Lab 06: Linux Remote Service

Goals

• Gain experiences with Linux terminal manipulation: You will learn how to manipulate Linux terminal settings such as turning off echo for command-line input.
• Practice more with server and client programming: You will write another set of server/client programs. The pair will allow a user to remotely log unto a server that is running the server program you are to write in this lab.

Credits

The work is based on labs and exercises from previous offerings of CSCI 363.

Introduction

In this lab you will create a pair of programs that mimic the behavior of Linux login server and client. You will be given a set of source programs as a starting point. One of the programs, login.c asks the user to enter a user name and a corresponding password. The program checks the validity of the user name and password against a given database. If the user name and password matches properly, the program starts a user shell with which the user can do any Linux work. The other two programs are a pair of remote login client and server rshClient.c and rshd.c, some of the functions are implemented in a separate file called rsh.c. This set of programs allow a user to remote log into a server without any authentication. Your task is to try these programs first, then read the programs to understand the process. Finally you will revise the programs such that the remote login server will ask for user name and password for authentication. Only the users with proper credentials can log onto the remote server.

Exercises before Programming

You first do the following to gain some first-hand experiences.

• Copy all files from the directory ~cs363/Spring16/student/labs/lab06/ into your lab06 directory.
• Compile all source code by using make. A number of executables will be generated. The program mlogin allows a user to enter a user name and a password to use a shell on a local Linux system. The program rshd is a server program that allows a user to get into a remote system without password. The program loginClient is a client program that will connect to a host that is running rshd. The program mypasswd is a program that allows you to create a password for an existing system user. You also should see two text files called passwd and shadow which is a faked password file and a faked shadow file. The use of these files will become clear as we move on the lab exercises.
• Create an account for yourself by adding a line similar to any lines in the passwd file using a text editor. Read manual page passwd in Section 5 by typing man -s 5 passwd if you are not sure how the file is structured. You then set a password for the account you just added to the passwd file by the command

  host% ./mypasswd user
  

  where user is a user name that is in the passwd file. The program will ask you for a password. Note that this is a faked password. Don't enter your real password. This faked password is stored in a shadow file in your current directory.
• Run mlogin which emulates the behavior of Linux login program. When asked for user name and password, give the user name and password you just created moments ago.
• Run rshd which is a remote shell program, then run rshClient which is a client program that connects to the rshd. If you run rshd on a remote computer, the rshClient will allow you to get into that computer.

Some Background Information

We describe some basic ideas here. There are three major components in this set of programs.

• Client-server: The behavior of this set of programs is very similar to any real Linux ssh. The only difference is that this set of programs does not use SSL, or Secured Socket Layer. (In a lab later in the semester, we'll exercise with the option of SSL.) The pair is still a set of client-server programs. The server waits on a specific port, the client connects to it and receives the service.
• The server rshd waits on a particular port for clients to connect. Once it receives and accepts a connection request, it spawns a child either using a thread, or forking a new process to service the client.
• Redirect input and output devices: Before starting the shell service, the server (rshd) has to redirect the input and output to the communication channel established with the client. This is done by first closing the standard input, standard output and standard error devices, then reassigning these device numbers (0, 1, and 2) to the socket connection number of the client. The dup system call is used to duplicate the socket with the stdin, stdout, and stderr devices.
• Once redirecting input/output devices is completed, all input (commands) from the client is sent to the shell and all shell output will be re-directed to the client through the socket connection that was established between the client and the server.
• The client simply reads the input from the keyboard, sends it to the server, and prints the response from the server to the screen.
• Check the user name and password: This is done through the faked system calls to getpwnam() and getspnam(). We created a pair of faked system calls because on our Linux systems, we no longer use the passwd and shadow files to check user credentials. But the essential concepts are the same. Read manual pages on getpwnam() and getspnam() to gain some basic understanding of this concept.
• In the last set of exercises in this lab, you will use the VM you created earlier to run this pair of programs with real user name and password you created for your VM.

Your Work

You will develop a set of remote login service program using the two existing pairs of programs. You should have a client program that will take the user name and password on the local machine. The client program then sends the pair of user name and password to the remote machine (server). The remote login service should check the validity of the user name and password combination. If the user is valid, the program provides a shell service to the remote client. If the user is invalid, the program simply ignores the request and prompt the user for next trial if so chose by the user, just like any Linux systems would do. The user credential files passwd and shadow reside on the server side.

Your first task is to revise the server (rshd.c and rsh.c) and client (rshClient.c) such that your client program and the server program can run on two different Linux computers with user name and password checking. You will have to add the part of the logic in login.c that reads user name and password into rshClient.c at proper place. You also need to add the part of the logic in login.c that check the user name and password to the server rshd.c and rsh.c at proper place.

Note that at this point the user name and password sent to the remote server are in plain text. So the service is not secure. In order to make a secure service, we need to use Secure Sockets Layer or SSL protocol, which we will explore later in the semester.

After you make the programs work properly on our local Linux machines, you are asked to revise the programs to run the server program on your VM so the program can access a set of user names and passwords on the VM. You have to complete two separate sets of tasks to make the programs work.

First, you need to change the firewall set-ups on the VM side such that the server program can run on the VM at a particular port.

• Log into your VM as the root.
• Create a few faked user with user name and password of your choice. Do not use any real user name or real password.
• First use the command useradd user-id to add a new user. For example, useradd jdoe.
• Then set the password for this newly created user using the command passwd. For example, passwd jdoe.
• Once a user is created, you will be able to, as a root user, see the user entries in /etc/passwd and /etc/shadow. Please compare these two files with the ones you used in the first set of exercises in this lab.
• The next task is to disable the firewall and open up some ports at which your rshd can run. This is accomplished by the following steps.
• To disable and stop the firewall you'd run:

  chkconfig iptables off
  service iptables stop
  

• To open a port, add a line of text (command) like

  -A INPUT -p tcp -m multiport --dports 8000 -m comment --comment "700 allow port 8000" -j ACCEPT
  

  in the file /etc/sysconfig/iptables after the --dport 22 line. The number "8000" is a sample port number. Please make sure use a port number that you feel comfortable. (Don't just use the one given as the example above.)
• Execute the following command to take effect of the change.

  service iptables reload
  

Next you need to revise the rshd program so it will use the real getspnam() function in the Linux system. Notice that in your current program, the function getspnam() is custom developed to mimic the behavior of the system function with the same name. The reason for doing so is that your program usually runs from user space that doesn't have the privilege of reading user information. But when running on your VM as the root user, the program has access to these real data. Thus you can use real system calls to access these information. The following is what you need to do.

• In your lab06 directory of the local Linux computer, create a sub-directory, call it native. Then copy all programs in lab06 into the newly created subdirectory.
• Using one of your terminal windows to log into your VM as the root user, create a directory, calling it something like cs363-lab06.
• Go into the native directory and send all files to your VM by using sftp on your Linux computer. For example

  sftp mynode-123-4
  cd cs363-lab06
  mput *
  

• Note: from now on, you will revise the server program on the VM side. You will be asked to submit that set of programs independent of what you have on the Linux side.
• On your VM, modify your Makefile so that the rshd program does not depend on the custom-made shadow.o and pwd.o.
• The given rshd.c program doesn't require user name and password. You need to revise this program such that it will check the user name and password before allowing any user to log into the system, using the components in login.c. That is, you need to introduce the user name and password check in your rshd.c.
• On your VM, make the following revision in the rshd.c program.
  • Change the TCP port number to the port you opened up for the VM in the above VM set-up steps.
  • In the function where your server checks for the user name and password, change the include file from the user-defined one to system-defined. That is, from

    #include "shadow.h"
    

    to

    #include <shadow.h>
    

  • Delete or comment out the line with

    extern struct spwd *getspnam();
    

    because now you will be using the function provided by the system.
  • On your Linux side, in the native directory, change your rshClient.c such that it uses the same port number as your server program rshd.c on the VM machine.

Now you should be able to compile the program by simply doing a make. Fix any errors you might have. Then run rshd on the VM.

With the server (rshd) running on the VM, you can compile and run your client on any other Linux computers and the pair of programs should allow you to log into the VM from local Linux machine, and work in a way similar to ssh.

When all is working well on the VM side, please copy all program files, including the Makefile back to your Linux side. Put them in the subdirectory native. You are asked to submit this set of files as well.

What to submit

You are asked to commit and push all program files in your lab06 and its subdirectory native.

In addition, create an answer.txt file. Include four sets of screen outputs, using copy-and-paste, or script. Please label these output files with the following number with a proper title.

1. Screen output of compiling the programs on the Linux side with make.
2. Screen output of compiling the programs on the VM side with make.
3. Screen output of running the client with the server running on a Linux machine.
4. Screen output of running the client with the server running on your VM.

Congratulations! You just finished this lab.