A 模块浙江题解.note

noteId: 85CF576034AE48449EE1C90DED8F1A02 · 原始路径：/ALL/世赛题目（练习） - 笔记/集训笔记/浙江-嘉兴/A 模块浙江题解.note · 图片：30 · 附件待处理：0

· 初始化：

有时如果 dbus 启用失败，可能是因为没有安装，可以先将其安装：apt install -y dbus

安装 Site-to-Site VPN 的软件包（因为有的服务安装了就会给分）：

apt install -y strongswan

apt install -y curl wget lynx dnsutils ftp lftp nfs-common smbclient ssh telnet traceroute ntpdate lsof nmap bsd-mailx sudo vim bash-completion net-tools man dbus
systemctl restart dbus
timedatectl set-timezone Asia/Shanghai
localectl set-x11-keymap us

一、路由：

1、开启路由功能：

2、配置 OSPF：

apt install -y frr
# 启用 ospf，并书写进程：
vim /etc/frr/daemons

vtysh
conf t
router ospf 1
exit
interfaces ens33
ip ospf 1 area 0    //在需要建立ospf邻居的接口输入即可
exit
interfaces ens35
ip ospf 1 area 0
end
wr me

二、SSH 免密登录：

ssh-keygen
# 不输入密码（密码为空）
ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.100.110    //将公钥复制到要连接的远程机器
# 接下来就能够免密进行登录了（因为根本就没有密码）

1、vscode 免密登录：

正常配置完成后只需要再添加一条：

# 输入 id 之后vscode有自动补全

三、Ansible 剧本：

1、1-initial.yml：

---

- name: init

  hosts: all

  gather_facts: False

 
  tasks:

    - name:

      block:

        - name: hostname

          raw:  apt install -y dbus && systemctl restart dbus && hostnamectl set-hostname {{ inventory_hostname }}

          changed_when: False

 
        - name: hostname

          copy: 

            src: "/etc/ansible/{{ inventory_hostname }}.hosts"

            dest: /etc/hosts

 
        - name: timezone

          raw: timedatectl set-timezone Asia/Shanghai

          changed_when: False

        

        - name: timesync

          raw: apt purge -y systemd-timesyncd && apt install -y systemd-timesyncd && echo "NTP=213.110.3.10" >> /etc/systemd/timesyncd.conf && systemctl restart systemd-timesyncd

          changed_when: False

 
        - name: nameserver

          raw: echo "nameserver 172.16.10.101" > /etc/resolv.conf && echo "nameserver 172.16.10.102" >> /etc/resolv.conf

          changed_when: False

 
        - name: nameserver

          raw: echo "nameserver 172.16.10.102" > /etc/resolv.conf

          changed_when: False

          when: inventory_hostname == "SERVER1"

 
        - name: nameserver

          raw: echo "nameserver 172.16.10.101" > /etc/resolv.conf

          changed_when: False

          when: inventory_hostname == "SERVER2"

 
 
        - name: ssh

          copy:

            src: /etc/ansible/sshd_config

            dest: /etc/ssh/sshd_config

          changed_when: False

          

        - name: ssh

          raw: systemctl restart sshd

          changed_when: False

 
        - name: ssh

          copy:

            src: /etc/ansible/authorized_keys 

            dest: /root/.ssh/authorized_keys 

          changed_when: False

 
        - name: package

          raw: apt install -y curl dnsutils lsof nfs-common

          changed_when: False

 
        - name: alias

          copy:

            src: /etc/ansible/profile

            dest: /etc/profile

          changed_when: False

          

        - name: alias

          reboot:

          changed_when: False

1、在 MANAGE 上配置 SSH 免密登录、连接别名：

· 先编辑hosts文件：

vim /etc/hosts
# 在末尾添加：

ssh-keygen
# 不输入密码，直接回车
ssh-copy-id root@172.16.10.101
# 使用 ssh-copy-id 命令后，172.16.10.101 的 root用户家目录下就会有 本台机的公钥，将 172.16.10.101 上的 .ssh/auth... 文件 复制到 ansible主控端上，然后通过 copy 复制到 ansible被控端
# 172.16.10.101: scp /root/.ssh/authorized_keys root@192.168.100.110（这里无法直接传给MANAGE，可以先传给 ROUTER1）

2、配置别名：lh 查看hostname 和 FQDN，tz 查看当前时区：

vim /etc/profile
# 在末尾添加：

# 然后将他 scp 给 Ansible 主控端

2、2-dnsserver.yml:

---

- name: dns server

  hosts: SERVER1,SERVER2

  gather_facts: False

 
  tasks:

    - name: dns server

      raw: apt install -y bind9 dnsutils bind9-utils

      changed_when: False

 
    - name: dns server

      block:

      - name: dns server

        copy:

          src: /etc/ansible/named.conf

          dest: /etc/bind/named.conf

        changed_when: False

      

      - name: dns server

        copy:

          src: /etc/ansible/db.16

          dest: /etc/bind/db.16

        changed_when: False

 
      - name: dns server

        copy:

          src: /etc/ansible/db.31

          dest: /etc/bind/db.31

        changed_when: False

      when: inventory_hostname == "SERVER1"

        

 
    - name: dns server

      block:

      - name: dns server

        copy:

          src: /etc/ansible/back/named.conf

          dest: /etc/bind/named.conf

        changed_when: False

      when: inventory_hostname == 'SERVER2'

    

    - name: dns server

      raw: systemctl restart bind9

      changed_when: False

1、配置 DNS 主从：

· 主 dns 服务器配置：

named.conf

· db.dy:

· db.16：

· db.31：

· 从 dns 服务器配置：

named.conf

3、2-ftpserver.yml：

---

- name: ftp server

  hosts: SERVER5,SERVER6

  gather_facts: False

 
  tasks:

    - name: 

      apt:

        name: vsftpd

        update_cache: no

      changed_when: False

4、3-iptables.yml：

---

- name: secure firewall

  hosts: all

  gather_facts: False

 
  tasks:

 
    - name: secure firewall

      apt: 

        name: 

          - iptables

          - iptables-persistent

        update_cache: no

      changed_when: False

 
    - name: secure firewall

      copy:

        src: /etc/ansible/back/rules.v4

        dest: /etc/iptables/rules.v4

      changed_when: False

 
    - name: secure firewall

      copy:

        src: /etc/ansible/rules.v4

        dest: /etc/iptables/rules.v4

      changed_when: False

      when: inventory_hostname == "SERVER1" or inventory_hostname == "SERVER2"

 
    - name: secure firewall

      reboot:

      changed_when: False

1、SERVER1、SERVER2 的配置：

# 配置完后 将“/etc/iptables/rules.v4” scp 传输给 manage 即可
# 放行 tcp 53端口（DNS）
# 放行 udp 53端口（DNS）
# 放行 tcp 22端口（SSH）

2、SERVER5、SERVER6的配置：

# 配置完后 将“/etc/iptables/rules.v4” scp 传输给 manage 即可
# 放行 tcp 21端口（FTP）
# 放行 tcp 22端口（SSH）

四、iptables、nftables 防火墙：

1、ROUTER1（nftables）：

（1）创建表和链：

iptables -A INPUT -s 1.1.1.1 -j ACCEPT

iptables -A OUTPUT -s 1.1.1.1 -j ACCEPT

iptables -A FORWARD

iptables -t nat -A PREROUTING -s 1.1.1.1 -j DNAT --to 2.2.2.2

iptables -t nat -A POSTROUTING -s 1.1.1.1 -j SNAT --to 2.2.2.2

iptables -F

iptables -t nat -F

（2）设置默认策略：

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

（3）MANAGE 配置静态 NAT：

NAT 会自动将数据包的源地址转换回去，所以这里只需要ISP的一条路由即可

# ROUTING1：
nft add rule ip nat POSTROUTING ip saddr 192.168.100.110 snat 213.110.3.10
 
# ISP:
echo "up route add -net 213.110.3.10 netmask 255.255.255.255 gw 213.110.3.1" >> /etc/network/interfaces
systemctl restart networking

（4）为 GZ2024.GZ 域所有主机配置 PAT：

# 这条需要写在 将 MANAGE 那条 静态 NAT 之后
nft add rule ip nat POSTROUTING ip saddr 192.168.100.0/24 snat 213.110.3.1

（5）为服务配置端口转发：

nft add rule ip nat PREROUTING ip daddr 213.110.3.10 tcp dport 22 dnat 192.168.100.110    //SSH 流量
nft add rule ip nat PREROUTING ip daddr 213.110.3.10 udp dport 123 dnat 192.168.100.110    //NTP端口
nft add rule ip nat PREROUTING ip daddr 213.110.3.10 tcp dport 53 dnat 192.168.100.110    //DNS端口（TCP）
nft add rule ip nat PREROUTING ip daddr 213.110.3.10 udp dport 53 dnat 192.168.100.110    //DNS端口（UDP）
nft add rule ip nat PREROUTING ip daddr 213.110.3.10 tcp dport 389 dnat 192.168.100.110    //OpenLDAP端口
nft add rule ip nat PREROUTING ip daddr 213.110.3.10 udp dport 389 dnat 192.168.100.110    //OpenLDAP端口
nft add rule ip nat PREROUTING ip daddr 213.110.3.10 udp dport 1812 dnat 192.168.100.110    //RADIUS端口
nft add rule ip nat PREROUTING ip daddr 213.110.3.10 udp dport 1813 dnat 192.168.100.110    //RADIUS端口
nft add rule ip nat PREROUTING ip daddr 213.110.3.10 tcp dport 465 dnat 192.168.100.110    //postfix 邮件加密端口
nft add rule ip nat PREROUTING ip daddr 213.110.3.10 tcp dport 993 dnat 192.168.100.110    //dovecot 邮件加密端口
 
nft add rule ip nat PREROUTING ip daddr 213.110.3.10 dnat 192.168.100.110    //防止服务无法进行通信，可以添加一条转发所有（如果服务都正常使用，则可以不添加这条）

（6）始终允许来自 192.168.100.0 ......（按照题目要求）：

nft add rule ip filter INPUT ip saddr 192.168.100.0/24 accept
nft add rule ip filter INPUT ip saddr 192.168.103.0/24 accept
nft add rule ip filter INPUT ip saddr 172.16.10.0/24 accept
 
nft add rule ip filter OUTPUT ip saddr 192.168.100.0/24 accept
nft add rule ip filter OUTPUT ip saddr 192.168.103.0/24 accept
nft add rule ip filter OUTPUT ip saddr 172.16.10.0/24 accept
 
nft add rule ip filter FORWARD ip saddr 192.168.100.0/24 accept
nft add rule ip filter FORWARD ip saddr 192.168.103.0/24 accept
nft add rule ip filter FORWARD ip saddr 172.16.10.0/24 accept

（7）来自manage的流量，只允许服务所需的流量通行：

50 端口是 Site-to-Site VPN 的端口

1194 是 Remote-VPN 的端口

UDP 67、68 是 DHCP 的端口

nft add rule ip filter INPUT ip saddr 192.168.100.110 tcp dport 22 accept
nft add rule ip filter INPUT ip saddr 192.168.100.110 udp dport 123 accept
nft add rule ip filter INPUT ip saddr 192.168.100.110 tcp dport 53 accept
nft add rule ip filter INPUT ip saddr 192.168.100.110 udp dport 53 accept
nft add rule ip filter INPUT ip saddr 192.168.100.110 tcp dport 389 accept
nft add rule ip filter INPUT ip saddr 192.168.100.110 udp dport 389 accept
nft add rule ip filter INPUT ip saddr 192.168.100.110 udp dport 1812 accept
nft add rule ip filter INPUT ip saddr 192.168.100.110 udp dport 1813 accept
nft add rule ip filter INPUT ip saddr 192.168.100.110 tcp dport 465 accept
nft add rule ip filter INPUT ip saddr 192.168.100.110 tcp dport 993 accept
nft add rule ip filter INPUT ip saddr 192.168.100.110 tcp dport 50 accept
nft add rule ip filter INPUT ip saddr 192.168.100.110 udp dport 50 accept
nft add rule ip filter INPUT ip saddr 192.168.100.110 tcp dport 1194 accept
nft add rule ip filter INPUT ip saddr 192.168.100.110 udp dport 1194 accept
 
nft add rule ip filter OUTPUT ip saddr 192.168.100.110 tcp dport 22 accept

nft add rule ip filter OUTPUT ip saddr 192.168.100.110 udp dport 123 accept

nft add rule ip filter OUTPUT ip saddr 192.168.100.110 tcp dport 53 accept

nft add rule ip filter OUTPUT ip saddr 192.168.100.110 udp dport 53 accept

nft add rule ip filter OUTPUT ip saddr 192.168.100.110 tcp dport 389 accept

nft add rule ip filter OUTPUT ip saddr 192.168.100.110 udp dport 389 accept

nft add rule ip filter OUTPUT ip saddr 192.168.100.110 udp dport 1812 accept

nft add rule ip filter OUTPUT ip saddr 192.168.100.110 udp dport 1813 accept

nft add rule ip filter OUTPUT ip saddr 192.168.100.110 tcp dport 465 accept

nft add rule ip filter OUTPUT ip saddr 192.168.100.110 tcp dport 993 accept

nft add rule ip filter OUTPUT ip saddr 192.168.100.110 tcp dport 50 accept
nft add rule ip filter OUTPUT ip saddr 192.168.100.110 udp dport 50 accept
nft add rule ip filter OUTPUT ip saddr 192.168.100.110 tcp dport 1194 accept
nft add rule ip filter OUTPUT ip saddr 192.168.100.110 udp dport 1194 accept
 

nft add rule ip filter FORWARD ip saddr 192.168.100.110 tcp dport 22 accept

nft add rule ip filter FORWARD ip saddr 192.168.100.110 udp dport 123 accept

nft add rule ip filter FORWARD ip saddr 192.168.100.110 tcp dport 53 accept

nft add rule ip filter FORWARD ip saddr 192.168.100.110 udp dport 53 accept

nft add rule ip filter FORWARD ip saddr 192.168.100.110 tcp dport 389 accept

nft add rule ip filter FORWARD ip saddr 192.168.100.110 udp dport 389 accept

nft add rule ip filter FORWARD ip saddr 192.168.100.110 udp dport 1812 accept

nft add rule ip filter FORWARD ip saddr 192.168.100.110 udp dport 1813 accept

nft add rule ip filter FORWARD ip saddr 192.168.100.110 tcp dport 465 accept

nft add rule ip filter FORWARD ip saddr 192.168.100.110 tcp dport 993 accept
nft add rule ip filter FORWARD ip saddr 192.168.100.110 tcp dport 50 accept
nft add rule ip filter FORWARD ip saddr 192.168.100.110 udp dport 50 accept
nft add rule ip filter FORWARD ip saddr 192.168.100.110 tcp dport 1194 accept
nft add rule ip filter FORWARD ip saddr 192.168.100.110 udp dport 1194 accept

（8）从 internet 网络发送到 manage 的流量，只允许服务所需的流量通行：

nft add rule ip filter INPUT ip daddr 213.110.3.10 tcp dport 22 accept

nft add rule ip filter INPUT ip daddr 213.110.3.10 udp dport 123 accept

nft add rule ip filter INPUT ip daddr 213.110.3.10 tcp dport 53 accept

nft add rule ip filter INPUT ip daddr 213.110.3.10 udp dport 53 accept

nft add rule ip filter INPUT ip daddr 213.110.3.10 tcp dport 389 accept

nft add rule ip filter INPUT ip daddr 213.110.3.10 udp dport 389 accept

nft add rule ip filter INPUT ip daddr 213.110.3.10 udp dport 1812 accept

nft add rule ip filter INPUT ip daddr 213.110.3.10 udp dport 1813 accept

nft add rule ip filter INPUT ip daddr 213.110.3.10 tcp dport 465 accept

nft add rule ip filter INPUT ip daddr 213.110.3.10 tcp dport 993 accept

nft add rule ip filter INPUT ip daddr 213.110.3.10 tcp dport 50 accept
nft add rule ip filter INPUT ip daddr 213.110.3.10 udp dport 50 accept
nft add rule ip filter INPUT ip daddr 213.110.3.10 udp dport 1194 accept
nft add rule ip filter INPUT ip daddr 213.110.3.10 tcp dport 1194 accept
    

nft add rule ip filter OUTPUT ip daddr 213.110.3.10 tcp dport 22 accept

nft add rule ip filter OUTPUT ip daddr 213.110.3.10 udp dport 123 accept

nft add rule ip filter OUTPUT ip daddr 213.110.3.10 tcp dport 53 accept

nft add rule ip filter OUTPUT ip daddr 213.110.3.10 udp dport 53 accept

nft add rule ip filter OUTPUT ip daddr 213.110.3.10 tcp dport 389 accept

nft add rule ip filter OUTPUT ip daddr 213.110.3.10 udp dport 389 accept

nft add rule ip filter OUTPUT ip daddr 213.110.3.10 udp dport 1812 accept

nft add rule ip filter OUTPUT ip daddr 213.110.3.10 udp dport 1813 accept

nft add rule ip filter OUTPUT ip daddr 213.110.3.10 tcp dport 465 accept

nft add rule ip filter OUTPUT ip daddr 213.110.3.10 tcp dport 993 accept
nft add rule ip filter OUTPUT ip daddr 213.110.3.10 tcp dport 50 accept

nft add rule ip filter OUTPUT ip daddr 213.110.3.10 udp dport 50 accept
nft add rule ip filter OUTPUT ip daddr 213.110.3.10 tcp dport 1194 accept

nft add rule ip filter OUTPUT ip daddr 213.110.3.10 udp dport 1194 accept
  

nft add rule ip filter FORWARD ip daddr 213.110.3.10 tcp dport 22 accept

nft add rule ip filter FORWARD ip daddr 213.110.3.10 udp dport 123 accept

nft add rule ip filter FORWARD ip daddr 213.110.3.10 tcp dport 53 accept

nft add rule ip filter FORWARD ip daddr 213.110.3.10 udp dport 53 accept

nft add rule ip filter FORWARD ip daddr 213.110.3.10 tcp dport 389 accept

nft add rule ip filter FORWARD ip daddr 213.110.3.10 udp dport 389 accept

nft add rule ip filter FORWARD ip daddr 213.110.3.10 udp dport 1812 accept

nft add rule ip filter FORWARD ip daddr 213.110.3.10 udp dport 1813 accept

nft add rule ip filter FORWARD ip daddr 213.110.3.10 tcp dport 465 accept

nft add rule ip filter FORWARD ip daddr 213.110.3.10 tcp dport 993 accept
nft add rule ip filter FORWARD ip daddr 213.110.3.10 tcp dport 50 accept
nft add rule ip filter FORWARD ip daddr 213.110.3.10 udp dport 50 accept
nft add rule ip filter FORWARD ip daddr 213.110.3.10 tcp dport 1194 accept
nft add rule ip filter FORWARD ip daddr 213.110.3.10 udp dport 1194 accept

2、ROUTER2（iptables）：

（1）

五、NTP：

1、INET 配置 chrony：

apt install -y chrony
vim /etc/chrony/chrony.conf
# 先注释掉官方地址

2、MANAGE 配置 chrony：

apt install -y chrony systemd-timesyncd
# 先配置 chrony作为服务器
vim /etc/chrony/chrony.conf
# 先注释掉官方地址池

3、客户端使用 timedatectl 显示时间同步状态：

apt install -y systemd-timesyncd
vim /etc/systemd/timesyncd.conf

systemctl restart systemd-timesyncd

六：DNS

1、MANAGE：

（1）named.conf：

vim /etc/named.conf

（2）“inside”区域：db.GZ：

vim /etc/bind/db.GZ

（3）“inside”区域：db.192：

vim /etc/bind/db.192

（4）“outside”区域：db.out：

vim /etc/bind/db.out

（5）“outside”区域：db.213：

vim /etc/bind/db.213

七、RAID、LVM、ISCSI：

1、RAID 10：

按照题目要求添加磁盘

apt install -y mdadm
mdadm -C /dev/md0 -l10 -n4 -x1 /dev/sd[bcdef]
mdadm -Ds >> /etc/mdadm/mdadm.conf
update-initramfs -u

2、LVM：

apt install -y lvm2
pvcreate /dev/md0    //使用 /dev/md0 创建一个 pv
vgcreate vg0 /dev/md0    //使用 /dev/md0 创建 vg0 卷组
lvcreate -L 1G -n lv0 vg0    //使用 vg0 卷组创建一个 名为‘lv0’的 1G 的逻辑卷
 
# 查看：
vgs
lvs

· 格式化磁盘：

apt install -y xfsdump
mkfs.xfs /dev/vg0/lv0

· 挂载到 /iSCSI 目录：

mkdir /iSCSI
vim /etc/fstab

mount -a

3、ISCSI：

iscsi 使用另一块磁盘，不使用 RAID 创建的磁盘，因为它已经被挂载

（1）ISCSI 服务器配置：

apt install -y tgt
# 查看 配置参考，并将其复制：
vim /usr/share/doc/tgt/examples/targets.conf.example

vim /etc/tgt/targets.conf

systemctl restart tgt

（2）ISCSI 客户端配置：

apt install -y open-iscsi
iscsiadm -t sendtargets -m discovery -p 172.31.10.103
# iscsiadm -t [tab] -m [tab] -p 172.31.10.103
 
vim /etc/iscsi/nodes/[一直Tab]

将启动方式设置为： automatic

systemctl restart iscsi    //重启服务
lsblk    //查看 是否获取到硬盘

这里已经成功获取到了

八、NFS：

1、NFS Server：

（1）先将 iscsi 获取的盘格式化并挂载：

apt install -y xfsdump
mkdir /website
mkfs.xfs /dev/sdb
vim /etc/fstab

mount -a

（2）配置 nfs server：

apt install -y nfs-kernel-server
vim /etc/exports

exportfs -av

2、NFS Client：

apt install -y nfs-common
vim /etc/fstab

mkdir -p /htdocs/html
chmod -R 777 /htdocs
mount -a

A 模块 浙江题解.note

A 模块浙江题解.note