ChinaSkills network system management LINUX module server01

Network system management (sample question 2)

Module A: Linux Environment

**Executive Committee of national vocational college skills competition. Technical expert group March 2021

catalogue
1, Competition introduction - 2-
2, Competition considerations - 2-
3, Submission of competition results - 2-
4, Initialize environment - 2-
1. Default account and password - 2-
2. Operating system configuration - 2-
5, Project task description - 3-
1. Topology - 3-
2. Basic configuration - 4-
3. Mission requirements - 4-
CLIENT TASK - 5 -
RSERVER TASK - 5 -
SERVER01 TASK - 6 -
SERVER02 TASK - 8 -
SERVER03 TASK - 8 -
SERVER04 TASK - 9 -
1, Competition introduction
1. Please read the following guidelines carefully!
2. The competition lasts 4 hours. You must decide how to allocate your time.
3. When the game is over, please do not shut down your virtual machine when you leave.
4. If there is no explicit requirement, please use "chinakill21" as the default password.
5. All systems in this module are in the most basic installed system state, and the client is equipped with desktop.
2, Competition precautions
1. The hardware, software and auxiliary tools required for the competition shall be uniformly arranged by the organizing committee. Contestants shall not bring any software, mobile storage, auxiliary tools, mobile communication, etc. into the competition field without permission.
2. Please check whether the listed hardware equipment, software list and material list are complete and whether the computer equipment can be used normally according to the competition environment provided by the competition.
3. During operation, the equipment configuration needs to be saved in time. After the competition, all equipment shall remain in operation. Do not remove the hardware connection.
4. After the competition, please keep the competition equipment, software and questions on your seat. It is forbidden to take all items used in the competition (including test papers and papyrus) away from the field.
5. The referee shall take the competition result documents submitted by each participating team as the main scoring basis. All submitted documents must be named according to the naming rules specified in the competition questions, and shall not reflect the participating institutions, station numbers and other information in any form.
3, Submission of competition results
According to the requirements of the topic, submit WORD files and corresponding PDF files that meet the template (PDF files are generated by saving Office Word as PDF files). It is suggested that in addition to the screenshots of configuration files, screenshots of function test should also be taken. Those that can be tested on the terminal must be tested and screenshot on the terminal, otherwise the function test part will not be scored.
4, Initialize environment
1. Default account and password
Username: root
Password: ChinaSkill21!
Username: skills
Password: ChinaSkill21!
Note: unless otherwise specified, the passwords of all accounts are ChinaSkill21!
2. Operating system configuration
Area: CST + 8
System environment language: English US (UTF-8)
Keyboard: English US
Note: when the task is to configure TLS, please add the root certificate or self signed certificate to the trusted zone.
After the console is logged in, whether it is network login or local login, it will be displayed according to the welcome information below

ChinaSkills 2020 – Jiangsu
Module A Linux
lnxserver1
Complete spelling of contestant's name

hostname<<
Debian Version<<
TIME <<

5, Project task description
A company needs to provide employees with convenient, safe and stable internal and external network services. As a company network system administrator, you are responsible for the company's network system management. Please complete the network service installation and testing according to the network topology, basic configuration information and service requirements. The network topology and basic configuration information are as follows:
1. Topology

2. Basic configuration
The basic configuration of server and client is shown in the following table:
Device Hostname FQDN IP Address Service
Server01 Server01 Server01.sdskills.cn 172.16.100.201 RAID5
NFS
DNS(bind)
Webserver(apache)
SSH
DBMS

3. Mission requirements
Task equipment: Client,Rserver,servr01,server02,server03,server04.
Note: if not specified in the title, please use the default configuration.

CLIENT TASK

1.Client: simple Debian has been pre installed. The specific requirements are as follows:
• it is required to have access to all servers for testing application services.
• please install a GNOME desktop environment for this host.
• adjust the display resolution to 1280x768;
• test DHCP, and the IPv4 address of the host network card is automatically obtained;
• test dns and install dnsutils and dig command line tools;
• test the web, install firefox browser and curl command line test tool, and do not pop up security warning information at any time;
• test ssh and install ssh command line tools;
• test VPN and install VPN client tool software;
• test ftp and install ftp command line client tools;
• test file sharing and install Samba command line client tools;
• test mail, install thunderbird, and send and receive mail normally;
• other settings are the default settings.

SERVER01 TASK

1.NETWORK
 please configure the host name of the server, network card IP address configuration, domain name server, gateway, etc. according to the basic configuration information.

root@server01:~# vim /etc/network/interfaces
auto ens37
iface ens37 inet static
address 172.16.100.201
netmask 255.255.255.128
gateway 172.16.100.254
systemctl restart networking
root@server01:~# hostnamectl set-hostname server01
root@server01:~# vim /etc/hosts
127.0.0.1 Server01.sdskills.cn

2.RAID5
 add four 1G hard disks to the virtual machine;
 create raid5, one of which is used as a hot spare, and the device name is md0;
 set md0 as LVM and the device as / dev/vg01/lv01;
 formatted as ext4 file system;
 automatically mount to / data directory after startup.

Add 4 pieces 1 g Hard disk
root@server01: echo "- - -" /sys/class/scsi_host/host0/scan 
root@server01:  echo "- - -" /sys/class/scsi_host/host1/scan 
root@server01:  echo "- - -" /sys/class/scsi_host/host2/scan 
root@server01:~# mdadm -Cv /dev/md0 -n 3 -l 5 -x 1 /dev/sdb /dev/sdc /dev/sdd /dev/sde create raid5 and backup disks
#-Cv display process / dev/md0 device name - N raid disks - l raid level 5 -x 1 backup disk
root@server01:~# Echo / dev / md0 / MNT / raid ext4 defaults 0 > > / etc / fstab mdadm - D / dev / md0 view details
root@server01:~# Echo / dev / md0 / MNT / raid ext4 defaults 0 > > / etc / fstabvgcreate vg01 / dev / md0 create a volume group
root@server01:~# lvcreate -L 1G -n lv01 vg01 lv logical volume
root@server01:~# mkfs.ext4 /dev/vg01/lv01 formatted as ext4
root@server01:~# mkdir /mnt/raid create mount file
root@server01:~# mount /dev/vg01/lv01 /mnt/raid / Mount
root@server01:~# Echo / dev / md0 / MNT / raid ext4 defaults 0 > > / etc / fstab permanently mounted


3.NFS
 share / data/share directory;
 it is used to store the web data of server01 host;
 only the service network segment is allowed to access the share.

root@server01:~# apt install nfs-common nfs-kernel-server  -y
root@server01:~# mkdir /data/share -p
root@server01:~# mkdir /data/web -p
root@server01:~# vim /etc/exports edit the configuration file
/data/share     172.16.100.128/25(rw,sync,no_root_squash,insecure) Only server address access is allowed
root@server01:~# systemctl restart nfs-kernel-server.service
root@server01:/# showmount -e localhost test local server
#test
 Client (192 network segments)
apt install nfs-comm
showmount -e 172.16.100.201
root@kali:~# MKDIR / data01 / share - P create mount directory
root@kali:~# mount -t nfs -o nolock 192.168.200.32:/data/share /data01/share / Mount
mount.nfs: access denied by server while mounting 172.16.100.201:/data/share access was denied

4.DNS(bind)
 install bind service;
 establish the sdskills.cn domain and establish positive / negative domain name resolution for all hosts or servers except the Internet region.
 in case of domain names that cannot be resolved, apply to skills.cn for higher-level resolution.

root@server01:/# apt install bind9
root@server01:/data/share/htdocs/skills# vim /etc/bind/named.conf.local
zone "." IN {
        type master ;
        file "/etc/bind/chinaskills";
};
zone "sdskills.cn" IN {
        type slave;
        masters { Main service address; };
file "/etc/bind/slave";
};
zone "100.16.172.in-addr.arpa"  {
        type master;
        file "/etc/bind/db.172.16.100";
};
zone "100.10.10.in-addr.arpa"  {
	 type master; 
	file "/etc/bind/db.10.10.100"; 
}; #Reverse dns
~                                                                                
vim /etc/bind/chinaskills
$TTL  1D
@  IN  SOA  ns.domain.com.  hostmaster.domain.com. (
                0    ; Serial
                1D   ; Refresh
                1H   ; Retry
                1W   ; Expire
                3H ) ; Negative Cache TTL
        IN      NS      localhost.  
*       IN      A       192.168.200.32 #All unknown domain names resolve the cost machine address. Remember to change the nameserver to the cost machine
vim /etc/bind/slave
$TTL  1D
@  IN  SOA  ns.domain.com.  hostmaster.domain.com. (
                0    ; Serial
                1D   ; Refresh
                1H   ; Retry
                1W   ; Expire
                3H ) ; Negative Cache TTL
        IN      NS      server02.sdskills.cn.  
server02       IN      A       192.168.100.253
www				IN 		A 		192.168.200.253(Server address)
~       
                                     

5.Webserver(apache)
 install apache services;

root@server01:~# apt install apache2

 provided by Server01 www.sdskills.cn
 skills portal;
 use apache services;
 web page files are placed in / data/share/htdocs/skills;

root@server01:~# vim /etc/apache2/sites-enabled/000-default.conf 
DocumentRoot /data/share/htdocs/skills
mkdir /data/share/htdocs/skills -p

 the service runs as a user webuser;

vim /etc/apache2/apache2.conf
User webuser
root@server01:~# useradd webuser

 the content of the home page is "This is the front page of sdskills's website";
 / htdocs/skills/staff.html is "Staff Information";
 this page can only be accessed after the employee's account authentication;
 employee accounts are stored in ldap, and the accounts are zsuser and lsus

root@server01:~# touch /data/share/htdocs/skills/index.html
root@server01:~# vim /etc/apache2/apache2.conf
<Directory /data/share/htdocs/skills>
        Options  Indexes FollowSymLinks
        AllowOverride all
       Require all granted
</Directory>
root@server01:~# echo "This is the front page of sdskills's website." >/data/share/htdocs/skills/index.html
root@server01:~# touch /data/share/htdocs/skills/staff.html
root@server01:~# vim /etc/apache2/apache2.conf
<Directory /data/share/htdocs/skills/staff.html>
        AuthType Basic
        AuthName "Password"
        AuthUserFile /etc/apache2/1dap
        require valid-user
</Directory>
root@server01:~# touch  /etc/apache2/1dap
root@server01:~#htpasswd -c /etc/apache2/1dap zsuser
root@server01:~#htpasswd -c /etc/apache2/1dap lsus

 the website uses https protocol;
 SSL uses the certificate issued by RServer and is issued to:
C = CN
ST = China
L = ShangDong
O = skills
OU = Operations Departments
CN = *.skills.cn
 CA certificate path of Sever01: / CA/cacert.pem
 issue digital certificate by:
C = CN;
O = Inc
OU = www.shills.cn
CN = shill Global Root CA
 when the client accesses https, there should be no browser (including terminal) security warning information;
 automatically jump to https secure connection when users use http access;
 when users use sdskills.cn or any.sdskills.cn (any represents any website prefix), they will automatically jump to www.sdskills.cn.

There will be another issue here in the future

6.SSH
 install SSH
 only client clients are allowed to access ssh, and requests from other hosts should be rejected;
 the configured client can only log in without secret key in the chinakill 20 user environment. The port number is 1122 and has root control authority.

I've written this in the previous chapter, but I won't write it

7.DBMS(MariaDB)
 complete the installation of MariaDB database on Server01, and add the database root user with the password chinakill20!

root@debian:~# apt install mariadb-server
root@debian:~# apt install apache2
root@debian:~# apt install php libapache2-mod-php php-mysql
root@debian:~# apt install php-bz2 php-curl  php-gd  php-tcpdf  php-zip
root@debian:~# cp phpMyAdmin-5.0.4-all-languages /var/www/html/phpadmin
root@debian:~# mysqladmin -u root -p password chinaskills
root@debian:~# mysql_secure_installation

 install the MariaDB database server component;
 MariaDB database administrator information: user: root / password: chinakill20!;
 install the MariaDB WEB management panel "phpMyAdmin" and publish it through apache
 install phpMyAdmin, the web management panel component of MariaDB;
 install apache and configure the php environment for publishing phpMyAdmin**

Tags: Linux

Posted on Sat, 09 Oct 2021 07:32:46 -0400 by Spud_Nic