Wiki Comminges Haut Débit

Outils pour utilisateurs

Outils du site

Piste: • Futur chd-stg1
technique:referentiel:chd-stg1-ng

Table des matières

Futur chd-stg1

  • netinstall Debian 9 amd64
  • Français / France
  • hostname : chd-stg1.chd.sx
  • Une seule partition sda1 de la taille du SSD, options discard,noatime, label=chd-stg1-rootfs
  • tasksel : utilitaires usuels, serveur ssh, pas d'env graphique
  • user root et rescue

Configuration initiale

/root/.ssh/authorized_keys
[...]
/etc/default/grub
GRUB_CMDLINE_LINUX_DEFAULT=""
GRUB_CMDLINE_LINUX="net.ifnames=0 nomodeset console=ttyS0,115200n8 console=tty1 systemd.journald.forward_to_console=1 systemd.journald.max_level_console=warning"
GRUB_TERMINAL=console
GRUB_INIT_TUNE="1000 334 1 334 1 0 1 334 1 0 1 261 1 334 1 0 1 392 2 0 4 196 2"
/etc/default/console-setup
FontFace="VGA"
/etc/default/networking
VERBOSE=YES
chmod -x /etc/grub.d/{05_debian_theme,20_linux_xen,30_os-prober,30_uefi-firmware,40_custom,41_custom}
update-grub
 
apt install arping beep bind binutils borgbackup conntrack cpufrequtils dnsutils ethtool fail2ban git gt5 htop iftop iotop iperf iperf3 ipmitool libvirt-daemon llibvirt-daemon-system lm-sensors molly-guard mtr-tiny nmap ntp nullmailer powertop psmisc qemu-kvm rsync screen sdparm smartmontools sshpass strace sudo sysstat tcpdump tree unzip vim aspell- lvm2- mysql-common-
 
sensors-detect
 
# Pour if_rrd_fast.py
apt install rrdtool python-pyrrd
mkdir /root/git
cd /root/git
git clone root@chd.sx:/var/git/if_rrd_fast 
git clone root@chd.sx:/var/git/chd_gestion
 
ln -s /root/git/if_rrd_fast/if_rrd_fast.py /root/
ln -s /root/git/chd_gestion/misc/setup_routing.sh /root/
ln -s /root/git/chd_gestion/misc/ssh-rt.sh /root/
ln -s /root/git/chd_gestion/misc/genconf_prod /usr/local/bin/
 
# Créer VM chd-stg2 via virt-manager over SSH
ln -s /etc/libvirt/qemu/chd-stg2.xml /etc/libvirt/qemu/autostart/
 
# Récupérer une version de lldpd qui gère plus de 4 voisins par ports
dpkg -i /opt/lldpd/lldpd_0.9.6-1.1~lpo1_amd64.deb
echo "lldpd hold" | dpkg --set-selections
/etc/default/ntp
NTPD_OPTS='-g -I eth0'
/etc/default/lldpd
# Active l'écoute CDP, désactive LLDP, admet 500 voisin par port
DAEMON_ARGS="-c -ll -n500"
/etc/hosts.system
127.0.0.1              localhost
185.131.40.1           chd-stg1.chd.sx chd-stg1
185.131.40.2           chd-stg2.chd.sx moniteur.chd.sx stg2.chd.sx ns2.commingeshautdebit.fr chd-stg2
 
::1                    localhost ip6-localhost ip6-loopback
ff02::1                ip6-allnodes
ff02::2                ip6-allrouters
/etc/ethers.system
# empty for now
adduser genconf
passwd -dl genconf
/home/genconf/.ssh/authorized_keys
command="~/.ssh/check",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-rsa ... www-data@chd-tls1
/home/genconf/.ssh/check
#!/bin/sh
if [ "xsudo genconf_prod" = "x$SSH_ORIGINAL_COMMAND" ]
then	$SSH_ORIGINAL_COMMAND;
else	echo "Rejected"
fi
/etc/sudoers
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
root    ALL=(ALL:ALL) ALL
genconf ALL=(ALL:ALL) NOPASSWD:/usr/local/bin/genconf_prod
%sudo   ALL=(ALL:ALL) ALL
/etc/modules
# ipmitool
ipmi_si
 
# Generated by sensors-detect on Fri Apr  6 09:11:11 2018
# Chip drivers
coretemp
jc42
w83627ehf
/etc/sensors.d/local.conf
chip "w83627dhg-*"
    ignore fan1
    ignore fan3
    ignore fan4
    ignore fan5
/etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
 
source /etc/network/interfaces.d/*
 
# The loopback network interface
auto lo
iface lo inet loopback
	# https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt
	up sysctl -w net.ipv4.conf.all.arp_announce=2
	up sysctl -w net.ipv4.ip_forward=1 
	up sysctl -w net.ipv6.conf.all.accept_ra_pinfo=0
	up sysctl -w net.ipv6.conf.all.accept_redirects=0
	up sysctl -w net.ipv6.conf.all.router_solicitations=0
	up sysctl -w net.ipv6.conf.all.accept_dad=0
	up sysctl -w net.ipv6.route.max_size=16384
	up sysctl -w net.ipv6.conf.all.forwarding=1
	up ip a r 185.131.40.1/32 dev $IFACE
	up ip -6 a r 2a03:a0a0:0000::1/128 dev $IFACE
 
# Interco Fullsave LAN2LAN IPv4
auto eth0
iface eth0 inet static
	address 93.93.40.214
	netmask 255.255.255.252
	up ip r r unreachable 185.131.40.0/22
	up ip r r default via 93.93.40.213 dev $IFACE src 185.131.40.1
	up sysctl -w net.ipv6.conf.$IFACE.accept_dad=0
 
# Interco Fullsave LAN2LAN IPv6
iface eth0 inet6 static
	address 2a01:6600:20:3000::1/127
	up ip -6 r r unreachable 2a03:a0a0:0000::/48 
	up ip -6 r r unreachable 2a03:a0a0:0001::/48 
	up ip -6 r r default via 2a01:6600:20:3000:: dev $IFACE src 2a03:a0a0::1
 
# Réseau des antennes CHD
auto br1
iface br1 inet static
	bridge_ports	eth1
	bridge_stp	off
	bridge_maxwait	0
	bridge_fd	0
	# gw IPv4 routeurs adhérents
	address 172.16.0.254
	netmask 255.255.0.0
	# Nécessaire tant qu'on a du NAT
	up modprobe nf_conntrack
	up sysctl -w net.netfilter.nf_conntrack_max=65536
	up sysctl -w net.ipv6.conf.$IFACE.accept_dad=0
	# gw IPv6 routeurs adhérents
	up ip -6 a r fe80::31/64 dev $IFACE
	# chd-stg2.chd.sx (2016-03-05 - now)
	up ip r r 185.131.40.2 dev $IFACE
	up ip -6 r r 2a03:a0a0::2 dev $IFACE
	# ns3.chd.sx (2016-03-05 - now) (on chd-stg2)
	up ip r r 185.131.40.3 dev $IFACE
	up ip -6 r r 2a03:a0a0::3 dev $IFACE
	# Routage adhérents
	#  cf /etc/systemd/system/setup_routing.service
	#
	# Anciens routages (historique 1 an nécessaire)
	# srv1.stg.prosoluce.net (2015-12-31 - 2016-03-05)
	#up ip r r 185.131.40.2 dev $IFACE
	#up ip -6 r r 2a03:a0a0::2 dev $IFACE
	# nuc-stgo (old stg2) (2015-12-31 - 2016-09-19)
	#up ip r r 185.131.40.4 dev $IFACE
	# srv1.stg.prosoluce.net (2016-03-05 - now)
	#up ip r r 185.131.40.9 dev $IFACE
	#up ip -6 r r 2a03:a0a0::9 dev $IFACE
	# backup3.stg.prosoluce.net (2016-01-02 - now)
	#up ip r r 185.131.40.10 dev $IFACE
 
auto br1:1
iface br1:1 inet static
	address 192.168.0.2
	netmask 255.255.255.0
 
iface br1:1 inet static
	address 192.168.1.2
	netmask 255.255.255.0
reboot
 
apt install munin-node
rm /etc/munin/plugins/ntp_*
rm /etc/munin/plugins/swap
wget -O /etc/munin/plugins/systemd_units https://raw.githubusercontent.com/munin-monitoring/contrib/master/plugins/systemd/systemd_units
chmod +x /etc/munin/plugins/systemd_units
 
# renommer les if_enp4s0 en if_eth0 si besoin
ln -s /usr/share/munin/plugins/bind9 /etc/munin/plugins/
ln -s /usr/share/munin/plugins/ipmi_sensor_ /etc/munin/plugins/ipmi_sensor_u_volts
ln -s /usr/share/munin/plugins/sensors_ /etc/munin/plugins/sensors_fan
ln -s /usr/share/munin/plugins/sensors_ /etc/munin/plugins/sensors_temp
ln -s /usr/share/munin/plugins/fw_conntrack /etc/munin/plugins/
ln -s /usr/share/munin/plugins/smart_ /etc/munin/plugins/smart_sda
ln -s /usr/share/munin/plugins/tcp  /etc/munin/plugins/
 
( cd /etc/munin/plugins; time for p in *; do munin-run $p; done )
/etc/munin/munin-node.conf
allow ^185\.61\.116\.41$
/etc/munin/plugin-conf.d/local
[bind9]
group bind
service munin-node restart
 
apt autoremove --purge os-prober doc-debian doc-debian-fr debian-faq ispell laptop-detect wamerican wfrench xauth 
 
mkdir /var/log/bind9
/etc/fstab
none	/var/log/bind9	tmpfs	uid=bind,gid=bind,mode=0750,size=30m	0	0
/       /mnt/rootfs     ext4    bind                                    0       0
# Attention à l'ordre, le mount --bind doit être à la fin
/etc/bind/named.conf.local
include "/etc/bind/zones.rfc1918";
 
acl internals {
	127.0.0.0/8;
	172.16.0.0/16;
	185.131.40.0/22;
	fe80::/12;
	2a03:a0a0::/32;
};
 
logging {
	channel query {
		file "/var/log/bind9/query.log" versions 2 size 10m;
		print-time yes;
		severity info;
	};
	category queries { query; };
};
/etc/bind/named.conf.options
        # 2018-04-04 lpo persionnalisation pour CHD
        #listen-on-v6 { any; };
        listen-on-v6 { fe80::31%br1; };
        listen-on { 127.0.0.1; 172.16.0.254; 185.131.40.1; };
        version none;
        allow-query { internals; };
        allow-recursion { internals; };
        memstatistics-file "/var/log/bind9/bind.stats";
        max-cache-size 384m;
/etc/resolv.conf
search chd.sx
nameserver 185.131.40.1
service bind9 restart
ls /var/log/bind9/query.log
/etc/systemd/system/getty@tty1.service.d/noclear.conf
[Service]
TTYVTDisallocate=no
/etc/systemd/system/setup_routing.service
[Unit]
Description=Setup routing at boot time
After=network.target
 
[Service]
Type=oneshot
ExecStart=/root/setup_routing.sh log_run
 
[Install]
WantedBy=multi-user.target
systemctl enable setup_routing.service
/etc/motd
      _         _           _        _ 
  ___| |__   __| |      ___| |_ __ _/ |
 / __| '_ \ / _` |_____/ __| __/ _` | |
| (__| | | | (_| |_____\__ \ || (_| | |
 \___|_| |_|\__,_|     |___/\__\__, |_|
                               |___/   
 
                                           chd-stg1.chd.sx
/root/.bashrc
# You may uncomment the following lines if you want `ls' to be colorized:
export LS_OPTIONS='--color=auto'
eval "`dircolors`"
alias ls='ls $LS_OPTIONS'
alias ll='ls $LS_OPTIONS -l'
alias l='ls $LS_OPTIONS -lA'
#
# Some more alias to avoid making mistakes:
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
 
export HISTIGNORE=' *'
alias journalnet="journalctl | awk '/ifup/ { out=1 } / (ifup|kernel|setup_routing)/{if (out==1) { print \$0 } }' | less"
 
systemctl is-system-running --quiet || ( systemctl --state=failed; echo >&2; echo "Use 'journalnet' for networking + related kernel and script logs" >&2 )
/root/.iftoprc
interface: br1
max-bandwidth: 10M
hide-source: yes
dns-resolution: no
/root/.vimrc
syn on
/etc/fail2ban/
├── action.d
│   └── route.conf
├── fail2ban.conf
├── fail2ban.d
├── filter.d
│   ├── common.conf
│   ├── pam-generic.conf
│   └── sshd.conf
├── jail.conf
├── jail.conf.lpo
├── jail.d
│   ├── customisation.local
│   └── defaults-debian.conf
├── paths-common.conf
├── paths-debian.conf
└── paths-opensuse.conf
/etc/fail2ban/jail.d/customisation.local
[DEFAULT]
maxretry = 3
banaction_allports = route
 
[sshd]
enabled = true
banaction = %(banaction_allports)s
 
[pam-generic]
enabled = true
/etc/fail2ban/action.d/route.conf
[Init]
#blocktype = unreachable
blocktype = blackhole

Compilation lldpd modifié

https://www.debian.org/doc/manuals/maint-guide/modify.fr.html

.bash_aliases
alias dquilt="quilt --quiltrc=${HOME}/.quiltrc-dpkg"
complete -F _quilt_completion -o filenames dquilt
source ~/.bash_aliases
sudo apt install devscripts
sudo apt build-dep lldpd
apt source lldpd
cd lldpd-0.9.6/
mkdir debian/patches
dquilt new add-max-neighbors-arg.patch
dquilt add src/daemon/lldpd.c
editor src/daemon/lldpd.c 
dch
# Version : 0.9.6-1.1~lpo1
# Commentaire: reprendre celui du patch (1ère ligne)
dpkg-buildpackage -us -uc
/opt/lldpd/lldpd-0.9.6/debian/patches/add-max-neighbors-arg.patch
Add -n <max_neighbors> getopt'ion
--- a/src/daemon/lldpd.c
+++ b/src/daemon/lldpd.c
@@ -1451,8 +1451,9 @@
 	 * unless there is a very good reason. Most command-line options will
 	 * get deprecated at some point. */
 	char *popt, opts[] =
-		"H:vhkrdD:p:xX:m:u:4:6:I:C:p:M:P:S:iL:@                    ";
+		"n:H:vhkrdD:p:xX:m:u:4:6:I:C:p:M:P:S:iL:@                    ";
 	int i, found, advertise_version = 1;
+	int max_neighbors = LLDPD_MAX_NEIGHBORS;
 #ifdef ENABLE_LLDPMED
 	int lldpmed = 0, noinventory = 0;
 	int enable_fast_start = 1;
@@ -1492,6 +1493,9 @@
 	}
 	while ((ch = getopt(argc, argv, opts)) != -1) {
 		switch (ch) {
+		case 'n':
+			max_neighbors = atoi(optarg);
+			break;
 		case 'h':
 			usage();
 			break;
@@ -1758,7 +1762,7 @@
 	cfg->g_config.c_receiveonly = receiveonly;
 	cfg->g_config.c_tx_interval = LLDPD_TX_INTERVAL;
 	cfg->g_config.c_tx_hold = LLDPD_TX_HOLD;
-	cfg->g_config.c_max_neighbors = LLDPD_MAX_NEIGHBORS;
+	cfg->g_config.c_max_neighbors = max_neighbors;
 #ifdef ENABLE_LLDPMED
 	cfg->g_config.c_enable_fast_start = enable_fast_start;
 	cfg->g_config.c_tx_fast_init = LLDPD_FAST_INIT;

Accéder au disque qcow2 d'une VM éteinte

Attention : toujours éteindre la VM, sinon corruption de données garantie 

modprobe nbd max_part=8
qemu-nbd --connect=/dev/nbd0 /var/lib/libvirt/images/chd-stg2.qcow2 
fdisk /dev/nbd0 -l 
partprobe 
mount -o ro /dev/nbd0p1 /mnt/loop
cd /mnt/loop/var/log
ls
cd /mnt/
umount /mnt/loop
qemu-nbd --disconnect /dev/nbd0 
dmesg | tail

TODO

Remplir vraiment les fichiers ~genconf/.ssh/*
configurer munin/multiping
tester interfaces, max nfconntrack, fail2ban, nullmailer, lldpd
voir si cpufreq par défaut est ok ou pas
netconsole config
apt remove --purge isc-dhcp-dhclient isc-dhcp-common
backup borg
côté serveur de backup : command="borg serve --restrict-to-path /var/backups/borg",restrict ssh-rsa [...]
côté client : command="/usr/local/bin/borg-save.sh" ssh-rsa [...]

mailer + mail alert (smartmontools/logcheck ?)
Point de montage pour /var/lib/libvirt/images/

Log association MAC ⟷ IP

L'objectif est de détecter l'IP spoofing en gardant une trace de la MAC usuelle associée à une IP donnée.

/var/log/mac/update.sh
#!/bin/bash
ip n | sort | sed \
 -e 's/\(REACHABLE\|STALE\|DELAY\)/normal/' \
 -e 's/\(INCOMPLETE\|FAILED\|PROBE\)/lost/' > ip-n-sort-sed
git add ip-n-sort-sed
git commit -m "update via $0 $*"
chown -R nobody: /var/log/mac
/etc/cron.d/log-mac
*/4 * * * *     nobody if [ -x /var/log/mac/update.sh ]; then cd /var/log/mac/; ./update.sh
technique/referentiel/chd-stg1-ng.txt · Dernière modification: 2018/05/19 20:46 par admin

Outils de la page

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki