BENINCOSAArmchair Notes

An old man’s take on tech, systems, and trying to make sense of the world.

Technology

Ubuntu 18.04 Jump server setup

By Vallard BenincosaSeptember 7, 20184 min read
In my environment I have limited IP addresses, so we're creating a new network and then allowing one server, the jump server, to sit between these network.  To do this, my jump server, aka: jump104 is "dual-homed".  This means it has two network adapters:  One on the public network, and one on the internal private network.  We are going to make this server a:
  • DHCP server to the 104 net
  • Router to the 104 net
  • DNS server to the 104 net
  • VNC Server to view things on the private network

Network Adapters

First, we install a brand new Ubuntu 18.04 operating system.  When I first set it up, I only had one interface which was configured correctly for the public network.  Now I need to modify the network to add the second network configuration.  This is done by editing /etc/netplan/01-netcfg.yaml We add another stanza below what is already there: 
network:
  version: 2
  renderer: networkd
  ethernets:
    ens160:
      addresses: [ 172.28.225.138/23 ]
      gateway4: 172.28.224.1
      nameservers:
          search: [ localhost ]
          addresses:
              - "171.36.131.10"
              - "171.70.168.183"
    ens192:
      addresses: [ 10.99.104.1/24 ]
      nameservers:
          addresses:
              - "10.99.104.1"
To make sure that we can route traffic from the 104 net, we have to add some rules.  This is called IP masquerading or setting up a NAT service. First, edit /etc/sysctl.d/99-sysctl.conf and uncomment 
net.ipv4.ip_forward=1
Then run 
sysctl -p
Next add the masquerading rules 
iptables -t nat -A POSTROUTING -s 10.99.104.0/24 -o ens160 -j MASQUERADE
iptables -A FORWARD -s 10.99.104.0/24 -o ens160 -j ACCEPT
iptables -A FORWARD -d 10.99.104.0/24 -m state --state ESTABLISHED,RELATED -i ens160 -j ACCEPT
Here, the -s is the source of the internal network: 10.99.104.0/24.  The -o is the Internet facing interface, so for my setup it is the ens160

DNS

Next up, we need to make it a DNS slave. 
sudo apt-get install bind9
In my setup we are creating a zone called "ccp.cisco.com"   We have to modify and add a few files.

/etc/bind/named.conf.local

zone "ccp.cisco.com" {
        type master;
        file "/etc/bind/zones/db.ccp.cisco.com";
};

zone "104.99.10.in-addr.arpa" {
        type master;
        file "/etc/bind/zones/db.10.99.104";
};
Above we added two stanzas.  First our new domain and where to do lookups and changes and second the reverse zone:  Where to get names from IP addresses.

/etc/bind/named.conf.options

Here we make sure to only listen on our private interface for queries and only allow queries from addresses in our private network.  We also specify that any DNS query that we don't know about (most of them) be forwarded to the master DNS service which can be directed through this server as well. 
options {
        directory "/var/cache/bind";

        forwarders {
                173.36.131.10;
                171.70.168.183;
        };

        listen-on { 10.99.104.1; };

        allow-query { localhost; 10.99.104.0/24; 172.28.0.0/16; };
        allow-transfer { any; };
        dnssec-validation auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
};

/etc/bind/zones

Now we add the addresses to the zone files we listed above.
db.10.99.104
$TTL    604800
@       IN      SOA     jump104.ccp.cisco.com. root.ccp.cisco.com. (
                              3         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL

        IN      NS      jump104.ccp.cisco.com.

1       IN      PTR     jump104.ccp.cisco.com.
db.sjc.kubam.cisco.com
$TTL    604800
@       IN      SOA     jump104.ccp.cisco.com. root.ccp.cisco.com. (
                              3         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      localhost.      ; delete this line
@       IN      A       127.0.0.1       ; delete this line
@       IN      AAAA    ::1             ; delete this line

        IN      NS      jump104.ccp.cisco.com.

jump104.ccp.cisco.com.  IN      A       10.99.104.1
Let's check that we did it right with: 
sudo named-checkconf

/etc/default/bind9

We are only serving on IPv4, so add the -4 flag to the options 
OPTIONS="-4 -u bind"
Once done we can now restart the DNS server and apply changes: 
service bind9 restart
 

DHCP

DHCP is used for dolling out IP addresses to unsuspecting servers that come on the network.  This makes setting up IP addressing easy for VMs that pop up in our data center. 
sudo apt-get install isc-dhcp-server
Now we add the DHCP range.  Here we want to create a dynamic range from 10.99.104.100-10.99.104.254.  By editing the /etc/dhcp/dhcpd.conf file we can make this happen: 
# dhcpd.conf
option domain-name "sjc.kubam.cisco.com";
option domain-name-servers 10.99.104.1;
default-lease-time 3600;
max-lease-time 7200;

ddns-update-style none;
authoritative;

subnet 10.99.104.0 netmask 255.255.255.0 {
        option routers 10.99.104.1;
        option subnet-mask 255.255.255.0;
        option domain-name "sjc.kubam.cisco.com";
        option domain-name-servers 10.99.104.1;
        range 10.99.104.100 10.99.104.254;
}
But we want to be sure we only listen and respond to DHCP requests on the internal facing network interface.  This is done by editing the /etc/default/isc-dhcp-server Since after running ifconfig I see that my internal interface is ens192, I update this file to look as follows: 
INTERFACESv4="ens192"
INTERFACESv6=""
Since I'm not serving up DHCP for IPV6 then I just leave that blank.  To make all these changes take effect I now run: 
service isc-dhcp-server restart
It's funny that I haven't done this type of configuration since 2005 but some things haven't changed all that much.  

VNC Server

Being that all the stuff we want is behind a network we can't reach, we need GUI tools to access the services.  In my case I'm installing Cisco Container Platform which requires that I can open a browser up to the IP address of the virtual machine behind this network.  I can accomplish this by installing VNC and Firefox.  I remember doing this once while installing vSphere many years ago and getting to the very end only to discover that I needed Flash and that Flash was not supported on Linux at the time.  Those days are gone and you can do everything now without Windows.  This makes me very happy. 
apt install xfce4 xfce4-goodies
apt install tightvncserver
From here I can start it up by simply running vncserver.  This opens up port 5901 and writes some configuration information to our ~/.vnc/xstartup.  We can customize it to look as follows: 
#!/bin/sh
/etc/X11/Xsession
unset SESSION_MANAGER
unset DBUS_SESSION_BUS_ADDRESS
xrdb $HOME/.Xresources
startxfce4 &
[ -x /etc/vnc/xstartup ] && exec /etc/vnc/xstartup
[ -r $HOME/.Xresources ] && xrdb $HOME/.Xresources
xsetroot -solid grey
vncconfig -iconic &
Start it with: 
vncserver -geometry 1600x1000
We are now ready to roll and get this private network all the goodness that it needs. Sources:
  • https://www.digitalocean.com/community/tutorials/how-to-configure-bind-as-a-private-network-dns-server-on-ubuntu-18-04
  • https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-vnc-on-ubuntu-18-04