Süsteemihaldus 2020/21 kevad

1. Overview of lab 2 :

Welcome to the 3rd lab. Here is a short action list that we will do during this lab:

1. Accessing ETAIS
2. Creating a public/private key pair
3. Creating a new CentOS 8 virtualmachine in Cloud
4. Configuring VPN Client
5. Accessing Server over SSH
6. Adding scoring account and its public key with no password for sudo commands
7. Update dnf configuration
8. Use Ansible to automate the previous steps
9. Using gitlab to store your Ansible repo
10. Knowing your Floating IP (External IP) to be configured in TLD DNS server (Will be used in the following labs)

2. How to login to ETAIS:

For the rest of the labs we use a cloud service called ETAIS. ETAIS’s main aim is to serve Estonian students and researchers. For access, you have been sent an email with instructions how to log in. You have also been invited into the System Administration organization, and have a private project in that organization.

3. Creating a public/private key pair

Before you continue we need to set up public / private key pair so you could use them to connect to machine.

Public key cryptography, or asymmetrical cryptography, is any cryptographic system that uses pairs of keys: public keys which may be disseminated widely, and private keys which are known only to the owner. This accomplishes two functions: authentication, where the public key verifies a holder of the paired private key sent the message, and encryption, where only the paired private key holder can decrypt the message encrypted with the public key.

In a public key encryption system, any person can encrypt a message using the receiver's public key. That encrypted message can only be decrypted with the receiver's private key. To be practical, the generation of a public and private key-pair must be computationally economical. https://en.wikipedia.org/wiki/Public-key_cryptography

Generating key pair and uploading the public key to SSH server

To be done on personal PC/Laptop and

• In Linux, MacOS and Linux subsystem for Windows ( PuTTy manual later):

• In Windows:

• Copy public key to ETAIS.

4. Creating a new CentOS 8 Virtual Machine

Example VM configuration will look as follows:
(WARNING: the Provider value will be specific to your project, so it will be different!)

General Network Topology

You may notice a VM has Internal and External IP listed. Each project actually suggest a private network of 192.168.42.0/24, this your project private LAN, an IP from this network will be assigned to your VM's eth0 network interface and also listed in the Internal IP column (VM list in ETAIS). Project private LAN is connected to University Campus network (172.17.0.0) through a router device that is specific to your project (each student will get 192.168.42.0/24 private network but this is not the same one!). Router devices are created automatically once project is created and network provider is chosen. The only possible provider for our course cloud is UT Campus (172.17.0.0). Therefore router devices will get the corresponding External IP address assigned, resulting a unique address from 172.17.0.0 subnet. The Internal address of the router is always set 192.168.42.1 and this becomes a default gateway for our VM. As we only create 1 VM in our private network (192.168.42.0/24) the router applies the Source/Destination NAT (network address translation) between the IP address of a VM (192.168.42.a) and the External address of a Router (172.17.x.x). As a result all packets arriving on 172.17.x.x are sent further to 192.168.42.a (called destination NAT). Opposite way around (source NAT): all packets that are passing through router (sent from VM into world) are getting the source address rewritten (192.168.42.a -> 172.17.x.x). The last is actually a default setting for any home/small-office router. If both applied the Router becomes transparent for a VM: VM becomes accessible behind the Router's External address. This is why the Router's External IP is enlisted as VM's External IP (right next VM's Internal IP).

Network topology diagram

5.Configuring VPN Client

In order to access your newly created Virtual machine you need to be inside of University of Tartu network. In classroom or in University of Tartu eduroam network it might be possible to access your machine without VPN, but we do reccomend set ip up for remote access.

A virtual private network (VPN) extends a private network across a public network, and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. Applications running across the VPN may therefore benefit from the functionality, security, and management of the private network. VPNs may allow employees to securely access a corporate intranet while located outside the office. They are used to securely connect geographically separated offices of an organization, creating one cohesive network. ... https://en.wikipedia.org/wiki/Virtual_private_network

6. Access machine over SSH

Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. The best known example application is for remote login to computer systems by users.

SSH provides a secure channel over an unsecured network in a client-server architecture, connecting an SSH client application with an SSH server. Common applications include remote command-line login and remote command execution, but any network service can be secured with SSH. https://en.wikipedia.org/wiki/Secure_Shell

Connecting to Cloud resources (VM-s) over SSH is preferred. Therefore SSH is installed in your system by default, as the cloud infrastructure takes care of bootstrapping and installing your CentOS 8 OS.

Accessing remote shell of the VM over SSH

Command line utilities

ssh

In MacOS and Linux hosts the ssh client is by default installed and accessible in command line. In order to access remote shell of the example.com host and user test the following command should be provided:

• $ ssh test@example.com

Desktop Applications

Putty

**Download Putty Putty is an portable executable, so just open Putty.exe and the following window will open up:

Testing the public key authentication

First of all make sure you know the IP of your newly created VM. It will be something like 172.17.XXX.XXX

Instead of username and password let use the key we generated earlier. Now you should be able to login to you VM over SSH using the private key:

• In Linux and MacOS

• In Windows

• Now the saved session can be used:

7. Adding root password

VMs in ETAIS by default ship without passwords. Meaning you can only gain access to the VM if you have pasted you SSH public key into ETAIS and afterwards created the VM. Root user should have a password. It allows for more convenient disaster recovery. Also you can utilise the root password whenever you lock yourself out of your machine and want to gain access again.

8.Adding scoring account

Now we will add a scoring user which will be used by our lab instructors and automatic scoring virtual machine to log in and check your machine.

Now let's give our lab instructors and automated scoring system access to your VM over SSH using scoring account. There is a public key for the scoring user available for a download here https://scoring.sa.cs.ut.ee/files/id_rsa.pub.

Now let's add the downloaded public key to the list of authorized keys for scoring account:

The last thing to do is to give the scoring rights to execute command in root rights.
We need scoring user to be able to run programs that need root access, but we are not going to give root privileges to the scoring backend (root password is unknown and root user cannot login over SSH). In order to give a regular user an ability to execute a particular command in super user rights there is a tool called sudo. sudo allows to run programs with security privileges of another user, by default the root user.
For more information on sudo read short review on debian wiki.

scoring ALL=(ALL:ALL) NOPASSWD: ALL
# under where users like root are specified

9. Automating the last step with Ansible

Ansible is an automation tool for system administrators that handles routines, data gathering, config management and more. There are obvious benefits to maintaining a proper collection of Ansible scripts - maintainability, reproducibility, documentation. A proper Ansible playbook will allow you to automatically configure a blank machine to any state you like. For example, once you have written a playbook for your VM and should that VM get corrupted, you could create a new virtual machine and after running the playbook get back to the previous state.

Another bonus to Ansible is idempotency - running your playbook multiple times on the same machine means that the same state is reached each time. For example, when adding lines to a config with Ansible, a well written playbook will not add a line on each run, but will first check if it already exists. This prevents mistakes and makes sure your playbook run smoothly each time.

Now lets take a look at a typical playbook structure.

The two main components of a playbook are the tasks and the hostfile. The hostfile will determine which machine a playbook is intended to run on. While we are using a singular machine for our course, Ansible can be (and is) used to manage more than hundreds of machines in live production systems.

For the playbooks, these are written for any purpose you need. The task can be as simple as adding a user with a password, or as complex as setting up a full webserver with the neccesary configs, services and permissions. In Ansible, a task is a singular action, while a playbook contains multiple tasks to be executed.

We will now take a look on how to set up and run your first playbooks. The official documentation (https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html) covers all the different OS versions, we recommend using the Windows susbsystem for linux if you're running on Windows instead of PuTTy.

• Installing Ansible in WSL

 [sa-vm]
<external IP of your VM>

- name: Add user scoring
  user:
    name: scoring

- name: Create .ssh directory
  file:
    path: /home/scoring/.ssh
    state: directory
    owner: scoring
    group: scoring
    mode: '0700'

- name: Download user scoring public key
  get_url:
    url: https://scoring.sa.cs.ut.ee/files/id_rsa.pub
    dest: /home/scoring/.ssh/authorized_keys
    owner: scoring
    group: scoring
    mode: '0600'

inventory =  /path/to/your/repo/inventory/hosts
host_key_checking = false
private_key_file = ~/.ssh/id_rsa
roles_path = /path/to/your/repo/roles

---

- hosts: sa-vm
  user: centos
  become: yes
  become_method: sudo
  become_user: root

  roles:
   - { role: etais, tags: etais } 

10. Keeping your Ansible repository safe in our Gitlab

Git is a version control system you should already be familiar with from previous courses. While github is a free public repository host, we will be using a private Gitlab instance created specially for this course.

Now we are ready to upload our repository - In the actual gitlab repo page you can also see the guide on how to do this, but this will also be mirrored here in this guide.

11. Updating DNF:

DNF (Dandified YUM) is a new package manager for CentOS platform. This can be used to install, update, remove software and handle dependencies.