CubelaPetarandClaude Opus 5.5
91ed0b300c
- infra/pve: host facts, IP plan, one-time setup - infra/tofu/student-vms: 3 student VMs via tf-mod-pve v1.0.0 - infra/sandbox: template clones for throwaway test VMs - README/TODO: Windows DC/AD instead of FreeIPA, new network - .gitignore: only ignore secrets.auto.tfvars instead of all tfvars Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
3.0 KiB
Learning Platform for Students
init
Build a reliable platform on a pve host to teach students Linux/Windows server administration and accompanied other interesting topics such as
- firewalls and routing
- subnetting
- vlans
- installing a ms dc/ad
- join a Linux host to a ms ad
- powershell usage and scripting
- smb server setup and joining with ad
- databases (mariadb/mysql)
- web servers
- certificate management
- mail server
- security and network tools like nmap or tcpdump
- and other things
User Management
A Windows Server DC/AD is the identity and DNS server of the lab. Each student gets an AD account and is in the group linux_students (further groups: linux_admins, linux_users). Student VMs join the domain.
Additional DCs and firewalls/routers are built by the students as exercises.
Repo layout
exercises/: exercise sheetsinfra/pve/: PVE host facts, IP plan, one-time setupinfra/tofu/<role>/: one OpenTofu root module (and state) per role, e.g.student-vmsinfra/sandbox/: throwaway test VMs (template clones, no OpenTofu)
Facts
Domain: lab.softbox.net
Students:
- username:
firstname.surname - mail:
firstname.surname@softbox.de - user_ssh_public_key: created in exercise sheet-00
- groups:
linux_students
VMs:
- hostname:
vm-00…vm-20 - IP addresses:
10.100.200.80-100(see infra/pve/README.md)
Schedule
Time Slot: Friday 3p.m. to 4p.m.
- Handout Sheets in this week at 4p.m.
- Have a 30-60 mins class for the students to ask questions
- Discuss sheets next week and handout begin at 1. handing out the new sheet
Ideas for exercises
Separate by different levels of difficulty. In the beginning only easier concepts should be presented. Write guide which can be followed in order to learn and see concepts such as a manual to install a nextcloud instance. In the process the student would learn how a mariadb database is setup. Just following some simple commands.
Level 0
- base commands - 20 most useful commands: cd, ls, mkdir, mv, rm , cp, touch, find, grep, cat, ssh
- ssh key-exchange authentication
- ssh hardening - not root login, no password hardening
- nginx
- user and group management
Level 1
- fail2ban-server
- samba server
- couple samba share with ms ad
Level 2
- git local and remote repo as github and internal gitea
- powershell: remote powershell and installation of ninja agent
Level 3
- git server
- setup mysql/mariadb database
- nextcloud setup
Level 4
- nmap
- ip and ipcalc - set ip addresses and routes
- ufw
Level 5
- simple mail server Ports: 25 (smtp), 587 (submission), 143 (imap) (no tls first)
- tcpdump -> catch clear text passwd with tcpdump at imapsync
- pki for mutual tls trust
- build each their own firewall/router with openbsd
- build together an firewall which will be the sbx_lab firewall