第五周作业-N67044-张铭扬

1. 搭建chrony服务完成多个主机的时间同步。

[root@centos8 ~]# yum -y install chrony

[root@centos8 ~]# vim /etc/chrony.conf

[root@centos8 ~]# cat /etc/chrony.conf

server ntp.aliyun.com iburst

server ntp1.aliyun.com iburst

server ntp2.aliyun.com iburst

driftfile /var/lib/chrony/drift

makestep 1.0 3

rtcsync

allow 0.0.0.0/0

local stratum 10

keyfile /etc/chrony.keys.

leapsectz right/UTC

logdir /var/log/chrony

[root@centos8 ~]# systemctl restart chronyd
[root@centos8 ~]# ss -ntlu
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp UNCONN 0 0 0.0.0.0:123 0.0.0.0:*
udp UNCONN 0 0 127.0.0.1:323 0.0.0.0:*
udp UNCONN 0 0 [::1]:323 [::]:*
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
tcp LISTEN 0 100 127.0.0.1:25 0.0.0.0:*
tcp LISTEN 0 128 [::]:22 [::]:*
tcp LISTEN 0 100 [::1]:25 [::]:*

[root@centos7 ~]#vim /etc/chrony.conf

server 10.0.0.152 iburst

[root@centos7 ~]#systemctl restart chronyd.service

[root@centos7 ~]#chronyc sources -v

210 Number of sources = 1

 .-- Source mode  '^' = server, '=' = peer, '#' = local clock.

 / .- Source state '*' = current synced, '+' = combined , '-' = not combined,

| /   '?' = unreachable, 'x' = time may be in error, '~' = time too variable.

||                                                 .- xxxx [ yyyy ] +/- zzzz

||     Reachability register (octal) -.           | xxxx = adjusted offset,

||     Log2(Polling interval) --.     |         | yyyy = measured offset,

||                               \     |         | zzzz = estimated error.

||                                 |   |           \

MS Name/IP address         Stratum Poll Reach LastRx Last sample

===============================================================================

^* 10.0.0.152                      3   6    77    29   -229us[-1154us] +/-   17m

2. 自制光盘，PXE, Cobbler完成自动安装系统。

自制光盘方式

1）制作光盘

[root@centos8 ~]# mkdir -pv /data/myiso

mkdir: created directory '/data/myiso'

[root@centos8 ~]# mount /dev/cdrom /mnt

[root@centos8 mnt]# cp -r /mnt/isolinux /data/myiso/

[root@centos8 mnt]# tree /data/myiso

/data/myiso

└── isolinux

    ├── boot.cat

    ├── boot.msg

    ├── grub.conf

    ├── initrd.img

    ├── isolinux.bin

    ├── isolinux.cfg

    ├── ldlinux.c32

    ├── libcom32.c32

    ├── libutil.c32

    ├── memtest

    ├── splash.png

    ├── TRANS.TBL

    ├── vesamenu.c32

    └── vmlinuz

1 directory, 14 files

[root@centos8 mnt]# vim /data/myiso/isolinux/isolinux.cfg

label linux
　　menu label ^Install CentOS Linux 8
　　kernel vmlinuz
　　append initrd=initrd.img text ks=cdrom:/myks.cfg

2)应答文件

[root@centos8 ks]# cat myks.cfg

ignoredisk --only-use=nvme0n1

zerombr

text

reboot

clearpart --all --initlabel

selinux --disabled

firewall --disabled

url --url=http://10.0.0.152/centos/

keyboard --vckeymap=us --xlayouts='us'

lang en_US.UTF-8

bootloader --append="net.ifnames=0" --location=mbr --boot-drive=sda

network  --bootproto=dhcp --device=eth0 --ipv6=auto --activate

network  --hostname=centos8.magedu.org

rootpw --iscrypted $6$j9YhzDUnQVnxaAk8$qv7rkMcPAEbV5yvwsP666DXWYadd3jYjkA9fpxAo9qYotjGGBUclCGoP1TRvgHBpqgc5n0RypMsPTQnVDcpO01

firstboot --enable

skipx

services --disabled="chronyd"

timezone Asia/Shanghai --isUtc --nontp

user --name=wang --password=6oUfb/02CWfLb5l8f$sgEZeR7c7DpqfpmFDH6huSmDbW1XQNR4qKl2EPns.gOXqlnAIgv9pTogtFVaDtEpMOC.SWXKYqxfVtd9MCwxb1 --iscrypted --gecos="wang"

#autopart --type=lvm

#part / --fstype xfs --size 1 --grow --ondisk sda

part / --fstype="xfs" --ondisk=nvme0n1 --size=102400

part /data --fstype="xfs" --ondisk=nvme0n1 --size=51200

part swap --fstype="swap" --ondisk=nvme0n1 --size=2048

part /boot --fstype="ext4" --ondisk=nvme0n1 --size=1024

%packages

@^minimal-environment

kexec-tools

%end

%addon com_redhat_kdump --enable --reserve-mb='auto'

%end

%anaconda

pwpolicy root --minlen=6 --minquality=1 --notstrict --nochanges --notempty

pwpolicy user --minlen=6 --minquality=1 --notstrict --nochanges --emptyok

pwpolicy luks --minlen=6 --minquality=1 --notstrict --nochanges --notempty

%end

%post

useradd mage

echo magedu | passwd --stdin mage &> /dev/null

%end

3）启动httpd

[root@centos8 ~]#dnf -y install httpd

[root@centos8 ~]#systemctl enable --now httpd

[root@centos8 ~]#mkdir /var/www/html/centos/8/ -p

[root@centos8 ~]#mount /dev/sr0 /var/www/html/centos/8/

4）开始安装

PXE方式

1）安装相关文件

[root@centos8 ~]#dnf -y install dhcp-server tftp-server httpd syslinuxnonlinux(或者syslinux-tftpboot)

[root@centos8 ~]#systemctl enable --now httpd tftp dhcpd

2）配置DHCP服务

（1）关闭VW DHCP服务

（2）修改配置文件

[root@centos8 ~]# cp /usr/share/doc/dhcp-server/dhcpd.conf.example  /etc/dhcp/dhcpd.conf

cp: overwrite '/etc/dhcp/dhcpd.conf'? y

[root@centos8 ~]# vim /etc/dhcp/dhcpd.conf

[root@centos8 ~]# cat /etc/dhcp/dhcpd.conf

option domain-name "example.org";

option domain-name-servers 180.76.76.76, 223.5.5.5;

default-lease-time 86400;

max-lease-time 106400;

subnet 10.0.0.0 netmask 255.255.255.0 {

    range 10.0.0.160 10.0.0.180;

    option routers 10.0.0.2;

    next-server 10.0.0.152;

    filename "pxelinux.0";

}

[root@centos8 ~]# systemctl restart dhcpd
[root@centos8 ~]# systemctl status dhcpd
● dhcpd.service - DHCPv4 Server Daemon
Loaded: loaded (/usr/lib/systemd/system/dhcpd.service; enabled; vendor preset: disabled)
Active: active (running) since Sat 2022-07-23 01:45:02 CST; 10s ago
Docs: man:dhcpd(8)
man:dhcpd.conf(5)
Main PID: 1455 (dhcpd)
Status: "Dispatching packets..."
Tasks: 1 (limit: 12254)
Memory: 5.4M
CGroup: /system.slice/dhcpd.service
└─1455 /usr/sbin/dhcpd -f -cf /etc/dhcp/dhcpd.conf -user dhcpd -group dhcpd --no-pid

Jul 23 01:45:02 centos8.linux.org dhcpd[1455]: Source compiled to use binary-leases
Jul 23 01:45:02 centos8.linux.org dhcpd[1455]: Wrote 0 class decls to leases file.
Jul 23 01:45:02 centos8.linux.org dhcpd[1455]: Wrote 0 deleted host decls to leases file.
Jul 23 01:45:02 centos8.linux.org dhcpd[1455]: Wrote 0 new dynamic host decls to leases file.
Jul 23 01:45:02 centos8.linux.org dhcpd[1455]: Wrote 1 leases to leases file.
Jul 23 01:45:02 centos8.linux.org dhcpd[1455]: Listening on LPF/ens160/00:0c:29:d6:88:e0/10.0.0.0/24
Jul 23 01:45:02 centos8.linux.org dhcpd[1455]: Sending on LPF/ens160/00:0c:29:d6:88:e0/10.0.0.0/24
Jul 23 01:45:02 centos8.linux.org dhcpd[1455]: Sending on Socket/fallback/fallback-net
Jul 23 01:45:02 centos8.linux.org dhcpd[1455]: Server starting service.
Jul 23 01:45:02 centos8.linux.org systemd[1]: Started DHCPv4 Server Daemon.

（3）配置httpd服务

[root@centos8 ~]#mkdir -pv /var/www/html/centos/8/os/x86_64/

[root@centos8~]#mount /dev/sr0 /var/www/html/centos/6/os/x86_64/

[root@centos8 ~]# df

Filesystem     1K-blocks     Used Available Use% Mounted on

devtmpfs          980372        0    980372   0% /dev

tmpfs             998404        0    998404   0% /dev/shm

tmpfs             998404     8896    989508   1% /run

tmpfs             998404        0    998404   0% /sys/fs/cgroup

/dev/nvme0n1p1 104806400  2496056 102310344   3% /

/dev/nvme0n1p2  52403200   398400  52004800   1% /data

/dev/nvme0n1p5    999320   144280    786228  16% /boot

tmpfs             199680        0    199680   0% /run/user/0

/dev/sr0        10540998 10540998         0 100% /var/www/html/centos/8/os/x86_64

（4）配置应答文件

[root@centos8 ~]# mkdir /var/www/html/centos/ks

[root@centos8 ~]# vim  /var/www/html/centos/ks/centos8.cfg

[root@centos8 ~]# cat /var/www/html/centos/ks/centos8.cfg

ignoredisk --only-use=nvme0n1

zerombr

text

reboot

clearpart --all --initlabel

selinux --disabled

firewall --disabled

url --url=http://10.0.0.100/centos/8/os/x86_64/

keyboard --vckeymap=us --xlayouts='us'

lang en_US.UTF-8

network --bootproto=dhcp --device=eth0 --ipv6=auto --activate

bootloader --append="net.ifnames=0" --location=mbr --boot-drive=nvme0n1

network --hostname=centos8.magedu.org

rootpw --iscrypted $6$j9YhzDUnQVnxaAk8$qv7rkMcPAEbV5yvwsP666DXWYadd3jYjkA9fpxAo9qYotjGGBUclCGoP1TRvgHBpqgc5n0RypMsPTQnVDcpO01

firstboot --enable

skipx

services --disabled="chronyd"

timezone Asia/Shanghai --isUtc --nontp

user --name=wang --password=6oUfb/02CWfLb5l8f$sgEZeR7c7DpqfpmFDH6huSmDbW1XQNR4qKl2EPns.gOXqlnAIgv9pTogtFVaDtEpMOC.SWXKYqxfVtd9MCwxb1 --iscrypted --gecos="wang"

#autopart --type=lvm

#part / --fstype xfs --size 1 --grow --ondisk nvme0n1

part / --fstype="xfs" --ondisk=nvme0n1 --size=102400

part /data --fstype="xfs" --ondisk=nvme0n1 --size=51200

part swap --fstype="swap" --ondisk=nvme0n1 --size=2048

part /boot --fstype="ext4" --ondisk=nvme0n1 --size=1024

%packages

@^minimal-environment

kexec-tools

%end

%addon com_redhat_kdump --enable --reserve-mb='auto'

%end

%anaconda

pwpolicy root --minlen=6 --minquality=1 --notstrict --nochanges --notempty

pwpolicy user --minlen=6 --minquality=1 --notstrict --nochanges --emptyok

pwpolicy luks --minlen=6 --minquality=1 --notstrict --nochanges --notempty

%end

（5）配置PXE启动相关文件

root@centos8 ~]# mkdir /var/lib/tftpboot/centos8

[root@centos8 ~]# cp /var/www/html/centos/8/os/x86_64/isolinux/{vmlinuz,initrd.img} /var/lib/tftpboot/centos8

[root@centos8 ~]# cp /usr/share/syslinux/{pxelinux.0,menu.c32} /var/lib/tftpboot/

[root@centos8 ~]# cp /var/www/html/centos/8/os/x86_64/isolinux/{ldlinux.c32,libcom32.c32,libutil.c32} /var/lib/tftpboot/

[root@centos8 ~]# mkdir /var/lib/tftpboot/pxelinux.cfg/

[root@centos8 ~]# cp /var/www/html/centos/8/os/x86_64/isolinux/isolinux.cfg /var/lib/tftpboot/pxelinux.cfg/default

[root@centos8 ~]# cp /var/www/html/centos/8/os/x86_64/isolinux/isolinux.cfg /var/lib/tftpboot/pxelinux.cfg/default

[root@centos8 ~]# tree /var/lib/tftpboot/

/var/lib/tftpboot/

├── centos8

│   ├── initrd.img

│   └── vmlinuz

├── ldlinux.c32

├── libcom32.c32

├── libutil.c32

├── menu.c32

├── pxelinux.0

└── pxelinux.cfg

    └── default

2 directories, 8 files

（6）准备启动菜单

[root@centos8 centos]# vim /var/lib/tftpboot/pxelinux.cfg/default

[root@centos8 centos]# cat /var/lib/tftpboot/pxelinux.cfg/default

default menu.c32

timeout 600

menu title Install CentOS Linux

label linux8

 menu label Auto Install CentOS Linux ^8

 kernel centos8/vmlinuz

 append initrd=centos8/initrd.img ks=http://10.0.0.152/centos/ks/centos8.cfg

label manual

 menu label ^Manual Install CentOS Linux 8.0

 kernel centos8/vmlinuz

append initrd=centos8/initrd.img

inst.repo=http://10.0.0.152/centos/8/os/x86_64/

label rescue

 menu label ^Rescue a CentOS Linux system 8

 kernel centos8/vmlinuz

 append initrd=centos8/initrd.img

inst.repo=http://10.0.0.152/centos/8/os/x86_64/ rescue 

label local

 menu default

 menu label Boot from ^local drive

 localboot 0xffff

(7)开始安装

注意：安装前内存要调大，不然会出现failed to start switch root；/dev/root does not exits的报错！

Cobbler自动化安装

1）安装相关包，启动服务

[root@centos7 ~]#yum install cobbler dhcp -y

[root@centos7 ~]#systemctl enable --now cobblerd httpd tftp dhcpd

2）修改cobbler配置

[root@centos7 ~]#cobbler check

The following are potential configuration items that you may want to fix:

1 : The 'server' field in /etc/cobbler/settings must be set to something other

than localhost, or kickstarting features will not work. This should be a

resolvable hostname or IP for the boot server as reachable by all machines that

will use it.

2 : For PXE to be functional, the 'next_server' field in /etc/cobbler/settings

must be set to something other than 127.0.0.1, and should match the IP of the

boot server on the PXE network.

3 : change 'disable' to 'no' in /etc/xinetd.d/tftp4 : Some network boot-loaders are missing from /var/lib/cobbler/loaders, you may

run 'cobbler get-loaders' to download them, or, if you only want to handle

x86/x86_64 netbooting, you may ensure that you have installed a *recent* version

of the syslinux package installed and can ignore this message entirely. Files

in this directory, should you want to support all architectures, should include

pxelinux.0, menu.c32, elilo.efi, and yaboot. The 'cobbler get-loaders' command is

the easiest way to resolve these requirements.

5 : enable and start rsyncd.service with systemctl

6 : debmirror package is not installed, it will be required to manage debian

deployments and repositories

7 : ksvalidator was not found, install pykickstart

8 : The default password used by the sample templates for newly installed

machines (default_password_crypted in /etc/cobbler/settings) is still set to

'cobbler' and should be changed, try: "openssl passwd -1 -salt 'random-phrasehere' 'your-password-here'" to generate new one

9 : fencing tools were not found, and are required to use the (optional) power

management features. install cman or fence-agents to use them

[root@centos7 ~]#openssl passwd -1 'magedu'

$1$1spuisnh$j34LNmyTQWs3l6xKxCZY60

[root@centos7 ~]#vim /etc/cobbler/settings

default_password_crypted: "$1$1spuisnh$j34LNmyTQWs3l6xKxCZY60"

next_server：< tftp服务器的 IP 地址>

server：<cobbler服务器的 IP 地址>

manage_dhcp：1

pxe_just_once: 1

[root@centos7 ~]#systemctl restart cobblerd

3）DHCP服务

[root@centos7 ~]#vim /etc/cobbler/dhcp.template

subnet 192.168.100.0 netmask 255.255.255.0 {

     option routers             192.168.100.1;

     option domain-name-servers 180.76.76.76,223.6.6.6;

     option subnet-mask         255.255.255.0;

     range dynamic-bootp       192.168.100.1 192.168.100.200;

[root@centos7 ~]#cobbler sync

4）导入文件

root@centos7 ~]#cobbler import --name=centos-8.1-x86_64 --path=/misc/cd --

arch=x86_64

[root@centos7 ~]#mount /dev/sr1 /mnt

mount: /dev/sr1 is write-protected, mounting read-only

[root@centos7 ~]#cobbler import --name=centos-7.7-x86_64 --path=/mnt --

arch=x86_64 --kickstart=/var/lib/cobbler/kickstarts/centos7.cfg

[root@centos7 ~]#du -sh /var/www/cobbler/ks_mirror/*

11G /var/www/cobbler/ks_mirror/centos-7.7-x86_64

7.2G /var/www/cobbler/ks_mirror/centos-8.1-x86_64

12K /var/www/cobbler/ks_mirror/config


[root@centos7 ~]#cobbler distro list

   centos-7.7-x86_64

[root@centos7 ~]#cobbler profile list

   centos-7.7-x86_64

3. 搭建配置主从DNS服务器，实现区域传送，并实现智能DNS。

DNS主服务端：192.168.150.128

DNS从服务端:192.168.150.129

web服务器：192.168.150.139

DNS客户端：192.168.150.130

主服务器：

[root@OS ~]#yum install bind -y

[root@OS ~]#vim /etc/named.conf

#注释掉下面两行

// listen-on port 53 { 127.0.0.1; };

// allow-query     { localhost; };

#只允许从服务器进行区域传输，为了数据安全

allow-transfer { 192.168.150.129;};

[root@OS ~]#vim /etc/named.rfc1912.zones

zone "zhang.com" IN {

   type master;

   file "zhang.com.zone";

};

[root@OS ~]#cp -ap /var/named/named.localhost /var/named/magedu.org.zone

[root@OS ~]#vim /var/named/zhang.com.zone

$TTL 1D

@       IN SOA  master  admin.zhang.com.  (

                                        1       ; serial

                                        1D      ; refresh

                                        1H      ; retry

                                        1W      ; expire

                                        3H )    ; minimum

        NS      master

        NS      slave

master  A       192.168.150.128

slave   A       192.168.150.129

www     A       192.168.150.139

[root@OS ~]#systemctl start named          #第一次启动服务

[root@OS ~]#rndc reload                    #不是第一次启动服务

[root@OS ~]#named-checkconf                #语法检查  

从服务器：

[root@os7 ~]#

vim /etc/named.conf

#注释掉下面两行

// listen-on port 53 { 127.0.0.1; };

// allow-query     { localhost; };

#不允许其它主机进行区域传输，为了数据安全必须操作

   allow-transfer { none;};

[root@os7 ~]# vim /etc/named.rfc1912.zones

zone "zhang.com" IN {

   type slave;

   masters { 192.168.150.128;};

   file "slaves/zg.com.slave";

};

[root@os7 ~]# ls /var/named/slaves/magedu.org.slave #查看区域数据库文件是否生成

systemctl start named          #第一次启动服务

rndc reload                    #不是第一次启动服务

web服务器：

[root@os7 ~]#yum  -y install httpd

[root@os7 ~]#echo www.zhang.com > /var/www/html/index.html

[root@os7 ~]#systemctl  start httpd

客户端：

[root@OS ~]# yum -y install bind bind-utils

[root@OS ~]# systemctl start named

[root@OS ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

NAME=eth0

BOOTPROTO=static

IPADDR=192.168.150.130

PREFIX=24

DNS1=192.168.150.128

DNS2=192.168.150.129

ONBOOT=yes

#验证从DNS服务器是否可以查询

[root@OS ~]# curl www.zhang.com

www.zhang.com

[root@OS ~]# dig www.zhang.com

; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> www.zhang.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56249

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 1232

; COOKIE: c822e0403af8d0438ff2fc5562c84aef88531745f920cb3c (good)

;; QUESTION SECTION:

;www.zhang.com.            IN    A

;; ANSWER SECTION:

www.zhang.com.        86400    IN    A    192.168.150.139

;; AUTHORITY SECTION:

zhang.com.            86400    IN    NS    master.zhang.com.

zhang.com.            86400    IN    NS    slave.zhang.com.

;; ADDITIONAL SECTION:

master.zhang.com.        86400    IN    A    192.168.150.128

slave.zhang.com.        86400    IN    A    192.168.150.129

;; Query time: 0 msec

;; SERVER: 192.168.150.128#53(192.168.150.128)

;; WHEN: Fri Jul 08 23:19:12 CST 2022

;; MSG SIZE  rcvd: 156

4. 配置iptables 打开常用端口加固linux。使用iptables DNAT完成暴露内网端口，使用SNAT,让内网可以上网。并抓包分析过程。可以尝试firewalld实现iptables的结果。

外界机器：192.168.159.130  gateway：192.168.159.2   仅主机模式

防火墙：192.168.159.2  192.168.150.2        仅主机和nat模式（双网卡）

内部服务器：192.168.150.128   192.168.150.129   nat模式

防火墙机器增添：ip——forward功能

[root@centos8 ~]#vim /etc/sysctl.conf

net.ipv4.ip_forward=1

内部服务器：安装http服务，

192.168.150.129:  echo  192.168.150.129 > /var/www/html/index.html

192.168.150.128:  echo  192.168.150.128 > /var/www/html/index.html

此时就可以互相ping通和访问了：

[root@OS ~]# curl  192.168.150.128

192.168.150.128

[root@OS ~]# curl  192.168.150.129

192.168.150.129

当在防火墙加一条iptables规则时： 禁止192.168.150网段的机器访问

[root@OS ~]# iptables -A  FORWARD ! -s 192.168.150.0/24 -m state --state NEW -j REJECT

[root@OS ~]# ping 192.168.150.128

PING 192.168.150.128 (192.168.150.128) 56(84) bytes of data.

From 192.168.159.2 icmp_seq=1 Destination Port Unreachable

From 192.168.159.2 icmp_seq=2 Destination Port Unreachable

From 192.168.159.2 icmp_seq=3 Destination Port Unreachable

From 192.168.159.2 icmp_seq=4 Destination Port Unreachable

From 192.168.159.2 icmp_seq=5 Destination Port Unreachable

[root@OS ~]# curl 192.168.150.128

curl: (7) Failed to connect to 192.168.150.128 port 80: Connection refused

[root@OS ~]# curl 192.168.150.129

curl: (7) Failed to connect to 192.168.150.129 port 80: Connection refused

<!-- wp:code -->

<pre class="wp-block-code"><code>外界机器：192.168.159.130  gateway：192.168.159.2   仅主机模式

防火墙：192.168.159.2  192.168.150.2        仅主机和nat模式（双网卡）

内部服务器：192.168.150.128   192.168.150.129   nat模式

防火墙机器增添：ip——forward功能

&#91;root@centos8 ~]#vim /etc/sysctl.conf

net.ipv4.ip_forward=1

内部服务器：安装http服务，

192.168.150.129:  echo  192.168.150.129 > /var/www/html/index.html

192.168.150.128:  echo  192.168.150.128 > /var/www/html/index.html

此时就可以互相ping通和访问了：

&#91;root@OS ~]# curl  192.168.150.128

192.168.150.128

&#91;root@OS ~]# curl  192.168.150.129

192.168.150.129

当在防火墙加一条iptables规则时： 禁止192.168.150网段的机器访问

[root@OS ~]# iptables -A  FORWARD ! -s 192.168.150.0/24 -m state --state NEW -j REJECT

[root@OS ~]# ping 192.168.150.128

PING 192.168.150.128 (192.168.150.128) 56(84) bytes of data.

From 192.168.159.2 icmp_seq=1 Destination Port Unreachable

From 192.168.159.2 icmp_seq=2 Destination Port Unreachable

From 192.168.159.2 icmp_seq=3 Destination Port Unreachable

From 192.168.159.2 icmp_seq=4 Destination Port Unreachable

From 192.168.159.2 icmp_seq=5 Destination Port Unreachable

[root@OS ~]# curl 192.168.150.128

curl: (7) Failed to connect to 192.168.150.128 port 80: Connection refused

[root@OS ~]# curl 192.168.150.129

curl: (7) Failed to connect to 192.168.150.129 port 80: Connection refused

[root@OS ~]# iptables -I FORWARD ! -s 192.168.150.0/24 -d 192.168.150.129  -m state NEW -p  tcp --dport 80 -j ACCEPT

当在前一条iptables插入允许访问129的80端口时：

[root@centos7_6 ~]# iptables -I FORWARD ! -s 192.168.150.0/24 -d 192.168.150.129  -m state --state NEW -p  tcp --dport 80 -j ACCEPT

[root@centos7_6 ~]# iptables -vnL

Chain INPUT (policy ACCEPT 29 packets, 1700 bytes)

 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

 pkts bytes target     prot opt in     out     source               destination

    0     0 ACCEPT     tcp  --  *      *      !192.168.150.0/24     192.168.150.129      state NEW tcp dpt:80

  464 38928 REJECT     all  --  *      *      !192.168.150.0/24     0.0.0.0/0            state NEW reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT 17 packets, 1260 bytes)

 pkts bytes target     prot opt in     out     source               destination 

  [root@OS ~]# curl 192.168.150.129

192.168.150.129

NAT的实现分为下面类型：

SNAT：source NAT ，支持POSTROUTING, INPUT，让本地网络中的主机通过某一特定地址访问

外部网络，实现地址伪装,请求报文：修改源IP

DNAT：destination NAT 支持PREROUTING , OUTPUT，把本地网络中的主机上的某服务开放给外

部网络访问(发布服务和端口映射)，但隐藏真实IP,请求报文：修改目标IP

PNAT: port nat，端口和IP都进行修改

网络最终实现———— NAT+PAT  不仅仅ip地址进行了转换，port端口也进行了转换。

结合上面实验，实现SNAT DNAT（删除客户端的网关）！！！

SNAT

[root@centos7_6 ~]# iptables -F               #清空上面的iptables规则

[root@centos7_6 ~]# iptables -t nat -A POSTROUTING -s 192.168.150.0/24 ! -d 192.168.150.0/24 -j MASQUERADE

#只要是192.168.150.0/24网段的机器访问其它网段，都做地址转换。

[root@OS ~]# ping 192.168.159.130

PING 192.168.159.130 (192.168.159.130) 56(84) bytes of data.

64 bytes from 192.168.159.130: icmp_seq=1 ttl=128 time=0.784 ms

64 bytes from 192.168.159.130: icmp_seq=2 ttl=128 time=0.694 ms

64 bytes from 192.168.159.130: icmp_seq=3 ttl=128 time=1.50 ms

64 bytes from 192.168.159.130: icmp_seq=4 ttl=128 time=1.28 ms

64 bytes from 192.168.159.130: icmp_seq=5 ttl=128 time=0.546 ms

64 bytes from 192.168.159.130: icmp_seq=6 ttl=128 time=0.767 ms

[root@OS ~]# tcpdump -i eth0 -nn icmp    #在外部机器上抓包发现ip地址不显示内部访问地址

dropped privs to tcpdump

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes

20:57:24.466670 IP 192.168.159.1 > 192.168.159.130: ICMP echo request, id 5, seq 1, length 64

20:57:24.466703 IP 192.168.159.130 > 192.168.159.1: ICMP echo reply, id 5, seq 1, length 64

20:57:25.476241 IP 192.168.159.1 > 192.168.159.130: ICMP echo request, id 5, seq 2, length 64

20:57:25.476271 IP 192.168.159.130 > 192.168.159.1: ICMP echo reply, id 5, seq 2, length 64

20:57:26.501190 IP 192.168.159.1 > 192.168.159.130: ICMP echo request, id 5, seq 3, length 64

20:57:26.501222 IP 192.168.159.130 > 192.168.159.1: ICMP echo reply, id 5, seq 3, length 64

DNAT            #访问192.168.159.2时，转发给192.168.120.129

[root@centos7_6 ~]# iptables -t nat -A PREROUTING -d 192.168.159.2 -p tcp --dport 80 -j DNAT --to-destination 192.168.150.129:80

[root@OS ~]# curl 192.168.159.2

192.168.150.129

5. 脚本实现openvpn的一键安装，日常管理：加用户，吊销用户等。

[root@OS ~]#vim  install_openvpn.sh

#!/bin/bash

openvpn脚本

#需要保证有网络

yum -y install openssl openssl-devel easy-rsa openvpn

#判断是否安装成功

if [ $? -eq 0 ];then

    echo "安装成功！"

else

    echo "未能安装成功！请检查网络环境或yum源配置情况"

fi

#准备配置文件

cp /usr/share/doc/openvpn/sample/sample-config-files/server.conf  /etc/openvpn/

cp -r /usr/share/easy-rsa/  /etc/openvpn/easy-rsa-server

cp /usr/share/doc/easy-rsa/vars.example  /etc/openvpn/easy-rsa-server/3/vars

#初始化PKI生成PKI相关目录和文件

cd /etc/openvpn/easy-rsa-server/3/

./easyrsa init-pki

./easyrsa build-ca nopass

echo "请输入证书名称"

./easyrsa gen-req server nopass

./easyrsa sign server server

echo "是否同意颁发证书，同意请输入yes"

#生成算法

./easyrsa gen-dh

echo "请稍候"

mkdir /etc/openvpn/certs

cp /etc/openvpn/easy-rsa-server/3/pki/ca.crt      /etc/openvpn/certs/

cp /etc/openvpn/easy-rsa-server/3/pki/issued/server.crt   /etc/openvpn/certs/

cp /etc/openvpn/easy-rsa-server/3/pki/private/server.key    /etc/openvpn/certs/

cp /etc/openvpn/easy-rsa-server/3/pki/dh.pem       /etc/openvpn/certs/

echo "**将****CA****和服务器证书相关文件已复制到服务器相应的目录"

rm  -rf   /etc/openvpn/server.conf

touch /etc/openvpn/server.conf

cat >  /etc/openvpn/server.conf <<eof

yum -y install epel-release

port 1194

proto tcp

dev tun

ca /etc/openvpn/certs/ca.crt

cert /etc/openvpn/certs/server.crt

key /etc/openvpn/certs/server.key

dh /etc/openvpn/certs/dh.pem

server  内网地址  255.255.255.0

push "route  公网地址  255.255.0.0 "

keepalive 10 120

cipher AES-256-CBC

compress lz4-v2

push "compress lz4-v2"

max-clients 2048

user openvpn

group openvpn

status /var/log/openvpn/openvpn-status.log

log-append /var/log/openvpn/openvpn.log

verb 3

mute 20

#tls-auth /etc/openvpn/certs/ta.key 0           #ka秘钥生成后

crl-verify /etc/openvpn/easy-rsa-server/3/pki/crl.pem  #吊销证书的存放地址

eof

mkdir /var/log/openvpn

chown openvpn.openvpn /var/log/openvpn

echo net.ipv4.ip_forward = 1 >> /etc/sysctl.conf

sysctl -p

echo 'iptables -t nat -A POSTROUTING -s 内网网段/24 -j MASQUERADE' >> /etc/rc.d/rc.local

if [ ! -d "/usr/lib/systemd/system/openvpn@.service" ];then

    mkdir -p /usr/lib/systemd/system/openvpn@.service

    echo "openvpn@.service创建成功"

cat > /usr/lib/systemd/system/openvpn@.service<<eof

[Unit]

Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I

After=network.target

[Service]

Type=notify

PrivateTmp=true

ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/ --config %i.conf

[Install]

WantedBy=multi-user.target

eof

[root@OS ~]# vim  openvpn-create-newuser-crt.sh 

. /etc/init.d/functions

OPENVPN_SERVER=公网ip

PASS=123456

remove_cert () {

    rm -rf /etc/openvpn/client/${NAME}

    find /etc/openvpn/ -name "$NAME.*" -delete

}

create_cert () {

    cd /etc/openvpn/easy-rsa-client/3

    ./easyrsa  gen-req ${NAME} nopass <<EOF

EOF

    cd /etc/openvpn/easy-rsa-server/3

    ./easyrsa import-req /etc/openvpn/easy-rsa-client/3/pki/reqs/${NAME}.req ${NAME}

    ./easyrsa sign client ${NAME} <<EOF

yes

EOF

    mkdir  /etc/openvpn/client/${NAME}

    cp /etc/openvpn/easy-rsa-server/3/pki/issued/${NAME}.crt /etc/openvpn/client/${NAME}

    cp /etc/openvpn/easy-rsa-client/3/pki/private/${NAME}.key  /etc/openvpn/client/${NAME}

    cp /etc/openvpn/certs/{ca.crt,dh.pem,ta.key} /etc/openvpn/client/${NAME}

  ./easyrsa sign client ${NAME} <<EOF

yes

EOF

    mkdir  /etc/openvpn/client/${NAME}

    cp /etc/openvpn/easy-rsa-server/3/pki/issued/${NAME}.crt /etc/openvpn/client/${NAME}

    cp /etc/openvpn/easy-rsa-client/3/pki/private/${NAME}.key  /etc/openvpn/client/${NAME}

    cp /etc/openvpn/certs/{ca.crt,dh.pem,ta.key} /etc/openvpn/client/${NAME}

    cat >  /etc/openvpn/client/${NAME}/client.ovpn <<EOF

client

dev tun

proto tcp

remote $OPENVPN_SERVER 1194

resolv-retry infinite

nobind

#persist-key

#persist-tun

ca ca.crt

cert $NAME.crt

key $NAME.key

remote-cert-tls server

tls-auth ta.key 1

cipher AES-256-CBC

verb 3

compress lz4-v2

EOF

    echo "证书存放路径:/etc/openvpn/client/${NAME},证书文件如下:"

    echo -e "\E[1;32m******************************************************************\E[0m"

    ls -l /etc/openvpn/client/${NAME}

    echo -e "\E[1;32m******************************************************************\E[0m"

    cd /etc/openvpn/client/${NAME}

    zip -qP "$PASS" /root/${NAME}.zip *

    action  "证书的打包文件已生成: /root/${NAME}.zip"

}

read -p "请输入用户(如:zhang): " NAME

remove_cert

create_cert

7. 总结数据库原理。

数据的分类：

　　结构化的数据：即有固定格式和有限长度的数据。例如填的表格就是结构化的数据，国籍：中华人民共和国，民族：汉，性别：男，这都叫结构化数据　　

　　非结构化的数据：非结构化的数据越来越多，就是不定长、无固定格式的数据，例如: 网页,图片文件，有时候非常大，有时候很小；例如语音，视频都是非结构化的数据

　　半结构化数据：比如：XML或者HTML的格式的数据

数据库系统发展阶段

　　萌芽阶段：文件系统使用磁盘文件来存储数据

　　初级阶段：第一代数据库出现了网状模型、层次模型的数据库

　　中级阶段：第二代数据库关系型数据库和结构化查询语言

　　高级阶段：新一代数据库 "关系-对象"型数据库

DBMS 数据库管理系统

　　Database：数据库是数据的汇集，它以一定的组织形式存于存储介质上

　　DBMS：Database Management System, 是管理数据库的系统软件，它实现数据库系统的各种功能。是数据库系统的核心

　　DBA：Database Administrator, 负责数据库的规划、设计、协调、维护和管理等工作

　　Application：应用程序,指以数据库为基础的应用程序

数据库管理系统的优点

　　程序与数据相互独立

　　保证数据的安全、可靠

　　最大限度地保证数据的正确性

　　数据可以并发使用并能同时保证一致性

　　相互关联的数据的集合

　　较少的数据冗余

数据库管理系统的基本功能

　　数据定义

　　数据处理

　　数据安全

　　数据备份

数据库系统的架构

　　单机架构

　　大型主机/终端架构

　　主从式架构（C/S）

　　分布式架构

巴特西

第五周作业-N67044-张铭扬

最新文章

热门文章