Téléverser les fichiers vers "sisr1"

sisr1/README.md

@@ -1,12 +1,16 @@
-# sisr1
-
-Travaux pratiques de première année : option SISR
-
-**- tp01-nat-dhcp** : 
-  * configuration de base d'un serveur DHCP Debian 
-  * configuration simple d'un routeur NAT sous Debian avec **nftables**
-
-**- tp02-dns** : 
-  * configuration de serveurs DNS primaires et secondaires 
-  * configuration du service DHCP pour utiliser ces DNS
-  * automatisation du lancement du script NAT
+# sisr1
+
+Travaux pratiques de première année : option SISR
+
+**- tp01-nat-dhcp** : 
+  * configuration de base d'un serveur DHCP Debian 
+  * configuration simple d'un routeur NAT sous Debian avec **nftables**
+
+**- tp02-dns** : 
+  * configuration de serveurs DNS primaires et secondaires 
+  * configuration du service DHCP pour utiliser ces DNS
+  * automatisation du lancement du script NAT
+
+**_ tp03-reseau-prive** : 
+  * configuration DHCP sur le srv-service
+  

sisr1/tp03-reseau-prive/srv-admin/interfaces

@@ -0,0 +1,20 @@
+# This file describes the network interfaces available on your system
+# and how to activate them. For more information, see interfaces(5).
+
+source /etc/network/interfaces.d/*
+
+# The loopback network interface
+auto lo
+iface lo inet loopback
+
+# The primary network interface
+allow-hotplug enp0s3
+#iface enp0s3 inet dhcp
+iface enp0s3 inet static
+      address 192.168.0.140/24	
+      gateway 192.168.0.1
+
+allow-hotplug enp0s8
+iface enp0s8 inet dhcp
+#iface enp0s8 inet static
+#	address 172.16.0.2/24

sisr1/tp03-reseau-prive/srv-admin/nat.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+echo "1" > /proc/sys/net/ipv4/ip_forward
+nft add table basic_nat_table
+nft add chain basic_nat_table prerouting {type nat hook prerouting priority 0 \; }
+nft add chain basic_nat_table postrouting {type nat hook postrouting priority 0 \; }
+nft add rule basic_nat_table postrouting masquerade

sisr1/tp03-reseau-prive/srv-service/db.monlabo.lan

@@ -0,0 +1,27 @@
+;
+; BIND data file for local loopback interface
+;
+$TTL	604800
+@		IN SOA	srv-service.monlabo.lan.  root.srv-service.monlabo.lan. (
+			      2		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+		NS      srv-service.monlabo.lan.
+srv-service	A	 172.16.0.8
+srv-admin-el 	A	 172.16.0.2
+
+;
+
+
+srvdns		IN	CNAME srv-service.monlabo.lan.
+srvdns1		IN	CNAME srv-service.monlabo.lan.
+dns		IN	CNAME srv-service.monlabo.lan.
+dns1		IN	CNAME srv-service.monlabo.lan.
+srvdhcp		IN	CNAME srv-service.monlabo.lan.
+dhcp		IN	CNAME srv-service.monlabo.lan.
+	
+srv-admin    IN  CNAME srv-admin-el.monlabo.lan.
+router 	     IN  CNAME srv-admin-el.monlabo.lan.
+gateway	     IN  CNAME srv-admin-el.monlabo.lan.

sisr1/tp03-reseau-prive/srv-service/db.monlabo.lan.rev

@@ -0,0 +1,20 @@
+;
+; BIND data file for local loopback interface
+;
+$TTL	604800
+@		IN SOA	srv-service.monlabo.lan.  root.srv-service.monlabo.lan. (
+			      2		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+		NS      srv-service.monlabo.lan.
+
+
+
+
+srv-service	A 172.16.0.8
+2	IN	PTR 	srv-admin-el.monlabo.lan.
+8	IN	PTR	srv-service.monlabo.lan.
+
+	

sisr1/tp03-reseau-prive/srv-service/dhcpd.conf

@@ -0,0 +1,113 @@
+# dhcpd.conf
+#
+# Sample configuration file for ISC dhcpd
+#
+
+# option definitions common to all supported networks...
+#option domain-name "exmaple.org";
+#option domain-name-servers ns1.example.org, ns2.example.org;
+
+default-lease-time 600;
+max-lease-time 7200;
+
+# The ddns-updates-style parameter controls whether or not the server will
+# attempt to do a DNS update when a lease is confirmed. We default to the
+# behavior of the version 2 packages ('none', since DHCP v2 didn't
+# have support for DDNS.)
+ddns-update-style none;
+
+# If this DHCP server is the official DHCP server for the local
+# network, the authoritative directive should be uncommented.
+#authoritative;
+
+# Use this to send dhcp log messages to a different log file (you also
+# have to hack syslog.conf to complete the redirection).
+#log-facility local7;
+
+# No service will be given on this subnet, but declaring it helps the 
+# DHCP server to understand the network topology.
+
+#subnet 10.152.187.0 netmask 255.255.255.0 {
+#}
+
+# This is a very basic subnet declaration.
+
+subnet 172.16.0.0 netmask 255.255.255.0 {
+  range 172.16.0.50 172.16.0.150;
+  option routers 172.16.0.8;
+  option domain-name-servers 172.16.0.9;
+  option domain-name "monlabo.lan";
+}
+host srv-admin-el{
+	hardware ethernet 08:00:27:73:72:e9;
+	fixed-address 172.16.0.2;
+}
+
+# This declaration allows BOOTP clients to get dynamic addresses,
+# which we don't really recommend.
+
+#subnet 10.254.239.32 netmask 255.255.255.224 {
+#  range dynamic-bootp 10.254.239.40 10.254.239.60;
+#  option broadcast-address 10.254.239.31;
+#  option routers rtr-239-32-1.example.org;
+#}
+
+# A slightly different configuration for an internal subnet.
+#subnet 10.5.5.0 netmask 255.255.255.224 {
+#  range 10.5.5.26 10.5.5.30;
+#  option domain-name-servers ns1.internal.example.org;
+#  option domain-name "internal.example.org";
+#  option routers 10.5.5.1;
+#  option broadcast-address 10.5.5.31;
+#  default-lease-time 600;
+#  max-lease-time 7200;
+#}
+
+# Hosts which require special configuration options can be listed in
+# host statements.   If no address is specified, the address will be
+# allocated dynamically (if possible), but the host-specific information
+# will still come from the host declaration.
+
+#host passacaglia {
+#  hardware ethernet 0:0:c0:5d:bd:95;
+#  filename "vmunix.passacaglia";
+#  server-name "toccata.example.com";
+#}
+
+# Fixed IP addresses can also be specified for hosts.   These addresses
+# should not also be listed as being available for dynamic assignment.
+# Hosts for which fixed IP addresses have been specified can boot using
+# BOOTP or DHCP.   Hosts for which no fixed address is specified can only
+# be booted with DHCP, unless there is an address range on the subnet
+# to which a BOOTP client is connected which has the dynamic-bootp flag
+# set.
+#host fantasia {
+#  hardware ethernet 08:00:07:26:c0:a5;
+#  fixed-address fantasia.example.com;
+#}
+
+# You can declare a class of clients and then do address allocation
+# based on that.   The example below shows a case where all clients
+# in a certain class get addresses on the 10.17.224/24 subnet, and all
+# other clients get addresses on the 10.0.29/24 subnet.
+
+#class "foo" {
+#  match if substring (option vendor-class-identifier, 0, 4) = "SUNW";
+#}
+
+#shared-network 224-29 {
+#  subnet 10.17.224.0 netmask 255.255.255.0 {
+#    option routers rtr-224.example.org;
+#  }
+#  subnet 10.0.29.0 netmask 255.255.255.0 {
+#    option routers rtr-29.example.org;
+#  }
+#  pool {
+#    allow members of "foo";
+#    range 10.17.224.10 10.17.224.250;
+#  }
+#  pool {
+#    deny members of "foo";
+#    range 10.0.29.10 10.0.29.230;
+#  }
+#}

sisr1/tp03-reseau-prive/srv-service/named.conf

@@ -0,0 +1,11 @@
+// This is the primary configuration file for the BIND DNS server named.
+//
+// Please read /usr/share/doc/bind9/README.Debian for information on the
+// structure of BIND configuration files in Debian, *BEFORE* you customize
+// this configuration file.
+//
+// If you are just adding zones, please do that in /etc/bind/named.conf.local
+
+include "/etc/bind/named.conf.options";
+include "/etc/bind/named.conf.local";
+include "/etc/bind/named.conf.default-zones";

sisr1/tp03-reseau-prive/srv-service/named.conf.local

@@ -0,0 +1,8 @@
+//
+// Do any local configuration here
+//
+
+// Consider adding the 1918 zones here, if they are not used in your
+// organization
+//include "/etc/bind/zones.rfc1918";
+

sisr1/tp03-reseau-prive/srv-service/named.conf.options

@@ -0,0 +1,24 @@
+options {
+	directory "/var/cache/bind";
+
+	// If there is a firewall between you and nameservers you want
+	// to talk to, you may need to fix the firewall to allow multiple
+	// ports to talk.  See http://www.kb.cert.org/vuls/id/800113
+
+	// If your ISP provided one or more IP addresses for stable 
+	// nameservers, you probably want to use them as forwarders.  
+	// Uncomment the following block, and insert the addresses replacing 
+	// the all-0's placeholder.
+
+	// forwarders {
+	// 	0.0.0.0;
+	// };
+
+	//========================================================================
+	// If BIND logs error messages about the root key being expired,
+	// you will need to update your keys.  See https://www.isc.org/bind-keys
+	//========================================================================
+	dnssec-validation auto;
+
+	listen-on-v6 { any; };
+};

sisr1/tp04-scripts-admin/Users.csv

@@ -0,0 +1,30 @@
+Ermengarde,Berthelmot,eberthelmot0@webmd.com,Female,Accountant,
+Kassi,Bunker,kbunker1@xinhuanet.com,Female,Production,
+Moises,McCallum,mmccallum2@i2i.jp,Male,Production,
+Patrizio,Lune,plune3@upenn.edu,Male,Accountant,
+Blanch,Everix,beverix4@php.net,Female,Accountant,
+Stafani,Kibbel,skibbel5@marriott.com,Female,Production,
+Ignacius,Mosdell,imosdell6@cloudflare.com,Male,Management,
+Jeana,Waller-Bridge,jwallerbridge7@mapy.cz,Female,Management,
+Elroy,Dressel,edressel8@opera.com,Male,Production,
+Thea,Strettell,tstrettell9@nature.com,Female,Production,
+Solomon,Insoll,sinsolla@utexas.edu,Male,Accountant,
+Carri,Feedome,cfeedomeb@ask.com,Female,Accountant,
+Padraic,Chetwind,pchetwindc@last.fm,Male,Management,
+Solly,D'Ugo,sdugod@uiuc.edu,Male,Production,
+Konstanze,MacCostigan,kmaccostigane@seattletimes.com,Female,Accountant,
+Roxane,Powlesland,rpowleslandf@pcworld.com,Female,Management,
+Orelle,Kennealy,okennealyg@arstechnica.com,Female,Production,
+Sukey,Soitoux,ssoitouxh@shinystat.com,Female,Production,
+Nelli,Syce,nsycei@blogger.com,Female,Production,
+Clarisse,Shillam,cshillamj@dailymotion.com,Female,Production,
+Carin,Gueny,cguenyk@naver.com,Female,Management,
+Donny,Riepel,driepell@addtoany.com,Male,Production,
+Daniella,Ralfe,dralfem@wunderground.com,Female,Production,
+Lexy,Clynmans,lclynmansn@furl.net,Female,Production,
+Gardiner,Adamthwaite,gadamthwaiteo@spotify.com,Male,Production,
+Woodman,Lippett,wlippettp@purevolume.com,Male,Production,
+Nadya,Munnion,nmunnionq@flavors.me,Female,Production,
+Llewellyn,Habershon,lhabershonr@alibaba.com,Male,Production,
+Isaak,Greatrex,igreatrexs@seesaa.net,Male,Production,
+Darill,Frostdyke,dfrostdyket@cafepress.com,Male,Production,

sisr1/tp04-scripts-admin/createGroups.sh

@@ -0,0 +1,12 @@
+#!bin/bash
+fichier=./Users.csv
+
+while read ligne    #définit la variable "ligne" comme le contenu de la ligne du fichier en cours de lecture
+do
+  metier=$(echo $ligne | cut -d "," -f5) # A chaque itération, stocker le métier dans $metier
+  if [[ $(echo $user_line | grep $metier /etc/group) == "" ]] ; then
+    groupadd $metier
+fi
+
+  echo $metier
+done < $fichier                                                                                                                                                                                                                                                                                                                                                                                                                             

sisr1/tp04-scripts-admin/createLogin.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+fichier_a_lire=./Users.csv
+fichier_a_ecrire=./login.csv    #creation du fichier alire +stockage dans cette variable
+rm $fichier_a_ecrire 2> /dev/null #supprimer le fichier avant dexcuter le scripts
+touch $fichier_a_ecrire
+
+
+
+
+while read line        #définit la variable "ligne" comme le contenu de la ligne du fichier                en cours de lecture
+do
+ aecrire=" "
+   last_name=$(echo $ligne | cut -d "," -f2)
+   first_name=$(echo $ligne | cut -d "," -f1)
+   login=$(echo $first_name| cut -c1)$last_name
+   login=$(echo $login | tr [:upper:] [:lower:])
+   login=$(echo $login | tr -dc [:alnum:])
+   password=$(tr -dc '12345!@#$%^&*()_A-Z-a-z-0-9'</dev/urandom| head -c8
+   group=$(echo $ligne | cut -d "," -f5)
+   aecrire="$login;$password;$first_name;$last_name;
+   $group"
+
+
+   echo $aecrire >> $fichier_a_ecrire
+   done < $fichier_a_lire

sisr1/tp04-scripts-admin/createUser.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+fichier_a_lire=./Users.csv
+
+
+while read ligne        #définit la variable "ligne" comme le contenu de la ligne du fichier                en cours de lecture
+do 
+   username=$(echo $ligne | cut -d ";" -f1)
+   useradd -m -s "/bin/bash" $username
+
+   group=$(echo $ligne | cut -d "," -f5)
+   usermod -aG $group $username
+
+   passwd=$(echo $ligne | cut -d ";" -f2)
+   echo $username:$passwd | chpasswd
+   chown $username:$username /home/$username
+  
+   done < $fichier_a_lire

sisr1/tp04-scripts-admin/deployUsers.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+ip=$1
+workdir=/root/deploy
+
+ssh $user@$ip "mkdir $workdir" 2> /dev/null
+
+scp createGroups.sh $user$ip:$workdir
+scp createUser.sh $user$ip:$workdir
+scp login.csv $user$ip:$workdir
+scp Users.csv $user$ip:$workdir
+
+# exécution des scripts
+ssh $user@$ip "bash $workdir/createGroups.sh"
+ssh $user@$ip "bash $workdir/createUsers.sh"
+
+
+ssh root@$ip "rm -R $workdir" # suppression répertoire et scripts
+
+
+

sisr1/tp04-scripts-admin/gitpush.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+message=$1
+git add
+git commit -m "$message"
+git push -u https://elio.lafourcade@gitea.lyc-lecastel.fr/elio.lafourcade/siotp.git

sisr1/utiliser

@@ -0,0 +1,4 @@
+root@172.16.0.8:/etc/bind/db.monlabo.lan
+root@172.16.0.8:/etc/bind/db.monlabo.lan.rev
+root@172.16.0.8:/etc/dhcp/dhcpd.conf
+root@172.16.0.8/etc/dhcp/named.conf