2. laboratorijska naloga: VPN / Lab assignment #2: VPN

Laboratorijska naloga je sestavljena iz več delov. Vsak del je vreden nekaj točk. Za maksimalno oceno morate nabrati vsaj 10 točk. Številka pred vsakim delom predstavlja število točk, ki jih lahko dobite, če del opravite.

Obvezni deli naloge so (6 točk, obvezno morate doseči vsaj 2 točki):

• Cilj je v skupini sestaviti čim večje navidezno zasebno omrežje (angl. virtual private network oz. VPN) z uporabo OpenVPN:

  • 1 - network.svg - Vektorska slika vašega omrežja s podatki o računalnikih, navideznih računalnikih, omrežjih, navideznih omrežjih..., ki ste jih uporabljali in povezali pri reševanju LN2.
  • 2 - members.txt - Seznam članov VPN. Datoteka naj vsebuje 3 stolpce: IP vsakega računalnika; ime in priimek lastnika; državo, iz katere je lastnik. Stolpci naj bodo ločeni z vejicami. Dve točki prejmejo člani skupine, ki bo postavili VPN z največ člani. Ostali pa lahko prejmete največ eno točko.
  • 2 - keys.txt - Opis tega, kako ste ustvarili CA (tudi, če ne teče na vašem računalniku), ključe in certifikate.
  • 1 - vpn.txt - Opis tega, kako ste vzpostavili VPN z OpenVPN.

Dodatni deli naloge so (27 točk):

• 1 - routing.txt - Opis tega, kako ste nastavili usmerjevalne tabele, da ste omogočili komunikacija med dvema ločenima VPN-jema, torej da lahko komunicira poljubni klient iz prvega VPN-ja s poljubnim klientom in drugega VPN-ja.
• 2 - memberssad.txt - Napišite SAD (Security Association Database) za vse naprave v vašem VPN-ju.
• 2 - subnetworks.txt - Postavite vsaj 3 podomrežja VPN, ki omogočajo komunikacijo med vsemi mogočimi par računalnikov iz the omrežij.
• 4 - othervpn.txt - Opis tega, kako ste postavili VPN z drugo tehnologijo, 1 točka/tehnologijo, največ 4 točke.

• Postavite HTTP strežnik, ki bo omogočal dostop do več zvočnih ali video datotek. Iste datoteke naredite dostopne še prek FTP, NFS in SMB. Poleg HTTP lahko naredite vsebine dostopne tudi prek HTTPS. Dostop do datotek lahko tudi zaščitite z uporabniškim imenom in geslom. Dodatna točka, če strežniki tečejo na navideznem omrežju, ki ste ga naredili v prvem sklopu.

  • 2 - http.txt - Opis tega, kako ste postavili strežnike SMB, HTTP, FTP in NFS (1 točka za dva strežnika, 2 točki za vse štiri strežnike).
  • 1 - https.txt - Opis tega, kako ste nastavili strežnik HTTPS.
  • 2 - auth.txt - Opis tega, kako ste poskrbeli za preverjanje uporabniških imen in gesel na strežnikih, ki so v omrežju.

• Preko mreže predvajajte video vsebine. Poskrbite lahko še za to, da bodo vsebine dostopne prek razpošiljanja (angl. multicast). Na omrežju lahko (na skrivaj) predvajate tudi IP TV signal, ki ga sicer dobivate na dom. Poleg tega lahko vse uporabnike shranite na enem mestu. Lahko jih celo shranite v podatkovno bazo, po možnosti dostopno prek LDAP. Dodatna točka, če strežniki tečejo na navideznem omrežju, ki ste ga naredili v prvem sklopu.

  • 1 - streaming.txt - Opis vzpostavitve predvajanja "TV programa".
  • 1 - dlna.txt - Opis vzpostavitve predvajanja vsebin na sodobnih domačih napravah (TV).
  • 3 - multicast.txt - Opis nastavitev, potrebnih za multicast streaming.
  • 3 - iptv.txt - Opis postavitve sistema za prepošiljanje IPTV signala.
  • 2 - radius.txt - Opis vzpostavitve centralnega strežnika za avtentikacijo.
  • 3 - ldap.txt - Opis postavitve skupne baze s podatki o uporabnikih.

Vsak del opišite v ločeni datoteki. Datoteke morajo biti navadne tekstovne datoteke v kodni tabeli UTF-8:

• Če boste oddali datoteke v drugi kodni tabeli, boste izgubili 1 točko.
• Če ne boste datotek poimenovali v skladu z navodili, boste izgubili 1 točko.
• Če boste oddali datoteke, ki niso tekstovne datoteke (naprimer .doc ali .pdf), boste izgubili 2 točki.

Datoteke z opisom svojega dela spravite v imenik report.

Nato ustvarite imenik hosts, v njem pa nadaljnji podimeniki, po en za vsak računalnik, ki ste ga nastavili in vanj spravite vse nastavitvene datoteke, ki ste jih pri svojem delu spremenili.

Na koncu oba imenika zapakirajte v eno .tgz datoteko z ukazom:

tar -czf 63120145.tgz report files

kjer je 63120145 vaša vpisna številka.

Oddajte ustvarjeno .tgz datoteko.

Srečno!

The lab task consists of several parts. Each part is worth a certain number of points. To get the maximum score, you must score at least 10 points. The number in front of each part represents the number of points you can get if you complete the part.

The mandatory parts of the task are (6 points, you must score at least 2 points):

• The goal is to create the largest possible virtual private network (VPN) in the group using OpenVPN:

  • 1 - network.svg - A vector image of your network with information about computers, virtual machines, networks, virtual networks... that you used and connected when solving LN2.
  • 2 - members.txt - A list of VPN members. The file should contain 3 columns: the IP of each computer; the owner's first and last name; the country the owner is from. The columns should be separated by commas. Two points are awarded to the members of the group that sets up the VPN with the most members. The rest can receive a maximum of one point.
  • 2 - keys.txt - Description of how you created the CA (even if it is not running on your computer), keys and certificates.
  • 1 - vpn.txt - Description of how you set up the VPN with OpenVPN.

Additional parts of the task are (27 points):

• 1 - routing.txt - A description of how you set up the routing tables to enable communication between two separate VPNs, meaning that any client from the first VPN can communicate with any client from the second VPN.
• 2 - memberssad.txt - Create SAD (Security Association Database) for all devices in your VPN.
• 2 - subnetworks.txt - Set up at least 3 VPN subnets that allow communication between all possible pairs of computers from the networks.
• 4 - othervpn.txt - Description of how you set up the VPN with another technology, 1 point/technology, maximum 4 points.

• Set up an HTTP server that will allow access to multiple audio or video files. Make the same files accessible via FTP, NFS and SMB. In addition to HTTP, you can also make the content accessible via HTTPS. You can also protect access to the files with a username and password. Additional point if the servers run on the virtual network that you created in the first set.

  • 2 - http.txt - Description of how you set up SMB, HTTP, FTP and NFS servers (1 point for two servers, 2 points for all four servers).
  • 1 - https.txt - Description of how you set up an HTTPS server.
  • 2 - auth.txt - Description of how you took care of checking usernames and passwords on the servers in the network.

• Play video content over the network. You can also make sure that the content is accessible via distribution (multicast). You can also (secretly) play the IP TV signal that you normally receive at home on the network. In addition, you can store all users in one place. You can even store them in a database, preferably accessible via LDAP. An additional point if the servers run on the virtual network that you created in the first set.

  • 1 - streaming.txt - Description of how to set up the playback of the "TV program".
  • 1 - dlna.txt - Description of setting up content playback on modern home devices (TV).
  • 3 - multicast.txt - Description of settings required for multicast streaming.
  • 3 - iptv.txt - Description of setting up a system for forwarding IPTV signals.
  • 2 - radius.txt - Description of setting up a central authentication server.
  • 3 - ldap.txt - Description of setting up a common database with user data.

Describe each part in a separate file. Files must be plain text files in the UTF-8 code table:

• If you submit files in a different code table, you will lose 1 point.
• If you do not name the files according to the instructions, you will lose 1 point.
• If you submit files that are not text files (for example, .doc or .pdf), you will lose 2 points.

Put the files describing your work in the report directory.

Then create a hosts directory, and in it further subdirectories, one for each computer you have set up, and put all the configuration files you have changed during your work in it.

Finally, pack both directories into one .tgz file with the command:

tar -czf 63120145.tgz report files

where 63120145 is your registration number.

Submit the created .tgz file.

Good luck!