Setup pour la VM du TP linux

setup.sh

# SSH
apt install openssh-server

#### configurer Virtual box pour le SSH ###
# machine > settings > network > advanced > port forwarding
# rule 1 : 3022 vers 22
# puis depuis l'hote
# ssh -p 3022 florian@127.0.0.1

# apt update & installation d'utilitaires
apt update && apt install -y \
    software-properties-common \
    python-software-properties \
    iputils-ping \
    curl \
    wget \
    vim
wget -O ~/.vimrc https://gist.githubusercontent.com/floriancourgey/6e58eb1852d540df446aca041384891e/raw/c6949ab23b79ec4c93dee1beaa37e074cfd8360b/.vimrc

#### java ####
# on accepte la license java
echo oracle-java8-installer shared/accepted-oracle-license-v1-1 select true | debconf-set-selections
# on ajoute le repo webupt8team java
add-apt-repository -y ppa:webupd8team/java
# apt install
apt update && apt install -y \
    oracle-java8-installer
# on teste
javac -version
java -version

#### elasticsearch ####
# téléchargement
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.1.1.deb
# check sum
sum=$(curl https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.1.1.deb.sha1) && echo "$sum elasticsearch-5.1.1.deb" | sha1sum -c -
# installation dpkg
dpkg -i elasticsearch-5.1.1.deb
# ajout d'elasticsearch au script de boot
update-rc.d elasticsearch defaults 95 10
# restart
service elasticsearch restart
# on vérifie que elasticsearch fonctionne :
curl localhost:9200

##### kibana ####
# téléchagement du deb
wget https://artifacts.elastic.co/downloads/kibana/kibana-5.1.1-amd64.deb
# check sha1sum
sum=$(curl https://artifacts.elastic.co/downloads/kibana/kibana-5.1.1-amd64.deb.sha1) && echo "$sum kibana-5.1.1-amd64.deb" | sha1sum -c -
# installation dpkg
dpkg -i kibana-5.1.1-amd64.deb
# ajout de kibana au boot
update-rc.d kibana defaults 96 9
# restart
service kibana restart
# on vérifie
curl localhost:5601

#### nginx ####
# installation APT
apt install -y nginx apache2-utils
# restart
service nginx restart
# test
curl localhost
# configuration du reverse proxy pour pointer sur le port de Kibana
# vim /etc/nginx/sites-available/default
# remplacer location / par :
# location / {
#     proxy_pass http://localhost:5601;
#     proxy_http_version 1.1;
#     proxy_set_header Upgrade $http_upgrade;
#     proxy_set_header Connection 'upgrade';
#     proxy_set_header Host $host;
#     proxy_cache_bypass $http_upgrade;        
# }
# puis ajouter :
# location /ecommerce {
#   root /var/www/html
# }

#### configurer Virtual Box pour le web ####
# machine > settings > network > advanced > port forwarding
# rule 2 : 8080 vers 80
# on teste depuis la machine hôte en allant sur : 
# localhost:8080 pour kibana
# localhost:8080/ecommerce pour le e-commerce

#### configurer PHP sur nginx ####
# vim /etc/nginx/sites-available/default
# location ~ \.php$ {
#   include fastcgi.conf;
#   fastcgi_pass 127.0.0.1:9000
# }
#
apt install php-fpm
#
# vim /etc/php/7.0/fpm/pool.d/www.conf
# listen = 127.0.0.1:9000
# et
# listen.allowed_clients = 127.0.0.1
# 
service nginx restart
service php7.0-fpm restart

#### logstash ####
# téléchargement deb
wget https://artifacts.elastic.co/downloads/logstash/logstash-5.1.1.deb
# check sha1sum
sum=$(curl https://artifacts.elastic.co/downloads/logstash/logstash-5.1.1.deb.sha1) && echo "$sum logstash-5.1.1.deb" | sha1sum -c -
# installation
dpkg -i logstash-5.1.1.deb
# startup
update-rc.d logstash defaults 96 9
# redémarrage
service logstash restart

input {
	file {
		path => ["/var/log/nginx/access.log"]
		type => "access logs"
	}
}

filter {
  if [type] == "access logs" {
    grok {
      match => { "message" => "%{IP:client_ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:apache_timestamp}\] \"%{WORD:method} /%{NOTSPACE:request_page} HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    syslog_pri { }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}

output {
  if [type] == "system logs" {
    elasticsearch {
      hosts => ['localhost:9200']
      index => "varlog-%{+YYYY.MM.dd}"
    }
    stdout { codec => rubydebug }
  }
  if [type] == "access logs" {
    elasticsearch {
      hosts => ['localhost:9200']
      index => "access-%{+YYYY.MM.dd}"
    }
    stdout { codec => rubydebug }
  }
}