2021年6月7日 星期一

ipset

ipset 安裝
sudo apt update
sudo apt install ipset

ipset建立基於ip hash的集合名稱
例如 blacklist表示集合的名字是blacklist
hashsize 4096 表示初始值為4096個,如果滿了,這個 hash 會自動擴容為之前的兩倍。最大能儲
存的數量是 maxelem指定的值;hashsize 的預設值是 1024
maxelem 1000000表示最大元素個數為100000 ,ipset預設值為65536
timeout 3600 表示封禁3600s;
ipset create blacklist hash:ip hashsize 4096 maxelem 1000000 timeout 3600

iptables開啟封禁80,443
iptables -A INPUT -p tcp -m set --match-set blacklist src -m multiport --dports 443,80 -j DROP

ipset 命令
ipset create blacklist hash:ip,port hashsize 4096 maxelem 1000000 timeout 100 #加入集合 
ipset del blacklist x.x.x.x # 從 blacklist 集合中刪除內容 
ipset add blacklist x.x.x.x #在集合內增加內容
ipset list blacklist # 檢視 blacklist 集合內容 
ipset list # 檢視所有集合的內容 
ipset flush blacklist # 清空 blacklist 集合 
ipset flush # 清空所有集合 
ipset destroy blacklist # 銷燬 blacklist 集合 
ipset destroy # 刪除所有集合 
  如ipset save blacklist > test.txt  # 輸出 banip 集合內容到test.txt
    ipset save > test.txt  # 輸出所有集合內容到test.txt
ipset save blacklist # 輸出 blacklist 集合內容到標準輸出 
ipset save # 輸出所有集合內容到標準輸出 
ipset restore # 根據輸入內容恢復集合內容 
  如 ipset restore  <test.txt  # 根據test.txt內容恢復集合內容

service ipset save    #儲存
service ipset restart #restart ipset

ipset test blacklist x.x.x.x. #測試x.x.x.x.這個ip是否在blacklist集合中

Ubuntu 20.04 OCS Inventory 2.8 安裝

OCS Inventory 2.8 下載

https://drive.google.com/drive/folders/1BD7Qtb93OlKySudfYYMu2RWwWoDHrzEq?usp=sharing


資料庫安裝(單一主機)

apt install mariadb-server mariadb-common mariadb-client

設定mysql root 密碼

mysql -u root

SET PASSWORD FOR 'root'@'localhost' = PASSWORD('yourpassword');

新增ocs資料庫

CREATE DATABASE ocsweb;

新增ocs資料庫使用者

CREATE USER 'ocs'@'localhost' IDENTIFIED BY 'ocs';

ocs資料庫使用者擁有全部ocs資料庫權限

GRANT ALL PRIVILEGES ON ocsweb.* TO 'ocs'@'localhost' WITH GRANT OPTION;

FLUSH PRIVILEGES;


OCS Inventory 2.8 安裝

www Server安裝

apt install apache2

PHP 安裝

apt install php7.4 php7.4-fpm 

a2enmod proxy_fcgi setenvif

a2enconf php7.4-fpm

service apache2 restart 

service php7.4-fpm restart


利用php info檢測php

<?php
phpinfo();
?>


修改php.ini設定

memory_limit = 256M

post_max_size = 100M

upload_max_filesize = 100M

max_execution_time = 360

date.timezone = Asia/Taipei


perl元件安裝

apt install libxml-simple-perl libdbi-perl libdbd-mysql-perl libapache-dbi-perl libnet-ip-perl libsoap-lite-perl libarchive-zip-perl make build-essential

apt-get install libmojolicious-perl

apt-get install libswitch-perl

apt-get install -y libplack-handler-anyevent-fcgi-perl

cpan install XML::Entities


PHP元件安裝

apt install php-pclzip make build-essential libdbd-mysql-perl libnet-ip-perl libxml-simple-perl php php-mbstring php-soap php-mysql php-curl php-xml php-zip

apt install php-gd


OCS Inventory 安裝

下載 OCS Inventory Server並解開

tar zxvf OCSNG_UNIX_SERVER_2.8.tar.gz

cd OCSNG_UNIX_SERVER_2.8/

./setup.sh

安裝過程所有設定保持預設值即可!成功安裝完成後,可看到如下畫面:

+----------------------------------------------------------------------+

|        OK, Administration server installation finished ;-)           |

|                                                                      |

| Please, review /etc/apache2/conf-available/ocsinventory-reports.conf

|          to ensure all is good and restart Apache daemon.            |

|                                                                      |

| Then, point your browser to http://server//ocsreports

|        to configure database server and create/update schema.        |

+----------------------------------------------------------------------+



Setup has created a log file /var/www/OCSNG_UNIX_SERVER_2.8/ocs_server_setup.log. Please, save this file.

If you encounter error while running OCS Inventory NG Management server,

we can ask you to show us its content !


DON'T FORGET TO RESTART APACHE DAEMON !


Enjoy OCS Inventory NG ;-)



啟動OCS的Apache設定

ln -s /etc/apache2/conf-available/ocsinventory-reports.conf /etc/apache2/conf-enabled/ocsinventory-reports.conf 


ln -s /etc/apache2/conf-available/z-ocsinventory-server.conf /etc/apache2/conf-enabled/z-ocsinventory-server.conf 


ln -s /etc/apache2/conf-available/zz-ocsinventory-restapi.conf /etc/apache2/conf-enabled/zz-ocsinventory-restapi.conf 


chown -R www-data:www-data /var/lib/ocsinventory-reports 


systemctl restart apache2.service



登入OCSInventory

http://你的伺服器ip/ocsreports/

此時會登入 OCS-NG Inventory Installation 的資料庫登入設定畫面

MySQL login: 前面新增的ocs資料庫使用者

MySQL password:ocs資料庫使用者密碼

Name of Database:前面新增的ocs資料庫

MySQL HostName:localhost

MySQL Port :3306

Enable SSL:no


輸入完後點選“Send”

接著點選 “Click here to enter OCS-NG GUI.”

接著應該可以看到 OCS Inventory 的登入畫面,預設的帳號和密碼都是admin。

====================================================================

Unix 操作系統上的 OCS Inventory NG Agent 2.x 互動式安裝

安裝make

apt install make


安裝需要的模組

apt install libmodule-install-perl dmidecode libxml-simple-perl libcompress-zlib-perl libnet-ip-perl libwww-perl libdigest-md5-perl libdata-uuid-perl

建議安裝的模組

apt install libcrypt-ssleay-perl libnet-snmp-perl libproc-pid-file-perl libproc-daemon-perl net-tools libsys-syslog-perl pciutils smartmontools read-edid nmap libnet-netmask-perl


下載 Ocsinventory-Unix-Agent-2.8.1

解開 Ocsinventory-Unix-Agent-2.8.1

tar zxvf Ocsinventory-Unix-Agent-2.8.1


cd Ocsinventory-Unix-Agent-2.8.1/


使用腳本 Makefile.PL 檢查 perl 配置。它查看 Perl、機器、庫的配置……並生成 Makefile。

perl Makefile.PL 


編譯

make

make install

Manifying 1 pod document

Manifying 6 pod documents

Appending installation info to /usr/local/lib/x86_64-linux-gnu/perl/5.30.0/perllocal.pod

[ ! -f run-postinst ] || /usr/bin/perl postinst.pl

Do you want to configure the agent

Please enter 'y' or 'n'?> [y] y

Where do you want to write the configuration file?

 0 -> /etc/ocsinventory

 1 -> /usr/local/etc/ocsinventory

 2 -> /etc/ocsinventory-agent

?>  2

Do you want to create the directory /etc/ocsinventory-agent?

Please enter 'y' or 'n'?> [y] 

Should the old unix_agent settings be imported ?

Please enter 'y' or 'n'?> [y] 

[info] The config file will be written in /etc/ocsinventory-agent/ocsinventory-agent.cfg,

What is the address of your ocs server?>  http://伺服器IP/ocsinventory

Do you need credential for the server? (You probably don't)

Please enter 'y' or 'n'?> [n] 

Do you want to apply an administrative tag on this machine

Please enter 'y' or 'n'?> [y] 

tag?>  伺服器IP

Do yo want to install the cron task in /etc/cron.d

Please enter 'y' or 'n'?> [y] 

Where do you want the agent to store its files? (You probably don't need to change it)?> [/var/lib/ocsinventory-agent] 

Do you want to create the /var/lib/ocsinventory-agent directory?


Please enter 'y' or 'n'?> [y] 

Should I remove the old unix_agent

Please enter 'y' or 'n'?> [n] 

Do you want to activate debug configuration option ?

Please enter 'y' or 'n'?> [y] 

Do you want to use OCS Inventory NG UNix Unified agent log file ?

Please enter 'y' or 'n'?> [y] 

Specify log file path you want to use?>  /var/log/ocs_agent.log

Do you want disable SSL CA verification configuration option (not recommended) ?

Please enter 'y' or 'n'?> [n] 

Do you want to set CA certificates file path ?

Please enter 'y' or 'n'?> [y] 

Specify CA certificates file path?>  /etc/ocsinventory-agent/cacert.pem

Do you want to use OCS-Inventory software deployment feature?

Please enter 'y' or 'n'?> [y] 

Do you want to use OCS-Inventory SNMP scans feature?

Please enter 'y' or 'n'?> [y] 

Do you want to send an inventory of this machine?

Please enter 'y' or 'n'?> [y] 

Setting OCS Inventory NG server address...

Looking for OCS Invetory NG Unix Unified agent installation...

ocsinventory agent presents: /usr/local/bin/ocsinventory-agent

Setting crontab...

Creating /var/lib/ocsinventory-agent directory...

Creating /etc/ocsinventory-agent directory...

Writing OCS Inventory NG Unix Unified agent configuration

Creating /var/lib/ocsinventory-agent/http:__你的伺服器IP_ocsinventory directory...

Creating /var/lib/ocsinventory-agent/http:__你的伺服器IP_ocsinventory/snmp directory...

Copying SNMP MIBs XML files...

Activating modules if needed...

Launching OCS Inventory NG Unix Unified agent...

   -> Success!

New settings written! Thank you for using OCS Inventory


Ocsinventory-Unix-Agent預設每天執行一次!排程設定在 /etc/cron.d



也可手動執行以下指令,強制立刻執行Agent,立刻將資訊傳送到Server

root /usr/local/bin/ocsinventory-agent --lazy


OCS Windows 安裝包製作(用於網域派送)

需下載Agent,PSTools,Packager

1.PSTools解壓縮

2.將Agent解壓縮,放在與PSTools相同的資料夾

3.解壓縮Packager,也放在與PSTools相同的資料夾

4.執行 OcsPackager.exe
























/S  silent mode

/NOW 安裝完之後立即做一次inventory

/NO_SYSTRAY  不在螢幕右下角出現圖示
























參考資料:

http://wiki.ocsinventory-ng.org/