4 203
modifications
« Proxmox et KVM » : différence entre les versions
Aller à la navigation
Aller à la recherche
→reboot et postinstallation
| Ligne 274 : | Ligne 274 : | ||
* désactivez le login root (directive PermitRootLogin no dans <code>/etc/ssh/sshd_config</code>) | * désactivez le login root (directive PermitRootLogin no dans <code>/etc/ssh/sshd_config</code>) | ||
* ajoutez la directive allowusers pfoo dans <code>/etc/ssh/sshd_config</code> | * ajoutez la directive allowusers pfoo dans <code>/etc/ssh/sshd_config</code> | ||
=Utiliser son propre certificat ssl pour l'interface web= | |||
Je vous renvoi sur http://wiki.csnu.org/index.php?title=Installation_et_configuration_de_OpenSSL pour la mise en place d'une autorité de certification. | |||
Dans l'exemple suivant, je créé un certificat proxmox et le signe avec l'autorité onyx_ca : | |||
<pre> | |||
openssl req -newkey rsa:2048 -keyout proxmox.key -out proxmox.req | |||
openssl ca -name onyx_ca -extensions PROXMOX -in proxmox.req -out proxmox.pem | |||
</pre> | |||
<pre> | |||
mkdir /etc/apache2/ssl/ | |||
mv proxmox.* /etc/apache2/ssl/ | |||
cat /etc/ssl/root_ca/root_ca.pem /etc/ssl/onyx_ca/onyx_ca.pem > /etc/apache2/ssl/cachain.pem | |||
</pre> | |||
Modifiez le fichier <code>/etc/apache2/sites-enabled/pve.conf</code> comme suit : | |||
<pre> | |||
<VirtualHost *:443> | |||
SSLEngine on | |||
SSLProtocol all -SSLv2 | |||
#SSLCertificateFile /etc/pve/pve-ssl.pem | |||
#SSLCertificateKeyFile /etc/pve/pve-ssl.key | |||
SSLCertificateFile /etc/apache2/ssl/proxmox.pem | |||
SSLCertificateKeyFile /etc/apache2/ssl/proxmox.key | |||
SSLCertificateChainFile /etc/apache2/ssl/cachain.pem | |||
RewriteEngine on | |||
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) | |||
RewriteRule .* - [F] | |||
</VirtualHost> | |||
</pre> | |||
=Installer un serveur dns pour ses VEs= | |||
Commencez par installer le serveur bind9 : | |||
<pre>aptitude install bind9 bind9-host dnsutils</pre> | |||
Éditez le fichier <code>/etc/bind/named.conf.options</code> et ajoutez y les lignes suivantes : | |||
<pre> | |||
allow-query { | |||
127.0.0.1; | |||
91.121.141.220; | |||
::1; | |||
2001:41d0:1:bcdc::220; | |||
192.168.0.0/24; | |||
}; | |||
allow-recursion { | |||
127.0.0.1; | |||
91.121.141.220; | |||
::1; | |||
2001:41d0:1:bcdc::220; | |||
192.168.0.0/24; | |||
}; | |||
allow-query-cache { | |||
127.0.0.1; | |||
91.121.141.220; | |||
::1; | |||
2001:41d0:1:bcdc::220; | |||
192.168.0.0/24; | |||
}; | |||
version "[SECURED]"; | |||
allow-notify { | |||
127.0.0.1; | |||
91.121.141.220; | |||
::1; | |||
2001:41d0:1:bcdc::220; | |||
192.168.0.0/24; | |||
}; | |||
//interdiction du transfère complet de zones | |||
allow-transfer {"none";}; | |||
listen-on { 127.0.0.1; 192.168.0.0/24; 91.121.141.220; }; | |||
listen-on-v6 { ::1; 2001:41d0:1:bcdc::220; }; | |||
transfer-source 91.121.141.220; | |||
transfer-source-v6 2001:41d0:1:bcdc::220; | |||
notify-source 91.121.141.220; | |||
notify-source-v6 2001:41d0:1:bcdc::220; | |||
</pre> | |||
Vous pouvez noter que j'ai autorité toutes les IPs 192.168.0.0 à interroger le serveur dns étant donné que je me servirais de cette classe pour créer un réseau interne pour mes VEs. | |||
Ajoutez les lignes suivantes dans <code>/etc/resolv.conf</code> : | |||
<pre> | |||
nameserver ::1 | |||
nameserver 127.0.0.1 | |||
nameserver 192.168.0.1 | |||
nameserver 2001:41d0:1:bcdc::220 | |||
nameserver 91.121.141.220 | |||
</pre> | |||
=Sécuriser et configurer le serveur mail de son host= | |||
Lors de l'installation de l'interface proxmox, <code>postfix</code> a été automatiquement installé. | |||
Modifiez la configuration de postfix dans <code>/etc/postfix/main.cf</code> comme suit : | |||
<pre> | |||
# See /usr/share/postfix/main.cf.dist for a commented, more complete version | |||
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU) | |||
biff = no | |||
# appending .domain is the MUA's job. | |||
append_dot_mydomain = no | |||
# Uncomment the next line to generate "delayed mail" warnings | |||
#delay_warning_time = 4h | |||
readme_directory = no | |||
# TLS parameters | |||
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem | |||
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key | |||
smtpd_use_tls=yes | |||
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache | |||
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache | |||
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for | |||
# information on enabling SSL in the smtp client. | |||
myhostname = onyx.csnu.org | |||
mydomain = onyx.csnu.org | |||
alias_maps = hash:/etc/aliases | |||
alias_database = hash:/etc/aliases | |||
myorigin = /etc/mailname | |||
mydestination = onyx.csnu.org, localhost | |||
relayhost = | |||
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/24 | |||
mailbox_size_limit = 0 | |||
recipient_delimiter = + | |||
inet_protocols = all | |||
inet_interfaces = 127.0.0.1, [::1], 192.168.0.1, 91.121.141.220, [2001:41d0:1:bcdc::220] | |||
smtpd_sender_restrictions = | |||
reject_unknown_sender_domain, | |||
reject_non_fqdn_sender | |||
smtpd_recipient_restrictions = | |||
permit_mynetworks, | |||
permit_sasl_authenticated, | |||
reject_non_fqdn_hostname, | |||
reject_non_fqdn_sender, | |||
reject_non_fqdn_recipient, | |||
reject_unauth_destination, | |||
reject_unauth_pipelining, | |||
reject_invalid_hostname | |||
</pre> | |||
==SSL== | |||
Si vous avez votre propre autorité ssl, vous pouvez générer votre propre certificat. | |||
Ajoutez les lignes suivantes dans <code>/etc/ssl/openssl.cnf</code> : | |||
<pre> | |||
[POSTFIX] | |||
nsComment = "SMTP Server Certificate" | |||
subjectKeyIdentifier = hash | |||
authorityKeyIdentifier = keyid,issuer:always | |||
issuerAltName = issuer:copy | |||
basicConstraints = critical,CA:FALSE | |||
keyUsage = digitalSignature, nonRepudiation, keyEncipherment | |||
nsCertType = server | |||
extendedKeyUsage = serverAuth | |||
</pre> | |||
Puis générez la clé et le certificat, et signez le avec votre autorité (onyx_ca dans mon cas) : | |||
<pre> | |||
openssl req -config /etc/ssl/openssl.cnf -nodes -newkey rsa:2048 -keyout postfix.key -out postfix.req | |||
openssl ca -config /etc/ssl/openssl.cnf -name onyx_ca -extensions POSTFIX -in postfix.req -out postfix.pem | |||
</pre> | |||
Déplacez les fichiers dans le répertoire <code>/etc/postfix/ssl</code>: | |||
<pre> | |||
mkdir /etc/postfix/ssl | |||
mv postfix.key /etc/postfix/ssl/ | |||
mv postfix.pem /etc/postfix/ssl/ | |||
chmod 600 /etc/postfix/ssl/* | |||
cat /etc/ssl/root_ca/root_ca.pem /etc/ssl/onyx_ca/onyx_ca.pem > /etc/postfix/ssl/ca_chain.pem | |||
</pre> | |||
Il faut encore modifier <code>/etc/postfix/main.cf</code> : | |||
<pre> | |||
smtpd_tls_cert_file=/etc/postfix/ssl/postfix.pem | |||
smtpd_tls_key_file=/etc/postfix/ssl/postfix.key | |||
smtpd_tls_CAfile=/etc/ssl/csnu.org/ca.pem | |||
smtpd_use_tls=yes | |||
smtp_tls_cert_file=/etc/postfix/ssl/postfix.pem | |||
smtp_tls_key_file=/etc/postfix/ssl/postfix.key | |||
smtp_tls_CAfile=/etc/postfix/ssl/ca_chain.pem | |||
</pre> | |||
=Télécharger vos images= | |||