Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:centos:6:avance:l108 [2020/08/25 14:44] – created admin | elearning:workbooks:centos:6:avance:l108 [2023/02/15 16:06] (Version actuelle) – created admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| - | Version : **2020.01** | + | Version : **2020.03** - Consulter le Change Log en fin de module. |
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LCF308 | + | ======LCF307 |
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| - | * **LCF308 | + | * **LCF307 |
| * Contenu du Module | * Contenu du Module | ||
| - | * Pour Aller Plus Loin | + | * Le Problématique |
| - | * Support | + | * LAB #1 - Utilisation |
| - | * L'Infrastructure Hors Formation | + | * nmap |
| - | * Matériel | + | * Installation |
| - | * Logiciels | + | * Utilisation |
| - | * Machine Virtuelle | + | * Fichiers de Configuration |
| - | * Rappel du Programme | + | * Scripts |
| - | * Jour #1 | + | * netcat |
| - | * Jour #2 | + | * Utilisation |
| - | * Jour #3 | + | * Les Contre-Mesures |
| - | * Remettre | + | * LAB #2 - Mise en place du Système de Détection d'Intrusion Snort |
| - | * Évaluation de la Formation | + | * Installation |
| - | * Remerciements | + | * Configuration de Snort |
| + | * Editer le fichier / | ||
| + | * Utilisation | ||
| + | * Utilisation de snort en mode " | ||
| + | * Journalisation | ||
| + | * LAB #3 - Mise en place du Système de Détection et de Prévention d'Intrusion Portsentry | ||
| + | * Installation | ||
| + | * Configuration | ||
| + | * Utilisation | ||
| + | * ChangeLog | ||
| + | * 2020.01 | ||
| + | * 2020.02 | ||
| + | * 2020.03 | ||
| - | =====Pour Aller Plus Loin===== | + | =====Le Problématique===== |
| - | ====Support | + | Un **Cheval |
| - | L' | + | * Back Orifice 2000 - tcp/8787, tcp/ |
| + | * Backdoor - tcp/1999, | ||
| + | * Subseven - tcp/1243, tcp/ 2773, tcp/ | ||
| + | * Socket | ||
| - | L'utilisation | + | Le **scan** consiste à balayer les ports d'une machine afin de : |
| - | * de mesurer | + | * connaître les ports qui sont ouverts, |
| - | * de suivre du travail de chaque participant en termes de temps passé dans chaque module grâce à un reporting détaillé. | + | * déterminer |
| + | * identifier les services ouverts. | ||
| - | L' | + | Plusieurs scanners existent dont : |
| - | * de télécharger des supports de cours et des LABS au format PDF le dernier jour de la formation, | + | * nmap |
| - | * de refaire les LABS en mode autonome en cas de missions décalées en relation avec le contenu de la formation initiale, | + | * netcat |
| - | * de rester en contact avec le formateur en cas de problèmes en production liés au contenu du cours, | + | |
| - | * de consulter les mises à jour du contenu des supports de cours pendant la période de l' | + | |
| - | * d' | + | |
| - | ====L' | + | ====LAB #1 - Utilisation de nmap et de netcat==== |
| - | ===Matériel=== | + | === nmap === |
| - | * Un poste 64 bits (MacOS, Linux, Windows(tm) ou Solaris(tm)), | + | ==Installation== |
| - | * Dans le cas de Windows(tm), | + | |
| - | * Le mot de passe du compte administrateur du système, | + | |
| - | * Clavier AZERTY FR ou QWERTY US, | + | |
| - | * 8 Go de RAM minimum, | + | |
| - | * Processeur 4 cœurs minimum, | + | |
| - | * 8 Go d' | + | |
| - | ===Logiciels=== | + | Sous RHEL/CentOS 7, **nmap** n'est pas installé par défaut : |
| - | * Oracle VirtualBox v 6.0 ou plus (MacOS, Linux, Windows(tm) ou Solaris(tm)), | + | < |
| - | * Si Windows(tm) - Putty et WinSCP, | + | [root@centos7 ~]# which nmap |
| - | * Navigateur Web Chrome ou Firefox. | + | / |
| + | </ | ||
| - | ===Machine Virtuelle=== | + | Installez donc nmap en utilisant yum : |
| - | A télécharger : **[[https://my-short.link/JQn9qhM|CentOs_7]]**. | + | < |
| + | [root@centos7 ~]# yum install nmap | ||
| + | Loaded plugins: fastestmirror, | ||
| + | Repodata is over 2 weeks old. Install yum-cron? Or run: yum makecache fast | ||
| + | adobe-linux-x86_64 | ||
| + | base | 3.6 kB | ||
| + | extras | ||
| + | updates | ||
| + | (1/3): adobe-linux-x86_64/ | ||
| + | (2/3): extras/ | ||
| + | (3/3): updates/ | ||
| + | Determining fastest mirrors | ||
| + | * base: ftp.rezopole.net | ||
| + | * extras: ftp.rezopole.net | ||
| + | * updates: ftp.rezopole.net | ||
| + | Resolving Dependencies | ||
| + | --> Running transaction check | ||
| + | ---> Package nmap.x86_64 2: | ||
| + | --> Processing Dependency: nmap-ncat = 2: | ||
| + | --> Running transaction check | ||
| + | ---> Package nmap-ncat.x86_64 2: | ||
| + | --> Finished Dependency Resolution | ||
| - | =====Rappel du Programme de la Formation===== | + | Dependencies Resolved |
| - | ====Jour #1 - 7 heures==== | + | ================================================================================ |
| + | | ||
| + | ================================================================================ | ||
| + | Installing: | ||
| + | | ||
| + | Installing for dependencies: | ||
| + | | ||
| - | * **LCF300 - CentOS Linux (RHEL) - System Administrator** - 1 heure. | + | Transaction Summary |
| - | * Pré-requis | + | ================================================================================ |
| - | * Matériel | + | Install |
| - | * Logiciels | + | |
| - | * Internet | + | |
| - | * Utilisation de l' | + | |
| - | * Connexion au Serveur Cloud | + | |
| - | * Linux, MacOS et Windows 10 muni du client ssh | + | |
| - | * Windows 7 et Windows 10 sans client ssh | + | |
| - | * Démarrage de la Machine Virtuelle | + | |
| - | * Connexion à la Machine Virtuelle | + | |
| - | * Programme de la Formation | + | |
| - | * Évaluation des Compétences | + | |
| - | * **LCF301 - Gestion des Paramètres et les Ressources du Matériel** | + | Total download size: 4.2 M |
| - | * Fichiers Spéciaux | + | Installed size: 17 M |
| - | * Commandes | + | Is this ok [y/d/N]: y |
| - | * La Commande lspci | + | </code> |
| - | * La Commande lsusb | + | |
| - | * La Commande dmidecode | + | |
| - | * Répertoire | + | |
| - | * Répertoires | + | |
| - | * ide/scsi | + | |
| - | * acpi | + | |
| - | * bus | + | |
| - | * net | + | |
| - | * sys | + | |
| - | * La commande sysctl | + | |
| - | * Options de la commande | + | |
| - | * Fichiers | + | |
| - | * Processeur | + | |
| - | * Interruptions système | + | |
| - | * Canaux DMA | + | |
| - | * Plages | + | |
| - | * Périphériques | + | |
| - | * Modules | + | |
| - | * Statistiques de l' | + | |
| - | * Partitions | + | |
| - | * Espaces de pagination | + | |
| - | * Statistiques d' | + | |
| - | * Statistiques d' | + | |
| - | * Version du noyau | + | |
| - | * Interprétation des informations dans /proc | + | |
| - | * Commandes | + | |
| - | * free | + | |
| - | * uptime ou w | + | |
| - | * iostat | + | |
| - | * vmstat | + | |
| - | * mpstat | + | |
| - | * sar | + | |
| - | * Utilisation des commandes en production | + | |
| - | * Identifier un système limité par le processeur | + | |
| - | * Identifier un système ayant un problème de mémoire | + | |
| - | * Identifier un système ayant un problème d' | + | |
| - | * Modules usb | + | |
| - | * udev | + | |
| - | * La commande udevadm | + | |
| - | * Les options de la commande | + | |
| - | * Système de fichiers /sys | + | |
| - | * Limiter les Ressources | + | |
| - | * ulimit | + | |
| - | * Groupes de Contrôle | + | |
| - | * LAB #1 - Travailler avec les cgroups sous RHEL/CentOS 7 | + | |
| - | * **LCF302 - Gestion Avancée des Disques - Raid Logiciel** - 3 heures. | + | ==Options |
| - | * Concepts RAID | + | |
| - | * Disques en miroir | + | |
| - | * Bandes | + | |
| - | * Types de RAID | + | |
| - | * RAID 0 - Concaténation | + | |
| - | * RAID 0 - Striping | + | |
| - | * RAID 1 - Miroir | + | |
| - | * RAID 1+0 - Striping en Miroir | + | |
| - | * RAID 2 - Miroir avec Contrôle d' | + | |
| - | * RAID 3 et 4 - Striping avec Parité | + | |
| - | * RAID 5 - Striping avec Parité Distribuée | + | |
| - | * Au délà de RAID 5 | + | |
| - | * RAID Logiciel sous RHEL | + | |
| - | * Préparation du disque | + | |
| - | * Partitionnement | + | |
| - | * Mise en Place du RAID 5 Logiciel | + | |
| - | ====Jour #2 - 7 heures==== | + | Les options de cette commande sont : |
| - | * **LCF303 | + | < |
| - | * Rôle du noyau | + | [root@centos7 ~]# nmap --help |
| - | * Compilation et installation du noyau et des modules | + | Nmap 6.40 ( http:// |
| - | * Déplacer | + | Usage: nmap [Scan Type(s)] [Options] {target specification} |
| - | * Créer un Nouveau Noyau | + | TARGET SPECIFICATION: |
| - | * Préparer l'Arborescence Source du Noyau | + | Can pass hostnames, IP addresses, networks, etc. |
| - | * Paramétrage du noyau | + | Ex: scanme.nmap.org, |
| - | * Compiler le Noyau | + | -iL < |
| - | * Installer le Nouveau Noyau | + | -iR <num hosts>: Choose random targets |
| - | | + | --exclude < |
| - | * La Commande quotacheck | + | --excludefile < |
| - | * La Commande edquota | + | HOST DISCOVERY: |
| - | * La Commande quotaon | + | -sL: List Scan - simply list targets to scan |
| - | * La Commande repquota | + | -sn: Ping Scan - disable port scan |
| - | * La Commande quota | + | -Pn: Treat all hosts as online -- skip host discovery |
| - | | + | -PS/ |
| + | -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes | ||
| + | -PO[protocol list]: IP Protocol Ping | ||
| + | -n/-R: Never do DNS resolution/ | ||
| + | --dns-servers < | ||
| + | --system-dns: | ||
| + | | ||
| + | SCAN TECHNIQUES: | ||
| + | | ||
| + | -sU: UDP Scan | ||
| + | -sN/sF/sX: TCP Null, FIN, and Xmas scans | ||
| + | --scanflags < | ||
| + | -sI <zombie host[: | ||
| + | -sY/sZ: SCTP INIT/ | ||
| + | -sO: IP protocol scan | ||
| + | -b <FTP relay host>: FTP bounce scan | ||
| + | PORT SPECIFICATION AND SCAN ORDER: | ||
| + | -p <port ranges>: Only scan specified ports | ||
| + | | ||
| + | -F: Fast mode - Scan fewer ports than the default scan | ||
| + | -r: Scan ports consecutively - don't randomize | ||
| + | | ||
| + | | ||
| + | SERVICE/ | ||
| + | -sV: Probe open ports to determine service/ | ||
| + | --version-intensity < | ||
| + | --version-light: | ||
| + | --version-all: | ||
| + | --version-trace: | ||
| + | SCRIPT SCAN: | ||
| + | -sC: equivalent to --script=default | ||
| + | --script=< | ||
| + | | ||
| + | --script-args=< | ||
| + | --script-args-file=filename: | ||
| + | --script-trace: | ||
| + | --script-updatedb: | ||
| + | --script-help=< | ||
| + | < | ||
| + | | ||
| + | OS DETECTION: | ||
| + | -O: Enable OS detection | ||
| + | --osscan-limit: | ||
| + | --osscan-guess: | ||
| + | TIMING AND PERFORMANCE: | ||
| + | Options which take < | ||
| + | ' | ||
| + | -T< | ||
| + | --min-hostgroup/ | ||
| + | --min-parallelism/ | ||
| + | --min-rtt-timeout/ | ||
| + | | ||
| + | --max-retries < | ||
| + | --host-timeout < | ||
| + | --scan-delay/ | ||
| + | --min-rate < | ||
| + | --max-rate < | ||
| + | FIREWALL/ | ||
| + | -f; --mtu < | ||
| + | -D < | ||
| + | -S < | ||
| + | -e < | ||
| + | -g/ | ||
| + | --data-length < | ||
| + | --ip-options < | ||
| + | --ttl < | ||
| + | --spoof-mac <mac address/ | ||
| + | --badsum: Send packets with a bogus TCP/ | ||
| + | OUTPUT: | ||
| + | -oN/ | ||
| + | and Grepable format, respectively, | ||
| + | -oA < | ||
| + | -v: Increase verbosity level (use -vv or more for greater effect) | ||
| + | -d: Increase debugging level (use -dd or more for greater effect) | ||
| + | --reason: Display the reason a port is in a particular state | ||
| + | --open: Only show open (or possibly open) ports | ||
| + | --packet-trace: | ||
| + | --iflist: Print host interfaces and routes (for debugging) | ||
| + | --log-errors: | ||
| + | --append-output: | ||
| + | --resume < | ||
| + | --stylesheet < | ||
| + | --webxml: Reference stylesheet from Nmap.Org for more portable XML | ||
| + | --no-stylesheet: | ||
| + | MISC: | ||
| + | -6: Enable IPv6 scanning | ||
| + | -A: Enable OS detection, version detection, script scanning, and traceroute | ||
| + | --datadir < | ||
| + | --send-eth/ | ||
| + | --privileged: | ||
| + | --unprivileged: | ||
| + | -V: Print version number | ||
| + | -h: Print this help summary page. | ||
| + | EXAMPLES: | ||
| + | nmap -v -A scanme.nmap.org | ||
| + | nmap -v -sn 192.168.0.0/ | ||
| + | nmap -v -iR 10000 -Pn -p 80 | ||
| + | SEE THE MAN PAGE (http:// | ||
| + | </ | ||
| - | * **LCF304 - Gestion du Système X et de l' | + | ==Utilisation== |
| - | * X Window System | + | |
| - | * Configuration | + | |
| - | * Gestionnaire de Fenêtres | + | |
| - | * Toolkits | + | |
| - | * Freedesktop | + | |
| - | * Display Manager | + | |
| - | * XDM, GDM et KDM | + | |
| - | * LightDM | + | |
| - | * X.orgX11 | + | |
| - | * Présentation | + | |
| - | * Démarrage et Arrêt | + | |
| - | * Utilisation | + | |
| - | * Configuration | + | |
| - | * La Section ServerFlags | + | |
| - | * La Section ServerLayout | + | |
| - | * La Section Files | + | |
| - | * La Section Modules | + | |
| - | * La Section InputDevice | + | |
| - | * La Section Monitor | + | |
| - | * La Section Device | + | |
| - | * La Section Screen | + | |
| - | * La Commande xwininfo | + | |
| - | * La Commande xdpyinfo | + | |
| - | * L' | + | |
| - | * Le Clavier et la Souris | + | |
| - | * Claviers Visuels | + | |
| - | * L' | + | |
| - | * Autres Technologies | + | |
| - | * **LCF305 - La Langage SQL** - 2 heures. | + | Pour connaître la liste des ports ouverts sur votre machine virtuelle, saisissez la commande suivante : |
| - | * SQL | + | |
| - | * Chaînes de caractères | + | |
| - | * Nombres | + | |
| - | * Nombres Entiers | + | |
| - | * Nombres Décimaux | + | |
| - | * Nombres Négatifs | + | |
| - | * Valeurs NULL | + | |
| - | * Noms de Fichiers | + | |
| - | * Variables Utilisateurs | + | |
| - | * Commentaires | + | |
| - | * Commandes | + | |
| - | * SELECT | + | |
| - | * UPDATE | + | |
| - | * DELETE FROM | + | |
| - | * DROP TABLE | + | |
| - | * INSERT | + | |
| - | * ALTER | + | |
| - | * MATCH | + | |
| - | * Opérateurs | + | |
| - | * Mathématiques | + | |
| - | * Logiques | + | |
| - | * Comparaison | + | |
| - | * Fonctions | + | |
| - | * Mathématiques | + | |
| - | * Chaînes | + | |
| - | * Dates | + | |
| - | * Contrôle | + | |
| - | * Agrégation | + | |
| - | * Autres | + | |
| - | * Types de Champs | + | |
| - | * Nombres entiers | + | |
| - | * Nombres à virgule flottante | + | |
| - | * Dates et Heures | + | |
| - | * Types de données TIMESTAMP | + | |
| - | * Chaînes | + | |
| - | * TEXT et BLOB | + | |
| - | * ENUM et SET | + | |
| - | * Types de Moteurs de Stockage | + | |
| - | * Caractéristiques | + | |
| - | * InnoDB | + | |
| - | * Mécanisme Interne | + | |
| - | * Transactions | + | |
| - | * Tablespace | + | |
| - | * Multiversion Concurrency Control | + | |
| - | * Transaction Isolation Levels | + | |
| - | * MyISAM | + | |
| - | * MyISAM FIXED | + | |
| - | * MyISAM DYNAMIC | + | |
| - | * MyISAM COMPRESSED | + | |
| - | * Particularités | + | |
| - | * Memory | + | |
| - | * Particularités | + | |
| - | * En Pratique | + | |
| - | * Archive | + | |
| - | * Particularités | + | |
| - | * CSV | + | |
| - | * FEDERATED | + | |
| - | * NDB Cluster | + | |
| - | * Autres Moteurs Non Standards | + | |
| - | * XtraDB | + | |
| - | * Aria | + | |
| - | * Jointures | + | |
| - | * FULL JOIN | + | |
| - | * LEFT JOIN | + | |
| - | * RIGHT JOIN | + | |
| - | * LAB #1 - Le Langage SQL | + | |
| - | ====Jour | + | < |
| + | [root@centos7 ~]# nmap 127.0.0.1 | ||
| - | * **LCF306 - Gestion du Réseau** - 4 heures. | + | Starting Nmap 6.40 ( http://nmap.org ) at 2017-08-05 14:17 CEST |
| - | * Configuration du Réseau sous RHEL/CentOS 5 et 6 | + | Nmap scan report for localhost.localdomain |
| - | * Configuration de TCP/IP | + | Host is up (-2100s latency). |
| - | * DHCP | + | Not shown: 996 closed ports |
| - | * / | + | PORT STATE SERVICE |
| - | * / | + | 22/tcp open ssh |
| - | * IP Fixe | + | 25/tcp open smtp |
| - | * / | + | 111/tcp open rpcbind |
| - | * / | + | 631/tcp open ipp |
| - | * La Commande hostname | + | |
| - | * La Commande ifconfig | + | |
| - | * Activer/ | + | |
| - | * / | + | |
| - | * Résolution d' | + | |
| - | * /etc/resolv.conf | + | |
| - | * / | + | |
| - | * / | + | |
| - | * Services réseaux | + | |
| - | * xinetd | + | |
| - | * TCP Wrapper | + | |
| - | * Routage Statique | + | |
| - | * La Commande route | + | |
| - | * Activer/désactiver le routage sur le serveur | + | |
| - | * Configuration du Réseau sous RHEL/CentOS 7 | + | |
| - | * La Commande nmcli | + | |
| - | * Connections et Profils | + | |
| - | * Ajouter une Deuxième Adresse IP à un Profil | + | |
| - | * La Commande hostname | + | |
| - | * La Commande ip | + | |
| - | * Activer/Désactiver une Interface Manuellement | + | |
| - | * Routage Statique | + | |
| - | * La commande ip | + | |
| - | * Activer/désactiver le routage sur le serveur | + | |
| - | * Diagnostique du Réseau | + | |
| - | * ping | + | |
| - | * netstat -i | + | |
| - | * traceroute | + | |
| - | * Connexions à Distance | + | |
| - | * Telnet | + | |
| - | * wget | + | |
| - | * ftp | + | |
| - | * SSH | + | |
| - | * Introduction | + | |
| - | * SSH-1 | + | |
| - | * SSH-2 | + | |
| - | * L' | + | |
| - | * L' | + | |
| - | * Installation | + | |
| - | * Configuration | + | |
| - | * Serveur | + | |
| - | * Utilisation | + | |
| - | * Tunnels SSH | + | |
| - | * SCP | + | |
| - | * Introduction | + | |
| - | * Utilisation | + | |
| - | * Mise en place des clefs | + | |
| - | * Annexe #1 - Comprendre les Réseaux | + | |
| - | * Présentation des Réseaux | + | |
| - | * Classification des Réseaux | + | |
| - | * Classification par Mode de Transmission | + | |
| - | * Classification par Topologie | + | |
| - | * La Topologie Physique | + | |
| - | * La Topologie en Ligne | + | |
| - | * La Topologie en Bus | + | |
| - | * La Topologie en Étoile | + | |
| - | * La Topologie en Anneau | + | |
| - | * La Topologie en Arbre | + | |
| - | * La Topologie Maillée | + | |
| - | * Classification par Etendue | + | |
| - | * Les Types de LAN | + | |
| - | * Réseau à Serveur Dédié | + | |
| - | * Réseau Poste-à-Poste | + | |
| - | * Le Modèle Client/ | + | |
| - | * Modèles de Communication | + | |
| - | * Le modèle OSI | + | |
| - | * Les Couches | + | |
| - | * Les Protocoles | + | |
| - | * Les Interfaces | + | |
| - | * Protocol Data Units | + | |
| - | * Encapsulation et Désencapsulation | + | |
| - | * Spécification NDIS et le Modèle ODI | + | |
| - | * Le modèle TCP/IP | + | |
| - | * Les Raccordements | + | |
| - | * Les Modes de Transmission | + | |
| - | * Les Câbles | + | |
| - | * Le Câble Coaxial | + | |
| - | * Le Câble Paire Torsadée | + | |
| - | * Catagories de Blindage | + | |
| - | * La Prise RJ45 | + | |
| - | * Channel Link et Basic Link | + | |
| - | * La Fibre Optique | + | |
| - | * Les Réseaux sans Fils | + | |
| - | * Le Courant Porteur en Ligne | + | |
| - | * Technologies | + | |
| - | * Ethernet | + | |
| - | * Token-Ring | + | |
| - | * Périphériques Réseaux Spéciaux | + | |
| - | * Les Concentrateurs | + | |
| - | * Les Répéteurs | + | |
| - | * Les Ponts | + | |
| - | * Le Pont de Base | + | |
| - | * Le Pont en Cascade | + | |
| - | * Le Pont en Dorsale | + | |
| - | * Les Commutateurs | + | |
| - | * Les Routeurs | + | |
| - | * Les Passerelles | + | |
| - | * Annexe #2 - Comprendre TCP Version 4 | + | |
| - | * En-tête TCP | + | |
| - | * En-tête UDP | + | |
| - | * Fragmentation et Ré-encapsulation | + | |
| - | * Adressage | + | |
| - | * Masques de sous-réseaux | + | |
| - | * VLSM | + | |
| - | * Ports et sockets | + | |
| - | * / | + | |
| - | * Résolution d' | + | |
| - | * Annexe #3 - Comprendre le Chiffrement | + | |
| - | * Introduction à la cryptologie | + | |
| - | * Définitions | + | |
| - | * La Cryptographie | + | |
| - | * Le Chiffrement par Substitution | + | |
| - | * Algorithmes à clé secrète | + | |
| - | * Le Chiffrement Symétrique | + | |
| - | * Algorithmes à clef publique | + | |
| - | * Le Chiffrement Asymétrique | + | |
| - | * La Clef de Session | + | |
| - | * Fonctions de Hachage | + | |
| - | * Signature Numérique | + | |
| - | * LAB #1 - Utilisation de GnuPG | + | |
| - | * Présentation | + | |
| - | * Installation | + | |
| - | * Configuration | + | |
| - | * Signer un message | + | |
| - | * Chiffrer un message | + | |
| - | * PKI | + | |
| - | * Certificats X509 | + | |
| - | * **LCF307 - Gestion du Serveur NFS** - 2 heures. | + | Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds |
| - | * Présentation | + | </ |
| - | * Les Services et Processus du Serveur NFSv3 | + | |
| - | * Les Services RPC | + | |
| - | * Options d'un Partage NFS | + | |
| - | * Commandes de Base | + | |
| - | * Installation | + | |
| - | * Mise en Place | + | |
| - | * Configuration du Serveur | + | |
| - | * Configuration du Client | + | |
| - | * Surveillance du Serveur | + | |
| - | * La Commande rpcinfo | + | |
| - | * La Commande nfsstat | + | |
| - | | + | <WRAP center round important 50%> |
| - | * Pour Aller Plus Loin | + | **Important** - Pour connaître les ports ouverts sur une machine distante, |
| - | * Support de Cours | + | </ |
| - | * L' | + | |
| - | * Matériel | + | |
| - | * Logiciels | + | |
| - | * Machine Virtuelle | + | |
| - | * Rappel du Programme de la Formation | + | |
| - | * Jour #1 | + | |
| - | * Jour #2 | + | |
| - | * Jour #3 | + | |
| - | * Remettre en Etat l'Infrastructure | + | |
| - | * Évaluation | + | |
| - | * Remerciements | + | |
| - | =====Remettre en Etat l' | + | ==Fichiers de Configuration== |
| - | Utilisez la commande suivante | + | **nmap** utilise un fichier spécifique |
| < | < | ||
| - | desktop@serverXX:~$ VBoxManage controlvm CentOS_7 poweroff | + | [root@centos7 |
| - | 0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100% | + | # THIS FILE IS GENERATED AUTOMATICALLY FROM A MASTER - DO NOT EDIT. |
| + | # EDIT / | ||
| + | # Well known service port numbers -*- mode: fundamental; | ||
| + | # From the Nmap Security Scanner ( http://nmap.org ) | ||
| + | # | ||
| + | # $Id: nmap-services 31220 2013-07-03 04:30:43Z david $ | ||
| + | # | ||
| + | # Derived from IANA data and our own research | ||
| + | # | ||
| + | # This collection of service data is (C) 1996-2011 by Insecure.Com | ||
| + | # LLC. It is distributed under the Nmap Open Source license as | ||
| + | # provided in the COPYING file of the source distribution or at | ||
| + | # http://nmap.org/ | ||
| + | # requires you to license your own work under a compatable open source | ||
| + | # license. If you wish to embed Nmap technology into proprietary | ||
| + | # software, we sell alternative licenses (contact sales@insecure.com). | ||
| + | # Dozens of software vendors already license Nmap technology such as | ||
| + | # host discovery, port scanning, OS detection, and version detection. | ||
| + | # For more details, see http://nmap.org/ | ||
| + | # | ||
| + | # Fields in this file are: Service name, portnum/ | ||
| + | # | ||
| + | tcpmux 1/ | ||
| + | tcpmux 1/ | ||
| + | compressnet 2/ | ||
| + | compressnet 2/ | ||
| + | compressnet 3/ | ||
| + | compressnet 3/ | ||
| + | unknown 4/ | ||
| + | rje 5/udp 0.000593 # Remote Job Entry | ||
| + | unknown 6/ | ||
| + | echo 7/ | ||
| + | echo 7/ | ||
| + | echo 7/ | ||
| + | unknown 8/ | ||
| + | --More--(0%) | ||
| </ | </ | ||
| - | Ensuite restaurez l' | + | Le répertoire **/ |
| < | < | ||
| - | desktop@serverXX:~$ VBoxManage snapshot CentOS_7 restorecurrent | + | [root@centos7 |
| - | Restoring snapshot ' | + | total 6548 |
| - | 0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100% | + | -rw-r--r--. 1 root root 10546 Nov 20 2015 nmap.dtd |
| + | -rw-r--r--. 1 root root 455371 Nov 20 2015 nmap-mac-prefixes | ||
| + | -rw-r--r--. 1 root root 3694559 Nov 20 2015 nmap-os-db | ||
| + | -rw-r--r--. 1 root root 11749 Nov 20 2015 nmap-payloads | ||
| + | -rw-r--r--. 1 root root 6631 Nov 20 2015 nmap-protocols | ||
| + | -rw-r--r--. 1 root root 49243 Nov 20 2015 nmap-rpc | ||
| + | -rw-r--r--. 1 root root 1727204 Nov 20 2015 nmap-service-probes | ||
| + | -rw-r--r--. 1 root root 622039 Nov 20 2015 nmap-services | ||
| + | -rw-r--r--. 1 root root 31935 Nov 20 2015 nmap.xsl | ||
| + | drwxr-xr-x. 3 root root 4096 Aug 5 14:16 nselib | ||
| + | -rw-r--r--. 1 root root 47190 Nov 20 2015 nse_main.lua | ||
| + | drwxr-xr-x. 2 root root 20480 Aug 5 14:16 scripts | ||
| </ | </ | ||
| - | =====Évaluation | + | Voici la liste des fichiers les plus importants : |
| + | |||
| + | ^ Fichier ^ Description ^ | ||
| + | | / | ||
| + | | / | ||
| + | | / | ||
| + | | / | ||
| + | |||
| + | ==Scripts== | ||
| + | |||
| + | **nmap** utilise des scripts pour accomplir certaines tâches allant de la découverte simple de ports ouverts jusqu' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ls / | ||
| + | acarsd-info.nse | ||
| + | address-info.nse | ||
| + | afp-brute.nse | ||
| + | afp-ls.nse | ||
| + | afp-path-vuln.nse | ||
| + | afp-serverinfo.nse | ||
| + | afp-showmount.nse | ||
| + | ajp-auth.nse | ||
| + | ajp-brute.nse | ||
| + | ajp-headers.nse | ||
| + | ajp-methods.nse | ||
| + | ajp-request.nse | ||
| + | amqp-info.nse | ||
| + | asn-query.nse | ||
| + | auth-owners.nse | ||
| + | auth-spoof.nse | ||
| + | backorifice-brute.nse | ||
| + | backorifice-info.nse | ||
| + | banner.nse | ||
| + | bitcoin-getaddr.nse | ||
| + | bitcoin-info.nse | ||
| + | bitcoinrpc-info.nse | ||
| + | bittorrent-discovery.nse | ||
| + | bjnp-discover.nse | ||
| + | broadcast-ataoe-discover.nse | ||
| + | broadcast-avahi-dos.nse | ||
| + | broadcast-bjnp-discover.nse | ||
| + | broadcast-db2-discover.nse | ||
| + | broadcast-dhcp6-discover.nse | ||
| + | broadcast-dhcp-discover.nse | ||
| + | broadcast-dns-service-discovery.nse | ||
| + | broadcast-dropbox-listener.nse | ||
| + | broadcast-eigrp-discovery.nse | ||
| + | broadcast-igmp-discovery.nse | ||
| + | broadcast-listener.nse | ||
| + | broadcast-ms-sql-discover.nse | ||
| + | broadcast-netbios-master-browser.nse | ||
| + | broadcast-networker-discover.nse | ||
| + | broadcast-novell-locate.nse | ||
| + | broadcast-pc-anywhere.nse | ||
| + | broadcast-pc-duo.nse | ||
| + | broadcast-pim-discovery.nse | ||
| + | broadcast-ping.nse | ||
| + | broadcast-pppoe-discover.nse | ||
| + | broadcast-rip-discover.nse | ||
| + | broadcast-ripng-discover.nse | ||
| + | broadcast-sybase-asa-discover.nse | ||
| + | broadcast-tellstick-discover.nse | ||
| + | broadcast-upnp-info.nse | ||
| + | broadcast-versant-locate.nse | ||
| + | broadcast-wake-on-lan.nse | ||
| + | broadcast-wpad-discover.nse | ||
| + | broadcast-wsdd-discover.nse | ||
| + | broadcast-xdmcp-discover.nse | ||
| + | cassandra-brute.nse | ||
| + | cassandra-info.nse | ||
| + | cccam-version.nse | ||
| + | citrix-brute-xml.nse | ||
| + | citrix-enum-apps.nse | ||
| + | citrix-enum-apps-xml.nse | ||
| + | citrix-enum-servers.nse | ||
| + | citrix-enum-servers-xml.nse | ||
| + | couchdb-databases.nse | ||
| + | couchdb-stats.nse | ||
| + | creds-summary.nse | ||
| + | cups-info.nse | ||
| + | cups-queue-info.nse | ||
| + | cvs-brute.nse | ||
| + | cvs-brute-repository.nse | ||
| + | daap-get-library.nse | ||
| + | daytime.nse | ||
| + | db2-das-info.nse | ||
| + | db2-discover.nse | ||
| + | dhcp-discover.nse | ||
| + | dict-info.nse | ||
| + | distcc-cve2004-2687.nse | ||
| + | dns-blacklist.nse | ||
| + | dns-brute.nse | ||
| + | dns-cache-snoop.nse | ||
| + | dns-check-zone.nse | ||
| + | dns-client-subnet-scan.nse | ||
| + | dns-fuzz.nse | ||
| + | dns-ip6-arpa-scan.nse | ||
| + | dns-nsec3-enum.nse | ||
| + | dns-nsec-enum.nse | ||
| + | dns-nsid.nse | ||
| + | dns-random-srcport.nse | ||
| + | dns-random-txid.nse | ||
| + | dns-recursion.nse | ||
| + | dns-service-discovery.nse | ||
| + | dns-srv-enum.nse | ||
| + | dns-update.nse | ||
| + | dns-zeustracker.nse | ||
| + | dns-zone-transfer.nse | ||
| + | domcon-brute.nse | ||
| + | domcon-cmd.nse | ||
| + | domino-enum-users.nse | ||
| + | dpap-brute.nse | ||
| + | drda-brute.nse | ||
| + | drda-info.nse | ||
| + | duplicates.nse | ||
| + | eap-info.nse | ||
| + | epmd-info.nse | ||
| + | eppc-enum-processes.nse | ||
| + | finger.nse | ||
| + | firewalk.nse | ||
| + | firewall-bypass.nse | ||
| + | flume-master-info.nse | ||
| + | ftp-anon.nse | ||
| + | ftp-bounce.nse | ||
| + | ftp-brute.nse | ||
| + | ftp-libopie.nse | ||
| + | ftp-proftpd-backdoor.nse | ||
| + | ftp-vsftpd-backdoor.nse | ||
| + | ftp-vuln-cve2010-4221.nse | ||
| + | ganglia-info.nse | ||
| + | giop-info.nse | ||
| + | gkrellm-info.nse | ||
| + | gopher-ls.nse | ||
| + | gpsd-info.nse | ||
| + | hadoop-datanode-info.nse | ||
| + | hadoop-jobtracker-info.nse | ||
| + | hadoop-namenode-info.nse | ||
| + | hadoop-secondary-namenode-info.nse | ||
| + | hadoop-tasktracker-info.nse | ||
| + | hbase-master-info.nse | ||
| + | hbase-region-info.nse | ||
| + | hddtemp-info.nse | ||
| + | hostmap-bfk.nse | ||
| + | hostmap-ip2hosts.nse | ||
| + | hostmap-robtex.nse | ||
| + | http-adobe-coldfusion-apsa1301.nse | ||
| + | http-affiliate-id.nse | ||
| + | http-apache-negotiation.nse | ||
| + | http-auth-finder.nse | ||
| + | http-auth.nse | ||
| + | http-awstatstotals-exec.nse | ||
| + | http-axis2-dir-traversal.nse | ||
| + | http-backup-finder.nse | ||
| + | http-barracuda-dir-traversal.nse | ||
| + | http-brute.nse | ||
| + | http-cakephp-version.nse | ||
| + | http-chrono.nse | ||
| + | http-coldfusion-subzero.nse | ||
| + | http-comments-displayer.nse | ||
| + | http-config-backup.nse | ||
| + | http-cors.nse | ||
| + | http-date.nse | ||
| + | http-default-accounts.nse | ||
| + | </ | ||
| + | |||
| + | Les scripts sont regroupés dans des catégories : **auth**, **broadcast**, | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Pour plus d' | ||
| + | </ | ||
| + | |||
| + | La catégorie la plus utilisée est **default** qui est appelée par l' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmap -v -sC localhost | ||
| + | |||
| + | Starting Nmap 6.40 ( http:// | ||
| + | NSE: Loaded 95 scripts for scanning. | ||
| + | NSE: Script Pre-scanning. | ||
| + | Initiating SYN Stealth Scan at 14:20 | ||
| + | Scanning localhost (127.0.0.1) [1000 ports] | ||
| + | Discovered open port 22/tcp on 127.0.0.1 | ||
| + | adjust_timeouts2: | ||
| + | adjust_timeouts2: | ||
| + | Discovered open port 25/tcp on 127.0.0.1 | ||
| + | adjust_timeouts2: | ||
| + | adjust_timeouts2: | ||
| + | Discovered open port 111/tcp on 127.0.0.1 | ||
| + | adjust_timeouts2: | ||
| + | adjust_timeouts2: | ||
| + | Discovered open port 631/tcp on 127.0.0.1 | ||
| + | adjust_timeouts2: | ||
| + | adjust_timeouts2: | ||
| + | Completed SYN Stealth Scan at 14:20, 0.01s elapsed (1000 total ports) | ||
| + | NSE: Script scanning 127.0.0.1. | ||
| + | Initiating NSE at 14:20 | ||
| + | Completed NSE at 14:20, 0.28s elapsed | ||
| + | Nmap scan report for localhost (127.0.0.1) | ||
| + | Host is up (0.0000060s latency). | ||
| + | rDNS record for 127.0.0.1: localhost.localdomain | ||
| + | Not shown: 996 closed ports | ||
| + | PORT STATE SERVICE | ||
| + | 22/ | ||
| + | | ssh-hostkey: | ||
| + | |_256 19: | ||
| + | 25/ | ||
| + | |_smtp-commands: | ||
| + | 111/tcp open rpcbind | ||
| + | | rpcinfo: | ||
| + | | | ||
| + | | | ||
| + | |_ 100000 | ||
| + | 631/tcp open ipp | ||
| + | | http-methods: | ||
| + | | Potentially risky methods: PUT | ||
| + | |_See http:// | ||
| + | | http-robots.txt: | ||
| + | |_/ | ||
| + | |_http-title: | ||
| + | |||
| + | NSE: Script Post-scanning. | ||
| + | Initiating NSE at 14:20 | ||
| + | Completed NSE at 14:20, 0.00s elapsed | ||
| + | Read data files from: / | ||
| + | Nmap done: 1 IP address (1 host up) scanned in 0.43 seconds | ||
| + | Raw packets sent: 1000 (44.000KB) | Rcvd: 2004 (84.176KB) | ||
| + | </ | ||
| + | |||
| + | <WRAP center round warning 50%> | ||
| + | **Attention** - La catégorie par défaut **default** contient certains scripts de la catégorie **intrusive**. Vous ne devez donc jamais utiliser cette option sur un réseau sans avoir obtenu un accord au préalable. | ||
| + | </ | ||
| + | |||
| + | ===netcat === | ||
| + | |||
| + | **netcat** est un couteau suisse. Il permet non seulement | ||
| + | |||
| + | ==Options de la commande== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nc --help | ||
| + | Ncat 6.40 ( http:// | ||
| + | Usage: ncat [options] [hostname] [port] | ||
| + | |||
| + | Options taking a time assume seconds. Append ' | ||
| + | ' | ||
| + | -4 Use IPv4 only | ||
| + | -6 Use IPv6 only | ||
| + | -U, --unixsock | ||
| + | -C, --crlf | ||
| + | -c, --sh-exec < | ||
| + | -e, --exec < | ||
| + | --lua-exec < | ||
| + | -g hop1[, | ||
| + | -G < | ||
| + | -m, --max-conns < | ||
| + | -h, --help | ||
| + | -d, --delay < | ||
| + | -o, --output < | ||
| + | -x, --hex-dump < | ||
| + | -i, --idle-timeout < | ||
| + | -p, --source-port port | ||
| + | -s, --source addr Specify source address to use (doesn' | ||
| + | -l, --listen | ||
| + | -k, --keep-open | ||
| + | -n, --nodns | ||
| + | -t, --telnet | ||
| + | -u, --udp Use UDP instead of default TCP | ||
| + | --sctp | ||
| + | -v, --verbose | ||
| + | -w, --wait < | ||
| + | --append-output | ||
| + | --send-only | ||
| + | --recv-only | ||
| + | --allow | ||
| + | --allowfile | ||
| + | --deny | ||
| + | --denyfile | ||
| + | --broker | ||
| + | --chat | ||
| + | --proxy < | ||
| + | --proxy-type < | ||
| + | --proxy-auth < | ||
| + | --ssl Connect or listen with SSL | ||
| + | --ssl-cert | ||
| + | --ssl-key | ||
| + | --ssl-verify | ||
| + | --ssl-trustfile | ||
| + | --version | ||
| + | |||
| + | See the ncat(1) manpage for full options, descriptions and usage examples | ||
| + | </ | ||
| + | |||
| + | ==Utilisation== | ||
| + | |||
| + | Dans l' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nc 127.0.0.1 80 -w 1 -vv | ||
| + | Ncat: Version 6.40 ( http:// | ||
| + | libnsock nsi_new2(): nsi_new (IOD #1) | ||
| + | libnsock nsock_connect_tcp(): | ||
| + | libnsock nsock_trace_handler_callback(): | ||
| + | Ncat: Connection refused. | ||
| + | |||
| + | [root@centos7 ~]# nc 127.0.0.1 25 -w 1 -vv | ||
| + | Ncat: Version 6.40 ( http:// | ||
| + | libnsock nsi_new2(): nsi_new (IOD #1) | ||
| + | libnsock nsock_connect_tcp(): | ||
| + | libnsock nsock_trace_handler_callback(): | ||
| + | Ncat: Connected to 127.0.0.1: | ||
| + | libnsock nsi_new2(): nsi_new (IOD #2) | ||
| + | libnsock nsock_read(): | ||
| + | libnsock nsock_readbytes(): | ||
| + | libnsock nsock_trace_handler_callback(): | ||
| + | 220 centos7.fenestros.loc ESMTP Postfix | ||
| + | libnsock nsock_readbytes(): | ||
| + | ^C | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez que **netcat** se connecte au port 25 qui est ouvert. | ||
| + | </ | ||
| + | |||
| + | =====Les Contre-Mesures===== | ||
| + | |||
| + | Les contre-mesures incluent l' | ||
| + | |||
| + | ====LAB #2 - Mise en place du Système de Détection d' | ||
| + | |||
| + | Snort est un **S**ystème de **D**étection d' | ||
| + | |||
| + | === Installation === | ||
| + | |||
| + | Sous RHEL/CentOS 7, **snort** n'est pas installé par défaut. Qui plus est **snort** ne se trouve pas dans les dépôts standards : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# yum provides snort | ||
| + | Loaded plugins: fastestmirror, | ||
| + | Loading mirror speeds from cached hostfile | ||
| + | * base: ftp.rezopole.net | ||
| + | * extras: ftp.rezopole.net | ||
| + | * updates: ftp.rezopole.net | ||
| + | adobe-linux-x86_64/ | ||
| + | extras/ | ||
| + | updates/ | ||
| + | No matches found | ||
| + | </ | ||
| + | |||
| + | Commencez donc par installer les dépendances de snort à partir des dépôts standards : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# yum install gcc flex bison zlib libpcap pcre libdnet tcpdump | ||
| + | </ | ||
| + | |||
| + | Snort a aussi besoin du paquet **libnghttp2** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# rpm -ivh https:// | ||
| + | </ | ||
| + | |||
| + | ainsi que le paquet **daq** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# rpm -ivh https:// | ||
| + | </ | ||
| + | |||
| + | |||
| + | Il est maintenant possible d' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# rpm -ivh https:// | ||
| + | </ | ||
| + | |||
| + | Créez un lien symbolique pour la bibliothèque partagée **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ln -s / | ||
| + | </ | ||
| + | |||
| + | Dernièrement, | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# chmod ug+x / | ||
| + | </ | ||
| + | |||
| + | ==Options de la commande== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# snort --help | ||
| + | |||
| + | ,, | ||
| + | o" | ||
| + | '''' | ||
| + | | ||
| + | | ||
| + | Using libpcap version 1.5.3 | ||
| + | Using PCRE version: 8.32 2012-11-30 | ||
| + | Using ZLIB version: 1.2.7 | ||
| + | |||
| + | USAGE: snort [-options] <filter options> | ||
| + | Options: | ||
| + | -A Set alert mode: fast, full, console, test or none (alert file alerts only) | ||
| + | " | ||
| + | -b Log packets in tcpdump format (much faster!) | ||
| + | -B < | ||
| + | -c < | ||
| + | -C Print out payloads with character data only (no hex) | ||
| + | -d Dump the Application Layer | ||
| + | -D Run Snort in background (daemon) mode | ||
| + | -e | ||
| + | -f Turn off fflush() calls after binary log writes | ||
| + | -F < | ||
| + | -g < | ||
| + | -G < | ||
| + | -h < | ||
| + | (for use with -l or -B, does NOT change $HOME_NET in IDS mode) | ||
| + | -H Make hash tables deterministic. | ||
| + | -i < | ||
| + | -I Add Interface name to alert output | ||
| + | -k < | ||
| + | -K < | ||
| + | -l < | ||
| + | -L < | ||
| + | -M Log messages to syslog (not alerts) | ||
| + | -m < | ||
| + | -n < | ||
| + | -N Turn off logging (alerts still work) | ||
| + | -O | ||
| + | -p | ||
| + | -P < | ||
| + | -q | ||
| + | -Q | ||
| + | -r < | ||
| + | -R < | ||
| + | -s Log alert messages to syslog | ||
| + | -S < | ||
| + | -t < | ||
| + | -T Test and report on the current Snort configuration | ||
| + | -u < | ||
| + | -U Use UTC for timestamps | ||
| + | -v Be verbose | ||
| + | -V Show version number | ||
| + | -X Dump the raw packet data starting at the link layer | ||
| + | -x Exit if Snort configuration problems occur | ||
| + | -y | ||
| + | -Z < | ||
| + | -? Show this information | ||
| + | <Filter Options> are standard BPF options, as seen in TCPDump | ||
| + | Longname options and their corresponding single char version | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | for < | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | takes from signaling until DAQ_Stop() is called. | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | --daq < | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | </ | ||
| + | |||
| + | ===Configuration de Snort=== | ||
| + | |||
| + | Snort a besoin de règles pour fonctionner correctement. Ces règles sont disponibles sous trois formes différentes : | ||
| + | |||
| + | * **Community** - règles de base disponibles à tout le monde, | ||
| + | * **Registered** - règles disponibles à toute personne possédant un compte gratuit sur le site **[[http:// | ||
| + | * **Subscription** - règles les plus efficaces disponibles uniquement aux utilisateurs enregistrés **et** abonnés à un plan payant. | ||
| + | |||
| + | Le répertoire rules est donc vide lors de l' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ls / | ||
| + | [root@centos7 ~]# | ||
| + | </ | ||
| + | |||
| + | Téléchargez les règles **Registered** grâce au lien suivant contenant un **oinkcode** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# wget https:// | ||
| + | </ | ||
| + | |||
| + | Ensuite, saisissez les commandes suivantes : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# tar -xvf ~/ | ||
| + | [root@centos7 ~]# ls / | ||
| + | app-detect.rules | ||
| + | attack-responses.rules | ||
| + | backdoor.rules | ||
| + | bad-traffic.rules | ||
| + | blacklist.rules | ||
| + | botnet-cnc.rules | ||
| + | browser-chrome.rules | ||
| + | browser-firefox.rules | ||
| + | browser-ie.rules | ||
| + | browser-other.rules | ||
| + | browser-plugins.rules | ||
| + | browser-webkit.rules | ||
| + | chat.rules | ||
| + | content-replace.rules | ||
| + | ddos.rules | ||
| + | deleted.rules | ||
| + | dns.rules | ||
| + | dos.rules | ||
| + | experimental.rules | ||
| + | exploit-kit.rules | ||
| + | exploit.rules | ||
| + | file-executable.rules | ||
| + | file-flash.rules | ||
| + | file-identify.rules | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Si vous utilisez **snort** régulièrement, | ||
| + | </ | ||
| + | |||
| + | == Editer le fichier / | ||
| + | |||
| + | Lancez vi pour éditer le fichier **/ | ||
| + | |||
| + | Modifiez la ligne qui commence par **ipvar HOME_NET** pour que celle-ci comporte l' | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | ipvar HOME_NET 10.0.2.0/ | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Dans le cas où vous êtes connecté à deux ou à plusieurs réseaux directement, | ||
| + | |||
| + | ipvar HOME_NET [adresse_réseau_1 ( p.e. 10.0.2.0/24 ), adresse_réseau_2 ( p.e. 10.0.0.0/8 )] | ||
| + | |||
| + | Vérifiez la présence de les lignes qui commencent par **var RULE_PATH**, | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | var RULE_PATH / | ||
| + | var SO_RULE_PATH ../ | ||
| + | var PREPROC_RULE_PATH ../ | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Modifiez les deux lignes suivantes afin d' | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | var WHITE_LIST_PATH / | ||
| + | var BLACK_LIST_PATH / | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Décommentez la ligne qui commence par **ooutput unified2** concernant la journalisation et supprimez le mot **nostamp** : | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | # unified2 | ||
| + | # Recommended for most installs | ||
| + | output unified2: filename merged.log, limit 128, mpls_event_types, | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Commentez ensuite la ligne commençant par **dynamicdetection directory** : | ||
| + | |||
| + | < | ||
| + | # path to dynamic rules libraries | ||
| + | # dynamicdetection directory / | ||
| + | </ | ||
| + | |||
| + | Créez ensuite les deux fichiers ci-dessous : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# touch / | ||
| + | [root@centos7 ~]# touch / | ||
| + | </ | ||
| + | |||
| + | Modifiez maintenant le fichier **/ | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | #### General Configuration | ||
| + | |||
| + | # What interface should snort listen on? [Pick only 1 of the next 3!] | ||
| + | # This is -i {interface} on the command line | ||
| + | # This is the snort.conf config interface: {interface} directive | ||
| + | # INTERFACE=eth0 | ||
| + | INTERFACE=enp0s3 | ||
| + | # | ||
| + | # The following two options are not directly supported on the command line | ||
| + | # or in the conf file and assume the same Snort configuration for all | ||
| + | # instances | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Vérifiez le fichier de configuration : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# snort -T -c / | ||
| + | ... | ||
| + | --== Initialization Complete ==-- | ||
| + | |||
| + | ,, | ||
| + | o" | ||
| + | '''' | ||
| + | | ||
| + | | ||
| + | Using libpcap version 1.5.3 | ||
| + | Using PCRE version: 8.32 2012-11-30 | ||
| + | Using ZLIB version: 1.2.7 | ||
| + | |||
| + | Rules Engine: SF_SNORT_DETECTION_ENGINE | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Snort successfully validated the configuration! | ||
| + | Snort exiting | ||
| + | </ | ||
| + | |||
| + | === Utilisation de snort en mode " | ||
| + | |||
| + | Pour visualiser les paquets à l'aide de snort, saisissez la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# snort -vde -c / | ||
| + | ... | ||
| + | [root@centos7 ~]# ^C | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | Pour surveiller une interface réseau en particulier, | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# snort -vd -i enp0s3 -c / | ||
| + | ... | ||
| + | [root@centos7 ~]# ^C | ||
| + | </ | ||
| + | |||
| + | === Utilisation de snort en mode " | ||
| + | |||
| + | Pour rediriger la sortie à l' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# snort -de -l / | ||
| + | ... | ||
| + | [root@centos7 ~]# ^C | ||
| + | </ | ||
| + | |||
| + | ===Journalisation=== | ||
| + | |||
| + | Constatez le contenu de **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ls / | ||
| + | merged.log | ||
| + | </ | ||
| + | |||
| + | Constatez le contenu du fichier de journalisation : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# tail / | ||
| + | |||
| + | ����; | ||
| + | |||
| + | �Ҡ��3��; | ||
| + | |||
| + | ����; | ||
| + | ������]l�S�����W�h���օYO<' | ||
| + | |||
| + | ����_��������օY���RT5' | ||
| + | |||
| + | �Ҡ����_P�����G}& | ||
| + | |||
| + | </ | ||
| + | |||
| + | Ce fichier étant au format **PCAP binaire**, vous pouvez le lire avec la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# snort -r / | ||
| + | </ | ||
| + | |||
| + | Notez que ce fichier peut aussi être lu par la commande **tcpdump** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# tcpdump -r / | ||
| + | reading from file / | ||
| + | 16: | ||
| + | 40, length 676 | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | --More-- | ||
| + | |||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Vous pouvez utiliser le logiciel Wireshark pour visulaiser le contenu du fichier en mode graphique. | ||
| + | </ | ||
| + | |||
| + | Dernièrement, | ||
| + | |||
| + | # snort -de -l / | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | Pour lancer snort en arrière plan afin de surveiller l' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# / | ||
| + | [1] 19281 | ||
| + | [root@centos7 ~]# Spawning daemon child... | ||
| + | My daemon child 19401 lives... | ||
| + | Daemon parent exiting (0) | ||
| + | ^C | ||
| + | [1]+ Done / | ||
| + | [root@centos7 ~]# ps aux | grep snort | ||
| + | snort 19401 0.0 24.6 850984 504544 ? | ||
| + | root | ||
| + | </ | ||
| + | |||
| + | Pour arrêter ce processus, utilisez al commande **kill**: | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ps aux | grep snort | ||
| + | snort 19401 0.0 24.6 850984 504692 ? | ||
| + | root | ||
| + | [root@centos7 ~]# kill 19401 | ||
| + | [root@centos7 ~]# ps aux | grep snort | ||
| + | root | ||
| + | </ | ||
| + | |||
| + | ====LAB #3 - Mise en place du Système de Détection et de Prévention d' | ||
| + | |||
| + | Portsentry est un **S**ystème de **D**étection et de **Prévention** d' | ||
| + | |||
| + | === Installation === | ||
| + | |||
| + | Sous RHEL/CentOS 7, **portsentry** n'est pas installé par défaut. Qui plus est **portsentry** ne se trouve pas dans les dépôts standards. Installez donc le paquet **portsentry-1.2-1.el5.x86_64.rpm** à partir de l'URL ci-dessous : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# rpm -ivh https:// | ||
| + | Loaded plugins: fastestmirror, | ||
| + | portsentry-1.2-1.el5.x86_64.rpm | ||
| + | Examining / | ||
| + | Marking / | ||
| + | Resolving Dependencies | ||
| + | --> Running transaction check | ||
| + | ---> Package portsentry.x86_64 0:1.2-1.el5 will be installed | ||
| + | --> Finished Dependency Resolution | ||
| + | adobe-linux-x86_64 | ||
| + | base/ | ||
| + | extras/ | ||
| + | updates/ | ||
| + | |||
| + | Dependencies Resolved | ||
| + | |||
| + | ======================================================================================================================================= | ||
| + | | ||
| + | ======================================================================================================================================= | ||
| + | Installing: | ||
| + | | ||
| + | |||
| + | Transaction Summary | ||
| + | ======================================================================================================================================= | ||
| + | Install | ||
| + | |||
| + | Total size: 114 k | ||
| + | Installed size: 114 k | ||
| + | Is this ok [y/d/N]: y | ||
| + | |||
| + | </ | ||
| + | |||
| + | ===Configuration=== | ||
| + | |||
| + | Modifiez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nl / | ||
| + | 1 # PortSentry Configuration | ||
| + | 2 # | ||
| + | 3 # $Id: portsentry.conf, | ||
| + | 4 # | ||
| + | 5 # IMPORTANT NOTE: You CAN NOT put spaces between your port arguments. | ||
| + | 6 # | ||
| + | 7 # The default ports will catch a large number of common probes | ||
| + | 8 # | ||
| + | 9 # All entries must be in quotes. | ||
| + | |||
| + | |||
| + | 10 ####################### | ||
| + | 11 # Port Configurations # | ||
| + | 12 ####################### | ||
| + | 13 # | ||
| + | 14 # | ||
| + | 15 # Some example port configs for classic and basic Stealth modes | ||
| + | 16 # | ||
| + | 17 # I like to always keep some ports at the " | ||
| + | 18 # This will detect a sequential port sweep really quickly and usually | ||
| + | 19 # these ports are not in use (i.e. tcpmux port 1) | ||
| + | 20 # | ||
| + | 21 # ** X-Windows Users **: If you are running X on your box, you need to be sure | ||
| + | 22 # you are not binding PortSentry to port 6000 (or port 2000 for OpenWindows users). | ||
| + | 23 # Doing so will prevent the X-client from starting properly. | ||
| + | 24 # | ||
| + | 25 # These port bindings are *ignored* for Advanced Stealth Scan Detection Mode. | ||
| + | 26 # | ||
| + | |||
| + | 27 # Un-comment these if you are really anal: | ||
| + | 28 # | ||
| + | 29 # | ||
| + | 30 # | ||
| + | 31 # Use these if you just want to be aware: | ||
| + | 32 TCP_PORTS=" | ||
| + | 33 UDP_PORTS=" | ||
| + | 34 # | ||
| + | 35 # Use these for just bare-bones | ||
| + | 36 # | ||
| + | 37 # | ||
| + | |||
| + | 38 ########################################### | ||
| + | 39 # Advanced Stealth Scan Detection Options # | ||
| + | 40 ########################################### | ||
| + | 41 # | ||
| + | 42 # This is the number of ports you want PortSentry to monitor in Advanced mode. | ||
| + | 43 # Any port *below* this number will be monitored. Right now it watches | ||
| + | 44 # everything below 1024. | ||
| + | 45 # | ||
| + | 46 # On many Linux systems you cannot bind above port 61000. This is because | ||
| + | 47 # these ports are used as part of IP masquerading. I don't recommend you | ||
| + | 48 # bind over this number of ports. Realistically: | ||
| + | 49 # OVER 1024 PORTS AS YOUR FALSE ALARM RATE WILL ALMOST CERTAINLY RISE. You've been | ||
| + | 50 # warned! Don't write me if you have have a problem because I'll only tell | ||
| + | 51 # you to RTFM and don't run above the first 1024 ports. | ||
| + | 52 # | ||
| + | 53 # | ||
| + | 54 ADVANCED_PORTS_TCP=" | ||
| + | 55 ADVANCED_PORTS_UDP=" | ||
| + | 56 # | ||
| + | 57 # This field tells PortSentry what ports (besides listening daemons) to | ||
| + | 58 # ignore. This is helpful for services like ident that services such | ||
| + | 59 # as FTP, SMTP, and wrappers look for but you may not run (and probably | ||
| + | 60 # *shouldn' | ||
| + | 61 # | ||
| + | 62 # By specifying ports here PortSentry will simply not respond to | ||
| + | 63 # incoming requests, in effect PortSentry treats them as if they are | ||
| + | 64 # actual bound daemons. The default ports are ones reported as | ||
| + | 65 # problematic false alarms and should probably be left alone for | ||
| + | 66 # all but the most isolated systems/ | ||
| + | 67 # | ||
| + | 68 # Default TCP ident and NetBIOS service | ||
| + | 69 ADVANCED_EXCLUDE_TCP=" | ||
| + | 70 # Default UDP route (RIP), NetBIOS, bootp broadcasts. | ||
| + | 71 ADVANCED_EXCLUDE_UDP=" | ||
| + | |||
| + | |||
| + | 72 ###################### | ||
| + | 73 # Configuration Files# | ||
| + | 74 ###################### | ||
| + | 75 # | ||
| + | 76 # Hosts to ignore | ||
| + | 77 IGNORE_FILE="/ | ||
| + | 78 # Hosts that have been denied (running history) | ||
| + | 79 HISTORY_FILE="/ | ||
| + | 80 # Hosts that have been denied this session only (temporary until next restart) | ||
| + | 81 BLOCKED_FILE="/ | ||
| + | |||
| + | 82 ############################## | ||
| + | 83 # Misc. Configuration Options# | ||
| + | 84 ############################## | ||
| + | 85 # | ||
| + | 86 # DNS Name resolution - Setting this to " | ||
| + | 87 # for attacking hosts. Setting it to " | ||
| + | 88 # it off. | ||
| + | 89 RESOLVE_HOST = " | ||
| + | |||
| + | 90 ################### | ||
| + | 91 # Response Options# | ||
| + | 92 ################### | ||
| + | 93 # Options to dispose of attacker. Each is an action that will | ||
| + | 94 # be run if an attack is detected. If you don't want a particular | ||
| + | 95 # option then comment it out and it will be skipped. | ||
| + | 96 # | ||
| + | 97 # The variable $TARGET$ will be substituted with the target attacking | ||
| + | 98 # host when an attack is detected. The variable $PORT$ will be substituted | ||
| + | 99 # with the port that was scanned. | ||
| + | | ||
| + | | ||
| + | 102 # Ignore Options # | ||
| + | | ||
| + | 104 # These options allow you to enable automatic response | ||
| + | 105 # options for UDP/TCP. This is useful if you just want | ||
| + | 106 # warnings for connections, | ||
| + | 107 # a particular protocol (i.e. you want to block TCP, but | ||
| + | 108 # not UDP). To prevent a possible Denial of service attack | ||
| + | 109 # against UDP and stealth scan detection for TCP, you may | ||
| + | 110 # want to disable blocking, but leave the warning enabled. | ||
| + | 111 # I personally would wait for this to become a problem before | ||
| + | 112 # doing though as most attackers really aren't doing this. | ||
| + | 113 # The third option allows you to run just the external command | ||
| + | 114 # in case of a scan to have a pager script or such execute | ||
| + | 115 # but not drop the route. This may be useful for some admins | ||
| + | 116 # who want to block TCP, but only want pager/ | ||
| + | 117 # on UDP, etc. | ||
| + | | ||
| + | 119 # | ||
| + | 120 # 0 = Do not block UDP/TCP scans. | ||
| + | 121 # 1 = Block UDP/TCP scans. | ||
| + | 122 # 2 = Run external command only (KILL_RUN_CMD) | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | | ||
| + | 126 # Dropping Routes:# | ||
| + | | ||
| + | 128 # This command is used to drop the route or add the host into | ||
| + | 129 # a local filter table. | ||
| + | | ||
| + | 131 # The gateway (333.444.555.666) should ideally be a dead host on | ||
| + | 132 # the *local* subnet. On some hosts you can also point this at | ||
| + | 133 # localhost (127.0.0.1) and get the same effect. NOTE THAT | ||
| + | 134 # 333.444.555.66 WILL *NOT* WORK. YOU NEED TO CHANGE IT!! | ||
| + | | ||
| + | 136 # ALL KILL ROUTE OPTIONS ARE COMMENTED OUT INITIALLY. Make sure you | ||
| + | 137 # uncomment the correct line for your OS. If you OS is not listed | ||
| + | 138 # here and you have a route drop command that works then please | ||
| + | 139 # mail it to me so I can include it. ONLY ONE KILL_ROUTE OPTION | ||
| + | 140 # CAN BE USED AT A TIME SO DON'T UNCOMMENT MULTIPLE LINES. | ||
| + | | ||
| + | 142 # NOTE: The route commands are the least optimal way of blocking | ||
| + | 143 # and do not provide complete protection against UDP attacks and | ||
| + | 144 # will still generate alarms for both UDP and stealth scans. I | ||
| + | 145 # always recommend you use a packet filter because they are made | ||
| + | 146 # for this purpose. | ||
| + | | ||
| + | |||
| + | 148 # Generic | ||
| + | | ||
| + | |||
| + | 150 # Generic Linux | ||
| + | | ||
| + | |||
| + | 152 # Newer versions of Linux support the reject flag now. This | ||
| + | 153 # is cleaner than the above option. | ||
| + | | ||
| + | |||
| + | 155 # Generic BSD (BSDI, OpenBSD, NetBSD, FreeBSD) | ||
| + | | ||
| + | |||
| + | 157 # Generic Sun | ||
| + | | ||
| + | |||
| + | 159 # NEXTSTEP | ||
| + | | ||
| + | |||
| + | 161 # FreeBSD | ||
| + | | ||
| + | |||
| + | 163 # Digital UNIX 4.0D (OSF/1 / Compaq Tru64 UNIX) | ||
| + | | ||
| + | |||
| + | 165 # Generic HP-UX | ||
| + | | ||
| + | |||
| + | | ||
| + | 168 # Using a packet filter is the PREFERRED. The below lines | ||
| + | 169 # work well on many OS's. Remember, you can only uncomment *one* | ||
| + | 170 # KILL_ROUTE option. | ||
| + | | ||
| + | |||
| + | 172 # ipfwadm support for Linux | ||
| + | | ||
| + | | ||
| + | 175 # ipfwadm support for Linux (no logging of denied packets) | ||
| + | | ||
| + | | ||
| + | 178 # ipchain support for Linux | ||
| + | | ||
| + | | ||
| + | 181 # ipchain support for Linux (no logging of denied packets) | ||
| + | | ||
| + | | ||
| + | 184 # iptables support for Linux | ||
| + | | ||
| + | |||
| + | 186 # For those of you running FreeBSD (and compatible) you can | ||
| + | 187 # use their built in firewalling as well. | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | 192 # For those running ipfilt (OpenBSD, etc.) | ||
| + | 193 # NOTE THAT YOU NEED TO CHANGE external_interface TO A VALID INTERFACE!! | ||
| + | | ||
| + | | ||
| + | |||
| + | |||
| + | | ||
| + | 197 # TCP Wrappers# | ||
| + | | ||
| + | 199 # This text will be dropped into the hosts.deny file for wrappers | ||
| + | 200 # to use. There are two formats for TCP wrappers: | ||
| + | | ||
| + | 202 # Format One: Old Style - The default when extended host processing | ||
| + | 203 # options are not enabled. | ||
| + | | ||
| + | | ||
| + | |||
| + | 206 # Format Two: New Style - The format used when extended option | ||
| + | 207 # processing is enabled. You can drop in extended processing | ||
| + | 208 # options, but be sure you escape all ' | ||
| + | 209 # to prevent problems writing out (i.e. \%c \%h ) | ||
| + | | ||
| + | | ||
| + | |||
| + | | ||
| + | 213 # External Command# | ||
| + | | ||
| + | 215 # This is a command that is run when a host connects, it can be whatever | ||
| + | 216 # you want it to be (pager, etc.). This command is executed before the | ||
| + | 217 # route is dropped or after depending on the KILL_RUN_CMD_FIRST option below | ||
| + | | ||
| + | | ||
| + | 220 # I NEVER RECOMMEND YOU PUT IN RETALIATORY ACTIONS AGAINST THE HOST SCANNING | ||
| + | 221 # YOU! | ||
| + | | ||
| + | 223 # TCP/IP is an *unauthenticated protocol* and people can make scans appear out | ||
| + | 224 # of thin air. The only time it is reasonably safe (and I *never* think it is | ||
| + | 225 # reasonable) to run reverse probe scripts is when using the " | ||
| + | 226 # This mode requires a full connect and is very hard to spoof. | ||
| + | | ||
| + | 228 # The KILL_RUN_CMD_FIRST value should be set to " | ||
| + | 229 # to run *before* the blocking occurs and should be set to " | ||
| + | 230 # command run *after* the blocking has occurred. | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | |||
| + | | ||
| + | 239 # Scan trigger value# | ||
| + | | ||
| + | 241 # Enter in the number of port connects you will allow before an | ||
| + | 242 # alarm is given. The default is 0 which will react immediately. | ||
| + | 243 # A value of 1 or 2 will reduce false alarms. Anything higher is | ||
| + | 244 # probably not necessary. This value must always be specified, but | ||
| + | 245 # generally can be left at 0. | ||
| + | | ||
| + | 247 # NOTE: If you are using the advanced detection option you need to | ||
| + | 248 # be careful that you don't make a hair trigger situation. Because | ||
| + | 249 # Advanced mode will react for *any* host connecting to a non-used | ||
| + | 250 # below your specified range, you have the opportunity to really | ||
| + | 251 # break things. (i.e someone innocently tries to connect to you via | ||
| + | 252 # SSL [TCP port 443] and you immediately block them). Some of you | ||
| + | 253 # may even want this though. Just be careful. | ||
| + | | ||
| + | | ||
| + | |||
| + | | ||
| + | 257 # Port Banner Section# | ||
| + | | ||
| + | | ||
| + | 260 # Enter text in here you want displayed to a person tripping the PortSentry. | ||
| + | 261 # I *don' | ||
| + | 262 # Leave this commented out to disable the feature | ||
| + | | ||
| + | 264 # Stealth scan detection modes don't use this feature | ||
| + | | ||
| + | | ||
| + | |||
| + | 267 # EOF | ||
| + | </ | ||
| + | |||
| + | Pour rendre le service SysVInit compatible avec Systemd, éditez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nl / | ||
| + | | ||
| + | 2 # | ||
| + | 3 # Startup script for the Portsentry portscan detector | ||
| + | 4 # | ||
| + | 5 # chkconfig: 345 98 02 | ||
| + | 6 # description: | ||
| + | | ||
| + | | ||
| + | | ||
| + | 10 # processname: | ||
| + | 11 # pidfile: / | ||
| + | 12 # config: / | ||
| + | |||
| + | 13 # Source function library. | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Puis ajoutez la ligne **80** : | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | 77 stop() { | ||
| + | 78 echo -n $" | ||
| + | 79 killproc portsentry | ||
| + | 80 killall portsentry | ||
| + | 81 RETVAL=$? | ||
| + | 82 echo | ||
| + | 83 [ $RETVAL -eq 0 ] && rm -f / | ||
| + | 84 } | ||
| + | |||
| + | 85 # See how we were called. | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Dernièrement, | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# yum install -y initscripts | ||
| + | </ | ||
| + | |||
| + | ===Utilisation=== | ||
| + | |||
| + | Démarrez le service **portsentry** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# systemctl start portsentry | ||
| + | [root@centos7 ~]# systemctl status portsentry | ||
| + | ● portsentry.service - SYSV: PortSentry Port Scan Detector is part of the Abacus Project suite of tools. The Abacus Project is an initiative to release low-maintenance, | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Process: 6487 ExecStart=/ | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Hint: Some lines were ellipsized, use -l to show in full. | ||
| + | [root@centos7 ~]# ps aux | grep portsentry | ||
| + | root 6511 0.0 0.0 | ||
| + | root 6513 0.0 0.0 | ||
| + | root 6687 0.0 0.0 114692 | ||
| + | </ | ||
| + | |||
| + | Editez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nl / | ||
| + | 1 # Put hosts in here you never want blocked. This includes the IP addresses | ||
| + | 2 # of all local interfaces on the protected host (i.e virtual host, mult-home) | ||
| + | 3 # Keep 127.0.0.1 and 0.0.0.0 to keep people from playing games. | ||
| + | 4 # | ||
| + | 5 # PortSentry can support full netmasks for networks as well. Format is: | ||
| + | 6 # | ||
| + | 7 # <IP Address>/< | ||
| + | 8 # | ||
| + | 9 # Example: | ||
| + | 10 # | ||
| + | 11 # 192.168.2.0/ | ||
| + | 12 # 192.168.0.0/ | ||
| + | 13 # 192.168.2.1/ | ||
| + | 14 # Etc. | ||
| + | 15 # | ||
| + | 16 # If you don't supply a netmask it is assumed to be 32 bits. | ||
| + | 17 # | ||
| + | 18 # | ||
| + | |||
| + | 19 127.0.0.1/ | ||
| + | 20 0.0.0.0 | ||
| + | 21 ######################################### | ||
| + | 22 # Do NOT edit below this line, if you # | ||
| + | 23 # do, your changes will be lost when # | ||
| + | 24 # portsentry is restarted via the # | ||
| + | 25 # initscript. Make all changes above # | ||
| + | 26 # this box. # | ||
| + | 27 ######################################### | ||
| + | |||
| + | 28 # Exclude all local interfaces | ||
| + | 29 # | ||
| + | 30 fe80:: | ||
| + | 31 127.0.0.1 | ||
| + | 32 ::1 | ||
| + | |||
| + | 33 # Exclude the default gateway(s) | ||
| + | 34 10.0.2.2 | ||
| + | |||
| + | 35 # Exclude the nameservers | ||
| + | 36 10.0.2.3 | ||
| + | |||
| + | 37 # And last but not least... | ||
| + | 38 0.0.0.0 | ||
| + | </ | ||
| + | |||
| + | **Sans** re-démarrez le service portsentry, lancez un scan des ports avec nmap : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmap -sC 172.YY+20.0.3 | ||
| + | |||
| + | Starting Nmap 6.40 ( http:// | ||
| + | ^C | ||
| + | You have new mail in / | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | Consultez les règles d' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# iptables -L | ||
| + | Chain INPUT (policy ACCEPT) | ||
| + | target | ||
| + | DROP | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | INPUT_direct | ||
| + | INPUT_ZONES_SOURCE | ||
| + | INPUT_ZONES | ||
| + | DROP | ||
| + | REJECT | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Dernièrement, | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# mail | ||
| + | Heirloom Mail version 12.5 7/ | ||
| + | "/ | ||
| + | >N 1 trainee@centos7.fene | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | & 6 | ||
| + | Message | ||
| + | From root@centos7.fenestros.loc | ||
| + | Return-Path: | ||
| + | X-Original-To: | ||
| + | Delivered-To: | ||
| + | Date: Sun, 06 Aug 2017 14:52:43 +0200 | ||
| + | To: root@localhost.fenestros.loc | ||
| + | Subject: Portscan from 10.0.2.15 on port 143 | ||
| + | User-Agent: Heirloom mailx 12.5 7/5/10 | ||
| + | Content-Type: | ||
| + | From: root@centos7.fenestros.loc (root) | ||
| + | Status: R | ||
| + | |||
| + | |||
| + | & q | ||
| + | Held 6 messages in / | ||
| + | You have mail in / | ||
| + | [root@centos7 ~]# | ||
| + | </ | ||
| + | |||
| + | Pour nettoyer la règle, re-démarrez le service **firewalld** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# systemctl restart firewalld | ||
| + | [root@centos7 ~]# iptables -L | ||
| + | Chain INPUT (policy ACCEPT) | ||
| + | target | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | INPUT_direct | ||
| + | INPUT_ZONES_SOURCE | ||
| + | INPUT_ZONES | ||
| + | DROP | ||
| + | REJECT | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | ----- | ||
| + | |||
| + | =====ChangeLog===== | ||
| + | |||
| + | ====2020.01==== | ||
| + | |||
| + | Backup 2019.beta restauré en 2020.01. | ||
| + | |||
| + | ====2020.02==== | ||
| + | |||
| + | * **Fixed** - Erreur dans un lien dans le LAB #2 : **https:// | ||
| + | |||
| + | ====2020.03==== | ||
| + | |||
| + | * **Fixed** - Erreur dans un lien dans le LAB #2 : **https:// | ||
| + | |||
| + | * **Fixed** - Erreur dans un lien dans le LAB #2 : **http:// | ||
| - | Afin de valider votre formation, veuillez compléter l’Évaluation de la Formation. | + | * **Fixed** - Erreur dans un lien dans le LAB #2 : **https:// |
| - | =====Remerciements===== | + | * **Fixed** - Erreur dans un lien dans le LAB #2 : **https:// |
| - | Nous vous remercions de votre confiance et nous vous souhaitons une excellente continuation. | + | * **Fixed** - Erreur dans un lien dans le LAB #3 : **http:// |
| ----- | ----- | ||
| - | < | + | Copyright © 2020 Hugh Norris. |
| - | <DIV ALIGN=" | + | |
| - | Copyright © 2020 Hugh Norris< | + | |
| - | Document non-contractuel. Le programme peut être modifié sans préavis. | + | |
| - | </ | + | |
| - | </ | + | |
