commit glpi

ansible/roles/doku/tasks/main.yml

@@ -6,7 +6,7 @@
 - name: Extraction archive
   unarchive:
     src: /tmp/dokuwiki-stable.tgz
-    dest: /var/www/html/
+    dest: /var/www/html
     remote_src: yes
 
 - name: stat rept
@@ -16,7 +16,7 @@
 
 - name: Renommage de dokuwiki-stable
   command: mv /var/www/html/dokuwiki-2020-07-29 /var/www/html/doku
-  when: not rept_stat.stat.exists
+  when: rept_stat.stat.exists
 
 - name: Droit root recursive
   file: 

glpi/ansible/glpi.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  connection: local
+  roles:
+    - glpi

glpi/ansible/roles/glpi/defaults/main.yml

@@ -0,0 +1,10 @@
+depl_url: "http://depl/store"
+glpi_tgz: "glpi-9.5.7.tgz"
+fusion: "fusioninventory-9.5+3.0.tar.bz2"
+fusion64: "fusioninventory-agent_windows-x64_2.6.exe"
+glpi_dir: "/var/www/html/glpi"
+glpi_dbhost: "127.0.0.1"
+glpi_dbname: "glpi"
+glpi_dbuser: "glpi"
+glpi_dbpasswd: "glpi"
+

glpi/ansible/roles/glpi/files/glpi.conf

@@ -0,0 +1,12 @@
+DocumentRoot /var/www/glpi
+        <Directory /var/www/glpi>
+                Options Indexes FollowSymLinks MultiViews
+                AllowOverride All
+                Order allow,deny
+                allow from all
+                AuthType Basic
+        </Directory>
+
+        LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined
+        CustomLog ${APACHE_LOG_DIR}/glpi_access.log combined
+        ErrorLog  ${APACHE_LOG_DIR}/glpi_error.log

glpi/ansible/roles/glpi/files/my.cnf

@@ -0,0 +1,3 @@
+[client]
+user=root
+password=root

glpi/ansible/roles/glpi/handlers/main.yml

@@ -0,0 +1,18 @@
+---
+- name: restart php-fpm
+  service:
+    name: php-fpm
+    state: restarted
+    enabled: yes
+
+- name: restart nginx
+  service:
+    name: nginx
+    state : restarted
+    enabled: yes  
+
+- name: restart mariadb-server
+  service: 
+    name: mariadb-server
+    state: restarted
+    enabled: yes

glpi/ansible/roles/glpi/tasks/main.yml

@@ -0,0 +1,132 @@
+---
+  - name: Installation des paquets
+    apt:
+      name:
+        - nginx
+        - php-fpm
+        - php-mbstring
+        - php-mysql
+        - php-gd
+        - php-curl
+        - php-xml
+        - php-apcu
+        - php-ldap
+        - php-imap
+        - php-xmlrpc
+        - php-cas
+        - python3-mysqldb
+        - mariadb-server
+        - python3-pymysql
+        - php-intl
+        - php-bz2
+        - php-zip
+        - postfix
+        - mailutils
+      state: present
+
+  - name: Changement listen dans le fichier conf de php
+    replace:
+      dest: /etc/php/7.4/fpm/pool.d/www.conf
+      regexp: 'listen = /run/php/php7.4-fpm.sock'
+      replace: 'listen = 127.0.0.1:9000'
+      backup: yes
+
+  - name: Effacement block nginx default
+    file:
+      path: /etc/nginx/sites-enabled/default 
+      state: absent
+
+  - name: Creation fichier block nginx
+    template: 
+      src: block.j2 
+      dest: /etc/nginx/sites-enabled/glpi
+
+  - name: Remplacement dans le fichier de conf php du timeout
+    replace:
+      dest: /etc/php/7.4/fpm/php.ini
+      regexp: 'max_execution_time = 30'
+      replace: 'max_execution_time = 600'
+      backup: yes
+
+    notify:
+      - restart nginx
+
+  - name: Creation de la base de donnee mysql
+    mysql_db:
+      name: "{{ glpi_dbname }}"
+      check_implicit_admin: yes
+      state: present
+      login_unix_socket: /var/run/mysqld/mysqld.sock
+
+  - name: Creation de l'utilisateur mysql avec tous les privileges
+    mysql_user:
+      user: "{{ glpi_dbuser }}"
+      password: "{{ glpi_dbpasswd }}"
+      priv: "*.*:ALL,GRANT"
+      login_unix_socket: /var/run/mysqld/mysqld.sock
+      state: present
+
+  - name: Creation du repertoire {{ glpi_dir }}
+    file: 
+      path: "{{ glpi_dir }}"
+      state: directory
+      owner: www-data
+      group: www-data
+
+  - name: Installation de GLPI
+    unarchive:
+      src: http://depl/store/glpi-9.5.7.tgz
+      dest: /var/www/html
+      remote_src: yes
+      owner: www-data
+      group: www-data
+
+  - name: Changement des attributs {{ glpi_dir }}
+    file: 
+      path: "{{ glpi_dir }}" 
+      owner: www-data 
+      group: www-data 
+      mode: 0755 
+      recurse: yes
+
+  - name: Changement des attributs {{ glpi_dir }}/plugins
+    file:
+      path: "{{ glpi_dir }}/plugins"
+      mode: 0777
+      owner: www-data
+      group: www-data
+      recurse: yes
+
+  - name: Installation de Fusioninventory pour Linux
+    unarchive:
+      src: "{{ depl_url }}/{{ fusion }}"
+      dest: "/var/www/html/glpi/plugins"
+      remote_src: yes
+
+  - name: Creation de ficlient
+    file:
+      path: /var/www/html/ficlients
+      state: directory
+      owner: www-data
+      group: www-data
+      mode: 0775
+
+  - name: Attribution des droits nginx.index
+    file:
+      path: /var/www/html/index.nginx-debian.html
+      owner: www-data
+      group: www-data
+      mode: 0775
+
+  - name: Installation de FusionInventory windows x64
+    get_url:
+      url: "{{ depl_url }}/{{ fusion64 }}"
+      dest: "/var/www/html/ficlients"
+
+  - name: Attribution des permissions sur repertoire /plugins/fusioninventory
+    file:
+      path: /var/www/html/glpi/plugins/fusioninventory
+      owner: www-data
+      group: www-data
+      recurse: yes
+      state: directory

glpi/ansible/roles/glpi/templates/block.j2

@@ -0,0 +1,23 @@
+server {
+        listen   80 default_server;
+        root {{ glpi_dir }};
+        index index.php;
+        server_name localhost;
+
+        location / {try_files $uri $uri/ index.php;}
+
+        #prise en charge PHP
+        location ~ \.php$ {
+                fastcgi_pass 127.0.0.1:9000;
+                fastcgi_index index.php;
+                include /etc/nginx/fastcgi_params;
+                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+                include fastcgi_params;
+                fastcgi_param SERVER_NAME $host;
+  	 }
+
+	location /ficlients {
+		root /var/www/html;
+		autoindex on;
+	}
+}

goss/goss.yaml

@@ -0,0 +1,61 @@
+package:
+  apache2:
+    installed: true
+    versions:
+    - 2.4.52-1~deb11u2
+  wireguard:
+    installed: true
+    versions:
+    - 1.0.20210223-1
+port:
+  tcp6:80:
+    listening: true
+    ip: []
+  tcp:3306:
+    listening: true
+    ip:
+    - 127.0.0.1
+service:
+  apache2:
+    enabled: true
+    running: true
+  mysql:
+    enabled: true
+    running: true
+  ssh:
+    enabled: true
+    running: true
+user:
+  mysql:
+    exists: true
+    uid: 106
+    gid: 113
+    groups:
+    - mysql
+    home: /nonexistent
+    shell: /bin/false
+group:
+  mysql:
+    exists: true
+    gid: 113
+  ssh:
+    exists: true
+    gid: 111
+process:
+  apache2:
+    running: true
+http:
+  http://onfarbo42/adminer.php:
+    status: 200
+    allow-insecure: false
+    no-follow-redirects: false
+    timeout: 5000
+    body:
+    - Adminer
+  http://onfarbo42/doku/doku.php:
+    status: 200
+    allow-insecure: false
+    no-follow-redirects: false
+    timeout: 5000
+    body:
+    - MISSION

nmap/scan

@@ -0,0 +1,75 @@
+#Scan carte en pont : 192.168.0.45
+
+Starting Nmap 7.80 ( https://nmap.org ) at 2022-02-10 14:52 CET
+Nmap scan report for 192.168.0.45
+Host is up (0.00027s latency).
+Not shown: 989 filtered ports
+PORT     STATE SERVICE      VERSION
+#DNS port 53 tcp
+53/tcp   open  domain?
+88/tcp   open  kerberos-sec Microsoft Windows Kerberos (server time: 2022-02-10 13:52:59Z)
+#Mappeur MSRCP port 135 tcp
+135/tcp  open  msrpc        Microsoft Windows RPC
+#Netbios port 139 tcp
+139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
+#LDAP port 389 en tcp
+389/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: onfdc.lan, Site: Default-First-Site-Name)
+#SMB port 445 tcp
+445/tcp  open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds (workgroup: ONFDC0)
+#Test intrusion LDAP port 464  tcp
+464/tcp  open  kpasswd5?
+#Testing MSRCP port 593 tcp
+593/tcp  open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
+#tcpwrapped port 636 tcp
+636/tcp  open  tcpwrapped
+#LDAP port 3268 tcp
+3268/tcp open  ldap         Microsoft Windows Active Directory LDAP (Domain: onfdc.lan, Site: Default-First-Site-Name)
+#tcpwrapped port 3269 tcp
+3269/tcp open  tcpwrapped
+1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
+SF-Port53-TCP:V=7.80%I=7%D=2/10%Time=620518C2%P=x86_64-pc-linux-gnu%r(DNSV
+SF:ersionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\
+SF:x04bind\0\0\x10\0\x03");
+MAC Address: 08:00:27:29:E0:6E (Oracle VirtualBox virtual NIC) #Adresse MAC
+Service Info: Host: ONFDC; OS: Windows; CPE: cpe:/o:microsoft:windows #Systeme info
+
+Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
+Nmap done: 1 IP address (1 host up) scanned in 147.14 seconds #Durée scan 147.14 sec
+
+#Scan carte interne : 192.168.2.1
+
+Starting Nmap 7.80 ( https://nmap.org ) at 2022-02-10 15:05 CET
+Nmap scan report for 192.168.2.3
+Host is up (0.0000090s latency).
+Not shown: 999 closed ports
+PORT   STATE SERVICE VERSION
+22/tcp open  ssh     OpenSSH 8.4p1 Debian 5 (protocol 2.0)
+Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
+
+Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
+Nmap done: 1 IP address (1 host up) scanned in 13.48 seconds
+Starting Nmap 7.80 ( https://nmap.org ) at 2022-02-10 15:05 CET
+Nmap scan report for 192.168.2.1
+Host is up (0.00044s latency).
+Not shown: 989 filtered ports
+PORT     STATE SERVICE      VERSION
+53/tcp   open  domain?
+88/tcp   open  kerberos-sec Microsoft Windows Kerberos (server time: 2022-02-10 14:06:14Z)
+135/tcp  open  msrpc        Microsoft Windows RPC
+139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
+389/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: onfdc.lan, Site: Default-First-Site-Name)
+445/tcp  open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds (workgroup: ONFDC0)
+464/tcp  open  kpasswd5?
+593/tcp  open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
+636/tcp  open  tcpwrapped
+3268/tcp open  ldap         Microsoft Windows Active Directory LDAP (Domain: onfdc.lan, Site: Default-First-Site-Name)
+3269/tcp open  tcpwrapped
+1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
+SF-Port53-TCP:V=7.80%I=7%D=2/10%Time=62051BDC%P=x86_64-pc-linux-gnu%r(DNSV
+SF:ersionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\
+SF:x04bind\0\0\x10\0\x03");
+MAC Address: 08:00:27:D2:86:46 (Oracle VirtualBox virtual NIC)
+Service Info: Host: ONFDC; OS: Windows; CPE: cpe:/o:microsoft:windows
+
+Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
+Nmap done: 1 IP address (1 host up) scanned in 159.90 seconds

wireguard/android.sh

@@ -0,0 +1,79 @@
+#!/bin/bash
+set -u
+set -e
+ 
+AddressAwg=10.0.0.1/32  # Adresse VPN Wireguard extremite A
+EndpointA=10.121.38.68  # Adresse extremite A
+PortA=51820             # Port ecoute extremite A
+AddressBwg=10.0.0.2/32  # Adresse VPN Wireguard extremite B
+EndpointB=192.168.1.82  # Adresse extremite B
+PortB=51820             # Port ecoute extremite B
+AddressCwg=10.0.0.3/32
+EndpointC=x.y.z.t
+PortC=51820
+
+umask 077 ;  
+wg genkey > endpoint-a.key
+wg pubkey < endpoint-a.key > endpoint-a.pub 
+
+wg genkey > endpoint-b.key
+wg pubkey < endpoint-b.key > endpoint-b.pub
+ 
+wg genkey > endpoint-c.key
+wg pubkey < endpoint-c.key > endpoint-c.pub
+
+PKA=$(cat endpoint-a.key)
+pKA=$(cat endpoint-a.pub)
+PKB=$(cat endpoint-b.key)
+pKB=$(cat endpoint-b.pub)
+PKC=$(cat endpoint-c.key)
+pKC=$(cat endpoint-c.pub)
+
+cat <<FINI > wg0-a.conf
+# local settings for Endpoint A
+[Interface]
+PrivateKey = $PKA
+Address = $AddressAwg
+ListenPort = $PortA
+ 
+# remote settings for Endpoint B
+[Peer]
+PublicKey = $pKB
+#Endpoint = ${EndpointB}:$PortB
+AllowedIPs = $AddressBwg
+
+# remote settings for Endpoint C
+[Peer]
+PublicKey = $pKC
+#EndPoint = ${EndpointC}:$PortC
+AllowedIPs = $AddressCwg
+FINI
+ 
+ 
+cat <<FINI > wg0-b.conf
+# local settings for Endpoint B
+[Interface]
+PrivateKey = $PKB
+Address = $AddressBwg
+ListenPort = $PortB
+ 
+# remote settings for Endpoint A
+[Peer]
+PublicKey = $pKA
+Endpoint = ${EndpointA}:$PortA
+AllowedIPs = $AddressAwg
+FINI
+
+cat <<FINI > wg0-c.conf
+# local settings for Endpoint C
+[Interface]
+PrivateKey = $PKC
+Address = $AddressCwg
+ListenPort = $PortC
+ 
+# remote settings for Endpoint A
+[Peer]
+PublicKey = $pKA
+Endpoint = ${EndpointA}:$PortA
+AllowedIPs = $AddressAwg
+FINI

wireguard/wg0-b.conf

@@ -1,11 +1,15 @@
 # local settings for Endpoint B
 [Interface]
-PrivateKey = 0Nb+sT20LbiRTMk4Ll5FsASVSFTgdA+JyMpd8shxJFA=
+PrivateKey = oMcR7DZkrkUumSdvGgC3F/uuLVYICP8kTF/6BdNsFGU=
 Address = 10.0.0.2/32
 ListenPort = 51820
  
+# IP forwarding
+PreUp = sysctl -w net.ipv4.ip_forward=1
+ 
 # remote settings for Endpoint A
 [Peer]
-PublicKey = uKQUgVq/uud3tIV2Qibth/8YHzDL2Z0SmcsnC+LkAms=
+PublicKey = ihizRzwgz/HEF8QHNPRYa7LYB/HTtnwWZlHltI0ZdDc=
-Endpoint = 10.121.38.68:51820
+Endpoint = 192.168.0.51:51820
-AllowedIPs = 10.0.0.1/32
+AllowedIPs = 10.0.0.1/32, 192.168.1.0/24
+