docs: add 100 Days of DevOps challenge notes
This commit is contained in:
303
100 - days of devops/devops-1-10.md
Normal file
303
100 - days of devops/devops-1-10.md
Normal file
@@ -0,0 +1,303 @@
|
||||
## Task 1
|
||||
|
||||
To accommodate the backup agent tool's specifications, the system admin team at xFusionCorp Industries requires the creation of a user with a non-interactive shell. Here's your task:
|
||||
|
||||
Create a user named siva with a non-interactive shell on App Server 2.
|
||||
|
||||
```bash
|
||||
sudo useradd -s /sbin/nologin siva
|
||||
|
||||
# Verify
|
||||
grep siva /etc/passwd
|
||||
```
|
||||
|
||||
|
||||
## Task 2
|
||||
|
||||
As part of the temporary assignment to the Nautilus project, a developer named siva requires access for a limited duration. To ensure smooth access management, a temporary user account with an expiry date is needed. Here's what you need to do:
|
||||
|
||||
Create a user named siva on App Server 1 in Stratos Datacenter. Set the expiry date to 2027-04-15, ensuring the user is created in lowercase as per standard protocol.
|
||||
|
||||
```bash
|
||||
sudo useradd -e 2027-04-15 siva
|
||||
|
||||
# Verify
|
||||
sudo chage -l siva | grep -i expire
|
||||
```
|
||||
## Task 3
|
||||
|
||||
Your task is to disable direct SSH root login on all app servers within the Stratos Datacenter.
|
||||
|
||||
App servers are these:
|
||||
Server Name IP Hostname User Password Purpose
|
||||
Application Server 1 Dynamic stapp01 tony Ir0nM@n Hosts Nautilus Application 1
|
||||
Application Server 2 Dynamic stapp02 steve Am3ric@ Hosts Nautilus Application 2
|
||||
Application Server 3 Dynamic stapp03 banner BigGr33n Hosts Nautilus Application 3
|
||||
|
||||
```bash
|
||||
cat > harden_ssh.sh <<'SCRIPT'
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
CREDS="${1:-creds.txt}"
|
||||
|
||||
REMOTE_CMD='
|
||||
echo "$SUDO_PASS" | sudo -S -p "" sed -i "s/^#*\s*PermitRootLogin.*/PermitRootLogin no/" /etc/ssh/sshd_config &&
|
||||
echo "$SUDO_PASS" | sudo -S -p "" sshd -t &&
|
||||
echo "$SUDO_PASS" | sudo -S -p "" systemctl restart sshd &&
|
||||
echo "--- $(hostname) effective config ---" &&
|
||||
echo "$SUDO_PASS" | sudo -S -p "" sshd -T | grep -i permitrootlogin
|
||||
'
|
||||
|
||||
while read -r host user pass <&3; do
|
||||
[[ -z "$host" || "$host" == \#* ]] && continue
|
||||
echo "==> Hardening $host"
|
||||
SSHPASS="$pass" sshpass -e ssh -n \
|
||||
-o StrictHostKeyChecking=no \
|
||||
-o UserKnownHostsFile=/dev/null \
|
||||
-o LogLevel=ERROR \
|
||||
"$user@$host" \
|
||||
"SUDO_PASS='$pass' bash -c '$REMOTE_CMD'"
|
||||
echo
|
||||
done 3< "$CREDS"
|
||||
SCRIPT
|
||||
chmod +x harden_ssh.sh
|
||||
|
||||
# --- deps ---
|
||||
sudo yum install -y sshpass 2>/dev/null || sudo apt install -y sshpass
|
||||
./harden_ssh.sh
|
||||
```
|
||||
|
||||
|
||||
## Task 4
|
||||
|
||||
Your task is to grant executable permissions to the /tmp/xfusioncorp.sh script on App Server 1. Additionally, ensure that all users have the capability to execute it.
|
||||
|
||||
```bash
|
||||
chmod a+rx /tmp/xfusioncorp.sh
|
||||
```
|
||||
|
||||
## Task 5
|
||||
|
||||
Following a security audit, the xFusionCorp Industries security team has opted to enhance application and server security with SELinux. To initiate testing, the following requirements have been established for App server 2 in the Stratos Datacenter:
|
||||
|
||||
Install the required SELinux packages.
|
||||
|
||||
Permanently disable SELinux for the time being; it will be re-enabled after necessary configuration changes.
|
||||
|
||||
No need to reboot the server, as a scheduled maintenance reboot is already planned for tonight.
|
||||
|
||||
Disregard the current status of SELinux via the command line; the final status after the reboot should be disabled.
|
||||
|
||||
```bash
|
||||
sudo yum install -y selinux-policy selinux-policy-targeted policycoreutils policycoreutils-python-utils libselinux-utils setools-console mcstrans
|
||||
sudo sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
|
||||
|
||||
# verify
|
||||
grep '^SELINUX=' /etc/selinux/config
|
||||
|
||||
```
|
||||
|
||||
## Task 6
|
||||
|
||||
The Nautilus system admins team has prepared scripts to automate several day-to-day tasks. They want them to be deployed on all app servers in Stratos DC on a set schedule. Before that they need to test similar functionality with a sample cron job. Therefore, perform the steps below:
|
||||
|
||||
a. Install cronie package on all Nautilus app servers and start crond service.
|
||||
b. Add a cron */5 * * * * echo hello > /tmp/cron_text for root user
|
||||
|
||||
```bash
|
||||
# --- creds ---
|
||||
cat > creds.txt <<'EOF'
|
||||
stapp01 tony Ir0nM@n
|
||||
stapp02 steve Am3ric@
|
||||
stapp03 banner BigGr33n
|
||||
EOF
|
||||
chmod 600 creds.txt
|
||||
|
||||
# --- deploy script ---
|
||||
cat > deploy_cron.sh <<'SCRIPT'
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
CREDS="${1:-creds.txt}"
|
||||
|
||||
# Everything runs inside one root shell: authenticate sudo ONCE via -S,
|
||||
# then stdin is free for the crontab pipe inside.
|
||||
REMOTE_CMD='
|
||||
yum install -y cronie
|
||||
systemctl enable --now crond
|
||||
echo "*/5 * * * * echo hello > /tmp/cron_text" | crontab -u root -
|
||||
echo "--- $(hostname) ---"
|
||||
systemctl is-active crond
|
||||
crontab -u root -l
|
||||
'
|
||||
|
||||
while read -r host user pass <&3; do
|
||||
[[ -z "$host" || "$host" == \#* ]] && continue
|
||||
echo "==> Deploying cron on $host"
|
||||
SSHPASS="$pass" sshpass -e ssh -n \
|
||||
-o StrictHostKeyChecking=no \
|
||||
-o UserKnownHostsFile=/dev/null \
|
||||
-o LogLevel=ERROR \
|
||||
"$user@$host" \
|
||||
"echo '$pass' | sudo -S -p '' bash -c '$REMOTE_CMD'" \
|
||||
2> >(grep -v '^\[sudo\]' >&2)
|
||||
echo
|
||||
done 3< "$CREDS"
|
||||
SCRIPT
|
||||
chmod +x deploy_cron.sh
|
||||
|
||||
# --- run ---
|
||||
./deploy_cron.sh
|
||||
```
|
||||
|
||||
## Task 7
|
||||
|
||||
The system admins team of xFusionCorp Industries has set up some scripts on jump host that run on regular intervals and perform operations on all app servers in Stratos Datacenter. To make these scripts work properly we need to make sure the thor user on jump host has password-less SSH access to all app servers through their respective sudo users (i.e tony for app server 1). Based on the requirements, perform the following:
|
||||
|
||||
Set up a password-less authentication from user thor on jump host to all app servers through their respective sudo users.
|
||||
|
||||
```bash
|
||||
ssh-keygen -t rsa -b 4096 -N '' -f ~/.ssh/id_rsa
|
||||
|
||||
# --- creds ---
|
||||
cat > creds.txt <<'EOF'
|
||||
stapp01 tony Ir0nM@n
|
||||
stapp02 steve Am3ric@
|
||||
stapp03 banner BigGr33n
|
||||
EOF
|
||||
chmod 600 creds.txt
|
||||
|
||||
# --- copy keys ---
|
||||
cat > setup_keys.sh <<'SCRIPT'
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
CREDS="${1:-creds.txt}"
|
||||
|
||||
while read -r host user pass <&3; do
|
||||
[[ -z "$host" || "$host" == \#* ]] && continue
|
||||
echo "==> Copying key to $host"
|
||||
SSHPASS="$pass" sshpass -e ssh-copy-id \
|
||||
-o StrictHostKeyChecking=no \
|
||||
-o UserKnownHostsFile=/dev/null \
|
||||
"$user@$host"
|
||||
done 3< "$CREDS"
|
||||
SCRIPT
|
||||
chmod +x setup_keys.sh
|
||||
./setup_keys.sh
|
||||
```
|
||||
|
||||
## Task 8
|
||||
|
||||
During the weekly meeting, the Nautilus DevOps team discussed about the automation and configuration management solutions that they want to implement. While considering several options, the team has decided to go with Ansible for now due to its simple setup and minimal pre-requisites. The team wanted to start testing using Ansible, so they have decided to use jump host as an Ansible controller to test different kind of tasks on rest of the servers.
|
||||
|
||||
Install ansible version 4.10.0 on Jump host using pip3 only. Make sure Ansible binary is available globally on this system, i.e all users on this system are able to run Ansible commands.
|
||||
|
||||
```bash
|
||||
sudo pip3 install ansible==4.10.0
|
||||
|
||||
# verify
|
||||
ansible --version
|
||||
which ansible # want /usr/local/bin/ansible
|
||||
```
|
||||
|
||||
## Task 9
|
||||
|
||||
There is a critical issue going on with the Nautilus application in Stratos DC. The production support team identified that the application is unable to connect to the database. After digging into the issue, the team found that mariadb service is down on the database server.
|
||||
|
||||
```bash
|
||||
systemctl enable mariadb
|
||||
|
||||
sudo chown mysql:mysql /run/mariadb
|
||||
sudo chmod 755 /run/mariadb
|
||||
sudo systemctl start mariadb
|
||||
sudo systemctl status mariadb --no-pager
|
||||
|
||||
systemctl start mariadb
|
||||
```
|
||||
|
||||
## Task 10
|
||||
|
||||
The production support team of xFusionCorp Industries is working on developing some bash scripts to automate different day to day tasks. One is to create a bash script for archiving website content files. They have a static website running on App Server 1 in Stratos Datacenter, and they need to create a bash script named beta_archive.sh which should accomplish the following tasks. (Also remember to place the script under the /scripts directory on App Server 1).
|
||||
|
||||
|
||||
|
||||
a. Create a zip archive named xfusioncorp_beta.zip of /var/www/html/beta directory.
|
||||
|
||||
|
||||
b. Save the archive in the /archives/ directory on the App Server 1. This is a temporary storage, as archives from this location will be cleaned on a weekly basis. Therefore, the archive should also be copied to the Nautilus Storage Server so it can be retrieved later for validation purposes.
|
||||
|
||||
|
||||
c. Copy the created archive to the Nautilus Storage Server server in the /archives/ location.
|
||||
|
||||
|
||||
d. Please make sure script won't ask for password while copying the archive file. Additionally, the respective server user (for example, tony in case of App Server 1) must be able to run it.
|
||||
|
||||
|
||||
e. Do not use sudo inside the script.
|
||||
|
||||
Note:
|
||||
The zip package must be installed on given App Server before executing the script. This package is essential for creating the zip archive of the website files. Install it manually outside the script.
|
||||
|
||||
```bash
|
||||
# install zip (task explicitly says do this manually)
|
||||
sudo yum install -y zip
|
||||
|
||||
# make dirs, owned by tony so script needs no sudo
|
||||
sudo mkdir -p /scripts /archives
|
||||
sudo chown tony:tony /scripts /archives
|
||||
|
||||
# --- on stapp01, as tony ---
|
||||
|
||||
# generate tony's key if he doesn't have one
|
||||
[ -f ~/.ssh/id_rsa ] || ssh-keygen -t rsa -b 4096 -N '' -f ~/.ssh/id_rsa
|
||||
|
||||
# creds for the storage server (the only target for this task)
|
||||
cat > /tmp/creds.txt <<'EOF'
|
||||
ststor01 natasha Bl@kW
|
||||
EOF
|
||||
chmod 600 /tmp/creds.txt
|
||||
|
||||
# distribute tony's pubkey to storage server
|
||||
cat > /tmp/setup_keys.sh <<'SCRIPT'
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
CREDS="${1:-/tmp/creds.txt}"
|
||||
while read -r host user pass <&3; do
|
||||
[[ -z "$host" || "$host" == \#* ]] && continue
|
||||
echo "==> Copying tony's key to $host"
|
||||
SSHPASS="$pass" sshpass -e ssh-copy-id \
|
||||
-o StrictHostKeyChecking=no \
|
||||
-o UserKnownHostsFile=/dev/null \
|
||||
"$user@$host"
|
||||
done 3< "$CREDS"
|
||||
SCRIPT
|
||||
chmod +x /tmp/setup_keys.sh
|
||||
/tmp/setup_keys.sh
|
||||
|
||||
# verify passwordless works
|
||||
ssh -o BatchMode=yes -o StrictHostKeyChecking=no natasha@ststor01 hostname
|
||||
|
||||
# archive copying script
|
||||
cat > /scripts/beta_archive.sh <<'EOF'
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
SRC="/var/www/html/beta"
|
||||
ARCHIVE_NAME="xfusioncorp_beta.zip"
|
||||
LOCAL_DIR="/archives"
|
||||
REMOTE_USER="natasha"
|
||||
REMOTE_HOST="ststor01"
|
||||
REMOTE_DIR="/archives"
|
||||
|
||||
# a + b: create zip in local /archives
|
||||
zip -r "${LOCAL_DIR}/${ARCHIVE_NAME}" "$SRC"
|
||||
|
||||
# c: copy to storage server (passwordless via key)
|
||||
scp "${LOCAL_DIR}/${ARCHIVE_NAME}" "${REMOTE_USER}@${REMOTE_HOST}:${REMOTE_DIR}/"
|
||||
|
||||
echo "Archive created and copied: ${ARCHIVE_NAME}"
|
||||
EOF
|
||||
chmod +x /scripts/beta_archive.sh
|
||||
```
|
||||
Reference in New Issue
Block a user