Ajout de certains fichiers du TP Ansible (Jusqu'au proxy).

Reviewed-on: #33

bts_annee_2/cyber2/vpn-ipsec/README.md

@@ -0,0 +1 @@
+Dossier avec les fichiers de configuration du tunnel IPsec fait en TP, ainsi que les IPs et tables de routage.

bts_annee_2/cyber2/vpn-ipsec/gw1/README.md

@@ -0,0 +1 @@
+Il faut renommer le fichier ipsec-gw1.conf en ipsec.conf et le placer dans /etc/ .

bts_annee_2/cyber2/vpn-ipsec/gw1/config_ip_gw1

@@ -0,0 +1,18 @@
+1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
+    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
+    inet 127.0.0.1/8 scope host lo
+       valid_lft forever preferred_lft forever
+    inet6 ::1/128 scope host noprefixroute 
+       valid_lft forever preferred_lft forever
+2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
+    link/ether 08:00:27:71:ec:44 brd ff:ff:ff:ff:ff:ff
+    inet 192.168.1.1/24 brd 192.168.1.255 scope global enp0s3
+       valid_lft forever preferred_lft forever
+    inet6 fe80::a00:27ff:fe71:ec44/64 scope link 
+       valid_lft forever preferred_lft forever
+3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
+    link/ether 08:00:27:c2:6d:0b brd ff:ff:ff:ff:ff:ff
+    inet 10.0.0.1/24 brd 10.0.0.255 scope global enp0s8
+       valid_lft forever preferred_lft forever
+    inet6 fe80::a00:27ff:fec2:6d0b/64 scope link 
+       valid_lft forever preferred_lft forever

bts_annee_2/cyber2/vpn-ipsec/gw1/ipsec-gw1.conf

@@ -0,0 +1,23 @@
+config setup
+        charondebug="all"
+        uniqueids=yes
+        strictcrlpolicy=no
+conn %default
+conn tunnel #
+        left=10.0.0.1
+        leftsubnet=192.168.1.0/24
+        right=10.0.0.2
+        rightsubnet=192.168.2.0/24
+        ike=aes256-sha2_256-modp1024!
+        esp=aes256-sha2_256!
+        keyingtries=0
+        ikelifetime=1h
+        lifetime=8h
+        dpddelay=30
+        dpdtimeout=120
+        dpdaction=restart
+        authby=secret
+        auto=start
+        keyexchange=ikev2
+        type=tunnel
+

bts_annee_2/cyber2/vpn-ipsec/gw1/table_routage_gw1

@@ -0,0 +1,3 @@
+10.0.0.0/24 dev enp0s8 proto kernel scope link src 10.0.0.1 
+192.168.1.0/24 dev enp0s3 proto kernel scope link src 192.168.1.1 
+192.168.2.0/24 via 192.168.1.1 dev enp0s3 

bts_annee_2/cyber2/vpn-ipsec/gw2/README.md

@@ -0,0 +1 @@
+Il faut renommer le fichier ipsec-gw2.conf en ipsec.conf et le placer dans /etc/ .

bts_annee_2/cyber2/vpn-ipsec/gw2/config_ip_gw2

@@ -0,0 +1,18 @@
+1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
+    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
+    inet 127.0.0.1/8 scope host lo
+       valid_lft forever preferred_lft forever
+    inet6 ::1/128 scope host noprefixroute 
+       valid_lft forever preferred_lft forever
+2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
+    link/ether 08:00:27:35:ba:6d brd ff:ff:ff:ff:ff:ff
+    inet 192.168.2.1/24 brd 192.168.2.255 scope global enp0s3
+       valid_lft forever preferred_lft forever
+    inet6 fe80::a00:27ff:fe35:ba6d/64 scope link 
+       valid_lft forever preferred_lft forever
+3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
+    link/ether 08:00:27:ea:8b:77 brd ff:ff:ff:ff:ff:ff
+    inet 10.0.0.2/24 brd 10.0.0.255 scope global enp0s8
+       valid_lft forever preferred_lft forever
+    inet6 fe80::a00:27ff:feea:8b77/64 scope link 
+       valid_lft forever preferred_lft forever

bts_annee_2/cyber2/vpn-ipsec/gw2/ipsec-gw2.conf

@@ -0,0 +1,23 @@
+config setup
+        charondebug="all"
+        uniqueids=yes
+        strictcrlpolicy=no
+conn %default
+conn tunnel #
+        left=10.0.0.2
+        leftsubnet=192.168.2.0/24
+        right=10.0.0.1
+        rightsubnet=192.168.1.0/24
+        ike=aes256-sha2_256-modp1024!
+        esp=aes256-sha2_256!
+        keyingtries=0
+        ikelifetime=1h
+        lifetime=8h
+        dpddelay=30
+        dpdtimeout=120
+        dpdaction=restart
+        authby=secret
+        auto=start
+        keyexchange=ikev2
+        type=tunnel
+

bts_annee_2/cyber2/vpn-ipsec/gw2/table_routage_gw2

@@ -0,0 +1,2 @@
+10.0.0.0/24 dev enp0s8 proto kernel scope link src 10.0.0.2 
+192.168.2.0/24 dev enp0s3 proto kernel scope link src 192.168.2.1 

bts_annee_2/sisr2/README.md

@@ -1,2 +1,2 @@
 Dépôt de seconde année de SISR.
-Chaque dossier porte le numéro de la séance associée.
+Chaque dossier porte le nom du sujet associé.

bts_annee_2/sisr2/ansible/README.md

@@ -0,0 +1,2 @@
+Fichier hosts utilisé pour ansible lors du TP de la séance 16.
+Sont inclus les fichiers idempotents .yml d'ansible que j'ai fait.

bts_annee_2/sisr2/ansible/hosts

@@ -0,0 +1,6 @@
+[adm]
+infra
+ 
+[web]
+web1
+web2

bts_annee_2/sisr2/ansible/squid.yml

@@ -0,0 +1,32 @@
+# squid.yml
+---
+- hosts: adm
+  vars:
+    - proxy_port: 8080
+    - proxy_mem: 128
+    - proxy_localnet: "192.168.0.0/24"
+
+  tasks:
+    - name: 1. Installe le proxy Squid sur la machine Infra.
+      apt:
+        name: squid
+        state: present
+
+# Uncomment this on FIRST RUN, comment afterwards !
+#    - name: 2. Récupère le fichier squid.conf.
+#      ansible.builtin.fetch:
+#        src: /etc/squid/squid.conf
+#        dest: squid.conf.j2
+#        flat: yes
+
+    - name: 3. Envoie squid.conf
+      template:
+        src: squid.conf.j2
+        dest: /etc/squid/squid.conf
+      notify: Restart squid
+  
+  handlers:
+    - name: Restart squid
+      service: 
+        name: squid
+        state: restarted

bts_annee_2/sisr2/ansible/syslog-cli.yml

@@ -0,0 +1,35 @@
+# syslog-cli.yml
+---
+- hosts: web
+  tasks:
+  - name: 1. Installe le paquet rsyslog.
+    apt: 
+      name: rsyslog
+      state: present
+
+  - name: 2. Ajoute la ligne pour forwarder les logs rsyslog au bon endroit.
+    lineinfile:
+      path: /etc/rsyslog.conf
+      line: '*.* @192.168.0.37:514'
+      create: yes
+    notify: Restart rsyslog
+
+  - name: 3. Forward les logs journald vers syslog.
+    replace:
+      path: /etc/systemd/journald.conf
+      regexp: '^#ForwardToSyslog=yes'
+      replace: 'ForwardToSyslog=yes'
+    notify: Restart journald
+
+  handlers:
+  - name: Restart rsyslog
+    service:
+      name: rsyslog
+      state: restarted
+
+  - name: Restart journald
+    service:
+      name: systemd-journald
+      state: restarted
+
+

bts_annee_2/sisr2/ansible/syslog.yml

@@ -0,0 +1,30 @@
+# syslog.yml
+---
+- hosts: adm
+  tasks:
+  - name: 1. Installe le paquet rsyslog.
+    apt: 
+      name: rsyslog
+      state: present
+
+  - name: 2. Active le module UDP sur le serveur syslog.
+    replace:
+      path: /etc/rsyslog.conf
+      regexp: '^#module\(load="imudp"\)'
+      replace: 'module(load="imudp")'
+    notify: Restart rsyslog
+
+  - name: 3. Active l'écoute sur le port UDP 514.
+    replace:
+      path: /etc/rsyslog.conf
+      regexp: '^#input\(type="imudp" port="514"\)'
+      replace: 'input(type="imudp" port="514")'
+    notify: Restart rsyslog
+
+  handlers:
+  - name: Restart rsyslog
+    service:
+      name: rsyslog
+      state: restarted
+
+

bts_annee_2/sisr2/ansible/web.yml

@@ -0,0 +1,21 @@
+# playbook.yml
+---
+- hosts: web
+  tasks:
+  - name: 1. installe Apache
+    apt: 
+      name: apache2
+      state: present
+  - name: 2. installe PHP pour Apache
+    apt:
+      name: php
+      state: present
+  - name: 3. installe php-mbstring
+    apt:
+      name: php-mbstring
+      state: present
+  - name: 4. installe index.html
+    copy:
+      src: index.html
+      dest: /var/www/html/index.html
+      mode: 0664