サーバー設定/echeclus.carrot.co.jp
をテンプレートにして作成
[
トップ
] [
新規
|
一覧
|
検索
|
最終更新
|
ヘルプ
]
開始行:
#topicpath
* 社内-社外ネットワークゲートウェイ/DHCPサーバー [#o43561...
構成検討中
* パッケージ追加 [#jc29daf2]
firewalld
dhcp
* 詳細設定 [#o3a04b55]
++ /etcresolv.conf
# Generated by NetworkManager
search carrot.co.jp
nameserver 8.8.8.8
++ /etc/modules-load.d/br_netfilter.conf
br_netfilter
※以下実施
# systemctl restart systemd-modules-load.service
++ /etc/sysctl.conf
net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.accept_source_route = 2
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0
vm.swappiness=10
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 16384
net.core.rmem_max = 134217728
net.core.wmem_max = 134217728
++ /etc/sysconfig/network
FORWARD_IPV4="yes"
GATEWAY=210.196.71.253
++ /etc/sysconfig/network-scripts/ifcfg-ens192
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
DEFROUTE=no
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=ens192
UUID=0682dbe7-9e4d-4c88-a2b7-124891560655
DEVICE=ens192
ONBOOT=yes
IPADDR1=172.31.200.1
PREFIX1=24
NETWORK=172.31.24.0
PEERDNS=no
DNS1=8.8.8.8
IPV6ADDR=2001:db8::1/64
IPADDR=172.31.24.3
PREFIX2=24
++ /etc/sysconfig/network-scripts/ifcfg-ens224
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=ens224
UUID=69bd6dff-0e1c-4829-82ae-57561009c7c6
DEVICE=ens224
ONBOOT=yes
NETWORK=210.196.71.248
BROADCAST=210.196.71.255
IPADDR=210.196.71.249
PREFIX=29
GATEWAY=210.196.71.253
++ /etc/sysconfig/network-scripts/ifcfg-ens161
HWADDR=00:0C:29:4F:D0:E5
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
IPV6INIT=no
NAME=ens161
UUID=cdc15a30-6fcf-3c07-a91a-7beaf9f7d949
ONBOOT=yes
AUTOCONNECT_PRIORITY=-999
NETWORK=210.196.71.248
IPADDR=210.196.71.250
PREFIX=29
GATEWAY=210.196.71.253
++ /etc/sysconfig/network-scripts/ifcfg-ens193
HWADDR=00:0C:29:4F:D0:EF
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
IPV6INIT=no
NAME=ens193
UUID=2235ff8f-58dc-36eb-8a2e-0aa9b63bffdd
ONBOOT=yes
AUTOCONNECT_PRIORITY=-999
IPADDR=210.196.71.251
PREFIX=29
GATEWAY=210.196.71.253
++ /etc/sysconfig/network-scripts/ifcfg-ens256
HWADDR=00:0C:29:4F:D0:DB
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
IPV6INIT=no
NAME=ens256
UUID=bd8e0444-f884-3169-808e-e3add6c6d788
ONBOOT=yes
AUTOCONNECT_PRIORITY=-999
IPADDR=210.196.71.252
PREFIX=29
GATEWAY=210.196.71.253
++ /etc/ssh/sshd_config
(以下追記)
ListenAddress 172.31.24.3
ListenAddress 172.31.200.1
++ /etc/sysconfig/iptables
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [59:4971]
:default - [0:0]
:pass - [0:0]
#-A INPUT -p icmp --icmp-type any -j ACCEPT
-A INPUT -j default
-A FORWARD -j pass
-A FORWARD -j default
-A default -m state --state RELATED,ESTABLISHED -j ACCEPT
-A default ! -i ens224 -m state --state NEW -j ACCEPT
-A default ! -i ens161 -m state --state NEW -j ACCEPT
-A default ! -i ens193 -m state --state NEW -j ACCEPT
-A default ! -i ens256 -m state --state NEW -j ACCEPT
# -A pass -d 172.31.24.232 -s 0.0.0.0/0.0.0.0 -j ACCEPT
-A pass -d 172.31.200.12 -s 1.202.70.134/255.255.255.255...
--- 踏み台サーバーdropフィルタ部分中略 ---
-A pass -d 172.31.200.12 -s 223.255.183.10/255.255.255.2...
-A pass -d 172.31.24.232 -s 1.13.20.177/255.255.255.255 ...
--- メールサーバーdropフィルタ部分中略 ---
-A pass -d 172.31.24.232 -s 223.241.117.180/255.255.255....
-A default -j DROP
-A pass -d 172.31.24.5 -p tcp -m tcp --dport 53 -j ACCEPT
-A pass -d 172.31.24.5 -p udp -m udp --dport 53 -j ACCEPT
-A pass -d 172.31.24.5 -p tcp -m tcp --dport 80 -j ACCEPT
-A pass -d 172.31.24.5 -p tcp -m tcp --dport 443 -j ACCE...
# DNS
-A pass -d 172.31.24.231 -p tcp -m tcp --dport 53 -j ACC...
-A pass -d 172.31.24.231 -p udp -m udp --dport 53 -j ACC...
# TGI通知メールバイパス
-A pass -d 172.31.24.232 -s 52.199.63.0/255.255.255.0 -j...
-A pass -d 172.31.24.232 -s 52.198.247.0/255.255.255.0 -...
-A pass -d 172.31.24.232 -s 13.115.104.0/255.255.255.0 -...
-A pass -d 172.31.24.232 -s 18.179.48.0/255.255.255.0 -j...
-A pass -d 172.31.24.232 -s 3.112.23.0/255.255.255.0 -j ...
# www.tdanp.jishin.net通知メールバイパス
-A pass -d 172.31.24.232 -s 110.50.242.2/255.255.255.255...
# hsspv.jishin.netメールバイパス
-A pass -d 172.31.24.232 -s 113.35.159.189/255.255.255.2...
# mta0[34].obc.smtps.jp勤務system通知
-A pass -d 172.31.24.232 -s 163.43.197.11/255.255.255.25...
-A pass -d 172.31.24.232 -s 153.125.134.139/255.255.255....
-A pass -d 172.31.24.232 -p tcp -m multiport --dports 25...
-A pass -d 172.31.24.232 -p tcp -m tcp --dport 110 -j AC...
-A pass -d 172.31.24.232 -p tcp -m tcp --dport 995 -j AC...
-A pass -d 172.31.24.232 -p tcp -m tcp --dport 20001 -j ...
-A pass -d 172.31.24.241 -p tcp -m tcp --dport 443 -j AC...
-A pass -d 172.31.24.228 -p tcp -m tcp --dport 80 -j ACC...
-A pass -d 172.31.24.33 -p tcp -m tcp --dport 8888 -j AC...
-A pass -d 172.31.24.98 -p tcp -m tcp --dport 5555 -j AC...
-A pass -d 172.31.24.9 -p tcp -m tcp --dport 22 -j ACCEPT
-A pass -d 172.31.24.9 -p tcp -m tcp --dport 80 -j ACCEPT
-A pass -d 172.31.24.9 -p tcp -m tcp --dport 443 -j ACCE...
-A pass -d 172.31.24.9 -p tcp -m tcp --dport 3306 -j ACC...
-A pass -d 172.31.24.9 -p udp -m udp --dport 3306 -j ACC...
-A pass -d 172.31.24.9 -p tcp -m tcp --dport 8081 -j ACC...
-A pass -d 172.31.24.9 -p tcp -m tcp --dport 5991 -j ACC...
-A pass -d 172.31.24.9 -p tcp -m tcp --dport 5992 -j ACC...
#-A pass -d 172.31.24.128 -p tcp -m tcp --dport 80 -j AC...
-A pass -d 172.31.24.228 -p tcp -m tcp --dport 5432 -j A...
-A pass -d 172.31.24.235 -p tcp -m tcp --dport 80 -j ACC...
-A pass -d 172.31.24.235 -p tcp -m tcp --dport 443 -j AC...
#-A pass -d 172.31.24.237 -p tcp -m tcp --dport 80 -j AC...
#-A pass -d 172.31.24.237 -p tcp -m tcp --dport 443 -j A...
#-A pass -d 172.31.24.237 -p tcp -m tcp --dport 8443 -j ...
#-A pass -d 172.31.24.237 -p tcp -m tcp --dport 8444 -j ...
#-A pass -d 172.31.24.230 -p tcp -m tcp --dport 443 -j A...
#-A pass -d 172.31.24.230 -p udp -m udp --dport 500 -j A...
#-A pass -d 172.31.24.230 -p udp -m udp --dport 4500 -j ...
-A pass -d 172.31.24.35 -p tcp -m tcp --dport 81 -j ACCEPT
# KCS -> carrot
-A pass -s 172.31.4.0/22 -d 172.31.24.0/22 -j ACCEPT
-A pass -d 172.31.24.227 -p tcp -m tcp --dport 10400 -j ...
-A pass -d 172.31.24.227 -p udp -m udp --dport 10400 -j ...
-A pass -d 172.31.24.31 -p tcp -m tcp --dport 8443 -j AC...
-A pass -d 172.31.200.12 -p tcp -m tcp --dport 22 -j ACC...
-A pass -d 172.31.200.12 -p tcp -m tcp --dport 25 -j ACC...
# PhoMES Light
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 118...
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 118...
# Teiki Ekishi Vision (Staging)
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 13....
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 13....
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 54....
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 54....
# Teiki Ekishi Vision (Production)
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 13....
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 13....
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 54....
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 54....
# Uruwashiki Ehon
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 160...
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 160...
# UMIN Hosting
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 130...
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 130...
# europa
-A pass -d 172.31.24.231 -p tcp -m tcp --dport 80 -j ACC...
-A pass -d 172.31.24.231 -p tcp -m tcp --dport 443 -j AC...
# proteus
-A pass -d 172.31.24.82 -p tcp -m tcp --dport 80 -j ACCEPT
-A pass -d 172.31.24.82 -p tcp -m tcp --dport 443 -j ACC...
# fmsagami
-A pass -d 172.31.24.53 -p tcp -m tcp --dport 10080 -j A...
# Uruwashiki Android Test Server
-A pass -d 172.31.24.121 -p tcp -m tcp --dport 8443 -j A...
# cavpn.carrot.co.jp
-A pass -d 172.31.24.251 -p tcp -m tcp --dport 5555 -j A...
-A pass -d 172.31.24.251 -p udp -m udp --dport 500 -j AC...
-A pass -d 172.31.24.251 -p udp -m udp --dport 4500 -j A...
# saigaist.carrot.co.jp
-A pass -d 172.31.24.243 -p tcp -m tcp --dport 80 -j ACC...
-A pass -d 172.31.24.243 -p tcp -m tcp --dport 443 -j AC...
-A pass -d 172.31.24.244 -p tcp -m tcp --dport 80 -j ACC...
-A pass -d 172.31.24.244 -p tcp -m tcp --dport 443 -j AC...
COMMIT
# Completed on Wed Oct 25 15:36:26 2006
# Generated by iptables-save v1.2.11 on Wed Oct 25 15:36...
*nat
:PREROUTING ACCEPT [21:1563]
:POSTROUTING ACCEPT [2:187]
:OUTPUT ACCEPT [2:187]
# phobos
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 88...
# mozart
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 55...
-A PREROUTING -d 210.196.71.251 -p udp -m udp --dport 50...
-A PREROUTING -d 210.196.71.251 -p udp -m udp --dport 45...
# europa (210.196.71.251 -> 172.31.24.231)
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 53...
-A PREROUTING -d 210.196.71.250 -p udp -m udp --dport 53...
-A PREROUTING -d 210.196.71.249 -p tcp -m tcp --dport 53...
-A PREROUTING -d 210.196.71.249 -p udp -m udp --dport 53...
# NB
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 84...
# fmsagami
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 10...
# NBMAC
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 30...
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 11...
# MTA WAN -> LAN
# -A PREROUTING -d 172.31.200.100 -p tcp -m tcp --dport ...
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 25...
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 58...
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 46...
# MTA LAN -> WAN
-A POSTROUTING -s 172.31.24.12 -p tcp -m tcp --dport 25 ...
# POP
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 11...
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 99...
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 99...
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 20...
# netmster-wiki
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 44...
# letsencrypt acme
-A PREROUTING -d 210.196.71.249 -p tcp -m tcp --dport 80...
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 80...
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 80...
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 80...
# www.carrot.co.jp
-A PREROUTING -d 210.196.71.249 -p tcp -m tcp --dport 44...
# cybozu
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 44...
# Uruwashiki Android Test Server (210.196.71.252 -> 172....
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 84...
# Rekochoku (210.196.71.252 -> 172.31.24.228)
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 54...
# cavpn.carrot.co.jp (210.196.71.252 -> 172.31.24.251) S...
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 15...
-A PREROUTING -d 210.196.71.252 -p udp -m udp --dport 50...
-A PREROUTING -d 210.196.71.252 -p udp -m udp --dport 45...
# promoter web & ssd (revers proxy) (210.196.71.252 -> 1...
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 44...
# zeno MSSQLServer (210.196.71.252 -> 172.31.24.227)
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 10...
-A PREROUTING -d 210.196.71.252 -p udp -m udp --dport 10...
# styx remote server (210.196.71.252 -> 172.31.200.12) I...
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 10...
# LAN -> WAN (Gateway(rickdom): 210.196.71.249)
-A POSTROUTING -s 172.31.24.232 -j SNAT --to-source 210....
-A POSTROUTING -o ens224 -j SNAT --to-source 210.196.71....
-A POSTROUTING -o ens161 -j SNAT --to-source 210.196.71....
-A POSTROUTING -o ens193 -j SNAT --to-source 210.196.71....
-A POSTROUTING -o ens256 -j SNAT --to-source 210.196.71....
COMMIT
++ /etc/dhcp/dhcpd.conf
authoritative;
option domain-name "carrot.co.jp";
option domain-name-servers 172.31.24.30, 172.31.24....
ddns-updates on;
ddns-update-style interim;
ignore client-updates;
update-static-leases on;
include "/etc/ddns.key";
zone carrot.co.jp. {
primary 172.31.24.30;
key DDNS;
}
zone 24.31.172.in-addr.arpa. {
primary 172.31.24.30;
key DDNS;
}
subnet 172.31.24.0 netmask 255.255.255.0 {
# --- default gateway
option routers 172.31.24.3;
option subnet-mask 255.255.255.0;
option nis-domain "carrotnet";
option time-offset -18000; # Easter...
option ntp-servers 172.31.24.231;
option domain-search "carrot.co.jp";
# option netbios-name-servers 172.31.24.48;
# --- Selects point-to-point node (default is hybrid). D...
# -- you understand Netbios very well
# option netbios-node-type 2;
range dynamic-bootp 172.31.24.111 172.31.24.199;
default-lease-time 216;
max-lease-time 43200;
}
# we want the nameserver to appear at a fixed ad...
#--- Carrotnet Hosts ----
host bach {
hardware ethernet 70:20:84:01:A4:DC;
fixed-address 172.31.24.33;
update-static-leases on;
}
host DocuPrint {
hardware ethernet 1C:7D:22:36:D6:6A;
fixed-address 172.31.24.34;
update-static-leases on;
}
host intranet-server {
hardware ethernet b8:ac:6f:81:47:a5;
fixed-address 172.31.24.36;
update-static-leases on;
}
host mozart {
hardware ethernet F8:B1:56:D3:E5:9B;
fixed-address 172.31.24.98;
update-static-leases on;
}
#
# [重要] 172.31.24.37/172.31.24.28 は電話の交換機で固定...
# 割り当て不可
#
#--- Groupware Hosts ---
host odessa {
hardware ethernet 00:07:40:98:D1:39;
fixed-address 172.31.24.20;
update-static-leases on;
}
host pluto {
hardware ethernet 00:01:80:6C:0B:EB;
fixed-address 172.31.24.30;
update-static-leases on;
}
#--- NB Host ---
host NB {
hardware ethernet D4:BE:D9:CA:6A:DE;
fixed-address 172.31.24.31;
update-static-leases on;
}
#--- Common Host ----
host jaguar {
hardware ethernet 00:0C:29:4F:C4:19;
fixed-address 172.31.24.40;
update-static-leases on;
}
host jaguar2 {
hardware ethernet 00:07:40:24:9E:E1;
fixed-address 172.31.24.41;
update-static-leases on;
}
#--- Project Hosts
# Sony EdgeStore Project
host cardl2 {
hardware ethernet 00:01:80:6B:5B:A8;
fixed-address 172.31.24.48;
update-static-leases on;
}
host COM-MID1 {
hardware ethernet 08:00:23:91:98:A7;
fixed-address 172.31.24.49;
update-static-leases on;
}
host COM-MID2 {
hardware ethernet BC:C3:42:08:E2:72;
fixed-address 172.31.24.50;
update-static-leases on;
}
host fmsagami {
hardware ethernet 00:19:b9:08:49:de;
fixed-address 172.31.24.53;
update-static-leases on;
}
# Panasonic Project
host nhktoc {
hardware ethernet 00:0C:29:84:FD:1A;
fixed-address 172.31.24.86;
update-static-leases on;
}
# SYS2グループ新サーバー
host sys2g-2020 {
hardware ethernet 6C:2B:59:BE:C8:BF;
fixed-address 172.31.24.88;
option host-name "sys2g-2020.carrot.co.j...
update-static-leases on;
}
# Partner GW Host
host cento {
hardware ethernet 00:01:80:6b:62:d0;
fixed-address 172.31.24.90;
update-static-leases on;
}
host cento2 {
hardware ethernet 00:0C:29:CC:3F:13;
fixed-address 172.31.24.91;
update-static-leases on;
}
#--- Sys1 Group Hosts ----
host sys1server {
hardware ethernet d4:ae:52:b8:af:bf;
fixed-address 172.31.24.70;
update-static-leases on;
}
#--- HUB Hosts ---
host newairport {
hardware ethernet 00:16:01:5B:76:63;
fixed-address 172.31.24.95;
update-static-leases on;
}
host airport {
hardware ethernet 88:57:EE:CC:0B:1C;
fixed-address 172.31.24.100;
update-static-leases on;
}
#--- Reserve ---
# host regalis {
# fixed-address 172.31.24.96;
# }
#
# host cardreader {
# fixed-address 172.31.24.97;
# }
++ /etc/postfix/main.cf
(以下差分)
76a77
> myhostname = echeclus.carrot.co.jp
83a85
> mydomain = carrot.co.jp
99a102
> myorigin = $mydomain
116c119
< inet_interfaces = localhost
---
> inet_interfaces = localhost, 172.31.200.1
266a270
> mynetworks = 172.0.0.0/8, 172.31.200.0/24
317a322
> relayhost = 172.31.24.232
* データ移行 [#b4722d72]
/home/backup0/
/online/
※/online/bin/backup0.shはOS依存のため差し替え
* グループ移行 [#h512ba67]
backup0:x:581:
* アカウント移行 [#yec16acc]
backup0:x:581:581::/home/backup0:/bin/bash
※合わせてshadowも移植
* sudo設定 [#y5a81c34]
(以下追加)
backup0 ALL=(ALL) NOPASSWD:/online/bin/rsync.sh, /usr/bi...
* cron [#j4001fb3]
(root)
00 1 * * 1 /online/bin/backup0.sh > /dev/null
1 19 * * 5 /online/bin/check_mail_filter_weekly.sh > /de...
14 19 * * 5 /online/bin/check_cybozu_filter_weekly.sh > ...
11 19 * * 5 /online/bin/check_sshauthfailed.sh > /dev/null
00 6 * * 3 /online/bin/sync_dump_mariners.sh
(backup0)
MAILFROM="root@carrot.co.jp"
0 7 * * * /usr/bin/sudo /usr/bin/rsync -auvz --delete -e...
0 15 * * * /usr/bin/sudo /usr/bin/rsync -auvz --delete -...
0 16 * * * /usr/bin/sudo /usr/bin/rsync -auvz --delete -...
* 課題 [#n6b4cf1c]
iptables -> firewalldの移植をしたい。最悪iptablesを継続...
終了行:
#topicpath
* 社内-社外ネットワークゲートウェイ/DHCPサーバー [#o43561...
構成検討中
* パッケージ追加 [#jc29daf2]
firewalld
dhcp
* 詳細設定 [#o3a04b55]
++ /etcresolv.conf
# Generated by NetworkManager
search carrot.co.jp
nameserver 8.8.8.8
++ /etc/modules-load.d/br_netfilter.conf
br_netfilter
※以下実施
# systemctl restart systemd-modules-load.service
++ /etc/sysctl.conf
net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.accept_source_route = 2
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0
vm.swappiness=10
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 16384
net.core.rmem_max = 134217728
net.core.wmem_max = 134217728
++ /etc/sysconfig/network
FORWARD_IPV4="yes"
GATEWAY=210.196.71.253
++ /etc/sysconfig/network-scripts/ifcfg-ens192
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
DEFROUTE=no
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=ens192
UUID=0682dbe7-9e4d-4c88-a2b7-124891560655
DEVICE=ens192
ONBOOT=yes
IPADDR1=172.31.200.1
PREFIX1=24
NETWORK=172.31.24.0
PEERDNS=no
DNS1=8.8.8.8
IPV6ADDR=2001:db8::1/64
IPADDR=172.31.24.3
PREFIX2=24
++ /etc/sysconfig/network-scripts/ifcfg-ens224
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=ens224
UUID=69bd6dff-0e1c-4829-82ae-57561009c7c6
DEVICE=ens224
ONBOOT=yes
NETWORK=210.196.71.248
BROADCAST=210.196.71.255
IPADDR=210.196.71.249
PREFIX=29
GATEWAY=210.196.71.253
++ /etc/sysconfig/network-scripts/ifcfg-ens161
HWADDR=00:0C:29:4F:D0:E5
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
IPV6INIT=no
NAME=ens161
UUID=cdc15a30-6fcf-3c07-a91a-7beaf9f7d949
ONBOOT=yes
AUTOCONNECT_PRIORITY=-999
NETWORK=210.196.71.248
IPADDR=210.196.71.250
PREFIX=29
GATEWAY=210.196.71.253
++ /etc/sysconfig/network-scripts/ifcfg-ens193
HWADDR=00:0C:29:4F:D0:EF
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
IPV6INIT=no
NAME=ens193
UUID=2235ff8f-58dc-36eb-8a2e-0aa9b63bffdd
ONBOOT=yes
AUTOCONNECT_PRIORITY=-999
IPADDR=210.196.71.251
PREFIX=29
GATEWAY=210.196.71.253
++ /etc/sysconfig/network-scripts/ifcfg-ens256
HWADDR=00:0C:29:4F:D0:DB
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
IPV6INIT=no
NAME=ens256
UUID=bd8e0444-f884-3169-808e-e3add6c6d788
ONBOOT=yes
AUTOCONNECT_PRIORITY=-999
IPADDR=210.196.71.252
PREFIX=29
GATEWAY=210.196.71.253
++ /etc/ssh/sshd_config
(以下追記)
ListenAddress 172.31.24.3
ListenAddress 172.31.200.1
++ /etc/sysconfig/iptables
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [59:4971]
:default - [0:0]
:pass - [0:0]
#-A INPUT -p icmp --icmp-type any -j ACCEPT
-A INPUT -j default
-A FORWARD -j pass
-A FORWARD -j default
-A default -m state --state RELATED,ESTABLISHED -j ACCEPT
-A default ! -i ens224 -m state --state NEW -j ACCEPT
-A default ! -i ens161 -m state --state NEW -j ACCEPT
-A default ! -i ens193 -m state --state NEW -j ACCEPT
-A default ! -i ens256 -m state --state NEW -j ACCEPT
# -A pass -d 172.31.24.232 -s 0.0.0.0/0.0.0.0 -j ACCEPT
-A pass -d 172.31.200.12 -s 1.202.70.134/255.255.255.255...
--- 踏み台サーバーdropフィルタ部分中略 ---
-A pass -d 172.31.200.12 -s 223.255.183.10/255.255.255.2...
-A pass -d 172.31.24.232 -s 1.13.20.177/255.255.255.255 ...
--- メールサーバーdropフィルタ部分中略 ---
-A pass -d 172.31.24.232 -s 223.241.117.180/255.255.255....
-A default -j DROP
-A pass -d 172.31.24.5 -p tcp -m tcp --dport 53 -j ACCEPT
-A pass -d 172.31.24.5 -p udp -m udp --dport 53 -j ACCEPT
-A pass -d 172.31.24.5 -p tcp -m tcp --dport 80 -j ACCEPT
-A pass -d 172.31.24.5 -p tcp -m tcp --dport 443 -j ACCE...
# DNS
-A pass -d 172.31.24.231 -p tcp -m tcp --dport 53 -j ACC...
-A pass -d 172.31.24.231 -p udp -m udp --dport 53 -j ACC...
# TGI通知メールバイパス
-A pass -d 172.31.24.232 -s 52.199.63.0/255.255.255.0 -j...
-A pass -d 172.31.24.232 -s 52.198.247.0/255.255.255.0 -...
-A pass -d 172.31.24.232 -s 13.115.104.0/255.255.255.0 -...
-A pass -d 172.31.24.232 -s 18.179.48.0/255.255.255.0 -j...
-A pass -d 172.31.24.232 -s 3.112.23.0/255.255.255.0 -j ...
# www.tdanp.jishin.net通知メールバイパス
-A pass -d 172.31.24.232 -s 110.50.242.2/255.255.255.255...
# hsspv.jishin.netメールバイパス
-A pass -d 172.31.24.232 -s 113.35.159.189/255.255.255.2...
# mta0[34].obc.smtps.jp勤務system通知
-A pass -d 172.31.24.232 -s 163.43.197.11/255.255.255.25...
-A pass -d 172.31.24.232 -s 153.125.134.139/255.255.255....
-A pass -d 172.31.24.232 -p tcp -m multiport --dports 25...
-A pass -d 172.31.24.232 -p tcp -m tcp --dport 110 -j AC...
-A pass -d 172.31.24.232 -p tcp -m tcp --dport 995 -j AC...
-A pass -d 172.31.24.232 -p tcp -m tcp --dport 20001 -j ...
-A pass -d 172.31.24.241 -p tcp -m tcp --dport 443 -j AC...
-A pass -d 172.31.24.228 -p tcp -m tcp --dport 80 -j ACC...
-A pass -d 172.31.24.33 -p tcp -m tcp --dport 8888 -j AC...
-A pass -d 172.31.24.98 -p tcp -m tcp --dport 5555 -j AC...
-A pass -d 172.31.24.9 -p tcp -m tcp --dport 22 -j ACCEPT
-A pass -d 172.31.24.9 -p tcp -m tcp --dport 80 -j ACCEPT
-A pass -d 172.31.24.9 -p tcp -m tcp --dport 443 -j ACCE...
-A pass -d 172.31.24.9 -p tcp -m tcp --dport 3306 -j ACC...
-A pass -d 172.31.24.9 -p udp -m udp --dport 3306 -j ACC...
-A pass -d 172.31.24.9 -p tcp -m tcp --dport 8081 -j ACC...
-A pass -d 172.31.24.9 -p tcp -m tcp --dport 5991 -j ACC...
-A pass -d 172.31.24.9 -p tcp -m tcp --dport 5992 -j ACC...
#-A pass -d 172.31.24.128 -p tcp -m tcp --dport 80 -j AC...
-A pass -d 172.31.24.228 -p tcp -m tcp --dport 5432 -j A...
-A pass -d 172.31.24.235 -p tcp -m tcp --dport 80 -j ACC...
-A pass -d 172.31.24.235 -p tcp -m tcp --dport 443 -j AC...
#-A pass -d 172.31.24.237 -p tcp -m tcp --dport 80 -j AC...
#-A pass -d 172.31.24.237 -p tcp -m tcp --dport 443 -j A...
#-A pass -d 172.31.24.237 -p tcp -m tcp --dport 8443 -j ...
#-A pass -d 172.31.24.237 -p tcp -m tcp --dport 8444 -j ...
#-A pass -d 172.31.24.230 -p tcp -m tcp --dport 443 -j A...
#-A pass -d 172.31.24.230 -p udp -m udp --dport 500 -j A...
#-A pass -d 172.31.24.230 -p udp -m udp --dport 4500 -j ...
-A pass -d 172.31.24.35 -p tcp -m tcp --dport 81 -j ACCEPT
# KCS -> carrot
-A pass -s 172.31.4.0/22 -d 172.31.24.0/22 -j ACCEPT
-A pass -d 172.31.24.227 -p tcp -m tcp --dport 10400 -j ...
-A pass -d 172.31.24.227 -p udp -m udp --dport 10400 -j ...
-A pass -d 172.31.24.31 -p tcp -m tcp --dport 8443 -j AC...
-A pass -d 172.31.200.12 -p tcp -m tcp --dport 22 -j ACC...
-A pass -d 172.31.200.12 -p tcp -m tcp --dport 25 -j ACC...
# PhoMES Light
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 118...
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 118...
# Teiki Ekishi Vision (Staging)
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 13....
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 13....
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 54....
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 54....
# Teiki Ekishi Vision (Production)
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 13....
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 13....
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 54....
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 54....
# Uruwashiki Ehon
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 160...
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 160...
# UMIN Hosting
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 22 -s 130...
-A pass -d 172.31.24.238 -p tcp -m tcp --dport 80 -s 130...
# europa
-A pass -d 172.31.24.231 -p tcp -m tcp --dport 80 -j ACC...
-A pass -d 172.31.24.231 -p tcp -m tcp --dport 443 -j AC...
# proteus
-A pass -d 172.31.24.82 -p tcp -m tcp --dport 80 -j ACCEPT
-A pass -d 172.31.24.82 -p tcp -m tcp --dport 443 -j ACC...
# fmsagami
-A pass -d 172.31.24.53 -p tcp -m tcp --dport 10080 -j A...
# Uruwashiki Android Test Server
-A pass -d 172.31.24.121 -p tcp -m tcp --dport 8443 -j A...
# cavpn.carrot.co.jp
-A pass -d 172.31.24.251 -p tcp -m tcp --dport 5555 -j A...
-A pass -d 172.31.24.251 -p udp -m udp --dport 500 -j AC...
-A pass -d 172.31.24.251 -p udp -m udp --dport 4500 -j A...
# saigaist.carrot.co.jp
-A pass -d 172.31.24.243 -p tcp -m tcp --dport 80 -j ACC...
-A pass -d 172.31.24.243 -p tcp -m tcp --dport 443 -j AC...
-A pass -d 172.31.24.244 -p tcp -m tcp --dport 80 -j ACC...
-A pass -d 172.31.24.244 -p tcp -m tcp --dport 443 -j AC...
COMMIT
# Completed on Wed Oct 25 15:36:26 2006
# Generated by iptables-save v1.2.11 on Wed Oct 25 15:36...
*nat
:PREROUTING ACCEPT [21:1563]
:POSTROUTING ACCEPT [2:187]
:OUTPUT ACCEPT [2:187]
# phobos
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 88...
# mozart
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 55...
-A PREROUTING -d 210.196.71.251 -p udp -m udp --dport 50...
-A PREROUTING -d 210.196.71.251 -p udp -m udp --dport 45...
# europa (210.196.71.251 -> 172.31.24.231)
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 53...
-A PREROUTING -d 210.196.71.250 -p udp -m udp --dport 53...
-A PREROUTING -d 210.196.71.249 -p tcp -m tcp --dport 53...
-A PREROUTING -d 210.196.71.249 -p udp -m udp --dport 53...
# NB
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 84...
# fmsagami
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 10...
# NBMAC
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 30...
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 11...
# MTA WAN -> LAN
# -A PREROUTING -d 172.31.200.100 -p tcp -m tcp --dport ...
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 25...
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 58...
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 46...
# MTA LAN -> WAN
-A POSTROUTING -s 172.31.24.12 -p tcp -m tcp --dport 25 ...
# POP
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 11...
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 99...
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 99...
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 20...
# netmster-wiki
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 44...
# letsencrypt acme
-A PREROUTING -d 210.196.71.249 -p tcp -m tcp --dport 80...
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 80...
-A PREROUTING -d 210.196.71.251 -p tcp -m tcp --dport 80...
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 80...
# www.carrot.co.jp
-A PREROUTING -d 210.196.71.249 -p tcp -m tcp --dport 44...
# cybozu
-A PREROUTING -d 210.196.71.250 -p tcp -m tcp --dport 44...
# Uruwashiki Android Test Server (210.196.71.252 -> 172....
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 84...
# Rekochoku (210.196.71.252 -> 172.31.24.228)
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 54...
# cavpn.carrot.co.jp (210.196.71.252 -> 172.31.24.251) S...
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 15...
-A PREROUTING -d 210.196.71.252 -p udp -m udp --dport 50...
-A PREROUTING -d 210.196.71.252 -p udp -m udp --dport 45...
# promoter web & ssd (revers proxy) (210.196.71.252 -> 1...
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 44...
# zeno MSSQLServer (210.196.71.252 -> 172.31.24.227)
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 10...
-A PREROUTING -d 210.196.71.252 -p udp -m udp --dport 10...
# styx remote server (210.196.71.252 -> 172.31.200.12) I...
-A PREROUTING -d 210.196.71.252 -p tcp -m tcp --dport 10...
# LAN -> WAN (Gateway(rickdom): 210.196.71.249)
-A POSTROUTING -s 172.31.24.232 -j SNAT --to-source 210....
-A POSTROUTING -o ens224 -j SNAT --to-source 210.196.71....
-A POSTROUTING -o ens161 -j SNAT --to-source 210.196.71....
-A POSTROUTING -o ens193 -j SNAT --to-source 210.196.71....
-A POSTROUTING -o ens256 -j SNAT --to-source 210.196.71....
COMMIT
++ /etc/dhcp/dhcpd.conf
authoritative;
option domain-name "carrot.co.jp";
option domain-name-servers 172.31.24.30, 172.31.24....
ddns-updates on;
ddns-update-style interim;
ignore client-updates;
update-static-leases on;
include "/etc/ddns.key";
zone carrot.co.jp. {
primary 172.31.24.30;
key DDNS;
}
zone 24.31.172.in-addr.arpa. {
primary 172.31.24.30;
key DDNS;
}
subnet 172.31.24.0 netmask 255.255.255.0 {
# --- default gateway
option routers 172.31.24.3;
option subnet-mask 255.255.255.0;
option nis-domain "carrotnet";
option time-offset -18000; # Easter...
option ntp-servers 172.31.24.231;
option domain-search "carrot.co.jp";
# option netbios-name-servers 172.31.24.48;
# --- Selects point-to-point node (default is hybrid). D...
# -- you understand Netbios very well
# option netbios-node-type 2;
range dynamic-bootp 172.31.24.111 172.31.24.199;
default-lease-time 216;
max-lease-time 43200;
}
# we want the nameserver to appear at a fixed ad...
#--- Carrotnet Hosts ----
host bach {
hardware ethernet 70:20:84:01:A4:DC;
fixed-address 172.31.24.33;
update-static-leases on;
}
host DocuPrint {
hardware ethernet 1C:7D:22:36:D6:6A;
fixed-address 172.31.24.34;
update-static-leases on;
}
host intranet-server {
hardware ethernet b8:ac:6f:81:47:a5;
fixed-address 172.31.24.36;
update-static-leases on;
}
host mozart {
hardware ethernet F8:B1:56:D3:E5:9B;
fixed-address 172.31.24.98;
update-static-leases on;
}
#
# [重要] 172.31.24.37/172.31.24.28 は電話の交換機で固定...
# 割り当て不可
#
#--- Groupware Hosts ---
host odessa {
hardware ethernet 00:07:40:98:D1:39;
fixed-address 172.31.24.20;
update-static-leases on;
}
host pluto {
hardware ethernet 00:01:80:6C:0B:EB;
fixed-address 172.31.24.30;
update-static-leases on;
}
#--- NB Host ---
host NB {
hardware ethernet D4:BE:D9:CA:6A:DE;
fixed-address 172.31.24.31;
update-static-leases on;
}
#--- Common Host ----
host jaguar {
hardware ethernet 00:0C:29:4F:C4:19;
fixed-address 172.31.24.40;
update-static-leases on;
}
host jaguar2 {
hardware ethernet 00:07:40:24:9E:E1;
fixed-address 172.31.24.41;
update-static-leases on;
}
#--- Project Hosts
# Sony EdgeStore Project
host cardl2 {
hardware ethernet 00:01:80:6B:5B:A8;
fixed-address 172.31.24.48;
update-static-leases on;
}
host COM-MID1 {
hardware ethernet 08:00:23:91:98:A7;
fixed-address 172.31.24.49;
update-static-leases on;
}
host COM-MID2 {
hardware ethernet BC:C3:42:08:E2:72;
fixed-address 172.31.24.50;
update-static-leases on;
}
host fmsagami {
hardware ethernet 00:19:b9:08:49:de;
fixed-address 172.31.24.53;
update-static-leases on;
}
# Panasonic Project
host nhktoc {
hardware ethernet 00:0C:29:84:FD:1A;
fixed-address 172.31.24.86;
update-static-leases on;
}
# SYS2グループ新サーバー
host sys2g-2020 {
hardware ethernet 6C:2B:59:BE:C8:BF;
fixed-address 172.31.24.88;
option host-name "sys2g-2020.carrot.co.j...
update-static-leases on;
}
# Partner GW Host
host cento {
hardware ethernet 00:01:80:6b:62:d0;
fixed-address 172.31.24.90;
update-static-leases on;
}
host cento2 {
hardware ethernet 00:0C:29:CC:3F:13;
fixed-address 172.31.24.91;
update-static-leases on;
}
#--- Sys1 Group Hosts ----
host sys1server {
hardware ethernet d4:ae:52:b8:af:bf;
fixed-address 172.31.24.70;
update-static-leases on;
}
#--- HUB Hosts ---
host newairport {
hardware ethernet 00:16:01:5B:76:63;
fixed-address 172.31.24.95;
update-static-leases on;
}
host airport {
hardware ethernet 88:57:EE:CC:0B:1C;
fixed-address 172.31.24.100;
update-static-leases on;
}
#--- Reserve ---
# host regalis {
# fixed-address 172.31.24.96;
# }
#
# host cardreader {
# fixed-address 172.31.24.97;
# }
++ /etc/postfix/main.cf
(以下差分)
76a77
> myhostname = echeclus.carrot.co.jp
83a85
> mydomain = carrot.co.jp
99a102
> myorigin = $mydomain
116c119
< inet_interfaces = localhost
---
> inet_interfaces = localhost, 172.31.200.1
266a270
> mynetworks = 172.0.0.0/8, 172.31.200.0/24
317a322
> relayhost = 172.31.24.232
* データ移行 [#b4722d72]
/home/backup0/
/online/
※/online/bin/backup0.shはOS依存のため差し替え
* グループ移行 [#h512ba67]
backup0:x:581:
* アカウント移行 [#yec16acc]
backup0:x:581:581::/home/backup0:/bin/bash
※合わせてshadowも移植
* sudo設定 [#y5a81c34]
(以下追加)
backup0 ALL=(ALL) NOPASSWD:/online/bin/rsync.sh, /usr/bi...
* cron [#j4001fb3]
(root)
00 1 * * 1 /online/bin/backup0.sh > /dev/null
1 19 * * 5 /online/bin/check_mail_filter_weekly.sh > /de...
14 19 * * 5 /online/bin/check_cybozu_filter_weekly.sh > ...
11 19 * * 5 /online/bin/check_sshauthfailed.sh > /dev/null
00 6 * * 3 /online/bin/sync_dump_mariners.sh
(backup0)
MAILFROM="root@carrot.co.jp"
0 7 * * * /usr/bin/sudo /usr/bin/rsync -auvz --delete -e...
0 15 * * * /usr/bin/sudo /usr/bin/rsync -auvz --delete -...
0 16 * * * /usr/bin/sudo /usr/bin/rsync -auvz --delete -...
* 課題 [#n6b4cf1c]
iptables -> firewalldの移植をしたい。最悪iptablesを継続...
ページ名:
![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
