krhacken
/
docu-vps
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
docu-vps/README.md

608 lines
20 KiB
Markdown
Raw Permalink Blame History

# Documentation du VPS Krhacken
*Première ébauche, restructuration nécessaire*
## Système d'exploitation
Sélectionner une template depuis le panneau de contrôle Proxgroup (Additional tools/Reinstall).
Distribution Actuelle : Ubuntu 20.04 LTS
## Choix techniques
Les différents services sont compartimentés dans des conteneurs LXC ou Docker.
## Liste des conteneurs
| Nom d'hôte | Service |
| :--------- | :--------- |
| bilmak | haproxy |
| syze | nextcloud |
| lozova | gitea |
| syhnal | matrix |
| butivka | bitwarden |
| hlodosy | keyserver |
| lutsenki | webserver |
| ternove | ctfd |
## Amélioration motd
```
rm /etc/update-motd.d/50-motd-news # Pour Ubuntu
echo -n "
echo \"
██ ▄█▀ ██▀███ ██░ ██ ▄▄▄ ▄████▄ ██ ▄█▀▓█████ ███▄ █
██▄█▒ ▓██ ▒ ██▒▓██░ ██▒▒████▄ ▒██▀ ▀█ ██▄█▒ ▓█ ▀ ██ ▀█ █
▓███▄░ ▓██ ░▄█ ▒▒██▀▀██░▒██ ▀█▄ ▒▓█ ▄ ▓███▄░ ▒███ ▓██ ▀█ ██▒
▓██ █▄ ▒██▀▀█▄ ░▓█ ░██ ░██▄▄▄▄██ ▒▓▓▄ ▄██▒▓██ █▄ ▒▓█ ▄ ▓██▒ ▐▌██▒
▒██▒ █▄░██▓ ▒██▒░▓█▒░██▓ ▓█ ▓██▒▒ ▓███▀ ░▒██▒ █▄░▒████▒▒██░ ▓██░
▒ ▒▒ ▓▒░ ▒▓ ░▒▓░ ▒ ░░▒░▒ ▒▒ ▓▒█░░ ░▒ ▒ ░▒ ▒▒ ▓▒░░ ▒░ ░░ ▒░ ▒ ▒
░ ░▒ ▒░ ░▒ ░ ▒░ ▒ ░▒░ ░ ▒ ▒▒ ░ ░ ▒ ░ ░▒ ▒░ ░ ░ ░░ ░░ ░ ▒░
░ ░░ ░ ░░ ░ ░ ░░ ░ ░ ▒ ░ ░ ░░ ░ ░ ░ ░ ░
░ ░ ░ ░ ░ ░ ░ ░░ ░ ░ ░ ░ ░ ░
░
\"
" >> /etc/update-motd.d/00-header
```
## Installation des paquets
```
apt install ferm fail2ban vim lxd git
```
## Sécurisation SSH
Copier les clefs publiques des sysadmin dans le fichier `~/.ssh/authorized_keys`.
Puis interdire l'authentification par mot de passe (pas de risque puisque qu'il y a un accès NoVNC):
```bash
echo "PasswordAuthentification no" >> /etc/ssh/sshd_config
systemctl restart ssh
```
## Configuration ZSH (optionnel)
```
apt install zsh zsh-common zsh-syntax-highlighting zsh-doc zsh-autosuggestions
# Garder les variables d'environnement
echo "emulate sh -c 'source /etc/profile'" >> /etc/zsh/zprofile
sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" # oui cette commande pique les yeux ^^
```
On choisit un beau de thème de shell (steeef par exemple !):
```
vim ~/.zshrc
```
```
ZSH_THEME="steeef"
```
Et on ajoute quelques plugins sympathiques :
```
plugins=(
git
python
pip
ssh-agent
debian
ansible
themes
)
```
## IP forward
Dé-commenter la ligne suivante dans le fichier `/etc/sysctl.conf` :
```
net.ipv4.ip_forward=1
```
Appliquer les changements :
```
sysctl -p /etc/sysctl.conf
```
## Configuration pare-feu Ferm
```
@def $DEV_PRIVATE = br0;
@def $DEV_WORLD = ens18;
@def $NET_PRIVATE = 10.0.0.0/24;
table filter {
chain INPUT {
policy DROP;
# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
# allow local connections
interface lo ACCEPT;
# respond to ping
proto icmp icmp-type echo-request ACCEPT;
# for IPsec
interface $DEV_WORLD {
proto udp dport 500 ACCEPT;
proto (esp ah) ACCEPT;
}
# allow SSH connections
proto tcp dport ssh ACCEPT;
# for LXD
proto (udp tcp) dport domain ACCEPT;
proto udp dport bootps ACCEPT;
# WEB
proto tcp dport http ACCEPT;
proto tcp dport https ACCEPT;
}
chain OUTPUT {
policy ACCEPT;
# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
}
chain FORWARD {
policy DROP;
# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
# connections from the internal net to the internet or to other
# internal nets are allowed
interface $DEV_PRIVATE ACCEPT;
}
}
table nat {
chain POSTROUTING {
# masquerade private IP addresses
saddr $NET_PRIVATE outerface $DEV_WORLD MASQUERADE;
}
}
```
## Configuration LXD
### Initialisation
```bash
lxd init
```
```
Would you like to use LXD clustering? (yes/no) [default=no]: no
Do you want to configure a new storage pool? (yes/no) [default=yes]: yes
Name of the new storage pool [default=default]: lxd-pool
Name of the storage backend to use (zfs, ceph, btrfs, dir, lvm) [default=btrfs]: btrfs
Create a new LVM pool? (yes/no) [default=yes]: yes
Would you like to use an existing empty disk or partition? (yes/no) [default=no]: yes
Path to the existing block device: /dev/sda3
Would you like to connect to a MAAS server? (yes/no) [default=no]: no
Would you like to create a new local network bridge? (yes/no) [default=yes]: yes
What should the new bridge be called? [default=lxdbr0]: br0
What IPv4 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]: 10.0.0.1/24
Would you like LXD to NAT IPv4 traffic on your bridge? [default=yes]: yes
What IPv6 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]: none # Pour l'instant car l'infra proxgroup ne le permet pas
Would you like LXD to be available over the network? (yes/no) [default=no]: no # pas pour l'instant
Would you like stale cached images to be updated automatically? (yes/no) [default=yes] yes
Would you like a YAML "lxd init" preseed to be printed? (yes/no) [default=no]: yes
```
### Désactivation du pare-feu intégré
```bash
lxc network set br0 ipv4.firewall false
lxc network set br0 ipv6.firewall false
```
### Système de fichiers
Il est important de mentionner l'utilisation du système de fichiers BTRFS, qui apporte une grande flexibilité pour le stockage des conteneurs et des images de base. Chacun entité se verra attribuer un sous-volume.
Pour avoir un aperçu des sous-volumes créés :
```bash
mount /dev/sda3
btrfs subvolume list /mnt
umount /mnt # Quand on a fini
```
## Gestion des conteneurs
### Profil
C'est certainement un des éléments clefs pour la création d'un conteneur, puisqu'il définira tous les caractéristiques de celui-ci.
Un profil "krhacken" été créé avec les paramètres suivants :
```yaml
config:
limits.cpu: "2"
limits.memory: 256MB
description: Krhacken LXD profile
devices:
eth0:
name: eth0
network: br0
type: nic
root:
path: /
pool: lxd-pool
type: disk
name: krhacken
```
Et voici quelques commandes pour créer un nouveau profil et le configurer :
```bash
lxc profile create krkn1
lxc profile edit krkn1 # Edition directe du fichier de configuration /!\ difficile
lxc profile set krkn1 limits.cpu 4 # Limiter l'utilisation à 4 CPU
lxc profile set krkn1 limits.memory 256MB # Limiter l'utilisation de la RAM à 256MB
```
### Création d'un conteneur
Exemple pour créer le conteneur "bilmak" avec le profile krhacken à partir d'une image Debian Buster:
```bash
lxc launch -p krhacken images:debian/buster bilmak
```
### Stop & Start
```bash
lxc stop <CT>
lxc start <CT>
```
### Snapshots de conteneurs
#### Créer un snap
```bash
lxc snapshot <CT>
```
#### Restaurer un snap
```bash
lxc restore <CT> snap
```
### Redirection de ports
La vieille méthode du NAT avec ferm pour rediriger les ports, applique d'avoir de connaître à l'avance l'ip de chaque, or pour plus de flexibilité les addresses sont attribuées via DHCP.
Nous utiliserons donc la nouvelle solution proposée par LXD à savoir le "device proxy". Le fait de passer par un couche supérieure permet de faire abstraction de l'IP du conteneur.
Voici comment rediriger les ports 80 et 443 pour sur conteneur exécutant un serveur web (type NginX) :
```bash
lxc config device add bilmak http proxy listen=tcp:IPv4_publique:80 connect=tcp:127.0.0.1:80
lxc config device add bilmak https proxy listen=tcp:IPv4_publique:443 connect=tcp:127.0.0.1:443
```
## Mise en place des services
### Proxy Nginx (Bilmak)
#### Pré-requis :
```bash
# Installation de paquets de base
apt install nginx certbot python3-certbot-dns-ovh vim net-tools dnsutils unattended-upgrades apt-listchanges wget curl
# Activation des màj auto de sécurité
echo unattended-upgrades unattended-upgrades/enable_auto_updates boolean true | debconf-set-selections
dpkg-reconfigure -f noninteractive unattended-upgrades
ln -sf /usr/share/zoneinfo/Europe/Paris /etc/localtime
```
#### Certbot
Générer une clef d'API ovh : [voir article de blog](https://buzut.net/certbot-challenge-dns-ovh-wildcard/#Creation-des-acces-a-l%E2%80%99API-OVH)
`/root/.ovh.ini`
```
dns_ovh_endpoint = ovh-eu
dns_ovh_application_key = xxx
dns_ovh_application_secret = xxx
dns_ovh_consumer_key = xxx
```
Puis on fait le petit `chmod 600 /root/.ovh.ini` kivabien.
Génération à blanc *dry-run* du certificat.
```bash
certbot certonly --dns-ovh --dns-ovh-credentials ~/.ovh.ini --cert-name krhacken.org -d "*.krhacken.org, krhacken.org" --dry-run
```
Si tout s'est bien passé :
```bash
certbot certonly --dns-ovh --dns-ovh-credentials ~/.ovh.ini --cert-name krhacken.org -d "*.krhacken.org, krhacken.org"
```
#### Mise en place des certificats pour HAProxy
HAProxy a besoin d'un seul fichier pour le certificat wildcard, voici comment créer ce fichier.
```
cat /etc/letsencrypt/live/krhacken.org/privkey.pem /etc/letsencrypt/live/krhacken.org/fullchain.pem > /etc/ssl/letsencrypt/krhacken.org.pem
```
On modifie le script de renouvellement utilisé par certbot pour inclure cette action
`/opt/certbot-renew.sh`
```
#!/bin/bash
/usr/bin/certbot renew
/bin/cat /etc/letsencrypt/live/krhacken.org/privkey.pem /etc/letsencrypt/live/krhacken.org/fullchain.pem > /etc/ssl/letsencrypt/krhacken.org.pem
/bin/systemctl reload haproxy.service
```
#### Fichiers de configuration HAProxy
Adapter `/etc/haproxy/haproxy.conf`
```
global
log /dev/log local0
log /dev/log local1 notice
stats socket /run/haproxy/admin.sock
stats timeout 30s
user haproxy
group haproxy
daemon
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
ssl-default-server-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL
ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
nbproc 1
defaults
log global
mode http
option dontlognull
timeout connect 5000
timeout client 50000
timeout server 50000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
frontend unsecure-all
bind :::80 accept-proxy v4v6
mode http
redirect scheme https code 301
default_backend drop-http
frontend secure-all
bind :::443 v4v6 accept-proxy ssl no-sslv3 crt /etc/ssl/letsencrypt/krhacken.org.pem
mode http
option forwardfor
option httplog
acl www hdr_beg(host) -i www.
reqirep ^Host:\ www.(.*)$ Host:\ \1 if www
rspadd Strict-Transport-Security:\ max-age=63072000
acl cloud hdr_end(host) cloud.krhacken.org
acl git hdr_end(host) git.krhacken.org
acl matrix hdr_end(host) matrix.krhacken.org
use_backend cloud if cloud
use_backend git if git
use_backend matrix if matrix
default_backend drop-http
backend cloud
mode http
server cloud-1 10.0.0.51:80 check
backend git
mode http
server git-1 10.0.0.202:80 check
backend matrix
mode http
server matrix-1 10.0.0.66:80 check
backend drop-http
mode http
http-request silent-drop
```
Pour chaque nouveau service il faut ajouter :
- Un ACL pour le domaine
- Une instruction use_backend par ACL
- Une backend
### Nextcloud (Syze)
#### Pré-requis :
```bash
# Installation de paquets de base
apt install vim wget sudo unzip unattended-upgrades nginx postgresql php-fpm php-common php-curl php-gd php-json php-xml php-mbstring php-zip php-pgsql php-imap php-apcu php-imagick php-intl php-bz2 php-gmp
# Activation des màj auto de sécurité
echo unattended-upgrades unattended-upgrades/enable_auto_updates boolean true | debconf-set-selections
dpkg-reconfigure -f noninteractive unattended-upgrades
ln -sf /usr/share/zoneinfo/Europe/Paris /etc/localtime
```
#### Migration Mariadb -> PostgreSQL
Suivre cet article de [blog](https://markus-blog.de/index.php/2019/10/21/how-to-migrate-nextcloud-17-database-backend-from-mysql-to-postgresql/).
#### Fichiers de configuration nginx
vhost pour nextcloud : `/etc/nginx/sites-available/nextcloud`
```
upstream php-handler {
server 127.0.0.1:9000;
}
server {
listen 80;
listen [::]:80;
server_name cloud.krhacken.org;
# Set real client IP
set_real_ip_from 10.0.0.0/8;
real_ip_header X-Real-IP;
real_ip_recursive on;
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
# Path to the root of your installation
root /var/www/nextcloud;
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
# The following rule is only needed for the Social app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
location = /.well-known/carddav {
return 301 $scheme://$host:$server_port/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host:$server_port/remote.php/dav;
}
# set max upload size
client_max_body_size 1G;
# Enable gzip but do not remove ETag headers
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
# Uncomment if your server is build with the ngx_pagespeed module
# This module is currently not supported.
#pagespeed off;
location / {
rewrite ^ /index.php;
}
location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
deny all;
}
location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}
#location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy)\.php(?:$|\/) {
fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
try_files $fastcgi_script_name =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTPS on;
# Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true;
# Enable pretty urls
fastcgi_param front_controller_active true;
fastcgi_pass php-handler;
fastcgi_intercept_errors on;
fastcgi_request_buffering off;
}
location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
try_files $uri/ =404;
index index.php;
}
# Adding the cache control header for js, css and map files
# Make sure it is BELOW the PHP block
location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463";
# Add headers to serve security related headers (It is intended to
# have those duplicated to the ones above)
# Before enabling Strict-Transport-Security headers please read into
# this topic first.
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload;";
#
# WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list
# could take several months.
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Optional: Don't log access to assets
access_log off;
}
location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$request_uri;
# Optional: Don't log access to other assets
access_log off;
}
}
```
Optimisations PHP : `/etc/nginx/conf.d/php-optimizations.conf`
```
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true;
fastcgi_cache_valid 404 1m;
fastcgi_cache_valid any 1h;
fastcgi_cache_methods GET HEAD;
```
Pour plus d'informations, il suffit de suivre la [documentation officielle](https://docs.nextcloud.com/server/latest/admin_manual/).
## Configuration LXC (pas utilisé finalement --> passage à LXD)
### Globale
`/etc/lxc/default.conf`
```
# Defaults
lxc.apparmor.profile = generated
lxc.apparmor.allow_nesting = 1
# Network bridge configuration
lxc.net.0.type = veth
lxc.net.0.link = lxcbr0
lxc.net.0.flags = up
lxc.net.0.hwaddr = ad:ba:be:xx:xx:xx
```
### lxc-net
`/etc/defaults/lxc-net` (activer la création du bridge)
```
USE_LXC_BRIDGE="true"
```
### Unprivileged
`~/.config/lxc/default.conf`
```
# Defaults
lxc.apparmor.profile = generated
lxc.apparmor.allow_nesting = 1
# Network bridge configuration
lxc.net.0.type = veth
lxc.net.0.link = lxcbr0
lxc.net.0.flags = up
lxc.net.0.hwaddr = ad:ba:be:xx:xx:xx
# Allow nesting
lxc.mount.auto = cgroup
# ID map for umpriviledged containers
lxc.idmap = u 0 100000 65536
lxc.idmap = g 0 100000 65536
# "Secure" mounting
lxc.mount.auto = proc:mixed sys:ro cgroup:mixed
# Disable AppArmor confinement for containers started by non-root
# See https://discuss.linuxcontainers.org/t/unprivileged-container-wont-start-cgroups-sysvinit/6766 and
# https://discuss.linuxcontainers.org/t/cannot-use-generated-profile-apparmor-parser-not-available/4449
lxc.apparmor.profile = unconfined
```
Reference in New Issue View Git Blame Copy Permalink