简介
滚动性教程 随着工具更迭 教程会针对实际作用进行更新 优化
支持投稿
滚动更新
2022.5.8 update
dnf 逐渐在取代yum （考虑到有萌新 ）
理解为用一个旧版的下载器去下载一个新的 默认要逐步习惯 实际上在入门阶段没有区别 习惯与熟练度为主
yum install -y dnf
dnsmasq download
environment
验证方式
kali->client
apt-get -y install dnsutils
centos ->server
dns install dnsmasq systemctl start dnsmasq systemctl enable dnsmasq systemctl status dnsmasq
基础环境
vmware
这边我选择使用vmware演示 实际上docker 更为合适
云服务
氪金大佬直接买 因为你是学习的 买最便宜的就够了
主机
如果会写shell脚本可以直接把以下代码加以修改 变成装机大师.sh
要注意ip 客户端id 端口 网关一类个人本地配置
DHCP
yum -y install dhcp #下载服务 vim /etc/dhcp/dhcpd.conf
# # DHCP Server Configuration file. # see /usr/share/doc/dhcp*/dhcpd.conf.example # see dhcpd.conf(5) man page # ddns-update-style none; log-facility local7; subnet 192.168.125.0 netmask 255.255.255.0 { # 管理192.168.125.0/24子网 range 192.168.125.50 192.168.125.250; # ip地址的分配范围 option routers 192.168.125.254; # 网关地址 option domain-name-servers 192.168.125.254; # 域名服务器地址 option broadcast-address 192.168.125.255; # 广播地址 default-lease-time 600; # 默认超时时间 max-lease-time 7200; # 最大超时时间 }
分配固定ip则在之前的配置文件之后增加以下内容
host 自定义主机名 { # 指定要固定的主机 hardware ethernet （这里写mac地址）; # 指定主机的mac地址 fixed-address 192.168.125.（选择固定范围不能在之前规定的50到250）; # 指定要分配的ip地址（此处的ip地址不能再range的范围内） }
systemctl enable dhcpd.service # 设置dhcp服务开机自启 systemctl start dhcpd.service # 设置dhcp服务开启 systemctl restart dhcpd.service # 重启服务
客户端设置为dhcp启动 （此验证是在centos7)
vi /etc/svsconfig/network-scripts/ifcfg-ens33 DEVICE=ens33 ONBOOT=yes BOOTPROTO=dhcp
DNS
配置文件
yum install -y bind bind-chroot vi /etc/named.conf
// // named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. // // See the BIND Administrator's Reference Manual (ARM) for details about the // configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html options { listen-on port 53 { any; }; /* # 监听server上所有的网卡（为了将服务提供给所有主机） */ listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; recursing-file "/var/named/data/named.recursing"; secroots-file "/var/named/data/named.secroots"; allow-query { any; }; /* # 接收来自任意地方的dns查询请求 */ /* - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion. - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion. - If your recursive DNS server has a public IP address, you MUST enable access control to limit queries to your legitimate users. Failing to do so will cause your server to become part of large scale DNS amplification attacks. Implementing BCP38 within your network would greatly reduce such attack surface */ recursion yes; dnssec-enable yes; dnssec-validation no; /*# 设置为no，防止seliunx干扰*/ /* Path to ISC DLV key */ bindkeys-file "/etc/named.root.key"; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.125.zones"; /*# 指定我们的主要配置文件*/ include "/etc/named.root.key";
vi /etc/named.125.zones
解析
cp /var/named/named.localhost /var/named/rhel.com.zone # 正向解析清单 vim /var/named/rhel.com.zone
$TTL 1D @ IN SOA @ root.rhel.com. ( # 指定为rhel.com域 注释不要写进去 0 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum @ IN NS server.rhel.com # 指定DNS解析服务器的地址 server IN A 192.168.125.20 # A类解析，从域名解析到ipv4地址
cp /var/named/named.loopback /var/named/192.168.125.loopback # 反向解析清单 vim /var/named/192.168.125.loopback
$TTL 1D @ IN SOA @ root.rhel.com. ( # 指定为rhel.com域 0 ; serial 1D ; refresh 1H ; retry 1W ; expire 3H ) ; minimum @ IN NS server.rhel.com # 指定DNS解析服务器的地址 20 IN PTR server.rhel.com. # PTR类解析，从ip反向解析为域名 25 IN PTR client.rhel.com. 100 IN PTR windows.rhel.com.
再次配置
firewall-cmd --add-service=dns --permanent # 防火墙放行dns的服务器访问 firewall-cmd --reload chown :named /var/named/192.168.125.loopback chown :named /var/named/rhel.com.zone chown :named /etc/named.125.zones systemctl enable named systemctl start named vim /etc/resolv.conf
# Generated by NetworkManager nameserver 192.168.125.20 nameserver 192.168.125.254
test（使用客户端）
nslookup > server > exit
dig windows.rhel.com
HTTP
yum install -y httpd systemctl enable httpd systemctl start httpd firewall-cmd --add-service=http --permanent firewall-cmd --reload vim /var/www/html/index.html # 写一个html页面
mkdir /var/www/html/server vim /var/www/html/server/index.html #自己写 mkdir /var/www/html/test touch /var/www/html/test/1.html vim /etc/httpd/conf.d/vhost.conf # 虚拟站点配置
<Virtualhost 192.168.125.20 > # 绑定的ip地址 DocumentRoot /var/www/html/server # 网站的根目录 ServerName server.rhel.com # 访问的时候填写的域名 </Virtualhost> <Directory "/var/www/html/server"> AllowOverride None Order deny,allow # 默认允许所有客户端访问 deny from 192.168.125.100 # 禁止192.168.125.100主机访问 </Directory> <Virtualhost 192.168.125.20 > DocumentRoot /var/www/html ServerName 192.168.125.20 # 当使用ip 的方式进行访问 </Virtualhost> Alias /hello "/var/www/html/test" # 将原本应该是192.168.125.20/test通过虚拟目录的方式，修改了192.168.125.20/hello <Directory "/var/www/html/test"> AllowOverride None Order deny,allow </Directory>
FTP
yum install -y vsftpd # ftp的服务端 # 客户端 # redhat yum install -y ftp # debian sudo apt-get -y ftp # window 从设置里面添加服务
配置
firewall-cmd --add-service=ftp --permanent firewall-cmd --reload systemctl start vsftpd touch /var/ftp/pub/test.txt vim /etc/vsftpd/vsftpd.conf
# Example config file /etc/vsftpd/vsftpd.conf # # The default compiled in settings are fairly paranoid. This sample file # loosens things up a bit, to make the ftp daemon more usable. # Please see vsftpd.conf.5 for all compiled in defaults. # # READ THIS: This example file is NOT an exhaustive list of vsftpd options. # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's # capabilities. # # Allow anonymous FTP? (Beware - allowed by default if you comment this out). anonymous_enable=YES # # Uncomment this to allow local users to log in. # When SELinux is enforcing check for SE bool ftp_home_dir local_enable=YES # # Uncomment this to enable any form of FTP write command. write_enable=YES # # Default umask for local users is 077. You may wish to change this to 022, # if your users expect that (022 is used by most other ftpd's) local_umask=022 # # Uncomment this to allow the anonymous FTP user to upload files. This only # has an effect if the above global write enable is activated. Also, you will # obviously need to create a directory writable by the FTP user. # When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access #anon_upload_enable=YES # # Uncomment this if you want the anonymous FTP user to be able to create # new directories. #anon_mkdir_write_enable=YES anon_root=/var/www/html # 匿名用户登录ftp默认显示的位置（需要处理一下selinux） # # Activate directory messages - messages given to remote users when they # go into a certain directory. dirmessage_enable=YES # # Activate logging of uploads/downloads. xferlog_enable=YES # # Make sure PORT transfer connections originate from port 20 (ftp-data). connect_from_port_20=YES # # If you want, you can arrange for uploaded anonymous files to be owned by # a different user. Note! Using "root" for uploaded files is not # recommended! #chown_uploads=YES #chown_username=whoever # # You may override where the log file goes if you like. The default is shown # below. #xferlog_file=/var/log/xferlog # # If you want, you can have your log file in standard ftpd xferlog format. # Note that the default log file location is /var/log/xferlog in this case. xferlog_std_format=YES # # You may change the default value for timing out an idle session. #idle_session_timeout=600 # # You may change the default value for timing out a data connection. #data_connection_timeout=120 # # It is recommended that you define on your system a unique user which the # ftp server can use as a totally isolated and unprivileged user. #nopriv_user=ftpsecure # # Enable this and the server will recognise asynchronous ABOR requests. Not # recommended for security (the code is non-trivial). Not enabling it, # however, may confuse older FTP clients. #async_abor_enable=YES # # By default the server will pretend to allow ASCII mode but in fact ignore # the request. Turn on the below options to have the server actually do ASCII # mangling on files when in ASCII mode. The vsftpd.conf(5) man page explains # the behaviour when these options are disabled. # Beware that on some FTP servers, ASCII support allows a denial of service # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd # predicted this attack and has always been safe, reporting the size of the # raw file. # ASCII mangling is a horrible feature of the protocol. #ascii_upload_enable=YES #ascii_download_enable=YES # # You may fully customise the login banner string: #ftpd_banner=Welcome to blah FTP service. # # You may specify a file of disallowed anonymous e-mail addresses. Apparently # useful for combatting certain DoS attacks. #deny_email_enable=YES # (default follows) #banned_email_file=/etc/vsftpd/banned_emails # # You may specify an explicit list of local users to chroot() to their home # directory. If chroot_local_user is YES, then this list becomes a list of # users to NOT chroot(). # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that # the user does not have write access to the top level directory within the # chroot) #chroot_local_user=YES #chroot_list_enable=YES # (default follows) #chroot_list_file=/etc/vsftpd/chroot_list # # You may activate the "-R" option to the builtin ls. This is disabled by # default to avoid remote users being able to cause excessive I/O on large # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume # the presence of the "-R" option, so there is a strong case for enabling it. #ls_recurse_enable=YES # # When "listen" directive is enabled, vsftpd runs in standalone mode and # listens on IPv4 sockets. This directive cannot be used in conjunction # with the listen_ipv6 directive. listen=NO # # This directive enables listening on IPv6 sockets. By default, listening # on the IPv6 "any" address (::) will accept connections from both IPv6 # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6 # sockets. If you want that (perhaps because you want to listen on specific # addresses) then you must run two copies of vsftpd with two configuration # files. # Make sure, that one of the listen options is commented !! listen_ipv6=YES pam_service_name=vsftpd userlist_enable=YES tcp_wrappers=YES
samba
yum install samba -y cp /etc/samba/smb.conf /etc/samba/smb.conf.bak echo > /etc/samba/smb.conf vim /etc/samba/smb.conf
[public] # 共享名 comment=public # 备注信息 path=/public # 共享的目录（绝对路径） public=yes # 是否允许匿名访问 writable=yes # 是否可以有写入的操作（还有文件本身的权限要考虑） # valid users=smbuser # 设置可以使用此共享的用户 # hosts allow=192.168.125. # 允许来自192.168.125.0网络的用户访问 # hosts deny=192.168.125.50 # 不允许来自192.168.125.50网络的用户访问
firewall-cmd --add-service=samba --permanent firewall-cmd --reload setenforce 0 systemctl start smb mkdir /public useradd smbuser smbpasswd -a smbuser chown smbuser:smbuser /public
为了方便使用centos7（一样的镜像当客户端测试）
yum install -y samba-client cifs-utils smbclient //192.168.125.20/public Enter SAMBA\root's password: Anonymous login successful Try "help" to get a list of possible commands. smb: \> ls
mkdir /mnt/samba mount -t cifs //192.168.125.20/public /mnt/samba -o username=smbuser Password for smbuser@//192.168.125.20/public: *******
nginx
download
dnf -y install nginx # 开启服务 开机自启 systemctl start nginx.service systemctl enable nginx.service systemctl status nginx.service # 配置文件 默认即可用 大佬可修改 /etc/nginx/ #nginx的配置目录 /etc/nginx/nginx.conf/ #nginx的主配置文件 /usr/share/nginx/ #默认存放网页的目录
