Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:centos:8:avance:l114 [2023/12/08 14:52] – admin | elearning:workbooks:centos:8:avance:l114 [2024/10/18 07:58] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| - | Version : **2023.01** | + | Version : **2024.01** |
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LCF604 | + | ======LCF606 |
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| - | * **LCF604 | + | * **LCF606 |
| * Contenu du Module | * Contenu du Module | ||
| - | * Présentation | + | * Le Pare-feu Netfilter/ |
| - | | + | * LAB #1 - La Configuration |
| - | | + | * La Configuration de Base de firewalld |
| - | * 1.1 - Connections et Profils | + | * La Commande firewall-cmd |
| - | * 1.2 - Résolution des Noms | + | * La Configuration Avancée de firewalld |
| - | * 1.3 - Ajouter une Deuxième Adresse IP à un Profil | + | * Le mode Panic de firewalld |
| - | * 1.4 - La Commande hostname | + | * System Hardening |
| - | * 1.5 - La Commande ip | + | * Les compilateurs |
| - | * 1.6 - Activer/ | + | * Les paquets |
| - | * 1.7 - Routage Statique | + | * Les démons et services |
| - | * La commande | + | * Les fichiers |
| - | * Activer/ | + | * Les fichiers et les repertoires sans proprietaire |
| - | * LAB #2 - Diagnostique du Réseau | + | * Limiter le delai d' |
| - | * 2.1 - ping | + | * Renforcer la securite d' |
| - | * 2.2 - netstat -i | + | * Les Distributions SysVInit |
| - | * 2.3 - traceroute | + | * Les Distributions Upstart |
| - | * LAB #3 - Connexions à Distance | + | * Renforcer la sécurité du Noyau |
| - | * 3.1 - Telnet | + | * La commande |
| - | * 3.2 - wget | + | * Mise en place de SELinux pour sécuriser |
| - | * 3.3 - ftp | + | * Introducton |
| - | * 3.4 - SSH | + | * Définitions |
| - | * Présentation | + | * Security Context |
| - | * SSH-1 | + | * Domains et Types |
| - | * SSH-2 | + | * Roles |
| - | * Authentification par mot de passe | + | * Politiques de Sécurité |
| - | * Authentification par clef asymétrique | + | * Langage de Politiques |
| - | * Configuration | + | * allow |
| - | * Configuration | + | * type |
| - | * Tunnels SSH | + | * type_transition |
| - | * 3.5 - SCP | + | * Décisions de SELinux |
| + | * Décisions d' | ||
| + | * Décisions de Transition | ||
| + | * Commandes SELinux | ||
| + | * Les Etats de SELinux | ||
| + | * Booléens | ||
| + | * LAB #2 - Travailler avec SELinux | ||
| + | * Copier et Déplacer des Fichiers | ||
| + | * Vérifier les SC des Processus | ||
| + | * Visualiser la SC d'un Utilisateur | ||
| + | * Vérifier la SC d'un fichier | ||
| + | * Troubleshooting SELinux | ||
| + | * La commande chcon | ||
| + | * La commande restorecon | ||
| + | * Le fichier /.autorelabel | ||
| + | * La commande semanage | ||
| + | * La commande audit2allow | ||
| + | | ||
| + | | ||
| + | * LAB #4 - Mise en place du Système de Prévention d' | ||
| + | * Installation | ||
| + | * Configuration | ||
| + | * Le répertoire / | ||
| + | * Le fichier fail2ban.conf | ||
| + | * Le répertoire / | ||
| + | * Le répertoire / | ||
| + | * Commandes | ||
| + | * Activer et Démarrer le Serveur | ||
| + | * Utiliser la Commande Fail2Ban-server | ||
| + | * Ajouter un Prison | ||
| + | * Balayage des Ports | ||
| + | * LAB #5 - Utilisation de nmap et de netcat | ||
| + | * nmap | ||
| + | * Installation | ||
| + | * Utilisation | ||
| + | * Fichiers | ||
| + | * Scripts | ||
| + | * netcat | ||
| + | * Utilisation | ||
| + | * LAB #6 - Mise en place du Système de Détection et de Prévention d' | ||
| + | * Installation | ||
| + | * Configuration | ||
| + | * Utilisation | ||
| + | * Système de Fichiers | ||
| + | * LAB #7 - Mise en place du File Integrity Checker Afick | ||
| * Présentation | * Présentation | ||
| + | * Installation | ||
| + | * Configuration | ||
| + | * La Section Directives | ||
| + | * La Section Alias | ||
| + | * La Section File | ||
| * Utilisation | * Utilisation | ||
| - | | + | |
| + | * LAB #8 - Mise en place de rkhunter | ||
| + | * Installation | ||
| + | * Les options de la commande | ||
| + | * Utilisation | ||
| + | * Configuration | ||
| + | |||
| + | |||
| + | =====Le Pare-feu Netfilter===== | ||
| + | |||
| + | **Netfilter** est composé de 5 //hooks// : | ||
| + | |||
| + | * NF_IP_PRE_ROUTING | ||
| + | * NF_IP_LOCAL_IN | ||
| + | * NF_IP_LOCAL_OUT | ||
| + | * NF_IP_FORWARD | ||
| + | * NF_IP_POSTROUTING | ||
| + | |||
| + | Ces hooks sont utilisés par deux branches, la première est celle concernée par les paquets qui entrent vers des services locaux : | ||
| + | |||
| + | * NF_IP_PRE_ROUTING > NF_IP_LOCAL_IN > NF_IP_LOCAL_OUT > NF_IP_POSTROUTING | ||
| + | |||
| + | tandis que la deuxième concerne les paquets qui traversent la passerelle: | ||
| + | |||
| + | * NF_IP_PRE_ROUTING > NF_IP_FORWARD > NF_IP_POSTROUTING | ||
| + | |||
| + | Si IPTABLES a été compilé en tant que module, son utilisation nécessite le chargement de plusieurs modules supplémentaires en fonction de la situation: | ||
| + | |||
| + | * iptable_filter | ||
| + | * iptable_mangle | ||
| + | * iptable_net | ||
| + | * etc | ||
| + | |||
| + | Netfilter est organisé en **tables**. La commande **iptables** de netfilter permet d' | ||
| + | |||
| + | * La table **FILTER** | ||
| + | * La chaîne INPUT | ||
| + | * Concerne les paquets entrants | ||
| + | * Policies: ACCEPT, DROP, REJECT | ||
| + | * La chaîne OUTPUT | ||
| + | * Concerne les paquets sortants | ||
| + | * Policies: ACCEPT, DROP, REJECT | ||
| + | * La chaîne FORWARD | ||
| + | * Concerne les paquets traversant le par-feu. | ||
| + | * Policies: ACCEPT, DROP, REJECT | ||
| + | |||
| + | Si aucune table n'est précisée, c'est la table FILTER qui s' | ||
| + | |||
| + | * La table **NAT** | ||
| + | * La chaîne PREROUTING | ||
| + | * Permet de faire la translation d' | ||
| + | * Cibles: SNAT, DNAT, MASQUERADE | ||
| + | * La chaîne POSTROUTING | ||
| + | * Permet de faire la translation d' | ||
| + | * Cibles: SNAT, DNAT, MASQUERADE | ||
| + | * Le cas spécifique OUTPUT | ||
| + | * Permet la modification de la destination des paquets générés localement | ||
| + | |||
| + | * La table **MANGLE** | ||
| + | * Permet le marquage de paquets générés localement (OUTPUT) et entrants (PREROUTING) | ||
| + | |||
| + | Les **policies** sont: | ||
| + | |||
| + | * ACCEPT | ||
| + | * Permet d' | ||
| + | * DROP | ||
| + | * Permet de rejeter le paquet concerné sans générer un message d' | ||
| + | * REJECT | ||
| + | * Permet de rejeter le paquet concerné en générant une message d' | ||
| + | |||
| + | Les **cibles** sont: | ||
| + | |||
| + | * SNAT | ||
| + | * Permet de modifier l' | ||
| + | * DNAT | ||
| + | * Permet de modifier l' | ||
| + | * MASQUERADE | ||
| + | * Permet de remplacer l' | ||
| + | |||
| + | IPTABLES peut être configuré soit par des outils tels shorewall, soit en utilisant des lignes de commandes ou un script. Dans ce dernier cas, la ligne prend la forme: | ||
| + | |||
| + | # IPTABLES --action CHAINE --option1 --option2 | ||
| + | |||
| + | Les actions sont: | ||
| + | |||
| + | ^ Action | ||
| + | | - -append | -A | Ajouter une règle à la fin de la chaîne spécifiée | | ||
| + | | - -delete | -D | Supprimer une règle en spécifiant son numéro ou la règle à supprimer | | ||
| + | | - -replace | -R | Permet de remplacer la règle spécifée par son numéro | | ||
| + | | - -insert | -I | Permet d' | ||
| + | | - -list | -L | Permet d' | ||
| + | | - -flush | -F | Permet de vider toutes les règles d'une chaîne | | ||
| + | |||
| + | Les options sont: | ||
| + | |||
| + | ^ Option | ||
| + | | - -protocol | -p | Permet de spécifier un protocol - tcp, udp, icmp, all | | ||
| + | | - -source | -s | Permet de spécifier une adresse source | | ||
| + | | - -destination | -d | Permet de spécifier une adresse de destination | | ||
| + | | - -in-interface | -i | Permet de spécifier une interface réseau d' | ||
| + | | - -out-interface | -o | Permet de spécifier une interface réseau de sortie | | ||
| + | | - -fragment | -f | Permet de ne spécifier que les paquets fragmentés | | ||
| + | | - -source-port | -sport | ||
| + | | - -destination-port | -dport | ||
| + | | - -tcp-flags | s/o | Permet de spécifier un flag TCP à matcher - SYN, ACK, FIN, RST, URG, PSH, ALL, NONE | | ||
| + | | - -icmp-type | s/o | Permet de spécifier un type de paquet ICMP | | ||
| + | | - -mac-source | s/o | Permet de spécifier une adresse MAC | | ||
| + | |||
| + | Les options spécifiques à NET sont: | ||
| + | |||
| + | | - -to-destination | s/o | Permet de spécifier l' | ||
| + | | - -to-source | s/o | Permet spécifier l' | ||
| + | |||
| + | Les options spécifiques aux LOGS sont: | ||
| + | |||
| + | | - -log-level | s/o | Permet de spécifier le niveau de logs | | ||
| + | | - -log-prefix | s/o | Permet de spécifier un préfix pour les logs | | ||
| + | |||
| + | L' | ||
| + | |||
| + | | - -state | s/o | Permet de spécifier l' | ||
| + | |||
| + | Ce dernier cas fait référence au STATEFUL. Le STATEFUL est la capacité du par-feu à enregistrer dans une table spécifique, | ||
| + | |||
| + | Il existe 4 états: | ||
| + | |||
| + | * NEW | ||
| + | * Le paquet concerne une nouvelle connexion et contient donc un flag SYN à 1 | ||
| + | * ESTABLISHED | ||
| + | * Le paquet concerne une connexion déjà établie. Le paquet ne doit contenir **ni** flag SYN à 1, **ni** flag FIN à 1 | ||
| + | * RELATED | ||
| + | * Le paquet est d'une connexion qui présente une relation avec une autre connexion | ||
| + | * INVALID | ||
| + | * La paquet provient d'une connexion anormale. | ||
| - | =====Présentation===== | + | ====LAB #1 - La Configuration par firewalld |
| - | RHEL/CentOS 8 utilise **Network Manager** pour gérer le réseau. Network Manager est composé | + | Firewalld |
| - | * un service qui gère les connexions réseaux et rapporte leurs états, | + | * **trusted** - un réseau fiable. Dans ce cas tous les ports sont autorisés, |
| - | * des front-ends qui passent par un API de configuration du service. | + | * **work**, **home**, **internal** |
| + | * **dmz**, **public**, **external** - un réseau non fiable. Dans ce cas peu de ports sont autorisés, | ||
| + | * **block**, **drop** - tout est interdit. La zone drop n' | ||
| - | <WRAP center round important | + | <WRAP center round important |
| - | **Important** | + | **Important** |
| </ | </ | ||
| - | Le service | + | Le service |
| < | < | ||
| - | [root@centos8 ~]# systemctl status | + | [root@centos8 ~]# systemctl status |
| - | ● NetworkManager.service - Network Manager | + | ● firewalld.service - firewalld - dynamic firewall daemon |
| - | | + | |
| - | | + | |
| - | Docs: man:NetworkManager(8) | + | Docs: man:firewalld(1) |
| - | Main PID: 1002 (NetworkManager) | + | Main PID: 1079 (firewalld) |
| - | Tasks: | + | Tasks: |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Warning: Journal has been rotated since unit was started. Log output is incomplete or> | + | Oct 01 12:13:53 centos8.ittraining.loc systemd[1]: Starting firewalld - dynamic firewall daemon... |
| - | lines 1-11/11 (END) | + | Oct 01 12:13:55 centos8.ittraining.loc systemd[1]: Started firewalld |
| - | [^q] | + | Oct 01 12:13:56 centos8.ittraining.loc firewalld[1079]: |
| + | [q] | ||
| </ | </ | ||
| - | ===La Commande nmcli=== | + | ===La Configuration de Base de firewalld=== |
| - | La commande | + | La configuration par défaut de firewalld se trouve dans **/ |
| - | Les options et les sous-commandes peuvent être consultées en utilisant les commandes suivantes | + | < |
| + | [root@centos8 ~]# ls -l / | ||
| + | total 16 | ||
| + | drwxr-xr-x. 2 root root 224 Mar 6 2022 helpers | ||
| + | drwxr-xr-x. 2 root root 4096 Mar 6 2022 icmptypes | ||
| + | drwxr-xr-x. 2 root root 20 Mar 6 2022 ipsets | ||
| + | drwxr-xr-x. 2 root root 33 Mar 6 2022 policies | ||
| + | drwxr-xr-x. 2 root root 8192 Mar 6 2022 services | ||
| + | drwxr-xr-x. 2 root root 203 Mar 6 2022 zones | ||
| + | |||
| + | [root@centos8 ~]# ls -l / | ||
| + | total 44 | ||
| + | -rw-r--r--. 1 root root 299 Aug 9 2021 block.xml | ||
| + | -rw-r--r--. 1 root root 293 Aug 9 2021 dmz.xml | ||
| + | -rw-r--r--. 1 root root 291 Aug 9 2021 drop.xml | ||
| + | -rw-r--r--. 1 root root 304 Aug 9 2021 external.xml | ||
| + | -rw-r--r--. 1 root root 397 Aug 9 2021 home.xml | ||
| + | -rw-r--r--. 1 root root 412 Aug 9 2021 internal.xml | ||
| + | -rw-r--r--. 1 root root 809 Nov 26 2019 libvirt.xml | ||
| + | -rw-r--r--. 1 root root 729 Aug 18 2021 nm-shared.xml | ||
| + | -rw-r--r--. 1 root root 343 Aug 9 2021 public.xml | ||
| + | -rw-r--r--. 1 root root 162 Aug 9 2021 trusted.xml | ||
| + | -rw-r--r--. 1 root root 339 Aug 9 2021 work.xml | ||
| + | |||
| + | [root@centos8 ~]# ls -l / | ||
| + | total 704 | ||
| + | -rw-r--r--. 1 root root 399 Aug 9 2021 amanda-client.xml | ||
| + | -rw-r--r--. 1 root root 427 Aug 9 2021 amanda-k5-client.xml | ||
| + | -rw-r--r--. 1 root root 283 Aug 9 2021 amqps.xml | ||
| + | -rw-r--r--. 1 root root 273 Aug 9 2021 amqp.xml | ||
| + | -rw-r--r--. 1 root root 285 Aug 9 2021 apcupsd.xml | ||
| + | -rw-r--r--. 1 root root 301 Aug 9 2021 audit.xml | ||
| + | -rw-r--r--. 1 root root 320 Aug 9 2021 bacula-client.xml | ||
| + | -rw-r--r--. 1 root root 346 Aug 9 2021 bacula.xml | ||
| + | -rw-r--r--. 1 root root 429 Aug 9 2021 bb.xml | ||
| + | -rw-r--r--. 1 root root 339 Aug 9 2021 bgp.xml | ||
| + | -rw-r--r--. 1 root root 275 Aug 9 2021 bitcoin-rpc.xml | ||
| + | -rw-r--r--. 1 root root 307 Aug 9 2021 bitcoin-testnet-rpc.xml | ||
| + | -rw-r--r--. 1 root root 281 Aug 9 2021 bitcoin-testnet.xml | ||
| + | -rw-r--r--. 1 root root 244 Aug 9 2021 bitcoin.xml | ||
| + | -rw-r--r--. 1 root root 410 Aug 9 2021 bittorrent-lsd.xml | ||
| + | -rw-r--r--. 1 root root 294 Aug 9 2021 ceph-mon.xml | ||
| + | -rw-r--r--. 1 root root 329 Aug 9 2021 ceph.xml | ||
| + | -rw-r--r--. 1 root root 168 Aug 9 2021 cfengine.xml | ||
| + | -rw-r--r--. 1 root root 211 Aug 9 2021 cockpit.xml | ||
| + | -rw-r--r--. 1 root root 296 Aug 9 2021 collectd.xml | ||
| + | -rw-r--r--. 1 root root 260 Aug 9 2021 condor-collector.xml | ||
| + | -rw-r--r--. 1 root root 296 Aug 9 2021 ctdb.xml | ||
| + | -rw-r--r--. 1 root root 305 Aug 9 2021 dhcpv6-client.xml | ||
| + | -rw-r--r--. 1 root root 234 Aug 9 2021 dhcpv6.xml | ||
| + | -rw-r--r--. 1 root root 227 Aug 9 2021 dhcp.xml | ||
| + | -rw-r--r--. 1 root root 205 Aug 9 2021 distcc.xml | ||
| + | -rw-r--r--. 1 root root 318 Aug 9 2021 dns-over-tls.xml | ||
| + | -rw-r--r--. 1 root root 346 Aug 9 2021 dns.xml | ||
| + | -rw-r--r--. 1 root root 374 Aug 9 2021 docker-registry.xml | ||
| + | -rw-r--r--. 1 root root 391 Aug 9 2021 docker-swarm.xml | ||
| + | -rw-r--r--. 1 root root 228 Aug 9 2021 dropbox-lansync.xml | ||
| + | -rw-r--r--. 1 root root 338 Aug 9 2021 elasticsearch.xml | ||
| + | -rw-r--r--. 1 root root 304 Aug 9 2021 etcd-client.xml | ||
| + | -rw-r--r--. 1 root root 304 Aug 9 2021 etcd-server.xml | ||
| + | -rw-r--r--. 1 root root 224 Aug 9 2021 finger.xml | ||
| + | -rw-r--r--. 1 root root 270 Aug 9 2021 foreman-proxy.xml | ||
| + | -rw-r--r--. 1 root root 408 Aug 9 2021 foreman.xml | ||
| + | -rw-r--r--. 1 root root 709 Aug 9 2021 freeipa-4.xml | ||
| + | -rw-r--r--. 1 root root 489 Aug 9 2021 freeipa-ldaps.xml | ||
| + | -rw-r--r--. 1 root root 488 Aug 9 2021 freeipa-ldap.xml | ||
| + | -rw-r--r--. 1 root root 242 Aug 9 2021 freeipa-replication.xml | ||
| + | -rw-r--r--. 1 root root 657 Aug 9 2021 freeipa-trust.xml | ||
| + | -rw-r--r--. 1 root root 361 Aug 9 2021 ftp.xml | ||
| + | -rw-r--r--. 1 root root 292 Aug 9 2021 galera.xml | ||
| + | -rw-r--r--. 1 root root 184 Aug 9 2021 ganglia-client.xml | ||
| + | -rw-r--r--. 1 root root 176 Aug 9 2021 ganglia-master.xml | ||
| + | -rw-r--r--. 1 root root 212 Aug 9 2021 git.xml | ||
| + | -rw-r--r--. 1 root root 218 Aug 9 2021 grafana.xml | ||
| + | -rw-r--r--. 1 root root 119 Aug 9 2021 gre.xml | ||
| + | -rw-r--r--. 1 root root 608 Aug 9 2021 high-availability.xml | ||
| + | -rw-r--r--. 1 root root 448 Aug 9 2021 https.xml | ||
| + | -rw-r--r--. 1 root root 353 Aug 9 2021 http.xml | ||
| + | -rw-r--r--. 1 root root 372 Aug 9 2021 imaps.xml | ||
| + | -rw-r--r--. 1 root root 327 Aug 9 2021 imap.xml | ||
| + | -rw-r--r--. 1 root root 454 Aug 9 2021 ipp-client.xml | ||
| + | -rw-r--r--. 1 root root 427 Aug 9 2021 ipp.xml | ||
| + | -rw-r--r--. 1 root root 894 Aug 9 2021 ipsec.xml | ||
| + | -rw-r--r--. 1 root root 255 Aug 9 2021 ircs.xml | ||
| + | -rw-r--r--. 1 root root 247 Aug 9 2021 irc.xml | ||
| + | -rw-r--r--. 1 root root 264 Aug 9 2021 iscsi-target.xml | ||
| + | -rw-r--r--. 1 root root 358 Aug 9 2021 isns.xml | ||
| + | -rw-r--r--. 1 root root 213 Aug 9 2021 jenkins.xml | ||
| + | -rw-r--r--. 1 root root 182 Aug 9 2021 kadmin.xml | ||
| + | -rw-r--r--. 1 root root 272 Aug 9 2021 kdeconnect.xml | ||
| + | -rw-r--r--. 1 root root 233 Aug 9 2021 kerberos.xml | ||
| + | -rw-r--r--. 1 root root 384 Aug 9 2021 kibana.xml | ||
| + | -rw-r--r--. 1 root root 249 Aug 9 2021 klogin.xml | ||
| + | -rw-r--r--. 1 root root 221 Aug 9 2021 kpasswd.xml | ||
| + | -rw-r--r--. 1 root root 182 Aug 9 2021 kprop.xml | ||
| + | -rw-r--r--. 1 root root 242 Aug 9 2021 kshell.xml | ||
| + | -rw-r--r--. 1 root root 308 Aug 9 2021 kube-apiserver.xml | ||
| + | -rw-r--r--. 1 root root 232 Aug 9 2021 ldaps.xml | ||
| + | -rw-r--r--. 1 root root 199 Aug 9 2021 ldap.xml | ||
| + | -rw-r--r--. 1 root root 385 Aug 9 2021 libvirt-tls.xml | ||
| + | -rw-r--r--. 1 root root 389 Aug 9 2021 libvirt.xml | ||
| + | -rw-r--r--. 1 root root 269 Aug 9 2021 lightning-network.xml | ||
| + | -rw-r--r--. 1 root root 324 Aug 9 2021 llmnr.xml | ||
| + | -rw-r--r--. 1 root root 349 Aug 9 2021 managesieve.xml | ||
| + | -rw-r--r--. 1 root root 432 Aug 9 2021 matrix.xml | ||
| + | -rw-r--r--. 1 root root 424 Aug 9 2021 mdns.xml | ||
| + | -rw-r--r--. 1 root root 245 Aug 9 2021 memcache.xml | ||
| + | -rw-r--r--. 1 root root 343 Aug 9 2021 minidlna.xml | ||
| + | -rw-r--r--. 1 root root 237 Aug 9 2021 mongodb.xml | ||
| + | -rw-r--r--. 1 root root 473 Aug 9 2021 mosh.xml | ||
| + | -rw-r--r--. 1 root root 211 Aug 9 2021 mountd.xml | ||
| + | -rw-r--r--. 1 root root 296 Aug 9 2021 mqtt-tls.xml | ||
| + | -rw-r--r--. 1 root root 287 Aug 9 2021 mqtt.xml | ||
| + | -rw-r--r--. 1 root root 170 Aug 9 2021 mssql.xml | ||
| + | -rw-r--r--. 1 root root 190 Aug 9 2021 ms-wbt.xml | ||
| + | -rw-r--r--. 1 root root 242 Aug 9 2021 murmur.xml | ||
| + | -rw-r--r--. 1 root root 171 Aug 9 2021 mysql.xml | ||
| + | -rw-r--r--. 1 root root 250 Aug 9 2021 nbd.xml | ||
| + | -rw-r--r--. 1 root root 342 Aug 9 2021 nfs3.xml | ||
| + | -rw-r--r--. 1 root root 324 Aug 9 2021 nfs.xml | ||
| + | -rw-r--r--. 1 root root 293 Aug 9 2021 nmea-0183.xml | ||
| + | -rw-r--r--. 1 root root 247 Aug 9 2021 nrpe.xml | ||
| + | -rw-r--r--. 1 root root 389 Aug 9 2021 ntp.xml | ||
| + | -rw-r--r--. 1 root root 368 Aug 9 2021 nut.xml | ||
| + | -rw-r--r--. 1 root root 335 Aug 9 2021 openvpn.xml | ||
| + | -rw-r--r--. 1 root root 260 Aug 9 2021 ovirt-imageio.xml | ||
| + | -rw-r--r--. 1 root root 343 Aug 9 2021 ovirt-storageconsole.xml | ||
| + | -rw-r--r--. 1 root root 235 Aug 9 2021 ovirt-vmconsole.xml | ||
| + | -rw-r--r--. 1 root root 1024 Aug 9 2021 plex.xml | ||
| + | -rw-r--r--. 1 root root 433 Aug 9 2021 pmcd.xml | ||
| + | -rw-r--r--. 1 root root 474 Aug 9 2021 pmproxy.xml | ||
| + | -rw-r--r--. 1 root root 544 Aug 9 2021 pmwebapis.xml | ||
| + | -rw-r--r--. 1 root root 460 Aug 9 2021 pmwebapi.xml | ||
| + | -rw-r--r--. 1 root root 357 Aug 9 2021 pop3s.xml | ||
| + | -rw-r--r--. 1 root root 348 Aug 9 2021 pop3.xml | ||
| + | -rw-r--r--. 1 root root 181 Aug 9 2021 postgresql.xml | ||
| + | -rw-r--r--. 1 root root 509 Aug 9 2021 privoxy.xml | ||
| + | -rw-r--r--. 1 root root 213 Aug 9 2021 prometheus.xml | ||
| + | -rw-r--r--. 1 root root 261 Aug 9 2021 proxy-dhcp.xml | ||
| + | -rw-r--r--. 1 root root 424 Aug 9 2021 ptp.xml | ||
| + | -rw-r--r--. 1 root root 414 Aug 9 2021 pulseaudio.xml | ||
| + | -rw-r--r--. 1 root root 297 Aug 9 2021 puppetmaster.xml | ||
| + | -rw-r--r--. 1 root root 273 Aug 9 2021 quassel.xml | ||
| + | -rw-r--r--. 1 root root 520 Aug 9 2021 radius.xml | ||
| + | -rw-r--r--. 1 root root 183 Aug 9 2021 rdp.xml | ||
| + | -rw-r--r--. 1 root root 212 Aug 9 2021 redis-sentinel.xml | ||
| + | -rw-r--r--. 1 root root 268 Aug 9 2021 redis.xml | ||
| + | -rw-r--r--. 1 root root 381 Aug 9 2021 RH-Satellite-6-capsule.xml | ||
| + | -rw-r--r--. 1 root root 556 Aug 9 2021 RH-Satellite-6.xml | ||
| + | -rw-r--r--. 1 root root 214 Aug 9 2021 rpc-bind.xml | ||
| + | -rw-r--r--. 1 root root 213 Aug 9 2021 rquotad.xml | ||
| + | -rw-r--r--. 1 root root 310 Aug 9 2021 rsh.xml | ||
| + | -rw-r--r--. 1 root root 311 Aug 9 2021 rsyncd.xml | ||
| + | -rw-r--r--. 1 root root 350 Aug 9 2021 rtsp.xml | ||
| + | -rw-r--r--. 1 root root 329 Aug 9 2021 salt-master.xml | ||
| + | -rw-r--r--. 1 root root 371 Aug 9 2021 samba-client.xml | ||
| + | -rw-r--r--. 1 root root 1298 Aug 9 2021 samba-dc.xml | ||
| + | -rw-r--r--. 1 root root 448 Aug 9 2021 samba.xml | ||
| + | -rw-r--r--. 1 root root 324 Aug 9 2021 sane.xml | ||
| + | -rw-r--r--. 1 root root 283 Aug 9 2021 sips.xml | ||
| + | -rw-r--r--. 1 root root 496 Aug 9 2021 sip.xml | ||
| + | -rw-r--r--. 1 root root 299 Aug 9 2021 slp.xml | ||
| + | -rw-r--r--. 1 root root 231 Aug 9 2021 smtp-submission.xml | ||
| + | -rw-r--r--. 1 root root 577 Aug 9 2021 smtps.xml | ||
| + | -rw-r--r--. 1 root root 550 Aug 9 2021 smtp.xml | ||
| + | -rw-r--r--. 1 root root 308 Aug 9 2021 snmptrap.xml | ||
| + | -rw-r--r--. 1 root root 342 Aug 9 2021 snmp.xml | ||
| + | -rw-r--r--. 1 root root 405 Aug 9 2021 spideroak-lansync.xml | ||
| + | -rw-r--r--. 1 root root 275 Aug 9 2021 spotify-sync.xml | ||
| + | -rw-r--r--. 1 root root 173 Aug 9 2021 squid.xml | ||
| + | -rw-r--r--. 1 root root 421 Aug 9 2021 ssdp.xml | ||
| + | -rw-r--r--. 1 root root 463 Aug 9 2021 ssh.xml | ||
| + | -rw-r--r--. 1 root root 631 Aug 9 2021 steam-streaming.xml | ||
| + | -rw-r--r--. 1 root root 287 Aug 9 2021 svdrp.xml | ||
| + | -rw-r--r--. 1 root root 231 Aug 9 2021 svn.xml | ||
| + | -rw-r--r--. 1 root root 297 Aug 9 2021 syncthing-gui.xml | ||
| + | -rw-r--r--. 1 root root 311 Aug 9 2021 syncthing.xml | ||
| + | -rw-r--r--. 1 root root 496 Aug 9 2021 synergy.xml | ||
| + | -rw-r--r--. 1 root root 444 Aug 9 2021 syslog-tls.xml | ||
| + | -rw-r--r--. 1 root root 329 Aug 9 2021 syslog.xml | ||
| + | -rw-r--r--. 1 root root 393 Aug 9 2021 telnet.xml | ||
| + | -rw-r--r--. 1 root root 252 Aug 9 2021 tentacle.xml | ||
| + | -rw-r--r--. 1 root root 288 Aug 9 2021 tftp-client.xml | ||
| + | -rw-r--r--. 1 root root 424 Aug 9 2021 tftp.xml | ||
| + | -rw-r--r--. 1 root root 221 Aug 9 2021 tile38.xml | ||
| + | -rw-r--r--. 1 root root 336 Aug 9 2021 tinc.xml | ||
| + | -rw-r--r--. 1 root root 771 Aug 9 2021 tor-socks.xml | ||
| + | -rw-r--r--. 1 root root 244 Aug 9 2021 transmission-client.xml | ||
| + | -rw-r--r--. 1 root root 264 Aug 9 2021 upnp-client.xml | ||
| + | -rw-r--r--. 1 root root 593 Aug 9 2021 vdsm.xml | ||
| + | -rw-r--r--. 1 root root 475 Aug 9 2021 vnc-server.xml | ||
| + | -rw-r--r--. 1 root root 310 Aug 9 2021 wbem-https.xml | ||
| + | -rw-r--r--. 1 root root 352 Aug 9 2021 wbem-http.xml | ||
| + | -rw-r--r--. 1 root root 323 Aug 9 2021 wsmans.xml | ||
| + | -rw-r--r--. 1 root root 316 Aug 9 2021 wsman.xml | ||
| + | -rw-r--r--. 1 root root 329 Aug 9 2021 xdmcp.xml | ||
| + | -rw-r--r--. 1 root root 509 Aug 9 2021 xmpp-bosh.xml | ||
| + | -rw-r--r--. 1 root root 488 Aug 9 2021 xmpp-client.xml | ||
| + | -rw-r--r--. 1 root root 264 Aug 9 2021 xmpp-local.xml | ||
| + | -rw-r--r--. 1 root root 545 Aug 9 2021 xmpp-server.xml | ||
| + | -rw-r--r--. 1 root root 314 Aug 9 2021 zabbix-agent.xml | ||
| + | -rw-r--r--. 1 root root 315 Aug 9 2021 zabbix-server.xml | ||
| + | |||
| + | [root@centos8 ~]# ls -l / | ||
| + | total 180 | ||
| + | -rw-r--r--. 1 root root 385 Aug 9 2021 address-unreachable.xml | ||
| + | -rw-r--r--. 1 root root 258 Aug 9 2021 bad-header.xml | ||
| + | -rw-r--r--. 1 root root 294 Aug 9 2021 beyond-scope.xml | ||
| + | -rw-r--r--. 1 root root 279 Aug 9 2021 communication-prohibited.xml | ||
| + | -rw-r--r--. 1 root root 222 Aug 9 2021 destination-unreachable.xml | ||
| + | -rw-r--r--. 1 root root 173 Aug 9 2021 echo-reply.xml | ||
| + | -rw-r--r--. 1 root root 210 Aug 9 2021 echo-request.xml | ||
| + | -rw-r--r--. 1 root root 261 Aug 9 2021 failed-policy.xml | ||
| + | -rw-r--r--. 1 root root 280 Aug 9 2021 fragmentation-needed.xml | ||
| + | -rw-r--r--. 1 root root 266 Aug 9 2021 host-precedence-violation.xml | ||
| + | -rw-r--r--. 1 root root 257 Aug 9 2021 host-prohibited.xml | ||
| + | -rw-r--r--. 1 root root 242 Aug 9 2021 host-redirect.xml | ||
| + | -rw-r--r--. 1 root root 239 Aug 9 2021 host-unknown.xml | ||
| + | -rw-r--r--. 1 root root 247 Aug 9 2021 host-unreachable.xml | ||
| + | -rw-r--r--. 1 root root 229 Aug 9 2021 ip-header-bad.xml | ||
| + | -rw-r--r--. 1 root root 355 Aug 9 2021 neighbour-advertisement.xml | ||
| + | -rw-r--r--. 1 root root 457 Aug 9 2021 neighbour-solicitation.xml | ||
| + | -rw-r--r--. 1 root root 250 Aug 9 2021 network-prohibited.xml | ||
| + | -rw-r--r--. 1 root root 248 Aug 9 2021 network-redirect.xml | ||
| + | -rw-r--r--. 1 root root 239 Aug 9 2021 network-unknown.xml | ||
| + | -rw-r--r--. 1 root root 247 Aug 9 2021 network-unreachable.xml | ||
| + | -rw-r--r--. 1 root root 239 Aug 9 2021 no-route.xml | ||
| + | -rw-r--r--. 1 root root 328 Aug 9 2021 packet-too-big.xml | ||
| + | -rw-r--r--. 1 root root 225 Aug 9 2021 parameter-problem.xml | ||
| + | -rw-r--r--. 1 root root 233 Aug 9 2021 port-unreachable.xml | ||
| + | -rw-r--r--. 1 root root 256 Aug 9 2021 precedence-cutoff.xml | ||
| + | -rw-r--r--. 1 root root 249 Aug 9 2021 protocol-unreachable.xml | ||
| + | -rw-r--r--. 1 root root 185 Aug 9 2021 redirect.xml | ||
| + | -rw-r--r--. 1 root root 244 Aug 9 2021 reject-route.xml | ||
| + | -rw-r--r--. 1 root root 241 Aug 9 2021 required-option-missing.xml | ||
| + | -rw-r--r--. 1 root root 227 Aug 9 2021 router-advertisement.xml | ||
| + | -rw-r--r--. 1 root root 223 Aug 9 2021 router-solicitation.xml | ||
| + | -rw-r--r--. 1 root root 248 Aug 9 2021 source-quench.xml | ||
| + | -rw-r--r--. 1 root root 236 Aug 9 2021 source-route-failed.xml | ||
| + | -rw-r--r--. 1 root root 253 Aug 9 2021 time-exceeded.xml | ||
| + | -rw-r--r--. 1 root root 233 Aug 9 2021 timestamp-reply.xml | ||
| + | -rw-r--r--. 1 root root 228 Aug 9 2021 timestamp-request.xml | ||
| + | -rw-r--r--. 1 root root 258 Aug 9 2021 tos-host-redirect.xml | ||
| + | -rw-r--r--. 1 root root 257 Aug 9 2021 tos-host-unreachable.xml | ||
| + | -rw-r--r--. 1 root root 272 Aug 9 2021 tos-network-redirect.xml | ||
| + | -rw-r--r--. 1 root root 269 Aug 9 2021 tos-network-unreachable.xml | ||
| + | -rw-r--r--. 1 root root 293 Aug 9 2021 ttl-zero-during-reassembly.xml | ||
| + | -rw-r--r--. 1 root root 256 Aug 9 2021 ttl-zero-during-transit.xml | ||
| + | -rw-r--r--. 1 root root 259 Aug 9 2021 unknown-header-type.xml | ||
| + | -rw-r--r--. 1 root root 249 Aug 9 2021 unknown-option.xml | ||
| + | </ | ||
| + | |||
| + | Ces fichiers sont au format **xml**, par exemple | ||
| < | < | ||
| - | [root@centos8 ~]# nmcli help | + | [root@centos8 ~]# cat / |
| - | Usage: nmcli [OPTIONS] OBJECT { COMMAND | help } | + | <?xml version=" |
| + | < | ||
| + | < | ||
| + | < | ||
| + | <service name=" | ||
| + | <service name=" | ||
| + | <service name=" | ||
| + | <service name=" | ||
| + | <service name=" | ||
| + | </ | ||
| + | </ | ||
| - | OPTIONS | + | La configuration de firewalld ainsi que les définitions et règles personnalisées se trouvent dans **/ |
| - | -a, --ask ask for missing parameters | + | |
| - | -c, --colors auto|yes|no | + | |
| - | -e, --escape yes|no | + | |
| - | -f, --fields < | + | |
| - | -g, --get-values < | + | |
| - | -h, --help | + | |
| - | -m, --mode tabular|multiline | + | |
| - | -o, --overview | + | |
| - | -p, --pretty | + | |
| - | -s, --show-secrets | + | |
| - | -t, --terse | + | |
| - | -v, --version | + | |
| - | -w, --wait < | + | |
| - | OBJECT | + | < |
| - | g[eneral] NetworkManager' | + | [root@centos8 ~]# ls -l / |
| - | | + | total 8 |
| - | r[adio] | + | -rw-r--r--. 1 root root 2840 Aug 9 2021 firewalld.conf |
| - | | + | drwxr-x---. 2 root root 6 Aug 9 2021 helpers |
| - | | + | drwxr-x---. 2 root root 6 Aug 9 2021 icmptypes |
| - | | + | drwxr-x---. 2 root root 6 Aug 9 2021 ipsets |
| - | m[onitor] monitor NetworkManager changes | + | -rw-r--r--. 1 root root 283 Aug 9 2021 lockdown-whitelist.xml |
| + | drwxr-x---. 2 root root 6 Aug 9 2021 policies | ||
| + | drwxr-x---. 2 root root 6 Aug 9 2021 services | ||
| + | drwxr-x---. 2 root root 46 Aug 9 2021 zones | ||
| + | |||
| + | [root@centos8 ~]# ls -l / | ||
| + | total 8 | ||
| + | -rw-r--r--. 1 root root 380 Jun 16 2021 public.xml | ||
| + | -rw-r--r--. 1 root root 343 Jun 16 2021 public.xml.old | ||
| + | |||
| + | [root@centos8 ~]# ls -l / | ||
| + | total 0 | ||
| + | |||
| + | [root@centos8 ~]# ls -l / | ||
| + | total 0 | ||
| </ | </ | ||
| - | =====LAB #1 - Configuration du Réseau===== | + | Le fichier de configuration de firewalld est **/ |
| - | ====1.1 - Connections et Profils==== | + | < |
| + | [root@centos8 ~]# cat / | ||
| + | # firewalld config file | ||
| - | NetworkManager inclus la notion | + | # default zone |
| + | # The default zone used if an empty zone string is used. | ||
| + | # Default: public | ||
| + | DefaultZone=public | ||
| + | |||
| + | # Clean up on exit | ||
| + | # If set to no or false the firewall configuration will not get cleaned up | ||
| + | # on exit or stop of firewalld | ||
| + | # Default: yes | ||
| + | CleanupOnExit=yes | ||
| + | |||
| + | # Lockdown | ||
| + | # If set to enabled, firewall changes with the D-Bus interface will be limited | ||
| + | # to applications that are listed in the lockdown whitelist. | ||
| + | # The lockdown whitelist file is lockdown-whitelist.xml | ||
| + | # Default: no | ||
| + | Lockdown=no | ||
| + | |||
| + | # IPv6_rpfilter | ||
| + | # Performs a reverse path filter test on a packet for IPv6. If a reply to the | ||
| + | # packet would be sent via the same interface that the packet arrived on, the | ||
| + | # packet will match and be accepted, otherwise dropped. | ||
| + | # The rp_filter for IPv4 is controlled using sysctl. | ||
| + | # Note: This feature has a performance impact. See man page FIREWALLD.CONF(5) | ||
| + | # for details. | ||
| + | # Default: yes | ||
| + | IPv6_rpfilter=yes | ||
| + | |||
| + | # IndividualCalls | ||
| + | # Do not use combined -restore calls, but individual calls. This increases the | ||
| + | # time that is needed to apply changes and to start the daemon, but is good for | ||
| + | # debugging. | ||
| + | # Default: no | ||
| + | IndividualCalls=no | ||
| + | |||
| + | # LogDenied | ||
| + | # Add logging rules right before reject and drop rules in the INPUT, FORWARD | ||
| + | # and OUTPUT chains for the default rules and also final reject and drop rules | ||
| + | # in zones. Possible values are: all, unicast, broadcast, multicast and off. | ||
| + | # Default: off | ||
| + | LogDenied=off | ||
| + | |||
| + | # FirewallBackend | ||
| + | # Selects the firewall backend implementation. | ||
| + | # Choices are: | ||
| + | # - nftables (default) | ||
| + | # - iptables (iptables, ip6tables, ebtables and ipset) | ||
| + | FirewallBackend=nftables | ||
| + | |||
| + | # FlushAllOnReload | ||
| + | # Flush all runtime rules on a reload. In previous releases some runtime | ||
| + | # configuration was retained during a reload, namely; interface to zone | ||
| + | # assignment, and direct rules. This was confusing to users. To get the old | ||
| + | # behavior set this to " | ||
| + | # Default: yes | ||
| + | FlushAllOnReload=yes | ||
| + | |||
| + | # RFC3964_IPv4 | ||
| + | # As per RFC 3964, filter IPv6 traffic with 6to4 destination addresses that | ||
| + | # correspond to IPv4 addresses that should not be routed over the public | ||
| + | # internet. | ||
| + | # Defaults to " | ||
| + | RFC3964_IPv4=yes | ||
| + | |||
| + | # AllowZoneDrifting | ||
| + | # Older versions of firewalld had undocumented behavior known as " | ||
| + | # drifting" | ||
| + | # violation of zone based firewalls. However, some users rely on this behavior | ||
| + | # to have a " | ||
| + | # desire such behavior. It's disabled by default for security reasons. | ||
| + | # Note: If " | ||
| + | # based zones (including the default zone). Packets never drift from interface | ||
| + | # based zones to other interfaces based zones (including the default zone). | ||
| + | # Possible values; " | ||
| + | AllowZoneDrifting=yes | ||
| + | </ | ||
| + | |||
| + | ===La Commande firewall-cmd=== | ||
| + | |||
| + | firewalld s' | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - firewall-cmd est le front-end de firewalld en ligne de commande. Il existe aussi la commande | ||
| + | </ | ||
| + | |||
| + | Pour obtenir la liste de toutes | ||
| < | < | ||
| - | [root@centos8 ~]# nmcli c show | + | [root@centos8 ~]# firewall-cmd --get-zones |
| - | NAME UUID TYPE DEVICE | + | block dmz drop external home internal libvirt nm-shared public trusted work |
| - | ens18 | + | |
| - | virbr0 | + | |
| </ | </ | ||
| - | Créez donc un profil IP fixe rattaché au périphérique **ens18** | + | Pour obtenir la liste de toutes les services prédéfinis, |
| < | < | ||
| - | [root@centos8 ~]# nmcli connection add con-name ip_fixe ifname ens18 type ethernet ip4 10.0.2.46/ | + | [root@centos8 ~]# firewall-cmd --get-services |
| - | Connection ' | + | RH-Satellite-6 RH-Satellite-6-capsule amanda-client amanda-k5-client amqp amqps apcupsd audit bacula bacula-client bb bgp bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc bittorrent-lsd ceph ceph-mon cfengine cockpit collectd condor-collector ctdb dhcp dhcpv6 dhcpv6-client distcc dns dns-over-tls docker-registry docker-swarm dropbox-lansync elasticsearch etcd-client etcd-server finger foreman foreman-proxy freeipa-4 freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp galera ganglia-client ganglia-master git grafana gre high-availability http https imap imaps ipp ipp-client ipsec irc ircs iscsi-target isns jenkins kadmin kdeconnect kerberos kibana klogin kpasswd kprop kshell kube-apiserver ldap ldaps libvirt libvirt-tls lightning-network llmnr managesieve matrix mdns memcache minidlna mongodb mosh mountd mqtt mqtt-tls ms-wbt mssql murmur mysql nbd nfs nfs3 nmea-0183 nrpe ntp nut openvpn ovirt-imageio ovirt-storageconsole ovirt-vmconsole plex pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy prometheus proxy-dhcp ptp pulseaudio puppetmaster quassel radius rdp redis redis-sentinel rpc-bind rquotad rsh rsyncd rtsp salt-master samba samba-client samba-dc sane sip sips slp smtp smtp-submission smtps snmp snmptrap spideroak-lansync spotify-sync squid ssdp ssh steam-streaming svdrp svn syncthing syncthing-gui synergy syslog syslog-tls telnet tentacle tftp tftp-client tile38 tinc tor-socks transmission-client upnp-client vdsm vnc-server wbem-http wbem-https wsman wsmans xdmcp xmpp-bosh xmpp-client xmpp-local xmpp-server zabbix-agent zabbix-server |
| </ | </ | ||
| - | Constatez sa présence | + | Pour obtenir la liste de toutes les types ICMP prédéfinis, |
| < | < | ||
| - | [root@centos8 ~]# nmcli c show | + | [root@centos8 ~]# firewall-cmd --get-icmptypes |
| - | NAME | + | address-unreachable bad-header beyond-scope communication-prohibited destination-unreachable echo-reply echo-request failed-policy fragmentation-needed host-precedence-violation host-prohibited host-redirect host-unknown host-unreachable ip-header-bad neighbour-advertisement neighbour-solicitation network-prohibited network-redirect network-unknown network-unreachable no-route packet-too-big parameter-problem port-unreachable precedence-cutoff protocol-unreachable redirect reject-route required-option-missing router-advertisement router-solicitation source-quench source-route-failed time-exceeded timestamp-reply timestamp-request tos-host-redirect tos-host-unreachable tos-network-redirect tos-network-unreachable ttl-zero-during-reassembly ttl-zero-during-transit unknown-header-type unknown-option |
| - | ens18 fc4a4d23-b15e-47a7-bcfa-b2e08f49553e | + | |
| - | virbr0 | + | |
| - | ip_fixe | + | |
| </ | </ | ||
| - | Notez que la sortie n' | + | Pour obtenir |
| < | < | ||
| - | [root@centos8 ~]# nmcli d show | + | [root@centos8 ~]# firewall-cmd --get-active-zones |
| - | GENERAL.DEVICE: | + | libvirt |
| - | GENERAL.TYPE: ethernet | + | |
| - | GENERAL.HWADDR: | + | public |
| - | GENERAL.MTU: | + | |
| - | GENERAL.STATE: | + | </code> |
| - | GENERAL.CONNECTION: | + | |
| - | GENERAL.CON-PATH: | + | |
| - | WIRED-PROPERTIES.CARRIER: | + | |
| - | IP4.ADDRESS[1]: | + | |
| - | IP4.GATEWAY: | + | |
| - | IP4.ROUTE[1]: | + | |
| - | IP4.ROUTE[2]: | + | |
| - | IP4.DNS[1]: | + | |
| - | IP6.ADDRESS[1]: | + | |
| - | IP6.GATEWAY: | + | |
| - | IP6.ROUTE[1]: | + | |
| - | IP6.ROUTE[2]: | + | |
| - | GENERAL.DEVICE: | + | Pour obtenir la liste des zones de la configuration courante pour une interface spécifique, utilisez la commande suivante |
| - | GENERAL.TYPE: | + | |
| - | GENERAL.HWADDR: | + | |
| - | GENERAL.MTU: | + | |
| - | GENERAL.STATE: | + | |
| - | GENERAL.CONNECTION: | + | |
| - | GENERAL.CON-PATH: | + | |
| - | IP4.ADDRESS[1]: | + | |
| - | IP4.GATEWAY: | + | |
| - | IP4.ROUTE[1]: | + | |
| - | IP6.GATEWAY: -- | + | |
| - | GENERAL.DEVICE: | + | < |
| - | GENERAL.TYPE: | + | [root@centos8 ~]# firewall-cmd --get-zone-of-interface=ens18 |
| - | GENERAL.HWADDR: | + | public |
| - | GENERAL.MTU: | + | </code> |
| - | GENERAL.STATE: | + | |
| - | GENERAL.CONNECTION: | + | |
| - | GENERAL.CON-PATH: -- | + | |
| - | IP4.ADDRESS[1]: | + | |
| - | IP4.GATEWAY: | + | |
| - | IP6.ADDRESS[1]: | + | |
| - | IP6.GATEWAY: | + | |
| - | IP6.ROUTE[1]: | + | |
| - | GENERAL.DEVICE: virbr0-nic | + | Pour obtenir la liste des services autorisés pour la zone public, utilisez la commande suivante |
| - | GENERAL.TYPE: | + | |
| - | GENERAL.HWADDR: | + | < |
| - | GENERAL.MTU: | + | [root@centos8 ~]# firewall-cmd --zone=public |
| - | GENERAL.STATE: | + | cockpit dhcpv6-client ssh |
| - | GENERAL.CONNECTION: | + | |
| - | GENERAL.CON-PATH: -- | + | |
| - | lines 28-50/50 (END) | + | |
| - | [q] | + | |
| </ | </ | ||
| - | Pour activer le profil ip_fixe, utilisez la commande suivante : | + | Pour obtenir toute la configuration pour la zone public, utilisez la commande suivante : |
| < | < | ||
| - | [root@centos8 ~]# nmcli connection up ip_fixe | + | [root@centos8 ~]# firewall-cmd --get-active-zones |
| + | libvirt | ||
| + | interfaces: virbr0 | ||
| + | public | ||
| + | interfaces: ens18 | ||
| + | [root@centos8 ~]# firewall-cmd --get-zone-of-interface=ens18 | ||
| + | public | ||
| + | [root@centos8 ~]# firewall-cmd --zone=public --list-services | ||
| + | cockpit dhcpv6-client ssh | ||
| + | [root@centos8 ~]# firewall-cmd --zone=public --list-all | ||
| + | public (active) | ||
| + | target: default | ||
| + | icmp-block-inversion: | ||
| + | interfaces: ens18 | ||
| + | sources: | ||
| + | services: cockpit dhcpv6-client ssh | ||
| + | ports: 5901/tcp | ||
| + | protocols: | ||
| + | forward: no | ||
| + | masquerade: no | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | icmp-blocks: | ||
| + | rich rules: | ||
| + | </ | ||
| + | |||
| + | Pour obtenir la liste complète de toutes les zones et leurs configurations, | ||
| + | |||
| + | < | ||
| + | root@centos8 ~]# firewall-cmd --zone=public --list-all | ||
| + | public (active) | ||
| + | target: default | ||
| + | icmp-block-inversion: | ||
| + | interfaces: ens18 | ||
| + | sources: | ||
| + | services: cockpit dhcpv6-client ssh | ||
| + | ports: 5901/tcp | ||
| + | protocols: | ||
| + | forward: no | ||
| + | masquerade: no | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | icmp-blocks: | ||
| + | rich rules: | ||
| + | [root@centos8 ~]# firewall-cmd --list-all-zones | ||
| + | block | ||
| + | target: %%REJECT%% | ||
| + | icmp-block-inversion: | ||
| + | interfaces: | ||
| + | sources: | ||
| + | services: | ||
| + | ports: | ||
| + | protocols: | ||
| + | forward: no | ||
| + | masquerade: no | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | icmp-blocks: | ||
| + | rich rules: | ||
| + | |||
| + | dmz | ||
| + | target: default | ||
| + | icmp-block-inversion: | ||
| + | interfaces: | ||
| + | sources: | ||
| + | services: ssh | ||
| + | ports: | ||
| + | protocols: | ||
| + | forward: no | ||
| + | masquerade: no | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | icmp-blocks: | ||
| + | rich rules: | ||
| + | |||
| + | drop | ||
| + | target: DROP | ||
| + | icmp-block-inversion: | ||
| + | interfaces: | ||
| + | sources: | ||
| + | services: | ||
| + | ports: | ||
| + | protocols: | ||
| + | forward: no | ||
| + | masquerade: no | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | icmp-blocks: | ||
| + | rich rules: | ||
| + | |||
| + | external | ||
| + | target: default | ||
| + | icmp-block-inversion: | ||
| + | interfaces: | ||
| + | sources: | ||
| + | services: ssh | ||
| + | ports: | ||
| + | protocols: | ||
| + | forward: no | ||
| + | masquerade: yes | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | icmp-blocks: | ||
| + | rich rules: | ||
| + | |||
| + | home | ||
| + | target: default | ||
| + | icmp-block-inversion: | ||
| + | interfaces: | ||
| + | sources: | ||
| + | services: cockpit dhcpv6-client mdns samba-client ssh | ||
| + | ports: | ||
| + | protocols: | ||
| + | forward: no | ||
| + | masquerade: no | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | icmp-blocks: | ||
| + | rich rules: | ||
| + | |||
| + | internal | ||
| + | target: default | ||
| + | icmp-block-inversion: | ||
| + | interfaces: | ||
| + | sources: | ||
| + | services: cockpit dhcpv6-client mdns samba-client ssh | ||
| + | ports: | ||
| + | protocols: | ||
| + | forward: no | ||
| + | masquerade: no | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | icmp-blocks: | ||
| + | rich rules: | ||
| + | |||
| + | libvirt (active) | ||
| + | target: ACCEPT | ||
| + | icmp-block-inversion: | ||
| + | interfaces: virbr0 | ||
| + | sources: | ||
| + | services: dhcp dhcpv6 dns ssh tftp | ||
| + | ports: | ||
| + | protocols: icmp ipv6-icmp | ||
| + | forward: no | ||
| + | masquerade: no | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | icmp-blocks: | ||
| + | rich rules: | ||
| + | rule priority=" | ||
| + | |||
| + | nm-shared | ||
| + | target: ACCEPT | ||
| + | icmp-block-inversion: | ||
| + | interfaces: | ||
| + | sources: | ||
| + | services: dhcp dns ssh | ||
| + | ports: | ||
| + | protocols: icmp ipv6-icmp | ||
| + | forward: no | ||
| + | masquerade: no | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | icmp-blocks: | ||
| + | rich rules: | ||
| + | rule priority=" | ||
| + | |||
| + | public (active) | ||
| + | target: default | ||
| + | icmp-block-inversion: | ||
| + | interfaces: ens18 | ||
| + | sources: | ||
| + | services: cockpit dhcpv6-client ssh | ||
| + | ports: 5901/tcp | ||
| + | protocols: | ||
| + | forward: no | ||
| + | masquerade: no | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | icmp-blocks: | ||
| + | rich rules: | ||
| + | |||
| + | trusted | ||
| + | target: ACCEPT | ||
| + | icmp-block-inversion: | ||
| + | interfaces: | ||
| + | sources: | ||
| + | services: | ||
| + | ports: | ||
| + | protocols: | ||
| + | forward: no | ||
| + | masquerade: no | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | icmp-blocks: | ||
| + | rich rules: | ||
| + | work | ||
| + | target: default | ||
| + | icmp-block-inversion: | ||
| + | interfaces: | ||
| + | sources: | ||
| + | services: cockpit dhcpv6-client ssh | ||
| + | ports: | ||
| + | protocols: | ||
| + | forward: no | ||
| + | masquerade: no | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | icmp-blocks: | ||
| + | rich rules: | ||
| </ | </ | ||
| - | Notez que votre terminal est bloqué à cause du changement | + | Pour changer la zone par défaut |
| - | <WRAP center round todo 60%> | + | <code> |
| - | **A faire** | + | [root@centos8 ~]# firewall-cmd --set-default-zone=work |
| - | </ | + | success |
| - | Le profil | + | [root@centos8 ~]# firewall-cmd --get-active-zones |
| + | libvirt | ||
| + | interfaces: virbr0 | ||
| + | work | ||
| + | interfaces: ens18 | ||
| + | </ | ||
| + | |||
| + | Pour ajouter l' | ||
| < | < | ||
| - | [root@centos8 ~]# nmcli c show | + | [root@centos8 ~]# firewall-cmd --zone=work |
| - | NAME | + | success |
| - | ip_fixe | + | |
| - | virbr0 | + | |
| - | ens18 fc4a4d23-b15e-47a7-bcfa-b2e08f49553e | + | |
| - | + | ||
| - | [root@centos8 ~]# nmcli d show | + | |
| - | GENERAL.DEVICE: | + | |
| - | GENERAL.TYPE: | + | |
| - | GENERAL.HWADDR: | + | |
| - | GENERAL.MTU: | + | |
| - | GENERAL.STATE: | + | |
| - | GENERAL.CONNECTION: | + | |
| - | GENERAL.CON-PATH: | + | |
| - | WIRED-PROPERTIES.CARRIER: | + | |
| - | IP4.ADDRESS[1]: | + | |
| - | IP4.GATEWAY: | + | |
| - | IP4.ROUTE[1]: | + | |
| - | IP4.ROUTE[2]: | + | |
| - | IP6.ADDRESS[1]: | + | |
| - | IP6.GATEWAY: | + | |
| - | IP6.ROUTE[1]: | + | |
| - | IP6.ROUTE[2]: | + | |
| - | GENERAL.DEVICE: | + | [root@centos8 ~]# firewall-cmd --get-active-zones |
| - | GENERAL.TYPE: | + | libvirt |
| - | GENERAL.HWADDR: 52: | + | |
| - | GENERAL.MTU: | + | work |
| - | GENERAL.STATE: 100 (connected (externally)) | + | |
| - | GENERAL.CONNECTION: | + | </code> |
| - | GENERAL.CON-PATH: | + | |
| - | IP4.ADDRESS[1]: | + | |
| - | IP4.GATEWAY: | + | |
| - | IP4.ROUTE[1]: | + | |
| - | IP6.GATEWAY: | + | |
| - | GENERAL.DEVICE: | + | Pour supprimer l' |
| - | GENERAL.TYPE: | + | |
| - | GENERAL.HWADDR: | + | |
| - | GENERAL.MTU: | + | |
| - | GENERAL.STATE: | + | |
| - | GENERAL.CONNECTION: | + | |
| - | GENERAL.CON-PATH: | + | |
| - | IP4.ADDRESS[1]: | + | |
| - | IP4.GATEWAY: | + | |
| - | IP6.ADDRESS[1]: | + | |
| - | IP6.GATEWAY: | + | |
| - | IP6.ROUTE[1]: | + | |
| - | GENERAL.DEVICE: | + | < |
| - | GENERAL.TYPE: | + | [root@centos8 ~]# firewall-cmd --zone=work --remove-interface=ip_fixe |
| - | GENERAL.HWADDR: | + | success |
| - | GENERAL.MTU: | + | |
| - | GENERAL.STATE: | + | [root@centos8 ~]# firewall-cmd --get-active-zones |
| - | GENERAL.CONNECTION: | + | libvirt |
| - | GENERAL.CON-PATH: -- | + | |
| - | lines 27-49/49 (END) | + | work |
| - | [q] | + | interfaces: ens18 |
| </ | </ | ||
| - | Pour consulter les paramètres du profil | + | Pour ajouter le service |
| < | < | ||
| - | [root@centos8 ~]# nmcli -p connection show ens18 | + | [root@centos8 ~]# firewall-cmd --zone=work |
| - | =============================================================================== | + | success |
| - | Connection profile details (ens18) | + | |
| - | =============================================================================== | + | [root@centos8 ~]# firewall-cmd --zone=work --list-services |
| - | connection.id: | + | cockpit dhcpv6-client |
| - | connection.uuid: | + | |
| - | connection.stable-id: | + | |
| - | connection.type: | + | |
| - | connection.interface-name: | + | |
| - | connection.autoconnect: | + | |
| - | connection.autoconnect-priority: | + | |
| - | connection.autoconnect-retries: | + | |
| - | connection.multi-connect: | + | |
| - | connection.auth-retries: | + | |
| - | connection.timestamp: | + | |
| - | connection.read-only: | + | |
| - | connection.permissions: | + | |
| - | connection.zone: | + | |
| - | connection.master: | + | |
| - | connection.slave-type: | + | |
| - | connection.autoconnect-slaves: | + | |
| - | connection.secondaries: | + | |
| - | connection.gateway-ping-timeout: | + | |
| - | connection.metered: | + | |
| - | connection.lldp: | + | |
| - | connection.mdns: | + | |
| - | connection.llmnr: | + | |
| - | connection.wait-device-timeout: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | 802-3-ethernet.port: | + | |
| - | 802-3-ethernet.speed: | + | |
| - | 802-3-ethernet.duplex: | + | |
| - | 802-3-ethernet.auto-negotiate: | + | |
| - | 802-3-ethernet.mac-address: | + | |
| - | 802-3-ethernet.cloned-mac-address: | + | |
| - | 802-3-ethernet.generate-mac-address-mask: | + | |
| - | 802-3-ethernet.mac-address-blacklist: | + | |
| - | 802-3-ethernet.mtu: | + | |
| - | 802-3-ethernet.s390-subchannels: | + | |
| - | 802-3-ethernet.s390-nettype: | + | |
| - | 802-3-ethernet.s390-options: | + | |
| - | 802-3-ethernet.wake-on-lan: | + | |
| - | 802-3-ethernet.wake-on-lan-password: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | ipv4.method: | + | |
| - | ipv4.dns: | + | |
| - | ipv4.dns-search: | + | |
| - | ipv4.dns-options: | + | |
| - | ipv4.dns-priority: | + | |
| - | ipv4.addresses: | + | |
| - | ipv4.gateway: | + | |
| - | ipv4.routes: | + | |
| - | ipv4.route-metric: | + | |
| - | ipv4.route-table: | + | |
| - | ipv4.routing-rules: | + | |
| - | ipv4.ignore-auto-routes: | + | |
| - | ipv4.ignore-auto-dns: | + | |
| - | ipv4.dhcp-client-id: -- | + | |
| - | ipv4.dhcp-iaid: | + | |
| - | ipv4.dhcp-timeout: | + | |
| - | ipv4.dhcp-send-hostname: | + | |
| - | ipv4.dhcp-hostname: | + | |
| - | ipv4.dhcp-fqdn: | + | |
| - | ipv4.dhcp-hostname-flags: | + | |
| - | ipv4.never-default: | + | |
| - | ipv4.may-fail: | + | |
| - | ipv4.dad-timeout: | + | |
| - | ipv4.dhcp-vendor-class-identifier: | + | |
| - | ipv4.dhcp-reject-servers: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | ipv6.method: | + | |
| - | ipv6.dns: | + | |
| - | ipv6.dns-search: | + | |
| - | ipv6.dns-options: | + | |
| - | ipv6.dns-priority: | + | |
| - | ipv6.addresses: | + | |
| - | ipv6.gateway: | + | |
| - | ipv6.routes: | + | |
| - | ipv6.route-metric: | + | |
| - | ipv6.route-table: | + | |
| - | ipv6.routing-rules: | + | |
| - | ipv6.ignore-auto-routes: | + | |
| - | ipv6.ignore-auto-dns: | + | |
| - | ipv6.never-default: | + | |
| - | ipv6.may-fail: | + | |
| - | ipv6.ip6-privacy: | + | |
| - | ipv6.addr-gen-mode: | + | |
| - | ipv6.ra-timeout: | + | |
| - | ipv6.dhcp-duid: | + | |
| - | ipv6.dhcp-iaid: | + | |
| - | ipv6.dhcp-timeout: | + | |
| - | ipv6.dhcp-send-hostname: | + | |
| - | ipv6.dhcp-hostname: | + | |
| - | ipv6.dhcp-hostname-flags: | + | |
| - | ipv6.token: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | proxy.method: | + | |
| - | proxy.browser-only: | + | |
| - | proxy.pac-url: | + | |
| - | proxy.pac-script: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | lines 56-100/100 (END) | + | |
| - | [q] | + | |
| </ | </ | ||
| - | De même, pour consulter les paramètres du profil | + | Pour supprimer le service |
| < | < | ||
| - | [root@centos8 ~]# nmcli -p connection show ip_fixe | + | [root@centos8 ~]# firewall-cmd --zone=work --remove-service=http |
| - | =============================================================================== | + | success |
| - | | + | |
| - | =============================================================================== | + | [root@centos8 ~]# firewall-cmd --zone=work --list-services |
| - | connection.id: | + | cockpit dhcpv6-client ssh |
| - | connection.uuid: | + | |
| - | connection.stable-id: | + | |
| - | connection.type: | + | |
| - | connection.interface-name: | + | |
| - | connection.autoconnect: | + | |
| - | connection.autoconnect-priority: | + | |
| - | connection.autoconnect-retries: | + | |
| - | connection.multi-connect: | + | |
| - | connection.auth-retries: | + | |
| - | connection.timestamp: | + | |
| - | connection.read-only: | + | |
| - | connection.permissions: | + | |
| - | connection.zone: -- | + | |
| - | connection.master: | + | |
| - | connection.slave-type: | + | |
| - | connection.autoconnect-slaves: | + | |
| - | connection.secondaries: | + | |
| - | connection.gateway-ping-timeout: | + | |
| - | connection.metered: | + | |
| - | connection.lldp: | + | |
| - | connection.mdns: | + | |
| - | connection.llmnr: | + | |
| - | connection.wait-device-timeout: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | 802-3-ethernet.port: | + | |
| - | 802-3-ethernet.speed: | + | |
| - | 802-3-ethernet.duplex: | + | |
| - | 802-3-ethernet.auto-negotiate: | + | |
| - | 802-3-ethernet.mac-address: | + | |
| - | 802-3-ethernet.cloned-mac-address: | + | |
| - | 802-3-ethernet.generate-mac-address-mask: | + | |
| - | 802-3-ethernet.mac-address-blacklist: | + | |
| - | 802-3-ethernet.mtu: | + | |
| - | 802-3-ethernet.s390-subchannels: | + | |
| - | 802-3-ethernet.s390-nettype: | + | |
| - | 802-3-ethernet.s390-options: | + | |
| - | 802-3-ethernet.wake-on-lan: | + | |
| - | 802-3-ethernet.wake-on-lan-password: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | ipv4.method: | + | |
| - | ipv4.dns: | + | |
| - | ipv4.dns-search: | + | |
| - | ipv4.dns-options: | + | |
| - | ipv4.dns-priority: | + | |
| - | ipv4.addresses: | + | |
| - | ipv4.gateway: | + | |
| - | ipv4.routes: | + | |
| - | ipv4.route-metric: | + | |
| - | ipv4.route-table: | + | |
| - | ipv4.routing-rules: | + | |
| - | ipv4.ignore-auto-routes: | + | |
| - | ipv4.ignore-auto-dns: | + | |
| - | ipv4.dhcp-client-id: | + | |
| - | ipv4.dhcp-iaid: | + | |
| - | ipv4.dhcp-timeout: | + | |
| - | ipv4.dhcp-send-hostname: | + | |
| - | ipv4.dhcp-hostname: | + | |
| - | ipv4.dhcp-fqdn: | + | |
| - | ipv4.dhcp-hostname-flags: | + | |
| - | ipv4.never-default: | + | |
| - | ipv4.may-fail: | + | |
| - | ipv4.dad-timeout: | + | |
| - | ipv4.dhcp-vendor-class-identifier: | + | |
| - | ipv4.dhcp-reject-servers: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | ipv6.method: | + | |
| - | ipv6.dns: | + | |
| - | ipv6.dns-search: | + | |
| - | ipv6.dns-options: | + | |
| - | ipv6.dns-priority: | + | |
| - | ipv6.addresses: | + | |
| - | ipv6.gateway: | + | |
| - | ipv6.routes: | + | |
| - | ipv6.route-metric: | + | |
| - | ipv6.route-table: | + | |
| - | ipv6.routing-rules: | + | |
| - | ipv6.ignore-auto-routes: | + | |
| - | ipv6.ignore-auto-dns: | + | |
| - | ipv6.never-default: | + | |
| - | ipv6.may-fail: | + | |
| - | ipv6.ip6-privacy: | + | |
| - | ipv6.addr-gen-mode: | + | |
| - | ipv6.ra-timeout: | + | |
| - | ipv6.dhcp-duid: | + | |
| - | ipv6.dhcp-iaid: | + | |
| - | ipv6.dhcp-timeout: | + | |
| - | ipv6.dhcp-send-hostname: | + | |
| - | ipv6.dhcp-hostname: | + | |
| - | ipv6.dhcp-hostname-flags: | + | |
| - | ipv6.token: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | proxy.method: | + | |
| - | proxy.browser-only: | + | |
| - | proxy.pac-url: | + | |
| - | proxy.pac-script: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | =============================================================================== | + | |
| - | Activate connection details (0f48c74d-5d16-4c37-8220-24644507b589) | + | |
| - | =============================================================================== | + | |
| - | GENERAL.NAME: | + | |
| - | GENERAL.UUID: | + | |
| - | GENERAL.DEVICES: | + | |
| - | GENERAL.IP-IFACE: | + | |
| - | GENERAL.STATE: | + | |
| - | GENERAL.DEFAULT: | + | |
| - | GENERAL.DEFAULT6: | + | |
| - | GENERAL.SPEC-OBJECT: | + | |
| - | GENERAL.VPN: | + | |
| - | GENERAL.DBUS-PATH: | + | |
| - | GENERAL.CON-PATH: | + | |
| - | GENERAL.ZONE: | + | |
| - | GENERAL.MASTER-PATH: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | IP4.ADDRESS[1]: | + | |
| - | IP4.GATEWAY: | + | |
| - | IP4.ROUTE[1]: | + | |
| - | IP4.ROUTE[2]: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | IP6.ADDRESS[1]: | + | |
| - | IP6.GATEWAY: | + | |
| - | IP6.ROUTE[1]: | + | |
| - | IP6.ROUTE[2]: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | lines 83-127/127 (END) | + | |
| - | [q] | + | |
| </ | </ | ||
| - | Pour consulter la liste profils associés à un périphérique, utilisez la commande suivante : | + | Pour ajouter |
| < | < | ||
| - | [root@centos8 ~]# nmcli -f CONNECTIONS device show ens18 | + | [root@centos8 ~]# firewall-cmd --zone=work |
| - | CONNECTIONS.AVAILABLE-CONNECTION-PATHS: / | + | success |
| - | CONNECTIONS.AVAILABLE-CONNECTIONS[1]: | + | |
| - | CONNECTIONS.AVAILABLE-CONNECTIONS[2]: | + | [root@centos8 ~]# firewall-cmd --zone=work --list-icmp-blocks |
| + | echo-reply | ||
| </ | </ | ||
| - | Les fichiers de configuration pour le periphérique **ens18** se trouvent dans le répertoire **/ | + | Pour supprimer un bloc ICMP, utilisez la commande suivante |
| < | < | ||
| - | [root@centos8 ~]# ls -l / | + | [root@centos8 ~]# firewall-cmd --zone=work |
| - | -rw-r--r--. 1 root root 417 Jun 16 06:39 ifcfg-ens18 | + | success |
| - | -rw-r--r--. 1 root root 326 Aug 29 03:58 ifcfg-ip_fixe | + | |
| + | [root@centos8 ~]# firewall-cmd --zone=work | ||
| + | |||
| + | [root@centos8 ~]# | ||
| </ | </ | ||
| - | ====1.2 - Résolution des Noms==== | + | Pour ajouter le port 591/tcp à la zone work, utilisez la commande suivante : |
| - | L' | + | < |
| + | [root@centos8 ~]# firewall-cmd --zone=work --add-port=591/tcp | ||
| + | success | ||
| + | |||
| + | [root@centos8 ~]# firewall-cmd --zone=work --list-ports | ||
| + | 591/tcp | ||
| + | </code> | ||
| + | |||
| + | Pour supprimer le port 591/tcp à la zone work, utilisez la commande suivante | ||
| < | < | ||
| - | [root@centos8 ~]# cat / | + | [root@centos8 ~]# firewall-cmd |
| - | TYPE=Ethernet | + | success |
| - | PROXY_METHOD=none | + | |
| - | BROWSER_ONLY=no | + | [root@centos8 ~]# firewall-cmd |
| - | BOOTPROTO=none | + | |
| - | IPADDR=10.0.2.46 | + | [root@centos8 ~]# |
| - | PREFIX=24 | + | |
| - | GATEWAY=10.0.2.1 | + | |
| - | DEFROUTE=yes | + | |
| - | IPV4_FAILURE_FATAL=no | + | |
| - | IPV6INIT=yes | + | |
| - | IPV6_AUTOCONF=yes | + | |
| - | IPV6_DEFROUTE=yes | + | |
| - | IPV6_FAILURE_FATAL=no | + | |
| - | IPV6_ADDR_GEN_MODE=stable-privacy | + | |
| - | NAME=ip_fixe | + | |
| - | UUID=0f48c74d-5d16-4c37-8220-24644507b589 | + | |
| - | DEVICE=ens18 | + | |
| - | ONBOOT=yes | + | |
| </ | </ | ||
| - | La résolution des noms est donc inactive | + | Pour créer un nouveau service, il convient de : |
| + | |||
| + | * copier un fichier existant se trouvant dans le répertoire **/ | ||
| + | * modifier le fichier, | ||
| + | * recharger la configuration de firewalld, | ||
| + | * vérifier que firewalld voit le nouveau service. | ||
| + | |||
| + | Par exemple | ||
| < | < | ||
| - | [root@centos8 ~]# ping www.free.fr | + | [root@centos8 ~]# cp / |
| - | ping: www.free.fr: Name or service | + | |
| + | [root@centos8 ~]# vi / | ||
| + | |||
| + | [root@centos8 ~]# cat / | ||
| + | <?xml version=" | ||
| + | <service> | ||
| + | < | ||
| + | < | ||
| + | <port protocol=" | ||
| + | </ | ||
| + | |||
| + | [root@centos8 ~]# firewall-cmd --reload | ||
| + | success | ||
| + | |||
| + | [root@centos8 ~]# firewall-cmd --get-services | ||
| + | RH-Satellite-6 RH-Satellite-6-capsule amanda-client amanda-k5-client amqp amqps apcupsd audit bacula bacula-client bb bgp bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc bittorrent-lsd ceph ceph-mon cfengine cockpit collectd condor-collector ctdb dhcp dhcpv6 dhcpv6-client distcc dns dns-over-tls docker-registry docker-swarm dropbox-lansync elasticsearch etcd-client etcd-server filemaker finger foreman foreman-proxy freeipa-4 freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp galera ganglia-client ganglia-master git grafana gre high-availability http https imap imaps ipp ipp-client ipsec irc ircs iscsi-target isns jenkins kadmin kdeconnect kerberos kibana klogin kpasswd kprop kshell kube-apiserver ldap ldaps libvirt libvirt-tls lightning-network llmnr managesieve matrix mdns memcache minidlna mongodb mosh mountd mqtt mqtt-tls ms-wbt mssql murmur mysql nbd nfs nfs3 nmea-0183 nrpe ntp nut openvpn ovirt-imageio ovirt-storageconsole ovirt-vmconsole plex pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy prometheus proxy-dhcp ptp pulseaudio puppetmaster quassel radius rdp redis redis-sentinel rpc-bind rquotad rsh rsyncd rtsp salt-master samba samba-client samba-dc sane sip sips slp smtp smtp-submission smtps snmp snmptrap spideroak-lansync spotify-sync squid ssdp ssh steam-streaming svdrp svn syncthing syncthing-gui synergy syslog syslog-tls telnet tentacle tftp tftp-client tile38 tinc tor-socks transmission-client upnp-client vdsm vnc-server wbem-http wbem-https wsman wsmans xdmcp xmpp-bosh xmpp-client xmpp-local xmpp-server zabbix-agent zabbix-server | ||
| </ | </ | ||
| - | Modifiez donc la configuration | + | ===La Configuration Avancée de firewalld=== |
| + | |||
| + | La configuration de base de firewalld ne permet que la configuration | ||
| + | |||
| + | Les **Critères** sont : | ||
| + | |||
| + | * **source address="< | ||
| + | * **destination address="< | ||
| + | * **rule port port="< | ||
| + | * **service name=< | ||
| + | |||
| + | Les **Actions** sont : | ||
| + | |||
| + | * **accept**, | ||
| + | * **reject**, | ||
| + | * une Action reject peut être associée avec un message d' | ||
| + | * **drop**. | ||
| + | |||
| + | Saisissez la commande suivante pour ouvrir le port 80 : | ||
| < | < | ||
| - | [root@centos8 ~]# nmcli connection mod ip_fixe ipv4.dns 8.8.8.8 | + | [root@centos8 ~]# firewall-cmd --add-rich-rule=' |
| + | success | ||
| </ | </ | ||
| - | L'étude du fichier **/etc/sysconfig/ | + | <WRAP center round important 50%> |
| + | **Important** - Notez que la Rich Rule doit être entourée de caractères **'**. | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez que la Rich Rule a créé deux règles, une pour IPv4 et une deuxième pour IPv6. Une règle peut être créée pour IPv4 seul en incluant le Critère **family=ipv4**. De la même façon, une règle peut être créée pour IPv6 seul en incluant le Critère **family=ipv6**. | ||
| + | </ | ||
| + | |||
| + | Cette nouvelle règle est écrite en mémoire mais non pas sur disque. Pour l' | ||
| < | < | ||
| - | [root@centos8 ~]# cat /etc/sysconfig/network-scripts/ifcfg-ip_fixe | + | [root@centos8 ~]# firewall-cmd --add-rich-rule=' |
| - | TYPE=Ethernet | + | success |
| - | PROXY_METHOD=none | + | |
| - | BROWSER_ONLY=no | + | [root@centos8 ~]# cat /etc/firewalld/zones/work.xml |
| - | BOOTPROTO=none | + | <?xml version=" |
| - | IPADDR=10.0.2.46 | + | < |
| - | PREFIX=24 | + | < |
| - | GATEWAY=10.0.2.1 | + | < |
| - | DEFROUTE=yes | + | < |
| - | IPV4_FAILURE_FATAL=no | + | < |
| - | IPV6INIT=yes | + | < |
| - | IPV6_AUTOCONF=yes | + | < |
| - | IPV6_DEFROUTE=yes | + | < |
| - | IPV6_FAILURE_FATAL=no | + | < |
| - | IPV6_ADDR_GEN_MODE=stable-privacy | + | </ |
| - | NAME=ip_fixe | + | </ |
| - | UUID=0f48c74d-5d16-4c37-8220-24644507b589 | + | |
| - | DEVICE=ens18 | + | |
| - | ONBOOT=yes | + | |
| - | DNS1=8.8.8.8 | + | |
| </ | </ | ||
| - | Afin que la modification du serveur DNS soit prise en compte, | + | <WRAP center round important 50%> |
| + | **Important** - Attention ! La règle ajoutée avec l' | ||
| + | </ | ||
| + | |||
| + | Redémarrez | ||
| < | < | ||
| - | root@centos8 ~]# systemctl restart | + | [root@centos8 ~]# systemctl restart |
| - | [root@centos8 ~]# systemctl status NetworkManager.service | + | </code> |
| - | ● NetworkManager.service - Network Manager | + | |
| - | | + | |
| - | | + | |
| - | Docs: man: | + | |
| - | Main PID: 973390 (NetworkManager) | + | |
| - | Tasks: 4 (limit: 23535) | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Aug 29 04:15:12 centos8.ittraining.loc NetworkManager[973390]: <info> [1630224912.2235] device | + | Pour visualiser cette règle dans la configuration de firewalld, il convient de saisir la commande suivante |
| - | Aug 29 04:15:12 centos8.ittraining.loc NetworkManager[973390]: < | + | |
| - | Aug 29 04:15:12 centos8.ittraining.loc NetworkManager[973390]: < | + | <code> |
| - | Aug 29 04:15:12 centos8.ittraining.loc NetworkManager[973390]: <info> [1630224912.2251] policy: set 'ip_fixe' | + | [root@centos8 ~]# firewall-cmd --zone=work --list-all |
| - | Aug 29 04:15:12 centos8.ittraining.loc NetworkManager[973390]: < | + | work (active) |
| - | Aug 29 04:15:12 centos8.ittraining.loc NetworkManager[973390]: < | + | target: default |
| - | Aug 29 04:15:12 centos8.ittraining.loc NetworkManager[973390]: <info> [1630224912.3102] manager: NetworkManager state is now CONNECTED_SITE | + | icmp-block-inversion: no |
| - | Aug 29 04:15:12 centos8.ittraining.loc NetworkManager[973390]: <info> [1630224912.3111] device (ens18): Activation: successful, device activated. | + | |
| - | Aug 29 04:15:12 centos8.ittraining.loc NetworkManager[973390]: | + | sources: |
| - | Aug 29 04:15:12 centos8.ittraining.loc NetworkManager[973390]: | + | services: cockpit dhcpv6-client ssh |
| - | lines 1-20/20 (END) | + | ports: |
| + | protocols: | ||
| + | | ||
| + | masquerade: no | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | | ||
| + | rich rules: | ||
| + | rule port port=" | ||
| + | </ | ||
| + | |||
| + | Notez que la Rich Rule est créée dans la Zone par Défaut. Il est possible de créer une Rich Rule dans une autre zone en utilisant l' | ||
| + | |||
| + | <code> | ||
| + | [root@centos8 ~]# firewall-cmd --zone=public --add-rich-rule='rule port port=" | ||
| + | success | ||
| + | |||
| + | [root@centos8 ~]# firewall-cmd --zone=public --list-all | ||
| + | public | ||
| + | target: | ||
| + | | ||
| + | interfaces: | ||
| + | sources: | ||
| + | services: cockpit dhcpv6-client ssh | ||
| + | ports: 5901/tcp | ||
| + | | ||
| + | forward: no | ||
| + | masquerade: no | ||
| + | forward-ports: | ||
| + | source-ports: | ||
| + | icmp-blocks: | ||
| + | rich rules: | ||
| + | rule port port=" | ||
| + | </code> | ||
| + | |||
| + | |||
| + | Pour supprimer une Rich Rule, il faut copier la ligne entière la concernant qui se trouve dans la sortie de la commande **firewall-cmd --list-all-zones** | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# firewall-cmd --zone=public --remove-rich-rule=' | ||
| + | success | ||
| + | </ | ||
| + | |||
| + | ===Le mode Panic de firewalld=== | ||
| + | |||
| + | Le mode Panic de firewalld permet de bloquer tout le trafic avec une seule commande. Pour connaître l' | ||
| + | |||
| + | <code> | ||
| + | [root@centos8 ~]# firewall-cmd --query-panic | ||
| + | no | ||
| + | </ | ||
| + | |||
| + | Pour activer le mode Panic, il convient de saisir la commande suivante | ||
| + | |||
| + | < | ||
| + | # firewall-cmd --panic-on | ||
| + | </ | ||
| + | |||
| + | Pour désactiver le mode Panic, il convient de saisir la commande suivante | ||
| + | |||
| + | < | ||
| + | # firewall-cmd --panic-off | ||
| + | </ | ||
| + | |||
| + | =====System Hardening===== | ||
| + | |||
| + | ====Les compilateurs==== | ||
| + | |||
| + | Afin d' | ||
| + | |||
| + | ====Les paquets==== | ||
| + | |||
| + | Il convient dans ce cas de passer en revue la liste des paquets installes puis de supprimer ceux qui sont juges être inutiles | ||
| + | |||
| + | <code> | ||
| + | [root@centos8 ~]# rpm -qa | more | ||
| + | librepo-1.14.0-2.el8.x86_64 | ||
| + | prefixdevname-0.1.0-6.el8.x86_64 | ||
| + | zip-3.0-23.el8.x86_64 | ||
| + | gnome-shell-extension-desktop-icons-3.32.1-22.el8_5.noarch | ||
| + | python3-setuptools-wheel-39.2.0-6.el8.noarch | ||
| + | perl-Term-Cap-1.17-395.el8.noarch | ||
| + | accountsservice-libs-0.6.55-2.el8_5.2.x86_64 | ||
| + | enchant2-2.2.3-3.el8.x86_64 | ||
| + | google-noto-sans-lisu-fonts-20161022-7.el8.1.noarch | ||
| + | ipset-libs-7.1-1.el8.x86_64 | ||
| + | pangomm-2.40.1-6.el8.x86_64 | ||
| + | anaconda-gui-33.16.5.6-1.el8.x86_64 | ||
| + | libibverbs-35.0-1.el8.x86_64 | ||
| + | thai-scalable-waree-fonts-0.6.5-1.el8.noarch | ||
| + | libidn-1.34-5.el8.x86_64 | ||
| + | tuned-2.16.0-1.el8.noarch | ||
| + | kbd-legacy-2.0.4-10.el8.noarch | ||
| + | NetworkManager-team-1.32.10-4.el8.x86_64 | ||
| + | lohit-kannada-fonts-2.5.4-3.el8.noarch | ||
| + | ipxe-roms-qemu-20181214-8.git133f4c47.el8.noarch | ||
| + | openssh-server-8.0p1-10.el8.x86_64 | ||
| + | sssd-nfs-idmap-2.5.2-2.el8_5.3.x86_64 | ||
| + | cronie-anacron-1.5.2-4.el8.x86_64 | ||
| + | libgdither-0.6-17.el8.x86_64 | ||
| + | libcanberra-gtk3-0.30-18.el8.x86_64 | ||
| + | net-snmp-libs-5.8-22.el8.x86_64 | ||
| + | libnl3-3.5.0-1.el8.x86_64 | ||
| + | libblockdev-lvm-2.24-7.el8.x86_64 | ||
| + | libjose-10-2.el8.x86_64 | ||
| + | jq-1.5-12.el8.x86_64 | ||
| + | zenity-3.28.1-1.el8.x86_64 | ||
| + | lz4-1.8.3-3.el8_4.x86_64 | ||
| + | flatpak-selinux-1.8.5-5.el8_5.noarch | ||
| + | python3-ordered-set-2.0.2-4.el8.noarch | ||
| + | bash-4.4.20-2.el8.x86_64 | ||
| + | libpkgconf-1.4.2-1.el8.x86_64 | ||
| + | gnome-keyring-3.28.2-1.el8.x86_64 | ||
| + | iwl100-firmware-39.31.5.1-103.el8.1.noarch | ||
| + | python3-libstoragemgmt-1.9.1-1.el8.x86_64 | ||
| + | libtevent-0.11.0-0.el8.x86_64 | ||
| + | gnome-themes-standard-3.22.3-4.el8.x86_64 | ||
| + | augeas-libs-1.12.0-6.el8.x86_64 | ||
| + | fprintd-pam-1.90.9-2.el8.x86_64 | ||
| + | setroubleshoot-plugins-3.3.14-1.el8.noarch | ||
| + | osinfo-db-tools-1.9.0-1.el8.x86_64 | ||
| + | libwayland-server-1.19.0-1.el8.x86_64 | ||
| + | libvirt-daemon-driver-interface-6.0.0-37.module_el8.5.0+1002+36725df2.x86_64 | ||
| + | kernel-modules-4.18.0-305.3.1.el8.x86_64 | ||
| + | libbpf-0.4.0-1.el8.x86_64 | ||
| + | libexif-0.6.22-5.el8_3.x86_64 | ||
| + | python3-simpleline-1.1.1-2.el8.noarch | ||
| + | cockpit-system-251.1-1.el8.noarch | ||
| + | python3-setools-4.3.0-2.el8.x86_64 | ||
| + | perl-IO-1.38-420.el8.x86_64 | ||
| + | ibus-typing-booster-2.1.0-5.el8.noarch | ||
| + | --More-- | ||
| [q] | [q] | ||
| </ | </ | ||
| - | Vérifiez que le fichier | + | ====Les démons et services==== |
| + | |||
| + | Il convient dans ce cas de passer en revue la liste des démons et services actives puis de supprimer ceux qui sont juges être inutiles; | ||
| + | |||
| + | | ||
| + | | ||
| + | | ||
| < | < | ||
| - | [root@centos8 ~]# cat /etc/resolv.conf | + | [root@centos8 ~]# ps aux | more |
| - | # Generated by NetworkManager | + | USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND |
| - | search ittraining.loc | + | root |
| - | nameserver 8.8.8.8 | + | root |
| + | root | ||
| + | root | ||
| + | root | ||
| + | root | ||
| + | root 10 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 11 0.0 0.0 0 0 ? I 12:13 0:00 [rcu_sched] | ||
| + | root 12 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 13 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 14 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/0] | ||
| + | root 15 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/1] | ||
| + | root 16 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 17 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 18 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 20 0.0 0.0 0 0 ? I< | ||
| + | root 21 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/2] | ||
| + | root 22 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 23 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 24 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 26 0.0 0.0 0 0 ? I< | ||
| + | root 27 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/3] | ||
| + | root 28 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 29 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 30 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 32 0.0 0.0 0 0 ? I< | ||
| + | root 33 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/4] | ||
| + | root 34 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 35 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 36 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 38 0.0 0.0 0 0 ? I< | ||
| + | root 39 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/5] | ||
| + | root 40 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 41 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 42 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 44 0.0 0.0 0 0 ? I< | ||
| + | root 45 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/6] | ||
| + | root 46 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 47 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 48 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 49 0.0 0.0 0 0 ? I 12:13 0:00 [kworker/ | ||
| + | root 50 0.0 0.0 0 0 ? I< | ||
| + | root 51 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/7] | ||
| + | root 52 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 53 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 54 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 56 0.0 0.0 0 0 ? I< | ||
| + | root 65 0.0 0.0 0 0 ? S 12:13 0:00 [kdevtmpfs] | ||
| + | root 66 0.0 0.0 0 0 ? I< | ||
| + | root 67 0.0 0.0 0 0 ? S 12:13 0:00 [rcu_tasks_trace] | ||
| + | root 68 0.0 0.0 0 0 ? S 12:13 0:00 [rcu_tasks_rude_] | ||
| + | root 69 0.0 0.0 0 0 ? S 12:13 0:00 [kauditd] | ||
| + | root 70 0.0 0.0 0 0 ? S 12:13 0:00 [khungtaskd] | ||
| + | root 71 0.0 0.0 0 0 ? S 12:13 0:00 [oom_reaper] | ||
| + | --More-- | ||
| + | [q] | ||
| </ | </ | ||
| - | Dernièrement vérifiez la resolution des noms : | + | < |
| + | [root@centos8 ~]# chkconfig --list | ||
| + | |||
| + | Note: This output shows SysV services only and does not include native | ||
| + | systemd services. SysV configuration data might be overridden by native | ||
| + | systemd configuration. | ||
| + | |||
| + | If you want to list systemd services use ' | ||
| + | To see services enabled on particular target use | ||
| + | ' | ||
| + | |||
| + | </ | ||
| < | < | ||
| - | [root@centos8 ~]# ping www.free.fr | + | [root@centos8 ~]# systemctl list-unit-files |
| - | PING www.free.fr (212.27.48.10) 56(84) bytes of data. | + | UNIT FILE STATE |
| - | 64 bytes from www.free.fr (212.27.48.10): icmp_seq=1 ttl=47 time=29.3 ms | + | proc-sys-fs-binfmt_misc.automount |
| - | 64 bytes from www.free.fr (212.27.48.10): icmp_seq=2 ttl=47 time=29.4 ms | + | -.mount generated |
| - | 64 bytes from www.free.fr (212.27.48.10): icmp_seq=3 ttl=47 time=29.4 ms | + | boot.mount |
| - | 64 bytes from www.free.fr (212.27.48.10): icmp_seq=4 ttl=47 time=29.4 ms | + | dev-hugepages.mount static |
| - | ^C | + | dev-mqueue.mount |
| - | --- www.free.fr ping statistics | + | proc-fs-nfsd.mount |
| - | 4 packets transmitted, 4 received, 0% packet loss, time 3005ms | + | proc-sys-fs-binfmt_misc.mount static |
| - | rtt min/avg/max/mdev = 29.266/29.377/29.428/0.183 ms | + | run-vmblock\x2dfuse.mount disabled |
| + | sys-fs-fuse-connections.mount static | ||
| + | sys-kernel-config.mount static | ||
| + | sys-kernel-debug.mount | ||
| + | tmp.mount disabled | ||
| + | var-lib-machines.mount | ||
| + | var-lib-nfs-rpc_pipefs.mount | ||
| + | cups.path | ||
| + | ostree-finalize-staged.path | ||
| + | systemd-ask-password-console.path | ||
| + | systemd-ask-password-plymouth.path | ||
| + | systemd-ask-password-wall.path | ||
| + | session-1.scope | ||
| + | session-5.scope | ||
| + | session-c1.scope | ||
| + | accounts-daemon.service | ||
| + | alsa-restore.service | ||
| + | alsa-state.service | ||
| + | anaconda-direct.service | ||
| + | anaconda-fips.service | ||
| + | anaconda-nm-config.service | ||
| + | anaconda-noshell.service | ||
| + | anaconda-pre.service | ||
| + | anaconda-shell@.service | ||
| + | anaconda-sshd.service | ||
| + | anaconda-tmux@.service | ||
| + | anaconda.service | ||
| + | arp-ethers.service | ||
| + | atd.service | ||
| + | auditd.service | ||
| + | auth-rpcgss-module.service | ||
| + | autovt@.service | ||
| + | avahi-daemon.service | ||
| + | blivet.service | ||
| + | blk-availability.service | ||
| + | bluetooth.service | ||
| + | bolt.service | ||
| + | brltty.service | ||
| + | btattach-bcm@.service | ||
| + | canberra-system-bootup.service | ||
| + | canberra-system-shutdown-reboot.service | ||
| + | canberra-system-shutdown.service | ||
| + | chrony-dnssrv@.service | ||
| + | chrony-wait.service | ||
| + | chronyd.service | ||
| + | cockpit-motd.service | ||
| + | cockpit-wsinstance-http-redirect.service | ||
| + | lines 1-55 | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | ====Les fichiers | ||
| + | |||
| + | Le système rhosts présente une faille de sécurité importante pour un serveur Linux. Pour cette raison, il convient de supprimer les fichiers **.rhosts** des utilisateurs. Utilisez la commande suivante: | ||
| + | |||
| + | # find / -name "\.rhosts" | ||
| + | |||
| + | ====Les fichiers et les repertoires sans proprietaire==== | ||
| + | |||
| + | Afin de dresser la liste des fichiers et des groupes sans propriétaires sur le serveur, il convient d' | ||
| + | |||
| + | # find / -nouser -exec ls -l \{\} \; 2> sans_pro.txt [Entree] | ||
| + | |||
| + | # find / -nogroup -exec ls -l \{\} \; 2>> sans_pro.txt[Entree] | ||
| + | |||
| + | Ces commandes produiront une liste éventuelle dans le fichier **sans_pro.txt**. | ||
| + | |||
| + | L' | ||
| + | |||
| + | * modifier le propriétaire a root | ||
| + | * modifier le groupe a root | ||
| + | * modifier les permissions a 700 | ||
| + | |||
| + | ====Limiter le delai d' | ||
| + | |||
| + | Une session de shell laissée ouverte inutilement et d'une manière sans surveillance est un risque de sécurité. Vérifiez donc le contenu du fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# cat / | ||
| + | # / | ||
| + | |||
| + | # System wide environment and startup programs, for login setup | ||
| + | # Functions and aliases go in / | ||
| + | |||
| + | # It's NOT a good idea to change this file unless you know what you | ||
| + | # are doing. It's much better to create a custom.sh shell script in | ||
| + | # / | ||
| + | # will prevent the need for merging in future updates. | ||
| + | |||
| + | pathmunge () { | ||
| + | case ":${PATH}:" | ||
| + | *:" | ||
| + | ;; | ||
| + | *) | ||
| + | if [ " | ||
| + | PATH=$PATH:$1 | ||
| + | else | ||
| + | PATH=$1:$PATH | ||
| + | fi | ||
| + | esac | ||
| + | } | ||
| + | |||
| + | |||
| + | if [ -x /usr/bin/id ]; then | ||
| + | if [ -z " | ||
| + | # ksh workaround | ||
| + | EUID=`/ | ||
| + | UID=`/ | ||
| + | fi | ||
| + | USER=" | ||
| + | LOGNAME=$USER | ||
| + | MAIL="/ | ||
| + | fi | ||
| + | |||
| + | # Path manipulation | ||
| + | if [ " | ||
| + | pathmunge /usr/sbin | ||
| + | pathmunge / | ||
| + | else | ||
| + | pathmunge / | ||
| + | pathmunge /usr/sbin after | ||
| + | fi | ||
| + | |||
| + | HOSTNAME=`/ | ||
| + | HISTSIZE=1000 | ||
| + | if [ " | ||
| + | export HISTCONTROL=ignoreboth | ||
| + | else | ||
| + | export HISTCONTROL=ignoredups | ||
| + | fi | ||
| + | |||
| + | export PATH USER LOGNAME MAIL HOSTNAME HISTSIZE HISTCONTROL | ||
| + | |||
| + | # By default, we want umask to get set. This sets it for login shell | ||
| + | # Current threshold for system reserved uid/gids is 200 | ||
| + | # You could check uidgid reservation validity in | ||
| + | # / | ||
| + | if [ $UID -gt 199 ] && [ " | ||
| + | umask 002 | ||
| + | else | ||
| + | umask 022 | ||
| + | fi | ||
| + | |||
| + | for i in / | ||
| + | if [ -r " | ||
| + | if [ " | ||
| + | | ||
| + | else | ||
| + | . " | ||
| + | fi | ||
| + | fi | ||
| + | done | ||
| + | |||
| + | unset i | ||
| + | unset -f pathmunge | ||
| + | |||
| + | if [ -n " | ||
| + | if [ -f /etc/bashrc ] ; then | ||
| + | # Bash login shells run only / | ||
| + | # Bash non-login shells run only / | ||
| + | # Check for double sourcing is done in / | ||
| + | . / | ||
| + | fi | ||
| + | fi | ||
| + | </ | ||
| + | |||
| + | A ce fichier doivent être ajoutées les deux lignes suivantes: | ||
| + | |||
| + | < | ||
| + | Readonly TMOUT=300 | ||
| + | Export TMOUT | ||
| + | </ | ||
| + | |||
| + | Par cette action, vous définissez le délai d’inactivité d'une session shell a une durée de 5 minutes. | ||
| + | |||
| + | Dernièrement, | ||
| + | |||
| + | ====Renforcer la securite d' | ||
| + | |||
| + | ===Les Distributions SysVInit=== | ||
| + | |||
| + | Le fichier **/ | ||
| + | |||
| + | La première modification à effectuer est de spécifier le niveau d’exécution par défaut a 3 au lieu de 5. Ceci permet de ne pas lancer les sessions graphiques sur une serveur de production. Cherchez donc la ligne suivante: | ||
| + | |||
| + | < | ||
| + | id: | ||
| + | </ | ||
| + | |||
| + | Modifiez-la en: | ||
| + | |||
| + | < | ||
| + | id: | ||
| + | </ | ||
| + | |||
| + | Le mode **single user** de démarrage de Linux n'est pas habituellement protégé par un mot de passe. Afin de remédier a cela, ajoutez les lignes suivantes: | ||
| + | |||
| + | < | ||
| + | # Single user mode | ||
| + | ~~: | ||
| + | </ | ||
| + | |||
| + | Dernièrement, | ||
| + | |||
| + | < | ||
| + | # ca:: | ||
| + | </ | ||
| + | |||
| + | ===Les Distributions Upstart=== | ||
| + | |||
| + | Afin d' | ||
| + | |||
| + | < | ||
| + | exec / | ||
| + | </ | ||
| + | |||
| + | en | ||
| + | |||
| + | < | ||
| + | #exec / | ||
| + | </ | ||
| + | |||
| + | ====Renforcer la sécurité du Noyau==== | ||
| + | |||
| + | ===La commande sysctl=== | ||
| + | |||
| + | Les fichiers dans le répertoire **/ | ||
| + | |||
| + | La commande **sysctl** applique les règles consignés dans le fichier **/ | ||
| + | |||
| + | Saisissez la commande : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# cat / | ||
| + | # sysctl settings are defined through files in | ||
| + | # / | ||
| + | # | ||
| + | # Vendors settings live in / | ||
| + | # To override a whole file, create a new file with the same in | ||
| + | # /etc/sysctl.d/ and put new settings there. To override | ||
| + | # only specific settings, add a file with a lexically later | ||
| + | # name in /etc/sysctl.d/ and put new settings there. | ||
| + | # | ||
| + | # For more information, | ||
| + | </code> | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# ls -la / | ||
| + | total 12 | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. 143 root root 8192 Oct 1 12:13 .. | ||
| + | lrwxrwxrwx. | ||
| + | </ | ||
| + | |||
| + | ==Options de la commande== | ||
| + | |||
| + | Les options de la commande **sysctl** sont : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# sysctl --help | ||
| + | |||
| + | Usage: | ||
| + | | ||
| + | |||
| + | Options: | ||
| + | -a, --all display all variables | ||
| + | -A alias of -a | ||
| + | -X alias of -a | ||
| + | --deprecated | ||
| + | -b, --binary | ||
| + | -e, --ignore | ||
| + | -N, --names | ||
| + | -n, --values | ||
| + | -p, --load[=< | ||
| + | -f alias of -p | ||
| + | --system | ||
| + | -r, --pattern < | ||
| + | | ||
| + | -q, --quiet | ||
| + | -w, --write | ||
| + | -o does nothing | ||
| + | -x does nothing | ||
| + | -d alias of -h | ||
| + | |||
| + | -h, --help | ||
| + | -V, --version | ||
| + | |||
| + | For more details see sysctl(8). | ||
| </ | </ | ||
| - | <WRAP center round important | + | <WRAP center round important |
| - | **Important** : Notez qu'il existe un front-end graphique en mode texte, | + | **Important** : Consultez la page de la traduction du manuel de **sysctl** **[[http:// |
| </ | </ | ||
| - | ====1.3 - Ajouter une Deuxième Adresse IP à un Profil==== | + | =====Mise en place de SELinux pour sécuriser le serveur===== |
| - | Pour ajouter | + | ====Introducton==== |
| + | |||
| + | L' | ||
| + | ur | ||
| + | ^ Type de Sécurité ^ Nom ^ Description ^ | ||
| + | | TE | //Type enforcement// | ||
| + | | RBAC | //Role Based Access Control// | ||
| + | | MAC | //Mandatory Access Control// | ||
| + | | MLS | // | ||
| + | |||
| + | Même quand le modèle %%SELinux%% de sécurité est actif, la sécurité type DAC est toujours active. Cependant dans le cas où la sécurité du type DAC autorise une action, %%SELinux%% va évaluer cette action par rapport | ||
| + | |||
| + | %%SELinux%% évalue toujours des **// | ||
| + | |||
| + | Dans le contexte de %%SELinux%% : | ||
| + | |||
| + | * un **// | ||
| + | * un **// | ||
| + | * une **// | ||
| + | |||
| + | Chaque **//classe d' | ||
| + | |||
| + | ====Définitions==== | ||
| + | |||
| + | ===Security Context=== | ||
| + | |||
| + | %%SELinux%% associe un //Security Context// (SC) à chaque **// | ||
| + | |||
| + | Un SC prend la forme **identité: | ||
| + | |||
| + | ^ Nom ^ Descriptions ^ | ||
| + | | Identité | Le nom du propriétaire de l' | ||
| + | | Rôle | Essentiellement appliqué aux processus, le rôle est appelé une domaine. Dans le cas d'un rôle de fichier, celui-ci est toujours **object_r**. Un rôle se termine généralement par **_r**. | | ||
| + | | Type | Définit la classification de sécurité de l' | ||
| + | | Niveau | Un niveau est un attribut de MLS et MCS. Une plage MLS est une paire de niveaux exprimée en utilisant la syntaxe // | ||
| + | |||
| + | Sous RHEL/CentOS 8, le fichier **/ | ||
| < | < | ||
| - | [root@centos8 ~]# nmcli connection mod ip_fixe +ipv4.addresses 192.168.1.2/24 | + | [root@centos8 ~]# cat / |
| + | # | ||
| + | # Multi-Category Security translation table for SELinux | ||
| + | # | ||
| + | # Uncomment the following to disable translation libary | ||
| + | # disable=1 | ||
| + | # | ||
| + | # Objects can be categorized with 0-1023 categories defined by the admin. | ||
| + | # Objects can be in more than one category at a time. | ||
| + | # Categories are stored in the system as c0-c1023. Users can use this | ||
| + | # table to translate the categories into a more meaningful output. | ||
| + | # Examples: | ||
| + | # s0: | ||
| + | # s0: | ||
| + | # s0: | ||
| + | # s0: | ||
| + | # s0: | ||
| + | s0=SystemLow | ||
| + | s0-s0: | ||
| + | s0: | ||
| </ | </ | ||
| - | Rechargez | + | Dans le contexte d'un SC pour un **// |
| + | |||
| + | Dans le contexte d'un SC pour un **// | ||
| + | |||
| + | %%SELinux%% maintient sa propre liste d' | ||
| < | < | ||
| - | [root@centos8 ~]# nmcli con up ip_fixe | + | [root@centos8 ~]# / |
| + | |||
| + | Login Name | ||
| + | |||
| + | __default__ | ||
| + | root | ||
| </ | </ | ||
| - | Saisissez ensuite la commande suivante | + | ===Domains et Types=== |
| + | |||
| + | Le **Domain** est l' | ||
| + | |||
| + | Le **Domain** contient des **// | ||
| + | |||
| + | Dans %%SELinux%% on utilise le mot : | ||
| + | |||
| + | * **Domain** pour un processus, | ||
| + | * **Type** pour un fichier. | ||
| + | |||
| + | ===Roles=== | ||
| + | |||
| + | Un **Rôle** est comme un utilisateur dans le système de sécurité DAC de Linux. Chaque utilisateur autorisé peut assumer l' | ||
| + | |||
| + | ===Politiques de Sécurité=== | ||
| + | |||
| + | Une politique de sécurité définit les SC de chaque application. Elle définit des droits d' | ||
| + | |||
| + | ^ Politique ^ Description ^ | ||
| + | | targeted | Les politiques de sécurité ne s' | ||
| + | | mls | Multi Level Security protection | | ||
| + | |||
| + | Les politiques de sécurité se trouvent dans le répertoire **/ | ||
| < | < | ||
| - | [root@centos8 ~]# nmcli connection show ip_fixe | + | [root@centos8 ~]# ls -lR / |
| - | connection.id: | + | / |
| - | connection.uuid: | + | total 8 |
| - | connection.stable-id: | + | -rw-r--r--. 1 root root 548 Jun 16 2021 config |
| - | connection.type: | + | -rw-r--r--. 1 root root 2647 Feb 3 2021 semanage.conf |
| - | connection.interface-name: ens18 | + | drwxr-xr-x. 5 root root 133 Mar 6 2022 targeted |
| - | connection.autoconnect: | + | |
| - | connection.autoconnect-priority: | + | / |
| - | connection.autoconnect-retries: | + | total 16 |
| - | connection.multi-connect: | + | -rw-r--r--. 1 root root 2367 Dec 21 2021 booleans.subs_dist |
| - | connection.auth-retries: | + | drwxr-xr-x. 4 root root 4096 Mar 6 2022 contexts |
| - | connection.timestamp: | + | drwxr-xr-x. 2 root root 6 Dec 21 2021 logins |
| - | connection.read-only: | + | drwxr-xr-x. 2 root root 23 Mar 6 2022 policy |
| - | connection.permissions: -- | + | -rw-r--r--. 1 root root 607 Dec 21 2021 setrans.conf |
| - | connection.zone: | + | -rw-r--r--. 1 root root 73 Mar 6 2022 seusers |
| - | connection.master: | + | |
| - | connection.slave-type: | + | / |
| - | connection.autoconnect-slaves: | + | total 68 |
| - | connection.secondaries: | + | -rw-r--r--. 1 root root 262 Mar 6 2022 customizable_types |
| - | connection.gateway-ping-timeout: | + | -rw-r--r--. 1 root root 195 Dec 21 2021 dbus_contexts |
| - | connection.metered: | + | -rw-r--r--. 1 root root 1111 Dec 21 2021 default_contexts |
| - | connection.lldp: default | + | -rw-r--r--. 1 root root 114 Dec 21 2021 default_type |
| - | connection.mdns: | + | -rw-r--r--. 1 root root 29 Dec 21 2021 failsafe_context |
| - | connection.llmnr: | + | drwxr-xr-x. 2 root root 213 Mar 6 2022 files |
| - | connection.wait-device-timeout: | + | -rw-r--r--. 1 root root 30 Dec 21 2021 initrc_context |
| - | 802-3-ethernet.port: | + | -rw-r--r--. 1 root root 372 Dec 21 2021 lxc_contexts |
| - | 802-3-ethernet.speed: 0 | + | -rw-r--r--. 1 root root 27 Dec 21 2021 openssh_contexts |
| - | 802-3-ethernet.duplex: | + | -rw-r--r--. 1 root root 33 Dec 21 2021 removable_context |
| - | 802-3-ethernet.auto-negotiate: | + | -rw-r--r--. 1 root root 74 Dec 21 2021 securetty_types |
| - | 802-3-ethernet.mac-address: | + | -rw-r--r--. 1 root root 1170 Dec 21 2021 sepgsql_contexts |
| - | 802-3-ethernet.cloned-mac-address: | + | -rw-r--r--. 1 root root 53 Dec 21 2021 snapperd_contexts |
| - | 802-3-ethernet.generate-mac-address-mask: | + | -rw-r--r--. 1 root root 57 Dec 21 2021 systemd_contexts |
| - | 802-3-ethernet.mac-address-blacklist: | + | -rw-r--r--. 1 root root 33 Dec 21 2021 userhelper_context |
| - | 802-3-ethernet.mtu: auto | + | drwxr-xr-x. 2 root root 114 Dec 21 2021 users |
| - | 802-3-ethernet.s390-subchannels: | + | -rw-r--r--. 1 root root 62 Dec 21 2021 virtual_domain_context |
| - | 802-3-ethernet.s390-nettype: | + | -rw-r--r--. 1 root root 71 Dec 21 2021 virtual_image_context |
| - | 802-3-ethernet.s390-options: | + | -rw-r--r--. 1 root root 2920 Dec 21 2021 x_contexts |
| - | 802-3-ethernet.wake-on-lan: | + | |
| - | 802-3-ethernet.wake-on-lan-password: | + | / |
| - | ipv4.method: | + | total 1008 |
| - | ipv4.dns: | + | -rw-r--r--. 1 root root 407436 Mar 6 2022 file_contexts |
| - | ipv4.dns-search: | + | -rw-r--r--. 1 root root 574118 Mar 6 2022 file_contexts.bin |
| - | ipv4.dns-options: | + | -rw-r--r--. 1 root root 14704 Mar 6 2022 file_contexts.homedirs |
| - | ipv4.dns-priority: | + | -rw-r--r--. 1 root root 20149 Mar 6 2022 file_contexts.homedirs.bin |
| - | ipv4.addresses: | + | -rw-r--r--. 1 root root |
| - | ipv4.gateway: | + | -rw-r--r--. 1 root root 0 Dec 21 2021 file_contexts.subs |
| - | ipv4.routes: | + | -rw-r--r--. 1 root root 597 Dec 21 2021 file_contexts.subs_dist |
| - | ipv4.route-metric: | + | -rw-r--r--. 1 root root 139 Dec 21 2021 media |
| - | ipv4.route-table: | + | |
| - | ipv4.routing-rules: | + | /etc/selinux/targeted/contexts/users: |
| - | ipv4.ignore-auto-routes: | + | total 28 |
| - | ipv4.ignore-auto-dns: | + | -rw-r--r--. 1 root root 342 Dec 21 2021 guest_u |
| - | ipv4.dhcp-client-id: | + | -rw-r--r--. 1 root root 724 Dec 21 2021 root |
| - | ipv4.dhcp-iaid: -- | + | -rw-r--r--. 1 root root 562 Dec 21 2021 staff_u |
| - | ipv4.dhcp-timeout: | + | -rw-r--r--. 1 root root 589 Dec 21 2021 sysadm_u |
| - | ipv4.dhcp-send-hostname: | + | -rw-r--r--. 1 root root 612 Dec 21 2021 unconfined_u |
| - | ipv4.dhcp-hostname: | + | --More-- |
| - | ipv4.dhcp-fqdn: -- | + | |
| - | ipv4.dhcp-hostname-flags: | + | |
| - | ipv4.never-default: | + | |
| - | ipv4.may-fail: yes | + | |
| - | ipv4.dad-timeout: | + | |
| - | ipv4.dhcp-vendor-class-identifier: | + | |
| - | ipv4.dhcp-reject-servers: | + | |
| - | ipv6.method: | + | |
| - | ipv6.dns: -- | + | |
| - | ipv6.dns-search: | + | |
| - | ipv6.dns-options: | + | |
| - | ipv6.dns-priority: | + | |
| - | ipv6.addresses: | + | |
| - | ipv6.gateway: | + | |
| - | ipv6.routes: | + | |
| - | ipv6.route-metric: | + | |
| - | ipv6.route-table: | + | |
| - | ipv6.routing-rules: | + | |
| - | ipv6.ignore-auto-routes: | + | |
| - | ipv6.ignore-auto-dns: | + | |
| - | ipv6.never-default: | + | |
| - | ipv6.may-fail: | + | |
| - | ipv6.ip6-privacy: | + | |
| - | ipv6.addr-gen-mode: | + | |
| - | ipv6.ra-timeout: | + | |
| - | ipv6.dhcp-duid: -- | + | |
| - | ipv6.dhcp-iaid: -- | + | |
| - | ipv6.dhcp-timeout: | + | |
| - | ipv6.dhcp-send-hostname: | + | |
| - | ipv6.dhcp-hostname: | + | |
| - | ipv6.dhcp-hostname-flags: | + | |
| - | ipv6.token: | + | |
| - | proxy.method: | + | |
| - | proxy.browser-only: | + | |
| - | proxy.pac-url: | + | |
| - | proxy.pac-script: | + | |
| - | GENERAL.NAME: | + | |
| - | GENERAL.UUID: | + | |
| - | GENERAL.DEVICES: | + | |
| - | GENERAL.IP-IFACE: | + | |
| - | GENERAL.STATE: | + | |
| - | GENERAL.DEFAULT: | + | |
| - | GENERAL.DEFAULT6: | + | |
| - | GENERAL.SPEC-OBJECT: | + | |
| - | GENERAL.VPN: | + | |
| - | GENERAL.DBUS-PATH: | + | |
| - | GENERAL.CON-PATH: / | + | |
| - | GENERAL.ZONE: | + | |
| - | GENERAL.MASTER-PATH: | + | |
| - | IP4.ADDRESS[1]: | + | |
| - | IP4.ADDRESS[2]: | + | |
| - | IP4.GATEWAY: | + | |
| - | IP4.ROUTE[1]: dst = 10.0.2.0/ | + | |
| - | IP4.ROUTE[2]: | + | |
| - | IP4.ROUTE[3]: | + | |
| - | IP4.DNS[1]: | + | |
| - | IP6.ADDRESS[1]: | + | |
| - | IP6.GATEWAY: | + | |
| - | IP6.ROUTE[1]: dst = fe80::/64, nh = ::, mt = 100 | + | |
| - | IP6.ROUTE[2]: | + | |
| - | lines 72-116/116 (END) | + | |
| [q] | [q] | ||
| </ | </ | ||
| - | <WRAP center round important 60%> | + | Afin d'utiliser SELinux en ligne de commande sous RHEL/CentOS 8, il est nécessaire d'installer le paquet |
| - | **Important** : Notez l'ajout de l'adresse secondaire à la ligne **ipv4.addresses: | + | |
| - | </WRAP> | + | < |
| + | [root@centos8 ~]# dnf install setools-console | ||
| + | Last metadata expiration check: 0:28:26 ago on Tue 01 Oct 2024 16:11:14 CEST. | ||
| + | Dependencies resolved. | ||
| + | ================================================================================================================================================================================================================== | ||
| + | | ||
| + | ================================================================================================================================================================================================================== | ||
| + | Installing: | ||
| + | | ||
| + | |||
| + | Transaction Summary | ||
| + | ================================================================================================================================================================================================================== | ||
| + | Install | ||
| + | |||
| + | Total download size: 42 k | ||
| + | Installed size: 122 k | ||
| + | Is this ok [y/N]: y | ||
| + | Downloading Packages: | ||
| + | setools-console-4.3.0-2.el8.x86_64.rpm | ||
| + | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ||
| + | Total 76 kB/s | 42 kB | ||
| + | Running transaction check | ||
| + | Transaction check succeeded. | ||
| + | Running transaction test | ||
| + | Transaction test succeeded. | ||
| + | Running transaction | ||
| + | Preparing | ||
| + | Installing | ||
| + | Running scriptlet: setools-console-4.3.0-2.el8.x86_64 | ||
| + | Verifying | ||
| + | Installed products updated. | ||
| + | |||
| + | Installed: | ||
| + | setools-console-4.3.0-2.el8.x86_64 | ||
| + | |||
| + | Complete! | ||
| + | </code> | ||
| - | Consultez maintenant le contenu du fichier | + | Pour consulter les statistiques de la politique, il convient d' |
| < | < | ||
| - | [root@centos8 ~]# cat /etc/sysconfig/network-scripts/ifcfg-ip_fixe | + | [root@centos8 ~]# seinfo |
| - | TYPE=Ethernet | + | Statistics for policy file: /sys/fs/selinux/policy |
| - | PROXY_METHOD=none | + | Policy Version: |
| - | BROWSER_ONLY=no | + | Target Policy: |
| - | BOOTPROTO=none | + | Handle unknown classes: |
| - | IPADDR=10.0.2.46 | + | |
| - | PREFIX=24 | + | |
| - | GATEWAY=10.0.2.1 | + | |
| - | DEFROUTE=yes | + | |
| - | IPV4_FAILURE_FATAL=no | + | Booleans: |
| - | IPV6INIT=yes | + | |
| - | IPV6_AUTOCONF=yes | + | |
| - | IPV6_DEFROUTE=yes | + | |
| - | IPV6_FAILURE_FATAL=no | + | |
| - | IPV6_ADDR_GEN_MODE=stable-privacy | + | Role allow: |
| - | NAME=ip_fixe | + | |
| - | UUID=0f48c74d-5d16-4c37-8220-24644507b589 | + | MLS Constrain: |
| - | DEVICE=ens18 | + | |
| - | ONBOOT=yes | + | |
| - | DNS1=8.8.8.8 | + | |
| - | IPADDR1=192.168.1.2 | + | |
| - | PREFIX1=24 | + | |
| + | | ||
| + | | ||
| + | Netifcon: | ||
| </ | </ | ||
| - | <WRAP center round important | + | <WRAP center round important |
| - | **Important** : Notez l' | + | **Important** : Notez ici le grand nombre |
| </ | </ | ||
| - | ====1.4 - La Commande hostname==== | + | ===Langage de Politiques=== |
| - | La procédure de la modification du hostname | + | Un politique |
| - | < | + | ==allow== |
| - | [root@centos8 ~]# hostname | + | |
| - | centos8.ittraining.loc | + | |
| - | [root@centos8 ~]# nmcli general hostname centos.ittraining.loc | + | **allow** autorise l' |
| - | [root@centos8 ~]# cat / | + | allow user_t domaine_t : file (read execute getattr) ; |
| - | centos.ittraining.loc | + | |
| - | [root@centos8 ~]# hostname | + | Dans cette directive : |
| - | centos.ittraining.loc | + | |
| - | [root@centos8 ~]# nmcli general hostname centos8.ittraining.loc | + | * user_t est le type de fichier, |
| + | * domaine_t est le domaine des processus qui sont autorisés par allow, | ||
| + | * file (droit1 droit2 etc) est la liste des permissions accordées. | ||
| - | [root@centos8 ~]# cat /etc/hostname | + | Les permissions possibles sont : |
| - | centos8.ittraining.loc | + | |
| + | * read | ||
| + | * write | ||
| + | * append | ||
| + | * execute | ||
| + | * getattr | ||
| + | * setattr | ||
| + | * lock | ||
| + | * link | ||
| + | * unlink | ||
| + | * rename | ||
| + | * ioctl | ||
| + | |||
| + | ==type== | ||
| + | |||
| + | La directive **type** définit un type %%SELinux%%. Le type se termine généralement par **_t**. | ||
| + | |||
| + | **auditallow, | ||
| + | |||
| + | La directive **auditallow** demande l' | ||
| + | |||
| + | L' | ||
| + | |||
| + | ===type_transition=== | ||
| + | |||
| + | Normalement quand un fichier est créé, il hérite du SC du répertoire parent. De même quand un processus %%SELinux%% active un nouveau processus, ce dernier s' | ||
| + | |||
| + | ===Décisions de SELinux=== | ||
| + | |||
| + | Il existe deux types de décisions auxquelles %%SELinux%% doit faire face : | ||
| + | |||
| + | * **Décisions d' | ||
| + | * **Décisions de Transition** | ||
| + | |||
| + | ==Décisions d' | ||
| + | |||
| + | Dans ce type de décision %%SELinux%% doit décider d' | ||
| + | |||
| + | * un **// | ||
| + | * un **// | ||
| + | |||
| + | ==Décisions de Transition== | ||
| + | |||
| + | Dans ce type de décision %%SELinux%% doit décider d' | ||
| + | |||
| + | * d' | ||
| + | * de créer des **// | ||
| + | |||
| + | ====Commandes SELinux==== | ||
| + | |||
| + | ^ Commande ^ Description ^ | ||
| + | | chcon | Changer le SC d'un fichier | | ||
| + | | audit2allow | Générer la source de la règle de sécurité à l' | ||
| + | | restorecon | Restaurer le SC par défaut à un ou plusieurs fichiers | | ||
| + | | setfiles -n | Vérifier si les SC sont corrects | ||
| + | | semodule | Gèrer les modules de politiques | | ||
| + | | semodule -i | Installer un module de politiques | | ||
| + | | checkmodule | Compiler un module | | ||
| + | | semodule_package | Créer un module installable par semodule | | ||
| + | | semanage | Administrer une politique | | ||
| + | | audit2allow -M | Créer un module à partir d'un message d' | ||
| + | | sesearch | Recherche des règles %%SELinux%% | | ||
| + | | seinfo | Effectuer des recherches dans la politique | | ||
| + | | getsebool | Affiche l' | ||
| + | | getsebool -a | Affiche l' | ||
| + | | sestatus -b | Affiche l' | ||
| + | | setsebool | Modifie l' | ||
| + | | togglesebool | Bascule la valeur d'un booléen | | ||
| + | |||
| + | ====Les Etats de SELinux==== | ||
| + | |||
| + | %%SELinux%% connait trois états : | ||
| + | |||
| + | ^ Etat ^ Description ^ | ||
| + | | disabled | %%SELinux%% est inactif. | | ||
| + | | permissive | %%SELinux%% est actif mais tout est permis. Des interdictions ne font que de générer des messages d' | ||
| + | | enforcing | %%SELinux%% est actif. | | ||
| + | |||
| + | L' | ||
| + | |||
| + | ^ Valeur ^ Description ^ | ||
| + | | 0 | %%SELinux%% est en mode // | ||
| + | | 1 | %%SELinux%% est en mode // | ||
| + | |||
| + | La configuration de l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# cat /etc/selinux/ | ||
| - | [root@centos8 ~]# hostname | + | # This file controls the state of SELinux on the system. |
| - | centos8.ittraining.loc | + | # SELINUX= can take one of these three values: |
| + | # | ||
| + | # | ||
| + | # | ||
| + | SELINUX=enforcing | ||
| + | # SELINUXTYPE= can take one of these three values: | ||
| + | # | ||
| + | # | ||
| + | # mls - Multi Level Security protection. | ||
| + | SELINUXTYPE=targeted | ||
| </ | </ | ||
| - | ====1.5 - La Commande ip==== | + | Afin de connaître l' |
| - | Sous RHEL/CentOS 8 la commande **ip** est préférée par rapport à la commande ifconfig | + | < |
| + | [root@centos8 ~]# getenforce | ||
| + | Enforcing | ||
| + | </code> | ||
| + | |||
| + | Pour modifier l' | ||
| < | < | ||
| - | [root@centos8 ~]# ip address | + | [root@centos8 ~]# setenforce permissive |
| - | 1: lo: < | + | |
| - | | + | [root@centos8 ~]# getenforce |
| - | inet 127.0.0.1/8 scope host lo | + | Permissive |
| - | | + | |
| - | inet6 ::1/128 scope host | + | |
| - | | + | |
| - | 2: ens18: < | + | |
| - | link/ether 4e: | + | |
| - | inet 10.0.2.46/ | + | |
| - | | + | |
| - | inet 192.168.1.2/ | + | |
| - | | + | |
| - | inet6 fe80:: | + | |
| - | | + | |
| - | 3: virbr0: < | + | |
| - | link/ether 52: | + | |
| - | inet 192.168.122.1/ | + | |
| - | | + | |
| - | 4: virbr0-nic: < | + | |
| - | link/ether 52: | + | |
| </ | </ | ||
| - | ===Options | + | La commande **sestatus** vous informe sur la configuration de %%SELinux%% et notamment sur la version |
| - | Les options | + | < |
| + | [root@centos8 ~]# sestatus | ||
| + | SELinux status: | ||
| + | SELinuxfs mount: | ||
| + | SELinux root directory: | ||
| + | Loaded policy name: | ||
| + | Current mode: | ||
| + | Mode from config file: enforcing | ||
| + | Policy MLS status: | ||
| + | Policy deny_unknown status: | ||
| + | Memory protection checking: | ||
| + | Max kernel policy version: | ||
| + | </ | ||
| + | |||
| + | Les différentes versions | ||
| + | |||
| + | La commande | ||
| < | < | ||
| - | [root@centos8 ~]# ip --help | + | [root@centos8 ~]# sestatus |
| - | Usage: ip [ OPTIONS ] OBJECT { COMMAND | help } | + | SELinux status: enabled |
| - | ip [ -force ] -batch filename | + | SELinuxfs mount: |
| - | where OBJECT | + | SELinux root directory: / |
| - | tunnel | tuntap | maddress | mroute | mrule | monitor | xfrm | | + | Loaded policy name: |
| - | netns | l2tp | fou | macsec | tcp_metrics | token | netconf | ila | | + | Current mode: |
| - | vrf | sr | nexthop | mptcp } | + | Mode from config file: enforcing |
| - | OPTIONS | + | Policy MLS status: |
| - | | + | Policy deny_unknown status: |
| - | | + | Memory protection checking: |
| - | -4 | -6 | -I | -D | -M | -B | -0 | | + | Max kernel policy version: |
| - | | + | |
| - | | + | Process contexts: |
| - | -rc[vbuf] [size] | -n[etns] name | -N[umeric] | -a[ll] | | + | Current context: |
| - | -c[olor]} | + | Init context: |
| + | / | ||
| + | File contexts: | ||
| + | Controlling terminal: | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| </ | </ | ||
| - | ====1.6 - Activer/ | + | ====Booléens==== |
| - | Deux commandes existent pour désactiver et activer manuellement | + | Les booléens permettent à des ensembles de règles d' |
| + | |||
| + | Pour visualiser l' | ||
| < | < | ||
| - | # nmcli device disconnect enp0s3 | + | [root@centos8 ~]# getsebool -a | more |
| - | # nmcli device connect enp0s3 | + | abrt_anon_write --> off |
| + | abrt_handle_event --> off | ||
| + | abrt_upload_watch_anon_write --> on | ||
| + | antivirus_can_scan_system --> off | ||
| + | antivirus_use_jit --> off | ||
| + | auditadm_exec_content --> on | ||
| + | authlogin_nsswitch_use_ldap --> off | ||
| + | authlogin_radius --> off | ||
| + | authlogin_yubikey --> off | ||
| + | awstats_purge_apache_log_files --> off | ||
| + | boinc_execmem --> on | ||
| + | cdrecord_read_content --> off | ||
| + | cluster_can_network_connect --> off | ||
| + | cluster_manage_all_files --> off | ||
| + | cluster_use_execmem --> off | ||
| + | cobbler_anon_write --> off | ||
| + | cobbler_can_network_connect --> off | ||
| + | cobbler_use_cifs --> off | ||
| + | cobbler_use_nfs --> off | ||
| + | collectd_tcp_network_connect --> off | ||
| + | colord_use_nfs --> off | ||
| + | condor_tcp_network_connect --> off | ||
| + | conman_can_network --> off | ||
| + | conman_use_nfs --> off | ||
| + | container_connect_any --> off | ||
| + | container_manage_cgroup --> off | ||
| + | container_use_cephfs --> off | ||
| + | cron_can_relabel --> off | ||
| + | cron_system_cronjob_use_shares --> off | ||
| + | cron_userdomain_transition --> on | ||
| + | cups_execmem --> off | ||
| + | cvs_read_shadow --> off | ||
| + | daemons_dump_core --> off | ||
| + | daemons_enable_cluster_mode --> off | ||
| + | daemons_use_tcp_wrapper --> off | ||
| + | daemons_use_tty --> off | ||
| + | dbadm_exec_content --> on | ||
| + | dbadm_manage_user_files --> off | ||
| + | dbadm_read_user_files --> off | ||
| + | deny_bluetooth --> off | ||
| + | deny_execmem --> off | ||
| + | deny_ptrace --> off | ||
| + | dhcpc_exec_iptables --> off | ||
| + | dhcpd_use_ldap --> off | ||
| + | domain_can_mmap_files --> off | ||
| + | domain_can_write_kmsg --> off | ||
| + | domain_fd_use --> on | ||
| + | domain_kernel_load_modules --> off | ||
| + | entropyd_use_audio --> on | ||
| + | exim_can_connect_db --> off | ||
| + | exim_manage_user_files --> off | ||
| + | exim_read_user_files --> off | ||
| + | fcron_crond --> off | ||
| + | fenced_can_network_connect --> off | ||
| + | fenced_can_ssh --> off | ||
| + | --More-- | ||
| + | [q] | ||
| </ | </ | ||
| - | <WRAP center round important 60%> | + | ou la commande |
| - | **Important** : Veuillez ne **PAS** exécuter ces deux commandes. | + | |
| - | </ | + | |
| - | ====1.7 | + | < |
| + | [root@centos8 ~]# sestatus | ||
| + | SELinux status: | ||
| + | SELinuxfs mount: | ||
| + | SELinux root directory: | ||
| + | Loaded policy name: | ||
| + | Current mode: | ||
| + | Mode from config file: enforcing | ||
| + | Policy MLS status: | ||
| + | Policy deny_unknown status: | ||
| + | Memory protection checking: | ||
| + | Max kernel policy version: | ||
| - | ===La commande ip=== | + | Policy booleans: |
| + | abrt_anon_write | ||
| + | abrt_handle_event | ||
| + | abrt_upload_watch_anon_write | ||
| + | antivirus_can_scan_system | ||
| + | antivirus_use_jit | ||
| + | auditadm_exec_content | ||
| + | authlogin_nsswitch_use_ldap | ||
| + | authlogin_radius | ||
| + | authlogin_yubikey | ||
| + | awstats_purge_apache_log_files | ||
| + | boinc_execmem | ||
| + | cdrecord_read_content | ||
| + | cluster_can_network_connect | ||
| + | cluster_manage_all_files | ||
| + | cluster_use_execmem | ||
| + | cobbler_anon_write | ||
| + | cobbler_can_network_connect | ||
| + | cobbler_use_cifs | ||
| + | cobbler_use_nfs | ||
| + | collectd_tcp_network_connect | ||
| + | colord_use_nfs | ||
| + | condor_tcp_network_connect | ||
| + | conman_can_network | ||
| + | conman_use_nfs | ||
| + | container_connect_any | ||
| + | container_manage_cgroup | ||
| + | container_use_cephfs | ||
| + | cron_can_relabel | ||
| + | cron_system_cronjob_use_shares | ||
| + | cron_userdomain_transition | ||
| + | cups_execmem | ||
| + | cvs_read_shadow | ||
| + | daemons_dump_core | ||
| + | daemons_enable_cluster_mode | ||
| + | daemons_use_tcp_wrapper | ||
| + | daemons_use_tty | ||
| + | dbadm_exec_content | ||
| + | dbadm_manage_user_files | ||
| + | dbadm_read_user_files | ||
| + | deny_bluetooth | ||
| + | deny_execmem | ||
| + | deny_ptrace | ||
| + | dhcpc_exec_iptables | ||
| + | --More-- | ||
| + | [q] | ||
| + | </ | ||
| - | Sous RHEL/CentOS 8, pour supprimer la route vers le réseau 192.168.1.0 | + | Pour fixer l' |
| < | < | ||
| - | [root@centos8 ~]# ip route | + | [root@centos8 ~]# setsebool antivirus_can_scan_system |
| - | default via 10.0.2.1 dev ens18 proto static metric 100 | + | |
| - | 10.0.2.0/24 dev ens18 proto kernel scope link src 10.0.2.46 metric 100 | + | |
| - | 192.168.1.0/ | + | |
| - | 192.168.122.0/ | + | |
| - | root@centos8 ~]# ip route del 192.168.1.0/ | + | [root@centos8 ~]# getsebool antivirus_can_scan_system |
| - | [root@centos8 ~]# ip route | + | antivirus_can_scan_system --> on |
| - | default via 10.0.2.1 dev ens18 proto static metric 100 | + | |
| - | 10.0.2.0/24 dev ens18 proto kernel scope link src 10.0.2.46 metric 100 | + | [root@centos8 ~]# setsebool antivirus_can_scan_system |
| - | 192.168.122.0/ | + | |
| + | [root@centos8 ~]# getsebool antivirus_can_scan_system | ||
| + | antivirus_can_scan_system --> off | ||
| </ | </ | ||
| - | Pour ajouter la route vers le réseau 192.168.1.0 : | + | =====LAB #2 - Travailler avec SELinux===== |
| + | Afin reconstruire la politique actuelle **sans** les règles **dontaudit**, | ||
| + | |||
| < | < | ||
| - | [root@centos8 ~]# ip route add 192.168.1.0/ | + | [root@centos8 ~]# semodule -DB |
| - | [root@centos8 ~]# ip route | + | |
| - | default via 10.0.2.1 dev ens18 proto static metric 100 | + | |
| - | 10.0.2.0/24 dev ens18 proto kernel scope link src 10.0.2.46 metric 100 | + | |
| - | 192.168.1.0/ | + | |
| - | 192.168.122.0/ | + | |
| </ | </ | ||
| - | <WRAP center round important 60%> | + | Vérifiez qu'il ne reste aucune règle de type **dontaudit** : |
| - | **Important** - La commande utilisée pour ajouter une passerelle par défaut prend la forme suivante **ip route add default via //adresse ip//**. | + | |
| - | </ | + | |
| - | ===Désactiver/Activer le routage sur le serveur=== | + | < |
| + | [root@centos8 ~]# seinfo | ||
| + | Statistics for policy file: /sys/ | ||
| + | Policy Version: | ||
| + | Target Policy: | ||
| + | Handle unknown classes: | ||
| + | Classes: | ||
| + | Sensitivities: | ||
| + | Types: | ||
| + | Users: | ||
| + | Booleans: | ||
| + | Allow: | ||
| + | Auditallow: | ||
| + | Type_trans: | ||
| + | Type_member: | ||
| + | Role allow: | ||
| + | Constraints: | ||
| + | MLS Constrain: | ||
| + | Permissives: | ||
| + | Defaults: | ||
| + | Allowxperm: | ||
| + | Auditallowxperm: | ||
| + | Ibendportcon: | ||
| + | Initial SIDs: | ||
| + | Genfscon: | ||
| + | Netifcon: | ||
| + | </ | ||
| - | Pour désactiver le routage sur le serveur, il convient de désactiver la retransmission | + | ====Copier et Déplacer |
| - | Pour IPv4 : | + | Créez deux fichiers **file1** et **file2** en tant que l' |
| < | < | ||
| - | [root@centos8 ~]# cat / | + | [root@centos8 ~]# exit |
| - | 1 | + | logout |
| - | [root@centos8 ~]# echo 0 > / | + | [trainee@centos8 ~]$ touch file1 file2 |
| - | [root@centos8 ~]# cat / | + | [trainee@centos8 ~]$ ls -Z file* |
| - | 0 | + | unconfined_u: |
| </ | </ | ||
| - | Pour activer | + | Notez que le type des deux fichiers est **user_home_t**. |
| + | |||
| + | Copiez maintenant | ||
| < | < | ||
| - | [root@centos8 ~]# echo 1 > /proc/ | + | [trainee@centos8 ~]$ cp file1 /tmp |
| - | [root@centos8 ~]# cat /proc/sys/net/ipv4/ | + | |
| - | 1 | + | [trainee@centos8 ~]$ ls -Z /tmp/file1 |
| + | unconfined_u: | ||
| </ | </ | ||
| - | Pour IPv6 : | + | Notez que le fichier ainsi copié a hérité du **type** du répertoire parent, à savoir **tmp_t**. |
| + | |||
| + | Déplacez maintenant le fichier **file2** dans le répertoire **/tmp** et contrôlez son SC : | ||
| < | < | ||
| - | [root@centos8 ~]# cat /proc/ | + | [trainee@centos8 ~]$ mv file2 /tmp |
| - | 1 | + | |
| - | [root@centos8 ~]# echo " | + | [trainee@centos8 ~]$ ls -Z /tmp/file2 |
| - | [root@centos8 ~]# cat /proc/sys/ | + | unconfined_u: |
| - | 0 | + | |
| </ | </ | ||
| - | Pour activer | + | Notez que la commande **mv** maintient |
| + | |||
| + | ====Vérifier les SC des Processus==== | ||
| + | |||
| + | Il convient d'utiliser l' | ||
| < | < | ||
| - | [root@centos8 ~]# echo "1" > /proc/sys/net/ipv6/conf/all/forwarding | + | [trainee@centos8 ~]$ ps auxZ | more |
| - | [root@centos8 ~]# cat /proc/sys/net/ipv6/conf/all/forwarding | + | LABEL |
| - | 1 | + | system_u: |
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | --More-- | ||
| + | [q] | ||
| </ | </ | ||
| - | =====LAB #2 - Diagnostique du Réseau===== | + | ====Visualiser la SC d'un Utilisateur==== |
| - | ====2.1 | + | Utilisez l' |
| + | |||
| + | < | ||
| + | [trainee@centos8 ~]$ id -Z | ||
| + | unconfined_u: | ||
| + | </ | ||
| - | Pour tester l' | + | Notez que vous ne pouvez pas consulter le SC d'un autre utilisateur |
| < | < | ||
| - | [root@centos8 ~]# ping -c4 10.0.2.1 | + | [trainee@centos8 ~]$ id root |
| - | PING 10.0.2.1 (10.0.2.1) 56(84) bytes of data. | + | uid=0(root) gid=0(root) groups=0(root) |
| - | 64 bytes from 10.0.2.1: icmp_seq=1 ttl=64 time=0.104 ms | + | |
| - | 64 bytes from 10.0.2.1: icmp_seq=2 ttl=64 time=0.325 ms | + | |
| - | 64 bytes from 10.0.2.1: icmp_seq=3 ttl=64 time=0.250 ms | + | |
| - | 64 bytes from 10.0.2.1: icmp_seq=4 ttl=64 time=0.123 ms | + | |
| - | --- 10.0.2.1 ping statistics --- | + | [trainee@centos8 ~]$ id -Z root |
| - | 4 packets transmitted, | + | id: cannot print security context when user specified |
| - | rtt min/ | + | |
| </ | </ | ||
| - | ===Options de la commande ping=== | + | ====Vérifier |
| - | Les options de cette commande | + | Il convient d' |
| < | < | ||
| - | [root@centos8 ~]# ping --help | + | [trainee@centos8 ~]$ cd /etc |
| - | ping: invalid option -- ' | + | |
| - | Usage: ping [-aAbBdDfhLnOqrRUvV64] [-c count] [-i interval] [-I interface] | + | [trainee@centos8 etc]$ ls -Z l* -d |
| - | [-m mark] [-M pmtudisc_option] [-l preload] [-p pattern] [-Q tos] | + | unconfined_u: |
| - | | + | |
| - | | + | |
| - | Usage: ping -6 [-aAbBdDfhLnOqrRUvV] [-c count] [-i interval] [-I interface] | + | |
| - | [-l preload] [-m mark] [-M pmtudisc_option] | + | |
| - | [-N nodeinfo_option] [-p pattern] [-Q tclass] [-s packetsize] | + | |
| - | [-S sndbuf] [-t ttl] [-T timestamp_option] [-w deadline] | + | |
| - | [-W timeout] destination | + | |
| </ | </ | ||
| - | ====2.2 - netstat -i==== | + | ====Troubleshooting SELinux==== |
| + | |||
| + | L' | ||
| + | |||
| + | Si le démon **auditd** est démarré, les messages de %%SELinux%% sont consignés dans le fichier **/ | ||
| + | |||
| + | ===La commande chcon=== | ||
| - | Pour visualiser les statistiques réseaux, vous disposez de la commande **netstat** : | + | La commande **chcon** permet de modifier // |
| < | < | ||
| - | [root@centos8 ~]# netstat | + | [trainee@centos8 etc]$ cd ~ |
| - | Kernel Interface table | + | |
| - | Iface | + | [trainee@centos8 ~]$ chcon --help |
| - | ens18 1500 | + | Usage: chcon [OPTION]... CONTEXT FILE... |
| - | lo 65536 10936 0 0 0 | + | |
| - | virbr0 | + | or: chcon [OPTION]... |
| + | Change the SELinux security context of each FILE to CONTEXT. | ||
| + | With --reference, change the security context of each FILE to that of RFILE. | ||
| + | |||
| + | Mandatory arguments to long options are mandatory for short options too. | ||
| + | | ||
| + | the default), rather than the symbolic link itself | ||
| + | -h, --no-dereference | ||
| + | -u, --user=USER | ||
| + | -r, --role=ROLE | ||
| + | -t, --type=TYPE | ||
| + | -l, --range=RANGE | ||
| + | --no-preserve-root | ||
| + | | ||
| + | --reference=RFILE | ||
| + | a CONTEXT value | ||
| + | -R, --recursive | ||
| + | -v, --verbose | ||
| + | |||
| + | The following options modify how a hierarchy is traversed when the -R | ||
| + | option is also specified. | ||
| + | one takes effect. | ||
| + | |||
| + | -H if a command line argument is a symbolic link | ||
| + | to a directory, traverse it | ||
| + | -L | ||
| + | | ||
| + | -P do not traverse any symbolic links (default) | ||
| + | |||
| + | --help | ||
| + | --version | ||
| + | |||
| + | GNU coreutils online help: < | ||
| + | Report chcon translation bugs to < | ||
| + | Full documentation at: < | ||
| + | or available locally via: info ' | ||
| </ | </ | ||
| - | ===Options de la commande netstat=== | + | HERE |
| - | Les options | + | Prenons le cas de la création d'un répertoire à la racine du système de fichiers afin d'y stocker les pages web du serveur apache |
| < | < | ||
| - | [root@centos8 ~]# netstat | + | [trainee@centos8 ~]$ su - |
| - | usage: netstat [-vWeenNcCF] [< | + | Password:fenestros |
| - | | + | |
| - | | + | |
| - | -r, --route | + | [root@centos8 ~]# mkdir /www |
| - | -I, --interfaces=<Iface> display interface table for < | + | [root@centos8 ~]# touch / |
| - | -i, --interfaces | + | </code> |
| - | -g, --groups | + | |
| - | -s, --statistics | + | |
| - | -M, --masquerade | + | |
| - | -v, --verbose | + | Installez maintenant le serveur Apache : |
| - | -W, --wide | + | |
| - | -n, --numeric | + | |
| - | --numeric-hosts | + | |
| - | --numeric-ports | + | |
| - | --numeric-users | + | |
| - | -N, --symbolic | + | |
| - | -e, --extend | + | |
| - | -p, --programs | + | |
| - | -o, --timers | + | |
| - | -c, --continuous | + | |
| - | -l, --listening | + | < |
| - | -a, --all display all sockets (default: connected) | + | [root@centos8 ~]# dnf install httpd -y |
| - | -F, --fib display Forwarding Information Base (default) | + | </ |
| - | -C, --cache | + | |
| - | -Z, --context | + | |
| - | | + | Modifiez ensuite la directive **%%DocumentRoot%%** dans le fichier **/ |
| - | {-x|--unix} --ax25 --ipx --netrom | + | |
| - | <AF>=Use ' | + | <file> |
| - | List of possible address families (which support routing): | + | [...] |
| - | | + | # |
| - | | + | DocumentRoot "/ |
| - | x25 (CCITT X.25) | + | [...] |
| + | </file> | ||
| + | |||
| + | Ajoutez les section **<Directory "/ | ||
| + | |||
| + | <file> | ||
| + | ... | ||
| + | < | ||
| + | AllowOverride None | ||
| + | # Allow open access: | ||
| + | | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | Options Indexes FollowSymLinks | ||
| + | AllowOverride None | ||
| + | Require all granted | ||
| + | </ | ||
| + | |||
| + | # Further relax access to the default document root: | ||
| + | < | ||
| + | ... | ||
| + | </file> | ||
| + | |||
| + | Créez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# cat / | ||
| + | < | ||
| + | < | ||
| + | This is a test | ||
| + | </ | ||
| + | < | ||
| + | www test page | ||
| + | </ | ||
| + | </ | ||
| </ | </ | ||
| - | ====2.3 | + | Modifiez ensuite le propriétaire et le groupe du répertoire **/www** et son contenu : |
| + | |||
| + | < | ||
| + | [root@centos8 ~]# chown -R apache: | ||
| + | </ | ||
| - | La commande ping est à la base de la commande | + | Dernièrement, |
| < | < | ||
| - | [root@centos8 ~]# traceroute | + | [root@centos8 ~]# touch /var/www/ |
| - | bash: traceroute: command not found... | + | </ |
| - | Install package 'traceroute' to provide command 'traceroute'? [N/y] y | + | |
| + | Redémarrez maintenant le service httpd : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# systemctl restart httpd.service | ||
| + | [root@centos8 ~]# systemctl status httpd.service | ||
| + | ● httpd.service - The Apache HTTP Server | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Main PID: 53680 (httpd) | ||
| + | | ||
| + | Tasks: 213 (limit: 100949) | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Oct 02 12:24:14 centos8.ittraining.loc systemd[1]: Starting The Apache HTTP Server... | ||
| + | Oct 02 12:24:15 centos8.ittraining.loc systemd[1]: Started The Apache HTTP Server. | ||
| + | Oct 02 12:24:15 centos8.ittraining.loc httpd[53680]: | ||
| + | </ | ||
| + | |||
| + | Passez SELinux en mode enforcing : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# setenforce enforcing | ||
| + | |||
| + | [root@centos8 ~]# getenforce | ||
| + | Enforcing | ||
| + | </ | ||
| + | |||
| + | Consultez le site localhost en utilisant **lynx** : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# lynx localhost | ||
| + | bash: lynx: command not found... | ||
| + | Install package 'lynx' to provide command 'lynx'? [N/y] y | ||
| * Waiting in queue... | * Waiting in queue... | ||
| + | * Loading list of packages.... | ||
| The following packages have to be installed: | The following packages have to be installed: | ||
| - | traceroute-3:2.1.0-6.el8.x86_64 | + | lynx-2.8.9-2.el8.x86_64 |
| Proceed with changes? [N/y] y | Proceed with changes? [N/y] y | ||
| Ligne 1108: | Ligne 2560: | ||
| * Requesting data... | * Requesting data... | ||
| * Testing changes... | * Testing changes... | ||
| - | * Installing packages... | + | * Installing packages... |
| - | traceroute | + | |
| - | 1 _gateway (10.0.2.1) 0.132 ms 0.101 ms 0.078 ms | + | HTTP Server Test Page |
| - | 2 79.137.68.252 (79.137.68.252) | + | |
| - | 3 10.50.24.61 (10.50.24.61) | + | This page is used to test the proper operation of the HTTP server after |
| - | 4 10.50.0.16 (10.50.0.16) | + | it has been installed. If you can read this page it means that this |
| - | 5 10.73.248.192 (10.73.248.192) | + | site is working properly. This server is powered by [1]CentOS. |
| - | 6 waw-wa2-sbb1-nc5.pl.eu (91.121.131.150) | + | __________________________________________________________________ |
| - | 7 fra-fr5-sbb1-nc5.de.eu (213.251.128.113) | + | |
| - | 8 10.200.0.6 (10.200.0.6) | + | If you are a member of the general public: |
| - | 9 decix.bb-a.fra3.fra.de.oneandone.net (80.81.192.123) 18.789 ms decix.bb-c.act.fra.de.oneandone.net (80.81.193.123) | + | |
| - | 10 ae-14.bb-b.fr7.fra.de.oneandone.net (212.227.120.149) | + | The website you just visited is either experiencing problems or is |
| - | 11 port-channel-3.gw-ngcs-1.dc1.con.glo.gb.oneandone.net (88.208.255.131) | + | |
| - | 12 109.228.63.209 (109.228.63.209) | + | |
| - | 13 * 109.228.63.209 (109.228.63.209) | + | If you would like to let the administrators of this website know that |
| - | 14 * * * | + | |
| - | 15 * * * | + | them e-mail. In general, mail sent to the name " |
| - | 16 * * * | + | to the website' |
| - | 17 * * * | + | |
| - | 18 * * * | + | For example, if you experienced problems while visiting |
| - | 19 * * * | + | www.example.com, you should send e-mail to " |
| - | 20 * * * | + | |
| - | 21 * * * | + | If you are the website administrator: |
| - | 22 * * * | + | |
| - | 23 * * * | + | You may now add content to the webroot directory. Note that until you |
| - | 24 * * * | + | do so, people visiting your website will see this page, and not your |
| - | 25 * * * | + | |
| - | 26 * * * | + | |
| - | 27 * * * | + | For systems using the Apache HTTP Server: You may now add content to |
| - | 28 * * * | + | the directory / |
| - | 29 * * *^C | + | |
| + | prevent this page from ever being used, follow the instructions in the | ||
| + | file / | ||
| + | |||
| + | For systems using NGINX: You should now put your content in a location | ||
| + | of your choice and edit the root configuration directive in the nginx | ||
| + | | ||
| + | |||
| + | [2][ Powered by CentOS ] [ Powered by CentOS ] | ||
| + | | ||
| + | |||
| + | Important note! | ||
| + | |||
| + | The CentOS Project has nothing to do with this website or its content, | ||
| + | it just provides the software that makes the website run. | ||
| + | |||
| + | If you have issues with the content of this site, contact the owner of | ||
| + | the domain, not the CentOS project. Unless you intended to visit | ||
| + | | ||
| + | | ||
| + | |||
| + | For example, if this website is www.example.com, you would find the | ||
| + | owner of the example.com domain at the following WHOIS server: | ||
| + | [3]http:// | ||
| + | |||
| + | © 2021 The CentOS Project | [4]Legal | [5]Privacy | ||
| + | |||
| + | References | ||
| + | |||
| + | 1. http:// | ||
| + | 2. https://www.centos.org/ | ||
| + | | ||
| + | 4. https://www.centos.org/legal/ | ||
| + | 5. https://www.centos.org/ | ||
| </ | </ | ||
| - | ===Options | + | Consultez les messages d' |
| - | Les options | + | < |
| + | [root@centos8 ~]# grep " | ||
| + | ... | ||
| + | Oct 2 12:44:28 centos8 setroubleshoot[57035]: | ||
| + | Oct 2 12:44:28 centos8 setroubleshoot[57035]: | ||
| + | Oct 2 12:44:38 centos8 setroubleshoot[57035]: | ||
| + | Oct 2 12:44:38 centos8 setroubleshoot[57035]: | ||
| + | </ | ||
| + | |||
| + | La commande **sealert** possède à la fois une interface graphique **et** un mode en ligne de commande. | ||
| < | < | ||
| - | [root@centos8 ~]# traceroute --help | + | [root@centos8 ~]# sealert |
| - | Usage: | + | SELinux |
| - | traceroute [ -46dFITnreAUDV ] [ -f first_ttl ] [ -g gate,... ] [ -i device ] [ -m max_ttl ] [ -N squeries ] [ -p port ] [ -t tos ] [ -l flow_label ] [ -w MAX, | + | |
| - | Options: | + | |
| - | -4 Use IPv4 | + | |
| - | -6 Use IPv6 | + | |
| - | -d --debug | + | |
| - | -F --dont-fragment | + | |
| - | -f first_ttl | + | |
| - | Start from the first_ttl hop (instead from 1) | + | |
| - | -g gate, | + | |
| - | Route packets through the specified gateway | + | |
| - | (maximum 8 for IPv4 and 127 for IPv6) | + | |
| - | -I --icmp | + | |
| - | -T --tcp Use TCP SYN for tracerouting (default port is 80) | + | |
| - | -i device | + | |
| - | Specify a network interface to operate with | + | |
| - | -m max_ttl | + | |
| - | Set the max number of hops (max TTL to be | + | |
| - | reached). Default is 30 | + | |
| - | -N squeries | + | |
| - | Set the number of probes to be tried | + | |
| - | simultaneously (default is 16) | + | |
| - | -n Do not resolve IP addresses to their domain names | + | |
| - | -p port --port=port | + | |
| - | initial udp port value for " | + | |
| - | (incremented by each probe, default is 33434), or | + | |
| - | initial seq for " | + | |
| - | default | + | |
| - | port for other methods (with default of 80 for | + | |
| - | " | + | |
| - | -t tos --tos=tos | + | |
| - | traffic class) value for outgoing packets | + | |
| - | -l flow_label | + | |
| - | Use specified flow_label for IPv6 packets | + | |
| - | -w MAX, | + | |
| - | Wait for a probe no more than HERE (default 3) | + | |
| - | times longer than a response from the same hop, | + | |
| - | or no more than NEAR (default 10) times than some | + | |
| - | next hop, or MAX (default 5.0) seconds (float | + | |
| - | point values allowed too) | + | |
| - | -q nqueries | + | |
| - | Set the number of probes per each hop. Default is | + | |
| - | 3 | + | |
| - | -r Bypass the normal routing and send directly to a | + | |
| - | host on an attached network | + | |
| - | -s src_addr | + | |
| - | Use source src_addr for outgoing packets | + | |
| - | -z sendwait | + | |
| - | Minimal time interval between probes (default 0). | + | |
| - | If the value is more than 10, then it specifies a | + | |
| - | number in milliseconds, | + | |
| - | seconds (float point values allowed too) | + | |
| - | -e --extensions | + | |
| - | -A --as-path-lookups | + | |
| - | print results directly after the corresponding | + | |
| - | addresses | + | |
| - | -M name --module=name | + | |
| - | for traceroute operations. Most methods have | + | |
| - | their shortcuts (`-I' means `-M icmp' etc.) | + | |
| - | -O OPTS, | + | |
| - | Use module-specific option OPTS for the | + | |
| - | traceroute module. Several OPTS allowed, | + | |
| - | separated by comma. If OPTS is " | + | |
| - | about available options | + | |
| - | --sport=num | + | |
| - | `-N 1' | + | |
| - | --fwmark=num | + | |
| - | -U --udp Use UDP to particular port for tracerouting | + | |
| - | (instead of increasing the port per each probe), | + | |
| - | default port is 53 | + | |
| - | -UL Use UDPLITE for tracerouting (default dest port | + | |
| - | is 53) | + | |
| - | -D --dccp | + | |
| - | is 33434) | + | |
| - | -P prot --protocol=prot | + | |
| - | --mtu | + | |
| - | `-F -N 1' | + | |
| - | --back | + | |
| - | print if it differs | + | |
| - | -V --version | + | |
| - | --help | + | |
| - | Arguments: | + | ***** Plugin catchall |
| - | + | + | |
| - | packetlen | + | |
| - | header plus 40). Can be ignored or increased to a minimal | + | |
| - | allowed value | + | |
| - | </ | + | |
| - | =====LAB | + | If you believe that httpd should have the net_admin capability by default. |
| + | Then you should report this as a bug. | ||
| + | You can generate a local policy module to allow this access. | ||
| + | Do | ||
| + | allow this access for now by executing: | ||
| + | # ausearch | ||
| + | # semodule -X 300 -i my-httpd.pp | ||
| - | ==== 3.1 - Telnet ==== | ||
| - | <WRAP center round important> | + | Additional Information: |
| - | **Important** | + | Source Context |
| - | </ | + | Target Context |
| + | Target Objects | ||
| + | Source | ||
| + | Source Path / | ||
| + | Port | ||
| + | Host centos8.ittraining.loc | ||
| + | Source RPM Packages | ||
| + | Target RPM Packages | ||
| + | SELinux Policy RPM selinux-policy-targeted-3.14.3-80.el8_5.2.noarch | ||
| + | Local Policy RPM selinux-policy-targeted-3.14.3-80.el8_5.2.noarch | ||
| + | Selinux Enabled | ||
| + | Policy Type | ||
| + | Enforcing Mode Enforcing | ||
| + | Host Name | ||
| + | Platform | ||
| + | 4.18.0-348.7.1.el8_5.x86_64 #1 SMP Wed Dec 22 | ||
| + | 13:25:12 UTC 2021 x86_64 x86_64 | ||
| + | Alert Count 110 | ||
| + | First Seen 2024-10-02 12:24:14 CEST | ||
| + | Last Seen | ||
| + | Local ID a169ef1e-7a43-47d5-ac8f-36d5459c82b6 | ||
| - | La commande **telnet** est utilisée pour établir une connexion à distance avec un serveur telnet | + | Raw Audit Messages |
| + | type=AVC msg=audit(1727866125.775:861): avc: denied | ||
| - | < | ||
| - | # telnet numero_ip | ||
| - | </ | ||
| - | <WRAP center round important 60%> | + | Hash: httpd, |
| - | **Important** - Le service telnet revient à une redirection des canaux standards d' | + | </code> |
| - | </WRAP> | + | |
| - | ===Options de la commande telnet=== | + | Ce message a été généré parce que le repertoire /www ainsi que le fichier index.html ne possèdent pas le **type** nécessaire pour que le service apache puisse les utiliser : |
| - | Les options de cette commande sont : | + | < |
| + | [root@centos8 ~]# ls -Z / | ||
| + | unconfined_u:object_r: | ||
| + | </ | ||
| < | < | ||
| - | [[root@centos8 ~]# telnet | + | [root@centos8 ~]# ls -Z / |
| - | telnet: invalid option -- ' | + | unconfined_u:object_r:httpd_sys_content_t: |
| - | Usage: telnet [-4] [-6] [-8] [-E] [-L] [-S tos] [-a] [-c] [-d] [-e char] [-l user] | + | |
| - | [-n tracefile] [-b hostalias ] [-r] | + | |
| - | | + | |
| </ | </ | ||
| - | ==== 3.2 - wget ==== | + | L' |
| - | La commande **wget** est utilisée pour récupérer un fichier via http, https ou ftp : | + | Pour vérifier la cause de l' |
| < | < | ||
| - | [root@centos8 ~]# wget https://www.dropbox.com/s/wk79lkfr6f12u9j/wget_file.txt | + | [root@centos8 ~]# grep "/www/index.html" |
| ... | ... | ||
| + | Oct 2 12:44:48 centos8 setroubleshoot[57035]: | ||
| + | ... | ||
| + | </ | ||
| - | [root@centos8 ~]# cat wget_file.txt | + | Modifiez donc la SC de /www et / |
| - | This is a file retrieved by the wget command. | + | |
| + | < | ||
| + | [root@centos8 ~]# chcon -Rv --type=httpd_sys_content_t /www | ||
| + | changing security context of '/ | ||
| + | changing security context of '/ | ||
| + | |||
| + | [root@centos8 ~]# ls -Z /www/index.html | ||
| + | unconfined_u: | ||
| </ | </ | ||
| - | ===Options | + | Afin de maintenir ces SC lors d'une **restauration des SC par défaut**, il convient d' |
| - | Les options de cette commande sont : | + | < |
| + | [root@centos8 ~]# semanage fcontext -a -t httpd_sys_content_t "/ | ||
| + | </ | ||
| + | |||
| + | Vérifiez que ces modifications fonctionnent | ||
| < | < | ||
| - | [root@centos8 ~]# wget --help | + | [root@centos8 ~]# lynx --dump localhost |
| - | GNU Wget 1.19.5, a non-interactive network retriever. | + | www test page |
| - | Usage: wget [OPTION]... [URL]... | + | </ |
| - | Mandatory arguments to long options are mandatory for short options too. | + | ====La commande restorecon==== |
| - | Startup: | + | < |
| - | -V, --version | + | usage: |
| - | -h, --help | + | </ |
| - | -b, --background | + | |
| - | | + | |
| - | Logging and input file: | + | Pour illustrer l' |
| - | -o, | + | |
| - | -a, --append-output=FILE | + | |
| - | -d, --debug | + | |
| - | -q, --quiet | + | |
| - | -v, --verbose | + | |
| - | -nv, --no-verbose | + | |
| - | | + | |
| - | -i, --input-file=FILE | + | |
| - | | + | |
| - | -F, --force-html treat input file as HTML | + | |
| - | -B, --base=URL | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Download: | + | < |
| - | | + | [root@centos8 ~]# cd /tmp ; touch copy.html move.html |
| - | | + | |
| - | | + | |
| - | -O, --output-document=FILE | + | |
| - | -nc, --no-clobber | + | |
| - | | + | |
| - | | + | |
| - | -c, --continue | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -N, --timestamping | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | the one on the server | + | |
| - | -S, --server-response | + | |
| - | | + | |
| - | -T, --timeout=SECONDS | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -w, --wait=SECONDS | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -Q, --quota=NUMBER | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -4, --inet4-only | + | |
| - | -6, --inet6-only | + | |
| - | | + | |
| - | one of IPv6, IPv4, or none | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Directories: | + | [root@centos8 tmp]# ls -Z | grep html |
| - | -nd, --no-directories | + | unconfined_u: |
| - | | + | unconfined_u: |
| - | -nH, --no-host-directories | + | </code> |
| - | --protocol-directories | + | |
| - | -P, --directory-prefix=PREFIX | + | |
| - | | + | |
| - | HTTP options: | + | **Copiez** le fichier copy.html vers /var/ |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | this is 'index.html'.) | + | |
| - | -E, --adjust-extension | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -U, --user-agent=AGENT | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | HTTPS (SSL/TLS) options: | + | < |
| - | --secure-protocol=PR | + | [root@centos8 tmp]# cp copy.html / |
| - | SSLv3, TLSv1, TLSv1_1, TLSv1_2 and PFS | + | [root@centos8 tmp]# mv move.html / |
| - | --https-only | + | [root@centos8 tmp]# ls -Z /var/www/html |
| - | | + | unconfined_u: |
| - | | + | </code> |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | of base64 encoded sha256 hashes preceded by | + | |
| - | ' | + | |
| - | peer against | + | |
| - | | + | <WRAP center round important 50%> |
| - | Use with care. This option overrides --secure-protocol. | + | **Important** : Notez ici que copy.html a pris le type du répertoire de destination tandis que move.html retient le type obtenu lors de sa création. |
| - | The format and syntax of this string depend on the specific SSL/TLS engine. | + | </WRAP> |
| - | HSTS options: | + | |
| - | | + | |
| - | | + | |
| - | FTP options: | + | Restaurez maintenant la SC par défaut de move.html compte tenu de son emplacement en utilisant la commande **restorecon** : |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | FTPS options: | + | < |
| - | --ftps-implicit | + | [root@centos8 tmp]# restorecon |
| - | | + | Relabeled /var/www/ |
| - | opening a data connection | + | |
| - | | + | |
| - | | + | |
| - | WARC options: | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | WARC writer | + | |
| - | Recursive download: | + | [root@centos8 tmp]# ls -Z / |
| - | | + | unconfined_u: |
| - | | + | </ |
| - | | + | |
| - | -k, --convert-links | + | |
| - | local files | + | |
| - | | + | |
| - | | + | |
| - | -K, --backup-converted | + | |
| - | -m, --mirror | + | |
| - | -p, --page-requisites | + | |
| - | --strict-comments | + | |
| - | Recursive accept/ | + | ====Le fichier / |
| - | -A, --accept=LIST | + | |
| - | -R, --reject=LIST | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -D, --domains=LIST | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -H, --span-hosts | + | |
| - | -L, --relative | + | |
| - | -I, --include-directories=LIST list of allowed directories | + | |
| - | | + | |
| - | | + | |
| - | -X, --exclude-directories=LIST list of excluded directories | + | |
| - | -np, --no-parent | + | |
| - | Email bug reports, questions, discussions to < | + | En cas de besoin il est intéressant de pouvoir restaurer les SC par défaut sur l' |
| - | and/or open issues at https:// | + | |
| + | <code> | ||
| + | [root@centos8 tmp]# touch /.autorelabel | ||
| + | [root@centos8 tmp]# shutdown -r now | ||
| </ | </ | ||
| - | ==== 3.3 - ftp ==== | + | < |
| + | root@computeXX: | ||
| + | trainee@10.0.2.45' | ||
| + | Activate the web console with: systemctl enable | ||
| - | <WRAP center round important 60%> | + | Last login: Wed Oct 2 11:47:29 2024 from 10.0.2.1 |
| - | **Important** | + | [trainee@centos8 ~]$ su - |
| - | </WRAP> | + | Password: fenestros |
| + | </code> | ||
| + | |||
| + | ====La commande semanage==== | ||
| - | La commande **ftp** est utilisée pour le transfert de fichiers. Une fois connecté, il convient d' | + | La commande **semanage** peut prendre plusieurs options |
| < | < | ||
| - | ftp> | + | [root@centos8 ~]# semanage --help |
| - | Commands may be abbreviated. | + | usage: semanage [-h] |
| + | {import, | ||
| + | ... | ||
| - | ! debug mdir sendport site | + | semanage is used to configure certain elements of SELinux policy with-out |
| - | $ dir mget put size | + | requiring modification to or recompilation from policy source. |
| - | account disconnect mkdir pwd status | + | |
| - | append exit mls quit struct | + | positional arguments: |
| - | ascii form mode quote system | + | |
| - | bell get modtime recv sunique | + | |
| - | binary glob mput reget tenex | + | |
| - | bye hash newer rstatus tick | + | |
| - | case help nmap rhelp trace | + | |
| - | cd idle nlist rename type | + | |
| - | cdup image ntrans reset user | + | |
| - | chmod lcd open restart umask | + | |
| - | close ls prompt rmdir verbose | + | |
| - | cr macdef passive runique ? | + | |
| - | delete mdelete proxy send | + | |
| - | ftp> | + | |
| + | node Manage network node type definitions | ||
| + | fcontext | ||
| + | boolean | ||
| + | permissive | ||
| + | dontaudit | ||
| + | |||
| + | optional arguments: | ||
| + | -h, --help | ||
| </ | </ | ||
| - | Le caractère | + | Pour illustrer l' |
| + | |||
| + | %%SELinux%% gère aussi l'accès aux ports par les différents serveurs. La liste complète des ports autorisés par serveur puet être visualiser à l'aide de la commande **semanage** : | ||
| < | < | ||
| - | ftp> !pwd | + | [root@centos8 ~]# semanage port -l |
| - | /root | + | SELinux Port Type Proto Port Number |
| + | |||
| + | afs3_callback_port_t | ||
| + | afs3_callback_port_t | ||
| + | afs_bos_port_t | ||
| + | afs_fs_port_t | ||
| + | afs_fs_port_t | ||
| + | afs_ka_port_t | ||
| + | afs_pt_port_t | ||
| + | afs_pt_port_t | ||
| + | afs_vl_port_t | ||
| + | agentx_port_t | ||
| + | agentx_port_t | ||
| + | amanda_port_t | ||
| + | amanda_port_t | ||
| + | amavisd_recv_port_t | ||
| + | amavisd_send_port_t | ||
| + | amqp_port_t | ||
| + | amqp_port_t | ||
| + | aol_port_t | ||
| + | aol_port_t | ||
| + | apc_port_t | ||
| + | apc_port_t | ||
| + | apcupsd_port_t | ||
| + | apcupsd_port_t | ||
| + | apertus_ldp_port_t | ||
| + | apertus_ldp_port_t | ||
| + | appswitch_emp_port_t | ||
| + | appswitch_emp_port_t | ||
| + | asterisk_port_t | ||
| + | asterisk_port_t | ||
| + | audit_port_t | ||
| + | auth_port_t | ||
| + | babel_port_t | ||
| + | bacula_port_t | ||
| + | bacula_port_t | ||
| + | bctp_port_t | ||
| + | bctp_port_t | ||
| + | bfd_control_port_t | ||
| + | bfd_control_port_t | ||
| + | bgp_port_t | ||
| + | bgp_port_t | ||
| + | boinc_client_port_t | ||
| + | boinc_client_port_t | ||
| + | boinc_port_t | ||
| + | brlp_port_t | ||
| + | certmaster_port_t | ||
| + | chronyd_port_t | ||
| + | clamd_port_t | ||
| + | clockspeed_port_t | ||
| + | cluster_port_t | ||
| + | cluster_port_t | ||
| + | cma_port_t | ||
| + | cma_port_t | ||
| + | cobbler_port_t | ||
| + | collectd_port_t | ||
| + | commplex_link_port_t | ||
| + | commplex_link_port_t | ||
| + | commplex_main_port_t | ||
| + | commplex_main_port_t | ||
| + | comsat_port_t | ||
| + | condor_port_t | ||
| + | condor_port_t | ||
| + | conman_port_t | ||
| + | conman_port_t | ||
| + | connlcli_port_t | ||
| + | connlcli_port_t | ||
| + | conntrackd_port_t | ||
| + | couchdb_port_t | ||
| + | couchdb_port_t | ||
| + | ctdb_port_t | ||
| + | ctdb_port_t | ||
| + | cvs_port_t | ||
| + | cvs_port_t | ||
| + | cyphesis_port_t | ||
| + | cyphesis_port_t | ||
| + | cyrus_imapd_port_t | ||
| + | daap_port_t | ||
| + | daap_port_t | ||
| + | dbskkd_port_t | ||
| + | dcc_port_t | ||
| + | dccm_port_t | ||
| + | dccm_port_t | ||
| + | dey_keyneg_port_t | ||
| + | dey_keyneg_port_t | ||
| + | dey_sapi_port_t | ||
| + | dhcpc_port_t | ||
| + | dhcpc_port_t | ||
| + | dhcpd_port_t | ||
| + | dhcpd_port_t | ||
| + | dict_port_t | ||
| + | distccd_port_t | ||
| + | dns_port_t | ||
| + | dns_port_t | ||
| + | dnssec_port_t | ||
| + | dogtag_port_t | ||
| + | echo_port_t | ||
| + | echo_port_t | ||
| + | efs_port_t | ||
| + | embrace_dp_c_port_t | ||
| + | embrace_dp_c_port_t | ||
| + | ephemeral_port_t | ||
| + | ephemeral_port_t | ||
| + | epmap_port_t | ||
| + | epmap_port_t | ||
| + | epmd_port_t | ||
| + | epmd_port_t | ||
| + | fac_restore_port_t | ||
| + | fac_restore_port_t | ||
| + | fingerd_port_t | ||
| + | firepower_port_t | ||
| + | firepower_port_t | ||
| + | flash_port_t | ||
| + | flash_port_t | ||
| + | fmpro_internal_port_t | ||
| + | fmpro_internal_port_t | ||
| + | freeipmi_port_t | ||
| + | freeipmi_port_t | ||
| + | ftp_data_port_t | ||
| + | ftp_port_t | ||
| + | ftp_port_t | ||
| + | gatekeeper_port_t | ||
| + | gatekeeper_port_t | ||
| + | gdomap_port_t | ||
| + | gdomap_port_t | ||
| + | gds_db_port_t | ||
| + | gds_db_port_t | ||
| + | gear_port_t | ||
| + | gear_port_t | ||
| + | geneve_port_t | ||
| + | giftd_port_t | ||
| + | git_port_t | ||
| + | git_port_t | ||
| + | glance_port_t | ||
| + | glance_port_t | ||
| + | glance_registry_port_t | ||
| + | glance_registry_port_t | ||
| + | gluster_port_t | ||
| + | gopher_port_t | ||
| + | gopher_port_t | ||
| + | gpsd_port_t | ||
| + | hadoop_datanode_port_t | ||
| + | hadoop_namenode_port_t | ||
| + | hddtemp_port_t | ||
| + | hi_reserved_port_t | ||
| + | hi_reserved_port_t | ||
| + | hi_reserved_port_t | ||
| + | howl_port_t | ||
| + | howl_port_t | ||
| + | hplip_port_t | ||
| + | http_cache_port_t | ||
| + | http_cache_port_t | ||
| + | http_port_t | ||
| + | ... | ||
| </ | </ | ||
| - | Pour transférer un fichier vers le serveur, il convient | + | Notez par exemple que le serveur |
| < | < | ||
| - | ftp> put nom_fichier_local nom_fichier_distant | + | http_port_t |
| </ | </ | ||
| - | Vous pouvez également transférer plusieurs fichiers | + | Dans le cas où on souhaite qu' |
| + | |||
| + | < | ||
| + | [root@centos8 ~]# semanage port -a -t http_port_t -p tcp 8090 | ||
| + | </ | ||
| + | |||
| + | Vous noterez que le port 8090 a été ajouté | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# semanage port -l | grep http | ||
| + | http_cache_port_t | ||
| + | http_cache_port_t | ||
| + | http_port_t | ||
| + | pegasus_http_port_t | ||
| + | pegasus_https_port_t | ||
| + | </ | ||
| + | |||
| + | ====La commande audit2allow==== | ||
| + | |||
| + | La création d'un module de politique personnalisé se fait en utilisant | ||
| + | |||
| + | * la résolution du problème n'est pas possible en utilisant une des commandes précédemment citées, | ||
| + | * il n' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# audit2allow --help | ||
| + | Usage: audit2allow [options] | ||
| + | |||
| + | Options: | ||
| + | --version | ||
| + | -h, --help | ||
| + | -b, --boot | ||
| + | -a, --all read input from audit log - conflicts with -i | ||
| + | -p POLICY, --policy=POLICY | ||
| + | Policy file to use for analysis | ||
| + | -d, --dmesg | ||
| + | --input | ||
| + | -i INPUT, --input=INPUT | ||
| + | read input from < | ||
| + | -l, --lastreload | ||
| + | -r, --requires | ||
| + | -m MODULE, --module=MODULE | ||
| + | set the module name - implies --requires | ||
| + | -M MODULE_PACKAGE, | ||
| + | generate a module package - conflicts with -o and -m | ||
| + | -o OUTPUT, --output=OUTPUT | ||
| + | append output to < | ||
| + | -D, --dontaudit | ||
| + | -R, --reference | ||
| + | -N, --noreference | ||
| + | -v, --verbose | ||
| + | -e, --explain | ||
| + | -t TYPE, --type=TYPE | ||
| + | regex | ||
| + | --perm-map=PERM_MAP | ||
| + | --interface-info=INTERFACE_INFO | ||
| + | file name of interface information | ||
| + | -x, --xperms | ||
| + | --debug | ||
| + | -w, --why | ||
| + | of why the access was denied | ||
| + | </ | ||
| + | |||
| + | Pour illustrer l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 tmp]# mkdir /www1 | ||
| + | [root@centos8 tmp]# touch / | ||
| + | </ | ||
| + | |||
| + | Éditez le fichier **/ | ||
| < | < | ||
| - | ftp> mput nom*.* | + | [...] |
| + | # | ||
| + | DocumentRoot "/ | ||
| + | [...] | ||
| </ | </ | ||
| - | Pour transférer un fichier du serveur, il convient d' | + | Ajoutez les section |
| < | < | ||
| - | ftp> get nom_fichier | + | ... |
| + | < | ||
| + | AllowOverride None | ||
| + | # Allow open access: | ||
| + | Require all granted | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | Options Indexes FollowSymLinks | ||
| + | AllowOverride None | ||
| + | Require all granted | ||
| + | </ | ||
| + | |||
| + | # Further relax access to the default document root: | ||
| + | < | ||
| + | ... | ||
| </ | </ | ||
| - | Vous pouvez également transférer plusieurs fichiers à la fois grâce à la commande | + | Créez le fichier |
| - | Pour supprimer un fichier sur le serveur, il convient d' | + | < |
| + | [root@centos8 ~]# vi / | ||
| + | [root@centos8 ~]# cat / | ||
| + | < | ||
| + | < | ||
| + | This is a test | ||
| + | </ | ||
| + | < | ||
| + | www1 test page | ||
| + | </ | ||
| + | </ | ||
| + | </ | ||
| - | < | + | Modifiez ensuite le propriétaire et le groupe du répertoire **/www1** et son contenu : |
| - | ftp> del nom_fichier | + | |
| - | </file> | + | |
| - | Pour fermer la session, il convient d' | + | < |
| + | [root@centos8 ~]# chown -R apache: | ||
| + | </ | ||
| + | |||
| + | Redémarrez le service httpd : | ||
| < | < | ||
| - | ftp> quit | + | [root@centos8 ~]# systemctl restart httpd.service |
| - | [root@centos7 | + | [root@centos8 |
| + | ● httpd.service - The Apache HTTP Server | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Main PID: 3255 (httpd) | ||
| + | | ||
| + | Tasks: 213 (limit: 100949) | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Oct 02 13:17:31 centos8.ittraining.loc systemd[1]: Starting The Apache HTTP Server... | ||
| + | Oct 02 13:17:32 centos8.ittraining.loc systemd[1]: Started The Apache HTTP Server. | ||
| + | Oct 02 13:17:32 centos8.ittraining.loc httpd[3255]: | ||
| </ | </ | ||
| - | ====3.4 - SSH==== | + | Consultez le site localhost en utilisant **lynx** : |
| - | ===Présentation=== | + | < |
| + | [root@centos8 ~]# lynx --dump localhost | ||
| + | HTTP Server Test Page | ||
| - | La commande **[[wpfr> | + | This page is used to test the proper operation of the HTTP server after |
| + | it has been installed. If you can read this page it means that this | ||
| + | site is working properly. This server is powered by [1]CentOS. | ||
| + | | ||
| - | * Le **serveur SSH** | + | If you are a member of the general public: |
| - | * le démon sshd, qui s' | + | |
| - | * Le **client SSH** | + | |
| - | * ssh ou scp, qui assure la connexion et le dialogue avec le serveur, | + | |
| - | * La **session** qui représente la connexion courante et qui commence juste après l' | + | |
| - | * Les **clefs** | + | |
| - | * **Couple de clef utilisateur asymétriques** et persistantes qui assurent l' | + | |
| - | * **Clef hôte asymétrique et persistante** garantissant l' | + | |
| - | * **Clef serveur asymétrique et temporaire** utilisée par le protocole SSH1 qui sert au chiffrement de la clé de session, | + | |
| - | * **Clef de session symétrique qui est générée aléatoirement** et qui permet le chiiffrement de la communication entre le client et le serveur. Elle est détruite en fin de session. SSH-1 utilise une seule clef tandis que SSH-2 utilise une clef par direction de la communication, | + | |
| - | * La **base de données des hôtes connus** qui stocke les clés des connexions précédentes. | + | |
| - | SSH fonctionne de la manière suivante pour la la mise en place d'un canal sécurisé: | + | The website you just visited is either experiencing problems or is |
| + | | ||
| - | | + | If you would like to let the administrators of this website know that |
| - | * Les client et le serveur échangent leur version de SSH. En cas de non-compatibilité de versions, l'un des deux met fin au processus, | + | |
| - | * Le serveur SSH s' | + | them e-mail. In general, mail sent to the name " |
| - | * Sa clé hôte, | + | to the website' |
| - | * Sa clé serveur, | + | |
| - | * Une séquence aléatoire de huit octets à inclure dans les futures réponses du client, | + | |
| - | * Une liste de méthodes de chiffrage, compression et authentification, | + | |
| - | * Le client et le serveur produisent un identifiant identique, un haché MD5 long de 128 bits contenant la clé hôte, la clé serveur et la séquence aléatoire, | + | |
| - | * Le client génère sa clé de session symétrique et la chiffre deux fois de suite, une fois avec la clé hôte du serveur et la deuxième fois avec la clé serveur. Le client envoie cette clé au serveur accompagnée de la séquence aléatoire et un choix d' | + | |
| - | * Le serveur déchiffre la clé de session, | + | |
| - | * Le client et le serveur mettent en place le canal sécurisé. | + | |
| - | ==SSH-1== | + | For example, if you experienced problems while visiting |
| + | | ||
| - | SSH-1 utilise une paire de clefs de type RSA1. Il assure l' | + | If you are the website administrator: |
| - | Afin de s' | + | You may now add content to the webroot directory. Note that until you |
| + | do so, people visiting your website will see this page, and not your | ||
| + | | ||
| - | | + | For systems using the Apache HTTP Server: You may now add content to |
| - | * **Rhosts**, | + | |
| - | * **%%RhostsRSA%%**, | + | visiting your website will see this page, and not your content. To |
| - | * Par **clef asymétrique**, | + | prevent this page from ever being used, follow the instructions in the |
| - | * **TIS**, | + | file / |
| - | * Par **mot de passe**. | + | |
| - | ==SSH-2== | + | For systems using NGINX: You should now put your content in a location |
| + | of your choice and edit the root configuration directive in the nginx | ||
| + | | ||
| - | SSH-2 utilise **DSA** ou **RSA**. Il assure l' | + | [2][ Powered by CentOS ] [ Powered by CentOS ] |
| + | | ||
| - | * **SSH-TRANS** – Transport Layer Protocol, | + | Important note! |
| - | * **SSH-AUTH** – Authentification Protocol, | + | |
| - | * **SSH-CONN** – Connection Protocol. | + | |
| - | SSH-2 diffère de SSH-1 essentiellement dans la phase authentification. | + | The CentOS Project has nothing to do with this website or its content, |
| + | it just provides the software that makes the website run. | ||
| - | Trois méthodes d' | + | If you have issues with the content of this site, contact the owner of |
| + | the domain, not the CentOS project. Unless you intended to visit | ||
| + | | ||
| + | | ||
| - | * Par **clef asymétrique**, | + | For example, if this website is www.example.com, you would find the |
| - | * Identique à SSH-1 sauf avec l' | + | owner of the example.com domain at the following WHOIS server: |
| - | * **%%RhostsRSA%%**, | + | |
| - | * Par **mot de passe**. | + | |
| - | ==Options de la commande== | + | © 2021 The CentOS Project | [4]Legal | [5]Privacy |
| - | Les options | + | References |
| + | |||
| + | 1. http:// | ||
| + | 2. https:// | ||
| + | 3. http:// | ||
| + | 4. https:// | ||
| + | 5. https:// | ||
| + | </ | ||
| + | |||
| + | Le fichier **/ | ||
| < | < | ||
| - | [root@centos8 ~]# ssh --help | + | Oct 2 13:20:57 centos8 setroubleshoot[3502]: SELinux is preventing / |
| - | unknown option -- - | + | Oct 2 13:20:57 centos8 setroubleshoot[3502]: SELinux is preventing / |