One small web server in Azure. Prove it works and is secure, delete it, hand in one PDF.
Proof means screenshots or terminal output. The brief asks for them (section 7), and the rubric only gives points for what you show. Upload them in the Steps tab so the group sees them.
One person, the builder, does every step marked Builder in their own Azure account. Agree who it is first.
Steps marked Anyone can be done by any member, on their own laptop. Tick a step when it is done; the group sees the same ticks.
Do the stages in order. Laptop your terminal VM inside the server Portal portal.azure.com screenshot to take
Go to azure.microsoft.com/free/students and sign in with your IE email. You get $100 credit, no credit card.
Only the builder needs this. Others can activate one too, as a backup if the builder's account is blocked. Never share passwords or the key file.
Search Policy > Assignments > Allowed resource deployment regions > Parameters. Pick an EU region from that list (Spain Central if it is there).
Write it down as ADMIN_IP.
curl -4 https://ifconfig.meIf the builder changes Wi-Fi later, run it again and update the SSH rule (stage 3). Never set SSH to Any to fix a problem.
Search Resource groups > Create. Name rg-s12-group03, your region. Review + create > Create.
Search Virtual machines > Create > Virtual machine.
rg-s12-group03, name vm-s12-g03-web, your regionazureuser, Generate new key pair, key name kp-s12-g03vnet-s12-g03, address range 10.10.0.0/16, subnet snet-web 10.10.1.0/24. OK.Click Review + create. Take the screenshot of the price, then Create, then Download private key and create resource.
Never share or screenshot this file.
mkdir -p ~/.ssh
mv ~/Downloads/kp-s12-g03.pem ~/.ssh/
chmod 400 ~/.ssh/kp-s12-g03.pemVM > Networking > Network settings > Create port rule > Inbound port rule.
ADMIN_IP/32)Allow-SSH-AdminYou should see two rules of your own: HTTP (Any, 80) and Allow-SSH-Admin (your IP, 22).
Network settings > click the network interface > Help > Effective security rules. The VM must be running.
No rule allows port 22 from Any or Internet. Only your IP, plus the Azure defaults for the virtual network.
Copy PUBLIC_IP from VM > Overview. Type yes the first time.
ssh -i ~/.ssh/kp-s12-g03.pem azureuser@PUBLIC_IPwhoami
hostname
sudo grep Accepted /var/log/auth.log | tail -3You should see: Accepted publickey for azureuser from ADMIN_IP.
Run one line at a time.
sudo apt-get update
sudo apt-get install -y nginx
systemctl status nginx --no-pagerYou should see: active (running).
Open the file. It opens empty. Paste the page below (replace REGION). Save with Ctrl+O, Enter, then Ctrl+X.
sudo nano /var/www/html/index.html<!DOCTYPE html>
<html lang="en">
<head><meta charset="UTF-8"><title>NexaPay Lab</title></head>
<body>
<h1>NexaPay Lab - Group 03</h1>
<p>Team initials: CP, EH, GA, JV, NK, PT, RP, SV, TS</p>
<p>Demo web server: Ubuntu VM running NGINX in REGION. Public HTTP on port 80. SSH only from one admin IP with a key. This page is stored on the VM's managed disk.</p>
</body>
</html>Taking a break? VM > Stop until it says Stopped (deallocated). Start it again later and check ADMIN_IP.
Not inside the VM. On Windows type curl.exe.
date; curl --connect-timeout 10 --max-time 15 -I http://PUBLIC_IPYou should see: HTTP/1.1 200 OK.
Type http://PUBLIC_IP with http:// written out.
Mark which IP is public and which is private.
Three screenshots in a row. Always a new curl from a laptop, never a browser refresh.
date; curl --connect-timeout 10 --max-time 15 -I http://PUBLIC_IPNetwork settings > Create port rule > Inbound port rule. Source Any, Service HTTP, Action Deny, Priority 100, Name Deny-HTTP-Test. Wait 1 to 2 minutes, then run the same curl.
You should see: curl: (28) with "Timeout was reached" or "Connection timed out".
Click the rule's ··· menu > Delete. Wait 1 to 2 minutes, run the curl again.
You should see: HTTP/1.1 200 OK again.
ls -l /var/www/html
df -h /var/www/html
lsblk -o NAME,SIZE,TYPE,MOUNTPOINTSsda (about 30G, mounted at /) is the managed OS disk with the page. A disk at /mnt, if shown, is the temporary disk.
VM > Disks. The OS disk is the same 30 GiB disk you saw in lsblk.
Check credit used at microsoftazuresponsorships.com/balance. Then VM > Stop until it says Stopped (deallocated).
For the report: when stopped, the VM itself costs nothing, but the disk and the public IP still cost money until they are deleted.
Deleting cannot be undone. Check the Assignment tab: E1 to E5 must all have screenshots.
Resource groups > rg-s12-group03 > Delete resource group. Type the name, then Delete. Leave force delete unticked and every other group alone.
Wait for the "Deleted resource group" notification. Refresh the Resource groups list.
Draft answers. Put them in your own words.
HTTP is the public website, so anyone on the internet must reach port 80. SSH gives full control of the server, so it is limited to the builder's IP (/32) and a key. Many devices on a university network share one public IP, which is why the key is still needed.
The public IP is reachable from the internet and points to the VM's network interface. The private IP (for example 10.10.1.4) only works inside the virtual network. The VM itself only sees its private IP.
In /var/www/html/index.html on the VM's managed OS disk. It survives a stop or restart. Azure will not delete the OS disk while it is attached. If the VM and its disk are deleted, the page and the operating system are gone for good unless a backup exists.
The website goes down. One VM is a single point of failure: there is no second copy to take over.
1. Two or more VMs in different availability zones behind a load balancer, so one failure does not take the site down. 2. HTTPS with a certificate. HTTP is fine for this public demo page, but a real payment site must encrypt data in transit and prove its identity to visitors.
One person uploads S12_Group_03.pdf on Blackboard > Cloud Computing > Session 12. Integrative Cloud Lab. Agree who first: there are 2 attempts.