第十五周作业
一、PAM和google模块实现ssh双因子安全验证。
功能：实现SSH登录的两次身份验证，先验证APP的数字码，再验证root用户的密码，都通过才可以登录。目前只支持口令验证，不支持基于key验证。
1、在手机应用市场搜索：身份验证器或authenticator，并安装APP
2、 运行脚本(需要联网EPEL源),本质是修改了/etc/pam.d/sshd文件，将google的PAM模块加入进去实现
[root@centos8 ~]#bash google-authenticator.sh
Installed:
google-authenticator-1.07-1.el8.x86_64
Complete!
Do you want me to update your /root/.google_authenticator file? (y/n) y
你希望我更新你的“/root/.google_authenticator”文件吗(y/n)？
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
你希望禁止多次使用同一个验证令牌吗?这限制你每次登录的时间大约是30秒， 但是这加大了发现或甚
至防止中间人攻击的可能性(y/n)?
By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the
server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If
you
experience problems with poor time synchronization, you can increase the
window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the
current
code, and the 8 next codes). This will permit for a time skew of up to 4
minutes
between client and server.
Do you want to do so? (y/n) y
默认情况下，令牌保持30秒有效;为了补偿客户机与服务器之间可能存在的时滞，
我们允许在当前时间前后有一个额外令牌。如果你在时间同步方面遇到了问题， 可以增加窗口从默认的
3个可通过验证码增加到17个可通过验证码，
这将允许客户机与服务器之间的时差增加到4分钟。你希望这么做吗(y/n)?
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every
30s.
Do you want to enable rate-limiting? (y/n) y
如果你登录的那台计算机没有经过固化，以防范运用蛮力的登录企图，可以对验证模块
启用尝试次数限制。默认情况下，这限制攻击者每30秒试图登录的次数只有3次。 你希望启用尝试次数
限制吗(y/n)?
在App Store 搜索Google Authenticator 进行App安装
Do you want authentication tokens to be time-based (y/n) y
Warning: pasting the following URL into your browser exposes the OTP secret
to Google:
https://www.google.com/chart?
chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@centos8.localdomain%3Fse
cret%3D7YTAL4GW3TND7BICUMJGJLIFVE%26issuer%3Dcentos8.localdomain #浏览器打开
此地址
Failed to use libqrencode to show QR code visually for scanning.
Consider typing the OTP secret into your app manually.
Your new secret key is: 7YTAL4GW3TND7BICUMJGJLIFVE
Enter code from app (-1 to skip):
3. 访问生成的url(需要KXSW):
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@centos8.localdomain%3Fsecret%3D7YTAL4GW3TND7BICUMJGJLIFVE%26issuer%3Dcentos8.localdomain
4、打开用身份验证器APP，扫网页上的二维码，进行绑定手机
5、继续上面的安装配置向导，输入手机APP上的数字，后续都回答 y 即可
6、ssh当前主机，可看到提示，输入手机APP上显示的数字码和root密码，可以登录，否则失败
7、临时口令存放在/root/.google_authenticator中，用一次删除一个，可手动加入使用
二、使用chrony实现内网时间同步（一台node1从外网同步时间，其余机器从node1同步时间）。
使用10.0.0.81这台机器作为内网中的时间同步服务器，来为内网10.0.0.0/24内网网段提供时间服务.10.0.0.71作为测试客户端，来获得时间服务
1、安装chronyd服务
[root@CentOS8 ~]#yum -y install chrony
2、编辑配置文件/etc/chrony.conf
[root@CentOS8 ~]#grep "^[^#]" /etc/chrony.conf
server ntp.aliyun.com iburst
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
allow 10.0.0.0/24
keyfile /etc/chrony.keys
leapsectz right/UTC
logdir /var/log/chrony
3、启动chronyd服务
[root@CentOS8 ~]#systemctl start chronyd
4、在客户端上安装chronyd服务
[root@CentOS7-1 ~]#yum -y install chronyyum
5、在客户端上编辑配置文件/etc/chrony.conf
[root@CentOS7-1 ~]#grep "^[^#]" /etc/chrony.conf
server 10.0.0.81 iburst
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
logdir /var/log/chrony
6、客户端上启动chronyd服务
[root@CentOS7-1 ~]#systemctl start chronyd
7、验证测试
[root@CentOS7-1 ~]#chronyc sources -v
210 Number of sources = 1
.-- Source mode '^' = server, '=' = peer, '#' = local clock.
/ .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| / '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
|| .- xxxx [ yyyy ] +/- zzzz
|| Reachability register (octal) -. | xxxx = adjusted offset,
|| Log2(Polling interval) --. | | yyyy = measured offset,
|| \ | | zzzz = estimated error.
|| | | \
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 10.0.0.81 3 6 377 53 +149us[ +198us] +/- 24ms
三、利用cobbler实现系统自动化安装。
1、环境准备
准备两台主机
一台主机：CentOS 7 充当 Cobbler，http，dhcp，tftp 服务器，并关闭防火墙和SELinux
一台主机：充当测试机，用于实现自动化安装Linux系统
网络要求：关闭Vmware软件中的NAT模式中的DHCP服务，两个主机网卡基于NAT模式
2、安装相关包并启动服务
[root@centos7 ~]#yum install cobbler dhcp -y
[root@centos7 ~]#systemctl enable --now cobblerd httpd tftp dhcpd
3、修改cobbler相关的配置
（1）、运行cobbler check,根据里面的项进行配置修改
[root@centos7 ~]#cobbler check
The following are potential configuration items that you may want to fix:
The 'server' field in /etc/cobbler/settings must be set to something other
than localhost, or kickstarting features will not work. This should be a
resolvable hostname or IP for the boot server as reachable by all machines that
will use it.
For PXE to be functional, the 'next_server' field in /etc/cobbler/settings
must be set to something other than 127.0.0.1, and should match the IP of the
boot server on the PXE network.
change 'disable' to 'no' in /etc/xinetd.d/tftp
Some network boot-loaders are missing from /var/lib/cobbler/loaders, you may
run 'cobbler get-loaders' to download them, or, if you only want to handle
x86/x86_64 netbooting, you may ensure that you have installed a *recent* version
of the syslinux package installed and can ignore this message entirely. Files
in this directory, should you want to support all architectures, should include
pxelinux.0, menu.c32, elilo.efi, and yaboot. The 'cobbler get-loaders' command
is the easiest way to resolve these requirements.
enable and start rsyncd.service with systemctl
debmirror package is not installed, it will be required to manage debian
deployments and repositories
ksvalidator was not found, install pykickstart
The default password used by the sample templates for newly installed
machines (default_password_crypted in /etc/cobbler/settings) is still set to
'cobbler' and should be changed, try: "openssl passwd -1 -salt 'random-phrasehere' 'your-password-here'" to generate new one
fencing tools were not found, and are required to use the (optional) power
management features. install cman or fence-agents to use them
2）、生成新密码，默认安装好的系统root密码为cobbler
[root@centos7 ~]#openssl passwd -1 'magedu'
$1$1spuisnh$j34LNmyTQWs3l6xKxCZY60
- 根据以上提示，只需要做1，2，8这三项即可，修改下面四行
[root@centos7 ~]#vim /etc/cobbler/settings
default_password_crypted: "$1$1spuisnh$j34LNmyTQWs3l6xKxCZY60"
next_server：< tftp服务器的 IP 地址>
server：<cobbler服务器的 IP 地址>
manage_dhcp：1 #设置为1，表示通过cobbler生成dhcpd.conf配置文件
- 再次运行cobbler check
[root@CentOS7-1 ~]#cobbler check
The following are potential configuration items that you may want to fix:
1 : enable and start rsyncd.service with systemctl
2 : debmirror package is not installed, it will be required to manage debian deployments and repositories
3 : The default password used by the sample templates for newly installed machines (default_password_crypted in /etc/cobbler/settings) is still set to 'cobbler' and should be changed, try: "openssl passwd -1 -salt 'random-phrase-here' 'your-password-here'" to generate new one
4 : fencing tools were not found, and are required to use the (optional) power management features. install cman or fence-agents to use them
- 重启cobblerd服务
[root@centos7 ~]#systemctl restart cobblerd
(4) 实现dhcp服务
修改dhcp的模版文件下面的行，用来生成dhcp的配置文件
[root@centos7 ~]#vim /etc/cobbler/dhcp.template
subnet 10.0.0.0 netmask 255.255.255.0 {
option routers 10.0.0.254;
option domain-name-servers 223.5.5.5,223.6.6.6;
option subnet-mask 255.255.255.0;
range dynamic-bootp 10.0.0.150 10.0.0.200;
default-lease-time 21600;
max-lease-time 43200;
next-server $next_server;
生成dhcp的配置文件
[root@centos7 ~]#cobbler sync
重启dhcpd服务
[root@centos7 ~]#systemctl start dhcpd
(5) 下载启动的相关文件
[root@CentOS7-1 ~]#cobbler get-loaders
task started: 2021-02-23_112737_get_loaders
task started (id=Download Bootloader Content, time=Tue Feb 23 11:27:37 2021)
path /var/lib/cobbler/loaders/README already exists, not overwriting existing content, use --force if you wish to update
path /var/lib/cobbler/loaders/COPYING.elilo already exists, not overwriting existing content, use --force if you wish to update
path /var/lib/cobbler/loaders/COPYING.yaboot already exists, not overwriting existing content, use --force if you wish to update
path /var/lib/cobbler/loaders/COPYING.syslinux already exists, not overwriting existing content, use --force if you wish to update
path /var/lib/cobbler/loaders/elilo-ia64.efi already exists, not overwriting existing content, use --force if you wish to update
path /var/lib/cobbler/loaders/yaboot already exists, not overwriting existing content, use --force if you wish to update
path /var/lib/cobbler/loaders/pxelinux.0 already exists, not overwriting existing content, use --force if you wish to update
path /var/lib/cobbler/loaders/menu.c32 already exists, not overwriting existing content, use --force if you wish to update
path /var/lib/cobbler/loaders/grub-x86.efi already exists, not overwriting existing content, use --force if you wish to update
path /var/lib/cobbler/loaders/grub-x86_64.efi already exists, not overwriting existing content, use --force if you wish to update
*** TASK COMPLETE ***
[root@centos7 ~]#ls /var/lib/cobbler/loaders
COPYING.elilo COPYING.yaboot grub-x86_64.efi menu.c32 README
COPYING.syslinux elilo-ia64.efi grub-x86.efi pxelinux.0 yaboot
[root@centos7 ~]#tree /var/lib/tftpboot/
/var/lib/tftpboot/
├── boot
├── etc
├── grub
├── images
├── images2
├── ppc
├── pxelinux.cfg
└── s390x
8 directories, 0 files
[root@CentOS7-1 ~]#cobbler sync
[root@CentOS7-1 ~]#tree /var/lib/tftpboot/
/var/lib/tftpboot/
├── boot
│ └── grub
│ └── menu.lst
├── etc
├── grub
│ ├── efidefault
│ ├── grub-x86_64.efi
│ ├── grub-x86.efi
│ └── images -> ../images
├── images
├── images2
├── memdisk
├── menu.c32
├── ppc
├── pxelinux.0
├── pxelinux.cfg
│ └── default
├── s390x
│ └── profile_list
└── yaboot
10 directories, 10 files
(6) 修改菜单的标题信息(可选)
[root@centos7 ~]#vim /etc/cobbler/pxe/pxedefault.template
MENU TITLE Cobbler | http://www.magedu.com/
[root@centos7 ~]#cobbler sync
[root@centos7 ~]#cat /var/lib/tftpboot/pxelinux.cfg/default
DEFAULT menu
PROMPT 0
MENU TITLE Cobbler | http://www.magedu.com/ #默认为：http://cobbler.github.io/
TIMEOUT 200
TOTALTIMEOUT 6000
ONTIMEOUT local
LABEL local
MENU LABEL (local)
MENU DEFAULT
LOCALBOOT -1
MENU end
(7) 导入CentOS系统的安装文件，生成相应的YUM源
[root@centos7 ~]#cobbler import --name=centos-8.1-x86_64 --path=/misc/cd --arch=x86_64
[root@centos7 ~]#mount /dev/sr1 /mnt mount: /dev/sr1 is write-protected, mounting read-only
[root@centos7 ~]#cobbler import --name=centos-7.7-x86_64 --path=/mnt --arch=x86_64
[root@centos7 ~]#du -sh /var/www/cobbler/ks_mirror/*
11G /var/www/cobbler/ks_mirror/centos-7.7-x86_64
7.2G /var/www/cobbler/ks_mirror/centos-8.1-x86_64
12K /var/www/cobbler/ks_mirror/config
[root@centos7 ~]#cobbler distro list
centos-7.7-x86_64
centos-8.1-x86_64
[root@centos7 ~]#cobbler profile list
centos-7.7-x86_64
centos-8.1-x86_64
(8) 准备 kickstart文件,并关联至指定的YUM源
- 将应答文件放到对应的目录中
[root@CentOS7-1 ~]#ll /var/lib/cobbler/kickstarts
-rw-r--r-- 1 root root 990 Feb 22 20:39 centos8.cfg
-rw-r--r-- 1 root root 741 Feb 23 11:59 centos7.cfg
- 将kickstart文件，关联指定的YUM源和生成菜单列表
[root@centos7 ~]#cobbler profile add --name=CentOS-8.1_test --distro=CentOS-8.1-x86_64 --kickstart=/var/lib/cobbler/kickstarts/centos8.cfg
[root@centos7 ~]#cobbler profile add --name=CentOS-7.7_test --distro=CentOS-7.7-x86_64 --kickstart=/var/lib/cobbler/kickstarts/centos7.cfg
- 删除默认生成的菜单
[root@centos7 ~]#cobbler profile remove --name=centos-8.1-x86_64
[root@centos7 ~]#cobbler profile remove --name=centos-7.7-x86_64
[root@centos7 ~]#cobbler profile list
CentOS-7.7_test
CentOS-8.1_test
- 删除默认的菜单列表
[root@centos7 ~]#cobbler profile remove --name=CentOS8.0-x86_64
(9) 测试客户端基于Cobbler实现自动安装
