Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:debian:11:sec:l106 [2025/11/30 15:24] – admin | elearning:workbooks:debian:11:sec:l106 [2025/12/04 09:40] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| - | |||
| - | SNORT | ||
| Version : **2026.01** | Version : **2026.01** | ||
| Ligne 7: | Ligne 5: | ||
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LDF406 - Balayage des Ports====== | + | ======LDF406 - Sécurité Applicative====== |
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| - | * **LDF406 - Balayage des Ports** | + | * **LDF406 - Sécurité Applicative** |
| * Contenu du Module | * Contenu du Module | ||
| * Le Problématique | * Le Problématique | ||
| - | | + | * Préparation |
| - | * 1.1 - nmap | + | * Les Outils |
| - | * Installation | + | |
| - | * Utilisation | + | * 1.1 - Installation |
| - | * Fichiers de Configuration | + | * 1.2 - Utilisation |
| - | * Scripts | + | * 1.3 - Avertissement important |
| - | * 1.2 - netcat | + | * LAB #2 - Greenbone Vulnerability Management (GVM) |
| - | * Utilisation | + | * 2.1 - Présentation |
| - | * Les Contre-Mesures | + | * 2.2 - Préparation |
| - | * LAB #2 - Mise en place du Système de Détection d' | + | * 2.3 - Installation |
| - | * 2.1 - Installation | + | * 2.4 - Configuration |
| - | * 2.2 - Configuration de Snort | + | * 2.5 - Utilisation |
| - | * Editer le fichier / | + | * 2.6 - Analyse des Résultats |
| - | * 2.3 - Utilisation de snort en mode " | + | * Les Contres-Mesures |
| - | * 2.4 - Utilisation de snort en mode " | + | * LAB #3 - La commande chroot |
| - | * 2.5 - Journalisation | + | |
| - | * LAB #3 - Mise en place du Système de Détection et de Prévention d' | + | |
| - | * 3.1 - Installation | + | |
| - | * 3.2 - Configuration | + | |
| - | * 3.3 - Utilisation | + | |
| =====Le Problématique===== | =====Le Problématique===== | ||
| - | Un **Cheval | + | La plupart des failles |
| - | * Back Orifice 2000 - tcp/8787, tcp/ | + | =====Préparation===== |
| - | * Backdoor - tcp/1999, | + | |
| - | * Subseven - tcp/1243, tcp/ 2773, tcp/ | + | |
| - | * Socket de Troie - tcp/5001, tcp/30303, tcp/50505. | + | |
| - | Le **scan** consiste à balayer les ports d'une machine afin de : | + | =====Les Outils===== |
| - | * connaître les ports qui sont ouverts, | + | ==== LAB #1 - Netwox ==== |
| - | * déterminer le système d' | + | |
| - | * identifier les services ouverts. | + | |
| - | Plusieurs scanners existent dont : | + | Le programme **netwox** est un utilitaire puissant de vérification de la sécurité. |
| - | * nmap | + | ===1.1 - Installation=== |
| - | * netcat | + | |
| - | ====LAB #1 - Utilisation de nmap et de netcat==== | + | Netwox s' |
| - | === 1.1 - nmap === | + | < |
| + | root@debian12: | ||
| - | ==Installation== | + | root@debian12:/ |
| + | |||
| + | root@debian12: | ||
| + | </ | ||
| - | Sous Debian 12, **nmap** n'est pas installé par défaut : | + | ===1.2 - Utilisation=== |
| < | < | ||
| - | root@debian12: | + | root@debian12: |
| - | root@debian12: | + | Netwox toolbox version 5.39.0. Netwib library version 5.39.0. |
| + | |||
| + | ######################## | ||
| + | 0 - leave netwox | ||
| + | 3 - search tools | ||
| + | 4 - display help of one tool | ||
| + | 5 - run a tool selecting parameters on command line | ||
| + | 6 - run a tool selecting parameters from keyboard | ||
| + | a + information | ||
| + | b + network protocol | ||
| + | c + application protocol | ||
| + | d + sniff (capture network packets) | ||
| + | e + spoof (create and send packets) | ||
| + | f + record (file containing captured packets) | ||
| + | g + client | ||
| + | h + server | ||
| + | i + ping (check if a computer if reachable) | ||
| + | j + traceroute (obtain list of gateways) | ||
| + | k + scan (computer and port discovery) | ||
| + | l + network audit | ||
| + | m + brute force (check if passwords are weak) | ||
| + | n + remote administration | ||
| + | o + tools not related to network | ||
| + | Select a node (key in 03456abcdefghijklmno): | ||
| </ | </ | ||
| - | Installez donc nmap en utilisant APT : | + | L' |
| < | < | ||
| - | root@debian12:~# apt install nmap | + | Select a node (key in 03456abcdefghijklmno): l |
| + | |||
| + | ###################### | ||
| + | 0 - leave netwox | ||
| + | 1 - go to main menu | ||
| + | 2 - go to previous menu | ||
| + | 3 - search tools | ||
| + | 4 - display help of one tool | ||
| + | 5 - run a tool selecting parameters on command line | ||
| + | 6 - run a tool selecting parameters from keyboard | ||
| + | a + network audit using Ethernet | ||
| + | b + network audit using IP | ||
| + | c + network audit using TCP | ||
| + | d + network audit using ICMP | ||
| + | e + network audit using ARP | ||
| + | Select a node (key in 0123456abcde): | ||
| </ | </ | ||
| - | ==Utilisation== | + | Choisissez ensuite le menu **c** : |
| - | Pour connaître la liste des ports ouverts | + | < |
| + | Select a node (key in 0123456abcde): | ||
| + | |||
| + | ################# | ||
| + | 0 - leave netwox | ||
| + | 1 - go to main menu | ||
| + | 2 - go to previous menu | ||
| + | 3 - search tools | ||
| + | 4 - display help of one tool | ||
| + | 5 - run a tool selecting parameters on command line | ||
| + | 6 - run a tool selecting parameters from keyboard | ||
| + | a - 76: | ||
| + | b - 77:Check if seqnum are predictible | ||
| + | c - 78:Reset every TCP packet | ||
| + | d - 79: | ||
| + | Select a node (key in 0123456abcd): | ||
| + | </ | ||
| + | |||
| + | Notre choix de test s' | ||
| < | < | ||
| - | root@debian12: | + | Select a node (key in 0123456abcd): a |
| - | Starting Nmap 7.93 ( https:// | + | |
| - | Nmap scan report for localhost (127.0.0.1) | + | |
| - | Host is up (0.0000090s latency). | + | |
| - | Not shown: 996 closed tcp ports (reset) | + | |
| - | PORT STATE SERVICE | + | |
| - | 22/ | + | |
| - | 80/ | + | |
| - | 631/ | + | |
| - | 5900/tcp open vnc | + | |
| - | Nmap done: 1 IP address (1 host up) scanned | + | ################# |
| + | Title: Synflood | ||
| + | +------------------------------------------------------------------------+ | ||
| + | | This tool sends a lot of TCP SYN packets. | ||
| + | | It permits to check how a firewall behaves when receiving packets | ||
| + | | which have to be ignored. | ||
| + | | Parameter --spoofip indicates how to generate link layer for spoofing. | | ||
| + | | Values ' | ||
| + | | is the list of accepted values: | ||
| + | | - ' | ||
| + | | a firewall is installed, or on some systems, this might not work. | | ||
| + | | - ' | ||
| + | | supported). The ' | ||
| + | | However, if source IP address is spoofed, it might be impossible | ||
| + | | to Fill it. So, linkf will not work: use linkb or linkfb instead. | ||
| + | | - ' | ||
| + | | source Ethernet | ||
| + | | - ' | ||
| + | | source Ethernet address, but if it is not possible, it is left | | ||
| + | | Blank. | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | - ' | ||
| + | | | | ||
| + | | This tool may need to be run with admin privilege in order to spoof. | ||
| + | +------------------------------------------------------------------------+ | ||
| + | Usage: netwox 76 -i ip -p port [-s spoofip] | ||
| + | Parameters: | ||
| + | | ||
| + | | ||
| + | | ||
| + | Example: netwox 76 -i " | ||
| + | Example: netwox 76 --dst-ip "5.6.7.8" --dst-port " | ||
| + | Press ' | ||
| </ | </ | ||
| - | <WRAP center round important 50%> | + | Il convient ensuite d' |
| - | **Important** - Pour connaître les ports ouverts | + | |
| - | </ | + | |
| - | ==Fichiers | + | Il est a noter que **netwox** |
| - | **nmap** utilise un fichier spécifique pour identifier les ports. Ce fichier est **/ | + | # netwox 76 -i " |
| - | < | + | ===1.3 - Avertissement important=== |
| - | root@debian12: | + | |
| - | # THIS FILE IS GENERATED AUTOMATICALLY FROM A MASTER - DO NOT EDIT. | + | |
| - | # EDIT / | + | |
| - | # Well known service port numbers -*- mode: fundamental; | + | |
| - | # From the Nmap Security Scanner ( https:// | + | |
| - | # | + | |
| - | # $Id: nmap-services 38442 2022-08-31 22:53:46Z dmiller $ | + | |
| - | # | + | |
| - | # Derived from IANA data and our own research | + | |
| - | # | + | |
| - | # This collection of service data is (C) 1996-2020 by Insecure.Com | + | |
| - | # LLC. It is distributed under the Nmap Public Source license as | + | |
| - | # provided in the LICENSE file of the source distribution or at | + | |
| - | # https:// | + | |
| - | # requires you to license your own work under a compatable open source | + | |
| - | # license. | + | |
| - | # software, we sell alternative licenses (contact sales@insecure.com). | + | |
| - | # Dozens of software vendors already license Nmap technology such as | + | |
| - | # host discovery, port scanning, OS detection, and version detection. | + | |
| - | # For more details, see https:// | + | |
| - | # | + | |
| - | # Fields in this file are: Service name, portnum/ | + | |
| - | # | + | |
| - | tcpmux | + | |
| - | tcpmux | + | |
| - | compressnet | + | |
| - | compressnet | + | |
| - | compressnet | + | |
| - | compressnet | + | |
| - | unknown 4/tcp | + | |
| - | rje | + | |
| - | rje | + | |
| - | unknown 6/tcp | + | |
| - | echo 7/ | + | |
| - | echo 7/tcp | + | |
| - | echo 7/udp | + | |
| - | unknown 8/tcp | + | |
| - | discard 9/ | + | |
| - | discard 9/tcp | + | |
| - | discard 9/udp | + | |
| - | unknown 10/ | + | |
| - | systat | + | |
| - | systat | + | |
| - | unknown 12/ | + | |
| - | daytime 13/ | + | |
| - | daytime 13/ | + | |
| - | unknown 14/ | + | |
| - | netstat 15/ | + | |
| - | unknown 16/ | + | |
| - | qotd 17/ | + | |
| - | qotd 17/ | + | |
| - | msp | + | |
| - | msp | + | |
| - | chargen 19/ | + | |
| - | chargen 19/ | + | |
| - | ftp-data | + | |
| - | --More--(0%) | + | |
| - | </ | + | |
| - | Le répertoire | + | **netwox** est un outil puissant. Il convient de noter que: |
| - | < | + | * il ne doit pas être installé sur un serveur de production mais sur le poste de l' |
| - | root@debian12: | + | |
| - | total 9368 | + | |
| - | -rw-r--r-- 1 root root 10829 Jan 16 2023 nmap.dtd | + | |
| - | -rw-r--r-- 1 root root 824437 Jan 16 2023 nmap-mac-prefixes | + | |
| - | -rw-r--r-- 1 root root 5032815 Jan 16 2023 nmap-os-db | + | |
| - | -rw-r--r-- 1 root root 21165 Jan 16 2023 nmap-payloads | + | |
| - | -rw-r--r-- 1 root root 6845 Jan 16 2023 nmap-protocols | + | |
| - | -rw-r--r-- 1 root root 43529 Jan 16 2023 nmap-rpc | + | |
| - | -rw-r--r-- 1 root root 2506640 Jan 16 2023 nmap-service-probes | + | |
| - | -rw-r--r-- 1 root root 1004557 Jan 16 2023 nmap-services | + | |
| - | -rw-r--r-- 1 root root 31936 Jan 16 2023 nmap.xsl | + | |
| - | drwxr-xr-x 3 root root 4096 Nov 27 16:46 nselib | + | |
| - | -rw-r--r-- 1 root root 49478 Jan 16 2023 nse_main.lua | + | |
| - | drwxr-xr-x 2 root root 36864 Nov 27 16:46 scripts | + | |
| - | </ | + | |
| - | Voici la liste des fichiers les plus importants : | + | ====LAB #2 - Greenbone Vulnerability Management (GVM)==== |
| - | ^ Fichier ^ Description ^ | + | ===2.1 - Présentation=== |
| - | | / | + | |
| - | | / | + | |
| - | | / | + | |
| - | | / | + | |
| - | ==Scripts== | + | **Greenbone Vulnerability Management (GVM)**, aussi connu sous le nom d' |
| - | **nmap** utilise des scripts pour accomplir certaines tâches allant de la découverte simple de ports ouverts jusqu' | + | ===2.2 - Préparation=== |
| + | |||
| + | Mettez SELinux en mode permissive et désactivez-le dans le fichier | ||
| < | < | ||
| - | root@debian12:~# ls /usr/share/nmap/scripts/ | + | [root@centos7 |
| - | acarsd-info.nse | + | |
| - | address-info.nse | + | [root@centos7 ~]# sed -i 's/=enforcing/=disabled/' |
| - | afp-brute.nse | + | |
| - | afp-ls.nse | + | [root@centos7 ~]# reboot |
| - | afp-path-vuln.nse | + | |
| - | afp-serverinfo.nse | + | |
| - | afp-showmount.nse | + | |
| - | ajp-auth.nse | + | |
| - | ajp-brute.nse | + | |
| - | ajp-headers.nse | + | |
| - | ajp-methods.nse | + | |
| - | ajp-request.nse | + | |
| - | allseeingeye-info.nse | + | |
| - | amqp-info.nse | + | |
| - | asn-query.nse | + | |
| - | auth-owners.nse | + | |
| - | auth-spoof.nse | + | |
| - | backorifice-brute.nse | + | |
| - | backorifice-info.nse | + | |
| - | bacnet-info.nse | + | |
| - | banner.nse | + | |
| - | bitcoin-getaddr.nse | + | |
| - | bitcoin-info.nse | + | |
| - | bitcoinrpc-info.nse | + | |
| - | bittorrent-discovery.nse | + | |
| - | bjnp-discover.nse | + | |
| - | broadcast-ataoe-discover.nse | + | |
| - | broadcast-avahi-dos.nse | + | |
| - | broadcast-bjnp-discover.nse | + | |
| - | broadcast-db2-discover.nse | + | |
| - | broadcast-dhcp6-discover.nse | + | |
| - | broadcast-dhcp-discover.nse | + | |
| - | broadcast-dns-service-discovery.nse | + | |
| - | broadcast-dropbox-listener.nse | + | |
| - | broadcast-eigrp-discovery.nse | + | |
| - | broadcast-hid-discoveryd.nse | + | |
| - | broadcast-igmp-discovery.nse | + | |
| - | broadcast-jenkins-discover.nse | + | |
| - | broadcast-listener.nse | + | |
| - | broadcast-ms-sql-discover.nse | + | |
| - | broadcast-netbios-master-browser.nse | + | |
| - | broadcast-networker-discover.nse | + | |
| - | broadcast-novell-locate.nse | + | |
| - | broadcast-ospf2-discover.nse | + | |
| - | broadcast-pc-anywhere.nse | + | |
| - | broadcast-pc-duo.nse | + | |
| - | broadcast-pim-discovery.nse | + | |
| - | broadcast-ping.nse | + | |
| - | broadcast-pppoe-discover.nse | + | |
| - | broadcast-rip-discover.nse | + | |
| - | broadcast-ripng-discover.nse | + | |
| - | broadcast-sonicwall-discover.nse | + | |
| - | broadcast-sybase-asa-discover.nse | + | |
| - | broadcast-tellstick-discover.nse | + | |
| - | broadcast-upnp-info.nse | + | |
| - | broadcast-versant-locate.nse | + | |
| - | broadcast-wake-on-lan.nse | + | |
| - | broadcast-wpad-discover.nse | + | |
| - | broadcast-wsdd-discover.nse | + | |
| - | broadcast-xdmcp-discover.nse | + | |
| - | cassandra-brute.nse | + | |
| - | cassandra-info.nse | + | |
| - | cccam-version.nse | + | |
| - | cics-enum.nse | + | |
| - | cics-info.nse | + | |
| - | cics-user-brute.nse | + | |
| - | cics-user-enum.nse | + | |
| - | citrix-brute-xml.nse | + | |
| - | citrix-enum-apps.nse | + | |
| - | citrix-enum-apps-xml.nse | + | |
| - | citrix-enum-servers.nse | + | |
| - | citrix-enum-servers-xml.nse | + | |
| - | clamav-exec.nse | + | |
| - | clock-skew.nse | + | |
| - | coap-resources.nse | + | |
| - | couchdb-databases.nse | + | |
| - | couchdb-stats.nse | + | |
| - | creds-summary.nse | + | |
| - | cups-info.nse | + | |
| - | cups-queue-info.nse | + | |
| - | cvs-brute.nse | + | |
| - | cvs-brute-repository.nse | + | |
| - | daap-get-library.nse | + | |
| - | daytime.nse | + | |
| - | db2-das-info.nse | + | |
| - | deluge-rpc-brute.nse | + | |
| - | dhcp-discover.nse | + | |
| - | dicom-brute.nse | + | |
| - | dicom-ping.nse | + | |
| - | dict-info.nse | + | |
| - | distcc-cve2004-2687.nse | + | |
| - | dns-blacklist.nse | + | |
| - | dns-brute.nse | + | |
| - | dns-cache-snoop.nse | + | |
| - | dns-check-zone.nse | + | |
| - | dns-client-subnet-scan.nse | + | |
| - | dns-fuzz.nse | + | |
| - | dns-ip6-arpa-scan.nse | + | |
| - | dns-nsec3-enum.nse | + | |
| - | dns-nsec-enum.nse | + | |
| - | dns-nsid.nse | + | |
| - | dns-random-srcport.nse | + | |
| - | dns-random-txid.nse | + | |
| - | dns-recursion.nse | + | |
| - | dns-service-discovery.nse | + | |
| - | dns-srv-enum.nse | + | |
| - | dns-update.nse | + | |
| - | dns-zeustracker.nse | + | |
| - | dns-zone-transfer.nse | + | |
| - | docker-version.nse | + | |
| - | domcon-brute.nse | + | |
| - | domcon-cmd.nse | + | |
| - | domino-enum-users.nse | + | |
| - | dpap-brute.nse | + | |
| - | drda-brute.nse | + | |
| - | drda-info.nse | + | |
| - | duplicates.nse | + | |
| - | eap-info.nse | + | |
| - | enip-info.nse | + | |
| - | epmd-info.nse | + | |
| - | eppc-enum-processes.nse | + | |
| </ | </ | ||
| - | Les scripts sont regroupés | + | Insérez une règle |
| - | <WRAP center round important 50%> | + | <code> |
| - | **Important** - Pour plus d' | + | [root@centos7 ~]# firewall-cmd --zone=public --add-port=9443/tcp --permanent |
| - | </WRAP> | + | success |
| + | [root@centos7 ~]# firewall-cmd --reload | ||
| + | success | ||
| + | </code> | ||
| - | La catégorie la plus utilisée est **default** qui est appelée par l' | + | ===2.3 |
| + | |||
| + | Téléchargez et installez | ||
| < | < | ||
| - | root@debian12:~# nmap -v -sC localhost | + | [root@centos7 |
| - | Starting Nmap 7.93 ( https://nmap.org ) at 2025-11-27 16:51 CET | + | --2025-12-01 15:29:01-- https:// |
| - | NSE: Loaded 125 scripts for scanning. | + | Resolving archives.fedoraproject.org |
| - | NSE: Script Pre-scanning. | + | Connecting to archives.fedoraproject.org |
| - | Initiating NSE at 16:51 | + | HTTP request sent, awaiting response... 200 OK |
| - | Completed NSE at 16:51, 0.00s elapsed | + | Length: 15608 (15K) [application/x-rpm] |
| - | Initiating NSE at 16:51 | + | Saving to: ‘epel-release-7-14.noarch.rpm’ |
| - | Completed NSE at 16:51, 0.00s elapsed | + | |
| - | Initiating SYN Stealth Scan at 16:51 | + | |
| - | Scanning localhost | + | |
| - | Discovered open port 22/tcp on 127.0.0.1 | + | |
| - | Discovered open port 5900/tcp on 127.0.0.1 | + | |
| - | Discovered open port 80/tcp on 127.0.0.1 | + | |
| - | Discovered open port 631/tcp on 127.0.0.1 | + | |
| - | Completed SYN Stealth Scan at 16:51, 0.03s elapsed | + | |
| - | NSE: Script scanning 127.0.0.1. | + | |
| - | Initiating NSE at 16:51 | + | |
| - | Completed NSE at 16:51, 2.00s elapsed | + | |
| - | Initiating NSE at 16:51 | + | |
| - | Completed NSE at 16:51, 0.00s elapsed | + | |
| - | Nmap scan report for localhost (127.0.0.1) | + | |
| - | Host is up (0.0000090s latency). | + | |
| - | Other addresses for localhost (not scanned): ::1 | + | |
| - | Not shown: 996 closed tcp ports (reset) | + | |
| - | PORT STATE SERVICE | + | |
| - | 22/tcp | + | |
| - | | ssh-hostkey: | + | |
| - | | 256 738a4166831b9c8af2bfb567ed025c4d (ECDSA) | + | |
| - | |_ 256 86dcfbca68069284b2ddb0545cbc4e2b (ED25519) | + | |
| - | 80/ | + | |
| - | | http-methods: | + | |
| - | |_ Supported Methods: GET POST OPTIONS HEAD | + | |
| - | |_http-title: Apache2 Debian Default Page: It works | + | |
| - | 631/ | + | |
| - | | ssl-cert: Subject: commonName=debian12/ | + | |
| - | | Subject Alternative Name: DNS: | + | |
| - | | Issuer: commonName=debian12/ | + | |
| - | | Public Key type: rsa | + | |
| - | | Public Key bits: 2048 | + | |
| - | | Signature Algorithm: sha256WithRSAEncryption | + | |
| - | | Not valid before: 2025-11-27T15: | + | |
| - | | Not valid after: | + | |
| - | | MD5: | + | |
| - | |_SHA-1: 0bda6fab805a00a5cdc863da5357a3791a58eca6 | + | |
| - | | http-methods: | + | |
| - | |_ Supported Methods: GET HEAD POST OPTIONS | + | |
| - | |_http-title: | + | |
| - | |_ssl-date: TLS randomness does not represent time | + | |
| - | | http-robots.txt: | + | |
| - | |_/ | + | |
| - | 5900/tcp open vnc | + | |
| - | | vnc-info: | + | |
| - | | | + | |
| - | | | + | |
| - | |_ VNC Authentication (2) | + | |
| - | NSE: Script Post-scanning. | + | 100%[========================================================================================================================================================================> |
| - | Initiating NSE at 16:51 | + | |
| - | Completed NSE at 16:51, 0.00s elapsed | + | |
| - | Initiating NSE at 16:51 | + | |
| - | Completed NSE at 16:51, 0.00s elapsed | + | |
| - | Read data files from: /usr/ | + | |
| - | Nmap done: 1 IP address (1 host up) scanned | + | |
| - | Raw packets sent: 1000 (44.000KB) | Rcvd: 2004 (84.176KB) | + | |
| - | </ | + | |
| - | <WRAP center round warning 50%> | + | 2025-12-01 15:29:01 (532 KB/s) - ‘epel-release-7-14.noarch.rpm’ saved [15608/15608] |
| - | **Attention** | + | |
| - | </WRAP> | + | |
| - | ==Options de la commande== | + | [root@centos7 ~]# yum localinstall epel-release-7-14.noarch.rpm --nogpgcheck |
| + | </ | ||
| - | Les options de cette commande sont : | + | Installez ensuite **openvas-scanner**, |
| < | < | ||
| - | root@debian12:~# nmap --help | + | [root@centos7 |
| - | Nmap 7.93 ( https:// | + | |
| - | Usage: nmap [Scan Type(s)] [Options] {target specification} | + | |
| - | TARGET SPECIFICATION: | + | |
| - | Can pass hostnames, IP addresses, networks, etc. | + | |
| - | Ex: scanme.nmap.org, | + | |
| - | -iL < | + | |
| - | -iR <num hosts>: Choose random targets | + | |
| - | --exclude < | + | |
| - | --excludefile < | + | |
| - | HOST DISCOVERY: | + | |
| - | -sL: List Scan - simply list targets to scan | + | |
| - | -sn: Ping Scan - disable port scan | + | |
| - | -Pn: Treat all hosts as online -- skip host discovery | + | |
| - | -PS/ | + | |
| - | -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes | + | |
| - | -PO[protocol list]: IP Protocol Ping | + | |
| - | -n/-R: Never do DNS resolution/ | + | |
| - | --dns-servers < | + | |
| - | --system-dns: | + | |
| - | --traceroute: | + | |
| - | SCAN TECHNIQUES: | + | |
| - | -sS/ | + | |
| - | -sU: UDP Scan | + | |
| - | -sN/sF/sX: TCP Null, FIN, and Xmas scans | + | |
| - | --scanflags < | + | |
| - | -sI <zombie host[: | + | |
| - | -sY/sZ: SCTP INIT/ | + | |
| - | -sO: IP protocol scan | + | |
| - | -b <FTP relay host>: FTP bounce scan | + | |
| - | PORT SPECIFICATION AND SCAN ORDER: | + | |
| - | -p <port ranges>: Only scan specified ports | + | |
| - | Ex: -p22; -p1-65535; -p U: | + | |
| - | --exclude-ports <port ranges>: Exclude the specified ports from scanning | + | |
| - | -F: Fast mode - Scan fewer ports than the default scan | + | |
| - | -r: Scan ports sequentially - don't randomize | + | |
| - | --top-ports < | + | |
| - | --port-ratio < | + | |
| - | SERVICE/ | + | |
| - | -sV: Probe open ports to determine service/ | + | |
| - | --version-intensity < | + | |
| - | --version-light: | + | |
| - | --version-all: | + | |
| - | --version-trace: | + | |
| - | SCRIPT SCAN: | + | |
| - | -sC: equivalent to --script=default | + | |
| - | --script=< | + | |
| - | | + | |
| - | --script-args=< | + | |
| - | --script-args-file=filename: | + | |
| - | --script-trace: | + | |
| - | --script-updatedb: | + | |
| - | --script-help=< | + | |
| - | < | + | |
| - | | + | |
| - | OS DETECTION: | + | |
| - | -O: Enable OS detection | + | |
| - | --osscan-limit: | + | |
| - | --osscan-guess: | + | |
| - | TIMING AND PERFORMANCE: | + | |
| - | Options which take < | + | |
| - | ' | + | |
| - | -T< | + | |
| - | --min-hostgroup/ | + | |
| - | --min-parallelism/ | + | |
| - | --min-rtt-timeout/ | + | |
| - | probe round trip time. | + | |
| - | --max-retries < | + | |
| - | --host-timeout < | + | |
| - | --scan-delay/ | + | |
| - | --min-rate < | + | |
| - | --max-rate < | + | |
| - | FIREWALL/ | + | |
| - | -f; --mtu < | + | |
| - | -D < | + | |
| - | -S < | + | |
| - | -e < | + | |
| - | -g/ | + | |
| - | --proxies < | + | |
| - | --data <hex string>: Append a custom payload to sent packets | + | |
| - | --data-string < | + | |
| - | --data-length < | + | |
| - | --ip-options < | + | |
| - | --ttl < | + | |
| - | --spoof-mac <mac address/ | + | |
| - | --badsum: Send packets with a bogus TCP/ | + | |
| - | OUTPUT: | + | |
| - | -oN/ | + | |
| - | and Grepable format, respectively, | + | |
| - | -oA < | + | |
| - | -v: Increase verbosity level (use -vv or more for greater effect) | + | |
| - | -d: Increase debugging level (use -dd or more for greater effect) | + | |
| - | --reason: Display the reason a port is in a particular state | + | |
| - | --open: Only show open (or possibly open) ports | + | |
| - | --packet-trace: | + | |
| - | --iflist: Print host interfaces and routes (for debugging) | + | |
| - | --append-output: | + | |
| - | --resume < | + | |
| - | --noninteractive: | + | |
| - | --stylesheet < | + | |
| - | --webxml: Reference stylesheet from Nmap.Org for more portable XML | + | |
| - | --no-stylesheet: | + | |
| - | MISC: | + | |
| - | -6: Enable IPv6 scanning | + | |
| - | -A: Enable OS detection, version detection, script scanning, and traceroute | + | |
| - | --datadir < | + | |
| - | --send-eth/ | + | |
| - | --privileged: | + | |
| - | --unprivileged: | + | |
| - | -V: Print version number | + | |
| - | -h: Print this help summary page. | + | |
| - | EXAMPLES: | + | |
| - | nmap -v -A scanme.nmap.org | + | |
| - | nmap -v -sn 192.168.0.0/ | + | |
| - | nmap -v -iR 10000 -Pn -p 80 | + | |
| - | SEE THE MAN PAGE (https:// | + | |
| </ | </ | ||
| - | ===1.2 - netcat | + | ===2.4 - Configuration=== |
| - | **netcat** est un couteau suisse. Il permet non seulement de scanner des ports mais aussi de lancer la connexion lors de la découverte | + | Les commandes |
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ls -l / | ||
| + | -rwxr-xr-x. 1 root root 18066 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 2182496 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 37993 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 11998 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 10976 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 766 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 2555 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 38378 Sep 6 2016 / | ||
| + | -rwxr-xr-x. 1 root root 86640 Sep 6 2016 / | ||
| + | </ | ||
| - | ==Utilisation== | + | * **/ |
| + | * Cette commande permet de générer un certificat SSL, | ||
| + | * **/ | ||
| + | * Cette commande permet la mise à jour des modules d' | ||
| + | * **/ | ||
| + | * Cette commande lance le serveur OpenVAS. | ||
| - | Dans l' | + | Exécutez maintenant la commande **openvas-check-setup** |
| < | < | ||
| - | root@debian12:~# nc 127.0.0.1 80 -w 1 -vv | + | [root@centos7 |
| - | localhost [127.0.0.1] 80 (http) open | + | openvas-check-setup |
| - | [ENTREE] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> | + | Test completeness and readiness of OpenVAS-8 |
| - | HTTP/1.1 400 Bad Request | + | (add '--v6' or '--v7' or ' |
| - | Date: Thu, 27 Nov 2025 15:53:56 GMT | + | if you want to check for another OpenVAS version) |
| - | Server: Apache/2.4.65 (Debian) | + | |
| - | Content-Length: 301 | + | |
| - | Connection: close | + | |
| - | Content-Type: text/html; charset=iso-8859-1 | + | |
| - | < | + | Please report us any non-detected problems and |
| - | < | + | help us to improve this check routine: |
| - | < | + | http://lists.wald.intevation.org/mailman/listinfo/ |
| - | </head>< | + | |
| - | < | + | Send us the log-file (/tmp/openvas-check-setup.log) to help analyze the problem. |
| - | < | + | |
| - | </p> | + | Use the parameter --server |
| - | < | + | like GSD and OpenVAS-CLI. |
| - | < | + | |
| - | </body>< | + | Step 1: Checking OpenVAS Scanner |
| - | sent 1, rcvd 483 | + | OK: OpenVAS Scanner is present in version 5.0.6. |
| + | | ||
| + | FIX: Run ' | ||
| + | |||
| + | | ||
| + | |||
| + | Please follow the instructions marked with FIX above and run this | ||
| + | script again. | ||
| + | |||
| + | If you think this result is wrong, please report your observation | ||
| + | and help us to improve this check routine: | ||
| + | http://lists.wald.intevation.org/ | ||
| + | Please attach the log-file (/ | ||
| </ | </ | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Notez que **netcat** se connecte au port 80 qui est ouvert. | + | **Important** - Notez l' |
| </ | </ | ||
| - | ==Options de la commande== | + | Créez donc un certificat SSL : |
| - | + | ||
| - | Les options de cette commande sont : | + | |
| < | < | ||
| - | root@debian12:~# nc -h | + | [root@centos7 |
| - | [v1.10-47] | + | |
| - | connect to somewhere: | + | |
| - | listen for inbound: | + | |
| - | options: | + | |
| - | -c shell commands | + | |
| - | -e filename | + | |
| - | -b allow broadcasts | + | |
| - | -g gateway | + | |
| - | -G num source-routing pointer: 4, 8, 12, ... | + | |
| - | -h this cruft | + | |
| - | -i secs delay interval for lines sent, ports scanned | + | |
| - | -k set keepalive option on socket | + | |
| - | -l listen mode, for inbound connects | + | |
| - | -n numeric-only IP addresses, no DNS | + | |
| - | -o file hex dump of traffic | + | |
| - | -p port local port number | + | |
| - | -r randomize local and remote ports | + | |
| - | -q secs quit after EOF on stdin and delay of secs | + | |
| - | -s addr local source address | + | |
| - | -T tos set Type Of Service | + | |
| - | -t answer TELNET negotiation | + | |
| - | -u UDP mode | + | |
| - | -v verbose [use twice to be more verbose] | + | |
| - | -w secs | + | |
| - | -C Send CRLF as line-ending | + | |
| - | -z zero-I/O mode [used for scanning] | + | |
| - | port numbers can be individual or ranges: lo-hi [inclusive]; | + | |
| - | hyphens in port names must be backslash escaped (e.g. 'ftp\-data' | + | |
| - | </ | + | |
| - | =====Les Contre-Mesures===== | + | ------------------------------------------------------------------------------- |
| + | Creation of the OpenVAS SSL Certificate | ||
| + | ------------------------------------------------------------------------------- | ||
| - | Les contre-mesures incluent l' | + | This script will now ask you the relevant information to create the SSL certificate of OpenVAS. |
| + | Note that this information will *NOT* be sent to anybody | ||
| - | ====LAB #2 - Mise en place du Système de Détection d' | ||
| - | Snort est un **S**ystème de **D**étection d' | + | CA certificate life time in days [1460]: 3650 |
| + | Server certificate life time in days [365]: 3650 | ||
| + | Your country | ||
| + | Your state or province name [none]: SURREY | ||
| + | Your location (e.g. town) [Berlin]: ADDLESTONE | ||
| + | Your organization [OpenVAS Users United]: I2TCH LIMITED | ||
| - | === Installation === | + | ------------------------------------------------------------------------------- |
| + | Creation of the OpenVAS SSL Certificate | ||
| + | ------------------------------------------------------------------------------- | ||
| - | Sous Debian 12, **snort** n'est pas installé par défaut. Qui plus est **snort** ne se trouve pas dans les dépôts standards. | + | Congratulations. Your server certificate was properly created. |
| - | Commencez donc par installer les dépendances de snort à partir des dépôts standards | + | The following files were created: |
| - | < | + | . Certification authority: |
| - | root@debian12:~# apt-get install -y build-essential libpcre3-dev libdumbnet-dev bison flex zlib1g-dev liblzma-dev libssl-dev libluajit-5.1-dev pkg-config libhwloc-dev cmake libpcap-dev libdaq-dev libnetfilter-queue-dev libmnl-dev libnghttp2-dev autoconf libtool cmake git | + | Certificate = / |
| + | | ||
| + | |||
| + | . OpenVAS Server : | ||
| + | Certificate = / | ||
| + | Private key = / | ||
| + | |||
| + | Press [ENTER] to exit | ||
| + | |||
| + | [Entrée] | ||
| + | [root@centos7 | ||
| </ | </ | ||
| + | |||
| + | Exécutez de nouveau la commande **openvas-check-setup** : | ||
| < | < | ||
| - | root@debian12:~# mkdir ~/prce2_src && cd ~/prce2_src | + | [root@centos7 |
| + | openvas-check-setup 2.3.3 | ||
| + | Test completeness and readiness of OpenVAS-8 | ||
| + | (add ' | ||
| + | if you want to check for another OpenVAS version) | ||
| - | root@debian12: | + | Please report us any non-detected problems and |
| - | Cloning into ' | + | help us to improve this check routine: |
| - | remote: Enumerating objects: 21776, done. | + | http://lists.wald.intevation.org/mailman/ |
| - | remote: Counting objects: 100% (253/253), done. | + | |
| - | remote: Compressing objects: 100% (151/151), done. | + | |
| - | remote: Total 21776 (delta 165), reused 125 (delta 102), pack-reused 21523 (from 3) | + | |
| - | Receiving objects: 100% (21776/ | + | |
| - | Resolving deltas: 100% (18190/18190), done. | + | |
| + | Send us the log-file (/ | ||
| - | </ | + | Use the parameter --server to skip checks for client tools |
| + | like GSD and OpenVAS-CLI. | ||
| - | Téléchargez et désarchivez**snort** | + | Step 1: Checking OpenVAS Scanner ... |
| + | OK: OpenVAS Scanner is present in version 5.0.6. | ||
| + | OK: OpenVAS Scanner CA Certificate is present as / | ||
| + | / | ||
| + | ERROR: No redis-server installation found. | ||
| + | FIX: You should install redis-server for improved scalability and ability to trace/debug the KB | ||
| - | < | + | ERROR: Your OpenVAS-8 installation is not yet complete! |
| - | root@debian12:~# mkdir ~/snort_src && cd ~/snort_src | + | |
| + | Please follow the instructions marked with FIX above and run this | ||
| + | script again. | ||
| - | root@debian12:~/ | + | If you think this result is wrong, please report your observation |
| - | Cloning into ' | + | and help us to improve this check routine: |
| - | remote: Enumerating objects: 123479, done. | + | http://lists.wald.intevation.org/mailman/listinfo/ |
| - | remote: Counting objects: 100% (12563/12563), done. | + | Please attach the log-file (/tmp/openvas-check-setup.log) to help us analyze the problem. |
| - | remote: Compressing objects: 100% (1891/1891), done. | + | |
| - | remote: Total 123479 (delta 11060), reused 10812 (delta 10672), pack-reused 110916 (from 5) | + | |
| - | Receiving objects: 100% (123479/123479), 91.19 MiB | 28.36 MiB/s, done. | + | |
| - | Resolving deltas: 100% (104741/ | + | |
| </ | </ | ||
| - | Créez un lien symbolique pour la bibliothèque partagée | + | <WRAP center round important 50%> |
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | Installez donc **redis** : | ||
| < | < | ||
| - | [root@centos7 ~]# ln -s / | + | [root@centos7 ~]# yum install redis |
| </ | </ | ||
| - | Dernièrement, | + | Activez |
| + | |||
| + | < | ||
| + | ... | ||
| + | # unixsocket / | ||
| + | # unixsocketperm 700... | ||
| + | </ | ||
| < | < | ||
| - | [root@centos7 ~]# chmod ug+x /var/log/snort | + | [root@centos7 ~]# sed -i '/^# |
| </ | </ | ||
| - | ==Options de la commande== | + | Ajoutez |
| - | Les options de cette commande sont : | + | < |
| + | ... | ||
| + | # KB test replay : | ||
| + | kb_dont_replay_scanners = no | ||
| + | kb_dont_replay_info_gathering = no | ||
| + | kb_dont_replay_attacks = no | ||
| + | kb_dont_replay_denials = no | ||
| + | kb_max_age = 864000 | ||
| + | kb_location = / | ||
| + | #--- end of the KB section | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Activez et démarrez le service **redis** | ||
| < | < | ||
| - | [root@centos7 ~]# snort --help | + | [root@centos7 ~]# systemctl enable redis |
| + | Created symlink from / | ||
| - | ,, | + | [root@centos7 |
| - | o" | + | |
| - | '''' | + | |
| - | | + | |
| - | | + | |
| - | Using libpcap version 1.5.3 | + | |
| - | Using PCRE version: 8.32 2012-11-30 | + | |
| - | Using ZLIB version: 1.2.7 | + | |
| - | USAGE: snort [-options] <filter options> | + | [root@centos7 ~]# systemctl status redis |
| - | Options: | + | ● redis.service |
| - | -A Set alert mode: fast, full, console, test or none (alert file alerts only) | + | Loaded: loaded |
| - | " | + | |
| - | | + | └─limit.conf |
| - | | + | Active: active |
| - | -c < | + | Main PID: 13037 (redis-server) |
| - | -C Print out payloads with character data only (no hex) | + | CGroup: /system.slice/redis.service |
| - | -d Dump the Application Layer | + | └─13037 / |
| - | -D Run Snort in background (daemon) mode | + | |
| - | -e | + | |
| - | -f Turn off fflush() calls after binary log writes | + | |
| - | -F < | + | |
| - | -g < | + | |
| - | -G < | + | |
| - | -h < | + | |
| - | (for use with -l or -B, does NOT change $HOME_NET in IDS mode) | + | |
| - | -H Make hash tables deterministic. | + | |
| - | -i < | + | |
| - | -I Add Interface name to alert output | + | |
| - | -k < | + | |
| - | -K < | + | |
| - | | + | |
| - | -L < | + | |
| - | -M Log messages to syslog (not alerts) | + | |
| - | -m < | + | |
| - | -n < | + | |
| - | -N Turn off logging (alerts still work) | + | |
| - | -O | + | |
| - | -p | + | |
| - | -P < | + | |
| - | -q Quiet. Don't show banner and status report | + | |
| - | -Q | + | |
| - | -r < | + | |
| - | -R < | + | |
| - | -s Log alert messages to syslog | + | |
| - | -S < | + | |
| - | -t < | + | |
| - | -T Test and report on the current Snort configuration | + | |
| - | -u < | + | |
| - | -U Use UTC for timestamps | + | |
| - | -v Be verbose | + | |
| - | -V Show version number | + | |
| - | -X Dump the raw packet data starting at the link layer | + | |
| - | -x Exit if Snort configuration problems occur | + | |
| - | -y | + | |
| - | -Z < | + | |
| - | -? Show this information | + | |
| - | <Filter Options> are standard BPF options, as seen in TCPDump | + | |
| - | Longname options and their corresponding single char version | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | --treat-drop-as-alert | + | |
| - | | + | |
| - | | + | |
| - | --enable-inline-test | + | |
| - | --dynamic-engine-lib < | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | for < | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | takes from signaling until DAQ_Stop() is called. | + | |
| - | --conf-error-out | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | --require-rule-sid | + | |
| - | --daq < | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| + | Dec 01 15:45:16 centos7.fenestros.loc systemd[1]: Starting Redis persistent key-value database... | ||
| + | Dec 01 15:45:16 centos7.fenestros.loc systemd[1]: Started Redis persistent key-value database. | ||
| </ | </ | ||
| - | ===Configuration de Snort=== | + | Exécutez encore une fois la commande **openvas-check-setup** : |
| - | Snort a besoin de règles pour fonctionner correctement. Ces règles sont disponibles sous trois formes différentes | + | < |
| + | [root@centos7 ~]# openvas-check-setup | ||
| + | ... | ||
| + | Step 1: Checking OpenVAS Scanner ... | ||
| + | OK: OpenVAS Scanner is present in version 5.0.6. | ||
| + | OK: OpenVAS Scanner CA Certificate is present as / | ||
| + | OK: redis-server is present in version v=3.2.10. | ||
| + | OK: scanner (kb_location setting) is configured properly using the redis-server socket: / | ||
| + | OK: redis-server is running and listening on socket: / | ||
| + | OK: redis-server configuration is OK and redis-server is running. | ||
| + | ERROR: The NVT collection is very small. | ||
| + | FIX: Run a synchronization script like openvas-nvt-sync or greenbone-nvt-sync. | ||
| + | ... | ||
| + | </ | ||
| - | * **Community** - règles de base disponibles à tout le monde, | + | <WRAP center round important 50%> |
| - | * **Registered** - règles disponibles à toute personne possédant un compte gratuit sur le site **[[http://www.snort.org]]**, | + | **Important** - Notez l' |
| - | * **Subscription** - règles les plus efficaces disponibles uniquement aux utilisateurs enregistrés **et** abonnés à un plan payant. | + | </ |
| - | Le répertoire rules est donc vide lors de l' | + | Téléchargez le script **greenbone-nvt-sync** |
| < | < | ||
| - | [root@centos7 ~]# ls /etc/snort/rules/ | + | [root@centos7 ~]# wget https://www.dropbox.com/scl/fi/ |
| - | [root@centos7 ~]# | + | |
| + | [root@centos7 ~]# mv greenbone-nvt-sync? | ||
| </ | </ | ||
| - | Téléchargez les règles | + | Si vous ne pouvez pas téléchargez le script |
| < | < | ||
| - | [root@centos7 ~]# wget https://www.dropbox.com/scl/fi/dkmuxq9j0ftahp4c3rf5p/registered.tar.gz?rlkey=mvs3qdu1kxfz9zs5mt5zy1niz&st=n90pywc2 | + | [root@centos7 ~]# vi greenbone-nvt-sync |
| + | [root@centos7 ~]# cat greenbone-nvt-sync | ||
| + | #!/bin/sh | ||
| + | # Copyright (C) 2009-2021 Greenbone Networks GmbH | ||
| + | # | ||
| + | # SPDX-License-Identifier: GPL-2.0-or-later | ||
| + | # | ||
| + | # This program is free software; you can redistribute it and/or | ||
| + | # modify it under the terms of the GNU General Public License | ||
| + | # as published by the Free Software Foundation; either version 2 | ||
| + | # of the License, or (at your option) any later version. | ||
| + | # | ||
| + | # This program is distributed in the hope that it will be useful, | ||
| + | # but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| + | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. | ||
| + | # GNU General Public License for more details. | ||
| + | # | ||
| + | # You should have received a copy of the GNU General Public License | ||
| + | # along with this program; if not, write to the Free Software | ||
| + | # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. | ||
| + | |||
| + | # This script updates the local Network Vulnerability Tests (NVTs) from the | ||
| + | # Greenbone Security Feed (GSF) or the Greenbone Community Feed (GCF). | ||
| + | |||
| + | VERSION=@OPENVAS_VERSION@ | ||
| + | |||
| + | # SETTINGS | ||
| + | # ======== | ||
| + | |||
| + | # PRIVATE_SUBDIR defines a subdirectory of the NVT directory that is excluded | ||
| + | # from the feed sync. This is where to place your own NVTs. | ||
| + | if [ -z " | ||
| + | then | ||
| + | PRIVATE_SUBDIR=" | ||
| + | fi | ||
| + | |||
| + | # RSYNC_DELETE controls whether files which are not part of the repository will | ||
| + | # be removed from the local directory after synchronization. The default value | ||
| + | # for this setting is | ||
| + | # " | ||
| + | # which means that files which are not part of the feed or private directory | ||
| + | # will be deleted. | ||
| + | RSYNC_DELETE=" | ||
| + | |||
| + | # RSYNC_SSH_OPTS contains options which should be passed to ssh for the rsync | ||
| + | # connection to the repository. | ||
| + | RSYNC_SSH_OPTS=" | ||
| + | |||
| + | # RSYNC_COMPRESS specifies the compression level to use for the rsync connection. | ||
| + | RSYNC_COMPRESS=" | ||
| + | |||
| + | # RSYNC_CHMOD specifies the permissions to chmod the files to. | ||
| + | RSYNC_CHMOD=" | ||
| + | |||
| + | # Verbosity flag for rsync. " | ||
| + | RSYNC_VERBOSE=" | ||
| + | |||
| + | # RSYNC_OPTIONS controls the general parameters for the rsync connection. | ||
| + | RSYNC_OPTIONS=" | ||
| + | |||
| + | # Script and feed information which will be made available to user through | ||
| + | # command line options and automated tools. | ||
| + | # Script name which will be used for logging | ||
| + | SCRIPT_NAME=" | ||
| + | |||
| + | # Result of selftest () is stored here. If it is not 0, the selftest has failed | ||
| + | # and the sync script is unlikely to work. | ||
| + | SELFTEST_FAIL=0 | ||
| + | |||
| + | # Port to use for synchronization. Default value is 24. | ||
| + | PORT=24 | ||
| + | |||
| + | # Directory where the OpenVAS configuration is located | ||
| + | OPENVAS_SYSCONF_DIR=" | ||
| + | |||
| + | # Directory where the feed update lock file will be placed. | ||
| + | OPENVAS_FEED_LOCK_PATH=" | ||
| + | |||
| + | # Location of the GSF Access Key | ||
| + | ACCESS_KEY=" | ||
| + | |||
| + | # If ENABLED is set to 0, the sync script will not perform a synchronization. | ||
| + | ENABLED=1 | ||
| + | |||
| + | # LOG_CMD defines the command to use for logging. To have logger log to stderr | ||
| + | # as well as syslog, add " | ||
| + | # all will be logged in the standard error and the socket error check will be | ||
| + | # disabled. | ||
| + | LOG_CMD=" | ||
| + | |||
| + | check_logger () { | ||
| + | logger -p daemon.info -t $SCRIPT_NAME " | ||
| + | if [ $? -gt 0 ] | ||
| + | then | ||
| + | LOG_CMD=" | ||
| + | $LOG_CMD -p daemon.warning "The log facility is not working as expected. All messages will be written to the standard error stream." | ||
| + | | ||
| + | } | ||
| + | check_logger | ||
| + | |||
| + | |||
| + | # Source configuration file if it is readable | ||
| + | [ -r $OPENVAS_SYSCONF_DIR/greenbone-nvt-sync.conf ] && . $OPENVAS_SYSCONF_DIR/greenbone-nvt-sync.conf | ||
| + | |||
| + | # NVT_DIR is the place where the NVTs are located. | ||
| + | if [ -z " | ||
| + | then | ||
| + | NVT_DIR=" | ||
| + | fi | ||
| + | |||
| + | log_write () { | ||
| + | $LOG_CMD -p daemon.notice $1 | ||
| + | } | ||
| + | |||
| + | log_debug () { | ||
| + | $LOG_CMD -p daemon.debug " | ||
| + | } | ||
| + | |||
| + | log_info () { | ||
| + | $LOG_CMD -p daemon.info " | ||
| + | } | ||
| + | |||
| + | log_notice () { | ||
| + | $LOG_CMD -p daemon.notice " | ||
| + | } | ||
| + | |||
| + | log_warning () { | ||
| + | $LOG_CMD -p daemon.warning " | ||
| + | } | ||
| + | |||
| + | log_err () { | ||
| + | $LOG_CMD -p daemon.err " | ||
| + | } | ||
| + | |||
| + | stderr_write () | ||
| + | { | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | # Read the general information about the feed origin from | ||
| + | # the file " | ||
| + | get_feed_info () | ||
| + | { | ||
| + | INFOFILE=" | ||
| + | if [ -r $INFOFILE ] ; then | ||
| + | FEED_VERSION=`grep PLUGIN_SET $INFOFILE | sed -e ' | ||
| + | FEED_NAME=`awk -F\" '/ | ||
| + | FEED_VENDOR=`awk -F\" '/ | ||
| + | FEED_HOME=`awk -F\" '/ | ||
| + | FEED_PRESENT=1 | ||
| + | else | ||
| + | FEED_PRESENT=0 | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_VENDOR=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_HOME=" | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | # Prevent that root executes this script | ||
| + | if [ "`id -u`" -eq " | ||
| + | then | ||
| + | stderr_write "$0 must not be executed as privileged user root" | ||
| + | stderr_write | ||
| + | stderr_write " | ||
| + | stderr_write " | ||
| + | stderr_write "files with a non-privileged user." | ||
| + | |||
| + | log_err " | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | # Always try to get the information when started. | ||
| + | # This also ensures variables like FEED_PRESENT are set. | ||
| + | get_feed_info | ||
| + | |||
| + | # Determine whether a GSF access key is present. If yes, | ||
| + | # then use the Greenbone Security Feed. Else use the | ||
| + | # Greenbone Community Feed. | ||
| + | if [ -e $ACCESS_KEY ] | ||
| + | then | ||
| + | RESTRICTED=1 | ||
| + | else | ||
| + | RESTRICTED=0 | ||
| + | |||
| + | if [ -z " | ||
| + | COMMUNITY_NVT_RSYNC_FEED=rsync:// | ||
| + | # An alternative syntax which might work if the above doesn' | ||
| + | # COMMUNITY_NVT_RSYNC_FEED=rsync@feed.community.greenbone.net::/ | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | RSYNC=`command -v rsync` | ||
| + | |||
| + | if [ -z " | ||
| + | SYNC_TMP_DIR=/ | ||
| + | # If we have mktemp, create a temporary dir (safer) | ||
| + | if [ -n " | ||
| + | SYNC_TMP_DIR=`mktemp -t -d greenbone-nvt-sync.XXXXXXXXXX` || { echo " | ||
| + | trap "rm -rf $SYNC_TMP_DIR" | ||
| + | fi | ||
| + | else | ||
| + | SYNC_TMP_DIR=" | ||
| + | fi | ||
| + | |||
| + | # Initialize this indicator variable with default assuming the | ||
| + | # feed is not up-to-date. | ||
| + | FEED_CURRENT=0 | ||
| + | |||
| + | # This function uses gos-state-manager to get information about the settings. | ||
| + | # If gos-state-manager is not installed the values of the settings can not be | ||
| + | # retrieved. | ||
| + | # | ||
| + | # Input: option | ||
| + | # Output: value as string or empty String if gos-state-manager is not installed | ||
| + | # or option not set | ||
| + | get_value () | ||
| + | { | ||
| + | value="" | ||
| + | key=$1 | ||
| + | if which gos-state-manager 1>/ | ||
| + | then | ||
| + | if gos-state-manager get " | ||
| + | then | ||
| + | value=" | ||
| + | fi | ||
| + | fi | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | # Creates a restricted access copy of the access key if necessary. | ||
| + | setup_temp_access_key () { | ||
| + | if [ -e " | ||
| + | then | ||
| + | FILE_ACCESS=`stat -c%a " | ||
| + | fi | ||
| + | if [ -n " | ||
| + | then | ||
| + | TEMP_ACCESS_KEY_DIR=`mktemp -d` | ||
| + | TEMP_ACCESS_KEY=" | ||
| + | cp " | ||
| + | chmod 400 " | ||
| + | else | ||
| + | TEMP_ACCESS_KEY_DIR="" | ||
| + | TEMP_ACCESS_KEY=" | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | # Deletes the read-only copy of the access key. | ||
| + | cleanup_temp_access_key () { | ||
| + | if [ -n " | ||
| + | then | ||
| + | rm -rf " | ||
| + | fi | ||
| + | TEMP_ACCESS_KEY_DIR="" | ||
| + | TEMP_ACCESS_KEY="" | ||
| + | } | ||
| + | |||
| + | is_feed_current () { | ||
| + | if [ -z " | ||
| + | then | ||
| + | log_write "Could not determine feed version." | ||
| + | FEED_CURRENT=0 | ||
| + | return $FEED_CURRENT | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | log_notice "rsync not available, skipping feed version test" | ||
| + | FEED_CURRENT=0 | ||
| + | rm -rf $FEED_INFO_TEMP_DIR | ||
| + | cleanup_temp_access_key | ||
| + | return 0 | ||
| + | fi | ||
| + | |||
| + | FEED_INFO_TEMP_DIR=`mktemp -d` | ||
| + | |||
| + | if [ -e $ACCESS_KEY ] | ||
| + | then | ||
| + | gsmproxy=$(get_value proxy_feed | sed -r -e ' | ||
| + | syncport=$(get_value syncport) | ||
| + | if [ " | ||
| + | then | ||
| + | PORT=" | ||
| + | fi | ||
| + | |||
| + | read feeduser < $ACCESS_KEY | ||
| + | custid=`awk -F@ 'NR > 1 { exit }; { print $1 }' $ACCESS_KEY` | ||
| + | if [ -z " | ||
| + | then | ||
| + | log_err "Could not determine credentials, | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | setup_temp_access_key | ||
| + | |||
| + | if [ " | ||
| + | then | ||
| + | RSYNC_SSH_PROXY_CMD="" | ||
| + | else | ||
| + | if [ -e $OPENVAS_SYSCONF_DIR/ | ||
| + | then | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | else | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $TEMP_ACCESS_KEY" | ||
| + | |||
| + | if [ $? -ne 0 ] | ||
| + | then | ||
| + | log_err " | ||
| + | rm -rf " | ||
| + | exit 1 | ||
| + | fi | ||
| + | else | ||
| + | # Sleep for five seconds (a previous feed might have been synced a few seconds before) to prevent | ||
| + | # IP blocking due to network equipment in between keeping the previous connection too long open. | ||
| + | sleep 5 | ||
| + | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | ||
| + | eval " | ||
| + | if [ $? -ne 0 ] | ||
| + | then | ||
| + | log_err "rsync failed, aborting synchronization." | ||
| + | rm -rf " | ||
| + | exit 1 | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | FEED_VERSION_SERVER=`grep PLUGIN_SET $FEED_INFO_TEMP_DIR/ | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | log_err "Could not determine server feed version." | ||
| + | rm -rf $FEED_INFO_TEMP_DIR | ||
| + | cleanup_temp_access_key | ||
| + | exit 1 | ||
| + | fi | ||
| + | # Check against FEED_VERSION | ||
| + | if [ $FEED_VERSION -lt $FEED_VERSION_SERVER ] ; then | ||
| + | FEED_CURRENT=0 | ||
| + | else | ||
| + | FEED_CURRENT=1 | ||
| + | fi | ||
| + | # Cleanup | ||
| + | rm -rf " | ||
| + | cleanup_temp_access_key | ||
| + | |||
| + | return $FEED_CURRENT | ||
| + | } | ||
| + | |||
| + | do_rsync_community_feed () { | ||
| + | # Sleep for five seconds (a previous feed might have been synced a few seconds before) to prevent | ||
| + | # IP blocking due to network equipment in between keeping the previous connection too long open. | ||
| + | sleep 5 | ||
| + | log_notice " | ||
| + | mkdir -p " | ||
| + | eval " | ||
| + | if [ $? -ne 0 ] ; then | ||
| + | log_err "rsync failed." | ||
| + | exit 1 | ||
| + | fi | ||
| + | # Sleep for five seconds (after the above rsync call) to prevent IP blocking due | ||
| + | # to network equipment in between keeping the previous connection too long open. | ||
| + | sleep 5 | ||
| + | eval " | ||
| + | if [ $? -ne 0 ] ; then | ||
| + | log_err "rsync failed." | ||
| + | exit 1 | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | sync_nvts(){ | ||
| + | if [ $ENABLED -ne 1 ] | ||
| + | then | ||
| + | log_write "NVT synchronization is disabled, exiting." | ||
| + | exit 0 | ||
| + | fi | ||
| + | |||
| + | if [ -e $ACCESS_KEY ] | ||
| + | then | ||
| + | log_write " | ||
| + | if [ $FEED_PRESENT -eq 1 ] ; then | ||
| + | FEEDCOUNT=`grep -E " | ||
| + | log_write " | ||
| + | else | ||
| + | log_write " | ||
| + | fi | ||
| + | notsynced=1 | ||
| + | retried=0 | ||
| + | |||
| + | mkdir -p " | ||
| + | read feeduser < $ACCESS_KEY | ||
| + | custid=`awk -F@ 'NR > 1 { exit }; { print $1 }' $ACCESS_KEY` | ||
| + | if [ -z " | ||
| + | then | ||
| + | log_err "Could not determine credentials, | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | setup_temp_access_key | ||
| + | |||
| + | while [ $notsynced -eq 1 ] | ||
| + | do | ||
| + | |||
| + | gsmproxy=$(get_value proxy_feed | sed -r -e ' | ||
| + | syncport=$(get_value syncport) | ||
| + | if [ " | ||
| + | then | ||
| + | PORT=" | ||
| + | fi | ||
| + | |||
| + | if [ " | ||
| + | then | ||
| + | RSYNC_SSH_PROXY_CMD="" | ||
| + | else | ||
| + | if [ -e $OPENVAS_SYSCONF_DIR/ | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | else | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | fi | ||
| + | fi | ||
| + | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $TEMP_ACCESS_KEY" | ||
| + | if [ $? -ne 0 ] ; then | ||
| + | log_err "rsync failed, aborting synchronization." | ||
| + | exit 1 | ||
| + | fi | ||
| + | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $TEMP_ACCESS_KEY" | ||
| + | if [ $? -ne 0 ] ; then | ||
| + | log_err "rsync failed, aborting synchronization." | ||
| + | exit 1 | ||
| + | fi | ||
| + | eval "cd \" | ||
| + | if [ $? -ne 0 ] ; then | ||
| + | if [ -n " | ||
| + | then | ||
| + | log_err "Feed integrity check failed twice, aborting synchronization." | ||
| + | cleanup_temp_access_key | ||
| + | exit 1 | ||
| + | else | ||
| + | log_write "The feed integrity check failed. This may be due to a concurrent feed update or other temporary issues." | ||
| + | log_write " | ||
| + | sleep 15 | ||
| + | retried=1 | ||
| + | fi | ||
| + | else | ||
| + | notsynced=0 | ||
| + | fi | ||
| + | done | ||
| + | cleanup_temp_access_key | ||
| + | log_write " | ||
| + | get_feed_info | ||
| + | if [ $FEED_PRESENT -eq 1 ] ; then | ||
| + | FEEDCOUNT=`grep -E " | ||
| + | log_write " | ||
| + | else | ||
| + | log_write " | ||
| + | fi | ||
| + | else | ||
| + | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | ||
| + | do_rsync_community_feed | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | do_self_test () | ||
| + | { | ||
| + | MD5SUM_AVAIL=`command -v md5sum` | ||
| + | if [ $? -ne 0 ] ; then | ||
| + | SELFTEST_FAIL=1 | ||
| + | stderr_write "The md5sum binary could not be found." | ||
| + | fi | ||
| + | |||
| + | RSYNC_AVAIL=`command -v rsync` | ||
| + | if [ $? -ne 0 ] ; then | ||
| + | SELFTEST_FAIL=1 | ||
| + | stderr_write "The rsync binary could not be found." | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | do_describe () | ||
| + | { | ||
| + | echo "This script synchronizes an NVT collection with the ' | ||
| + | echo "The ' | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | do_feedversion () { | ||
| + | if [ $FEED_PRESENT -eq 1 ] ; then | ||
| + | echo $FEED_VERSION | ||
| + | else | ||
| + | stderr_write "The file containing the feed version could not be found." | ||
| + | exit 1 | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | do_sync () | ||
| + | { | ||
| + | do_self_test | ||
| + | if [ $SELFTEST_FAIL -ne 0 ] ; then | ||
| + | exit $SELFTEST_FAIL | ||
| + | fi | ||
| + | |||
| + | if [ $FEED_CURRENT -eq 1 ] | ||
| + | then | ||
| + | log_write "Feed is already current, skipping synchronization." | ||
| + | else | ||
| + | ( | ||
| + | chmod +660 $OPENVAS_FEED_LOCK_PATH | ||
| + | flock -n 9 | ||
| + | if [ $? -eq 1 ] ; then | ||
| + | log_warning " | ||
| + | exit 1 | ||
| + | fi | ||
| + | date > $OPENVAS_FEED_LOCK_PATH | ||
| + | sync_nvts | ||
| + | echo -n $OPENVAS_FEED_LOCK_PATH | ||
| + | )9>> | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | do_help () { | ||
| + | echo "$0: Sync NVT data" | ||
| + | echo " --describe | ||
| + | echo " --feedcurrent | ||
| + | echo " --feedversion | ||
| + | echo " --help | ||
| + | echo " --identify | ||
| + | echo " --nvtdir dir set dir as NVT directory" | ||
| + | echo " --selftest | ||
| + | echo " --verbose | ||
| + | echo " --version | ||
| + | echo "" | ||
| + | echo "" | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo "Note that you can use standard ones as well (e.g. RSYNC_PROXY) for rsync" | ||
| + | echo "" | ||
| + | exit 0 | ||
| + | } | ||
| + | |||
| + | while test $# -gt 0; do | ||
| + | case " | ||
| + | --version) | ||
| + | echo $VERSION | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --identify) | ||
| + | echo " | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --selftest) | ||
| + | do_self_test | ||
| + | exit $SELFTEST_FAIL | ||
| + | ;; | ||
| + | --describe) | ||
| + | do_describe | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --feedversion) | ||
| + | do_feedversion | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --help) | ||
| + | do_help | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --nvt-dir) | ||
| + | NVT_DIR=" | ||
| + | shift | ||
| + | ;; | ||
| + | --feedcurrent) | ||
| + | is_feed_current | ||
| + | exit $? | ||
| + | ;; | ||
| + | --verbose) | ||
| + | RSYNC_VERBOSE=" | ||
| + | ;; | ||
| + | esac | ||
| + | shift | ||
| + | done | ||
| + | |||
| + | do_sync | ||
| + | |||
| + | exit 0 | ||
| </ | </ | ||
| - | Ensuite, saisissez les commandes suivantes | + | Rendez le script exécutable |
| < | < | ||
| - | [root@centos7 ~]# tar -xvf ~/ | + | [root@centos7 ~]# chmod +x greenbone-nvt-sync |
| - | [root@centos7 ~]# ls / | + | |
| - | app-detect.rules | + | |
| - | attack-responses.rules | + | |
| - | backdoor.rules | + | |
| - | bad-traffic.rules | + | |
| - | blacklist.rules | + | |
| - | botnet-cnc.rules | + | |
| - | browser-chrome.rules | + | |
| - | browser-firefox.rules | + | |
| - | browser-ie.rules | + | |
| - | browser-other.rules | + | |
| - | browser-plugins.rules | + | |
| - | browser-webkit.rules | + | |
| - | chat.rules | + | |
| - | content-replace.rules | + | |
| - | ddos.rules | + | |
| - | deleted.rules | + | |
| - | dns.rules | + | |
| - | dos.rules | + | |
| - | experimental.rules | + | |
| - | exploit-kit.rules | + | |
| - | exploit.rules | + | |
| - | file-executable.rules | + | |
| - | file-flash.rules | + | |
| - | file-identify.rules | + | |
| </ | </ | ||
| - | <WRAP center round important 50%> | + | Déplacez le script vers **/usr/sbin/** : |
| - | **Important** - Si vous utilisez **snort** régulièrement, | + | |
| - | </ | + | |
| - | == Editer le fichier | + | < |
| + | [root@centos7 ~]# mv greenbone-nvt-sync | ||
| + | mv: overwrite ‘/usr/ | ||
| + | </ | ||
| - | Lancez vi pour éditer le fichier **/ | + | Devenez l' |
| - | Modifiez la ligne qui commence par **ipvar HOME_NET** pour que celle-ci comporte l' | + | < |
| - | < | + | [root@centos7 ~]# su - trainee |
| + | Last login: Mon Dec 1 15:30:45 CET 2025 on pts/0 | ||
| + | |||
| + | [trainee@centos7 ~]$ greenbone-nvt-sync | ||
| ... | ... | ||
| - | ipvar HOME_NET 10.0.2.0/24 | + | Greenbone community feed server - http://feed.community.greenbone.net/ |
| - | ... | + | This service is hosted by Greenbone Networks - http://www.greenbone.net/ |
| - | </file> | + | |
| - | Dans le cas où vous êtes connecté à deux ou à plusieurs réseaux directement, | + | All transactions are logged. |
| - | ipvar HOME_NET [adresse_réseau_1 ( p.e. 10.0.2.0/24 ), adresse_réseau_2 ( p.e. 10.0.0.0/8 )] | + | If you have any questions, please use the Greenbone community portal. |
| + | See https://community.greenbone.net for details. | ||
| - | Vérifiez la présence de les lignes qui commencent par **var RULE_PATH**, | + | By using this service you agree to our terms and conditions. |
| - | < | + | Only one sync per time, otherwise the source ip will be temporarily blocked. |
| - | ... | + | |
| - | var RULE_PATH / | + | |
| - | var SO_RULE_PATH ../ | + | |
| - | var PREPROC_RULE_PATH ../ | + | |
| - | ... | + | |
| - | </ | + | |
| - | Modifiez les deux lignes suivantes afin d' | ||
| - | <file> | + | receiving incremental |
| - | ... | + | plugin_feed_info.inc |
| - | var WHITE_LIST_PATH | + | 330 100% 322.27kB/s 0:00:00 (xfr#1, to-chk=0/1) |
| - | var BLACK_LIST_PATH / | + | |
| - | ... | + | |
| - | </ | + | |
| - | Décommentez la ligne qui commence par **ooutput unified2** concernant la journalisation et supprimez le mot **nostamp** : | + | sent 57 bytes received 436 bytes 328.67 bytes/sec |
| + | total size is 330 speedup is 0.67 | ||
| + | [trainee@centos7 ~]$ exit | ||
| + | [root@centos7 ~]# | ||
| + | </ | ||
| - | <file> | + | <WRAP center round important 50%> |
| - | ... | + | **Important** - En cas d' |
| - | # unified2 | + | </WRAP> |
| - | # Recommended for most installs | + | |
| - | output unified2: filename merged.log, limit 128, mpls_event_types, | + | |
| - | ... | + | |
| - | </file> | + | |
| - | Commentez ensuite la ligne commençant par **dynamicdetection directory** : | + | Déplacez les plugins vers le répertoire |
| < | < | ||
| - | # path to dynamic rules libraries | + | [root@centos7 ~]# mv /home/trainee/ |
| - | # dynamicdetection directory | + | |
| </ | </ | ||
| - | Créez | + | Vérifiez |
| < | < | ||
| - | [root@centos7 ~]# touch /etc/snort/rules/white_list.rules | + | [root@centos7 ~]# ls -l /var/lib/openvas/plugins/ | more |
| - | [root@centos7 ~]# touch / | + | total 41280 |
| + | drwxr-xr-x. 6 trainee trainee | ||
| + | drwxr-xr-x. 14 trainee trainee | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. 288 trainee trainee | ||
| + | drwxr-xr-x. 215 trainee trainee | ||
| + | drwxr-xr-x. 181 trainee trainee | ||
| + | drwxr-xr-x. 154 trainee trainee | ||
| + | drwxr-xr-x. 149 trainee trainee | ||
| + | drwx------. 136 trainee trainee | ||
| + | drwx------. 127 trainee trainee | ||
| + | drwx------. 132 trainee trainee | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | drwx------. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | --More-- | ||
| </ | </ | ||
| - | Modifiez maintenant le fichier | + | Exécutez de nouveau la commande |
| - | <file> | + | <code> |
| + | [root@centos7 ~]# openvas-check-setup | ||
| ... | ... | ||
| - | #### General Configuration | + | Step 2: Checking OpenVAS Manager ... |
| + | OK: OpenVAS Manager is present in version 6.0.9. | ||
| + | ERROR: No client certificate file of OpenVAS Manager found. | ||
| + | FIX: Run ' | ||
| - | # What interface should snort listen on? [Pick only 1 of the next 3!] | + | ERROR: Your OpenVAS-8 installation |
| - | # This is -i {interface} on the command line | + | |
| - | # This is the snort.conf config interface: {interface} directive | + | |
| - | # INTERFACE=eth0 | + | |
| - | INTERFACE=enp0s3 | + | |
| - | # | + | |
| - | # The following two options are not directly supported on the command line | + | |
| - | # or in the conf file and assume the same Snort configuration for all | + | |
| - | # instances | + | |
| ... | ... | ||
| - | </file> | + | </code> |
| - | Vérifiez le fichier de configuration | + | <WRAP center round important 50%> |
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | Consultez la signification des options suggérées pour la commande **openvas-mkcert-client** | ||
| < | < | ||
| - | [root@centos7 ~]# snort -T -c /etc/snort/ | + | [root@centos7 ~]# openvas-mkcert-client --help |
| - | ... | + | /bin/openvas-mkcert-client: |
| - | --== Initialization Complete ==-- | + | Usage: |
| + | openvas-mkcert-client [OPTION...] - Create SSL client certificates for OpenVAS. | ||
| - | ,, | + | Options: |
| - | | + | |
| - | '''' | + | -n |
| - | | + | and register with the OpenVAS scanner |
| - | | + | |
| - | Using libpcap version 1.5.3 | + | </ |
| - | Using PCRE version: 8.32 2012-11-30 | + | |
| - | Using ZLIB version: 1.2.7 | + | |
| - | Rules Engine: SF_SNORT_DETECTION_ENGINE | + | Exécutez donc la commande **openvas-mkcert-client -i** : |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Snort successfully validated the configuration! | + | < |
| - | Snort exiting | + | [root@centos7 ~]# openvas-mkcert-client -i |
| - | </code> | + | This script will now ask you the relevant information to create the SSL client certificates for OpenVAS. |
| - | === Utilisation de snort en mode " | + | Client certificates life time in days [365]: 3650 |
| + | Your country (two letter code) [DE]: UK | ||
| + | Your state or province name [none]: SURREY | ||
| + | Your location (e.g. town) [Berlin]: ADDLESTONE | ||
| + | Your organization [none]: I2TCH LIMITED | ||
| + | Your organizational unit [none]: TRAINING | ||
| + | ********** | ||
| + | We are going to ask you some question for each client certificate. | ||
| + | |||
| + | If some question has a default answer, you can force an empty answer by entering a single dot ' | ||
| + | |||
| + | ********* | ||
| + | Client certificates life time in days [3650]: | ||
| + | Country (two letter code) [UK]: | ||
| + | State or province name [SURREY]: | ||
| + | Location (e.g. town) [ADDLESTONE]: | ||
| + | Organization [I2TCH LIMITED]: | ||
| + | Organization unit [TRAINING]: | ||
| + | e-Mail []: infos@i2tch.eu | ||
| + | Generating RSA private key, 4096 bit long modulus | ||
| + | ....++ | ||
| + | .......++ | ||
| + | e is 65537 (0x10001) | ||
| + | You are about to be asked to enter information that will be incorporated | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Country Name (2 letter code) [DE]:State or Province Name (full name) [Some-State]: | ||
| + | Check that the request matches the signature | ||
| + | Signature ok | ||
| + | The Subject' | ||
| + | countryName | ||
| + | stateOrProvinceName | ||
| + | localityName | ||
| + | organizationName | ||
| + | organizationalUnitName: | ||
| + | commonName | ||
| + | emailAddress | ||
| + | Certificate is to be certified until Jun 17 02:03:34 2028 GMT (3650 days) | ||
| + | |||
| + | Write out database with 1 new entries | ||
| + | Data Base Updated | ||
| + | / | ||
| + | </ | ||
| - | Pour visualiser les paquets à l'aide de snort, saisissez | + | Exécutez encore une fois la commande |
| < | < | ||
| - | [root@centos7 ~]# snort -vde -c /etc/snort/snort.conf -l /var/log/snort | + | [root@centos7 ~]# openvas-check-setup |
| + | ... | ||
| + | Step 2: Checking OpenVAS Manager ... | ||
| + | OK: OpenVAS Manager is present in version 6.0.9. | ||
| + | OK: OpenVAS Manager client certificate is present as /etc/pki/openvas/ | ||
| + | ERROR: No OpenVAS Manager database found. (Tried: | ||
| + | FIX: Run ' | ||
| + | WARNING: OpenVAS Scanner is NOT running! | ||
| + | SUGGEST: Start OpenVAS Scanner (openvassd). | ||
| + | |||
| + | | ||
| ... | ... | ||
| - | [root@centos7 ~]# ^C | ||
| </ | </ | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Notez l'utilisation de la combinaison de touches < | + | **Important** - Notez l'erreur **ERROR: No OpenVAS Manager database found. (Tried: |
| </ | </ | ||
| - | Pour surveiller une interface réseau en particulier, | + | Afin de générer |
| < | < | ||
| - | [root@centos7 ~]# snort -vd -i enp0s3 | + | [root@centos7 ~]# systemctl enable openvas-scanner |
| + | Created symlink from / | ||
| + | [root@centos7 ~]# systemctl start openvas-scanner | ||
| + | [root@centos7 ~]# systemctl status openvas-scanner | ||
| + | ● openvas-scanner.service - OpenVAS Scanner | ||
| + | | ||
| + | | ||
| + | Process: 8889 ExecStart=/ | ||
| + | Main PID: 8890 (openvassd) | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Dec 01 16:45:47 centos7.fenestros.loc systemd[1]: Starting OpenVAS Scanner... | ||
| + | Dec 01 16:45:47 centos7.fenestros.loc systemd[1]: Started OpenVAS Scanner. | ||
| + | </ | ||
| + | |||
| + | Construisez maintenant la base de données : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# openvasmd --rebuild --progress | ||
| + | Rebuilding NVT cache... done. | ||
| + | </ | ||
| + | |||
| + | Exécutez de nouveau la commande **openvas-check-setup** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# openvas-check-setup | ||
| + | ... | ||
| + | Step 2: Checking OpenVAS Manager ... | ||
| + | OK: OpenVAS Manager is present in version 6.0.9. | ||
| + | OK: OpenVAS Manager client certificate is present as /etc/pki/openvas/ | ||
| + | OK: OpenVAS Manager database found in / | ||
| + | OK: Access rights for the OpenVAS Manager database are correct. | ||
| + | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. | ||
| + | OK: OpenVAS Manager database is at revision 146. | ||
| + | OK: OpenVAS Manager expects database at revision 146. | ||
| + | OK: Database schema is up to date. | ||
| + | OK: OpenVAS Manager database contains information about 45654 NVTs. | ||
| + | ERROR: No users found. You need to create at least one user to log in. | ||
| + | It is recommended to have at least one user with role Admin. | ||
| + | FIX: create a user by running ' | ||
| ... | ... | ||
| - | [root@centos7 ~]# ^C | ||
| </ | </ | ||
| - | === Utilisation de snort en mode " | + | <WRAP center round important 50%> |
| + | **Important** - Notez l' | ||
| + | </ | ||
| - | Pour rediriger la sortie à l' | + | Créez donc un utilisateur |
| < | < | ||
| - | [root@centos7 ~]# snort -de -l /var/log/snort -c /etc/snort/snort.conf | + | [root@centos7 ~]# openvasmd |
| + | User created with password ' | ||
| + | |||
| + | [root@centos7 ~]# openvasmd --user=fenestros --new-password=fenestros | ||
| + | </ | ||
| + | |||
| + | Exécutez encore une fois la commande **openvas-check-setup** : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# openvas-check-setup | ||
| + | ... | ||
| + | Step 2: Checking OpenVAS Manager ... | ||
| + | OK: OpenVAS Manager is present in version 6.0.9. | ||
| + | OK: OpenVAS Manager client certificate is present as / | ||
| + | OK: OpenVAS Manager database found in /var/lib/openvas/mgr/tasks.db. | ||
| + | OK: Access rights for the OpenVAS Manager database are correct. | ||
| + | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. | ||
| + | OK: OpenVAS Manager database is at revision 146. | ||
| + | OK: OpenVAS Manager expects database at revision 146. | ||
| + | OK: Database schema is up to date. | ||
| + | OK: OpenVAS Manager database contains information about 45654 NVTs. | ||
| + | OK: At least one user exists. | ||
| + | ERROR: No OpenVAS SCAP database found. (Tried: | ||
| + | FIX: Run a SCAP synchronization script like openvas-scapdata-sync or greenbone-scapdata-sync. | ||
| + | |||
| + | | ||
| ... | ... | ||
| - | [root@centos7 ~]# ^C | ||
| </ | </ | ||
| - | ===Journalisation=== | + | <WRAP center round important 50%> |
| + | **Important** - Notez l' | ||
| + | </ | ||
| - | Constatez | + | La prochaine étape donc consiste à récupérer la base SCAP (Security Content Automation Protocol). |
| + | |||
| + | Créez | ||
| < | < | ||
| - | [root@centos7 ~]# ls /var/log/snort/ | + | [root@centos7 ~]# vi greenbone-feed-sync |
| - | merged.log snort.log.1501937132 | + | [root@centos7 ~]# cat greenbone-feed-sync |
| + | #!/bin/sh | ||
| + | # Copyright (C) 2011-2020 Greenbone Networks GmbH | ||
| + | # | ||
| + | # SPDX-License-Identifier: | ||
| + | # | ||
| + | # This program is free software: you can redistribute it and/or modify | ||
| + | # it under the terms of the GNU Affero General Public License as | ||
| + | # published by the Free Software Foundation, either version 3 of the | ||
| + | # License, or (at your option) any later version. | ||
| + | # | ||
| + | # This program is distributed in the hope that it will be useful, | ||
| + | # but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| + | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. | ||
| + | # GNU Affero General Public License for more details. | ||
| + | # | ||
| + | # You should have received a copy of the GNU Affero General Public License | ||
| + | # along with this program. | ||
| + | |||
| + | # This script synchronizes a GVM installation with the | ||
| + | # feed data from either the Greenbone Security Feed (in | ||
| + | # case a GSF access key is present) or else from the Greenbone | ||
| + | # Community Feed. | ||
| + | |||
| + | log_notice () { | ||
| + | $LOG_CMD -p daemon.notice " | ||
| + | } | ||
| + | |||
| + | |||
| + | ########## SETTINGS | ||
| + | ########## ======== | ||
| + | |||
| + | # PRIVATE_SUBDIR defines a subdirectory of the feed data directory | ||
| + | # where files not part of the feed or database will not be deleted by rsync. | ||
| + | if [ -z " | ||
| + | then | ||
| + | PRIVATE_SUBDIR=" | ||
| + | fi | ||
| + | |||
| + | # RSYNC_DELETE controls whether files which are not part of the repository will | ||
| + | # be removed from the local directory after synchronization. The default value | ||
| + | # for this setting is | ||
| + | # " | ||
| + | # which means that files which are not part of the feed, feed info or private | ||
| + | # directory will be deleted. | ||
| + | RSYNC_DELETE=" | ||
| + | |||
| + | # RSYNC_SSH_OPTS contains options which should be passed to ssh for the rsync | ||
| + | # connection to the repository. | ||
| + | RSYNC_SSH_OPTS=" | ||
| + | |||
| + | # RSYNC_COMPRESS specifies the compression level to use for the rsync connection. | ||
| + | RSYNC_COMPRESS=" | ||
| + | |||
| + | # PORT controls the outgoing TCP port for updates. If PAT/ | ||
| + | # not used, this should be " | ||
| + | # the value 22 (Standard SSH) is useful. Only change if you know what you are | ||
| + | # doing. | ||
| + | PORT=24 | ||
| + | |||
| + | # SCRIPT_NAME is the name the scripts will use to identify itself and to mark | ||
| + | # log messages. | ||
| + | SCRIPT_NAME=" | ||
| + | |||
| + | # LOG_CMD defines the command to use for logging. To have logger | ||
| + | # as well as syslog, add " | ||
| + | LOG_CMD=" | ||
| + | |||
| + | # LOCK_FILE is the name of the file used to lock the feed during sync or update. | ||
| + | if [ -z " | ||
| + | then | ||
| + | LOCK_FILE=" | ||
| + | fi | ||
| + | |||
| + | |||
| + | ########## GLOBAL VARIABLES | ||
| + | ########## ================ | ||
| + | |||
| + | VERSION=@GVMD_VERSION@ | ||
| + | |||
| + | [ -r " | ||
| + | |||
| + | if [ -z " | ||
| + | DROP_USER=" | ||
| + | fi | ||
| + | |||
| + | ACCESSKEY=" | ||
| + | |||
| + | # Note when running as root or restart as $DROP_USER if defined | ||
| + | if [ $(id -u) -eq 0 ] | ||
| + | then | ||
| + | if [ -z " | ||
| + | then | ||
| + | log_notice " | ||
| + | else | ||
| + | log_notice " | ||
| + | su --shell /bin/sh --command "$0 $*" " | ||
| + | exit $? | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | # Determine whether a GSF access key is present. If yes, | ||
| + | # then use the Greenbone Security Feed. Else use the | ||
| + | # Greenbone Community Feed. | ||
| + | if [ -e $ACCESSKEY ] | ||
| + | then | ||
| + | RESTRICTED=1 | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_VENDOR=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_HOME=" | ||
| + | fi | ||
| + | |||
| + | else | ||
| + | RESTRICTED=0 | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_VENDOR=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | FEED_HOME=" | ||
| + | fi | ||
| + | |||
| + | fi | ||
| + | |||
| + | RSYNC=`command -v rsync` | ||
| + | |||
| + | # Current supported feed types (for --type parameter) | ||
| + | FEED_TYPES_SUPPORTED=" | ||
| + | |||
| + | ########## FUNCTIONS | ||
| + | ########## ========= | ||
| + | |||
| + | log_debug () { | ||
| + | $LOG_CMD -p daemon.debug " | ||
| + | } | ||
| + | |||
| + | log_info () { | ||
| + | $LOG_CMD -p daemon.info " | ||
| + | } | ||
| + | |||
| + | log_warning () { | ||
| + | $LOG_CMD -p daemon.warning " | ||
| + | } | ||
| + | |||
| + | log_err () { | ||
| + | $LOG_CMD -p daemon.err " | ||
| + | } | ||
| + | |||
| + | init_feed_type () { | ||
| + | if [ -z " | ||
| + | then | ||
| + | echo "No feed type given to --type parameter" | ||
| + | log_err "No feed type given to --type parameter" | ||
| + | exit 1 | ||
| + | elif [ " | ||
| + | then | ||
| + | [ -r " | ||
| + | |||
| + | FEED_TYPE_LONG=" | ||
| + | FEED_DIR=" | ||
| + | TIMESTAMP=" | ||
| + | SCRIPT_ID=" | ||
| + | |||
| + | if [ -z " | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | # An alternative syntax which might work if the above doesn' | ||
| + | # COMMUNITY_RSYNC_FEED=" | ||
| + | else | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | fi | ||
| + | |||
| + | GSF_RSYNC_PATH="/ | ||
| + | |||
| + | if [ -e $ACCESSKEY ]; then | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | else | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | fi | ||
| + | elif [ " | ||
| + | then | ||
| + | [ -r " | ||
| + | |||
| + | FEED_TYPE_LONG=" | ||
| + | FEED_DIR=" | ||
| + | TIMESTAMP=" | ||
| + | SCRIPT_ID=" | ||
| + | |||
| + | if [ -z " | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | # An alternative syntax which might work if the above doesn' | ||
| + | # COMMUNITY_RSYNC_FEED=" | ||
| + | else | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | fi | ||
| + | |||
| + | GSF_RSYNC_PATH="/ | ||
| + | |||
| + | if [ -e $ACCESSKEY ]; then | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | else | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | fi | ||
| + | elif [ " | ||
| + | then | ||
| + | [ -r " | ||
| + | |||
| + | FEED_TYPE_LONG=" | ||
| + | FEED_DIR=" | ||
| + | TIMESTAMP=" | ||
| + | SCRIPT_ID=" | ||
| + | |||
| + | if [ -z " | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | # An alternative syntax which might work if the above doesn' | ||
| + | # COMMUNITY_RSYNC_FEED=" | ||
| + | else | ||
| + | COMMUNITY_RSYNC_FEED=" | ||
| + | fi | ||
| + | |||
| + | GSF_RSYNC_PATH="/ | ||
| + | |||
| + | if [ -e $ACCESSKEY ]; then | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | else | ||
| + | if [ -z " | ||
| + | FEED_NAME=" | ||
| + | fi | ||
| + | fi | ||
| + | else | ||
| + | echo " | ||
| + | log_err " | ||
| + | exit 1 | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | write_feed_xml () { | ||
| + | if [ -r $TIMESTAMP ] | ||
| + | then | ||
| + | FEED_VERSION=`cat $TIMESTAMP` | ||
| + | else | ||
| + | FEED_VERSION=0 | ||
| + | fi | ||
| + | |||
| + | mkdir -p $FEED_DIR | ||
| + | echo '< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "< | ||
| + | echo "This script synchronizes a $FEED_TYPE collection with the ' | ||
| + | echo "The ' | ||
| + | echo " | ||
| + | echo "</ | ||
| + | echo "</ | ||
| + | } | ||
| + | |||
| + | create_tmp_key () { | ||
| + | KEYTEMPDIR=`mktemp -d` | ||
| + | cp " | ||
| + | TMPACCESSKEY=" | ||
| + | chmod 400 " | ||
| + | } | ||
| + | |||
| + | remove_tmp_key () { | ||
| + | rm -rf " | ||
| + | } | ||
| + | |||
| + | set_interrupt_trap () { | ||
| + | trap " | ||
| + | } | ||
| + | |||
| + | handle_interrupt () { | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | do_describe () { | ||
| + | echo "This script synchronizes a $FEED_TYPE collection with the ' | ||
| + | echo "The ' | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | do_feedversion () { | ||
| + | if [ -r $TIMESTAMP ]; then | ||
| + | cat $TIMESTAMP | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | # This function uses gos-state-manager to get information about the settings. | ||
| + | # gos-state-manager is only available on a Greenbone OS. | ||
| + | # If gos-state-manager is missing the settings values can not be retrieved. | ||
| + | # | ||
| + | # Input: option | ||
| + | # Output: value as string or empty String if gos-state-manager is not installed | ||
| + | # or option not set | ||
| + | get_value () | ||
| + | { | ||
| + | value="" | ||
| + | key=$1 | ||
| + | if which gos-state-manager 1>/ | ||
| + | then | ||
| + | if gos-state-manager get " | ||
| + | then | ||
| + | value=" | ||
| + | fi | ||
| + | fi | ||
| + | echo " | ||
| + | } | ||
| + | |||
| + | is_feed_current () { | ||
| + | if [ -r $TIMESTAMP ] | ||
| + | then | ||
| + | FEED_VERSION=`cat $TIMESTAMP` | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | log_warning "Could not determine feed version." | ||
| + | FEED_CURRENT=0 | ||
| + | return $FEED_CURRENT | ||
| + | fi | ||
| + | |||
| + | FEED_INFO_TEMP_DIR=`mktemp -d` | ||
| + | |||
| + | if [ -e $ACCESSKEY ] | ||
| + | then | ||
| + | read feeduser < $ACCESSKEY | ||
| + | custid_at_host=`head -1 $ACCESSKEY | cut -d : -f 1` | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | log_err "Could not determine credentials, | ||
| + | rm -rf " | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | gsmproxy=$(get_value proxy_feed | sed -r -e ' | ||
| + | syncport=$(get_value syncport) | ||
| + | if [ " | ||
| + | then | ||
| + | PORT=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | RSYNC_SSH_PROXY_CMD="" | ||
| + | else | ||
| + | if [ -e $GVM_SYSCONF_DIR/ | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | else | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | fi | ||
| + | fi | ||
| + | create_tmp_key | ||
| + | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $TMPACCESSKEY" | ||
| + | if [ $? -ne 0 ] | ||
| + | then | ||
| + | log_err "rsync failed, aborting synchronization." | ||
| + | rm -rf " | ||
| + | remove_tmp_key | ||
| + | exit 1 | ||
| + | fi | ||
| + | remove_tmp_key | ||
| + | else | ||
| + | # Sleep for five seconds (a previous feed might have been synced a few seconds before) to prevent | ||
| + | # IP blocking due to network equipment in between keeping the previous connection too long open. | ||
| + | sleep 5 | ||
| + | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | ||
| + | eval " | ||
| + | if [ $? -ne 0 ] | ||
| + | then | ||
| + | log_err "rsync failed, aborting synchronization." | ||
| + | rm -rf " | ||
| + | exit 1 | ||
| + | fi | ||
| + | fi | ||
| + | |||
| + | FEED_VERSION_SERVER=`cat " | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | log_err "Could not determine server feed version." | ||
| + | rm -rf " | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | # Check against FEED_VERSION | ||
| + | if [ $FEED_VERSION -lt $FEED_VERSION_SERVER ]; then | ||
| + | FEED_CURRENT=0 | ||
| + | else | ||
| + | FEED_CURRENT=1 | ||
| + | fi | ||
| + | |||
| + | # Cleanup | ||
| + | rm -rf " | ||
| + | |||
| + | return $FEED_CURRENT | ||
| + | } | ||
| + | |||
| + | do_help () { | ||
| + | echo "$0: Sync feed data" | ||
| + | |||
| + | if [ -e $ACCESSKEY ] | ||
| + | then | ||
| + | echo "GSF access key found: Using Greenbone Security Feed" | ||
| + | else | ||
| + | echo "No GSF access key found: Using Community Feed" | ||
| + | fi | ||
| + | |||
| + | echo " --describe | ||
| + | echo " --feedversion | ||
| + | echo " --help | ||
| + | echo " --identify | ||
| + | echo " --selftest | ||
| + | echo " --type < | ||
| + | echo " --version | ||
| + | echo "" | ||
| + | exit 0 | ||
| + | } | ||
| + | |||
| + | do_rsync_community_feed () { | ||
| + | if [ -z " | ||
| + | log_err "rsync not found!" | ||
| + | else | ||
| + | # Sleep for five seconds (after is_feed_current) to prevent IP blocking due to | ||
| + | # network equipment in between keeping the previous connection too long open. | ||
| + | sleep 5 | ||
| + | log_notice "Using rsync: $RSYNC" | ||
| + | log_notice " | ||
| + | mkdir -p " | ||
| + | eval " | ||
| + | if [ $? -ne 0 ]; then | ||
| + | log_err "rsync failed. Your $FEED_TYPE_LONG might be broken now." | ||
| + | exit 1 | ||
| + | fi | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | do_sync_community_feed () { | ||
| + | if [ -z " | ||
| + | log_err "rsync not found!" | ||
| + | log_err "No utility available in PATH environment variable to download Feed data" | ||
| + | exit 1 | ||
| + | else | ||
| + | log_notice "Will use rsync" | ||
| + | do_rsync_community_feed | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | sync_feed_data(){ | ||
| + | if [ -e $ACCESSKEY ] | ||
| + | then | ||
| + | log_notice "Found Greenbone Security Feed subscription file, trying to synchronize with Greenbone $FEED_TYPE_LONG Repository ..." | ||
| + | notsynced=1 | ||
| + | |||
| + | mkdir -p " | ||
| + | read feeduser < $ACCESSKEY | ||
| + | custid_at_host=`head -1 $ACCESSKEY | cut -d : -f 1` | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | log_err "Could not determine credentials, | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | while [ 0 -ne " | ||
| + | do | ||
| + | |||
| + | gsmproxy=$(get_value proxy_feed | sed -r -e ' | ||
| + | syncport=$(get_value syncport) | ||
| + | if [ " | ||
| + | then | ||
| + | PORT=" | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | RSYNC_SSH_PROXY_CMD="" | ||
| + | else | ||
| + | if [ -e $GVM_SYSCONF_DIR/ | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | else | ||
| + | RSYNC_SSH_PROXY_CMD=" | ||
| + | fi | ||
| + | fi | ||
| + | create_tmp_key | ||
| + | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $ACCESSKEY" | ||
| + | if [ 0 -ne " | ||
| + | log_err "rsync failed, aborting synchronization." | ||
| + | remove_tmp_key | ||
| + | exit 1 | ||
| + | fi | ||
| + | remove_tmp_key | ||
| + | notsynced=0 | ||
| + | done | ||
| + | log_notice " | ||
| + | else | ||
| + | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | ||
| + | do_sync_community_feed | ||
| + | fi | ||
| + | |||
| + | write_feed_xml | ||
| + | } | ||
| + | |||
| + | do_self_test () { | ||
| + | if [ -z " | ||
| + | then | ||
| + | SELFTEST_STDERR=0 | ||
| + | fi | ||
| + | |||
| + | if [ -z " | ||
| + | then | ||
| + | if [ 0 -ne $SELFTEST_STDERR ] | ||
| + | then | ||
| + | echo "rsync not found (required)." | ||
| + | fi | ||
| + | log_err "rsync not found (required)." | ||
| + | SELFTEST_FAIL=1 | ||
| + | fi | ||
| + | } | ||
| + | |||
| + | |||
| + | ########## START | ||
| + | ########## ===== | ||
| + | |||
| + | while test $# -gt 0; do | ||
| + | case " | ||
| + | " | ||
| + | if [ -z " | ||
| + | ACTION=" | ||
| + | fi | ||
| + | ;; | ||
| + | " | ||
| + | do_help | ||
| + | exit 0 | ||
| + | ;; | ||
| + | " | ||
| + | FEED_TYPE=$(echo " | ||
| + | shift | ||
| + | ;; | ||
| + | esac | ||
| + | shift | ||
| + | done | ||
| + | |||
| + | init_feed_type | ||
| + | |||
| + | write_feed_xml | ||
| + | |||
| + | case " | ||
| + | --version) | ||
| + | echo $VERSION | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --identify) | ||
| + | echo " | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --describe) | ||
| + | do_describe | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --feedversion) | ||
| + | do_feedversion | ||
| + | exit 0 | ||
| + | ;; | ||
| + | --selftest) | ||
| + | SELFTEST_FAIL=0 | ||
| + | SELFTEST_STDERR=1 | ||
| + | do_self_test | ||
| + | exit $SELFTEST_FAIL | ||
| + | ;; | ||
| + | --feedcurrent) | ||
| + | is_feed_current | ||
| + | exit $? | ||
| + | ;; | ||
| + | esac | ||
| + | |||
| + | SELFTEST_FAIL=0 | ||
| + | do_self_test | ||
| + | if [ $SELFTEST_FAIL -ne 0 ] | ||
| + | then | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | is_feed_current | ||
| + | if [ $FEED_CURRENT -eq 1 ] | ||
| + | then | ||
| + | log_notice "Feed is already current, skipping synchronization." | ||
| + | exit 0 | ||
| + | fi | ||
| + | ( | ||
| + | chmod +660 $LOCK_FILE | ||
| + | flock -n 9 | ||
| + | if [ $? -eq 1 ]; then | ||
| + | log_notice "Sync in progress, exiting." | ||
| + | exit 1 | ||
| + | fi | ||
| + | date > $LOCK_FILE | ||
| + | sync_feed_data | ||
| + | echo -n > $LOCK_FILE | ||
| + | ) 9>> | ||
| + | |||
| + | exit 0 | ||
| </ | </ | ||
| - | Constatez | + | Rendez |
| < | < | ||
| - | [root@centos7 ~]# tail / | + | [root@centos7 ~]# chmod +x greenbone-feed-sync |
| - | + | </code> | |
| - | ����; | + | |
| - | + | ||
| - | �Ҡ��3��; | + | |
| - | + | ||
| - | ����; | + | |
| - | ������]l�S�����W�h���օYO<' | + | |
| - | + | ||
| - | ����_��������օY���RT5' | + | |
| - | + | ||
| - | �Ҡ����_P�����G}& | + | |
| + | Déplacez le script vers **/ | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# mv greenbone-feed-sync /usr/sbin/ | ||
| </ | </ | ||
| - | Ce fichier étant au format | + | Créez le répertoire |
| < | < | ||
| - | [root@centos7 ~]# snort -r /var/log/snort/snort.log.1501943548 | more | + | [root@centos7 ~]# mkdir /var/lib/openvas/ |
| </ | </ | ||
| - | Notez que ce fichier peut aussi être lu par la commande **tcpdump** | + | Devenez l' |
| < | < | ||
| - | [root@centos7 ~]# tcpdump | + | [root@centos7 ~]# su - trainee |
| - | reading from file /var/log/snort/snort.log.1501943548, | + | Last login: Mon Dec 1 17:30:45 CET 2025 on pts/0 |
| - | 16:32:28.316281 IP 15.2.0.10.rev.sfr.net.ssh > 2.2.0.10.rev.sfr.net.48338: Flags [P.], seq 2695230935: | + | |
| - | 40, length 676 | + | [trainee@centos7 ~]$ touch /var/lib/openvas/scap-data/ |
| - | 16:32:28.316485 IP 2.2.0.10.rev.sfr.net.48338 > 15.2.0.10.rev.sfr.net.ssh: | + | |
| - | 16: | + | [trainee@centos7 ~]$ greenbone-feed-sync --type SCAP |
| - | 16: | + | Greenbone community feed server - http://feed.community.greenbone.net/ |
| - | 16:32:28.318799 IP 15.2.0.10.rev.sfr.net.ssh > 2.2.0.10.rev.sfr.net.48338: Flags [P.], seq 768:860, ack 1, win 53440, length 92 | + | This service is hosted by Greenbone Networks - http://www.greenbone.net/ |
| - | 16: | + | |
| - | 16:32:28.319081 IP 15.2.0.10.rev.sfr.net.ssh > 2.2.0.10.rev.sfr.net.48338: Flags [P.], seq 860:952, ack 1, win 53440, length 92 | + | All transactions are logged. |
| - | 16: | + | |
| - | 16:32:28.319278 IP 15.2.0.10.rev.sfr.net.ssh > 2.2.0.10.rev.sfr.net.48338: Flags [P.], seq 952:1044, ack 1, win 53440, length 92 | + | If you have any questions, please use the Greenbone community portal. |
| - | 16: | + | See https://community.greenbone.net for details. |
| - | 16:32:28.319457 IP 15.2.0.10.rev.sfr.net.ssh > 2.2.0.10.rev.sfr.net.48338: Flags [P.], seq 1044:1136, ack 1, win 53440, length 92 | + | |
| - | 16: | + | By using this service you agree to our terms and conditions. |
| - | 16:32:28.319624 IP 15.2.0.10.rev.sfr.net.ssh > 2.2.0.10.rev.sfr.net.48338: Flags [P.], seq 1136:1228, ack 1, win 53440, length 92 | + | |
| - | 16: | + | Only one sync per time, otherwise the source ip will be temporarily blocked. |
| - | 16:32:28.319787 IP 15.2.0.10.rev.sfr.net.ssh > 2.2.0.10.rev.sfr.net.48338: Flags [P.], seq 1228:1320, ack 1, win 53440, length 92 | + | |
| - | 16:32:28.319972 IP 2.2.0.10.rev.sfr.net.48338 > 15.2.0.10.rev.sfr.net.ssh: | + | |
| - | 16:32:28.320041 IP 15.2.0.10.rev.sfr.net.ssh > 2.2.0.10.rev.sfr.net.48338: Flags [P.], seq 1320:1412, ack 1, win 53440, length 92 | + | receiving incremental file list |
| - | 16: | + | timestamp |
| - | 16:32:28.320240 IP 15.2.0.10.rev.sfr.net.ssh > 2.2.0.10.rev.sfr.net.48338: Flags [P.], seq 1412:1504, ack 1, win 53440, length 92 | + | 13 100% 12.70kB/ |
| - | 16: | + | |
| - | 16:32:28.320451 IP 15.2.0.10.rev.sfr.net.ssh > 2.2.0.10.rev.sfr.net.48338: Flags [P.], seq 1504:1596, ack 1, win 53440, length 92 | + | sent 43 bytes received 108 bytes 100.67 bytes/sec |
| - | 16: | + | total size is 13 speedup is 0.09 |
| - | 16:32:28.320659 IP 15.2.0.10.rev.sfr.net.ssh > 2.2.0.10.rev.sfr.net.48338: Flags [P.], seq 1596:1688, ack 1, win 53440, length 92 | + | Greenbone community feed server - http://feed.community.greenbone.net/ |
| - | 16: | + | This service is hosted by Greenbone Networks - http://www.greenbone.net/ |
| - | 16:32:28.320869 IP 15.2.0.10.rev.sfr.net.ssh > 2.2.0.10.rev.sfr.net.48338: Flags [P.], seq 1688:1780, ack 1, win 53440, length 92 | + | |
| - | 16: | + | All transactions are logged. |
| - | 16:32:28.321047 IP 15.2.0.10.rev.sfr.net.ssh > 2.2.0.10.rev.sfr.net.48338: Flags [P.], seq 1780:1872, ack 1, win 53440, length 92 | + | |
| - | 16: | + | If you have any questions, please use the Greenbone community portal. |
| - | 16:32:28.321232 IP 15.2.0.10.rev.sfr.net.ssh > 2.2.0.10.rev.sfr.net.48338: Flags [P.], seq 1872:1964, ack 1, win 53440, length 92 | + | See https://community.greenbone.net for details. |
| - | 16:32:28.321355 IP 2.2.0.10.rev.sfr.net.48338 > 15.2.0.10.rev.sfr.net.ssh: | + | |
| - | 16: | + | By using this service you agree to our terms and conditions. |
| - | 16: | + | |
| - | 16: | + | Only one sync per time, otherwise the source ip will be temporarily blocked. |
| - | 16: | + | |
| - | --More-- | + | |
| + | receiving incremental file list | ||
| + | ./ | ||
| + | COPYING | ||
| + | 1,187 100% 1.13MB/ | ||
| + | nvdcve-2.0-2002.xml | ||
| + | 19,533,351 100% | ||
| + | nvdcve-2.0-2003.xml | ||
| + | 4,744,330 100% 13.55MB/ | ||
| + | nvdcve-2.0-2004.xml | ||
| + | 9,416,639 100% | ||
| + | nvdcve-2.0-2005.xml | ||
| + | | ||
| + | nvdcve-2.0-2006.xml | ||
| + | 26,320,892 100% | ||
| + | nvdcve-2.0-2007.xml | ||
| + | | ||
| + | nvdcve-2.0-2008.xml | ||
| + | 29,775,037 100% | ||
| + | nvdcve-2.0-2009.xml | ||
| + | | ||
| + | nvdcve-2.0-2010.xml | ||
| + | 42,684,286 100% | ||
| + | nvdcve-2.0-2011.xml | ||
| + | | ||
| + | nvdcve-2.0-2012.xml | ||
| + | 66,859,075 100% 152.18MB/ | ||
| + | nvdcve-2.0-2013.xml | ||
| + | | ||
| + | nvdcve-2.0-2014.xml | ||
| + | 98,694,839 100% | ||
| + | nvdcve-2.0-2015.xml | ||
| + | 124,671,234 100% 227.33MB/ | ||
| + | nvdcve-2.0-2016.xml | ||
| + | 161,692,009 100% 172.29MB/ | ||
| + | nvdcve-2.0-2017.xml | ||
| + | 189,948,654 100% 141.52MB/ | ||
| + | nvdcve-2.0-2018.xml | ||
| + | 210,761,959 100% 156.30MB/ | ||
| + | nvdcve-2.0-2019.xml | ||
| + | 265,685,784 100% 172.95MB/ | ||
| + | nvdcve-2.0-2020.xml | ||
| + | 294,835,369 100% 134.53MB/ | ||
| + | nvdcve-2.0-2021.xml | ||
| + | 442,673,740 100% 155.72MB/ | ||
| + | nvdcve-2.0-2022.xml | ||
| + | 743,192,055 100% 111.53MB/ | ||
| + | nvdcve-2.0-2023.xml | ||
| + | 599,785,077 100% 67.83MB/ | ||
| + | nvdcve-2.0-2024.xml | ||
| + | 922,757,332 100% | ||
| + | nvdcve-2.0-2025.xml | ||
| + | 480,360,705 100% 127.96MB/ | ||
| + | official-cpe-dictionary_v2.2.xml | ||
| + | 784,852,577 100% 251.59MB/ | ||
| + | timestamp | ||
| + | 13 100% 12.70kB/ | ||
| + | |||
| + | sent 2,186,887 bytes received 11,127,079 bytes 117,303.67 bytes/sec | ||
| + | total size is 5,773,481,175 speedup is 433.64 | ||
| + | |||
| + | [trainee@centos7 ~]$ greenbone-scapdata-sync | ||
| + | [trainee@centos7 ~]$ exit | ||
| </ | </ | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Vous pouvez utiliser le logiciel Wireshark pour visulaiser le contenu du fichier en mode graphique. | + | **Important** - En cas d' |
| </ | </ | ||
| - | Dernièrement, | + | Exécutez |
| - | | + | < |
| + | [root@centos7 ~]# openvas-check-setup | ||
| + | ... | ||
| + | Step 2: Checking OpenVAS Manager ... | ||
| + | OK: OpenVAS Manager is present in version 6.0.9. | ||
| + | OK: OpenVAS Manager client certificate is present as / | ||
| + | OK: OpenVAS Manager database found in /var/lib/openvas/ | ||
| + | OK: Access rights for the OpenVAS Manager database are correct. | ||
| + | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. | ||
| + | OK: OpenVAS Manager database is at revision 146. | ||
| + | OK: OpenVAS Manager expects database at revision 146. | ||
| + | OK: Database schema is up to date. | ||
| + | OK: OpenVAS Manager database contains information about 45654 NVTs. | ||
| + | OK: At least one user exists. | ||
| + | OK: OpenVAS SCAP database found in / | ||
| + | ERROR: No OpenVAS CERT database found. (Tried: / | ||
| + | FIX: Run a CERT synchronization script like openvas-certdata-sync or greenbone-certdata-sync. | ||
| + | |||
| + | | ||
| + | ... | ||
| + | </code> | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Notez l'utilisation des options suivantes : **-l** indique le fichier de journalisation**, | + | **Important** - Notez l'erreur |
| </ | </ | ||
| - | Pour lancer snort en arrière plan afin de surveiller l' | + | Créez le fichier |
| < | < | ||
| - | [root@centos7 ~]# / | + | [root@centos7 ~]# touch /var/lib/openvas/cert-data/cert.db |
| - | [1] 19281 | + | |
| - | [root@centos7 ~]# Spawning daemon child... | + | |
| - | My daemon child 19401 lives... | + | |
| - | Daemon parent exiting (0) | + | |
| - | ^C | + | |
| - | [1]+ Done | + | |
| - | [root@centos7 ~]# ps aux | grep snort | + | |
| - | snort 19401 0.0 24.6 850984 504544 ? | + | |
| - | root | + | |
| </ | </ | ||
| - | Pour arrêter ce processus, utilisez al commande **kill**: | + | Exécutez la commande **openvas-certdata-sync** : |
| < | < | ||
| - | [root@centos7 ~]# ps aux | grep snort | + | [root@centos7 ~]# openvas-certdata-sync |
| - | snort 19401 0.0 24.6 850984 504692 ? | + | |
| - | root | + | |
| - | [root@centos7 ~]# kill 19401 | + | |
| - | [root@centos7 ~]# ps aux | grep snort | + | |
| - | root | + | |
| </ | </ | ||
| - | ====LAB #3 - Mise en place du Système de Détection et de Prévention d' | + | Exécutez encore une fois la commande **openvas-check-setup** : |
| - | Portsentry est un **S**ystème de **D**étection et de **Prévention** d' | + | < |
| + | [root@centos7 ~]# openvas-check-setup | ||
| + | openvas-check-setup 2.3.3 | ||
| + | Test completeness and readiness of OpenVAS-8 | ||
| + | | ||
| + | if you want to check for another OpenVAS version) | ||
| - | === Installation === | + | Please report us any non-detected problems and |
| + | help us to improve this check routine: | ||
| + | http:// | ||
| - | Sous RHEL/CentOS 7, **portsentry** n'est pas installé par défaut. Qui plus est **portsentry** ne se trouve pas dans les dépôts standards. Installez donc le paquet **portsentry-1.2-1.el5.x86_64.rpm** à partir de l'URL ci-dessous : | + | Send us the log-file (/tmp/openvas-check-setup.log) to help analyze the problem. |
| - | < | + | Use the parameter |
| - | [root@centos7 ~]# rpm -ivh https:// | + | |
| - | Loaded plugins: fastestmirror, | + | |
| - | portsentry-1.2-1.el5.x86_64.rpm | + | |
| - | Examining / | + | |
| - | Marking / | + | |
| - | Resolving Dependencies | + | |
| - | --> Running transaction check | + | |
| - | ---> Package portsentry.x86_64 0:1.2-1.el5 will be installed | + | |
| - | --> Finished Dependency Resolution | + | |
| - | adobe-linux-x86_64 | + | |
| - | base/ | + | |
| - | extras/ | + | |
| - | updates/ | + | |
| - | Dependencies Resolved | + | Step 1: Checking OpenVAS Scanner ... |
| + | OK: OpenVAS Scanner is present in version 5.0.6. | ||
| + | OK: OpenVAS Scanner CA Certificate is present as / | ||
| + | OK: redis-server is present in version v=3.2.12. | ||
| + | OK: scanner (kb_location setting) is configured properly using the redis-server socket: / | ||
| + | OK: redis-server is running and listening on socket: / | ||
| + | OK: redis-server configuration is OK and redis-server is running. | ||
| + | OK: NVT collection in / | ||
| + | WARNING: Signature checking of NVTs is not enabled in OpenVAS Scanner. | ||
| + | SUGGEST: Enable signature checking (see http:// | ||
| + | OK: The NVT cache in / | ||
| + | Step 2: Checking OpenVAS Manager ... | ||
| + | OK: OpenVAS Manager is present in version 6.0.9. | ||
| + | OK: OpenVAS Manager client certificate is present as / | ||
| + | OK: OpenVAS Manager database found in / | ||
| + | OK: Access rights for the OpenVAS Manager database are correct. | ||
| + | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. | ||
| + | OK: OpenVAS Manager database is at revision 146. | ||
| + | OK: OpenVAS Manager expects database at revision 146. | ||
| + | OK: Database schema is up to date. | ||
| + | OK: OpenVAS Manager database contains information about 138097 NVTs. | ||
| + | OK: At least one user exists. | ||
| + | OK: OpenVAS SCAP database found in / | ||
| + | OK: OpenVAS CERT database found in / | ||
| + | OK: xsltproc found. | ||
| + | Step 3: Checking user configuration ... | ||
| + | WARNING: Your password policy is empty. | ||
| + | SUGGEST: Edit the / | ||
| + | Step 4: Checking Greenbone Security Assistant (GSA) ... | ||
| + | OK: Greenbone Security Assistant is present in version 6.0.11. | ||
| + | Step 5: Checking OpenVAS CLI ... | ||
| + | OK: OpenVAS CLI version 1.4.4. | ||
| + | Step 6: Checking Greenbone Security Desktop (GSD) ... | ||
| + | SKIP: Skipping check for Greenbone Security Desktop. | ||
| + | Step 7: Checking if OpenVAS services are up and running ... | ||
| + | OK: netstat found, extended checks of the OpenVAS services enabled. | ||
| + | OK: OpenVAS Scanner is running and listening on all interfaces. | ||
| + | OK: OpenVAS Scanner is listening on port 9391, which is the default port. | ||
| + | ERROR: OpenVAS Manager is NOT running! | ||
| + | FIX: Start OpenVAS Manager (openvasmd). | ||
| + | ERROR: Greenbone Security Assistant is NOT running! | ||
| + | FIX: Start Greenbone Security Assistant (gsad). | ||
| - | ======================================================================================================================================= | + | ERROR: Your OpenVAS-8 installation is not yet complete! |
| - | | + | |
| - | ======================================================================================================================================= | + | |
| - | Installing: | + | |
| - | | + | |
| - | Transaction Summary | + | Please follow the instructions marked with FIX above and run this |
| - | ======================================================================================================================================= | + | script again. |
| - | Install | + | |
| - | Total size: 114 k | + | If you think this result is wrong, please report your observation |
| - | Installed size: 114 k | + | and help us to improve this check routine: |
| - | Is this ok [y/d/N]: y | + | http:// |
| + | Please attach the log-file (/ | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Notez l' | ||
| + | </ | ||
| + | |||
| + | Activer et démarrer OpenVAS Manager : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# systemctl enable openvas-manager | ||
| + | Created symlink from /etc/systemd/ | ||
| + | |||
| + | [root@centos7 ~]# systemctl start openvas-manager | ||
| + | |||
| + | [root@centos7 ~]# systemctl status openvas-manager | ||
| + | ● openvas-manager.service - OpenVAS Manager | ||
| + | | ||
| + | | ||
| + | Process: 12237 ExecStart=/ | ||
| + | Main PID: 12238 (openvasmd) | ||
| + | | ||
| + | | ||
| + | Dec 02 11:51:41 centos7.fenestros.loc systemd[1]: Starting OpenVAS Manager... | ||
| + | Dec 02 11:51:41 centos7.fenestros.loc systemd[1]: Started OpenVAS Manager. | ||
| </ | </ | ||
| - | ===Configuration=== | + | Activer et démarrer le Greenbone Security Assistant : |
| - | Modifiez le fichier **/etc/portsentry/portsentry.conf** en ajoutant | + | < |
| + | [root@centos7 ~]# systemctl enable openvas-gsa | ||
| + | Created symlink from /etc/systemd/system/ | ||
| + | |||
| + | [root@centos7 ~]# systemctl start openvas-gsa | ||
| + | |||
| + | [root@centos7 ~]# systemctl status openvas-gsa | ||
| + | ● openvas-gsa.service - OpenVAS Greenbone Security Assistant | ||
| + | | ||
| + | | ||
| + | Process: 12948 ExecStart=/ | ||
| + | Main PID: 12949 (gsad) | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Dec 02 11:53:08 centos7.fenestros.loc systemd[1]: Starting OpenVAS Greenbone Security Assistant... | ||
| + | Dec 02 11:53:08 centos7.fenestros.loc systemd[1]: Started OpenVAS Greenbone Security Assistant. | ||
| + | </ | ||
| + | |||
| + | Exécutez encore une fois la commande | ||
| < | < | ||
| - | [root@centos7 ~]# nl / | + | [root@centos7 ~]# openvas-check-setup |
| - | 1 # PortSentry Configuration | + | openvas-check-setup |
| - | 2 # | + | Test completeness and readiness |
| - | 3 # $Id: portsentry.conf,v 1.25 2003/05/23 16:15:39 crowland Exp crowland $ | + | (add '--v6' |
| - | 4 # | + | |
| - | 5 # IMPORTANT NOTE: You CAN NOT put spaces between your port arguments. | + | |
| - | 6 # | + | |
| - | 7 # The default ports will catch a large number | + | help us to improve |
| - | 8 # | + | |
| - | 9 # All entries must be in quotes. | + | |
| - | + | Send us the log-file (/ | |
| - | + | ||
| - | 10 ####################### | + | Use the parameter --server |
| - | 11 # Port Configurations # | + | like GSD and OpenVAS-CLI. |
| - | 12 ####################### | + | |
| - | 13 # | + | Step 1: Checking OpenVAS Scanner ... |
| - | 14 # | + | OK: OpenVAS Scanner is present |
| - | 15 # Some example port configs for classic and basic Stealth modes | + | OK: OpenVAS Scanner CA Certificate is present as /etc/pki/openvas/ |
| - | 16 # | + | OK: redis-server is present in version v=3.2.12. |
| - | 17 # I like to always keep some ports at the " | + | OK: scanner |
| - | 18 # This will detect a sequential port sweep really quickly and usually | + | OK: redis-server is running and listening |
| - | 19 # these ports are not in use (i.e. tcpmux port 1) | + | OK: redis-server configuration |
| - | 20 # | + | OK: NVT collection in / |
| - | 21 # ** X-Windows Users **: If you are running X on your box, you need to be sure | + | |
| - | 22 # you are not binding PortSentry to port 6000 (or port 2000 for OpenWindows users). | + | |
| - | 23 # Doing so will prevent the X-client from starting properly. | + | |
| - | 24 # | + | Step 2: Checking OpenVAS Manager |
| - | 25 # These port bindings are *ignored* for Advanced Stealth Scan Detection Mode. | + | OK: OpenVAS Manager is present in version 6.0.9. |
| - | 26 # | + | OK: OpenVAS Manager client certificate is present as / |
| - | + | OK: OpenVAS Manager database found in / | |
| - | 27 # Un-comment these if you are really anal: | + | OK: Access rights for the OpenVAS Manager database are correct. |
| - | | + | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. |
| - | 29 # | + | OK: OpenVAS Manager database |
| - | 30 # | + | OK: OpenVAS Manager expects database at revision 146. |
| - | 31 # Use these if you just want to be aware: | + | OK: Database schema is up to date. |
| - | | + | OK: OpenVAS Manager database contains information about 138097 NVTs. |
| - | | + | OK: At least one user exists. |
| - | 34 # | + | OK: OpenVAS SCAP database found in /var/lib/ |
| - | 35 # Use these for just bare-bones | + | OK: OpenVAS CERT database found in /var/lib/openvas/cert-data/cert.db. |
| - | | + | OK: xsltproc found. |
| - | 37 # | + | Step 3: Checking user configuration ... |
| - | + | | |
| - | 38 ########################################### | + | |
| - | 39 # Advanced Stealth Scan Detection Options # | + | Step 4: Checking Greenbone Security Assistant (GSA) ... |
| - | 40 ########################################### | + | OK: Greenbone Security Assistant is present in version 6.0.11. |
| - | 41 # | + | Step 5: Checking OpenVAS CLI ... |
| - | 42 # This is the number of ports you want PortSentry | + | OK: OpenVAS CLI version 1.4.4. |
| - | 43 # Any port *below* | + | Step 6: Checking Greenbone Security Desktop |
| - | 44 # everything below 1024. | + | SKIP: Skipping check for Greenbone Security Desktop. |
| - | 45 # | + | Step 7: Checking if OpenVAS services are up and running |
| - | 46 # On many Linux systems you cannot bind above port 61000. This is because | + | OK: netstat found, extended checks of the OpenVAS services enabled. |
| - | 47 # these ports are used as part of IP masquerading. I don't recommend you | + | OK: OpenVAS Scanner is running and listening on all interfaces. |
| - | 48 # bind over this number of ports. Realistically: | + | OK: OpenVAS Scanner is listening on port 9391, which is the default port. |
| - | 49 # OVER 1024 PORTS AS YOUR FALSE ALARM RATE WILL ALMOST CERTAINLY RISE. You've been | + | OK: OpenVAS Manager is running and listening on all interfaces. |
| - | 50 # warned! Don't write me if you have have a problem because I'll only tell | + | OK: OpenVAS Manager is listening on port 9390, which is the default port. |
| - | 51 # you to RTFM and don't run above the first 1024 ports. | + | OK: Greenbone Security Assistant is listening |
| - | 52 # | + | Step 8: Checking nmap installation ... |
| - | | + | |
| - | 54 ADVANCED_PORTS_TCP=" | + | |
| - | 55 ADVANCED_PORTS_UDP=" | + | Step 10: Checking presence |
| - | 56 # | + | |
| - | 57 # This field tells PortSentry what ports (besides listening daemons) | + | |
| - | 58 # ignore. This is helpful for services | + | OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely |
| - | 59 # as FTP, SMTP, and wrappers look for but you may not run (and probably | + | OK: rpm found, LSC credential package generation |
| - | 60 # *shouldn' | + | |
| - | 61 # | + | |
| - | 62 # By specifying ports here PortSentry will simply not respond to | + | |
| - | 63 # incoming requests, | + | |
| - | 64 # actual bound daemons. The default ports are ones reported as | + | OK: SELinux is disabled. |
| - | 65 # problematic false alarms and should probably be left alone for | + | |
| - | 66 # all but the most isolated systems/ | + | It seems like your OpenVAS-8 installation |
| - | 67 # | + | |
| - | 68 # Default TCP ident and NetBIOS service | + | If you think it is not OK, please report your observation |
| - | 69 ADVANCED_EXCLUDE_TCP=" | + | and help us to improve this check routine: |
| - | 70 # Default UDP route (RIP), NetBIOS, bootp broadcasts. | + | http://lists.wald.intevation.org/mailman/listinfo/openvas-discuss |
| - | | + | Please attach the log-file (/tmp/openvas-check-setup.log) to help us analyze |
| - | + | ||
| - | + | ||
| - | 72 ###################### | + | |
| - | 73 # Configuration Files# | + | |
| - | 74 ###################### | + | |
| - | 75 # | + | |
| - | 76 # Hosts to ignore | + | |
| - | 77 IGNORE_FILE=" | + | |
| - | 78 # Hosts that have been denied (running history) | + | |
| - | 79 HISTORY_FILE="/ | + | |
| - | 80 # Hosts that have been denied this session only (temporary until next restart) | + | |
| - | 81 BLOCKED_FILE=" | + | |
| - | + | ||
| - | 82 ############################## | + | |
| - | 83 # Misc. Configuration Options# | + | |
| - | 84 ############################## | + | |
| - | 85 # | + | |
| - | 86 # DNS Name resolution | + | |
| - | 87 # for attacking hosts. Setting it to " | + | |
| - | 88 # it off. | + | |
| - | | + | |
| - | + | ||
| - | 90 ################### | + | |
| - | 91 # Response Options# | + | |
| - | 92 ################### | + | |
| - | 93 # Options to dispose of attacker. Each is an action that will | + | |
| - | 94 # be run if an attack | + | |
| - | 95 # option then comment it out and it will be skipped. | + | |
| - | | + | |
| - | 97 # The variable $TARGET$ will be substituted with the target attacking | + | |
| - | 98 # host when an attack | + | |
| - | 99 # with the port that was scanned. | + | |
| - | | + | |
| - | | + | |
| - | 102 # Ignore Options # | + | |
| - | | + | |
| - | 104 # These options allow you to enable automatic response | + | |
| - | 105 # options for UDP/TCP. This is useful if you just want | + | |
| - | 106 # warnings for connections, | + | |
| - | 107 # a particular protocol (i.e. you want to block TCP, but | + | |
| - | 108 # not UDP). To prevent a possible Denial of service attack | + | |
| - | 109 # against UDP and stealth scan detection for TCP, you may | + | |
| - | 110 # want to disable blocking, but leave the warning enabled. | + | |
| - | 111 # I personally would wait for this to become a problem before | + | |
| - | 112 # doing though as most attackers really aren't doing this. | + | |
| - | | + | |
| - | | + | |
| - | 115 # but not drop the route. This may be useful for some admins | + | |
| - | 116 # who want to block TCP, but only want pager/e-mail warnings | + | |
| - | 117 # on UDP, etc. | + | |
| - | | + | |
| - | 119 # | + | |
| - | 120 # 0 = Do not block UDP/TCP scans. | + | |
| - | 121 # 1 = Block UDP/TCP scans. | + | |
| - | 122 # 2 = Run external command only (KILL_RUN_CMD) | + | |
| - | + | ||
| - | | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | 126 # Dropping Routes:# | + | |
| - | | + | |
| - | 128 # This command is used to drop the route or add the host into | + | |
| - | 129 # a local filter table. | + | |
| - | | + | |
| - | 131 # The gateway (333.444.555.666) should ideally be a dead host on | + | |
| - | 132 # the *local* subnet. On some hosts you can also point this at | + | |
| - | 133 # localhost (127.0.0.1) and get the same effect. NOTE THAT | + | |
| - | 134 # 333.444.555.66 WILL *NOT* WORK. YOU NEED TO CHANGE IT!! | + | |
| - | 135 # | + | |
| - | 136 # ALL KILL ROUTE OPTIONS ARE COMMENTED OUT INITIALLY. Make sure you | + | |
| - | 137 # uncomment | + | |
| - | 138 # here and you have a route drop command that works then please | + | |
| - | 139 # mail it to me so I can include it. ONLY ONE KILL_ROUTE OPTION | + | |
| - | 140 # CAN BE USED AT A TIME SO DON'T UNCOMMENT MULTIPLE LINES. | + | |
| - | 141 # | + | |
| - | 142 # NOTE: The route commands are the least optimal way of blocking | + | |
| - | 143 # and do not provide complete protection against UDP attacks and | + | |
| - | 144 # will still generate alarms for both UDP and stealth scans. I | + | |
| - | 145 # always recommend you use a packet filter because they are made | + | |
| - | 146 # for this purpose. | + | |
| - | | + | |
| - | + | ||
| - | 148 # Generic | + | |
| - | | + | |
| - | + | ||
| - | 150 # Generic Linux | + | |
| - | | + | |
| - | + | ||
| - | 152 # Newer versions of Linux support the reject flag now. This | + | |
| - | 153 # is cleaner than the above option. | + | |
| - | 154 # | + | |
| - | + | ||
| - | 155 # Generic BSD (BSDI, OpenBSD, NetBSD, FreeBSD) | + | |
| - | | + | |
| - | + | ||
| - | 157 # Generic Sun | + | |
| - | | + | |
| - | + | ||
| - | 159 # NEXTSTEP | + | |
| - | | + | |
| - | + | ||
| - | 161 # FreeBSD | + | |
| - | | + | |
| - | + | ||
| - | 163 # Digital UNIX 4.0D (OSF/1 / Compaq Tru64 UNIX) | + | |
| - | | + | |
| - | + | ||
| - | 165 # Generic HP-UX | + | |
| - | 166 # | + | |
| - | | + | |
| - | 167 ## | + | |
| - | 168 # Using a packet filter | + | |
| - | 169 # work well on many OS's. Remember, you can only uncomment *one* | + | |
| - | 170 # KILL_ROUTE option. | + | |
| - | 171 ## | + | |
| - | + | ||
| - | 172 # ipfwadm support | + | |
| - | | + | |
| - | | + | |
| - | 175 # ipfwadm support for Linux (no logging of denied packets) | + | |
| - | | + | |
| - | | + | |
| - | 178 # ipchain support for Linux | + | |
| - | | + | |
| - | | + | |
| - | 181 # ipchain support for Linux (no logging of denied packets) | + | |
| - | 182 # | + | |
| - | | + | |
| - | 184 # iptables support for Linux | + | |
| - | | + | |
| - | + | ||
| - | 186 # For those of you running FreeBSD (and compatible) you can | + | |
| - | 187 # use their built in firewalling as well. | + | |
| - | | + | |
| - | | + | |
| - | 190 # | + | |
| - | | + | |
| - | 192 # For those running ipfilt (OpenBSD, etc.) | + | |
| - | 193 # NOTE THAT YOU NEED TO CHANGE external_interface TO A VALID INTERFACE!! | + | |
| - | 194 # | + | |
| - | | + | |
| - | + | ||
| - | + | ||
| - | | + | |
| - | 197 # TCP Wrappers# | + | |
| - | | + | |
| - | 199 # This text will be dropped into the hosts.deny file for wrappers | + | |
| - | | + | |
| - | 201 # | + | |
| - | 202 # Format One: Old Style - The default when extended host processing | + | |
| - | 203 # options are not enabled. | + | |
| - | 204 # | + | |
| - | | + | |
| - | + | ||
| - | 206 # Format Two: New Style - The format used when extended option | + | |
| - | 207 # processing is enabled. You can drop in extended processing | + | |
| - | 208 # options, but be sure you escape all ' | + | |
| - | 209 # to prevent problems writing out (i.e. \%c \%h ) | + | |
| - | 210 # | + | |
| - | | + | |
| - | | + | |
| - | 212 ################### | + | |
| - | 213 # External Command# | + | |
| - | | + | |
| - | 215 # This is a command that is run when a host connects, it can be whatever | + | |
| - | 216 # you want it to be (pager, etc.). This command is executed before the | + | |
| - | 217 # route is dropped or after depending on the KILL_RUN_CMD_FIRST option below | + | |
| - | 218 # | + | |
| - | | + | |
| - | 220 # I NEVER RECOMMEND YOU PUT IN RETALIATORY ACTIONS AGAINST THE HOST SCANNING | + | |
| - | 221 # YOU! | + | |
| - | | + | |
| - | 223 # TCP/IP is an *unauthenticated protocol* and people can make scans appear out | + | |
| - | 224 # of thin air. The only time it is reasonably safe (and I *never* | + | |
| - | 225 # reasonable) to run reverse probe scripts is when using the " | + | |
| - | 226 # This mode requires a full connect | + | |
| - | 227 # | + | |
| - | 228 # The KILL_RUN_CMD_FIRST value should be set to " | + | |
| - | 229 # to run *before* the blocking occurs and should be set to " | + | |
| - | 230 # command run *after* the blocking has occurred. | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | 237 KILL_RUN_CMD="/ | + | |
| - | + | ||
| - | + | ||
| - | | + | |
| - | 239 # Scan trigger value# | + | |
| - | | + | |
| - | 241 # Enter in the number of port connects you will allow before an | + | |
| - | 242 # alarm is given. The default is 0 which will react immediately. | + | |
| - | 243 # A value of 1 or 2 will reduce false alarms. Anything higher is | + | |
| - | 244 # probably not necessary. This value must always be specified, but | + | |
| - | 245 # generally can be left at 0. | + | |
| - | | + | |
| - | 247 # NOTE: If you are using the advanced detection option you need to | + | |
| - | 248 # be careful that you don't make a hair trigger situation. Because | + | |
| - | 249 # Advanced mode will react for *any* host connecting to a non-used | + | |
| - | 250 # below your specified range, you have the opportunity to really | + | |
| - | 251 # break things. (i.e someone innocently tries to connect to you via | + | |
| - | 252 # SSL [TCP port 443] and you immediately block them). Some of you | + | |
| - | 253 # may even want this though. Just be careful. | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | 257 # Port Banner Section# | + | |
| - | | + | |
| - | | + | |
| - | 260 # Enter text in here you want displayed | + | |
| - | 261 # I *don' | + | |
| - | 262 # Leave this commented out to disable the feature | + | |
| - | | + | |
| - | 264 # Stealth scan detection modes don't use this feature | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | 267 # EOF | + | |
| </ | </ | ||
| - | Pour rendre le service SysVInit compatible avec Systemd, éditez le fichier | + | <WRAP center round important 50%> |
| + | **Important** - Notez les WARNINGS. | ||
| + | </WRAP> | ||
| + | |||
| + | Installez les paquets suggérés | ||
| < | < | ||
| - | [root@centos7 ~]# nl / | + | [root@centos7 ~]# yum install nmap texlive-latex-bin-bin alien -y |
| - | | + | |
| - | 2 # | + | |
| - | 3 # Startup script for the Portsentry portscan detector | + | |
| - | 4 # | + | |
| - | 5 # chkconfig: 345 98 02 | + | |
| - | 6 # description: | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | 10 # processname: | + | |
| - | 11 # pidfile: / | + | |
| - | 12 # config: / | + | |
| - | + | ||
| - | 13 # Source function library. | + | |
| - | ... | + | |
| </ | </ | ||
| - | Puis ajoutez | + | Exécutez de nouveau |
| < | < | ||
| + | [root@centos7 ~]# openvas-check-setup | ||
| ... | ... | ||
| - | 77 stop() { | + | Step 10: Checking presence of optional tools ... |
| - | | + | OK: pdflatex found. |
| - | | + | |
| - | | + | |
| - | | + | OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work. |
| - | | + | OK: rpm found, LSC credential package generation for RPM based targets is likely to work. |
| - | 83 [ $RETVAL -eq 0 ] && rm -f / | + | OK: alien found, LSC credential package generation for DEB based targets is likely to work. |
| - | 84 } | + | |
| - | | + | |
| - | 85 # See how we were called. | + | OK: SELinux is disabled. |
| + | |||
| + | It seems like your OpenVAS-8 installation is OK. | ||
| ... | ... | ||
| </ | </ | ||
| - | Dernièrement, | + | <WRAP center round important 50%> |
| + | **Important** - Notez la ligne **WARNING: PDF generation failed, most likely due to missing LaTeX packages. The PDF report format will not work.** | ||
| + | </ | ||
| + | |||
| + | Pour pouvoir utiliser les rapports au format PDF, installez les paquets suivants | ||
| < | < | ||
| - | [root@centos7 ~]# yum install -y initscripts | + | [root@centos7 ~]# yum -y install |
| </ | </ | ||
| - | ===Utilisation=== | + | Téléchargez ensuite |
| - | + | ||
| - | Démarrez | + | |
| < | < | ||
| - | [root@centos7 ~]# systemctl start portsentry | + | [root@centos7 ~]# mkdir -p /usr/share/texlive/texmf-local/tex/latex/comment |
| - | [root@centos7 ~]# systemctl status portsentry | + | |
| - | ● portsentry.service | + | |
| - | | + | |
| - | | + | |
| - | Docs: man: | + | |
| - | Process: 6487 ExecStart=/etc/rc.d/init.d/ | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | [root@centos7 ~]# cd /usr/share/texlive/ |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Hint: Some lines were ellipsized, use -l to show in full. | + | |
| - | [root@centos7 ~]# ps aux | grep portsentry | + | |
| - | root 6511 0.0 0.0 | + | |
| - | root 6513 0.0 0.0 | + | |
| - | root 6687 0.0 0.0 114692 | + | |
| - | </code> | + | |
| - | Editez le fichier **/etc/portsentry/portsentry.ignore** en commentant la ligne contenant votre adresse IP : | + | [root@centos7 comment]# wget http://mirrors.ctan.org/macros/ |
| + | --2025-12-02 13:35: | ||
| + | Resolving mirrors.ctan.org (mirrors.ctan.org)... 89.58.7.101, | ||
| + | Connecting to mirrors.ctan.org (mirrors.ctan.org)|89.58.7.101|: | ||
| + | HTTP request sent, awaiting response... 307 Temporary Redirect | ||
| + | Location: https:// | ||
| + | --2025-12-02 13: | ||
| + | Resolving mirror.its.dal.ca (mirror.its.dal.ca)... 192.75.96.254 | ||
| + | Connecting to mirror.its.dal.ca (mirror.its.dal.ca)|192.75.96.254|: | ||
| + | HTTP request sent, awaiting response... 200 OK | ||
| + | Length: 10197 (10.0K) [application/ | ||
| + | Saving to: ‘comment.sty’ | ||
| - | <code> | + | 100%[========================================================================================================================================================================>] 10,197 --.-K/s in 0s |
| - | [root@centos7 ~]# nl / | + | |
| - | 1 # Put hosts in here you never want blocked. This includes the IP addresses | + | 2025-12-02 13:35:43 (175 MB/s) - ‘comment.sty’ saved [10197/10197] |
| - | 2 # of all local interfaces on the protected host (i.e virtual host, mult-home) | + | |
| - | 3 # Keep 127.0.0.1 and 0.0.0.0 to keep people from playing games. | + | [root@centos7 comment]# chmod 644 comment.sty |
| - | 4 # | + | |
| - | 5 # PortSentry can support full netmasks for networks as well. Format is: | + | [root@centos7 comment]# texhash |
| - | 6 # | + | texhash: Updating |
| - | 7 # <IP Address>/< | + | texhash: Updating / |
| - | 8 # | + | texhash: Updating / |
| - | 9 # Example: | + | texhash: Updating / |
| - | 10 # | + | texhash: Updating / |
| - | 11 # 192.168.2.0/24 | + | texhash: Done |
| - | 12 # 192.168.0.0/16 | + | |
| - | 13 # 192.168.2.1/ | + | |
| - | 14 # Etc. | + | |
| - | 15 # | + | |
| - | 16 # If you don't supply a netmask it is assumed to be 32 bits. | + | |
| - | | + | |
| - | 18 # | + | |
| - | + | ||
| - | 19 127.0.0.1/32 | + | |
| - | 20 0.0.0.0 | + | |
| - | | + | |
| - | 22 # Do NOT edit below this line, if you # | + | |
| - | 23 # do, your changes will be lost when # | + | |
| - | 24 # portsentry is restarted via the # | + | |
| - | 25 # initscript. Make all changes above # | + | |
| - | 26 # this box. # | + | |
| - | 27 ######################################### | + | |
| - | + | ||
| - | 28 # Exclude all local interfaces | + | |
| - | 29 # | + | |
| - | 30 fe80:: | + | |
| - | 31 127.0.0.1 | + | |
| - | 32 ::1 | + | |
| - | + | ||
| - | 33 # Exclude the default gateway(s) | + | |
| - | 34 10.0.2.2 | + | |
| - | + | ||
| - | 35 # Exclude the nameservers | + | |
| - | 36 10.0.2.3 | + | |
| - | + | ||
| - | 37 # And last but not least... | + | |
| - | | + | |
| </ | </ | ||
| - | **Sans** re-démarrez le service portsentry, lancez un scan des ports avec nmap : | + | Exécutez une dernière fois la commande |
| < | < | ||
| - | [root@centos7 | + | [root@centos7 |
| + | ... | ||
| + | Step 10: Checking presence of optional tools ... | ||
| + | OK: pdflatex found. | ||
| + | OK: PDF generation successful. The PDF report format is likely to work. | ||
| + | OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work. | ||
| + | OK: rpm found, LSC credential package generation for RPM based targets is likely to work. | ||
| + | OK: alien found, LSC credential package generation for DEB based targets is likely to work. | ||
| + | WARNING: Could not find makensis binary, LSC credential package generation for Microsoft Windows targets will not work. | ||
| + | SUGGEST: Install nsis. | ||
| + | OK: SELinux is disabled. | ||
| - | Starting Nmap 6.40 ( http:// | + | It seems like your OpenVAS-8 installation is OK. |
| - | ^C | + | ... |
| - | You have new mail in / | + | |
| </ | </ | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Notez l' | + | **Important** - Notez la ligne **WARNING: Could not find makensis binary, LSC credential package generation for Microsoft Windows targets will not work.** |
| </ | </ | ||
| - | Consultez les règles d' | + | Téléchargez et installez le fichier **mingw32-nsis-3.01-1.el7.x86_64.rpm** |
| < | < | ||
| - | [root@centos7 ~]# iptables -L | + | [root@centos7 ~]# cd ~ |
| - | Chain INPUT (policy ACCEPT) | + | |
| - | target | + | |
| - | DROP | + | |
| - | ACCEPT | + | |
| - | ACCEPT | + | |
| - | INPUT_direct | + | |
| - | INPUT_ZONES_SOURCE | + | |
| - | INPUT_ZONES | + | |
| - | DROP | + | |
| - | REJECT | + | |
| - | ... | + | |
| - | </ | + | |
| - | Dernièrement, | + | [root@centos7 ~]# wget ftp:// |
| + | --2025-12-02 13: | ||
| + | => ‘mingw32-nsis-3.01-1.el7.x86_64.rpm’ | ||
| + | Resolving ftp.icm.edu.pl (ftp.icm.edu.pl)... 193.219.28.2, | ||
| + | Connecting to ftp.icm.edu.pl (ftp.icm.edu.pl)|193.219.28.2|: | ||
| + | Logging in as anonymous ... Logged in! | ||
| + | ==> SYST ... done. ==> PWD ... done. | ||
| + | ==> TYPE I ... done. ==> CWD (1) / | ||
| + | ==> SIZE mingw32-nsis-3.01-1.el7.x86_64.rpm ... 1379180 | ||
| + | ==> PASV ... done. ==> RETR mingw32-nsis-3.01-1.el7.x86_64.rpm ... done. | ||
| + | Length: 1379180 (1.3M) (unauthoritative) | ||
| - | < | + | 100%[========================================================================================================================================================================>] 1, |
| - | [root@centos7 ~]# mail | + | |
| - | Heirloom Mail version 12.5 7/ | + | |
| - | "/ | + | |
| - | >N | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | & 6 | + | |
| - | Message | + | |
| - | From root@centos7.fenestros.loc | + | |
| - | Return-Path: | + | |
| - | X-Original-To: | + | |
| - | Delivered-To: | + | |
| - | Date: Sun, 06 Aug 2017 14:52:43 +0200 | + | |
| - | To: root@localhost.fenestros.loc | + | |
| - | Subject: Portscan from 10.0.2.15 on port 143 | + | |
| - | User-Agent: Heirloom mailx 12.5 7/5/10 | + | |
| - | Content-Type: | + | |
| - | From: root@centos7.fenestros.loc (root) | + | |
| - | Status: R | + | |
| + | 2025-12-02 13:46:28 (2.05 MB/s) - ‘mingw32-nsis-3.01-1.el7.x86_64.rpm’ saved [1379180] | ||
| - | & q | + | [root@centos7 ~]# yum localinstall mingw32-nsis-3.01-1.el7.x86_64.rpm --nogpgcheck -y |
| - | Held 6 messages in / | + | |
| - | You have mail in / | + | |
| - | [root@centos7 ~]# | + | |
| </ | </ | ||
| - | Pour nettoyer | + | Exécutez une dernière fois la commande |
| < | < | ||
| - | [root@centos7 ~]# systemctl restart firewalld | + | [root@centos7 ~]# openvas-check-setup |
| - | [root@centos7 ~]# iptables | + | ... |
| - | Chain INPUT (policy ACCEPT) | + | Step 10: Checking presence of optional tools ... |
| - | target | + | OK: pdflatex found. |
| - | ACCEPT | + | OK: PDF generation successful. The PDF report format is likely to work. |
| - | ACCEPT | + | OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work. |
| - | INPUT_direct | + | OK: rpm found, LSC credential package generation for RPM based targets is likely to work. |
| - | INPUT_ZONES_SOURCE | + | OK: alien found, LSC credential package generation for DEB based targets is likely to work. |
| - | INPUT_ZONES | + | OK: nsis found, LSC credential package generation for Microsoft Windows targets is likely to work. |
| - | DROP | + | OK: SELinux is disabled. |
| - | REJECT | + | |
| + | It seems like your OpenVAS-8 installation is OK. | ||
| ... | ... | ||
| </ | </ | ||
| + | |||
| + | ===2.5 - Utilisation=== | ||
| + | |||
| + | Retournez à l' | ||
| + | |||
| + | Ouvrez un navigateur web dans la VM et saississez l' | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Créez une exception pour le Self Signed Certificate. Vous obtiendrez une fenêtre similaire à celle-ci: | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Entrez le nom de votre utilisateur (fenestros) ainsi que son mot de passe (fenestros) et cliquez sur le bouton **Login**. Vous obtiendrez une fenêtre similaire à celle-ci : | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Dans la boîte **Quick start**, entrez l' | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Vous pouvez indiquer un réseau entier de la forme 10.0.2.0/24 | ||
| + | </ | ||
| + | |||
| + | ===Analyse des Résultats=== | ||
| + | |||
| + | A l'issu de l' | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | ainsi que les détails de celui-ci : | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Vous trouverez aussi une **solution** ainsi qu'une évaluation du niveau de risque, **Risk factor**. | ||
| + | |||
| + | {{ : | ||
| + | {{ : | ||
| + | |||
| + | =====Les Contres-Mesures===== | ||
| + | |||
| + | |||
| + | |||
| + | |||
| ----- | ----- | ||
| Copyright © 2025 Hugh Norris. | Copyright © 2025 Hugh Norris. | ||
| + | |||
