lvs

README.md

@@ -14,8 +14,8 @@ Pour chaque machine intéressante
         on taggue : git tag v.0.1
         on vérifie : git status
         on renvoie sur le dépôt amont : git push
-        on renvoie les tags : git push –tag
+        on renvoie les tags : git push --tag
         vérifier ensuite que les fichiers sont bien remontés sur le dépôt amont
-        exemple d'arborescence :
+       
 
 

sio1/02-dns/db.domaine.lan

@@ -0,0 +1,21 @@
+;
+; BIND data file for local loopback interface
+;
+$TTL    604800
+domaine.lan.       IN      SOA     srv1.domaine.lan. root.srv1.domaine.lan.  (
+                              2         ; Serial
+                         604800         ; Refresh
+                          86400         ; Retry
+                        2419200         ; Expire
+                         604800 )       ; Negative Cache TTL
+
+;
+
+	      NS      srv1.domaine.lan.
+srv1.domaine.lan.     A  192.168.0.29
+srv2.domaine.lan.     A  192.168.0.41
+
+$ORIGIN domaine.lan.
+poste1				A	192.168.0.22
+www				CNAME poste1.domaine.lan.
+

sio1/02-dns/db.domaine.lan.rev

@@ -0,0 +1,19 @@
+;
+; BIND data file for local loopback interface
+;
+$TTL    604800
+@       IN      SOA     srv1.domaine.lan. root.domaine.lan. (
+                     2021022600         ; Serial
+                         604800         ; Refresh
+                          86400         ; Retry
+                        2419200         ; Expire
+                         604800 )       ; Negative Cache TTL
+;
+        IN      NS      srv1.domaine.lan.
+srv1.domaine.lan. A	192.168.0.29
+srv2.domaine.lan. A	192.168.0.41
+
+29	IN      PTR	srv1.domaine.lan.
+22	IN	PTR	poste1.domaine.lan.	
+41	IN	PTR	srv2.domaine.lan.
+

sio1/02-dns/esclave/named.conf.local

@@ -0,0 +1,22 @@
+//
+// Do any local configuration here
+//
+
+// Consider adding the 1918 zones here, if they are not used in your
+// organization
+//include "/etc/bind/zones.rfc1918";
+zone "domaine.lan" {
+               type slave;
+               file "/etc/bind/db.domaine.lan";
+       masters { 192.168.0.29; };
+	masterfile-format text;  
+          };
+  
+  // zone inverse 
+  zone "0.168.192.in-addr.arpa" {
+       type slave;
+               notify no;
+               file "/etc/bind/db.domaine.lan.rev";
+      masters { 192.168.0.29; };
+      masterfile-format text;
+  };

sio1/02-dns/named.conf.local

@@ -0,0 +1,17 @@
+//
+// Do any local configuration here
+//
+
+// Consider adding the 1918 zones here, if they are not used in your
+// organization
+//include "/etc/bind/zones.rfc1918";
+zone "domaine.lan" {
+	type master;
+	file "/etc/bind/db.domaine.lan";
+};
+
+zone "0.168.192.in-addr.arpa" {
+	type master;
+	notify no;
+	file "/etc/bind/db.domaine.lan.rev";
+};		

sio1/02-dns/named.conf.options

@@ -0,0 +1,24 @@
+options {
+	directory "/var/cache/bind";
+
+	// If there is a firewall between you and nameservers you want
+	// to talk to, you may need to fix the firewall to allow multiple
+	// ports to talk.  See http://www.kb.cert.org/vuls/id/800113
+
+	// If your ISP provided one or more IP addresses for stable 
+	// nameservers, you probably want to use them as forwarders.  
+	// Uncomment the following block, and insert the addresses replacing 
+	// the all-0's placeholder.
+
+	 forwarders {
+	 192.168.0.1;
+	 };
+
+	//========================================================================
+	// If BIND logs error messages about the root key being expired,
+	// you will need to update your keys.  See https://www.isc.org/bind-keys
+	//========================================================================
+	dnssec-validation no;
+
+	listen-on-v6 { any; };
+};

sio1/ferm/tppf/fw.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+

sio1/ferm/tppf/fw1.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT

sio1/ferm/tppf/fw3.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
+iptables -A INPUT -p tcp --sport 80 -j ACCEPT
+
+iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+iptables -A INPUT -p udp --sport 53 -j ACCEPT
+
+iptables -A OUTPUT -p tcp -d 10.121.38.1 --dport 8080 -j ACCEPT
+iptables -A INPUT -p tcp -d 10.121.38.1 --sport 8080 -j ACCEPT

sio1/ferm/tppf/fw3.sh.save

@@ -0,0 +1,16 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT 

sio1/ferm/tppf/fw3.sh.save.1

@@ -0,0 +1,22 @@
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+iptables -A INPUT -p tcp -m multiport --dports 53,80,21 -j ACCEPT
+iptables -A OUTPUT -p tcp -m multiport --sports 53,80,21 -j ACCEPT
+
+

sio1/ferm/tppf/fw4.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+sysctl -w net.ipv4.ip_forward=1
+iptables -F -t filter
+iptables -F  nat
+
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD DROP
+
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
+iptables -A INPUT -p tcp --sport 80 -j ACCEPT
+
+iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+iptables -A INPUT -p udp --sport 53 -j ACCEPT
+
+iptables -A OUTPUT -p tcp -d 10.121.38.1 --dport 8080 -j ACCEPT
+iptables -A INPUT -p tcp -d 10.121.38.1 --sport 8080 -j ACCEPT
+
+iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
+iptables -A FORWARD -o enp0s3 -j ACCEPT
+iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+
+

sio2/sisr/05-lvs/lvs

@@ -0,0 +1,5 @@
+#!/bin/bash
+echo "1" > /proc/sys/net/ipv4/ip_forward
+ipvsadm -A -t 192.168.0.160:80 -s rr
+ipvsadm -a -t 192.168.0.160:80 -r 172.16.0.11:80 -m
+ipvsadm -a -t 192.168.0.160:80 -r 172.16.0.12:80 -m