Network and System Administration

Job scheduling with Cron and Crontab

Cron is a time-based job scheduler daemon (crond) in Unix/Linux. It wakes up every minute, reads the schedule tables and runs any command whose time has come. It is used for backups, log rotation, report generation and system maintenance.

Crontab ("cron table") is the file that holds the schedule. Each user has a personal crontab, and the system has /etc/crontab and the directories /etc/cron.d, /etc/cron.hourly, /etc/cron.daily, /etc/cron.weekly and /etc/cron.monthly.

Entry format (five time fields followed by the command):

# m   h   dom  mon  dow   command
30   2   *    *    1-5   /usr/local/bin/backup.sh

Special characters: * (any value), , (list), - (range), / (step, e.g. */10 = every 10 minutes). Shortcuts such as @reboot, @daily, @hourly also exist.

Commands

• crontab -e edit the current user's crontab
• crontab -l list entries
• crontab -r remove the crontab
• crontab -u user -e edit another user's crontab (root)

Access is controlled by /etc/cron.allow and /etc/cron.deny. Output is mailed to the user unless redirected (> /var/log/job.log 2>&1).

Linux server installation (brief)

1. Planning: check hardware requirements, choose a distribution (Ubuntu Server, CentOS/RHEL, Debian) and the server's role.
2. Boot media: download the ISO, create a bootable USB/DVD, boot from it.
3. Language, keyboard and network: set the language, keyboard layout, hostname and IP (static for servers).
4. Disk partitioning: create /boot, / (root), /home, /var and swap, optionally using LVM or RAID.
5. Package selection: choose a minimal install and the needed roles (SSH, web, DB), to reduce the attack surface.
6. User setup: set the root password and create an administrative user.
7. Bootloader (GRUB): install and reboot.
8. Post-install: update packages (apt update && apt upgrade or yum update), configure the firewall, enable SSH, set the time with NTP and set up backups.

IP-based virtual hosting

Virtual hosting lets one physical web server host several websites. In IP-based virtual hosting each website is assigned its own unique IP address. The server looks at the destination IP address of the incoming connection to decide which site to serve. The server's network interface therefore has many IP addresses (multiple NICs or IP aliases on one NIC).

How it is carried out (Apache example)

1. Add several IP addresses to the server, e.g. as aliases:

ip addr add 192.168.1.101/24 dev eth0
ip addr add 192.168.1.102/24 dev eth0

2. Create a separate document root for each site: /var/www/site1, /var/www/site2.
3. Define one VirtualHost block per IP:

<VirtualHost 192.168.1.101:80>
    ServerName www.site1.com
    DocumentRoot /var/www/site1
</VirtualHost>

<VirtualHost 192.168.1.102:80>
    ServerName www.site2.com
    DocumentRoot /var/www/site2
</VirtualHost>

4. Point each domain's DNS A record to its own IP address.
5. Test the syntax (apachectl configtest) and restart the service.

Advantages

• Works with every client, including very old browsers that do not send the Host header.
• Each site can have its own SSL/TLS certificate on port 443 (classic SSL needed a dedicated IP).
• Sites are separated clearly at the network level, so firewall rules and logging can be applied per IP.
• Does not depend on the HTTP Host header, so it also works for non-HTTP protocols such as FTP.
• A site can easily be moved to another server by moving its IP address.

Its main disadvantage is that it uses many IP addresses, which are scarce (IPv4), so name-based hosting is preferred where possible.

Firewall

A firewall is a hardware or software security system placed between a trusted internal network and an untrusted network (such as the Internet). It monitors incoming and outgoing traffic and allows or blocks it according to a set of security rules.

Why a firewall is required

• It blocks unauthorized access and attacks (port scans, DoS, intrusion attempts) from outside.
• It enforces the organisation's security policy (which services, hosts and ports are allowed).
• It hides internal network structure (using NAT) and gives a single point of control.
• It logs and audits traffic, helping to detect suspicious activity.
• It restricts users' access to harmful sites and unwanted services, and can limit data leakage.

Packet-level vs application-level firewall

How CIDR improves address distribution

Classless Inter-Domain Routing (CIDR) removes the fixed class A/B/C boundaries of classful addressing. An address block is written as address/prefix-length, e.g. 192.168.8.0/21, and the prefix can be any length from 0 to 32.

Improvements in efficiency

1. Less address waste. In classful addressing an organisation needing 1000 hosts had to take a class B (65,534 hosts), wasting about 64,000 addresses. With CIDR it gets a /22 block (1022 hosts), matching its real need.
2. Flexible block sizes. Blocks are allocated in powers of two, so ISPs give each customer the right size.
3. Route aggregation (supernetting). Several contiguous networks are summarised into one routing entry. For example, 192.168.0.0/24 to 192.168.3.0/24 becomes 192.168.0.0/22. This shrinks routing tables and speeds lookup, saving router memory and bandwidth.
4. Slows IPv4 exhaustion by using the address space more fully.
5. Hierarchical allocation from registries to ISPs to customers keeps routing manageable.

Server monitoring and management

How it is carried out

• Resource monitoring: CPU, memory, swap, disk space and I/O, and network traffic are watched with commands such as top, htop, vmstat, iostat, df -h, free -m, netstat/ss.
• Service and process monitoring: checking that daemons (web, DNS, mail, DB) are running and responding, using systemctl status, ps, or port checks.
• Log analysis: reading /var/log/messages, syslog, auth.log, application logs; central logging with rsyslog; tools such as logwatch.
• Monitoring software: Nagios, Zabbix, Cacti, Prometheus/Grafana, MRTG use SNMP or agents to poll servers, draw graphs, store history and send alerts by e-mail or SMS when thresholds are crossed.
• Management tasks: user and permission management, patching and updates, backups, scheduled jobs (cron), remote administration through SSH, and configuration management tools (Ansible, Puppet).

Why it is carried out

• To detect failures early and keep the service available (high uptime).
• To maintain good performance and find bottlenecks.
• For capacity planning, using trend data to decide upgrades.
• To detect security incidents (failed logins, unusual traffic).
• To troubleshoot faster and meet SLA and audit requirements.

SMTP relay

SMTP (Simple Mail Transfer Protocol, port 25/587) is used to send mail between servers. SMTP relay is the process in which a mail server accepts a message that is not addressed to one of its own users/domains and forwards it onward to another mail server for delivery. A server that does this is a mail relay or Mail Transfer Agent (MTA).

How it works

1. A user's mail client (MUA) submits the message to the configured outgoing server (the SMTP relay / smarthost), usually on port 587 with authentication.
2. The relay server checks whether the sender is allowed to use it (authenticated user, trusted IP address or network).
3. The relay looks up the MX record of the recipient's domain through DNS to find the destination mail server.
4. It opens an SMTP connection to that server and transfers the message with commands HELO/EHLO, MAIL FROM, RCPT TO, DATA, QUIT.
5. If the destination is unreachable, the relay queues the message and retries for some time before returning a bounce message.

Open relay and security

A server that relays mail for anybody is an open relay and is abused by spammers. So relaying is restricted using SMTP authentication, mynetworks / IP-based access lists, and TLS. In Postfix, for example, smtpd_relay_restrictions and mynetworks control this.

FTP principles

File Transfer Protocol (FTP) is an application-layer protocol (RFC 959) for transferring files between a client and a server over TCP.

• Client-server model: the client initiates, the server (e.g. vsftpd, ProFTPD) answers.
• Two connections:
  • Control connection on TCP port 21 carries commands (USER, PASS, LIST, RETR, STOR) and replies (e.g. 220, 230, 226). It stays open for the whole session.
  • Data connection on port 20 (active mode) or a negotiated high port (passive mode) carries file contents and directory listings. It is opened for each transfer.
• Modes: in active mode the server connects back to the client; in passive mode the client makes both connections, which suits firewalls/NAT.
• Transfer types: ASCII and binary; modes stream, block, compressed.
• Authentication: username and password; data is sent in plain text (so SFTP/FTPS is preferred for security).

Anonymous FTP

Anonymous FTP lets the public download files without having an account. The user logs in with the username anonymous (or ftp) and gives an e-mail address as the password. The server maps this login to a restricted ftp user whose home is a chroot-ed directory (e.g. /var/ftp/pub), so the user cannot see the rest of the file system. Normally access is read-only (download only), upload is disabled or limited to an incoming directory, and permissions are tightly controlled. In vsftpd it is enabled with anonymous_enable=YES. It is used for distributing software, documents and public data.

Bandwidth management

Bandwidth management is the process of measuring, controlling and allocating the available network capacity so that important applications and users get adequate performance and the link is not exhausted by unimportant traffic.

Main techniques

• Traffic shaping / policing: limits the rate of certain traffic; shaping buffers excess packets, policing drops them.
• Quality of Service (QoS): classifies and prioritises traffic (voice, video and business applications over file sharing) using queuing methods such as priority queuing, WFQ and HTB (e.g. Linux tc).
• Rate limiting / quotas: per-user or per-IP speed limits and monthly data caps.
• Proxy caching: a Squid proxy serves repeated web content locally, saving external bandwidth.
• Content filtering / blocking: stops streaming, P2P and unwanted sites.
• Load balancing and link aggregation across several links.
• Monitoring and reporting: tools like MRTG, ntop, iftop and NetFlow show who uses what and help plan capacity.

Benefits: fair sharing among users, better performance for critical applications, lower cost and less congestion.

DNS zone transfer

A zone is the portion of the DNS namespace administered by one set of name servers, stored as a zone file of resource records. For reliability every zone has a primary (master) server holding the original copy and one or more secondary (slave) servers. Zone transfer is the process by which a secondary server copies the zone data from the primary so that all servers give the same answers.

How it works

1. The secondary periodically queries the primary's SOA record and compares the serial number.
2. When the primary's serial is higher (or the primary sends a NOTIFY message), the secondary requests the zone.
3. The transfer uses TCP port 53 with query type AXFR (full) or IXFR (incremental).

Example (BIND)

On the primary (192.168.1.10), named.conf:

zone "example.com" {
    type master;
    file "/var/named/example.com.zone";
    allow-transfer { 192.168.1.11; };
    also-notify   { 192.168.1.11; };
};

On the secondary (192.168.1.11):

zone "example.com" {
    type slave;
    file "slaves/example.com.zone";
    masters { 192.168.1.10; };
};

When the serial in the SOA changes from 2024010101 to 2024010102 on the primary, the secondary pulls the new zone. The test command is dig @192.168.1.10 example.com AXFR.

allow-transfer restricts who may obtain the zone, since an open transfer exposes the full list of hosts.

Common DHCP options

DHCP options carry extra configuration information from the server to clients along with the IP address. Three common ones:

1. Option 3, Router (default gateway)
2. Option 6, Domain Name Server (DNS servers)
3. Option 1, Subnet mask (others: Option 15 domain name, Option 51 lease time, Option 42 NTP servers)

Explanation of Option 6 (DNS servers)

Option 6 gives the client the IP addresses of one or more DNS servers, listed in order of preference. Without it the client could get an IP address but could not resolve names such as www.example.com. The server includes it in the DHCPOFFER and DHCPACK messages, and the client puts the addresses in its resolver configuration (e.g. /etc/resolv.conf). In ISC dhcpd it is set as:

option domain-name-servers 8.8.8.8, 192.168.1.1;

Changing the DNS servers for the whole network then needs only one change on the DHCP server.

SDN controller

In Software Defined Networking (SDN) the control plane is separated from the data (forwarding) plane. The SDN controller is the centralized software "brain" of the network that holds a global view of the topology and decides how traffic should flow.

Functions

• Maintains the network topology and state, discovers devices and links.
• Computes paths and installs flow rules (match-action entries) into the switches' flow tables.
• Communicates southbound with switches/routers using protocols such as OpenFlow (also NETCONF, P4Runtime), and northbound with applications through REST APIs.
• Provides services such as routing, load balancing, access control, QoS and monitoring.

Examples: OpenDaylight, ONOS, Ryu, Floodlight, POX.

Because the controller is programmable and centralized, network policy can be changed quickly in software without configuring each device separately.

(a) Multicast

Multicast is one-to-many (or many-to-many) communication in which a sender transmits a single copy of a packet to a group of interested receivers, and the network replicates it only where paths diverge. IPv4 uses class D addresses 224.0.0.0 to 239.255.255.255.

• Receivers join a group using IGMP (Internet Group Management Protocol); routers build distribution trees with protocols such as PIM (Protocol Independent Multicast).
• It uses UDP and saves bandwidth compared with sending separate unicast copies to each receiver.
• Uses: video conferencing, IPTV, stock quotes, software distribution, routing protocols (OSPF uses 224.0.0.5).

(b) IPv4

IPv4 is the fourth version of the Internet Protocol and the main addressing scheme of the Internet.

• Uses 32-bit addresses written in dotted decimal (e.g. 192.168.1.1), giving about $2^{32} \approx 4.3$ billion addresses.
• Address classes A to E and CIDR; private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
• The header is variable length (minimum 20 bytes) and contains version, header length, TTL, protocol, checksum, source and destination address.
• Supports unicast, broadcast and multicast; fragmentation can be done by routers.
• Address exhaustion is overcome using NAT, CIDR and the transition to IPv6.

Salient features of a Linux server

• Open source and free: no licence cost, the source code can be studied and modified.
• Stability and reliability: servers run for months or years without reboot.
• Security: a strong permission model, SELinux/AppArmor, built-in firewall (iptables/nftables), fast security patches.
• Multi-user and multitasking: many users and processes work at the same time.
• Performance and scalability: runs on small machines up to clusters and supercomputers with efficient resource use.
• Powerful command line and scripting: shell, cron and SSH allow remote administration and automation.
• Package management: apt, yum/dnf install and update software and dependencies.
• Wide software support: Apache, Nginx, MySQL, PostgreSQL, Samba, Postfix, BIND, Docker.
• Hardware flexibility and networking: many architectures, excellent TCP/IP stack, virtualization (KVM).
• Large community support and many distributions (Ubuntu, Debian, RHEL, CentOS).

Online server upgrade

An online upgrade updates the system over the network while the server remains in service, with only a short outage at the final reboot.

1. Backup data, configuration files (/etc) and databases; take a snapshot if virtual.
2. Check current state: release version, free disk space, repository configuration, held packages.
3. Refresh package lists and update current packages:
   • Debian/Ubuntu: apt update && apt upgrade && apt full-upgrade
   • RHEL/CentOS/Fedora: yum update or dnf upgrade
4. Change repositories to the new release (e.g. edit /etc/apt/sources.list, or use do-release-upgrade on Ubuntu, dnf system-upgrade download --releasever=N on Fedora/RHEL-based).
5. Download and install new packages; resolve configuration file conflicts (keep or replace the local config).
6. Reboot into the new kernel (reboot or dnf system-upgrade reboot).
7. Verify: check version (cat /etc/os-release), running services, logs and applications; clean unused packages (apt autoremove).
8. Rollback plan: restore the backup or snapshot if the upgrade fails.

Doing it in a maintenance window, and testing first on a staging machine, lowers the risk.

DNS principles

The Domain Name System translates human-readable domain names into IP addresses (and the reverse).

• Hierarchical namespace: an inverted tree with the root (.), top-level domains (.com, .np), second-level domains and subdomains. A fully qualified domain name reads leaf to root, e.g. www.tu.edu.np.
• Distributed database: data is split into zones, each managed by an authority, so no single server holds everything.
• Delegation: a zone administrator delegates subdomains to other name servers using NS records.
• Client-server model: resolvers (clients) send queries, name servers answer, mostly over UDP port 53 (TCP for large replies and zone transfers).
• Caching: answers are cached for a time set by the TTL, which reduces load and delay.
• Redundancy: each zone has at least a primary and a secondary server.
• Resolution types: recursive (the server does all the work for the client) and iterative (the server returns referrals).
• Resource records: A, AAAA, NS, MX, CNAME, PTR, SOA, TXT.

Types of DNS servers and their functions

• Root name servers: top of the hierarchy; know the addresses of the TLD servers and answer with referrals (13 root server identities, A to M).
• TLD servers: hold information about domains under a top-level domain such as .com or .np and refer to the authoritative servers.
• Authoritative servers: hold the actual zone data and give definitive answers for their domains.
  • Primary (master): keeps the original, editable zone file.
  • Secondary (slave): keeps a read-only copy obtained by zone transfer, for redundancy and load sharing.
• Recursive resolver / caching server: accepts queries from clients, performs the full lookup by querying root, TLD and authoritative servers, and caches the results (e.g. ISP resolver, 8.8.8.8).
• Forwarding server: forwards the queries it cannot answer to another DNS server instead of resolving them itself.

Name-based vs IP-based virtual hosting

Proxy ACL

An Access Control List (ACL) in a proxy server (such as Squid) is a named rule that classifies requests by some property, and is then used in http_access rules to allow or deny them. ACL types include source IP/network (src), destination domain (dstdomain), URL regular expressions (url_regex), port, protocol, time of day and user authentication.

Example (Squid):

acl lan src 192.168.1.0/24
acl blocked dstdomain .facebook.com .youtube.com
acl worktime time MTWHF 10:00-17:00

http_access deny blocked worktime
http_access allow lan
http_access deny all

Rules are checked from top to bottom and the first match decides; the final deny all is the default. Proxy ACLs control who can use the proxy, which sites are reachable, and when, which helps in security, bandwidth saving and policy enforcement.

Use of a firewall

A firewall sits between a trusted network and an untrusted one (the Internet) and permits or blocks traffic according to security rules. It is used to:

• block unauthorized access and attacks such as scans and DoS;
• enforce the organisation's policy on allowed hosts, ports and services;
• hide internal addresses through NAT;
• log and audit traffic.

Packet-level (packet-filtering) firewall

Works at the network and transport layers. It examines each packet's header (source and destination IP, port, protocol, TCP flags) against an ACL and accepts or drops it, without looking at the data. It is fast and simple (e.g. iptables, router ACLs), but cannot detect attacks hidden inside the payload and does not understand application commands. (Stateful versions also track connection state.)

Application-level (proxy) firewall

Works at the application layer. It acts as an intermediary: the client connects to the proxy, which checks the real content and application protocol (HTTP URLs, FTP commands, SMTP, user identity, viruses) and then opens a separate connection to the server. It gives much stronger and more detailed control and logging, and hides the internal client completely, but it is slower, more complex and needs a proxy for each protocol (e.g. Squid, application gateways).

VLSM vs CIDR

Benefits of VLSM

• Efficient use of IP addresses, since each subnet gets only the size it needs (e.g. /30 for a point-to-point link, /24 for a LAN).
• Less address waste than fixed-length subnetting.
• Allows route summarization and hierarchical design, which reduces routing table size.
• Greater flexibility in network design and growth.
• Better security and control by isolating subnets of different sizes.

Web server configuration

A web server (Apache httpd, Nginx) serves web pages over HTTP/HTTPS. Steps, using Apache on Linux:

1. Install: yum install httpd or apt install apache2.
2. Set the main configuration (/etc/httpd/conf/httpd.conf or /etc/apache2/apache2.conf):
   • Listen 80
   • ServerName www.example.com
   • DocumentRoot "/var/www/html"
   • DirectoryIndex index.html
3. Directory permissions:

<Directory "/var/www/html">
    Options -Indexes +FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

4. Virtual hosts (to host several sites): add a <VirtualHost *:80> block for each site with its own ServerName, DocumentRoot and log files.
5. HTTPS (optional): install a certificate and use SSLEngine on, SSLCertificateFile, SSLCertificateKeyFile on port 443.
6. Firewall: allow ports 80 and 443 (firewall-cmd --add-service=http --permanent).
7. DNS: create an A record for the site's name.
8. Test and start: apachectl configtest, then systemctl enable --now httpd.
9. Verify with a browser or curl http://localhost, and check the logs in /var/log/httpd/.

DNS zone transfer

Zone transfer is the process in which a secondary (slave) DNS server copies the zone file (all resource records of a zone) from the primary (master) server. It is carried out over TCP port 53 using the AXFR (full) or IXFR (incremental) query, when the SOA serial number on the primary is higher than the secondary's, or when the primary sends a NOTIFY message.

Why it is carried out

• Redundancy and fault tolerance: if the primary fails, the secondary still answers queries for the zone.
• Load sharing: queries are spread over several authoritative servers.
• Consistency: all authoritative servers hold the same, up-to-date data, so changes are made once at the primary and propagated automatically.
• Better performance and availability: secondaries may be located closer to users.
• Easy administration: only one master zone file needs to be edited.

Transfers should be limited to trusted secondaries with allow-transfer (or TSIG keys), because an open transfer reveals all host names of the domain.

DHCP troubleshooting

Typical symptom: clients get no IP address, get a 169.254.x.x (APIPA) address, or get a wrong configuration. Steps:

1. Check the client: verify the cable/Wi-Fi link, and renew the lease (ipconfig /release and /renew on Windows; dhclient -r; dhclient on Linux). A 169.254.x.x address shows that no DHCP server replied.
2. Check the DHCP service: confirm it is running (systemctl status dhcpd), and read the logs (/var/log/messages, journalctl -u dhcpd) for DISCOVER, OFFER, REQUEST and ACK messages and errors.
3. Check configuration: validate syntax (dhcpd -t), that the subnet and range match the server's interface, and that the server listens on the correct interface.
4. Address pool and leases: look at dhcpd.leases for pool exhaustion or too long lease time; remove stale leases or enlarge the scope; check reservations and duplicate addresses.
5. Network path: check VLANs and switch settings; for clients in another subnet, ensure a DHCP relay agent (ip helper-address) is set; check that firewall rules allow UDP ports 67 and 68.
6. Rogue DHCP servers: another device (e.g. a home router) answering clients; use DHCP snooping or capture traffic with Wireshark/tcpdump (tcpdump -i eth0 port 67 or port 68) to see which server replies.
7. Verify options: check that the gateway, DNS and subnet mask given are correct, then test connectivity with ping.

SDN controller

In Software Defined Networking the control plane is separated from the forwarding plane. The SDN controller is the central software component that has a global view of the network, decides how packets are forwarded, and programs the switches by installing flow entries. It talks to the switches through southbound interfaces (OpenFlow, NETCONF) and exposes northbound APIs (REST) to applications. Examples: OpenDaylight, ONOS, Ryu.

Benefits

• Centralized management and visibility of the whole network from one place.
• Programmability and automation: network behaviour is changed by software, not by configuring devices one by one.
• Faster deployment of new services and policies.
• Vendor independence through open standards, and use of cheaper commodity switches.
• Efficient resource use: dynamic traffic engineering, load balancing and better bandwidth use.
• Improved security: consistent policy enforcement and quick reaction to threats.
• Lower operating cost and reduced human error.

Cron vs Anacron

Example /etc/anacrontab line: 1 5 daily-backup /usr/local/bin/backup.sh (every 1 day, 5 minutes after start).

Purposes of anacron

• To make sure periodic jobs (backups, log rotation, logrotate, tmpwatch) are executed even when the computer was off at the scheduled time.
• To run jobs at intervals expressed in days rather than at exact clock times.
• It keeps a timestamp of the last run for each job in /var/spool/anacron, and to avoid overloading at startup it delays the jobs.
• It complements cron, which often calls anacron to run the daily/weekly/monthly jobs.

Open source network monitoring

Open source network monitoring means using freely available software, whose source code is open, to continuously watch the health, availability and performance of network devices, servers and services, and to send alerts when problems occur. It avoids licence costs, can be customised and has strong community support.

Typical functions: device and service availability checks (ping, TCP, HTTP), bandwidth and traffic graphs (via SNMP), CPU/memory/disk monitoring, threshold alerting by mail or SMS, reports and history for capacity planning.

Examples: Nagios, Zabbix, Cacti, MRTG, Prometheus with Grafana, LibreNMS, ntopng.

Example: Nagios

Nagios Core runs on Linux, and monitors hosts and services using plugins. A host and a service are defined like this:

define host {
    use        linux-server
    host_name  webserver1
    address    192.168.1.20
}
define service {
    use                  generic-service
    host_name            webserver1
    service_description  HTTP
    check_command        check_http
}

Nagios runs check_http periodically; if the web server does not respond, the status changes from OK to CRITICAL and an alert is sent to the administrator. Its web interface shows the current status of all hosts and services.

(a) CUPS

CUPS (Common Unix Printing System) is the standard open source printing system for Linux and Unix. It lets a computer act as a print server that accepts print jobs from clients, queues them and sends them to local or network printers.

• Uses the Internet Printing Protocol (IPP) on port 631.
• Has a web administration interface at http://localhost:631.
• Main configuration files are /etc/cups/cupsd.conf and /etc/cups/printers.conf; drivers are described by PPD files.
• Commands: lpadmin (add printers), lp and lpr (print), lpstat (status), cancel/lprm (remove jobs).
• Supports printer sharing, access control and many printer types.

(b) SMTP

Simple Mail Transfer Protocol (SMTP) is the application-layer protocol used to send and relay e-mail between mail clients and servers and between mail servers. It uses TCP, port 25 (server to server), 587 (submission, with authentication) or 465 (SMTPS).

• It is a push protocol: the sender pushes the message to the server.
• Basic commands: HELO/EHLO, MAIL FROM, RCPT TO, DATA, QUIT; replies are three-digit codes such as 250 (OK) and 550 (mailbox unavailable).
• The destination mail server is found from the domain's MX record.
• Receiving mail by the user is done with POP3 or IMAP. Common SMTP servers are Postfix, Sendmail and Exim.

Layers of the TCP/IP protocol suite (6 marks)

Data is encapsulated as it passes down: data, segment, packet, frame, bits.

IPv6 vs IPv4 (4 marks)

User, group and privilege management in Linux

Linux is multi-user, so every person or service has an account, belongs to groups and has permissions that decide what it may do. User data is kept in /etc/passwd (account details), /etc/shadow (encrypted passwords) and /etc/group (groups).

1. User management

useradd -m -s /bin/bash -G developers ram   # create user with home dir and shell
passwd ram                                   # set the password
usermod -aG sudo ram                         # add to a supplementary group
usermod -L ram        # lock account        usermod -U ram   # unlock
usermod -l newname ram                       # rename
userdel -r ram                               # delete user and home directory
id ram        whoami        who        last  # information about users
chage -M 90 ram                              # password aging (max 90 days)

2. Group management

groupadd developers                 # create a group
groupmod -n devs developers         # rename
gpasswd -a ram developers           # add a member
gpasswd -d ram developers           # remove a member
groupdel devs                       # delete
groups ram                          # list groups of a user

Each user has one primary group (in /etc/passwd) and any number of secondary groups.

3. Privilege (permission) management

File permissions are read (r=4), write (w=2) and execute (x=1) for the owner (u), group (g) and others (o).

ls -l file                 # -rw-r--r-- 1 ram developers ...
chmod 750 script.sh        # owner rwx, group r-x, others none
chmod g+w file             # symbolic form
chown ram:developers file  # change owner and group
chgrp developers file
umask 022                  # default permission mask

Special bits: SUID (chmod u+s), SGID (chmod g+s), sticky bit (chmod +t /tmp).

Administrative privileges:

• su - user switches user; sudo command runs a command as root if allowed.
• visudo edits /etc/sudoers, e.g. ram ALL=(ALL) /usr/bin/systemctl or %admin ALL=(ALL) ALL.
• setfacl -m u:ali:rw file and getfacl file give fine-grained ACLs.

Good practice: least privilege, no direct root login, strong password policy, and regular review of accounts.

DNS zone transfer (3 marks)

A zone transfer is the replication of the DNS zone data (resource records) from a primary (master) name server to secondary (slave) servers over TCP port 53. The secondary compares the SOA serial number with the primary's (or is told by a NOTIFY message) and requests the zone when it is out of date. It keeps all authoritative servers consistent and gives redundancy and load sharing.

AXFR vs IXFR (5 marks)

IXFR falls back to AXFR if the primary cannot supply the delta.

Importance of zone transfer security (2 marks)

A zone transfer returns every record in the zone. If anybody can request it, an attacker learns the complete list of host names, IP addresses, mail servers and internal structure, which helps in reconnaissance and targeted attacks. A forged or tampered transfer could also poison secondary servers. So transfers must be limited to authorized secondaries (allow-transfer { IP; }) and authenticated with TSIG keys, with a firewall limiting TCP 53 access.

CUPS (1 mark)

CUPS (Common Unix Printing System) is the open source printing system for Linux/Unix that manages print queues and lets a machine work as a print server using the Internet Printing Protocol (IPP, port 631).

Basic CUPS configuration (4 marks)

1. Install and start:

yum install cups        # or: apt install cups
systemctl enable --now cups

2. Main configuration file /etc/cups/cupsd.conf. To make the server reachable and share printers:

Listen 631
Browsing On
<Location />
    Order allow,deny
    Allow from 192.168.1.0/24
</Location>
<Location /admin>
    Order allow,deny
    Allow localhost
</Location>

3. Add a printer using the web interface at http://localhost:631 (Administration, Add Printer) or by command:

lpadmin -p office -E -v ipp://192.168.1.50/ipp/print -m everywhere
lpoptions -d office          # make it the default

4. Share and open the firewall: cupsctl --share-printers, allow 631/tcp or the ipp service.
5. Clients add the printer with ipp://server:631/printers/office.
6. Test and manage: lp -d office file.txt, lpstat -t, cancel jobid.

Printers are stored in /etc/cups/printers.conf, and logs are in /var/log/cups/.

Proxy caching server

A proxy caching server sits between clients and the Internet. Clients send web requests to it; it fetches the content from the origin server on their behalf, stores a copy in its cache, and serves later requests for the same object directly from the cache. Squid is the most common example.

Configuration (Squid)

1. Install: yum install squid or apt install squid.
2. Edit /etc/squid/squid.conf:

http_port 3128
cache_mem 256 MB
cache_dir ufs /var/spool/squid 5000 16 256
maximum_object_size 50 MB

acl lan src 192.168.1.0/24
acl blocked dstdomain .facebook.com
http_access deny blocked
http_access allow lan
http_access deny all

3. Open port 3128 in the firewall, initialise the cache (squid -z) and start: systemctl enable --now squid.
4. Point browsers at the proxy (host:3128), or use transparent proxying with an iptables redirect from port 80.
5. Check /var/log/squid/access.log for HIT/MISS results.

Benefits for performance and bandwidth management

• Saves bandwidth: repeated requests are answered from the cache, not over the WAN link.
• Faster response for users because local access is quicker than the Internet.
• Reduced load on the origin servers and the Internet link.
• Bandwidth control through ACLs, delay pools, limits and blocking of heavy sites.
• Security and monitoring: hides client addresses, filters content, and logs user access.

Firewall configuration to allow SSH, HTTP/HTTPS and a custom port

Using firewalld (RHEL/CentOS)

systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --permanent --add-port=8080/tcp      # custom port
firewall-cmd --reload
firewall-cmd --list-all                           # verify

Using iptables

# keep existing and loopback traffic
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# allow services
iptables -A INPUT -p tcp --dport 22   -j ACCEPT   # SSH
iptables -A INPUT -p tcp --dport 80   -j ACCEPT   # HTTP
iptables -A INPUT -p tcp --dport 443  -j ACCEPT   # HTTPS
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT   # custom port

# default policy: drop everything else
iptables -P INPUT DROP

service iptables save        # make rules persistent
iptables -L -n -v            # verify

Explanation: the rules are checked in order; the established-connection rule keeps replies to outgoing traffic working, each ACCEPT rule opens one port, and the default DROP policy blocks all unlisted traffic. The SSH rule should be added before setting the DROP policy so that the administrator is not locked out.

Inetd vs Xinetd

Both are super-servers: a single daemon listens on the ports of many network services (telnet, ftp, tftp, etc.) and starts the actual service program only when a connection arrives, saving memory and resources.

Example xinetd service file:

service telnet
{
    disable     = no
    socket_type = stream
    wait        = no
    user        = root
    server      = /usr/sbin/in.telnetd
    only_from   = 192.168.1.0/24
}

Communication between SDN controller and data plane (1 mark)

The controller communicates with the data plane devices (switches/routers) through the southbound interface, mainly the OpenFlow protocol (also NETCONF, OVSDB, P4Runtime). The secure channel is typically TLS over TCP (port 6653). Through it the controller installs, modifies and deletes flow entries in the switch flow tables, and receives events (packet-in messages, port status, statistics). When a switch gets a packet with no matching flow, it sends it to the controller, which decides and installs a rule so the following packets are forwarded at line rate.

SDN architecture (4 marks)

   +--------------------------------------------------+
   | Application Layer:  routing, firewall, load      |
   | balancer, monitoring, security apps              |
   +----------------------+---------------------------+
                          |  Northbound API (REST)
   +----------------------v---------------------------+
   | Control Layer:  SDN Controller                    |
   | (topology, path computation, policy, flow mgmt)  |
   +----------------------+---------------------------+
                          |  Southbound API (OpenFlow)
   +----------------------v---------------------------+
   | Infrastructure (Data) Layer:                      |
   | [Switch]--[Switch]--[Router]--[Switch]            |
   +--------------------------------------------------+

• Application layer: business and network applications that tell the controller what behaviour is wanted.
• Control layer: the logically centralized controller keeps a global network view and turns application requests into forwarding rules.
• Infrastructure layer: physical and virtual switches that only forward packets according to their flow tables.
• Northbound API links applications and controller; southbound API links controller and devices; an east-west interface connects multiple controllers.

The key idea is the separation of the control plane from the data plane, which makes the network programmable and centrally managed.

Network troubleshooting commands

A usual approach is bottom-up: check the cable and interface (ip link), the IP and gateway (ip addr, ip route), then connectivity (ping gateway, ping 8.8.8.8), then DNS (nslookup), and finally the application port.

DHCP (1 mark)

Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and related settings (subnet mask, default gateway, DNS servers, lease time) to clients from a pool, using UDP ports 67 (server) and 68 (client). The exchange is DORA: Discover, Offer, Request, Acknowledge.

Configuring a DHCP server (4 marks), ISC dhcpd on Linux

1. Install: yum install dhcp-server or apt install isc-dhcp-server.
2. Give the server a static IP (e.g. 192.168.1.1) and choose the listening interface (INTERFACESv4="eth0" in /etc/default/isc-dhcp-server).
3. Edit /etc/dhcp/dhcpd.conf:

default-lease-time 600;
max-lease-time 7200;
authoritative;

subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.100 192.168.1.200;
    option routers 192.168.1.1;
    option subnet-mask 255.255.255.0;
    option domain-name-servers 8.8.8.8, 192.168.1.1;
    option domain-name "example.com";
}

host printer1 {                       # fixed reservation
    hardware ethernet 00:11:22:33:44:55;
    fixed-address 192.168.1.50;
}

4. Open the firewall: firewall-cmd --permanent --add-service=dhcp && firewall-cmd --reload.
5. Start the service: systemctl enable --now dhcpd.
6. Test: set a client to obtain an address automatically, and check the leases in /var/lib/dhcpd/dhcpd.leases and the logs.

For other subnets a DHCP relay agent forwards requests to this server.

Roles of SMTP, POP3 and IMAP in e-mail

E-mail uses separate protocols for sending and for retrieving messages.

SMTP (Simple Mail Transfer Protocol)

• A push protocol used to send mail from the client to its mail server, and to relay it between mail servers until it reaches the recipient's server.
• Uses TCP port 25 (server to server), 587 (submission with authentication), 465 (SMTPS).
• It cannot be used by the user to read mail.

POP3 (Post Office Protocol v3)

• A pull protocol used by the client to download mail from the server mailbox (port 110, secure 995).
• Messages are normally downloaded and deleted from the server, so mail is stored on one device. It is simple and works offline, but is not suitable for access from many devices.

IMAP (Internet Message Access Protocol)

• Also used to retrieve mail (port 143, secure 993), but mail stays on the server and is synchronised across devices.
• Supports server-side folders, flags (read/unread), searching and partial download of messages.

Flow: sender's client, SMTP to sender's server, SMTP to recipient's server (found by the MX record), and then the recipient's client collects it with POP3 or IMAP.

(a) VLSM

Variable Length Subnet Masking (VLSM) allows a single network address block to be divided into subnets of different sizes, each with its own subnet mask, rather than using one mask for all subnets. It requires a classless routing protocol (RIPv2, OSPF, EIGRP).

Example: from 192.168.1.0/24, a LAN needing 100 hosts gets 192.168.1.0/25 (126 hosts), another needing 50 hosts gets 192.168.1.128/26 (62 hosts), and a point-to-point link gets 192.168.1.192/30 (2 hosts).

Benefits: efficient use of addresses, less waste, support for route summarization and flexible hierarchical design. Subnets are allocated from the largest requirement to the smallest to avoid overlap.

(b) ACL

An Access Control List (ACL) is an ordered list of permit/deny rules applied on a router, firewall or proxy interface to filter traffic according to criteria such as source/destination IP, protocol and port.

• Rules are checked top to bottom; the first match is used, and there is an implicit deny all at the end.
• Standard ACL filters by source address only; extended ACL filters by source, destination, protocol and port.
• Example (Cisco): access-list 101 permit tcp 192.168.1.0 0.0.0.255 any eq 80, applied with ip access-group 101 in.
• Uses: security, restricting access, traffic control and limiting what users can reach.