Configuring network settings and server roles in Linux is a fundamental skill for cybersecurity professionals in Kenya, where secure and reliable network infrastructure supports critical services across sectors such as healthcare, finance, and government. Proper network configuration ensures devices communicate efficiently and securely, while server roles like DHCP and DNS are vital for managing IP address allocation and domain name resolution. This chapter equips learners with practical knowledge on configuring IP addresses, DNS settings, and setting up essential Linux network services to safeguard organizational networks from vulnerabilities and enhance operational resilience.

6.1 Configuring IP Addresses and DNS

Configuring IP addresses and Domain Name System (DNS) settings on Linux systems is critical for establishing network connectivity and ensuring secure name resolution in cybersecurity environments. Kenyan institutions such as county government offices and financial institutions rely on precise network configurations to protect sensitive data and maintain uninterrupted service availability. This section focuses on three primary tools used in Linux for network configuration: netplan, nmcli, and resolv.conf.

6.1.1 Using netplan, nmcli, and resolv.conf

Linux offers multiple utilities to configure IP addresses and DNS, each suited to different environments and use cases. Understanding these tools enables cybersecurity professionals to tailor network settings to organizational policies and security requirements effectively.

netplan for Network Configuration

Netplan is the default network configuration tool on Ubuntu and several other Linux distributions, designed to simplify network interface management by using YAML files.

• Declarative Configuration: Netplan uses YAML files located in /etc/netplan/ to define network interfaces, allowing administrators to specify IP addresses, gateways, and DNS servers in a human-readable format.
• Support for Static and Dynamic IPs: It supports both static IP address assignment and DHCP, enabling flexible deployment in various network environments.
• Integration with Systemd-networkd and NetworkManager: Netplan generates backend configuration for either systemd-networkd or NetworkManager, allowing seamless integration with different Linux networking stacks.
• Ease of Automation: The declarative nature of netplan makes it suitable for automated deployment scripts, which is advantageous in managing large-scale networks such as those in Kenyan universities.
• Security Consideration: Configurations must be validated before applying to prevent misconfigurations that could expose systems to network attacks.

To configure a static IP using netplan, an administrator edits a YAML file specifying the interface, IP address, subnet mask, gateway, and DNS servers, then applies the configuration with netplan apply. This approach is effective for servers requiring fixed IPs in secure environments like hospital networks.

nmcli Command Line Tool

The NetworkManager Command Line Interface (nmcli) is a versatile utility that manages network connections dynamically, suitable for desktop and server systems.

• Real-time Network Management: nmcli allows administrators to create, modify, and delete network connections without rebooting or restarting services, facilitating quick adjustments in response to security incidents.
• Support for Wired and Wireless Interfaces: It manages various interface types, including Ethernet and Wi-Fi, which is important for mobile cybersecurity teams operating in diverse Kenyan field environments.
• DNS Configuration: nmcli can set DNS servers per connection, ensuring that secure and trusted DNS services are used to prevent DNS spoofing or cache poisoning attacks.
• Scripting Capability: nmcli commands can be scripted for automated network configuration and monitoring, enhancing operational efficiency in large institutions like SACCOs.
• User Permissions: Proper user privileges are required to execute nmcli commands, reinforcing access control policies.

An example use case includes swiftly switching DNS servers during a cyber threat to redirect traffic through security-filtered resolvers, protecting sensitive financial data in banks.

Managing DNS Resolution with resolv.conf

The /etc/resolv.conf file specifies DNS server addresses that the system uses to resolve domain names to IP addresses.

• Primary DNS Configuration File: It contains nameserver entries that point to DNS servers, which can be internal or public, depending on organizational security policies.
• Static vs Dynamic Updates: In some systems, resolv.conf is manually edited for static DNS settings, while in others it is dynamically managed by tools like DHCP clients or NetworkManager.
• Order of DNS Servers: The sequence of nameserver entries determines the order in which DNS queries are sent, affecting resolution speed and reliability.
• Security Implications: Using trusted DNS servers prevents man-in-the-middle attacks and data leakage; Kenyan cybersecurity teams often configure resolv.conf to use internal DNS servers for sensitive operations.
• File Locking and Overwrites: Administrators must be cautious as some network services overwrite resolv.conf on reboot or network changes, requiring configuration of the managing service to preserve settings.

In county government offices, setting internal DNS servers in resolv.conf ensures that domain resolution remains within the secure intranet, reducing exposure to external threats.

Chapter Summary

This chapter covered essential tasks for configuring network settings and server roles in a Linux environment. It began with methods for setting IP addresses and DNS, focusing on tools such as netplan, nmcli, and editing the resolv.conf file to manage network configurations effectively. The setup of Linux DHCP and DNS servers was explained to enable dynamic IP address allocation and domain name resolution within a network. Webserver configuration was addressed by detailing the installation and management of Apache and Nginx, including the creation of virtual hosts for hosting multiple websites. Firewall and port management techniques were explored through the use of iptables, UFW, and firewalld to secure network traffic and control access. Finally, the chapter discussed SSH configuration, emphasizing practices for hardening and managing remote access to enhance security and maintain system integrity.