サーバー設定/echeclus.carrot.co.jp の編集

#topicpath

* 社内-社外ネットワークゲートウェイ/DHCPサーバー [#o4356192]
 構成検討中

* パッケージ追加 [#jc29daf2]
 firewalld
 dhcp

* 詳細設定 [#o3a04b55]
++ /etcresolv.conf
 # Generated by NetworkManager
 search carrot.co.jp
 nameserver 8.8.8.8
++ /etc/modules-load.d/br_netfilter.conf
 br_netfilter
 ※以下実施
 # systemctl restart systemd-modules-load.service
++ /etc/sysctl.conf
 net.ipv4.conf.all.rp_filter = 2
 net.ipv4.conf.default.accept_source_route = 2
 kernel.sysrq = 0
 kernel.core_uses_pid = 1
 net.ipv4.tcp_syncookies = 1
 net.bridge.bridge-nf-call-ip6tables = 0
 net.bridge.bridge-nf-call-iptables = 0
 net.bridge.bridge-nf-call-arptables = 0
 vm.swappiness=10
 net.core.somaxconn = 65535
 net.core.netdev_max_backlog = 16384
 net.core.rmem_max = 134217728
 net.core.wmem_max = 134217728
++ /etc/sysconfig/network
 FORWARD_IPV4="yes"
 GATEWAY=210.196.71.253
++ /etc/sysconfig/network-scripts/ifcfg-ens192
 TYPE=Ethernet
 PROXY_METHOD=none
 BROWSER_ONLY=no
 BOOTPROTO=none
 DEFROUTE=no
 IPV4_FAILURE_FATAL=no
 IPV6INIT=yes
 IPV6_AUTOCONF=yes
 IPV6_DEFROUTE=yes
 IPV6_FAILURE_FATAL=no
 IPV6_ADDR_GEN_MODE=stable-privacy
 NAME=ens192
 UUID=0682dbe7-9e4d-4c88-a2b7-124891560655
 DEVICE=ens192
 ONBOOT=yes
 IPADDR1=172.31.200.1
 PREFIX1=24
 NETWORK=172.31.24.0
 PEERDNS=no
 DNS1=8.8.8.8
 IPV6ADDR=2001:db8::1/64
 IPADDR=172.31.24.3
 PREFIX2=24
++ /etc/sysconfig/network-scripts/ifcfg-ens224
 TYPE=Ethernet
 PROXY_METHOD=none
 BROWSER_ONLY=no
 BOOTPROTO=none
 DEFROUTE=yes
 IPV4_FAILURE_FATAL=no
 IPV6INIT=yes
 IPV6_AUTOCONF=yes
 IPV6_DEFROUTE=yes
 IPV6_FAILURE_FATAL=no
 IPV6_ADDR_GEN_MODE=stable-privacy
 NAME=ens224
 UUID=69bd6dff-0e1c-4829-82ae-57561009c7c6
 DEVICE=ens224
 ONBOOT=yes
 NETWORK=210.196.71.248
 BROADCAST=210.196.71.255
 IPADDR=210.196.71.249
 PREFIX=29
 GATEWAY=210.196.71.253
++ /etc/sysconfig/network-scripts/ifcfg-ens161
 HWADDR=00:0C:29:4F:D0:E5
 TYPE=Ethernet
 PROXY_METHOD=none
 BROWSER_ONLY=no
 IPV6INIT=no
 NAME=ens161
 UUID=cdc15a30-6fcf-3c07-a91a-7beaf9f7d949
 ONBOOT=yes
 AUTOCONNECT_PRIORITY=-999
 NETWORK=210.196.71.248
 IPADDR=210.196.71.250
 PREFIX=29
 GATEWAY=210.196.71.253
++ /etc/sysconfig/network-scripts/ifcfg-ens193
 HWADDR=00:0C:29:4F:D0:EF
 TYPE=Ethernet
 PROXY_METHOD=none
 BROWSER_ONLY=no
 IPV6INIT=no
 NAME=ens193
 UUID=2235ff8f-58dc-36eb-8a2e-0aa9b63bffdd
 ONBOOT=yes
 AUTOCONNECT_PRIORITY=-999
 IPADDR=210.196.71.251
 PREFIX=29
 GATEWAY=210.196.71.253
++ /etc/sysconfig/network-scripts/ifcfg-ens256
 HWADDR=00:0C:29:4F:D0:DB
 TYPE=Ethernet
 PROXY_METHOD=none
 BROWSER_ONLY=no
 IPV6INIT=no
 NAME=ens256
 UUID=bd8e0444-f884-3169-808e-e3add6c6d788
 ONBOOT=yes
 AUTOCONNECT_PRIORITY=-999
 IPADDR=210.196.71.252
 PREFIX=29
 GATEWAY=210.196.71.253
++ /etc/ssh/sshd_config
 (以下追記)
 ListenAddress 172.31.24.3
 ListenAddress 172.31.200.1
++ /etc/sysconfig/iptables
 *filter
 :INPUT DROP [0:0]
 :FORWARD DROP [0:0]
 :OUTPUT ACCEPT [59:4971]
 :default - [0:0]
 :pass - [0:0]
 #-A INPUT -p icmp --icmp-type any -j ACCEPT
 -A INPUT -j default 
 -A FORWARD -j pass 
 -A FORWARD -j default 
 -A default -m state --state RELATED,ESTABLISHED -j ACCEPT 
 -A default ! -i ens224 -m state --state NEW -j ACCEPT 
 -A default ! -i ens161 -m state --state NEW -j ACCEPT 
 -A default ! -i ens193 -m state --state NEW -j ACCEPT 
 -A default ! -i ens256 -m state --state NEW -j ACCEPT 
 # -A pass -d 172.31.24.232 -s 0.0.0.0/0.0.0.0 -j ACCEPT
 -A pass -d 172.31.200.12 -s 1.202.70.134/255.255.255.255 -j DROP
  --- 踏み台サーバーdropフィルタ部分中略 ---
 -A pass -d 172.31.200.12 -s 223.255.183.10/255.255.255.255 -j DROP
 -A pass -d 172.31.24.232 -s 1.13.20.177/255.255.255.255 -j DROP
  --- メールサーバーdropフィルタ部分中略 ---
 -A pass -d 172.31.24.232 -s 223.241.117.180/255.255.255.255 -j DROP
 -A default -j DROP 
 -A pass -d 172.31.24.5 -p tcp -m tcp --dport 53 -j ACCEPT 
 -A pass -d 172.31.24.5 -p udp -m udp --dport 53 -j ACCEPT 
 -A pass -d 172.31.24.5 -p tcp -m tcp --dport 80 -j ACCEPT 
 -A pass -d 172.31.24.5 -p tcp -m tcp --dport 443 -j ACCEPT 
 # DNS
 -A pass -d 172.31.24.231 -p tcp -m tcp --dport 53 -j ACCEPT
 -A pass -d 172.31.24.231 -p udp -m udp --dport 53 -j ACCEPT
 # TGI通知メールバイパス
 -A pass -d 172.31.24.232 -s 52.199.63.0/255.255.255.0 -j ACCEPT
 -A pass -d 172.31.24.232 -s 52.198.247.0/255.255.255.0 -j ACCEPT
 -A pass -d 172.31.24.232 -s 13.115.104.0/255.255.255.0 -j ACCEPT
 -A pass -d 172.31.24.232 -s 18.179.48.0/255.255.255.0 -j ACCEPT
 -A pass -d 172.31.24.232 -s 3.112.23.0/255.255.255.0 -j ACCEPT
 # www.tdanp.jishin.net通知メールバイパス
 -A pass -d 172.31.24.232 -s 110.50.242.2/255.255.255.255 -j ACCEPT
 # hsspv.jishin.netメールバイパス
 -A pass -d 172.31.24.232 -s 113.35.159.189/255.255.255.255 -j ACCEPT
 # mta0[34].obc.smtps.jp勤務system通知
 -A pass -d 172.31.24.232 -s 163.43.197.11/255.255.255.255 -j ACCEPT
 -A pass -d 172.31.24.232 -s 153.125.134.139/255.255.255.255 -j ACCEPT
 
 -A pass -d 172.31.24.232 -p tcp -m multiport --dports 25,465,587 -j ACCEPT
 -A pass -d 172.31.24.232 -p tcp -m tcp --dport 110 -j ACCEPT 
 -A pass -d 172.31.24.232 -p tcp -m tcp --dport 995 -j ACCEPT 
 -A pass -d 172.31.24.232 -p tcp -m tcp --dport 20001 -j ACCEPT 
 -A pass -d 172.31.24.241 -p tcp -m tcp --dport 443 -j ACCEPT
 -A pass -d 172.31.24.228 -p tcp -m tcp --dport 80 -j ACCEPT 
 -A pass -d 172.31.24.33 -p tcp -m tcp --dport 8888 -j ACCEPT
 -A pass -d 172.31.24.98 -p tcp -m tcp --dport 5555 -j ACCEPT
 -A pass -d 172.31.24.9 -p tcp -m tcp --dport 22 -j ACCEPT
 -A pass -d 172.31.24.9 -p tcp -m tcp --dport 80 -j ACCEPT 
 -A pass -d 172.31.24.9 -p tcp -m tcp --dport 443 -j ACCEPT 
 -A pass -d 172.31.24.9 -p tcp -m tcp --dport 3306 -j ACCEPT 
 -A pass -d 172.31.24.9 -p udp -m udp --dport 3306 -j ACCEPT 
 -A pass -d 172.31.24.9 -p tcp -m tcp --dport 8081 -j ACCEPT 
 -A pass -d 172.31.24.9 -p tcp -m tcp --dport 5991 -j ACCEPT 
 -A pass -d 172.31.24.9 -p tcp -m tcp --dport 5992 -j ACCEPT 
 #-A pass -d 172.31.24.128 -p tcp -m tcp --dport 80 -j ACCEPT 
 -A pass -d 172.31.24.228 -p tcp -m tcp --dport 5432 -j ACCEPT 
 -A pass -d 172.31.24.235 -p tcp -m tcp --dport 80 -j ACCEPT 
 -A pass -d 172.31.24.235 -p tcp -m tcp --dport 443 -j ACCEPT 
 #-A pass -d 172.31.24.237 -p tcp -m tcp --dport 80 -j ACCEPT 
 #-A pass -d 172.31.24.237 -p tcp -m tcp --dport 443 -j ACCEPT 
 #-A pass -d 172.31.24.237 -p tcp -m tcp --dport 8443 -j ACCEPT 
 #-A pass -d 172.31.24.237 -p tcp -m tcp --dport 8444 -j ACCEPT 
 #-A pass -d 172.31.24.230 -p tcp -m tcp --dport 443 -j ACCEPT 
 #-A pass -d 172.31.24.230 -p udp -m udp --dport 500 -j ACCEPT 
 #-A pass -d 172.31.24.230 -p udp -m udp --dport 4500 -j ACCEPT 
 -A pass -d 172.31.24.35 -p tcp -m tcp --dport 81 -j ACCEPT
 # KCS -> carrot
 -A pass -s 172.31.4.0/22 -d 172.31.24.0/22 -j ACCEPT 
 
 -A pass -d 172.31.24.227 -p tcp -m tcp --dport 10400 -j ACCEPT
 -A pass -d 172.31.24.227 -p udp -m udp --dport 10400 -j ACCEPT
 -A pass -d 172.31.24.31 -p tcp -m tcp --dport 8443 -j ACCEPT
 -A pass -d 172.31.200.12 -p tcp -m tcp --dport 22 -j ACCEPT
 -A pass -d 172.31.200.12 -p tcp -m tcp --dport 25 -j ACCEPT
 # PhoMES Light
 -A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 118.27.22.29/23 -j ACCEPT
 -A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 118.27.22.29/23 -j ACCEPT
 # Teiki Ekishi Vision (Staging)
 -A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 13.115.249.210 -j ACCEPT
 -A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 13.115.249.210 -j ACCEPT
 -A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 54.199.129.242 -j ACCEPT
 -A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 54.199.129.242 -j ACCEPT
 # Teiki Ekishi Vision (Production)
 -A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 13.114.85.91 -j ACCEPT
 -A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 13.114.85.91 -j ACCEPT
 -A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 54.249.216.0 -j ACCEPT
 -A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 54.249.216.0 -j ACCEPT
 # Uruwashiki Ehon
 -A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 160.16.78.73 -j ACCEPT
 -A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 160.16.78.73 -j ACCEPT
 # UMIN Hosting
 -A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 130.69.92.113 -j ACCEPT
 -A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 130.69.92.113 -j ACCEPT
 # europa
 -A pass -d 172.31.24.231 -p tcp -m tcp --dport 80 -j ACCEPT
 -A pass -d 172.31.24.231 -p tcp -m tcp --dport 443 -j ACCEPT
 # proteus
 -A pass -d 172.31.24.82 -p tcp -m tcp --dport 80 -j ACCEPT
 -A pass -d 172.31.24.82 -p tcp -m tcp --dport 443 -j ACCEPT
 # fmsagami
 -A pass -d 172.31.24.53 -p tcp -m tcp --dport 10080 -j ACCEPT
 # Uruwashiki Android Test Server
 -A pass -d 172.31.24.121 -p tcp -m tcp --dport 8443 -j ACCEPT
 # cavpn.carrot.co.jp
 -A pass -d 172.31.24.251 -p tcp -m tcp --dport 5555 -j ACCEPT
 -A pass -d 172.31.24.251 -p udp -m udp --dport 500 -j ACCEPT 
 -A pass -d 172.31.24.251 -p udp -m udp --dport 4500 -j ACCEPT 
 # saigaist.carrot.co.jp
 -A pass -d 172.31.24.243 -p tcp -m tcp --dport 80 -j ACCEPT
 -A pass -d 172.31.24.243 -p tcp -m tcp --dport 443 -j ACCEPT
 -A pass -d 172.31.24.244 -p tcp -m tcp --dport 80 -j ACCEPT
 -A pass -d 172.31.24.244 -p tcp -m tcp --dport 443 -j ACCEPT
 COMMIT
 # Completed on Wed Oct 25 15:36:26 2006
 # Generated by iptables-save v1.2.11 on Wed Oct 25 15:36:26 2006
 *nat
 :PREROUTING ACCEPT [21:1563]
 :POSTROUTING ACCEPT [2:187]
 :OUTPUT ACCEPT [2:187]
 # phobos
 -A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 8888 -j DNAT --to-destination 172.31.24.33:8888
 
 # mozart
 -A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 5555 -j DNAT --to-destination 172.31.24.98:5555
 -A PREROUTING -d 210.196.71.251 -p udp -m udp --dport 500 -j DNAT --to-destination 172.31.24.98:500
 -A PREROUTING -d 210.196.71.251 -p udp -m udp --dport 4500 -j DNAT --to-destination 172.31.24.98:4500
 
 # europa (210.196.71.251 -> 172.31.24.231)
 -A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 53 -j DNAT --to-destination 172.31.24.231:53 
 -A PREROUTING -d 210.196.71.250 -p udp -m udp --dport 53 -j DNAT --to-destination 172.31.24.231:53 
 -A PREROUTING -d 210.196.71.249 -p tcp -m tcp --dport 53 -j DNAT --to-destination 172.31.24.231:53 
 -A PREROUTING -d 210.196.71.249 -p udp -m udp --dport 53 -j DNAT --to-destination 172.31.24.231:53 
 
 # NB
 -A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 8443 -j DNAT --to-destination 172.31.24.31:8443
 
 # fmsagami
 -A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 10080 -j DNAT --to-destination 172.31.24.53:10080
 
 # NBMAC
 -A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 3000 -j DNAT --to-destination 172.31.24.54:3000
 -A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 11434 -j DNAT --to-destination 172.31.24.54:11434
 
 # MTA WAN -> LAN
 # -A PREROUTING -d 172.31.200.100 -p tcp -m tcp --dport 25 -j DNAT --to-destination 172.31.24.232:25 
 -A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 25 -j DNAT --to-destination 172.31.24.232:25 
 -A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 587 -j DNAT --to-destination 172.31.24.232:587
 -A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 465 -j DNAT --to-destination 172.31.24.232:465 
 
 # MTA LAN -> WAN
 -A POSTROUTING -s 172.31.24.12 -p tcp -m tcp --dport 25 -j SNAT --to-source 210.196.71.251
 
 # POP
 -A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 110 -j DNAT --to-destination 172.31.24.232:110 
 -A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 995 -j DNAT --to-destination 172.31.24.232:995 
 -A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 993 -j DNAT --to-destination 172.31.24.232:993 
 
 -A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 20001 -j DNAT --to-destination 172.31.24.229:20001
 
 # netmster-wiki
 -A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.31.24.224:443
 
 # letsencrypt acme
 -A PREROUTING -d 210.196.71.249 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.31.24.224:80
 -A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.31.24.224:80
 -A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.31.24.224:80
 -A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.31.24.224:80
 
 # www.carrot.co.jp
 -A PREROUTING -d 210.196.71.249 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.31.24.224:443
 
 # cybozu
 -A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.31.24.241:443
 
 # Uruwashiki Android Test Server (210.196.71.252 -> 172.31.24.121)
 -A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 8443 -j DNAT --to-destination 172.31.24.121:8443
 
 # Rekochoku (210.196.71.252 -> 172.31.24.228)
 -A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 5432 -j DNAT --to-destination 172.31.24.228:5432
 
 # cavpn.carrot.co.jp (210.196.71.252 -> 172.31.24.251) SoftEtherVPN(G2)
 -A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 15555 -j DNAT --to-destination 172.31.24.251:5555
 -A PREROUTING -d 210.196.71.252 -p udp -m udp --dport 500 -j DNAT --to-destination 172.31.24.251:500
 -A PREROUTING -d 210.196.71.252 -p udp -m udp --dport 4500 -j DNAT --to-destination 172.31.24.251:4500
 
 # promoter web & ssd (revers proxy) (210.196.71.252 -> 172.31.24.229)
 -A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.31.24.229:443
 
 # zeno MSSQLServer (210.196.71.252 -> 172.31.24.227)
 -A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 10400 -j DNAT --to-destination 172.31.24.205:10400
 -A PREROUTING -d 210.196.71.252 -p udp -m udp --dport 10400 -j DNAT --to-destination 172.31.24.205:10400
 
 # styx remote server (210.196.71.252 -> 172.31.200.12) ISLAND
 -A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 10999 -j DNAT --to-destination 172.31.200.12:22
 
 # LAN -> WAN (Gateway(rickdom): 210.196.71.249)
 -A POSTROUTING -s 172.31.24.232 -j SNAT --to-source 210.196.71.251
 -A POSTROUTING -o ens224 -j SNAT --to-source 210.196.71.249
 -A POSTROUTING -o ens161 -j SNAT --to-source 210.196.71.250
 -A POSTROUTING -o ens193 -j SNAT --to-source 210.196.71.251
 -A POSTROUTING -o ens256 -j SNAT --to-source 210.196.71.252
 
 COMMIT
++ /etc/dhcp/dhcpd.conf
 authoritative;
 option domain-name              "carrot.co.jp";
 option domain-name-servers      172.31.24.30, 172.31.24.20;
 
 ddns-updates on;
 ddns-update-style interim;
 ignore client-updates;
 update-static-leases on;
 
 include "/etc/ddns.key";
 zone carrot.co.jp. {
         primary 172.31.24.30;
         key DDNS;
 }
 zone 24.31.172.in-addr.arpa. {
         primary 172.31.24.30;
         key DDNS;
 }
 
 subnet 172.31.24.0 netmask 255.255.255.0 {
 
 # --- default gateway
         option routers                  172.31.24.3;
         option subnet-mask              255.255.255.0;
 
         option nis-domain               "carrotnet";
 
         option time-offset              -18000; # Eastern Standard Time
         option ntp-servers              172.31.24.231;
         option domain-search            "carrot.co.jp";
 #       option netbios-name-servers     172.31.24.48;
 # --- Selects point-to-point node (default is hybrid). Don't change this unless
 # -- you understand Netbios very well
 #       option netbios-node-type 2;
 
         range dynamic-bootp 172.31.24.111 172.31.24.199;
         default-lease-time 216;
         max-lease-time 43200;
 }
         # we want the nameserver to appear at a fixed address
 #--- Carrotnet Hosts ----
         host bach {
                 hardware ethernet 70:20:84:01:A4:DC;
                 fixed-address 172.31.24.33;
                 update-static-leases on;
         }
         host DocuPrint {
                 hardware ethernet 1C:7D:22:36:D6:6A;
                 fixed-address 172.31.24.34;
                 update-static-leases on;
         }
         host intranet-server {
                 hardware ethernet b8:ac:6f:81:47:a5;
                 fixed-address 172.31.24.36;
                 update-static-leases on;
         }
         host mozart {
                 hardware ethernet F8:B1:56:D3:E5:9B;
                 fixed-address 172.31.24.98;
                 update-static-leases on;
         }
 
 #
 # [重要] 172.31.24.37/172.31.24.28 は電話の交換機で固定で使用しているので
 #　　　　割り当て不可
 #
 
 #--- Groupware Hosts ---
         host odessa {
                 hardware ethernet 00:07:40:98:D1:39;
                 fixed-address 172.31.24.20;
                 update-static-leases on;
         }
         host pluto {
                 hardware ethernet 00:01:80:6C:0B:EB;
                 fixed-address 172.31.24.30;
                 update-static-leases on;
         }
 
         #--- NB Host ---
         host NB {
                 hardware ethernet D4:BE:D9:CA:6A:DE;
                 fixed-address 172.31.24.31;
                 update-static-leases on;
         }
 
 #--- Common Host ----
         host jaguar {
                 hardware ethernet 00:0C:29:4F:C4:19;
                 fixed-address 172.31.24.40;
                 update-static-leases on;
         }
         host jaguar2 {
                 hardware ethernet 00:07:40:24:9E:E1;
                 fixed-address 172.31.24.41;
                 update-static-leases on;
         }
 
 #--- Project Hosts
         # Sony EdgeStore Project
         host cardl2 {
                 hardware ethernet 00:01:80:6B:5B:A8;
                 fixed-address 172.31.24.48;
                 update-static-leases on;
         }
         host COM-MID1 {
                 hardware ethernet 08:00:23:91:98:A7;
                 fixed-address 172.31.24.49;
                 update-static-leases on;
         }
         host COM-MID2 {
                 hardware ethernet BC:C3:42:08:E2:72;
                 fixed-address 172.31.24.50;
                 update-static-leases on;
         }
         host fmsagami {
                 hardware ethernet 00:19:b9:08:49:de;
                 fixed-address 172.31.24.53;
                 update-static-leases on;
         }
 
         # Panasonic Project
         host nhktoc {
                 hardware ethernet 00:0C:29:84:FD:1A;
                 fixed-address 172.31.24.86;
                 update-static-leases on;
         }
 
         # SYS2グループ新サーバー
         host sys2g-2020 {
                 hardware ethernet 6C:2B:59:BE:C8:BF;
                 fixed-address 172.31.24.88;
                 option host-name "sys2g-2020.carrot.co.jp";
                 update-static-leases on;
         }
 
         # Partner GW Host
         host cento {
                 hardware ethernet 00:01:80:6b:62:d0;
                 fixed-address 172.31.24.90;
                 update-static-leases on;
         }
         host cento2 {
                 hardware ethernet 00:0C:29:CC:3F:13;
                 fixed-address 172.31.24.91;
                 update-static-leases on;
         }
 
 #--- Sys1 Group Hosts ----
         host sys1server {
                 hardware ethernet d4:ae:52:b8:af:bf;
                 fixed-address 172.31.24.70;
                 update-static-leases on;
         }
 
 #--- HUB Hosts ---
         host newairport {
                 hardware ethernet 00:16:01:5B:76:63;
                 fixed-address 172.31.24.95;
                 update-static-leases on;
         }
 
         host airport {
                 hardware ethernet 88:57:EE:CC:0B:1C;
                 fixed-address 172.31.24.100;
                 update-static-leases on;
         }
 
 #--- Reserve ---
 #       host regalis {
 #               fixed-address 172.31.24.96;
 #       }
 #
 #       host cardreader {
 #               fixed-address 172.31.24.97;
 #       }
++ /etc/postfix/main.cf
 (以下差分)
 76a77
 > myhostname = echeclus.carrot.co.jp
 83a85
 > mydomain = carrot.co.jp
 99a102
 > myorigin = $mydomain
 116c119
 < inet_interfaces = localhost
 ---
 > inet_interfaces = localhost, 172.31.200.1
 266a270
 > mynetworks = 172.0.0.0/8, 172.31.200.0/24
 317a322
 > relayhost = 172.31.24.232
* データ移行 [#b4722d72]
 /home/backup0/
 /online/
 ※/online/bin/backup0.shはOS依存のため差し替え
* グループ移行 [#h512ba67]
 backup0:x:581:
* アカウント移行 [#yec16acc]
 backup0:x:581:581::/home/backup0:/bin/bash
 ※合わせてshadowも移植
* sudo設定 [#y5a81c34]
 (以下追加)
 backup0 ALL=(ALL) NOPASSWD:/online/bin/rsync.sh, /usr/bin/rsync
* cron [#j4001fb3]
 (root)
 00 1 * * 1 /online/bin/backup0.sh > /dev/null
 1 19 * * 5 /online/bin/check_mail_filter_weekly.sh > /dev/null
 14 19 * * 5 /online/bin/check_cybozu_filter_weekly.sh > /dev/null
 11 19 * * 5 /online/bin/check_sshauthfailed.sh > /dev/null
 00 6 * * 3 /online/bin/sync_dump_mariners.sh
 (backup0)
 MAILFROM="root@carrot.co.jp"

0 7 * * * /usr/bin/sudo /usr/bin/rsync -auvz --delete -e "ssh -t -i /home/backup0/.ssh/id_rsa" --rsync-path='sudo /usr/bin/rsync' backup0@172.31.200.11:/var/log/ /home/backup0/mariners/log/
 0 15 * * * /usr/bin/sudo /usr/bin/rsync -auvz --delete -e "ssh -t -i /home/backup0/.ssh/id_rsa" --rsync-path='sudo /usr/bin/rsync' backup0@172.31.200.12:/home/ /home/backup0/styx/home/
 0 16 * * * /usr/bin/sudo /usr/bin/rsync -auvz --delete -e "ssh -t -i /home/backup0/.ssh/id_rsa" --rsync-path='sudo /usr/bin/rsync' backup0@172.31.200.12:/var/log/ /home/backup0/styx/log/
* 課題 [#n6b4cf1c]
 iptables -> firewalldの移植をしたい。最悪iptablesを継続して使う

タイムスタンプを変更しない

#topicpath

* 社内-社外ネットワークゲートウェイ/DHCPサーバー [#o4356192]
 構成検討中

* パッケージ追加 [#jc29daf2]
 firewalld
 dhcp

テキスト整形のルールを表示する