130 lines
6.5 KiB
Bash
130 lines
6.5 KiB
Bash
#!/bin/bash
|
||
# ============================================================
|
||
# ПРОВЕРКА ЗАДАНИЯ 1 — HQ-SRV (только читает состояние!)
|
||
# Пункты sshd -T и sudo требуют root — иначе ПРОПУЩЕНО.
|
||
# Требует установленный dig (bind-utils): если его нет — DNS
|
||
# проверки получат [ПРОПУЩЕНО] с подсказкой.
|
||
# ============================================================
|
||
|
||
NAME="hq-srv"
|
||
LOG="check_${NAME}_z1.txt"
|
||
|
||
OK=0; FAIL=0; SKIP=0
|
||
ok() { echo "[OK] $1"; OK=$((OK+1)); }
|
||
fail() { echo "[FAIL] $1 — $2"; FAIL=$((FAIL+1)); }
|
||
skip() { echo "[ПРОПУЩЕНО] $1"; SKIP=$((SKIP+1)); }
|
||
root_or_skip() { if [[ $EUID -ne 0 ]]; then skip "$1 (нужен root)"; return 1; fi; return 0; }
|
||
check_var() { if [[ -z "${!2}" ]]; then skip "$1 — не задано $2"; return 1; fi; return 0; }
|
||
expect_eq() { if [[ "$3" == "$2" ]]; then ok "$1"; else fail "$1" "ожидалось '$2', получено '$3'"; fi; }
|
||
|
||
# ================= ПЕРЕМЕННЫЕ (заполните для проверки) =================
|
||
HOSTNAME_EXPECTED="hq-srv.au-team.irpo" # таблица 3
|
||
|
||
SRV_IF="" # интерфейс к VLAN 100
|
||
SRV_ADDR="" # адрес HQ-SRV, адрес/префикс
|
||
SRV_GW="" # шлюз (адрес HQ-RTR в VLAN 100)
|
||
|
||
SSH_PORT="2027" # по заданию 1 п. 5
|
||
SSH_USER="sshuser"
|
||
SSH_USER_UID="2027" # по заданию 1 п. 3
|
||
SSH_BANNER_TEXT="Authorized access only"
|
||
|
||
# Адреса для DNS-записей (таблица 3)
|
||
HQ_RTR_IP="" BR_RTR_IP="" BR_FW_IP="" HQ_CLI_IP=""
|
||
BR_SRV_IP="" ISP_TO_HQ_IP="" ISP_TO_BR_IP=""
|
||
|
||
EXAM_TZ=""
|
||
|
||
main () {
|
||
echo "=== Проверка задания 1: HQ-SRV ==="
|
||
|
||
# --- 1. Имя хоста ---
|
||
check_var "имя хоста" HOSTNAME_EXPECTED &&
|
||
expect_eq "имя хоста" "$HOSTNAME_EXPECTED" "$(hostname)"
|
||
|
||
# --- 2. Сеть ---
|
||
check_var "адрес" SRV_ADDR &&
|
||
if grep -qF -- "$SRV_ADDR" <(ip -4 -o addr show "$SRV_IF" 2>/dev/null); then
|
||
ok "адрес = $SRV_ADDR"
|
||
else fail "адрес" "не нашёлся $SRV_ADDR ($(ip -4 -o addr show 2>/dev/null | grep inet))"; fi
|
||
check_var "шлюз" SRV_GW &&
|
||
expect_eq "шлюз по умолчанию" "$SRV_GW" "$(ip route show default 2>/dev/null | awk '{print $3}')"
|
||
|
||
# --- 3. Пользователь sshuser (UID 2027) и sudo ---
|
||
check_var "пользователь sshuser" SSH_USER &&
|
||
if id "$SSH_USER" &>/dev/null; then
|
||
got_uid=$(id -u "$SSH_USER")
|
||
expect_eq "UID $SSH_USER" "$SSH_USER_UID" "$got_uid"
|
||
else fail "пользователь $SSH_USER" "нет такого пользователя"; fi
|
||
check_var "sudo для sshuser" SSH_USER &&
|
||
if root_or_skip "sudo для sshuser"; then
|
||
if sudo -ln -U "$SSH_USER" 2>/dev/null | grep -q "NOPASSWD: ALL"; then
|
||
ok "sshuser — sudo без пароля"
|
||
else fail "sudo для sshuser" "нет NOPASSWD: ALL"; fi
|
||
fi
|
||
|
||
# --- 4. SSH: порт 2027, только sshuser, 2 попытки, баннер ---
|
||
if root_or_skip "sshd -T (эффективный конфиг)"; then
|
||
T=$(sshd -T 2>/dev/null)
|
||
if [[ -z "$T" ]]; then fail "sshd -T" "команда не отработала"
|
||
else
|
||
got_port=$(grep -E "^port " <<<"$T" | awk '{print $2}')
|
||
expect_eq "SSH порт" "$SSH_PORT" "$got_port"
|
||
if grep -E "^allowusers " <<<"$T" | grep -qw "$SSH_USER"; then
|
||
ok "SSH AllowUsers = $SSH_USER"
|
||
else fail "SSH AllowUsers" "$(grep -E '^allowusers' <<<"$T")"; fi
|
||
got_tries=$(grep -E "^maxauthtries " <<<"$T" | awk '{print $2}')
|
||
expect_eq "SSH MaxAuthTries" "2" "$got_tries"
|
||
got_banner=$(grep -E "^banner " <<<"$T" | awk '{print $2}')
|
||
if [[ -n "$got_banner" ]] && grep -qF "$SSH_BANNER_TEXT" "$got_banner" 2>/dev/null; then
|
||
ok "SSH баннер '$SSH_BANNER_TEXT'"
|
||
else fail "SSH баннер" "banner=$got_banner, текст не совпал"; fi
|
||
fi
|
||
fi
|
||
|
||
# --- 5. DNS: A- и PTR-записи по таблице 3 ---
|
||
if ! command -v dig &>/dev/null; then
|
||
skip "DNS-проверки — dig не установлен (dnf install bind-utils)"
|
||
else
|
||
check_dns_a () {
|
||
local RECORD="$1" EXPECT="$2"
|
||
local GOT; GOT=$(dig +short "$RECORD" @127.0.0.1 2>/dev/null)
|
||
if [[ "$GOT" == "$EXPECT" ]]; then ok "DNS A: $RECORD -> $EXPECT"
|
||
else fail "DNS A: $RECORD" "ожидалось '$EXPECT', получено '$GOT'"; fi
|
||
}
|
||
check_var "DNS hq-rtr" HQ_RTR_IP && check_dns_a "hq-rtr.au-team.irpo" "$HQ_RTR_IP"
|
||
check_var "DNS br-rtr" BR_RTR_IP && check_dns_a "br-rtr.au-team.irpo" "$BR_RTR_IP"
|
||
check_var "DNS br-fw" BR_FW_IP && check_dns_a "br-fw.au-team.irpo" "$BR_FW_IP"
|
||
# PTR для HQ-SRV (адрес = наш собственный, из переменной SRV_ADDR)
|
||
check_var "PTR HQ-SRV" SRV_ADDR &&
|
||
{ GOT_PTR=$(dig +short -x "${SRV_ADDR%/*}" @127.0.0.1 2>/dev/null)
|
||
if grep -q "hq-srv.au-team.irpo" <<<"$GOT_PTR"; then ok "PTR: ${SRV_ADDR%/*} -> hq-srv.au-team.irpo"
|
||
else fail "PTR HQ-SRV" "ожидалось 'hq-srv.au-team.irpo', получено '$GOT_PTR'"; fi; }
|
||
check_var "DNS hq-cli" HQ_CLI_IP && check_dns_a "hq-cli.au-team.irpo" "$HQ_CLI_IP"
|
||
check_var "DNS br-srv" BR_SRV_IP &&
|
||
{ check_dns_a "br-srv.au-team.irpo" "$BR_SRV_IP"
|
||
GOT_PTR=$(dig +short -x "$BR_SRV_IP" @127.0.0.1 2>/dev/null)
|
||
if grep -q "br-srv.au-team.irpo" <<<"$GOT_PTR"; then ok "PTR: $BR_SRV_IP -> br-srv.au-team.irpo"
|
||
else fail "PTR BR-SRV" "ожидалось 'br-srv.au-team.irpo', получено '$GOT_PTR'"; fi; }
|
||
check_var "DNS docker" ISP_TO_HQ_IP && check_dns_a "docker.au-team.irpo" "$ISP_TO_HQ_IP"
|
||
check_var "DNS web" ISP_TO_BR_IP && check_dns_a "web.au-team.irpo" "$ISP_TO_BR_IP"
|
||
fi
|
||
|
||
# --- 6. Часовой пояс ---
|
||
check_var "часовой пояс" EXAM_TZ &&
|
||
expect_eq "часовой пояс" "$EXAM_TZ" "$(timedatectl show -p Timezone --value)"
|
||
|
||
echo ""
|
||
echo "=== Проверить вручную ==="
|
||
echo " — ssh -p 2027 sshuser@<адрес HQ-SRV> с другой машины (подключение работает)"
|
||
echo " — fork wong вход под другими пользователями по ssh запрещён (MaxAuthTries/AllowUsers)"
|
||
|
||
echo ""
|
||
echo "=== Итог: OK=$OK FAIL=$FAIL ПРОПУЩЕНО=$SKIP ==="
|
||
[[ $FAIL -eq 0 ]]
|
||
}
|
||
main 2>&1 | tee "$LOG"
|
||
STATUS=${PIPESTATUS[0]}
|
||
echo "Лог сохранён: $LOG"
|
||
exit $STATUS
|