1

# sed -i 's/false/true/' /etc/default/rsync
# cat /etc/rsyncd.conf
[opt]
        comment = repertoire opt
        path = /opt
        use chroot = yes
        lock file = /var/lock/rsyncd
        read only = yes
        list = yes
        uid = root
        gid = root
        strict modes = yes
        hosts allow = <IP DU VOISIN>
        ignore errors = no
        ignore nonreadable = no
        transfer logging = no
        log format = %t: host %h (%a) %o %f (%l bytes). Total %b bytes.
        timeout = 600
        refuse options = checksum dry-run
        dont compress = *.gz *.tgz *.zip *.z *.rpm *.deb *.iso *.bz2 *.tbz

/usr/bin/rsync -a /opt/mestrucs/* serverRsync::opt/

Screen

L’escape Key : C-a
soit Control+a

Créer un screen :

1

screen -S "un nom"

Créer un screen, a partir d’un .screenrc :

1

screen -c .screenrc -S "un nom"

Lister les sessions :

1

screen -ls

S’attacher à une session :

1

screen -x "nom de session"

Quitter un screen :

1

C-a d

Créer une nouvelle fenêtre :

1

C-a c

Renommer une fenêtre :

1

C-a a "nom"

Lister les fenêtres :

1

C-a "

Fenêtre suivante :

1

C-a n

Fenêtre précédente :

1

C-a p

Killer une fenêtre :

1

C-a k

Resizer la fenêtre :

1

C-a F

=============

= AWS =

courses:
https://evantage.gilmoreglobal.com/?#/ (mypass)
Labs:
https://aws.qwiklab.com/live

https://aws.amazon.com/solutions/case-studies/

Regardez ce nouveau blog: https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-systems-manager.html. Ce nouveau “system manager” rend les choses encore plus faciles.

Il existe une variété de laboratoires autonomes ( self-paced labs (http://aws.amazon.com/training/self-paced-labs/)), qui acquièrent une expérience pratique sur de nombreux services AWS. Qu'il s'agisse d'un nouveau service ou d'un sujet dont vous avez entendu parler et que vous souhaitez mieux comprendre ou préparer un examen ou une discussion.
N'oubliez pas qu'AWS Free Tier vous permet de commencer à utiliser gratuitement AWS. 

Vous pouvez également créer des alarmes de facturation pour contrôler la facturation sur votre utilisation de carte bleu.

Les pages Whitepapers(https://aws.amazon.com/whitepapers/) et Cloud Security(https://aws.amazon.com/security/) contiennent des informations détaillées sur la sécurité et d’autres sujets relatifs au cloud. Voici le lien vers AWS Well-Architected Framework(https://aws.amazon.com/architecture/well-architected/) et AWS Cloud Adoption Framework(https://aws.amazon.com/professional-services/CAF/) - deux très bonnes lectures!

Plus de formation, de laboratoires ou de certification ?

Acloud.guru
https://qwiklabs.com/
https://www.whizlabs.com
Learn to Build(https://aws.amazon.com/getting-started/use-cases/)

Besoin de plus d’informations sur les outils:

Simple Calculator(http://aws.amazon.com/calculator): Cette calculatrice vous aide à établir vos dépenses mensuelles.
Whitepapers(http://aws.amazon.com/whitepapers): Know more in-depth comparisons and guidelines from AWS Whitepapers
TCO Calculator(http://aws.amazon.com/tco-calculator/): Une calculatrice d’aperçu du coût total “On-prem” par rapport aux coût dans le cloud d’AWS
IAM policy simulator(https://policysim.aws.amazon.com/home/index.jsp): Vérifiez vos politiques avant d’intégrer votre code et votre IAM
DynamoDB plus d’info(https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/best-practices.html)


Voici des liens supplémentaires: AWS YouTube channel(https://www.youtube.com/user/amazonwebservices)  , AWS Official Blog(http://aws.amazon.com/blogs/aws/), AWS SlideShare.net(http://www.slideshare.net/AmazonWebServices), et AWS Architecture Centre(http://aws.amazon.com/architecture/). 

Regions + HAzone
and edge locations (dns deployement tools etc..)

T2 Credit accumulation
spare when not used so you can sometimes go over the limit

Spot Instances good offer ?

gather info on EC2
curl http://169.254.169.254/latest/meta-data
curl http://169.254.169.254/latest/user-data

== Stockage
Instance Store : Ephemeral, SSD

EBS : snapshot, persistance
SSD
SSD (provisioned iops)
Throughput Optimized 40Mb/s

S3 : can create endpoint on vpc subnet(where you manage policy)
configure notification (add, mod, delete)
possibility ti activate versionning
4 classes standard, standard infrequente access, glacier, (old : reduced redundancy)

glacier : use sdk to write ! or lifecycle rules

EFS : Share FS

== Network
DC to aws => AWS Direct Connect (bgp style ?)

Auto Assign pub IP != Elastic IP (fix)

IGW Internet GW
VGW Vpn GW
NGW Nat GW : EIP priv -> pub

VPC

VPC Peering : between vpcs (often use for peering an admin vpc) same region, not encrypt, no chaining route between vpc-A to vpc-C through vpc-B

Elastic LoadBalancer : RR, sticky or not, cross AZ (zone) or not (defaut not), TCP HTTP, autoscalable, can be internal lb

Route53 : dns w request w criteria : weight, healthcheck, latency, geo

== Security

Security groups : by instances , statefull, whitelist, Deny allways prior
NACL Network acl : by subnets, order list , blacklist, stateless

== Monitor

cloudwatch
gather metrics
can set alarm threshold
create filter

cloudtrail
log specific actions : tracing , also api
can chosse : Region or global

aws config
inventory with trigger alarm
config run every 15min and notice all change

redshift
big data stocakge en colonne

== Automation

AWS CloudFormation
Manage template
then -> stack

create AMI from instance (like snapshot)

tips : send message (w sqs) a the end of user-data

System Manager Service : run scripts etc…
Inspector : check for secu vulnerability

AutoScaling
auto healthcheck
auto add in ELB
auto balance in zones
can autoscale by steps
auscale lifecycle hooks (send hooks for start or stop)
can perform rolling update

Can autoscale 1
creating a scale group w 1 instance : will restart if healthcheck fail

aws-cfn-bootstrap : between ansible and cloudinit

Coudformer
create cloudFormation templates
parameter : ask human for value
mappings : dictio

== CLI
aws configuration

== LEXIC
EC2 = Elastic Compute Cloud
IAM = Identity Access Management
EBS = Elastic Block Store (Optimzed is dedicated)
S3 = Simple Storage Service
EIP = Elastic IP
AMI = Amazon Machine Image
ENI = Elastic Network Interfaces
SQS = Simple Queue Service
SNS = Simple Notification Service
ELB = Elastic Load Balancer

complete -C ‘/usr/local/bin/aws_completer’ aws

JMESPATH
query cli json
http://jmespath.org/

CostExplorer in billing section
Trusted adviser : some check for cost/secu

https://github.com/Netflix/aminator

AWS

Compute

EC2
ECS
Lambda (autoscale /!\ set max)

Storage

EBS - block
S3 - object
Glacier - slow
Snowball - transfert data (via box and ups)
Cloudfront - CDN
storage gateway - vm to install on-premise who transfert to aws S3 (eg : backup)

Database

RDS - sql mysql psql oracle
Dynamo - nosql
DMS - Database Migration Service
Redshift - big data

Networking

VPC
Direct Connect - private link
Route 53 - DNS + LB

Management

cloudwatch - monit
formation - deploy/template
trusted advisor - advise

secu

A authentication
A authorization
A accouting

AIM
WAF
cloudtrail - log activity on managment

Analytics

EMR - hadoop
kinesis - streaming

Application service

Api gateway - expose HTTP Lambda, dynamoDB, kinesis …
SQS - Simple Queue Service (1 to 1) max 256K (dead letter queue)
message delivery MINIMUM once !!

Entrprise applications

workspaces - desktop

AI

Machine learning

IOT

iot - connect devices to cloud

Developer tools

Code pipeline - release automation
Code commit - control service, version
Code Build - build and test
Code deploy - deploy orchestration
X-ray - issued detector and optimization
Codestar - set and configure the developer tools
Cloud9 - web environment IDE

Security

shield (standart) - DDOS protection
shield advanced + waf

EC2 Type

M C T2 etc …

factu
Reserved Instances :
Standard = fixed
Convertible = modif instances type
Scheduled = not 100%
Intel techno
default 20/region

S3

Type factu
factu par object
S3 gratuit en interne (az) (check if cloudfront more interesting)
Hook à l’upload/download
retention, deplacement (vers glacier) , modif facturation
versionning
S3 upload gratos
diff type
IA
RRS (old)
apprendre les 99,99..% for s3

encryption SSE-S3, SSE-KMS, SSE-C
SSE = server side
CSE = Client side
gerer le multi-part upload (chunk your file) ~ 100Mo
service regional
unique woldwide name
IA (minimum 30days)
can log all access

EBS

taille max
IO

EFS

Share storage (NFS 4.0/4.1)
Linux only

Glacier

Types access :
expedited
standard
bulk
Vaults - archive (gros tar)

lifecycle policy

= retention

RDS

scalable (but not autoscalable)
Can use read replicas (but latency) - No available for oracle and M$sql
No root access(no mega tuning)

Dynamo DB

autoscale
no size limit
no throughtput limit
Lecture :
consistent
non consistent
Dynamo max name key/values combined => 400KB
Read 4KB/s
Write 1KB/s

IAM

Deny default
Delegate - tempo access to a role

billing report

important

cloudtrail & aws(cloud) config

aws organizations

ou (organisation unit) (ldap style)

endpoint

endpoint in vpc for non-vpc-linked service

vpc peering

non transitif
no nat - think about lan ip range

Nat gw

nat priv => pub
en retour d’un LB

NACL

bound to range not instance

IGW

0.0.0.0/0 route

nat gw

VPC flow logs

Capture traffic
-> cloudwatch (or S3)

CGW + # VGW (multiple vpn connexion and direct connect)

customer gw. connect customer lan to vpc
= vpn
2 tunnels (ha)

ElasticIP

switch to ec2

ELB

PUB or Private
http, tcp, websocket
TLS termination

ApplicationLB = HTTP(s) (manage web route)
NetworkLB = TCP

Drain = ability to graceful stop backend

Cloudwatch

logs -> cloudwatch
cloudwathc alarms -> evenement -> trigger
possibilité de fournir les logs cloudwatch à un outils de monitor tier
every 5min or every minutes
default metrics : cpu, disk read, network in

autoscaling

/!\ warmup (and cooldown)

cloud formation

deploiement not orchestration
mapping - dictionnaire | + parameters + conditions = un minimum d’intelligence et de “variablilité”

can use lambda to add functions
cloudformation groups - separate cloudformation script (ex : aim, vpc, appli, etc..)

Elastic Beanstalk

deploy and scaling service for web appli
ready for production (or preproduction)

OpsWorks

use puppet or chef

System Manager

replace puppet or chef
aws or on premise

can Run Command

SNS

simple notification
(1 to multiple)
mail (plain / json)
SMS
HTTP(S)
SQS
Mobile push messaging
lambda
256K max

MQ

ActiveMQ fully managed

API Gateway

…

flow logs

logs tcp connexions
set on : vpc, subnet, EIP

• dev tools

codestar

code commit

codebuild

codedeploy

codepipeline

x-ray

ex : “aws config” alarms if resources with no tag

guard duty

inelligent threat detection
analyse : cloud trail , vpc flow, dns query logs

inspector

scan (from inside) : anti virus, best practice deviation, remote root login, vulnerable appli installed …

KMS

key master
encrypt keys with a master key, that i don’t own
Symmetric only

Macie

AI analyse data -> suggest data classification

cloud HSM

Hardware Security Module
hard dedicated storage for your key
(kind of dedicated kms)
can create asymetric encryption

Directory Service

M$ ad
ad connector : connect to on premise ad

STS

security token service
for temporary access to resources

SAML

sso using saml with amazon

Cognito

Web Identify Federation
use a tier account to auth (ex, amazon, google, fb, etc..)

Recovery

in another region :

backup/restore
pilot light = cold drp
low capacity stand by = drp low capacity (possiblity to lb 80%/20%)
active-active

Anonimisation d’une vm à transformer en template

1
2

# tail /etc/crontab
@reboot root /root/sshkey_generate.sh ; /bin/sed -i '/sshkey_generate.sh/d' /etc/crontab &> /dev/null

1
2
3
4
5
6
7

# cat /root/sshkey_generate.sh 

#!/bin/bash
/usr/sbin/dpkg-reconfigure openssh-server
/bin/rm /root/sshkey_generate.sh

# chmod +x /root/sshkey_generate.sh

1
2
3
4
5
6
7
8
9

# /etc/init.d/rsyslogd stop

# find /var/log/ -type f -delete

# rm –rf /tmp/*
# rm –rf /var/tmp/*
# rm –f /etc/ssh/*key*
# rm -f ~root/.bash_history
# unset HISTFILE

1
2
3

# for i in `cat /etc/hostname` ; do sed -i s/$i/vmtemplate/g /etc/hosts ; done
# echo "vmtemplate" > /etc/hostname
# echo "vmtemplate" > /etc/mailname

== DRAFT ==

Installation

1
2
3
4
5
6
7
8
9
10

# echo "deb http://apt.postgresql.org/pub/repos/apt/ $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list
# apt-get install wget ca-certificates
# wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add -
# apt-get update
# apt-get install postgresql
# echo "export PATH=$PATH:/usr/lib/postgresql/9.5/bin" >> /etc/profile
# apt-get install rsync
# apt-get install repmgr
# su - postgres
# ssh-keygen

Configuration

On echange les clefs des users postgres entre les differents serveurs

• Set des autorisations postgres

1
2
3
4

# tail -3 /etc/postgresql/9.5/main/pg_hba.conf 
local   repmgr        repmgr                              trust
host    repmgr        repmgr      127.0.0.1/32            trust
host    repmgr        repmgr      10.0.69.0/24            trust

• Conf Postgres

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

# diff /etc/postgresql/9.5/main/postgresql.conf /tmp/postgresql.conf.ori 
59c59
< listen_addresses = '*'                # what IP address(es) to listen on;
---
> #listen_addresses = 'localhost'               # what IP address(es) to listen on;
143c143
< shared_preload_libraries = 'repmgr_funcs'             # (change requires restart)
---
> #shared_preload_libraries = ''                # (change requires restart)
171c171
< wal_level = hot_standby               # minimal, archive, hot_standby, or logical
---
> #wal_level = minimal                  # minimal, archive, hot_standby, or logical
204c204
< archive_mode = on             # enables archiving; off, on, or always
---
> #archive_mode = off           # enables archiving; off, on, or always
206c206
< archive_command = '/bin/true'         # command to use to archive a logfile segment
---
> #archive_command = ''         # command to use to archive a logfile segment
222c222
< max_wal_senders = 10          # max number of walsender processes
---
> #max_wal_senders = 0          # max number of walsender processes
224c224
< wal_keep_segments = 5000              # in logfile segments, 16MB each; 0 disables
---
> #wal_keep_segments = 0                # in logfile segments, 16MB each; 0 disables
245c245
< hot_standby = on                      # "on" allows queries during recovery
---
> #hot_standby = off                    # "on" allows queries during recovery

• Conf Repmgr

toute les commande repmgr sont a lancer en postgres

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

# cat /etc/repmgr.conf 
cluster=jaytest
node=2
node_name=node2
conninfo='host=10.0.69.110 user=repmgr dbname=repmgr'
pg_basebackup_options='--xlog-method=fetch'
pg_bindir=/usr/lib/postgresql/9.5/bin/
#upstream_node=1
#priority=100

monitor_interval_secs=2
master_response_timeout=60
#reconnect_attempts=6
#reconnect_interval=10

failover=automatic
promote_command='repmgr standby promote -f /etc/repmgr.conf'
follow_command='repmgr standby follow -f /etc/repmgr.conf'

logfile='/var/log/postgresql/repmgrd.log'

1
2

$ createuser -s repmgr
$ createdb repmgr -O repmgr

Replication

• Initialise the master server

1

repmgr -f /etc/repmgr.conf primary register

On check

1
2

=# \c repmgr
=# SELECT * FROM repmgr_jaytest.repl_nodes;

• Clone the standby server (stop postgresql ; purge /var/lib/postgresql/9.5/main/ first)

1
2
3
4

repmgr -h node1 -U repmgr -d repmgr -D /var/lib/postgresql/9.5/main/ -f /etc/repmgr.conf standby clone

# rsync node1:/etc/postgresql/9.5/main/pg_hba.conf /etc/postgresql/9.5/main/
# rsync node1:/etc/postgresql/9.5/main/postgresql.conf  /etc/postgresql/9.5/main/

On check (depuis le master)

1

=# SELECT * FROM pg_stat_replication;

• Register the standby

1

repmgr -f /etc/repmgr.conf standby register

On check

1
2

=# \c repmgr
=# SELECT * FROM repmgr_jaytest.repl_nodes ORDER BY id;

Recovery

node1 est dead

1
2
3
4
5
6

$ repmgr cluster show
Role      | Name  | Upstream | Connection String
----------+-------|----------|-------------------------------------------
  standby | node3 | node2    | host=10.0.69.110 user=repmgr dbname=repmgr
  FAILED  | node1 |          | host=10.0.69.108 user=repmgr dbname=repmgr
* master  | node2 |          | host=10.0.69.109 user=repmgr dbname=repmgr

on stop ses services

1

# /etc/init.d/postgresql stop

on resync & register

1
2
3

# repmgr -h node3 -U repmgr -d repmgr -D /var/lib/postgresql/9.5/main/ -f /etc/repmgr.conf standby clone

# repmgr -f /etc/repmgr.conf standby register -F

node1 is back

1
2
3
4
5
6

$ repmgr cluster show
Role      | Name  | Upstream | Connection String
----------+-------|----------|-------------------------------------------
  standby | node3 | node2    | host=10.0.69.110 user=repmgr dbname=repmgr
* master  | node2 |          | host=10.0.69.109 user=repmgr dbname=repmgr
  standby | node1 | node2    | host=10.0.69.108 user=repmgr dbname=repmgr

Lancement de repmgrd

• pour quand le script d’init marchera :

  1 2 3 4

  # sed -i 's/REPMGRD_ENABLED=no/REPMGRD_ENABLED=yes/' /etc/default/repmgrd # sed -i 's/\#REPMGRD_CONF\=\"\/path\/to\/repmgr.conf\"/REPMGRD_CONF\=\"\/etc\/repmgr.conf\"/' /etc/default/repmgrd # sed -i 's/\#REPMGRD_OPTS=\"\"/REPMGRD_OPTS="-m -d"/' /etc/default/repmgrd # sed -i 's/\#REPMGR_PIDFILE\=\/var\/run\/repmgrd.pid/REPMGR_PIDFILE\=\/var\/run\/postgresql\/repmgrd.pid/' /etc/default/repmgrd

• mon script d’init de remplacement :

  1

  # cat /etc/init.d/repmgrd.init #!/bin/bash ### BEGIN INIT INFO # Provides: repmgrd # Required-Start: $remote_fs $all # Should-Start: # Required-Stop: # Default-Start: 2 3 5 # Default-Stop: 0 6 # Description: Starts and stops repmgrd. ### END INIT INFO REPMGRD=/usr/bin/repmgrd REPMGR_PIDFILE=/var/run/postgresql/repmgrd.pid REPMGRD_CONF=/etc/repmgr.conf case $1 in # Startup repmgrd servers. start) su postgres -c "$REPMGRD -m -d -p $REPMGR_PIDFILE -f $REPMGRD_CONF" #renice -5 -p `cat $REPMGR_PIDFILE` echo "starting..." ;; # Stop repmgrd servers. stop) if [ -f $REPMGR_PIDFILE ] then if ps auxww | grep `cat $REPMGR_PIDFILE` | grep -v grep then kill `cat $REPMGR_PIDFILE` echo "stopping..." else echo "Repmgrd is not running, but $REPMGR_PIDFILE is present" fi else echo "Repmgrd is not running" fi ;; # status status) if ps auxww | grep `cat $REPMGR_PIDFILE` | grep -v grep then echo "Repmgrd is running" else echo "Repmgrd is stopped" fi ;; *) echo "Init de Repmgrd: stop / start ou status" ;; esac

Notif

repmgr.conf

%n - node ID
%e - event type
%s - success (1 or 0)
%t - timestamp
%d - details

event_notification_command=’/path/to/some/script %n %e %s “%t” “%d”‘

event_notifications=master_register,standby_register,witness_create
https://github.com/2ndQuadrant/repmgr/blob/master/README.md#generating-event-notifications-with-repmgrrepmgrd

Gestion de la vip avec heartbeat dans le cas d’un master/slave

Install

1

# apt-get install heartbeat

conf de la vip

1

# cat <<EOF >> /etc/network/interfaces
#auto ens160:pg # nonauto
iface ens160:pg inet static
address 10.0.69.0.120
netmask 255.255.255.0
EOF
# echo "net.ipv4.ip_nonlocal_bind=1" >> /etc/sysctl.conf
# sysctl -p

• commande heartbeat utiles
  /usr/share/heartbeat/hb_standby
  /usr/share/heartbeat/hb_takeover

• conf heartbeat

  1

  # cat /etc/ha.d/ha.cf ############################### # logging logfile /var/log/ha/ha-log debugfile /var/log/ha/ha-debug ############################### # communication autojoin none udpport 694 ucast ens160 10.0.69.100 bcast ens160 ############################### # thresholds warntime 5 deadtime 15 initdead 60 keepalive 2 ############################### # nodes node bdd1 node bdd2 auto_failback off

1

# cat /etc/ha.d/haresources
# VIP
bdd1 IPaddr::10.0.69.120/24/ens160:pg #MailTo::moi@pouet.fr::HA_Postgresql

• on adapte la conf /etc/repmgr.conf

  1

  # diff /etc/repmgr.conf_heartbeat /etc/repmgr.conf_ori - promote_command='repmgr standby promote -f /etc/repmgr.conf' - follow_command='repmgr standby follow -f /etc/repmgr.conf' + promote_command='sudo /usr/share/heartbeat/hb_takeover && repmgr standby promote -f /etc/repmgr.conf' + follow_command='sudo /usr/share/heartbeat/hb_standby && repmgr standby follow -f /etc/repmgr.conf'

• conf sudo
  postgres ALL=(root) NOPASSWD:/usr/share/heartbeat/hb_takeover

Mettre un mot de passe pour eviter l’edit

Generer le hash du pass

1

# grub-mkpasswd-pbkdf2

editer la conf

1

# cat /etc/grub.d/40_custom 
#!/bin/sh
exec tail -n +3 $0
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.

# define superusers
set superusers="toor"

#define users
password_pbkdf2 toor grub.pbkdf2.sha512.10000.41A4BB99DD5F334FDZFOFDVDPVA33F6FABB7AEEE9EE3F6B533D47B05712619797411812BD97413274F9F29FAD1A444D3FA5E4B0619F8425C316120BC248480F29A1BDE64619.E61C7C6A45BF4A0E89143868AC6B2874E2DC0BDCF0BC7764B5C77ECD293E8C8743E0A

authoriser a booter sans pass

1

# diff /etc/grub.d/10_linux /etc/grub.d/10_linux.ori 
130c130
<       echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' --unrestricted {" | sed "s/^/$submenu_indentation/"
---
>       echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' {" | sed "s/^/$submenu_indentation/"

<      echo "menuentry '$(echo "$os" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-simple-$boot_device_id' --unrestricted {" | sed "s/^/$submenu_indentation/"
---
>      echo "menuentry '$(echo "$os" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_indentation/"

On regenere la conf

1

# update-grub

Rescue

1

fdisk -l                      		# pour vous aider à trouver la partition sur laquelle est votre ubuntu
mount /dev/sdaX /mnt          		# montage de celle-ci en remplaçant le X par le bon numéro de partition
mount --bind /dev /mnt/dev    		# lien symbolique du dossier /dev en cours d'utilisation vers le disque monté
mount --bind /dev/pts /mnt/dev/pts   	# lien symbolique du dossier /dev/pts en cours d'utilisation vers le disque monté
mount --bind /sys /mnt/sys    		# lien symbolique du dossier /sys en cours d'utilisation vers le disque monté
mount -t proc /proc /mnt/proc 		# Pour que Grub2 trouve /proc/mounts
chroot /mnt /bin/bash         		# mise à la racine du disque monté
mount -a                           	# montage des partitions dans le chroot
apt-get install grub-pc            	# installation du logiciel Grub2 (sur le disque maintenant à la racine)
update-grub                        	# création d'un nouveau fichier de configuration : grub.cfg
grub-install /dev/sda              	# installation de grub sur le MBR

backup

1

# rdiff-backup /data /backup

list

1

# rdiff-backup -l /backup

list size

1

rdiff-backup --list-increment-sizes /backup

restore

1

#rdiff-backup -f -r "2016-09-01T15:20:55+02:00" /backup /data

retention

1

# rdiff-backup --force --remove-older-than 2016-08-04 /backup

Restart de service apres modif d’un file

1

service { "sshd" :
  ensure => "running",
  enable => "true",
  require => Package["openssh-server"],
}

file { "/etc/ssh/sshd_config" :
  notify => Service["sshd"],
  mode   => 700,
  owner  => root,
  group  => root,
  source => "puppet:///modules/openssh-server/sshd_config",
}

check de syntax

1

# find /etc/puppet/ -name "*.pp" -exec puppet parser validate {} \;

Pareil pour les templates

1

# find /etc/puppet/ -name "*.erb" -exec puppet parser validate {} \;

API rest

syntax

1

curl -X GET http://127.0.0.1:8080/v4/resources --data-urlencode  query@<query_file>

ex :

1

curl -X GET http://127.0.0.1:8080/v4/nodes
curl -X GET http://127.0.0.1:8080/v4/facts
curl -X GET http://127.0.0.1:8080/v4/facts/kernel
curl -X GET http://127.0.0.1:8080/v4/nodes --data-urlencode 'query=["not",["=","report-timestamp",null]]'
curl -X GET http://127.0.0.1:8080/v4/nodes --data-urlencode 'query=["<","report-timestamp","2016-08-15T00:00:01.000Z"]'
curl -X GET http://127.0.0.1:8080/v4/facts --data-urlencode 'query=["=","name","apt_reboot_required"]'

Doc (https://docs.puppet.com/puppetdb/2.3/api/query/v4/nodes.html)

la bonne doc