CubelaPetarandClaude Opus 5.5
91ed0b300c
- infra/pve: host facts, IP plan, one-time setup - infra/tofu/student-vms: 3 student VMs via tf-mod-pve v1.0.0 - infra/sandbox: template clones for throwaway test VMs - README/TODO: Windows DC/AD instead of FreeIPA, new network - .gitignore: only ignore secrets.auto.tfvars instead of all tfvars Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
106 lines
3.0 KiB
Markdown
106 lines
3.0 KiB
Markdown
|
|
# Learning Platform for Students
|
|
|
|
## init
|
|
|
|
Build a reliable platform on a pve host to teach students Linux/Windows server administration and accompanied other interesting topics such as
|
|
|
|
- firewalls and routing
|
|
- subnetting
|
|
- vlans
|
|
- installing a ms dc/ad
|
|
- join a Linux host to a ms ad
|
|
- powershell usage and scripting
|
|
- smb server setup and joining with ad
|
|
- databases (mariadb/mysql)
|
|
- web servers
|
|
- certificate management
|
|
- mail server
|
|
- security and network tools like nmap or tcpdump
|
|
- and other things
|
|
|
|
## User Management
|
|
|
|
A Windows Server DC/AD is the identity and DNS server of the lab. Each student gets an AD account and is in the group `linux_students` (further groups: `linux_admins`, `linux_users`). Student VMs join the domain.
|
|
|
|
Additional DCs and firewalls/routers are built by the students as exercises.
|
|
|
|
## Repo layout
|
|
|
|
- `exercises/`: exercise sheets
|
|
- `infra/pve/`: PVE host facts, IP plan, one-time setup
|
|
- `infra/tofu/<role>/`: one OpenTofu root module (and state) per role, e.g. `student-vms`
|
|
- `infra/sandbox/`: throwaway test VMs (template clones, no OpenTofu)
|
|
|
|
## Facts
|
|
|
|
**Domain:** `lab.softbox.net`
|
|
|
|
**Students:**
|
|
|
|
- username: `firstname.surname`
|
|
- mail: `firstname.surname@softbox.de`
|
|
- user_ssh_public_key: created in exercise sheet-00
|
|
- groups: `linux_students`
|
|
|
|
**VMs:**
|
|
|
|
- hostname: `vm-00` … `vm-20`
|
|
- IP addresses: `10.100.200.80-100` (see [infra/pve/README.md](infra/pve/README.md))
|
|
|
|
## Schedule
|
|
|
|
Time Slot: Friday 3p.m. to 4p.m.
|
|
|
|
1. Handout Sheets in this week at 4p.m.
|
|
2. Have a 30-60 mins class for the students to ask questions
|
|
3. Discuss sheets next week and handout begin at 1. handing out the new sheet
|
|
|
|
|
|
## Ideas for exercises
|
|
|
|
Separate by different levels of difficulty. In the beginning only easier concepts should be presented.
|
|
Write guide which can be followed in order to learn and see concepts such as a manual to install a nextcloud instance.
|
|
In the process the student would learn how a mariadb database is setup. Just following some simple commands.
|
|
|
|
### Level 0
|
|
|
|
- [ ] base commands - 20 most useful commands: cd, ls, mkdir, mv, rm , cp, touch, find, grep, cat, ssh
|
|
- [x] ssh key-exchange authentication
|
|
- [x] ssh hardening - not root login, no password hardening
|
|
- [x] nginx
|
|
- [ ] user and group management
|
|
|
|
### Level 1
|
|
|
|
- [x] fail2ban-server
|
|
- [ ] samba server
|
|
- [ ] couple samba share with ms ad
|
|
|
|
### Level 2
|
|
|
|
- [ ] git local and remote repo as github and internal gitea
|
|
- [ ] powershell: remote powershell and installation of ninja agent
|
|
|
|
### Level 3
|
|
|
|
- [ ] git server
|
|
- [ ] setup mysql/mariadb database
|
|
- [ ] nextcloud setup
|
|
|
|
### Level 4
|
|
|
|
- [ ] nmap
|
|
- [ ] ip and ipcalc - set ip addresses and routes
|
|
- [ ] ufw
|
|
|
|
### Level 5
|
|
|
|
- [ ] simple mail server Ports: 25 (smtp), 587 (submission), 143 (imap) (no tls first)
|
|
- [ ] tcpdump -> catch clear text passwd with tcpdump at imapsync
|
|
- [ ] pki for mutual tls trust
|
|
- [ ] build each their own firewall/router with openbsd
|
|
- [ ] build together an firewall which will be the sbx_lab firewall
|
|
|
|
|