+++ /dev/null
-#!/bin/sh
-
-
-INTERNAL_DEVICE=internal
-CONNECTION_LINE=$(nmcli --terse connection show | grep "${INTERNAL_DEVICE}$")
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id internal \
- connection.interface-name $INTERNAL_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "10.228.109.52/16" \
- ipv4.dns "10.228.109.104, 10.228.109.253" \
- ipv4.dns-search "usr.user.hu" \
- ipv4.gateway "10.228.109.254" \
- ipv4.method "manual" \
- ipv6.method "ignore" \
- save yes
-
-HOST_BRIDGE_DEVICE=brh
-CONNECTION_LINE=$(nmcli --terse connection show | grep "${HOST_BRIDGE_DEVICE}$")
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id brh \
- connection.interface-name $HOST_BRIDGE_DEVICE \
- connection.type bridge \
- save yes
-
-nmcli connection show
-
-for LXC_DEVICE in efg ifg svc ldap vpn pns ins
-do
- CONNECTION_LINE=$(nmcli --terse connection show | grep "${LXC_DEVICE}$")
- if [ -n "$CONNECTION_LINE" ]
- then
- CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
- nmcli connection delete uuid "$CONNECTION_UUID"
- fi
-done
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-hostnamectl set-hostname cvm.usr.user.hu
-systemctl enable lxc.service
-systemctl start lxc.service
+++ /dev/null
-lxc.lxcpath = /lxc/containers
+++ /dev/null
-#fs.inotify.max_queued_events = 16384
-# This is the default.
-
-fs.inotify.max_user_instances = 1024
-# The default is 128.
-
-#fs.inotify.max_user_watches = 8192
-# This is the default.
+++ /dev/null
-[Match]
-MACAddress=00:50:56:1e:28:92
-
-[Link]
-Name=efg
+++ /dev/null
-[Match]
-MACAddress=00:50:56:1e:6d:fe
-
-[Link]
-Name=ifg
+++ /dev/null
-[Match]
-MACAddress=00:50:56:1e:6d:68
-
-[Link]
-Name=ins
+++ /dev/null
-[Match]
-MACAddress=00:50:56:1e:6d:34
-
-[Link]
-Name=internal
+++ /dev/null
-[Match]
-MACAddress=00:50:56:1e:6d:fc
-
-[Link]
-Name=ldap
+++ /dev/null
-[Match]
-MACAddress=00:50:56:1e:6d:ae
-
-[Link]
-Name=pns
+++ /dev/null
-[Match]
-MACAddress=00:50:56:1e:6d:fd
-
-[Link]
-Name=svc
+++ /dev/null
-[Match]
-MACAddress=00:50:56:1e:6d:ec
-
-[Link]
-Name=vpn
+++ /dev/null
-chrony
-lxc
-lxc-templates
-mercurial
-screen
-vim-enhanced
+++ /dev/null
-#!/bin/sh
-
-
-INTERNAL_DEVICE=internal
-CONNECTION_LINE=$(nmcli --terse connection show | grep "${INTERNAL_DEVICE}$")
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id internal \
- connection.interface-name $INTERNAL_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "10.228.92.52/16" \
- ipv4.dns "10.228.109.104, 10.228.109.253" \
- ipv4.dns-search "usr.user.hu" \
- ipv4.gateway "10.228.109.254" \
- ipv4.method "manual" \
- ipv6.method "ignore" \
- save yes
-
-HOST_BRIDGE_DEVICE=brh
-CONNECTION_LINE=$(nmcli --terse connection show | grep "${HOST_BRIDGE_DEVICE}$")
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id brh \
- connection.interface-name $HOST_BRIDGE_DEVICE \
- connection.type bridge \
- save yes
-
-nmcli connection show
-
-for LXC_DEVICE in efg ifg svc ldap vpn pns ins
-do
- CONNECTION_LINE=$(nmcli --terse connection show | grep "${LXC_DEVICE}$")
- if [ -n "$CONNECTION_LINE" ]
- then
- CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
- nmcli connection delete uuid "$CONNECTION_UUID"
- fi
-done
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-hostnamectl set-hostname cvmb.usr.user.hu
-systemctl enable lxc.service
-systemctl start lxc.service
+++ /dev/null
-lxc.lxcpath = /lxc/containers
+++ /dev/null
-#fs.inotify.max_queued_events = 16384
-# This is the default.
-
-fs.inotify.max_user_instances = 1024
-# The default is 128.
-
-#fs.inotify.max_user_watches = 8192
-# This is the default.
+++ /dev/null
-[Match]
-MACAddress=00:50:56:9e:28:92
-
-[Link]
-Name=efg
+++ /dev/null
-[Match]
-MACAddress=00:50:56:9e:6d:fe
-
-[Link]
-Name=ifg
+++ /dev/null
-[Match]
-MACAddress=00:50:56:9e:6d:68
-
-[Link]
-Name=ins
+++ /dev/null
-[Match]
-MACAddress=00:50:56:9e:5c:34
-
-[Link]
-Name=internal
+++ /dev/null
-[Match]
-MACAddress=00:50:56:9e:6d:fc
-
-[Link]
-Name=ldap
+++ /dev/null
-[Match]
-MACAddress=00:50:56:9e:6d:ae
-
-[Link]
-Name=pns
+++ /dev/null
-[Match]
-MACAddress=00:50:56:9e:6d:fd
-
-[Link]
-Name=svc
+++ /dev/null
-[Match]
-MACAddress=00:50:56:9e:6d:ec
-
-[Link]
-Name=vpn
+++ /dev/null
-chrony
-lxc
-lxc-templates
-mercurial
-screen
-vim-enhanced
+++ /dev/null
-lxc.include = /usr/share/lxc/config/common.conf
-
-lxc.arch = x86_64
-lxc.uts.name = efg.pm.user.hu
-lxc.rootfs.path = __CONTAINER_PATH__/rootfs
-lxc.mount.auto = proc:rw sys:ro
-
-lxc.net.0.type = veth
-lxc.net.0.flags = up
-lxc.net.0.link = brh
-lxc.net.0.hwaddr = 02:0c:18:03:ad:fe
-
-lxc.net.1.type = phys
-lxc.net.1.flags = up
-lxc.net.1.link = efg
-
-lxc.autodev = 1
-
-lxc.signal.halt = SIGRTMIN+4
-
-lxc.start.auto = 1
-lxc.start.order = 1
-lxc.start.delay = 3
+++ /dev/null
-BASE_PACKAGES="NetworkManager hostname initscripts iproute iputils rootfiles rsyslog tar vim-minimal"
-SPEC_PACKAGES="nftables"
+++ /dev/null
-#!/bin/sh
-set -x
-
-
-sleep 1
-systemctl --quiet is-active NetworkManager.service
-NM_RC=$?
-WAITED=0
-while [ $NM_RC -ne 0 ]
-do
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active NetworkManager.service
- NM_RC=$?
-done
-[ $WAITED -eq 1 ] && echo
-
-CONNECTION_DEVICES_UP=$(nmcli --terse connection show | grep -v ':$' | wc -l)
-#while [ $CONNECTION_DEVICES_UP -lt 2 ]
-while [ $CONNECTION_DEVICES_UP -lt 1 ]
-do
- sleep 1
- nmcli --terse connection show
- CONNECTION_DEVICES_UP=$(nmcli --terse connection show | grep -v ':$' | wc -l)
-done
-
-EXTERNAL_DEVICE=efg
-PERIMETER_DEVICE=eth0
-
-CONNECTIONS=$(nmcli --terse connection show | wc -l)
-while [ $CONNECTIONS -gt 0 ]
-do
- CONNECTION_LINE=$(nmcli --terse connection show | head -n 1)
- CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
- nmcli connection delete uuid "$CONNECTION_UUID"
- CONNECTIONS=$(nmcli --terse connection show | wc -l)
-done
-
-nmcli connection show
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id perimeter \
- connection.interface-name $PERIMETER_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "192.168.173.254/24" \
- ipv4.dns "192.168.173.174" \
- ipv4.dns-search "pm.user.hu" \
- ipv4.method "manual" \
- ipv4.routes "10.228.0.0/16 192.168.173.1, 192.168.42.0/24 192.168.173.1, 192.168.43.0/24 192.168.173.1" \
- save yes
-
-nmcli connection show
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id dynamic \
- connection.interface-name $EXTERNAL_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "192.168.65.1/24, 194.149.40.146/28, 194.149.40.147/28, 194.149.40.148/28, 194.149.40.149/28, 194.149.40.150/28" \
- ipv4.gateway "194.149.40.145" \
- ipv4.method "manual" \
- save yes
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active dbus.service
-DBUS_RC=$?
-WAITED=0
-while [ $DBUS_RC -ne 0 ]
-do
- if [ $WAITED -eq 0 ]
- then
- echo -n "Waiting for dbus.service"
- fi
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active dbus.service
- DBUS_RC=$?
-done
-[ $WAITED -ne 0 ] && echo
-timedatectl set-timezone Europe/Budapest
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(realpath $(dirname $0))
-
-
-nft list ruleset
-nft list ruleset | grep ^table | sed 's/ {$//' | while read TABLE_SPEC
-do
- nft flush $TABLE_SPEC
- nft delete $TABLE_SPEC
-done
-
-nft --echo --file $REAL_PATH/nftables.config
-nft list ruleset >/etc/nftables/efg.nft
-
-systemctl enable nftables.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-#!/usr/sbin/nft -f
-
-
-################################
-# interface definitions
-################################
-
-# external interface
-define EXTERNAL_IF = efg
-
-# loopback interface
-define LOOPBACK_IF = lo
-
-# perimeter interface
-define PERIMETER_IF = eth0
-
-################################
-# address definitions
-################################
-
-# loopback address
-define LOOPBACK_IP = 127.0.0.1
-
-# public addresses
-define PUBLIC_EFG_IP = 194.149.40.146
-define PUBLIC_MX_IP = 194.149.40.147
-define PUBLIC_NS_IP = 194.149.40.148
-define PUBLIC_VPN_IP = 194.149.40.149
-define PUBLIC_WS_IP = 194.149.40.150
-define PUBLIC_MINECRAFT_IP = 194.149.40.151
-define PUBLIC_IP_152 = 194.149.40.152
-define PUBLIC_IP_153 = 194.149.40.153
-define PUBLIC_IP_154 = 194.149.40.154
-define PUBLIC_IP_155 = 194.149.40.155
-define PUBLIC_IP_156 = 194.149.40.156
-define PUBLIC_IP_157 = 194.149.40.157
-define PUBLIC_DL380E_IP = 194.149.40.158
-
-# efg address (perimeter network)
-define EFG_PERIMETER_IP = 192.168.173.254
-
-# transfer web server address (perimeter network)
-define XFR_PERIMETER_IP = 192.168.173.251
-
-# web server address (perimeter network)
-define WS_PERIMETER_IP = 192.168.173.249
-
-# perimeter name server address (perimeter network)
-define PNS_PERIMETER_IP = 192.168.173.174
-
-# external name server address (perimeter network)
-define ENS_PERIMETER_IP = 192.168.173.64
-
-# ifg address (perimeter network)
-define IFG_PERIMETER_IP = 192.168.173.1
-
-# dvredmine address (internal network)
-define DVREDMINE_INTERNAL_IP = 10.228.62.193
-
-# minicrm address (internal network)
-define MINICRM_INTERNAL_IP = 10.228.109.133
-
-# store address (internal network)
-define STORE_INTERNAL_IP = 10.228.109.250
-
-# service address (internal network)
-define SVC_INTERNAL_IP = 10.228.109.253
-
-# vpn address (internal network)
-define VPN_INTERNAL_IP = 10.228.109.236
-
-# primary name server address (internal network)
-define PNS_INTERNAL_IP = 10.228.109.174
-
-# internal name server address (internal network)
-define INS_INTERNAL_IP = 10.228.109.104
-
-# worksheet address (internal network)
-define WORKSHEET_SR_IP = 192.168.42.248
-
-################################
-# network definitions
-################################
-
-# internal networks
-define USR_NET = 10.228.0.0/16
-define SR_NET = 192.168.42.0/24
-define IN_NET = 192.168.43.0/24
-define INTERNAL_NETS = { $USR_NET, $SR_NET, $IN_NET }
-
-# perimeter network
-define PERIMETER_NET = 192.168.173.0/24
-
-# vpn client network
-define VPN_NET = 172.16.223.0/24
-
-# peep-bo network
-define PEEP_BO_NET = 10.162.104.0/24
-
-################################
-# port definitions
-################################
-
-#define MX_PORTS = { 25, 110, 143, 465, 587, 993, 995 }
-define WS_PORTS = { 80, 443 }
-
-
-################################
-# reset nftables
-################################
-
-create table inet efg_filter
-create table ip efg_nat
-
-create chain inet efg_filter input { type filter hook input priority 0; policy drop; }
-create chain inet efg_filter forward { type filter hook forward priority 0; policy drop; }
-create chain inet efg_filter output { type filter hook output priority 0; policy drop; }
-create chain ip efg_nat prerouting { type nat hook prerouting priority 0; policy accept; }
-create chain ip efg_nat postrouting { type nat hook postrouting priority 0; policy accept; }
-
-
-################################
-# NAT prerouting rules
-################################
-
-add rule ip efg_nat prerouting \
- ip protocol udp \
- iifname $EXTERNAL_IF \
- ip daddr $PUBLIC_VPN_IP udp dport 1194 \
- counter dnat $VPN_INTERNAL_IP comment "Incoming VPN traffic"
-
-#add rule ip efg_nat prerouting \
-# ip protocol tcp \
-# iifname $EXTERNAL_IF \
-# ip daddr $PUBLIC_MX_IP tcp dport $MX_PORTS \
-# counter dnat $MX_PERIMETER_IP comment "Incoming MX traffic"
-
-add rule ip efg_nat prerouting \
- ip protocol udp \
- iifname $EXTERNAL_IF udp sport 1024-65535 \
- ip daddr $PUBLIC_NS_IP udp dport 53 \
- counter dnat $ENS_PERIMETER_IP comment "Incoming DNS requests (udp)"
-
-add rule ip efg_nat prerouting \
- ip protocol tcp \
- iifname $EXTERNAL_IF tcp sport 1024-65535 \
- ip daddr $PUBLIC_NS_IP tcp dport 53 \
- counter dnat $ENS_PERIMETER_IP comment "Incoming DNS requests (tcp)"
-
-add rule ip efg_nat prerouting \
- ip protocol tcp \
- iifname $EXTERNAL_IF tcp sport 1024-65535 \
- ip daddr $PUBLIC_WS_IP tcp dport $WS_PORTS \
- counter dnat $WS_PERIMETER_IP comment "Incoming http(s) requests"
-
-
-################################
-# FILTER input rules
-################################
-
-add rule inet efg_filter input \
- ct state established \
- ip protocol udp \
- iifname $PERIMETER_IF ip saddr $PNS_PERIMETER_IP udp sport 53 \
- ip daddr $EFG_PERIMETER_IP udp dport 1024-65535 \
- counter accept comment "DNS replies"
-
-add rule inet efg_filter input \
- ip protocol icmp \
- counter accept comment "ICMP"
-
-add rule inet efg_filter input \
- counter log prefix "INPUT"
-
-
-################################
-# FILTER forward rules
-################################
-
-add rule inet efg_filter forward \
- ct state established, related \
- iifname $EXTERNAL_IF \
- oifname $PERIMETER_IF ip daddr $INTERNAL_NETS \
- counter accept comment "Established sessions"
-
-add rule inet efg_filter forward \
- iifname $PERIMETER_IF ip saddr $INTERNAL_NETS \
- oifname $EXTERNAL_IF \
- counter accept comment "Internet access"
-
-add rule inet efg_filter forward \
- ip protocol udp \
- iifname $EXTERNAL_IF \
- oifname $PERIMETER_IF ip daddr $VPN_INTERNAL_IP udp dport 1194 \
- counter accept comment "Incoming VPN traffic"
-
-add rule inet efg_filter forward \
- ip protocol tcp \
- iifname $EXTERNAL_IF tcp sport 1024-65535 \
- oifname $PERIMETER_IF ip daddr $WS_PERIMETER_IP tcp dport $WS_PORTS \
- counter accept comment "Incoming http(s) requests"
-
-add rule inet efg_filter forward \
- ct state established \
- ip protocol tcp \
- iifname $PERIMETER_IF ip saddr $WS_PERIMETER_IP tcp sport $WS_PORTS \
- oifname $EXTERNAL_IF tcp dport 1024-65535 \
- counter accept comment "Outgoing http(s) replies"
-
-add rule inet efg_filter forward \
- ip protocol udp \
- iifname $EXTERNAL_IF udp sport 1024-65535 \
- oifname $PERIMETER_IF ip daddr $ENS_PERIMETER_IP udp dport 53 \
- counter accept comment "Incoming DNS requests/notifications (udp)"
-
-add rule inet efg_filter forward \
- ct state established, related \
- ip protocol udp \
- iifname $PERIMETER_IF ip saddr $ENS_PERIMETER_IP udp sport 53 \
- oifname $EXTERNAL_IF udp dport 1024-65535 \
- counter accept comment "Outgoing DNS replies (udp)"
-
-add rule inet efg_filter forward \
- ip protocol tcp \
- iifname $EXTERNAL_IF tcp sport 1024-65535 \
- oifname $PERIMETER_IF ip daddr $ENS_PERIMETER_IP tcp dport 53 \
- counter accept comment "Incoming DNS requests (tcp)"
-
-add rule inet efg_filter forward \
- ct state established, related \
- ip protocol tcp \
- iifname $PERIMETER_IF ip saddr $ENS_PERIMETER_IP tcp sport 53 \
- oifname $EXTERNAL_IF tcp dport 1024-65535 \
- counter accept comment "Outgoing DNS replies (tcp)"
-
-add rule inet efg_filter forward \
- ip protocol udp \
- iifname $PERIMETER_IF ip saddr { $ENS_PERIMETER_IP, $PNS_PERIMETER_IP } udp sport 1024-65535 \
- oifname $EXTERNAL_IF udp dport 53 \
- counter accept comment "Outgoing DNS requests/notifications (udp)"
-
-add rule inet efg_filter forward \
- ct state established, related \
- ip protocol udp \
- iifname $EXTERNAL_IF udp sport 53 \
- oifname $PERIMETER_IF ip daddr { $ENS_PERIMETER_IP, $PNS_PERIMETER_IP } udp dport 1024-65535 \
- counter accept comment "Incoming DNS replies (udp)"
-
-add rule inet efg_filter forward \
- ip protocol tcp \
- iifname $PERIMETER_IF ip saddr { $ENS_PERIMETER_IP, $PNS_PERIMETER_IP } tcp sport 1024-65535 \
- oifname $EXTERNAL_IF tcp dport 53 \
- counter accept comment "Outgoing DNS requests (tcp)"
-
-add rule inet efg_filter forward \
- ct state established, related \
- ip protocol tcp \
- iifname $EXTERNAL_IF tcp sport 53 \
- oifname $PERIMETER_IF ip daddr { $ENS_PERIMETER_IP, $PNS_PERIMETER_IP } tcp dport 1024-65535 \
- counter accept comment "Incoming DNS replies (tcp)"
-
-add rule inet efg_filter forward \
- ip protocol tcp \
- iifname $PERIMETER_IF ip saddr $WS_PERIMETER_IP tcp sport 1024-65535 \
- oifname $EXTERNAL_IF tcp dport $WS_PORTS \
- counter accept comment "Outgoing let's encrypt requests"
-
-add rule inet efg_filter forward \
- ct state established \
- ip protocol tcp \
- iifname $EXTERNAL_IF tcp sport $WS_PORTS \
- oifname $PERIMETER_IF ip daddr $WS_PERIMETER_IP tcp dport 1024-65535 \
- counter accept comment "Incoming let's encrypt replies"
-
-add rule inet efg_filter forward \
- ip protocol icmp \
- counter accept comment "ICMP"
-
-add rule inet efg_filter forward \
- counter log prefix "FORWARD"
-
-
-################################
-# FILTER output rules
-################################
-
-add rule inet efg_filter output \
- ct state new \
- ip protocol udp \
- ip saddr $EFG_PERIMETER_IP udp sport 1024-65535 \
- oifname $PERIMETER_IF ip daddr $PNS_PERIMETER_IP udp dport 53 \
- counter accept comment "DNS requests"
-
-add rule inet efg_filter output \
- ip protocol icmp \
- counter accept comment "ICMP"
-
-add rule inet efg_filter output \
- counter log prefix "OUTPUT"
-
-
-################################
-# NAT postrouting rules
-################################
-
-add rule ip efg_nat postrouting \
- oifname $EXTERNAL_IF ip saddr $VPN_INTERNAL_IP \
- counter snat $PUBLIC_VPN_IP comment "Outgoing VPN traffic"
-
-add rule ip efg_nat postrouting \
- oifname $EXTERNAL_IF ip saddr $INTERNAL_NETS \
- counter snat $PUBLIC_EFG_IP comment "Outgoing internal traffic"
-
-#add rule ip efg_nat postrouting \
-# oifname $EXTERNAL_IF ip saddr $MX_PERIMETER_IP \
-# counter snat $PUBLIC_MX_IP comment "Outgoing MX traffic"
-
-add rule ip efg_nat postrouting \
- oifname $EXTERNAL_IF ip saddr $ENS_PERIMETER_IP \
- counter snat $PUBLIC_NS_IP comment "Outgoing external DNS traffic"
-
-add rule ip efg_nat postrouting \
- oifname $EXTERNAL_IF ip saddr $PNS_PERIMETER_IP \
- counter snat $PUBLIC_EFG_IP comment "Outgoing perimeter DNS traffic"
-
-add rule ip efg_nat postrouting \
- oifname $EXTERNAL_IF ip saddr $WS_PERIMETER_IP \
- counter snat $PUBLIC_WS_IP comment "Outgoing WS traffic"
+++ /dev/null
-###############################
- chain traversal
- for all tables
-###############################
-
- NETWORK
- |
- ______v_____
- / raw \
- | PREROUTING |
- \____________/
- |
- ________ ______v_____
- / mangle \ / mangle \
- | INPUT |<- | PREROUTING |
- \________/ | \____________/
- | | |
- ____v___ | ______v_____
- / filter \ | / nat \
- | INPUT | | | PREROUTING |
- \________/ | \____________/
- | | |
- ____v____ | ____v___
- | | | / \
- | local | |__/ routing \__________
- | process | \ decision / |
- |_________| \________/ ____v____
- | / mangle \
- ___v____ | FORWARD |
- / \ \_________/
- / routing \ |
- \ decision / ____v____
- \________/ / filter \
- | | FORWARD |
- ____v___ ________ \_________/
- / raw \ / \ |
- | OUTPUT | / routing \ |
- \________/ ->\ decision /<---------
- | | \________/
- ____v___ | |
- / mangle \ | ______v______
- | OUTPUT | | / mangle \
- \________/ | | POSTROUTING |
- | | \_____________/
- ____v___ | |
- / nat \ | ______v______
- | OUTPUT | | / nat \
- \________/ | | POSTROUTING |
- | | \_____________/
- ____v___ | |
- / filter \ | v
- | OUTPUT |-- NETWORK
- \________/
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chown -R root.root $SOURCE_PATH/*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-tar --create \
- --directory=$REAL_PATH \
- --to-stdout \
- install \
- | tar --extract \
- --backup \
- --directory=/ \
- --no-overwrite-dir \
- --strip-components=1 \
- --suffix=.orig
+++ /dev/null
-#!/bin/sh
-
-
-systemctl enable NetworkManager-wait-online.service
-
-systemctl mask wpa_supplicant.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-127.0.0.1 localhost.localdomain localhost localhost4.localdomain4 localhost4
-::1 localhost6.localdomain6 localhost6
-
-192.168.173.254 efg.pm.user.hu efg
+++ /dev/null
-nameserver 192.168.173.174
-domain pm.user.hu
-search pm.user.hu
+++ /dev/null
-include "/etc/nftables/efg.nft"
+++ /dev/null
-net.ipv4.conf.all.forwarding = 1
+++ /dev/null
-lxc.include = /usr/share/lxc/config/common.conf
-
-lxc.arch = x86_64
-lxc.uts.name = ens.pm.user.hu
-lxc.rootfs.path = __CONTAINER_PATH__/rootfs
-lxc.mount.auto = proc:rw sys:ro
-
-lxc.net.0.type = veth
-lxc.net.0.flags = up
-lxc.net.0.link = brh
-lxc.net.0.hwaddr = 02:0c:18:03:ad:40
-
-lxc.autodev = 1
-
-lxc.signal.halt = SIGRTMIN+4
-
-lxc.start.auto = 1
-lxc.start.order = 11
-lxc.start.delay = 3
+++ /dev/null
-BASE_PACKAGES="NetworkManager hostname initscripts iproute iputils rootfiles rsyslog tar vim-minimal"
-SPEC_PACKAGES="bind bind-utils"
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active NetworkManager.service
-NM_RC=$?
-WAITED=0
-while [ $NM_RC -ne 0 ]
-do
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active NetworkManager.service
- NM_RC=$?
-done
-[ $WAITED -eq 1 ] && echo
-
-CONNECTIONS=$(nmcli --terse connection show | wc -l)
-while [ $CONNECTIONS -ne 1 ]
-do
- echo "Number of connections: $CONNECTIONS" >&2
- sleep 1
- CONNECTIONS=$(nmcli --terse connection show | wc -l)
-done
-
-nmcli --terse connection show | grep ':$' >/dev/null
-ALL_CONNECTION_DEVICES_KNOWN=$?
-while [ $ALL_CONNECTION_DEVICES_KNOWN -eq 0 ]
-do
- echo "Not all connection devices are known yet" >&2
- sleep 1
- nmcli --terse connection show | grep ':$' >/dev/null
- ALL_CONNECTION_DEVICES_KNOWN=$?
-done
-
-CONNECTION_LINE=$(nmcli --terse connection show)
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-CONNECTION_DEVICE=$(echo $CONNECTION_LINE | cut -f 4 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id perimeter \
- connection.interface-name $CONNECTION_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "192.168.173.64/24" \
- ipv4.dns "192.168.173.174" \
- ipv4.dns-search "pm.user.hu" \
- ipv4.gateway "192.168.173.254" \
- ipv4.method "manual" \
- ipv4.routes "10.228.0.0/16 192.168.173.1" \
- ipv6.method "ignore" \
- save yes
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active dbus.service
-DBUS_RC=$?
-WAITED=0
-while [ $DBUS_RC -ne 0 ]
-do
- if [ $WAITED -eq 0 ]
- then
- echo -n "Waiting for dbus.service"
- fi
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active dbus.service
- DBUS_RC=$?
-done
-[ $WAITED -ne 0 ] && echo
-timedatectl set-timezone Europe/Budapest
+++ /dev/null
-#!/bin/sh
-
-
-exit 0
-authselect select sssd with-mkhomedir --force
-
-cat >>/etc/openldap/ldap.conf <<EOF
-BASE dc=user,dc=hu
-URI ldap://ldap.usr.user.hu
-EOF
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chown -R root.root $SOURCE_PATH/*
-
-chgrp named $SOURCE_PATH/etc/named.*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chmod 640 $SOURCE_PATH/etc/named.*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-tar --create \
- --directory=$REAL_PATH \
- --to-stdout \
- install \
- | tar --extract \
- --backup \
- --directory=/ \
- --no-overwrite-dir \
- --strip-components=1 \
- --suffix=.orig
+++ /dev/null
-#!/bin/sh
-
-
-sed --in-place=.orig \
- 's/^After=\(.*\)network\.target\(.*\)$/After=\1network-online.target\2/' \
- /usr/lib/systemd/system/named.service
+++ /dev/null
-#!/bin/sh
-
-
-systemctl enable named.service
-systemctl enable NetworkManager-wait-online.service
-
-systemctl mask wpa_supplicant.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-127.0.0.1 localhost.localdomain localhost localhost4.localdomain4 localhost4
-::1 localhost6.localdomain6 localhost6
-
-192.168.173.64 ens.pm.user.hu ens
+++ /dev/null
-//
-// named.conf
-//
-
-options {
- directory "/var/named";
- dump-file "data/cache_dump.db";
- statistics-file "data/named_stats.txt";
- memstatistics-file "data/named_mem_stats.txt";
-
- listen-on port 53 { any; };
- listen-on-v6 port 53 { any; };
-
- allow-query { none; };
- allow-query-cache { none; };
- allow-recursion { none; };
-
- recursion no;
-
- dnssec-enable yes;
- dnssec-validation auto;
-
- random-device "/dev/urandom";
-};
-
-logging {
- channel default_debug {
- file "data/named.run" versions 3 size 5m;
- severity dynamic;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel client_channel {
- file "data/client.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel lame-servers_channel {
- file "data/lame-servers.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel notify_channel {
- file "data/notify.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel queries_channel {
- file "data/queries.log" versions 3 size 5m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel security_channel {
- file "data/security.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel xfer-in_channel {
- file "data/xfer-in.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel xfer-out_channel {
- file "data/xfer-out.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- category default {
- default_syslog;
- default_debug;
- };
- category client {
- client_channel;
- };
- category lame-servers {
- lame-servers_channel;
- };
- category notify {
- notify_channel;
- };
- category queries {
- queries_channel;
- };
- category security {
- security_channel;
- };
- category xfer-in {
- xfer-in_channel;
- };
- category xfer-out {
- xfer-out_channel;
- };
-};
-
-key "primary_ns-external_ns" {
- algorithm hmac-sha256;
- secret "4ekZY173EctYMvyy9XaCAMhB5bpU7gHNTPiJ0m8ajBA=";
-};
-key "peep_bo_ns-user_ns" {
- algorithm hmac-sha256;
- secret "TlqKwJQhMZJ1sfS7eQxJIrGrysvhylWuvIIPLi5dQiw=";
-};
-
-acl primary_ns_key_acl { key "primary_ns-external_ns"; };
-acl peep_bo_ns_key_acl { key "peep_bo_ns-user_ns"; };
-
-masters primary_ns_master { 10.228.109.174 key "primary_ns-external_ns"; };
-masters peep_bo_ns_master { 46.107.213.35 key "peep_bo_ns-user_ns"; };
-
-server 10.228.109.174 { keys { "primary_ns-external_ns"; }; };
-server 195.228.46.236 { keys { "peep_bo_ns-user_ns"; }; };
-
-view "external" {
- match-clients { ! localnets; ! localhost; any; };
-
- allow-query { ! localnets; ! localhost; any; };
- allow-query-cache { none; };
- allow-recursion { none; };
- allow-transfer { none; };
- allow-update { none; };
-
- notify no;
-
- recursion no;
-
- # external zones
- zone "mediacube.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/mediacube.hu.zone";
-
- allow-transfer { peep_bo_ns_key_acl; };
- allow-notify { primary_ns_key_acl; };
- notify explicit;
- also-notify { peep_bo_ns_master; };
- };
- zone "useribm.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/useribm.hu.zone";
-
- allow-transfer { peep_bo_ns_key_acl; };
- allow-notify { primary_ns_key_acl; };
- notify explicit;
- also-notify { peep_bo_ns_master; };
- };
- zone "userrendszerhaz.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/userrendszerhaz.hu.zone";
-
- allow-transfer { peep_bo_ns_key_acl; };
- allow-notify { primary_ns_key_acl; };
- notify explicit;
- also-notify { peep_bo_ns_master; };
- };
-
- # peep-bo zones
- zone "qqcs.org" IN {
- type slave;
- masters { peep_bo_ns_master; };
- file "slaves/qqcs.org.zone.signed";
-
- allow-notify { peep_bo_ns_key_acl; };
- };
- zone "kukucs.org" IN {
- type slave;
- masters { peep_bo_ns_master; };
- file "slaves/kukucs.org.zone.signed";
-
- allow-notify { peep_bo_ns_key_acl; };
- };
-};
+++ /dev/null
-net.ipv6.conf.all.disable_ipv6 = 1
-net.ipv6.conf.svc.disable_ipv6 = 1
+++ /dev/null
-lxc.include = /usr/share/lxc/config/common.conf
-
-lxc.arch = x86_64
-lxc.uts.name = ifg.usr.user.hu
-lxc.rootfs.path = __CONTAINER_PATH__/rootfs
-lxc.mount.auto = proc:rw sys:ro
-
-lxc.net.0.type = phys
-lxc.net.0.flags = up
-lxc.net.0.link = ifg
-
-lxc.net.1.type = veth
-lxc.net.1.flags = up
-lxc.net.1.link = brh
-lxc.net.1.hwaddr = 02:0c:18:03:ad:01
-
-lxc.autodev = 1
-lxc.console.logfile = /tmp/ifg.console.log
-
-lxc.signal.halt = SIGRTMIN+4
-
-lxc.start.auto = 1
-lxc.start.order = 2
-lxc.start.delay = 3
+++ /dev/null
-BASE_PACKAGES="NetworkManager hostname initscripts iproute iputils rootfiles rsyslog tar vim-minimal"
-SPEC_PACKAGES="nftables"
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active NetworkManager.service
-NM_RC=$?
-WAITED=0
-while [ $NM_RC -ne 0 ]
-do
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active NetworkManager.service
- NM_RC=$?
-done
-[ $WAITED -eq 1 ] && echo
-
-# wait for two network connections
-CONNECTION_DEVICES_UP=$(nmcli --terse connection show | grep -v ':$' | wc -l)
-CYCLES_WAITED=0
-while [ $CONNECTION_DEVICES_UP -lt 2 ]
-do
- if [ $CYCLES_WAITED -ge 10 ]
- then
- nmcli connection show
- exit 1
- fi
- sleep 1
- CYCLES_WAITED=$(( $CYCLES_WAITED + 1 ))
- CONNECTION_DEVICES_UP=$(nmcli --terse connection show | grep -v ':$' | wc -l)
-done
-
-CONNECTIONS=$(nmcli --terse connection show | wc -l)
-while [ $CONNECTIONS -gt 0 ]
-do
- CONNECTION_LINE=$(nmcli --terse connection show | head -n 1)
- CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
- nmcli connection delete uuid "$CONNECTION_UUID"
- CONNECTIONS=$(nmcli --terse connection show | wc -l)
-done
-
-INTERNAL_DEVICE=ifg
-PM_DEVICE=eth0
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id internal \
- connection.interface-name $INTERNAL_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "10.228.109.254/16, 192.168.42.254/24, 192.168.43.254/24" \
- ipv4.dns "10.228.109.104, 10.228.109.253" \
- ipv4.dns-search "usr.user.hu" \
- ipv4.method "manual" \
- ipv4.routes "172.16.223.0/24 10.228.109.236, 10.162.104.0/24 10.228.109.236" \
- save yes
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id perimeter \
- connection.interface-name $PM_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "192.168.173.1/24" \
- ipv4.gateway "192.168.173.254" \
- ipv4.method "manual" \
- save yes
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active dbus.service
-DBUS_RC=$?
-WAITED=0
-while [ $DBUS_RC -ne 0 ]
-do
- if [ $WAITED -eq 0 ]
- then
- echo -n "Waiting for dbus.service"
- fi
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active dbus.service
- DBUS_RC=$?
-done
-[ $WAITED -ne 0 ] && echo
-timedatectl set-timezone Europe/Budapest
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(realpath $(dirname $0))
-
-
-nft list ruleset
-nft list ruleset | grep ^table | sed 's/ {$//' | while read TABLE_SPEC
-do
- nft flush $TABLE_SPEC
- nft delete $TABLE_SPEC
-done
-
-nft --echo --file $REAL_PATH/nftables.config
-nft list ruleset >/etc/nftables/ifg.nft
-
-systemctl enable nftables.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-#!/usr/sbin/nft -f
-
-
-################################
-# interface definitions
-################################
-
-# internal interface
-define INTERNAL_IF = ifg
-
-# loopback interface
-define LOOPBACK_IF = lo
-
-# perimeter interface
-define PERIMETER_IF = eth0
-
-################################
-# address definitions
-################################
-
-# loopback address
-define LOOPBACK_IP = 127.0.0.1
-
-# public addresses
-define PUBLIC_EFG_IP = 194.149.40.146
-define PUBLIC_MX_IP = 194.149.40.147
-define PUBLIC_NS_IP = 194.149.40.148
-define PUBLIC_VPN_IP = 194.149.40.149
-define PUBLIC_WS_IP = 194.149.40.150
-define PUBLIC_MINECRAFT_IP = 194.149.40.151
-define PUBLIC_IP_152 = 194.149.40.152
-define PUBLIC_IP_153 = 194.149.40.153
-define PUBLIC_IP_154 = 194.149.40.154
-define PUBLIC_IP_155 = 194.149.40.155
-define PUBLIC_IP_156 = 194.149.40.156
-define PUBLIC_RX300_IP = 194.149.40.157
-define PUBLIC_DL360E_IP = 194.149.40.158
-
-define PUBLIC_IP_194 = 84.2.25.194
-define PUBLIC_IP_195 = 84.2.25.195
-define PUBLIC_IP_196 = 84.2.25.196
-define PUBLIC_IP_197 = 84.2.25.197
-define PUBLIC_IP_198 = 84.2.25.198
-define PUBLIC_IP_199 = 84.2.25.199
-define PUBLIC_IP_200 = 84.2.25.200
-define PUBLIC_IP_201 = 84.2.25.201
-define PUBLIC_IP_202 = 84.2.25.202
-define PUBLIC_IP_203 = 84.2.25.203
-define PUBLIC_IP_204 = 84.2.25.204
-define PUBLIC_IP_205 = 84.2.25.205
-define PUBLIC_IP_206 = 84.2.25.206
-
-# efg address (perimeter network)
-define EFG_PERIMETER_IP = 192.168.173.254
-
-# service address (perimeter network)
-#define SVC_PERIMETER_IP = 192.168.173.253
-
-# transfer web server address (perimeter network)
-define XFR_PERIMETER_IP = 192.168.173.251
-
-# subversion address (perimeter network)
-#define SVN_PERIMETER_IP = 192.168.173.250
-
-# web server address (perimeter network)
-define WS_PERIMETER_IP = 192.168.173.249
-
-# perimeter name server address (perimeter network)
-define PNS_PERIMETER_IP = 192.168.173.174
-
-# external name server address (perimeter network)
-define ENS_PERIMETER_IP = 192.168.173.64
-
-# ifg address (perimeter network)
-define IFG_PERIMETER_IP = 192.168.173.1
-
-# ifg addresses (internal network)
-define IFG_USR_IP = 10.228.109.254
-define IFG_SR_IP = 192.168.42.254
-define IFG_IN_IP = 192.168.43.254
-
-# dvredmine address (internal network)
-define DVREDMINE_INTERNAL_IP = 10.228.62.193
-
-# minicrm address (internal network)
-define MINICRM_INTERNAL_IP = 10.228.109.133
-
-# store address (internal network)
-define STORE_INTERNAL_IP = 10.228.109.250
-
-# service address (internal network)
-define SVC_INTERNAL_IP = 10.228.109.253
-
-# vpn address (internal network)
-define VPN_INTERNAL_IP = 10.228.109.236
-
-# primary name server address (internal network)
-define PNS_INTERNAL_IP = 10.228.109.174
-
-# internal name server address (internal network)
-define INS_INTERNAL_IP = 10.228.109.104
-
-# worksheet address (internal network)
-define WORKSHEET_SR_IP = 192.168.42.248
-
-################################
-# network definitions
-################################
-
-# internal networks
-define USR_NET = 10.228.0.0/16
-define SR_NET = 192.168.42.0/24
-define IN_NET = 192.168.43.0/24
-define INTERNAL_NETS = { $USR_NET, $SR_NET, $IN_NET }
-
-# perimeter network
-define PERIMETER_NET = 192.168.173.0/24
-
-# vpn client network
-define VPN_NET = 172.16.223.0/24
-
-# peep-bo network
-define PEEP_BO_NET = 10.162.104.0/24
-
-################################
-# port definitions
-################################
-
-#define MX_PORTS = { 25, 110, 143, 465, 587, 993, 995 }
-define WS_PORTS = { 80, 443 }
-
-
-################################
-# reset nftables
-################################
-
-create table inet ifg_filter
-create table ip ifg_nat
-
-create chain inet ifg_filter input { type filter hook input priority 0; policy drop; }
-create chain inet ifg_filter forward { type filter hook forward priority 0; policy drop; }
-create chain inet ifg_filter output { type filter hook output priority 0; policy drop; }
-create chain ip ifg_nat prerouting { type nat hook prerouting priority 0; policy accept; }
-
-
-################################
-# NAT prerouting rules
-################################
-
-add rule ip ifg_nat prerouting \
- ip protocol tcp \
- iifname $INTERNAL_IF ip saddr $INTERNAL_NETS tcp sport 1024-65535 \
- ip daddr $PUBLIC_WS_IP tcp dport $WS_PORTS \
- counter dnat $WS_PERIMETER_IP comment "Webserver access"
-
-
-################################
-# FILTER input rules
-################################
-
-add rule inet ifg_filter input \
- ct state established \
- ip protocol udp \
- iifname $INTERNAL_IF ip saddr { $INS_INTERNAL_IP, $SVC_INTERNAL_IP } udp sport 53 \
- ip daddr $IFG_USR_IP udp dport 1024-65535 \
- counter accept comment "DNS replies"
-
-add rule inet ifg_filter input \
- ip protocol icmp \
- counter accept comment "ICMP"
-
-add rule inet ifg_filter input \
- counter log prefix "INPUT"
-
-
-################################
-# FILTER forward rules
-################################
-
-add rule inet ifg_filter forward \
- ct state established, related \
- iifname $PERIMETER_IF \
- oifname $INTERNAL_IF ip daddr $INTERNAL_NETS \
- counter accept comment "Established sessions"
-
-add rule inet ifg_filter forward \
- iifname $INTERNAL_IF ip saddr $INTERNAL_NETS \
- oifname $PERIMETER_IF ip daddr != $PERIMETER_NET \
- counter accept comment "Internet access"
-
-add rule inet ifg_filter forward \
- ct state new, established \
- ip protocol tcp \
- iifname $INTERNAL_IF ip saddr $INTERNAL_NETS tcp sport 1024-65535 \
- oifname $PERIMETER_IF ip daddr $WS_PERIMETER_IP tcp dport $WS_PORTS \
- counter accept comment "Webserver access"
-
-add rule inet ifg_filter forward \
- ct state new \
- ip protocol udp \
- iifname $INTERNAL_IF ip saddr $PNS_INTERNAL_IP udp sport 1024-65535 \
- oifname $PERIMETER_IF ip daddr { $ENS_PERIMETER_IP, $PNS_PERIMETER_IP } udp dport 53 \
- counter accept comment "DNS zone notification"
-
-add rule inet ifg_filter forward \
- ct state new \
- ip protocol tcp \
- iifname $PERIMETER_IF ip saddr { $ENS_PERIMETER_IP, $PNS_PERIMETER_IP } tcp sport 1024-65535 \
- oifname $INTERNAL_IF ip daddr $PNS_INTERNAL_IP tcp dport 53 \
- counter accept comment "DNS zone transfer requests"
-
-add rule inet ifg_filter forward \
- ct state established \
- ip protocol tcp \
- iifname $INTERNAL_IF ip saddr $PNS_INTERNAL_IP tcp sport 53 \
- oifname $PERIMETER_IF ip daddr { $ENS_PERIMETER_IP, $PNS_PERIMETER_IP } tcp dport 1024-65535 \
- counter accept comment "DNS zone transfer replies"
-
-add rule inet ifg_filter forward \
- ip protocol udp \
- iifname $PERIMETER_IF ip saddr != $PERIMETER_NET udp sport 1024-65535 \
- oifname $INTERNAL_IF ip daddr $VPN_INTERNAL_IP udp dport 1194 \
- counter accept comment "Incoming VPN traffic"
-
-add rule inet ifg_filter forward \
- iifname $INTERNAL_IF \
- oifname $INTERNAL_IF \
- counter accept comment "Internal traffic"
-
-add rule inet ifg_filter forward \
- ip protocol tcp \
- iifname $PERIMETER_IF ip saddr $WS_PERIMETER_IP tcp sport 1024-65535 \
- oifname $INTERNAL_IF ip daddr $DVREDMINE_INTERNAL_IP tcp dport 80 \
- counter accept comment "Redmine requests"
-
-add rule inet ifg_filter forward \
- ct state established \
- ip protocol tcp \
- iifname $INTERNAL_IF ip saddr $DVREDMINE_INTERNAL_IP tcp sport 80 \
- oifname $PERIMETER_IF ip daddr $WS_PERIMETER_IP tcp dport 1024-65535 \
- counter accept comment "Redmine replies"
-
-add rule inet ifg_filter forward \
- ip protocol tcp \
- iifname $PERIMETER_IF ip saddr $WS_PERIMETER_IP tcp sport 1024-65535 \
- oifname $INTERNAL_IF ip daddr $MINICRM_INTERNAL_IP tcp dport 8080 \
- counter accept comment "MiniCRM requests"
-
-add rule inet ifg_filter forward \
- ct state established \
- ip protocol tcp \
- iifname $INTERNAL_IF ip saddr $MINICRM_INTERNAL_IP tcp sport 8080 \
- oifname $PERIMETER_IF ip daddr $WS_PERIMETER_IP tcp dport 1024-65535 \
- counter accept comment "MiniCRM replies"
-
-add rule inet ifg_filter forward \
- ip protocol tcp \
- iifname $PERIMETER_IF ip saddr $WS_PERIMETER_IP tcp sport 1024-65535 \
- oifname $INTERNAL_IF ip daddr $WORKSHEET_SR_IP tcp dport 8079 \
- counter accept comment "Worksheet requests"
-
-add rule inet ifg_filter forward \
- ct state established \
- ip protocol tcp \
- iifname $INTERNAL_IF ip saddr $WORKSHEET_SR_IP tcp sport 8079 \
- oifname $PERIMETER_IF ip daddr $WS_PERIMETER_IP tcp dport 1024-65535 \
- counter accept comment "Worksheet replies"
-
-add rule inet ifg_filter forward \
- ip protocol icmp \
- counter accept comment "ICMP"
-
-add rule inet ifg_filter forward \
- counter log prefix "FORWARD"
-
-
-################################
-# FILTER output rules
-################################
-
-add rule inet ifg_filter output \
- ct state new \
- ip protocol udp \
- ip saddr $IFG_USR_IP udp sport 1024-65535 \
- oifname $INTERNAL_IF ip daddr { $INS_INTERNAL_IP, $SVC_INTERNAL_IP } udp dport 53 \
- counter accept comment "DNS requests"
-
-add rule inet ifg_filter output \
- ip protocol icmp \
- counter accept comment "ICMP"
-
-add rule inet ifg_filter output \
- counter log prefix "OUTPUT"
+++ /dev/null
-###############################
- chain traversal
- for all tables
-###############################
-
- NETWORK
- |
- ______v_____
- / raw \
- | PREROUTING |
- \____________/
- |
- ________ ______v_____
- / mangle \ / mangle \
- | INPUT |<- | PREROUTING |
- \________/ | \____________/
- | | |
- ____v___ | ______v_____
- / filter \ | / nat \
- | INPUT | | | PREROUTING |
- \________/ | \____________/
- | | |
- ____v____ | ____v___
- | | | / \
- | local | |__/ routing \__________
- | process | \ decision / |
- |_________| \________/ ____v____
- | / mangle \
- ___v____ | FORWARD |
- / \ \_________/
- / routing \ |
- \ decision / ____v____
- \________/ / filter \
- | | FORWARD |
- ____v___ ________ \_________/
- / raw \ / \ |
- | OUTPUT | / routing \ |
- \________/ ->\ decision /<---------
- | | \________/
- ____v___ | |
- / mangle \ | ______v______
- | OUTPUT | | / mangle \
- \________/ | | POSTROUTING |
- | | \_____________/
- ____v___ | |
- / nat \ | ______v______
- | OUTPUT | | / nat \
- \________/ | | POSTROUTING |
- | | \_____________/
- ____v___ | |
- / filter \ | v
- | OUTPUT |-- NETWORK
- \________/
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chown -R root.root $SOURCE_PATH/*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-tar --create \
- --directory=$REAL_PATH \
- --to-stdout \
- install \
- | tar --extract \
- --backup \
- --directory=/ \
- --no-overwrite-dir \
- --strip-components=1 \
- --suffix=.orig
+++ /dev/null
-#!/bin/sh
-
-
-#systemctl enable iptables.service
-systemctl enable NetworkManager-wait-online.service
-
-systemctl mask wpa_supplicant.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-127.0.0.1 localhost.localdomain localhost localhost4.localdomain4 localhost4
-::1 localhost6.localdomain6 localhost6
-
-10.228.109.254 ifg.usr.user.hu ifg
-192.168.42.254 ifg.sr.user.hu
-192.168.43.254 ifg.in.user.hu
+++ /dev/null
-nameserver 10.228.109.253
-nameserver 10.228.109.104
-domain usr.user.hu
-search usr.user.hu
+++ /dev/null
-include "/etc/nftables/ifg.nft"
+++ /dev/null
-net.ipv4.conf.all.forwarding = 1
+++ /dev/null
-lxc.include = /usr/share/lxc/config/common.conf
-
-lxc.arch = x86_64
-lxc.uts.name = ins.usr.user.hu
-lxc.rootfs.path = __CONTAINER_PATH__/rootfs
-lxc.mount.auto = proc:rw sys:ro
-
-lxc.net.0.type = phys
-lxc.net.0.flags = up
-lxc.net.0.link = ins
-
-lxc.autodev = 1
-
-lxc.signal.halt = SIGRTMIN+4
-
-lxc.start.auto = 1
-lxc.start.order = 22
-lxc.start.delay = 3
+++ /dev/null
-BASE_PACKAGES="NetworkManager hostname initscripts iproute iputils rootfiles rsyslog tar vim-minimal"
-SPEC_PACKAGES="bind bind-utils"
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active NetworkManager.service
-NM_RC=$?
-WAITED=0
-while [ $NM_RC -ne 0 ]
-do
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active NetworkManager.service
- NM_RC=$?
-done
-[ $WAITED -eq 1 ] && echo
-
-CONNECTIONS=$(nmcli --terse connection show | wc -l)
-while [ $CONNECTIONS -ne 1 ]
-do
- echo "Number of connections: $CONNECTIONS" >&2
- sleep 1
- CONNECTIONS=$(nmcli --terse connection show | wc -l)
-done
-
-nmcli --terse connection show | grep ':$' >/dev/null
-ALL_CONNECTION_DEVICES_KNOWN=$?
-while [ $ALL_CONNECTION_DEVICES_KNOWN -eq 0 ]
-do
- echo "Not all connection devices are known yet" >&2
- sleep 1
- nmcli --terse connection show | grep ':$' >/dev/null
- ALL_CONNECTION_DEVICES_KNOWN=$?
-done
-
-CONNECTION_LINE=$(nmcli --terse connection show)
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-CONNECTION_DEVICE=$(echo $CONNECTION_LINE | cut -f 4 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id internal \
- connection.interface-name $CONNECTION_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "10.228.109.104/16" \
- ipv4.dns "10.228.109.253, 10.228.109.104" \
- ipv4.dns-search "usr.user.hu" \
- ipv4.gateway "10.228.109.254" \
- ipv4.method "manual" \
- ipv6.method "ignore" \
- save yes
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active dbus.service
-DBUS_RC=$?
-WAITED=0
-while [ $DBUS_RC -ne 0 ]
-do
- if [ $WAITED -eq 0 ]
- then
- echo -n "Waiting for dbus.service"
- fi
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active dbus.service
- DBUS_RC=$?
-done
-[ $WAITED -ne 0 ] && echo
-timedatectl set-timezone Europe/Budapest
+++ /dev/null
-#!/bin/sh
-
-
-exit 0
-authselect select sssd with-mkhomedir --force
-
-cat >>/etc/openldap/ldap.conf <<EOF
-BASE dc=user,dc=hu
-URI ldap://ldap.usr.user.hu
-EOF
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chown -R root.root $SOURCE_PATH/*
-
-chgrp named $SOURCE_PATH/etc/named.*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chmod 640 $SOURCE_PATH/etc/named.*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-tar --create \
- --directory=$REAL_PATH \
- --to-stdout \
- install \
- | tar --extract \
- --backup \
- --directory=/ \
- --no-overwrite-dir \
- --strip-components=1 \
- --suffix=.orig
+++ /dev/null
-#!/bin/sh
-
-
-systemctl enable named.service
-systemctl enable NetworkManager-wait-online.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-127.0.0.1 localhost.localdomain localhost localhost4.localdomain4 localhost4
-::1 localhost6.localdomain6 localhost6
-
-10.228.109.104 ins.usr.user.hu ins
+++ /dev/null
-//
-// named.conf
-//
-
-options {
- directory "/var/named";
- dump-file "data/cache_dump.db";
- statistics-file "data/named_stats.txt";
- memstatistics-file "data/named_mem_stats.txt";
-
- listen-on port 53 { any; };
- listen-on-v6 port 53 { any; };
-
- allow-query { none; };
- allow-query-cache { none; };
- allow-recursion { none; };
-
- recursion no;
-
- dnssec-enable yes;
- dnssec-validation no;
-};
-
-logging {
- channel default_debug {
- file "data/named.run" versions 3 size 5m;
- severity dynamic;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel client_channel {
- file "data/client.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel lame-servers_channel {
- file "data/lame-servers.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel notify_channel {
- file "data/notify.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel queries_channel {
- file "data/queries.log" versions 3 size 5m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel security_channel {
- file "data/security.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel xfer-in_channel {
- file "data/xfer-in.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel xfer-out_channel {
- file "data/xfer-out.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- category default {
- default_syslog;
- default_debug;
- };
- category client {
- client_channel;
- };
- category lame-servers {
- lame-servers_channel;
- };
- category notify {
- notify_channel;
- };
- category queries {
- queries_channel;
- };
- category security {
- security_channel;
- };
- category xfer-in {
- xfer-in_channel;
- };
- category xfer-out {
- xfer-out_channel;
- };
-};
-
-key "primary_ns-internal_ns" {
- algorithm hmac-sha256;
- secret "fjQyVn7bfGnbbBTgm7CgJSVOttSm9ji7WlVGVgV02Qo=";
-};
-
-acl internal_networks { 10.228.0.0/16; 192.168.42.0/24; 192.168.43.0/24; };
-acl vpn_client_network { 172.16.223.0/24; };
-acl primary_ns_key_acl { key "primary_ns-internal_ns"; };
-
-masters primary_ns_master { 10.228.109.174 key "primary_ns-internal_ns"; };
-
-server 10.228.109.174 { keys { "primary_ns-internal_ns"; }; };
-
-view "internal" {
- match-clients { internal_networks; vpn_client_network; localhost; };
-
- recursion yes;
-
- allow-query { internal_networks; vpn_client_network; localhost; };
- allow-query-cache { internal_networks; vpn_client_network; localhost; };
- allow-recursion { internal_networks; vpn_client_network; localhost; };
-
- allow-notify { primary_ns_key_acl; };
- notify no;
-
- include "/etc/named.rfc1912.zones";
-
- # internal zones
- zone "in.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/in.user.hu.zone";
- };
- zone "43.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/43.168.192.in-addr.arpa.zone";
- };
- zone "sr.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/sr.user.hu.zone";
- };
- zone "42.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/42.168.192.in-addr.arpa.zone";
- };
- zone "usr.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/usr.user.hu.zone";
- };
- zone "228.10.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/228.10.in-addr.arpa.zone";
- };
-
- # perimeter zones
- zone "pm.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/pm.user.hu.zone";
- };
- zone "173.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/173.168.192.in-addr.arpa.zone";
- };
-
- # external zones
- zone "useribm.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/useribm.hu.zone";
- };
- zone "userrendszerhaz.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/userrendszerhaz.hu.zone";
- };
-};
+++ /dev/null
-net.ipv6.conf.all.disable_ipv6 = 1
-net.ipv6.conf.ins.disable_ipv6 = 1
+++ /dev/null
-lxc.include = /usr/share/lxc/config/common.conf
-
-lxc.arch = x86_64
-lxc.uts.name = ldap.usr.user.hu
-lxc.rootfs.path = __CONTAINER_PATH__/rootfs
-lxc.mount.auto = proc:rw sys:ro
-
-lxc.net.0.type = phys
-lxc.net.0.flags = up
-lxc.net.0.link = ldap
-
-lxc.autodev = 1
-
-lxc.signal.halt = SIGRTMIN+4
-
-lxc.start.auto = 1
-lxc.start.order = 24
-lxc.start.delay = 3
+++ /dev/null
-BASE_PACKAGES="NetworkManager hostname initscripts iproute iputils rootfiles rsyslog tar vim-minimal"
-SPEC_PACKAGES="openssh-server openssh-clients openssh-ldap sudo"
-SPEC_PACKAGES="$SPEC_PACKAGES authselect openldap-servers openldap-clients nss-pam-ldapd oddjob-mkhomedir pam_ssh passwd python3 sssd-ldap"
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active NetworkManager.service
-NM_RC=$?
-WAITED=0
-while [ $NM_RC -ne 0 ]
-do
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active NetworkManager.service
- NM_RC=$?
-done
-[ $WAITED -eq 1 ] && echo
-
-CONNECTIONS=$(nmcli --terse connection show | wc -l)
-while [ $CONNECTIONS -ne 1 ]
-do
- echo "Number of connections: $CONNECTIONS" >&2
- sleep 1
- CONNECTIONS=$(nmcli --terse connection show | wc -l)
-done
-
-nmcli --terse connection show | grep ':$' >/dev/null
-ALL_CONNECTION_DEVICES_KNOWN=$?
-while [ $ALL_CONNECTION_DEVICES_KNOWN -eq 0 ]
-do
- echo "Not all connection devices are known yet" >&2
- sleep 1
- nmcli --terse connection show | grep ':$' >/dev/null
- ALL_CONNECTION_DEVICES_KNOWN=$?
-done
-
-CONNECTION_LINE=$(nmcli --terse connection show)
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-CONNECTION_DEVICE=$(echo $CONNECTION_LINE | cut -f 4 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id internal \
- connection.interface-name $CONNECTION_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "10.228.109.252/16" \
- ipv4.dns "10.228.109.104, 10.228.109.253" \
- ipv4.dns-search "usr.user.hu" \
- ipv4.gateway "10.228.109.254" \
- ipv4.method "manual" \
- ipv6.method "ignore" \
- save yes
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active dbus.service
-DBUS_RC=$?
-WAITED=0
-while [ $DBUS_RC -ne 0 ]
-do
- if [ $WAITED -eq 0 ]
- then
- echo -n "Waiting for dbus.service"
- fi
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active dbus.service
- DBUS_RC=$?
-done
-[ $WAITED -ne 0 ] && echo
-timedatectl set-timezone Europe/Budapest
+++ /dev/null
-#!/bin/sh
-set -x
-
-read -n 1 -p "Recreate ldap certificate? y/[n] " -t 5 RECREATE
-if [ "$RECREATE" = "y" ]
-then
- cd /etc/pki/tls/certs
- openssl genrsa -aes128 2048 >tmp.key
- openssl rsa -in tmp.key -out slapd.key
- openssl req -utf8 -new -key slapd.key -out slapd.csr
- openssl x509 -in slapd.csr -out slapd.crt -req -signkey slapd.key -days 3650
- chmod 600 slapd.key
- rm -f slapd.csr tmp.key
-fi
-
-cp -p /etc/pki/tls/certs/slapd.key \
- /etc/pki/tls/certs/slapd.crt \
- /etc/pki/tls/certs/ca-bundle.crt \
- /etc/openldap/certs/
-
-chown ldap.ldap /etc/openldap/certs/slapd.key \
- /etc/openldap/certs/slapd.crt \
- /etc/openldap/certs/ca-bundle.crt
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(realpath $(dirname $0))
-
-
->$REAL_PATH/SEED.txt
->$REAL_PATH/UIDS.txt
-cat $REAL_PATH/USERS.txt | while read LINE
-do
- COMPACT_LINE=$(echo $LINE | sed 's/, /,/g')
- LOGIN=$(echo $COMPACT_LINE | cut -f 1 -d ',')
- LOGIN_MD5SUM=$(echo $LOGIN | md5sum | awk '{print $1}')
- UID_POSITION=30
- UID_IS_UNIQUE=0
- while [ $UID_IS_UNIQUE -eq 0 ]
- do
- LOGIN_UID=$(echo $LOGIN_MD5SUM | cut -c ${UID_POSITION}- | cut -c 1-3)
- grep $LOGIN_UID $REAL_PATH/SEED.txt >/dev/null 2>&1
- if [ $? -eq 1 ]
- then
- INT_UID=$(python3 -c "print(10000 + int('$LOGIN_UID', 16))")
- HEX_UID=$(python3 -c "print(hex($INT_UID))")
- #echo $LOGIN $LOGIN_MD5SUM $LOGIN_UID $INT_UID $HEX_UID
- echo $LOGIN_UID >>$REAL_PATH/SEED.txt
- echo "${INT_UID},${HEX_UID},$COMPACT_LINE" >>$REAL_PATH/UIDS.txt
- UID_IS_UNIQUE=1
- else
- UID_POSITION=$(( $UID_POSITION - 1 ))
- echo "shifted $LOGIN to $UID_POSITION"
- if [ $UID_POSITION -eq 0 ]
- then
- echo "Cannot generate unique uid for $LOGIN" >&2
- exit 1
- fi
- fi
- done
- #echo $LOGIN $LOGIN_UID $INT_UID $LOGIN_MD5SUM
-done
-
->$REAL_PATH/setupusers.ldif
-cat $REAL_PATH/UIDS.txt | while read LINE
-do
- INT_UID=$(echo $LINE | cut -f 1 -d ',')
- HEX_UID=$(echo $LINE | cut -f 2 -d ',')
- LOGIN=$(echo $LINE | cut -f 3 -d ',')
- FIRSTNAME=$(echo $LINE | cut -f 4 -d ',')
- LASTNAME=$(echo $LINE | cut -f 5 -d ',')
- MAIL_ADDRESS=$(echo $LINE | cut -f 6 -d ',')
- MOBILE_NUMBER=$(echo $LINE | cut -f 7 -d ',')
- sed -e "s/__UID__/$INT_UID/" \
- -e "s/__LOGIN__/$LOGIN/" \
- -e "s/__FIRSTNAME__/$FIRSTNAME/" \
- -e "s/__LASTNAME__/$LASTNAME/" \
- -e "s/__MAIL__/$MAIL_ADDRESS/" \
- -e "s/__MOBILE__/$MOBILE_NUMBER/" \
- <$REAL_PATH/user_template.ldif \
- >>$REAL_PATH/setupusers.ldif
-done
+++ /dev/null
-#!/bin/sh
-set -x
-
-REAL_PATH=$(realpath $(dirname $0))
-SLAPD_RUNNING=0
-
-
-while [ $SLAPD_RUNNING -ne 1 ]
-do
- echo -n '.'
- sleep 1
- systemctl --quiet is-active slapd.service
- SLAPD_RUNNING=$(( $? + 1 ))
-done
-
-read -n 1 -p "Recreate ldap database? y/[n] " -t 5 RECREATE
-
-ldapadd -Y EXTERNAL -H ldapi:/// -f $REAL_PATH/setup0config.ldif
-ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
-ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
-ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
-ldapadd -Y EXTERNAL -H ldapi:/// -f /usr/share/doc/openssh-ldap/openssh-lpk-openldap.ldif
-ldapmodify -Y EXTERNAL -H ldapi:/// -f $REAL_PATH/setup1monitor.ldif
-ldapmodify -Y EXTERNAL -H ldapi:/// -f $REAL_PATH/setup2mdb.ldif
-ldapmodify -Y EXTERNAL -H ldapi:/// -f $REAL_PATH/setuptls.ldif
-if [ "$RECREATE" = "y" ]
-then
- ldapadd -x -D cn=Manager,dc=user,dc=hu -w pwd -f $REAL_PATH/setupdomain.ldif
- ldapadd -x -D cn=Manager,dc=user,dc=hu -w pwd -f $REAL_PATH/setupusers.ldif
-fi
-ldapmodify -Y EXTERNAL -H ldapi:/// -f $REAL_PATH/replacerootpw.ldif
-
-if [ "$RECREATE" != "y" ]
-then
- systemctl stop slapd.service
- slapadd -n 2 -l $REAL_PATH/data.ldif
- chown -R ldap.ldap /var/lib/ldap
- systemctl start slapd.service
-fi
-
-authselect select sssd with-mkhomedir --force
-systemctl restart oddjobd.service
-systemctl restart sssd.service
-
-# back up passwords
-#ldapsearch -x -D cn=Manager,dc=user,dc=hu -W -b "ou=People,dc=user,dc=hu" "objectClass=*" userPassword shadowLastChange
-
-# back up openldap
-#slapcat -n 0 >/tmp/config.ldif
-#slapcat -n 2 >/tmp/data.ldif
-
-# restore openldap
-#slapadd -n 0 -F /etc/openldap/slapd.d -l /tmp/config.ldif
-#slapadd -n 2 -F /etc/openldap/slapd.d -l /tmp/data.ldif
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-akosztolanyi, Árpád, Kosztolányi, arpad.kosztolanyi@userrendszerhaz.hu, +36 20 583 7539
-azsamboki, Attila, Zsámboki, attila.zsamboki@userrendszerhaz.hu, +36 20 980 6592
-bcsoka, Barnabás, Csóka, barnabas.csoka@userrendszerhaz.hu, +36 30 939 7023
-csgulyas, Csaba, Gulyás, csaba.gulyas@userrendszerhaz.hu, +36 30 374 4065
-cslevai, Csilla, Lévai, csilla.levai@userrendszerhaz.hu, +36 30 280 8517
-dhorvath, Dénes, Horváth, denes.horvath@userrendszerhaz.hu, +36 30 971 8563
-dvasary, Dániel, Vásáry, daniel.vasary@userrendszerhaz.hu, +36 30 515 9417
-fritter, Ferenc, Ritter, ferenc.ritter@userrendszerhaz.hu, +36 20 937 8022
-fschnell, Ferenc, Schnellbach, ferenc.schnellbach@userrendszerhaz.hu, +36 30 950 2529
-ibartakovics, István, Bartakovics, istvan.bartakovics@userrendszerhaz.hu, +36 30 630 4920
-ifabian, Ildikó, Fábián, ildiko.fabian@userrendszerhaz.hu, +36 30 239 9891
-khorvath, Kálmán, Horváth, kalman.horvath@userrendszerhaz.hu, +36 20 444 8693
-kkele, Károly, Kele, karoly.kele@userrendszerhaz.hu, +36 70 942 2450
-mszabo, Marcell, Szabó, marcell.szabo@userrendszerhaz.hu, +36 70 458 1234
-rrendek, Róbert, Rendek, robert.rendek@userrendszerhaz.hu, +36 30 977 5888
-tlevai, Tibor, Lévai, tibor.levai@userrendszerhaz.hu, +36 30 297 6481
-zbartakovics, Zoltán, Bartakovics, zoltan.bartakovics@userrendszerhaz.hu, +36 30 944 0299
-zfelleg, Zoltán, Felleg, zoltan.felleg@userrendszerhaz.hu, +36 20 954 1513
+++ /dev/null
-temp (pwd): {SSHA}PaJYPlbWfzdt301XlzPy7PhfJkIDohyc
-final : {SSHA}RWEH1A6dxFFVufJrFI5BchIyq3AIAq4I
+++ /dev/null
-dn: olcDatabase={2}mdb,cn=config
-changetype: modify
-replace: olcRootPW
-olcRootPW: {SSHA}RWEH1A6dxFFVufJrFI5BchIyq3AIAq4I
+++ /dev/null
-dn: olcDatabase={0}config,cn=config
-changetype: modify
-add: olcRootPW
-olcRootPW: {SSHA}Qta8GXQLA1k8WpxRd9FQ2qzi3jcJBfob
-
-#dn: cn=config
-#changetype: modify
-#replace: olcLogLevel
-#olcLogLevel: Conns ACL
+++ /dev/null
-dn: olcDatabase={1}monitor,cn=config
-changetype: modify
-replace: olcAccess
-olcAccess: {0}to *
- by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
- by dn.base="cn=Manager,dc=user,dc=hu" read
- by * none
+++ /dev/null
-dn: olcDatabase={2}mdb,cn=config
-changetype: modify
-replace: olcSuffix
-olcSuffix: dc=user,dc=hu
-
-dn: olcDatabase={2}mdb,cn=config
-changetype: modify
-replace: olcRootDN
-olcRootDN: cn=Manager,dc=user,dc=hu
-
-dn: olcDatabase={2}mdb,cn=config
-changetype: modify
-add: olcRootPW
-olcRootPW: {SSHA}PaJYPlbWfzdt301XlzPy7PhfJkIDohyc
-
-dn: olcDatabase={2}mdb,cn=config
-changetype: modify
-add: olcAccess
-olcAccess: {0}to attrs=userPassword
- by dn="cn=Manager,dc=user,dc=hu" write
- by anonymous auth
- by self write
- by * none
-olcAccess: {1}to attrs=shadowLastChange
- by dn="cn=Manager,dc=user,dc=hu" write
- by self write
- by * read
-olcAccess: {2}to dn.base=""
- by * read
-olcAccess: {3}to *
- by dn="cn=Manager,dc=user,dc=hu" write
- by * read
+++ /dev/null
-dn: dc=user,dc=hu
-objectClass: top
-objectClass: dcObject
-objectclass: organization
-o: USER Sytemhouse
-dc: user
-
-dn: cn=Manager,dc=user,dc=hu
-objectClass: organizationalRole
-cn: Manager
-description: Directory Manager
-
-dn: ou=People,dc=user,dc=hu
-objectClass: organizationalUnit
-ou: People
-
-dn: ou=Group,dc=user,dc=hu
-objectClass: organizationalUnit
-ou: Group
+++ /dev/null
-dn: cn=config
-changetype: modify
-add: olcTLSCACertificateFile
-olcTLSCACertificateFile: /etc/openldap/certs/ca-bundle.crt
--
-replace: olcTLSCertificateFile
-olcTLSCertificateFile: /etc/openldap/certs/slapd.crt
--
-replace: olcTLSCertificateKeyFile
-olcTLSCertificateKeyFile: /etc/openldap/certs/slapd.key
+++ /dev/null
-# __LOGIN__
-dn: uid=__LOGIN__,ou=People,dc=user,dc=hu
-objectClass: inetOrgPerson
-objectClass: posixAccount
-objectClass: shadowAccount
-cn: __LOGIN__
-gn: __FIRSTNAME__
-sn: __LASTNAME__
-mail: __MAIL__
-mobile: __MOBILE__
-loginShell: /bin/bash
-uidNumber: __UID__
-gidNumber: __UID__
-homeDirectory: /home/__LOGIN__
-userPassword: {SSHA}Be0QldINCqu8gM+Fii1cR2fpjCzSqEcO
-shadowLastChange: 0
-shadowMax: 3650
-
-dn: cn=__LOGIN__,ou=Group,dc=user,dc=hu
-objectClass: posixGroup
-cn: __LOGIN__
-gidNumber: __UID__
-memberUid: __LOGIN__
-
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-
-chown -R root.root $SOURCE_PATH
-chown -R ldap.ldap $SOURCE_PATH/var/lib/ldap
-
-chgrp ssh_keys $SOURCE_PATH/etc/ssh/*_key
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-
-chmod 600 $SOURCE_PATH/etc/pki/tls/certs/slapd.key
-chmod 400 $SOURCE_PATH/etc/ssh/*_key
-chmod 444 $SOURCE_PATH/etc/ssh/*.pub
-chmod 600 $SOURCE_PATH/etc/sssd/sssd.conf
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-tar --create \
- --directory=$REAL_PATH \
- --to-stdout \
- install \
- | tar --extract \
- --backup \
- --directory=/ \
- --no-overwrite-dir \
- --strip-components=1 \
- --suffix=.orig
+++ /dev/null
-#!/bin/sh
-
-
-systemctl enable oddjobd.service
-systemctl enable slapd.service
-systemctl enable sssd.service
-systemctl enable NetworkManager-wait-online.service
-
-systemctl mask wpa_supplicant.service
+++ /dev/null
-#!/bin/sh
-
-
-echo "AuthorizedKeysCommand /usr/libexec/openssh/ssh-ldap-wrapper" >>/etc/ssh/sshd_config
-echo "AuthorizedKeysCommandUser nobody" >>/etc/ssh/sshd_config
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-127.0.0.1 localhost.localdomain localhost localhost4.localdomain4 localhost4
-::1 localhost6.localdomain6 localhost6
-
-10.228.109.252 ldap.usr.user.hu ldap
+++ /dev/null
-#
-# LDAP Defaults
-#
-
-# See ldap.conf(5) for details
-# This file should be world readable but not world writable.
-
-#BASE dc=example,dc=com
-#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
-
-#SIZELIMIT 12
-#TIMELIMIT 15
-#DEREF never
-
-# When no CA certificates are specified the Shared System Certificates
-# are in use. In order to have these available along with the ones specified
-# by TLS_CACERTDIR one has to include them explicitly:
-#TLS_CACERT /etc/pki/tls/cert.pem
-
-# System-wide Crypto Policies provide up to date cipher suite which should
-# be used unless one needs a finer grinded selection of ciphers. Hence, the
-# PROFILE=SYSTEM value represents the default behavior which is in place
-# when no explicit setting is used. (see openssl-ciphers(1) for more info)
-#TLS_CIPHER_SUITE PROFILE=SYSTEM
-
-# Turning this off breaks GSSAPI used with krb5 when rdns = false
-SASL_NOCANON on
-
-BASE dc=user,dc=hu
-URI ldap://ldap.usr.user.hu
+++ /dev/null
------BEGIN CERTIFICATE-----
-MIIDMjCCAhoCCQC4bVg+Y9rSOjANBgkqhkiG9w0BAQsFADBbMQswCQYDVQQGEwJI
-VTERMA8GA1UEBwwIQnVkYXBlc3QxHjAcBgNVBAoMFVVTRVIgU3lzdGVtaG91c2Ug
-THRkLjEZMBcGA1UEAwwQbGRhcC51c3IudXNlci5odTAeFw0xODEwMDEwOTU0MjJa
-Fw0yODA5MjgwOTU0MjJaMFsxCzAJBgNVBAYTAkhVMREwDwYDVQQHDAhCdWRhcGVz
-dDEeMBwGA1UECgwVVVNFUiBTeXN0ZW1ob3VzZSBMdGQuMRkwFwYDVQQDDBBsZGFw
-LnVzci51c2VyLmh1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAm1g5
-LJtdXNjzxSonx/FH5Mxo3Jx8pYOSjPfkQGMLn7k9hpaZFjlZQlMZURlP3lBntSpz
-7ZUecEpIP1f5Yompk/zdDrAAToLpFoKwhp2sBwlcqgPMw8hi2WD88/jVcigbdQL+
-jhqHtYHXBF4HfwQf5AiJgqnQ+jY8jOKQgwSUsrNKVL/LDRW9rJzGrUwf1k0IYfnL
-/eOhwzJj7aCpFY5cf9cMP1SeBq9UL7tzT2tIGneQLhxb38/aPKYVEP4vZavCW/G1
-B/p0DOXZ9njyy8sOj02vdZN8CIuOqyIOS79rWRkQlXt85httRF+rNOtHg6LqviH6
-ZKsbkjsALnyWj1FnwQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQADOaFtkRiO3pSn
-5BGeWYIPu0iE0ADaZDjMIxd+7fQyMb8jx7S114ylWvdpmQAhUPqDgojW4xrSteR+
-fGIY2ai2ZBoVHgFqhDGcg/iAv/BeblspD81AdYy9/OGLkmNi2nvggmNQ5pEATqAO
-CavZ6DIZp/i1Y2dxKvlnkKFo9jwpZVIqZdFYLsybq9xIcI5L942I0LVYL0Mgyhr0
-3VF1uwxva0apM7yl0KZ/MNcwsJU1s6ObnWyeybNwTnCKlyIStfhV3e3KJ5bHQLaI
-snX6owJIAve99AmVw6aneGu27qlKYbuENYC06K+RuYrbYHRzrjbF5SGEHcLAhFVN
-/Cb2K+qe
------END CERTIFICATE-----
+++ /dev/null
------BEGIN RSA PRIVATE KEY-----
-MIIEogIBAAKCAQEAm1g5LJtdXNjzxSonx/FH5Mxo3Jx8pYOSjPfkQGMLn7k9hpaZ
-FjlZQlMZURlP3lBntSpz7ZUecEpIP1f5Yompk/zdDrAAToLpFoKwhp2sBwlcqgPM
-w8hi2WD88/jVcigbdQL+jhqHtYHXBF4HfwQf5AiJgqnQ+jY8jOKQgwSUsrNKVL/L
-DRW9rJzGrUwf1k0IYfnL/eOhwzJj7aCpFY5cf9cMP1SeBq9UL7tzT2tIGneQLhxb
-38/aPKYVEP4vZavCW/G1B/p0DOXZ9njyy8sOj02vdZN8CIuOqyIOS79rWRkQlXt8
-5httRF+rNOtHg6LqviH6ZKsbkjsALnyWj1FnwQIDAQABAoIBABvNOUZLc/UW+uGx
-frcg7n37O1UoSIKSvpquDtKbJ0xpqaI5t6Irl1bwalqCTjH6b+UTePXvNyhfkviL
-NR22h3vtyF5Fj3h9o1uc/hzJgS0tNsFStsXfShmfawX65bBtjyRs6cPi6aDJYQLu
-FSddRJvaD0osPDNbm5CXR8e6/SXR+zdDsdOTFnnM6KsNqw0SQgNVBoTHIHMGKU//
-SprTYNgP5Jhib4kuUNa+iaNwv/I8BEzooRG+JXJezhtbUecM0poI1izyKhPTlFgx
-KTJ0FmzpPtypOGWnPazt710wIUU/O4dODOKB/J6eF578QkHoOZ4Z0Ykes9p6RWMF
-oPqb07ECgYEAzJKOf6fNWrWjzZksiP6NB5jvfEF3Fb3IyclH3z0cYLJ40DHYehp7
-Qs2/2BikPd4zsZHLCcp08gjlT8LsZQwYdJK4BsQ80xHVsiZY3Gfqm867EJJlnZ7b
-Le1h0iCXmrkh9KeNHeWZdOpttJPo/5kvf9TdNL1dk3VHxXuVy9mBat0CgYEAwmWQ
-Xh3egaIPYNdlPAeK8Q67CrQ0CKriwJMUeyMzU+IhbyRQgus5dWOnvdS0Jt8tT7dA
-thrfWDQCaeSjsXW8vNdQxK9WMZoCYSI5gayu0WmlX9Vcgp1LSxuRkGpJvqdU4SlU
-XGoP7NuIqxvDJ3TiWVV+1nufk74XLhlEKhuG6DUCgYAHQE6iwbzqsTOMLxjABl3T
-Xh1nBx8Ee0SpumO8yvq9hrX3kzy8H0ItPQPG0iDIPJ8SdTuALlf02FHggOVGM6aO
-Q0EYpE4PoTs05F0T+u769Nn2nWnSq3XTa+2iuBsHlfZZKLM80w2cck7PLsr8fF6N
-pmrs2qV9e5O+sUG/BweqVQKBgFfvtaS9gj/F3YsDJMpI5zMwZK/s4HTjSHuwjN0/
-CSLy8gjitoDigzV1BRY8N9o1rruWu/Ekqs+th0H7qYjHJ7+M7v5qCmWZs2XZI4Zj
-ZRlZ3vNBAv4axUqOiAR58C4MZ7sLBRxg5h9RF7u/bUJV/2ZF5ICFn6Qnozi5OTqL
-BTXZAoGAS8bsX6GVqWd/FkBJCqFVbUQcbawQKy0ZVlEIPg06hPtxRcmNZt+dtOWT
-6W/yoer/7oGGUoSHE1y6a5SX0vHOvtkToYy4zUjESaMsa9Wr/DoP9RDkCqUJijxY
-zG3XPCj7maygTKSC77ao2bCyQqKYyjIU80CjmI8X8ybAQIkdgAo=
------END RSA PRIVATE KEY-----
+++ /dev/null
-# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $
-#
-# This is the example configuration file for the OpenSSH
-# LDAP backend
-#
-# see ssh-ldap.conf(5)
-#
-
-# URI with your LDAP server name. This allows to use
-# Unix Domain Sockets to connect to a local LDAP Server.
-uri ldap://127.0.0.1/
-#uri ldaps://127.0.0.1/
-#uri ldapi://%2fvar%2frun%2fldapi_sock/
-# Note: %2f encodes the '/' used as directory separator
-
-# Another way to specify your LDAP server is to provide an
-# host name and the port of our LDAP server. Host name
-# must be resolvable without using LDAP.
-# Multiple hosts may be specified, each separated by a
-# space. How long nss_ldap takes to failover depends on
-# whether your LDAP client library supports configurable
-# network or connect timeouts (see bind_timelimit).
-#host 127.0.0.1
-
-# The port.
-# Optional: default is 389.
-#port 389
-
-# The distinguished name to bind to the server with.
-# Optional: default is to bind anonymously.
-#binddn cn=openssh_keys,dc=example,dc=org
-
-# The credentials to bind with.
-# Optional: default is no credential.
-#bindpw TopSecret
-
-# The distinguished name of the search base.
-#base dc=example,dc=org
-
-# The LDAP version to use (defaults to 3
-# if supported by client library)
-#ldap_version 3
-
-# The search scope.
-#scope sub
-#scope one
-#scope base
-
-# Search timelimit
-#timelimit 30
-
-# Bind/connect timelimit
-#bind_timelimit 30
-
-# Reconnect policy: hard (default) will retry connecting to
-# the software with exponential backoff, soft will fail
-# immediately.
-#bind_policy hard
-
-# SSL setup, may be implied by URI also.
-ssl no
-#ssl on
-#ssl start_tls
-
-# OpenLDAP SSL options
-# Require and verify server certificate (yes/no)
-# Default is to use libldap's default behavior, which can be configured in
-# /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for
-# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
-#tls_checkpeer hard
-
-# CA certificates for server certificate verification
-# At least one of these are required if tls_checkpeer is "yes"
-#tls_cacertfile /etc/ssl/ca.cert
-#tls_cacertdir /etc/pki/tls/certs
-
-# Seed the PRNG if /dev/urandom is not provided
-#tls_randfile /var/run/egd-pool
-
-# SSL cipher suite
-# See man ciphers for syntax
-#tls_ciphers TLSv1
-
-# Client certificate and key
-# Use these, if your server requires client authentication.
-#tls_cert
-#tls_key
-
-# OpenLDAP search_format
-# format used to search for users in LDAP directory using substitution
-# for %u for user name and %f for SSH_Filter option (optional, empty by default)
-#search_format (&(objectclass=%c)(objectclass=ldapPublicKey)(uid=%u)%f)
-
-#AccountClass posixAccount
-
+++ /dev/null
------BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
-1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQRNhyIFsn1XHUZl3cXseM3xVxjVTDL4
-wBFyEQELvVGAEGmxqhETsNPb0xzFGXstoNZkQeBO72huapDROPbs72JXAAAAoLbGMeS2xj
-HkAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBE2HIgWyfVcdRmXd
-xex4zfFXGNVMMvjAEXIRAQu9UYAQabGqEROw09vTHMUZey2g1mRB4E7vaG5qkNE49uzvYl
-cAAAAhALkbjaiJrtAkV7WAjDoFzCcjYavVqLSDWyq549QfKliMAAAAAAECAwQFBgc=
------END OPENSSH PRIVATE KEY-----
+++ /dev/null
-ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBE2HIgWyfVcdRmXdxex4zfFXGNVMMvjAEXIRAQu9UYAQabGqEROw09vTHMUZey2g1mRB4E7vaG5qkNE49uzvYlc=
+++ /dev/null
------BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
-QyNTUxOQAAACAPqi+85zTZURcO07ZEkK/+WbPE0jeqbs5ezIefribFxwAAAIgiYFM1ImBT
-NQAAAAtzc2gtZWQyNTUxOQAAACAPqi+85zTZURcO07ZEkK/+WbPE0jeqbs5ezIefribFxw
-AAAEDv3ANgLBg7Rq+8xAZZLTCknzJn4WtmPtyQ9aqJUqFJMQ+qL7znNNlRFw7TtkSQr/5Z
-s8TSN6puzl7Mh5+uJsXHAAAAAAECAwQF
------END OPENSSH PRIVATE KEY-----
+++ /dev/null
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA+qL7znNNlRFw7TtkSQr/5Zs8TSN6puzl7Mh5+uJsXH
+++ /dev/null
------BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
-NhAAAAAwEAAQAAAQEAl33xHJr1IacdKzig31rgBuKL4kfuvLmXPzHgftSlH0q1r0zMizAE
-aPcXMRHZ5w/TVUegd3qk2tNVQcJSPoqTjOFC2+tTpYYO6uJ7i5iDvP5v2Akm0VlSL3zwdv
-k/TYBwpp3qXtLz4TNhcCjFpup63QgPCVlhZj7WyES4fWstR56ePAyBGydWUkwz1d4pZo8G
-ChrSflt3F9nHcfTkgoZPD5GMQnm521rpL+yeuyUOmkO0DTkh00CP8nm9rhXUN99uGlYxDM
-+lMcNn/1PV/8/BYMzhgeI1qJz10yXwPKQb5fxXdk/6qa4I9AKzscTV23/QAwgmz4bSYlzz
-ypYlt0enEQAAA7h06oRJdOqESQAAAAdzc2gtcnNhAAABAQCXffEcmvUhpx0rOKDfWuAG4o
-viR+68uZc/MeB+1KUfSrWvTMyLMARo9xcxEdnnD9NVR6B3eqTa01VBwlI+ipOM4ULb61Ol
-hg7q4nuLmIO8/m/YCSbRWVIvfPB2+T9NgHCmnepe0vPhM2FwKMWm6nrdCA8JWWFmPtbIRL
-h9ay1Hnp48DIEbJ1ZSTDPV3ilmjwYKGtJ+W3cX2cdx9OSChk8PkYxCebnbWukv7J67JQ6a
-Q7QNOSHTQI/yeb2uFdQ3324aVjEMz6Uxw2f/U9X/z8FgzOGB4jWonPXTJfA8pBvl/Fd2T/
-qprgj0ArOxxNXbf9ADCCbPhtJiXPPKliW3R6cRAAAAAwEAAQAAAQA3Q7aF3PG4CSLW9Z2a
-XaiEWnj1X5B0QLAwWZ2wJxrlw3dsL/QegrHZKOrI994qMNfDsJGVhKRHP/lGOAGQ1zTkm/
-isCblGFRW0ElNHpafJdniOsyf6Dz+wG0AN5vd06nouDkXFuedGLFxLclRIhBm2MI5rtrOV
-fS8VeBxlhIfMLD2QGy6tZytksdqTIf8egAYv5QGn/LAYmjtiXfyWIGwN4LUKV6jeQUz9mk
-P0UzY9VyOwXAthWE43MDM3zllzXF7Yw8vf2EJuOKLzXqbuKzNPAyNrOXMXYHMt2ZlJuy0b
-JThk72tmR7aCiyKOsHxWPjwMad9hBvjV7Kg475UD+WkRAAAAgQCPim2W3nzD8i1mq89jr7
-VkQQWsmKmbeS/cufuHoJ23JqNyoO3dxfRT1GHupBYJXvjwQS9Dt/v2+GTVZa6Ldbx9T1Ew
-COetJS1ZnrTUPbT6fesSuFZnCBDwGjx02bOcPbhDutTMDqCTPh8J45kIpw8U4UynWTIe9w
-ZhObgUeKh2rQAAAIEAyJS2/z7CpwN7gtzRovSuaPFMtxBGlmkHDBa/AA9oCSleoXABMSiI
-GE7Mfl6B3q+ryvLJMNj9ILSfPhBORMvO6RhKVV3qR0hUKuqFxy9p8e8e69N1QoYVgBsEtR
-q+iij76B1cnwsV6wf4kxHKRHmivHATfKFPgZONmr4E9SST4ncAAACBAMFZHe0EdpReZGw4
-ARCyj6fvGLOu3ApM+PreNyVLXETNxvPIsqn1JTAPsMrX/82HKxD78c6nu1Ki0qJ7BuTEBQ
-Rq6SiGjEEaW3skoppOK0md5cj7xNBY7eJFVbVAFmiudQaEbQlorf63jd0ErzIu0xKEi0Kg
-l5RXrm5GsNIiwly3AAAAAAEC
------END OPENSSH PRIVATE KEY-----
+++ /dev/null
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCXffEcmvUhpx0rOKDfWuAG4oviR+68uZc/MeB+1KUfSrWvTMyLMARo9xcxEdnnD9NVR6B3eqTa01VBwlI+ipOM4ULb61Olhg7q4nuLmIO8/m/YCSbRWVIvfPB2+T9NgHCmnepe0vPhM2FwKMWm6nrdCA8JWWFmPtbIRLh9ay1Hnp48DIEbJ1ZSTDPV3ilmjwYKGtJ+W3cX2cdx9OSChk8PkYxCebnbWukv7J67JQ6aQ7QNOSHTQI/yeb2uFdQ3324aVjEMz6Uxw2f/U9X/z8FgzOGB4jWonPXTJfA8pBvl/Fd2T/qprgj0ArOxxNXbf9ADCCbPhtJiXPPKliW3R6cR
+++ /dev/null
-[domain/default]
-id_provider = ldap
-autofs_provider = ldap
-auth_provider = ldap
-chpass_provider = ldap
-ldap_uri = ldap://ldap.usr.user.hu/
-ldap_search_base = dc=user,dc=hu
-ldap_id_use_start_tls = True
-ldap_tls_cacertdir = /etc/openldap/certs
-cache_credentials = True
-ldap_tls_reqcert = allow
-
-[sssd]
-services = nss, pam, autofs
-domains = default
-
-[nss]
-homedir_substring = /home
+++ /dev/null
-net.ipv6.conf.all.disable_ipv6 = 1
-net.ipv6.conf.ldap.disable_ipv6 = 1
+++ /dev/null
-# $OpenLDAP$
-# Example DB_CONFIG file for use with slapd(8) BDB/HDB databases.
-#
-# See the Oracle Berkeley DB documentation
-# <http://www.oracle.com/technology/documentation/berkeley-db/db/ref/env/db_config.html>
-# for detail description of DB_CONFIG syntax and semantics.
-#
-# Hints can also be found in the OpenLDAP Software FAQ
-# <http://www.openldap.org/faq/index.cgi?file=2>
-# in particular:
-# <http://www.openldap.org/faq/index.cgi?file=1075>
-
-# Note: most DB_CONFIG settings will take effect only upon rebuilding
-# the DB environment.
-
-# one 0.25 GB cache
-set_cachesize 0 268435456 1
-
-# Data Directory
-#set_data_dir db
-
-# Transaction Log settings
-set_lg_regionmax 262144
-set_lg_bsize 2097152
-#set_lg_dir logs
-
-# Note: special DB_CONFIG flags are no longer needed for "quick"
-# slapadd(8) or slapindex(8) access (see their -q option).
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(realpath $(dirname $0))
-CONTAINER_NAME=$1
-CONTAINER_ROOTFS=$2
-CONTAINER_SOURCE_PATH=$3
-
-lxc-attach --name=$CONTAINER_NAME -- systemctl stop slapd.service
-lxc-attach --name=$CONTAINER_NAME -- slapcat -n 2 \
- >$CONTAINER_SOURCE_PATH/firstboot/data.ldif
+++ /dev/null
-lxc.include = /usr/share/lxc/config/common.conf
-
-lxc.arch = x86_64
-lxc.uts.name = pns.pm.user.hu
-lxc.rootfs.path = __CONTAINER_PATH__/rootfs
-lxc.mount.auto = proc:rw sys:ro
-
-lxc.net.0.type = veth
-lxc.net.0.flags = up
-lxc.net.0.link = brh
-lxc.net.0.hwaddr = 02:0c:18:03:ad:ae
-
-lxc.autodev = 1
-
-lxc.signal.halt = SIGRTMIN+4
-
-lxc.start.auto = 1
-lxc.start.order = 12
-lxc.start.delay = 3
+++ /dev/null
-BASE_PACKAGES="NetworkManager hostname initscripts iproute iputils rootfiles rsyslog tar vim-minimal"
-SPEC_PACKAGES="bind bind-utils"
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active NetworkManager.service
-NM_RC=$?
-WAITED=0
-while [ $NM_RC -ne 0 ]
-do
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active NetworkManager.service
- NM_RC=$?
-done
-[ $WAITED -eq 1 ] && echo
-
-CONNECTIONS=$(nmcli --terse connection show | wc -l)
-while [ $CONNECTIONS -ne 1 ]
-do
- echo "Number of connections: $CONNECTIONS" >&2
- sleep 1
- CONNECTIONS=$(nmcli --terse connection show | wc -l)
-done
-
-nmcli --terse connection show | grep ':$' >/dev/null
-ALL_CONNECTION_DEVICES_KNOWN=$?
-while [ $ALL_CONNECTION_DEVICES_KNOWN -eq 0 ]
-do
- echo "Not all connection devices are known yet" >&2
- sleep 1
- nmcli --terse connection show | grep ':$' >/dev/null
- ALL_CONNECTION_DEVICES_KNOWN=$?
-done
-
-CONNECTION_LINE=$(nmcli --terse connection show)
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-CONNECTION_DEVICE=$(echo $CONNECTION_LINE | cut -f 4 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id perimeter \
- connection.interface-name $CONNECTION_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "192.168.173.174/24" \
- ipv4.dns "127.0.0.1" \
- ipv4.dns-search "pm.user.hu" \
- ipv4.gateway "192.168.173.254" \
- ipv4.method "manual" \
- ipv4.routes "10.228.0.0/16 192.168.173.1" \
- ipv6.method "ignore" \
- save yes
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active dbus.service
-DBUS_RC=$?
-WAITED=0
-while [ $DBUS_RC -ne 0 ]
-do
- if [ $WAITED -eq 0 ]
- then
- echo -n "Waiting for dbus.service"
- fi
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active dbus.service
- DBUS_RC=$?
-done
-[ $WAITED -ne 0 ] && echo
-timedatectl set-timezone Europe/Budapest
+++ /dev/null
-#!/bin/sh
-
-
-exit 0
-authselect select sssd with-mkhomedir --force
-
-cat >>/etc/openldap/ldap.conf <<EOF
-BASE dc=user,dc=hu
-URI ldap://ldap.usr.user.hu
-EOF
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chown -R root.root $SOURCE_PATH/*
-
-chgrp named $SOURCE_PATH/etc/named.*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chmod 640 $SOURCE_PATH/etc/named.*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-tar --create \
- --directory=$REAL_PATH \
- --to-stdout \
- install \
- | tar --extract \
- --backup \
- --directory=/ \
- --no-overwrite-dir \
- --strip-components=1 \
- --suffix=.orig
+++ /dev/null
-#!/bin/sh
-
-
-sed --in-place=.orig \
- 's/^After=\(.*\)network\.target\(.*\)$/After=\1network-online.target\2/' \
- /usr/lib/systemd/system/named.service
+++ /dev/null
-#!/bin/sh
-
-
-systemctl enable named.service
-systemctl enable NetworkManager-wait-online.service
-
-systemctl mask wpa_supplicant.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-127.0.0.1 localhost.localdomain localhost localhost4.localdomain4 localhost4
-::1 localhost6.localdomain6 localhost6
-
-192.168.173.174 pns.pm.user.hu pns
+++ /dev/null
-//
-// named.conf
-//
-
-options {
- directory "/var/named";
- dump-file "data/cache_dump.db";
- statistics-file "data/named_stats.txt";
- memstatistics-file "data/named_mem_stats.txt";
-
- listen-on port 53 { any; };
- listen-on-v6 port 53 { any; };
-
- allow-query { none; };
- allow-query-cache { none; };
- allow-recursion { none; };
-
- recursion no;
-
- dnssec-enable yes;
- dnssec-validation no;
-};
-
-logging {
- channel default_debug {
- file "data/named.run" versions 3 size 5m;
- severity dynamic;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel client_channel {
- file "data/client.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel lame-servers_channel {
- file "data/lame-servers.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel notify_channel {
- file "data/notify.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel queries_channel {
- file "data/queries.log" versions 3 size 5m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel security_channel {
- file "data/security.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel xfer-in_channel {
- file "data/xfer-in.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel xfer-out_channel {
- file "data/xfer-out.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- category default {
- default_syslog;
- default_debug;
- };
- category client {
- client_channel;
- };
- category lame-servers {
- lame-servers_channel;
- };
- category notify {
- notify_channel;
- };
- category queries {
- queries_channel;
- };
- category security {
- security_channel;
- };
- category xfer-in {
- xfer-in_channel;
- };
- category xfer-out {
- xfer-out_channel;
- };
-};
-
-key "primary_ns-perimeter_ns" {
- algorithm hmac-sha256;
- secret "grOxaoe16BkIW9AVbdWkEjmQptVEGzjfDSzjhhPU3YA=";
-};
-
-acl primary_ns_key_acl { key "primary_ns-perimeter_ns"; };
-
-masters primary_ns_master { 10.228.109.174 key "primary_ns-perimeter_ns"; };
-
-server 10.228.109.174 { keys { "primary_ns-perimeter_ns"; }; };
-
-view "perimeter" {
- match-clients { localnets; localhost; };
-
- allow-query { localnets; localhost; };
- allow-query-cache { localnets; localhost; };
- allow-recursion { localnets; localhost; };
- allow-transfer { none; };
- allow-update { none; };
-
- allow-notify { primary_ns_key_acl; };
- notify no;
-
- recursion yes;
-
- include "/etc/named.rfc1912.zones";
-
- # internal zones
- zone "in.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/in.user.hu.zone";
- };
- zone "43.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/43.168.192.in-addr.arpa.zone";
- };
- zone "sr.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/sr.user.hu.zone";
- };
- zone "42.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/42.168.192.in-addr.arpa.zone";
- };
- zone "usr.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/usr.user.hu.zone";
- };
- zone "228.10.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/228.10.in-addr.arpa.zone";
- };
-
- # perimeter zones
- zone "pm.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/pm.user.hu.zone";
- };
- zone "173.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/173.168.192.in-addr.arpa.zone";
- };
-
- # external zones
- zone "useribm.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/useribm.hu.zone";
- };
- zone "userrendszerhaz.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/userrendszerhaz.hu.zone";
- };
-};
+++ /dev/null
-net.ipv6.conf.all.disable_ipv6 = 1
-net.ipv6.conf.svc.disable_ipv6 = 1
+++ /dev/null
-lxc.include = /usr/share/lxc/config/common.conf
-
-lxc.arch = x86_64
-lxc.uts.name = pns.usr.user.hu
-lxc.rootfs.path = __CONTAINER_PATH__/rootfs
-lxc.mount.auto = proc:rw sys:ro
-
-lxc.net.0.type = phys
-lxc.net.0.flags = up
-lxc.net.0.link = pns
-
-lxc.autodev = 1
-
-lxc.signal.halt = SIGRTMIN+4
-
-lxc.start.auto = 1
-lxc.start.order = 21
-lxc.start.delay = 3
+++ /dev/null
-BASE_PACKAGES="NetworkManager hostname initscripts iproute iputils rootfiles rsyslog tar vim-minimal"
-SPEC_PACKAGES="bind bind-utils"
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active NetworkManager.service
-NM_RC=$?
-WAITED=0
-while [ $NM_RC -ne 0 ]
-do
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active NetworkManager.service
- NM_RC=$?
-done
-[ $WAITED -eq 1 ] && echo
-
-CONNECTIONS=$(nmcli --terse connection show | wc -l)
-while [ $CONNECTIONS -ne 1 ]
-do
- echo "Number of connections: $CONNECTIONS" >&2
- sleep 1
- CONNECTIONS=$(nmcli --terse connection show | wc -l)
-done
-
-nmcli --terse connection show | grep ':$' >/dev/null
-ALL_CONNECTION_DEVICES_KNOWN=$?
-while [ $ALL_CONNECTION_DEVICES_KNOWN -eq 0 ]
-do
- echo "Not all connection devices are known yet" >&2
- sleep 1
- nmcli --terse connection show | grep ':$' >/dev/null
- ALL_CONNECTION_DEVICES_KNOWN=$?
-done
-
-CONNECTION_LINE=$(nmcli --terse connection show)
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-CONNECTION_DEVICE=$(echo $CONNECTION_LINE | cut -f 4 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id internal \
- connection.interface-name $CONNECTION_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "10.228.109.174/16" \
- ipv4.dns "10.228.109.104, 10.228.109.253" \
- ipv4.dns-search "usr.user.hu" \
- ipv4.gateway "10.228.109.254" \
- ipv4.method "manual" \
- ipv6.method "ignore" \
- save yes
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active dbus.service
-DBUS_RC=$?
-WAITED=0
-while [ $DBUS_RC -ne 0 ]
-do
- if [ $WAITED -eq 0 ]
- then
- echo -n "Waiting for dbus.service"
- fi
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active dbus.service
- DBUS_RC=$?
-done
-[ $WAITED -ne 0 ] && echo
-timedatectl set-timezone Europe/Budapest
+++ /dev/null
-#!/bin/sh
-
-
-exit 0
-authselect select sssd with-mkhomedir --force
-
-cat >>/etc/openldap/ldap.conf <<EOF
-BASE dc=user,dc=hu
-URI ldap://ldap.usr.user.hu
-EOF
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chown -R root.root $SOURCE_PATH/*
-
-chgrp named $SOURCE_PATH/etc/named.*
-chgrp -R named $SOURCE_PATH/var/named
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chmod 640 $SOURCE_PATH/etc/named.*
-chmod 640 $SOURCE_PATH/var/named/*.zone
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-tar --create \
- --directory=$REAL_PATH \
- --to-stdout \
- install \
- | tar --extract \
- --backup \
- --directory=/ \
- --no-overwrite-dir \
- --strip-components=1 \
- --suffix=.orig
+++ /dev/null
-#!/bin/sh
-
-
-sed --in-place=.orig \
- 's/^After=\(.*\)network\.target\(.*\)$/After=\1network-online.target\2/' \
- /usr/lib/systemd/system/named.service
+++ /dev/null
-#!/bin/sh
-
-
-systemctl enable named.service
-systemctl enable NetworkManager-wait-online.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-127.0.0.1 localhost.localdomain localhost localhost4.localdomain4 localhost4
-::1 localhost6.localdomain6 localhost6
-
-10.228.109.174 pns.usr.user.hu pns
+++ /dev/null
-//
-// named.conf
-//
-
-options {
- directory "/var/named";
- dump-file "data/cache_dump.db";
- statistics-file "data/named_stats.txt";
- memstatistics-file "data/named_mem_stats.txt";
-
- listen-on port 53 { any; };
- listen-on-v6 port 53 { any; };
-
- allow-query { none; };
- allow-query-cache { none; };
- allow-recursion { none; };
-
- recursion no;
-
- dnssec-enable yes;
- dnssec-validation no;
-};
-
-logging {
- channel default_debug {
- file "data/named.run" versions 3 size 5m;
- severity dynamic;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel client_channel {
- file "data/client.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel lame-servers_channel {
- file "data/lame-servers.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel notify_channel {
- file "data/notify.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel queries_channel {
- file "data/queries.log" versions 3 size 5m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel security_channel {
- file "data/security.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel xfer-in_channel {
- file "data/xfer-in.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel xfer-out_channel {
- file "data/xfer-out.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- category default {
- default_syslog;
- default_debug;
- };
- category client {
- client_channel;
- };
- category lame-servers {
- lame-servers_channel;
- };
- category notify {
- notify_channel;
- };
- category queries {
- queries_channel;
- };
- category security {
- security_channel;
- };
- category xfer-in {
- xfer-in_channel;
- };
- category xfer-out {
- xfer-out_channel;
- };
-};
-
-key "primary_ns-external_ns" {
- algorithm hmac-sha256;
- secret "4ekZY173EctYMvyy9XaCAMhB5bpU7gHNTPiJ0m8ajBA=";
-};
-key "primary_ns-internal_ns" {
- algorithm hmac-sha256;
- secret "fjQyVn7bfGnbbBTgm7CgJSVOttSm9ji7WlVGVgV02Qo=";
-};
-key "primary_ns-perimeter_ns" {
- algorithm hmac-sha256;
- secret "grOxaoe16BkIW9AVbdWkEjmQptVEGzjfDSzjhhPU3YA=";
-};
-
-acl external_ns_ip_acl { 10.228.173.64; };
-acl external_ns_key_acl { key "primary_ns-external_ns"; };
-acl internal_ns_ip_acl { 10.228.109.104; };
-acl internal_ns_svc_key_acl { key "primary_ns-internal_ns"; };
-acl internal_svc_ip_acl { 10.228.109.253; };
-acl perimeter_ns_ip_acl { 10.228.173.253; };
-acl perimeter_ns_key_acl { key "primary_ns-perimeter_ns"; };
-
-masters external_ns_master { 192.168.173.64 key "primary_ns-external_ns"; };
-masters internal_ns_master { 10.228.109.104 key "primary_ns-internal_ns"; };
-masters internal_svc_master { 10.228.109.253 key "primary_ns-internal_ns"; };
-masters perimeter_ns_master { 192.168.173.253 key "primary_ns-perimeter_ns"; };
-
-server 10.228.109.104 { keys { "primary_ns-internal_ns"; }; };
-server 10.228.109.253 { keys { "primary_ns-internal_ns"; }; };
-server 192.168.173.64 { keys { "primary_ns-external_ns"; }; };
-server 192.168.173.253 { keys { "primary_ns-perimeter_ns"; }; };
-
-view "external" {
- match-clients { external_ns_key_acl; };
-
- allow-query { external_ns_key_acl; };
- allow-query-cache { none; };
- allow-recursion { none; };
- allow-update { none; };
- allow-transfer { external_ns_key_acl; };
-
- allow-notify { none; };
- notify explicit;
- also-notify { external_ns_master; };
-
- # external zones
- zone "useribm.hu" IN {
- type master;
- file "useribm.hu.zone";
- };
- zone "userrendszerhaz.hu" IN {
- type master;
- file "userrendszerhaz.hu.zone";
- };
-};
-
-view "internal" {
- match-clients { internal_ns_svc_key_acl; };
-
- allow-query { internal_ns_svc_key_acl; };
- allow-query-cache { none; };
- allow-recursion { none; };
- allow-update { none; };
- allow-transfer { internal_ns_svc_key_acl; };
-
- allow-notify { none; };
- notify explicit;
- also-notify { internal_ns_master; internal_svc_master; };
-
- # internal zones
- zone "in.user.hu" IN {
- type master;
- file "in.user.hu.zone";
- };
- zone "43.168.192.in-addr.arpa" IN {
- type master;
- file "43.168.192.in-addr.arpa.zone";
- };
- zone "sr.user.hu" IN {
- type master;
- file "sr.user.hu.zone";
- };
- zone "42.168.192.in-addr.arpa" IN {
- type master;
- file "42.168.192.in-addr.arpa.zone";
- };
- zone "usr.user.hu" IN {
- type master;
- file "usr.user.hu.zone";
- };
- zone "228.10.in-addr.arpa" IN {
- type master;
- file "228.10.in-addr.arpa.zone";
- };
-
- # perimeter zones
- zone "pm.user.hu" IN {
- type master;
- file "pm.user.hu.zone";
- };
- zone "173.168.192.in-addr.arpa" IN {
- type master;
- file "173.168.192.in-addr.arpa.zone";
- };
-
- # external zones
- zone "useribm.hu" IN {
- type master;
- file "useribm.hu.zone";
- };
- zone "userrendszerhaz.hu" IN {
- type master;
- file "userrendszerhaz.hu.zone";
- };
-};
-
-view "perimeter" {
- match-clients { perimeter_ns_key_acl; };
-
- allow-query { perimeter_ns_key_acl; };
- allow-query-cache { none; };
- allow-recursion { none; };
- allow-update { none; };
- allow-transfer { perimeter_ns_key_acl; };
-
- allow-notify { none; };
- notify explicit;
- also-notify { perimeter_ns_master; };
-
- # internal zones
- zone "in.user.hu" IN {
- type master;
- file "in.user.hu.zone";
- };
- zone "43.168.192.in-addr.arpa" IN {
- type master;
- file "43.168.192.in-addr.arpa.zone";
- };
- zone "sr.user.hu" IN {
- type master;
- file "sr.user.hu.zone";
- };
- zone "42.168.192.in-addr.arpa" IN {
- type master;
- file "42.168.192.in-addr.arpa.zone";
- };
- zone "usr.user.hu" IN {
- type master;
- file "usr.user.hu.zone";
- };
- zone "228.10.in-addr.arpa" IN {
- type master;
- file "228.10.in-addr.arpa.zone";
- };
-
- # perimeter zones
- zone "pm.user.hu" IN {
- type master;
- file "pm.user.hu.zone";
- };
- zone "173.168.192.in-addr.arpa" IN {
- type master;
- file "173.168.192.in-addr.arpa.zone";
- };
-
- # external zones
- zone "useribm.hu" IN {
- type master;
- file "useribm.hu.zone";
- };
- zone "userrendszerhaz.hu" IN {
- type master;
- file "userrendszerhaz.hu.zone";
- };
-};
+++ /dev/null
-net.ipv6.conf.all.disable_ipv6 = 1
-net.ipv6.conf.pns.disable_ipv6 = 1
+++ /dev/null
-$TTL 86400
-@ IN SOA ns.pm.user.hu. hostmaster.mx.pm.user.hu. (
- 2018100901 ; Serial
- 86400 ; Refresh (1 day)
- 7200 ; Retry (2 hours)
- 2419200 ; Expire (4 weeks)
- 3600) ; Minimum (1 hour)
-
-@ IN NS ns.pm.user.hu.
-
-254 IN PTR efg.pm.user.hu.
-253 IN PTR svc.pm.user.hu.
-252 IN PTR oldwww.pm.user.hu.
-251 IN PTR oldxfr.pm.user.hu.
-250 IN PTR whmcs.pm.user.hu.
-
-249 IN PTR ws.pm.user.hu.
-246 IN PTR xfr.pm.user.hu.
-223 IN PTR vc.pm.user.hu.
-193 IN PTR dvredmine.pm.user.hu.
-174 IN PTR pns.pm.user.hu.
-64 IN PTR ens.pm.user.hu.
-
-1 IN PTR ifg.pm.user.hu.
+++ /dev/null
-$TTL 86400
-@ IN SOA ns.usr.user.hu. hostmaster.mx.usr.user.hu. (
- 2019102401 ; Serial
- 86400 ; Refresh (1 day)
- 7200 ; Retry (2 hours)
- 2419200 ; Expire (4 weeks)
- 3600) ; Minimum (1 hour)
- IN NS ns.usr.user.hu.
-
-; 1 2
-; 12345678901234567890123456
-; abcdefghijklmnopqrstuvwxyz
-; 123456789
-
-; ================================================================
-; wifi routers (wr = 23 * 10 + 18 = 248)
-; ================================================================
-196.248 IN PTR archer-c5-sf
-66.248 IN PTR archer-c5-ff
-
-; ================================================================
-; 2N/two n (tn = 20 * 10 + 15 = 215)
-; ================================================================
-196.215 IN PTR tn-phone-sf.usr.user.hu.
-76.215 IN PTR tn-intercom-gf.usr.user.hu.
-66.215 IN PTR tn-phone-ff.usr.user.hu.
-13.215 IN PTR tn-ac.usr.user.hu.
-
-; ================================================================
-; servers (sv = 19 * 10 + 22 = 212)
-; ================================================================
-42.212 IN PTR db2svr.usr.user.hu.
-
-; ================================================================
-; spectrum scale sandbox (ss = 19 * 10 + 19 = 209)
-; ================================================================
-131.209 IN PTR sssbn3.usr.user.hu.
-130.209 IN PTR sssbn2.usr.user.hu.
-129.209 IN PTR sssbn1.usr.user.hu.
-3.209 IN PTR sssan3.usr.user.hu.
-2.209 IN PTR sssan2.usr.user.hu.
-1.209 IN PTR sssan1.usr.user.hu.
-
-; ================================================================
-; sharepoint sandbox (ss = 19 * 10 + 16 = 206)
-; ================================================================
-212.206 IN PTR spstsql.usr.user.hu.
-211.206 IN PTR spstad.usr.user.hu.
-210.206 IN PTR spstsp.usr.user.hu.
-207.206 IN PTR spw2k08sql.usr.user.hu.
-206.206 IN PTR spw2k08sp.usr.user.hu.
-14.206 IN PTR spw2k08ad.usr.user.hu.
-3.206 IN PTR ppitsp.usr.user.hu.
-2.206 IN PTR ppitdb.usr.user.hu.
-1.206 IN PTR ppitad.usr.user.hu.
-
-; ================================================================
-; rrendek (rr = 18 * 10 + 18 = 198)
-; ================================================================
-214.198 IN PTR userdev1.usr.user.hu.
-53.198 IN PTR rredms.usr.user.hu.
-2.198 IN PTR rrwas90.usr.user.hu.
-1.198 IN PTR rrdb2.usr.user.hu.
-
-; ================================================================
-; sandbox (sb = 19 * 10 + 2 = 192)
-; ================================================================
-212.192 IN PTR ssam.usr.user.hu.
-209.192 IN PTR ssam.usr.user.hu.
-207.192 IN PTR spsbsql.usr.user.hu.
-206.192 IN PTR spsb.usr.user.hu.
-204.192 IN PTR tsmddtest.usr.user.hu.
-202.192 IN PTR toolbox.usr.user.hu.
-191.192 IN PTR spsbad.usr.user.hu.
-123.192 IN PTR jenkinswin.usr.user.hu.
-70.192 IN PTR oratest.usr.user.hu.
-44.192 IN PTR mkbdarc2dev.usr.user.hu.
-40.192 IN PTR blobtest.usr.user.hu.
-
-; ================================================================
-; rkonkoly (rk = 18 * 10 + 11 = 191)
-; ================================================================
-1.191 IN PTR rkdominoadmin.usr.user.hu.
-
-; ================================================================
-; redhat gluster storage server sandbox (rs = 18 * 10 + 7 = 187)
-; ================================================================
-3.187 IN PTR rhgssn3.usr.user.hu.
-2.187 IN PTR rhgssn2.usr.user.hu.
-1.187 IN PTR rhgssn1.usr.user.hu.
-
-; ================================================================
-; purebackup (pb = 16 * 10 + 2 = 162)
-; ================================================================
-242.162 IN PTR purebcw2k12.usr.user.hu.
-238.162 IN PTR purebcw2k08.usr.user.hu.
-233.162 IN PTR purebcw2k03.usr.user.hu.
-187.162 IN PTR purebcrhel7.usr.user.hu.
-186.162 IN PTR purebcrhel6.usr.user.hu.
-106.162 IN PTR purebcwdb2105.usr.user.hu.
-105.162 IN PTR purebcldb2105.usr.user.hu.
-97.162 IN PTR purebcldb297.usr.user.hu.
-17.162 IN PTR purebcaix71.usr.user.hu.
-
-; ================================================================
-; network switches (ns = 14 * 10 + 19 = 159)
-; ================================================================
-211.159 IN PTR t1600g-28ts-sfu.usr.user.hu.
-203.159 IN PTR smcgs24c-srm.usr.user.hu.
-202.159 IN PTR t1600g-28ts-sfl.usr.user.hu.
-199.159 IN PTR t1600g-28ts-sri.usr.user.hu.
-195.159 IN PTR smcgs24c-sre.usr.user.hu.
-81.159 IN PTR t1600g-28ts-ffu.usr.user.hu.
-72.159 IN PTR t1600g-28ts-ffl.usr.user.hu.
-
-; ================================================================
-; network printers (np = 14 * 10 + 16 = 156)
-; ================================================================
-106.156 IN PTR infoprint1120.usr.user.hu.
-28.156 IN PTR bizhubc253.usr.user.hu.
-
-; ================================================================
-; mszabo (ms = 13 * 10 + 19 = 149)
-; ================================================================
-243.149 IN PTR msexchange.usr.user.hu.
-212.149 IN PTR msptt4.usr.user.hu.
-211.149 IN PTR msptt3.usr.user.hu.
-210.149 IN PTR msptt2.usr.user.hu.
-209.149 IN PTR msptt1.usr.user.hu.
-184.149 IN PTR msrdnt.usr.user.hu.
-5.149 IN PTR mstsmdtest.usr.user.hu.
-4.149 IN PTR msfhblbtest1.usr.user.hu.
-3.149 IN PTR msfhblbtest1.usr.user.hu.
-2.149 IN PTR msflashtest.usr.user.hu.
-1.149 IN PTR mstsmupgrade.usr.user.hu.
-
-; ================================================================
-; integration toolbox test servers (it = 9 * 10 + 20 = 110)
-; ================================================================
-65.110 IN PTR ittestrhel65.usr.user.hu.
-12.110 IN PTR ittestwin2012.usr.user.hu.
-
-; ================================================================
-; infrastructure servers (is = 9 * 10 + 19 = 109)
-; ================================================================
-254.109 IN PTR ifg.usr.user.hu.
-253.109 IN PTR svc.usr.user.hu.
-252.109 IN PTR ldap.usr.user.hu.
-251.109 IN PTR vpnvm.usr.user.hu.
-250.109 IN PTR store.usr.user.hu.
-249.109 IN PTR tsm.usr.user.hu.
-
-236.109 IN PTR vpn.usr.user.hu.
-
-193.109 IN PTR isc.usr.user.hu.
-
-174.109 IN PTR pns.usr.user.hu.
-
-133.109 IN PTR minicrm.usr.user.hu.
-
-109.109 IN PTR iscbe.usr.user.hu.
-
-104.109 IN PTR ins.usr.user.hu.
-
-52.109 IN PTR cvm.usr.user.hu.
-
-51.109 IN PTR winadk.usr.user.hu.
-
-; ================================================================
-; infrastructure management (im = 9 * 10 + 13 = 103)
-; ================================================================
-246.103 IN PTR v5010svc2.usr.user.hu.
-245.103 IN PTR v5010svc1.usr.user.hu.
-227.103 IN PTR v5010b.usr.user.hu.
-225.103 IN PTR v5010.usr.user.hu.
-5.103 IN PTR vhost5xcc.usr.user.hu.
-4.103 IN PTR vhost4xcc.usr.user.hu.
-3.103 IN PTR vhost3imm.usr.user.hu.
-2.103 IN PTR vhost2imm.usr.user.hu.
-1.103 IN PTR vhost1imm.usr.user.hu.
-
-; ================================================================
-; hypervisor management (hm = 8 * 10 + 13 = 93)
-; ================================================================
-67.93 IN PTR vcsa67.usr.user.hu.
-65.93 IN PTR vcsa65.usr.user.hu.
-5.93 IN PTR vhost5.usr.user.hu.
-4.93 IN PTR vhost4.usr.user.hu.
-3.93 IN PTR vhost3.usr.user.hu.
-2.93 IN PTR vhost2.usr.user.hu.
-1.93 IN PTR vhost1.usr.user.hu.
-
-; ================================================================
-; infrastructure backup servers (ib = 9 * 10 + 2 = 92)
-; ================================================================
-52.92 IN PTR cvmb.usr.user.hu.
-
-; ================================================================
-; fuge (fu = 6 * 10 + 21 = 81)
-; ================================================================
-2.81 IN PTR fuonyffilenet.usr.user.hu.
-1.81 IN PTR futmp.usr.user.hu.
-
-; ================================================================
-; fschnell (fs = 6 * 10 + 19 = 79)
-; ================================================================
-249.79 IN PTR fsws.usr.user.hu.
-92.79 IN PTR fs-iibv10.usr.user.hu.
-84.79 IN PTR fsmq8004.usr.user.hu.
-80.79 IN PTR fsmq80.usr.user.hu.
-75.79 IN PTR fsmq75.usr.user.hu.
-70.79 IN PTR fsmq70.usr.user.hu.
-
-; ================================================================
-; fritter (fr = 6 * 10 + 18 = 78)
-; ================================================================
-206.78 IN PTR frsppapp.usr.user.hu.
-71.78 IN PTR frtsm71.usr.user.hu.
-37.78 IN PTR frtsmc7.usr.user.hu.
-12.78 IN PTR frtsm12.usr.user.hu.
-
-; ================================================================
-; fpga development (fd = 6 * 10 + 4 = 64)
-; ================================================================
-219.64 IN PTR fdthinkstation.usr.user.hu.
-123.64 IN PTR fdlc922.usr.user.hu.
-122.64 IN PTR fdlc922bmc.usr.user.hu.
-
-; ================================================================
-; dvasary (dv = 4 * 10 + 22 = 62)
-; ================================================================
-193.62 IN PTR dvredmine.usr.user.hu.
-70.62 IN PTR dvedmstest.usr.user.hu.
-32.62 IN PTR dvaviglion.usr.user.hu.
-
-; ================================================================
-; desktops (dt = 4 * 10 + 20 = 60)
-; ================================================================
-$GENERATE 1-9 $.60 IN PTR desktop00$.usr.user.hu.
-$GENERATE 10-99 $.60 IN PTR desktop0$.usr.user.hu.
-$GENERATE 100-254 $.60 IN PTR desktop$.usr.user.hu.
-
-; ================================================================
-; dhcp clients (dc = 4 * 10 + 3 = 43)
-; ================================================================
-$GENERATE 1-9 $.43 IN PTR dhcp00$.usr.user.hu.
-$GENERATE 10-99 $.43 IN PTR dhcp0$.usr.user.hu.
-$GENERATE 100-254 $.43 IN PTR dhcp$.usr.user.hu.
-
-; ================================================================
-; old sr (192.168.42.0) static dhcp clients
-; ================================================================
-246.42 IN PTR ads.usr.user.hu.
-245.42 IN PTR spelive.usr.user.hu.
-236.42 IN PTR datacap-rr.usr.user.hu.
-231.42 IN PTR testcibod9.usr.user.hu.
-208.42 IN PTR rtc4.usr.user.hu.
-207.42 IN PTR vmbkp.usr.user.hu.
-206.42 IN PTR mqsvr.usr.user.hu.
-205.42 IN PTR mqback.usr.user.hu.
-204.42 IN PTR mqfiles.usr.user.hu.
-203.42 IN PTR azsamboki01.usr.user.hu.
-194.42 IN PTR csldallianz.usr.user.hu.
-190.42 IN PTR tsmmon-p.usr.user.hu.
-189.42 IN PTR tsmmon-s.usr.user.hu.
-188.42 IN PTR accounting.usr.user.hu.
-185.42 IN PTR jenkinslnx.usr.user.hu.
-184.42 IN PTR jenkinstst.usr.user.hu.
-180.42 IN PTR ssam71.usr.user.hu.
-
-; ================================================================
-; azsamboki (az = 1 * 10 + 26 = 36)
-; ================================================================
-209.36 IN PTR azsssam.usr.user.hu.
-194.36 IN PTR azsssamdev.usr.user.hu.
-146.36 IN PTR azsnfs.usr.user.hu.
-88.36 IN PTR azsgpfs2.usr.user.hu.
-87.36 IN PTR azsgpfs1.usr.user.hu.
-86.36 IN PTR azsgpfs.usr.user.hu.
-
-; ================================================================
-; capi development (cd = 3 * 10 + 4 = 34)
-; ================================================================
-233.34 IN PTR cdvm.usr.user.hu.
-202.34 IN PTR cdsmartlynq.usr.user.hu.
-25.34 IN PTR cds822p4.usr.user.hu.
-24.34 IN PTR cds822p3.usr.user.hu.
-23.34 IN PTR cds822p2.usr.user.hu.
-22.34 IN PTR cds822p1.usr.user.hu.
-22.34 IN PTR cds822.usr.user.hu.
-2.34 IN PTR cds822hmc2.usr.user.hu.
-1.34 IN PTR cds822hmc1.usr.user.hu.
-
-; ================================================================
-; akosztolanyi (ak = 1 * 10 + 11 = 21)
-; ================================================================
-143.21 IN PTR akmacmini.usr.user.hu.
-1.21 IN PTR akminecraft.usr.user.hu.
-
-; ================================================================
-; artificial intelligence (ai = 1 * 10 + 9 = 19)
-; ================================================================
-13.19 IN PTR aiac922.usr.user.hu.
-12.19 IN PTR aiac922bmc.usr.user.hu.
-10.19 IN PTR aiac922icell.usr.user.hu.
-9.19 IN PTR aiac922icellbmc.usr.user.hu.
-
-; ================================================================
-; acsiba (ac = 1 * 10 + 3 = 13)
-; ================================================================
-18.13 IN PTR acubuntu1804.usr.user.hu.
-14.13 IN PTR acubuntu14.usr.user.hu.
-11.13 IN PTR acopensuse11.usr.user.hu.
-10.13 IN PTR acwin10.usr.user.hu.
-5.13 IN PTR accentos5.usr.user.hu.
-
-; ================================================================
-; zfelleg (zf = 26 * 10 + 6 (mod 256) = 10)
-; ================================================================
-249.10 IN PTR zfws.usr.user.hu.
-236.10 IN PTR zfvpn.usr.user.hu.
-234.10 IN PTR zfwd.usr.user.hu.
-223.10 IN PTR zfvc.usr.user.hu.
-149.10 IN PTR zfmssql.usr.user.hu.
-140.10 IN PTR zfdl380eilo.usr.user.hu.
-138.10 IN PTR zfdl360eilo.usr.user.hu.
-102.10 IN PTR zfilo.usr.user.hu.
-90.10 IN PTR zfdl380e.usr.user.hu.
-88.10 IN PTR zfdl360e.usr.user.hu.
-86.10 IN PTR zfhfe.usr.user.hu.
-48.10 IN PTR zfdevrhel8b.usr.user.hu.
-47.10 IN PTR zfdevrhel7.usr.user.hu.
-28.10 IN PTR zfbldw2k08.usr.user.hu.
-27.10 IN PTR zfbldrhel7.usr.user.hu.
-26.10 IN PTR zfbldrhel6.usr.user.hu.
-22.10 IN PTR zfboinc2.usr.user.hu.
-21.10 IN PTR zfboinc1.usr.user.hu.
-20.10 IN PTR zfwin2k.usr.user.hu.
-7.10 IN PTR zfwin7.usr.user.hu.
-3.10 IN PTR zfryzen.usr.user.hu.
-2.10 IN PTR zfblu-r1-hd.usr.user.hu.
+++ /dev/null
-$TTL 86400
-@ IN SOA svc.sr.user.hu. hostmaster.svc.sr.user.hu. (
- 2019012801 ; Serial
- 86400 ; Refresh (1 day)
- 7200 ; Retry (2 hours)
- 2419200 ; Expire (4 weeks)
- 3600) ; Minimum (1 hour)
- IN NS ns.sr.user.hu.
-
-253 IN PTR sr.user.hu.
-
-254 IN PTR ipg.sr.user.hu.
-253 IN PTR svc.sr.user.hu.
-252 IN PTR management.sr.user.hu.
-251 IN PTR vpn.sr.user.hu.
-250 IN PTR store.sr.user.hu.
-249 IN PTR domino.sr.user.hu.
-248 IN PTR worksheet.sr.user.hu.
-247 IN PTR kbsvr.sr.user.hu.
-246 IN PTR ads.sr.user.hu.
-245 IN PTR spelive.sr.user.hu.
-244 IN PTR splive.sr.user.hu.
-243 IN PTR ccsvr.sr.user.hu.
-242 IN PTR sg-1.sr.user.hu. ; shellinabox szerver
-241 IN PTR kickstart.sr.user.hu.
-240 IN PTR verbatsm.sr.user.hu.
-239 IN PTR db2svr.sr.user.hu.
-238 IN PTR sp2010test.sr.user.hu.
-
-236 IN PTR datacap-rr.sr.user.hu.
-235 IN PTR tsm55.sr.user.hu.
-234 IN PTR imrtest.sr.user.hu.
-233 IN PTR sza.sr.user.hu.
-232 IN PTR project.sr.user.hu.
-231 IN PTR testcibod.sr.user.hu.
-230 IN PTR jazzserver.sr.user.hu. ;srevesz
-229 IN PTR netmon.sr.user.hu.
-228 IN PTR test.sr.user.hu.
-;227 IN PTR vcsvr51.sr.user.hu.
-
-
-224 IN PTR erstehit.sr.user.hu.
-223 IN PTR wiki.sr.user.hu.
-222 IN PTR xp-22.sr.user.hu.
-221 IN PTR xp-21.sr.user.hu.
-220 IN PTR xp-20.sr.user.hu.
-219 IN PTR xp-19.sr.user.hu.
-218 IN PTR xp-18.sr.user.hu.
-217 IN PTR xp-17.sr.user.hu.
-216 IN PTR xp-16.sr.user.hu.
-215 IN PTR xp-15.sr.user.hu.
-214 IN PTR xp-14.sr.user.hu.
-213 IN PTR xp-13.sr.user.hu.
-212 IN PTR xp-12.sr.user.hu.
-211 IN PTR xp-11.sr.user.hu.
-210 IN PTR xp-10.sr.user.hu.
-209 IN PTR xp-template.sr.user.hu.
-208 IN PTR rtc.sr.user.hu.
-207 IN PTR vmbkp.sr.user.hu.
-206 IN PTR mqsvr.sr.user.hu.
-205 IN PTR mqback.sr.user.hu.
-204 IN PTR mqfiles.sr.user.hu.
-203 IN PTR azsamboki01.sr.user.hu.
-202 IN PTR praxis.sr.user.hu.
-;201 IN PTR ds5020b.sr.user.hu.
-;200 IN PTR ds5020a.sr.user.hu.
-
-
-;197 IN PTR vtlstgb.sr.user.hu.
-;196 IN PTR vtlstga.sr.user.hu.
-195 IN PTR lto.sr.user.hu.
-194 IN PTR csldallianz.sr.user.hu.
-193 IN PTR store-old.sr.user.hu.
-192 IN PTR fcsw1.sr.user.hu.
-191 IN PTR fcsw0.sr.user.hu.
-190 IN PTR tsmmonp.sr.user.hu.
-189 IN PTR tsmmons.sr.user.hu.
-188 IN PTR accounting.sr.user.hu.
-185 IN PTR jenkinslnx.sr.user.hu.
-184 IN PTR jenkinstst.sr.user.hu.
-183 IN PTR jenkinswin.sr.user.hu.
-182 IN PTR jenkinsaix.sr.user.hu.
-181 IN PTR magdevdc.sr.user.hu.
-180 IN PTR ssam71.sr.user.hu.
-174 IN PTR dominoadmin.sr.user.hu.
-
-173 IN PTR tsmclustera.sr.user.hu.
-172 IN PTR tsmclusterb.sr.user.hu.
-171 IN PTR tsmcluster.sr.user.hu.
-
-162 IN PTR cwdba.sr.user.hu.
-161 IN PTR cwdbb.sr.user.hu.
-160 IN PTR cwbina.sr.user.hu.
-159 IN PTR cwbinb.sr.user.hu.
-
-158 IN PTR win-7-base.sr.user.hu.
-157 IN PTR win-7-thinapp.sr.user.hu.
-148 IN PTR win-7-20.sr.user.hu.
-147 IN PTR win-7-19.sr.user.hu.
-146 IN PTR win-7-18.sr.user.hu.
-145 IN PTR win-7-17.sr.user.hu.
-144 IN PTR win-7-16.sr.user.hu.
-143 IN PTR win-7-15.sr.user.hu.
-142 IN PTR win-7-14.sr.user.hu.
-141 IN PTR win-7-13.sr.user.hu.
-140 IN PTR win-7-12.sr.user.hu.
-139 IN PTR win-7-11.sr.user.hu.
-138 IN PTR win-7-10.sr.user.hu.
-137 IN PTR win-7-09.sr.user.hu.
-136 IN PTR win-7-08.sr.user.hu.
-135 IN PTR win-7-07.sr.user.hu.
-134 IN PTR win-7-06.sr.user.hu.
-133 IN PTR win-7-05.sr.user.hu.
-132 IN PTR win-7-04.sr.user.hu.
-131 IN PTR win-7-03.sr.user.hu.
-130 IN PTR win-7-02.sr.user.hu.
-129 IN PTR win-7-01.sr.user.hu.
-
-116 IN PTR jobworker.sr.user.hu. ; job worker dvasary
-115 IN PTR jobengine.sr.user.hu. ; job engine dvasary
-114 IN PTR astronfw.sr.user.hu. ; firewall for Astron
-113 IN PTR wasng.sr.user.hu. ; syslog-ng WAS
-112 IN PTR slng.sr.user.hu. ; syslog-ng
-111 IN PTR nimol.sr.user.hu. ; nimol teszt / temp / zsoos
-110 IN PTR lajos.sr.user.hu. ; zsamboki AIX p550
-109 IN PTR vtl.sr.user.hu. ; zsamboki vtl ts7520
-108 IN PTR gpfs02.sr.user.hu. ; zsamboki
-107 IN PTR gpfs01.sr.user.hu. ; zsamboki
-106 IN PTR redhat.sr.user.hu. ; zsamboki
-105 IN PTR ubuntu.sr.user.hu. ; zsamboki
-104 IN PTR mssql.sr.user.hu. ; zsamboki
-103 IN PTR exchsrv2.sr.user.hu. ; zsamboki
-102 IN PTR exchsrv.sr.user.hu. ; zsamboki
-101 IN PTR exchdc.sr.user.hu. ; zsamboki
-100 IN PTR sptest.sr.user.hu.
-99 IN PTR director.sr.user.hu. ; IBM Systems Director
-97 IN PTR tpc.sr.user.hu. ; tivoli prod. cent. zsamboki
-96 IN PTR nas1.sr.user.hu. ; netapp test stg
-95 IN PTR nas2.sr.user.hu. ; netapp test stg
-94 IN PTR nas3.sr.user.hu. ; netapp test stg
-
-; HACMP zsamboki
-93 IN PTR hacmp61.sr.user.hu. ; HACMP node1 zsamboki
-92 IN PTR hacmp62.sr.user.hu. ; HACMP node2 zsamboki
-91 IN PTR ha1.sr.user.hu. ; HACMP app 1 zsamboki
-90 IN PTR ha2.sr.user.hu. ; HACMP app 2 zsamboki
-; HACMP zsamboki
-
-89 IN PTR kofax1.sr.user.hu.
-88 IN PTR kofax2.sr.user.hu.
-87 IN PTR kofax3.sr.user.hu.
-86 IN PTR tfsproxy.sr.user.hu.
-85 IN PTR wpar01.sr.user.hu. ; WPAR Application Mobility Zsamboki
-84 IN PTR spatial.sr.user.hu. ; mszabo, spatial teszt
-83 IN PTR kofaxcluster.sr.user.hu.
-82 IN PTR kofaxclusterfs.sr.user.hu.
-81 IN PTR kofaxclustersrv.sr.user.hu.
-80 IN PTR kofaxid1.sr.user.hu.
-79 IN PTR kofaxid2.sr.user.hu.
-78 IN PTR kofaxid.sr.user.hu.
-77 IN PTR kofaxidfs.sr.user.hu.
-76 IN PTR kofaxidcluster.sr.user.hu.
-
-; HACMP zsamboki
-75 IN PTR mirror1.sr.user.hu. ; PowerHA 7.1 zsamboki
-74 IN PTR mirror2.sr.user.hu. ; PowerHA 7.1 zsamboki
-73 IN PTR mirrorapp1.sr.user.hu. ; PowerHA 7.1 zsamboki
-; HACMP zsamboki
-72 IN PTR mavirnim.sr.user.hu. ; MAVIR NIM restore test
-
-68 IN PTR boinc4.sr.user.hu. ; boinc 4 (zfelleg)
-67 IN PTR boinc3.sr.user.hu. ; boinc 3 (zfelleg)
-66 IN PTR boinc2.sr.user.hu. ; boinc 2 (zfelleg)
-65 IN PTR boinc1.sr.user.hu. ; boinc 1 (zfelleg)
-64 IN PTR win2k8r2.sr.user.hu. ; Windows 2008 R2 Server Template Imagehez, szmarcell
-63 IN PTR edmstest.sr.user.hu. ; EDMS Test Server Robinak, szmarcell
-62 IN PTR pftsm1.sr.user.hu. ; PureFlex szerver
-61 IN PTR pftsm2.sr.user.hu. ; PureFlex szerver
-60 IN PTR pftsm3.sr.user.hu. ; PureFlex szerver
-59 IN PTR pftws1.sr.user.hu. ; PureFlex szerver
-58 IN PTR pfsd1.sr.user.hu. ; PureFlex szerver
-57 IN PTR pfitm1.sr.user.hu. ; PureFlex szerver
-56 IN PTR pfbes1.sr.user.hu. ; PureFlex szerver
-55 IN PTR pfwinc1.sr.user.hu. ; PureFlex szerver
-54 IN PTR pflinc1.sr.user.hu. ; PureFlex szerver
-53 IN PTR tsmapiw.sr.user.hu. ; TSM API teszt szerver
-52 IN PTR tsmapil.sr.user.hu. ; TSM API teszt szerver
-51 IN PTR tfs.sr.user.hu. ; TFS verziokezelo, VasaryD, RendekR
-
-; A 30-39 tartomanyt is foglalom tovabbi LPAR-oknak, zsoos
-39 IN PTR fhbws.sr.user.hu. ; FHB WebSphere test
-38 IN PTR fhbws4.sr.user.hu. ; FHB WebSphere test
-37 IN PTR prxy.sr.user.hu. ; astron
-36 IN PTR build61w.sr.user.hu. ; WPAR a build61-en
-35 IN PTR fhbws3.sr.user.hu. ; FHB WebSphere test
-34 IN PTR fhbws2.sr.user.hu. ; FHB WebSphere test
-33 IN PTR fhbws1.sr.user.hu. ; FHB WebSphere test
-32 IN PTR nim.sr.user.hu.
-31 IN PTR vio2.sr.user.hu.
-28 IN PTR db2t.sr.user.hu.
-;27 IN PTR tst1.sr.user.hu.
-27 IN PTR build71.sr.user.hu.
-26 IN PTR build61.sr.user.hu.
-25 IN PTR build53.sr.user.hu.
-24 IN PTR tsm.sr.user.hu.
-21 IN PTR vio1.sr.user.hu.
-20 IN PTR hmc.sr.user.hu. ; hmc
-19 IN PTR fhbwsc2.sr.user.hu. ; FHB WebSphere test
-5 IN PTR orasrv.sr.user.hu. ; Oracle (srevesz)
-4 IN PTR dhcp4.sr.user.hu. ; DHCP address 4
-3 IN PTR dhcp3.sr.user.hu. ; DHCP address 3
-2 IN PTR dhcp2.sr.user.hu. ; DHCP address 2
-1 IN PTR dhcp1.sr.user.hu. ; DHCP address 1
+++ /dev/null
-$TTL 86400
-@ IN SOA svc.in.user.hu. hostmaster.svc.in.user.hu. (
- 2018012301 ; Serial
- 86400 ; Refresh (1 day)
- 7200 ; Retry (2 hours)
- 2419200 ; Expire (4 weeks)
- 3600) ; Minimum (1 hour)
- IN NS ns.in.user.hu.
-
-254 IN PTR ifg.in.user.hu.
-253 IN PTR svc.in.user.hu.
-;251 IN PTR smcez2.in.user.hu.
-250 IN PTR store.in.user.hu.
-;249 IN PTR wrds.in.user.hu.
-;248 IN PTR wrus.in.user.hu.
-212 IN PTR wasrhel5.in.user.hu.
-211 IN PTR db2rhel5.in.user.hu.
-210 IN PTR dev2008.in.user.hu.
-209 IN PTR devesxi.in.user.hu.
-208 IN PTR proxysvr.in.user.hu.
-
-179 IN PTR robi.in.user.hu.
-178 IN PTR peti.in.user.hu.
-177 IN PTR fuge.in.user.hu.
-
-161 IN PTR chronos.in.user.hu.
-159 IN PTR dhcp159.in.user.hu.
-158 IN PTR dhcp158.in.user.hu.
-157 IN PTR dhcp157.in.user.hu.
-156 IN PTR dhcp156.in.user.hu.
-155 IN PTR dhcp155.in.user.hu.
-154 IN PTR dhcp154.in.user.hu.
-153 IN PTR dhcp153.in.user.hu.
-152 IN PTR dhcp152.in.user.hu.
-151 IN PTR dhcp151.in.user.hu.
-150 IN PTR dhcp150.in.user.hu.
-149 IN PTR dhcp149.in.user.hu.
-148 IN PTR dhcp148.in.user.hu.
-147 IN PTR dhcp147.in.user.hu.
-146 IN PTR dhcp146.in.user.hu.
-145 IN PTR dhcp145.in.user.hu.
-144 IN PTR dhcp144.in.user.hu.
-143 IN PTR dhcp143.in.user.hu.
-142 IN PTR dhcp142.in.user.hu.
-141 IN PTR dhcp141.in.user.hu.
-140 IN PTR dhcp140.in.user.hu.
-139 IN PTR dhcp139.in.user.hu.
-138 IN PTR dhcp138.in.user.hu.
-137 IN PTR dhcp137.in.user.hu.
-136 IN PTR dhcp136.in.user.hu.
-135 IN PTR dhcp135.in.user.hu.
-134 IN PTR dhcp134.in.user.hu.
-133 IN PTR dhcp133.in.user.hu.
-132 IN PTR dhcp132.in.user.hu.
-131 IN PTR dhcp131.in.user.hu.
-130 IN PTR dhcp130.in.user.hu.
-129 IN PTR dhcp129.in.user.hu.
-128 IN PTR dhcp128.in.user.hu.
-127 IN PTR dhcp127.in.user.hu.
-126 IN PTR dhcp126.in.user.hu.
-125 IN PTR dhcp125.in.user.hu.
-124 IN PTR dhcp124.in.user.hu.
-123 IN PTR dhcp123.in.user.hu.
-122 IN PTR dhcp122.in.user.hu.
-121 IN PTR dhcp121.in.user.hu.
-120 IN PTR dhcp120.in.user.hu.
-119 IN PTR dhcp119.in.user.hu.
-118 IN PTR dhcp118.in.user.hu.
-117 IN PTR dhcp117.in.user.hu.
-116 IN PTR dhcp116.in.user.hu.
-115 IN PTR dhcp115.in.user.hu.
-114 IN PTR dhcp114.in.user.hu.
-113 IN PTR dhcp113.in.user.hu.
-112 IN PTR dhcp112.in.user.hu.
-111 IN PTR dhcp111.in.user.hu.
-110 IN PTR dhcp110.in.user.hu.
-109 IN PTR dhcp109.in.user.hu.
-108 IN PTR dhcp108.in.user.hu.
-107 IN PTR dhcp107.in.user.hu.
-106 IN PTR dhcp106.in.user.hu.
-105 IN PTR dhcp105.in.user.hu.
-104 IN PTR dhcp104.in.user.hu.
-103 IN PTR dhcp103.in.user.hu.
-102 IN PTR dhcp102.in.user.hu.
-101 IN PTR dhcp101.in.user.hu.
-100 IN PTR dhcp100.in.user.hu.
-
-1 IN PTR chaos.in.user.hu.
+++ /dev/null
-$TTL 86400
-@ IN SOA svc.in.user.hu. hostmaster.mx.in.user.hu. (
- 2018012301 ; Serial
- 86400 ; Refresh (1 day)
- 7200 ; Retry (2 hours)
- 2419200 ; Expire (4 weeks)
- 3600) ; Minimum (1 hour)
- IN NS ns.in.user.hu.
-
-ifg IN A 192.168.43.254
-dhcp IN A 192.168.43.253 ; dhcp
-ns IN A 192.168.43.253 ; ns
-ntp IN A 192.168.43.253 ; ntp
-smtp IN A 192.168.43.253 ; smtp
-svc IN A 192.168.43.253 ; svc
-svc IN AAAA 2a02:558:1000:1868:21a:64ff:fe71:f690
-store IN A 192.168.43.250
-fs IN CNAME store.in.user.hu.
-;tsm IN A 192.168.43.253 ; TSM Server (in)
-;smcez2 IN A 192.168.43.251 ; SMC EZ Switch 2
-;smcez1 IN A 192.168.43.250 ; SMC EZ Switch 1
-wrds IN A 192.168.43.249 ; WIFI router downstairs
-wrus IN A 192.168.43.248 ; WIFI router upstairs
-wasrhel5 IN A 192.168.43.212 ; WAS RHEL ESXi szervere
-db2rhel5 IN A 192.168.43.211 ; DB2 RHEL ESXi szervere
-dev2008 IN A 192.168.43.210 ; windows AD ESXi szervere
-devesxi IN A 192.168.43.209 ; Robi ESXi szervere
-proxysvr IN A 192.168.43.208 ; Sanyi proxy szervere
-
-; network ...176/28 -> machines routed through UPC
-; network address: ...176
-; host addresses: ...177 - ...190
-; broadcast address: ...191
-robi IN A 192.168.43.179
-peti IN A 192.168.43.178
-fuge IN A 192.168.43.177
-
-chronos IN A 192.168.43.161 ; Fixed DHCP client (chronos)
-dhcp159 IN A 192.168.43.159 ; DHCP client
-dhcp158 IN A 192.168.43.158 ; DHCP client
-dhcp157 IN A 192.168.43.157 ; DHCP client
-dhcp156 IN A 192.168.43.156 ; DHCP client
-dhcp155 IN A 192.168.43.155 ; DHCP client
-dhcp154 IN A 192.168.43.154 ; DHCP client
-dhcp153 IN A 192.168.43.153 ; DHCP client
-dhcp152 IN A 192.168.43.152 ; DHCP client
-dhcp151 IN A 192.168.43.151 ; DHCP client
-dhcp150 IN A 192.168.43.150 ; DHCP client
-dhcp149 IN A 192.168.43.149 ; DHCP client
-dhcp148 IN A 192.168.43.148 ; DHCP client
-dhcp147 IN A 192.168.43.147 ; DHCP client
-dhcp146 IN A 192.168.43.146 ; DHCP client
-dhcp145 IN A 192.168.43.145 ; DHCP client
-dhcp144 IN A 192.168.43.144 ; DHCP client
-dhcp143 IN A 192.168.43.143 ; DHCP client
-dhcp142 IN A 192.168.43.142 ; DHCP client
-dhcp141 IN A 192.168.43.141 ; DHCP client
-dhcp140 IN A 192.168.43.140 ; DHCP client
-dhcp139 IN A 192.168.43.139 ; DHCP client
-dhcp138 IN A 192.168.43.138 ; DHCP client
-dhcp137 IN A 192.168.43.137 ; DHCP client
-dhcp136 IN A 192.168.43.136 ; DHCP client
-dhcp135 IN A 192.168.43.135 ; DHCP client
-dhcp134 IN A 192.168.43.134 ; DHCP client
-dhcp133 IN A 192.168.43.133 ; DHCP client
-dhcp132 IN A 192.168.43.132 ; DHCP client
-dhcp131 IN A 192.168.43.131 ; DHCP client
-dhcp130 IN A 192.168.43.130 ; DHCP client
-dhcp129 IN A 192.168.43.129 ; DHCP client
-dhcp128 IN A 192.168.43.128 ; DHCP client
-dhcp127 IN A 192.168.43.127 ; DHCP client
-dhcp126 IN A 192.168.43.126 ; DHCP client
-dhcp125 IN A 192.168.43.125 ; DHCP client
-dhcp124 IN A 192.168.43.124 ; DHCP client
-dhcp123 IN A 192.168.43.123 ; DHCP client
-dhcp122 IN A 192.168.43.122 ; DHCP client
-dhcp121 IN A 192.168.43.121 ; DHCP client
-dhcp120 IN A 192.168.43.120 ; DHCP client
-dhcp119 IN A 192.168.43.119 ; DHCP client
-dhcp118 IN A 192.168.43.118 ; DHCP client
-dhcp117 IN A 192.168.43.117 ; DHCP client
-dhcp116 IN A 192.168.43.116 ; DHCP client
-dhcp115 IN A 192.168.43.115 ; DHCP client
-dhcp114 IN A 192.168.43.114 ; DHCP client
-dhcp113 IN A 192.168.43.113 ; DHCP client
-dhcp112 IN A 192.168.43.112 ; DHCP client
-dhcp111 IN A 192.168.43.111 ; DHCP client
-dhcp110 IN A 192.168.43.110 ; DHCP client
-dhcp109 IN A 192.168.43.109 ; DHCP client
-dhcp108 IN A 192.168.43.108 ; DHCP client
-dhcp107 IN A 192.168.43.107 ; DHCP client
-dhcp106 IN A 192.168.43.106 ; DHCP client
-dhcp105 IN A 192.168.43.105 ; DHCP client
-dhcp104 IN A 192.168.43.104 ; DHCP client
-dhcp103 IN A 192.168.43.103 ; DHCP client
-dhcp102 IN A 192.168.43.102 ; DHCP client
-dhcp101 IN A 192.168.43.101 ; DHCP client
-dhcp100 IN A 192.168.43.100 ; DHCP client
-
-chaos IN A 192.168.43.1 ; zfelleg
-chaos IN AAAA 2a02:558:1000:1868:29c:2ff:fea9:275d
+++ /dev/null
-$TTL 86400
-@ IN SOA ns.pm.user.hu. hostmaster.mx.pm.user.hu. (
- 2018100901 ; Serial
- 86400 ; Refresh (1 day)
- 7200 ; Retry (2 hours)
- 2419200 ; Expire (4 weeks)
- 3600) ; Minimum (1 hour)
-; 0 1 2
-; 12345678901234567890123456
-; abcdefghijklmnopqrstuvwxyz
-
-@ IN NS ns
-@ IN MX 10 mx
-@ IN A 192.168.173.249
-
-efg IN A 192.168.173.254 ; efg
-svc IN A 192.168.173.253 ; svc
-ns IN A 192.168.173.253 ; ns
-mx IN A 192.168.173.253 ; mx
-
-oldwww IN A 192.168.173.252 ; www
-oldxfr IN A 192.168.173.251 ; xfr
-whmcs IN A 192.168.173.250 ; whmcs
-
-ws IN A 192.168.173.249 ; ws
-www IN A 192.168.173.249 ; ws
-xfr IN A 192.168.173.246 ; xf
-vc IN A 192.168.173.223 ; vc (version control)
-dvredmine IN A 192.168.173.193 ; rm
-pns IN A 192.168.173.174 ; pn (perimeter ns)
-ens IN A 192.168.173.64 ; en (external ns)
-
-ifg IN A 192.168.173.1 ; ifg
+++ /dev/null
-$TTL 86400
-@ IN SOA svc.sr.user.hu. hostmaster.svc.sr.user.hu. (
- 2019012801 ; Serial
- 86400 ; Refresh (1 day)
- 7200 ; Retry (2 hours)
- 2419200 ; Expire (4 weeks)
- 3600) ; Minimum (1 hour)
- IN NS ns.sr.user.hu.
-
-sr.user.hu. IN A 192.168.42.253
-
-ipg IN A 192.168.42.254 ; ipg
-router IN CNAME ipg.sr.user.hu.
-svc IN A 192.168.42.253 ; svc
-ns IN A 192.168.42.253 ; ns
-dhcp IN CNAME svc.sr.user.hu.
-mx IN CNAME svc.sr.user.hu.
-ntp IN CNAME svc.sr.user.hu.
-management IN A 192.168.42.252 ; management
-mgmt IN CNAME management.sr.user.hu.
-vpn IN A 192.168.42.251 ; vpn
-store IN A 192.168.42.250 ; store
-domino IN A 192.168.42.249 ; domino
-domino85 IN CNAME domino.sr.user.hu.
-pop3 IN CNAME domino.sr.user.hu.
-worksheet IN A 192.168.42.248 ; worksheet
-kbsvr IN A 192.168.42.247 ; knowledgebase server
-ads IN A 192.168.42.246 ; Active Directory server
-spelive IN A 192.168.42.245 ; Sharepoint Enterprise Live
-splive IN A 192.168.42.244 ; SharePoint Live
-ccsvr IN A 192.168.42.243 ; ClearCase server
-sg-1 IN A 192.168.42.242 ; shellinabox server (zsoos)
-kickstart IN A 192.168.42.241 ; kickstart server (zfelleg)
-verbatsm IN A 192.168.42.240 ; Arpinak TSM szerver
-db2svr IN A 192.168.42.239 ; DB2 server
-sp2010test IN A 192.168.42.238 ; Sharepoint 2010 test (srevesz)
-
-datacap-rr IN A 192.168.42.236 ; Datacap rulerunner (akosztolanyi)
-tsm55 IN A 192.168.42.235 ; 5.5-os TSM szmarcell, flex, akosztolanyi
-imrtest IN A 192.168.42.234 ; imrtest (fschnell)
-sza IN A 192.168.42.233 ; szopoalarc
-project IN A 192.168.42.232 ; project
-testcibod IN A 192.168.42.231 ; CIB OnDemand test (fuge)
-jazzserver IN A 192.168.42.230 ; jazz.net (RTC) server
-netmon IN A 192.168.42.229 ; netmon (marcell, fritter)
-test IN A 192.168.42.228 ; (kickstart) test
-;vcsvr51 IN A 192.168.42.227 ; vCenter server
-
-
-erstehit IN A 192.168.42.224 ; Erste (fuge)
-wiki IN A 192.168.42.223 ; wiki (moinmoin)
-xp-22 IN A 192.168.42.222 ; XP 22
-xp-21 IN A 192.168.42.221 ; XP 21
-xp-20 IN A 192.168.42.220 ; XP 20
-xp-19 IN A 192.168.42.219 ; XP 19
-xp-18 IN A 192.168.42.218 ; XP 18
-xp-17 IN A 192.168.42.217 ; XP 17
-xp-16 IN A 192.168.42.216 ; XP 16
-xp-15 IN A 192.168.42.215 ; XP 15
-xp-14 IN A 192.168.42.214 ; XP 14
-xp-13 IN A 192.168.42.213 ; XP 13
-xp-12 IN A 192.168.42.212 ; XP 12
-xp-11 IN A 192.168.42.211 ; XP 11
-xp-10 IN A 192.168.42.210 ; XP 10
-xp-template IN A 192.168.42.209 ; XP template
-rtc IN A 192.168.42.208 ; rtc (arpi)
-vmbkp IN A 192.168.42.207 ; VMWare Backup Server
-vhost3 IN CNAME vmbkp.sr.user.hu.
-mqsvr IN A 192.168.42.206 ; MQ server (srevesz)
-mqback IN A 192.168.42.205 ; MQ backup server (srevesz)
-mqfiles IN A 192.168.42.204 ; MQ file server (srevesz)
-azsamboki01 IN A 192.168.42.203 ; azsamboki test 01
-praxis IN A 192.168.42.202 ; praxis (dvasary)
-edoki IN CNAME praxis.sr.user.hu.
-;ds5020b IN A 192.168.42.201 ; DS5020 ctrl B
-;ds5020a IN A 192.168.42.200 ; DS5020 ctrl A
-
-
-;vtlstgb IN A 192.168.42.197 ; VTL storage ctrl B
-;vtlstga IN A 192.168.42.196 ; VTL storage ctrl A
-lto IN A 192.168.42.195 ; TS3200
-csldallianz IN A 192.168.42.194 ; CSLD Allianz (fuge)
-store-old IN A 192.168.42.193 ; old store
-fcsw1 IN A 192.168.42.192 ; FC switch
-fcsw0 IN A 192.168.42.191 ; FC switch
-tsmmonp IN A 192.168.42.190 ; TSM monitoring primary
-tsmmons IN A 192.168.42.189 ; TSM monitoring primary
-accounting IN A 192.168.42.188 ; accounting server
-jenkinslnx IN A 192.168.42.185 ; rhel
-jenkinstst IN A 192.168.42.184 ; win 2008
-jenkinswin IN A 192.168.42.183 ; win 2008
-jenkinsaix IN A 192.168.42.182 ; aix
-magdevdc IN A 192.168.42.181 ; MAG dev dc
-ssam71 IN A 192.168.42.180 ; Arpinak, TSM-SSM teszt
-dominoadmin IN A 192.168.42.174 ; rkonkoly domino administrator
-
-tsmclustera IN A 192.168.42.173 ; FRitter, BB Test cluster
-tsmclusterb IN A 192.168.42.172 ; FRitter, BB Test cluster
-tsmcluster IN A 192.168.42.171 ; FRitter, BB Test cluster
-
-;cwdba IN A 192.168.42.162 ; zfelleg temp
-;cwdbb IN A 192.168.42.161 ; zfelleg temp
-;cwbina IN A 192.168.42.160 ; zfelleg temp
-;cwbinb IN A 192.168.42.159 ; zfelleg temp
-
-; network ...128/27 -> desktops
-; network address: ...128
-; host addresses: ...129 - ...158
-; broadcast address: ...159
-
-win-7-base IN A 192.168.42.158 ; Windows 7 base image
-win-7-thinapp IN A 192.168.42.157 ; ThinApp build machine
-win-7-20 IN A 192.168.42.148 ; Windows 7 20
-win-7-19 IN A 192.168.42.147 ; Windows 7 19
-win-7-18 IN A 192.168.42.146 ; Windows 7 18
-win-7-17 IN A 192.168.42.145 ; Windows 7 17
-win-7-16 IN A 192.168.42.144 ; Windows 7 16
-win-7-15 IN A 192.168.42.143 ; Windows 7 15
-win-7-14 IN A 192.168.42.142 ; Windows 7 14
-win-7-13 IN A 192.168.42.141 ; Windows 7 13
-win-7-12 IN A 192.168.42.140 ; Windows 7 12
-win-7-11 IN A 192.168.42.139 ; Windows 7 11
-win-7-10 IN A 192.168.42.138 ; Windows 7 10
-win-7-09 IN A 192.168.42.137 ; Windows 7 09
-win-7-08 IN A 192.168.42.136 ; Windows 7 08
-win-7-07 IN A 192.168.42.135 ; Windows 7 07
-win-7-06 IN A 192.168.42.134 ; Windows 7 06
-win-7-05 IN A 192.168.42.133 ; Windows 7 05
-win-7-04 IN A 192.168.42.132 ; Windows 7 04
-win-7-03 IN A 192.168.42.131 ; Windows 7 03
-win-7-02 IN A 192.168.42.130 ; Windows 7 02
-win-7-zfelleg IN CNAME win-7-02.sr.user.hu.
-win-7-01 IN A 192.168.42.129 ; Windows 7 01
-win-7-rkallai IN CNAME win-7-01.sr.user.hu.
-
-jobworker IN A 192.168.42.116 ; job worker dvasary
-jobengine IN A 192.168.42.115 ; job engine dvasary
-astronfw IN A 192.168.42.114 ; firewall/gateway for Astron
-wasng IN A 192.168.42.113 ; syslog-ng demo WAS
-slng IN A 192.168.42.112 ; syslog-ng demo
-nimol IN A 192.168.42.111 ; nimol teszt / temp / zsoos
-lajos IN A 192.168.42.110 ; zsamboki p550 AIX
-vtl IN A 192.168.42.109 ; zsamboki
-gpfs02 IN A 192.168.42.108 ; gpfs demo zsamboki
-gpfs01 IN A 192.168.42.107 ; gpfs demo zsamboki
-redhat IN A 192.168.42.106 ; Exchange mentes demo zsamboki
-ubuntu IN A 192.168.42.105 ; Exchange mentes demo zsamboki
-mssql IN A 192.168.42.104 ; Exchange mentes demo zsamboki
-exchsrv2 IN A 192.168.42.103 ; Exchange mentes demo zsamboki
-exchsrv IN A 192.168.42.102 ; Exchange mentes demo zsamboki
-exchdc IN A 192.168.42.101 ; Exchange mentes demo zsamboki
-sptest IN A 192.168.42.100 ; SharePoint test (kalman)
-director IN A 192.168.42.99 ; IBM Systems Director (zsamboki)
-tpc IN A 192.168.42.97 ; tpc (zsamboki)
-nas1 IN A 192.168.42.96 ; netapp test
-nas2 IN A 192.168.42.95 ; netapp test
-nas3 IN A 192.168.42.94 ; netapp test
-
-; HACMP zsamboki
-hacmp61 IN A 192.168.42.93 ; HACMP PowerHA 6.1 node1
-hacmp62 IN A 192.168.42.92 ; HACMP PowerHA 6.1 node2
-ha1 IN A 192.168.42.91 ; HACMP PowerHA 6.1 service ip 1
-ha2 IN A 192.168.42.90 ; HACMP PowerHA 6.1 service ip 2
-kofax1 IN A 192.168.42.89 ;
-kofax2 IN A 192.168.42.88 ;
-kofax3 IN A 192.168.42.87 ;
-tfsproxy IN A 192.168.42.86 ;
-wpar01 IN A 192.168.42.85 ;
-spatial IN A 192.168.42.84 ; szmarcell, oracle RMAN teszt
-kofaxcluster IN A 192.168.42.83 ;
-kofaxclusterfs IN A 192.168.42.82 ;
-kofaxclustersrv IN A 192.168.42.81 ;
-kofaxid1 IN A 192.168.42.80 ;
-kofaxid2 IN A 192.168.42.79 ;
-kofaxid IN A 192.168.42.78 ;
-kofaxidfs IN A 192.168.42.77 ;
-kofaxidcluster IN A 192.168.42.76 ;
-
-mirror1 IN A 192.168.42.75 ; PowerHA 7.1 zsamboki
-mirror2 IN A 192.168.42.74 ; PowerHA 7.1 zsamboki
-mirrorapp1 IN A 192.168.42.73 ; PowerHA 7.1 zsamboki
-mavirnim IN A 192.168.42.72 ; MAVIR NIM restore test zsamboki
-boinc4 IN A 192.168.42.68 ; boinc 4 (zfelleg)
-boinc3 IN A 192.168.42.67 ; boinc 3 (zfelleg)
-boinc2 IN A 192.168.42.66 ; boinc 2 (zfelleg)
-boinc1 IN A 192.168.42.65 ; boinc 1 (zfelleg)
-win2k8r2 IN A 192.168.42.64 ; Windows 2008 R2 Server Template IP cim, szmarcell
-edmstest IN A 192.168.42.63 ; EDMS Test szerver Robinak, szmarcell
-pftsm1 IN A 192.168.42.62 ; PureFlex szerver
-pftsm2 IN A 192.168.42.61 ; PureFlex szerver
-pftsm3 IN A 192.168.42.60 ; PureFlex szerver
-pftws1 IN A 192.168.42.59 ; PureFlex szerver
-pfsd1 IN A 192.168.42.58 ; PureFlex szerver
-pfitm1 IN A 192.168.42.57 ; PureFlex szerver
-pfbes1 IN A 192.168.42.56 ; PureFlex szerver
-pfwinc1 IN A 192.168.42.55 ; PureFlex szerver
-pflinc1 IN A 192.168.42.54 ; PureFlex szerver
-tsmapiw IN A 192.168.42.53 ; PureFlex szerver
-tsmapil IN A 192.168.42.52 ; PureFlex szerver
-tfs IN A 192.168.42.51 ; TFS Verziokezelo, VasaryD, RendekR
-
-
-; A 30-39 tartomanyt is foglalom az LPAR-oknak
-fhbws IN A 192.168.42.39 ; FHB WebSphere Test, szmarcell
-fhbws4 IN A 192.168.42.38 ; FHB WebSphere Test, szmarcell
-prxy IN A 192.168.42.37
-build61w IN A 192.168.42.36
-fhbws3 IN A 192.168.42.35 ; FHB WebSphere Test, szmarcell
-fhbws2 IN A 192.168.42.34 ; FHB WebSphere Test, szmarcell
-fhbws1 IN A 192.168.42.33 ; FHB WebSphere Test, szmarcell
-nim IN A 192.168.42.32
-vio2 IN A 192.168.42.31
-db2t IN A 192.168.42.28
-build71 IN A 192.168.42.27
-build61 IN A 192.168.42.26
-build53 IN A 192.168.42.25
-tsm IN A 192.168.42.24
-rac2 IN A 192.168.42.23
-rac1 IN A 192.168.42.22
-vio1 IN A 192.168.42.21 ; LPAR 1 vio (p7-750)
-hmc IN A 192.168.42.20 ; hmc
-fhbwsc2 IN A 192.168.42.19 ; FHB WebSphere Test, szmarcell
-orasrv IN A 192.168.42.5 ; Oracle (srevesz)
-dhcp4 IN A 192.168.42.4 ; DHCP address 4
-dhcp3 IN A 192.168.42.3 ; DHCP address 3
-dhcp2 IN A 192.168.42.2 ; DHCP address 2
-dhcp1 IN A 192.168.42.1 ; DHCP address 1
+++ /dev/null
-$TTL 86400
-@ IN SOA ns1.useribm.hu. hostmaster.mx.useribm.hu. (
- 2019080501 ; Serial
- 86400 ; Refresh (1 day)
- 7200 ; Retry (2 hours)
- 2419200 ; Expire (4 weeks)
- 3600) ; Minimum (1 hour)
- IN NS ns1.useribm.hu.
- IN NS ns2.useribm.hu.
- MX 10 mx.useribm.hu.
- IN TXT "v=spf1 +mx -all"
- IN SPF "v=spf1 +mx -all"
-
-efg IN A 194.149.40.146 ; efg
-mx IN A 194.149.40.147 ; mail exchanger
-ns IN A 194.149.40.148 ; primary name server
-ns1 IN A 194.149.40.148 ; primary name server
-ns2 IN A 46.107.213.35 ; secondary name server
-vpn IN A 194.149.40.149 ; OpenVPN server
-hg IN A 194.149.40.150 ; mercurial
-jtrac IN A 194.149.40.150 ; jtrac
-minicrm IN A 194.149.40.150 ; minicrm
-redmine IN A 194.149.40.150 ; redmine
-svn IN A 194.149.40.150 ; subversion
-ws IN A 194.149.40.150 ; web server
-www IN A 194.149.40.150 ; web server
-@ IN A 194.149.40.150 ; userrendszerhaz.hu
-minecraft IN A 194.149.40.151 ; akosztolanyi minecraft
-unused152 IN A 194.149.40.152 ; unused
-unused153 IN A 194.149.40.153 ; unused
-unused154 IN A 194.149.40.154 ; unused
-unused155 IN A 194.149.40.155 ; unused
-unused156 IN A 194.149.40.156 ; unused
-zfdl360e IN A 194.149.40.157 ; zfelleg DL360e
-fschnell IN A 194.149.40.158 ; fschnell/zfelleg server
-zfelleg IN A 194.149.40.158 ; fschnell/zfelleg server
-zfdl380e IN A 194.149.40.158 ; zfelleg DL380e
+++ /dev/null
-$TTL 86400
-@ IN SOA ns1.userrendszerhaz.hu. hostmaster.mx.userrendszerhaz.hu. (
- 2019080501 ; Serial
- 86400 ; Refresh (1 day)
- 7200 ; Retry (2 hours)
- 2419200 ; Expire (4 weeks)
- 3600) ; Minimum (1 hour)
- IN NS ns1.userrendszerhaz.hu.
- IN NS ns2.userrendszerhaz.hu.
- MX 1 aspmx.l.google.com.
- MX 5 alt1.aspmx.l.google.com.
- MX 5 alt2.aspmx.l.google.com.
- MX 10 aspmx2.googlemail.com.
- MX 10 aspmx3.googlemail.com.
- IN SPF "v=spf1 include:_spf.google.com ~all"
- IN TXT "v=spf1 include:_spf.google.com ~all"
-
-efg IN A 194.149.40.146 ; efg
-mx IN A 194.149.40.147 ; mail exchanger
-ns IN A 194.149.40.148 ; primary name server
-ns1 IN A 194.149.40.148 ; primary name server
-ns2 IN A 46.107.213.35 ; secondary name server
-vpn IN A 194.149.40.149 ; OpenVPN server
-hg IN A 194.149.40.150 ; mercurial
-jtrac IN A 194.149.40.150 ; jtrac
-minicrm IN A 194.149.40.150 ; minicrm
-redmine IN A 194.149.40.150 ; redmine
-svn IN A 194.149.40.150 ; subversion
-ws IN A 194.149.40.150 ; web server
-www IN A 194.149.40.150 ; web server
-@ IN A 194.149.40.150 ; userrendszerhaz.hu
-minecraft IN A 194.149.40.151 ; akosztolanyi minecraft
-unused152 IN A 194.149.40.152 ; unused
-unused153 IN A 194.149.40.153 ; unused
-unused154 IN A 194.149.40.154 ; unused
-unused155 IN A 194.149.40.155 ; unused
-unused156 IN A 194.149.40.156 ; unused
-zfdl360e IN A 194.149.40.157 ; zfelleg DL360e
-fschnell IN A 194.149.40.158 ; fschnell/zfelleg server
-zfelleg IN A 194.149.40.158 ; fschnell/zfelleg server
-zfdl380e IN A 194.149.40.158 ; zfelleg DL380e
-
-calendar IN CNAME ghs.google.com.
-docs IN CNAME ghs.google.com.
-mail IN CNAME ghs.google.com.
-sites IN CNAME ghs.google.com.
-
-googleffffffff963b8d47 IN CNAME google.com.
+++ /dev/null
-$TTL 86400
-@ IN SOA ns.usr.user.hu. hostmaster.mx.usr.user.hu. (
- 2019102401 ; Serial
- 86400 ; Refresh (1 day)
- 7200 ; Retry (2 hours)
- 2419200 ; Expire (4 weeks)
- 3600) ; Minimum (1 hour)
- IN NS ns.usr.user.hu.
-
-; 1 2
-; 12345678901234567890123456
-; abcdefghijklmnopqrstuvwxyz
-; 123456789
-
-; ================================================================
-; wifi routers (wr = 23 * 10 + 18 = 248)
-; ================================================================
-archer-c5-sf IN A 10.228.248.196 ; sf (second floor)
-archer-c5-ff IN A 10.228.248.66 ; ff (first floor)
-
-; ================================================================
-; 2N/two n (tn = 20 * 10 + 15 = 215)
-; ================================================================
-tn-phone-sf IN A 10.228.215.196 ; sf (second floor)
-tn-intercom-gf IN A 10.228.215.76 ; gf (ground floor)
-tn-phone-ff IN A 10.228.215.66 ; ff (first floor)
-tn-ac IN A 10.228.215.13 ; ac (access control)
-
-; ================================================================
-; servers (sv = 19 * 10 + 22 = 212)
-; ================================================================
-db2svr IN A 10.228.212.42 ; db/d2
-accounting IN A 10.228.212.13 ; ac
-
-; ================================================================
-; spectrum scale sandbox (ss = 19 * 10 + 19 = 209)
-; ================================================================
-sssbn3 IN A 10.228.209.131 ; site b node 3
-sssbn2 IN A 10.228.209.130 ; site b node 2
-sssbn1 IN A 10.228.209.129 ; site b node 1
-sssan3 IN A 10.228.209.3 ; site a node 3
-sssan2 IN A 10.228.209.2 ; site a node 2
-sssan1 IN A 10.228.209.1 ; site a node 1
-
-; ================================================================
-; sharepoint sandbox (sp = 19 * 10 + 16 = 206)
-; ================================================================
-spstsql IN A 10.228.206.212 ; st + 2
-spstad IN A 10.228.206.211 ; st + 1
-spstsp IN A 10.228.206.210 ; st
-spw2k08sql IN A 10.228.206.207 ; sq
-spw2k08sp IN A 10.228.206.206 ; sp
-spw2k08ad IN A 10.228.206.14 ; ad
-ppitsp IN A 10.228.206.3
-ppitdb IN A 10.228.206.2
-ppitad IN A 10.228.206.1
-
-; ================================================================
-; rrendek (rr = 18 * 10 + 18 = 198)
-; ================================================================
-rruserdev1 IN A 10.228.198.214
-userdev1 IN A 10.228.198.214
-rredms IN A 10.228.198.53 ; dm
-rrwas90 IN A 10.228.198.2
-was90 IN A 10.228.198.2
-rrdb2 IN A 10.228.198.1
-
-; ================================================================
-; sandbox (sb = 19 * 10 + 2 = 192)
-; ================================================================
-tsmapil IN A 10.228.192.212 ; tl
-ssam IN A 10.228.192.209 ; ss
-spsbsql IN A 10.228.192.207 ; sq
-spsb IN A 10.228.192.206 ; sp
-tsmddtest IN A 10.228.192.204 ; td
-toolbox IN A 10.228.192.202 ; tb
-spsbad IN A 10.228.192.191 ; sa
-jenkinswin IN A 10.228.192.123 ; jw
-oratest IN A 10.228.192.70 ; ot
-mkbdarc2dev IN A 10.228.192.44 ; dd
-blobtest IN A 10.228.192.40 ; bt
-
-; ================================================================
-; rkonkoly (rk = 18 * 10 + 11 = 191)
-; ================================================================
-rkdominoadmin IN A 10.228.191.1
-
-; ================================================================
-; redhat gluster storage server sandbox (rg = 18 * 10 + 7 = 187)
-; ================================================================
-rhgssn3 IN A 10.228.187.3 ; node 2
-rhgssn2 IN A 10.228.187.2 ; node 2
-rhgssn1 IN A 10.228.187.1 ; node 1
-
-; ================================================================
-; purebackup (pb = 16 * 10 + 2 = 162)
-; ================================================================
-purebcw2k12 IN A 10.228.162.242
-purebcw2k08 IN A 10.228.162.238
-purebcw2k03 IN A 10.228.162.233
-purebcrhel7 IN A 10.228.162.187
-purebcrhel6 IN A 10.228.162.186
-purebcwdb2105 IN A 10.228.162.106
-purebcldb2105 IN A 10.228.162.105
-purebcldb297 IN A 10.228.162.97
-purebcaix71 IN A 10.228.162.17
-
-; ================================================================
-; network switches (ns = 14 * 10 + 19 = 159)
-; ================================================================
-t1600g-28ts-sfu IN A 10.228.159.211 ; su (second floor upper)
-smcgs24c-srm IN A 10.228.159.203 ; sm (server room management)
-t1600g-28ts-sfl IN A 10.228.159.202 ; sl (second floor lower)
-t1600g-28ts-sri IN A 10.228.159.199 ; si (server room internal)
-smcgs24c-sre IN A 10.228.159.195 ; se (server room external)
-t1600g-28ts-ffu IN A 10.228.159.81 ; fu (first floor upper)
-t1600g-28ts-ffl IN A 10.228.159.72 ; fl (first floor lower)
-
-; ================================================================
-; network printers (np = 14 * 10 + 16 = 156)
-; ================================================================
-infoprint1120 IN A 10.228.156.106 ; ip
-bizhubc253 IN A 10.228.156.28 ; bh
-
-; ================================================================
-; mszabo (ms = 13 * 10 + 19 = 149)
-; ================================================================
-msexchange IN A 10.228.149.243 ; xc
-msptt4 IN A 10.228.149.212
-msptt3 IN A 10.228.149.211
-msptt2 IN A 10.228.149.210
-msptt1 IN A 10.228.149.209
-msrdnt IN A 10.228.149.184 ; rd
-mstsmdtest IN A 10.228.149.5
-msfhblbtest2 IN A 10.228.149.4
-msfhblbtest1 IN A 10.228.149.3
-msflashtest IN A 10.228.149.2
-mstsmupgrade IN A 10.228.149.1
-
-; ================================================================
-; integration toolbox test servers (it = 9 * 10 + 20 = 110)
-; ================================================================
-ittestrhel65 IN A 10.228.110.65
-ittestwin2012 IN A 10.228.110.12
-
-; ================================================================
-; infrastructure servers (is = 9 * 10 + 19 = 109)
-; ================================================================
-ifg IN A 10.228.109.254
-dhcp IN A 10.228.109.253
-mx IN A 10.228.109.253
-ns IN A 10.228.109.253
-svc IN A 10.228.109.253
-ldap IN A 10.228.109.252
-vpnvm IN A 10.228.109.251
-store IN A 10.228.109.250
-svn IN A 10.228.109.250
-tsm IN A 10.228.109.249
-
-vpn IN A 10.228.109.236 ; vp
-
-isc IN A 10.228.109.193 ; sc (ibm spectrum connect)
-
-pns IN A 10.228.109.174 ; pn
-
-minicrm IN A 10.228.109.133 ; mc
-
-iscbe IN A 10.228.109.109 ; is
-
-ins IN A 10.228.109.104 ; in
-
-cvm IN A 10.228.109.52 ; cv (container virtual machine)
-ntp IN A 10.228.109.52
-
-winadk IN A 10.228.109.51 ; dk
-
-; ================================================================
-; infrastructure management (im = 9 * 10 + 13 = 103)
-; ================================================================
-v5010svc2 IN A 10.228.103.246 ; v5 + (s + 2)
-v5010svc1 IN A 10.228.103.245 ; v5 + (s + 1)
-v5010b IN A 10.228.103.227 ; v5 + b
-v5010 IN A 10.228.103.225 ; v5
-vhost5xcc IN A 10.228.103.5
-vhost4xcc IN A 10.228.103.4
-vhost3imm IN A 10.228.103.3
-vhost2imm IN A 10.228.103.2
-vhost1imm IN A 10.228.103.1
-
-; ================================================================
-; hypervisor management (hm = 8 * 10 + 13 = 93)
-; ================================================================
-vcsa67 IN A 10.228.93.67
-vcsa65 IN A 10.228.93.65
-vhost5 IN A 10.228.93.5
-vhost4 IN A 10.228.93.4
-vhost3 IN A 10.228.93.3
-vhost2 IN A 10.228.93.2
-vhost1 IN A 10.228.93.1
-
-; ================================================================
-; infrastructure backup servers (ib = 9 * 10 + 2 = 92)
-; ================================================================
-cvmb IN A 10.228.92.52 ; cv (container virtual machine)
-ntpb IN A 10.228.92.52
-
-; ================================================================
-; fuge (fu = 6 * 10 + 21 = 81)
-; ================================================================
-fuonyffilenet IN A 10.228.81.2
-futmp IN A 10.228.81.1
-
-; ================================================================
-; fschnell (fs = 6 * 10 + 19 = 79)
-; ================================================================
-fsws IN A 10.228.79.249
-fs-iibv10 IN A 10.228.79.92
-fsmq8004 IN A 10.228.79.84
-fsmq80 IN A 10.228.79.80
-fsmq75 IN A 10.228.79.75
-fsmq70 IN A 10.228.79.70
-
-; ================================================================
-; fritter (fr = 6 * 10 + 18 = 78)
-; ================================================================
-frsppapp IN A 10.228.78.206 ; sp
-frtsm71 IN A 10.228.78.71
-frtsmc7 IN A 10.228.78.37
-frtsm12 IN A 10.228.78.12
-
-; ================================================================
-; fpga development (fd = 6 * 10 + 4 = 64)
-; ================================================================
-fdthinkstation IN A 10.228.64.219 ; ts
-fdlc922 IN A 10.228.64.123 ; lc
-fdlc922bmc IN A 10.228.64.122 ; lb
-
-; ================================================================
-; dvasary (dv = 4 * 10 + 22 = 62)
-; ================================================================
-dvredmine IN A 10.228.62.193 ; rm
-dvedmstest IN A 10.228.62.70 ; et
-dvaviglion IN A 10.228.62.32 ; av
-
-; ================================================================
-; desktops (dt = 4 * 10 + 20 = 60)
-; ================================================================
-$GENERATE 1-9 desktop00$ A 10.228.60.$
-$GENERATE 10-99 desktop0$ A 10.228.60.$
-$GENERATE 100-254 desktop$ A 10.228.60.$
-
-; ================================================================
-; dhcp clients (dc = 4 * 10 + 3 = 43)
-; ================================================================
-$GENERATE 1-9 dhcp00$ A 10.228.43.$
-$GENERATE 10-99 dhcp0$ A 10.228.43.$
-$GENERATE 100-254 dhcp$ A 10.228.43.$
-
-; ================================================================
-; old sr (192.168.42.0) static dhcp clients
-; ================================================================
-ads IN A 10.228.42.246
-spelive IN A 10.228.42.245
-datacap-rr IN A 10.228.42.236
-testcibod9 IN A 10.228.42.231
-rtc4 IN A 10.228.42.208
-vmbkp IN A 10.228.42.207
-mqsvr IN A 10.228.42.206
-mqback IN A 10.228.42.205
-mqfiles IN A 10.228.42.204
-azsamboki01 IN A 10.228.42.203
-csldallianz IN A 10.228.42.194
-tsmmon-p IN A 10.228.42.190
-tsmmon-s IN A 10.228.42.189
-accounting IN A 10.228.42.188
-jenkinslnx IN A 10.228.42.185
-jenkinstst IN A 10.228.42.184
-ssam71 IN A 10.228.42.180
-
-; ================================================================
-; azsamboki (az = 1 * 10 + 26 = 36)
-; ================================================================
-azsssam IN A 10.228.36.209 ; ss
-azsssamdev IN A 10.228.36.194 ; sd
-azsnfs IN A 10.228.36.146 ; nf
-azsgpfs2 IN A 10.228.36.88 ; gp + 2
-azsgpfs1 IN A 10.228.36.87 ; gp + 1
-azsgpfs IN A 10.228.36.86 ; gp
-
-; ================================================================
-; capi development (cd = 3 * 10 + 4 = 34)
-; ================================================================
-cdvm IN A 10.228.34.233
-cdsmartlynq IN A 10.228.34.202 ; sl
-cds822p4 IN A 10.228.34.25
-cds822p3 IN A 10.228.34.24
-cds822p2 IN A 10.228.34.23
-cds822p1 IN A 10.228.34.22
-cds822 IN A 10.228.34.22
-cds822hmc2 IN A 10.228.34.2
-cds822hmc1 IN A 10.228.34.1
-
-; ================================================================
-; akosztolanyi (ak = 1 * 10 + 11 = 21)
-; ================================================================
-akmacmini IN A 10.228.21.143 ; mm
-akminecraft IN A 10.228.21.1
-
-; ================================================================
-; artificial intelligence (ai = 1 * 10 + 9 = 19)
-; ================================================================
-aiac922 IN A 10.228.19.13 ; ac
-aiac922bmc IN A 10.228.19.12 ; ab
-aiac922icell IN A 10.228.19.10
-aiac922icellbmc IN A 10.228.19.9
-
-; ================================================================
-; acsiba (ac = 1 * 10 + 3 = 13)
-; ================================================================
-acubuntu1804 IN A 10.228.13.18 ; tsmterminal
-acubuntu14 IN A 10.228.13.14 ; tsmterminal
-acopensuse11 IN A 10.228.13.11 ; tsmterminal
-acwin10 IN A 10.228.13.10
-accentos5 IN A 10.228.13.5 ; tsmterminal
-
-; ================================================================
-; zfelleg (zf = 26 * 10 + 6 (mod 256) = 10)
-; ================================================================
-zfws IN A 10.228.10.249 ; ws
-zfvpn IN A 10.228.10.236 ; vp
-zfwd IN A 10.228.10.234 ; wd
-zfvc IN A 10.228.10.223 ; vc
-zfmssql IN A 10.228.10.149 ; ms
-zfdl380eilo IN A 10.228.10.140 ; il + 38
-zfdl360eilo IN A 10.228.10.138 ; il + 36
-zfilo IN A 10.228.10.102 ; il
-zfdl380e IN A 10.228.10.90 ; dl + 38
-zfdl360e IN A 10.228.10.88 ; dl + 36
-zfhfe IN A 10.228.10.86 ; hf
-zfdevrhel8b IN A 10.228.10.48 ; d8
-zfdevrhel7 IN A 10.228.10.47 ; d7
-zfbldw2k08 IN A 10.228.10.28 ; b8
-zfbldrhel7 IN A 10.228.10.27 ; b7
-zfbldrhel6 IN A 10.228.10.26 ; b6
-zfboinc2 IN A 10.228.10.22
-zfboinc1 IN A 10.228.10.21
-zfwin2k IN A 10.228.10.20
-zfwin7 IN A 10.228.10.7
-zfryzen IN A 10.228.10.3 ; ryzen 2400G
-zfblu-r1-hd IN A 10.228.10.2
$TTL 86400
@ IN SOA ns.usr.user.hu. hostmaster.mx.usr.user.hu. (
- 2019110401 ; Serial
+ 2020012701 ; Serial
86400 ; Refresh (1 day)
7200 ; Retry (2 hours)
2419200 ; Expire (4 weeks)
149.10 IN PTR zfmssql.usr.user.hu.
140.10 IN PTR zfdl380eilo.usr.user.hu.
138.10 IN PTR zfdl360eilo.usr.user.hu.
-102.10 IN PTR zfilo.usr.user.hu.
90.10 IN PTR zfdl380e.usr.user.hu.
88.10 IN PTR zfdl360e.usr.user.hu.
-86.10 IN PTR zfhfe.usr.user.hu.
48.10 IN PTR zfdevrhel8b.usr.user.hu.
47.10 IN PTR zfdevrhel7.usr.user.hu.
28.10 IN PTR zfbldw2k08.usr.user.hu.
26.10 IN PTR zfbldrhel6.usr.user.hu.
22.10 IN PTR zfboinc2.usr.user.hu.
21.10 IN PTR zfboinc1.usr.user.hu.
-20.10 IN PTR zfwin2k.usr.user.hu.
+8.10 IN PTR zft320.usr.user.hu.
7.10 IN PTR zfwin7.usr.user.hu.
3.10 IN PTR zfryzen.usr.user.hu.
-2.10 IN PTR zfblu-r1-hd.usr.user.hu.
$TTL 86400
@ IN SOA ns.usr.user.hu. hostmaster.mx.usr.user.hu. (
- 2019110401 ; Serial
+ 2020012701 ; Serial
86400 ; Refresh (1 day)
7200 ; Retry (2 hours)
2419200 ; Expire (4 weeks)
zfvpn IN A 10.228.10.236 ; vp
zfwd IN A 10.228.10.234 ; wd
zfvc IN A 10.228.10.223 ; vc
-zfmssql IN A 10.228.10.149 ; ms
zfdl380eilo IN A 10.228.10.140 ; il + 38
zfdl360eilo IN A 10.228.10.138 ; il + 36
-zfilo IN A 10.228.10.102 ; il
zfdl380e IN A 10.228.10.90 ; dl + 38
zfdl360e IN A 10.228.10.88 ; dl + 36
-zfhfe IN A 10.228.10.86 ; hf
zfdevrhel8b IN A 10.228.10.48 ; d8
zfdevrhel7 IN A 10.228.10.47 ; d7
zfbldw2k08 IN A 10.228.10.28 ; b8
zfbldrhel6 IN A 10.228.10.26 ; b6
zfboinc2 IN A 10.228.10.22
zfboinc1 IN A 10.228.10.21
-zfwin2k IN A 10.228.10.20
+zft320 IN A 10.228.10.8 ; t + 320 (mod256)
zfwin7 IN A 10.228.10.7
zfryzen IN A 10.228.10.3 ; ryzen 2400G
zfblu-r1-hd IN A 10.228.10.2
+++ /dev/null
-lxc.include = /usr/share/lxc/config/common.conf
-
-lxc.arch = x86_64
-lxc.uts.name = svc.usr.user.hu
-lxc.rootfs.path = __CONTAINER_PATH__/rootfs
-lxc.mount.auto = proc:rw sys:ro
-
-lxc.net.0.type = phys
-lxc.net.0.flags = up
-lxc.net.0.link = svc
-
-lxc.autodev = 1
-
-lxc.signal.halt = SIGRTMIN+4
-
-lxc.start.auto = 1
-lxc.start.order = 23
-lxc.start.delay = 3
+++ /dev/null
-BASE_PACKAGES="NetworkManager hostname initscripts iputils iproute rootfiles rsyslog tar vim-minimal"
-SPEC_PACKAGES="bind bind-utils dhcp postfix python3 python3-dbus"
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active NetworkManager.service
-NM_RC=$?
-WAITED=0
-while [ $NM_RC -ne 0 ]
-do
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active NetworkManager.service
- NM_RC=$?
-done
-[ $WAITED -eq 1 ] && echo
-
-CONNECTIONS=$(nmcli --terse connection show | wc -l)
-while [ $CONNECTIONS -ne 1 ]
-do
- echo "Number of connections: $CONNECTIONS" >&2
- sleep 1
- CONNECTIONS=$(nmcli --terse connection show | wc -l)
-done
-
-nmcli --terse connection show | grep ':$' >/dev/null
-ALL_CONNECTION_DEVICES_KNOWN=$?
-while [ $ALL_CONNECTION_DEVICES_KNOWN -eq 0 ]
-do
- echo "Not all connection devices are known yet" >&2
- sleep 1
- nmcli --terse connection show | grep ':$' >/dev/null
- ALL_CONNECTION_DEVICES_KNOWN=$?
-done
-
-CONNECTION_LINE=$(nmcli --terse connection show)
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-CONNECTION_DEVICE=$(echo $CONNECTION_LINE | cut -f 4 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id internal \
- connection.interface-name $CONNECTION_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "10.228.109.253/16" \
- ipv4.dns "10.228.109.104, 10.228.109.253" \
- ipv4.dns-search "usr.user.hu" \
- ipv4.gateway "10.228.109.254" \
- ipv4.method "manual" \
- ipv6.method "ignore" \
- save yes
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active dbus.service
-DBUS_RC=$?
-WAITED=0
-while [ $DBUS_RC -ne 0 ]
-do
- if [ $WAITED -eq 0 ]
- then
- echo -n "Waiting for dbus.service"
- fi
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active dbus.service
- DBUS_RC=$?
-done
-[ $WAITED -ne 0 ] && echo
-timedatectl set-timezone Europe/Budapest
+++ /dev/null
-#!/bin/sh
-
-
-exit 0
-authselect select sssd with-mkhomedir --force
-
-cat >>/etc/openldap/ldap.conf <<EOF
-BASE dc=user,dc=hu
-URI ldap://ldap.usr.user.hu
-EOF
+++ /dev/null
-#!/bin/sh
-
-
-systemctl enable postfix.service
-systemctl start postfix.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chown -R root.root $SOURCE_PATH/*
-
-chgrp named $SOURCE_PATH/etc/named.*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chmod 640 $SOURCE_PATH/etc/named.*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-tar --create \
- --directory=$REAL_PATH \
- --to-stdout \
- install \
- | tar --extract \
- --backup \
- --directory=/ \
- --no-overwrite-dir \
- --strip-components=1 \
- --suffix=.orig
+++ /dev/null
-#!/bin/sh
-
-
-sed --in-place=.orig \
- 's/^After=\(.*\)network\.target\(.*\)$/After=\1network-online.target\2/' \
- /usr/lib/systemd/system/named.service
-
-sed --in-place=.orig \
- 's/^After=\(.*\)network\.target\(.*\)$/After=\1network-online.target\2/' \
- /usr/lib/systemd/system/postfix.service
+++ /dev/null
-#!/bin/sh
-
-
-systemctl disable postfix.service
-
-systemctl enable dhcpd.service
-systemctl enable named.service
-systemctl enable NetworkManager-wait-online.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-# dhcpd.conf
-#
-# Configuration file for ISC dhcpd
-#
-
-# Option definitions
-option broadcast-address 10.228.255.255;
-option domain-name "usr.user.hu";
-option domain-name-servers svc.usr.user.hu, ins.usr.user.hu;
-option domain-search "usr.user.hu", "sr.user.hu", "in.user.hu";
-option ntp-servers ntp.usr.user.hu, ntpb.usr.user.hu;
-option routers ifg.usr.user.hu;
-option smtp-server mx.usr.user.hu;
-option subnet-mask 255.255.0.0;
-option time-offset 3600;
-
-option space PXE;
-option PXE.mtftp-ip code 1 = ip-address;
-option PXE.mtftp-cport code 2 = unsigned integer 16;
-option PXE.mtftp-sport code 3 = unsigned integer 16;
-option PXE.mtftp-tmout code 4 = unsigned integer 8;
-option PXE.mtftp-delay code 5 = unsigned integer 8;
-option architecture-type code 93 = unsigned integer 16;
-
-option space pxelinux;
-option pxelinux.magic code 208 = string;
-option pxelinux.configfile code 209 = text;
-option pxelinux.pathprefix code 210 = text;
-option pxelinux.reboottime code 211 = unsigned integer 32;
-option architecture-type code 93 = unsigned integer 16;
-
-# 12/24 hours
-default-lease-time 43200;
-max-lease-time 86400;
-
-# Disable dynamic dns updates
-ddns-update-style none;
-
-# This DHCP server is the official DHCP server for the local network
-authoritative;
-
-# Use this to send dhcp log messages to a different log file (you also
-# have to hack syslog.conf to complete the redirection).
-log-facility local7;
-
-# usr.user.hu subnet
-subnet 10.228.0.0 netmask 255.255.0.0 {
- range 10.228.43.1 10.228.43.254;
- #next-server kickstart.usr.user.hu;
- filename "/grub/grub.efi.c7";
-}
-
-# static hosts
-host tn-phone-test {
- hardware ethernet 00:0b:82:66:f2:3e;
- fixed-address 10.228.215.220;
-}
-host tn-phone-sf {
- hardware ethernet 00:0b:82:67:2f:1c;
- fixed-address 10.228.215.196;
-}
-host tn-intercom-gf {
- hardware ethernet 7c:1e:b3:fe:4e:61;
- fixed-address 10.228.215.76;
-}
-host tn-phone-ff {
- hardware ethernet 00:0b:82:67:2d:26;
- fixed-address 10.228.215.66;
-}
-host db2svr {
- hardware ethernet 00:50:56:00:d4:2a;
- fixed-address 10.228.212.42;
-}
-host accounting-usr {
- hardware ethernet 00:50:56:00:d4:0d;
- fixed-address 10.228.212.13;
-}
-host tsmapil {
- hardware ethernet 00:50:56:00:c0:d4;
- fixed-address 10.228.192.212;
-}
-host sssbn3 {
- hardware ethernet 00:50:56:00:d1:83;
- fixed-address 10.228.209.131;
-}
-host sssbn2 {
- hardware ethernet 00:50:56:00:d1:82;
- fixed-address 10.228.209.130;
-}
-host sssbn1 {
- hardware ethernet 00:50:56:00:d1:81;
- fixed-address 10.228.209.129;
-}
-host sssan3 {
- hardware ethernet 00:50:56:00:d1:03;
- fixed-address 10.228.209.3;
-}
-host sssan2 {
- hardware ethernet 00:50:56:00:d1:02;
- fixed-address 10.228.209.2;
-}
-host sssan1 {
- hardware ethernet 00:50:56:00:d1:01;
- fixed-address 10.228.209.1;
-}
-host spstsql {
- hardware ethernet 00:50:56:00:ce:d4;
- fixed-address 10.228.206.212;
-}
-host spstad {
- hardware ethernet 00:50:56:00:ce:d3;
- fixed-address 10.228.206.211;
-}
-host spstsp {
- hardware ethernet 00:50:56:00:ce:d2;
- fixed-address 10.228.206.210;
-}
-host spw2k08sql {
- hardware ethernet 00:50:56:00:ce:cf;
- fixed-address 10.228.206.207;
-}
-host spw2k08sp {
- hardware ethernet 00:50:56:00:ce:ce;
- fixed-address 10.228.206.206;
-}
-host spw2k08ad {
- hardware ethernet 00:50:56:00:ce:0e;
- fixed-address 10.228.206.14;
-}
-host ppitsp {
- hardware ethernet 00:50:56:00:ce:03;
- fixed-address 10.228.206.3;
-}
-host ppitdb {
- hardware ethernet 00:50:56:00:ce:02;
- fixed-address 10.228.206.2;
-}
-host ppitad {
- hardware ethernet 00:50:56:00:ce:01;
- fixed-address 10.228.206.1;
-}
-host rredms {
- hardware ethernet 00:50:56:00:c6:35;
- fixed-address 10.228.198.53;
-}
-host ssam {
- hardware ethernet 00:50:56:00:c0:d1;
- fixed-address 10.228.192.209;
-}
-host spsbsql {
- hardware ethernet 00:50:56:00:c0:cf;
- fixed-address 10.228.192.207;
-}
-host spsb {
- hardware ethernet 00:50:56:00:c0:ce;
- fixed-address 10.228.192.206;
-}
-host tsmddtest {
- hardware ethernet 00:50:56:00:c0:cc;
- fixed-address 10.228.192.204;
-}
-host toolbox {
- hardware ethernet 00:50:56:00:c0:ca;
- fixed-address 10.228.192.202;
-}
-host spsbad {
- hardware ethernet 00:50:56:00:c0:bf;
- fixed-address 10.228.192.191;
-}
-host jenkinswin {
- hardware ethernet 00:50:56:00:c0:7b;
- fixed-address 10.228.192.123;
-}
-host mkbdarc2dev {
- hardware ethernet 00:50:56:00:c0:2c;
- fixed-address 10.228.192.44;
-}
-host blobtest {
- hardware ethernet 00:50:56:00:c0:28;
- fixed-address 10.228.192.40;
-}
-host rkdominoadmin {
- hardware ethernet 00:50:56:00:bf:01;
- fixed-address 10.228.191.1;
-}
-host rhgssn3 {
- hardware ethernet 00:50:56:00:bb:03;
- fixed-address 10.228.187.3;
-}
-host rhgssn2 {
- hardware ethernet 00:50:56:00:bb:02;
- fixed-address 10.228.187.2;
-}
-host rhgssn1 {
- hardware ethernet 00:50:56:00:bb:01;
- fixed-address 10.228.187.1;
-}
-host purebcw2k12 {
- hardware ethernet 00:50:56:00:a2:f2;
- fixed-address 10.228.162.242;
-}
-host purebcw2k08 {
- hardware ethernet 00:50:56:00:a2:ee;
- fixed-address 10.228.162.238;
-}
-host purebcw2k03 {
- hardware ethernet 00:50:56:00:a2:e9;
- fixed-address 10.228.162.233;
-}
-host purebcrhel7 {
- hardware ethernet 00:50:56:00:a2:bb;
- fixed-address 10.228.162.187;
-}
-host purebcrhel6 {
- hardware ethernet 00:50:56:00:a2:ba;
- fixed-address 10.228.162.186;
-}
-host purebcwdb2105 {
- hardware ethernet 00:50:56:00:a2:6a;
- fixed-address 10.228.162.106;
-}
-host purebcldb2105 {
- hardware ethernet 00:50:56:00:a2:69;
- fixed-address 10.228.162.105;
-}
-host purebcldb297 {
- hardware ethernet 00:50:56:00:a2:61;
- fixed-address 10.228.162.97;
-}
-host msexchange {
- hardware ethernet 00:50:56:00:95:f3;
- fixed-address 10.228.149.243;
-}
-host msptt4 {
- hardware ethernet 00:50:56:00:95:d4;
- fixed-address 10.228.149.212;
-}
-host msptt3 {
- hardware ethernet 00:50:56:00:95:d3;
- fixed-address 10.228.149.211;
-}
-host msptt2 {
- hardware ethernet 00:50:56:00:95:d2;
- fixed-address 10.228.149.210;
-}
-host msptt1 {
- hardware ethernet 00:50:56:00:95:d1;
- fixed-address 10.228.149.209;
-}
-host msfhblbtest2 {
- hardware ethernet 00:50:56:00:95:04;
- fixed-address 10.228.149.4;
-}
-host msfhblbtest1 {
- hardware ethernet 00:50:56:00:95:03;
- fixed-address 10.228.149.3;
-}
-host msflashtest {
- hardware ethernet 00:50:56:00:95:02;
- fixed-address 10.228.149.2;
-}
-host mstsmupgrade {
- hardware ethernet 00:50:56:00:95:01;
- fixed-address 10.228.149.1;
-}
-host svc {
- hardware ethernet 00:50:56:00:6d:fd;
- fixed-address 10.228.109.253;
-}
-host idm {
- hardware ethernet 00:50:56:00:6d:fc;
- fixed-address 10.228.109.252;
-}
-host vpn {
- hardware ethernet 00:50:56:00:6d:fb;
- fixed-address 10.228.109.251;
-}
-host store {
- hardware ethernet 00:50:56:00:6d:fa;
- fixed-address 10.228.109.250;
-}
-host tsm {
- hardware ethernet 00:50:56:00:6d:f9;
- fixed-address 10.228.109.249;
-}
-host winadk {
- hardware ethernet 00:50:56:00:6d:33;
- fixed-address 10.228.109.51;
-}
-host vcsa60 {
- hardware ethernet 00:50:56:00:5d:3c;
- fixed-address 10.228.93.60;
-}
-host vcsvr55 {
- hardware ethernet 00:50:56:00:5d:37;
- fixed-address 10.228.93.55;
-}
-host vhost2 {
- hardware ethernet e4:1f:13:bc:e0:d0;
- fixed-address 10.228.93.2;
-}
-host vhost1 {
- hardware ethernet e4:1f:13:bc:c3:20;
- fixed-address 10.228.93.1;
-}
-host svcb {
- hardware ethernet 00:50:56:00:5c:fd;
- fixed-address 10.228.92.253;
-}
-host fuonyffilenet {
- hardware ethernet 00:50:56:00:51:02;
- fixed-address 10.228.81.2;
-}
-host futmp {
- hardware ethernet 00:50:56:00:51:01;
- fixed-address 10.228.81.1;
-}
-host fsmq8004 {
- hardware ethernet 00:50:56:00:4f:54;
- fixed-address 10.228.79.84;
-}
-host frsppapp {
- hardware ethernet 00:50:56:00:4e:ce;
- fixed-address 10.228.78.206;
-}
-host frtsm71 {
- hardware ethernet 00:50:56:00:4e:47;
- fixed-address 10.228.78.71;
-}
-host dvredmine {
- hardware ethernet 00:50:56:00:3e:c1;
- fixed-address 10.228.62.193;
-}
-host dvedmstest {
- hardware ethernet 00:50:56:00:3e:46;
- fixed-address 10.228.62.70;
-}
-host dvaviglion {
- hardware ethernet 00:18:85:09:80:06;
- fixed-address 10.228.62.32;
-}
-host desktop-20 {
- hardware ethernet 00:50:56:00:3c:14;
- fixed-address 10.228.60.20;
-}
-host desktop-19 {
- hardware ethernet 00:50:56:00:3c:13;
- fixed-address 10.228.60.19;
-}
-host desktop-18 {
- hardware ethernet 00:50:56:00:3c:12;
- fixed-address 10.228.60.18;
-}
-host desktop-17 {
- hardware ethernet 00:50:56:00:3c:11;
- fixed-address 10.228.60.17;
-}
-host desktop-16 {
- hardware ethernet 00:50:56:00:3c:10;
- fixed-address 10.228.60.16;
-}
-host desktop-15 {
- hardware ethernet 00:50:56:00:3c:0f;
- fixed-address 10.228.60.15;
-}
-host desktop-14 {
- hardware ethernet 00:50:56:00:3c:0e;
- fixed-address 10.228.60.14;
-}
-host desktop-13 {
- hardware ethernet 00:50:56:00:3c:0d;
- fixed-address 10.228.60.13;
-}
-host desktop-12 {
- hardware ethernet 00:50:56:00:3c:0c;
- fixed-address 10.228.60.12;
-}
-host desktop-11 {
- hardware ethernet 00:50:56:00:3c:0b;
- fixed-address 10.228.60.11;
-}
-host desktop-10 {
- hardware ethernet 00:50:56:00:3c:0a;
- fixed-address 10.228.60.10;
-}
-host desktop-09 {
- hardware ethernet 00:50:56:00:3c:09;
- fixed-address 10.228.60.9;
-}
-host desktop-08 {
- hardware ethernet 00:50:56:00:3c:08;
- fixed-address 10.228.60.8;
-}
-host desktop-07 {
- hardware ethernet 00:50:56:00:3c:07;
- fixed-address 10.228.60.7;
-}
-host desktop-06 {
- hardware ethernet 00:50:56:00:3c:06;
- fixed-address 10.228.60.6;
-}
-host desktop-05 {
- hardware ethernet 00:50:56:00:3c:05;
- fixed-address 10.228.60.5;
-}
-host desktop-04 {
- hardware ethernet 00:50:56:00:3c:04;
- fixed-address 10.228.60.4;
-}
-host desktop-03 {
- hardware ethernet 00:50:56:00:3c:03;
- fixed-address 10.228.60.3;
-}
-host desktop-02 {
- hardware ethernet 00:50:56:00:3c:02;
- fixed-address 10.228.60.2;
-}
-host desktop-01 {
- hardware ethernet 00:50:56:00:3c:01;
- fixed-address 10.228.60.1;
-}
-host ads {
- hardware ethernet 00:50:56:00:2a:f6;
- fixed-address 10.228.42.246;
-}
-host spelive {
- hardware ethernet 00:50:56:00:2a:f5;
- fixed-address 10.228.42.245;
-}
-host datacap-rr {
- hardware ethernet 00:50:56:00:2a:ec;
- fixed-address 10.228.42.236;
-}
-host testcibod9 {
- hardware ethernet 00:50:56:00:2a:e7;
- fixed-address 10.228.42.231;
-}
-host rtc4 {
- hardware ethernet 00:50:56:00:2a:d0;
- fixed-address 10.228.42.208;
-}
-host vmbkp {
- hardware ethernet 00:50:56:00:2a:cf;
- fixed-address 10.228.42.207;
-}
-host mqsvr {
- hardware ethernet 00:50:56:00:2a:ce;
- fixed-address 10.228.42.206;
-}
-host mqback {
- hardware ethernet 00:50:56:00:2a:cd;
- fixed-address 10.228.42.205;
-}
-host mqfiles {
- hardware ethernet 00:50:56:00:2a:cc;
- fixed-address 10.228.42.204;
-}
-host azsamboki01 {
- hardware ethernet 00:50:56:00:2a:cb;
- fixed-address 10.228.42.203;
-}
-host csldallianz {
- hardware ethernet 00:50:56:00:2a:c2;
- fixed-address 10.228.42.194;
-}
-host tsmmon-p {
- hardware ethernet 00:50:56:00:2a:be;
- fixed-address 10.228.42.190;
-}
-host tsmmon-s {
- hardware ethernet 00:50:56:00:2a:bd;
- fixed-address 10.228.42.189;
-}
-host accounting {
- hardware ethernet 00:50:56:00:2a:bc;
- fixed-address 10.228.42.188;
-}
-host jenkinslnx {
- hardware ethernet 00:50:56:00:2a:b9;
- fixed-address 10.228.42.185;
-}
-host jenkinstst {
- hardware ethernet 00:50:56:00:2a:b8;
- fixed-address 10.228.42.184;
-}
-host ssam71 {
- hardware ethernet 00:50:56:00:2a:b4;
- fixed-address 10.228.42.180;
-}
-host azsssam {
- hardware ethernet 00:50:56:00:24:d1;
- fixed-address 10.228.36.209;
-}
-host azsssamdev {
- hardware ethernet 00:50:56:00:24:c2;
- fixed-address 10.228.36.194;
-}
-host azsnfs {
- hardware ethernet 00:50:56:00:24:92;
- fixed-address 10.228.36.146;
-}
-host azsgpfs2 {
- hardware ethernet 00:50:56:00:24:58;
- fixed-address 10.228.36.88;
-}
-host azsgpfs1 {
- hardware ethernet 00:50:56:00:24:57;
- fixed-address 10.228.36.87;
-}
-host cdvm {
- hardware ethernet 00:50:56:00:22:e9;
- fixed-address 10.228.34.233;
-}
-host cds822p4 {
- hardware ethernet 98:be:94:04:06:fb;
- fixed-address 10.228.34.25;
-}
-host cds822p3 {
- hardware ethernet 98:be:94:04:06:fa;
- fixed-address 10.228.34.24;
-}
-host cds822p2 {
- hardware ethernet 98:be:94:04:06:f9;
- fixed-address 10.228.34.23;
-}
-host cds822p1 {
- hardware ethernet 98:be:94:04:06:f8;
- fixed-address 10.228.34.22;
-}
-host cds822hmc2 {
- hardware ethernet 98:be:94:4c:5e:3f;
- fixed-address 10.228.34.2;
-}
-host cds822hmc1 {
- hardware ethernet 98:be:94:4c:5e:3e;
- fixed-address 10.228.34.1;
-}
-host akmacmini {
- hardware ethernet 10:dd:b1:b3:e3:ad;
- fixed-address 10.228.21.143;
-}
-host aiac922 {
- hardware ethernet 08:94:ef:80:21:3b;
- fixed-address 10.228.19.13;
-}
-host aiac922bmc {
- hardware ethernet 08:94:ef:80:21:3a;
- fixed-address 10.228.19.12;
-}
-host acubuntu14 {
- hardware ethernet 00:50:56:00:0d:0e;
- fixed-address 10.228.13.14;
-}
-host acopensuse11 {
- hardware ethernet 00:50:56:00:0d:0b;
- fixed-address 10.228.13.11;
-}
-host accentos5 {
- hardware ethernet 00:50:56:00:0d:05;
- fixed-address 10.228.13.5;
-}
-host zfvpn {
- hardware ethernet 00:50:56:00:0a:ec;
- fixed-address 10.228.10.236;
-}
-host zfmssql {
- hardware ethernet 00:50:56:00:0a:95;
- fixed-address 10.228.10.149;
-}
-host zfwin81 {
- hardware ethernet 00:50:56:00:0a:51;
- fixed-address 10.228.10.81;
-}
-host zfbldw2k08 {
- hardware ethernet 00:50:56:00:0a:1c;
- fixed-address 10.228.10.28;
-}
-host zfbldrhel7 {
- hardware ethernet 00:50:56:00:0a:1b;
- fixed-address 10.228.10.27;
-}
-host zfbldrhel6 {
- hardware ethernet 00:50:56:00:0a:1a;
- fixed-address 10.228.10.26;
-}
-host zfwin2k {
- hardware ethernet 00:50:56:00:0a:14;
- fixed-address 10.228.10.20;
-}
-host zfwin7 {
- hardware ethernet 00:50:56:00:0a:07;
- fixed-address 10.228.10.7;
-}
-host zfryzen {
- hardware ethernet 1c:1b:0d:e4:ed:c7;
- fixed-address 10.228.10.3;
-}
-# zfelleg (BLU R1 HD)
-host zfblu-r1-hd {
- hardware ethernet cc:79:4a:fe:58:8b;
- fixed-address 10.228.10.2;
-}
+++ /dev/null
-127.0.0.1 localhost.localdomain localhost localhost4.localdomain4 localhost4
-::1 localhost6.localdomain6 localhost6
-
-10.228.109.253 svc.usr.user.hu svc
+++ /dev/null
-//
-// named.conf
-//
-
-options {
- directory "/var/named";
- dump-file "data/cache_dump.db";
- statistics-file "data/named_stats.txt";
- memstatistics-file "data/named_mem_stats.txt";
-
- listen-on port 53 { any; };
- listen-on-v6 port 53 { any; };
-
- allow-query { none; };
- allow-query-cache { none; };
- allow-recursion { none; };
-
- recursion no;
-
- dnssec-enable yes;
- dnssec-validation no;
-};
-
-logging {
- channel default_debug {
- file "data/named.run" versions 3 size 5m;
- severity dynamic;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel client_channel {
- file "data/client.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel lame-servers_channel {
- file "data/lame-servers.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel notify_channel {
- file "data/notify.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel queries_channel {
- file "data/queries.log" versions 3 size 5m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel security_channel {
- file "data/security.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel xfer-in_channel {
- file "data/xfer-in.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel xfer-out_channel {
- file "data/xfer-out.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- category default {
- default_syslog;
- default_debug;
- };
- category client {
- client_channel;
- };
- category lame-servers {
- lame-servers_channel;
- };
- category notify {
- notify_channel;
- };
- category queries {
- queries_channel;
- };
- category security {
- security_channel;
- };
- category xfer-in {
- xfer-in_channel;
- };
- category xfer-out {
- xfer-out_channel;
- };
-};
-
-key "primary_ns-internal_ns" {
- algorithm hmac-sha256;
- secret "fjQyVn7bfGnbbBTgm7CgJSVOttSm9ji7WlVGVgV02Qo=";
-};
-
-acl internal_networks { 10.228.0.0/16; 192.168.42.0/24; 192.168.43.0/24; };
-acl vpn_client_network { 172.16.223.0/24; };
-acl primary_ns_key_acl { key "primary_ns-internal_ns"; };
-
-masters primary_ns_master { 10.228.109.174 key "primary_ns-internal_ns"; };
-
-server 10.228.109.174 { keys { "primary_ns-internal_ns"; }; };
-
-view "internal" {
- match-clients { internal_networks; vpn_client_network; localhost; };
-
- recursion yes;
-
- allow-query { internal_networks; vpn_client_network; localhost; };
- allow-query-cache { internal_networks; vpn_client_network; localhost; };
- allow-recursion { internal_networks; vpn_client_network; localhost; };
-
- allow-notify { primary_ns_key_acl; };
- notify no;
-
- include "/etc/named.rfc1912.zones";
-
- # internal zones
- zone "in.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/in.user.hu.zone";
- };
- zone "43.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/43.168.192.in-addr.arpa.zone";
- };
- zone "sr.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/sr.user.hu.zone";
- };
- zone "42.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/42.168.192.in-addr.arpa.zone";
- };
- zone "usr.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/usr.user.hu.zone";
- };
- zone "228.10.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/228.10.in-addr.arpa.zone";
- };
-
- # perimeter zones
- zone "pm.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/pm.user.hu.zone";
- };
- zone "173.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/173.168.192.in-addr.arpa.zone";
- };
-
- # external zones
- zone "useribm.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/useribm.hu.zone";
- };
- zone "userrendszerhaz.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/userrendszerhaz.hu.zone";
- };
-};
+++ /dev/null
-# Global Postfix configuration file. This file lists only a subset
-# of all parameters. For the syntax, and for a complete parameter
-# list, see the postconf(5) manual page (command: "man 5 postconf").
-#
-# For common configuration examples, see BASIC_CONFIGURATION_README
-# and STANDARD_CONFIGURATION_README. To find these documents, use
-# the command "postconf html_directory readme_directory", or go to
-# http://www.postfix.org/BASIC_CONFIGURATION_README.html etc.
-#
-# For best results, change no more than 2-3 parameters at a time,
-# and test if Postfix still works after every change.
-
-# COMPATIBILITY
-#
-# The compatibility_level determines what default settings Postfix
-# will use for main.cf and master.cf settings. These defaults will
-# change over time.
-#
-# To avoid breaking things, Postfix will use backwards-compatible
-# default settings and log where it uses those old backwards-compatible
-# default settings, until the system administrator has determined
-# if any backwards-compatible default settings need to be made
-# permanent in main.cf or master.cf.
-#
-# When this review is complete, update the compatibility_level setting
-# below as recommended in the RELEASE_NOTES file.
-#
-# The level below is what should be used with new (not upgrade) installs.
-#
-compatibility_level = 2
-
-# SOFT BOUNCE
-#
-# The soft_bounce parameter provides a limited safety net for
-# testing. When soft_bounce is enabled, mail will remain queued that
-# would otherwise bounce. This parameter disables locally-generated
-# bounces, and prevents the SMTP server from rejecting mail permanently
-# (by changing 5xx replies into 4xx replies). However, soft_bounce
-# is no cure for address rewriting mistakes or mail routing mistakes.
-#
-#soft_bounce = no
-
-# LOCAL PATHNAME INFORMATION
-#
-# The queue_directory specifies the location of the Postfix queue.
-# This is also the root directory of Postfix daemons that run chrooted.
-# See the files in examples/chroot-setup for setting up Postfix chroot
-# environments on different UNIX systems.
-#
-queue_directory = /var/spool/postfix
-
-# The command_directory parameter specifies the location of all
-# postXXX commands.
-#
-command_directory = /usr/sbin
-
-# The daemon_directory parameter specifies the location of all Postfix
-# daemon programs (i.e. programs listed in the master.cf file). This
-# directory must be owned by root.
-#
-daemon_directory = /usr/libexec/postfix
-
-# The data_directory parameter specifies the location of Postfix-writable
-# data files (caches, random numbers). This directory must be owned
-# by the mail_owner account (see below).
-#
-data_directory = /var/lib/postfix
-
-# QUEUE AND PROCESS OWNERSHIP
-#
-# The mail_owner parameter specifies the owner of the Postfix queue
-# and of most Postfix daemon processes. Specify the name of a user
-# account THAT DOES NOT SHARE ITS USER OR GROUP ID WITH OTHER ACCOUNTS
-# AND THAT OWNS NO OTHER FILES OR PROCESSES ON THE SYSTEM. In
-# particular, don't specify nobody or daemon. PLEASE USE A DEDICATED
-# USER.
-#
-mail_owner = postfix
-
-# The default_privs parameter specifies the default rights used by
-# the local delivery agent for delivery to external file or command.
-# These rights are used in the absence of a recipient user context.
-# DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER.
-#
-#default_privs = nobody
-
-# INTERNET HOST AND DOMAIN NAMES
-#
-# The myhostname parameter specifies the internet hostname of this
-# mail system. The default is to use the fully-qualified domain name
-# from gethostname(). $myhostname is used as a default value for many
-# other configuration parameters.
-#
-#myhostname = host.domain.tld
-#myhostname = virtual.domain.tld
-myhostname = mx.usr.user.hu
-
-# The mydomain parameter specifies the local internet domain name.
-# The default is to use $myhostname minus the first component.
-# $mydomain is used as a default value for many other configuration
-# parameters.
-#
-#mydomain = domain.tld
-
-# SENDING MAIL
-#
-# The myorigin parameter specifies the domain that locally-posted
-# mail appears to come from. The default is to append $myhostname,
-# which is fine for small sites. If you run a domain with multiple
-# machines, you should (1) change this to $mydomain and (2) set up
-# a domain-wide alias database that aliases each user to
-# user@that.users.mailhost.
-#
-# For the sake of consistency between sender and recipient addresses,
-# myorigin also specifies the default domain name that is appended
-# to recipient addresses that have no @domain part.
-#
-#myorigin = $myhostname
-myorigin = $mydomain
-
-# RECEIVING MAIL
-
-# The inet_interfaces parameter specifies the network interface
-# addresses that this mail system receives mail on. By default,
-# the software claims all active interfaces on the machine. The
-# parameter also controls delivery of mail to user@[ip.address].
-#
-# See also the proxy_interfaces parameter, for network addresses that
-# are forwarded to us via a proxy or network address translator.
-#
-# Note: you need to stop/start Postfix when this parameter changes.
-#
-#inet_interfaces = all
-inet_interfaces = $myhostname
-#inet_interfaces = $myhostname, localhost
-#inet_interfaces = localhost
-
-# Enable IPv4, and IPv6 if supported
-inet_protocols = all
-
-# The proxy_interfaces parameter specifies the network interface
-# addresses that this mail system receives mail on by way of a
-# proxy or network address translation unit. This setting extends
-# the address list specified with the inet_interfaces parameter.
-#
-# You must specify your proxy/NAT addresses when your system is a
-# backup MX host for other domains, otherwise mail delivery loops
-# will happen when the primary MX host is down.
-#
-#proxy_interfaces =
-#proxy_interfaces = 1.2.3.4
-
-# The mydestination parameter specifies the list of domains that this
-# machine considers itself the final destination for.
-#
-# These domains are routed to the delivery agent specified with the
-# local_transport parameter setting. By default, that is the UNIX
-# compatible delivery agent that lookups all recipients in /etc/passwd
-# and /etc/aliases or their equivalent.
-#
-# The default is $myhostname + localhost.$mydomain + localhost. On
-# a mail domain gateway, you should also include $mydomain.
-#
-# Do not specify the names of virtual domains - those domains are
-# specified elsewhere (see VIRTUAL_README).
-#
-# Do not specify the names of domains that this machine is backup MX
-# host for. Specify those names via the relay_domains settings for
-# the SMTP server, or use permit_mx_backup if you are lazy (see
-# STANDARD_CONFIGURATION_README).
-#
-# The local machine is always the final destination for mail addressed
-# to user@[the.net.work.address] of an interface that the mail system
-# receives mail on (see the inet_interfaces parameter).
-#
-# Specify a list of host or domain names, /file/name or type:table
-# patterns, separated by commas and/or whitespace. A /file/name
-# pattern is replaced by its contents; a type:table is matched when
-# a name matches a lookup key (the right-hand side is ignored).
-# Continue long lines by starting the next line with whitespace.
-#
-# See also below, section "REJECTING MAIL FOR UNKNOWN LOCAL USERS".
-#
-mydestination = $myhostname, localhost.$mydomain, localhost
-#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
-#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
-# mail.$mydomain, www.$mydomain, ftp.$mydomain
-
-# REJECTING MAIL FOR UNKNOWN LOCAL USERS
-#
-# The local_recipient_maps parameter specifies optional lookup tables
-# with all names or addresses of users that are local with respect
-# to $mydestination, $inet_interfaces or $proxy_interfaces.
-#
-# If this parameter is defined, then the SMTP server will reject
-# mail for unknown local users. This parameter is defined by default.
-#
-# To turn off local recipient checking in the SMTP server, specify
-# local_recipient_maps = (i.e. empty).
-#
-# The default setting assumes that you use the default Postfix local
-# delivery agent for local delivery. You need to update the
-# local_recipient_maps setting if:
-#
-# - You define $mydestination domain recipients in files other than
-# /etc/passwd, /etc/aliases, or the $virtual_alias_maps files.
-# For example, you define $mydestination domain recipients in
-# the $virtual_mailbox_maps files.
-#
-# - You redefine the local delivery agent in master.cf.
-#
-# - You redefine the "local_transport" setting in main.cf.
-#
-# - You use the "luser_relay", "mailbox_transport", or "fallback_transport"
-# feature of the Postfix local delivery agent (see local(8)).
-#
-# Details are described in the LOCAL_RECIPIENT_README file.
-#
-# Beware: if the Postfix SMTP server runs chrooted, you probably have
-# to access the passwd file via the proxymap service, in order to
-# overcome chroot restrictions. The alternative, having a copy of
-# the system passwd file in the chroot jail is just not practical.
-#
-# The right-hand side of the lookup tables is conveniently ignored.
-# In the left-hand side, specify a bare username, an @domain.tld
-# wild-card, or specify a user@domain.tld address.
-#
-#local_recipient_maps = unix:passwd.byname $alias_maps
-#local_recipient_maps = proxy:unix:passwd.byname $alias_maps
-#local_recipient_maps =
-
-# The unknown_local_recipient_reject_code specifies the SMTP server
-# response code when a recipient domain matches $mydestination or
-# ${proxy,inet}_interfaces, while $local_recipient_maps is non-empty
-# and the recipient address or address local-part is not found.
-#
-# The default setting is 550 (reject mail) but it is safer to start
-# with 450 (try again later) until you are certain that your
-# local_recipient_maps settings are OK.
-#
-unknown_local_recipient_reject_code = 550
-
-# TRUST AND RELAY CONTROL
-
-# The mynetworks parameter specifies the list of "trusted" SMTP
-# clients that have more privileges than "strangers".
-#
-# In particular, "trusted" SMTP clients are allowed to relay mail
-# through Postfix. See the smtpd_recipient_restrictions parameter
-# in postconf(5).
-#
-# You can specify the list of "trusted" network addresses by hand
-# or you can let Postfix do it for you (which is the default).
-#
-# By default (mynetworks_style = subnet), Postfix "trusts" SMTP
-# clients in the same IP subnetworks as the local machine.
-# On Linux, this does works correctly only with interfaces specified
-# with the "ifconfig" command.
-#
-# Specify "mynetworks_style = class" when Postfix should "trust" SMTP
-# clients in the same IP class A/B/C networks as the local machine.
-# Don't do this with a dialup site - it would cause Postfix to "trust"
-# your entire provider's network. Instead, specify an explicit
-# mynetworks list by hand, as described below.
-#
-# Specify "mynetworks_style = host" when Postfix should "trust"
-# only the local machine.
-#
-#mynetworks_style = class
-#mynetworks_style = subnet
-#mynetworks_style = host
-
-# Alternatively, you can specify the mynetworks list by hand, in
-# which case Postfix ignores the mynetworks_style setting.
-#
-# Specify an explicit list of network/netmask patterns, where the
-# mask specifies the number of bits in the network part of a host
-# address.
-#
-# You can also specify the absolute pathname of a pattern file instead
-# of listing the patterns here. Specify type:table for table-based lookups
-# (the value on the table right-hand side is not used).
-#
-#mynetworks = 168.100.189.0/28, 127.0.0.0/8
-#mynetworks = $config_directory/mynetworks
-#mynetworks = hash:/etc/postfix/network_table
-mynetworks = 10.228.0.0/16, 192.168.42.0/24, 192.168.43.0/24
-
-# The relay_domains parameter restricts what destinations this system will
-# relay mail to. See the smtpd_recipient_restrictions description in
-# postconf(5) for detailed information.
-#
-# By default, Postfix relays mail
-# - from "trusted" clients (IP address matches $mynetworks) to any destination,
-# - from "untrusted" clients to destinations that match $relay_domains or
-# subdomains thereof, except addresses with sender-specified routing.
-# The default relay_domains value is $mydestination.
-#
-# In addition to the above, the Postfix SMTP server by default accepts mail
-# that Postfix is final destination for:
-# - destinations that match $inet_interfaces or $proxy_interfaces,
-# - destinations that match $mydestination
-# - destinations that match $virtual_alias_domains,
-# - destinations that match $virtual_mailbox_domains.
-# These destinations do not need to be listed in $relay_domains.
-#
-# Specify a list of hosts or domains, /file/name patterns or type:name
-# lookup tables, separated by commas and/or whitespace. Continue
-# long lines by starting the next line with whitespace. A file name
-# is replaced by its contents; a type:name table is matched when a
-# (parent) domain appears as lookup key.
-#
-# NOTE: Postfix will not automatically forward mail for domains that
-# list this system as their primary or backup MX host. See the
-# permit_mx_backup restriction description in postconf(5).
-#
-#relay_domains = $mydestination
-
-# INTERNET OR INTRANET
-
-# The relayhost parameter specifies the default host to send mail to
-# when no entry is matched in the optional transport(5) table. When
-# no relayhost is given, mail is routed directly to the destination.
-#
-# On an intranet, specify the organizational domain name. If your
-# internal DNS uses no MX records, specify the name of the intranet
-# gateway host instead.
-#
-# In the case of SMTP, specify a domain, host, host:port, [host]:port,
-# [address] or [address]:port; the form [host] turns off MX lookups.
-#
-# If you're connected via UUCP, see also the default_transport parameter.
-#
-#relayhost = $mydomain
-#relayhost = [gateway.my.domain]
-#relayhost = [mailserver.isp.tld]
-#relayhost = uucphost
-#relayhost = [an.ip.add.ress]
-
-# REJECTING UNKNOWN RELAY USERS
-#
-# The relay_recipient_maps parameter specifies optional lookup tables
-# with all addresses in the domains that match $relay_domains.
-#
-# If this parameter is defined, then the SMTP server will reject
-# mail for unknown relay users. This feature is off by default.
-#
-# The right-hand side of the lookup tables is conveniently ignored.
-# In the left-hand side, specify an @domain.tld wild-card, or specify
-# a user@domain.tld address.
-#
-#relay_recipient_maps = hash:/etc/postfix/relay_recipients
-
-# INPUT RATE CONTROL
-#
-# The in_flow_delay configuration parameter implements mail input
-# flow control. This feature is turned on by default, although it
-# still needs further development (it's disabled on SCO UNIX due
-# to an SCO bug).
-#
-# A Postfix process will pause for $in_flow_delay seconds before
-# accepting a new message, when the message arrival rate exceeds the
-# message delivery rate. With the default 100 SMTP server process
-# limit, this limits the mail inflow to 100 messages a second more
-# than the number of messages delivered per second.
-#
-# Specify 0 to disable the feature. Valid delays are 0..10.
-#
-#in_flow_delay = 1s
-
-# ADDRESS REWRITING
-#
-# The ADDRESS_REWRITING_README document gives information about
-# address masquerading or other forms of address rewriting including
-# username->Firstname.Lastname mapping.
-
-# ADDRESS REDIRECTION (VIRTUAL DOMAIN)
-#
-# The VIRTUAL_README document gives information about the many forms
-# of domain hosting that Postfix supports.
-
-# "USER HAS MOVED" BOUNCE MESSAGES
-#
-# See the discussion in the ADDRESS_REWRITING_README document.
-
-# TRANSPORT MAP
-#
-# See the discussion in the ADDRESS_REWRITING_README document.
-
-# ALIAS DATABASE
-#
-# The alias_maps parameter specifies the list of alias databases used
-# by the local delivery agent. The default list is system dependent.
-#
-# On systems with NIS, the default is to search the local alias
-# database, then the NIS alias database. See aliases(5) for syntax
-# details.
-#
-# If you change the alias database, run "postalias /etc/aliases" (or
-# wherever your system stores the mail alias file), or simply run
-# "newaliases" to build the necessary DBM or DB file.
-#
-# It will take a minute or so before changes become visible. Use
-# "postfix reload" to eliminate the delay.
-#
-#alias_maps = dbm:/etc/aliases
-alias_maps = hash:/etc/aliases
-#alias_maps = hash:/etc/aliases, nis:mail.aliases
-#alias_maps = netinfo:/aliases
-
-# The alias_database parameter specifies the alias database(s) that
-# are built with "newaliases" or "sendmail -bi". This is a separate
-# configuration parameter, because alias_maps (see above) may specify
-# tables that are not necessarily all under control by Postfix.
-#
-#alias_database = dbm:/etc/aliases
-#alias_database = dbm:/etc/mail/aliases
-alias_database = hash:/etc/aliases
-#alias_database = hash:/etc/aliases, hash:/opt/majordomo/aliases
-
-# ADDRESS EXTENSIONS (e.g., user+foo)
-#
-# The recipient_delimiter parameter specifies the separator between
-# user names and address extensions (user+foo). See canonical(5),
-# local(8), relocated(5) and virtual(5) for the effects this has on
-# aliases, canonical, virtual, relocated and .forward file lookups.
-# Basically, the software tries user+foo and .forward+foo before
-# trying user and .forward.
-#
-#recipient_delimiter = +
-
-# DELIVERY TO MAILBOX
-#
-# The home_mailbox parameter specifies the optional pathname of a
-# mailbox file relative to a user's home directory. The default
-# mailbox file is /var/spool/mail/user or /var/mail/user. Specify
-# "Maildir/" for qmail-style delivery (the / is required).
-#
-#home_mailbox = Mailbox
-#home_mailbox = Maildir/
-
-# The mail_spool_directory parameter specifies the directory where
-# UNIX-style mailboxes are kept. The default setting depends on the
-# system type.
-#
-#mail_spool_directory = /var/mail
-#mail_spool_directory = /var/spool/mail
-
-# The mailbox_command parameter specifies the optional external
-# command to use instead of mailbox delivery. The command is run as
-# the recipient with proper HOME, SHELL and LOGNAME environment settings.
-# Exception: delivery for root is done as $default_user.
-#
-# Other environment variables of interest: USER (recipient username),
-# EXTENSION (address extension), DOMAIN (domain part of address),
-# and LOCAL (the address localpart).
-#
-# Unlike other Postfix configuration parameters, the mailbox_command
-# parameter is not subjected to $parameter substitutions. This is to
-# make it easier to specify shell syntax (see example below).
-#
-# Avoid shell meta characters because they will force Postfix to run
-# an expensive shell process. Procmail alone is expensive enough.
-#
-# IF YOU USE THIS TO DELIVER MAIL SYSTEM-WIDE, YOU MUST SET UP AN
-# ALIAS THAT FORWARDS MAIL FOR ROOT TO A REAL USER.
-#
-#mailbox_command = /some/where/procmail
-#mailbox_command = /some/where/procmail -a "$EXTENSION"
-
-# The mailbox_transport specifies the optional transport in master.cf
-# to use after processing aliases and .forward files. This parameter
-# has precedence over the mailbox_command, fallback_transport and
-# luser_relay parameters.
-#
-# Specify a string of the form transport:nexthop, where transport is
-# the name of a mail delivery transport defined in master.cf. The
-# :nexthop part is optional. For more details see the sample transport
-# configuration file.
-#
-# NOTE: if you use this feature for accounts not in the UNIX password
-# file, then you must update the "local_recipient_maps" setting in
-# the main.cf file, otherwise the SMTP server will reject mail for
-# non-UNIX accounts with "User unknown in local recipient table".
-#
-# Cyrus IMAP over LMTP. Specify ``lmtpunix cmd="lmtpd"
-# listen="/var/imap/socket/lmtp" prefork=0'' in cyrus.conf.
-#mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp
-
-# If using the cyrus-imapd IMAP server deliver local mail to the IMAP
-# server using LMTP (Local Mail Transport Protocol), this is prefered
-# over the older cyrus deliver program by setting the
-# mailbox_transport as below:
-#
-# mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp
-#
-# The efficiency of LMTP delivery for cyrus-imapd can be enhanced via
-# these settings.
-#
-# local_destination_recipient_limit = 300
-# local_destination_concurrency_limit = 5
-#
-# Of course you should adjust these settings as appropriate for the
-# capacity of the hardware you are using. The recipient limit setting
-# can be used to take advantage of the single instance message store
-# capability of Cyrus. The concurrency limit can be used to control
-# how many simultaneous LMTP sessions will be permitted to the Cyrus
-# message store.
-#
-# Cyrus IMAP via command line. Uncomment the "cyrus...pipe" and
-# subsequent line in master.cf.
-#mailbox_transport = cyrus
-
-# The fallback_transport specifies the optional transport in master.cf
-# to use for recipients that are not found in the UNIX passwd database.
-# This parameter has precedence over the luser_relay parameter.
-#
-# Specify a string of the form transport:nexthop, where transport is
-# the name of a mail delivery transport defined in master.cf. The
-# :nexthop part is optional. For more details see the sample transport
-# configuration file.
-#
-# NOTE: if you use this feature for accounts not in the UNIX password
-# file, then you must update the "local_recipient_maps" setting in
-# the main.cf file, otherwise the SMTP server will reject mail for
-# non-UNIX accounts with "User unknown in local recipient table".
-#
-#fallback_transport = lmtp:unix:/var/lib/imap/socket/lmtp
-#fallback_transport =
-
-# The luser_relay parameter specifies an optional destination address
-# for unknown recipients. By default, mail for unknown@$mydestination,
-# unknown@[$inet_interfaces] or unknown@[$proxy_interfaces] is returned
-# as undeliverable.
-#
-# The following expansions are done on luser_relay: $user (recipient
-# username), $shell (recipient shell), $home (recipient home directory),
-# $recipient (full recipient address), $extension (recipient address
-# extension), $domain (recipient domain), $local (entire recipient
-# localpart), $recipient_delimiter. Specify ${name?value} or
-# ${name:value} to expand value only when $name does (does not) exist.
-#
-# luser_relay works only for the default Postfix local delivery agent.
-#
-# NOTE: if you use this feature for accounts not in the UNIX password
-# file, then you must specify "local_recipient_maps =" (i.e. empty) in
-# the main.cf file, otherwise the SMTP server will reject mail for
-# non-UNIX accounts with "User unknown in local recipient table".
-#
-#luser_relay = $user@other.host
-#luser_relay = $local@other.host
-#luser_relay = admin+$local
-
-# JUNK MAIL CONTROLS
-#
-# The controls listed here are only a very small subset. The file
-# SMTPD_ACCESS_README provides an overview.
-
-# The header_checks parameter specifies an optional table with patterns
-# that each logical message header is matched against, including
-# headers that span multiple physical lines.
-#
-# By default, these patterns also apply to MIME headers and to the
-# headers of attached messages. With older Postfix versions, MIME and
-# attached message headers were treated as body text.
-#
-# For details, see "man header_checks".
-#
-#header_checks = regexp:/etc/postfix/header_checks
-
-# FAST ETRN SERVICE
-#
-# Postfix maintains per-destination logfiles with information about
-# deferred mail, so that mail can be flushed quickly with the SMTP
-# "ETRN domain.tld" command, or by executing "sendmail -qRdomain.tld".
-# See the ETRN_README document for a detailed description.
-#
-# The fast_flush_domains parameter controls what destinations are
-# eligible for this service. By default, they are all domains that
-# this server is willing to relay mail to.
-#
-#fast_flush_domains = $relay_domains
-
-# SHOW SOFTWARE VERSION OR NOT
-#
-# The smtpd_banner parameter specifies the text that follows the 220
-# code in the SMTP server's greeting banner. Some people like to see
-# the mail version advertised. By default, Postfix shows no version.
-#
-# You MUST specify $myhostname at the start of the text. That is an
-# RFC requirement. Postfix itself does not care.
-#
-#smtpd_banner = $myhostname ESMTP $mail_name
-#smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
-
-# PARALLEL DELIVERY TO THE SAME DESTINATION
-#
-# How many parallel deliveries to the same user or domain? With local
-# delivery, it does not make sense to do massively parallel delivery
-# to the same user, because mailbox updates must happen sequentially,
-# and expensive pipelines in .forward files can cause disasters when
-# too many are run at the same time. With SMTP deliveries, 10
-# simultaneous connections to the same domain could be sufficient to
-# raise eyebrows.
-#
-# Each message delivery transport has its XXX_destination_concurrency_limit
-# parameter. The default is $default_destination_concurrency_limit for
-# most delivery transports. For the local delivery agent the default is 2.
-
-#local_destination_concurrency_limit = 2
-#default_destination_concurrency_limit = 20
-
-# DEBUGGING CONTROL
-#
-# The debug_peer_level parameter specifies the increment in verbose
-# logging level when an SMTP client or server host name or address
-# matches a pattern in the debug_peer_list parameter.
-#
-debug_peer_level = 2
-
-# The debug_peer_list parameter specifies an optional list of domain
-# or network patterns, /file/name patterns or type:name tables. When
-# an SMTP client or server host name or address matches a pattern,
-# increase the verbose logging level by the amount specified in the
-# debug_peer_level parameter.
-#
-#debug_peer_list = 127.0.0.1
-#debug_peer_list = some.domain
-
-# The debugger_command specifies the external command that is executed
-# when a Postfix daemon program is run with the -D option.
-#
-# Use "command .. & sleep 5" so that the debugger can attach before
-# the process marches on. If you use an X-based debugger, be sure to
-# set up your XAUTHORITY environment variable before starting Postfix.
-#
-debugger_command =
- PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
- ddd $daemon_directory/$process_name $process_id & sleep 5
-
-# If you can't use X, use this to capture the call stack when a
-# daemon crashes. The result is in a file in the configuration
-# directory, and is named after the process name and the process ID.
-#
-# debugger_command =
-# PATH=/bin:/usr/bin:/usr/local/bin; export PATH; (echo cont;
-# echo where) | gdb $daemon_directory/$process_name $process_id 2>&1
-# >$config_directory/$process_name.$process_id.log & sleep 5
-#
-# Another possibility is to run gdb under a detached screen session.
-# To attach to the screen sesssion, su root and run "screen -r
-# <id_string>" where <id_string> uniquely matches one of the detached
-# sessions (from "screen -list").
-#
-# debugger_command =
-# PATH=/bin:/usr/bin:/sbin:/usr/sbin; export PATH; screen
-# -dmS $process_name gdb $daemon_directory/$process_name
-# $process_id & sleep 1
-
-# INSTALL-TIME CONFIGURATION INFORMATION
-#
-# The following parameters are used when installing a new Postfix version.
-#
-# sendmail_path: The full pathname of the Postfix sendmail command.
-# This is the Sendmail-compatible mail posting interface.
-#
-sendmail_path = /usr/sbin/sendmail.postfix
-
-# newaliases_path: The full pathname of the Postfix newaliases command.
-# This is the Sendmail-compatible command to build alias databases.
-#
-newaliases_path = /usr/bin/newaliases.postfix
-
-# mailq_path: The full pathname of the Postfix mailq command. This
-# is the Sendmail-compatible mail queue listing command.
-#
-mailq_path = /usr/bin/mailq.postfix
-
-# setgid_group: The group for mail submission and queue management
-# commands. This must be a group name with a numerical group ID that
-# is not shared with other accounts, not even with the Postfix account.
-#
-setgid_group = postdrop
-
-# html_directory: The location of the Postfix HTML documentation.
-#
-html_directory = no
-
-# manpage_directory: The location of the Postfix on-line manual pages.
-#
-manpage_directory = /usr/share/man
-
-# sample_directory: The location of the Postfix sample configuration files.
-# This parameter is obsolete as of Postfix 2.1.
-#
-sample_directory = /usr/share/doc/postfix/samples
-
-# readme_directory: The location of the Postfix README files.
-#
-readme_directory = /usr/share/doc/postfix/README_FILES
-meta_directory = /etc/postfix
-shlib_directory = /usr/lib64/postfix
-
-message_size_limit = 67108864
+++ /dev/null
-net.ipv6.conf.all.disable_ipv6 = 1
-net.ipv6.conf.svc.disable_ipv6 = 1
+++ /dev/null
-lxc.include = /usr/share/lxc/config/common.conf
-
-lxc.arch = x86_64
-lxc.uts.name = vpn.usr.user.hu
-lxc.rootfs.path = __CONTAINER_PATH__/rootfs
-lxc.mount.auto = proc:rw sys:ro
-
-lxc.net.0.type = phys
-lxc.net.0.flags = up
-lxc.net.0.link = vpn
-
-lxc.autodev = 1
-lxc.hook.autodev = __CONTAINER_PATH__/hooks/autodev
-
-lxc.cgroup.devices.allow = c 10:200 rwm
-
-lxc.signal.halt = SIGRTMIN+4
-
-lxc.start.auto = 1
-lxc.start.order = 25
-lxc.start.delay = 3
+++ /dev/null
-BASE_PACKAGES="NetworkManager hostname initscripts iproute iputils rootfiles rsyslog tar vim-minimal"
-SPEC_PACKAGES="easy-rsa openvpn python"
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active NetworkManager.service
-NM_RC=$?
-WAITED=0
-while [ $NM_RC -ne 0 ]
-do
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active NetworkManager.service
- NM_RC=$?
-done
-[ $WAITED -eq 1 ] && echo
-
-CONNECTIONS=$(nmcli --terse connection show | wc -l)
-while [ $CONNECTIONS -ne 1 ]
-do
- echo "Number of connections: $CONNECTIONS" >&2
- sleep 1
- CONNECTIONS=$(nmcli --terse connection show | wc -l)
-done
-
-nmcli --terse connection show | grep ':$' >/dev/null
-ALL_CONNECTION_DEVICES_KNOWN=$?
-while [ $ALL_CONNECTION_DEVICES_KNOWN -eq 0 ]
-do
- echo "Not all connection devices are known yet" >&2
- sleep 1
- nmcli --terse connection show | grep ':$' >/dev/null
- ALL_CONNECTION_DEVICES_KNOWN=$?
-done
-
-CONNECTION_LINE=$(nmcli --terse connection show)
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-CONNECTION_DEVICE=$(echo $CONNECTION_LINE | cut -f 4 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id internal \
- connection.interface-name $CONNECTION_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "10.228.109.236/16" \
- ipv4.dns "10.228.109.104, 10.228.109.253" \
- ipv4.dns-search "usr.user.hu" \
- ipv4.gateway "10.228.109.254" \
- ipv4.method "manual" \
- ipv6.method "ignore" \
- save yes
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active dbus.service
-DBUS_RC=$?
-WAITED=0
-while [ $DBUS_RC -ne 0 ]
-do
- if [ $WAITED -eq 0 ]
- then
- echo -n "Waiting for dbus.service"
- fi
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active dbus.service
- DBUS_RC=$?
-done
-[ $WAITED -ne 0 ] && echo
-timedatectl set-timezone Europe/Budapest
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo "OpenVPN setup scripts can be found in /etc/openvpn/setupscripts"
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-#!/bin/bash
-
-cd $LXC_ROOTFS_MOUNT/dev
-mkdir net
-mknod net/tun c 10 200
-chmod 0666 net/tun
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chown -R root.root $SOURCE_PATH/*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-tar --create \
- --directory=$REAL_PATH \
- --to-stdout \
- install \
- | tar --extract \
- --backup \
- --directory=/ \
- --no-overwrite-dir \
- --strip-components=1 \
- --suffix=.orig
+++ /dev/null
-#!/bin/sh
-
-
-systemctl enable openvpn-server@server.service
-systemctl enable NetworkManager-wait-online.service
-
-systemctl mask wpa_supplicant.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-127.0.0.1 localhost.localdomain localhost localhost4.localdomain4 localhost4
-::1 localhost6.localdomain6 localhost6
-
-10.228.109.236 vpn.usr.user.hu vpn
+++ /dev/null
-##############################################
-# Sample client-side OpenVPN 2.0 config file #
-# for connecting to multi-client server. #
-# #
-# This configuration can be used by multiple #
-# clients, however each client should have #
-# its own cert and key files. #
-# #
-# On Windows, you might want to rename this #
-# file so it has a .ovpn extension #
-##############################################
-
-# Specify that we are a client and that we
-# will be pulling certain config file directives
-# from the server.
-client
-
-# Use the same setting as you are using on
-# the server.
-# On most systems, the VPN will not function
-# unless you partially or fully disable
-# the firewall for the TUN/TAP interface.
-;dev tap
-dev tun
-
-# Windows needs the TAP-Win32 adapter name
-# from the Network Connections panel
-# if you have more than one. On XP SP2,
-# you may need to disable the firewall
-# for the TAP adapter.
-;dev-node MyTap
-
-# Are we connecting to a TCP or
-# UDP server? Use the same setting as
-# on the server.
-;proto tcp
-proto udp
-
-# The hostname/IP and port of the server.
-# You can have multiple remote entries
-# to load balance between the servers.
-remote vpn.userrendszerhaz.hu 1194
-
-# Choose a random host from the remote
-# list for load-balancing. Otherwise
-# try hosts in the order specified.
-;remote-random
-
-# Keep trying indefinitely to resolve the
-# host name of the OpenVPN server. Very useful
-# on machines which are not permanently connected
-# to the internet such as laptops.
-resolv-retry infinite
-
-# Most clients don't need to bind to
-# a specific local port number.
-nobind
-
-# Downgrade privileges after initialization (non-Windows only)
-user nobody
-group nobody
-
-# Try to preserve some state across restarts.
-persist-key
-persist-tun
-
-# If you are connecting through an
-# HTTP proxy to reach the actual OpenVPN
-# server, put the proxy server/IP and
-# port number here. See the man page
-# if your proxy server requires
-# authentication.
-;http-proxy-retry # retry on connection failures
-;http-proxy [proxy server] [proxy port #]
-
-# Wireless networks often produce a lot
-# of duplicate packets. Set this flag
-# to silence duplicate packet warnings.
-;mute-replay-warnings
-
-# SSL/TLS parms.
-# See the server config file for more
-# description. It's best to use
-# a separate .crt/.key file pair
-# for each client. A single ca
-# file can be used for all clients.
-;ca ca.crt
-;cert client.crt
-;key client.key
-
-# Verify server certificate by checking that the
-# certicate has the correct key usage set.
-# This is an important precaution to protect against
-# a potential attack discussed here:
-# http://openvpn.net/howto.html#mitm
-#
-# To use this feature, you will need to generate
-# your server certificates with the keyUsage set to
-# digitalSignature, keyEncipherment
-# and the extendedKeyUsage to
-# serverAuth
-# EasyRSA can do this for you.
-remote-cert-tls server
-
-# If a tls-auth key is used on the server
-# then every client must also have the key.
-;tls-auth ta.key 1
-key-direction 1
-
-# Select a cryptographic cipher.
-# If the cipher option is used on the server
-# then you must also specify it here.
-# Note that v2.4 client/server will automatically
-# negotiate AES-256-GCM in TLS mode.
-# See also the ncp-cipher option in the manpage
-cipher AES-256-CBC
-
-# Enable compression on the VPN link.
-# Don't enable this unless it is also
-# enabled in the server config file.
-#comp-lzo
-
-# Set log file verbosity.
-verb 3
-
-# Silence repeating messages
-;mute 20
+++ /dev/null
-iroute 10.162.104.0 255.255.255.0
+++ /dev/null
-#################################################
-# Sample OpenVPN 2.0 config file for #
-# multi-client server. #
-# #
-# This file is for the server side #
-# of a many-clients <-> one-server #
-# OpenVPN configuration. #
-# #
-# OpenVPN also supports #
-# single-machine <-> single-machine #
-# configurations (See the Examples page #
-# on the web site for more info). #
-# #
-# This config should work on Windows #
-# or Linux/BSD systems. Remember on #
-# Windows to quote pathnames and use #
-# double backslashes, e.g.: #
-# "C:\\Program Files\\OpenVPN\\config\\foo.key" #
-# #
-# Comments are preceded with '#' or ';' #
-#################################################
-
-# Which local IP address should OpenVPN
-# listen on? (optional)
-;local a.b.c.d
-
-# Which TCP/UDP port should OpenVPN listen on?
-# If you want to run multiple OpenVPN instances
-# on the same machine, use a different port
-# number for each one. You will need to
-# open up this port on your firewall.
-port 1194
-
-# TCP or UDP server?
-;proto tcp
-proto udp
-
-# "dev tun" will create a routed IP tunnel,
-# "dev tap" will create an ethernet tunnel.
-# Use "dev tap0" if you are ethernet bridging
-# and have precreated a tap0 virtual interface
-# and bridged it with your ethernet interface.
-# If you want to control access policies
-# over the VPN, you must create firewall
-# rules for the the TUN/TAP interface.
-# On non-Windows systems, you can give
-# an explicit unit number, such as tun0.
-# On Windows, use "dev-node" for this.
-# On most systems, the VPN will not function
-# unless you partially or fully disable
-# the firewall for the TUN/TAP interface.
-;dev tap
-dev tun
-
-# Windows needs the TAP-Win32 adapter name
-# from the Network Connections panel if you
-# have more than one. On XP SP2 or higher,
-# you may need to selectively disable the
-# Windows firewall for the TAP adapter.
-# Non-Windows systems usually don't need this.
-;dev-node MyTap
-
-# SSL/TLS root certificate (ca), certificate
-# (cert), and private key (key). Each client
-# and the server must have their own cert and
-# key file. The server and all clients will
-# use the same ca file.
-#
-# See the "easy-rsa" directory for a series
-# of scripts for generating RSA certificates
-# and private keys. Remember to use
-# a unique Common Name for the server
-# and each of the client certificates.
-#
-# Any X509 key management system can be used.
-# OpenVPN can also use a PKCS #12 formatted key file
-# (see "pkcs12" directive in man page).
-ca easy-rsa/pki/ca.crt
-cert easy-rsa/pki/issued/server.crt
-key easy-rsa/pki/private/server.key # This file should be kept secret
-crl-verify easy-rsa/pki/crl.pem
-
-# Diffie hellman parameters.
-# Generate your own with:
-# openssl dhparam -out dh2048.pem 2048
-#dh dh2048.pem
-dh easy-rsa/pki/dh.pem
-
-# Network topology
-# Should be subnet (addressing via IP)
-# unless Windows clients v2.0.9 and lower have to
-# be supported (then net30, i.e. a /30 per client)
-# Defaults to net30 (not recommended)
-;topology subnet
-
-# Configure server mode and supply a VPN subnet
-# for OpenVPN to draw client addresses from.
-# The server will take 10.8.0.1 for itself,
-# the rest will be made available to clients.
-# Each client will be able to reach the server
-# on 10.8.0.1. Comment this line out if you are
-# ethernet bridging. See the man page for more info.
-server 172.16.223.0 255.255.255.0
-
-# Maintain a record of client <-> virtual IP address
-# associations in this file. If OpenVPN goes down or
-# is restarted, reconnecting clients can be assigned
-# the same virtual IP address from the pool that was
-# previously assigned.
-ifconfig-pool-persist ipp.txt
-
-# Configure server mode for ethernet bridging.
-# You must first use your OS's bridging capability
-# to bridge the TAP interface with the ethernet
-# NIC interface. Then you must manually set the
-# IP/netmask on the bridge interface, here we
-# assume 10.8.0.4/255.255.255.0. Finally we
-# must set aside an IP range in this subnet
-# (start=10.8.0.50 end=10.8.0.100) to allocate
-# to connecting clients. Leave this line commented
-# out unless you are ethernet bridging.
-;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
-
-# Configure server mode for ethernet bridging
-# using a DHCP-proxy, where clients talk
-# to the OpenVPN server-side DHCP server
-# to receive their IP address allocation
-# and DNS server addresses. You must first use
-# your OS's bridging capability to bridge the TAP
-# interface with the ethernet NIC interface.
-# Note: this mode only works on clients (such as
-# Windows), where the client-side TAP adapter is
-# bound to a DHCP client.
-;server-bridge
-
-# Push routes to the client to allow it
-# to reach other private subnets behind
-# the server. Remember that these
-# private subnets will also need
-# to know to route the OpenVPN client
-# address pool (10.8.0.0/255.255.255.0)
-# back to the OpenVPN server.
-;push "route 192.168.10.0 255.255.255.0"
-;push "route 192.168.20.0 255.255.255.0"
-push "route 10.228.0.0 255.255.0.0"
-push "route 192.168.42.0 255.255.255.0"
-push "route 192.168.43.0 255.255.255.0"
-
-# To assign specific IP addresses to specific
-# clients or if a connecting client has a private
-# subnet behind it that should also have VPN access,
-# use the subdirectory "ccd" for client-specific
-# configuration files (see man page for more info).
-client-config-dir ccd
-route 10.162.104.0 255.255.255.0
-
-# EXAMPLE: Suppose the client
-# having the certificate common name "Thelonious"
-# also has a small subnet behind his connecting
-# machine, such as 192.168.40.128/255.255.255.248.
-# First, uncomment out these lines:
-;client-config-dir ccd
-;route 192.168.40.128 255.255.255.248
-# Then create a file ccd/Thelonious with this line:
-# iroute 192.168.40.128 255.255.255.248
-# This will allow Thelonious' private subnet to
-# access the VPN. This example will only work
-# if you are routing, not bridging, i.e. you are
-# using "dev tun" and "server" directives.
-
-# EXAMPLE: Suppose you want to give
-# Thelonious a fixed VPN IP address of 10.9.0.1.
-# First uncomment out these lines:
-;client-config-dir ccd
-;route 10.9.0.0 255.255.255.252
-# Then add this line to ccd/Thelonious:
-# ifconfig-push 10.9.0.1 10.9.0.2
-
-# Suppose that you want to enable different
-# firewall access policies for different groups
-# of clients. There are two methods:
-# (1) Run multiple OpenVPN daemons, one for each
-# group, and firewall the TUN/TAP interface
-# for each group/daemon appropriately.
-# (2) (Advanced) Create a script to dynamically
-# modify the firewall in response to access
-# from different clients. See man
-# page for more info on learn-address script.
-;learn-address ./script
-
-# If enabled, this directive will configure
-# all clients to redirect their default
-# network gateway through the VPN, causing
-# all IP traffic such as web browsing and
-# and DNS lookups to go through the VPN
-# (The OpenVPN server machine may need to NAT
-# or bridge the TUN/TAP interface to the internet
-# in order for this to work properly).
-;push "redirect-gateway def1 bypass-dhcp"
-
-# Certain Windows-specific network settings
-# can be pushed to clients, such as DNS
-# or WINS server addresses. CAVEAT:
-# http://openvpn.net/faq.html#dhcpcaveats
-# The addresses below refer to the public
-# DNS servers provided by opendns.com.
-;push "dhcp-option DNS 208.67.222.222"
-;push "dhcp-option DNS 208.67.220.220"
-push "dhcp-option DNS 10.228.109.253"
-
-# Uncomment this directive to allow different
-# clients to be able to "see" each other.
-# By default, clients will only see the server.
-# To force clients to only see the server, you
-# will also need to appropriately firewall the
-# server's TUN/TAP interface.
-;client-to-client
-
-# Uncomment this directive if multiple clients
-# might connect with the same certificate/key
-# files or common names. This is recommended
-# only for testing purposes. For production use,
-# each client should have its own certificate/key
-# pair.
-#
-# IF YOU HAVE NOT GENERATED INDIVIDUAL
-# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
-# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
-# UNCOMMENT THIS LINE OUT.
-;duplicate-cn
-
-# The keepalive directive causes ping-like
-# messages to be sent back and forth over
-# the link so that each side knows when
-# the other side has gone down.
-# Ping every 10 seconds, assume that remote
-# peer is down if no ping received during
-# a 120 second time period.
-keepalive 10 120
-
-# For extra security beyond that provided
-# by SSL/TLS, create an "HMAC firewall"
-# to help block DoS attacks and UDP port flooding.
-#
-# Generate with:
-# openvpn --genkey --secret ta.key
-#
-# The server and each client must have
-# a copy of this key.
-# The second parameter should be '0'
-# on the server and '1' on the clients.
-tls-auth easy-rsa/pki/ta.key 0 # This file is secret
-
-# Select a cryptographic cipher.
-# This config item must be copied to
-# the client config file as well.
-# Note that 2.4 client/server will automatically
-# negotiate AES-256-GCM in TLS mode.
-# See also the ncp-cipher option in the manpage
-cipher AES-256-CBC
-
-# Enable compression on the VPN link and push the
-# option to the client (2.4+ only, for earlier
-# versions see below)
-;compress lz4-v2
-;push "compress lz4-v2"
-
-# For compression compatible with older clients use comp-lzo
-# If you enable it here, you must also
-# enable it in the client config file.
-;comp-lzo
-
-# The maximum number of concurrently connected
-# clients we want to allow.
-;max-clients 100
-
-# It's a good idea to reduce the OpenVPN
-# daemon's privileges after initialization.
-#
-# You can uncomment this out on
-# non-Windows systems.
-user nobody
-group nobody
-
-# The persist options will try to avoid
-# accessing certain resources on restart
-# that may no longer be accessible because
-# of the privilege downgrade.
-persist-key
-persist-tun
-
-# Output a short status file showing
-# current connections, truncated
-# and rewritten every minute.
-status openvpn-status.log
-
-# By default, log messages will go to the syslog (or
-# on Windows, if running as a service, they will go to
-# the "\Program Files\OpenVPN\log" directory).
-# Use log or log-append to override this default.
-# "log" will truncate the log file on OpenVPN startup,
-# while "log-append" will append to it. Use one
-# or the other (but not both).
-;log openvpn.log
-;log-append openvpn.log
-
-# Set the appropriate level of log
-# file verbosity.
-#
-# 0 is silent, except for fatal errors
-# 4 is reasonable for general usage
-# 5 and 6 can help to debug connection problems
-# 9 is extremely verbose
-verb 3
-
-# Silence repeating messages. At most 20
-# sequential messages of the same message
-# category will be output to the log.
-;mute 20
-
-# Notify the client that when the server restarts so it
-# can automatically reconnect.
-explicit-exit-notify 1
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(realpath $(dirname $0))
-ERSA_PATH=/etc/openvpn/server/easy-rsa
-ERSA_VERSION=$(rpm --query --queryformat "%{VERSION}\n" easy-rsa)
-PKI_PATH=$ERSA_PATH/pki
-
-
-if [ ! -d $PKI_PATH ]
-then
- if [ -d $ERSA_PATH ]
- then
- mv $ERSA_PATH ${ERSA_PATH}.orig
- fi
- mkdir $ERSA_PATH
- cp -a /usr/share/doc/easy-rsa/vars.example $ERSA_PATH/vars
- cp -a /usr/share/easy-rsa/$ERSA_VERSION/easyrsa $ERSA_PATH
- cp -a /usr/share/easy-rsa/$ERSA_VERSION/openssl-easyrsa.cnf $ERSA_PATH
- cp -a /usr/share/easy-rsa/$ERSA_VERSION/x509-types $ERSA_PATH
- cd $ERSA_PATH
- echo "Edit (review only) $ERSA_PATH/openssl-easyrsa.cnf"
- read
- vi $ERSA_PATH/openssl-easyrsa.cnf
- echo "Edit (set EASYRSA_ALGO to ec) $ERSA_PATH/vars"
- echo "Optionally set EASYRSA_CURVE to one of \$(openssl ecparam -list_curves)"
- read
- vi $ERSA_PATH/vars
-
- echo "Run ./easyrsa init-pki"
- read
- ./easyrsa init-pki
- echo "Run ./easyrsa build-ca nopass"
- read
- ./easyrsa build-ca nopass
- echo "Run ./easyrsa gen-crl"
- read
- ./easyrsa gen-crl
- echo "Run ./easyrsa gen-req server nopass"
- read
- ./easyrsa gen-req server nopass
- echo "Run ./easyrsa sign-req server server"
- read
- ./easyrsa sign-req server server
- echo "Run ./easyrsa gen-dh"
- read
- ./easyrsa gen-dh
- echo "Run openvpn --genkey --secret pki/ta.key"
- read
- openvpn --genkey --secret pki/ta.key
- echo "Check server.conf"
- read
- echo "Run ./20_getuids.sh"
- echo "Run ./30_create_client.sh for each client"
-fi
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(realpath $(dirname $0))
-
-
->$REAL_PATH/SEED.txt
->$REAL_PATH/UIDS.txt
-grep '^[a-z]' $REAL_PATH/NAMES.txt | while read LOGIN_NAME
-do
- LOGIN_MD5SUM=$(echo $LOGIN_NAME | md5sum | awk '{print $1}')
- UID_POSITION=30
- UID_IS_UNIQUE=0
- while [ $UID_IS_UNIQUE -eq 0 ]
- do
- LOGIN_UID=$(echo $LOGIN_MD5SUM | cut -c ${UID_POSITION}- | cut -c 1-3)
- grep $LOGIN_UID $REAL_PATH/SEED.txt >/dev/null 2>&1
- if [ $? -eq 1 ]
- then
- INT_UID=$(python -c "print(10000 + int('$LOGIN_UID', 16))")
- HEX_UID=$(python -c "print(hex($INT_UID))")
- echo $LOGIN_NAME $LOGIN_MD5SUM $LOGIN_UID $INT_UID $HEX_UID
- echo $LOGIN_UID >>$REAL_PATH/SEED.txt
- echo $LOGIN_NAME $INT_UID $HEX_UID >>$REAL_PATH/UIDS.txt
- UID_IS_UNIQUE=1
- else
- UID_POSITION=$(( $UID_POSITION - 1 ))
- if [ $UID_POSITION -eq 0 ]
- then
- echo "Cannot generate unique uid for $LOGIN_NAME" >&2
- exit 1
- fi
- fi
- done
-done
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(realpath $(dirname $0))
-OVPN_PATH=/etc/openvpn
-ERSA_PATH=$OVPN_PATH/server/easy-rsa
-PKI_PATH=$ERSA_PATH/pki
-CCFG_PATH=$OVPN_PATH/client-config
-
-
-if [ -z "$1" ]
-then
- echo "Usage: $(basename $0) clientname"
-fi
-
-NAME=$1
-LINE=$(grep "^$NAME " UIDS.txt)
-if [ -z "$LINE" ]
-then
- echo "$NAME not found." >&2
- exit 1
-fi
-
-SERIAL=$(echo $LINE | awk '{print $3}' | cut -c 3-6)
-
-if [ -f $CCFG_PATH/${NAME}.conf ]
-then
- echo "Configuration for $NAME already exists."
-else
- echo "Generating configuration for ${NAME}."
- cd $ERSA_PATH
- echo $SERIAL >${PKI_PATH}/serial
- ./easyrsa gen-req $NAME nopass
- ./easyrsa sign-req client $NAME
- cp -a $CCFG_PATH/client.conf.template $CCFG_PATH/${NAME}.conf
- echo >>$CCFG_PATH/${NAME}.conf
- echo '<ca>' >>$CCFG_PATH/${NAME}.conf
- cat $PKI_PATH/ca.crt >>$CCFG_PATH/${NAME}.conf
- echo '</ca>' >>$CCFG_PATH/${NAME}.conf
- echo >>$CCFG_PATH/${NAME}.conf
- echo '<cert>' >>$CCFG_PATH/${NAME}.conf
- cat $PKI_PATH/issued/${NAME}.crt >>$CCFG_PATH/${NAME}.conf
- echo '</cert>' >>$CCFG_PATH/${NAME}.conf
- echo >>$CCFG_PATH/${NAME}.conf
- echo '<key>' >>$CCFG_PATH/${NAME}.conf
- cat $PKI_PATH/private/${NAME}.key >>$CCFG_PATH/${NAME}.conf
- echo '</key>' >>$CCFG_PATH/${NAME}.conf
- echo >>$CCFG_PATH/${NAME}.conf
- echo '<tls-auth>' >>$CCFG_PATH/${NAME}.conf
- cat $PKI_PATH/ta.key >>$CCFG_PATH/${NAME}.conf
- echo '</tls-auth>' >>$CCFG_PATH/${NAME}.conf
-fi
+++ /dev/null
-#!/bin/sh
-
-
-cat UIDS.txt | while read LINE
-do
- NAME=$(echo $LINE | awk '{print $1}')
- ./30_create_client.sh $NAME
-done
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-# Regular users
-akosztolanyi
-azsamboki
-bcsoka
-csgulyas
-cslevai
-dhorvath
-dvasary
-fritter
-fschnell
-ifabian
-khorvath
-kkele
-mszabo
-rrendek
-tsuhajda
-zbartakovics
-zfelleg
-
-# zfelleg's home network
-qqcs
+++ /dev/null
-login name -> uid: 10000+last 3 digits of md5sum(login name)
- in case of collision: shift the 3 digits
+++ /dev/null
-# Enable IPv4 packet forwarding
-net.ipv4.ip_forward = 1
+++ /dev/null
-net.ipv6.conf.all.disable_ipv6 = 1
-net.ipv6.conf.svc.disable_ipv6 = 1
+++ /dev/null
-lxc.include = /usr/share/lxc/config/common.conf
-
-lxc.arch = x86_64
-lxc.uts.name = ws.pm.user.hu
-lxc.rootfs.path = __CONTAINER_PATH__/rootfs
-lxc.mount.auto = proc:rw sys:ro
-lxc.mount.entry = __CONTAINER_FILESYSTEMS_PATH__/htdocs.useribm.hu.443 var/www/htdocs.useribm.hu.443 none bind,create=dir 0 0
-lxc.mount.entry = __CONTAINER_FILESYSTEMS_PATH__/htdocs.useribm.hu.80 var/www/htdocs.useribm.hu.80 none bind,create=dir 0 0
-lxc.mount.entry = __CONTAINER_FILESYSTEMS_PATH__/htdocs.userrendszerhaz.hu.443 var/www/htdocs.userrendszerhaz.hu.443 none bind,create=dir 0 0
-lxc.mount.entry = __CONTAINER_FILESYSTEMS_PATH__/htdocs.userrendszerhaz.hu.80 var/www/htdocs.userrendszerhaz.hu.80 none bind,create=dir 0 0
-
-lxc.net.0.type = veth
-lxc.net.0.flags = up
-lxc.net.0.link = brh
-lxc.net.0.hwaddr = 02:0c:18:03:ad:f9
-
-lxc.autodev = 1
-
-lxc.signal.halt = SIGRTMIN+4
-
-lxc.start.auto = 1
-lxc.start.order = 13
-lxc.start.delay = 3
+++ /dev/null
-BASE_PACKAGES="NetworkManager hostname initscripts iproute iputils rootfiles rsyslog tar vim-minimal"
-SPEC_PACKAGES="httpd mailx mod_ssl php postfix python3-certbot-apache"
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active NetworkManager.service
-NM_RC=$?
-WAITED=0
-while [ $NM_RC -ne 0 ]
-do
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active NetworkManager.service
- NM_RC=$?
-done
-[ $WAITED -eq 1 ] && echo
-
-CONNECTIONS=$(nmcli --terse connection show | wc -l)
-while [ $CONNECTIONS -ne 1 ]
-do
- echo "Number of connections: $CONNECTIONS" >&2
- sleep 1
- CONNECTIONS=$(nmcli --terse connection show | wc -l)
-done
-
-nmcli --terse connection show | grep ':$' >/dev/null
-ALL_CONNECTION_DEVICES_KNOWN=$?
-while [ $ALL_CONNECTION_DEVICES_KNOWN -eq 0 ]
-do
- echo "Not all connection devices are known yet" >&2
- sleep 1
- nmcli --terse connection show | grep ':$' >/dev/null
- ALL_CONNECTION_DEVICES_KNOWN=$?
-done
-
-CONNECTION_LINE=$(nmcli --terse connection show)
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-CONNECTION_DEVICE=$(echo $CONNECTION_LINE | cut -f 4 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id perimeter \
- connection.interface-name $CONNECTION_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "192.168.173.249/24" \
- ipv4.dns "192.168.173.174" \
- ipv4.dns-search "pm.user.hu" \
- ipv4.gateway "192.168.173.254" \
- ipv4.method "manual" \
- ipv4.routes "10.228.0.0/16 192.168.173.1, 192.168.42.0/24 192.168.173.1" \
- ipv6.method "ignore" \
- save yes
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active dbus.service
-DBUS_RC=$?
-WAITED=0
-while [ $DBUS_RC -ne 0 ]
-do
- if [ $WAITED -eq 0 ]
- then
- echo -n "Waiting for dbus.service"
- fi
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active dbus.service
- DBUS_RC=$?
-done
-[ $WAITED -ne 0 ] && echo
-timedatectl set-timezone Europe/Budapest
+++ /dev/null
-#!/bin/sh
-
-
-exit 0
-authselect select sssd with-mkhomedir --force
-
-cat >>/etc/openldap/ldap.conf <<EOF
-BASE dc=user,dc=hu
-URI ldap://ldap.usr.user.hu
-EOF
+++ /dev/null
-#!/bin/sh
-
-
-echo "Trying to generate certificates..."
-# testing/temporary/staging
-# --staging \
-# final
-certbot certonly \
- --agree-tos \
- --standalone \
- --cert-name user \
- --non-interactive \
- -d hg.useribm.hu \
- -d hg.userrendszerhaz.hu \
- -d jtrac.useribm.hu \
- -d jtrac.userrendszerhaz.hu \
- -d minicrm.useribm.hu \
- -d minicrm.userrendszerhaz.hu \
- -d redmine.useribm.hu \
- -d redmine.userrendszerhaz.hu \
- -d svn.useribm.hu \
- -d svn.userrendszerhaz.hu \
- -d useribm.hu \
- -d userrendszerhaz.hu \
- -d www.useribm.hu \
- -d www.userrendszerhaz.hu \
- -m zoltan.felleg@userrendszerhaz.hu
-RC=$?
-echo "RC: $RC"
-if [ \( $RC -eq 0 \) -a \( -d /etc/letsencrypt/live/user \) ]
-then
- for f in /etc/httpd/conf.d/*.le
- do
- cf=$(echo $f | sed 's/^\(.*\).le$/\1/')
- mv $f $cf
- done
- cp --archive /usr/lib/python3.7/site-packages/certbot_apache/options-ssl-apache.conf /etc/letsencrypt
- systemctl enable httpd.service
- systemctl start httpd.service
- systemctl enable certbot-renew.timer
- systemctl start certbot-renew.timer
-fi
+++ /dev/null
-#!/bin/sh
-
-
-#echo "relayhost = mx.usr.user.hu" >>/etc/postfix/main.cf
-
-systemctl enable postfix.service
-systemctl start postfix.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chown -R root.root $SOURCE_PATH/*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-tar --create \
- --directory=$REAL_PATH \
- --to-stdout \
- install \
- | tar --extract \
- --backup \
- --directory=/ \
- --no-overwrite-dir \
- --strip-components=1 \
- --suffix=.orig
+++ /dev/null
-#!/bin/sh
-
-
-systemctl disable httpd.service
-systemctl enable NetworkManager-wait-online.service
-
-systemctl mask wpa_supplicant.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-127.0.0.1 localhost.localdomain localhost localhost4.localdomain4 localhost4
-::1 localhost6.localdomain6 localhost6
-
-192.168.173.249 ws.pm.user.hu ws
+++ /dev/null
-<VirtualHost *:443>
- ServerName www.useribm.hu
- ServerAlias useribm.hu
- ServerAdmin webadmin@useribm.hu
- DocumentRoot "/var/www/htdocs.useribm.hu.443"
-
- SSLCertificateFile /etc/letsencrypt/live/user/fullchain.pem
- SSLCertificateKeyFile /etc/letsencrypt/live/user/privkey.pem
- Include /etc/letsencrypt/options-ssl-apache.conf
-
- <Directory /var/www/htdocs.useribm.hu.443>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- ProxyPreserveHost On
- ProxyPass /ugyvitel http://192.168.42.248:8079/ugyvitel keepalive=On connectiontimeout=600
- ProxyPassReverse /ugyvitel http://192.168.42.248:8079/ugyvitel
-
- # avon file transfer -> shs.pm.user.hu:80
- ProxyPass /avonxfr http://192.168.173.251/avonxfr
- ProxyPassReverse /avonxfr http://192.168.173.251/avonxfr
-
- # erste file transfer -> shs.pm.user.hu:80
- ProxyPass /erstexfr http://192.168.173.251/erstexfr
- ProxyPassReverse /erstexfr http://192.168.173.251/erstexfr
-
- # onyf file transfer -> shs.pm.user.hu:80
- ProxyPass /onyfxfr http://192.168.173.251/onyfxfr
- ProxyPassReverse /onyfxfr http://192.168.173.251/onyfxfr
-
- # ubis file transfer -> shs.pm.user.hu:80
- ProxyPass /ubisxfr http://192.168.173.251/ubisxfr
- ProxyPassReverse /ubisxfr http://192.168.173.251/ubisxfr
-
- # dvasary's redmine -> dvredmine.usr.user.hu:80
- ProxyPass /redmine http://10.228.62.193/
- ProxyPassReverse /redmine http://10.228.62.193/
-
- # webdav store -> store.usr.user.hu:80
- #ProxyPass /store http://store.usr.user.hu/
- #ProxyPassReverse /store http://store.usr.user.hu/
-</VirtualHost>
-
-<VirtualHost *:443>
- ServerName hg.useribm.hu
- ServerAdmin webadmin@useribm.hu
- DocumentRoot "/var/www/htdocs.useribm.hu.443"
-
- SSLCertificateFile /etc/letsencrypt/live/user/fullchain.pem
- SSLCertificateKeyFile /etc/letsencrypt/live/user/privkey.pem
- Include /etc/letsencrypt/options-ssl-apache.conf
-
- <Directory /var/www/htdocs.useribm.hu.443>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- ProxyPass "/" "http://hg.pm.user.hu/jtrac"
-</VirtualHost>
-
-<VirtualHost *:443>
- ServerName jtrac.useribm.hu
- ServerAdmin webadmin@useribm.hu
- DocumentRoot "/var/www/htdocs.useribm.hu.443"
-
- SSLCertificateFile /etc/letsencrypt/live/user/fullchain.pem
- SSLCertificateKeyFile /etc/letsencrypt/live/user/privkey.pem
- Include /etc/letsencrypt/options-ssl-apache.conf
-
- <Directory /var/www/htdocs.useribm.hu.443>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- ProxyPass /jtrac http://192.168.43.210/jtrac
- ProxyPassReverse /jtrac http://192.168.43.210/jtrac
-</VirtualHost>
-
-<VirtualHost *:443>
- ServerName minicrm.useribm.hu
- ServerAdmin webadmin@useribm.hu
- DocumentRoot "/var/www/htdocs.useribm.hu.443"
-
- SSLCertificateFile /etc/letsencrypt/live/user/fullchain.pem
- SSLCertificateKeyFile /etc/letsencrypt/live/user/privkey.pem
- Include /etc/letsencrypt/options-ssl-apache.conf
-
- <Directory /var/www/htdocs.useribm.hu.443>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- ProxyPass /minicrm http://minicrm.usr.user.hu:8080/minicrm
- ProxyPassReverse /minicrm http://minicrm.usr.user.hu:8080/minicrm
-</VirtualHost>
-
-<VirtualHost *:443>
- ServerName redmine.useribm.hu
- ServerAdmin webadmin@useribm.hu
- DocumentRoot "/var/www/htdocs.useribm.hu.443"
-
- SSLCertificateFile /etc/letsencrypt/live/user/fullchain.pem
- SSLCertificateKeyFile /etc/letsencrypt/live/user/privkey.pem
- Include /etc/letsencrypt/options-ssl-apache.conf
-
- <Directory /var/www/htdocs.useribm.hu.443>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- ProxyPass / http://10.228.62.193/
- ProxyPassReverse / http://10.228.62.193/
-</VirtualHost>
+++ /dev/null
-<VirtualHost *:80>
- ServerName www.useribm.hu
- ServerAlias useribm.hu
- ServerAdmin webadmin@useribm.hu
- DocumentRoot "/var/www/htdocs.useribm.hu.80"
-
- <Directory /var/www/htdocs.useribm.hu.80>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- Redirect permanent / https://www.useribm.hu/
-</VirtualHost>
-
-<VirtualHost *:80>
- ServerName jtrac.useribm.hu
- ServerAdmin webadmin@useribm.hu
- DocumentRoot "/var/www/htdocs.useribm.hu.80"
-
- <Directory /var/www/htdocs.useribm.hu.80>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- Redirect permanent / https://jtrac.useribm.hu/
-</VirtualHost>
-
-<VirtualHost *:80>
- ServerName minicrm.useribm.hu
- ServerAdmin webadmin@useribm.hu
- DocumentRoot "/var/www/htdocs.useribm.hu.80"
-
- <Directory /var/www/htdocs.useribm.hu.80>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- Redirect permanent / https://minicrm.useribm.hu/
-</VirtualHost>
-
-<VirtualHost *:80>
- ServerName redmine.useribm.hu
- ServerAdmin webadmin@useribm.hu
- DocumentRoot "/var/www/htdocs.useribm.hu.80"
-
- <Directory /var/www/htdocs.useribm.hu.80>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- Redirect permanent / https://redmine.useribm.hu/
-</VirtualHost>
+++ /dev/null
-<VirtualHost *:443>
- ServerName www.userrendszerhaz.hu
- ServerAlias userrendszerhaz.hu
- ServerAdmin webadmin@userrendszerhaz.hu
- DocumentRoot "/var/www/htdocs.userrendszerhaz.hu.443"
-
- SSLCertificateFile /etc/letsencrypt/live/user/fullchain.pem
- SSLCertificateKeyFile /etc/letsencrypt/live/user/privkey.pem
- Include /etc/letsencrypt/options-ssl-apache.conf
-
- <Directory /var/www/htdocs.userrendszerhaz.hu.443>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- ProxyPreserveHost On
- ProxyPass /ugyvitel http://192.168.42.248:8079/ugyvitel keepalive=On connectiontimeout=600
- ProxyPassReverse /ugyvitel http://192.168.42.248:8079/ugyvitel
-
- # avon file transfer -> shs.pm.user.hu:80
- ProxyPass /avonxfr http://192.168.173.251/avonxfr
- ProxyPassReverse /avonxfr http://192.168.173.251/avonxfr
-
- # erste file transfer -> shs.pm.user.hu:80
- ProxyPass /erstexfr http://192.168.173.251/erstexfr
- ProxyPassReverse /erstexfr http://192.168.173.251/erstexfr
-
- # onyf file transfer -> shs.pm.user.hu:80
- ProxyPass /onyfxfr http://192.168.173.251/onyfxfr
- ProxyPassReverse /onyfxfr http://192.168.173.251/onyfxfr
-
- # ubis file transfer -> shs.pm.user.hu:80
- ProxyPass /ubisxfr http://192.168.173.251/ubisxfr
- ProxyPassReverse /ubisxfr http://192.168.173.251/ubisxfr
-
- # dvasary's redmine -> dvredmine.usr.user.hu:80
- ProxyPass /redmine http://10.228.62.193/
- ProxyPassReverse /redmine http://10.228.62.193/
-
- # webdav store -> store.usr.user.hu:80
- #ProxyPass /store http://store.usr.user.hu/
- #ProxyPassReverse /store http://store.usr.user.hu/
-</VirtualHost>
-
-<VirtualHost *:443>
- ServerName hg.userrendszerhaz.hu
- ServerAdmin webadmin@userrendszerhaz.hu
- DocumentRoot "/var/www/htdocs.userrendszerhaz.hu.443"
-
- SSLCertificateFile /etc/letsencrypt/live/user/fullchain.pem
- SSLCertificateKeyFile /etc/letsencrypt/live/user/privkey.pem
- Include /etc/letsencrypt/options-ssl-apache.conf
-
- <Directory /var/www/htdocs.userrendszerhaz.hu.443>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- ProxyPass "/" "http://hg.pm.user.hu/jtrac"
-</VirtualHost>
-
-<VirtualHost *:443>
- ServerName jtrac.userrendszerhaz.hu
- ServerAdmin webadmin@userrendszerhaz.hu
- DocumentRoot "/var/www/htdocs.userrendszerhaz.hu.443"
-
- SSLCertificateFile /etc/letsencrypt/live/user/fullchain.pem
- SSLCertificateKeyFile /etc/letsencrypt/live/user/privkey.pem
- Include /etc/letsencrypt/options-ssl-apache.conf
-
- <Directory /var/www/htdocs.userrendszerhaz.hu.443>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- ProxyPass /jtrac http://192.168.43.210/jtrac
- ProxyPassReverse /jtrac http://192.168.43.210/jtrac
-</VirtualHost>
-
-<VirtualHost *:443>
- ServerName minicrm.userrendszerhaz.hu
- ServerAdmin webadmin@userrendszerhaz.hu
- DocumentRoot "/var/www/htdocs.userrendszerhaz.hu.443"
-
- SSLCertificateFile /etc/letsencrypt/live/user/fullchain.pem
- SSLCertificateKeyFile /etc/letsencrypt/live/user/privkey.pem
- Include /etc/letsencrypt/options-ssl-apache.conf
-
- <Directory /var/www/htdocs.userrendszerhaz.hu.443>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- ProxyPass /minicrm http://minicrm.usr.user.hu:8080/minicrm
- ProxyPassReverse /minicrm http://minicrm.usr.user.hu:8080/minicrm
-</VirtualHost>
-
-<VirtualHost *:443>
- ServerName redmine.userrendszerhaz.hu
- ServerAdmin webadmin@userrendszerhaz.hu
- DocumentRoot "/var/www/htdocs.userrendszerhaz.hu.443"
-
- SSLCertificateFile /etc/letsencrypt/live/user/fullchain.pem
- SSLCertificateKeyFile /etc/letsencrypt/live/user/privkey.pem
- Include /etc/letsencrypt/options-ssl-apache.conf
-
- <Directory /var/www/htdocs.userrendszerhaz.hu.443>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- ProxyPass / http://10.228.62.193/
- ProxyPassReverse / http://10.228.62.193/
-</VirtualHost>
+++ /dev/null
-<VirtualHost *:80>
- ServerName www.userrendszerhaz.hu
- ServerAlias userrendszerhaz.hu
- ServerAdmin webadmin@userrendszerhaz.hu
- DocumentRoot "/var/www/htdocs.userrendszerhaz.hu.80"
-
- <Directory /var/www/htdocs.userrendszerhaz.hu.80>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- Redirect permanent / https://www.userrendszerhaz.hu/
-</VirtualHost>
-
-<VirtualHost *:80>
- ServerName jtrac.userrendszerhaz.hu
- ServerAdmin webadmin@userrendszerhaz.hu
- DocumentRoot "/var/www/htdocs.userrendszerhaz.hu.80"
-
- <Directory /var/www/htdocs.userrendszerhaz.hu.80>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- Redirect permanent / https://jtrac.userrendszerhaz.hu/
-</VirtualHost>
-
-<VirtualHost *:80>
- ServerName minicrm.userrendszerhaz.hu
- ServerAdmin webadmin@userrendszerhaz.hu
- DocumentRoot "/var/www/htdocs.userrendszerhaz.hu.80"
-
- <Directory /var/www/htdocs.userrendszerhaz.hu.80>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- Redirect permanent / https://minicrm.userrendszerhaz.hu/
-</VirtualHost>
-
-<VirtualHost *:80>
- ServerName redmine.userrendszerhaz.hu
- ServerAdmin webadmin@userrendszerhaz.hu
- DocumentRoot "/var/www/htdocs.userrendszerhaz.hu.80"
-
- <Directory /var/www/htdocs.userrendszerhaz.hu.80>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- Redirect permanent / https://redmine.userrendszerhaz.hu/
-</VirtualHost>
+++ /dev/null
-lxc.include = /usr/share/lxc/config/common.conf
-
-lxc.arch = x86_64
-lxc.uts.name = xfr.pm.user.hu
-lxc.rootfs.path = __CONTAINER_PATH__/rootfs
-lxc.mount.auto = proc:rw sys:ro
-lxc.mount.entry = __CONTAINER_FILESYSTEMS_PATH__/www.xfr var/www.xfr none bind,create=dir 0 0
-
-lxc.net.0.type = veth
-lxc.net.0.flags = up
-lxc.net.0.link = brh
-lxc.net.0.hwaddr = 02:0c:18:03:ad:fb
-
-lxc.autodev = 1
-
-lxc.signal.halt = SIGRTMIN+4
-
-lxc.start.auto = 1
-lxc.start.order = 14
-lxc.start.delay = 3
+++ /dev/null
-BASE_PACKAGES="NetworkManager hostname initscripts iproute iputils rootfiles rsyslog tar vim-minimal"
-SPEC_PACKAGES="httpd mod_wsgi"
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active NetworkManager.service
-NM_RC=$?
-WAITED=0
-while [ $NM_RC -ne 0 ]
-do
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active NetworkManager.service
- NM_RC=$?
-done
-[ $WAITED -eq 1 ] && echo
-
-CONNECTIONS=$(nmcli --terse connection show | wc -l)
-while [ $CONNECTIONS -ne 1 ]
-do
- echo "Number of connections: $CONNECTIONS" >&2
- sleep 1
- CONNECTIONS=$(nmcli --terse connection show | wc -l)
-done
-
-nmcli --terse connection show | grep ':$' >/dev/null
-ALL_CONNECTION_DEVICES_KNOWN=$?
-while [ $ALL_CONNECTION_DEVICES_KNOWN -eq 0 ]
-do
- echo "Not all connection devices are known yet" >&2
- sleep 1
- nmcli --terse connection show | grep ':$' >/dev/null
- ALL_CONNECTION_DEVICES_KNOWN=$?
-done
-
-CONNECTION_LINE=$(nmcli --terse connection show)
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-CONNECTION_DEVICE=$(echo $CONNECTION_LINE | cut -f 4 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id perimeter \
- connection.interface-name $CONNECTION_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "192.168.173.251/24" \
- ipv4.dns "192.168.173.174" \
- ipv4.dns-search "pm.user.hu" \
- ipv4.gateway "192.168.173.254" \
- ipv4.method "manual" \
- ipv6.method "ignore" \
- save yes
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active dbus.service
-DBUS_RC=$?
-WAITED=0
-while [ $DBUS_RC -ne 0 ]
-do
- if [ $WAITED -eq 0 ]
- then
- echo -n "Waiting for dbus.service"
- fi
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active dbus.service
- DBUS_RC=$?
-done
-[ $WAITED -ne 0 ] && echo
-timedatectl set-timezone Europe/Budapest
+++ /dev/null
-#!/bin/sh
-
-
-exit 0
-authselect select sssd with-mkhomedir --force
-
-cat >>/etc/openldap/ldap.conf <<EOF
-BASE dc=user,dc=hu
-URI ldap://ldap.usr.user.hu
-EOF
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chown -R root.root $SOURCE_PATH/*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-tar --create \
- --directory=$REAL_PATH \
- --to-stdout \
- install \
- | tar --extract \
- --backup \
- --directory=/ \
- --no-overwrite-dir \
- --strip-components=1 \
- --suffix=.orig
+++ /dev/null
-#!/bin/sh
-
-
-systemctl enable httpd.service
-systemctl enable NetworkManager-wait-online.service
-
-systemctl mask wpa_supplicant.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-127.0.0.1 localhost.localdomain localhost localhost4.localdomain4 localhost4
-::1 localhost6.localdomain6 localhost6
-
-192.168.173.251 xfr.pm.user.hu xfr
+++ /dev/null
-WSGISocketPrefix run/wsgi
-
-<VirtualHost *:80>
- ServerName xfr.userrendszerhaz.hu
- ServerAdmin webadmin@userrendszerhaz.hu
- DocumentRoot "/var/www.xfr/htdocs.80"
-
- <Directory /var/www.xfr/htdocs.80>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-
- <Directory /var/www.xfr/htdocs.80/avonxfr>
- AuthType Basic
- AuthName "Avon File Transfer"
- AuthUserFile /var/www.xfr/auth/avonxfr.users
- Require valid-user
-
- Options Indexes
- </Directory>
-
- Alias /avonxfr/download /var/www.xfr/htdocs.80/avonxfr/download
-
- <Directory /var/www.xfr/htdocs.80/avonxfr/download>
- Options Indexes
- </Directory>
-
- <Directory /var/www.xfr/htdocs.80/erstexfr>
- AuthType Basic
- AuthName "Erste File Transfer"
- AuthUserFile /var/www.xfr/auth/erstexfr.users
- Require valid-user
-
- Options Indexes
- </Directory>
-
- Alias /erstexfr/download /var/www.xfr/htdocs.80/erstexfr/download
-
- <Directory /var/www.xfr/htdocs.80/erstexfr/download>
- Options Indexes
- </Directory>
-
- <Directory /var/www.xfr/htdocs.80/onyfxfr>
- AuthType Basic
- AuthName "ONYF File Transfer"
- AuthUserFile /var/www.xfr/auth/onyfxfr.users
- Require valid-user
-
- Options Indexes
- </Directory>
-
- Alias /onyfxfr/download /var/www.xfr/htdocs.80/onyfxfr/download
-
- <Directory /var/www.xfr/htdocs.80/onyfxfr/download>
- Options Indexes
- </Directory>
-
- <Directory /var/www.xfr/htdocs.80/ubisxfr>
- AuthType Basic
- AuthName "UBIS File Transfer"
- AuthUserFile /var/www.xfr/auth/ubisxfr.users
- Require valid-user
-
- Options Indexes
- </Directory>
-
- Alias /ubisxfr/download /var/www.xfr/htdocs.80/ubisxfr/download
-
- <Directory /var/www.xfr/htdocs.80/ubisxfr/download>
- Options Indexes
- </Directory>
-
- WSGIDaemonProcess was.80 processes=1 threads=1 maximum-requests=10000 shutdown-timeout=5
- WSGIProcessGroup was.80
- WSGIScriptAlias /avonxfr/upload/do /var/www.xfr/wsgi.80/upload.wsgi
- WSGIScriptAlias /erstexfr/upload/do /var/www.xfr/wsgi.80/upload.wsgi
- WSGIScriptAlias /onyfxfr/upload/do /var/www.xfr/wsgi.80/upload.wsgi
- WSGIScriptAlias /ubisxfr/upload/do /var/www.xfr/wsgi.80/upload.wsgi
-
- <Directory /var/www.xfr/wsgi.80>
- <RequireAny>
- Require all granted
- </RequireAny>
- </Directory>
-</VirtualHost>
ServerAdmin webadmin@userrendszerhaz.hu
DocumentRoot "/var/www.xfr/htdocs.80"
+ IndexOptions NameWidth=*
+
<Directory /var/www.xfr/htdocs.80>
<RequireAny>
Require all granted
https://git.useribm.hu / user-lxc.git / commitdiff