Différences
Ci-dessous, les différences entre deux révisions de la page.
| Prochaine révision | Révision précédente | ||
| elearning:workbooks:lpic:21:450:l106 [2022/10/07 09:54] – created admin | elearning:workbooks:lpic:21:450:l106 [2022/11/01 07:27] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| - | Dernière mise-à-jour | + | Version |
| - | ======Topic 6: Networking Configuration====== | + | Dernière mise-à-jour |
| - | =====Contenu du Module===== | + | ======Topic 205: Networking Configuration====== |
| - | * **Topic | + | * **Topic |
| - | * Contenu du Module | + | |
| * Configuration du Réseau sous Debian 6 | * Configuration du Réseau sous Debian 6 | ||
| * Configuration de TCP/IP | * Configuration de TCP/IP | ||
| Ligne 22: | Ligne 21: | ||
| * / | * / | ||
| * /etc/hosts | * /etc/hosts | ||
| - | * Configuration du Réseau sous RHEL/ | + | |
| + | * 1.1 - Connections et Profils | ||
| + | * 1.2 - Résolution des Noms | ||
| + | * 1.3 - Ajouter une Deuxième Adresse IP à un Profil | ||
| + | * 1.4 - La Commande hostname | ||
| + | * 1.5 - La Commande ip | ||
| + | * 1.6 - Activer/ | ||
| + | * 1.7 - Routage Statique | ||
| + | * La commande ip | ||
| + | * Activer/ | ||
| + | * LAB #2 - Diagnostique du Réseau | ||
| + | * 2.1 - ping | ||
| + | * 2.2 - netstat -i | ||
| + | * 2.3 - traceroute | ||
| + | * LAB #3 - Connexions à Distance | ||
| + | * 3.1 - Telnet | ||
| + | * 3.2 - wget | ||
| + | * 3.3 - ftp | ||
| + | * 3.4 - SSH | ||
| + | * Présentation | ||
| + | * SSH-1 | ||
| + | * SSH-2 | ||
| + | * Authentification par mot de passe | ||
| + | * Authentification par clef asymétrique | ||
| + | * Configuration du Serveur | ||
| + | * Configuration du Client | ||
| + | * Tunnels SSH | ||
| + | * 3.5 - SCP | ||
| + | * Présentation | ||
| + | * Utilisation | ||
| + | * 3.6 - Mise en Place des Clefs Asymétriques | ||
| + | * 3.7 - Services réseaux | ||
| + | * inetd | ||
| + | * TCP Wrapper | ||
| + | | ||
| * Configuration de TCP/IP | * Configuration de TCP/IP | ||
| * DHCP | * DHCP | ||
| Ligne 44: | Ligne 77: | ||
| * La Commande route | * La Commande route | ||
| * Activer/ | * Activer/ | ||
| - | * Configuration du Réseau sous Debian 9 | + | * Configuration du Réseau sous RHEL/CentOS 7 |
| * La Commande nmcli | * La Commande nmcli | ||
| * Connections et Profils | * Connections et Profils | ||
| Ligne 51: | Ligne 84: | ||
| * La Commande ip | * La Commande ip | ||
| * Activer/ | * Activer/ | ||
| - | * Configuration du Réseau sous RHEL/CentOS 7 | + | |
| - | * La Commande nmcli | + | * La commande ip |
| - | * Connections et Profils | + | * Activer/ |
| - | * Ajouter une Deuxième Adresse IP à un Profil | + | * LAB #4 - Utilisation de nmap et de netcat |
| - | * La Commande hostname | + | * 4.1 - nmap |
| - | * La Commande ip | + | |
| - | * Activer/ | + | |
| - | | + | |
| - | * La commande ip | + | |
| - | * Activer/ | + | |
| - | * Services réseaux | + | |
| - | * xinetd | + | |
| - | * TCP Wrapper | + | |
| - | * Diagnostique du Réseau | + | |
| - | * ping | + | |
| - | * netstat | + | |
| - | * traceroute | + | |
| - | * Connexions à Distance | + | |
| - | * Telnet | + | |
| - | * wget | + | |
| - | * ftp | + | |
| - | * SSH | + | |
| - | * Introduction | + | |
| - | * SSH-1 | + | |
| - | * SSH-2 | + | |
| - | * L' | + | |
| - | * L' | + | |
| * Installation | * Installation | ||
| - | * Configuration | ||
| - | * Serveur | ||
| * Utilisation | * Utilisation | ||
| - | * Tunnels SSH | + | * Fichiers de Configuration |
| - | * SCP | + | * Scripts |
| - | * Introduction | + | * 4.2 - netcat |
| - | * Utilisation | + | * Utilisation |
| - | * Mise en place des clefs | + | * LAB #5 - Utilisation de tcpdump |
| - | * Le Pare-feu Netfilter | + | * 5.1 - Utilisation |
| - | * Configuration du Pare-feu Netfilter/ | + | * L' |
| - | * Introduction | + | * L' |
| - | * Configuration | + | * L' |
| - | * La Configuration | + | * L' |
| - | * La Configuration | + | * L' |
| - | * La Commande firewall-cmd | + | |
| - | * La Configuration Avancée de firewalld | + | * LAB #6 - Mise en place d'un VPN avec OpenVPN |
| - | * Le mode Panic de firewalld | + | * Présentation |
| + | * Configuration | ||
| + | * Configuration | ||
| + | * Configuration | ||
| + | * Tests | ||
| + | * Du client vers le serveur | ||
| + | * Du serveur vers le client | ||
| * Annexe #1 - Comprendre les Réseaux | * Annexe #1 - Comprendre les Réseaux | ||
| * Présentation des Réseaux | * Présentation des Réseaux | ||
| Ligne 176: | Ligne 191: | ||
| * PKI | * PKI | ||
| * Certificats X509 | * Certificats X509 | ||
| + | * Annexe 4 - La Commande iw | ||
| =====Configuration de TCP/IP sous Debian 6===== | =====Configuration de TCP/IP sous Debian 6===== | ||
| Ligne 557: | Ligne 573: | ||
| </ | </ | ||
| - | ==== Services réseaux | + | =====LAB #1 - Configuration du Réseau sous Debian 11===== |
| - | Quand un client émet une demande de connexion vers une application réseau sur un serveur, il utilise | + | Debian 11 utilise **Network Manager** pour gérer |
| - | === xinetd === | + | * un service qui gère les connexions réseaux et rapporte leurs états, |
| + | * des front-ends qui passent par un API de configuration du service. | ||
| - | Sous Debian 6 xinetd n' | + | <WRAP center round important 60%> |
| + | **Important** : Notez qu'avec cette version de NetworkManager, | ||
| + | </ | ||
| + | |||
| + | Le service NetworkManager doit toujours être lancé | ||
| < | < | ||
| - | root@debian6:~# apt-get install xinetd | + | root@debian11:~# systemctl status NetworkManager.service |
| - | Lecture des listes de paquets... Fait | + | ● NetworkManager.service - Network Manager |
| - | Construction de l' | + | Loaded: loaded (/ |
| - | Lecture des informations d' | + | Active: active (running) since Sun 2022-05-01 18:00:05 CEST; 20h ago |
| - | Les NOUVEAUX paquets suivants seront installés | + | Docs: man: |
| - | | + | Main PID: 499 (NetworkManager) |
| - | 0 mis à jour, 1 nouvellement installés, 0 à enlever et 219 non mis à jour. | + | |
| - | Il est nécessaire de prendre 136 ko dans les archives. | + | Memory: 13.3M |
| - | Après cette opération, 311 ko d' | + | CPU: 1.811s |
| - | Réception de : 1 http://ftp.fr.debian.org/debian/ squeeze/main xinetd i386 1:2.3.14-7 [136 kB] | + | |
| - | 136 ko réceptionnés en 0s (427 ko/s) | + | |
| - | Sélection du paquet xinetd précédemment désélectionné. | + | |
| - | (Lecture de la base de données... 130628 fichiers et répertoires déjà installés.) | + | May 01 18:00:05 debian11 NetworkManager[499]: < |
| - | Dépaquetage de xinetd | + | May 01 18:00:05 debian11 NetworkManager[499]: |
| - | Traitement des actions différées (« triggers ») pour « man-db »... | + | May 01 18:00:05 debian11 NetworkManager[499]: |
| - | Paramétrage de xinetd (1:2.3.14-7) ... | + | May 01 18:00:05 debian11 NetworkManager[499]: |
| - | Stopping internet superserver: xinetd. | + | May 01 18:00:05 debian11 NetworkManager[499]: |
| - | Starting internet superserver: xinetd. | + | May 01 18:00:05 debian11 NetworkManager[499]: |
| + | May 01 18:00:05 debian11 NetworkManager[499]: | ||
| + | May 01 18:00:05 debian11 NetworkManager[499]: | ||
| + | May 01 18:00:05 debian11 NetworkManager[499]: | ||
| + | May 01 18:00:05 debian11 NetworkManager[499]: | ||
| + | lines 1-21/21 (END) | ||
| + | [q] | ||
| </ | </ | ||
| - | Le programme xinetd est configuré via le fichier | + | La commande |
| + | |||
| + | Les options et les sous-commandes peuvent être consultées en utilisant les commandes suivantes | ||
| < | < | ||
| - | root@debian6:~# cat / | + | root@debian11:~# nmcli help |
| - | # Simple configuration file for xinetd | + | Usage: nmcli [OPTIONS] OBJECT { COMMAND | help } |
| - | # | + | |
| - | # Some defaults, and include / | + | |
| - | defaults | + | OPTIONS |
| - | { | + | -a, --ask ask for missing parameters |
| + | -c, --colors auto|yes|no | ||
| + | -e, --escape yes|no | ||
| + | -f, --fields < | ||
| + | -g, --get-values < | ||
| + | -h, --help | ||
| + | -m, --mode tabular|multiline | ||
| + | -o, --overview | ||
| + | -p, --pretty | ||
| + | -s, --show-secrets | ||
| + | -t, --terse | ||
| + | -v, --version | ||
| + | -w, --wait < | ||
| - | # Please note that you need a log_type line to be able to use log_on_success | + | OBJECT |
| - | # and log_on_failure. The default is the following : | + | |
| - | # log_type = SYSLOG daemon info | + | n[etworking] |
| + | r[adio] | ||
| + | c[onnection] | ||
| + | d[evice] | ||
| + | a[gent] | ||
| + | m[onitor] | ||
| + | </ | ||
| - | } | + | ====1.1 - Connections et Profils==== |
| - | includedir /etc/xinetd.d | + | NetworkManager inclus la notion de **connections** ou **profils** permettant des configurations différentes en fonction de la localisation. Pour voir les connections actuelles, utilisez la commande **nmcli c** avec la sous-commande **show** : |
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | NAME UUID TYPE DEVICE | ||
| + | Wired connection 1 77c569e6-3176-4c10-8008-40d7634d2504 | ||
| </ | </ | ||
| - | Les valeurs des directives dans le fichier **/ | + | Créez donc un profil IP fixe rattaché au périphérique |
| - | Les variables les plus usuellement utilisées dans **/etc/xinetd.conf** sont : | + | < |
| + | root@debian11: | ||
| + | Connection ' | ||
| + | </ | ||
| - | ^ Directive | + | Constatez sa présence : |
| - | | instances | + | |
| - | | log_type | + | |
| - | | log_on_succes | + | |
| - | | log_on_failure | + | |
| - | | cps | Indique 50 connexions par seconde avec un temps d' | + | |
| - | Les options concernant les journaux sont : | + | < |
| + | root@debian11:~# nmcli c show | ||
| + | NAME UUID TYPE DEVICE | ||
| + | Wired connection 1 77c569e6-3176-4c10-8008-40d7634d2504 | ||
| + | ip_fixe | ||
| + | </ | ||
| - | | HOST | Journalisation de l' | + | Notez que la sortie n'indique pas que le profil **ip_fixe** soit associé au periphérique **ens18** car le profil **ip_fixe** n'est pas activé : |
| - | | PID | Journalisation du PID du processus qui reçoit | + | |
| - | | DURATION | + | |
| - | | EXIT | Journalisation de l' | + | |
| - | | ATTEMPT | + | |
| - | | USERID | + | |
| - | Examinons maintenant le répertoire **/etc/xinetd.d** : | + | < |
| + | root@debian11: | ||
| + | GENERAL.DEVICE: | ||
| + | GENERAL.TYPE: | ||
| + | GENERAL.HWADDR: | ||
| + | GENERAL.MTU: | ||
| + | GENERAL.STATE: | ||
| + | GENERAL.CONNECTION: | ||
| + | GENERAL.CON-PATH: | ||
| + | WIRED-PROPERTIES.CARRIER: | ||
| + | IP4.ADDRESS[1]: | ||
| + | IP4.GATEWAY: | ||
| + | IP4.ROUTE[1]: | ||
| + | IP4.ROUTE[2]: | ||
| + | IP4.DNS[1]: | ||
| + | IP4.DNS[2]: | ||
| + | IP6.ADDRESS[1]: | ||
| + | IP6.GATEWAY: | ||
| + | IP6.ROUTE[1]: | ||
| + | IP6.ROUTE[2]: | ||
| + | |||
| + | GENERAL.DEVICE: | ||
| + | GENERAL.TYPE: | ||
| + | GENERAL.HWADDR: | ||
| + | GENERAL.MTU: | ||
| + | lines 1-23 | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | Pour activer le profil ip_fixe, utilisez la commande suivante | ||
| < | < | ||
| - | root@debian6:~# ls -l / | + | [root@centos8 |
| - | total 20 | + | |
| - | -rw-r--r-- 1 root root 798 26 mars 2008 chargen | + | |
| - | -rw-r--r-- 1 root root 660 26 mars 2008 daytime | + | |
| - | -rw-r--r-- 1 root root 549 26 mars 2008 discard | + | |
| - | -rw-r--r-- 1 root root 580 26 mars 2008 echo | + | |
| - | -rw-r--r-- 1 root root 727 26 mars 2008 time | + | |
| </ | </ | ||
| - | A l'examen de ce répertoire vous noterez que celui-ci contient des fichiers nominatifs par application-serveur, par exemple pour le serveur chargen | + | Notez que votre terminal est bloqué à cause du changement de l'adresse IP. |
| + | |||
| + | <WRAP center round todo 60%> | ||
| + | **A faire** | ||
| + | </ | ||
| + | |||
| + | Le profil ip_fixe est maintenant activé tandis que le profil enp0s3 a été désactivé | ||
| < | < | ||
| - | root@debian6:~# cat / | + | root@debian11:~# nmcli c show |
| - | # default: off | + | NAME UUID TYPE DEVICE |
| - | # description: An xinetd internal service which generate characters. The | + | ip_fixe |
| - | # xinetd internal service which continuously generates characters until the | + | Wired connection 1 77c569e6-3176-4c10-8008-40d7634d2504 |
| - | # connection is dropped. The characters look something like this: | + | |
| - | # !"# | + | root@debian11: |
| - | # This is the tcp version. | + | GENERAL.DEVICE: ens18 |
| - | service chargen | + | GENERAL.TYPE: ethernet |
| - | { | + | GENERAL.HWADDR: |
| - | disable = yes | + | GENERAL.MTU: 1500 |
| - | type = INTERNAL | + | GENERAL.STATE: |
| - | id = chargen-stream | + | GENERAL.CONNECTION: ip_fixe |
| - | socket_type = stream | + | GENERAL.CON-PATH: |
| - | protocol = tcp | + | WIRED-PROPERTIES.CARRIER: |
| - | user = root | + | IP4.ADDRESS[1]: |
| - | wait = no | + | IP4.GATEWAY: |
| - | } | + | IP4.ROUTE[1]: |
| + | IP4.ROUTE[2]: | ||
| + | IP6.ADDRESS[1]: | ||
| + | IP6.GATEWAY: | ||
| + | IP6.ROUTE[1]: | ||
| + | IP6.ROUTE[2]: | ||
| - | # This is the udp version. | + | GENERAL.DEVICE: |
| - | service chargen | + | GENERAL.TYPE: |
| - | { | + | lines 1-19 |
| - | disable = yes | + | [q] |
| - | type = INTERNAL | + | |
| - | id = chargen-dgram | + | |
| - | socket_type = dgram | + | |
| - | protocol = udp | + | |
| - | user = root | + | |
| - | wait = yes | + | |
| - | } | + | |
| </ | </ | ||
| - | Les directives principales de ce fichier sont : | + | Pour consulter les paramètres du profil **Wired connection 1**, utilisez la commande suivante |
| - | ^ Paramètre | + | < |
| - | | disable | + | root@debian11:~# nmcli -p connection show "Wired connection 1" |
| - | | | + | =============================================================================== |
| - | | socket_type | + | Connection profile details (Wired connection 1) |
| - | | protocol | + | =============================================================================== |
| - | | wait | **no** | + | connection.id: Wired connection 1 |
| - | | user | Indique le compte sous lequel le serveur est exécuté | | + | connection.uuid: |
| - | | server | + | connection.stable-id: |
| - | | env | Définit un environnement système | | + | connection.type: |
| - | | server_args | + | connection.interface-name: |
| + | connection.autoconnect: | ||
| + | connection.autoconnect-priority: 0 | ||
| + | connection.autoconnect-retries: | ||
| + | connection.multi-connect: | ||
| + | connection.auth-retries: | ||
| + | connection.timestamp: | ||
| + | connection.read-only: | ||
| + | connection.permissions: | ||
| + | connection.zone: | ||
| + | connection.master: | ||
| + | connection.slave-type: | ||
| + | connection.autoconnect-slaves: | ||
| + | connection.secondaries: | ||
| + | connection.gateway-ping-timeout: | ||
| + | connection.metered: | ||
| + | connection.lldp: | ||
| + | connection.mdns: | ||
| + | connection.llmnr: | ||
| + | connection.wait-device-timeout: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | 802-3-ethernet.port: -- | ||
| + | 802-3-ethernet.speed: | ||
| + | 802-3-ethernet.duplex: | ||
| + | 802-3-ethernet.auto-negotiate: | ||
| + | 802-3-ethernet.mac-address: | ||
| + | 802-3-ethernet.cloned-mac-address: | ||
| + | 802-3-ethernet.generate-mac-address-mask: | ||
| + | 802-3-ethernet.mac-address-blacklist: | ||
| + | 802-3-ethernet.mtu: | ||
| + | 802-3-ethernet.s390-subchannels: | ||
| + | 802-3-ethernet.s390-nettype: | ||
| + | 802-3-ethernet.s390-options: | ||
| + | 802-3-ethernet.wake-on-lan: | ||
| + | 802-3-ethernet.wake-on-lan-password: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | ipv4.method: | ||
| + | ipv4.dns: | ||
| + | ipv4.dns-search: | ||
| + | ipv4.dns-options: | ||
| + | ipv4.dns-priority: | ||
| + | ipv4.addresses: | ||
| + | ipv4.gateway: | ||
| + | ipv4.routes: | ||
| + | ipv4.route-metric: -1 | ||
| + | ipv4.route-table: 0 (unspec) | ||
| + | ipv4.routing-rules: | ||
| + | ipv4.ignore-auto-routes: | ||
| + | ipv4.ignore-auto-dns: | ||
| + | lines 1-56 | ||
| + | [q] | ||
| + | </ | ||
| - | Cependant il est aussi possible d' | + | De même, pour consulter |
| - | ^ Paramètre | + | < |
| - | | nice | Fixe le niveau de nice entre -19 et +20 | 10 | | + | root@debian11: |
| - | | max_load | + | =============================================================================== |
| - | | bind | Limite le service à l'interface | + | |
| - | | only_from | + | =============================================================================== |
| - | | no_access | + | connection.id: ip_fixe |
| - | | access_time | + | connection.uuid: c52994fc-0918-4108-81d2-d86dade62c7a |
| - | | redirect | + | connection.stable-id: |
| + | connection.type: | ||
| + | connection.interface-name: | ||
| + | connection.autoconnect: | ||
| + | connection.autoconnect-priority: | ||
| + | connection.autoconnect-retries: | ||
| + | connection.multi-connect: | ||
| + | connection.auth-retries: | ||
| + | connection.timestamp: | ||
| + | connection.read-only: | ||
| + | connection.permissions: | ||
| + | connection.zone: | ||
| + | connection.master: | ||
| + | connection.slave-type: | ||
| + | connection.autoconnect-slaves: | ||
| + | connection.secondaries: | ||
| + | connection.gateway-ping-timeout: | ||
| + | connection.metered: | ||
| + | connection.lldp: default | ||
| + | connection.mdns: -1 (default) | ||
| + | connection.llmnr: | ||
| + | connection.wait-device-timeout: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | 802-3-ethernet.port: | ||
| + | 802-3-ethernet.speed: | ||
| + | 802-3-ethernet.duplex: | ||
| + | 802-3-ethernet.auto-negotiate: | ||
| + | 802-3-ethernet.mac-address: | ||
| + | 802-3-ethernet.cloned-mac-address: | ||
| + | 802-3-ethernet.generate-mac-address-mask: | ||
| + | 802-3-ethernet.mac-address-blacklist: | ||
| + | 802-3-ethernet.mtu: | ||
| + | 802-3-ethernet.s390-subchannels: | ||
| + | 802-3-ethernet.s390-nettype: | ||
| + | 802-3-ethernet.s390-options: | ||
| + | 802-3-ethernet.wake-on-lan: | ||
| + | 802-3-ethernet.wake-on-lan-password: | ||
| + | ------------------------------------------------------------------------------- | ||
| + | ipv4.method: | ||
| + | ipv4.dns: | ||
| + | ipv4.dns-search: | ||
| + | ipv4.dns-options: | ||
| + | ipv4.dns-priority: | ||
| + | ipv4.addresses: | ||
| + | ipv4.gateway: | ||
| + | ipv4.routes: -- | ||
| + | ipv4.route-metric: -1 | ||
| + | ipv4.route-table: | ||
| + | ipv4.routing-rules: | ||
| + | ipv4.ignore-auto-routes: | ||
| + | ipv4.ignore-auto-dns: | ||
| + | lines 1-56 | ||
| + | [q] | ||
| + | </ | ||
| - | Afin d' | + | Pour consulter la liste profils associés à un périphérique, utilisez la commande suivante : |
| - | === TCP Wrapper === | + | < |
| + | root@debian11: | ||
| + | CONNECTIONS.AVAILABLE-CONNECTION-PATHS: | ||
| + | CONNECTIONS.AVAILABLE-CONNECTIONS[1]: | ||
| + | CONNECTIONS.AVAILABLE-CONNECTIONS[2]: | ||
| + | lines 1-3/3 (END) | ||
| + | [q] | ||
| + | </ | ||
| - | **TCP Wrapper** contrôle l' | + | Les fichiers de configuration pour le periphérique |
| - | Quand une requête arrive pour un serveur, xinetd active le wrapper **tcpd** au lieu d' | + | < |
| + | root@debian11: | ||
| + | total 8 | ||
| + | -rw------- 1 root root 284 May 2 14:23 ip_fixe.nmconnection | ||
| + | -rw------- 1 root root 249 Apr 25 07:01 'Wired connection 1' | ||
| + | </ | ||
| - | **tcpd** met à jour un journal et vérifie si le client a le droit d' | + | ====1.2 - Résolution des Noms==== |
| - | * **/etc/hosts.allow** | + | L' |
| - | * **/etc/hosts.deny** | + | |
| - | Il faut noter que si ces fichiers n' | + | < |
| + | root@debian11: | ||
| + | [connection] | ||
| + | id=ip_fixe | ||
| + | uuid=c52994fc-0918-4108-81d2-d86dade62c7a | ||
| + | type=ethernet | ||
| + | interface-name=ens18 | ||
| + | permissions= | ||
| - | Le format d'une ligne dans un de ces deux fichiers est: | + | [ethernet] |
| + | mac-address-blacklist= | ||
| - | < | + | [ipv4] |
| - | démon : liste_de_clients | + | address1=10.0.2.41/24, |
| - | </file> | + | dns-search= |
| + | method=manual | ||
| - | Par exemple dans le cas d'un serveur **démon**, on verrait une ligne dans le fichier **/ | + | [ipv6] |
| + | addr-gen-mode=stable-privacy | ||
| + | dns-search= | ||
| + | method=auto | ||
| - | < | + | [proxy] |
| - | démon : LOCAL, .fenestros.loc | + | </code> |
| - | </file> | + | |
| - | ce qui implique que les machines dont le nom ne comporte pas de point ainsi que les machines du domaine **fenestros.loc** sont autorisées à utiliser le service. | + | La résolution des noms est donc inactive : |
| - | Le mot clef **ALL** peut être utilisé pour indiquer tout. Par exemple, **ALL:ALL** dans le fichier **/etc/host.deny** bloque effectivement toute tentative de connexion à un service xinetd sauf pour les ACL inclus dans le fichier | + | < |
| + | root@debian11: | ||
| + | ping: www.free.fr: Temporary failure in name resolution | ||
| + | </code> | ||
| - | ====Routage Statique==== | + | Modifiez donc la configuration du profil **ip_fixe** : |
| - | ===La Commande route=== | + | < |
| + | root@debian11: | ||
| + | </ | ||
| - | Pour afficher la table de routage de la machine vous pouvez utiliser la commande | + | L' |
| < | < | ||
| - | root@debian6:~# route | + | root@debian11:~# cat / |
| - | Table de routage IP du noyau | + | [connection] |
| - | Destination | + | id=ip_fixe |
| - | 192.168.1.0 | + | uuid=c52994fc-0918-4108-81d2-d86dade62c7a |
| - | 10.0.2.0 * | + | type=ethernet |
| - | default | + | interface-name=ens18 |
| + | permissions= | ||
| + | timestamp=1651499105 | ||
| + | |||
| + | [ethernet] | ||
| + | mac-address-blacklist= | ||
| + | |||
| + | [ipv4] | ||
| + | address1=10.0.2.41/24,10.0.2.1 | ||
| + | dns=8.8.8.8; | ||
| + | dns-search= | ||
| + | method=manual | ||
| + | |||
| + | [ipv6] | ||
| + | addr-gen-mode=stable-privacy | ||
| + | dns-search= | ||
| + | method=auto | ||
| + | |||
| + | [proxy] | ||
| </ | </ | ||
| - | La table issue de la commande **route** indique les informations suivantes: | + | Afin que la modification du serveur DNS soit prise en compte, re-démarrez le service NetworkManager |
| - | * La destination qui peut être un hôte ou un réseau et est identifiée par les champs **Destination** et **Genmask** | + | < |
| - | * La route à prendre identifiée par les champs **Gateway** et **Iface**. Dans le cas d'une valeur de 0.0.0.0 ceci spécifie une route directe. La valeur d' | + | root@debian11:~# systemctl restart NetworkManager.service |
| - | * Le champ **Indic** qui peux prendre un ou plusieurs de svaleurs suivantes: | + | </ |
| - | * U - **Up** - la route est active | + | |
| - | * H - **Host** - la route conduit à un hôte | + | |
| - | * G - **Gateways** - la route passe par une passerelle | + | |
| - | * Le champ **Metric** indique le nombre de sauts (passerelles) pour atteindre la destination, | + | |
| - | * Le champ **Ref** indique le nombre de références à cette route. Ce champs est usilisé par le Noyau de Linux, | + | |
| - | * Le champ **Use** indique le nombre de recherches associés à cette route. | + | |
| - | La commande | + | Vérifiez que le fichier |
| < | < | ||
| - | root@debian6:~# route del -net 192.168.1.0 | + | root@debian11:~# cat / |
| - | root@debian6:~# route | + | # Generated by NetworkManager |
| - | Table de routage IP du noyau | + | nameserver 8.8.8.8 |
| - | Destination | + | </ |
| - | 10.0.2.0 | + | |
| - | default | + | Dernièrement vérifiez la resolution des noms : |
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | PING www.free.fr (212.27.48.10) 56(84) bytes of data. | ||
| + | 64 bytes from www.free.fr (212.27.48.10): | ||
| + | 64 bytes from www.free.fr (212.27.48.10): | ||
| + | ^C | ||
| + | --- www.free.fr ping statistics --- | ||
| + | 2 packets transmitted, | ||
| + | rtt min/ | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** : Notez qu'il existe un front-end graphique en mode texte, **nmtui**, pour configurer NetworkManager. | ||
| + | </ | ||
| + | |||
| + | ====1.3 - Ajouter une Deuxième Adresse IP à un Profil==== | ||
| + | |||
| + | Pour ajouter une deuxième adresse IP à un profil sous Debian 11, il convient d' | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | </ | ||
| + | |||
| + | Rechargez la configuration du profil : | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | Connection successfully activated (D-Bus active path: / | ||
| + | </ | ||
| + | |||
| + | Saisissez ensuite la commande suivante : | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | connection.id: | ||
| + | connection.uuid: | ||
| + | connection.stable-id: | ||
| + | connection.type: | ||
| + | connection.interface-name: | ||
| + | connection.autoconnect: | ||
| + | connection.autoconnect-priority: | ||
| + | connection.autoconnect-retries: | ||
| + | connection.multi-connect: | ||
| + | connection.auth-retries: | ||
| + | connection.timestamp: | ||
| + | connection.read-only: | ||
| + | connection.permissions: | ||
| + | connection.zone: | ||
| + | connection.master: | ||
| + | connection.slave-type: | ||
| + | connection.autoconnect-slaves: | ||
| + | connection.secondaries: | ||
| + | connection.gateway-ping-timeout: | ||
| + | connection.metered: | ||
| + | connection.lldp: | ||
| + | connection.mdns: | ||
| + | connection.llmnr: | ||
| + | connection.wait-device-timeout: | ||
| + | 802-3-ethernet.port: | ||
| + | 802-3-ethernet.speed: | ||
| + | 802-3-ethernet.duplex: | ||
| + | 802-3-ethernet.auto-negotiate: | ||
| + | 802-3-ethernet.mac-address: | ||
| + | 802-3-ethernet.cloned-mac-address: | ||
| + | 802-3-ethernet.generate-mac-address-mask: | ||
| + | 802-3-ethernet.mac-address-blacklist: | ||
| + | 802-3-ethernet.mtu: | ||
| + | 802-3-ethernet.s390-subchannels: | ||
| + | 802-3-ethernet.s390-nettype: | ||
| + | 802-3-ethernet.s390-options: | ||
| + | 802-3-ethernet.wake-on-lan: | ||
| + | 802-3-ethernet.wake-on-lan-password: | ||
| + | ipv4.method: | ||
| + | ipv4.dns: | ||
| + | ipv4.dns-search: | ||
| + | ipv4.dns-options: | ||
| + | ipv4.dns-priority: | ||
| + | ipv4.addresses: | ||
| + | ipv4.gateway: | ||
| + | ipv4.routes: | ||
| + | ipv4.route-metric: | ||
| + | ipv4.route-table: | ||
| + | ipv4.routing-rules: | ||
| + | ipv4.ignore-auto-routes: | ||
| + | ipv4.ignore-auto-dns: | ||
| + | ipv4.dhcp-client-id: | ||
| + | ipv4.dhcp-iaid: | ||
| + | ipv4.dhcp-timeout: | ||
| + | ipv4.dhcp-send-hostname: | ||
| + | ipv4.dhcp-hostname: | ||
| + | lines 1-56 | ||
| + | [Space Bar] | ||
| + | IP4.ADDRESS[1]: | ||
| + | IP4.ADDRESS[2]: | ||
| + | IP4.GATEWAY: | ||
| + | IP4.ROUTE[1]: | ||
| + | IP4.ROUTE[2]: | ||
| + | IP4.ROUTE[3]: | ||
| + | IP4.DNS[1]: | ||
| + | lines 57-112 | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** : Notez l' | ||
| + | </ | ||
| + | |||
| + | Consultez maintenant le contenu du fichier **/ | ||
| + | |||
| + | < | ||
| + | root@debian11:~# cat / | ||
| + | [connection] | ||
| + | id=ip_fixe | ||
| + | uuid=c52994fc-0918-4108-81d2-d86dade62c7a | ||
| + | type=ethernet | ||
| + | interface-name=ens18 | ||
| + | permissions= | ||
| + | timestamp=1651499263 | ||
| + | |||
| + | [ethernet] | ||
| + | mac-address-blacklist= | ||
| + | |||
| + | [ipv4] | ||
| + | address1=10.0.2.41/ | ||
| + | address2=192.168.1.2/ | ||
| + | dns=8.8.8.8; | ||
| + | dns-search= | ||
| + | method=manual | ||
| + | |||
| + | [ipv6] | ||
| + | addr-gen-mode=stable-privacy | ||
| + | dns-search= | ||
| + | method=auto | ||
| + | |||
| + | [proxy] | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** : Notez l' | ||
| + | </ | ||
| + | |||
| + | ====1.4 - La Commande hostname==== | ||
| + | |||
| + | La procédure de la modification | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | debian11 | ||
| + | |||
| + | root@debian11: | ||
| + | |||
| + | root@debian11: | ||
| + | debian11.ittraining.loc | ||
| + | |||
| + | root@debian11: | ||
| + | debian11.ittraining.loc | ||
| + | </ | ||
| + | |||
| + | ====1.5 - La Commande ip==== | ||
| + | |||
| + | Sous Debian 11 la commande **ip** est préférée par rapport à la commande ifconfig : | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | 1: lo: < | ||
| + | | ||
| + | inet 127.0.0.1/8 scope host lo | ||
| + | | ||
| + | inet6 ::1/128 scope host | ||
| + | | ||
| + | 2: ens18: < | ||
| + | link/ether f6: | ||
| + | altname enp0s18 | ||
| + | inet 10.0.2.41/24 brd 10.0.2.255 scope global noprefixroute ens18 | ||
| + | | ||
| + | inet 192.168.1.2/ | ||
| + | | ||
| + | inet6 fe80:: | ||
| + | | ||
| + | </ | ||
| + | |||
| + | En cas de besoin, pour extraire les adresses IP de cette sortie, utilisez les commandes suivantes : | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | 10.0.2.41 | ||
| + | 192.168.1.2 | ||
| + | </ | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | Usage: ip [ OPTIONS ] OBJECT { COMMAND | help } | ||
| + | ip [ -force ] -batch filename | ||
| + | where OBJECT := { link | address | addrlabel | route | rule | neigh | ntable | | ||
| + | | ||
| + | netns | l2tp | fou | macsec | tcp_metrics | token | netconf | ila | | ||
| + | vrf | sr | nexthop | mptcp } | ||
| + | | ||
| + | -h[uman-readable] | -iec | -j[son] | -p[retty] | | ||
| + | -f[amily] { inet | inet6 | mpls | bridge | link } | | ||
| + | -4 | -6 | -I | -D | -M | -B | -0 | | ||
| + | -l[oops] { maximum-addr-flush-attempts } | -br[ief] | | ||
| + | -o[neline] | -t[imestamp] | -ts[hort] | -b[atch] [filename] | | ||
| + | -rc[vbuf] [size] | -n[etns] name | -N[umeric] | -a[ll] | | ||
| + | -c[olor]} | ||
| + | </ | ||
| + | |||
| + | ====1.6 - Activer/ | ||
| + | |||
| + | Deux commandes existent pour désactiver et activer manuellement une interface réseau : | ||
| + | |||
| + | < | ||
| + | # nmcli device disconnect enp0s3 | ||
| + | # nmcli device connect enp0s3 | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** : Veuillez ne **PAS** exécuter ces deux commandes. | ||
| + | </ | ||
| + | |||
| + | ====1.7 - Routage Statique==== | ||
| + | |||
| + | ===La commande ip=== | ||
| + | |||
| + | Sous Debian 11, pour supprimer la route vers le réseau 192.168.1.0 il convient d' | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | default | ||
| + | 10.0.2.0/24 dev ens18 proto kernel scope link src 10.0.2.41 metric 100 | ||
| + | 192.168.1.0/24 dev ens18 proto kernel scope link src 192.168.1.2 metric 100 | ||
| + | |||
| + | root@debian11: | ||
| + | |||
| + | root@debian11: | ||
| + | default via 10.0.2.1 dev ens18 proto static metric 100 | ||
| + | 10.0.2.0/24 dev ens18 proto kernel scope link src 10.0.2.41 metric 100 | ||
| </ | </ | ||
| Ligne 768: | Ligne 1227: | ||
| < | < | ||
| - | root@debian6:~# route add -net 192.168.1.0 | + | root@debian11:~# ip route add 192.168.1.0/24 via 10.0.2.1 |
| - | root@debian6:~# route | + | |
| - | Table de routage IP du noyau | + | root@debian11:~# ip route |
| - | Destination | + | default via 10.0.2.1 dev ens18 proto static metric 100 |
| - | 192.168.1.0 mdt34.formation 255.255.255.0 UG 0 0 0 eth0 | + | 10.0.2.0/24 dev ens18 proto kernel scope link src 10.0.2.41 metric 100 |
| - | 10.0.2.0 * 255.255.255.0 U | + | 192.168.1.0/24 via 10.0.2.1 dev ens18 |
| - | default | + | |
| </ | </ | ||
| - | <WRAP center round important> | + | <WRAP center round important |
| - | La commande utilisée pour ajouter une passerelle par défaut prend la forme suivante **route add default | + | **Important** - La commande utilisée pour ajouter une passerelle par défaut prend la forme suivante **ip route add default |
| </ | </ | ||
| - | Les options cette commande sont : | + | ===Activer le routage sur le serveur=== |
| + | |||
| + | Pour activer le routage sur le serveur, il convient d' | ||
| < | < | ||
| - | root@debian6:~# route --help | + | root@debian11:~# echo 1 > / |
| - | Syntaxe: route [-nNvee] [-FC] [<AF>] Liste les tables de routage noyau | + | root@debian11:~# cat / |
| - | route [-v] [-FC] {add|del|flush} ... Modifie la table de routage pour AF. | + | 1 |
| + | </code> | ||
| - | route {-h|--help} [< | + | =====LAB #2 - Diagnostique du Réseau===== |
| - | route {-V|--version} | + | |
| - | -v, --verbose | + | ====2.1 - ping==== |
| + | |||
| + | Pour tester l' | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | PING 10.0.2.1 (10.0.2.1) 56(84) bytes of data. | ||
| + | 64 bytes from 10.0.2.1: icmp_seq=1 ttl=64 time=0.184 ms | ||
| + | 64 bytes from 10.0.2.1: icmp_seq=2 ttl=64 time=0.167 ms | ||
| + | 64 bytes from 10.0.2.1: icmp_seq=3 ttl=64 time=0.168 ms | ||
| + | ^C | ||
| + | --- 10.0.2.1 ping statistics --- | ||
| + | 3 packets transmitted, | ||
| + | rtt min/ | ||
| + | </ | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | ping: invalid option -- ' | ||
| + | |||
| + | Usage | ||
| + | ping [options] < | ||
| + | |||
| + | Options: | ||
| + | < | ||
| + | -a use audible ping | ||
| + | -A use adaptive ping | ||
| + | -B | ||
| + | -c < | ||
| + | -D print timestamps | ||
| + | -d use SO_DEBUG socket option | ||
| + | -f flood ping | ||
| + | -h print help and exit | ||
| + | -I < | ||
| + | -i < | ||
| + | -L | ||
| + | -l < | ||
| + | -m < | ||
| + | -M <pmtud opt> | ||
| + | -n no dns name resolution | ||
| + | -O | ||
| + | -p < | ||
| + | -q quiet output | ||
| + | -Q < | ||
| + | -s < | ||
| + | -S < | ||
| + | -t < | ||
| + | -U print user-to-user latency | ||
| + | -v | ||
| + | -V print version and exit | ||
| + | -w < | ||
| + | -W < | ||
| + | |||
| + | IPv4 options: | ||
| + | -4 use IPv4 | ||
| + | -b allow pinging broadcast | ||
| + | -R | ||
| + | -T < | ||
| + | |||
| + | IPv6 options: | ||
| + | -6 use IPv6 | ||
| + | -F < | ||
| + | -N < | ||
| + | |||
| + | For more details see ping(8). | ||
| + | </ | ||
| + | |||
| + | ====2.2 - netstat -i==== | ||
| + | |||
| + | Pour visualiser les statistiques réseaux, vous disposez de la commande **netstat** : | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | -bash: netstat: command not found | ||
| + | |||
| + | root@debian11: | ||
| + | |||
| + | root@debian11: | ||
| + | Kernel Interface table | ||
| + | Iface MTU RX-OK RX-ERR RX-DRP RX-OVR | ||
| + | ens18 | ||
| + | lo | ||
| + | </ | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | usage: netstat [-vWeenNcCF] [< | ||
| + | | ||
| + | | ||
| + | |||
| + | -r, --route | ||
| + | -i, --interfaces | ||
| + | -g, --groups | ||
| + | -s, --statistics | ||
| + | -M, --masquerade | ||
| + | |||
| + | | ||
| + | -W, --wide | ||
| -n, --numeric | -n, --numeric | ||
| + | --numeric-hosts | ||
| + | --numeric-ports | ||
| + | --numeric-users | ||
| + | -N, --symbolic | ||
| -e, --extend | -e, --extend | ||
| + | -p, --programs | ||
| + | -o, --timers | ||
| + | -c, --continuous | ||
| + | |||
| + | -l, --listening | ||
| + | -a, --all display all sockets (default: connected) | ||
| -F, --fib display Forwarding Information Base (default) | -F, --fib display Forwarding Information Base (default) | ||
| - | -C, --cache | + | -C, --cache |
| + | -Z, --context | ||
| - | < | + | |
| - | | + | |
| + | | ||
| + | | ||
| inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25) | inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25) | ||
| netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP) | netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP) | ||
| Ligne 804: | Ligne 1378: | ||
| </ | </ | ||
| - | Vous pouvez aussi utiliser | + | ====2.3 - traceroute==== |
| + | |||
| + | La commande ping est à la base de la commande **traceroute**. Cette commande sert à découvrir | ||
| < | < | ||
| - | root@debian6:~# netstat -nr | + | root@debian11:~# traceroute www.free.fr |
| - | Table de routage IP du noyau | + | traceroute to www.free.fr (212.27.48.10), |
| - | Destination | + | 1 10.0.2.1 (10.0.2.1) 0.476 ms 0.440 ms |
| - | 192.168.1.0 192.168.1.2 255.255.255.0 UG 0 0 0 eth0 | + | 2 51.68.180.253 (51.68.180.253) |
| - | 10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 | + | |
| - | 0.0.0.0 | + | 4 10.17.242.66 (10.17.242.66) |
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | 10 10.200.2.65 (10.200.2.65) | ||
| + | 11 * * * | ||
| + | 12 194.149.166.61 (194.149.166.61) | ||
| + | 13 * * * | ||
| + | 14 * * * | ||
| + | 15 * * * | ||
| + | 16 * * * | ||
| + | 17 * * * | ||
| + | 18 * * * | ||
| + | 19 * * * | ||
| + | 20 * * * | ||
| + | 21 * * * | ||
| + | 22 * * * | ||
| + | 23 * * * | ||
| + | 24 * * * | ||
| + | 25 * * * | ||
| + | 26 * * * | ||
| + | 27 * * * | ||
| + | 28 * * * | ||
| + | 29 * * * | ||
| + | 30 * * * | ||
| </ | </ | ||
| - | La table issue de la commande | + | Les options |
| - | * La champ **MSS** indique la taille maximale des segments | + | < |
| - | | + | root@debian11: |
| - | | + | Usage: |
| + | traceroute [ -46dFITnreAUDV ] [ -f first_ttl ] [ -g gate,... ] [ -i device ] [ -m max_ttl ] [ -N squeries ] [ -p port ] [ -t tos ] [ -l flow_label ] [ -w MAX, | ||
| + | Options: | ||
| + | -4 Use IPv4 | ||
| + | -6 Use IPv6 | ||
| + | -d --debug | ||
| + | -F --dont-fragment | ||
| + | -f first_ttl | ||
| + | Start from the first_ttl hop (instead from 1) | ||
| + | -g gate, | ||
| + | Route packets through the specified gateway | ||
| + | (maximum 8 for IPv4 and 127 for IPv6) | ||
| + | -I --icmp | ||
| + | -T --tcp | ||
| + | -i device | ||
| + | Specify a network interface to operate with | ||
| + | -m max_ttl | ||
| + | Set the max number of hops (max TTL to be | ||
| + | reached). Default is 30 | ||
| + | -N squeries | ||
| + | Set the number of probes to be tried | ||
| + | simultaneously (default is 16) | ||
| + | -n Do not resolve IP addresses to their domain names | ||
| + | -p port --port=port | ||
| + | initial udp port value for " | ||
| + | (incremented by each probe, default is 33434), or | ||
| + | initial seq for " | ||
| + | default from 1), or some constant destination | ||
| + | port for other methods (with default of 80 for | ||
| + | " | ||
| + | | ||
| + | traffic class) value for outgoing packets | ||
| + | -l flow_label | ||
| + | Use specified flow_label for IPv6 packets | ||
| + | -w MAX,HERE, | ||
| + | Wait for a probe no more than HERE (default 3) | ||
| + | times longer than a response from the same hop, | ||
| + | or no more than NEAR (default 10) times than some | ||
| + | next hop, or MAX (default 5.0) seconds (float | ||
| + | point values allowed too) | ||
| + | | ||
| + | Set the number of probes per each hop. Default is | ||
| + | 3 | ||
| + | -r Bypass the normal routing and send directly to a | ||
| + | host on an attached network | ||
| + | -s src_addr | ||
| + | Use source src_addr for outgoing packets | ||
| + | -z sendwait | ||
| + | Minimal time interval between probes (default 0). | ||
| + | If the value is more than 10, then it specifies a | ||
| + | number in milliseconds, | ||
| + | seconds (float point values allowed too) | ||
| + | -e --extensions | ||
| + | -A --as-path-lookups | ||
| + | print results directly after the corresponding | ||
| + | addresses | ||
| + | -M name --module=name | ||
| + | for traceroute operations. Most methods have | ||
| + | their shortcuts (`-I' means `-M icmp' etc.) | ||
| + | -O OPTS, | ||
| + | Use module-specific option OPTS for the | ||
| + | traceroute module. Several OPTS allowed, | ||
| + | separated by comma. If OPTS is " | ||
| + | about available options | ||
| + | --sport=num | ||
| + | `-N 1' | ||
| + | --fwmark=num | ||
| + | -U --udp Use UDP to particular port for tracerouting | ||
| + | (instead of increasing the port per each probe), | ||
| + | default port is 53 | ||
| + | -UL Use UDPLITE for tracerouting (default dest port | ||
| + | is 53) | ||
| + | -D --dccp | ||
| + | is 33434) | ||
| + | -P prot --protocol=prot | ||
| + | --mtu | ||
| + | `-F -N 1' | ||
| + | --back | ||
| + | print if it differs | ||
| + | -V --version | ||
| + | --help | ||
| - | ===Activer/désactiver le routage sur le serveur=== | + | Arguments: |
| + | + | ||
| + | packetlen | ||
| + | header plus 40). Can be ignored or increased to a minimal | ||
| + | allowed value | ||
| + | </code> | ||
| - | Pour activer le routage sur le serveur, il convient d'activer | + | =====LAB #3 - Connexions à Distance===== |
| + | |||
| + | ==== 3.1 - Telnet ==== | ||
| + | |||
| + | La commande **telnet** est utilisée pour établir une connexion à distance avec un serveur | ||
| + | |||
| + | < | ||
| + | # telnet numero_ip | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** - Le service telnet revient à une redirection des canaux standards d' | ||
| + | </ | ||
| + | |||
| + | Les options de cette commande sont : | ||
| < | < | ||
| - | root@debian6:~# echo 1 > /proc/sys/net/ | + | root@debian11:~# which telnet |
| - | root@debian6:~# cat / | + | /usr/bin/telnet |
| - | 1 | + | root@debian11:~# telnet --help |
| + | telnet: invalid option -- ' | ||
| + | Usage: telnet [-4] [-6] [-8] [-E] [-L] [-a] [-d] [-e char] [-l user] | ||
| + | [-n tracefile] [ -b addr ] [-r] [host-name [port]] | ||
| </ | </ | ||
| - | Pour désactiver le routage sur le serveur, il convient de désactiver la retransmission des paquets: | + | ==== 3.2 - wget ==== |
| + | |||
| + | La commande **wget** est utilisée pour récupérer un fichier via http, https ou ftp : | ||
| < | < | ||
| - | root@debian6:~# echo 0 > /proc/sys/net/ipv4/ip_forward | + | root@debian11:~# wget https://www.dropbox.com/s/wk79lkfr6f12u9j/wget_file.txt |
| - | root@debian6:~# cat /proc/sys/net/ipv4/ip_forward | + | --2022-05-03 10: |
| + | Resolving www.dropbox.com (www.dropbox.com)... 162.125.67.18, | ||
| + | Connecting to www.dropbox.com (www.dropbox.com)|162.125.67.18|: | ||
| + | HTTP request sent, awaiting response... 301 Moved Permanently | ||
| + | Location: / | ||
| + | --2022-05-03 10: | ||
| + | Reusing existing connection to www.dropbox.com: | ||
| + | HTTP request sent, awaiting response... 302 Found | ||
| + | Location: https:// | ||
| + | --2022-05-03 10: | ||
| + | Resolving uc64dcd84ee4be2a0c2f111bd2ab.dl.dropboxusercontent.com (uc64dcd84ee4be2a0c2f111bd2ab.dl.dropboxusercontent.com)... 162.125.67.15, | ||
| + | Connecting to uc64dcd84ee4be2a0c2f111bd2ab.dl.dropboxusercontent.com (uc64dcd84ee4be2a0c2f111bd2ab.dl.dropboxusercontent.com)|162.125.67.15|: | ||
| + | HTTP request sent, awaiting response... 200 OK | ||
| + | Length: 46 [text/ | ||
| + | Saving to: ‘wget_file.txt’ | ||
| + | |||
| + | wget_file.txt | ||
| + | |||
| + | 2022-05-03 10:07:51 (26.8 MB/s) - ‘wget_file.txt’ saved [46/46] | ||
| + | |||
| + | root@debian11: | ||
| + | This is a file retrieved by the wget command. | ||
| </ | </ | ||
| - | =====Configuration du Réseau sous RHEL/ | + | Les options de cette commande sont : |
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | GNU Wget 1.21, a non-interactive network retriever. | ||
| + | Usage: wget [OPTION]... [URL]... | ||
| + | |||
| + | Mandatory arguments to long options are mandatory for short options too. | ||
| + | |||
| + | Startup: | ||
| + | -V, --version | ||
| + | -h, --help | ||
| + | -b, --background | ||
| + | -e, --execute=COMMAND | ||
| + | |||
| + | Logging and input file: | ||
| + | -o, --output-file=FILE | ||
| + | -a, --append-output=FILE | ||
| + | -d, --debug | ||
| + | -q, --quiet | ||
| + | -v, --verbose | ||
| + | -nv, --no-verbose | ||
| + | | ||
| + | -i, --input-file=FILE | ||
| + | -F, --force-html | ||
| + | -B, --base=URL | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Download: | ||
| + | -t, --tries=NUMBER | ||
| + | | ||
| + | | ||
| + | -O, --output-document=FILE | ||
| + | -nc, --no-clobber | ||
| + | | ||
| + | | ||
| + | -c, --continue | ||
| + | | ||
| + | | ||
| + | | ||
| + | -N, --timestamping | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | the one on the server | ||
| + | -S, --server-response | ||
| + | | ||
| + | -T, --timeout=SECONDS | ||
| + | | ||
| + | | ||
| + | | ||
| + | -w, --wait=SECONDS | ||
| + | | ||
| + | --More-- | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | ==== 3.3 - ftp ==== | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** - Si la commande **ftp** n'est pas installée sous Debian 11, installez-le à l'aide de la commande **apt install ftp** en tant que root. | ||
| + | </ | ||
| + | |||
| + | La commande **ftp** est utilisée pour le transfert de fichiers. Une fois connecté, il convient d' | ||
| + | |||
| + | < | ||
| + | ftp> help | ||
| + | Commands may be abbreviated. | ||
| + | |||
| + | ! | ||
| + | $ | ||
| + | account | ||
| + | append | ||
| + | ascii | ||
| + | bell glob mode quote | ||
| + | binary | ||
| + | bye | ||
| + | case idle newer | ||
| + | cd image | ||
| + | cdup ipany | ||
| + | chmod | ||
| + | close | ||
| + | cr lcd | ||
| + | delete | ||
| + | debug | ||
| + | ftp> | ||
| + | </ | ||
| + | |||
| + | Le caractère **!** permet d' | ||
| + | |||
| + | < | ||
| + | ftp> !pwd | ||
| + | /root | ||
| + | </ | ||
| + | |||
| + | Pour transférer un fichier vers le serveur, il convient d' | ||
| + | |||
| + | < | ||
| + | ftp> put nom_fichier_local nom_fichier_distant | ||
| + | </ | ||
| + | |||
| + | Vous pouvez également transférer plusieurs fichiers à la fois grâce à la commande **mput**. Dans ce cas précis, il convient de saisir la commande suivante: | ||
| + | |||
| + | < | ||
| + | ftp> mput nom*.* | ||
| + | </ | ||
| + | |||
| + | Pour transférer un fichier du serveur, il convient d' | ||
| + | |||
| + | < | ||
| + | ftp> get nom_fichier | ||
| + | </ | ||
| + | |||
| + | Vous pouvez également transférer plusieurs fichiers à la fois grâce à la commande **mget** ( voir la commande **mput** ci-dessus ). | ||
| + | |||
| + | Pour supprimer un fichier sur le serveur, il convient d' | ||
| + | |||
| + | < | ||
| + | ftp> del nom_fichier | ||
| + | </ | ||
| + | |||
| + | Pour fermer la session, il convient d' | ||
| + | |||
| + | < | ||
| + | ftp> quit | ||
| + | root@debian11: | ||
| + | </ | ||
| + | |||
| + | ====3.4 - SSH==== | ||
| + | |||
| + | ===Présentation=== | ||
| + | |||
| + | La commande **[[wpfr> | ||
| + | |||
| + | * Le **serveur SSH** | ||
| + | * le démon sshd, qui s' | ||
| + | * Le **client SSH** | ||
| + | * ssh ou scp, qui assure la connexion et le dialogue avec le serveur, | ||
| + | * La **session** qui représente la connexion courante et qui commence juste après l' | ||
| + | * Les **clefs** | ||
| + | * **Couple de clef utilisateur asymétriques** et persistantes qui assurent l' | ||
| + | * **Clef hôte asymétrique et persistante** garantissant l' | ||
| + | * **Clef serveur asymétrique et temporaire** utilisée par le protocole SSH1 qui sert au chiffrement de la clé de session, | ||
| + | * **Clef de session symétrique qui est générée aléatoirement** et qui permet le chiiffrement de la communication entre le client et le serveur. Elle est détruite en fin de session. SSH-1 utilise une seule clef tandis que SSH-2 utilise une clef par direction de la communication, | ||
| + | * La **base de données des hôtes connus** qui stocke les clés des connexions précédentes. | ||
| + | |||
| + | SSH fonctionne de la manière suivante pour la la mise en place d'un canal sécurisé: | ||
| + | |||
| + | * Le client contacte le serveur sur son port 22, | ||
| + | * Les client et le serveur échangent leur version de SSH. En cas de non-compatibilité de versions, l'un des deux met fin au processus, | ||
| + | * Le serveur SSH s' | ||
| + | * Sa clé hôte, | ||
| + | * Sa clé serveur, | ||
| + | * Une séquence aléatoire de huit octets à inclure dans les futures réponses du client, | ||
| + | * Une liste de méthodes de chiffrage, compression et authentification, | ||
| + | * Le client et le serveur produisent un identifiant identique, un haché MD5 long de 128 bits contenant la clé hôte, la clé serveur et la séquence aléatoire, | ||
| + | * Le client génère sa clé de session symétrique et la chiffre deux fois de suite, une fois avec la clé hôte du serveur et la deuxième fois avec la clé serveur. Le client envoie cette clé au serveur accompagnée de la séquence aléatoire et un choix d' | ||
| + | * Le serveur déchiffre la clé de session, | ||
| + | * Le client et le serveur mettent en place le canal sécurisé. | ||
| + | |||
| + | ==SSH-1== | ||
| + | |||
| + | SSH-1 utilise une paire de clefs de type RSA1. Il assure l' | ||
| + | |||
| + | Afin de s' | ||
| + | |||
| + | * **Kerberos**, | ||
| + | * **Rhosts**, | ||
| + | * **%%RhostsRSA%%**, | ||
| + | * Par **clef asymétrique**, | ||
| + | * **TIS**, | ||
| + | * Par **mot de passe**. | ||
| + | |||
| + | ==SSH-2== | ||
| + | |||
| + | SSH-2 utilise **DSA** ou **RSA**. Il assure l' | ||
| + | |||
| + | * **SSH-TRANS** – Transport Layer Protocol, | ||
| + | * **SSH-AUTH** – Authentification Protocol, | ||
| + | * **SSH-CONN** – Connection Protocol. | ||
| + | |||
| + | SSH-2 diffère de SSH-1 essentiellement dans la phase authentification. | ||
| + | |||
| + | Trois méthodes d' | ||
| + | |||
| + | * Par **clef asymétrique**, | ||
| + | * Identique à SSH-1 sauf avec l' | ||
| + | * **%%RhostsRSA%%**, | ||
| + | * Par **mot de passe**. | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | unknown option -- - | ||
| + | usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface] | ||
| + | [-b bind_address] [-c cipher_spec] [-D [bind_address: | ||
| + | [-E log_file] [-e escape_char] [-F configfile] [-I pkcs11] | ||
| + | [-i identity_file] [-J [user@]host[: | ||
| + | [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port] | ||
| + | [-Q query_option] [-R address] [-S ctl_path] [-W host: | ||
| + | [-w local_tun[: | ||
| + | </ | ||
| + | |||
| + | ===Authentification par mot de passe=== | ||
| + | |||
| + | L' | ||
| + | |||
| + | Avantage: | ||
| + | * Aucune configuration de clef asymétrique n'est nécessaire. | ||
| + | |||
| + | Inconvénients: | ||
| + | * L' | ||
| + | * Moins sécurisé qu'un système par clef asymétrique. | ||
| + | |||
| + | ===Authentification par clef asymétrique=== | ||
| + | |||
| + | * Le **client** envoie au serveur une requête d' | ||
| + | * Le **serveur** recherche une correspondance pour ce module dans le fichier des clés autorisés **~/ | ||
| + | * Dans le cas où une correspondance n'est pas trouvée, le serveur met fin à la communication, | ||
| + | * Dans le cas contraire le serveur génère une chaîne aléatoire de 256 bits appelée un **challenge** et la chiffre avec la **clé publique du client**, | ||
| + | * Le **client** reçoit le challenge et le décrypte avec la partie privée de sa clé. Il combine le challenge avec l' | ||
| + | * Le **serveur** génère le même haché et le compare avec celui reçu du client. Si les deux hachés sont identiques, l' | ||
| + | |||
| + | ===Configuration du Serveur=== | ||
| + | |||
| + | La configuration du serveur s' | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | # | ||
| + | |||
| + | # This is the sshd server system-wide configuration file. See | ||
| + | # sshd_config(5) for more information. | ||
| + | |||
| + | # This sshd was compiled with PATH=/ | ||
| + | |||
| + | # The strategy used for options in the default sshd_config shipped with | ||
| + | # OpenSSH is to specify options with their default value where | ||
| + | # possible, but leave them commented. | ||
| + | # default value. | ||
| + | |||
| + | Include / | ||
| + | |||
| + | #Port 22 | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | #HostKey / | ||
| + | #HostKey / | ||
| + | #HostKey / | ||
| + | |||
| + | # Ciphers and keying | ||
| + | #RekeyLimit default none | ||
| + | |||
| + | # Logging | ||
| + | # | ||
| + | #LogLevel INFO | ||
| + | |||
| + | # Authentication: | ||
| + | |||
| + | # | ||
| + | PermitRootLogin yes | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # | ||
| + | |||
| + | # Expect .ssh/ | ||
| + | # | ||
| + | |||
| + | # | ||
| + | |||
| + | # | ||
| + | # | ||
| + | |||
| + | # For this to work you will also need host keys in / | ||
| + | # | ||
| + | # Change to yes if you don't trust ~/ | ||
| + | # HostbasedAuthentication | ||
| + | # | ||
| + | # Don't read the user's ~/.rhosts and ~/.shosts files | ||
| + | # | ||
| + | |||
| + | # To disable tunneled clear text passwords, change to no here! | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Change to yes to enable challenge-response passwords (beware issues with | ||
| + | # some PAM modules and threads) | ||
| + | ChallengeResponseAuthentication no | ||
| + | |||
| + | # Kerberos options | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # GSSAPI options | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Set this to ' | ||
| + | # and session processing. If this is enabled, PAM authentication will | ||
| + | # be allowed through the ChallengeResponseAuthentication and | ||
| + | # PasswordAuthentication. | ||
| + | # PAM authentication via ChallengeResponseAuthentication may bypass | ||
| + | # the setting of " | ||
| + | # If you just want the PAM account and session checks to run without | ||
| + | # PAM authentication, | ||
| + | # and ChallengeResponseAuthentication to ' | ||
| + | UsePAM yes | ||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | X11Forwarding yes | ||
| + | # | ||
| + | # | ||
| + | #PermitTTY yes | ||
| + | PrintMotd no | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #UseDNS no | ||
| + | #PidFile / | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # no default banner path | ||
| + | #Banner none | ||
| + | |||
| + | # Allow client to pass locale environment variables | ||
| + | AcceptEnv LANG LC_* | ||
| + | |||
| + | # override default of no subsystems | ||
| + | Subsystem | ||
| + | |||
| + | # Example of overriding settings on a per-user basis | ||
| + | #Match User anoncvs | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | </ | ||
| + | |||
| + | Pour ôter les lignes de commentaires dans ce fichier, utilisez la commande suivante : | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | root@debian11:/ | ||
| + | Include / | ||
| + | PermitRootLogin yes | ||
| + | ChallengeResponseAuthentication no | ||
| + | UsePAM yes | ||
| + | X11Forwarding yes | ||
| + | PrintMotd no | ||
| + | AcceptEnv LANG LC_* | ||
| + | Subsystem | ||
| + | </ | ||
| + | |||
| + | Pour sécuriser le serveur ssh, ajoutez ou modifiez les directives suivantes : | ||
| + | |||
| + | < | ||
| + | AllowGroups adm | ||
| + | Banner / | ||
| + | HostbasedAuthentication no | ||
| + | IgnoreRhosts yes | ||
| + | LoginGraceTime 60 | ||
| + | LogLevel INFO | ||
| + | PermitEmptyPasswords no | ||
| + | PermitRootLogin no | ||
| + | PrintLastLog yes | ||
| + | Protocol 2 | ||
| + | StrictModes yes | ||
| + | X11Forwarding no | ||
| + | </ | ||
| + | |||
| + | Votre fichier ressemblera à celui-ci : | ||
| + | |||
| + | < | ||
| + | root@debian11:/ | ||
| + | root@debian11:/ | ||
| + | AllowGroups adm | ||
| + | Banner / | ||
| + | HostbasedAuthentication no | ||
| + | IgnoreRhosts yes | ||
| + | LoginGraceTime 60 | ||
| + | LogLevel INFO | ||
| + | PermitEmptyPasswords no | ||
| + | PermitRootLogin no | ||
| + | PrintLastLog yes | ||
| + | Protocol 2 | ||
| + | StrictModes yes | ||
| + | X11Forwarding no | ||
| + | Include / | ||
| + | ChallengeResponseAuthentication no | ||
| + | UsePAM yes | ||
| + | PrintMotd no | ||
| + | AcceptEnv LANG LC_* | ||
| + | Subsystem | ||
| + | </ | ||
| + | |||
| + | Renommez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos11 tmp]# cp / | ||
| + | </ | ||
| + | |||
| + | Copiez le fichier **/ | ||
| + | |||
| + | < | ||
| + | root@debian11:/ | ||
| + | </ | ||
| + | |||
| + | Redémarrez le service sshd : | ||
| + | |||
| + | < | ||
| + | root@debian11:/ | ||
| + | root@debian11:/ | ||
| + | ● ssh.service - OpenBSD Secure Shell server | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | | ||
| + | Process: 4885 ExecStartPre=/ | ||
| + | Main PID: 4888 (sshd) | ||
| + | Tasks: 1 (limit: 4632) | ||
| + | | ||
| + | CPU: 24ms | ||
| + | | ||
| + | | ||
| + | |||
| + | May 03 11:01:24 debian11.ittraining.loc sshd[4888]: Server listening on 0.0.0.0 port > | ||
| + | May 03 11:01:24 debian11.ittraining.loc systemd[1]: Stopping OpenBSD Secure Shell ser> | ||
| + | May 03 11:01:24 debian11.ittraining.loc sshd[4888]: Server listening on :: port 22. | ||
| + | May 03 11:01:24 debian11.ittraining.loc systemd[1]: ssh.service: | ||
| + | May 03 11:01:24 debian11.ittraining.loc systemd[1]: Stopped OpenBSD Secure Shell serv> | ||
| + | May 03 11:01:24 debian11.ittraining.loc systemd[1]: Starting OpenBSD Secure Shell ser> | ||
| + | May 03 11:01:24 debian11.ittraining.loc systemd[1]: Started OpenBSD Secure Shell serv> | ||
| + | lines 1-20/20 (END) | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | Mettez l' | ||
| + | |||
| + | < | ||
| + | root@debian11:/ | ||
| + | trainee : trainee cdrom floppy audio dip src video plugdev netdev lpadmin scanner | ||
| + | root@debian11:/ | ||
| + | root@debian11:/ | ||
| + | trainee : trainee adm cdrom floppy audio dip src video plugdev netdev lpadmin scanner | ||
| + | </ | ||
| + | |||
| + | Pour générer les clefs du serveur, saisissez la commande suivante en tant que **root**. Notez que la passphrase doit être **vide**. | ||
| + | |||
| + | < | ||
| + | root@debian11:/ | ||
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | SHA256: | ||
| + | The key's randomart image is: | ||
| + | +---[DSA 1024]----+ | ||
| + | | | ||
| + | | | ||
| + | | ..=..o . o.| | ||
| + | | o+ =. . o..| | ||
| + | | | ||
| + | | ==+=o . | | ||
| + | | o *==o.. . | | ||
| + | | . ooo=o. o | | ||
| + | | .o +o... | | ||
| + | +----[SHA256]-----+ | ||
| + | root@debian11:/ | ||
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | / | ||
| + | Overwrite (y/n)? y | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | SHA256: | ||
| + | The key's randomart image is: | ||
| + | +---[RSA 3072]----+ | ||
| + | | =+=+++oo | ||
| + | | . *o+.o. . | | ||
| + | | . + = o. ..| | ||
| + | | o + *.o...| | ||
| + | | S * =..+o| | ||
| + | | . * + .+.o| | ||
| + | | . * + o E | | ||
| + | | = o o | | ||
| + | | ... | | ||
| + | +----[SHA256]-----+ | ||
| + | root@debian11:/ | ||
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | / | ||
| + | Overwrite (y/n)? y | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | SHA256: | ||
| + | The key's randomart image is: | ||
| + | +---[ECDSA 256]---+ | ||
| + | | .o..o . ooo. | | ||
| + | | . o. . o = + ...| | ||
| + | |. . . + + o.| | ||
| + | |... | ||
| + | |.o . S . . | | ||
| + | |. o + . = .. | | ||
| + | | | ||
| + | | = . . *B+.| | ||
| + | |E... . o** | | ||
| + | +----[SHA256]-----+ | ||
| + | root@debian11:/ | ||
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | / | ||
| + | Overwrite (y/n)? y | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | SHA256: | ||
| + | The key's randomart image is: | ||
| + | +--[ED25519 256]--+ | ||
| + | |..+. .+*o.+oo | ||
| + | |++ . . oo.o.+ o .| | ||
| + | |o. o + o o + | | ||
| + | | .. .. B . o .| | ||
| + | | | ||
| + | | ..oo =.=. | | ||
| + | | .. o +..+ | | ||
| + | | . .o . | | ||
| + | | .o. | | ||
| + | +----[SHA256]-----+ | ||
| + | </ | ||
| + | |||
| + | Les clefs publiques générées possèdent l' | ||
| + | |||
| + | < | ||
| + | root@debian11:/ | ||
| + | moduli | ||
| + | ssh_config | ||
| + | ssh_config.d | ||
| + | sshd_config | ||
| + | </ | ||
| + | |||
| + | Re-démarrez ensuite le service sshd : | ||
| + | |||
| + | < | ||
| + | root@debian11:/ | ||
| + | root@debian11:/ | ||
| + | ● ssh.service - OpenBSD Secure Shell server | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | | ||
| + | Process: 4942 ExecStartPre=/ | ||
| + | Main PID: 4943 (sshd) | ||
| + | Tasks: 1 (limit: 4632) | ||
| + | | ||
| + | CPU: 24ms | ||
| + | | ||
| + | | ||
| + | |||
| + | May 03 11:30:09 debian11.ittraining.loc systemd[1]: Starting OpenBSD Secure Shell ser> | ||
| + | May 03 11:30:09 debian11.ittraining.loc sshd[4943]: Server listening on 0.0.0.0 port > | ||
| + | May 03 11:30:09 debian11.ittraining.loc sshd[4943]: Server listening on :: port 22. | ||
| + | May 03 11:30:09 debian11.ittraining.loc systemd[1]: Started OpenBSD Secure Shell serv> | ||
| + | lines 1-17/17 (END) | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | ===Configuration du Client=== | ||
| + | |||
| + | Saisissez maintenant les commandes suivantes en tant que **trainee** : | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** - Lors de la génération des clefs, la passphrase doit être **vide**. | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | root@debian11:/ | ||
| + | logout | ||
| + | trainee@debian11: | ||
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | Created directory '/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | SHA256: | ||
| + | The key's randomart image is: | ||
| + | +---[DSA 1024]----+ | ||
| + | | | ||
| + | | .+oo.B*o+ | ||
| + | | . . +=.=+o | | ||
| + | | . . o o +=.| | ||
| + | | . . S+ ..o= .| | ||
| + | | . o. o .+ ..| | ||
| + | | . . ...| | ||
| + | | . .E .| | ||
| + | | | ||
| + | +----[SHA256]-----+ | ||
| + | trainee@debian11: | ||
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | SHA256: | ||
| + | The key's randomart image is: | ||
| + | +---[RSA 3072]----+ | ||
| + | | | ||
| + | | = .. = + | | ||
| + | | | ||
| + | | E o X . | | ||
| + | | | ||
| + | | | ||
| + | | . | ||
| + | | + + + .oo*=| | ||
| + | | =.= .. .XXB| | ||
| + | +----[SHA256]-----+ | ||
| + | trainee@debian11: | ||
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | SHA256: | ||
| + | The key's randomart image is: | ||
| + | +---[ECDSA 256]---+ | ||
| + | |..o+=o. | ||
| + | |. +.. o . | | ||
| + | | .. = o + | | ||
| + | | .= + + o | | ||
| + | | ..B | ||
| + | | | ||
| + | | oB.B | | ||
| + | |o++@ . | | ||
| + | |X+EoB. | ||
| + | +----[SHA256]-----+ | ||
| + | trainee@debian11: | ||
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | SHA256: | ||
| + | The key's randomart image is: | ||
| + | +--[ED25519 256]--+ | ||
| + | | | | ||
| + | | . . | | ||
| + | | o + | | ||
| + | | .* = | ||
| + | | | ||
| + | | . ++oOE+ * * | | ||
| + | | . +* =.= O .| | ||
| + | | | ||
| + | | | ||
| + | +----[SHA256]-----+ | ||
| + | </ | ||
| + | |||
| + | Les clés générées seront placées dans le répertoire **~/.ssh/** : | ||
| + | |||
| + | < | ||
| + | trainee@debian11: | ||
| + | id_dsa | ||
| + | id_dsa.pub | ||
| + | </ | ||
| + | |||
| + | ===Tunnels SSH=== | ||
| + | |||
| + | Le protocole SSH peut être utilisé pour sécuriser les protocoles tels telnet, pop3 etc.. En effet, on peut créer un //tunnel// SSH dans lequel passe les communications du protocole non-sécurisé. | ||
| + | |||
| + | La commande pour créer un tunnel ssh prend la forme suivante : | ||
| + | |||
| + | ssh -N -f compte@hôte -Lport-local: | ||
| + | |||
| + | Dans votre cas, vous allez créer un tunnel dans votre propre VM entre le port 15023 et le port 23 : | ||
| + | |||
| + | < | ||
| + | trainee@debian11: | ||
| + | Password: fenestros | ||
| + | root@debian11: | ||
| + | The authenticity of host ' | ||
| + | ECDSA key fingerprint is SHA256: | ||
| + | Are you sure you want to continue connecting (yes/ | ||
| + | Warning: Permanently added ' | ||
| + | Debian GNU/Linux 11 | ||
| + | trainee@localhost' | ||
| + | </ | ||
| + | |||
| + | Installez maintenant le serveur telnet : | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | </ | ||
| + | |||
| + | Vérifiez que le service **inetd** est démarré : | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | ● inetd.service - Internet superserver | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Main PID: 5110 (inetd) | ||
| + | Tasks: 1 (limit: 4632) | ||
| + | | ||
| + | CPU: 7ms | ||
| + | | ||
| + | | ||
| + | |||
| + | May 03 11:55:27 debian11.ittraining.loc systemd[1]: Starting Internet superserver... | ||
| + | May 03 11:55:27 debian11.ittraining.loc systemd[1]: Started Internet superserver. | ||
| + | </ | ||
| + | |||
| + | Connectez-vous ensuite via telnet sur le port 15023, vous constaterez que votre connexion n' | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | Trying ::1... | ||
| + | Connected to localhost. | ||
| + | Escape character is ' | ||
| + | Debian GNU/Linux 11 | ||
| + | debian11.ittraining.loc login: trainee | ||
| + | Password: trainee | ||
| + | Linux debian11.ittraining.loc 5.17.0-1-amd64 #1 SMP PREEMPT Debian 5.17.3-1 (2022-04-18) x86_64 | ||
| + | |||
| + | The programs included with the Debian GNU/Linux system are free software; | ||
| + | the exact distribution terms for each program are described in the | ||
| + | individual files in / | ||
| + | |||
| + | Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent | ||
| + | permitted by applicable law. | ||
| + | Last login: Tue May 3 08:57:59 CEST 2022 from 10.0.2.1 on pts/0 | ||
| + | |||
| + | trainee@debian11: | ||
| + | trainee | ||
| + | |||
| + | trainee@debian11: | ||
| + | / | ||
| + | |||
| + | trainee@debian11: | ||
| + | logout | ||
| + | Connection closed by foreign host. | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** - Notez bien que votre communication telnet passe par le tunnel SSH. | ||
| + | </ | ||
| + | |||
| + | ====3.5 - SCP==== | ||
| + | |||
| + | ===Présentation=== | ||
| + | |||
| + | La commande **scp** est le successeur et la remplaçante de la commande **rcp** de la famille des commandes **remote**. Il permet de faire des transferts sécurisés à partir d'une machine distante : | ||
| + | |||
| + | $ scp compte@numero_ip(nom_de_machine):/ | ||
| + | |||
| + | ou vers une machine distante : | ||
| + | |||
| + | $ scp / | ||
| + | |||
| + | ===Utilisation=== | ||
| + | |||
| + | Nous allons maintenant utiliser **scp** pour chercher un fichier sur le << | ||
| + | |||
| + | Créez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [trainee@centos8 ~]$ touch scp-test | ||
| + | [trainee@centos8 ~]$ exit | ||
| + | logout | ||
| + | Connection closed by foreign host. | ||
| + | [root@centos8 ~]# | ||
| + | </ | ||
| + | |||
| + | Récupérez le fichier **scp_test** en utilisant scp : | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# scp trainee@127.0.0.1:/ | ||
| + | The authenticity of host ' | ||
| + | ECDSA key fingerprint is SHA256: | ||
| + | Are you sure you want to continue connecting (yes/ | ||
| + | Warning: Permanently added ' | ||
| + | \S | ||
| + | Kernel \r on an \m | ||
| + | trainee@127.0.0.1' | ||
| + | scp-test | ||
| + | |||
| + | [root@centos8 ~]# ls -l | ||
| + | total 32 | ||
| + | -rw-------. 1 root root 1358 Jun 16 06:40 anaconda-ks.cfg | ||
| + | drwxr-xr-x. 3 root root 21 Jun 16 06:39 home | ||
| + | -rw-r--r--. 1 root root 1749 Aug 24 11:20 I2TCH.asc | ||
| + | -rw-r--r--. 1 root root 1853 Jun 16 06:54 initial-setup-ks.cfg | ||
| + | -rw-r--r--. 1 root root 31 Aug 24 11:22 message.txt | ||
| + | -rw-r--r--. 1 root root 561 Aug 24 11:32 message.txt.asc | ||
| + | -rw-r--r--. 1 root root 367 Aug 24 11:30 message.txt.gpg | ||
| + | -rw-r--r--. 1 root root 329 Aug 24 11:23 message.txt.sig | ||
| + | -rw-r--r--. 1 root root 0 Aug 30 03:55 scp-test | ||
| + | -rw-r--r--. 1 root root 46 Aug 29 06:22 wget_file.txt | ||
| + | </ | ||
| + | |||
| + | ====3.6 - Mise en Place des Clefs Asymétriques==== | ||
| + | |||
| + | Il convient maintenant de se connecter sur le << | ||
| + | |||
| + | < | ||
| + | [root@centos8 ~]# ssh -l trainee 127.0.0.1 | ||
| + | \S | ||
| + | Kernel \r on an \m | ||
| + | trainee@127.0.0.1' | ||
| + | Activate the web console with: systemctl enable --now cockpit.socket | ||
| + | |||
| + | [trainee@centos8 ~]$ ls -la | grep .ssh | ||
| + | drwx------. | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** - Si le dossier distant .ssh n' | ||
| + | </ | ||
| + | |||
| + | Ensuite, il convient de transférer le fichier local **.ssh/ | ||
| + | |||
| + | < | ||
| + | [trainee@centos8 ~]$ exit | ||
| + | logout | ||
| + | Connection to 127.0.0.1 closed. | ||
| + | |||
| + | [root@centos8 ~]# exit | ||
| + | logout | ||
| + | |||
| + | [trainee@centos8 ~]$ scp .ssh/ | ||
| + | The authenticity of host ' | ||
| + | ECDSA key fingerprint is SHA256: | ||
| + | Are you sure you want to continue connecting (yes/ | ||
| + | Warning: Permanently added ' | ||
| + | \S | ||
| + | Kernel \r on an \m | ||
| + | trainee@127.0.0.1' | ||
| + | id_ecdsa.pub | ||
| + | </ | ||
| + | |||
| + | Connectez-vous via telnet : | ||
| + | |||
| + | < | ||
| + | [trainee@centos8 ~]$ ssh -l trainee localhost | ||
| + | The authenticity of host ' | ||
| + | ECDSA key fingerprint is SHA256: | ||
| + | Are you sure you want to continue connecting (yes/ | ||
| + | Warning: Permanently added ' | ||
| + | \S | ||
| + | Kernel \r on an \m | ||
| + | Activate the web console with: systemctl enable --now cockpit.socket | ||
| + | |||
| + | Last login: Mon Aug 30 03:57:14 2021 from 127.0.0.1 | ||
| + | [trainee@centos8 ~]$ | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** - Lors de la connexion au serveur, l' | ||
| + | </ | ||
| + | |||
| + | Insérez maintenant les clefs publiques restantes dans le fichier .ssh/ | ||
| + | |||
| + | < | ||
| + | [trainee@centos8 ~]$ cd .ssh | ||
| + | [trainee@centos8 .ssh]$ ls | ||
| + | authorized_keys | ||
| + | [trainee@centos8 .ssh]$ cat authorized_keys | ||
| + | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHDrzSXP+Ecxf/ | ||
| + | |||
| + | [trainee@centos8 .ssh]$ cat id_rsa.pub >> authorized_keys | ||
| + | [trainee@centos8 .ssh]$ cat id_dsa.pub >> authorized_keys | ||
| + | [trainee@centos8 .ssh]$ cat id_ed25519.pub >> authorized_keys | ||
| + | |||
| + | [trainee@centos8 .ssh]$ cat authorized_keys | ||
| + | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHDrzSXP+Ecxf/ | ||
| + | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD3ZSMn/ | ||
| + | ssh-dss AAAAB3NzaC1kc3MAAACBALIdwEEqHrMWSUdzARm9ldsZK9ebbtZShtmwgdjphOk77fxymK0y6wV7QEmLL25LOcLb12uZ1F0LtRt/ | ||
| + | ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfFQULLU8IZyKiSU63D2Zz6yGLqyHcBHnCRdSR9JSmc trainee@centos8.ittraining.loc | ||
| + | </ | ||
| + | |||
| + | ====3.7 - Services réseaux ==== | ||
| + | |||
| + | Quand un client émet une demande de connexion vers une application réseau sur un serveur, il utilise un socket attaché à un port local **supérieur à 1023**, alloué d'une manière dynamique. La requête contient le port de destination sur le serveur. Certaines applications serveurs se gèrent toutes seules, ce qui est la cas par exemple d' | ||
| + | |||
| + | === inetd === | ||
| + | |||
| + | Le programme inetd est configuré via le fichier **/ | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | # / | ||
| + | # | ||
| + | # Internet superserver configuration database | ||
| + | # | ||
| + | # | ||
| + | # Lines starting with "#: | ||
| + | # be changed unless you know what you are doing! | ||
| + | # | ||
| + | # If you want to disable an entry so it isn't touched during | ||
| + | # package updates just comment it out with a single '#' | ||
| + | # | ||
| + | # Packages should modify this file by using update-inetd(8) | ||
| + | # | ||
| + | # < | ||
| + | # | ||
| + | #:INTERNAL: Internal services | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #time | ||
| + | |||
| + | #:STANDARD: These are standard services. | ||
| + | telnet | ||
| + | |||
| + | #:BSD: Shell, login, exec and talk are BSD protocols. | ||
| + | |||
| + | #:MAIL: Mail, news and uucp services. | ||
| + | |||
| + | #:INFO: Info services | ||
| + | |||
| + | #:BOOT: TFTP service is provided primarily for booting. | ||
| + | # run this only on machines acting as "boot servers." | ||
| + | |||
| + | #:RPC: RPC based services | ||
| + | |||
| + | #: | ||
| + | |||
| + | #:OTHER: Other services | ||
| + | </ | ||
| + | |||
| + | Les lignes de configuration des serveurs ressemblent à : | ||
| + | |||
| + | < | ||
| + | telnet | ||
| + | </ | ||
| + | |||
| + | Le premier champs de la ligne identifie le nom du port qui identifie l' | ||
| + | |||
| + | Le deuxième et le troisième champs définissent le type de protocole, à savoir: | ||
| + | |||
| + | * stream tcp pour le tcp | ||
| + | * dgram udp pour l' | ||
| + | |||
| + | Le quatrième champs prend un de deux valeurs: | ||
| + | |||
| + | * nowait | ||
| + | * indique qu'il y aura un serveur par client | ||
| + | * wait | ||
| + | * indique qu'il y aura un seul serveur pour l' | ||
| + | |||
| + | Le cinquième champs indique l' | ||
| + | |||
| + | Le sixième champs indique l' | ||
| + | |||
| + | Le septième champs indique les arguments de l' | ||
| + | |||
| + | == TCP Wrapper == | ||
| + | |||
| + | Lors de l' | ||
| + | |||
| + | < | ||
| + | telnet | ||
| + | </ | ||
| + | |||
| + | Quand une requête arrive pour le serveur telnet, inetd active le wrapper **tcpd** au lieu d' | ||
| + | |||
| + | **tcpd** met à jour un journal et vérifie si le client a le droit d' | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | # / | ||
| + | # See the manual pages hosts_access(5) and hosts_options(5). | ||
| + | # | ||
| + | # Example: | ||
| + | # ALL: .foobar.edu EXCEPT terminalserver.foobar.edu | ||
| + | # | ||
| + | # If you're going to protect the portmapper use the name " | ||
| + | # daemon name. See rpcbind(8) and rpc.mountd(8) for further information. | ||
| + | # | ||
| + | |||
| + | root@debian11: | ||
| + | # / | ||
| + | # See the manual pages hosts_access(5) and hosts_options(5). | ||
| + | # | ||
| + | # Example: | ||
| + | # ALL EXCEPT in.fingerd: other.host.name, | ||
| + | # | ||
| + | # If you're going to protect the portmapper use the name " | ||
| + | # daemon name. See rpcbind(8) and rpc.mountd(8) for further information. | ||
| + | # | ||
| + | # The PARANOID wildcard matches any host whose name does not match its | ||
| + | # address. | ||
| + | # | ||
| + | # You may wish to enable this to ensure any programs that don' | ||
| + | # validate looked up hostnames still leave understandable logs. In past | ||
| + | # versions of Debian this has been the default. | ||
| + | # ALL: PARANOID | ||
| + | </ | ||
| + | |||
| + | Il faut noter que si ces fichiers n' | ||
| + | |||
| + | Le format d'une ligne dans un de ces deux fichiers est: | ||
| + | |||
| + | < | ||
| + | démon: liste_de_clients | ||
| + | </ | ||
| + | |||
| + | Par exemple dans le cas de notre serveur telnetd, une ligne dans le fichier **/ | ||
| + | |||
| + | < | ||
| + | in.telnetd: 192.168.1.10, | ||
| + | </ | ||
| + | |||
| + | implique que la machine dont le numéro IP est le 192.168.1.10 ainsi que les machines du domaine **fenestros.com** sont autorisées à utiliser le service. | ||
| + | |||
| + | Le mot clef **ALL** peut être utilisé pour indiquer tout. Par exemple, **ALL:ALL** dans le fichier **/ | ||
| + | |||
| + | =====Configuration du Réseau sous RHEL/CentOS 6===== | ||
| ==== Configuration de TCP/IP ==== | ==== Configuration de TCP/IP ==== | ||
| Ligne 1255: | Ligne 3037: | ||
| ;; WHEN: Mon Jan 22 18:00:27 CET 2018 | ;; WHEN: Mon Jan 22 18:00:27 CET 2018 | ||
| ;; MSG SIZE rcvd: 72 | ;; MSG SIZE rcvd: 72 | ||
| - | </ | ||
| - | |||
| - | ==== Services réseaux ==== | ||
| - | |||
| - | Quand un client émet une demande de connexion vers une application réseau sur un serveur, il utilise un socket attaché à un port local **supérieur à 1023**, alloué d'une manière dynamique. La requête contient le port de destination sur le serveur. Certaines applications serveurs se gèrent toutes seules, ce qui est la cas par exemple d' | ||
| - | |||
| - | === xinetd === | ||
| - | |||
| - | Sous RHEL/CentOS 6 xinetd n'est pas installé par défaut. Installez-le grâce à yum : | ||
| - | |||
| - | < | ||
| - | [root@centos6 ~]# yum install xinetd | ||
| - | Loaded plugins: fastestmirror, | ||
| - | Loading mirror speeds from cached hostfile | ||
| - | * base: fr2.rpmfind.net | ||
| - | * extras: fr2.rpmfind.net | ||
| - | * updates: fr2.rpmfind.net | ||
| - | Setting up Install Process | ||
| - | Resolving Dependencies | ||
| - | --> Running transaction check | ||
| - | ---> Package xinetd.i686 2: | ||
| - | --> Finished Dependency Resolution | ||
| - | |||
| - | Dependencies Resolved | ||
| - | |||
| - | ================================================================================ | ||
| - | | ||
| - | ================================================================================ | ||
| - | Installing: | ||
| - | | ||
| - | |||
| - | Transaction Summary | ||
| - | ================================================================================ | ||
| - | Install | ||
| - | Upgrade | ||
| - | |||
| - | Total download size: 121 k | ||
| - | Installed size: 258 k | ||
| - | Is this ok [y/N]: y | ||
| - | Downloading Packages: | ||
| - | xinetd-2.3.14-33.el6.i686.rpm | ||
| - | Running rpm_check_debug | ||
| - | Running Transaction Test | ||
| - | Transaction Test Succeeded | ||
| - | Running Transaction | ||
| - | Installing | ||
| - | |||
| - | Installed: | ||
| - | xinetd.i686 2: | ||
| - | |||
| - | Complete! | ||
| - | </ | ||
| - | |||
| - | Le programme xinetd est configuré via le fichier **/ | ||
| - | |||
| - | < | ||
| - | [root@centos6 ~]# cat / | ||
| - | # | ||
| - | # This is the master xinetd configuration file. Settings in the | ||
| - | # default section will be inherited by all service configurations | ||
| - | # unless explicitly overridden in the service configuration. See | ||
| - | # xinetd.conf in the man pages for a more detailed explanation of | ||
| - | # these attributes. | ||
| - | |||
| - | defaults | ||
| - | { | ||
| - | # The next two items are intended to be a quick access place to | ||
| - | # temporarily enable or disable services. | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | |||
| - | # Define general logging characteristics. | ||
| - | log_type = SYSLOG daemon info | ||
| - | log_on_failure = HOST | ||
| - | log_on_success = PID HOST DURATION EXIT | ||
| - | |||
| - | # Define access restriction defaults | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | # | ||
| - | cps = 50 10 | ||
| - | instances = 50 | ||
| - | per_source = 10 | ||
| - | |||
| - | # Address and networking defaults | ||
| - | # | ||
| - | # bind = | ||
| - | # mdns = yes | ||
| - | v6only = no | ||
| - | |||
| - | # setup environmental attributes | ||
| - | # | ||
| - | # | ||
| - | groups = yes | ||
| - | umask = 002 | ||
| - | |||
| - | # Generally, banners are not used. This sets up their global defaults | ||
| - | # | ||
| - | # banner = | ||
| - | # | ||
| - | # | ||
| - | } | ||
| - | |||
| - | includedir / | ||
| - | </ | ||
| - | |||
| - | Les valeurs des directives dans le fichier **/ | ||
| - | |||
| - | Les variables les plus importantes dans **/ | ||
| - | |||
| - | ^ Directive | ||
| - | | instances | ||
| - | | log_type | ||
| - | | log_on_succes | ||
| - | | log_on_failure | ||
| - | | cps | Indique 50 connexions par seconde avec un temps d' | ||
| - | |||
| - | Les options concernant les journaux sont : | ||
| - | |||
| - | | HOST | Journalisation de l' | ||
| - | | PID | Journalisation du PID du processus qui reçoit la demande d' | ||
| - | | DURATION | ||
| - | | EXIT | Journalisation de l' | ||
| - | |||
| - | Il est aussi possible de trouver les options suivantes pour les journaux : | ||
| - | |||
| - | | ATTEMPT | ||
| - | | USERID | ||
| - | |||
| - | Examinons maintenant le répertoire **/ | ||
| - | |||
| - | < | ||
| - | [root@centos6 ~]# ls -l / | ||
| - | total 52 | ||
| - | -rw-------. 1 root root 1157 7 déc. 22:07 chargen-dgram | ||
| - | -rw-------. 1 root root 1159 7 déc. 22:07 chargen-stream | ||
| - | -rw-r--r--. 1 root root 523 25 juin 2011 cvs | ||
| - | -rw-------. 1 root root 1157 7 déc. 22:07 daytime-dgram | ||
| - | -rw-------. 1 root root 1159 7 déc. 22:07 daytime-stream | ||
| - | -rw-------. 1 root root 1157 7 déc. 22:07 discard-dgram | ||
| - | -rw-------. 1 root root 1159 7 déc. 22:07 discard-stream | ||
| - | -rw-------. 1 root root 1148 7 déc. 22:07 echo-dgram | ||
| - | -rw-------. 1 root root 1150 7 déc. 22:07 echo-stream | ||
| - | -rw-r--r--. 1 root root 332 20 mai 2009 rsync | ||
| - | -rw-------. 1 root root 1212 7 déc. 22:07 tcpmux-server | ||
| - | -rw-------. 1 root root 1149 7 déc. 22:07 time-dgram | ||
| - | -rw-------. 1 root root 1150 7 déc. 22:07 time-stream | ||
| - | </ | ||
| - | |||
| - | A l' | ||
| - | |||
| - | < | ||
| - | [root@centos6 ~]# cat / | ||
| - | # default: off | ||
| - | # description: | ||
| - | # files. CVS stores all the versions of a file in a single \ | ||
| - | # file in a clever way that only stores the differences \ | ||
| - | # between versions. | ||
| - | service cvspserver | ||
| - | { | ||
| - | disable = yes | ||
| - | port = 2401 | ||
| - | socket_type = stream | ||
| - | protocol = tcp | ||
| - | wait = no | ||
| - | user = root | ||
| - | passenv = PATH | ||
| - | server = / | ||
| - | env = HOME=/ | ||
| - | server_args = -f --allow-root=/ | ||
| - | # bind = 127.0.0.1 | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | Les directives principales de ce fichier sont : | ||
| - | |||
| - | ^ Paramètre | ||
| - | | disable | ||
| - | | port | Le numéro de port ou, à défaut, le numéro indiqué pour le service dans le fichier / | ||
| - | | socket_type | ||
| - | | protocol | ||
| - | | wait | **no** : indique si xinetd active un serveur par client. **yes** : indique que xinetd active un seul serveur pour tous les client | | ||
| - | | user | Indique le compte sous lequel le serveur est exécuté | | ||
| - | | server | ||
| - | | env | Définit un environnement système | | ||
| - | | server_args | ||
| - | |||
| - | Cependant il est aussi possible d' | ||
| - | |||
| - | ^ Paramètre | ||
| - | | nice | Fixe le niveau de nice entre -19 et +20 | 10 | | ||
| - | | max_load | ||
| - | | bind | Limite le service à l' | ||
| - | | only_from | ||
| - | | no_access | ||
| - | | access_time | ||
| - | | redirect | ||
| - | |||
| - | Afin d' | ||
| - | |||
| - | === TCP Wrapper === | ||
| - | |||
| - | **TCP Wrapper** contrôle l' | ||
| - | |||
| - | Quand une requête arrive pour un serveur, xinetd active le wrapper **tcpd** au lieu d' | ||
| - | |||
| - | **tcpd** met à jour un journal et vérifie si le client a le droit d' | ||
| - | |||
| - | * **/ | ||
| - | * **/ | ||
| - | |||
| - | Il faut noter que si ces fichiers n' | ||
| - | |||
| - | Le format d'une ligne dans un de ces deux fichiers est: | ||
| - | |||
| - | < | ||
| - | démon : liste_de_clients | ||
| - | </ | ||
| - | |||
| - | Par exemple dans le cas d'un serveur **démon**, on verrait une ligne dans le fichier **/ | ||
| - | |||
| - | < | ||
| - | démon : LOCAL, .fenestros.loc | ||
| - | </ | ||
| - | |||
| - | ce qui implique que les machines dont le nom ne comporte pas de point ainsi que les machines du domaine **fenestros.loc** sont autorisées à utiliser le service. | ||
| - | |||
| - | Le mot clef **ALL** peut être utilisé pour indiquer tout. Par exemple, **ALL:ALL** dans le fichier **/ | ||
| - | |||
| - | ====Routage Statique==== | ||
| - | |||
| - | ===La Commande route=== | ||
| - | |||
| - | Pour afficher la table de routage de la machine vous pouvez utiliser la commande **route** : | ||
| - | |||
| - | < | ||
| - | [root@centos6 ~]# route | ||
| - | Table de routage IP du noyau | ||
| - | Destination | ||
| - | 192.168.1.0 | ||
| - | 10.0.2.0 | ||
| - | link-local | ||
| - | default | ||
| - | </ | ||
| - | |||
| - | La table issue de la commande **route** indique les informations suivantes: | ||
| - | |||
| - | * La destination qui peut être un hôte ou un réseau et est identifiée par les champs **Destination** et **Genmask** | ||
| - | * La route à prendre identifiée par les champs **Gateway** et **Iface**. Dans le cas d'une valeur de 0.0.0.0 ceci spécifie une route directe. La valeur d' | ||
| - | * Le champ **Indic** qui peux prendre un ou plusieurs de svaleurs suivantes: | ||
| - | * U - **Up** - la route est active | ||
| - | * H - **Host** - la route conduit à un hôte | ||
| - | * G - **Gateways** - la route passe par une passerelle | ||
| - | * Le champ **Metric** indique le nombre de sauts (passerelles) pour atteindre la destination, | ||
| - | * Le champ **Ref** indique le nombre de références à cette route. Ce champs est usilisé par le Noyau de Linux, | ||
| - | * Le champ **Use** indique le nombre de recherches associés à cette route. | ||
| - | |||
| - | La commande **route** permet aussi de paramétrer le routage indirect. Par exemple pour supprimer la route vers le réseau 192.168.1.0 : | ||
| - | |||
| - | < | ||
| - | [root@centos6 ~]# route del -net 192.168.1.0 netmask 255.255.255.0 | ||
| - | [root@centos6 ~]# route | ||
| - | Table de routage IP du noyau | ||
| - | Destination | ||
| - | 10.0.2.0 | ||
| - | link-local | ||
| - | default | ||
| - | </ | ||
| - | |||
| - | Pour ajouter la route vers le réseau 192.168.1.0 : | ||
| - | |||
| - | < | ||
| - | [root@centos6 ~]# route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.2 | ||
| - | [root@centos6 ~]# route | ||
| - | Table de routage IP du noyau | ||
| - | Destination | ||
| - | 192.168.1.0 | ||
| - | 10.0.2.0 | ||
| - | link-local | ||
| - | default | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important> | ||
| - | La commande utilisée pour ajouter une passerelle par défaut prend la forme suivante **route add default gw // | ||
| - | </ | ||
| - | |||
| - | Les options cette commande sont : | ||
| - | |||
| - | < | ||
| - | [root@centos6 ~]# route --help | ||
| - | Syntaxe: route [-nNvee] [-FC] [< | ||
| - | route [-v] [-FC] {add|del|flush} ... Modifie la table de routage pour AF. | ||
| - | |||
| - | route {-h|--help} [< | ||
| - | route {-V|--version} | ||
| - | |||
| - | -v, --verbose | ||
| - | -n, --numeric | ||
| - | -e, --extend | ||
| - | -F, --fib display Forwarding Information Base (default) | ||
| - | -C, --cache | ||
| - | |||
| - | < | ||
| - | Liste les familles d' | ||
| - | inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25) | ||
| - | netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP) | ||
| - | x25 (CCITT X.25) | ||
| - | </ | ||
| - | |||
| - | Vous pouvez aussi utiliser la commande **netstat** pour afficher la table de routage de la machine : | ||
| - | |||
| - | < | ||
| - | [root@centos6 ~]# netstat -nr | ||
| - | Table de routage IP du noyau | ||
| - | Destination | ||
| - | 192.168.1.0 | ||
| - | 192.168.1.0 | ||
| - | 10.0.2.0 | ||
| - | 0.0.0.0 | ||
| - | </ | ||
| - | |||
| - | La table issue de la commande **netstat -nr** indique les informations suivantes: | ||
| - | |||
| - | * La champ **MSS** indique la taille maximale des segments TCP sur la route, | ||
| - | * Le champ **Window** indique la taille de la fenêtre sur cette route, | ||
| - | * Le champ **irrt** indique le paramètre IRRT pour la route. | ||
| - | |||
| - | ===Activer/ | ||
| - | |||
| - | Pour activer le routage sur le serveur, il convient d' | ||
| - | |||
| - | < | ||
| - | [root@centos6 ~]# echo 1 > / | ||
| - | [root@centos6 ~]# cat / | ||
| - | 1 | ||
| - | </ | ||
| - | |||
| - | Pour désactiver le routage sur le serveur, il convient de désactiver la retransmission des paquets: | ||
| - | |||
| - | < | ||
| - | [root@centos6 ~]# echo 0 > / | ||
| - | [root@centos6 ~]# cat / | ||
| - | 0 | ||
| - | </ | ||
| - | |||
| - | =====Configuration du Réseau sous Debian 8===== | ||
| - | |||
| - | Debian 8 utilise exclusivement **Network Manager** pour gérer le réseau. Network Manager est composé de deux éléments : | ||
| - | |||
| - | * un service qui gère les connexions réseaux et rapporte leurs états, | ||
| - | * des front-ends qui passent par un API de configuration du service. | ||
| - | |||
| - | <WRAP center round important> | ||
| - | **Important** : Notez qu' | ||
| - | </ | ||
| - | |||
| - | Le service NetworkManager doit toujours être lancé : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | ● NetworkManager.service - Network Manager | ||
| - | | ||
| - | | ||
| - | Main PID: 510 (NetworkManager) | ||
| - | | ||
| - | | ||
| - | | ||
| - | |||
| - | Nov 03 09:10:12 debian8 NetworkManager[510]: | ||
| - | Nov 03 09:10:12 debian8 NetworkManager[510]: | ||
| - | Nov 03 09:10:12 debian8 NetworkManager[510]: | ||
| - | Nov 03 09:10:12 debian8 NetworkManager[510]: | ||
| - | Nov 03 09:10:12 debian8 NetworkManager[510]: | ||
| - | Nov 03 09:10:12 debian8 NetworkManager[510]: | ||
| - | Nov 03 09:10:12 debian8 dhclient[1715]: | ||
| - | Nov 03 09:10:12 debian8 NetworkManager[510]: | ||
| - | Nov 03 09:10:12 debian8 NetworkManager[510]: | ||
| - | Nov 03 09:10:12 debian8 NetworkManager[510]: | ||
| - | </ | ||
| - | |||
| - | ====La Commande nmcli==== | ||
| - | |||
| - | La commande **nmcli** (Network Manager Command Line Interface) est utilisée pour configurer NetworkManager. | ||
| - | |||
| - | Les options et les sous-commandes peuvent être consultées en utilisant les commandes suivantes : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | Usage: nmcli [OPTIONS] OBJECT { COMMAND | help } | ||
| - | |||
| - | OPTIONS | ||
| - | -t[erse] | ||
| - | -p[retty] | ||
| - | -m[ode] tabular|multiline | ||
| - | -f[ields] < | ||
| - | -e[scape] yes|no | ||
| - | -n[ocheck] | ||
| - | -a[sk] | ||
| - | -w[ait] < | ||
| - | -v[ersion] | ||
| - | -h[elp] | ||
| - | |||
| - | OBJECT | ||
| - | g[eneral] | ||
| - | n[etworking] | ||
| - | r[adio] | ||
| - | c[onnection] | ||
| - | d[evice] | ||
| - | |||
| - | root@debian8: | ||
| - | Usage: nmcli general { COMMAND | help } | ||
| - | |||
| - | COMMAND := { status | hostname | permissions | logging } | ||
| - | |||
| - | status | ||
| - | |||
| - | hostname [< | ||
| - | |||
| - | permissions | ||
| - | |||
| - | logging [level <log level>] [domains <log domains> | ||
| - | |||
| - | root@debian8: | ||
| - | Usage: nmcli general status { help } | ||
| - | |||
| - | Show overall status of NetworkManager. | ||
| - | ' | ||
| - | </ | ||
| - | |||
| - | ====Connections et Profils==== | ||
| - | |||
| - | NetworkManager inclus la notion de **connections** ou **profils** permettant des configurations différentes en fonction de la localisation. Pour voir les connections actuelles, utilisez la commande **nmcli c** avec la sous-commande **show** : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | NAME UUID TYPE DEVICE | ||
| - | Wired connection 1 0caa0d4f-0222-415a-8a4f-753ca284911e | ||
| - | </ | ||
| - | |||
| - | Comme on peut constater ici, il n' | ||
| - | |||
| - | Si vous constatez que vous n'avez pas de profil dans la sortie de la commande **nmcli c show**, ceci indique que NetworkManager ne gère pas la carte : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | NAME | ||
| - | </ | ||
| - | |||
| - | Dans ce cas, le fichier **/ | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | # This file describes the network interfaces available on your system | ||
| - | # and how to activate them. For more information, | ||
| - | |||
| - | source / | ||
| - | |||
| - | # The loopback network interface | ||
| - | auto lo | ||
| - | iface lo inet loopback | ||
| - | |||
| - | # The primary network interface | ||
| - | allow-hotplug eth0 | ||
| - | iface eth0 inet dhcp | ||
| - | </ | ||
| - | |||
| - | Afin de permettre NetworkManager de gérer la carte malgré cette configuration, | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | [main] | ||
| - | plugins=ifupdown, | ||
| - | |||
| - | [ifupdown] | ||
| - | managed=true | ||
| - | </ | ||
| - | |||
| - | Il faut ensuite re-démarrer le service NetworkManager : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | </ | ||
| - | |||
| - | Créez maintenant un profil IP fixe rattaché au périphérique **eth0** : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | Connection ' | ||
| - | </ | ||
| - | |||
| - | Constatez sa présence : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | NAME UUID TYPE DEVICE | ||
| - | ip_fixe | ||
| - | Wired connection 1 0caa0d4f-0222-415a-8a4f-753ca284911e | ||
| - | </ | ||
| - | |||
| - | Notez que la sortie n' | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | GENERAL.DEVICE: | ||
| - | GENERAL.TYPE: | ||
| - | GENERAL.HWADDR: | ||
| - | GENERAL.MTU: | ||
| - | GENERAL.STATE: | ||
| - | GENERAL.CONNECTION: | ||
| - | GENERAL.CON-PATH: | ||
| - | WIRED-PROPERTIES.CARRIER: | ||
| - | IP4.ADDRESS[1]: | ||
| - | IP4.ROUTE[1]: | ||
| - | IP4.DNS[1]: | ||
| - | IP4.DOMAIN[1]: | ||
| - | IP6.ADDRESS[1]: | ||
| - | |||
| - | GENERAL.DEVICE: | ||
| - | GENERAL.TYPE: | ||
| - | GENERAL.HWADDR: | ||
| - | GENERAL.MTU: | ||
| - | GENERAL.STATE: | ||
| - | GENERAL.CONNECTION: | ||
| - | GENERAL.CON-PATH: | ||
| - | IP4.ADDRESS[1]: | ||
| - | IP6.ADDRESS[1]: | ||
| - | </ | ||
| - | |||
| - | Pour activer le profil ip_fixe, utilisez la commande suivante : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | Connection successfully activated (D-Bus active path: / | ||
| - | </ | ||
| - | |||
| - | Le profil ip_fixe est maintenant activé tandis que le profil Wired connection 1 a été désactivé : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | NAME UUID TYPE DEVICE | ||
| - | ip_fixe | ||
| - | Wired connection 1 0caa0d4f-0222-415a-8a4f-753ca284911e | ||
| - | | ||
| - | root@debian8: | ||
| - | GENERAL.DEVICE: | ||
| - | GENERAL.TYPE: | ||
| - | GENERAL.HWADDR: | ||
| - | GENERAL.MTU: | ||
| - | GENERAL.STATE: | ||
| - | GENERAL.CONNECTION: | ||
| - | GENERAL.CON-PATH: | ||
| - | WIRED-PROPERTIES.CARRIER: | ||
| - | IP4.ADDRESS[1]: | ||
| - | IP4.ROUTE[1]: | ||
| - | IP6.ADDRESS[1]: | ||
| - | |||
| - | GENERAL.DEVICE: | ||
| - | GENERAL.TYPE: | ||
| - | GENERAL.HWADDR: | ||
| - | GENERAL.MTU: | ||
| - | GENERAL.STATE: | ||
| - | GENERAL.CONNECTION: | ||
| - | GENERAL.CON-PATH: | ||
| - | IP4.ADDRESS[1]: | ||
| - | IP6.ADDRESS[1]: | ||
| - | </ | ||
| - | |||
| - | Pour consulter les paramètres d'un profil, utilisez la commande suivante : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | =============================================================================== | ||
| - | Connection profile details (Wired connection 1) | ||
| - | =============================================================================== | ||
| - | connection.id: | ||
| - | connection.uuid: | ||
| - | connection.interface-name: | ||
| - | connection.type: | ||
| - | connection.autoconnect: | ||
| - | connection.timestamp: | ||
| - | connection.read-only: | ||
| - | connection.permissions: | ||
| - | connection.zone: | ||
| - | connection.master: | ||
| - | connection.slave-type: | ||
| - | connection.secondaries: | ||
| - | connection.gateway-ping-timeout: | ||
| - | ------------------------------------------------------------------------------- | ||
| - | 802-3-ethernet.port: | ||
| - | 802-3-ethernet.speed: | ||
| - | 802-3-ethernet.duplex: | ||
| - | 802-3-ethernet.auto-negotiate: | ||
| - | 802-3-ethernet.mac-address: | ||
| - | 802-3-ethernet.cloned-mac-address: | ||
| - | 802-3-ethernet.mac-address-blacklist: | ||
| - | 802-3-ethernet.mtu: | ||
| - | 802-3-ethernet.s390-subchannels: | ||
| - | 802-3-ethernet.s390-nettype: | ||
| - | 802-3-ethernet.s390-options: | ||
| - | ------------------------------------------------------------------------------- | ||
| - | ipv4.method: | ||
| - | ipv4.dns: | ||
| - | ipv4.dns-search: | ||
| - | ipv4.addresses: | ||
| - | ipv4.routes: | ||
| - | ipv4.ignore-auto-routes: | ||
| - | ipv4.ignore-auto-dns: | ||
| - | ipv4.dhcp-client-id: | ||
| - | ipv4.dhcp-send-hostname: | ||
| - | ipv4.dhcp-hostname: | ||
| - | ipv4.never-default: | ||
| - | ipv4.may-fail: | ||
| - | ------------------------------------------------------------------------------- | ||
| - | ipv6.method: | ||
| - | ipv6.dns: | ||
| - | ipv6.dns-search: | ||
| - | ipv6.addresses: | ||
| - | ipv6.routes: | ||
| - | ipv6.ignore-auto-routes: | ||
| - | ipv6.ignore-auto-dns: | ||
| - | ipv6.never-default: | ||
| - | ipv6.may-fail: | ||
| - | ipv6.ip6-privacy: | ||
| - | ipv6.dhcp-hostname: | ||
| - | ------------------------------------------------------------------------------- | ||
| - | </ | ||
| - | |||
| - | Pour consulter la liste profils associés à un périphérique, | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | CONNECTIONS.AVAILABLE-CONNECTION-PATHS: | ||
| - | CONNECTIONS.AVAILABLE-CONNECTIONS[1]: | ||
| - | CONNECTIONS.AVAILABLE-CONNECTIONS[2]: | ||
| - | </ | ||
| - | |||
| - | Sous Debian 8, les fichiers de configuration pour le periphérique **eth0** se trouvent dans le répertoire **/ | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | total 8 | ||
| - | -rw------- 1 root root 207 Nov 3 12:00 ip_fixe | ||
| - | -rw------- 1 root root 170 Oct 23 16:44 Wired connection 1 | ||
| - | </ | ||
| - | |||
| - | L' | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | [connection] | ||
| - | id=ip_fixe | ||
| - | uuid=ec7e2b5f-0d19-4a40-8639-24af88a59d79 | ||
| - | interface-name=eth0 | ||
| - | type=ethernet | ||
| - | timestamp=1446548328 | ||
| - | |||
| - | [ipv6] | ||
| - | method=auto | ||
| - | |||
| - | [ipv4] | ||
| - | method=manual | ||
| - | address1=10.0.2.16/ | ||
| - | </ | ||
| - | |||
| - | La résolution des noms est donc inactive : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | ping: unknown host www.free.fr | ||
| - | </ | ||
| - | |||
| - | Modifiez donc la configuration du profil **ip_fixe** : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | </ | ||
| - | |||
| - | Sous Debian 8 l' | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | [connection] | ||
| - | id=ip_fixe | ||
| - | uuid=ec7e2b5f-0d19-4a40-8639-24af88a59d79 | ||
| - | interface-name=eth0 | ||
| - | type=ethernet | ||
| - | timestamp=1446548328 | ||
| - | |||
| - | [ipv6] | ||
| - | method=auto | ||
| - | |||
| - | [ipv4] | ||
| - | method=manual | ||
| - | dns=8.8.8.8; | ||
| - | address1=10.0.2.16/ | ||
| - | </ | ||
| - | |||
| - | Afin que la modification du serveur DNS soit prise en compte, re-démarrez le service NetworkManager : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | |||
| - | root@debian8: | ||
| - | ● NetworkManager.service - Network Manager | ||
| - | | ||
| - | | ||
| - | Main PID: 2991 (NetworkManager) | ||
| - | | ||
| - | | ||
| - | |||
| - | Nov 03 12:08:26 debian8 NetworkManager[2991]: | ||
| - | Nov 03 12:08:26 debian8 NetworkManager[2991]: | ||
| - | Nov 03 12:08:26 debian8 NetworkManager[2991]: | ||
| - | Nov 03 12:08:26 debian8 NetworkManager[2991]: | ||
| - | Nov 03 12:08:26 debian8 NetworkManager[2991]: | ||
| - | Nov 03 12:08:26 debian8 NetworkManager[2991]: | ||
| - | Nov 03 12:08:26 debian8 NetworkManager[2991]: | ||
| - | Nov 03 12:08:26 debian8 NetworkManager[2991]: | ||
| - | Nov 03 12:08:26 debian8 NetworkManager[2991]: | ||
| - | Nov 03 12:08:31 debian8 NetworkManager[2991]: | ||
| - | </ | ||
| - | |||
| - | Vérifiez que le fichier **/ | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | # Generated by NetworkManager | ||
| - | nameserver 8.8.8.8 | ||
| - | </ | ||
| - | |||
| - | Dernièrement vérifiez la resolution des noms : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | PING www.free.fr (212.27.48.10) 56(84) bytes of data. | ||
| - | 64 bytes from www.free.fr (212.27.48.10): | ||
| - | ^C | ||
| - | --- www.free.fr ping statistics --- | ||
| - | 2 packets transmitted, | ||
| - | rtt min/ | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important> | ||
| - | **Important** : Notez qu'il existe un front-end graphique en mode texte, **nmtui**, pour configurer NetworkManager. | ||
| - | </ | ||
| - | |||
| - | ====Ajouter une Deuxième Adresse IP à un Profil==== | ||
| - | |||
| - | Pour ajouter une deuxième adresse IP à un profil sous Debian 8, il convient d' | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | </ | ||
| - | |||
| - | Redémarrez la machine virtuelle puis en tant que root saisissez la commande suivante : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | connection.id: | ||
| - | connection.uuid: | ||
| - | connection.interface-name: | ||
| - | connection.type: | ||
| - | connection.autoconnect: | ||
| - | connection.timestamp: | ||
| - | connection.read-only: | ||
| - | connection.permissions: | ||
| - | connection.zone: | ||
| - | connection.master: | ||
| - | connection.slave-type: | ||
| - | connection.secondaries: | ||
| - | connection.gateway-ping-timeout: | ||
| - | 802-3-ethernet.port: | ||
| - | 802-3-ethernet.speed: | ||
| - | 802-3-ethernet.duplex: | ||
| - | 802-3-ethernet.auto-negotiate: | ||
| - | 802-3-ethernet.mac-address: | ||
| - | 802-3-ethernet.cloned-mac-address: | ||
| - | 802-3-ethernet.mac-address-blacklist: | ||
| - | 802-3-ethernet.mtu: | ||
| - | 802-3-ethernet.s390-subchannels: | ||
| - | 802-3-ethernet.s390-nettype: | ||
| - | 802-3-ethernet.s390-options: | ||
| - | ipv4.method: | ||
| - | ipv4.dns: | ||
| - | ipv4.dns-search: | ||
| - | ipv4.addresses: | ||
| - | ipv4.routes: | ||
| - | ipv4.ignore-auto-routes: | ||
| - | ipv4.ignore-auto-dns: | ||
| - | ipv4.dhcp-client-id: | ||
| - | ipv4.dhcp-send-hostname: | ||
| - | ipv4.dhcp-hostname: | ||
| - | ipv4.never-default: | ||
| - | ipv4.may-fail: | ||
| - | ipv6.method: | ||
| - | ipv6.dns: | ||
| - | ipv6.dns-search: | ||
| - | ipv6.addresses: | ||
| - | ipv6.routes: | ||
| - | ipv6.ignore-auto-routes: | ||
| - | ipv6.ignore-auto-dns: | ||
| - | ipv6.never-default: | ||
| - | ipv6.may-fail: | ||
| - | ipv6.ip6-privacy: | ||
| - | ipv6.dhcp-hostname: | ||
| - | GENERAL.NAME: | ||
| - | GENERAL.UUID: | ||
| - | GENERAL.DEVICES: | ||
| - | GENERAL.STATE: | ||
| - | GENERAL.DEFAULT: | ||
| - | GENERAL.DEFAULT6: | ||
| - | GENERAL.VPN: | ||
| - | GENERAL.ZONE: | ||
| - | GENERAL.DBUS-PATH: | ||
| - | GENERAL.CON-PATH: | ||
| - | GENERAL.SPEC-OBJECT: | ||
| - | GENERAL.MASTER-PATH: | ||
| - | IP4.ADDRESS[1]: | ||
| - | IP4.ADDRESS[2]: | ||
| - | IP4.ROUTE[1]: | ||
| - | IP4.DNS[1]: | ||
| - | IP6.ADDRESS[1]: | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important> | ||
| - | **Important** : Notez l' | ||
| - | </ | ||
| - | |||
| - | Sous Debian 8, consultez maintenant le contenu du fichier **/ | ||
| - | |||
| - | < | ||
| - | [root@debian8: | ||
| - | [connection] | ||
| - | id=ip_fixe | ||
| - | uuid=ec7e2b5f-0d19-4a40-8639-24af88a59d79 | ||
| - | interface-name=eth0 | ||
| - | type=ethernet | ||
| - | timestamp=1446551688 | ||
| - | |||
| - | [ipv6] | ||
| - | method=auto | ||
| - | |||
| - | [ipv4] | ||
| - | method=manual | ||
| - | dns=8.8.8.8; | ||
| - | address1=10.0.2.16/ | ||
| - | address2=192.168.1.2/ | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important> | ||
| - | **Important** : Notez l' | ||
| - | </ | ||
| - | |||
| - | ====La Commande hostname==== | ||
| - | |||
| - | La procédure de la modification du hostname est simplifiée et sa prise en compte est immédiate : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | |||
| - | root@debian8: | ||
| - | debian.fenestros.loc | ||
| - | |||
| - | root@debian8: | ||
| - | debian.fenestros.loc | ||
| - | |||
| - | root@debian8: | ||
| - | |||
| - | root@debian8: | ||
| - | debian8.fenestros.loc | ||
| - | |||
| - | root@debian8: | ||
| - | debian8.fenestros.loc | ||
| - | </ | ||
| - | |||
| - | ====La Commande ip==== | ||
| - | |||
| - | Sous Debian 8 la commande **ip** est préférée par rapport à la commande ifconfig : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | 1: lo: < | ||
| - | link/ | ||
| - | inet 127.0.0.1/8 scope host lo | ||
| - | | ||
| - | inet6 ::1/128 scope host | ||
| - | | ||
| - | 2: eth0: < | ||
| - | link/ether 08: | ||
| - | inet 10.0.2.16/ | ||
| - | | ||
| - | inet 192.168.1.2/ | ||
| - | | ||
| - | inet6 fe80:: | ||
| - | | ||
| - | </ | ||
| - | |||
| - | ===Options de la Commande ip=== | ||
| - | |||
| - | Les options de cette commande sont : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | Usage: ip [ OPTIONS ] OBJECT { COMMAND | help } | ||
| - | ip [ -force ] -batch filename | ||
| - | where OBJECT := { link | addr | addrlabel | route | rule | neigh | ntable | | ||
| - | | ||
| - | netns | l2tp | tcp_metrics | token | netconf } | ||
| - | | ||
| - | -f[amily] { inet | inet6 | ipx | dnet | bridge | link } | | ||
| - | -4 | -6 | -I | -D | -B | -0 | | ||
| - | -l[oops] { maximum-addr-flush-attempts } | | ||
| - | -o[neline] | -t[imestamp] | -b[atch] [filename] | | ||
| - | -rc[vbuf] [size]} | ||
| - | </ | ||
| - | |||
| - | ====Activer/ | ||
| - | |||
| - | Deux commandes existent pour désactiver et activer manuellement une interface réseau : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | root@debian8: | ||
| - | </ | ||
| - | |||
| - | ====Routage Statique==== | ||
| - | |||
| - | ===La commande ip=== | ||
| - | |||
| - | Sous Debian 8, pour supprimer la route vers le réseau 192.168.1.0 il convient d' | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | default via 10.0.2.2 dev enp0s3 | ||
| - | 10.0.2.0/24 dev enp0s3 | ||
| - | 192.168.1.0/ | ||
| - | |||
| - | root@debian8: | ||
| - | |||
| - | root@debian8: | ||
| - | default via 10.0.2.2 dev enp0s3 | ||
| - | 10.0.2.0/24 dev enp0s3 | ||
| - | </ | ||
| - | |||
| - | Pour ajouter la route vers le réseau 192.168.1.0 : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | |||
| - | root@debian8: | ||
| - | default via 10.0.2.2 dev enp0s3 | ||
| - | 10.0.2.0/24 dev enp0s3 | ||
| - | 192.168.1.0/ | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important> | ||
| - | La commande utilisée pour ajouter une passerelle par défaut prend la forme suivante **ip route add default via //adresse ip//**. | ||
| - | </ | ||
| - | |||
| - | ===Activer/ | ||
| - | |||
| - | Pour activer le routage sur le serveur, il convient d' | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | root@debian8: | ||
| - | 1 | ||
| - | </ | ||
| - | |||
| - | Pour désactiver le routage sur le serveur, il convient de désactiver la retransmission des paquets: | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | root@debian8: | ||
| - | 0 | ||
| </ | </ | ||
| Ligne 2963: | Ligne 3768: | ||
| </ | </ | ||
| - | =====Diagnostique du Réseau===== | + | =====LAB #4 - Utilisation de nmap et de netcat===== |
| - | ====ping==== | + | ==== 4.1 - nmap ==== |
| - | Pour tester l' | + | ===Installation=== |
| - | < | + | Sous RHEL/CentOS 7, **nmap** n'est pas installé par défaut |
| - | root@debian8: | + | |
| - | PING 10.0.2.2 (10.0.2.2) 56(84) bytes of data. | + | |
| - | 64 bytes from 10.0.2.2: icmp_seq=1 ttl=64 time=0.095 ms | + | |
| - | 64 bytes from 10.0.2.2: icmp_seq=2 ttl=64 time=0.153 ms | + | |
| - | 64 bytes from 10.0.2.2: icmp_seq=3 ttl=64 time=0.137 ms | + | |
| - | ^C | + | |
| - | --- 10.0.2.2 ping statistics --- | + | |
| - | 3 packets transmitted, 3 received, 0% packet loss, time 2000ms | + | |
| - | rtt min/ | + | |
| - | </ | + | |
| - | + | ||
| - | ===Options de la commande ping=== | + | |
| - | + | ||
| - | Les options de cette commande sont : | + | |
| < | < | ||
| - | root@debian8:~# ping --help | + | [root@centos7 |
| - | ping: invalid option -- ' | + | / |
| - | Usage: ping [-aAbBdDfhLnOqrRUvV] [-c count] [-i interval] [-I interface] | + | |
| - | [-m mark] [-M pmtudisc_option] [-l preload] [-p pattern] [-Q tos] | + | |
| - | [-s packetsize] [-S sndbuf] [-t ttl] [-T timestamp_option] | + | |
| - | [-w deadline] [-W timeout] [hop1 ...] destination | + | |
| </ | </ | ||
| - | ====netstat -i==== | + | Installez donc nmap en utilisant yum : |
| - | + | ||
| - | Pour visualiser les statistiques réseaux, vous disposez de la commande **netstat** | + | |
| < | < | ||
| - | root@debian8:~# netstat | + | [root@centos7 |
| - | Kernel Interface table | + | Loaded plugins: fastestmirror, |
| - | Iface | + | Repodata is over 2 weeks old. Install yum-cron? Or run: yum makecache fast |
| - | eth0 1500 0 | + | adobe-linux-x86_64 |
| - | lo 65536 0 | + | base | 3.6 kB |
| - | </code> | + | extras |
| + | updates | ||
| + | (1/3): adobe-linux-x86_64/ | ||
| + | (2/3): extras/ | ||
| + | (3/3): updates/ | ||
| + | Determining fastest mirrors | ||
| + | * base: ftp.rezopole.net | ||
| + | * extras: ftp.rezopole.net | ||
| + | * updates: ftp.rezopole.net | ||
| + | Resolving Dependencies | ||
| + | --> Running transaction check | ||
| + | ---> Package nmap.x86_64 2:6.40-7.el7 will be installed | ||
| + | --> Processing Dependency: nmap-ncat = 2: | ||
| + | --> Running transaction check | ||
| + | ---> Package nmap-ncat.x86_64 2: | ||
| + | --> Finished Dependency Resolution | ||
| - | ===Options de la commande netstat=== | + | Dependencies Resolved |
| - | Les options de cette commande sont : | + | ================================================================================ |
| + | | ||
| + | ================================================================================ | ||
| + | Installing: | ||
| + | | ||
| + | Installing for dependencies: | ||
| + | | ||
| - | < | + | Transaction Summary |
| - | root@debian8: | + | ================================================================================ |
| - | usage: netstat [-vWeenNcCF] [< | + | Install |
| - | | + | |
| - | | + | |
| - | -r, --route | + | Total download size: 4.2 M |
| - | -i, --interfaces | + | Installed size: 17 M |
| - | -g, --groups | + | Is this ok [y/d/N]: y |
| - | -s, --statistics | + | |
| - | -M, --masquerade | + | |
| - | + | ||
| - | -v, --verbose | + | |
| - | -W, --wide | + | |
| - | -n, --numeric | + | |
| - | --numeric-hosts | + | |
| - | --numeric-ports | + | |
| - | --numeric-users | + | |
| - | -N, --symbolic | + | |
| - | -e, --extend | + | |
| - | -p, --programs | + | |
| - | -c, --continuous | + | |
| - | + | ||
| - | -l, --listening | + | |
| - | -a, --all, --listening | + | |
| - | -o, --timers | + | |
| - | -F, --fib display Forwarding Information Base (default) | + | |
| - | -C, --cache | + | |
| - | + | ||
| - | < | + | |
| - | < | + | |
| - | List of possible address families (which support routing): | + | |
| - | inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25) | + | |
| - | netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP) | + | |
| - | x25 (CCITT X.25) | + | |
| </ | </ | ||
| - | |||
| - | ====La commande traceroute==== | ||
| - | |||
| - | La commande ping est à la base de la commande **traceroute**. Cette commande sert à découvrir la route empruntée pour accéder à un site donné : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | traceroute to www.i2tch.eu (217.160.122.33), | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | 10 * * * | ||
| - | 11 * * * | ||
| - | 12 * * * | ||
| - | 13 * * * | ||
| - | 14 *^C | ||
| - | </ | ||
| - | |||
| - | ===Options de la commande traceroute=== | ||
| Les options de cette commande sont : | Les options de cette commande sont : | ||
| < | < | ||
| - | root@debian8:~# traceroute | + | [root@centos7 |
| - | Usage: | + | Nmap 6.40 ( http://nmap.org ) |
| - | | + | Usage: nmap [Scan Type(s)] [Options] {target specification} |
| - | Options: | + | TARGET SPECIFICATION: |
| - | -4 Use IPv4 | + | Can pass hostnames, IP addresses, networks, etc. |
| - | -6 Use IPv6 | + | Ex: scanme.nmap.org, microsoft.com/ |
| - | -d | + | |
| - | -F --dont-fragment | + | |
| - | -f first_ttl | + | |
| - | Start from the first_ttl hop (instead from 1) | + | |
| - | -g gate, | + | HOST DISCOVERY: |
| - | Route packets through the specified gateway | + | -sL: List Scan - simply list targets to scan |
| - | (maximum 8 for IPv4 and 127 for IPv6) | + | -sn: Ping Scan - disable port scan |
| - | -I | + | -Pn: Treat all hosts as online |
| - | -T --tcp | + | -PS/ |
| - | -i device | + | -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes |
| - | | + | -PO[protocol list]: IP Protocol Ping |
| - | -m max_ttl | + | -n/-R: Never do DNS resolution/ |
| - | Set the max number of hops (max TTL to be | + | --dns-servers < |
| - | | + | --system-dns: Use OS's DNS resolver |
| - | -N squeries | + | --traceroute: |
| - | | + | SCAN TECHNIQUES: |
| - | simultaneously (default | + | -sS/ |
| - | -n Do not resolve IP addresses to their domain names | + | -sU: UDP Scan |
| - | -p port | + | -sN/sF/sX: TCP Null, FIN, and Xmas scans |
| - | | + | |
| - | (incremented by each probe, default is 33434), or | + | -sI <zombie host[: |
| - | initial seq for " | + | -sY/sZ: SCTP INIT/COOKIE-ECHO scans |
| - | default from 1), or some constant destination | + | |
| - | port for other methods | + | -b <FTP relay host>: FTP bounce scan |
| - | " | + | PORT SPECIFICATION AND SCAN ORDER: |
| - | -t tos | + | -p <port ranges>: Only scan specified ports |
| - | | + | Ex: -p22; -p1-65535; -p U: |
| - | -l flow_label | + | -F: Fast mode - Scan fewer ports than the default |
| - | Use specified flow_label for IPv6 packets | + | -r: Scan ports consecutively - don't randomize |
| - | -w waittime | + | --top-ports < |
| - | Set the number of seconds to wait for response | + | |
| - | a probe (default is 5.0). Non-integer (float | + | SERVICE/ |
| - | point) values allowed too | + | -sV: Probe open ports to determine service/ |
| - | -q nqueries | + | --version-intensity < |
| - | Set the number | + | |
| - | 3 | + | --version-all: Try every single probe (intensity 9) |
| - | -r Bypass the normal routing and send directly to a | + | |
| - | host on an attached network | + | SCRIPT SCAN: |
| - | -s src_addr | + | -sC: equivalent to --script=default |
| - | Use source src_addr for outgoing packets | + | --script=<Lua scripts>: |
| - | -z sendwait | + | directories, |
| - | | + | --script-args=< |
| - | If the value is more than 10, then it specifies a | + | |
| - | number in milliseconds, | + | |
| - | seconds (float point values allowed too) | + | --script-updatedb: |
| - | -e | + | --script-help=<Lua scripts>: |
| - | -A --as-path-lookups | + | <Lua scripts> is a comma separted list of script-files or |
| - | print results directly | + | |
| - | | + | OS DETECTION: |
| - | -M name --module=name | + | -O: Enable OS detection |
| - | for traceroute operations. Most methods have | + | --osscan-limit: Limit OS detection to promising targets |
| - | their shortcuts (`-I' means `-M icmp' etc.) | + | --osscan-guess: Guess OS more aggressively |
| - | -O OPTS,... --options=OPTS, | + | TIMING AND PERFORMANCE: |
| - | Use module-specific option OPTS for the | + | Options which take <time> are in seconds, or append ' |
| - | traceroute module. Several OPTS allowed, | + | ' |
| - | separated by comma. If OPTS is " | + | -T<0-5>: Set timing template |
| - | about available options | + | --min-hostgroup/ |
| - | --sport=num | + | --min-parallelism/ |
| - | `-N 1' | + | |
| - | --fwmark=num | + | probe round trip time. |
| - | -U --udp | + | --max-retries < |
| - | (instead of increasing the port per each probe), | + | --host-timeout < |
| - | | + | |
| - | -UL Use UDPLITE for tracerouting | + | --min-rate < |
| - | is 53) | + | --max-rate < |
| - | -D --dccp Use DCCP Request for tracerouting | + | FIREWALL/ |
| - | is 33434) | + | -f; --mtu < |
| - | -P prot --protocol=prot | + | -D < |
| - | --mtu | + | -S < |
| - | `-F -N 1' | + | -e < |
| - | --back Guess the number | + | |
| - | print if it differs | + | --data-length <num>: Append random data to sent packets |
| - | -V --version | + | --ip-options < |
| - | --help Read this help and exit | + | --ttl < |
| - | + | --spoof-mac <mac address/ | |
| - | Arguments: | + | --badsum: Send packets with a bogus TCP/UDP/SCTP checksum |
| - | + | + | OUTPUT: |
| - | | + | -oN/ |
| - | header plus 40). Can be ignored or increased to a minimal | + | and Grepable format, respectively, |
| - | | + | -oA < |
| + | -v: Increase verbosity level (use -vv or more for greater effect) | ||
| + | -d: Increase debugging level (use -dd or more for greater effect) | ||
| + | | ||
| + | --open: Only show open (or possibly open) ports | ||
| + | --packet-trace: | ||
| + | --iflist: Print host interfaces and routes | ||
| + | --log-errors: | ||
| + | --append-output: | ||
| + | --resume < | ||
| + | --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML | ||
| + | --webxml: Reference stylesheet from Nmap.Org for more portable XML | ||
| + | --no-stylesheet: | ||
| + | MISC: | ||
| + | -6: Enable IPv6 scanning | ||
| + | -A: Enable OS detection, version detection, script scanning, | ||
| + | | ||
| + | --send-eth/ | ||
| + | --privileged: Assume that the user is fully privileged | ||
| + | --unprivileged: | ||
| + | -V: Print version | ||
| + | -h: Print this help summary page. | ||
| + | EXAMPLES: | ||
| + | nmap -v -A scanme.nmap.org | ||
| + | nmap -v -sn 192.168.0.0/16 10.0.0.0/8 | ||
| + | nmap -v -iR 10000 -Pn -p 80 | ||
| + | SEE THE MAN PAGE (http:// | ||
| </ | </ | ||
| - | =====Connexions à Distance===== | + | ===Utilisation=== |
| - | ==== Telnet ==== | + | Pour connaître |
| - | + | ||
| - | La commande **telnet** est utilisée pour établir une connexion à distance avec un serveur telnet : | + | |
| - | + | ||
| - | < | + | |
| - | # telnet numero_ip | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | Le service telnet revient à une redirection des canaux standards d' | + | |
| - | </ | + | |
| - | + | ||
| - | ===Options de la commande telnet=== | + | |
| - | + | ||
| - | Les options de cette commande sont : | + | |
| < | < | ||
| - | root@debian8:~# telnet --help | + | [root@centos7 |
| - | telnet: invalid option -- ' | + | |
| - | Usage: telnet [-4] [-6] [-8] [-E] [-L] [-a] [-d] [-e char] [-l user] | + | |
| - | [-n tracefile] [ -b addr ] [-r] [host-name [port]] | + | |
| - | </ | + | |
| - | + | ||
| - | ==== wget ==== | + | |
| - | + | ||
| - | La commande **wget** est utilisée pour récupérer un fichier via http ou ftp : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian8: | + | |
| - | --2017-06-22 15: | + | |
| - | Resolving www.dropbox.com (www.dropbox.com)... 162.125.65.1 | + | |
| - | Connecting to www.dropbox.com (www.dropbox.com)|162.125.65.1|: | + | |
| - | HTTP request sent, awaiting response... 302 Found | + | |
| - | Location: https:// | + | |
| - | --2017-06-22 15: | + | |
| - | Resolving dl.dropboxusercontent.com (dl.dropboxusercontent.com)... 162.125.65.6 | + | |
| - | Connecting to dl.dropboxusercontent.com (dl.dropboxusercontent.com)|162.125.65.6|: | + | |
| - | HTTP request sent, awaiting response... 200 OK | + | |
| - | Length: 17 [text/ | + | |
| - | Saving to: ‘fichier_test? | + | |
| - | fichier_test? | + | Starting Nmap 6.40 ( http:// |
| + | Nmap scan report for localhost.localdomain (127.0.0.1) | ||
| + | Host is up (-2100s latency). | ||
| + | Not shown: 996 closed ports | ||
| + | PORT STATE SERVICE | ||
| + | 22/tcp open ssh | ||
| + | 25/ | ||
| + | 111/tcp open rpcbind | ||
| + | 631/tcp open ipp | ||
| - | 2017-06-22 15:58:31 (3.53 MB/s) - ‘fichier_test? | + | Nmap done: 1 IP address |
| </ | </ | ||
| - | ===Options de la commande wget=== | + | <WRAP center round important 50%> |
| + | **Important** - Pour connaître les ports ouverts sur une machine distante, | ||
| + | </ | ||
| - | Les options | + | ===Fichiers |
| - | < | + | **nmap** utilise un fichier spécifique pour identifier les ports. Ce fichier est **/usr/share/nmap/nmap-services**: |
| - | root@debian8: | + | |
| - | GNU Wget 1.16, a non-interactive network retriever. | + | |
| - | Usage: wget [OPTION]... [URL]... | + | |
| - | + | ||
| - | Mandatory arguments to long options are mandatory for short options too. | + | |
| - | + | ||
| - | Startup: | + | |
| - | -V, --version | + | |
| - | -h, --help | + | |
| - | -b, --background | + | |
| - | -e, --execute=COMMAND | + | |
| - | + | ||
| - | Logging and input file: | + | |
| - | -o, --output-file=FILE | + | |
| - | -a, --append-output=FILE | + | |
| - | -d, --debug | + | |
| - | -q, --quiet | + | |
| - | -v, --verbose | + | |
| - | -nv, --no-verbose | + | |
| - | | + | |
| - | -i, --input-file=FILE | + | |
| - | -F, --force-html | + | |
| - | -B, --base=URL | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | Download: | + | |
| - | -t, --tries=NUMBER | + | |
| - | | + | |
| - | -O, --output-document=FILE | + | |
| - | -nc, --no-clobber | + | |
| - | | + | |
| - | -c, --continue | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -N, --timestamping | + | |
| - | | + | |
| - | --no-use-server-timestamps | + | |
| - | the one on the server. | + | |
| - | -S, --server-response | + | |
| - | | + | |
| - | -T, --timeout=SECONDS | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -w, --wait=SECONDS | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -Q, --quota=NUMBER | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -4, --inet4-only | + | |
| - | -6, --inet6-only | + | |
| - | | + | |
| - | one of IPv6, IPv4, or none. | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | Directories: | + | |
| - | -nd, --no-directories | + | |
| - | -x, --force-directories | + | |
| - | -nH, --no-host-directories | + | |
| - | | + | |
| - | -P, --directory-prefix=PREFIX | + | |
| - | | + | |
| - | + | ||
| - | HTTP options: | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | this is `index.html' | + | |
| - | -E, --adjust-extension | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -U, --user-agent=AGENT | + | |
| - | --no-http-keep-alive | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | HTTPS (SSL/TLS) options: | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | FTP options: | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | WARC options: | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | WARC writer. | + | |
| - | + | ||
| - | Recursive download: | + | |
| - | -r, --recursive | + | |
| - | -l, --level=NUMBER | + | |
| - | | + | |
| - | -k, --convert-links | + | |
| - | local files. | + | |
| - | | + | |
| - | -K, --backup-converted | + | |
| - | -m, --mirror | + | |
| - | -p, --page-requisites | + | |
| - | | + | |
| - | + | ||
| - | Recursive accept/ | + | |
| - | -A, --accept=LIST | + | |
| - | -R, --reject=LIST | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -D, --domains=LIST | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | -H, --span-hosts | + | |
| - | -L, --relative | + | |
| - | -I, --include-directories=LIST | + | |
| - | | + | |
| - | url last component. | + | |
| - | -X, --exclude-directories=LIST | + | |
| - | -np, --no-parent | + | |
| - | + | ||
| - | Mail bug reports and suggestions to < | + | |
| - | </ | + | |
| - | + | ||
| - | ==== ftp ==== | + | |
| - | + | ||
| - | La commande | + | |
| < | < | ||
| - | root@debian8:~# ftp ftp2.fenestros.com | + | [root@centos7 |
| - | Connected to anonymous.ftp.ovh.net. | + | # THIS FILE IS GENERATED AUTOMATICALLY FROM A MASTER - DO NOT EDIT. |
| - | 220 anonymous.ftp.ovh.net NcFTPd Server (licensed copy) ready. | + | # EDIT / |
| - | Name (ftp2.fenestros.com:trainee): anonymous | + | # Well known service port numbers -*- mode: fundamental; |
| - | 331 Guest login ok, send your complete e-mail address | + | # From the Nmap Security Scanner ( http://nmap.org ) |
| - | Password: | + | # |
| - | 230 Logged | + | # $Id: nmap-services 31220 2013-07-03 04:30:43Z david $ |
| - | Remote | + | # |
| - | Using binary mode to transfer files. | + | # Derived from IANA data and our own research |
| - | ftp> | + | # |
| + | # This collection of service data is (C) 1996-2011 by Insecure.Com | ||
| + | # LLC. It is distributed under the Nmap Open Source license as | ||
| + | # provided in the COPYING file of the source distribution or at | ||
| + | # http://nmap.org/ | ||
| + | # requires you to license your own work under a compatable open source | ||
| + | # license. If you wish to embed Nmap technology into proprietary | ||
| + | # software, we sell alternative licenses | ||
| + | # Dozens of software vendors already license Nmap technology such as | ||
| + | # host discovery, port scanning, OS detection, and version detection. | ||
| + | # For more details, see http:// | ||
| + | # | ||
| + | # Fields | ||
| + | # | ||
| + | tcpmux 1/ | ||
| + | tcpmux 1/ | ||
| + | compressnet 2/ | ||
| + | compressnet 2/ | ||
| + | compressnet 3/ | ||
| + | compressnet 3/ | ||
| + | unknown 4/ | ||
| + | rje 5/ | ||
| + | unknown 6/ | ||
| + | echo 7/ | ||
| + | echo 7/ | ||
| + | echo 7/ | ||
| + | unknown 8/ | ||
| + | --More--(0%) | ||
| </ | </ | ||
| - | Une fois connecté, il convient d' | + | Le répertoire |
| < | < | ||
| - | ftp> help | + | [root@centos7 ~]# ls -l / |
| - | Commands may be abbreviated. | + | total 6548 |
| - | + | -rw-r--r--. 1 root root 10546 Nov 20 2015 nmap.dtd | |
| - | ! dir mdelete qc site | + | -rw-r--r--. 1 root root 455371 Nov 20 2015 nmap-mac-prefixes |
| - | $ disconnect mdir sendport size | + | -rw-r--r--. 1 root root 3694559 Nov 20 2015 nmap-os-db |
| - | account exit mget put status | + | -rw-r--r--. 1 root root 11749 Nov 20 2015 nmap-payloads |
| - | append form mkdir pwd struct | + | -rw-r--r--. 1 root root 6631 Nov 20 2015 nmap-protocols |
| - | ascii get mls quit system | + | -rw-r--r--. 1 root root 49243 Nov 20 2015 nmap-rpc |
| - | bell glob mode quote sunique | + | -rw-r--r--. 1 root root 1727204 Nov 20 2015 nmap-service-probes |
| - | binary hash modtime recv tenex | + | -rw-r--r--. 1 root root 622039 Nov 20 2015 nmap-services |
| - | bye help mput reget tick | + | -rw-r--r--. 1 root root 31935 Nov 20 2015 nmap.xsl |
| - | case idle newer rstatus trace | + | drwxr-xr-x. 3 root root 4096 Aug 5 14:16 nselib |
| - | cd image nmap rhelp type | + | -rw-r--r--. 1 root root 47190 Nov 20 2015 nse_main.lua |
| - | cdup ipany nlist rename user | + | drwxr-xr-x. 2 root root 20480 Aug 5 14:16 scripts |
| - | chmod ipv4 ntrans reset umask | + | |
| - | close ipv6 open restart verbose | + | |
| - | cr lcd prompt rmdir ? | + | |
| - | delete ls passive runique | + | |
| - | debug macdef proxy send | + | |
| </ | </ | ||
| - | Le caractère **!** permet d' | + | Voici la liste des fichiers les plus importants : |
| - | < | + | ^ Fichier ^ Description ^ |
| - | ftp> !pwd | + | | / |
| - | /root | + | | /usr/ |
| - | </code> | + | | / |
| + | | / | ||
| - | Pour transférer un fichier vers le serveur, il convient d' | + | ===Scripts=== |
| - | < | + | **nmap** utilise des scripts pour accomplir certaines tâches allant |
| - | ftp> put nom_fichier_local nom_fichier_distant | + | |
| - | </ | + | |
| - | + | ||
| - | Vous pouvez également transférer plusieurs fichiers à la fois grâce à la commande | + | |
| - | + | ||
| - | < | + | |
| - | ftp> mput nom*.* | + | |
| - | </ | + | |
| - | + | ||
| - | Pour transférer un fichier du serveur, il convient d'utiliser la commande **get** : | + | |
| - | + | ||
| - | < | + | |
| - | ftp> get nom_fichier | + | |
| - | </ | + | |
| - | + | ||
| - | Vous pouvez également transférer plusieurs fichiers | + | |
| - | + | ||
| - | Pour supprimer un fichier sur le serveur, il convient d'utiliser la commande **del** : | + | |
| - | + | ||
| - | < | + | |
| - | ftp> del nom_fichier | + | |
| - | </ | + | |
| - | + | ||
| - | Pour fermer la session, il convient d' | + | |
| < | < | ||
| - | ftp> quit | + | [root@centos7 |
| - | 221 Goodbye. | + | acarsd-info.nse |
| - | root@debian8:~# | + | address-info.nse |
| + | afp-brute.nse | ||
| + | afp-ls.nse | ||
| + | afp-path-vuln.nse | ||
| + | afp-serverinfo.nse | ||
| + | afp-showmount.nse | ||
| + | ajp-auth.nse | ||
| + | ajp-brute.nse | ||
| + | ajp-headers.nse | ||
| + | ajp-methods.nse | ||
| + | ajp-request.nse | ||
| + | amqp-info.nse | ||
| + | asn-query.nse | ||
| + | auth-owners.nse | ||
| + | auth-spoof.nse | ||
| + | backorifice-brute.nse | ||
| + | backorifice-info.nse | ||
| + | banner.nse | ||
| + | bitcoin-getaddr.nse | ||
| + | bitcoin-info.nse | ||
| + | bitcoinrpc-info.nse | ||
| + | bittorrent-discovery.nse | ||
| + | bjnp-discover.nse | ||
| + | broadcast-ataoe-discover.nse | ||
| + | broadcast-avahi-dos.nse | ||
| + | broadcast-bjnp-discover.nse | ||
| + | broadcast-db2-discover.nse | ||
| + | broadcast-dhcp6-discover.nse | ||
| + | broadcast-dhcp-discover.nse | ||
| + | broadcast-dns-service-discovery.nse | ||
| + | broadcast-dropbox-listener.nse | ||
| + | broadcast-eigrp-discovery.nse | ||
| + | broadcast-igmp-discovery.nse | ||
| + | broadcast-listener.nse | ||
| + | broadcast-ms-sql-discover.nse | ||
| + | broadcast-netbios-master-browser.nse | ||
| + | broadcast-networker-discover.nse | ||
| + | broadcast-novell-locate.nse | ||
| + | broadcast-pc-anywhere.nse | ||
| + | broadcast-pc-duo.nse | ||
| + | broadcast-pim-discovery.nse | ||
| + | broadcast-ping.nse | ||
| + | broadcast-pppoe-discover.nse | ||
| + | broadcast-rip-discover.nse | ||
| + | broadcast-ripng-discover.nse | ||
| + | broadcast-sybase-asa-discover.nse | ||
| + | broadcast-tellstick-discover.nse | ||
| + | broadcast-upnp-info.nse | ||
| + | broadcast-versant-locate.nse | ||
| + | broadcast-wake-on-lan.nse | ||
| + | broadcast-wpad-discover.nse | ||
| + | broadcast-wsdd-discover.nse | ||
| + | broadcast-xdmcp-discover.nse | ||
| + | cassandra-brute.nse | ||
| + | cassandra-info.nse | ||
| + | cccam-version.nse | ||
| + | citrix-brute-xml.nse | ||
| + | citrix-enum-apps.nse | ||
| + | citrix-enum-apps-xml.nse | ||
| + | citrix-enum-servers.nse | ||
| + | citrix-enum-servers-xml.nse | ||
| + | couchdb-databases.nse | ||
| + | couchdb-stats.nse | ||
| + | creds-summary.nse | ||
| + | cups-info.nse | ||
| + | cups-queue-info.nse | ||
| + | cvs-brute.nse | ||
| + | cvs-brute-repository.nse | ||
| + | daap-get-library.nse | ||
| + | daytime.nse | ||
| + | db2-das-info.nse | ||
| + | db2-discover.nse | ||
| + | dhcp-discover.nse | ||
| + | dict-info.nse | ||
| + | distcc-cve2004-2687.nse | ||
| + | dns-blacklist.nse | ||
| + | dns-brute.nse | ||
| + | dns-cache-snoop.nse | ||
| + | dns-check-zone.nse | ||
| + | dns-client-subnet-scan.nse | ||
| + | dns-fuzz.nse | ||
| + | dns-ip6-arpa-scan.nse | ||
| + | dns-nsec3-enum.nse | ||
| + | dns-nsec-enum.nse | ||
| + | dns-nsid.nse | ||
| + | dns-random-srcport.nse | ||
| + | dns-random-txid.nse | ||
| + | dns-recursion.nse | ||
| + | dns-service-discovery.nse | ||
| + | dns-srv-enum.nse | ||
| + | dns-update.nse | ||
| + | dns-zeustracker.nse | ||
| + | dns-zone-transfer.nse | ||
| + | domcon-brute.nse | ||
| + | domcon-cmd.nse | ||
| + | domino-enum-users.nse | ||
| + | dpap-brute.nse | ||
| + | drda-brute.nse | ||
| + | drda-info.nse | ||
| + | duplicates.nse | ||
| + | eap-info.nse | ||
| + | epmd-info.nse | ||
| + | eppc-enum-processes.nse | ||
| + | finger.nse | ||
| + | firewalk.nse | ||
| + | firewall-bypass.nse | ||
| + | flume-master-info.nse | ||
| + | ftp-anon.nse | ||
| + | ftp-bounce.nse | ||
| + | ftp-brute.nse | ||
| + | ftp-libopie.nse | ||
| + | ftp-proftpd-backdoor.nse | ||
| + | ftp-vsftpd-backdoor.nse | ||
| + | ftp-vuln-cve2010-4221.nse | ||
| + | ganglia-info.nse | ||
| + | giop-info.nse | ||
| + | gkrellm-info.nse | ||
| + | gopher-ls.nse | ||
| + | gpsd-info.nse | ||
| + | hadoop-datanode-info.nse | ||
| + | hadoop-jobtracker-info.nse | ||
| + | hadoop-namenode-info.nse | ||
| + | hadoop-secondary-namenode-info.nse | ||
| + | hadoop-tasktracker-info.nse | ||
| + | hbase-master-info.nse | ||
| + | hbase-region-info.nse | ||
| + | hddtemp-info.nse | ||
| + | hostmap-bfk.nse | ||
| + | hostmap-ip2hosts.nse | ||
| + | hostmap-robtex.nse | ||
| + | http-adobe-coldfusion-apsa1301.nse | ||
| + | http-affiliate-id.nse | ||
| + | http-apache-negotiation.nse | ||
| + | http-auth-finder.nse | ||
| + | http-auth.nse | ||
| + | http-awstatstotals-exec.nse | ||
| + | http-axis2-dir-traversal.nse | ||
| + | http-backup-finder.nse | ||
| + | http-barracuda-dir-traversal.nse | ||
| + | http-brute.nse | ||
| + | http-cakephp-version.nse | ||
| + | http-chrono.nse | ||
| + | http-coldfusion-subzero.nse | ||
| + | http-comments-displayer.nse | ||
| + | http-config-backup.nse | ||
| + | http-cors.nse | ||
| + | http-date.nse | ||
| + | http-default-accounts.nse | ||
| </ | </ | ||
| - | ====SSH==== | + | Les scripts sont regroupés dans des catégories : **auth**, **broadcast**, |
| - | ===Introduction=== | + | <WRAP center round important 50%> |
| + | **Important** - Pour plus d' | ||
| + | </ | ||
| - | La commande **[[wpfr> | + | La catégorie |
| - | + | ||
| - | * Le **serveur SSH** | + | |
| - | * le démon sshd, qui s' | + | |
| - | * Le **client SSH** | + | |
| - | * ssh ou scp, qui assure la connexion et le dialogue avec le serveur, | + | |
| - | * La **session** qui représente la connexion courante et qui commence juste après l' | + | |
| - | * Les **clefs** | + | |
| - | * **Couple de clef utilisateur asymétriques** et persistantes qui assurent l' | + | |
| - | * **Clef hôte asymétrique et persistante** garantissant l' | + | |
| - | | + | |
| - | * **Clef de session symétrique | + | |
| - | * La **base de données des hôtes connus** qui stocke les clés des connexions précédentes. | + | |
| - | + | ||
| - | SSH fonctionne de la manière suivante pour la la mise en place d'un canal sécurisé: | + | |
| - | + | ||
| - | * Le client contacte le serveur sur son port 22, | + | |
| - | * Les client et le serveur échangent leur version | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | * Une liste de méthodes de chiffrage, compression et authentification, | + | |
| - | * Le client et le serveur produisent un identifiant identique, un haché MD5 long de 128 bits contenant la clé hôte, la clé serveur et la séquence aléatoire, | + | |
| - | * Le client génère sa clé de session symétrique et la chiffre deux fois de suite, une fois avec la clé hôte du serveur et la deuxième fois avec la clé serveur. Le client envoie cette clé au serveur accompagnée de la séquence aléatoire et un choix d' | + | |
| - | * Le serveur déchiffre la clé de session, | + | |
| - | * Le client et le serveur mettent en place le canal sécurisé. | + | |
| - | + | ||
| - | ===SSH-1=== | + | |
| - | + | ||
| - | SSH-1 utilise | + | |
| - | + | ||
| - | Afin de s' | + | |
| - | + | ||
| - | * **Kerberos**, | + | |
| - | * **Rhosts**, | + | |
| - | * **%%RhostsRSA%%**, | + | |
| - | * Par **clef asymétrique**, | + | |
| - | * **TIS**, | + | |
| - | * Par **mot de passe**. | + | |
| - | + | ||
| - | ===SSH-2=== | + | |
| - | + | ||
| - | SSH-2 utilise **DSA** ou **RSA**. Il assure l' | + | |
| - | + | ||
| - | * **SSH-TRANS** – Transport Layer Protocol, | + | |
| - | * **SSH-AUTH** – Authentification Protocol, | + | |
| - | * **SSH-CONN** – Connection Protocol. | + | |
| - | + | ||
| - | SSH-2 diffère de SSH-1 essentiellement dans la phase authentification. | + | |
| - | + | ||
| - | Trois méthodes d' | + | |
| - | + | ||
| - | * Par **clef asymétrique**, | + | |
| - | * Identique à SSH-1 sauf avec l' | + | |
| - | * **%%RhostsRSA%%**, | + | |
| - | * Par **mot de passe**. | + | |
| - | + | ||
| - | ===Options de la commande=== | + | |
| - | + | ||
| - | Les options de cette commande sont : | + | |
| < | < | ||
| - | root@debian8:~# ssh --help | + | [root@centos7 |
| - | unknown option -- - | + | |
| - | usage: ssh [-1246AaCfgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec] | + | |
| - | [-D [bind_address: | + | |
| - | [-F configfile] [-I pkcs11] [-i identity_file] | + | |
| - | [-L [bind_address: | + | |
| - | [-O ctl_cmd] [-o option] [-p port] | + | |
| - | [-Q cipher | cipher-auth | mac | kex | key] | + | |
| - | [-R [bind_address: | + | |
| - | [-w local_tun[: | + | |
| - | </ | + | |
| - | ====L' | + | Starting Nmap 6.40 ( http:// |
| + | NSE: Loaded 95 scripts for scanning. | ||
| + | NSE: Script Pre-scanning. | ||
| + | Initiating SYN Stealth Scan at 14:20 | ||
| + | Scanning localhost (127.0.0.1) [1000 ports] | ||
| + | Discovered open port 22/tcp on 127.0.0.1 | ||
| + | adjust_timeouts2: | ||
| + | adjust_timeouts2: | ||
| + | Discovered open port 25/tcp on 127.0.0.1 | ||
| + | adjust_timeouts2: | ||
| + | adjust_timeouts2: | ||
| + | Discovered open port 111/tcp on 127.0.0.1 | ||
| + | adjust_timeouts2: | ||
| + | adjust_timeouts2: | ||
| + | Discovered open port 631/tcp on 127.0.0.1 | ||
| + | adjust_timeouts2: | ||
| + | adjust_timeouts2: | ||
| + | Completed SYN Stealth Scan at 14:20, 0.01s elapsed (1000 total ports) | ||
| + | NSE: Script scanning 127.0.0.1. | ||
| + | Initiating NSE at 14:20 | ||
| + | Completed NSE at 14:20, 0.28s elapsed | ||
| + | Nmap scan report for localhost (127.0.0.1) | ||
| + | Host is up (0.0000060s latency). | ||
| + | rDNS record for 127.0.0.1: localhost.localdomain | ||
| + | Not shown: 996 closed ports | ||
| + | PORT STATE SERVICE | ||
| + | 22/ | ||
| + | | ssh-hostkey: | ||
| + | |_256 19: | ||
| + | 25/ | ||
| + | |_smtp-commands: | ||
| + | 111/tcp open rpcbind | ||
| + | | rpcinfo: | ||
| + | | | ||
| + | | | ||
| + | |_ 100000 | ||
| + | 631/tcp open ipp | ||
| + | | http-methods: | ||
| + | | Potentially risky methods: PUT | ||
| + | |_See http:// | ||
| + | | http-robots.txt: | ||
| + | |_/ | ||
| + | |_http-title: | ||
| - | L' | + | NSE: Script Post-scanning. |
| - | + | Initiating NSE at 14:20 | |
| - | Avantage: | + | Completed NSE at 14:20, 0.00s elapsed |
| - | * Aucune configuration de clef asymétrique n'est nécessaire. | + | Read data files from: /usr/bin/../share/nmap |
| - | + | Nmap done: 1 IP address (1 host up) scanned in 0.43 seconds | |
| - | Inconvénients: | + | Raw packets sent: 1000 (44.000KB) | Rcvd: 2004 (84.176KB) |
| - | * L' | + | |
| - | * Moins sécurisé qu'un système par clef asymétrique. | + | |
| - | + | ||
| - | ====L' | + | |
| - | + | ||
| - | * Le **client** envoie au serveur une requête d' | + | |
| - | * Le **serveur** recherche une correspondance pour ce module dans le fichier des clés autorisés **~/ | + | |
| - | * Dans le cas où une correspondance n'est pas trouvée, le serveur met fin à la communication, | + | |
| - | * Dans le cas contraire le serveur génère une chaîne aléatoire de 256 bits appelée un **challenge** et la chiffre avec la **clé publique du client**, | + | |
| - | * Le **client** reçoit le challenge et le décrypte avec la partie privée de sa clé. Il combine le challenge avec l' | + | |
| - | * Le **serveur** génère le même haché et le compare avec celui reçu du client. Si les deux hachés sont identiques, l' | + | |
| - | + | ||
| - | ====Installation==== | + | |
| - | + | ||
| - | Pour installer/ | + | |
| - | + | ||
| - | < | + | |
| - | root@debian8: | + | |
| - | / | + | |
| - | root@debian8: | + | |
| - | /usr/bin/ssh | + | |
| - | root@debian8: | + | |
| - | openssh-server: / | + | |
| - | root@debian8:~# dpkg -S / | + | |
| - | openssh-client: / | + | |
| - | root@debian8: | + | |
| - | Reading package lists... Done | + | |
| - | Building dependency tree | + | |
| - | Reading state information... Done | + | |
| - | openssh-server is already the newest version. | + | |
| - | 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. | + | |
| </ | </ | ||
| - | <WRAP center round important> | + | <WRAP center round warning 50%> |
| - | **Important** - Pour les stations | + | **Attention** - La catégorie par défaut **default** contient certains scripts |
| </ | </ | ||
| - | ===Options de la commande=== | + | ====4.2 - netcat ==== |
| - | Les options | + | **netcat** est un couteau suisse. Il permet non seulement de scanner des ports mais aussi de lancer la connexion lors de la découverte d'un port ouvert. |
| - | < | + | Les options |
| - | SYNOPSIS | + | |
| - | sshd [-46DdeiqTt] [-b bits] [-C connection_spec] [-f config_file] [-g login_grace_time] [-h host_key_file] [-k key_gen_time] [-o option] [-p port] [-u len] | + | |
| - | </ | + | |
| - | + | ||
| - | ====Configuration==== | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - La configuration doit s' | + | |
| - | </ | + | |
| - | + | ||
| - | ===Serveur=== | + | |
| - | + | ||
| - | La configuration du serveur s' | + | |
| < | < | ||
| - | root@debian8:~# cat /etc/ssh/sshd_config | + | [root@centos7 |
| - | # Package generated configuration file | + | Ncat 6.40 ( http://nmap.org/ncat ) |
| - | # See the sshd_config(5) manpage for details | + | Usage: ncat [options] [hostname] [port] |
| - | # What ports, IPs and protocols we listen | + | Options taking a time assume seconds. Append ' |
| - | Port 22 | + | ' |
| - | # Use these options to restrict which interfaces/protocols sshd will bind to | + | |
| - | # | + | |
| - | # | + | -U, --unixsock |
| - | Protocol 2 | + | -C, --crlf |
| - | # HostKeys for protocol version 2 | + | -c, --sh-exec < |
| - | HostKey / | + | -e, --exec < |
| - | HostKey | + | |
| - | HostKey / | + | -g hop1[,hop2,...] Loose source routing hop points (8 max) |
| - | HostKey /etc/ssh/ | + | -G < |
| - | #Privilege Separation is turned | + | -m, --max-conns < |
| - | UsePrivilegeSeparation yes | + | -h, --help |
| + | -d, --delay < | ||
| + | -o, --output < | ||
| + | -x, --hex-dump < | ||
| + | -i, --idle-timeout < | ||
| + | -p, --source-port port | ||
| + | -s, --source addr Specify source address to use (doesn' | ||
| + | -l, --listen | ||
| + | -k, --keep-open | ||
| + | -n, --nodns | ||
| + | -t, --telnet | ||
| + | -u, --udp Use UDP instead of default TCP | ||
| + | --sctp | ||
| + | -v, --verbose | ||
| + | -w, --wait < | ||
| + | --append-output | ||
| + | --send-only | ||
| + | --recv-only | ||
| + | --allow | ||
| + | --allowfile | ||
| + | --deny | ||
| + | --denyfile | ||
| + | --broker | ||
| + | --chat | ||
| + | --proxy < | ||
| + | --proxy-type < | ||
| + | --proxy-auth < | ||
| + | --ssl Connect or listen with SSL | ||
| + | --ssl-cert | ||
| + | | ||
| + | --ssl-verify | ||
| + | --ssl-trustfile | ||
| + | --version | ||
| - | # Lifetime and size of ephemeral version 1 server key | + | See the ncat(1) manpage for full options, |
| - | KeyRegenerationInterval 3600 | + | |
| - | ServerKeyBits 1024 | + | |
| - | + | ||
| - | # Logging | + | |
| - | SyslogFacility AUTH | + | |
| - | LogLevel INFO | + | |
| - | + | ||
| - | # Authentication: | + | |
| - | LoginGraceTime 120 | + | |
| - | PermitRootLogin without-password | + | |
| - | StrictModes yes | + | |
| - | + | ||
| - | RSAAuthentication yes | + | |
| - | PubkeyAuthentication yes | + | |
| - | # | + | |
| - | + | ||
| - | # Don't read the user's ~/.rhosts and ~/.shosts files | + | |
| - | IgnoreRhosts yes | + | |
| - | # For this to work you will also need host keys in / | + | |
| - | RhostsRSAAuthentication no | + | |
| - | # similar for protocol version 2 | + | |
| - | HostbasedAuthentication no | + | |
| - | # Uncomment if you don't trust ~/ | + | |
| - | # | + | |
| - | + | ||
| - | # To enable empty passwords, change to yes (NOT RECOMMENDED) | + | |
| - | PermitEmptyPasswords no | + | |
| - | + | ||
| - | # Change to yes to enable challenge-response passwords (beware issues with | + | |
| - | # some PAM modules and threads) | + | |
| - | ChallengeResponseAuthentication no | + | |
| - | + | ||
| - | # Change to no to disable tunnelled clear text passwords | + | |
| - | # | + | |
| - | + | ||
| - | # Kerberos | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | + | ||
| - | # GSSAPI options | + | |
| - | # | + | |
| - | # | + | |
| - | + | ||
| - | X11Forwarding yes | + | |
| - | X11DisplayOffset 10 | + | |
| - | PrintMotd no | + | |
| - | PrintLastLog yes | + | |
| - | TCPKeepAlive yes | + | |
| - | #UseLogin no | + | |
| - | + | ||
| - | # | + | |
| - | #Banner / | + | |
| - | + | ||
| - | # Allow client to pass locale environment variables | + | |
| - | AcceptEnv LANG LC_* | + | |
| - | + | ||
| - | Subsystem sftp / | + | |
| - | + | ||
| - | # Set this to ' | + | |
| - | # and session processing. If this is enabled, PAM authentication will | + | |
| - | # be allowed through the ChallengeResponseAuthentication and | + | |
| - | # PasswordAuthentication. | + | |
| - | # PAM authentication via ChallengeResponseAuthentication may bypass | + | |
| - | # the setting of " | + | |
| - | # If you just want the PAM account and session checks to run without | + | |
| - | # PAM authentication, then enable this but set PasswordAuthentication | + | |
| - | # and ChallengeResponseAuthentication to ' | + | |
| - | UsePAM yes | + | |
| </ | </ | ||
| - | |||
| - | Pour ôter les lignes de commentaires dans ce fichier, utilisez la commande suivante : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | root@debian8:/ | ||
| - | Port 22 | ||
| - | Protocol 2 | ||
| - | HostKey / | ||
| - | HostKey / | ||
| - | HostKey / | ||
| - | HostKey / | ||
| - | UsePrivilegeSeparation yes | ||
| - | KeyRegenerationInterval 3600 | ||
| - | ServerKeyBits 1024 | ||
| - | SyslogFacility AUTH | ||
| - | LogLevel INFO | ||
| - | LoginGraceTime 120 | ||
| - | PermitRootLogin without-password | ||
| - | StrictModes yes | ||
| - | RSAAuthentication yes | ||
| - | PubkeyAuthentication yes | ||
| - | IgnoreRhosts yes | ||
| - | RhostsRSAAuthentication no | ||
| - | HostbasedAuthentication no | ||
| - | PermitEmptyPasswords no | ||
| - | ChallengeResponseAuthentication no | ||
| - | X11Forwarding yes | ||
| - | X11DisplayOffset 10 | ||
| - | PrintMotd no | ||
| - | PrintLastLog yes | ||
| - | TCPKeepAlive yes | ||
| - | AcceptEnv LANG LC_* | ||
| - | Subsystem sftp / | ||
| - | UsePAM yes | ||
| - | </ | ||
| - | |||
| - | Pour sécuriser le serveur ssh, ajoutez ou modifiez les directives suivantes : | ||
| - | |||
| - | < | ||
| - | AllowGroups adm | ||
| - | Banner / | ||
| - | PermitRootLogin no | ||
| - | X11Forwarding no | ||
| - | </ | ||
| - | |||
| - | Votre fichier ressemblera à celui-ci : | ||
| - | |||
| - | < | ||
| - | AllowGroups adm | ||
| - | Banner / | ||
| - | PermitRootLogin no | ||
| - | X11Forwarding no | ||
| - | Port 22 | ||
| - | Protocol 2 | ||
| - | HostKey / | ||
| - | HostKey / | ||
| - | HostKey / | ||
| - | HostKey / | ||
| - | UsePrivilegeSeparation yes | ||
| - | KeyRegenerationInterval 3600 | ||
| - | ServerKeyBits 1024 | ||
| - | SyslogFacility AUTH | ||
| - | LogLevel INFO | ||
| - | LoginGraceTime 120 | ||
| - | StrictModes yes | ||
| - | RSAAuthentication yes | ||
| - | PubkeyAuthentication yes | ||
| - | IgnoreRhosts yes | ||
| - | RhostsRSAAuthentication no | ||
| - | HostbasedAuthentication no | ||
| - | PermitEmptyPasswords no | ||
| - | ChallengeResponseAuthentication no | ||
| - | X11DisplayOffset 10 | ||
| - | PrintMotd no | ||
| - | PrintLastLog yes | ||
| - | TCPKeepAlive yes | ||
| - | AcceptEnv LANG LC_* | ||
| - | Subsystem sftp / | ||
| - | UsePAM yes | ||
| - | </ | ||
| - | |||
| - | <WRAP center round todo> | ||
| - | **A Faire** - Renommez le fichier **/ | ||
| - | </ | ||
| - | |||
| - | Saisissez maintenant les commandes suivantes en tant que **trainee** : | ||
| - | |||
| - | <WRAP center round important> | ||
| - | Lors de la génération des clefs, la passphrase doit être **vide**. | ||
| - | </ | ||
| - | |||
| - | < | ||
| - | trainee@debian8: | ||
| - | Generating public/ | ||
| - | Enter file in which to save the key (/ | ||
| - | Created directory '/ | ||
| - | Enter passphrase (empty for no passphrase): | ||
| - | Enter same passphrase again: | ||
| - | Your identification has been saved in / | ||
| - | Your public key has been saved in / | ||
| - | The key fingerprint is: | ||
| - | 07: | ||
| - | The key's randomart image is: | ||
| - | +---[DSA 1024]----+ | ||
| - | | | | ||
| - | | . . | | ||
| - | | + | | ||
| - | | | ||
| - | | . .S o | | ||
| - | |o E o. + | | ||
| - | |++ o +o | | ||
| - | |= = . +.oo | | ||
| - | |.+ . | ||
| - | +-----------------+ | ||
| - | trainee@debian8: | ||
| - | Generating public/ | ||
| - | Enter file in which to save the key (/ | ||
| - | Enter passphrase (empty for no passphrase): | ||
| - | Enter same passphrase again: | ||
| - | Your identification has been saved in / | ||
| - | Your public key has been saved in / | ||
| - | The key fingerprint is: | ||
| - | 75: | ||
| - | The key's randomart image is: | ||
| - | +---[RSA 2048]----+ | ||
| - | | . oo.. | | ||
| - | | . ...o . | | ||
| - | | | ||
| - | | . . + . | | ||
| - | | .S. . . | | ||
| - | | . . . .o . | | ||
| - | | | ||
| - | | ..*. | | ||
| - | | .=o+. | | ||
| - | +-----------------+ | ||
| - | trainee@debian8: | ||
| - | Generating public/ | ||
| - | Enter file in which to save the key (/ | ||
| - | Enter passphrase (empty for no passphrase): | ||
| - | Enter same passphrase again: | ||
| - | Your identification has been saved in / | ||
| - | Your public key has been saved in / | ||
| - | The key fingerprint is: | ||
| - | 66: | ||
| - | The key's randomart image is: | ||
| - | +---[ECDSA 256]---+ | ||
| - | | | ||
| - | | | ||
| - | | o.. . | | ||
| - | | oo . + | | ||
| - | | S+ . = | | ||
| - | | | ||
| - | | + + + | | ||
| - | | * E + | | ||
| - | | o . | | ||
| - | +-----------------+ | ||
| - | trainee@debian8: | ||
| - | Generating public/ | ||
| - | Enter file in which to save the key (/ | ||
| - | Enter passphrase (empty for no passphrase): | ||
| - | Enter same passphrase again: | ||
| - | Your identification has been saved in / | ||
| - | Your public key has been saved in / | ||
| - | The key fingerprint is: | ||
| - | 92: | ||
| - | The key's randomart image is: | ||
| - | +--[ED25519 256]--+ | ||
| - | | ++| | ||
| - | | | ||
| - | | + . + + +o.| | ||
| - | | . + . B + | | ||
| - | | o S | ||
| - | | | ||
| - | | . | | ||
| - | | | | ||
| - | | | | ||
| - | +-----------------+ | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important> | ||
| - | Les clés générées seront placées dans le répertoire **~/ | ||
| - | </ | ||
| ===Utilisation=== | ===Utilisation=== | ||
| - | La commande ssh prend la forme suivante: | + | Dans l' |
| - | + | ||
| - | ssh -l nom_de_compte numero_ip (nom_de_machine) | + | |
| - | + | ||
| - | En saisissant cette commande sur votre propre machine, vous obtiendrez | + | |
| < | < | ||
| - | trainee@debian8:~$ su - | + | [root@centos7 |
| - | Password: fenestros | + | Ncat: Version 6.40 ( http:// |
| + | libnsock nsi_new2(): nsi_new (IOD #1) | ||
| + | libnsock nsock_connect_tcp(): | ||
| + | libnsock nsock_trace_handler_callback(): | ||
| + | Ncat: Connection refused. | ||
| - | root@debian8:~# ssh -l trainee localhost | + | [root@centos7 |
| - | The authenticity of host ' | + | Ncat: Version 6.40 ( http:// |
| - | ECDSA key fingerprint is 79:00:60:0e:2b:71:5e: | + | libnsock nsi_new2(): nsi_new (IOD #1) |
| - | Are you sure you want to continue connecting | + | libnsock nsock_connect_tcp(): TCP connection requested to 127.0.0.1:25 (IOD #1) EID 8 |
| - | Warning: Permanently added ' | + | libnsock nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [127.0.0.1:25] |
| - | trainee@localhost' | + | Ncat: Connected to 127.0.0.1:25. |
| - | + | libnsock nsi_new2(): nsi_new | |
| - | The programs included with the Debian GNU/Linux system are free software; | + | libnsock nsock_read(): Read request from IOD #1 [127.0.0.1:25] (timeout: -1ms) EID 18 |
| - | the exact distribution terms for each program are described in the | + | libnsock nsock_readbytes(): Read request for 0 bytes from IOD #2 [peer unspecified] EID 26 |
| - | individual files in / | + | libnsock nsock_trace_handler_callback(): |
| - | + | 220 centos7.fenestros.loc ESMTP Postfix | |
| - | Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent | + | libnsock nsock_readbytes(): Read request for 0 bytes from IOD #1 [127.0.0.1:25] EID 34 |
| - | permitted by applicable law. | + | ^C |
| - | Last login: Sun Aug 7 08:17:07 2016 from 10.0.2.2 | + | |
| - | + | ||
| - | trainee@debian8:~$ pwd | + | |
| - | / | + | |
| - | + | ||
| - | trainee@debian8:~$ whoami | + | |
| - | trainee | + | |
| - | + | ||
| - | trainee@debian8:~$ exit | + | |
| - | logout | + | |
| - | Connection to localhost closed. | + | |
| </ | </ | ||
| - | ====Tunnels SSH==== | + | <WRAP center round important 50%> |
| + | **Important** - Notez que **netcat** se connecte au port 25 qui est ouvert. | ||
| + | </ | ||
| - | Le protocole SSH peut être utilisé pour sécuriser les protocoles tels telnet, pop3 etc.. En effet, on peut créer un //tunnel// SSH dans lequel passe les communications du protocole non-sécurisé. | + | =====LAB #5 - Utilisation de tcpdump===== |
| - | La commande pour créer un tunnel ssh prend la forme suivante : | + | Le logiciel **tcpdump** sert à écouter le réseau en interceptant les paquets. |
| - | ssh -N -f compte@hôte -Lport-local: | + | Les options de cette commande sont : |
| - | + | ||
| - | Dans votre cas, vous allez créer un tunnel dans votre propre vm entre le port 15023 et le port 23 : | + | |
| < | < | ||
| - | root@debian8:~# ssh -N -f trainee@localhost | + | [root@centos7 |
| - | trainee@localhost' | + | tcpdump version 4.9.2 |
| + | libpcap version 1.5.3 | ||
| + | OpenSSL 1.0.2k-fips 26 Jan 2017 | ||
| + | Usage: tcpdump [-aAbdDefhHIJKlLnNOpqStuUvxX# | ||
| + | [ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ] | ||
| + | [ -i interface ] [ -j tstamptype ] [ -M secret ] [ --number ] | ||
| + | [ -Q|-P in|out|inout ] | ||
| + | [ -r file ] [ -s snaplen ] [ --time-stamp-precision precision ] | ||
| + | [ --immediate-mode ] [ -T type ] [ --version ] [ -V file ] | ||
| + | [ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z postrotate-command ] | ||
| + | [ -Z user ] [ expression ] | ||
| </ | </ | ||
| - | Installez maintenant le serveur telnet : | + | ====5.1 - Utilisation==== |
| - | < | + | ===L' |
| - | root@debian8: | + | |
| - | Reading package lists... Done | + | |
| - | Building dependency tree | + | |
| - | Reading state information... Done | + | |
| - | The following extra packages will be installed: | + | |
| - | openbsd-inetd | + | |
| - | The following NEW packages will be installed: | + | |
| - | openbsd-inetd telnetd | + | |
| - | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. | + | |
| - | Need to get 80.0 kB of archives. | + | |
| - | After this operation, 289 kB of additional disk space will be used. | + | |
| - | Do you want to continue? [Y/n] y | + | |
| - | Get:1 http:// | + | |
| - | Get:2 http:// | + | |
| - | Fetched 80.0 kB in 0s (585 kB/s) | + | |
| - | Selecting previously unselected package openbsd-inetd. | + | |
| - | (Reading database ... 82450 files and directories currently installed.) | + | |
| - | Preparing to unpack .../ | + | |
| - | Unpacking openbsd-inetd (0.20140418-2) ... | + | |
| - | Selecting previously unselected package telnetd. | + | |
| - | Preparing to unpack .../ | + | |
| - | Unpacking telnetd (0.17-36) ... | + | |
| - | Processing triggers for systemd (215-17+deb8u4) ... | + | |
| - | Processing triggers for man-db (2.7.0.2-5) ... | + | |
| - | Setting up openbsd-inetd (0.20140418-2) ... | + | |
| - | Setting up telnetd (0.17-36) ... | + | |
| - | Adding user telnetd to group utmp | + | |
| - | Processing triggers for systemd (215-17+deb8u4) ... | + | |
| - | </ | + | |
| - | Connectez-vous ensuite via telnet | + | Pour écouter |
| < | < | ||
| - | root@debian8:~# telnet localhost 15023 | + | [root@centos7 |
| - | Trying | + | tcpdump: verbose output suppressed, use -v or -vv for full protocol decode |
| - | Connected to localhost. | + | listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes |
| - | Escape character is ' | + | 01:32:57.800710 IP centos7.fenestros.loc.ssh > gateway.36360: Flags [P.], seq 2207704927: |
| - | Debian GNU/Linux 8 | + | 01:32: |
| - | debian8 login: trainee | + | 01:32: |
| - | Password: | + | 01:32:57.862866 IP google-public-dns-a.google.com.domain > centos7.fenestros.loc.45319: 62187 NXDomain 0/0/0 (39) |
| - | Last login: Sun Aug 7 09:30:13 BST 2016 from localhost on pts/1 | + | 01:32:57.873506 IP centos7.fenestros.loc.54658 > google-public-dns-a.google.com.domain: 6854+ PTR? 15.2.0.10.in-addr.arpa. (40) |
| - | Linux debian8 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt25-2 (2016-04-08) x86_64 | + | 01: |
| - | + | 01: | |
| - | The programs included with the Debian GNU/Linux system are free software; | + | 01: |
| - | the exact distribution terms for each program are described in the | + | 01: |
| - | individual files in /usr/share/doc/ | + | 01: |
| - | + | 01: | |
| - | Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent | + | 01: |
| - | permitted by applicable law. | + | 01:32:58.028108 IP gateway.36360 > centos7.fenestros.loc.ssh: |
| - | + | 01: | |
| - | trainee@debian8:~$ pwd | + | 01:32: |
| - | / | + | 01: |
| - | + | 01: | |
| - | trainee@debian8:~$ whoami | + | 01:32: |
| - | trainee | + | 01: |
| - | + | 01: | |
| - | trainee@debian8:~$ exit | + | 01:32: |
| - | logout | + | 01: |
| - | Connection closed by foreign host. | + | ... |
| </ | </ | ||
| - | <WRAP center round important> | + | Notez qu' |
| - | Notez bien que votre communication telnet passe par le tunnel SSH. | + | |
| - | </ | + | |
| - | + | ||
| - | ====SCP==== | + | |
| - | + | ||
| - | ===Introduction=== | + | |
| - | + | ||
| - | La commande **scp** est le successeur et la remplaçante de la commande **rcp** de la famille des commandes **remote**. Il permet de faire des transferts sécurisés à partir d'une machine distante : | + | |
| - | + | ||
| - | $ scp compte@numero_ip(nom_de_machine):/ | + | |
| - | + | ||
| - | ou vers une machine distante : | + | |
| - | + | ||
| - | $ scp / | + | |
| - | + | ||
| - | ===Utilisation=== | + | |
| - | + | ||
| - | Nous allons maintenant utiliser **scp** pour chercher | + | |
| - | + | ||
| - | Créez le fichier **/ | + | |
| < | < | ||
| - | root@debian8: | + | ... |
| - | logout | + | ^C |
| - | + | 767 packets captured | |
| - | trainee@debian8: | + | 767 packets received by filter |
| - | / | + | 0 packets dropped by kernel |
| - | + | ||
| - | trainee@debian8: | + | |
| </ | </ | ||
| - | Récupérez le fichier **scp_test** en utilisant scp : | + | ===L' |
| - | < | + | Pour écouter |
| - | trainee@debian8: | + | |
| - | The authenticity of host ' | + | |
| - | ECDSA key fingerprint is 79: | + | |
| - | Are you sure you want to continue connecting (yes/no)? yes | + | |
| - | Warning: Permanently added ' | + | |
| - | trainee@127.0.0.1' | + | |
| - | scp_test | + | |
| - | + | ||
| - | trainee@debian8: | + | |
| - | / | + | |
| - | + | ||
| - | </ | + | |
| - | + | ||
| - | ==Mise en place des clefs== | + | |
| - | + | ||
| - | Il convient maintenant de se connecter | + | |
| - | + | ||
| - | En saisissant cette commande, vous obtiendrez une fenêtre similaire à celle-ci : | + | |
| < | < | ||
| - | trainee@debian8:~$ ssh -l trainee 127.0.0.1 | + | [root@centos7 |
| - | trainee@127.0.0.1's password: trainee | + | tcpdump: verbose output suppressed, use -v or -vv for full protocol decode |
| + | listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes | ||
| + | 01:34:55.540011 IP centos7.fenestros.loc.ssh > gateway.36360: | ||
| + | 0x0000: | ||
| + | 0x0010: | ||
| + | 0x0020: | ||
| + | 0x0030: | ||
| + | 0x0040: | ||
| + | 0x0050: | ||
| + | 0x0060: | ||
| + | 0x0070: | ||
| + | 0x0080: | ||
| + | 0x0090: | ||
| + | 0x00a0: | ||
| + | 0x00b0: | ||
| + | 0x00c0: | ||
| + | 0x00d0: | ||
| + | 0x00e0: | ||
| + | 01:34:55.540618 IP gateway.36360 > centos7.fenestros.loc.ssh: | ||
| + | 0x0000: | ||
| + | 0x0010: | ||
| + | 0x0020: | ||
| + | ^C01: | ||
| + | 0x0000: | ||
| + | 0x0010: | ||
| + | 0x0020: | ||
| + | 0x0030: | ||
| + | 0x0040: 0c00 01 | ||
| - | The programs included with the Debian GNU/Linux system are free software; | + | 3 packets captured |
| - | the exact distribution terms for each program are described in the | + | 21 packets received |
| - | individual files in / | + | 0 packets dropped by kernel |
| - | + | ||
| - | Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent | + | |
| - | permitted | + | |
| - | Last login: Sun Aug 7 09:36:15 2016 from localhost | + | |
| - | + | ||
| - | trainee@debian8: | + | |
| - | drwx------ | + | |
| - | trainee@debian8: | + | |
| - | logout | + | |
| - | Connection to 127.0.0.1 closed. | + | |
| </ | </ | ||
| - | <WRAP center round important> | + | ===L'option -X=== |
| - | Si le dossier distant .ssh n'existe pas dans le répertoire personnel de l' | + | |
| - | </ | + | |
| - | Ensuite, il convient de transférer | + | Pour écouter sur une interface spécifique et voir le contenu |
| < | < | ||
| - | trainee@debian8:~$ scp .ssh/id_ecdsa.pub trainee@127.0.0.1:/ | + | [root@centos7 |
| - | trainee@127.0.0.1's password: | + | tcpdump: verbose output suppressed, use -v or -vv for full protocol decode |
| - | id_ecdsa.pub 100% 177 0.2KB/s 00:00 | + | listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes |
| - | </code> | + | 01: |
| + | 0x0000: | ||
| + | 0x0010: | ||
| + | 0x0020: | ||
| + | 0x0030: | ||
| + | 0x0040: | ||
| + | 0x0050: | ||
| + | 0x0060: | ||
| + | 0x0070: | ||
| + | 0x0080: | ||
| + | 0x0090: | ||
| + | 0x00a0: 988b e3b1 444e ab24 e1b0 3eb8 ffa7 ae3f | ||
| + | 0x00b0: | ||
| + | 0x00c0: | ||
| + | 0x00d0: | ||
| + | 0x00e0: | ||
| + | 01:35: | ||
| + | 0x0000: | ||
| + | 0x0010: | ||
| + | 0x0020: | ||
| + | ^C01: | ||
| + | 0x0000: 4500 0043 188e 4000 4011 05fe 0a00 020f E..C..@.@....... | ||
| + | 0x0010: | ||
| + | 0x0020: | ||
| + | 0x0030: | ||
| + | 0x0040: | ||
| - | <WRAP center round important> | + | 3 packets captured |
| - | **Important** : Le fichier **authorized_keys** doit avoir les permissions de 600. | + | 13 packets received by filter |
| - | </ | + | 0 packets dropped |
| - | + | ||
| - | + | ||
| - | Connectez-vous via telnet et insérer les clefs publiques restantes dans le fichier .ssh/ | + | |
| - | + | ||
| - | < | + | |
| - | trainee@debian8: | + | |
| - | The authenticity of host ' | + | |
| - | ECDSA key fingerprint is 79: | + | |
| - | Are you sure you want to continue connecting (yes/no)? yes | + | |
| - | Warning: Permanently added ' | + | |
| - | + | ||
| - | The programs included with the Debian GNU/Linux system are free software; | + | |
| - | the exact distribution terms for each program are described in the | + | |
| - | individual files in / | + | |
| - | + | ||
| - | Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent | + | |
| - | permitted | + | |
| - | Last login: Sun Aug 7 09:39:27 2016 from localhost | + | |
| - | trainee@debian8: | + | |
| - | trainee@debian8: | + | |
| - | trainee@debian8: | + | |
| - | trainee@debian8: | + | |
| - | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGdOSQvO1nuPdg5FqzsdwD2l6JuylCDjguGV89prpCYndSaNDyLzE8qV2lHNy8Nk+026oDSyceTOJMJ56rzCVpM= trainee@debian8 | + | |
| - | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdVGlmhx8NjbSOk4DHFcUU/ | + | |
| - | ssh-dss AAAAB3NzaC1kc3MAAACBAP0CgPkPk5tkJeZC3bmB+7yuSjWzdeNF3WeKKxd6YRfHwYVtTWbpw5VMBEGQVVTLtozGmSaZXI2rcL2ZjLRKu2PrWMXMHNptu+5xD1B7obRutzNa0wzxRuwyI7Ducq8PK53nbm56M4GormuZmc/ | + | |
| - | ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOmyQOP1WnEAbS/ | + | |
| </ | </ | ||
| - | <WRAP center round important> | + | ===L'option -w=== |
| - | **Important** : Notez que l'authentification a utilisé le couple de clefs asymétrique et aucun mot de passe n'a été requis. | + | |
| - | </ | + | |
| - | =====Le Parefeu Netfilter===== | + | Pour écouter sur une interface |
| - | + | ||
| - | ====Configuration du Pare-feu Netfilter/ | + | |
| - | + | ||
| - | ===Introduction=== | + | |
| - | + | ||
| - | **Netfilter** est composé de 5 //hooks// : | + | |
| - | + | ||
| - | * NF_IP_PRE_ROUTING | + | |
| - | * NF_IP_LOCAL_IN | + | |
| - | * NF_IP_LOCAL_OUT | + | |
| - | * NF_IP_FORWARD | + | |
| - | * NF_IP_POSTROUTING | + | |
| - | + | ||
| - | Ces hooks sont utilisés par deux branches, la première est celle concernée par les paquets qui entrent vers des services locaux : | + | |
| - | + | ||
| - | * NF_IP_PRE_ROUTING > NF_IP_LOCAL_IN > NF_IP_LOCAL_OUT > NF_IP_POSTROUTING | + | |
| - | + | ||
| - | tandis que la deuxième concerne les paquets qui traversent la passerelle: | + | |
| - | + | ||
| - | * NF_IP_PRE_ROUTING > NF_IP_FORWARD > NF_IP_POSTROUTING | + | |
| - | + | ||
| - | Si IPTABLES a été compilé en tant que module, son utilisation nécessite le chargement de plusieurs modules supplémentaires en fonction de la situation: | + | |
| - | + | ||
| - | * iptable_filter | + | |
| - | * iptable_mangle | + | |
| - | * iptable_net | + | |
| - | * etc | + | |
| - | + | ||
| - | Netfilter est organisé en **tables**. La commande **iptables** de netfilter permet d' | + | |
| - | + | ||
| - | * La table **FILTER** | + | |
| - | * La chaîne INPUT | + | |
| - | * Concerne les paquets entrants | + | |
| - | * Policies: ACCEPT, DROP, REJECT | + | |
| - | * La chaîne OUTPUT | + | |
| - | * Concerne les paquets sortants | + | |
| - | * Policies: ACCEPT, DROP, REJECT | + | |
| - | * La chaîne FORWARD | + | |
| - | * Concerne les paquets traversant le par-feu. | + | |
| - | * Policies: ACCEPT, DROP, REJECT | + | |
| - | + | ||
| - | Si aucune table n'est précisée, c'est la table FILTER qui s' | + | |
| - | + | ||
| - | * La table **NAT** | + | |
| - | * La chaîne PREROUTING | + | |
| - | * Permet de faire la translation d' | + | |
| - | * Cibles: SNAT, DNAT, MASQUERADE | + | |
| - | * La chaîne POSTROUTING | + | |
| - | * Permet de faire la translation d' | + | |
| - | * Cibles: SNAT, DNAT, MASQUERADE | + | |
| - | * Le cas spécifique | + | |
| - | * Permet la modification de la destination des paquets générés localement | + | |
| - | + | ||
| - | * La table **MANGLE** | + | |
| - | * Permet le marquage de paquets générés localement (OUTPUT) | + | |
| - | + | ||
| - | Les **policies** sont: | + | |
| - | + | ||
| - | * ACCEPT | + | |
| - | * Permet d' | + | |
| - | * DROP | + | |
| - | * Permet de rejeter le paquet concerné sans générer un message d' | + | |
| - | * REJECT | + | |
| - | * Permet de rejeter le paquet concerné en générant une message d' | + | |
| - | + | ||
| - | Les **cibles** sont: | + | |
| - | + | ||
| - | * SNAT | + | |
| - | * Permet de modifier l' | + | |
| - | * DNAT | + | |
| - | * Permet de modifier l' | + | |
| - | * MASQUERADE | + | |
| - | * Permet de remplacer l' | + | |
| - | + | ||
| - | IPTABLES peut être configuré soit par des outils tels shorewall, soit en utilisant des lignes de commandes ou un script. Dans ce dernier cas, la ligne prend la forme: | + | |
| - | + | ||
| - | # IPTABLES --action CHAINE --option1 --option2 | + | |
| - | + | ||
| - | Les actions sont: | + | |
| - | + | ||
| - | ^ Action | + | |
| - | | - -append | -A | Ajouter une règle à la fin de la chaîne spécifiée | | + | |
| - | | - -delete | -D | Supprimer une règle en spécifiant son numéro ou la règle à supprimer | | + | |
| - | | - -replace | -R | Permet de remplacer la règle spécifée par son numéro | | + | |
| - | | - -insert | -I | Permet d' | + | |
| - | | - -list | -L | Permet d' | + | |
| - | | - -flush | -F | Permet de vider toutes | + | |
| - | + | ||
| - | Les options | + | |
| - | + | ||
| - | ^ Option | + | |
| - | | - -protocol | -p | Permet de spécifier un protocol - tcp, udp, icmp, all | | + | |
| - | | - -source | -s | Permet de spécifier une adresse source | | + | |
| - | | - -destination | -d | Permet de spécifier une adresse de destination | | + | |
| - | | - -in-interface | | + | |
| - | | - -out-interface | -o | Permet de spécifier une interface réseau de sortie | | + | |
| - | | - -fragment | -f | Permet de ne spécifier que les paquets fragmentés | | + | |
| - | | - -source-port | -sport | + | |
| - | | - -destination-port | -dport | + | |
| - | | - -tcp-flags | s/o | Permet de spécifier un flag TCP à matcher - SYN, ACK, FIN, RST, URG, PSH, ALL, NONE | | + | |
| - | | - -icmp-type | s/o | Permet de spécifier un type de paquet ICMP | | + | |
| - | | - -mac-source | s/o | Permet de spécifier une adresse MAC | | + | |
| - | + | ||
| - | Les options spécifiques à NET sont: | + | |
| - | + | ||
| - | | - -to-destination | s/o | Permet de spécifier l' | + | |
| - | | - -to-source | s/o | Permet spécifier l' | + | |
| - | + | ||
| - | Les options spécifiques aux LOGS sont: | + | |
| - | + | ||
| - | | - -log-level | s/o | Permet de spécifier le niveau de logs | | + | |
| - | | - -log-prefix | s/o | Permet de spécifier un préfix pour les logs | | + | |
| - | + | ||
| - | L' | + | |
| - | + | ||
| - | | - -state | s/o | Permet de spécifier l' | + | |
| - | + | ||
| - | Ce dernier cas fait référence au STATEFUL. Le STATEFUL est la capacité du par-feu à enregistrer dans une table spécifique, | + | |
| - | + | ||
| - | Il existe 4 états: | + | |
| - | + | ||
| - | | + | |
| - | | + | |
| - | * ESTABLISHED | + | |
| - | * Le paquet concerne une connexion déjà établie. Le paquet ne doit contenir **ni** flag SYN à 1, **ni** flag FIN à 1 | + | |
| - | * RELATED | + | |
| - | * Le paquet est d'une connexion qui présente une relation avec une autre connexion | + | |
| - | * INVALID | + | |
| - | * La paquet provient d'une connexion anormale. | + | |
| - | + | ||
| - | ===Configuration par Scripts sous Debian 6 et 7=== | + | |
| - | + | ||
| - | Dans l' | + | |
| - | + | ||
| - | < | + | |
| - | # | + | |
| - | ##################################### | + | |
| - | # proxy server IP | + | |
| - | PROXY_SERVER=" | + | |
| - | # Interface connected to Internet | + | |
| - | INTERNET=" | + | |
| - | # Interface connected to LAN | + | |
| - | LAN_IN=" | + | |
| - | # Local Interface | + | |
| - | LOCAL=" | + | |
| - | # Squid port | + | |
| - | PROXY_PORT=" | + | |
| - | # DO NOT MODIFY BELOW | + | |
| - | # Clean old firewall | + | |
| - | iptables -F | + | |
| - | iptables -X | + | |
| - | iptables -t nat -F | + | |
| - | iptables -t nat -X | + | |
| - | iptables -t mangle -F | + | |
| - | iptables -t mangle -X | + | |
| - | # Load IPTABLES modules for NAT and IP conntrack support | + | |
| - | modprobe ip_conntrack | + | |
| - | modprobe ip_conntrack_ftp | + | |
| - | # For win xp ftp client | + | |
| - | modprobe ip_nat_ftp | + | |
| - | echo 1 > / | + | |
| - | # Setting default filter policy | + | |
| - | iptables -P INPUT DROP | + | |
| - | iptables -P OUTPUT ACCEPT | + | |
| - | # Unlimited access to loop back | + | |
| - | iptables -A INPUT -i lo -j ACCEPT | + | |
| - | iptables -A OUTPUT -o lo -j ACCEPT | + | |
| - | # Allow UDP, DNS and Passive FTP | + | |
| - | iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED, | + | |
| - | # set this system as a router for Rest of LAN | + | |
| - | iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE | + | |
| - | iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT | + | |
| - | # unlimited access to LAN | + | |
| - | iptables -A INPUT -i $LAN_IN -j ACCEPT | + | |
| - | iptables -A OUTPUT -o $LAN_IN -j ACCEPT | + | |
| - | # DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy | + | |
| - | iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $PROXY_SERVER: | + | |
| - | # iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -j REDIRECT --to-port 3128 | + | |
| - | # if it is same system | + | |
| - | iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $PROXY_PORT | + | |
| - | # DROP everything and Log it | + | |
| - | iptables -A INPUT -j LOG | + | |
| - | iptables -A INPUT -j DROP | + | |
| - | </ | + | |
| - | + | ||
| - | Dans l' | + | |
| < | < | ||
| - | #!/bin/sh | + | [root@centos7 ~]# tcpdump |
| - | # | + | tcpdump: listening |
| - | # Generated iptables firewall script for the Linux 2.4 kernel | + | ^C45 packets |
| - | # Script generated by Easy Firewall Generator for IPTables 1.15 | + | 45 packets |
| - | # copyright 2002 Timothy Scott Morizot | + | 0 packets dropped by kernel |
| - | # | + | |
| - | # Redhat chkconfig comments - firewall applied early, | + | |
| - | # | + | |
| - | # chkconfig: 2345 08 92 | + | |
| - | # description: | + | |
| - | # | + | |
| - | # This generator is primarily designed for RedHat installations, | + | |
| - | # although it should be adaptable for others. | + | |
| - | # | + | |
| - | # It can be executed with the typical start and stop arguments. | + | |
| - | # If used with stop, it will stop after flushing the firewall. | + | |
| - | # The save and restore arguments will save or restore the rules | + | |
| - | # from the / | + | |
| - | # arguments are included to preserve compatibility with | + | |
| - | # Redhat' | + | |
| - | + | ||
| - | # Redhat/ | + | |
| - | # | + | |
| - | # 1. Have the system link the iptables init.d startup script into run states | + | |
| - | # 2, 3, and 5. | + | |
| - | # chkconfig --level 235 iptables on | + | |
| - | # | + | |
| - | # 2. Save this script and execute it to load the ruleset from this file. | + | |
| - | # You may need to run the dos2unix command on it to remove carraige returns. | + | |
| - | # | + | |
| - | # 3. To have it applied at startup, copy this script to | + | |
| - | # / | + | |
| - | # arguments. | + | |
| - | # Alternatively, | + | |
| - | # the init.d script should save the rules and reload them at runtime. | + | |
| - | # | + | |
| - | # 4. For non-Redhat systems (or Redhat systems if you have a problem), you | + | |
| - | # may want to append the command to execute this script to rc.local. | + | |
| - | # rc.local is typically located in /etc and /etc/rc.d and is usually | + | |
| - | # the last thing executed on startup. | + | |
| - | # on its own line in the rc.local file. | + | |
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # Local Settings | + | |
| - | # | + | |
| - | + | ||
| - | # sysctl location. | + | |
| - | # If this is set to the empty string (or is unset), the use of sysctl | + | |
| - | # is disabled. | + | |
| - | + | ||
| - | SYSCTL="/ | + | |
| - | + | ||
| - | # To echo the value directly to the /proc file instead | + | |
| - | # SYSCTL="" | + | |
| - | + | ||
| - | # IPTables Location - adjust if needed | + | |
| - | + | ||
| - | IPT="/ | + | |
| - | IPTS="/ | + | |
| - | IPTR="/ | + | |
| - | + | ||
| - | # Internet Interface | + | |
| - | INET_IFACE=" | + | |
| - | + | ||
| - | # Local Interface Information | + | |
| - | LOCAL_IFACE=" | + | |
| - | LOCAL_IP=" | + | |
| - | LOCAL_NET=" | + | |
| - | LOCAL_BCAST=" | + | |
| - | + | ||
| - | # Localhost Interface | + | |
| - | + | ||
| - | LO_IFACE=" | + | |
| - | LO_IP=" | + | |
| - | + | ||
| - | # Save and Restore arguments handled here | + | |
| - | if [ " | + | |
| - | then | + | |
| - | echo -n " | + | |
| - | $IPTS > / | + | |
| - | echo " | + | |
| - | exit 0 | + | |
| - | elif [ " | + | |
| - | then | + | |
| - | echo -n " | + | |
| - | $IPTR < / | + | |
| - | echo " | + | |
| - | exit 0 | + | |
| - | fi | + | |
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # Load Modules | + | |
| - | # | + | |
| - | + | ||
| - | echo " | + | |
| - | + | ||
| - | # You should uncomment the line below and run it the first time just to | + | |
| - | # ensure all kernel module dependencies are OK. There is no need to run | + | |
| - | # every time, however. | + | |
| - | + | ||
| - | # / | + | |
| - | + | ||
| - | # Unless you have kernel module auto-loading disabled, you should not | + | |
| - | # need to manually load each of these modules. | + | |
| - | # ip_conntrack, | + | |
| - | # commented by default. | + | |
| - | # you have disabled module autoload. | + | |
| - | # be loaded by another kernel module. | + | |
| - | + | ||
| - | # core netfilter module | + | |
| - | / | + | |
| - | + | ||
| - | # the stateful connection tracking module | + | |
| - | / | + | |
| - | + | ||
| - | # filter table module | + | |
| - | # / | + | |
| - | + | ||
| - | # mangle table module | + | |
| - | # / | + | |
| - | + | ||
| - | # nat table module | + | |
| - | # / | + | |
| - | + | ||
| - | # LOG target module | + | |
| - | # / | + | |
| - | + | ||
| - | # This is used to limit the number of packets per sec/ | + | |
| - | # / | + | |
| - | + | ||
| - | # masquerade target module | + | |
| - | # / | + | |
| - | + | ||
| - | # filter using owner as part of the match | + | |
| - | # / | + | |
| - | Importez une machine virtuelle vierge de CentOS 6 pour effectuer le LABS #8. | + | |
| - | </ | + | |
| - | + | ||
| - | # REJECT target drops the packet and returns an ICMP response. | + | |
| - | # The response is configurable. | + | |
| - | # / | + | |
| - | + | ||
| - | # This target allows packets to be marked in the mangle table | + | |
| - | # / | + | |
| - | + | ||
| - | # This target affects the TCP MSS | + | |
| - | # / | + | |
| - | + | ||
| - | # This match allows multiple ports instead of a single port or range | + | |
| - | # / | + | |
| - | + | ||
| - | # This match checks against the TCP flags | + | |
| - | # / | + | |
| - | + | ||
| - | # This match catches packets with invalid flags | + | |
| - | # / | + | |
| - | + | ||
| - | # The ftp nat module is required for non-PASV ftp support | + | |
| - | / | + | |
| - | + | ||
| - | # the module for full ftp connection tracking | + | |
| - | / | + | |
| - | + | ||
| - | # the module for full irc connection tracking | + | |
| - | / | + | |
| - | + | ||
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # Kernel Parameter Configuration | + | |
| - | # | + | |
| - | # See http:// | + | |
| - | # for a detailed tutorial on sysctl and the various settings | + | |
| - | # available. | + | |
| - | + | ||
| - | # Required to enable IPv4 forwarding. | + | |
| - | # Redhat users can try setting FORWARD_IPV4 in / | + | |
| - | # Alternatively, | + | |
| - | if [ " | + | |
| - | then | + | |
| - | echo " | + | |
| - | else | + | |
| - | $SYSCTL net.ipv4.ip_forward=" | + | |
| - | fi | + | |
| - | + | ||
| - | # This enables dynamic address hacking. | + | |
| - | # This may help if you have a dynamic IP address \(e.g. slip, ppp, dhcp\). | + | |
| - | #if [ " | + | |
| - | #then | + | |
| - | # echo " | + | |
| - | #else | + | |
| - | # $SYSCTL net.ipv4.ip_dynaddr=" | + | |
| - | #fi | + | |
| - | + | ||
| - | # This enables SYN flood protection. | + | |
| - | # The SYN cookies activation allows your system to accept an unlimited | + | |
| - | # number of TCP connections while still trying to give reasonable | + | |
| - | # service during a denial of service attack. | + | |
| - | if [ " | + | |
| - | then | + | |
| - | echo " | + | |
| - | else | + | |
| - | $SYSCTL net.ipv4.tcp_syncookies=" | + | |
| - | fi | + | |
| - | + | ||
| - | # This enables source validation by reversed path according to RFC1812. | + | |
| - | # In other words, did the response packet originate from the same interface | + | |
| - | # through which the source packet was sent? It's recommended for single-homed | + | |
| - | # systems and routers on stub networks. | + | |
| - | # this firewall is designed to support, I turn it on by default. | + | |
| - | # Turn it off if you use multiple NICs connected to the same network. | + | |
| - | if [ " | + | |
| - | then | + | |
| - | echo " | + | |
| - | else | + | |
| - | $SYSCTL net.ipv4.conf.all.rp_filter=" | + | |
| - | fi | + | |
| - | + | ||
| - | # This option allows a subnet to be firewalled with a single IP address. | + | |
| - | # It's used to build a DMZ. Since that's not a focus of this firewall | + | |
| - | # script, it's not enabled by default, but is included for reference. | + | |
| - | # See: http:// | + | |
| - | #if [ " | + | |
| - | #then | + | |
| - | # echo " | + | |
| - | #else | + | |
| - | # $SYSCTL net.ipv4.conf.all.proxy_arp=" | + | |
| - | #fi | + | |
| - | + | ||
| - | # The following kernel settings were suggested by Alex Weeks. Thanks! | + | |
| - | + | ||
| - | # This kernel parameter instructs the kernel to ignore all ICMP | + | |
| - | # echo requests sent to the broadcast address. | + | |
| - | # a number of smurfs and similar DoS nasty attacks. | + | |
| - | if [ " | + | |
| - | then | + | |
| - | echo " | + | |
| - | else | + | |
| - | $SYSCTL net.ipv4.icmp_echo_ignore_broadcasts=" | + | |
| - | fi | + | |
| - | + | ||
| - | # This option can be used to accept or refuse source routed | + | |
| - | # packets. | + | |
| - | # considered a security risk. This option turns it off. | + | |
| - | if [ " | + | |
| - | then | + | |
| - | echo " | + | |
| - | else | + | |
| - | $SYSCTL net.ipv4.conf.all.accept_source_route=" | + | |
| - | fi | + | |
| - | + | ||
| - | # This option can disable ICMP redirects. | + | |
| - | # are generally considered a security risk and shouldn' | + | |
| - | # needed by most systems using this generator. | + | |
| - | #if [ " | + | |
| - | #then | + | |
| - | # echo " | + | |
| - | #else | + | |
| - | # $SYSCTL net.ipv4.conf.all.accept_redirects=" | + | |
| - | #fi | + | |
| - | + | ||
| - | # However, we'll ensure the secure_redirects option is on instead. | + | |
| - | # This option accepts only from gateways in the default gateways list. | + | |
| - | if [ " | + | |
| - | then | + | |
| - | echo " | + | |
| - | else | + | |
| - | $SYSCTL net.ipv4.conf.all.secure_redirects=" | + | |
| - | fi | + | |
| - | + | ||
| - | # This option logs packets from impossible addresses. | + | |
| - | if [ " | + | |
| - | then | + | |
| - | echo " | + | |
| - | else | + | |
| - | $SYSCTL net.ipv4.conf.all.log_martians=" | + | |
| - | fi | + | |
| - | + | ||
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # Flush Any Existing Rules or Chains | + | |
| - | # | + | |
| - | + | ||
| - | echo " | + | |
| - | + | ||
| - | # Reset Default Policies | + | |
| - | $IPT -P INPUT ACCEPT | + | |
| - | $IPT -P FORWARD ACCEPT | + | |
| - | $IPT -P OUTPUT ACCEPT | + | |
| - | $IPT -t nat -P PREROUTING ACCEPT | + | |
| - | $IPT -t nat -P POSTROUTING ACCEPT | + | |
| - | $IPT -t nat -P OUTPUT ACCEPT | + | |
| - | $IPT -t mangle -P PREROUTING ACCEPT | + | |
| - | $IPT -t mangle -P OUTPUT ACCEPT | + | |
| - | + | ||
| - | # Flush all rules | + | |
| - | $IPT -F | + | |
| - | $IPT -t nat -F | + | |
| - | $IPT -t mangle -F | + | |
| - | + | ||
| - | # Erase all non-default chains | + | |
| - | $IPT -X | + | |
| - | $IPT -t nat -X | + | |
| - | $IPT -t mangle -X | + | |
| - | + | ||
| - | if [ " | + | |
| - | then | + | |
| - | echo " | + | |
| - | exit 0 | + | |
| - | fi | + | |
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # Rules Configuration | + | |
| - | # | + | |
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # Filter Table | + | |
| - | # | + | |
| - | ############################################################################### | + | |
| - | + | ||
| - | # Set Policies | + | |
| - | + | ||
| - | $IPT -P INPUT DROP | + | |
| - | $IPT -P OUTPUT DROP | + | |
| - | $IPT -P FORWARD DROP | + | |
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # User-Specified Chains | + | |
| - | # | + | |
| - | # Create user chains to reduce the number of rules each packet | + | |
| - | # must traverse. | + | |
| - | + | ||
| - | echo " | + | |
| - | + | ||
| - | # Create a chain to filter INVALID packets | + | |
| - | + | ||
| - | $IPT -N bad_packets | + | |
| - | + | ||
| - | # Create another chain to filter bad tcp packets | + | |
| - | + | ||
| - | $IPT -N bad_tcp_packets | + | |
| - | + | ||
| - | # Create separate chains for icmp, tcp (incoming and outgoing), | + | |
| - | # and incoming udp packets. | + | |
| - | + | ||
| - | $IPT -N icmp_packets | + | |
| - | + | ||
| - | # Used for UDP packets inbound from the Internet | + | |
| - | $IPT -N udp_inbound | + | |
| - | + | ||
| - | # Used to block outbound UDP services from internal network | + | |
| - | # Default to allow all | + | |
| - | $IPT -N udp_outbound | + | |
| - | + | ||
| - | # Used to allow inbound services if desired | + | |
| - | # Default fail except for established sessions | + | |
| - | $IPT -N tcp_inbound | + | |
| - | + | ||
| - | # Used to block outbound services from internal network | + | |
| - | # Default to allow all | + | |
| - | $IPT -N tcp_outbound | + | |
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # Populate User Chains | + | |
| - | # | + | |
| - | + | ||
| - | # bad_packets chain | + | |
| - | # | + | |
| - | + | ||
| - | # Drop packets received on the external interface | + | |
| - | # claiming a source of the local network | + | |
| - | $IPT -A bad_packets -p ALL -i $INET_IFACE -s $LOCAL_NET -j LOG \ | + | |
| - | --log-prefix " | + | |
| - | $IPT -A bad_packets -p ALL -i $INET_IFACE -s $LOCAL_NET -j DROP | + | |
| - | + | ||
| - | # Drop INVALID packets immediately | + | |
| - | $IPT -A bad_packets -p ALL -m state --state INVALID -j LOG \ | + | |
| - | --log-prefix " | + | |
| - | + | ||
| - | $IPT -A bad_packets -p ALL -m state --state INVALID -j DROP | + | |
| - | + | ||
| - | # Then check the tcp packets for additional problems | + | |
| - | $IPT -A bad_packets -p tcp -j bad_tcp_packets | + | |
| - | + | ||
| - | # All good, so return | + | |
| - | $IPT -A bad_packets -p ALL -j RETURN | + | |
| - | + | ||
| - | # bad_tcp_packets chain | + | |
| - | # | + | |
| - | # All tcp packets will traverse this chain. | + | |
| - | # Every new connection attempt should begin with | + | |
| - | # a syn packet. | + | |
| - | # port scan. This drops packets in state | + | |
| - | # NEW that are not flagged as syn packets. | + | |
| - | + | ||
| - | # Return to the calling chain if the bad packets originate | + | |
| - | # from the local interface. This maintains the approach | + | |
| - | # throughout this firewall of a largely trusted internal | + | |
| - | # network. | + | |
| - | $IPT -A bad_tcp_packets -p tcp -i $LOCAL_IFACE -j RETURN | + | |
| - | + | ||
| - | # However, I originally did apply this filter to the forward chain | + | |
| - | # for packets originating from the internal network. | + | |
| - | # not conclusively determined its effect, it appears to have the | + | |
| - | # interesting side effect of blocking some of the ad systems. | + | |
| - | # Apparently some ad systems have the browser initiate a NEW | + | |
| - | # connection that is not flagged as a syn packet to retrieve | + | |
| - | # the ad image. | + | |
| - | # rule above. If you try it, you may also wish to uncomment the | + | |
| - | # rule below. | + | |
| - | # There are a lot of them. | + | |
| - | # $IPT -A bad_tcp_packets -p tcp -i $LOCAL_IFACE ! --syn -m state \ | + | |
| - | # | + | |
| - | + | ||
| - | $IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \ | + | |
| - | --log-prefix " | + | |
| - | $IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP | + | |
| - | + | ||
| - | $IPT -A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j LOG \ | + | |
| - | --log-prefix " | + | |
| - | $IPT -A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j DROP | + | |
| - | + | ||
| - | $IPT -A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j LOG \ | + | |
| - | --log-prefix " | + | |
| - | $IPT -A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j DROP | + | |
| - | + | ||
| - | $IPT -A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j LOG \ | + | |
| - | --log-prefix " | + | |
| - | $IPT -A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP | + | |
| - | + | ||
| - | $IPT -A bad_tcp_packets -p tcp --tcp-flags ALL SYN, | + | |
| - | --log-prefix " | + | |
| - | $IPT -A bad_tcp_packets -p tcp --tcp-flags ALL SYN, | + | |
| - | + | ||
| - | $IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j LOG \ | + | |
| - | --log-prefix " | + | |
| - | $IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j DROP | + | |
| - | + | ||
| - | $IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG \ | + | |
| - | --log-prefix " | + | |
| - | $IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP | + | |
| - | + | ||
| - | # All good, so return | + | |
| - | $IPT -A bad_tcp_packets -p tcp -j RETURN | + | |
| - | + | ||
| - | # icmp_packets chain | + | |
| - | # | + | |
| - | # This chain is for inbound (from the Internet) icmp packets only. | + | |
| - | # Type 8 (Echo Request) is not accepted by default | + | |
| - | # Enable it if you want remote hosts to be able to reach you. | + | |
| - | # 11 (Time Exceeded) is the only one accepted | + | |
| - | # that would not already be covered by the established | + | |
| - | # connection rule. Applied to INPUT on the external interface. | + | |
| - | # | + | |
| - | # See: http:// | + | |
| - | # for more info on ICMP types. | + | |
| - | # | + | |
| - | # Note that the stateful settings allow replies to ICMP packets. | + | |
| - | # These rules allow new packets of the specified types. | + | |
| - | + | ||
| - | # ICMP packets should fit in a Layer 2 frame, thus they should | + | |
| - | # never be fragmented. | + | |
| - | # of a denial of service attack. | + | |
| - | $IPT -A icmp_packets --fragment -p ICMP -j LOG \ | + | |
| - | --log-prefix " | + | |
| - | $IPT -A icmp_packets --fragment -p ICMP -j DROP | + | |
| - | + | ||
| - | # Echo - uncomment to allow your system to be pinged. | + | |
| - | # Uncomment the LOG command if you also want to log PING attempts | + | |
| - | # | + | |
| - | # $IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j LOG \ | + | |
| - | # --log-prefix " | + | |
| - | # $IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT | + | |
| - | + | ||
| - | # By default, however, drop pings without logging. Blaster | + | |
| - | # and other worms have infected systems blasting pings. | + | |
| - | # Comment the line below if you want pings logged, but it | + | |
| - | # will likely fill your logs. | + | |
| - | $IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j DROP | + | |
| - | + | ||
| - | # Time Exceeded | + | |
| - | $IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT | + | |
| - | + | ||
| - | # Not matched, so return so it will be logged | + | |
| - | $IPT -A icmp_packets -p ICMP -j RETURN | + | |
| - | + | ||
| - | # TCP & UDP | + | |
| - | # Identify ports at: | + | |
| - | # http:// | + | |
| - | # http:// | + | |
| - | + | ||
| - | # udp_inbound chain | + | |
| - | # | + | |
| - | # This chain describes the inbound UDP packets it will accept. | + | |
| - | # It's applied to INPUT on the external or Internet interface. | + | |
| - | # Note that the stateful settings allow replies. | + | |
| - | # These rules are for new requests. | + | |
| - | # It drops netbios packets | + | |
| - | + | ||
| - | # Drop netbios calls | + | |
| - | # Please note that these rules do not really change the way the firewall | + | |
| - | # treats netbios connections. | + | |
| - | # internal interface (if one exists) are accepted by default. | + | |
| - | # Responses from the Internet to requests initiated by or through | + | |
| - | # the firewall are also accepted by default. | + | |
| - | # packets | + | |
| - | # Internet interface. | + | |
| - | # accept these. | + | |
| - | # such as those via cable modems, tend to be filled with noise from | + | |
| - | # unprotected Windows machines. | + | |
| - | # quickly and without logging them. This prevents them from traversing | + | |
| - | # the whole chain and keeps the log from getting cluttered with | + | |
| - | # chatter from Windows systems. | + | |
| - | $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 137 -j DROP | + | |
| - | $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 138 -j DROP | + | |
| - | + | ||
| - | # Ident requests (Port 113) must have a REJECT rule rather than the | + | |
| - | # default DROP rule. This is the minimum requirement to avoid | + | |
| - | # long delays while connecting. | + | |
| - | $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 113 -j REJECT | + | |
| - | + | ||
| - | # A more sophisticated configuration could accept the ident requests. | + | |
| - | # $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 113 -j ACCEPT | + | |
| - | + | ||
| - | # However, if this is a gateway system that masquerades/ | + | |
| - | # and the internal systems wish to chat, a simple changing these rules to | + | |
| - | # ACCEPT won't work. The ident daemon on the gateway will need to know how | + | |
| - | # to handle the requests. | + | |
| - | # can't do that. | + | |
| - | # See: http:// | + | |
| - | + | ||
| - | # Network Time Protocol (NTP) Server | + | |
| - | $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 123 -j ACCEPT | + | |
| - | + | ||
| - | # Dynamic Address | + | |
| - | # If DHCP, the initial request is a broadcast. The response | + | |
| - | # doesn' | + | |
| - | # allow the DHCP ports to alleviate this problem. | + | |
| - | # If you receive your dynamic address | + | |
| - | # can probably comment this line. | + | |
| - | $IPT -A udp_inbound -p UDP -s 0/0 --source-port 67 --destination-port 68 \ | + | |
| - | -j ACCEPT | + | |
| - | + | ||
| - | + | ||
| - | # Not matched, so return for logging | + | |
| - | $IPT -A udp_inbound -p UDP -j RETURN | + | |
| - | + | ||
| - | # udp_outbound chain | + | |
| - | # | + | |
| - | # This chain is used with a private network to prevent forwarding for | + | |
| - | # UDP requests on specific protocols. | + | |
| - | # the internal network. | + | |
| - | + | ||
| - | + | ||
| - | # No match, so ACCEPT | + | |
| - | $IPT -A udp_outbound -p UDP -s 0/0 -j ACCEPT | + | |
| - | + | ||
| - | # tcp_inbound chain | + | |
| - | # | + | |
| - | # This chain is used to allow inbound connections to the | + | |
| - | # system/ | + | |
| - | # It's applied on INPUT from the external or Internet interface. | + | |
| - | + | ||
| - | # Ident requests (Port 113) must have a REJECT rule rather than the | + | |
| - | # default DROP rule. This is the minimum requirement to avoid | + | |
| - | # long delays while connecting. | + | |
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 113 -j REJECT | + | |
| - | + | ||
| - | # A more sophisticated configuration could accept the ident requests. | + | |
| - | # $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 113 -j ACCEPT | + | |
| - | + | ||
| - | # However, if this is a gateway system that masquerades/ | + | |
| - | # and the internal systems wish to chat, a simple changing these rules to | + | |
| - | # ACCEPT won't work. The ident daemon on the gateway will need to know how | + | |
| - | # to handle the requests. | + | |
| - | # can't do that. | + | |
| - | # See: http:// | + | |
| - | + | ||
| - | # Web Server | + | |
| - | + | ||
| - | # HTTP | + | |
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 80 -j ACCEPT | + | |
| - | + | ||
| - | # HTTPS (Secure Web Server) | + | |
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 443 -j ACCEPT | + | |
| - | + | ||
| - | # FTP Server (Control) | + | |
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 21 -j ACCEPT | + | |
| - | + | ||
| - | # FTP Client (Data Port for non-PASV transfers) | + | |
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --source-port 20 -j ACCEPT | + | |
| - | + | ||
| - | # Passive FTP | + | |
| - | # | + | |
| - | # With passive FTP, the server provides a port to the client | + | |
| - | # and allows the client to initiate the connection rather | + | |
| - | # than initiating the connection with the client from the data port. | + | |
| - | # Web browsers and clients operating behind a firewall generally | + | |
| - | # use passive ftp transfers. | + | |
| - | # will need to support them. | + | |
| - | # | + | |
| - | # However, by default an FTP server will select a port from the entire | + | |
| - | # range of high ports. | + | |
| - | # high ports. | + | |
| - | # firewall presumes that the range has been restricted to a specific | + | |
| - | # selected range. | + | |
| - | # | + | |
| - | # Instructions for specifying the port range for the wu-ftpd server | + | |
| - | # can be found here: | + | |
| - | # http:// | + | |
| - | # (See the passive ports option.) | + | |
| - | # | + | |
| - | # Instructions for the ProFTPD server can be found here: | + | |
| - | # http:// | + | |
| - | + | ||
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 62000:64000 -j ACCEPT | + | |
| - | + | ||
| - | # Email Server (SMTP) | + | |
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 25 -j ACCEPT | + | |
| - | + | ||
| - | # Email Server (POP3) | + | |
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 110 -j ACCEPT | + | |
| - | + | ||
| - | # Email Server (IMAP4) | + | |
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 143 -j ACCEPT | + | |
| - | + | ||
| - | # SSL Email Server (POP3) | + | |
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 995 -j ACCEPT | + | |
| - | + | ||
| - | # SSL Email Server (IMAP4) | + | |
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 993 -j ACCEPT | + | |
| - | + | ||
| - | # sshd | + | |
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 22 -j ACCEPT | + | |
| - | + | ||
| - | # ICQ File Transfers & Other Advanced Features | + | |
| - | # | + | |
| - | # ICQ supports a number of options beyond simple instant messaging. | + | |
| - | # For those to function, the instant messaging system must allow | + | |
| - | # new connections initiated from remote systems. This option will | + | |
| - | # open a specified port range on the firewalled system. | + | |
| - | # on the firewalled system must also be configured to use the specified | + | |
| - | # port range. | + | |
| - | + | ||
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 5000:5100 -j ACCEPT | + | |
| - | + | ||
| - | # MSN Messenger File Transfers | + | |
| - | # | + | |
| - | # Messenger supports file transfers. | + | |
| - | # remote systems to function, the system must allow | + | |
| - | # new connections initiated from remote systems a specific port range. | + | |
| - | # This option defaults to the port range 6891 through 6900. | + | |
| - | # Unless the MSN Messenger client can be configured to specify any | + | |
| - | # port range, don't change the default. | + | |
| - | + | ||
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 6891:6900 -j ACCEPT | + | |
| - | + | ||
| - | # User specified allowed UDP protocol | + | |
| - | $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 32500:36000 -j ACCEPT | + | |
| - | + | ||
| - | + | ||
| - | # Not matched, so return so it will be logged | + | |
| - | $IPT -A tcp_inbound -p TCP -j RETURN | + | |
| - | + | ||
| - | # tcp_outbound chain | + | |
| - | # | + | |
| - | # This chain is used with a private network to prevent forwarding for | + | |
| - | # requests on specific protocols. | + | |
| - | # the internal network. | + | |
| - | + | ||
| - | + | ||
| - | # No match, so ACCEPT | + | |
| - | $IPT -A tcp_outbound -p TCP -s 0/0 -j ACCEPT | + | |
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # INPUT Chain | + | |
| - | # | + | |
| - | + | ||
| - | echo " | + | |
| - | + | ||
| - | # Allow all on localhost interface | + | |
| - | $IPT -A INPUT -p ALL -i $LO_IFACE -j ACCEPT | + | |
| - | + | ||
| - | # Drop bad packets | + | |
| - | $IPT -A INPUT -p ALL -j bad_packets | + | |
| - | + | ||
| - | # DOCSIS compliant cable modems | + | |
| - | # Some DOCSIS compliant cable modems send IGMP multicasts to find | + | |
| - | # connected PCs. The multicast packets have the destination address | + | |
| - | # 224.0.0.1. | + | |
| - | # Uncomment the rule to ACCEPT them and comment the rule to DROP | + | |
| - | # them The firewall will drop them here by default to avoid | + | |
| - | # cluttering the log. The firewall will drop all multicasts | + | |
| - | # to the entire subnet (224.0.0.1) by default. | + | |
| - | # IGMP multicasts, change '-p ALL' to '-p 2' | + | |
| - | # if they aren't accepted elsewhere, it will only ensure that | + | |
| - | # multicasts on other protocols are logged. | + | |
| - | # Drop them without logging. | + | |
| - | $IPT -A INPUT -p ALL -d 224.0.0.1 -j DROP | + | |
| - | # The rule to accept the packets. | + | |
| - | # $IPT -A INPUT -p ALL -d 224.0.0.1 -j ACCEPT | + | |
| - | + | ||
| - | # Rules for the private network (accessing gateway system itself) | + | |
| - | $IPT -A INPUT -p ALL -i $LOCAL_IFACE -s $LOCAL_NET -j ACCEPT | + | |
| - | $IPT -A INPUT -p ALL -i $LOCAL_IFACE -d $LOCAL_BCAST -j ACCEPT | + | |
| - | + | ||
| - | + | ||
| - | # Inbound Internet Packet Rules | + | |
| - | + | ||
| - | # Accept Established Connections | + | |
| - | $IPT -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED, | + | |
| - | -j ACCEPT | + | |
| - | + | ||
| - | # Route the rest to the appropriate user chain | + | |
| - | $IPT -A INPUT -p TCP -i $INET_IFACE -j tcp_inbound | + | |
| - | $IPT -A INPUT -p UDP -i $INET_IFACE -j udp_inbound | + | |
| - | $IPT -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets | + | |
| - | + | ||
| - | # Drop without logging broadcasts that get this far. | + | |
| - | # Cuts down on log clutter. | + | |
| - | # Comment this line if testing new rules that impact | + | |
| - | # broadcast protocols. | + | |
| - | $IPT -A INPUT -m pkttype --pkt-type broadcast -j DROP | + | |
| - | + | ||
| - | # Log packets that still don't match | + | |
| - | $IPT -A INPUT -j LOG --log-prefix " | + | |
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # FORWARD Chain | + | |
| - | # | + | |
| - | + | ||
| - | echo " | + | |
| - | + | ||
| - | # Used if forwarding for a private network | + | |
| - | + | ||
| - | # Drop bad packets | + | |
| - | $IPT -A FORWARD -p ALL -j bad_packets | + | |
| - | + | ||
| - | # Accept TCP packets we want to forward from internal sources | + | |
| - | $IPT -A FORWARD -p tcp -i $LOCAL_IFACE -j tcp_outbound | + | |
| - | + | ||
| - | # Accept UDP packets we want to forward from internal sources | + | |
| - | $IPT -A FORWARD -p udp -i $LOCAL_IFACE -j udp_outbound | + | |
| - | + | ||
| - | # If not blocked, accept any other packets from the internal interface | + | |
| - | $IPT -A FORWARD -p ALL -i $LOCAL_IFACE -j ACCEPT | + | |
| - | + | ||
| - | # Deal with responses from the internet | + | |
| - | $IPT -A FORWARD -i $INET_IFACE -m state --state ESTABLISHED, | + | |
| - | -j ACCEPT | + | |
| - | + | ||
| - | # Port Forwarding is enabled, so accept forwarded traffic | + | |
| - | $IPT -A FORWARD -p tcp -i $INET_IFACE --destination-port 8080 \ | + | |
| - | | + | |
| - | + | ||
| - | # Log packets that still don't match | + | |
| - | $IPT -A FORWARD -j LOG --log-prefix " | + | |
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # OUTPUT Chain | + | |
| - | # | + | |
| - | + | ||
| - | echo " | + | |
| - | + | ||
| - | # Generally trust the firewall on output | + | |
| - | + | ||
| - | # However, invalid icmp packets need to be dropped | + | |
| - | # to prevent a possible exploit. | + | |
| - | $IPT -A OUTPUT -m state -p icmp --state INVALID -j DROP | + | |
| - | + | ||
| - | # Localhost | + | |
| - | $IPT -A OUTPUT -p ALL -s $LO_IP -j ACCEPT | + | |
| - | $IPT -A OUTPUT -p ALL -o $LO_IFACE -j ACCEPT | + | |
| - | + | ||
| - | # To internal network | + | |
| - | $IPT -A OUTPUT -p ALL -s $LOCAL_IP -j ACCEPT | + | |
| - | $IPT -A OUTPUT -p ALL -o $LOCAL_IFACE -j ACCEPT | + | |
| - | + | ||
| - | # To internet | + | |
| - | $IPT -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT | + | |
| - | + | ||
| - | # Log packets that still don't match | + | |
| - | $IPT -A OUTPUT -j LOG --log-prefix " | + | |
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # nat table | + | |
| - | # | + | |
| - | ############################################################################### | + | |
| - | + | ||
| - | # The nat table is where network address translation occurs if there | + | |
| - | # is a private network. | + | |
| - | # with a static IP, snat is used. If the gateway has a dynamic address, | + | |
| - | # masquerade must be used instead. | + | |
| - | # with masquerade, so snat is better when it can be used. | + | |
| - | # The nat table has a builtin chain, PREROUTING, for dnat and redirects. | + | |
| - | # Another, POSTROUTING, | + | |
| - | + | ||
| - | echo "Load rules for nat table ..." | + | |
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # PREROUTING chain | + | |
| - | # | + | |
| - | + | ||
| - | # Port Forwarding | + | |
| - | # | + | |
| - | # Port forwarding forwards all traffic on a port or ports from | + | |
| - | # the firewall to a computer on the internal LAN. This can | + | |
| - | # be required to support special situations. | + | |
| - | # this is the only way to support file transfers with an ICQ | + | |
| - | # client on an internal computer. | + | |
| - | # system hosts a service such as a web server. | + | |
| - | # a dangerous option. | + | |
| - | # your internal network. | + | |
| - | # certain you know what you're doing. | + | |
| - | + | ||
| - | $IPT -t nat -A PREROUTING -p tcp -i $INET_IFACE --destination-port 80:80 \ | + | |
| - | -j DNAT --to-destination 192.168.1.50: | + | |
| - | + | ||
| - | # This is a sample that will exempt a specific host from the transparent proxy | + | |
| - | #$IPT -t nat -A PREROUTING -p tcp -s 192.168.1.50 --destination-port 80 \ | + | |
| - | # -j RETURN | + | |
| - | #$IPT -t nat -A PREROUTING -p tcp -s 192.168.1.50 --destination-port 443 \ | + | |
| - | # -j RETURN | + | |
| - | + | ||
| - | # Redirect HTTP for a transparent proxy | + | |
| - | $IPT -t nat -A PREROUTING -p tcp --destination-port 80 \ | + | |
| - | -j REDIRECT --to-ports 3128 | + | |
| - | # Redirect HTTPS for a transparent proxy - commented | + | |
| - | # $IPT -t nat -A PREROUTING -p tcp --destination-port 443 \ | + | |
| - | # -j REDIRECT --to-ports 3128 | + | |
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # POSTROUTING chain | + | |
| - | # | + | |
| - | + | ||
| - | $IPT -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE | + | |
| - | + | ||
| - | ############################################################################### | + | |
| - | # | + | |
| - | # mangle table | + | |
| - | # | + | |
| - | ############################################################################### | + | |
| - | + | ||
| - | # The mangle table is used to alter packets. | + | |
| - | # several ways. For the purposes of this generator, we only use its ability | + | |
| - | # to alter the TTL in packets. | + | |
| - | # mark values on specific packets. | + | |
| - | # table like filter, to limit activities associated with a specific host, for | + | |
| - | # instance. | + | |
| - | # the IP header. | + | |
| - | # distribution on your system. | + | |
| - | # have to add it. That may require that you build from source. | + | |
| - | + | ||
| - | echo "Load rules for mangle table ..." | + | |
| - | # Set the TTL in outbound packets to the same consistent value. | + | [root@centos7 ~]# ls -l log.dump |
| - | # A value around 128 is a good value. | + | -rw-r--r--. 1 tcpdump tcpdump 8685 Jun 9 01:37 log.dump |
| - | # it will adversely affect your network. | + | |
| - | # form on the Internet. | + | |
| - | $IPT -t mangle | + | |
| </ | </ | ||
| - | <WRAP center round todo> | + | <WRAP center round important 50%> |
| - | Utilisez la commande | + | **Important** - Pour générer le trafic, réactualisez simplement cette page web. Arrêtez la sortie de la commande à l'aide des touches |
| </ | </ | ||
| - | ====La Configuration par firewalld sous Debian 8==== | + | Notez que le fichier log.dump est au format |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | Importez une machine virtuelle vierge de Debian 8. | + | |
| - | </ | + | |
| - | + | ||
| - | firewalld est à Netfilter ce que NetworkManager | + | |
| - | + | ||
| - | * **trusted** - un réseau fiable. Dans ce cas tous les ports sont autorisés, | + | |
| - | * **work**, **home**, **internal** - un réseau partiellement fiable. Dans ce cas quelques ports sont autorisés, | + | |
| - | * **dmz**, **public**, **external** - un réseau | + | |
| - | * **block**, **drop** - tout est interdit. La zone drop n'envoie pas de messages d' | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | Une interface ne peut être que dans une zone à la fois tandis que plusieurs interfaces peuvent être dans la même zone. | + | |
| - | </ | + | |
| - | + | ||
| - | Sous Debian 8, firewalld n'est pas installé par défaut | + | |
| < | < | ||
| - | root@debian8:~# apt-get install firewalld | + | [root@centos7 |
| - | Reading package lists... Done | + | log.dump: tcpdump capture file (little-endian) |
| - | Building dependency tree | + | |
| - | Reading state information... Done | + | |
| - | The following packages were automatically installed and are no longer required: | + | |
| - | libevent-core-2.0-5 libevent-pthreads-2.0-5 | + | |
| - | Use ' | + | |
| - | The following extra packages will be installed: | + | |
| - | ebtables python-decorator python-slip python-slip-dbus | + | |
| - | The following NEW packages will be installed: | + | |
| - | ebtables firewalld python-decorator python-slip python-slip-dbus | + | |
| - | 0 upgraded, 5 newly installed, 0 to remove and 1 not upgraded. | + | |
| - | Need to get 436 kB of archives. | + | |
| - | After this operation, 2,950 kB of additional disk space will be used. | + | |
| - | Do you want to continue? [Y/n] y | + | |
| </ | </ | ||
| - | Le service firewalld est déjà lancé et activé : | + | ===L' |
| - | < | + | Tcpdump peut être utilisé avec un de trois modes verbose. |
| - | root@debian8: | + | |
| - | ● firewalld.service - firewalld - dynamic firewall daemon | + | |
| - | | + | |
| - | | + | |
| - | Main PID: 8093 (firewalld) | + | |
| - | | + | |
| - | | + | |
| - | Jul 26 09:10:38 debian8 systemd[1]: Started firewalld | + | ^ Mode ^ Option ^ |
| - | </ | + | | Light verbose | -v | |
| - | + | | Medium verbose | -vv | | |
| - | ===La Configuration de Base de firewalld=== | + | | Full verbose | -vvv | |
| - | + | ||
| - | La configuration par défaut de firewalld se trouve dans **/ | + | |
| < | < | ||
| - | root@debian8:~# ls -lR / | + | [root@centos7 |
| - | / | + | tcpdump: listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes |
| - | total 12 | + | 01:39:13.094781 IP (tos 0x10, ttl 64, id 39762, offset 0, flags [DF], proto TCP (6), length 164) |
| - | drwxr-xr-x 2 root root 4096 Jul 26 09:10 icmptypes | + | ^C centos7.fenestros.loc.ssh > gateway.36360: Flags [P.], cksum 0x18a7 (incorrect |
| - | drwxr-xr-x 2 root root 4096 Jul 26 09:10 services | + | |
| - | drwxr-xr-x 2 root root 4096 Jul 26 09:10 zones | + | |
| - | + | ||
| - | / | + | |
| - | total 36 | + | |
| - | -rw-r--r-- 1 root root 222 Oct 16 2014 destination-unreachable.xml | + | |
| - | -rw-r--r-- 1 root root 173 Oct 16 2014 echo-reply.xml | + | |
| - | -rw-r--r-- 1 root root 210 Oct 16 2014 echo-request.xml | + | |
| - | -rw-r--r-- 1 root root 225 Oct 16 2014 parameter-problem.xml | + | |
| - | -rw-r--r-- 1 root root 185 Oct 16 2014 redirect.xml | + | |
| - | -rw-r--r-- 1 root root 227 Oct 16 2014 router-advertisement.xml | + | |
| - | -rw-r--r-- 1 root root 223 Oct 16 2014 router-solicitation.xml | + | |
| - | -rw-r--r-- 1 root root 248 Oct 16 2014 source-quench.xml | + | |
| - | -rw-r--r-- 1 root root 253 Oct 16 2014 time-exceeded.xml | + | |
| - | + | ||
| - | / | + | |
| - | total 248 | + | |
| - | -rw-r--r-- 1 root root 412 Oct 16 2014 amanda-client.xml | + | |
| - | -rw-r--r-- 1 root root 447 Oct 16 2014 amanda-k5-client.xml | + | |
| - | -rw-r--r-- 1 root root 320 Oct 16 2014 bacula-client.xml | + | |
| - | -rw-r--r-- 1 root root 346 Oct 16 2014 bacula.xml | + | |
| - | -rw-r--r-- 1 root root 305 Oct 16 2014 dhcpv6-client.xml | + | |
| - | -rw-r--r-- 1 root root 234 Oct 16 2014 dhcpv6.xml | + | |
| - | -rw-r--r-- 1 root root 227 Oct 16 2014 dhcp.xml | + | |
| - | -rw-r--r-- 1 root root 346 Oct 16 2014 dns.xml | + | |
| - | -rw-r--r-- 1 root root 836 Oct 16 2014 freeipa-ldaps.xml | + | |
| - | -rw-r--r-- 1 root root 836 Oct 16 2014 freeipa-ldap.xml | + | |
| - | -rw-r--r-- 1 root root 315 Oct 16 2014 freeipa-replication.xml | + | |
| - | -rw-r--r-- 1 root root 374 Oct 16 2014 ftp.xml | + | |
| - | -rw-r--r-- 1 root root 476 Oct 16 2014 high-availability.xml | + | |
| - | -rw-r--r-- 1 root root 448 Oct 16 2014 https.xml | + | |
| - | -rw-r--r-- 1 root root 353 Oct 16 2014 http.xml | + | |
| - | -rw-r--r-- 1 root root 372 Oct 16 2014 imaps.xml | + | |
| - | -rw-r--r-- 1 root root 454 Oct 16 2014 ipp-client.xml | + | |
| - | -rw-r--r-- 1 root root 427 Oct 16 2014 ipp.xml | + | |
| - | -rw-r--r-- 1 root root 517 Oct 16 2014 ipsec.xml | + | |
| - | -rw-r--r-- 1 root root 182 Oct 16 2014 kadmin.xml | + | |
| - | -rw-r--r-- 1 root root 233 Oct 16 2014 kerberos.xml | + | |
| - | -rw-r--r-- 1 root root 221 Oct 16 2014 kpasswd.xml | + | |
| - | -rw-r--r-- 1 root root 232 Oct 16 2014 ldaps.xml | + | |
| - | -rw-r--r-- 1 root root 199 Oct 16 2014 ldap.xml | + | |
| - | -rw-r--r-- 1 root root 385 Oct 16 2014 libvirt-tls.xml | + | |
| - | -rw-r--r-- 1 root root 389 Oct 16 2014 libvirt.xml | + | |
| - | -rw-r--r-- 1 root root 424 Oct 16 2014 mdns.xml | + | |
| - | -rw-r--r-- 1 root root 211 Oct 16 2014 mountd.xml | + | |
| - | -rw-r--r-- 1 root root 190 Oct 16 2014 ms-wbt.xml | + | |
| - | -rw-r--r-- 1 root root 171 Oct 16 2014 mysql.xml | + | |
| - | -rw-r--r-- 1 root root 324 Oct 16 2014 nfs.xml | + | |
| - | -rw-r--r-- 1 root root 389 Oct 16 2014 ntp.xml | + | |
| - | -rw-r--r-- 1 root root 335 Oct 16 2014 openvpn.xml | + | |
| - | -rw-r--r-- 1 root root 433 Oct 16 2014 pmcd.xml | + | |
| - | -rw-r--r-- 1 root root 474 Oct 16 2014 pmproxy.xml | + | |
| - | -rw-r--r-- 1 root root 544 Oct 16 2014 pmwebapis.xml | + | |
| - | -rw-r--r-- 1 root root 460 Oct 16 2014 pmwebapi.xml | + | |
| - | -rw-r--r-- 1 root root 357 Oct 16 2014 pop3s.xml | + | |
| - | -rw-r--r-- 1 root root 181 Oct 16 2014 postgresql.xml | + | |
| - | -rw-r--r-- 1 root root 509 Oct 16 2014 privoxy.xml | + | |
| - | -rw-r--r-- 1 root root 261 Oct 16 2014 proxy-dhcp.xml | + | |
| - | -rw-r--r-- 1 root root 297 Oct 16 2014 puppetmaster.xml | + | |
| - | -rw-r--r-- 1 root root 446 Oct 16 2014 radius.xml | + | |
| - | -rw-r--r-- 1 root root 214 Oct 16 2014 rpc-bind.xml | + | |
| - | -rw-r--r-- 1 root root 384 Oct 16 2014 samba-client.xml | + | |
| - | -rw-r--r-- 1 root root 461 Oct 16 2014 samba.xml | + | |
| - | -rw-r--r-- 1 root root 337 Oct 16 2014 sane.xml | + | |
| - | -rw-r--r-- 1 root root 550 Oct 16 2014 smtp.xml | + | |
| - | -rw-r--r-- 1 root root 173 Oct 16 2014 squid.xml | + | |
| - | -rw-r--r-- 1 root root 463 Oct 16 2014 ssh.xml | + | |
| - | -rw-r--r-- 1 root root 496 Oct 16 2014 synergy.xml | + | |
| - | -rw-r--r-- 1 root root 393 Oct 16 2014 telnet.xml | + | |
| - | -rw-r--r-- 1 root root 301 Oct 16 2014 tftp-client.xml | + | |
| - | -rw-r--r-- 1 root root 437 Oct 16 2014 tftp.xml | + | |
| - | -rw-r--r-- 1 root root 771 Oct 16 2014 tor-socks.xml | + | |
| - | -rw-r--r-- 1 root root 211 Oct 16 2014 transmission-client.xml | + | |
| - | -rw-r--r-- 1 root root 475 Oct 16 2014 vnc-server.xml | + | |
| - | -rw-r--r-- 1 root root 310 Oct 16 2014 wbem-https.xml | + | |
| - | -rw-r--r-- 1 root root 509 Oct 16 2014 xmpp-bosh.xml | + | |
| - | -rw-r--r-- 1 root root 488 Oct 16 2014 xmpp-client.xml | + | |
| - | -rw-r--r-- 1 root root 264 Oct 16 2014 xmpp-local.xml | + | |
| - | -rw-r--r-- 1 root root 545 Oct 16 2014 xmpp-server.xml | + | |
| - | / | + | 1 packet captured |
| - | total 36 | + | 11 packets received by filter |
| - | -rw-r--r-- | + | 0 packets dropped by kernel |
| - | -rw-r--r-- 1 root root 293 Oct 16 2014 dmz.xml | + | |
| - | -rw-r--r-- 1 root root 291 Oct 16 2014 drop.xml | + | |
| - | -rw-r--r-- 1 root root 304 Oct 16 2014 external.xml | + | |
| - | -rw-r--r-- 1 root root 369 Oct 16 2014 home.xml | + | |
| - | -rw-r--r-- 1 root root 384 Oct 16 2014 internal.xml | + | |
| - | -rw-r--r-- 1 root root 315 Oct 16 2014 public.xml | + | |
| - | -rw-r--r-- 1 root root 162 Oct 16 2014 trusted.xml | + | |
| - | -rw-r--r-- 1 root root 311 Oct 16 2014 work.xml | + | |
| </ | </ | ||
| - | Ces fichiers sont au format **xml**, par exemple : | + | ====5.2 - Filtrage à l' |
| - | < | + | Tcpdump peut effectuer du filtrage lors de l' |
| - | root@debian8: | + | |
| - | <?xml version=" | + | |
| - | < | + | |
| - | < | + | |
| - | < | + | |
| - | <service name=" | + | |
| - | <service name=" | + | |
| - | <service name=" | + | |
| - | <service name=" | + | |
| - | </ | + | |
| - | </ | + | |
| - | La configuration de firewalld ainsi que les définitions et règles personnalisées se trouvent dans **/ | + | Pour uniquement écouter |
| - | < | + | |
| - | root@debian8: | + | |
| - | / | + | |
| - | total 20 | + | |
| - | -rw-r--r-- 1 root root 1026 Oct 16 2014 firewalld.conf | + | |
| - | drwxr-xr-x 2 root root 4096 Oct 16 2014 icmptypes | + | |
| - | -rw-r--r-- | + | |
| - | drwxr-xr-x 2 root root 4096 Oct 16 2014 services | + | |
| - | drwxr-xr-x 2 root root 4096 Oct 16 2014 zones | + | |
| - | / | + | Pour uniquement écouter les paquets en provenance de l' |
| - | total 0 | + | |
| - | / | + | # tcpdump src host 192.168.1.11 and dst host 192.168.1.2 [Entrée] |
| - | total 0 | + | |
| - | / | + | Pour uniquement écouter les paquets d'un port précis, utilisez la condition **port** |
| - | total 0 | + | |
| - | </ | + | |
| - | Le fichier de configuration de firewalld est **/ | + | # tcpdump -i eth0 port 80 [Entrée] |
| - | < | + | Pour uniquement écouter les paquets d'un protocole précis, utilisez une condition telle **ip**, **icmp**, **arp**, **rarp**, **udp** ou **tcp**: |
| - | root@debian8:~# cat / | + | |
| - | # firewalld config file | + | |
| - | # default zone | + | |
| - | # The default zone used if an empty zone string is used. | + | |
| - | # Default: public | + | |
| - | DefaultZone=public | + | |
| - | # Minimal mark | + | Pour uniquement écouter les paquets d'une taille inférieure à 100 octets, utilisez la condition **less** |
| - | # Marks up to this minimum are free for use for example in the direct | + | |
| - | # interface. If more free marks are needed, increase the minimum | + | |
| - | # Default: 100 | + | |
| - | MinimalMark=100 | + | |
| - | # Clean up on exit | + | |
| - | # If set to no or false the firewall configuration will not get cleaned up | + | |
| - | # on exit or stop of firewalld | + | |
| - | # Default: yes | + | |
| - | CleanupOnExit=yes | + | |
| - | # Lockdown | + | Pour uniquement écouter les paquets d'une taille supérieure à 100 octets, utilisez la condition **great** |
| - | # If set to enabled, firewall changes with the D-Bus interface will be limited | + | |
| - | # to applications that are listed in the lockdown whitelist. | + | |
| - | # The lockdown whitelist file is lockdown-whitelist.xml | + | |
| - | # Default: no | + | |
| - | Lockdown=no | + | |
| - | # IPv6_rpfilter | + | |
| - | # Performs a reverse path filter test on a packet for IPv6. If a reply to the | + | |
| - | # packet would be sent via the same interface that the packet arrived on, the | + | |
| - | # packet will match and be accepted, otherwise dropped. | + | |
| - | # The rp_filter for IPv4 is controlled using sysctl. | + | |
| - | # Default: yes | + | |
| - | IPv6_rpfilter=yes | + | |
| - | </ | + | |
| - | ===La Commande firewall-cmd=== | + | L' |
| - | firewalld s' | + | # tcpdump |
| - | <WRAP center round important> | + | =====LAB #6 - Mise en place d'un VPN avec OpenVPN===== |
| - | firewall-cmd est le front-end de firewalld | + | |
| - | </ | + | |
| - | Pour obtenir la liste de toutes les zones prédéfinies, | + | ====6.1 - Présentation==== |
| - | < | + | **%%OpenVPN%%** permet à des pairs de s' |
| - | root@debian8:~# firewall-cmd --get-zones | + | |
| - | block dmz drop external home internal public trusted work | + | |
| - | </ | + | |
| - | Pour obtenir la liste de toutes les services prédéfinis, utilisez | + | * d'une **clé privée partagée** à l' |
| + | * de **certificats** ou, | ||
| + | * à partir de la version 2.0 et à condition que le serveur possède un certificat, de **couples de noms d' | ||
| - | < | + | **%%OpenVPN%%** |
| - | root@debian8:~# firewall-cmd --get-services | + | |
| - | amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns freeipa-ldap freeipa-ldaps freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec kadmin kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind samba samba-client sane smtp squid ssh synergy telnet tftp tftp-client tor-socks transmission-client vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server | + | |
| - | </ | + | |
| - | Pour obtenir | + | * utilise de manière intensive |
| + | * n'est pas compatible avec IPsec ou d' | ||
| - | < | + | ====6.2 |
| - | root@debian8: | + | |
| - | destination-unreachable echo-reply echo-request parameter-problem redirect router-advertisement router-solicitation source-quench time-exceeded | + | |
| - | </ | + | |
| - | Pour obtenir la liste des zones de la configuration courante, utilisez la commande suivante | + | Commencez par vérifiez si le paquet **openssl** est bien installé |
| < | < | ||
| - | root@debian8:~# firewall-cmd --get-active-zones | + | [root@centos7 |
| - | public | + | openssl-1.0.2k-8.el7.x86_64 |
| - | interfaces: eth0 | + | |
| </ | </ | ||
| - | Pour obtenir la liste des zones de la configuration courante pour une interface spécifique, | + | Installez ensuite le paquet openvpn |
| < | < | ||
| - | root@debian8:~# firewall-cmd --get-zone-of-interface=eth0 | + | [root@centos7 |
| - | public | + | |
| </ | </ | ||
| - | Pour obtenir | + | Naviguez au répertoire **/ |
| < | < | ||
| - | root@debian8:~# firewall-cmd --zone=public | + | [root@centos7 |
| - | dhcpv6-client ssh | + | [root@centos7 openvpn]# openvpn |
| + | [root@centos7 openvpn]# cat static.key | ||
| + | # | ||
| + | # 2048 bit OpenVPN static key | ||
| + | # | ||
| + | -----BEGIN OpenVPN Static key V1----- | ||
| + | 54f96ea50dbef7d5341efeda459b05ad | ||
| + | 5af134bf915bbd867fdd6310f4f0b72b | ||
| + | 331a82cdc6080622a7861e8c30cd0ffb | ||
| + | 6b35c143e5c715077247270bdb610fc8 | ||
| + | 4c536f34742ba23f2bfe9ab148b3fa04 | ||
| + | 20d1f6e5a20d58db30cce56ce1ca5744 | ||
| + | 3028353a7e5e47b3f630738b71b04a1e | ||
| + | e388b5e986826ce481ff457157b3492e | ||
| + | 61c147cd3d4373e283ad91c8ac44c0e8 | ||
| + | 3b593d342cd0a2600db7b3e7cd0efa89 | ||
| + | d38dd861c1e4fc566e5e50004b102c7f | ||
| + | b444795e2691cd59dfbb51e79996339d | ||
| + | 7e54d002aa4d5c63b3c155fbcc20f696 | ||
| + | fe148128f2e94e509c39c72c117a684b | ||
| + | 9fa8c7e159c451a7c52f42b2260d62c9 | ||
| + | 586d66a454319ba538559c143643e434 | ||
| + | -----END OpenVPN Static key V1----- | ||
| </ | </ | ||
| - | Pour obtenir toute la configuration pour la zone public, utilisez la commande | + | L' |
| - | <code> | + | <file> |
| - | root@debian8: | + | serveur <------------Votre réseau-------------> |
| - | public (default, active) | + | |
| - | interfaces: eth0 | + | |
| - | sources: | + | |
| - | services: dhcpv6-client | + | |
| - | | + | </file> |
| - | | + | |
| - | | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | </code> | + | |
| - | Pour obtenir la liste complète de toutes les zones et leurs configurations, | + | ====6.3 |
| - | + | ||
| - | < | + | |
| - | root@debian8: | + | |
| - | block | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | dmz | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | drop | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | external | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: ssh | + | |
| - | ports: | + | |
| - | masquerade: yes | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | home | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: dhcpv6-client | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | internal | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: dhcpv6-client mdns samba-client ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | public (default, active) | + | |
| - | interfaces: eth0 | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | trusted | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | work | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | </ | + | |
| - | Pour changer la zone par défaut de public à work, utilisez la commande suivante | + | Créez le fichier **/ |
| < | < | ||
| - | root@debian8:~# firewall-cmd --set-default-zone=work | + | [root@centos7 |
| - | success | + | [root@centos7 |
| - | root@debian8:~# firewall-cmd --get-active-zones | + | remote 10.0.2.15 |
| - | work | + | dev tun |
| - | | + | port 1194 |
| + | proto udp | ||
| + | comp-lzo | ||
| + | ifconfig 10.0.0.2 10.0.0.1 | ||
| + | secret / | ||
| </ | </ | ||
| - | HERE | + | <WRAP center round important 50%> |
| + | **Important** - Trouvez la signification de chacune des directives dans ce fichier. | ||
| + | </ | ||
| - | Pour ajouter l' | + | Arrêtez le service **firewalld** |
| < | < | ||
| - | root@debian8:~# firewall-cmd --zone=work --add-interface=ip_fixe | + | [root@centos7 |
| - | success | + | |
| - | root@debian8: | + | |
| - | work | + | |
| - | interfaces: eth0 ip_fixe | + | |
| </ | </ | ||
| - | Pour supprimer l' | + | Lancez openvpn en ligne de commande |
| < | < | ||
| - | root@debian8:~# firewall-cmd --zone=work --remove-interface=ip_fixe | + | [root@centos7 |
| - | success | + | |
| - | root@debian8: | + | |
| - | work | + | |
| - | interfaces: eth0 | + | |
| </ | </ | ||
| - | Pour ajouter | + | Vérifiez ensuite que le **socket** d' |
| < | < | ||
| - | root@debian8:~# firewall-cmd --zone=work --add-service=http | + | [root@centos7 |
| - | success | + | udp 0 0 0.0.0.0:1194 0.0.0.0: |
| - | root@debian8:~# firewall-cmd --zone=work --list-services | + | |
| - | dhcpv6-client http ssh | + | |
| </ | </ | ||
| - | Pour supprimer le service **http** | + | Constatez ensuite la table de routage |
| - | < | + | < |
| - | root@debian8:~# firewall-cmd --zone=work --remove-service=http | + | [root@centos7 |
| - | success | + | Kernel IP routing table |
| - | root@debian8: | + | Destination |
| - | dhcpv6-client ssh | + | default |
| + | 10.0.0.1 | ||
| + | 10.0.2.0 | ||
| </ | </ | ||
| - | Pour ajouter un nouveau bloc ICMP, utilisez | + | Notez la présence de la route via **tun0**. |
| - | < | + | Constatez ensuite le montage du tunnel en regardant le contenu du fichier de journalisation **/var/ |
| - | root@debian8: | + | |
| - | success | + | |
| - | root@debian8: | + | |
| - | echo-reply | + | |
| - | </code> | + | |
| - | + | ||
| - | Pour supprimer un bloc ICMP, utilisez la commande suivante | + | |
| < | < | ||
| - | root@debian8:~# firewall-cmd --zone=work --remove-icmp-block=echo-reply | + | [root@centos7 |
| - | success | + | |
| - | root@debian8: | + | |
| - | root@debian8: | + | |
| </ | </ | ||
| - | Pour ajouter le port 591/tcp à la zone work, utilisez la commande suivante : | + | ====6.4 - Configuration du serveur==== |
| - | < | + | Créez le fichier **/etc/openvpn/server.conf** |
| - | root@debian8: | + | |
| - | success | + | |
| - | root@debian8: | + | |
| - | 591/tcp | + | |
| - | </ | + | |
| - | + | ||
| - | Pour supprimer le port 591/tcp à la zone work, utilisez la commande suivante | + | |
| < | < | ||
| - | root@debian8:~# firewall-cmd --zone=work --remove-port=591/tcp | + | [root@centos7 |
| - | success | + | [root@centos7 |
| - | root@debian8:~# firewall-cmd --zone=work | + | dev tun |
| - | root@debian8: | + | ifconfig 10.0.0.1 10.0.0.2 |
| + | secret / | ||
| + | port 1194 | ||
| + | proto udp | ||
| + | user nobody | ||
| + | group nobody | ||
| + | daemon | ||
| + | comp-lzo | ||
| + | keepalive 10 60 | ||
| + | ping-timer-rem | ||
| + | persist-tun | ||
| + | persist-key | ||
| + | log / | ||
| + | verb 1 | ||
| </ | </ | ||
| - | Pour créer un nouveau service, il convient | + | <WRAP center round important 50%> |
| + | **Important** - Trouvez la signification | ||
| + | </ | ||
| - | * copier un fichier existant se trouvant dans le répertoire | + | Arrêtez |
| - | * modifier le fichier, | + | |
| - | * recharger la configuration de firewalld, | + | |
| - | * vérifier que firewalld voit le nouveau service. | + | |
| - | + | ||
| - | Par exemple | + | |
| < | < | ||
| - | root@debian8:~# cp /usr/lib/firewalld/ | + | [root@centos7 |
| - | root@debian8: | + | |
| - | <?xml version=" | + | |
| - | < | + | |
| - | < | + | |
| - | < | + | |
| - | <port protocol=" | + | |
| - | </ | + | |
| - | root@debian8: | + | |
| - | root@debian8: | + | |
| - | <?xml version=" | + | |
| - | < | + | |
| - | < | + | |
| - | < | + | |
| - | <port protocol=" | + | |
| - | </ | + | |
| - | root@debian8: | + | |
| - | success | + | |
| - | root@debian8: | + | |
| - | amanda-client amanda-k5-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns filemaker freeipa-ldap freeipa-ldaps freeipa-replication ftp high-availability http https imaps ipp ipp-client ipsec kadmin kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql privoxy proxy-dhcp puppetmaster radius rpc-bind samba samba-client sane smtp squid ssh synergy telnet tftp tftp-client tor-socks transmission-client vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server | + | |
| </ | </ | ||
| - | ===La Configuration Avancée | + | Lancez openvpn en ligne de commande |
| - | + | ||
| - | La configuration de base de firewalld ne permet que la configuration des zones, services, blocs ICMP et les ports non-standard. Cependant firewalld peut également être configuré avec des **Rich Rules** ou **//Règles Riches//**. Rich Rules ou Règles Riches évaluent des **critères** pour ensuite entreprendre | + | |
| - | + | ||
| - | Les **Critères** sont : | + | |
| - | + | ||
| - | * **source address="< | + | |
| - | * **destination address="< | + | |
| - | * **rule port port="< | + | |
| - | * **service name=< | + | |
| - | + | ||
| - | Les **Actions** sont : | + | |
| - | + | ||
| - | * **accept**, | + | |
| - | * **reject**, | + | |
| - | * une Action reject peut être associée avec un message d' | + | |
| - | * **drop**. | + | |
| - | + | ||
| - | Saisissez la commande suivante pour ouvrir le port 80 : | + | |
| < | < | ||
| - | root@debian8:~# firewall-cmd --add-rich-rule=' | + | [root@centos7 |
| - | success | + | [1] 7751 |
| </ | </ | ||
| - | <WRAP center round important 50%> | + | Vérifiez ensuite |
| - | Notez que la Rich Rule doit être entourée de caractères | + | |
| - | </ | + | |
| - | + | ||
| - | Saisissez la commande suivante pour visualiser la règle iptables pour IPv4 : | + | |
| < | < | ||
| - | root@debian8:~# iptables | + | [root@centos7 |
| - | ACCEPT | + | udp 0 0 0.0.0.0:1194 |
| </ | </ | ||
| - | Saisissez | + | Constatez ensuite |
| - | < | + | < |
| - | root@debian8:~# ip6tables | + | [root@centos7 |
| - | ACCEPT | + | Kernel IP routing table |
| - | ACCEPT | + | Destination |
| + | 0.0.0.0 | ||
| + | 10.0.0.1 | ||
| + | 10.0.2.0 | ||
| </ | </ | ||
| - | <WRAP center round important 50%> | + | Constatez ensuite |
| - | **Important** - Notez que la Rich Rule a créé deux règles, une pour IPv4 et une deuxième pour IPv6. Une règle peut être créée pour IPv4 seul en incluant | + | |
| - | </ | + | |
| - | + | ||
| - | Cette nouvelle règle est écrite en mémoire mais non pas sur disque. Pour l' | + | |
| < | < | ||
| - | root@debian8:~# firewall-cmd --add-rich-rule=' | + | [root@centos7 |
| - | success | + | |
| - | root@debian8: | + | |
| - | <?xml version=" | + | |
| - | < | + | |
| - | < | + | |
| - | < | + | |
| - | <service name=" | + | |
| - | <service name=" | + | |
| - | < | + | |
| - | <port protocol=" | + | |
| - | <accept/> | + | |
| - | </rule> | + | |
| - | </zone> | + | |
| </ | </ | ||
| - | <WRAP center round important 50%> | + | ====6.5 - Tests==== |
| - | **Important** - Attention ! La règle ajoutée avec l' | + | |
| - | </ | + | |
| - | Pour visualiser cette règle dans la configuration de firewalld, il convient de saisir la commande suivante : | + | ===Du client vers le serveur=== |
| - | < | + | Sur le client, utilisez |
| - | root@debian8: | + | |
| - | ... | + | |
| - | work (default, active) | + | |
| - | interfaces: eth0 | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | rule port port=" | + | |
| - | + | ||
| - | </ | + | |
| - | + | ||
| - | Notez que la Rich Rule est créée | + | |
| < | < | ||
| - | root@debian8:~# firewall-cmd --zone=public --add-rich-rule='rule port port=" | + | [root@centos7 |
| - | success | + | PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. |
| - | root@debian8: | + | 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=7.62 ms |
| - | ... | + | 64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=1.35 ms |
| - | public | + | 64 bytes from 10.0.0.1: icmp_seq=3 ttl=64 time=0.000 ms |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | rule port port=" | + | |
| - | trusted | + | |
| - | interfaces: | + | |
| - | sources: | + | |
| - | services: | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | + | ||
| - | work (default, active) | + | |
| - | interfaces: eth0 | + | |
| - | sources: | + | |
| - | services: dhcpv6-client ssh | + | |
| - | ports: | + | |
| - | masquerade: no | + | |
| - | forward-ports: | + | |
| - | icmp-blocks: | + | |
| - | rich rules: | + | |
| - | rule port port=" | + | |
| - | </ | + | |
| - | + | --- 10.0.0.1 ping statistics --- | |
| - | Pour supprimer une Rich Rule, il faut copier la ligne entière la concernant qui se trouve dans la sortie de la commande **firewall-cmd --list-all-zones** : | + | 3 packets transmitted, |
| - | + | rtt min/ | |
| - | < | + | |
| - | root@debian8: | + | |
| - | success | + | |
| </ | </ | ||
| - | ===Le mode Panic de firewalld=== | + | ===Du serveur vers le client=== |
| - | Le mode Panic de firewalld permet de bloquer tout le trafic avec une seule commande. Pour connaître l' | + | Sur le serveur, utilisez la commande |
| < | < | ||
| - | root@debian8:~# firewall-cmd --query-panic | + | [root@centos7 |
| - | no | + | PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. |
| - | </ | + | 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=2.59 ms |
| + | 64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=9.08 ms | ||
| + | 64 bytes from 10.0.0.2: icmp_seq=3 ttl=64 time=7.24 ms | ||
| + | 64 bytes from 10.0.0.2: icmp_seq=4 ttl=64 time=7.03 ms | ||
| + | 64 bytes from 10.0.0.2: icmp_seq=5 ttl=64 time=4.08 ms | ||
| - | Pour activer le mode Panic, il convient de saisir la commande suivante : | + | --- 10.0.0.2 ping statistics |
| - | + | 5 packets transmitted, | |
| - | < | + | rtt min/avg/ |
| - | root@debian8: | + | |
| - | success | + | |
| - | root@debian8: | + | |
| - | yes | + | |
| - | </code> | + | |
| - | + | ||
| - | Pour désactiver le mode Panic, il convient de saisir la commande suivante : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian8: | + | |
| - | success | + | |
| - | root@debian8: | + | |
| - | no | + | |
| </ | </ | ||
| Ligne 7642: | Ligne 6574: | ||
| {{: | {{: | ||
| + | |||
| + | =====Annexe 4 - La Commande iw===== | ||
| + | |||
| + | La commande **iw** permet de gérer le wifi : | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | Connected to 00: | ||
| + | SSID: TP-Link_BEF5_5G | ||
| + | freq: 5220 | ||
| + | RX: 3323698885 bytes (7423914 packets) | ||
| + | TX: 1238020520 bytes (5751871 packets) | ||
| + | signal: -30 dBm | ||
| + | rx bitrate: 433.3 MBit/s VHT-MCS 9 80MHz short GI VHT-NSS 1 | ||
| + | tx bitrate: 433.3 MBit/s VHT-MCS 9 80MHz short GI VHT-NSS 1 | ||
| + | |||
| + | bss flags: | ||
| + | dtim period: 1 | ||
| + | beacon int: 100 | ||
| + | root@debian11: | ||
| + | wlo1 IEEE 802.11 | ||
| + | Mode: | ||
| + | Bit Rate=433.3 Mb/s | ||
| + | Retry short limit: | ||
| + | Encryption key:off | ||
| + | Power Management: | ||
| + | Link Quality=70/ | ||
| + | Rx invalid nwid: | ||
| + | Tx excessive retries: | ||
| + | </ | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | root@debian11: | ||
| + | Usage: | ||
| + | Options: | ||
| + | --debug | ||
| + | --version | ||
| + | Commands: | ||
| + | dev < | ||
| + | Stop AP functionality | ||
| + | |||
| + | |||
| + | dev < | ||
| + | < | ||
| + | |||
| + | |||
| + | phy < | ||
| + | Show coalesce status. | ||
| + | |||
| + | phy < | ||
| + | Disable coalesce. | ||
| + | |||
| + | phy < | ||
| + | Enable coalesce with given configuration. | ||
| + | The configuration file contains coalesce rules: | ||
| + | delay=< | ||
| + | condition=< | ||
| + | patterns=< | ||
| + | delay=< | ||
| + | condition=< | ||
| + | patterns=< | ||
| + | ... | ||
| + | delay: maximum coalescing delay in msec. | ||
| + | condition: 1/0 i.e. 'not match'/' | ||
| + | patterns: each pattern is given as a bytestring with ' | ||
| + | places where any byte may be present, e.g. 00: | ||
| + | match 00: | ||
| + | pattern should be separated by ' | ||
| + | match ' | ||
| + | |||
| + | |||
| + | dev < | ||
| + | Authenticate with the given network. | ||
| + | |||
| + | |||
| + | dev < | ||
| + | Join the network with the given SSID (and frequency, BSSID). | ||
| + | With -w, wait for the connect to finish or fail. | ||
| + | |||
| + | dev < | ||
| + | Disconnect from the current network. | ||
| + | |||
| + | dev < | ||
| + | Set connection quality monitor RSSI threshold. | ||
| + | |||
| + | |||
| + | event [-t|-r] [-f] | ||
| + | Monitor events from the kernel. | ||
| + | -t - print timestamp | ||
| + | -r - print relative timestamp | ||
| + | -f - print full frame for auth/assoc etc. | ||
| + | |||
| + | dev < | ||
| + | Start an FTM responder. Needs a running ap interface | ||
| + | |||
| + | |||
| + | dev < | ||
| + | Get FTM responder statistics. | ||
| + | |||
| + | |||
| + | phy < | ||
| + | |||
| + | |||
| + | phy < | ||
| + | |||
| + | |||
| + | phy < | ||
| + | |||
| + | |||
| + | phy < | ||
| + | |||
| + | |||
| + | dev < | ||
| + | Join the IBSS cell with the given SSID, if it doesn' | ||
| + | it on the given frequency. When fixed frequency is requested, don't | ||
| + | join/create a cell on a different frequency. When a fixed BSSID is | ||
| + | requested use that BSSID and do not adopt another cell's BSSID even | ||
| + | if it has higher TSF and the same SSID. If an IBSS is created, create | ||
| + | it with the specified basic-rates, | ||
| + | |||
| + | dev < | ||
| + | Leave the current IBSS cell. | ||
| + | |||
| + | features | ||
| + | |||
| + | |||
| + | commands | ||
| + | list all known commands and their decimal & hex value | ||
| + | |||
| + | phy | ||
| + | list | ||
| + | List all wireless devices and their capabilities. | ||
| + | |||
| + | phy < | ||
| + | Show capabilities for the specified wireless device. | ||
| + | |||
| + | dev < | ||
| + | dev < | ||
| + | dev < | ||
| + | Switch the operating channel by sending a channel switch announcement (CSA). | ||
| + | |||
| + | dev | ||
| + | List all network interfaces for wireless hardware. | ||
| + | |||
| + | dev < | ||
| + | Show information for this interface. | ||
| + | |||
| + | dev < | ||
| + | Remove this virtual interface | ||
| + | |||
| + | dev < | ||
| + | phy < | ||
| + | Add a new virtual interface with the given configuration. | ||
| + | Valid interface types are: managed, ibss, monitor, mesh, wds. | ||
| + | |||
| + | The flags are only used for monitor interfaces, valid flags are: | ||
| + | none: no special flags | ||
| + | fcsfail: | ||
| + | control: | ||
| + | otherbss: show frames from other BSSes | ||
| + | cook: use cooked mode | ||
| + | active: | ||
| + | mumimo-groupid < | ||
| + | mumimo-follow-mac < | ||
| + | |||
| + | The mesh_id is used only for mesh mode. | ||
| + | |||
| + | help [command] | ||
| + | Print usage for all or a specific command, e.g. | ||
| + | "help wowlan" | ||
| + | |||
| + | dev < | ||
| + | Print information about the current link, if any. | ||
| + | |||
| + | dev < | ||
| + | Send an FTM request to the targets supplied in the config file. | ||
| + | Each line in the file represents a target, with the following format: | ||
| + | < | ||
| + | |||
| + | dev < | ||
| + | Leave a mesh. | ||
| + | |||
| + | dev < | ||
| + | Join a mesh with the given mesh ID with frequency, basic-rates, | ||
| + | mcast-rate and mesh parameters. Basic-rates are applied only if | ||
| + | frequency is provided. | ||
| + | |||
| + | dev < | ||
| + | Register for receiving certain mgmt frames and print them. | ||
| + | Frames are selected by their type and pattern containing | ||
| + | the first several bytes of the frame that should match. | ||
| + | |||
| + | Example: iw dev wlan0 mgmt dump frame 40 00 frame 40 01:02 count 10 | ||
| + | |||
| + | |||
| + | dev < | ||
| + | List known mesh paths. | ||
| + | |||
| + | dev < | ||
| + | Set an existing mesh path's next hop. | ||
| + | |||
| + | dev < | ||
| + | Create a new mesh path (instead of relying on automatic discovery). | ||
| + | |||
| + | dev < | ||
| + | Remove the mesh path to the given node. | ||
| + | |||
| + | dev < | ||
| + | Get information on mesh path to the given node. | ||
| + | |||
| + | dev < | ||
| + | Inject ethernet frame to given peer overriding the next hop | ||
| + | lookup from mpath table. | ||
| + | .Example: iw dev wlan0 mpath probe xx: | ||
| + | |||
| + | |||
| + | dev < | ||
| + | List known mesh proxy paths. | ||
| + | |||
| + | dev < | ||
| + | Get information on mesh proxy path to the given node. | ||
| + | |||
| + | wdev <idx> nan add_func type < | ||
| + | |||
| + | |||
| + | wdev <idx> nan rm_func cookie < | ||
| + | |||
| + | |||
| + | wdev <idx> nan config [pref < | ||
| + | |||
| + | |||
| + | wdev <idx> nan stop | ||
| + | |||
| + | |||
| + | wdev <idx> nan start pref < | ||
| + | |||
| + | |||
| + | dev < | ||
| + | Leave the OCB mode network. | ||
| + | |||
| + | dev < | ||
| + | Join the OCB mode network. | ||
| + | |||
| + | dev < | ||
| + | Leave operating channel and go to the given channel for a while. | ||
| + | |||
| + | wdev <idx> p2p stop | ||
| + | |||
| + | |||
| + | wdev <idx> p2p start | ||
| + | |||
| + | |||
| + | dev < | ||
| + | dev < | ||
| + | dev < | ||
| + | dev < | ||
| + | dev < | ||
| + | dev < | ||
| + | Start or trigger a channel availability check (CAC) looking to look for | ||
| + | radars on the given channel. | ||
| + | |||
| + | phy < | ||
| + | Show available channels. | ||
| + | |||
| + | reg reload | ||
| + | Reload the kernel' | ||
| + | |||
| + | phy < | ||
| + | Print out the devices' | ||
| + | |||
| + | reg get | ||
| + | Print out the kernel' | ||
| + | |||
| + | reg set <ISO/IEC 3166-1 alpha2> | ||
| + | Notify the kernel about the current regulatory domain. | ||
| + | |||
| + | dev < | ||
| + | |||
| + | |||
| + | dev < | ||
| + | Scan on the given frequencies and probe for the given SSIDs | ||
| + | (or wildcard if not given) unless passive scanning is requested. | ||
| + | If -u is specified print unknown data in the scan results. | ||
| + | Specified (vendor) IEs must be well-formed. | ||
| + | |||
| + | dev < | ||
| + | Stop an ongoing scheduled scan. | ||
| + | |||
| + | dev < | ||
| + | Start a scheduled scan at the specified interval on the given frequencies | ||
| + | with probing for the given SSIDs (or wildcard if not given) unless passive | ||
| + | scanning is requested. | ||
| + | will be returned. | ||
| + | |||
| + | dev < | ||
| + | Abort ongoing scan | ||
| + | |||
| + | dev < | ||
| + | Trigger a scan on the given frequencies with probing for the given | ||
| + | SSIDs (or wildcard if not given) unless passive scanning is requested. | ||
| + | Duration(in TUs), if specified, will be used to set dwell times. | ||
| + | |||
| + | |||
| + | dev < | ||
| + | Dump the current scan results. If -u is specified, print unknown | ||
| + | data in scan results. | ||
| + | |||
| + | dev < | ||
| + | Sets up the specified rate masks. | ||
| + | Not passing any arguments would clear the existing mask (if any). | ||
| + | |||
| + | dev < | ||
| + | Setup per-node TID specific configuration for TIDs selected by bitmask. | ||
| + | If MAC address is not specified, then supplied TID configuration | ||
| + | applied to all the peers. | ||
| + | Examples: | ||
| + | $ iw dev wlan0 set tidconf tids 0x1 ampdu off | ||
| + | $ iw dev wlan0 set tidconf tids 0x5 ampdu off amsdu off rtscts on | ||
| + | $ iw dev wlan0 set tidconf tids 0x3 override ampdu on noack on rtscts on | ||
| + | $ iw dev wlan0 set tidconf peer xx: | ||
| + | $ iw dev wlan0 set tidconf peer xx: | ||
| + | $ iw dev wlan0 set tidconf peer xx: | ||
| + | |||
| + | |||
| + | dev < | ||
| + | Set the multicast bitrate. | ||
| + | |||
| + | dev < | ||
| + | Set interface WDS peer. | ||
| + | |||
| + | dev < | ||
| + | Set the NoAck map for the TIDs. (0x0009 = BE, 0x0006 = BK, 0x0030 = VI, 0x00C0 = VO) | ||
| + | |||
| + | dev < | ||
| + | Set interface 4addr (WDS) mode. | ||
| + | |||
| + | dev < | ||
| + | Set interface type/mode. | ||
| + | Valid interface types are: managed, ibss, monitor, mesh, wds. | ||
| + | |||
| + | dev < | ||
| + | dev < | ||
| + | Set monitor flags. Valid flags are: | ||
| + | none: no special flags | ||
| + | fcsfail: | ||
| + | control: | ||
| + | otherbss: show frames from other BSSes | ||
| + | cook: use cooked mode | ||
| + | active: | ||
| + | mumimo-groupid < | ||
| + | mumimo-follow-mac < | ||
| + | |||
| + | dev < | ||
| + | Set mesh parameter (run command without any to see available ones). | ||
| + | |||
| + | phy < | ||
| + | Set TXQ parameters. The limit and memory_limit are global queue limits | ||
| + | for the whole phy. The quantum is the DRR scheduler quantum setting. | ||
| + | Valid values: 1 - 2**32 | ||
| + | |||
| + | phy < | ||
| + | Set a bitmap of allowed antennas to use for TX and RX. | ||
| + | The driver may reject antenna configurations it cannot support. | ||
| + | |||
| + | dev < | ||
| + | Specify transmit power level and setting type. | ||
| + | |||
| + | phy < | ||
| + | Specify transmit power level and setting type. | ||
| + | |||
| + | phy < | ||
| + | Enable ACK timeout estimation algorithm (dynack) or set appropriate | ||
| + | coverage class for given link distance in meters. | ||
| + | To disable dynack set valid value for coverage class. | ||
| + | Valid values: 0 - 114750 | ||
| + | |||
| + | phy < | ||
| + | Set coverage class (1 for every 3 usec of air propagation time). | ||
| + | Valid values: 0 - 255. | ||
| + | |||
| + | phy < | ||
| + | Put this wireless device into a different network namespace: | ||
| + | < | ||
| + | < | ||
| + | or by absolute path (man ip-netns) | ||
| + | |||
| + | |||
| + | phy < | ||
| + | Set retry limit. | ||
| + | |||
| + | phy < | ||
| + | Set rts threshold. | ||
| + | |||
| + | phy < | ||
| + | Set fragmentation threshold. | ||
| + | |||
| + | dev < | ||
| + | phy < | ||
| + | dev < | ||
| + | dev < | ||
| + | phy < | ||
| + | phy < | ||
| + | Set frequency/ | ||
| + | configuration. | ||
| + | |||
| + | phy < | ||
| + | Rename this wireless device. | ||
| + | |||
| + | dev < | ||
| + | Set power save state to on or off. | ||
| + | |||
| + | dev < | ||
| + | Retrieve mesh parameter (run command without any to see available ones). | ||
| + | |||
| + | phy < | ||
| + | Get TXQ parameters. | ||
| + | |||
| + | dev < | ||
| + | Retrieve power save state. | ||
| + | |||
| + | dev < | ||
| + | List all stations known, e.g. the AP on managed interfaces | ||
| + | |||
| + | dev < | ||
| + | Set Tx power for this station. | ||
| + | |||
| + | dev < | ||
| + | Set airtime weight for this station. | ||
| + | |||
| + | dev < | ||
| + | Set link-specific mesh power mode for this station | ||
| + | |||
| + | dev < | ||
| + | Set an AP VLAN for this station. | ||
| + | |||
| + | dev < | ||
| + | Set mesh peer link action for this station (peer). | ||
| + | |||
| + | dev < | ||
| + | Remove the given station entry (use with caution!) | ||
| + | Example subtype values: 0xA (disassociation), | ||
| + | |||
| + | dev < | ||
| + | Get information for a specific station. | ||
| + | |||
| + | dev < | ||
| + | List all gathered channel survey data | ||
| + | |||
| + | dev < | ||
| + | |||
| + | |||
| + | dev < | ||
| + | |||
| + | |||
| + | dev < | ||
| + | |||
| + | |||
| + | phy < | ||
| + | Show WoWLAN status. | ||
| + | |||
| + | phy < | ||
| + | Disable WoWLAN. | ||
| + | |||
| + | phy < | ||
| + | Enable WoWLAN with the given triggers. | ||
| + | Each pattern is given as a bytestring with ' | ||
| + | may be present, e.g. 00: | ||
| + | 00: | ||
| + | Offset and pattern should be separated by ' | ||
| + | |||
| + | The TCP configuration file contains: | ||
| + | source=ip[: | ||
| + | dest=ip: | ||
| + | data=< | ||
| + | data.interval=seconds | ||
| + | [wake=< | ||
| + | [data.seq=len, | ||
| + | [data.tok=len, | ||
| + | |||
| + | Net-detect configuration example: | ||
| + | iw phy0 wowlan enable net-detect interval 5000 delay 30 freqs 2412 2422 matches ssid foo ssid bar | ||
| + | |||
| + | |||
| + | Commands that use the netdev (' | ||
| + | ' | ||
| + | |||
| + | You can omit the ' | ||
| + | e.g. "iw wlan0 info" or "iw phy0 info". (Don't when scripting.) | ||
| + | |||
| + | Do NOT screenscrape this tool, we don't consider its output stable. | ||
| + | </ | ||
| + | |||
| ----- | ----- | ||
| - | < | + | Copyright © 2022 Hugh Norris. |
| - | <div align=" | + | |
| - | Copyright © 2020 Hugh Norris | + | |
| - | </ | + | |
| - | </ | + | |
| - | ----- | + | |
