80 lines
2.7 KiB
Bash
80 lines
2.7 KiB
Bash
listening 9100 tcp && refuse "something already listens on port 9100, which the lab uses; stop it and start again"
|
|
listening 8443 tcp && refuse "something already listens on port 8443, which the lab uses; stop it and start again"
|
|
peer_up
|
|
mkdir -p /usr/local/lib/le-lab /etc/le-lab/tls
|
|
|
|
# Task 1: a service on all addresses.
|
|
echo 'LISTEN=0.0.0.0' >/etc/metrics-exporter.conf
|
|
cat >/usr/local/lib/le-lab/metrics-exporter.py <<'Y'
|
|
# Serves a few made-up metrics on the address in /etc/metrics-exporter.conf.
|
|
import http.server, socketserver
|
|
addr = "127.0.0.1"
|
|
for line in open("/etc/metrics-exporter.conf"):
|
|
if line.strip().startswith("LISTEN="):
|
|
addr = line.split("=", 1)[1].strip()
|
|
|
|
|
|
class H(http.server.BaseHTTPRequestHandler):
|
|
def do_GET(self):
|
|
self.send_response(200)
|
|
self.end_headers()
|
|
self.wfile.write(b"node_load1 0.42\nnode_users 3\n")
|
|
|
|
|
|
class S(http.server.HTTPServer):
|
|
allow_reuse_address = True
|
|
|
|
def server_bind(self):
|
|
socketserver.TCPServer.server_bind(self)
|
|
|
|
|
|
S((addr, 9100), H).serve_forever()
|
|
Y
|
|
cat >/etc/systemd/system/metrics-exporter.service <<'Y'
|
|
[Unit]
|
|
Description=Metrics exporter for local monitoring
|
|
After=network.target
|
|
|
|
[Service]
|
|
ExecStart=/usr/bin/python3 /usr/local/lib/le-lab/metrics-exporter.py
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
Y
|
|
|
|
# Task 2: a CA, and a server certificate for the wrong name.
|
|
cd /etc/le-lab/tls
|
|
openssl req -x509 -newkey rsa:2048 -nodes -keyout ca.key -out ca.crt -days 30 -subj "/CN=Lab Test CA" 2>/dev/null
|
|
openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr -subj "/CN=old.example.test" 2>/dev/null
|
|
printf 'subjectAltName=DNS:old.example.test\n' >san.ext
|
|
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 30 -extfile san.ext 2>/dev/null
|
|
rm -f server.csr san.ext
|
|
chmod 600 ca.key server.key
|
|
cd /
|
|
cat >/etc/systemd/system/le-lab-tls.service <<'Y'
|
|
[Unit]
|
|
Description=Practice lab TLS test server on port 8443
|
|
After=network.target
|
|
|
|
[Service]
|
|
ExecStart=/usr/bin/openssl s_server -accept 8443 -cert /etc/le-lab/tls/server.crt -key /etc/le-lab/tls/server.key -www -quiet
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
Y
|
|
systemctl daemon-reload
|
|
systemctl enable --now --quiet metrics-exporter.service le-lab-tls.service
|
|
|
|
# Task 3: the SSH client insists on a key exchange the server dropped.
|
|
cat >/etc/ssh/ssh_config.d/05-legacy-hosts.conf <<'Y'
|
|
# Settings for old appliances.
|
|
Host localhost 127.0.0.1
|
|
KexAlgorithms diffie-hellman-group1-sha1
|
|
Y
|
|
|
|
# Task 4: a repository that doesn't exist.
|
|
if is_rhel; then
|
|
printf '[internal-tools]\nname=Internal tools\nbaseurl=https://repo.example.invalid/el10/\ngpgcheck=1\n' >/etc/yum.repos.d/internal-tools.repo
|
|
fi
|
|
true
|