Skip to main content

Build Your First Practical Lab - Part 1

With Immersive One, you can build your own labs in Lab Builder, including labs that run virtual machines you have imported yourself.

This is the first of two articles on building a custom practical lab from scratch. Here you'll launch an Elastic Compute Cloud (EC2) instance in your Amazon Web Services (AWS) account and configure it as a lab machine. Part 2 covers imaging that machine, importing it into Lab Builder, and building a simple Linux privilege escalation scenario on it, so you finish with a working lab you can copy for scenarios of your own.

Before you start

You need an AWS account with permission to launch EC2 instances. How you sign in depends on your organization and its access rules, for example going to console.aws.amazon.com.

Provision an EC2 instance

Once you're signed in, launch an EC2 instance. Type EC2 in the top search bar, then click EC2 under Services.

In the EC2 dashboard, click Launch instance.

The lab runs on a standard Linux distribution, and it's easier to start from a clean image. Select Ubuntu Server 22.04 LTS (HVM), SSD Volume Type, or a similar recent Ubuntu long-term support (LTS) release. It's widely used, it's well documented, and it's in the free tier, so your costs stay low.

Next, pick the instance type. Lab Builder supports t3.micro, t3.medium, and t3.large. Choose the size that matches what your machine has to do in the lab. This example is a straightforward Linux privilege escalation lab, so t3.micro is enough.

Now configure the instance details. You can leave most of these at their defaults, but check two of them:

  • Under Network, make sure your default virtual private cloud (VPC) and a subnet are selected
  • Turn on Auto-assign Public IP so you can reach the instance over Secure Shell (SSH) from the internet and configure it

Security groups control the machine's inbound and outbound access. You need to configure the machine, so open SSH to get into it. Alternatively, use AWS Systems Manager to reach it without SSH or direct network access. When you use a security group, only allow traffic from trusted IP addresses.

  • Select Create security group
  • Select Allow SSH traffic from
  • For the source, choose a trusted IP range or your own IP address

How much storage you need depends on the machine you're building. The default 8 GiB general purpose SSD (gp2) volume is usually enough, unless you're installing and configuring large applications.

Note: We don't currently support encrypted Elastic Block Store (EBS) volumes.

Now you're ready to launch your machine. Review your settings and click Launch.

You'll be prompted to add an SSH key to the machine, and you'll use that key to connect to the instance and configure it.

  • To create a new key pair, give it a name such as my-lab-key and click Download Key Pair. Keep the .pem file somewhere safe, because you need it to reach your instance over SSH
  • To use an existing key pair, select it

Once your key is sorted, click Launch instance. Your EC2 instance starts launching, and it can take a few minutes to be ready.

Configure the instance for use as a lab

When your EC2 machine is up, connect to it and configure it for your custom lab.

Connect to the running instance over SSH, using the key you downloaded when you provisioned the EC2 instance.

ssh -i <key>.pem ubuntu@<public_ip>

Note: You might need to change the permissions on the key first, with chmod 400 <key>.pem.

Then update the system packages.

sudo apt update
sudo apt upgrade -y

Note: Depending on the labs you build later, you might not want to update the system packages, because a scenario can need specific versions of software or libraries.

Set up SSH for the lab user

Lab Builder can open a session for the learner when the lab loads, and that session can use SSH, remote desktop protocol (RDP), or HTTP. For this lab, you want the lab to load with the lab user already connected over SSH, so they can get straight to the scenario without connecting to a machine themselves.

Most default Ubuntu Amazon Machine Images (AMIs) turn off SSH password authentication and allow key-based authentication only, but you can change that. Lab Builder doesn't support key-based authentication, so your lab user needs to connect with a password.

To allow it, update the SSH configuration. The examples below use nano, but use whichever editor you're comfortable with, such as Vi or Vim.

sudo nano /etc/ssh/sshd_config

Find the line that reads #PasswordAuthentication no or PasswordAuthentication no, and change it so your users can connect with a password:

PasswordAuthentication yes

Check that ChallengeResponseAuthentication is set to no, which it usually is, then save the file.

That's enough for most distributions, but some AWS images carry extra SSH configuration that also needs changing. The image in this example, Ubuntu Server 22.04 LTS (HVM), SSD Volume Type, needs the same edit in this file:

/etc/ssh/sshd_config.d/60-cloudimg-settings.conf

Open it and make the same change:

PasswordAuthentication yes

Restart the SSH service so the changes take effect:

sudo systemctl restart ssh

Next, create a dedicated user account for your lab participants:

sudo adduser lab-user

When prompted:

  1. Enter the password for lab-user, and make a note of it because you need it later
  2. Re-enter the password to confirm it
  3. Press Enter to skip the full name, room number, and the other prompts
  4. Enter Y when you're asked whether the information is correct

Note: We recommend a password that's unique to you and this machine.

Now log out of your SSH session as the ubuntu user and log back in as the lab-user you just created. That confirms the SSH configuration has changed and that you can connect to the machine with a password.

ssh lab-user@<ec2-ip>

You'll be prompted for the user's password, and entering it connects you to the machine.

ssh lab-user@52.18.126.144
lab-user@52.18.126.144's password:
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 6.8.0-1029-aws x86_64)
lab-user@ip-172-31-17-115:~$

What's next

Your machine is configured and ready to become a lab. Part 2 builds the privilege escalation scenario on it, images the machine, and imports it into Lab Builder.