Quartz 5

HQ-DMZ-2

3 min read

HOSTNAMEDNS RECORD(S)IPV4 ADDRESSIPV6 ADDRESS
HQ-DMZ-2mail.vikingtoys.dk,
monitor.aarhus.vikingtoys.dk,
aarhus.vikingtoys.dk		10.10.20.12/24-
  1. Configure an HA web service with HQ‑DMZ‑1. ▪ Serve https://aarhus.vikingtoys.dk with a valid certificate signed by the company Sub CA. ▪ HTTP must redirect to HTTPS. ▪ The website must display: Welcome to Aarhus. Served by <hostname> ▪ Use HAProxy for HA.
  2. Configure e‑mail service accessible on mail.vikingtoys.dk: ▪ Receive and send mail for domain vikingtoys.dk. ▪ Users must authenticate via LDAP. ▪ IMAP over TLS: 993 ▪ SMTP Submission with STARTTLS: 587 ▪ SPF/DKIM/DMARC verification must be applied. If verification fails → move the message to the Spam folder. ▪ Only necessary ports must be open (port 25 may be open or closed).
  3. Install and configure the Zabbix web interface at: ▪ http://monitor.aarhus.vikingtoys.dk:8080/zabbix ▪ Keep default credentials. ▪ Monitor availability of https://aarhus.vikingtoys.dk. ▪ When the site is down: o append an alert line to /monitor/webalert.log o send an email to Egon.
  4. Configure Zabbix to monitor CPU usage of computers on the BR‑CLIENT network via SNMP.

Настройка

hostnamectl hostname HQ-DMZ-2
timedatectl set-timezone Europe/Stockholm
 
vi /etc/resov.conf.head
	search aarhus.vikingtoys.dk
	domain aarhus.vikingtoys.dk
	nameserver 10.10.20.11
 
vi /etc/network/interfaces
	auto ens3
	iface ens3 inet static
		address 10.10.20.12/24
		gateway 10.10.20.1
 
vi /etc/systemd/timesyncd.conf
	NTP=10.10.20.1
 
service systemd-timesyncd restart

APACHE

apt install apache2 -y
 
mkdir /var/www/site
--> vi /var/www/site/index.html
================================
<h1> Welcome to Aarhus. Served by HQ-DMZ-2 </h1>
================================
 
 
cd /etc/apache2/sites-available/
cp 000-default.conf ca.conf
 
--> vi site.conf
================================
	<VirtualHost *:8080>
	ServerName www.skyling.dk # Перед и после VirtualHost
	DocumentRoot /var/www/site/
================================
 
a2dissite 000-default.conf
a2ensite ca.conf
service apache2 restart
 
 
--> vi /etc/apache2/ports.conf
================================
Listen 8080
================================

Haproxy

apt install haproxy -y
# /usr/share/doc/haproxy/examples/option-че-то-там как дефолтный использую
# /usr/share/doc/haproxy/examples/basik-че-то-там беру ssl_fs
 
--> vi /etc/haproxy
================================
global
        maxconn         20000
        daemon
 
frontend http    
		bind            *:80
        bind            *:443 ssl crt /ca/aarhus.pem
        mode http       
	
		acl crl hdr(host) -i crl.vikingtoys.dk
        use_backend test-crl if crl
        default_backend aarhus
	
backend test-crl
        mode http                 
        server HQ-DMZ-1 10.10.20.11:8080 check
 
        
backend aarhus 
        mode http                 
        http-request redirect scheme https if { ssl_fs }
        server HQ-DMZ-1 10.10.20.11:8080 check
        server HQ-DMZ-2 10.10.20.12:8080 check
================================

Zabbix

apt install zabbix-server-pgsql zabbix-apache-conf php8.4-pgsql zabbix-sql-scripts zabbix-agent2
apt install postgresql -y
 
--> su postgres
================================
createuser -P zabbix
createdb -O zabbix zabbix
 
zcat /usr/share/zabbix/sql-scripts/postgresql/server.sql.gz | psql -U zabbix -d zabbix -h localhost -W
================================
 
--> vi /etc/zabbix/zabbix_server.conf
================================
DBPassword=P@ssw0rd!
 
================================
 
systemctl restart zabbix-server zabbix-agent2 apache2
 
--> http://monitor.aarhus.vikingtoys.dk:8080/zabbix
================================
	Admin
	zabbix
================================

Почта

LDAP + SAMBA

apt install libpam-ldapd
 
# Выбрать (нажать пробел) (далее = Enter)
*passwd *group *shadow 
 
# IP сервера
<ip address> 
 
# Доменное имя сервера
<domain name>
 
# Включить создание каталога для пользователя
pam-auth-update
    # выбрать (нажать пробел) (далее = Enter)
	*create home directory on login
 
# Перезапустить
reboot

Graph View