Actualiser sisr2/sisr/README.md

README.md

@@ -4,3 +4,4 @@ Dépôt de suivi des fichiers de configuration réalisés au cours du BTS SIO
 
 **sisr1** : enseignement SISR, première année
 
+**sisr2** : enseignement SISR, deuxième année

sisr-qj/qj09/get_last_connexion.sh

@@ -1,40 +0,0 @@
-#!/bin/bash
-
-    # Affectation du nom d'utilisateur passé en paramètre à la variable "username"
-#[...]
-username=$1
-    # extraction de la ligne correspondante du fichier de logs
-user_line=$(grep $username ./logs_access.txt)
-    # Création d'une variable comprenant les groupes recherchés
-groups=""
-    # Vérification de la présence du groupe sudo -> ajout de la fonction "administrateur" à $groups
-if [[ $(echo $user_line | grep "sudo") != "" ]] ; then
-    groups=$groups" administrateur "
-fi
-    # Vérification de la présence du groupe slam -> ajout de la fonction "développeur" à $groups
-#[...]
-if [[ $(echo $user_line | grep "slam") != "" ]] ; then
-    groups=$groups" développeur "
-fi
-    # Vérification de la présence du groupe sisr -> ajout de la fonction "technicien" à $groups
-#[...]
-if [[ $(echo $user_line | grep "sisr") != "" ]] ; then
-    groups=$groups" technicien "
-fi
-    # récupération du champ date + temps
-date_time=$(echo $user_line | cut -d ":" -f4)
-    # récupération des champs dates (format US) et temps dans deux variables distinctes
-date_us=$(echo $date_time | cut -d "_" -f1)
-#[...]
-time_us=$(echo $date_time | cut -d "_" -f2)
-    # extraction de chaque information utile de ces champs
-day=$(echo $date_us | cut -d "/" -f3)
-month=$(echo $date_us | cut -d "/" -f2)
-#[...]
-year=$(echo $date_us | cut -d "/" -f1)
-hours=$(echo $time_us | cut -d "-" -f1)
-min=$(echo $time_us | cut -d "-" -f2)
-sec=$(echo $time_us | cut -d "-" -f3)
-    # affichage du message
-#[...]
-echo "L'utilisateur $username est membre de(s) groupe(s)  $groups  et sa dernière connexion remonte au $day/$month/$year à $hours h $min min et $sec sec."

sisr-qj/qj09/logs_access.txt

@@ -1,5 +0,0 @@
-admin:1000:users,sudo:24/10/07_21-41-28
-jibril:1001:users,eleves_sio,slam:24/09/29_07-46-51
-lea:1002:users,sudo,sisr:24/12/14_18-31-27
-mona:1003:users,eleves_sio,sisr:24/10/05_15-30-23
-luc:1004:users,eleves_sio,slam:24/10/02_12-14-50

sisr2/sisr/20-LB/haproxy.cfg

@@ -0,0 +1,51 @@
+global
+	log /dev/log	local0
+	log /dev/log	local1 notice
+	chroot /var/lib/haproxy
+	stats socket /run/haproxy/admin.sock mode 660 level admin
+	stats timeout 30s
+	user haproxy
+	group haproxy
+	daemon
+
+	# Default SSL material locations
+	ca-base /etc/ssl/certs
+	crt-base /etc/ssl/private
+
+	# See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
+        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+        ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
+
+defaults
+	log	global
+	mode	http
+	option	httplog
+	option	dontlognull
+        timeout connect 5000
+        timeout client  50000
+        timeout server  50000
+	errorfile 400 /etc/haproxy/errors/400.http
+	errorfile 403 /etc/haproxy/errors/403.http
+	errorfile 408 /etc/haproxy/errors/408.http
+	errorfile 500 /etc/haproxy/errors/500.http
+	errorfile 502 /etc/haproxy/errors/502.http
+	errorfile 503 /etc/haproxy/errors/503.http
+	errorfile 504 /etc/haproxy/errors/504.http
+
+# définir l'avant-tête (n'importe quel nom est OK pour [http-in)
+frontend http-in
+        # Écouter sur 80 ports
+        bind *:80
+        # Délimiter le retrait par défaut
+        default_backend    backend_servers
+        # Envoyer l'en-tête X-Forwarded-For
+        option             forwardfor
+
+# définir le backend
+backend backend_servers
+        # équilibre avec la arrondie
+        balance            roundrobin
+        # définir des serveurs dorsaux
+        server             web1 172.16.1.1:80 check
+        server             web2 172.16.1.2:80 check

sisr2/sisr/20-LB/lvs.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# Installation du paquet ipvsadm
+sudo apt update && sudo apt upgrade -y
+sudo apt install ipvsadm
+
+# Activation du routage
+sudo sysctl -w net.ipv4.ip_forward=1
+
+# Création du cluster
+sudo ipvsadm -A -t 192.168.0.160:80 -s rr
+
+# Ajout des serveurs réels au cluster
+sudo ipvsadm -a -t 192.168.0.160:80 -r 172.16.1.1:80 -m
+sudo ipvsadm -a -t 192.168.0.160:80 -r 172.16.1.2:80 -m

sisr2/sisr/25-pxe/README.md

@@ -0,0 +1,9 @@
+# séance 7 : PXE/déploiement automatisé de machines
+
+**nat.sh** : Activation du routage NAT
+
+**dhcpd.conf** : Configuration du dhcp
+
+**isc-dhcp-server** : Activation tout ce qui concerne IPV4
+
+**enp0s3 et enp0s8** : Cartes réseaux

sisr2/sisr/25-pxe/dhcpd.conf

@@ -0,0 +1,110 @@
+# dhcpd.conf
+#
+# Sample configuration file for ISC dhcpd
+#
+
+# option definitions common to all supported networks...
+option domain-name "example.org";
+option domain-name-servers ns1.example.org, ns2.example.org;
+
+default-lease-time 600;
+max-lease-time 7200;
+
+# The ddns-updates-style parameter controls whether or not the server will
+# attempt to do a DNS update when a lease is confirmed. We default to the
+# behavior of the version 2 packages ('none', since DHCP v2 didn't
+# have support for DDNS.)
+ddns-update-style none;
+
+# If this DHCP server is the official DHCP server for the local
+# network, the authoritative directive should be uncommented.
+#authoritative;
+
+# Use this to send dhcp log messages to a different log file (you also
+# have to hack syslog.conf to complete the redirection).
+#log-facility local7;
+
+# No service will be given on this subnet, but declaring it helps the 
+# DHCP server to understand the network topology.
+
+#subnet 10.152.187.0 netmask 255.255.255.0 {
+#}
+
+# This is a very basic subnet declaration.
+
+#subnet 10.254.239.0 netmask 255.255.255.224 {
+#  range 10.254.239.10 10.254.239.20;
+#  option routers rtr-239-0-1.example.org, rtr-239-0-2.example.org;
+#}
+
+# This declaration allows BOOTP clients to get dynamic addresses,
+# which we don't really recommend.
+
+subnet 192.168.1.0 netmask 255.255.255.0 {
+  range 192.168.1.10 192.168.1.20;
+  option domain-name-servers 10.121.38.7;
+  option broadcast-address 192.168.1.255;
+  option routers 192.168.1.1;
+  next-server 192.168.1.1;
+  filename "pxelinux.0";
+}
+
+# A slightly different configuration for an internal subnet.
+#subnet 10.5.5.0 netmask 255.255.255.224 {
+#  range 10.5.5.26 10.5.5.30;
+#  option domain-name-servers ns1.internal.example.org;
+#  option domain-name "internal.example.org";
+#  option routers 10.5.5.1;
+#  option broadcast-address 10.5.5.31;
+#  default-lease-time 600;
+#  max-lease-time 7200;
+#}
+
+# Hosts which require special configuration options can be listed in
+# host statements.   If no address is specified, the address will be
+# allocated dynamically (if possible), but the host-specific information
+# will still come from the host declaration.
+
+#host passacaglia {
+#  hardware ethernet 0:0:c0:5d:bd:95;
+#  filename "vmunix.passacaglia";
+#  server-name "toccata.example.com";
+#}
+
+# Fixed IP addresses can also be specified for hosts.   These addresses
+# should not also be listed as being available for dynamic assignment.
+# Hosts for which fixed IP addresses have been specified can boot using
+# BOOTP or DHCP.   Hosts for which no fixed address is specified can only
+# be booted with DHCP, unless there is an address range on the subnet
+# to which a BOOTP client is connected which has the dynamic-bootp flag
+# set.
+#host fantasia {
+#  hardware ethernet 08:00:07:26:c0:a5;
+#  fixed-address fantasia.example.com;
+#}
+
+# You can declare a class of clients and then do address allocation
+# based on that.   The example below shows a case where all clients
+# in a certain class get addresses on the 10.17.224/24 subnet, and all
+# other clients get addresses on the 10.0.29/24 subnet.
+
+#class "foo" {
+#  match if substring (option vendor-class-identifier, 0, 4) = "SUNW";
+#}
+
+#shared-network 224-29 {
+#  subnet 10.17.224.0 netmask 255.255.255.0 {
+#    option routers rtr-224.example.org;
+#  }
+#  subnet 10.0.29.0 netmask 255.255.255.0 {
+#    option routers rtr-29.example.org;
+#  }
+#  pool {
+#    allow members of "foo";
+#    range 10.17.224.10 10.17.224.250;
+#  }
+#  pool {
+#    deny members of "foo";
+#    range 10.0.29.10 10.0.29.230;
+#  }
+#}

sisr2/sisr/25-pxe/enp0s3

@@ -0,0 +1,3 @@
+# generated by FAI
+auto enp0s3
+iface enp0s3 inet dhcp

sisr2/sisr/25-pxe/enp0s8

@@ -0,0 +1,5 @@
+# generated by FAI
+auto enp0s8
+iface enp0s8 inet static
+	address 192.168.1.1/24
+	post-up bash /root/nat.sh

sisr2/sisr/25-pxe/isc-dhcp-server

@@ -0,0 +1,18 @@
+# Defaults for isc-dhcp-server (sourced by /etc/init.d/isc-dhcp-server)
+
+# Path to dhcpd's config file (default: /etc/dhcp/dhcpd.conf).
+DHCPDv4_CONF=/etc/dhcp/dhcpd.conf
+#DHCPDv6_CONF=/etc/dhcp/dhcpd6.conf
+
+# Path to dhcpd's PID file (default: /var/run/dhcpd.pid).
+DHCPDv4_PID=/var/run/dhcpd.pid
+#DHCPDv6_PID=/var/run/dhcpd6.pid
+
+# Additional options to start dhcpd with.
+#	Don't use options -cf or -pf here; use DHCPD_CONF/ DHCPD_PID instead
+#OPTIONS=""
+
+# On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
+#	Separate multiple interfaces with spaces, e.g. "eth0 eth1".
+INTERFACESv4="enp0s8"
+#INTERFACESv6=""

sisr2/sisr/25-pxe/nat.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+IFEXT=enp0s3
+echo "1" > /proc/sys/net/ipv4/ip_forward
+iptables -F -t nat
+iptables -t nat -A POSTROUTING -o "${IFEXT}" -j MASQUERADE
+exit 0

sisr2/sisr/README.md

@@ -0,0 +1 @@
+# Dépôt tp de SISR 2ème année