haproxy

README.md

@@ -14,8 +14,8 @@ Pour chaque machine intéressante
         on taggue : git tag v.0.1
         on vérifie : git status
         on renvoie sur le dépôt amont : git push
-        on renvoie les tags : git push –tag
+        on renvoie les tags : git push --tag
         vérifier ensuite que les fichiers sont bien remontés sur le dépôt amont
-        exemple d'arborescence :
+       
 
 

sio1/02-dns/esclave/named.conf.local

@@ -0,0 +1,22 @@
+//
+// Do any local configuration here
+//
+
+// Consider adding the 1918 zones here, if they are not used in your
+// organization
+//include "/etc/bind/zones.rfc1918";
+zone "domaine.lan" {
+               type slave;
+               file "/etc/bind/db.domaine.lan";
+       masters { 192.168.0.29; };
+	masterfile-format text;  
+          };
+  
+  // zone inverse 
+  zone "0.168.192.in-addr.arpa" {
+       type slave;
+               notify no;
+               file "/etc/bind/db.domaine.lan.rev";
+      masters { 192.168.0.29; };
+      masterfile-format text;
+  };

sio1/ferm/tppf/fw.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+

sio1/ferm/tppf/fw1.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT

sio1/ferm/tppf/fw3.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
+iptables -A INPUT -p tcp --sport 80 -j ACCEPT
+
+iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+iptables -A INPUT -p udp --sport 53 -j ACCEPT
+
+iptables -A OUTPUT -p tcp -d 10.121.38.1 --dport 8080 -j ACCEPT
+iptables -A INPUT -p tcp -d 10.121.38.1 --sport 8080 -j ACCEPT

sio1/ferm/tppf/fw3.sh.save

@@ -0,0 +1,16 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT 

sio1/ferm/tppf/fw3.sh.save.1

@@ -0,0 +1,22 @@
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+iptables -A INPUT -p tcp -m multiport --dports 53,80,21 -j ACCEPT
+iptables -A OUTPUT -p tcp -m multiport --sports 53,80,21 -j ACCEPT
+
+

sio1/ferm/tppf/fw4.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
+iptables -A INPUT -p tcp --sport 80 -j ACCEPT
+
+iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+iptables -A INPUT -p udp --sport 53 -j ACCEPT
+
+iptables -A OUTPUT -p tcp -d 10.121.38.1 --dport 8080 -j ACCEPT
+iptables -A INPUT -p tcp -d 10.121.38.1 --sport 8080 -j ACCEPT
+
+iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
+iptables -A FORWARD -o enp0s3 -j ACCEPT
+iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+
+

sio2/sisr/05-lvs/haproxy.cfg

@@ -0,0 +1,41 @@
+global
+	log /dev/log	local0
+	log /dev/log	local1 notice
+	chroot /var/lib/haproxy
+	stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
+	stats timeout 30s
+	user haproxy
+	group haproxy
+	daemon
+
+	# Default SSL material locations
+	ca-base /etc/ssl/certs
+	crt-base /etc/ssl/private
+
+	# See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
+        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+        ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
+
+defaults
+	log	global
+	mode	http
+	option	httplog
+	option	dontlognull
+        timeout connect 5000
+        timeout client  50000
+        timeout server  50000
+	errorfile 400 /etc/haproxy/errors/400.http
+	errorfile 403 /etc/haproxy/errors/403.http
+	errorfile 408 /etc/haproxy/errors/408.http
+	errorfile 500 /etc/haproxy/errors/500.http
+	errorfile 502 /etc/haproxy/errors/502.http
+	errorfile 503 /etc/haproxy/errors/503.http
+	errorfile 504 /etc/haproxy/errors/504.http
+listen httpProxy
+	bind 192.168.0.160:80
+	balance roundrobin
+	option httpclose
+	option httpchk HEAD / HTTP/1.0
+	server web1 172.16.0.11:80 check
+	server web2 172.16.0.12:80 check

sio2/sisr/05-lvs/lvs

@@ -0,0 +1,5 @@
+#!/bin/bash
+echo "1" > /proc/sys/net/ipv4/ip_forward
+ipvsadm -A -t 192.168.0.160:80 -s rr
+ipvsadm -a -t 192.168.0.160:80 -r 172.16.0.11:80 -m
+ipvsadm -a -t 192.168.0.160:80 -r 172.16.0.12:80 -m

sio2/sisr/05-lvs/recup

@@ -0,0 +1,5 @@
+#!/bin/bash
+while [ true ]
+do
+	curl -s http://192.168.0.160 -o /dev/null
+done