Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:centos:8:avance:l114 [2024/10/01 12:38] – admin | elearning:workbooks:centos:8:avance:l114 [2024/10/18 07:58] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 5: | Ligne 5: | ||
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LCF606 - Gestion de Netfilter et de Firewalld====== | + | ======LCF606 - Gestion de la Sécurité====== |
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| - | * **LCF606 - Gestion de Netfilter et de Firewalld** | + | * **LCF606 - Gestion de la Sécurité** |
| * Contenu du Module | * Contenu du Module | ||
| - | | + | * Le Pare-feu Netfilter/ |
| - | * L'IP Spoofing | + | |
| - | * Déni de Service (DoS) | + | |
| - | * SYN Flooding | + | |
| - | * Flood | + | |
| - | * Le Contre-Mesure | + | |
| - | | + | |
| * LAB #1 - La Configuration par firewalld | * LAB #1 - La Configuration par firewalld | ||
| * La Configuration de Base de firewalld | * La Configuration de Base de firewalld | ||
| Ligne 23: | Ligne 17: | ||
| * La Configuration Avancée de firewalld | * La Configuration Avancée de firewalld | ||
| * Le mode Panic de firewalld | * Le mode Panic de firewalld | ||
| + | * System Hardening | ||
| + | * Les compilateurs | ||
| + | * Les paquets | ||
| + | * Les démons et services | ||
| + | * Les fichiers .rhosts | ||
| + | * Les fichiers et les repertoires sans proprietaire | ||
| + | * Limiter le delai d' | ||
| + | * Renforcer la securite d'init | ||
| + | * Les Distributions SysVInit | ||
| + | * Les Distributions Upstart | ||
| + | * Renforcer la sécurité du Noyau | ||
| + | * La commande sysctl | ||
| + | * Mise en place de SELinux pour sécuriser le serveur | ||
| + | * Introducton | ||
| + | * Définitions | ||
| + | * Security Context | ||
| + | * Domains et Types | ||
| + | * Roles | ||
| + | * Politiques de Sécurité | ||
| + | * Langage de Politiques | ||
| + | * allow | ||
| + | * type | ||
| + | * type_transition | ||
| + | * Décisions de SELinux | ||
| + | * Décisions d' | ||
| + | * Décisions de Transition | ||
| + | * Commandes SELinux | ||
| + | * Les Etats de SELinux | ||
| + | * Booléens | ||
| + | * LAB #2 - Travailler avec SELinux | ||
| + | * Copier et Déplacer des Fichiers | ||
| + | * Vérifier les SC des Processus | ||
| + | * Visualiser la SC d'un Utilisateur | ||
| + | * Vérifier la SC d'un fichier | ||
| + | * Troubleshooting SELinux | ||
| + | * La commande chcon | ||
| + | * La commande restorecon | ||
| + | * Le fichier / | ||
| + | * La commande semanage | ||
| + | * La commande audit2allow | ||
| + | * Mots de Passe | ||
| + | * LAB #3 - John the Ripper | ||
| + | * LAB #4 - Mise en place du Système de Prévention d' | ||
| + | * Installation | ||
| + | * Configuration | ||
| + | * Le répertoire / | ||
| + | * Le fichier fail2ban.conf | ||
| + | * Le répertoire / | ||
| + | * Le répertoire / | ||
| + | * Commandes | ||
| + | * Activer et Démarrer le Serveur | ||
| + | * Utiliser la Commande Fail2Ban-server | ||
| + | * Ajouter un Prison | ||
| + | * Balayage des Ports | ||
| + | * LAB #5 - Utilisation de nmap et de netcat | ||
| + | * nmap | ||
| + | * Installation | ||
| + | * Utilisation | ||
| + | * Fichiers de Configuration | ||
| + | * Scripts | ||
| + | * netcat | ||
| + | * Utilisation | ||
| + | * LAB #6 - Mise en place du Système de Détection et de Prévention d' | ||
| + | * Installation | ||
| + | * Configuration | ||
| + | * Utilisation | ||
| + | * Système de Fichiers | ||
| + | * LAB #7 - Mise en place du File Integrity Checker Afick | ||
| + | * Présentation | ||
| + | * Installation | ||
| + | * Configuration | ||
| + | * La Section Directives | ||
| + | * La Section Alias | ||
| + | * La Section File | ||
| + | * Utilisation | ||
| + | * Automatiser Afick | ||
| + | * LAB #8 - Mise en place de rkhunter | ||
| + | * Installation | ||
| + | * Les options de la commande | ||
| + | * Utilisation | ||
| + | * Configuration | ||
| - | =====Les Problématiques===== | ||
| - | ====L' | + | =====Le Pare-feu Netfilter===== |
| - | + | ||
| - | L'IP Spoofing consiste en faire croire à un serveur que sa machine possède une adresse IP autre que celle réellement attribuée. Le but de cette opération est de se placer en tant que point de passage obligatoire des paquets envoyés entre le serveur et le vrai // | + | |
| - | + | ||
| - | * L' | + | |
| - | * L' | + | |
| - | * L' | + | |
| - | * Le serveur accepte la requête car elle provient d'une adresse IP à laquelle il peux faire confiance et renvoie une réponse en utilisant la route spécifiée par l' | + | |
| - | * Le client utilise la route spécifiée par l' | + | |
| - | + | ||
| - | ====Déni de Service (DoS)==== | + | |
| - | + | ||
| - | Une attaque de déni de service consiste à rendre inopérable une machine en lui envoyant une grande quantité de données inutiles. Un exemple de ce type d' | + | |
| - | + | ||
| - | * L' | + | |
| - | * Il envoie ensuite un ping à une machine de diffusion, | + | |
| - | * La machine de diffusion envoie ce même ping à un grand nombre de clients en spécifiant l' | + | |
| - | * L' | + | |
| - | * Tous les clients renvoie une réponse au ping //en même temps// à la cible. | + | |
| - | + | ||
| - | ====SYN Flooding==== | + | |
| - | + | ||
| - | Le **SYN Flooding**, aussi appelé un //SYN-ACK Attack//, consiste à envoyer vers une cible de multiples paquets **SYN** très rapidement. La cible répond à chaque paquet reçu avec un paquet **ACK** et attend une réponse **ACK** de l' | + | |
| - | + | ||
| - | ====Flood==== | + | |
| - | + | ||
| - | Le **Flood** consiste à envoyer très rapidement des gros paquets **ICMP** vers la cible. | + | |
| - | + | ||
| - | =====Le Contre-Mesure===== | + | |
| - | + | ||
| - | Le contre-mesure est principalement l' | + | |
| - | + | ||
| - | ====Le Pare-feu Netfilter/iptables===== | + | |
| **Netfilter** est composé de 5 //hooks// : | **Netfilter** est composé de 5 //hooks// : | ||
| Ligne 1053: | Ligne 1095: | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Attention ! La règle ajoutée avec l' | + | **Important** - Attention ! La règle ajoutée avec l' |
| </ | </ | ||
| Ligne 1135: | Ligne 1177: | ||
| # firewall-cmd --panic-off | # firewall-cmd --panic-off | ||
| </ | </ | ||
| + | |||
| + | =====System Hardening===== | ||
| + | |||
| + | ====Les compilateurs==== | ||
| + | |||
| + | Afin d' | ||
| + | |||
| + | ====Les paquets==== | ||
| + | |||
| + | Il convient dans ce cas de passer en revue la liste des paquets installes puis de supprimer ceux qui sont juges être inutiles : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# rpm -qa | more | ||
| + | librepo-1.14.0-2.el8.x86_64 | ||
| + | prefixdevname-0.1.0-6.el8.x86_64 | ||
| + | zip-3.0-23.el8.x86_64 | ||
| + | gnome-shell-extension-desktop-icons-3.32.1-22.el8_5.noarch | ||
| + | python3-setuptools-wheel-39.2.0-6.el8.noarch | ||
| + | perl-Term-Cap-1.17-395.el8.noarch | ||
| + | accountsservice-libs-0.6.55-2.el8_5.2.x86_64 | ||
| + | enchant2-2.2.3-3.el8.x86_64 | ||
| + | google-noto-sans-lisu-fonts-20161022-7.el8.1.noarch | ||
| + | ipset-libs-7.1-1.el8.x86_64 | ||
| + | pangomm-2.40.1-6.el8.x86_64 | ||
| + | anaconda-gui-33.16.5.6-1.el8.x86_64 | ||
| + | libibverbs-35.0-1.el8.x86_64 | ||
| + | thai-scalable-waree-fonts-0.6.5-1.el8.noarch | ||
| + | libidn-1.34-5.el8.x86_64 | ||
| + | tuned-2.16.0-1.el8.noarch | ||
| + | kbd-legacy-2.0.4-10.el8.noarch | ||
| + | NetworkManager-team-1.32.10-4.el8.x86_64 | ||
| + | lohit-kannada-fonts-2.5.4-3.el8.noarch | ||
| + | ipxe-roms-qemu-20181214-8.git133f4c47.el8.noarch | ||
| + | openssh-server-8.0p1-10.el8.x86_64 | ||
| + | sssd-nfs-idmap-2.5.2-2.el8_5.3.x86_64 | ||
| + | cronie-anacron-1.5.2-4.el8.x86_64 | ||
| + | libgdither-0.6-17.el8.x86_64 | ||
| + | libcanberra-gtk3-0.30-18.el8.x86_64 | ||
| + | net-snmp-libs-5.8-22.el8.x86_64 | ||
| + | libnl3-3.5.0-1.el8.x86_64 | ||
| + | libblockdev-lvm-2.24-7.el8.x86_64 | ||
| + | libjose-10-2.el8.x86_64 | ||
| + | jq-1.5-12.el8.x86_64 | ||
| + | zenity-3.28.1-1.el8.x86_64 | ||
| + | lz4-1.8.3-3.el8_4.x86_64 | ||
| + | flatpak-selinux-1.8.5-5.el8_5.noarch | ||
| + | python3-ordered-set-2.0.2-4.el8.noarch | ||
| + | bash-4.4.20-2.el8.x86_64 | ||
| + | libpkgconf-1.4.2-1.el8.x86_64 | ||
| + | gnome-keyring-3.28.2-1.el8.x86_64 | ||
| + | iwl100-firmware-39.31.5.1-103.el8.1.noarch | ||
| + | python3-libstoragemgmt-1.9.1-1.el8.x86_64 | ||
| + | libtevent-0.11.0-0.el8.x86_64 | ||
| + | gnome-themes-standard-3.22.3-4.el8.x86_64 | ||
| + | augeas-libs-1.12.0-6.el8.x86_64 | ||
| + | fprintd-pam-1.90.9-2.el8.x86_64 | ||
| + | setroubleshoot-plugins-3.3.14-1.el8.noarch | ||
| + | osinfo-db-tools-1.9.0-1.el8.x86_64 | ||
| + | libwayland-server-1.19.0-1.el8.x86_64 | ||
| + | libvirt-daemon-driver-interface-6.0.0-37.module_el8.5.0+1002+36725df2.x86_64 | ||
| + | kernel-modules-4.18.0-305.3.1.el8.x86_64 | ||
| + | libbpf-0.4.0-1.el8.x86_64 | ||
| + | libexif-0.6.22-5.el8_3.x86_64 | ||
| + | python3-simpleline-1.1.1-2.el8.noarch | ||
| + | cockpit-system-251.1-1.el8.noarch | ||
| + | python3-setools-4.3.0-2.el8.x86_64 | ||
| + | perl-IO-1.38-420.el8.x86_64 | ||
| + | ibus-typing-booster-2.1.0-5.el8.noarch | ||
| + | --More-- | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | ====Les démons et services==== | ||
| + | |||
| + | Il convient dans ce cas de passer en revue la liste des démons et services actives puis de supprimer ceux qui sont juges être inutiles; | ||
| + | |||
| + | * ps aux | ||
| + | * chkconfig --list | ||
| + | * systemctl list-unit-files | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# ps aux | more | ||
| + | USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND | ||
| + | root | ||
| + | root | ||
| + | root | ||
| + | root | ||
| + | root | ||
| + | root | ||
| + | root 10 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 11 0.0 0.0 0 0 ? I 12:13 0:00 [rcu_sched] | ||
| + | root 12 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 13 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 14 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/0] | ||
| + | root 15 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/1] | ||
| + | root 16 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 17 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 18 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 20 0.0 0.0 0 0 ? I< | ||
| + | root 21 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/2] | ||
| + | root 22 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 23 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 24 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 26 0.0 0.0 0 0 ? I< | ||
| + | root 27 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/3] | ||
| + | root 28 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 29 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 30 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 32 0.0 0.0 0 0 ? I< | ||
| + | root 33 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/4] | ||
| + | root 34 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 35 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 36 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 38 0.0 0.0 0 0 ? I< | ||
| + | root 39 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/5] | ||
| + | root 40 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 41 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 42 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 44 0.0 0.0 0 0 ? I< | ||
| + | root 45 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/6] | ||
| + | root 46 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 47 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 48 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 49 0.0 0.0 0 0 ? I 12:13 0:00 [kworker/ | ||
| + | root 50 0.0 0.0 0 0 ? I< | ||
| + | root 51 0.0 0.0 0 0 ? S 12:13 0:00 [cpuhp/7] | ||
| + | root 52 0.0 0.0 0 0 ? S 12:13 0:00 [watchdog/ | ||
| + | root 53 0.0 0.0 0 0 ? S 12:13 0:00 [migration/ | ||
| + | root 54 0.0 0.0 0 0 ? S 12:13 0:00 [ksoftirqd/ | ||
| + | root 56 0.0 0.0 0 0 ? I< | ||
| + | root 65 0.0 0.0 0 0 ? S 12:13 0:00 [kdevtmpfs] | ||
| + | root 66 0.0 0.0 0 0 ? I< | ||
| + | root 67 0.0 0.0 0 0 ? S 12:13 0:00 [rcu_tasks_trace] | ||
| + | root 68 0.0 0.0 0 0 ? S 12:13 0:00 [rcu_tasks_rude_] | ||
| + | root 69 0.0 0.0 0 0 ? S 12:13 0:00 [kauditd] | ||
| + | root 70 0.0 0.0 0 0 ? S 12:13 0:00 [khungtaskd] | ||
| + | root 71 0.0 0.0 0 0 ? S 12:13 0:00 [oom_reaper] | ||
| + | --More-- | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# chkconfig --list | ||
| + | |||
| + | Note: This output shows SysV services only and does not include native | ||
| + | systemd services. SysV configuration data might be overridden by native | ||
| + | systemd configuration. | ||
| + | |||
| + | If you want to list systemd services use ' | ||
| + | To see services enabled on particular target use | ||
| + | ' | ||
| + | |||
| + | </ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# systemctl list-unit-files | ||
| + | UNIT FILE STATE | ||
| + | proc-sys-fs-binfmt_misc.automount | ||
| + | -.mount | ||
| + | boot.mount | ||
| + | dev-hugepages.mount | ||
| + | dev-mqueue.mount | ||
| + | proc-fs-nfsd.mount | ||
| + | proc-sys-fs-binfmt_misc.mount | ||
| + | run-vmblock\x2dfuse.mount | ||
| + | sys-fs-fuse-connections.mount | ||
| + | sys-kernel-config.mount | ||
| + | sys-kernel-debug.mount | ||
| + | tmp.mount | ||
| + | var-lib-machines.mount | ||
| + | var-lib-nfs-rpc_pipefs.mount | ||
| + | cups.path | ||
| + | ostree-finalize-staged.path | ||
| + | systemd-ask-password-console.path | ||
| + | systemd-ask-password-plymouth.path | ||
| + | systemd-ask-password-wall.path | ||
| + | session-1.scope | ||
| + | session-5.scope | ||
| + | session-c1.scope | ||
| + | accounts-daemon.service | ||
| + | alsa-restore.service | ||
| + | alsa-state.service | ||
| + | anaconda-direct.service | ||
| + | anaconda-fips.service | ||
| + | anaconda-nm-config.service | ||
| + | anaconda-noshell.service | ||
| + | anaconda-pre.service | ||
| + | anaconda-shell@.service | ||
| + | anaconda-sshd.service | ||
| + | anaconda-tmux@.service | ||
| + | anaconda.service | ||
| + | arp-ethers.service | ||
| + | atd.service | ||
| + | auditd.service | ||
| + | auth-rpcgss-module.service | ||
| + | autovt@.service | ||
| + | avahi-daemon.service | ||
| + | blivet.service | ||
| + | blk-availability.service | ||
| + | bluetooth.service | ||
| + | bolt.service | ||
| + | brltty.service | ||
| + | btattach-bcm@.service | ||
| + | canberra-system-bootup.service | ||
| + | canberra-system-shutdown-reboot.service | ||
| + | canberra-system-shutdown.service | ||
| + | chrony-dnssrv@.service | ||
| + | chrony-wait.service | ||
| + | chronyd.service | ||
| + | cockpit-motd.service | ||
| + | cockpit-wsinstance-http-redirect.service | ||
| + | lines 1-55 | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | ====Les fichiers .rhosts==== | ||
| + | |||
| + | Le système rhosts présente une faille de sécurité importante pour un serveur Linux. Pour cette raison, il convient de supprimer les fichiers **.rhosts** des utilisateurs. Utilisez la commande suivante: | ||
| + | |||
| + | # find / -name " | ||
| + | |||
| + | ====Les fichiers et les repertoires sans proprietaire==== | ||
| + | |||
| + | Afin de dresser la liste des fichiers et des groupes sans propriétaires sur le serveur, il convient d' | ||
| + | |||
| + | # find / -nouser -exec ls -l \{\} \; 2> sans_pro.txt [Entree] | ||
| + | |||
| + | # find / -nogroup -exec ls -l \{\} \; 2>> sans_pro.txt[Entree] | ||
| + | |||
| + | Ces commandes produiront une liste éventuelle dans le fichier **sans_pro.txt**. | ||
| + | |||
| + | L' | ||
| + | |||
| + | * modifier le propriétaire a root | ||
| + | * modifier le groupe a root | ||
| + | * modifier les permissions a 700 | ||
| + | |||
| + | ====Limiter le delai d' | ||
| + | |||
| + | Une session de shell laissée ouverte inutilement et d'une manière sans surveillance est un risque de sécurité. Vérifiez donc le contenu du fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# cat / | ||
| + | # / | ||
| + | |||
| + | # System wide environment and startup programs, for login setup | ||
| + | # Functions and aliases go in /etc/bashrc | ||
| + | |||
| + | # It's NOT a good idea to change this file unless you know what you | ||
| + | # are doing. It's much better to create a custom.sh shell script in | ||
| + | # / | ||
| + | # will prevent the need for merging in future updates. | ||
| + | |||
| + | pathmunge () { | ||
| + | case ": | ||
| + | *:" | ||
| + | ;; | ||
| + | *) | ||
| + | if [ " | ||
| + | PATH=$PATH: | ||
| + | else | ||
| + | PATH=$1: | ||
| + | fi | ||
| + | esac | ||
| + | } | ||
| + | |||
| + | |||
| + | if [ -x /usr/bin/id ]; then | ||
| + | if [ -z " | ||
| + | # ksh workaround | ||
| + | EUID=`/ | ||
| + | UID=`/ | ||
| + | fi | ||
| + | USER=" | ||
| + | LOGNAME=$USER | ||
| + | MAIL="/ | ||
| + | fi | ||
| + | |||
| + | # Path manipulation | ||
| + | if [ " | ||
| + | pathmunge /usr/sbin | ||
| + | pathmunge / | ||
| + | else | ||
| + | pathmunge / | ||
| + | pathmunge /usr/sbin after | ||
| + | fi | ||
| + | |||
| + | HOSTNAME=`/ | ||
| + | HISTSIZE=1000 | ||
| + | if [ " | ||
| + | export HISTCONTROL=ignoreboth | ||
| + | else | ||
| + | export HISTCONTROL=ignoredups | ||
| + | fi | ||
| + | |||
| + | export PATH USER LOGNAME MAIL HOSTNAME HISTSIZE HISTCONTROL | ||
| + | |||
| + | # By default, we want umask to get set. This sets it for login shell | ||
| + | # Current threshold for system reserved uid/gids is 200 | ||
| + | # You could check uidgid reservation validity in | ||
| + | # / | ||
| + | if [ $UID -gt 199 ] && [ " | ||
| + | umask 002 | ||
| + | else | ||
| + | umask 022 | ||
| + | fi | ||
| + | |||
| + | for i in / | ||
| + | if [ -r " | ||
| + | if [ " | ||
| + | . " | ||
| + | else | ||
| + | . " | ||
| + | fi | ||
| + | fi | ||
| + | done | ||
| + | |||
| + | unset i | ||
| + | unset -f pathmunge | ||
| + | |||
| + | if [ -n " | ||
| + | if [ -f /etc/bashrc ] ; then | ||
| + | # Bash login shells run only / | ||
| + | # Bash non-login shells run only /etc/bashrc | ||
| + | # Check for double sourcing is done in / | ||
| + | . /etc/bashrc | ||
| + | fi | ||
| + | fi | ||
| + | </ | ||
| + | |||
| + | A ce fichier doivent être ajoutées les deux lignes suivantes: | ||
| + | |||
| + | < | ||
| + | Readonly TMOUT=300 | ||
| + | Export TMOUT | ||
| + | </ | ||
| + | |||
| + | Par cette action, vous définissez le délai d’inactivité d'une session shell a une durée de 5 minutes. | ||
| + | |||
| + | Dernièrement, | ||
| + | |||
| + | ====Renforcer la securite d' | ||
| + | |||
| + | ===Les Distributions SysVInit=== | ||
| + | |||
| + | Le fichier **/ | ||
| + | |||
| + | La première modification à effectuer est de spécifier le niveau d’exécution par défaut a 3 au lieu de 5. Ceci permet de ne pas lancer les sessions graphiques sur une serveur de production. Cherchez donc la ligne suivante: | ||
| + | |||
| + | < | ||
| + | id: | ||
| + | </ | ||
| + | |||
| + | Modifiez-la en: | ||
| + | |||
| + | < | ||
| + | id: | ||
| + | </ | ||
| + | |||
| + | Le mode **single user** de démarrage de Linux n'est pas habituellement protégé par un mot de passe. Afin de remédier a cela, ajoutez les lignes suivantes: | ||
| + | |||
| + | < | ||
| + | # Single user mode | ||
| + | ~~: | ||
| + | </ | ||
| + | |||
| + | Dernièrement, | ||
| + | |||
| + | < | ||
| + | # ca:: | ||
| + | </ | ||
| + | |||
| + | ===Les Distributions Upstart=== | ||
| + | |||
| + | Afin d' | ||
| + | |||
| + | < | ||
| + | exec / | ||
| + | </ | ||
| + | |||
| + | en | ||
| + | |||
| + | < | ||
| + | #exec / | ||
| + | </ | ||
| + | |||
| + | ====Renforcer la sécurité du Noyau==== | ||
| + | |||
| + | ===La commande sysctl=== | ||
| + | |||
| + | Les fichiers dans le répertoire **/ | ||
| + | |||
| + | La commande **sysctl** applique les règles consignés dans le fichier **/ | ||
| + | |||
| + | Saisissez la commande : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# cat / | ||
| + | # sysctl settings are defined through files in | ||
| + | # / | ||
| + | # | ||
| + | # Vendors settings live in / | ||
| + | # To override a whole file, create a new file with the same in | ||
| + | # / | ||
| + | # only specific settings, add a file with a lexically later | ||
| + | # name in / | ||
| + | # | ||
| + | # For more information, | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# ls -la / | ||
| + | total 12 | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. 143 root root 8192 Oct 1 12:13 .. | ||
| + | lrwxrwxrwx. | ||
| + | </ | ||
| + | |||
| + | ==Options de la commande== | ||
| + | |||
| + | Les options de la commande **sysctl** sont : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# sysctl --help | ||
| + | |||
| + | Usage: | ||
| + | | ||
| + | |||
| + | Options: | ||
| + | -a, --all display all variables | ||
| + | -A alias of -a | ||
| + | -X alias of -a | ||
| + | --deprecated | ||
| + | -b, --binary | ||
| + | -e, --ignore | ||
| + | -N, --names | ||
| + | -n, --values | ||
| + | -p, --load[=< | ||
| + | -f alias of -p | ||
| + | --system | ||
| + | -r, --pattern < | ||
| + | | ||
| + | -q, --quiet | ||
| + | -w, --write | ||
| + | -o does nothing | ||
| + | -x does nothing | ||
| + | -d alias of -h | ||
| + | |||
| + | -h, --help | ||
| + | -V, --version | ||
| + | |||
| + | For more details see sysctl(8). | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Consultez la page de la traduction du manuel de **sysctl** **[[http:// | ||
| + | </ | ||
| + | |||
| + | =====Mise en place de SELinux pour sécuriser le serveur===== | ||
| + | |||
| + | ====Introducton==== | ||
| + | |||
| + | L' | ||
| + | ur | ||
| + | ^ Type de Sécurité ^ Nom ^ Description ^ | ||
| + | | TE | //Type enforcement// | ||
| + | | RBAC | //Role Based Access Control// | ||
| + | | MAC | //Mandatory Access Control// | ||
| + | | MLS | // | ||
| + | |||
| + | Même quand le modèle %%SELinux%% de sécurité est actif, la sécurité type DAC est toujours active. Cependant dans le cas où la sécurité du type DAC autorise une action, %%SELinux%% va évaluer cette action par rapport à ses propres règles avant de l' | ||
| + | |||
| + | %%SELinux%% évalue toujours des **// | ||
| + | |||
| + | Dans le contexte de %%SELinux%% : | ||
| + | |||
| + | * un **// | ||
| + | * un **// | ||
| + | * une **// | ||
| + | |||
| + | Chaque **//classe d' | ||
| + | |||
| + | ====Définitions==== | ||
| + | |||
| + | ===Security Context=== | ||
| + | |||
| + | %%SELinux%% associe un //Security Context// (SC) à chaque **// | ||
| + | |||
| + | Un SC prend la forme **identité: | ||
| + | |||
| + | ^ Nom ^ Descriptions ^ | ||
| + | | Identité | Le nom du propriétaire de l' | ||
| + | | Rôle | Essentiellement appliqué aux processus, le rôle est appelé une domaine. Dans le cas d'un rôle de fichier, celui-ci est toujours **object_r**. Un rôle se termine généralement par **_r**. | | ||
| + | | Type | Définit la classification de sécurité de l' | ||
| + | | Niveau | Un niveau est un attribut de MLS et MCS. Une plage MLS est une paire de niveaux exprimée en utilisant la syntaxe // | ||
| + | |||
| + | Sous RHEL/CentOS 8, le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# cat / | ||
| + | # | ||
| + | # Multi-Category Security translation table for SELinux | ||
| + | # | ||
| + | # Uncomment the following to disable translation libary | ||
| + | # disable=1 | ||
| + | # | ||
| + | # Objects can be categorized with 0-1023 categories defined by the admin. | ||
| + | # Objects can be in more than one category at a time. | ||
| + | # Categories are stored in the system as c0-c1023. | ||
| + | # table to translate the categories into a more meaningful output. | ||
| + | # Examples: | ||
| + | # s0: | ||
| + | # s0: | ||
| + | # s0: | ||
| + | # s0: | ||
| + | # s0: | ||
| + | s0=SystemLow | ||
| + | s0-s0: | ||
| + | s0: | ||
| + | </ | ||
| + | |||
| + | Dans le contexte d'un SC pour un **// | ||
| + | |||
| + | Dans le contexte d'un SC pour un **// | ||
| + | |||
| + | %%SELinux%% maintient sa propre liste d' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# / | ||
| + | |||
| + | Login Name | ||
| + | |||
| + | __default__ | ||
| + | root | ||
| + | </ | ||
| + | |||
| + | ===Domains et Types=== | ||
| + | |||
| + | Le **Domain** est l' | ||
| + | |||
| + | Le **Domain** contient des **// | ||
| + | |||
| + | Dans %%SELinux%% on utilise le mot : | ||
| + | |||
| + | * **Domain** pour un processus, | ||
| + | * **Type** pour un fichier. | ||
| + | |||
| + | ===Roles=== | ||
| + | |||
| + | Un **Rôle** est comme un utilisateur dans le système de sécurité DAC de Linux. Chaque utilisateur autorisé peut assumer l' | ||
| + | |||
| + | ===Politiques de Sécurité=== | ||
| + | |||
| + | Une politique de sécurité définit les SC de chaque application. Elle définit des droits d' | ||
| + | |||
| + | ^ Politique ^ Description ^ | ||
| + | | targeted | Les politiques de sécurité ne s' | ||
| + | | mls | Multi Level Security protection | | ||
| + | |||
| + | Les politiques de sécurité se trouvent dans le répertoire **/ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# ls -lR / | ||
| + | / | ||
| + | total 8 | ||
| + | -rw-r--r--. 1 root root 548 Jun 16 2021 config | ||
| + | -rw-r--r--. 1 root root 2647 Feb 3 2021 semanage.conf | ||
| + | drwxr-xr-x. 5 root root 133 Mar 6 2022 targeted | ||
| + | |||
| + | / | ||
| + | total 16 | ||
| + | -rw-r--r--. 1 root root 2367 Dec 21 2021 booleans.subs_dist | ||
| + | drwxr-xr-x. 4 root root 4096 Mar 6 2022 contexts | ||
| + | drwxr-xr-x. 2 root root 6 Dec 21 2021 logins | ||
| + | drwxr-xr-x. 2 root root 23 Mar 6 2022 policy | ||
| + | -rw-r--r--. 1 root root 607 Dec 21 2021 setrans.conf | ||
| + | -rw-r--r--. 1 root root 73 Mar 6 2022 seusers | ||
| + | |||
| + | / | ||
| + | total 68 | ||
| + | -rw-r--r--. 1 root root 262 Mar 6 2022 customizable_types | ||
| + | -rw-r--r--. 1 root root 195 Dec 21 2021 dbus_contexts | ||
| + | -rw-r--r--. 1 root root 1111 Dec 21 2021 default_contexts | ||
| + | -rw-r--r--. 1 root root 114 Dec 21 2021 default_type | ||
| + | -rw-r--r--. 1 root root 29 Dec 21 2021 failsafe_context | ||
| + | drwxr-xr-x. 2 root root 213 Mar 6 2022 files | ||
| + | -rw-r--r--. 1 root root 30 Dec 21 2021 initrc_context | ||
| + | -rw-r--r--. 1 root root 372 Dec 21 2021 lxc_contexts | ||
| + | -rw-r--r--. 1 root root 27 Dec 21 2021 openssh_contexts | ||
| + | -rw-r--r--. 1 root root 33 Dec 21 2021 removable_context | ||
| + | -rw-r--r--. 1 root root 74 Dec 21 2021 securetty_types | ||
| + | -rw-r--r--. 1 root root 1170 Dec 21 2021 sepgsql_contexts | ||
| + | -rw-r--r--. 1 root root 53 Dec 21 2021 snapperd_contexts | ||
| + | -rw-r--r--. 1 root root 57 Dec 21 2021 systemd_contexts | ||
| + | -rw-r--r--. 1 root root 33 Dec 21 2021 userhelper_context | ||
| + | drwxr-xr-x. 2 root root 114 Dec 21 2021 users | ||
| + | -rw-r--r--. 1 root root 62 Dec 21 2021 virtual_domain_context | ||
| + | -rw-r--r--. 1 root root 71 Dec 21 2021 virtual_image_context | ||
| + | -rw-r--r--. 1 root root 2920 Dec 21 2021 x_contexts | ||
| + | |||
| + | / | ||
| + | total 1008 | ||
| + | -rw-r--r--. 1 root root 407436 Mar 6 2022 file_contexts | ||
| + | -rw-r--r--. 1 root root 574118 Mar 6 2022 file_contexts.bin | ||
| + | -rw-r--r--. 1 root root 14704 Mar 6 2022 file_contexts.homedirs | ||
| + | -rw-r--r--. 1 root root 20149 Mar 6 2022 file_contexts.homedirs.bin | ||
| + | -rw-r--r--. 1 root root 0 Dec 21 2021 file_contexts.local | ||
| + | -rw-r--r--. 1 root root 0 Dec 21 2021 file_contexts.subs | ||
| + | -rw-r--r--. 1 root root 597 Dec 21 2021 file_contexts.subs_dist | ||
| + | -rw-r--r--. 1 root root 139 Dec 21 2021 media | ||
| + | |||
| + | / | ||
| + | total 28 | ||
| + | -rw-r--r--. 1 root root 342 Dec 21 2021 guest_u | ||
| + | -rw-r--r--. 1 root root 724 Dec 21 2021 root | ||
| + | -rw-r--r--. 1 root root 562 Dec 21 2021 staff_u | ||
| + | -rw-r--r--. 1 root root 589 Dec 21 2021 sysadm_u | ||
| + | -rw-r--r--. 1 root root 612 Dec 21 2021 unconfined_u | ||
| + | --More-- | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | Afin d' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# dnf install setools-console | ||
| + | Last metadata expiration check: 0:28:26 ago on Tue 01 Oct 2024 16:11:14 CEST. | ||
| + | Dependencies resolved. | ||
| + | ================================================================================================================================================================================================================== | ||
| + | | ||
| + | ================================================================================================================================================================================================================== | ||
| + | Installing: | ||
| + | | ||
| + | |||
| + | Transaction Summary | ||
| + | ================================================================================================================================================================================================================== | ||
| + | Install | ||
| + | |||
| + | Total download size: 42 k | ||
| + | Installed size: 122 k | ||
| + | Is this ok [y/N]: y | ||
| + | Downloading Packages: | ||
| + | setools-console-4.3.0-2.el8.x86_64.rpm | ||
| + | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ||
| + | Total 76 kB/s | 42 kB | ||
| + | Running transaction check | ||
| + | Transaction check succeeded. | ||
| + | Running transaction test | ||
| + | Transaction test succeeded. | ||
| + | Running transaction | ||
| + | Preparing | ||
| + | Installing | ||
| + | Running scriptlet: setools-console-4.3.0-2.el8.x86_64 | ||
| + | Verifying | ||
| + | Installed products updated. | ||
| + | |||
| + | Installed: | ||
| + | setools-console-4.3.0-2.el8.x86_64 | ||
| + | |||
| + | Complete! | ||
| + | </ | ||
| + | |||
| + | Pour consulter les statistiques de la politique, il convient d' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# seinfo | ||
| + | Statistics for policy file: / | ||
| + | Policy Version: | ||
| + | Target Policy: | ||
| + | Handle unknown classes: | ||
| + | Classes: | ||
| + | Sensitivities: | ||
| + | Types: | ||
| + | Users: | ||
| + | Booleans: | ||
| + | Allow: | ||
| + | Auditallow: | ||
| + | Type_trans: | ||
| + | Type_member: | ||
| + | Role allow: | ||
| + | Constraints: | ||
| + | MLS Constrain: | ||
| + | Permissives: | ||
| + | Defaults: | ||
| + | Allowxperm: | ||
| + | Auditallowxperm: | ||
| + | Ibendportcon: | ||
| + | Initial SIDs: | ||
| + | Genfscon: | ||
| + | Netifcon: | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez ici le grand nombre de la catégorie **Dontaudit**. | ||
| + | </ | ||
| + | |||
| + | ===Langage de Politiques=== | ||
| + | |||
| + | Un politique est composé de centaines de directives. Les principales directives sont : | ||
| + | |||
| + | ==allow== | ||
| + | |||
| + | **allow** autorise l' | ||
| + | |||
| + | allow user_t domaine_t : file (read execute getattr) ; | ||
| + | |||
| + | Dans cette directive : | ||
| + | |||
| + | * user_t est le type de fichier, | ||
| + | * domaine_t est le domaine des processus qui sont autorisés par allow, | ||
| + | * file (droit1 droit2 etc) est la liste des permissions accordées. | ||
| + | |||
| + | Les permissions possibles sont : | ||
| + | |||
| + | * read | ||
| + | * write | ||
| + | * append | ||
| + | * execute | ||
| + | * getattr | ||
| + | * setattr | ||
| + | * lock | ||
| + | * link | ||
| + | * unlink | ||
| + | * rename | ||
| + | * ioctl | ||
| + | |||
| + | ==type== | ||
| + | |||
| + | La directive **type** définit un type %%SELinux%%. Le type se termine généralement par **_t**. | ||
| + | |||
| + | **auditallow, | ||
| + | |||
| + | La directive **auditallow** demande l' | ||
| + | |||
| + | L' | ||
| + | |||
| + | ===type_transition=== | ||
| + | |||
| + | Normalement quand un fichier est créé, il hérite du SC du répertoire parent. De même quand un processus %%SELinux%% active un nouveau processus, ce dernier s' | ||
| + | |||
| + | ===Décisions de SELinux=== | ||
| + | |||
| + | Il existe deux types de décisions auxquelles %%SELinux%% doit faire face : | ||
| + | |||
| + | * **Décisions d' | ||
| + | * **Décisions de Transition** | ||
| + | |||
| + | ==Décisions d' | ||
| + | |||
| + | Dans ce type de décision %%SELinux%% doit décider d' | ||
| + | |||
| + | * un **// | ||
| + | * un **// | ||
| + | |||
| + | ==Décisions de Transition== | ||
| + | |||
| + | Dans ce type de décision %%SELinux%% doit décider d' | ||
| + | |||
| + | * d' | ||
| + | * de créer des **// | ||
| + | |||
| + | ====Commandes SELinux==== | ||
| + | |||
| + | ^ Commande ^ Description ^ | ||
| + | | chcon | Changer le SC d'un fichier | | ||
| + | | audit2allow | Générer la source de la règle de sécurité à l' | ||
| + | | restorecon | Restaurer le SC par défaut à un ou plusieurs fichiers | | ||
| + | | setfiles -n | Vérifier si les SC sont corrects | ||
| + | | semodule | Gèrer les modules de politiques | | ||
| + | | semodule -i | Installer un module de politiques | | ||
| + | | checkmodule | Compiler un module | | ||
| + | | semodule_package | Créer un module installable par semodule | | ||
| + | | semanage | Administrer une politique | | ||
| + | | audit2allow -M | Créer un module à partir d'un message d' | ||
| + | | sesearch | Recherche des règles %%SELinux%% | | ||
| + | | seinfo | Effectuer des recherches dans la politique | | ||
| + | | getsebool | Affiche l' | ||
| + | | getsebool -a | Affiche l' | ||
| + | | sestatus -b | Affiche l' | ||
| + | | setsebool | Modifie l' | ||
| + | | togglesebool | Bascule la valeur d'un booléen | | ||
| + | |||
| + | ====Les Etats de SELinux==== | ||
| + | |||
| + | %%SELinux%% connait trois états : | ||
| + | |||
| + | ^ Etat ^ Description ^ | ||
| + | | disabled | %%SELinux%% est inactif. | | ||
| + | | permissive | %%SELinux%% est actif mais tout est permis. Des interdictions ne font que de générer des messages d' | ||
| + | | enforcing | %%SELinux%% est actif. | | ||
| + | |||
| + | L' | ||
| + | |||
| + | ^ Valeur ^ Description ^ | ||
| + | | 0 | %%SELinux%% est en mode // | ||
| + | | 1 | %%SELinux%% est en mode // | ||
| + | |||
| + | La configuration de l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# cat / | ||
| + | |||
| + | # This file controls the state of SELinux on the system. | ||
| + | # SELINUX= can take one of these three values: | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | SELINUX=enforcing | ||
| + | # SELINUXTYPE= can take one of these three values: | ||
| + | # | ||
| + | # | ||
| + | # mls - Multi Level Security protection. | ||
| + | SELINUXTYPE=targeted | ||
| + | </ | ||
| + | |||
| + | Afin de connaître l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# getenforce | ||
| + | Enforcing | ||
| + | </ | ||
| + | |||
| + | Pour modifier l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# setenforce permissive | ||
| + | |||
| + | [root@centos8 ~]# getenforce | ||
| + | Permissive | ||
| + | </ | ||
| + | |||
| + | La commande **sestatus** vous informe sur la configuration de %%SELinux%% et notamment sur la version de la politique utilisée : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# sestatus | ||
| + | SELinux status: | ||
| + | SELinuxfs mount: | ||
| + | SELinux root directory: | ||
| + | Loaded policy name: | ||
| + | Current mode: | ||
| + | Mode from config file: enforcing | ||
| + | Policy MLS status: | ||
| + | Policy deny_unknown status: | ||
| + | Memory protection checking: | ||
| + | Max kernel policy version: | ||
| + | </ | ||
| + | |||
| + | Les différentes versions de politiques évolue en même temps que le noyau Linux. | ||
| + | |||
| + | La commande sestatus peut aussi prendre l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# sestatus -v | ||
| + | SELinux status: | ||
| + | SELinuxfs mount: | ||
| + | SELinux root directory: | ||
| + | Loaded policy name: | ||
| + | Current mode: | ||
| + | Mode from config file: enforcing | ||
| + | Policy MLS status: | ||
| + | Policy deny_unknown status: | ||
| + | Memory protection checking: | ||
| + | Max kernel policy version: | ||
| + | |||
| + | Process contexts: | ||
| + | Current context: | ||
| + | Init context: | ||
| + | / | ||
| + | |||
| + | File contexts: | ||
| + | Controlling terminal: | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | ====Booléens==== | ||
| + | |||
| + | Les booléens permettent à des ensembles de règles d' | ||
| + | |||
| + | Pour visualiser l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# getsebool -a | more | ||
| + | abrt_anon_write --> off | ||
| + | abrt_handle_event --> off | ||
| + | abrt_upload_watch_anon_write --> on | ||
| + | antivirus_can_scan_system --> off | ||
| + | antivirus_use_jit --> off | ||
| + | auditadm_exec_content --> on | ||
| + | authlogin_nsswitch_use_ldap --> off | ||
| + | authlogin_radius --> off | ||
| + | authlogin_yubikey --> off | ||
| + | awstats_purge_apache_log_files --> off | ||
| + | boinc_execmem --> on | ||
| + | cdrecord_read_content --> off | ||
| + | cluster_can_network_connect --> off | ||
| + | cluster_manage_all_files --> off | ||
| + | cluster_use_execmem --> off | ||
| + | cobbler_anon_write --> off | ||
| + | cobbler_can_network_connect --> off | ||
| + | cobbler_use_cifs --> off | ||
| + | cobbler_use_nfs --> off | ||
| + | collectd_tcp_network_connect --> off | ||
| + | colord_use_nfs --> off | ||
| + | condor_tcp_network_connect --> off | ||
| + | conman_can_network --> off | ||
| + | conman_use_nfs --> off | ||
| + | container_connect_any --> off | ||
| + | container_manage_cgroup --> off | ||
| + | container_use_cephfs --> off | ||
| + | cron_can_relabel --> off | ||
| + | cron_system_cronjob_use_shares --> off | ||
| + | cron_userdomain_transition --> on | ||
| + | cups_execmem --> off | ||
| + | cvs_read_shadow --> off | ||
| + | daemons_dump_core --> off | ||
| + | daemons_enable_cluster_mode --> off | ||
| + | daemons_use_tcp_wrapper --> off | ||
| + | daemons_use_tty --> off | ||
| + | dbadm_exec_content --> on | ||
| + | dbadm_manage_user_files --> off | ||
| + | dbadm_read_user_files --> off | ||
| + | deny_bluetooth --> off | ||
| + | deny_execmem --> off | ||
| + | deny_ptrace --> off | ||
| + | dhcpc_exec_iptables --> off | ||
| + | dhcpd_use_ldap --> off | ||
| + | domain_can_mmap_files --> off | ||
| + | domain_can_write_kmsg --> off | ||
| + | domain_fd_use --> on | ||
| + | domain_kernel_load_modules --> off | ||
| + | entropyd_use_audio --> on | ||
| + | exim_can_connect_db --> off | ||
| + | exim_manage_user_files --> off | ||
| + | exim_read_user_files --> off | ||
| + | fcron_crond --> off | ||
| + | fenced_can_network_connect --> off | ||
| + | fenced_can_ssh --> off | ||
| + | --More-- | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | ou la commande **sestatus -b** : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# sestatus -b | more | ||
| + | SELinux status: | ||
| + | SELinuxfs mount: | ||
| + | SELinux root directory: | ||
| + | Loaded policy name: | ||
| + | Current mode: | ||
| + | Mode from config file: enforcing | ||
| + | Policy MLS status: | ||
| + | Policy deny_unknown status: | ||
| + | Memory protection checking: | ||
| + | Max kernel policy version: | ||
| + | |||
| + | Policy booleans: | ||
| + | abrt_anon_write | ||
| + | abrt_handle_event | ||
| + | abrt_upload_watch_anon_write | ||
| + | antivirus_can_scan_system | ||
| + | antivirus_use_jit | ||
| + | auditadm_exec_content | ||
| + | authlogin_nsswitch_use_ldap | ||
| + | authlogin_radius | ||
| + | authlogin_yubikey | ||
| + | awstats_purge_apache_log_files | ||
| + | boinc_execmem | ||
| + | cdrecord_read_content | ||
| + | cluster_can_network_connect | ||
| + | cluster_manage_all_files | ||
| + | cluster_use_execmem | ||
| + | cobbler_anon_write | ||
| + | cobbler_can_network_connect | ||
| + | cobbler_use_cifs | ||
| + | cobbler_use_nfs | ||
| + | collectd_tcp_network_connect | ||
| + | colord_use_nfs | ||
| + | condor_tcp_network_connect | ||
| + | conman_can_network | ||
| + | conman_use_nfs | ||
| + | container_connect_any | ||
| + | container_manage_cgroup | ||
| + | container_use_cephfs | ||
| + | cron_can_relabel | ||
| + | cron_system_cronjob_use_shares | ||
| + | cron_userdomain_transition | ||
| + | cups_execmem | ||
| + | cvs_read_shadow | ||
| + | daemons_dump_core | ||
| + | daemons_enable_cluster_mode | ||
| + | daemons_use_tcp_wrapper | ||
| + | daemons_use_tty | ||
| + | dbadm_exec_content | ||
| + | dbadm_manage_user_files | ||
| + | dbadm_read_user_files | ||
| + | deny_bluetooth | ||
| + | deny_execmem | ||
| + | deny_ptrace | ||
| + | dhcpc_exec_iptables | ||
| + | --More-- | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | Pour fixer l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# setsebool antivirus_can_scan_system 1 | ||
| + | |||
| + | [root@centos8 ~]# getsebool antivirus_can_scan_system | ||
| + | antivirus_can_scan_system --> on | ||
| + | |||
| + | [root@centos8 ~]# setsebool antivirus_can_scan_system 0 | ||
| + | |||
| + | [root@centos8 ~]# getsebool antivirus_can_scan_system | ||
| + | antivirus_can_scan_system --> off | ||
| + | </ | ||
| + | |||
| + | =====LAB #2 - Travailler avec SELinux===== | ||
| + | |||
| + | Afin reconstruire la politique actuelle **sans** les règles **dontaudit**, | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# semodule -DB | ||
| + | </ | ||
| + | |||
| + | Vérifiez qu'il ne reste aucune règle de type **dontaudit** : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# seinfo | ||
| + | Statistics for policy file: / | ||
| + | Policy Version: | ||
| + | Target Policy: | ||
| + | Handle unknown classes: | ||
| + | Classes: | ||
| + | Sensitivities: | ||
| + | Types: | ||
| + | Users: | ||
| + | Booleans: | ||
| + | Allow: | ||
| + | Auditallow: | ||
| + | Type_trans: | ||
| + | Type_member: | ||
| + | Role allow: | ||
| + | Constraints: | ||
| + | MLS Constrain: | ||
| + | Permissives: | ||
| + | Defaults: | ||
| + | Allowxperm: | ||
| + | Auditallowxperm: | ||
| + | Ibendportcon: | ||
| + | Initial SIDs: | ||
| + | Genfscon: | ||
| + | Netifcon: | ||
| + | </ | ||
| + | |||
| + | ====Copier et Déplacer des Fichiers==== | ||
| + | |||
| + | Créez deux fichiers **file1** et **file2** en tant que l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# exit | ||
| + | logout | ||
| + | [trainee@centos8 ~]$ touch file1 file2 | ||
| + | [trainee@centos8 ~]$ ls -Z file* | ||
| + | unconfined_u: | ||
| + | </ | ||
| + | |||
| + | Notez que le type des deux fichiers est **user_home_t**. | ||
| + | |||
| + | Copiez maintenant le fichier **file1** vers **/tmp** en utilisant la commande **cp** et visualiser son SC : | ||
| + | |||
| + | < | ||
| + | [trainee@centos8 ~]$ cp file1 /tmp | ||
| + | |||
| + | [trainee@centos8 ~]$ ls -Z /tmp/file1 | ||
| + | unconfined_u: | ||
| + | </ | ||
| + | |||
| + | Notez que le fichier ainsi copié a hérité du **type** du répertoire parent, à savoir **tmp_t**. | ||
| + | |||
| + | Déplacez maintenant le fichier **file2** dans le répertoire **/tmp** et contrôlez son SC : | ||
| + | |||
| + | < | ||
| + | [trainee@centos8 ~]$ mv file2 /tmp | ||
| + | |||
| + | [trainee@centos8 ~]$ ls -Z /tmp/file2 | ||
| + | unconfined_u: | ||
| + | </ | ||
| + | |||
| + | Notez que la commande **mv** maintient le **type** d' | ||
| + | |||
| + | ====Vérifier les SC des Processus==== | ||
| + | |||
| + | Il convient d' | ||
| + | |||
| + | < | ||
| + | [trainee@centos8 ~]$ ps auxZ | more | ||
| + | LABEL | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | --More-- | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | ====Visualiser la SC d'un Utilisateur==== | ||
| + | |||
| + | Utilisez l' | ||
| + | |||
| + | < | ||
| + | [trainee@centos8 ~]$ id -Z | ||
| + | unconfined_u: | ||
| + | </ | ||
| + | |||
| + | Notez que vous ne pouvez pas consulter le SC d'un autre utilisateur : | ||
| + | |||
| + | < | ||
| + | [trainee@centos8 ~]$ id root | ||
| + | uid=0(root) gid=0(root) groups=0(root) | ||
| + | |||
| + | [trainee@centos8 ~]$ id -Z root | ||
| + | id: cannot print security context when user specified | ||
| + | </ | ||
| + | |||
| + | ====Vérifier la SC d'un fichier==== | ||
| + | |||
| + | Il convient d' | ||
| + | |||
| + | < | ||
| + | [trainee@centos8 ~]$ cd /etc | ||
| + | |||
| + | [trainee@centos8 etc]$ ls -Z l* -d | ||
| + | unconfined_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | system_u: | ||
| + | </ | ||
| + | |||
| + | ====Troubleshooting SELinux==== | ||
| + | |||
| + | L' | ||
| + | |||
| + | Si le démon **auditd** est démarré, les messages de %%SELinux%% sont consignés dans le fichier **/ | ||
| + | |||
| + | ===La commande chcon=== | ||
| + | |||
| + | La commande **chcon** permet de modifier // | ||
| + | |||
| + | < | ||
| + | [trainee@centos8 etc]$ cd ~ | ||
| + | |||
| + | [trainee@centos8 ~]$ chcon --help | ||
| + | Usage: chcon [OPTION]... CONTEXT FILE... | ||
| + | or: chcon [OPTION]... [-u USER] [-r ROLE] [-l RANGE] [-t TYPE] FILE... | ||
| + | or: chcon [OPTION]... --reference=RFILE FILE... | ||
| + | Change the SELinux security context of each FILE to CONTEXT. | ||
| + | With --reference, | ||
| + | |||
| + | Mandatory arguments to long options are mandatory for short options too. | ||
| + | --dereference | ||
| + | the default), rather than the symbolic link itself | ||
| + | -h, --no-dereference | ||
| + | -u, --user=USER | ||
| + | -r, --role=ROLE | ||
| + | -t, --type=TYPE | ||
| + | -l, --range=RANGE | ||
| + | --no-preserve-root | ||
| + | --preserve-root | ||
| + | --reference=RFILE | ||
| + | a CONTEXT value | ||
| + | -R, --recursive | ||
| + | -v, --verbose | ||
| + | |||
| + | The following options modify how a hierarchy is traversed when the -R | ||
| + | option is also specified. | ||
| + | one takes effect. | ||
| + | |||
| + | -H if a command line argument is a symbolic link | ||
| + | to a directory, traverse it | ||
| + | -L | ||
| + | | ||
| + | -P do not traverse any symbolic links (default) | ||
| + | |||
| + | --help | ||
| + | --version | ||
| + | |||
| + | GNU coreutils online help: < | ||
| + | Report chcon translation bugs to < | ||
| + | Full documentation at: < | ||
| + | or available locally via: info ' | ||
| + | </ | ||
| + | |||
| + | HERE | ||
| + | |||
| + | Prenons le cas de la création d'un répertoire à la racine du système de fichiers afin d'y stocker les pages web du serveur apache : | ||
| + | |||
| + | < | ||
| + | [trainee@centos8 ~]$ su - | ||
| + | Password: | ||
| + | |||
| + | [root@centos8 ~]# mkdir /www | ||
| + | [root@centos8 ~]# touch / | ||
| + | </ | ||
| + | |||
| + | Installez maintenant le serveur Apache : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# dnf install httpd -y | ||
| + | </ | ||
| + | |||
| + | Modifiez ensuite la directive **%%DocumentRoot%%** dans le fichier **/ | ||
| + | |||
| + | < | ||
| + | [...] | ||
| + | # | ||
| + | DocumentRoot "/ | ||
| + | [...] | ||
| + | </ | ||
| + | |||
| + | Ajoutez les section **< | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | < | ||
| + | AllowOverride None | ||
| + | # Allow open access: | ||
| + | Require all granted | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | Options Indexes FollowSymLinks | ||
| + | AllowOverride None | ||
| + | Require all granted | ||
| + | </ | ||
| + | |||
| + | # Further relax access to the default document root: | ||
| + | < | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Créez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# cat / | ||
| + | < | ||
| + | < | ||
| + | This is a test | ||
| + | </ | ||
| + | < | ||
| + | www test page | ||
| + | </ | ||
| + | </ | ||
| + | </ | ||
| + | |||
| + | Modifiez ensuite le propriétaire et le groupe du répertoire **/www** et son contenu : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# chown -R apache: | ||
| + | </ | ||
| + | |||
| + | Dernièrement, | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# touch / | ||
| + | </ | ||
| + | |||
| + | Redémarrez maintenant le service httpd : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# systemctl restart httpd.service | ||
| + | [root@centos8 ~]# systemctl status httpd.service | ||
| + | ● httpd.service - The Apache HTTP Server | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Main PID: 53680 (httpd) | ||
| + | | ||
| + | Tasks: 213 (limit: 100949) | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Oct 02 12:24:14 centos8.ittraining.loc systemd[1]: Starting The Apache HTTP Server... | ||
| + | Oct 02 12:24:15 centos8.ittraining.loc systemd[1]: Started The Apache HTTP Server. | ||
| + | Oct 02 12:24:15 centos8.ittraining.loc httpd[53680]: | ||
| + | </ | ||
| + | |||
| + | Passez SELinux en mode enforcing : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# setenforce enforcing | ||
| + | |||
| + | [root@centos8 ~]# getenforce | ||
| + | Enforcing | ||
| + | </ | ||
| + | |||
| + | Consultez le site localhost en utilisant **lynx** : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# lynx localhost | ||
| + | bash: lynx: command not found... | ||
| + | Install package ' | ||
| + | |||
| + | |||
| + | * Waiting in queue... | ||
| + | * Loading list of packages.... | ||
| + | The following packages have to be installed: | ||
| + | | ||
| + | Proceed with changes? [N/y] y | ||
| + | |||
| + | |||
| + | * Waiting in queue... | ||
| + | * Waiting for authentication... | ||
| + | * Waiting in queue... | ||
| + | * Downloading packages... | ||
| + | * Requesting data... | ||
| + | * Testing changes... | ||
| + | * Installing packages... | ||
| + | |||
| + | HTTP Server Test Page | ||
| + | |||
| + | This page is used to test the proper operation of the HTTP server after | ||
| + | it has been installed. If you can read this page it means that this | ||
| + | site is working properly. This server is powered by [1]CentOS. | ||
| + | | ||
| + | |||
| + | If you are a member of the general public: | ||
| + | |||
| + | The website you just visited is either experiencing problems or is | ||
| + | | ||
| + | |||
| + | If you would like to let the administrators of this website know that | ||
| + | | ||
| + | them e-mail. In general, mail sent to the name " | ||
| + | to the website' | ||
| + | |||
| + | For example, if you experienced problems while visiting | ||
| + | | ||
| + | |||
| + | If you are the website administrator: | ||
| + | |||
| + | You may now add content to the webroot directory. Note that until you | ||
| + | do so, people visiting your website will see this page, and not your | ||
| + | | ||
| + | |||
| + | For systems using the Apache HTTP Server: You may now add content to | ||
| + | the directory / | ||
| + | | ||
| + | | ||
| + | file / | ||
| + | |||
| + | For systems using NGINX: You should now put your content in a location | ||
| + | of your choice and edit the root configuration directive in the nginx | ||
| + | | ||
| + | |||
| + | [2][ Powered by CentOS ] [ Powered by CentOS ] | ||
| + | | ||
| + | |||
| + | Important note! | ||
| + | |||
| + | The CentOS Project has nothing to do with this website or its content, | ||
| + | it just provides the software that makes the website run. | ||
| + | |||
| + | If you have issues with the content of this site, contact the owner of | ||
| + | the domain, not the CentOS project. Unless you intended to visit | ||
| + | | ||
| + | | ||
| + | |||
| + | For example, if this website is www.example.com, | ||
| + | owner of the example.com domain at the following WHOIS server: | ||
| + | | ||
| + | |||
| + | © 2021 The CentOS Project | [4]Legal | [5]Privacy | ||
| + | |||
| + | References | ||
| + | |||
| + | 1. http:// | ||
| + | 2. https:// | ||
| + | 3. http:// | ||
| + | 4. https:// | ||
| + | 5. https:// | ||
| + | </ | ||
| + | |||
| + | Consultez les messages d' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# grep " | ||
| + | ... | ||
| + | Oct 2 12:44:28 centos8 setroubleshoot[57035]: | ||
| + | Oct 2 12:44:28 centos8 setroubleshoot[57035]: | ||
| + | Oct 2 12:44:38 centos8 setroubleshoot[57035]: | ||
| + | Oct 2 12:44:38 centos8 setroubleshoot[57035]: | ||
| + | </ | ||
| + | |||
| + | La commande **sealert** possède à la fois une interface graphique **et** un mode en ligne de commande. | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# sealert -l a169ef1e-7a43-47d5-ac8f-36d5459c82b6 | ||
| + | SELinux is preventing / | ||
| + | |||
| + | ***** Plugin catchall (100. confidence) suggests | ||
| + | |||
| + | If you believe that httpd should have the net_admin capability by default. | ||
| + | Then you should report this as a bug. | ||
| + | You can generate a local policy module to allow this access. | ||
| + | Do | ||
| + | allow this access for now by executing: | ||
| + | # ausearch -c ' | ||
| + | # semodule -X 300 -i my-httpd.pp | ||
| + | |||
| + | |||
| + | Additional Information: | ||
| + | Source Context | ||
| + | Target Context | ||
| + | Target Objects | ||
| + | Source | ||
| + | Source Path / | ||
| + | Port < | ||
| + | Host centos8.ittraining.loc | ||
| + | Source RPM Packages | ||
| + | Target RPM Packages | ||
| + | SELinux Policy RPM selinux-policy-targeted-3.14.3-80.el8_5.2.noarch | ||
| + | Local Policy RPM selinux-policy-targeted-3.14.3-80.el8_5.2.noarch | ||
| + | Selinux Enabled | ||
| + | Policy Type | ||
| + | Enforcing Mode Enforcing | ||
| + | Host Name | ||
| + | Platform | ||
| + | 4.18.0-348.7.1.el8_5.x86_64 #1 SMP Wed Dec 22 | ||
| + | 13:25:12 UTC 2021 x86_64 x86_64 | ||
| + | Alert Count 110 | ||
| + | First Seen 2024-10-02 12:24:14 CEST | ||
| + | Last Seen | ||
| + | Local ID a169ef1e-7a43-47d5-ac8f-36d5459c82b6 | ||
| + | |||
| + | Raw Audit Messages | ||
| + | type=AVC msg=audit(1727866125.775: | ||
| + | |||
| + | |||
| + | Hash: httpd, | ||
| + | </ | ||
| + | |||
| + | Ce message a été généré parce que le repertoire /www ainsi que le fichier index.html ne possèdent pas le **type** nécessaire pour que le service apache puisse les utiliser : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# ls -Z / | ||
| + | unconfined_u: | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# ls -Z / | ||
| + | unconfined_u: | ||
| + | </ | ||
| + | |||
| + | L' | ||
| + | |||
| + | Pour vérifier la cause de l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# grep "/ | ||
| + | ... | ||
| + | Oct 2 12:44:48 centos8 setroubleshoot[57035]: | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Modifiez donc la SC de /www et / | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# chcon -Rv --type=httpd_sys_content_t /www | ||
| + | changing security context of '/ | ||
| + | changing security context of '/ | ||
| + | |||
| + | [root@centos8 ~]# ls -Z / | ||
| + | unconfined_u: | ||
| + | </ | ||
| + | |||
| + | Afin de maintenir ces SC lors d'une **restauration des SC par défaut**, il convient d' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# semanage fcontext -a -t httpd_sys_content_t "/ | ||
| + | </ | ||
| + | |||
| + | Vérifiez que ces modifications fonctionnent : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# lynx --dump localhost | ||
| + | www test page | ||
| + | </ | ||
| + | |||
| + | ====La commande restorecon==== | ||
| + | |||
| + | < | ||
| + | usage: | ||
| + | </ | ||
| + | |||
| + | Pour illustrer l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# cd /tmp ; touch copy.html move.html | ||
| + | |||
| + | [root@centos8 tmp]# ls -Z | grep html | ||
| + | | ||
| + | | ||
| + | </ | ||
| + | |||
| + | **Copiez** le fichier copy.html vers / | ||
| + | |||
| + | < | ||
| + | [root@centos8 tmp]# cp copy.html / | ||
| + | [root@centos8 tmp]# mv move.html / | ||
| + | [root@centos8 tmp]# ls -Z / | ||
| + | unconfined_u: | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez ici que copy.html a pris le type du répertoire de destination tandis que move.html retient le type obtenu lors de sa création. | ||
| + | </ | ||
| + | |||
| + | Restaurez maintenant la SC par défaut de move.html compte tenu de son emplacement en utilisant la commande **restorecon** : | ||
| + | |||
| + | < | ||
| + | [root@centos8 tmp]# restorecon -v / | ||
| + | Relabeled / | ||
| + | |||
| + | [root@centos8 tmp]# ls -Z / | ||
| + | unconfined_u: | ||
| + | </ | ||
| + | |||
| + | ====Le fichier / | ||
| + | |||
| + | En cas de besoin il est intéressant de pouvoir restaurer les SC par défaut sur l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 tmp]# touch / | ||
| + | [root@centos8 tmp]# shutdown -r now | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | root@computeXX: | ||
| + | trainee@10.0.2.45' | ||
| + | Activate the web console with: systemctl enable --now cockpit.socket | ||
| + | |||
| + | Last login: Wed Oct 2 11:47:29 2024 from 10.0.2.1 | ||
| + | [trainee@centos8 ~]$ su - | ||
| + | Password: fenestros | ||
| + | </ | ||
| + | |||
| + | ====La commande semanage==== | ||
| + | |||
| + | La commande **semanage** peut prendre plusieurs options : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# semanage --help | ||
| + | usage: semanage [-h] | ||
| + | {import, | ||
| + | ... | ||
| + | |||
| + | semanage is used to configure certain elements of SELinux policy with-out | ||
| + | requiring modification to or recompilation from policy source. | ||
| + | |||
| + | positional arguments: | ||
| + | {import, | ||
| + | import | ||
| + | export | ||
| + | login | ||
| + | confined users | ||
| + | user Manage SELinux confined users (Roles and levels for an | ||
| + | SELinux user) | ||
| + | port Manage network port type definitions | ||
| + | ibpkey | ||
| + | ibendport | ||
| + | interface | ||
| + | module | ||
| + | node Manage network node type definitions | ||
| + | fcontext | ||
| + | boolean | ||
| + | permissive | ||
| + | dontaudit | ||
| + | |||
| + | optional arguments: | ||
| + | -h, --help | ||
| + | </ | ||
| + | |||
| + | Pour illustrer l' | ||
| + | |||
| + | %%SELinux%% gère aussi l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# semanage port -l | ||
| + | SELinux Port Type Proto Port Number | ||
| + | |||
| + | afs3_callback_port_t | ||
| + | afs3_callback_port_t | ||
| + | afs_bos_port_t | ||
| + | afs_fs_port_t | ||
| + | afs_fs_port_t | ||
| + | afs_ka_port_t | ||
| + | afs_pt_port_t | ||
| + | afs_pt_port_t | ||
| + | afs_vl_port_t | ||
| + | agentx_port_t | ||
| + | agentx_port_t | ||
| + | amanda_port_t | ||
| + | amanda_port_t | ||
| + | amavisd_recv_port_t | ||
| + | amavisd_send_port_t | ||
| + | amqp_port_t | ||
| + | amqp_port_t | ||
| + | aol_port_t | ||
| + | aol_port_t | ||
| + | apc_port_t | ||
| + | apc_port_t | ||
| + | apcupsd_port_t | ||
| + | apcupsd_port_t | ||
| + | apertus_ldp_port_t | ||
| + | apertus_ldp_port_t | ||
| + | appswitch_emp_port_t | ||
| + | appswitch_emp_port_t | ||
| + | asterisk_port_t | ||
| + | asterisk_port_t | ||
| + | audit_port_t | ||
| + | auth_port_t | ||
| + | babel_port_t | ||
| + | bacula_port_t | ||
| + | bacula_port_t | ||
| + | bctp_port_t | ||
| + | bctp_port_t | ||
| + | bfd_control_port_t | ||
| + | bfd_control_port_t | ||
| + | bgp_port_t | ||
| + | bgp_port_t | ||
| + | boinc_client_port_t | ||
| + | boinc_client_port_t | ||
| + | boinc_port_t | ||
| + | brlp_port_t | ||
| + | certmaster_port_t | ||
| + | chronyd_port_t | ||
| + | clamd_port_t | ||
| + | clockspeed_port_t | ||
| + | cluster_port_t | ||
| + | cluster_port_t | ||
| + | cma_port_t | ||
| + | cma_port_t | ||
| + | cobbler_port_t | ||
| + | collectd_port_t | ||
| + | commplex_link_port_t | ||
| + | commplex_link_port_t | ||
| + | commplex_main_port_t | ||
| + | commplex_main_port_t | ||
| + | comsat_port_t | ||
| + | condor_port_t | ||
| + | condor_port_t | ||
| + | conman_port_t | ||
| + | conman_port_t | ||
| + | connlcli_port_t | ||
| + | connlcli_port_t | ||
| + | conntrackd_port_t | ||
| + | couchdb_port_t | ||
| + | couchdb_port_t | ||
| + | ctdb_port_t | ||
| + | ctdb_port_t | ||
| + | cvs_port_t | ||
| + | cvs_port_t | ||
| + | cyphesis_port_t | ||
| + | cyphesis_port_t | ||
| + | cyrus_imapd_port_t | ||
| + | daap_port_t | ||
| + | daap_port_t | ||
| + | dbskkd_port_t | ||
| + | dcc_port_t | ||
| + | dccm_port_t | ||
| + | dccm_port_t | ||
| + | dey_keyneg_port_t | ||
| + | dey_keyneg_port_t | ||
| + | dey_sapi_port_t | ||
| + | dhcpc_port_t | ||
| + | dhcpc_port_t | ||
| + | dhcpd_port_t | ||
| + | dhcpd_port_t | ||
| + | dict_port_t | ||
| + | distccd_port_t | ||
| + | dns_port_t | ||
| + | dns_port_t | ||
| + | dnssec_port_t | ||
| + | dogtag_port_t | ||
| + | echo_port_t | ||
| + | echo_port_t | ||
| + | efs_port_t | ||
| + | embrace_dp_c_port_t | ||
| + | embrace_dp_c_port_t | ||
| + | ephemeral_port_t | ||
| + | ephemeral_port_t | ||
| + | epmap_port_t | ||
| + | epmap_port_t | ||
| + | epmd_port_t | ||
| + | epmd_port_t | ||
| + | fac_restore_port_t | ||
| + | fac_restore_port_t | ||
| + | fingerd_port_t | ||
| + | firepower_port_t | ||
| + | firepower_port_t | ||
| + | flash_port_t | ||
| + | flash_port_t | ||
| + | fmpro_internal_port_t | ||
| + | fmpro_internal_port_t | ||
| + | freeipmi_port_t | ||
| + | freeipmi_port_t | ||
| + | ftp_data_port_t | ||
| + | ftp_port_t | ||
| + | ftp_port_t | ||
| + | gatekeeper_port_t | ||
| + | gatekeeper_port_t | ||
| + | gdomap_port_t | ||
| + | gdomap_port_t | ||
| + | gds_db_port_t | ||
| + | gds_db_port_t | ||
| + | gear_port_t | ||
| + | gear_port_t | ||
| + | geneve_port_t | ||
| + | giftd_port_t | ||
| + | git_port_t | ||
| + | git_port_t | ||
| + | glance_port_t | ||
| + | glance_port_t | ||
| + | glance_registry_port_t | ||
| + | glance_registry_port_t | ||
| + | gluster_port_t | ||
| + | gopher_port_t | ||
| + | gopher_port_t | ||
| + | gpsd_port_t | ||
| + | hadoop_datanode_port_t | ||
| + | hadoop_namenode_port_t | ||
| + | hddtemp_port_t | ||
| + | hi_reserved_port_t | ||
| + | hi_reserved_port_t | ||
| + | hi_reserved_port_t | ||
| + | howl_port_t | ||
| + | howl_port_t | ||
| + | hplip_port_t | ||
| + | http_cache_port_t | ||
| + | http_cache_port_t | ||
| + | http_port_t | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Notez par exemple que le serveur apache est autorisé d' | ||
| + | |||
| + | < | ||
| + | http_port_t | ||
| + | </ | ||
| + | |||
| + | Dans le cas où on souhaite qu' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# semanage port -a -t http_port_t -p tcp 8090 | ||
| + | </ | ||
| + | |||
| + | Vous noterez que le port 8090 a été ajouté à la liste des ports reconnus comme valides par %%SELinux%% : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# semanage port -l | grep http | ||
| + | http_cache_port_t | ||
| + | http_cache_port_t | ||
| + | http_port_t | ||
| + | pegasus_http_port_t | ||
| + | pegasus_https_port_t | ||
| + | </ | ||
| + | |||
| + | ====La commande audit2allow==== | ||
| + | |||
| + | La création d'un module de politique personnalisé se fait en utilisant la commande **audit2allow**. L' | ||
| + | |||
| + | * la résolution du problème n'est pas possible en utilisant une des commandes précédemment citées, | ||
| + | * il n' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# audit2allow --help | ||
| + | Usage: audit2allow [options] | ||
| + | |||
| + | Options: | ||
| + | --version | ||
| + | -h, --help | ||
| + | -b, --boot | ||
| + | -a, --all read input from audit log - conflicts with -i | ||
| + | -p POLICY, --policy=POLICY | ||
| + | Policy file to use for analysis | ||
| + | -d, --dmesg | ||
| + | --input | ||
| + | -i INPUT, --input=INPUT | ||
| + | read input from < | ||
| + | -l, --lastreload | ||
| + | -r, --requires | ||
| + | -m MODULE, --module=MODULE | ||
| + | set the module name - implies --requires | ||
| + | -M MODULE_PACKAGE, | ||
| + | generate a module package - conflicts with -o and -m | ||
| + | -o OUTPUT, --output=OUTPUT | ||
| + | append output to < | ||
| + | -D, --dontaudit | ||
| + | -R, --reference | ||
| + | -N, --noreference | ||
| + | -v, --verbose | ||
| + | -e, --explain | ||
| + | -t TYPE, --type=TYPE | ||
| + | regex | ||
| + | --perm-map=PERM_MAP | ||
| + | --interface-info=INTERFACE_INFO | ||
| + | file name of interface information | ||
| + | -x, --xperms | ||
| + | --debug | ||
| + | -w, --why | ||
| + | of why the access was denied | ||
| + | </ | ||
| + | |||
| + | Pour illustrer l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 tmp]# mkdir /www1 | ||
| + | [root@centos8 tmp]# touch / | ||
| + | </ | ||
| + | |||
| + | Éditez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [...] | ||
| + | # | ||
| + | DocumentRoot "/ | ||
| + | [...] | ||
| + | </ | ||
| + | |||
| + | Ajoutez les section **< | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | < | ||
| + | AllowOverride None | ||
| + | # Allow open access: | ||
| + | Require all granted | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | Options Indexes FollowSymLinks | ||
| + | AllowOverride None | ||
| + | Require all granted | ||
| + | </ | ||
| + | |||
| + | # Further relax access to the default document root: | ||
| + | < | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Créez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# vi / | ||
| + | [root@centos8 ~]# cat / | ||
| + | < | ||
| + | < | ||
| + | This is a test | ||
| + | </ | ||
| + | < | ||
| + | www1 test page | ||
| + | </ | ||
| + | </ | ||
| + | </ | ||
| + | |||
| + | Modifiez ensuite le propriétaire et le groupe du répertoire **/www1** et son contenu : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# chown -R apache: | ||
| + | </ | ||
| + | |||
| + | Redémarrez le service httpd : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# systemctl restart httpd.service | ||
| + | [root@centos8 ~]# systemctl status httpd.service | ||
| + | ● httpd.service - The Apache HTTP Server | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Main PID: 3255 (httpd) | ||
| + | | ||
| + | Tasks: 213 (limit: 100949) | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Oct 02 13:17:31 centos8.ittraining.loc systemd[1]: Starting The Apache HTTP Server... | ||
| + | Oct 02 13:17:32 centos8.ittraining.loc systemd[1]: Started The Apache HTTP Server. | ||
| + | Oct 02 13:17:32 centos8.ittraining.loc httpd[3255]: | ||
| + | </ | ||
| + | |||
| + | Consultez le site localhost en utilisant **lynx** : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# lynx --dump localhost | ||
| + | HTTP Server Test Page | ||
| + | |||
| + | This page is used to test the proper operation of the HTTP server after | ||
| + | it has been installed. If you can read this page it means that this | ||
| + | site is working properly. This server is powered by [1]CentOS. | ||
| + | | ||
| + | |||
| + | If you are a member of the general public: | ||
| + | |||
| + | The website you just visited is either experiencing problems or is | ||
| + | | ||
| + | |||
| + | If you would like to let the administrators of this website know that | ||
| + | | ||
| + | them e-mail. In general, mail sent to the name " | ||
| + | to the website' | ||
| + | |||
| + | For example, if you experienced problems while visiting | ||
| + | | ||
| + | |||
| + | If you are the website administrator: | ||
| + | |||
| + | You may now add content to the webroot directory. Note that until you | ||
| + | do so, people visiting your website will see this page, and not your | ||
| + | | ||
| + | |||
| + | For systems using the Apache HTTP Server: You may now add content to | ||
| + | the directory / | ||
| + | | ||
| + | | ||
| + | file / | ||
| + | |||
| + | For systems using NGINX: You should now put your content in a location | ||
| + | of your choice and edit the root configuration directive in the nginx | ||
| + | | ||
| + | |||
| + | [2][ Powered by CentOS ] [ Powered by CentOS ] | ||
| + | | ||
| + | |||
| + | Important note! | ||
| + | |||
| + | The CentOS Project has nothing to do with this website or its content, | ||
| + | it just provides the software that makes the website run. | ||
| + | |||
| + | If you have issues with the content of this site, contact the owner of | ||
| + | the domain, not the CentOS project. Unless you intended to visit | ||
| + | | ||
| + | | ||
| + | |||
| + | For example, if this website is www.example.com, | ||
| + | owner of the example.com domain at the following WHOIS server: | ||
| + | | ||
| + | |||
| + | © 2021 The CentOS Project | [4]Legal | [5]Privacy | ||
| + | |||
| + | References | ||
| + | |||
| + | 1. http:// | ||
| + | 2. https:// | ||
| + | 3. http:// | ||
| + | 4. https:// | ||
| + | 5. https:// | ||
| + | </ | ||
| + | |||
| + | Le fichier **/ | ||
| + | |||
| + | < | ||
| + | Oct 2 13:20:57 centos8 setroubleshoot[3502]: | ||
| + | Oct 2 13:20:57 centos8 setroubleshoot[3502]: | ||