!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!МОДУЛЬ2!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Настройка доменного контроллера Samba на машине BR-SRV
BR-SRV:
echo "nameserver 192.168.1.10" >> /etc/net/ifaces/enp7s1/resolv.conf
systemctl restart network
apt-get update && apt-get install -y task-samba-dc
for service in smb nmb krb5kdc slapd bind;
do
systemctl disable $service --now;
done
rm -f /etc/samba/smb.conf
rm -rf /var/lib/samba
rm -rf /var/cache/samba
mkdir -p /var/lib/samba/sysvol
samba-tool domain provision --realm=au-team.irpo --domain=au-team --adminpass='P@ssw0rd' --dns-backend=SAMBA_INTERNAL --option="dns forwarder=77.88.8.8" --server-role=dc
systemctl enable --now samba
cp /var/lib/samba/private/krb5.conf /etc/krb5.conf
systemctl restart samba
echo "search au-team.irpo" > /etc/resolv.conf
echo "nameserver 127.0.0.1" >> /etc/resolv.conf
echo "search au-team.irpo" > /etc/net/ifaces/enp7s1/resolv.conf
echo "nameserver 127.0.0.1" >> /etc/net/ifaces/enp7s1/resolv.conf
systemctl restart network
kinit administrator@AU-TEAM.IRPO
samba-tool group add hq
for i in {1..5};
do
samba-tool user add hquser$i P@ssw0rd;
samba-tool user setexpiry hquser$i --noexpiry;
samba-tool group addmembers "hq" hquser$i;
done
На клиенте:
установить статику ip 192.168.2.10 mask 28 gateaway 192.168.2.1 dns 192.168.3.10
apt-get update && apt-get install -y task-auth-ad-sssd
В ЦУС - Аутентификация - домен AD - пользователь Administrator пароль P@ssw0rd - ОК - применить. Результат добро пожаловать в AD.
Установим библиотеку libnss-role для NSS и набор инструментов для администрирования ролей и привилегий:
apt-get install -y libnss-role
roleadd hq wheel
echo "Cmnd_Alias SHELLCMD = /bin/cat, /bin/grep, /usr/bin/id" >> /etc/sudoers
echo "WHEEL_USERS ALL=(ALL:ALL) SHELLCMD" >> /etc/sudoers
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Конфигурация файлового хранилища на сервере HQ-SRV!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
HQ-SRV
apt-get update && apt-get install -y mdadm
!!!!!!!смотрим диски!!!!!!
lsblk
интересуют диски по 1ГИГ
sdb 8:16 0 1G 0 disk
sdc 8:32 0 1G 0 disk
Убедитесь, что sdb и sdc не имеют разделов и не смонтированы (в вашем случае — это так).
Если есть разделы — удалите их с помощью fdisk или wipefs:
wipefs -a /dev/sdb
wipefs -a /dev/sdc
mdadm --create --verbose /dev/md0 --level=0 --raid-devices=2 /dev/sdb /dev/sdc
Создание раздела на RAID-устройстве
fdisk /dev/md0
Внутри fdisk:
Нажмите n → p → 1 → Enter → Enter (весь объём)
Нажмите w для записи
Отформатируйте раздел в ext4
mkfs.ext4 /dev/md0p1
Создайте точку монтирования
mkdir -p /raid
Настройте автоматическое монтирование
a) Получите UUID массива:
blkid /dev/md0p1
КАК ПРИМЕР""""UUID="1ee29b22-f503-40e3-827a-579b5eacfb33"""""""
Отредактируйте /etc/fstab
echo "UUID=************************* /raid ext4 defaults 0 2" >> /etc/fstab
Проверьте:
df -h /raid
Сохраните конфигурацию RAID в /etc/mdadm.conf
создайте заготовку:
mdadm --detail --scan >> /etc/mdadm.conf
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Настройка сервера сетевой файловой системы (nfs) на HQ-SRV!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
apt-get install -y nfs-server nfs-utils
mkdir /raid/nfs
chmod 777 /raid/nfs
echo "/srv/public -ro,insecure,no_subtree_check,fsid=1 *
#/srv/share -rw,insecure,fsid=0,sec=krb5 *
/raid/nfs 192.168.2.0/28(rw,no_root_squash)" > /etc/exports
exportfs -arv
systemctl enable --now nfs-server
HQ-CLI:
apt-get update && apt-get install -y nfs-utils nfs-clients
mkdir /mnt/nfs
chmod 777 /mnt/nfs
echo "192.168.1.10:/raid/nfs /mnt/nfs nfs defaults 0 0" >> /etc/fstab
mount -av
touch /mnt/nfs/test.txt
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Настройка службы сетевого времени на базе сервиса chrony на маршрутизаторе ISP!!!!!!!!!!!!!!!!!!!!!!!!!!!
ISP
echo "server ntp0.ntp-servers.net iburst prefer minstratum 4
local stratum 5
allow 0.0.0.0/0" >> /etc/chrony.conf
systemctl restart chronyd
HQ-RTR
ntp server 172.16.1.1
write memory
BR-RTR:
ntp server 172.16.2.1
write memory
HQ-CLI и HQ-SRV:
echo "server 172.16.1.1 iburst" >> /etc/chrony.conf
systemctl restart chronyd
BR-SRV:
echo "server 172.16.2.1 iburst" >> /etc/chrony.conf
systemctl restart chronyd
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Сконфигурируйте ansible на сервере BR-SRV!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
BR-SRV:
apt-get update && apt-get install -y ansible sshpass
echo "[Servers]
HQ-SRV ansible_host=192.168.1.10
[Routers]
HQ-RTR ansible_host=192.168.5.1
BR-RTR ansible_host=192.168.5.2
[Clients]
HQ-CLI ansible_host=192.168.2.10
[Servers:vars]
ansible_user=sshuser
ansible_password=P@ssw0rd
ansible_port=2026
[Routers:vars]
ansible_user=net_admin
ansible_password=P@ssw0rd
ansible_connection=network_cli
ansible_network_os=ios
[Clients:vars]
ansible_user=user
ansible_password=resu
[all:vars]
ansible_python_interpreter=/usr/bin/python3" > /etc/ansible/hosts
Редактируем файл mcedit /etc/ansible/ansible.cfg
(убрать решётку) inventory = /etc/ansible/hosts
(вписать) host_key_checking = False
ansible-galaxy collection install ansible.netcommon
ansible-galaxy collection install cisco.ios
apt-get install –y python3-module-pip
pip3 install ansible-pylibssh
HQ-RTR | BR-RTR:
security none
HQ-CLI:
systemctl enable --now sshd
на br-srv для проверки !ansible -m ping all!
!!!!!!!!!!!!!!!!!!!!!!!!!!!Веб-приложение testapp с использованием редств контейнеризации на сервере BR-SRV!!!!!!!!!!!!!!!!!!
apt-get install -y docker-engine docker-compose-v2
systemctl enable --now docker.service
mount /dev/sr0 /mnt/
docker load < /mnt/docker/site_latest.tar
docker load < /mnt/docker/mariadb_latest.tar
echo "services:
database:
container_name: db
image: mariadb:10.11
restart: always
ports:
- "3306:3306"
environment:
MARIADB_DATABASE: "testdb"
MARIADB_USER: "testc"
MARIADB_PASSWORD: "P@ssw0rd"
MARIADB_ROOT_PASSWORD: "toor"
app:
container_name: testapp
image: site:latest
restart: always
ports:
- "8080:8000"
environment:
DB_TYPE: "maria"
DB_HOST: "192.168.3.10"
DB_PORT: "3306"
DB_NAME: "testdb"
DB_USER: "testc"
DB_PASS: "P@ssw0rd"
depends_on:
- database" > /etc/docker/compose.yaml
cd /etc/docker
docker compose up -d
для проверки cli 192.168.3.10:8000
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Веб-приложение на сервере HQ-SRV!!!!!!!!!!!!!!!!!!!!!!!!!!!
HQ-SRV
apt-get install -y lamp-server
mount /dev/sr0 /mnt/
cp /mnt/web/index.php /var/www/html
cp /mnt/web/logo.png /var/www/html
редактируем
mcedit /var/www/html/index.php
$username = "webc";
$password = "P@ssw0rd";
$dbname = "webdb";
systemctl enable --now mariadb
mariadb -u root
CREATE DATABASE webdb;
CREATE USER 'webc'@'localhost' IDENTIFIED BY 'P@ssw0rd';
GRANT ALL PRIVILEGES ON webdb.* TO 'webc'@'localhost' WITH GRANT OPTION;
EXIT;
mariadb -u webc -p -D webdb < /mnt/web/dump.sql
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Конфигурация статической трансляции портов!!!!!!!!!!!!!!!!!!!!!!!
BR-RTR
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
sysctl -p
iptables -t nat -F
iptables -F FORWARD
iptables -t nat -A PREROUTING -i enp7s1 -p tcp --dport 8080 -j DNAT --to-destination 192.168.3.10:8080
iptables -t nat -A PREROUTING -i enp7s1 -p tcp --dport 2026 -j DNAT --to-destination 192.168.3.10:2026
iptables -t nat -A POSTROUTING -s 192.168.3.0/28 -o enp7s1 -j SNAT --to-source 172.16.2.10
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -d 192.168.3.10 -p tcp --dport 8080 -j ACCEPT
iptables -A FORWARD -d 192.168.3.10 -p tcp --dport 2026 -j ACCEPT
iptables-save > /etc/sysconfig/iptables
systemctl restart iptables
HQ-RTR
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
sysctl -p
iptables -t nat -F
iptables -F FORWARD
iptables -t nat -A PREROUTING -i enp7s1 -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.10:80
iptables -t nat -A PREROUTING -i enp7s1 -p tcp --dport 2026 -j DNAT --to-destination 192.168.1.10:2026
iptables -t nat -A POSTROUTING -s 192.168.1.0/27 -o enp7s1 -j SNAT --to-source 172.16.1.10
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -d 192.168.1.10 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.1.10 -p tcp --dport 2026 -j ACCEPT
iptables-save > /etc/sysconfig/iptables
systemctl restart iptables
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Настройка веб-сервера nginx как обратного прокси-сервера на ISP!!!!!!!!!!!!!!!!!
apt-get install -y nginx
echo "server {
listen 80;
server_name web.au-team.irpo;
location / {
proxy_pass http://172.16.1.10:8080;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
auth_basic "Restricted area";
auth_basic_user_file /etc/nginx/.htpasswd;
}
}
server {
listen 80;
server_name docker.au-team.irpo;
location / {
proxy_pass http://172.16.2.10:8080;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
}" > /etc/nginx/sites-available.d/default.conf
ln -s /etc/nginx/sites-available.d/default.conf /etc/nginx/sites-enabled.d/
systemctl enable --now nginx
HQ-CLI
echo "172.16.1.1 web.au-team.irpo
172.16.2.1 docker.au-team.irpo" >> /etc/hosts
Проверяем возможность доступа до веб ресурсов с браузера на клиенте:
http://web.au-team.irpo
http://docer.au-team.irpo
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Настройка на маршрутизаторе ISP web-based аутентификации!!!!!!!!!!!!!!!!!!!!!!!!!
ISP:
apt-get install -y apache2-htpasswd или
apt-get install -y apache2
htpasswd –c /etc/nginx/.htpasswd WEB
Добавить web-based аутентификацию для доступа к сайту web.au-team.irpo в конфигурационный файл /etc/nginx/sites-available.d/default.conf:
location / {
proxy_pass http://172.16.1.2:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
auth_basic "Restricted area";
auth_basic_user_file /etc/nginx/.htpasswd;
}
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Установка браузера на HQ-CLI!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
HQ-CLI:
apt-get install –y yandex-browser-stable