{"id":3633,"date":"2018-09-07T16:40:08","date_gmt":"2018-09-07T22:40:08","guid":{"rendered":"http:\/\/benincosa.com\/?p=3633"},"modified":"2018-09-11T15:56:51","modified_gmt":"2018-09-11T21:56:51","slug":"ubuntu-18-04-jump-server-setup","status":"publish","type":"post","link":"https:\/\/benincosa.com\/?p=3633","title":{"rendered":"Ubuntu 18.04 Jump server setup"},"content":{"rendered":"<p>In my environment I have limited IP addresses, so we&#8217;re creating a new network and then allowing one server, the jump server, to sit between these network.\u00a0 To do this, my jump server, aka: jump104 is &#8220;dual-homed&#8221;.\u00a0 This means it has two network adapters:\u00a0 One on the public network, and one on the internal private network.\u00a0 We are going to make this server a:<\/p>\n<ul>\n<li>DHCP server to the 104 net<\/li>\n<li>Router to the 104 net<\/li>\n<li>DNS server to the 104 net<\/li>\n<li>VNC Server to view things on the private network<\/li>\n<\/ul>\n<h2>Network Adapters<\/h2>\n<p>First, we install a brand new Ubuntu 18.04 operating system.\u00a0 When I first set it up, I only had one interface which was configured correctly for the public network.\u00a0 Now I need to modify the network to add the second network configuration.\u00a0 This is done by editing \/etc\/netplan\/01-netcfg.yaml<\/p>\n<p>We add another stanza below what is already there:<\/p>\n<pre class=\"lang:yaml decode:true \">network:\r\n  version: 2\r\n  renderer: networkd\r\n  ethernets:\r\n    ens160:\r\n      addresses: [ 172.28.225.138\/23 ]\r\n      gateway4: 172.28.224.1\r\n      nameservers:\r\n          search: [ localhost ]\r\n          addresses:\r\n              - \"171.36.131.10\"\r\n              - \"171.70.168.183\"\r\n    ens192:\r\n      addresses: [ 10.99.104.1\/24 ]\r\n      nameservers:\r\n          addresses:\r\n              - \"10.99.104.1\"<\/pre>\n<p>To make sure that we can route traffic from the 104 net, we have to add some rules.\u00a0 This is called IP masquerading or setting up a NAT service.<\/p>\n<p>First, edit \/etc\/sysctl.d\/99-sysctl.conf and uncomment<\/p>\n<pre class=\"lang:sh decode:true \">net.ipv4.ip_forward=1<\/pre>\n<p>Then run<\/p>\n<pre class=\"lang:sh decode:true\">sysctl -p<\/pre>\n<p>Next add the masquerading rules<\/p>\n<pre class=\"lang:sh decode:true\">iptables -t nat -A POSTROUTING -s 10.99.104.0\/24 -o ens160 -j MASQUERADE\r\niptables -A FORWARD -s 10.99.104.0\/24 -o ens160 -j ACCEPT\r\niptables -A FORWARD -d 10.99.104.0\/24 -m state --state ESTABLISHED,RELATED -i ens160 -j ACCEPT<\/pre>\n<p>Here, the -s is the source of the internal network: 10.99.104.0\/24.\u00a0 The -o is the Internet facing interface, so for my setup it is the ens160<\/p>\n<h2>DNS<\/h2>\n<p>Next up, we need to make it a DNS slave.<\/p>\n<pre class=\"lang:sh decode:true\">sudo apt-get install bind9<\/pre>\n<p>In my setup we are creating a zone called &#8220;ccp.cisco.com&#8221;\u00a0\u00a0 We have to modify and add a few files.<\/p>\n<h4>\/etc\/bind\/named.conf.local<\/h4>\n<pre class=\"lang:sh decode:true\">zone \"ccp.cisco.com\" {\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 type master;\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 file \"\/etc\/bind\/zones\/db.ccp.cisco.com\";\r\n};\r\n\r\nzone \"104.99.10.in-addr.arpa\" {\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 type master;\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 file \"\/etc\/bind\/zones\/db.10.99.104\";\r\n};<\/pre>\n<p>Above we added two stanzas.\u00a0 First our new domain and where to do lookups and changes and second the reverse zone:\u00a0 Where to get names from IP addresses.<\/p>\n<h4>\/etc\/bind\/named.conf.options<\/h4>\n<p>Here we make sure to only listen on our private interface for queries and only allow queries from addresses in our private network.\u00a0 We also specify that any DNS query that we don&#8217;t know about (most of them) be forwarded to the master DNS service which can be directed through this server as well.<\/p>\n<pre class=\"lang:sh decode:true\">options {\r\n        directory \"\/var\/cache\/bind\";\r\n\r\n        forwarders {\r\n                173.36.131.10;\r\n                171.70.168.183;\r\n        };\r\n\r\n        listen-on { 10.99.104.1; };\r\n\r\n        allow-query { localhost; 10.99.104.0\/24; 172.28.0.0\/16; };\r\n        allow-transfer { any; };\r\n        dnssec-validation auto;\r\n\r\n        auth-nxdomain no;    # conform to RFC1035\r\n        listen-on-v6 { any; };\r\n};\r\n<\/pre>\n<h4>\/etc\/bind\/zones<\/h4>\n<p>Now we add the addresses to the zone files we listed above.<\/p>\n<h5>db.10.99.104<\/h5>\n<pre class=\"lang:sh decode:true\">$TTL\u00a0\u00a0\u00a0 604800\r\n@\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 IN\u00a0\u00a0\u00a0\u00a0\u00a0 SOA\u00a0\u00a0\u00a0\u00a0 jump104.ccp.cisco.com. root.ccp.cisco.com. (\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ; Serial\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 604800\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ; Refresh\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 86400\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ; Retry\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2419200\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ; Expire\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 604800 )\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ; Negative Cache TTL\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 IN\u00a0\u00a0\u00a0\u00a0\u00a0 NS\u00a0\u00a0\u00a0\u00a0\u00a0 jump104.ccp.cisco.com.\r\n\r\n1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 IN\u00a0\u00a0\u00a0\u00a0\u00a0 PTR\u00a0\u00a0\u00a0\u00a0 jump104.ccp.cisco.com.<\/pre>\n<h5>db.sjc.kubam.cisco.com<\/h5>\n<pre class=\"lang:sh decode:true\">$TTL\u00a0\u00a0\u00a0 604800\r\n@\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 IN\u00a0\u00a0\u00a0\u00a0\u00a0 SOA\u00a0\u00a0\u00a0\u00a0 jump104.ccp.cisco.com. root.ccp.cisco.com. (\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ; Serial\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 604800\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ; Refresh\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 86400\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ; Retry\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2419200\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ; Expire\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 604800 )\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ; Negative Cache TTL\r\n;\r\n@\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 IN\u00a0\u00a0\u00a0\u00a0\u00a0 NS\u00a0\u00a0\u00a0\u00a0\u00a0 localhost.\u00a0\u00a0\u00a0\u00a0\u00a0 ; delete this line\r\n@\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 IN\u00a0\u00a0\u00a0\u00a0\u00a0 A\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 127.0.0.1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ; delete this line\r\n@\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 IN\u00a0\u00a0\u00a0\u00a0\u00a0 AAAA\u00a0\u00a0\u00a0 ::1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ; delete this line\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 IN\u00a0\u00a0\u00a0\u00a0\u00a0 NS\u00a0\u00a0\u00a0\u00a0\u00a0 jump104.ccp.cisco.com.\r\n\r\njump104.ccp.cisco.com.\u00a0 IN\u00a0\u00a0\u00a0\u00a0\u00a0 A\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 10.99.104.1<\/pre>\n<p>Let&#8217;s check that we did it right with:<\/p>\n<pre class=\"lang:sh decode:true\">sudo named-checkconf<\/pre>\n<h4>\/etc\/default\/bind9<\/h4>\n<p>We are only serving on IPv4, so add the -4 flag to the options<\/p>\n<pre class=\"lang:sh decode:true \">OPTIONS=\"-4 -u bind\"<\/pre>\n<p>Once done we can now restart the DNS server and apply changes:<\/p>\n<pre class=\"lang:sh decode:true \">service bind9 restart<\/pre>\n<p>&nbsp;<\/p>\n<h2>DHCP<\/h2>\n<p>DHCP is used for dolling out IP addresses to unsuspecting servers that come on the network.\u00a0 This makes setting up IP addressing easy for VMs that pop up in our data center.<\/p>\n<pre class=\"lang:sh decode:true\">sudo apt-get install isc-dhcp-server<\/pre>\n<p>Now we add the DHCP range.\u00a0 Here we want to create a dynamic range from 10.99.104.100-10.99.104.254.\u00a0 By editing the \/etc\/dhcp\/dhcpd.conf file we can make this happen:<\/p>\n<pre class=\"lang:sh decode:true \"># dhcpd.conf\r\noption domain-name \"sjc.kubam.cisco.com\";\r\noption domain-name-servers 10.99.104.1;\r\ndefault-lease-time 3600;\r\nmax-lease-time 7200;\r\n\r\nddns-update-style none;\r\nauthoritative;\r\n\r\nsubnet 10.99.104.0 netmask 255.255.255.0 {\r\n        option routers 10.99.104.1;\r\n        option subnet-mask 255.255.255.0;\r\n        option domain-name \"sjc.kubam.cisco.com\";\r\n        option domain-name-servers 10.99.104.1;\r\n        range 10.99.104.100 10.99.104.254;\r\n}<\/pre>\n<p>But we want to be sure we only listen and respond to DHCP requests on the internal facing network interface.\u00a0 This is done by editing the \/etc\/default\/isc-dhcp-server<\/p>\n<p>Since after running ifconfig I see that my internal interface is ens192, I update this file to look as follows:<\/p>\n<pre class=\"lang:sh decode:true \">INTERFACESv4=\"ens192\"\r\nINTERFACESv6=\"\"<\/pre>\n<p>Since I&#8217;m not serving up DHCP for IPV6 then I just leave that blank.\u00a0 To make all these changes take effect I now run:<\/p>\n<pre class=\"lang:sh decode:true \">service isc-dhcp-server restart<\/pre>\n<p>It&#8217;s funny that I haven&#8217;t done this type of configuration since 2005 but some things haven&#8217;t changed all that much.<\/p>\n<p>&nbsp;<\/p>\n<h2>VNC Server<\/h2>\n<p>Being that all the stuff we want is behind a network we can&#8217;t reach, we need GUI tools to access the services.\u00a0 In my case I&#8217;m installing <a href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/net_mgmt\/cisco_container_platform\/1-5\/Installation_Guide\/CCP-Installation-Guide-1-5-0\/CCP-Installation-Guide-1-5-0_chapter_01.html#id_66042\">Cisco Container Platform<\/a> which requires that I can open a browser up to the IP address of the virtual machine behind this network.\u00a0 I can accomplish this by installing VNC and Firefox.\u00a0 I remember doing this once while installing vSphere many years ago and getting to the very end only to discover that I needed Flash and that Flash was not supported on Linux at the time.\u00a0 Those days are gone and you can do everything now without Windows.\u00a0 This makes me very happy.<\/p>\n<pre class=\"lang:sh decode:true \">apt install xfce4 xfce4-goodies\r\napt install tightvncserver<\/pre>\n<p>From here I can start it up by simply running vncserver.\u00a0 This opens up port 5901 and writes some configuration information to our ~\/.vnc\/xstartup.\u00a0 We can customize it to look as follows:<\/p>\n<pre class=\"lang:sh decode:true\">#!\/bin\/sh\r\n\/etc\/X11\/Xsession\r\nunset SESSION_MANAGER\r\nunset DBUS_SESSION_BUS_ADDRESS\r\nxrdb $HOME\/.Xresources\r\nstartxfce4 &amp;\r\n[ -x \/etc\/vnc\/xstartup ] &amp;&amp; exec \/etc\/vnc\/xstartup\r\n[ -r $HOME\/.Xresources ] &amp;&amp; xrdb $HOME\/.Xresources\r\nxsetroot -solid grey\r\nvncconfig -iconic &amp;<\/pre>\n<p>Start it with:<\/p>\n<pre class=\"lang:sh decode:true  \">vncserver -geometry 1600x1000<\/pre>\n<p>We are now ready to roll and get this private network all the goodness that it needs.<\/p>\n<p>Sources:<\/p>\n<ul>\n<li>https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-configure-bind-as-a-private-network-dns-server-on-ubuntu-18-04<\/li>\n<li>https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-install-and-configure-vnc-on-ubuntu-18-04<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>In my environment I have limited IP addresses, so we&#8217;re creating a new network and then allowing one server, the jump server, to sit between these network.\u00a0 To do this, my jump server, aka: jump104 is &#8220;dual-homed&#8221;.\u00a0 This means it has two network adapters:\u00a0 One on the public network, and one on the internal private&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[920],"tags":[921,855],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/benincosa.com\/index.php?rest_route=\/wp\/v2\/posts\/3633"}],"collection":[{"href":"https:\/\/benincosa.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/benincosa.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/benincosa.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/benincosa.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3633"}],"version-history":[{"count":7,"href":"https:\/\/benincosa.com\/index.php?rest_route=\/wp\/v2\/posts\/3633\/revisions"}],"predecessor-version":[{"id":3640,"href":"https:\/\/benincosa.com\/index.php?rest_route=\/wp\/v2\/posts\/3633\/revisions\/3640"}],"wp:attachment":[{"href":"https:\/\/benincosa.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3633"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/benincosa.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3633"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/benincosa.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3633"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}