10-PXE

README.md

@@ -14,8 +14,8 @@ Pour chaque machine intéressante
         on taggue : git tag v.0.1
         on vérifie : git status
         on renvoie sur le dépôt amont : git push
-        on renvoie les tags : git push –tag
+        on renvoie les tags : git push --tag
         vérifier ensuite que les fichiers sont bien remontés sur le dépôt amont
-        exemple d'arborescence :
+       
 
 

sio1/02-dns/db.domaine.lan

@@ -0,0 +1,21 @@
+;
+; BIND data file for local loopback interface
+;
+$TTL    604800
+domaine.lan.       IN      SOA     srv1.domaine.lan. root.srv1.domaine.lan.  (
+                              2         ; Serial
+                         604800         ; Refresh
+                          86400         ; Retry
+                        2419200         ; Expire
+                         604800 )       ; Negative Cache TTL
+
+;
+
+	      NS      srv1.domaine.lan.
+srv1.domaine.lan.     A  192.168.0.29
+srv2.domaine.lan.     A  192.168.0.41
+
+$ORIGIN domaine.lan.
+poste1				A	192.168.0.22
+www				CNAME poste1.domaine.lan.
+

sio1/02-dns/db.domaine.lan.rev

@@ -0,0 +1,19 @@
+;
+; BIND data file for local loopback interface
+;
+$TTL    604800
+@       IN      SOA     srv1.domaine.lan. root.domaine.lan. (
+                     2021022600         ; Serial
+                         604800         ; Refresh
+                          86400         ; Retry
+                        2419200         ; Expire
+                         604800 )       ; Negative Cache TTL
+;
+        IN      NS      srv1.domaine.lan.
+srv1.domaine.lan. A	192.168.0.29
+srv2.domaine.lan. A	192.168.0.41
+
+29	IN      PTR	srv1.domaine.lan.
+22	IN	PTR	poste1.domaine.lan.	
+41	IN	PTR	srv2.domaine.lan.
+

sio1/02-dns/esclave/named.conf.local

@@ -0,0 +1,22 @@
+//
+// Do any local configuration here
+//
+
+// Consider adding the 1918 zones here, if they are not used in your
+// organization
+//include "/etc/bind/zones.rfc1918";
+zone "domaine.lan" {
+               type slave;
+               file "/etc/bind/db.domaine.lan";
+       masters { 192.168.0.29; };
+	masterfile-format text;  
+          };
+  
+  // zone inverse 
+  zone "0.168.192.in-addr.arpa" {
+       type slave;
+               notify no;
+               file "/etc/bind/db.domaine.lan.rev";
+      masters { 192.168.0.29; };
+      masterfile-format text;
+  };

sio1/02-dns/named.conf.local

@@ -0,0 +1,17 @@
+//
+// Do any local configuration here
+//
+
+// Consider adding the 1918 zones here, if they are not used in your
+// organization
+//include "/etc/bind/zones.rfc1918";
+zone "domaine.lan" {
+	type master;
+	file "/etc/bind/db.domaine.lan";
+};
+
+zone "0.168.192.in-addr.arpa" {
+	type master;
+	notify no;
+	file "/etc/bind/db.domaine.lan.rev";
+};		

sio1/02-dns/named.conf.options

@@ -0,0 +1,24 @@
+options {
+	directory "/var/cache/bind";
+
+	// If there is a firewall between you and nameservers you want
+	// to talk to, you may need to fix the firewall to allow multiple
+	// ports to talk.  See http://www.kb.cert.org/vuls/id/800113
+
+	// If your ISP provided one or more IP addresses for stable 
+	// nameservers, you probably want to use them as forwarders.  
+	// Uncomment the following block, and insert the addresses replacing 
+	// the all-0's placeholder.
+
+	 forwarders {
+	 192.168.0.1;
+	 };
+
+	//========================================================================
+	// If BIND logs error messages about the root key being expired,
+	// you will need to update your keys.  See https://www.isc.org/bind-keys
+	//========================================================================
+	dnssec-validation no;
+
+	listen-on-v6 { any; };
+};

sio1/ferm/tppf/fw.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+

sio1/ferm/tppf/fw1.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT

sio1/ferm/tppf/fw3.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
+iptables -A INPUT -p tcp --sport 80 -j ACCEPT
+
+iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+iptables -A INPUT -p udp --sport 53 -j ACCEPT
+
+iptables -A OUTPUT -p tcp -d 10.121.38.1 --dport 8080 -j ACCEPT
+iptables -A INPUT -p tcp -d 10.121.38.1 --sport 8080 -j ACCEPT

sio1/ferm/tppf/fw3.sh.save

@@ -0,0 +1,16 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT 

sio1/ferm/tppf/fw3.sh.save.1

@@ -0,0 +1,22 @@
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+iptables -A INPUT -p tcp -m multiport --dports 53,80,21 -j ACCEPT
+iptables -A OUTPUT -p tcp -m multiport --sports 53,80,21 -j ACCEPT
+
+

sio1/ferm/tppf/fw4.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
+iptables -A INPUT -p tcp --sport 80 -j ACCEPT
+
+iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+iptables -A INPUT -p udp --sport 53 -j ACCEPT
+
+iptables -A OUTPUT -p tcp -d 10.121.38.1 --dport 8080 -j ACCEPT
+iptables -A INPUT -p tcp -d 10.121.38.1 --sport 8080 -j ACCEPT
+
+iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
+iptables -A FORWARD -o enp0s3 -j ACCEPT
+iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+
+

sio2/sisr/05-lvs/haproxy.cfg

@@ -0,0 +1,41 @@
+global
+	log /dev/log	local0
+	log /dev/log	local1 notice
+	chroot /var/lib/haproxy
+	stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
+	stats timeout 30s
+	user haproxy
+	group haproxy
+	daemon
+
+	# Default SSL material locations
+	ca-base /etc/ssl/certs
+	crt-base /etc/ssl/private
+
+	# See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
+        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+        ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
+
+defaults
+	log	global
+	mode	http
+	option	httplog
+	option	dontlognull
+        timeout connect 5000
+        timeout client  50000
+        timeout server  50000
+	errorfile 400 /etc/haproxy/errors/400.http
+	errorfile 403 /etc/haproxy/errors/403.http
+	errorfile 408 /etc/haproxy/errors/408.http
+	errorfile 500 /etc/haproxy/errors/500.http
+	errorfile 502 /etc/haproxy/errors/502.http
+	errorfile 503 /etc/haproxy/errors/503.http
+	errorfile 504 /etc/haproxy/errors/504.http
+listen httpProxy
+	bind 192.168.0.160:80
+	balance roundrobin
+	option httpclose
+	option httpchk HEAD / HTTP/1.0
+	server web1 172.16.0.11:80 check
+	server web2 172.16.0.12:80 check

sio2/sisr/05-lvs/lvs

@@ -0,0 +1,5 @@
+#!/bin/bash
+echo "1" > /proc/sys/net/ipv4/ip_forward
+ipvsadm -A -t 192.168.0.160:80 -s rr
+ipvsadm -a -t 192.168.0.160:80 -r 172.16.0.11:80 -m
+ipvsadm -a -t 192.168.0.160:80 -r 172.16.0.12:80 -m

sio2/sisr/05-lvs/recup

@@ -0,0 +1,5 @@
+#!/bin/bash
+while [ true ]
+do
+	curl -s http://192.168.0.160 -o /dev/null
+done

sio2/sisr/10-PXE/dhcpd.conf

@@ -0,0 +1,125 @@
+# dhcpd.conf
+#
+# Sample configuration file for ISC dhcpd
+#
+
+# option definitions common to all supported networks...
+option domain-name "example.org";
+option domain-name-servers ns1.example.org, ns2.example.org;
+
+default-lease-time 600;
+max-lease-time 7200;
+
+# The ddns-updates-style parameter controls whether or not the server will
+# attempt to do a DNS update when a lease is confirmed. We default to the
+# behavior of the version 2 packages ('none', since DHCP v2 didn't
+# have support for DDNS.)
+ddns-update-style none;
+
+# If this DHCP server is the official DHCP server for the local
+# network, the authoritative directive should be uncommented.
+#authoritative;
+
+# Use this to send dhcp log messages to a different log file (you also
+# have to hack syslog.conf to complete the redirection).
+#log-facility local7;
+
+# No service will be given on this subnet, but declaring it helps the 
+# DHCP server to understand the network topology.
+
+#subnet 10.152.187.0 netmask 255.255.255.0 {
+#}
+
+# This is a very basic subnet declaration.
+
+#subnet 10.254.239.0 netmask 255.255.255.224 {
+#  range 10.254.239.10 10.254.239.20;
+#  option routers rtr-239-0-1.example.org, rtr-239-0-2.example.org;
+#}
+
+# This declaration allows BOOTP clients to get dynamic addresses,
+# which we don't really recommend.
+
+#subnet 10.254.239.32 netmask 255.255.255.224 {
+#  range dynamic-bootp 10.254.239.40 10.254.239.60;
+#  option broadcast-address 10.254.239.31;
+#  option routers rtr-239-32-1.example.org;
+#}
+
+# A slightly different configuration for an internal subnet.
+#subnet 10.5.5.0 netmask 255.255.255.224 {
+#  range 10.5.5.26 10.5.5.30;
+#  option domain-name-servers ns1.internal.example.org;
+#  option domain-name "internal.example.org";
+#  option routers 10.5.5.1;
+#  option broadcast-address 10.5.5.31;
+#  default-lease-time 600;
+#  max-lease-time 7200;
+#}
+
+# Hosts which require special configuration options can be listed in
+# host statements.   If no address is specified, the address will be
+# allocated dynamically (if possible), but the host-specific information
+# will still come from the host declaration.
+
+#host passacaglia {
+#  hardware ethernet 0:0:c0:5d:bd:95;
+#  filename "vmunix.passacaglia";
+#  server-name "toccata.example.com";
+#}
+
+# Fixed IP addresses can also be specified for hosts.   These addresses
+# should not also be listed as being available for dynamic assignment.
+# Hosts for which fixed IP addresses have been specified can boot using
+# BOOTP or DHCP.   Hosts for which no fixed address is specified can only
+# be booted with DHCP, unless there is an address range on the subnet
+# to which a BOOTP client is connected which has the dynamic-bootp flag
+# set.
+#host fantasia {
+#  hardware ethernet 08:00:07:26:c0:a5;
+#  fixed-address fantasia.example.com;
+#}
+
+# You can declare a class of clients and then do address allocation
+# based on that.   The example below shows a case where all clients
+# in a certain class get addresses on the 10.17.224/24 subnet, and all
+# other clients get addresses on the 10.0.29/24 subnet.
+
+#class "foo" {
+#  match if substring (option vendor-class-identifier, 0, 4) = "SUNW";
+#}
+
+#shared-network 224-29 {
+#  subnet 10.17.224.0 netmask 255.255.255.0 {
+#    option routers rtr-224.example.org;
+#  }
+#  subnet 10.0.29.0 netmask 255.255.255.0 {
+#    option routers rtr-29.example.org;
+#  }
+#  pool {
+#    allow members of "foo";
+#    range 10.17.224.10 10.17.224.250;
+#  }
+#  pool {
+#    deny members of "foo";
+#    range 10.0.29.10 10.0.29.230;
+#  }
+#}
+default-lease-time 86400; # durée du bail en secondes
+max-lease-time 86400; 	 # durée du bail en secondes
+
+option domain-name-servers 192.168.0.1; # adr. des serveurs DNS
+option domain-name "sio.lan";		#nom du domaine DNS
+option netbios-name-servers 192.168.1.1;	# adr. du serveur WINS
+option netbios-node-type 8;	# type de noeud NetBios (WINS puis broadcast)
+
+subnet 192.168.1.0 netmask 255.255.255.0 {
+   option subnet-mask 255.255.255.0;
+   option broadcast-address 192.168.1.255;
+   option routers 192.168.1.1;  # passerelle par defaut
+   range 192.168.1.10 192.168.1.20;
+filename "pxelinux.0";
+next-server 192.168.1.1;  #serveur TFTP
+option subnet-mask 255.255.255.0; 
+option broadcast-address 192.168.1.255; 
+option routers 192.168.1.1; } 

sio2/sisr/10-PXE/install-bullseye

@@ -0,0 +1,4 @@
+YOURMIRROR=deb.debian.org
+DIST=bullseye
+ARCH=amd64
+wget http://"$YOURMIRROR"/debian/dists/"$DIST"/main/installer-"$ARCH"/current/images/netboot/netboot.tar.gz

sio2/sisr/10-PXE/isc-dhcp-server

@@ -0,0 +1,18 @@
+# Defaults for isc-dhcp-server (sourced by /etc/init.d/isc-dhcp-server)
+
+# Path to dhcpd's config file (default: /etc/dhcp/dhcpd.conf).
+DHCPDv4_CONF=/etc/dhcp/dhcpd.conf
+#DHCPDv6_CONF=/etc/dhcp/dhcpd6.conf
+
+# Path to dhcpd's PID file (default: /var/run/dhcpd.pid).
+DHCPDv4_PID=/var/run/dhcpd.pid
+#DHCPDv6_PID=/var/run/dhcpd6.pid
+
+# Additional options to start dhcpd with.
+#	Don't use options -cf or -pf here; use DHCPD_CONF/ DHCPD_PID instead
+#OPTIONS=""
+
+# On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
+#	Separate multiple interfaces with spaces, e.g. "eth0 eth1".
+INTERFACESv4="enp0s8"
+INTERFACESv6=""

sio2/sisr/10-PXE/nat.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+echo "1" > /proc/sys/net/ipv4/ip_forward
+sudo iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE