下午考

Myth丶恋晨 2021-12-21 14:23 246阅读 0赞

System1:172.25.0.11 server

System2:172.25.0.10 desktop

Password:redhat

**第****1****题：****sys1 sys2**

\# vim /etc/selinux/config

SELINUX=enforcing

**第****2****题：****sys1 sys2**

\# vim /etc/hosts.allow

sshd : 172.25.0.0/255.255.255.0 冒号两边有空格，考试记得ping域名看地址

\# vim /etc/hosts.deny

sshd : 172.25.1.0/255.255.255.0 冒号两边有空格，考试记得ping域名看地址

**第****3****题：****sys1 sys2**

\# vim /etc/profile

alias qstat='/bin/ps -Ao pid,tt,user,fname,rsz' 单引号，双引号都可以

\# source /etc/profile

**第****4****题：****sys1**

\# firewall-config

调用图形化界面，永久模式下，端口转发TCP UDP都要做。

![1552165-20190414163854786-627326324.png][]

\# firewall-cmd --list-all 查看一下

**第****5****题****:sys1 sys2**

\# nm-connection-editor 打开图形界面，点击添加team,改个名字

添加网卡，eth1,eth2,记得勾选自动连接的对勾

\{"runner":\{"name":"activebackup"\}\}

点击save,退出

\# nm-connection-editor 进图形界面配置要求的team的IP地址，save完成。

\# ping 172.16.1.25测试，不通，重启网卡再测试

\# teamdctl team0 state 查看team0状态,第一个添加的team为team0

**第****6****题：****sys1 sys2**

\# nm-connection-editor 进图形界面找到对应要求的网卡eth0配置IPV6地址，复制进去。

Ping6 测试不通，

Systemctl restart network

Ping6 测试正常。

**第****7****题：****sys1 sys2**

\# vim /etc/postfix/main.cf

local\_transport=error:local 100行加上，

myorigin = domain1.example.com 99行改一下，来源地址

relayhost = rhgls.domain1.example.com 313行改一下，路由转发到地址。

\# systemctl restart postfix

\# systemctl enable postfix

Firewall-config 打开图形界面，永久生效里面配置把smtp对勾，加载一下。

测试一下：

\# mail -s "for test" dave@domain1.example.com

火狐浏览器打开题目最后给的URL地址看一下。完成。

**第****8****题：**

system1:

\# yum install samba samba-client -y

\# mkdir /common

\#chcon -R -t samba\_sahre\_t /common

\# vim /etc/samba/smb.conf

workgroup = STAFF 89行改一下

\[common\] 320行后加下面内容

path = /common

hosts allow = 172.25.0. ping一下域名看看IP地址。写网段三位数加一个点.

browseable = yes

：wq!

firewall-config 打开图形界面，永久生效里面勾选samba mountd,加载一下ok。

\#\#防火墙也可以用命令行方式如下：

\# firewall-cmd --permanent --add-service=samba

\# firewall-cmd --permanent --add-service=mountd

\# firewall-cmd --reload

\# useradd andy 创建用户，考试不用，已经有此用户

\# smbpasswd -a andy 加入smb数据库，考试环境中有不用，密码为flectrag

\# systemctl restart smb nmb

\# systemctl enable smb nmb

system2验证:

\# yum install samba-client cifs-utils

\# smbclient -L //172.225.0.11 -U andy 已实际地址为准。

**第****9****题：**

System1：

\# mkdir /miscellaneous

\# chmod o+w /miscellaneous

\# vim /etc/samba/smb.conf

\[miscellaneous\] 在最后行加入如下内容：

path=/miscellaneous

hosts allow = 172.25.0.

browseable = yes

writable = no

write list = akira

:wq!

\#useradd silene 考试用id silene查看一下，有了就不用创建

\#useradd akira

\# smbpasswd -a silene 配密码flectrag

\# smbpasswd -a akira

\# systemctl restart smb nmb

System2：

\# smbclient -L //172.24.1.5 -U silene

\# smbclient -L //172.24.1.5 -U akira

\# yum install cifs\*

\# mkdir /mnt/multi

\# chmod o+w /mnt/multi

\# vim /etc/fstab

//172.25.0.11/miscellaneous /mnt/multi cifs defaults,multiuser,username=silene,password=flectrag,sec=ntlmssp 0 0

:wq!

\# mount -a

**第****10****题：**

System1：

\# mkdir/public

\# mkdir -p /protected/confidential

chcon -R -t public\_content\_t /public

chcon -R -t public\_content\_t /protected

chowndeepak /protected/confidential

\# vim /etc/exports

/public 172.25.0.0/24(ro)

/protected 172.25.0.0/24(rw,sec=krb5p)

:wq!

\# systemctl start nfs-server nfs-secure-server 报错了

用火狐浏览器打开网址下载 krb5.keytab文件mv到/etc/krb5.keytab或者用下面wget命令下载

\# wget -O /etc/krb5.keytab http://host.domain1.example.com/materials/nfs\_server.keytab

\# systemctl restart nfs-server nfs-secure-server 成功了

\# systemctl enable nfs-server nfs-secure-server

\# vim /etc/sysconfig/nfs

RPCNFSDARGS="-V 4.2"

\# systemctl start nfs-server nfs-secure-server

\# firewall-cmd --permanent --add-service=nfs

\# firewall-cmd --permanent --add-service=rpc-bind

\# firewall-cmd --reload

\# exportfs -r 共享出去

System2验证：

\# showmount -e 172.25.0.11

Export list for 172.25.0.11:

/protected 172.25.0.0/24

/public 172.25.0.0/24

**第****11****题：****sys2****上**

\# mkdir /mnt/nfsmount

\# mkdir /mnt/nfssecure

\# systemctl restart nfs-secure 报错了

用火狐浏览器打开网址下载 krb5.keytab文件mv到/etc/krb5.keytab或者用下面wget命令下载

\# wget -O /etc/krb5.keytab http://host.domain1.example.com/materials/nfs\_server.keytab

\# systemctl restart nfs-secure 成功了

\# systemctl enable nfs-secure

\# vim /etc/fstab

172.24.1.5:/public /mnt/nfsmount nfs defaults 0 0

172.24.1.5:/protected /mnt/nfssecure nfs defaults,sec=krb5p,v4.2 0 0

\# mount -a

报错了，试验环境问题，两台主机都执行lab nfskrb5 setup再试，

再不行就重启systemctl start nfs-secure，考试不用担心。再不行就sys1 sys2都重启一下再试。

**第****12****题：****sys1**

\# yum install httpd

cd /var/www/html

echo "system1.hahaha.com" > index.html 模拟环境自己创建一个文件，考试是后一定要去下载

\# wget -O index.html http://rhgls.domain1.example.com/materials/station.html

systemctl restart httpd

systemctl enable httpd

\# cp /usr/share/doc/httpd-2.4.6/httpd-vhosts.conf /etc/httpd/conf.d/

\# vim /etc/httpd/conf.d/httpd-vhosts.conf 里面的内容作参考，只要下面内容，其他全删除就可以。

DocumentRoot /var/www/html

ServerName system1.domain1.example.com hostname命令查一下

</VirtualHost>

：wq!

\# systemctl restart httpd

\# firewall-cmd --permanent --add-service=http

\# firewall-cmd --permanent --add-service=https

\# firewall-cmd --reload

\# firewall-config 图形化界面做一个富规则Rich Rules

![1552165-20190414163923801-2074453073.png][]

**第****13****题：****sys1**

\# yum -y install mod\_ssl

\# cd /var/www/html/

\# wget http://host.domain1.example.com/materials/system1.crt

\# wget http://host.domain1.example.com/materials/system1.key

\# wget http://host.domain1.example.com/materials/domain1.crt

\# vim /etc/httpd/conf.d/httpd-vhosts.conf

SSLEngine on

SSLProtocol all -SSLv2

SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5 （必须大写）

SSLHonorCipherOrder on

DocumentRoot /var/www/html

ServerName system1.domain1.example.com

SSLCertificateFile /var/www/html/system1.crt

SSLCertificateKeyFile /var/www/html/system1.key

SSLCACertificateFile /var/www/html/domain1.crt

</VirtualHost>

:wq!

\# getsebool -a | grep httpd

\# setsebool -P httpd\_read\_user\_content=on

\# systemctl restart httpd

网页打开测试一下,system1的主机名，server0.example.com。

模拟环境中这么做的：

DocumentRoot /var/www/html

ServerName server0.example.com

sslengine on

sslprotocol all -sslv2

sslciphersuite HIGH:MEDIUM:!aNULL:!MD5 只有这地方大小写区分了，别的都小写的。

sslhonorcipherorder on ssh.conf模板中没有这行

sslcertificatefile /var/www/html/www0.crt

sslcertificatekeyfile /var/www/html/www0.key

sslcacertificatefile /var/www/html/domain0.crt ssh.conf 模板中没有这行

</VirtualHost>

辅助命令来查找模板文件：

Find /etc –name ssl.conf

以上文件内容模板中都有，感觉用more ssl.conf命令从头看到尾，共9行都找了，命令不多。翻几页就ok了。

grep -v "\#" ssl.conf | grep -v "^$" | grep SSL\*　　此命令过滤出来少4行。

**第****14****题：****sys1**

\# mkdir /var/www/virtual/

\# cd /var/www/virtual/

\# wget -O index.html http://rhgls.domain1.example.com/materials/www.html

\# setfacl -m u:andy:rwx /var/www/virtual

\#vim /etc/httpd/conf.d/httpd-vhosts.conf

DocumentRoot "/var/www/virtual"

ServerName www.domain1.example.com

</VirtualHost>

:wq!

Systemctl restart httpd

\#ping www.domain1.example.com 有问题

\#vim /etc/hosts 没有解析到本地

172.25.0.11 www.domain1.example.com 考试不用,这里是为了本地测试。

**第****15****题：****sys1**

\# mkdir /var/www/html/secret

\#cd /var/www/html/secret

\#wget -O index.html http://rhgls.domain1.example.com/materials/private.html 考试用

echo "ceshiceshi......lslslslslsl.......sdf" > index.html 模拟环境用

\#vim /etc/httpd/conf.d/httpd-vhosts.conf

allowOverride none

require all denied

require local

</directory>

:wq!

\#systemctl restart httpd

浏览器打开server0.example.com/secret 成功

**第****16****题：****sys1**

\# yum install mod\_wsgi

\# mkdir /var/www/ws

\# cd /var/www/ws/

\# wget http://rhgls.domain1.example.com/materials/webapp.wsgi

\# vim /etc/httpd/conf.d/httpd-vhosts.conf

listen 8998

wsgiscriptalias / /var/www/ws/webapp.wsgi

servername dynamic.domain1.example.com 　　这地方模拟环境用

</virtualhost>

systemctl restart httpd 会报错和selinux相关

semanage port -l | grep http

semanage port -a -t http\_port\_t -p tcp 8998

systemctl restart httpd

\# firewall-cmd --permanent --add-port=8998/tcp

\# firewall-cmd –reload

或者firewall-config图形界面配port里配

Cd /var/www/ws

Ls –lZ \*

Ls –lZ /var/www/html

Semanage fcontext –a –t httpd\_sys\_content\_t webapp.wsgi

Restorecon –v webapp.wsgi 立即生效

访问网页测试发现：webapp0.example.com或者server0.example.com都可以

**第****17****题：****System1**

\# vim /root/script

\#!/bin/bash

case $1 in

foo)

echo bar

;;

bar)

echo foo

;;

\*)

echo '/root/script foo|bar'

;;

esac

:wq!

\# chmod a+x /root/script

./root/script foo 测试一下

**第****18****题：****sys1**

\# cd /root

\# wget http://rhgls.domain1.example.com/materials/userlist

\# vim /root/mkusers

if \[ $\# -eq 0 \];then

echo ‘Usage: /root/mkusers userfile’

exit 1

if \[ ! -f $1 \];then

echo ‘Input file not found’

exit 1

while read line

useradd -s /bin/false $line

done < $1

:wq!

\# chmod -Rf +x /root/mkusers

./root/mkusers userlist

**第****19****题：****sys1**

\# yum -y install target\*

\# systemctl restart target

\# systemctl enable target

\# pvcreate /dev/sdb

\# vgcreate rhce /dev/sdb

\# lvcreate -l 768 -n iscsi\_vol rhce

\# targetcli

/> /backstores/block create block1 /dev/rhce/iscsi\_vol

/> /iscsi create iqn.2014-12.com.example.domain1:system1

/> /iscsi/iqn.2014-12.com.example.domain1:system1/tpg1/acls/ create iqn.2014-12.com.example.domain1:system2

/> /iscsi/iqn.2014-12.com.example.domain1:system1/tpg1/luns create /backstores/block/block1

/> /iscsi/iqn.2014-12.com.example.domain1:system1/tpg1/portals/ create 172.25.0.11 这是服务器的IP地址

/> exit

\# systemctl restart target

\# firewall-config

![1552165-20190414164000481-1850473638.png][]

**第****20****题：****sys2**

\# yum -y install iscsi-\*

\# systemctl restart iscsi

\# systemctl enable iscsi

\# vim /etc/iscsi/initiatorname.iscsi

InitiatorName=iqn.2014-12.com.example.domain1:system2

\# systemctl restart iscsi

\# iscsiadm -m discovery -t st -p 172.25.0.11

\# iscsiadm -m node -T iqn.2014-12.com.example.domain1:system1 -l

\# lsblk

\# fdisk /dev/sdc

回车，回车

\+1700M

\# mkfs.xfs /dev/sdc1

\# vim /etc/fstab

/dev/sdc1 /mnt/data xfs default,\_netdev 0 0

:wq!

mount –a

**第****21****题：****sys1**

传文件：scp mariadb.dump root@172.25.0.11:/home

\# yum groupinstall mariadb mariadb-client mariadb-server -y

\# vim /etc/my.cnf

skip-networking=1

\# systemctl restart mariadb

\# systemctl enable mariadb

\# wget http://rhgls.domain1.example.com/materials/users.mdb

\# mysql

show databases;

create database Contacts ; 注意大小写

use Contacts ;

show tables; 查看一下有哪些表

source /root/users.mdb ; 恢复数据库，根据实际文件路径

show tables ;

grant select on Contacts.\* to Luigi@'localhost' identified by 'flectrag' ;

exit

\# mysql\_secure\_installation

回车

y回车

输入新密码两遍

y回车

**第****22****题：填空题**

\# mysql -u root –p

输入密码flectrag

\# use Contacts ;

\# show tables ;

\# select \* from 表名字 ；

\# select \* from 表名字 where emp\_name='jack' ; 列的名子和要查的关键字

\# select \* from User\_Logins where User\_Pass='tangerine' ;

Bplante 查到的答案注意大小写

\# select \* from user\_Names where user\_id='4654'

Brian 查到的答案注意大小写

结束，真费劲鸭。

以上好多行第一个字母大写了，是用word编辑的问题。

转载于:https://www.cnblogs.com/biglu/p/10705606.html

[1552165-20190414163854786-627326324.png]: /images/20211220/14e66ca5bf8947b78424f9c489149206.png
[1552165-20190414163923801-2074453073.png]: /images/20211220/df1e212ae8d941d1ad3c09521042894d.png
[1552165-20190414164000481-1850473638.png]: /images/20211220/68943ce25a9f454e8f053fbdc25b8c93.png