Гайд по демонстрационному экзамену

# hostnamectl set-hostname isp; exec bash
# timedatectl set-timezone Europe/Moscow
# nmtui

# nano /etc/sysctl.conf
net.ipv4.ip_forward=1

# sysctl -p

# hostnamectl set-hostname hq-rtr.au-team.irpo; exec bash
# timedatectl set-timezone Europe/Moscow
# nmtui

# nano /etc/sysctl.conf
net.ipv4.ip_forward=1

# sysctl -p

# hostnamectl set-hostname hq-srv.au-team.irpo; exec bash
# timedatectl set-timezone Europe/Moscow
# useradd sshuser -u 2027 -U
# passwd sshuser
< вводим пароль пользователя >
< повторяем ввод паря >
# visudo
sshuser ALL=(ALL) NOPASSWD: ALL

# nmtui

# hostnamectl set-hostname hq-cli.au-team.irpo; exec bash
# timedatectl set-timezone Europe/Moscow
# nmtui

# hostnamectl set-hostname br-rtr.au-team.irpo; exec bash
# timedatectl set-timezone Europe/Moscow
# nmtui

# nano /etc/sysctl.conf
net.ipv4.ip_forward=1

# sysctl -p

# hostnamectl set-hostname br-fw.au-team.irpo; exec bash
# timedatectl set-timezone Europe/Moscow
# nmtui

# nano /etc/sysctl.conf
net.ipv4.ip_forward=1

# sysctl -p

# hostnamectl set-hostname br-srv.au-team.irpo; exec bash
# timedatectl set-timezone Europe/Moscow
# useradd net_admin  -U
# passwd net_admin
< вводим пароль пользователя >
< повторяем ввод паря >
# visudo
net_admin   ALL=(ALL) NOPASSWD: ALL

# nmtui

# nano /etc/nftables/isp.nft
table inet nat {
chain POSTROUTING {
type nat hook postrouting priority srcnat;
oifname "enp0s3" masquerade
}
}

# nano /etc/sysconfig/nftables.conf
include "/etc/nftables/isp.nft"

# systemctl enable --now nftables

# lsmod | grep 8021q

# modprobe 8021q
# ip -c -br a

# semanage port -a -t ssh_port_t -p tcp 2027
# setenforce 0
# dnf install policycoreutils-python-utils
# nano /etc/ssh/sshd_config

# nano /etc/ssh_banner

# systemctl restart sshd

# semanage port -a -t ssh_port_t -p tcp 2027
# setenforce 0
# dnf install policycoreutils-python-utils
# nano /etc/ssh/sshd_config

# nano /etc/ssh_banner

# systemctl restart sshd

# nmtui

# nmcli connection modify tun1 ip-tunnel.ttl 64

# nmtui

# nmcli connection modify tun1 ip-tunnel.ttl 64

# dnf install -y frr
# nano /etc/frr/daemons
ospfd = yes

# systemctl enable --now frr
# vtysh
hq-rtr.au-team.irpo# configure terminal
hq-rtr.au-team.irpo(config)# router ospf
hq-rtr.au-team.irpo(config-router)# passive-interface default
hq-rtr.au-team.irpo(config-router)# network 192.168.100.0/27 area 0
hq-rtr.au-team.irpo(config-router)# network 192.168.200.0/28 area 0
hq-rtr.au-team.irpo(config-router)# network 192.168.99.0/29 area 0
hq-rtr.au-team.irpo(config-router)# network 10.10.10.0/30 area 0
hq-rtr.au-team.irpo(config-router)# exit
hq-rtr.au-team.irpo(config)# interface tun1
hq-rtr.au-team.irpo(config-if)# no ip ospf passive
hq-rtr.au-team.irpo(config-if)# ip ospf authentication message-digest
hq-rtr.au-team.irpo(config-if)# ip ospf message-digest-key 1 md5 P@ssw0rd
hq-rtr.au-team.irpo(config-if)# exit
hq-rtr.au-team.irpo(config)# exit
hq-rtr.au-team.irpo write
hq-rtr.au-team.irpo exit
# systemctl restart frr

# vtysh
# show running-config

# nano /etc/nftables/hq-rtr.nft
table inet nat {
chain POSTROUTING {
type nat hook postrouting priority srcnat;
oifname "enp0s3" masquerade
}
}
# nano /etc/sysconfig/nftables.conf
include "/etc/nftables/hq-rtr.nft"
# systemctl enable --now nftables
# vtysh -c  "show ip ospf neighbor"
# vtysh -c "show ip route ospf"

# dnf install -y frr
# nano /etc/frr/daemons
ospfd = yes

# systemctl enable --now frr
# vtysh
br-rtr.au-team.irpo# configure terminal
br-rtr.au-team.irpo(config)# router ospf
br-rtr.au-team.irpo(config-router)# passive-interface default
br-rtr.au-team.irpo(config-router)# network 172.16.10.0/30 area 0
br-rtr.au-team.irpo(config-router)# network 10.10.10.0/30 area 0
br-rtr.au-team.irpo(config-router)# exit
br-rtr.au-team.irpo(config)# interface tun1
br-rtr.au-team.irpo(config-if)# no ip ospf passive
br-rtr.au-team.irpo(config-if)# ip ospf authentication message-digest
br-rtr.au-team.irpo(config-if)# ip ospf message-digest-key 1 md5 P@ssw0rd
br-rtr.au-team.irpo(config-if)# exit
br-fw.au-team.irpo(config)# interface enp0s8
br-fw.au-team.irpo(config-if)# no ip ospf passive
br-fw.au-team.irpo(config-if)# exit
br-fw.au-team.irpo(config)# exit
br-rtr.au-team.irpo write
br-rtr.au-team.irpo exit

# systemctl restart frr
# nano /etc/nftables/br-rtr.nft
table inet nat {
chain POSTROUTING {
type nat hook postrouting priority srcnat;
oifname "enp0s3" masquerade
}
}
# nano /etc/sysconfig/nftables.conf
include "/etc/nftables/br-rtr.nft"
# systemctl enable --now nftables
# vtysh -c  "show ip ospf neighbor"
# vtysh -c "show ip route ospf"

# dnf install -y frr
# nano /etc/frr/daemons
ospfd = yes

# systemctl enable --now frr
# vtysh
br-fw.au-team.irpo# configure terminal
br-fw.au-team.irpo(config)# router ospf
br-fw.au-team.irpo(config-router)# passive-interface default
br-fw.au-team.irpo(config-router)# network 172.16.10.0/30 area 0
br-fw.au-team.irpo(config-router)# network 172.16.20.0/28 area 0
br-fw.au-team.irpo(config-router)# exit
br-fw.au-team.irpo(config)# interface enp0s3
br-fw.au-team.irpo(config-if)# no ip ospf passive
br-fw.au-team.irpo(config-if)# exit
br-fw.au-team.irpo(config)# exit
br-fw.au-team.irpo write
br-fw.au-team.irpo exit
# systemctl restart frr

# systemctl restart frr
# vtysh -c  "show ip ospf neighbor"
# vtysh -c "show ip route ospf"

# dnf install dhcp-server -y
# cp /usr/share/doc/dhcp-server/dhcpd.conf.example  /etc/dhcp/dhcpd.conf
# nano /etc/dhcp/dhcpd.conf

subnet 192.168.200.0 netmask 255.255.255.240 {
range 192.168.200.2 192.168.200.14;
option domain-name-servers 192.168.100.2;
option domain-name "au-team.irpo";
option routers 192.168.200.1;
default-lease-time 600;
max-lease-time 7200;
}

# systemctl enable --now dhcpd

# dnf install bind bind-utils
# nano  /etc/named.conf

# named-checkconf

# mkdir /var/named/master
# cp /var/named/named.localhost /var/named/master/au-team.db
# nano /var/named/master/au-team.db

# cp /var/named/named.loopback /var/named/master/au-team_rev1.db
# nano /var/named/master/au-team_rev1.db

# cp /var/named/master/au-team_rev1.db  /var/named/master/au-team_rev2.db
# nano /var/named/master/au-team_rev2.db

# chown -R root:named /var/named/master
# chmod 0640 /var/named/master/*
# named-checkconf -z

# systemctl enable --now named