Différences
Ci-dessous, les différences entre deux révisions de la page.
| Prochaine révision | Révision précédente | ||
| elearning:workbooks:centos:8:avance:l115 [2023/12/08 14:56] – created admin | elearning:workbooks:centos:8:avance:l115 [2024/11/08 12:39] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| - | Version : **2021.01** | + | Version : **2024.01** |
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LRF402 | + | ======LCF607 |
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| - | * **LRF402 | + | * **LCF607 |
| * Contenu du Module | * Contenu du Module | ||
| - | * Les Problématiques | + | * Rôle du noyau |
| - | * L'IP Spoofing | + | * LAB #1 - Modules |
| - | * Déni de Service (DoS) | + | * LAB #2 - Compilation et installation du noyau et des modules |
| - | * SYN Flooding | + | * 2.1 - Déplacer /home |
| - | * Flood | + | * 2.2 - Préparer l' |
| - | * Le Contre-Mesure | + | * 2.3 - Préparer l' |
| - | * Le Pare-feu Netfilter/ | + | * Le Fichier .config |
| - | * LAB #1 - Configuration par Scripts sous RHEL/CentOS 6 et versions Antérieures | + | * Le Fichier Makefile |
| - | * LAB #2 - La Configuration par firewalld sous RHEL/CentOS 7 | + | * 2.4 - Paramétrage du noyau |
| - | * La Configuration de Base de firewalld | + | * 2.5 - Compiler le Noyau |
| - | * La Commande | + | |
| - | * La Configuration Avancée de firewalld | + | |
| - | * Le mode Panic de firewalld | + | * 3.1 - La Commande quotacheck |
| + | * 3.2 - La Commande edquota | ||
| + | * 3.3 - La Commande quotaon | ||
| + | * 3.4 - La Commande | ||
| + | * 3.5 - La Commande quota | ||
| + | * 3.6 - La Commande warnquota | ||
| - | =====Les Problématiques===== | + | =====Rôle du noyau===== |
| - | ====L'IP Spoofing==== | + | Le noyau ou //kernel// est la partie du système d'exploitation qui gère les entrées/ |
| - | L'IP Spoofing consiste en faire croire à un serveur que sa machine possède une adresse IP autre que celle réellement attribuée. Le but de cette opération est de se placer | + | * la diminution |
| + | * la prise en charge | ||
| + | * l' | ||
| + | * l'optimisation du code, | ||
| + | * la correction de bogues, | ||
| + | * le besoin d'une fonctionnalité expérimentale. | ||
| + | |||
| + | Commencez par mettre à jour CentOS 8 : | ||
| - | * L' | + | < |
| - | * L' | + | [root@centos8 ~]# dnf update |
| - | * L' | + | ... |
| - | * Le serveur accepte la requête car elle provient d'une adresse IP à laquelle il peux faire confiance et renvoie une réponse en utilisant la route spécifiée par l' | + | [root@centos8 ~]# reboot |
| - | * Le client utilise la route spécifiée par l' | + | </ |
| - | ====Déni de Service (DoS)==== | + | Identifiez ensuite le noyau utilisé par votre machine virtuelle : |
| - | Une attaque de déni de service consiste à rendre inopérable une machine en lui envoyant une grande quantité de données inutiles. Un exemple de ce type d' | + | < |
| + | [root@centos8 ~]# uname -r | ||
| + | 4.18.0-305.7.1.el8_4.x86_64 | ||
| + | </code> | ||
| - | * L' | + | =====LAB #1 - Modules===== |
| - | * Il envoie ensuite un ping à une machine de diffusion, | + | |
| - | * La machine de diffusion envoie ce même ping à un grand nombre de clients en spécifiant l' | + | |
| - | * L' | + | |
| - | * Tous les clients renvoie une réponse au ping //en même temps// à la cible. | + | |
| - | ====SYN Flooding==== | + | Dans le cas d'une utilisation courante de Linux, il est cependant préférable de faire appel aux **modules**. Les modules se trouvent dans le répertoire **/ |
| - | Le **SYN Flooding**, aussi appelé un //SYN-ACK Attack//, consiste à envoyer vers une cible de multiples paquets **SYN** très rapidement. La cible répond à chaque paquet reçu avec un paquet **ACK** et attend une réponse **ACK** de l' | + | < |
| + | [root@centos8 ~]# ls /lib/modules/`uname -r`/ | ||
| + | bls.conf | ||
| + | build modules.builtin.bin | ||
| + | config | ||
| + | kernel | ||
| + | modules.alias | ||
| + | modules.alias.bin modules.drm | ||
| + | modules.block | ||
| + | </ | ||
| - | ====Flood==== | + | Les commandes pour manipuler les modules sont : |
| - | Le **Flood** consiste à envoyer très rapidement des gros paquets **ICMP** vers la cible. | + | |
| + | | ||
| + | | ||
| + | | ||
| - | =====Le Contre-Mesure===== | + | Par exemple : |
| - | Le contre-mesure est principalement l' | + | < |
| + | [root@centos8 ~]# lsmod | ||
| + | Module | ||
| + | xt_CHECKSUM | ||
| + | ipt_MASQUERADE | ||
| + | xt_conntrack | ||
| + | ipt_REJECT | ||
| + | nft_compat | ||
| + | nf_nat_tftp | ||
| + | nft_objref | ||
| + | nf_conntrack_tftp | ||
| + | nft_counter | ||
| + | tun 53248 1 | ||
| + | bridge | ||
| + | stp 16384 1 bridge | ||
| + | llc 16384 2 bridge, | ||
| + | nft_fib_inet | ||
| + | nft_fib_ipv4 | ||
| + | nft_fib_ipv6 | ||
| + | nft_fib | ||
| + | nft_reject_inet | ||
| + | nf_reject_ipv4 | ||
| + | nf_reject_ipv6 | ||
| + | nft_reject | ||
| + | nft_ct | ||
| + | nf_tables_set | ||
| + | nft_chain_nat | ||
| + | nf_nat | ||
| + | nf_conntrack | ||
| + | nf_defrag_ipv6 | ||
| + | nf_defrag_ipv4 | ||
| + | ip_set | ||
| + | nf_tables | ||
| + | nfnetlink | ||
| + | sunrpc | ||
| + | ext4 761856 | ||
| + | mbcache | ||
| + | jbd2 131072 | ||
| + | virtio_balloon | ||
| + | pcspkr | ||
| + | i2c_piix4 | ||
| + | joydev | ||
| + | ip_tables | ||
| + | xfs 1515520 | ||
| + | libcrc32c | ||
| + | sr_mod | ||
| + | sd_mod | ||
| + | cdrom 65536 1 sr_mod | ||
| + | t10_pi | ||
| + | sg | ||
| + | ata_generic | ||
| + | bochs_drm | ||
| + | drm_vram_helper | ||
| + | drm_kms_helper | ||
| + | syscopyarea | ||
| + | sysfillrect | ||
| + | sysimgblt | ||
| + | fb_sys_fops | ||
| + | drm_ttm_helper | ||
| + | ttm | ||
| + | drm | ||
| + | ahci | ||
| + | libahci | ||
| + | virtio_net | ||
| + | net_failover | ||
| + | ata_piix | ||
| + | serio_raw | ||
| + | failover | ||
| + | libata | ||
| + | dm_mirror | ||
| + | dm_region_hash | ||
| + | dm_log | ||
| + | dm_mod | ||
| + | fuse 151552 | ||
| + | </ | ||
| - | ====Le Pare-feu Netfilter/ | + | Pour ajouter un module, on peut utiliser la commande **insmod** ou **modprobe**. Cette dernière ajoute non seulement le module passé en argument mais également ses dépendances : |
| - | **Netfilter** est composé de 5 //hooks// : | + | < |
| + | [root@centos8 ~]# modprobe bonding | ||
| + | [root@centos8 ~]# lsmod | more | ||
| + | Module | ||
| + | bonding | ||
| + | xt_CHECKSUM | ||
| + | ipt_MASQUERADE | ||
| + | xt_conntrack | ||
| + | ipt_REJECT | ||
| + | nft_compat | ||
| + | nf_nat_tftp | ||
| + | nft_objref | ||
| + | nf_conntrack_tftp | ||
| + | nft_counter | ||
| + | tun 53248 1 | ||
| + | bridge | ||
| + | stp 16384 1 bridge | ||
| + | llc 16384 2 bridge, | ||
| + | nft_fib_inet | ||
| + | nft_fib_ipv4 | ||
| + | nft_fib_ipv6 | ||
| + | nft_fib | ||
| + | nft_reject_inet | ||
| + | nf_reject_ipv4 | ||
| + | nf_reject_ipv6 | ||
| + | --More-- | ||
| + | </code> | ||
| - | | + | Pour supprimer un module, on peut utiliser la commande |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Ces hooks sont utilisés par deux branches, la première est celle concernée par les paquets qui entrent vers des services locaux : | + | < |
| + | [root@centos8 ~]# modprobe -r bonding | ||
| + | [root@centos8 ~]# lsmod | more | ||
| + | Module | ||
| + | xt_CHECKSUM | ||
| + | ipt_MASQUERADE | ||
| + | xt_conntrack | ||
| + | ipt_REJECT | ||
| + | nft_compat | ||
| + | nf_nat_tftp | ||
| + | nft_objref | ||
| + | nf_conntrack_tftp | ||
| + | nft_counter | ||
| + | tun 53248 1 | ||
| + | bridge | ||
| + | stp 16384 1 bridge | ||
| + | llc 16384 2 bridge,stp | ||
| + | nft_fib_inet | ||
| + | nft_fib_ipv4 | ||
| + | nft_fib_ipv6 | ||
| + | nft_fib | ||
| + | nft_reject_inet | ||
| + | nf_reject_ipv4 | ||
| + | nf_reject_ipv6 | ||
| + | nft_reject | ||
| + | --More-- | ||
| + | </ | ||
| - | | + | Les dépendances des modules sont résolues par la commande |
| - | tandis que la deuxième concerne les paquets qui traversent la passerelle: | + | < |
| + | [root@centos8 ~]# more / | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | xz kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | _64.ko.xz | ||
| + | kernel/ | ||
| + | --More--(0%) | ||
| + | </ | ||
| - | | + | Il est possible d' |
| - | Si IPTABLES | + | < |
| + | [root@centos8 ~]# modinfo bonding | ||
| + | filename: | ||
| + | author: | ||
| + | description: | ||
| + | license: | ||
| + | alias: | ||
| + | rhelversion: | ||
| + | srcversion: | ||
| + | depends: | ||
| + | intree: | ||
| + | name: | ||
| + | vermagic: | ||
| + | sig_id: | ||
| + | signer: | ||
| + | sig_key: | ||
| + | sig_hashalgo: | ||
| + | signature: | ||
| + | B7: | ||
| + | 3F: | ||
| + | BE: | ||
| + | 44: | ||
| + | DE: | ||
| + | 7F: | ||
| + | D8: | ||
| + | BA: | ||
| + | B8: | ||
| + | 8F: | ||
| + | 58: | ||
| + | 6E: | ||
| + | 50: | ||
| + | 2F: | ||
| + | CA: | ||
| + | 0C: | ||
| + | A6: | ||
| + | AE: | ||
| + | 59: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | </ | ||
| - | | + | Dernièrement, |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Netfilter est organisé en **tables**. La commande **iptables** de netfilter permet | + | < |
| + | [root@centos8 ~]# ls / | ||
| + | firewalld-sysctls.conf | ||
| + | kvm.conf | ||
| - | * La table **FILTER** | + | [root@centos8 ~]# cat / |
| - | * La chaîne INPUT | + | # Setting modprobe kvm_intel/ |
| - | * Concerne les paquets entrants | + | # only enables Nested Virtualization until the next reboot or |
| - | * Policies: ACCEPT, DROP, REJECT | + | # module reload. Uncomment the option applicable |
| - | * La chaîne OUTPUT | + | # to your system below to enable the feature permanently. |
| - | * Concerne les paquets sortants | + | # |
| - | * Policies: ACCEPT, DROP, REJECT | + | # User changes in this file are preserved across upgrades. |
| - | * La chaîne FORWARD | + | # |
| - | * Concerne les paquets traversant le par-feu. | + | # For Intel |
| - | * Policies: ACCEPT, DROP, REJECT | + | #options kvm_intel nested=1 |
| + | # | ||
| + | # For AMD | ||
| + | #options kvm_amd nested=1 | ||
| + | </ | ||
| - | Si aucune table n'est précisée, c'est la table FILTER qui s' | + | =====LAB #2 - Compilation et installation du noyau et des modules===== |
| - | | + | Activez le dépôt |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | * Le cas spécifique OUTPUT | + | |
| - | * Permet la modification de la destination des paquets générés localement | + | |
| - | * La table **MANGLE** | + | < |
| - | * Permet le marquage de paquets générés localement (OUTPUT) et entrants (PREROUTING) | + | [root@centos8 ~]# vi / |
| + | [root@centos8 ~]# cat / | ||
| + | # CentOS-PowerTools.repo | ||
| + | # | ||
| + | # The mirror system uses the connecting IP address of the client and the | ||
| + | # update status of each mirror to pick mirrors that are updated to and | ||
| + | # geographically close to the client. | ||
| + | # unless you are manually picking other mirrors. | ||
| + | # | ||
| + | # If the ### | ||
| + | # remarked out baseurl= line instead. | ||
| + | # | ||
| + | # | ||
| - | Les **policies** sont: | + | [Stream-PowerTools] |
| + | name=CentOS-Stream - PowerTools | ||
| + | ### | ||
| + | baseurl=http:// | ||
| + | gpgcheck=1 | ||
| + | enabled=1 | ||
| + | gpgkey=file:/// | ||
| + | </ | ||
| - | * ACCEPT | + | Installez maintenant les paquets necéssaires : |
| - | * Permet d' | + | |
| - | * DROP | + | |
| - | * Permet de rejeter le paquet concerné sans générer un message d' | + | |
| - | * REJECT | + | |
| - | * Permet de rejeter le paquet concerné en générant une message d' | + | |
| - | Les **cibles** sont: | + | < |
| + | [root@centos8 ~]# dnf groupinstall " | ||
| + | ... | ||
| + | [root@centos8 ~]# dnf install asciidoc audit-libs-devel bash bc binutils binutils-devel bison diffutils elfutils elfutils-devel elfutils-libelf-devel findutils flex gawk gcc gettext gzip hmaccalc hostname make module-init-tools ncurses-devel net-tools newt-devel numactl-devel openssl patch pciutils-devel perl perl-ExtUtils-Embed pesign redhat-rpm-config rpm-build rpmdevtools sh-utils tar xmlto xz zlib-devel rpmdevtools clang dwarves java-devel kabi-dw libbabeltrace-devel libbpf-devel libcap-devel libmnl-devel libnl3-devel libtraceevent-devel llvm python3-devel python3-docutils | ||
| + | ... | ||
| + | </ | ||
| - | * SNAT | + | ====2.1 - Déplacer /home==== |
| - | * Permet de modifier l' | + | |
| - | * DNAT | + | |
| - | * Permet de modifier l' | + | |
| - | * MASQUERADE | + | |
| - | * Permet de remplacer l' | + | |
| - | IPTABLES peut être configuré soit par des outils tels shorewall, soit en utilisant | + | <WRAP center round alert 60%> |
| + | **Important** - Il n'est pas conseillé de compiler | ||
| + | </ | ||
| - | # IPTABLES | + | <WRAP center round todo 60%> |
| + | **A faire** | ||
| + | </ | ||
| - | Les actions sont: | + | Créez ensuite une seule partition sur **/ |
| - | ^ Action | + | < |
| - | | - -append | -A | Ajouter une règle à la fin de la chaîne spécifiée | | + | [root@centos8 ~]# fdisk /dev/sdc |
| - | | - -delete | -D | Supprimer une règle en spécifiant son numéro ou la règle à supprimer | | + | |
| - | | - -replace | -R | Permet de remplacer la règle spécifée par son numéro | | + | |
| - | | - -insert | -I | Permet d' | + | |
| - | | - -list | -L | Permet d' | + | |
| - | | - -flush | -F | Permet de vider toutes les règles d'une chaîne | | + | |
| - | Les options sont: | + | Welcome to fdisk (util-linux 2.32.1). |
| + | Changes will remain in memory only, until you decide to write them. | ||
| + | Be careful before using the write command. | ||
| - | ^ Option | + | Device does not contain a recognized partition table. |
| - | | - -protocol | -p | Permet de spécifier un protocol - tcp, udp, icmp, all | | + | Created a new DOS disklabel with disk identifier 0xc321702b. |
| - | | - -source | -s | Permet de spécifier une adresse source | | + | |
| - | | - -destination | -d | Permet de spécifier une adresse de destination | | + | |
| - | | - -in-interface | -i | Permet de spécifier une interface réseau d' | + | |
| - | | - -out-interface | -o | Permet de spécifier une interface réseau de sortie | | + | |
| - | | - -fragment | -f | Permet de ne spécifier que les paquets fragmentés | | + | |
| - | | - -source-port | -sport | + | |
| - | | - -destination-port | -dport | + | |
| - | | - -tcp-flags | s/o | Permet de spécifier un flag TCP à matcher - SYN, ACK, FIN, RST, URG, PSH, ALL, NONE | | + | |
| - | | - -icmp-type | s/o | Permet de spécifier un type de paquet ICMP | | + | |
| - | | - -mac-source | s/o | Permet de spécifier une adresse MAC | | + | |
| - | Les options spécifiques à NET sont: | + | Command (m for help): n |
| + | Partition type | ||
| + | | ||
| + | | ||
| + | Select (default p): | ||
| - | | - -to-destination | s/o | Permet de spécifier l' | + | Using default response p. |
| - | | - -to-source | s/o | Permet spécifier l' | + | Partition number (1-4, default 1): |
| + | First sector (2048-41943039, default 2048): | ||
| + | Last sector, +sectors or +size{K, | ||
| - | Les options spécifiques aux LOGS sont: | + | Created a new partition 1 of type ' |
| - | | - -log-level | s/o | Permet de spécifier le niveau de logs | | + | Command (m for help): w |
| - | | - -log-prefix | s/o | Permet de spécifier un préfix pour les logs | | + | The partition table has been altered. |
| + | Calling ioctl() to re-read partition table. | ||
| + | Syncing disks. | ||
| + | </code> | ||
| - | L' | + | Créez maintenant un système de fichiers ext4 sur **/ |
| - | | - -state | s/o | Permet de spécifier l' | + | < |
| + | [root@centos8 ~]# mkfs.ext4 /dev/sdc1 | ||
| + | mke2fs 1.45.6 (20-Mar-2020) | ||
| + | Discarding device blocks: done | ||
| + | Creating filesystem with 16776960 4k blocks and 4194304 inodes | ||
| + | Filesystem UUID: dc92c0d7-919b-4fff-8719-53e9e7e628dd | ||
| + | Superblock backups stored on blocks: | ||
| + | 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, | ||
| + | 4096000, 7962624, 11239424 | ||
| - | Ce dernier cas fait référence au STATEFUL. Le STATEFUL est la capacité du par-feu à enregistrer dans une table spécifique, | + | Allocating group tables: done |
| + | Writing inode tables: done | ||
| + | Creating journal (65536 blocks): done | ||
| + | Writing superblocks and filesystem accounting information: | ||
| + | </ | ||
| - | Il existe 4 états: | + | Montez **/ |
| - | * NEW | + | < |
| - | * Le paquet concerne une nouvelle connexion et contient donc un flag SYN à 1 | + | [root@centos8 ~]# mount /dev/sdc1 /mnt |
| - | * ESTABLISHED | + | </ |
| - | * Le paquet concerne une connexion déjà établie. Le paquet ne doit contenir **ni** flag SYN à 1, **ni** flag FIN à 1 | + | |
| - | * RELATED | + | |
| - | * Le paquet est d'une connexion qui présente une relation avec une autre connexion | + | |
| - | * INVALID | + | |
| - | * La paquet provient d'une connexion anormale. | + | |
| - | ====LAB #1 - Configuration par Scripts sous RHEL/CentOS 6 et versions Antérieures==== | + | Copiez le contenu de /home vers /mnt : |
| - | Dans l' | + | < |
| + | [root@centos8 ~]# cp -a /home/* /mnt | ||
| + | </ | ||
| - | < | + | Démontez |
| - | #!/bin/bash | + | |
| - | ##################################### | + | |
| - | # proxy server IP | + | |
| - | PROXY_SERVER=" | + | |
| - | # Interface connected to Internet | + | |
| - | INTERNET=" | + | |
| - | # Interface connected to LAN | + | |
| - | LAN_IN=" | + | |
| - | # Local Interface | + | |
| - | LOCAL=" | + | |
| - | # Squid port | + | |
| - | PROXY_PORT=" | + | |
| - | # DO NOT MODIFY BELOW | + | |
| - | # Clean old firewall | + | |
| - | iptables -F | + | |
| - | iptables -X | + | |
| - | iptables -t nat -F | + | |
| - | iptables -t nat -X | + | |
| - | iptables -t mangle -F | + | |
| - | iptables -t mangle -X | + | |
| - | # Load IPTABLES modules for NAT and IP conntrack support | + | |
| - | modprobe ip_conntrack | + | |
| - | modprobe ip_conntrack_ftp | + | |
| - | # For win xp ftp client | + | |
| - | modprobe ip_nat_ftp | + | |
| - | echo 1 > /proc/sys/ | + | |
| - | # Setting default filter policy | + | |
| - | iptables -P INPUT DROP | + | |
| - | iptables -P OUTPUT ACCEPT | + | |
| - | # Unlimited access to loop back | + | |
| - | iptables -A INPUT -i lo -j ACCEPT | + | |
| - | iptables -A OUTPUT -o lo -j ACCEPT | + | |
| - | # Allow UDP, DNS and Passive FTP | + | |
| - | iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED, | + | |
| - | # set this system as a router for Rest of LAN | + | |
| - | iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE | + | |
| - | iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT | + | |
| - | # unlimited access to LAN | + | |
| - | iptables -A INPUT -i $LAN_IN -j ACCEPT | + | |
| - | iptables -A OUTPUT -o $LAN_IN -j ACCEPT | + | |
| - | # DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy | + | |
| - | iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $PROXY_SERVER:$PROXY_PORT | + | |
| - | # iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -j REDIRECT --to-port 3128 | + | |
| - | # if it is same system | + | |
| - | iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $PROXY_PORT | + | |
| - | # DROP everything and Log it | + | |
| - | iptables -A INPUT -j LOG | + | |
| - | iptables -A INPUT -j DROP | + | |
| - | </ | + | |
| - | ====LAB | + | < |
| + | [root@centos8 ~]# umount | ||
| + | [root@centos8 ~]# mv /home /root | ||
| + | </ | ||
| - | firewalld est à Netfilter ce que NetworkManager est au réseau. firewalld utilise des **zones** - des jeux de règles pré-définis dans lesquels sont placés les interfaces | + | Identifiez l' |
| - | * **trusted** | + | < |
| - | * **work**, **home**, **internal** | + | [root@centos8 ~]# ls -l / |
| - | * **dmz**, **public**, **external** | + | lrwxrwxrwx. 1 root root 10 Jul 19 12:02 f76d6b66-985b-4a91-af9c-4987e8c1443c -> ../../sdc |
| - | * **block**, **drop** | + | [root@centos8 ~]# |
| + | </ | ||
| + | |||
| + | Editez le fichier | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# vi / | ||
| + | [root@centos8 ~]# cat / | ||
| + | |||
| + | # | ||
| + | # / | ||
| + | # Created by anaconda on Wed Jun 16 06:21:32 2021 | ||
| + | # | ||
| + | # Accessible filesystems, by reference, are maintained under '/ | ||
| + | # See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info. | ||
| + | # | ||
| + | # After editing this file, run ' | ||
| + | # units generated from this file. | ||
| + | # | ||
| + | / | ||
| + | UUID=1c04981e-5317-4b73-9695-3ce25246835d /boot | ||
| + | / | ||
| + | UUID=f76d6b66-985b-4a91-af9c-4987e8c1443c /home | ||
| + | </ | ||
| + | |||
| + | Créez le point de montage /home : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# mkdir /home | ||
| + | </ | ||
| + | |||
| + | Montez /dev/sdc1 : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# mount -a | ||
| + | [root@centos8 ~]# mount | ||
| + | sysfs on /sys type sysfs (rw,nosuid, | ||
| + | proc on /proc type proc (rw,nosuid,nodev, | ||
| + | devtmpfs on /dev type devtmpfs (rw, | ||
| + | securityfs on / | ||
| + | tmpfs on /dev/shm type tmpfs (rw, | ||
| + | devpts on /dev/pts type devpts (rw, | ||
| + | tmpfs on /run type tmpfs (rw, | ||
| + | tmpfs on / | ||
| + | cgroup on / | ||
| + | pstore on / | ||
| + | bpf on /sys/fs/bpf type bpf (rw, | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | none on / | ||
| + | configfs on / | ||
| + | / | ||
| + | selinuxfs on / | ||
| + | mqueue on /dev/mqueue type mqueue (rw, | ||
| + | hugetlbfs on / | ||
| + | debugfs on / | ||
| + | systemd-1 on / | ||
| + | fusectl on / | ||
| + | /dev/sda1 on /boot type ext4 (rw, | ||
| + | sunrpc on / | ||
| + | tmpfs on / | ||
| + | tmpfs on / | ||
| + | gvfsd-fuse on / | ||
| + | tmpfs on /run/user/0 type tmpfs (rw,nosuid, | ||
| + | gvfsd-fuse on / | ||
| + | /dev/sdc1 on /home type ext4 (rw, | ||
| + | </ | ||
| + | |||
| + | Notez la taille | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# df -h | ||
| + | Filesystem | ||
| + | devtmpfs | ||
| + | tmpfs 1.9G | ||
| + | tmpfs 1.9G 9.4M 1.9G 1% /run | ||
| + | tmpfs 1.9G | ||
| + | / | ||
| + | / | ||
| + | tmpfs 374M | ||
| + | tmpfs 374M 1.2M 373M 1% / | ||
| + | / | ||
| + | </ | ||
| - | <WRAP center round important 50%> | + | <WRAP center round todo 60%> |
| - | **Important** - Une interface ne peut être que dans une zone à la fois tandis | + | **A faire** - **Déconnectez-vous** de votre session **CentOS8_ROOT_10.0.2.45** et re-connectez-vous |
| </ | </ | ||
| - | Le service firewalld doit toujours être lancé | + | ====2.2 - Préparer l' |
| + | |||
| + | Pour créer l' | ||
| < | < | ||
| - | [root@centos7 | + | [trainee@centos8 |
| - | firewalld.service - firewalld | + | ...> |
| - | Loaded: loaded (/usr/lib/systemd/ | + | [trainee@centos8 ~]$ ls -laR rpmbuild/ |
| - | Active: active (running) since Tue 2015-07-07 15:53:56 CEST; 1 day 21h ago | + | rpmbuild/: |
| - | Main PID: 493 (firewalld) | + | total 28 |
| - | CGroup: /system.slice/ | + | drwxrwxr-x. |
| - | └─493 / | + | drwxr-xr-x. 17 trainee trainee 4096 Jul 19 12:10 .. |
| + | drwxrwxr-x. | ||
| + | drwxrwxr-x. | ||
| + | drwxrwxr-x. | ||
| + | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 SPECS | ||
| + | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 SRPMS | ||
| - | Jul 07 15:53:56 centos7.fenestros.loc systemd[1]: Started firewalld | + | rpmbuild/ |
| + | total 8 | ||
| + | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . | ||
| + | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | ||
| + | |||
| + | rpmbuild/ | ||
| + | total 8 | ||
| + | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . | ||
| + | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | ||
| + | |||
| + | rpmbuild/ | ||
| + | total 8 | ||
| + | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . | ||
| + | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | ||
| + | |||
| + | rpmbuild/ | ||
| + | total 8 | ||
| + | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . | ||
| + | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | ||
| + | |||
| + | rpmbuild/ | ||
| + | total 8 | ||
| + | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . | ||
| + | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | ||
| </ | </ | ||
| - | ===La Configuration de Base de firewalld=== | + | Téléchargez le rpm source du noyau : |
| - | La configuration par défaut de firewalld se trouve dans **/usr/lib/firewalld** | + | < |
| + | [root@centos8 ~]# uname -a | ||
| + | Linux centos8.ittraining.loc 4.18.0-553.6.1.el8.x86_64 #1 SMP Thu May 30 04:13:58 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux | ||
| + | |||
| + | [root@centos8 ~]# cat /etc/centos-release | ||
| + | CentOS Stream release 8 | ||
| + | |||
| + | [trainee@centos8 ~]$ wget https:// | ||
| + | </ | ||
| + | |||
| + | Installez maintenant les dépendances pour le rpm source en tant que root : | ||
| < | < | ||
| - | [root@centos7 | + | [trainee@centos8 |
| - | total 12 | + | Mot de passe : fenestros |
| - | drwxr-x---. 2 root root 4096 Jun 4 09:52 icmptypes | + | |
| - | drwxr-x---. 2 root root 4096 Jun 4 09:52 services | + | [root@centos8 |
| - | drwxr-x---. 2 root root 4096 Jun 4 09:52 zones | + | ... |
| - | [root@centos7 | + | |
| - | total 36 | + | [root@centos8 |
| - | -rw-r-----. 1 root root 299 Mar 6 00:35 block.xml | + | ... |
| - | -rw-r-----. 1 root root 293 Mar 6 00:35 dmz.xml | + | |
| - | -rw-r-----. 1 root root 291 Mar 6 00:35 drop.xml | + | |
| - | -rw-r-----. 1 root root 304 Mar 6 00:35 external.xml | + | |
| - | -rw-r-----. 1 root root 400 Mar 6 00:35 home.xml | + | |
| - | -rw-r-----. 1 root root 415 Mar 6 00:35 internal.xml | + | |
| - | -rw-r-----. 1 root root 315 Mar 6 00:35 public.xml | + | |
| - | -rw-r-----. 1 root root 162 Mar 6 00:35 trusted.xml | + | |
| - | -rw-r-----. 1 root root 342 Mar 6 00:35 work.xml | + | |
| - | [root@centos7 | + | |
| - | total 192 | + | |
| - | -rw-r-----. 1 root root 412 Mar 6 00:35 amanda-client.xml | + | |
| - | -rw-r-----. 1 root root 320 Mar 6 00:35 bacula-client.xml | + | |
| - | -rw-r-----. 1 root root 346 Mar 6 00:35 bacula.xml | + | |
| - | -rw-r-----. 1 root root 305 Mar 6 00:35 dhcpv6-client.xml | + | |
| - | -rw-r-----. 1 root root 234 Mar 6 00:35 dhcpv6.xml | + | |
| - | -rw-r-----. 1 root root 227 Mar 6 00:35 dhcp.xml | + | |
| - | -rw-r-----. 1 root root 346 Mar 6 00:35 dns.xml | + | |
| - | -rw-r-----. 1 root root 374 Mar 6 00:35 ftp.xml | + | |
| - | -rw-r-----. 1 root root 476 Mar 6 00:35 high-availability.xml | + | |
| - | -rw-r-----. 1 root root 448 Mar 6 00:35 https.xml | + | |
| - | -rw-r-----. 1 root root 353 Mar 6 00:35 http.xml | + | |
| - | -rw-r-----. 1 root root 372 Mar 6 00:35 imaps.xml | + | |
| - | -rw-r-----. 1 root root 454 Mar 6 00:35 ipp-client.xml | + | |
| - | -rw-r-----. 1 root root 427 Mar 6 00:35 ipp.xml | + | |
| - | -rw-r-----. 1 root root 517 Mar 6 00:35 ipsec.xml | + | |
| - | -rw-r-----. 1 root root 233 Mar 6 00:35 kerberos.xml | + | |
| - | -rw-r-----. 1 root root 221 Mar 6 00:35 kpasswd.xml | + | |
| - | -rw-r-----. 1 root root 232 Mar 6 00:35 ldaps.xml | + | |
| - | -rw-r-----. 1 root root 199 Mar 6 00:35 ldap.xml | + | |
| - | -rw-r-----. 1 root root 385 Mar 6 00:35 libvirt-tls.xml | + | |
| - | -rw-r-----. 1 root root 389 Mar 6 00:35 libvirt.xml | + | |
| - | -rw-r-----. 1 root root 424 Mar 6 00:35 mdns.xml | + | |
| - | -rw-r-----. 1 root root 211 Mar 6 00:35 mountd.xml | + | |
| - | -rw-r-----. 1 root root 190 Mar 6 00:35 ms-wbt.xml | + | |
| - | -rw-r-----. 1 root root 171 Mar 6 00:35 mysql.xml | + | |
| - | -rw-r-----. 1 root root 324 Mar 6 00:35 nfs.xml | + | |
| - | -rw-r-----. 1 root root 389 Mar 6 00:35 ntp.xml | + | |
| - | -rw-r-----. 1 root root 335 Mar 6 00:35 openvpn.xml | + | |
| - | -rw-r-----. 1 root root 433 Mar 6 00:35 pmcd.xml | + | |
| - | -rw-r-----. 1 root root 474 Mar 6 00:35 pmproxy.xml | + | |
| - | -rw-r-----. 1 root root 544 Mar 6 00:35 pmwebapis.xml | + | |
| - | -rw-r-----. 1 root root 460 Mar 6 00:35 pmwebapi.xml | + | |
| - | -rw-r-----. 1 root root 357 Mar 6 00:35 pop3s.xml | + | |
| - | -rw-r-----. 1 root root 181 Mar 6 00:35 postgresql.xml | + | |
| - | -rw-r-----. 1 root root 261 Mar 6 00:35 proxy-dhcp.xml | + | |
| - | -rw-r-----. 1 root root 446 Mar 6 00:35 radius.xml | + | |
| - | -rw-r-----. 1 root root 517 Mar 6 00:35 RH-Satellite-6.xml | + | |
| - | -rw-r-----. 1 root root 214 Mar 6 00:35 rpc-bind.xml | + | |
| - | -rw-r-----. 1 root root 384 Mar 6 00:35 samba-client.xml | + | |
| - | -rw-r-----. 1 root root 461 Mar 6 00:35 samba.xml | + | |
| - | -rw-r-----. 1 root root 550 Mar 6 00:35 smtp.xml | + | |
| - | -rw-r-----. 1 root root 463 Mar 6 00:35 ssh.xml | + | |
| - | -rw-r-----. 1 root root 393 Mar 6 00:35 telnet.xml | + | |
| - | -rw-r-----. 1 root root 301 Mar 6 00:35 tftp-client.xml | + | |
| - | -rw-r-----. 1 root root 437 Mar 6 00:35 tftp.xml | + | |
| - | -rw-r-----. 1 root root 211 Mar 6 00:35 transmission-client.xml | + | |
| - | -rw-r-----. 1 root root 475 Mar 6 00:35 vnc-server.xml | + | |
| - | -rw-r-----. 1 root root 310 Mar 6 00:35 wbem-https.xml | + | |
| - | [root@centos7 ~]# ls -l / | + | |
| - | total 36 | + | |
| - | -rw-r-----. 1 root root 222 Mar 6 00:35 destination-unreachable.xml | + | |
| - | -rw-r-----. 1 root root 173 Mar 6 00:35 echo-reply.xml | + | |
| - | -rw-r-----. 1 root root 210 Mar 6 00:35 echo-request.xml | + | |
| - | -rw-r-----. 1 root root 225 Mar 6 00:35 parameter-problem.xml | + | |
| - | -rw-r-----. 1 root root 185 Mar 6 00:35 redirect.xml | + | |
| - | -rw-r-----. 1 root root 227 Mar 6 00:35 router-advertisement.xml | + | |
| - | -rw-r-----. 1 root root 223 Mar 6 00:35 router-solicitation.xml | + | |
| - | -rw-r-----. 1 root root 248 Mar 6 00:35 source-quench.xml | + | |
| - | -rw-r-----. 1 root root 253 Mar 6 00:35 time-exceeded.xml | + | |
| </ | </ | ||
| - | Ces fichiers sont au format | + | Installez maintenant le paquet |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | <?xml version=" | + | logout |
| - | < | + | [trainee@centos8 ~]$ rpm -Uvh kernel-4.18.0-553.16.1.el8_10.src.rpm |
| - | < | + | Updating |
| - | < | + | |
| - | < | + | warning: group mockbuild does not exist - using root |
| - | < | + | warning: user mockbuild does not exist - using root |
| - | < | + | warning: group mockbuild does not exist - using root |
| - | < | + | warning: user mockbuild does not exist - using root |
| - | < | + | warning: group mockbuild does not exist - using root |
| - | </ | + | warning: user mockbuild does not exist - using root |
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | ################################# | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| </ | </ | ||
| - | La configuration de firewalld ainsi que les définitions et règles personnalisées se trouvent dans **/etc/firewalld** : | + | <WRAP center round important 60%> |
| + | **Important** - Les erreurs sont sans importance. | ||
| + | </WRAP> | ||
| + | |||
| + | ====2.3 - Préparer l' | ||
| + | |||
| + | Naviguez vers le repertoire **~/rpmbuild/ | ||
| < | < | ||
| - | [root@centos7 ~]# ls -l /etc/firewalld/ | + | [trainee@centos7 ~]$ cd ~/rpmbuild/SPECS |
| - | total 8 | + | [trainee@centos7 |
| - | -rw-r-----. 1 root root 1026 Mar 6 00:35 firewalld.conf | + | ... |
| - | drwxr-x---. 2 root root 6 Mar 6 00:35 icmptypes | + | |
| - | -rw-r-----. 1 root root 271 Mar 6 00:35 lockdown-whitelist.xml | + | |
| - | drwxr-x---. 2 root root 6 Mar 6 00:35 services | + | |
| - | drwxr-x---. 2 root root 23 Mar 6 00:35 zones | + | |
| - | [root@centos7 | + | |
| - | total 4 | + | |
| - | -rw-r--r--. 1 root root 315 Mar 8 14:05 public.xml | + | |
| - | [root@centos7 ~]# ls -l / | + | |
| - | total 0 | + | |
| - | [root@centos7 ~]# ls -l / | + | |
| - | total 0 | + | |
| </ | </ | ||
| - | Le fichier de configuration de firewalld est **/ | + | A l'issu du processus, examinez l' |
| < | < | ||
| - | [root@centos7 ~]# cat /etc/firewalld/firewalld.conf | + | [trainee@centos8 SPECS]$ ls -la ~/rpmbuild/BUILD/kernel-4.18.0-305.7.1.el8_4/ |
| - | # firewalld config file | + | total 812 |
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | drwxr-xr-x. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. 119 trainee trainee | ||
| + | drwxr-xr-x. 137 trainee trainee | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | -rw-r--r--. | ||
| + | drwxr-xr-x. | ||
| + | -rw-r--r--. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | </ | ||
| - | # default zone | + | ===Le Fichier |
| - | # The default zone used if an empty zone string is used. | + | |
| - | # Default: public | + | |
| - | DefaultZone=public | + | |
| - | # Minimal mark | + | Changez de répertoire de travail |
| - | # Marks up to this minimum are free for use for example in the direct | + | |
| - | # interface. If more free marks are needed, increase the minimum | + | |
| - | # Default: 100 | + | |
| - | MinimalMark=100 | + | |
| - | # Clean up on exit | + | < |
| - | # If set to no or false the firewall configuration will not get cleaned up | + | [trainee@centos8 SPECS]$ cd ~/ |
| - | # on exit or stop of firewalld | + | </ |
| - | # Default: yes | + | |
| - | CleanupOnExit=yes | + | |
| - | # Lockdown | + | Copiez le fichier **configs/ |
| - | # If set to enabled, firewall changes with the D-Bus interface will be limited | + | |
| - | # to applications that are listed in the lockdown whitelist. | + | |
| - | # The lockdown whitelist file is lockdown-whitelist.xml | + | |
| - | # Default: no | + | |
| - | Lockdown=no | + | |
| - | # IPv6_rpfilter | + | < |
| - | # Performs a reverse path filter test on a packet for IPv6. If a reply to the | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ cp configs/ |
| - | # packet would be sent via the same interface that the packet arrived on, the | + | </ |
| - | # packet will match and be accepted, otherwise dropped. | + | |
| - | # The rp_filter for IPv4 is controlled using sysctl. | + | |
| - | # Default: yes | + | |
| - | IPv6_rpfilter=yes | + | |
| + | Mettez à jour le fichier .config par rapport à la configuration actuelle du noyau : | ||
| + | |||
| + | < | ||
| + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ make oldconfig | ||
| + | scripts/ | ||
| + | # | ||
| + | # configuration written to .config | ||
| + | # | ||
| </ | </ | ||
| - | ===La Commande firewall-cmd=== | + | <WRAP center round important 60%> |
| + | **Important** - Cette commande lit le fichier .config du noyau actuel et le compare avec celui des sources du noyau. S'il existent des nouvelles configurations à effectuer dans les sources du noyau, la commande vous pose des questions. | ||
| + | </ | ||
| + | |||
| + | La configuration du noyau se trouve dans un fichier dénommé **.config**. Le fichier **.config** est généré par une des trois commandes suivantes et ne doit **pas** être édité manuellement : | ||
| + | |||
| + | * make config | ||
| + | * make menuconfig | ||
| + | * make xconfig | ||
| + | |||
| + | Exécutez la commande **make menuconfig** : | ||
| + | |||
| + | < | ||
| + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ make menuconfig | ||
| + | UPD | ||
| + | HOSTCC | ||
| + | HOSTCC | ||
| + | HOSTCC | ||
| + | HOSTCC | ||
| + | HOSTCC | ||
| + | HOSTCC | ||
| + | HOSTCC | ||
| + | HOSTLD | ||
| + | scripts/ | ||
| + | </ | ||
| + | |||
| + | Dans l' | ||
| - | firewalld s' | + | * **y**, |
| + | * la fonctionalité est incluse dans le noyau monolithique ou dans le cas d'une dépendance d'un module, dans le module concerné, | ||
| + | * **m**, | ||
| + | * la fonctionalité | ||
| + | * **n**, | ||
| + | * la fonctionalité n'est pas incluse. | ||
| - | <WRAP center round important | + | <WRAP center round important |
| - | **Important** - firewall-cmd est le front-end de firewalld en ligne de commande. Il existe aussi la commande **firewall-config** qui lance un outi de configuration | + | **Important** - Cette commande |
| </ | </ | ||
| + | |||
| + | Sauvegardez simplement la configuration actuelle et sortez de l' | ||
| - | Pour obtenir la liste de toutes les zones prédéfinies, | + | < |
| + | *** End of the configuration. | ||
| + | *** Execute ' | ||
| + | </ | ||
| + | |||
| + | Vérifiez que le fichier **.config** a été" créé par l' | ||
| < | < | ||
| - | [root@centos7 ~]# firewall-cmd --get-zones | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ ls -a |
| - | block dmz drop external home internal public trusted work | + | . |
| + | .. .gitlab-ci.yml | ||
| + | .clang-format | ||
| + | .cocciconfig | ||
| + | .config | ||
| + | .config.old | ||
| + | .get_maintainer.ignore | ||
| </ | </ | ||
| - | Pour obtenir la liste de toutes les services prédéfinis, | + | Consultez ce fichier |
| < | < | ||
| - | [root@centos7 ~]# firewall-cmd --get-services | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ more .config |
| - | RH-Satellite-6 amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind samba samba-client smtp ssh telnet tftp tftp-client transmission-client vnc-server wbem-https | + | # |
| + | # Automatically generated file; DO NOT EDIT. | ||
| + | # Linux/x86 4.18.0 Kernel Configuration | ||
| + | # | ||
| + | |||
| + | # | ||
| + | # Compiler: gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-22) | ||
| + | # | ||
| + | CONFIG_64BIT=y | ||
| + | CONFIG_X86_64=y | ||
| + | CONFIG_X86=y | ||
| + | CONFIG_INSTRUCTION_DECODER=y | ||
| + | CONFIG_OUTPUT_FORMAT=" | ||
| + | CONFIG_ARCH_DEFCONFIG=" | ||
| + | CONFIG_LOCKDEP_SUPPORT=y | ||
| + | CONFIG_STACKTRACE_SUPPORT=y | ||
| + | CONFIG_MMU=y | ||
| + | CONFIG_ARCH_MMAP_RND_BITS_MIN=28 | ||
| + | CONFIG_ARCH_MMAP_RND_BITS_MAX=32 | ||
| + | CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8 | ||
| + | CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16 | ||
| + | CONFIG_GENERIC_ISA_DMA=y | ||
| + | CONFIG_GENERIC_BUG=y | ||
| + | --More--(0%) | ||
| </ | </ | ||
| - | Pour obtenir la liste de toutes | + | ===Le Fichier Makefile=== |
| + | |||
| + | Le fichier **Makefile** contient le nom du noyau et spécifie | ||
| + | |||
| + | * VERSION, | ||
| + | * PATCHLEVEL, | ||
| + | * SUBLEVEL, | ||
| + | * EXTRAVERSION. | ||
| + | |||
| + | Les trois premières informations sont gérées par **kernel.org** et Linus Torvalds en personne tandis que l' | ||
| < | < | ||
| - | [root@centos7 ~]# firewall-cmd --get-icmptypes | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ more Makefile |
| - | destination-unreachable echo-reply echo-request parameter-problem redirect router-advertisement router-solicitation source-quench time-exceeded | + | # SPDX-License-Identifier: GPL-2.0 |
| + | VERSION = 4 | ||
| + | PATCHLEVEL = 18 | ||
| + | SUBLEVEL = 0 | ||
| + | EXTRAVERSION = | ||
| + | NAME = Merciless Moray | ||
| + | |||
| + | # | ||
| + | # DRM backport version | ||
| + | # | ||
| + | RHEL_DRM_VERSION = 6 | ||
| + | RHEL_DRM_PATCHLEVEL = 3 | ||
| + | RHEL_DRM_SUBLEVEL = | ||
| + | RHEL_DRM_EXTRAVERSION = | ||
| + | |||
| + | # *DOCUMENTATION* | ||
| + | # To see a list of typical targets execute "make help" | ||
| + | # More info can be located in ./README | ||
| + | # Comments in this file are targeted only to the developer, do not | ||
| + | # expect to learn how to build the kernel reading this file. | ||
| + | |||
| + | # That's our default target when none is given on the command line | ||
| + | PHONY := _all | ||
| + | --More--(0%) | ||
| </ | </ | ||
| - | Pour obtenir | + | <WRAP center round important 60%> |
| + | **Important** - La version 2.6 du noyau a vu le jour en **2003**. Les **SUBLEVEL** se suivaient régulièrement. Avec la version 2.6 du noyau, la valeur paire du **PATCHLEVEL** indiquait que le noyau était stable. Quand vous recompilez le noyau à partir | ||
| + | </ | ||
| + | |||
| + | ====2.4 - Paramétrage du noyau==== | ||
| + | |||
| + | Insérez la sortie de la commande | ||
| < | < | ||
| - | [root@centos7 ~]# firewall-cmd --get-active-zones | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ uname -i |
| - | public | + | x86_64 |
| - | | + | |
| + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ vi .config | ||
| + | |||
| + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ head .config | ||
| + | # x86_64 | ||
| + | # | ||
| + | # Automatically generated file; DO NOT EDIT. | ||
| + | # Linux/x86 4.18.0 Kernel Configuration | ||
| + | # | ||
| + | |||
| + | # | ||
| + | # Compiler: gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-22) | ||
| + | # | ||
| + | CONFIG_64BIT=y | ||
| </ | </ | ||
| - | Pour obtenir la liste des zones de la configuration courante pour une interface spécifique, | + | Renommez le fichier .config en le plaçant dans le répertoire **~/ |
| < | < | ||
| - | [root@centos7 | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ cp .config |
| - | public | + | |
| + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ ls ~/ | ||
| + | Module.kabi_aarch64 | ||
| + | Module.kabi_dup_aarch64 | ||
| + | Module.kabi_dup_ppc64le | ||
| + | Module.kabi_dup_s390x | ||
| + | Module.kabi_dup_x86_64 | ||
| + | Module.kabi_ppc64le | ||
| + | Module.kabi_s390x | ||
| + | Module.kabi_x86_64 | ||
| + | centossecureboot201.cer | ||
| + | centossecurebootca2.cer | ||
| + | check-kabi | ||
| + | config-x86_64-generic | ||
| + | cpupower.config | ||
| + | cpupower.service | ||
| + | filter-aarch64.sh | ||
| + | filter-modules.sh | ||
| + | filter-ppc64le.sh | ||
| </ | </ | ||
| - | Pour obtenir la liste des services autorisés pour la zone public, utilisez la commande suivante | + | Copiez le contenu du répertoire **configs** vers le répertoire **~/ |
| < | < | ||
| - | [root@centos7 ~]# firewall-cmd --zone=public --list-services | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ cp configs/* ~/ |
| - | dhcpv6-client ssh | + | |
| </ | </ | ||
| - | Pour obtenir toute la configuration pour la zone public, utilisez la commande suivante | + | Editez |
| < | < | ||
| - | [root@centos7 ~]# firewall-cmd --zone=public --list-all | + | [trainee@centos8 linux-4.18.0-305.7.1.el8.x86_64]$ cd ~/ |
| - | public (default, active) | + | |
| - | interfaces: enp0s3 | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| + | [trainee@centos8 SPECS]$ vi kernel.spec | ||
| + | |||
| + | [trainee@centos8 SPECS]$ head -n 50 kernel.spec | ||
| + | # We have to override the new %%install behavior because, well... the kernel is special. | ||
| + | %global __spec_install_pre %{___build_pre} | ||
| + | |||
| + | # At the time of this writing (2019-03), RHEL8 packages use w2.xzdio | ||
| + | # compression for rpms (xz, level 2). | ||
| + | # Kernel has several large (hundreds of mbytes) rpms, they take ~5 mins | ||
| + | # to compress by single-threaded xz. Switch to threaded compression, | ||
| + | # and from level 2 to 3 to keep compressed sizes close to " | ||
| + | # | ||
| + | # NB: if default compression in / | ||
| + | # this one might need tweaking (e.g. if default changes to w3.xzdio, | ||
| + | # change below to w4T.xzdio): | ||
| + | %define _binary_payload w3T.xzdio | ||
| + | |||
| + | %global distro_build 553 | ||
| + | |||
| + | # Sign the x86_64 kernel for secure boot authentication | ||
| + | %ifarch x86_64 aarch64 s390x ppc64le | ||
| + | %global signkernel 1 | ||
| + | %else | ||
| + | %global signkernel 0 | ||
| + | %endif | ||
| + | |||
| + | # Sign modules on all arches | ||
| + | %global signmodules 1 | ||
| + | |||
| + | # Compress modules only for architectures that build modules | ||
| + | %ifarch noarch | ||
| + | %global zipmodules 0 | ||
| + | %else | ||
| + | %global zipmodules 1 | ||
| + | %endif | ||
| + | |||
| + | %if %{zipmodules} | ||
| + | %global zipsed -e ' | ||
| + | %endif | ||
| + | |||
| + | %define buildid .ittraining | ||
| + | |||
| + | %define specversion 4.18.0 | ||
| + | %define pkgrelease 553.16.1.el8_10 | ||
| + | |||
| + | # allow pkg_release to have configurable %%{?dist} tag | ||
| + | %define specrelease 553.16.1%{? | ||
| + | |||
| + | %define pkg_release %{specrelease}%{? | ||
| + | |||
| + | # libexec dir is not used by the linker, so the shared object there | ||
| + | # should not be exported to RPM provides | ||
| + | %global __provides_exclude_from ^%{_libexecdir}/ | ||
| </ | </ | ||
| - | Pour obtenir la liste complète | + | ====2.5 - Compiler le Noyau==== |
| + | |||
| + | La compilation du noyau peut prendre beaucoup | ||
| < | < | ||
| - | [root@centos7 ~]# firewall-cmd --list-all-zones | + | [trainee@centos8 SPECS]$ rpmbuild |
| - | block | + | [1] 96990 |
| - | interfaces: | + | [trainee@centos8 SPECS]$ Building target platforms: x86_64 |
| - | sources: | + | Building for target x86_64 |
| - | services: | + | ... |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | | + | |
| - | rich rules: | + | |
| - | + | ||
| - | dmz | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | drop | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | external | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: ssh | + | |
| - | ports: | + | |
| - | masquerade: yes | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | home | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ipp-client mdns samba-client ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | internal | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ipp-client mdns samba-client ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | public (default, active) | + | |
| - | interfaces: enp0s3 | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | trusted | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | work | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ipp-client ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| </ | </ | ||
| - | Pour changer la zone par défaut de public à work, utilisez la commande suivante | + | <WRAP center round important 60%> |
| + | **Important** - La compilation peut prendre des heures. | ||
| + | </ | ||
| + | |||
| + | A l'issu du processus, les RPMs se trouvent dans le répertoire **/ | ||
| < | < | ||
| - | [root@centos7 ~]# firewall-cmd --set-default-zone=work | + | ... |
| - | success | + | Wrote: / |
| - | [root@centos7 ~]# firewall-cmd --get-active-zones | + | ... |
| - | work | + | |
| - | interfaces: enp0s3 | + | [1]+ Done rpmbuild |
| </ | </ | ||
| - | Pour ajouter l'interface ip_fixe | + | Notez que la génération du nouveau noyau peut consommer jusqu' |
| < | < | ||
| - | [root@centos7 ~]# firewall-cmd --zone=work --add-interface=ip_fixe | + | [trainee@centos8 x86_64]$ df -h |
| - | success | + | Filesystem |
| - | [root@centos7 ~]# firewall-cmd --get-active-zones | + | devtmpfs |
| - | work | + | tmpfs 1.9G |
| - | | + | tmpfs 1.9G 9.4M 1.9G 1% /run |
| + | tmpfs 1.9G | ||
| + | / | ||
| + | / | ||
| + | tmpfs 374M | ||
| + | tmpfs 374M 1.2M 373M 1% / | ||
| + | / | ||
| </ | </ | ||
| - | Pour supprimer l'interface ip_fixe à la zone work, utilisez la commande | + | ====2.6 - Installer le Nouveau Noyau==== |
| + | |||
| + | Installez maintenant les paquets **kernel***. L'installation du noyau peut prendre beaucoup de temps (~2 heures). La commande utilisée est la suivante | ||
| < | < | ||
| - | [root@centos7 ~]# firewall-cmd --zone=work --remove-interface=ip_fixe | + | [trainee@centos8 SPECS]$ cd ../ |
| - | success | + | |
| - | [root@centos7 ~]# firewall-cmd --get-active-zones | + | [root@centos8 x86_64]# dnf localinstall kernel-*.rpm |
| - | work | + | |
| - | interfaces: enp0s3 | + | |
| </ | </ | ||
| - | Pour ajouter le service **http** à la zone **work**, utilisez | + | A l'issu de l' |
| < | < | ||
| - | [root@centos7 ~]# firewall-cmd --zone=work --add-service=http | + | [root@centos7 ~]# reboot |
| - | success | + | |
| - | [root@centos7 ~]# firewall-cmd --zone=work --list-services | + | |
| - | dhcpv6-client http ipp-client ssh | + | |
| </ | </ | ||
| - | Pour supprimer le service | + | Connectez-vous en tant que trainee et devenez root. Constatez l' |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | success | + | saved_entry=95bd69e34a7444a7b58cb74fbfb86df2-4.18.0-553.16.1.el8.ittraining.x86_64 |
| - | [root@centos7 ~]# firewall-cmd --zone=work --list-services | + | |
| - | dhcpv6-client ipp-client ssh | + | |
| </ | </ | ||
| - | Pour ajouter un nouveau bloc ICMP, utilisez la commande suivante | + | Dernièrement, vérifiez l' |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | success | + | 4.18.0-553.16.1.el8.ittraining.x86_64 |
| - | [root@centos7 ~]# firewall-cmd --zone=work --list-icmp-blocks | + | |
| - | echo-reply | + | |
| </ | </ | ||
| - | Pour supprimer un bloc ICMP, utilisez la commande suivante | + | =====LAB #3 - Gestion des Quotas===== |
| + | |||
| + | Sous Linux il est possible de mettre en place des quotas par utilisateur et par groupe. Ceci étant, Linux ne sait pas gérer des quotas par répertoire, | ||
| + | quotas par partition. L' | ||
| + | |||
| + | Déconnectez-vous et reconnectez-vous **directement** en tant que root : | ||
| < | < | ||
| - | [root@centos7 | + | root@computeXX:~# ssh -l root 10.0.2.45 |
| - | success | + | root@10.0.2.45' |
| - | [root@centos7 ~]# firewall-cmd --zone=work --list-icmp-blocks | + | Activate the web console with: systemctl enable |
| - | [root@centos7 | + | |
| + | Last login: Wed Jul 21 11:14:31 2021 | ||
| + | [root@centos8 | ||
| </ | </ | ||
| - | Pour ajouter le port 591/tcp à la zone work, utilisez la commande suivante | + | Avant de mettre en place des quotas, configurer SELINUX en mode **permissive** afin de ne pas avoir d' |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | success | + | Enforcing |
| - | [root@centos7 | + | [root@centos8 |
| - | 591/tcp | + | [root@centos8 ~]# getenforce |
| + | Permissive | ||
| + | [root@centos8 ~]# | ||
| </ | </ | ||
| - | Pour supprimer | + | Editez ensuite |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | success | + | [root@centos8 |
| - | [root@centos7 | + | |
| - | [root@centos7 ~]# | + | # This file controls the state of SELinux on the system. |
| + | # SELINUX= can take one of these three values: | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | SELINUX=permissive | ||
| + | # SELINUXTYPE= can take one of these three values: | ||
| + | # | ||
| + | # | ||
| + | # mls - Multi Level Security protection. | ||
| + | SELINUXTYPE=targeted | ||
| </ | </ | ||
| - | Pour créer un nouveau service, il convient de : | + | Commencez par vérifiez que le paquet **quota** est bien installé |
| - | * copier un fichier existant se trouvant dans le répertoire **/ | + | < |
| - | * modifier le fichier, | + | [root@centos8 ~]# rpm -qa | grep quota |
| - | * recharger la configuration de firewalld, | + | quota-4.04-12.el8.x86_64 |
| - | * vérifier que firewalld voit le nouveau service. | + | quota-nls-4.04-12.el8.noarch |
| + | </ | ||
| - | Par exemple | + | Editez le fichier **/ |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | [root@centos7 ~]# | + | [root@centos8 |
| - | [root@centos7 | + | |
| - | <?xml version=" | + | # |
| - | < | + | # /etc/fstab |
| - | < | + | # Created by anaconda on Wed Jun 16 06:21:32 2021 |
| - | < | + | # |
| - | <port protocol=" | + | # Accessible filesystems, |
| - | </service> | + | # See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info. |
| - | [root@centos7 ~]# | + | # |
| - | [root@centos7 ~]# firewall-cmd --reload | + | # After editing this file, run ' |
| - | success | + | # units generated from this file. |
| - | [root@centos7 ~]# | + | # |
| - | [root@centos7 ~]# firewall-cmd --get-services | + | / |
| - | RH-Satellite-6 amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns filemaker ftp high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind samba samba-client smtp ssh telnet tftp tftp-client transmission-client vnc-server wbem-https | + | UUID=1c04981e-5317-4b73-9695-3ce25246835d /boot |
| + | / | ||
| + | UUID=f76d6b66-985b-4a91-af9c-4987e8c1443c /home | ||
| </ | </ | ||
| - | ===La Configuration Avancée de firewalld=== | + | Redémarrez la VM : |
| - | La configuration de base de firewalld ne permet que la configuration des zones, services, blocs ICMP et les ports non-standard. Cependant firewalld peut également être configuré avec des **Rich Rules** ou **//Règles Riches//**. Rich Rules ou Règles Riches évaluent des **critères** pour ensuite entreprendre une **action**. | + | < |
| + | [root@centos8 ~]# reboot | ||
| + | </code> | ||
| - | Les **Critères** sont : | + | Reconnectez-vous |
| - | * **source address=" | + | <code> |
| - | * **destination address="< | + | root@computeXX: |
| - | * **rule port port="< | + | root@10.0.2.45's password: fenestros |
| - | * **service name=< | + | Activate the web console with: systemctl enable --now cockpit.socket |
| - | Les **Actions** sont : | + | Last login: Wed Jul 21 11:19:46 2021 |
| + | [root@centos8 ~]# | ||
| + | </ | ||
| - | | + | Vérifiez ensuite que les options |
| - | | + | |
| - | * une Action reject peut être associée avec un message d' | + | |
| - | * **drop**. | + | |
| - | Saisissez | + | < |
| + | [root@centos8 ~]# cat /etc/mtab | grep /home | ||
| + | /dev/sdc1 /home ext4 rw, | ||
| + | </ | ||
| + | |||
| + | ====3.1 - La Commande quotacheck==== | ||
| + | |||
| + | Pour activer les quotas sur /home, il convient d' | ||
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | success | + | quotacheck: Your kernel probably supports journaled quota but you are not using it. Consider switching to journaled quota to avoid running quotacheck after an unclean shutdown. |
| + | quotacheck: Scanning /dev/sdc1 [/home] done | ||
| + | quotacheck: Cannot stat old user quota file / | ||
| + | quotacheck: Cannot stat old group quota file / | ||
| + | quotacheck: Cannot stat old user quota file / | ||
| + | quotacheck: Cannot stat old group quota file / | ||
| + | quotacheck: Checked 6763 directories and 129772 files | ||
| + | quotacheck: Old file not found. | ||
| + | quotacheck: Old file not found. | ||
| </ | </ | ||
| - | <WRAP center round important | + | Les options de la commande quotacheck sont : |
| - | **Important** - Notez que la Rich Rule doit être entourée de caractères **'**. | + | |
| + | < | ||
| + | [root@centos8 ~]# quotacheck --help | ||
| + | Utility for checking and repairing quota files. | ||
| + | quotacheck [-gucbfinvdmMR] [-F < | ||
| + | |||
| + | -u, --user | ||
| + | -g, --group | ||
| + | -c, --create-files | ||
| + | -b, --backup | ||
| + | -f, --force | ||
| + | -i, --interactive | ||
| + | -n, --use-first-dquot | ||
| + | -v, --verbose | ||
| + | -d, --debug | ||
| + | -m, --no-remount | ||
| + | -M, --try-remount | ||
| + | continue even if it fails | ||
| + | -R, --exclude-root | ||
| + | -F, --format=formatname | ||
| + | -a, --all check all filesystems | ||
| + | -h, --help | ||
| + | -V, --version | ||
| + | |||
| + | Bugs to jack@suse.cz | ||
| + | </ | ||
| + | |||
| + | Les quotas ont été activés et les fichier **aquota.user** et **aquota.group** ont été créés dans le répertoire /home : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# ls -la /home | ||
| + | total 40 | ||
| + | drwxr-xr-x. | ||
| + | dr-xr-xr-x. 17 root root 224 Jul 19 12:05 .. | ||
| + | -rw-------. | ||
| + | -rw-------. | ||
| + | drwx------. | ||
| + | drwxr-xr-x. 17 trainee trainee | ||
| + | </ | ||
| + | |||
| + | Créez maintenant un utilisateur **fenestros** avec le mot de passe **fenestros** : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# groupadd fenestros && useradd fenestros -c FenestrOs -d / | ||
| + | [root@centos8 ~]# passwd fenestros | ||
| + | Changing password for user fenestros. | ||
| + | New password: | ||
| + | BAD PASSWORD: The password contains the user name in some form | ||
| + | Retype new password: | ||
| + | passwd: all authentication tokens updated successfully. | ||
| + | </ | ||
| + | |||
| + | ====3.2 - La Commande edquota==== | ||
| + | |||
| + | Mettez en place maintenant un quota de 10Mo pour l' | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# edquota -u fenestros -f /home | ||
| + | </ | ||
| + | |||
| + | L' | ||
| + | |||
| + | < | ||
| + | Disk quotas for user fenestros (uid 1001): | ||
| + | Filesystem | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | Modifiez ce fichier ainsi : | ||
| + | |||
| + | < | ||
| + | Disk quotas for user fenestros (uid 1001): | ||
| + | Filesystem | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | Sauvegardez et quittez le fichier. | ||
| + | |||
| + | Les options de la commande **edquota** sont : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# edquota --help | ||
| + | edquota: Usage: | ||
| + | edquota [-rm] [-u] [-F formatname] [-p username] [-f filesystem] username ... | ||
| + | edquota [-rm] -g [-F formatname] [-p groupname] [-f filesystem] groupname ... | ||
| + | edquota [-rm] -P [-F formatname] [-p projectname] [-f filesystem] projectname ... | ||
| + | edquota [-u|g|-P] [-F formatname] [-f filesystem] -t | ||
| + | edquota [-u|g|-P] [-F formatname] [-f filesystem] -T username|groupname|projectname ... | ||
| + | |||
| + | -u, --user | ||
| + | -g, --group | ||
| + | -P, --project | ||
| + | -r, --remote | ||
| + | -m, --no-mixed-pathnames | ||
| + | -F, --format=formatname | ||
| + | -p, --prototype=name | ||
| + | --always-resolve | ||
| + | composed only of digits | ||
| + | -f, --filesystem=filesystem | ||
| + | -t, --edit-period | ||
| + | -T, --edit-times | ||
| + | -h, --help | ||
| + | -V, --version | ||
| + | |||
| + | Bugs to: jack@suse.cz | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important | ||
| + | **Important** - Pour mettre en place un quota par group, | ||
| </ | </ | ||
| - | Saisissez la commande suivante pour visualiser la règle iptables pour IPv4 : | + | ====3.3 - La Commande quotaon==== |
| + | |||
| + | Appliquez maintenant les quotas | ||
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | ACCEPT | + | |
| </ | </ | ||
| - | Saisissez | + | Les options de la commande |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | ACCEPT | + | quotaon: Usage: |
| - | ACCEPT | + | quotaon [-guPvp] [-F quotaformat] [-x state] -a |
| + | quotaon [-guPvp] [-F quotaformat] [-x state] filesys ... | ||
| + | |||
| + | -a, --all turn quotas on for all filesystems | ||
| + | -f, --off turn quotas off | ||
| + | -u, --user | ||
| + | -g, --group | ||
| + | -P, --project | ||
| + | -p, --print-state | ||
| + | -x, --xfs-command=cmd | ||
| + | -F, --format=formatname | ||
| + | -v, --verbose | ||
| + | -h, --help | ||
| + | -V, --version | ||
| </ | </ | ||
| - | <WRAP center round important 50%> | + | De cette manière vous avez mis en place un quota **souple** pour fenestros de 8 000 Ko et un quota **stricte** de 10 000 Ko. |
| - | **Important** - Notez que la Rich Rule a créé deux règles, une pour IPv4 et une deuxième pour IPv6. Une règle peut être créée pour IPv4 seul en incluant | + | |
| + | Quand l' | ||
| + | |||
| + | Il est à noter que vous pouvez soit mettre en place un quota en taille, soit mettre en place un quota basé sur le nombre d' | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **important** - La commande pour désactivez les quotas est **quotaoff**. | ||
| </ | </ | ||
| - | Cette nouvelle règle est écrite en mémoire mais non pas sur disque. Pour l' | + | ====3.4 - La Commande repquota==== |
| + | |||
| + | Pour visualiser les quotas utilisez la commande | ||
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | success | + | *** Report for user quotas on device /dev/sdc1 |
| - | [root@centos7 ~]# | + | Block grace time: 7days; Inode grace time: 7days |
| - | [root@centos7 ~]# cat / | + | Block limits |
| - | <?xml version=" | + | User used soft hard grace used soft hard grace |
| - | < | + | ---------------------------------------------------------------------- |
| - | < | + | root -- |
| - | < | + | trainee |
| - | <service name=" | + | |
| - | < | + | |
| - | < | + | |
| - | < | + | |
| - | <port protocol=" | + | |
| - | < | + | |
| - | </ | + | |
| - | </ | + | |
| </ | </ | ||
| - | <WRAP center round important | + | <WRAP center round important |
| - | **Important** - Attention ! La règle ajoutée avec l'option --permanent | + | **Important** - Notez que l'utilisateur fenestros ne figure pas dans la liste. Sous RHEL / CentOS, le quota n'est pas visible tant que l'utilisateur ne s'est pas connecté pour la première |
| </ | </ | ||
| - | Pour visualiser cette règle dans la configuration de firewalld, il convient | + | Les options |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | ... | + | repquota: Utility for reporting quotas. |
| - | work (default, active) | + | Usage: |
| - | | + | repquota [-vugsi] [-c|C] [-t|n] [-F quotaformat] [-O (default | xml | csv)] (-a | mntpoint) |
| - | | + | |
| - | services: dhcpv6-client ipp-client ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | rule port port=" | + | |
| + | -v, --verbose | ||
| + | -u, --user | ||
| + | -g, --group | ||
| + | -P, --project | ||
| + | -s, --human-readable | ||
| + | -t, --truncate-names | ||
| + | -p, --raw-grace | ||
| + | -n, --no-names | ||
| + | -i, --no-autofs | ||
| + | -c, --cache | ||
| + | -C, --no-cache | ||
| + | -F, --format=formatname | ||
| + | -O, --output=format | ||
| + | -a, --all | ||
| + | -h, --help | ||
| + | -V, --version | ||
| + | |||
| + | Bugs to jack@suse.cz | ||
| </ | </ | ||
| - | Notez que la Rich Rule est créée dans la Zone par Défaut. Il est possible de créer une Rich Rule dans une autre zone en utilisant l'option | + | ====3.5 - La Commande quota==== |
| + | |||
| + | Pour visualiser les quotas d'un utilisateur spécifique, | ||
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | success | + | Disk quotas for user fenestros (uid 1001): no limited resources used |
| - | [root@centos7 | + | [root@centos8 |
| - | ... | + | [fenestros@centos8 ~]$ touch test |
| - | public | + | [fenestros@centos8 ~]$ exit |
| - | | + | logout |
| - | sources: | + | [root@centos8 ~]# quota fenestros |
| - | services: dhcpv6-client ssh | + | Disk quotas for user fenestros |
| - | ports: | + | Filesystem |
| - | masquerade: no | + | / |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | rule port port=" | + | |
| - | trusted | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | work (default, active) | + | |
| - | interfaces: enp0s3 | + | |
| - | | + | |
| - | services: dhcpv6-client ipp-client ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | rule port port=" | + | |
| </ | </ | ||
| - | + | Les options | |
| - | Pour supprimer une Rich Rule, il faut copier la ligne entière la concernant qui se trouve dans la sortie | + | |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | success | + | quota: Usage: quota [-guPqvswim] [-l | [-Q | -A]] [-F quotaformat] |
| + | quota [-qvswim] [-l | [-Q | -A]] [-F quotaformat] -u username ... | ||
| + | quota [-qvswim] [-l | [-Q | -A]] [-F quotaformat] -g groupname ... | ||
| + | quota [-qvswugPQm] [-F quotaformat] -f filesystem ... | ||
| + | |||
| + | -u, --user | ||
| + | -g, --group | ||
| + | -P, --project | ||
| + | -q, --quiet | ||
| + | -v, --verbose | ||
| + | -s, --human-readable | ||
| + | --always-resolve | ||
| + | composed of only digits | ||
| + | -w, --no-wrap | ||
| + | -p, --raw-grace | ||
| + | -l, --local-only | ||
| + | -Q, --quiet-refuse | ||
| + | not respond | ||
| + | -i, --no-autofs | ||
| + | -F, --format=formatname | ||
| + | -f, --filesystem-list | ||
| + | -A, --all-nfs | ||
| + | -m, --no-mixed-pathnames | ||
| + | --show-mntpoint | ||
| + | --hide-device | ||
| + | -h, --help | ||
| + | -V, --version | ||
| + | |||
| + | Bugs to: jack@suse.cz | ||
| </ | </ | ||
| - | ===Le mode Panic de firewalld=== | + | ====3.6 - La Commande warnquota==== |
| - | Le mode Panic de firewalld permet de bloquer tout le trafic avec une seule commande. | + | La commande |
| + | |||
| + | Sous RHEL/CentOS, warnquota n'est pas installé par défaut | ||
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | no | + | / |
| </ | </ | ||
| - | Pour activer | + | Installez donc le paquet **quota-warnquota** |
| < | < | ||
| - | [root@centos7 ~]# firewall-cmd --panic-on | + | [root@centos7 ~]# dnf install quota-warnquota |
| - | success | + | ... |
| - | [root@centos7 ~]# firewall-cmd --query-panic | + | |
| - | yes | + | |
| </ | </ | ||
| - | Pour désactiver le mode Panic, il convient | + | Les options |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | success | + | warnquota: Usage: |
| - | [root@centos7 ~]# firewall-cmd --query-panic | + | |
| - | no | + | |
| + | -u, --user | ||
| + | -g, --group | ||
| + | -s, --human-readable | ||
| + | -i, --no-autofs | ||
| + | -d, --no-details | ||
| + | -F, --format=formatname | ||
| + | -c, --config=config-file | ||
| + | -q, --quota-tab=quotatab-file | ||
| + | -a, --admins-file=admins-file | ||
| + | -h, --help | ||
| + | -v, --version | ||
| + | |||
| + | warnquota: Bugs to jack@suse.cz | ||
| </ | </ | ||
| ----- | ----- | ||
| - | < | + | Copyright © 2024 Hugh Norris. |
| - | <div align=" | + | |
| - | Copyright © 2021 Hugh Norris.< | + | |
| - | </ | + | |
| - | </ | + | |
