diff --git a/challenge.yml b/challenge.yml index 9e99858..62f73b5 100644 --- a/challenge.yml +++ b/challenge.yml @@ -76,7 +76,7 @@ files: [ "$2" = "root" ] && echo -e "\\e[01mTip: vous souvenez-vous du mot de passe root ?\\e[0m" || - echo -e "\\e[01mTip: cette machine n'est pas reliée au LDAP de l'école.\\e[0m" + echo -e "\\e[01mTip: cette machine n'est pas reliée à l'authentification de l'école.\\e[0m" exec login $@ mode: "0755" diff --git a/login.yml b/login.yml index a88e0c2..c421d40 100644 --- a/login.yml +++ b/login.yml @@ -1,6 +1,6 @@ init: - busybox - - nemunaire/adlin-login-app:6df63c5b8f2895efe4830b682072eb77d862936f + - nemunaire/adlin-login-app:4bf902928c4f20c1e40d12de8e7d4fb22772b876 files: - path: /etc/ssl/certs/DST_Root_CA_X3.pem diff --git a/server.yml b/server.yml index 94739d3..07041dc 100644 --- a/server.yml +++ b/server.yml @@ -1,33 +1,33 @@ kernel: - image: linuxkit/kernel:5.4.19 + image: linuxkit/kernel:5.4.39 # cmdline: "console=tty0 console=ttyS0" # cmdline: "console=tty0 adlin.network=alt" cmdline: "console=tty0" init: - - linuxkit/init:a4fcf333298f644dfac6adf680b83140927aa85e - - linuxkit/runc:69b4a35eaa22eba4990ee52cccc8f48f6c08ed03 - - linuxkit/containerd:09553963ed9da626c25cf8acdf6d62ec37645412 - - linuxkit/ca-certificates:v0.7 + - linuxkit/init:a68f9fa0c1d9dbfc9c23663749a0b7ac510cbe1c + - linuxkit/runc:v0.8 + - linuxkit/containerd:1ae8f054e9fe792d1dbdb9a65f1b5e14491cb106 + - linuxkit/ca-certificates:v0.8 # - linuxkit/firmware:v0.7 - - linuxkit/getty:v0.7 - - nemunaire/monit:f57bcdfc02e2523c714d657a4abda61d191aa15c + - linuxkit/getty:v0.8 + - nemunaire/monit:efb921ff9d2e564dfa43880c608e87dce6ad22b1 # - nemunaire/iscsi-target:8872d1c5e0cefe3c36b60e873b8452aefb19d84d onboot: - name: sysctl - image: linuxkit/sysctl:v0.7 + image: linuxkit/sysctl:v0.8 binds: - /etc/sysctl.d/:/etc/sysctl.d/:ro # Mount first drive to enable some persistance - name: mount - image: linuxkit/mount:v0.7 + image: linuxkit/mount:v0.8 command: ["/usr/bin/mountie", "-device", "/dev/sda", "/var/lib/adlin" ] # Network: interface for login-validator - name: login-iface-setup - image: linuxkit/ip:v0.7 + image: linuxkit/ip:v0.8 command: ["/bin/sh", "-c", "ip a add 172.23.255.2/24 dev vethin-login; ip link set vethin-login up; ip route add default via 172.23.255.1;" ] net: new runtime: @@ -42,7 +42,7 @@ onboot: # wg-manager - name: wg-iface-setup - image: linuxkit/ip:v0.7 + image: linuxkit/ip:v0.8 command: ["/bin/sh", "-c", "ip a add 172.17.0.15/16 dev vethin-wg; ip a add 10.224.32.251/24 dev vethin-wg; ip link set vethin-wg up; grep adlin.network=alt /proc/cmdline > /dev/null && ip route add default via 10.224.32.254 || ip route add default via 10.224.32.1; wg-quick up wg0; /sbin/iptables-restore < /etc/iptables/rules.v4;" ] net: new binds: @@ -60,7 +60,7 @@ onboot: # token-validator - name: validator-iface-setup - image: linuxkit/ip:v0.7 + image: linuxkit/ip:v0.8 command: ["/bin/sh", "-c", "ip a add 172.23.200.1/24 dev vethin-vldtr; ip link set vethin-vldtr up; ip route add default via 172.23.200.254;" ] net: new runtime: @@ -73,7 +73,7 @@ onboot: # domain name - name: ns-iface-setup - image: linuxkit/ip:v0.7 + image: linuxkit/ip:v0.8 command: ["/bin/sh", "-c", "ip a add 172.23.200.2/24 dev vethin-ns; ip link set vethin-ns up; ip route add default via 172.23.200.254;" ] net: new runtime: @@ -86,7 +86,7 @@ onboot: # time server - name: time-iface-setup - image: linuxkit/ip:v0.7 + image: linuxkit/ip:v0.8 command: ["/bin/sh", "-c", "ip a add 172.23.200.3/24 dev vethin-time; ip link set vethin-time up; ip route add default via 172.23.200.254;" ] net: new runtime: @@ -99,7 +99,7 @@ onboot: # mail server - name: mail-iface-setup - image: linuxkit/ip:v0.7 + image: linuxkit/ip:v0.8 command: ["/bin/sh", "-c", "ip a add 172.23.200.4/24 dev vethin-mail; ip link set vethin-mail up; ip route add default via 172.23.200.254;" ] net: new runtime: @@ -116,9 +116,9 @@ onboot: services: - name: rngd - image: linuxkit/rngd:v0.7 + image: linuxkit/rngd:v0.8 - name: sshd - image: linuxkit/sshd:v0.7 + image: linuxkit/sshd:v0.8 - name: dhcpd image: joebiellik/dhcpd @@ -218,7 +218,7 @@ services: - /etc/unbound:/etc/unbound:ro - name: time - image: linuxkit/openntpd:v0.7 + image: linuxkit/openntpd:v0.8 net: /run/netns/dmz-time capabilities: - CAP_NET_BIND_SERVICE diff --git a/subject/adlin.6.md b/subject/adlin.6.md index 259017b..e720bd8 100644 --- a/subject/adlin.6.md +++ b/subject/adlin.6.md @@ -2,9 +2,9 @@ title: ADLIN section: 6 header: ADvanced LINux administration -footer: EPITA SRS 2021 +footer: EPITA SRS 2022 author: Écrit par Pierre-Olivier *nemunaire* Mercier <**nemunaire+adlin@nemunai.re**> -date: 2020-02-24 +date: 2021-02-18 ... # NOM @@ -200,13 +200,14 @@ aux prochains TP. # HISTORIQUE +2021 - Quatrième édition du cours à destination des SRS 2022. + 2020 - Troisième édition du cours à destination des SRS 2021. 2019 - Deuxième édition du cours à destination des SRS 2020. 2018 - Première édition du cours à destination des SRS 2019. - # CONFORMITÉ Certifié non conforme. diff --git a/tuto3.yml b/tuto3.yml index 20198cb..c05a1e6 100644 --- a/tuto3.yml +++ b/tuto3.yml @@ -1,36 +1,36 @@ kernel: - image: linuxkit/kernel:4.19.104 - cmdline: "console=ttyS0 root=/dev/sda1 root=/dev/sr0 adlin.token=LqCdJDfniA" -# cmdline: "console=tty0" + image: linuxkit/kernel:4.19.113 +# cmdline: "console=ttyS0 root=/dev/sda1 root=/dev/sr0 adlin.token=LqCdJDfniA" + cmdline: "console=tty0" init: - - linuxkit/init:a4fcf333298f644dfac6adf680b83140927aa85e - - linuxkit/runc:69b4a35eaa22eba4990ee52cccc8f48f6c08ed03 - - linuxkit/containerd:09553963ed9da626c25cf8acdf6d62ec37645412 - - linuxkit/ca-certificates:v0.7 - - linuxkit/getty:v0.7 + - linuxkit/init:a68f9fa0c1d9dbfc9c23663749a0b7ac510cbe1c + - linuxkit/runc:v0.8 + - linuxkit/containerd:1ae8f054e9fe792d1dbdb9a65f1b5e14491cb106 + - linuxkit/ca-certificates:v0.8 + - linuxkit/getty:v0.8 onboot: - name: format - image: linuxkit/format:65b9e0a76d0b9fb8ac5c5f3bc8d3131109290f56 + image: linuxkit/format:v0.8 command: ["/usr/bin/format", "/dev/sda"] - name: mount - image: linuxkit/mount:v0.7 + image: linuxkit/mount:v0.8 command: ["/usr/bin/mountie", "/dev/sda1", "/var/lib/adlin"] - name: sysctl - image: linuxkit/sysctl:v0.7 + image: linuxkit/sysctl:v0.8 binds: - /etc/sysctl.d/:/etc/sysctl.d/:ro - name: rngd1 - image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81 + image: linuxkit/rngd:v0.8 command: ["/sbin/rngd", "-1"] # Network: external - name: dhcpcd - image: linuxkit/dhcpcd:v0.7 + image: linuxkit/dhcpcd:v0.8 command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1", "eth0"] net: new runtime: @@ -41,7 +41,7 @@ onboot: services: - name: dhcpcd-wks1 - image: linuxkit/dhcpcd:v0.7 + image: linuxkit/dhcpcd:v0.8 hostname: wks1 net: new pid: new @@ -58,7 +58,7 @@ services: - /var/lib/adlin/wks1resolv.conf:/etc/resolv.conf - name: dhcpcd-wks2 - image: linuxkit/dhcpcd:v0.7 + image: linuxkit/dhcpcd:v0.8 hostname: wks2 net: new pid: new @@ -74,7 +74,7 @@ services: - /var/lib/adlin/wks2resolv.conf:/etc/resolv.conf - name: sshd-wks1 - image: linuxkit/sshd:v0.7 + image: linuxkit/sshd:v0.8 net: /run/netns/wks1 uts: /run/utsns/wks1 pid: new @@ -86,7 +86,7 @@ services: - /var/lib/adlin/wks1resolv.conf:/etc/resolv.conf - name: sshd-wks2 - image: linuxkit/sshd:v0.7 + image: linuxkit/sshd:v0.8 net: /run/netns/wks2 uts: /run/utsns/wks2 pid: new @@ -446,6 +446,31 @@ files: ip netns exec router wget -O - --header "X-ADLIN-time: $(stat -c %Y /boot)" https://adlin.nemunai.re/fix-vm | sh mode: "0755" +# - path: etc/init.d/021-correction +# contents: | +# #!/bin/sh +# PS=$(pgrep systemd | head -1) +# nsenter -t "${PS}" -a sysctl -w net.ipv4.ip_forward=1 +# nsenter -t "${PS}" -a sysctl -w net.ipv6.conf.all.forwarding=1 +# nsenter -t "${PS}" -a sysctl -w net.ipv4.conf.ethsrv.route_localnet=1 +# nsenter -t "${PS}" -a iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE +# nsenter -t "${PS}" -a iptables -t nat -A POSTROUTING -o ethsrv -m addrtype --src-type LOCAL -j MASQUERADE +# nsenter -t "${PS}" -a iptables -t nat -A PREROUTING -p tcp --dport 8052 -j DNAT --to 172.23.42.9 +# nsenter -t "${PS}" -a iptables -t nat -A OUTPUT -o lo -p tcp -m tcp --dport 8052 -j DNAT --to-destination 172.23.42.9 +# nsenter -t "${PS}" -a iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to 172.23.42.6 +# nsenter -t "${PS}" -a iptables -t nat -A OUTPUT -o lo -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.23.42.6 +# nsenter -t "${PS}" -a ip link set ethwks up +# cat <