Exercise: The service nobody can reach

A small web service on serverb answers on its own machine and from nowhere else. Work up the ladder from servera, read each error message, and make exactly one change per layer until curl returns the page.

The service nobody can reach

Use the error message to pick the next layer to check.
Find a loopback-only listener with ss.
Open a port and fix the bind address.

Start the exercise

On workstation, start the exercise. It starts a small web server on serverb that listens on port 8080 of the loopback address only, with the page hello from serverb.

[student@workstation ~]$ lab start sa-reach

Later tasks assume that you are logged in to the server they name: ssh student@servera from workstation, then sudo -i for a root shell.

Then, as root on serverb, change to the exercise directory:

[root@serverb ~]# cd /srv/web

Rung 1 to 5: is the machine reachable?

In a second terminal, log in to servera. Check that serverb resolves, that its address answers a ping, and then try the service. Write down the exact error.

[student@workstation ~]$ ssh student@servera
[student@servera ~]$ getent hosts serverb
172.25.250.11   serverb.lab.example.com
[student@servera ~]$ ping -c 1 serverb | tail -2
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.134/0.134/0.134/0.000 ms
[student@servera ~]$ curl -sS -m 5 http://serverb:8080/
curl: (7) Failed to connect to serverb port 8080: No route to host

The name and the address are fine, so rungs 1 to 5 hold. "No route to host" with a working ping means the port is being rejected.

Rung 6a: the firewall

On serverb, look at which services and ports the firewall allows, and open TCP port 8080 for the running system (not permanently). Test from servera again. What is the error now?

[root@serverb web]# firewall-cmd --list-services; firewall-cmd --list-ports
cockpit dhcpv6-client ssh

[root@serverb web]# firewall-cmd --add-port=8080/tcp
success
[student@servera ~]$ curl -sS -m 5 http://serverb:8080/
curl: (7) Failed to connect to serverb port 8080: Connection refused

Progress: the packets now arrive, and the answer changed from "no route" to "refused". (Chapter 20 teaches firewalld properly, including permanent rules.)

Rung 6b: is anything listening where it should?

On serverb, show what listens on port 8080 and on which address.

[root@serverb web]# ss -tlnp | grep 8080
LISTEN 0      5          127.0.0.1:8080      0.0.0.0:*    users:(("python3",pid=679,fd=3))

The local address is 127.0.0.1: the loopback. Only programs on serverb itself can connect.

Fix it and verify

Restart the web server so that it listens on all addresses (--bind 0.0.0.0). Check ss on serverb, then curl from servera.

[root@serverb web]# pkill -f 'http.server 8080'
[root@serverb web]# nohup python3 -m http.server 8080 --bind 0.0.0.0 > /tmp/http.log 2>&1 &
[root@serverb web]# ss -tlnp | grep 8080
LISTEN 0      5            0.0.0.0:8080      0.0.0.0:*    users:(("python3",pid=708,fd=3))
[student@servera ~]$ curl -sS -m 5 http://serverb:8080/
hello from serverb

Grade and finish

Check your work with lab grade sa-reach, then put the exercise away with lab finish sa-reach.