Quartz 5

BR-SRV

2 min read

HOSTNAMEDNS RECORD(S)IPV4 ADDRESSIPV6 ADDRESS
R-BRns1.odense.vikingtoys.dk,
www.odense.vikingtoys.dk,
odense.vikingtoys.dk		10.20.10.11/24-
BR‑SRV has GUI, VSCode and Zeal documentation available for Ansible development.
  1. Create a DHCP server for the BR‑CLIENT network. ▪ Ensure that BR‑CL always obtains 10.20.30.50/24 (reservation is allowed)
  2. Install and configure a DNS server for: ▪ odense.vikingtoys.dk (forward + reverse zone) ▪ It serves requests from the Internet, but must not use private addressing for that ▪ Configure DDNS for the BR‑CLIENT network ▪ Configure this DNS server as secondary for vikingtoys.dk and aarhus.vikingtoys.dk ▪ Forward all other domains to the correct upstream DNS (use R‑CORE resolver)
  3. Install and configure the web service: ▪ Serve https://odense.vikingtoys.dk with a valid certificate signed by the company Sub CA. ▪ Website text: Welcome to Odense ▪ Remove server signatures / header tokens.
  4. Configure an SFTP server so that the LDAP user bjarke.dam can access and edit files in the web root.
  5. Deploy a centralized syslog server with TLS to collect logs from BR‑CLIENT. ▪ DHCP logs → /log/dhcp.log ▪ All other logs → /log/dump.log

Настройка

hostnamectl hostname BR-SRV
timedatectl set-timezone Europe/Stockholm
 
vi /etc/resov.conf.head
	search odense.vikingtoys.dk
	domain odense.vikingtoys.dk
	nameserver 10.20.10.11
 
vi /etc/network/interfaces
	auto ens3
	iface ens3 inet static
		address 10.20.10.11/24
		gateway 10.20.10.1
 
vi /etc/systemd/timesyncd.conf
	NTP=10.20.10.1
 
service systemd-timesyncd restart

DHCP

apt install isc-dhcp-server -y
 
--> /etc/dhcp/dhcpd.conf
==========================================
option domain-name "odense.vikingtoys.dk";
option domain-name-servers 10.20.10.11;
 
 
 
update-static-leases on;   # Обновлять статически выданные адресса
ddns-update-style interim;
 
log-facility local7;
 
zone odense.vikingtoys.dk {            
            primary 10.20.10.11; 
    }
zone 20.10.in-addr.arpa {
            primary 10.20.10.11;
    }
subnet 10.20.10.0 netmask 255.255.255.0 {
}
 
subnet 10.20.30.0 netmask 255.255.255.0 {
	option routers 10.20.30.1;
	range 10.20.30.0 10.20.30.254;
	option ntp-servers 10.20.30.1;
}
 
host fantasia { 
	hardware ethernet 08:00:07:26:c0:a5; 
	fixed-address 10.20.30.50; 
}
==========================================
 
---> /etc/default/isc-dhcp-server
==========================================
INTERFACESv4="ens3"
==========================================
 
service isc-dhcp-server restart

BIND9

apt install bind9 -y
cd /etc/bind/
--> vi named.conf.options
=========================================
allow-query {any;};
listen-on {any;};
forwarders {198.51.100.1}
=========================================
	
--> vi named.conf.local
=========================================
 
	zone "odense.skylink.dk" {
		type slave;
		file "/var/lib/bind/local/odense.skylink.dk";
		masters {10.20.10.11;};
		allow-update {127.0.0.1; 10.20.10.11;};
	};
 
# Остальное сам

APACHE2

# самый обычный сайт
# хз что это	▪ Remove server signatures / header tokens. МБ ЭТО
--> /vi/apache2/conf-enabled/security.conf
=========================================
ServerTokens Minimal
ServerSignature Off
=========================================

rsyslog

apt install rsyslog
 
--> /etc/rsyslog.ocnf
==========================================
	# provides UDP syslog reception
	module(load="imudp")
	input(type="imudp" port="514")
	
	# provides TCP syslog reception
	module(load="imtcp")
	input(type="imtcp" port="514")
 
	local7.*         /log/dhcp.log
==========================================
	
--> /etc/rsyslog.d/BR.conf
==========================================
	if ($fromhost-ip contains "10.20.30.50") then{
	        /log/dump.log
	}
==========================================

Graph View