Skip to content

2.3NetworkInstallation

Jump to bottom
Hocquel Rafael edited this page Jun 4, 2026 · 19 revisions

title: Project 2.3 Network installation

S2.03 Installation de Services Réseaux

ℹ️ Informations Authors: Rafaël HOCQUEL & Zakaria SABRI

Under the direction of: Serge BOUTER

Date: June, 5th 2026

Team Presentation

Zakaria SABRI and Rafaël HOCQUEL are both students of the Computer Science Bachelor program at the University of Bordeaux, here is a quick introduction of their profiles:

Zakaria SABRI is highly interested in computer systems, networking, and DevOps, he naturally gravitate toward infrastructure management and automation. Throughout his academic and personal projects, he use a diverse set of technical tools including Bash/Shell, Git, Java, HTML CSS JavaScript and Python.

Outside of his studies, Zakaria SABRI is also an official passionate football referee. His main task is to make sure that the matches that he supervise, respectes all the IFAB prescriptions, and takes place safely.

Rafaël HOCQUEL is more focused on the coding side of Computer Sciences, leaning towards application and website development using technologies such as React, Supabase or Swift in addition to the concepts and programming laguages he learnt during his formation.

Outside of his studies, he is both a driver (or spotter) and a marshall for iRacing online events, between 2 sim-races, Rafaël is building his own SaaS products and proposing its freelance services.

Context & Tools

This project aims to deploy a secure, and fully functional network infrastructure in a professional environment. The architecture is divided into two distinct subnets: a Client LAN and a Server LAN, bridged by a central router.

The core of this deployment relies on Nextcloud, a powerful open-source suite for creating and using self-hosted file sharing and collaboration services. To provide a complete collaborative workspace, we integrated OnlyOffice, an online office suite that allows real-time document editing directly within the browser.

Note: this guide and all the following commands are supposed to be executed in a unix-based environment (linux distributions or macOS environmnent)

Initial Startup

⌨️ Commands to run in the main terminal

  1. Start the virtual machine that will simulate the router /mnt/netta/apps/vnet/nemu-vnet ncloud and login with the username root and the password plop

machines.png{width="566" height="317"}

Overview of the virtual machines terminals

  1. Start both, clients and the server virtual machines with the commands cli() and srv() commands. And then log in with root on each machine

System & Network Configuration

⌨️ The following commands has to be run in the dedicated users terminal.

  1. First step create the users (alice, bob & ncloud, office)

[!note] With each machine

Connect with the root user, (password: plop)

Then enter the followings commands to create the users

  • adduser <login>
  • login <login>
  1. Give them sudo rights
  • usermod -aG sudo <login>

droitSudoAlice.png{width="768" height="507"}

Result of the usermod command giving the sudo rights to alice

  1. Check that they are part of the sudo group (on the root login of the user's machine) - id - sudo whoami

[!note] Question n°8

The sudo (Super User DO) command allows the user to run commands with the privileges of another user (by default super user)

Administration of Local Networks

[!important] Question n°9

A /24 subnet is identified by his subnet mask of 255.255.255.0. The /24 corresponds to the 24 bits allocated to the network portion of the IP address, this means that the subnet can support 254 machines (256 - broadcastAdress - subnetAdress).

  1. Select two distinct /24 subnets from the 192.168.0.0/16 address, the Lan Server Network (ncloud, office, router): 192.168.1.0/24 and the Lan Client Network (alice, bob, router): 192.168.2.0/24
  2. Assign then an IP address to each required interface:

[!warning] Lan Server Subnet

(router eth0) 192.168.1.254/24

[!caution] ncloud

(eth0): 192.168.1.1

[!caution] office

(eth0): 192.168.1.2

[!warning] Lan Client Subnet

(router eth1) 192.168.2.254/24

[!caution] Alice

(eth0): 192.168.2.1

[!caution] Bob

(eth0): 192.168.2.2

  1. Run the following commands ifconfig, ifconfig -a and ip -br addr

Q12.webp{width="449" height="225"}

Result of command `ifconfig -a` ran on bob's machine

Q12bis.webp{width="419" height="84"}

Result of command `ip -br addr` ran on bob's machine

[!note] Question n°13

The _lo_ network interface, (for Loopback interface) is a network virtual interface used to send back a signal received to its sender without changes, or treatment, 127.0.0.1 corresponds to his local IP adress

14. Set the IP addresses to all the machines (clients, servers and router)

[!important] Router

(eth0) : ifconfig eth0 192.168.1.0/24 netmask 255.255.255.0

[!important] Router

(eth1) : ifconfig eth1 192.168.2.0/24 netmask 255.255.255.0

[!important] Alice

sudo ifconfig eth0 192.168.2.1/24 netmask 255.255.255.0

[!important] Bob

sudo ifconfig eth0 192.168.2.2/24 netmask 255.255.255.0

[!important] NCloud

sudo ifconfig eth0 192.168.1.1/24 netmask 255.255.255.0

[!important] Office

sudo ifconfig eth0 192.168.1.2/24 netmask 255.255.255.0

Check that the addresses are configured correctly with the `ip -br addr` command

14alice.png{width="597" height="89"}

IP configuration result on Alice

14bob.png{width="597" height="89"}

IP configuration result on Bob

14ncloud.png{width="763" height="76"}

IP configuration result on ncloud

14office.png{width="763" height="76"}

IP configuration result on office

14 router.png{width="770" height="115"}

IP configuration result on router

  1. Everything should work for the communication in the same subnet

15alice.png{width="734" height="180"}

Ping tests from Alice to local subnet

15aliceOff.png{width="742" height="67"}

Ping test to Office

15aliceR.png{width="734" height="180"}

Ping test to Router from Alice

15BOB.png{width="734" height="180"}

Ping tests from Bob to local subnet

  1. Run the command `sudo echo 1 > /proc/sys/net/ipv4/ip_forward` to make the router route the packets that aren't directly destinated to him

16.png{width="742" height="37"}

Enabling IPv4 forwarding on the router

[!note] Question n°17

Machines from 2 different subnets cannot communicate (yet) because the machines (alice, bob, office and ncloud) do not have their default gateway set up, thus, they do not know where to send packets that are not destinated to a machine of the same subnet

  1. Add the default gateways for all the machines:

[!important] ncloud & office

default_gateway: (router eth0): sudo route add default gw 192.168.1.0

[!important] alice & bob

default_gateway: (router eth1): sudo route add default gw 192.168.2.0

18.png{width="742" height="66"}

Applying the default gateway routes on machines

  1. Everything should work for the communication between machines of the same subnet and machines from different subnets with the `ping` command

However, the ssh connection is not working, for the reason that the package is not installed on the machines, the user have to install oppenssh-server on all machines with the command sudo apt update && sudo apt install openssh-server

19 alice.png{width="742" height="82"}

Successful ping test across subnets from Alice

  1. The traceroute command should be ran in 2 different cases:
  • 2 machines from the same subnet ( 192.168.1.1 ➜ 192.168.1.2 ): 192.168.1.1 ➜ 192.168.1.2
  • 2 machines from the same subnet ( 192.168.1.1 ➜ 192.168.2.1 ): 192.168.1.1 ➜ 192.168.1.0 ➜ 192.168.2.1

21. You should observe that the differents IP address and the routes of the computers have disappeared, what we did at the question 14 was temporary and only valid until the next reboot.

22. For each machine (including the router), we add the corresponding network configuration at the end of the /etc/network/interfaces file:

- Router:

image.png{width="706" height="291"}

Network configuration inside the router's interfaces file

For the router, we do not provide the `gateway` as the router already knows all subnets

[!note] Question n°23

To restart the network configuration run and apply all the past changes use the command systemctl restart networking on each machine.

[!tip] Question n°24

For any problem use the following commands

systemctl status networking

journalctl --reverse --unit networking

  1. For this step, set up all the interfaces on each machine and check that everything is working correctly by monitoring interfaces and connections with the commands ip -br addr, ifconfig, route and ping

25Alice.png{width="647" height="90"}

Alice's terminal, after the ip -br addr command

25AliceRoutage.png{width="647" height="90"}

Alice's terminal, after the ip route command

  1. For this step, the user should allow packet transfering to the router by editing the /etc/network/interfaces file and appending the up echo 1 > /proc/sys/net/ipv4/ip_forward command to its end

router26.png{width="473" height="600"}

network configuration inside the router's interfaces file

[!important] Question 27

Run sudo reboot on all machines and check with ip, ifconfig, route and ping after the reboot

image.png{width="802" height="119"}

Network status check after reboot by the ip -br addr command

image.png{width="703" height="185"}

Ping test after reboot

image.png{width="707" height="190"}

Ping from bob

Server Installation and Configuration

[!tip] 28. What is APT ?

The acronym APT (Advanced Package Tool) is a package manager for Debian based OS (Ubuntu, Mint, Raspbian) that allow to the user to download, install or manage differents softwares.

[!note] 29. Package managers

Distribution Package Manager
Fedora DNF
Red Hat YUM
Open Suse Zypper
Arch Linux Pacman

[!note] 30. Package Formats

Package Manager Package Format
APT .deb
YUM .rpm
Zypper .rpm
Pacman .pkg.tar.zst
DNF .rpm

[!important] 31. Package Manager for  Windows

For windows there are some managers like Windows Package Manager or Chocolatey.

[!important] 32. Package Manager for macOs

For macOs the manager is Homebrew.

[!tip] 33. APT package manager

Here are the most useful commands for the APT package manager

Description Command
Update available software list sudo apt update
Search a package apt search <packageName>
Show a package details apt show  <packageName>
List installed packages apt list --installed
Install package sudo apt install <packageName>
Uninstall package sudo apt remove <packageName>
Update all packages sudo apt upgrade

[!warning] Be careful

The following instructions have to be executed on the ncloud machine

  1. First step to install snap, run the following command sudo apt install snapd

[!tip] 35. APT package manager

Here are the most useful commands for the APT package manager

Description Command
Update available software list sudo snap refresh --list
Search a package snap find <packageName>
Show a package details snap info <packageName>
List installed packages snap list
Intall package sudo snap install <packageName>
Uninstall package sudo snap remove <packageName>
Update all packages sudo snap refresh
  1. Run the following command sudo snap install nextcloud to install Nextcloud on the machine
  2. Let's switch to the Debian UI with the startx command and made the needed graphical adjustments

[!note] 38.

In the default installed web browser, type the IP adress of the nextcloud machine (192.168.1.1) and get access to the nextcloud's signup page

When you are done, type the following commands on the ncloud terminal:

  • snap set nextcloud listen.http=192.168.1.1
  • snap run nextcloud.occ config:system:set trusted_domains 1 --value=192.168.1.1
  • snap restart nextcloud

image.png{width="900" height="541"}

Nextcloud machine's terminal restarting the nextcloud app

[!note] 39.

When the user is on the page, create the admin account to take the access of the platform

image.png{width="900" height="554"}

Nextcloud admin account creation

[!tip] 40. ➜ Tip

Don't install any application in the goal to keep a light installation

[!note] 41. What is MIME ?

Multipurpose Internet Mail Extensions are identifiers used to tell the type of a ressource (HTML document, vidéo, image etc...) and are used by both the browser and server to handle those ressources correctly

  1. Run the following command: sudo snap run nextcloud.occ maintenance:repair --include-expensive and the warning is now gone in the administration settings

    image.png{width="900" height="541"}

    Warning resolved by running the following command

[!important] 43. The HTTPS protocol

The HTTPS protocol is the secured version of the HTTP (HyperText Transfer Protocol) protocol.

  • It uses the TLS (formerly SSL) protocol which is both asymmetrical (for establishing the connection) and symmetrical (for data transfer once connection is established).
  • TLS uses the X.509 Certificate which "binds" a public key to an identity (domain name, enterprise, website, etc...).   This certificate is delivered by the CA (Certification Authority). The CA delivers certificates after validating the entity identity (companies, websites, etc...). The CA signs the certificate to assert that the entity is authentic. Certificates can also be self-signed (not signed by a CA but by the entity itself). They are used for local testing and development environments but are not trusted by browsers.
  1. To generate the TLS certificate and the private key in order to set up HTTPS protocol (instead of the current HTTP protocol), use the following commands:
  • cd /var/snap/nextcloud/common/
  • certgen -common-name 192.168.1.1 -host 192.168.1.1

image.png{width="900" height="80"}

Generation of the TLS certificate

  1. Now that the certificate is created, use the following command

    snap run nextcloud.enable-https custom -s public.crt private.key public.crt

    so then the HTTPS protocol is enabled

image.png{width="779" height="91"}

Enabling HTTPS protocol for Nextcloud

[!important] 46. HTTPS Protocol

You may have seen that now we have the HTTPS protocol, but we have an exception.

The error MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT tells us that firefox is blocking the page because our certificate is self-signed (not provided by the CA)

image.png{width="826" height="600"}

Firefox security warning for self-signed certificate

  1. For this step, add just an exceptionin the firefox settings 48. 

[!tip] MFA (Multi Factor Authentication)

Consists of securing an accound or a ressource with multiple factors (steps) like as a password, topt, email, sms, facial recognition

[!tip] 2FA (2 Factor Authentication)

This is a form of MFA that consists of 2 verification factors / steps (often a password + [TOTP, sms, email, facial recognition])

It prevents attackers from loggin in into a stolen account (repetitive passwords, credentials leaks etc...) because they only have the password but not the 2nd factor

[!tip] TOTP (Time based One Time Password)

Is a common way of 2FA that consists of entering (often after typing the password) a one-time code valid for a short amount of time and then invalid.

This code is generated from the current timestamp that is used in a "function" to encrypt it. As this system relies on time only, it does not require a network connection between the device containing the 2FA method and the server, thus, it is faster and safer (no fata being send).

  1. On Apple iPhones devices, the "Passwords" app can be used, on other phones (or in replacement of this app), the user can use "Microsoft Authenticator" or "Google Authenticator"

[!note] 50.

For this tutorial we will be use the iPhone's "Passwords" app

  1. Return to the NextCloud interface, go to "Apps" then to "My Apps" and enable the "Two-Factor TOPT Provider" app
  2. Next step, go to "Personal Settings" ➜ "Security" and set up TOTP by checking the option
  3. Generate the recuperation codes from the same page and download them in a safe place (for example: tTao7g4oM8gKjeX)

    image.png{width="900" height="483"}

    TOTP setup and recuperation codes

  1. Then we toggle the "Always ask for password" and "Require password protection" (By following this path "Administration Settings" ➜ "Sharing")

    image.png{width="361" height="43"}

    Enabling password protection settings

55. The user can also toggle all those options from the ("Administration Settings" ➜ "Security" page) instead of the previous explanation

[!note] 56. ihavebeenpwned

This is a website that checks if the given email addresses have appeared in known data breaches, it checks in leaked databases / data resellers and shows (if any leak occured), where it came from and what informations leaked

  1. Create a new group from the "Accounts" page.

image.png{width="252" height="126"}

Creation of the IUT group

  1. Create the "Alice" user from the same page and select the specifications of the user through the account creation process.
  2. Create the "Bob" user following the same process.

image.png{width="900" height="279"}

Creation of Alice and Bob users and affectation to the IUT group

  1. For both Bob and Alice, you can change their names in the "View Profile" page.
  2. Create the folder in the "Files" page and share it to the "IUT" group with the dedicated icon. After logging in on "Bob", he has access to the shared folder with read/write permissions.

image.png{width="900" height="42"}

Folder shared with the IUT group

  1. Create the file and the sharing link in the "Files" page.

[!important] Mandatory Password

Because of the earlier configuration we made, the link is protected by a mandatory password. When entering the sharing link in a private browsing window (not logged in), we are asked for the password. If it is correct, then we can access the file.

  1. After importing a .odt file, we can see that we cannot open it directly in the app. Clicking the file downloads it onto the computer, and doing "Right Click" ➜ "Open locally" ➜ "Open Online" gives us the There is no pluggin available to display this file type error, as expected.

image.png{width="900" height="41"}

The .odt file

image.png{width="478" height="61"}

No plugin available error message

Service OnlyOffice

⌨️ Commands to run in the terminal of the office machine

  1. On the office machine, install the snap package manager (the same way as earlier) with the sudo apt install snapd command. Then, install the onlyoffice-ds service via snap with the following command:     sudo snap install onlyoffice-ds

image.png{width="552" height="96"}

Checking the installation of the onlyoffice-ds service

  1. Get the OnlyOffice secret key used to protect the access to our instance. Save it in a safe place! sudo snap get onlyoffice-ds onlyoffice.jwt-secret

[!important] Secret Key

Keep this JWT key safe, as it will be required later to link Nextcloud and OnlyOffice securely.

image.png{width="552" height="64"}

Retrieval of the OnlyOffice secret key

  1. Activate the remote document editing for Nextcloud to be able to connect to OnlyOffice. For this, use the following command:  sudo snap set onlyoffice-ds onlyoffice.use-unauthorized-storage=true

image.png{width="552" height="64"}

Checking the enabling unauthorized storage for OnlyOffice

  1. Open a browser and type 192.168.1.2 in the address bar. The OnlyOffice presentation page should show up.

image.png{width="900" height="245"}

OnlyOffice default presentation page

[!warning] Security Issue

We are encountering the same issue as when we installed the Nextcloud server: our connection isn't secured because it is using HTTP instead of HTTPS.

  1. To set up the HTTPS protocol, use the following commands: cd /var/snap/onlyoffice-ds/current/var/www/onlyoffice/Data/certs/  then certgen -common-name 192.168.1.2 -host 192.168.1.2  then ln -s private.key onlyoffice.key  and finally ln -s public.crt onlyoffice.crt
  2. Now that our self-signed certificates are created, we have to restart the OnlyOffice service to apply the change: sudo snap restart onlyoffice-ds
  3. After reconnecting, we can see that the OnlyOffice service is now using HTTPS.

[!caution] Browser Block

We get the same error as with the Nextcloud configuration: the browser is preventing us from accessing the service because the certificate is self-signed (MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT).

image.png{width="900" height="461"}

Firefox security warning for OnlyOffice certificate

  1. Add the exception in the Firefox settings to bypass the warning.

Nextcloud Pluggins

⌨️ Commands and actions for the Nextcloud environment

[!tip] Plugin Installation Process

To install plugins on Nextcloud, log in with your administrator account (Password + TOTP) and navigate to the Apps page. Search for the desired plugin and click the Download and Activate button.

  1. Go to the "Apps" page, search for the ONLYOFFICE app (located in the "Office and Text" section), and activate it. It should now show up in the "Active Apps" section. Go to "Administration Settings" ➜ "ONLYOFFICE".  Set the ONLYOFFICE Docs address to https://192.168.1.2. Check the Disable certificate verification (insecure) checkbox. Type the previously saved secret key in the Secret Key field.

image.png{width="900" height="380"}

Configuration of the ONLYOFFICE plugin

  1. From the same page, select which file formats the plugin supports. Check all of the following checkboxes: doc, docx, ppt, pptx, xls, xlsx, odp, ods, odt.
  2. Try to open the .ods file that was not opening in the previous questions. Right-click the file and click "Open in ONLYOFFICE". If everything is working correctly, it should open the document seamlessly.

[!note] Troubleshooting OnlyOffice

If you get an error, it might be because the OnlyOffice example is not running. If so, enter the following command in the office machine terminal: sudo snap set onlyoffice-ds onlyoffice.example-enabled=true

  1. Splash (Tools): Install "Splash" from the Apps page.
  2. Go to "Administration Settings" ➜ "Customise appearance" and scroll down to the "Splash" section. Set the image provider to "WallHavenCC", and check both Use random image as login background and Use random image as dashboard background.
  3. The wallpaper should now be changed on both the dashboard and login screens.

image.png{width="900" height="481"}

Custom login background applied by Splash

  1. Passwords (Security): Install and activate the "Passwords" app.
  2. Click on the "Passwords" app in the top navbar (key icon). Create a new password using the ... menu, then click Create Password. Fill the form. To share it, click the ... button on the password, select Share, and choose the respective users.

image.png{width="900" height="180"}

Shared password creation in the Passwords app

  1. Secrets (Security): Install and activate the "Secrets" app.
  2. Click on the "Secrets" app icon. Create a secret using the dedicated + icon. You can then copy the sharing link and send it to the dedicated person.

image.png{width="900" height="486"}

Secret link generation in the Secrets app

  1. Diagramming (Integrations): Install and activate the "Diagramming" application.
  2. Test if it is working by going to the "Files" page, clicking on New, then New Draw.io Diagram.

image.png{width="282" height="73"}

Creating a new Draw.io diagram

  1. Calendar (Organization): Install and activate the "Calendar" app.
  2. Click the "Calendar" app icon, then click the + button next to "My Agendas". Click New Agenda and name it. Click the edit icon to enter the usernames of people you want to share it with.
  3. Create an event on Bob's account, switch to Alice's account, and check that it is showing. Do the opposite operation to ensure bi-directional syncing works.

image.png{width="900" height="448"}

Synchronized event displayed in the calendar

  1. FormVox (Organization): Install and activate "FormVox".
  2. Go to the "FormVox" app icon, click on Survey, and create a survey.
  3. Copy the survey link, log in as another user (e.g., Alice), and answer the questions. Go back to the admin user to verify that the results are showing correctly.

image.png{width="900" height="483"}

FormVox survey results view

  1. Extra Plugins: Do the same manipulation for the two following plugins: Language Switcher: Allows users to easily switch languages or translate the UI. The translate menu is located next to the user profile picture.  Doom: A lightweight game to allow users to take a break. Once installed, it automatically appears in the top navbar.

image.png{width="760" height="101"}

Doom and Language Switcher icons in the navbar

Client Installation and Configuration

⌨️ Commands to run in the terminal of the alice and bob machines

  1. We install the Nextcloud desktop client for the alice and bob machines so they can access the environment directly from their OS: sudo apt update then sudo apt install nextcloud-desktop
  2. On each of the client machines, start the GUI (startx command) and type the nextcloud command in the terminal to start the client. Reference the server URL: https://192.168.1.1. Approve the connection (bypassing the self-signed certificate warning). Log in to the account and close the webpage. Back in the Nextcloud client, select the local folder to sync.

image.png{width="533" height="522"}

Nextcloud desktop client configuration

image.png{width="900" height="520"}

Nextcloud desktop client successfully connected

  1. Create some files/folders from the web interface AND from the system file explorer locally to ensure that bi-directional synchronization is fully operational.

image.png{width="478" height="589"}

Local system file explorer synchronization

image.png{width="900" height="542"}

Web interface reflecting the local files

Portfolio

Zakaria SABRI's words

Starting with blank virtual machines with the NEmu emulator, I successfully integrated all the necessary configurations to deploy a fully functional and secure collaborative network architecture. I implemented the routing between our isolated subnets (enabling ip_forward) to manage traffic seamlessly, while ensuring the persistence of our IP configurations through /etc/network/interfaces.

I significantly progressed in deploying containerized services using snap for Nextcloud and OnlyOffice. Furthermore, I managed the end-to-end securing of data flows by generating self-signed certificates (certgen), enforcing the HTTPS protocol across our web servers, and implementing Two-Factor Authentication (TOTP) to protect user access.

This SAÉ has thoroughly solidified my skills in Linux administration and network security. It perfectly aligns with my professional trajectory, confirming my DevOps-oriented profile and serving as a strong my SysAdmin skills foundations.

Rafaël's words

This project involded setting up a whole virtual network using the NEmu virtualization platform. The infrastrucutre consisted of 2 nubnetworks (client and server) communicating through a router linking those 2 subnets. Once the network was operational, I deployed and configured both a NextCloud environment (for cloud storage and team collaboration) and an ONLYOFFICE server that I integrated to NextCloud to allow for document editing capabilities.

Finally, I installed the "NextCloud desktop client" on the clients machines to allow the users to synchronize their cloud documents with their local file systems.

Through this project, I developed some important system-administrator skills such as network routing, IP forwarding, software deployment & configuration, troubleshooting and documentation analysis.

Clone this wiki locally