# Data Networking/Fall 2016/PAKP
## Group Members

Ashwin Maniyankode Chandranathan Kailash Natarajan Pooja Deshpande Pranoy Thykkoottathil Jose

## Objective

The main objective of this project is to build a secure and a dynamic network which has Dynamic Host Configuration Protocol(DHCP),Domain Name Server(DNS), Webserver, Firewall and Backup system using the Linux-Ubuntu operating system.

## Behaviour of the Protocols
### Dynamic Host Configuration Protocol

Dynamic Host Configuration Protocol (DHCP) is a network protocol that enables a server to automatically assign an IP address to a computer from a defined range of IP addresses (i.e., a scope) configured for a given network.The DHCP server leases an address to any DHCP-enabled client when it starts up on the network. Since IP addresses are dynamic (leased) rather than static (permanently assigned), addresses which are no longer in use are automatically returned to the pool for reallocation. Both IPV4 and IPV6 addresses can be assigned using DHCP server.
DHCP supports three mechanisms for IP address allocation.
* Automatic allocation: DHCP assigns IP address to a client when it gets the requests from them.
* Dynamic allocation: DHCP assigns IP addresses to clients for a specified period of time (or until the client explicitly relinquishes the address). When the lease expires, then the client will have to request for an extension on the lease or request another IP.
* Manual allocation: Using DHCP, we can assign the same IP to a particular device by using its MAC address as an identifier. For example, a server will always have the same IP, even though it is getting it via. the DHCP server.
One or more of these mechanisms will get used depending on the policies of the network administrator.

### Domain Name System

DNS is an application layer protocol with the ability to translate domain names to IP addresses and vice versa. The basic job of the DNS is to provide simplicity for the application user; i.e. it provides an easier way that will translate the user-friendly domain name to a machine understanding IP address which is then used to fetch and forward data. With the explosion in the use of internet and World Wide Web in commercial, security, social markets among many others, it is not possible for a user to remember the logical IP addresses of the sites. This is where DNS steps in and makes it possible such that the user just needs to remember the user-friendly domain name like www.google.com from which the DNS will translate it into an IP address as 8.8.8.8.
Jumping further into the behavior of the protocol, the DNS stores DNS records for a domain name with corresponding IP addresses and it will respond to queries from the user with answers from its database.
DNS Records are nothing but the database files from which the mappings are fetched. Some of the commonly used DNS records are A, CNAME, MX, PTR, NS.
| RECORD TYPE | EXAMPLE NAME | MAPPED DATA | DESCRIPTION |
| NS | test.com | dns1.test.com | This record indicates the host/user about the authoritative servers and also provides with information about the Master and Slave servers of the zone. |
| A | dns1.test.com | 192.168.1.1 | This is the most basic type of DNS Record which indicates the 32 bit IPv4 address of the domain, i.e. mapping the FQDN to an IP address. |
| CNAME | test.com | a.test.com | This record maps to the canonical name (CNAME) details for the alias that is mentioned in the FQDN. |
| MX | test.com | mail.test.com | EThis record is used for the mapping of mail exchange server information to a specific domain name. |
| PTR | 192.168.1.1 | dns1.test.com | This is an interesting record type where the user actually has the IP address of the domain from which he can map it to a CNAME, these mappings are stored in this record type. |

### Webserver & Firewall

A webserver should run on the Linux OS to host a website. Apache2 is the used webserver.A firewall is used to provide a layer of security to control the incoming and outgoing traffic in a network and to block and filter packets to go into the system. The firewall can for a system or even a specific server with bunches of databases or confidential data which is being shielded from unapproved clients in/outside the system.

## Signalling
### Dynamic Host Configuration Protocol

1. When a Client, configured with the TCP/IP setting “Obtain an IP address automatically(DHCP)”, plugs into a network, it sends out a broadcast from UDP port 68 to UDP port 67 to “DISCOVER” a DHCP Server (or relay agent).
2.The DHCP Server then responds by sending out an “Offer” (through a relay agent if applicable).
3.Then the client sends out a “Request”, requesting an IP address . 4. This request is finally “Acknowledged” by the server so that the client starts using the IP address.

### Domain Name Server

1. The requesting host will generate a DNS query packet, which will be passed to the Local DNS Server that is connected to the host network.
2. The Local DNS Server will receive this query and forward this to appropriate Root Name Server. The Root Name Server will check if it is a valid domain and if there are entries for that in its database and reply to the Local DNS.
3. The Local DNS will then send a query to the TLD DNS Server which will send the details of the Authoritative Name Server which will have the details of the mapping address or name.
4. The Local DNS Server will then send a query to the Authoritative Name server seeking the mapping for the domain name or the IP address which was initially sent by the requesting host.

### Webserver

1.The client initiates a TCP connection with the web server IP provider. 2.The connection involves a 3 way handshake mechanism.
3.First, the clients sends a SYN message requesting TCP connection to the browser at port 80.
4.The server responds with a SYN-ACK message acknowledging the request and requests the client to open a port for the server to send information.
5.The client responds with the ACK message and also sends a request for the HTML page.

## Installation Steps
### DHCP

Step 1: Install DHCP server package
Step 2: Edit the isc-dhcp-server file
Step 3: Configure the DHCP server for ipv4
For the servers within the network to always have the same IP, we have matched their MAC addresses with a specific IP.
Step 4 : Set the static IP address of the DHCP server
Step 5: Edit the resolv.conf file
Step 6: Restart the DHCP server
Step 7: Configuring the DHCPv6 server
Create a file named dhcpd6.conf

### DNS Server

In this project all the servers are in a private network and the servers receive its IP from the DHCP server. For configuring DNS, we have used Bind9 (Berkeley Internet Name Domain v9) on Ubuntu for resolving hostnames and IP addresses by the clients.
Prerequisite:
To configure DNS server one must have root user permissions and install Bind9. To install Bind9, use the following command,
Command:
Step 1: Obtain static IP from DHCP server and assign that in the interface – “/etc/network/interfaces”
Command:
Step 2: Now add the Name Server and Hostname details with respect to the webpage for which address resolving has to be done in the – “/etc/hosts” file.
Command:
Step 3: Provide the hostname for the webpage to be resolved in the – “/etc/hostname” file.
Command:
Step 4: Provide the IP address for the Name Server and name of the webpage in the – “/etc/resolvconf/resolv.conf.d/head” file.
Command:
Step 5: For the DNS Server we have to specify the forward and the reverse zones that will provide with the forward and reverse DN resolving. This can be done from the – “/etc/bind/named.conf.local” file.
Command:
Step 6: Now to add the forwarder IP for the DNS we can configure that in the – “/etc/bind/named.conf.options” file. There is also one more option where you can use Access Lists to only allow specified IP addresses to access the DNS server which can also be added here.
Command:
Step 7: Now we have to create the forward and reverse zone which will act as the database from which the DNS server will look-up to resolve for the Domain name or IP address. This database file can be created with reference to the already existing local database file at – “/etc/bind/db.local” file and making our own copy as the – “/etc/bind/db.project.com” file for the forward zone and “/etc/bind/db.192” file for the reverse zone.
Command:
Note:
* The serial number 9 represents the number of times this database file has been edited and make sure you increment it each time the file is edited.
* The @ symbol means that the record applies in all cases not otherwise specified.
* That is followed by IN the record type A or CNAME or AAAA or NS
Note:
* The serial number 6 represents the number of times this database file has been edited and make sure you increment it each time the file is edited.
* The @ symbol means that the record applies in all cases not otherwise specified.
* That is followed by IN the record type PTR or NS
Step 8: Now that we have defined the database and the name servers for the DNS server, we have to restart the server for the configurations to take effect.
Command:
Configuring Secondary DNS
The primary DNS will provide with the domain name resolving functionality for the clients. If there is a failure in the primary DNS, then the client will not be able to resolve for the domain name and will be cut off from using the web. In order to overcome this, it is advisable to have a secondary DNS server which will act as a backup in case the primary DSN fails. It is relatively easier to configure the secondary DNS once the primary DNS is configured.
Prerequisite:
To configure DNS server one must have root user permissions and install Bind9. To install Bind9, use the following command,
Command:
Step 1: Obtain static IP from DHCP server and assign that in the interface – “/etc/network/interfaces”
Command:
Step 2: Now add the Name Server and Hostname details with respect to the webpage for which address resolving has to be done in the – “/etc/hosts” file.
Command:
Step 3: Provide the hostname for the webpage to be resolved in the – “/etc/hostname” file.
Command:
Step 4: Provide the IP address for the Secondary Name Server and name of the webpage in the – “/etc/resolvconf/resolv.conf.d/head” file.
Command:
Step 5: For the Secondary DNS Server we have to specify the forward and the reverse zones that will provide with the forward and reverse DN resolving. This can be done from the – “/etc/bind/named.conf.local” file
Command:
Step 6: Now to add the forwarder IP for the secondary DNS, we can configure that in the – “/etc/bind/named.conf.options” file. There is also one more option where you can use Access Lists to only allow specified IP addresses to access the secondary DNS server which can also be added here.
Command:
Step 7: Now that we have defined the database and the name servers for the secondary DNS server, we have to restart the server for the configurations to take effect.
Command:

### Webserver

Step 1: To Install Apache2 Webserver
Command:
Step 2: To Check whether the web server is able to listen on port 80
Command:
Step 3: To restart the web server
Command:
Step 4: To develop a webpage for the server
Command:

### Webserver Backup

The protocols used for backup are rsync and ssh. Rsync is a protocol used to synchronize files in Ubuntu. It updates only that data that is not yet synchronized with the backup file. Ssh protocol provides a secure channel to send and receive files on Unix machines.It uses encryption and decryption at the end users. Crontab is used for scheduling backups. Step 1: Install rsync
Step 2: Install ssh
Step 3: Create a public and a private key for security
Step 4: Append new public key
Step 5: Edit crontab
Step 6: Scheduling and run the rsync command from the crontab to automate the backup of the webserver

### Firewall

Step 1: Install UFW package
Step 2: Check UFW status
Step 3: Set Up Default Policies
Step 4: Allow SSH,http,ftp,https Connections
Step 5: Disabling ping
Step 6: Enable UFW

## Algorithm

1. A client tries to connect to the network. 2. Once the client gets connected, he'll try to obtain an IP via DHCP. So a broadcast message will be sent out requesting an IP. 3. The DHCP server will provide an IP address to the client if the request is successful.
Otherwise, 'request fail' message will be obtained and we will need to contact the network administrator for help. 4. The client will now try to access the web server. If the domain name server details obtained via DHCP is correct, a request will be sent to DNS to resolve the IP address of the domain. DNS will then reply with IP address of the web page. else if DNS reply fails, an error message will be displayed saying, ‘server not found.’ else if URL entered is wrong, an error message will be displayed saying, ‘webpage unavailable.’ Retry 5. Client accessed the web server. Now he sends HTTP request to the server. if the request is successful, the Web page will be displayed else Error message like ‘no data received’ will be displayed. Retry

## Flow Chart

Flow chart has been provided in the project report.

## Add-ons Implemented (Additional Features)
### ARP Poisoning

ARP poisoning has been implemented using Scapy.

### NFS

Step 1:Configuring the NFS-server
Command:
Edit the file
On the last line append below
Save and Exit Change the directory
Start the server
Step 2:Configuring the NFS-client
Command to Install NFS client:
Make directory in a location

### IPSEC VPN

IPSEC VPN has been implemented using the 'strongswan' package. IPSEC VPN helps make the connection between two servers more secure and it also makes sure that sniffing cannot be done between them.

### VPN First Server Configuration

Step 1:Installing the 'strongswan' package Command:
Step 2:Making the cryto map entries Edit the /etc/ipsec.conf file Command:
Step 3:Make the PSK entries
We need to edit the /etc/ipsec.secrets file
Command:
Step 4:Restart the ipsec service Command:

### VPN Second Server Configuration

Step 1:Installing the 'strongswan' package Command:
Step 2:Making the cryto map entries Edit the /etc/ipsec.conf file Command:
Step 3:Make the PSK entries
We need to edit the /etc/ipsec.secrets file
Command:
Step 4:Restart the ipsec service Command:

## Testing
### DHCP Test

If the clients are able to get the IP addresses from the defined range of IP addresses defined in the server pool then the DHCP is working properly. For example, since the DHCPv4 address pool is assigned from 192.168.10.30 to 192.168.10.99 and the DHCPv6 pool is assigned from 2001:0db8:edfa:1234:5678::aaaa to 2001:0db8:edfa:1234:5678::ffff, if a client gets assigned an IP address of 192.168.10.36 & 2001:0db8:edfa:1234:5678::aaa1 through DHCP, then the DHCP server is assigning IP addresses correctly and is functioning properly.
We can also see the status of the DHCP servers by using the commands:

### DNS Test

For testing the functioning and effectiveness of DNS, the following commands will be useful:
1) Dig
The Domain Information Groper is used to query DNS name servers. It performs DNS lookups and returns the response from the name servers. Eg., We can perform a DIG from the secondary DNS using the following command,
Dig 192.168.10.10 project.com AXFR
This will return with the records from the master server.
2) Ping
Ping is used for checking the network layer status of the server. This can be performed on both the master and the slave DNS to check out if they are reachable from both.
3) Nslookup
nslookup is a command used to query DNS servers. Interactive mode gives permission to the user to query the name servers for getting information about hosts and domains. Non-interactive mode gives permission to the user for printing just the name and the information that is requested for a particular host or domain.
4) Host
Host is used for DNS lookups. It resolves hostnames to IP addresses and vice versa.

### Webserver Test

Open the web browser and enter the host name or the local IP address. If it is working, then the web server is up and running.

### Firewall Test

A client can try to ping the servers that are blocked. If the response is 'request timed-out' then, the firewall has blocked the client and it is working as per the firewall rules.

### VPN Test

To test IPSEC VPN, run a continuous ping from one server to the other. Simultaneously, run the command:
or
if the number of packets increases in the first case, or if you see packets come in the second case, then the IPSEC tunnel is configured properly.

### ARP Poisoning Test

When the client tries to access the webpage, if he/she is redirected to the hacked page, then APR poisoning has been properly implemented.

## Future Scope

1. Implementing AAA servers for added security. 2. Additional Firewall rules for added security. 3. Adding Mail servers. 4. Expanding server capabilities.
5. Increase the number of DNS for load distribution and decentralization.