To be completed by 2/14/2007 Practical Exercises

Check the current inteface mode with mii-tool

mii-tool

By using mii-tool, configure the network interface for 100 MBit half-duplex, 10 MBit half-duplex modes, then autonegotiate for the default mode.

mii-tool -F 100baseTx-HD
mii-tool 
mii-tool -F 10baseT-HD
mii-tool
mii-tool -r
mii-tool

During the installation, the network settings on your computer are configured for DHCP.
Renew the IP address lease:

dhclient

Alternatively, you can renew the lease by restarting the network script:

/etc/init.d/networking restart

ARP command:

arp -a
arp -d [list all IP-addresses] 
arp -a
ping unisys01
ping capone
ping engsoft 
arp -a

Every time when you are trying to access any remote machine via TCP/IP, your ARP cash gets updated first, then the MAC address of the remote host, or the gateway if the host is located outside of your subnet, is used to deliver the ethernet frame.

traceroute command:

/usr/sbin/traceroute -I capone 
/usr/sbin/traceroute -I engsoft
/usr/sbin/traceroute -I eden

This shows you all the gateways between the subnets your packet travels towards the destination (engsoft for example).

Install ipcalc on your desktop. By using ipcalc, figure out the subnet mask in decimal notations, network address, broadcast address, and the maximum number of available hosts on the subnet for IP address 192.168.1.3 and netmask 11111111.11111111.11111111.11000000 (/26). Is host with IP address 192.168.1.75 located on the same or different subnet?

Re-configure your network interface for network 192.5.1.0/24 using ifconfig command. If you are on unisys04 machine, for example:

/sbin/ifconfig eth0 192.5.1.4 netmask 255.255.255.0 up

Ask your neighbor to reconfigure his machine on the same network (192.5.1.0/24 ); try to ping each other machines. Make sure you are using different IP addresses on the same subnet. Try to ping any machine on the original subnet, 192.168.5.0/24 As you understand, there is no routing set between subnets 192.5.1.0/24 and 192.168.5.0/24 so you can't pass network packets between them.
Do the same network re-configuration using the network scipt files, as it was discussed in the lecture. Finally, configure your machine for the original network settings.

Setting network services on the cluster nodes.
Pick up a node with the same number as your unisys desktop. For example if you are on unisys04, use node04. Power-up the rack-mount cluster node. Make sure the IP address of the cluster node is listed in file /etc/hosts on your desktop: the IP addresses run from 192.168.5.21 to 192.168.5.36 for node01 to node16, accordingly.

ssh to the node as root (you know the root password):

ssh root@node04

Create a user account for yourself; give yourself a password.

Setup RSH, RLOGIN server on the cluster node.
Check the content of /etc/inetd.conf on the cluster node -- everything should be commented out, which means there is no services runnable through inetd To see open ports on the node, run command

netstat -na

It should show enabled TCP/UDP ports. Among them, there are ports tcp/25 (exim4), tcp/22 (sshd), udp/68 (dhclient3).
Install rsh-server and rsh-client:

apt-get install rsh-server rsh-client

Now you should see the following entry in /etc/inetd.conf:

shell stream  tcp     nowait  root    /usr/sbin/tcpd /usr/sbin/in.rshd
login stream  tcp     nowait  root    /usr/sbin/tcpd /usr/sbin/in.rlogind
exec  stream  tcp     nowait  root    /usr/sbin/tcpd /usr/sbin/in.rexecd

They stand for rsh, rlogin and rexec services. Restart inetd service:

/etc/init.d/openbsd-inetd stop
/etc/init.d/openbsd-inetd start

Modify /etc/hosts.equiv and put the host name or IP address of your desktop computer (rsh client).

On your desktop machine, install only rsh-client, then try to run rsh (remote shell) command on the node as a non-root user:

rsh node04 "uname -a"

Run rcp command to copy files between your desktop and the node. For example, to copy files from directory /etc/hosts on node04 to your current directory:

rcp node04:/etc/hosts .

Make sure you see this file in you directory. Create a new file in your home directory and rcp it to node04:

touch somef.txt
rcp somef.txt node04:/home/$USER

rcp somef.txt node04:~/.ssh/authorized_keys

Then rsh to node04 and make sure you see the file there.

rsh node04

Now try to rsh as root - you shouldn't be able to.
To enable rsh access as root on the node,

cp /etc/hosts.equiv /root/.rhosts

and modify file /etc/securetty by including the following entries in the end:

pts/0
pts/1
pts/2
rsh
rlogin
rexec

Try to rsh as root again.

Install telnet server on the cluster node.

apt-get install telnetd

Check /etc/inetd.conf and make sure you see the following entry:

telnet  stream  tcp   nowait  telnetd.telnetd /usr/sbin/tcpd /usr/sbin/in.telnetd

Command netstat -na should show open tcp/23 port:

tcp    0   0 0.0.0.0:23      0.0.0.0:*           LISTEN

Telnet to the node from your desktop machine, for example:

telnet node04

Install FTP server on the cluster node.

apt-get install ftpd

Check out /etc/inetd.conf and notice the entry for FTP:

ftp  stream  tcp     nowait  root    /usr/sbin/tcpd  /usr/sbin/in.ftpd

Command netstat -na shows open tcp/21 port:

tcp     0    0 0.0.0.0:21     0.0.0.0:*     LISTEN

From the desktop, ftp to the node as a user.

ftp  node04

To be able to ftp as root, modify file /etc/ftpusers and comment-out root.

Configure SSH.
For SSH authentication, you can use either RSA or DSA keys besides password.
To generate a RSA key pair to work with version 2 of the protocol, type the following command at a shell prompt on your desktop:

ssh-keygen -t rsa

Accept the default file location of ~/.ssh/id_rsa. Enter a passphrase different from your account password and confirm it by entering it again.
The public key is written to ~/.ssh/id_rsa.pub. The private key is written to ~/.ssh/id_rsa. Never distribute your private key to anyone. Change the permissions of your .ssh directory using the command chmod 755 ~/.ssh. Note, you have to have this directory with 755 permission on both hosts.
Copy the contents of ~/.ssh/id_rsa.pub to ~/.ssh/authorized_keys on the machine to which you want to connect, for example, using rcp as in the previous exercise. If the file ~/.ssh/authorized_keys does not exist, you can copy the file ~/.ssh/id_rsa.pub to the file ~/.ssh/authorized_keys on the other machine.
Try to ssh to the node.

To generate a DSA key pair to work with version 2 of the protocol, type the following command at a shell prompt:

ssh-keygen -t dsa

Accept the default file location of ~/.ssh/id_dsa. Enter a passphrase different from your account password and confirm it by entering it again. The public key is written to ~/.ssh/id_dsa.pub. The private key is written to ~/.ssh/id_dsa. It is important never to give anyone the private key.
Copy the contents of ~/.ssh/id_dsa.pub to ~/.ssh/authorized_keys on the machine to which you want to connect. If the file ~/.ssh/authorized_keys does not exist, you can copy the file ~/.ssh/id_dsa.pub to the file ~/.ssh/authorized_keys on the other machine.
Try to ssh to the node. Note, if you haven't provided password when generating DSA or RSA keys, you would be able to login without a passfrase. If you want to ssh to the node from the other hosts, you would need to generate the client RSA or DSA keys and add them to ~/.ssh/authorized_keys on the node.

The ssh-agent can be used to store your passphrase so that you do not have to enter it each time you make a ssh or scp connection.
At a shell prompt, type the following command:

exec /usr/bin/ssh-agent $SHELL

Then type the command:

ssh-add

and enter your passphrase(s). If you have more than one key pair configured, you will be prompted for each one. When you log out, your passphrase(s) will be forgotten. You must execute these two commands each time you log in to a virtual console or open a terminal window.

Run a remote command over ssh, for example:

ssh node04 "uname -a"

Copy files from your desktop to the node and vise versa using scp command as you already did in exercise with rcp above:

scp node04:/etc/hosts .
touch somef.txt
scp somef.txt node04:/home/$USER

Syncronizing directories between remote hosts by using rsync.
rsync is a very useful alternative to rcp. This tool lets you copy files and directories between a local host and a remote host using either rsh or ssh. Install rsync on both your tesktop and the node:

apt-get install rsync

Creat a directory tree and copy it over to the node with rsync command:

mkdir -p dir1/dir2/dir3
rsync -e rsh -avz dir1 node04:/home/$USER

Option a stands for archive (preserve links and timestamps); v is for verbose and z is for data compression when sending-receiving.
In the case above, rsync was running over rsh. To run rsync over ssh, specify "-e ssh" option:

rsync -e ssh -avz dir1 node04:/home/$USER

In addition to using rcp/ssh for transport, you can also use Rsync itself, in which case you will connect to TCP port 873, but it is beyond the scope of this lecture.

Disable rsh, rlogin, telnet, and ftp
Since you have fully functioning SSH on the node, you can get rid of rsh, rlogin, telnet and ftp servers. In file /etc/inetd.conf comment-out the lines for shell, login, exec, telnet and ftp. Make inetd daemon to re-read the modified /etc/inetd.conf by executing the following command:

kill -HUP inetd_PID

where the process ID, inetd_PID, for inetd can be found from

ps -ef | grep inetd

Alternatively, you can simply run

pkill -HUP inetd

Make sure ports tcp/21, tcp/23, tcp/513, tcp/514 are not open by running

netstat -na

Never run rsh, rlogin, telnet and ftp servers on the open Internet. They are very unsecure due to clear text authentication and data transfer.

Read Chapters 25--29

top