WorldSkills Hong Kong Competition Test Project IT Network Systems Administration (Linux Module) English Version only 只 提 供 英 文 版 本

Transcription

1 WorldSkills Hong Kong Competition 2016 Test Project IT Network Systems Administration (Linux Module) English Version only 只 提 供 英 文 版 本

2 Table of Content INTRODUCTION 2 DESCRIPTION OF PROJECT AND TASKS 2 Work Task Linux Server 2 APPENDIX 4 INSTRUCTIONS TO THE COMPETITOR 4 EQUIPMENT, MACHINERY, INSTALLATIONS AND MATERIALS REQUIRED 5 INTRODUCTION Warning: SAVE ALL YOUR CONFIGURATIONS!!! Take snapshots periordically. The competition has a fixed start and finish time. You must decide how to best divide your time. Please carefully read the following instructions! DESCRIPTION OF PROJECT AND TASKS You are working for a new secondary school, ExtraSmart Secondary School. They plan to set up some servers to serve students and teachers. You have been assigned with building the server infrastructure at the new location. You are responsible for setting up a Linux server to provide various services such as web, DNS, for staff and students. The webserver is used to host web pages for public and intranet browsing. The server is used to provide internal services. The visitor area is equipped with a few guest computers for browsing local and internet webpages. For speeding up internet access, a proxy should be used. Work Task Linux Server Setup the following services on a linux server. DNS service o Set up DNS records to resolve domain names for web and services. Make sure the websites and server are resolvable to o Set up the reverse lookup records for the records setup above. o Configure DNS to forward all non-resolvable requests to the DNS server at Webserver (Apache2) o Install php5 o Create two websites, and intranet.xs.whk, stored in the directories /home/www/xs and /home/www/intra, respectively. o The www site should display Welcome to ExtraSmart, while the intranet should display Welcome to XS Intranet. o The intranet should have HTTPS enabled. o Create a personal website for user joe stored in the home directory /home/joe/public_html. Allow joe to maintain the website. The Joe s website should be protected by authentication using the login joe and password jpass. 2 of 30

3 Server (using the SMTP and IMAP protocols) o The server should use the hostname mail.xs.whk. o account should use the domain xs.whk. o Setup two accounts admin1 and teacher1. Also, enable access via webmail. o Test the service by sending s between the users admin1 and teacher1. o Install a Thunderbird client Proxy server (Squid) o The guest computer should be configured to use the proxy server when going online. Configure the server in transparent mode Configure it to block HTTP access to all hosts in the facebook.com domain. Samba service o Setup two shares for sharing between the Linux server and Windows client Share staff Path is /samba/staff Give access only to user admin1 with password adpass Make sure the share is not shown in the network browser of the clients Share forall Path is /samba/forall Enable read-only access to everyone SSH service o use RADIUS for your SSH authentication instead of using your local user accounts o Allow only users (admin1 and admin2 with password adpass) to login to the server using ssh o It has to listen on port 2222 o Root access should be prohibited o If the RADIUS failed, the authentication should fallback to using local user accounts Backup o Schedule a daily backup of /etc folder at 11:30pm. Firewall o Set the IPtable to allow for all the services listed above such as SSH, WWW, , samba. 3 of 30

4 APPENDIX SPECIFICATIONS INSTRUCTIONS TO THE COMPETITOR Warning: SAVE ALL YOUR CONFIGURATIONS!!! Every device will be rebooted before marking. Do not bring any materials with you to the competition. Mobile phones and any electric devices are prohibited. Do not disclose any competition material / information to any person during each session s competition. Read the whole competition script prior to starting your work. Be aware of different tasks attract a percentage of the overall mark. Plan your time carefully. 4 of 30

5 EQUIPMENT, MACHINERY, INSTALLATIONS AND MATERIALS REQUIRED PowerPC 1: Performance PC with 16GB memory with 2 network cards (one is onboard) VMware Workstation preinstalled VMs are preconfigured Additional software: Operating System (Centos 6.7 or later) Windows 7 and Windows 8 Additional equipment: None 5 of 30

6 WorldSkills Hong Kong Competition 2016 Test Project IT Network Systems Administration (Network Module) 6 of 30

7 Table of Content INTRODUCTION 7 DESCRIPTION OF PROJECT AND TASKS 7 PART1 8 Topology 8 Addressing and VLAN TABLE 9 VLAN Configurations and Port Mapping 10 Work Task Routers and Switches at HQ and Branches 10 Part 2 Configuration for the new site 13 Topology 13 IP Addressing Table 13 Work Task ASA at New HQ Site 14 Part 3 Design of IP Addressing Scheme for Branch 3 14 INSTRUCTIONS TO THE COMPETITOR 15 EQUIPMENT, MACHINERY, INSTALLATIONS AND MATERIALS REQUIRED 15 INTRODUCTION Warning: SAVE ALL YOUR CONFIGURATIONS FREQUENTLY!!! The competition has a fixed start and finish time. You must decide how to best divide your time. Please carefully read the following instructions! DESCRIPTION OF PROJECT AND TASKS The Wonderful Corporation is a growing trading company. It currently has an HQ office and two branch offices. It is also planning to move the HQ office to a new location and at the same time implement more security features in its networking equipment. The company uses a combination of LAN and WAN technologies to support interoffice communications and connections to the internet. The company is also using the latest VOIP technology to support inter-branch voice communications. Note: The user EXEC password is wchk and the privileged EXEC password is skill. 7 of 30

8 Part 1 Topology 8 of 30

9 Addressing and VLAN Table Device Interface IP Address Subnet Mask IPv6 Address Default Gateway G0/ :1:1:1::1/64 N/A HQ S0/0/ N/A S0/1/ :1:1:A001::1/ 64 S0/0/ N/A G0/ N/A G0/ N/A Branch1 G0/ N/A G0/ N/A S0/0/ N/A BR1-SW1 VLAN BR1-SW2 VLAN BR2-SW Branch2 S0/0/ :1:1:A001::2/ 64 G0/ :1:1:10::1/64 N/A BR2-PC1 Fa0/0 Preconfigured 2001:1:1:10::F/64 FE80::2 DNS server Fa0/0 Preconfigured 2001:1:1:10::F/64 FE80::1 wc.whk Outside hosts and Preconfigured Preconfigured 9 of 30

10 VLAN Configurations and Port Mappings VLAN Number Network Address VLAN Name Port Mappings /24 Admin BR-SW2:Fa0/ /24 Marketing BR-SW1:Fa0/6, BR-SW2:Fa0/ /24 Voice BR-SW1:Fa0/ /24 MgmtNative BR-SW1:Gi0/0 and Port Channel N/A Unused Unused Ports Work Task Routers and Switches at HQ and Branches Configure the following features on the appropriate routers and switches: BANNERS o On HQ and Branch routers set the login message No unauthorized use. Use # for delimiting. SSH o PPP o o NAT o Configure HQ to use SSH for remote access. The domain name is wc.hk. Set the modulus to The username is admin and the password is pass1. Only SSH (version2) should be allowed on VTY lines. Use PPP CHAP authentication for the link between HQ and the Internet. Create a user HQuser with the password of wchk. Use PPP PAP authentication for the link from HQ to the Branch2. Use the user Branch2 with the password of wchk. Configure static and dynamic NAT on HQ Allow all addresses in the /8 address space to be translated using a standard access list named Private. HQ has been given the public address pool for translation: to with a /29 mask. Allow port overloading in the translation. The wc.whk website at should be accessible using the IP address from the Outside Host. 10 of 30

11 DHCP o On Branch1, configure a DHCP pool for the Admin and Marketing using the following requirements: Exclude the first 10 IP addresses in the range. The case-sensitive pool name is VLAN60 (for Admin) and VLAN70 (for Marketing) Include assignment of the DNS server (in HQ LAN) as part of the DHCP configuration. Configure the Admin and Marketing PC to use DHCP. Static and Default Routing o On HQ, configure a default route to the Internet. Use the exit interface as an argument. o Configure an IPv6 default route from Branch2 to HQ using the next hop address as an argument. o Configure an IPv6 static route from HQ to Branch2 using the exit interface as an argument. OSPF Routing o Configure HQ, Branch and Branch2 with OSPF routing. Use Multi-area OSPFv2. HQ and Branch1 should use area 0 while Branch2 should use both area 0 and area 100. HQ should advertise the default route to other routers. Disable OSPF updates on appropriate interfaces. Configure OSPF router IDs as follows: HQ: ; Branch1: and Branch2: Inter-VLAN Routing o Configure Branch1 for inter-vlan routing. Using the addressing table for Branch1 router, configure the LAN interface for inter-vlan routing. Set VLAN 88 as the native VLAN. Etherchannel o Set the ports between the Branch1 switches to use LACP unconditionally. Statically configure them to belong to Port Channel 1 and set the channel as a trunk interface. VLANs and Trunking Configurations o Configure trunking and VLANs on BR1-SW1 and BR1-SW2. Create and name the VLANs listed in the VLAN Configuration and Port Mappings table on both switches. Configure the VLAN 88 interface (the management VLAN) and default gateway on the Branch1 switches. Configure the VLANs for the access ports according to the table above. Set Trunking mode to appropriate interfaces Disable all unused ports and assign the Unused VLAN. Port Security o Use the following policy to establish port security on the BR1-SW2 access ports for Admin and Markting VLAN: Allow only one MAC addresses to be learned on the port. Configure the first learned MAC address to stick to the configuration. Set the port to shut down if there is a security violation. 11 of 30

12 STP o Configure BR1-SW1 as the root bridge for all the VLANs: Use the priority level Access List Policy o Because HQ is connected to the Internet, configure a named ACL called HQINBOUND in the following order: Allow inbound HTTP requests to the wc.whk server. (Use the IP address as the URL) Allow only established TCP sessions from the Internet. Allow only inbound ping replies from the Internet. **(may omit) Block all other inbound access from the Internet, explicitly. Create another named ACL called HQTelnet to allow only PCs in VLAN 60 to telnet the HQ router. IP Telephony o Configure telephony service on Branch1 and Branch2 router. o Configure BR1-SW1 and BR2-SW to support voice VLAN. o The Branch1 phone should use VLAN 80. Branch2 phone can use VLAN1 o Each routers will serve as both DHCP and TFTP server for the IP phone and CIPC o Branch1 site s phone should have extension 1111 on button 1 o Branch2 site s phone should have the extension 2222 on button 1. o Branch2 site s CIPC should have the extension 2223 on button 1. o Configure the routers to ensure that the phones can call each other o For Branch1 s DHCP setting for the IP phones: Exclude the first 10 IP addresses in the range. The default gateway of the IP phone should be The case-sensitive pool name is VLAN80. Connectivity o Verify full connectivity from each PC to wc.whk and o Verify connectivity to and from the Internet. o IPv6 PC can ping the DNS server. 12 of 30

13 Part 2 Configuration for the new site The company is going to move to the new site in the next few months. To improve security it is going to use an ASA firewall in the new site. Currently, it is testing the newsite s firewall settings. R1 has a serial connection to the ISP. Layer 3 VLAN interfaces provide access to the three areas: inside, outside, and dmz. The ISP has assigned the public IP address space of /29, which will be used for address translation on the ASA. Topology IP Addressing Table Device Interface IP Address Subnet Mask Remarks R1 Fa0/ Completed S0/0/0 (DCE) Completed ISP router S0/0/ Completed ASA VLAN 1 (E0/1) ASA VLAN 2 (E0/0) ASA VLAN 3 (E0/2) DMZ Server NIC Completed Inside-PC NIC Completed 13 of 30

14 Work Task ASA at New HQ Site VLANs and zones o Configure the VLAN 1 (inside), VLAN 2 (outside) and VLAN 3 (dmz) interfaces. Use security level 70 for the DMZ and default values for other zones. Also, configure the corresponding IP addresses according to the addressing table above. Default route o Configure a default static route on the ASA outside interface using the next hop address as an argument. NAT o o o o o Create network object inside-network to include the inside subnet. Also use nat commands to specify to translate to the outside interface. Configure a network object named dmz-server and assign it the static IP address of the DMZ server ( ). Use the nat (static nat) command to translate the private DMZ-server address to the outside public address of To allow outside hosts to access the DMZ-server, configure a named access list OUTSIDE2DMZ that permits the TCP protocol on port 80 from any outside host to the internal IP address of the DMZ-server. Apply the access list to the ASA outside interface and specify the appropriate direction. Part 3 Design of IP Addressing Scheme for Branch 3 The company is planning to open a new branch office in next few months. Initially, it has assigned you to design the IP addressing scheme for this new branch office. You have been given the network address /24 to subnet and provide the IP addressing for Branch 3. TASK: Complete the Design of IP Addressing Scheme for Branch 3 Branch 3 subnets requirements o LAN1 will require 55 host IP addresses. o LAN2 will require 113 host IP addresses. o LAN3 will require 15 host IP addresses. o The link from Branch3 to HQ will require an IP address for each end of the link. o The link from Branch3 to Branch1 will require an IP address for each end of the link. Complete the IP addressing scheme with the least wastage of addresses in the following table: LAN/Link Subnet Address Usable Address Range For Hosts Subnet Mask 14 of 30

15 INSTRUCTIONS TO THE COMPETITOR Warning: SAVE ALL YOUR CONFIGURATIONS!!! Every device will be rebooted before marking. Do not bring any materials with you to the competition. Mobile phones and any electric devices are prohibited. Do not disclose any competition material / information to any person during each session s competition. Read the whole competition script prior to starting your work. Be aware of different tasks attract a percentage of the overall mark. Plan your time carefully EQUIPMENT, MACHINERY, INSTALLATIONS AND MATERIALS REQUIRED CISCO Switches (2960), Routers (2811), ASA Firewall and PCs. Cisco Packet Tracer 6.2 Additional equipment: None 15 of 30

16 WorldSkills Hong Kong Competition 2016 Test Project IT Network Systems Administration (Troubleshooting Module) 16 of 30

17 Table of Content INTRODUCTION PART 1 Troubleshooting Network Configuration Errors Topology Diagram Addressing Table DESCRIPTION OF PROJECT AND TASKS Task 1: Find and Correct All Network Error Task 2: Documenting the Errors Part 2 Troubleshooting Server Configuration Errors DESCRIPTION OF PROJECT AND TASKS Services installed on Linux server Services installed on Windows Virtual Server Problems Reported Task 1: Find and correct All Configuration Errors Task 2: Document the Configurations Errors of various services INSTRUCTIONS TO THE COMPETITOR EQUIPMENT, MACHINERY, INSTALLATIONS AND MATERIALS REQUIRED Appendix Logical topology diagram INTRODUCTION Warning: SAVE ALL YOUR CONFIGURATIONS FREQUENTLY!!! The competition has a fixed start and finish time. You must decide how to best divide your time. Please carefully read the following instructions! 17 of 30

18 PART 1 Troubleshooting Network Configuration Errors Topology Diagram Addressing Table Device Interface IP Address Subnet Mask Default Gateway Fa0/ N/A R1 R2 R3 Fa0/ N/A S0/0/ N/A S0/0/ N/A Fa0/ N/A S0/0/ N/A S0/0/ N/A Lo Fa0/1 N/A N/A N/A Fa0/ N/A Fa0/ N/A S0/0/ N/A S0/0/ N/A Fa0/ N/A 18 of 30

19 S1 VLAN10 DHCP N/A S2 VLAN N/A S3 VLAN N/A PC1 NIC DHCP DHCP DHCP PC2 NIC PC3 NIC DHCP Server WWW Server NIC NIC DESCRIPTION OF PROJECT AND TASKS You are working as an IT consultant for the company, OK Marketing Ltd. The junior technician has setup and configured the network devices for the company. However, it is found that there are many configuration errors. You have been assigned to troubleshoot the configured network and identify and correct the errors in the configurations in the networking devices. Requirements S2 is the spanning-tree root for both VLAN 11 and VLAN30. S3 is a VTP server with S2 as a client. The serial link between R1 and R3 is authenticated using CHAP. R2 must have secure login procedures because it is the Internet edge router. The vty lines, belonging to R1, allow connections only from the subnets in VLAN. OSPF is used in this scenario. R3 has access to both VLAN 11 and 30 via its Fast Ethernet port 0/1. Only devices in VLAN 10 are allowed access to the TFTP server. All devices on the and subnet must be able to get their IP addresses from DHCP on R1. All devices will use NAT (PAT) reach the internet. All VLANs must be able to reach other VLANs. R1, R2 and R3 must get the OSPF route to the /24 network The Wireless PC must be able to connect to and obtain an IP address from the Wireless Router. Hints on how to troubleshoot errors: Check the connectivity amount the VLANs and connectivity to Internet. Check the status of the serial links. Check the routing table to ensure all required routes is present. Check whether all PC can ping the Internet. Check only VLAN10 are allowed to access the WWW server. 19 of 30

20 Task 1: Find and Correct All Network Errors Correct and/or modify the erroneous configurations on the devices. Task 2: Documenting the Errors Give a summary of each error found in the configurations of the network, also specify the troubleshooting commands used in identifying the errors. Configuration errors Device Error summary troubleshooting commands used 20 of 30

21 Part 2 Troubleshooting Server Configuration Errors DESCRIPTION OF PROJECT AND TASKS You are working as an IT consultant for the company, OK Marketing Ltd. The junior technician has setup some servers to serve sales and admin staff. However, it is found that many of the installed services are not working as planned. Services installed on Linux server: Websites (Apache2): o Domain name: and intra.ok.wsc. They are stored in the directories /home/www/ok and /home/www/intra, respectively. o The www site will display Welcome to OK Marketing while the intranet will display Welcome to OK Intranet when accessed. o a personal website for user tom stored in the home directory /home/tom/public_html has been created. tom has the rights to maintain the website. The website is protected by authentication using the login tom and password pass1. Server (using the SMTP and IMAP protocols) o The server uses the hostname mail.ok.wsc. o accounts use the domain ok.wsc. o The accounts for user sales and admin have been created. Also, access via webmail has been enabled. Samba service o The file sharing service between linux server and windows client has been setup as follows: Share staff Path is /samba/staff Access only is allowed for user admin with password adpass The share is configured not to appear in the network browser of the clients Share others Path is /samba/others read-only access to everyone has been enabled Services and policies configured on Windows Virtual Server: Active Directory Domain Services (domain controller) o Domain name: ok.wsc o The Active Directory Recovery Password is Password1 o 3 new Organizational Unit named SS, Adm and GG (SS to contain sales, Adm to contain admin users and GG to contain guest users) has been created. o The user and security global group with members have been created according to following table. The password for all user accounts is Password1. 21 of 30

22 Groups Members Sales sx (1 2) Adm ax (1 2) Guest g1, g2 DNS service o Host and MX records for the websites (apache), FTP and servers have been setup. File sites (FTP) o a file server site: ftp.ok.wsc o a virtual directory called Admin pointing to the physical drive C:\adm has been created. Also, directory browsing has been enabled. Group Policies o password policies have been setup according to the following criteria: Domain passwords will be at least 6 characters Strong passwords need not be enforced Exception: admin users are configured to use 8 characters and complex passwords Problems reported: Windows (AD) Sales users cannot access the FTP server. When adding new admin users, the password policy is not properly enforced. The apache server is not accessible. The server is not working. The samba service is not working as intended. Task 1: Find and correct All Configuration Errors. Enter the correct configurations on the servers to allow all the services to function correctly. 22 of 30

23 Task 2: Document the Configurations Errors of various services. Give a summary of the errors found and solution used. Configuration errors Services Error summary Solution summary INSTRUCTIONS TO THE COMPETITOR Warning: SAVE ALL YOUR CONFIGURATIONS!!! Every device will be rebooted before marking. Do not bring any materials with you to the competition. Mobile phones and any electric devices are prohibited. Do not disclose any competition material / information to any person during each session s competition. Read the whole competition script prior to starting your work. Be aware of different tasks attract a percentage of the overall mark. Plan your time carefully EQUIPMENT, MACHINERY, INSTALLATIONS AND MATERIALS REQUIRED Pre-configured Linux Server (Centos 6.7 or later) and Windows 2012 Server. PC and Cisco Packet Tracer 6.2. Additional equipment: None 23 of 30

24 Appendix 24 of 30

25 WorldSkills Hong Kong Competition 2016 Test Project IT Network Systems Administration (Windows Module) 25 of 30

26 Table of Content INTRODUCTION 26 DESCRIPTION OF PROJECT AND TASKS 26 Work Task Windows Server 27 APPENDIX 29 INSTRUCTIONS TO THE COMPETITOR 29 EQUIPMENT, MACHINERY, INSTALLATIONS AND MATERIALS REQUIRED 30 INTRODUCTION Warning: SAVE ALL YOUR CONFIGURATIONS!!! Take snapshots periodically. The competition has a fixed start and finish time. You must decide how to best divide your time. Please carefully read the following instructions! DESCRIPTION OF PROJECT AND TASKS You are working for a new secondary school, ExtraSmart Secondary School. In addition to the Linux services you setup previously; you have also been assigned to setup some windows services and group policies to support teachers and admin staff. 26 of 30

27 Work Tasks Windows Server Install Active Directory Domain Services (domain controller) for xs.whk o Use Password1 as the Active Directory Recovery Password o Create 3 new Organizational Unit named TT, Adm and GG (TT to contain teachers, Adm to contain admin staff and GG to contain guest users) o Create the user and security global group with members as indicated in the following table. Use Password1 as the password for all user accounts. Groups Members Teacher tx (1 9) Adm ax (1 9) Guest g1, g2 DNS service o Set up DNS to resolve domain names for all web and ftp sites o Create a forward zone called xs.whk pointing to the IP address o Create a reverse zone for the IP addresses for the network /24. o Configure DNS to forward all non-resolvable requests to the DNS server at Certificate Services o Install the Enterprise Root (certification authority) CA o The CA server name is XSHK, and valid for 5 years. Webserver (IIS) o Create a website to display Welcome to Extra-Smart School. o Configure an HTTPS binding to the (CA) XSHK. o Create a virtual directory called Teacher beneath the above site. (The physical path is C:\Teacher. When accessed, it should display This directory belongs to teachers of Extra-smart. File server (FTP) o Create a file server site: ftp.xs.whk o Create a virtual directory called Admin pointing to the physical drive C:\adm Also, enable directory browsing. DHCP Server o Ranges: /24 (Client) Default Gateway , DNS: Group Policies (GPO) password policies o Ensure the user passwords must meet the following criteria: Domain passwords will be at least 5 characters. (Except Adm users should use 7 characters) Strong passwords need not be enforced. Passwords will be changed every 90 days. Accounts will be locked out for 3 minutes after five invalid logon attempts. 27 of 30

28 GPO Group Policies o All domain users should see the following message before logging in: Welcome to ExtraSmart. o Disallow access to the display settings on the Control Panel for all users, except the Adm group users o Disable the use of cmd and run for the Guest group users o Hide Network Connections from Start Menu for all teachers o Hide All Programs list from the start menu for all guests o Hide Recycle Bin icon from desktop for all guests o Redirect the MyDocuments of teachers to the same location for all teachers VPN service o Install VPN Server: use the following IP address Range for the VPN Clients: (provided by RRAS service) With a VPN connection, the user should be able to access to the shares on the server Only users in the adm group should be able to connect to the VPN server. Remote Clients should be able to access the vpn server via the IP address GPO Application Installation o Create GPO to automate software installation Using the firefox msi provided on the desktop, create a policy at the domain level called firefox to publish the program automatically to all computers in the domain, so it is available on the control panel, but not installed. Map Network Drives and Folder Redirection o Create users home folder \\xs.whk\home \username and ensure it is mapped to Z: at each logon automatically. limit the storage space to every home folder to 40MB ensure only users can access their own home folder o Redirect the Documents folder to \\xs.whk \home\username\documents. o Create departmental share folders on \\xs.whk\home\teacher and \\xs.whk\admin and map the respective share folder to Y: at logon, depending on the department the user is in. Users should not be allowed to access other departments or users home shares. 28 of 30

29 APPENDIX SPECIFICATIONS INSTRUCTIONS TO THE COMPETITOR Warning: SAVE ALL YOUR CONFIGURATIONS!!! Every device will be rebooted before marking. Do not bring any materials with you to the competition. Mobile phones and any electric devices are prohibited. Do not disclose any competition material / information to any person during each session s competition. Read the whole competition script prior to starting your work. Be aware of different tasks attract a percentage of the overall mark. Plan your time carefully. 29 of 30

30 EQUIPMENT, MACHINERY, INSTALLATIONS AND MATERIALS REQUIRED PowerPC 1: Performance PC with 16GB memory with 2 network cards (one is onboard) VMware Workstation preinstalled VMs are preconfigured Additional software: Operating System (Windows 2012 Server) Windows 7 and Windows 8 Additional equipment: None 30 of 30