ajout ferm.conf

goss/list-goss

@@ -0,0 +1,12 @@
+cd goss/
+goss -g r-vp1.yaml v
+goss  -g r-vp1.yaml aa wireguard
+goss add interface enp0s3
+goss add interface enp0s8
+goss add interface enp0s9
+goss add interface wg0
+goss aa wireguard
+goss add package wireguard-tools
+goss add service wg-quick@wg0
+goss add command "ping -c4  10.0.0.2"
+goss add file "/etc/wireguard/wg0.conf"

roles/fw-ferm-1/ferm.conf

@@ -0,0 +1,63 @@
+# -*- shell-script -*-
+#
+# Ferm script r-vp1
+
+@def $DEV_PRIVATE = enp0s8;
+@def $DEV_WORLD = enp0s9;
+
+@def $NET_PRIVATE = 172.16.0.0/24;
+
+table filter {
+    chain (INPUT OUTPUT){
+        # allow VPN
+	proto udp dport 51820 ACCEPT;
+}
+    chain INPUT {
+        policy DROP;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # allow local connections
+        interface lo ACCEPT;
+
+        # respond to ping
+        proto icmp icmp-type echo-request ACCEPT;  
+       
+
+        # allow SSH connections from the private network and from some
+        # well-known internet hosts
+        saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
+
+        # we provide DNS and SMTP services for the internal net
+        interface $DEV_PRIVATE saddr $NET_PRIVATE {
+            proto (udp tcp) dport domain ACCEPT;
+            proto udp dport bootps ACCEPT;            
+        }
+
+        # interface réseau 
+        interface $DEV_WORLD {
+            
+        }
+
+        # the rest is dropped by the above policy
+    }#FIN INPUT
+
+    # outgoing connections are not limited
+    chain OUTPUT policy ACCEPT;
+
+    chain FORWARD {
+        policy ACCEPT;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # connections from the internal net to the internet or to other
+        # internal nets are allowed
+        interface $DEV_PRIVATE ACCEPT;
+
+        # the rest is dropped by the above policy
+    }
+}

roles/fw-ferm-1/nmap-rvp1.txt

@@ -0,0 +1,12 @@
+# CMD
+sudo nmap -pU:51820  192.168.0.51
+#Resultat
+Starting Nmap 7.80 ( https://nmap.org ) at 2023-01-27 09:02 CET
+Nmap scan report for 192.168.0.51
+Host is up (0.00030s latency).
+
+PORT      STATE    SERVICE
+51820/tcp filtered unknown
+MAC Address: 08:00:27:F0:E2:46 (Oracle VirtualBox virtual NIC)
+
+Nmap done: 1 IP address (1 host up) scanned in 0.36 seconds

roles/fw-ferm-2/ferm.conf

@@ -0,0 +1,62 @@
+# -*- shell-script -*-
+#
+# Ferm script r-vp2
+
+@def $DEV_PRIVATE = enp0s9;
+@def $DEV_WORLD = enp0s8;
+
+@def $NET_PRIVATE = 172.16.0.0/24;
+
+table filter {
+    chain (INPUT OUTPUT){
+        # allow VPN
+	proto udp dport 51820 ACCEPT;
+}
+    chain INPUT {
+        policy DROP;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # allow local connections
+        interface lo ACCEPT;
+
+        # respond to ping
+        proto icmp icmp-type echo-request ACCEPT;
+
+        # allow SSH connections from the private network and from some
+        # well-known internet hosts
+        saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
+
+        # we provide DNS and SMTP services for the internal net
+        interface $DEV_PRIVATE saddr $NET_PRIVATE {
+            proto (udp tcp) dport domain ACCEPT;
+            proto udp dport bootps ACCEPT;
+        }
+
+        # interface réseau
+        interface $DEV_WORLD {
+
+        }
+
+        # the rest is dropped by the above policy
+    }#FIN INPUT
+
+    # outgoing connections are not limited
+    chain OUTPUT policy ACCEPT;
+
+    chain FORWARD {
+        policy ACCEPT;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # connections from the internal net to the internet or to other
+        # internal nets are allowed
+        interface $DEV_PRIVATE ACCEPT;
+
+        # the rest is dropped by the above policy
+    }
+}

roles/fw-ferm-2/nmap-rvp2.txt

@@ -0,0 +1,9 @@
+Starting Nmap 7.80 ( https://nmap.org ) at 2023-01-27 09:33 CET
+Nmap scan report for 192.168.0.52
+Host is up (0.00021s latency).
+
+PORT      STATE    SERVICE
+51820/tcp filtered unknown
+MAC Address: 08:00:27:31:FA:71 (Oracle VirtualBox virtual NIC)
+
+Nmap done: 1 IP address (1 host up) scanned in 0.36 seconds

roles/lb-nfs-server/tasks/main.yml

@@ -1,77 +1,70 @@
-  - name: 00 - cree repertoire wordpress pour export nfs
-    file:
-      path: /exports/wordpress
-      state: directory
+- name: 00 - cree repertoire wordpress pour export nfs
+  file:
+    path: /home/wordpress
+    state: directory
 
-  - name: 05 - Install nfs-server
-    apt:
-      name: nfs-server
-      state: present
+- name: 05 - Install nfs-server
+  apt:
+    name: nfs-server
+    state: present
 
-  - name: 10 - creation fichier exports nfs  
-    ansible.builtin.blockinfile:
-      path: /etc/exports
-      block: |
-        /exports/wordpress 192.168.56.0/255.255.255.0 (rw,no_root_squash,subtree_check)
+- name: 10 - creation fichier exports nfs
+  ansible.builtin.blockinfile:
+    path: /etc/exports
+    block: |
+      /home/wordpress 192.168.102.0/255.255.255.0(rw,no_root_squash,subtree_check)
+
+- name: 20 - decompresse wordpress
+  unarchive:
+    src: https://fr.wordpress.org/latest-fr_FR.tar.gz
+    dest: /home/
+    remote_src: yes
+
+- name: 22 - change owner et group pour repertoire wordpress
+  file:
+    path: /home/wordpress
+    state: directory
+    recurse: yes
+    owner: www-data
+    group: www-data
+
+- name: 30 - genere fichier de config wordpress
+  copy:
+    src: /home/wordpress/wp-config-sample.php
+    dest: /home/wordpress/wp-config.php
+    remote_src: yes
+
+- name: 35 - ajuste variable dbname dans fichier de config wp-config.php
+  replace:
+    path: /home/wordpress/wp-config.php
+    regexp: "votre_nom_de_bdd"
+    replace: "wordpressdb"
+    backup: yes
 
 
-  - name: 15 - Recupere wordpress.tar.gz
-    get_url: 
-      url: "https://fr.wordpress.org/latest-fr_FR.tar.gz"
-      dest: /tmp/wordpress-6.1.1-fr_FR.tar.gz
+- name: 40 ajuste variable dbusername dans fichier de config wp-config.php
+  replace:
+    path: /home/wordpress/wp-config.php
+    regexp: "votre_utilisateur_de_bdd"
+    replace: "wordpressuser"
+    backup: yes
 
-  - name: 20 - decompresse wordpress 
-    unarchive: 
-      src: /tmp/wordpress-6.1.1-fr_FR.tar.gz
-      dest: /exports/
-      remote_src: yes  
-  
-  - name: 22 - change owner et group pour repertoire wordpress
-    file:
-      path: /exports/wordpress
-      state: directory
-      recurse: yes
-      owner: www-data
-      group: www-data
+- name: 45 - ajuste variable mdp dans fichier de config wp-config.php
+  replace:
+    path: /home/wordpress/wp-config.php
+    regexp: "votre_mdp_de_bdd"
+    replace: "wordpresspasswd"
+    backup: yes
 
-  - name: 30 - genere fichier de config wordpress 
-    copy: 
-      src: /exports/wordpress/wp-config-sample.php
-      dest: /exports/wordpress/wp-config.php
-      remote_src: yes  
-
-  - name: 35 - ajuste variable dbname dans fichier de config wp-config.php  
-    replace: 
-      path: /exports/wordpress/wp-config.php
-      regexp: "votre_nom_de_bdd"
-      replace: "wordpressdb"
-      backup: yes
-
-
-  - name: 40 ajuste variable dbusername dans fichier de config wp-config.php  
-    replace: 
-      path: /exports/wordpress/wp-config.php
-      regexp: "votre_utilisateur_de_bdd"
-      replace: "wordpressuser"
-      backup: yes
-  
-  - name: 45 - ajuste variable mdp dans fichier de config wp-config.php  
-    replace: 
-      path: /exports/wordpress/wp-config.php
-      regexp: "votre_mdp_de_bdd"
-      replace: "wordpresspasswd"
-      backup: yes
-
-  - name: 50 - ajuste hostname fichier wp-config.php  
-    replace: 
-      path: /exports/wordpress/wp-config.php
-      regexp: "localhost"
-      replace: "192.168.102.253"
-      backup: yes
-
-  - name: 55 - relance nfs
-    service:
-      name: nfs-server
-      state: restarted
-      enabled: yes
+- name: 50 - ajuste hostname fichier wp-config.php
+  replace:
+    path: /home/wordpress/wp-config.php
+    regexp: "localhost"
+    replace: "192.168.102.253"
+    backup: yes
 
+- name: 55 - relance nfs
+  service:
+    name: nfs-server
+    state: restarted
+    enabled: yes

roles/smb-backup/README.md

@@ -6,6 +6,13 @@ s-backup permet de récupérer les dossiers et fichiers présent dans le répert
 # Lancement du script backup.sh
 
 Après la fin de l'installation de s-backup et la fin de la configuration de s-win vous pouvez
-lancer le fichier backup.sh pour récuperer l'intégraliter du fichier partagé gsb.lan de s-win
+lancer le fichier backupsmb.sh pour récuperer l'intégraliter du fichier partagé gsb.lan de s-win
 sur la machine s-backup.
 
+# Crontab
+
+Une crontab a été ajoutée mais désactivée par défaut ( backupsmb.sh executée tout les jours à 5h00)
+
+# Pistes
+
+- Traps à consolider