Serveur Debian10

gdisk /dev/sda

gdisk /dev/sda

GPT fdisk (gdisk) version 0.8.6
 
Partition table scan:
  MBR: not present
  BSD: not present
  APM: not present
  GPT: not present
 
Creating new GPT entries.
 
Command (? for help): o
This option deletes all partitions and creates a new protective MBR.
Proceed? (Y/N): y

Command (? for help): n
Partition number (1-128, default 1): 
First sector (34-937703054, default = 2048) or {+-}size{KMGTP}: 
Last sector (2048-937703054, default = 937703054) or {+-}size{KMGTP}: +2M
Current type is 8300 (Linux filesystem)
Hex code or GUID (L to show codes, Enter = 8300): ef02
Changed type of partition to 'BIOS boot partition'

Command (? for help): n
Partition number (2-128, default 2): 
First sector (34-937703054, default = 6144) or {+-}size{KMGTP}: 
Last sector (6144-937703054, default = 937703054) or {+-}size{KMGTP}: +512M
Current type is 8300 (Linux filesystem)
Hex code or GUID (L to show codes, Enter = 8300): 
Changed type of partition to 'Linux filesystem'

Command (? for help): n
Partition number (3-128, default 3): 
First sector (34-937703054, default = 1054720) or {+-}size{KMGTP}: 
Last sector (1054720-937703054, default = 937703054) or {+-}size{KMGTP}: +4G
Current type is 8300 (Linux filesystem)
Hex code or GUID (L to show codes, Enter = 8300): 8200
Changed type of partition to 'Linux swap'

Command (? for help): n
Partition number (4-128, default 4): 
First sector (34-937703054, default = 9443328) or {+-}size{KMGTP}: 
Last sector (9443328-937703054, default = 937703054) or {+-}size{KMGTP}: 
Current type is 8300 (Linux filesystem)
Hex code or GUID (L to show codes, Enter = 8300): 8e00
Changed type of partition to 'Linux LVM'
 
Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!
 
Do you want to proceed? (Y/N): y
OK; writing new GUID partition table (GPT) to /dev/sda.
The operation has completed successfully.

ssh ctuser@192.168.0.45

su 

apt update && apt upgrade -y

apt install rsync curl tmux jq figlet tree git -y

apt install sudo

echo "ctuser     ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

# Global, tout utilisateur
echo '"\e[1;2A": history-search-backward' | sudo tee -a /etc/inputrc
echo '"\e[1;2B": history-search-forward' | sudo tee -a /etc/inputrc

ssh-keygen -t ed25519 -o -a 100 -f ~/.ssh/srvct-ed25519

scp ~/.ssh/srvct-ed25519.pub ctuser@192.168.0.45:/home/ctuser/

ssh ctuser@192.168.0.45

cd ~

chmod 600 $HOME/.ssh/authorized_keys

rm $HOME/srvct-ed25519.pub

sudo sed -i 's/#Port 22/Port 55035/g' /etc/ssh/sshd_config
sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config

sudo apt-get install libpam-systemd  # Installé par défaut sur debian buster

sudo systemctl restart sshd

ssh -p 55035 -i ~/.ssh/srvct-ed25519 ctuser@192.168.0.45

hostnamectl

   Static hostname: srvct
         Icon name: computer-desktop
           Chassis: desktop
        Machine ID: b65c705c91e04653ad975d9c29f50ed0
           Boot ID: 10aa2c2367a845a3acddb3d72ab7df3f
  Operating System: Debian GNU/Linux 10 (buster)
            Kernel: Linux 4.19.0-10-amd64
      Architecture: x86-64

sudo gpasswd -a $USER systemd-journal
sudo gpasswd -a $USER adm

echo "export SYSTEMD_LESS=FRXMK journalctl" >> /home/$USER/.bashrc

sudo nano /etc/motd

                                               
  ___ _ _ __ ____ __ ___                       
 (_-<| '_|\ V /\ \ // _ \                      
 /__/|_|   \_/ /_\_\\___/                      
 __ __ ___  _  _ (_) ___ ___    __ __ _  _  ___
 \ \ // _ \| || || ||_ // -_) _ \ \ /| || ||_ /
 /_\_\\___/ \_, ||_|/__|\___|(_)/_\_\ \_, |/__|
            |__/                      |__/     

sudo -s

apt install nfs-kernel-server

rpcinfo -p | grep nfs

    100003    3   tcp   2049  nfs
    100003    4   tcp   2049  nfs
    100003    3   udp   2049  nfs

cat /proc/filesystems | grep nfs

nodev	nfsd

rpcinfo -p | grep portmap

    100000    4   tcp    111  portmapper
    100000    3   tcp    111  portmapper
    100000    2   tcp    111  portmapper
    100000    4   udp    111  portmapper
    100000    3   udp    111  portmapper
    100000    2   udp    111  portmapper

sudo -s

nano /etc/exports

/srv/data	192.168.0.0/24(rw,sync,no_subtree_check,no_root_squash)
/srv/nfs	192.168.0.0/24(rw,sync,no_subtree_check,no_root_squash)

exportfs -ar

sudo -s

echo "rpcbind mountd nfsd statd lockd rquotad : ALL" >> /etc/hosts.deny
echo "rpcbind mountd nfsd statd lockd rquotad: 192.168.0." >> /etc/hosts.allow

echo 'STATDOPTS="--port 32765 --outgoing-port 32766"' >> /etc/default/nfs-common
echo 'RPCMOUNTDOPTS="-p 32767"' >> /etc/default/nfs-kernel-server
echo 'RPCRQUOTADOPTS="-p 32769"' >> /etc/default/quota

sysctl --system

* Applying /etc/sysctl.d/99-sysctl.conf ...
* Applying /etc/sysctl.d/protect-links.conf ...
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
* Applying /etc/sysctl.conf ...

systemctl restart nfs-kernel-server

iptables -A INPUT -s 192.168.0.0/24 -p tcp -m multiport --ports 111,2049,32764:32769 -j ACCEPT -m comment --comment "NFS Server"
iptables -A INPUT -s 192.168.0.0/24 -p udp -m multiport --ports 111,2049,32764:32769 -j ACCEPT -m comment --comment "NFS Server"

sudo chmod 2770 /srv/nfs

sudo groupadd -g 9999 partage      # sur client et serveur
sudo usermod -a -G partage $USER   # sur client et serveur
sudo chgrp partage /srv/nfs        # serveur uniquement

ls -la /srv/nfs/

sudo apt install cifs-utils smbclient

smbclient -L <nom-de-l'ordinateur> (nécessite le paquet smbclient)

sudo nano /sbin/iptables-firewall.sh

#!/bin/bash
# Configure iptables firewall

# Limit PATH
PATH="/sbin:/usr/sbin:/bin:/usr/bin"

# iptables configuration
firewall_start() {
###################
#      IPv4       #
###################

# refuser input et forward par défaut, accepter output
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT ACCEPT

# interface lo (loop) accessible
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# maintenir les connexions établies
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# accepter en entrée le ping (icmp), et les
# connexions sur les ports nécessaires.
iptables -A INPUT -p icmp --icmp-type echo-request -m conntrack --ctstate NEW -m limit --limit 1/s --limit-burst 1 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 55035 -j ACCEPT

# NFSV4
iptables -A INPUT -s 192.168.0.0/24 -p tcp -m multiport --ports 111,2049,32764:32769 -j ACCEPT -m comment --comment "NFS Server"
iptables -A INPUT -s 192.168.0.0/24 -p udp -m multiport --ports 111,2049,32764:32769 -j ACCEPT -m comment --comment "NFS Server"

# accepter en sortie le ping, les requêtes HTTP(S), DNS,
# et les connexions sur les ports nécessaires.
iptables -A OUTPUT -p icmp --icmp-type echo-request -m conntrack --ctstate NEW -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT


###################
#      IPv6       #
###################

# refuser input et forward par défaut, accepter output
ip6tables -t filter -P INPUT DROP
ip6tables -t filter -P FORWARD DROP
ip6tables -t filter -P OUTPUT ACCEPT

# interface lo (loop) accessible
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT

# maintenir les connexions établies
ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# NDP pour toute interface de type broadcast
ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbour-solicitation -m hl --hl-eq 255 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbour-advertisement -m hl --hl-eq 255 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT

ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbour-solicitation -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbour-advertisement -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type router-solicitation -j ACCEPT

# accepter en entrée le ping (icmpv6), les
# connexions entrantes déjà établies et les connexions sur les ports nécessaires.
ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -m conntrack --ctstate NEW -m limit --limit 1/s --limit-burst 1 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 55035 -j ACCEPT
ip6tables -A INPUT -p udp --dport 55035 -j ACCEPT

# accepter en sortie le ping, les requêtes HTTP(S), DNS,
# et les connexions sur les ports nécessaires.
ip6tables -t filter -A OUTPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
ip6tables -A OUTPUT -p tcp --dport 80 -j ACCEPT
ip6tables -A OUTPUT -p tcp --dport 443 -j ACCEPT
ip6tables -A OUTPUT -p udp --dport 53 -j ACCEPT
ip6tables -A OUTPUT -p tcp --dport 53 -j ACCEPT
}

# clear iptables configuration
firewall_stop() {
  iptables -F
  iptables -X
  iptables -P INPUT   ACCEPT
  iptables -P FORWARD ACCEPT
  iptables -P OUTPUT  ACCEPT
  ip6tables -F
  ip6tables -X
  ip6tables -P INPUT   ACCEPT
  ip6tables -P FORWARD ACCEPT
  ip6tables -P OUTPUT  ACCEPT
}

# execute action
case "$1" in
  start|restart)
    echo "Starting firewall"
    firewall_stop
    firewall_start
    ;;
  stop)
    echo "Stopping firewall"
    firewall_stop
    ;;
esac

sudo chown root:root /sbin/iptables-firewall.sh
sudo chmod 750 /sbin/iptables-firewall.sh 

cat << EOF | sudo tee /etc/systemd/system/iptables-firewall.service
[Unit]
Description=iptables firewall service
After=network.target

[Service]
Type=oneshot
ExecStart=/sbin/iptables-firewall.sh start
RemainAfterExit=true
ExecStop=/sbin/iptables-firewall.sh stop
StandardOutput=journal

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload

sudo systemctl start iptables-firewall
sudo systemctl enable iptables-firewall

sudo -s

apt install borgbackup

useradd borg --create-home --home-dir /srv/data/borg-backups/

chown borg.borg -R  /srv/data/borg-backups/

mkdir -p /srv/data/borg-backups/.ssh
cat >> /srv/data/borg-backups/.ssh/authorized_keys

echo "borg ALL=NOPASSWD: /usr/bin/borg" >> /etc/sudoers

ssh-keygen -t ed25519 -o -a 100 -f ~/.ssh/xoyaz_ed25519

ssh -p 55036 -i /home/xoyi/.ssh/xoyaz_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null usernl@xoyaz.xyz

nano .ssh/exclude-list.txt

.bash_logout
.bashrc
.profile
.ssh

tmux
sudo -s
rsync -avz --progress --stats --human-readable --exclude-from '/home/xoyi/.ssh/exclude-list.txt' --rsync-path="sudo rsync" -e "ssh -p 55036 -i /home/xoyi/.ssh/xoyaz_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"  usernl@xoyaz.xyz:/srv/data/borg-backups/* /srv/data/borg-backups/

sudo crontab -e

# Synchro Backup entre serveur distant xoyaz.xyz (contient les backup des serveurs VPS) et le serveur local xoyize.xyz 
30 02 * * * rsync -avz --progress --stats --delete --human-readable --exclude-from '/home/xoyi/.ssh/exclude-list.txt' --rsync-path="sudo rsync" -e "ssh -p 55036 -i /home/xoyi/.ssh/xoyaz_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"  usernl@xoyaz.xyz:/srv/data/borg-backups/* /srv/data/borg-backups/ ; if [ $? -eq 0 ]; then echo "Rsync usernl@xoyaz.xyz:/srv/data/borg-backups/* /srv/data/borg-backups/ : Synchronisation OK" | systemd-cat -t rsync-cron -p info ; else echo "Rsync usernl@xoyaz.xyz:/srv/data/borg-backups/* /srv/data/borg-backups/ : Synchronisation ERREUR" | systemd-cat -t rsync-cron -p emerg ; fi

if [ $? -eq 0 ]
 then
  echo "Rsync usernl@xoyaz.xyz:/srv/data/borg-backups/* /srv/data/borg-backups/ : Synchronisation OK" | systemd-cat -t rsync-cron -p info
 else
  echo "Rsync usernl@xoyaz.xyz:/srv/data/borg-backups/* /srv/data/borg-backups/ :Erreur Synchronisation" | systemd-cat -t rsync-cron -p emerg
fi

journalctl -t rsync-cron

-- Logs begin at Thu 2019-08-29 11:07:55 CEST, end at Tue 2019-09-17 17:50:32 CEST. --
sept. 17 17:50:32 srvxo rsync-cron[11728]: Rsync usernl@xoyaz.xyz:/srv/data/borg-backups/* /srv/data/borg-backups/ : Synchronisation OK

sudo crontab -e

# Sauvegarde de dossiers /srv/data/{music,CalibreTechnique} sur serveur distant backup (nl) xoyaz.xyz
# Synchro music avec Backup
00 02 * * * rsync -avz --progress --stats --human-readable --delete --exclude-from '/home/xoyi/.ssh/exclude-list.txt' --rsync-path="sudo rsync" -e "ssh -p 55036 -i /home/xoyi/.ssh/xoyaz_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"  /srv/data/music/* usernl@xoyaz.xyz:/home/usernl/backup/musique/ ; if [ $? -eq 0 ]; then echo "Rsync /srv/data/music/* usernl@xoyaz.xyz:/home/usernl/backup/musique/ : Synchronisation OK" | systemd-cat -t rsync-cron -p info ; else echo "Rsync /srv/data/music/* usernl@xoyaz.xyz:/home/usernl/backup/musique/ : Synchronisation ERREUR" | systemd-cat -t rsync-cron -p emerg ; fi

# Synchro CalibreTechnique avec Backup
10 02 * * * rsync -avz --progress --stats --human-readable --exclude-from '/home/xoyi/.ssh/exclude-list.txt' --rsync-path="sudo rsync" -e "ssh -p 55036 -i /home/xoyi/.ssh/xoyaz_ed25519 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"  /srv/data/CalibreTechnique/* usernl@xoyaz.xyz:/home/usernl/backup/CalibreTechnique/ ; if [ $? -eq 0 ]; then echo "Rsync /srv/data/CalibreTechnique/* usernl@xoyaz.xyz:/home/usernl/backup/CalibreTechnique/ : Synchronisation OK" | systemd-cat -t rsync-cron -p info ; else echo "Rsync /srv/data/CalibreTechnique/* usernl@xoyaz.xyz:/home/usernl/backup/CalibreTechnique/ : Synchronisation ERREUR" | systemd-cat -t rsync-cron -p emerg ; fi

sudo crontab -e

10 02 * * * rsync -avz --progress --stats --human-readable --rsync-path="sudo rsync" -e "ssh -p 55031 -i /home/xoyi/.ssh/kvm-vps591606 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"  /srv/data/devel/ouestline/osm-new/* debadm@cinay.xyz:/srv/osm-new/ ; if [ $? -eq 0 ]; then echo "Rsync /srv/data/devel/ouestline/osm-new/* debadm@cinay.xyz:/srv/osm-new/ : Synchronisation OK" | systemd-cat -t rsync-osm -p info ; else echo "Rsync /srv/data/devel/ouestline/osm-new/* debadm@cinay.xyz:/srv/osm-new/ : Synchronisation ERREUR" | systemd-cat -t rsync-osm -p emerg ; fi

sudo -s
apt install resolvconf -y
echo "nameserver 127.0.0.1" >> /etc/resolvconf/resolv.conf.d/head

/var/lib/unbound/blocked.zone

$TTL 10800
@	IN SOA localhost. nobody.invalid. (
	1
	3600
	1200
	604800
	10800
	)

/etc/unbound/unbound.conf.d/adblock-war.conf

# À n'utiliser qu'avec une version d'Unbound supérieure à la 1.7.0
auth-zone:
	name: "eulerian.net."
	zonefile: "/var/lib/unbound/blocked.zone"
auth-zone:
	name: "eulerian.fr."
	zonefile: "/var/lib/unbound/blocked.zone"
auth-zone:
	name: "eulerian.com."
	zonefile: "/var/lib/unbound/blocked.zone"
auth-zone:
	name: "dnsdelegation.io."
	zonefile: "/var/lib/unbound/blocked.zone"
auth-zone:
	name: "a.20mn.fr."
	zonefile: "/var/lib/unbound/blocked.zone"
auth-zone:
	name: "at-o.net."
	zonefile: "/var/lib/unbound/blocked.zone"
auth-zone:
	name: "keyade.com."
	zonefile: "/var/lib/unbound/blocked.zone"
auth-zone:
	name: "storetail.io."
	zonefile: "/var/lib/unbound/blocked.zone"
auth-zone:
	name: "omtrdc.net."
	zonefile: "/var/lib/unbound/blocked.zone"

systemctl restart unbound

dig v.oui.sncf

; <<>> DiG 9.11.5-P4-5.1-Debian <<>> v.oui.sncf
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 23289
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;v.oui.sncf.			IN	A

;; ANSWER SECTION:
v.oui.sncf.		2822	IN	CNAME	voyages-sncf.eulerian.net.

;; AUTHORITY SECTION:
eulerian.net.		10021	IN	SOA	localhost. nobody.invalid. 1 3600 1200 604800 10800

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: ven. nov. 15 16:07:19 CET 2019
;; MSG SIZE  rcvd: 137

my $CADAYS = "-days 3650";	# 10 years
my $CATOP = "/etc/ssl/CertificateAuthority";

[ CA_default ]

dir		= /etc/ssl/CertificateAuthority		# Where everything is kept

/usr/lib/ssl/misc/CA.pl -newca # Répondre aux différentes questions ,une "passphrase" sera demandée pour le fichier cakey.pem (conserver la "passphrase")

tree /etc/ssl/CertificateAuthority/

/etc/ssl/CertificateAuthority/
├── cacert.pem
├── careq.pem
├── certs
├── crl
├── crlnumber
├── index.txt
├── index.txt.attr
├── index.txt.old
├── newcerts
│   └── 0DDDBF9FF301DFEC10C1E57CEBB38DAD6E7A6251.pem
├── private
│   └── cakey.pem
└── serial

openssl x509 -hash -noout -in /etc/ssl/CertificateAuthority/cacert.pem 
    ecd697ae

ln -s /etc/ssl/CertificateAuthority/cacert.pem /etc/ssl/CertificateAuthority/certs/ecd697ae.0

# Certificat client Yannick
sudo -s
cd /etc/ssl/CertificateAuthority/
openssl ecparam -out yannick.key -name prime256v1 -genkey
openssl req -new -key yannick.key -out yannick.csr -sha256    # Renseigner Common Name obligatoirement (Yannick)
openssl req -x509 -in yannick.csr -key yannick.key > admin-linux.crt
openssl ca -policy policy_anything -out yannick.crt -infiles yannick.csr # signature et valable 365 jours , mp cakey.pem demandé
openssl pkcs12 -export -out yannick.pfx -inkey yannick.key -in yannick.crt -certfile cacert.pem # il faut saisir un mot de passe d'exportation pour le certificat client (mp yannick)
cp yannick.pfx /srv/nfs/
chmod 775 /srv/nfs/yannick.pfx

# Certificat client Yann
sudo -s
cd /etc/ssl/CertificateAuthority/
openssl ecparam -out yann.key -name prime256v1 -genkey
openssl req -new -key yann.key -out yann.csr -sha256    # Renseigner Common Name obligatoirement (Yann)
openssl req -x509 -in yann.csr -key yann.key > admin-linux.crt
openssl ca -policy policy_anything -out yann.crt -infiles yann.csr # signature et valable 365 jours , mp cakey.pem demandé
openssl pkcs12 -export -out yann.pfx -inkey yann.key -in yann.crt -certfile cacert.pem # il faut saisir un mot de passe d'exportation pour le certificat client (mp yann)
cp yann.pfx /srv/nfs/
chmod 775 /srv/nfs/yann.pfx

Versions Nginx OpenSSL MariaDB et PHP
nginx version: nginx/1.16.1
OpenSSL 1.1.1d  10 Sep 2019
mysql  Ver 15.1 Distrib 10.3.22-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2
Mot de passe MySql/MariaDB : /etc/mysql/mdp
PHP 7.4.3 (cli) (built: Feb 24 2020 18:39:14) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with Zend OPcache v7.4.3, Copyright (c), by Zend Technologies

sudo nginx -V

nginx version: nginx/1.16.1
built by gcc 8.3.0 (Debian 8.3.0-6) 
built with OpenSSL 1.1.1d  10 Sep 2019
TLS SNI support enabled
configure arguments: \
 --with-cc-opt='-g -O2 -fdebug-prefix-map=/usr/src/nginx-custom/$stable_nginx=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2' \
 --with-ld-opt='-Wl,-z,relro -Wl,-z,now,-rpath,/usr/local/lib' \
 --prefix=/usr/share/nginx \
 --user=nginx \
 --group=nginx \
 --sbin-path=/usr/sbin/nginx \
 --conf-path=/etc/nginx/nginx.conf \
 --http-log-path=/var/log/nginx/access.log \
 --error-log-path=/var/log/nginx/error.log \
 --lock-path=/var/lock/nginx.lock \
 --pid-path=/run/nginx.pid \
 --modules-path=/usr/lib/nginx/modules \
 --http-client-body-temp-path=/var/lib/nginx/body \
 --http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
 --http-proxy-temp-path=/var/lib/nginx/proxy \
 --http-scgi-temp-path=/var/lib/nginx/scgi \
 --http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
 --with-debug \
 --with-pcre-jit \
 --with-http_ssl_module \
 --with-http_stub_status_module \
 --with-http_realip_module \
 --with-http_auth_request_module \
 --with-http_v2_module \
 --with-http_dav_module \
 --with-http_slice_module \
 --with-threads \
 --with-http_addition_module \
 --with-http_flv_module \
 --with-http_geoip_module=dynamic \
 --with-http_gunzip_module \
 --with-http_gzip_static_module \
 --with-http_image_filter_module=dynamic \
 --with-http_mp4_module \
 --with-http_perl_module=dynamic \
 --with-http_random_index_module \
 --with-http_secure_link_module \
 --with-http_sub_module \
 --with-http_xslt_module=dynamic \
 --with-mail=dynamic \
 --with-mail_ssl_module \
 --with-stream \
 --with-stream_ssl_module \
 --with-stream_ssl_preread_module \
 --with-http_ssl_module \
 --add-dynamic-module=../modules/nginx-auth-pam \
 --add-dynamic-module=../modules/ngx-fancyindex

sudo mkdir -p /var/www/default-www
sudo mv /var/www/{index.html,info.php} /var/www/default-www/

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
}

http {
  server_names_hash_bucket_size 64;
		upstream php-handler {
	  		server unix:/run/php/php7.4-fpm.sock;
		}

	
	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	tcp_nodelay on;
	keepalive_timeout 65;
	types_hash_max_size 2048;
	# server_tokens off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;


	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	##
	# Gzip Settings
	##

	gzip on;
	gzip_disable "msie6";

        ##
        # Authentification par certificat client
        # limité à certains utilisateurs
        ##

        map $ssl_client_s_dn $ssl_access {
            default 0;
            "~CN=Yannick" 1;
	    "~CN=Yann" 1;
            "~CN=Jean Dupondt Stagiaire" 1;
            # etc.
        }

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
}

openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048

    ##
    # SSL Settings
    ##
    ssl_certificate /etc/ssl/private/xoyize.xyz-fullchain.pem;
    ssl_certificate_key /etc/ssl/private/xoyize.xyz-key.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
    ssl_session_tickets off;

    ssl_dhparam /etc/ssl/private/dh2048.pem;

    # intermediate configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # Add headers to serve security related headers
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;
    add_header X-Frame-Options "SAMEORIGIN"; 
    add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains;';
    add_header Referrer-Policy "no-referrer" always;


    # OCSP settings
    ssl_stapling on;
    ssl_stapling_verify on;
    #ssl_trusted_certificate /etc/ssl/private/xoyize.xyz-fullchain.pem;
    ssl_trusted_certificate /etc/ssl/private/ocsp-certs.pem;
    resolver 127.0.0.1;

/etc/nginx/auth_certificat_client

# Certificat client 
ssl_client_certificate /etc/ssl/CertificateAuthority/cacert.pem; 
# rendre la vérification optionnelle
# afin de pouvoir afficher un message 403 
# à ceux qui échouent à l'authentification
ssl_verify_client optional;
    if ( $ssl_access = 0 ) {
        return 403 "<h2>Zone Interdite, absence de certificat client !!!</h2>" ; # => forbidden
    }

sudo nano /etc/nginx/conf.d/xoyize.xyz.conf

server {
    listen 80;
    listen [::]:80;

    ## redirect http to https ##
    server_name xoyize.xyz;
    return  301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name xoyize.xyz;

    ####    Locations
    # On cache les fichiers statiques
    location ~* \.(html|css|js|png|jpg|jpeg|gif|ico|svg|eot|woff|ttf)$ { expires max; }
    # On interdit les dotfiles
    location ~ /\. { deny all; }

    

    root /var/www/default-www ;
    index index.php index.html index.htm;
        location ~ \.php$ {
           fastcgi_split_path_info ^(.+\.php)(/.+)$;
           fastcgi_pass unix:/run/php/php7.4-fpm.sock;   # PHP7.4
           fastcgi_index index.php;
           include fastcgi_params;
	   fastcgi_param SCRIPT_FILENAME $request_filename;
        }

    # if folder xoyize.xyz.d , uncomment the following directive
    #include conf.d/xoyize.xyz.d/*.conf;

    access_log /var/log/nginx/xoyize.xyz-access.log;
    error_log /var/log/nginx/xoyize.xyz-error.log;
}

sudo rm /etc/nginx/conf.d/default.conf

sudo nginx -t

nginx: the configuration file /usr/local/openresty/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/openresty/nginx/conf/nginx.conf test is successful

sudo systemctl restart nginx

 ____                 _                                  _   
|  _ \  _____   _____| | ___  _ __  _ __ ___   ___ _ __ | |_ 
| | | |/ _ \ \ / / _ \ |/ _ \| '_ \| '_ ` _ \ / _ \ '_ \| __|
| |_| |  __/\ V /  __/ | (_) | |_) | | | | | |  __/ | | | |_ 
|____/ \___| \_/ \___|_|\___/| .__/|_| |_| |_|\___|_| |_|\__|
                             |_|                             

# /etc/nginx/conf.d/devel.xoyize.xyz.conf	
	##
	# Virtual Host devel.xoyize.xyz
	##

	server {
	    listen 80;
	    listen [::]:80;
	
	    ## redirect http to https ##
	    server_name devel.xoyize.xyz;
	    return  301 https://$server_name$request_uri;
	}
	
	server {
	    listen 443 ssl http2;
	    listen [::]:443 ssl http2;
	    server_name devel.xoyize.xyz;
	
	    ####    Locations
	    # On cache les fichiers statiques
	    location ~* \.(html|css|js|png|jpg|jpeg|gif|ico|svg|eot|woff|ttf)$ { expires max; }
	    # On interdit les dotfiles
	    location ~ /\. { deny all; }

	    include ssl_dh_header_ocsp;
	
	    include auth_certificat_client;	   
	
	    #autoindex on;
	    fancyindex on;              # Enable fancy indexes.
	    fancyindex_exact_size off;  # Output human-readable file sizes.
	
	    root /srv/data/devel/ouestline/ ;
	    index index.php index.html index.htm;
	        location ~ \.php$ {
	           fastcgi_split_path_info ^(.+\.php)(/.+)$;
	           fastcgi_pass unix:/run/php/php7.4-fpm.sock;   # php7.4
	           fastcgi_index index.php;
	           include fastcgi_params;
		   fastcgi_param SCRIPT_FILENAME $request_filename;
	        }
	
	    # if folder devel.xoyize.xyz.d , uncomment the following directive
	    #include conf.d/devel.xoyize.xyz.d/*.conf;
	
	    access_log /var/log/nginx/develop-access.log;
	    error_log /var/log/nginx/develop-error.log;
	}

sudo nginx -t
sudo systemctl reload nginx

sudo useradd airsonic

sudo mkdir /var/airsonic
sudo chown airsonic /var/airsonic

sudo -s
wget -4 https://github.com/airsonic/airsonic/releases/download/v10.5.0/airsonic.war  --output-document=/var/airsonic/airsonic.war

wget -4 https://raw.githubusercontent.com/airsonic/airsonic/master/contrib/airsonic.service -O /etc/systemd/system/airsonic.service
wget -4 https://raw.githubusercontent.com/airsonic/airsonic/master/contrib/airsonic-systemd-env -O /etc/default/airsonic

nano /etc/systemd/system/airsonic.service

[...]
Environment="PORT=4040"
Environment="CONTEXT_PATH=/"
[...]

systemctl daemon-reload
systemctl start airsonic.service
systemctl enable airsonic.service

sudo nano /etc/nginx/conf.d/sub.xoyize.xyz.conf

# /etc/nginx/conf.d/sub.xoyize.xyz.conf	
##
# Virtual Host sub.xoyize.xyz (Subsonic)
##

server {
    listen 80;
    listen [::]:80;
	
    ## redirect http to https ##
    server_name sub.xoyize.xyz;
    return  301 https://$server_name$request_uri;
}
	
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name sub.xoyize.xyz;

    include ssl_dh_header_ocsp;

    # Proxy to the Airsonic server
    location / {
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Host  $http_host;
        proxy_set_header Host              $http_host;
        proxy_max_temp_file_size           0;
        proxy_pass                         http://127.0.0.1:4040;
        proxy_redirect                     http:// https://;
    }
	
}

sudo -s
systemctl stop airsonic
systemctl disable airsonic
rm /etc/systemd/system/airsonic.service
systemctl daemon-reload
rm /var/airsonic/airsonic.war
mv /etc/nginx/conf.d/sub.xoyize.xyz.conf /etc/nginx/conf.d/sub.xoyize.xyz.conf.sav
systemctl restart nginx
ocsp_cache
apt remove adoptopenjdk-8-hotspot
apt autoremove
# Ouvrir le fichier /etc/apt/sources.list 
# supprimer les 2 lignes qui contiennent 'https://adoptopenjdk.jfrog.io/adoptopenjdk/deb/'
apt update

sudo -s
# la dernière version en cours https://files.phpmyadmin.net/phpMyAdmin/
wget -4 https://files.phpmyadmin.net/phpMyAdmin/5.0.1/phpMyAdmin-5.0.1-all-languages.zip
unzip  phpMyAdmin-5.0.1-all-languages.zip
mv phpMyAdmin-5.0.1-all-languages /usr/share/phpmyadmin
#
mkdir -p /var/lib/phpmyadmin/tmp
chown -R www-data:www-data /var/lib/phpmyadmin
cp /usr/share/phpmyadmin/config.sample.inc.php /usr/share/phpmyadmin/config.inc.php

mysql -uroot -p$(cat /etc/mysql/mdp) < /usr/share/phpmyadmin/sql/create_tables.sql
mysql -uroot -p$(cat /etc/mysql/mdp) -e "GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'qzbXEHio0lwq';"
mysql -uroot -p$(cat /etc/mysql/mdp) -e "GRANT ALL PRIVILEGES ON *.* TO 'yanspm'@'localhost' IDENTIFIED BY 'DxShMzcc4v' WITH GRANT OPTION;" 
ln -s /usr/share/phpmyadmin /var/www/default-www/rienavoir

<?php
[...]
$cfg['Servers'][$i]['AllowRoot'] = false;

sudo sh -c "echo -n 'yanspm:' >> /etc/nginx/.pma_pass"
sudo sh -c "openssl passwd -apr1 >> /etc/nginx/.pma_pass"  # même mot de passe yanspm
mkdir -p /etc/nginx/conf.d/xoyize.xyz.d/ # créer le dossier si inexistant

location /rienavoir {
    auth_basic "Admin Login";
    auth_basic_user_file /etc/nginx/.pma_pass;

    location ~ \.php$ {
           fastcgi_split_path_info ^(.+\.php)(/.+)$;
           fastcgi_pass unix:/run/php/php7.3-fpm.sock;   # PHP7.3
           fastcgi_index index.php;
           include fastcgi_params;
	   fastcgi_param SCRIPT_FILENAME $request_filename;
        }

}

sudo nginx -t
sudo systemctl reload nginx

# /etc/nginx/conf.d/sql.xoyize.xyz.conf	
	##
	# Virtual Host sql.xoyize.xyz (PhpMyAdmin)
	##

	server {
	    listen 80;
	    listen [::]:80;
	
	    ## redirect http to https ##
	    server_name sql.xoyize.xyz;
	    return  301 https://$server_name$request_uri;
	}
	
	server {
	    listen 443 ssl http2;
	    listen [::]:443 ssl http2;
	    server_name sql.xoyize.xyz;
	
	    include ssl_dh_header_ocsp;
            # Authentification par certificat client
            include auth_certificat_client;

	    root /var/www/default-www/rienavoir/;
	    index index.php;

	
	        location ~ \.php$ {
	           fastcgi_split_path_info ^(.+\.php)(/.+)$;
	           fastcgi_pass unix:/run/php/php7.4-fpm.sock;   # PHP7.4
                   fastcgi_param SCRIPT_FILENAME $request_filename;
	           fastcgi_index index.php;
	           include fastcgi_params;
	        }
	
	
	    access_log /var/log/nginx/sql-access.log;
	    error_log /var/log/nginx/sql-error.log;
	}

sudo nano /etc/nginx/conf.d/xoyize.xyz.d/phpmyadmin.conf

location /phpmyadmin {
  return 403; # => forbidden
}

gpg --encrypt -o .msmtp-xoyize-xyz.gpg -r xoyize-xyz@cinay.xyz - 

ls .msmtp-xoyize-xyz.gpg

.msmtp-xoyize-xyz.gpg

gpg --no-tty -q -d .msmtp-xoyize-xyz.gpg

msmtp --serverinfo --tls --tls-certcheck=off --host=cinay.xyz  

...
    Empreintes:
        SHA256: 20:D3:6B:CD:B5:DA:90:06:B2:FF:B8:9D:C1:57:2D:1B:B8:FC:5E:6B:DF:C9:41:0A:CC:2C:C5:61:D0:02:F9:61
...

nano ~/.msmtprc

# fichier de configuration utilisateur ~/.msmtprc

# Définissez les valeurs par défaut pour tous les comptes suivants.
defaults

# Utilisez le port de soumission du courrier 587 au lieu du port SMTP 25.
port 587

# Utilisez toujours le TLS.
tls on

# Un service de courrier électronique gratuit
account cinay-xyz

# Nom d'hôte du serveur SMTP
host cinay.xyz

# Comme alternative au tls_trust_file/tls_crl_file, vous pouvez utiliser tls_fingerprint
# pour épingler un seul certificat. Vous devez mettre à jour l'empreinte digitale lorsque le
# le certificat du serveur change, mais un attaquant ne peut pas vous piéger pour que vous acceptiez
# un certificat frauduleux. Obtenez l'empreinte digitale avec
# msmtp --serverinfo --tls --tls-certcheck=off --host=smtp.freemail.example
tls_fingerprint 20:D3:6B:CD:B5:DA:90:06:B2:FF:B8:9D:C1:57:2D:1B:B8:FC:5E:6B:DF:C9:41:0A:CC:2C:C5:61:D0:02:F9:61

# Enveloppe - à partir de l'adresse
from yannick@cinay.xyz

# Authentification. 
auth on
user yannick

# le mot de passe est dans un fichier crypté, indiquer à msmtp la commande à utiliser pour le décrypter.
# Cette commande est généralement utilisée avec GnuPG
# Habituellement, gpg-agent demande une fois le mot de passe de décryptage.
passwordeval gpg --no-tty -q -d ~/.msmtp-cinay-xyz.gpg

# Définir un compte par défaut
account default : cinay-xyz

echo "hello there username." | msmtp -a default username@domain.com

To: username@domain.com
From: user12@gmail.com
Subject: A test

Hello there.

cat test.mail | msmtp -a default username@domain.com

# Transfert du home
mkdir -p /mnt/{home,homeOld}
mount /dev/ssd-vg/home /mnt/home
mount /dev/hdd-2g/home /mnt/homeOld/
rm -r /mnt/homeOld/lost+found/
rm -r /mnt/home/lost+found/
rsync -av /mnt/homeOld/*
umount /mnt/{home,homeOld} 
lvremove /dev/hdd-2g/home 
# Transfert data nfs su /srv
mkdir /mnt/srv 
mount /dev/mapper/hdd--2g-lvhdd /mnt/srv/
rm -r /mnt/srv/lost+found/
mkdir -p /mnt/srv/{data,nfs}
mv /mnt/srv/{borg-backups,CalibreTechnique,devel,dplus,Musique,playlists,podcasts,virtuel} /mnt/srv/data/
mkdir /mnt/nfs 
mount /dev/hdd-2g/nfs /mnt/nfs/
rsync -av /mnt/nfs/*
umount /mnt/srv 
umount /mnt/nfs 
# supprime /dev/hdd-2g/nfs
lvremove /dev/hdd-2g/nfs 
# Vérification avant augmentation capacité volume
e2fsck -f /dev/hdd-2g/lvhdd
lvresize -l +100%FREE
resize2fs /dev/hdd-2g/lvhdd 
# Modifier fstab et exports
mkdir /mnt/root 
mount /dev/ssd-vg/rootb /mnt/root
nano /mnt/root/etc/fstab 
nano /mnt/root/etc/exports 

root@srvxo:/home/xoyi# pvs
  PV         VG     Fmt  Attr PSize    PFree  
  /dev/sda4  ssd-vg lvm2 a--  <107,29g <67,29g
  /dev/sdb1  hdd-2g lvm2 a--    <1,82t      0 

root@srvxo:/home/xoyi# vgs
  VG     #PV #LV #SN Attr   VSize    VFree  
  hdd-2g   1   1   0 wz--n-   <1,82t      0 
  ssd-vg   1   2   0 wz--n- <107,29g <67,29g

root@srvxo:/home/xoyi# lvs
  LV    VG     Attr       LSize  Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert
  lvhdd hdd-2g -wi-ao---- <1,82t                                                    
  home  ssd-vg -wi-ao---- 20,00g                                                    
  rootb ssd-vg -wi-ao---- 20,00g                                                    

root@srvxo:/home/xoyi# cat /etc/fstab 
# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
/dev/mapper/ssd--vg-rootb /               ext4    errors=remount-ro 0       1
# /boot was on /dev/sda2 during installation
UUID=6ff909c4-5117-4b17-a571-54bde94fd6b5 /boot           ext2    defaults        0       2
/dev/mapper/ssd--vg-home /home           ext4    defaults        0       2
# swap was on /dev/sda3 during installation
UUID=4afbc634-a79f-47c2-a15f-6ea17e62ceb7 none            swap    sw              0       0

/dev/mapper/hdd--2g-lvhdd     /srv    ext4    defaults        0       2

root@srvxo:/home/xoyi# cat /etc/exports 
# /etc/exports: the access control list for filesystems which may be exported
#		to NFS clients.  See exports(5).
#
# Example for NFSv2 and NFSv3:
# /srv/homes       hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)
#
# Example for NFSv4:
# /srv/nfs4        gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
# /srv/nfs4/homes  gss/krb5i(rw,sync,no_subtree_check)
#
# exportfs -ar
#/srv/data	192.168.0.0/24(rw,sync,no_subtree_check,no_root_squash)
/srv	192.168.0.0/24(rw,sync,no_subtree_check,no_root_squash)

root@srvxo:/home/xoyi# df -h
Sys. de fichiers          Taille Utilisé Dispo Uti% Monté sur
udev                        3,7G       0  3,7G   0% /dev
tmpfs                       741M    8,7M  733M   2% /run
/dev/mapper/ssd--vg-rootb    20G    2,7G   16G  15% /
tmpfs                       3,7G       0  3,7G   0% /dev/shm
tmpfs                       5,0M       0  5,0M   0% /run/lock
tmpfs                       3,7G       0  3,7G   0% /sys/fs/cgroup
/dev/sda2                   504M     84M  395M  18% /boot
/dev/mapper/ssd--vg-home     20G    2,0G   17G  11% /home
/dev/mapper/hdd--2g-lvhdd   1,8T    324G  1,4T  19% /srv
tmpfs                       741M       0  741M   0% /run/user/1000

cd ~
wget https://dl.google.com/go/go1.14.2.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.14.2.linux-amd64.tar.gz
rm go1.14.2.linux-amd64.tar.gz

mkdir -p $HOME/go
echo "export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin" >> ~/.bashrc
echo "export GOPATH=$HOME/go"  >> ~/.bashrc
source ~/.bashrc

sudo apt install curl software-properties-common -y
curl -sL https://deb.nodesource.com/setup_12.x | sudo bash -

## Run `sudo apt-get install -y nodejs` to install Node.js 12.x and npm
## You may also need development tools to build native addons:
     sudo apt-get install gcc g++ make
## To install the Yarn package manager, run:
     curl -sL https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -
     echo "deb https://dl.yarnpkg.com/debian/ stable main" | sudo tee /etc/apt/sources.list.d/yarn.list
     sudo apt-get update && sudo apt-get install yarn

sudo apt-get install -y nodejs