Week 6: Comprehensive Infrastructure Guide - GoogleMattEckhardt/MattEckhardtTechJournal GitHub Wiki

Week 6

Comprehensive Infrastructure Guide (Summary of network setup weeks 1-5)

FIREWALL SETUP:

  1. Boot up fw (username: root and password: Ch@mpl@1n!19)
  2. Assign the interfaces. Input 1 in the main OPNsense menu. Set WAN to be em0 and LAN em1. DO NOT CONFIGURE VLANs
  3. Select 2 to set IP addresses. select 2 for the WAN interface, input whatever you're assigned. (for me its 10.0.17.152) Do not use DHCP. Upstream WAN gateway is 10.0.17.2 and we're not using IPv6 4.Respond no for using HTTP
  4. Select 2 from the main menu again. 1 for the LAN interface, no DHCP. LAN address is 10.0.5.2. 24 bit subnet mask. No upstream gateway. no DHCP, bypass IPv6 config, and do not enable DHCP server or revert HTTP

SETUP WORKSTATION:

  1. Configure the IPv4 properties for a manual IP. 10.0.5.100, 255.255.255.0, 10.0.5.2. Use 10.0.5.2 as your preferred DNS server.
  2. Use a web browser to go to the firewall. Type in its IP. Login using the fw login credentials. Setup hostname: fw1-matt, Domain: matt.local . Configure WAN Interface RFC1918 Networks: Uncheck "Block private networks from entering via WAN." Set the root

SERVER 2019 CONFIG:

  1. Default settings but don't do product key. Give the server a password.
  2. Start server manager
  3. IP address: 10.0.5.5 Netmask: 255.255.255.0 Gateway: 10.0.5.2 DNS: 10.0.5.2 Make it discoverable
  4. Time should be UTC-5:00 Eastern Time
  5. Reboot
  6. Go to manage in server manager, add roles, and select Active Directory Domain Services under server roles
  7. install and reboot
  8. Select the link to promote the server to a domain controller (yellow triangle)
  9. Make a new forest make it yourname.local set a password 10.Go to Server Manager/DNS/AD01 and go into DNS manager
  10. Find and expand the forward lookup zone for your new domain. You should have an entry for ad01.yourname. This allows you to ping ad01 by hostname and/or domain name. Add an entry for fw01. select New Host (A or AAAA)

12.Add a reference to fw01, go ahead and check "Create associated (PTR) record".

13.Add a reverse primary lookup for all IP addresses in the 10.0.5.0/24 Network by selecting the New Zone options from the right-click context menu as shown below. Use the defaults and add a Network ID for 10.0.5.

14.Create a new PTR records from the A record of fw01-yourname and ad01-yourname by unchecking, applying checking the update PTR record check box and re-applying fw01's properties.

MAKE NAMED DOMAIN USERS:

1.On AD01, find the Active Directory Users and Computers option. Under the Domain's user folder Add a new User. 2.This user (first.lastname-adm) will be a Domain Administrator and will have a distinct suffix (ADM) to show this. Uncheck user must change password at next login. 3.Add this user to the Domain Admins Group (if you dont want a domain admin, simply dont add to group)

JOINING WKS01 TO YOUR NEW DOMAIN:

  1. If you haven't changed the hostname from the random assigned hostname, do so now. Call it wks01-yourname (control panel, system security, system)

SETUP DHCP:

  1. Login to dhcp01-matt
  2. On CentOS, use the nmtui tool.
  3. Select 'edit connection'
  4. Click on your proper connection
  5. Set the IPv4 configuration to manual
  6. Input your IP and netmask
  7. input systemctl restart network
  8. Useradd username
  9. passwd password
  10. input useradd -aG wheel username
  11. ssh into the dhcp01 or do it from there and sudo yum install dhcp
  12. vm into /etc/dhcp/dhcp.conf and add data for your network (need to sudo -i) first subnet 10.0.5.0 netmask 255.255.255.0 { option routers 10.0.5.2; option subnet-mask 255.255.255.0 ; option domain-name "yourname.local"; option domain-name-servers 10.0.5.5; range 10.0.5.100 10.0.5.150;

}

  1. while still in sudo, type systemctl start dhcpd
  2. then do systemctl enable dhcpd
  3. type firewall-cmd --add-service=dhcp --permanent
  4. type firewall-cmd --reload
  5. type firewall-cmd --listall (double check)
  6. set the workstation back to automatic IP/DNS server addresses

SETUP ORGANIZATIONAL UNITS IN ACTIVE DIRECTORY

  1. Open up Active Directory Users and Computers in ad01
  2. Create an organizational unit called "SYS255", within this group we will add OU's for Accounts, Computers, and Groups.
  3. Within the SYS255\Accounts OU, create users alice, bob and charlie
  4. Drag WKS01 from the yourname.local\Computers OU to the SYS255\Computers OU.
  5. Within the SYS255\Groups OU, add a global security group called custom-desktop with users alice and bob
  6. Go to tools and open Group Policy Management
  7. Select the SYS255 OU and create a new group policy object called sys255-desktop. Once created, right click on the object and select Edit.
  8. Now, this SYS255-desktop Group Policy should only apply to those users in this OU who are members of the custom-desktop security group. You set this using the security filters section of the group policy. By default, All Authenticated Users have access to apply and read group policy, we will restrict this through the following steps.
  9. Add the custom-desktop group created earlier to the Security Filter
  10. Remove Authenticated Users from the Security Filter.
  11. Add Domain Computers
  12. Delegation->Advanced (Uncheck Apply Group Policy, Select Deny)