Pastein: Модуль 1 ISP Hostnamectl set-hostname isp: exec bash Ip -c a Cat /etc/net/ifaces/enp7s1/options TYPE=eth BOOTPROTO=dhcp Mkdir /etc/net/ifaces/enp7s2 Mkdir /etc/net/ifaces/enp7s3 Vim /et

Загрузка данных
Модуль 1
ISP
Hostnamectl set-hostname isp: exec bash
Ip -c a
Cat /etc/net/ifaces/enp7s1/options
TYPE=eth
BOOTPROTO=dhcp
Mkdir /etc/net/ifaces/enp7s2
Mkdir /etc/net/ifaces/enp7s3
Vim /etc/net/ifaces/enp7s2/options
TYPE=eth
BOOTPROTO=static
Vim /etc/net/ifaces/enp7s3/options
TYPE=eth
BOOTPROTO=static
Echo “172.16.1.1/28” > /etc/net/ifaces/enp7s2/ipv4address
Echo “172.16.2.1/28” > /etc/net/ifaces/enp7s3/ipv4address
Vim /etc/net/sysctl.conf
1
Systemctl restart network
Ip -c -br -4 a
Apt-get update && apt-get install tzdata -y && apt-get install iptables -y
Iptables -t nat -A POSTROUTING -o enp7s1 -j MASQUERADE
Iptables-save >> /etc/sysconfig/iptables
Systemctl enable –now iptables
Iptables -t nat -L -n -v
Timedatectl set-timezone Asia/Yekaterinburg

BR-RTR
Hostnamectl set-hostname br-rtr.au-team.irpo; exec bash
Ip -c a
Vim /etc/net/ifaces/enp7s1/options
	Заменить BOOTPROTO=static SYSTEMD_BOOTPROTO=static
Vim /etc/net/ifaces/enp7s1/ipv4address
172.16.2.14/28
Vim /etc/net/ifaces/enp7s1/ipv4route
Default via 172.16.2.1
Mkdir /etc/net/ifaces/enp7s2
Mkdir /etc/net/ifaces/gre1
Vim /etc/net/ifaces/enp7s2/options
	TYPE=eth
	BOOTPROTO=static
Vim /etc/net/ifaces/enp7s2/ipv4address
	192.168.200.1/28
Echo “nameserver 77.88.8.8” > /etc/resolv.conf
Vim /etc/net/ifaces/gre1/options
	TYPE=iptun
	TUNTYPE=gre
	TUNLOCAL=172.16.2.14
TUNREMOTE=172.16.1.14
	TUNOPTIONS=’ttl 64’
	HOST=enp7s1
Echo “10.10.10.2/30” > /etc/net/ifaces/gre1/ipv4address
Vim /etc/net/sysctl.conf
	1
Systemctl restart network
Ip -c -br -4 a
Useradd net_admin
Passwd net_admin
	P@ssw0rd
	P@ssw0rd
Usermod -aG wheel net_admin
Echo “net_admin ALL=(ALL:ALL) NOPASSWD:ALL” >> /etc/sudoers
Apt-get update && apt-get install iptables -y && apt-get install tzdata -y && apt-get install frr -y
Timedatectl set-timezone Asia/Yekaterinburg
Iptables -t nat -A POSTROUTING -o enp7s1 -j MASQUERADE
Iptables-save >> /etc/sysconfig/iptables
Systemctl enable –now iptables
Iptables -t nat -L -n -v
Vim /etc/frr/daemons
	Ospfd=yes
Systemctl enable –now frr
Vtysh
	Conf t
	Ro ospf
	Passive-interface default
	Net 10.10.10.0/30 a 0
	Net 192.168.200.0/28 a 0
	Ex
	Int gre1
	No ip ospf passive
	Ip ospf authentication message-digest
	Ip ospf message-digest 1 md5 P@ssw0rd
	End
	Wr mem
	Exit

BR-SRV
Hostnamectl set-hostname br-srv.au-team.irpo; exec bash
Ip -c a
Vim /etc/net/ifaces/enp7s1/options
Заменить BOOTPROTO=static  SYSTEMD_BOOTPROTO=static
Vim /etc/net/ifaces/enp7s1/ipv4address
192.168.200.2/28
Vim /etc/net/ifaces/enp7s1/ipv4route
Default via 192.168.200.1
Vim /etc/resolv.conf
	Nameserver 77.88.8.8
Vim /etc/net/sysctl.conf
	1
Systemctl restart network
Ip -c a
Useradd sshuser -u 2026
Passwd sshuser
	P@ssw0rd
	P@ssw0rd
Usermod -aG wheel sshuser
Echo “sshuser ALL=(ALL:ALL) NOPASSWD:ALL”  >> /etc/sudoers
Vim /etc/openssh/sshd_config
	Port 2026
	AllowUsers sshuser
	MaxAuthTries 2
	Banner /etc/openssh/banner
Echo “authorized access only” > /etc/openssh/banner
Systemctl restart sshd

HQ-RTR
Hostnamectl set-hostname hq-rtr.au-team.irpo; exec bash
Ip -c a
Vim /etc/net/ifaces/enp7s1/options
	TYPE=eth
	BOOTPROTO=static
Vim /etc/net/ifaces/enp7s1/ipv4address
	172.16.1.14/28
Vim /etc/net/ifaces/enp7s1/ipv4route
	Default via 172.16.1.1
Mkdir /etc/net/ifaces/gre1
Vim /etc/net/ifaces/gre1/options
	TYPE=iptun
	TUNTYPE=gre
	TUNLOCAL=172.16.1.14
TUNREMOTE=172.16.2.14
	TUNOPTIONS=’ttl 64’
	HOST=enp7s1
Echo “10.10.10.1/30” > /etc/net/ifaces/gre1/ipv4address
Echo “nameserver 77.88.8.8” > /etc/resolv.conf
Vim /etc/net/sysctl.conf
	1
Systemctl restart network
Useradd net_admin
Passwd net_admin
	P@ssw0rd
	P@ssw0rd
Usermod -aG wheel net_admin
Echo “net_admin ALL=(ALL:ALL) NOPASSWD:ALL”  >> /etc/sudoers
Apt-get update && apt-get install tzdata -y && apt-get install iptables -y && apt-get install frr -y && apt-get install openvswitch -y && apt-get install dhcp-server -y
Timedatectl set-timezone Asia/Yekaterinburg
Iptables -t nat -A POSTROUTING -o enp7s1 -j MASQUERADE
Iptables-save >> /etc/sysconfig/iptables
Systemctl enable –now iptables
Mkdir /etc/net/ifaces/enp7s2
Mkdir /etc/net/ifaces/vlan100
Mkdir /etc/net/ifaces/vlan200
Mkdir /etc/net/ifaces/vlan999
Mkdir /etc/net/ifaces/HQ-SW
Vim /etc/net/ifaces/enp7s2/options
	TYPE=eth
	BOOTPROTO=static
Vim /etc/net/ifaces/vlan100/options
TYPE=ovsport
	BRIDGE=HQ-SW
	VID=100
	BOOTPROTO=static
	CONFIG_IPV4=yes
Vim /etc/net/ifaces/vlan200/options
TYPE=ovsport
	BRIDGE=HQ-SW
	VID=200
	BOOTPROTO=static
	CONFIG_IPV4=yes
Vim /etc/net/ifaces/vlan999/options
TYPE=ovsport
	BRIDGE=HQ-SW
	VID=999
	BOOTPROTO=static
	CONFIG_IPV4=yes
Echo “192.168.100.1/27” > /etc/net/ifaces/vlan100/ipv4address
Echo “192.168.20.1/24” > /etc/net/ifaces/vlan200/ipv4address
Echo “192.168.99.1/29” > /etc/net/ifaces/vlan999/ipv4address
vim /etc/net/ifaces/HQ-SW/options
“TYPE=ovsbr”
Systemctl enable –now openvswitch
Modprobe 8021q
Echo “8021q” | tee -a /etc/modules
Ip -c -br -4 a
Ovs-vsctl show
Vim /etc/net/ifaces/default/options
	OVS_REMOVE=no
Systemctl restart network
Ovs-vsctl add-port HQ-SW enp7s2 trunks=100,200,999
Ovs-vsctl show
		Если пинг от сервера до роутера не идет попробовать прописать
			Ovs-vsctl del-port HQ-SW enp7s2 trunks=100,200,999
			Ovs-vsctl add-port HQ-SW enp7s2 trunks=100,200,999
			Ip link set HQ-SW up
			Ip link set enp7s2 up

Vim /etc/frr/daemons
	Ospfd=yes
Systemctl enable –now frr
Vtysh
	Conf t
	Ro ospf 
	Passive-interface default
	Net 10.10.10.0/30 a 0
	Net 192.168.100.0/27 a 0
	Net 192.168.20.0/24 a 0
	Net 192.168.99.0/29 a 0
	Ex
	Int gre1
	No ip ospf passive
	Ip ospf authentication message-digest
	Ip ospf message-digest-key 1 md5 P@ssw0rd
	End
	Wr mem
	Exit
Vim /etc/sysconfig/dhcpd
	DHCPDARGS=’vlan200’
Vim /etc/dhcp/dhcpd.conf
	Option domain-name “au-team.irpo”;
	Option domain-name-servers 192.168.100.2;
	Default-lease-time 6000;
	Max-lease-time 72000;
	Authoritative;
	Subnet 192.168.20.0 netmask 255.255.255.0 {
		Range 192.168.20.2 192.168.20.10;
		Option routers 192.168.20.1;
	}
Dhcpd -t -cf /etc/dhcp/dhcpd.conf  / проверка синтаксиса, не обязательно
Systemctl enable –now dhcpd
Systemctl status dhcpd

HQ-SRV
hostnamectl set-hostname hq-srv.au-team.irpo; exec bash 
Timedatectl set-timezone Asia/Yekaterinburg
Ip -c a
mkdir /etc/net/ifaces/enp7s1.100
vim /etc/net/ifaces/enp7s1.100/options
	TYPE=vlan
	HOST=enp7s1
	VID=100
	BOOTPROTO=static
Echo “192.168.100.2/27” > /etc/net/ifaces/enp7s1.100/ipv4address
Echo “default via 192.168.100.1” > /etc/net/ifaces/enp7s1.100/ipv4route
Echo “nameserver 77.88.8.8” > /etc/resolv.conf
Useradd sshuser -u 2026
Passwd sshuser
	P@ssw0rd
	P@ssw0rd
Usermod -aG wheel sshuser
Echo “sshuser ALL=(ALL:ALL) NOPASSWD:ALL” >> /etc/sudoers
Vim /etc/net/sysctl.conf
	1
Systemctl restart network
Apt-get update && apt-get install dnsmasq -y
Vim /etc/dnsmasq.conf
	no-hosts
	server=77.88.8.8
	cache-size=1000
	all-servers
	no-negcache
	interface=*
	host-record=hq-rtr.au-team.irpo,192.168.100.1
	host-record=hq-rtr.au-team.irpo,192.168.20.1
	host-record=hq-rtr.au-team.irpo,192.168.99.1
	host-record=hq-srv.au-team.irpo,192.168.100.2
host-record=hq-cli.au-team.irpo,192.168.20.2
address=/br-rtr.au-team.irpo/192.168.200.1
address=/br-srv.au-team.irpo/192.168.200.2
address=/docker.au-team.irpo/172.16.1.1
address=/web.au-team.irpo/172.16.2.1
systemctl enable –now dnsmasq.service
Vim /etc/openssh/sshd_config
	Port 2026
	AllowUsers sshuser
	MaxAuthTries 2
	Banner /etc/openssh/banner
Echo “Authorized access only” >> /etc/openssh/banner
Systemctl restart sshd

HQ-CLI
Hostnamectl set-hostname hq-cli.au-team.irpo;exec bash
Vim /etc/net/ifaces/enp7s1/options
	BOOTPROTO=dhcp
	TYPE=eth
	NM_CINTROLLED=no
	DISABLED=no
	CONFIG_IPV4=no
Mkdir /etc/net/ifaces/enp7s1.200
Vim /etc/net/ifaces/enp7s1.200/options
	TYPE=vlan
	BOOTPROTO=dhcp
	DISABLED=no
	VID=200
	HOST=enp7s1
	NM_CONTROLLED=no
	CONFIG_IPV4=yes
Vim /etc/net/sysctl.conf
	1
Systemctl restart network
Timedatectl set-timezone Asia/Yekaterinburg

Модуль 2
ISP
Ip -c -br -4 a
apt-get update && apt-get install iptables -y
iptables -t nat -A POSTROUTING -o enp7s1 -j MASQUERADE
iptables-save >> /etc/sysconfig/iptables
iptables -t nat -L -n -v
vim /etc/net/sysctl.conf
	1
Systemctl restart network
Vim /etc/chrony.conf
#pool
Server ntp0.ntp-servers.net iburst prefer minstratum 4
Local stratum 5	
Allow 0.0.0.0/0
Systemctl restart chronyd 
Apt-get install curl -y && apt-get install apache2-htpasswd && Apt-get install nginx -y

HQ-RTR 
vim /etc/net/sysctl.conf
	1
Systemctl restart network
apt-get update && apt-get install iptables -y
iptables -t nat -A POSTROUTING -o enp7s1 -j MASQUERADE
iptables -t nat -A PREROUTING -i enp7s1 -p tcp –dport 2026 -j DNAT –to-destination 192.168.1.10:2026
iptables -t nat -A PREROUTING -i enp7s1 -p tcp –dport 8080 -j DNAT –to-destination 192.168.1.10:80
iptables-save >> /etc/sysconfig/iptables
Systemctl enable –now iptables
iptables -t nat -L -n -v
Vim /etc/chrony.conf
#pool
	Server 172.16.1.1 iburst
Systemctl restart chronyd
BR-RTR
vim /etc/net/sysctl.conf
	1
Systemctl restart network
apt-get update && apt-get install iptables -y
iptables -t nat -A POSTROUTING -o enp7s1 -j MASQUERADE
Iptables -t nat -A PREROUTING -i enp7s1 -p tcp –-dport 2026 -j DNAT –to-destination 192.168.3.10:2026
Iptables -t nat -A PREROUTING -I enp7s1 -p tcp –dport 8080 -j DNAT –to-destination 192.168.3.10:80
iptables-save >> /etc/sysconfig/iptables
Systemctl enable –now iptables
iptables -t nat -L -n -v
Vim /etc/chrony.conf
#pool
	Server 172.16.2.1 iburst
Systemctl restart chronyd

BR-SRV
Vim /etc/net/sysctl.conf
	1
Echo “nameserver 77.88.8.8” >> /etc/net/ifaces/enp7s1/resolv.conf
Systemctl restart network
Ip -c -br -4 a
Vim /etc/chrony.conf
#pool
	Server 172.16.2.1 iburst
Systemctl restart chronyd
Apt-get update && apt-get install task-samba-dc -y
rm -f /etc/samba/smb.conf
rm -rf /var/lib/samba/
rm -rf /var/cache/samba/
mkdir -p /var/lib/samba/sysvol
samba-tool domain provision
	везде пробел 
	P@ssw0rd
	P@ssw0rd
cp /var/lib/samba/private/krb5.conf /etc/krb5.conf
y
systemctl enable –now samba.service
echo "search au-team.irpo" > /etc/net/ifaces/enp7s1/resolv.conf
echo "nameserver 127.0.0.1" >> /etc/net/ifaces/enp7s1/resolv.conf
systemctl restart network
samba-tool domain info 127.0.0.1 
kinit Administrator
	P@ssw0rd
Klist
Samba-tool group add hq
for i in {1..5}; do samba-tool user add hquser$i P@ssw0rd; samba-tool user setexpiry hquser$i --noexpiry; samba-tool group addmembers "hq" hquser$i; done
samba-tool group listmembers hq
apt-get install ansible sshpass -y && apt-get install docker-engine docker-compose-v2 -y
Hq-cli
В терминале:
Vim /etc/chrony.conf
#pool
	Server 172.16.1.1 iburst
Systemctl restart chronyd
Nmcli connection show
Nmcli con mod “DHCP-CLI” ipv4.method manual
Nmcli con mod “DHCP-CLI” ipv4.addresses 192.168.2.10/28
Nmcli con mod “DHCP-CLI” ipv4.gateway 192.168.2.1
Nmcli con mod “DHCP-CLI” ipv4.dns “192.168.3.10”
Nmcli con mod “DHCP-CLI” ipv4.dns-search “au-team.irpo”
Nmcli con up “DHCP-CLI”
Cat /etc/resolv.conf
Host au-team.irpo
apt-get update && apt-get install task-auth-ad-sssd -y
Заходим в Центр управления системой – в пользователи Аутентификация
Домен Active Directory
Применить
P@ssw0rd
Ок
перезагрузить
В терминале:
Su –
Roleadd hq wheel
echo "Cmnd_Alias SHELLCMD = /bin/cat, /bin/grep, /usr/bin/id" > /etc/sudoers.d/hq
echo "WHEEL_USERS ALL=(ALL: ALL) SHELLCMD" >> /etc/sudoers.d/hq
exit
sudo id
sado cat /etc/hosts
sudo ip a

HQ-SRV
Vim /etc/chrony.conf
#pool
	Server 172.16.1.1 iburst
Systemctl restart chronyd
Apt-get update && apt-get install mdadm -y && Apt-get install nfs-server -y
mdadm --create /dev/md0 -l 0 -n 2 /dev/sdb /dev/sdc
mdadm –detail –scan –verbose | tee -a /etc/mdadm.conf
mkfs.ext4 /dev/md0
echo “/dev/md0 /raid ext4 defaults 0 0” >> /etc/fstab
Mkdir /raid
Mount -av
Lsblk
Mkdir /raid/nfs
Chmod -R 777 /raid/nfs
Echo “/raid/nfs 192.168.2.10/28(rw,no_root_squash): > /etc/exports
Exportfs -arv
Systemctl enable –now nfs-server.service 
Vim /etc/openssh/sshd_config
	Port 2026
Systemctl restart sshd
Apt-get update && apt-get install lamp-server -y
HQ-CLI
Su -
Mkdir /mnt/nfs
Chmod -R 777 /mnt/nfs
Echo “192.168.1.10:/raid/nfs /mnt/nfs	nfs defaults 0 0” >> /etc/fstab
Mount -av
Df -h
echo "Hello" > /mnt/nfs/test.txt
cat /mnt/nfs/test.txt
HQ-CLI и на RTR Systemctl enable –now sshd
BR-SRV
Vim /etc/ansible/ansible.cfg
	Расскоментируем invenroty
	Host_key_checking = False
Vim /etc/ansible/hosts
	BR-RTR ansible_ssh_host=192.168.3.1 ansible_ssh_user=net_admin ansible_ssh_pass=P@ssw0rd
	HQ-RTR ansible_ssh_host=192.168.1.1 ansible_ssh_user=net_admin ansible_ssh_pass=P@ssw0rd
	HQ-SRV ansible_ssh_host=192.168.1.2 ansible_ssh_user=sshuser ansible_ssh_pass=P@ssw0rd ansible_port=2026
	HQ-CLI ansible_ssh_host=192.168.2.10 ansible_ssh_user=user ansible_ssh_pass=resu
	[all:vars]
	Ansible_python_interpreter=/usr/bin/python3
Ansible -m ping all
Systemctl enable –now docker.service
Mount /dev/sr0 /mnt/
Docker load < /mnt/docker/site_latest.tar
Docker load <  /mnt/docker/mariadb_latest.tar
Docker image ls
Vim compose.yaml
	Services:
Database:
Container_name: db
Image: mariadb:10.11
Restart: always
Ports:
-	“3306:3306”
Environment:
MARIADB_DATABASE: “testdb”
MARIADB_USER: “testc”
MARIADB_PASSWORD: “P@ssw0rd”
MARIADB_ROOT_PASSWORD: “toor”
App:
Container_name: testapp
Image: site:latest
Restart: always
Ports:
-	“3306:3306”
Environment:
DB_TYPE: “maria”
DB_HOST: “192.168.3.10”
DB_PORT: “3306”
DB_NAME: “testdb”
DB_USER: “testc”
DB_PASS: “P@ssw0rd”
Depends_on:
-	Database
Docker compose up -d
Docker compose ps
HQ-SRV:
Mount /dev/sr0 /mnt/
Cp /mnt/web/index.php /var/www/html/
Cp /mnt/web/logo.png /var/www/html/
Vim /var/www/html/index.php
	Username = “webc”
	Password = “P@ssw0rd”
	dbname = “webdb”
Systemctl enable –now mariadb
Mariadb -u root
	CREATE DATABASE webdb;
	CREATE USER ‘webc’@’localhost’ IDENTIFIED BY ‘P@ssw0rd’;
	GRANT ALL PRIVILEGES ON webdb.* TO ‘webc’@’localhost’ WITH GRANT OPTION;
	EXIT;
Mariadb -u webc -p -D webdb < /mnt/web/dump.sql
	P@ssw0rd
Systemctl enable –now httpd2.service
HQ-CLI:
http://192.168.3.10:8080
http://192.168.1.10:8080
ISP
Ssh -p 2026 sshuser@172.16.1.10
Ssh -p 2026 sshuser@172.16.2.10
Curl http://172.16.1.10:8080 | head
Curl http://172.16.2.10:8080 | head
Htpasswd -c /etc/nginx/.htpasswd WEB	
	P@ssw0rd
	P@ssw0rd
Vim /etc/nginx/sites-available.d/default.conf
	Server {
	Listen 80;
	Server_name web.au-team.irpo;
	Location / {
		Proxy_pass http://172.16.1.10:8080;
		Auth_basic “Restricted area”;
		Auth_basic_user_file /etc/nginx/.htpasswd;
}
}
Server {
Listen 80;
Server_name docker.au-team.irpo;
Location / {
Proxy_pass http://172.16.2.10:8080;
}
}
ln -s /etc/nginx/sites-available.d/default.conf /etc/nginx/sites-enabled.d/
Systemctl enable –now nginx
HQ-CLI
Su –
Echo “172.16.1.1 web.au-team.irpo” >> /etc/hosts
Echo “172.16.2.1 docker.au-team.irpo” >> /etc/hosts
Проверить
apt-get install yandex-browser-stable -y
3 модуль
BR-SRV
Mount /dev/sr0 /mnt/
Wc -l /mnt/Users.csv
Head -n1 /mnt/Users.csv
Head -n1 /mnt/Users.csv | tr -cd ‘;’ | wc -c | awk ‘{print $1+1}’
Awk -F ‘;’ ‘NR>1 {print $5}’ /mnt/Users.csv | sort | uniq
Vim import_user.sh
	#!/bin/bash
	Awk -F ’;’ ‘NR>1 {print $5}’ “$csv_file” | sort | uniq | while read ou; 
do 
samba-tool ou add OU=”$ou”,DC=au.team,DC=irpo;
Done
While IFS=”;” read -r firstName lastName role phone ou street zip city country password;
Do
	If [ “$firstName” == “First Name” ] ;
	Then
		Continue
	Fi
	Username=”${firstName,,}.${lastName,,}”
	Samba-tool user add “$username” P@ssw0rd1 \
		--given-name=”$firstName” \
		--surname=”$lastName” \
		--telephone-number=”$phone” \
		--job-title=”$role” \
		--userou=”OU=$ou”
	Samba-tool user setexpiry “$username” –noexpiry
Done < “$csv_file”
 
Chmod +x import_user.sh
./import_user.sh /mnt/Users.csv
Samba-tool ou list
Samba-tool ou listobjects OU=IT
Samba-tool ou listobjects OU=Overal
Samba-tool ou listobjects OU=Manager
Samba-tool ou listobjects OU=Supporter | wc -l
Samba-tool ou listobjects OU=Cloud\ storage | wc -l
HQ-SRV
Apt-get update && apt-get install cups cups-pdf -y
Systemctl enable –now cups
Cupsctl –share-printers –remote-any
Ss -tulpn | grep “631”
Apt-get install openssl-gost-engine -y

HQ-CLI
id
Vim /etc/hosts
 
HQ-SRV
Ls -l /var/spool/cups/
Control openssl-gost enabled
Openssl genpkey -algorithm gost2012_256 -pkeyopt paramset:TCB -out ca.key
Openssl req -new -x509 -md_gost12_256 -days 30 -key ca.key -out ca.cer
	
	.
	.
	Au-team.irpo
	.
	Hq-srv.au-team.irpo
	
Openssl x509 -noout -text -in ca.cer
openssl genpkey -algorithm gost2012_256 -pkeyopt paramset:A -out web.au-team.irpo.key
openssl genpkey -algorithm gost2012_256 -pkeyopt paramset:A -out docker.au-team.irpo.key
openssl req -new  -md_gost12_256 -key gost.example.com.key -out web.au-team.irpo.csr

	.
	.
	Au-team.irpo
	.
	web.au-team.irpo
	
openssl req -new  -md_gost12_256 -key gost.example.com.key -out docker.au-team.irpo.csr
openssl x509 -req -in web.au-team.irpo.csr -CA ca.cer -CAkey ca.key -CAcreateserial -out web.au-team.irpo.cer -days 30
openssl x509 -req -in docker.au-team.irpo.csr -CA ca.cer -CAkey ca.key -CAcreateserial -out docker.au-team.irpo.cer -days 30
ISP
Vim /etc/openssh/sshd_config
	PermitRootLogin yes
Systemctl restart sshd
HQ-SRV
scp web.au-team.irpo.key root@172.16.1.1:~/
scp web.au-team.irpo.cer root@172.16.1.1:~/
scp docker.au-team.irpo.key root@172.16.1.1:~/
scp docker.au-team.irpo.cer root@172.16.1.1:~/
ISP
Ls
Mkdir /etc/nginx/ssl
Cp web.au-team.irpo.* /etc/nginx/ssl
Cp docker.au-team.irpo.* /etc/nginx/ssl
Vim /etc/nginx/sites-available.d/default.conf
 
Nginx -t
Apt-get install openssl-gost-engine -y
Control openssl-gost enabled
Nginx -t
Systemctl restart nginx
HQ-SRV
Scp ca.cer user@192.168.2.10:~/
HQ-CLI
Ls
Cp /home/user/ca.cer /etc/pki/ca-trust/source/anchors/ && update-ca-trust
Скачать крипто про с оф сайта
Продукты – КриптоПро CSP
Скачать
Ivanov ivan Ivanovich
admin@au-team.irpo
au-team.irpo
Выбрать другой вариант – RPM
Распаковать
Cd /home/user/linux-amd64
Apt-get install cryptopro-preinstall -y
./install_gui.sh
Далее – Импортировать корневые сертификаты из ОС – далее – установить – ок – позже – выход
Открыть и в поиске ввести au-team
Зайти на 2 сайта
Больше возможностей при регистрации:
