0% found this document useful (0 votes)
667 views5 pages

Network Administration Project Overview

This document outlines the requirements for a group project where students will build and demonstrate a TCP/IP network configured with essential services like DNS, DHCP, email, web, and LDAP. It is divided into an individual component worth 20% and a group component worth 25% of the total course grade. Students will work in groups of up to three members to set up a base network system and implement additional enhancements. The document provides several options for individual and group enhancements that integrate additional features into the basic network system. It also specifies criteria for assessment, due dates, and instructions for documenting the work.

Uploaded by

Seprah K
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOC, PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
667 views5 pages

Network Administration Project Overview

This document outlines the requirements for a group project where students will build and demonstrate a TCP/IP network configured with essential services like DNS, DHCP, email, web, and LDAP. It is divided into an individual component worth 20% and a group component worth 25% of the total course grade. Students will work in groups of up to three members to set up a base network system and implement additional enhancements. The document provides several options for individual and group enhancements that integrate additional features into the basic network system. It also specifies criteria for assessment, due dates, and instructions for documenting the work.

Uploaded by

Seprah K
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOC, PDF, TXT or read online on Scribd
  • Group Project Overview
  • Part A: Individual Component
  • Part B: Group Component
  • Tasks and Enhancements
  • Special Recommendations
  • Basic VPN Configuration

Systems and Network Administration CT106-3-2 Page 1 of 5

Group Project: 45% of the total mark for the class *

Integrate DNS, DHCP, email, web, LDAP, SSL to create a Part A - Individual
working system (A4, PLO6) Component (20%)

Combine new elements into the basic system to meet the Part B - Group
needs of diverse communities of interest (A4, PLO4) Component (25%)

* Final Exam is 55% of the total mark for the class

Title: Network Administration Project


Overview: Students in groups of at most THREE (3) members will be required to build,
document, and demonstrate a TCP/IP network, configured with essential network
services and additional enhancements.

Criteria for assessment:


1. The network and its services work as intended
2. The report documents the system and indicates a correct understanding of how
the network components fit into the whole.

Maximum points for an enhancement will only be achieved when it is successfully


implemented (criteria 1) and properly documented (criteria 2).
A template for reporting on each enhancement is provided. Note that all screenshots
must include the student ID number of a group member in e.g., the hostname, email
address, or logfile entries. Anonymous screenshots and heavy reliance on screenshot
fragments that do not show personalization provide insufficient evidence, and the
maximum mark for the enhancement is 4/10.

Due dates: Week 7 : Base System Presentation (Part A)


Week 14 : Report Submission (Parts A & B)

Module: SNA Asia Pacific University of Technology and Innovation 2020


Systems and Network Administration CT106-3-2 Page 2 of 5

Part A: Individual Component (20%)

Everyone needs to do an individual demonstration of their base system around


mid-semester. To prepare for the demonstration, add your TP number as a user in
/home/vmail/mail-pwd, and send yourself some test emails. The demonstration simply
requires you to [A] show an email from your inbox in Squirrelmail, and [B] access the
LDAP server using PLA.

Everyone needs to do an individual enhancement for their base system. There are
a number of options listed below for enhancements to the base system, and each group
member needs to choose one for their individual work. The rest will be available for the
group to work on together.

Part B: Group Component (20%)


There are a number of options listed below for enhancements to the base system, and
once each group member chooses one enhancement for individual implementation, the
rest will be available for the group to work on together.

The minimum number of enhancements done by the group is 3. The group is free to
choose any combination, and a special scenario devised by the group can be proposed
to your lecturer, who will be happy to advise on its suitability and help you refine it if
necessary.

Remember, maximum points for an enhancement will only be achieved when it is


successfully implemented (criteria 1) and properly documented (criteria 2).

Screenshots used to document enhancements must show the student ID of the


owner in e.g., the command prompt, logfile messages, or email address. Details
of how to do this are in the Resources Document and Report Template.

Documentation should be organized as a set of steps that were followed to implement


the enhancement, with a focus on pitfalls and obstacles encountered and overcome. If
you find a resource that is useful, refer to it with some critical evaluation (how complete
is it? how close is their system to our system? what’s missing?) rather than copy/paste
into your report.

A peer evaluation of group work form will be provided, for online submission. This is an
important part of the assignment, and is included in the final mark. The peer evaluation
of group work form is submitted individually, and should not be included in the final
report.

Module: SNA Asia Pacific University of Technology and Innovation 2020


Systems and Network Administration CT106-3-2 Page 3 of 5

1.1 LDAP – The missing piece of our enterprise network


a) Configure dovecot and squirrelmail to use LDAP
b) Demonstrate by using the squirrelmail address lookup to send mail from your
personal account to someone in the LDAP directory

1.2 Extended LDAP – (this is a separate enhancement, but do 1.1 first)


a) Add the dc= DIT to the LDAP directory and PLA
b) Demonstrate by using the squirrelmail address lookup to send mail from your
personal account to someone in the dc= DIT and showing the dc= DIT users in
PLA

2. SUDO - when you move to Ubuntu, you will want to manage sudo!
Choose one server and
a) Set up two normal users
b) Allow no root login: force everyone to use sudo
c) Have different color prompts for normal users and root
d) Change the startup display to show a random fortune in color each time a user
logs in.
e) Edit /etc/[Link] to stop advertising the root password

3.1 Virtual Servers


Choose one server and
a) Set up two normal users, and add directories under their home directories for
their web pages and CGI scripts
b) Set up a virtual server (VirtualHost) for each user in [Link], change
permissions on the VirtualDocumentRoot directories so users cannot access
them, and add appropriate cnames to dnsmasq on the Gateway
c) Set up a cron job to automatically move files from home directories to the proper
VirtualDocumentRoot

3.2 Virtual Servers with NFS – (this is a separate enhancement, but do 3.1 first)
a) Put the VirtualDocumentRoot directories (from 3.1) on a new VM which will be
the server for NFS mount, and export them
b) Delete the original directories and mount the exported ones
c) Remove the VirtualHost users and the cron jobs on the original webserver
d) Set up the VirtualHost users and run the cron jobs on the NFS server

Module: SNA Asia Pacific University of Technology and Innovation 2020


Systems and Network Administration CT106-3-2 Page 4 of 5

4. Protocol Analysis
Use tcpflow to capture the dialog between the browser and monkey webserver when
a) You access the default monkey webpage. What command line arguments
determine if you can or cannot recover the images from the tcpflow files?
b) You access a mailbox in squirrelmail. How many requests are made? How many
servers are involved?

5. iptables
a) Add the six “Rules for things that no proper TCP stack should be processing”
from the IPTables Quick Reference section -p --protocol tcp using a LOG
target instead of DROP
b) Show that the rules are saved to a shell script
c) Use hping and multitail to show the rules are working

6. Syslog Server
a) Reconfigure syslog on the Gateway to listen for log messages from the network.
Use netstat –tulp to show it is running.
b) Reconfigure syslog on the Mailhost to send root login log messages to the
Gateway AND the local file /var/log/secure
c) Use multitail to separate the merged logfile entries and show them in separate
windows

7.1. Cross-System Multitail with xinetd


Use the xinetd method to set up a listener on the mailserver, and show the
postfix logfiles on the Gateway and mailserver at the same time in separate
multitail windows

7.2. Cross-System Multitail with netcat


Same as 6.1, but use the netcat method for the remote listener.
(These are independent enhancements - you can do either or both)

7.3. Cross-System Multitail with regex


(this is a separate enhancement, but do 6.1 or 6.2 first)
Modify your enhancement 7.1 or 7.2 to use the dnsmasq logfile on the gateway
and the dhcpcd logfile on the mailhost instead of the postfix logfiles, and use
regular expressions to select the DHCP activity for today on both servers.

8. STUNNEL – Securing our enterprise network


a) Setup stunnel to secure communication between all of the TinyNet servers. Use
netstat –tulp to show stunnel is running on each one.
b) Demonstrate a https:// connection between the host browser and the TinyNet
Webserver

Module: SNA Asia Pacific University of Technology and Innovation 2020


Systems and Network Administration CT106-3-2 Page 5 of 5

9. Basic VPN
a) Setup openvpn using static keys
b) Demonstrate a ping across the VPN tunnel with two sets of config files, one for
tun and one for tap

10. Compile and Install


a) Setup a VM using the TinyNet-gcc image
b) Compile the toilet source code and demonstrate using shell scripts

Special Recommendations for Ethical Hacking

11. Migrate to Net-R


a) Complete the Net-R Basic Setup: Domserv and one Net-R host
b) Clone and reconfigure your TinyNet servers as Net-R servers
(NOT the gateway – the Net-R Domserv takes on that role)
c) Reconfigure DNSMASQ to hand out static addresses to servers rather than
dynamic ones

12. Net-R Traffic


a) Complete the Net-R Basic Setup: Domserv and two Net-R hosts
b) Setup syslog on the Domserv to listen for log messages with Facility LPR and
Priority Notice and save them to a particular file
c) Modify the automatic traffic generation scripts on both Net-R hosts to send log
messages to the Domserv

13. Port Knock


a) Use the Netcat and Named Pipes technique to set up a reverse shell
b) Use knockd and hping to control availability (activate/deactivate)

Module: SNA Asia Pacific University of Technology and Innovation 2020

Common questions

Powered by AI

The key differences between using xinetd and netcat for cross-system multitail enhancements lie in their configuration and operational flexibility. xinetd is a more structured super-server daemon that can manage network-based services, allowing precise control over which services run under specified conditions. Netcat, however, offers a more straightforward method for data transfer between system components, functioning like a simple utility to connect between sockets. Using xinetd provides richer features such as access control and logging, making it easier to manage services reliably. In contrast, netcat is less sophisticated but highly versatile for ad-hoc transfers without the overhead of a service manager. These differences mean xinetd setups require more comprehensive configuration for effective service management while netcat setups can be more ad-hoc but may lack the security features provided by structured daemons like xinetd .

Setting up a basic VPN with OpenVPN using static keys significantly enhances network communication privacy and integrity. VPNs create encrypted tunnels for data, preventing eavesdropping and tampering by encrypting the entire communication channel. Using static keys simplifies configuration but may limit scalability and key management. Static keys ensure consistent encryption, but they require secure distribution and storage to prevent breaches. By establishing such a VPN, sensitive data remains confidential and intact, deterring potential data leaks and ensuring secure communication across less-trusted networks .

Setting up stunnel enhances network security by encrypting data between TinyNet servers, thereby preventing unauthorized interception of sensitive information. It implements TLS/SSL protocols, providing confidentiality and integrity assurances for data in transit. Specific configurations that ensure data integrity include using strong cipher suites, configuring stunnel for mutual authentication with client certificates, and ensuring certificates are properly signed by trusted Certificate Authorities to prevent spoofing. Additionally, enabling logging helps trace any connection anomalies, further supporting network security .

Setting up Virtual Servers with NFS enhances scalability and performance by separating storage from server instances, allowing multiple servers to access shared storage resources efficiently. This setup supports horizontal scaling and ensures consistent data access across different instances. Critical considerations for NFS setup include ensuring network reliability and sufficient bandwidth to handle increased data traffic, setting appropriate NFS export permissions to prevent unauthorized access, and implementing locking mechanisms to maintain data consistency. A well-designed NFS configuration increases both flexibility and resource utilization in network environments .

Disabling root login and enforcing sudo usage on Ubuntu is crucial because it minimizes the risk of system compromise by restricting direct root access, which is more vulnerable to brute-force attacks. Using sudo promotes accountability and allows granular permission control, as users must authenticate themselves before performing administrative tasks, and all actions are logged. This approach effectively divides privileges, reducing the chance of accidental or intentional system changes by unprivileged users and contributes significantly to system security .

Protocol analysis using tcpflow plays a crucial role in understanding network communication by capturing and displaying data transmitted over the network in a human-readable format. This visibility allows administrators to analyze communication patterns, identify anomalies, and pinpoint potential vulnerabilities such as unencrypted sensitive data or unauthorized access attempts. By examining these data flows, security configurations can be refined to close vulnerabilities, enforce encryption, and ensure compliance with security policies, significantly enhancing network robustness .

The requirement to personalize supplements such as screenshots with student IDs affects the reporting process by ensuring accountability and authenticity, which proves the originality of individual contributions and discourages plagiarism. This personalization verifies that the work was completed by the claimed individual, thus enhancing the credibility of the documentation. It can add complexity to the reporting process as it requires extra steps for verification, but it is crucial for maintaining academic integrity in network administration projects .

The use of peer evaluation forms in group projects for network administration offers advantages such as promoting accountability and providing insights into individual contributions, which can equilibrate grading among group members based on effort and contribution levels. It encourages self-reflection and motivates members to contribute equally. However, disadvantages include the potential for bias, where personal relationships might affect evaluations, and stress due to the high stakes of peer opinions impacting grades. Effective use requires clear guidelines and transparency in evaluation criteria to mitigate these disadvantages .

Using a LOG target instead of DROP for iptables when processing improper TCP stack packets allows administrators to capture log entries for each such packet, providing valuable insight into potential attacks or misconfigurations. The LOG target records packet information without altering the traffic flow, aiding in verifying if certain rules are effective and in diagnosing issues. However, this approach increases log file size and may generate unnecessary noise, requiring robust log management practices to discern actionable intelligence. While it does not directly enhance packet control, it bolsters security monitoring .

Configuring LDAP for Dovecot and Squirrelmail presents challenges such as ensuring compatible schema configurations between LDAP and mail applications, accurately mapping LDAP attributes to email fields, and maintaining directory synchronization. Address lookup might fail if schemas are mismatched or if access permissions are incorrectly set. A solution is to ensure LDAP schemas support the mail application requirements and to configure Dovecot and Squirrelmail with proper attribute mappings. Regularly synchronized directories and properly set bind DN permissions are critical to avoid disruptions in address lookups and email deliveries .

You might also like