Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:centos:8:avance:l114 [2024/10/02 14:41] – admin | elearning:workbooks:centos:8:avance:l114 [2024/10/18 07:58] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 9: | Ligne 9: | ||
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| - | * **LCF606 - Gestion de Netfilter et de Firewalld** | + | * **LCF606 - Gestion de la Sécurité** |
| * Contenu du Module | * Contenu du Module | ||
| * Le Pare-feu Netfilter/ | * Le Pare-feu Netfilter/ | ||
| Ligne 70: | Ligne 70: | ||
| * Utiliser la Commande Fail2Ban-server | * Utiliser la Commande Fail2Ban-server | ||
| * Ajouter un Prison | * Ajouter un Prison | ||
| + | * Balayage des Ports | ||
| + | * LAB #5 - Utilisation de nmap et de netcat | ||
| + | * nmap | ||
| + | * Installation | ||
| + | * Utilisation | ||
| + | * Fichiers de Configuration | ||
| + | * Scripts | ||
| + | * netcat | ||
| + | * Utilisation | ||
| + | * LAB #6 - Mise en place du Système de Détection et de Prévention d' | ||
| + | * Installation | ||
| + | * Configuration | ||
| + | * Utilisation | ||
| + | * Système de Fichiers | ||
| + | * LAB #7 - Mise en place du File Integrity Checker Afick | ||
| + | * Présentation | ||
| + | * Installation | ||
| + | * Configuration | ||
| + | * La Section Directives | ||
| + | * La Section Alias | ||
| + | * La Section File | ||
| + | * Utilisation | ||
| + | * Automatiser Afick | ||
| + | * LAB #8 - Mise en place de rkhunter | ||
| + | * Installation | ||
| + | * Les options de la commande | ||
| + | * Utilisation | ||
| + | * Configuration | ||
| + | |||
| =====Le Pare-feu Netfilter===== | =====Le Pare-feu Netfilter===== | ||
| Ligne 1066: | Ligne 1095: | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Attention ! La règle ajoutée avec l' | + | **Important** - Attention ! La règle ajoutée avec l' |
| </ | </ | ||
| Ligne 1365: | Ligne 1394: | ||
| ====Les fichiers .rhosts==== | ====Les fichiers .rhosts==== | ||
| - | Le systeme | + | Le système |
| # find / -name " | # find / -name " | ||
| Ligne 1371: | Ligne 1400: | ||
| ====Les fichiers et les repertoires sans proprietaire==== | ====Les fichiers et les repertoires sans proprietaire==== | ||
| - | Afin de dresser la liste des fichiers et des groupes sans proprietaires | + | Afin de dresser la liste des fichiers et des groupes sans propriétaires |
| # find / -nouser -exec ls -l \{\} \; 2> sans_pro.txt [Entree] | # find / -nouser -exec ls -l \{\} \; 2> sans_pro.txt [Entree] | ||
| Ligne 1387: | Ligne 1416: | ||
| ====Limiter le delai d' | ====Limiter le delai d' | ||
| - | Une session de shell laissee | + | Une session de shell laissée |
| < | < | ||
| Ligne 1478: | Ligne 1507: | ||
| </ | </ | ||
| - | A ce fichier doivent | + | A ce fichier doivent |
| < | < | ||
| Ligne 2597: | Ligne 2626: | ||
| </ | </ | ||
| - | Consultez les messages d' | + | Consultez les messages d' |
| < | < | ||
| Ligne 3408: | Ligne 3437: | ||
| ====LAB #4 - Mise en place du Système de Prévention d' | ====LAB #4 - Mise en place du Système de Prévention d' | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Pour continuer, il faut travailler sur un CentOS 8 Stream. | ||
| + | </ | ||
| Fail2Ban est un **S**ystème de **P**révention d' | Fail2Ban est un **S**ystème de **P**révention d' | ||
| Ligne 3514: | Ligne 3547: | ||
| | action | Spécifie l' | | action | Spécifie l' | ||
| - | Il n'est pas recommendé | + | Il n'est pas recommandé |
| < | < | ||
| Ligne 4237: | Ligne 4270: | ||
| ==Ajouter un Prison== | ==Ajouter un Prison== | ||
| - | |||
| - | Installez maintenant le serveur Apache si ce n'est pas déjà fait : | ||
| - | |||
| - | < | ||
| - | [root@centos7 ~]# yum install httpd | ||
| - | </ | ||
| - | |||
| - | Activez et démarrez le service Apache si ce n'est pas déjà lancé : | ||
| - | |||
| - | < | ||
| - | [root@centos7 ~]# systemctl status httpd | ||
| - | ● httpd.service - The Apache HTTP Server | ||
| - | | ||
| - | | ||
| - | Docs: man: | ||
| - | | ||
| - | |||
| - | [root@centos7 ~]# systemctl enable httpd | ||
| - | |||
| - | Created symlink from / | ||
| - | |||
| - | [root@centos7 ~]# systemctl start httpd | ||
| - | </ | ||
| Modifiez maintenant votre fichier **/ | Modifiez maintenant votre fichier **/ | ||
| Ligne 4291: | Ligne 4301: | ||
| </ | </ | ||
| + | =====Balayage des Ports===== | ||
| + | |||
| + | ====LAB #5 - Utilisation de nmap et de netcat==== | ||
| + | |||
| + | === nmap === | ||
| + | |||
| + | ==Installation== | ||
| + | |||
| + | Sous RHEL/CentOS 8, **nmap** n'est pas installé par défaut : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# which nmap | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | Installez donc nmap en utilisant yum : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# dnf install nmap | ||
| + | </ | ||
| + | |||
| + | ==Options de la commande== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# nmap --help | ||
| + | Nmap 7.92 ( https:// | ||
| + | Usage: nmap [Scan Type(s)] [Options] {target specification} | ||
| + | TARGET SPECIFICATION: | ||
| + | Can pass hostnames, IP addresses, networks, etc. | ||
| + | Ex: scanme.nmap.org, | ||
| + | -iL < | ||
| + | -iR <num hosts>: Choose random targets | ||
| + | --exclude < | ||
| + | --excludefile < | ||
| + | HOST DISCOVERY: | ||
| + | -sL: List Scan - simply list targets to scan | ||
| + | -sn: Ping Scan - disable port scan | ||
| + | -Pn: Treat all hosts as online -- skip host discovery | ||
| + | -PS/ | ||
| + | -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes | ||
| + | -PO[protocol list]: IP Protocol Ping | ||
| + | -n/-R: Never do DNS resolution/ | ||
| + | --dns-servers < | ||
| + | --system-dns: | ||
| + | --traceroute: | ||
| + | SCAN TECHNIQUES: | ||
| + | -sS/ | ||
| + | -sU: UDP Scan | ||
| + | -sN/sF/sX: TCP Null, FIN, and Xmas scans | ||
| + | --scanflags < | ||
| + | -sI <zombie host[: | ||
| + | -sY/sZ: SCTP INIT/ | ||
| + | -sO: IP protocol scan | ||
| + | -b <FTP relay host>: FTP bounce scan | ||
| + | PORT SPECIFICATION AND SCAN ORDER: | ||
| + | -p <port ranges>: Only scan specified ports | ||
| + | Ex: -p22; -p1-65535; -p U: | ||
| + | --exclude-ports <port ranges>: Exclude the specified ports from scanning | ||
| + | -F: Fast mode - Scan fewer ports than the default scan | ||
| + | -r: Scan ports consecutively - don't randomize | ||
| + | --top-ports < | ||
| + | --port-ratio < | ||
| + | SERVICE/ | ||
| + | -sV: Probe open ports to determine service/ | ||
| + | --version-intensity < | ||
| + | --version-light: | ||
| + | --version-all: | ||
| + | --version-trace: | ||
| + | SCRIPT SCAN: | ||
| + | -sC: equivalent to --script=default | ||
| + | --script=< | ||
| + | | ||
| + | --script-args=< | ||
| + | --script-args-file=filename: | ||
| + | --script-trace: | ||
| + | --script-updatedb: | ||
| + | --script-help=< | ||
| + | < | ||
| + | | ||
| + | OS DETECTION: | ||
| + | -O: Enable OS detection | ||
| + | --osscan-limit: | ||
| + | --osscan-guess: | ||
| + | TIMING AND PERFORMANCE: | ||
| + | Options which take < | ||
| + | ' | ||
| + | -T< | ||
| + | --min-hostgroup/ | ||
| + | --min-parallelism/ | ||
| + | --min-rtt-timeout/ | ||
| + | probe round trip time. | ||
| + | --max-retries < | ||
| + | --host-timeout < | ||
| + | --scan-delay/ | ||
| + | --min-rate < | ||
| + | --max-rate < | ||
| + | FIREWALL/ | ||
| + | -f; --mtu < | ||
| + | -D < | ||
| + | -S < | ||
| + | -e < | ||
| + | -g/ | ||
| + | --proxies < | ||
| + | --data <hex string>: Append a custom payload to sent packets | ||
| + | --data-string < | ||
| + | --data-length < | ||
| + | --ip-options < | ||
| + | --ttl < | ||
| + | --spoof-mac <mac address/ | ||
| + | --badsum: Send packets with a bogus TCP/ | ||
| + | OUTPUT: | ||
| + | -oN/ | ||
| + | and Grepable format, respectively, | ||
| + | -oA < | ||
| + | -v: Increase verbosity level (use -vv or more for greater effect) | ||
| + | -d: Increase debugging level (use -dd or more for greater effect) | ||
| + | --reason: Display the reason a port is in a particular state | ||
| + | --open: Only show open (or possibly open) ports | ||
| + | --packet-trace: | ||
| + | --iflist: Print host interfaces and routes (for debugging) | ||
| + | --append-output: | ||
| + | --resume < | ||
| + | --noninteractive: | ||
| + | --stylesheet < | ||
| + | --webxml: Reference stylesheet from Nmap.Org for more portable XML | ||
| + | --no-stylesheet: | ||
| + | MISC: | ||
| + | -6: Enable IPv6 scanning | ||
| + | -A: Enable OS detection, version detection, script scanning, and traceroute | ||
| + | --datadir < | ||
| + | --send-eth/ | ||
| + | --privileged: | ||
| + | --unprivileged: | ||
| + | -V: Print version number | ||
| + | -h: Print this help summary page. | ||
| + | EXAMPLES: | ||
| + | nmap -v -A scanme.nmap.org | ||
| + | nmap -v -sn 192.168.0.0/ | ||
| + | nmap -v -iR 10000 -Pn -p 80 | ||
| + | SEE THE MAN PAGE (https:// | ||
| + | </ | ||
| + | |||
| + | ==Utilisation== | ||
| + | |||
| + | Pour connaître la liste des ports ouverts sur votre machine virtuelle, saisissez la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# nmap 127.0.0.1 | ||
| + | Starting Nmap 7.92 ( https:// | ||
| + | Nmap scan report for localhost (127.0.0.1) | ||
| + | Host is up (0.000011s latency). | ||
| + | Not shown: 996 closed tcp ports (reset) | ||
| + | PORT STATE SERVICE | ||
| + | 22/ | ||
| + | 80/ | ||
| + | 111/tcp open rpcbind | ||
| + | 631/tcp open ipp | ||
| + | |||
| + | Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Pour connaître les ports ouverts sur une machine distante, la procédure est identique sauf que vous devez utiliser l' | ||
| + | </ | ||
| + | |||
| + | ==Fichiers de Configuration== | ||
| + | |||
| + | **nmap** utilise un fichier spécifique pour identifier les ports. Ce fichier est **/ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# more / | ||
| + | # THIS FILE IS GENERATED AUTOMATICALLY FROM A MASTER - DO NOT EDIT. | ||
| + | # EDIT / | ||
| + | # Well known service port numbers -*- mode: fundamental; | ||
| + | # From the Nmap Security Scanner ( https:// | ||
| + | # | ||
| + | # $Id: nmap-services 38272 2021-08-06 18:05:30Z dmiller $ | ||
| + | # | ||
| + | # Derived from IANA data and our own research | ||
| + | # | ||
| + | # This collection of service data is (C) 1996-2020 by Insecure.Com | ||
| + | # LLC. It is distributed under the Nmap Public Source license as | ||
| + | # provided in the LICENSE file of the source distribution or at | ||
| + | # https:// | ||
| + | # requires you to license your own work under a compatable open source | ||
| + | # license. | ||
| + | # software, we sell alternative licenses (contact sales@insecure.com). | ||
| + | # Dozens of software vendors already license Nmap technology such as | ||
| + | # host discovery, port scanning, OS detection, and version detection. | ||
| + | # For more details, see https:// | ||
| + | # | ||
| + | # Fields in this file are: Service name, portnum/ | ||
| + | # | ||
| + | tcpmux | ||
| + | tcpmux | ||
| + | compressnet | ||
| + | compressnet | ||
| + | compressnet | ||
| + | compressnet | ||
| + | unknown 4/tcp | ||
| + | rje | ||
| + | rje | ||
| + | unknown 6/tcp | ||
| + | echo 7/ | ||
| + | echo 7/tcp | ||
| + | echo 7/udp | ||
| + | unknown 8/tcp | ||
| + | discard 9/ | ||
| + | discard 9/tcp | ||
| + | discard 9/udp | ||
| + | unknown 10/ | ||
| + | systat | ||
| + | systat | ||
| + | unknown 12/ | ||
| + | daytime 13/ | ||
| + | daytime 13/ | ||
| + | unknown 14/ | ||
| + | netstat 15/ | ||
| + | unknown 16/ | ||
| + | qotd 17/ | ||
| + | qotd 17/ | ||
| + | msp | ||
| + | msp | ||
| + | chargen 19/ | ||
| + | chargen 19/ | ||
| + | ftp-data | ||
| + | --More--(0%) | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | Le répertoire **/ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# ls -l / | ||
| + | total 9312 | ||
| + | -rw-r--r--. 1 root root 10834 Mar 22 2023 nmap.dtd | ||
| + | -rw-r--r--. 1 root root 767503 Mar 22 2023 nmap-mac-prefixes | ||
| + | -rw-r--r--. 1 root root 5033049 Mar 22 2023 nmap-os-db | ||
| + | -rw-r--r--. 1 root root 21253 Mar 22 2023 nmap-payloads | ||
| + | -rw-r--r--. 1 root root 6756 Mar 22 2023 nmap-protocols | ||
| + | -rw-r--r--. 1 root root 43755 Mar 22 2023 nmap-rpc | ||
| + | -rw-r--r--. 1 root root 2498555 Mar 22 2023 nmap-service-probes | ||
| + | -rw-r--r--. 1 root root 1002889 Mar 22 2023 nmap-services | ||
| + | -rw-r--r--. 1 root root 31936 Mar 22 2023 nmap.xsl | ||
| + | drwxr-xr-x. 3 root root 8192 Oct 2 16:57 nselib | ||
| + | -rw-r--r--. 1 root root 48627 Mar 22 2023 nse_main.lua | ||
| + | drwxr-xr-x. 2 root root 28672 Oct 2 16:57 scripts | ||
| + | </ | ||
| + | |||
| + | Voici la liste des fichiers les plus importants : | ||
| + | |||
| + | ^ Fichier ^ Description ^ | ||
| + | | / | ||
| + | | / | ||
| + | | / | ||
| + | | / | ||
| + | |||
| + | ==Scripts== | ||
| + | |||
| + | **nmap** utilise des scripts pour accomplir certaines tâches allant de la découverte simple de ports ouverts jusqu' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# ls / | ||
| + | acarsd-info.nse | ||
| + | address-info.nse | ||
| + | afp-brute.nse | ||
| + | afp-ls.nse | ||
| + | afp-path-vuln.nse | ||
| + | afp-serverinfo.nse | ||
| + | afp-showmount.nse | ||
| + | ajp-auth.nse | ||
| + | ajp-brute.nse | ||
| + | ajp-headers.nse | ||
| + | ajp-methods.nse | ||
| + | ajp-request.nse | ||
| + | allseeingeye-info.nse | ||
| + | amqp-info.nse | ||
| + | asn-query.nse | ||
| + | auth-owners.nse | ||
| + | auth-spoof.nse | ||
| + | backorifice-brute.nse | ||
| + | backorifice-info.nse | ||
| + | bacnet-info.nse | ||
| + | banner.nse | ||
| + | bitcoin-getaddr.nse | ||
| + | bitcoin-info.nse | ||
| + | bitcoinrpc-info.nse | ||
| + | bittorrent-discovery.nse | ||
| + | bjnp-discover.nse | ||
| + | broadcast-ataoe-discover.nse | ||
| + | broadcast-avahi-dos.nse | ||
| + | broadcast-bjnp-discover.nse | ||
| + | broadcast-db2-discover.nse | ||
| + | broadcast-dhcp6-discover.nse | ||
| + | broadcast-dhcp-discover.nse | ||
| + | broadcast-dns-service-discovery.nse | ||
| + | broadcast-dropbox-listener.nse | ||
| + | broadcast-eigrp-discovery.nse | ||
| + | broadcast-hid-discoveryd.nse | ||
| + | broadcast-igmp-discovery.nse | ||
| + | broadcast-jenkins-discover.nse | ||
| + | broadcast-listener.nse | ||
| + | broadcast-ms-sql-discover.nse | ||
| + | broadcast-netbios-master-browser.nse | ||
| + | broadcast-networker-discover.nse | ||
| + | broadcast-novell-locate.nse | ||
| + | broadcast-ospf2-discover.nse | ||
| + | broadcast-pc-anywhere.nse | ||
| + | broadcast-pc-duo.nse | ||
| + | broadcast-pim-discovery.nse | ||
| + | broadcast-ping.nse | ||
| + | broadcast-pppoe-discover.nse | ||
| + | broadcast-rip-discover.nse | ||
| + | broadcast-ripng-discover.nse | ||
| + | broadcast-sonicwall-discover.nse | ||
| + | broadcast-sybase-asa-discover.nse | ||
| + | broadcast-tellstick-discover.nse | ||
| + | broadcast-upnp-info.nse | ||
| + | broadcast-versant-locate.nse | ||
| + | broadcast-wake-on-lan.nse | ||
| + | broadcast-wpad-discover.nse | ||
| + | broadcast-wsdd-discover.nse | ||
| + | broadcast-xdmcp-discover.nse | ||
| + | cassandra-brute.nse | ||
| + | cassandra-info.nse | ||
| + | cccam-version.nse | ||
| + | cics-enum.nse | ||
| + | cics-info.nse | ||
| + | cics-user-brute.nse | ||
| + | cics-user-enum.nse | ||
| + | citrix-brute-xml.nse | ||
| + | citrix-enum-apps.nse | ||
| + | citrix-enum-apps-xml.nse | ||
| + | citrix-enum-servers.nse | ||
| + | citrix-enum-servers-xml.nse | ||
| + | clamav-exec.nse | ||
| + | clock-skew.nse | ||
| + | coap-resources.nse | ||
| + | couchdb-databases.nse | ||
| + | couchdb-stats.nse | ||
| + | creds-summary.nse | ||
| + | cups-info.nse | ||
| + | cups-queue-info.nse | ||
| + | cvs-brute.nse | ||
| + | cvs-brute-repository.nse | ||
| + | daap-get-library.nse | ||
| + | daytime.nse | ||
| + | db2-das-info.nse | ||
| + | deluge-rpc-brute.nse | ||
| + | dhcp-discover.nse | ||
| + | dicom-brute.nse | ||
| + | dicom-ping.nse | ||
| + | dict-info.nse | ||
| + | distcc-cve2004-2687.nse | ||
| + | dns-blacklist.nse | ||
| + | dns-brute.nse | ||
| + | dns-cache-snoop.nse | ||
| + | dns-check-zone.nse | ||
| + | dns-client-subnet-scan.nse | ||
| + | dns-fuzz.nse | ||
| + | dns-ip6-arpa-scan.nse | ||
| + | dns-nsec3-enum.nse | ||
| + | dns-nsec-enum.nse | ||
| + | dns-nsid.nse | ||
| + | dns-random-srcport.nse | ||
| + | dns-random-txid.nse | ||
| + | dns-recursion.nse | ||
| + | dns-service-discovery.nse | ||
| + | dns-srv-enum.nse | ||
| + | dns-update.nse | ||
| + | dns-zeustracker.nse | ||
| + | dns-zone-transfer.nse | ||
| + | docker-version.nse | ||
| + | domcon-brute.nse | ||
| + | domcon-cmd.nse | ||
| + | domino-enum-users.nse | ||
| + | dpap-brute.nse | ||
| + | drda-brute.nse | ||
| + | drda-info.nse | ||
| + | duplicates.nse | ||
| + | eap-info.nse | ||
| + | enip-info.nse | ||
| + | epmd-info.nse | ||
| + | eppc-enum-processes.nse | ||
| + | </ | ||
| + | |||
| + | Les scripts sont regroupés dans des catégories : **auth**, **broadcast**, | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Pour plus d' | ||
| + | </ | ||
| + | |||
| + | La catégorie la plus utilisée est **default** qui est appelée par l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# nmap -v -sC localhost | ||
| + | Starting Nmap 7.92 ( https:// | ||
| + | NSE: Loaded 125 scripts for scanning. | ||
| + | NSE: Script Pre-scanning. | ||
| + | Initiating NSE at 17:02 | ||
| + | Completed NSE at 17:02, 0.00s elapsed | ||
| + | Initiating NSE at 17:02 | ||
| + | Completed NSE at 17:02, 0.00s elapsed | ||
| + | Initiating SYN Stealth Scan at 17:02 | ||
| + | Scanning localhost (127.0.0.1) [1000 ports] | ||
| + | Discovered open port 80/tcp on 127.0.0.1 | ||
| + | Discovered open port 111/tcp on 127.0.0.1 | ||
| + | Discovered open port 22/tcp on 127.0.0.1 | ||
| + | Discovered open port 631/tcp on 127.0.0.1 | ||
| + | Completed SYN Stealth Scan at 17:02, 0.04s elapsed (1000 total ports) | ||
| + | NSE: Script scanning 127.0.0.1. | ||
| + | Initiating NSE at 17:02 | ||
| + | Completed NSE at 17:02, 0.38s elapsed | ||
| + | Initiating NSE at 17:02 | ||
| + | Completed NSE at 17:02, 0.00s elapsed | ||
| + | Nmap scan report for localhost (127.0.0.1) | ||
| + | Host is up (0.000011s latency). | ||
| + | Other addresses for localhost (not scanned): ::1 | ||
| + | Not shown: 996 closed tcp ports (reset) | ||
| + | PORT STATE SERVICE | ||
| + | 22/ | ||
| + | | ssh-hostkey: | ||
| + | | 3072 11: | ||
| + | | 256 9d: | ||
| + | |_ 256 d9: | ||
| + | 80/ | ||
| + | | http-methods: | ||
| + | | | ||
| + | |_ Potentially risky methods: TRACE | ||
| + | |_http-title: | ||
| + | 111/tcp open rpcbind | ||
| + | | rpcinfo: | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | | | ||
| + | |_ 100000 | ||
| + | 631/tcp open ipp | ||
| + | | http-robots.txt: | ||
| + | |_/ | ||
| + | |_http-title: | ||
| + | | ssl-cert: Subject: commonName=centos8.ittraining.loc/ | ||
| + | | Issuer: commonName=centos8.ittraining.loc/ | ||
| + | | Public Key type: rsa | ||
| + | | Public Key bits: 2048 | ||
| + | | Signature Algorithm: sha256WithRSAEncryption | ||
| + | | Not valid before: 2024-10-02T15: | ||
| + | | Not valid after: | ||
| + | | MD5: 3dbd 816b b33c 9bd8 d9f0 f0c4 8204 a60b | ||
| + | |_SHA-1: 9d58 dda8 a024 41db 63cb bb85 fea9 86c1 6238 399b | ||
| + | | http-methods: | ||
| + | |_ Supported Methods: GET HEAD POST OPTIONS | ||
| + | |_ssl-date: TLS randomness does not represent time | ||
| + | |||
| + | NSE: Script Post-scanning. | ||
| + | Initiating NSE at 17:02 | ||
| + | Completed NSE at 17:02, 0.00s elapsed | ||
| + | Initiating NSE at 17:02 | ||
| + | Completed NSE at 17:02, 0.00s elapsed | ||
| + | Read data files from: / | ||
| + | Nmap done: 1 IP address (1 host up) scanned in 0.82 seconds | ||
| + | Raw packets sent: 1000 (44.000KB) | Rcvd: 2004 (84.176KB) | ||
| + | </ | ||
| + | |||
| + | <WRAP center round warning 50%> | ||
| + | **Attention** - La catégorie par défaut **default** contient certains scripts de la catégorie **intrusive**. Vous ne devez donc jamais utiliser cette option sur un réseau sans avoir obtenu un accord au préalable. | ||
| + | </ | ||
| + | |||
| + | ===netcat === | ||
| + | |||
| + | **netcat** est un couteau suisse. Il permet non seulement de scanner des ports mais aussi de lancer la connexion lors de la découverte d'un port ouvert. | ||
| + | |||
| + | ==Options de la commande== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# nc --help | ||
| + | Ncat 7.92 ( https:// | ||
| + | Usage: ncat [options] [hostname] [port] | ||
| + | |||
| + | Options taking a time assume seconds. Append ' | ||
| + | ' | ||
| + | -4 Use IPv4 only | ||
| + | -6 Use IPv6 only | ||
| + | -U, --unixsock | ||
| + | --vsock | ||
| + | -C, --crlf | ||
| + | -c, --sh-exec < | ||
| + | -e, --exec < | ||
| + | --lua-exec < | ||
| + | -g hop1[, | ||
| + | -G < | ||
| + | -m, --max-conns < | ||
| + | -h, --help | ||
| + | -d, --delay < | ||
| + | -o, --output < | ||
| + | -x, --hex-dump < | ||
| + | -i, --idle-timeout < | ||
| + | -p, --source-port port | ||
| + | -s, --source addr Specify source address to use (doesn' | ||
| + | -l, --listen | ||
| + | -k, --keep-open | ||
| + | -n, --nodns | ||
| + | -t, --telnet | ||
| + | -u, --udp Use UDP instead of default TCP | ||
| + | --sctp | ||
| + | -v, --verbose | ||
| + | -w, --wait < | ||
| + | -z | ||
| + | --append-output | ||
| + | --send-only | ||
| + | --recv-only | ||
| + | --no-shutdown | ||
| + | --allow | ||
| + | --allowfile | ||
| + | --deny | ||
| + | --denyfile | ||
| + | --broker | ||
| + | --chat | ||
| + | --proxy < | ||
| + | --proxy-type < | ||
| + | --proxy-auth < | ||
| + | --proxy-dns < | ||
| + | --ssl Connect or listen with SSL | ||
| + | --ssl-cert | ||
| + | --ssl-key | ||
| + | --ssl-verify | ||
| + | --ssl-trustfile | ||
| + | --ssl-ciphers | ||
| + | --ssl-servername | ||
| + | --ssl-alpn | ||
| + | --version | ||
| + | |||
| + | See the ncat(1) manpage for full options, descriptions and usage examples | ||
| + | </ | ||
| + | |||
| + | ==Utilisation== | ||
| + | |||
| + | Dans l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# nc 127.0.0.1 80 -w 1 -vv | ||
| + | Ncat: Version 7.92 ( https:// | ||
| + | NCAT DEBUG: Using system default trusted CA certificates and those in / | ||
| + | NCAT DEBUG: Unable to load trusted CA certificates from / | ||
| + | libnsock nsock_iod_new2(): | ||
| + | libnsock nsock_connect_tcp(): | ||
| + | libnsock nsock_trace_handler_callback(): | ||
| + | Ncat: Connected to 127.0.0.1: | ||
| + | libnsock nsock_iod_new2(): | ||
| + | libnsock nsock_read(): | ||
| + | libnsock nsock_readbytes(): | ||
| + | ^C | ||
| + | |||
| + | [root@centos8 ~]# nc 127.0.0.1 25 -w 1 -vv | ||
| + | Ncat: Version 7.92 ( https:// | ||
| + | NCAT DEBUG: Using system default trusted CA certificates and those in / | ||
| + | NCAT DEBUG: Unable to load trusted CA certificates from / | ||
| + | libnsock nsock_iod_new2(): | ||
| + | libnsock nsock_connect_tcp(): | ||
| + | libnsock nsock_trace_handler_callback(): | ||
| + | Ncat: Connection refused. | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez que **netcat** se connecte au port 25 qui est ouvert. | ||
| + | </ | ||
| + | |||
| + | ====LAB #6 - Mise en place du Système de Détection et de Prévention d' | ||
| + | |||
| + | Portsentry est un **S**ystème de **D**étection et de **Prévention** d' | ||
| + | |||
| + | === Installation === | ||
| + | |||
| + | Sous RHEL/CentOS 8, **portsentry** n'est pas installé par défaut. Qui plus est **portsentry** ne se trouve pas dans les dépôts standards. Installez donc le paquet **portsentry-1.2-1.el5.x86_64.rpm** à partir de l'URL ci-dessous : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# rpm -ivh https:// | ||
| + | [1] 9629 | ||
| + | [root@centos8 ~]# Retrieving https:// | ||
| + | warning: / | ||
| + | Verifying... | ||
| + | Preparing... | ||
| + | Updating / installing... | ||
| + | | ||
| + | ^C | ||
| + | </ | ||
| + | |||
| + | ===Configuration=== | ||
| + | |||
| + | Téléchargez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# wget https:// | ||
| + | [1] 9676 | ||
| + | [root@centos8 ~]# | ||
| + | Redirecting output to ‘wget-log’. | ||
| + | ^C | ||
| + | [1]+ Done wget https:// | ||
| + | |||
| + | [root@centos8 ~]# mv ' | ||
| + | mv: overwrite '/ | ||
| + | </ | ||
| + | |||
| + | Pour rendre le service SysVInit compatible avec Systemd, éditez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# nl / | ||
| + | | ||
| + | 2 # | ||
| + | 3 # Startup script for the Portsentry portscan detector | ||
| + | 4 # | ||
| + | 5 # chkconfig: 345 98 02 | ||
| + | 6 # description: | ||
| + | | ||
| + | | ||
| + | | ||
| + | 10 # processname: | ||
| + | 11 # pidfile: / | ||
| + | 12 # config: / | ||
| + | |||
| + | 13 # Source function library. | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Puis ajoutez la ligne **80** : | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | 77 stop() { | ||
| + | 78 echo -n $" | ||
| + | 79 killproc portsentry | ||
| + | 80 killall portsentry | ||
| + | 81 RETVAL=$? | ||
| + | 82 echo | ||
| + | 83 [ $RETVAL -eq 0 ] && rm -f / | ||
| + | 84 } | ||
| + | |||
| + | 85 # See how we were called. | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Exécutez la commande suivante pour prendre en compte les modifications : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# systemctl daemon-reload | ||
| + | </ | ||
| + | |||
| + | ===Utilisation=== | ||
| + | |||
| + | Démarrez le service **portsentry** : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# systemctl restart portsentry | ||
| + | |||
| + | [root@centos8 ~]# systemctl status portsentry | ||
| + | ● portsentry.service - SYSV: PortSentry Port Scan Detector is part of the Abacus Project suite of tools. The Abacus Project is an initiative to release low-maintenance, | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Process: 10142 ExecStart=/ | ||
| + | Tasks: 6 (limit: 100483) | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Oct 02 17:37:33 centos8.ittraining.loc portsentry[10169]: | ||
| + | Oct 02 17:37:33 centos8.ittraining.loc portsentry[10169]: | ||
| + | Oct 02 17:37:33 centos8.ittraining.loc portsentry[10169]: | ||
| + | Oct 02 17:37:33 centos8.ittraining.loc portsentry[10169]: | ||
| + | Oct 02 17:37:33 centos8.ittraining.loc portsentry[10169]: | ||
| + | Oct 02 17:37:33 centos8.ittraining.loc portsentry[10169]: | ||
| + | Oct 02 17:37:33 centos8.ittraining.loc portsentry[10169]: | ||
| + | Oct 02 17:37:33 centos8.ittraining.loc portsentry[10169]: | ||
| + | Oct 02 17:37:33 centos8.ittraining.loc portsentry[10169]: | ||
| + | Oct 02 17:37:33 centos8.ittraining.loc portsentry[10169]: | ||
| + | |||
| + | [root@centos8 ~]# ps aux | grep portsentry | ||
| + | root 9907 0.0 0.0 | ||
| + | root 9909 0.0 0.0 | ||
| + | root | ||
| + | root | ||
| + | root | ||
| + | root | ||
| + | root | ||
| + | </ | ||
| + | |||
| + | Editez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# vi / | ||
| + | |||
| + | [root@centos8 ~]# cat / | ||
| + | # Put hosts in here you never want blocked. This includes the IP addresses | ||
| + | # of all local interfaces on the protected host (i.e virtual host, mult-home) | ||
| + | # Keep 127.0.0.1 and 0.0.0.0 to keep people from playing games. | ||
| + | # | ||
| + | # PortSentry can support full netmasks for networks as well. Format is: | ||
| + | # | ||
| + | # <IP Address>/< | ||
| + | # | ||
| + | # Example: | ||
| + | # | ||
| + | # 192.168.2.0/ | ||
| + | # 192.168.0.0/ | ||
| + | # 192.168.2.1/ | ||
| + | # Etc. | ||
| + | # | ||
| + | # If you don't supply a netmask it is assumed to be 32 bits. | ||
| + | # | ||
| + | # | ||
| + | |||
| + | 127.0.0.1/ | ||
| + | 0.0.0.0 | ||
| + | ######################################### | ||
| + | # Do NOT edit below this line, if you # | ||
| + | # do, your changes will be lost when # | ||
| + | # portsentry is restarted via the # | ||
| + | # initscript. Make all changes above # | ||
| + | # this box. # | ||
| + | ######################################### | ||
| + | |||
| + | # Exclude all local interfaces | ||
| + | fe80:: | ||
| + | 127.0.0.1 | ||
| + | ::1 | ||
| + | 192.168.122.1 | ||
| + | |||
| + | # Exclude the default gateway(s) | ||
| + | 10.0.2.1 | ||
| + | |||
| + | # Exclude the nameservers | ||
| + | 8.8.8.8 | ||
| + | |||
| + | # And last but not least... | ||
| + | 0.0.0.0 | ||
| + | </ | ||
| + | |||
| + | Installez maintenant le paquet **mailx** : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# dnf install mailx | ||
| + | </ | ||
| + | |||
| + | **Sans** re-démarrez le service portsentry, lancez un scan des ports avec nmap : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# nmap -sC 10.0.2.45 | ||
| + | Starting Nmap 7.92 ( https:// | ||
| + | ^C | ||
| + | [root@centos8 ~]# | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | Consultez les règles d' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# iptables -L | ||
| + | Chain INPUT (policy ACCEPT) | ||
| + | target | ||
| + | DROP | ||
| + | LIBVIRT_INP | ||
| + | |||
| + | Chain FORWARD (policy ACCEPT) | ||
| + | target | ||
| + | LIBVIRT_FWX | ||
| + | LIBVIRT_FWI | ||
| + | LIBVIRT_FWO | ||
| + | |||
| + | Chain OUTPUT (policy ACCEPT) | ||
| + | target | ||
| + | LIBVIRT_OUT | ||
| + | |||
| + | Chain LIBVIRT_INP (1 references) | ||
| + | target | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | |||
| + | Chain LIBVIRT_OUT (1 references) | ||
| + | target | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | |||
| + | Chain LIBVIRT_FWO (1 references) | ||
| + | target | ||
| + | ACCEPT | ||
| + | REJECT | ||
| + | |||
| + | Chain LIBVIRT_FWI (1 references) | ||
| + | target | ||
| + | ACCEPT | ||
| + | REJECT | ||
| + | |||
| + | Chain LIBVIRT_FWX (1 references) | ||
| + | target | ||
| + | ACCEPT | ||
| + | </ | ||
| + | |||
| + | Pour nettoyer la règle, re-démarrez le service **firewalld** : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# systemctl restart firewalld | ||
| + | </ | ||
| + | |||
| + | =====Système de Fichiers===== | ||
| + | |||
| + | ==== LAB #7 - Mise en place du File Integrity Checker Afick ==== | ||
| + | |||
| + | ===Présentation=== | ||
| + | |||
| + | **[[http:// | ||
| + | un logiciel dédié à la sécurité informatique, | ||
| + | |||
| + | ===Installation=== | ||
| + | |||
| + | Téléchargez la dernière version d' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# wget https:// | ||
| + | </ | ||
| + | |||
| + | Pour installer **Afick**, utilisez la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# dnf localinstall afick-3.8.1-1.noarch.rpm --nogpgcheck | ||
| + | </ | ||
| + | |||
| + | ===Configuration=== | ||
| + | |||
| + | La configuration d' | ||
| + | |||
| + | Dans ce fichier, plusieurs sections nous intéressent : | ||
| + | |||
| + | ==La Section Directives== | ||
| + | |||
| + | < | ||
| + | #################### | ||
| + | # directives section | ||
| + | #################### | ||
| + | # binary values can be : yes/1/true or no/0/false | ||
| + | # database : name with full path to database file | ||
| + | database: | ||
| + | # history : full path to history file | ||
| + | history := / | ||
| + | # archive : full path to directory for archived results | ||
| + | archive := / | ||
| + | # report_url : where to send the result : stdout/ | ||
| + | report_url := stdout | ||
| + | # report_syslog : send output to syslog ? | ||
| + | report_syslog := no | ||
| + | # mask_sysupdate : report packages update | ||
| + | mask_sysupdate := no | ||
| + | # verbose : (obsolete) boolean value for debugging messages | ||
| + | # use debug parameter below | ||
| + | verbose := no | ||
| + | # debug : set a level of debugging messages, from 0 (none) to 4 (full) | ||
| + | debug := 0 | ||
| + | # warn_dead_symlinks : boolean : if set, warn about dead symlinks | ||
| + | warn_dead_symlinks := no | ||
| + | # follow_symlinks : boolean : if set, do checksum on target file (else on target file name) | ||
| + | follow_symlinks := no | ||
| + | # allow_overload : boolean : if set, allow to overload rules (the last rule wins), else put a warning | ||
| + | allow_overload := yes | ||
| + | # report_context : boolean : if set, display all changed attributes, not just those selected by rules | ||
| + | report_context := no | ||
| + | # report_full_newdel : boolean : if set, report all changes, if not set, report only a summary on top directories | ||
| + | report_full_newdel := no | ||
| + | # report_summary : boolean ; if set, report the summary section | ||
| + | report_summary := yes | ||
| + | # warn_missing_file | ||
| + | warn_missing_file := no | ||
| + | # running_files : boolean : if set, warn about files changed during a program run | ||
| + | running_files := yes | ||
| + | # timing : boolean : if set, print timing statistics about the job | ||
| + | timing := yes | ||
| + | # ignore_case : boolean : if set, ignore case on file name | ||
| + | ignore_case := no | ||
| + | # max_checksum_size : numeric : only compute checksum on first max_checksum_size bytes ( 0 means unlimited) | ||
| + | max_checksum_size := 10000000 | ||
| + | # allow_relativepath : boolean : if set, afick files, config and databases are stored as relative path | ||
| + | allow_relativepath := 0 | ||
| + | # utc_time : boolean; if set display date in utc time, else in local time | ||
| + | utc_time := 0 | ||
| + | |||
| + | # only_suffix : list of suffix to scan (and just this ones) : is empty (disabled) by default | ||
| + | # not very usefull on unix, but is ok on windows | ||
| + | # this will speed up the scan, but with a lesser security | ||
| + | # only_suffix := | ||
| + | |||
| + | # the 3 next directives : exclude_suffix exclude_prefix exclude_re | ||
| + | # can be written on several lines | ||
| + | # exclude_suffix : list of suffixes to ignore | ||
| + | # text files | ||
| + | exclude_suffix := log LOG html htm HTM txt TXT xml | ||
| + | # help files | ||
| + | exclude_suffix := hlp pod chm | ||
| + | # old files | ||
| + | exclude_suffix := tmp old bak | ||
| + | # fonts | ||
| + | exclude_suffix := fon ttf TTF | ||
| + | # images | ||
| + | exclude_suffix := bmp BMP jpg JPG gif png ico | ||
| + | # audio | ||
| + | exclude_suffix := wav WAV mp3 avi | ||
| + | # python | ||
| + | exclude_suffix := pyc | ||
| + | |||
| + | # exclude_prefix : list of prefixes to ignore | ||
| + | exclude_prefix := __pycache__ | ||
| + | |||
| + | # exclude_re : a file pattern (using regex syntax) to ignore (apply on full path) | ||
| + | # one pattern by line | ||
| + | #exclude_re := | ||
| + | </ | ||
| + | |||
| + | Cette section définit les directives globales et notamment : | ||
| + | |||
| + | * l' | ||
| + | |||
| + | < | ||
| + | database: | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Veuillez à sauvegarder régulièrement votre base de données. En effet, dans le cas où votre système est compromis, sans sauvegarde de votre base, vous ne serez plus certain de l' | ||
| + | </ | ||
| + | |||
| + | * l' | ||
| + | |||
| + | < | ||
| + | exclude_suffix := log LOG html htm HTM txt TXT xml | ||
| + | </ | ||
| + | |||
| + | ==La Section Alias== | ||
| + | |||
| + | < | ||
| + | ############### | ||
| + | # alias section | ||
| + | ############### | ||
| + | # action : a list of item to check : | ||
| + | # md5 : md5 checksum | ||
| + | # sha1 : sha-1 checksum | ||
| + | # sha256 : sha-256 checksum | ||
| + | # sha512 : sha-512 checksum | ||
| + | # d : device | ||
| + | # i : inode | ||
| + | # p : permissions | ||
| + | # n : number of links | ||
| + | # u : user | ||
| + | # g : group | ||
| + | # s : size | ||
| + | # b : number of blocks | ||
| + | # m : mtime | ||
| + | # c : ctime | ||
| + | # a : atime | ||
| + | # acl : acl | ||
| + | |||
| + | #all: p+d+i+n+u+g+s+b+m+c+md5+acl | ||
| + | #R: p+d+i+n+u+g+s+m+c+md5 | ||
| + | #L: p+d+i+n+u+g | ||
| + | #P: p+n+u+g+s+md5 | ||
| + | #E: '' | ||
| + | |||
| + | # action alias may be configured with | ||
| + | # your_alias = another_alias|item[+item][-item] | ||
| + | # all is a pre-defined alias for all items except " | ||
| + | DIR = p+i+n+u+g | ||
| + | ETC = p+d+u+g+s+md5 | ||
| + | Logs = p+n+u+g | ||
| + | MyRule = p+d+n+u+g+s+b+md5 | ||
| + | </ | ||
| + | |||
| + | Cette partie du fichier de configuration détaille les combinaisons de vérifications de fichiers à réaliser : | ||
| + | |||
| + | < | ||
| + | DIR=p+i+n+u+g | ||
| + | ETC = p+d+i+u+g+s+md5 | ||
| + | Logs = p+n+u+g | ||
| + | MyRule = p+d+n+u+g+s+b+md5 | ||
| + | </ | ||
| + | |||
| + | Les options détaillées sont : | ||
| + | |||
| + | ^ Option ^ Description ^ | ||
| + | | md5 | Vérifie la somme de contrôle md5 du contenu du fichier | | ||
| + | | sha1 | Vérifie la somme de contrôle sha1 du contenu du fichier | | ||
| + | | d | Vérifie pour un périphérique son "major number" | ||
| + | | i | Vérifie le numéro d' | ||
| + | | p | Vérifie les droits d' | ||
| + | | n | Vérifie le nombre de liens | | ||
| + | | u | Vérifie l' | ||
| + | | g | Vérifie le groupe propriétaire du fichier | | ||
| + | | s | Vérifie la taille du fichier | | ||
| + | | b | Vérifie le nombre de blocs alloués au fichier | | ||
| + | | m | Vérifie la date de la dernière modification du contenu du fichier | | ||
| + | | c | Vérifie la date de la dernière modification de l' | ||
| + | | a | Vérifie la date du dernier accès | | ||
| + | |||
| + | ==La Section File== | ||
| + | |||
| + | < | ||
| + | ############## | ||
| + | # file section | ||
| + | ############## | ||
| + | # 3 syntaxe are available : | ||
| + | # file action | ||
| + | # to scan a file/ | ||
| + | # ! file | ||
| + | # to remove file from scan | ||
| + | # = directory action | ||
| + | # to scan the directory but not sub-directories | ||
| + | # file with blank character have to be quoted | ||
| + | # | ||
| + | # action is the list of attribute used to detect a change | ||
| + | |||
| + | = / DIR | ||
| + | |||
| + | /bin MyRule | ||
| + | |||
| + | /boot | ||
| + | # ! /boot/map | ||
| + | # ! / | ||
| + | |||
| + | /dev p+n | ||
| + | # ! / | ||
| + | # ! / | ||
| + | # ! / | ||
| + | # ! / | ||
| + | ! /dev/bsg | ||
| + | ! /dev/bus | ||
| + | ! /dev/pts | ||
| + | ! /dev/shm | ||
| + | # to avoid problems with pending usb | ||
| + | # = /dev/scsi p+n | ||
| + | |||
| + | /etc ETC | ||
| + | /etc/mtab ETC - md5 - s | ||
| + | / | ||
| + | # / | ||
| + | # / | ||
| + | /etc/motd ETC | ||
| + | # / | ||
| + | # / | ||
| + | # / | ||
| + | # / | ||
| + | ! /etc/cups | ||
| + | # ! /etc/map | ||
| + | # ! / | ||
| + | # ! / | ||
| + | # ! / | ||
| + | # ! / | ||
| + | # ! / | ||
| + | |||
| + | /lib MyRule | ||
| + | / | ||
| + | / | ||
| + | # / | ||
| + | |||
| + | /root MyRule | ||
| + | ! / | ||
| + | ! / | ||
| + | # ! /root/.mc | ||
| + | # ! /root/tmp | ||
| + | ! / | ||
| + | |||
| + | /sbin | ||
| + | |||
| + | / | ||
| + | / | ||
| + | / | ||
| + | ! / | ||
| + | ! / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | |||
| + | /var/ftp MyRule | ||
| + | /var/log Logs | ||
| + | # ! / | ||
| + | = / | ||
| + | # ! / | ||
| + | /var/www MyRule | ||
| + | # ! / | ||
| + | </ | ||
| + | |||
| + | Cette partie du fichier de configuration détaille les vérifications de fichiers à réaliser, en voici un extrait : | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | /etc ETC | ||
| + | /etc/mtab ETC - md5 - s | ||
| + | / | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Cet extrait indique que : | ||
| + | |||
| + | * le répertoire /etc sera vérifié selon l' | ||
| + | * le fichier /etc/mtab sera vérifié selon l' | ||
| + | * le fichier / | ||
| + | |||
| + | ===Utilisation=== | ||
| + | |||
| + | Commencez par créer la base de données d' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# afick -i | ||
| + | # Afick (3.8.1) init at 2024/10/03 11:16:16 with options (/ | ||
| + | # archive: | ||
| + | # database: | ||
| + | # exclude_prefix: | ||
| + | # exclude_suffix: | ||
| + | # history: | ||
| + | # max_checksum_size: | ||
| + | # running_files: | ||
| + | # timing:=1 | ||
| + | # dbm: | ||
| + | # ################################################################# | ||
| + | # MD5 hash of / | ||
| + | |||
| + | # Hash database created successfully. 46551 files entered. | ||
| + | # user time : 18.88; system time : 6.49; real time : 117 | ||
| + | </ | ||
| + | |||
| + | Au moment où vous souhaitez vérifier l' | ||
| + | |||
| + | * **afick -k** | ||
| + | |||
| + | En cas de modifications, | ||
| + | |||
| + | Il est aussi nécessaire de mettre à jour votre base de données chaque fois que vous installez un nouveau paquet ou que vous mettez à jour un paquet déjà installé. Dans ce cas, utilisez la commande suivante : | ||
| + | |||
| + | * **afick -u** | ||
| + | |||
| + | ===Automatiser Afick=== | ||
| + | |||
| + | Lors de l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# cat / | ||
| + | # | ||
| + | ############################################################################### | ||
| + | # | ||
| + | # it's a part of the afick project | ||
| + | # | ||
| + | # Copyright (C) 2002, 2003 by Eric Gerbier | ||
| + | # Bug reports to: eric.gerbier@tutanota.com | ||
| + | # $Id$ | ||
| + | # | ||
| + | # This program is free software; you can redistribute it and/or modify | ||
| + | # it under the terms of the GNU General Public License as published by | ||
| + | # the Free Software Foundation; either version 2 of the License, or | ||
| + | # (at your option) any later version. | ||
| + | # | ||
| + | # This program is distributed in the hope that it will be useful, | ||
| + | # but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| + | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. | ||
| + | # GNU General Public License for more details. | ||
| + | # | ||
| + | ############################################################################### | ||
| + | # script for cron job | ||
| + | # this script use the " | ||
| + | # the goals are : | ||
| + | # - set the nice priority | ||
| + | # - truncate too long reports to avoid big mails | ||
| + | # - avoid mails if no changes detected | ||
| + | # - sent report to the specicified email adress | ||
| + | # - write reports to / | ||
| + | # - archive retention management | ||
| + | |||
| + | AFICK="/ | ||
| + | PATH="/ | ||
| + | LOGDIR="/ | ||
| + | LOGFILE=" | ||
| + | ERRORLOG=" | ||
| + | CONFFILE="/ | ||
| + | |||
| + | # the default action is " | ||
| + | ACTION=" | ||
| + | |||
| + | ############################################################################### | ||
| + | treat_log() { | ||
| + | if [ -n " | ||
| + | then | ||
| + | echo "# This is an automated report generated by Another File Integrity Checker on $FQDN $DATE." | ||
| + | fi | ||
| + | |||
| + | # " | ||
| + | if [ -s $LOGFILE ]; then | ||
| + | loglines=`wc -l $LOGFILE | awk '{ print $1 }'` | ||
| + | if [ ${loglines: | ||
| + | echo "# TRUNCATED (!) output of the daily afick run:" | ||
| + | echo "# Output is $loglines lines, truncated to $LINES." | ||
| + | head -$LINES $LOGFILE | ||
| + | echo "# The full output can be found in $LOGFILE." | ||
| + | else | ||
| + | echo "# Output of the daily afick run:" | ||
| + | cat $LOGFILE | ||
| + | fi | ||
| + | elif [ -n " | ||
| + | then | ||
| + | echo "# afick detected no changes." | ||
| + | fi | ||
| + | |||
| + | # afick errors | ||
| + | if [ -s $ERRORLOG ]; then | ||
| + | errorlines=`wc -l $ERRORLOG | awk '{ print $1 }'` | ||
| + | if [ ${errorlines: | ||
| + | echo "# TRUNCATED (!) output of errors produced:" | ||
| + | echo "# Error output is $errorlines lines, truncated to $LINES." | ||
| + | head -$LINES $ERRORLOG | ||
| + | echo "# The full output can be found in $ERRORLOG." | ||
| + | else | ||
| + | echo "# Errors produced:" | ||
| + | cat $ERRORLOG | ||
| + | fi | ||
| + | elif [ -n " | ||
| + | then | ||
| + | echo "# afick produced no errors." | ||
| + | fi | ||
| + | |||
| + | # check end of report (summary) | ||
| + | if [ -s $LOGFILE ]; then | ||
| + | summary=` grep "MD5 hash of" $LOGFILE ` | ||
| + | if [ -z " | ||
| + | then | ||
| + | echo " | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | } | ||
| + | ############################################################################### | ||
| + | # extract macro value from config file | ||
| + | macro () { | ||
| + | key=$1 | ||
| + | grep -m 1 " | ||
| + | } | ||
| + | ############################################################################### | ||
| + | send_mail() { | ||
| + | echo " | ||
| + | } | ||
| + | ############################################################################### | ||
| + | send_nagios() { | ||
| + | NAGIOS_STATUS=3 # UNKNOWN initial status | ||
| + | if [ -s $LOGFILE ] | ||
| + | then | ||
| + | NAGIOS_MSG=`tail -4 $LOGFILE | head -1 | sed -e " | ||
| + | NUM_CHANGES=`echo $NAGIOS_MSG | cut -d " " -f 4` | ||
| + | if [ $NUM_CHANGES -gt 0 ] | ||
| + | then | ||
| + | if [ $NUM_CHANGES -ge $NAGIOS_CRITICAL_CHANGES ] | ||
| + | then | ||
| + | NAGIOS_STATUS=2 # CRITICAL | ||
| + | else | ||
| + | NAGIOS_STATUS=1 # WARNING | ||
| + | fi | ||
| + | else | ||
| + | NAGIOS_STATUS=0 # OK | ||
| + | fi | ||
| + | fi | ||
| + | HOST=`hostname` | ||
| + | echo " | ||
| + | } | ||
| + | ############################################################################### | ||
| + | # MAIN | ||
| + | ############################################################################### | ||
| + | |||
| + | [ -x $AFICK ] || exit 0 | ||
| + | |||
| + | # hostname -f only exists on GNU systems, | ||
| + | # on others (HPUX, AIX, Solaris, Tru64), it return an error on stderr | ||
| + | # and a usage message on stdout | ||
| + | FQDN=`( hostname -f || hostname ) 2>/ | ||
| + | DATE=`date +"at %X on %x"` | ||
| + | MAILTO=`macro MAILTO` | ||
| + | LINES=`macro LINES` | ||
| + | VERBOSE=`macro VERBOSE` | ||
| + | REPORT=`macro REPORT` | ||
| + | NICE=`macro NICE` | ||
| + | BATCH=`macro BATCH` | ||
| + | MOUNT=`macro MOUNT` | ||
| + | NAGIOS=`macro NAGIOS` | ||
| + | NAGIOS_SERVER=`macro NAGIOS_SERVER` | ||
| + | NAGIOS_CONFIG=`macro NAGIOS_CONFIG` | ||
| + | NAGIOS_CHECK_NAME=`macro NAGIOS_CHECK_NAME` | ||
| + | NAGIOS_CRITICAL_CHANGES=`macro NAGIOS_CRITICAL_CHANGES` | ||
| + | NAGIOS_NSCA=`macro NAGIOS_NSCA` | ||
| + | ARCHIVE_RETENTION=`macro ARCHIVE_RETENTION` | ||
| + | |||
| + | # default values | ||
| + | [ -z " | ||
| + | [ -z " | ||
| + | [ -z " | ||
| + | [ -z " | ||
| + | [ -z " | ||
| + | [ -z " | ||
| + | [ -z " | ||
| + | [ -z " | ||
| + | [ -z " | ||
| + | [ -z " | ||
| + | [ -z " | ||
| + | [ -z " | ||
| + | [ -z " | ||
| + | [ -z " | ||
| + | |||
| + | #echo " | ||
| + | |||
| + | if [ " | ||
| + | then | ||
| + | exit 0 | ||
| + | fi | ||
| + | |||
| + | if [ " | ||
| + | then | ||
| + | # verbose mail | ||
| + | export VERBOSE_AFICK=1 | ||
| + | fi | ||
| + | |||
| + | # the mount point must be already defined in /etc/fstab | ||
| + | if [ -n " | ||
| + | then | ||
| + | mount $MOUNT | ||
| + | fi | ||
| + | |||
| + | # launch command | ||
| + | nice -n $NICE $AFICK -c $CONFFILE $ACTION > $LOGFILE 2> $ERRORLOG | ||
| + | |||
| + | # archive retention | ||
| + | if [ " | ||
| + | then | ||
| + | echo "###############" | ||
| + | echo "# afick_archive" | ||
| + | / | ||
| + | fi | ||
| + | |||
| + | if [ -n " | ||
| + | then | ||
| + | umount $MOUNT | ||
| + | fi | ||
| + | |||
| + | # nagios ? | ||
| + | if [ " | ||
| + | then | ||
| + | send_nagios | ||
| + | fi | ||
| + | |||
| + | if [ " | ||
| + | then | ||
| + | # no report | ||
| + | exit | ||
| + | fi | ||
| + | |||
| + | # filter output to send by mail | ||
| + | OUTPUT=`treat_log` | ||
| + | if [ " | ||
| + | then | ||
| + | send_mail | ||
| + | else | ||
| + | # skip comments and empty lines | ||
| + | OUTPUT_FILTRE=`echo " | ||
| + | if [ -n " | ||
| + | then | ||
| + | send_mail | ||
| + | fi | ||
| + | fi | ||
| + | </ | ||
| + | |||
| + | Ce fichier permet d' | ||
| + | |||
| + | L' | ||
| + | |||
| + | < | ||
| + | ################# | ||
| + | # macros section | ||
| + | ################# | ||
| + | # used by cron job (afick_cron) | ||
| + | # define the mail adress to send cron job result | ||
| + | @@define MAILTO root@localhost | ||
| + | # truncate the result sended by mail to the number of lines (avoid too long mails) | ||
| + | @@define LINES 1000 | ||
| + | # REPORT = 1 to enable mail reports, =0 to disable report | ||
| + | @@define REPORT 1 | ||
| + | # VERBOSE = 1 to have one mail by run, =0 to have a mail only if changes are detected | ||
| + | @@define VERBOSE 0 | ||
| + | # define the nice value : from 0 to 19 (priority of the job) | ||
| + | @@define NICE 18 | ||
| + | # = 1 to allow cron job, = 0 to suppress cron job | ||
| + | @@define BATCH 1 | ||
| + | # (optionnal, for unix) specify a file system to mount before the scan | ||
| + | # it must be defined in /etc/fstab | ||
| + | #@@define MOUNT /mnt/dist | ||
| + | # if set to 0, keep all archives, else define the number of days to keep | ||
| + | # with the syntaxe nS , n for a number, S for the scale | ||
| + | # (d for day, w for week, m for month, y for year) | ||
| + | # ex : for 5 months : 5m | ||
| + | @@define ARCHIVE_RETENTION 0 | ||
| + | |||
| + | # send nagios messages by NSCA (= 1 to allow, = 0 to block) | ||
| + | @@define NAGIOS 0 | ||
| + | # address of the nagios server to send messages to | ||
| + | @@define NAGIOS_SERVER my.nagios.server.org | ||
| + | # NSCA configuration file | ||
| + | # @@define NAGIOS_CONFIG / | ||
| + | # name used for nagios passive check on the nagios server side | ||
| + | @@define NAGIOS_CHECK_NAME Another File Integrity Checker | ||
| + | # number c of the changes that are considered critical => nagios state CRITICAL | ||
| + | # (0 changes => nagios state OK; 0> and <c changes => nagios state WARNING) | ||
| + | @@define NAGIOS_CRITICAL_CHANGES 2 | ||
| + | # path to nsca binary | ||
| + | # @@define NAGIOS_NSCA / | ||
| + | </ | ||
| + | |||
| + | ====Root Kits==== | ||
| + | |||
| + | Un **rootkit** est un paquet logiciel qui permet à un utilisateur non-autorisé d' | ||
| + | |||
| + | Les rootkits sont essentiellement de deux types, voire un mélange des deux : | ||
| + | |||
| + | * des modules du noyau, | ||
| + | * des paquets logiciels d'un utilisateur qui prennent la place de binaires système. | ||
| + | |||
| + | Les rootkits de type modules du noyau insèrent des modules qui remplacent des appels systèmes et cachent des informations concernant certains processus spécifiques. | ||
| + | |||
| + | Les rootkits de type paquets logiciels remplacement en règle générale des binaires système tels **ps**, **login** etc. Les binaires de remplacement cachent des processus et des répertoires de l' | ||
| + | |||
| + | ===LAB #8 - Mise en place de rkhunter=== | ||
| + | |||
| + | **rkhunter** est un logiciel utilisé pour détecter les rootkits présents sur votre machine. | ||
| + | |||
| + | ==Installation== | ||
| + | |||
| + | L' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# dnf install rkhunter | ||
| + | </ | ||
| + | |||
| + | ==Les options de la commande== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# rkhunter --help | ||
| + | |||
| + | Usage: rkhunter {--check | --unlock | --update | --versioncheck | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Current options are: | ||
| + | | ||
| + | | ||
| + | -c, --check | ||
| + | -C, --config-check | ||
| + | --cs2, --color-set2 | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | (Do not use unless asked to do so) | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | NONE | < | ||
| + | | ||
| + | -h, --help | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | -l, --logfile [file] | ||
| + | | ||
| + | | ||
| + | | ||
| + | for disabled tests (only valid with --disable) | ||
| + | | ||
| + | | ||
| + | --nomow, --no-mail-on-warning | ||
| + | --ns, --nosummary | ||
| + | | ||
| + | | ||
| + | BSDng | SOLARIS | or verify file property values. | ||
| + | | ||
| + | | ||
| + | package]... | ||
| + | -q, --quiet | ||
| + | --rwo, --report-warnings-only | ||
| + | --sk, --skip-keypress | ||
| + | | ||
| + | (This is the default) | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | --vl, --verbose-logging | ||
| + | -V, --version | ||
| + | | ||
| + | -x, --autox | ||
| + | -X, --no-autox | ||
| + | </ | ||
| + | |||
| + | ==Utilisation== | ||
| + | |||
| + | Lancez **rkhunter** simplement en appelant son exécutable. A l'issu de son exécution, vous observerez un résumé : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# rkhunter -c | ||
| + | ... | ||
| + | System checks summary | ||
| + | ===================== | ||
| + | |||
| + | File properties checks... | ||
| + | Required commands check failed | ||
| + | Files checked: 137 | ||
| + | Suspect files: 4 | ||
| + | |||
| + | Rootkit checks... | ||
| + | Rootkits checked : 498 | ||
| + | Possible rootkits: 0 | ||
| + | |||
| + | Applications checks... | ||
| + | All checks skipped | ||
| + | |||
| + | The system checks took: 2 minutes and 10 seconds | ||
| + | |||
| + | All results have been written to the log file: / | ||
| + | |||
| + | One or more warnings have been found while checking the system. | ||
| + | Please check the log file (/ | ||
| + | </ | ||
| + | |||
| + | ==Configuration== | ||
| + | |||
| + | **rkhunter** peut être configuré soit par des options sur la ligne de commande soit par l' | ||
| ----- | ----- | ||
| Copyright © 2024 Hugh Norris. | Copyright © 2024 Hugh Norris. | ||
