Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:centos:6:avance:l108 [2020/03/09 14:01] – supprimée admin | elearning:workbooks:centos:6:avance:l108 [2023/02/15 16:06] (Version actuelle) – created admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| + | ~~PDF: | ||
| + | Version : **2020.03** - Consulter le Change Log en fin de module. | ||
| + | |||
| + | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| + | |||
| + | ======LCF307 - Gestion du Balayage des Ports====== | ||
| + | |||
| + | =====Contenu du Module===== | ||
| + | |||
| + | * **LCF307 - Gestion du Balayage des Ports** | ||
| + | * Contenu du Module | ||
| + | * Le Problématique | ||
| + | * LAB #1 - Utilisation de nmap et de netcat | ||
| + | * nmap | ||
| + | * Installation | ||
| + | * Utilisation | ||
| + | * Fichiers de Configuration | ||
| + | * Scripts | ||
| + | * netcat | ||
| + | * Utilisation | ||
| + | * Les Contre-Mesures | ||
| + | * LAB #2 - Mise en place du Système de Détection d' | ||
| + | * Installation | ||
| + | * Configuration de Snort | ||
| + | * Editer le fichier / | ||
| + | * Utilisation de snort en mode " | ||
| + | * Utilisation de snort en mode " | ||
| + | * Journalisation | ||
| + | * LAB #3 - Mise en place du Système de Détection et de Prévention d' | ||
| + | * Installation | ||
| + | * Configuration | ||
| + | * Utilisation | ||
| + | * ChangeLog | ||
| + | * 2020.01 | ||
| + | * 2020.02 | ||
| + | * 2020.03 | ||
| + | |||
| + | =====Le Problématique===== | ||
| + | |||
| + | Un **Cheval de Troie** est un binaire qui se cache dans un autre. Il est exécuté suite à l' | ||
| + | |||
| + | * Back Orifice 2000 - tcp/8787, tcp/ | ||
| + | * Backdoor - tcp/1999, | ||
| + | * Subseven - tcp/1243, tcp/ 2773, tcp/ | ||
| + | * Socket de Troie - tcp/5001, tcp/30303, tcp/50505. | ||
| + | |||
| + | Le **scan** consiste à balayer les ports d'une machine afin de : | ||
| + | |||
| + | * connaître les ports qui sont ouverts, | ||
| + | * déterminer le système d' | ||
| + | * identifier les services ouverts. | ||
| + | |||
| + | Plusieurs scanners existent dont : | ||
| + | |||
| + | * nmap | ||
| + | * netcat | ||
| + | |||
| + | ====LAB #1 - Utilisation de nmap et de netcat==== | ||
| + | |||
| + | === nmap === | ||
| + | |||
| + | ==Installation== | ||
| + | |||
| + | Sous RHEL/CentOS 7, **nmap** n'est pas installé par défaut : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# which nmap | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | Installez donc nmap en utilisant yum : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# yum install nmap | ||
| + | Loaded plugins: fastestmirror, | ||
| + | Repodata is over 2 weeks old. Install yum-cron? Or run: yum makecache fast | ||
| + | adobe-linux-x86_64 | ||
| + | base | 3.6 kB | ||
| + | extras | ||
| + | updates | ||
| + | (1/3): adobe-linux-x86_64/ | ||
| + | (2/3): extras/ | ||
| + | (3/3): updates/ | ||
| + | Determining fastest mirrors | ||
| + | * base: ftp.rezopole.net | ||
| + | * extras: ftp.rezopole.net | ||
| + | * updates: ftp.rezopole.net | ||
| + | Resolving Dependencies | ||
| + | --> Running transaction check | ||
| + | ---> Package nmap.x86_64 2: | ||
| + | --> Processing Dependency: nmap-ncat = 2: | ||
| + | --> Running transaction check | ||
| + | ---> Package nmap-ncat.x86_64 2: | ||
| + | --> Finished Dependency Resolution | ||
| + | |||
| + | Dependencies Resolved | ||
| + | |||
| + | ================================================================================ | ||
| + | | ||
| + | ================================================================================ | ||
| + | Installing: | ||
| + | | ||
| + | Installing for dependencies: | ||
| + | | ||
| + | |||
| + | Transaction Summary | ||
| + | ================================================================================ | ||
| + | Install | ||
| + | |||
| + | Total download size: 4.2 M | ||
| + | Installed size: 17 M | ||
| + | Is this ok [y/d/N]: y | ||
| + | </ | ||
| + | |||
| + | ==Options de la commande== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmap --help | ||
| + | Nmap 6.40 ( http:// | ||
| + | Usage: nmap [Scan Type(s)] [Options] {target specification} | ||
| + | TARGET SPECIFICATION: | ||
| + | Can pass hostnames, IP addresses, networks, etc. | ||
| + | Ex: scanme.nmap.org, | ||
| + | -iL < | ||
| + | -iR <num hosts>: Choose random targets | ||
| + | --exclude < | ||
| + | --excludefile < | ||
| + | HOST DISCOVERY: | ||
| + | -sL: List Scan - simply list targets to scan | ||
| + | -sn: Ping Scan - disable port scan | ||
| + | -Pn: Treat all hosts as online -- skip host discovery | ||
| + | -PS/ | ||
| + | -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes | ||
| + | -PO[protocol list]: IP Protocol Ping | ||
| + | -n/-R: Never do DNS resolution/ | ||
| + | --dns-servers < | ||
| + | --system-dns: | ||
| + | --traceroute: | ||
| + | SCAN TECHNIQUES: | ||
| + | -sS/ | ||
| + | -sU: UDP Scan | ||
| + | -sN/sF/sX: TCP Null, FIN, and Xmas scans | ||
| + | --scanflags < | ||
| + | -sI <zombie host[: | ||
| + | -sY/sZ: SCTP INIT/ | ||
| + | -sO: IP protocol scan | ||
| + | -b <FTP relay host>: FTP bounce scan | ||
| + | PORT SPECIFICATION AND SCAN ORDER: | ||
| + | -p <port ranges>: Only scan specified ports | ||
| + | Ex: -p22; -p1-65535; -p U: | ||
| + | -F: Fast mode - Scan fewer ports than the default scan | ||
| + | -r: Scan ports consecutively - don't randomize | ||
| + | --top-ports < | ||
| + | --port-ratio < | ||
| + | SERVICE/ | ||
| + | -sV: Probe open ports to determine service/ | ||
| + | --version-intensity < | ||
| + | --version-light: | ||
| + | --version-all: | ||
| + | --version-trace: | ||
| + | SCRIPT SCAN: | ||
| + | -sC: equivalent to --script=default | ||
| + | --script=< | ||
| + | | ||
| + | --script-args=< | ||
| + | --script-args-file=filename: | ||
| + | --script-trace: | ||
| + | --script-updatedb: | ||
| + | --script-help=< | ||
| + | < | ||
| + | | ||
| + | OS DETECTION: | ||
| + | -O: Enable OS detection | ||
| + | --osscan-limit: | ||
| + | --osscan-guess: | ||
| + | TIMING AND PERFORMANCE: | ||
| + | Options which take < | ||
| + | ' | ||
| + | -T< | ||
| + | --min-hostgroup/ | ||
| + | --min-parallelism/ | ||
| + | --min-rtt-timeout/ | ||
| + | probe round trip time. | ||
| + | --max-retries < | ||
| + | --host-timeout < | ||
| + | --scan-delay/ | ||
| + | --min-rate < | ||
| + | --max-rate < | ||
| + | FIREWALL/ | ||
| + | -f; --mtu < | ||
| + | -D < | ||
| + | -S < | ||
| + | -e < | ||
| + | -g/ | ||
| + | --data-length < | ||
| + | --ip-options < | ||
| + | --ttl < | ||
| + | --spoof-mac <mac address/ | ||
| + | --badsum: Send packets with a bogus TCP/ | ||
| + | OUTPUT: | ||
| + | -oN/ | ||
| + | and Grepable format, respectively, | ||
| + | -oA < | ||
| + | -v: Increase verbosity level (use -vv or more for greater effect) | ||
| + | -d: Increase debugging level (use -dd or more for greater effect) | ||
| + | --reason: Display the reason a port is in a particular state | ||
| + | --open: Only show open (or possibly open) ports | ||
| + | --packet-trace: | ||
| + | --iflist: Print host interfaces and routes (for debugging) | ||
| + | --log-errors: | ||
| + | --append-output: | ||
| + | --resume < | ||
| + | --stylesheet < | ||
| + | --webxml: Reference stylesheet from Nmap.Org for more portable XML | ||
| + | --no-stylesheet: | ||
| + | MISC: | ||
| + | -6: Enable IPv6 scanning | ||
| + | -A: Enable OS detection, version detection, script scanning, and traceroute | ||
| + | --datadir < | ||
| + | --send-eth/ | ||
| + | --privileged: | ||
| + | --unprivileged: | ||
| + | -V: Print version number | ||
| + | -h: Print this help summary page. | ||
| + | EXAMPLES: | ||
| + | nmap -v -A scanme.nmap.org | ||
| + | nmap -v -sn 192.168.0.0/ | ||
| + | nmap -v -iR 10000 -Pn -p 80 | ||
| + | SEE THE MAN PAGE (http:// | ||
| + | </ | ||
| + | |||
| + | ==Utilisation== | ||
| + | |||
| + | Pour connaître la liste des ports ouverts sur votre machine virtuelle, saisissez la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmap 127.0.0.1 | ||
| + | |||
| + | Starting Nmap 6.40 ( http:// | ||
| + | Nmap scan report for localhost.localdomain (127.0.0.1) | ||
| + | Host is up (-2100s latency). | ||
| + | Not shown: 996 closed ports | ||
| + | PORT STATE SERVICE | ||
| + | 22/ | ||
| + | 25/ | ||
| + | 111/tcp open rpcbind | ||
| + | 631/tcp open ipp | ||
| + | |||
| + | Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Pour connaître les ports ouverts sur une machine distante, la procédure est identique sauf que vous devez utiliser l' | ||
| + | </ | ||
| + | |||
| + | ==Fichiers de Configuration== | ||
| + | |||
| + | **nmap** utilise un fichier spécifique pour identifier les ports. Ce fichier est **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# more / | ||
| + | # THIS FILE IS GENERATED AUTOMATICALLY FROM A MASTER - DO NOT EDIT. | ||
| + | # EDIT / | ||
| + | # Well known service port numbers -*- mode: fundamental; | ||
| + | # From the Nmap Security Scanner ( http:// | ||
| + | # | ||
| + | # $Id: nmap-services 31220 2013-07-03 04:30:43Z david $ | ||
| + | # | ||
| + | # Derived from IANA data and our own research | ||
| + | # | ||
| + | # This collection of service data is (C) 1996-2011 by Insecure.Com | ||
| + | # LLC. It is distributed under the Nmap Open Source license as | ||
| + | # provided in the COPYING file of the source distribution or at | ||
| + | # http:// | ||
| + | # requires you to license your own work under a compatable open source | ||
| + | # license. | ||
| + | # software, we sell alternative licenses (contact sales@insecure.com). | ||
| + | # Dozens of software vendors already license Nmap technology such as | ||
| + | # host discovery, port scanning, OS detection, and version detection. | ||
| + | # For more details, see http:// | ||
| + | # | ||
| + | # Fields in this file are: Service name, portnum/ | ||
| + | # | ||
| + | tcpmux 1/ | ||
| + | tcpmux 1/ | ||
| + | compressnet 2/ | ||
| + | compressnet 2/ | ||
| + | compressnet 3/ | ||
| + | compressnet 3/ | ||
| + | unknown 4/ | ||
| + | rje 5/ | ||
| + | unknown 6/ | ||
| + | echo 7/ | ||
| + | echo 7/ | ||
| + | echo 7/ | ||
| + | unknown 8/ | ||
| + | --More--(0%) | ||
| + | </ | ||
| + | |||
| + | Le répertoire **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ls -l / | ||
| + | total 6548 | ||
| + | -rw-r--r--. 1 root root 10546 Nov 20 2015 nmap.dtd | ||
| + | -rw-r--r--. 1 root root 455371 Nov 20 2015 nmap-mac-prefixes | ||
| + | -rw-r--r--. 1 root root 3694559 Nov 20 2015 nmap-os-db | ||
| + | -rw-r--r--. 1 root root 11749 Nov 20 2015 nmap-payloads | ||
| + | -rw-r--r--. 1 root root 6631 Nov 20 2015 nmap-protocols | ||
| + | -rw-r--r--. 1 root root 49243 Nov 20 2015 nmap-rpc | ||
| + | -rw-r--r--. 1 root root 1727204 Nov 20 2015 nmap-service-probes | ||
| + | -rw-r--r--. 1 root root 622039 Nov 20 2015 nmap-services | ||
| + | -rw-r--r--. 1 root root 31935 Nov 20 2015 nmap.xsl | ||
| + | drwxr-xr-x. 3 root root 4096 Aug 5 14:16 nselib | ||
| + | -rw-r--r--. 1 root root 47190 Nov 20 2015 nse_main.lua | ||
| + | drwxr-xr-x. 2 root root 20480 Aug 5 14:16 scripts | ||
| + | </ | ||
| + | |||
| + | Voici la liste des fichiers les plus importants : | ||
| + | |||
| + | ^ Fichier ^ Description ^ | ||
| + | | / | ||
| + | | / | ||
| + | | / | ||
| + | | / | ||
| + | |||
| + | ==Scripts== | ||
| + | |||
| + | **nmap** utilise des scripts pour accomplir certaines tâches allant de la découverte simple de ports ouverts jusqu' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ls / | ||
| + | acarsd-info.nse | ||
| + | address-info.nse | ||
| + | afp-brute.nse | ||
| + | afp-ls.nse | ||
| + | afp-path-vuln.nse | ||
| + | afp-serverinfo.nse | ||
| + | afp-showmount.nse | ||
| + | ajp-auth.nse | ||
| + | ajp-brute.nse | ||
| + | ajp-headers.nse | ||
| + | ajp-methods.nse | ||
| + | ajp-request.nse | ||
| + | amqp-info.nse | ||
| + | asn-query.nse | ||
| + | auth-owners.nse | ||
| + | auth-spoof.nse | ||
| + | backorifice-brute.nse | ||
| + | backorifice-info.nse | ||
| + | banner.nse | ||
| + | bitcoin-getaddr.nse | ||
| + | bitcoin-info.nse | ||
| + | bitcoinrpc-info.nse | ||
| + | bittorrent-discovery.nse | ||
| + | bjnp-discover.nse | ||
| + | broadcast-ataoe-discover.nse | ||
| + | broadcast-avahi-dos.nse | ||
| + | broadcast-bjnp-discover.nse | ||
| + | broadcast-db2-discover.nse | ||
| + | broadcast-dhcp6-discover.nse | ||
| + | broadcast-dhcp-discover.nse | ||
| + | broadcast-dns-service-discovery.nse | ||
| + | broadcast-dropbox-listener.nse | ||
| + | broadcast-eigrp-discovery.nse | ||
| + | broadcast-igmp-discovery.nse | ||
| + | broadcast-listener.nse | ||
| + | broadcast-ms-sql-discover.nse | ||
| + | broadcast-netbios-master-browser.nse | ||
| + | broadcast-networker-discover.nse | ||
| + | broadcast-novell-locate.nse | ||
| + | broadcast-pc-anywhere.nse | ||
| + | broadcast-pc-duo.nse | ||
| + | broadcast-pim-discovery.nse | ||
| + | broadcast-ping.nse | ||
| + | broadcast-pppoe-discover.nse | ||
| + | broadcast-rip-discover.nse | ||
| + | broadcast-ripng-discover.nse | ||
| + | broadcast-sybase-asa-discover.nse | ||
| + | broadcast-tellstick-discover.nse | ||
| + | broadcast-upnp-info.nse | ||
| + | broadcast-versant-locate.nse | ||
| + | broadcast-wake-on-lan.nse | ||
| + | broadcast-wpad-discover.nse | ||
| + | broadcast-wsdd-discover.nse | ||
| + | broadcast-xdmcp-discover.nse | ||
| + | cassandra-brute.nse | ||
| + | cassandra-info.nse | ||
| + | cccam-version.nse | ||
| + | citrix-brute-xml.nse | ||
| + | citrix-enum-apps.nse | ||
| + | citrix-enum-apps-xml.nse | ||
| + | citrix-enum-servers.nse | ||
| + | citrix-enum-servers-xml.nse | ||
| + | couchdb-databases.nse | ||
| + | couchdb-stats.nse | ||
| + | creds-summary.nse | ||
| + | cups-info.nse | ||
| + | cups-queue-info.nse | ||
| + | cvs-brute.nse | ||
| + | cvs-brute-repository.nse | ||
| + | daap-get-library.nse | ||
| + | daytime.nse | ||
| + | db2-das-info.nse | ||
| + | db2-discover.nse | ||
| + | dhcp-discover.nse | ||
| + | dict-info.nse | ||
| + | distcc-cve2004-2687.nse | ||
| + | dns-blacklist.nse | ||
| + | dns-brute.nse | ||
| + | dns-cache-snoop.nse | ||
| + | dns-check-zone.nse | ||
| + | dns-client-subnet-scan.nse | ||
| + | dns-fuzz.nse | ||
| + | dns-ip6-arpa-scan.nse | ||
| + | dns-nsec3-enum.nse | ||
| + | dns-nsec-enum.nse | ||
| + | dns-nsid.nse | ||
| + | dns-random-srcport.nse | ||
| + | dns-random-txid.nse | ||
| + | dns-recursion.nse | ||
| + | dns-service-discovery.nse | ||
| + | dns-srv-enum.nse | ||
| + | dns-update.nse | ||
| + | dns-zeustracker.nse | ||
| + | dns-zone-transfer.nse | ||
| + | domcon-brute.nse | ||
| + | domcon-cmd.nse | ||
| + | domino-enum-users.nse | ||
| + | dpap-brute.nse | ||
| + | drda-brute.nse | ||
| + | drda-info.nse | ||
| + | duplicates.nse | ||
| + | eap-info.nse | ||
| + | epmd-info.nse | ||
| + | eppc-enum-processes.nse | ||
| + | finger.nse | ||
| + | firewalk.nse | ||
| + | firewall-bypass.nse | ||
| + | flume-master-info.nse | ||
| + | ftp-anon.nse | ||
| + | ftp-bounce.nse | ||
| + | ftp-brute.nse | ||
| + | ftp-libopie.nse | ||
| + | ftp-proftpd-backdoor.nse | ||
| + | ftp-vsftpd-backdoor.nse | ||
| + | ftp-vuln-cve2010-4221.nse | ||
| + | ganglia-info.nse | ||
| + | giop-info.nse | ||
| + | gkrellm-info.nse | ||
| + | gopher-ls.nse | ||
| + | gpsd-info.nse | ||
| + | hadoop-datanode-info.nse | ||
| + | hadoop-jobtracker-info.nse | ||
| + | hadoop-namenode-info.nse | ||
| + | hadoop-secondary-namenode-info.nse | ||
| + | hadoop-tasktracker-info.nse | ||
| + | hbase-master-info.nse | ||
| + | hbase-region-info.nse | ||
| + | hddtemp-info.nse | ||
| + | hostmap-bfk.nse | ||
| + | hostmap-ip2hosts.nse | ||
| + | hostmap-robtex.nse | ||
| + | http-adobe-coldfusion-apsa1301.nse | ||
| + | http-affiliate-id.nse | ||
| + | http-apache-negotiation.nse | ||
| + | http-auth-finder.nse | ||
| + | http-auth.nse | ||
| + | http-awstatstotals-exec.nse | ||
| + | http-axis2-dir-traversal.nse | ||
| + | http-backup-finder.nse | ||
| + | http-barracuda-dir-traversal.nse | ||
| + | http-brute.nse | ||
| + | http-cakephp-version.nse | ||
| + | http-chrono.nse | ||
| + | http-coldfusion-subzero.nse | ||
| + | http-comments-displayer.nse | ||
| + | http-config-backup.nse | ||
| + | http-cors.nse | ||
| + | http-date.nse | ||
| + | http-default-accounts.nse | ||
| + | </ | ||
| + | |||
| + | Les scripts sont regroupés dans des catégories : **auth**, **broadcast**, | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Pour plus d' | ||
| + | </ | ||
| + | |||
| + | La catégorie la plus utilisée est **default** qui est appelée par l' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmap -v -sC localhost | ||
| + | |||
| + | Starting Nmap 6.40 ( http:// | ||
| + | NSE: Loaded 95 scripts for scanning. | ||
| + | NSE: Script Pre-scanning. | ||
| + | Initiating SYN Stealth Scan at 14:20 | ||
| + | Scanning localhost (127.0.0.1) [1000 ports] | ||
| + | Discovered open port 22/tcp on 127.0.0.1 | ||
| + | adjust_timeouts2: | ||
| + | adjust_timeouts2: | ||
| + | Discovered open port 25/tcp on 127.0.0.1 | ||
| + | adjust_timeouts2: | ||
| + | adjust_timeouts2: | ||
| + | Discovered open port 111/tcp on 127.0.0.1 | ||
| + | adjust_timeouts2: | ||
| + | adjust_timeouts2: | ||
| + | Discovered open port 631/tcp on 127.0.0.1 | ||
| + | adjust_timeouts2: | ||
| + | adjust_timeouts2: | ||
| + | Completed SYN Stealth Scan at 14:20, 0.01s elapsed (1000 total ports) | ||
| + | NSE: Script scanning 127.0.0.1. | ||
| + | Initiating NSE at 14:20 | ||
| + | Completed NSE at 14:20, 0.28s elapsed | ||
| + | Nmap scan report for localhost (127.0.0.1) | ||
| + | Host is up (0.0000060s latency). | ||
| + | rDNS record for 127.0.0.1: localhost.localdomain | ||
| + | Not shown: 996 closed ports | ||
| + | PORT STATE SERVICE | ||
| + | 22/ | ||
| + | | ssh-hostkey: | ||
| + | |_256 19: | ||
| + | 25/ | ||
| + | |_smtp-commands: | ||
| + | 111/tcp open rpcbind | ||
| + | | rpcinfo: | ||
| + | | | ||
| + | | | ||
| + | |_ 100000 | ||
| + | 631/tcp open ipp | ||
| + | | http-methods: | ||
| + | | Potentially risky methods: PUT | ||
| + | |_See http:// | ||
| + | | http-robots.txt: | ||
| + | |_/ | ||
| + | |_http-title: | ||
| + | |||
| + | NSE: Script Post-scanning. | ||
| + | Initiating NSE at 14:20 | ||
| + | Completed NSE at 14:20, 0.00s elapsed | ||
| + | Read data files from: / | ||
| + | Nmap done: 1 IP address (1 host up) scanned in 0.43 seconds | ||
| + | Raw packets sent: 1000 (44.000KB) | Rcvd: 2004 (84.176KB) | ||
| + | </ | ||
| + | |||
| + | <WRAP center round warning 50%> | ||
| + | **Attention** - La catégorie par défaut **default** contient certains scripts de la catégorie **intrusive**. Vous ne devez donc jamais utiliser cette option sur un réseau sans avoir obtenu un accord au préalable. | ||
| + | </ | ||
| + | |||
| + | ===netcat === | ||
| + | |||
| + | **netcat** est un couteau suisse. Il permet non seulement de scanner des ports mais aussi de lancer la connexion lors de la découverte d'un port ouvert. | ||
| + | |||
| + | ==Options de la commande== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nc --help | ||
| + | Ncat 6.40 ( http:// | ||
| + | Usage: ncat [options] [hostname] [port] | ||
| + | |||
| + | Options taking a time assume seconds. Append ' | ||
| + | ' | ||
| + | -4 Use IPv4 only | ||
| + | -6 Use IPv6 only | ||
| + | -U, --unixsock | ||
| + | -C, --crlf | ||
| + | -c, --sh-exec < | ||
| + | -e, --exec < | ||
| + | --lua-exec < | ||
| + | -g hop1[, | ||
| + | -G < | ||
| + | -m, --max-conns < | ||
| + | -h, --help | ||
| + | -d, --delay < | ||
| + | -o, --output < | ||
| + | -x, --hex-dump < | ||
| + | -i, --idle-timeout < | ||
| + | -p, --source-port port | ||
| + | -s, --source addr Specify source address to use (doesn' | ||
| + | -l, --listen | ||
| + | -k, --keep-open | ||
| + | -n, --nodns | ||
| + | -t, --telnet | ||
| + | -u, --udp Use UDP instead of default TCP | ||
| + | --sctp | ||
| + | -v, --verbose | ||
| + | -w, --wait < | ||
| + | --append-output | ||
| + | --send-only | ||
| + | --recv-only | ||
| + | --allow | ||
| + | --allowfile | ||
| + | --deny | ||
| + | --denyfile | ||
| + | --broker | ||
| + | --chat | ||
| + | --proxy < | ||
| + | --proxy-type < | ||
| + | --proxy-auth < | ||
| + | --ssl Connect or listen with SSL | ||
| + | --ssl-cert | ||
| + | --ssl-key | ||
| + | --ssl-verify | ||
| + | --ssl-trustfile | ||
| + | --version | ||
| + | |||
| + | See the ncat(1) manpage for full options, descriptions and usage examples | ||
| + | </ | ||
| + | |||
| + | ==Utilisation== | ||
| + | |||
| + | Dans l' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nc 127.0.0.1 80 -w 1 -vv | ||
| + | Ncat: Version 6.40 ( http:// | ||
| + | libnsock nsi_new2(): nsi_new (IOD #1) | ||
| + | libnsock nsock_connect_tcp(): | ||
| + | libnsock nsock_trace_handler_callback(): | ||
| + | Ncat: Connection refused. | ||
| + | |||
| + | [root@centos7 ~]# nc 127.0.0.1 25 -w 1 -vv | ||
| + | Ncat: Version 6.40 ( http:// | ||
| + | libnsock nsi_new2(): nsi_new (IOD #1) | ||
| + | libnsock nsock_connect_tcp(): | ||
| + | libnsock nsock_trace_handler_callback(): | ||
| + | Ncat: Connected to 127.0.0.1: | ||
| + | libnsock nsi_new2(): nsi_new (IOD #2) | ||
| + | libnsock nsock_read(): | ||
| + | libnsock nsock_readbytes(): | ||
| + | libnsock nsock_trace_handler_callback(): | ||
| + | 220 centos7.fenestros.loc ESMTP Postfix | ||
| + | libnsock nsock_readbytes(): | ||
| + | ^C | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez que **netcat** se connecte au port 25 qui est ouvert. | ||
| + | </ | ||
| + | |||
| + | =====Les Contre-Mesures===== | ||
| + | |||
| + | Les contre-mesures incluent l' | ||
| + | |||
| + | ====LAB #2 - Mise en place du Système de Détection d' | ||
| + | |||
| + | Snort est un **S**ystème de **D**étection d' | ||
| + | |||
| + | === Installation === | ||
| + | |||
| + | Sous RHEL/CentOS 7, **snort** n'est pas installé par défaut. Qui plus est **snort** ne se trouve pas dans les dépôts standards : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# yum provides snort | ||
| + | Loaded plugins: fastestmirror, | ||
| + | Loading mirror speeds from cached hostfile | ||
| + | * base: ftp.rezopole.net | ||
| + | * extras: ftp.rezopole.net | ||
| + | * updates: ftp.rezopole.net | ||
| + | adobe-linux-x86_64/ | ||
| + | extras/ | ||
| + | updates/ | ||
| + | No matches found | ||
| + | </ | ||
| + | |||
| + | Commencez donc par installer les dépendances de snort à partir des dépôts standards : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# yum install gcc flex bison zlib libpcap pcre libdnet tcpdump | ||
| + | </ | ||
| + | |||
| + | Snort a aussi besoin du paquet **libnghttp2** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# rpm -ivh https:// | ||
| + | </ | ||
| + | |||
| + | ainsi que le paquet **daq** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# rpm -ivh https:// | ||
| + | </ | ||
| + | |||
| + | |||
| + | Il est maintenant possible d' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# rpm -ivh https:// | ||
| + | </ | ||
| + | |||
| + | Créez un lien symbolique pour la bibliothèque partagée **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ln -s / | ||
| + | </ | ||
| + | |||
| + | Dernièrement, | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# chmod ug+x / | ||
| + | </ | ||
| + | |||
| + | ==Options de la commande== | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# snort --help | ||
| + | |||
| + | ,, | ||
| + | o" | ||
| + | '''' | ||
| + | | ||
| + | | ||
| + | Using libpcap version 1.5.3 | ||
| + | Using PCRE version: 8.32 2012-11-30 | ||
| + | Using ZLIB version: 1.2.7 | ||
| + | |||
| + | USAGE: snort [-options] <filter options> | ||
| + | Options: | ||
| + | -A Set alert mode: fast, full, console, test or none (alert file alerts only) | ||
| + | " | ||
| + | -b Log packets in tcpdump format (much faster!) | ||
| + | -B < | ||
| + | -c < | ||
| + | -C Print out payloads with character data only (no hex) | ||
| + | -d Dump the Application Layer | ||
| + | -D Run Snort in background (daemon) mode | ||
| + | -e | ||
| + | -f Turn off fflush() calls after binary log writes | ||
| + | -F < | ||
| + | -g < | ||
| + | -G < | ||
| + | -h < | ||
| + | (for use with -l or -B, does NOT change $HOME_NET in IDS mode) | ||
| + | -H Make hash tables deterministic. | ||
| + | -i < | ||
| + | -I Add Interface name to alert output | ||
| + | -k < | ||
| + | -K < | ||
| + | -l < | ||
| + | -L < | ||
| + | -M Log messages to syslog (not alerts) | ||
| + | -m < | ||
| + | -n < | ||
| + | -N Turn off logging (alerts still work) | ||
| + | -O | ||
| + | -p | ||
| + | -P < | ||
| + | -q | ||
| + | -Q | ||
| + | -r < | ||
| + | -R < | ||
| + | -s Log alert messages to syslog | ||
| + | -S < | ||
| + | -t < | ||
| + | -T Test and report on the current Snort configuration | ||
| + | -u < | ||
| + | -U Use UTC for timestamps | ||
| + | -v Be verbose | ||
| + | -V Show version number | ||
| + | -X Dump the raw packet data starting at the link layer | ||
| + | -x Exit if Snort configuration problems occur | ||
| + | -y | ||
| + | -Z < | ||
| + | -? Show this information | ||
| + | <Filter Options> are standard BPF options, as seen in TCPDump | ||
| + | Longname options and their corresponding single char version | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | for < | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | takes from signaling until DAQ_Stop() is called. | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | --daq < | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | </ | ||
| + | |||
| + | ===Configuration de Snort=== | ||
| + | |||
| + | Snort a besoin de règles pour fonctionner correctement. Ces règles sont disponibles sous trois formes différentes : | ||
| + | |||
| + | * **Community** - règles de base disponibles à tout le monde, | ||
| + | * **Registered** - règles disponibles à toute personne possédant un compte gratuit sur le site **[[http:// | ||
| + | * **Subscription** - règles les plus efficaces disponibles uniquement aux utilisateurs enregistrés **et** abonnés à un plan payant. | ||
| + | |||
| + | Le répertoire rules est donc vide lors de l' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ls / | ||
| + | [root@centos7 ~]# | ||
| + | </ | ||
| + | |||
| + | Téléchargez les règles **Registered** grâce au lien suivant contenant un **oinkcode** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# wget https:// | ||
| + | </ | ||
| + | |||
| + | Ensuite, saisissez les commandes suivantes : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# tar -xvf ~/ | ||
| + | [root@centos7 ~]# ls / | ||
| + | app-detect.rules | ||
| + | attack-responses.rules | ||
| + | backdoor.rules | ||
| + | bad-traffic.rules | ||
| + | blacklist.rules | ||
| + | botnet-cnc.rules | ||
| + | browser-chrome.rules | ||
| + | browser-firefox.rules | ||
| + | browser-ie.rules | ||
| + | browser-other.rules | ||
| + | browser-plugins.rules | ||
| + | browser-webkit.rules | ||
| + | chat.rules | ||
| + | content-replace.rules | ||
| + | ddos.rules | ||
| + | deleted.rules | ||
| + | dns.rules | ||
| + | dos.rules | ||
| + | experimental.rules | ||
| + | exploit-kit.rules | ||
| + | exploit.rules | ||
| + | file-executable.rules | ||
| + | file-flash.rules | ||
| + | file-identify.rules | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Si vous utilisez **snort** régulièrement, | ||
| + | </ | ||
| + | |||
| + | == Editer le fichier / | ||
| + | |||
| + | Lancez vi pour éditer le fichier **/ | ||
| + | |||
| + | Modifiez la ligne qui commence par **ipvar HOME_NET** pour que celle-ci comporte l' | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | ipvar HOME_NET 10.0.2.0/24 | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Dans le cas où vous êtes connecté à deux ou à plusieurs réseaux directement, | ||
| + | |||
| + | ipvar HOME_NET [adresse_réseau_1 ( p.e. 10.0.2.0/24 ), adresse_réseau_2 ( p.e. 10.0.0.0/8 )] | ||
| + | |||
| + | Vérifiez la présence de les lignes qui commencent par **var RULE_PATH**, | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | var RULE_PATH / | ||
| + | var SO_RULE_PATH ../so_rules | ||
| + | var PREPROC_RULE_PATH ../ | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Modifiez les deux lignes suivantes afin d' | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | var WHITE_LIST_PATH / | ||
| + | var BLACK_LIST_PATH / | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Décommentez la ligne qui commence par **ooutput unified2** concernant la journalisation et supprimez le mot **nostamp** : | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | # unified2 | ||
| + | # Recommended for most installs | ||
| + | output unified2: filename merged.log, limit 128, mpls_event_types, | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Commentez ensuite la ligne commençant par **dynamicdetection directory** : | ||
| + | |||
| + | < | ||
| + | # path to dynamic rules libraries | ||
| + | # dynamicdetection directory / | ||
| + | </ | ||
| + | |||
| + | Créez ensuite les deux fichiers ci-dessous : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# touch / | ||
| + | [root@centos7 ~]# touch / | ||
| + | </ | ||
| + | |||
| + | Modifiez maintenant le fichier **/ | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | #### General Configuration | ||
| + | |||
| + | # What interface should snort listen on? [Pick only 1 of the next 3!] | ||
| + | # This is -i {interface} on the command line | ||
| + | # This is the snort.conf config interface: {interface} directive | ||
| + | # INTERFACE=eth0 | ||
| + | INTERFACE=enp0s3 | ||
| + | # | ||
| + | # The following two options are not directly supported on the command line | ||
| + | # or in the conf file and assume the same Snort configuration for all | ||
| + | # instances | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Vérifiez le fichier de configuration : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# snort -T -c / | ||
| + | ... | ||
| + | --== Initialization Complete ==-- | ||
| + | |||
| + | ,, | ||
| + | o" | ||
| + | '''' | ||
| + | | ||
| + | | ||
| + | Using libpcap version 1.5.3 | ||
| + | Using PCRE version: 8.32 2012-11-30 | ||
| + | Using ZLIB version: 1.2.7 | ||
| + | |||
| + | Rules Engine: SF_SNORT_DETECTION_ENGINE | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Snort successfully validated the configuration! | ||
| + | Snort exiting | ||
| + | </ | ||
| + | |||
| + | === Utilisation de snort en mode " | ||
| + | |||
| + | Pour visualiser les paquets à l'aide de snort, saisissez la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# snort -vde -c / | ||
| + | ... | ||
| + | [root@centos7 ~]# ^C | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | Pour surveiller une interface réseau en particulier, | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# snort -vd -i enp0s3 -c / | ||
| + | ... | ||
| + | [root@centos7 ~]# ^C | ||
| + | </ | ||
| + | |||
| + | === Utilisation de snort en mode " | ||
| + | |||
| + | Pour rediriger la sortie à l' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# snort -de -l / | ||
| + | ... | ||
| + | [root@centos7 ~]# ^C | ||
| + | </ | ||
| + | |||
| + | ===Journalisation=== | ||
| + | |||
| + | Constatez le contenu de **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ls / | ||
| + | merged.log | ||
| + | </ | ||
| + | |||
| + | Constatez le contenu du fichier de journalisation : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# tail / | ||
| + | |||
| + | ����; | ||
| + | |||
| + | �Ҡ��3��; | ||
| + | |||
| + | ����; | ||
| + | ������]l�S�����W�h���օYO<' | ||
| + | |||
| + | ����_��������օY���RT5' | ||
| + | |||
| + | �Ҡ����_P�����G}& | ||
| + | |||
| + | </ | ||
| + | |||
| + | Ce fichier étant au format **PCAP binaire**, vous pouvez le lire avec la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# snort -r / | ||
| + | </ | ||
| + | |||
| + | Notez que ce fichier peut aussi être lu par la commande **tcpdump** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# tcpdump -r / | ||
| + | reading from file / | ||
| + | 16: | ||
| + | 40, length 676 | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | 16: | ||
| + | --More-- | ||
| + | |||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Vous pouvez utiliser le logiciel Wireshark pour visulaiser le contenu du fichier en mode graphique. | ||
| + | </ | ||
| + | |||
| + | Dernièrement, | ||
| + | |||
| + | # snort -de -l / | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | Pour lancer snort en arrière plan afin de surveiller l' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# / | ||
| + | [1] 19281 | ||
| + | [root@centos7 ~]# Spawning daemon child... | ||
| + | My daemon child 19401 lives... | ||
| + | Daemon parent exiting (0) | ||
| + | ^C | ||
| + | [1]+ Done / | ||
| + | [root@centos7 ~]# ps aux | grep snort | ||
| + | snort 19401 0.0 24.6 850984 504544 ? | ||
| + | root | ||
| + | </ | ||
| + | |||
| + | Pour arrêter ce processus, utilisez al commande **kill**: | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ps aux | grep snort | ||
| + | snort 19401 0.0 24.6 850984 504692 ? | ||
| + | root | ||
| + | [root@centos7 ~]# kill 19401 | ||
| + | [root@centos7 ~]# ps aux | grep snort | ||
| + | root | ||
| + | </ | ||
| + | |||
| + | ====LAB #3 - Mise en place du Système de Détection et de Prévention d' | ||
| + | |||
| + | Portsentry est un **S**ystème de **D**étection et de **Prévention** d' | ||
| + | |||
| + | === Installation === | ||
| + | |||
| + | Sous RHEL/CentOS 7, **portsentry** n'est pas installé par défaut. Qui plus est **portsentry** ne se trouve pas dans les dépôts standards. Installez donc le paquet **portsentry-1.2-1.el5.x86_64.rpm** à partir de l'URL ci-dessous : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# rpm -ivh https:// | ||
| + | Loaded plugins: fastestmirror, | ||
| + | portsentry-1.2-1.el5.x86_64.rpm | ||
| + | Examining / | ||
| + | Marking / | ||
| + | Resolving Dependencies | ||
| + | --> Running transaction check | ||
| + | ---> Package portsentry.x86_64 0:1.2-1.el5 will be installed | ||
| + | --> Finished Dependency Resolution | ||
| + | adobe-linux-x86_64 | ||
| + | base/ | ||
| + | extras/ | ||
| + | updates/ | ||
| + | |||
| + | Dependencies Resolved | ||
| + | |||
| + | ======================================================================================================================================= | ||
| + | | ||
| + | ======================================================================================================================================= | ||
| + | Installing: | ||
| + | | ||
| + | |||
| + | Transaction Summary | ||
| + | ======================================================================================================================================= | ||
| + | Install | ||
| + | |||
| + | Total size: 114 k | ||
| + | Installed size: 114 k | ||
| + | Is this ok [y/d/N]: y | ||
| + | |||
| + | </ | ||
| + | |||
| + | ===Configuration=== | ||
| + | |||
| + | Modifiez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nl / | ||
| + | 1 # PortSentry Configuration | ||
| + | 2 # | ||
| + | 3 # $Id: portsentry.conf, | ||
| + | 4 # | ||
| + | 5 # IMPORTANT NOTE: You CAN NOT put spaces between your port arguments. | ||
| + | | ||
| + | 7 # The default ports will catch a large number of common probes | ||
| + | 8 # | ||
| + | 9 # All entries must be in quotes. | ||
| + | |||
| + | |||
| + | 10 ####################### | ||
| + | 11 # Port Configurations # | ||
| + | 12 ####################### | ||
| + | 13 # | ||
| + | 14 # | ||
| + | 15 # Some example port configs for classic and basic Stealth modes | ||
| + | 16 # | ||
| + | 17 # I like to always keep some ports at the " | ||
| + | 18 # This will detect a sequential port sweep really quickly and usually | ||
| + | 19 # these ports are not in use (i.e. tcpmux port 1) | ||
| + | 20 # | ||
| + | 21 # ** X-Windows Users **: If you are running X on your box, you need to be sure | ||
| + | 22 # you are not binding PortSentry to port 6000 (or port 2000 for OpenWindows users). | ||
| + | 23 # Doing so will prevent the X-client from starting properly. | ||
| + | 24 # | ||
| + | 25 # These port bindings are *ignored* for Advanced Stealth Scan Detection Mode. | ||
| + | 26 # | ||
| + | |||
| + | 27 # Un-comment these if you are really anal: | ||
| + | 28 # | ||
| + | 29 # | ||
| + | 30 # | ||
| + | 31 # Use these if you just want to be aware: | ||
| + | 32 TCP_PORTS=" | ||
| + | 33 UDP_PORTS=" | ||
| + | 34 # | ||
| + | 35 # Use these for just bare-bones | ||
| + | 36 # | ||
| + | 37 # | ||
| + | |||
| + | 38 ########################################### | ||
| + | 39 # Advanced Stealth Scan Detection Options # | ||
| + | 40 ########################################### | ||
| + | 41 # | ||
| + | 42 # This is the number of ports you want PortSentry to monitor in Advanced mode. | ||
| + | 43 # Any port *below* this number will be monitored. Right now it watches | ||
| + | 44 # everything below 1024. | ||
| + | 45 # | ||
| + | 46 # On many Linux systems you cannot bind above port 61000. This is because | ||
| + | 47 # these ports are used as part of IP masquerading. I don't recommend you | ||
| + | 48 # bind over this number of ports. Realistically: | ||
| + | 49 # OVER 1024 PORTS AS YOUR FALSE ALARM RATE WILL ALMOST CERTAINLY RISE. You've been | ||
| + | 50 # warned! Don't write me if you have have a problem because I'll only tell | ||
| + | 51 # you to RTFM and don't run above the first 1024 ports. | ||
| + | 52 # | ||
| + | 53 # | ||
| + | 54 ADVANCED_PORTS_TCP=" | ||
| + | 55 ADVANCED_PORTS_UDP=" | ||
| + | 56 # | ||
| + | 57 # This field tells PortSentry what ports (besides listening daemons) to | ||
| + | 58 # ignore. This is helpful for services like ident that services such | ||
| + | 59 # as FTP, SMTP, and wrappers look for but you may not run (and probably | ||
| + | 60 # *shouldn' | ||
| + | 61 # | ||
| + | 62 # By specifying ports here PortSentry will simply not respond to | ||
| + | 63 # incoming requests, in effect PortSentry treats them as if they are | ||
| + | 64 # actual bound daemons. The default ports are ones reported as | ||
| + | 65 # problematic false alarms and should probably be left alone for | ||
| + | 66 # all but the most isolated systems/ | ||
| + | 67 # | ||
| + | 68 # Default TCP ident and NetBIOS service | ||
| + | 69 ADVANCED_EXCLUDE_TCP=" | ||
| + | 70 # Default UDP route (RIP), NetBIOS, bootp broadcasts. | ||
| + | 71 ADVANCED_EXCLUDE_UDP=" | ||
| + | |||
| + | |||
| + | 72 ###################### | ||
| + | 73 # Configuration Files# | ||
| + | 74 ###################### | ||
| + | 75 # | ||
| + | 76 # Hosts to ignore | ||
| + | 77 IGNORE_FILE="/ | ||
| + | 78 # Hosts that have been denied (running history) | ||
| + | 79 HISTORY_FILE="/ | ||
| + | 80 # Hosts that have been denied this session only (temporary until next restart) | ||
| + | 81 BLOCKED_FILE="/ | ||
| + | |||
| + | 82 ############################## | ||
| + | 83 # Misc. Configuration Options# | ||
| + | 84 ############################## | ||
| + | 85 # | ||
| + | 86 # DNS Name resolution - Setting this to " | ||
| + | 87 # for attacking hosts. Setting it to " | ||
| + | 88 # it off. | ||
| + | 89 RESOLVE_HOST = " | ||
| + | |||
| + | 90 ################### | ||
| + | 91 # Response Options# | ||
| + | 92 ################### | ||
| + | 93 # Options to dispose of attacker. Each is an action that will | ||
| + | 94 # be run if an attack is detected. If you don't want a particular | ||
| + | 95 # option then comment it out and it will be skipped. | ||
| + | 96 # | ||
| + | 97 # The variable $TARGET$ will be substituted with the target attacking | ||
| + | 98 # host when an attack is detected. The variable $PORT$ will be substituted | ||
| + | 99 # with the port that was scanned. | ||
| + | 100 # | ||
| + | | ||
| + | 102 # Ignore Options # | ||
| + | | ||
| + | 104 # These options allow you to enable automatic response | ||
| + | 105 # options for UDP/TCP. This is useful if you just want | ||
| + | 106 # warnings for connections, | ||
| + | 107 # a particular protocol (i.e. you want to block TCP, but | ||
| + | 108 # not UDP). To prevent a possible Denial of service attack | ||
| + | 109 # against UDP and stealth scan detection for TCP, you may | ||
| + | 110 # want to disable blocking, but leave the warning enabled. | ||
| + | 111 # I personally would wait for this to become a problem before | ||
| + | 112 # doing though as most attackers really aren't doing this. | ||
| + | 113 # The third option allows you to run just the external command | ||
| + | 114 # in case of a scan to have a pager script or such execute | ||
| + | 115 # but not drop the route. This may be useful for some admins | ||
| + | 116 # who want to block TCP, but only want pager/ | ||
| + | 117 # on UDP, etc. | ||
| + | 118 # | ||
| + | | ||
| + | 120 # 0 = Do not block UDP/TCP scans. | ||
| + | 121 # 1 = Block UDP/TCP scans. | ||
| + | 122 # 2 = Run external command only (KILL_RUN_CMD) | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | | ||
| + | 126 # Dropping Routes:# | ||
| + | | ||
| + | 128 # This command is used to drop the route or add the host into | ||
| + | 129 # a local filter table. | ||
| + | 130 # | ||
| + | 131 # The gateway (333.444.555.666) should ideally be a dead host on | ||
| + | 132 # the *local* subnet. On some hosts you can also point this at | ||
| + | 133 # localhost (127.0.0.1) and get the same effect. NOTE THAT | ||
| + | 134 # 333.444.555.66 WILL *NOT* WORK. YOU NEED TO CHANGE IT!! | ||
| + | 135 # | ||
| + | 136 # ALL KILL ROUTE OPTIONS ARE COMMENTED OUT INITIALLY. Make sure you | ||
| + | 137 # uncomment the correct line for your OS. If you OS is not listed | ||
| + | 138 # here and you have a route drop command that works then please | ||
| + | 139 # mail it to me so I can include it. ONLY ONE KILL_ROUTE OPTION | ||
| + | 140 # CAN BE USED AT A TIME SO DON'T UNCOMMENT MULTIPLE LINES. | ||
| + | 141 # | ||
| + | 142 # NOTE: The route commands are the least optimal way of blocking | ||
| + | 143 # and do not provide complete protection against UDP attacks and | ||
| + | 144 # will still generate alarms for both UDP and stealth scans. I | ||
| + | 145 # always recommend you use a packet filter because they are made | ||
| + | 146 # for this purpose. | ||
| + | 147 # | ||
| + | |||
| + | 148 # Generic | ||
| + | | ||
| + | |||
| + | 150 # Generic Linux | ||
| + | | ||
| + | |||
| + | 152 # Newer versions of Linux support the reject flag now. This | ||
| + | 153 # is cleaner than the above option. | ||
| + | | ||
| + | |||
| + | 155 # Generic BSD (BSDI, OpenBSD, NetBSD, FreeBSD) | ||
| + | | ||
| + | |||
| + | 157 # Generic Sun | ||
| + | | ||
| + | |||
| + | 159 # NEXTSTEP | ||
| + | | ||
| + | |||
| + | 161 # FreeBSD | ||
| + | | ||
| + | |||
| + | 163 # Digital UNIX 4.0D (OSF/1 / Compaq Tru64 UNIX) | ||
| + | | ||
| + | |||
| + | 165 # Generic HP-UX | ||
| + | | ||
| + | |||
| + | | ||
| + | 168 # Using a packet filter is the PREFERRED. The below lines | ||
| + | 169 # work well on many OS's. Remember, you can only uncomment *one* | ||
| + | 170 # KILL_ROUTE option. | ||
| + | | ||
| + | |||
| + | 172 # ipfwadm support for Linux | ||
| + | | ||
| + | 174 # | ||
| + | 175 # ipfwadm support for Linux (no logging of denied packets) | ||
| + | | ||
| + | 177 # | ||
| + | 178 # ipchain support for Linux | ||
| + | | ||
| + | 180 # | ||
| + | 181 # ipchain support for Linux (no logging of denied packets) | ||
| + | | ||
| + | 183 # | ||
| + | 184 # iptables support for Linux | ||
| + | | ||
| + | |||
| + | 186 # For those of you running FreeBSD (and compatible) you can | ||
| + | 187 # use their built in firewalling as well. | ||
| + | 188 # | ||
| + | | ||
| + | 190 # | ||
| + | 191 # | ||
| + | 192 # For those running ipfilt (OpenBSD, etc.) | ||
| + | 193 # NOTE THAT YOU NEED TO CHANGE external_interface TO A VALID INTERFACE!! | ||
| + | 194 # | ||
| + | | ||
| + | |||
| + | |||
| + | | ||
| + | 197 # TCP Wrappers# | ||
| + | | ||
| + | 199 # This text will be dropped into the hosts.deny file for wrappers | ||
| + | 200 # to use. There are two formats for TCP wrappers: | ||
| + | 201 # | ||
| + | 202 # Format One: Old Style - The default when extended host processing | ||
| + | 203 # options are not enabled. | ||
| + | 204 # | ||
| + | | ||
| + | |||
| + | 206 # Format Two: New Style - The format used when extended option | ||
| + | 207 # processing is enabled. You can drop in extended processing | ||
| + | 208 # options, but be sure you escape all ' | ||
| + | 209 # to prevent problems writing out (i.e. \%c \%h ) | ||
| + | 210 # | ||
| + | | ||
| + | |||
| + | | ||
| + | 213 # External Command# | ||
| + | | ||
| + | 215 # This is a command that is run when a host connects, it can be whatever | ||
| + | 216 # you want it to be (pager, etc.). This command is executed before the | ||
| + | 217 # route is dropped or after depending on the KILL_RUN_CMD_FIRST option below | ||
| + | 218 # | ||
| + | 219 # | ||
| + | 220 # I NEVER RECOMMEND YOU PUT IN RETALIATORY ACTIONS AGAINST THE HOST SCANNING | ||
| + | 221 # YOU! | ||
| + | 222 # | ||
| + | 223 # TCP/IP is an *unauthenticated protocol* and people can make scans appear out | ||
| + | 224 # of thin air. The only time it is reasonably safe (and I *never* think it is | ||
| + | 225 # reasonable) to run reverse probe scripts is when using the " | ||
| + | 226 # This mode requires a full connect and is very hard to spoof. | ||
| + | 227 # | ||
| + | 228 # The KILL_RUN_CMD_FIRST value should be set to " | ||
| + | 229 # to run *before* the blocking occurs and should be set to " | ||
| + | 230 # command run *after* the blocking has occurred. | ||
| + | 231 # | ||
| + | | ||
| + | 233 # | ||
| + | 234 # | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | |||
| + | | ||
| + | 239 # Scan trigger value# | ||
| + | | ||
| + | 241 # Enter in the number of port connects you will allow before an | ||
| + | 242 # alarm is given. The default is 0 which will react immediately. | ||
| + | 243 # A value of 1 or 2 will reduce false alarms. Anything higher is | ||
| + | 244 # probably not necessary. This value must always be specified, but | ||
| + | 245 # generally can be left at 0. | ||
| + | 246 # | ||
| + | 247 # NOTE: If you are using the advanced detection option you need to | ||
| + | 248 # be careful that you don't make a hair trigger situation. Because | ||
| + | 249 # Advanced mode will react for *any* host connecting to a non-used | ||
| + | 250 # below your specified range, you have the opportunity to really | ||
| + | 251 # break things. (i.e someone innocently tries to connect to you via | ||
| + | 252 # SSL [TCP port 443] and you immediately block them). Some of you | ||
| + | 253 # may even want this though. Just be careful. | ||
| + | 254 # | ||
| + | | ||
| + | |||
| + | | ||
| + | 257 # Port Banner Section# | ||
| + | | ||
| + | 259 # | ||
| + | 260 # Enter text in here you want displayed to a person tripping the PortSentry. | ||
| + | 261 # I *don' | ||
| + | 262 # Leave this commented out to disable the feature | ||
| + | 263 # | ||
| + | 264 # Stealth scan detection modes don't use this feature | ||
| + | 265 # | ||
| + | | ||
| + | |||
| + | 267 # EOF | ||
| + | </ | ||
| + | |||
| + | Pour rendre le service SysVInit compatible avec Systemd, éditez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nl / | ||
| + | | ||
| + | 2 # | ||
| + | 3 # Startup script for the Portsentry portscan detector | ||
| + | 4 # | ||
| + | 5 # chkconfig: 345 98 02 | ||
| + | 6 # description: | ||
| + | | ||
| + | | ||
| + | | ||
| + | 10 # processname: | ||
| + | 11 # pidfile: / | ||
| + | 12 # config: / | ||
| + | |||
| + | 13 # Source function library. | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Puis ajoutez la ligne **80** : | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | 77 stop() { | ||
| + | 78 echo -n $" | ||
| + | 79 killproc portsentry | ||
| + | 80 killall portsentry | ||
| + | 81 RETVAL=$? | ||
| + | 82 echo | ||
| + | 83 [ $RETVAL -eq 0 ] && rm -f / | ||
| + | 84 } | ||
| + | |||
| + | 85 # See how we were called. | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Dernièrement, | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# yum install -y initscripts | ||
| + | </ | ||
| + | |||
| + | ===Utilisation=== | ||
| + | |||
| + | Démarrez le service **portsentry** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# systemctl start portsentry | ||
| + | [root@centos7 ~]# systemctl status portsentry | ||
| + | ● portsentry.service - SYSV: PortSentry Port Scan Detector is part of the Abacus Project suite of tools. The Abacus Project is an initiative to release low-maintenance, | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Process: 6487 ExecStart=/ | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | ||
| + | Hint: Some lines were ellipsized, use -l to show in full. | ||
| + | [root@centos7 ~]# ps aux | grep portsentry | ||
| + | root 6511 0.0 0.0 | ||
| + | root 6513 0.0 0.0 | ||
| + | root 6687 0.0 0.0 114692 | ||
| + | </ | ||
| + | |||
| + | Editez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nl / | ||
| + | 1 # Put hosts in here you never want blocked. This includes the IP addresses | ||
| + | 2 # of all local interfaces on the protected host (i.e virtual host, mult-home) | ||
| + | 3 # Keep 127.0.0.1 and 0.0.0.0 to keep people from playing games. | ||
| + | 4 # | ||
| + | 5 # PortSentry can support full netmasks for networks as well. Format is: | ||
| + | 6 # | ||
| + | 7 # <IP Address>/< | ||
| + | 8 # | ||
| + | 9 # Example: | ||
| + | 10 # | ||
| + | 11 # 192.168.2.0/ | ||
| + | 12 # 192.168.0.0/ | ||
| + | 13 # 192.168.2.1/ | ||
| + | 14 # Etc. | ||
| + | 15 # | ||
| + | 16 # If you don't supply a netmask it is assumed to be 32 bits. | ||
| + | 17 # | ||
| + | 18 # | ||
| + | |||
| + | 19 127.0.0.1/ | ||
| + | 20 0.0.0.0 | ||
| + | 21 ######################################### | ||
| + | 22 # Do NOT edit below this line, if you # | ||
| + | 23 # do, your changes will be lost when # | ||
| + | 24 # portsentry is restarted via the # | ||
| + | 25 # initscript. Make all changes above # | ||
| + | 26 # this box. # | ||
| + | 27 ######################################### | ||
| + | |||
| + | 28 # Exclude all local interfaces | ||
| + | 29 # | ||
| + | 30 fe80:: | ||
| + | 31 127.0.0.1 | ||
| + | 32 ::1 | ||
| + | |||
| + | 33 # Exclude the default gateway(s) | ||
| + | 34 10.0.2.2 | ||
| + | |||
| + | 35 # Exclude the nameservers | ||
| + | 36 10.0.2.3 | ||
| + | |||
| + | 37 # And last but not least... | ||
| + | 38 0.0.0.0 | ||
| + | </ | ||
| + | |||
| + | **Sans** re-démarrez le service portsentry, lancez un scan des ports avec nmap : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# nmap -sC 172.YY+20.0.3 | ||
| + | |||
| + | Starting Nmap 6.40 ( http:// | ||
| + | ^C | ||
| + | You have new mail in / | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | Consultez les règles d' | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# iptables -L | ||
| + | Chain INPUT (policy ACCEPT) | ||
| + | target | ||
| + | DROP | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | INPUT_direct | ||
| + | INPUT_ZONES_SOURCE | ||
| + | INPUT_ZONES | ||
| + | DROP | ||
| + | REJECT | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Dernièrement, | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# mail | ||
| + | Heirloom Mail version 12.5 7/ | ||
| + | "/ | ||
| + | >N 1 trainee@centos7.fene | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | & 6 | ||
| + | Message | ||
| + | From root@centos7.fenestros.loc | ||
| + | Return-Path: | ||
| + | X-Original-To: | ||
| + | Delivered-To: | ||
| + | Date: Sun, 06 Aug 2017 14:52:43 +0200 | ||
| + | To: root@localhost.fenestros.loc | ||
| + | Subject: Portscan from 10.0.2.15 on port 143 | ||
| + | User-Agent: Heirloom mailx 12.5 7/5/10 | ||
| + | Content-Type: | ||
| + | From: root@centos7.fenestros.loc (root) | ||
| + | Status: R | ||
| + | |||
| + | |||
| + | & q | ||
| + | Held 6 messages in / | ||
| + | You have mail in / | ||
| + | [root@centos7 ~]# | ||
| + | </ | ||
| + | |||
| + | Pour nettoyer la règle, re-démarrez le service **firewalld** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# systemctl restart firewalld | ||
| + | [root@centos7 ~]# iptables -L | ||
| + | Chain INPUT (policy ACCEPT) | ||
| + | target | ||
| + | ACCEPT | ||
| + | ACCEPT | ||
| + | INPUT_direct | ||
| + | INPUT_ZONES_SOURCE | ||
| + | INPUT_ZONES | ||
| + | DROP | ||
| + | REJECT | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | ----- | ||
| + | |||
| + | =====ChangeLog===== | ||
| + | |||
| + | ====2020.01==== | ||
| + | |||
| + | Backup 2019.beta restauré en 2020.01. | ||
| + | |||
| + | ====2020.02==== | ||
| + | |||
| + | * **Fixed** - Erreur dans un lien dans le LAB #2 : **https:// | ||
| + | |||
| + | ====2020.03==== | ||
| + | |||
| + | * **Fixed** - Erreur dans un lien dans le LAB #2 : **https:// | ||
| + | |||
| + | * **Fixed** - Erreur dans un lien dans le LAB #2 : **http:// | ||
| + | |||
| + | * **Fixed** - Erreur dans un lien dans le LAB #2 : **https:// | ||
| + | |||
| + | * **Fixed** - Erreur dans un lien dans le LAB #2 : **https:// | ||
| + | |||
| + | * **Fixed** - Erreur dans un lien dans le LAB #3 : **http:// | ||
| + | |||
| + | ----- | ||
| + | |||
| + | Copyright © 2020 Hugh Norris. | ||
