[root@CentOS8 scripts]#cat google-authenticator.sh
#安装epel
#yum install -y epel-release.noarch
#yum makecache
#安装google authenticator
yum install -y google-authenticator.x86_64
echo -e "\033[31mDo you want me to update your "/root/.google_authenticator" file? (y/n) y"
echo -e "\033[31m你希望我更新你的“/root/.google_authenticator”文件吗(y/n)？\033[0m"
echo -e "\033[31mDo you want to disallow multiple uses of the same authentication"
echo -e "\033[31mtoken? This restricts you to one login about every 30s, but it increases"
echo -e "\033[31myour chances to notice or even prevent man-in-the-middle attacks (y/n) y"
echo -e "\033[31m你希望禁止多次使用同一个验证令牌吗?这限制你每次登录的时间大约是30秒， 但是这加大了发现或甚至防止中间人的可能性(y/n)?\033[0m"
echo -e "\033[31mBy default, a new token is generated every 30 seconds by the mobile app."
echo -e "\033[31mIn order to compensate for possible time-skew between the client and the server,"
echo -e "\033[31mwe allow an extra token before and after the current time. This allows for a"
echo -e "\033[31mtime skew of up to 30 seconds between authentication server and client. If you"
echo -e "\033[31mexperience problems with poor time synchronization, you can increase the window"
echo -e "\033[31mfrom its default size of 3 permitted codes (one previous code, the current"
echo -e "\033[31mcode, the next code) to 17 permitted codes (the 8 previous codes, the current"
echo -e "\033[31mcode, and the 8 next codes). This will permit for a time skew of up to 4 minutes"
echo -e "\033[31mbetween client and server."
echo -e "\033[31mDo you want to do so? (y/n) y"
echo -e "\033[31m默认情况下，令牌保持30秒有效;为了补偿客户机与服务器之间可能存在的时滞，\033[0m"
echo -e "\033[31m我们允许在当前时间前后有一个额外令牌。如果你在时间同步方面遇到了问题， 可以增加窗口从默认的3个可通过验证码增加到17个可通过验证码，\033[0m"
echo -e "\033[31m这将允许客户机与服务器之间的时差增加到4分钟。你希望这么做吗(y/n)?\033[0m"
echo -e "\033[31mIf the computer that you are logging into isn't hardened against brute-force"
echo -e "\033[31mlogin attempts, you can enable rate-limiting for the authentication module."
echo -e "\033[31mBy default, this limits attackers to no more than 3 login attempts every 30s."
echo -e "\033[31mDo you want to enable rate-limiting? (y/n) y"
echo -e "\033[31m如果你登录的那台计算机没有经过固化，以防范运用蛮力的登录企图，可以对验证模块\033[0m"
echo -e "\033[31m启用尝试次数限制。默认情况下，这限制访问者每30秒试图登录的次数只有3次。 你希望启用尝试次数限制吗(y/n)?\033[0m"
echo -e "\033[32m 在App Store 搜索Google Authenticator 进行App安装 \033[0m"
google-authenticator
#/etc/pam.d/sshd文件，修改或添加下行保存
#auth required pam_google_authenticator.so
sed -i '1a\auth required pam_google_authenticator.so' /etc/pam.d/sshd
#编辑/etc/ssh/sshd_config找到下行
#ChallengeResponseAuthentication no
#更改为
#ChallengeResponseAuthentication yes
sed -i 's/.*ChallengeResponseAuthentication.*/ChallengeResponseAuthentication yes/' /etc/ssh/sshd_config
#重启SSH服务
service sshd restart
[root@centos8 ~]#dnf info google-authenticator
BaseOS
3.3 MB/s | 3.9 kB 00:00
AppStream
2.9 MB/s | 4.3 kB 00:00
EPEL
34 kB/s | 4.7 kB 00:00
extras
7.3 kB/s | 1.5 kB 00:00
Available Packages
Name : google-authenticator
Version : 1.07
Release : 1.el8
Architecture : x86_64
Size : 57 k
Source : google-authenticator-1.07-1.el8.src.rpm
Repository : epel
Summary : One-time pass-code support using open standards
URL : https://github.com/google/google-authenticator-libpam/
License : ASL 2.0
Description : The Google Authenticator package contains a plug-able
authentication
: module (PAM) which allows login using one-time pass-codes
conforming to
: the open standards developed by the Initiative for Open
Authentication
: (OATH) (which is unrelated to OAuth).
:
: Pass-code generators are available (separately) for several
mobile
: platforms.
:
: These implementations support the HMAC-Based One-time
Password (HOTP)
: algorithm specified in RFC 4226 and the Time-based One-time
Password
: (TOTP) algorithm currently in draft.
[root@centos8 ~]#bash google-authenticator.sh
Installed:
google-authenticator-1.07-1.el8.x86_64
Complete!
Do you want me to update your /root/.google_authenticator file? (y/n) y
你希望我更新你的“/root/.google_authenticator”文件吗(y/n)？
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
你希望禁止多次使用同一个验证令牌吗?这限制你每次登录的时间大约是30秒， 但是这加大了发现或甚
至防止中间人的可能性(y/n)?
By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the
server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If
you3. 访问生成的url:
experience problems with poor time synchronization, you can increase the
window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the
current
code, and the 8 next codes). This will permit for a time skew of up to 4
minutes
between client and server.
Do you want to do so? (y/n) y
默认情况下，令牌保持30秒有效;为了补偿客户机与服务器之间可能存在的时滞，
我们允许在当前时间前后有一个额外令牌。如果你在时间同步方面遇到了问题， 可以增加窗口从默认的
3个可通过验证码增加到17个可通过验证码，
这将允许客户机与服务器之间的时差增加到4分钟。你希望这么做吗(y/n)?
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every
30s.
Do you want to enable rate-limiting? (y/n) y
如果你登录的那台计算机没有经过固化，以防范运用蛮力的登录企图，可以对验证模块
启用尝试次数限制。默认情况下，这限制访问者每30秒试图登录的次数只有3次。 你希望启用尝试次数
限制吗(y/n)?
在App Store 搜索Google Authenticator 进行App安装
Do you want authentication tokens to be time-based (y/n) y
Warning: pasting the following URL into your browser exposes the OTP secret
to Google:
https://www.google.com/chart?
chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@centos8.localdomain%3Fse
cret%3D7YTAL4GW3TND7BICUMJGJLIFVE%26issuer%3Dcentos8.localdomain #浏览器打开
此地址
Failed to use libqrencode to show QR code visually for scanning.
Consider typing the OTP secret into your app manually.
Your new secret key is: 7YTAL4GW3TND7BICUMJGJLIFVE
Enter code from app (-1 to skip):
4、打开用身份验证器APP，扫网页上的二维码，进行绑定手机
5、继续上面的安装配置向导，输入手机APP上的数字，后续都回答 y 即可
Failed to use libqrencode to show QR code visually for scanning.
Consider typing the OTP secret into your app manually.
Your new secret key is: 7YTAL4GW3TND7BICUMJGJLIFVE
Enter code from app (-1 to skip): 224421 #手机APP上的数字
Code confirmed
Your emergency scratch codes are:
68820657
77385307
50928320
41000243
54628309
Do you want me to update your "/root/.google_authenticator" file? (y/n) y
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the
server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If
you
experience problems with poor time synchronization, you can increase the
window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the
current
code, and the 8 next codes). This will permit for a time skew of up to 4
minutes
between client and server.
Do you want to do so? (y/n) y
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every
30s.
Do you want to enable rate-limiting? (y/n) y
Redirecting to /bin/systemctl restart sshd.service
[root@centos8 ~]#
6、ssh 当前主机，可看到提示，输入手机APP上显示的数字码和root密码，可以登录，否则失败
[root@centos7 ~]#ssh 10.0.0.8
Verification code:
Password:
Last failed login: Fri Feb 7 12:11:12 CST 2020 from 10.0.0.7 on ssh:notty
There were 6 failed login attempts since the last successful login.
Last login: Fri Feb 7 12:09:47 2020 from 10.0.0.7
[root@centos8 ~]#
cobbler check
The following are potential configuration items that you may want to fix:
1 : The 'server' field in /etc/cobbler/settings must be set to something other
than localhost, or kickstarting features will not work. This should be a
resolvable hostname or IP for the boot server as reachable by all machines that
will use it.
2 : For PXE to be functional, the 'next_server' field in /etc/cobbler/settings
must be set to something other than 127.0.0.1, and should match the IP of the
boot server on the PXE network.
3 : change 'disable' to 'no' in /etc/xinetd.d/tftp7.7 cobbler命令用法
4 : Some network boot-loaders are missing from /var/lib/cobbler/loaders, you may
run 'cobbler get-loaders' to download them, or, if you only want to handle
x86/x86_64 netbooting, you may ensure that you have installed a *recent* version
of the syslinux package installed and can ignore this message entirely. Files
in this directory, should you want to support all architectures, should include
pxelinux.0, menu.c32, elilo.efi, and yaboot. The 'cobbler get-loaders' command
is the easiest way to resolve these requirements.
5 : enable and start rsyncd.service with systemctl
6 : debmirror package is not installed, it will be required to manage debian
deployments and repositories
7 : ksvalidator was not found, install pykickstart
8 : The default password used by the sample templates for newly installed
machines (default_password_crypted in /etc/cobbler/settings) is still set to
'cobbler' and should be changed, try: "openssl passwd -1 -salt 'random-phrasehere' 'your-password-here'" to generate new one
9 : fencing tools were not found, and are required to use the (optional) power
management features. install cman or fence-agents to use them
Restart cobblerd and then run 'cobbler sync' to apply changes.
1.更改/etc/xinetd.d/tftp配置文件
vim /etc/xinetd.d/tftp
disable = yes --> disable = no
systemctl restart xinetd
2.联网下载boot引导程序文件
cobbler get-loaders
3.没有网络情况下拷贝启动文件到TFTP服务文件夹
cp -a /usr/share/syslinux/{pxelinux.0,menu.c32} /var/lib/tftpboot
4.更改/etc/cobbler/settings配置文件的server项为提供cobblerd服务的主机地址,也就是本机地址
sed -nri 's#server:127.0.0.1#server:192.168.100.100#' /etc/cobbler/settings
更改后的整行内容:server:192.168.100.100
5.更改/etc/cobbler/settings配置文件的next_server项，指明tftp服务器地址，使得客户端能够找
到TFTP服务器
sed -i 's/next_server: 127.0.0.1/next_server: 192.168.100.100/'
/etc/cobbler/settings
更改后的整行内容:next_server:192.168.100.100
6.配置相应的选项来使用cobbler管理dhcp服务和tftp服务
manage_dhcp：1
manage_tftpd：1
7.pxe_just_once选项，该选项置1表示在pxe安装块结束时在cobbler系统中做相应的记录，这样会避免
如果客户机的BIOS选项中PXE启动处于第一位导致的循环重启；如果第一个启动硬件不是PXE启动那就置0。
pxe_just_once：1
配置完成后重启
systemctl restart cobblerd
[root@Centos7 ~]#cobbler check
The following are potential configuration items that you may want to fix:
1 : The 'server' field in /etc/cobbler/settings must be set to something other than localhost, or kickstarting features will not work. This shesolvable hostname or IP for the boot server as reachable by all machines that will use it.
2 : For PXE to be functional, the 'next_server' field in /etc/cobbler/settings must be set to something other than 127.0.0.1, and should match he boot server on the PXE network.
3 : change 'disable' to 'no' in /etc/xinetd.d/tftp
4 : Some network boot-loaders are missing from /var/lib/cobbler/loaders, you may run 'cobbler get-loaders' to download them, or, if you only wae x86/x86_64 netbooting, you may ensure that you have installed a *recent* version of the syslinux package installed and can ignore this messag Files in this directory, should you want to support all architectures, should include pxelinux.0, menu.c32, elilo.efi, and yaboot. The 'cobblers' command is the easiest way to resolve these requirements.
5 : enable and start rsyncd.service with systemctl
6 : debmirror package is not installed, it will be required to manage debian deployments and repositories
7 : ksvalidator was not found, install pykickstart
8 : The default password used by the sample templates for newly installed machines (default_password_crypted in /etc/cobbler/settings) is stillbbler' and should be changed, try: "openssl passwd -1 -salt 'random-phrase-here' 'your-password-here'" to generate new one
9 : fencing tools were not found, and are required to use the (optional) power management features. install cman or fence-agents to use them
Restart cobblerd and then run 'cobbler sync' to apply changes.
#生成新密码，默认安装好的系统root密码为cobbler
[root@centos7 ~]#openssl passwd -1 'magedu'
$1$1spuisnh$j34LNmyTQWs3l6xKxCZY60
#根据以上提示，只需要做1，2，8这三项即可，修改下面四行
[root@centos7 ~]#vim /etc/cobbler/settings
default_password_crypted: "$1$1spuisnh$j34LNmyTQWs3l6xKxCZY60"
next_server：< tftp服务器的 IP 地址>
server：<cobbler服务器的 IP 地址>
manage_dhcp：1 #设置为1，表示通过cobbler生成dhcpd.conf配置文件
[root@centos7 ~]#systemctl restart cobblerd
[root@Centos7 cobbler]#vim /etc/cobbler/pxe/pxedefault.template
[root@Centos7 cobbler]#cobbler sync
[root@Centos7 cobbler]#cat /etc/cobbler/pxe/pxedefault.template
DEFAULT menu
PROMPT 0
MENU TITLE Cobbler | http://www.magedu.org/ #默认为：http://cobbler.github.io/
TIMEOUT 200
TOTALTIMEOUT 6000
ONTIMEOUT $pxe_timeout_profile
LABEL local
MENU LABEL (local)
MENU DEFAULT
LOCALBOOT -1
$pxe_menu_items
MENU end
3.10.8 导入Centos系统的安装文件，生成相应的yum源
[root@Centos7 ~]#echo '- - -' > /sys/class/scsi_host/host0/scan
[root@Centos7 ~]#echo '- - -' > /sys/class/scsi_host/host1/scan
[root@Centos7 ~]#echo '- - -' > /sys/class/scsi_host/host2/scan
[root@Centos7 ~]#lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sr0 11:0 1 9.5G 0 rom
sr1 11:1 1 3.7G 0 rom
[root@Centos7 ~]#mount /dev/sr1 /mnt
[root@Centos7 ~]#cobbler import --name=centos-6.10-x86_64 --path=/mnt --arch=x86_64
task started: 2021-06-21_231232_import
task started (id=Media import, time=Mon Jun 21 23:12:32 2021)
Found a candidate signature: breed=redhat, version=rhel6
Found a matching signature: breed=redhat, version=rhel6
Adding distros from path /var/www/cobbler/ks_mirror/centos-6.10-x86_64:
creating new distro: centos-6.10-x86_64
trying symlink: /var/www/cobbler/ks_mirror/centos-6.10-x86_64 -> /var/www/cobbler/links/centos-6.10-x86_64
creating new profile: centos-6.10-x86_64
associating repos
checking for rsync repo(s)
checking for rhn repo(s)
checking for yum repo(s)
starting descent into /var/www/cobbler/ks_mirror/centos-6.10-x86_64 for centos-6.10-x86_64
processing repo at : /var/www/cobbler/ks_mirror/centos-6.10-x86_64
need to process repo/comps: /var/www/cobbler/ks_mirror/centos-6.10-x86_64
looking for /var/www/cobbler/ks_mirror/centos-6.10-x86_64/repodata/*comps*.xml
Keeping repodata as-is :/var/www/cobbler/ks_mirror/centos-6.10-x86_64/repodata
*** TASK COMPLETE ***
[root@Centos7 cobbler]#du -sh /var/www/cobbler/ks_mirror/*
3.8G /var/www/cobbler/ks_mirror/centos-6.10-x86_64
4.0K /var/www/cobbler/ks_mirror/config
[root@Centos7 cobbler]#cobbler distro list
centos-6.10-x86_64
[root@Centos7 cobbler]#cobbler profile list
centos-6.10-x86_64
#默认生成的是最小化安装
服务系统
发布于：2021-06-30 18:22
|
阅读数：529
|
评论：0
QQ好友和群
QQ空间
