{"id":92,"date":"2021-03-11T18:46:15","date_gmt":"2021-03-11T16:46:15","guid":{"rendered":"http:\/\/cimalink.eu\/blog\/?p=92"},"modified":"2021-03-11T18:46:15","modified_gmt":"2021-03-11T16:46:15","slug":"serveurs-debian-en-mirroir-mirroring","status":"publish","type":"post","link":"https:\/\/cimalink.eu\/blog\/serveurs-debian-en-mirroir-mirroring\/","title":{"rendered":"Serveurs debian en mirroir (mirroring)"},"content":{"rendered":"\n<p>pour r\u00e9pliquer un serveur il faut<\/p>\n\n\n\n<p>1 &#8211; les programmes, si tu installe tout grace \u00e0 un gestionnaire de paquets (dpkg, apt, aptitude \u2026) recup\u00e8re le r\u00e9sultat de la commande dpkg &#8211;get-selections qui donne la liste des paquets install\u00e9s. tu les installera sur le second serveur en chargant ce fichier avec dpkg &#8211;set-selections.<\/p>\n\n\n\n<p>2 &#8211; les config des programmes. sur debian tout est dans \/etc, recupere reguli\u00e8rement une archive de ce dossier avec rsync.<\/p>\n\n\n\n<p>avec ces deux premiers points tu es capable d\u2019obtenir deux machines identiques (attention quand m\u00eame aux adressages IP)<\/p>\n\n\n\n<p>3 &#8211; les bases de donn\u00e9es et les donn\u00e9es. l\u2019id\u00e9al est DRDB car m\u00eame si mysql sait faire de la replication, \u00e7a reste en mode asynchrone. et un petit dump de temps en temps permet aussi un retour arri\u00e8re.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>tuto:<\/p>\n\n\n\n<p>On imagine deux serveurs: serv1 &amp; serv2<\/p>\n\n\n\n<p>On va consid\u00e9rer que serv1 a l\u2019ip 192.168..20.20 et serv2 \u00e0 l&#8217;ip 192.168.20.30 (c\u2019est juste pour l\u2019exemple hein, je vais pas mettre d\u2019ip publiques dans le tuto\u00a0\u00a0vous changer par l\u2019ip publique principale de votre serveur = eth0<\/p>\n\n\n\n<p>On est parti, phase 1.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Configuration d\u2019un tunnel VPN IPSEC en mode transport<\/li><\/ul>\n\n\n\n<p>Pour que les \u00e9changes d\u2019information r\u00e9seau entre les deux serveurs d\u00e9di\u00e9s soient un minimum s\u00e9curis\u00e9 (comprendre difficilement \u00ab&nbsp;sniffable&nbsp;\u00bb), j\u2019ai d\u00e9cider de monter un tunnel VPN en IPSEC entre les deux.<\/p>\n\n\n\n<p>Les serveurs sont sous Debian. (vous adapter si vous avez un autre OS)<\/p>\n\n\n\n<p>IPSEC autorise 2 modes de communication le mode tunnel (1 serveur\/r\u00e9seau vers 1 r\u00e9seau) et le mode Transport (1 serveur vers 1 serveur) <\/p>\n\n\n\n<p>Donc pour nous le mode transport.<\/p>\n\n\n\n<p>apt-get install ipsec-tools<\/p>\n\n\n\n<p>on se configure le \/etc\/ipsec-tools.conf sur les deux serveurs.<\/p>\n\n\n\n<p>serv1 :<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">#!\/usr\/sbin\/setkey -f \n\nflush;\n\nspdflush;\n(pour plus d\u2019infos sur crontab\n# AH\n\nadd 192.168.20.30 192.168.20.20 ah 15700 -A hmac-md5 \"1234567890123456\";\n\nadd 192.168.20.20 192.168.20.30 ah 24500 -A hmac-md5 \"1234567890123456\";\n\n# ESP\n\nadd 192.168.20.30 192.168.20.20 esp 15701 -E 3des-cbc \"123456789012123456789012\";\n\nadd 192.168.20.20 192.168.20.30 esp 24501 -E 3des-cbc \"123456789012123456789012\";\n\nspdadd 192.168.20.20 192.168.20.30 any -P out ipsec\n\n           esp\/transport\/\/require\n\n           ah\/transport\/\/require;\n\nspdadd 192.168.20.30 192.168.20.20 any -P in ipsec\n\n           esp\/transport\/\/require\n\n           ah\/transport\/\/require;<\/pre>\n\n\n\n<p>serv2 :<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">#!\/usr\/sbin\/setkey -f \n\nflush;\n\nspdflush;\n\n# AH\n\nadd 192.168.20.30 192.168.20.20 ah 15700 -A hmac-md5 \"1234567890123456\";\n\nadd 192.168.20.20 192.168.20.30 ah 24500 -A hmac-md5 \"1234567890123456\";\n\n# ESP\n\nadd 192.168.20.30 192.168.20.20 esp 15701 -E 3des-cbc \"123456789012123456789012\";\n\nadd 192.168.20.20 192.168.20.30 esp 24501 -E 3des-cbc \"123456789012123456789012\";\n\nspdadd 192.168.20.30 192.168.20.20 any -P out ipsec\n\n        esp\/transport\/\/require\n\n ah\/transport\/\/require;\n\nspdadd 192.168.20.20 192.168.20.30 any -P in ipsec\n\n           esp\/transport\/\/require\n\n           ah\/transport\/\/require;<\/pre>\n\n\n\n<p>Vous remarquerez que les changements portent sur les sens de trafic.<\/p>\n\n\n\n<p>Bien \u00e9videmment, vous changez les cl\u00e9s (32 octets hexadecimaux, et 48 pour les cl\u00e9s 3des-cbc), g\u00e9n\u00e9rable faisable facilement par un :<\/p>\n\n\n\n<p>hexdump -e \u20188\/2 \u201c%04x\u201d \u2018 \/dev\/urandom -n 16; echo (pour les 32 caract\u00e8res)<\/p>\n\n\n\n<p>hexdump -e \u20188\/2 \u201c%04x\u201d \u2018 \/dev\/urandom -n 24; echo (pour 48)<\/p>\n\n\n\n<p>Exemple :<\/p>\n\n\n\n<p>hexdump -e \u20188\/2 \u00ab&nbsp;%04x&nbsp;\u00bb \u2018 \/dev\/urandom -n 16; echo<br>6e99170129b4bc1b774161f0c7ecf50f<\/p>\n\n\n\n<p>la cl\u00e9 = 0x6e99170129b4bc1b774161f0c7ecf50f (sans les guillemets).<\/p>\n\n\n\n<p>Un ping vers l\u2019autre serveur et un tcpdump vous d\u00e9montreront le cryptage effectif :<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># tcpdump -n \"host 192.168.20.30\"\n\n01:23:27.996891 IP 192.168.20.20 &gt; 192.168.20.30: AH(spi=0x00000302,seq=0x1): ESP(spi=0x00000303,seq=0x1), length 88\n\n01:23:27.998282 IP 192.168.20.30 &gt; 192.168.20.20: AH(spi=0x00000202,seq=0x277ac2): ESP(spi=0x00000203,seq=0x277ac2), length 88\n\n01:23:28.999853 IP 192.168.20.20 &gt; 192.168.20.30: AH(spi=0x00000302,seq=0x2): ESP(spi=0x00000303,seq=0x2), length 88\n\n01:23:29.001726 IP 192.168.20.30 &gt; 192.168.20.20: AH(spi=0x00000202,seq=0x277ac3): ESP(spi=0x00000203,seq=0x277ac3), length 88\n\n4 packets captured\n\n15653 packets received by filter\n\n0 packets dropped by kernel<\/pre>\n\n\n\n<p>Comme nous ne faisons que du 1 pour 1, inutile de se fatiguer \u00e0 installer une gestion des cl\u00e9s (type isakmpd ou Racoon).<\/p>\n\n\n\n<p><strong>NB :\u00a0<\/strong>Pour s\u00e9curiser tout cela, vous peaufiner votre Iptables pour n\u2019accepter que du trafic Ipsec entre les deux serveurs.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><\/h2>\n","protected":false},"excerpt":{"rendered":"<p>pour r\u00e9pliquer un serveur il faut 1 &#8211; les programmes, si tu installe tout grace \u00e0 un gestionnaire de paquets (dpkg, apt, aptitude \u2026) recup\u00e8re le r\u00e9sultat de la commande [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":85,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[16,44,8,45,42,43,40],"class_list":["post-92","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","tag-debian","tag-drdb","tag-linux","tag-mirroir","tag-rsync","tag-serveurs","tag-synchro"],"_links":{"self":[{"href":"https:\/\/cimalink.eu\/blog\/wp-json\/wp\/v2\/posts\/92","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cimalink.eu\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cimalink.eu\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cimalink.eu\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cimalink.eu\/blog\/wp-json\/wp\/v2\/comments?post=92"}],"version-history":[{"count":1,"href":"https:\/\/cimalink.eu\/blog\/wp-json\/wp\/v2\/posts\/92\/revisions"}],"predecessor-version":[{"id":95,"href":"https:\/\/cimalink.eu\/blog\/wp-json\/wp\/v2\/posts\/92\/revisions\/95"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cimalink.eu\/blog\/wp-json\/wp\/v2\/media\/85"}],"wp:attachment":[{"href":"https:\/\/cimalink.eu\/blog\/wp-json\/wp\/v2\/media?parent=92"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cimalink.eu\/blog\/wp-json\/wp\/v2\/categories?post=92"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cimalink.eu\/blog\/wp-json\/wp\/v2\/tags?post=92"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}