updated project 1
This commit is contained in:
Hugh Ratsch
@@ -28,68 +28,136 @@ This project documents the setup of a basic home lab environment using VirtualBo
|
||||
- [x] Basic system configuration
|
||||
- [x] Network setup
|
||||
|
||||
### 3. Network Configuration (In Progress)
|
||||
- [ ] Configure NAT adapter for internet access
|
||||
1. Verify IP address configuration:
|
||||
### 3. Network Configuration ✅
|
||||
- [x] Configure NAT adapter for internet access
|
||||
1. Verify IP address configuration ✅
|
||||
2. Test internet connectivity ✅
|
||||
```bash
|
||||
ip addr show
|
||||
```
|
||||
2. Test internet connectivity:
|
||||
```bash
|
||||
ping 8.8.8.8
|
||||
ping google.com
|
||||
ping 8.8.8.8 # Success
|
||||
ping google.com # Success
|
||||
```
|
||||
|
||||
- [ ] Configure Host-only adapter for direct host communication
|
||||
1. Verify second network interface:
|
||||
- [x] Configure Host-only adapter for direct host communication
|
||||
1. Verify second network interface ✅
|
||||
```bash
|
||||
ip addr show
|
||||
ip addr show enp0s8
|
||||
# Output shows:
|
||||
# inet 169.254.0.2/16 brd 169.254.255.255 scope global enp0s8
|
||||
```
|
||||
2. Test host connectivity:
|
||||
2. Test host connectivity ✅
|
||||
```bash
|
||||
# From Ubuntu VM - ping your Windows host IP
|
||||
ping <windows-host-ip>
|
||||
|
||||
# From Windows host - ping your Ubuntu VM IP
|
||||
ping <ubuntu-vm-ip>
|
||||
# Successfully pinged host (169.254.167.242)
|
||||
# Round-trip time (RTT) avg: 2.846ms
|
||||
```
|
||||
|
||||
- [ ] Document network configuration:
|
||||
- NAT adapter IP: _____________
|
||||
- Host-only adapter IP: _____________
|
||||
- Default gateway: _____________
|
||||
- DNS servers: _____________
|
||||
- [x] Document network configuration:
|
||||
- NAT adapter IP (enp0s3): 10.0.2.15/24
|
||||
- Host-only adapter IP (enp0s8): 169.254.0.2/16
|
||||
- Default gateway: 10.0.2.2
|
||||
- Host IP: 169.254.167.242
|
||||
|
||||
### 4. Basic Security Setup (Pending)
|
||||
- [ ] Create non-root user with sudo privileges
|
||||
- [ ] Configure SSH access
|
||||
- [ ] Set up UFW firewall
|
||||
- [ ] Implement basic security hardening
|
||||
### Current Status
|
||||
- ✅ NAT adapter: Working (Internet access)
|
||||
- ✅ Host-only adapter: Working (Host communication)
|
||||
- ✅ Network connectivity: Verified
|
||||
|
||||
### Next Steps
|
||||
Now that networking is configured, we can proceed to:
|
||||
1. Basic Security Setup
|
||||
- [ ] Create non-root user with sudo privileges
|
||||
- [ ] Configure SSH access
|
||||
- [ ] Set up UFW firewall
|
||||
|
||||
### 4. Basic Security Setup ✅
|
||||
- [x] User Management ✅
|
||||
- Created sysadmin user with sudo privileges
|
||||
- Enhanced hugh user security
|
||||
|
||||
- [x] SSH Configuration ✅
|
||||
- Installed and configured OpenSSH server
|
||||
- Implemented key-based authentication
|
||||
- Disabled password authentication
|
||||
- Applied security hardening settings
|
||||
|
||||
- [x] UFW Firewall Setup ✅
|
||||
- Installed and configured UFW
|
||||
- Set default policies (deny incoming, allow outgoing)
|
||||
- Allowed required services:
|
||||
- SSH (port 22)
|
||||
- HTTP (port 80)
|
||||
- HTTPS (port 443)
|
||||
- Host machine access (169.254.167.242)
|
||||
- Verified connectivity
|
||||
|
||||
### 5. System Monitoring Setup (Next Phase)
|
||||
- [ ] Monitoring Tools
|
||||
- [ ] Install and configure htop
|
||||
- [ ] Set up netdata for system metrics
|
||||
- [ ] Configure log monitoring
|
||||
|
||||
- [ ] Maintenance Planning
|
||||
- [ ] Create backup strategy
|
||||
- [ ] Set up automated updates
|
||||
- [ ] Implement log rotation
|
||||
- [ ] Configure system alerts
|
||||
|
||||
### Current Status
|
||||
- ✅ Basic VM Setup: Complete
|
||||
- ✅ Network Configuration: Complete
|
||||
- ✅ Security Measures: Complete
|
||||
- ⏳ System Monitoring: Not Started
|
||||
|
||||
### Next Steps
|
||||
1. System Monitoring Implementation
|
||||
- Research and select monitoring tools
|
||||
- Plan monitoring strategy
|
||||
- Document monitoring requirements
|
||||
|
||||
2. Maintenance Procedures
|
||||
- Design backup strategy
|
||||
- Create maintenance schedule
|
||||
- Document procedures
|
||||
|
||||
3. Future Enhancements
|
||||
- Service deployment
|
||||
- Automation implementation
|
||||
- Advanced networking features
|
||||
|
||||
## Security Configuration Status
|
||||
- [x] User Management
|
||||
- [x] Admin user created
|
||||
- [x] Sudo privileges configured
|
||||
- [x] SSH Access
|
||||
- [x] SSH server installed
|
||||
- [x] Key-based authentication configured
|
||||
- [x] Root login disabled
|
||||
- [x] Firewall
|
||||
- [x] UFW installed
|
||||
- [x] Basic rules configured
|
||||
- [x] SSH access allowed
|
||||
|
||||
## Commands and Configurations
|
||||
|
||||
### Network Configuration Commands
|
||||
```bash
|
||||
# View network interfaces
|
||||
ip addr show
|
||||
|
||||
# View routing table
|
||||
ip route show
|
||||
|
||||
# View DNS configuration
|
||||
cat /etc/resolv.conf
|
||||
|
||||
# Test connectivity
|
||||
ping -c 4 8.8.8.8 # Test internet connectivity
|
||||
ping -c 4 google.com # Test DNS resolution
|
||||
|
||||
# If needed, restart networking
|
||||
sudo systemctl restart systemd-networkd
|
||||
```
|
||||
|
||||
## Issues and Solutions
|
||||
Any issues encountered and their solutions will be documented here.
|
||||
### SSH Configuration
|
||||
```conf
|
||||
# Key SSH configuration settings (/etc/ssh/sshd_config)
|
||||
PermitRootLogin no
|
||||
PasswordAuthentication no
|
||||
AllowUsers admin
|
||||
```
|
||||
|
||||
## Resources
|
||||
- [Ubuntu Server Download Page](https://ubuntu.com/download/server)
|
||||
- [VirtualBox Documentation](https://www.virtualbox.org/wiki/Documentation)
|
||||
### UFW Rules
|
||||
```bash
|
||||
# View UFW status
|
||||
sudo ufw status verbose
|
||||
|
||||
# Basic allowed services
|
||||
sudo ufw status numbered
|
||||
```
|
||||
|
||||
## Additional Documentation
|
||||
- [Security Setup Details](security-setup.md)
|
||||
- [Lessons Learned & Challenges](lessons-learned.md)
|
||||
@@ -0,0 +1,97 @@
|
||||
# Lessons Learned & Challenges
|
||||
|
||||
## Network Configuration
|
||||
|
||||
### Lessons Learned
|
||||
1. **Network Adapters**
|
||||
- NAT adapter is essential for internet access
|
||||
- Host-only adapter enables direct communication with host machine
|
||||
- Each adapter serves a specific purpose in the VM setup
|
||||
|
||||
2. **IP Addressing**
|
||||
- NAT adapter typically gets 10.0.2.15/24 in VirtualBox
|
||||
- Host-only adapter uses 169.254.x.x range (link-local addressing)
|
||||
- Understanding different IP ranges helps with troubleshooting
|
||||
|
||||
### Challenges Faced
|
||||
1. **Host-only Network Issues**
|
||||
- Initial "state DOWN" on enp0s8 interface
|
||||
- Required proper netplan configuration to resolve
|
||||
- Solution: Explicitly configure network interfaces in netplan
|
||||
|
||||
## Security Setup
|
||||
|
||||
### Lessons Learned
|
||||
1. **User Management**
|
||||
- Creating admin user first ensures backup access
|
||||
- Group membership (especially sudo) is crucial for administration
|
||||
- Verify permissions immediately after changes
|
||||
|
||||
2. **SSH Configuration**
|
||||
- Always backup sshd_config before modifications
|
||||
- Test SSH access before disabling password authentication
|
||||
- Key order of operations:
|
||||
1. Set up SSH keys
|
||||
2. Test key-based login
|
||||
3. Only then disable password authentication
|
||||
|
||||
3. **Firewall Configuration**
|
||||
- Always allow SSH before enabling UFW
|
||||
- Default deny incoming, allow outgoing is a secure baseline
|
||||
- Document all allowed ports/services for future reference
|
||||
|
||||
### Challenges Faced
|
||||
1. **SSH Key Setup**
|
||||
- Proper file permissions are critical (700 for .ssh, 600 for authorized_keys)
|
||||
- Windows line endings can cause issues with key files
|
||||
- Solution: Use proper chmod commands and verify permissions
|
||||
|
||||
2. **UFW Configuration**
|
||||
- Risk of losing SSH access when enabling firewall
|
||||
- Solution: Always add SSH rule before enabling UFW
|
||||
- Remember to allow both IPv4 and IPv6 traffic if needed
|
||||
|
||||
## Best Practices Discovered
|
||||
1. **Documentation**
|
||||
- Document commands as you execute them
|
||||
- Keep track of configuration changes
|
||||
- Note IP addresses and network settings
|
||||
|
||||
2. **Testing**
|
||||
- Test each change immediately
|
||||
- Have a backup plan (like VirtualBox GUI access)
|
||||
- Verify services after system changes
|
||||
|
||||
3. **Security**
|
||||
- Follow principle of least privilege
|
||||
- Use key-based authentication over passwords
|
||||
- Keep system updated and maintain secure configurations
|
||||
|
||||
## Quick Reference Commands
|
||||
```bash
|
||||
# Network Verification
|
||||
ip addr show # Check network interfaces
|
||||
ping -c 4 8.8.8.8 # Test internet connectivity
|
||||
ss -tulpn # List listening ports
|
||||
|
||||
# SSH Security
|
||||
ssh-keygen -t rsa -b 4096 # Generate SSH key
|
||||
ssh-copy-id user@host # Copy SSH key to server
|
||||
chmod 700 ~/.ssh # Set correct permissions
|
||||
|
||||
# UFW Management
|
||||
sudo ufw status numbered # List rules with numbers
|
||||
sudo ufw delete NUMBER # Remove specific rule
|
||||
sudo ufw reload # Apply changes without disable/enable
|
||||
```
|
||||
|
||||
## Future Considerations
|
||||
1. **Monitoring**
|
||||
- Consider setting up basic system monitoring
|
||||
- Implement log monitoring
|
||||
- Regular security audits
|
||||
|
||||
2. **Maintenance**
|
||||
- Regular backup strategy
|
||||
- Update management plan
|
||||
- Documentation maintenance
|
||||
@@ -0,0 +1,107 @@
|
||||
# Security Setup Documentation
|
||||
|
||||
## User Management
|
||||
|
||||
### New Admin User Creation
|
||||
```bash
|
||||
# Create new admin user 'sysadmin'
|
||||
sudo adduser sysadmin
|
||||
|
||||
# Add to sudo group
|
||||
sudo usermod -aG sudo sysadmin
|
||||
|
||||
# Verify sudo access
|
||||
sudo -l -U sysadmin
|
||||
```
|
||||
|
||||
### Existing User (hugh) Security Enhancement
|
||||
```bash
|
||||
# Verify current groups
|
||||
groups hugh
|
||||
|
||||
# Ensure proper sudo access
|
||||
sudo usermod -aG sudo hugh
|
||||
```
|
||||
|
||||
## SSH Key Configuration
|
||||
|
||||
### Existing Windows SSH Key
|
||||
1. Display public key content on Windows:
|
||||
```powershell
|
||||
# In PowerShell/Command Prompt
|
||||
type C:\Users\YourUsername\.ssh\id_rsa.pub
|
||||
```
|
||||
|
||||
2. Add public key to authorized_keys:
|
||||
```bash
|
||||
# On Ubuntu Server
|
||||
mkdir -p ~/.ssh
|
||||
chmod 700 ~/.ssh
|
||||
nano ~/.ssh/authorized_keys
|
||||
# Paste your public key here
|
||||
chmod 600 ~/.ssh/authorized_keys
|
||||
```
|
||||
|
||||
## SSH Server Hardening
|
||||
```bash
|
||||
# Backup original config
|
||||
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
|
||||
|
||||
# Edit SSH config
|
||||
sudo nano /etc/ssh/sshd_config
|
||||
```
|
||||
|
||||
Required SSH configurations:
|
||||
```conf
|
||||
# Security settings
|
||||
PermitRootLogin no
|
||||
PasswordAuthentication no
|
||||
PubkeyAuthentication yes
|
||||
AllowUsers hugh sysadmin
|
||||
|
||||
# Additional hardening
|
||||
Protocol 2
|
||||
X11Forwarding no
|
||||
MaxAuthTries 3
|
||||
```
|
||||
|
||||
## Applied Security Measures
|
||||
- [x] Created sysadmin user
|
||||
- [x] Enhanced hugh user security
|
||||
- [x] Configured SSH key authentication
|
||||
- [x] Applied SSH hardening settings
|
||||
- [x] Tested SSH access
|
||||
- [x] Configured UFW firewall
|
||||
|
||||
## Firewall Setup (UFW) ✅
|
||||
|
||||
### Current UFW Configuration
|
||||
```bash
|
||||
Status: active
|
||||
|
||||
# Allowed incoming connections:
|
||||
1. SSH (22/tcp)
|
||||
2. HTTP (80/tcp)
|
||||
3. HTTPS (443/tcp)
|
||||
4. All traffic from host (169.254.167.242)
|
||||
|
||||
# Default policies:
|
||||
- Incoming: deny (default)
|
||||
- Outgoing: allow (default)
|
||||
```
|
||||
|
||||
### Applied Rules
|
||||
```bash
|
||||
sudo ufw default deny incoming
|
||||
sudo ufw default allow outgoing
|
||||
sudo ufw allow ssh
|
||||
sudo ufw allow http
|
||||
sudo ufw allow https
|
||||
sudo ufw allow from 169.254.167.242
|
||||
```
|
||||
|
||||
### Verification
|
||||
```bash
|
||||
# Current firewall status
|
||||
sudo ufw status numbered
|
||||
```
|
||||
Reference in New Issue
Block a user