ICTNWK502 IMPLEMENT SECURE ENCRYPTION TECHNOLOGIES
OPS335 Assignment 1 Seneca College
Part 1
Purpose
For this portion of assignment 1, you will set up the basic functionality for a virtual machine to act as a cloning-source to make it easier for the student to create other servers (VMs) in later assignments. Whenever you clone another server (in later assignments), you MUST make certain to configure the cloned server in order to make it function in the network correctly and meet the requirements of future assignments. All of the assignments for this course are interdependent of each other and belong to the same Virtual Private Network called 335assign.
General Requirements
Weight: 3% of the overall grade
Due Date: During Week 5 (check with your professor)
Detailed Requirements
SET-UP A VIRTUAL NETWORK (335ASSIGN)
Create a new virtual network on your Host Machine.
- Assign a newly-created virtual network the name: 335assign, and set forwarding to any physical device
(refer to lab setup. You can have different network names: “335assign” and “ops335” without causing any problems). - Addresses in this network will start with 172.28.105. The subnet mask must be 255.255.255.0
- There must NOT be a DHCP server running for this network!
- All the machines for this assignment will be connected to your newly-created virtual network called: 335assign
CREATE A “CLONING-SOURCE” VM (335ASSIGN VIRTUAL NETWORK)
Create a virtual machine that you will use as a cloning-source.
Details for the cloning-source
- The name of this cloning-source VM will be called: Pangaea.
- You should use the options that you used in your lab1 to set up the static network, plus you should use the DOMAIN parameter to set the continents. earth.ops domain for your cloning-source.
- The VM should have a command-line interface only.
- Configure it to be a good cloning-source, making certain that the cloning-source has all the following elements prior to cloning:
- Don’t make the virtual drive too big: you will need space for it as well as space for the clones you from your cloning-source
(5 GB should be enough for any cloning-source and clone VM that you create for this assignment). - The hostname for this server will be called: Pangaea
- Make certain that you can log in to your cloning-source.
- Configure your network interface for this cloning-source with a static configuration and is connected to the 335assign network. Refer to the table below for IP address and hostname.
| Hostname / Domain | Address | Purpose |
| (your existing host/source) | External Facing Address: DHCP assigned Internal Virtual Bridge (virbr1): 172.28.105.1 |
Your host machine |
| Pangaea.continents.earth.ops | 172.28.105.100 | Cloning-source used to create other servers for other assignments. |
- Make certain your cloning-source can connect to the Internet using the newer static configuration.
- Run a yum update for this cloning-source.
- Make certain that SELinux is set to enforcing (unless you’re in Andrew’s sections – then have it disabled).
- Set up an SSH server on this “cloning-source”.
- Make sure that PermitRootLogin is set to yes for this server.
- Make certain that the root account is permitted to log in only using key authentication. If other users are required to be created in a later assignment, they should be permitted to log in with their username and password.
- Copy the same public key (already generated for your Host Machine for your root account in lab1) to the root account on your cloning-source.
- Test to make certain that you can log in from root on your host machine to your root account on the cloning-course (“Pangaea”) without being prompted for a pass-phrase.
- If you have created a regular user when you installed this machine, delete that regular user (make certain to remove the regular user’s home directory!).
SET-UP FIREWALL RULES FOR YOUR CLONING-SOURCE
Perform the following steps for this section:
- Make certain that you have iptables services enabled and running instead of Firewalld.
- Modify the tables to meet the following conditions:
- All outgoing traffic is allowed.
- Responses to any traffic the machine sends out are allowed.
- Traffic on the loopback interface is allowed.
- The host machine (and only the host machine) must be able to ssh to that cloning-source VM.
- ICMP traffic is allowed if it originated with the local network only.
- As this is acting as the secure basis for later machines, no other traffic should be allowed, and no response should be sent if any other traffic is received.
CREATE FULL AND INCREMENTAL BACKUPS OF CLONING-SOURCE VM
Perform the following steps for this section:
- This task is to be performed in your host machine.
- Issue the command su –
- Create a Bash shell script called /root/bin/assnBackup.bash to perform a full backup using the gzip command to backup the entire file system of your cloning-source VM to save the compressed copy to the directory path: /backup/full/).
- This shell script should read each of any number of VM image files in the /var/lib/libvirt/images directory that has the extension “.qcow2”. In this way, this shell script will safely backup any new VMs that are created later in this course, yet backup the existing labs and assignment VMs.
- Perform a Net-search to use the pv (pipe-viewer) command to show a text-based indicator of backup for EACH VM image file. You need to add the EPEL repository to install the pv command.
- Set execute permissions for this script, and run this Bash shell script prior to exiting your assignment work session to properly backup your cloning source. You should also make a copy of the backup on an external device (such as a USB key).
- Set-up via a crontab entry, an incremental backup of the /etc/ directory of your cloning-source to be performed every hour to the /backup/incremental/cloning-source directory.
ASSIGNMENT SUBMISSION
The student is required to prove to their professor that their set-up works correctly during the regularly-scheduled lab period.
ASSIGNMENT EVALUATION DETAILS
- Demonstrate working assignment to your instructor in class:
- Students can demonstrate their assignment functionality to their professor during a lab period (like you would for any lab for “sign-off”).
- Students are required to prepare everything ahead of time so that they can quickly demonstrate to their instructor that all required parts of their assignment are working.
- The idea of the demonstration of your assignment to your instructor is to check for errors that may cause problems when running the checking script.
- Download and run a shell script to check your work:
- Login as root on your host machine.
- Change to the /root/bin directory.
- Make certain that your cloning-source VM is running.
- Issue the command to download a checking script for your assignment to your host machine:
wget https://matrix.senecacollege.ca/~ahad.mammadov/files/OPS335/check-assn1-p1.bash - Set execute permissions and run the shell script.
It will create a tar file for you to upload as your submission to the blackboard.
EVALUATION RUBRIC
Here is an evaluation rubric (in table form) showing you how you will be evaluated for this assignment. Part of the rubric is marked from professor observation from student demonstration of assignment in class, and the other part is based on output from the results of an assignment checking script that the student will download and run.
| Student Demonstration (optional) | |
| Evaluation Item | Mark |
| Created Virtual Network: 335assign (correct settings) |
/1 |
| Can ping cloning-source from host machine with correct IPADDR | /1 |
| root account on the host machine can connect to cloning-source VM via ssh application without password | /1 |
| cloning-source VM can connect to the Internet (i.e. ping 8.8.8.8) |
/1 |
| cloning-source can SSH to student’s Matrix account | /1 |
| Configuration (Checking Script Output) | |
| Evaluation Item | Mark |
| Hostname set to Pangaea only, domain name continents. earth.ops set as a network parameter | /1 |
| yum update performed | /1 |
| No regular users on cloning source (just root) | /1 |
| SELinux status set to enforcing | /1 |
| firewalld stopped and inactive | /1 |
| iptables active and enabled | /1 |
| iptables – All outgoing traffic is allowed | /1 |
| iptables – The host machine (and only the host machine) must be able to ssh to the cloning-source | /1 |
| iptables – ICMP traffic is allowed if it originated with the local network only | /1 |
| iptables – Other unexpected INPUT traffic is blocked without response | /1 |
| iptables – all FORWARD traffic is blocked without response | /1 |
| correct static network configuration for cloning-source VM (half mark for each network config item) |
/5 |
| permit root login set to yes for cloning-source VM | /1 |
| Backup script assnBackup.bash structure | /1 |
| Use of PV command for backup script | /1 |
| Proof that VM full backup was run | /2 |
| Crontab entries executed properly | /2 |
| Incremental Backup of /etc/ directory of cloning-source to /backup/incremental/cloning-source directory | /2 |
| TOTAL | /30 |
OPS335 Assignment
OPS335 Assignment 1 Part 2
Purpose
In this assignment, you will use the 335assign virtual network and the Pangaea cloning-source that you created in assignment 1 (part 1) to create two name-servers. One of the cloned VMs (hostname: Australia) will be a master name server, and the other VM (hostname: Antarctica) will be a slave name server. You will install and set up the master and slave servers in order to provide various domain name resolutions for existing servers, and for servers that will be created and used in assignment #2.
General Requirements
Weight: 7% of the overall grade
Due Date (Winter 2021): During Week 7 (check with your professor)
Detailed Requirements
It is YOUR responsibility to back up all of your VMs for this Assignment!
You are required to frequently back up your VMs prior to exiting a work session during this assignment. Your instructor will NOT accept the fact that your hard disk crashed and lost all of your work. If you properly backed up your VM images and XML configuration files to a USB, then you can purchase a new hard-disk or wipe and recreate your hard disk and restore your VMs.
OPS335 Assignment
Set-up Master Name Server (Australia)
Perform the following steps for this section:
- Create a clone virtual machine called Australia from the Pangaea cloning-source. Refer to the table below for address and hostname.
- Create a regular user for this virtual machine using your Seneca userID.
- Setup a DNS server on your Australia virtual machine noting the following items below:
- This virtual machine will be the Master DNS server for continents.earth.ops.
- Only Antarctica will be allowed to obtain zone transfers of this zone.
- This machine will provide forward and reverse lookups of ALL virtual machines in the continents.earth.ops. zone, including resource records for virtual machines that do not currently exist.
- You MUST use the following names for both the forward and reverse zone files in the/var/named directory: mydb-for-continents.earth.ops and made-for-172.28.105
- Any machine in the continents. earth. ops network may use this machine to perform queries of machines outside the network, however, it will route all such queries through the DNS server you created in lab #3.
- For machines outside the continents. earth. ops domain, will only answer queries about machines inside the network. They may not use it to query other machines.
Set-up Slave Name Server (Antarctica)
Perform the following steps for this section:
- Create a clone virtual machine called Antarctica from the Pangaea cloning-source. Refer to the table below for address and hostname.
- Create a regular user for this virtual machine using your Seneca userID.
- Setup a DNS server on your Antarctica virtual machine noting the following items below:
- This virtual machine will be the Slave DNS server (in case the Master Name Server goes down).
- This virtual machine will obtain its zone files by copying them from the Master Name Server.
- This Slave DNS server will check for updated records from the Master DNS server every three days. If the initial attempt fails, then it will attempt every twenty-four hours until it succeeds, or three weeks have passed.
- This machine will provide forward and reverse lookups of ALL machines in the continents. earth.ops zone, the zone files for which will be obtained from Australia.continents.earth.ops.
- Only machines within the continents. earth. ops domain will be allowed to query this machine.
- This machine will not provide recursive lookup capabilities for any machines.
OPS335 Assignment
Network Configuration
As you will now have functioning primary and secondary DNS servers, modify your network configuration file on these machines and on the cloning source to specify the correct IPADDR.
Table of Virtual Machines / DNS Records
All the machines in the following table require DNS records. The rows are not shaded represent future servers that will be created in Assignment #2.
| Hostname / Domain | Address | Purpose |
| Africa.continents.earth.ops’ (your existing host) | External Facing Address: DHCP assigned Internal Virtual Bridge (virbr1): 172.28.105.1 |
Your host machine |
| Pangaea.continents.earth.ops | 172.28.105.100 | Cloning-source used to create other servers for other assignments. |
| Australia.continents.earth.ops | 172.28.105.2 | Master Name Server |
| Antarctica.continents.earth.ops | 172.28.105.3 | Slave Name Server |
| Asia.continents.earth.ops | 172.28.105.5 | SMTP mail Server |
| Europe.continents.earth.ops | 172.28.105.6 | IMAP mail Server |
| southamerica.continents.earth.ops | 172.28.105.8 | Samba Server |
Set-up Firewall Policies
In addition to the basic firewall established in assignment 1, ensure the following restrictions are met:
- Any machine may query Australia
- Only the machines in the continents. earth. ops network may query Antarctica.
Assignment Submission
The student is required to prove to their professor that their set-up works correctly during the regularly-scheduled lab period.
Assignment Evaluation Details
- Demonstrate working assignment to your instructor in class:
- Students need to demonstrate their assignment functionality to their professor during a lab period (like you would for any lab for “sign-off”).
- Students are required to prepare everything ahead of time so that they can quickly demonstrate to their instructor that all required parts of their assignment are working.
- Do not proceed to the next step until you have demonstrated your assignment to your instructor to check for errors that may cause problems when running the checking script.
- Download and run a shell script to check your work:
- Login as root on your host machine.
- Change to the /root/bin directory.
- Make certain that your assignment VMs are running.
- Issue the command to download a checking script for your assignment to your host machine:
wget https://matrix.senecacollege.ca/~peter.callaghan/files/OPS335/check-assn1-p2.bashSet execute permissions and run the shell script.
Upload the resulting file to the blackboard. Evaluation Rubric Here is an evaluation rubric (in table form) showing you how you will be evaluated for this assignment. Part of the rubric is marked from professor observation from student demonstration of assignment in class, and the other part is based on output from the results of an assignment checking script that the student will download and run. Student Demonstration (in class) Evaluation Item Mark Australia and Antarctica VMs created /1 Australia and Antarctica VMs can perform DNS queries of vm1, vm2, vm3 /1 Australia and Antarctica VMs can perform forward DNS lookups for ALL machines within the network (listed in the table above) /3 Australia and Antarctica VMs can perform reverse DNS lookups for ALL machines within the network (listed in the table above) /3 Zone transfer occurs /3 Configuration (Checking Script Output) Evaluation Item Mark Master Name Server (Australia) – Network Configuration correct static network configuration
(one mark for each network config item) /5 Master Name Server (Australia) – Named Configuration Options / Zone Declarations Zone transfer (i.e. to slave DNS server) limited to Antarctica only /1 Allows forward and reverse lookups to continents. earth. ops /1 Recursion limited to continents. earth. ops only /1 Australia server is the master name-server for continents. earth.ops /1 Master Name Server (Australia) – Zone Record SOA – three common options (determined by the instructor at time of marking) /3 Correct NS records in forwarding zone /2 Correct NS records in reverse zone /2 Slave Name Server (Antarctica) – Network Configuration correct static network configuration
(one mark for each network config item) /5 Slave Name Server (Antarctica) – Named Configuration Options Queries are limited to continents. earth.ops /1 Slave server is Non-recursive /1 Allows forward and reverse lookup for continents. earth.ops /1 Antarctica server is slave name-server for continents. earth.ops /1 Firewall policies australinea allows queries from any machine (i.e. will work with vm1, vm2, vm3) /2 Antarctica limits queries to continents. earth.ops (i.e. won’t work with vm1, vm2, vm3) /2 Fewer Deductions (1 mark per issue for EACH VM):- Not using zone filenames: mydb-for-continents.earth.ops and made-for-172.28.105
- VM hostname NOT set
- firewalld enabled/running
- iptables disabled / not running
- No Yum update
- Named NOT active
- Local hostname resolution appears in /etc/hosts (1 mark per entry, per VM)
- Neglecting major safeguards (e.g. no firewall present, firewall allowing all traffic, no active SELinux) (4 marks per issue, per VM)
- Failing to backup VMs (1 mark deduction for each VM not backed up)
TOTAL /40
Visit At ;- ICTNWK502 IMPLEMENT SECURE ENCRYPTION TECHNOLOGIES
