Quartz 5

HQ-DC

3 min read

HOSTNAMEDNS RECORD(S)IPV4 ADDRESSIPV6 ADDRESS
HQ-DCldap.vikingtoys.dk10.10.10.11/24-
  1. Create a Root Certificate Authority (Root CA) using these exact parameters: ▪ C=DK, O=VikingToys A/S, CN=VikingToys Root CA ▪ Place the root certificate at /ca/CA.crt. ▪ This Root CA must be used only to sign the Subordinate CA certificate on HQ‑SAM‑1.
  2. Deploy a directory service with LDAP over SSL/TLS available at ldap.vikingtoys.dk. ▪ Create all OUs, groups and users from Appendix C.
  3. Add 4 new 2GB HDDs. ▪ Configure a software-based encrypted ZFS array (RAIDZ1). ▪ Mount it to /share.
  4. Configure CIFS/SMB service for profile/home directories: ▪ Path: /share/users/<username>. ▪ Users must only access their own folder.
  5. Enable automatic mounting of the share on clients to: ▪ /home/<username>/share

Настройка

hostnamectl hostname HQ-DC
timedatectl set-timezone Europe/Stockholm
 
vi /etc/resov.conf.head
	search aarhus.vikingtoys.dk
	domain aarhus.vikingtoys.dk
	nameserver 10.10.20.11
 
vi /etc/network/interfaces
	auto ens3
	iface ens3 inet static
		address 10.10.10.11/24
 
vi /etc/systemd/timesyncd.conf
	NTP=10.10.10.1
 
service systemd-timesyncd restart

Сертификаты

mkdir /ca
cd /ca
 
vi /etc/ssl/openssl.cnf
	
 
[CA_default]
dir = /ca                        
certificate = $dir/ca.crt        
crl = $dir/ca.crl         
private.key = $dir/private/ca.key
 
[policy_match]
# Везде = optional            
 
[req_distinguished_name]
# 
countryName_default = DK # Подпункты не трогаем
0.organizationName_default = VikingToys A/S # Подпункты не трогаем
CommonName = CommonName  # Не трогаем
 
# Это скорее всего не надо
crlDistributionPoints = URI:http://crl.vikingtoys.dk/root_crl.pem
authorityInfoAccess = OCSP;URI:http://aia.vikingtoys.dk/CA.crt
 
 
mkdir certs crl newcerts private
touch index.txt
echo 01  > serial
echo 01  > crlnumber
 
# ca.crt
openssl genrsa -out private/ca.key 
openssl req -x509 -new -key private/ca.key -out ca.crt
 
# crl
openssl ca -gencrl -out ca.crl
 
# sub.crt
openssl genrsa -out private/subca.key
openssl req -new -key private/services.key -out newcerts/subca.req
openssl ca -in newcerts/services.req -extensions v3_ca -out /ca/subca.crt

ZFS RAID

 
apt install linux-headers-amd64 zfsutils-linux -y
 
#возможно нужно будет dpkg-reconfigure zfs-dkms
 
zpool create -f zfsarray raidz1 /dev/vda /dev/vdb /dev/vdc
# zfsarray - имя
zpool status
 
zfs set mountpoint=/share zfsarray	
zfs mount

LDAP + SAMBA

--> vi /etc/smbldap-tools/smbldap.conf
====================================
groupsdn="ou=Aarhus,${suffix}"   # Тут дописываем "ou=Aarhus," после создание групп в нужных ou убираем 
====================================
 
smbldap-groupadd admins -g 2000
smbldap-groupadd aarhus -g 2001
smbldap-groupadd odense -g 2002
 
smbldap-useradd -a -N Egon -S Lange -P egon.lange -G admins -o "Aarhus" -md /home/egon.lange/ -M egon.lange@vikingtoys.dk
 
smbldap-useradd -a -N Bjarke -S Dam -P bjarke.dam  -G aarhus -o "Aarhus" -md /home/bjarke.dam/ -M bjarke.dam@viki ngtoys.dk
 
smbldap-useradd -a -N Signe -S Madsen -P signe.madsen -G odense -o "Odense" -md /home/signe.madsen/ -M signe.madsen@vikingtoys.dk
 
smbldap-useradd -a -N Mikkel -S Jorgensen -P mikkel.jorgensen  -G odense -o "Odense" -md /home/mikkel.jorgensen/ -M mikkel.jorgensen@vikingtoys.dk
 
 
 
cd /share/users
mkdir egon.lange bjarke.dam signe.madsen mikkel.jorgensen
chmod 700 *
chown :513 *
chown egon.lange: egon.lange
chown bjarke.dam: bjarke.dam
chown signe.madsen: signe.madsen
chown mikkel.jorgensen: mikkel.jorgensen

Graph View