OS3 infrastructure 2016/2017

Transcription

1 OS3 infrastructure 2016/2017

2 Your sysadmin Name: Niels Sijm Studied SNE myself in parttime ( ) Taught web tech. at a HBO in Eindhoven Work 3 days/week for SNE Main tasks: system engineer, intake, info@os3.nl Secundary tasks: supervising projects, grading papers etc. Work as a software developer the other 2 (or 4?) days

3 Infra overview OS3 network: Where the magic happens Scanning/hacking/DoS ing houserules Lab: Desktops for lab assignments and projects Server Room: Dust, noise, lack of daylight, and servers Services: Wiki, shell server, Mail, web, DNS, VPN etc.

4 OS3 network We have our own network! \o/ Uplinked directly to SURFnet Not a part of the UvA network (almost) No firewalls, no ACLs etc. 10Gb/s internal backbone 1Gb/s SURFnet uplink

5 OS3 network (cont d) OS3 network is quite open Firewall to prevent UDP spoofing/amplification attacks Blocks portmapper and remote management ifaces Public IPs for everyone! Computers all connected via 1Gb/s Small firewall

6

7

8

9

10

11 OS3 IP space IPv4 via SURFnet /20 IPv6 via SURFnet 2001:610:158::/48

12 OS3 IP space (cont d) IPv4 via SURFnet /20 4,096 addr s IPv6 via SURFnet 2001:610:158::/48

13 OS3 IP space (cont d) IPv4 via SURFnet /20 4,096 addr s IPv6 via SURFnet 2001:610:158::/48 enough ;)

14 OS3 IP space (cont d) IPv4 via SURFnet /20 4,096 addr s IPv6 via SURFnet 2001:610:158::/48 enough ;) IPv4 via UvA /25

15 OS3 IP space (cont d) IPv4 via SURFnet /20 4,096 addr s IPv6 via SURFnet 2001:610:158::/48 enough ;) IPv4 via UvA / addr s

16 OS3 IP space (cont d) Routed IP subnets for everyone! \o/ IPv4: /28 routed to each student server IPv6: /60 routed to each student server Used for courses and experiments Don t start your own hosting company! For projects, more IP space can be requested

17 With great power comes great responsibility Compared to 40Gb/s and 100Gb/s, 1Gb/s is not much of a data stream. For lots of networks, however, 1Gb/s is a lot of data. Denial of Service with 1Gb/s is more than feasable The road to hell is paved with good intentions When unsure: contact teacher and/or OS3 team Not only apply, but also test rate limiting!

18

19 On the subject of scanning Within the OS3 network: Scanning on production VLANs is NOT allowed Do NOT scan/hack/dos teachers or other students Within OS3, trusting each other makes life easier Everything is hackable; no need to prove

20 On the subject of scanning (cont d) Outside the OS3 network Scanning the Internet is NOT allowed Consider the karma of the OS3 netblock For scanning experiments, talk to teacher and/or core team Responsible Disclosure through OS3 Ethics Committee

21 Desktops Desktops are designed as workstations Dual screen, Ubuntu 16.04, 8-12GB RAM, 1xSSD Students have sudo rights \o/ This is by design: installing software is allowed Desktops are assigned to students All students should be able to work on all desktops

22 Desktops (cont d) Login to desktop goes via LDAP OS3 credentials apply Desktop homedirs are local! Store Important Data at your own server Remember: all students can login to all desktops...and sometimes they will Don t traverse foreign homedirs or install keyloggers!

23 Lab connects All tables have 4 UTP cables at their disposal: Blue: Dekstop network Black: Laptop network Grey & White: Experiments Don t disconnect desktop from its blue cable! Desktop network is for OS3 desktops only! Black cable can be used freely (laptop etc.)

24 Lab connects (cont d) Patch panels in the server room to connect grey & white To your server, for instance Grey behind patch A White behind patch B

25 Student servers All students have their own rack server 25 x Dell PowerEdge R x Dell PowerEdge R210 II Spare servers for experiments 25 x Dell PowerEdge R210 II 10 x SuperMicro twin nodes

26 Student servers (cont d) Server is used for OS3 lab assignments and projects Intel Xeon proc, 8-16GB RAM, 2xGbE, idrac enterprise You own this machine: Students install and administer their own server You are responsible for your own server! Don t mount attacks on other Internet Sites!

27 Student servers (cont d) Remote Management via idrac Eliminates the need to get into server room :) Java applet for VNC-like administration Only accessible from within OS3 network! Use the OS3 VPN service when you re away

28 OS3 services , DNS, website, wiki, shell servers, etc. Run on 2x Dell PowerEdge R530 servers 64GB RAM, 2x quad-core 3GHz Intel Xeon, SSDs + HDDs Xen + DRBD/LVM for virtualization and shared storage platform Homebrew shell scripts for basic platform management Each service runs in its own VM Makes OS upgrades (and therefore my life) easier

29 services Website and Wiki Website == wiki Some parts are public, others are private Public: general and course information Private: students pages and playground Log in with your OS3 credentials Keep a log on your wiki subtree e.g. for ES logs

30 services Student Shell Server shell.students.os3.nl Shell access via SSH to Debian Jessie (current release) Login w/ OS3 credentials (ssh key auth. Possible) Typical usage: screen, irssi, IM, Persistent and secure home directory! Stored on RaidZ (ZFS on FreeNAS), Mounted via NFS No sudo rights; ask me to install additional software

31 services OS3 VPN access Provides access to/from OS3 and UvA network Username/password authn with OS3 credentials vpn.students.os3.nl Gives you an OS3 IPv4 address uva.vpn.students.os3.nl Gives you a UvA IPv4 address IPv6 support planned for OS3 VPN network

32 services , DNS, VPN etc. DNS: VPN: webmail.os3.nl (HTTPS) and imap.os3.nl (IMAPS) dns1.os3.nl and dns2.os3.nl OpenVPN via vpn.students.os3.nl

33 the_end Auxiliary non-logo image sources: