linuxexpert-practice-labs/labs/lfca/2-3-networking

LFCA 2.3: Networking

Addresses and routes, a subnet worked out by hand, listening ports, DNS lookups, SSH keys, and a firewall that allows only SSH.

Before you start

Work as root (sudo -i), so ~ is /root. Answers go in /root/lab-answers/<task>. The VM needs internet access for task 4.

The lab runs a web server on port 8080 and creates user alice (password Lab-Pass-1). The peer, at 10.99.0.2 (name peer), stands in for a computer outside the VM; this VM is 10.99.0.1 there. Get a shell there with sudo ip netns exec lepeer bash. The lab notes the firewall's settings, and reset puts them back. Keep a console open for task 6: a firewall mistake can cut off SSH.

Tasks

1. Find the VM's IPv4 address with its prefix, its default gateway and its DNS servers. Write the address with its prefix (like 192.0.2.10/24) and the gateway to /root/lab-answers/1, one per line.
2. Work out the network address, broadcast address and usable range of 10.20.30.77/26. Write them to /root/lab-answers/2, one per line: network, broadcast, first usable, last usable. Check your answer with ipcalc if it's installed.
3. List the listening ports with ss -tulpn and say which service each belongs to. Write the name of the program listening on TCP port 8080 to /root/lab-answers/3.
4. Look up the A, AAAA and MX records of a domain you know with dig (in bind9-dnsutils on Ubuntu, bind-utils on the RHEL family). Write the domain to /root/lab-answers/4.
5. Set up SSH key login from root to alice on this VM: make a key pair for root, so that ssh alice@localhost logs in without a password.
6. Turn on the VM's firewall (firewalld on the RHEL family, ufw on Ubuntu), allow only SSH, and check that the web server on port 8080 can no longer be reached from the peer, while SSH still can.

Hints

• ip addr, ip route, /etc/resolv.conf or resolvectl status.
• A /26 has 64 addresses; the network address is a multiple of 64. ipcalc 10.20.30.77/26.
• ss -tulpn, the users:(("NAME",...)) column.
• dig example.org A, dig example.org AAAA +short, dig example.org MX.
• ssh-keygen, ssh-copy-id alice@localhost, then ssh alice@localhost.
• dnf install firewalld, systemctl enable --now firewalld, firewall-cmd --list-all, --remove-service, --remove-port, --permanent, --reload. ufw allow OpenSSH, ufw enable, ufw status. From the peer: curl --max-time 5 http://10.99.0.1:8080/.