Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:debian:10:junior:l122 [2023/08/24 11:19] – admin | elearning:workbooks:debian:10:junior:l122 [2024/10/18 11:37] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| - | Version : **2023.01** | + | Version : **2024.01** |
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LDF603 | + | ======LDF607 |
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| - | * **LDF603 | + | * **LDF607 |
| * Contenu du Module | * Contenu du Module | ||
| - | * Présentation | + | * Rôle du noyau |
| - | * La Commande nmcli | + | * LAB #1 - Compilation et installation |
| - | * LAB #1 - Configuration | + | * 1.1 - Déplacer /home |
| - | * 1.1 - Connections et Profils | + | * 1.2 - Télécharger le Code Source du Noyau |
| - | * 1.2 - Résolution des Noms | + | * 1.3 - Configurer le Noyau |
| - | * 1.3 - Ajouter une Deuxième Adresse IP à un Profil | + | * 1.4 - Compiler le Noyau |
| - | * 1.4 - La Commande hostname | + | * 1.5 - Installer le Nouveau Noyau |
| - | * 1.5 - La Commande ip | + | * 1.6 - Désinstaller un Noyau |
| - | * 1.6 - Activer/ | + | * LAB #2 - Mise à Jour du Noyau avec le Gestionnaire des Paquets |
| - | * 1.7 - Routage Statique | + | * LAB #3 - Gestion des Quotas |
| - | * La commande ip | + | * 3.1 - La Commande quotacheck |
| - | * Activer/ | + | * 3.2 - La Commande edquota |
| - | * LAB #2 - Diagnostique | + | * 3.3 - La Commande quotaon |
| - | * 2.1 - ping | + | * 3.4 - La Commande repquota |
| - | * 2.2 - netstat -i | + | * 3.5 - La Commande quota |
| - | * 2.3 - traceroute | + | * 3.6 - La Commande |
| - | * LAB #3 - Connexions à Distance | + | |
| - | * 3.1 - Telnet | + | |
| - | * 3.2 - wget | + | |
| - | * 3.3 - ftp | + | |
| - | * 3.4 - SSH | + | |
| - | * Présentation | + | |
| - | * SSH-1 | + | |
| - | * SSH-2 | + | |
| - | * Authentification par mot de passe | + | |
| - | * Authentification par clef asymétrique | + | |
| - | * Configuration du Serveur | + | |
| - | * Configuration du Client | + | |
| - | * Tunnels SSH | + | |
| - | * 3.5 - SCP | + | |
| - | * Présentation | + | |
| - | * Utilisation | + | |
| - | * 3.6 - Mise en Place des Clefs Asymétriques | + | |
| - | * 3.7 - Services réseaux | + | |
| - | * inetd | + | |
| - | * TCP Wrapper | + | |
| - | * LAB #4 - Le Parefeu Netfilter | + | |
| - | * 4.1 - Présentation | + | |
| - | * 4.2 - La Configuration de Netfilter par firewalld | + | |
| - | * La Configuration de Base de firewalld | + | |
| - | * La Commande | + | |
| - | * La Configuration Avancée de firewalld | + | |
| - | * Le mode Panic de firewalld | + | |
| - | =====Présentation===== | + | =====Rôle du noyau===== |
| - | Debian 11 utilise **Network Manager** pour gérer le réseau. Network Manager | + | Le noyau ou //kernel// est la partie du système d' |
| - | * un service qui gère les connexions réseaux et rapporte leurs états, | + | * la diminution de la taille du noyau, |
| - | * des front-ends qui passent par un API de configuration | + | * la prise en charge |
| + | * l' | ||
| + | * l' | ||
| + | * la correction de bogues, | ||
| + | * le besoin d'une fonctionnalité expérimentale. | ||
| - | <WRAP center round important 60%> | + | Commencez |
| - | **Important** : Notez qu' | + | |
| - | </ | + | |
| - | + | ||
| - | Le service NetworkManager doit toujours être lancé | + | |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | ● NetworkManager.service | + | 5.10.0-13-amd64 |
| - | Loaded: loaded (/ | + | |
| - | | + | |
| - | Docs: man: | + | |
| - | Main PID: 499 (NetworkManager) | + | |
| - | Tasks: 3 (limit: 4632) | + | |
| - | | + | |
| - | CPU: 1.811s | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | May 01 18:00:05 debian11 NetworkManager[499]: | + | |
| - | May 01 18:00:05 debian11 NetworkManager[499]: | + | |
| - | May 01 18:00:05 debian11 NetworkManager[499]: | + | |
| - | May 01 18:00:05 debian11 NetworkManager[499]: | + | |
| - | May 01 18:00:05 debian11 NetworkManager[499]: | + | |
| - | May 01 18:00:05 debian11 NetworkManager[499]: | + | |
| - | May 01 18:00:05 debian11 NetworkManager[499]: | + | |
| - | May 01 18:00:05 debian11 NetworkManager[499]: | + | |
| - | May 01 18:00:05 debian11 NetworkManager[499]: | + | |
| - | May 01 18:00:05 debian11 NetworkManager[499]: | + | |
| - | lines 1-21/21 (END) | + | |
| - | [q] | + | |
| </ | </ | ||
| - | ===La Commande nmcli=== | + | Dans le cas d'une utilisation courante de Linux, il est cependant préférable de faire appel aux **modules**. Les modules se trouvent dans le répertoire **/ |
| - | + | ||
| - | La commande | + | |
| - | + | ||
| - | Les options et les sous-commandes peuvent être consultées en utilisant les commandes suivantes | + | |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | Usage: nmcli [OPTIONS] OBJECT { COMMAND | help } | + | kernel |
| - | + | modules.alias | |
| - | OPTIONS | + | |
| - | | + | |
| - | | + | |
| - | -e, --escape yes|no | + | |
| - | -f, --fields <field,...> | + | |
| - | -g, --get-values <field,...> | + | |
| - | -h, --help | + | |
| - | -m, --mode tabular|multiline | + | |
| - | -o, --overview | + | |
| - | -p, --pretty | + | |
| - | -s, --show-secrets | + | |
| - | -t, --terse | + | |
| - | -v, --version | + | |
| - | -w, --wait < | + | |
| - | + | ||
| - | OBJECT | + | |
| - | g[eneral] | + | |
| - | n[etworking] | + | |
| - | | + | |
| - | c[onnection] | + | |
| - | d[evice] | + | |
| - | a[gent] | + | |
| - | m[onitor] | + | |
| </ | </ | ||
| - | =====LAB #1 - Configuration du Réseau===== | + | Les commandes pour manipuler les modules sont : |
| - | ====1.1 - Connections et Profils==== | + | * insmod |
| + | * rmmod | ||
| + | * lsmod | ||
| + | * modprobe | ||
| - | NetworkManager inclus la notion de **connections** ou **profils** permettant des configurations différentes en fonction de la localisation. Pour voir les connections actuelles, utilisez la commande **nmcli c** avec la sous-commande **show** | + | Par exemple |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | NAME UUID TYPE DEVICE | + | Module |
| - | Wired connection | + | rfkill |
| + | raid456 | ||
| + | async_raid6_recov | ||
| + | async_memcpy | ||
| + | async_pq | ||
| + | async_xor | ||
| + | async_tx | ||
| + | md_mod | ||
| + | sg | ||
| + | virtio_balloon | ||
| + | joydev | ||
| + | qemu_fw_cfg | ||
| + | pcspkr | ||
| + | serio_raw | ||
| + | evdev 28672 2 | ||
| + | ecryptfs | ||
| + | parport_pc | ||
| + | ppdev 24576 0 | ||
| + | lp | ||
| + | parport | ||
| + | fuse 167936 | ||
| + | configfs | ||
| + | ip_tables | ||
| + | x_tables | ||
| + | autofs4 | ||
| + | ext4 921600 | ||
| + | crc16 16384 1 ext4 | ||
| + | mbcache | ||
| + | jbd2 151552 | ||
| + | hid_generic | ||
| + | btrfs 1568768 | ||
| + | usbhid | ||
| + | hid | ||
| + | blake2b_generic | ||
| + | xor 24576 2 async_xor, | ||
| + | raid6_pq | ||
| + | libcrc32c | ||
| + | crc32c_generic | ||
| + | usb_storage | ||
| + | dm_mod | ||
| + | sd_mod | ||
| + | t10_pi | ||
| + | crc_t10dif | ||
| + | crct10dif_generic | ||
| + | crct10dif_common | ||
| + | sr_mod | ||
| + | cdrom 73728 | ||
| + | virtio_net | ||
| + | net_failover | ||
| + | failover | ||
| + | virtio_scsi | ||
| + | bochs_drm | ||
| + | ata_generic | ||
| + | drm_vram_helper | ||
| + | uhci_hcd | ||
| + | drm_ttm_helper | ||
| + | ttm | ||
| + | ehci_hcd | ||
| + | drm_kms_helper | ||
| + | cec 61440 1 drm_kms_helper | ||
| + | psmouse | ||
| + | drm | ||
| + | usbcore | ||
| + | ata_piix | ||
| + | virtio_pci | ||
| + | libata | ||
| + | virtio_ring | ||
| + | virtio | ||
| + | i2c_piix4 | ||
| + | scsi_mod | ||
| + | usb_common | ||
| + | floppy | ||
| + | button | ||
| </ | </ | ||
| - | Créez donc un profil IP fixe rattaché au périphérique | + | Pour ajouter |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | Connection ' | + | |
| - | </ | + | |
| - | Constatez sa présence : | + | root@debian11: |
| - | + | Module | |
| - | < | + | bonding |
| - | root@debian11: | + | rfkill |
| - | NAME UUID TYPE DEVICE | + | raid456 |
| - | Wired connection | + | async_raid6_recov |
| - | ip_fixe | + | async_memcpy |
| + | async_pq | ||
| + | async_xor | ||
| + | async_tx | ||
| + | md_mod | ||
| </ | </ | ||
| - | Notez que la sortie n' | + | Pour supprimer un module, on peut utiliser |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | GENERAL.DEVICE: ens18 | + | root@debian11:~# lsmod | head |
| - | GENERAL.TYPE: | + | Module |
| - | GENERAL.HWADDR: | + | rfkill |
| - | GENERAL.MTU: | + | raid456 |
| - | GENERAL.STATE: | + | async_raid6_recov |
| - | GENERAL.CONNECTION: | + | async_memcpy |
| - | GENERAL.CON-PATH: | + | async_pq |
| - | WIRED-PROPERTIES.CARRIER: | + | async_xor |
| - | IP4.ADDRESS[1]: | + | async_tx |
| - | IP4.GATEWAY: | + | md_mod |
| - | IP4.ROUTE[1]: | + | sg |
| - | IP4.ROUTE[2]: dst = 0.0.0.0/0, nh = 10.0.2.1, mt = 100 | + | |
| - | IP4.DNS[1]: | + | |
| - | IP4.DNS[2]: | + | |
| - | IP6.ADDRESS[1]: | + | |
| - | IP6.GATEWAY: | + | |
| - | IP6.ROUTE[1]: | + | |
| - | IP6.ROUTE[2]: | + | |
| - | + | ||
| - | GENERAL.DEVICE: | + | |
| - | GENERAL.TYPE: | + | |
| - | GENERAL.HWADDR: | + | |
| - | GENERAL.MTU: | + | |
| - | lines 1-23 | + | |
| - | [q] | + | |
| </ | </ | ||
| - | Pour activer le profil ip_fixe, utilisez | + | Les dépendances des modules sont résolues par la commande |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | + | kernel/ | |
| - | </code> | + | kernel/arch/ |
| - | + | kernel/ | |
| - | Notez que votre terminal est bloqué à cause du changement de l' | + | kernel/ |
| - | + | kernel/ | |
| - | <WRAP center round todo 60%> | + | kernel/ |
| - | **A faire** | + | kernel/ |
| - | </WRAP> | + | kernel/ |
| - | + | kernel/ | |
| - | Le profil ip_fixe est maintenant activé tandis que le profil enp0s3 a été désactivé | + | kernel/ |
| - | + | kernel/ | |
| - | < | + | mmon.ko kernel/ |
| - | root@debian11:~# nmcli c show | + | kernel/ |
| - | NAME UUID TYPE DEVICE | + | kernel/ |
| - | ip_fixe | + | kernel/ |
| - | Wired connection 1 77c569e6-3176-4c10-8008-40d7634d2504 | + | kernel/ |
| - | | + | kernel/ |
| - | root@debian11:~# nmcli d show | + | kernel/ |
| - | GENERAL.DEVICE: ens18 | + | kernel/ |
| - | GENERAL.TYPE: ethernet | + | crypto/ |
| - | GENERAL.HWADDR: F6: | + | kernel/ |
| - | GENERAL.MTU: 1500 | + | kernel/ |
| - | GENERAL.STATE: 100 (connected) | + | kernel/ |
| - | GENERAL.CONNECTION: ip_fixe | + | kernel/ |
| - | GENERAL.CON-PATH: | + | kernel/ |
| - | WIRED-PROPERTIES.CARRIER: on | + | kernel/ |
| - | IP4.ADDRESS[1]: 10.0.2.41/24 | + | kernel/ |
| - | IP4.GATEWAY: 10.0.2.1 | + | kernel/ |
| - | IP4.ROUTE[1]: dst = 10.0.2.0/24, nh = 0.0.0.0, mt = 1> | + | kernel/arch/x86/crypto/sha512-ssse3.ko: kernel/ |
| - | IP4.ROUTE[2]: dst = 0.0.0.0/0, nh = 10.0.2.1, mt = 100 | + | kernel/ |
| - | IP6.ADDRESS[1]: fe80::7958:e23f:31e:62cd/64 | + | kernel/ |
| - | IP6.GATEWAY: -- | + | kernel/arch/ |
| - | IP6.ROUTE[1]: dst = fe80::/64, nh = ::, mt = 100 | + | kernel/ |
| - | IP6.ROUTE[2]: | + | kernel/ |
| - | + | kernel/ | |
| - | GENERAL.DEVICE: lo | + | kernel/ |
| - | GENERAL.TYPE: loopback | + | kernel/ |
| - | lines 1-19 | + | kernel/arch/ |
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/fs/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/fs/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | --More--(0%) | ||
| [q] | [q] | ||
| </ | </ | ||
| - | Pour consulter les paramètres du profil | + | Il est possible d' |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | =============================================================================== | + | filename: |
| - | | + | author: |
| - | =============================================================================== | + | description: |
| - | connection.id: Wired connection 1 | + | license: GPL |
| - | connection.uuid: | + | alias: rtnl-link-bond |
| - | connection.stable-id: -- | + | depends: |
| - | connection.type: | + | retpoline: Y |
| - | connection.interface-name: -- | + | intree: |
| - | connection.autoconnect: yes | + | name: bonding |
| - | connection.autoconnect-priority: | + | vermagic: |
| - | connection.autoconnect-retries: -1 (default) | + | sig_id: PKCS#7 |
| - | connection.multi-connect: 0 (default) | + | signer: |
| - | connection.auth-retries: | + | sig_key: |
| - | connection.timestamp: 1651494383 | + | sig_hashalgo: sha256 |
| - | connection.read-only: no | + | signature: |
| - | connection.permissions: -- | + | EC:81: |
| - | connection.zone: -- | + | 77: |
| - | connection.master: -- | + | |
| - | connection.slave-type: -- | + | |
| - | connection.autoconnect-slaves: -1 (default) | + | |
| - | connection.secondaries: -- | + | |
| - | connection.gateway-ping-timeout: 0 | + | |
| - | connection.metered: unknown | + | |
| - | connection.lldp: | + | |
| - | connection.mdns: | + | |
| - | connection.llmnr: -1 (default) | + | |
| - | connection.wait-device-timeout: -1 | + | |
| - | ------------------------------------------------------------------------------- | + | parm: max_bonds: |
| - | 802-3-ethernet.port: -- | + | parm: tx_queues: |
| - | 802-3-ethernet.speed: 0 | + | parm: num_grat_arp: |
| - | 802-3-ethernet.duplex: -- | + | parm: num_unsol_na: |
| - | 802-3-ethernet.auto-negotiate: no | + | parm: miimon:Link check interval in milliseconds (int) |
| - | 802-3-ethernet.mac-address: | + | parm: updelay: |
| - | 802-3-ethernet.cloned-mac-address: | + | parm: downdelay: |
| - | 802-3-ethernet.generate-mac-address-mask:-- | + | parm: use_carrier: |
| - | 802-3-ethernet.mac-address-blacklist: -- | + | parm: mode:Mode of operation; 0 for balance-rr, 1 for active-backup, 2 for balance-xor, 3 for broadcast, 4 for 802.3ad, 5 for balance-tlb, 6 for balance-alb (charp) |
| - | 802-3-ethernet.mtu: auto | + | parm: primary: |
| - | 802-3-ethernet.s390-subchannels: | + | parm: primary_reselect: |
| - | 802-3-ethernet.s390-nettype: -- | + | parm: lacp_rate: |
| - | 802-3-ethernet.s390-options: -- | + | parm: ad_select:802.3ad aggregation selection logic; 0 for stable (default), 1 for bandwidth, 2 for count (charp) |
| - | 802-3-ethernet.wake-on-lan: | + | parm: |
| - | 802-3-ethernet.wake-on-lan-password: -- | + | parm: xmit_hash_policy: |
| - | ------------------------------------------------------------------------------- | + | parm: arp_interval:arp interval in milliseconds (int) |
| - | ipv4.method: manual | + | parm: arp_ip_target:arp targets in n.n.n.n form (array of charp) |
| - | ipv4.dns: | + | parm: arp_validate: |
| - | ipv4.dns-search: -- | + | parm: arp_all_targets: |
| - | ipv4.dns-options: -- | + | parm: fail_over_mac: |
| - | ipv4.dns-priority: 0 | + | parm: all_slaves_active: |
| - | ipv4.addresses: 10.0.2.40/24 | + | parm: resend_igmp:Number of IGMP membership reports to send on link failure (int) |
| - | ipv4.gateway: 10.0.2.1 | + | parm: |
| - | ipv4.routes: -- | + | parm: |
| - | ipv4.route-metric: -1 | + | |
| - | ipv4.route-table: | + | |
| - | ipv4.routing-rules: | + | |
| - | ipv4.ignore-auto-routes: no | + | |
| - | ipv4.ignore-auto-dns: no | + | |
| - | lines 1-56 | + | |
| - | [q] | + | |
| </ | </ | ||
| - | De même, pour consulter | + | Dernièrement, les fichiers dans le repertoire |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | =============================================================================== | + | mdadm.conf |
| - | | + | |
| - | =============================================================================== | + | |
| - | connection.id: | + | |
| - | connection.uuid: | + | |
| - | connection.stable-id: | + | |
| - | connection.type: | + | |
| - | connection.interface-name: | + | |
| - | connection.autoconnect: | + | |
| - | connection.autoconnect-priority: | + | |
| - | connection.autoconnect-retries: | + | |
| - | connection.multi-connect: | + | |
| - | connection.auth-retries: | + | |
| - | connection.timestamp: | + | |
| - | connection.read-only: | + | |
| - | connection.permissions: | + | |
| - | connection.zone: | + | |
| - | connection.master: | + | |
| - | connection.slave-type: | + | |
| - | connection.autoconnect-slaves: | + | |
| - | connection.secondaries: | + | |
| - | connection.gateway-ping-timeout: | + | |
| - | connection.metered: | + | |
| - | connection.lldp: | + | |
| - | connection.mdns: | + | |
| - | connection.llmnr: | + | |
| - | connection.wait-device-timeout: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | 802-3-ethernet.port: | + | |
| - | 802-3-ethernet.speed: | + | |
| - | 802-3-ethernet.duplex: | + | |
| - | 802-3-ethernet.auto-negotiate: | + | |
| - | 802-3-ethernet.mac-address: | + | |
| - | 802-3-ethernet.cloned-mac-address: | + | |
| - | 802-3-ethernet.generate-mac-address-mask: | + | |
| - | 802-3-ethernet.mac-address-blacklist: | + | |
| - | 802-3-ethernet.mtu: | + | |
| - | 802-3-ethernet.s390-subchannels: | + | |
| - | 802-3-ethernet.s390-nettype: | + | |
| - | 802-3-ethernet.s390-options: | + | |
| - | 802-3-ethernet.wake-on-lan: | + | |
| - | 802-3-ethernet.wake-on-lan-password: | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | ipv4.method: | + | |
| - | ipv4.dns: | + | |
| - | ipv4.dns-search: | + | |
| - | ipv4.dns-options: | + | |
| - | ipv4.dns-priority: | + | |
| - | ipv4.addresses: | + | |
| - | ipv4.gateway: | + | |
| - | ipv4.routes: | + | |
| - | ipv4.route-metric: | + | |
| - | ipv4.route-table: | + | |
| - | ipv4.routing-rules: | + | |
| - | ipv4.ignore-auto-routes: | + | |
| - | ipv4.ignore-auto-dns: | + | |
| - | lines 1-56 | + | |
| - | [q] | + | |
| - | </ | + | |
| - | Pour consulter la liste profils associés à un périphérique, utilisez la commande suivante | + | root@debian11: |
| + | # mdadm module configuration file | ||
| + | # set start_ro=1 to make newly assembled arrays read-only initially, | ||
| + | # to prevent metadata writes. | ||
| + | # resume-from-disk to work - new boot should not perform writes | ||
| + | # because it will be done behind the back of the system being | ||
| + | # resumed. | ||
| - | < | + | options md_mod start_ro=1 |
| - | root@debian11: | + | |
| - | CONNECTIONS.AVAILABLE-CONNECTION-PATHS: | + | |
| - | CONNECTIONS.AVAILABLE-CONNECTIONS[1]: | + | |
| - | CONNECTIONS.AVAILABLE-CONNECTIONS[2]: | + | |
| - | lines 1-3/3 (END) | + | |
| - | [q] | + | |
| </ | </ | ||
| - | Les fichiers de configuration pour le periphérique **ens18** se trouvent dans le répertoire **/ | + | =====LAB #1 - Compilation et installation du noyau===== |
| - | < | + | Commencez par installer |
| - | root@debian11: | + | |
| - | total 8 | + | |
| - | -rw------- 1 root root 284 May 2 14:23 ip_fixe.nmconnection | + | |
| - | -rw------- 1 root root 249 Apr 25 07:01 'Wired connection 1' | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.2 - Résolution des Noms==== | + | |
| - | + | ||
| - | L' | + | |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | [connection] | + | Hit:1 http://deb.debian.org/debian bullseye InRelease |
| - | id=ip_fixe | + | Get:2 http://deb.debian.org/ |
| - | uuid=c52994fc-0918-4108-81d2-d86dade62c7a | + | Get:3 http:// |
| - | type=ethernet | + | Fetched 83.5 kB in 1s (158 kB/s) |
| - | interface-name=ens18 | + | Reading package lists... Done |
| - | permissions= | + | |
| - | [ethernet] | + | root@debian11: |
| - | mac-address-blacklist= | + | |
| - | + | ||
| - | [ipv4] | + | |
| - | address1=10.0.2.41/ | + | |
| - | dns-search= | + | |
| - | method=manual | + | |
| - | + | ||
| - | [ipv6] | + | |
| - | addr-gen-mode=stable-privacy | + | |
| - | dns-search= | + | |
| - | method=auto | + | |
| - | + | ||
| - | [proxy] | + | |
| </ | </ | ||
| - | La résolution des noms est donc inactive : | + | ====1.1 - Déplacer |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | ping: www.free.fr: | + | |
| - | </code> | + | |
| - | Modifiez donc la configuration du profil | + | Créez une seule partition sur **/dev/sdb** : |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | </code> | + | |
| - | L' | + | Welcome to fdisk (util-linux 2.36.1). |
| + | Changes will remain in memory only, until you decide to write them. | ||
| + | Be careful before using the write command. | ||
| - | < | + | Device does not contain a recognized partition table. |
| - | root@debian11: | + | Created a new DOS disklabel with disk identifier 0xa10c368d. |
| - | [connection] | + | |
| - | id=ip_fixe | + | |
| - | uuid=c52994fc-0918-4108-81d2-d86dade62c7a | + | |
| - | type=ethernet | + | |
| - | interface-name=ens18 | + | |
| - | permissions= | + | |
| - | timestamp=1651499105 | + | |
| - | [ethernet] | + | Command (m for help): n |
| - | mac-address-blacklist= | + | Partition type |
| + | | ||
| + | | ||
| + | Select (default p): | ||
| - | [ipv4] | + | Using default response p. |
| - | address1=10.0.2.41/24,10.0.2.1 | + | Partition number (1-4, default |
| - | dns=8.8.8.8; | + | First sector (2048-134217727, default 2048): |
| - | dns-search= | + | Last sector, +/-sectors or +/ |
| - | method=manual | + | |
| - | [ipv6] | + | Created a new partition 1 of type ' |
| - | addr-gen-mode=stable-privacy | + | |
| - | dns-search= | + | |
| - | method=auto | + | |
| - | [proxy] | + | Command (m for help): w |
| + | The partition table has been altered. | ||
| + | Calling ioctl() to re-read partition table. | ||
| + | Syncing disks. | ||
| </ | </ | ||
| - | Afin que la modification du serveur DNS soit prise en compte, re-démarrez le service NetworkManager | + | Créez maintenant un système de fichiers ext4 sur **/ |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | </code> | + | mke2fs 1.46.2 (28-Feb-2021) |
| + | Discarding device blocks: done | ||
| + | Creating filesystem with 16776960 4k blocks and 4194304 inodes | ||
| + | Filesystem UUID: 24f1821e-1d5b-4256-8ee3-c9ee6b382ddc | ||
| + | Superblock backups stored on blocks: | ||
| + | 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, | ||
| + | 4096000, 7962624, 11239424 | ||
| - | Vérifiez que le fichier **/ | + | Allocating group tables: done |
| - | + | Writing inode tables: done | |
| - | < | + | Creating journal (65536 blocks): done |
| - | root@debian11:~# cat / | + | Writing superblocks and filesystem accounting information: |
| - | # Generated by NetworkManager | + | |
| - | nameserver 8.8.8.8 | + | |
| </ | </ | ||
| - | Dernièrement vérifiez la resolution des noms : | + | Editez |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | PING www.free.fr (212.27.48.10) 56(84) bytes of data. | + | |
| - | 64 bytes from www.free.fr (212.27.48.10): | + | |
| - | 64 bytes from www.free.fr (212.27.48.10): | + | |
| - | ^C | + | |
| - | --- www.free.fr ping statistics --- | + | |
| - | 2 packets transmitted, | + | |
| - | rtt min/ | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** : Notez qu'il existe un front-end graphique en mode texte, **nmtui**, pour configurer NetworkManager. | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.3 - Ajouter une Deuxième Adresse IP à un Profil==== | + | |
| - | + | ||
| - | Pour ajouter une deuxième adresse IP à un profil sous Debian 11, il convient d' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | </ | + | |
| - | + | ||
| - | Rechargez la configuration du profil : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | Connection successfully activated (D-Bus active path: / | + | |
| - | </ | + | |
| - | + | ||
| - | Saisissez ensuite la commande suivante : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | connection.id: | + | |
| - | connection.uuid: | + | |
| - | connection.stable-id: | + | |
| - | connection.type: | + | |
| - | connection.interface-name: | + | |
| - | connection.autoconnect: | + | |
| - | connection.autoconnect-priority: | + | |
| - | connection.autoconnect-retries: | + | |
| - | connection.multi-connect: | + | |
| - | connection.auth-retries: | + | |
| - | connection.timestamp: | + | |
| - | connection.read-only: | + | |
| - | connection.permissions: | + | |
| - | connection.zone: | + | |
| - | connection.master: | + | |
| - | connection.slave-type: | + | |
| - | connection.autoconnect-slaves: | + | |
| - | connection.secondaries: | + | |
| - | connection.gateway-ping-timeout: | + | |
| - | connection.metered: | + | |
| - | connection.lldp: | + | |
| - | connection.mdns: | + | |
| - | connection.llmnr: | + | |
| - | connection.wait-device-timeout: | + | |
| - | 802-3-ethernet.port: | + | |
| - | 802-3-ethernet.speed: | + | |
| - | 802-3-ethernet.duplex: | + | |
| - | 802-3-ethernet.auto-negotiate: | + | |
| - | 802-3-ethernet.mac-address: | + | |
| - | 802-3-ethernet.cloned-mac-address: | + | |
| - | 802-3-ethernet.generate-mac-address-mask: | + | |
| - | 802-3-ethernet.mac-address-blacklist: | + | |
| - | 802-3-ethernet.mtu: | + | |
| - | 802-3-ethernet.s390-subchannels: | + | |
| - | 802-3-ethernet.s390-nettype: | + | |
| - | 802-3-ethernet.s390-options: | + | |
| - | 802-3-ethernet.wake-on-lan: | + | |
| - | 802-3-ethernet.wake-on-lan-password: | + | |
| - | ipv4.method: | + | |
| - | ipv4.dns: | + | |
| - | ipv4.dns-search: | + | |
| - | ipv4.dns-options: | + | |
| - | ipv4.dns-priority: | + | |
| - | ipv4.addresses: | + | |
| - | ipv4.gateway: | + | |
| - | ipv4.routes: | + | |
| - | ipv4.route-metric: | + | |
| - | ipv4.route-table: | + | |
| - | ipv4.routing-rules: | + | |
| - | ipv4.ignore-auto-routes: | + | |
| - | ipv4.ignore-auto-dns: | + | |
| - | ipv4.dhcp-client-id: | + | |
| - | ipv4.dhcp-iaid: | + | |
| - | ipv4.dhcp-timeout: | + | |
| - | ipv4.dhcp-send-hostname: | + | |
| - | ipv4.dhcp-hostname: | + | |
| - | lines 1-56 | + | |
| - | [Space Bar] | + | |
| - | IP4.ADDRESS[1]: | + | |
| - | IP4.ADDRESS[2]: | + | |
| - | IP4.GATEWAY: | + | |
| - | IP4.ROUTE[1]: | + | |
| - | IP4.ROUTE[2]: | + | |
| - | IP4.ROUTE[3]: | + | |
| - | IP4.DNS[1]: | + | |
| - | lines 57-112 | + | |
| - | [q] | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** : Notez l' | + | |
| - | </ | + | |
| - | + | ||
| - | Consultez maintenant | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | [connection] | + | |
| - | id=ip_fixe | + | |
| - | uuid=c52994fc-0918-4108-81d2-d86dade62c7a | + | |
| - | type=ethernet | + | |
| - | interface-name=ens18 | + | |
| - | permissions= | + | |
| - | timestamp=1651499263 | + | |
| - | + | ||
| - | [ethernet] | + | |
| - | mac-address-blacklist= | + | |
| - | + | ||
| - | [ipv4] | + | |
| - | address1=10.0.2.41/ | + | |
| - | address2=192.168.1.2/ | + | |
| - | dns=8.8.8.8; | + | |
| - | dns-search= | + | |
| - | method=manual | + | |
| - | + | ||
| - | [ipv6] | + | |
| - | addr-gen-mode=stable-privacy | + | |
| - | dns-search= | + | |
| - | method=auto | + | |
| - | + | ||
| - | [proxy] | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** : Notez l' | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.4 - La Commande hostname==== | + | |
| - | + | ||
| - | La procédure de la modification du hostname est simplifiée et sa prise en compte est immédiate : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | debian11 | + | |
| - | + | ||
| - | root@debian11: | + | |
| - | + | ||
| - | root@debian11: | + | |
| - | debian11.ittraining.loc | + | |
| - | + | ||
| - | root@debian11: | + | |
| - | debian11.ittraining.loc | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.5 - La Commande ip==== | + | |
| - | + | ||
| - | Sous Debian 11 la commande **ip** est préférée par rapport à la commande ifconfig : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | 1: lo: < | + | |
| - | link/ | + | |
| - | inet 127.0.0.1/8 scope host lo | + | |
| - | | + | |
| - | inet6 ::1/128 scope host | + | |
| - | | + | |
| - | 2: ens18: < | + | |
| - | link/ether f6: | + | |
| - | altname enp0s18 | + | |
| - | inet 10.0.2.41/ | + | |
| - | | + | |
| - | inet 192.168.1.2/ | + | |
| - | | + | |
| - | inet6 fe80:: | + | |
| - | | + | |
| - | </ | + | |
| - | + | ||
| - | En cas de besoin, pour extraire les adresses IP de cette sortie, utilisez les commandes suivantes : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | 10.0.2.41 | + | |
| - | 192.168.1.2 | + | |
| - | </ | + | |
| - | + | ||
| - | Les options de cette commande sont : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | Usage: ip [ OPTIONS ] OBJECT { COMMAND | help } | + | |
| - | ip [ -force ] -batch filename | + | |
| - | where OBJECT := { link | address | addrlabel | route | rule | neigh | ntable | | + | |
| - | | + | |
| - | netns | l2tp | fou | macsec | tcp_metrics | token | netconf | ila | | + | |
| - | vrf | sr | nexthop | mptcp } | + | |
| - | | + | |
| - | -h[uman-readable] | -iec | -j[son] | -p[retty] | | + | |
| - | -f[amily] { inet | inet6 | mpls | bridge | link } | | + | |
| - | -4 | -6 | -I | -D | -M | -B | -0 | | + | |
| - | -l[oops] { maximum-addr-flush-attempts } | -br[ief] | | + | |
| - | -o[neline] | -t[imestamp] | -ts[hort] | -b[atch] [filename] | | + | |
| - | -rc[vbuf] [size] | -n[etns] name | -N[umeric] | -a[ll] | | + | |
| - | -c[olor]} | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.6 - Activer/ | + | |
| - | + | ||
| - | Deux commandes existent pour désactiver et activer manuellement une interface réseau : | + | |
| - | + | ||
| - | < | + | |
| - | # nmcli device disconnect enp0s3 | + | |
| - | # nmcli device connect enp0s3 | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** : Veuillez ne **PAS** exécuter ces deux commandes. | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.7 - Routage Statique==== | + | |
| - | + | ||
| - | ===La commande ip=== | + | |
| - | + | ||
| - | Sous Debian 11, pour supprimer la route vers le réseau 192.168.1.0 il convient d' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | default via 10.0.2.1 dev ens18 proto static metric 100 | + | |
| - | 10.0.2.0/24 dev ens18 proto kernel scope link src 10.0.2.41 metric 100 | + | |
| - | 192.168.1.0/ | + | |
| - | + | ||
| - | root@debian11: | + | |
| - | + | ||
| - | root@debian11: | + | |
| - | default via 10.0.2.1 dev ens18 proto static metric 100 | + | |
| - | 10.0.2.0/24 dev ens18 proto kernel scope link src 10.0.2.41 metric 100 | + | |
| - | </ | + | |
| - | + | ||
| - | Pour ajouter la route vers le réseau 192.168.1.0 : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | + | ||
| - | root@debian11: | + | |
| - | default via 10.0.2.1 dev ens18 proto static metric 100 | + | |
| - | 10.0.2.0/24 dev ens18 proto kernel scope link src 10.0.2.41 metric 100 | + | |
| - | 192.168.1.0/ | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** - La commande utilisée pour ajouter une passerelle par défaut prend la forme suivante **ip route add default via //adresse ip//**. | + | |
| - | </ | + | |
| - | + | ||
| - | ===Désactiver/ | + | |
| - | + | ||
| - | Pour désactiver le routage sur le serveur, il convient de désactiver la retransmission des paquets. | + | |
| - | + | ||
| - | Pour IPv4 : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | 1 | + | |
| - | root@debian11: | + | |
| - | root@debian11: | + | |
| - | 0 | + | |
| - | </ | + | |
| - | + | ||
| - | Pour activer le routage sur le serveur, il convient d' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | root@debian11: | + | |
| - | 1 | + | |
| - | </ | + | |
| - | + | ||
| - | Pour IPv6 : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | 1 | + | |
| - | root@debian11: | + | |
| - | root@debian11: | + | |
| - | 0 | + | |
| - | </ | + | |
| - | + | ||
| - | Pour activer le routage sur le serveur, il convient d' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | root@debian11: | + | |
| - | 1 | + | |
| - | </ | + | |
| - | + | ||
| - | =====LAB #2 - Diagnostique du Réseau===== | + | |
| - | + | ||
| - | ====2.1 - ping==== | + | |
| - | + | ||
| - | Pour tester l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | PING 10.0.2.1 (10.0.2.1) 56(84) bytes of data. | + | |
| - | 64 bytes from 10.0.2.1: icmp_seq=1 ttl=64 time=0.184 ms | + | |
| - | 64 bytes from 10.0.2.1: icmp_seq=2 ttl=64 time=0.167 ms | + | |
| - | 64 bytes from 10.0.2.1: icmp_seq=3 ttl=64 time=0.168 ms | + | |
| - | ^C | + | |
| - | --- 10.0.2.1 ping statistics --- | + | |
| - | 3 packets transmitted, | + | |
| - | rtt min/ | + | |
| - | </ | + | |
| - | + | ||
| - | Les options de cette commande sont : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | ping: invalid option -- ' | + | |
| - | + | ||
| - | Usage | + | |
| - | ping [options] < | + | |
| - | + | ||
| - | Options: | + | |
| - | < | + | |
| - | -a use audible ping | + | |
| - | -A use adaptive ping | + | |
| - | -B | + | |
| - | -c < | + | |
| - | -D print timestamps | + | |
| - | -d use SO_DEBUG socket option | + | |
| - | -f flood ping | + | |
| - | -h print help and exit | + | |
| - | -I < | + | |
| - | -i < | + | |
| - | -L | + | |
| - | -l < | + | |
| - | -m < | + | |
| - | -M <pmtud opt> | + | |
| - | -n no dns name resolution | + | |
| - | -O | + | |
| - | -p < | + | |
| - | -q quiet output | + | |
| - | -Q < | + | |
| - | -s < | + | |
| - | -S < | + | |
| - | -t < | + | |
| - | -U print user-to-user latency | + | |
| - | -v | + | |
| - | -V print version and exit | + | |
| - | -w < | + | |
| - | -W < | + | |
| - | + | ||
| - | IPv4 options: | + | |
| - | -4 use IPv4 | + | |
| - | -b allow pinging broadcast | + | |
| - | -R | + | |
| - | -T < | + | |
| - | + | ||
| - | IPv6 options: | + | |
| - | -6 use IPv6 | + | |
| - | -F < | + | |
| - | -N < | + | |
| - | + | ||
| - | For more details see ping(8). | + | |
| - | </ | + | |
| - | + | ||
| - | ====2.2 - netstat -i==== | + | |
| - | + | ||
| - | Pour visualiser les statistiques réseaux, vous disposez de la commande **netstat** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | -bash: netstat: command not found | + | |
| - | + | ||
| - | root@debian11: | + | |
| - | + | ||
| - | root@debian11: | + | |
| - | Kernel Interface table | + | |
| - | Iface MTU RX-OK RX-ERR RX-DRP RX-OVR | + | |
| - | ens18 | + | |
| - | lo | + | |
| - | </ | + | |
| - | + | ||
| - | Les options de cette commande sont : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | usage: netstat [-vWeenNcCF] [< | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | -r, --route | + | |
| - | -i, --interfaces | + | |
| - | -g, --groups | + | |
| - | -s, --statistics | + | |
| - | -M, --masquerade | + | |
| - | + | ||
| - | -v, --verbose | + | |
| - | -W, --wide | + | |
| - | -n, --numeric | + | |
| - | --numeric-hosts | + | |
| - | --numeric-ports | + | |
| - | --numeric-users | + | |
| - | -N, --symbolic | + | |
| - | -e, --extend | + | |
| - | -p, --programs | + | |
| - | -o, --timers | + | |
| - | -c, --continuous | + | |
| - | + | ||
| - | -l, --listening | + | |
| - | -a, --all display all sockets (default: connected) | + | |
| - | -F, --fib display Forwarding Information Base (default) | + | |
| - | -C, --cache | + | |
| - | -Z, --context | + | |
| - | + | ||
| - | < | + | |
| - | | + | |
| - | < | + | |
| - | List of possible address families (which support routing): | + | |
| - | inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25) | + | |
| - | netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP) | + | |
| - | x25 (CCITT X.25) | + | |
| - | </ | + | |
| - | + | ||
| - | ====2.3 - traceroute==== | + | |
| - | + | ||
| - | La commande ping est à la base de la commande **traceroute**. Cette commande sert à découvrir la route empruntée pour accéder à un site donné : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | traceroute to www.free.fr (212.27.48.10), | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | 10 10.200.2.65 (10.200.2.65) | + | |
| - | 11 * * * | + | |
| - | 12 194.149.166.61 (194.149.166.61) | + | |
| - | 13 * * * | + | |
| - | 14 * * * | + | |
| - | 15 * * * | + | |
| - | 16 * * * | + | |
| - | 17 * * * | + | |
| - | 18 * * * | + | |
| - | 19 * * * | + | |
| - | 20 * * * | + | |
| - | 21 * * * | + | |
| - | 22 * * * | + | |
| - | 23 * * * | + | |
| - | 24 * * * | + | |
| - | 25 * * * | + | |
| - | 26 * * * | + | |
| - | 27 * * * | + | |
| - | 28 * * * | + | |
| - | 29 * * * | + | |
| - | 30 * * * | + | |
| - | </ | + | |
| - | + | ||
| - | Les options de cette commande sont : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | Usage: | + | |
| - | traceroute [ -46dFITnreAUDV ] [ -f first_ttl ] [ -g gate,... ] [ -i device ] [ -m max_ttl ] [ -N squeries ] [ -p port ] [ -t tos ] [ -l flow_label ] [ -w MAX, | + | |
| - | Options: | + | |
| - | -4 Use IPv4 | + | |
| - | -6 Use IPv6 | + | |
| - | -d --debug | + | |
| - | -F --dont-fragment | + | |
| - | -f first_ttl | + | |
| - | Start from the first_ttl hop (instead from 1) | + | |
| - | -g gate, | + | |
| - | Route packets through the specified gateway | + | |
| - | (maximum 8 for IPv4 and 127 for IPv6) | + | |
| - | -I --icmp | + | |
| - | -T --tcp Use TCP SYN for tracerouting (default port is 80) | + | |
| - | -i device | + | |
| - | Specify a network interface to operate with | + | |
| - | -m max_ttl | + | |
| - | Set the max number of hops (max TTL to be | + | |
| - | reached). Default is 30 | + | |
| - | -N squeries | + | |
| - | Set the number of probes to be tried | + | |
| - | simultaneously (default is 16) | + | |
| - | -n Do not resolve IP addresses to their domain names | + | |
| - | -p port --port=port | + | |
| - | initial udp port value for " | + | |
| - | (incremented by each probe, default is 33434), or | + | |
| - | initial seq for " | + | |
| - | default from 1), or some constant destination | + | |
| - | port for other methods (with default of 80 for | + | |
| - | " | + | |
| - | -t tos --tos=tos | + | |
| - | traffic class) value for outgoing packets | + | |
| - | -l flow_label | + | |
| - | Use specified flow_label for IPv6 packets | + | |
| - | -w MAX, | + | |
| - | Wait for a probe no more than HERE (default 3) | + | |
| - | times longer than a response from the same hop, | + | |
| - | or no more than NEAR (default 10) times than some | + | |
| - | next hop, or MAX (default 5.0) seconds (float | + | |
| - | point values allowed too) | + | |
| - | -q nqueries | + | |
| - | Set the number of probes per each hop. Default is | + | |
| - | 3 | + | |
| - | -r Bypass the normal routing and send directly to a | + | |
| - | host on an attached network | + | |
| - | -s src_addr | + | |
| - | Use source src_addr for outgoing packets | + | |
| - | -z sendwait | + | |
| - | Minimal time interval between probes (default 0). | + | |
| - | If the value is more than 10, then it specifies a | + | |
| - | number in milliseconds, | + | |
| - | seconds (float point values allowed too) | + | |
| - | -e --extensions | + | |
| - | -A --as-path-lookups | + | |
| - | print results directly after the corresponding | + | |
| - | addresses | + | |
| - | -M name --module=name | + | |
| - | for traceroute operations. Most methods have | + | |
| - | their shortcuts (`-I' means `-M icmp' etc.) | + | |
| - | -O OPTS, | + | |
| - | Use module-specific option OPTS for the | + | |
| - | traceroute module. Several OPTS allowed, | + | |
| - | separated by comma. If OPTS is " | + | |
| - | about available options | + | |
| - | --sport=num | + | |
| - | `-N 1' | + | |
| - | --fwmark=num | + | |
| - | -U --udp Use UDP to particular port for tracerouting | + | |
| - | (instead of increasing the port per each probe), | + | |
| - | default port is 53 | + | |
| - | -UL Use UDPLITE for tracerouting (default dest port | + | |
| - | is 53) | + | |
| - | -D --dccp | + | |
| - | is 33434) | + | |
| - | -P prot --protocol=prot | + | |
| - | --mtu | + | |
| - | `-F -N 1' | + | |
| - | --back | + | |
| - | print if it differs | + | |
| - | -V --version | + | |
| - | --help | + | |
| - | + | ||
| - | Arguments: | + | |
| - | + | + | |
| - | packetlen | + | |
| - | header plus 40). Can be ignored or increased to a minimal | + | |
| - | allowed value | + | |
| - | </ | + | |
| - | + | ||
| - | =====LAB #3 - Connexions à Distance===== | + | |
| - | + | ||
| - | ==== 3.1 - Telnet ==== | + | |
| - | + | ||
| - | La commande **telnet** est utilisée pour établir une connexion à distance avec un serveur telnet : | + | |
| - | + | ||
| - | < | + | |
| - | # telnet numero_ip | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** - Le service telnet revient à une redirection des canaux standards d' | + | |
| - | </ | + | |
| - | + | ||
| - | Les options de cette commande sont : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | / | + | |
| - | root@debian11: | + | |
| - | telnet: invalid option -- ' | + | |
| - | Usage: telnet [-4] [-6] [-8] [-E] [-L] [-a] [-d] [-e char] [-l user] | + | |
| - | [-n tracefile] [ -b addr ] [-r] [host-name [port]] | + | |
| - | </ | + | |
| - | + | ||
| - | ==== 3.2 - wget ==== | + | |
| - | + | ||
| - | La commande **wget** est utilisée pour récupérer un fichier via http, https ou ftp : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | --2022-05-03 10: | + | |
| - | Resolving www.dropbox.com (www.dropbox.com)... 162.125.67.18, | + | |
| - | Connecting to www.dropbox.com (www.dropbox.com)|162.125.67.18|: | + | |
| - | HTTP request sent, awaiting response... 301 Moved Permanently | + | |
| - | Location: / | + | |
| - | --2022-05-03 10: | + | |
| - | Reusing existing connection to www.dropbox.com: | + | |
| - | HTTP request sent, awaiting response... 302 Found | + | |
| - | Location: https:// | + | |
| - | --2022-05-03 10: | + | |
| - | Resolving uc64dcd84ee4be2a0c2f111bd2ab.dl.dropboxusercontent.com (uc64dcd84ee4be2a0c2f111bd2ab.dl.dropboxusercontent.com)... 162.125.67.15, | + | |
| - | Connecting to uc64dcd84ee4be2a0c2f111bd2ab.dl.dropboxusercontent.com (uc64dcd84ee4be2a0c2f111bd2ab.dl.dropboxusercontent.com)|162.125.67.15|: | + | |
| - | HTTP request sent, awaiting response... 200 OK | + | |
| - | Length: 46 [text/ | + | |
| - | Saving to: ‘wget_file.txt’ | + | |
| - | + | ||
| - | wget_file.txt | + | |
| - | + | ||
| - | 2022-05-03 10:07:51 (26.8 MB/s) - ‘wget_file.txt’ saved [46/46] | + | |
| - | + | ||
| - | root@debian11: | + | |
| - | This is a file retrieved by the wget command. | + | |
| - | </ | + | |
| - | + | ||
| - | Les options de cette commande sont : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | GNU Wget 1.21, a non-interactive network retriever. | + | |
| - | Usage: wget [OPTION]... [URL]... | + | |
| - | + | ||
| - | Mandatory arguments to long options are mandatory for short options too. | + | |
| - | + | ||
| - | Startup: | + | |
| - | -V, --version | + | |
| - | -h, --help | + | |
| - | -b, --background | + | |
| - | -e, --execute=COMMAND | + | |
| - | + | ||
| - | Logging and input file: | + | |
| - | -o, --output-file=FILE | + | |
| - | -a, --append-output=FILE | + | |
| - | -d, --debug | + | |
| - | -q, --quiet | + | |
| - | -v, --verbose | + | |
| - | -nv, --no-verbose | + | |
| - | | + | |
| - | -i, --input-file=FILE | + | |
| - | -F, --force-html | + | |
| - | -B, --base=URL | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | Download: | + | |
| - | -t, --tries=NUMBER | + | |
| - | | + | |
| - | | + | |
| - | -O, --output-document=FILE | + | |
| - | -nc, --no-clobber | + | |
| - | | + | |
| - | | + | |
| - | -c, --continue | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -N, --timestamping | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | the one on the server | + | |
| - | -S, --server-response | + | |
| - | | + | |
| - | -T, --timeout=SECONDS | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -w, --wait=SECONDS | + | |
| - | | + | |
| - | --More-- | + | |
| - | [q] | + | |
| - | </ | + | |
| - | + | ||
| - | ==== 3.3 - ftp ==== | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** - Si la commande **ftp** n'est pas installée sous Debian 11, installez-le à l'aide de la commande **apt install ftp** en tant que root. | + | |
| - | </ | + | |
| - | + | ||
| - | La commande **ftp** est utilisée pour le transfert de fichiers. Une fois connecté, il convient d' | + | |
| - | + | ||
| - | < | + | |
| - | ftp> help | + | |
| - | Commands may be abbreviated. | + | |
| - | + | ||
| - | ! | + | |
| - | $ | + | |
| - | account | + | |
| - | append | + | |
| - | ascii | + | |
| - | bell glob mode quote | + | |
| - | binary | + | |
| - | bye | + | |
| - | case idle newer | + | |
| - | cd image | + | |
| - | cdup ipany | + | |
| - | chmod | + | |
| - | close | + | |
| - | cr lcd | + | |
| - | delete | + | |
| - | debug | + | |
| - | ftp> | + | |
| - | </ | + | |
| - | + | ||
| - | Le caractère **!** permet d' | + | |
| - | + | ||
| - | < | + | |
| - | ftp> !pwd | + | |
| - | /root | + | |
| - | </ | + | |
| - | + | ||
| - | Pour transférer un fichier vers le serveur, il convient d' | + | |
| - | + | ||
| - | < | + | |
| - | ftp> put nom_fichier_local nom_fichier_distant | + | |
| - | </ | + | |
| - | + | ||
| - | Vous pouvez également transférer plusieurs fichiers à la fois grâce à la commande **mput**. Dans ce cas précis, il convient de saisir la commande suivante: | + | |
| - | + | ||
| - | < | + | |
| - | ftp> mput nom*.* | + | |
| - | </ | + | |
| - | + | ||
| - | Pour transférer un fichier du serveur, il convient d' | + | |
| - | + | ||
| - | < | + | |
| - | ftp> get nom_fichier | + | |
| - | </ | + | |
| - | + | ||
| - | Vous pouvez également transférer plusieurs fichiers à la fois grâce à la commande **mget** ( voir la commande **mput** ci-dessus ). | + | |
| - | + | ||
| - | Pour supprimer un fichier sur le serveur, il convient d' | + | |
| - | + | ||
| - | < | + | |
| - | ftp> del nom_fichier | + | |
| - | </ | + | |
| - | + | ||
| - | Pour fermer la session, il convient d' | + | |
| - | + | ||
| - | < | + | |
| - | ftp> quit | + | |
| - | root@debian11: | + | |
| - | </ | + | |
| - | + | ||
| - | ====3.4 - SSH==== | + | |
| - | + | ||
| - | ===Présentation=== | + | |
| - | + | ||
| - | La commande **[[wpfr> | + | |
| - | + | ||
| - | * Le **serveur SSH** | + | |
| - | * le démon sshd, qui s' | + | |
| - | * Le **client SSH** | + | |
| - | * ssh ou scp, qui assure la connexion et le dialogue avec le serveur, | + | |
| - | * La **session** qui représente la connexion courante et qui commence juste après l' | + | |
| - | * Les **clefs** | + | |
| - | * **Couple de clef utilisateur asymétriques** et persistantes qui assurent l' | + | |
| - | * **Clef hôte asymétrique et persistante** garantissant l' | + | |
| - | * **Clef serveur asymétrique et temporaire** utilisée par le protocole SSH1 qui sert au chiffrement de la clé de session, | + | |
| - | * **Clef de session symétrique qui est générée aléatoirement** et qui permet le chiiffrement de la communication entre le client et le serveur. Elle est détruite en fin de session. SSH-1 utilise une seule clef tandis que SSH-2 utilise une clef par direction de la communication, | + | |
| - | * La **base de données des hôtes connus** qui stocke les clés des connexions précédentes. | + | |
| - | + | ||
| - | SSH fonctionne de la manière suivante pour la la mise en place d'un canal sécurisé: | + | |
| - | + | ||
| - | * Le client contacte le serveur sur son port 22, | + | |
| - | * Les client et le serveur échangent leur version de SSH. En cas de non-compatibilité de versions, l'un des deux met fin au processus, | + | |
| - | * Le serveur SSH s' | + | |
| - | * Sa clé hôte, | + | |
| - | * Sa clé serveur, | + | |
| - | * Une séquence aléatoire de huit octets à inclure dans les futures réponses du client, | + | |
| - | * Une liste de méthodes de chiffrage, compression et authentification, | + | |
| - | * Le client et le serveur produisent un identifiant identique, un haché MD5 long de 128 bits contenant la clé hôte, la clé serveur et la séquence aléatoire, | + | |
| - | * Le client génère sa clé de session symétrique et la chiffre deux fois de suite, une fois avec la clé hôte du serveur et la deuxième fois avec la clé serveur. Le client envoie cette clé au serveur accompagnée de la séquence aléatoire et un choix d' | + | |
| - | * Le serveur déchiffre la clé de session, | + | |
| - | * Le client et le serveur mettent en place le canal sécurisé. | + | |
| - | + | ||
| - | ==SSH-1== | + | |
| - | + | ||
| - | SSH-1 utilise une paire de clefs de type RSA1. Il assure l' | + | |
| - | + | ||
| - | Afin de s' | + | |
| - | + | ||
| - | * **Kerberos**, | + | |
| - | * **Rhosts**, | + | |
| - | * **%%RhostsRSA%%**, | + | |
| - | * Par **clef asymétrique**, | + | |
| - | * **TIS**, | + | |
| - | * Par **mot de passe**. | + | |
| - | + | ||
| - | ==SSH-2== | + | |
| - | + | ||
| - | SSH-2 utilise **DSA** ou **RSA**. Il assure l' | + | |
| - | + | ||
| - | * **SSH-TRANS** – Transport Layer Protocol, | + | |
| - | * **SSH-AUTH** – Authentification Protocol, | + | |
| - | * **SSH-CONN** – Connection Protocol. | + | |
| - | + | ||
| - | SSH-2 diffère de SSH-1 essentiellement dans la phase authentification. | + | |
| - | + | ||
| - | Trois méthodes d' | + | |
| - | + | ||
| - | * Par **clef asymétrique**, | + | |
| - | * Identique à SSH-1 sauf avec l' | + | |
| - | * **%%RhostsRSA%%**, | + | |
| - | * Par **mot de passe**. | + | |
| - | + | ||
| - | Les options de cette commande sont : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | unknown option -- - | + | |
| - | usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface] | + | |
| - | [-b bind_address] [-c cipher_spec] [-D [bind_address: | + | |
| - | [-E log_file] [-e escape_char] [-F configfile] [-I pkcs11] | + | |
| - | [-i identity_file] [-J [user@]host[: | + | |
| - | [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port] | + | |
| - | [-Q query_option] [-R address] [-S ctl_path] [-W host: | + | |
| - | [-w local_tun[: | + | |
| - | </code> | + | |
| - | + | ||
| - | ===Authentification par mot de passe=== | + | |
| - | + | ||
| - | L' | + | |
| - | + | ||
| - | Avantage: | + | |
| - | | + | |
| - | + | ||
| - | Inconvénients: | + | |
| - | | + | |
| - | * Moins sécurisé qu'un système par clef asymétrique. | + | |
| - | + | ||
| - | ===Authentification par clef asymétrique=== | + | |
| - | + | ||
| - | * Le **client** envoie au serveur une requête d' | + | |
| - | | + | |
| - | * Dans le cas où une correspondance n'est pas trouvée, le serveur met fin à la communication, | + | |
| - | * Dans le cas contraire le serveur génère une chaîne aléatoire de 256 bits appelée un **challenge** et la chiffre avec la **clé publique du client**, | + | |
| - | * Le **client** reçoit le challenge et le décrypte avec la partie privée de sa clé. Il combine le challenge avec l' | + | |
| - | * Le **serveur** génère le même haché et le compare avec celui reçu du client. Si les deux hachés sont identiques, l' | + | |
| - | + | ||
| - | ===Configuration du Serveur=== | + | |
| - | + | ||
| - | La configuration du serveur s' | + | |
| < | < | ||
| + | root@debian11: | ||
| root@debian11: | root@debian11: | ||
| # | # | ||
| Ligne 1353: | Ligne 425: | ||
| # | # | ||
| - | # | + | ... |
| - | + | ||
| - | # Expect | + | |
| - | # | + | |
| - | + | ||
| - | # | + | |
| - | + | ||
| - | # | + | |
| - | # | + | |
| - | + | ||
| - | # For this to work you will also need host keys in / | + | |
| - | # | + | |
| - | # Change to yes if you don't trust ~/ | + | |
| - | # HostbasedAuthentication | + | |
| - | # | + | |
| - | # Don't read the user's ~/.rhosts and ~/.shosts files | + | |
| - | # | + | |
| - | + | ||
| - | # To disable tunneled clear text passwords, change to no here! | + | |
| - | # | + | |
| - | # | + | |
| - | + | ||
| - | # Change to yes to enable challenge-response passwords (beware issues with | + | |
| - | # some PAM modules and threads) | + | |
| - | ChallengeResponseAuthentication no | + | |
| - | + | ||
| - | # Kerberos options | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | + | ||
| - | # GSSAPI options | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | + | ||
| - | # Set this to ' | + | |
| - | # and session processing. If this is enabled, PAM authentication will | + | |
| - | # be allowed through the ChallengeResponseAuthentication and | + | |
| - | # PasswordAuthentication. | + | |
| - | # PAM authentication via ChallengeResponseAuthentication may bypass | + | |
| - | # the setting of " | + | |
| - | # If you just want the PAM account and session checks to run without | + | |
| - | # PAM authentication, | + | |
| - | # and ChallengeResponseAuthentication to ' | + | |
| - | UsePAM yes | + | |
| - | + | ||
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | X11Forwarding yes | + | |
| - | # | + | |
| - | # | + | |
| - | #PermitTTY yes | + | |
| - | PrintMotd no | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | #UseDNS no | + | |
| - | #PidFile / | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | + | ||
| - | # no default banner path | + | |
| - | #Banner none | + | |
| - | + | ||
| - | # Allow client to pass locale environment variables | + | |
| - | AcceptEnv LANG LC_* | + | |
| - | + | ||
| - | # override default of no subsystems | + | |
| - | Subsystem | + | |
| - | + | ||
| - | # Example of overriding settings on a per-user basis | + | |
| - | #Match User anoncvs | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | </ | + | |
| - | + | ||
| - | Pour ôter les lignes de commentaires dans ce fichier, utilisez la commande suivante : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | root@debian11:/ | + | |
| - | Include / | + | |
| - | PermitRootLogin yes | + | |
| - | ChallengeResponseAuthentication no | + | |
| - | UsePAM yes | + | |
| - | X11Forwarding yes | + | |
| - | PrintMotd no | + | |
| - | AcceptEnv LANG LC_* | + | |
| - | Subsystem | + | |
| - | </ | + | |
| - | + | ||
| - | Pour sécuriser le serveur ssh, ajoutez ou modifiez les directives suivantes : | + | |
| - | + | ||
| - | < | + | |
| - | AllowGroups adm | + | |
| - | Banner / | + | |
| - | HostbasedAuthentication no | + | |
| - | IgnoreRhosts yes | + | |
| - | LoginGraceTime 60 | + | |
| - | LogLevel INFO | + | |
| - | PermitEmptyPasswords no | + | |
| - | PermitRootLogin no | + | |
| - | PrintLastLog yes | + | |
| - | Protocol 2 | + | |
| - | StrictModes yes | + | |
| - | X11Forwarding no | + | |
| - | </ | + | |
| - | + | ||
| - | Votre fichier ressemblera à celui-ci : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11:/ | + | |
| - | root@debian11:/ | + | |
| - | AllowGroups adm | + | |
| - | Banner / | + | |
| - | HostbasedAuthentication no | + | |
| - | IgnoreRhosts yes | + | |
| - | LoginGraceTime 60 | + | |
| - | LogLevel INFO | + | |
| - | PermitEmptyPasswords no | + | |
| - | PermitRootLogin no | + | |
| - | PrintLastLog yes | + | |
| - | Protocol 2 | + | |
| - | StrictModes yes | + | |
| - | X11Forwarding no | + | |
| - | Include / | + | |
| - | ChallengeResponseAuthentication no | + | |
| - | UsePAM yes | + | |
| - | PrintMotd no | + | |
| - | AcceptEnv LANG LC_* | + | |
| - | Subsystem | + | |
| - | </ | + | |
| - | + | ||
| - | Renommez le fichier **/ | + | |
| - | + | ||
| - | < | + | |
| - | [root@centos11 tmp]# cp / | + | |
| - | </ | + | |
| - | + | ||
| - | Copiez le fichier **/ | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11:/ | + | |
| </ | </ | ||
| - | Redémarrez | + | Re-démarrez |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | root@debian11: | + | root@debian11: |
| ● ssh.service - OpenBSD Secure Shell server | ● ssh.service - OpenBSD Secure Shell server | ||
| | | ||
| - | | + | |
| Docs: man:sshd(8) | Docs: man:sshd(8) | ||
| | | ||
| - | Process: | + | Process: |
| - | Main PID: 4888 (sshd) | + | Main PID: 2794 (sshd) |
| - | Tasks: 1 (limit: | + | Tasks: 1 (limit: |
| | | ||
| - | CPU: 24ms | + | CPU: 25ms |
| | | ||
| - | | + | |
| - | May 03 11:01:24 debian11.ittraining.loc sshd[4888]: Server listening on 0.0.0.0 port > | + | May 01 15:35:50 debian11 |
| - | May 03 11:01:24 debian11.ittraining.loc systemd[1]: Stopping OpenBSD Secure Shell ser> | + | May 01 15:35:50 debian11 |
| - | May 03 11: | + | May 01 15:35:50 debian11 sshd[2794]: Server listening on :: port 22. |
| - | May 03 11:01:24 debian11.ittraining.loc systemd[1]: ssh.service: | + | May 01 15:35:50 debian11 systemd[1]: |
| - | May 03 11: | + | |
| - | May 03 11:01:24 debian11.ittraining.loc systemd[1]: Starting OpenBSD Secure Shell ser> | + | |
| - | May 03 11:01:24 debian11.ittraining.loc systemd[1]: Started OpenBSD Secure Shell serv> | + | |
| - | lines 1-20/20 (END) | + | |
| - | [q] | + | |
| </ | </ | ||
| - | Mettez l' | + | <WRAP center round todo> |
| + | **A Faire** - Déconnectez-vous en ssh. Connectez-vous directement en tant que root en ssh. | ||
| + | </ | ||
| - | < | + | Montez **/dev/sdb1** sur /mnt : |
| - | root@debian11: | + | |
| - | trainee : trainee cdrom floppy audio dip src video plugdev netdev lpadmin scanner | + | |
| - | root@debian11: | + | |
| - | root@debian11: | + | |
| - | trainee | + | |
| - | </ | + | |
| - | + | ||
| - | Pour générer les clefs du serveur, saisissez la commande suivante en tant que **root**. Notez que la passphrase doit être **vide**. | + | |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | Generating public/ | + | |
| - | Enter file in which to save the key (/ | + | |
| - | Enter passphrase (empty for no passphrase): | + | |
| - | Enter same passphrase again: | + | |
| - | Your identification has been saved in / | + | |
| - | Your public key has been saved in / | + | |
| - | The key fingerprint is: | + | |
| - | SHA256: | + | |
| - | The key's randomart image is: | + | |
| - | +---[DSA 1024]----+ | + | |
| - | | | + | |
| - | | | + | |
| - | | ..=..o . o.| | + | |
| - | | o+ =. . o..| | + | |
| - | | | + | |
| - | | ==+=o . | | + | |
| - | | o *==o.. . | | + | |
| - | | . ooo=o. o | | + | |
| - | | .o +o... | | + | |
| - | +----[SHA256]-----+ | + | |
| - | root@debian11:/ | + | |
| - | Generating public/ | + | |
| - | Enter file in which to save the key (/ | + | |
| - | / | + | |
| - | Overwrite (y/n)? y | + | |
| - | Enter passphrase (empty for no passphrase): | + | |
| - | Enter same passphrase again: | + | |
| - | Your identification has been saved in / | + | |
| - | Your public key has been saved in / | + | |
| - | The key fingerprint is: | + | |
| - | SHA256: | + | |
| - | The key's randomart image is: | + | |
| - | +---[RSA 3072]----+ | + | |
| - | | =+=+++oo | + | |
| - | | . *o+.o. . | | + | |
| - | | . + = o. ..| | + | |
| - | | o + *.o...| | + | |
| - | | S * =..+o| | + | |
| - | | . * + .+.o| | + | |
| - | | . * + o E | | + | |
| - | | = o o | | + | |
| - | | ... | | + | |
| - | +----[SHA256]-----+ | + | |
| - | root@debian11:/ | + | |
| - | Generating public/ | + | |
| - | Enter file in which to save the key (/ | + | |
| - | / | + | |
| - | Overwrite (y/n)? y | + | |
| - | Enter passphrase (empty for no passphrase): | + | |
| - | Enter same passphrase again: | + | |
| - | Your identification has been saved in / | + | |
| - | Your public key has been saved in / | + | |
| - | The key fingerprint is: | + | |
| - | SHA256: | + | |
| - | The key's randomart image is: | + | |
| - | +---[ECDSA 256]---+ | + | |
| - | | .o..o . ooo. | | + | |
| - | | . o. . o = + ...| | + | |
| - | |. . . + + o.| | + | |
| - | |... | + | |
| - | |.o . S . . | | + | |
| - | |. o + . = .. | | + | |
| - | | | + | |
| - | | = . . *B+.| | + | |
| - | |E... . o** | | + | |
| - | +----[SHA256]-----+ | + | |
| - | root@debian11:/ | + | |
| - | Generating public/ | + | |
| - | Enter file in which to save the key (/ | + | |
| - | / | + | |
| - | Overwrite (y/n)? y | + | |
| - | Enter passphrase (empty for no passphrase): | + | |
| - | Enter same passphrase again: | + | |
| - | Your identification has been saved in / | + | |
| - | Your public key has been saved in /etc/ssh/ssh_host_ed25519_key.pub | + | |
| - | The key fingerprint is: | + | |
| - | SHA256: | + | |
| - | The key's randomart image is: | + | |
| - | +--[ED25519 256]--+ | + | |
| - | |..+. .+*o.+oo | + | |
| - | |++ . . oo.o.+ o .| | + | |
| - | |o. o + o o + | | + | |
| - | | .. .. B . o .| | + | |
| - | | | + | |
| - | | ..oo =.=. | | + | |
| - | | .. o +..+ | | + | |
| - | | . .o . | | + | |
| - | | .o. | | + | |
| - | +----[SHA256]-----+ | + | |
| </ | </ | ||
| - | Les clefs publiques générées possèdent l' | + | Copiez le contenu de /home vers /mnt : |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | moduli | + | |
| - | ssh_config | + | |
| - | ssh_config.d | + | |
| - | sshd_config | + | |
| </ | </ | ||
| - | Re-démarrez ensuite le service sshd : | + | Démontez / |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | root@debian11:/ | + | |
| - | ● ssh.service - OpenBSD Secure Shell server | + | |
| - | | + | |
| - | | + | |
| - | Docs: man: | + | |
| - | | + | |
| - | Process: 4942 ExecStartPre=/ | + | |
| - | Main PID: 4943 (sshd) | + | |
| - | Tasks: 1 (limit: 4632) | + | |
| - | | + | |
| - | CPU: 24ms | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | May 03 11:30:09 debian11.ittraining.loc systemd[1]: Starting OpenBSD Secure Shell ser> | + | |
| - | May 03 11:30:09 debian11.ittraining.loc sshd[4943]: Server listening on 0.0.0.0 port > | + | |
| - | May 03 11:30:09 debian11.ittraining.loc sshd[4943]: Server listening on :: port 22. | + | |
| - | May 03 11:30:09 debian11.ittraining.loc systemd[1]: Started OpenBSD Secure Shell serv> | + | |
| - | lines 1-17/17 (END) | + | |
| - | [q] | + | |
| </ | </ | ||
| - | ===Configuration du Client=== | + | Identifiez l' |
| - | + | ||
| - | Saisissez maintenant les commandes suivantes en tant que **trainee** : | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** - Lors de la génération des clefs, la passphrase doit être **vide**. | + | |
| - | </WRAP> | + | |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | logout | + | lrwxrwxrwx 1 root root 10 May 1 15:31 24f1821e-1d5b-4256-8ee3-c9ee6b382ddc |
| - | trainee@debian11: | + | |
| - | Generating public/private dsa key pair. | + | |
| - | Enter file in which to save the key (/home/trainee/ | + | |
| - | Created directory '/ | + | |
| - | Enter passphrase (empty for no passphrase): | + | |
| - | Enter same passphrase again: | + | |
| - | Your identification has been saved in / | + | |
| - | Your public key has been saved in / | + | |
| - | The key fingerprint is: | + | |
| - | SHA256: | + | |
| - | The key's randomart image is: | + | |
| - | +---[DSA 1024]----+ | + | |
| - | | | + | |
| - | | .+oo.B*o+ | + | |
| - | | . . +=.=+o | | + | |
| - | | . . o o +=.| | + | |
| - | | . . S+ ..o= .| | + | |
| - | | . o. o .+ ..| | + | |
| - | | . . ...| | + | |
| - | | . .E .| | + | |
| - | | | + | |
| - | +----[SHA256]-----+ | + | |
| - | trainee@debian11: | + | |
| - | Generating public/private rsa key pair. | + | |
| - | Enter file in which to save the key (/ | + | |
| - | Enter passphrase (empty for no passphrase): | + | |
| - | Enter same passphrase again: | + | |
| - | Your identification has been saved in / | + | |
| - | Your public key has been saved in / | + | |
| - | The key fingerprint is: | + | |
| - | SHA256: | + | |
| - | The key's randomart image is: | + | |
| - | +---[RSA 3072]----+ | + | |
| - | | | + | |
| - | | = .. = + | | + | |
| - | | | + | |
| - | | E o X . | | + | |
| - | | | + | |
| - | | | + | |
| - | | . | + | |
| - | | + + + .oo*=| | + | |
| - | | =.= .. .XXB| | + | |
| - | +----[SHA256]-----+ | + | |
| - | trainee@debian11:~$ ssh-keygen | + | |
| - | Generating public/ | + | |
| - | Enter file in which to save the key (/ | + | |
| - | Enter passphrase (empty for no passphrase): | + | |
| - | Enter same passphrase again: | + | |
| - | Your identification has been saved in / | + | |
| - | Your public key has been saved in / | + | |
| - | The key fingerprint is: | + | |
| - | SHA256: | + | |
| - | The key's randomart image is: | + | |
| - | +---[ECDSA 256]---+ | + | |
| - | |..o+=o. | | + | |
| - | |. +.. o . | | + | |
| - | | .. = o + | | + | |
| - | | .= + + o | | + | |
| - | | ..B | + | |
| - | | | + | |
| - | | oB.B | | + | |
| - | |o++@ . | | + | |
| - | |X+EoB. | + | |
| - | +----[SHA256]-----+ | + | |
| - | trainee@debian11: | + | |
| - | Generating public/private ed25519 key pair. | + | |
| - | Enter file in which to save the key (/ | + | |
| - | Enter passphrase (empty for no passphrase): | + | |
| - | Enter same passphrase again: | + | |
| - | Your identification has been saved in / | + | |
| - | Your public key has been saved in / | + | |
| - | The key fingerprint is: | + | |
| - | SHA256: | + | |
| - | The key's randomart image is: | + | |
| - | +--[ED25519 256]--+ | + | |
| - | | | | + | |
| - | | . . | | + | |
| - | | o + | | + | |
| - | | .* = | + | |
| - | | | + | |
| - | | . ++oOE+ * * | | + | |
| - | | . +* =.= O .| | + | |
| - | | | + | |
| - | | | + | |
| - | +----[SHA256]-----+ | + | |
| </ | </ | ||
| - | Les clés générées seront placées dans le répertoire | + | Editez |
| < | < | ||
| - | trainee@debian11:~$ ls .ssh | + | root@debian11:~# vi / |
| - | id_dsa | + | root@debian11: |
| - | id_dsa.pub id_ecdsa.pub id_ed25519.pub id_rsa.pub | + | # /etc/fstab: static file system information. |
| + | # | ||
| + | # Use ' | ||
| + | # device; this may be used with UUID= as a more robust way to name devices | ||
| + | # that works even if disks are added and removed. See fstab(5). | ||
| + | # | ||
| + | # systemd generates mount units based on this file, see systemd.mount(5). | ||
| + | # Please run ' | ||
| + | # | ||
| + | # <file system> <mount point> | ||
| + | # / was on /dev/sda1 during installation | ||
| + | UUID=9887a74f-a680-4bde-8f04-db5ae9ea186e / | ||
| + | UUID=24f1821e-1d5b-4256-8ee3-c9ee6b382ddc /home | ||
| + | # swap was on /dev/sda5 during installation | ||
| + | UUID=1f9439f5-4b19-49b1-b292-60c2c674cee9 none swap sw 0 0 | ||
| + | / | ||
| </ | </ | ||
| - | ===Tunnels SSH=== | + | Créez le point de montage |
| - | + | ||
| - | Le protocole SSH peut être utilisé pour sécuriser les protocoles tels telnet, pop3 etc.. En effet, on peut créer un //tunnel// SSH dans lequel passe les communications du protocole non-sécurisé. | + | |
| - | + | ||
| - | La commande pour créer un tunnel ssh prend la forme suivante : | + | |
| - | + | ||
| - | ssh -N -f compte@hôte -Lport-local: | + | |
| - | + | ||
| - | Dans votre cas, vous allez créer un tunnel dans votre propre VM entre le port 15023 et le port 23 : | + | |
| < | < | ||
| - | trainee@debian11:~$ su - | + | root@debian11:~# rm -rf /home |
| - | Password: fenestros | + | root@debian11: |
| - | root@debian11: | + | |
| - | The authenticity of host ' | + | |
| - | ECDSA key fingerprint is SHA256: | + | |
| - | Are you sure you want to continue connecting (yes/ | + | |
| - | Warning: Permanently added ' | + | |
| - | Debian GNU/Linux 11 | + | |
| - | trainee@localhost' | + | |
| </ | </ | ||
| - | Installez maintenant le serveur telnet | + | Montez / |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | </ | + | |
| - | + | ||
| - | Vérifiez que le service **inetd** est démarré : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian11: | + | |
| - | ● inetd.service - Internet superserver | + | |
| - | | + | |
| - | | + | |
| - | Docs: man: | + | |
| - | Main PID: 5110 (inetd) | + | |
| - | Tasks: 1 (limit: 4632) | + | |
| - | | + | |
| - | CPU: 7ms | + | |
| - | | + | |
| - | | + | |
| - | May 03 11: | + | root@debian11:~# mount |
| - | May 03 11:55:27 debian11.ittraining.loc | + | sysfs on /sys type sysfs (rw, |
| + | proc on /proc type proc (rw, | ||
| + | udev on /dev type devtmpfs (rw, | ||
| + | devpts on /dev/pts type devpts (rw, | ||
| + | tmpfs on /run type tmpfs (rw, | ||
| + | /dev/sda1 on / type ext4 (rw, | ||
| + | securityfs on / | ||
| + | tmpfs on /dev/shm type tmpfs (rw, | ||
| + | tmpfs on /run/lock type tmpfs (rw, | ||
| + | cgroup2 on / | ||
| + | pstore on / | ||
| + | none on /sys/fs/bpf type bpf (rw, | ||
| + | systemd-1 on / | ||
| + | mqueue on /dev/mqueue type mqueue (rw, | ||
| + | debugfs on / | ||
| + | hugetlbfs on / | ||
| + | tracefs on / | ||
| + | configfs on / | ||
| + | fusectl on / | ||
| + | tmpfs on /run/user/0 type tmpfs (rw, | ||
| + | /dev/sdb1 on /home type ext4 (rw, | ||
| </ | </ | ||
| - | Connectez-vous ensuite via telnet sur le port 15023, vous constaterez que votre connexion n' | + | Notez la taille de /home : |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | Trying ::1... | + | Filesystem |
| - | Connected to localhost. | + | udev |
| - | Escape character is ' | + | tmpfs |
| - | Debian GNU/Linux 11 | + | / |
| - | debian11.ittraining.loc login: trainee | + | tmpfs 2.0G |
| - | Password: trainee | + | tmpfs 5.0M 0 5.0M 0% /run/lock |
| - | Linux debian11.ittraining.loc | + | tmpfs |
| - | + | /dev/sdb1 63G 1.4M | |
| - | The programs included with the Debian GNU/Linux system are free software; | + | |
| - | the exact distribution terms for each program are described in the | + | |
| - | individual files in /usr/share/doc/*/copyright. | + | |
| - | + | ||
| - | Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent | + | |
| - | permitted by applicable law. | + | |
| - | Last login: Tue May 3 08:57:59 CEST 2022 from 10.0.2.1 on pts/0 | + | |
| - | + | ||
| - | trainee@debian11: | + | |
| - | trainee | + | |
| - | + | ||
| - | trainee@debian11: | + | |
| - | /home/trainee | + | |
| - | + | ||
| - | trainee@debian11: | + | |
| - | logout | + | |
| - | Connection closed by foreign host. | + | |
| </ | </ | ||
| - | <WRAP center round important 60%> | + | <WRAP center round todo> |
| - | **Important** - Notez bien que votre communication telnet passe par le tunnel SSH. | + | **A Faire** - Fermez la session de root et connectez-vous en tant que trainee en ssh. |
| </ | </ | ||
| - | ====3.5 - SCP==== | + | ====1.2 - Télécharger le Code Source du Noyau==== |
| - | ===Présentation=== | + | Le code source |
| - | + | ||
| - | La commande **scp** | + | |
| - | + | ||
| - | $ scp compte@numero_ip(nom_de_machine):/ | + | |
| - | + | ||
| - | ou vers une machine distante : | + | |
| - | + | ||
| - | $ scp / | + | |
| - | + | ||
| - | ===Utilisation=== | + | |
| - | + | ||
| - | Nous allons maintenant utiliser **scp** pour chercher un fichier sur le << | + | |
| - | + | ||
| - | Créez le fichier **/ | + | |
| < | < | ||
| - | trainee@debian11: | + | trainee@debian11: |
| - | trainee@debian11:~$ exit | + | |
| - | logout | + | |
| - | Connection closed by foreign host. | + | |
| - | root@debian11: | + | |
| </ | </ | ||
| - | Récupérez | + | Désarchivez |
| < | < | ||
| - | root@debian11: | + | trainee@debian8:~$ tar xf linux-5.11.1.tar.gz |
| - | The authenticity of host ' | + | |
| - | ECDSA key fingerprint is SHA256: | + | |
| - | Are you sure you want to continue connecting (yes/ | + | |
| - | Warning: Permanently added ' | + | |
| - | \S | + | |
| - | Kernel \r on an \m | + | |
| - | trainee@127.0.0.1' | + | |
| - | scp-test | + | |
| - | + | ||
| - | root@debian11:~# ls -l | + | |
| - | total 32 | + | |
| - | -rw-------. 1 root root 1358 Jun 16 06:40 anaconda-ks.cfg | + | |
| - | drwxr-xr-x. 3 root root 21 Jun 16 06:39 home | + | |
| - | -rw-r--r--. 1 root root 1749 Aug 24 11:20 I2TCH.asc | + | |
| - | -rw-r--r--. 1 root root 1853 Jun 16 06:54 initial-setup-ks.cfg | + | |
| - | -rw-r--r--. 1 root root 31 Aug 24 11:22 message.txt | + | |
| - | -rw-r--r--. 1 root root 561 Aug 24 11:32 message.txt.asc | + | |
| - | -rw-r--r--. 1 root root 367 Aug 24 11:30 message.txt.gpg | + | |
| - | -rw-r--r--. 1 root root 329 Aug 24 11:23 message.txt.sig | + | |
| - | -rw-r--r--. 1 root root 0 Aug 30 03:55 scp-test | + | |
| - | -rw-r--r--. 1 root root 46 Aug 29 06:22 wget_file.txt | + | |
| </ | </ | ||
| - | ====3.6 | + | Notez que l' |
| - | + | ||
| - | Il convient maintenant | + | |
| < | < | ||
| - | root@debian11:~# ssh -l trainee 127.0.0.1 | + | trainee@debian11:~$ du -hs ./linux-5.11.1 |
| - | \S | + | 1.2G |
| - | Kernel \r on an \m | + | |
| - | trainee@127.0.0.1's password: trainee | + | |
| - | Activate the web console with: systemctl enable --now cockpit.socket | + | |
| - | + | ||
| - | trainee@debian11: | + | |
| - | drwx------. 2 trainee trainee | + | |
| </ | </ | ||
| - | <WRAP center round important 60%> | + | ====1.3 |
| - | **Important** | + | |
| - | </ | + | |
| - | Ensuite, il convient de transférer le fichier | + | Le fichier **Makefile** contient le nom du noyau et spécifie les informations suivantes |
| - | < | + | * VERSION, |
| - | trainee@debian11: | + | * PATCHLEVEL, |
| - | logout | + | * SUBLEVEL, |
| - | Connection to 127.0.0.1 closed. | + | * EXTRAVERSION. |
| - | root@debian11: | + | Les trois premières informations sont gérées par **kernel.org** et Linus Torvalds en personne tandis que l'EXTRAVERSION est gérée par Debian |
| - | logout | + | |
| - | + | ||
| - | trainee@debian11: | + | |
| - | The authenticity of host '127.0.0.1 (127.0.0.1)' | + | |
| - | ECDSA key fingerprint is SHA256: | + | |
| - | Are you sure you want to continue connecting (yes/ | + | |
| - | Warning: Permanently added ' | + | |
| - | \S | + | |
| - | Kernel \r on an \m | + | |
| - | trainee@127.0.0.1' | + | |
| - | id_ecdsa.pub | + | |
| - | </ | + | |
| - | + | ||
| - | Connectez-vous via ssh : | + | |
| < | < | ||
| - | trainee@debian11: | + | trainee@debian11: |
| - | The authenticity of host ' | + | # SPDX-License-Identifier: GPL-2.0 |
| - | ECDSA key fingerprint is SHA256:Q7T/CP0SLiMbMAIgVzTuEHegYS/ | + | VERSION = 5 |
| - | Are you sure you want to continue connecting (yes/no/[fingerprint])? | + | PATCHLEVEL = 11 |
| - | Warning: Permanently added ' | + | SUBLEVEL = 1 |
| - | \S | + | EXTRAVERSION = |
| - | Kernel \r on an \m | + | NAME = 💕 Valentine' |
| - | Activate the web console with: systemctl enable --now cockpit.socket | + | |
| - | Last login: Mon Aug 30 03:57:14 2021 from 127.0.0.1 | + | # *DOCUMENTATION* |
| - | trainee@debian11: | + | # To see a list of typical targets execute "make help" |
| + | # More info can be located in ./README | ||
| </ | </ | ||
| - | <WRAP center round important | + | <WRAP center round important> |
| - | **Important** - Lors de la connexion au serveur, l' | + | **Important** - La version 2.6 du noyau a vu le jour en **2003**. Les **SUBLEVEL** se suivaient régulièrement. Avec la version 2.6 du noyau, la valeur paire du **PATCHLEVEL** indiquait que le noyau était stable. Quand vous recompilez le noyau à partir des sources, vous devez modifier la valeur |
| </ | </ | ||
| - | Insérez | + | Utilisez |
| < | < | ||
| - | trainee@debian11: | + | trainee@debian11: |
| - | [trainee@centos8 | + | Password: fenestros |
| - | authorized_keys | + | root@debian11: |
| - | [trainee@centos8 .ssh]$ cat authorized_keys | + | root@debian11:/ |
| - | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHDrzSXP+Ecxf/sQ18VwCRNm7rrSrrsaJmuIw/RgTH5puKF5E+Yy15cvAAKBXpJPxUmrOaOyhab84PevV7XSHcI= trainee@centos8.ittraining.loc | + | |
| - | + | HOSTCC | |
| - | [trainee@centos8 | + | HOSTCC |
| - | [trainee@centos8 .ssh]$ cat id_dsa.pub >> authorized_keys | + | HOSTCC |
| - | [trainee@centos8 | + | LEX |
| - | + | | |
| - | [trainee@centos8 .ssh]$ cat authorized_keys | + | |
| - | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHDrzSXP+Ecxf/sQ18VwCRNm7rrSrrsaJmuIw/RgTH5puKF5E+Yy15cvAAKBXpJPxUmrOaOyhab84PevV7XSHcI= trainee@centos8.ittraining.loc | + | |
| - | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD3ZSMn/GIAHtaDFc6ZNnKJam9hzq8TxqMN5IopUr8QhwODyPadbB+FgH4r50qTux4ubwr1BlymgIdqRVWy32mE15M8tdtKc3j8DNMpUwPGEh+s/PT7GW+3E3shoyPvpLc1kKaKXKGl/JwfCK/8IYsubk2BmiiJYkzLECotPlaaxm4w1K0AtlnZQuLHt1HK3/rHChxo2o2w1t59/QwNcMLiKve1Z+zQ1POKo8VJ/ | + | |
| - | ssh-dss AAAAB3NzaC1kc3MAAACBALIdwEEqHrMWSUdzARm9ldsZK9ebbtZShtmwgdjphOk77fxymK0y6wV7QEmLL25LOcLb12uZ1F0LtRt/t2oqgrwqk3vUSpCPLr09AXpcD/nxL9kc+rUxHyl6u1mHtyfCVLCPSvavCMR8TaA8egVMk3EwGRfHTiuDOKi7Iwus7gXPAAAAFQDHEQPGVRI7gVYKzCT6nrjDsQQ6jwAAAIEAhhhH7fEjdldASXY0qTWkCvcs3cfK9/ | + | HOSTCC |
| - | ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfFQULLU8IZyKiSU63D2Zz6yGLqyHcBHnCRdSR9JSmc trainee@centos8.ittraining.loc | + | HOSTCC |
| + | | ||
| + | *** Default configuration is based on ' | ||
| + | # | ||
| + | # configuration written to .config | ||
| + | # | ||
| </ | </ | ||
| - | ====3.7 - Services réseaux ==== | + | Ce fichier est configuré par une des trois commandes suivantes : |
| - | Quand un client émet une demande de connexion vers une application réseau sur un serveur, il utilise un socket attaché à un port local **supérieur à 1023**, alloué d'une manière dynamique. La requête contient le port de destination sur le serveur. Certaines applications serveurs se gèrent toutes seules, ce qui est la cas par exemple d' | + | |
| + | | ||
| + | | ||
| - | === inetd === | + | Dans ce fichier, vous pouvez constater la présence de lignes correspondantes à des fonctionalités suivies par une lettre ou une valeur. Dans le cas d'une lettre, la signification est la suivante : |
| - | Le programme inetd est configuré via le fichier | + | * **y** |
| + | * la fonctionnalité | ||
| + | | ||
| + | * la fonctionnalité est incluse en tant que module, | ||
| + | * **n** | ||
| + | * la fonctionnalité n'est pas incluse. Cette option est rarement visible car dans bien les cas, la fonctionnalité est simplement commentée dans le fichier lui-même. | ||
| < | < | ||
| - | root@debian11: | + | root@debian11:/ |
| - | # / | + | |
| # | # | ||
| - | # Internet superserver configuration database | + | # Automatically generated file; DO NOT EDIT. |
| + | # Linux/x86 5.11.1 Kernel Configuration | ||
| # | # | ||
| + | CONFIG_CC_VERSION_TEXT=" | ||
| + | CONFIG_CC_IS_GCC=y | ||
| + | CONFIG_GCC_VERSION=100201 | ||
| + | CONFIG_LD_VERSION=235020000 | ||
| + | CONFIG_CLANG_VERSION=0 | ||
| + | CONFIG_LLD_VERSION=0 | ||
| + | CONFIG_CC_CAN_LINK=y | ||
| + | CONFIG_CC_CAN_LINK_STATIC=y | ||
| + | CONFIG_CC_HAS_ASM_GOTO=y | ||
| + | CONFIG_CC_HAS_ASM_INLINE=y | ||
| + | CONFIG_IRQ_WORK=y | ||
| + | CONFIG_BUILDTIME_TABLE_SORT=y | ||
| + | CONFIG_THREAD_INFO_IN_TASK=y | ||
| + | |||
| # | # | ||
| - | # Lines starting with "#: | + | # General setup |
| - | # be changed unless you know what you are doing! | + | |
| # | # | ||
| - | # If you want to disable an entry so it isn't touched during | + | CONFIG_INIT_ENV_ARG_LIMIT=32 |
| - | # package updates just comment it out with a single '#' character. | + | # CONFIG_COMPILE_TEST is not set |
| + | CONFIG_LOCALVERSION="" | ||
| + | # CONFIG_LOCALVERSION_AUTO is not set | ||
| + | CONFIG_BUILD_SALT="" | ||
| + | CONFIG_HAVE_KERNEL_GZIP=y | ||
| + | CONFIG_HAVE_KERNEL_BZIP2=y | ||
| + | CONFIG_HAVE_KERNEL_LZMA=y | ||
| + | CONFIG_HAVE_KERNEL_XZ=y | ||
| + | CONFIG_HAVE_KERNEL_LZO=y | ||
| + | CONFIG_HAVE_KERNEL_LZ4=y | ||
| + | CONFIG_HAVE_KERNEL_ZSTD=y | ||
| + | CONFIG_KERNEL_GZIP=y | ||
| + | # CONFIG_KERNEL_BZIP2 is not set | ||
| + | # CONFIG_KERNEL_LZMA is not set | ||
| + | # CONFIG_KERNEL_XZ is not set | ||
| + | # CONFIG_KERNEL_LZO is not set | ||
| + | # CONFIG_KERNEL_LZ4 is not set | ||
| + | # CONFIG_KERNEL_ZSTD is not set | ||
| + | CONFIG_DEFAULT_INIT="" | ||
| + | CONFIG_DEFAULT_HOSTNAME=" | ||
| + | CONFIG_SWAP=y | ||
| + | CONFIG_SYSVIPC=y | ||
| + | CONFIG_SYSVIPC_SYSCTL=y | ||
| + | CONFIG_POSIX_MQUEUE=y | ||
| + | CONFIG_POSIX_MQUEUE_SYSCTL=y | ||
| + | # CONFIG_WATCH_QUEUE is not set | ||
| + | CONFIG_CROSS_MEMORY_ATTACH=y | ||
| + | CONFIG_USELIB=y | ||
| + | CONFIG_AUDIT=y | ||
| + | CONFIG_HAVE_ARCH_AUDITSYSCALL=y | ||
| + | CONFIG_AUDITSYSCALL=y | ||
| # | # | ||
| - | # Packages should modify this file by using update-inetd(8) | + | # IRQ subsystem |
| # | # | ||
| - | # < | + | CONFIG_GENERIC_IRQ_PROBE=y |
| - | # | + | --More--(1%) |
| - | #:INTERNAL: Internal services | + | [q] |
| - | # | + | </ |
| - | # | + | |
| - | # | + | |
| - | #time | + | |
| - | #:STANDARD: These are standard services. | + | ====1.4 - Compiler le Noyau==== |
| - | telnet | + | |
| - | #:BSD: Shell, login, exec and talk are BSD protocols. | + | La compilation du noyau peut prendre beaucoup de temps. La commande utilisée est la suivante |
| - | + | ||
| - | #:MAIL: Mail, news and uucp services. | + | |
| - | + | ||
| - | #:INFO: Info services | + | |
| - | + | ||
| - | #:BOOT: TFTP service is provided primarily for booting. | + | |
| - | # run this only on machines acting as "boot servers." | + | |
| - | + | ||
| - | #:RPC: RPC based services | + | |
| - | + | ||
| - | #: | + | |
| - | + | ||
| - | #:OTHER: Other services | + | |
| - | </ | + | |
| - | + | ||
| - | Les lignes de configuration des serveurs ressemblent à : | + | |
| < | < | ||
| - | telnet | + | root@debian11:/ |
| + | ... | ||
| + | dpkg-buildpackage: | ||
| + | CLEAN | ||
| + | CLEAN arch/x86/kernel/cpu | ||
| + | CLEAN arch/x86/ | ||
| + | CLEAN | ||
| + | CLEAN | ||
| + | CLEAN | ||
| + | CLEAN | ||
| + | CLEAN | ||
| + | CLEAN | ||
| + | CLEAN | ||
| + | CLEAN lib | ||
| + | CLEAN | ||
| + | CLEAN | ||
| + | CLEAN usr/include | ||
| + | CLEAN usr | ||
| + | CLEAN arch/x86/ | ||
| + | CLEAN | ||
| + | CLEAN | ||
| + | CLEAN | ||
| </ | </ | ||
| - | Le premier champs de la ligne identifie le nom du port qui identifie | + | A l'issu du processus, les paquets du nouveau noyau se trouvent dans le répertoire |
| - | + | ||
| - | Le deuxième et le troisième champs définissent le type de protocole, à savoir: | + | |
| - | + | ||
| - | * stream tcp pour le tcp | + | |
| - | * dgram udp pour l' | + | |
| - | + | ||
| - | Le quatrième champs prend un de deux valeurs: | + | |
| - | + | ||
| - | * nowait | + | |
| - | * indique qu'il y aura un serveur par client | + | |
| - | * wait | + | |
| - | * indique qu'il y aura un seul serveur pour l' | + | |
| - | + | ||
| - | Le cinquième champs indique l' | + | |
| - | + | ||
| - | Le sixième champs indique l' | + | |
| - | + | ||
| - | Le septième champs indique | + | |
| - | + | ||
| - | == TCP Wrapper == | + | |
| - | + | ||
| - | Lors de l' | + | |
| - | + | ||
| - | < | + | |
| - | telnet | + | |
| - | </ | + | |
| - | + | ||
| - | Quand une requête arrive pour le serveur telnet, inetd active le wrapper | + | |
| - | + | ||
| - | **tcpd** met à jour un journal et vérifie si le client a le droit d' | + | |
| < | < | ||
| - | root@debian11: | + | root@debian11:/ |
| - | # /etc/hosts.allow: list of hosts that are allowed to access the system. | + | root@debian11:/ |
| - | # See the manual pages hosts_access(5) and hosts_options(5). | + | Desktop |
| - | # | + | Documents |
| - | # Example: | + | Downloads |
| - | # | + | |
| - | # | + | |
| - | # If you're going to protect the portmapper use the name " | + | |
| - | # daemon name. See rpcbind(8) and rpc.mountd(8) for further information. | + | |
| - | # | + | |
| - | + | ||
| - | root@debian11: | + | |
| - | # /etc/hosts.deny: list of hosts that are _not_ allowed to access the system. | + | |
| - | # See the manual pages hosts_access(5) and hosts_options(5). | + | |
| - | # | + | |
| - | # Example: | + | |
| - | # ALL EXCEPT in.fingerd: other.host.name, .other.domain | + | |
| - | # | + | |
| - | # If you're going to protect the portmapper use the name " | + | |
| - | # daemon name. See rpcbind(8) and rpc.mountd(8) for further information. | + | |
| - | # | + | |
| - | # The PARANOID wildcard matches any host whose name does not match its | + | |
| - | # address. | + | |
| - | # | + | |
| - | # You may wish to enable this to ensure any programs that don' | + | |
| - | # validate looked up hostnames still leave understandable logs. In past | + | |
| - | # versions of Debian this has been the default. | + | |
| - | # ALL: PARANOID | + | |
| </ | </ | ||
| - | Il faut noter que si ces fichiers n' | + | ====1.5 - Installer |
| - | + | ||
| - | Le format d'une ligne dans un de ces deux fichiers est: | + | |
| - | + | ||
| - | < | + | |
| - | démon: liste_de_clients | + | |
| - | </ | + | |
| - | + | ||
| - | Par exemple dans le cas de notre serveur telnetd, une ligne dans le fichier **/ | + | |
| - | + | ||
| - | < | + | |
| - | in.telnetd: 192.168.1.10, | + | |
| - | </ | + | |
| - | + | ||
| - | implique que la machine dont le numéro IP est le 192.168.1.10 ainsi que les machines du domaine **fenestros.com** sont autorisées à utiliser le service. | + | |
| - | + | ||
| - | Le mot clef **ALL** peut être utilisé pour indiquer tout. Par exemple, **ALL:ALL** dans le fichier **/ | + | |
| - | + | ||
| - | =====LAB #4 - Le Parefeu Netfilter===== | + | |
| - | + | ||
| - | ====4.1 - Présentation==== | + | |
| - | + | ||
| - | **Netfilter** est composé de 5 //hooks// : | + | |
| - | + | ||
| - | * NF_IP_PRE_ROUTING | + | |
| - | * NF_IP_LOCAL_IN | + | |
| - | * NF_IP_LOCAL_OUT | + | |
| - | * NF_IP_FORWARD | + | |
| - | * NF_IP_POSTROUTING | + | |
| - | + | ||
| - | Ces hooks sont utilisés par deux branches, la première est celle concernée par les paquets qui entrent vers des services locaux : | + | |
| - | + | ||
| - | * NF_IP_PRE_ROUTING > NF_IP_LOCAL_IN > NF_IP_LOCAL_OUT > NF_IP_POSTROUTING | + | |
| - | + | ||
| - | tandis que la deuxième concerne les paquets qui traversent la passerelle: | + | |
| - | + | ||
| - | * NF_IP_PRE_ROUTING > NF_IP_FORWARD > NF_IP_POSTROUTING | + | |
| - | + | ||
| - | Si IPTABLES a été compilé en tant que module, son utilisation nécessite le chargement de plusieurs modules supplémentaires en fonction de la situation: | + | |
| - | + | ||
| - | * iptable_filter | + | |
| - | * iptable_mangle | + | |
| - | * iptable_net | + | |
| - | * etc | + | |
| - | + | ||
| - | Netfilter est organisé en **tables**. La commande **iptables** de netfilter permet d' | + | |
| - | + | ||
| - | * La table **FILTER** | + | |
| - | * La chaîne INPUT | + | |
| - | * Concerne les paquets entrants | + | |
| - | * Policies: ACCEPT, DROP, REJECT | + | |
| - | * La chaîne OUTPUT | + | |
| - | * Concerne les paquets sortants | + | |
| - | * Policies: ACCEPT, DROP, REJECT | + | |
| - | * La chaîne FORWARD | + | |
| - | * Concerne les paquets traversant le par-feu. | + | |
| - | * Policies: ACCEPT, DROP, REJECT | + | |
| - | + | ||
| - | Si aucune table n'est précisée, c'est la table FILTER qui s' | + | |
| - | + | ||
| - | * La table **NAT** | + | |
| - | * La chaîne PREROUTING | + | |
| - | * Permet de faire la translation d' | + | |
| - | * Cibles: SNAT, DNAT, MASQUERADE | + | |
| - | * La chaîne POSTROUTING | + | |
| - | * Permet de faire la translation d' | + | |
| - | * Cibles: SNAT, DNAT, MASQUERADE | + | |
| - | * Le cas spécifique OUTPUT | + | |
| - | * Permet la modification de la destination des paquets générés localement | + | |
| - | + | ||
| - | * La table **MANGLE** | + | |
| - | * Permet | + | |
| - | + | ||
| - | Les **policies** sont: | + | |
| - | + | ||
| - | * ACCEPT | + | |
| - | * Permet d' | + | |
| - | * DROP | + | |
| - | * Permet de rejeter le paquet concerné sans générer un message d' | + | |
| - | * REJECT | + | |
| - | * Permet de rejeter le paquet concerné en générant une message d' | + | |
| - | + | ||
| - | Les **cibles** sont: | + | |
| - | + | ||
| - | * SNAT | + | |
| - | * Permet de modifier l' | + | |
| - | * DNAT | + | |
| - | * Permet de modifier l' | + | |
| - | * MASQUERADE | + | |
| - | * Permet de remplacer l' | + | |
| - | + | ||
| - | ====4.2 - La Configuration de Netfilter par firewalld==== | + | |
| - | + | ||
| - | firewalld est à Netfilter ce que NetworkManager est au réseau. firewalld utilise des **zones** - des jeux de règles pré-définis dans lesquels sont placés les interfaces : | + | |
| - | + | ||
| - | * **trusted** - un réseau fiable. Dans ce cas tous les ports sont autorisés, | + | |
| - | * **work**, **home**, **internal** - un réseau partiellement fiable. Dans ce cas quelques ports sont autorisés, | + | |
| - | * **dmz**, **public**, **external** - un réseau non fiable. Dans ce cas peu de ports sont autorisés, | + | |
| - | * **block**, **drop** - tout est interdit. La zone drop n' | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - Une interface ne peut être que dans une zone à la fois tandis que plusieurs interfaces peuvent être dans la même zone. | + | |
| - | </ | + | |
| - | Sous Debian 11, firewalld n'est pas installé par défaut | + | Installez maintenant les paquets **deb** |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| </ | </ | ||
| - | Le service firewalld est déjà lancé et activé | + | Constatez la création d'un nouveau grub.cfg |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | ● firewalld.service | + | |
| - | Loaded: loaded (/lib/systemd/ | + | linux / |
| - | Active: active (running) since Tue 2022-05-03 15:17:03 CEST; 11s ago | + | |
| - | Docs: man: | + | |
| - | Main PID: 5695 (firewalld) | + | |
| - | Tasks: 2 (limit: 4632) | + | |
| - | | + | |
| - | CPU: 619ms | + | |
| - | CGroup: | + | |
| - | └─5695 /usr/bin/python3 / | + | |
| - | + | | |
| - | May 03 15:17:02 debian11.ittraining.loc systemd[1]: Starting firewalld | + | |
| - | May 03 15:17:03 debian11.ittraining.loc systemd[1]: Started firewalld - dynamic firew> | + | |
| - | lines 1-13/13 (END) | + | |
| - | [q] | + | |
| </ | </ | ||
| - | ===La Configuration de Base de firewalld=== | + | ====1.6 - Désinstaller un Noyau==== |
| - | La configuration par défaut de firewalld se trouve dans **/ | + | Lister les noyaux installés |
| < | < | ||
| - | root@debian11: | + | root@debian11:/ |
| - | / | + | linux-image-5.10.0-13-amd64 |
| - | total 32 | + | linux-image-5.11.1 |
| - | drwxr-xr-x 2 root root 4096 May 3 15:16 helpers | + | linux-image-amd64 |
| - | drwxr-xr-x 2 root root 4096 May 3 15:16 icmptypes | + | |
| - | drwxr-xr-x 2 root root 4096 May 3 15:16 ipsets | + | |
| - | drwxr-xr-x 2 root root 4096 May 3 15:16 policies | + | |
| - | drwxr-xr-x 2 root root 12288 May 3 15:16 services | + | |
| - | drwxr-xr-x 2 root root 4096 May 3 15:16 zones | + | |
| - | + | ||
| - | / | + | |
| - | total 52 | + | |
| - | -rw-r--r-- 1 root root 125 Feb 1 2021 amanda.xml | + | |
| - | -rw-r--r-- 1 root root 119 Feb 1 2021 ftp.xml | + | |
| - | -rw-r--r-- 1 root root 85 Feb 1 2021 h323.xml | + | |
| - | -rw-r--r-- 1 root root 134 Feb 1 2021 irc.xml | + | |
| - | -rw-r--r-- 1 root root 141 Feb 1 2021 netbios-ns.xml | + | |
| - | -rw-r--r-- | + | |
| - | -rw-r--r-- 1 root root 90 Feb 1 2021 proto-gre.xml | + | |
| - | -rw-r--r-- 1 root root 122 Feb 1 2021 Q.931.xml | + | |
| - | -rw-r--r-- 1 root root 122 Feb 1 2021 RAS.xml | + | |
| - | -rw-r--r-- 1 root root 122 Feb 1 2021 sane.xml | + | |
| - | -rw-r--r-- 1 root root 158 Feb 1 2021 sip.xml | + | |
| - | -rw-r--r-- 1 root root 135 Feb 1 2021 snmp.xml | + | |
| - | -rw-r--r-- 1 root root 120 Feb 1 2021 tftp.xml | + | |
| - | + | ||
| - | / | + | |
| - | total 180 | + | |
| - | -rw-r--r-- 1 root root 385 Feb 1 2021 address-unreachable.xml | + | |
| - | -rw-r--r-- 1 root root 258 Feb 1 2021 bad-header.xml | + | |
| - | -rw-r--r-- 1 root root 294 Feb 1 2021 beyond-scope.xml | + | |
| - | -rw-r--r-- 1 root root 279 Feb 1 2021 communication-prohibited.xml | + | |
| - | -rw-r--r-- 1 root root 222 Feb 1 2021 destination-unreachable.xml | + | |
| - | -rw-r--r-- 1 root root 173 Feb 1 2021 echo-reply.xml | + | |
| - | -rw-r--r-- 1 root root 210 Feb 1 2021 echo-request.xml | + | |
| - | -rw-r--r-- 1 root root 261 Feb 1 2021 failed-policy.xml | + | |
| - | -rw-r--r-- 1 root root 280 Feb 1 2021 fragmentation-needed.xml | + | |
| - | -rw-r--r-- 1 root root 266 Feb 1 2021 host-precedence-violation.xml | + | |
| - | -rw-r--r-- 1 root root 257 Feb 1 2021 host-prohibited.xml | + | |
| - | -rw-r--r-- 1 root root 242 Feb 1 2021 host-redirect.xml | + | |
| - | -rw-r--r-- 1 root root 239 Feb 1 2021 host-unknown.xml | + | |
| - | -rw-r--r-- 1 root root 247 Feb 1 2021 host-unreachable.xml | + | |
| - | -rw-r--r-- 1 root root 229 Feb 1 2021 ip-header-bad.xml | + | |
| - | -rw-r--r-- 1 root root 355 Feb 1 2021 neighbour-advertisement.xml | + | |
| - | -rw-r--r-- 1 root root 457 Feb 1 2021 neighbour-solicitation.xml | + | |
| - | -rw-r--r-- 1 root root 250 Feb 1 2021 network-prohibited.xml | + | |
| - | -rw-r--r-- 1 root root 248 Feb 1 2021 network-redirect.xml | + | |
| - | -rw-r--r-- 1 root root 239 Feb 1 2021 network-unknown.xml | + | |
| - | -rw-r--r-- 1 root root 247 Feb 1 2021 network-unreachable.xml | + | |
| - | -rw-r--r-- 1 root root 239 Feb 1 2021 no-route.xml | + | |
| - | -rw-r--r-- 1 root root 328 Feb 1 2021 packet-too-big.xml | + | |
| - | -rw-r--r-- 1 root root 225 Feb 1 2021 parameter-problem.xml | + | |
| - | -rw-r--r-- 1 root root 233 Feb 1 2021 port-unreachable.xml | + | |
| - | -rw-r--r-- 1 root root 256 Feb 1 2021 precedence-cutoff.xml | + | |
| - | -rw-r--r-- 1 root root 249 Feb 1 2021 protocol-unreachable.xml | + | |
| - | -rw-r--r-- 1 root root 185 Feb 1 2021 redirect.xml | + | |
| - | -rw-r--r-- 1 root root 244 Feb 1 2021 reject-route.xml | + | |
| - | -rw-r--r-- 1 root root 241 Feb 1 2021 required-option-missing.xml | + | |
| - | -rw-r--r-- 1 root root 227 Feb 1 2021 router-advertisement.xml | + | |
| - | -rw-r--r-- 1 root root 223 Feb 1 2021 router-solicitation.xml | + | |
| - | -rw-r--r-- 1 root root 248 Feb 1 2021 source-quench.xml | + | |
| - | -rw-r--r-- 1 root root 236 Feb 1 2021 source-route-failed.xml | + | |
| - | -rw-r--r-- 1 root root 253 Feb 1 2021 time-exceeded.xml | + | |
| - | -rw-r--r-- 1 root root 233 Feb 1 2021 timestamp-reply.xml | + | |
| - | -rw-r--r-- 1 root root 228 Feb 1 2021 timestamp-request.xml | + | |
| - | -rw-r--r-- 1 root root 258 Feb 1 2021 tos-host-redirect.xml | + | |
| - | -rw-r--r-- 1 root root 257 Feb 1 2021 tos-host-unreachable.xml | + | |
| - | -rw-r--r-- 1 root root 272 Feb 1 2021 tos-network-redirect.xml | + | |
| - | -rw-r--r-- 1 root root 269 Feb 1 2021 tos-network-unreachable.xml | + | |
| - | -rw-r--r-- 1 root root 293 Feb 1 2021 ttl-zero-during-reassembly.xml | + | |
| - | -rw-r--r-- 1 root root 256 Feb 1 2021 ttl-zero-during-transit.xml | + | |
| - | -rw-r--r-- 1 root root 259 Feb 1 2021 unknown-header-type.xml | + | |
| - | -rw-r--r-- 1 root root 249 Feb 1 2021 unknown-option.xml | + | |
| - | + | ||
| - | / | + | |
| - | total 4 | + | |
| - | -rw-r--r-- 1 root root 29 Feb 1 2021 README | + | |
| - | + | ||
| - | / | + | |
| - | total 4 | + | |
| - | -rw-r--r-- 1 root root 649 Feb 1 2021 allow-host-ipv6.xml | + | |
| - | + | ||
| - | / | + | |
| - | total 700 | + | |
| - | -rw-r--r-- 1 root root 399 Feb 1 2021 amanda-client.xml | + | |
| - | -rw-r--r-- 1 root root 427 Feb 1 2021 amanda-k5-client.xml | + | |
| - | -rw-r--r-- 1 root root 283 Feb 1 2021 amqps.xml | + | |
| - | -rw-r--r-- 1 root root 273 Feb 1 2021 amqp.xml | + | |
| - | -rw-r--r-- 1 root root 285 Feb 1 2021 apcupsd.xml | + | |
| - | -rw-r--r-- 1 root root 301 Feb 1 2021 audit.xml | + | |
| - | -rw-r--r-- 1 root root 320 Feb 1 2021 bacula-client.xml | + | |
| - | -rw-r--r-- 1 root root 346 Feb 1 2021 bacula.xml | + | |
| - | -rw-r--r-- 1 root root 429 Feb 1 2021 bb.xml | + | |
| - | -rw-r--r-- 1 root root 339 Feb 1 2021 bgp.xml | + | |
| - | -rw-r--r-- 1 root root 275 Feb 1 2021 bitcoin-rpc.xml | + | |
| - | -rw-r--r-- 1 root root 307 Feb 1 2021 bitcoin-testnet-rpc.xml | + | |
| - | -rw-r--r-- 1 root root 281 Feb 1 2021 bitcoin-testnet.xml | + | |
| - | -rw-r--r-- 1 root root 244 Feb 1 2021 bitcoin.xml | + | |
| - | -rw-r--r-- 1 root root 410 Feb 1 2021 bittorrent-lsd.xml | + | |
| - | -rw-r--r-- 1 root root 294 Feb 1 2021 ceph-mon.xml | + | |
| - | -rw-r--r-- 1 root root 329 Feb 1 2021 ceph.xml | + | |
| - | -rw-r--r-- 1 root root 168 Feb 1 2021 cfengine.xml | + | |
| - | -rw-r--r-- 1 root root 211 Feb 1 2021 cockpit.xml | + | |
| - | -rw-r--r-- 1 root root 296 Feb 1 2021 collectd.xml | + | |
| - | -rw-r--r-- 1 root root 260 Feb 1 2021 condor-collector.xml | + | |
| - | -rw-r--r-- 1 root root 296 Feb 1 2021 ctdb.xml | + | |
| - | -rw-r--r-- 1 root root 305 Feb 1 2021 dhcpv6-client.xml | + | |
| - | -rw-r--r-- 1 root root 234 Feb 1 2021 dhcpv6.xml | + | |
| - | -rw-r--r-- 1 root root 227 Feb 1 2021 dhcp.xml | + | |
| - | -rw-r--r-- 1 root root 205 Feb 1 2021 distcc.xml | + | |
| - | -rw-r--r-- 1 root root 318 Feb 1 2021 dns-over-tls.xml | + | |
| - | -rw-r--r-- 1 root root 346 Feb 1 2021 dns.xml | + | |
| - | -rw-r--r-- 1 root root 374 Feb 1 2021 docker-registry.xml | + | |
| - | -rw-r--r-- 1 root root 391 Feb 1 2021 docker-swarm.xml | + | |
| - | -rw-r--r-- 1 root root 228 Feb 1 2021 dropbox-lansync.xml | + | |
| - | -rw-r--r-- 1 root root 338 Feb 1 2021 elasticsearch.xml | + | |
| - | -rw-r--r-- 1 root root 304 Feb 1 2021 etcd-client.xml | + | |
| - | -rw-r--r-- 1 root root 304 Feb 1 2021 etcd-server.xml | + | |
| - | -rw-r--r-- 1 root root 224 Feb 1 2021 finger.xml | + | |
| - | -rw-r--r-- 1 root root 270 Feb 1 2021 foreman-proxy.xml | + | |
| - | -rw-r--r-- 1 root root 408 Feb 1 2021 foreman.xml | + | |
| - | -rw-r--r-- 1 root root 709 Feb 1 2021 freeipa-4.xml | + | |
| - | -rw-r--r-- 1 root root 489 Feb 1 2021 freeipa-ldaps.xml | + | |
| - | -rw-r--r-- 1 root root 488 Feb 1 2021 freeipa-ldap.xml | + | |
| - | -rw-r--r-- 1 root root 242 Feb 1 2021 freeipa-replication.xml | + | |
| - | -rw-r--r-- 1 root root 657 Feb 1 2021 freeipa-trust.xml | + | |
| - | -rw-r--r-- 1 root root 361 Feb 1 2021 ftp.xml | + | |
| - | -rw-r--r-- 1 root root 184 Feb 1 2021 ganglia-client.xml | + | |
| - | -rw-r--r-- 1 root root 176 Feb 1 2021 ganglia-master.xml | + | |
| - | -rw-r--r-- 1 root root 212 Feb 1 2021 git.xml | + | |
| - | -rw-r--r-- 1 root root 218 Feb 1 2021 grafana.xml | + | |
| - | -rw-r--r-- 1 root root 119 Feb 1 2021 gre.xml | + | |
| - | -rw-r--r-- 1 root root 608 Feb 1 2021 high-availability.xml | + | |
| - | -rw-r--r-- 1 root root 448 Feb 1 2021 https.xml | + | |
| - | -rw-r--r-- 1 root root 353 Feb 1 2021 http.xml | + | |
| - | -rw-r--r-- 1 root root 372 Feb 1 2021 imaps.xml | + | |
| - | -rw-r--r-- 1 root root 327 Feb 1 2021 imap.xml | + | |
| - | -rw-r--r-- 1 root root 454 Feb 1 2021 ipp-client.xml | + | |
| - | -rw-r--r-- 1 root root 427 Feb 1 2021 ipp.xml | + | |
| - | -rw-r--r-- 1 root root 894 Feb 1 2021 ipsec.xml | + | |
| - | -rw-r--r-- 1 root root 255 Feb 1 2021 ircs.xml | + | |
| - | -rw-r--r-- 1 root root 247 Feb 1 2021 irc.xml | + | |
| - | -rw-r--r-- 1 root root 264 Feb 1 2021 iscsi-target.xml | + | |
| - | -rw-r--r-- 1 root root 358 Feb 1 2021 isns.xml | + | |
| - | -rw-r--r-- 1 root root 213 Feb 1 2021 jenkins.xml | + | |
| - | -rw-r--r-- 1 root root 182 Feb 1 2021 kadmin.xml | + | |
| - | -rw-r--r-- 1 root root 272 Feb 1 2021 kdeconnect.xml | + | |
| - | -rw-r--r-- 1 root root 233 Feb 1 2021 kerberos.xml | + | |
| - | -rw-r--r-- 1 root root 384 Feb 1 2021 kibana.xml | + | |
| - | -rw-r--r-- 1 root root 249 Feb 1 2021 klogin.xml | + | |
| - | -rw-r--r-- 1 root root 221 Feb 1 2021 kpasswd.xml | + | |
| - | -rw-r--r-- 1 root root 182 Feb 1 2021 kprop.xml | + | |
| - | -rw-r--r-- 1 root root 242 Feb 1 2021 kshell.xml | + | |
| - | -rw-r--r-- 1 root root 308 Feb 1 2021 kube-apiserver.xml | + | |
| - | -rw-r--r-- 1 root root 232 Feb 1 2021 ldaps.xml | + | |
| - | -rw-r--r-- 1 root root 199 Feb 1 2021 ldap.xml | + | |
| - | -rw-r--r-- 1 root root 385 Feb 1 2021 libvirt-tls.xml | + | |
| - | -rw-r--r-- 1 root root 389 Feb 1 2021 libvirt.xml | + | |
| - | -rw-r--r-- 1 root root 269 Feb 1 2021 lightning-network.xml | + | |
| - | -rw-r--r-- 1 root root 324 Feb 1 2021 llmnr.xml | + | |
| - | -rw-r--r-- 1 root root 349 Feb 1 2021 managesieve.xml | + | |
| - | -rw-r--r-- 1 root root 432 Feb 1 2021 matrix.xml | + | |
| - | -rw-r--r-- 1 root root 424 Feb 1 2021 mdns.xml | + | |
| - | -rw-r--r-- 1 root root 245 Feb 1 2021 memcache.xml | + | |
| - | -rw-r--r-- 1 root root 343 Feb 1 2021 minidlna.xml | + | |
| - | -rw-r--r-- 1 root root 237 Feb 1 2021 mongodb.xml | + | |
| - | -rw-r--r-- 1 root root 473 Feb 1 2021 mosh.xml | + | |
| - | -rw-r--r-- 1 root root 211 Feb 1 2021 mountd.xml | + | |
| - | -rw-r--r-- 1 root root 296 Feb 1 2021 mqtt-tls.xml | + | |
| - | -rw-r--r-- 1 root root 287 Feb 1 2021 mqtt.xml | + | |
| - | -rw-r--r-- 1 root root 170 Feb 1 2021 mssql.xml | + | |
| - | -rw-r--r-- 1 root root 190 Feb 1 2021 ms-wbt.xml | + | |
| - | -rw-r--r-- 1 root root 242 Feb 1 2021 murmur.xml | + | |
| - | -rw-r--r-- 1 root root 171 Feb 1 2021 mysql.xml | + | |
| - | -rw-r--r-- 1 root root 250 Feb 1 2021 nbd.xml | + | |
| - | -rw-r--r-- 1 root root 342 Feb 1 2021 nfs3.xml | + | |
| - | -rw-r--r-- 1 root root 324 Feb 1 2021 nfs.xml | + | |
| - | -rw-r--r-- 1 root root 293 Feb 1 2021 nmea-0183.xml | + | |
| - | -rw-r--r-- 1 root root 247 Feb 1 2021 nrpe.xml | + | |
| - | -rw-r--r-- 1 root root 389 Feb 1 2021 ntp.xml | + | |
| - | -rw-r--r-- 1 root root 368 Feb 1 2021 nut.xml | + | |
| - | -rw-r--r-- 1 root root 335 Feb 1 2021 openvpn.xml | + | |
| - | -rw-r--r-- 1 root root 260 Feb 1 2021 ovirt-imageio.xml | + | |
| - | -rw-r--r-- 1 root root 343 Feb 1 2021 ovirt-storageconsole.xml | + | |
| - | -rw-r--r-- 1 root root 235 Feb 1 2021 ovirt-vmconsole.xml | + | |
| - | -rw-r--r-- 1 root root 1024 Feb 1 2021 plex.xml | + | |
| - | -rw-r--r-- 1 root root 433 Feb 1 2021 pmcd.xml | + | |
| - | -rw-r--r-- 1 root root 474 Feb 1 2021 pmproxy.xml | + | |
| - | -rw-r--r-- 1 root root 544 Feb 1 2021 pmwebapis.xml | + | |
| - | -rw-r--r-- 1 root root 460 Feb 1 2021 pmwebapi.xml | + | |
| - | -rw-r--r-- 1 root root 357 Feb 1 2021 pop3s.xml | + | |
| - | -rw-r--r-- 1 root root 348 Feb 1 2021 pop3.xml | + | |
| - | -rw-r--r-- 1 root root 181 Feb 1 2021 postgresql.xml | + | |
| - | -rw-r--r-- 1 root root 509 Feb 1 2021 privoxy.xml | + | |
| - | -rw-r--r-- 1 root root 213 Feb 1 2021 prometheus.xml | + | |
| - | -rw-r--r-- 1 root root 261 Feb 1 2021 proxy-dhcp.xml | + | |
| - | -rw-r--r-- 1 root root 424 Feb 1 2021 ptp.xml | + | |
| - | -rw-r--r-- 1 root root 414 Feb 1 2021 pulseaudio.xml | + | |
| - | -rw-r--r-- 1 root root 297 Feb 1 2021 puppetmaster.xml | + | |
| - | -rw-r--r-- 1 root root 273 Feb 1 2021 quassel.xml | + | |
| - | -rw-r--r-- 1 root root 520 Feb 1 2021 radius.xml | + | |
| - | -rw-r--r-- 1 root root 183 Feb 1 2021 rdp.xml | + | |
| - | -rw-r--r-- 1 root root 212 Feb 1 2021 redis-sentinel.xml | + | |
| - | -rw-r--r-- 1 root root 268 Feb 1 2021 redis.xml | + | |
| - | -rw-r--r-- 1 root root 381 Feb 1 2021 RH-Satellite-6-capsule.xml | + | |
| - | -rw-r--r-- 1 root root 556 Feb 1 2021 RH-Satellite-6.xml | + | |
| - | -rw-r--r-- 1 root root 214 Feb 1 2021 rpc-bind.xml | + | |
| - | -rw-r--r-- 1 root root 213 Feb 1 2021 rquotad.xml | + | |
| - | -rw-r--r-- 1 root root 310 Feb 1 2021 rsh.xml | + | |
| - | -rw-r--r-- 1 root root 311 Feb 1 2021 rsyncd.xml | + | |
| - | -rw-r--r-- 1 root root 350 Feb 1 2021 rtsp.xml | + | |
| - | -rw-r--r-- 1 root root 329 Feb 1 2021 salt-master.xml | + | |
| - | -rw-r--r-- 1 root root 371 Feb 1 2021 samba-client.xml | + | |
| - | -rw-r--r-- 1 root root 1298 Feb 1 2021 samba-dc.xml | + | |
| - | -rw-r--r-- 1 root root 448 Feb 1 2021 samba.xml | + | |
| - | -rw-r--r-- 1 root root 324 Feb 1 2021 sane.xml | + | |
| - | -rw-r--r-- 1 root root 283 Feb 1 2021 sips.xml | + | |
| - | -rw-r--r-- 1 root root 496 Feb 1 2021 sip.xml | + | |
| - | -rw-r--r-- 1 root root 299 Feb 1 2021 slp.xml | + | |
| - | -rw-r--r-- 1 root root 231 Feb 1 2021 smtp-submission.xml | + | |
| - | -rw-r--r-- 1 root root 577 Feb 1 2021 smtps.xml | + | |
| - | -rw-r--r-- 1 root root 550 Feb 1 2021 smtp.xml | + | |
| - | -rw-r--r-- 1 root root 308 Feb 1 2021 snmptrap.xml | + | |
| - | -rw-r--r-- 1 root root 342 Feb 1 2021 snmp.xml | + | |
| - | -rw-r--r-- 1 root root 405 Feb 1 2021 spideroak-lansync.xml | + | |
| - | -rw-r--r-- 1 root root 275 Feb 1 2021 spotify-sync.xml | + | |
| - | -rw-r--r-- 1 root root 173 Feb 1 2021 squid.xml | + | |
| - | -rw-r--r-- 1 root root 421 Feb 1 2021 ssdp.xml | + | |
| - | -rw-r--r-- 1 root root 463 Feb 1 2021 ssh.xml | + | |
| - | -rw-r--r-- 1 root root 631 Feb 1 2021 steam-streaming.xml | + | |
| - | -rw-r--r-- 1 root root 287 Feb 1 2021 svdrp.xml | + | |
| - | -rw-r--r-- 1 root root 231 Feb 1 2021 svn.xml | + | |
| - | -rw-r--r-- 1 root root 297 Feb 1 2021 syncthing-gui.xml | + | |
| - | -rw-r--r-- 1 root root 311 Feb 1 2021 syncthing.xml | + | |
| - | -rw-r--r-- 1 root root 496 Feb 1 2021 synergy.xml | + | |
| - | -rw-r--r-- 1 root root 444 Feb 1 2021 syslog-tls.xml | + | |
| - | -rw-r--r-- 1 root root 329 Feb 1 2021 syslog.xml | + | |
| - | -rw-r--r-- 1 root root 393 Feb 1 2021 telnet.xml | + | |
| - | -rw-r--r-- 1 root root 252 Feb 1 2021 tentacle.xml | + | |
| - | -rw-r--r-- 1 root root 288 Feb 1 2021 tftp-client.xml | + | |
| - | -rw-r--r-- 1 root root 424 Feb 1 2021 tftp.xml | + | |
| - | -rw-r--r-- 1 root root 221 Feb 1 2021 tile38.xml | + | |
| - | -rw-r--r-- 1 root root 336 Feb 1 2021 tinc.xml | + | |
| - | -rw-r--r-- 1 root root 771 Feb 1 2021 tor-socks.xml | + | |
| - | -rw-r--r-- 1 root root 244 Feb 1 2021 transmission-client.xml | + | |
| - | -rw-r--r-- 1 root root 264 Feb 1 2021 upnp-client.xml | + | |
| - | -rw-r--r-- 1 root root 593 Feb 1 2021 vdsm.xml | + | |
| - | -rw-r--r-- 1 root root 475 Feb 1 2021 vnc-server.xml | + | |
| - | -rw-r--r-- 1 root root 310 Feb 1 2021 wbem-https.xml | + | |
| - | -rw-r--r-- 1 root root 352 Feb 1 2021 wbem-http.xml | + | |
| - | -rw-r--r-- 1 root root 323 Feb 1 2021 wsmans.xml | + | |
| - | -rw-r--r-- 1 root root 316 Feb 1 2021 wsman.xml | + | |
| - | -rw-r--r-- 1 root root 329 Feb 1 2021 xdmcp.xml | + | |
| - | -rw-r--r-- 1 root root 509 Feb 1 2021 xmpp-bosh.xml | + | |
| - | -rw-r--r-- 1 root root 488 Feb 1 2021 xmpp-client.xml | + | |
| - | -rw-r--r-- 1 root root 264 Feb 1 2021 xmpp-local.xml | + | |
| - | -rw-r--r-- 1 root root 545 Feb 1 2021 xmpp-server.xml | + | |
| - | -rw-r--r-- 1 root root 314 Feb 1 2021 zabbix-agent.xml | + | |
| - | -rw-r--r-- 1 root root 315 Feb 1 2021 zabbix-server.xml | + | |
| - | + | ||
| - | / | + | |
| - | total 40 | + | |
| - | -rw-r--r-- 1 root root 299 Feb 1 2021 block.xml | + | |
| - | -rw-r--r-- 1 root root 293 Feb 1 2021 dmz.xml | + | |
| - | -rw-r--r-- 1 root root 291 Feb 1 2021 drop.xml | + | |
| - | -rw-r--r-- 1 root root 304 Feb 1 2021 external.xml | + | |
| - | -rw-r--r-- 1 root root 369 Feb 1 2021 home.xml | + | |
| - | -rw-r--r-- 1 root root 384 Feb 1 2021 internal.xml | + | |
| - | -rw-r--r-- 1 root root 729 Apr 12 2021 nm-shared.xml | + | |
| - | -rw-r--r-- 1 root root 315 Feb 1 2021 public.xml | + | |
| - | -rw-r--r-- 1 root root 162 Feb 1 2021 trusted.xml | + | |
| - | -rw-r--r-- 1 root root 311 Feb 1 2021 work.xml | + | |
| </ | </ | ||
| - | Ces fichiers sont au format **xml**, par exemple | + | Le noyau se désinstalle comme tout autre paquet |
| < | < | ||
| - | root@debian11: | + | root@debian11:/ |
| - | < | + | Reading package lists... Done |
| - | < | + | Building dependency tree... Done |
| - | | + | Reading state information... Done |
| - | < | + | The following packages will be REMOVED: |
| - | < | + | |
| - | < | + | 0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded. |
| - | < | + | After this operation, 15.1 MB disk space will be freed. |
| - | </zone> | + | (Reading database ... 118012 files and directories currently installed.) |
| + | Removing linux-image-5.11.1 (5.11.1-1) ... | ||
| + | update-initramfs: Deleting | ||
| + | Generating grub configuration file ... | ||
| + | Found background image: / | ||
| + | Found linux image: | ||
| + | Found initrd image: / | ||
| + | done | ||
| + | (Reading database ... 117967 files and directories currently installed.) | ||
| + | Purging configuration files for linux-image-5.11.1 (5.11.1-1) ... | ||
| </ | </ | ||
| - | La configuration de firewalld ainsi que les définitions et règles personnalisées se trouvent dans **/ | + | Vérifiez |
| < | < | ||
| - | root@debian11: | + | root@debian11:/ |
| - | / | + | root@debian11:/home/trainee# |
| - | total 32 | + | |
| - | -rw-r--r-- 1 root root 2745 Feb 1 2021 firewalld.conf | + | |
| - | drwxr-xr-x 2 root root 4096 Feb 1 2021 helpers | + | |
| - | drwxr-xr-x 2 root root 4096 Feb 1 2021 icmptypes | + | |
| - | drwxr-xr-x 2 root root 4096 Feb 1 2021 ipsets | + | |
| - | -rw-r--r-- 1 root root 268 Feb 1 2021 lockdown-whitelist.xml | + | |
| - | drwxr-xr-x 2 root root 4096 Feb | + | |
| - | drwxr-xr-x 2 root root 4096 Feb 1 2021 services | + | |
| - | drwxr-xr-x 2 root root 4096 Feb 1 2021 zones | + | |
| - | + | ||
| - | /etc/firewalld/helpers: | + | |
| - | total 0 | + | |
| - | + | ||
| - | / | + | |
| - | total 0 | + | |
| - | + | ||
| - | /etc/firewalld/ | + | |
| - | total 0 | + | |
| - | + | ||
| - | / | + | |
| - | total 0 | + | |
| - | + | ||
| - | / | + | |
| - | total 0 | + | |
| - | + | ||
| - | / | + | |
| - | total 0 | + | |
| </ | </ | ||
| - | Le fichier de configuration de firewalld est **/ | + | Dernièrement, |
| < | < | ||
| - | root@debian11: | + | root@debian11:/ |
| - | # firewalld config file | + | linux-image-5.10.0-13-amd64 |
| - | + | linux-image-amd64 | |
| - | # default zone | + | |
| - | # The default zone used if an empty zone string is used. | + | |
| - | # Default: public | + | |
| - | DefaultZone=public | + | |
| - | + | ||
| - | # Clean up on exit | + | |
| - | # If set to no or false the firewall configuration will not get cleaned up | + | |
| - | # on exit or stop of firewalld | + | |
| - | # Default: yes | + | |
| - | CleanupOnExit=yes | + | |
| - | + | ||
| - | # Lockdown | + | |
| - | # If set to enabled, firewall changes with the D-Bus interface will be limited | + | |
| - | # to applications that are listed in the lockdown whitelist. | + | |
| - | # The lockdown whitelist file is lockdown-whitelist.xml | + | |
| - | # Default: no | + | |
| - | Lockdown=no | + | |
| - | + | ||
| - | # IPv6_rpfilter | + | |
| - | # Performs a reverse path filter test on a packet for IPv6. If a reply to the | + | |
| - | # packet would be sent via the same interface that the packet arrived on, the | + | |
| - | # packet will match and be accepted, otherwise dropped. | + | |
| - | # The rp_filter for IPv4 is controlled using sysctl. | + | |
| - | # Default: yes | + | |
| - | IPv6_rpfilter=yes | + | |
| - | + | ||
| - | # IndividualCalls | + | |
| - | # Do not use combined | + | |
| - | # time that is needed to apply changes and to start the daemon, but is good for | + | |
| - | # debugging. | + | |
| - | # Default: no | + | |
| - | IndividualCalls=no | + | |
| - | + | ||
| - | # LogDenied | + | |
| - | # Add logging rules right before reject and drop rules in the INPUT, FORWARD | + | |
| - | # and OUTPUT chains for the default rules and also final reject and drop rules | + | |
| - | # in zones. Possible values are: all, unicast, broadcast, multicast and off. | + | |
| - | # Default: off | + | |
| - | LogDenied=off | + | |
| - | + | ||
| - | # FirewallBackend | + | |
| - | # Selects the firewall backend implementation. | + | |
| - | # Choices are: | + | |
| - | # - nftables (default) | + | |
| - | # - iptables (iptables, ip6tables, ebtables and ipset) | + | |
| - | FirewallBackend=nftables | + | |
| - | + | ||
| - | # FlushAllOnReload | + | |
| - | # Flush all runtime rules on a reload. In previous releases some runtime | + | |
| - | # configuration was retained during a reload, namely; interface to zone | + | |
| - | # assignment, and direct rules. This was confusing to users. To get the old | + | |
| - | # behavior set this to " | + | |
| - | # Default: yes | + | |
| - | FlushAllOnReload=yes | + | |
| - | + | ||
| - | # RFC3964_IPv4 | + | |
| - | # As per RFC 3964, filter IPv6 traffic with 6to4 destination addresses that | + | |
| - | # correspond to IPv4 addresses that should not be routed over the public | + | |
| - | # internet. | + | |
| - | # Defaults to " | + | |
| - | RFC3964_IPv4=yes | + | |
| - | + | ||
| - | # AllowZoneDrifting | + | |
| - | # Older versions of firewalld had undocumented behavior known as " | + | |
| - | # drifting" | + | |
| - | # violation of zone based firewalls. However, some users rely on this behavior | + | |
| - | # to have a "catch-all" zone, e.g. the default zone. You can enable this if you | + | |
| - | # desire such behavior. It's disabled by default for security reasons. | + | |
| - | # Note: If " | + | |
| - | # based zones (including the default zone). Packets never drift from interface | + | |
| - | # based zones to other interfaces based zones (including the default zone). | + | |
| - | # Possible values; " | + | |
| - | AllowZoneDrifting=no | + | |
| </ | </ | ||
| - | ===La Commande firewall-cmd=== | + | =====LAB #2 - Mise à Jour du Noyau avec le Gestionnaire des Paquets===== |
| - | firewalld s'appuie sur netfilter. Pour cette raison, l' | + | Afin d'obtenir la **dernière version du noyau pré-compliée** par Debian, il convient d' |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - firewall-cmd est le front-end de firewalld en ligne de commande. Il existe aussi la commande | + | |
| - | </ | + | |
| - | + | ||
| - | Pour obtenir la liste de toutes les zones prédéfinies, | + | |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | block dmz drop external | + | deb http:// |
| + | root@debian11:/ | ||
| + | deb-src http:// | ||
| </ | </ | ||
| - | Pour obtenir la liste de toutes les services prédéfinis, utilisez la commande suivante | + | Afin de ne faire que des mises à jour du **noyau** à partir de ce dépôt, créez le fichier **/ |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | RH-Satellite-6 RH-Satellite-6-capsule amanda-client amanda-k5-client amqp amqps apcupsd audit bacula bacula-client bb bgp bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc bittorrent-lsd ceph ceph-mon cfengine cockpit collectd condor-collector ctdb dhcp dhcpv6 dhcpv6-client distcc dns dns-over-tls docker-registry docker-swarm dropbox-lansync elasticsearch etcd-client etcd-server finger foreman foreman-proxy freeipa-4 freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp ganglia-client ganglia-master git grafana gre high-availability http https imap imaps ipp ipp-client ipsec irc ircs iscsi-target isns jenkins kadmin kdeconnect kerberos kibana klogin kpasswd kprop kshell kube-apiserver ldap ldaps libvirt libvirt-tls lightning-network llmnr managesieve matrix mdns memcache minidlna mongodb mosh mountd mqtt mqtt-tls ms-wbt mssql murmur mysql nbd nfs nfs3 nmea-0183 nrpe ntp nut openvpn ovirt-imageio ovirt-storageconsole ovirt-vmconsole plex pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy prometheus proxy-dhcp ptp pulseaudio puppetmaster quassel radius rdp redis redis-sentinel rpc-bind rquotad rsh rsyncd rtsp salt-master samba samba-client samba-dc sane sip sips slp smtp smtp-submission smtps snmp snmptrap spideroak-lansync spotify-sync squid ssdp ssh steam-streaming svdrp svn syncthing syncthing-gui synergy syslog syslog-tls telnet tentacle tftp tftp-client tile38 tinc tor-socks transmission-client upnp-client vdsm vnc-server wbem-http wbem-https wsman wsmans xdmcp xmpp-bosh xmpp-client xmpp-local xmpp-server zabbix-agent zabbix-server | + | root@debian11:/ |
| - | </ | + | Package: * |
| + | Pin: release a=bullseye | ||
| + | Pin-Priority: 500 | ||
| - | Pour obtenir la liste de toutes les types ICMP prédéfinis, | + | Package: linux-image-amd64 |
| + | Pin: release a=unstable | ||
| + | Pin-Priority: | ||
| - | < | + | Package: * |
| - | root@debian11:~# firewall-cmd --get-icmptypes | + | Pin: release a=unstable |
| - | address-unreachable bad-header beyond-scope communication-prohibited destination-unreachable echo-reply echo-request failed-policy fragmentation-needed host-precedence-violation host-prohibited host-redirect host-unknown host-unreachable ip-header-bad neighbour-advertisement neighbour-solicitation network-prohibited network-redirect network-unknown network-unreachable no-route packet-too-big parameter-problem port-unreachable precedence-cutoff protocol-unreachable redirect reject-route required-option-missing router-advertisement router-solicitation source-quench source-route-failed time-exceeded timestamp-reply timestamp-request tos-host-redirect tos-host-unreachable tos-network-redirect tos-network-unreachable ttl-zero-during-reassembly ttl-zero-during-transit unknown-header-type unknown-option | + | Pin-Priority: 100 |
| </ | </ | ||
| - | Pour obtenir la liste des zones de la configuration courante, utilisez la commande suivante | + | Mettez à jour apt : |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | public | + | Hit:1 http:// |
| - | | + | Hit:2 http:// |
| + | Get:3 http:// | ||
| + | Get:4 http:// | ||
| + | Get:5 http:// | ||
| + | Get:6 http:// | ||
| + | Get:7 http:// | ||
| + | Get:8 http:// | ||
| + | Get:9 http:// | ||
| + | Get:10 http:// | ||
| + | Get:11 http:// | ||
| + | Get:12 http:// | ||
| + | Get:13 http:// | ||
| + | Fetched 26.3 MB in 5s (4,955 kB/s) | ||
| + | Reading package lists... Done | ||
| + | Building dependency tree... Done | ||
| + | Reading state information... Done | ||
| + | 2 packages can be upgraded. Run 'apt list --upgradable' | ||
| </ | </ | ||
| - | Pour obtenir la liste des zones de la configuration courante pour une interface spécifique, | + | Installez ensuite les mises-à-jour du noyau : |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | public | + | |
| </ | </ | ||
| - | Pour obtenir la liste des services autorisés pour la zone public, utilisez la commande suivante | + | Re-démarrez votre VM : |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | dhcpv6-client ssh | + | |
| </ | </ | ||
| - | Pour obtenir toute la configuration pour la zone public, utilisez la commande suivante | + | Connectez-vous de nouveau à la VM et contrôlez |
| < | < | ||
| - | root@debian11:~# firewall-cmd --zone=public | + | trainee@debian11:~$ uname -a |
| - | public (active) | + | Linux debian11 5.17.0-1-amd64 #1 SMP PREEMPT Debian 5.17.3-1 (2022-04-18) x86_64 GNU/Linux |
| - | target: default | + | |
| - | icmp-block-inversion: | + | |
| - | interfaces: ens18 | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ssh | + | |
| - | ports: | + | |
| - | protocols: | + | |
| - | forward: no | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | source-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| </ | </ | ||
| - | Pour obtenir la liste complète de toutes les zones et leurs configurations, | + | Déconnectez-vous |
| - | < | + | =====LAB |
| - | root@debian11: | + | |
| - | block | + | |
| - | target: %%REJECT%% | + | |
| - | icmp-block-inversion: | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: | + | |
| - | ports: | + | |
| - | protocols: | + | |
| - | forward: no | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | source-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | dmz | + | Sous Linux il est possible de mettre en place des quotas par utilisateur et par groupe. Ceci étant, Linux ne sait pas gérer des quotas par répertoire, |
| - | | + | quotas par partition. L' |
| - | icmp-block-inversion: | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: ssh | + | |
| - | ports: | + | |
| - | protocols: | + | |
| - | forward: no | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | source-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | drop | + | Commencez par vérifiez que le paquet **quota** est bien installé |
| - | target: DROP | + | |
| - | icmp-block-inversion: | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: | + | |
| - | ports: | + | |
| - | protocols: | + | |
| - | forward: no | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | source-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | external | + | |
| - | target: default | + | |
| - | icmp-block-inversion: | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: ssh | + | |
| - | ports: | + | |
| - | protocols: | + | |
| - | forward: no | + | |
| - | masquerade: yes | + | |
| - | forward-ports: | + | |
| - | source-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | home | + | |
| - | target: default | + | |
| - | icmp-block-inversion: | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: dhcpv6-client mdns samba-client ssh | + | |
| - | ports: | + | |
| - | protocols: | + | |
| - | forward: no | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | source-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | internal | + | |
| - | target: default | + | |
| - | icmp-block-inversion: | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: dhcpv6-client mdns samba-client ssh | + | |
| - | ports: | + | |
| - | protocols: | + | |
| - | forward: no | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | source-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | nm-shared | + | |
| - | target: ACCEPT | + | |
| - | icmp-block-inversion: | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: dhcp dns ssh | + | |
| - | ports: | + | |
| - | protocols: icmp ipv6-icmp | + | |
| - | forward: no | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | source-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | rule priority=" | + | |
| - | + | ||
| - | public (active) | + | |
| - | target: default | + | |
| - | icmp-block-inversion: | + | |
| - | interfaces: ens18 | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ssh | + | |
| - | ports: | + | |
| - | protocols: | + | |
| - | forward: no | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | source-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | trusted | + | |
| - | target: ACCEPT | + | |
| - | icmp-block-inversion: | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: | + | |
| - | ports: | + | |
| - | protocols: | + | |
| - | forward: no | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | source-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | work | + | |
| - | target: default | + | |
| - | icmp-block-inversion: | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ssh | + | |
| - | ports: | + | |
| - | protocols: | + | |
| - | forward: no | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | source-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| + | < | ||
| + | root@debian11: | ||
| + | root@debian11: | ||
| </ | </ | ||
| - | Pour changer la zone par défaut de public | + | Editez le fichier **/ |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | success | + | root@debian11: |
| - | root@debian11: | + | # /etc/fstab: static file system information. |
| - | work | + | # |
| - | | + | # Use ' |
| + | # device; this may be used with UUID= as a more robust way to name devices | ||
| + | # that works even if disks are added and removed. See fstab(5). | ||
| + | # | ||
| + | # systemd generates mount units based on this file, see systemd.mount(5). | ||
| + | # Please run ' | ||
| + | # | ||
| + | # <file system> <mount point> | ||
| + | # / was on /dev/sda1 during installation | ||
| + | UUID=9887a74f-a680-4bde-8f04-db5ae9ea186e / | ||
| + | UUID=24f1821e-1d5b-4256-8ee3-c9ee6b382ddc /home | ||
| + | # swap was on /dev/sda5 during installation | ||
| + | UUID=1f9439f5-4b19-49b1-b292-60c2c674cee9 none swap sw 0 0 | ||
| + | / | ||
| </ | </ | ||
| - | HERE | + | Démontez puis remontez /home : |
| - | + | ||
| - | Pour ajouter l' | + | |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | success | + | root@debian11: |
| - | root@debian11: | + | |
| - | work | + | |
| - | interfaces: ens18 ip_fixe | + | |
| </ | </ | ||
| - | Pour supprimer l' | + | Vérifiez ensuite que les options soient prises en compte |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | success | + | sysfs /sys sysfs rw, |
| - | root@debian11: | + | proc /proc proc rw, |
| - | work | + | udev /dev devtmpfs rw, |
| - | | + | devpts /dev/pts devpts rw, |
| + | tmpfs /run tmpfs rw, | ||
| + | /dev/sda1 / ext4 rw, | ||
| + | securityfs / | ||
| + | tmpfs /dev/shm tmpfs rw, | ||
| + | tmpfs /run/lock tmpfs rw, | ||
| + | cgroup2 / | ||
| + | pstore / | ||
| + | bpf /sys/fs/bpf bpf rw, | ||
| + | systemd-1 / | ||
| + | mqueue /dev/mqueue mqueue rw, | ||
| + | hugetlbfs / | ||
| + | tracefs / | ||
| + | debugfs / | ||
| + | configfs / | ||
| + | fusectl / | ||
| + | tmpfs /run/user/0 tmpfs rw, | ||
| + | /dev/sdb1 /home ext4 rw, | ||
| </ | </ | ||
| - | Pour ajouter le service **http** à la zone **work**, utilisez la commande suivante | + | ====3.1 - La Commande quotacheck==== |
| + | |||
| + | Pour activer les quotas sur /home, il convient d' | ||
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | success | + | quotacheck: Your kernel probably supports ext4 quota feature but you are using external quota files. Please switch your filesystem to use ext4 quota feature as external quota files on ext4 are deprecated. |
| - | root@debian11:~# firewall-cmd --zone=work --list-services | + | quotacheck: Scanning /dev/sdb1 [/home] done |
| - | dhcpv6-client http ssh | + | quotacheck: Cannot stat old user quota file / |
| + | quotacheck: Cannot stat old group quota file / | ||
| + | quotacheck: Cannot stat old user quota file / | ||
| + | quotacheck: Cannot stat old group quota file / | ||
| + | quotacheck: Checked 7199 directories and 81583 files | ||
| + | quotacheck: Old file not found. | ||
| + | quotacheck: Old file not found. | ||
| </ | </ | ||
| - | Pour supprimer le service **http** | + | Les options |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | success | + | Utility for checking and repairing quota files. |
| - | root@debian11: | + | quotacheck [-gucbfinvdmMR] [-F <quota-format>] filesystem|-a |
| - | dhcpv6-client ssh | + | |
| - | </ | + | |
| - | Pour ajouter un nouveau bloc ICMP, utilisez la commande suivante : | + | -u, --user |
| + | -g, --group | ||
| + | -c, --create-files | ||
| + | -b, --backup | ||
| + | -f, --force | ||
| + | -i, --interactive | ||
| + | -n, --use-first-dquot | ||
| + | -v, --verbose | ||
| + | -d, --debug | ||
| + | -m, --no-remount | ||
| + | -M, --try-remount | ||
| + | continue even if it fails | ||
| + | -R, --exclude-root | ||
| + | -F, --format=formatname | ||
| + | -a, --all check all filesystems | ||
| + | -h, --help | ||
| + | -V, --version | ||
| - | < | + | Bugs to jack@suse.cz |
| - | root@debian11:~# firewall-cmd --zone=work --add-icmp-block=echo-reply | + | |
| - | success | + | |
| - | root@debian11: | + | |
| - | echo-reply | + | |
| </ | </ | ||
| - | Pour supprimer un bloc ICMP, utilisez la commande suivante | + | Les quotas ont été activés et les fichier **aquota.user** et **aquota.group** ont été créés dans le répertoire /home : |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | success | + | total 44 |
| - | root@debian11:~# firewall-cmd --zone=work | + | drwxr-xr-x 4 root root 4096 May 1 18:05 . |
| - | + | drwxr-xr-x 20 root root 4096 May 1 17:41 .. | |
| - | root@debian11:~# | + | -rw------- 1 root |
| + | -rw------- 1 root root 7168 May 1 18:05 aquota.user | ||
| + | drwx------ | ||
| + | drwxr-xr-x 15 trainee trainee | ||
| </ | </ | ||
| - | Pour ajouter | + | Créez maintenant un utilisateur **fenestros** avec le mot de passe **fenestros** |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | success | + | root@debian11: |
| - | root@debian11: | + | New password: fenestros |
| - | 591/tcp | + | Retype new password: fenestros |
| + | passwd: password updated successfully | ||
| </ | </ | ||
| - | Pour supprimer le port 591/tcp à la zone work, utilisez la commande suivante : | + | ====3.2 - La Commande edquota==== |
| - | < | + | Mettez en place maintenant un quota de 10Mo pour l' |
| - | root@debian11:~# firewall-cmd --zone=work --remove-port=591/ | + | |
| - | success | + | |
| - | root@debian11: | + | |
| - | root@debian11:~# | + | < |
| + | root@debian8:~# EDITOR=/ | ||
| + | root@debian8: | ||
| + | root@debian8: | ||
| </ | </ | ||
| - | Pour créer | + | L' |
| - | * copier un fichier existant se trouvant dans le répertoire **/ | + | < |
| - | | + | Disk quotas for user fenestros (uid 1001): |
| - | | + | |
| - | * vérifier que firewalld voit le nouveau service. | + | |
| + | </ | ||
| - | Par exemple | + | Modifiez ce fichier ainsi : |
| - | <code> | + | <file> |
| - | root@debian11:~# cp /usr/lib/firewalld/ | + | Disk quotas for user fenestros (uid 1001): |
| + | Filesystem | ||
| + | | ||
| + | </file> | ||
| - | root@debian11:~# cat / | + | Les options de la commande **edquota** sont : |
| - | <?xml version=" | + | |
| - | < | + | |
| - | < | + | |
| - | < | + | |
| - | <port protocol=" | + | |
| - | </ | + | |
| - | root@debian11: | + | < |
| - | + | root@debian11: | |
| - | root@debian11:~# cat / | + | edquota: Usage: |
| - | <?xml version=" | + | edquota [-rm] [-u] [-F formatname] [-p username] [-f filesystem] username ... |
| - | < | + | |
| - | < | + | edquota [-rm] -P [-F formatname] [-p projectname] [-f filesystem] projectname ... |
| - | < | + | |
| - | <port protocol=" | + | |
| - | </ | + | |
| - | root@debian11: | + | -u, --user edit user data |
| - | success | + | -g, --group |
| + | -P, --project | ||
| + | -r, --remote | ||
| + | -m, --no-mixed-pathnames | ||
| + | -F, --format=formatname | ||
| + | -p, --prototype=name | ||
| + | --always-resolve | ||
| + | composed only of digits | ||
| + | -f, --filesystem=filesystem | ||
| + | -t, --edit-period | ||
| + | -T, --edit-times | ||
| + | -h, --help | ||
| + | -V, --version | ||
| - | root@debian11:~# firewall-cmd --get-services | + | Bugs to: jack@suse.cz |
| - | RH-Satellite-6 RH-Satellite-6-capsule amanda-client amanda-k5-client amqp amqps apcupsd audit bacula bacula-client bb bgp bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc bittorrent-lsd ceph ceph-mon cfengine cockpit collectd condor-collector ctdb dhcp dhcpv6 dhcpv6-client distcc dns dns-over-tls docker-registry docker-swarm dropbox-lansync elasticsearch etcd-client etcd-server filemaker finger foreman foreman-proxy freeipa-4 freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp ganglia-client ganglia-master git grafana gre high-availability http https imap imaps ipp ipp-client ipsec irc ircs iscsi-target isns jenkins kadmin kdeconnect kerberos kibana klogin kpasswd kprop kshell kube-apiserver ldap ldaps libvirt libvirt-tls lightning-network llmnr managesieve matrix mdns memcache minidlna mongodb mosh mountd mqtt mqtt-tls ms-wbt mssql murmur mysql nbd nfs nfs3 nmea-0183 nrpe ntp nut openvpn ovirt-imageio ovirt-storageconsole ovirt-vmconsole plex pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy prometheus proxy-dhcp ptp pulseaudio puppetmaster quassel radius rdp redis redis-sentinel rpc-bind rquotad rsh rsyncd rtsp salt-master samba samba-client samba-dc sane sip sips slp smtp smtp-submission smtps snmp snmptrap spideroak-lansync spotify-sync squid ssdp ssh steam-streaming svdrp svn syncthing syncthing-gui synergy syslog syslog-tls telnet tentacle tftp tftp-client tile38 tinc tor-socks transmission-client upnp-client vdsm vnc-server wbem-http wbem-https wsman wsmans xdmcp xmpp-bosh xmpp-client xmpp-local xmpp-server zabbix-agent zabbix-server | + | |
| </ | </ | ||
| - | ===La Configuration Avancée | + | <WRAP center round important> |
| + | **Important** - Pour mettre en place un quota par group, la procédure est similaire. Il suffit d' | ||
| + | </ | ||
| - | La configuration de base de firewalld ne permet que la configuration des zones, services, blocs ICMP et les ports non-standard. Cependant firewalld peut également être configuré avec des **Rich Rules** ou **//Règles Riches//**. Rich Rules ou Règles Riches évaluent des **critères** pour ensuite entreprendre une **action**. | + | ====3.3 - La Commande quotaon==== |
| - | Les **Critères** sont : | + | Appliquez maintenant les quotas |
| - | * **source address=" | + | <code> |
| - | * **destination address="< | + | root@debian11: |
| - | * **rule port port="< | + | </code> |
| - | * **service name=<nom_d' | + | |
| - | Les **Actions** sont : | + | Les options de la commande |
| - | * **accept**, | + | <code> |
| - | * **reject**, | + | root@debian11: |
| - | * une Action reject peut être associée avec un message d' | + | quotaon: Usage: |
| - | * **drop**. | + | quotaon [-guPvp] [-F quotaformat] [-x state] -a |
| + | quotaon [-guPvp] [-F quotaformat] [-x state] filesys ... | ||
| - | Saisissez la commande suivante pour ouvrir le port 80 : | + | -a, --all turn quotas on for all filesystems |
| - | + | -f, --off turn quotas off | |
| - | < | + | -u, --user |
| - | root@debian11: | + | -g, --group operate on group quotas |
| - | success | + | -P, --project |
| + | -p, --print-state | ||
| + | -x, --xfs-command=cmd perform XFS quota command | ||
| + | -F, --format=formatname | ||
| + | -v, --verbose | ||
| + | -h, --help | ||
| + | -V, --version | ||
| </ | </ | ||
| - | <WRAP center round important 50%> | + | De cette manière vous avez mis en place un quota **souple** pour fenestros |
| - | **Important** - Notez que la Rich Rule doit être entourée | + | |
| - | </ | + | |
| - | <WRAP center round important 50%> | + | Quand l' |
| - | **Important** - Notez que la Rich Rule a créé deux règles, une pour IPv4 et une deuxième pour IPv6. Une règle peut être créée | + | |
| + | Il est à noter que vous pouvez soit mettre en place un quota en taille, soit mettre | ||
| + | |||
| + | <WRAP center round important> | ||
| + | **Important** - La commande pour désactivez les quotas est **quotaoff**. | ||
| </ | </ | ||
| - | Cette nouvelle règle est écrite en mémoire mais non pas sur disque. Pour l' | + | ====3.4 - La Commande repquota==== |
| + | |||
| + | Pour visualiser les quotas utilisez la commande | ||
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | success | + | *** Report for user quotas on device |
| - | + | Block grace time: 7days; Inode grace time: 7days | |
| - | root@debian11: | + | Block limits |
| - | <?xml version=" | + | User used soft hard grace used soft hard grace |
| - | < | + | ---------------------------------------------------------------------- |
| - | | + | root -- 241004 |
| - | < | + | trainee |
| - | <service name=" | + | |
| - | <service name=" | + | |
| - | | + | |
| - | < | + | |
| - | < | + | |
| - | </ | + | |
| - | </ | + | |
| </ | </ | ||
| - | <WRAP center round important | + | <WRAP center round important> |
| - | **Important** - Attention ! La règle ajoutée avec l'option --permanent | + | **Important** - Notez que l'utilisateur fenestros ne figure pas dans la liste. Le quota n'est pas visible tant que l' |
| </ | </ | ||
| - | Pour visualiser cette règle dans la configuration de firewalld, il convient | + | Les options |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | success | + | repquota: Utility for reporting quotas. |
| + | Usage: | ||
| + | repquota [-vugsi] [-c|C] [-t|n] [-F quotaformat] [-O (default | xml | csv)] (-a | mntpoint) | ||
| - | root@debian11: | + | -v, --verbose |
| - | work (active) | + | -u, --user display information about users |
| - | | + | -g, --group |
| - | icmp-block-inversion: no | + | -P, --project |
| - | | + | -s, --human-readable[=units] |
| - | | + | ...). Units can be also specified explicitely by |
| - | | + | an optional argument in format [kgt],[kgt] where |
| - | | + | the first character specifies space units and the |
| - | | + | second character specifies inode units |
| - | | + | -t, --truncate-names truncate names to 9 characters |
| - | | + | -p, --raw-grace |
| - | | + | -n, --no-names |
| - | | + | -i, --no-autofs |
| - | icmp-blocks: | + | -c, --cache |
| - | rich rules: | + | -C, --no-cache |
| - | rule port port=" | + | -F, --format=formatname |
| + | -O, --output=format | ||
| + | -a, --all | ||
| + | | ||
| + | -h, --help | ||
| + | -V, --version | ||
| + | Bugs to jack@suse.cz | ||
| </ | </ | ||
| - | Notez que la Rich Rule est créée dans la Zone par Défaut. Il est possible de créer une Rich Rule dans une autre zone en utilisant l'option | + | ====3.5 - La Commande quota==== |
| + | |||
| + | Pour visualiser les quotas d'un utilisateur spécifique, | ||
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | success | + | Disk quotas for user fenestros (uid 1001): no limited resources used |
| - | root@debian11: | + | root@debian11: |
| - | success | + | |
| - | root@debian11:~# firewall-cmd --zone=public --list-all | + | fenestros@debian11:~$ touch test |
| - | public | + | |
| - | target: default | + | |
| - | icmp-block-inversion: | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ssh | + | |
| - | ports: | + | |
| - | protocols: | + | |
| - | forward: no | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | source-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | root@debian11:~# firewall-cmd --zone=public --add-rich-rule=' | + | fenestros@debian11:~$ exit |
| - | success | + | logout |
| - | root@debian11: | + | root@debian11: |
| - | public | + | Disk quotas for user fenestros (uid 1001): |
| - | target: default | + | Filesystem |
| - | | + | / |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ssh | + | |
| - | ports: | + | |
| - | protocols: | + | |
| - | forward: no | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | source-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | root@debian11: | + | |
| - | success | + | |
| - | + | ||
| - | root@debian11: | + | |
| - | public | + | |
| - | target: default | + | |
| - | icmp-block-inversion: | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ssh | + | |
| - | ports: | + | |
| - | protocols: | + | |
| - | forward: no | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | source-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | rule port port=" | + | |
| </ | </ | ||
| - | + | Les options | |
| - | Pour supprimer une Rich Rule, il faut copier la ligne entière la concernant qui se trouve dans la sortie | + | |
| < | < | ||
| - | root@debian11: | + | root@debian11: |
| - | success | + | quota: Usage: quota [-guPqvswim] [-l | [-Q | -A]] [-F quotaformat] |
| + | quota [-qvswim] [-l | [-Q | -A]] [-F quotaformat] -u username ... | ||
| + | quota [-qvswim] [-l | [-Q | -A]] [-F quotaformat] -g groupname ... | ||
| + | quota [-qvswim] [-l | [-Q | -A]] [-F quotaformat] -P projectname ... | ||
| + | quota [-qvswugPQm] [-F quotaformat] -f filesystem ... | ||
| - | root@debian11: | + | -u, --user display quota for user |
| - | public | + | -g, --group |
| - | | + | -P, --project |
| - | icmp-block-inversion: no | + | -q, --quiet |
| - | | + | -v, --verbose |
| - | | + | -s, --human-readable[=units] |
| - | | + | ...). Units can be also specified explicitely by |
| - | | + | an optional argument in format [kgt],[kgt] where |
| - | | + | the first character specifies space units and the |
| - | | + | second character specifies inode units |
| - | | + | |
| - | | + | |
| - | | + | -w, --no-wrap |
| - | icmp-blocks: | + | -p, --raw-grace |
| - | rich rules: | + | -l, --local-only |
| + | -Q, --quiet-refuse | ||
| + | not respond | ||
| + | -i, --no-autofs | ||
| + | -F, --format=formatname | ||
| + | -f, --filesystem-list | ||
| + | filesystems | ||
| + | --filesystem=path | ||
| + | filesystem, remaining command line arguments | ||
| + | are still treated as user/ | ||
| + | -A, --all-nfs | ||
| + | -m, --no-mixed-pathnames | ||
| + | --show-mntpoint | ||
| + | --hide-device | ||
| + | -h, --help | ||
| + | -V, --version | ||
| + | |||
| + | Bugs to: jack@suse.cz | ||
| </ | </ | ||
| - | ===Le mode Panic de firewalld=== | + | ====3.6 - La Commande warnquota==== |
| - | Le mode Panic de firewalld permet de bloquer tout le trafic avec une seule commande. | + | La commande |
| - | < | + | Les options |
| - | root@debian8: | + | |
| - | no | + | |
| - | </ | + | |
| - | + | ||
| - | Pour activer le mode Panic, il convient | + | |
| < | < | ||
| - | # firewall-cmd --panic-on | + | root@debian11: |
| - | </ | + | warnquota: Usage: |
| + | warnquota [-ugsid] [-F quotaformat] [-c configfile] [-q quotatabfile] [-a adminsfile] [filesystem...] | ||
| - | Pour désactiver le mode Panic, il convient de saisir la commande suivante : | + | -u, --user |
| + | -g, --group | ||
| + | -s, --human-readable[=units] | ||
| + | GB, ...). Units can be also specified | ||
| + | explicitely by an optional argument in format | ||
| + | [kgt],[kgt] where the first character specifies | ||
| + | space units and the second character specifies | ||
| + | inode units | ||
| + | -i, --no-autofs | ||
| + | -d, --no-details | ||
| + | -F, --format=formatname | ||
| + | -c, --config=config-file | ||
| + | -q, --quota-tab=quotatab-file | ||
| + | -a, --admins-file=admins-file | ||
| + | -I, --ignore-config-errors | ||
| + | -h, --help | ||
| + | -V, --version | ||
| - | < | + | warnquota: Bugs to jack@suse.cz |
| - | # firewall-cmd --panic-off | + | |
| </ | </ | ||
| - | |||
| ----- | ----- | ||
| - | Copyright © 2023 Hugh Norris. | + | Copyright © 2024 Hugh Norris. |
