Small Buisness Network Environmentclau4/docs/FinalProjectWriteUp.pdf · Small Business Network...

Small Business Network Environment

The goal of this project is to provide a

small business with the necessary tools

to build a functional infrastructure for

their company. This guide will help you

set up an Apache web server, FTP,

NFS, DNS, and VPN. This is a step in

the right direction for any small business

infrastructure.

ITIS 2110L-L02

Team Kombol

Team #4

2016/04/25

Small

Buisness

Network

Environment

Christopher Lau

Kyle Poitinger

Azhar Toqeer

Thomas Washington

Michael Foley


Introduction

The goal of this project is built some infrastructure for a small business, allowing them to host

their own web server and access it remotely in multiple different ways. Apache will be the web

server of choice in this project but there are many other open source alternatives that work. We

will also implement a local DNS server for internal domain name resolution. This will provide

administrative users on the server the ability to use domain names to access network locations in

oppose to IP addresses. FTP and VPN allow remote users to access the server and manipulate

data within it.

FTP (File Transfer Protocol) is a technology that is very useful for any server environment where

files need to be added and removed. This transfer protocol is especially useful for a web server as

it allows a website to be updated with ease. You make changes to files on your local machine

and transfer the file to the root directory of your website. This updated file can then be accessed

by the internet over port 80.

VPN (Virtual Private Network) is also a great tool to have in a network environment. This is a

single server network so VPN does not really get used in full fledge for this project but when

adding other network locations, this technology becomes extremely useful. When you have a

VPN enabled on your network, remote machines can use specific credentials to access the

network. VPN enables a remote machine to act as if it was part of the local network, giving you

access to network locations and other things that may be local area specific. This is extremely

useful for a small business because it allows employees to work from home or other remote

locations.

There are so many benefits to hosting your own web server, especially if you have a physical

server at the office. In this project, we cover hosting a web server through Amazon AWS which

is a cloud server service but having a physical server gives you complete control over hardware

specifications. Whenever you host a website through a data center like GoDaddy or HostGator,

you just don’t get the control over the server like you do with a self-hosted web server. People

run into many problems with server specifications and these hosting services attempt to control

what you can and cannot do. Of course this is also going to be much cheaper than hosting

through a company, especially if you are planning a long term deployment. On average, hosting

will cost between $3-$10 and depending on how much traffic you are expecting, it could cost

more than that. Having complete and total control over the server itself is the main reason to host

a local webserver and the gratification that comes from instant changes and results to the server

will pay for itself. In this project, we use a free EC2 instance through Amazon that is running

Ubuntu Server.


We also made an attempt to add NFS (Network File System) to the server but were not able to do

so. We will cover this in more detail later in this document.

Amazon EC2 Virtual Server Hosting is a cloud computing solution for developers. It allows you

to host a small virtual server for free or a large farm of higher capacity virtual servers for a

monthly price. It is very useful because you can fire up an instance of multiple different types of

servers in less than 5 minutes and then you can run with it. Another benefit of using Amazon

EC2 is that it gives you full control over your server. There is not much that you can’t do with it

compared to a physical server on location. It is also very secure and reliable. Using a virtual

cloud server is great for someone that is just getting started with this type of stuff because you do

not have to worry about the maintenance of any hardware. It uses Amazon's sturdy infrastructure

and data centers to provide you with a reliable server environment. Below are the steps to get

you started with your own Amazon Cloud Server running Ubuntu Server.

1. Create an AWS account and login to the dashboard. You should see a large list of

services available to you through EC2.

2. Click on EC2. Click on the “Launch Instance” button.

3. You will be presented with default AMI(Amazon Machine Images) that are built into

EC2 for your convenience. For this project, we choose Ubuntu as it was most familiar to

the group members and is well documented throughout the internet.

4. The next screen presents the instance types that are available through AWS. The free

instance is called “t2.micro” and can be used for low to moderate network performance.

Paid options are available but we will use the free option for this project.

5. After this, you can click on “Review and Launch” and then launch the instance. You will

be directed back to a screen that hosts all the instances you are currently running. You

will see that I have two instances running but the one that is being used for this project is

called “2110 Project.”

6. The next thing we must deal with is the IP address of the instance. By default, Amazon

provides you with a private and public IP address. The problem is, both of these are


dynamic and are liable to change at any given time. Amazon had addressed this problem

by adding a service they call “Elastic IP” which gives you access to a Static IP address

for your server. Look at the menu items on the left side of the Instances screen and you

will find “Elastic IP” under the “Network and Security” section. Click on it and you will

be taken to the Elastic IP screen. Click on “Allocate New Address” and click “OK.” At

this point you should see a new address pop up. This is the static IP you will use for the

server. It is very important to use a static IP for your web server because the DNS server

of your choosing will not update instantly with your dynamic IP when it changes. Right

click the address and allocate it to the instance you created in the previous steps. The

final product should look like this.

7. The next important step is to open up the necessary ports to receive incoming and

outgoing traffic on your server. Amazon provides you with a graphical interface for doing

this. Navigate back to your instance and click on it. Scroll down in the details section at

the bottom of the screen until you see “security groups.” Create a new security group

with whatever name you please. Right click it and click “edit inbound rules.” This will

allow you to open up ports for inbound traffic on the server. We are going to initially

open up port 80 for HTTP traffic, port 20-21 for FTP traffic, port 22 for SSH traffic, and

port 5900-5950 for VNC remote desktop traffic. You will see that I have opened up some

other ports but the ones listed below are what we will be working with initially. To set up

a new rule,

a. Click “Add Rule”

b. Type: Custom TCP Rule

c. Protocol: TCP

d. Port Range: Port #


e. Source: Anywhere (You may want to change this at some point for security

reasons but leave it at this for now)

8. Once you save this, you are ready to start working with your server. At this point you

may be wondering how in the world we are going to access the server. How do we make

changes to it?

PuTTY is an SSH and telnet client developed for Windows. It allows the user to connect to a

secure command line interface on their server to make changes remotely. SSH is one of the most

secure ways that you can connect to a server and make changes. Whenever you fire up a new

server instance on Amazon EC2, you are going to have to use SSH to make initial changes.

Some server administrators with years of experience with the CLI could completely manage a

server through PuTTY. Since we are beginners, we are going to want to install a lightweight

desktop environment and the necessary tools to use a remote desktop client. Below are the steps

you must follow to set up PuTTY, connect to the server with SSH, install a lightweight GUI

desktop environment, and set up VNC server for remote desktop access.

1. Go to www.putty.org and download and run it on your client machine. Make sure that

you have created and inbound rule for port 22 in the previous steps or this will not work.

2. Remember the .ppk authentication file that EC2 made you create before you launched

your instance. This is the key that will be used to SSH into the system. You will need to

download another small piece of software to convert that .pem file to a .ppk file that

PuTTY can understand. Head over to

http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html and download the

puttygen.exe. Once it is up and running, click load and locate the .pem file that you got


from Amazon. Open it and click save public key. This will allow you to generate and

save a .ppk file that PuTTY can use. Close PuTTYgen.

3. Fire up PuTTy and type a name for your configuration into the “saved sessions” box. You

will see in the example below that I have named mine 2110. Next go to the “Host Name”

box and type in “ubuntu@PUBLICIP” and use port 22. Replace PUBLICIP with the

public IP address of your EC2 instance. The connection type will be SSH.

4. Click save and navigate to SSH in the side menu. Open it up with the plus sign and click

on “Auth.” This is where you are going to verify that you are the owner of the server with

your .ppk file. Leave the checkboxes how they are and click on “browse.” Locate your

.ppk file use it. After this, navigate back to the “session” tab in the menu and click “save”

again. This will save these settings you have initialized for future use.

5. Not you are ready to start an SSH connection with your server. Click “Open.” You may

be prompted with a security warning; just accept it. At this point you should see a

terminal open up and prompt for input. Here is an example below.


6. Once this is open, let’s go ahead and update and upgrade our system. This is very

important because it gives you access to the latest version of Ubuntu and all the

repositories that come with it. If you do not update and upgrade your system, you will

most likely not be able to install the necessary components to complete this project. Let’s

run the following two commands to update and upgrade our system.

a. sudo apt-get update

b. sudo apt-get upgrade

7. The next step is going to be installing a lightweight operating system that we can access

via remote desktop. We choose XFCE as our desktop of choice because it is super

lightweight and won’t bog down our server. While we are at it, let’s go ahead and install

TightVNCServer as well. This is the program that is going to allow us to remote desktop

into the system. The following command will install both XFCE, the goodies that we

need to use it, and the VNC server. Feel free to use another desktop environment but we

find this one to be the best.

a. sudo apt-get install xfce4 xfce4-goodies tightvncserver

8. When VNC Server gets to the end of its installation, it will ask you to type in a password

for access. It will then ask you to repeat that password. You now have VNC Server

installed and a desktop environment. Now it’s time to access the server via remote

desktop.

9. Once this is finished, you will need to install the VNC Viewer client on your desktop to

access the server. Head over to https://www.realvnc.com/download/viewer/ and install

the viewer for your OS. Make sure that you have created an inbound security rule for

ports 5900-5950. These are ports that are almost always used for a remote desktop

connection. Fire up the viewer and type in “PUBLICIP::5901” into the Remote Host box.

After that, hit “Connect” and you should be prompted to enter your password. If it does

not work, check that you created your security rules correctly. Below is an example what

you should see when you are connecting successfully.

10. Type in the password that you created in step 8 and you will be connected to your

desktop environment. Now you can make changes using a GUI instead of the CLI. This is

great for beginners who don’t have a lot of practice with the CLI and text editors like vi.


Apache Web Server

The Apache Web Server was the go-to web server for our group, everyone having realized the

benefits of it compared to other web servers. Apache is the most popular open source web server

in the world and is being used by over 40% of web servers according to a recent study conducted

by Net Craft. The installation command was “apt-get install apache2”, which was inputted into

the Command Line Interface. You can see below that our server already has the latest version of

Apache installed and it is running.

Once Apache is up and running, you can check to see if it is working by typing localhost into the

URL bar of an internet browser within the server. If you get the following page, you know it is

working.


The benefits of installing the full LAMP package are that they are completely open source,

which means free and constantly being updated. LAMP stands for Linux, Apache, MySql, PHP.

There are the essential things that should be installed on every web server whether you are going

to use the tool or not. At some point, you will probably want to include PHP script in your site.

Below are screenshots of the commands used to install PHP and MySQL. You can see that PHP

and MySQL are already installed on our server.


If you would like to test that PHP is working on the server, you need to create a PHP file with the

following contents and upload it to the root directory of your web server which should be located

at var/www.

Once you have uploaded this php file to the root directory, attempt to access it through a web

browser. If you get the following, php is installed and running correctly.


FTP

File Transfer Protocol is a system that allows for the shipping of files between a client and a

server that are on the same network. The installation of FTP was necessary for the creation of our

small business in order for our company to move files around whenever the situation demanded

it. FTP would be extremely beneficial to the person that is managing your website at your

business. If you host your own webserver which we have provided the steps for doing in the

previous section about Apache. You can set up FTP and build FTP users that can access the root

folders of your web server and make modifications to the files that are hosted there. This is great

because your website administrator does not have to go into the server and think of weird ways

to copy the files over. He can simple use a client like FileZilla and with proper credentials and

permissions, he can read and write to the directory. Below are the steps to setting up FTP.

1. Install FTP using the following command.

2. Next you will want to open up /etc/vsftpd.conf in your favorite text editor. You can see

below a list of abilities that come with FTP, and the authority that you can give to a

variety of people. FTP configuration files come with instructions and the commands

already written with it, all the user has to do is to go into the config file and uncomment

whatever command that want to be run while FTP is operational. There is lots of

documentation online that can tell you what each of these individual things can

accomplish but we will only use a couple of them for basic FTP set up. We want the

“local_enable” line to be set to yes to allow local users to access everything. We also

want to configure “chroot_local_user” to yes as well and this restricts FTP users to their

home directory which we will set accordingly in steps below. Find some documentation

online about making changes to this file and you will be able to read about the inidividual

lines and what they can accomplish. After you have finished configuring the file, restart

FTP with this command sudo service vsftp restart.


3. Next we will create an FTP user. View the shots below for the commands needed to add a

user with proper permissions. You will be prompted to enter the password twice for

security reasons.

4. Next we change the user’s home directory to that of our website root directory which in

this case is /var/www. To do this we can use the CLI but I prefer to get experience inside

the passwd file and make the changes directly in there. Open /etc/passwd in your favorite

text editor and scroll down to your newly created user. Change the home directory to

whatever you please just like I did in the screenshot below for “ftpuser.”


5. We are ready to connect to our new FTP server through a client. Head over to

https://filezilla-project.org/ and download the client software for your corresponding

operating system. Fire it up and open the site manager at the top. You should see a screen

like this.


6. You can see that I have multiple FTP server’s setup for different web servers but I am

working inside of “EXAMPLE.” Enter the following things.

a. Host: Enter your public IP address here

b. Logon Type: Normal

c. Username and Password: Whatever you created for your user in the previous step

7. Everything else in this can be left to normal. When you are ready, click connect and you

should be connected to your newly deployed FTP server and view the contents of the

home directory for that user. A successful connection should give you the following

results. That's it! You should now be able to transfer, move, and delete files wherever you

have permission to do so. You can also see below that we are able to make a transfer.

VPN

VPN or Virtual Private Network is something that can be very useful in a small business

network. A VPN will bring a computer onto a LAN that is not actually a part of that LAN. At the

company I currently work for, we use a VPN in order to use programs that access local

databases. Every week I must submit my timesheet and the piece of software that we use does

not work outside of the network. I use the Windows VPN wizard to connect to our VPN and I am

automagically connected. I can then use the timecard software and submit my timesheet. There

are many other great uses for a virtual private network and below I will go through the steps of

setting one up in a VPS environment on Amazon AWS.

1. A VPN acts as an access tunnel for your entire network so it is widely recommended to

host it on a standalone server instance. In this case, we are using virtual private servers.

Let’s take a trip back to the introduction of the project and fire up a new instance using

the EC2 dashboard. When you get to the step where you are choosing your OS, we are

going to select something that gives us the majority of what we need to set up a virtual

private network. Fire up an instance of Open VPN Access Server.


You may need to use the search bar to find it. When configuring the instance details,

change the username and password to something of your choosing. All the other steps

remain the same. In the security groups details, open up port 22 for SSH access.

2. You will need to go through the process of setting up PuTTY like you did in the first part

of this project. Remember to use PuTTYgen to convert your file to the appropriate

format. The username that will be used for initial setup will be “openvpnas.” Select yes

for the next two security questions. Select yes when asked if this will be the primary

access server node. Then select options 1 for “all interfaces.” For the remainder of the

setup process, you can just hit enter and it will select all the default options.

3. Now let’s set up a desktop environment so we have access to a web browser on the

server. We already covered this in the introduction of this document. Review that and

install XFCE and the goodies on your system. Also install the VNC server and set a

password for it. All these steps were covered in the introduction of this document.

4. Make sure you open up the necessary ports to use remote desktop through VNC. 5900-

5950 are the ports I like to open up via our inbound rules. Now let’s remote in and open a

web browser. Navigate to https://<your machine ip>/admin/ and login with the username

and password that you created in the earlier steps.

5. You should now be looking at the administration screen for OpenVPN. Head over to the

“server network settings” page and make sure that the hostname section is filled in with

the IP address of your machine. If it is, leave it alone. If not, input it there and save. At

this point you are ready to connect to the network through your VPN tunnel.


NFS

NFS is basically a way for people who are connected to the Internet to share files across varying

distances. File-sharing services allows people to search and share files on other people’s devices.

File sharing allows users to share or even collaborate no matter where they are. Most people use

these services to search for music, projects, and video files in order to download them to their

own devices.

One advantage that NFS provides is central management. Using a centrally managed server

decreases the workload for the administrator in terms of back-ups, adding software that will be


shared and computer repair. NFS is a distributed file system that allows users to access files and

directories located on remote computers and treat those files and directories as if they were local.

NFS has many practical uses. Some of the more common uses include Data that would otherwise

be duplicated on each client can be kept in a single location and accessed by clients on the

network. Several clients may need access to the /usr/ports/distfiles directory. Sharing that

directory allows for quick access to the source files without having to download them to each

client. Removable media storage devices can be used by other machines on the network. This

reduces the number of devices throughout the network and provides a centralized location to

manage their security. It is often more convenient to install software on multiple machines from

a centralized installation media.

Unfortunately, we were not able to get NFS to work because of the environment we were using it

in. Amazon EC2 seems to only support a more basic version of NFS that is specifically designed

for the servers. They refer to it as bucket storage and it is easily added to any server. It acts just

like NFS as you can pick which directories are to be shared and then they can be mounted by

users within the network. Another reason that NFS would not work on our server is that we don’t

have any other machines on the network to share files with. Our FTP and VPN users have full

access to all files on the server remotely. NFS is great for sharing files within a local network.

Since we were unable to get it working, we decided to add a local DNS to our server

environment which will be documented later in this paper.

DNS

Since this is a single server environment with no clients in the local network, DNS is not

completely useful but in a small business network environment, their chances of there being

multiple servers and network locations are very high. You may not want to have to type in an IP

address every time you want to remote access a server or hit a network share. This is where DNS

comes into play. The following steps are going to show you how we implemented DNS on our

server. We will also add records to the configuration that allow domain names to be resolved to

IP addresses. We are only going to set up a primary DNS server for this project but you will most

likely want to have a secondary/backup DNS server as well. Below are the steps to accomplish

this. Some of the screenshots used in this documentation come from www.digitalocean.com.

They have done a great job of showing what information needs to be changed in these files.

Sometimes they can get messy and I believe that they have done a much better job with their

screenshots than I could ever do.


1. First we must install BIND. Run the following command and continue with the

installation.

2. Next we must set BIND to use IPv4. Open up /etc/default/bind9 in your favorite text

editor or vi in the command line and add “-4” to the options like so. Once completed,

save the file and close the editor.

3. The data in the following configuration files are strictly for example but would be

replaced with relevant information if we were adding trusted clients and records for

resolution. Open /etc/bind/named.conf.options file in an elevated permissions text editor

or CLI. We are going to add an ACL block called trusted where we will list clients that

can make requests to the DNS server. You will see that I have also included a comment

space where you can label the IP addresses or ranges.


4. Next we want to edit the options block in the same file to enable recursive queries from

trusted clients and tell the DNS server the network it should listen for queries on. We also

will be disabling zone transfers in this step. The final product should look like the

following.

5. The next step is to configure DNS Zones in the local file. Open up

/etc/bind/named.conf.local in your favorite file editor with root permissions and let’s start

creating some local zones. Here is an example below of DNS zone. Replace the zone

with the domain name you are addressing and the IP address with the IP of the location.

Once completed, save and exit.

6. The final step is to create forward zone files. This is where the queries will be processed.

When user types in a domain name, he/she will be directed to the correct IP address

location because of this zone file. You will have to create this file yourself. Run the

following commands to set up the forward zone file. Replace hey.example.com with the

domain name set previously.

a. sudo mkdir /etc/bind/zones

b. cd /etc/bind/zones

c. sudo cp /etc/bind/zones/db.local /etc/bind/zones/db.hey.example.com


7. Next we will edit the file. Open /etc/bind/zone/db.hey.example.com in your favorite text

editor. It will look like this initially.

8. Now we will edit the SOA record by replacing “localhost” with our fully qualified

domain name. We will also replace “root.localhost” with the fully qualified domain name

and “admin.” in front of it. We also need to add some A records that will belong to the

zone. I will provide an example tomorrow and you will just need to plug in your own

information. Domain names and their respective IP addresses should be put into A

record. The final product should look something like this.

9. Let’s restart BIND and we should have a DNS server that is working successfully. The

records that you have set up in the zone files should allow you to use domain names to

access network locations. This is very useful for small business because it prevents a

client machine user from having to type in IP addresses to access these locations. Usually


within a small business, NFS will be up and running to share files throughout the

company. These locations have unique private IP addresses that can be confusing the the

average user. If you have a network share that hosts software and the IP address of that

network location is 192.168.1.94, don’t you think it would be much easier to type in

\\example.com\software. DNS is also very important if you are hosting local web servers.

Some companies will set up multiple web servers that are internal to the company.

Having a local DNS server makes accessing these servers very easy.

Conclusion

Overall this project should provide a small business with the local network environment that they

need to accomplish a lot of work within the office. NFS allows multiple people in the office to

collaborate on a project with shared folders. It can be used instead of email to transfer large files

in the office from one computer to another. Say you have a new website built that you want to

show your boss. You obviously can’t send it to him over email because of the size limitations of

most mail servers. Add it to a shared folder and you will be good to go. Your boss can access it

via the network location on the server. VPN will allow your employees to work on things

remotely because they will still have local network access. This is essential to any company that

plans to have traveling employees or employees that work from home. Apache and FTP allow

the web administrators to run a successful website and easily upload files to their web server. If

you are a network administrator in a small or medium sized network environment, consider

following all of certain parts of this project write up and implement them into your network

environment. There are many other things that can be added to a local network like this that

would provide it even more functionality but this is a major step in the right direction.


Team Member Signatures

Christopher Lau: __________________________________________

Kyle Poitinger: ____________________________________________

Azhar Toqeer: ____________________________________________

Michael Foley: _____________________________________________

Thomas Washington: _______________________________________

Date post:	03-Aug-2020
Category:	Documents
Upload:	others
View:	0 times
Download:	0 times

Small Buisness Network Environmentclau4/docs/FinalProjectWriteUp.pdf · Small Business Network...

Documents