HOSTNAME	DNS RECORD(S)	IPV4 ADDRESS	IPV6 ADDRESS
HQ-DMZ-1	crl.vikingtoys.dk, ns1.vikingtoys.dk, ns1.aarhus.vikingt oys.dk	10.10.20.11/24	-

Configure CRL Distribution Point to be available at: ▪ http://crl.vikingtoys.dk/root_crl.pem ▪ http://crl.vikingtoys.dk/sub_crl.pem
Install and configure a DNS server for: ▪ vikingtoys.dk ▪ aarhus.vikingtoys.dk ▪ forward and reverse zones ▪ Publish SPF/DKIM/DMARC records for vikingtoys.dk. ▪ It must serve requests from the Internet, but must not use private addressing for that. ▪ Configure this DNS server as secondary for odense.vikingtoys.dk. ▪ All other domains must be forwarded to the correct upstream DNS (use R‑CORE resolver).
Configure an HA web service with HQ‑DMZ‑2. ▪ Serve https://aarhus.vikingtoys.dk with a valid certificate signed by the company Sub CA. ▪ HTTP must redirect to HTTPS. ▪ The website must display: Welcome to Aarhus. Served by <hostname> ▪ Use HAProxy for HA.

Настройка

hostnamectl hostname HQ-DMZ-1
timedatectl set-timezone Europe/Stockholm
 
vi /etc/resov.conf.head
	search aarhus.vikingtoys.dk
	domain aarhus.vikingtoys.dk
	nameserver 127.0.0.1
 
vi /etc/network/interfaces
	auto ens3
	iface ens3 inet static
		address 10.10.20.11/24
 
vi /etc/systemd/timesyncd.conf
	NTP=10.10.20.1
 
service systemd-timesyncd restart

BIND9

apt install bind9 -y
cd /etc/bind/
--> vi named.conf.options
=========================================
allow-query {any;};
listen-on {any;};
listen-on-v6 {any;};
forwarders {198.51.100.1}
=========================================
	
--> vi named.conf.local
=========================================
acl WAN {
0.0.0.0/0;
!Local;           
};
acl Local {
		10.10.10.0/24;
		10.10.20.0/24;
		10.10.30.0/24;
		10.20.10.0/24;
		10.20.30.0/24;
		127.0.0.1;
};
view "local" {
	match-clients {
			Local;
	};
	zone "vikingtoys.dk" {
		type master;
		file "/var/lib/bind/local/vikingtoys.dk";
		allow-transfer {10.20.10.11;};
	};
	
	zone "aarhus.skylink.dk" {
		type master;
		file "/var/lib/bind/local/aarhus.skylink.dk";
		allow-transfer {10.20.10.11;};
	};
	zone "10.10.in-addr.arpa" {
		type master;
		file "/var/lib/bind/local/10.10.in-addr.arpa";
		allow-transfer {10.20.10.11;};
	};
	zone "odense.skylink.dk" {
		type slave;
		file "/var/lib/bind/local/odense.skylink.dk";
		masters {10.20.10.11;};
	};
};
 
 
view "wan" {
	match-clients {
			WAN;
	};
	zone "vikingtoys.dk" {
		type master;
		file "/var/lib/bind/wan/vikingtoys.dk";
	};
	
	zone "aarhus.skylink.dk" {
		type master;
		file "/var/lib/bind/wan/aarhus.skylink.dk";
	};
	zone "100.51.198.in-addr.arpa" {
		type master;
		file "/var/lib/bind/wan/100.51.198.in-addr.arpa";
	};
	zone "9.3.0.0.8.b.d.0.1.0.0.2.ip6.arpa" {
		type master;
		file "/var/lib/bind/wan/39.ip6.arpa";
	};
};
=========================================
 
--> vi /var/lib/bind/local/vikingtoys.dk
=========================================
$TTL    604800
@       IN      SOA     vikingtoys.dk. root.vikingtoys.dk. (
							  2         ; Serial
						 604800         ; Refresh
						  86400         ; Retry
						2419200         ; Expire
						 604800 )       ; Negative Cache TTL
;
@         IN       NS      vikingtoys.dk.
@         IN       A       10.10.20.11
@         IN       MX      1   mail
crl       IN       A       10.10.20.11
ns1       IN       A       10.10.20.11
 
ldap      IN       A       10.10.10.11 
 
mail      IN       A       10.10.20.12
=========================================
 
--> vi /var/lib/bind/local/aarhus.vikingtoys.dk
=========================================
$TTL    604800
@       IN      SOA     aarhus.vikingtoys.dk. root.aarhus.vikingtoys.dk. (
							  2         ; Serial
						 604800         ; Refresh
						  86400         ; Retry
						2419200         ; Expire
						 604800 )       ; Negative Cache TTL
;
@         IN       NS      aarhus.vikingtoys.dk.
@         IN       A       10.10.20.12
ns1       IN       A       10.10.20.11
 
monitor   IN       A       10.10.20.12
=========================================
	
--> vi /var/lib/bind/local/10.10.in-addr.arpa
=========================================
$TTL    604800
@       IN      SOA     aarhus.vikingtoys.dk. root.aarhus.vikingtoys.dk. (
							  2         ; Serial
						 604800         ; Refresh
						  86400         ; Retry
						2419200         ; Expire
						 604800 )       ; Negative Cache TTL
;
@         IN       NS      ns1.vikingtoys.dk.
11.20     IN       PTR     vikingtoys.dk.
11.20     IN       PTR     crl.vikingtoys.dk.
11.20     IN       PTR     ns1.vikingtoys.dk.
11.20     IN       PTR     ns1.aarhus.vikingtoys.dk.
 
12.20     IN       PTR     aarhus.vikingtoys.dk.
12.20     IN       PTR     mail.vikingtoys.dk.
12.20     IN       PTR     monitoring.vikingtoys.dk.
 
11.10     IN       PTR     ldap.vikingtoys.dk.
=========================================
 
 
--> vi /var/lib/bind/wan/vikingtoys.dk
--> vi /var/lib/bind/wan/aarhus.vikingtoys.dk
=========================================
# Всё тоже самое ток тип того будет
crl       IN       A       198.51.100.2
crl       IN       A       198.51.100.17
crl       IN       AAAA    2001:db8:39:1::2
crl       IN       AAAA    2001:db8:39:4::1
 
=========================================
 
--> vi /var/lib/bind/wan/100.51.198.in-addr.arpa
=========================================
# Всё тоже самое ток тип того будет
2        IN       PTR       vikingtoys.dk.
17       IN       PTR       vikingtoys.dk.
=========================================
 
--> vi /var/lib/bind/wan/39.ip6.arpa
=========================================
# Всё тоже самое ток тип того будет
2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.0.0.0      IN       PTR       vikingtoys.dk.
17.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.0.0.0     IN       PTR       vikingtoys.dk.
=========================================
service named restart

APACHE

apt install apache2 -y
 
mkdir /var/www/ca
# копируем туда сертификаты и crl из HQ-DC
	CA.crt root_crl.pem subca.crt sub_crl.pem
 
cd /etc/apache2/sites-available/
cp 000-default.conf ca.conf
 
vi ca.conf
	ServerName www.skyling.dk # Перед и после VirtualHost
	DocumentRoot /var/www/site/
 
a2dissite 000-default.conf
a2ensite ca.conf
service apache2 restart

APACHE

apt install apache2 -y
 
mkdir /var/www/site
--> vi /var/www/site/index.html
================================
<h1> Welcome to Aarhus. Served by HQ-DMZ-2 </h1>
================================
 
 
cd /etc/apache2/sites-available/
cp 000-default.conf ca.conf
 
--> vi site.conf
================================
	<VirtualHost *:8080>
	ServerName www.skyling.dk # Перед и после VirtualHost
	DocumentRoot /var/www/site/
================================
 
a2dissite 000-default.conf
a2ensite ca.conf
service apache2 restart
 
 
--> vi /etc/apache2/ports.conf
================================
Listen 8080
================================

Haproxy

apt install haproxy -y
# /usr/share/doc/haproxy/examples/option-че-то-там как дефолтный использую
# /usr/share/doc/haproxy/examples/basik-че-то-там беру ssl_fs
 
--> vi /etc/haproxy
================================
global
        maxconn         20000
        daemon
 
frontend http    
		bind            *:80
        bind            *:443 ssl crt /ca/aarhus.pem
        mode http       
	
		acl crl hdr(host) -i crl.vikingtoys.dk
        use_backend test-crl if crl
        default_backend aarhus
	
backend test-crl
        mode http                 
        server HQ-DMZ-1 10.10.20.11:8080 check
 
        
backend aarhus 
        mode http                 
        http-request redirect scheme https if { ssl_fs }
        server HQ-DMZ-1 10.10.20.11:8080 check
        server HQ-DMZ-2 10.10.20.12:8080 check
================================

Quartz 5

Explorer

HQ-DMZ-1

Настройка

BIND9

APACHE

APACHE

Haproxy

Graph View