Sunteți pe pagina 1din 12

Test Practic RL

Varianta sample1, ianuarie 2015

Rezolv
ari

1.

Subpunctele (a), (b), (c)


Exist
a 4 ret, ele n topologia ment, ionat
a:
PC1, PC2, PC3 s, i Fa4/0 de pe Router0 - 4 stat, ii
PC0, PC6, PC7, PC8, PC9 s, i Fa5/0 de pe Router0 - 6 stat, ii
PC4 s, i Fa0/0 - 2 stat, ii
PC5 s, i Fa0/1 - 2 stat, ii
Avem as, adar nevoie de 2 subret, ele cu masca /29 (o astfel de ret, ea poate cont, ine 23229 2 = 6
stat, ii) s, i 2 subret, ele cu masca /30 (o astfel de subret, ea poate cont, ine 23230 2 = 2 stat, ii). Pornim
de la ret, eaua 172.16.245.11000000/26. Dorim sa obt, inem, pentru nceput doua subret, ele cu masca
/29, adic
a 172.16.245.11XYZ000/29. Alocam spat, iul 172.16.245.11000000/29 pentru ret, eaua cu 4
stat, ii s, i spat, iul 172.16.245.11001000/29 pentru ret, eaua cu 6 stat, ii. Impart, im urmatorul spat, iul /29,
adic
a 172.16.245.1101000/29 n 2 spat, ii /30: 172.16.245.1101000/29 s, i 172.16.245.1101010/29.
Cele 4 spat, ii pentru cele 4 ret, ele, sunt as, adar:
172.16.245.11000000/29, adic
a 172.16.245.192/29 pentru ret, eaua cu 4 stat, ii
172.16.245.11001000/29, adic
a 172.16.245.200/29 pentru ret, eaua cu 4 stat, ii
172.16.245.11010000/30, adic
a 172.16.245.208/30 pentru ret, eaua cu 2 stat, ii
172.16.245.11010100/30, adic
a 172.16.245.212/30 pentru ret, eaua cu 2 stat, ii
Vom configura pe stat, ii urm
atoarele adrese:
ret, eaua de 4 stat, ii (cea cu Switch0): 172.16.245.193/29, 172.16.245.194/29, 172.16.245.195/29,
172.16.245.196/29; masca n format zecimal este 255.255.255.248
ret, eaua de 6 stat, ii (cea cu Switch3): 172.16.245.201/29, 172.16.245.202/29, 172.16.245.203/29,
172.16.245.204/29, 172.16.245.205/29, 172.16.245.206/29 ; masca n format zecimal este
255.255.255.248
ret, eaua de 2 stat, ii (cea cu PC4): 172.16.4.209/30, 172.16.4.210/30; masca n format zecimal
este 255.255.255.252
ret, eaua de 2 stat, ii (cea cu PC5): 172.16.4.213/30, 172.16.4.214/30; masca n format zecimal
este 255.255.255.252
In Packet Tracer se acceseaz
a fiecare stat, ie (Desktop IP Configuration) s, i se completeaza adresa
IP s, i masca de ret, ea corespunz
atoare. Apoi se verifica folosind mesaje PacketTracer (n dreapta iconul Add Simple PDU sau tasta p) sau direct din consola unei stat, ii (Desktop Command Prompt,
urmat de o comand
a ping $adresaIP, unde $adresa IP este adresa unei alte stat, ii din ret, ea).
Pentru Router0:
Router>enable
Router#conf t
Enter configuration commands, one per line.
Router(config)#interface fa0/0
Router(config-if)#ip address 172.16.245.209
Router(config-if)#exit
Router(config)#interface fa1/0
Router(config-if)#ip address 172.16.245.213
Router(config-if)#exit
Router(config)#interface fa4/0
Router(config-if)#ip address 172.16.245.193

Test Practic RL

End with CNTL/Z.


255.255.255.252

255.255.255.252

255.255.255.248

Varianta sample1

ianuarie 2015

Router(config-if)#exit
Router(config)#interface fa5/0
Router(config-if)#ip address 172.16.245.201 255.255.255.248
Router(config-if)#exit
Router(config)#exit
Router#ping 172.16.245.210
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.245.210, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 3/4/6 ms
Router#ping 172.16.245.214
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.245.214, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/5/7 ms
Solut, ia se g
ases, te n fis, ierul rl_practic_2014-2015_sample1_ex1_sol.pkt.
2.

Subpunctele (a) s, i (b)


Pe switch-ul Switch0 vom configura portul Fa0/1 aferent stat, iei PC0 n VLAN-ul 10 s, i portul Fa1/1
aferent stat, iei PC3 n VLAN-ul 20:
Switch0>enable
Password:
Switch0#conf t
Enter configuration commands,
Switch0(config)#int fa0/1
Switch0(config-if)#switchport
Switch0(config-if)#switchport
Switch0(config-if)#switchport
% Access VLAN does not exist.
Switch0(config-if)#exit
Switch0(config)#int fa1/1
Switch0(config-if)#switchport
Switch0(config-if)#switchport
% Access VLAN does not exist.

one per line. End with CNTL/Z.


mode access
access vlan 10
access vlan 10
Creating vlan 10

mode access
access vlan 20
Creating vlan 20

Proced
am la fel pentru switch-ul Switch2:
Switch2>enable
Password:
Switch2#conf t
Enter configuration commands,
Switch2(config)#int fa0/1
Switch2(config-if)#switchport
Switch2(config-if)#switchport
Switch2(config-if)#switchport
% Access VLAN does not exist.
Switch2(config-if)#exit
Switch2(config)#int fa1/1
Switch2(config-if)#switchport
Switch2(config-if)#switchport
% Access VLAN does not exist.

Test Practic RL

one per line. End with CNTL/Z.


mode access
access vlan 10
access vlan 10
Creating vlan 10

mode access
access vlan 20
Creating vlan 20

Varianta sample1

ianuarie 2015

In fiecare zon
a (Switch0 s, i Switch2) avem cate 2 VLAN-uri. Pentru ca pachetele din ambele VLANuri s
a poat
a circula pe o singur
a leg
atura simultan, aceasta trebuie configurata ca s, i legatura de
trunchi. Astfel pe Switch0 configur
am portul fa2/1 n mod trunchi:
Switch0(config)#int fa2/1
Switch0(config-if)#switchport mode trunk
La fel proced
am s, i cu portul fa2/1 de pe Switch2:
Switch2(config)#int fa2/1
Switch2(config-if)#switchport mode trunk
Ne mai r
am
ane s
a configur
am porturile de pe Switch1 n mod trunchi:
Switch1>enable
Password:
Switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch1(config)#in fa0/1
Switch1(config-if)#switchport mode trunk
Switch1(config-if)#exit
Switch1(config)#int fa1/1
Switch1(config-if)#switchport mode trunk
Switch1 nu are n baza lui de date VLAN-urile 10 s, i 11 (se poate verifica folosind comanda show
vlan brief). Trebuie s
a cre
am aceste VLAN-uri:
Switch1(config)#vlan 10
Switch1(config-vlan)#exit
Switch1(config)#vlan 20
Switch1(config-vlan)#exit
Pentru verificarea conectivit
at, ii (PC0 cu PC3 s, i PC1 cu PC2) folosim fie mesaje PacketTracer (Add
Simple PDU sau tasta p) sau comanda ping din consola stat, iilor (Desktop Command Prompt).

Subpunctul (c)
Pentru a afla adresa MAC a unui calculator merget, i cu mouse-ul peste acesta (hover ) s, i as, teptat, i sa
v
a apar
a o fereastr
a cu adresa IP a acestuia. In partea dreapta a ferestrei se afla s, i adresa MAC.
Adresa MAC a lui PC0 este 0001.6458.8b1a s, i adresa MAC a lui PC1 este 0090.2ba4.567c. Pentru a
configura o intrare static
a pe Switch1 pentru cele doua adrese MAC executam urmatoarele comenzi:
Switch1(config)#mac-address-table static 0001.6458.8b1a vlan 10 interface fa1/0
Switch1(config)#mac-address-table static 0090.2ba4.567c vlan 20 interface fa1/1
Vom vizualiza noua configurat, ie static
a:
Switch1#show mac-address-table
Mac Address Table
------------------------------------------Vlan Mac Address Type Ports
---- ----------- -------- ----1
1
10
20

0001.43a0.1632
000a.410a.5502
0001.6458.8b1a
0090.2ba4.567c

Test Practic RL

DYNAMIC Fa1/1
DYNAMIC Fa0/1
STATIC Fa1/1
STATIC Fa1/1

Varianta sample1

ianuarie 2015

Subpunctul (d)
Pe switch-ul Switch0 vom crea un nou VLAN cu ID-ul 100 n care adaugam portul fa3/1 aferent
stat, iei Management:
Switch0#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch0(config)#vlan 100
Switch0(config-vlan)#exit
Switch0(config)#int fa3/1
Switch0(config-if)#switchport mode access
Switch0(config-if)#switchport access vlan 100
Pe switch-ul Switch1 vom crea VLAN-ul cu ID-ul 100:
Switch1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch1(config)#vlan 100
Switch1(config-vlan)#exit
Vom configura adresa IP 172.16.0.1/16 pe interfata virtuala vlan100:
Switch1(config)#int vlan100
%LINK-5-CHANGED: Interface Vlan100, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan100, changed state to up
Switch1(config-if)#
Switch1(config-if)#ip add 172.16.0.1 255.255.0.0
De pe stat, ia Management, din Command prompt ne conectam la switch-ul configurat:
Packet Tracer PC Command Line 1.0
PC>telnet 172.16.0.1
Trying 172.16.0.1 ...Open

Switch1>
Solut, ia se g
ases, te n fis, ierul rl_practic_2014-2015_sample2_ex2_sol.pkt.
3.

Subpunctul (a)
Router1>enable
Router1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router1(config)#int fa6/0
Router1(config-if)#ip add 172.16.255.253 255.255.255.252
Router2>en
Router2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router2(config)#int fa6/0
Router2(config-if)#ip add 172.16.255.253 255.255.255.252
Verific
am s
a avem conectivitate ntre ele:
Router2#ping 172.16.255.253
Type escape sequence to abort.

Test Practic RL

Varianta sample1

ianuarie 2015

Sending 5, 100-byte ICMP Echos to 172.16.255.253, timeout is 2 seconds:


.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 2/3/5 ms

Subpunctul (b)
In primul r
and trebuie s
a afl
am care este ruta implicita pentru fiecare ret, ea. Pentru PC0 s, i PC1 ruta
implicit
a este dat
a de adresa IP de pe interfata Fa0/0 a ruterului Router1: 192.168.0.1 (faceti
hover peste ruter pentru a v
a ap
area configuratiile). Pentru PC2 s, i PC3 ruta implicita este data de
adresa IP de pe interfata Fa0/0 a ruterului Router2: 192.168.2.1 (faceti hover peste ruter pentru
a v
a ap
area configuratiile).
Configur
am ruta implicit
a pe fiecare stat, ie n Desktop IP Configuration Default Gateway.
Test
am conectivitatea pentru PC0 s, i PC1 catre adresa IP 172.16.255.253 configurata pe Router1
merg
and n Desktop Command Prompt:
PC>ping 172.16.255.253
Pinging 172.16.255.253 with 32 bytes of data:
Reply from 172.16.255.253: bytes=32 time=12ms TTL=255
Ping statistics for 172.16.255.253:
Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 12ms, Maximum = 12ms, Average = 12ms

Subpunctul (c)
Pentru a obtine conectivitate ntre toate stat, iile, Router1 trebuie sa stie de ret, eaua formata din PC2
s, i PC3 (192.168.2.0/24), iar Router2 trebuie sa stie de ret, eaua formata dn PC0 s, i PC1 (192.168.0.0/24).
Avem 2 posibilit
ati: ad
aug
am rut
a specifica doar pentru ret, elele mai sus mentionate sau adaugam o
rut
a implicit
a pe fiecare din rutere. Vom alege ruta specifica. Astfel pe Router1:
Router1>enable
Router1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router1(config)#ip route 192.168.2.0 255.255.255.0 172.16.255.254
Router1(config)#exit
Verific
am tabela de rutare:
Router1#show ip route static
S 192.168.2.0/24 [1/0] via 172.16.255.254
Router1#
Proced
am la fel s, i pe Router1:
Router2>enable
Router2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router2(config)#ip route 192.168.0.0 255.255.255.0 172.16.255.253
Router2(config)#exit
%SYS-5-CONFIG_I: Configured from console by console
Router2#show ip route static
S 192.168.0.0/24 [1/0] via 172.16.255.253

Test Practic RL

Varianta sample1

ianuarie 2015

Acum putem verifica conectivitatea ntre PC0/PC1 s, i PC2/PC3 folosind mesaje PacketTracer (n
dreapta icon-ul Add Simple PDU sau tasta p) sau direct din consola unei stat, ii (Desktop Command
Prompt, urmat de o comand
a ping $adresaIP, unde $adresa IP este adresa unei alte stat, ii din
ret, ea).
Solut, ia se g
ases, te n fis, ierul rl_practic_2014-2015_sample1_ex3_sol.pkt.

Subpunctul (d)
Vom ncepe prin inspectarea configuratiilor stat, iilor. Verificam ruta implicita sa corespunda cu
adresa IP configurat
a pe interfata ruterului adiacent. Observam ca Router3 are pe interfata fa1/0
adresa IP 192.168.1.1, iar PC1 are ruta implicita setata la 192.168.1.249. Setam ruta implicita
la 192.168.1.1. In continuare o vom lua sistematic s, i vom verifica conectivitatea de la PC0 la toate
adrese IP de pe fiecare din rutere n ordine. Observam ca adresa IP 192.168.199.2 de pe Router2
nu r
aspunde:
PC>ping 192.168.199.2
Pinging 192.168.199.2 with 32 bytes of data:

Ping statistics for 192.168.199.2:


Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
De aici deducem c
a Router2 nu stie unde se afla ret, eaua din care face parte adresa IP a lui PC0. Vom
vizualiza tabela de rutare a lui Router2:
Router2#show ip route static
S 192.168.0.0/24 [1/0] via 192.168.200.3
S 192.168.1.0/24 [1/0] via 192.168.200.3
Observ
am c
a ruta aferent
a ret, elei 192.168.0.0/24 este gresita ntrucat ea se afla la next-hop-ul
192.168.199.1. Stergem s, i ad
aug
am din nou ruta pentru ret, eaua lui PC0:
Router2(config)#no ip route 192.168.0.0 255.255.255.0
Router2(config)#ip route 192.168.0.0 255.255.255.0 192.168.199.1
Verific
am din nou conectivitatea de pe PC0:
PC>ping 192.168.199.2
Pinging 192.168.199.2 with 32 bytes of data:
Reply from 192.168.199.2: bytes=32 time=8ms TTL=254
Continu
am descoperirea problemelor prin testarea conectivitatii ntre PC0 s, i Router3:
PC>ping 192.168.200.3
Pinging 192.168.200.3 with 32 bytes of data:

Ping statistics for 192.168.200.3:


Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
Vom aplica aceeas, i procedur
a ca s, i pe Router2, afisand tabela de rutare:
Router3#show ip route static
Observ
am c
a Router3 nu are nici o rut
a n tabela de rutare. Vom adauga o ruta implicita catre
Router2:

Test Practic RL

Varianta sample1

ianuarie 2015

Router3(config)#ip route 0.0.0.0 0.0.0.0 192.168.200.2


In acest moment test
am conectivitatea ntre PC0 s, i PC1:
PC>ping 192.168.1.2
Pinging 192.168.1.2 with 32 bytes of data:
Request timed out.
Reply from 192.168.1.2: bytes=32 time=10ms TTL=125
Reply from 192.168.1.2: bytes=32 time=13ms TTL=125
Solut, ia se g
ases, te n fis, ierul rl_practic_2014-2015_sample1_ex3d_sol.pkt.
4.

Subpunctul (a)
Pe interfata veth-red vom configura prima adresa IP din subretea (10.200.40.129/29), iar pe interfata
eth0 de pe stat, ia red vom configura a doua adresa IP (10.200.40.130/29):
root@host:~# ip address add 10.200.40.129/29 dev veth-red
root@host:~# go red
root@red:~# ip address add 10.200.40.130/29 dev eth0
Verific
am conectivitatea ntre acestea folosind comanda ping:
root@red:~# ping 10.200.40.129
PING 10.200.40.129 (10.200.40.129) 56(84) bytes of data.
64 bytes from 10.200.40.128: icmp_req=1 ttl=64 time=0.106 ms
Proced
am asem
an
ator s, i pentru cel
alalte doua legaturi:
root@host:~# ip address add 10.200.40.137/30 dev veth-green
root@host:~# ip address add 10.200.40.141/30 dev veth-blue
root@host:~# go green
root@green:~# ip address add 10.200.40.138/30 dev eth0
root@green:~# ping 10.200.40.137
PING 10.200.40.137 (10.200.40.137) 56(84) bytes of data.
64 bytes from 10.200.40.137: icmp_req=1 ttl=64 time=0.103 ms
^C
--- 10.200.40.137 ping statistics --1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.103/0.103/0.103/0.000 ms
root@green:~#
[...]
root@host:~# go blue
root@blue:~# ip address add 10.200.40.142/30 dev eth0
root@blue:~# ping 10.200.40.141
PING 10.200.40.141 (10.200.40.141) 56(84) bytes of data.
64 bytes from 10.200.40.141: icmp_req=1 ttl=64 time=0.073 ms
^C
--- 10.200.40.141 ping statistics --1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.073/0.073/0.073/0.000 ms

Subpunctul (b)
Configur
am ruta implicit
a pe containerele red, green s, i blue:

Test Practic RL

Varianta sample1

ianuarie 2015

root@host:~# go blue
root@blue:~# ip route add default via 10.200.40.141
root@host:~# go green
root@green:~# ip route add default via 10.200.40.137
root@host:~# go red
root@red:~# ip route add default via 10.200.40.129
Activ
am rutarea pe stat, ia host:
root@host:~# sysctl -w net.ipv4.ip_forward=1
net.ipv4.ip_forward = 1
Verific
am conectivitatea ntre containere. De pe red executam comanda ping catre adresele IP ale
celorlalte dou
a containere:
root@host:~# go red
root@red:~# ping 10.200.40.138
PING 10.200.40.138 (10.200.40.138) 56(84) bytes of data.
64 bytes from 10.200.40.138: icmp_req=1 ttl=63 time=0.099 ms
^C
--- 10.200.40.138 ping statistics --1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.099/0.099/0.099/0.000 ms
root@red:~# ping 10.200.40.142
PING 10.200.40.142 (10.200.40.142) 56(84) bytes of data.
64 bytes from 10.200.40.142: icmp_req=1 ttl=63 time=0.112 ms
^C
--- 10.200.40.142 ping statistics --1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.112/0.112/0.112/0.000 ms

Subpunctul (d)
Pentru a asigura accesul la internet al stat, iilor de tip container trebuie sa adaugam o regula de
NAT/MAQUERADE pe host folosind iptables pentru tot traficul ce iese prin interfata eth0:
root@host:~# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Verific
am accesul la Internet de pe stat, ia red:
root@red:~# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_req=1 ttl=41 time=38.3 ms
64 bytes from 8.8.8.8: icmp_req=2 ttl=41 time=38.2 ms

5.

Subpunctul (a)
Pentru a putea realiza autentificarea prin SSH, fara parola, aceasta trebuie facuta pe baza unei
perechi de chei publice/private. Vom genera o astfel de pereche folosind comanda ssh-keygen n
contul utilizatorului ana de pe stat, ia red (patrat, i opt, iunile implicite din paranteze apasand tasta
ENTER):
root@red:~# su - ana
ana@red:~$ ssh-keygen
Generating public/private rsa key pair.

Test Practic RL

Varianta sample1

ianuarie 2015

Enter file in which to save the key (/home/ana/.ssh/id_rsa):


Created directory /home/ana/.ssh.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/ana/.ssh/id_rsa.
Your public key has been saved in /home/ana/.ssh/id_rsa.pub.
The key fingerprint is:
a9:50:a8:93:f7:42:ff:67:00:ff:09:4d:e4:47:94:40 ana@red
The keys randomart image is:
+--[ RSA 2048]----+
| .Eo.. |
| . . o |
| . . o . |
| o .. .o . |
| + + oSo . |
| + + .+ . |
| . + + . |
| . . = |
| .o |
+-----------------+
ana@red:~$
Vom copia cheia n contul utilizatorului bogdan de pe stat, ia green folosind comanda ssh-copy-id:
ana@red:~$ ssh-copy-id bogdan@green
The authenticity of host green (192.168.2.2) cant be established.
ECDSA key fingerprint is fb:7a:95:31:ac:06:32:11:28:8f:8a:e2:4a:17:f2:f4.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added green,192.168.2.2 (ECDSA) to the list of known hosts.
bogdan@greens password:
Now try logging into the machine, with "ssh bogdan@green", and check in:
~/.ssh/authorized_keys
to make sure we havent added extra keys that you werent expecting.
In acest moment ne putem autentifica f
ar
a parola n contul utilizatorului bogdan de pe stat, ia green:
ana@red:~$ ssh bogdan@green
Welcome to Ubuntu 12.04.3 LTS (GNU/Linux 3.2.0-53-generic-pae i686)
* Documentation: https://help.ubuntu.com/
bogdan@green:~$

Subpunctul (b)
Copierea de pe o stat, ie pe alta, prin ret, ea, se poate realiza folosind comanda scp. In mod particular,
n acest caz, ni se cere s
a copiem un director. Pentru acest lucru trebuie sa folosim optiunea -r
(recursiv) a comenzii:

student@red:~$ ls -l examen/
total 12
drwxr-xr-x 3 student student 4096 Dec 23 06:44 test1
drwxr-xr-x 3 student student 4096 Dec 23 06:44 test2
drwxr-xr-x 3 student student 4096 Dec 23 06:43 test3
student@red:~$ scp -r examen/ student@blue:
Warning: Permanently added the ECDSA host key for IP address 192.168.3.2 to the list of known host
veryclassic 100% 24 0.0KB/s 00:00

Test Practic RL

Varianta sample1

ianuarie 2015

classic 100% 17 0.0KB/s 00:00


simple 100% 10 0.0KB/s 00:00
student@red:~$ ssh student@blue
Welcome to Ubuntu 12.04.3 LTS (GNU/Linux 3.2.0-53-generic-pae i686)
* Documentation: https://help.ubuntu.com/
Last login: Thu Sep 19 05:39:36 2013 from 3.3.3.1
student@blue:~$ ls -l examen/
total 12
drwxr-xr-x 3 student student 4096 Dec 23 22:55 test1
drwxr-xr-x 3 student student 4096 Dec 23 22:55 test2
drwxr-xr-x 3 student student 4096 Dec 23 22:55 test3

Subpunctul (c)
Pentru a crea tunelul SSH vom folosi comanda ssh cu optiunea -R:
root@green:~# ssh -R 3000:127.0.0.1:22 root@host
Welcome to Ubuntu 12.04.3 LTS (GNU/Linux 3.2.0-53-generic-pae i686)
[...]
Last login: Tue Dec 24 00:59:58 2013 from 192.168.2.2
root@host:~#
3000 reprezint
a portul remote (de pe host) pe care va asculta tunelul, 127.0.0.1:22 reprezinta
faptul c
a traficul de pe portul 3000 de pe host va fi redirectat pe stat, ia locala (green) pe portul 22
(serviciul SSH). Pentru a verifica faptul c
a s-a deschis portul 3000 pe host folosim comanda netstat:
root@host:~# netstat -tlnp | grep 3000
tcp 0 0 127.0.0.1:3000 0.0.0.0:* LISTEN 3060/17
Dac
a deschidem o conexiune SSH pe portul 3000 pe localhost vom fi redirectati catre stat, ia green:
root@host:~# ssh root@localhost -p 3000
Welcome to Ubuntu 12.04.3 LTS (GNU/Linux 3.2.0-53-generic-pae i686)
* Documentation: https://help.ubuntu.com/
Last login: Mon Dec 23 23:00:09 2013 from 127.0.0.1
root@green:~#

6.

Subpunctul (a)
Serviciul telnet ascult
a pe portul 23. Pentru a putea realiza DNAT-ul trebuie sa aflam adresa IP a
lui blue:
root@host:~# ping blue
PING blue (192.168.3.2) 56(84) bytes of data.
64 bytes from blue (192.168.3.2): icmp_req=1 ttl=64 time=0.062 ms
Pe stat, ia host execut
am urm
atoarea comanda iptables ce redirecteaza tot traficul ce vine pe portul
22000 al protocolului tcp pe portul 23 al stat, iei blue:
root@host:~# iptables -t nat -A PREROUTING -p tcp --dport 22000 -j DNAT --to-dest 192.168.3.2:23
Putem vizualiza tabela nat n care apare regula introdusa anterior:
root@host:~# iptables -t nat -nvL PREROUTING
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22000 to:192.168.3.2:23

Test Practic RL

Varianta sample1

ianuarie 2015

Pentru a testa vom intra pe stat, ia red s, i ne vom conecta la stat, ia host pe portul 22000:
root@red:~# telnet host 22000
Trying 192.168.1.1...
Connected to host.
Escape character is ^].
Ubuntu 12.04.3 LTS
blue login:
Observati c
a am ajuns direct pe stat, ia blue.

Subpunctul (b)
Politica cerut
a la acest subpunct seam
an
a cu politica anterioara, dar necesita o conditie suplimentara
legat
a de sursa pachetelor:
root@host:~# iptables -t nat -A PREROUTING -s red -p tcp --dport 4000 -j DNAT \
--to-dest 192.168.2.2:5000
Observati c
a am ad
augat conditia suplimentara -s red (tot ceea ce vine de la red) s, i am modificat
porturile cu cele cerute. Vizualiz
am configuratia realizata anterior:
root@host:~# iptables -t nat -nvL PREROUTING
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1 60 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22000 to:192.168.3.2:23
0 0 DNAT tcp -- * * 192.168.1.2 0.0.0.0/0 tcp dpt:4000 to:192.168.2.2:5000
Observat, i c
a la regula de la Subpunctul (a) exista pachete care au selectat regula (campul pkts
0). Portul 5000 nu e folosit de nici un serviciu. Cum putem testa corectitudinea configurat, iei?
Putem folosi utilitarul netcat pe care sa-l rulam pe green sa asculte pe portul 5000 emuland
comportomanetul unui server:
root@green:~# nc -l 5000 &
[1] 503
root@green:~# netstat -ntpl|grep 5000
tcp 0 0 0.0.0.0:5000 0.0.0.0:* LISTEN 503/nc
Observati c
a am verificat cu utilitarul netstat faptul ca portul 5000 a fost deschis de catre netstat.
De pe stat, ia red ne vom conecta la portul 4000 de pe stat, ia host:
root@red:~# netcat host 4000
test
Dac
a ne uit
am pe stat, ia green cuv
antul test a ajuns:
root@host:~# go green
Type <Ctrl+a q> to exit the console
test

Subpunctul (c)
URL-ul dat foloses, te protocolul HTTP, fiind adresa unui server WEB. Unul din utilitarele cu care
putem desc
arca din linia de comand
a fis, iere este wget. Ni se cere sa descarcam toate fis, ierele, nu
unul singur. In acest caz trebuie s
a folosim un parametrul special al wget, s, i anume -R (recursiv).
De pe green:

Test Practic RL

Varianta sample1

ianuarie 2015

root@green:~# wget -r "http://host/examen"


[...]
root@green:~# ls -l host/examen/
total 44
-rw-r--r-- 1 root root 1280 Dec 23 23:50 index.html?C=D;O=A
-rw-r--r-- 1 root root 1280 Dec 23 23:50 index.html?C=D;O=D
-rw-r--r-- 1 root root 1280 Dec 23 23:50 index.html?C=M;O=A
-rw-r--r-- 1 root root 1280 Dec 23 23:50 index.html?C=M;O=D
-rw-r--r-- 1 root root 1280 Dec 23 23:50 index.html?C=N;O=A
-rw-r--r-- 1 root root 1280 Dec 23 23:50 index.html?C=N;O=D
-rw-r--r-- 1 root root 1280 Dec 23 23:50 index.html?C=S;O=A
-rw-r--r-- 1 root root 1280 Dec 23 23:50 index.html?C=S;O=D
drwxr-xr-x 3 root root 4096 Dec 23 23:49 test5
drwxr-xr-x 3 root root 4096 Dec 23 23:49 test6
drwxr-xr-x 3 root root 4096 Dec 23 23:49 test7
Observat, i c
a s-a realizat desc
arcarea recursiva a tuturor fisierelor s, i directoarelor de la adaresa
indicat
a.
ATENT
a fie inclus
a ntre ghilimele, altfel bash poate interpreta unele caractere
, IE: Adresa trebuie s
speciale.

Test Practic RL

Varianta sample1

ianuarie 2015

S-ar putea să vă placă și