Süsteemihaldus 2021/22 kevad

1. Overview of lab 2 :

Welcome to the 2nd lab. Here is a short action list that we will do during this lab:

1. Accessing ETAIS
2. Creating a public/private key pair
3. Creating a new CentOS 8 virtual machine in Cloud
4. Configuring VPN Client
5. Accessing Server over SSH
6. Adding scoring account and its public key with no password for sudo commands
7. Update dnf configuration

2. How to login to ETAIS:

For the rest of the labs, we use a cloud service called ETAIS. ETAIS’s main aim is to serve Estonian students and researchers. For access, you have been sent an email with instructions on how to log in. You have also been invited into the System Administration organization, and have a private project in that organization.

3. Creating a public/private key pair

Before you continue we need to set up public / private key pair so you could use them to connect to the machine.

Public key cryptography, or asymmetrical cryptography, is any cryptographic system that uses pairs of keys: public keys which may be disseminated widely, and private keys which are known only to the owner. This accomplishes two functions: authentication, where the public key verifies a holder of the paired private key sent the message, and encryption, where only the paired private key holder can decrypt the message encrypted with the public key.

In a public-key encryption system, any person can encrypt a message using the receiver's public key. That encrypted message can only be decrypted with the receiver's private key. To be practical, the generation of public and private key pairs must be computationally economical. https://en.wikipedia.org/wiki/Public-key_cryptography

Generating key pair and uploading the public key to the SSH server

To be done on personal PC/Laptop and

• In Linux, macOS, and Linux subsystem for Windows ( PuTTy manual later):

• In Windows:

• Copy the public key to ETAIS.

4. Creating a new Virtual Machine

Example VM configuration will look as follows:
(WARNING: the Provider value will be specific to your project, so it will be different!)

General Network Topology

You may notice a VM has Internal and External IP listed. Each project suggests a private network of 192.168.42.0/24, this is your project's private LAN, an IP from this network will be assigned to your VM's eth0 network interface and also listed in the Internal IP column (VM list in ETAIS). Project private LAN is connected to the University's Campus network (172.17.0.0) through a router device that is specific to your project (each student will get a 192.168.42.0/24 private network but this is not the same one!). Router devices are created automatically once the project is created and the network provider is chosen. The only possible provider for our course cloud is UT Campus (172.17.0.0). Therefore router devices will get the corresponding External IP address assigned, resulting in a unique address from the 172.17.0.0 subnet. The Internal address of the router is always set 192.168.42.1 and this becomes a default gateway for our VM. As we only create 1 VM in our private network (192.168.42.0/24) the router applies the Source/Destination NAT (network address translation) between the IP address of a VM (192.168.42.a) and the External address of a Router (172.17.x.x). As a result, all packets arriving on 172.17.x.x are sent further to 192.168.42.a (called destination NAT). The opposite way around (source NAT): all packets that are passing through the router (sent from VM into the world) are getting the source address rewritten (192.168.42.a -> 172.17.x.x). This is a default setting for any home/small-office router. If both are applied the Router becomes transparent for a VM: VM becomes accessible behind the Router's External address. This is why the Router's External IP is enlisted as VM's External IP (right next to VM's Internal IP).

Network topology diagram

5. Configuring the VPN Client

To access your newly created Virtual machine you need to be inside of University of Tartu network. In the classroom or inside the University of Tartu eduroam network it is possible to access your machine without a VPN, but we do recommend setting up a VPN for remote access outside the University network. You can skip this step if you have already configured a UT VPN.

A virtual private network (VPN) extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. Applications running across the VPN may therefore benefit from the functionality, security, and management of the private network. VPNs may allow employees to securely access a corporate intranet while located outside the office. They are used to securely connect geographically separated offices of an organization, creating one cohesive network. ... https://en.wikipedia.org/wiki/Virtual_private_network

6. Access machine over SSH

Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over a network. The best-known example application is for remote login to computer systems by users.

SSH provides a secure channel over an unsecured network in a client-server architecture, connecting an SSH client application with an SSH server. Common applications include remote command-line login and remote command execution, but any network service can be secured with SSH. https://en.wikipedia.org/wiki/Secure_Shell

Connecting to Cloud resources (VM-s) over SSH is preferred. Therefore SSH is installed in your system by default, as the cloud infrastructure takes care of bootstrapping and installing your CentOS 8 OS. The other option is to use the slow network console from minu.etais.ee, but usually this is reserved for emergency purposes.

Accessing remote shell of the VM over SSH

Command line utilities

ssh (Linux,MacOS, WSL)

In macOS and Linux hosts the ssh client is by default installed and accessible in the command line. Starting with Windows 10, a Linux subsystem was created that runs a pseudo-VM in Windows, which also has ssh installed by default. To access the remote shell of the example.com host and user test the following command should be provided:

• $ ssh test@example.com

Desktop Applications

Putty (Windows)

**Download Putty Putty is a portable executable, so just open Putty.exe.

Testing the public key authentication

First of all, make sure you know the IP of your newly created VM. It will be something like 172.17.XXX.XXX

Instead of username and password let's use the key we generated earlier. Now you should be able to login to your VM over SSH using the private key:

• In Windows

• Now the saved session can be used:

7. Adding root password

VMs in ETAIS by default ship without passwords. Meaning you can only gain access to the VM with the correct public keypair. In this course, the root user should have a password, as it allows for disaster recovery in case something happens to your key/VM through the web console. In general system administration, root passwords are usually not used, or only for disaster recovery purposes. Having a password with full control of your services/server is a security risk.

8.Adding scoring account

Now we will add a scoring user which will be used by our lab instructors and an automatic scoring service to log in and check your machine.

Now let's give our lab instructors and automated scoring system access to your VM over SSH using a scoring account. The public key for the scoring user is available for download here, and it works exactly like your own public-private keypair for ssh https://scoring.sa.cs.ut.ee/files/id_rsa.pub.

Now let's add the downloaded public key to the list of authorized keys for scoring account:

What we did was add the scoring server's public key into a special file named authorized_keys, the contents of which are checked by the SSH service in the VM for each login to assess authentication methods for that particular user. This process is identical to the VM setup scripts adding *your* key under the authorized_keys file under the centos user(you are encouraged to check the contents of /home/centos/.ssh/authorized_keys). The format of the file allows for multiple keys as well, one per line. When manually adding new keys to any user, make sure the formatting is correct and that the key header ssh-rsa is attached to the key.

The last thing to do is to give the scoring user rights to execute commands in root permissions.
We need the scoring user to be able to run programs that need root access, but we are not going to give root privileges to the scoring backend (root password is unknown and root user cannot log in over SSH). To give a regular user the ability to execute a particular command in superuser rights there is a tool called sudo. sudo allows running programs with the security privileges of another user, which, by default is the root user.
For more information on sudo read a short review on Debian wiki.

scoring ALL=(ALL:ALL) NOPASSWD: ALL
# under where users like root are specified

9. Perform backups

Whenever you are about to introduce some portion of changes to your system it might be wise to back up the current state first. Configuration mistakes might result in locking the network access. Once network access is lost - you can't control your VM over SSH anymore, and it might be useful to restore from backup (not always). There is a recovery console (Action button in ETAIS next to your VM has Open console option), but that only works if you have set a root user password. ETAIS infrastructure does allow you to perform the snapshots of your VM image. By creating a snapshot you are saving the state of the whole hard drive, and once the snapshot is created you can proceed with dangerous actions knowing that you can always recover to the last snapshot's state in case you misconfigure something. But this should not happen often, and keeping multiple snapshots is not necessary. Another way of backing your VM state is to automate VM creating with Ansible, something we will be covering in the next lab. Ansible scripts allow you to automate the steps you do in this course, and in the case of VM corruption, easily re-setup your machine to the last state. Using Ansible is also encouraged during the exam and a properly configured Ansible can automate the whole exam, allowing easy pass of the course sometimes in minutes.

10. Security groups.

From this lab onward we need to sometimes open ports for our VMs, to allow config of the different services we set up. Some of these security groups should be preconfigured in the course project already, but configuring the firewall of your VM is entirely up to You. Below is a small guide on how to configure firewall rules if the guides ask for them.

When you open any other port, you also have to do it in the ETAIS interface. This is not a one-time thing and has to be done for each port/protocol/service we install into our machines. One security group can also have multiple ports/protocols in them.

11. Updating DNF:

DNF (Dandified YUM) is a new package manager for the CentOS platform. This can be used to install, update, remove software and handle dependencies.

That is everything for this lab, you should now have all the tools to start completing the following labs.