Membangun server intranet dengan linux

MEMBANGUN INTRANET DENGAN LINUX Ubuntu
Copyright © Mochammad Taufiq
m_taufiq_2005@yahoo.com












auto eth0
iface eth0 inet static
address 200.100.11.2
netmask 255.255.255.192
network 200.100.11.0
broadcast 200. 100. 11.63
gateway 200.100.11.1

auto eth1
iface eth1 inet static
address 192.168.0.1
netmask 255.255.255.0
network 192.168.0.0
broadcast 192.168.0.255




Chain POSTROUTING (policy ACCEPT)

target prot opt source destination

MASQUERADE all -- 192.168.0.0/24 anywhere


subnet 192.168.0.0 netmask 255.255.255.0 {
range 192.168.0.2 192.168.0.10;
option domain-name-servers ns.skull.net;
option domain-name "skull.net";
option routers 192.168.0.1;
option broadcast-address 192.168.0.255;
default-lease-time 600;
max-lease-time 7200;
}

subnet 192.168.0.0 netmask 255.255.255.0

range 192.168.0.2 192.168.0.10;

option domain-name-servers ns.skull.net;

option domain-name "skull.net";

option routers 192.168.0.1;


option broadcast-address 192.168.0.255;

default-lease-time 600; dan max-lease-time 7200;

INTERFACES=""

host ws-03 {
hardware ethernet 08:00:07:26:c0:a5;
fixed-address 192.168.0.4;
}







Reading package lists... Done
Building dependency tree... Done
Suggested packages:
bind9-doc
The following NEW packages will be installed:
bind9
0 upgraded, 1 newly installed, 0 to remove and 0 not
upgraded.
Need to get 0B/289kB of archives.
……




zone “skull.net” {
type master;
file “/etc/bind/db.skull.zone”;
};

zone “0.168.192.in-addr.arpa” {
type master;
file “/etc/bind/db.skull.rev”;
};



$TTL 86400
$ORIGIN skull.net.
@ IN SOA ns.skull.net. admin.skull.net. (
2007020109 ;serial
1H ;refresh
15M ;retry
1W ;expire
1D ) ;minimum
IN NS ns.skull.net.
IN MX 10 mail.skull.net.
ns IN A 192.168.0.1


server IN CNAME ns
www IN CNAME ns
mail IN CNAME ns
ftp IN CNAME ns
proxy IN CNAME ns
secure IN CNAME ns

ws-01 IN A 192.168.0.2
ws-02 IN A 192.168.0.3
ws-03 IN A 192.168.0.4



@ IN SOA ns.skull.net. admin.skull.net. (
2007020109 ;serial
1H ;refresh
15M ;retry
1W ;expire
1D ) ;minimum
IN NS ns.skull.net.

1 IN PTR ns.skull.net.
2 IN PTR ws-01.skull.net.



IN NS ns.skull.net.


ns IN A 192.168.0.1
ws-01 IN A 192.168.0.2
ws-02 IN A 192.168.0.3
ws-03 IN A 192.168.0.4



server IN CNAME ns
www IN CNAME ns
mail IN CNAME ns
ftp IN CNAME ns
proxy IN CNAME ns




1 IN PTR ns.skull.net



IN MX 10 mail.skull.net.

zone “slave.skull.net” IN (
type slave;
file “/etc/bind/slave.skull.zone”;
master {
192.168.0.1;
};
) ;


5450 ? Ssl 0:00 /usr/sbin/named -u bind
5484 pts/3 R+ 0:00 grep bind

> set type=any
> skull.net
Server: 192.168.0.1
Address: 192.168.0.1#53

skull.net
origin = ns.skull.net
mail addr = admin.skull.net
serial = 2007031109
refresh = 3600
retry = 900
expire = 604800
minimum = 86400
skull.net nameserver = ns.skull.net.

Server: 192.168.0.1
Address: 192.168.0.1#53

Name: ns.skull.net
Address: 192.168.0.1

Server: 192.168.0.1
Address: 192.168.0.1#53

1.0.168.192.in-addr.arpa name = ns.skull.net.


Enter password: passwordbaru

;extension=mysql.so

extension=mysql.so


NameVirtualHost 192.168.0.1:80
<VirtualHost 192.168.0.1:80>
ServerAdmin webmaster@skull.net
ServerName www.skull.net
DocumentRoot /var/www/skullnet

ScriptAlias /cgi-bin/ /var/www/cgi-bin/
<Directory "/var/www/cgi-bin">
AllowOverride None
Options +ExecCGI -MultiViews
+SymLinksIfOwnerMatch
Order allow,deny
Allow from all
</Directory>

ErrorLog /var/log/apache2/error.log

# Possible values include: debug, info, notice, warn,
error, crit,
# alert, emerg.
LogLevel warn

CustomLog /var/log/apache2/access.log combined
ServerSignature On
</VirtualHost>


<?
phpinfo();
?>


creating selfsigned certificate
replace it with one signed by a certification authority (CA)

enter your ServerName at the Common Name prompt

If you want your certificate to expire after x days call this
programm
with -days x
Generating a 1024 bit RSA private key
..................................++++++
..........................++++++
writing new private key to '/etc/apache2/ssl/apache.pem'
-----
You are about to be asked to enter information that will be
incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished
Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:ID
State or Province Name (full name) [Some-State]:Jawa Barat
Locality Name (eg, city) []:Padalarang
Organization Name (eg, company; recommended) []:SKULL
Organizational Unit Name (eg, section) []:
server name (eg. ssl.domain.tld; required!!!)
[]:secure.skull.net
Email Address []:pick@skull.net

NameVirtualHost 192.168.0.1:443
<VirtualHost 192.168.0.1:443>
SSLEngine ON
SSLOptions +FakeBasicAuth +ExportCertData
+CompatEnvVars +StrictRequire
SSLCertificateFile /etc/apache2/ssl/apache.pem
ServerName secure.skull.net
ServerAdmin webmaster@skull.net
DocumentRoot /var/www/skullnet
</VirtualHost>


Listen 443
.


tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN -

Connected to ftp.skull.net.
220 (vsFTPd 2.0.4)
Name (ftp.skull.net:pick): pick
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwx------ 3 1000 1000 4096 Sep 27 13:25 mail
drwxr-xr-x 2 1000 1000 4096 Sep 27 13:09 public_html
drwx------ 4 1000 1000 4096 Sep 27 13:16 xxx
226 Directory send OK.
ftp>


PORT Keterangan
25 SMTP
110 POP3
143 IMAP

















protocols = imap pop3

pop3_uidl_format = %08Xv%08Xu

#disable_plaintext_auth = yes

disable_plaintext_auth = no

default_mail_env = mbox:~/mail/:INBOX=/var/mail/%u


# http_port 3128

http_port 3128


# cache_mem 8 MB

cache_mem 16 MB

#cache_mgr webmaster

cache_mgr webmaster@skull.net

# cache_dir ufs /var/spool/squid 100 16 256

cache_dir ufs /cache 2000 16 256

#Recommended minimum configuration:
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8


acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

acl lan src 192.168.0.0/255.255.255.0

http_access allow localhost

# And finally deny all other access to this proxy

http_access deny all

http_access allow lan

http_access allow localhost
http_access allow lan
# And finally deny all other access to this proxy
http_access deny all

visible_hostname proxy.skull.net

2007/08/03 01:43:39| Creating Swap Directories


httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on


acl domain-terlarang dstdomain “/etc/squid/domain-terlarang”
http_access deny domain-terlarang

acl kata-terlarang url_regex -i “/etc/squid/kata-terlarang”
http_access deny kata-terlarang


acl ip-terlarang dst "/etc/squid/ip-terlarang"
http_access deny ip-terlarang

209.247.228.203
209.247.228.201
206.251.29.35









# Batas kecepatan koneksi overall adalah 256 Kbps.
# per-network adalah 64 kbps.
# Sedangkan per-user/host dibatasi 2 Kbps jika digunakan untuk
# download file bertipe exe, mp3, vqf, tar.gz, gz, rpm, zip,
# rar, avi,
# mpeg, mpe, mpg, qt, ram, rm, iso, raw, dan wav.
# Jika tidak, maka
# koneksi perhost HANYA mengikuti aturan per-Network saja.

acl filegede url_regex -i .exe
acl filegede url_regex -i .mp3
acl filegede url_regex -i .vqf


acl filegede url_regex -i .gz
acl filegede url_regex -i .rpm
acl filegede url_regex -i .zip
acl filegede url_regex -i .rar
acl filegede url_regex -i .avi
acl filegede url_regex -i .mpeg
acl filegede url_regex -i .mpe
acl filegede url_regex -i .mpg
acl filegede url_regex -i .qt
acl filegede url_regex -i .ram
acl filegede url_regex -i .rm
acl filegede url_regex -i .iso
acl filegede url_regex -i .raw
acl filegede url_regex -i .wav

# Kita buat dulu ACL untuk mendefinisikan file-file di atas
# dengan menggunakan regularexpression.
# Kemudian kita mendefinisikan 2 delay pool untuk
# menampung bandwidth.
# Satu pool masuk dalam kategori class 2 untuk
# mendefinisikan aturan overall
# 256 Kbps dan per-network 64 Kbps.
# Satu pool lainnya masuk kategori class 3
# untuk mendefinisikan aturan tambahan jika
# user mendownload file-file
# yang didefinisikan dalam ACL url_regex dengan
# bandwidth maksimal 2 Kbps.
delay_pools 2
delay_class 1 3
delay_parameters 1 32000/32000 8000/8000 250/250
delay_access 1 allow lan filegede
delay_access 1 deny all
delay_class 2 2
delay_parameters 2 32000/32000 8000/8000
delay_access 2 allow lan
delay_access 2 deny all


auth_param basic realm Squid proxy server
auth_param basic program /usr/lib/squid/ncsa_auth
/etc/squid/passwd
auth_param basic credentialsttl 1 hour
auth_param basic children 5

acl login proxy_auth REQUIRED
http_access allow login


[global]
workgroup = SKULL
server string = Skull File Server
passdb backend = tdbsam
passwd program = /usr/bin/passwd %u
passwd chat = *EntersnewsUNIXspassword:* %nn
*RetypesnewsUNIXspassword:* %nn .


passwd chat debug = Yes
username map = /etc/samba/smbusers
unix password sync = Yes
log level = 2
log file = /var/log/samba/%U%m.log
max log size = 9216
name resolve order = wins bcast hosts
printcap name = CUPS
add user script = /usr/sbin/useradd -m %u
delete user script = /usr/sbin/userdel -r %u
add group script = /usr/sbin/groupadd %g
delete group script = /usr/sbin/groupdel %g
add user to group script = /usr/sbin/usermod -G %g %u
add machine script = /usr/sbin/useradd -s /bin/false/
-d /var/lib/nobody %u
logon script = scripts/logon.bat
logon path = %Nprofiles%U
logon drive = L:
domain logons = Yes
preferred master = Yes
wins support = Yes
idmap uid = 15000-20000
idmap gid = 15000-20000
printing = cups
print command =
lpq command = %p
lprm command =

[Homes]
comment = Personal Data
valid users = %S
read only = No
browseable = No

[netlogon]
comment = Network Logon Service
path = /home/samba/netlogon
valid users = %U
admin users = Administrator
browseable = No

[profiles]
comment = User profiles
path = /home/samba/profiles
valid users = %U
read only = No
create mask = 0600
directory mask = 0700
browseable = No
csc policy = disable


[Temporary]
comment = Temporary Data [All Area]
path = /home/shares/allusers
valid users = @users
force group = users
read only = No
create mask = 0660

[Software]
comment = Program Coy
path = /home/shares/program
create mask = 0660

[Administrasi]
comment = Administration Form [All Area]
path = /home/shares/data/administrasi
invalid users = bin, daemon, nobody, named, sys, tty,
disk, mem, kmem, users
valid users = Administrator, ws-01, ws-02, ws-03
read only = No

[Report]
comment = Report Form [All Area]
path = /home/shares/data/report
invalid users = bin, daemon, nobody, named, sys, tty,
disk, mem, kmem, users
valid users = Administrator, ws-01, ws-02, ws-03
read only = No


hosts: files dns

hosts: files wins dns

New SMB password:adminsamba
Retype new SMB password:adminsamba


net use M: serverSoftware
net use N: serverAdministrasi
net use O: serverReport
net use P: serverTemporary

New SMB password: ws-01winadmin

Retype new SMB password: ws-01winadmin

Added user ws-01.

Membangun server intranet dengan linux

More Related Content

What's hot (16)

Similar to Membangun server intranet dengan linux (20)

Membangun server intranet dengan linux