# Data Networking/Fall 2016/FYY

1. Fulin Shen 2. Yanxiao Lu 3. Yehui Rong

## Motivation

The development of Linux is one of the most prominent examples of free and open-source software collaboration, and this is our motivation to use Linux operating system to design a robust, effective and dynamic network solution for a start-up company, including the main and backup DNS server, DHCP server, web server, firewall, IPsec VPN, NFS and backup.

## Behaviour of Protocols
### Domain Name System

Domain Name System (DNS) controls the domain names of web server, translate them to Internet Protocol address. DNS is a protocol within the set of standards of how devices exchange data on the Internet. In this project, we design five records for the web server, including A, AAAA, NS, CNAME, and PTR types.

### Dynamic Host Configuration Protocol

Dynamic Host Configuration Protocol (DHCP) is a network protocol that enables a server to automatically assign an IP address to a computer from a defined range of numbers (i.e. a scope) configured for a given network. DHCP assigns an IP address when a system is started.

### webserver

LAMP (Linux, Apache, MySQL, and PHP) is the most popular solution to get a web server up and running. In this project, we use LAMP to set up a simple webpage so that clients can browse it with the DNS and DHCP server’s help.

### Firewall

The main function of a firewall is to provide security through couple rules applied to the server. Here we use the firewall to allow all the needed services and deny others to make our network secure and robust.

### File Transfer Protocol

File transfer protocol offers the backup to the server to avoid the whole network crush if the main server is malfunction. FTP is built both on the client and server, use different control and data connections between the server and client. In the project, we design the policy to back up the whole web and SQL data every day, and clean the data every 30 days to save the space.

### Arp Poison

Arp (address resolution protocol) determines the MAC address of a device with an IP address. And the Arp poison is a network attack which exploits the transition from layer 3 to layer 2 addresses. Arp poison means that the hacker replaces the MAC address in the normal ARP message with a counterfeit one, then the hacker can take the role of man in the middle to spoof any traffic. In the project, we use a client to work as a hacker to attack another client. Every time when the normal client tries to login the webserver page, the hacker will replace the web page and display a fake website to the client.

### IPsec VPN

IPsec (Internet Protocol Security) is a protocol used to offer secure IP communications by authenticating and encrypting the messages between the peers. Here we design a IPsec VPN tunnel between two servers using the pre shared key.

### Network File System

Network File System (NFS) is a distributed file system protocol originally developed by Sun Microsystems, allowing the user or system administrator to mount (designate as accessible) all or a portion of a file system on a server. In this project, we create 2 clients to whom the shared file is available.

## Installation Steps
### DHCP server

Step1: Install DHCP Command:
Step2: configure the network card Command:
Find the line after ‘#’ and change the network card as ens33:
Save and Exit
Step3: edit the dhcpd.conf file Command:
Set the domain name and the domain-name servers:
Uncomment the following line:
Give the ip address poll and define the subnet:
Give fixed address to the web server, DNS server, DNS standby server and three clients:
And I give three clients 193.168.1.104, 193.168.1.105, 193.168.1.106 as the method above.
Step 4: give the static address to the DHCP server Command:
DHCP IPv6 configuration Step 5: open the IPv6 configuration Command
Make the changes as shown below:
Run sysctl –p to make it effective.
Step 6: install radvd Command:
Step7: configure the IPv6 address pool Command:
Step 8: give the DHCP server a fixed address Just as shown in step 4
Step 9: configure the DHCP server to access website through domain name Command:
step 10: restart and check the dhcp server after configuration Command:

### DNS

Master DNS
Step 1: Install bind9 Command:
After install bind9, we will get configuration files named.conf, named.conf.options, and named.conf.local in
Step 2: Demand We want to make this host as master DNS, and can resolve
www.pawupa.com 193.168.1.1(webserver) And add five records Thus, we need to add
Forward Lookup Zones “pawupa.com” Backward Lookup Zones “1.168.193.in-addr.arpa”
Another Backward Lookup Zones for IPV6 “0.0.0.0.0.0.0.0.0.0.0.0.9.9.1.1.ip6.arpa”
Step 3: Edit configuration file “named.conf.local” Add the forward and backward lookup zones
Command:
Step 4: Add files of zones Copy a zone “db.local” to pawupa.com Copy a zone “db.local” to rev.pawupa.com Copy a zone “db.local” to revip6.pawupa.com Command:
Step 5: Edit files of zones Command:
Step 6: Restart DNS service Command:
Slave DNS
Step 1: Edit configuration file “named.conf.local” Add “allow-transfer { 193.168.1.103; }; “ to each zone, that synchronize the configuration of zones from master to slave. If master DNS cannot use, the slave DNS will help it to resolve. (193.168.1.103 is the IP address of slave DNS)
Command:
Step 2: Install bind9 to another host (slave DNS) Command:
Step 3: Edit configuration file “named.conf.local” in slave DNS host Add the forward and backward lookup zones
Command:
Step 4: Change the authority of "/etc/bind” Command:
Step 5: Restart apparmor Command:
Step 6: Restart DNS service The configuration of zones files will be synchronized by master DNS Command:

### Web Server

Step 1: Install Apache Command:
Step 2: Install PHP Command:
Step 3: Install MySQL, password “linux” Command:
Step 4: Check mysql is working Command:
Step 5: Install phpmyadmin using the apache2 and myql-server with password linux Command:
Step 6: Change the authority of /var/www Command:
Step 7: Create the phpmyadmin link Command:
Step 8: Create a basic webpage “Index.htm”
Step 9: Change the default webpage catalog “/var/www” to “/home/fulin” Command:
Step 10: Change the default webpage catalog “/var/www/html” to “/home/fulin” Command:
Step 11: Restart the apache Command:
Step 11: Use the browser on mac to connect the web page of the web server in VM

### Firewall

Step 1: List the current rules that are configured for iptables Command:
Step 2: Accept your current SSH connection Command:
Step 3: Accept SSH, HTTP, FTP, TFTP, DHCP, DNS, VPN Command:
Step 4: Accept services on the computer communicate with each other by sending network packets to each other Command:
Step 5: Accept all traffic on loopback interface Command:
Step 6: Allow Established Outgoing Connections Command:
Step 7: Internal to External Command:
Step 8: Drop Invalid Packets Command:
Step 9: Deny ping Command:
Step 10: Limit 10 connection for every client Command:
Step 11: Prevent HTTP flood Command:
Step 12: Block an IP Address Command:
Step 13: Cancel the block IP address Command:
Step 14: Permit VPN Command:
Step 15: Deny any other Command:
Step 16: In order to preserve your IPTABLES rules upon reboot, install iptables-persistant Command:
Step 17: If you make any changes to the rules, run the following commands so you don’t lose them during a system reboot Command:

### Back UP

Step 1: Install ftp Command:
Step 2: Start ftp server Command:
Step 3: Create ftp script “testftp.sh”
Step 4: Add authority to script Command:
Step 5: Change configuration of ftp
Step 6: Add kernel module to allow passive ftp
Step 7: Restart ftp service and check the status Command:
Step 8: Add rule to commit the script every day at 14:40 PM Command:
Step 9: Restart cron service and check the status Command:

### Arp poison

Step 1: Install scapy Command:
Step 2: Use root Command:
Step 3: Start iptables after reboot Command:
Step 4: Turn on IP forwarding Command:
Step 5: Configure Scapy arp poison Command:
Step 6: Create fake web page Command:
Step 7: Then configure your IP Tables to forward all traffic except HTTP traffic. For HTTP traffic, we will return our own site instead (193.168.1.104 is the IP address of hacker) Command:

### IPsec VPN

Step 1: Inatall strongswan Command:
Step 2: Install Opensc Command:
Step 3: Install GMP library Command:
Step 4: Install development library of GMP Command:
Step 5: Install Openssl libcrypto Command:
Step 6: Under /usr/src/ folder, download the Strongswan Command:
Step 7: Extract the compressed file Command:
Step 8: Run the configure script to check the dependencies of strongswan Command:
Step 9: Run the configure script, use prefix /usr/local and enable openssl support Command:
Step 10: Run the following two commands to compile and install strongswan under /usr/local directory Command:
Step 11: Under /usr/local/etc path, Pre-share key based tunnel One side ipsec.conf configuration:
Step12: After changes at both sides, create tunnel Command:
Step 13: Check the status of tunnel on both machines Command:
Step 14: Test One server ping another:
At the another side, watch the status (If you notice the number of packets and the number of bytes should be increasing with the ping being run, this shows things are running the way they should be.):

### NFS

NFS-Server
Step 1: Inatall nfs-kernel-server Command:
Step 2: Make share folder Command:
Step 3: Edit configuration Command:
Step 4: Restart service Command:
Step 5: Test Command:
NFS-Clients
Step 1: Inatall nfs-common for clients Command:
Step 2: Make share folder Command:
Step 3: Mount the share file Command:
Step 4: Mount this share file when turn on the client Command:

## Test Plan
### DHCP Test

Step 1: Start the DHCP server. Step 2: Start all the other clients, use “ifconfig” command to check whether or not the IP address is correctly received from the DHCP server.

### Webserver Test

Step 1: Start the web server. Step 2: At the client side, open the browser and enter the IP address of the webserver to check whether or not the right web page can be displayed.

### DNS Test

Step 1: Start the DNS server. Step 2: At the client side, open the browser again and this time enter the domain name of the webserver instead of the IP address, check whether or not the right web page can be displayed.

### Firewall Test

Step 1: At a client side, open the browser to surf the web page. Step 2: Add an IPtable to deny the client browsing the web server. Step 3: At a client side, open the browser again, force refresh the web page, check whether or not the right web page can be displayed. Step 4: Delete the IPtable to allow the client browsing the web server again. Step 5: Again at the client side, open the browser again, force refresh the web page, check whether or not the right web page can be displayed. Step 6: When all the other IPtable rules existing, test the whole functions of the project to check whether or not these functions are working well or not.

### Backup Test

Step 1: Start the FTP server. Step 2: Change the ftp configuration to enable the backup process in the next couple minutes, restart the ftp server. Step3: When the designed time arrives, check whether or not the files are backed up to the local file folder and the remote device’s file folder too.

### Arp Poison Test

Step 1: Start the normal web server and the hacker’s web server. Step 2: The hacker to send fake ARP message to the client. Step 3: The client opens the browser to enter the normal web page, check whether or not the client will the fake web page instead of the normal page.

### IPsec VPN Test

Step 1: One server ping another (Ping –s 4048 193.168.1.104). Step 2: At the another side, watch the status (If you notice the number of packets and the number of bytes should be increasing with the ping being run, this shows things are running the way they should be), using command “Sudo watch ipsec statusall”.

### NFS Test

Step 1: Start NFS server and client. Step 2: Put a file to the shared folder on the client server. Step 3: At the server side, check whether or not the file exists.