Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:centos:6:avance:l104 [2021/12/29 09:39] – admin | elearning:workbooks:centos:6:avance:l104 [2023/02/15 15:54] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| + | |||
| + | Version : **2022.01** | ||
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LCF307 | + | ======LCF303 |
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| - | * **LCF307 | + | * **LCF303 |
| * Contenu du Module | * Contenu du Module | ||
| - | * Présentation | + | * Configuration du Réseau sous RHEL/CentOS 5 et 6 |
| - | * Les Services et Processus du Serveur NFSv3 | + | * Configuration de TCP/IP |
| - | * Les Services RPC | + | * DHCP |
| - | * Options | + | * / |
| - | * Commandes de Base | + | * / |
| - | * Installation | + | * IP Fixe |
| - | * Mise en Place | + | * / |
| - | * Configuration du Serveur | + | * / |
| - | * Configuration | + | * La Commande hostname |
| - | * Surveillance du Serveur | + | * La Commande ifconfig |
| - | * La Commande rpcinfo | + | * Activer/ |
| - | * La Commande nfsstat | + | * / |
| + | * Résolution | ||
| + | * / | ||
| + | * / | ||
| + | * / | ||
| + | * Services réseaux | ||
| + | * xinetd | ||
| + | * TCP Wrapper | ||
| + | * Routage Statique | ||
| + | * La Commande route | ||
| + | * Activer/ | ||
| + | * Configuration du Réseau sous RHEL/CentOS 7 | ||
| + | * La Commande nmcli | ||
| + | * Connections et Profils | ||
| + | * Ajouter une Deuxième Adresse IP à un Profil | ||
| + | * La Commande hostname | ||
| + | * La Commande ip | ||
| + | * Activer/ | ||
| + | * Routage Statique | ||
| + | * La commande ip | ||
| + | * Activer/ | ||
| + | * Diagnostique du Réseau | ||
| + | * ping | ||
| + | * netstat -i | ||
| + | * traceroute | ||
| + | * Connexions à Distance | ||
| + | * Telnet | ||
| + | | ||
| + | * ftp | ||
| + | * SSH | ||
| + | * Introduction | ||
| + | * SSH-1 | ||
| + | * SSH-2 | ||
| + | * L' | ||
| + | * L' | ||
| + | * Installation | ||
| + | | ||
| + | * Serveur | ||
| + | * Utilisation | ||
| + | * Tunnels SSH | ||
| + | * SCP | ||
| + | * Introduction | ||
| + | * Utilisation | ||
| + | * Mise en place des clefs | ||
| - | =====Présentation===== | + | =====Configuration du Réseau sous RHEL/CentOS 5 et 6===== |
| - | Quand on parle de NFS, on parle d' | + | ==== Configuration |
| - | Le Network File System (NFS) est le protocole de partage de fichiers historique sur des systèmes Unix. Lors de l' | + | La configuration TCP/IP se trouve dans le répertoire **/ |
| - | * le partage ainsi que ses caractéristiques sont configurés par rapport à l' | + | === DHCP === |
| - | * aucun mot de passe n'est demandé lors de la connexion d'un utilisateur à une ressource car le serveur NFS présume que l' | + | |
| - | Cependant l' | + | == / |
| - | Il existe actuellement 3 versions de NFS : | + | < |
| + | [root@centos6 ~]# cat / | ||
| + | NETWORKING=yes | ||
| + | HOSTNAME=centos6 | ||
| + | </ | ||
| - | ^ Version ^ Protocole Utilisé ^ Dépendance ^ | + | Dans ce fichier vous pouvez constater |
| - | | **NFSv2** | TCP et UDP | portmap | | + | |
| - | | **NFSv3** | TCP et UDP | portmap | | + | |
| - | | **NFSv4** | TCP | Aucune - les fonctions de portmap sont incluses dans NFSv4 | | + | |
| - | La version utilisée par défaut sous CentOS/ | + | ^ Directive ^ Description ^ |
| + | | NETWORKING | Indique que la prise en charge du réseau | ||
| + | | HOSTNAME | Indique le nom d' | ||
| - | ====Les Services et Processus du Serveur NFSv3==== | + | Ce fichier peut également contenir les directives suivantes : |
| - | La version NFSv3 utilise les services suivants : | + | ^ Directive ^ Description ^ |
| + | | GATEWAY | Indique l' | ||
| + | | GATEWAYDEV | Indique l' | ||
| + | | NISDOMAIN | Indique le domaine NIS s'il en existe un | | ||
| + | | NETWORKING_IPV6 | Active ou désactive le support IPv6 | | ||
| - | ^ Services ^ Fonction ^ | + | ==/ |
| - | | **nfs** | Démarre le service NFS ainsi que les processus RPC pour recevoir et traiter les demandes des clients | | + | |
| - | | **nfslock** | Démarre les processus RPC qui permettent aux clients de verrouiller les fichiers sur le serveur | + | |
| - | | **portmap** | Gestion des réservations des ports pour les services RPC locaux afin que les services RPC distants puissent se connecter | | + | |
| - | ===Les Services RPC=== | + | **ifcfg-eth0** |
| - | Les services RPC ( //Remote Procedure Calls// ou appel de procédures distantes ) ont été inventé par SUN Microsystem pour faciliter le travail des développeurs | + | < |
| + | [root@centos6 ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0 | ||
| + | DEVICE=" | ||
| + | NM_CONTROLLED=" | ||
| + | ONBOOT=yes | ||
| + | TYPE=Ethernet | ||
| + | BOOTPROTO=dhcp | ||
| + | DEFROUTE=yes | ||
| + | IPV4_FAILURE_FATAL=yes | ||
| + | IPV6INIT=no | ||
| + | NAME=" | ||
| + | UUID=5fb06bd0-0bb0-7ffb-45f1-d6edd65f3e03 | ||
| + | HWADDR=08: | ||
| + | PEERDNS=yes | ||
| + | PEERROUTES=yes | ||
| + | </ | ||
| - | Lorsque le client veut faire une requête à un service RPC, il contacte en premier lieu le service **rpcbind** qui assigne un numéro de port au délà du numéro **32768** à un numéro de programme RPC. | + | Dans ce fichier vous pouvez constater les directives suivantes : |
| + | ^ Directive ^ Description ^ | ||
| + | | DEVICE | Indique le nom de l' | ||
| + | | NM_CONTROLLED | Indique que le service NetworkManager est utilisé pour gérer les interfaces réseau | | ||
| + | | ONBOOT | Indique que l' | ||
| + | | TYPE | Indique que le type de réseau est ethernet. | ||
| + | | BOOTPROTO | Indique comment monter l' | ||
| + | | DEFROUTE | Définit l' | ||
| + | | IPV4_FAILURE_FATAL | Stipule que si IPv4 et IPv6 sont activés et la connexion IPv4 est perdue, la connexion IPv6 est considérée d' | ||
| + | | IPV6INIT | Indique que le support IPv6 ne sera pas initialisé | | ||
| + | | NAME | Indique un nom descriptif de l' | ||
| + | | UUID | Indique la valeur de l'UUID de l' | ||
| + | | HWADDR | Indique l' | ||
| + | | PEERDNS |Indique que le fichier / | ||
| - | ====Options d'un Partage NFS==== | ||
| - | Certaines options, appliquées à un partage, modifient le comportement du serveur NFS pour le partage concerné lors de son démarrage : | + | <WRAP center round todo> |
| + | Recherchez la définition | ||
| + | </ | ||
| - | ^ Option ^ Comportement ^ | + | === IP Fixe === |
| - | | **ro** | Accès en lecture seule | | + | |
| - | | **rw** | Accès en lecture | + | == /etc/ |
| - | | **sync** | Ecriture synchrone | + | |
| - | | **async** | Ecriture asynchrone ( écriture sur disque en utilisant une cache ) | | + | < |
| - | | **root_squash** | + | NETWORKING=yes |
| - | | **no_root_squash** | + | NETWORKING_IPV6=no |
| - | | **no_lock** | + | HOSTNAME=centos6.fenestros.loc |
| - | | **all_squash** | + | </ |
| - | | **anonuid** | + | |
| - | | **anongid** | + | ==/ |
| + | |||
| + | **ifcfg-eth0** | ||
| + | |||
| + | < | ||
| + | DEVICE=" | ||
| + | NM_CONTROLLED=" | ||
| + | ONBOOT=yes | ||
| + | TYPE=Ethernet | ||
| + | BOOTPROTO=static | ||
| + | IPV6INIT=no | ||
| + | HWADDR=" | ||
| + | NETMASK=255.255.255.0 | ||
| + | IPADDR=10.0.2.15 | ||
| + | GATEWAY=10.0.2.2 | ||
| + | DNS1=8.8.8.8 | ||
| + | DNS2=8.8.4.4 | ||
| + | DOMAIN=fenestros.loc | ||
| + | USERCTL=yes | ||
| + | </ | ||
| + | |||
| + | Dans ce fichier vous pouvez constater les nouvelles directives suivantes : | ||
| + | |||
| + | ^ Directive ^ Description ^ | ||
| + | | NETMASK | ||
| + | | IPADDR | ||
| + | | GATEWAY | ||
| + | | DNS1 | Indique le DNS primaire | ||
| + | | DNS2 | Indique le DNS secondaire | ||
| + | | DOMAIN | ||
| + | | USERCTL | Indique que les utilisateurs normaux peuvent activer/ | ||
| <WRAP center round important> | <WRAP center round important> | ||
| - | **Important** : Si plusieurs options sont spécifiées, | + | Notez que %%VirtualBox%% fournit une passerelle |
| </ | </ | ||
| - | ====Commandes de Base==== | + | Après avoir modifier les deux fichiers **/ |
| - | Plusieurs commandes permettent | + | < |
| + | [root@centos6 ~]# service NetworkManager stop | ||
| + | Arrêt du démon NetworkManager : [ OK ] | ||
| + | [root@centos6 ~]# chkconfig --del NetworkManager | ||
| + | [root@centos6 ~]# service network start | ||
| + | Activation | ||
| + | Activation de l'interface eth0 : [ OK ] | ||
| + | [root@centos6 ~]# | ||
| + | </ | ||
| - | ^ Commande ^ Comportement ^ | ||
| - | | **exportfs** | Affiche les partages actifs sur le serveur courant | | ||
| - | | **nfsstat** | Affiche les statistiques de l' | ||
| - | | **rpcinfo** | Affiche les démons gérés en effectuant une requête RPC sur le serveur courant | | ||
| - | | **showmount** | Affiche les partages actifs sur un serveur distant | | ||
| - | | **mount** | Permet de monter un partage distant sur un répertoire local | | ||
| - | =====Mise en Place===== | + | ====La Commande hostname==== |
| - | ====Configuration | + | Lors du passage à une configuration en IPv4 fixe vous avez modifié la directive **HOSTNAME** du fichier **/ |
| + | |||
| + | < | ||
| + | [root@centos6 ~]# hostname | ||
| + | centos6 | ||
| + | [root@centos6 ~]# hostname centos6.fenestros.loc | ||
| + | [root@centos6 ~]# hostname | ||
| + | centos6.fenestros.loc | ||
| + | </ | ||
| + | |||
| + | Pour afficher le FQDN du système vous pouvez également utiliser la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# uname -n | ||
| + | centos6.fenestros.loc | ||
| + | </ | ||
| + | |||
| + | ===Options de la commande hostname=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# hostname --help | ||
| + | Syntaxe : hostname [-v] {hôte|-F fichier} | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | dnsdomainname=hostname -d, {yp, | ||
| + | |||
| + | -s, --short | ||
| + | -a, --alias | ||
| + | -i, --ip-address | ||
| + | -f, --fqdn, --long | ||
| + | -d, --domain | ||
| + | -y, --yp, --nis nom de domaine NIS/YP | ||
| + | -F, --file | ||
| + | |||
| + | This command can read or set the hostname or the NIS domainname. You can | ||
| + | also read the DNS domain or the FQDN (fully qualified domain name). | ||
| + | | ||
| + | FQDN (Fully Qualified Domain Name) and the DNS domain name (which is | ||
| + | part of the FQDN) in the /etc/hosts file. | ||
| + | </ | ||
| + | |||
| + | ====La Commande ifconfig==== | ||
| + | |||
| + | Pour afficher la configuration IP de la machine il faut saisir la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# ifconfig | ||
| + | eth0 Link encap: | ||
| + | inet adr: | ||
| + | adr inet6: fe80:: | ||
| + | UP BROADCAST RUNNING MULTICAST | ||
| + | RX packets: | ||
| + | TX packets: | ||
| + | collisions: | ||
| + | RX bytes: | ||
| + | |||
| + | lo Link encap: | ||
| + | inet adr: | ||
| + | adr inet6: ::1/128 Scope: | ||
| + | UP LOOPBACK RUNNING | ||
| + | RX packets:8 errors:0 dropped:0 overruns:0 frame:0 | ||
| + | TX packets:8 errors:0 dropped:0 overruns:0 carrier:0 | ||
| + | collisions: | ||
| + | RX bytes:480 (480.0 b) TX bytes:480 (480.0 b) | ||
| + | </ | ||
| + | |||
| + | La commande ifconfig est également utilisée pour configurer une interface. | ||
| + | |||
| + | Créez maintenant une interface fictive ainsi : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# ifconfig eth0:1 192.168.1.2 netmask 255.255.255.0 broadcast 192.168.1.255 | ||
| + | </ | ||
| + | |||
| + | Constatez maintenant le résultat : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# ifconfig | ||
| + | eth0 Link encap: | ||
| + | inet adr: | ||
| + | adr inet6: fe80:: | ||
| + | UP BROADCAST RUNNING MULTICAST | ||
| + | RX packets: | ||
| + | TX packets: | ||
| + | collisions: | ||
| + | RX bytes: | ||
| + | |||
| + | eth0: | ||
| + | inet adr: | ||
| + | UP BROADCAST RUNNING MULTICAST | ||
| + | |||
| + | lo Link encap: | ||
| + | inet adr: | ||
| + | adr inet6: ::1/128 Scope: | ||
| + | UP LOOPBACK RUNNING | ||
| + | RX packets:8 errors:0 dropped:0 overruns:0 frame:0 | ||
| + | TX packets:8 errors:0 dropped:0 overruns:0 carrier:0 | ||
| + | collisions: | ||
| + | RX bytes:480 (480.0 b) TX bytes:480 (480.0 b) | ||
| + | </ | ||
| + | |||
| + | ===Options de la commande ifconfig=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# ifconfig --help | ||
| + | Usage: | ||
| + | ifconfig [-a] [-v] [-s] < | ||
| + | [add < | ||
| + | [del < | ||
| + | [[-]broadcast [< | ||
| + | [netmask < | ||
| + | [outfill <NN>] [keepalive < | ||
| + | [hw <HW> < | ||
| + | [[-]trailers] | ||
| + | [multicast] | ||
| + | [mem_start < | ||
| + | [txqueuelen < | ||
| + | [[-]dynamic] | ||
| + | [up|down] ... | ||
| + | |||
| + | < | ||
| + | Liste des types de matériels possibles: | ||
| + | loop (Boucle locale) slip (IP ligne série) cslip (IP ligne série - VJ ) | ||
| + | slip6 (IP ligne série - 6 bits) cslip6 (IP ligne série - 6 bits VJ) adaptive (IP ligne série adaptative) | ||
| + | strip (Metricom Starmode IP) ash (Ash) ether (Ethernet) | ||
| + | tr (16/4 Mbps Token Ring) tr (16/4 Mbps Token Ring (New)) ax25 (AMPR AX.25) | ||
| + | netrom (AMPR NET/ROM) rose (AMPR ROSE) tunnel (IPIP Tunnel) | ||
| + | ppp (Protocole Point-à-Point) hdlc ((Cisco)-HDLC) lapb (LAPB) | ||
| + | arcnet (ARCnet) dlci (Frame Relay DLCI) frad (Périphériue d' | ||
| + | sit (IPv6-dans-IPv4) fddi (Fiber Distributed Data Interface) hippi (HIPPI) | ||
| + | irda (IrLAP) ec (Econet) x25 (generic X.25) | ||
| + | infiniband (InfiniBand) | ||
| + | < | ||
| + | Liste des familles d' | ||
| + | unix (Domaine UNIX) inet (DARPA Internet) inet6 (IPv6) | ||
| + | ax25 (AMPR AX.25) netrom (AMPR NET/ROM) rose (AMPR ROSE) | ||
| + | ipx (Novell IPX) ddp (Appletalk DDP) ec (Econet) | ||
| + | ash (Ash) x25 (CCITT X.25) | ||
| + | </ | ||
| + | |||
| + | ====Activer/ | ||
| + | |||
| + | Deux commandes existent pour activer et désactiver manuellement une interface réseau : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# ifdown eth0 | ||
| + | [root@centos6 ~]# ifconfig | ||
| + | lo Link encap: | ||
| + | inet adr: | ||
| + | adr inet6: ::1/128 Scope: | ||
| + | UP LOOPBACK RUNNING | ||
| + | RX packets:384 errors:0 dropped:0 overruns:0 frame:0 | ||
| + | TX packets:384 errors:0 dropped:0 overruns:0 carrier:0 | ||
| + | collisions: | ||
| + | RX bytes:32496 (31.7 KiB) TX bytes:32496 (31.7 KiB) | ||
| + | |||
| + | [root@centos6 ~]# ifup eth0 | ||
| + | État de connexion active& | ||
| + | État de chemin actif& | ||
| + | état& | ||
| + | Connexion activée | ||
| + | [root@centos6 ~]# ifconfig | ||
| + | eth0 Link encap: | ||
| + | inet adr: | ||
| + | adr inet6: fe80:: | ||
| + | UP BROADCAST RUNNING MULTICAST | ||
| + | RX packets:27 errors:0 dropped:0 overruns:0 frame:0 | ||
| + | TX packets:42 errors:0 dropped:0 overruns:0 carrier:0 | ||
| + | collisions: | ||
| + | RX bytes:4271 (4.1 KiB) TX bytes:6145 (6.0 KiB) | ||
| + | |||
| + | lo Link encap: | ||
| + | inet adr: | ||
| + | adr inet6: ::1/128 Scope: | ||
| + | UP LOOPBACK RUNNING | ||
| + | RX packets:392 errors:0 dropped:0 overruns:0 frame:0 | ||
| + | TX packets:392 errors:0 dropped:0 overruns:0 carrier:0 | ||
| + | collisions: | ||
| + | RX bytes:33600 (32.8 KiB) TX bytes:33600 (32.8 KiB) | ||
| + | </ | ||
| + | |||
| + | ===/ | ||
| + | |||
| + | Ce fichier contient la correspondance entre des noms de réseaux et l' | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# cat / | ||
| + | default 0.0.0.0 | ||
| + | loopback 127.0.0.0 | ||
| + | link-local 169.254.0.0 | ||
| + | </ | ||
| + | |||
| + | === Résolution d' | ||
| + | |||
| + | La configuration DNS est stockée dans le fichier **/ | ||
| + | |||
| + | |||
| + | == / | ||
| + | |||
| + | La configuration DNS est stockée dans le fichier / | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# cat / | ||
| + | # Generated by NetworkManager | ||
| + | |||
| + | |||
| + | # No nameservers found; try putting DNS servers into your | ||
| + | # ifcfg files in / | ||
| + | # | ||
| + | # DNS1=xxx.xxx.xxx.xxx | ||
| + | # DNS2=xxx.xxx.xxx.xxx | ||
| + | # DOMAIN=lab.foo.com bar.foo.com | ||
| + | nameserver 8.8.8.8 | ||
| + | nameserver 8.8.4.4 | ||
| + | search fenestros.loc | ||
| + | </ | ||
| <WRAP center round important> | <WRAP center round important> | ||
| - | **Important** : Arrêtez votre VM. Dans la fenêtre de Oracle VM VirtualBox, cliquez sur **Fichier > Paramètres > Réseau** et créez un réseau NAT appelé **NatNetwork**. Dans les paramètres | + | Notez que les DNS utilisés sont les serveurs DNS publics |
| </ | </ | ||
| - | Configurez votre interface | + | |
| + | ==/ | ||
| + | |||
| + | L' | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# grep ' | ||
| + | hosts: | ||
| + | </ | ||
| + | |||
| + | == /etc/hosts == | ||
| + | |||
| + | Le mot **files** dans la sortie de la commande précédente fait référence au fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# cat / | ||
| + | 10.0.2.15 centos6 # | ||
| + | 127.0.0.1 localhost.localdomain localhost | ||
| + | :: | ||
| + | </ | ||
| + | |||
| + | Pour tester le serveur DNS, deux commandes sont possibles : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# nslookup www.i2tch.com | ||
| + | Server: | ||
| + | Address: | ||
| + | |||
| + | Non-authoritative answer: | ||
| + | www.i2tch.com canonical name = i2tch.com. | ||
| + | Name: | ||
| + | Address: 90.119.37.144 | ||
| + | |||
| + | [root@centos6 ~]# dig www.i2tch.com | ||
| + | |||
| + | ; <<>> | ||
| + | ;; global options: +cmd | ||
| + | ;; Got answer: | ||
| + | ;; ->> | ||
| + | ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 | ||
| + | |||
| + | ;; OPT PSEUDOSECTION: | ||
| + | ; EDNS: version: 0, flags:; udp: 65494 | ||
| + | ;; QUESTION SECTION: | ||
| + | ; | ||
| + | |||
| + | ;; ANSWER SECTION: | ||
| + | www.i2tch.com. 6563 IN CNAME i2tch.com. | ||
| + | i2tch.com. 50 IN A 90.119.37.144 | ||
| + | |||
| + | ;; Query time: 1 msec | ||
| + | ;; SERVER: 8.8.8.8# | ||
| + | ;; WHEN: Mon Jan 22 18:00:27 CET 2018 | ||
| + | ;; MSG SIZE rcvd: 72 | ||
| + | </ | ||
| + | |||
| + | ==== Services réseaux ==== | ||
| + | |||
| + | Quand un client émet une demande de connexion vers une application | ||
| + | |||
| + | === xinetd === | ||
| + | |||
| + | Sous RHEL/CentOS 6 xinetd n'est pas installé par défaut. Installez-le grâce à yum : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# yum install xinetd | ||
| + | Loaded plugins: fastestmirror, | ||
| + | Loading mirror speeds from cached hostfile | ||
| + | * base: fr2.rpmfind.net | ||
| + | * extras: fr2.rpmfind.net | ||
| + | * updates: fr2.rpmfind.net | ||
| + | Setting up Install Process | ||
| + | Resolving Dependencies | ||
| + | --> Running transaction check | ||
| + | ---> Package xinetd.i686 2: | ||
| + | --> Finished Dependency Resolution | ||
| + | |||
| + | Dependencies Resolved | ||
| + | |||
| + | ================================================================================ | ||
| + | | ||
| + | ================================================================================ | ||
| + | Installing: | ||
| + | | ||
| + | |||
| + | Transaction Summary | ||
| + | ================================================================================ | ||
| + | Install | ||
| + | Upgrade | ||
| + | |||
| + | Total download size: 121 k | ||
| + | Installed size: 258 k | ||
| + | Is this ok [y/N]: y | ||
| + | Downloading Packages: | ||
| + | xinetd-2.3.14-33.el6.i686.rpm | ||
| + | Running rpm_check_debug | ||
| + | Running Transaction Test | ||
| + | Transaction Test Succeeded | ||
| + | Running Transaction | ||
| + | Installing | ||
| + | |||
| + | Installed: | ||
| + | xinetd.i686 2: | ||
| + | |||
| + | Complete! | ||
| + | </ | ||
| + | |||
| + | Le programme xinetd est configuré via le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# cat / | ||
| + | # | ||
| + | # This is the master xinetd configuration file. Settings in the | ||
| + | # default section will be inherited by all service configurations | ||
| + | # unless explicitly overridden in the service configuration. See | ||
| + | # xinetd.conf in the man pages for a more detailed explanation of | ||
| + | # these attributes. | ||
| + | |||
| + | defaults | ||
| + | { | ||
| + | # The next two items are intended to be a quick access place to | ||
| + | # temporarily enable or disable services. | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Define general logging characteristics. | ||
| + | log_type = SYSLOG daemon info | ||
| + | log_on_failure = HOST | ||
| + | log_on_success = PID HOST DURATION EXIT | ||
| + | |||
| + | # Define access restriction defaults | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | cps = 50 10 | ||
| + | instances = 50 | ||
| + | per_source = 10 | ||
| + | |||
| + | # Address and networking defaults | ||
| + | # | ||
| + | # bind = | ||
| + | # mdns = yes | ||
| + | v6only = no | ||
| + | |||
| + | # setup environmental attributes | ||
| + | # | ||
| + | # | ||
| + | groups = yes | ||
| + | umask = 002 | ||
| + | |||
| + | # Generally, banners are not used. This sets up their global defaults | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | } | ||
| + | |||
| + | includedir / | ||
| + | </ | ||
| + | |||
| + | Les valeurs des directives dans le fichier **/ | ||
| + | |||
| + | Les variables les plus importantes dans **/ | ||
| + | |||
| + | ^ Directive | ||
| + | | instances | ||
| + | | log_type | ||
| + | | log_on_succes | ||
| + | | log_on_failure | ||
| + | | cps | Indique 50 connexions par seconde avec un temps d' | ||
| + | |||
| + | Les options concernant les journaux sont : | ||
| + | |||
| + | | HOST | Journalisation de l' | ||
| + | | PID | Journalisation du PID du processus qui reçoit la demande d' | ||
| + | | DURATION | ||
| + | | EXIT | Journalisation de l' | ||
| + | |||
| + | Il est aussi possible de trouver les options suivantes pour les journaux : | ||
| + | |||
| + | | ATTEMPT | ||
| + | | USERID | ||
| + | |||
| + | Examinons maintenant le répertoire **/ | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# ls -l / | ||
| + | total 52 | ||
| + | -rw-------. 1 root root 1157 7 déc. 22:07 chargen-dgram | ||
| + | -rw-------. 1 root root 1159 7 déc. 22:07 chargen-stream | ||
| + | -rw-r--r--. 1 root root 523 25 juin 2011 cvs | ||
| + | -rw-------. 1 root root 1157 7 déc. 22:07 daytime-dgram | ||
| + | -rw-------. 1 root root 1159 7 déc. 22:07 daytime-stream | ||
| + | -rw-------. 1 root root 1157 7 déc. 22:07 discard-dgram | ||
| + | -rw-------. 1 root root 1159 7 déc. 22:07 discard-stream | ||
| + | -rw-------. 1 root root 1148 7 déc. 22:07 echo-dgram | ||
| + | -rw-------. 1 root root 1150 7 déc. 22:07 echo-stream | ||
| + | -rw-r--r--. 1 root root 332 20 mai 2009 rsync | ||
| + | -rw-------. 1 root root 1212 7 déc. 22:07 tcpmux-server | ||
| + | -rw-------. 1 root root 1149 7 déc. 22:07 time-dgram | ||
| + | -rw-------. 1 root root 1150 7 déc. 22:07 time-stream | ||
| + | </ | ||
| + | |||
| + | A l' | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# cat / | ||
| + | # default: off | ||
| + | # description: | ||
| + | # files. CVS stores all the versions of a file in a single \ | ||
| + | # file in a clever way that only stores the differences \ | ||
| + | # between versions. | ||
| + | service cvspserver | ||
| + | { | ||
| + | disable = yes | ||
| + | port = 2401 | ||
| + | socket_type = stream | ||
| + | protocol = tcp | ||
| + | wait = no | ||
| + | user = root | ||
| + | passenv = PATH | ||
| + | server = / | ||
| + | env = HOME=/ | ||
| + | server_args = -f --allow-root=/ | ||
| + | # bind = 127.0.0.1 | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | Les directives principales de ce fichier sont : | ||
| + | |||
| + | ^ Paramètre | ||
| + | | disable | ||
| + | | port | Le numéro de port ou, à défaut, le numéro indiqué pour le service dans le fichier / | ||
| + | | socket_type | ||
| + | | protocol | ||
| + | | wait | **no** : indique si xinetd active un serveur par client. **yes** : indique que xinetd active un seul serveur pour tous les client | | ||
| + | | user | Indique le compte sous lequel le serveur est exécuté | | ||
| + | | server | ||
| + | | env | Définit un environnement système | | ||
| + | | server_args | ||
| + | |||
| + | Cependant il est aussi possible d' | ||
| + | |||
| + | ^ Paramètre | ||
| + | | nice | Fixe le niveau de nice entre -19 et +20 | 10 | | ||
| + | | max_load | ||
| + | | bind | Limite le service à l' | ||
| + | | only_from | ||
| + | | no_access | ||
| + | | access_time | ||
| + | | redirect | ||
| + | |||
| + | Afin d' | ||
| + | |||
| + | === TCP Wrapper === | ||
| + | |||
| + | **TCP Wrapper** contrôle l' | ||
| + | |||
| + | Quand une requête arrive pour un serveur, xinetd active le wrapper **tcpd** au lieu d' | ||
| + | |||
| + | **tcpd** met à jour un journal et vérifie si le client a le droit d' | ||
| + | |||
| + | * **/ | ||
| + | * **/ | ||
| + | |||
| + | Il faut noter que si ces fichiers | ||
| + | |||
| + | Le format d'une ligne dans un de ces deux fichiers | ||
| + | |||
| + | < | ||
| + | démon : liste_de_clients | ||
| + | </ | ||
| + | |||
| + | Par exemple dans le cas d'un serveur **démon**, on verrait une ligne dans le fichier **/ | ||
| + | |||
| + | < | ||
| + | démon : LOCAL, .fenestros.loc | ||
| + | </ | ||
| + | |||
| + | ce qui implique que les machines dont le nom ne comporte | ||
| + | |||
| + | Le mot clef **ALL** peut être utilisé pour indiquer tout. Par exemple, **ALL:ALL** dans le fichier **/ | ||
| + | |||
| + | ====Routage Statique==== | ||
| + | |||
| + | ===La Commande route=== | ||
| + | |||
| + | Pour afficher la table de routage de la machine vous pouvez utiliser la commande **route** : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# route | ||
| + | Table de routage IP du noyau | ||
| + | Destination | ||
| + | 192.168.1.0 | ||
| + | 10.0.2.0 | ||
| + | link-local | ||
| + | default | ||
| + | </ | ||
| + | |||
| + | La table issue de la commande **route** indique les informations suivantes: | ||
| + | |||
| + | * La destination qui peut être un hôte ou un réseau et est identifiée par les champs **Destination** et **Genmask** | ||
| + | * La route à prendre identifiée par les champs **Gateway** et **Iface**. Dans le cas d'une valeur de 0.0.0.0 ceci spécifie une route directe. La valeur d' | ||
| + | * Le champ **Indic** qui peux prendre un ou plusieurs de svaleurs suivantes: | ||
| + | * U - **Up** - la route est active | ||
| + | * H - **Host** - la route conduit à un hôte | ||
| + | * G - **Gateways** - la route passe par une passerelle | ||
| + | * Le champ **Metric** indique le nombre de sauts (passerelles) pour atteindre la destination, | ||
| + | * Le champ **Ref** indique le nombre de références à cette route. Ce champs est usilisé par le Noyau de Linux, | ||
| + | * Le champ **Use** indique le nombre de recherches associés à cette route. | ||
| + | |||
| + | La commande **route** permet aussi de paramétrer le routage indirect. Par exemple pour supprimer la route vers le réseau 192.168.1.0 : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# route del -net 192.168.1.0 netmask 255.255.255.0 | ||
| + | [root@centos6 ~]# route | ||
| + | Table de routage IP du noyau | ||
| + | Destination | ||
| + | 10.0.2.0 | ||
| + | link-local | ||
| + | default | ||
| + | </ | ||
| + | |||
| + | Pour ajouter la route vers le réseau 192.168.1.0 : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.2 | ||
| + | [root@centos6 ~]# route | ||
| + | Table de routage IP du noyau | ||
| + | Destination | ||
| + | 192.168.1.0 | ||
| + | 10.0.2.0 | ||
| + | link-local | ||
| + | default | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | La commande utilisée pour ajouter une passerelle par défaut prend la forme suivante **route add default gw // | ||
| + | </ | ||
| + | |||
| + | Les options cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# route --help | ||
| + | Syntaxe: route [-nNvee] [-FC] [< | ||
| + | route [-v] [-FC] {add|del|flush} ... Modifie la table de routage pour AF. | ||
| + | |||
| + | route {-h|--help} [< | ||
| + | route {-V|--version} | ||
| + | |||
| + | -v, --verbose | ||
| + | -n, --numeric | ||
| + | -e, --extend | ||
| + | -F, --fib display Forwarding Information Base (default) | ||
| + | -C, --cache | ||
| + | |||
| + | < | ||
| + | Liste les familles d' | ||
| + | inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25) | ||
| + | netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP) | ||
| + | x25 (CCITT X.25) | ||
| + | </ | ||
| + | |||
| + | Vous pouvez aussi utiliser la commande **netstat** pour afficher la table de routage de la machine : | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# netstat -nr | ||
| + | Table de routage IP du noyau | ||
| + | Destination | ||
| + | 192.168.1.0 | ||
| + | 192.168.1.0 | ||
| + | 10.0.2.0 | ||
| + | 0.0.0.0 | ||
| + | </ | ||
| + | |||
| + | La table issue de la commande **netstat -nr** indique les informations suivantes: | ||
| + | |||
| + | * La champ **MSS** indique la taille maximale des segments TCP sur la route, | ||
| + | * Le champ **Window** indique la taille de la fenêtre sur cette route, | ||
| + | * Le champ **irrt** indique le paramètre IRRT pour la route. | ||
| + | |||
| + | ===Activer/ | ||
| + | |||
| + | Pour activer le routage sur le serveur, il convient d' | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# echo 1 > / | ||
| + | [root@centos6 ~]# cat / | ||
| + | 1 | ||
| + | </ | ||
| + | |||
| + | Pour désactiver le routage sur le serveur, il convient de désactiver la retransmission des paquets: | ||
| + | |||
| + | < | ||
| + | [root@centos6 ~]# echo 0 > / | ||
| + | [root@centos6 ~]# cat / | ||
| + | 0 | ||
| + | </ | ||
| + | |||
| + | =====Configuration du Réseau sous RHEL/CentOS 7===== | ||
| + | |||
| + | RHEL/CentOS 7 utilise exclusivement **Network Manager** pour gérer le réseau. Network Manager est composé de deux éléments : | ||
| + | |||
| + | * un service qui gère les connexions réseaux et rapporte leurs états, | ||
| + | * des front-ends qui passent par un API de configuration du service. | ||
| + | |||
| + | <WRAP center round important> | ||
| + | **Important** : Notez qu' | ||
| + | </ | ||
| + | |||
| + | Le service NetworkManager doit toujours être lancé : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# systemctl status NetworkManager.service | ||
| + | ● NetworkManager.service - Network Manager | ||
| + | | ||
| + | | ||
| + | Main PID: 673 (NetworkManager) | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc NetworkManager[673]: | ||
| + | Aug 08 11:03:55 centos7.fenestros.loc dhclient[2673]: | ||
| + | </ | ||
| + | |||
| + | ====La Commande nmcli==== | ||
| + | |||
| + | La commande **nmcli** (Network Manager Command Line Interface) est utilisée pour configurer NetworkManager. | ||
| + | |||
| + | Les options et les sous-commandes peuvent être consultées en utilisant les commandes suivantes : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli help | ||
| + | Usage: nmcli [OPTIONS] OBJECT { COMMAND | help } | ||
| + | |||
| + | OPTIONS | ||
| + | -t[erse] | ||
| + | -p[retty] | ||
| + | -m[ode] tabular|multiline | ||
| + | -f[ields] < | ||
| + | -e[scape] yes|no | ||
| + | -n[ocheck] | ||
| + | -a[sk] | ||
| + | -w[ait] < | ||
| + | -v[ersion] | ||
| + | -h[elp] | ||
| + | |||
| + | OBJECT | ||
| + | g[eneral] | ||
| + | n[etworking] | ||
| + | r[adio] | ||
| + | c[onnection] | ||
| + | d[evice] | ||
| + | a[gent] | ||
| + | |||
| + | [root@centos7 ~]# nmcli g help | ||
| + | Usage: nmcli general { COMMAND | help } | ||
| + | |||
| + | COMMAND := { status | hostname | permissions | logging } | ||
| + | |||
| + | status | ||
| + | |||
| + | hostname [< | ||
| + | |||
| + | permissions | ||
| + | |||
| + | logging [level <log level>] [domains <log domains> | ||
| + | |||
| + | |||
| + | [root@centos7 ~]# nmcli g status help | ||
| + | Usage: nmcli general status { help } | ||
| + | |||
| + | Show overall status of NetworkManager. | ||
| + | ' | ||
| + | |||
| + | </ | ||
| + | |||
| + | ====Connections et Profils==== | ||
| + | |||
| + | NetworkManager inclus la notion de **connections** ou **profils** permettant des configurations différentes en fonction de la localisation. Pour voir les connections actuelles, utilisez la commande **nmcli c** avec la sous-commande **show** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli c show | ||
| + | NAME UUID TYPE DEVICE | ||
| + | Wired connection 1 45b701c1-0a21-4d76-a795-2f2bcba86955 | ||
| + | </ | ||
| + | |||
| + | Comme on peut constater ici, il n' | ||
| + | |||
| + | Créez donc un profil IP fixe rattaché au périphérique **enp0s3** | ||
| < | < | ||
| [root@centos7 ~]# nmcli connection add con-name ip_fixe ifname enp0s3 type ethernet ip4 10.0.2.16/ | [root@centos7 ~]# nmcli connection add con-name ip_fixe ifname enp0s3 type ethernet ip4 10.0.2.16/ | ||
| - | Connection ' | + | Connection ' |
| + | </ | ||
| + | |||
| + | Constatez sa présence : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli c show | ||
| + | NAME UUID TYPE DEVICE | ||
| + | ip_fixe | ||
| + | Wired connection 1 45b701c1-0a21-4d76-a795-2f2bcba86955 | ||
| + | </ | ||
| + | |||
| + | Notez que la sortie n' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli d show | ||
| + | GENERAL.DEVICE: | ||
| + | GENERAL.TYPE: | ||
| + | GENERAL.HWADDR: | ||
| + | GENERAL.MTU: | ||
| + | GENERAL.STATE: | ||
| + | GENERAL.CONNECTION: | ||
| + | GENERAL.CON-PATH: | ||
| + | WIRED-PROPERTIES.CARRIER: | ||
| + | IP4.ADDRESS[1]: | ||
| + | IP4.GATEWAY: | ||
| + | IP4.DNS[1]: | ||
| + | IP6.ADDRESS[1]: | ||
| + | IP6.GATEWAY: | ||
| + | |||
| + | GENERAL.DEVICE: | ||
| + | GENERAL.TYPE: | ||
| + | GENERAL.HWADDR: | ||
| + | GENERAL.MTU: | ||
| + | GENERAL.STATE: | ||
| + | GENERAL.CONNECTION: | ||
| + | GENERAL.CON-PATH: | ||
| + | IP4.ADDRESS[1]: | ||
| + | IP4.GATEWAY: | ||
| + | IP6.ADDRESS[1]: | ||
| + | IP6.GATEWAY: | ||
| + | </ | ||
| + | |||
| + | Pour activer le profil ip_fixe, utilisez la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli connection up ip_fixe | ||
| + | </ | ||
| + | |||
| + | Le profil ip_fixe est maintenant activé tandis que le profil enp0s3 a été désactivé : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli c show | ||
| + | NAME UUID TYPE DEVICE | ||
| + | ip_fixe | ||
| + | Wired connection 1 45b701c1-0a21-4d76-a795-2f2bcba86955 | ||
| + | [root@centos7 ~]# nmcli d show | ||
| + | GENERAL.DEVICE: | ||
| + | GENERAL.TYPE: | ||
| + | GENERAL.HWADDR: | ||
| + | GENERAL.MTU: | ||
| + | GENERAL.STATE: | ||
| + | GENERAL.CONNECTION: | ||
| + | GENERAL.CON-PATH: | ||
| + | WIRED-PROPERTIES.CARRIER: | ||
| + | IP4.ADDRESS[1]: | ||
| + | IP4.GATEWAY: | ||
| + | IP6.ADDRESS[1]: | ||
| + | IP6.GATEWAY: | ||
| + | |||
| + | GENERAL.DEVICE: | ||
| + | GENERAL.TYPE: | ||
| + | GENERAL.HWADDR: | ||
| + | GENERAL.MTU: | ||
| + | GENERAL.STATE: | ||
| + | GENERAL.CONNECTION: | ||
| + | GENERAL.CON-PATH: | ||
| + | IP4.ADDRESS[1]: | ||
| + | IP4.GATEWAY: | ||
| + | IP6.ADDRESS[1]: | ||
| + | IP6.GATEWAY: | ||
| + | </ | ||
| + | |||
| + | Pour consulter les paramètres d'un profil, utilisez la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli -p connection show "Wired connection 1" | ||
| + | =============================================================================== | ||
| + | Connection profile details (Wired connection 1) | ||
| + | =============================================================================== | ||
| + | connection.id: | ||
| + | connection.uuid: | ||
| + | connection.interface-name: | ||
| + | connection.type: | ||
| + | connection.autoconnect: | ||
| + | connection.autoconnect-priority: | ||
| + | connection.timestamp: | ||
| + | connection.read-only: | ||
| + | connection.permissions: | ||
| + | connection.zone: | ||
| + | connection.master: | ||
| + | connection.slave-type: | ||
| + | connection.autoconnect-slaves: | ||
| + | connection.secondaries: | ||
| + | connection.gateway-ping-timeout: | ||
| + | connection.metered: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | 802-3-ethernet.port: | ||
| + | 802-3-ethernet.speed: | ||
| + | 802-3-ethernet.duplex: | ||
| + | 802-3-ethernet.auto-negotiate: | ||
| + | 802-3-ethernet.mac-address: | ||
| + | 802-3-ethernet.cloned-mac-address: | ||
| + | 802-3-ethernet.mac-address-blacklist: | ||
| + | 802-3-ethernet.mtu: | ||
| + | 802-3-ethernet.s390-subchannels: | ||
| + | 802-3-ethernet.s390-nettype: | ||
| + | 802-3-ethernet.s390-options: | ||
| + | 802-3-ethernet.wake-on-lan: | ||
| + | 802-3-ethernet.wake-on-lan-password: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | ipv4.method: | ||
| + | ipv4.dns: | ||
| + | ipv4.dns-search: | ||
| + | ipv4.addresses: | ||
| + | ipv4.gateway: | ||
| + | ipv4.routes: | ||
| + | ipv4.route-metric: | ||
| + | ipv4.ignore-auto-routes: | ||
| + | ipv4.ignore-auto-dns: | ||
| + | ipv4.dhcp-client-id: | ||
| + | ipv4.dhcp-send-hostname: | ||
| + | ipv4.dhcp-hostname: | ||
| + | ipv4.never-default: | ||
| + | ipv4.may-fail: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | ipv6.method: | ||
| + | ipv6.dns: | ||
| + | ipv6.dns-search: | ||
| + | ipv6.addresses: | ||
| + | ipv6.gateway: | ||
| + | ipv6.routes: | ||
| + | ipv6.route-metric: | ||
| + | ipv6.ignore-auto-routes: | ||
| + | ipv6.ignore-auto-dns: | ||
| + | ipv6.never-default: | ||
| + | ipv6.may-fail: | ||
| + | ipv6.ip6-privacy: | ||
| + | ipv6.dhcp-send-hostname: | ||
| + | ipv6.dhcp-hostname: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | [root@centos7 ~]# nmcli -p connection show ip_fixe | ||
| + | =============================================================================== | ||
| + | | ||
| + | =============================================================================== | ||
| + | connection.id: | ||
| + | connection.uuid: | ||
| + | connection.interface-name: | ||
| + | connection.type: | ||
| + | connection.autoconnect: | ||
| + | connection.autoconnect-priority: | ||
| + | connection.timestamp: | ||
| + | connection.read-only: | ||
| + | connection.permissions: | ||
| + | connection.zone: | ||
| + | connection.master: | ||
| + | connection.slave-type: | ||
| + | connection.autoconnect-slaves: | ||
| + | connection.secondaries: | ||
| + | connection.gateway-ping-timeout: | ||
| + | connection.metered: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | 802-3-ethernet.port: | ||
| + | 802-3-ethernet.speed: | ||
| + | 802-3-ethernet.duplex: | ||
| + | 802-3-ethernet.auto-negotiate: | ||
| + | 802-3-ethernet.mac-address: | ||
| + | 802-3-ethernet.cloned-mac-address: | ||
| + | 802-3-ethernet.mac-address-blacklist: | ||
| + | 802-3-ethernet.mtu: | ||
| + | 802-3-ethernet.s390-subchannels: | ||
| + | 802-3-ethernet.s390-nettype: | ||
| + | 802-3-ethernet.s390-options: | ||
| + | 802-3-ethernet.wake-on-lan: | ||
| + | 802-3-ethernet.wake-on-lan-password: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | ipv4.method: | ||
| + | ipv4.dns: | ||
| + | ipv4.dns-search: | ||
| + | ipv4.addresses: | ||
| + | ipv4.gateway: | ||
| + | ipv4.routes: | ||
| + | ipv4.route-metric: | ||
| + | ipv4.ignore-auto-routes: | ||
| + | ipv4.ignore-auto-dns: | ||
| + | ipv4.dhcp-client-id: | ||
| + | ipv4.dhcp-send-hostname: | ||
| + | ipv4.dhcp-hostname: | ||
| + | ipv4.never-default: | ||
| + | ipv4.may-fail: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | ipv6.method: | ||
| + | ipv6.dns: | ||
| + | ipv6.dns-search: | ||
| + | ipv6.addresses: | ||
| + | ipv6.gateway: | ||
| + | ipv6.routes: | ||
| + | ipv6.route-metric: | ||
| + | ipv6.ignore-auto-routes: | ||
| + | ipv6.ignore-auto-dns: | ||
| + | ipv6.never-default: | ||
| + | ipv6.may-fail: | ||
| + | ipv6.ip6-privacy: | ||
| + | ipv6.dhcp-send-hostname: | ||
| + | ipv6.dhcp-hostname: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | =============================================================================== | ||
| + | Activate connection details (fb3a11d9-4e03-4032-b26e-09d1195d2bcd) | ||
| + | =============================================================================== | ||
| + | GENERAL.NAME: | ||
| + | GENERAL.UUID: | ||
| + | GENERAL.DEVICES: | ||
| + | GENERAL.STATE: | ||
| + | GENERAL.DEFAULT: | ||
| + | GENERAL.DEFAULT6: | ||
| + | GENERAL.VPN: | ||
| + | GENERAL.ZONE: | ||
| + | GENERAL.DBUS-PATH: | ||
| + | GENERAL.CON-PATH: | ||
| + | GENERAL.SPEC-OBJECT: | ||
| + | GENERAL.MASTER-PATH: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | IP4.ADDRESS[1]: | ||
| + | IP4.GATEWAY: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | IP6.ADDRESS[1]: | ||
| + | IP6.GATEWAY: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | </ | ||
| + | |||
| + | Pour consulter la liste profils associés à un périphérique, | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmcli -f CONNECTIONS device show enp0s3 | ||
| + | CONNECTIONS.AVAILABLE-CONNECTION-PATHS: | ||
| + | CONNECTIONS.AVAILABLE-CONNECTIONS[1]: | ||
| + | CONNECTIONS.AVAILABLE-CONNECTIONS[2]: | ||
| + | </ | ||
| + | |||
| + | Les fichiers de configuration pour le periphérique **enp0s3** se trouvent dans le répertoire **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ls -l / | ||
| + | -rw-r--r--. 1 root root 296 Aug 8 11:08 ifcfg-ip_fixe | ||
| + | -rw-r--r--. 1 root root 254 Sep 16 2015 ifcfg-lo | ||
| + | </ | ||
| + | |||
| + | L' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# cat / | ||
| + | TYPE=Ethernet | ||
| + | BOOTPROTO=none | ||
| + | IPADDR=10.0.2.16 | ||
| + | PREFIX=24 | ||
| + | GATEWAY=10.0.2.2 | ||
| + | DEFROUTE=yes | ||
| + | IPV4_FAILURE_FATAL=no | ||
| + | IPV6INIT=yes | ||
| + | IPV6_AUTOCONF=yes | ||
| + | IPV6_DEFROUTE=yes | ||
| + | IPV6_PEERDNS=yes | ||
| + | IPV6_PEERROUTES=yes | ||
| + | IPV6_FAILURE_FATAL=no | ||
| + | NAME=ip_fixe | ||
| + | UUID=fb3a11d9-4e03-4032-b26e-09d1195d2bcd | ||
| + | DEVICE=enp0s3 | ||
| + | ONBOOT=yes | ||
| + | </ | ||
| + | |||
| + | La résolution des noms est donc inactive : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ping www.free.fr | ||
| + | ping: unknown host www.free.fr | ||
| + | </ | ||
| + | |||
| + | Modifiez donc la configuration du profil **ip_fixe** : | ||
| + | |||
| + | < | ||
| [root@centos7 ~]# nmcli connection mod ip_fixe ipv4.dns 8.8.8.8 | [root@centos7 ~]# nmcli connection mod ip_fixe ipv4.dns 8.8.8.8 | ||
| - | [root@centos7 ~]# nmcli connection up ip_fixe | + | </ |
| - | Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/1) | + | |
| + | L' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# cat /etc/sysconfig/network-scripts/ifcfg-ip_fixe | ||
| + | TYPE=Ethernet | ||
| + | BOOTPROTO=none | ||
| + | DEFROUTE=yes | ||
| + | IPV4_FAILURE_FATAL=no | ||
| + | IPV6INIT=yes | ||
| + | IPV6_AUTOCONF=yes | ||
| + | IPV6_DEFROUTE=yes | ||
| + | IPV6_FAILURE_FATAL=no | ||
| + | NAME=ip_fixe | ||
| + | UUID=fb3a11d9-4e03-4032-b26e-09d1195d2bcd | ||
| + | DEVICE=enp0s3 | ||
| + | ONBOOT=yes | ||
| + | IPADDR=10.0.2.16 | ||
| + | PREFIX=24 | ||
| + | GATEWAY=10.0.2.2 | ||
| + | DNS1=8.8.8.8 | ||
| + | IPV6_PEERDNS=yes | ||
| + | IPV6_PEERROUTES=yes | ||
| + | </code> | ||
| + | |||
| + | Afin que la modification du serveur DNS soit prise en compte, re-démarrez le service NetworkManager : | ||
| + | |||
| + | < | ||
| [root@centos7 ~]# systemctl restart NetworkManager.service | [root@centos7 ~]# systemctl restart NetworkManager.service | ||
| + | [root@centos7 ~]# systemctl status NetworkManager.service | ||
| + | ● NetworkManager.service - Network Manager | ||
| + | | ||
| + | | ||
| + | Main PID: 8394 (NetworkManager) | ||
| + | | ||
| + | | ||
| + | |||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| + | Aug 08 11:16:53 centos7.fenestros.loc NetworkManager[8394]: | ||
| </ | </ | ||
| - | Ajoutez | + | Vérifiez que le fichier **/ |
| + | |||
| + | < | ||
| + | [root@centos7 ~]# cat / | ||
| + | # Generated by NetworkManager | ||
| + | search fenestros.loc | ||
| + | nameserver 8.8.8.8 | ||
| + | </ | ||
| + | |||
| + | Dernièrement vérifiez la resolution des noms : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ping www.free.fr | ||
| + | PING www.free.fr (212.27.48.10) 56(84) bytes of data. | ||
| + | 64 bytes from www.free.fr (212.27.48.10): | ||
| + | 64 bytes from www.free.fr (212.27.48.10): | ||
| + | 64 bytes from www.free.fr (212.27.48.10): | ||
| + | ^C | ||
| + | --- www.free.fr ping statistics --- | ||
| + | 3 packets transmitted, | ||
| + | rtt min/ | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | **Important** : Notez qu'il existe un front-end graphique en mode texte, **nmtui**, pour configurer NetworkManager. | ||
| + | </ | ||
| + | |||
| + | ====Ajouter | ||
| + | |||
| + | Pour ajouter une deuxième | ||
| < | < | ||
| Ligne 114: | Ligne 1309: | ||
| </ | </ | ||
| - | Continuez maintenant par la mise en place du service **nfs** | + | Redémarrez |
| < | < | ||
| - | [root@centos7 ~]# systemctl status nfs.service | + | [root@centos7 ~]# nmcli connection show ip_fixe |
| - | nfs-server.service | + | connection.id: ip_fixe |
| - | Loaded: loaded | + | connection.uuid: |
| - | Active: inactive (dead) | + | connection.interface-name: enp0s3 |
| + | connection.type: | ||
| + | connection.autoconnect: | ||
| + | connection.autoconnect-priority: | ||
| + | connection.timestamp: | ||
| + | connection.read-only: | ||
| + | connection.permissions: | ||
| + | connection.zone: | ||
| + | connection.master: | ||
| + | connection.slave-type: | ||
| + | connection.autoconnect-slaves: | ||
| + | connection.secondaries: | ||
| + | connection.gateway-ping-timeout: | ||
| + | connection.metered: | ||
| + | 802-3-ethernet.port: | ||
| + | 802-3-ethernet.speed: | ||
| + | 802-3-ethernet.duplex: | ||
| + | 802-3-ethernet.auto-negotiate: | ||
| + | 802-3-ethernet.mac-address: | ||
| + | 802-3-ethernet.cloned-mac-address: | ||
| + | 802-3-ethernet.mac-address-blacklist: | ||
| + | 802-3-ethernet.mtu: | ||
| + | 802-3-ethernet.s390-subchannels: | ||
| + | 802-3-ethernet.s390-nettype: | ||
| + | 802-3-ethernet.s390-options: | ||
| + | 802-3-ethernet.wake-on-lan: 1 (default) | ||
| + | 802-3-ethernet.wake-on-lan-password: | ||
| + | ipv4.method: | ||
| + | ipv4.dns: | ||
| + | ipv4.dns-search: | ||
| + | ipv4.addresses: | ||
| + | ipv4.gateway: | ||
| + | ipv4.routes: | ||
| + | ipv4.route-metric: | ||
| + | ipv4.ignore-auto-routes: | ||
| + | ipv4.ignore-auto-dns: | ||
| + | ipv4.dhcp-client-id: | ||
| + | ipv4.dhcp-send-hostname: | ||
| + | ipv4.dhcp-hostname: | ||
| + | ipv4.never-default: | ||
| + | ipv4.may-fail: | ||
| + | ipv6.method: | ||
| + | ipv6.dns: | ||
| + | ipv6.dns-search: | ||
| + | ipv6.addresses: | ||
| + | ipv6.gateway: | ||
| + | ipv6.routes: | ||
| + | ipv6.route-metric: | ||
| + | ipv6.ignore-auto-routes: | ||
| + | ipv6.ignore-auto-dns: | ||
| + | ipv6.never-default: | ||
| + | ipv6.may-fail: | ||
| + | ipv6.ip6-privacy: | ||
| + | ipv6.dhcp-send-hostname: | ||
| + | ipv6.dhcp-hostname: | ||
| + | GENERAL.NAME: | ||
| + | GENERAL.UUID: | ||
| + | GENERAL.DEVICES: | ||
| + | GENERAL.STATE: | ||
| + | GENERAL.DEFAULT: | ||
| + | GENERAL.DEFAULT6: | ||
| + | GENERAL.VPN: | ||
| + | GENERAL.ZONE: | ||
| + | GENERAL.DBUS-PATH: | ||
| + | GENERAL.CON-PATH: / | ||
| + | GENERAL.SPEC-OBJECT: | ||
| + | GENERAL.MASTER-PATH: -- | ||
| + | IP4.ADDRESS[1]: | ||
| + | IP4.ADDRESS[2]: | ||
| + | IP4.GATEWAY: | ||
| + | IP4.DNS[1]: | ||
| + | IP6.ADDRESS[1]: | ||
| + | IP6.GATEWAY: | ||
| + | </ | ||
| - | [root@centos7 ~]# systemctl enable nfs-server.service | + | <WRAP center round important> |
| - | ln -s '/usr/ | + | **Important** : Notez l' |
| - | [root@centos7 ~]# systemctl status nfs.service | + | </WRAP> |
| - | nfs-server.service - NFS server and services | + | |
| - | | + | Consultez maintenant le contenu du fichier **/etc/sysconfig/network-scripts/ifcfg-ip_fixe** : |
| - | Active: inactive (dead) | + | |
| + | < | ||
| + | [root@centos7 ~]# cat /etc/sysconfig/network-scripts/ifcfg-ip_fixe | ||
| + | TYPE=Ethernet | ||
| + | BOOTPROTO=none | ||
| + | DEFROUTE=yes | ||
| + | IPV4_FAILURE_FATAL=no | ||
| + | IPV6INIT=yes | ||
| + | IPV6_AUTOCONF=yes | ||
| + | IPV6_DEFROUTE=yes | ||
| + | IPV6_FAILURE_FATAL=no | ||
| + | NAME=ip_fixe | ||
| + | UUID=fb3a11d9-4e03-4032-b26e-09d1195d2bcd | ||
| + | DEVICE=enp0s3 | ||
| + | ONBOOT=yes | ||
| + | DNS1=8.8.8.8 | ||
| + | IPADDR=10.0.2.16 | ||
| + | PREFIX=24 | ||
| + | IPADDR1=192.168.1.2 | ||
| + | PREFIX1=24 | ||
| + | GATEWAY=10.0.2.2 | ||
| + | IPV6_PEERDNS=yes | ||
| + | IPV6_PEERROUTES=yes | ||
| </ | </ | ||
| - | La mise en place d'un partage ponctuel se fait en utilisant | + | <WRAP center round important> |
| + | **Important** : Notez l'ajout de la ligne **IPADDR1=192.168.1.2**. | ||
| + | </WRAP> | ||
| + | |||
| + | ====La Commande hostname==== | ||
| + | |||
| + | La procédure de la modification du hostname est simplifiée et sa prise en compte est immédiate | ||
| < | < | ||
| - | [root@centos7 ~]# exportfs | + | [root@centos7 ~]# nmcli general hostname centos.fenestros.loc |
| - | [root@centos7 ~]# exportfs 192.168.1.2:/ | + | [root@centos7 ~]# cat / |
| - | [root@centos7 ~]# exportfs | + | centos.fenestros.loc |
| - | /home/trainee 192.168.1.2 | + | [root@centos7 ~]# hostname |
| + | centos.fenestros.loc | ||
| + | [root@centos7 ~]# nmcli general hostname centos7.fenestros.loc | ||
| + | [root@centos7 ~]# cat /etc/hostname | ||
| + | centos7.fenestros.loc | ||
| + | [root@centos7 ~]# hostname | ||
| + | centos7.fenestros.loc | ||
| </ | </ | ||
| - | Démarrez maintenant le service | + | ====La Commande ip==== |
| + | |||
| + | Sous RHEL/CentOS 7 la commande | ||
| < | < | ||
| - | [root@centos7 ~]# systemctl start nfs.service | + | [root@centos7 ~]# ip address |
| - | [root@centos7 ~]# systemctl status nfs.service | + | 1: lo: < |
| - | nfs-server.service - NFS server and services | + | link/ |
| - | Loaded: loaded (/usr/lib/systemd/ | + | inet 127.0.0.1/8 scope host lo |
| - | Active: active (exited) since Thu 2015-10-01 13:18:13 CEST; 4s ago | + | |
| - | Process: 9552 ExecStart=/usr/sbin/rpc.nfsd $RPCNFSDARGS (code=exited, status=0/ | + | inet6 ::1/128 scope host |
| - | Process: 9551 ExecStartPre=/ | + | |
| - | Main PID: 9552 (code=exited, status=0/SUCCESS) | + | 2: enp0s3: < |
| - | CGroup: / | + | link/ether 08: |
| + | inet 10.0.2.16/ | ||
| + | | ||
| + | inet 192.168.1.2/ | ||
| + | | ||
| + | inet6 fe80:: | ||
| + | | ||
| + | [root@centos7 ~]# ip addr | ||
| + | 1: lo: < | ||
| + | link/ | ||
| + | inet 127.0.0.1/8 scope host lo | ||
| + | valid_lft forever preferred_lft forever | ||
| + | inet6 ::1/128 scope host | ||
| + | | ||
| + | 2: enp0s3: < | ||
| + | link/ether 08: | ||
| + | inet 10.0.2.16/24 brd 10.0.2.255 scope global enp0s3 | ||
| + | | ||
| + | inet 192.168.1.2/24 brd 192.168.1.255 scope global enp0s3 | ||
| + | valid_lft forever preferred_lft forever | ||
| + | inet6 fe80::a00:27ff:fe03:97dd/64 scope link | ||
| + | | ||
| + | </code> | ||
| + | |||
| + | ===Options de la Commande ip=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | <code> | ||
| + | [root@centos7 ~]# ip --help | ||
| + | Usage: ip [ OPTIONS ] OBJECT { COMMAND | help } | ||
| + | ip [ -force ] -batch filename | ||
| + | where OBJECT := { link | addr | addrlabel | route | rule | neigh | ntable | | ||
| + | | ||
| + | netns | l2tp | tcp_metrics | token } | ||
| + | | ||
| + | -f[amily] { inet | inet6 | ipx | dnet | bridge | link } | | ||
| + | -4 | -6 | -I | -D | -B | -0 | | ||
| + | -l[oops] { maximum-addr-flush-attempts } | | ||
| + | -o[neline] | -t[imestamp] | -b[atch] [filename] | | ||
| + | -rc[vbuf] [size]} | ||
| - | Oct 01 13:18:13 centos7.fenestros.loc systemd[1]: Starting NFS server and services... | ||
| - | Oct 01 13:18:13 centos7.fenestros.loc systemd[1]: Started NFS server and services. | ||
| </ | </ | ||
| - | Afin de mettre en place un ou des partages **permanents**, | + | ====Activer/Désactiver une Interface Manuellement==== |
| + | |||
| + | Deux commandes existent pour désactiver et activer manuellement une interface réseau | ||
| < | < | ||
| - | /home/trainee 192.168.1.1 | + | [root@centos7 ~]# nmcli device disconnect enp0s3 |
| - | /tmp *(fsid=0) | + | [root@centos7 ~]# nmcli device connect enp0s3 |
| + | </code> | ||
| + | |||
| + | ====Routage Statique==== | ||
| + | |||
| + | ===La commande ip=== | ||
| + | |||
| + | Sous RHEL/CentOS 7, pour supprimer la route vers le réseau | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ip route | ||
| + | default via 10.0.2.2 dev enp0s3 | ||
| + | 10.0.2.0/24 dev enp0s3 | ||
| + | 192.168.1.0/24 dev enp0s3 | ||
| + | |||
| + | [root@centos7 ~]# ip route del 192.168.1.0/24 via 0.0.0.0 | ||
| + | |||
| + | [root@centos7 ~]# ip route | ||
| + | default via 10.0.2.2 dev enp0s3 | ||
| + | 10.0.2.0/24 dev enp0s3 | ||
| + | </ | ||
| + | |||
| + | Pour ajouter la route vers le réseau 192.168.1.0 : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ip route add 192.168.1.0/ | ||
| + | |||
| + | [root@centos7 ~]# ip route | ||
| + | default via 10.0.2.2 dev enp0s3 | ||
| + | 10.0.2.0/24 dev enp0s3 | ||
| + | 192.168.1.0/ | ||
| </ | </ | ||
| <WRAP center round important> | <WRAP center round important> | ||
| - | **Important** : Dans ce cas, nous avons partagé le répertoire **/home/trainee** pour la seule adresse IP 192.168.1.1. | + | La commande utilisée pour ajouter une passerelle par défaut prend la forme suivante |
| </ | </ | ||
| - | Redémarrez maintenant | + | ===Activer/ |
| + | |||
| + | Pour activer le routage sur le serveur, il convient d' | ||
| < | < | ||
| - | [root@centos7 ~]# systemctl restart nfs.service | + | [root@centos7 ~]# echo 1 > / |
| - | [root@centos7 ~]# systemctl status nfs.service | + | [root@centos7 ~]# cat /proc/sys/net/ipv4/ip_forward |
| - | nfs-server.service - NFS server and services | + | 1 |
| - | | + | </code> |
| - | Active: active (exited) since Thu 2015-10-01 14:24:50 CEST; 18s ago | + | |
| - | | + | |
| - | Process: 4639 ExecStopPost=/ | + | |
| - | Process: 4638 ExecStop=/ | + | |
| - | Process: 4650 ExecStart=/ | + | |
| - | Process: 4649 ExecStartPre=/ | + | |
| - | Main PID: 4650 (code=exited, | + | |
| - | | + | |
| - | Oct 01 14:24:50 centos7.fenestros.loc systemd[1]: Starting NFS server and services... | + | Pour désactiver le routage sur le serveur, il convient de désactiver la retransmission des paquets: |
| - | Oct 01 14: | + | |
| - | Oct 01 14: | + | < |
| - | Oct 01 14:24:50 centos7.fenestros.loc systemd[1]: Started NFS server and services. | + | [root@centos7 |
| + | [root@centos7 | ||
| + | 0 | ||
| </ | </ | ||
| - | Puisque aucune option ne soit spécifiée pour les montages, ceux-ci ont été exportés avec des option par défaut. En utilisant | + | =====Diagnostique du Réseau===== |
| + | |||
| + | ====ping==== | ||
| + | |||
| + | Pour tester | ||
| < | < | ||
| - | [root@centos7 ~]# exportfs -v | + | [root@centos7 ~]# ping 10.0.2.2 |
| - | / | + | PING 10.0.2.2 (10.0.2.2) 56(84) bytes of data. |
| - | /tmp < | + | 64 bytes from 10.0.2.2: icmp_seq=1 ttl=63 time=0.602 ms |
| + | 64 bytes from 10.0.2.2: icmp_seq=2 ttl=63 time=0.375 ms | ||
| + | 64 bytes from 10.0.2.2: icmp_seq=3 ttl=63 time=0.512 ms | ||
| + | 64 bytes from 10.0.2.2: icmp_seq=4 ttl=63 time=0.547 ms | ||
| + | ^C | ||
| + | --- 10.0.2.2 ping statistics --- | ||
| + | 4 packets transmitted, 4 received, 0% packet loss, time 3035ms | ||
| + | rtt min/ | ||
| </ | </ | ||
| - | ====Configuration du Client==== | + | ===Options de la commande ping=== |
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ping --help | ||
| + | ping: invalid option -- ' | ||
| + | Usage: ping [-aAbBdDfhLnOqrRUvV] [-c count] [-i interval] [-I interface] | ||
| + | [-m mark] [-M pmtudisc_option] [-l preload] [-p pattern] [-Q tos] | ||
| + | [-s packetsize] [-S sndbuf] [-t ttl] [-T timestamp_option] | ||
| + | [-w deadline] [-W timeout] [hop1 ...] destination | ||
| + | </ | ||
| + | |||
| + | ====netstat -i==== | ||
| + | |||
| + | Pour visualiser les statistiques réseaux, vous disposez de la commande **netstat** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# netstat -i | ||
| + | Kernel Interface table | ||
| + | Iface MTU RX-OK RX-ERR RX-DRP RX-OVR | ||
| + | enp0s3 | ||
| + | lo | ||
| + | </ | ||
| + | |||
| + | ===Options de la commande netstat=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# netstat --help | ||
| + | usage: netstat [-vWeenNcCF] [< | ||
| + | | ||
| + | | ||
| + | |||
| + | -r, --route | ||
| + | -I, --interfaces=< | ||
| + | -i, --interfaces | ||
| + | -g, --groups | ||
| + | -s, --statistics | ||
| + | -M, --masquerade | ||
| + | |||
| + | -v, --verbose | ||
| + | -W, --wide | ||
| + | -n, --numeric | ||
| + | --numeric-hosts | ||
| + | --numeric-ports | ||
| + | --numeric-users | ||
| + | -N, --symbolic | ||
| + | -e, --extend | ||
| + | -p, --programs | ||
| + | -o, --timers | ||
| + | -c, --continuous | ||
| + | |||
| + | -l, --listening | ||
| + | -a, --all display all sockets (default: connected) | ||
| + | -F, --fib display Forwarding Information Base (default) | ||
| + | -C, --cache | ||
| + | -Z, --context | ||
| + | |||
| + | < | ||
| + | | ||
| + | < | ||
| + | List of possible address families (which support routing): | ||
| + | inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25) | ||
| + | netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP) | ||
| + | x25 (CCITT X.25) | ||
| + | </ | ||
| + | |||
| + | ====La commande traceroute==== | ||
| + | |||
| + | La commande ping est à la base de la commande **traceroute**. Cette commande sert à découvrir la route empruntée pour accéder à un site donné : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# traceroute www.i2tch.eu | ||
| + | traceroute to www.i2tch.eu (217.160.122.33), | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | 10 * * * | ||
| + | 11 * * * | ||
| + | 12 * * * | ||
| + | 13 * * * | ||
| + | 14 * * * | ||
| + | 15 * * * | ||
| + | 16 * * * | ||
| + | 17 * * * | ||
| + | 18 * * * | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | ===Options de la commande traceroute=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# traceroute --help | ||
| + | Usage: | ||
| + | traceroute [ -46dFITnreAUDV ] [ -f first_ttl ] [ -g gate,... ] [ -i device ] [ -m max_ttl ] [ -N squeries ] [ -p port ] [ -t tos ] [ -l flow_label ] [ -w waittime ] [ -q nqueries ] [ -s src_addr ] [ -z sendwait ] [ --fwmark=num ] host [ packetlen ] | ||
| + | Options: | ||
| + | -4 Use IPv4 | ||
| + | -6 Use IPv6 | ||
| + | -d --debug | ||
| + | -F --dont-fragment | ||
| + | -f first_ttl | ||
| + | Start from the first_ttl hop (instead from 1) | ||
| + | -g gate, | ||
| + | Route packets through the specified gateway | ||
| + | (maximum 8 for IPv4 and 127 for IPv6) | ||
| + | -I --icmp | ||
| + | -T --tcp Use TCP SYN for tracerouting (default port is 80) | ||
| + | -i device | ||
| + | Specify a network interface to operate with | ||
| + | -m max_ttl | ||
| + | Set the max number of hops (max TTL to be | ||
| + | reached). Default is 30 | ||
| + | -N squeries | ||
| + | Set the number of probes to be tried | ||
| + | simultaneously (default is 16) | ||
| + | -n Do not resolve IP addresses to their domain names | ||
| + | -p port --port=port | ||
| + | initial udp port value for " | ||
| + | (incremented by each probe, default is 33434), or | ||
| + | initial seq for " | ||
| + | default from 1), or some constant destination | ||
| + | port for other methods (with default of 80 for | ||
| + | " | ||
| + | -t tos --tos=tos | ||
| + | traffic class) value for outgoing packets | ||
| + | -l flow_label | ||
| + | Use specified flow_label for IPv6 packets | ||
| + | -w waittime | ||
| + | Set the number of seconds to wait for response to | ||
| + | a probe (default is 5.0). Non-integer (float | ||
| + | point) values allowed too | ||
| + | -q nqueries | ||
| + | Set the number of probes per each hop. Default is | ||
| + | 3 | ||
| + | -r Bypass the normal routing and send directly to a | ||
| + | host on an attached network | ||
| + | -s src_addr | ||
| + | Use source src_addr for outgoing packets | ||
| + | -z sendwait | ||
| + | Minimal time interval between probes (default 0). | ||
| + | If the value is more than 10, then it specifies a | ||
| + | number in milliseconds, | ||
| + | seconds (float point values allowed too) | ||
| + | -e --extensions | ||
| + | -A --as-path-lookups | ||
| + | print results directly after the corresponding | ||
| + | addresses | ||
| + | -M name --module=name | ||
| + | for traceroute operations. Most methods have | ||
| + | their shortcuts (`-I' means `-M icmp' etc.) | ||
| + | -O OPTS, | ||
| + | Use module-specific option OPTS for the | ||
| + | traceroute module. Several OPTS allowed, | ||
| + | separated by comma. If OPTS is " | ||
| + | about available options | ||
| + | --sport=num | ||
| + | `-N 1' | ||
| + | --fwmark=num | ||
| + | -U --udp Use UDP to particular port for tracerouting | ||
| + | (instead of increasing the port per each probe), | ||
| + | default port is 53 | ||
| + | -UL Use UDPLITE for tracerouting (default dest port | ||
| + | is 53) | ||
| + | -D --dccp | ||
| + | is 33434) | ||
| + | -P prot --protocol=prot | ||
| + | --mtu | ||
| + | `-F -N 1' | ||
| + | --back | ||
| + | print if it differs | ||
| + | -V --version | ||
| + | --help | ||
| + | |||
| + | Arguments: | ||
| + | + | ||
| + | packetlen | ||
| + | header plus 40). Can be ignored or increased to a minimal | ||
| + | allowed value | ||
| + | </ | ||
| + | |||
| + | =====Connexions à Distance===== | ||
| + | |||
| + | ==== Telnet | ||
| <WRAP center round important> | <WRAP center round important> | ||
| - | **Important** : Arrêtez votre VM. Créez une clône | + | La commande |
| </ | </ | ||
| - | Re-configurez ensuite l'interface réseau | + | La commande **telnet** est utilisée pour établir une connexion à distance avec un serveur telnet : |
| + | |||
| + | < | ||
| + | # telnet numero_ip | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | Le service telnet revient à une redirection des canaux standards d'entrée et de sortie. Notez que la connexion n'est **pas** sécurisée. Pour fermer la connexion, il faut saisir la commande **exit**. La commande telnet n' | ||
| + | </ | ||
| + | |||
| + | ===Options de la commande telnet=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| < | < | ||
| - | [root@centos7 ~]# nmcli connection del ip_fixe | + | [root@centos7 ~]# telnet --help |
| + | telnet: invalid option -- ' | ||
| + | Usage: telnet [-8] [-E] [-L] [-S tos] [-a] [-c] [-d] [-e char] [-l user] | ||
| + | [-n tracefile] [-b hostalias ] [-r] | ||
| + | | ||
| + | </ | ||
| - | [root@centos7 ~]# nmcli connection show ip_fixe | + | ==== wget ==== |
| - | Error: ip_fixe - no such connection profile. | + | |
| - | [root@centos7 ~]# nmcli connection add con-name ip_fixe ifname enp0s3 type ethernet ip4 10.0.2.17/ | + | La commande **wget** est utilisée pour récupérer un fichier via http, https ou ftp : |
| - | Connection ' | + | |
| - | [root@centos7 ~]# nmcli connection mod ip_fixe ipv4.dns 8.8.8.8 | + | < |
| + | [root@centos7 ~]# wget https://www.dropbox.com/ | ||
| + | --2017-06-22 16: | ||
| + | Resolving www.dropbox.com (www.dropbox.com)... 162.125.65.1 | ||
| + | Connecting to www.dropbox.com (www.dropbox.com)|162.125.65.1|: | ||
| + | HTTP request sent, awaiting response... 302 Found | ||
| + | Location: https:// | ||
| + | --2017-06-22 16: | ||
| + | Resolving dl.dropboxusercontent.com (dl.dropboxusercontent.com)... 162.125.65.6 | ||
| + | Connecting to dl.dropboxusercontent.com (dl.dropboxusercontent.com)|162.125.65.6|: | ||
| + | HTTP request sent, awaiting response... 200 OK | ||
| + | Length: 17 [text/ | ||
| + | Saving to: ‘fichier_test? | ||
| - | [root@centos7 ~]# nmcli connection mod ip_fixe +ipv4.addresses 192.168.1.1/24 | + | 100%[====================================================================================> |
| - | [root@centos7 ~]# nmcli connection up ip_fixe | + | 2017-06-22 16:53:41 (480 KB/s) - ‘fichier_test? |
| - | Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ | + | </code> |
| - | [root@centos7 ~]# systemctl restart NetworkManager.service | + | ===Options de la commande wget=== |
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# wget --help | ||
| + | GNU Wget 1.14, a non-interactive network retriever. | ||
| + | Usage: wget [OPTION]... [URL]... | ||
| + | |||
| + | Mandatory arguments to long options are mandatory for short options too. | ||
| + | |||
| + | Startup: | ||
| + | -V, --version | ||
| + | -h, --help | ||
| + | -b, --background | ||
| + | -e, --execute=COMMAND | ||
| + | |||
| + | Logging and input file: | ||
| + | -o, --output-file=FILE | ||
| + | -a, --append-output=FILE | ||
| + | -d, --debug | ||
| + | -q, --quiet | ||
| + | -v, --verbose | ||
| + | -nv, --no-verbose | ||
| + | | ||
| + | -i, --input-file=FILE | ||
| + | -F, --force-html | ||
| + | -B, --base=URL | ||
| + | | ||
| + | | ||
| + | |||
| + | Download: | ||
| + | -t, --tries=NUMBER | ||
| + | | ||
| + | -O, --output-document=FILE | ||
| + | -nc, --no-clobber | ||
| + | | ||
| + | -c, --continue | ||
| + | | ||
| + | -N, --timestamping | ||
| + | | ||
| + | --no-use-server-timestamps | ||
| + | the one on the server. | ||
| + | -S, --server-response | ||
| + | | ||
| + | -T, --timeout=SECONDS | ||
| + | | ||
| + | | ||
| + | | ||
| + | -w, --wait=SECONDS | ||
| + | | ||
| + | | ||
| + | | ||
| + | -Q, --quota=NUMBER | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | -4, --inet4-only | ||
| + | -6, --inet6-only | ||
| + | | ||
| + | one of IPv6, IPv4, or none. | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Directories: | ||
| + | -nd, --no-directories | ||
| + | -x, --force-directories | ||
| + | -nH, --no-host-directories | ||
| + | | ||
| + | -P, --directory-prefix=PREFIX | ||
| + | | ||
| + | |||
| + | HTTP options: | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | this is `index.html' | ||
| + | -E, --adjust-extension | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | -U, --user-agent=AGENT | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | HTTPS (SSL/TLS) options: | ||
| + | | ||
| + | SSLv3, and TLSv1. | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | FTP options: | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | WARC options: | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | WARC writer. | ||
| + | |||
| + | Recursive download: | ||
| + | -r, --recursive | ||
| + | -l, --level=NUMBER | ||
| + | | ||
| + | -k, --convert-links | ||
| + | local files. | ||
| + | --backups=N | ||
| + | -K, --backup-converted | ||
| + | -m, --mirror | ||
| + | -p, --page-requisites | ||
| + | | ||
| + | |||
| + | Recursive accept/ | ||
| + | -A, --accept=LIST | ||
| + | -R, --reject=LIST | ||
| + | | ||
| + | | ||
| + | | ||
| + | -D, --domains=LIST | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | -H, --span-hosts | ||
| + | -L, --relative | ||
| + | -I, --include-directories=LIST | ||
| + | --trust-server-names | ||
| + | url last component. | ||
| + | -X, --exclude-directories=LIST | ||
| + | -np, --no-parent | ||
| + | |||
| + | Mail bug reports and suggestions to < | ||
| </ | </ | ||
| - | <WRAP center round important > | + | ==== ftp ==== |
| - | **Important** : Démarrez la VM d'origine. | + | |
| + | <WRAP center round important> | ||
| + | La commande | ||
| </ | </ | ||
| - | Dans la VM d' | + | La commande **ftp** est utilisée pour le transfert de fichiers: |
| < | < | ||
| - | [root@centos7 ~]# getenforce | + | [root@centos7 ~]# ftp ftp2.fenestros.com |
| - | Enforcing | + | Connected to ftp2.fenestros.com |
| - | [root@centos7 ~]# setenforce permissive | + | 220 anonymous.ftp.ovh.net NcFTPd Server |
| - | [root@centos7 ~]# systemctl status firewalld.service | + | Name (ftp2.fenestros.com:root): anonymous |
| - | firewalld.service - firewalld - dynamic firewall daemon | + | 331 Guest login ok, send your complete e-mail address as password. |
| - | | + | Password: |
| - | Active: active | + | 230 Logged in anonymously. |
| - | Main PID: 479 (firewalld) | + | Remote |
| - | CGroup: /system.slice/ | + | Using binary mode to transfer files. |
| - | └─479 | + | ftp> |
| + | </code> | ||
| + | |||
| + | Une fois connecté, il convient d' | ||
| + | |||
| + | < | ||
| + | ftp> help | ||
| + | Commands may be abbreviated. | ||
| - | Oct 01 14:54:57 centos7.fenestros.loc systemd[1]: Started firewalld - dynamic firewall daemon. | + | ! debug mdir sendport site |
| - | [root@centos7 ~]# systemctl stop firewalld.service | + | $ dir mget put size |
| + | account disconnect mkdir pwd status | ||
| + | append exit mls quit struct | ||
| + | ascii form mode quote system | ||
| + | bell get modtime recv sunique | ||
| + | binary glob mput reget tenex | ||
| + | bye hash newer rstatus tick | ||
| + | case help nmap rhelp trace | ||
| + | cd idle nlist rename type | ||
| + | cdup image ntrans reset user | ||
| + | chmod lcd open restart umask | ||
| + | close ls prompt rmdir verbose | ||
| + | cr macdef passive runique ? | ||
| + | delete mdelete proxy send | ||
| + | ftp> | ||
| </ | </ | ||
| - | A partir de votre client, consultez les répertoire exportés du serveur : | + | Le caractère **!** permet d' |
| < | < | ||
| - | [root@centos7 ~]# showmount --exports 192.168.1.2 | + | ftp> !pwd |
| - | Export list for 192.168.1.2: | + | /root |
| - | /tmp * | + | |
| - | / | + | |
| </ | </ | ||
| - | Créez maintenant | + | Pour transférer un fichier vers le serveur, il convient d' |
| + | |||
| + | < | ||
| + | ftp> put nom_fichier_local nom_fichier_distant | ||
| + | </file> | ||
| + | |||
| + | Vous pouvez également transférer plusieurs fichiers à la fois grâce à la commande | ||
| + | |||
| + | < | ||
| + | ftp> mput nom*.* | ||
| + | </ | ||
| + | |||
| + | Pour transférer un fichier du serveur, il convient d' | ||
| + | |||
| + | < | ||
| + | ftp> get nom_fichier | ||
| + | </ | ||
| + | |||
| + | Vous pouvez également transférer plusieurs fichiers à la fois grâce à la commande **mget** ( voir la commande **mput** ci-dessus ). | ||
| + | |||
| + | Pour supprimer un fichier sur le serveur, il convient d' | ||
| + | |||
| + | < | ||
| + | ftp> del nom_fichier | ||
| + | </file> | ||
| + | |||
| + | Pour fermer la session, il convient d' | ||
| < | < | ||
| - | [root@centos7 ~]# mkdir /nfs | + | ftp> quit |
| - | [root@centos7 ~]# mount -t nfs 192.168.1.2:/ | + | [root@centos7 ~]# |
| </ | </ | ||
| - | Notez que quand vous essayer | + | ====SSH==== |
| + | |||
| + | ===Introduction=== | ||
| + | |||
| + | La commande **[[wpfr> | ||
| + | |||
| + | * Le **serveur SSH** | ||
| + | * le démon sshd, qui s' | ||
| + | * Le **client SSH** | ||
| + | * ssh ou scp, qui assure la connexion et le dialogue avec le serveur, | ||
| + | * La **session** qui représente la connexion courante et qui commence juste après l' | ||
| + | * Les **clefs** | ||
| + | * **Couple de clef utilisateur asymétriques** et persistantes qui assurent l' | ||
| + | * **Clef hôte asymétrique et persistante** garantissant l' | ||
| + | * **Clef serveur asymétrique et temporaire** utilisée par le protocole SSH1 qui sert au chiffrement de la clé de session, | ||
| + | * **Clef de session symétrique qui est générée aléatoirement** et qui permet le chiiffrement de la communication entre le client et le serveur. Elle est détruite en fin de session. SSH-1 utilise une seule clef tandis | ||
| + | * La **base de données des hôtes connus** qui stocke les clés des connexions précédentes. | ||
| + | |||
| + | SSH fonctionne de la manière suivante pour la la mise en place d'un canal sécurisé: | ||
| + | |||
| + | * Le client contacte le serveur sur son port 22, | ||
| + | * Les client et le serveur échangent leur version de SSH. En cas de non-compatibilité de versions, l'un des deux met fin au processus, | ||
| + | * Le serveur SSH s' | ||
| + | * Sa clé hôte, | ||
| + | * Sa clé serveur, | ||
| + | * Une séquence aléatoire | ||
| + | * Une liste de méthodes de chiffrage, compression et authentification, | ||
| + | * Le client et le serveur produisent un identifiant identique, un haché MD5 long de 128 bits contenant la clé hôte, la clé serveur et la séquence aléatoire, | ||
| + | * Le client génère sa clé de session symétrique et la chiffre deux fois de suite, une fois avec la clé hôte du serveur et la deuxième fois avec la clé serveur. Le client envoie cette clé au serveur accompagnée de la séquence aléatoire et un choix d' | ||
| + | * Le serveur déchiffre la clé de session, | ||
| + | * Le client et le serveur mettent | ||
| + | |||
| + | ==SSH-1== | ||
| + | |||
| + | SSH-1 utilise une paire de clefs de type RSA1. Il assure l' | ||
| + | |||
| + | Afin de s' | ||
| + | |||
| + | | ||
| + | * **Rhosts**, | ||
| + | * **%%RhostsRSA%%**, | ||
| + | * Par **clef asymétrique**, | ||
| + | * **TIS**, | ||
| + | * Par **mot de passe**. | ||
| + | |||
| + | ==SSH-2== | ||
| + | |||
| + | SSH-2 utilise **DSA** ou **RSA**. Il assure l' | ||
| + | |||
| + | * **SSH-TRANS** – Transport Layer Protocol, | ||
| + | * **SSH-AUTH** – Authentification Protocol, | ||
| + | * **SSH-CONN** – Connection Protocol. | ||
| + | |||
| + | SSH-2 diffère de SSH-1 essentiellement dans la phase authentification. | ||
| + | |||
| + | Trois méthodes d' | ||
| + | |||
| + | | ||
| + | * Identique à SSH-1 sauf avec l' | ||
| + | * **%%RhostsRSA%%**, | ||
| + | * Par **mot de passe**. | ||
| + | |||
| + | ==Options de la commande== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| < | < | ||
| - | [root@centos7 | + | [root@centos6 |
| - | -bash: cd: /nfs: Permission denied | + | usage: ssh [-1246AaCfgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec] |
| + | [-D [bind_address:]port] [-e escape_char] [-F configfile] | ||
| + | [-i identity_file] [-L [bind_address:]port: | ||
| + | [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port] | ||
| + | [-R [bind_address: | ||
| + | [-w local_tun[: | ||
| + | </code> | ||
| + | |||
| + | ===L' | ||
| + | |||
| + | L' | ||
| + | |||
| + | Avantage: | ||
| + | * Aucune configuration de clef asymétrique n'est nécessaire. | ||
| + | |||
| + | Inconvénients: | ||
| + | * L' | ||
| + | * Moins sécurisé qu'un système par clef asymétrique. | ||
| + | |||
| + | ===L' | ||
| + | |||
| + | * Le **client** envoie au serveur une requête d' | ||
| + | * Le **serveur** recherche une correspondance pour ce module dans le fichier des clés autorisés **~/ | ||
| + | * Dans le cas où une correspondance n'est pas trouvée, le serveur met fin à la communication, | ||
| + | * Dans le cas contraire le serveur génère une chaîne aléatoire de 256 bits appelée un **challenge** et la chiffre avec la **clé publique du client**, | ||
| + | * Le **client** reçoit le challenge et le décrypte avec la partie privée de sa clé. Il combine le challenge avec l' | ||
| + | * Le **serveur** génère le même haché et le compare avec celui reçu du client. Si les deux hachés sont identiques, l' | ||
| + | |||
| + | ===Installation=== | ||
| + | |||
| + | Pour installer/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# yum install openssh-server | ||
| + | Loaded plugins: fastestmirror, | ||
| + | Loading mirror speeds from cached hostfile | ||
| + | * base: centos.mirror.fr.planethoster.net | ||
| + | * extras: ftp.ciril.fr | ||
| + | * updates: centos.mirrors.ovh.net | ||
| + | Package openssh-server-6.6.1p1-25.el7_2.x86_64 already installed and latest version | ||
| + | Nothing to do | ||
| </ | </ | ||
| <WRAP center round important> | <WRAP center round important> | ||
| - | **Important** | + | **Important** |
| </ | </ | ||
| - | Retournez donc dans le serveur | + | ==Options de la commande== |
| + | |||
| + | Les options de la commande sont : | ||
| + | |||
| + | < | ||
| + | SYNOPSIS | ||
| + | sshd [-46DdeiqTt] [-b bits] [-C connection_spec] [-f config_file] [-g login_grace_time] [-h host_key_file] [-k key_gen_time] [-o option] [-p port] [-u len] | ||
| + | </ | ||
| + | |||
| + | ===Configuration=== | ||
| + | |||
| + | <WRAP center round important> | ||
| + | **Important** - La configuration doit s' | ||
| + | </ | ||
| + | |||
| + | ==Serveur== | ||
| + | |||
| + | La configuration du serveur | ||
| < | < | ||
| - | [root@centos7 ~]# cat /etc/exports | + | [root@centos7 ~]# cat /etc/ssh/ |
| - | /home/trainee 192.168.1.1(async,rw, | + | # $OpenBSD: sshd_config, |
| - | /tmp * | + | |
| + | # This is the sshd server system-wide configuration file. See | ||
| + | # sshd_config(5) for more information. | ||
| + | |||
| + | # This sshd was compiled with PATH=/ | ||
| + | |||
| + | # The strategy used for options in the default sshd_config shipped with | ||
| + | # OpenSSH is to specify options with their default value where | ||
| + | # possible, but leave them commented. | ||
| + | # default value. | ||
| + | |||
| + | # If you want to change the port on a SELinux system, you have to tell | ||
| + | # SELinux about this change. | ||
| + | # semanage port -a -t ssh_port_t -p tcp # | ||
| + | # | ||
| + | #Port 22 | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # The default requires explicit activation of protocol | ||
| + | #Protocol 2 | ||
| + | |||
| + | # HostKey for protocol version 1 | ||
| + | #HostKey / | ||
| + | # HostKeys for protocol version 2 | ||
| + | HostKey / | ||
| + | #HostKey / | ||
| + | HostKey / | ||
| + | HostKey / | ||
| + | |||
| + | # Lifetime and size of ephemeral version 1 server key | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Ciphers and keying | ||
| + | #RekeyLimit default none | ||
| + | |||
| + | # Logging | ||
| + | # obsoletes QuietMode and FascistLogging | ||
| + | # | ||
| + | SyslogFacility AUTHPRIV | ||
| + | #LogLevel INFO | ||
| + | |||
| + | # Authentication: | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # | ||
| + | # | ||
| + | |||
| + | # The default is to check both .ssh/ | ||
| + | # but this is overridden so installations will only check .ssh/ | ||
| + | AuthorizedKeysFile .ssh/ | ||
| + | |||
| + | # | ||
| + | |||
| + | # | ||
| + | # | ||
| + | |||
| + | # For this to work you will also need host keys in / | ||
| + | # | ||
| + | # similar for protocol version 2 | ||
| + | # | ||
| + | # Change to yes if you don't trust ~/ | ||
| + | # RhostsRSAAuthentication and HostbasedAuthentication | ||
| + | # | ||
| + | # Don't read the user's ~/.rhosts and ~/.shosts files | ||
| + | # | ||
| + | |||
| + | # To disable tunneled clear text passwords, change to no here! | ||
| + | # | ||
| + | # | ||
| + | PasswordAuthentication yes | ||
| + | |||
| + | # Change to no to disable s/key passwords | ||
| + | # | ||
| + | ChallengeResponseAuthentication no | ||
| + | |||
| + | # Kerberos options | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # GSSAPI options | ||
| + | GSSAPIAuthentication yes | ||
| + | GSSAPICleanupCredentials no | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set this to ' | ||
| + | # and session processing. If this is enabled, PAM authentication will | ||
| + | # be allowed through the ChallengeResponseAuthentication and | ||
| + | # PasswordAuthentication. | ||
| + | # PAM authentication via ChallengeResponseAuthentication may bypass | ||
| + | # the setting of " | ||
| + | # If you just want the PAM account and session checks to run without | ||
| + | # PAM authentication, | ||
| + | # and ChallengeResponseAuthentication to ' | ||
| + | # WARNING: ' | ||
| + | # problems. | ||
| + | UsePAM yes | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | X11Forwarding yes | ||
| + | # | ||
| + | # | ||
| + | #PermitTTY yes | ||
| + | #PrintMotd yes | ||
| + | # | ||
| + | # | ||
| + | #UseLogin no | ||
| + | UsePrivilegeSeparation sandbox # Default for new installations. | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #UseDNS yes | ||
| + | #PidFile / | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # no default banner path | ||
| + | #Banner none | ||
| + | |||
| + | # Accept locale-related environment variables | ||
| + | AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES | ||
| + | AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT | ||
| + | AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE | ||
| + | AcceptEnv XMODIFIERS | ||
| + | |||
| + | # override default of no subsystems | ||
| + | Subsystem sftp / | ||
| + | |||
| + | # Example of overriding settings on a per-user basis | ||
| + | #Match User anoncvs | ||
| + | # | ||
| + | # | ||
| + | # PermitTTY no | ||
| + | # | ||
| </ | </ | ||
| - | Redémarrez le service nfs : | + | Pour ôter les lignes de commentaires dans ce fichier, utilisez la commande suivante |
| < | < | ||
| - | [root@centos7 ~]# systemctl restart nfs.service | + | [root@centos7 ~]# cd /tmp ; grep -E -v ' |
| + | [root@centos7 tmp]# cat sshd_config | ||
| + | HostKey / | ||
| + | HostKey / | ||
| + | HostKey / | ||
| + | SyslogFacility AUTHPRIV | ||
| + | AuthorizedKeysFile .ssh/ | ||
| + | PasswordAuthentication yes | ||
| + | ChallengeResponseAuthentication no | ||
| + | GSSAPIAuthentication yes | ||
| + | GSSAPICleanupCredentials no | ||
| + | UsePAM yes | ||
| + | X11Forwarding yes | ||
| + | UsePrivilegeSeparation sandbox # Default for new installations. | ||
| + | AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES | ||
| + | AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT | ||
| + | AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE | ||
| + | AcceptEnv XMODIFIERS | ||
| + | Subsystem sftp / | ||
| </ | </ | ||
| - | Vous noterez que maintenant vous êtes capable | + | Pour sécuriser le serveur ssh, ajoutez ou modifiez les directives suivantes : |
| + | |||
| + | < | ||
| + | AllowGroups adm | ||
| + | Banner / | ||
| + | HostbasedAuthentication no | ||
| + | IgnoreRhosts yes | ||
| + | LoginGraceTime 60 | ||
| + | LogLevel INFO | ||
| + | PermitEmptyPasswords no | ||
| + | PermitRootLogin no | ||
| + | PrintLastLog yes | ||
| + | Protocol 2 | ||
| + | StrictModes yes | ||
| + | X11Forwarding no | ||
| + | </ | ||
| + | |||
| + | Votre fichier ressemblera à celui-ci : | ||
| + | |||
| + | < | ||
| + | AllowGroups adm | ||
| + | Banner / | ||
| + | HostbasedAuthentication no | ||
| + | IgnoreRhosts yes | ||
| + | LoginGraceTime 60 | ||
| + | LogLevel INFO | ||
| + | PermitEmptyPasswords no | ||
| + | PermitRootLogin no | ||
| + | PrintLastLog yes | ||
| + | Protocol 2 | ||
| + | StrictModes yes | ||
| + | X11Forwarding no | ||
| + | HostKey / | ||
| + | HostKey / | ||
| + | HostKey / | ||
| + | SyslogFacility AUTHPRIV | ||
| + | AuthorizedKeysFile .ssh/ | ||
| + | PasswordAuthentication yes | ||
| + | ChallengeResponseAuthentication no | ||
| + | GSSAPIAuthentication yes | ||
| + | GSSAPICleanupCredentials no | ||
| + | UsePAM yes | ||
| + | UsePrivilegeSeparation sandbox # Default for new installations. | ||
| + | AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES | ||
| + | AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT | ||
| + | AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE | ||
| + | AcceptEnv XMODIFIERS | ||
| + | Subsystem sftp / | ||
| + | </ | ||
| + | |||
| + | <WRAP center round todo> | ||
| + | **A Faire** - Renommez le fichier **/ | ||
| + | </ | ||
| + | |||
| + | Pour générer les clefs sur le serveur saisissez la commande suivante | ||
| + | |||
| + | Lors de la génération des clefs, la passphrase doit être **vide**. | ||
| < | < | ||
| - | [root@centos7 ~]# cd /nfs | + | [root@centos7 ~]# ssh-keygen -t dsa |
| - | [root@centos7 | + | Generating public/private dsa key pair. |
| + | Enter file in which to save the key (/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | d5: | ||
| + | The key's randomart image is: | ||
| + | +--[ DSA 1024]----+ | ||
| + | | +oBB.| | ||
| + | | o *.o*| | ||
| + | | . o +.o| | ||
| + | | | ||
| + | | S .=..| | ||
| + | | .o.| | ||
| + | | o| | ||
| + | | E| | ||
| + | | | | ||
| + | +-----------------+ | ||
| </ | </ | ||
| - | =====Surveillance du Serveur===== | + | <WRAP center round important> |
| + | Le chemin à indiquer pour le fichier est **/ | ||
| + | </ | ||
| - | ====La Commande rpcinfo==== | + | Les clefs publiques générées possèdent l' |
| - | La commande **rpcinfo** permet de faire une requête RPC sur le serveur et de voir les démons gérés | + | < |
| + | [root@centos7 ~]# ls /etc/ssh | ||
| + | moduli | ||
| + | ssh_config | ||
| + | </ | ||
| + | |||
| + | Re-démarrez ensuite | ||
| < | < | ||
| - | [root@centos6 | + | [root@centos7 |
| - | | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100000 | + | |
| - | 100024 | + | |
| - | 100024 | + | |
| - | 100024 | + | |
| - | 100024 | + | |
| - | 100011 | + | |
| - | 100011 | + | |
| - | 100011 | + | |
| - | 100011 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100005 | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100227 | + | |
| - | 100227 | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100227 | + | |
| - | 100227 | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100227 | + | |
| - | 100227 | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100003 | + | |
| - | 100227 | + | |
| - | 100227 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| - | 100021 | + | |
| </ | </ | ||
| + | |||
| + | Saisissez maintenant les commandes suivantes en tant que **trainee** : | ||
| + | |||
| + | <WRAP center round important> | ||
| + | Lors de la génération des clefs, la passphrase doit être **vide**. | ||
| + | </ | ||
| < | < | ||
| - | [root@centos7 ~]# rpcinfo | + | [trainee@centos7 ~]$ ssh-keygen -t dsa |
| - | program version netid | + | Generating public/ |
| - | | + | Enter file in which to save the key (/ |
| - | | + | Created directory '/ |
| - | | + | Enter passphrase (empty for no passphrase): |
| - | | + | Enter same passphrase again: |
| - | 100000 | + | Your identification has been saved in / |
| - | | + | Your public key has been saved in / |
| - | | + | The key fingerprint is: |
| - | | + | 97:92: |
| - | | + | The key's randomart image is: |
| - | | + | +--[ DSA 1024]----+ |
| - | | + | | |
| - | | + | | o. . o.| |
| - | 100024 | + | | |
| - | | + | | o.. ..E.| |
| - | | + | | S.o..oo .| |
| - | | + | | |
| - | | + | | . . =. | |
| - | | + | | |
| - | 100005 | + | | | |
| - | | + | +-----------------+ |
| - | | + | [trainee@centos7 ~]$ ssh-keygen -t rsa |
| - | | + | Generating public/ |
| - | | + | Enter file in which to save the key (/home/trainee/.ssh/ |
| - | | + | Enter passphrase (empty for no passphrase): |
| - | | + | Enter same passphrase again: |
| - | | + | Your identification has been saved in /home/trainee/.ssh/id_rsa. |
| - | | + | Your public key has been saved in / |
| - | | + | The key fingerprint is: |
| - | 100003 | + | 80:4c:5a: |
| - | | + | The key's randomart image is: |
| - | 100227 | + | +--[ RSA 2048]----+ |
| - | | + | | +o=o.. | |
| - | | + | | * Xo+o. | |
| - | | + | | |
| - | | + | | .E=. | |
| - | | + | | o.S | |
| - | | + | | . | |
| - | | + | | | |
| - | | + | | | |
| - | 100227 | + | | | |
| - | | + | +-----------------+ |
| - | 100021 | + | [trainee@centos7 ~]$ ssh-keygen -t ecdsa |
| - | | + | Generating public/ |
| - | | + | Enter file in which to save the key (/ |
| - | 100021 | + | Enter passphrase (empty for no passphrase): |
| - | | + | Enter same passphrase again: |
| - | | + | Your identification has been saved in / |
| - | 100021 | + | Your public key has been saved in / |
| - | | + | The key fingerprint is: |
| - | | + | 41:5d:64:cf:d6: |
| - | 100021 | + | The key's randomart image is: |
| - | | + | +--[ECDSA |
| + | | ..... .. o+ | | ||
| + | | | ||
| + | |. .. | ||
| + | | o E | ||
| + | | | ||
| + | | . + | | ||
| + | | o . | ||
| + | | . o . . | | ||
| + | | | ||
| + | +-----------------+ | ||
| + | [trainee@centos7 ~]$ ssh-keygen -t ed25519 | ||
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | 66:3a:83:d1:6d: | ||
| + | The key's randomart image is: | ||
| + | +--[ED25519 | ||
| + | | . . +..oo. | ||
| + | | o +..o. . | | ||
| + | | . . . . | ||
| + | | . . o . . | | ||
| + | | . . S + E | | ||
| + | | o = o + | | ||
| + | | | ||
| + | | | ||
| + | | | | ||
| + | +-----------------+ | ||
| </ | </ | ||
| - | ====La Commande nfsstat==== | + | <WRAP center round important> |
| + | Les clés générées seront placées dans le répertoire **~/ | ||
| + | </ | ||
| - | La Commande **nfsstat** permet de vérifier | + | ==Utilisation== |
| + | |||
| + | La commande ssh prend la forme suivante: | ||
| + | |||
| + | ssh -l nom_de_compte numero_ip (nom_de_machine) | ||
| + | |||
| + | En saisissant cette commande | ||
| < | < | ||
| - | [root@centos6 | + | [trainee@centos7 |
| - | Server rpc stats: | + | Mot de passe : |
| - | calls badcalls | + | Dernière connexion : lundi 9 mai 2016 à 22:47:48 CEST sur pts/0 |
| - | 50 | + | |
| - | Server nfs v4: | + | [root@centos7 ~]# ssh -l trainee localhost |
| - | null | + | The authenticity of host ' |
| - | 2 4% 48 | + | ECDSA key fingerprint is 19:cd: |
| + | Are you sure you want to continue connecting (yes/no)? yes | ||
| + | Warning: Permanently added ' | ||
| + | trainee@localhost' | ||
| + | Last login: Mon May 9 23:25:15 2016 from localhost.localdomain | ||
| + | </ | ||
| - | Server nfs v4 operations: | + | ===Tunnels SSH=== |
| - | op0-unused | + | |
| - | 0 0% 0 0% 0 0% 5 4% 0 0% 0 | + | Le protocole SSH peut être utilisé pour sécuriser les protocoles tels telnet, pop3 etc.. En effet, on peut créer un //tunnel// SSH dans lequel passe les communications du protocole non-sécurisé. |
| - | create | + | |
| - | 0 0% 0 0% 0 0% 45 41% 5 4% 0 | + | La commande pour créer un tunnel ssh prend la forme suivante : |
| - | lock | + | |
| - | 0 0% 0 0% 0 0% 3 2% 0 0% 0 | + | |
| - | open | + | |
| - | 0 0% 0 0% 0 0% 0 0% 46 42% 0 | + | Dans votre cas, vous allez créer un tunnel dans votre propre vm entre le port 15023 et le port 23 : |
| - | putrootfh | + | |
| - | 2 1% 0 0% 3 2% 0 0% 0 0% 0 | + | < |
| - | renew restorefh | + | [root@centos7 ~]# ssh -N -f trainee@localhost -L15023: |
| - | 0 0% 0 0% 0 0% 0 0% 0 0% 0 0% | + | trainee@localhost' |
| - | setcltidconf verify | + | |
| - | 0 0% 0 0% 0 0% 0 0% 0 0% 0 0% | + | |
| - | exchange_id | + | |
| - | 0 0% 0 0% 0 0% 0 0% 0 0% 0 0% | + | |
| - | getdevlist | + | |
| - | 0 0% 0 0% 0 0% 0 0% 0 0% 0 0% | + | |
| - | set_ssv | + | |
| - | 0 0% 0 0% 0 0% 0 0% 0 | + | |
| </ | </ | ||
| + | |||
| + | Installez maintenant le client et le serveur telnet : | ||
| < | < | ||
| - | [root@centos7 ~]# nfsstat | + | [root@centos7 ~]# yum install telnet telnet-server |
| - | Server rpc stats: | + | </ |
| - | calls badcalls | + | |
| - | 34 | + | |
| - | Server nfs v4: | + | Telnet n'est ni démarré ni activé. Il convient donc de le démarrer et de l' |
| - | null | + | |
| - | 1 2% 33 | + | |
| - | Server | + | < |
| - | op0-unused | + | [root@centos7 ~]# systemctl status telnet.socket |
| - | 0 0% 0 0% 0 0% 5 7% 0 0% 0 | + | ● telnet.socket - Telnet |
| - | create | + | |
| - | 0 | + | Active: inactive (dead) |
| - | lock | + | Docs: man: |
| - | 0 0% 0 0% 0 0% 5 7% 0 0% 0 | + | Listen: [::]:23 (Stream) |
| - | open | + | Accepted: |
| - | 0 0% 0 0% 0 0% 0 | + | |
| - | putrootfh | + | [root@centos7 ~]# systemctl start telnet.socket |
| - | 1 | + | |
| - | renew restorefh | + | [root@centos7 ~]# systemctl status telnet.socket |
| - | 5 7% 0 0% 0 0% 0 0% 0 0% 2 | + | ● telnet.socket - Telnet Server Activation Socket |
| - | setcltidconf verify | + | |
| - | 2 2% 0 0% 0 0% 0 0% 0 0% 0 | + | |
| - | exchange_id | + | Docs: man: |
| - | 0 0% 0 0% 0 0% 0 0% 0 0% 0 | + | Listen: [::]:23 (Stream) |
| - | getdevlist | + | |
| - | 0 | + | |
| - | set_ssv | + | May 09 23:40:13 centos7.fenestros.loc systemd[1]: Listening on Telnet Server Activation Socket. |
| - | 0 0% 0 0% 0 0% 0 0% 0 | + | May 09 23:40:13 centos7.fenestros.loc systemd[1]: Starting Telnet Server Activation Socket. |
| + | |||
| + | [root@centos7 ~]# systemctl enable telnet.socket | ||
| + | Created symlink from / | ||
| + | [root@centos7 ~]# systemctl status telnet.socket | ||
| + | ● telnet.socket - Telnet Server Activation Socket | ||
| + | Loaded: loaded (/ | ||
| + | | ||
| + | Docs: man: | ||
| + | Listen: [::]:23 (Stream) | ||
| + | Accepted: | ||
| + | |||
| + | May 09 23:40:13 centos7.fenestros.loc systemd[1]: Listening on Telnet Server Activation Socket. | ||
| + | May 09 23:40:13 centos7.fenestros.loc systemd[1]: Starting Telnet Server Activation Socket. | ||
| </ | </ | ||
| - | ----- | + | Connectez-vous ensuite via telnet sur le port 15023, vous constaterez que votre connexion n' |
| - | <html> | + | |
| - | <div align=" | + | < |
| - | Copyright © 2020 Hugh Norris | + | [root@centos7 ~]# telnet localhost 15023 |
| - | </div> | + | Trying 127.0.0.1... |
| - | </html> | + | Connected to localhost. |
| + | Escape character is ' | ||
| + | |||
| + | Kernel 3.10.0-327.13.1.el7.x86_64 on an x86_64 | ||
| + | centos7 login: trainee | ||
| + | Password: | ||
| + | Last login: Mon May 9 23:26:32 from localhost.localdomain | ||
| + | [trainee@centos7 ~]$ | ||
| + | |||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | Notez bien que votre communication telnet passe par le tunnel SSH. | ||
| + | </ | ||
| + | |||
| + | ====SCP==== | ||
| + | |||
| + | ===Introduction=== | ||
| + | |||
| + | La commande **scp** est le successeur et la remplaçante de la commande **rcp** de la famille des commandes **remote**. Il permet de faire des transferts sécurisés à partir d'une machine distante : | ||
| + | |||
| + | $ scp compte@numero_ip(nom_de_machine):/ | ||
| + | |||
| + | ou vers une machine distante : | ||
| + | |||
| + | $ scp / | ||
| + | |||
| + | ===Utilisation=== | ||
| + | |||
| + | Nous allons maintenant utiliser **scp** pour chercher un fichier sur le << | ||
| + | |||
| + | Créez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [trainee@centos7 ~]$ pwd | ||
| + | / | ||
| + | [trainee@centos7 ~]$ touch scp_test | ||
| + | </ | ||
| + | |||
| + | Récupérez le fichier **scp_test** en utilisant scp : | ||
| + | |||
| + | < | ||
| + | [trainee@centos7 ~]$ touch / | ||
| + | [trainee@centos7 ~]$ scp trainee@127.0.0.1:/ | ||
| + | The authenticity of host ' | ||
| + | ECDSA key fingerprint is 19: | ||
| + | Are you sure you want to continue connecting (yes/no)? yes | ||
| + | Warning: Permanently added ' | ||
| + | trainee@127.0.0.1' | ||
| + | scp_test | ||
| + | [trainee@centos7 ~]$ ls / | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | ==Mise en place des clefs== | ||
| + | |||
| + | Il convient maintenant de se connecter sur le << | ||
| + | |||
| + | En saisissant cette commande, vous obtiendrez une fenêtre similaire à celle-ci : | ||
| + | |||
| + | < | ||
| + | [trainee@centos7 ~]$ ssh -l trainee 127.0.0.1 | ||
| + | trainee@127.0.0.1' | ||
| + | Last login: Mon May 9 23:42:46 2016 from localhost.localdomain | ||
| + | [trainee@centos7 ~]$ ls -la | grep .ssh | ||
| + | drwx------. | ||
| + | [trainee@centos7 ~]$ exit | ||
| + | logout | ||
| + | Connection to 127.0.0.1 closed. | ||
| + | </code> | ||
| + | |||
| + | <WRAP center | ||
| + | Si le dossier distant .ssh n' | ||
| + | </WRAP> | ||
| + | |||
| + | Ensuite, il convient de transférer le fichier local **.ssh/ | ||
| + | |||
| + | < | ||
| + | [trainee@centos7 ~]$ scp .ssh/id_ecdsa.pub trainee@127.0.0.1:/ | ||
| + | trainee@127.0.0.1' | ||
| + | id_ecdsa.pub | ||
| + | </code> | ||
| + | |||
| + | Connectez-vous via telnet et insérer les clefs publiques restantes dans le fichier .ssh/ | ||
| + | |||
| + | < | ||
| + | root@centos7 ~]# ssh -l trainee localhost | ||
| + | trainee@localhost' | ||
| + | Last login: Tue May 10 01:39:33 2016 from localhost.localdomain | ||
| + | [trainee@centos7 ~]$ cat .ssh/ | ||
| + | [trainee@centos7 ~]$ cat .ssh/ | ||
| + | [trainee@centos7 ~]$ cat .ssh/ | ||
| + | [trainee@centos7 ~]$ cat .ssh/ | ||
| + | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBG5BtOMFLrUbxD// | ||
| + | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9KOuEH5+kyihhm99Na8UTA4Gi5AfiOVeJyS3UzH7ta73ewmv7JZqaXzar1NlHcpEMkCUs2yKxHyO/ | ||
| + | ssh-dss AAAAB3NzaC1kc3MAAACBAK9/ | ||
| + | ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIENas3A3hmXFj1cb+lrn2NAt6g95Pla6qUFQHd1wg2y1 trainee@centos7.fenestros.loc | ||
| + | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBG5BtOMFLrUbxD// | ||
| + | </ | ||
| + | |||
| + | Lors de la connexion suivante au serveur, l' | ||
| + | |||
| + | < | ||
| + | [trainee@centos7 ~]$ ssh -l trainee localhost | ||
| + | Last login: Tue May 10 01:50:39 2016 from localhost.localdomain | ||
| + | [trainee@centos7 ~]$ exit | ||
| + | déconnexion | ||
| + | Connection to localhost closed. | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | Le fichier **authorized_keys** doit avoir les permissions de 600. | ||
| + | </ | ||
| ----- | ----- | ||
| + | Copyright © 2023 Hugh Norris. | ||
