After attending this track students will be able to:
Install and upgrade the Unix operating system on standard PC hardware
Provide basic security for a Unix installation
Use Unix to provide some essential Internet services
In addition they will be taught concepts such as:
Basic Internet Protocols and how they work
Some basic Internet services and how they function, including DNS, Web, SSH and E-mail
Designing installations for long-term scalability of services
Resources needed
Local mirror of FreeBSD 6.0 Production Release with selected
packages not on the CD-ROM and the distfiles we need for the ports
exercises (test all the exercises on one machine, then copy across its
distfiles directory).
Possibly a Local FreeBSD cvsup mirror. Note, we can freeze
it and therefore be guaranteed that our exercises won't break due to
new changes in CVS!
Idealy one PC per two students.
One FreeBSD CD-ROM installation set per student.
Instructor PC with overhead projector.
Useful handout: commands and config files for FreeBSD 6.x.
Student non-root logins on the NOC server, for SSH and mail practice.
Instructors
(HA) Hervey Allen, USA/Chile
(JA) Joe Abley, Canada (Invited speaker)
(NS) Noah Sematimba, Uganda
(PO) Patrick Okui, Uganda
(PR) Phil Reganuld, Denmark
why use Unix not Windows? (and a bit about the philosophy:
small, re-usable components which you can join together. Scripts and
remote management rather than a GUI. Security history)
How to create a user: 'pw useradd xxx -m', 'passwd xxx'
How to delete a user: 'pw userdel xxx -r'
Using 'su' to become root from non-root; add user into 'wheel' group
Everybody create a non-root account. Always use it! Then use su when necessary
Simple filesystem commands
Look at the filesystem status: 'mount', 'df'
Mount the cdrom, use 'ls' to check contents, unmount it (can't eject until unmounted)
Simple package management commands
Look at package status: 'pkg_info' (and remember 'man pkg_info')
Add packages from CD-ROM
Install 'bash'
List the files it contains with pkg_info -L bash\; note all under /usr/local
Type 'bash'; why doesn't it work? 'rehash' first (C shell anomoly)
Editing files with vi
Edit /etc/rc.conf to set up networking
Edit /etc/resolv.conf to set up nameserver client
Test (e.g. ping)
Configure network interface in /etc/rc.conf
Using FTP client
Fetch joe and lynx-ssl packages into your home directory
Install them
Check they work (try editing a file with joe instead of vi)
Stick to vi if you want to practice
Note that some packages have dependencies which need downloading too; e.g. try installing 'gmake'
Note that /stand/sysinstall lets you install packages, but
it's tedious over the network because it downloads a huge INDEX file
every time. OK for CD-ROM though.
Practice installing, deleting, and querying packages
Session 4: Tour of Unix basics (Phil Regnauld)
Presentation: OpenOffice
Handout:
PDF (2-up) |
Exercises:
OpenDocument |
PDF (2-up) |
For each session include the commands you need to see the current state (e.g. ps and top, ls -l) and to change the current state (e.g. kill, rm). Some of this may be trimmed...
talk about the different branches of FreeBSD: CURRENT, 6_STABLE, 6_0_STABLE etc.
ways to update
updating by reinstalling a new release
updating by using the binary upgrade feature (pros/cons)
updating through source
install cvsup-without-gui package
upgrade the system source to 6_1_STABLE using cvsup (copy the example supfile, modify it to point to our local cvs mirror!)
Do source update
read /usr/src/UPDATING (why?)
follow ALL the steps to build and install new world and kernel (because kernel changes can be tied to the userland utilities)
show updating individual binaries through make / make install (example of a FreeBSD security alert)
Session 2: Installing and upgrading applications through ports (Noah Sematimba)
OpenOffice |
PDF
ports overview
ports are instructions (in a Makefile) to fetch the original source, apply FreeBSD-specific patches, compile and install
after installation it's just like a package; in fact the binary packages are built from ports
the ports tree is continually updated; the binary packages are not.
you can just upgrade from ports, or build your own packages
required ports are built automatically
configure make.conf to point to your local FreeBSD distfiles mirror
look at the ports Makefile, the md5 checksums, files (patches), the packing list and package description
use cvsup to bring the ports tree up to date (already done)
demonstration
(find a package which is out of date; Apache perhaps) using make / (make deinstall) / make install / make clean
other examples and practice
tools which assist (e.g. portupgrade)
Session 3: Security Revisited: Cryptography (Hervey Allen)
Presentation:
OpenOffice
Handout:
PDF |
PS .gz
SSH Exercise:
HTML |
PDF |
PS .gz
main cryptographic techniques: private key, hashing, public key
demonstrate md5/md5sum and discuss sha1sum
approaches to man-in-the-middle
known hosts (a magic 'fingerprint' learned from the other side)
[moved to start of next session] certificates
ssh practical
enable ssh, use it to log onto neighbour's machine, get prompted
to accept the host key first time, not second. (Check the host key
fingerprint manually on the other side)
o DNS Session-1 (Fundamentals):
* DNS Materials.
* Goal: to understand overall purpse and structure of DNS
+ IP addresses vs. names
+ DNS as a distributed, hierarchical database
+ Domain names and resource records:
- A, PTR, MX, CNAME, TXT, SOA/NS
+ Domain name lookup responses
+ Reverse DNS
+ DNS as client-server model
- Resolver
- Cache
- Authoritative server
+ Testing DNS (dig)
+ Understanding output from dig
+ Practical Exercises:
- Configure Unix resolver
- Use dig { A, other (e.g. MX), non-existent answer, reverse lookup }
- Use tcpdump to show queries being sent to cache