one minute to pass, and check the '''/tmp/cron.log''' file to see if it was created with the expected contents.<br>(You can also check '''/var/log/cron''' file to see what jobs were run).# Perform a Net-search to see how to configure that crontab entry to run every two minutes instead of every minute.# Edit your crontab entry to run same command every two minutes, save and exit, and then confirm by viewing '''/tmp/cron.log''' and '''/var/log/cron''' files.# Perform a Net-search to see how to run a cron for a command for every hour.# Edit your crontab to '''make automatic backups using the rsync command''' of the '''/etc''' directory from '''vm1''', '''vm2''', and '''vm3''' into '''/backup/incremental/vm1''', '''/backup/incremental/vm2''', and '''/backup/incremental/vm3''' every hour and overwrite the previous backup.

Wait for {{Admon/important |Backup your VMs!|You MUST perform a '''full backup''' of ALL of your VMs whenever you complete your '''OPS335 labs''' or when working on your '''OPS335 assignments'''. You should be using the minute to passgzip command, and check you should use the Bash shell script that /tmp/cron.log was created with the expected contents. You can also check /var/log/cron you were adviced to create in order to see what jobs were runbackup all of your VMs.}}

= Completing the lab = EXPLORATION QUESTIONS ==

* Each of # Explain the major different between the '''ip''' and '''ifconfig''' commands.# List the steps to create a '''temporary static IP network connection''' for your vm1 machine to connect to your VMs should now boot host machine.# List the steps to create a command prompt (no graphical interface), and should be using a '''persistent static IP addressnetwork connection''' for your vm1 machine to connect to your host machine. * Each of your VMs should have # List at least '''3 trouble-shooting techniques''' to check or verify a working network connection and from a vm to a static IP addresshost machine.* Each of your VMs should have an SSH server running# List at least '''5 reasons''' (from networking trouble-shooting) that can break a network connection.* You should be able # List the tools (commands) how to configure / stop / start the ssh from your host service.# Explain why it is important to know how to manage network services if you intend to each VM as configure ("tweak") the root user without a passwordservice.* Backups # Briefly explain the purpose of the three VMs'''tar''', '''cpio''', '''dump''', '''restore''' commands.# Explain how the '''rsync''' command differs from the ''tar'', ''cpio'', ''dump'', and ''restore'' commands.# List the steps to create a '''crontab''' entry to run the program ''' /etcbin/ directories are made automatically in the hostclean-out.bash''' every half day.* You have notes in # What is the purpose of using '''crontabs''' for backing up your labbook about what youvirtual machines've learned in this lab.data to your host machine?