CIA Lab 1 Assignment: Booting 1

###### tags: `finished` :::success # CIA Lab 1 Assignment: Booting 1 ::: ## Task 1 - PXE Installation :::info Create the first virtual machine using VirtualBox and isolate a private network on your workstation: do not pollute our shared network with your own DHCP service. There are several network settings offered by VirtualBox, choose the right one accordingly and install your PXE server there. ::: Let's start by creating a virtual machine that will act as a server. I chose Ubuntu 20.04 as the distribution package. The internal network ^1^ is chosen as the connection type for the second network adapter, because it is more secure than a bridged network, in which all traffic goes through the physical interface of the host and can be intercepted. :::spoiler * system name: Ubuntu 20.04 (64-bit) * memory: 2 gb * network adapter 1: enable NAT * network adapter 2: enable Internal Network all other settings are default ::: ### Task 1.1 - DHCP Installation First of all check connections and addresses. As a DHCP server will used interface enp0s8 of second network adapter. <center> ![](https://i.imgur.com/IFADt1s.png) Picture 1 - Interface and subnet future DHCP-server </center> For install DHCP-srever use following command: ``` sudo apt-get install isc-dhcp-server ``` After need to change parameters in two configuration files in ```isc-dhcp-server``` (the interface name) and in```dhcp.conf``` (network parameters): ``` sudo vim /etc/default/isc-dhcp-server ``` <center> ![](https://i.imgur.com/ishxm8W.png) Picture 2 – A result of changing interface </center> I think that it is not necessary to make changes to the domain names and addresses, because this will not affect the configuration functionality. So I left everything defaulted. ``` sudo vim /etc/dhcp/dhcpd.conf ``` <center> ![](https://i.imgur.com/WBeS63C.png) Picture 2 - Network configuration for DHCP-server </center> After that restart server and display its status: ``` sudo systemctl restart isc-dhcp-server sudo systemctl status isc-dhcp-server ``` <center> ![](https://i.imgur.com/Hg9lQ4v.png) Picture 3 - Result </center> :::info Question: why not run your DHCP service on the SNE network directly? ::: I think this is necessary in order to avoid a conflict between two DHCP servers in the one subnet and so that the client-server responds only to broadcast requests from one server. ### Task 1.2 - TFTP Installation We also need to install the packages of TFTP service for this server: ``` sudo apt install tftpd-hpa ``` And after that change configuration file: ``` sudo nano /etc/default/tftpd-hpa ``` <center> ![](https://i.imgur.com/QlacQob.png) Picture 4 - New parameters for better compatibility </center> <center> ![](https://i.imgur.com/0AiwbCg.png) Picture 5 - Current status of the TFTP server </center> ### Task 1.3 - PXE Installation Now we need to download and unpack what the PXE menu will consist of: the bootloader (Syslinux-5.01) and modules. And after find memdisk, pxelinux.0 and others modules comboot. ``` wget https://mirrors.edge.kernel.org/pub/linux/utils/boot/syslinux/syslinux-5.01.zip unzip syslinux-5.01.zip find ./ -name "memdisk" -type f|xargs -I {} sudo cp '{}' /srv/tftp/ find ./ -name "pxelinux.0"|xargs -I {} sudo cp '{}' /srv/tftp/ find ./ -name "*.c32"|xargs -I {} sudo cp '{}' /srv/tftp/ ``` Then create a directory pxelinux.cfg and in it create a default configuration file with this configurations: ``` UI vesamenu.c32 PROMPT 0 MENU TITLE PXE Server MENU BACKGROUND bg.png LABEL bootlocal menu label Boot from HDD kernel chain.c32 append hd0 0 timeout 0 TEXT HELP Boot from first HDD in your system ENDTEXT LABEL grml menu label GRML Linux KERNEL grml/boot/grml32full/vmlinuz APPEND root=/dev/nfs rw nfsroot=10.5.5.1:/srv/tftp/grml/ live-media-path=/live/grml32-full boot=live lang=us nomce apm=power-off noprompt noeject initrd=grml/boot/grml32full/initrd.img vga=791 LABEL reboot menu label Reboot kernel reboot.c32 TEXT HELP Reboot server ENDTEXT ``` Since my virtual machine doesn't have a lot of resources, I decided to send most of the files to the client via the NFS server. GRML (32-bit) I used it as an example, because this system is familiar to me and it does not require installation on a hard disk. But anyway, the iso is quite large, compared to the same MS-DOS, so I pulled out only the necessary "parts" as a kernel and a live-filesystem. The client will receive them via the TFTP server. For the first - download ISO: ``` wget https://download.grml.org/grml32-full_2020.06.iso #rename for comfort mv grml32-full_2020.06.iso grml.iso #create a separate directory to stop the mess sudo mkdir /srv/tftp/iso #also create a separate directory for temporary mount point sudo mkdir /tmp/iso ``` In parallel with downloading the iso, I installed an NFS server: ``` sudo apt install nfs-kernel-server ``` <center> ![](https://i.imgur.com/iH3peW3.png) Picture 6 - NFS server status </center> Now I downloaded the ISO, and then it was mounted in the */tmp/iso* folder. After that, we copy all the contents of the folder to the additional directory */srv/tftp/grml*, from where the NFS server will be able to share its contents with all the IP addresses of my subnet. It is also necessary to eliminate the problem of access rights, so I changed the owner and assigned the rights. <center> ![](https://i.imgur.com/FiIH918.png) Picture 7 - Mount and copy ISO ![](https://i.imgur.com/epaXn4l.png) Picture 8 - Providing a directory for any address from the subnet </center> After updating the list `sudo exportfs -a` and restarting NFS server. Now we can start the client machine. <center> ![](https://i.imgur.com/Fhzpxsh.png) Picture 9 - PXE menu and download via TFTP ![](https://i.imgur.com/m2IVvkg.png) Picture 10 - Best result! </center> ## Task 2 - Questions to answer ### Question 1 ::: info a. What is UEFI PXE booting? b. How does it work? ::: **a.** This is a modern standard of fimware for downloading over the network using PXE environment. UEFI has many advantages over the BIOS, and at the same time is the heir to most of its features. I consider it necessary to specify such advantages as support for a graphical environment, supports drives with a very large amount of memory, Secure Boot and GUID partition table. **b.** If I understand correctly, now we are talking about the loader. In my laboratory work, I used the PXE environment to download an image of the GRML operating system to the client's computer. In order for the client to be able to download, I wrote the pxelinux.cfg file, which is a PXE menu. And pxelinux. 0 is the legacy BIOS in simple words. Thus, I want to say that I did not use the UEFI standard in my work. This means that the principle of operation of UEFI PXE is most likely based on the fact that the client gets access through the DHCP server to a bootloader that supports the UEFI standard, for example, GRUB2 (as shown in the example [[5](https://wiki.ubuntu.com/UEFI/PXE-netboot-install)]). ### Question 2 ::: info a. What is a GPT? b. What is its layout? Explain each element. c. What is the role of a partition table? ::: **a.** GPT (GUID Partition Table) is a standard that defines the creation of partition tables. It is synonymous with MBR (BIOS), but differs in a large number of partitions (GPT supports creating 128 partitions, and BIOS - 4), the disk size (MBR supports disks up to 2TB, while GPT supports up to 9.4 Zettabytes) and GPT differs in the boot order. UEFI reads the GPT, finds all efi-type partitions in the table (they contain boot loaders), and loads them into memory. **b.** Answer in the table: | <center>Logical blocks</center>|<center>Name</center>|<center>Description</center>| | ---------- | -------- | -------- | |LBA 0|Protective MBR| it is used as the very first boot sector on the hard disk, it is necessary to protect and solve the compatibility problem with old MBR-oriented programs. When the computer is working with UEFI, this sector is ignored and not executed.| |LBA 1|Primary GPT Header|This header sector contains data about all the LBA addresses used for partitioning the disk. The UEFI system uses the CRC32 algorithm to calculate the checksum to check whether the header is correct. The damaged header can be restored from the copy, and the damaged copy can be updated through the original header. If both the header and the copy are damaged, the disk will stop working.| |LBA 2|Disk partition table| This is the partition table itself, which contains the partition records, there can be 128 of them. The partition records consist of the type GUID, the GUID unique for the partition, the first and last LBAs, the partition attributes in the form of a bit mask and the partition name (36 characters).| |LBA 34|Contents of disk partitions| This is the content itself, which is stored in the disk partitions. For example, in my old laptop, the hard disk was divided into two partitions "disk C:" and "disk:"E", and there was a BIOS on it and, therefore, it could only have 4 partitions. | |LBA -2|A copy of the disk partition table| just a copy of the partition table | |LBA -34|A copy of the GPT header| just a copy of GPT header | **с.** I think that the main role of the partition table is to mark up the hard disk into sections into which the system can write this or that information. For a user, for example, this can be implemented as logical disks (the example I gave in the table above) to separate system files and user files, or to place different operating systems on the same disk. ### Question 3 :::info a. What is gdisk? b. How does it work? c. What can you do with it? ::: **a.** Gdisk is a text-mode partitioning table tool and it works on GUID GPT. **b.** Gdisk is installed as a regular Linux application via the ``sudo apt-get install``. At startup, the application will determine the type of partition used on the disk. If it finds GPT, it will work with them. In the case of MBR or BSD, it will try to overwrite the data to the GPT format. In general, fdisk works with headers and partition tables, but it can also update the protective MBR. Gdisk is very similar to fdisk, but gdisk was created to work with GPS to replace Parted. Below you can see an example of how the ``sudo fdisk -l /dev/sda`` command works to output the disk partitions of sda disks in my virtual machine. Here you can see that the device's memory capacity is 40 GB, the bootloader partition and its FAT32 type, the extended partition (contains multiple logical partitions and it is used to store data) and the operating system partition are also displayed in the table. <center> ![](https://i.imgur.com/p24sp8d.png) Picture 11 - An example of my system </center> **c.** As with any other application for editing hard disk or SSD partition tables, you can use fdisk to partition disks into partitions, creating new partition tables. You can generate a new security MBR in it. Basically, fdisk works with disk device files, but it can also work with disk image files. I found a good description of the work of gdisk and I have nothing to add to it. [[6](http://www.rodsbooks.com/gdisk/gdisk.html)] ### Question 4 :::info a. What is a Protective MBR and why is it in the GPT? ::: **a.** Protective MBR (LBA 0) got GPT from MBR, it is located in the first sector of the hard disk and is a section with executable code that manages the further boot of the system. And this is present in GPT for compatibility with old software, including to protect the GPT structure from incorrect operation of these outdated programs that do not know about the existence of GPT. For them, the entire partition structure will be represented as a single partition that takes up all the space on the hard disk. ## Task 3 - Partitions Boot into Ubuntu and use the dd utility to dump the Protective MBR and GPT into a file in your home directory. Use a hex dump utility to look at the raw data in the file. :::info 1. Copy and dump the Protective MBR and GPT in hex format (do not forget to submit them also in your moodle account submission entry) and fully annotate the entries in the report. This means you must describe the purpose of every field, and translate all fields that have a numerical value into human-readable, decimal format. ::: <center> ![](https://i.imgur.com/GokS5oI.png) Picture 12 - Home directory with mbr_backup </center> I highlighted the beginning of the partition table in pink (the first partition entry), it starts with the bootable flag (0x80), includes an entry about the type of partition, coordinates of the beginning and end of the section in CHS format, LBA of first sector in the partition (because system has more memory then 7,8 Gb) and number of sectors in partition. And as you can see the partition with the W95 FAT32 occupies only 512 MB, so LBA addressing is not used. But if you look at the entry of the second partition in which the Extended system is located, then it has a LBA of first sector in the partition, because its weight is 39,5 GB. <center> ![](https://i.imgur.com/AgbPKbu.png) Picture 13 - MBR in hex format </center> :::info (a) At what byte index from the start of the disk do the real partition table entries start? (b) At what byte index would the partition table start if your server had a so-called “4K native” (4Kn) disk? ::: **(a)** 0x1BE there is a bootable flag of the first partition. **(b)** Well, since my system does not use 4kn and GPT, after many hours of studying the information, I did not have a clear answer to this question. I found out that there is still a compatibility problem between 512 byte sectors and 4kn disks that use 4kb sectors. To solve it, emulators and alignment methods are used. I can assume that the beginning and end of the sector for a 4kn disk will be calculated as follows: ``` echo -n 'Begin '; echo "2048 / 8" | bc Begin 256 echo -n 'End '; echo "(1050623 + 1) / 8 - 1" | bc End 131327 ``` But maybe I'm complicating everything, and I didn't need to convert the 512 byte system to 4k. In this case, the partition table starts with 0x03Fh=LBA (63) now LBA(2048), this is done in order to ensure greater compatibility with 4k disks. :::info 2. If you wanted to add a 8 GiB FreeBSD ZFS partition, called ØS3 (U+00D8U+015A U+0033) to the table by hand, what values would you have to use for the entry (including the name) in the raw table on disk? Assume the disk is large enough to hold the extra partition after which you already described. ::: Okey, I will try to use my own sfdisk script file: ``` label: dos label-id: 0x07871d04 device: /dev/sda unit: sectors /dev/sda1 : start= 2048, size= 1048576, type=b, bootable /dev/sda2 : start= 1052670, size= 82831362, type=5 /dev/sda5 : start= 1052672, size= 82831360, type=83 the new one partition will be /dev/sda3 : start= 1052674, size= 18014399*, type=a5** * I'm not sure, but let me explain my mind: we have 8GiB = 9223372036 bytes of memory and we have information, that 1 sector contains 512 bytes in this case 9223372036/512 = 18014399 sectors (size) ** from the list of known partitation type ``` <center> ![](https://i.imgur.com/FlpJnR2.png) Picture 14 - List of known partitation type </center> But if we will talk about GPT and about file system ZNS, which I missed, I think it will be looks like that: ``` Partition type GUID: 516E7CBA-6ECF-11D6-8FF8-00022D09712B Unique partition GUID: (?) Starting LBA: 34 (1/1/4) Ending LBA: Attribute flags: 0 Partition name= U+00D8U+015AU+0033 ``` :::info 3. Name two differences between primary and logical partitions in an MBR partitioning scheme. ::: 1. The number of partitions. MBR has just 4 numbers for primary partitions and unlimited numbers of logical partitions. 2. Primary partitions are bootable, logical - no. ## References: 1. [Virtual Networking: 6.6. Internal Networking](https://www.virtualbox.org/manual/ch06.html) 2. [Habr.com - article about PXE-server installation on a Raspberry Pi (ru)](https://habr.com/ru/company/selectel/blog/556394/) 3. [UEFI official site](https://uefi.org/faq) 4. [UEFI boot: how does that actually work, then?](https://www.happyassassin.net/posts/2014/01/25/uefi-boot-how-does-that-actually-work-then/) 5. [PXE-netboot-install](https://wiki.ubuntu.com/UEFI/PXE-netboot-install) 6. [About GDISK](http://www.rodsbooks.com/gdisk/) 7. [What's at 1st sector/MBR of hard disk(MBR Forensics)](https://nixhacker.com/explaining-the-magic-of-mbr-and-its/) 8. [Best pictures of MBR and GPT](http://www.invoke-ir.com/2015/06/ontheforensictrail-part3.html)