SEC350 Midterm - ConnorEast/Tech-Journal GitHub Wiki

Disclaimer Content

The following boxes are going to be deleted prior to the assessment. If refrencing notes outside of this document confirm the following box information is not being used again [Caveat: Firewall default Gateways]

RW01: -- IP:10.0.17.31 -- Default: 10.0.17.2
FW01: -- 3 V-Network Adapter --
WEB01: -- IP:172.16.50.3 -- Default: 172.16.50.3

The following boxes will be added to the network. Current IP space has not been specified. Check the IP space as assigned in the midterm itself. In each of the boxes respective sections implement the appropriate IP.

Traveler: --> Windows 10 VM --> Default Gateway: 10.0.17.132 [WAN]
Edge01: --> Vyos Firewall --> 3 V-Network Adapters for DFGW
NGINX01: --> Ubuntu Linux VM --> Default Gateway: 172.16.50.2 [DMZ]
DHCP01: --> Ubuntu Linux VM --> Default Gateway: 172.16.150.2 [LAN]

Created By Ina

Edge 01

Default Logon <--> User:vy0s ; Password:Ch@mpl@1n!22 ;

Command:	Image / Appended Content
<-- Base Config -->
configure
set system name-server 10.0.17.2
set system host-name edge-east
set protocol static route 0.0.0.0/0 next-hop 10.0.17.2

<-- Ethernet Setup -->
set interfaces ethernet eth0 description Sec350-WAN
set interfaces ethernet eth1 description Sec350-DMZ
set interfaces ethernet eth2 description Sec350-LAN
set interfaces ethernet eth0 address 10.0.17.132/24
set interfaces ethernet eth1 address 172.16.50.2/29
set interfaces ethernet eth1 address 172.16.150.2/24

<-- Setting up Nat Rules -->
set protocols rip interface eth2
set protocols rip network 172.16.50.0/29
set nat source rule 10 description "Nat DMZ to WAN"
set nat source rule 10 outbound-interface eth0
set nat source rule 10 source address 172.16.50.0/29
set nat source rule 10 translation address masquerade
set nat source rule 20 description 'NAT FROM DMZ to WAN'
set nat source rule 20 outbound-interface eth0
set nat source rule 20 source address 172.16.150.0/24
set nat source rule 20 translation address masquerade

<-- DNS forwarding setup -->
set service dns forwarding allow-from 172.16.50.0/29
set service dns forwarding allow-from 172.16.150.0/24
set service dns forwarding listen-address '172.16.50.2'
set service dns forwarding listen-address '172.16.150.3'
set service dns forwarding listen-address '172.16.150.2'
set service dns forwarding system
Commit
Save
<-- MGMT network Forwarding NAT -->
configure
set nat source rule 30 description "MGMT TO WAN"
set nat source rule 30 outbound-interface eth0
set nat source rule 30 source address 172.16.200.0/28
set nat source rule 30 translation address masquerade
set service dns forwarding listen-address 172.16.200.2

NGINX01

Default Logon <--> User:champuser ; Password:Ch@mpl@1n!22 ;

Command:	Image / Appended Content
<-- Networking configuration -->
cd /etc/netplan
vi 00-installer-config.yaml	Insert the following: network: ethernets: ens160: [Or applicable ethernet] dhcp4: false addresses: - [Insert IP address] nameservers: addresses: [insert default gateway in brackets] routes: - to: default - via: [Default gateway IP] version: 2
sudo netplan apply
sudo hostnamectl set-hostname NGINX01-east
<-- User Creation -->
sudo add user connor
sudo usermod -aG sudo connor
passwd connor
<-- ssh key user config -->
sudo add user connor-jump
sudo mkdir /home/connor-jump/.ssh
sudo touch /home/connor-jump/.ssh/authorized_keys
sudo chmod 700 /home/connor/.ssh
sudo chmod 600 /home/connor/.ssh/authorized_keys
sudo chown -R connor-jump:connor-jump /home/connor-jump/.ssh
echo "connor-jump ALL=(ALL) NOPASSWD:ALL" \| sudo tee /etc/sudoers.d/connor-jump
<-- NGINX Installation -->
sudo yum update
sudo yum upgrade
sudo yum install nginx php
sudo systemctl status nginx
<-- Web Page Creation -->
rm /var/www/html/*
vi /var/www/html/index.html	Make A special HTML page.
systemctl restart nginx

DHCP01

Default Logon <--> User:champuser ; Password:Ch@mpl@1n!22 ;

Command:	Image / Appended Content
cd /etc/netplan
vi 00-installer-config.yaml	Insert the following: network: ethernets: ens160: [Or applicable ethernet] dhcp4: false addresses: - [Insert IP address] nameservers: addresses: [insert default gateway in brackets] routes: - to: default - via: [Default gateway IP] version: 2
sudo netplan apply
sudo hostnamectl set-hostname
sudo netplan apply
sudo hostnamectl set-hostname DHCP01-east
sudo add user connor
sudo usermod -aG sudo connor
passwd connor
sudo add user connor-jump
sudo mkdir /home/connor-jump/.ssh
sudo touch /home/connor-jump/.ssh/authorized_keys
sudo chmod 700 /home/connor/.ssh
sudo chmod 600 /home/connor/.ssh/authorized_keys
sudo chown -R connor-jump:connor-jump /home/connor-jump/.ssh
echo "connor-jump ALL=(ALL) NOPASSWD:ALL" \| sudo tee /etc/sudoers.d/connor-jump
<-- DHCP Installation & Setup -->
sudo apt update
sudo apt upgrade
sudo apt install isc-dhcp-server
sudo systemctl status isc-dhcp-server
sudo vi /etc/dhcp/dhcpd.conf	subnet 172.16.150.0 netmask 255.255.255.0 { range 172.16.150.100 172.16.150.150; option routers 172.16.150.2; option subnet-mask 255.255.255.0; option domain-name-servers 172.16.150.2;
ip a	locate ethernet header [ens18 or other] and note it down
sudo vi /etc/default/isc-dhcp-server	INTERFACESv4="[Insert ENS instance as noted in previous sect.]"
systemctl restart isc-dhcp-server
systemctl status isc-dhcp-server	If this works go to the WKS01 device and change it to DHCP then use -ipconfig /release; -ipconfig /renew;
sudo dhcpd -t -cf /etc/dhcp/dhcpd.conf	Use this command for troubleshooting syntax

Traveler

Command:	Image / Appended Content

Edge 01 Part 2