go to mkdocs
This commit is contained in:
Ludovic Cartier
parent
b8f840ee7a
commit
3e0a7572e6
26
docs/MySQL/size.md
Normal file
26
docs/MySQL/size.md
Normal file
@ -0,0 +1,26 @@
|
||||
categories: mysql
|
||||
title: Taille des bases de données et tables
|
||||
|
||||
#### Obtenir la taille de *toutes* les bases de données présentes sur le serveur :
|
||||
|
||||
```bash
|
||||
SELECT table_schema AS 'DB Name', ROUND(SUM(data_length + index_length) / 1024 / 1024, 1) AS 'DB Size in MB' FROM information_schema.tables GROUP BY table_schema;
|
||||
```
|
||||
|
||||
#### Obtenir la taille d'une base en particulier :
|
||||
|
||||
```bash
|
||||
SELECT table_schema AS 'DB Name', ROUND(SUM(data_length + index_length) / 1024 / 1024, 1) AS 'DB Size in MB' FROM information_schema.tables WHERE table_schema = '##DBNAME##' GROUP BY table_schema;
|
||||
```
|
||||
|
||||
#### Obtenir la taille de toutes les tables d'un base de données spécifique :
|
||||
|
||||
```bash
|
||||
SELECT TABLE_NAME AS `Table`, ROUND((DATA_LENGTH + INDEX_LENGTH) / 1024 / 1024) AS `Size (MB)` FROM information_schema.TABLES WHERE TABLE_SCHEMA = "<DBNAME>" ORDER BY (DATA_LENGTH + INDEX_LENGTH) DESC;
|
||||
```
|
||||
|
||||
#### Obtenir la taille de toutes les tables de *toutes* les bases de données :
|
||||
|
||||
```bash
|
||||
SELECT TABLE_SCHEMA AS `Database`, TABLE_NAME AS `Table`, ROUND((DATA_LENGTH + INDEX_LENGTH) / 1024 / 1024) AS `Size (MB)` FROM information_schema.TABLES ORDER BY (DATA_LENGTH + INDEX_LENGTH) DESC;
|
||||
```
|
||||
27
docs/MySQL/user.md
Normal file
27
docs/MySQL/user.md
Normal file
@ -0,0 +1,27 @@
|
||||
categories: mysql
|
||||
title: Gestion des utilisateurs
|
||||
|
||||
#### Obtenir la liste des utilisateurs
|
||||
|
||||
```bash
|
||||
mysql> SELECT User, Host from mysql.user;
|
||||
```
|
||||
|
||||
#### Créer un nouvel utilisateur
|
||||
|
||||
```bash
|
||||
mysql> CREATE USER `<user>`@`<host>` IDENTIFIED BY `<password>`;
|
||||
```
|
||||
|
||||
#### Affecter des droits à un utilisateur
|
||||
|
||||
```bash
|
||||
mysql> GRANT ALL PRIVILEGES ON <database>.* TO `<user>`@`<host>` IDENTIFIED BY `<password>`;
|
||||
mysql> FLUSH PRIVILEGES;
|
||||
```
|
||||
|
||||
#### Vérifier les droits d'un utilisateur
|
||||
|
||||
```bash
|
||||
mysql> SHOW GRANTS FOR `<user>`@`<host>`;
|
||||
```
|
||||
353
docs/SSH/sshportal.md
Normal file
353
docs/SSH/sshportal.md
Normal file
@ -0,0 +1,353 @@
|
||||
categories: ssh
|
||||
title: SSHPortal - Installation et exploitation
|
||||
|
||||
#### Pré-requis
|
||||
|
||||
_Docker_ doit être installé sur le serveur qui accueillera _SSHPortal_.
|
||||
|
||||
Les lignes pré-fixées de "~" sont à exécuter via SSH.
|
||||
|
||||
Les lignes pré-fixées de "config> " sont à exécuter dans la console d'administration de SSPortal.
|
||||
|
||||
#### Installation
|
||||
|
||||
L'installation se fait via _Docker_ , avec l'image [officielle](https://hub.docker.com/r/moul/sshportal).
|
||||
|
||||
```bash
|
||||
~ mkdir -p /etc/docker/compose/sshportal/{data,log}
|
||||
~ cat <<EOF >> /etc/docker/compose/sshportal/docker-compose.yml
|
||||
version: "3"
|
||||
|
||||
services:
|
||||
sshportal:
|
||||
image: moul/sshportal
|
||||
container_name: sshportal
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
SSHPORTAL_DEFAULT_ADMIN_INVITE_TOKEN: 'XXXXX'
|
||||
SSHPORTAL_DB_DRIVER: 'sqlite3'
|
||||
SSHPORTAL_DATABASE_URL: '/var/lib/sshportal/sshportal.db'
|
||||
ports:
|
||||
- 2222:2222
|
||||
volumes:
|
||||
- ./log:/log
|
||||
- ./data:/var/lib/sshportal/
|
||||
- /etc/hosts:/etc/hosts:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
networks:
|
||||
sshportal:
|
||||
ipv4_address: 172.19.0.2
|
||||
|
||||
networks:
|
||||
sshportal:
|
||||
ipam:
|
||||
driver: default
|
||||
config:
|
||||
- subnet: 172.19.0.0/24
|
||||
EOF
|
||||
~ docker-compose pull
|
||||
~ docker-compose up -d
|
||||
```
|
||||
|
||||
> A noter qu'il est possible d'utiliser un backend de base de données différents, selon votre choix / goût (MySQL, PostgreSQL, etc).
|
||||
|
||||
#### Initialisation du compte admin
|
||||
|
||||
Pour initialiser le compte _admin_, il faut :
|
||||
|
||||
1. se connecter une première fois avec le token d'invitation _SSHPORTAL_DEFAULT_ADMIN_INVITE_TOKEN_ (défini dans le fichier `docker-compose.yml`)
|
||||
2. lui fournir une clé SSH qui servira à identifier le compte _admin_
|
||||
|
||||
> Attention: il est indispensable de créer un clé SSH dédiée à l'administration de _SSHPortal_.
|
||||
|
||||
Nous commencons par générer une clé SSH :
|
||||
|
||||
```bash
|
||||
~ ssh-keygen -t ed25519 -f ed25519_sshportal_admin
|
||||
Generating public/private ed25519 key pair.
|
||||
Enter passphrase (empty for no passphrase):
|
||||
Enter same passphrase again:
|
||||
Your identification has been saved in ed25519_sshportal_admin.
|
||||
Your public key has been saved in ed25519_sshportal_admin.pub.
|
||||
The key fingerprint is:
|
||||
SHA256:69qOmaargSULBB1xdG3SlfRsAmoiSdPwBTotnlW6lUI ludal@mbp-ludal-1.home
|
||||
The key's randomart image is:
|
||||
+--[ED25519 256]--+
|
||||
|..**E.+o.oo. |
|
||||
|...O.=.o+..o |
|
||||
| .* B =o . + |
|
||||
|.. * * o |
|
||||
|o + . S |
|
||||
|.= . |
|
||||
|o . . |
|
||||
| . .* |
|
||||
| ..o+=o+ |
|
||||
+----[SHA256]-----+
|
||||
```
|
||||
|
||||
Puis, on se connecter avec la clé SSH et le token d'invitation (pour rappel, qui est défini dans le fichier `docker-compose.yml`) :
|
||||
|
||||
```bash
|
||||
~ ssh <HOST> -i ed25519_sshportal_admin -p 2222 -l invite:XXXXX
|
||||
```
|
||||
|
||||
Cela va donc enregistrer la clé SSH "ed25519_sshportal_admin" pour le compte admin de SSHPortal.
|
||||
|
||||
Pour se connecter à la console d'administration de SSHPortal, il faudra donc faire :
|
||||
|
||||
```bash
|
||||
~ ssh <HOST> -i ed25519_sshportal_admin -p 2222 -l admin
|
||||
```
|
||||
|
||||
#### Configuration
|
||||
|
||||
Pré-requis: pour réaliser toutes les commandes de configuration, il est nécessaire de se connecter à _SSHPortal_ avec le compte _admin_ :
|
||||
|
||||
```bash
|
||||
~ ssh <HOST> -i ed25519_sshportal_admin -p 2222 -l admin
|
||||
```
|
||||
|
||||
##### Céation d'une clé SSH dédiée
|
||||
|
||||
```bash
|
||||
config> key create --name my-project
|
||||
3
|
||||
```
|
||||
|
||||
Cette clé sera à copier sur les serveurs cibles, pour permettra la connexion.
|
||||
|
||||
##### Créer les _hostgroup_
|
||||
|
||||
```bash
|
||||
config> hostgroup create --name preprod
|
||||
config> hostgroup create --name prod
|
||||
```
|
||||
|
||||
Vérification :
|
||||
|
||||
```bash
|
||||
config> hostgroup ls
|
||||
ID | NAME | HOSTS | ACLS | UPDATED | CREATED | COMMENT
|
||||
-----+---------+-------+------+---------------+---------------+-----------------------
|
||||
3 | prod | 0 | 0 | 6 seconds ago | 6 seconds ago |
|
||||
2 | preprod | 0 | 0 | 9 seconds ago | 9 seconds ago |
|
||||
1 | default | 0 | 1 | 2 minutes ago | 2 minutes ago | created by sshportal
|
||||
Total: 3 host groups.
|
||||
```
|
||||
|
||||
##### Créer les _hosts_
|
||||
|
||||
```bash
|
||||
config> host create --name=preprod1 --group=preprod --logging=everything --key my-project root@W.X.Y.Z
|
||||
config> host create --name=prod1 --group=prod --logging=everything --key my-project root@W.X.Y.Z
|
||||
```
|
||||
|
||||
Vérification :
|
||||
|
||||
```bash
|
||||
config> host ls
|
||||
ID | NAME | URL | KEY | GROUPS | UPDATED | CREATED | COMMENT | HOP | LOGGING
|
||||
-----+----------+--------------------+---------+-------------+----------------+----------------+---------+-----+-------------
|
||||
2 | prod1 | ssh://root@W.X.Y.Z | default | prod | 16 seconds ago | 16 seconds ago | | | everything
|
||||
1 | preprod1 | ssh://root@W.X.Y.Z | default | preprod c| 29 seconds ago | 29 seconds ago | | | everything
|
||||
Total: 2 hosts.
|
||||
```
|
||||
|
||||
##### Créer les _usergroup_
|
||||
|
||||
```bash
|
||||
config> usergroup create --name foo
|
||||
config> usergroup create --name bar
|
||||
```
|
||||
|
||||
Vérification :
|
||||
|
||||
```bash
|
||||
config> usergroup ls
|
||||
ID | NAME | USERS | ACLS | UPDATE | CREATE | COMMENT
|
||||
-----+----------+-------+------+---------------+---------------+-----------------------
|
||||
3 | bar | 1 | 0 | 6 seconds ago | 6 seconds ago |
|
||||
2 | foo | 1 | 0 | 9 seconds ago | 9 seconds ago |
|
||||
1 | default | 1 | 1 | 5 minutes ago | 5 minutes ago | created by sshportal
|
||||
Total: 3 user groups.
|
||||
```
|
||||
|
||||
##### Créer les utilisateurs
|
||||
|
||||
> Il faut 'inviter' les utilisateurs à rejoindre notre instance de SSHPortal, via la commande suivante :
|
||||
|
||||
```bash
|
||||
config> user invite --name="John Doe" --group foo john.doe@domain.com
|
||||
User 2 created.
|
||||
```
|
||||
|
||||
En retour, SSHPortal va nous fournir un token à utiliser à la première connexion :
|
||||
|
||||
```bash
|
||||
To associate this account with a key, use the following SSH user: 'invite:XXXXXXXX'.
|
||||
```
|
||||
|
||||
Se connecter ensuite une première fois:
|
||||
|
||||
```bash
|
||||
~ ssh <HOST> -i my-ssh-key -p 2222 -l invite:XXXXXXX
|
||||
The authenticity of host '[<HOST>]:2222 ([<HOST>]:2222)' can't be established.
|
||||
ED25519 key fingerprint is SHA256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX..
|
||||
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
|
||||
Warning: Permanently added '[<HOST>]:2222' (ED25519) to the list of known hosts.
|
||||
Welcome Jon Doe!
|
||||
|
||||
Your key is now associated with the user "john.doe@domain.com".
|
||||
Connection to <HOST> closed.
|
||||
```
|
||||
|
||||
Cela aura alors pour conséquence de copier la clé SSH publique sur votre compte SSHPortal.
|
||||
|
||||
##### Passer un utilisateur en admin
|
||||
|
||||
Il faut commencer par récupérer la liste des utilisateurs et leur id :
|
||||
|
||||
```bash
|
||||
config> user ls
|
||||
ID | NAME | EMAIL | ROLES | KEYS | GROUPS | UPDATED | CREATED | COMMENT
|
||||
-----+----------+---------------------+-------+------+--------------------------------+----------------+----------------+-----------------------
|
||||
2 | John Doe | john.doe@domain.com | | 0 | default | 4 seconds ago | 3 minutes ago |
|
||||
1 | admin | admin@localhost | admin | 1 | default | 5 minutes ago | 46 minutes ago | created by sshportal
|
||||
```
|
||||
|
||||
Nous pouvons maintenant mettre à jour l'utilisateur et le passer en administrateur :
|
||||
|
||||
```
|
||||
config> user update --email john.doe@domain.com --assign-role admin 2
|
||||
```
|
||||
|
||||
Vérification :
|
||||
|
||||
```bash
|
||||
config> user ls
|
||||
ID | NAME | EMAIL | ROLES | KEYS | GROUPS | UPDATED | CREATED | COMMENT
|
||||
-----+----------+---------------------+-------+------+--------------------------------+----------------+----------------+-----------------------
|
||||
2 | John Doe | john.doe@domain.com | admin | 0 | default | 9 seconds ago | 3 minutes ago |
|
||||
1 | admin | admin@localhost | admin | 1 | default | 5 minutes ago | 46 minutes ago | created by sshportal
|
||||
```
|
||||
|
||||
##### Création des ACL
|
||||
|
||||
_SSHPortal_ permet de gérer finement les accès à chaque host en fonction d'un utilisateur, ou d'un groupe d'utilisateur.
|
||||
|
||||
Pour créer une ACL qui permettra à un groupe d'utilisateur de se connecter à un groupe d'hôte :
|
||||
|
||||
```bash
|
||||
config> acl create --usergroup foo --hostgroup prod --action allow
|
||||
config> acl create --usergroup foo --hostgroup preprod --action allow
|
||||
```
|
||||
|
||||
Vérification :
|
||||
|
||||
```bash
|
||||
config> acl ls
|
||||
ID | WEIGHT | USER GROUPS | HOST GROUPS | HOST PATTERN | ACTION | INCEPTION | EXPIRATION | UPDATED | CREATED | COMMENT
|
||||
-----+--------+-------------+-------------+--------------+--------+-----------+------------+---------------+---------------+-----------------------
|
||||
3 | 0 | foo | preprod | | allow | | | 4 minutes ago | 4 minutes ago |
|
||||
2 | 0 | foo | prod | | allow | | | 4 minutes ago | 4 minutes ago |
|
||||
1 | 0 | default | default | | allow | | | 1 hour ago | 1 hour ago | created by sshportal
|
||||
Total: 3 ACLs.
|
||||
```
|
||||
|
||||
#### Préparation des hosts
|
||||
|
||||
Pour se connecter aux hosts "finaux", il convient de copier la clé SSH de SSHPortal sur le compte _unix_ de votre choix sur chaque host.
|
||||
|
||||
1. on peut ensuite inspecter la clé
|
||||
|
||||
```bash
|
||||
config> key show my-project
|
||||
General
|
||||
=======
|
||||
Name: my-project
|
||||
Type: ed25519
|
||||
Length: 1
|
||||
Comment:
|
||||
|
||||
Relationships
|
||||
=============
|
||||
Linked hosts: (0)
|
||||
|
||||
Crypto
|
||||
======
|
||||
authorized_key format: ssh-ed25519 XXXXXXXXX
|
||||
Private Key:
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
XXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||||
-----END PRIVATE KEY-----
|
||||
|
||||
|
||||
Help
|
||||
====
|
||||
inspect: ssh sshportal key inspect my-project
|
||||
setup: ssh user@example.com "$(ssh sshportal key setup my-project)"
|
||||
```
|
||||
|
||||
2. il faut ensuite récupérer la clé
|
||||
|
||||
```bash
|
||||
config> key setup my-project
|
||||
umask 077; mkdir -p .ssh; echo ssh-ed25519 XXXXXXXXXXXXXXXX sshportal >> .ssh/authorized_keys
|
||||
```
|
||||
|
||||
3. se connecter sur chaque host et ajouter la clé SSH précédemment récupérée:
|
||||
|
||||
```bash
|
||||
~ ssh <host>
|
||||
~ sudo su -
|
||||
~ umask 077; mkdir -p .ssh; echo ssh-ed25519 XXXXXXXXXXXXXXXX sshportal >> .ssh/authorized_keys
|
||||
```
|
||||
|
||||
4. si besoin, adapter la conf de SSH `/etc/ssh/sshd_config`
|
||||
|
||||
```bash
|
||||
Match Address 1.2.3.4/24
|
||||
PermitRootLogin without-password
|
||||
Match User root
|
||||
AllowTcpForwarding yes
|
||||
|
||||
AllowUsers root (ne pas effacer les autres entrées !)
|
||||
```
|
||||
|
||||
```bash
|
||||
~ systemctl reload sshd.service
|
||||
```
|
||||
|
||||
#### Utilisation de SSHPortal
|
||||
|
||||
Pour se connecter aux hosts via SSHPortal, il suffit de faire :
|
||||
|
||||
```bash
|
||||
~ ssh -i my-sshportal-key -p 2222 <HOST> -l <HOST>
|
||||
```
|
||||
|
||||
A noter qu'il serait possible de rajouter une configuration dans votre fichier ".ssh/config" pour faciler les choses :
|
||||
|
||||
```bash
|
||||
Host portal
|
||||
Port 2222
|
||||
Hostname <HOST>
|
||||
IdentityFile my-sshportal-key
|
||||
```
|
||||
|
||||
Couplé à un _alias_ dans votre `.bashrc` :
|
||||
|
||||
```bash
|
||||
alias sshportal="sshportal portal -l $1"
|
||||
```
|
||||
|
||||
Cela vous permettra d'utiliser SSHPortal ainsi :
|
||||
|
||||
```bash
|
||||
~ portal <host>
|
||||
```
|
||||
|
||||
#### Référence
|
||||
|
||||
https://github.com/moul/sshportal
|
||||
https://hub.docker.com/r/moul/sshportal
|
||||
BIN
docs/assets/logo.png
Normal file
BIN
docs/assets/logo.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 59 KiB |
4
docs/index.md
Normal file
4
docs/index.md
Normal file
@ -0,0 +1,4 @@
|
||||
# Accueil
|
||||
|
||||
Site propulsé par [mkdocs.org](https://www.mkdocs.org) et [gitea](https://about.gitea.com/).
|
||||
|
||||
29
mkdocs.yml
Normal file
29
mkdocs.yml
Normal file
@ -0,0 +1,29 @@
|
||||
site_name: BrainSys - wiki
|
||||
|
||||
theme:
|
||||
name: material
|
||||
highlightjs: true
|
||||
palette:
|
||||
scheme: slate
|
||||
primary: light blue
|
||||
language: fr
|
||||
logo: assets/logo.png
|
||||
homepage: https://brainsys.io
|
||||
features:
|
||||
- navigation.indexes
|
||||
- navigation.instant
|
||||
- navigation.expand
|
||||
- navigation.path
|
||||
|
||||
extra:
|
||||
consent:
|
||||
title: Cookie consent
|
||||
description: >-
|
||||
We use cookies to recognize your repeated visits and preferences, as well
|
||||
as to measure the effectiveness of our documentation and whether users
|
||||
find what they're searching for. With your consent, you're helping us to
|
||||
make our documentation better.
|
||||
actions:
|
||||
- reject
|
||||
- accept
|
||||
- manage
|
||||
Loading…
Reference in New Issue
Block a user