Learning Platform for Students

init

Build a reliable platform on a pve host to teach students Linux/Windows server administration and accompanied other interesting topics such as

• firewalls and routing
• subnetting
• vlans
• installing a ms dc/ad
• join a Linux host to a ms ad
• powershell usage and scripting
• smb server setup and joining with ad
• databases (mariadb/mysql)
• web servers
• certificate management
• mail server
• security and network tools like nmap or tcpdump
• and other things

User Management

A Windows Server DC/AD is the identity and DNS server of the lab. Each student gets an AD account and is in the group linux_students (further groups: linux_admins, linux_users). Student VMs join the domain.

Additional DCs and firewalls/routers are built by the students as exercises.

Repo layout

• exercises/: exercise sheets
• infra/pve/: PVE host facts, IP plan, one-time setup
• infra/tofu/<role>/: one OpenTofu root module (and state) per role, e.g. student-vms
• infra/sandbox/: throwaway test VMs (template clones, no OpenTofu)

Facts

Domain: lab.softbox.net

Students:

• username: firstname.surname
• mail: firstname.surname@softbox.de
• user_ssh_public_key: created in exercise sheet-00
• groups: linux_students

VMs:

• hostname: vm-00 … vm-20
• IP addresses: 10.100.200.80-100 (see infra/pve/README.md)

Schedule

Time Slot: Friday 3p.m. to 4p.m.

1. Handout Sheets in this week at 4p.m.
2. Have a 30-60 mins class for the students to ask questions
3. Discuss sheets next week and handout begin at 1. handing out the new sheet

Ideas for exercises

Separate by different levels of difficulty. In the beginning only easier concepts should be presented. Write guide which can be followed in order to learn and see concepts such as a manual to install a nextcloud instance. In the process the student would learn how a mariadb database is setup. Just following some simple commands.

Level 0

• base commands - 20 most useful commands: cd, ls, mkdir, mv, rm , cp, touch, find, grep, cat, ssh
• ssh key-exchange authentication
• ssh hardening - not root login, no password hardening
• nginx
• user and group management

Level 1

• fail2ban-server
• samba server
• couple samba share with ms ad

Level 2

• git local and remote repo as github and internal gitea
• powershell: remote powershell and installation of ninja agent

Level 3

• git server
• setup mysql/mariadb database
• nextcloud setup

Level 4

• nmap
• ip and ipcalc - set ip addresses and routes
• ufw

Level 5

• simple mail server Ports: 25 (smtp), 587 (submission), 143 (imap) (no tls first)
• tcpdump -> catch clear text passwd with tcpdump at imapsync
• pki for mutual tls trust
• build each their own firewall/router with openbsd
• build together an firewall which will be the sbx_lab firewall