Unit iv
Using Network configuration Tools
Advanced Wireless Network
DHCP
Setting up a Telnet Server
Setting up an SSH server
Network Configuration Files
As previously stated, seven network configuration files can
1
4
be modified to make changesto basic network interaction of your system.
The files are
. /etc/hosts—A listing of addresses, hostnames, and aliases . /etc/services—Network service and port connections
. /etc/nsswitch.conf—Linux network information service configuration
. /etc/resolv.conf—Domain name service domain (search) settings
. /etc/host.conf—Network information search order (by default, /etc/hostsandthen DNS)
. /etc/sysconfig/network—The hostname, IP address, boot activation control, and gateway settings (along with optional IPv6 settings)
. /etc/sysconfig/network-scripts/ifcfg-eth0—Network settings for the eth0 network device; see the file
sysconfig.txt under the /usr/share/doc/initscripts/directory for details about optional settings
After the first six of these files are modified, the changes are active. As with most configu- ration files, comments can be added with a hash mark (#) preceding the comment. The last file (/etc/sysconfig/network) requires the networking daemons to be restarted before the file is used. All seven of these files have a man page written about them for more information.
Adding Hosts to /etc/hosts
The /etc/hosts file is a map of IP to hostnames. If you are not using DNS or another naming service, and you are connected to a large network, this file can get quite large andcan be a real headache to manage.
A small /etc/hostsfile can look something like this: 127.0.0.1 localhost.localdo main localho
128.112.50 .69 myhost.mydomai
st
n.commyhost
128.112.50. 169 yourhost.mydoma in.com yourho
st
The first entry is for the loopback entry.
The second is for the name of the machine.
The third is another machine on the network.
If no naming service is in use on the network, the only host that myhostrecognizes by name is yourhost. (IP addresses on the network can still be used.)
If your network is using a naming service, the last line is not needed and can be deleted.
However, if myhost connects to yourhost frequently, it might be good to leave the entry so that myhost does not need to consult the naming service each time.
This can save time and reduce the strain on the network or the name service server.
Edit this file if you need to change your hostname or IP address or if you aren’t using a naming service and a host has been added to your network.
Service Settings in /etc/services
The /etc/servicesfile maps port numbers to services. The first few lines look similar to this (the /etc/servicesfile can be quite long, more than 500 lines):
# Each line describes one service, and is ofthe form:
#
# service-name port/protocol [aliases ...] [# comment] tcpmu
x1/tcp # TCP port service multiplexer
tcpmu
x1/udp # TCP port service multiplexer
rje 5/tcp # Remote Job Entry
rje 5/udp # Remote Job Entry
echo 7/tcp
echo 7/udp
discard 9/tcp sink null
discard 9/udp sink null
systat 11/tcp Users
Typically, there are two entries for each service because most services can use either TCP or UDP for their transmissions.
Usually after /etc/servicesis initially configured, you will not need to change it.
Using /etc/nsswitch.conf After Changing Naming Services
This file was initially developed by Sun Microsystems to specify the order in which services are accessed on the system.
A number of services are listed in the
/etc/nsswitch.conf file, but the most commonly modified entry is the hostsentry.
A portion of the file can look like this:
passwd: files
shadow: files
group: files
#hosts: db files nisplus nis dnshosts: files dns
This tells services that they should consult standard Unix/Linux files for passwd, shadow, and group (/etc/passwd, /etc/shadow, /etc/group, respectively) lookups.
For host lookups, the system checks /etc/hosts and if there is no entry, it checks DNS.
The commented hosts entry lists the possible values for hosts. Edit this file only if your naming service has changed.
Setting a Name Server with /etc/resolv.conf
/etc/resolv.confis used by DNS, the domain name service.
The following is an example of resolv.conf:
nameserver 192.172.3.8
nameserver
192.172.3.9 search
mydomain.com
This sets the nameservers and the order of domains for DNS to use.
Setting DNS Search Order with /etc/host.conf
1
4
The /etc/host.conf file lists the order in which your machine will search for hostname resolution. The following is the default /etc/host.conffile:
order hosts, bind
In this example, the host checks the /etc/hosts file first and then performs a DNS lookup. A couple more options control how the name service is used.
The only reason to modify this file is if you use NIS for your name service or you want one of the optional services. The nospoof option can be a good option for system security. It compares a stan- dard DNS lookup to a reverse lookup (host-to-IP then IP-to-host) and fails if the two don’tmatch. The drawback is that often when proxy services are used, the lookup fails, so you want to use this with caution.
Examining Host Network Settings in /etc/sysconfig/network Changes to /etc/sysconfig/network do take effect until you
restart the networking daemons or reboot the system. The file might look like this:
NETWORKING=yes
HOSTNAME=my
host
GATEWAY=192.1
12.50.99
A GATEWAYDEV setting is also available to associate a specific network device (such as eth0or eth1 and so on). An additional optional entry to /etc/sysconfig/network is for NIS domain machines and would look like this:
NISDOMAIN=rebel
The network file previously supported a FORWARD_IPV4value, which determined whether the host forwarded IP packets (usually “yes” for routers). This setting is now saved in /etc/sysctl.conf as a net.ipv4.ip_forward setting, which can be modified if the forwarding changes are required. See the sysctl.confman page for more information.
Networking with TCP/IP
The basic building block for any network based on Unix hosts is the Transport Control Protocol/Internet Protocol (TCP/IP) suite of three protocols.
The suite consists of the Internet Protocol (IP), Transport Control Protocol (TCP), and Universal Datagram Protocol (UDP). IP is the base protocol.
The TCP/IP suite is packet-based, which means that data is broken into little chunks on the transmit end for transmission to the receiving end. Breaking data up into manageable packets allows for faster and more accurate transfers.
In TCP/IP, all data travels via IP packets, which is why addresses are referred to as IP addresses. It is the lowest level of the suite.
TCP is a connection-based protocol. Before data is transmitted between two machines, a connection is established between them.
When a connection is made, a stream of data issent to the IP to be broken into the packets that are then transmitted.
At the receiving end, the packets are put back in order and sent to the proper application port. TCP/IP forms the basis of the Internet; without it the Internet would be a very different place indeed, if it even existed!
Advanced Wireless Networking
∙ Linux has had support for wireless networking since the first standards were developed in the early 1990s.
∙ With computers getting smaller and smaller, the usesfor wireless networking have increased; meanwhile, the transmission speeds also are increasing all the time.
∙ There are several different ways to create a wireless network.
1
4
∙ The following sections introduce you to several Linux commands you can use to initialize, configure, and manage wireless networking on your Fedora system.
Support for Wireless Networking
The Linux kernel that ships with Fedora provides extensive support for wireless network-ing.
Related wireless tools for configuring, managing, or displaying information about a wireless connection include . iwconfig—Sets the network name, encryption, transmission rate, and other features of a wireless network interface
. iwlist—Displays information about a wireless interface, such as rate, power level,or frequency used
. iwpriv—Uses i to set optional features, such as roaming, of a wireless networkinterface
. iwspy—Shows wireless statistics of a number of nodes
TCP/IP Addressing
∙ To understand networking with Linux, you need to know the basics of TCP/IP addressing. Internet IP addresses are assigned (for the United States and some other hosts) by the American Registry for Internet Numbers, available at http://www.arin.net/.
∙ The agency assigns Internet service providers (ISPs) one or more blocks of IP addresses, which the ISPs can then assign to their subscribers.
∙ You will quickly recognize the current form of TCP/IP addressing, known as IPv4 (IP version 4).
∙ In this method, a TCP/IP address is expressed of a series of four decimal numbers—a 32-bit value expressed in a format known as dotted decimal format, such as 192.168.120.135. Each set of numbers is known as an octet (eight ones and zeros, such as 10000000 to represent 128) and ranges from zero to 255.
∙ The first octet usually determines what class the network belongs to. There are three classes of networks.
∙ The classes are
. Class A—Consists of networks with the first octet ranging from 1 to 126. There are only 126 Class A networks—each composed of up to 16,777,214 hosts. (If you are doing the math, there are potentially 16,777,216 addresses, but no host portion
of an address can be all zeros or 255s.) The “10.” network is reserved for local network use, and the “127.” network is reserved for the loopback address of 127.0.0.1.
. Class B—Consists of networks defined by the
first two octets, with the first ranging from 128 to 191. The “128.” network is also reserved for local network use. There are 16,382 Class B networks—each with 65,534 possible hosts.
. Class C—Consists of a network defined by the
first three octets, with the first ranging from 192 to
1
4
223. The “192.” network is another that is reserved for local network use. There are a possible 2,097,150 Class C networks of up to 254 hosts each.
No host portion of an IP address can be all zeros or 255s. These addresses are reserved for local network broadcasts. Broadcast messages are not typically seen by users. IP addresses with all zeros in the host portion are reserved for network-to-network broadcast addresses.
These classes are the standard, but a netmask also determines in what class your network is. The netmask determines what part of an IP address represents the network and what part represents the host. Common netmasks for the different classes are
. Class A—255.0.0.0
. Class B—255.255.0.0
. Class C—255.255.255.0
Because of the allocation of IP addresses for Internet hosts, it is now impossible to get a Class A network. It is also nearly impossible to get a Class B network (all the addresses have been given out, but some companies are said to be willing to sell theirs), and Class C network availability is dropping rapidly with the current growth of Internet use world- wide.
Dynamic Host Configuration Protocol
∙ Dynamic Host Configuration Protocol (DHCP) configures hosts for connection to your network.
∙ DHCP allows a network administrator to configure all TCP/IP parameters for each host as he connects to the network after activation of a NIC.
∙ These parameters include automatically assigning an IP address to a NIC, setting name server entries in /etc/resolv.conf, and configuring default routing and gateway informa-tion for a host.
∙ how to use DHCP to obtain IP address assign- ment for your NIC, and then how to quickly set up and start a DHCP server using Fedora.
How DHCP Works
∙ DHCP provides persistent storage of network parameters by holding identifying informa- tion for each network client that might connect to the network.
The three most commonpairs of identifying information are . Network subnet/host address—Used by hosts to connect to the network at will
. Subnet/hostname—Enables the specified host to connect to the subnet
. Subnet/hardware address—Enables a specific client to connect to the network after getting the hostname from DHCP
∙ DHCP also allocates to clients temporary or permanent network (IP) addresses.
∙ When a temporary assignment, known as a lease, elapses, the client can request to have the lease 1
4
extended, or, if the address is no longer needed, the client can relinquish the address.
∙ For hosts that will be permanently connected to a network with adequate addresses available, DHCP allocates infinite leases.
∙ DHCP offers your network some advantages.
∙ First, it shifts responsibility for assigning IP addresses from the network administrator (who can accidentally assign duplicate IP addresses) to the DHCP server. Second, DHCP makes better use of limited IP addresses.
∙ If a user is away from the office for whatever reason, the user’s host can release its IP address for use by other hosts.
∙ Each network host configured to obtain an IP address dynamically via DHCP will upon boot send a DHCP request over the network ( by definition this is a broadcast of all 1’s ) to discover whether there is a DHCP server available somewhere on the network and consequently ask for a network configuration.
∙ DHCP client is then obligated to maintain communication with DHCP server and renew its IP address regularly as dictated by IP address’s lease time expiry.
∙ In case that DHCP client fails to renew its IP address ( disconnection, a host is turned off, etc. ) its IP address expires and DHCP server is free to lease this IP address to another DHCP client.
Basic DHCP Configuration
∙ By default, DHCP server configuration does not include any subnets on which DHCP server should lease IP addresses.
∙ Therefore, depending on your Linux system you may get the following error message when you attempt to start DHCP with the default dhcpd.conf configuration file.
∙ Starting ISC DHCP server: dhcpdcheck syslog for diagnostics. ... failed!
∙ Examining log files such as /var/log/syslog reveals more details:
∙ No subnet declaration for eth0 (some IP address).
∙ Your server may be connected to multiple network subnets. To start DHCP server, at least one subnet must be defined within the DHCP configuration file /etc/dhcp/dhcpd.conf.
Below is the simplest example of DHCP configuration file: subnet 10.1.1.0 netmask 255.255.255.0 {
range 10.1.1.3 10.1.1.254;
}
subnet 192.168.0.0 netmask 255.255.0.0 {
}
This configuration file instructs DHCP server to listen for DHCP client requests on subnet 10.1.1.0 with netmask 255.255.255.0. Furthermore, it will assign IP addresses in range 10.1.1.3 –
10.1.1.254. It also defines an empty definition for subnet with network ID 192.168.0.0.
Alter the above code with your subnet and insert it into /etc/dhcp/dhcpd.conf. When ready, restart your DHCP server with ( restart command may vary ) :
$ sudo systemctl restart isc-dhcp-server
Setting Up a Telnet server
∙ Having been superseded by SSH, you will find the Telnet server installation packages under Legacy Network Server in the Add or Remove Packages dialog box.
∙ You need to select it from the Details selection because it is not one of the default selections for the package group.
∙ After it’s installed, select System Settings, Server
Settings, Services and enable Telnet for runlevel 5. ∙ Note your IP address while you are here (switch to root andrun ifconfig).
∙ With that done, you can now fire up your other Linux box and type telnet <your IP>.
∙ If you are unsure of your IP address, switch to root and use the ifconfig command.
∙ You are prompted to enter your username and password.
∙ The whole conversation should looklike this:
[paul@susannah ~]$ telnet
10.0.0.1Trying 10.0.0.1…
Connected to 10.0.0.1
(10.0.0.1) Escape
character is‘^]’.
Welcome to
Caitlin Running
Fedora Core
* All accessislogged *
login:
paul
Passwor
d:
Last login: Sat Jul 9 12:05:41 from
10.0.0.5[paul@caitlin ~]$
Setting Up an SSH Server
∙ The OpenSSH server is set up to be automatically installed and run in Fedora, which means it should already be working on your system.
∙ However, if you have disabled it, youcan re-enable it by selecting System Settings, Server Settings, Services and selecting the sshd box.
∙ As you might have gathered, sshd is the name for the SSH server daemon.
∙ Two different versions of SSH exist, called SSH1 and SSH2.
1
∙ The latter is newer, is more secure, comes with more 5
features, and is the default in Fedora Core Linux.
∙ However, support for SSH1 clients is also left enabled by default so that older clients can connect.
∙ Because it is less secure, you should disable SSH1 if you have no one who specifically relies on it.
∙ To do this, edit the /etc/ssh/sshd_config file and look for this line:
#Protocol 2,1
Edit this line so that it becomes:
Protocol 2
This removes the comment sign (#) and tells sshd that you want it to only allow SSH2 connections. Save the file and exit your editor. The next step is to tell sshd to reread its configuration file, by executing this command:
kill -HUP `cat /var/run/sshd.pid`
If this returns cat: /var/run/sshd.pid: No such file or directory, it means you didn’t have sshd running. Next time you start it, it reads the configuration file and usesSSH2 only.
You can test this change by trying to connect to your SSH server in SSH1 mode. From thesame machine, type this:
ssh -1 localhost
The -1 switch forces SSH1 mode. If you successfully forced the SSH2 protocol, you should get the message Protocol major versions differ: 1 vs. 2.
The SSH Tools
∙ To the surprise of many, OpenSSH actually comprises a suite of tools.
∙ You have already seen ssh, the secure shell command that connects to other machines, and sshd, the SSH server daemon that accepts incoming SSH connections.
∙ However, there is also sftp, a replacement for ftp, and scp, a replacement for rcp.
∙ You should already be familiar with the ftp command because it is the lowest-common- denominator system for handling FTP file transfers.
∙ Like Telnet, though, ftpis insecure: Itsends your data in plain text across the network and anyone can sniff
your packets to pick out a username and password.
∙ The SSH replacement, sftp, puts FTP traffic over an SSH link, thus securing it.
∙ The rcp command might be new to you, largely because it is not used much anymore. Back in its day, rcp was the primary way of copying a single file to another server.
∙ As with ftp, scp replaces rcp by simply channeling the data over a secure SSH connection. The difference between sftp and scp is that the former allows you to copy many files,whereas the latter sends just one.
Public key encryption
It is an encryption technique that uses a pair of keys (public and private key) for secure data communication. In the pair of keys, the public key is for encrypting the plain text to convert it into ciphertext, and the private key is used for decrypting the ciphertext to read the message.
The private key is given to the receiver while the public key is provided to the public. Public Key Cryptography is also known as asymmetric cryptography.
he public key can be shared without compromising the security of the private one. All asymmetric key pairs are unique, so a message encrypted with a public key can only be read by the person who has the corresponding private key. The keys in the pair have much
longer than those used in symmetric cryptography. So, it is hard to decipher the private key from its public counterpart. Many of us, heard about RSA, which is the most common algorithm for asymmetric encryption in use today.
Public-key encryption is slower than secret-key encryption. In secret key encryption, a single shared key is used to encrypt and decrypt the message, while in public-key encryption, different two keys are used, both related to each other by a complex mathematical process. Therefore, we can say that encryption and decryption take more time in public-key encryption.
Applications of public key
The applications of public key are –
1) Public key cryptography can be used to encrypt Emails to keep their content confidential.
2) Asymmetric cryptography or public-key cryptography is also used in Secure socket layer (SSL) protocol to make secure connections to websites.
3) Public key is also used in Blockchain and cryptography technology. For example, a pair of keys is generated, while setting up a new cryptocurrency wallet.
4) It can be used to create a digital signature in the Operating System software such as Ubuntu, Red Hat Linux packages distribution, etc.
Private key
In private key, the same key (or secret key) is used by both the parties, i.e., the sender and receiver, for Encryption/Decryption technique.
The sender uses the secret key and encryption algorithm for encryption, whereas for decryption, the receiver uses this key and decryption algorithm. In Secret Key Encryption/Decryption technique, the algorithm used for encryption is the inverse of the
algorithm used for decryption. It means that if the combination of addition and multiplication is used in the encryption algorithm, then the decryption algorithm will use the combination of subtraction and division.
The secret key encryption algorithm is also known as symmetric encryption algorithm because the same secret key is used in bidirectional communication. The mechanism of private key is faster than the mechanism of public-key cryptography. The reason for this is that the size of the key is small.
1) It is defined as the technique that uses a single shared key (secret key) to encrypt and decrypt the message.
2) It is also called as symmetric key encryption. It is because the same secret key is used in bidirectional communication. 3) It is efficient as this technique is recommended for large amounts of text.
4) It is faster as it uses a single key for encryption and decryption. 5) Apart from the sender and receiver, the private key is kept secret and not public to anyone.
6) The main purpose of the secret key algorithm is to transmit the bulk data.
7) There is a possibility of losing the key that renders the system void.
Integrity Check & Digital signature
he Digital Signature is a technique which is used to validate the authenticity and integrity of the message. We know that there are four aspects of security: privacy, authentication, integrity, and non repudiation. We have already discussed the first aspect of security and other three aspects can be achieved by using a digital signature. The basic idea behind the Digital Signature is to sign a document. When we send a document electronically, we can also sign it. We can sign a document in two ways: to sign a whole document and to sign a digest.
∙ In Digital Signature, a public key encryption technique is used
to sign a document. However, the roles of a public key and private key are different here. The sender uses a private key to encrypt the message while the receiver uses the public key of the sender to decrypt the message.
∙ In Digital Signature, the private key is used for encryption while the public key is used for decryption.
∙ Digital Signature cannot be achieved by using secret key encryption.
Digital Signature is used to achieve the following three aspects:
∙ Integrity: The Digital Signature preserves the integrity of a message because, if any malicious attack intercepts a message and partially or totally changes it, then the decrypted message would be impossible.
∙ Authentication: We can use the following reasoning to show how the message is authenticated. If an intruder (user X) sends a message pretending that it is coming from someone else (user A), user X uses her own private key to encrypt the message. The message is decrypted by using the public key of user A. Therefore this makes the message unreadable. Encryption with X's private key and decryption with A's public key results in garbage value.
∙ Non-Repudiation: Digital Signature also provides non repudiation. If the sender denies sending the message, then her private key corresponding to her public key is tested on the plaintext. If the decrypted message is the same as the original message, then we know that the sender has sent the
message.
Signing the Digest
∙ Public key encryption is efficient if the message is short. If the message is long, a public key encryption is inefficient to use. The solution to this problem is to let the sender sign a digest of the document instead of the whole document.
∙ The sender creates a miniature version (digest) of the document and then signs it, the receiver checks the signature of the miniature version.
∙ The hash function is used to create a digest of the message. The hash function creates a fixed-size digest from the variable-length message.
∙ The two most common hash functions used: MD5 (Message Digest 5) and SHA-1 (Secure Hash Algorithm 1). The first one produces 120-bit digest while the second one produces a 160-bit digest.
∙ A hash function must have two properties to ensure the success:
∙ First, the digest must be one way, i.e., the digest can only be created from the message but not vice versa.
∙ Second, hashing is a one-to-one function, i.e., two messages should not create the same digest.
Following are the steps taken to ensure security:
∙ The miniature version (digest) of the message is created by using a hash function.
∙ The digest is encrypted by using the sender's private key. ∙ After the digest is encrypted, then the encrypted digest is attached to the original message and sent to the receiver.
∙ The receiver receives the original message and encrypted
digest and separates the two. The receiver implements the hash function on the original message to create the second digest, and it also decrypts the received digest by using the public key of the sender. If both the digests are same, then all the aspects of security are preserved.
At the sender site
At the receiver site
Wireless networking
Wireless LAN stands for Wireless Local Area Network. It is also called LAWN (Local Area Wireless Network). WLAN is one in which a
mobile user can connect to a Local Area Network (LAN) through a wireless connection.
The IEEE 802.11 group of standards defines the technologies for wireless LANs. For path sharing, 802.11 standard uses the Ethernet protocol and CSMA/CA (carrier sense multiple access with collision avoidance). It also uses an encryption method i.e. wired equivalent privacy algorithm.
Wireless LANs provide high speed data communication in small areas such as building or an office. WLANs allow users to move around in a confined area while they are still connected to the network.
In some instance wireless LAN technology is used to save costs and avoid laying cable, while in other cases, it is the only option for providing high-speed internet access to the public. Whatever the reason, wireless solutions are popping up everywhere.
Advantages of WLANs
o Flexibility: Within radio coverage, nodes can communicate without further restriction. Radio waves can penetrate walls, senders and receivers can be placed anywhere (also non visible, e.g., within devices, in walls etc.).
o Planning: Only wireless ad-hoc networks allow for communication without previous planning, any wired network needs wiring plans.
o Design: Wireless networks allow for the design of independent, small devices which can for example be put into a pocket. Cables not only restrict users but also designers of small notepads, PDAs, etc.
o Robustness: Wireless networks can handle disasters, e.g., earthquakes, flood etc. whereas, networks requiring a wired infrastructure will usually break down completely in disasters.
o Cost: The cost of installing and maintaining a wireless LAN is on average lower than the cost of installing and maintaining a traditional wired LAN, for two reasons. First, after providing wireless access to the wireless network via an access point for
the first user, adding additional users to a network will not increase the cost. And second, wireless LAN eliminates the direct costs of cabling and the labor associated with installing and repairing it.
o Ease of Use: Wireless LAN is easy to use and the users need very little new information to take advantage of WLANs.
Disadvantages of WLANs
o Quality of Services: Quality of wireless LAN is typically lower than wired networks. The main reason for this is the lower bandwidth due to limitations is radio transmission, higher error rates due to interference and higher delay/delay variation due to extensive error correction and detection mechanisms.
o Proprietary Solutions: Due to slow standardization procedures, many companies have come up with proprietary solutions offering standardization functionality plus many enhanced features. Most components today adhere to the basic standards IEEE 802.11a or 802.11b.
o Restrictions: Several govt. and non-govt. institutions world wide regulate the operation and restrict frequencies to minimize interference.
o Global operation: Wireless LAN products are sold in all countries so, national and international frequency regulations have to be considered.
o Low Power: Devices communicating via a wireless LAN are typically power consuming, also wireless devices running on battery power. Whereas the LAN design should take this into account and implement special power saving modes and power management functions.
o License free operation: LAN operators don't want to apply for a special license to be able to use the product. The equipment must operate in a license free band, such as the 2.4 GHz ISM band.
o Robust transmission technology: If wireless LAN uses radio
transmission, many other electrical devices can interfere with them (such as vacuum cleaner, train engines, hair dryers, etc.).Wireless LAN transceivers cannot be adjusted for perfect transmission is a standard office or production environment.
No comments:
Post a Comment