Adicionar krb5.conf

interfaces

@@ -0,0 +1,20 @@
+# This file describes the network interfaces available on your system
+# and how to activate them. For more information, see interfaces(5).
+
+source /etc/network/interfaces.d/*
+
+# The loopback network interface
+auto lo
+iface lo inet loopback
+
+auto enp0s3
+iface enp0s3 inet dhcp
+
+auto enp0s8
+iface enp0s8 inet static
+	address 172.17.0.1
+	netmask 255.255.255.0
+
+auto enp0s9
+iface enp0s9 inet static
+	address 192.168.56.205/24

krb5.conf

@@ -0,0 +1,56 @@
+# =========================
+# Configuração Kerberos
+# =========================
+
+[libdefaults]
+
+    # Realm Kerberos padrão (domínio AD)
+    default_realm = FATECSEG.LOCAL
+
+    # Não tenta descobrir o realm via DNS
+    dns_lookup_realm = false
+
+    # Descobre automaticamente o KDC via registros DNS SRV
+    dns_lookup_kdc = true
+
+    # Desabilita reverse DNS para evitar problemas de resolução
+    rdns = false
+
+    # Permite encaminhamento de tickets Kerberos
+    forwardable = true
+
+
+# =========================
+# Definição do Realm AD
+# =========================
+
+[realms]
+
+    FATECSEG.LOCAL = {
+
+        # Servidor KDC (Key Distribution Center)
+        kdc = pisrc-srv1.fatecseg.local
+
+        # Servidor administrativo Kerberos
+        admin_server = pisrc-srv1.fatecseg.local
+
+        # Servidor de alteração de senha Kerberos
+        kpasswd_server = pisrc-srv1.fatecseg.local
+
+        # Domínio DNS associado ao realm
+        default_domain = fatecseg.local
+    }
+
+
+# =========================
+# Mapeamento DNS -> Realm
+# =========================
+
+[domain_realm]
+
+    # Todos os hosts do domínio fatecseg.local
+    # pertencem ao realm FATECSEG.LOCAL
+    .fatecseg.local = FATECSEG.LOCAL
+
+    # Domínio principal associado ao realm
+    fatecseg.local = FATECSEG.LOCAL

nftables.conf

@@ -0,0 +1,11 @@
+table ip nat {
+	chain POSTROUTING {
+		type nat hook postrouting priority srcnat; policy accept;
+		oifname "enp0s3" counter packets 2 bytes 136 masquerade
+	}
+
+	chain PREROUTING {
+		type nat hook prerouting priority dstnat; policy accept;
+		ip daddr 192.168.56.205 tcp dport 3389 counter packets 2 bytes 104 dnat to 172.17.0.2:3389
+	}
+}

router.sh

@@ -1,32 +1,7 @@
 #!/bin/bash
-echo "Router, ok!"
+wget https://git.tmferreira.tec.br/tiago.ferreira/PISRC/raw/branch/main/sysctl.conf -O /etc/sysctl.conf --no-check-certificate --no-cache
+#
+wget https://git.tmferreira.tec.br/tiago.ferreira/PISRC/raw/branch/main/interfaces -O /etc/network/interfaces --no-check-certificate --no-cache
+wget https://git.tmferreira.tec.br/tiago.ferreira/PISRC/raw/branch/main/nftables.conf -O /etc/nftables.conf --no-check-certificate --no-cache
 
-ip link set up dev enp0s8
+reboot
-ip link set up dev enp0s9
-ip link set up dev enp0s10
-
-wget https://git.tmferreira.tec.br/tiago.ferreira/GRC/raw/branch/main/interfaces -O /etc/network/interfaces
-
-ip address flush enp0s8
-ip address flush enp0s10
-ip address flush enp0s9
-
-ip address add 172.17.0.1/24 dev enp0s8
-ip address add 192.168.200.1/24 dev enp0s9
-ip address add 192.168.56.200/24 dev enp0s10
-
-sysctl -w net.ipv4.ip_forward=1
-
-iptables -t nat -F
-
-iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
-
-iptables -t nat -A PREROUTING -p tcp --dport 10000 -j DNAT --to-destination 192.168.200.2:22
-iptables -t nat -A PREROUTING -p tcp --dport 10001 -j DNAT --to-destination 192.168.200.3:22
-iptables -t nat -A PREROUTING -p tcp --dport 10002 -j DNAT --to-destination 172.17.0.2:22
-
-systemctl restart named
-
-apt clean
-
-poweroff

smb.conf

@@ -0,0 +1,70 @@
+# =========================
+# Configuração Global Samba
+# =========================
+[global]
+
+        # Escuta apenas nas interfaces definidas abaixo
+        bind interfaces only = Yes
+
+        # Arquivo keytab Kerberos utilizado pelo sistema
+        dedicated keytab file = /etc/krb5.keytab
+
+        # Interface de rede utilizada pelo Samba
+        interfaces = enp0s3
+
+        # Usa secrets.tdb + keytab para autenticação Kerberos
+        kerberos method = secrets and keytab
+
+        # Realm Kerberos (domínio AD)
+        realm = FATECSEG.LOCAL
+
+        # Integração com Active Directory
+        security = ADS
+
+        # Define este host como membro do domínio (não DC)
+        server role = member server
+
+        # Diretório home padrão dos usuários AD
+        template homedir = /home/%U
+
+        # Shell padrão para usuários do AD
+        template shell = /bin/bash
+
+        # Permite listar grupos do domínio
+        winbind enum groups = Yes
+
+        # Permite listar usuários do domínio
+        winbind enum users = Yes
+
+        # Permite login em cache se o DC estiver offline
+        winbind offline logon = Yes
+
+        # Renova tickets Kerberos automaticamente
+        winbind refresh tickets = Yes
+
+        # Permite usar apenas o nome do usuário sem DOMINIO\
+        winbind use default domain = Yes
+
+        # Nome NetBIOS do domínio
+        workgroup = FATECSEG
+
+        # Backend padrão de mapeamento SID -> UID/GID
+        idmap config * : backend = tdb
+
+        # Faixa UID/GID padrão para domínios desconhecidos
+        idmap config * : range = 3000-7999
+
+        # Usa RID para gerar UID/GID automaticamente
+        idmap config fatecseg : backend = rid
+
+        # Faixa UID/GID usada para usuários do domínio
+        idmap config fatecseg : range = 10000-999999
+
+        # Herança de ACL estilo Windows
+        map acl inherit = Yes
+
+        # Armazena atributos DOS/Windows no filesystem Linux
+        store dos attributes = Yes
+
+        # Habilita ACL NTFS via extended attributes
+        vfs objects = acl_xattr

sysctl.conf

@@ -0,0 +1,68 @@
+#
+# /etc/sysctl.conf - Configuration file for setting system variables
+# See /etc/sysctl.d/ for additional system variables.
+# See sysctl.conf (5) for information.
+#
+
+#kernel.domainname = example.com
+
+# Uncomment the following to stop low-level messages on console
+#kernel.printk = 3 4 1 3
+
+###################################################################
+# Functions previously found in netbase
+#
+
+# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
+# Turn on Source Address Verification in all interfaces to
+# prevent some spoofing attacks
+#net.ipv4.conf.default.rp_filter=1
+#net.ipv4.conf.all.rp_filter=1
+
+# Uncomment the next line to enable TCP/IP SYN cookies
+# See http://lwn.net/Articles/277146/
+# Note: This may impact IPv6 TCP sessions too
+#net.ipv4.tcp_syncookies=1
+
+# Uncomment the next line to enable packet forwarding for IPv4
+net.ipv4.ip_forward=1
+
+# Uncomment the next line to enable packet forwarding for IPv6
+#  Enabling this option disables Stateless Address Autoconfiguration
+#  based on Router Advertisements for this host
+#net.ipv6.conf.all.forwarding=1
+
+
+###################################################################
+# Additional settings - these settings can improve the network
+# security of the host and prevent against some network attacks
+# including spoofing attacks and man in the middle attacks through
+# redirection. Some network environments, however, require that these
+# settings are disabled so review and enable them as needed.
+#
+# Do not accept ICMP redirects (prevent MITM attacks)
+#net.ipv4.conf.all.accept_redirects = 0
+#net.ipv6.conf.all.accept_redirects = 0
+# _or_
+# Accept ICMP redirects only for gateways listed in our default
+# gateway list (enabled by default)
+# net.ipv4.conf.all.secure_redirects = 1
+#
+# Do not send ICMP redirects (we are not a router)
+#net.ipv4.conf.all.send_redirects = 0
+#
+# Do not accept IP source route packets (we are not a router)
+#net.ipv4.conf.all.accept_source_route = 0
+#net.ipv6.conf.all.accept_source_route = 0
+#
+# Log Martian Packets
+#net.ipv4.conf.all.log_martians = 1
+#
+
+###################################################################
+# Magic system request Key
+# 0=disable, 1=enable all, >1 bitmask of sysrq functions
+# See https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html
+# for what other values do
+#kernel.sysrq=438
+