# Data Networking/Fall 2013/Group8
## Group Members

* Hang Chen
* Jatin Verma
* Sunan Jiang
* Phum Auacherdkul

## Understanding the Protocol
### Client–Server Architecture

The client–server characteristic describes the relationship of cooperating programs in an application. The server component provides a function or service to one or many clients, which initiate requests for such services. The model assigns one of two roles to the computers in a network: Client or server. A server is a computer system that selectively shares its resources; a client is a computer or computer program that initiates contact with a server in order to make use of a resource. Data, CPUs, printers, and data storage devices are some examples of resources.

### Dynamic Host Configuration Protocol

Dynamic Host Configuration Protocol (DHCP) is a standardized networking protocol used on IP networks that dynamically configures IP addresses and other information that is needed for Internet communication. DHCP allows computers and other devices to receive an IP address automatically from a central DHCP server, reducing the need for a network administrator or a user from having to configure these settings manually. DHCP uses the concept of a "lease" or amount of time that a given IP address will be valid for a computer. The lease time can vary depending on how long a user is likely to require the Internet connection at a particular location. It's especially useful in education and other environments where users change frequently. Using very short leases, DHCP can dynamically reconfigure networks in which there are more computers than there are available IP addresses. The protocol also supports static addresses for computers that need a permanent IP address, such as Web servers. DHCP is used for Internet Protocol version 4 (IPv4), as well as IPv6. While both versions serve the same purpose, the details of the protocol for IPv4 and IPv6 are sufficiently different that they may be considered separate protocols.[6] IPv6 devices may alternatively use stateless address autoconfiguration. IPv4 hosts may use link-local addressing to achieve limited local connectivity.

#### DHCP Procedure

* DHCP discovery
* DHCP offer
* DHCP request
* DHCP acknowledgement

### Domain Name Server

Domain Name System (DNS) translates Internet domain and host names to IP addresses. DNS automatically converts the names we type in our Web browser address bar to the IP addresses of Web servers hosting those sites. DNS implements a distributed database to store this name and address information for all public hosts on the Internet. DNS assumes IP addresses do not change (are statically assigned rather than dynamically assigned).

### Firewall

A Firewall is a software or hardware-based network security system that controls the incoming and outgoing network traffic by analyzing the data packets and determining whether they should be allowed through or not, based on applied rule set. Firewalls can be defined in many ways according to your level of understanding. A firewall establishes a barrier between a trusted, secure internal network and other network (e.g., the Internet) that is not assumed to be secure and trusted.

### Backup

A Backup, or the process of backing up, refers to the copying and archiving of computer data so it may be used to restore the original after a data loss event. The verb form is to back up in two words, whereas the noun is backup. Backups have two distinct purposes. The primary purpose is to recover data after its loss, be it by data deletion or corruption. Data loss can be a common experience of computer users. The secondary purpose of backups is to recover data from an earlier time, according to a user-defined data retention policy, typically configured within a backup application for how long copies of data are required. Though backups popularly represent a simple form of disaster recovery, and should be part of a disaster recovery plan, by themselves, backups should not alone be considered disaster recovery.

## The Requirements
### DNS

" httpː//www.sudotic.com " As IPv4 and IPv6.

### Webserver

In our project we use Apache 2.

#### Apache

Apache web server is the most widely utilized web server in the world and most of the world's websites are served on Apache web servers. Apache development is run by the Apache Software Foundation, which is a community of software developers. Apache is released with an open-source software license. There are releases of Apache that can run on most operating systems including Unix, Linux, Windows and Apple to name a few. Most often Apache is run on Linux web servers. The danscourses.com website is hosted on an Apache webserver, using shared webhosting. Shared webhosting utilizes Apache's ability to host multiple websites on one web server, called virtual hosts.

### Firewall

Make your server the most secured one in all possible ways.

### Backup server

Our group use Rync (and shell) as a backup tool and crontab for automaticly backup

#### Rsync

Rsync is a fast and extraordinarily versatile file copying tool. It can copy locally, to/from another host over any remote shell, or to/from a remote rsync daemon. It offers a large number of options that control every aspect of its behavior and permit very flexible specification of the set of files to be copied. It is famous for its delta-transfer algorithm, which reduces the amount of data sent over the network by sending only the differences between the source files and the existing files in the destination. Rsync is widely used for backups and mirroring and as an improved copy command for everyday use.

#### Cron

Cron is a system daemon used to execute desired tasks (in the background) at designated times.
A crontab is a simple text file with a list of commands meant to be run at specified times. It is edited with a command-line utility. These commands (and their run times) are then controlled by the cron daemon, which executes them in the system background. Each user has a crontab file which specifies the actions and times at which they should be executed, these jobs will run regardless of whether the user is actually logged into the system. There is also a root crontab for tasks requiring administrative privileges. This system crontab allows scheduling of systemwide tasks.

#### Passwordless ssh

Because OpenSSH allows you to run commands on remote systems, showing you the results directly, as well as just logging in to systems it's ideal for automating common tasks with shellscripts and cronjobs. One thing that you probably won't want is to do though is store the remote system's password in the script. Instead you'll want to setup SSH so that you can login securely without having to give a password.
Thankfully this is very straightforward, with the use of public keys.
To enable the remote login you create a pair of keys, one of which you simply append to a file upon the remote system. When this is done you'll then be able to login without being prompted for a password - and this also includes any cronjobs you have setup to run.
If you don't already have a keypair generated you'll first of all need to create one.

#### Zip

The program is useful for packaging a set of files for distribution; for archiving files; and for saving disk space by temporarily compressing unused files or directories.
The zip program puts one or more compressed files into a single zip archive, along with information about the files (name, path, date, time of last modification, protection, and check information to verify file integrity). An entire directory structure can be packed into a zip archive with a single command. Compression ratios of 2:1 to 3:1 are common for text files. zip has one compression method (deflation) and can also store files without compression. zip automatically chooses the better of the two for each file to be compressed.

## Steps to perform the setup / installation
### Installation

First, we need to configure all the server in the network separately.

#### DHCP

Download the "isc-dhcp-server", revise the file which is in the directory: /etc/dhcp/dhcpd.conf.
In this configuration for dhcpd, we have already fixed Ipv4 address of the Web server and the DNS server. Each host have two MAC (hardware) addresses for wireless and wired. In this project, we used the MAC address of wired to fixed IPv4 address (RARP).
Finally, the Web server and the DNS server will obtain fixed IPv4 address 192.168.10.2 and 192.168.10.4 and the client will obtain dynamic IPv4 address in the setup range.
Now for IPv6 configuration' Since dhcpd cannot give out both Ipv4 and Ipv6 at the same time and we already have done a working for Ipv4, we need configured DHCPd6 and use a lot of configuration same as dhcpd in dhcpd6 configuration. Firstly, we configured the /etc/dhcp/dhcpd6.conf file
Since we cannot use MAC addresses to fixed Ipv6 address for Web server and DNS server, we must use a client ID of each host to fixed IPv6 address.
Problem is we don’t know client ID of each host. So, we cannot fix IPv6. We can find out by consider process log and look in file that in IPv6 process step by step.
Client ID can find in /var/lib/dhcp/. You will find dhcpclient……….lease file that has client ID inside. Every *.lease file hold same client ID.
Radvd package It is required for the IPv6 stateless auto-configuration. Radvd (Router advertisement daemon). If we want to use DHCPv6 hang out IPv6 addresses, we must have a correct configuration in radvd file. Firstly, we need to install the “radvd” package Then, open the Ipv6 permission in /etc/syscyl.conf file
The problem we faced is radvd.conf and dhcpd6.conf configuration is not suitable for our project. We need to consider every condition in our configuration.

### DNS

Configure IPv4 DNS server: Installing a DNS server 1. Our domain name is sudotic.com. So first we need to get an Bind 9 package which will be having the configuration directories. install bind9 This will install the package and required directories.
2. Create a file for forwarding the Domain name which has the same format as the file db.local:
3. Create a file for reversing domain name which has the same format as the file db.12 The last 5 lines begin with the numbers which represent the last digit of IP address in our network. And items in this file should have a reflection in the forwarding file. For example, “6” is the last digit IP address of our web server, and www is also showed in the forwarding file which has the IP address of 192.168.10.6.
4. Then we need to add our forwarding file and reversing file as local zones. The forwarding zone is not confusing, but in the reversing zone, the name of the zone could be regarded as a prefix which is combined with the digit in the reverse file and consist to a whole reversed IP address. And also, we set the entire zone as a primary server, so we add the line “type master” in every zone.
Add configuration for IPv6 in DNS server: As the first picture shows, we can add IPv6 address in the forwarding file using AAAA. And what we should do next is to add a reversing file for IPv6 address.
1. The reversing file for IPv6 has the same format as db.127. The address which reflects the www.sudotic.com should be the reversing address of the last 16 digits in the IPv6 address. In our case, the IPv6 address is 1988:1990:1991:888::2, so the last 16 digits in reversing manner is 2000000000000000 and divide digits by dot. Then save.
2. Then we need to add a zone for IPv6 address. The syntax is the same as IPv4, but the reversing zone name should be the first 16 digits of the IPv6 address in reversing manner. In our case, they are 1988199019910888, and divide these digits by dot. As follow:

### Web server

Download the "apache2"

### Backup server

Requirement is automatically backup with zip file every day 12am.
1) What we Need
2) Passwordless login
3) Write script that include command for zip and rsync file.
4) Configure Crontab

#### Firewall
##### Download “ufw”

* Specify what service will allowed by this firewall. In our case, we allowed for HTTP and SSH.
* Enable firewall and also you can check status of firewall.

##### Config Sysctl file

* IP Spoofing protection
* Ignore ICMP broadcast requests
* Disable source packet routing
* Ignore send redirects
* Block SYN attacks
* Ignore ICMP redirects
* Ignore Directed pings

##### Restrict Apache information

* Config apache 2 security configuration file
* Disable Apache Signature and/or Apache Banner and trace HTTP request
* Restart apache

#### DNS server

* First we need to install a Bind DNS server
Putting a DNS server on a network allows for the replacement of IP addresses of individual machines by a name. As a result, it's even possible to associate multiple names to the same machine to update the different available services. For example, www.example.com and pop.example.com, could both point to the primary server where the mail server and the business intranet reside, and the domain could be example.com. It's easy to remember that these two services are running on the same machine whose IP address is 192.168.0.1.
Command ː sudo apt-get install bind9

### Configuration

Second, check if the DNS is working.
Third, check if the DHCP is working.
* Establish a wlan by the computer which is set up as DHCP server.
* Revise the wlan setup, set the ip address to 192.168.10.2 and the subnetmask. Reconnect to this wlan.
* Use another computer to connect to this new wlan, type in "ifconfig", see if its ip address is in the ip pool which is defined by DHCP server file.
Fourth: check if Webserver is working check if web server is working. (because we can use ip address to visit the web server without DNS server, so it is easy to check it)
* Make sure web server and host are in the same wlan created by the DHCP and are successfully distributed the IP address.
* Try to use firefox to connect to the 192,168.10.3 directly. See if it works.
Fifth: check if Firewall is working
Sixth: add on all the requirement in this part, especially DNS. Try to figure out how to deal with IPv6 address.

## Testing
### Webserver

* To check to see if Apache is running open Firefox and type in the following web address: http://localhost or, loopback address We will see the message, "It Works!" This is the Apache homepage, the index.html file and it means the server has installed correctly and is currently running. If it doesn’t see "It Works!" try starting the server. The commands to start, stop and restart Apache are: $ sudo /etc/init.d/apache2 start $ sudo /etc/init.d/apache2 stop $ sudo /etc/init.d/apache2 restart

### Backup

The biggest problem we face in this part is SSH: Permission denied (publickey,password). So we assume that problem is public key.
* Generating key for paswordless login
We face a problem here that we have more than one way to copy public key to backup server. So we try every way for testing.
o First way is use scp command to copy public key to backup server and create authorized_keys and then copy content inside of public key to authorized_keys. Sometimes it works and not works.
o Second way is use ssh-copy-id command to create and copy content inside public key at the same time to backup server. This is the best way.
o Also I test to ssh login to backup server for testing passwordless login is working correctly.
* Script
Problem here is rsync ssh and cron have condition when it use together.
o First, testing zip file and it work correctly along with –r that means it will include all files and directories in zip file.
o Second, testing rsync. By use rsync to transfer file within same machine. Then try to transfer file to backup machine. Problems happen here that I cannot write file to user in backup machine. So I recreate user in backup machine by appropriate way.
o Third, combine commands in script and run by
$ ./backup.sh
It works correctly by checking timestamp of backup file in backup server.
First time I tried to combine command without specify all path, it works correctly by itself but not with crontab. So I fix it appropriately.
* Crontab
Problem here is crontab don’t know where is rsync command. I found out this because of cron.env that doesn’t has path for rsync and ssh.
o First test is specifying time and look for timestamp in backup server. It works only zip command. I can check at timestamp of zip file but not work for rsync because I put the command like
$ rsync –az ssh –e …
I solve this problem by specify full path for rsync and ssh in crontab. Everything is solve by consider error in log file. It’s very useful.

### Firewall

* Ping testing : try to ping from client to webserver and try to access website via browser.
* Firewall rules testing : try to telnet, ssh, ftp from client to webserver. Result is denied by webserver. One specific rule is webserver still can ssh to backup server.

## Add-on

NIS-Network Information Service NFS- Network File System VPN-Virtual Private Network

## Future improvement

DHCP DNS Webserver/Backup/Firewall -support more languages such as php mysql -mail server will be provided -encrypted backup file and provide more option about transfer file -more efficient script -improvement in security
-close all the hole
improvement in database is important. SAMBA CIFs network printer

## Citations

http://ubuntuforums.org/ https://help.ubuntu.com/community/ http://www.ietf.org/ https://en.wikipedia.org