Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:centos:6:avance:l104 [2020/03/09 13:59] – supprimée admin | elearning:workbooks:centos:6:avance:l104 [2023/02/15 15:54] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| + | ~~PDF: | ||
| + | Version : **2022.01** | ||
| + | |||
| + | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| + | |||
| + | ======LCF303 - Gestion du Réseau TCPv4====== | ||
| + | |||
| + | =====Contenu du Module===== | ||
| + | |||
| + | * **LCF303 - Gestion du Réseau TCPv4** | ||
| + | * Contenu du Module | ||
| + | * Configuration du Réseau sous RHEL/CentOS 5 et 6 | ||
| + | * Configuration de TCP/IP | ||
| + | * DHCP | ||
| + | * / | ||
| + | * / | ||
| + | * IP Fixe | ||
| + | * / | ||
| + | * / | ||
| + | * La Commande hostname | ||
| + | * La Commande ifconfig | ||
| + | * Activer/ | ||
| + | * / | ||
| + | * Résolution d' | ||
| + | * / | ||
| + | * / | ||
| + | * /etc/hosts | ||
| + | * Services réseaux | ||
| + | * xinetd | ||
| + | * TCP Wrapper | ||
| + | * Routage Statique | ||
| + | * La Commande route | ||
| + | * Activer/ | ||
| + | * Configuration du Réseau sous RHEL/CentOS 7 | ||
| + | * La Commande nmcli | ||
| + | * Connections et Profils | ||
| + | * Ajouter une Deuxième Adresse IP à un Profil | ||
| + | * La Commande hostname | ||
| + | * La Commande ip | ||
| + | * Activer/ | ||
| + | * Routage Statique | ||
| + | * La commande ip | ||
| + | * Activer/ | ||
| + | * Diagnostique du Réseau | ||
| + | * ping | ||
| + | * netstat -i | ||
| + | * traceroute | ||
| + | * Connexions à Distance | ||
| + | * Telnet | ||
| + | * wget | ||
| + | * ftp | ||
| + | * SSH | ||
| + | * Introduction | ||
| + | * SSH-1 | ||
| + | * SSH-2 | ||
| + | * L' | ||
| + | * L' | ||
| + | * Installation | ||
| + | * Configuration | ||
| + | * Serveur | ||
| + | * Utilisation | ||
| + | * Tunnels SSH | ||
| + | * SCP | ||
| + | * Introduction | ||
| + | * Utilisation | ||
| + | * Mise en place des clefs | ||
| + | |||
| + | =====Configuration du Réseau sous RHEL/CentOS 5 et 6===== | ||
| + | |||
| + | ==== Configuration de TCP/IP ==== | ||
| + | |||
| + | La configuration TCP/IP se trouve dans le répertoire **/ | ||
| + | |||
| + | === DHCP === | ||
| + | |||
| + | == / | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# cat / | ||
| + | NETWORKING=yes | ||
| + | HOSTNAME=centos6 | ||
| + | </ | ||
| + | |||
| + | Dans ce fichier vous pouvez constater les directives suivantes : | ||
| + | |||
| + | ^ Directive ^ Description ^ | ||
| + | | NETWORKING | Indique que la prise en charge du réseau est activée | | ||
| + | | HOSTNAME | Indique le nom d' | ||
| + | |||
| + | Ce fichier peut également contenir les directives suivantes : | ||
| + | |||
| + | ^ Directive ^ Description ^ | ||
| + | | GATEWAY | Indique l' | ||
| + | | GATEWAYDEV | Indique l' | ||
| + | | NISDOMAIN | Indique le domaine NIS s'il en existe un | | ||
| + | | NETWORKING_IPV6 | Active ou désactive le support IPv6 | | ||
| + | |||
| + | ==/ | ||
| + | |||
| + | **ifcfg-eth0** | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# cat / | ||
| + | DEVICE=" | ||
| + | NM_CONTROLLED=" | ||
| + | ONBOOT=yes | ||
| + | TYPE=Ethernet | ||
| + | BOOTPROTO=dhcp | ||
| + | DEFROUTE=yes | ||
| + | IPV4_FAILURE_FATAL=yes | ||
| + | IPV6INIT=no | ||
| + | NAME=" | ||
| + | UUID=5fb06bd0-0bb0-7ffb-45f1-d6edd65f3e03 | ||
| + | HWADDR=08: | ||
| + | PEERDNS=yes | ||
| + | PEERROUTES=yes | ||
| + | </ | ||
| + | |||
| + | Dans ce fichier vous pouvez constater les directives suivantes : | ||
| + | |||
| + | ^ Directive ^ Description ^ | ||
| + | | DEVICE | Indique le nom de l' | ||
| + | | NM_CONTROLLED | Indique que le service NetworkManager est utilisé pour gérer les interfaces réseau | | ||
| + | | ONBOOT | Indique que l' | ||
| + | | TYPE | Indique que le type de réseau est ethernet. | ||
| + | | BOOTPROTO | Indique comment monter l' | ||
| + | | DEFROUTE | Définit l' | ||
| + | | IPV4_FAILURE_FATAL | Stipule que si IPv4 et IPv6 sont activés et la connexion IPv4 est perdue, la connexion IPv6 est considérée d' | ||
| + | | IPV6INIT | Indique que le support IPv6 ne sera pas initialisé | | ||
| + | | NAME | Indique un nom descriptif de l' | ||
| + | | UUID | Indique la valeur de l'UUID de l' | ||
| + | | HWADDR | Indique l' | ||
| + | | PEERDNS |Indique que le fichier / | ||
| + | |||
| + | |||
| + | <WRAP center round todo> | ||
| + | Recherchez la définition de la directive **PEERROUTES=yes**. | ||
| + | </ | ||
| + | |||
| + | === IP Fixe === | ||
| + | |||
| + | == / | ||
| + | |||
| + | < | ||
| + | NETWORKING=yes | ||
| + | NETWORKING_IPV6=no | ||
| + | HOSTNAME=centos6.fenestros.loc | ||
| + | </ | ||
| + | |||
| + | ==/ | ||
| + | |||
| + | **ifcfg-eth0** | ||
| + | |||
| + | < | ||
| + | DEVICE=" | ||
| + | NM_CONTROLLED=" | ||
| + | ONBOOT=yes | ||
| + | TYPE=Ethernet | ||
| + | BOOTPROTO=static | ||
| + | IPV6INIT=no | ||
| + | HWADDR=" | ||
| + | NETMASK=255.255.255.0 | ||
| + | IPADDR=10.0.2.15 | ||
| + | GATEWAY=10.0.2.2 | ||
| + | DNS1=8.8.8.8 | ||
| + | DNS2=8.8.4.4 | ||
| + | DOMAIN=fenestros.loc | ||
| + | USERCTL=yes | ||
| + | </ | ||
| + | |||
| + | Dans ce fichier vous pouvez constater les nouvelles directives suivantes : | ||
| + | |||
| + | ^ Directive ^ Description ^ | ||
| + | | NETMASK | Indique le masque de sous-réseau IPv4 associé à l' | ||
| + | | IPADDR | Indique l' | ||
| + | | GATEWAY | ||
| + | | DNS1 | Indique le DNS primaire | | ||
| + | | DNS2 | Indique le DNS secondaire | | ||
| + | | DOMAIN | ||
| + | | USERCTL | Indique que les utilisateurs normaux peuvent activer/ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | Notez que %%VirtualBox%% fournit une passerelle par défaut ( 10.0.2.2 ). | ||
| + | </ | ||
| + | |||
| + | Après avoir modifier les deux fichiers **/ | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# service NetworkManager stop | ||
| + | Arrêt du démon NetworkManager : [ OK ] | ||
| + | [root@centos6 ~]# chkconfig --del NetworkManager | ||
| + | [root@centos6 ~]# service network start | ||
| + | Activation de l' | ||
| + | Activation de l' | ||
| + | [root@centos6 ~]# | ||
| + | </ | ||
| + | |||
| + | |||
| + | ====La Commande hostname==== | ||
| + | |||
| + | Lors du passage à une configuration en IPv4 fixe vous avez modifié la directive **HOSTNAME** du fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# hostname | ||
| + | centos6 | ||
| + | [root@centos6 ~]# hostname centos6.fenestros.loc | ||
| + | [root@centos6 ~]# hostname | ||
| + | centos6.fenestros.loc | ||
| + | </ | ||
| + | |||
| + | Pour afficher le FQDN du système vous pouvez également utiliser la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# uname -n | ||
| + | centos6.fenestros.loc | ||
| + | </ | ||
| + | |||
| + | ===Options de la commande hostname=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# hostname --help | ||
| + | Syntaxe : hostname [-v] {hôte|-F fichier} | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | dnsdomainname=hostname -d, {yp, | ||
| + | |||
| + | -s, --short | ||
| + | -a, --alias | ||
| + | -i, --ip-address | ||
| + | -f, --fqdn, --long | ||
| + | -d, --domain | ||
| + | -y, --yp, --nis nom de domaine NIS/YP | ||
| + | -F, --file | ||
| + | |||
| + | This command can read or set the hostname or the NIS domainname. You can | ||
| + | also read the DNS domain or the FQDN (fully qualified domain name). | ||
| + | | ||
| + | FQDN (Fully Qualified Domain Name) and the DNS domain name (which is | ||
| + | part of the FQDN) in the /etc/hosts file. | ||
| + | </ | ||
| + | |||
| + | ====La Commande ifconfig==== | ||
| + | |||
| + | Pour afficher la configuration IP de la machine il faut saisir la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# ifconfig | ||
| + | eth0 Link encap: | ||
| + | inet adr: | ||
| + | adr inet6: fe80:: | ||
| + | UP BROADCAST RUNNING MULTICAST | ||
| + | RX packets: | ||
| + | TX packets: | ||
| + | collisions: | ||
| + | RX bytes: | ||
| + | |||
| + | lo Link encap: | ||
| + | inet adr: | ||
| + | adr inet6: ::1/128 Scope:Hôte | ||
| + | UP LOOPBACK RUNNING | ||
| + | RX packets:8 errors:0 dropped:0 overruns:0 frame:0 | ||
| + | TX packets:8 errors:0 dropped:0 overruns:0 carrier:0 | ||
| + | collisions: | ||
| + | RX bytes:480 (480.0 b) TX bytes:480 (480.0 b) | ||
| + | </ | ||
| + | |||
| + | La commande ifconfig est également utilisée pour configurer une interface. | ||
| + | |||
| + | Créez maintenant une interface fictive ainsi : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# ifconfig eth0:1 192.168.1.2 netmask 255.255.255.0 broadcast 192.168.1.255 | ||
| + | </ | ||
| + | |||
| + | Constatez maintenant le résultat : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# ifconfig | ||
| + | eth0 Link encap: | ||
| + | inet adr: | ||
| + | adr inet6: fe80:: | ||
| + | UP BROADCAST RUNNING MULTICAST | ||
| + | RX packets: | ||
| + | TX packets: | ||
| + | collisions: | ||
| + | RX bytes: | ||
| + | |||
| + | eth0: | ||
| + | inet adr: | ||
| + | UP BROADCAST RUNNING MULTICAST | ||
| + | |||
| + | lo Link encap: | ||
| + | inet adr: | ||
| + | adr inet6: ::1/128 Scope:Hôte | ||
| + | UP LOOPBACK RUNNING | ||
| + | RX packets:8 errors:0 dropped:0 overruns:0 frame:0 | ||
| + | TX packets:8 errors:0 dropped:0 overruns:0 carrier:0 | ||
| + | collisions: | ||
| + | RX bytes:480 (480.0 b) TX bytes:480 (480.0 b) | ||
| + | </ | ||
| + | |||
| + | ===Options de la commande ifconfig=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# ifconfig --help | ||
| + | Usage: | ||
| + | ifconfig [-a] [-v] [-s] < | ||
| + | [add < | ||
| + | [del < | ||
| + | [[-]broadcast [< | ||
| + | [netmask < | ||
| + | [outfill <NN>] [keepalive <NN>] | ||
| + | [hw <HW> < | ||
| + | [[-]trailers] | ||
| + | [multicast] | ||
| + | [mem_start < | ||
| + | [txqueuelen <NN>] | ||
| + | [[-]dynamic] | ||
| + | [up|down] ... | ||
| + | |||
| + | < | ||
| + | Liste des types de matériels possibles: | ||
| + | loop (Boucle locale) slip (IP ligne série) cslip (IP ligne série - VJ ) | ||
| + | slip6 (IP ligne série - 6 bits) cslip6 (IP ligne série - 6 bits VJ) adaptive (IP ligne série adaptative) | ||
| + | strip (Metricom Starmode IP) ash (Ash) ether (Ethernet) | ||
| + | tr (16/4 Mbps Token Ring) tr (16/4 Mbps Token Ring (New)) ax25 (AMPR AX.25) | ||
| + | netrom (AMPR NET/ROM) rose (AMPR ROSE) tunnel (IPIP Tunnel) | ||
| + | ppp (Protocole Point-à-Point) hdlc ((Cisco)-HDLC) lapb (LAPB) | ||
| + | arcnet (ARCnet) dlci (Frame Relay DLCI) frad (Périphériue d' | ||
| + | sit (IPv6-dans-IPv4) fddi (Fiber Distributed Data Interface) hippi (HIPPI) | ||
| + | irda (IrLAP) ec (Econet) x25 (generic X.25) | ||
| + | infiniband (InfiniBand) | ||
| + | < | ||
| + | Liste des familles d' | ||
| + | unix (Domaine UNIX) inet (DARPA Internet) inet6 (IPv6) | ||
| + | ax25 (AMPR AX.25) netrom (AMPR NET/ROM) rose (AMPR ROSE) | ||
| + | ipx (Novell IPX) ddp (Appletalk DDP) ec (Econet) | ||
| + | ash (Ash) x25 (CCITT X.25) | ||
| + | </ | ||
| + | |||
| + | ====Activer/ | ||
| + | |||
| + | Deux commandes existent pour activer et désactiver manuellement une interface réseau : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# ifdown eth0 | ||
| + | [root@centos6 ~]# ifconfig | ||
| + | lo Link encap: | ||
| + | inet adr: | ||
| + | adr inet6: ::1/128 Scope:Hôte | ||
| + | UP LOOPBACK RUNNING | ||
| + | RX packets:384 errors:0 dropped:0 overruns:0 frame:0 | ||
| + | TX packets:384 errors:0 dropped:0 overruns:0 carrier:0 | ||
| + | collisions: | ||
| + | RX bytes:32496 (31.7 KiB) TX bytes:32496 (31.7 KiB) | ||
| + | |||
| + | [root@centos6 ~]# ifup eth0 | ||
| + | État de connexion active& | ||
| + | État de chemin actif& | ||
| + | état& | ||
| + | Connexion activée | ||
| + | [root@centos6 ~]# ifconfig | ||
| + | eth0 Link encap: | ||
| + | inet adr: | ||
| + | adr inet6: fe80:: | ||
| + | UP BROADCAST RUNNING MULTICAST | ||
| + | RX packets:27 errors:0 dropped:0 overruns:0 frame:0 | ||
| + | TX packets:42 errors:0 dropped:0 overruns:0 carrier:0 | ||
| + | collisions: | ||
| + | RX bytes:4271 (4.1 KiB) TX bytes:6145 (6.0 KiB) | ||
| + | |||
| + | lo Link encap: | ||
| + | inet adr: | ||
| + | adr inet6: ::1/128 Scope:Hôte | ||
| + | UP LOOPBACK RUNNING | ||
| + | RX packets:392 errors:0 dropped:0 overruns:0 frame:0 | ||
| + | TX packets:392 errors:0 dropped:0 overruns:0 carrier:0 | ||
| + | collisions: | ||
| + | RX bytes:33600 (32.8 KiB) TX bytes:33600 (32.8 KiB) | ||
| + | </ | ||
| + | |||
| + | ===/ | ||
| + | |||
| + | Ce fichier contient la correspondance entre des noms de réseaux et l' | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# cat / | ||
| + | default 0.0.0.0 | ||
| + | loopback 127.0.0.0 | ||
| + | link-local 169.254.0.0 | ||
| + | </ | ||
| + | |||
| + | === Résolution d' | ||
| + | |||
| + | La configuration DNS est stockée dans le fichier **/ | ||
| + | |||
| + | |||
| + | == / | ||
| + | |||
| + | La configuration DNS est stockée dans le fichier / | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# cat / | ||
| + | # Generated by NetworkManager | ||
| + | |||
| + | |||
| + | # No nameservers found; try putting DNS servers into your | ||
| + | # ifcfg files in / | ||
| + | # | ||
| + | # DNS1=xxx.xxx.xxx.xxx | ||
| + | # DNS2=xxx.xxx.xxx.xxx | ||
| + | # DOMAIN=lab.foo.com bar.foo.com | ||
| + | nameserver 8.8.8.8 | ||
| + | nameserver 8.8.4.4 | ||
| + | search fenestros.loc | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | Notez que les DNS utilisés sont les serveurs DNS publics de Google. | ||
| + | </ | ||
| + | |||
| + | |||
| + | ==/ | ||
| + | |||
| + | L' | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# grep ' | ||
| + | hosts: | ||
| + | </ | ||
| + | |||
| + | == /etc/hosts == | ||
| + | |||
| + | Le mot **files** dans la sortie de la commande précédente fait référence au fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# cat /etc/hosts | ||
| + | 10.0.2.15 centos6 # | ||
| + | 127.0.0.1 localhost.localdomain localhost | ||
| + | :: | ||
| + | </ | ||
| + | |||
| + | Pour tester le serveur DNS, deux commandes sont possibles : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# nslookup www.i2tch.com | ||
| + | Server: | ||
| + | Address: | ||
| + | |||
| + | Non-authoritative answer: | ||
| + | www.i2tch.com canonical name = i2tch.com. | ||
| + | Name: | ||
| + | Address: 90.119.37.144 | ||
| + | |||
| + | [root@centos6 ~]# dig www.i2tch.com | ||
| + | |||
| + | ; <<>> | ||
| + | ;; global options: +cmd | ||
| + | ;; Got answer: | ||
| + | ;; ->> | ||
| + | ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 | ||
| + | |||
| + | ;; OPT PSEUDOSECTION: | ||
| + | ; EDNS: version: 0, flags:; udp: 65494 | ||
| + | ;; QUESTION SECTION: | ||
| + | ; | ||
| + | |||
| + | ;; ANSWER SECTION: | ||
| + | www.i2tch.com. 6563 IN CNAME i2tch.com. | ||
| + | i2tch.com. 50 IN A 90.119.37.144 | ||
| + | |||
| + | ;; Query time: 1 msec | ||
| + | ;; SERVER: 8.8.8.8# | ||
| + | ;; WHEN: Mon Jan 22 18:00:27 CET 2018 | ||
| + | ;; MSG SIZE rcvd: 72 | ||
| + | </ | ||
| + | |||
| + | ==== Services réseaux ==== | ||
| + | |||
| + | Quand un client émet une demande de connexion vers une application réseau sur un serveur, il utilise un socket attaché à un port local **supérieur à 1023**, alloué d'une manière dynamique. La requête contient le port de destination sur le serveur. Certaines applications serveurs se gèrent toutes seules, ce qui est la cas par exemple d' | ||
| + | |||
| + | === xinetd === | ||
| + | |||
| + | Sous RHEL/CentOS 6 xinetd n'est pas installé par défaut. Installez-le grâce à yum : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# yum install xinetd | ||
| + | Loaded plugins: fastestmirror, | ||
| + | Loading mirror speeds from cached hostfile | ||
| + | * base: fr2.rpmfind.net | ||
| + | * extras: fr2.rpmfind.net | ||
| + | * updates: fr2.rpmfind.net | ||
| + | Setting up Install Process | ||
| + | Resolving Dependencies | ||
| + | --> Running transaction check | ||
| + | ---> Package xinetd.i686 2: | ||
| + | --> Finished Dependency Resolution | ||
| + | |||
| + | Dependencies Resolved | ||
| + | |||
| + | ================================================================================ | ||
| + | | ||
| + | ================================================================================ | ||
| + | Installing: | ||
| + | | ||
| + | |||
| + | Transaction Summary | ||
| + | ================================================================================ | ||
| + | Install | ||
| + | Upgrade | ||
| + | |||
| + | Total download size: 121 k | ||
| + | Installed size: 258 k | ||
| + | Is this ok [y/N]: y | ||
| + | Downloading Packages: | ||
| + | xinetd-2.3.14-33.el6.i686.rpm | ||
| + | Running rpm_check_debug | ||
| + | Running Transaction Test | ||
| + | Transaction Test Succeeded | ||
| + | Running Transaction | ||
| + | Installing | ||
| + | |||
| + | Installed: | ||
| + | xinetd.i686 2: | ||
| + | |||
| + | Complete! | ||
| + | </ | ||
| + | |||
| + | Le programme xinetd est configuré via le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# cat / | ||
| + | # | ||
| + | # This is the master xinetd configuration file. Settings in the | ||
| + | # default section will be inherited by all service configurations | ||
| + | # unless explicitly overridden in the service configuration. See | ||
| + | # xinetd.conf in the man pages for a more detailed explanation of | ||
| + | # these attributes. | ||
| + | |||
| + | defaults | ||
| + | { | ||
| + | # The next two items are intended to be a quick access place to | ||
| + | # temporarily enable or disable services. | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Define general logging characteristics. | ||
| + | log_type = SYSLOG daemon info | ||
| + | log_on_failure = HOST | ||
| + | log_on_success = PID HOST DURATION EXIT | ||
| + | |||
| + | # Define access restriction defaults | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | cps = 50 10 | ||
| + | instances = 50 | ||
| + | per_source = 10 | ||
| + | |||
| + | # Address and networking defaults | ||
| + | # | ||
| + | # bind = | ||
| + | # mdns = yes | ||
| + | v6only = no | ||
| + | |||
| + | # setup environmental attributes | ||
| + | # | ||
| + | # | ||
| + | groups = yes | ||
| + | umask = 002 | ||
| + | |||
| + | # Generally, banners are not used. This sets up their global defaults | ||
| + | # | ||
| + | # banner = | ||
| + | # | ||
| + | # | ||
| + | } | ||
| + | |||
| + | includedir / | ||
| + | </ | ||
| + | |||
| + | Les valeurs des directives dans le fichier **/ | ||
| + | |||
| + | Les variables les plus importantes dans **/ | ||
| + | |||
| + | ^ Directive | ||
| + | | instances | ||
| + | | log_type | ||
| + | | log_on_succes | ||
| + | | log_on_failure | ||
| + | | cps | Indique 50 connexions par seconde avec un temps d' | ||
| + | |||
| + | Les options concernant les journaux sont : | ||
| + | |||
| + | | HOST | Journalisation de l' | ||
| + | | PID | Journalisation du PID du processus qui reçoit la demande d' | ||
| + | | DURATION | ||
| + | | EXIT | Journalisation de l' | ||
| + | |||
| + | Il est aussi possible de trouver les options suivantes pour les journaux : | ||
| + | |||
| + | | ATTEMPT | ||
| + | | USERID | ||
| + | |||
| + | Examinons maintenant le répertoire **/ | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# ls -l / | ||
| + | total 52 | ||
| + | -rw-------. 1 root root 1157 7 déc. 22:07 chargen-dgram | ||
| + | -rw-------. 1 root root 1159 7 déc. 22:07 chargen-stream | ||
| + | -rw-r--r--. 1 root root 523 25 juin 2011 cvs | ||
| + | -rw-------. 1 root root 1157 7 déc. 22:07 daytime-dgram | ||
| + | -rw-------. 1 root root 1159 7 déc. 22:07 daytime-stream | ||
| + | -rw-------. 1 root root 1157 7 déc. 22:07 discard-dgram | ||
| + | -rw-------. 1 root root 1159 7 déc. 22:07 discard-stream | ||
| + | -rw-------. 1 root root 1148 7 déc. 22:07 echo-dgram | ||
| + | -rw-------. 1 root root 1150 7 déc. 22:07 echo-stream | ||
| + | -rw-r--r--. 1 root root 332 20 mai 2009 rsync | ||
| + | -rw-------. 1 root root 1212 7 déc. 22:07 tcpmux-server | ||
| + | -rw-------. 1 root root 1149 7 déc. 22:07 time-dgram | ||
| + | -rw-------. 1 root root 1150 7 déc. 22:07 time-stream | ||
| + | </ | ||
| + | |||
| + | A l' | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# cat / | ||
| + | # default: off | ||
| + | # description: | ||
| + | # files. CVS stores all the versions of a file in a single \ | ||
| + | # file in a clever way that only stores the differences \ | ||
| + | # between versions. | ||
| + | service cvspserver | ||
| + | { | ||
| + | disable = yes | ||
| + | port = 2401 | ||
| + | socket_type = stream | ||
| + | protocol = tcp | ||
| + | wait = no | ||
| + | user = root | ||
| + | passenv = PATH | ||
| + | server = / | ||
| + | env = HOME=/ | ||
| + | server_args = -f --allow-root=/ | ||
| + | # bind = 127.0.0.1 | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | Les directives principales de ce fichier sont : | ||
| + | |||
| + | ^ Paramètre | ||
| + | | disable | ||
| + | | port | Le numéro de port ou, à défaut, le numéro indiqué pour le service dans le fichier / | ||
| + | | socket_type | ||
| + | | protocol | ||
| + | | wait | **no** : indique si xinetd active un serveur par client. **yes** : indique que xinetd active un seul serveur pour tous les client | | ||
| + | | user | Indique le compte sous lequel le serveur est exécuté | | ||
| + | | server | ||
| + | | env | Définit un environnement système | | ||
| + | | server_args | ||
| + | |||
| + | Cependant il est aussi possible d' | ||
| + | |||
| + | ^ Paramètre | ||
| + | | nice | Fixe le niveau de nice entre -19 et +20 | 10 | | ||
| + | | max_load | ||
| + | | bind | Limite le service à l' | ||
| + | | only_from | ||
| + | | no_access | ||
| + | | access_time | ||
| + | | redirect | ||
| + | |||
| + | Afin d' | ||
| + | |||
| + | === TCP Wrapper === | ||
| + | |||
| + | **TCP Wrapper** contrôle l' | ||
| + | |||
| + | Quand une requête arrive pour un serveur, xinetd active le wrapper **tcpd** au lieu d' | ||
| + | |||
| + | **tcpd** met à jour un journal et vérifie si le client a le droit d' | ||
| + | |||
| + | * **/ | ||
| + | * **/ | ||
| + | |||
| + | Il faut noter que si ces fichiers n' | ||
| + | |||
| + | Le format d'une ligne dans un de ces deux fichiers est: | ||
| + | |||
| + | < | ||
| + | démon : liste_de_clients | ||
| + | </ | ||
| + | |||
| + | Par exemple dans le cas d'un serveur **démon**, on verrait une ligne dans le fichier **/ | ||
| + | |||
| + | < | ||
| + | démon : LOCAL, .fenestros.loc | ||
| + | </ | ||
| + | |||
| + | ce qui implique que les machines dont le nom ne comporte pas de point ainsi que les machines du domaine **fenestros.loc** sont autorisées à utiliser le service. | ||
| + | |||
| + | Le mot clef **ALL** peut être utilisé pour indiquer tout. Par exemple, **ALL:ALL** dans le fichier **/ | ||
| + | |||
| + | ====Routage Statique==== | ||
| + | |||
| + | ===La Commande route=== | ||
| + | |||
| + | Pour afficher la table de routage de la machine vous pouvez utiliser la commande **route** : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# route | ||
| + | Table de routage IP du noyau | ||
| + | Destination | ||
| + | 192.168.1.0 | ||
| + | 10.0.2.0 | ||
| + | link-local | ||
| + | default | ||
| + | </ | ||
| + | |||
| + | La table issue de la commande **route** indique les informations suivantes: | ||
| + | |||
| + | * La destination qui peut être un hôte ou un réseau et est identifiée par les champs **Destination** et **Genmask** | ||
| + | * La route à prendre identifiée par les champs **Gateway** et **Iface**. Dans le cas d'une valeur de 0.0.0.0 ceci spécifie une route directe. La valeur d' | ||
| + | * Le champ **Indic** qui peux prendre un ou plusieurs de svaleurs suivantes: | ||
| + | * U - **Up** - la route est active | ||
| + | * H - **Host** - la route conduit à un hôte | ||
| + | * G - **Gateways** - la route passe par une passerelle | ||
| + | * Le champ **Metric** indique le nombre de sauts (passerelles) pour atteindre la destination, | ||
| + | * Le champ **Ref** indique le nombre de références à cette route. Ce champs est usilisé par le Noyau de Linux, | ||
| + | * Le champ **Use** indique le nombre de recherches associés à cette route. | ||
| + | |||
| + | La commande **route** permet aussi de paramétrer le routage indirect. Par exemple pour supprimer la route vers le réseau 192.168.1.0 : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# route del -net 192.168.1.0 netmask 255.255.255.0 | ||
| + | [root@centos6 ~]# route | ||
| + | Table de routage IP du noyau | ||
| + | Destination | ||
| + | 10.0.2.0 | ||
| + | link-local | ||
| + | default | ||
| + | </ | ||
| + | |||
| + | Pour ajouter la route vers le réseau 192.168.1.0 : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.2 | ||
| + | [root@centos6 ~]# route | ||
| + | Table de routage IP du noyau | ||
| + | Destination | ||
| + | 192.168.1.0 | ||
| + | 10.0.2.0 | ||
| + | link-local | ||
| + | default | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | La commande utilisée pour ajouter une passerelle par défaut prend la forme suivante **route add default gw // | ||
| + | </ | ||
| + | |||
| + | Les options cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# route --help | ||
| + | Syntaxe: route [-nNvee] [-FC] [< | ||
| + | route [-v] [-FC] {add|del|flush} ... Modifie la table de routage pour AF. | ||
| + | |||
| + | route {-h|--help} [< | ||
| + | route {-V|--version} | ||
| + | |||
| + | -v, --verbose | ||
| + | -n, --numeric | ||
| + | -e, --extend | ||
| + | -F, --fib display Forwarding Information Base (default) | ||
| + | -C, --cache | ||
| + | |||
| + | < | ||
| + | Liste les familles d' | ||
| + | inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25) | ||
| + | netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP) | ||
| + | x25 (CCITT X.25) | ||
| + | </ | ||
| + | |||
| + | Vous pouvez aussi utiliser la commande **netstat** pour afficher la table de routage de la machine : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# netstat -nr | ||
| + | Table de routage IP du noyau | ||
| + | Destination | ||
| + | 192.168.1.0 | ||
| + | 192.168.1.0 | ||
| + | 10.0.2.0 | ||
| + | 0.0.0.0 | ||
| + | </ | ||
| + | |||
| + | La table issue de la commande **netstat -nr** indique les informations suivantes: | ||
| + | |||
| + | * La champ **MSS** indique la taille maximale des segments TCP sur la route, | ||
| + | * Le champ **Window** indique la taille de la fenêtre sur cette route, | ||
| + | * Le champ **irrt** indique le paramètre IRRT pour la route. | ||
| + | |||
| + | ===Activer/ | ||
| + | |||
| + | Pour activer le routage sur le serveur, il convient d' | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# echo 1 > / | ||
| + | [root@centos6 ~]# cat / | ||
| + | 1 | ||
| + | </ | ||
| + | |||
| + | Pour désactiver le routage sur le serveur, il convient de désactiver la retransmission des paquets: | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# echo 0 > / | ||
| + | [root@centos6 ~]# cat / | ||
| + | 0 | ||
| + | </ | ||
| + | |||
| + | =====Configuration du Réseau sous RHEL/CentOS 7===== | ||
| + | |||
| + | RHEL/CentOS 7 utilise exclusivement **Network Manager** pour gérer le réseau. Network Manager est composé de deux éléments : | ||
| + | |||
| + | * un service qui gère les connexions réseaux et rapporte leurs états, | ||
| + | * des front-ends qui passent par un API de configuration du service. | ||
| + | |||
| + | <WRAP center round important> | ||
| + | **Important** : Notez qu' | ||
| + | </ | ||
| + | |||
| + | Le service NetworkManager doit toujours être lancé : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# systemctl status NetworkManager.service | ||
| + | ● NetworkManager.service - Network Manager | ||
| + | | ||
| + | | ||
| + | Main PID: 673 (NetworkManager) | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc dhclient[2673]: | ||
| + | </ | ||
| + | |||
| + | ====La Commande nmcli==== | ||
| + | |||
| + | La commande **nmcli** (Network Manager Command Line Interface) est utilisée pour configurer NetworkManager. | ||
| + | |||
| + | Les options et les sous-commandes peuvent être consultées en utilisant les commandes suivantes : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli help | ||
| + | Usage: nmcli [OPTIONS] OBJECT { COMMAND | help } | ||
| + | |||
| + | OPTIONS | ||
| + | -t[erse] | ||
| + | -p[retty] | ||
| + | -m[ode] tabular|multiline | ||
| + | -f[ields] < | ||
| + | -e[scape] yes|no | ||
| + | -n[ocheck] | ||
| + | -a[sk] | ||
| + | -w[ait] < | ||
| + | -v[ersion] | ||
| + | -h[elp] | ||
| + | |||
| + | OBJECT | ||
| + | g[eneral] | ||
| + | n[etworking] | ||
| + | r[adio] | ||
| + | c[onnection] | ||
| + | d[evice] | ||
| + | a[gent] | ||
| + | |||
| + | [root@centos7 ~]# nmcli g help | ||
| + | Usage: nmcli general { COMMAND | help } | ||
| + | |||
| + | COMMAND := { status | hostname | permissions | logging } | ||
| + | |||
| + | status | ||
| + | |||
| + | hostname [< | ||
| + | |||
| + | permissions | ||
| + | |||
| + | logging [level <log level>] [domains <log domains> | ||
| + | |||
| + | |||
| + | [root@centos7 ~]# nmcli g status help | ||
| + | Usage: nmcli general status { help } | ||
| + | |||
| + | Show overall status of NetworkManager. | ||
| + | ' | ||
| + | |||
| + | </ | ||
| + | |||
| + | ====Connections et Profils==== | ||
| + | |||
| + | NetworkManager inclus la notion de **connections** ou **profils** permettant des configurations différentes en fonction de la localisation. Pour voir les connections actuelles, utilisez la commande **nmcli c** avec la sous-commande **show** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli c show | ||
| + | NAME UUID TYPE DEVICE | ||
| + | Wired connection 1 45b701c1-0a21-4d76-a795-2f2bcba86955 | ||
| + | </ | ||
| + | |||
| + | Comme on peut constater ici, il n' | ||
| + | |||
| + | Créez donc un profil IP fixe rattaché au périphérique **enp0s3** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli connection add con-name ip_fixe ifname enp0s3 type ethernet ip4 10.0.2.16/ | ||
| + | Connection ' | ||
| + | </ | ||
| + | |||
| + | Constatez sa présence : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli c show | ||
| + | NAME UUID TYPE DEVICE | ||
| + | ip_fixe | ||
| + | Wired connection 1 45b701c1-0a21-4d76-a795-2f2bcba86955 | ||
| + | </ | ||
| + | |||
| + | Notez que la sortie n' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli d show | ||
| + | GENERAL.DEVICE: | ||
| + | GENERAL.TYPE: | ||
| + | GENERAL.HWADDR: | ||
| + | GENERAL.MTU: | ||
| + | GENERAL.STATE: | ||
| + | GENERAL.CONNECTION: | ||
| + | GENERAL.CON-PATH: | ||
| + | WIRED-PROPERTIES.CARRIER: | ||
| + | IP4.ADDRESS[1]: | ||
| + | IP4.GATEWAY: | ||
| + | IP4.DNS[1]: | ||
| + | IP6.ADDRESS[1]: | ||
| + | IP6.GATEWAY: | ||
| + | |||
| + | GENERAL.DEVICE: | ||
| + | GENERAL.TYPE: | ||
| + | GENERAL.HWADDR: | ||
| + | GENERAL.MTU: | ||
| + | GENERAL.STATE: | ||
| + | GENERAL.CONNECTION: | ||
| + | GENERAL.CON-PATH: | ||
| + | IP4.ADDRESS[1]: | ||
| + | IP4.GATEWAY: | ||
| + | IP6.ADDRESS[1]: | ||
| + | IP6.GATEWAY: | ||
| + | </ | ||
| + | |||
| + | Pour activer le profil ip_fixe, utilisez la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli connection up ip_fixe | ||
| + | </ | ||
| + | |||
| + | Le profil ip_fixe est maintenant activé tandis que le profil enp0s3 a été désactivé : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli c show | ||
| + | NAME UUID TYPE DEVICE | ||
| + | ip_fixe | ||
| + | Wired connection 1 45b701c1-0a21-4d76-a795-2f2bcba86955 | ||
| + | [root@centos7 ~]# nmcli d show | ||
| + | GENERAL.DEVICE: | ||
| + | GENERAL.TYPE: | ||
| + | GENERAL.HWADDR: | ||
| + | GENERAL.MTU: | ||
| + | GENERAL.STATE: | ||
| + | GENERAL.CONNECTION: | ||
| + | GENERAL.CON-PATH: | ||
| + | WIRED-PROPERTIES.CARRIER: | ||
| + | IP4.ADDRESS[1]: | ||
| + | IP4.GATEWAY: | ||
| + | IP6.ADDRESS[1]: | ||
| + | IP6.GATEWAY: | ||
| + | |||
| + | GENERAL.DEVICE: | ||
| + | GENERAL.TYPE: | ||
| + | GENERAL.HWADDR: | ||
| + | GENERAL.MTU: | ||
| + | GENERAL.STATE: | ||
| + | GENERAL.CONNECTION: | ||
| + | GENERAL.CON-PATH: | ||
| + | IP4.ADDRESS[1]: | ||
| + | IP4.GATEWAY: | ||
| + | IP6.ADDRESS[1]: | ||
| + | IP6.GATEWAY: | ||
| + | </ | ||
| + | |||
| + | Pour consulter les paramètres d'un profil, utilisez la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli -p connection show "Wired connection 1" | ||
| + | =============================================================================== | ||
| + | Connection profile details (Wired connection 1) | ||
| + | =============================================================================== | ||
| + | connection.id: | ||
| + | connection.uuid: | ||
| + | connection.interface-name: | ||
| + | connection.type: | ||
| + | connection.autoconnect: | ||
| + | connection.autoconnect-priority: | ||
| + | connection.timestamp: | ||
| + | connection.read-only: | ||
| + | connection.permissions: | ||
| + | connection.zone: | ||
| + | connection.master: | ||
| + | connection.slave-type: | ||
| + | connection.autoconnect-slaves: | ||
| + | connection.secondaries: | ||
| + | connection.gateway-ping-timeout: | ||
| + | connection.metered: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | 802-3-ethernet.port: | ||
| + | 802-3-ethernet.speed: | ||
| + | 802-3-ethernet.duplex: | ||
| + | 802-3-ethernet.auto-negotiate: | ||
| + | 802-3-ethernet.mac-address: | ||
| + | 802-3-ethernet.cloned-mac-address: | ||
| + | 802-3-ethernet.mac-address-blacklist: | ||
| + | 802-3-ethernet.mtu: | ||
| + | 802-3-ethernet.s390-subchannels: | ||
| + | 802-3-ethernet.s390-nettype: | ||
| + | 802-3-ethernet.s390-options: | ||
| + | 802-3-ethernet.wake-on-lan: | ||
| + | 802-3-ethernet.wake-on-lan-password: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | ipv4.method: | ||
| + | ipv4.dns: | ||
| + | ipv4.dns-search: | ||
| + | ipv4.addresses: | ||
| + | ipv4.gateway: | ||
| + | ipv4.routes: | ||
| + | ipv4.route-metric: | ||
| + | ipv4.ignore-auto-routes: | ||
| + | ipv4.ignore-auto-dns: | ||
| + | ipv4.dhcp-client-id: | ||
| + | ipv4.dhcp-send-hostname: | ||
| + | ipv4.dhcp-hostname: | ||
| + | ipv4.never-default: | ||
| + | ipv4.may-fail: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | ipv6.method: | ||
| + | ipv6.dns: | ||
| + | ipv6.dns-search: | ||
| + | ipv6.addresses: | ||
| + | ipv6.gateway: | ||
| + | ipv6.routes: | ||
| + | ipv6.route-metric: | ||
| + | ipv6.ignore-auto-routes: | ||
| + | ipv6.ignore-auto-dns: | ||
| + | ipv6.never-default: | ||
| + | ipv6.may-fail: | ||
| + | ipv6.ip6-privacy: | ||
| + | ipv6.dhcp-send-hostname: | ||
| + | ipv6.dhcp-hostname: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | [root@centos7 ~]# nmcli -p connection show ip_fixe | ||
| + | =============================================================================== | ||
| + | | ||
| + | =============================================================================== | ||
| + | connection.id: | ||
| + | connection.uuid: | ||
| + | connection.interface-name: | ||
| + | connection.type: | ||
| + | connection.autoconnect: | ||
| + | connection.autoconnect-priority: | ||
| + | connection.timestamp: | ||
| + | connection.read-only: | ||
| + | connection.permissions: | ||
| + | connection.zone: | ||
| + | connection.master: | ||
| + | connection.slave-type: | ||
| + | connection.autoconnect-slaves: | ||
| + | connection.secondaries: | ||
| + | connection.gateway-ping-timeout: | ||
| + | connection.metered: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | 802-3-ethernet.port: | ||
| + | 802-3-ethernet.speed: | ||
| + | 802-3-ethernet.duplex: | ||
| + | 802-3-ethernet.auto-negotiate: | ||
| + | 802-3-ethernet.mac-address: | ||
| + | 802-3-ethernet.cloned-mac-address: | ||
| + | 802-3-ethernet.mac-address-blacklist: | ||
| + | 802-3-ethernet.mtu: | ||
| + | 802-3-ethernet.s390-subchannels: | ||
| + | 802-3-ethernet.s390-nettype: | ||
| + | 802-3-ethernet.s390-options: | ||
| + | 802-3-ethernet.wake-on-lan: | ||
| + | 802-3-ethernet.wake-on-lan-password: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | ipv4.method: | ||
| + | ipv4.dns: | ||
| + | ipv4.dns-search: | ||
| + | ipv4.addresses: | ||
| + | ipv4.gateway: | ||
| + | ipv4.routes: | ||
| + | ipv4.route-metric: | ||
| + | ipv4.ignore-auto-routes: | ||
| + | ipv4.ignore-auto-dns: | ||
| + | ipv4.dhcp-client-id: | ||
| + | ipv4.dhcp-send-hostname: | ||
| + | ipv4.dhcp-hostname: | ||
| + | ipv4.never-default: | ||
| + | ipv4.may-fail: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | ipv6.method: | ||
| + | ipv6.dns: | ||
| + | ipv6.dns-search: | ||
| + | ipv6.addresses: | ||
| + | ipv6.gateway: | ||
| + | ipv6.routes: | ||
| + | ipv6.route-metric: | ||
| + | ipv6.ignore-auto-routes: | ||
| + | ipv6.ignore-auto-dns: | ||
| + | ipv6.never-default: | ||
| + | ipv6.may-fail: | ||
| + | ipv6.ip6-privacy: | ||
| + | ipv6.dhcp-send-hostname: | ||
| + | ipv6.dhcp-hostname: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | =============================================================================== | ||
| + | Activate connection details (fb3a11d9-4e03-4032-b26e-09d1195d2bcd) | ||
| + | =============================================================================== | ||
| + | GENERAL.NAME: | ||
| + | GENERAL.UUID: | ||
| + | GENERAL.DEVICES: | ||
| + | GENERAL.STATE: | ||
| + | GENERAL.DEFAULT: | ||
| + | GENERAL.DEFAULT6: | ||
| + | GENERAL.VPN: | ||
| + | GENERAL.ZONE: | ||
| + | GENERAL.DBUS-PATH: | ||
| + | GENERAL.CON-PATH: | ||
| + | GENERAL.SPEC-OBJECT: | ||
| + | GENERAL.MASTER-PATH: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | IP4.ADDRESS[1]: | ||
| + | IP4.GATEWAY: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | IP6.ADDRESS[1]: | ||
| + | IP6.GATEWAY: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | </ | ||
| + | |||
| + | Pour consulter la liste profils associés à un périphérique, | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli -f CONNECTIONS device show enp0s3 | ||
| + | CONNECTIONS.AVAILABLE-CONNECTION-PATHS: | ||
| + | CONNECTIONS.AVAILABLE-CONNECTIONS[1]: | ||
| + | CONNECTIONS.AVAILABLE-CONNECTIONS[2]: | ||
| + | </ | ||
| + | |||
| + | Les fichiers de configuration pour le periphérique **enp0s3** se trouvent dans le répertoire **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ls -l / | ||
| + | -rw-r--r--. 1 root root 296 Aug 8 11:08 ifcfg-ip_fixe | ||
| + | -rw-r--r--. 1 root root 254 Sep 16 2015 ifcfg-lo | ||
| + | </ | ||
| + | |||
| + | L' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# cat / | ||
| + | TYPE=Ethernet | ||
| + | BOOTPROTO=none | ||
| + | IPADDR=10.0.2.16 | ||
| + | PREFIX=24 | ||
| + | GATEWAY=10.0.2.2 | ||
| + | DEFROUTE=yes | ||
| + | IPV4_FAILURE_FATAL=no | ||
| + | IPV6INIT=yes | ||
| + | IPV6_AUTOCONF=yes | ||
| + | IPV6_DEFROUTE=yes | ||
| + | IPV6_PEERDNS=yes | ||
| + | IPV6_PEERROUTES=yes | ||
| + | IPV6_FAILURE_FATAL=no | ||
| + | NAME=ip_fixe | ||
| + | UUID=fb3a11d9-4e03-4032-b26e-09d1195d2bcd | ||
| + | DEVICE=enp0s3 | ||
| + | ONBOOT=yes | ||
| + | </ | ||
| + | |||
| + | La résolution des noms est donc inactive : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ping www.free.fr | ||
| + | ping: unknown host www.free.fr | ||
| + | </ | ||
| + | |||
| + | Modifiez donc la configuration du profil **ip_fixe** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli connection mod ip_fixe ipv4.dns 8.8.8.8 | ||
| + | </ | ||
| + | |||
| + | L' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# cat / | ||
| + | TYPE=Ethernet | ||
| + | BOOTPROTO=none | ||
| + | DEFROUTE=yes | ||
| + | IPV4_FAILURE_FATAL=no | ||
| + | IPV6INIT=yes | ||
| + | IPV6_AUTOCONF=yes | ||
| + | IPV6_DEFROUTE=yes | ||
| + | IPV6_FAILURE_FATAL=no | ||
| + | NAME=ip_fixe | ||
| + | UUID=fb3a11d9-4e03-4032-b26e-09d1195d2bcd | ||
| + | DEVICE=enp0s3 | ||
| + | ONBOOT=yes | ||
| + | IPADDR=10.0.2.16 | ||
| + | PREFIX=24 | ||
| + | GATEWAY=10.0.2.2 | ||
| + | DNS1=8.8.8.8 | ||
| + | IPV6_PEERDNS=yes | ||
| + | IPV6_PEERROUTES=yes | ||
| + | </ | ||
| + | |||
| + | Afin que la modification du serveur DNS soit prise en compte, re-démarrez le service NetworkManager : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# systemctl restart NetworkManager.service | ||
| + | [root@centos7 ~]# systemctl status NetworkManager.service | ||
| + | ● NetworkManager.service - Network Manager | ||
| + | | ||
| + | | ||
| + | Main PID: 8394 (NetworkManager) | ||
| + | | ||
| + | | ||
| + | |||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | </ | ||
| + | |||
| + | Vérifiez que le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# cat / | ||
| + | # Generated by NetworkManager | ||
| + | search fenestros.loc | ||
| + | nameserver 8.8.8.8 | ||
| + | </ | ||
| + | |||
| + | Dernièrement vérifiez la resolution des noms : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ping www.free.fr | ||
| + | PING www.free.fr (212.27.48.10) 56(84) bytes of data. | ||
| + | 64 bytes from www.free.fr (212.27.48.10): | ||
| + | 64 bytes from www.free.fr (212.27.48.10): | ||
| + | 64 bytes from www.free.fr (212.27.48.10): | ||
| + | ^C | ||
| + | --- www.free.fr ping statistics --- | ||
| + | 3 packets transmitted, | ||
| + | rtt min/ | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | **Important** : Notez qu'il existe un front-end graphique en mode texte, **nmtui**, pour configurer NetworkManager. | ||
| + | </ | ||
| + | |||
| + | ====Ajouter une Deuxième Adresse IP à un Profil==== | ||
| + | |||
| + | Pour ajouter une deuxième adresse IP à un profil sous RHEL/CentOS 7, il convient d' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli connection mod ip_fixe +ipv4.addresses 192.168.1.2/ | ||
| + | </ | ||
| + | |||
| + | Redémarrez la machine virtuelle puis en tant que root saisissez la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli connection show ip_fixe | ||
| + | connection.id: | ||
| + | connection.uuid: | ||
| + | connection.interface-name: | ||
| + | connection.type: | ||
| + | connection.autoconnect: | ||
| + | connection.autoconnect-priority: | ||
| + | connection.timestamp: | ||
| + | connection.read-only: | ||
| + | connection.permissions: | ||
| + | connection.zone: | ||
| + | connection.master: | ||
| + | connection.slave-type: | ||
| + | connection.autoconnect-slaves: | ||
| + | connection.secondaries: | ||
| + | connection.gateway-ping-timeout: | ||
| + | connection.metered: | ||
| + | 802-3-ethernet.port: | ||
| + | 802-3-ethernet.speed: | ||
| + | 802-3-ethernet.duplex: | ||
| + | 802-3-ethernet.auto-negotiate: | ||
| + | 802-3-ethernet.mac-address: | ||
| + | 802-3-ethernet.cloned-mac-address: | ||
| + | 802-3-ethernet.mac-address-blacklist: | ||
| + | 802-3-ethernet.mtu: | ||
| + | 802-3-ethernet.s390-subchannels: | ||
| + | 802-3-ethernet.s390-nettype: | ||
| + | 802-3-ethernet.s390-options: | ||
| + | 802-3-ethernet.wake-on-lan: | ||
| + | 802-3-ethernet.wake-on-lan-password: | ||
| + | ipv4.method: | ||
| + | ipv4.dns: | ||
| + | ipv4.dns-search: | ||
| + | ipv4.addresses: | ||
| + | ipv4.gateway: | ||
| + | ipv4.routes: | ||
| + | ipv4.route-metric: | ||
| + | ipv4.ignore-auto-routes: | ||
| + | ipv4.ignore-auto-dns: | ||
| + | ipv4.dhcp-client-id: | ||
| + | ipv4.dhcp-send-hostname: | ||
| + | ipv4.dhcp-hostname: | ||
| + | ipv4.never-default: | ||
| + | ipv4.may-fail: | ||
| + | ipv6.method: | ||
| + | ipv6.dns: | ||
| + | ipv6.dns-search: | ||
| + | ipv6.addresses: | ||
| + | ipv6.gateway: | ||
| + | ipv6.routes: | ||
| + | ipv6.route-metric: | ||
| + | ipv6.ignore-auto-routes: | ||
| + | ipv6.ignore-auto-dns: | ||
| + | ipv6.never-default: | ||
| + | ipv6.may-fail: | ||
| + | ipv6.ip6-privacy: | ||
| + | ipv6.dhcp-send-hostname: | ||
| + | ipv6.dhcp-hostname: | ||
| + | GENERAL.NAME: | ||
| + | GENERAL.UUID: | ||
| + | GENERAL.DEVICES: | ||
| + | GENERAL.STATE: | ||
| + | GENERAL.DEFAULT: | ||
| + | GENERAL.DEFAULT6: | ||
| + | GENERAL.VPN: | ||
| + | GENERAL.ZONE: | ||
| + | GENERAL.DBUS-PATH: | ||
| + | GENERAL.CON-PATH: | ||
| + | GENERAL.SPEC-OBJECT: | ||
| + | GENERAL.MASTER-PATH: | ||
| + | IP4.ADDRESS[1]: | ||
| + | IP4.ADDRESS[2]: | ||
| + | IP4.GATEWAY: | ||
| + | IP4.DNS[1]: | ||
| + | IP6.ADDRESS[1]: | ||
| + | IP6.GATEWAY: | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | **Important** : Notez l' | ||
| + | </ | ||
| + | |||
| + | Consultez maintenant le contenu du fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# cat / | ||
| + | TYPE=Ethernet | ||
| + | BOOTPROTO=none | ||
| + | DEFROUTE=yes | ||
| + | IPV4_FAILURE_FATAL=no | ||
| + | IPV6INIT=yes | ||
| + | IPV6_AUTOCONF=yes | ||
| + | IPV6_DEFROUTE=yes | ||
| + | IPV6_FAILURE_FATAL=no | ||
| + | NAME=ip_fixe | ||
| + | UUID=fb3a11d9-4e03-4032-b26e-09d1195d2bcd | ||
| + | DEVICE=enp0s3 | ||
| + | ONBOOT=yes | ||
| + | DNS1=8.8.8.8 | ||
| + | IPADDR=10.0.2.16 | ||
| + | PREFIX=24 | ||
| + | IPADDR1=192.168.1.2 | ||
| + | PREFIX1=24 | ||
| + | GATEWAY=10.0.2.2 | ||
| + | IPV6_PEERDNS=yes | ||
| + | IPV6_PEERROUTES=yes | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | **Important** : Notez l' | ||
| + | </ | ||
| + | |||
| + | ====La Commande hostname==== | ||
| + | |||
| + | La procédure de la modification du hostname est simplifiée et sa prise en compte est immédiate : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli general hostname centos.fenestros.loc | ||
| + | [root@centos7 ~]# cat / | ||
| + | centos.fenestros.loc | ||
| + | [root@centos7 ~]# hostname | ||
| + | centos.fenestros.loc | ||
| + | [root@centos7 ~]# nmcli general hostname centos7.fenestros.loc | ||
| + | [root@centos7 ~]# cat / | ||
| + | centos7.fenestros.loc | ||
| + | [root@centos7 ~]# hostname | ||
| + | centos7.fenestros.loc | ||
| + | </ | ||
| + | |||
| + | ====La Commande ip==== | ||
| + | |||
| + | Sous RHEL/CentOS 7 la commande **ip** est préférée par rapport à la commande ifconfig : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ip address | ||
| + | 1: lo: < | ||
| + | link/ | ||
| + | inet 127.0.0.1/8 scope host lo | ||
| + | | ||
| + | inet6 ::1/128 scope host | ||
| + | | ||
| + | 2: enp0s3: < | ||
| + | link/ether 08: | ||
| + | inet 10.0.2.16/ | ||
| + | | ||
| + | inet 192.168.1.2/ | ||
| + | | ||
| + | inet6 fe80:: | ||
| + | | ||
| + | [root@centos7 ~]# ip addr | ||
| + | 1: lo: < | ||
| + | link/ | ||
| + | inet 127.0.0.1/8 scope host lo | ||
| + | | ||
| + | inet6 ::1/128 scope host | ||
| + | | ||
| + | 2: enp0s3: < | ||
| + | link/ether 08: | ||
| + | inet 10.0.2.16/ | ||
| + | | ||
| + | inet 192.168.1.2/ | ||
| + | | ||
| + | inet6 fe80:: | ||
| + | | ||
| + | </ | ||
| + | |||
| + | ===Options de la Commande ip=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ip --help | ||
| + | Usage: ip [ OPTIONS ] OBJECT { COMMAND | help } | ||
| + | ip [ -force ] -batch filename | ||
| + | where OBJECT := { link | addr | addrlabel | route | rule | neigh | ntable | | ||
| + | | ||
| + | netns | l2tp | tcp_metrics | token } | ||
| + | | ||
| + | -f[amily] { inet | inet6 | ipx | dnet | bridge | link } | | ||
| + | -4 | -6 | -I | -D | -B | -0 | | ||
| + | -l[oops] { maximum-addr-flush-attempts } | | ||
| + | -o[neline] | -t[imestamp] | -b[atch] [filename] | | ||
| + | -rc[vbuf] [size]} | ||
| + | |||
| + | </ | ||
| + | |||
| + | ====Activer/ | ||
| + | |||
| + | Deux commandes existent pour désactiver et activer manuellement une interface réseau : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli device disconnect enp0s3 | ||
| + | [root@centos7 ~]# nmcli device connect enp0s3 | ||
| + | </ | ||
| + | |||
| + | ====Routage Statique==== | ||
| + | |||
| + | ===La commande ip=== | ||
| + | |||
| + | Sous RHEL/CentOS 7, pour supprimer la route vers le réseau 192.168.1.0 il convient d' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ip route | ||
| + | default via 10.0.2.2 dev enp0s3 | ||
| + | 10.0.2.0/24 dev enp0s3 | ||
| + | 192.168.1.0/ | ||
| + | |||
| + | [root@centos7 ~]# ip route del 192.168.1.0/ | ||
| + | |||
| + | [root@centos7 ~]# ip route | ||
| + | default via 10.0.2.2 dev enp0s3 | ||
| + | 10.0.2.0/24 dev enp0s3 | ||
| + | </ | ||
| + | |||
| + | Pour ajouter la route vers le réseau 192.168.1.0 : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ip route add 192.168.1.0/ | ||
| + | |||
| + | [root@centos7 ~]# ip route | ||
| + | default via 10.0.2.2 dev enp0s3 | ||
| + | 10.0.2.0/24 dev enp0s3 | ||
| + | 192.168.1.0/ | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | La commande utilisée pour ajouter une passerelle par défaut prend la forme suivante **ip route add default via //adresse ip//**. | ||
| + | </ | ||
| + | |||
| + | ===Activer/ | ||
| + | |||
| + | Pour activer le routage sur le serveur, il convient d' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# echo 1 > / | ||
| + | [root@centos7 ~]# cat / | ||
| + | 1 | ||
| + | </ | ||
| + | |||
| + | Pour désactiver le routage sur le serveur, il convient de désactiver la retransmission des paquets: | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# echo 0 > / | ||
| + | [root@centos7 ~]# cat / | ||
| + | 0 | ||
| + | </ | ||
| + | |||
| + | =====Diagnostique du Réseau===== | ||
| + | |||
| + | ====ping==== | ||
| + | |||
| + | Pour tester l' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ping 10.0.2.2 | ||
| + | PING 10.0.2.2 (10.0.2.2) 56(84) bytes of data. | ||
| + | 64 bytes from 10.0.2.2: icmp_seq=1 ttl=63 time=0.602 ms | ||
| + | 64 bytes from 10.0.2.2: icmp_seq=2 ttl=63 time=0.375 ms | ||
| + | 64 bytes from 10.0.2.2: icmp_seq=3 ttl=63 time=0.512 ms | ||
| + | 64 bytes from 10.0.2.2: icmp_seq=4 ttl=63 time=0.547 ms | ||
| + | ^C | ||
| + | --- 10.0.2.2 ping statistics --- | ||
| + | 4 packets transmitted, | ||
| + | rtt min/ | ||
| + | </ | ||
| + | |||
| + | ===Options de la commande ping=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ping --help | ||
| + | ping: invalid option -- ' | ||
| + | Usage: ping [-aAbBdDfhLnOqrRUvV] [-c count] [-i interval] [-I interface] | ||
| + | [-m mark] [-M pmtudisc_option] [-l preload] [-p pattern] [-Q tos] | ||
| + | [-s packetsize] [-S sndbuf] [-t ttl] [-T timestamp_option] | ||
| + | [-w deadline] [-W timeout] [hop1 ...] destination | ||
| + | </ | ||
| + | |||
| + | ====netstat -i==== | ||
| + | |||
| + | Pour visualiser les statistiques réseaux, vous disposez de la commande **netstat** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# netstat -i | ||
| + | Kernel Interface table | ||
| + | Iface MTU RX-OK RX-ERR RX-DRP RX-OVR | ||
| + | enp0s3 | ||
| + | lo | ||
| + | </ | ||
| + | |||
| + | ===Options de la commande netstat=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# netstat --help | ||
| + | usage: netstat [-vWeenNcCF] [< | ||
| + | | ||
| + | | ||
| + | |||
| + | -r, --route | ||
| + | -I, --interfaces=< | ||
| + | -i, --interfaces | ||
| + | -g, --groups | ||
| + | -s, --statistics | ||
| + | -M, --masquerade | ||
| + | |||
| + | -v, --verbose | ||
| + | -W, --wide | ||
| + | -n, --numeric | ||
| + | --numeric-hosts | ||
| + | --numeric-ports | ||
| + | --numeric-users | ||
| + | -N, --symbolic | ||
| + | -e, --extend | ||
| + | -p, --programs | ||
| + | -o, --timers | ||
| + | -c, --continuous | ||
| + | |||
| + | -l, --listening | ||
| + | -a, --all display all sockets (default: connected) | ||
| + | -F, --fib display Forwarding Information Base (default) | ||
| + | -C, --cache | ||
| + | -Z, --context | ||
| + | |||
| + | < | ||
| + | | ||
| + | < | ||
| + | List of possible address families (which support routing): | ||
| + | inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25) | ||
| + | netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP) | ||
| + | x25 (CCITT X.25) | ||
| + | </ | ||
| + | |||
| + | ====La commande traceroute==== | ||
| + | |||
| + | La commande ping est à la base de la commande **traceroute**. Cette commande sert à découvrir la route empruntée pour accéder à un site donné : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# traceroute www.i2tch.eu | ||
| + | traceroute to www.i2tch.eu (217.160.122.33), | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | 10 * * * | ||
| + | 11 * * * | ||
| + | 12 * * * | ||
| + | 13 * * * | ||
| + | 14 * * * | ||
| + | 15 * * * | ||
| + | 16 * * * | ||
| + | 17 * * * | ||
| + | 18 * * * | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | ===Options de la commande traceroute=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# traceroute --help | ||
| + | Usage: | ||
| + | traceroute [ -46dFITnreAUDV ] [ -f first_ttl ] [ -g gate,... ] [ -i device ] [ -m max_ttl ] [ -N squeries ] [ -p port ] [ -t tos ] [ -l flow_label ] [ -w waittime ] [ -q nqueries ] [ -s src_addr ] [ -z sendwait ] [ --fwmark=num ] host [ packetlen ] | ||
| + | Options: | ||
| + | -4 Use IPv4 | ||
| + | -6 Use IPv6 | ||
| + | -d --debug | ||
| + | -F --dont-fragment | ||
| + | -f first_ttl | ||
| + | Start from the first_ttl hop (instead from 1) | ||
| + | -g gate, | ||
| + | Route packets through the specified gateway | ||
| + | (maximum 8 for IPv4 and 127 for IPv6) | ||
| + | -I --icmp | ||
| + | -T --tcp Use TCP SYN for tracerouting (default port is 80) | ||
| + | -i device | ||
| + | Specify a network interface to operate with | ||
| + | -m max_ttl | ||
| + | Set the max number of hops (max TTL to be | ||
| + | reached). Default is 30 | ||
| + | -N squeries | ||
| + | Set the number of probes to be tried | ||
| + | simultaneously (default is 16) | ||
| + | -n Do not resolve IP addresses to their domain names | ||
| + | -p port --port=port | ||
| + | initial udp port value for " | ||
| + | (incremented by each probe, default is 33434), or | ||
| + | initial seq for " | ||
| + | default from 1), or some constant destination | ||
| + | port for other methods (with default of 80 for | ||
| + | " | ||
| + | -t tos --tos=tos | ||
| + | traffic class) value for outgoing packets | ||
| + | -l flow_label | ||
| + | Use specified flow_label for IPv6 packets | ||
| + | -w waittime | ||
| + | Set the number of seconds to wait for response to | ||
| + | a probe (default is 5.0). Non-integer (float | ||
| + | point) values allowed too | ||
| + | -q nqueries | ||
| + | Set the number of probes per each hop. Default is | ||
| + | 3 | ||
| + | -r Bypass the normal routing and send directly to a | ||
| + | host on an attached network | ||
| + | -s src_addr | ||
| + | Use source src_addr for outgoing packets | ||
| + | -z sendwait | ||
| + | Minimal time interval between probes (default 0). | ||
| + | If the value is more than 10, then it specifies a | ||
| + | number in milliseconds, | ||
| + | seconds (float point values allowed too) | ||
| + | -e --extensions | ||
| + | -A --as-path-lookups | ||
| + | print results directly after the corresponding | ||
| + | addresses | ||
| + | -M name --module=name | ||
| + | for traceroute operations. Most methods have | ||
| + | their shortcuts (`-I' means `-M icmp' etc.) | ||
| + | -O OPTS, | ||
| + | Use module-specific option OPTS for the | ||
| + | traceroute module. Several OPTS allowed, | ||
| + | separated by comma. If OPTS is " | ||
| + | about available options | ||
| + | --sport=num | ||
| + | `-N 1' | ||
| + | --fwmark=num | ||
| + | -U --udp Use UDP to particular port for tracerouting | ||
| + | (instead of increasing the port per each probe), | ||
| + | default port is 53 | ||
| + | -UL Use UDPLITE for tracerouting (default dest port | ||
| + | is 53) | ||
| + | -D --dccp | ||
| + | is 33434) | ||
| + | -P prot --protocol=prot | ||
| + | --mtu | ||
| + | `-F -N 1' | ||
| + | --back | ||
| + | print if it differs | ||
| + | -V --version | ||
| + | --help | ||
| + | |||
| + | Arguments: | ||
| + | + | ||
| + | packetlen | ||
| + | header plus 40). Can be ignored or increased to a minimal | ||
| + | allowed value | ||
| + | </ | ||
| + | |||
| + | =====Connexions à Distance===== | ||
| + | |||
| + | ==== Telnet ==== | ||
| + | |||
| + | <WRAP center round important> | ||
| + | La commande **telnet** n'est pas installée par défaut sous CentOS 7. Installez-le à l'aide de la commande **yum install telnet** en tant que root. | ||
| + | </ | ||
| + | |||
| + | La commande **telnet** est utilisée pour établir une connexion à distance avec un serveur telnet : | ||
| + | |||
| + | < | ||
| + | # telnet numero_ip | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | Le service telnet revient à une redirection des canaux standards d' | ||
| + | </ | ||
| + | |||
| + | ===Options de la commande telnet=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# telnet --help | ||
| + | telnet: invalid option -- ' | ||
| + | Usage: telnet [-8] [-E] [-L] [-S tos] [-a] [-c] [-d] [-e char] [-l user] | ||
| + | [-n tracefile] [-b hostalias ] [-r] | ||
| + | | ||
| + | </ | ||
| + | |||
| + | ==== wget ==== | ||
| + | |||
| + | La commande **wget** est utilisée pour récupérer un fichier via http, https ou ftp : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# wget https:// | ||
| + | --2017-06-22 16: | ||
| + | Resolving www.dropbox.com (www.dropbox.com)... 162.125.65.1 | ||
| + | Connecting to www.dropbox.com (www.dropbox.com)|162.125.65.1|: | ||
| + | HTTP request sent, awaiting response... 302 Found | ||
| + | Location: https:// | ||
| + | --2017-06-22 16: | ||
| + | Resolving dl.dropboxusercontent.com (dl.dropboxusercontent.com)... 162.125.65.6 | ||
| + | Connecting to dl.dropboxusercontent.com (dl.dropboxusercontent.com)|162.125.65.6|: | ||
| + | HTTP request sent, awaiting response... 200 OK | ||
| + | Length: 17 [text/ | ||
| + | Saving to: ‘fichier_test? | ||
| + | |||
| + | 100%[====================================================================================> | ||
| + | |||
| + | 2017-06-22 16:53:41 (480 KB/s) - ‘fichier_test? | ||
| + | </ | ||
| + | |||
| + | ===Options de la commande wget=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# wget --help | ||
| + | GNU Wget 1.14, a non-interactive network retriever. | ||
| + | Usage: wget [OPTION]... [URL]... | ||
| + | |||
| + | Mandatory arguments to long options are mandatory for short options too. | ||
| + | |||
| + | Startup: | ||
| + | -V, --version | ||
| + | -h, --help | ||
| + | -b, --background | ||
| + | -e, --execute=COMMAND | ||
| + | |||
| + | Logging and input file: | ||
| + | -o, --output-file=FILE | ||
| + | -a, --append-output=FILE | ||
| + | -d, --debug | ||
| + | -q, --quiet | ||
| + | -v, --verbose | ||
| + | -nv, --no-verbose | ||
| + | | ||
| + | -i, --input-file=FILE | ||
| + | -F, --force-html | ||
| + | -B, --base=URL | ||
| + | | ||
| + | | ||
| + | |||
| + | Download: | ||
| + | -t, --tries=NUMBER | ||
| + | | ||
| + | -O, --output-document=FILE | ||
| + | -nc, --no-clobber | ||
| + | | ||
| + | -c, --continue | ||
| + | | ||
| + | -N, --timestamping | ||
| + | | ||
| + | --no-use-server-timestamps | ||
| + | the one on the server. | ||
| + | -S, --server-response | ||
| + | | ||
| + | -T, --timeout=SECONDS | ||
| + | | ||
| + | | ||
| + | | ||
| + | -w, --wait=SECONDS | ||
| + | | ||
| + | | ||
| + | | ||
| + | -Q, --quota=NUMBER | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | -4, --inet4-only | ||
| + | -6, --inet6-only | ||
| + | | ||
| + | one of IPv6, IPv4, or none. | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Directories: | ||
| + | -nd, --no-directories | ||
| + | -x, --force-directories | ||
| + | -nH, --no-host-directories | ||
| + | | ||
| + | -P, --directory-prefix=PREFIX | ||
| + | | ||
| + | |||
| + | HTTP options: | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | this is `index.html' | ||
| + | -E, --adjust-extension | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | -U, --user-agent=AGENT | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | HTTPS (SSL/TLS) options: | ||
| + | | ||
| + | SSLv3, and TLSv1. | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | FTP options: | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | WARC options: | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | WARC writer. | ||
| + | |||
| + | Recursive download: | ||
| + | -r, --recursive | ||
| + | -l, --level=NUMBER | ||
| + | | ||
| + | -k, --convert-links | ||
| + | local files. | ||
| + | --backups=N | ||
| + | -K, --backup-converted | ||
| + | -m, --mirror | ||
| + | -p, --page-requisites | ||
| + | | ||
| + | |||
| + | Recursive accept/ | ||
| + | -A, --accept=LIST | ||
| + | -R, --reject=LIST | ||
| + | | ||
| + | | ||
| + | | ||
| + | -D, --domains=LIST | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | -H, --span-hosts | ||
| + | -L, --relative | ||
| + | -I, --include-directories=LIST | ||
| + | --trust-server-names | ||
| + | url last component. | ||
| + | -X, --exclude-directories=LIST | ||
| + | -np, --no-parent | ||
| + | |||
| + | Mail bug reports and suggestions to < | ||
| + | </ | ||
| + | |||
| + | ==== ftp ==== | ||
| + | |||
| + | <WRAP center round important> | ||
| + | La commande **ftp** n'est pas installée par défaut sous CentOS 7. Installez-le à l'aide de la commande **yum install ftp** en tant que root. | ||
| + | </ | ||
| + | |||
| + | La commande **ftp** est utilisée pour le transfert de fichiers: | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ftp ftp2.fenestros.com | ||
| + | Connected to ftp2.fenestros.com (213.186.33.14). | ||
| + | 220 anonymous.ftp.ovh.net NcFTPd Server (licensed copy) ready. | ||
| + | Name (ftp2.fenestros.com: | ||
| + | 331 Guest login ok, send your complete e-mail address as password. | ||
| + | Password: | ||
| + | 230 Logged in anonymously. | ||
| + | Remote system type is UNIX. | ||
| + | Using binary mode to transfer files. | ||
| + | ftp> | ||
| + | </ | ||
| + | |||
| + | Une fois connecté, il convient d' | ||
| + | |||
| + | < | ||
| + | ftp> help | ||
| + | Commands may be abbreviated. | ||
| + | |||
| + | ! debug mdir sendport site | ||
| + | $ dir mget put size | ||
| + | account disconnect mkdir pwd status | ||
| + | append exit mls quit struct | ||
| + | ascii form mode quote system | ||
| + | bell get modtime recv sunique | ||
| + | binary glob mput reget tenex | ||
| + | bye hash newer rstatus tick | ||
| + | case help nmap rhelp trace | ||
| + | cd idle nlist rename type | ||
| + | cdup image ntrans reset user | ||
| + | chmod lcd open restart umask | ||
| + | close ls prompt rmdir verbose | ||
| + | cr macdef passive runique ? | ||
| + | delete mdelete proxy send | ||
| + | ftp> | ||
| + | </ | ||
| + | |||
| + | Le caractère **!** permet d' | ||
| + | |||
| + | < | ||
| + | ftp> !pwd | ||
| + | /root | ||
| + | </ | ||
| + | |||
| + | Pour transférer un fichier vers le serveur, il convient d' | ||
| + | |||
| + | < | ||
| + | ftp> put nom_fichier_local nom_fichier_distant | ||
| + | </ | ||
| + | |||
| + | Vous pouvez également transférer plusieurs fichiers à la fois grâce à la commande **mput**. Dans ce cas précis, il convient de saisir la commande suivante: | ||
| + | |||
| + | < | ||
| + | ftp> mput nom*.* | ||
| + | </ | ||
| + | |||
| + | Pour transférer un fichier du serveur, il convient d' | ||
| + | |||
| + | < | ||
| + | ftp> get nom_fichier | ||
| + | </ | ||
| + | |||
| + | Vous pouvez également transférer plusieurs fichiers à la fois grâce à la commande **mget** ( voir la commande **mput** ci-dessus ). | ||
| + | |||
| + | Pour supprimer un fichier sur le serveur, il convient d' | ||
| + | |||
| + | < | ||
| + | ftp> del nom_fichier | ||
| + | </ | ||
| + | |||
| + | Pour fermer la session, il convient d' | ||
| + | |||
| + | < | ||
| + | ftp> quit | ||
| + | [root@centos7 ~]# | ||
| + | </ | ||
| + | |||
| + | ====SSH==== | ||
| + | |||
| + | ===Introduction=== | ||
| + | |||
| + | La commande **[[wpfr> | ||
| + | |||
| + | * Le **serveur SSH** | ||
| + | * le démon sshd, qui s' | ||
| + | * Le **client SSH** | ||
| + | * ssh ou scp, qui assure la connexion et le dialogue avec le serveur, | ||
| + | * La **session** qui représente la connexion courante et qui commence juste après l' | ||
| + | * Les **clefs** | ||
| + | * **Couple de clef utilisateur asymétriques** et persistantes qui assurent l' | ||
| + | * **Clef hôte asymétrique et persistante** garantissant l' | ||
| + | * **Clef serveur asymétrique et temporaire** utilisée par le protocole SSH1 qui sert au chiffrement de la clé de session, | ||
| + | * **Clef de session symétrique qui est générée aléatoirement** et qui permet le chiiffrement de la communication entre le client et le serveur. Elle est détruite en fin de session. SSH-1 utilise une seule clef tandis que SSH-2 utilise une clef par direction de la communication, | ||
| + | * La **base de données des hôtes connus** qui stocke les clés des connexions précédentes. | ||
| + | |||
| + | SSH fonctionne de la manière suivante pour la la mise en place d'un canal sécurisé: | ||
| + | |||
| + | * Le client contacte le serveur sur son port 22, | ||
| + | * Les client et le serveur échangent leur version de SSH. En cas de non-compatibilité de versions, l'un des deux met fin au processus, | ||
| + | * Le serveur SSH s' | ||
| + | * Sa clé hôte, | ||
| + | * Sa clé serveur, | ||
| + | * Une séquence aléatoire de huit octets à inclure dans les futures réponses du client, | ||
| + | * Une liste de méthodes de chiffrage, compression et authentification, | ||
| + | * Le client et le serveur produisent un identifiant identique, un haché MD5 long de 128 bits contenant la clé hôte, la clé serveur et la séquence aléatoire, | ||
| + | * Le client génère sa clé de session symétrique et la chiffre deux fois de suite, une fois avec la clé hôte du serveur et la deuxième fois avec la clé serveur. Le client envoie cette clé au serveur accompagnée de la séquence aléatoire et un choix d' | ||
| + | * Le serveur déchiffre la clé de session, | ||
| + | * Le client et le serveur mettent en place le canal sécurisé. | ||
| + | |||
| + | ==SSH-1== | ||
| + | |||
| + | SSH-1 utilise une paire de clefs de type RSA1. Il assure l' | ||
| + | |||
| + | Afin de s' | ||
| + | |||
| + | * **Kerberos**, | ||
| + | * **Rhosts**, | ||
| + | * **%%RhostsRSA%%**, | ||
| + | * Par **clef asymétrique**, | ||
| + | * **TIS**, | ||
| + | * Par **mot de passe**. | ||
| + | |||
| + | ==SSH-2== | ||
| + | |||
| + | SSH-2 utilise **DSA** ou **RSA**. Il assure l' | ||
| + | |||
| + | * **SSH-TRANS** – Transport Layer Protocol, | ||
| + | * **SSH-AUTH** – Authentification Protocol, | ||
| + | * **SSH-CONN** – Connection Protocol. | ||
| + | |||
| + | SSH-2 diffère de SSH-1 essentiellement dans la phase authentification. | ||
| + | |||
| + | Trois méthodes d' | ||
| + | |||
| + | * Par **clef asymétrique**, | ||
| + | * Identique à SSH-1 sauf avec l' | ||
| + | * **%%RhostsRSA%%**, | ||
| + | * Par **mot de passe**. | ||
| + | |||
| + | ==Options de la commande== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# ssh --help | ||
| + | usage: ssh [-1246AaCfgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec] | ||
| + | [-D [bind_address: | ||
| + | [-i identity_file] [-L [bind_address: | ||
| + | [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port] | ||
| + | [-R [bind_address: | ||
| + | [-w local_tun[: | ||
| + | </ | ||
| + | |||
| + | ===L' | ||
| + | |||
| + | L' | ||
| + | |||
| + | Avantage: | ||
| + | * Aucune configuration de clef asymétrique n'est nécessaire. | ||
| + | |||
| + | Inconvénients: | ||
| + | * L' | ||
| + | * Moins sécurisé qu'un système par clef asymétrique. | ||
| + | |||
| + | ===L' | ||
| + | |||
| + | * Le **client** envoie au serveur une requête d' | ||
| + | * Le **serveur** recherche une correspondance pour ce module dans le fichier des clés autorisés **~/ | ||
| + | * Dans le cas où une correspondance n'est pas trouvée, le serveur met fin à la communication, | ||
| + | * Dans le cas contraire le serveur génère une chaîne aléatoire de 256 bits appelée un **challenge** et la chiffre avec la **clé publique du client**, | ||
| + | * Le **client** reçoit le challenge et le décrypte avec la partie privée de sa clé. Il combine le challenge avec l' | ||
| + | * Le **serveur** génère le même haché et le compare avec celui reçu du client. Si les deux hachés sont identiques, l' | ||
| + | |||
| + | ===Installation=== | ||
| + | |||
| + | Pour installer/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# yum install openssh-server | ||
| + | Loaded plugins: fastestmirror, | ||
| + | Loading mirror speeds from cached hostfile | ||
| + | * base: centos.mirror.fr.planethoster.net | ||
| + | * extras: ftp.ciril.fr | ||
| + | * updates: centos.mirrors.ovh.net | ||
| + | Package openssh-server-6.6.1p1-25.el7_2.x86_64 already installed and latest version | ||
| + | Nothing to do | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | **Important** - Pour les stations de travail, installez le client : **openssh-clients**. | ||
| + | </ | ||
| + | |||
| + | ==Options de la commande== | ||
| + | |||
| + | Les options de la commande sont : | ||
| + | |||
| + | < | ||
| + | SYNOPSIS | ||
| + | sshd [-46DdeiqTt] [-b bits] [-C connection_spec] [-f config_file] [-g login_grace_time] [-h host_key_file] [-k key_gen_time] [-o option] [-p port] [-u len] | ||
| + | </ | ||
| + | |||
| + | ===Configuration=== | ||
| + | |||
| + | <WRAP center round important> | ||
| + | **Important** - La configuration doit s' | ||
| + | </ | ||
| + | |||
| + | ==Serveur== | ||
| + | |||
| + | La configuration du serveur s' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# cat / | ||
| + | # $OpenBSD: sshd_config, | ||
| + | |||
| + | # This is the sshd server system-wide configuration file. See | ||
| + | # sshd_config(5) for more information. | ||
| + | |||
| + | # This sshd was compiled with PATH=/ | ||
| + | |||
| + | # The strategy used for options in the default sshd_config shipped with | ||
| + | # OpenSSH is to specify options with their default value where | ||
| + | # possible, but leave them commented. | ||
| + | # default value. | ||
| + | |||
| + | # If you want to change the port on a SELinux system, you have to tell | ||
| + | # SELinux about this change. | ||
| + | # semanage port -a -t ssh_port_t -p tcp #PORTNUMBER | ||
| + | # | ||
| + | #Port 22 | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # The default requires explicit activation of protocol 1 | ||
| + | #Protocol 2 | ||
| + | |||
| + | # HostKey for protocol version 1 | ||
| + | #HostKey / | ||
| + | # HostKeys for protocol version 2 | ||
| + | HostKey / | ||
| + | #HostKey / | ||
| + | HostKey / | ||
| + | HostKey / | ||
| + | |||
| + | # Lifetime and size of ephemeral version 1 server key | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Ciphers and keying | ||
| + | #RekeyLimit default none | ||
| + | |||
| + | # Logging | ||
| + | # obsoletes QuietMode and FascistLogging | ||
| + | # | ||
| + | SyslogFacility AUTHPRIV | ||
| + | #LogLevel INFO | ||
| + | |||
| + | # Authentication: | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # | ||
| + | # | ||
| + | |||
| + | # The default is to check both .ssh/ | ||
| + | # but this is overridden so installations will only check .ssh/ | ||
| + | AuthorizedKeysFile .ssh/ | ||
| + | |||
| + | # | ||
| + | |||
| + | # | ||
| + | # | ||
| + | |||
| + | # For this to work you will also need host keys in / | ||
| + | # | ||
| + | # similar for protocol version 2 | ||
| + | # | ||
| + | # Change to yes if you don't trust ~/ | ||
| + | # RhostsRSAAuthentication and HostbasedAuthentication | ||
| + | # | ||
| + | # Don't read the user's ~/.rhosts and ~/.shosts files | ||
| + | # | ||
| + | |||
| + | # To disable tunneled clear text passwords, change to no here! | ||
| + | # | ||
| + | # | ||
| + | PasswordAuthentication yes | ||
| + | |||
| + | # Change to no to disable s/key passwords | ||
| + | # | ||
| + | ChallengeResponseAuthentication no | ||
| + | |||
| + | # Kerberos options | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # GSSAPI options | ||
| + | GSSAPIAuthentication yes | ||
| + | GSSAPICleanupCredentials no | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set this to ' | ||
| + | # and session processing. If this is enabled, PAM authentication will | ||
| + | # be allowed through the ChallengeResponseAuthentication and | ||
| + | # PasswordAuthentication. | ||
| + | # PAM authentication via ChallengeResponseAuthentication may bypass | ||
| + | # the setting of " | ||
| + | # If you just want the PAM account and session checks to run without | ||
| + | # PAM authentication, | ||
| + | # and ChallengeResponseAuthentication to ' | ||
| + | # WARNING: ' | ||
| + | # problems. | ||
| + | UsePAM yes | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | X11Forwarding yes | ||
| + | # | ||
| + | # | ||
| + | #PermitTTY yes | ||
| + | #PrintMotd yes | ||
| + | # | ||
| + | # | ||
| + | #UseLogin no | ||
| + | UsePrivilegeSeparation sandbox # Default for new installations. | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #UseDNS yes | ||
| + | #PidFile / | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # no default banner path | ||
| + | #Banner none | ||
| + | |||
| + | # Accept locale-related environment variables | ||
| + | AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES | ||
| + | AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT | ||
| + | AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE | ||
| + | AcceptEnv XMODIFIERS | ||
| + | |||
| + | # override default of no subsystems | ||
| + | Subsystem sftp / | ||
| + | |||
| + | # Example of overriding settings on a per-user basis | ||
| + | #Match User anoncvs | ||
| + | # | ||
| + | # | ||
| + | # PermitTTY no | ||
| + | # | ||
| + | </ | ||
| + | |||
| + | Pour ôter les lignes de commentaires dans ce fichier, utilisez la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# cd /tmp ; grep -E -v ' | ||
| + | [root@centos7 tmp]# cat sshd_config | ||
| + | HostKey / | ||
| + | HostKey / | ||
| + | HostKey / | ||
| + | SyslogFacility AUTHPRIV | ||
| + | AuthorizedKeysFile .ssh/ | ||
| + | PasswordAuthentication yes | ||
| + | ChallengeResponseAuthentication no | ||
| + | GSSAPIAuthentication yes | ||
| + | GSSAPICleanupCredentials no | ||
| + | UsePAM yes | ||
| + | X11Forwarding yes | ||
| + | UsePrivilegeSeparation sandbox # Default for new installations. | ||
| + | AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES | ||
| + | AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT | ||
| + | AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE | ||
| + | AcceptEnv XMODIFIERS | ||
| + | Subsystem sftp / | ||
| + | </ | ||
| + | |||
| + | Pour sécuriser le serveur ssh, ajoutez ou modifiez les directives suivantes : | ||
| + | |||
| + | < | ||
| + | AllowGroups adm | ||
| + | Banner / | ||
| + | HostbasedAuthentication no | ||
| + | IgnoreRhosts yes | ||
| + | LoginGraceTime 60 | ||
| + | LogLevel INFO | ||
| + | PermitEmptyPasswords no | ||
| + | PermitRootLogin no | ||
| + | PrintLastLog yes | ||
| + | Protocol 2 | ||
| + | StrictModes yes | ||
| + | X11Forwarding no | ||
| + | </ | ||
| + | |||
| + | Votre fichier ressemblera à celui-ci : | ||
| + | |||
| + | < | ||
| + | AllowGroups adm | ||
| + | Banner / | ||
| + | HostbasedAuthentication no | ||
| + | IgnoreRhosts yes | ||
| + | LoginGraceTime 60 | ||
| + | LogLevel INFO | ||
| + | PermitEmptyPasswords no | ||
| + | PermitRootLogin no | ||
| + | PrintLastLog yes | ||
| + | Protocol 2 | ||
| + | StrictModes yes | ||
| + | X11Forwarding no | ||
| + | HostKey / | ||
| + | HostKey / | ||
| + | HostKey / | ||
| + | SyslogFacility AUTHPRIV | ||
| + | AuthorizedKeysFile .ssh/ | ||
| + | PasswordAuthentication yes | ||
| + | ChallengeResponseAuthentication no | ||
| + | GSSAPIAuthentication yes | ||
| + | GSSAPICleanupCredentials no | ||
| + | UsePAM yes | ||
| + | UsePrivilegeSeparation sandbox # Default for new installations. | ||
| + | AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES | ||
| + | AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT | ||
| + | AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE | ||
| + | AcceptEnv XMODIFIERS | ||
| + | Subsystem sftp / | ||
| + | </ | ||
| + | |||
| + | <WRAP center round todo> | ||
| + | **A Faire** - Renommez le fichier **/ | ||
| + | </ | ||
| + | |||
| + | Pour générer les clefs sur le serveur saisissez la commande suivante en tant que **root**: | ||
| + | |||
| + | Lors de la génération des clefs, la passphrase doit être **vide**. | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ssh-keygen -t dsa | ||
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | d5: | ||
| + | The key's randomart image is: | ||
| + | +--[ DSA 1024]----+ | ||
| + | | +oBB.| | ||
| + | | o *.o*| | ||
| + | | . o +.o| | ||
| + | | | ||
| + | | S .=..| | ||
| + | | .o.| | ||
| + | | o| | ||
| + | | E| | ||
| + | | | | ||
| + | +-----------------+ | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | Le chemin à indiquer pour le fichier est **/ | ||
| + | </ | ||
| + | |||
| + | Les clefs publiques générées possèdent l' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ls /etc/ssh | ||
| + | moduli | ||
| + | ssh_config | ||
| + | </ | ||
| + | |||
| + | Re-démarrez ensuite le service sshd : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# systemctl restart sshd.service | ||
| + | </ | ||
| + | |||
| + | Saisissez maintenant les commandes suivantes en tant que **trainee** : | ||
| + | |||
| + | <WRAP center round important> | ||
| + | Lors de la génération des clefs, la passphrase doit être **vide**. | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | [trainee@centos7 ~]$ ssh-keygen -t dsa | ||
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | Created directory '/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | 97: | ||
| + | The key's randomart image is: | ||
| + | +--[ DSA 1024]----+ | ||
| + | | .. ..=| | ||
| + | | | ||
| + | | ... ..o| | ||
| + | | o.. ..E.| | ||
| + | | S.o..oo .| | ||
| + | | .oo o.+. | | ||
| + | | . . =. | | ||
| + | | . | | ||
| + | | | | ||
| + | +-----------------+ | ||
| + | [trainee@centos7 ~]$ ssh-keygen -t rsa | ||
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | 80: | ||
| + | The key's randomart image is: | ||
| + | +--[ RSA 2048]----+ | ||
| + | | +o=o.. | ||
| + | | * Xo+o. | | ||
| + | | . B.Bo. | | ||
| + | | | ||
| + | | o.S | | ||
| + | | | ||
| + | | | | ||
| + | | | | ||
| + | | | | ||
| + | +-----------------+ | ||
| + | [trainee@centos7 ~]$ ssh-keygen -t ecdsa | ||
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | 41: | ||
| + | The key's randomart image is: | ||
| + | +--[ECDSA | ||
| + | | ..... .. o+ | | ||
| + | | ... . .. o . | | ||
| + | |. .. . = .| | ||
| + | | o E . = . | | ||
| + | | . | ||
| + | | . | ||
| + | | o . o . | | ||
| + | | . o . . | | ||
| + | | ..... . | | ||
| + | +-----------------+ | ||
| + | [trainee@centos7 ~]$ ssh-keygen -t ed25519 | ||
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | 66: | ||
| + | The key's randomart image is: | ||
| + | +--[ED25519 | ||
| + | | . . +..oo. | ||
| + | | o +..o. . | | ||
| + | | | ||
| + | | . . o . . | | ||
| + | | . . S + E | | ||
| + | | o = o + | | ||
| + | | . + | ||
| + | | | ||
| + | | | | ||
| + | +-----------------+ | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | Les clés générées seront placées dans le répertoire **~/ | ||
| + | </ | ||
| + | |||
| + | ==Utilisation== | ||
| + | |||
| + | La commande ssh prend la forme suivante: | ||
| + | |||
| + | ssh -l nom_de_compte numero_ip (nom_de_machine) | ||
| + | |||
| + | En saisissant cette commande sur votre propre machine, vous obtiendrez un résultat similaire à celle-ci : | ||
| + | |||
| + | < | ||
| + | [trainee@centos7 ~]$ su - | ||
| + | Mot de passe : | ||
| + | Dernière connexion : lundi 9 mai 2016 à 22:47:48 CEST sur pts/0 | ||
| + | |||
| + | [root@centos7 ~]# ssh -l trainee localhost | ||
| + | The authenticity of host ' | ||
| + | ECDSA key fingerprint is 19: | ||
| + | Are you sure you want to continue connecting (yes/no)? yes | ||
| + | Warning: Permanently added ' | ||
| + | trainee@localhost' | ||
| + | Last login: Mon May 9 23:25:15 2016 from localhost.localdomain | ||
| + | </ | ||
| + | |||
| + | ===Tunnels SSH=== | ||
| + | |||
| + | Le protocole SSH peut être utilisé pour sécuriser les protocoles tels telnet, pop3 etc.. En effet, on peut créer un //tunnel// SSH dans lequel passe les communications du protocole non-sécurisé. | ||
| + | |||
| + | La commande pour créer un tunnel ssh prend la forme suivante : | ||
| + | |||
| + | ssh -N -f compte@hôte -Lport-local: | ||
| + | |||
| + | Dans votre cas, vous allez créer un tunnel dans votre propre vm entre le port 15023 et le port 23 : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ssh -N -f trainee@localhost -L15023: | ||
| + | trainee@localhost' | ||
| + | </ | ||
| + | |||
| + | Installez maintenant le client et le serveur telnet : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# yum install telnet telnet-server | ||
| + | </ | ||
| + | |||
| + | Telnet n'est ni démarré ni activé. Il convient donc de le démarrer et de l' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# systemctl status telnet.socket | ||
| + | ● telnet.socket - Telnet Server Activation Socket | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | | ||
| + | | ||
| + | |||
| + | [root@centos7 ~]# systemctl start telnet.socket | ||
| + | |||
| + | [root@centos7 ~]# systemctl status telnet.socket | ||
| + | ● telnet.socket - Telnet Server Activation Socket | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | | ||
| + | | ||
| + | |||
| + | May 09 23:40:13 centos7.fenestros.loc systemd[1]: Listening on Telnet Server Activation Socket. | ||
| + | May 09 23:40:13 centos7.fenestros.loc systemd[1]: Starting Telnet Server Activation Socket. | ||
| + | |||
| + | [root@centos7 ~]# systemctl enable telnet.socket | ||
| + | Created symlink from / | ||
| + | [root@centos7 ~]# systemctl status telnet.socket | ||
| + | ● telnet.socket - Telnet Server Activation Socket | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | | ||
| + | | ||
| + | |||
| + | May 09 23:40:13 centos7.fenestros.loc systemd[1]: Listening on Telnet Server Activation Socket. | ||
| + | May 09 23:40:13 centos7.fenestros.loc systemd[1]: Starting Telnet Server Activation Socket. | ||
| + | </ | ||
| + | |||
| + | Connectez-vous ensuite via telnet sur le port 15023, vous constaterez que votre connexion n' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# telnet localhost 15023 | ||
| + | Trying 127.0.0.1... | ||
| + | Connected to localhost. | ||
| + | Escape character is ' | ||
| + | |||
| + | Kernel 3.10.0-327.13.1.el7.x86_64 on an x86_64 | ||
| + | centos7 login: trainee | ||
| + | Password: | ||
| + | Last login: Mon May 9 23:26:32 from localhost.localdomain | ||
| + | [trainee@centos7 ~]$ | ||
| + | |||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | Notez bien que votre communication telnet passe par le tunnel SSH. | ||
| + | </ | ||
| + | |||
| + | ====SCP==== | ||
| + | |||
| + | ===Introduction=== | ||
| + | |||
| + | La commande **scp** est le successeur et la remplaçante de la commande **rcp** de la famille des commandes **remote**. Il permet de faire des transferts sécurisés à partir d'une machine distante : | ||
| + | |||
| + | $ scp compte@numero_ip(nom_de_machine):/ | ||
| + | |||
| + | ou vers une machine distante : | ||
| + | |||
| + | $ scp / | ||
| + | |||
| + | ===Utilisation=== | ||
| + | |||
| + | Nous allons maintenant utiliser **scp** pour chercher un fichier sur le << | ||
| + | |||
| + | Créez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [trainee@centos7 ~]$ pwd | ||
| + | / | ||
| + | [trainee@centos7 ~]$ touch scp_test | ||
| + | </ | ||
| + | |||
| + | Récupérez le fichier **scp_test** en utilisant scp : | ||
| + | |||
| + | < | ||
| + | [trainee@centos7 ~]$ touch / | ||
| + | [trainee@centos7 ~]$ scp trainee@127.0.0.1:/ | ||
| + | The authenticity of host ' | ||
| + | ECDSA key fingerprint is 19: | ||
| + | Are you sure you want to continue connecting (yes/no)? yes | ||
| + | Warning: Permanently added ' | ||
| + | trainee@127.0.0.1' | ||
| + | scp_test | ||
| + | [trainee@centos7 ~]$ ls / | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | ==Mise en place des clefs== | ||
| + | |||
| + | Il convient maintenant de se connecter sur le << | ||
| + | |||
| + | En saisissant cette commande, vous obtiendrez une fenêtre similaire à celle-ci : | ||
| + | |||
| + | < | ||
| + | [trainee@centos7 ~]$ ssh -l trainee 127.0.0.1 | ||
| + | trainee@127.0.0.1' | ||
| + | Last login: Mon May 9 23:42:46 2016 from localhost.localdomain | ||
| + | [trainee@centos7 ~]$ ls -la | grep .ssh | ||
| + | drwx------. | ||
| + | [trainee@centos7 ~]$ exit | ||
| + | logout | ||
| + | Connection to 127.0.0.1 closed. | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | Si le dossier distant .ssh n' | ||
| + | </ | ||
| + | |||
| + | Ensuite, il convient de transférer le fichier local **.ssh/ | ||
| + | |||
| + | < | ||
| + | [trainee@centos7 ~]$ scp .ssh/ | ||
| + | trainee@127.0.0.1' | ||
| + | id_ecdsa.pub | ||
| + | </ | ||
| + | |||
| + | Connectez-vous via telnet et insérer les clefs publiques restantes dans le fichier .ssh/ | ||
| + | |||
| + | < | ||
| + | root@centos7 ~]# ssh -l trainee localhost | ||
| + | trainee@localhost' | ||
| + | Last login: Tue May 10 01:39:33 2016 from localhost.localdomain | ||
| + | [trainee@centos7 ~]$ cat .ssh/ | ||
| + | [trainee@centos7 ~]$ cat .ssh/ | ||
| + | [trainee@centos7 ~]$ cat .ssh/ | ||
| + | [trainee@centos7 ~]$ cat .ssh/ | ||
| + | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBG5BtOMFLrUbxD// | ||
| + | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9KOuEH5+kyihhm99Na8UTA4Gi5AfiOVeJyS3UzH7ta73ewmv7JZqaXzar1NlHcpEMkCUs2yKxHyO/ | ||
| + | ssh-dss AAAAB3NzaC1kc3MAAACBAK9/ | ||
| + | ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIENas3A3hmXFj1cb+lrn2NAt6g95Pla6qUFQHd1wg2y1 trainee@centos7.fenestros.loc | ||
| + | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBG5BtOMFLrUbxD// | ||
| + | </ | ||
| + | |||
| + | Lors de la connexion suivante au serveur, l' | ||
| + | |||
| + | < | ||
| + | [trainee@centos7 ~]$ ssh -l trainee localhost | ||
| + | Last login: Tue May 10 01:50:39 2016 from localhost.localdomain | ||
| + | [trainee@centos7 ~]$ exit | ||
| + | déconnexion | ||
| + | Connection to localhost closed. | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | Le fichier **authorized_keys** doit avoir les permissions de 600. | ||
| + | </ | ||
| + | |||
| + | ----- | ||
| + | |||
| + | Copyright © 2023 Hugh Norris. | ||
