System Administration 2017/18 spring

0. Overview of lab 3 :

Welcome to 3rd lab. Here the short action list we will do in this lab:

1. Accessing ETAIS
2. Creating a public/private key pair
3. Creating a new Debian 9 virtualmachine in Cloud
4. Configuring VPN Client
5. Accessing Server over SSH
6. Adding TESTER account and its public key with no password for sudo commands
7. Update apt configuration
8. Submitting your Floating IP (External IP) to be configured in TLD DNS server (Will be used in lab4)

<TO BE ADDED LATER>

1. Configuring Machine name and understanding its network
2. Firewall
3. Backup

1. How to login to ETAIS:

This year we are using new Cloud environment called ETAIS. ETAIS’s main aim is to serve Estonian students and researches. To gain access you have register yourself by creating an account in ETAIS portal. Please read and agree to Terms of Use before continuing http://etais.ee/terms_of_use/.

Also please familiarize yourself with ETAIS MANUAL http://etais.ee/self_service/

2. Creating a public/private key pair

Before you continue we need to set up public / private key pair so you could use them to connect to machine.

Public key cryptography, or asymmetrical cryptography, is any cryptographic system that uses pairs of keys: public keys which may be disseminated widely, and private keys which are known only to the owner. This accomplishes two functions: authentication, where the public key verifies a holder of the paired private key sent the message, and encryption, where only the paired private key holder can decrypt the message encrypted with the public key.

In a public key encryption system, any person can encrypt a message using the receiver's public key. That encrypted message can only be decrypted with the receiver's private key. To be practical, the generation of a public and private key-pair must be computationally economical. https://en.wikipedia.org/wiki/Public-key_cryptography

Generating key pair and uploading the public key to SSH server

To be done on personal PC/Laptop and

• In Linux and MacOS (Windows manual later):

• In Windows:

• Copy public key to ETAIS.

3. Creating a new Debian 9 Virtual Machine

For example: VM configuration for Alo Peets would look as follows:
(WARNING: the Provider value will be specific to your project, so it will be different!)

General Network Topology

You may notice a VM has Internal and External IP listed. Each project actually suggest a private network of 192.168.42.0/24, this your project private LAN, an IP from this network will be assigned to your VM's eth0 network interface and also listed in the Internal IP column (VM list in ETAIS). Project private LAN is connected to University Campus network (172.17.0.0) through a router device that is specific to your project (each student will get 192.168.42.0/24 private network but this is not the same one!). Router devices are created automatically once project is created and network provider is chosen. The only possible provider for our course cloud is UT Campus (172.17.0.0). Therefore router devices will get the corresponding External IP address assigned, resulting a unique address from 172.17.0.0 subnet. The Internal address of the router is always set 192.168.42.1 and this becomes a default gateway for our VM. As we only create 1 VM in our private network (192.168.42.0/24) the router applies the Source/Destination NAT (network address translation) between the IP address of a VM (192.168.42.a) and the External address of a Router (172.17.x.x). As a result all packets arriving on 172.17.x.x are sent further to 192.168.42.a (called destination NAT). Opposite way around (source NAT): all packets that are passing through router (sent from VM into world) are getting the source address rewritten (192.168.42.a -> 172.17.x.x). The last is actually a default setting for any home/small-office router. If both applied the Router becomes transparent for a VM: VM becomes accessible behind the Router's External address. This is why the Router's External IP is enlisted as VM's External IP (right next VM's Internal IP).

Network topology diagram

4.Configuring VPN Client

In order to access your newly created Virtual machine you need to be inside of University of Tartu network. In classroom or in University of Tartu eduroam network it might be possible to access your machine without VPN, but we do reccomend set ip up for remote access.

A virtual private network (VPN) extends a private network across a public network, and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. Applications running across the VPN may therefore benefit from the functionality, security, and management of the private network. VPNs may allow employees to securely access a corporate intranet while located outside the office. They are used to securely connect geographically separated offices of an organization, creating one cohesive network. ... https://en.wikipedia.org/wiki/Virtual_private_network

5. Access machine over SSH

Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. The best known example application is for remote login to computer systems by users.

SSH provides a secure channel over an unsecured network in a client-server architecture, connecting an SSH client application with an SSH server. Common applications include remote command-line login and remote command execution, but any network service can be secured with SSH. https://en.wikipedia.org/wiki/Secure_Shell

Connecting to Cloud resources (VM-s) over SSH is preferred. Therefore SSH is installed in your system by default, as the cloud infrastructure takes care of bootstrapping your debian OS. In case you would have to the bootstrap manually, you could do it with # apt install openssh-server command.

Accessing remote shell of the VM over SSH

Command line utilities

ssh

In MacOS and Linux hosts the ssh client is by default installed and accessible in command line. In order to access remote shell of the example.com host and user test the following command should be provided:

• $ ssh test@example.com

Desktop Applications

Putty

**Download Putty Putty is an portable executable, so just open Putty.exe and the following window will open up:

Testing the public key authentication

First of all make sure you know the IP of your newly created VM. Pay attention to the following image:

Instead of username and password let use the key we generated earlier. Now you should be able to login to you VM over SSH using the private key:

• In Linux and MacOS

• In Windows

• Now the saved session can be used:

6.Adding tester account

Now we will add a tester user which will be used by our lab instructors and automatic tester virtual machine to log in and check your machine.

Now let's give our lab instructors and automated tester system access to your VM over SSH using tester account. There is a public key for the tester user available for a download here http://www.ut.ee/~alop/sa18_tester_rsa.pub.

Now let's add the downloaded public key to the list of authorized keys for tester account:

The last thing to do is to give the tester rights to execute command in root rights.
We need tester user to be able to run programs that need root access, but we are not going to give root privileges to the tester backend (root password is unknown and root user cannot login over SSH). In order to give a regular user an ability to execute a particular command in super user rights there is a tool called sudo. sudo allows to run programs with security privileges of another user, by default the root user.
For more information on sudo read short review on debian wiki.

7. Updating apt:

Apt (short for Advanced Package Tool) is a set of core tools inside Debian. Since every program is handled as a package in Linux distributions generally, apt makes it possible to manage the programs, install them, remove them, update them and so on.

Sources.list file contains all the sites that the apt will check to get the necessary updates, programs etc.

    deb http://ftp.ee.debian.org/debian stretch main 
    deb-src http://ftp.ee.debian.org/debian stretch main

    deb http://ftp.ee.debian.org/debian stretch-updates main
    deb-src http://ftp.ee.debian.org/debian stretch-updates main

    deb http://security.debian.org/ stretch/updates main
    deb-src http://security.debian.org/ stretch/updates main

8. Submitting your Floating IP (External IP)

Please paste here in submission box (you need to be logged into courses.cs.ut.ee to enable it)your:

1. University of Tartu user_id also known as username (i.e. First part of your project Description in ETAIS)
2. virtual machine Floating IP also known as External IP (172.17.64.X) so we could configure it in TLD DNS for next lab, where you need it.