Quartz 5

HQ-SAM-1

2 min read

HOSTNAMEDNS RECORD(S)IPV4 ADDRESSIPV6 ADDRESS
HQ-SAM-1-10.10.10.21/24-
  1. Create a HA DHCP cluster with HQ‑SAM‑2 for the HQ‑CLIENT network. ▪ Allowed solutions: ISC DHCP failover or Kea DHCP HA.
  2. Create a Subordinate Certificate Authority (Subordinate CA) using these parameters: ▪ C=DK, O=VikingToys A/S, CN=VikingToys Intermediate CA ▪ Place the certificate at /ca/SUBCA.crt.
  3. The Sub CA must issue all necessary certificates. ▪ The subject of each issued certificate must contain only and exactly: C=DK, O=VikingToys A/S, CN=<FQDN> ▪ All servers and client applications must accept certificates issued by this Sub CA.

Настройка

hostnamectl hostname HQ-SAM-1
timedatectl set-timezone Europe/Stockholm
 
vi /etc/resov.conf.head
	search aarhus.vikingtoys.dk
	domain aarhus.vikingtoys.dk
	nameserver 10.10.20.11
 
vi /etc/network/interfaces
	auto ens3
	iface ens3 inet static
		address 10.10.10.21/24
 
vi /etc/systemd/timesyncd.conf
	NTP=10.10.10.1
 
service systemd-timesyncd restart

Сертификаты

mkdir /ca
cd /ca
 
vi /etc/ssl/openssl.cnf
	
 
[CA_default]
dir = /ca                        
certificate = $dir/subca.crt        
crl = $dir/subca.crl         
private.key = $dir/private/subca.key
 
[policy_match]
# Везде = optional            
 
[req_distinguished_name]
# 
countryName_default = DK # Подпункты не трогаем
0.organizationName_default = VikingToys A/S # Подпункты не трогаем
CommonName = CommonName  # Не трогаем
 
# Это скорее всего не надо
crlDistributionPoints = URI:http://crl.vikingtoys.dk/sub_crl.pem
authorityInfoAccess = OCSP;URI:http://aia.vikingtoys.dk/subca.crt
 
 
mkdir certs crl newcerts private
touch index.txt
echo 01  > serial
echo 01  > crlnumber
 
# crl
openssl ca -gencrl -out subca.crl
 
vi gen.sh
	DOMAIN="$1.vikingtoys.dk"
	openssl  genrsa -out /ca/private/$1.key
	
	echo "subjectAltName = DNS:$DOMAIN" > /ca/alt.txt
	echo "crlDistributionPoints = URI:http://crl.vikingtoys.dk/sub_crl.pem" >> /ca/alt.txt
	echo "authorityInfoAccess = OCSP;URI:http://aia.vikingtoys.dk/subca.crt" >> /ca/alt.txt
	
	openssl req -key /ca/private/$1.key -new -out /ca/newcerts/$1.req
	openssl ca -in /ca/newcerts/$1.req -out /ca/certs/$1.crt -extfile /ca/alt.txt

DHCP

apt install isc-dhcp-server -y
 
--> /etc/dhcp/dhcpd.conf
==========================================
option domain-name "aarhus.vikingtoys.dk";
option domain-name-servers 10.10.20.11;
option ntp-servers 10.10.30.1;
 
failover peer "DHCP" {
	primary;
	address 10.10.10.21;
	peer address 10.10.10.22;
	mclt 3600;
	split 128;
}
 
subnet 10.10.0.0 netmask 255.255.0.0 {
	pool {
	option routers 10.10.30.1;
	option subnet-mask 255.255.255.0;
	failover peer "DHCP";
	range 10.10.30.2 10.10.30.254;
	}
}
==========================================
 
---> /etc/default/isc-dhcp-server
==========================================
INTERFACESv4="ens3"
==========================================
 
service isc-dhcp-server restart

Graph View