Практические аспекты администрирования корпоративной инфраструктуры

# Удаление некорректных символов и кодировка
iconv -f UTF-8 -t UTF-8//IGNORE Users.csv > /home/user/Users_fixed.csv
# Проверка содержимого
head -n1 /home/user/Users_fixed.csv
wc -l /home/user/Users_fixed.csv

#!/bin/bash
csv_file="$1"
# Извлечение уникальных подразделений (OU)
awk -F":" 'NR>1 {print $5}' "$csv_file" | sort -u | while read ou;
do
    samba-tool ou add OU="$ou",DC=au-team,DC=irpo
done

# Создание пользователей
while IFS=";" read -r first_name last_name role phone ou street zip city country password; do
    # Пропуск заголовка
    if [ "$first_name" == "First Name" ]; then
        continue
    fi

    # Формирование имени пользователя
    username="${first_name,,}.${last_name,,}"

    # Создание учетной записи
    samba-tool user add "$username" "P@ssw0rd1" \
        --given-name="$first_name" \
        --surname="$last_name" \
        --telephone-number="$phone" \
        --job-title="$role" \
        --userou="OU=$ou"

    # Установка бессрочного пароля
    samba-tool user setexpiry "$username" --noexpiry
done < "$csv_file"

chmod +x import_user.sh
bash import_user.sh Users_fixed.csv

# Установка необходимых пакетов
apt-get install -y openssl-gost-engine
# Включение движка ГОСТ
systemctl enable openssl-gost
# Генерация закрытого ключа CA
openssl genpkey -algorithm gost2012_256 -pkeyopt paramset:TCB -out ca.key
# Создание самоподписанного сертификата CA
openssl req -new -x509 -md_gost12_256 -days 30 -key ca.key -out ca.cer
# Копирование сертификата на клиент
scp ca.cer user@hq-cli.au-team.irpo:/home/user/

# Добавление сертификата в доверенные
cp /home/user/ca.cer /etc/pki/ca-trust/source/anchors/
update-ca-trust

# Установка CryptoPro
cd /home/user/Загрузки/linux-amd64
apt-get install -y cryptopro-preinstall
./install_gui.sh

# Генерация ключей
openssl genpkey -algorithm gost2012_256 -pkeyopt paramset:A -out web.au-team.irpo.key
openssl genpkey -algorithm gost2012_256 -pkeyopt paramset:A -out docker.au-team.irpo.key

# Создание запросов на подпись (CSR)
openssl req -new -md_gost12_256 -key web.au-team.irpo.key -out web.au-team.irpo.csr
openssl req -new -md_gost12_256 -key docker.au-team.irpo.key -out docker.au-team.irpo.csr

# Подписание сертификатов
openssl x509 -req -in web.au-team.irpo.csr -CA ca.cer -CAkey ca.key \
    -CAcreateserial -out web.au-team.irpo.cer -days 30

openssl x509 -req -in docker.au-team.irpo.csr -CA ca.cer -CAkey ca.key \
    -CAcreateserial -out docker.au-team.irpo.cer -days 30

# Копирование на веб-сервер
scp web.au-team.irpo.key root@172.16.1.1:~/
scp web.au-team.irpo.cer root@172.16.1.1:~/
scp docker.au-team.irpo.key root@172.16.1.1:~/
scp docker.au-team.irpo.cer root@172.16.1.1:~/

# Создание директории для SSL
mkdir /etc/nginx/ssl
cp web.au-team.irpo.* /etc/nginx/ssl/
cp docker.au-team.irpo.* /etc/nginx/ssl/

# Редактирование конфигурации
vim /etc/nginx/sites-available/default.conf

ssl_certificate /etc/nginx/ssl/web.au-team.irpo.cer;
ssl_certificate_key /etc/nginx/ssl/web.au-team.irpo.key;
ssl_ciphers GOST2012-GOST8912-GOST8912:HIGH:MEDIUM;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;

nginx -t
systemctl restart nginx

Router-A(config)# crypto-ipsec ike enable
Router-A(config)# crypto-ipsec profile CIPROFILE ike-v2
Router-A(config-ipsec-ikev2)# mode tunnel
Router-A(config-ipsec-ikev2)# ike-phase1
Router-A(config-ipsec-ikev2-ph1)# proposal aes256-sha256-modp2048
Router-A(config-ipsec-ikev2-ph1)# auth pre-shared-key P@ssw0rd
Router-A(config-ipsec-ikev2-ph1)# exit
Router-A(config-ipsec-ikev2)# ike-phase2
Router-A(config-ipsec-ikev2-ph2)# protocol esp
Router-A(config-ipsec-ikev2-ph2)# proposal aes256-sha256
Router-A(config-ipsec-ikev2-ph2)# local-ts 172.16.1.2
Router-A(config-ipsec-ikev2-ph2)# remote-ts 172.16.2.2
Router-A(config-ipsec-ikev2-ph2)# exit
Router-A(config-ipsec-ikev2)# exit

Router-A(config)# crypto-map CMAP 10
Router-A(config-crypto-map)# match peer 172.16.2.2
Router-A(config-crypto-map)# set crypto-ipsec profile CIPROFILE
Router-A(config-crypto-map)# exit

Router-A(config)# filter-map ipv4 FMAP 5
Router-A(config-filter-map-ipv4)# match gre host 172.16.1.2 host 172.16.2.2
Router-A(config-filter-map-ipv4)# set crypto-map CMAP peer 172.16.2.2
Router-A(config-filter-map-ipv4)# exit

Router-A(config)# filter-map ipv4 FMAP 10
Router-A(config-filter-map-ipv4)# match udp host 172.16.2.2 eq 4500 host 172.16.1.2 eq 4500
Router-A(config-filter-map-ipv4)# set crypto-map CMAP peer 172.16.2.2
Router-A(config-filter-map-ipv4)# exit

Router-A(config)# filter-map ipv4 FMAP 15
Router-A(config-filter-map-ipv4)# match any any
Router-A(config-filter-map-ipv4)# set accept
Router-A(config-filter-map-ipv4)# exit

Router-A(config)# interface isp
Router-A(config-if)# set filter-map in FMAP 10
Router-A(config-if)# exit

Router-A(config)# interface tunnel.0
Router-A(config-if-tunnel)# set filter-map in FMAP 10
Router-A(config-if-tunnel)# exit

Router-A(config)# write memory

Router-B(config)# crypto-ipsec ike enable
Router-B(config)# crypto-ipsec profile CIPROFILE ike-v2
Router-B(config-ipsec-ikev2)# mode tunnel
Router-B(config-ipsec-ikev2)# ike-phase1
Router-B(config-ipsec-ikev2-ph1)# proposal aes256-sha256-modp2048
Router-B(config-ipsec-ikev2-ph1)# auth pre-shared-key P@ssw0rd
Router-B(config-ipsec-ikev2-ph1)# exit
Router-B(config-ipsec-ikev2)# ike-phase2
Router-B(config-ipsec-ikev2-ph2)# protocol esp
Router-B(config-ipsec-ikev2-ph2)# proposal aes256-sha256
Router-B(config-ipsec-ikev2-ph2)# local-ts 172.16.2.2
Router-B(config-ipsec-ikev2-ph2)# remote-ts 172.16.1.2
Router-B(config-ipsec-ikev2-ph2)# exit
Router-B(config-ipsec-ikev2)# exit

Router-B(config)# crypto-map CMAP 10
Router-B(config-crypto-map)# match peer 172.16.1.2
Router-B(config-crypto-map)# set crypto-ipsec profile CIPROFILE
Router-B(config-crypto-map)# exit

Router-B(config)# filter-map ipv4 FMAP 5
Router-B(config-filter-map-ipv4)# match gre host 172.16.2.2 host 172.16.1.2
Router-B(config-filter-map-ipv4)# set crypto-map CMAP peer 172.16.1.2
Router-B(config-filter-map-ipv4)# exit

Router-B(config)# filter-map ipv4 FMAP 10
Router-B(config-filter-map-ipv4)# match udp host 172.16.1.2 eq 4500 host 172.16.2.2 eq 4500
Router-B(config-filter-map-ipv4)# set crypto-map CMAP peer 172.16.1.2
Router-B(config-filter-map-ipv4)# exit

Router-B(config)# filter-map ipv4 FMAP 15
Router-B(config-filter-map-ipv4)# match any any
Router-B(config-filter-map-ipv4)# set accept
Router-B(config-filter-map-ipv4)# exit

Router-B(config)# interface isp
Router-B(config-if)# set filter-map in FMAP 10
Router-B(config-if)# exit

Router-B(config)# interface tunnel.0
Router-B(config-if-tunnel)# set filter-map in FMAP 10
Router-B(config-if-tunnel)# exit

Router-B(config)# write memory

(config)# no filter-map ipv4 FMAP 30

# Правила для Kerberos, LDAP, DNS
filter-map ipv4 FMAP 21
match tcp any any eq 88
match udp any any eq 88
match udp any any dns
match tcp any any range 3268 3269
match tcp any any eq 389
match tcp any any eq 464
match udp any any eq 464
match tcp any any eq 636
match tcp any any eq 445
match udp any any range 137 138
set accept
# Правила для веб-сервисов и управления
filter-map ipv4 FMAP 22
match icmp any any
match ospf any any
match tcp any any eq 8080
match tcp any any http
match tcp any any eq 2026
match tcp any any range 32768 60999
match udp any any range 32768 60999
match tcp any any eq https
match udp any any eq 123
set accept

# Установка CUPS
apt-get update && apt-get install -y cups cups-pdf

# Включение и запуск службы
systemctl enable --now cups
# Настройка общего доступа
cupsctl --share-printers --remote-any

# Установка rsyslog
apt-get install -y rsyslog

# Создание конфигурации
vim /etc/rsyslog.conf.d/custom.conf

module(load="imudp")
module(load="imuxsock")

authpriv.* /var/log/auth.log
input(type="imudp" port="514")

if $fromhost-ip contains '192.168.100.1' then {
    *.warn /opt/Router-A/router.log
}

if $fromhost-ip contains '10.10.10.2' then {
    *.warn /opt/Router-B/router.log
}

if $fromhost-ip contains '192.168.0.2' then {
    *.warn /opt/br-srv/server.log
}

systemctl enable --now rsyslog

Router-A(config)# rsyslog host 192.168.100.2
Router-B(config)# rsyslog host 192.168.100.2

$ModLoad imuxsock
$ModLoad imjournal
*.warn @@192.168.100.2:514

logger -p warn "atencion"

# Установка logrotate
apt-get install -y logrotate
# Настройка
vim /etc/logrotate.conf

/opt/Router-B/*.log
/opt/Router-A/*.log
/opt/br-srv/*.log {
    weekly
    compress
    minsize 10M
}

systemctl enable --now logrotate
logrotate -d /etc/logrotate.conf

---
- name: Get_hostname
  hosts: srv,cli
  tasks:
    - name: Save hostname and IP
      copy:
        content: |
          Hostname: {{ ansible_hostname }}
          IP_Address: {{ ansible_default_ipv4.address }}
        dest: "/etc/inventarized/PC-INFO/{{ ansible_hostname }}.yml"
      delegate_to: localhost

ansible-playbook /etc/ansible/get_hostname_address.yml

apt-get install -y fail2ban iptables

SyslogFacility AUTHPRIV
LogLevel INFO

[sshd]
enabled = yes
port = 2026
logpath = /var/log/auth.log
backend = %(sshd_backend)s
maxretry = 3
bantime = 1m

authpriv.* /var/log/auth.log

# Запуск службы
systemctl enable --now fail2ban
# Проверка статуса
fail2ban-client status sshd

# Разблокировка всех IP
fail2ban-client unban all

# Разблокировка конкретного IP
fail2ban-client unban 192.168.0.2

# Обновление системы
apt-get update && apt-get dist-upgrade
update-kernel
apt-get clean
reboot

# Установка зависимостей
apt-get install -y kernel-source-6.1.168 kernel-headers-modules-un-def gcc make kmod-sign

# Установка CyberBackup
chmod +x CyberBackup
./CyberBackup
# Создание директории для бэкапов
mkdir /backup
# Обновление системы
apt-get update && apt-get dist-upgrade
update-kernel

# Установка зависимостей
apt-get install -y kernel-source-6.1.168 kernel-headers-modules-un-def gcc make kmod-sign

# Копирование и установка
cd /home/user/Загрузки
cp -r cyberbackup /mnt/nfs/
chmod +x CyberBackup
./CyberBackup