![[Zobrazit/Skrýt nabídky vlevo]](img/icons/oleftcol.png "[Zobrazit/Skrýt nabídky vlevo]"){kind=icon}
![[Zobrazit/Skrýt nabídky vpravo]](img/icons/orightcol.png "[Zobrazit/Skrýt nabídky vpravo]"){kind=icon}
Cheque Dejeuner - vyroba
Obsah
- Prazska centrala Up Česká republika s.r.o.(původně - Cheque Dejeuner - Seky, pripadne UP)
- Informace z převzetí linux serveru do správy
- Pristup do ticketovaciho systemu
- Konsolidace a provedene zmeny
- Desktop support
Prazska centrala Up Česká republika s.r.o.(původně - Cheque Dejeuner - Seky, pripadne UP)
FYZICKE SERVERY:
NOD1
| Funkce | Hyper-V, S2D, Cluster | |
| OS | Windows 2016R2 Datacenter Server s GUI | |
| Popis a HW | Dell Inc. PowerEdge? R730xd, 256GB RAM, 1 logical drives, 12 physical drives | |
| IP | 10.10.37.6 | |
| Netbios/DNS | NOD1.cdjcz.local | |
| Umístění | serverovna UP Vyroba | |
| Datum nákupu/instalace | 2017 | |
| PowerEdge? R730xd Service Tag | 34825M2 | |
NOD2
| Funkce | Hyper-V, S2D, Cluster | |
| OS | Windows 2016R2 Datacenter Server s GUI | |
| Popis a HW | Dell Inc. PowerEdge? R730xd, 256GB RAM, 1 logical drives, 12 physical drives | |
| IP | 10.10.37.7 | |
| Netbios/DNS | NOD2.cdjcz.local | |
| Umístění | serverovna UP Vyroba | |
| Datum nákupu/instalace | 2017 | |
| PowerEdge? R730xd Service Tag | 34825M2 | |
PDC2
| Funkce | AD DC, DNS, DHCP Failover Hot-Stanby? mode | |
| OS | Windows 2016R2 Standart Server | |
| Popis a HW | Dell Inc. PowerEdge? R320, 8GB RAM, 1 logical drives, 2 physical drives | |
| IP | 10.10.32.25 | |
| Netbios/DNS | pdc2.cdjcz.local | |
| Umístění | serverovna UP Vyroba | |
| Datum nákupu/instalace | 2017 | |
| zaloha | WSB zaloha na target na Storagecraftu | |
HVC
| Funkce | Primarni backup Storagecraft, ImageManager?, iSCSI storage, Hyper-V pro BackupPC | |
| OS | Windows 2016 Hyper-V free | |
| Popis a HW | Dell Inc. PowerEdge? R720xd, 32GB RAM, 3 logical drives, 14 physical drives | |
| IP | 10.10.32.18 | |
| iDRAC | 10.10.38.31 | |
| Netbios/DNS | Storagecraft.cdjcz.local | |
| Umístění | serverovna UP Vyroba | |
| Datum nákupu/instalace | leden 2018, zakazka AJA36, reinstalace na HYper-V free 03/21, Storagecravt virtualizovan | |
| STG zalohy sifrovane heslo | 1:nbGbp6q3kMbHlsGzwZTZyp7GqLzy | |
Seky-Backup
| Funkce | Sekundarni backup Storagecraft, ImageManager?, Hyper-V pro BackupPC | |
| OS | Windows 2008R2 Datacenter Server | |
| Popis a HW | Dell Inc. PowerEdge? R510, 32GB RAM, 3 logical drives, 14 physical drives | |
| IP | 10.174.82.100 | |
| Netbios/DNS | Seky-Backup? | |
| Umístění | serverovna Zabehlice | |
| Datum nákupu/instalace | leden 2018, zakazka AJA7 | |
| seky-backup\administrator | 1:MGZsZy0uMSlWZiwrRmAF | |
| STG zalohy sifrovane heslo | 1:nbGbp6q3kMbHlsGzwZTZyp7GqLzy | |
| ftpuser | 1:roOLi9m+io7Zq4qPiL2Ig56K7Q== | |
Hyper-V cluster
| iDRAC | qbGh5SDd2k1J | |
| local admin | V9hMWolaDk2kgV3dT4IP | |
| BIOS | Mouse.house159 |
pve4.cdjcz.local
| IP | 10.10.32.93/24 | uvt:1:yM3Lv7zm5+mO |
| IPMI | 10.10.38.20/24 | root:calvin |
pve4.cdjcz.local STANDBY
| IP | 10.10.32.92/24 | uvt:1:yM3Lv7zm5+mO |
| IPMI | 10.10.38.21/24 | root:calvin |
Pripojeni iscsi reseno startem scriptu po aktivaci 10Gb site.
/etc/network/interfaces:
auto eth3
iface eth3 inet static
address 192.168.193.18
netmask 255.255.255.0
mtu 9000
post-up /etc/init.d/open-iscsi-bosson start
Proxmox webove rozhrani:
| https://10.10.32.93:8006 | uvt:1:yM3Lv7zm5+mO (realm pam) | |
Konfigurace VM a proxmoxu je ulozena v /etc/pve na fuse filesystemu. O pripojeni se stara daemon pmxcfs (/etc/init.d/pve-cluster). Pri startu pmxcfs daemon nacita konfiguraci z sqlite databaze z adresare /var/lib/pve-cluster.
Host backup (hypervizor)
| IP | 10.10.32.90 | |
| User | root | |
| pass | 1:jouN+fqgoa/I | |
| IPMI | 10.10.38.15 | uvt:1:9aqq96aFlrqQh7OghI2IhMI= |
Virtualni servery
BackupPC (virtual)
Bezi na hyperv (storagecraft), zalohuje linuxove servery
| IP | 10.10.32.191 | |
BackupPC sekundarni (virtual)
Bezi na hyperv v zabehlicich, synchronizovana kopie BackupPC (10.10.32.191) s sifrovanym diskem
| IP | 10.174.82.101 | |
smtp.cdjcz.local
Slouzi jako odchozi SMTP server a prepisuje odchozi domenu na seky.cz
| IP | 10.10.32.218 | |
netstat.cdjcz.local
Slouzi pro grafovani a zalohy sitovych prvku
| IP | 10.10.32.217 | |
| zabbix web | admin | 1:6unJ1t2Ukac= |
| netbackup gitweb | netbackup | 1:DzwBAHx5f3lO |
| mysql | root | 1:n6mGq4OD9PPF |
| ssh | root | 1:trW4tc7Cys77 |
Zabbix web: http://zabbix.cdjcz.local/zabbix/dashboard.php
Netbackup gitweb: https://netbackup.cdjcz.local
SSH pristup na servery obecne
Realizovan pres ssh proxy z uvt@linux-remote (10.0.12.251), proxy konfigurace v .ssh/config. Povoleno pouze pres ssh klice. Pripadne pres SSLVPN Forticlient (viz nize), pak naprimo na IP serveru/ipmi.
Hlasit se jako uvt, potom sudo su -
| uvt | 1:mZya7u23trjf | |
Vzdaleny pristup na Fortigate Cluster ze Zabehlic
Pristupy a fotky na centralni prvky site jsou v dc.b.ktf.cuni.cz
VPN pristup do site CDJCZ
Realizovan pres fortiklient sslvpn
| IP | vpn1.seky.cz / vpn2.seky.cz | |
| Port | 10443 | |
| UVT | 1:YX0AUlZeeBp3ZEVjXgECWzU= | |
Linux client: forticlientsslvpn.tgz
Ostatni pristupy do site a jine
Windows pristup
| User: CDJCZ\uvt | 1:/eTahcf45+jByu/0yOnX+q4= | |
| Local Admin | 1:aEtAQElITgsJCAg5 | |
| Domain Admin | 1:Di0mJi8uKG1vbm5f | |
| ERA | https://10.10.32.52/era | 1:JwQPDwYHAURGR0d2 |
| VNC | 1:X2QtJBQ= (90%) nebo 1:aXJkcnh3EA== (5%) | |
| Test User | testa | 1:xuvj47e1tLLrhQ== |
Centreon
| IP: 10.10.32.215 | http://centreon.cdjcz.local/centreon/index.php | |
| admin | 1:p6Kk0NOJiIbh | |
Sit v centrale DCJCZ
Jako router je v centrale dvojice Fortigate 100D v HA clusteru, pred kteryma je dvojice HP 2530G switchu ve stacku. Z routeru FG je kabel/spojovacka na centralni routovaci prvek, coz je stack sesti switchu Extreme X440. Na tomto stacku je nekolik VLAN, je tam nastaven zakladni routing mezi vlany a defaultni routa na Fortigate cluster. DHCP je relayovano na windows server z Extreme stacku.
Switche HP pred Fortigaty switchuji pouze uplinky internetu, jeden Casablancu, druhy TMO a dale je na nich zakoncena public sit (asi 20x UTP), kterou ridi zvlastni VDOM (virtualni instance) na FG routerech. Tento VDOM na opet jako uplink casablancu, ale na jinem portu (je to separatni instance a nevidi porty mezi sebou) a dale ma tento VDOM port do LAN (opet separatni od ostre LAN).
Na clusteru Fortigate je terminovano nekolik statickych ipsecu po evropskych pobockach (i k nam do hostingu), dale je tam ipsec hub pro CZ pobocky a je tam SSLVPN. Fortigate take dela AV a filtering webu, pricemz nekteri uzivatele/subnety maji omezeny pristup k webu timto zarizenim.
Routery na pobockach
| Brno | https://fwbrno.cdjcz.local | 192.168.21.1 |
| Pardubice | https://fwpard.cdjcz.local | 192.168.6.1 |
| Usti n. L. | https://fwusti.cdjcz.local | 192.168.25.1 |
| Plzen | https://fwplze.cdjcz.local | 192.168.1.1 |
| zavreno - Most | https://fwmost.cdjcz.local | 192.168.4.1 |
| zavreno - Cesky Tesin | https://fwtesi.cdjcz.local | 192.168.20.1 |
Pristupy na pobockove routery stejny jako na centralni router (tj. fortigate1.seky.cz v evidenci DC)
Podpora FG
Oficialni podpora (vsechny FG jsou pod supportem)
| account: daniel.rimal v(e) uvt.cz | pass : 1:npud6OyLur2/rtg= | |
Wifi
Management wifi je resen pomoci unifi. Vzhledem k implementaci voucher-style open wifi se overuji vouchery vuci unifi aplikaci, takze kdokoliv zvenci se muze pripojit na open wifi a zkouset prolomit tuto aplikaci. Z toho duvodu je vytvorena VLAN 41, ktera je v "public-fw" vdomu, takze je izolovana od interni site UPCZ.
Mezi vdomy "root" a "public_fw" je pro controller povoleno SSH a 8443 (management + management voucheru)
Tato sit (vlan 41) je vyvedena na portu 6 fortigate a z obou je zapojena do extremu (portu 3:32 a 4:32), ktere jsou untagged vl41. Dale tato vlan vede tagovane do hyperv, kde bezi controller.
V teze vlane jsou zapojene unifi talire, ktere ve vlan 41 maji management.
Administrace controlleru bezi na URL https://unifi.cdjcz.local:8443, pripadne zvenci https://94.113.252.51:8443/
Sprava public wifi ticketu je dostupna pres:
https://unifi.cdjcz.local:8443/manage/hotspot
https://94.113.252.51:8443/manage/hotspot
Pristupy v syspass.
802.1X
Na switchi extreme je reseno overovani uzivatelu (stanic) 802.1X proti radiusu (10.10.32.25 a 10.10.32.31).
Zjisteni portu dle MAC:
show fdb <MAC>
Zapnuti 802.1X pro dany port (priklad pro port 4:47):
enable netlogin ports 4:47 dot1x configure netlogin dot1x guest-vlan public ports 4:47 enable netlogin dot1x guest-vlan ports all configure netlogin authentication failure vlan "Empty" ports 4:47 configure netlogin authentication service-unavailable vlan "Empty" ports 4:47 enable netlogin authentication failure vlan ports all enable netlogin authentication service-unavailable vlan ports all * Slot-1 Stack.60 # save The configuration file primary.cfg already exists. Do you want to save configuration to primary.cfg and overwrite it? (y/N) Yes Saving configuration on master . done! Synchronizing configuration to backup .................................................. done! Saving configuration on Standbys (Slots: 3,4,5,6). ......................................... Configuration saved on Standby (Slot 5): done! Configuration saved on Standby (Slot 3): done! Configuration saved on Standby (Slot 4): done! Configuration saved on Standby (Slot 6): done!
Vypnuti per port:
unconfigure netlogin dot1x guest-vlan ports 2:16 disable netlogin ports 2:16 dot1x
konfigurace radiusu takto:
configure radius netlogin primary server 10.10.32.25 1812 client-ip 10.10.32.1 vr VR-Default configure radius netlogin primary shared-secret encrypted "#$Sqf9xoKjR3+T7dKAue2jUBr0dR7V7aR7U0HZ8+cD" enable radius netlogin configure radius netlogin timeout 2
konfigurace sysloggingu kvuli debugu:
create log filter UVT_ALL create log filter UVT_DOT1X configure log filter UVT_ALL add events All severity debug-verbose configure log filter UVT_DOT1X add events nl severity debug-verbose configure syslog add 10.10.32.217:514 vr VR-Default local7 enable log target syslog 10.10.32.217:514 vr VR-Default local7 configure log target syslog 10.10.32.217:514 vr VR-Default local7 filter DefaultFilter severity Debug-Verbose configure log target syslog 10.10.32.217:514 vr VR-Default local7 match Any configure log target syslog 10.10.32.217:514 vr VR-Default local7 format timestamp seconds date dd-mm-yyyy event-name component process-slot host-name tag-name
Pro zapnuti debugu spustit:
enable log debug-mode configure log target syslog 10.10.32.217:514 vr VR-Default local7 filter UVT_DOT1X severity Debug-Verbose
Pro vypnuti zpet:
disable log debug-mode configure log target syslog 10.10.32.217:514 vr VR-Default local7 filter DefaultFilter severity Debug-Verbose
zjisteni stavu portu nebo celeho netlogin:
show netlogin port 4:48
Port : 4:48
Port Restart : Disabled
Allow Egress : None
Vlan : Sales
Authentication : 802.1x
Port State : Enabled
Auth Failure Vlan : Enabled
Auth Service-Unavailable Vlan : Enabled
------------------------------------------------
802.1x Port Configuration
------------------------------------------------
Quiet Period : 60
Supplicant Response Timeout : 30
Re-authentication : On
Re-authentication period : 3600
Max Re-authentications : 3
RADIUS server timeout : 2
Guest Vlan : Enabled
------------------------------------------------
Netlogin Clients
------------------------------------------------
MAC IP address Authenticated Type ReAuth-Timer User
a4:4c:c8:7e:65:2a 10.10.33.130 Yes, Radius 802.1x 3371 host/slobch38.cdjcz.local
-----------------------------------------------
Slot-1 Stack.36 # show netlogin dot1x
NetLogin Authentication Mode : web-based DISABLED; 802.1x ENABLED; MAC-based DISABLED
NetLogin VLAN : "nl_vlan"
NetLogin move-fail-action : Deny
NetLogin Client Aging Time : 5 minutes
Dynamic VLAN Creation : Disabled
Dynamic VLAN Uplink Ports : None
Authentication Protocol Order: 802.1x, web-based, mac-based (default)
Maximum Number Of Users : 0 (Policy Enabled only)
------------------------------------------------
802.1x Mode Global Configuration
------------------------------------------------
EAPOL MPDU version to transmit : v2
Tag EAPOL on tagged ports : Off
Authentication Database : Radius
RADIUS Accounting : On
------------------------------------------------
Port: 4:48, Vlan: Sales, State: Enabled, Authentication: 802.1x
Authentication Failure Vlan Empty: Enabled
Authentication Service-Unavailable Vlan Empty: Enabled
------------------------------------------------
802.1x Port Configuration
------------------------------------------------
Quiet Period : 60
Supplicant Response Timeout : 30
Re-authentication : On
Re-authentication period : 3600
Max Re-authentications : 3
RADIUS server timeout : 2
Guest Vlan public: Enabled
------------------------------------------------
Netlogin Clients
------------------------------------------------
MAC IP address Authenticated Type ReAuth-Timer User
a4:4c:c8:7e:65:2a 10.10.33.130 Yes, Radius 802.1x 3316 host/slobch38.cdjcz.local
-----------------------------------------------
Vypsani nepodarenych prihlaseni a vypsani eventu ohledne dane MAC, lze z logu na serveru 10.10.32.217 a aktualniho logu v /data/logy/10.10.32.1/<rok>/<mesic>/<den>/user.<date>.txt
for i in `cat user.20180709.txt | grep "authentication Locally" | awk '{print $19}'`; do cat user.20180709.txt | grep $i; echo "-----------------"; done
Skript na generovani configu pro switch, pak staci jen pastnout do konzole. Samozrejme potreba upravit seznam portu, ktere chci zapnout. Typicky vsechny z dane vlan (radek untag):
Slot-1 Stack.165 # show vlan "Financial"
VLAN Interface with name Financial created by user
Admin State: Enabled Tagging: 802.1Q Tag 8
Description: None
Virtual router: VR-Default
IPv4 Forwarding: Enabled
IPv4 MC Forwarding: Disabled
Primary IP: 10.10.33.193/26
IPv6 Forwarding: Disabled
IPv6 MC Forwarding: Disabled
IPv6: None
STPD: None
Protocol: Match all unfiltered protocols
Loopback: Disabled
NetLogin: Disabled
OpenFlow: Disabled
TRILL: Disabled
QosProfile: None configured
Egress Rate Limit Designated Port: None configured
Flood Rate Limit QosProfile: None configured
Ports: 9. (Number of active ports=4)
Untag: 2:13u, *2:14a, *2:15a, *2:16
Tag: 4:10, *4:11, 4:12, 4:13, 4:14
Flags: (*) Active, (!) Disabled, (g) Load Sharing port
(b) Port blocked on the vlan, (m) Mac-Based port
(a) Egress traffic allowed for NetLogin
(u) Egress traffic unallowed for NetLogin
(t) Translate VLAN tag for Private-VLAN
(s) Private-VLAN System Port, (L) Loopback port
(x) VMAN Tag Translated port
(G) Multi-switch LAG Group port
(H) Dynamically added by MVRP
(D) TRILL Designated, (A) TRILL Appointed Forwarder
(I) Dynamically added by IDM
(U) Dynamically added uplink port
(V) Dynamically added by VM Tracking
Skript samotny:
#!/bin/bash ports="1:17 1:37 1:39" for i in $ports; do. echo "enable netlogin ports $i dot1x" echo "configure netlogin dot1x guest-vlan public ports $i" echo "enable netlogin dot1x guest-vlan ports all" echo "configure netlogin authentication failure vlan public ports $i" echo "configure netlogin authentication service-unavailable vlan public ports $i" echo "enable netlogin authentication failure vlan ports all" echo "enable netlogin authentication service-unavailable vlan ports all" done
Management switch
V racku je u servru dell switch pro IP management.Porty 1-12 jsou untagged v ip-management vlane (vid 4).
| 10.10.38.2 | admin | heslo v syspass pod: ipmiswitch.cdjcz.local |
Informace z převzetí linux serveru do správy
Diagram CDJCZ_workflow2.pdf
Pristup do ticketovaciho systemu
http://iservice.cdjcz.local/login
UVT:1:3Z24nILcrN+qh4m5ndbYju8=
Konsolidace a provedene zmeny
- clean_vips presunut z monit a vips (22.2.18)
Desktop support
Základní instalace PC/NB
| 1. Dell Command Update | ||
| 2. Windows Update | ||
| 3. Adobe Reader DC | ||
| 4. Firefox ESR | ||
| 5. Flash Player pro Firefox (a IE ve W7) | ||
| 6. Na C vytvořit složku CDJ a nastavit právo pro čtení i zápis skupina users. | ||
| 7. Nastavit heslo pro lokální správce (administrator + spravce) | ||
| 8. Přejmenovat a přidat do domény – přesunout do kontejneru dle zařízení. | ||
| 9. Povolit vzdálenou plochu. | ||
| 10. Nastavit firewall – na W7 bylo nastaveno GPO které firewall nastaví. Musíme ověřit jestli funguje i u W10. Prvotně je ale potřeba povolit sdílení tiskáren pro instalaci dalších položek. | ||
| 12. ESET – Eset agenta přes GPO, vložením do skupiny Centrála- GPO_test. | ||
| 13. SAM Agent | ||
| 14. Tight VNC – nastavit heslo pro admin. | ||
| 15. Forti SSLVPN – + přidat uživatele do skupiny v AD FortiVPN_internal jinak mu nepůjde VPN. | ||
| 16. MS Office + Skype for business | ||
| 17. Nastavit zamykání obrazovky po 30 min – zamykání obrazovky je přes GPO, každý pc který je v kontejneru mimo výchozí „computers“ , se aktivuje zamykání po 15 min. Zbytek pc kde chceme zamykat po 60min. je třeba dát do příslušného kontejneru.Týká se poboček a výroby. | ||
| 18.Nastavit power management, u pc i ntb zakázat režim spánku, při napájení z baterie dle uvážení. Já dávám režim spánku po hodině. |
![[přepni]](javascript:icntoggle('mod-Application_Menuleft1','module.png'); "[přepni]"){kind=small}