University of East London

School of Computer Science

MODULE CODE: CET262 MODULE TITLE: Virtualisation and Cloud Infrastructure

MODULE ASSESSOR: Ashley Williamson ASSESSMENT: 1 of 2

TITLE OF ASSESSMENT: Baremetal Configuration ASSESSMENT VALUE: 40%

PLEASE READ ALL INSTRUCTIONS AND INFORMATION CAREFULLY.

This assignment contributes 40% to your final module mark. Please ensure that you retain a duplicate of your assignment work as a safeguard of your work in the unlikely event of your work being lost or corrupted online.

THE FOLLOWING LEARNING OUTCOMES WILL BE ASSESSED:

[LO1] Analyse business requirements and appropriately configure a Linux system to meet operational demand.

[LO2] Demonstrate knowledge of Linux System administration in the context of a small to medium enterprise

IMPORTANT INFORMATION

You are required to submit your work within the bounds of the University Infringement of Assessment Regulations (see your Programme Guide). Plagiarism, paraphrasing and downloading large amounts of information from external sources, will not be tolerated and will be dealt with severely. The coursework submission for this module is largely based upon your own practice, but where you do use material from other sources, for example an occasional short quote, this should be duly referenced. It is important to note that your work WILL BE SUBJECT TO CHECKS FOR ORIGINALITY, which WILL include use of an electronic plagiarism detection service.

Where you are asked to submit an individual piece of work, the work must be entirely your own. The safety of your assessments is your responsibility. You must not permit another student access to your work at any time during the inception, design or development of your coursework submission and must take great care in this respect.

Where referencing is required, unless otherwise stated, the Harvard referencing system must be used (see your Programme Guide or university library website).

Submission Date and Time:

Detailed in CANVAS assignment area

Submission Location: Electronic submission to CANVAS assignment area

Assessment

Scenario & Task A Small Business, EcoGoods, has recently acquired compute resources on-premises which they wish to begin deployment of their website, product database, and any related services. Your role as systems administrator for this company is to configure an Arch Linux system to meet the requirements of the company laid out below in ‘requirements’. This machine should not have an GUI installed on it at any point, any and all configuration tasks must be completed from a CLI.

For the purposes of this assessment, you should create a single Virtual Machine with a 40GB vDisk split into multiple files, for the purposes of installing Arch Linux. This will act as your Baremetal server. For the specifications of this machine, ensure that you configure the VM to have at least 2GB of Memory (otherwise installation may fail). For CPU, this can be left at default values.

Requirements

1. Install the Arch Linux OS. In total you should have a 40GB Virtual Disk, as multiple files. Your system should have the following partition configuration:

1. /boot – 512M 2. /home – 14G 3. / – 25.5G (remaining)

2. Secure, with justification, the root user account 3. Setup administrative users for yourself and the IT Manager (Ashley) 4. Create User accounts where needed for the following persons:

1. Avery Wolfgang Stephenson – Technical Lead Developer, should have complete access to any and all folders under /srv/

2. Evelynn Hughes – Website developer who will need access to a folder (/srv/http) for the website files only. She will put files in there such as index.php, and any other website related files / folders. She will not require interacting via CLI.

3. James Hunter – Software Tester responsible for verifying that developed work conforms to company standards and works appropriately.

5. Set-up and correctly configure a SSH server for secure access, taking into account all user account requirements.

6. Store, and secure access to, a development project data directory (under /srv/) for developers to have access to. Developers should have full access to the development folders; however, the Software testers should not be able to change code, only check the code for code-style and whether the program/scripts runs appropriately.

7. Installation, configuration, and running of a docker containerisation environment. Only Technical Leads and System Administrators should have access to control Docker containers’ lifecycles. Note, Avery requires a database admin user.

1. MySQL – Not externally accessible. Only by other containers. 2. PhpMyAdmin – Accessible via Reverse Proxy on /phpmyadmin route. 3. NGinx accessible on Port 80. The Website will be hosted on the main ‘/’ route. Files for

this website should be placed in /srv/http on the host-machine. (Provided on Canvas)

Note: Your VM itself will NOT be inspected for awarding marks. Therefore, you should ensure that your documented progress sufficiently shows the steps taken. It is expected that when performing

configuration steps, that these are done optimally and with consideration of security of the system. E.g Appropriate use of root and non-root administrative users.

Deliverable A PDF report ( Approx 1500 words ) detailing the steps from the Virtual Machine creation, towards the goal of configuring to the above specification. You should provide clear and justified rationale for decisions made with reference back to the requirements provided. You should include steps taken to verify that changes implemented are working as intended. You may utilise additional software which is required to be installed via pacman; however, these must be justified and fit-for-purpose. Cover page, table of contents page, appendices, and references sections do not count towards the word limit. For evidentiary screenshots, it is recommended to place these as appendix items such as “Appendix Item A – Screenshots of VM Creation”. You would then reference these appropriately from within the main report text, e.g “A Virtual Machine was created (See Appendix Item A) …”

Submission Requirements You are required to submit your paper as a single PDF file via the Canvas submission portal.

Help with Referencing Whenever you need to refer the reader to the source of some information, e.g. a book/journal/academic paper/WWW address, provide a citation at that point within the main body of your report.

Example 1: … as we are all now aware referencing is not trivial (Kendal, 2017)

Provide a reference list towards the end of your research paper (after your conclusions section but before any appendices) that contains:

● References, a list of books/journals/academic papers/URLs etc. that have been directly cited from within the report (see example citation above).

● Any material from which text, diagrams or specific ideas have been used, even if this has been presented in your own words, must be cited within the main body of the paper and listed in the reference list. It is not enough to list this material in a bibliography.

Example 2: For Example 1, (using Harvard system) the reference list would contain the following:

Kendal S., 2017, Referencing standards, International Student Journal, Vol 55, Pages 25 – 30, Scotts Pub., ISBN 1-243567-89

This shows the authors, date published, title of paper (in single quotes), title of journal or conference (in italics), volume, page numbers, and publisher (ISBN desirable but not essential).

For further help see the following book which is available in the library:

● Cite Them Right: The Essential Guide to Referencing and Plagiarism by Richard Pears and Graham Shields

An interactive online version of this guide is available by logging into My Sunderland with your User ID and password and then clicking on Me and Library Resources.

Cover page

Table of contents

Proper headers

Screenshot references

Space for rationale, justification, verification

For reference:

1. Arch Linux Installation (on 40GB Virtual Disk): Steps for installation Arch Linux and disk Partition

Select iso and 40GB disk will create the VM:

After boot successful first verify the network connectivity:

Verify the internet connectivity:

Disk partition :

Using cfdisk, partition your disk as follows:

#lsblk

#cfdisk /dev/sda

Select Label Type:

Choose gpt for modern systems.

Create Partitions:

1. /boot – 512M

2. /home – 14G

3. / – 25.5G (remaining)

Write Changes: Confirm and write the partition table.

Format and Mount Partitions:

Format Partitions:

mkfs.ext4 /dev/sda1

mkfs.ext4 /dev/sda2

mkfs.ext4 /dev/sda3

Mount Partitions:

mount /dev/sda3 /mnt # Mount root

mkdir /mnt/{boot,home}

mount /dev/sda1 /mnt/boot # Mount boot

mount /dev/sda2 /mnt/home # Mount home

Then verify the disk :

#df –h

pacstrap /mnt base linux linux-firmware vim

genfstab -U /mnt >> /mnt/etc/fstab

arch-chroot /mnt

pacstrap /mnt base linux linux-firmware sudo networkmanager

After verifying then you have to set the root password

Passwd

<enter password>

2.Secure the Root Account: Set strong password:

Passwd

Disable root login via SSH: Edit file /etc/ssh/sshd_config:

PermitRootLogin no

3.Create Admin Users

Groupadd IT

useradd -m -G IT anil

useradd -m -G IT ashley

passwd anil

passwd ashley

Enable sudo:

visudo

IT ALL=(ALL:ALL) ALL

4.Create Users & Set Permissions

# Create users

useradd -m avery

useradd -m evelynn

useradd -m james

# Set passwords

passwd avery

passwd evelynn

passwd james

4. Folder Setup: mkdir -p /srv/{http,dev}

# Avery: Full access to /srv

chown -R avery:avery /srv

chmod -R 770 /srv

# Evelynn: Access to /srv/http

chown -R evelynn:evelynn /srv/http

chmod -R 750 /srv/http

# Developers group for shared dev directory

groupadd developers

usermod -aG developers avery

usermod -aG developers evelynn

chown -R avery:developers /srv/dev

chmod -R 770 /srv/dev

# James: Read-only to /srv/dev

groupadd testers

usermod -aG testers james

chmod -R 750 /srv/dev

5. Setup SSH Server pacman -S openssh

systemctl enable sshd

systemctl start sshd

SSH configuration setup :

Install the package:

pacman –Sy openssh

Start the services :

Systemctl start ssh

Systemctl enable ssh

Check the IP address :

ip a

Then connect through the remote :

Edit /etc/ssh/sshd_config:

PermitRootLogin no

PasswordAuthentication yes

AllowUsers anil ashley avery evelynn james

Restart SSH services:

systemctl restart sshd

6.Secure Dev Data Directory mkdir -p /srv/dev/project

chown -R avery:developers /srv/dev/project

chmod -R 770 /srv/dev/project

James (tester) will only have read access:

usermod -aG testers james

chmod -R 750 /srv/dev/project

7. Install Docker and Docker Compose genfstab -U /mnt >> /mnt/etc/fstab

arch-chroot /mnt

sudo pacman -S docker docker-compose

sudo systemctl enable docker –now

Give Access to Docker Only to Admins + Avery sudo groupadd docker

sudo usermod -aG docker anil # You

sudo usermod -aG docker ashley # IT Manager

sudo usermod -aG docker avery # Tech Lead

# Log out & log back in to apply group changes

Directory Setup sudo mkdir -p /srv/http # Website files

sudo mkdir -p /srv/docker/nginx # NGINX config

cd /srv/docker

Create docker-compose.yml vi docker-compose.yml

Paste this:

version: '3.8'

services:

mysql:

image: mysql:latest

container_name: mysql

restart: unless-stopped

environment:

MYSQL_ROOT_PASSWORD: StrongPass123!

networks:

– backend

expose:

– "3306" # Not exposed to host

phpmyadmin:

image: phpmyadmin

container_name: phpmyadmin

restart: unless-stopped

environment:

PMA_HOST: mysql

networks:

– backend

nginx:

image: nginx:alpine

container_name: nginx

restart: unless-stopped

ports:

– "80:80"

volumes:

– /srv/http:/usr/share/nginx/html

– ./nginx/default.conf:/etc/nginx/conf.d/default.conf

networks:

– backend

networks:

backend:

driver: bridge

Create NGINX Reverse Proxy Config

mkdir -p nginx

nano nginx/default.conf

Paste this:

server {

listen 80;

location / {

root /usr/share/nginx/html;

index index.html index.php;

}

location /phpmyadmin {

proxy_pass http://phpmyadmin:80;

proxy_set_header Host $host;

}

}

Start Everything

cd /srv/docker

docker compose up -d