Différences
Ci-dessous, les différences entre deux révisions de la page.
| Prochaine révision | Révision précédente | ||
| elearning:workbooks:debian:11:sec:l106 [2025/11/30 15:21] – créée admin | elearning:workbooks:debian:11:sec:l106 [2025/12/07 14:09] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 5: | Ligne 5: | ||
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LDF406 - Balayage des Ports====== | + | ======LDF406 - Sécurité Applicative====== |
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| - | * **LDF406 - Balayage des Ports** | + | * **LDF406 - Sécurité Applicative** |
| * Contenu du Module | * Contenu du Module | ||
| * Le Problématique | * Le Problématique | ||
| - | | + | * Préparation |
| - | * 1.1 - nmap | + | * Les Outils |
| - | * Installation | + | |
| - | * Utilisation | + | * 1.1 - Installation |
| - | * Fichiers de Configuration | + | * 1.2 - Utilisation |
| - | * Scripts | + | * 1.3 - Avertissement important |
| - | * 1.2 - netcat | + | * LAB #2 - Greenbone Vulnerability Management (GVM) |
| - | * Utilisation | + | * 2.1 - Présentation |
| - | * Les Contre-Mesures | + | * 2.2 - Préparation |
| - | * LAB #2 - Mise en place du Système de Détection d' | + | * 2.3 - Installation |
| - | * 2.1 - Installation | + | * 2.4 - Configuration |
| - | * 2.2 - Configuration de Snort | + | * 2.5 - Utilisation |
| - | * Editer le fichier / | + | * 2.6 - Analyse des Résultats |
| - | * 2.3 - Utilisation de snort en mode " | + | * LAB #3 - Sécuriser le Serveur DNS |
| - | * 2.4 - Utilisation | + | * 3.1 - Le Serveur DNS |
| - | * 2.5 - Journalisation | + | * 3.2 - Préparation à l' |
| - | * LAB #3 - Mise en place du Système de Détection et de Prévention d' | + | * 3.3 - Installation |
| - | * 3.1 - Installation | + | * 3.4 - Les fichiers de configuration |
| - | * 3.2 - Configuration | + | * 3.5 - Utilisation |
| - | * 3.3 - Utilisation | + | * 3.6 - Créer les Pairs de Clefs |
| + | * 3.7 - Modifier la Configuration de Bind | ||
| + | * 3.8 - Signer la Zone | ||
| + | * 3.9 - La chaîne de confiance DNS | ||
| =====Le Problématique===== | =====Le Problématique===== | ||
| - | Un **Cheval | + | La plupart des failles |
| - | * Back Orifice 2000 - tcp/8787, tcp/ | + | =====Préparation===== |
| - | * Backdoor - tcp/1999, | + | |
| - | * Subseven - tcp/1243, tcp/ 2773, tcp/ | + | |
| - | * Socket de Troie - tcp/5001, tcp/30303, tcp/50505. | + | |
| - | Le **scan** consiste à balayer les ports d'une machine afin de : | + | =====Les Outils===== |
| - | * connaître les ports qui sont ouverts, | + | ==== LAB #1 - Netwox ==== |
| - | * déterminer le système d' | + | |
| - | * identifier les services ouverts. | + | |
| - | Plusieurs scanners existent dont : | + | Le programme **netwox** est un utilitaire puissant de vérification de la sécurité. |
| - | * nmap | + | ===1.1 - Installation=== |
| - | * netcat | + | |
| - | ====LAB #1 - Utilisation de nmap et de netcat==== | + | Netwox s' |
| - | === 1.1 - nmap === | + | < |
| + | root@debian12: | ||
| - | ==Installation== | + | root@debian12:/ |
| - | Sous Debian 12, **nmap** n'est pas installé par défaut | + | root@debian12:~# apt install netwox -y |
| + | </ | ||
| + | |||
| + | ===1.2 - Utilisation=== | ||
| < | < | ||
| - | root@debian12: | + | root@debian12: |
| - | root@debian12: | + | Netwox toolbox version 5.39.0. Netwib library version 5.39.0. |
| + | |||
| + | ######################## | ||
| + | 0 - leave netwox | ||
| + | 3 - search tools | ||
| + | 4 - display help of one tool | ||
| + | 5 - run a tool selecting parameters on command line | ||
| + | 6 - run a tool selecting parameters from keyboard | ||
| + | a + information | ||
| + | b + network protocol | ||
| + | c + application protocol | ||
| + | d + sniff (capture network packets) | ||
| + | e + spoof (create and send packets) | ||
| + | f + record (file containing captured packets) | ||
| + | g + client | ||
| + | h + server | ||
| + | i + ping (check if a computer if reachable) | ||
| + | j + traceroute (obtain list of gateways) | ||
| + | k + scan (computer and port discovery) | ||
| + | l + network audit | ||
| + | m + brute force (check if passwords are weak) | ||
| + | n + remote administration | ||
| + | o + tools not related to network | ||
| + | Select a node (key in 03456abcdefghijklmno): | ||
| </ | </ | ||
| - | Installez donc nmap en utilisant APT : | + | L' |
| < | < | ||
| - | root@debian12:~# apt install nmap | + | Select a node (key in 03456abcdefghijklmno): l |
| + | |||
| + | ###################### | ||
| + | 0 - leave netwox | ||
| + | 1 - go to main menu | ||
| + | 2 - go to previous menu | ||
| + | 3 - search tools | ||
| + | 4 - display help of one tool | ||
| + | 5 - run a tool selecting parameters on command line | ||
| + | 6 - run a tool selecting parameters from keyboard | ||
| + | a + network audit using Ethernet | ||
| + | b + network audit using IP | ||
| + | c + network audit using TCP | ||
| + | d + network audit using ICMP | ||
| + | e + network audit using ARP | ||
| + | Select a node (key in 0123456abcde): | ||
| </ | </ | ||
| - | ==Utilisation== | + | Choisissez ensuite le menu **c** : |
| - | Pour connaître la liste des ports ouverts | + | < |
| + | Select a node (key in 0123456abcde): | ||
| + | |||
| + | ################# | ||
| + | 0 - leave netwox | ||
| + | 1 - go to main menu | ||
| + | 2 - go to previous menu | ||
| + | 3 - search tools | ||
| + | 4 - display help of one tool | ||
| + | 5 - run a tool selecting parameters on command line | ||
| + | 6 - run a tool selecting parameters from keyboard | ||
| + | a - 76: | ||
| + | b - 77:Check if seqnum are predictible | ||
| + | c - 78:Reset every TCP packet | ||
| + | d - 79: | ||
| + | Select a node (key in 0123456abcd): | ||
| + | </ | ||
| + | |||
| + | Notre choix de test s' | ||
| < | < | ||
| - | root@debian12: | + | Select a node (key in 0123456abcd): a |
| - | Starting Nmap 7.93 ( https:// | + | |
| - | Nmap scan report for localhost (127.0.0.1) | + | |
| - | Host is up (0.0000090s latency). | + | |
| - | Not shown: 996 closed tcp ports (reset) | + | |
| - | PORT STATE SERVICE | + | |
| - | 22/ | + | |
| - | 80/ | + | |
| - | 631/ | + | |
| - | 5900/tcp open vnc | + | |
| - | Nmap done: 1 IP address (1 host up) scanned | + | ################# |
| + | Title: Synflood | ||
| + | +------------------------------------------------------------------------+ | ||
| + | | This tool sends a lot of TCP SYN packets. | ||
| + | | It permits to check how a firewall behaves when receiving packets | ||
| + | | which have to be ignored. | ||
| + | | Parameter --spoofip indicates how to generate link layer for spoofing. | | ||
| + | | Values ' | ||
| + | | is the list of accepted values: | ||
| + | | - ' | ||
| + | | a firewall is installed, or on some systems, this might not work. | | ||
| + | | - ' | ||
| + | | supported). The ' | ||
| + | | However, if source IP address is spoofed, it might be impossible | ||
| + | | to Fill it. So, linkf will not work: use linkb or linkfb instead. | ||
| + | | - ' | ||
| + | | source Ethernet | ||
| + | | - ' | ||
| + | | source Ethernet address, but if it is not possible, it is left | | ||
| + | | Blank. | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | | | ||
| + | | This tool may need to be run with admin privilege in order to spoof. | ||
| + | +------------------------------------------------------------------------+ | ||
| + | Usage: netwox 76 -i ip -p port [-s spoofip] | ||
| + | Parameters: | ||
| + | | ||
| + | | ||
| + | | ||
| + | Example: netwox 76 -i " | ||
| + | Example: netwox 76 --dst-ip " | ||
| + | Press ' | ||
| + | </ | ||
| + | |||
| + | Il convient ensuite d' | ||
| + | |||
| + | Il est a noter que **netwox** | ||
| + | |||
| + | # netwox 76 -i " | ||
| + | |||
| + | ===1.3 - Avertissement important=== | ||
| + | |||
| + | **netwox** est un outil puissant. Il convient de noter que: | ||
| + | |||
| + | * il ne doit pas être installé sur un serveur de production mais sur le poste de l' | ||
| + | * netwox existe aussi en version Windows(tm), | ||
| + | * l' | ||
| + | |||
| + | ====LAB #2 - Greenbone Vulnerability Management (GVM)==== | ||
| + | |||
| + | ===2.1 - Présentation=== | ||
| + | |||
| + | **Greenbone Vulnerability Management (GVM)**, aussi connu sous le nom d' | ||
| + | |||
| + | ===2.2 - Préparation=== | ||
| + | |||
| + | Mettez SELinux en mode permissive et désactivez-le dans le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# setenforce permissive | ||
| + | |||
| + | [root@centos7 ~]# sed -i ' | ||
| + | |||
| + | [root@centos7 ~]# reboot | ||
| + | </ | ||
| + | |||
| + | Insérez une règle dans le pare-feu pour permettre la consultation de l' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# firewall-cmd --zone=public --add-port=9443/ | ||
| + | success | ||
| + | [root@centos7 ~]# firewall-cmd --reload | ||
| + | success | ||
| + | </ | ||
| + | |||
| + | ===2.3 - Installation=== | ||
| + | |||
| + | Téléchargez et installez **epel-release-7-14.noarch.rpm** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# wget https:// | ||
| + | --2025-12-01 15: | ||
| + | Resolving archives.fedoraproject.org (archives.fedoraproject.org)... 38.145.32.23, | ||
| + | Connecting to archives.fedoraproject.org (archives.fedoraproject.org)|38.145.32.23|: | ||
| + | HTTP request sent, awaiting response... 200 OK | ||
| + | Length: 15608 (15K) [application/ | ||
| + | Saving to: ‘epel-release-7-14.noarch.rpm’ | ||
| + | |||
| + | 100%[========================================================================================================================================================================> | ||
| + | |||
| + | 2025-12-01 15:29:01 (532 KB/s) - ‘epel-release-7-14.noarch.rpm’ saved [15608/ | ||
| + | |||
| + | [root@centos7 ~]# yum localinstall epel-release-7-14.noarch.rpm --nogpgcheck | ||
| + | </ | ||
| + | |||
| + | Installez ensuite **openvas-scanner**, | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# yum install openvas-scanner openvas-manager openvas-gsa openvas-cli coreutils openssl | ||
| + | </ | ||
| + | |||
| + | ===2.4 - Configuration=== | ||
| + | |||
| + | Les commandes d' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ls -l / | ||
| + | -rwxr-xr-x. 1 root root 18066 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 2182496 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 37993 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 11998 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 10976 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 766 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 2555 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 38378 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 86640 Sep 6 2016 / | ||
| + | </ | ||
| + | |||
| + | * **/ | ||
| + | * Cette commande permet de générer un certificat SSL, | ||
| + | * **/ | ||
| + | * Cette commande permet la mise à jour des modules d' | ||
| + | * **/ | ||
| + | * Cette commande lance le serveur OpenVAS. | ||
| + | |||
| + | Exécutez maintenant la commande **openvas-check-setup** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# openvas-check-setup | ||
| + | openvas-check-setup 2.3.3 | ||
| + | Test completeness and readiness of OpenVAS-8 | ||
| + | (add ' | ||
| + | if you want to check for another OpenVAS version) | ||
| + | |||
| + | Please report us any non-detected problems and | ||
| + | help us to improve this check routine: | ||
| + | http:// | ||
| + | |||
| + | Send us the log-file (/ | ||
| + | |||
| + | Use the parameter --server to skip checks for client tools | ||
| + | like GSD and OpenVAS-CLI. | ||
| + | |||
| + | Step 1: Checking OpenVAS Scanner ... | ||
| + | OK: OpenVAS Scanner is present in version 5.0.6. | ||
| + | ERROR: No CA certificate file of OpenVAS Scanner found. | ||
| + | FIX: Run ' | ||
| + | |||
| + | | ||
| + | |||
| + | Please follow the instructions marked with FIX above and run this | ||
| + | script again. | ||
| + | |||
| + | If you think this result is wrong, please report your observation | ||
| + | and help us to improve this check routine: | ||
| + | http:// | ||
| + | Please attach the log-file (/ | ||
| </ | </ | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Pour connaître les ports ouverts sur une machine distante, la procédure est identique sauf que vous devez utiliser | + | **Important** - Notez l'erreur **ERROR: No CA certificate file of OpenVAS Scanner found.** |
| </ | </ | ||
| - | ==Fichiers de Configuration== | + | Créez donc un certificat SSL : |
| - | **nmap** utilise un fichier spécifique pour identifier les ports. Ce fichier est **/usr/share/nmap/nmap-services**: | + | < |
| + | [root@centos7 ~]# openvas-mkcert | ||
| + | |||
| + | ------------------------------------------------------------------------------- | ||
| + | Creation of the OpenVAS SSL Certificate | ||
| + | ------------------------------------------------------------------------------- | ||
| + | |||
| + | This script will now ask you the relevant information to create the SSL certificate of OpenVAS. | ||
| + | Note that this information will *NOT* be sent to anybody (everything stays local), but anyone with the ability to connect to your OpenVAS daemon will be able to retrieve this information. | ||
| + | |||
| + | |||
| + | CA certificate life time in days [1460]: 3650 | ||
| + | Server certificate life time in days [365]: 3650 | ||
| + | Your country (two letter code) [DE]: UK | ||
| + | Your state or province name [none]: SURREY | ||
| + | Your location (e.g. town) [Berlin]: ADDLESTONE | ||
| + | Your organization [OpenVAS Users United]: I2TCH LIMITED | ||
| + | |||
| + | ------------------------------------------------------------------------------- | ||
| + | Creation of the OpenVAS SSL Certificate | ||
| + | ------------------------------------------------------------------------------- | ||
| + | |||
| + | Congratulations. Your server certificate was properly created. | ||
| + | |||
| + | The following files were created: | ||
| + | |||
| + | . Certification authority: | ||
| + | | ||
| + | | ||
| + | |||
| + | . OpenVAS Server : | ||
| + | Certificate = / | ||
| + | Private key = / | ||
| + | |||
| + | Press [ENTER] to exit | ||
| + | |||
| + | [Entrée] | ||
| + | [root@centos7 ~]# | ||
| + | </ | ||
| + | |||
| + | Exécutez de nouveau la commande **openvas-check-setup** : | ||
| < | < | ||
| - | root@debian12:~# more /usr/share/nmap/nmap-services | + | [root@centos7 |
| - | # THIS FILE IS GENERATED AUTOMATICALLY FROM A MASTER | + | openvas-check-setup 2.3.3 |
| - | # EDIT /nmap-private-dev/nmap-services-all IN SVN INSTEAD. | + | Test completeness and readiness of OpenVAS-8 |
| - | # Well known service | + | (add ' |
| - | # From the Nmap Security | + | if you want to check for another OpenVAS version) |
| + | |||
| + | Please report us any non-detected problems and | ||
| + | help us to improve this check routine: | ||
| + | http://lists.wald.intevation.org/mailman/listinfo/ | ||
| + | |||
| + | Send us the log-file (/ | ||
| + | |||
| + | Use the parameter --server to skip checks for client tools | ||
| + | like GSD and OpenVAS-CLI. | ||
| + | |||
| + | Step 1: Checking OpenVAS Scanner ... | ||
| + | OK: OpenVAS Scanner is present in version 5.0.6. | ||
| + | OK: OpenVAS Scanner CA Certificate is present as / | ||
| + | / | ||
| + | ERROR: No redis-server installation found. | ||
| + | FIX: You should install redis-server for improved scalability and ability to trace/debug the KB | ||
| + | |||
| + | | ||
| + | |||
| + | Please follow the instructions marked with FIX above and run this | ||
| + | script again. | ||
| + | |||
| + | If you think this result is wrong, please report your observation | ||
| + | and help us to improve this check routine: | ||
| + | http:// | ||
| + | Please attach the log-file (/ | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | Installez donc **redis** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# yum install redis | ||
| + | </ | ||
| + | |||
| + | Activez les deux lignes suivantes dans le fichier **/ | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | # unixsocket / | ||
| + | # unixsocketperm 700... | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# sed -i '/ | ||
| + | </ | ||
| + | |||
| + | Ajoutez la ligne **kb_location = / | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | # KB test replay : | ||
| + | kb_dont_replay_scanners = no | ||
| + | kb_dont_replay_info_gathering = no | ||
| + | kb_dont_replay_attacks = no | ||
| + | kb_dont_replay_denials = no | ||
| + | kb_max_age = 864000 | ||
| + | kb_location = /tmp/ | ||
| + | #--- end of the KB section | ||
| + | ... | ||
| + | </file> | ||
| + | |||
| + | Activez et démarrez le service **redis** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# systemctl enable redis | ||
| + | Created symlink from / | ||
| + | |||
| + | [root@centos7 ~]# systemctl start redis | ||
| + | |||
| + | [root@centos7 ~]# systemctl status redis | ||
| + | ● redis.service - Redis persistent key-value database | ||
| + | | ||
| + | Drop-In: / | ||
| + | | ||
| + | | ||
| + | Main PID: 13037 (redis-server) | ||
| + | | ||
| + | | ||
| + | |||
| + | Dec 01 15:45:16 centos7.fenestros.loc systemd[1]: Starting Redis persistent key-value database... | ||
| + | Dec 01 15:45:16 centos7.fenestros.loc systemd[1]: Started Redis persistent key-value database. | ||
| + | </ | ||
| + | |||
| + | Exécutez encore une fois la commande | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# openvas-check-setup | ||
| + | ... | ||
| + | Step 1: Checking OpenVAS | ||
| + | OK: OpenVAS Scanner is present in version 5.0.6. | ||
| + | OK: OpenVAS Scanner CA Certificate is present as / | ||
| + | OK: redis-server is present in version v=3.2.10. | ||
| + | OK: scanner | ||
| + | OK: redis-server is running and listening on socket: / | ||
| + | OK: redis-server configuration is OK and redis-server is running. | ||
| + | ERROR: The NVT collection is very small. | ||
| + | FIX: Run a synchronization script like openvas-nvt-sync or greenbone-nvt-sync. | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | Téléchargez le script **greenbone-nvt-sync** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# wget https://www.dropbox.com/scl/ | ||
| + | |||
| + | [root@centos7 ~]# mv greenbone-nvt-sync? | ||
| + | </ | ||
| + | |||
| + | Si vous ne pouvez pas téléchargez le script **greenbone-nvt-sync**, | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# vi greenbone-nvt-sync | ||
| + | [root@centos7 ~]# cat greenbone-nvt-sync | ||
| + | #!/bin/sh | ||
| + | # Copyright (C) 2009-2021 Greenbone Networks GmbH | ||
| # | # | ||
| - | # $Id: nmap-services 38442 2022-08-31 22:53:46Z dmiller $ | + | # SPDX-License-Identifier: GPL-2.0-or-later |
| # | # | ||
| - | # Derived from IANA data and our own research | + | # This program is free software; you can redistribute it and/or |
| + | # modify it under the terms of the GNU General Public License | ||
| + | # as published by the Free Software Foundation; either version 2 | ||
| + | # of the License, or (at your option) any later version. | ||
| # | # | ||
| - | # This collection of service data is (C) 1996-2020 by Insecure.Com | + | # This program |
| - | # LLC. It is distributed | + | # but WITHOUT ANY WARRANTY; without even the implied warranty |
| - | # provided | + | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| - | # https:// | + | # GNU General Public License for more details. |
| - | # requires you to license your own work under a compatable open source | + | |
| - | # license. | + | |
| - | # software, we sell alternative licenses (contact sales@insecure.com). | + | |
| - | # Dozens | + | |
| - | # host discovery, port scanning, OS detection, and version detection. | + | |
| - | # For more details, see https:// | + | |
| # | # | ||
| - | # Fields in this file are: Service | + | # You should have received a copy of the GNU General Public License |
| + | # along with this program; if not, write to the Free Software | ||
| + | # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. | ||
| + | |||
| + | # This script updates the local Network Vulnerability Tests (NVTs) from the | ||
| + | # Greenbone Security Feed (GSF) or the Greenbone Community Feed (GCF). | ||
| + | |||
| + | VERSION=@OPENVAS_VERSION@ | ||
| + | |||
| + | # SETTINGS | ||
| + | # ======== | ||
| + | |||
| + | # PRIVATE_SUBDIR defines a subdirectory of the NVT directory that is excluded | ||
| + | # from the feed sync. This is where to place your own NVTs. | ||
| + | if [ -z " | ||
| + | then | ||
| + | PRIVATE_SUBDIR=" | ||
| + | fi | ||
| + | |||
| + | # RSYNC_DELETE controls whether files which are not part of the repository will | ||
| + | # be removed from the local directory after synchronization. The default value | ||
| + | # for this setting is | ||
| + | # " | ||
| + | # which means that files which are not part of the feed or private directory | ||
| + | # will be deleted. | ||
| + | RSYNC_DELETE=" | ||
| + | |||
| + | # RSYNC_SSH_OPTS contains options which should be passed to ssh for the rsync | ||
| + | # connection to the repository. | ||
| + | RSYNC_SSH_OPTS=" | ||
| + | |||
| + | # RSYNC_COMPRESS specifies the compression level to use for the rsync connection. | ||
| + | RSYNC_COMPRESS=" | ||
| + | |||
| + | # RSYNC_CHMOD specifies the permissions to chmod the files to. | ||
| + | RSYNC_CHMOD=" | ||
| + | |||
| + | # Verbosity flag for rsync. " | ||
| + | RSYNC_VERBOSE=" | ||
| + | |||
| + | # RSYNC_OPTIONS controls the general parameters for the rsync connection. | ||
| + | RSYNC_OPTIONS=" | ||
| + | |||
| + | # Script and feed information which will be made available to user through | ||
| + | # command line options and automated tools. | ||
| + | # Script | ||
| + | SCRIPT_NAME=" | ||
| + | |||
| + | # Result of selftest () is stored here. If it is not 0, the selftest has failed | ||
| + | # and the sync script is unlikely to work. | ||
| + | SELFTEST_FAIL=0 | ||
| + | |||
| + | # Port to use for synchronization. Default value is 24. | ||
| + | PORT=24 | ||
| + | |||
| + | # Directory where the OpenVAS configuration is located | ||
| + | OPENVAS_SYSCONF_DIR=" | ||
| + | |||
| + | # Directory where the feed update lock file will be placed. | ||
| + | OPENVAS_FEED_LOCK_PATH=" | ||
| + | |||
| + | # Location of the GSF Access Key | ||
| + | ACCESS_KEY=" | ||
| + | |||
| + | # If ENABLED is set to 0, the sync script will not perform a synchronization. | ||
| + | ENABLED=1 | ||
| + | |||
| + | # LOG_CMD defines the command to use for logging. To have logger log to stderr | ||
| + | # as well as syslog, add "-s" here. The logging facility is checked. In case of error | ||
| + | # all will be logged in the standard error and the socket error check will be | ||
| + | # disabled. | ||
| + | LOG_CMD=" | ||
| + | |||
| + | check_logger () { | ||
| + | logger -p daemon.info -t $SCRIPT_NAME " | ||
| + | if [ $? -gt 0 ] | ||
| + | then | ||
| + | LOG_CMD=" | ||
| + | $LOG_CMD -p daemon.warning "The log facility is not working as expected. All messages will be written to the standard error stream." | ||
| + | fi | ||
| + | } | ||
| + | check_logger | ||
| + | |||
| + | |||
| + | # Source configuration file if it is readable | ||
| + | [ -r $OPENVAS_SYSCONF_DIR/ | ||
| + | |||
| + | # NVT_DIR is the place where the NVTs are located. | ||
| + | if [ -z " | ||
| + | then | ||
| + | NVT_DIR=" | ||
| + | fi | ||
| + | |||
| + | log_write () { | ||
| + | $LOG_CMD -p daemon.notice $1 | ||
| + | } | ||
| + | |||
| + | log_debug () { | ||
| + | $LOG_CMD -p daemon.debug " | ||
| + | } | ||
| + | |||
| + | log_info () { | ||
| + | $LOG_CMD -p daemon.info " | ||
| + | } | ||
| + | |||
| + | log_notice () { | ||
| + | $LOG_CMD -p daemon.notice " | ||
| + | } | ||
| + | |||
| + | log_warning () { | ||
| + | $LOG_CMD -p daemon.warning " | ||
| + | } | ||
| + | |||
| + | log_err () { | ||
| + | $LOG_CMD -p daemon.err " | ||
| + | } | ||
| + | |||
| + | stderr_write () | ||
| + | { | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | # Read the general information about the feed origin from | ||
| + | # the file " | ||
| + | get_feed_info () | ||
| + | { | ||
| + | INFOFILE=" | ||
| + | if [ -r $INFOFILE ] ; then | ||
| + | FEED_VERSION=`grep PLUGIN_SET $INFOFILE | sed -e ' | ||
| + | FEED_NAME=`awk -F\" '/ | ||
| + | FEED_VENDOR=`awk -F\" '/ | ||
| + | FEED_HOME=`awk -F\" '/ | ||
| + | FEED_PRESENT=1 | ||
| + | else | ||
| + | FEED_PRESENT=0 | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_VENDOR=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_HOME=" | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | # Prevent that root executes this script | ||
| + | if [ "`id -u`" -eq " | ||
| + | then | ||
| + | stderr_write "$0 must not be executed as privileged user root" | ||
| + | stderr_write | ||
| + | stderr_write " | ||
| + | stderr_write " | ||
| + | stderr_write "files with a non-privileged user." | ||
| + | |||
| + | log_err " | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | # Always try to get the information when started. | ||
| + | # This also ensures variables like FEED_PRESENT are set. | ||
| + | get_feed_info | ||
| + | |||
| + | # Determine whether a GSF access key is present. If yes, | ||
| + | # then use the Greenbone Security Feed. Else use the | ||
| + | # Greenbone Community Feed. | ||
| + | if [ -e $ACCESS_KEY ] | ||
| + | then | ||
| + | RESTRICTED=1 | ||
| + | else | ||
| + | RESTRICTED=0 | ||
| + | |||
| + | if [ -z " | ||
| + | COMMUNITY_NVT_RSYNC_FEED=rsync:// | ||
| + | # An alternative syntax which might work if the above doesn' | ||
| + | # COMMUNITY_NVT_RSYNC_FEED=rsync@feed.community.greenbone.net::/ | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | RSYNC=`command -v rsync` | ||
| + | |||
| + | if [ -z " | ||
| + | SYNC_TMP_DIR=/ | ||
| + | # If we have mktemp, create a temporary dir (safer) | ||
| + | if [ -n " | ||
| + | SYNC_TMP_DIR=`mktemp -t -d greenbone-nvt-sync.XXXXXXXXXX` || { echo " | ||
| + | trap "rm -rf $SYNC_TMP_DIR" | ||
| + | fi | ||
| + | else | ||
| + | SYNC_TMP_DIR=" | ||
| + | fi | ||
| + | |||
| + | # Initialize this indicator variable with default assuming the | ||
| + | # feed is not up-to-date. | ||
| + | FEED_CURRENT=0 | ||
| + | |||
| + | # This function uses gos-state-manager to get information about the settings. | ||
| + | # If gos-state-manager is not installed the values of the settings can not be | ||
| + | # retrieved. | ||
| # | # | ||
| - | tcpmux | + | # Input: option |
| - | tcpmux | + | # Output: value as string or empty String if gos-state-manager is not installed |
| - | compressnet | + | # or option not set |
| - | compressnet | + | get_value () |
| - | compressnet | + | { |
| - | compressnet | + | value="" |
| - | unknown 4/tcp 0.000477 | + | key=$1 |
| - | rje 5/tcp 0.000000 | + | if which gos-state-manager 1>/dev/null 2>& |
| - | rje 5/udp 0.000593 | + | then |
| - | unknown 6/tcp 0.000502 | + | if gos-state-manager get "$key.value" 1>/ |
| - | echo 7/ | + | then |
| - | echo 7/tcp 0.004855 | + | value=" |
| - | echo 7/udp 0.024679 | + | fi |
| - | unknown 8/tcp 0.000013 | + | fi |
| - | discard 9/sctp 0.000000 | + | echo " |
| - | discard 9/tcp 0.003764 | + | } |
| - | discard 9/udp 0.015733 | + | |
| - | unknown 10/tcp | + | # Creates a restricted access copy of the access key if necessary. |
| - | systat | + | setup_temp_access_key () { |
| - | systat | + | if [ -e " |
| - | unknown 12/tcp 0.000063 | + | then |
| - | daytime 13/ | + | FILE_ACCESS=`stat -c%a " |
| - | daytime 13/ | + | |
| - | unknown 14/ | + | if [ -n " |
| - | netstat 15/ | + | then |
| - | unknown 16/ | + | TEMP_ACCESS_KEY_DIR=`mktemp -d` |
| - | qotd 17/ | + | TEMP_ACCESS_KEY=" |
| - | qotd 17/ | + | cp " |
| - | msp | + | chmod 400 " |
| - | msp | + | else |
| - | chargen 19/ | + | TEMP_ACCESS_KEY_DIR="" |
| - | chargen 19/ | + | TEMP_ACCESS_KEY=" |
| - | ftp-data 20/ | + | fi |
| - | --More--(0%) | + | } |
| + | |||
| + | # Deletes the read-only copy of the access key. | ||
| + | cleanup_temp_access_key () { | ||
| + | if [ -n " | ||
| + | then | ||
| + | rm -rf " | ||
| + | fi | ||
| + | TEMP_ACCESS_KEY_DIR="" | ||
| + | TEMP_ACCESS_KEY="" | ||
| + | } | ||
| + | |||
| + | is_feed_current () { | ||
| + | if [ -z " | ||
| + | then | ||
| + | log_write "Could not determine feed version." | ||
| + | FEED_CURRENT=0 | ||
| + | return $FEED_CURRENT | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | log_notice "rsync not available, skipping feed version test" | ||
| + | FEED_CURRENT=0 | ||
| + | rm -rf $FEED_INFO_TEMP_DIR | ||
| + | cleanup_temp_access_key | ||
| + | return 0 | ||
| + | fi | ||
| + | |||
| + | FEED_INFO_TEMP_DIR=`mktemp -d` | ||
| + | |||
| + | if [ -e $ACCESS_KEY ] | ||
| + | then | ||
| + | gsmproxy=$(get_value proxy_feed | sed -r -e 's/^.*\/ | ||
| + | syncport=$(get_value syncport) | ||
| + | if [ " | ||
| + | then | ||
| + | PORT=" | ||
| + | fi | ||
| + | |||
| + | read feeduser < $ACCESS_KEY | ||
| + | custid=`awk -F@ 'NR > 1 { exit }; { print $1 }' $ACCESS_KEY` | ||
| + | if [ -z " | ||
| + | then | ||
| + | log_err "Could not determine credentials, | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | setup_temp_access_key | ||
| + | |||
| + | if [ " | ||
| + | then | ||
| + | RSYNC_SSH_PROXY_CMD="" | ||
| + | else | ||
| + | if [ -e $OPENVAS_SYSCONF_DIR/proxyauth ] && [ -r $OPENVAS_SYSCONF_DIR/ | ||
| + | then | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | else | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $TEMP_ACCESS_KEY" | ||
| + | |||
| + | if [ $? -ne 0 ] | ||
| + | then | ||
| + | log_err " | ||
| + | rm -rf " | ||
| + | exit 1 | ||
| + | fi | ||
| + | else | ||
| + | | ||
| + | # IP blocking due to network equipment in between keeping the previous connection too long open. | ||
| + | sleep 5 | ||
| + | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | ||
| + | eval " | ||
| + | if [ $? -ne 0 ] | ||
| + | then | ||
| + | log_err "rsync failed, aborting synchronization." | ||
| + | rm -rf " | ||
| + | exit 1 | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | FEED_VERSION_SERVER=`grep PLUGIN_SET $FEED_INFO_TEMP_DIR/plugin_feed_info.inc | sed -e 's/[^0-9]// | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | log_err "Could not determine server feed version." | ||
| + | rm -rf $FEED_INFO_TEMP_DIR | ||
| + | cleanup_temp_access_key | ||
| + | exit 1 | ||
| + | fi | ||
| + | | ||
| + | if [ $FEED_VERSION -lt $FEED_VERSION_SERVER ] ; then | ||
| + | FEED_CURRENT=0 | ||
| + | else | ||
| + | FEED_CURRENT=1 | ||
| + | fi | ||
| + | # Cleanup | ||
| + | rm -rf " | ||
| + | cleanup_temp_access_key | ||
| + | |||
| + | return $FEED_CURRENT | ||
| + | } | ||
| + | |||
| + | do_rsync_community_feed () { | ||
| + | # Sleep for five seconds (a previous feed might have been synced a few seconds before) to prevent | ||
| + | # IP blocking due to network equipment in between keeping the previous connection too long open. | ||
| + | | ||
| + | log_notice " | ||
| + | mkdir -p " | ||
| + | eval " | ||
| + | if [ $? -ne 0 ] ; then | ||
| + | log_err "rsync failed." | ||
| + | exit 1 | ||
| + | fi | ||
| + | | ||
| + | # to network equipment in between keeping the previous connection too long open. | ||
| + | sleep 5 | ||
| + | eval " | ||
| + | if [ $? -ne 0 ] ; then | ||
| + | log_err "rsync failed." | ||
| + | | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | sync_nvts(){ | ||
| + | if [ $ENABLED -ne 1 ] | ||
| + | then | ||
| + | log_write "NVT synchronization is disabled, exiting." | ||
| + | | ||
| + | fi | ||
| + | |||
| + | if [ -e $ACCESS_KEY ] | ||
| + | then | ||
| + | log_write " | ||
| + | | ||
| + | FEEDCOUNT=`grep -E " | ||
| + | log_write " | ||
| + | else | ||
| + | log_write " | ||
| + | fi | ||
| + | notsynced=1 | ||
| + | retried=0 | ||
| + | |||
| + | mkdir -p " | ||
| + | read feeduser < $ACCESS_KEY | ||
| + | custid=`awk -F@ 'NR > 1 { exit }; { print $1 }' $ACCESS_KEY` | ||
| + | if [ -z " | ||
| + | then | ||
| + | log_err "Could not determine credentials, | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | setup_temp_access_key | ||
| + | |||
| + | while [ $notsynced -eq 1 ] | ||
| + | do | ||
| + | |||
| + | gsmproxy=$(get_value proxy_feed | sed -r -e 's/^.*\/ | ||
| + | syncport=$(get_value syncport) | ||
| + | if [ " | ||
| + | then | ||
| + | PORT=" | ||
| + | fi | ||
| + | |||
| + | if [ " | ||
| + | then | ||
| + | RSYNC_SSH_PROXY_CMD="" | ||
| + | else | ||
| + | if [ -e $OPENVAS_SYSCONF_DIR/proxyauth ] && [ -r $OPENVAS_SYSCONF_DIR/ | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | else | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | fi | ||
| + | fi | ||
| + | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $TEMP_ACCESS_KEY" | ||
| + | if [ $? -ne 0 ] ; then | ||
| + | log_err "rsync failed, aborting synchronization." | ||
| + | exit 1 | ||
| + | fi | ||
| + | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $TEMP_ACCESS_KEY" | ||
| + | if [ $? -ne 0 ] ; then | ||
| + | log_err "rsync failed, aborting synchronization." | ||
| + | exit 1 | ||
| + | fi | ||
| + | eval "cd \" | ||
| + | if [ $? -ne 0 ] ; then | ||
| + | if [ -n " | ||
| + | then | ||
| + | log_err "Feed integrity check failed twice, aborting synchronization." | ||
| + | | ||
| + | exit 1 | ||
| + | else | ||
| + | log_write "The feed integrity check failed. This may be due to a concurrent feed update or other temporary issues." | ||
| + | log_write " | ||
| + | sleep 15 | ||
| + | retried=1 | ||
| + | fi | ||
| + | | ||
| + | notsynced=0 | ||
| + | fi | ||
| + | done | ||
| + | cleanup_temp_access_key | ||
| + | log_write " | ||
| + | | ||
| + | if [ $FEED_PRESENT -eq 1 ] ; then | ||
| + | FEEDCOUNT=`grep -E " | ||
| + | log_write " | ||
| + | else | ||
| + | log_write " | ||
| + | fi | ||
| + | else | ||
| + | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | ||
| + | do_rsync_community_feed | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | do_self_test () | ||
| + | { | ||
| + | MD5SUM_AVAIL=`command -v md5sum` | ||
| + | if [ $? -ne 0 ] ; then | ||
| + | SELFTEST_FAIL=1 | ||
| + | stderr_write "The md5sum binary could not be found." | ||
| + | | ||
| + | |||
| + | RSYNC_AVAIL=`command -v rsync` | ||
| + | if [ $? -ne 0 ] ; then | ||
| + | SELFTEST_FAIL=1 | ||
| + | stderr_write "The rsync binary could not be found." | ||
| + | | ||
| + | } | ||
| + | |||
| + | do_describe () | ||
| + | { | ||
| + | echo "This script synchronizes an NVT collection with the ' | ||
| + | | ||
| + | | ||
| + | } | ||
| + | |||
| + | do_feedversion () { | ||
| + | | ||
| + | echo $FEED_VERSION | ||
| + | else | ||
| + | stderr_write "The file containing the feed version could not be found." | ||
| + | | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | do_sync () | ||
| + | { | ||
| + | do_self_test | ||
| + | if [ $SELFTEST_FAIL -ne 0 ] ; then | ||
| + | exit $SELFTEST_FAIL | ||
| + | fi | ||
| + | |||
| + | if [ $FEED_CURRENT -eq 1 ] | ||
| + | then | ||
| + | log_write "Feed is already current, skipping synchronization." | ||
| + | else | ||
| + | ( | ||
| + | chmod +660 $OPENVAS_FEED_LOCK_PATH | ||
| + | flock -n 9 | ||
| + | if [ $? -eq 1 ] ; then | ||
| + | log_warning " | ||
| + | exit 1 | ||
| + | fi | ||
| + | date > $OPENVAS_FEED_LOCK_PATH | ||
| + | sync_nvts | ||
| + | echo -n $OPENVAS_FEED_LOCK_PATH | ||
| + | | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | do_help () { | ||
| + | echo "$0: Sync NVT data" | ||
| + | echo " --describe | ||
| + | echo " --feedcurrent | ||
| + | echo " --feedversion | ||
| + | echo " --help | ||
| + | echo " --identify | ||
| + | echo " --nvtdir dir set dir as NVT directory" | ||
| + | echo " --selftest | ||
| + | echo " --verbose | ||
| + | echo " --version | ||
| + | echo "" | ||
| + | echo "" | ||
| + | echo " | ||
| + | echo " | ||
| + | | ||
| + | | ||
| + | echo "Note that you can use standard ones as well (e.g. RSYNC_PROXY) for rsync" | ||
| + | echo "" | ||
| + | | ||
| + | } | ||
| + | |||
| + | while test $# -gt 0; do | ||
| + | case " | ||
| + | | ||
| + | echo $VERSION | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --identify) | ||
| + | echo " | ||
| + | exit 0 | ||
| + | ;; | ||
| + | | ||
| + | do_self_test | ||
| + | exit $SELFTEST_FAIL | ||
| + | ;; | ||
| + | | ||
| + | do_describe | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --feedversion) | ||
| + | do_feedversion | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --help) | ||
| + | do_help | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --nvt-dir) | ||
| + | NVT_DIR=" | ||
| + | shift | ||
| + | ;; | ||
| + | --feedcurrent) | ||
| + | is_feed_current | ||
| + | exit $? | ||
| + | ;; | ||
| + | --verbose) | ||
| + | RSYNC_VERBOSE=" | ||
| + | ;; | ||
| + | esac | ||
| + | shift | ||
| + | done | ||
| + | |||
| + | do_sync | ||
| + | |||
| + | exit 0 | ||
| </ | </ | ||
| - | Le répertoire **/ | + | Rendez le script exécutable |
| < | < | ||
| - | root@debian12:~# ls -l / | + | [root@centos7 |
| - | total 9368 | + | |
| - | -rw-r--r-- 1 root root 10829 Jan 16 2023 nmap.dtd | + | |
| - | -rw-r--r-- 1 root root 824437 Jan 16 2023 nmap-mac-prefixes | + | |
| - | -rw-r--r-- 1 root root 5032815 Jan 16 2023 nmap-os-db | + | |
| - | -rw-r--r-- 1 root root 21165 Jan 16 2023 nmap-payloads | + | |
| - | -rw-r--r-- 1 root root 6845 Jan 16 2023 nmap-protocols | + | |
| - | -rw-r--r-- 1 root root 43529 Jan 16 2023 nmap-rpc | + | |
| - | -rw-r--r-- 1 root root 2506640 Jan 16 2023 nmap-service-probes | + | |
| - | -rw-r--r-- 1 root root 1004557 Jan 16 2023 nmap-services | + | |
| - | -rw-r--r-- 1 root root 31936 Jan 16 2023 nmap.xsl | + | |
| - | drwxr-xr-x 3 root root 4096 Nov 27 16:46 nselib | + | |
| - | -rw-r--r-- 1 root root 49478 Jan 16 2023 nse_main.lua | + | |
| - | drwxr-xr-x 2 root root 36864 Nov 27 16:46 scripts | + | |
| </ | </ | ||
| - | Voici la liste des fichiers les plus importants | + | Déplacez le script vers **/ |
| - | ^ Fichier ^ Description ^ | + | < |
| - | | / | + | [root@centos7 ~]# mv greenbone-nvt-sync /usr/sbin |
| - | | /usr/share/ | + | mv: overwrite ‘/usr/sbin/greenbone-nvt-sync’? y |
| - | | /usr/share/nmap/nmap-mac-prefixes | Contient une liste de préfix d' | + | </code> |
| - | | /usr/ | + | |
| - | ==Scripts== | + | Devenez l' |
| + | |||
| + | < | ||
| + | |||
| + | [root@centos7 ~]# su - trainee | ||
| + | Last login: Mon Dec 1 15:30:45 CET 2025 on pts/0 | ||
| + | |||
| + | [trainee@centos7 ~]$ greenbone-nvt-sync | ||
| + | ... | ||
| + | Greenbone community feed server - http:// | ||
| + | This service is hosted by Greenbone Networks - http:// | ||
| + | |||
| + | All transactions are logged. | ||
| + | |||
| + | If you have any questions, please use the Greenbone community portal. | ||
| + | See https:// | ||
| + | |||
| + | By using this service you agree to our terms and conditions. | ||
| + | |||
| + | Only one sync per time, otherwise the source ip will be temporarily blocked. | ||
| + | |||
| + | |||
| + | receiving incremental file list | ||
| + | plugin_feed_info.inc | ||
| + | 330 100% 322.27kB/ | ||
| + | |||
| + | sent 57 bytes received 436 bytes 328.67 bytes/sec | ||
| + | total size is 330 speedup is 0.67 | ||
| + | [trainee@centos7 ~]$ exit | ||
| + | [root@centos7 ~]# | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - En cas d' | ||
| + | </ | ||
| - | **nmap** utilise des scripts pour accomplir certaines tâches allant de la découverte simple de ports ouverts jusqu' | + | Déplacez les plugins vers le répertoire |
| < | < | ||
| - | root@debian12:~# ls /usr/share/nmap/scripts/ | + | [root@centos7 |
| - | acarsd-info.nse | + | |
| - | address-info.nse | + | |
| - | afp-brute.nse | + | |
| - | afp-ls.nse | + | |
| - | afp-path-vuln.nse | + | |
| - | afp-serverinfo.nse | + | |
| - | afp-showmount.nse | + | |
| - | ajp-auth.nse | + | |
| - | ajp-brute.nse | + | |
| - | ajp-headers.nse | + | |
| - | ajp-methods.nse | + | |
| - | ajp-request.nse | + | |
| - | allseeingeye-info.nse | + | |
| - | amqp-info.nse | + | |
| - | asn-query.nse | + | |
| - | auth-owners.nse | + | |
| - | auth-spoof.nse | + | |
| - | backorifice-brute.nse | + | |
| - | backorifice-info.nse | + | |
| - | bacnet-info.nse | + | |
| - | banner.nse | + | |
| - | bitcoin-getaddr.nse | + | |
| - | bitcoin-info.nse | + | |
| - | bitcoinrpc-info.nse | + | |
| - | bittorrent-discovery.nse | + | |
| - | bjnp-discover.nse | + | |
| - | broadcast-ataoe-discover.nse | + | |
| - | broadcast-avahi-dos.nse | + | |
| - | broadcast-bjnp-discover.nse | + | |
| - | broadcast-db2-discover.nse | + | |
| - | broadcast-dhcp6-discover.nse | + | |
| - | broadcast-dhcp-discover.nse | + | |
| - | broadcast-dns-service-discovery.nse | + | |
| - | broadcast-dropbox-listener.nse | + | |
| - | broadcast-eigrp-discovery.nse | + | |
| - | broadcast-hid-discoveryd.nse | + | |
| - | broadcast-igmp-discovery.nse | + | |
| - | broadcast-jenkins-discover.nse | + | |
| - | broadcast-listener.nse | + | |
| - | broadcast-ms-sql-discover.nse | + | |
| - | broadcast-netbios-master-browser.nse | + | |
| - | broadcast-networker-discover.nse | + | |
| - | broadcast-novell-locate.nse | + | |
| - | broadcast-ospf2-discover.nse | + | |
| - | broadcast-pc-anywhere.nse | + | |
| - | broadcast-pc-duo.nse | + | |
| - | broadcast-pim-discovery.nse | + | |
| - | broadcast-ping.nse | + | |
| - | broadcast-pppoe-discover.nse | + | |
| - | broadcast-rip-discover.nse | + | |
| - | broadcast-ripng-discover.nse | + | |
| - | broadcast-sonicwall-discover.nse | + | |
| - | broadcast-sybase-asa-discover.nse | + | |
| - | broadcast-tellstick-discover.nse | + | |
| - | broadcast-upnp-info.nse | + | |
| - | broadcast-versant-locate.nse | + | |
| - | broadcast-wake-on-lan.nse | + | |
| - | broadcast-wpad-discover.nse | + | |
| - | broadcast-wsdd-discover.nse | + | |
| - | broadcast-xdmcp-discover.nse | + | |
| - | cassandra-brute.nse | + | |
| - | cassandra-info.nse | + | |
| - | cccam-version.nse | + | |
| - | cics-enum.nse | + | |
| - | cics-info.nse | + | |
| - | cics-user-brute.nse | + | |
| - | cics-user-enum.nse | + | |
| - | citrix-brute-xml.nse | + | |
| - | citrix-enum-apps.nse | + | |
| - | citrix-enum-apps-xml.nse | + | |
| - | citrix-enum-servers.nse | + | |
| - | citrix-enum-servers-xml.nse | + | |
| - | clamav-exec.nse | + | |
| - | clock-skew.nse | + | |
| - | coap-resources.nse | + | |
| - | couchdb-databases.nse | + | |
| - | couchdb-stats.nse | + | |
| - | creds-summary.nse | + | |
| - | cups-info.nse | + | |
| - | cups-queue-info.nse | + | |
| - | cvs-brute.nse | + | |
| - | cvs-brute-repository.nse | + | |
| - | daap-get-library.nse | + | |
| - | daytime.nse | + | |
| - | db2-das-info.nse | + | |
| - | deluge-rpc-brute.nse | + | |
| - | dhcp-discover.nse | + | |
| - | dicom-brute.nse | + | |
| - | dicom-ping.nse | + | |
| - | dict-info.nse | + | |
| - | distcc-cve2004-2687.nse | + | |
| - | dns-blacklist.nse | + | |
| - | dns-brute.nse | + | |
| - | dns-cache-snoop.nse | + | |
| - | dns-check-zone.nse | + | |
| - | dns-client-subnet-scan.nse | + | |
| - | dns-fuzz.nse | + | |
| - | dns-ip6-arpa-scan.nse | + | |
| - | dns-nsec3-enum.nse | + | |
| - | dns-nsec-enum.nse | + | |
| - | dns-nsid.nse | + | |
| - | dns-random-srcport.nse | + | |
| - | dns-random-txid.nse | + | |
| - | dns-recursion.nse | + | |
| - | dns-service-discovery.nse | + | |
| - | dns-srv-enum.nse | + | |
| - | dns-update.nse | + | |
| - | dns-zeustracker.nse | + | |
| - | dns-zone-transfer.nse | + | |
| - | docker-version.nse | + | |
| - | domcon-brute.nse | + | |
| - | domcon-cmd.nse | + | |
| - | domino-enum-users.nse | + | |
| - | dpap-brute.nse | + | |
| - | drda-brute.nse | + | |
| - | drda-info.nse | + | |
| - | duplicates.nse | + | |
| - | eap-info.nse | + | |
| - | enip-info.nse | + | |
| - | epmd-info.nse | + | |
| - | eppc-enum-processes.nse | + | |
| </ | </ | ||
| - | Les scripts sont regroupés dans des catégories | + | Vérifiez ensuite la réussite de la commande précédente |
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ls -l / | ||
| + | total 41280 | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. 288 trainee trainee | ||
| + | drwxr-xr-x. 215 trainee trainee | ||
| + | drwxr-xr-x. 181 trainee trainee | ||
| + | drwxr-xr-x. 154 trainee trainee | ||
| + | drwxr-xr-x. 149 trainee trainee | ||
| + | drwx------. 136 trainee trainee | ||
| + | drwx------. 127 trainee trainee | ||
| + | drwx------. 132 trainee trainee | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | drwx------. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | --More-- | ||
| + | </ | ||
| + | |||
| + | Exécutez de nouveau la commande | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# openvas-check-setup | ||
| + | ... | ||
| + | Step 2: Checking OpenVAS Manager ... | ||
| + | OK: OpenVAS Manager is present in version | ||
| + | ERROR: No client certificate file of OpenVAS Manager found. | ||
| + | FIX: Run ' | ||
| + | |||
| + | | ||
| + | ... | ||
| + | </ | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Pour plus d'informations concernant ces catégories, | + | **Important** - Notez l'erreur **ERROR: No client certificate file of OpenVAS Manager found.** |
| </ | </ | ||
| - | La catégorie | + | Consultez |
| < | < | ||
| - | root@debian12:~# nmap -v -sC localhost | + | [root@centos7 |
| - | Starting Nmap 7.93 ( https:// | + | /bin/openvas-mkcert-client: illegal option |
| - | NSE: Loaded 125 scripts for scanning. | + | Usage: |
| - | NSE: Script Pre-scanning. | + | |
| - | Initiating NSE at 16:51 | + | |
| - | Completed NSE at 16:51, 0.00s elapsed | + | |
| - | Initiating NSE at 16:51 | + | |
| - | Completed NSE at 16:51, 0.00s elapsed | + | |
| - | Initiating SYN Stealth Scan at 16:51 | + | |
| - | Scanning localhost (127.0.0.1) [1000 ports] | + | |
| - | Discovered open port 22/tcp on 127.0.0.1 | + | |
| - | Discovered open port 5900/tcp on 127.0.0.1 | + | |
| - | Discovered open port 80/tcp on 127.0.0.1 | + | |
| - | Discovered open port 631/tcp on 127.0.0.1 | + | |
| - | Completed SYN Stealth Scan at 16:51, 0.03s elapsed (1000 total ports) | + | |
| - | NSE: Script scanning 127.0.0.1. | + | |
| - | Initiating NSE at 16:51 | + | |
| - | Completed NSE at 16:51, 2.00s elapsed | + | |
| - | Initiating NSE at 16:51 | + | |
| - | Completed NSE at 16:51, 0.00s elapsed | + | |
| - | Nmap scan report for localhost (127.0.0.1) | + | |
| - | Host is up (0.0000090s latency). | + | |
| - | Other addresses for localhost (not scanned): ::1 | + | |
| - | Not shown: 996 closed tcp ports (reset) | + | |
| - | PORT STATE SERVICE | + | |
| - | 22/ | + | |
| - | | ssh-hostkey: | + | |
| - | | 256 738a4166831b9c8af2bfb567ed025c4d (ECDSA) | + | |
| - | |_ 256 86dcfbca68069284b2ddb0545cbc4e2b (ED25519) | + | |
| - | 80/ | + | |
| - | | http-methods: | + | |
| - | |_ Supported Methods: GET POST OPTIONS HEAD | + | |
| - | |_http-title: Apache2 Debian Default Page: It works | + | |
| - | 631/ | + | |
| - | | ssl-cert: Subject: commonName=debian12/ | + | |
| - | | Subject Alternative Name: DNS: | + | |
| - | | Issuer: commonName=debian12/ | + | |
| - | | Public Key type: rsa | + | |
| - | | Public Key bits: 2048 | + | |
| - | | Signature Algorithm: sha256WithRSAEncryption | + | |
| - | | Not valid before: 2025-11-27T15: | + | |
| - | | Not valid after: | + | |
| - | | MD5: | + | |
| - | |_SHA-1: 0bda6fab805a00a5cdc863da5357a3791a58eca6 | + | |
| - | | http-methods: | + | |
| - | |_ Supported Methods: GET HEAD POST OPTIONS | + | |
| - | |_http-title: Home - CUPS 2.4.2 | + | |
| - | |_ssl-date: TLS randomness does not represent time | + | |
| - | | http-robots.txt: 1 disallowed entry | + | |
| - | |_/ | + | |
| - | 5900/tcp open vnc | + | |
| - | | vnc-info: | + | |
| - | | | + | |
| - | | | + | |
| - | |_ VNC Authentication (2) | + | |
| - | NSE: Script Post-scanning. | + | Options: |
| - | Initiating NSE at 16:51 | + | |
| - | Completed NSE at 16:51, 0.00s elapsed | + | |
| - | Initiating NSE at 16:51 | + | and register with the OpenVAS scanner |
| - | Completed NSE at 16:51, 0.00s elapsed | + | |
| - | Read data files from: / | + | |
| - | Nmap done: 1 IP address (1 host up) scanned in 2.45 seconds | + | |
| - | Raw packets sent: 1000 (44.000KB) | Rcvd: 2004 (84.176KB) | + | |
| </ | </ | ||
| - | <WRAP center round warning 50%> | + | Exécutez donc la commande **openvas-mkcert-client -i** : |
| - | **Attention** - La catégorie par défaut | + | |
| + | <code> | ||
| + | [root@centos7 ~]# openvas-mkcert-client -i | ||
| + | This script will now ask you the relevant information to create the SSL client certificates for OpenVAS. | ||
| + | |||
| + | Client certificates life time in days [365]: 3650 | ||
| + | Your country (two letter code) [DE]: UK | ||
| + | Your state or province name [none]: SURREY | ||
| + | Your location (e.g. town) [Berlin]: ADDLESTONE | ||
| + | Your organization [none]: I2TCH LIMITED | ||
| + | Your organizational unit [none]: TRAINING | ||
| + | ********** | ||
| + | We are going to ask you some question for each client certificate. | ||
| + | |||
| + | If some question has a default | ||
| + | |||
| + | ********* | ||
| + | Client certificates life time in days [3650]: | ||
| + | Country (two letter code) [UK]: | ||
| + | State or province name [SURREY]: | ||
| + | Location (e.g. town) [ADDLESTONE]: | ||
| + | Organization [I2TCH LIMITED]: | ||
| + | Organization unit [TRAINING]: | ||
| + | e-Mail []: infos@i2tch.eu | ||
| + | Generating RSA private key, 4096 bit long modulus | ||
| + | ....++ | ||
| + | .......++ | ||
| + | e is 65537 (0x10001) | ||
| + | You are about to be asked to enter information that will be incorporated | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Country Name (2 letter code) [DE]:State or Province Name (full name) [Some-State]: | ||
| + | Check that the request matches the signature | ||
| + | Signature ok | ||
| + | The Subject' | ||
| + | countryName | ||
| + | stateOrProvinceName | ||
| + | localityName | ||
| + | organizationName | ||
| + | organizationalUnitName: | ||
| + | commonName | ||
| + | emailAddress | ||
| + | Certificate is to be certified until Jun 17 02:03:34 2028 GMT (3650 days) | ||
| + | |||
| + | Write out database with 1 new entries | ||
| + | Data Base Updated | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | Exécutez encore une fois la commande | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# openvas-check-setup | ||
| + | ... | ||
| + | Step 2: Checking OpenVAS Manager ... | ||
| + | OK: OpenVAS Manager is present in version 6.0.9. | ||
| + | OK: OpenVAS Manager client certificate is present as / | ||
| + | ERROR: No OpenVAS Manager database found. (Tried: / | ||
| + | FIX: Run ' | ||
| + | WARNING: OpenVAS Scanner is NOT running! | ||
| + | SUGGEST: Start OpenVAS Scanner (openvassd). | ||
| + | |||
| + | | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez l' | ||
| </ | </ | ||
| - | ==Options | + | Afin de générer |
| - | Les options | + | < |
| + | [root@centos7 ~]# systemctl enable openvas-scanner | ||
| + | Created symlink from / | ||
| + | [root@centos7 ~]# systemctl start openvas-scanner | ||
| + | [root@centos7 ~]# systemctl status openvas-scanner | ||
| + | ● openvas-scanner.service - OpenVAS Scanner | ||
| + | | ||
| + | | ||
| + | Process: 8889 ExecStart=/ | ||
| + | Main PID: 8890 (openvassd) | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Dec 01 16:45:47 centos7.fenestros.loc systemd[1]: Starting OpenVAS Scanner... | ||
| + | Dec 01 16:45:47 centos7.fenestros.loc systemd[1]: Started OpenVAS Scanner. | ||
| + | </ | ||
| + | |||
| + | Construisez maintenant la base de données | ||
| < | < | ||
| - | root@debian12:~# nmap --help | + | [root@centos7 |
| - | Nmap 7.93 ( https:// | + | Rebuilding NVT cache... done. |
| - | Usage: nmap [Scan Type(s)] [Options] {target specification} | + | |
| - | TARGET SPECIFICATION: | + | |
| - | Can pass hostnames, IP addresses, networks, etc. | + | |
| - | Ex: scanme.nmap.org, | + | |
| - | -iL < | + | |
| - | -iR <num hosts>: Choose random targets | + | |
| - | --exclude < | + | |
| - | --excludefile < | + | |
| - | HOST DISCOVERY: | + | |
| - | -sL: List Scan - simply list targets to scan | + | |
| - | -sn: Ping Scan - disable port scan | + | |
| - | -Pn: Treat all hosts as online -- skip host discovery | + | |
| - | -PS/ | + | |
| - | -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes | + | |
| - | -PO[protocol list]: IP Protocol Ping | + | |
| - | -n/-R: Never do DNS resolution/ | + | |
| - | --dns-servers < | + | |
| - | --system-dns: | + | |
| - | --traceroute: | + | |
| - | SCAN TECHNIQUES: | + | |
| - | -sS/ | + | |
| - | -sU: UDP Scan | + | |
| - | -sN/sF/sX: TCP Null, FIN, and Xmas scans | + | |
| - | --scanflags < | + | |
| - | -sI <zombie host[: | + | |
| - | -sY/sZ: SCTP INIT/ | + | |
| - | -sO: IP protocol scan | + | |
| - | -b <FTP relay host>: FTP bounce scan | + | |
| - | PORT SPECIFICATION AND SCAN ORDER: | + | |
| - | -p <port ranges>: Only scan specified ports | + | |
| - | Ex: -p22; -p1-65535; -p U: | + | |
| - | --exclude-ports <port ranges>: Exclude the specified ports from scanning | + | |
| - | -F: Fast mode - Scan fewer ports than the default scan | + | |
| - | -r: Scan ports sequentially - don't randomize | + | |
| - | --top-ports < | + | |
| - | --port-ratio < | + | |
| - | SERVICE/ | + | |
| - | -sV: Probe open ports to determine service/ | + | |
| - | --version-intensity < | + | |
| - | --version-light: | + | |
| - | --version-all: | + | |
| - | --version-trace: | + | |
| - | SCRIPT SCAN: | + | |
| - | -sC: equivalent to --script=default | + | |
| - | --script=< | + | |
| - | | + | |
| - | --script-args=< | + | |
| - | --script-args-file=filename: | + | |
| - | --script-trace: | + | |
| - | --script-updatedb: | + | |
| - | --script-help=< | + | |
| - | < | + | |
| - | | + | |
| - | OS DETECTION: | + | |
| - | -O: Enable OS detection | + | |
| - | --osscan-limit: | + | |
| - | --osscan-guess: | + | |
| - | TIMING AND PERFORMANCE: | + | |
| - | Options which take < | + | |
| - | ' | + | |
| - | -T< | + | |
| - | --min-hostgroup/ | + | |
| - | --min-parallelism/ | + | |
| - | --min-rtt-timeout/ | + | |
| - | probe round trip time. | + | |
| - | --max-retries < | + | |
| - | --host-timeout < | + | |
| - | --scan-delay/ | + | |
| - | --min-rate < | + | |
| - | --max-rate < | + | |
| - | FIREWALL/ | + | |
| - | -f; --mtu < | + | |
| - | -D < | + | |
| - | -S < | + | |
| - | -e < | + | |
| - | -g/ | + | |
| - | --proxies < | + | |
| - | --data <hex string>: Append a custom payload to sent packets | + | |
| - | --data-string < | + | |
| - | --data-length < | + | |
| - | --ip-options < | + | |
| - | --ttl < | + | |
| - | --spoof-mac <mac address/ | + | |
| - | --badsum: Send packets with a bogus TCP/ | + | |
| - | OUTPUT: | + | |
| - | -oN/ | + | |
| - | and Grepable format, respectively, | + | |
| - | -oA < | + | |
| - | -v: Increase verbosity level (use -vv or more for greater effect) | + | |
| - | -d: Increase debugging level (use -dd or more for greater effect) | + | |
| - | --reason: Display the reason a port is in a particular state | + | |
| - | --open: Only show open (or possibly open) ports | + | |
| - | --packet-trace: | + | |
| - | --iflist: Print host interfaces and routes (for debugging) | + | |
| - | --append-output: | + | |
| - | --resume < | + | |
| - | --noninteractive: | + | |
| - | --stylesheet < | + | |
| - | --webxml: Reference stylesheet from Nmap.Org for more portable XML | + | |
| - | --no-stylesheet: | + | |
| - | MISC: | + | |
| - | -6: Enable IPv6 scanning | + | |
| - | -A: Enable OS detection, version detection, script scanning, and traceroute | + | |
| - | --datadir < | + | |
| - | --send-eth/ | + | |
| - | --privileged: | + | |
| - | --unprivileged: | + | |
| - | -V: Print version number | + | |
| - | -h: Print this help summary page. | + | |
| - | EXAMPLES: | + | |
| - | nmap -v -A scanme.nmap.org | + | |
| - | nmap -v -sn 192.168.0.0/ | + | |
| - | nmap -v -iR 10000 -Pn -p 80 | + | |
| - | SEE THE MAN PAGE (https:// | + | |
| </ | </ | ||
| - | ===1.2 | + | Exécutez de nouveau la commande **openvas-check-setup** : |
| - | **netcat** est un couteau suisse. Il permet non seulement de scanner des ports mais aussi de lancer la connexion lors de la découverte d'un port ouvert. | + | < |
| + | [root@centos7 ~]# openvas-check-setup | ||
| + | ... | ||
| + | Step 2: Checking OpenVAS Manager ... | ||
| + | OK: OpenVAS Manager is present in version 6.0.9. | ||
| + | OK: OpenVAS Manager client certificate is present as / | ||
| + | OK: OpenVAS Manager database found in / | ||
| + | OK: Access rights for the OpenVAS Manager database are correct. | ||
| + | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. | ||
| + | OK: OpenVAS Manager database is at revision 146. | ||
| + | OK: OpenVAS Manager expects database at revision 146. | ||
| + | OK: Database schema is up to date. | ||
| + | OK: OpenVAS Manager database contains information about 45654 NVTs. | ||
| + | ERROR: No users found. You need to create at least one user to log in. | ||
| + | It is recommended to have at least one user with role Admin. | ||
| + | FIX: create a user by running | ||
| + | ... | ||
| + | </ | ||
| - | ==Utilisation== | + | <WRAP center round important 50%> |
| + | **Important** - Notez l' | ||
| + | </ | ||
| - | Dans l' | + | Créez donc un utilisateur |
| < | < | ||
| - | root@debian12:~# nc 127.0.0.1 80 -w 1 -vv | + | [root@centos7 |
| - | localhost [127.0.0.1] 80 (http) open | + | User created with password ' |
| - | [ENTREE] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> | + | |
| - | HTTP/1.1 400 Bad Request | + | |
| - | Date: Thu, 27 Nov 2025 15:53:56 GMT | + | |
| - | Server: Apache/ | + | |
| - | Content-Length: 301 | + | |
| - | Connection: close | + | |
| - | Content-Type: text/html; charset=iso-8859-1 | + | |
| - | < | + | [root@centos7 ~]# openvasmd |
| - | < | + | </code> |
| - | < | + | |
| - | </ | + | Exécutez encore une fois la commande **openvas-check-setup** : |
| - | < | + | |
| - | < | + | <code> |
| - | </p> | + | [root@centos7 ~]# openvas-check-setup |
| - | <hr> | + | ... |
| - | < | + | Step 2: Checking OpenVAS Manager |
| - | </body>< | + | OK: OpenVAS Manager is present in version 6.0.9. |
| - | sent 1, rcvd 483 | + | OK: OpenVAS Manager client certificate is present as /etc/ |
| + | OK: OpenVAS Manager database found in /var/lib/ | ||
| + | OK: Access rights for the OpenVAS Manager database are correct. | ||
| + | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. | ||
| + | OK: OpenVAS Manager database is at revision 146. | ||
| + | OK: OpenVAS Manager expects database at revision 146. | ||
| + | OK: Database schema is up to date. | ||
| + | OK: OpenVAS Manager database contains information about 45654 NVTs. | ||
| + | OK: At least one user exists. | ||
| + | ERROR: No OpenVAS SCAP database found. (Tried: / | ||
| + | FIX: Run a SCAP synchronization script like openvas-scapdata-sync or greenbone-scapdata-sync. | ||
| + | |||
| + | | ||
| + | ... | ||
| </ | </ | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Notez que **netcat** se connecte au port 80 qui est ouvert. | + | **Important** - Notez l' |
| </ | </ | ||
| - | ==Options de la commande== | + | La prochaine étape donc consiste à récupérer |
| - | Les options de cette commande sont : | + | Créez le fichier **greenbone-feed-sync** |
| < | < | ||
| - | root@debian12:~# nc -h | + | [root@centos7 |
| - | [v1.10-47] | + | [root@centos7 ~]# cat greenbone-feed-sync |
| - | connect to somewhere: nc [-options] hostname | + | #!/bin/sh |
| - | listen for inbound: nc -l -p port [-options] [hostname] [port] | + | # Copyright (C) 2011-2020 Greenbone Networks GmbH |
| - | options: | + | # |
| - | -c shell commands | + | # SPDX-License-Identifier: |
| - | -e filename | + | # |
| - | -b allow broadcasts | + | # This program is free software: you can redistribute it and/or modify |
| - | -g gateway | + | # it under the terms of the GNU Affero General Public License as |
| - | -G num source-routing pointer: 4, 8, 12, ... | + | # published by the Free Software Foundation, either version 3 of the |
| - | -h this cruft | + | # License, or (at your option) any later version. |
| - | -i secs delay interval | + | # |
| - | -k set keepalive option on socket | + | # This program is distributed in the hope that it will be useful, |
| - | -l listen mode, for inbound connects | + | # but WITHOUT ANY WARRANTY; without even the implied warranty of |
| - | -n numeric-only IP addresses, no DNS | + | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
| - | -o file hex dump of traffic | + | # GNU Affero General Public License for more details. |
| - | -p port local port number | + | # |
| - | -r randomize local and remote ports | + | # You should have received a copy of the GNU Affero General Public License |
| - | -q secs quit after EOF on stdin and delay of secs | + | # along with this program. |
| - | -s addr local source address | + | |
| - | -T tos set Type Of Service | + | # This script synchronizes a GVM installation with the |
| - | -t answer TELNET negotiation | + | # feed data from either the Greenbone Security Feed (in |
| - | -u UDP mode | + | # case a GSF access key is present) or else from the Greenbone |
| - | -v verbose | + | # Community Feed. |
| - | -w secs | + | |
| - | -C Send CRLF as line-ending | + | log_notice () { |
| - | -z zero-I/O mode [used for scanning] | + | $LOG_CMD -p daemon.notice " |
| - | port numbers can be individual or ranges: lo-hi [inclusive]; | + | } |
| - | hyphens in port names must be backslash escaped | + | |
| + | |||
| + | ########## SETTINGS | ||
| + | ########## ======== | ||
| + | |||
| + | # PRIVATE_SUBDIR defines a subdirectory of the feed data directory | ||
| + | # where files not part of the feed or database will not be deleted by rsync. | ||
| + | if [ -z " | ||
| + | then | ||
| + | PRIVATE_SUBDIR=" | ||
| + | fi | ||
| + | |||
| + | # RSYNC_DELETE controls whether files which are not part of the repository will | ||
| + | # be removed from the local directory after synchronization. The default value | ||
| + | # for this setting is | ||
| + | # " | ||
| + | # which means that files which are not part of the feed, feed info or private | ||
| + | # directory will be deleted. | ||
| + | RSYNC_DELETE=" | ||
| + | |||
| + | # RSYNC_SSH_OPTS contains options which should be passed to ssh for the rsync | ||
| + | # connection to the repository. | ||
| + | RSYNC_SSH_OPTS=" | ||
| + | |||
| + | # RSYNC_COMPRESS specifies the compression level to use for the rsync connection. | ||
| + | RSYNC_COMPRESS=" | ||
| + | |||
| + | # PORT controls the outgoing TCP port for updates. If PAT/ | ||
| + | # not used, this should be " | ||
| + | # the value 22 (Standard SSH) is useful. Only change if you know what you are | ||
| + | # doing. | ||
| + | PORT=24 | ||
| + | |||
| + | # SCRIPT_NAME is the name the scripts will use to identify itself and to mark | ||
| + | # log messages. | ||
| + | SCRIPT_NAME=" | ||
| + | |||
| + | # LOG_CMD defines the command to use for logging. To have logger log to stderr | ||
| + | # as well as syslog, add "-s" here. | ||
| + | LOG_CMD=" | ||
| + | |||
| + | # LOCK_FILE is the name of the file used to lock the feed during sync or update. | ||
| + | if [ -z " | ||
| + | then | ||
| + | LOCK_FILE=" | ||
| + | fi | ||
| + | |||
| + | |||
| + | ########## GLOBAL VARIABLES | ||
| + | ########## ================ | ||
| + | |||
| + | VERSION=@GVMD_VERSION@ | ||
| + | |||
| + | [ -r " | ||
| + | |||
| + | if [ -z " | ||
| + | DROP_USER=" | ||
| + | fi | ||
| + | |||
| + | ACCESSKEY=" | ||
| + | |||
| + | # Note when running as root or restart as $DROP_USER if defined | ||
| + | if [ $(id -u) -eq 0 ] | ||
| + | then | ||
| + | if [ -z " | ||
| + | then | ||
| + | log_notice " | ||
| + | else | ||
| + | log_notice " | ||
| + | su --shell /bin/sh --command "$0 $*" " | ||
| + | exit $? | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | # Determine whether a GSF access key is present. If yes, | ||
| + | # then use the Greenbone Security Feed. Else use the | ||
| + | # Greenbone Community Feed. | ||
| + | if [ -e $ACCESSKEY ] | ||
| + | then | ||
| + | RESTRICTED=1 | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_VENDOR=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_HOME=" | ||
| + | fi | ||
| + | |||
| + | else | ||
| + | RESTRICTED=0 | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_VENDOR=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_HOME=" | ||
| + | fi | ||
| + | |||
| + | fi | ||
| + | |||
| + | RSYNC=`command -v rsync` | ||
| + | |||
| + | # Current supported feed types (for --type parameter) | ||
| + | FEED_TYPES_SUPPORTED=" | ||
| + | |||
| + | ########## FUNCTIONS | ||
| + | ########## ========= | ||
| + | |||
| + | log_debug () { | ||
| + | $LOG_CMD | ||
| + | } | ||
| + | |||
| + | log_info () { | ||
| + | $LOG_CMD -p daemon.info " | ||
| + | } | ||
| + | |||
| + | log_warning () { | ||
| + | $LOG_CMD -p daemon.warning " | ||
| + | } | ||
| + | |||
| + | log_err () { | ||
| + | $LOG_CMD -p daemon.err " | ||
| + | } | ||
| + | |||
| + | init_feed_type () { | ||
| + | if [ -z " | ||
| + | then | ||
| + | echo "No feed type given to --type parameter" | ||
| + | log_err "No feed type given to --type parameter" | ||
| + | exit 1 | ||
| + | elif [ " | ||
| + | then | ||
| + | | ||
| + | |||
| + | FEED_TYPE_LONG=" | ||
| + | FEED_DIR=" | ||
| + | TIMESTAMP=" | ||
| + | SCRIPT_ID=" | ||
| + | |||
| + | if [ -z " | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | # An alternative syntax which might work if the above doesn' | ||
| + | # COMMUNITY_RSYNC_FEED=" | ||
| + | else | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | fi | ||
| + | |||
| + | GSF_RSYNC_PATH="/ | ||
| + | |||
| + | if [ -e $ACCESSKEY ]; then | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | else | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | fi | ||
| + | elif [ " | ||
| + | then | ||
| + | [ -r " | ||
| + | |||
| + | FEED_TYPE_LONG=" | ||
| + | FEED_DIR=" | ||
| + | TIMESTAMP=" | ||
| + | SCRIPT_ID=" | ||
| + | |||
| + | if [ -z " | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | # An alternative syntax which might work if the above doesn' | ||
| + | # COMMUNITY_RSYNC_FEED=" | ||
| + | else | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | fi | ||
| + | |||
| + | GSF_RSYNC_PATH="/ | ||
| + | |||
| + | if [ -e $ACCESSKEY ]; then | ||
| + | if [ -z " | ||
| + | | ||
| + | fi | ||
| + | else | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | fi | ||
| + | elif [ " | ||
| + | then | ||
| + | [ -r " | ||
| + | |||
| + | FEED_TYPE_LONG=" | ||
| + | FEED_DIR=" | ||
| + | TIMESTAMP=" | ||
| + | SCRIPT_ID=" | ||
| + | |||
| + | if [ -z " | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | # An alternative syntax which might work if the above doesn' | ||
| + | # COMMUNITY_RSYNC_FEED=" | ||
| + | else | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | fi | ||
| + | |||
| + | GSF_RSYNC_PATH="/ | ||
| + | |||
| + | if [ -e $ACCESSKEY ]; then | ||
| + | if [ -z " | ||
| + | | ||
| + | fi | ||
| + | else | ||
| + | if [ -z " | ||
| + | | ||
| + | fi | ||
| + | fi | ||
| + | else | ||
| + | echo " | ||
| + | log_err " | ||
| + | exit 1 | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | write_feed_xml () { | ||
| + | if [ -r $TIMESTAMP | ||
| + | then | ||
| + | FEED_VERSION=`cat $TIMESTAMP` | ||
| + | else | ||
| + | FEED_VERSION=0 | ||
| + | fi | ||
| + | |||
| + | mkdir -p $FEED_DIR | ||
| + | echo '< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "This script synchronizes a $FEED_TYPE collection with the ' | ||
| + | echo "The ' | ||
| + | echo " | ||
| + | echo "</ | ||
| + | echo "</ | ||
| + | } | ||
| + | |||
| + | create_tmp_key () { | ||
| + | KEYTEMPDIR=`mktemp -d` | ||
| + | cp " | ||
| + | TMPACCESSKEY=" | ||
| + | chmod 400 " | ||
| + | } | ||
| + | |||
| + | remove_tmp_key () { | ||
| + | rm -rf " | ||
| + | } | ||
| + | |||
| + | set_interrupt_trap () { | ||
| + | trap " | ||
| + | } | ||
| + | |||
| + | handle_interrupt () { | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | do_describe () { | ||
| + | echo "This script synchronizes a $FEED_TYPE collection with the ' | ||
| + | echo "The ' | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | do_feedversion () { | ||
| + | if [ -r $TIMESTAMP ]; then | ||
| + | cat $TIMESTAMP | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | # This function uses gos-state-manager | ||
| + | # gos-state-manager is only available on a Greenbone OS. | ||
| + | # If gos-state-manager is missing the settings values can not be retrieved. | ||
| + | # | ||
| + | # Input: option | ||
| + | # Output: value as string or empty String if gos-state-manager is not installed | ||
| + | # or option not set | ||
| + | get_value () | ||
| + | { | ||
| + | value="" | ||
| + | key=$1 | ||
| + | if which gos-state-manager 1>/ | ||
| + | then | ||
| + | if gos-state-manager get "$key.value" 1>/ | ||
| + | then | ||
| + | value=" | ||
| + | fi | ||
| + | fi | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | is_feed_current () { | ||
| + | if [ -r $TIMESTAMP ] | ||
| + | then | ||
| + | FEED_VERSION=`cat $TIMESTAMP` | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | log_warning "Could not determine feed version." | ||
| + | FEED_CURRENT=0 | ||
| + | return $FEED_CURRENT | ||
| + | fi | ||
| + | |||
| + | FEED_INFO_TEMP_DIR=`mktemp -d` | ||
| + | |||
| + | if [ -e $ACCESSKEY ] | ||
| + | then | ||
| + | read feeduser < $ACCESSKEY | ||
| + | custid_at_host=`head -1 $ACCESSKEY | cut -d : -f 1` | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | log_err "Could not determine credentials, | ||
| + | rm -rf " | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | gsmproxy=$(get_value proxy_feed | sed -r -e ' | ||
| + | syncport=$(get_value syncport) | ||
| + | if [ " | ||
| + | then | ||
| + | PORT=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | RSYNC_SSH_PROXY_CMD="" | ||
| + | else | ||
| + | if [ -e $GVM_SYSCONF_DIR/ | ||
| + | | ||
| + | else | ||
| + | | ||
| + | fi | ||
| + | fi | ||
| + | create_tmp_key | ||
| + | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $TMPACCESSKEY" | ||
| + | if [ $? -ne 0 ] | ||
| + | then | ||
| + | log_err "rsync failed, aborting synchronization." | ||
| + | rm -rf " | ||
| + | remove_tmp_key | ||
| + | exit 1 | ||
| + | fi | ||
| + | remove_tmp_key | ||
| + | else | ||
| + | # Sleep for five seconds (a previous feed might have been synced a few seconds before) to prevent | ||
| + | # IP blocking due to network equipment in between keeping the previous connection too long open. | ||
| + | sleep 5 | ||
| + | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | ||
| + | eval " | ||
| + | if [ $? -ne 0 ] | ||
| + | then | ||
| + | log_err "rsync failed, aborting synchronization." | ||
| + | | ||
| + | exit 1 | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | FEED_VERSION_SERVER=`cat " | ||
| + | |||
| + | if [ -z " | ||
| + | | ||
| + | log_err "Could not determine server feed version." | ||
| + | rm -rf " | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | # Check against FEED_VERSION | ||
| + | if [ $FEED_VERSION -lt $FEED_VERSION_SERVER ]; then | ||
| + | FEED_CURRENT=0 | ||
| + | else | ||
| + | FEED_CURRENT=1 | ||
| + | fi | ||
| + | |||
| + | # Cleanup | ||
| + | rm -rf " | ||
| + | |||
| + | return $FEED_CURRENT | ||
| + | } | ||
| + | |||
| + | do_help () { | ||
| + | echo "$0: Sync feed data" | ||
| + | |||
| + | if [ -e $ACCESSKEY ] | ||
| + | then | ||
| + | echo "GSF access key found: Using Greenbone Security Feed" | ||
| + | else | ||
| + | echo "No GSF access key found: Using Community Feed" | ||
| + | fi | ||
| + | |||
| + | echo " --describe | ||
| + | echo " --feedversion | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " --type < | ||
| + | echo " | ||
| + | echo "" | ||
| + | exit 0 | ||
| + | } | ||
| + | |||
| + | do_rsync_community_feed () { | ||
| + | if [ -z " | ||
| + | | ||
| + | else | ||
| + | # Sleep for five seconds (after is_feed_current) to prevent IP blocking due to | ||
| + | # network equipment in between keeping the previous connection too long open. | ||
| + | sleep 5 | ||
| + | log_notice "Using rsync: $RSYNC" | ||
| + | log_notice " | ||
| + | mkdir -p " | ||
| + | eval " | ||
| + | if [ $? -ne 0 ]; then | ||
| + | log_err "rsync failed. Your $FEED_TYPE_LONG might be broken now." | ||
| + | exit 1 | ||
| + | fi | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | do_sync_community_feed () { | ||
| + | if [ -z " | ||
| + | log_err "rsync not found!" | ||
| + | log_err "No utility available in PATH environment variable to download Feed data" | ||
| + | exit 1 | ||
| + | else | ||
| + | log_notice " | ||
| + | do_rsync_community_feed | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | sync_feed_data(){ | ||
| + | if [ -e $ACCESSKEY ] | ||
| + | then | ||
| + | log_notice "Found Greenbone Security Feed subscription file, trying | ||
| + | notsynced=1 | ||
| + | |||
| + | mkdir -p " | ||
| + | read feeduser < $ACCESSKEY | ||
| + | custid_at_host=`head -1 $ACCESSKEY | cut -d : -f 1` | ||
| + | |||
| + | if [ -z " | ||
| + | | ||
| + | log_err "Could not determine credentials, | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | while [ 0 -ne " | ||
| + | do | ||
| + | |||
| + | gsmproxy=$(get_value proxy_feed | sed -r -e ' | ||
| + | syncport=$(get_value syncport) | ||
| + | if [ " | ||
| + | then | ||
| + | | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | RSYNC_SSH_PROXY_CMD="" | ||
| + | else | ||
| + | if [ -e $GVM_SYSCONF_DIR/proxyauth ] && | ||
| + | | ||
| + | else | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | fi | ||
| + | fi | ||
| + | create_tmp_key | ||
| + | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $ACCESSKEY" | ||
| + | if [ 0 -ne " | ||
| + | | ||
| + | remove_tmp_key | ||
| + | exit 1 | ||
| + | fi | ||
| + | remove_tmp_key | ||
| + | notsynced=0 | ||
| + | done | ||
| + | log_notice " | ||
| + | else | ||
| + | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | ||
| + | do_sync_community_feed | ||
| + | fi | ||
| + | |||
| + | write_feed_xml | ||
| + | } | ||
| + | |||
| + | do_self_test | ||
| + | if [ -z " | ||
| + | then | ||
| + | SELFTEST_STDERR=0 | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | if [ 0 -ne $SELFTEST_STDERR ] | ||
| + | then | ||
| + | echo "rsync not found (required)." 1>& | ||
| + | fi | ||
| + | log_err "rsync not found (required)." | ||
| + | SELFTEST_FAIL=1 | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | |||
| + | ########## START | ||
| + | ########## ===== | ||
| + | |||
| + | while test $# -gt 0; do | ||
| + | case " | ||
| + | " | ||
| + | if [ -z " | ||
| + | ACTION=" | ||
| + | fi | ||
| + | ;; | ||
| + | " | ||
| + | do_help | ||
| + | exit 0 | ||
| + | ;; | ||
| + | " | ||
| + | FEED_TYPE=$(echo " | ||
| + | shift | ||
| + | ;; | ||
| + | esac | ||
| + | shift | ||
| + | done | ||
| + | |||
| + | init_feed_type | ||
| + | |||
| + | write_feed_xml | ||
| + | |||
| + | case " | ||
| + | --version) | ||
| + | echo $VERSION | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --identify) | ||
| + | echo " | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --describe) | ||
| + | do_describe | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --feedversion) | ||
| + | do_feedversion | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --selftest) | ||
| + | SELFTEST_FAIL=0 | ||
| + | SELFTEST_STDERR=1 | ||
| + | do_self_test | ||
| + | exit $SELFTEST_FAIL | ||
| + | ;; | ||
| + | --feedcurrent) | ||
| + | is_feed_current | ||
| + | exit $? | ||
| + | ;; | ||
| + | esac | ||
| + | |||
| + | SELFTEST_FAIL=0 | ||
| + | do_self_test | ||
| + | if [ $SELFTEST_FAIL -ne 0 ] | ||
| + | then | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | is_feed_current | ||
| + | if [ $FEED_CURRENT -eq 1 ] | ||
| + | then | ||
| + | log_notice "Feed is already current, skipping synchronization." | ||
| + | exit 0 | ||
| + | fi | ||
| + | ( | ||
| + | chmod +660 $LOCK_FILE | ||
| + | flock -n 9 | ||
| + | if [ $? -eq 1 ]; then | ||
| + | log_notice "Sync in progress, exiting." | ||
| + | exit 1 | ||
| + | fi | ||
| + | date > $LOCK_FILE | ||
| + | sync_feed_data | ||
| + | echo -n > $LOCK_FILE | ||
| + | ) 9>> | ||
| + | |||
| + | exit 0 | ||
| </ | </ | ||
| - | =====Les Contre-Mesures===== | + | Rendez le script exécutable : |
| - | Les contre-mesures incluent l' | + | < |
| + | [root@centos7 ~]# chmod +x greenbone-feed-sync | ||
| + | </ | ||
| - | ====LAB #2 - Mise en place du Système de Détection d' | + | Déplacez le script vers **/ |
| - | Snort est un **S**ystème de **D**étection d' | + | < |
| + | [root@centos7 ~]# mv greenbone-feed-sync / | ||
| + | </ | ||
| - | === Installation === | + | Créez le répertoire **/ |
| - | Sous Debian 12, **snort** n'est pas installé par défaut. Qui plus est **snort** ne se trouve pas dans les dépôts standards. | + | < |
| + | [root@centos7 ~]# mkdir / | ||
| + | </ | ||
| - | Commencez donc par installer | + | Devenez l' |
| < | < | ||
| - | root@debian12:~# apt-get install | + | [root@centos7 ~]# su - trainee |
| + | Last login: Mon Dec 1 17:30:45 CET 2025 on pts/0 | ||
| + | |||
| + | [trainee@centos7 | ||
| + | |||
| + | [trainee@centos7 ~]$ greenbone-feed-sync --type SCAP | ||
| + | Greenbone community feed server - http:// | ||
| + | This service is hosted by Greenbone Networks - http:// | ||
| + | |||
| + | All transactions are logged. | ||
| + | |||
| + | If you have any questions, please use the Greenbone community portal. | ||
| + | See https:// | ||
| + | |||
| + | By using this service you agree to our terms and conditions. | ||
| + | |||
| + | Only one sync per time, otherwise the source ip will be temporarily blocked. | ||
| + | |||
| + | |||
| + | receiving incremental file list | ||
| + | timestamp | ||
| + | 13 100% | ||
| + | |||
| + | sent 43 bytes received 108 bytes 100.67 bytes/sec | ||
| + | total size is 13 speedup is 0.09 | ||
| + | Greenbone community feed server | ||
| + | This service is hosted by Greenbone Networks | ||
| + | |||
| + | All transactions are logged. | ||
| + | |||
| + | If you have any questions, please use the Greenbone community portal. | ||
| + | See https:// | ||
| + | |||
| + | By using this service you agree to our terms and conditions. | ||
| + | |||
| + | Only one sync per time, otherwise the source ip will be temporarily blocked. | ||
| + | |||
| + | |||
| + | receiving incremental file list | ||
| + | ./ | ||
| + | COPYING | ||
| + | 1,187 100% 1.13MB/ | ||
| + | nvdcve-2.0-2002.xml | ||
| + | | ||
| + | nvdcve-2.0-2003.xml | ||
| + | 4,744,330 100% | ||
| + | nvdcve-2.0-2004.xml | ||
| + | 9,416,639 100% | ||
| + | nvdcve-2.0-2005.xml | ||
| + | | ||
| + | nvdcve-2.0-2006.xml | ||
| + | | ||
| + | nvdcve-2.0-2007.xml | ||
| + | | ||
| + | nvdcve-2.0-2008.xml | ||
| + | | ||
| + | nvdcve-2.0-2009.xml | ||
| + | | ||
| + | nvdcve-2.0-2010.xml | ||
| + | | ||
| + | nvdcve-2.0-2011.xml | ||
| + | | ||
| + | nvdcve-2.0-2012.xml | ||
| + | | ||
| + | nvdcve-2.0-2013.xml | ||
| + | | ||
| + | nvdcve-2.0-2014.xml | ||
| + | | ||
| + | nvdcve-2.0-2015.xml | ||
| + | 124,671,234 100% 227.33MB/ | ||
| + | nvdcve-2.0-2016.xml | ||
| + | 161,692,009 100% 172.29MB/ | ||
| + | nvdcve-2.0-2017.xml | ||
| + | 189,948,654 100% 141.52MB/ | ||
| + | nvdcve-2.0-2018.xml | ||
| + | 210,761,959 100% 156.30MB/ | ||
| + | nvdcve-2.0-2019.xml | ||
| + | 265,685,784 100% 172.95MB/ | ||
| + | nvdcve-2.0-2020.xml | ||
| + | 294,835,369 100% 134.53MB/ | ||
| + | nvdcve-2.0-2021.xml | ||
| + | 442,673,740 100% 155.72MB/ | ||
| + | nvdcve-2.0-2022.xml | ||
| + | 743,192,055 100% 111.53MB/ | ||
| + | nvdcve-2.0-2023.xml | ||
| + | 599,785,077 100% | ||
| + | nvdcve-2.0-2024.xml | ||
| + | 922,757,332 100% | ||
| + | nvdcve-2.0-2025.xml | ||
| + | 480,360,705 100% 127.96MB/ | ||
| + | official-cpe-dictionary_v2.2.xml | ||
| + | 784,852,577 100% 251.59MB/ | ||
| + | timestamp | ||
| + | 13 100% | ||
| + | |||
| + | sent 2,186,887 bytes received 11,127,079 bytes 117,303.67 bytes/sec | ||
| + | total size is 5, | ||
| + | |||
| + | [trainee@centos7 ~]$ greenbone-scapdata-sync | ||
| + | |||
| + | [trainee@centos7 ~]$ exit | ||
| </ | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - En cas d' | ||
| + | </ | ||
| + | |||
| + | Exécutez de nouveau la commande **openvas-check-setup** : | ||
| < | < | ||
| - | root@debian12:~# mkdir ~/prce2_src && cd ~/prce2_src | + | [root@centos7 |
| + | ... | ||
| + | Step 2: Checking OpenVAS Manager ... | ||
| + | OK: OpenVAS Manager is present in version 6.0.9. | ||
| + | OK: OpenVAS Manager client certificate is present as /etc/pki/ | ||
| + | OK: OpenVAS Manager database found in / | ||
| + | OK: Access rights for the OpenVAS Manager database are correct. | ||
| + | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. | ||
| + | OK: OpenVAS Manager database is at revision 146. | ||
| + | OK: OpenVAS Manager expects database at revision 146. | ||
| + | OK: Database schema is up to date. | ||
| + | OK: OpenVAS Manager database contains information about 45654 NVTs. | ||
| + | OK: At least one user exists. | ||
| + | OK: OpenVAS SCAP database found in / | ||
| + | ERROR: No OpenVAS CERT database found. (Tried: / | ||
| + | FIX: Run a CERT synchronization script like openvas-certdata-sync or greenbone-certdata-sync. | ||
| - | root@debian12:~/ | + | ERROR: Your OpenVAS-8 installation is not yet complete! |
| - | Cloning into ' | + | ... |
| - | remote: Enumerating objects: 21776, done. | + | </code> |
| - | remote: Counting objects: 100% (253/253), done. | + | |
| - | remote: Compressing objects: 100% (151/151), done. | + | |
| - | remote: Total 21776 (delta 165), reused 125 (delta 102), pack-reused 21523 (from 3) | + | |
| - | Receiving objects: 100% (21776/ | + | |
| - | Resolving deltas: 100% (18190/18190), done. | + | |
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | Créez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# touch / | ||
| </ | </ | ||
| - | Téléchargez et désarchivez**snort** : | + | Exécutez la commande |
| < | < | ||
| - | root@debian12:~# mkdir ~/snort_src && cd ~/snort_src | + | [root@centos7 |
| + | </code> | ||
| - | root@debian12:~/snort_src# git clone https://github.com/snort3/snort3.git | + | Exécutez encore une fois la commande **openvas-check-setup** : |
| - | Cloning into ' | + | |
| - | remote: Enumerating objects: 123479, done. | + | < |
| - | remote: Counting objects: 100% (12563/12563), done. | + | [root@centos7 |
| - | remote: Compressing objects: 100% (1891/1891), done. | + | openvas-check-setup 2.3.3 |
| - | remote: Total 123479 | + | Test completeness and readiness of OpenVAS-8 |
| - | Receiving objects: 100% (123479/ | + | (add ' |
| - | Resolving deltas: 100% (104741/104741), done. | + | if you want to check for another OpenVAS version) |
| + | |||
| + | Please report us any non-detected problems and | ||
| + | help us to improve this check routine: | ||
| + | http://lists.wald.intevation.org/mailman/listinfo/ | ||
| + | |||
| + | Send us the log-file (/ | ||
| + | |||
| + | Use the parameter --server to skip checks for client tools | ||
| + | like GSD and OpenVAS-CLI. | ||
| + | |||
| + | Step 1: Checking OpenVAS Scanner | ||
| + | OK: OpenVAS Scanner is present in version 5.0.6. | ||
| + | OK: OpenVAS Scanner CA Certificate is present as / | ||
| + | OK: redis-server is present in version v=3.2.12. | ||
| + | OK: scanner | ||
| + | OK: redis-server is running and listening on socket: / | ||
| + | OK: redis-server configuration is OK and redis-server is running. | ||
| + | OK: NVT collection in / | ||
| + | WARNING: Signature checking of NVTs is not enabled in OpenVAS Scanner. | ||
| + | SUGGEST: Enable signature checking | ||
| + | OK: The NVT cache in / | ||
| + | Step 2: Checking OpenVAS Manager ... | ||
| + | OK: OpenVAS Manager is present in version 6.0.9. | ||
| + | OK: OpenVAS Manager client certificate is present as / | ||
| + | OK: OpenVAS Manager database found in / | ||
| + | OK: Access rights for the OpenVAS Manager database are correct. | ||
| + | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. | ||
| + | OK: OpenVAS Manager database is at revision 146. | ||
| + | OK: OpenVAS Manager expects database at revision 146. | ||
| + | OK: Database schema is up to date. | ||
| + | OK: OpenVAS Manager database contains information about 138097 NVTs. | ||
| + | OK: At least one user exists. | ||
| + | OK: OpenVAS SCAP database found in / | ||
| + | OK: OpenVAS CERT database found in / | ||
| + | OK: xsltproc found. | ||
| + | Step 3: Checking user configuration ... | ||
| + | WARNING: Your password policy is empty. | ||
| + | SUGGEST: Edit the / | ||
| + | Step 4: Checking Greenbone Security Assistant | ||
| + | OK: Greenbone Security Assistant is present in version 6.0.11. | ||
| + | Step 5: Checking OpenVAS CLI ... | ||
| + | OK: OpenVAS CLI version 1.4.4. | ||
| + | Step 6: Checking Greenbone Security Desktop | ||
| + | SKIP: Skipping check for Greenbone Security Desktop. | ||
| + | Step 7: Checking if OpenVAS services are up and running ... | ||
| + | OK: netstat found, extended checks of the OpenVAS services enabled. | ||
| + | OK: OpenVAS Scanner is running and listening on all interfaces. | ||
| + | OK: OpenVAS Scanner is listening on port 9391, which is the default port. | ||
| + | ERROR: OpenVAS Manager is NOT running! | ||
| + | FIX: Start OpenVAS Manager | ||
| + | ERROR: Greenbone Security Assistant is NOT running! | ||
| + | FIX: Start Greenbone Security Assistant | ||
| + | |||
| + | | ||
| + | |||
| + | Please follow the instructions marked with FIX above and run this | ||
| + | script again. | ||
| + | |||
| + | If you think this result is wrong, please report your observation | ||
| + | and help us to improve this check routine: | ||
| + | http:// | ||
| + | Please attach the log-file | ||
| </ | </ | ||
| - | Créez un lien symbolique pour la bibliothèque partagée | + | <WRAP center round important 50%> |
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | Activer et démarrer OpenVAS Manager | ||
| < | < | ||
| - | [root@centos7 ~]# ln -s /usr/lib64/libdnet.so.1.0.1 /usr/lib64/libdnet.1 | + | [root@centos7 ~]# systemctl enable openvas-manager |
| + | Created symlink from / | ||
| + | |||
| + | [root@centos7 ~]# systemctl start openvas-manager | ||
| + | |||
| + | [root@centos7 ~]# systemctl status openvas-manager | ||
| + | ● openvas-manager.service - OpenVAS Manager | ||
| + | | ||
| + | | ||
| + | Process: 12237 ExecStart=/usr/sbin/openvasmd $MANAGER_LISTEN $MANAGER_PORT $SCANNER_LISTEN $SCANNER_PORT $MANAGER_OTP (code=exited, | ||
| + | Main PID: 12238 (openvasmd) | ||
| + | | ||
| + | | ||
| + | |||
| + | Dec 02 11:51:41 centos7.fenestros.loc systemd[1]: Starting OpenVAS Manager... | ||
| + | Dec 02 11:51:41 centos7.fenestros.loc systemd[1]: Started OpenVAS Manager. | ||
| </ | </ | ||
| - | Dernièrement, | + | Activer et démarrer |
| < | < | ||
| - | [root@centos7 ~]# chmod ug+x /var/log/snort | + | [root@centos7 ~]# systemctl enable openvas-gsa |
| + | Created symlink from /etc/systemd/system/ | ||
| + | |||
| + | [root@centos7 ~]# systemctl start openvas-gsa | ||
| + | |||
| + | [root@centos7 ~]# systemctl status openvas-gsa | ||
| + | ● openvas-gsa.service - OpenVAS Greenbone Security Assistant | ||
| + | | ||
| + | | ||
| + | Process: 12948 ExecStart=/ | ||
| + | Main PID: 12949 (gsad) | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Dec 02 11:53:08 centos7.fenestros.loc systemd[1]: Starting OpenVAS Greenbone Security Assistant... | ||
| + | Dec 02 11:53:08 centos7.fenestros.loc systemd[1]: Started OpenVAS Greenbone Security Assistant. | ||
| </ | </ | ||
| - | ==Options de la commande== | + | Exécutez encore une fois la commande |
| - | Les options de cette commande sont : | + | < |
| + | [root@centos7 ~]# openvas-check-setup | ||
| + | openvas-check-setup 2.3.3 | ||
| + | Test completeness and readiness of OpenVAS-8 | ||
| + | (add ' | ||
| + | if you want to check for another OpenVAS version) | ||
| + | |||
| + | Please report us any non-detected problems and | ||
| + | help us to improve this check routine: | ||
| + | http:// | ||
| + | |||
| + | Send us the log-file (/ | ||
| + | |||
| + | Use the parameter --server to skip checks for client tools | ||
| + | like GSD and OpenVAS-CLI. | ||
| + | |||
| + | Step 1: Checking OpenVAS Scanner ... | ||
| + | OK: OpenVAS Scanner is present in version 5.0.6. | ||
| + | OK: OpenVAS Scanner CA Certificate is present as / | ||
| + | OK: redis-server is present in version v=3.2.12. | ||
| + | OK: scanner (kb_location setting) is configured properly using the redis-server socket: / | ||
| + | OK: redis-server is running and listening on socket: / | ||
| + | OK: redis-server configuration is OK and redis-server is running. | ||
| + | OK: NVT collection in / | ||
| + | WARNING: Signature checking of NVTs is not enabled in OpenVAS Scanner. | ||
| + | SUGGEST: Enable signature checking (see http:// | ||
| + | OK: The NVT cache in / | ||
| + | Step 2: Checking OpenVAS Manager ... | ||
| + | OK: OpenVAS Manager is present in version 6.0.9. | ||
| + | OK: OpenVAS Manager client certificate is present as / | ||
| + | OK: OpenVAS Manager database found in / | ||
| + | OK: Access rights for the OpenVAS Manager database are correct. | ||
| + | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. | ||
| + | OK: OpenVAS Manager database is at revision 146. | ||
| + | OK: OpenVAS Manager expects database at revision 146. | ||
| + | OK: Database schema is up to date. | ||
| + | OK: OpenVAS Manager database contains information about 138097 NVTs. | ||
| + | OK: At least one user exists. | ||
| + | OK: OpenVAS SCAP database found in / | ||
| + | OK: OpenVAS CERT database found in / | ||
| + | OK: xsltproc found. | ||
| + | Step 3: Checking user configuration ... | ||
| + | WARNING: Your password policy is empty. | ||
| + | SUGGEST: Edit the / | ||
| + | Step 4: Checking Greenbone Security Assistant (GSA) ... | ||
| + | OK: Greenbone Security Assistant is present in version 6.0.11. | ||
| + | Step 5: Checking OpenVAS CLI ... | ||
| + | OK: OpenVAS CLI version 1.4.4. | ||
| + | Step 6: Checking Greenbone Security Desktop (GSD) ... | ||
| + | SKIP: Skipping check for Greenbone Security Desktop. | ||
| + | Step 7: Checking if OpenVAS services are up and running ... | ||
| + | OK: netstat found, extended checks of the OpenVAS services enabled. | ||
| + | OK: OpenVAS Scanner is running and listening on all interfaces. | ||
| + | OK: OpenVAS Scanner is listening on port 9391, which is the default port. | ||
| + | OK: OpenVAS Manager is running and listening on all interfaces. | ||
| + | OK: OpenVAS Manager is listening on port 9390, which is the default port. | ||
| + | OK: Greenbone Security Assistant is listening on port 80, which is the default port. | ||
| + | Step 8: Checking nmap installation ... | ||
| + | WARNING: No nmap installation found. | ||
| + | SUGGEST: You should install nmap for comprehensive network scanning (see http:// | ||
| + | Step 10: Checking presence of optional tools ... | ||
| + | WARNING: Could not find pdflatex binary, the PDF report format will not work. | ||
| + | SUGGEST: Install pdflatex. | ||
| + | OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work. | ||
| + | OK: rpm found, LSC credential package generation for RPM based targets is likely to work. | ||
| + | WARNING: Could not find alien binary, LSC credential package generation for DEB based targets will not work. | ||
| + | SUGGEST: Install alien. | ||
| + | WARNING: Could not find makensis binary, LSC credential package generation for Microsoft Windows targets will not work. | ||
| + | SUGGEST: Install nsis. | ||
| + | OK: SELinux is disabled. | ||
| + | |||
| + | It seems like your OpenVAS-8 installation is OK. | ||
| + | |||
| + | If you think it is not OK, please report your observation | ||
| + | and help us to improve this check routine: | ||
| + | http:// | ||
| + | Please attach the log-file (/ | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez les WARNINGS. | ||
| + | </ | ||
| + | |||
| + | Installez les paquets suggérés | ||
| < | < | ||
| - | [root@centos7 ~]# snort --help | + | [root@centos7 ~]# yum install nmap texlive-latex-bin-bin alien -y |
| + | </ | ||
| - | ,, | + | Exécutez de nouveau la commande |
| - | o" | + | |
| - | '''' | + | |
| - | | + | |
| - | | + | |
| - | Using libpcap version 1.5.3 | + | |
| - | Using PCRE version: 8.32 2012-11-30 | + | |
| - | Using ZLIB version: 1.2.7 | + | |
| - | USAGE: snort [-options] | + | <code> |
| - | Options: | + | [root@centos7 ~]# openvas-check-setup |
| - | -A Set alert mode: fast, full, console, test or none (alert file alerts only) | + | ... |
| - | " | + | Step 10: Checking presence |
| - | -b Log packets in tcpdump format (much faster!) | + | |
| - | -B < | + | |
| - | -c < | + | |
| - | -C Print out payloads with character data only (no hex) | + | |
| - | -d Dump the Application Layer | + | OK: rpm found, LSC credential package generation for RPM based targets |
| - | -D Run Snort in background (daemon) mode | + | OK: alien found, LSC credential package generation |
| - | -e | + | |
| - | -f Turn off fflush() calls after binary log writes | + | |
| - | -F < | + | OK: SELinux |
| - | -g < | + | |
| - | -G < | + | |
| - | -h < | + | |
| - | (for use with -l or -B, does NOT change $HOME_NET in IDS mode) | + | |
| - | -H Make hash tables deterministic. | + | |
| - | -i < | + | |
| - | -I Add Interface name to alert output | + | |
| - | -k < | + | |
| - | -K < | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -m < | + | |
| - | -n < | + | |
| - | -N Turn off logging (alerts still work) | + | |
| - | -O | + | |
| - | -p | + | |
| - | -P < | + | |
| - | -q Quiet. Don't show banner and status report | + | |
| - | -Q | + | |
| - | | + | |
| - | -R < | + | |
| - | | + | |
| - | -S < | + | |
| - | -t < | + | |
| - | -T Test and report | + | |
| - | | + | |
| - | -U Use UTC for timestamps | + | |
| - | -v Be verbose | + | |
| - | -V Show version number | + | |
| - | -X Dump the raw packet data starting at the link layer | + | |
| - | -x Exit if Snort configuration problems occur | + | |
| - | -y | + | |
| - | -Z < | + | |
| - | -? Show this information | + | |
| - | <Filter Options> are standard BPF options, as seen in TCPDump | + | |
| - | Longname options and their corresponding single char version | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | --process-all-events | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | --pcap-dir < | + | |
| - | | + | |
| - | --pcap-no-filter | + | |
| - | | + | |
| - | for < | + | |
| - | --pcap-reset | + | |
| - | --pcap-reload | + | |
| - | | + | |
| - | | + | |
| - | takes from signaling until DAQ_Stop() is called. | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | --daq < | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| + | It seems like your OpenVAS-8 installation is OK. | ||
| + | ... | ||
| </ | </ | ||
| - | ===Configuration de Snort=== | + | <WRAP center round important 50%> |
| + | **Important** - Notez la ligne **WARNING: PDF generation failed, most likely due to missing LaTeX packages. The PDF report format will not work.** | ||
| + | </ | ||
| - | Snort a besoin de règles pour fonctionner correctement. Ces règles sont disponibles sous trois formes différentes | + | Pour pouvoir utiliser les rapports au format PDF, installez les paquets suivants |
| - | * **Community** - règles de base disponibles à tout le monde, | + | < |
| - | * **Registered** - règles disponibles à toute personne possédant un compte gratuit sur le site **[[http:// | + | [root@centos7 ~]# yum -y install texlive-collection-fontsrecommended texlive-collection-latexrecommended texlive-changepage texlive-titlesec -y |
| - | * **Subscription** | + | </ |
| - | Le répertoire | + | Téléchargez ensuite le fichier **comment.sty** vers le répertoire |
| < | < | ||
| - | [root@centos7 ~]# ls /etc/snort/rules/ | + | [root@centos7 ~]# mkdir -p /usr/share/texlive/texmf-local/ |
| - | [root@centos7 ~]# | + | |
| + | [root@centos7 ~]# cd / | ||
| + | |||
| + | [root@centos7 comment]# wget http:// | ||
| + | --2025-12-02 13: | ||
| + | Resolving mirrors.ctan.org (mirrors.ctan.org)... 89.58.7.101, | ||
| + | Connecting to mirrors.ctan.org (mirrors.ctan.org)|89.58.7.101|: | ||
| + | HTTP request sent, awaiting response... 307 Temporary Redirect | ||
| + | Location: https:// | ||
| + | --2025-12-02 13: | ||
| + | Resolving mirror.its.dal.ca (mirror.its.dal.ca)... 192.75.96.254 | ||
| + | Connecting to mirror.its.dal.ca (mirror.its.dal.ca)|192.75.96.254|: | ||
| + | HTTP request sent, awaiting response... 200 OK | ||
| + | Length: 10197 (10.0K) [application/ | ||
| + | Saving to: ‘comment.sty’ | ||
| + | |||
| + | 100%[========================================================================================================================================================================> | ||
| + | |||
| + | 2025-12-02 13:35:43 (175 MB/s) - ‘comment.sty’ saved [10197/ | ||
| + | |||
| + | [root@centos7 comment]# chmod 644 comment.sty | ||
| + | |||
| + | [root@centos7 comment]# texhash | ||
| + | texhash: Updating / | ||
| + | texhash: Updating / | ||
| + | texhash: Updating / | ||
| + | texhash: Updating / | ||
| + | texhash: Updating / | ||
| + | texhash: Done | ||
| </ | </ | ||
| - | Téléchargez les règles | + | Exécutez une dernière fois la commande |
| < | < | ||
| - | [root@centos7 | + | [root@centos7 |
| + | ... | ||
| + | Step 10: Checking presence of optional tools ... | ||
| + | OK: pdflatex found. | ||
| + | OK: PDF generation successful. The PDF report format is likely to work. | ||
| + | OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work. | ||
| + | OK: rpm found, LSC credential package generation for RPM based targets is likely to work. | ||
| + | OK: alien found, LSC credential package generation for DEB based targets is likely to work. | ||
| + | WARNING: Could not find makensis binary, LSC credential package generation for Microsoft Windows targets will not work. | ||
| + | SUGGEST: Install nsis. | ||
| + | OK: SELinux is disabled. | ||
| + | |||
| + | It seems like your OpenVAS-8 installation is OK. | ||
| + | ... | ||
| </ | </ | ||
| - | Ensuite, saisissez les commandes suivantes | + | <WRAP center round important 50%> |
| + | **Important** - Notez la ligne **WARNING: Could not find makensis binary, LSC credential package generation for Microsoft Windows targets will not work.** | ||
| + | </ | ||
| + | |||
| + | Téléchargez et installez le fichier **mingw32-nsis-3.01-1.el7.x86_64.rpm** | ||
| < | < | ||
| - | [root@centos7 ~]# tar -xvf ~/ | + | [root@centos7 ~]# cd ~ |
| - | [root@centos7 ~]# ls /etc/snort/rules | + | |
| - | app-detect.rules file-image.rules | + | [root@centos7 ~]# wget ftp://ftp.icm.edu.pl/vol/ |
| - | attack-responses.rules file-java.rules nntp.rules | + | --2025-12-02 13: |
| - | backdoor.rules file-multimedia.rules oracle.rules | + | => ‘mingw32-nsis-3.01-1.el7.x86_64.rpm’ |
| - | bad-traffic.rules | + | Resolving ftp.icm.edu.pl (ftp.icm.edu.pl)... 193.219.28.2, |
| - | blacklist.rules | + | Connecting to ftp.icm.edu.pl (ftp.icm.edu.pl)|193.219.28.2|: |
| - | botnet-cnc.rules file-pdf.rules os-other.rules | + | Logging in as anonymous |
| - | browser-chrome.rules finger.rules | + | ==> SYST ... done. ==> PWD ... done. |
| - | browser-firefox.rules | + | ==> TYPE I ... done. ==> CWD (1) / |
| - | browser-ie.rules | + | ==> SIZE mingw32-nsis-3.01-1.el7.x86_64.rpm ... 1379180 |
| - | browser-other.rules icmp.rules p2p.rules pua-adware.rules tftp.rules | + | ==> PASV ... done. |
| - | browser-plugins.rules imap.rules | + | Length: 1379180 (1.3M) (unauthoritative) |
| - | browser-webkit.rules indicator-compromise.rules | + | |
| - | chat.rules indicator-obfuscation.rules policy-other.rules pua-toolbars.rules VRT-License.txt | + | 100%[========================================================================================================================================================================> |
| - | content-replace.rules | + | |
| - | ddos.rules indicator-shellcode.rules policy-social.rules rservices.rules web-attacks.rules | + | 2025-12-02 13:46:28 (2.05 MB/s) - ‘mingw32-nsis-3.01-1.el7.x86_64.rpm’ saved [1379180] |
| - | deleted.rules info.rules | + | |
| - | dns.rules local.rules pop2.rules scan.rules | + | [root@centos7 ~]# yum localinstall mingw32-nsis-3.01-1.el7.x86_64.rpm --nogpgcheck -y |
| - | dos.rules | + | </ |
| - | experimental.rules malware-cnc.rules protocol-dns.rules | + | |
| - | exploit-kit.rules | + | Exécutez une dernière fois la commande **openvas-check-setup** : |
| - | exploit.rules | + | |
| - | file-executable.rules | + | < |
| - | file-flash.rules multimedia.rules | + | [root@centos7 ~]# openvas-check-setup |
| - | file-identify.rules mysql.rules protocol-nntp.rules server-other.rules | + | ... |
| + | Step 10: Checking presence of optional tools ... | ||
| + | OK: pdflatex found. | ||
| + | OK: PDF generation successful. The PDF report format is likely to work. | ||
| + | OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work. | ||
| + | OK: rpm found, LSC credential package generation for RPM based targets is likely to work. | ||
| + | OK: alien found, LSC credential package generation for DEB based targets is likely to work. | ||
| + | OK: nsis found, LSC credential package generation for Microsoft Windows targets is likely to work. | ||
| + | OK: SELinux is disabled. | ||
| + | |||
| + | It seems like your OpenVAS-8 installation is OK. | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | ===2.5 | ||
| + | |||
| + | Retournez à l' | ||
| + | |||
| + | Ouvrez un navigateur web dans la VM et saisissez l' | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Créez une exception pour le Self Signed Certificate. Vous obtiendrez une fenêtre similaire à celle-ci: | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Entrez le nom de votre utilisateur (fenestros) ainsi que son mot de passe (fenestros) et cliquez sur le bouton **Login**. Vous obtiendrez une fenêtre similaire à celle-ci : | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Dans la boîte **Quick start**, entrez l' | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** | ||
| + | </ | ||
| + | |||
| + | ===Analyse des Résultats=== | ||
| + | |||
| + | A l'issu de l' | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | ainsi que les détails de celui-ci : | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Vous trouverez aussi une **solution** ainsi qu'une évaluation du niveau de risque, **Risk factor**. | ||
| + | |||
| + | {{ : | ||
| + | {{ : | ||
| + | |||
| + | |||
| + | =====LAB #3 - Sécuriser le Serveur DNS===== | ||
| + | |||
| + | ====3.1 - Le serveur DNS==== | ||
| + | |||
| + | Le principe du DNS est basé sur l' | ||
| + | |||
| + | Le **DNS** ( Domain Name Service ) est né peut après l' | ||
| + | |||
| + | Lorsqu' | ||
| + | |||
| + | Ce processus tente d' | ||
| + | |||
| + | Si cette tentative échoue, le serveur DNS cherche le serveur de domaine pour le **TLD** ( Top Level Domain ) dans son cache afin de lui demander l' | ||
| + | |||
| + | Si cette recherche échoue, le serveur s' | ||
| + | |||
| + | Le serveur DNS sert à faire la résolution de noms. Autrement dit de traduire une adresse Internet telle que **www.ittraining.com **en **numéro IP**. | ||
| + | |||
| + | ====3.2 - Préparation à l' | ||
| + | |||
| + | Le serveur DNS nécessite que la machine sur laquelle il est installé possède un nom FQDN et une adresse IP fixe. Il est également important de noter que le service de bind ne démarrera **pas** dans le cas où le fichier **/ | ||
| + | |||
| + | * Modification de l' | ||
| + | * Définition d'un nom FQDN (Fully Qualified Domain Name) | ||
| + | * Vérification du fichier / | ||
| + | |||
| + | Afin d' | ||
| + | |||
| + | * **FQDN** | ||
| + | * **Adresse IP** - 10.0.2.46 | ||
| + | |||
| + | Vérifiez la configuration de la VM : | ||
| + | |||
| + | < | ||
| + | root@debian12: | ||
| + | debian12 | ||
| + | |||
| + | root@debian12: | ||
| + | |||
| + | root@debian12: | ||
| + | debian12.ittraining.loc | ||
| + | |||
| + | root@debian12: | ||
| + | NAME UUID TYPE DEVICE | ||
| + | ip_fixe | ||
| + | lo c4172990-a224-464f-a1de-9820ca5e83c8 | ||
| + | Wired connection 1 77c569e6-3176-4c10-8008-40d7634d2504 | ||
| + | |||
| + | root@debian12: | ||
| + | 1: lo: < | ||
| + | link/ | ||
| + | inet 127.0.0.1/8 scope host lo | ||
| + | | ||
| + | inet6 ::1/128 scope host noprefixroute | ||
| + | | ||
| + | 2: ens18: < | ||
| + | link/ether 56: | ||
| + | altname enp0s18 | ||
| + | inet 10.0.2.46/24 brd 10.0.2.255 scope global noprefixroute ens18 | ||
| + | valid_lft forever preferred_lft forever | ||
| + | inet6 fe80:: | ||
| + | | ||
| + | |||
| + | root@debian12: | ||
| + | 127.0.0.1 | ||
| + | 10.0.2.46 | ||
| + | |||
| + | # The following lines are desirable for IPv6 capable hosts | ||
| + | ::1 | ||
| + | ff02::1 ip6-allnodes | ||
| + | ff02::2 ip6-allrouters | ||
| </ | </ | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Si vous utilisez **snort** régulièrement, vous devez prendre un abonnement sur le site [[http:// | + | **Important** - La configuration du serveur DNS dépend du nom de votre machine. Dans le cas où vous changeriez ce nom, vous devez reconfigurer votre serveur DNS en éditant |
| </ | </ | ||
| - | == Editer le fichier / | + | ====3.3 - Installation==== |
| - | Lancez vi pour éditer | + | Pour installer |
| - | Modifiez | + | < |
| + | root@debian12: | ||
| + | |||
| + | root@debian12: | ||
| + | ● named.service - BIND Domain Name Server | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Main PID: 32581 (named) | ||
| + | | ||
| + | Tasks: 26 (limit: 19123) | ||
| + | | ||
| + | CPU: 215ms | ||
| + | | ||
| + | | ||
| + | |||
| + | Dec 07 11:19:19 debian12.ittraining.loc named[32581]: | ||
| + | Dec 07 11:19:19 debian12.ittraining.loc named[32581]: | ||
| + | Dec 07 11:19:19 debian12.ittraining.loc named[32581]: | ||
| + | Dec 07 11:19:19 debian12.ittraining.loc named[32581]: | ||
| + | Dec 07 11:19:19 debian12.ittraining.loc named[32581]: | ||
| + | Dec 07 11:19:19 debian12.ittraining.loc named[32581]: | ||
| + | Dec 07 11:19:19 debian12.ittraining.loc named[32581]: | ||
| + | Dec 07 11:19:19 debian12.ittraining.loc named[32581]: | ||
| + | Dec 07 11:19:19 debian12.ittraining.loc named[32581]: | ||
| + | Dec 07 11:19:19 debian12.ittraining.loc named[32581]: | ||
| + | </ | ||
| + | |||
| + | ===Options de la commande named=== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | root@debian12: | ||
| + | usage: named [-4|-6] [-c conffile] [-d debuglevel] [-D comment] [-E engine] | ||
| + | | ||
| + | [-S sockets] [-t chrootdir] [-u username] [-U listeners] | ||
| + | [-X lockfile] [-m {usage|trace|record}] | ||
| + | [-M fill|nofill] | ||
| + | usage: named [-v|-V|-C] | ||
| + | named: extra command line arguments | ||
| + | </ | ||
| + | |||
| + | ====3.4 - Les fichiers de configuration==== | ||
| + | |||
| + | Sous Debian12, les fichiers de configuration de **bind9** se trouvent dans **/ | ||
| + | |||
| + | < | ||
| + | root@debian12: | ||
| + | total 48 | ||
| + | -rw-r--r-- 1 root root 2928 Oct 22 17:38 bind.keys | ||
| + | -rw-r--r-- 1 root root 255 Oct 22 17:38 db.0 | ||
| + | -rw-r--r-- 1 root root 271 Oct 22 17:38 db.127 | ||
| + | -rw-r--r-- 1 root root 237 Oct 22 17:38 db.255 | ||
| + | -rw-r--r-- 1 root root 353 Oct 22 17:38 db.empty | ||
| + | -rw-r--r-- 1 root root 270 Oct 22 17:38 db.local | ||
| + | -rw-r--r-- 1 root bind 458 Oct 22 17:38 named.conf | ||
| + | -rw-r--r-- 1 root bind 498 Oct 22 17:38 named.conf.default-zones | ||
| + | -rw-r--r-- 1 root bind 165 Oct 22 17:38 named.conf.local | ||
| + | -rw-r--r-- 1 root bind 846 Oct 22 17:38 named.conf.options | ||
| + | -rw-r----- 1 bind bind 100 Dec 7 11:19 rndc.key | ||
| + | -rw-r--r-- 1 root root 1317 Oct 22 17:38 zones.rfc1918 | ||
| + | </ | ||
| + | |||
| + | ===named.conf=== | ||
| + | |||
| + | Le fichier de configuration principal du serveur DNS Bind est **/ | ||
| + | |||
| + | < | ||
| + | root@debian12: | ||
| + | // This is the primary configuration file for the BIND DNS server named. | ||
| + | // | ||
| + | // Please read / | ||
| + | // structure of BIND configuration files in Debian, *BEFORE* you customize | ||
| + | // this configuration file. | ||
| + | // | ||
| + | // If you are just adding zones, please do that in / | ||
| + | |||
| + | include "/ | ||
| + | include "/ | ||
| + | include "/ | ||
| + | </ | ||
| + | |||
| + | Les directives **include**, | ||
| + | |||
| + | < | ||
| + | root@debian12: | ||
| + | options { | ||
| + | directory "/ | ||
| + | |||
| + | // If there is a firewall between you and nameservers you want | ||
| + | // to talk to, you may need to fix the firewall to allow multiple | ||
| + | // ports to talk. See http:// | ||
| + | |||
| + | // If your ISP provided one or more IP addresses for stable | ||
| + | // nameservers, | ||
| + | // Uncomment the following block, and insert the addresses replacing | ||
| + | // the all-0' | ||
| + | |||
| + | // forwarders { | ||
| + | // 0.0.0.0; | ||
| + | // }; | ||
| + | |||
| + | // | ||
| + | // If BIND logs error messages about the root key being expired, | ||
| + | // you will need to update your keys. See https:// | ||
| + | // | ||
| + | dnssec-validation auto; | ||
| + | |||
| + | listen-on-v6 { any; }; | ||
| + | }; | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | root@debian12: | ||
| + | // | ||
| + | // Do any local configuration here | ||
| + | // | ||
| + | |||
| + | // Consider adding the 1918 zones here, if they are not used in your | ||
| + | // organization | ||
| + | //include "/ | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | root@debian12: | ||
| + | // prime the server with knowledge of the root servers | ||
| + | zone " | ||
| + | type hint; | ||
| + | file "/ | ||
| + | }; | ||
| + | |||
| + | // be authoritative for the localhost forward and reverse zones, and for | ||
| + | // broadcast zones as per RFC 1912 | ||
| + | |||
| + | zone " | ||
| + | type master; | ||
| + | file "/ | ||
| + | }; | ||
| + | |||
| + | zone " | ||
| + | type master; | ||
| + | file "/ | ||
| + | }; | ||
| + | |||
| + | zone " | ||
| + | type master; | ||
| + | file "/ | ||
| + | }; | ||
| + | |||
| + | zone " | ||
| + | type master; | ||
| + | file "/ | ||
| + | }; | ||
| + | </ | ||
| + | |||
| + | ===Les Sections de Zone=== | ||
| + | |||
| + | **La Valeur Type** | ||
| + | |||
| + | Maintenant, étudions les sections de zones. La valeur " | ||
| + | |||
| + | * **master** | ||
| + | * Ce type définit le serveur DNS comme serveur maître ayant **autorité** sur la zone concernée. | ||
| + | * **slave** | ||
| + | * Ce type définit le serveur DNS comme serveur esclave | ||
| + | * **stub** | ||
| + | * Ce type définit le serveur DNS comme serveur esclave pour la zone concernée mais uniquement pour les **enregistrements** de type **NS**. | ||
| + | * **forward** | ||
| + | * Ce type définit le serveur DNS comme serveur de transit pour la zone concernée. Ceci implique que toute requête est retransmise vers un autre serveur. | ||
| + | * **hint** | ||
| + | * Ce type définit la zone concernée comme une zone racine. Ceci implique que lors du démarrage du serveur, cette zone est utilisée pour récupérer les adresses des serveurs DNS racine. | ||
| + | |||
| + | La valeur " | ||
| + | |||
| + | **La Valeur File** | ||
| + | |||
| + | La deuxième directive dans une section de zone comporte | ||
| + | |||
| + | ===Exemples de Sections de Zone=== | ||
| + | |||
| + | Chaque section de zone, à l' | ||
| + | |||
| + | La zone " | ||
| < | < | ||
| ... | ... | ||
| - | ipvar HOME_NET 10.0.2.0/24 | + | zone "." { |
| + | type hint; | ||
| + | file "/usr/ | ||
| + | }; | ||
| ... | ... | ||
| </ | </ | ||
| - | Dans le cas où vous êtes connecté à deux ou à plusieurs réseaux directement, | + | La section de zone fait correspondre un nom avec une adresse IP tandis que la section de zone inversée fait l' |
| - | ipvar HOME_NET [adresse_réseau_1 ( p.e. 10.0.2.0/24 ), adresse_réseau_2 ( p.e. 10.0.0.0/8 )] | + | < |
| + | adresse_réseau_inversée.in-addr.arpa. | ||
| + | </file> | ||
| - | Vérifiez la présence de les lignes qui commencent par **var RULE_PATH**, | + | Par exemple dans le fichier ci-dessus nous trouvons |
| < | < | ||
| ... | ... | ||
| - | var RULE_PATH | + | zone " |
| - | var SO_RULE_PATH | + | type master; |
| - | var PREPROC_RULE_PATH | + | file "/etc/bind/db.local"; |
| + | }; | ||
| + | |||
| + | zone "127.in-addr.arpa" { | ||
| + | type master; | ||
| + | file "/etc/ | ||
| + | }; | ||
| + | |||
| + | zone "0.in-addr.arpa" { | ||
| + | type master; | ||
| + | file "/etc/ | ||
| + | }; | ||
| + | |||
| + | zone " | ||
| + | type master; | ||
| + | file "/ | ||
| + | }; | ||
| ... | ... | ||
| </ | </ | ||
| - | Modifiez les deux lignes suivantes afin d'utiliser des chemins absolus | + | ===Sections de Zones de votre Machine=== |
| + | |||
| + | Afin de configurer notre serveur correctement, | ||
| + | |||
| + | * La zone correspondante à notre domaine, ici appelée " | ||
| < | < | ||
| ... | ... | ||
| - | var WHITE_LIST_PATH / | + | zone " |
| - | var BLACK_LIST_PATH | + | type master; |
| + | file "/etc/bind/zones/ | ||
| + | forwarders { }; | ||
| + | }; | ||
| ... | ... | ||
| </ | </ | ||
| - | Décommentez la ligne qui commence par **ooutput unified2** concernant la journalisation et supprimez | + | |
| < | < | ||
| ... | ... | ||
| - | # unified2 | + | zone " |
| - | # Recommended for most installs | + | type master; |
| - | output unified2: filename merged.log, limit 128, mpls_event_types, | + | file "/ |
| + | forwarders { }; | ||
| + | }; | ||
| ... | ... | ||
| </ | </ | ||
| - | Commentez ensuite la ligne commençant par **dynamicdetection directory** : | + | Ajoutez donc ces deux sections au fichier |
| < | < | ||
| - | # path to dynamic rules libraries | + | root@debian12: |
| - | # dynamicdetection directory | + | |
| + | root@debian12: | ||
| + | // prime the server with knowledge of the root servers | ||
| + | zone " | ||
| + | type hint; | ||
| + | file "/usr/share/ | ||
| + | }; | ||
| + | |||
| + | // be authoritative for the localhost forward and reverse zones, and for | ||
| + | // broadcast zones as per RFC 1912 | ||
| + | |||
| + | zone " | ||
| + | type master; | ||
| + | file "/ | ||
| + | }; | ||
| + | |||
| + | zone " | ||
| + | type master; | ||
| + | file "/etc/bind/ | ||
| + | }; | ||
| + | |||
| + | zone " | ||
| + | type master; | ||
| + | file "/ | ||
| + | }; | ||
| + | |||
| + | zone " | ||
| + | type master; | ||
| + | file "/ | ||
| + | }; | ||
| + | |||
| + | zone " | ||
| + | type master; | ||
| + | file "/ | ||
| + | forwarders { }; | ||
| + | }; | ||
| + | |||
| + | zone " | ||
| + | type master; | ||
| + | file "/ | ||
| + | forwarders { }; | ||
| + | }; | ||
| </ | </ | ||
| - | Créez ensuite | + | ===Les fichiers de zone=== |
| + | |||
| + | La fichiers de zone sont composées de lignes d'une forme: | ||
| + | |||
| + | | nom | TTL | classe | ||
| + | |||
| + | où | ||
| + | |||
| + | * **nom** | ||
| + | * Le nom DNS. | ||
| + | * **TTL** | ||
| + | * La durée de vie en cache de cet enregistrement. | ||
| + | * **classe** | ||
| + | * Le réseau de transport utilisé. Dans notre cas, le réseau est du TCP. La valeur est donc IN. | ||
| + | * **type** | ||
| + | * Le type d' | ||
| + | * SOA - Start of Authority - se trouve au début du fichier et contient des informations générales | ||
| + | * NS - Name Server | ||
| + | * A - Address - indique une résolution de nom vers une adresse IP. Ne se trouve que dans les fichiers | ||
| + | * PTR - %%PoinTeR%% - indique une résolution d'une adresse IP vers un nom. Ne se trouve que dans les fichiers inversés. | ||
| + | * MX - Mail eXchange - le nom d'un serveur de mail. | ||
| + | * CNAME - Canonical Name - un alias d'une machine. | ||
| + | * HINFO - Hardware Info - fournit des informations sur le matériel de la machine | ||
| + | * **donnée** | ||
| + | * La donnée de la ressource: | ||
| + | * Une adresse IP pour un enregistrement de type A | ||
| + | * Un nom de machine pour un eregistrement de type PTR | ||
| + | |||
| + | ==ittraining.loc== | ||
| + | |||
| + | Ce fichier se trouve dans / | ||
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# mkdir /etc/bind/zones |
| - | [root@centos7 | + | |
| + | root@debian12: | ||
| + | |||
| + | root@debian12:~# cat /etc/bind/zones/ittraining.loc | ||
| + | $TTL 3D | ||
| + | @ | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | localhost | ||
| + | dnsmaster | ||
| + | debian12.ittraining.loc. | ||
| + | |||
| + | ftp IN CNAME debian12.ittraining.loc. | ||
| + | www IN CNAME debian12.ittraining.loc. | ||
| + | mail IN CNAME debian12.ittraining.loc. | ||
| + | news IN CNAME debian12.ittraining.loc. | ||
| </ | </ | ||
| - | Modifiez maintenant le fichier | + | <WRAP center round important 50%> |
| + | **Important** - Notez le point à la fin de chaque nom de domaine. Notez bien le remplacement du caractère @ dans l' | ||
| + | </ | ||
| + | |||
| + | La première ligne de ce fichier commence par une ligne semblable à celle-ci: | ||
| < | < | ||
| - | ... | + | $TTL 3D |
| - | #### General Configuration | + | </ |
| - | # What interface should snort listen on? [Pick only 1 of the next 3!] | + | Cette ligne indique aux autres serveurs DNS pendant combien de temps ils doivent garder en cache les enregistrements de cette zone. La durée peut s' |
| - | # This is -i {interface} on the command line | + | |
| - | # This is the snort.conf config interface: {interface} directive | + | La deuxième ligne définit une **classe** **IN**ternet, |
| - | # INTERFACE=eth0 | + | |
| - | INTERFACE=enp0s3 | + | <file> |
| - | # | + | @ |
| - | # The following two options are not directly supported on the command line | + | |
| - | # or in the conf file and assume the same Snort configuration for all | + | |
| - | # instances | + | |
| - | ... | + | |
| </ | </ | ||
| - | Vérifiez | + | Le caractère **@** correspond au nom de la zone et est une abréviation pour le nom de la zone décrit par le fichier de la zone, soit dans ce cas db.**ittraining.loc**.hosts, |
| - | <code> | + | <file> |
| - | [root@centos7 ~]# snort -T -c /etc/snort/snort.conf | + | zone " |
| - | ... | + | type master; |
| - | --== Initialization Complete ==-- | + | file "/etc/bind/zones/ |
| + | | ||
| + | }; | ||
| + | </ | ||
| - | ,, | + | Le **numéro de série** doit être modifié chaque fois que le fichier est changé. Il faut noter que dans le cas de plusieurs changements dans la même journée il est nécessaire d'incrémenter les deux derniers chiffres du numéro de série. Par exemple, dans le cas de deux changements en date du 07/12/2025, le premier fichier comportera une ligne Serial avec la valeur 2025120701 tandis que le deuxième changement comportera le numéro de série 2025120702 |
| - | o" | + | |
| - | '''' | + | |
| - | | + | |
| - | | + | |
| - | Using libpcap version 1.5.3 | + | |
| - | Using PCRE version: 8.32 2012-11-30 | + | |
| - | Using ZLIB version: 1.2.7 | + | |
| - | Rules Engine: SF_SNORT_DETECTION_ENGINE | + | <file> |
| - | Preprocessor Object: SF_SSLPP | + | 2025120701 |
| - | | + | </file> |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Preprocessor Object: SF_DCERPC2 | + | |
| - | Snort successfully validated the configuration! | + | La ligne suivante indique le temps de rafraîchissement, |
| - | Snort exiting | + | |
| - | </ | + | |
| - | === Utilisation de snort en mode " | + | < |
| + | 8H ; Refresh | ||
| + | </ | ||
| - | Pour visualiser les paquets | + | La ligne suivante indique le temps entre de nouveaux essaies de mise à jour d'un autre serveur dans le cas où la durée du Refresh a été dépassée |
| - | <code> | + | <file> |
| - | [root@centos7 ~]# snort -vde -c /etc/snort/snort.conf -l / | + | 2H ; Retry |
| + | </ | ||
| + | |||
| + | La ligne suivante indique le temps d' | ||
| + | |||
| + | < | ||
| + | 4W ; Expire | ||
| + | </file> | ||
| + | |||
| + | La ligne suivante indique le temps minimum pour la valeur TTL, soit un jour: | ||
| + | |||
| + | < | ||
| + | 1D) ; Minimum TTL | ||
| + | </file> | ||
| + | |||
| + | Cette ligne identifie notre serveur de noms : | ||
| + | |||
| + | < | ||
| + | IN NS debian12.ittraining.loc. | ||
| + | </file> | ||
| + | |||
| + | Dans le cas où notre serveur était également un serveur mail. Nous trouverions aussi une entrée du type SMTP (MX) : | ||
| + | < | ||
| + | IN MX 10 mail.ittraining.loc. | ||
| + | </ | ||
| + | |||
| + | Ci-dessous on définit avec une entrée du type A, les machines que l'on souhaite appeler par leur nom, à savoir **debian12.ittraining.loc** et **localhost** : | ||
| + | |||
| + | < | ||
| + | localhost | ||
| ... | ... | ||
| - | [root@centos7 ~]# ^C | + | debian12.ittraining.loc. |
| - | </code> | + | </file> |
| - | <WRAP center round important 50%> | + | Ci-dessous on définit des **Alias** avec des entrées du type CNAME. Les alias servent à identifier une machine. |
| - | **Important** - Notez l' | + | |
| - | </ | + | |
| - | Pour surveiller une interface réseau en particulier, saisissez | + | < |
| + | dnsmaster | ||
| + | </ | ||
| + | |||
| + | Nous pourrions aussi trouver ici des entrées telles: | ||
| + | |||
| + | < | ||
| + | ftp IN CNAME debian12.ittraining.loc. | ||
| + | www IN CNAME debian12.ittraining.loc. | ||
| + | mail IN CNAME debian12.ittraining.loc. | ||
| + | news IN CNAME debian12.ittraining.loc. | ||
| + | </ | ||
| + | |||
| + | ==db.2.0.10.hosts== | ||
| + | |||
| + | Ce fichier se trouve dans / | ||
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# vi /etc/bind/zones/db.2.0.10.hosts |
| - | ... | + | |
| - | [root@centos7 | + | root@debian12:~# cat / |
| + | $TTL 3D | ||
| + | @ | ||
| + | 2025120701 ; Serial | ||
| + | 10800 ; Refresh | ||
| + | 3600 ; Retry | ||
| + | 604800 | ||
| + | 86400) ; Minimum TTL | ||
| + | NS debian12.ittraining.loc. | ||
| + | 46 | ||
| </ | </ | ||
| - | === Utilisation | + | Modifiez maintenant les permissions sur les fichiers |
| - | + | ||
| - | Pour rediriger la sortie à l' | + | |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# ls -l /etc/bind/zones/* |
| - | ... | + | -rw-r--r-- 1 root bind 362 Dec 7 12:16 /etc/bind/zones/db.2.0.10.hosts |
| - | [root@centos7 | + | -rw-r--r-- 1 root bind 634 Dec 7 12:06 / |
| + | |||
| + | root@debian12:~# chmod g+w / | ||
| + | |||
| + | root@debian12: | ||
| + | -rw-rw-r-- 1 root bind 362 Dec 7 12:16 / | ||
| + | -rw-rw-r-- 1 root bind 634 Dec 7 12:06 / | ||
| </ | </ | ||
| - | ===Journalisation=== | + | ====3.5 - Utilisation==== |
| - | Constatez | + | Modifiez maintenant |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# vi /etc/resolv.conf |
| - | merged.log snort.log.1501937132 | + | |
| + | root@debian12: | ||
| + | # Generated by NetworkManager | ||
| + | search ittraining.loc | ||
| + | nameserver 127.0.0.1 | ||
| + | nameserver 8.8.8.8 | ||
| </ | </ | ||
| - | Constatez | + | Dernièrement, |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# systemctl restart named |
| - | + | ||
| - | ����; | + | |
| - | + | ||
| - | �Ҡ��3��; | + | |
| - | + | ||
| - | ����; | + | |
| - | ������]l�S�����W�h���օYO<' | + | |
| - | + | ||
| - | ����_��������օY���RT5' | + | |
| - | + | ||
| - | �Ҡ����_P�����G}& | + | |
| + | root@debian12: | ||
| + | ● named.service - BIND Domain Name Server | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Main PID: 32731 (named) | ||
| + | | ||
| + | Tasks: 18 (limit: 19123) | ||
| + | | ||
| + | CPU: 86ms | ||
| + | | ||
| + | | ||
| + | |||
| + | Dec 07 12:19:11 debian12.ittraining.loc named[32731]: | ||
| + | Dec 07 12:19:11 debian12.ittraining.loc named[32731]: | ||
| + | Dec 07 12:19:11 debian12.ittraining.loc named[32731]: | ||
| + | Dec 07 12:19:11 debian12.ittraining.loc named[32731]: | ||
| + | Dec 07 12:19:11 debian12.ittraining.loc named[32731]: | ||
| + | Dec 07 12:19:11 debian12.ittraining.loc named[32731]: | ||
| + | Dec 07 12:19:11 debian12.ittraining.loc named[32731]: | ||
| + | Dec 07 12:19:11 debian12.ittraining.loc named[32731]: | ||
| + | Dec 07 12:19:12 debian12.ittraining.loc named[32731]: | ||
| + | Dec 07 12:19:12 debian12.ittraining.loc named[32731]: | ||
| </ | </ | ||
| - | Ce fichier étant au format **PCAP binaire**, vous pouvez le lire avec la commande suivante | + | Testez maintenant votre serveur |
| < | < | ||
| - | [root@centos7 ~]# snort -r /var/log/snort/snort.log.1501943548 | more | + | root@debian12:/etc/bind/zones# nslookup debian12.ittraining.loc |
| + | Server: | ||
| + | Address: | ||
| + | |||
| + | Name: | ||
| + | Address: 10.0.2.46 | ||
| + | |||
| + | root@debian12: | ||
| + | |||
| + | ; <<>> | ||
| + | ;; global options: +cmd | ||
| + | ;; Got answer: | ||
| + | ;; ->> | ||
| + | ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 | ||
| + | |||
| + | ;; OPT PSEUDOSECTION: | ||
| + | ; EDNS: version: 0, flags:; udp: 1232 | ||
| + | ; COOKIE: 74a7e4078e44bf490100000069356348f4e348254883e231 (good) | ||
| + | ;; QUESTION SECTION: | ||
| + | ; | ||
| + | |||
| + | ;; AUTHORITY SECTION: | ||
| + | ittraining.loc. | ||
| + | |||
| + | ;; Query time: 0 msec | ||
| + | ;; SERVER: 127.0.0.1# | ||
| + | ;; WHEN: Sun Dec 07 12:21:44 CET 2025 | ||
| + | ;; MSG SIZE rcvd: 121 | ||
| + | |||
| + | root@debian12: | ||
| + | |||
| + | ; <<>> | ||
| + | ;; global options: +cmd | ||
| + | ;; Got answer: | ||
| + | ;; ->> | ||
| + | ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 | ||
| + | |||
| + | ;; OPT PSEUDOSECTION: | ||
| + | ; EDNS: version: 0, flags:; udp: 1232 | ||
| + | ; COOKIE: b019ecafc27e897601000000693563584aff28c151c1bd67 (good) | ||
| + | ;; QUESTION SECTION: | ||
| + | ; | ||
| + | |||
| + | ;; ANSWER SECTION: | ||
| + | 46.2.0.10.in-addr.arpa. 259200 | ||
| + | |||
| + | ;; Query time: 0 msec | ||
| + | ;; SERVER: 127.0.0.1# | ||
| + | ;; WHEN: Sun Dec 07 12:22:00 CET 2025 | ||
| + | ;; MSG SIZE rcvd: 116 | ||
| </ | </ | ||
| - | Notez que ce fichier peut aussi être lu par la commande **tcpdump** : | + | <WRAP center round important 50%> |
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | ====3.6 - Créer les Pairs de Clefs==== | ||
| + | |||
| + | Utilisez la commande **dnssec-keygen** pour créer la ZSK : | ||
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# cd /etc/bind/zones/ |
| - | reading from file / | + | |
| - | 16: | + | |
| - | 40, length 676 | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | --More-- | + | |
| + | root@debian12:/ | ||
| + | Generating key pair............+.....+...+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.....+........+...+...+....+...+........+.......+.....+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*........+.........+..............+....+..+...+.+......+...+..+...+..........+...+.....+...+......+.+........+.+.........+..+.........+......+...+......+.........+..........+......+.....+...+.+.........+...+.....+....+...+............+........+.+...........+...+...+...+........................+...+.......+......+.....+.+....................+....+.....+......................+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ..+......+........+.......+.....+......+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.......+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*................+.+............+.....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ | ||
| + | Kittraining.loc.+008+18528 | ||
| </ | </ | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Vous pouvez utiliser le logiciel Wireshark pour visulaiser le contenu du fichier en mode graphique. | + | **Important** - L' |
| </ | </ | ||
| - | Dernièrement, | + | < |
| - | + | root@debian12:/ | |
| - | # snort -de -l / | + | total 24 |
| + | -rw-rw-r-- 1 root bind 362 Dec 7 12:16 db.2.0.10.hosts | ||
| + | -rw-rw-r-- 1 root bind 747 Dec 7 13:13 ittraining.loc | ||
| + | -rw-r--r-- 1 root bind 612 Dec 7 13:28 Kittraining.loc.+008+18528.key | ||
| + | -rw------- 1 root bind 1776 Dec 7 13:28 Kittraining.loc.+008+18528.private | ||
| + | </code> | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Notez l' | + | **Important** - Dans le nom de chaque fichier, |
| </ | </ | ||
| - | Pour lancer snort en arrière plan afin de surveiller l' | + | Utilisez la commande |
| < | < | ||
| - | [root@centos7 ~]# /usr/sbin/snort -A fast -b -d -D -i enp0s3 -u snort -g snort -c / | + | root@debian12:/etc/bind/zones# dnssec-keygen |
| - | [1] 19281 | + | Generating key pair..+.....+....+......+......+.....+....+...+.....+......+......................+........+....+...+...+.........+..+...+.+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...+.....+.+...........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.........+.......+......+..+......+.......+.........+..............+.........+.+..+....+.....+....+..+.......+...+..+......+..........+...........+.+....................+...+......+.........+.........+.+......+........+...+............+..........+...+...+....................+....+........+...+....+..................+..............+.........+.......+...+..+.......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ..+..+....+..+.......+..+......+.........+....+..+..........+.....+.......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..+.......+........+.+.....+.......+........+.......+..+.+......+..............+.+......+.........+...+......+.........+...+.................+................+......+.....+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...........+....+...+............+..............+..........+.................+.............+.........+..+...+.+..+.........+...+.............+...+.....+....+..+...+......+.......+...+.........+...+.....+.........+....+...........+......+.......+...........+.+.........+.....+.+.....+..................+.+..+.........+.........+.......+........+...................+.....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
| - | [root@centos7 ~]# Spawning daemon child... | + | Kittraining.loc.+008+63515 |
| - | My daemon child 19401 lives... | + | |
| - | Daemon parent exiting (0) | + | |
| - | ^C | + | |
| - | [1]+ | + | |
| - | [root@centos7 ~]# ps aux | grep snort | + | |
| - | snort 19401 0.0 24.6 850984 504544 ? | + | |
| - | root | + | |
| </ | </ | ||
| - | Pour arrêter ce processus, utilisez al commande | + | <WRAP center round important 50%> |
| + | **Important** - L' | ||
| + | </ | ||
| + | |||
| + | Constatez la présence des pairs de clefs : | ||
| < | < | ||
| - | [root@centos7 ~]# ps aux | grep snort | + | root@debian12:/ |
| - | snort 19401 0.0 24.6 850984 504692 ? | + | total 24 |
| - | root 20521 0.0 0.0 114692 | + | -rw-rw-r-- 1 root bind 362 Dec 7 12:16 db.2.0.10.hosts |
| - | [root@centos7 ~]# kill 19401 | + | -rw-rw-r-- 1 root bind 747 Dec 7 13:13 ittraining.loc |
| - | [root@centos7 ~]# ps aux | grep snort | + | -rw-r--r-- 1 root bind 612 Dec 7 13:28 Kittraining.loc.+008+18528.key |
| - | root | + | -rw------- 1 root bind 1776 Dec 7 13:28 Kittraining.loc.+008+18528.private |
| + | -rw-r--r-- 1 root bind 957 Dec 7 13:28 Kittraining.loc.+008+63515.key | ||
| + | -rw------- 1 root bind 3316 Dec 7 13:28 Kittraining.loc.+008+63515.private | ||
| </ | </ | ||
| - | ====LAB #3 - Mise en place du Système | + | ====3.7 - Modifier la Configuration |
| - | Portsentry est un **S**ystème | + | Ajoutez les deux clefs publiques dans la configuration du fichier |
| - | === Installation === | + | < |
| + | root@debian12:/ | ||
| + | |||
| + | root@debian12:/ | ||
| + | $TTL 3D | ||
| + | @ | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | localhost | ||
| + | dnsmaster | ||
| + | debian12.ittraining.loc. | ||
| + | |||
| + | ftp IN CNAME debian12.ittraining.loc. | ||
| + | www IN CNAME debian12.ittraining.loc. | ||
| + | mail IN CNAME debian12.ittraining.loc. | ||
| + | news IN CNAME debian12.ittraining.loc. | ||
| + | |||
| + | $include / | ||
| + | $include / | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - N' | ||
| + | </ | ||
| - | Sous RHEL/CentOS 7, **portsentry** n'est pas installé par défaut. Qui plus est **portsentry** ne se trouve pas dans les dépôts standards. Installez donc le paquet | + | Redémarrez |
| < | < | ||
| - | [root@centos7 ~]# rpm -ivh https://www.dropbox.com/scl/ | + | root@debian12:/etc/bind/zones# systemctl restart named |
| - | Loaded plugins: fastestmirror, | + | |
| - | portsentry-1.2-1.el5.x86_64.rpm | + | |
| - | Examining / | + | |
| - | Marking / | + | |
| - | Resolving Dependencies | + | |
| - | --> Running transaction check | + | |
| - | ---> Package portsentry.x86_64 0:1.2-1.el5 will be installed | + | |
| - | --> Finished Dependency Resolution | + | |
| - | adobe-linux-x86_64 | + | |
| - | base/ | + | |
| - | extras/ | + | |
| - | updates/ | + | |
| - | Dependencies Resolved | + | root@debian12:/ |
| + | ● named.service - BIND Domain Name Server | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Main PID: 32952 (named) | ||
| + | | ||
| + | Tasks: 18 (limit: 19123) | ||
| + | | ||
| + | CPU: 83ms | ||
| + | | ||
| + | | ||
| - | ======================================================================================================================================= | + | Dec 07 13:32:03 debian12.ittraining.loc named[32952]: |
| - | Package | + | Dec 07 13:32:03 debian12.ittraining.loc named[32952]: |
| - | ======================================================================================================================================= | + | Dec 07 13:32:03 debian12.ittraining.loc named[32952]: |
| - | Installing: | + | Dec 07 13:32:03 debian12.ittraining.loc named[32952]: |
| - | portsentry | + | Dec 07 13:32:03 debian12.ittraining.loc named[32952]: |
| + | Dec 07 13:32:03 debian12.ittraining.loc named[32952]: | ||
| + | Dec 07 13:32:03 debian12.ittraining.loc named[32952]: | ||
| + | Dec 07 13:32:03 debian12.ittraining.loc named[32952]: | ||
| + | Dec 07 13:32:03 debian12.ittraining.loc named[32952]: | ||
| + | Dec 07 13:32:03 debian12.ittraining.loc named[32952]: | ||
| + | </ | ||
| - | Transaction Summary | + | Intérogez le DNS local pour obtenir les clefs publiques : |
| - | ======================================================================================================================================= | + | |
| - | Install | + | |
| - | Total size: 114 k | + | < |
| - | Installed size: 114 k | + | root@debian12:/etc/bind/zones# dig @debian12.ittraining.loc DNSKEY ittraining.loc |
| - | Is this ok [y/d/N]: y | + | |
| + | ; <<>> | ||
| + | ; (1 server found) | ||
| + | ;; global options: +cmd | ||
| + | ;; Got answer: | ||
| + | ;; ->> | ||
| + | ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 | ||
| + | |||
| + | ;; OPT PSEUDOSECTION: | ||
| + | ; EDNS: version: 0, flags:; udp: 1232 | ||
| + | ; COOKIE: 74f4778aedb99b4d01000000693576d3fe2e16da8329795a (good) | ||
| + | ;; QUESTION SECTION: | ||
| + | ; | ||
| + | |||
| + | ;; ANSWER SECTION: | ||
| + | ittraining.loc. | ||
| + | ittraining.loc. | ||
| + | |||
| + | ;; Query time: 4 msec | ||
| + | ;; SERVER: 10.0.2.46# | ||
| + | ;; WHEN: Sun Dec 07 13:45:07 CET 2025 | ||
| + | ;; MSG SIZE rcvd: 879 | ||
| </ | </ | ||
| - | ===Configuration=== | + | ====3.8 - Signer la Zone==== |
| - | Modifiez le fichier | + | Les clefs étant maintenant insérées dans la configuration, |
| < | < | ||
| - | [root@centos7 ~]# nl /etc/portsentry/portsentry.conf | + | root@debian12:/etc/bind/zones# dnssec-signzone -S ittraining.loc |
| - | 1 # PortSentry Configuration | + | Verifying |
| - | 2 # | + | - RSASHA256 |
| - | 3 # $Id: portsentry.conf,v 1.25 2003/05/23 16:15:39 crowland Exp crowland $ | + | Zone fully signed: |
| - | 4 # | + | Algorithm: RSASHA256: KSKs: 1 active, 0 stand-by, 0 revoked |
| - | 5 # IMPORTANT NOTE: You CAN NOT put spaces between your port arguments. | + | |
| - | 6 # | + | ittraining.loc.signed |
| - | 7 # The default ports will catch a large number of common probes | + | |
| - | 8 # | + | root@debian12:/etc/bind/zones# ls -l | grep signed |
| - | 9 # All entries must be in quotes. | + | -rw-r--r-- 1 root bind 12407 Dec 7 13:39 ittraining.loc.signed |
| - | + | ||
| - | + | ||
| - | 10 ####################### | + | |
| - | 11 # Port Configurations # | + | |
| - | 12 ####################### | + | |
| - | 13 # | + | |
| - | 14 # | + | |
| - | 15 # Some example port configs for classic and basic Stealth modes | + | |
| - | 16 # | + | |
| - | 17 # I like to always keep some ports at the " | + | |
| - | 18 # This will detect a sequential port sweep really quickly and usually | + | |
| - | 19 # these ports are not in use (i.e. tcpmux port 1) | + | |
| - | 20 # | + | |
| - | 21 # ** X-Windows Users **: If you are running X on your box, you need to be sure | + | |
| - | 22 # you are not binding PortSentry to port 6000 (or port 2000 for OpenWindows users). | + | |
| - | 23 # Doing so will prevent the X-client from starting properly. | + | |
| - | | + | |
| - | 25 # These port bindings are *ignored* for Advanced Stealth Scan Detection Mode. | + | |
| - | 26 # | + | |
| - | + | ||
| - | 27 # Un-comment these if you are really anal: | + | |
| - | | + | |
| - | 29 # | + | |
| - | 30 # | + | |
| - | 31 # Use these if you just want to be aware: | + | |
| - | 32 TCP_PORTS=" | + | |
| - | 33 UDP_PORTS=" | + | |
| - | 34 # | + | |
| - | 35 # Use these for just bare-bones | + | |
| - | 36 # | + | |
| - | | + | |
| - | + | ||
| - | 38 ########################################### | + | |
| - | 39 # Advanced Stealth Scan Detection Options # | + | |
| - | 40 ########################################### | + | |
| - | 41 # | + | |
| - | 42 # This is the number of ports you want PortSentry to monitor in Advanced mode. | + | |
| - | 43 # Any port *below* this number will be monitored. Right now it watches | + | |
| - | 44 # everything below 1024. | + | |
| - | 45 # | + | |
| - | 46 # On many Linux systems you cannot bind above port 61000. This is because | + | |
| - | 47 # these ports are used as part of IP masquerading. I don't recommend you | + | |
| - | 48 # bind over this number of ports. Realistically: | + | |
| - | 49 # OVER 1024 PORTS AS YOUR FALSE ALARM RATE WILL ALMOST CERTAINLY RISE. You've been | + | |
| - | 50 # warned! Don't write me if you have have a problem because I'll only tell | + | |
| - | 51 # you to RTFM and don't run above the first 1024 ports. | + | |
| - | 52 # | + | |
| - | 53 # | + | |
| - | 54 ADVANCED_PORTS_TCP=" | + | |
| - | 55 ADVANCED_PORTS_UDP=" | + | |
| - | 56 # | + | |
| - | 57 # This field tells PortSentry what ports (besides listening daemons) to | + | |
| - | 58 # ignore. This is helpful for services like ident that services such | + | |
| - | 59 # as FTP, SMTP, and wrappers look for but you may not run (and probably | + | |
| - | 60 # *shouldn' | + | |
| - | 61 # | + | |
| - | 62 # By specifying ports here PortSentry will simply not respond to | + | |
| - | 63 # incoming requests, in effect PortSentry treats them as if they are | + | |
| - | 64 # actual bound daemons. The default ports are ones reported as | + | |
| - | 65 # problematic false alarms and should probably be left alone for | + | |
| - | 66 # all but the most isolated systems/ | + | |
| - | 67 # | + | |
| - | 68 # Default TCP ident and NetBIOS service | + | |
| - | 69 ADVANCED_EXCLUDE_TCP=" | + | |
| - | 70 # Default UDP route (RIP), NetBIOS, bootp broadcasts. | + | |
| - | 71 ADVANCED_EXCLUDE_UDP=" | + | |
| - | + | ||
| - | + | ||
| - | 72 ###################### | + | |
| - | 73 # Configuration Files# | + | |
| - | 74 ###################### | + | |
| - | 75 # | + | |
| - | 76 # Hosts to ignore | + | |
| - | 77 IGNORE_FILE="/ | + | |
| - | 78 # Hosts that have been denied (running history) | + | |
| - | 79 HISTORY_FILE="/ | + | |
| - | 80 # Hosts that have been denied this session only (temporary until next restart) | + | |
| - | 81 BLOCKED_FILE="/ | + | |
| - | + | ||
| - | 82 ############################## | + | |
| - | 83 # Misc. Configuration Options# | + | |
| - | 84 ############################## | + | |
| - | 85 # | + | |
| - | 86 # DNS Name resolution - Setting this to " | + | |
| - | 87 # for attacking hosts. Setting it to "0" (or any other value) will shut | + | |
| - | 88 # it off. | + | |
| - | 89 RESOLVE_HOST = " | + | |
| - | + | ||
| - | 90 ################### | + | |
| - | 91 # Response Options# | + | |
| - | 92 ################### | + | |
| - | 93 # Options to dispose of attacker. Each is an action that will | + | |
| - | 94 # be run if an attack is detected. If you don't want a particular | + | |
| - | 95 # option then comment it out and it will be skipped. | + | |
| - | 96 # | + | |
| - | 97 # The variable $TARGET$ will be substituted with the target attacking | + | |
| - | 98 # host when an attack is detected. The variable $PORT$ will be substituted | + | |
| - | 99 # with the port that was scanned. | + | |
| - | | + | |
| - | | + | |
| - | 102 # Ignore Options # | + | |
| - | | + | |
| - | 104 # These options allow you to enable automatic response | + | |
| - | 105 # options for UDP/TCP. This is useful if you just want | + | |
| - | 106 # warnings for connections, | + | |
| - | 107 # a particular protocol (i.e. you want to block TCP, but | + | |
| - | 108 # not UDP). To prevent a possible Denial of service attack | + | |
| - | 109 # against UDP and stealth scan detection for TCP, you may | + | |
| - | 110 # want to disable blocking, but leave the warning enabled. | + | |
| - | 111 # I personally would wait for this to become a problem before | + | |
| - | 112 # doing though as most attackers really aren't doing this. | + | |
| - | 113 # The third option allows you to run just the external command | + | |
| - | 114 # in case of a scan to have a pager script or such execute | + | |
| - | 115 # but not drop the route. This may be useful for some admins | + | |
| - | 116 # who want to block TCP, but only want pager/e-mail warnings | + | |
| - | 117 # on UDP, etc. | + | |
| - | | + | |
| - | 119 # | + | |
| - | | + | |
| - | 121 # 1 = Block UDP/TCP scans. | + | |
| - | 122 # 2 = Run external command only (KILL_RUN_CMD) | + | |
| - | + | ||
| - | | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | 126 # Dropping Routes:# | + | |
| - | | + | |
| - | 128 # This command is used to drop the route or add the host into | + | |
| - | 129 # a local filter table. | + | |
| - | 130 # | + | |
| - | 131 # The gateway (333.444.555.666) should ideally be a dead host on | + | |
| - | 132 # the *local* subnet. On some hosts you can also point this at | + | |
| - | 133 # localhost (127.0.0.1) and get the same effect. NOTE THAT | + | |
| - | 134 # 333.444.555.66 WILL *NOT* WORK. YOU NEED TO CHANGE IT!! | + | |
| - | | + | |
| - | 136 # ALL KILL ROUTE OPTIONS ARE COMMENTED OUT INITIALLY. Make sure you | + | |
| - | 137 # uncomment the correct line for your OS. If you OS is not listed | + | |
| - | 138 # here and you have a route drop command that works then please | + | |
| - | 139 # mail it to me so I can include it. ONLY ONE KILL_ROUTE OPTION | + | |
| - | 140 # CAN BE USED AT A TIME SO DON'T UNCOMMENT MULTIPLE LINES. | + | |
| - | | + | |
| - | 142 # NOTE: The route commands are the least optimal way of blocking | + | |
| - | 143 # and do not provide complete protection against UDP attacks and | + | |
| - | 144 # will still generate alarms for both UDP and stealth scans. I | + | |
| - | 145 # always recommend you use a packet filter because they are made | + | |
| - | 146 # for this purpose. | + | |
| - | | + | |
| - | + | ||
| - | 148 # Generic | + | |
| - | | + | |
| - | + | ||
| - | 150 # Generic Linux | + | |
| - | | + | |
| - | + | ||
| - | 152 # Newer versions of Linux support the reject flag now. This | + | |
| - | 153 # is cleaner than the above option. | + | |
| - | | + | |
| - | + | ||
| - | 155 # Generic BSD (BSDI, OpenBSD, NetBSD, FreeBSD) | + | |
| - | | + | |
| - | + | ||
| - | 157 # Generic Sun | + | |
| - | | + | |
| - | + | ||
| - | 159 # NEXTSTEP | + | |
| - | | + | |
| - | + | ||
| - | 161 # FreeBSD | + | |
| - | | + | |
| - | + | ||
| - | 163 # Digital UNIX 4.0D (OSF/1 / Compaq Tru64 UNIX) | + | |
| - | 164 #KILL_ROUTE="/ | + | |
| - | + | ||
| - | 165 # Generic HP-UX | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | 168 # Using a packet filter is the PREFERRED. The below lines | + | |
| - | 169 # work well on many OS's. Remember, you can only uncomment *one* | + | |
| - | 170 # KILL_ROUTE option. | + | |
| - | | + | |
| - | + | ||
| - | 172 # ipfwadm support for Linux | + | |
| - | | + | |
| - | | + | |
| - | 175 # ipfwadm support for Linux (no logging of denied packets) | + | |
| - | | + | |
| - | | + | |
| - | 178 # ipchain support for Linux | + | |
| - | | + | |
| - | 180 # | + | |
| - | 181 # ipchain support for Linux (no logging of denied packets) | + | |
| - | | + | |
| - | | + | |
| - | 184 # iptables support for Linux | + | |
| - | | + | |
| - | + | ||
| - | 186 # For those of you running FreeBSD (and compatible) you can | + | |
| - | 187 # use their built in firewalling as well. | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | 192 # For those running ipfilt (OpenBSD, etc.) | + | |
| - | 193 # NOTE THAT YOU NEED TO CHANGE external_interface TO A VALID INTERFACE!! | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | + | ||
| - | | + | |
| - | 197 # TCP Wrappers# | + | |
| - | | + | |
| - | 199 # This text will be dropped into the hosts.deny file for wrappers | + | |
| - | 200 # to use. There are two formats for TCP wrappers: | + | |
| - | | + | |
| - | 202 # Format One: Old Style - The default when extended host processing | + | |
| - | 203 # options are not enabled. | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | 206 # Format Two: New Style - The format used when extended option | + | |
| - | 207 # processing is enabled. You can drop in extended processing | + | |
| - | 208 # options, but be sure you escape all ' | + | |
| - | 209 # to prevent problems writing out (i.e. \%c \%h ) | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | 213 # External Command# | + | |
| - | | + | |
| - | 215 # This is a command that is run when a host connects, it can be whatever | + | |
| - | 216 # you want it to be (pager, etc.). This command is executed before the | + | |
| - | 217 # route is dropped or after depending on the KILL_RUN_CMD_FIRST option below | + | |
| - | | + | |
| - | | + | |
| - | 220 # I NEVER RECOMMEND YOU PUT IN RETALIATORY ACTIONS AGAINST THE HOST SCANNING | + | |
| - | 221 # YOU! | + | |
| - | | + | |
| - | 223 # TCP/IP is an *unauthenticated protocol* and people can make scans appear out | + | |
| - | 224 # of thin air. The only time it is reasonably safe (and I *never* think it is | + | |
| - | 225 # reasonable) to run reverse probe scripts is when using the " | + | |
| - | 226 # This mode requires a full connect and is very hard to spoof. | + | |
| - | | + | |
| - | 228 # The KILL_RUN_CMD_FIRST value should be set to " | + | |
| - | 229 # to run *before* the blocking occurs and should be set to " | + | |
| - | 230 # command run *after* the blocking has occurred. | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | + | ||
| - | | + | |
| - | 239 # Scan trigger value# | + | |
| - | | + | |
| - | 241 # Enter in the number of port connects you will allow before an | + | |
| - | 242 # alarm is given. The default is 0 which will react immediately. | + | |
| - | 243 # A value of 1 or 2 will reduce false alarms. Anything higher is | + | |
| - | 244 # probably not necessary. This value must always be specified, but | + | |
| - | 245 # generally can be left at 0. | + | |
| - | | + | |
| - | 247 # NOTE: If you are using the advanced detection option you need to | + | |
| - | 248 # be careful that you don't make a hair trigger situation. Because | + | |
| - | 249 # Advanced mode will react for *any* host connecting to a non-used | + | |
| - | 250 # below your specified range, you have the opportunity to really | + | |
| - | 251 # break things. (i.e someone innocently tries to connect to you via | + | |
| - | 252 # SSL [TCP port 443] and you immediately block them). Some of you | + | |
| - | 253 # may even want this though. Just be careful. | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | 257 # Port Banner Section# | + | |
| - | | + | |
| - | | + | |
| - | 260 # Enter text in here you want displayed to a person tripping the PortSentry. | + | |
| - | 261 # I *don' | + | |
| - | 262 # Leave this commented out to disable the feature | + | |
| - | | + | |
| - | 264 # Stealth scan detection modes don't use this feature | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | 267 # EOF | + | |
| </ | </ | ||
| - | Pour rendre le service SysVInit compatible avec Systemd, éditez | + | Consultez |
| < | < | ||
| - | [root@centos7 ~]# nl /etc/init.d/portsentry | + | root@debian12:/etc/bind/zones# more ittraining.loc.signed |
| - | | + | ; File written on Sun Dec 7 13:39:03 2025 |
| - | 2 # | + | ; dnssec_signzone version 9.18.41-1~deb12u1-Debian |
| - | 3 # Startup script for the Portsentry portscan detector | + | ittraining.loc. |
| - | 4 # | + | |
| - | 5 # chkconfig: 345 98 02 | + | |
| - | 6 # description: | + | |
| - | 7 # suite of tools. The Abacus Project is an initiative to release \ | + | |
| - | | + | |
| - | 9 # detection software to the Internet community. | + | ) |
| - | 10 # processname: | + | 259200 |
| - | 11 # pidfile: | + | |
| - | 12 # config: | + | |
| - | | + | Baxfh/B4BxgYGeQoDih2uGqLxzDExRWix2a2 |
| - | | + | B95uAkDGClaGdlFkYtU4voIQJWuAx0Goo6Xa |
| - | ... | + | omEyrIdLGqoj9e2vdn6j2lVpJik9YgCTxP2G |
| + | ShVYc632XsAFPXN6SJrR3QdKo1x6KM1uPYdd | ||
| + | OxAX9fGNYj59ZXG84slUxreDejoqn2k8Rx68 | ||
| + | gxuzkIY3oM5aUtbvL8bwjflk121mWxQ4vVhW | ||
| + | R/KNk9SEc6AbZSqJXwmlY/vReOA+pvPCdLYJ | ||
| + | 7Wf+S9kr1i1xT1y078Iqz2twASWBjBnP/ | ||
| + | QtKpn9SvKUEzICTaNA== ) | ||
| + | 259200 | ||
| + | 259200 | ||
| + | | ||
| + | CGtE8nZ2F0JQLAmbyPgrqKLDXjyWg2hZmEcf | ||
| + | 22h2zAxJZWjNWB7k5aLHA6weKkvo7mTnH7sS | ||
| + | pEazWPhaDzmW2BLfdBjeaSZzj+mMWUiXVnUq | ||
| + | LYAMLRXGD1NAPcuSQlyzDpN0JZXwWfQFTpzT | ||
| + | DJttJyChcQgyJmvaJEhIhQK5gRFMaT+Ww1zg | ||
| + | pvAke0HlkSEz9mQxIhff5FqSL00Zyn5mnLBB | ||
| + | N6X1XKQXL/mUJ8nb9X70n9b/qsYqAQdFFxzS | ||
| + | 6lz+kMr/D1AhzabDGkeD/ | ||
| + | | ||
| + | | ||
| + | 86400 | ||
| + | 86400 | ||
| + | 20260106113903 20251207113903 18528 ittraining.loc. | ||
| + | dDLcoBI/ | ||
| + | 775fNQI/ | ||
| + | 2b8Q2Dm26f218L1KYF7NF7dew2s5OUIkfM+V | ||
| + | iZIqBSAFYyAbLYRCfbQA6DxsIgDT6T/ | ||
| + | +jYHNeASGauWunufrSLvbqdsIE0z+JH+3AVE | ||
| + | JaLTeXYL6I+/ | ||
| + | 0lqDK8qRlcbhFF1ngOJHe+Fa5ect9kqnbjCa | ||
| + | 7mwOOmp4v4JA6Myvvut7OEDI5mQItd9HApPl | ||
| + | eM0kvui7mioUEUCM2EXRPtJYXVAELUnqGz1S | ||
| + | hn6EYefpcWvUDo8veg== ) | ||
| + | 259200 | ||
| + | AwEAAZ+2bRM+yedcAeqUR6AdkSzyIeQg1kH4 | ||
| + | 021as3WvYGlOLqeUnfbegNewRYifndXx/ | ||
| + | 84A9L6IZH1ZamuSNxNi7Y0+FZbyq4DJmFnHA | ||
| + | 68Ao5zmOhK76mrQf6SjzQHZWzwtoG0DAApTg | ||
| + | gaRxhmezzjkSr3WNadIoFg4FXU5UaV4ePU5h | ||
| + | hPn+zi34SUYvgPTZsSWb/ | ||
| + | hgRxoaPpjV/ | ||
| + | --More--(18%) | ||
| </ | </ | ||
| - | Puis ajoutez | + | Consultez |
| - | <code> | + | <file> |
| ... | ... | ||
| - | 77 stop() { | + | 259200 |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | 83 [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/portsentry | + | |
| - | | + | OxAX9fGNYj59ZXG84slUxreDejoqn2k8Rx68 |
| - | + | gxuzkIY3oM5aUtbvL8bwjflk121mWxQ4vVhW | |
| - | 85 # See how we were called. | + | R/KNk9SEc6AbZSqJXwmlY/vReOA+pvPCdLYJ |
| + | 7Wf+S9kr1i1xT1y078Iqz2twASWBjBnP/adG | ||
| + | | ||
| ... | ... | ||
| </ | </ | ||
| - | Dernièrement, installez le paquet | + | Dans cette section on constate : |
| + | |||
| + | * L'ID de la clef **18528** utilisée pour la signature, soit la ZSK | ||
| + | | ||
| + | * La date et l' | ||
| + | |||
| + | Configurez Bind pour qu'il utilise le fichier signé | ||
| < | < | ||
| - | [root@centos7 ~]# yum install | + | root@debian12:/ |
| - | </code> | + | root@debian12: |
| + | // prime the server with knowledge of the root servers | ||
| + | zone " | ||
| + | type hint; | ||
| + | file "/ | ||
| + | }; | ||
| - | ===Utilisation=== | + | // be authoritative for the localhost forward and reverse zones, and for |
| + | // broadcast zones as per RFC 1912 | ||
| - | Démarrez le service **portsentry** : | + | zone " |
| + | type master; | ||
| + | file "/ | ||
| + | }; | ||
| - | < | + | zone "127.in-addr.arpa" { |
| - | [root@centos7 ~]# systemctl start portsentry | + | type master; |
| - | [root@centos7 ~]# systemctl status portsentry | + | file "/etc/bind/db.127"; |
| - | ● portsentry.service | + | }; |
| - | Loaded: loaded (/etc/rc.d/init.d/ | + | |
| - | Active: active (running) since Sun 2017-08-06 14:48:18 CEST; 6s ago | + | zone "0.in-addr.arpa" |
| - | Docs: man: | + | type master; |
| - | | + | file "/etc/bind/db.0"; |
| - | CGroup: /system.slice/ | + | }; |
| - | ├─6511 | + | |
| - | └─6513 | + | zone "255.in-addr.arpa" { |
| + | type master; | ||
| + | file "/etc/bind/db.255"; | ||
| + | }; | ||
| + | |||
| + | zone " | ||
| + | type master; | ||
| + | file "/etc/bind/zones/ | ||
| + | forwarders { }; | ||
| + | }; | ||
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | zone "2.0.10.in-addr.arpa" { |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | type master; |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | file "/etc/bind/zones/db.2.0.10.hosts"; |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | forwarders { }; |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | }; |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Hint: Some lines were ellipsized, use -l to show in full. | + | |
| - | [root@centos7 ~]# ps aux | grep portsentry | + | |
| - | root 6511 0.0 0.0 | + | |
| - | root 6513 0.0 0.0 | + | |
| - | root 6687 | + | |
| </ | </ | ||
| - | Editez | + | Redémarrez |
| < | < | ||
| - | [root@centos7 ~]# nl /etc/portsentry/portsentry.ignore | + | root@debian12:/ |
| - | 1 # Put hosts in here you never want blocked. This includes the IP addresses | + | |
| - | 2 # of all local interfaces on the protected host (i.e virtual host, mult-home) | + | root@debian12: |
| - | 3 # Keep 127.0.0.1 and 0.0.0.0 to keep people from playing games. | + | ● named.service - BIND Domain Name Server |
| - | 4 # | + | Loaded: loaded (/ |
| - | 5 # PortSentry can support full netmasks for networks as well. Format is: | + | Active: active |
| - | 6 # | + | Docs: man:named(8) |
| - | 7 # <IP Address>/< | + | Main PID: 33227 (named) |
| - | 8 # | + | Status: " |
| - | 9 # Example: | + | Tasks: 18 (limit: 19123) |
| - | 10 # | + | Memory: 109.0M |
| - | 11 # 192.168.2.0/24 | + | CPU: 88ms |
| - | 12 # 192.168.0.0/16 | + | CGroup: / |
| - | 13 # 192.168.2.1/32 | + | └─33227 |
| - | 14 # Etc. | + | |
| - | 15 # | + | Dec 07 14:02:52 debian12.ittraining.loc named[33227]: |
| - | 16 # If you don't supply a netmask it is assumed to be 32 bits. | + | Dec 07 14:02:52 debian12.ittraining.loc named[33227]: |
| - | | + | Dec 07 14:02:52 debian12.ittraining.loc named[33227]: |
| - | 18 # | + | Dec 07 14:02:52 debian12.ittraining.loc named[33227]: |
| - | + | Dec 07 14:02:52 debian12.ittraining.loc named[33227]: | |
| - | 19 127.0.0.1/32 | + | Dec 07 14:02:52 debian12.ittraining.loc named[33227]: |
| - | 20 0.0.0.0 | + | Dec 07 14:02:52 debian12.ittraining.loc named[33227]: |
| - | | + | Dec 07 14:02:52 debian12.ittraining.loc named[33227]: |
| - | 22 # Do NOT edit below this line, if you # | + | Dec 07 14:02:52 debian12.ittraining.loc named[33227]: |
| - | 23 # do, your changes will be lost when # | + | Dec 07 14:02:52 debian12.ittraining.loc named[33227]: |
| - | 24 # portsentry is restarted via the # | + | |
| - | 25 # initscript. Make all changes above # | + | |
| - | 26 # this box. # | + | |
| - | 27 ######################################### | + | |
| - | + | ||
| - | 28 # Exclude all local interfaces | + | |
| - | 29 #172.YY+20.0.3 | + | |
| - | | + | |
| - | 31 127.0.0.1 | + | |
| - | 32 ::1 | + | |
| - | + | ||
| - | 33 # Exclude the default gateway(s) | + | |
| - | 34 10.0.2.2 | + | |
| - | + | ||
| - | 35 # Exclude the nameservers | + | |
| - | 36 10.0.2.3 | + | |
| - | + | ||
| - | 37 # And last but not least... | + | |
| - | 38 0.0.0.0 | + | |
| </ | </ | ||
| - | **Sans** re-démarrez le service portsentry, lancez un scan des ports avec nmap : | + | Demandez l' |
| < | < | ||
| - | [root@centos7 ~]# nmap -sC 172.YY+20.0.3 | + | root@debian12:/ |
| - | Starting Nmap 6.40 ( http://nmap.org ) at 2017-08-06 14:52 CEST | + | ; <<>> |
| - | ^C | + | ; (1 server found) |
| - | You have new mail in / | + | ;; global options: +cmd |
| - | </code> | + | ;; Got answer: |
| + | ;; ->> | ||
| + | ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 | ||
| - | <WRAP center round important 50%> | + | ;; OPT PSEUDOSECTION: |
| - | **Important** - Notez l' | + | ; EDNS: version: 0, flags:; udp: 1232 |
| - | </WRAP> | + | ; COOKIE: a42dbdb3e931b5b40100000069357b611d705b9c213bca01 (good) |
| + | ;; QUESTION SECTION: | ||
| + | ;ittraining.loc. IN SOA | ||
| + | |||
| + | ;; ANSWER SECTION: | ||
| + | ittraining.loc. | ||
| + | |||
| + | ;; Query time: 0 msec | ||
| + | ;; SERVER: 10.0.2.46# | ||
| + | ;; WHEN: Sun Dec 07 14:04:33 CET 2025 | ||
| + | ;; MSG SIZE rcvd: 121 | ||
| + | </code> | ||
| - | Consultez les règles d'iptables | + | Demandez l'enregistrement SOA et sa signature du DNS local : |
| < | < | ||
| - | [root@centos7 ~]# iptables | + | root@debian12:/ |
| - | Chain INPUT (policy ACCEPT) | + | |
| - | target | + | ; <<>> |
| - | DROP | + | ; (1 server found) |
| - | ACCEPT | + | ;; global options: +cmd |
| - | ACCEPT | + | ;; Got answer: |
| - | INPUT_direct | + | ;; ->> |
| - | INPUT_ZONES_SOURCE | + | ;; flags: qr aa rd ra; QUERY: 1, ANSWER: |
| - | INPUT_ZONES | + | |
| - | DROP | + | ;; OPT PSEUDOSECTION: |
| - | REJECT | + | ; EDNS: version: 0, flags: do; udp: 1232 |
| - | ... | + | ; COOKIE: 14cfa09283a1f4980100000069357b95d90b040d04f37247 (good) |
| + | ;; QUESTION SECTION: | ||
| + | ; | ||
| + | |||
| + | ;; ANSWER SECTION: | ||
| + | ittraining.loc. | ||
| + | ittraining.loc. | ||
| + | |||
| + | ;; Query time: 0 msec | ||
| + | ;; SERVER: 10.0.2.46# | ||
| + | ;; WHEN: Sun Dec 07 14:05:25 CET 2025 | ||
| + | ;; MSG SIZE rcvd: 423 | ||
| </ | </ | ||
| - | Dernièrement, | + | ====3.9 - La chaîne de confiance DNS==== |
| + | |||
| + | Créez le DSSet à partir de la clef publique KSK : | ||
| < | < | ||
| - | [root@centos7 ~]# mail | + | root@debian12:/etc/bind/zones# dnssec-dsfromkey |
| - | Heirloom Mail version 12.5 7/5/10. Type ? for help. | + | ittraining.loc. IN DS 63515 8 2 909F3FC8A2B34083B1268C0FE7FDAA851252626CDCDF4D8B51D97CB98C62FDA4 |
| - | "/var/ | + | |
| - | >N 1 trainee@centos7.fene | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | & 6 | + | |
| - | Message | + | |
| - | From root@centos7.fenestros.loc Sun Aug 6 14:52:43 2017 | + | |
| - | Return-Path: | + | |
| - | X-Original-To: | + | |
| - | Delivered-To: | + | |
| - | Date: Sun, 06 Aug 2017 14:52:43 +0200 | + | |
| - | To: root@localhost.fenestros.loc | + | |
| - | Subject: Portscan from 10.0.2.15 on port 143 | + | |
| - | User-Agent: Heirloom mailx 12.5 7/5/10 | + | |
| - | Content-Type: | + | |
| - | From: root@centos7.fenestros.loc (root) | + | |
| - | Status: R | + | |
| + | root@debian12:/ | ||
| + | -rw-r--r-- 1 root bind 99 Dec 7 13:39 dsset-ittraining.loc. | ||
| - | & q | + | root@debian12:/etc/bind/zones# cat dsset-ittraining.loc. |
| - | Held 6 messages in / | + | ittraining.loc. |
| - | You have mail in /var/spool/mail/root | + | |
| - | [root@centos7 ~]# | + | |
| </ | </ | ||
| - | Pour nettoyer | + | Il conviendrait maintenant d' |
| + | |||
| + | Quand DNSSEC ne peut pas être validé, le résultat routorné par la commande dig est **SERVFAIL** : | ||
| < | < | ||
| - | [root@centos7 ~]# systemctl restart firewalld | + | root@debian12:/ |
| - | [root@centos7 | + | |
| - | Chain INPUT (policy ACCEPT) | + | ; <<>> |
| - | target | + | ;; global options: +cmd |
| - | ACCEPT | + | ;; Got answer: |
| - | ACCEPT | + | ;; ->> |
| - | INPUT_direct | + | ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 |
| - | INPUT_ZONES_SOURCE | + | |
| - | INPUT_ZONES | + | ;; OPT PSEUDOSECTION: |
| - | DROP | + | ; EDNS: version: 0, flags: do; udp: 1232 |
| - | REJECT | + | ; COOKIE: 5321c94da922f6ca010000006935867f45a42de06e00bfa1 (good) |
| - | ... | + | ;; QUESTION SECTION: |
| + | ;www.dnssec-failed.org. | ||
| + | |||
| + | ;; Query time: 140 msec | ||
| + | ;; SERVER: 127.0.0.1# | ||
| + | ;; WHEN: Sun Dec 07 14:51:59 CET 2025 | ||
| + | ;; MSG SIZE rcvd: 78 | ||
| </ | </ | ||
| ----- | ----- | ||
| Copyright © 2025 Hugh Norris. | Copyright © 2025 Hugh Norris. | ||
| + | |||
