Différences
Ci-dessous, les différences entre deux révisions de la page.
| Prochaine révision | Révision précédente | ||
| elearning:workbooks:debian:11:sec:l108 [2025/12/02 13:10] – créée admin | elearning:workbooks:debian:11:sec:l108 [2025/12/04 09:31] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| + | |||
| + | OPENVPN | ||
| Version : **2026.01** | Version : **2026.01** | ||
| Ligne 5: | Ligne 7: | ||
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LRF408 | + | ======LDF408 |
| - | =====Contenu du Module===== | + | =====Contenu du module===== |
| - | * **LRF408 | + | * **LDF408 |
| - | * Contenu du Module | + | * Contenu du module |
| * Le Problématique | * Le Problématique | ||
| - | | + | * LAB #1 - Utilisation de tcpdump |
| - | * Les Outils | + | * 1.1 - Utilisation |
| - | | + | * L' |
| - | * 1.1 - Installation | + | |
| - | * 1.2 - Utilisation | + | * L' |
| - | * 1.3 - Avertissement important | + | * L' |
| - | * LAB #2 - Greenbone Vulnerability Management (GVM) | + | * L' |
| - | * 2.1 - Présentation | + | |
| - | * 2.2 - Préparation | + | * Les Contre-Mesures |
| - | * 2.3 - Installation | + | |
| - | * 2.4 - Configuration | + | * Définitions |
| - | * 2.5 - Utilisation | + | * Algorithmes à clé secrète |
| - | * 2.6 - Analyse | + | * Le Chiffrement Symétrique |
| - | * Les Contres-Mesures | + | * Algorithmes à clef publique |
| - | * LAB #3 - La commande chroot | + | * Le Chiffrement Asymétrique |
| + | * La Clef de Session | ||
| + | * Fonctions de Hachage | ||
| + | * Signature Numérique | ||
| + | * PKI | ||
| + | * Certificats X509 | ||
| + | | ||
| + | * 2.1 - Présentation | ||
| + | * 2.2 - Installation | ||
| + | * 2.3 - Utilisation | ||
| + | * Signer un message | ||
| + | * Chiffrer un message | ||
| + | * LAB #3 - Mise en place de SSH et SCP | ||
| + | * 3.1 - Introduction | ||
| + | * SSH-1 | ||
| + | * SSH-2 | ||
| + | * L' | ||
| + | * L' | ||
| + | * 3.2 - Configuration du Serveur | ||
| + | * 3.3 - Utilisation | ||
| + | * 3.4 - Mise en place des clefs | ||
| + | * 3.5 - Tunnels SSH | ||
| + | | ||
| + | * Introduction | ||
| + | * Utilisation | ||
| + | | ||
| + | * Présentation | ||
| + | * Configuration commune au client et au serveur | ||
| + | * Configuration du client | ||
| + | * Configuration du serveur | ||
| + | * Tests | ||
| + | * Du client vers le serveur | ||
| + | * Du serveur vers le client | ||
| =====Le Problématique===== | =====Le Problématique===== | ||
| - | La plupart | + | Le **sniffing** |
| - | =====Préparation===== | + | * Telnet, |
| + | * Rlogin, | ||
| + | * Ftp, | ||
| + | * Pop3. | ||
| - | =====Les Outils===== | + | Un // |
| - | ==== LAB #1 - Netwox ==== | + | * Tcpdump. |
| - | Le programme **netwox** est un utilitaire puissant | + | =====LAB #1 - Utilisation |
| - | ===1.1 - Installation=== | + | Le logiciel **tcpdump** sert à écouter le réseau en interceptant les paquets. |
| - | Netwox s' | + | ===1.1 - Utilisation=== |
| - | < | + | Installez **tcpdump** |
| - | root@debian12:~# cd /tmp | + | |
| - | + | ||
| - | root@debian12:/ | + | |
| - | + | ||
| - | root@debian12: | + | |
| - | </ | + | |
| - | + | ||
| - | ===1.2 - Utilisation=== | + | |
| < | < | ||
| - | root@debian12: | + | root@debian12: |
| - | Netwox toolbox version 5.39.0. Netwib library version 5.39.0. | + | |
| - | + | ||
| - | ######################## | + | |
| - | 0 - leave netwox | + | |
| - | 3 - search tools | + | |
| - | 4 - display help of one tool | + | |
| - | 5 - run a tool selecting parameters on command line | + | |
| - | 6 - run a tool selecting parameters from keyboard | + | |
| - | a + information | + | |
| - | b + network protocol | + | |
| - | c + application protocol | + | |
| - | d + sniff (capture network packets) | + | |
| - | e + spoof (create and send packets) | + | |
| - | f + record (file containing captured packets) | + | |
| - | g + client | + | |
| - | h + server | + | |
| - | i + ping (check if a computer if reachable) | + | |
| - | j + traceroute (obtain list of gateways) | + | |
| - | k + scan (computer and port discovery) | + | |
| - | l + network audit | + | |
| - | m + brute force (check if passwords are weak) | + | |
| - | n + remote administration | + | |
| - | o + tools not related to network | + | |
| - | Select a node (key in 03456abcdefghijklmno): | + | |
| </ | </ | ||
| - | L'utilisation de **netwox** en mode interactif se fait a l'aide des menus proposés. Dans notre cas, nous souhaitons utiliser un des outils de la section **network audit**. Il convient donc de choisir le menu **l** : | + | ==L'option -i== |
| - | < | + | Pour écouter sur une **interface spécifique**, |
| - | Select a node (key in 03456abcdefghijklmno): | + | |
| - | + | ||
| - | ###################### | + | |
| - | 0 - leave netwox | + | |
| - | 1 - go to main menu | + | |
| - | 2 - go to previous menu | + | |
| - | 3 - search tools | + | |
| - | 4 - display help of one tool | + | |
| - | 5 - run a tool selecting parameters on command line | + | |
| - | 6 - run a tool selecting parameters from keyboard | + | |
| - | a + network audit using Ethernet | + | |
| - | b + network audit using IP | + | |
| - | c + network audit using TCP | + | |
| - | d + network audit using ICMP | + | |
| - | e + network audit using ARP | + | |
| - | Select a node (key in 0123456abcde): | + | |
| - | </ | + | |
| - | + | ||
| - | Choisissez ensuite le menu **c** : | + | |
| < | < | ||
| - | Select a node (key in 0123456abcde): c | + | root@debian12:~# tcpdump |
| - | + | tcpdump: verbose output suppressed, use -v[v]... for full protocol decode | |
| - | ################# | + | listening on ens18, link-type EN10MB (Ethernet), snapshot length 262144 bytes |
| - | | + | 17: |
| - | | + | 17: |
| - | 2 - go to previous menu | + | 17: |
| - | 3 - search tools | + | 17:29: |
| - | 4 - display help of one tool | + | 17: |
| - | 5 - run a tool selecting parameters on command line | + | 17:29: |
| - | 6 - run a tool selecting parameters from keyboard | + | 17:29: |
| - | a - 76:Synflood | + | 17:29: |
| - | b - 77:Check if seqnum are predictible | + | 17: |
| - | c - 78:Reset every TCP packet | + | 17:29: |
| - | d - 79:Acknowledge every TCP SYN | + | 10 packets captured |
| - | Select a node (key in 0123456abcd): | + | 14 packets received by filter |
| + | 0 packets dropped by kernel | ||
| </ | </ | ||
| - | Notre choix de test s'arrête sur un test du type **Synflood** sur un de nos serveurs internes. Nous choisissons donc le menu **a** : | + | Notez qu'à la fin, un résumé vous est présenté, par exemple |
| < | < | ||
| - | Select a node (key in 0123456abcd): | + | ... |
| - | + | 10 packets captured | |
| - | ################# | + | 14 packets received by filter |
| - | Title: Synflood | + | 0 packets dropped by kernel |
| - | +------------------------------------------------------------------------+ | + | |
| - | | This tool sends a lot of TCP SYN packets. | | + | |
| - | | It permits to check how a firewall behaves when receiving packets | + | |
| - | | which have to be ignored. | | + | |
| - | | Parameter --spoofip indicates how to generate link layer for spoofing. | | + | |
| - | | Values ' | + | |
| - | | is the list of accepted values: | + | |
| - | | - ' | + | |
| - | | a firewall is installed, or on some systems, this might not work. | | + | |
| - | | - ' | + | |
| - | | supported). The ' | + | |
| - | | However, if source IP address is spoofed, it might be impossible | + | |
| - | | to Fill it. So, linkf will not work: use linkb or linkfb instead. | + | |
| - | | - ' | + | |
| - | | source Ethernet address (0:0:0:0:0:0, do not try to Fill it). | | + | |
| - | | - ' | + | |
| - | | source Ethernet address, but if it is not possible, it is left | | + | |
| - | | Blank. | + | |
| - | | - ' | + | |
| - | | - ' | + | |
| - | | - ' | + | |
| - | | - ' | + | |
| - | | - ' | + | |
| - | | - ' | + | |
| - | | - ' | + | |
| - | | - ' | + | |
| - | | - ' | + | |
| - | | - ' | + | |
| - | | | | + | |
| - | | This tool may need to be run with admin privilege in order to spoof. | + | |
| - | +------------------------------------------------------------------------+ | + | |
| - | Usage: netwox 76 -i ip -p port [-s spoofip] | + | |
| - | Parameters: | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Example: netwox 76 -i " | + | |
| - | Example: netwox 76 --dst-ip " | + | |
| - | Press ' | + | |
| </ | </ | ||
| - | Il convient ensuite d'appuyer sur la touche [r] ou [k] pour lancer l' | + | <WRAP center round important> |
| + | **Important** : L'option **-c** limite le nombre de paquets capturés. | ||
| + | </ | ||
| - | Il est a noter que **netwox** | + | ==L' |
| - | # netwox 76 -i " | + | Pour écouter |
| - | + | ||
| - | ===1.3 - Avertissement important=== | + | |
| - | + | ||
| - | **netwox** est un outil puissant. Il convient de noter que: | + | |
| - | + | ||
| - | * il ne doit pas être installé sur un serveur de production mais sur le poste de l' | + | |
| - | * netwox existe aussi en version Windows(tm), | + | |
| - | * l' | + | |
| - | + | ||
| - | ====LAB #2 - Greenbone Vulnerability Management (GVM)==== | + | |
| - | + | ||
| - | ===2.1 - Présentation=== | + | |
| - | + | ||
| - | **Greenbone Vulnerability Management (GVM)**, aussi connu sous le nom d' | + | |
| - | + | ||
| - | ===2.2 | + | |
| - | + | ||
| - | Mettez SELinux en mode permissive et désactivez-le dans le fichier **/ | + | |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# tcpdump -i ens18 -x -c 3 |
| - | + | tcpdump: verbose output suppressed, use -v[v]... for full protocol decode | |
| - | [root@centos7 ~]# sed -i ' | + | listening on ens18, link-type EN10MB (Ethernet), snapshot length 262144 bytes |
| - | + | 17: | |
| - | [root@centos7 ~]# reboot | + | |
| + | 0x0010: | ||
| + | 0x0020: | ||
| + | 0x0030: | ||
| + | 0x0040: | ||
| + | 0x0050: | ||
| + | 0x0060: | ||
| + | 0x0070: | ||
| + | 0x0080: | ||
| + | 0x0090: | ||
| + | 0x00a0: | ||
| + | 0x00b0: | ||
| + | 0x00c0: | ||
| + | 0x00d0: | ||
| + | 0x00e0: | ||
| + | 17: | ||
| + | 0x0000: | ||
| + | 0x0010: | ||
| + | 0x0020: | ||
| + | 0x0030: | ||
| + | 17: | ||
| + | 0x0000: | ||
| + | 0x0010: | ||
| + | 0x0020: | ||
| + | 0x0030: | ||
| + | 0x0040: | ||
| + | 3 packets captured | ||
| + | 10 packets received by filter | ||
| + | 0 packets dropped by kernel | ||
| </ | </ | ||
| - | Insérez une règle dans le pare-feu pour permettre la consultation de l'interface HTML du client OpenVAS : | + | ==L'option -X== |
| - | < | + | Pour écouter sur une interface spécifique et voir le contenu en Hexadécimal et en ASCII, utilisez les options |
| - | [root@centos7 ~]# firewall-cmd --zone=public --add-port=9443/ | + | |
| - | success | + | |
| - | [root@centos7 ~]# firewall-cmd --reload | + | |
| - | success | + | |
| - | </ | + | |
| - | + | ||
| - | ===2.3 - Installation=== | + | |
| - | + | ||
| - | Téléchargez | + | |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# tcpdump |
| - | --2025-12-01 15:29:01-- https://archives.fedoraproject.org/pub/ | + | tcpdump: verbose output suppressed, use -v[v]... for full protocol decode |
| - | Resolving archives.fedoraproject.org (archives.fedoraproject.org)... 38.145.32.23, 38.145.32.22, 38.145.32.24 | + | listening on ens18, link-type EN10MB (Ethernet), snapshot length 262144 bytes |
| - | Connecting to archives.fedoraproject.org (archives.fedoraproject.org)|38.145.32.23|:443... connected. | + | 13:07: |
| - | HTTP request sent, awaiting response... 200 OK | + | 0x0000: |
| - | Length: 15608 (15K) [application/ | + | 0x0010: 0a00 0201 0016 a50c 0720 87e1 e32f 2d9d ............./-. |
| - | Saving to: ‘epel-release-7-14.noarch.rpm’ | + | 0x0020: |
| - | + | | |
| - | 100%[========================================================================================================================================================================>] 15,608 --.-K/s in 0.03s | + | 0x0040: |
| - | + | | |
| - | 2025-12-01 15:29:01 (532 KB/s) - ‘epel-release-7-14.noarch.rpm’ saved [15608/15608] | + | 0x0060: 17d1 afa8 dbb3 1d59 122a 3e9d e4be 07f7 .......Y.*> |
| - | + | | |
| - | [root@centos7 ~]# yum localinstall epel-release-7-14.noarch.rpm --nogpgcheck | + | |
| + | 0x0090: | ||
| + | 0x00a0: | ||
| + | | ||
| + | | ||
| + | | ||
| + | 0x00e0: | ||
| + | 13: | ||
| + | 0x0000: | ||
| + | 0x0010: | ||
| + | 0x0020: | ||
| + | | ||
| + | 13:07:33.008324 IP 10.0.2.46.47533 > dns.google.domain: | ||
| + | 0x0000: | ||
| + | 0x0010: | ||
| + | | ||
| + | | ||
| + | 0x0040: | ||
| + | 3 packets captured | ||
| + | 10 packets received by filter | ||
| + | 0 packets dropped by kernel | ||
| </ | </ | ||
| - | Installez ensuite **openvas-scanner**, **openvas-manager**, | + | ==L' |
| - | < | + | Pour écouter sur une interface spécifique et envoyer la sortie dans un fichier, utilisez les options |
| - | [root@centos7 ~]# yum install openvas-scanner openvas-manager openvas-gsa openvas-cli coreutils openssl | + | |
| - | </ | + | |
| - | + | ||
| - | ===2.4 - Configuration=== | + | |
| - | + | ||
| - | Les commandes d' | + | |
| < | < | ||
| - | [root@centos7 ~]# ls -l / | + | root@debian12:~# tcpdump |
| - | -rwxr-xr-x. 1 root root 18066 Sep 6 2016 / | + | tcpdump: listening on ens18, link-type EN10MB |
| - | -rwxr-xr-x. 1 root root 2182496 Sep 6 2016 / | + | ^C42 packets captured |
| - | -rwxr-xr-x. 1 root root 37993 Sep 6 2016 / | + | 45 packets received by filter |
| - | -rwxr-xr-x. 1 root root 11998 Sep 6 2016 / | + | 0 packets dropped by kernel |
| - | -rwxr-xr-x. 1 root root 10976 Sep 6 2016 / | + | |
| - | -rwxr-xr-x. 1 root root 766 Sep 6 2016 / | + | |
| - | -rwxr-xr-x. 1 root root 2555 Sep 6 2016 / | + | |
| - | -rwxr-xr-x. 1 root root 38378 Sep 6 2016 / | + | |
| - | -rwxr-xr-x. 1 root root 86640 Sep 6 2016 / | + | |
| - | </ | + | |
| - | + | ||
| - | * **/ | + | |
| - | * Cette commande permet de générer un certificat SSL, | + | |
| - | * **/ | + | |
| - | * Cette commande permet la mise à jour des modules d' | + | |
| - | * **/ | + | |
| - | * Cette commande lance le serveur OpenVAS. | + | |
| - | + | ||
| - | Exécutez maintenant la commande **openvas-check-setup** | + | |
| - | + | ||
| - | < | + | |
| - | [root@centos7 | + | |
| - | openvas-check-setup 2.3.3 | + | |
| - | Test completeness and readiness of OpenVAS-8 | + | |
| - | (add ' | + | |
| - | if you want to check for another OpenVAS version) | + | |
| - | + | ||
| - | Please report us any non-detected problems and | + | |
| - | help us to improve this check routine: | + | |
| - | http:// | + | |
| - | + | ||
| - | Send us the log-file (/ | + | |
| - | + | ||
| - | Use the parameter --server to skip checks for client tools | + | |
| - | like GSD and OpenVAS-CLI. | + | |
| - | + | ||
| - | Step 1: Checking OpenVAS Scanner ... | + | |
| - | OK: OpenVAS Scanner is present in version 5.0.6. | + | |
| - | ERROR: No CA certificate file of OpenVAS Scanner found. | + | |
| - | FIX: Run ' | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | Please follow the instructions marked with FIX above and run this | + | |
| - | script again. | + | |
| - | If you think this result is wrong, please report your observation | + | root@debian12:~# ls -l log.dump |
| - | and help us to improve this check routine: | + | -rw-r--r-- 1 tcpdump tcpdump 25555 Nov 28 13:11 log.dump |
| - | http:// | + | |
| - | Please attach the log-file (/ | + | |
| </ | </ | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Notez l'erreur | + | **Important** - Arrêtez la sortie de la commande à l'aide des touches |
| </ | </ | ||
| - | Créez | + | Notez que le fichier log.dump est au format **libpcap** et non au format texte. Il est donc inutile d' |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# file log.dump |
| + | log.dump: pcap capture file, microsecond ts (little-endian) - version 2.4 (Ethernet, capture length 262144) | ||
| + | </ | ||
| - | ------------------------------------------------------------------------------- | + | ==L' |
| - | Creation of the OpenVAS SSL Certificate | + | |
| - | ------------------------------------------------------------------------------- | + | |
| - | This script will now ask you the relevant information to create the SSL certificate of OpenVAS. | + | Tcpdump peut être utilisé avec un de trois modes verbose. |
| - | Note that this information will *NOT* be sent to anybody (everything stays local), but anyone with the ability to connect to your OpenVAS daemon will be able to retrieve this information. | + | |
| + | ^ Mode ^ Option ^ | ||
| + | | Light verbose | -v | | ||
| + | | Medium verbose | -vv | | ||
| + | | Full verbose | -vvv | | ||
| - | CA certificate life time in days [1460]: 3650 | + | < |
| - | Server certificate life time in days [365]: 3650 | + | root@debian12:~# tcpdump -i ens18 -v -c 3 |
| - | Your country | + | tcpdump: listening on ens18, link-type EN10MB (Ethernet), snapshot length 262144 bytes |
| - | Your state or province name [none]: SURREY | + | 13: |
| - | Your location | + | 10.0.2.46.ssh > 10.0.2.1.42252: Flags [P.], cksum 0x18d1 |
| - | Your organization | + | 13: |
| - | + | 10.0.2.1.42252 > 10.0.2.46.ssh: Flags [.], cksum 0x1855 (incorrect -> 0x174a), ack 124, win 10660, options [nop,nop,TS val 1648286831 ecr 3553465811], | |
| - | ------------------------------------------------------------------------------- | + | 13:13:22.951837 IP (tos 0x10, ttl 64, id 34139, offset 0, flags [DF], proto TCP (6), length 176) |
| - | Creation of the OpenVAS SSL Certificate | + | |
| - | ------------------------------------------------------------------------------- | + | 3 packets captured |
| - | + | 10 packets received by filter | |
| - | Congratulations. Your server certificate was properly created. | + | 0 packets dropped by kernel |
| - | + | ||
| - | The following files were created: | + | |
| - | + | ||
| - | . Certification authority: | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | . OpenVAS Server | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | Press [ENTER] to exit | + | |
| - | + | ||
| - | [Entrée] | + | |
| - | [root@centos7 ~]# | + | |
| </ | </ | ||
| - | Exécutez de nouveau la commande **openvas-check-setup** : | + | ===1.2 |
| - | < | + | Tcpdump peut effectuer du filtrage lors de l' |
| - | [root@centos7 ~]# openvas-check-setup | + | |
| - | openvas-check-setup 2.3.3 | + | |
| - | Test completeness and readiness of OpenVAS-8 | + | |
| - | (add ' | + | |
| - | if you want to check for another OpenVAS version) | + | |
| - | Please report us any non-detected problems and | + | Pour uniquement écouter les paquets en provenance de l' |
| - | help us to improve this check routine: | + | |
| - | http:// | + | |
| - | | + | |
| - | Use the parameter --server to skip checks for client tools | + | Pour uniquement écouter les paquets en provenance de l' |
| - | like GSD and OpenVAS-CLI. | + | |
| - | Step 1: Checking OpenVAS Scanner | + | # tcpdump src host 192.168.1.11 and dst host 192.168.1.2 [Entrée] |
| - | OK: OpenVAS Scanner is present in version 5.0.6. | + | |
| - | OK: OpenVAS Scanner CA Certificate is present as / | + | |
| - | / | + | |
| - | ERROR: No redis-server installation found. | + | |
| - | FIX: You should install redis-server for improved scalability and ability to trace/debug the KB | + | |
| - | ERROR: Your OpenVAS-8 installation is not yet complete! | + | Pour uniquement écouter les paquets d'un port précis, utilisez la condition **port** |
| - | Please follow the instructions marked with FIX above and run this | + | # tcpdump -i eth0 port 80 [Entrée] |
| - | script again. | + | |
| - | If you think this result is wrong, please report your observation | + | Pour uniquement écouter les paquets d'un protocole précis, utilisez une condition telle **ip**, **icmp**, **arp**, **rarp**, **udp** ou **tcp**: |
| - | and help us to improve this check routine: | + | |
| - | http:// | + | |
| - | Please attach the log-file (/ | + | |
| - | </ | + | |
| - | <WRAP center round important 50%> | + | # tcpdump |
| - | **Important** | + | |
| - | </ | + | |
| - | Installez donc **redis** : | + | Pour uniquement écouter les paquets d'une taille inférieure à 100 octets, utilisez la condition |
| - | < | + | # tcpdump -i eth0 less 100 [Entrée] |
| - | [root@centos7 ~]# yum install redis | + | |
| - | </ | + | |
| - | Activez | + | Pour uniquement écouter |
| - | < | + | |
| - | ... | + | |
| - | # unixsocket / | + | |
| - | # unixsocketperm 700... | + | |
| - | </ | + | |
| - | < | + | L'utilisation des ses options et conditions peut être combinée pour donner des commandes telles : |
| - | [root@centos7 ~]# sed -i '/ | + | |
| - | </ | + | |
| - | Ajoutez la ligne **kb_location = /tmp/redis.sock** dans le fichier **/ | + | # tcpdump -i eth0 -X src host 192.168.1.11 and dst host 192.168.1.2 and port 21 and ftp [Entrée] |
| - | < | + | ===Options de la commande=== |
| - | ... | + | |
| - | # KB test replay : | + | |
| - | kb_dont_replay_scanners | + | |
| - | kb_dont_replay_info_gathering | + | |
| - | kb_dont_replay_attacks | + | |
| - | kb_dont_replay_denials | + | |
| - | kb_max_age | + | |
| - | kb_location | + | |
| - | #--- end of the KB section | + | |
| - | ... | + | |
| - | </ | + | |
| - | Activez et démarrez le service **redis** | + | Les options de cette commande sont : |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# tcpdump |
| - | Created symlink from / | + | tcpdump version 4.99.3 |
| - | [root@centos7 ~]# systemctl start redis | + | libpcap version 1.10.3 (with TPACKET_V3) |
| - | [root@centos7 ~]# systemctl status redis | + | OpenSSL 3.0.17 1 Jul 2025 |
| - | ● redis.service | + | Usage: tcpdump |
| - | Loaded: loaded (/ | + | [ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ] |
| - | Drop-In: / | + | |
| - | └─limit.conf | + | |
| - | | + | |
| - | Main PID: 13037 (redis-server) | + | |
| - | CGroup: / | + | [ --time-stamp-precision precision |
| - | | + | [ -z postrotate-command |
| - | + | ||
| - | Dec 01 15:45:16 centos7.fenestros.loc systemd[1]: Starting Redis persistent key-value database... | + | |
| - | Dec 01 15:45:16 centos7.fenestros.loc systemd[1]: Started Redis persistent key-value database. | + | |
| </ | </ | ||
| - | Exécutez encore une fois la commande **openvas-check-setup** : | + | =====Les Contre-Mesures===== |
| - | < | + | Les contre-mesures incluent l' |
| - | [root@centos7 ~]# openvas-check-setup | + | |
| - | ... | + | |
| - | Step 1: Checking OpenVAS Scanner ... | + | |
| - | OK: OpenVAS Scanner is present in version 5.0.6. | + | |
| - | OK: OpenVAS Scanner CA Certificate is present as / | + | |
| - | OK: redis-server is present in version v=3.2.10. | + | |
| - | OK: scanner (kb_location setting) is configured properly using the redis-server socket: / | + | |
| - | OK: redis-server is running and listening on socket: / | + | |
| - | OK: redis-server configuration is OK and redis-server is running. | + | |
| - | ERROR: The NVT collection is very small. | + | |
| - | FIX: Run a synchronization script like openvas-nvt-sync or greenbone-nvt-sync. | + | |
| - | ... | + | |
| - | </ | + | |
| - | <WRAP center round important 50%> | + | ====Introduction à la cryptologie==== |
| - | **Important** - Notez l' | + | |
| - | </ | + | |
| - | Téléchargez le script **greenbone-nvt-sync** : | + | ===Définitions=== |
| - | < | + | * **La Cryptologie** |
| - | [root@centos7 ~]# wget https://www.dropbox.com/ | + | * La science qui étudie les aspects scientifiques de ces techniques, c' |
| + | * **La Cryptanalyse** | ||
| + | * Lorsque la clef de déchiffrement n'est pas connue de l' | ||
| + | * **La Cryptographie** | ||
| + | * Un terme générique désignant l' | ||
| + | * **Le Décryptement ou Décryptage** | ||
| + | * Est le fait d' | ||
| - | [root@centos7 ~]# mv greenbone-nvt-sync? | + | {{ : |
| - | </ | + | |
| - | Si vous ne pouvez pas téléchargez le script | + | **La Cryptographie** |
| - | < | + | La cryptographie apporte quatre points clefs: |
| - | [root@centos7 ~]# vi greenbone-nvt-sync | + | |
| - | [root@centos7 ~]# cat greenbone-nvt-sync | + | |
| - | #!/bin/sh | + | |
| - | # Copyright (C) 2009-2021 Greenbone Networks GmbH | + | |
| - | # | + | |
| - | # SPDX-License-Identifier: GPL-2.0-or-later | + | |
| - | # | + | |
| - | # This program is free software; you can redistribute it and/or | + | |
| - | # modify it under the terms of the GNU General Public License | + | |
| - | # as published by the Free Software Foundation; either version 2 | + | |
| - | # of the License, or (at your option) any later version. | + | |
| - | # | + | |
| - | # This program is distributed in the hope that it will be useful, | + | |
| - | # but WITHOUT ANY WARRANTY; without even the implied warranty of | + | |
| - | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. | + | |
| - | # GNU General Public License for more details. | + | |
| - | # | + | |
| - | # You should have received a copy of the GNU General Public License | + | |
| - | # along with this program; if not, write to the Free Software | + | |
| - | # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. | + | |
| - | # This script updates the local Network Vulnerability Tests (NVTs) from the | + | * La confidentialité |
| - | # Greenbone Security Feed (GSF) or the Greenbone Community Feed (GCF). | + | * consiste à rendre l' |
| + | * L' | ||
| + | * consiste à déterminer si les données n'ont pas été altérées durant la communication | ||
| + | * L' | ||
| + | * consiste à assurer l' | ||
| + | * La non-répudiation | ||
| + | * est la garantie qu' | ||
| - | VERSION=@OPENVAS_VERSION@ | + | La cryptographie est basée sur l' |
| - | # SETTINGS | + | * Procéder au chiffrement |
| - | # ======== | + | * Le résultat de cette modification (le message chiffré) est appelé cryptogramme (Ciphertext) par opposition au message initial, appelé message en clair (Plaintext) |
| + | * Procéder au déchiffrement | ||
| - | # PRIVATE_SUBDIR defines a subdirectory of the NVT directory that is excluded | + | Le chiffrement se fait à l'aide d'une clef de chiffrement. Le déchiffrement nécessite |
| - | # from the feed sync. This is where to place your own NVTs. | + | |
| - | if [ -z " | + | |
| - | then | + | |
| - | PRIVATE_SUBDIR=" | + | |
| - | fi | + | |
| - | # RSYNC_DELETE controls whether files which are not part of the repository will | + | On distingue deux types de clefs: |
| - | # be removed from the local directory after synchronization. The default value | + | |
| - | # for this setting is | + | |
| - | # " | + | |
| - | # which means that files which are not part of the feed or private directory | + | |
| - | # will be deleted. | + | |
| - | RSYNC_DELETE=" | + | |
| - | # RSYNC_SSH_OPTS contains options which should be passed to ssh for the rsync | + | * Les clés symétriques: |
| - | # connection to the repository. | + | * des clés utilisées pour le chiffrement ainsi que pour le déchiffrement. On parle alors de chiffrement symétrique ou de chiffrement à clé secrète. |
| - | RSYNC_SSH_OPTS=" | + | * Les clés asymétriques: |
| + | * des clés utilisées dans le cas du chiffrement asymétrique (aussi appelé chiffrement à clé publique). Dans ce cas, une clé différente est utilisée pour le chiffrement et pour le déchiffrement. | ||
| - | # RSYNC_COMPRESS specifies the compression level to use for the rsync connection. | + | **Le Chiffrement par Substitution** |
| - | RSYNC_COMPRESS=" | + | |
| + | Le chiffrement par substitution consiste à remplacer dans un message une ou plusieurs entités (généralement des lettres) par une ou plusieurs autres entités. On distingue généralement plusieurs types de cryptosystèmes par substitution : | ||
| - | # RSYNC_CHMOD specifies the permissions to chmod the files to. | + | * La substitution **monoalphabétique** |
| - | RSYNC_CHMOD=" | + | * consiste à remplacer chaque lettre du message par une autre lettre de l' |
| + | * La substitution **polyalphabétique** | ||
| + | * consiste à utiliser une suite de chiffres monoalphabétique réutilisée périodiquement | ||
| + | * La substitution **homophonique** | ||
| + | * permet de faire correspondre à chaque lettre du message en clair un ensemble possible d' | ||
| + | * La substitution de **polygrammes** | ||
| + | * consiste à substituer un groupe de caractères (polygramme) dans le message par un autre groupe de caractères | ||
| - | # Verbosity flag for rsync. " | + | ===Algorithmes à clé secrète=== |
| - | RSYNC_VERBOSE=" | + | |
| - | # RSYNC_OPTIONS controls the general parameters for the rsync connection. | + | ==Le Chiffrement Symétrique== |
| - | RSYNC_OPTIONS=" | + | |
| - | # Script and feed information which will be made available to user through | + | Ce système est aussi appelé le système à **Clef Secrète** ou à **clef privée**. |
| - | # command line options and automated tools. | + | |
| - | # Script name which will be used for logging | + | |
| - | SCRIPT_NAME=" | + | |
| - | # Result of selftest () is stored here. If it is not 0, the selftest has failed | + | Ce système consiste à effectuer une opération de chiffrement par algorithme mais comporte un inconvénient, à savoir qu'il nécessite un canal sécurisé pour la transmission de la clef de chiffrement/ |
| - | # and the sync script is unlikely to work. | + | |
| - | SELFTEST_FAIL=0 | + | |
| - | # Port to use for synchronization. Default value is 24. | + | {{: |
| - | PORT=24 | + | |
| - | # Directory where the OpenVAS configuration is located | + | <WRAP center round important 50%> |
| - | OPENVAS_SYSCONF_DIR=" | + | **Important** - Le système de Méthode du Masque Jetable (One Time Pad) fût mis au point dans les années 1920. Il utilisait une clef générée aléatoirement à usage unique. |
| + | </ | ||
| - | # Directory where the feed update lock file will be placed. | + | Les algorithmes de chiffrement symétrique couramment utilisés en informatique sont: |
| - | OPENVAS_FEED_LOCK_PATH=" | + | |
| - | # Location of the GSF Access Key | + | * **[[wpfr> |
| - | ACCESS_KEY=" | + | * **[[wpfr> |
| + | * **[[wpfr> | ||
| + | * **[[wpfr> | ||
| + | * **[[wpfr> | ||
| + | * **[[wpfr> | ||
| - | # If ENABLED is set to 0, the sync script will not perform a synchronization. | + | ===Algorithmes à clef publique=== |
| - | ENABLED=1 | + | |
| - | # LOG_CMD defines the command to use for logging. To have logger log to stderr | + | ==Le Chiffrement Asymétrique== |
| - | # as well as syslog, add " | + | |
| - | # all will be logged in the standard error and the socket error check will be | + | |
| - | # disabled. | + | |
| - | LOG_CMD=" | + | |
| - | check_logger () { | + | Ce système est aussi appelé **Système à Clef Publique**. |
| - | logger -p daemon.info -t $SCRIPT_NAME " | + | |
| - | if [ $? -gt 0 ] | + | |
| - | then | + | |
| - | LOG_CMD=" | + | |
| - | $LOG_CMD -p daemon.warning "The log facility is not working as expected. All messages will be written to the standard error stream." | + | |
| - | fi | + | |
| - | } | + | |
| - | check_logger | + | |
| + | Ce système consiste à avoir deux clefs appelées des **bi-clefs**: | ||
| - | # Source configuration file if it is readable | + | * Une clef **publique** pour le chiffrement |
| - | [ -r $OPENVAS_SYSCONF_DIR/ | + | * Une clef **secrète** ou **privée** pour le déchiffrement |
| - | # NVT_DIR is the place where the NVTs are located. | + | {{: |
| - | if [ -z " | + | |
| - | then | + | |
| - | NVT_DIR=" | + | |
| - | fi | + | |
| - | log_write | + | * L' |
| - | | + | |
| - | } | + | * L' |
| - | log_debug () { | + | Ce système est basé sur ce que l'on appelle une **fonction à trappe à sens unique** ou **one-way trap door**. |
| - | $LOG_CMD | + | |
| - | } | + | |
| - | log_info () { | + | Il existe toutefois un problème – s' |
| - | $LOG_CMD -p daemon.info " | + | |
| - | } | + | |
| - | log_notice () { | + | Les algorithmes de chiffrement asymétrique couramment utilisés en informatique sont: |
| - | $LOG_CMD -p daemon.notice " | + | |
| - | } | + | |
| - | log_warning | + | * **[[wpfr> |
| - | | + | |
| - | } | + | |
| - | log_err () { | + | ==La Clef de Session== |
| - | $LOG_CMD -p daemon.err " | + | |
| - | } | + | |
| - | stderr_write () | + | Ce système est un compromis entre le système symétrique et le système asymétrique. Il permet l' |
| - | { | + | |
| - | echo " | + | |
| - | } | + | |
| - | # Read the general information about the feed origin from | + | {{: |
| - | # the file " | + | |
| - | get_feed_info () | + | |
| - | { | + | |
| - | INFOFILE=" | + | |
| - | if [ -r $INFOFILE ] ; then | + | |
| - | FEED_VERSION=`grep PLUGIN_SET $INFOFILE | sed -e 's/ | + | |
| - | FEED_NAME=`awk -F\" '/ | + | |
| - | FEED_VENDOR=`awk -F\" '/ | + | |
| - | FEED_HOME=`awk -F\" '/ | + | |
| - | FEED_PRESENT=1 | + | |
| - | else | + | |
| - | FEED_PRESENT=0 | + | |
| - | fi | + | |
| - | if [ -z " | + | Ce système fonctionne de la façon suivante : |
| - | FEED_NAME=" | + | |
| - | fi | + | |
| - | | + | |
| - | | + | * L' |
| - | | + | * L' |
| + | | ||
| - | if [ -z " | + | ===Fonctions de Hachage=== |
| - | FEED_HOME=" | + | |
| - | fi | + | |
| - | } | + | |
| - | # Prevent that root executes this script | + | La fonction de **hachage**, |
| - | if [ "`id -u`" -eq " | + | |
| - | then | + | |
| - | stderr_write "$0 must not be executed as privileged user root" | + | |
| - | stderr_write | + | |
| - | stderr_write " | + | |
| - | stderr_write " | + | |
| - | stderr_write "files with a non-privileged user." | + | |
| - | log_err " | + | {{: |
| - | exit 1 | + | |
| - | fi | + | |
| - | # Always try to get the information when started. | + | Les deux algorithmes de hachage utilisés sont: |
| - | # This also ensures variables like FEED_PRESENT are set. | + | |
| - | get_feed_info | + | |
| - | # Determine whether a GSF access key is present. If yes, | + | * **[[wpfr> |
| - | # then use the Greenbone Security Feed. Else use the | + | |
| - | # Greenbone Community Feed. | + | |
| - | if [ -e $ACCESS_KEY | + | |
| - | then | + | |
| - | | + | |
| - | else | + | |
| - | RESTRICTED=0 | + | |
| - | if [ -z " | + | Lors de son envoie, le message est accompagné de son haché et il est donc possible de garantir son intégrité: |
| - | COMMUNITY_NVT_RSYNC_FEED=rsync:// | + | |
| - | # An alternative syntax which might work if the above doesn' | + | |
| - | # COMMUNITY_NVT_RSYNC_FEED=rsync@feed.community.greenbone.net::/ | + | |
| - | fi | + | |
| - | fi | + | |
| - | RSYNC=`command -v rsync` | + | {{: |
| + | |||
| + | * A la réception du message, le destinataire ou l’utilisateur B calcule le haché du message reçu et le compare avec le haché accompagnant le document. | ||
| + | * Si le message ou le haché a été falsifié durant la communication, | ||
| - | if [ -z " | + | <WRAP center round important 50%> |
| - | SYNC_TMP_DIR=/ | + | **Important** |
| - | # If we have mktemp, create | + | </WRAP> |
| - | if [ -n " | + | |
| - | SYNC_TMP_DIR=`mktemp -t -d greenbone-nvt-sync.XXXXXXXXXX` || { echo " | + | |
| - | trap "rm -rf $SYNC_TMP_DIR" | + | |
| - | fi | + | |
| - | else | + | |
| - | SYNC_TMP_DIR=" | + | |
| - | fi | + | |
| - | # Initialize this indicator variable with default assuming the | + | ===Signature Numérique=== |
| - | # feed is not up-to-date. | + | |
| - | FEED_CURRENT=0 | + | |
| - | # This function uses gos-state-manager to get information about the settings. | + | Pour garantir l' |
| - | # If gos-state-manager is not installed the values of the settings can not be | + | |
| - | # retrieved. | + | |
| - | # | + | |
| - | # Input: option | + | |
| - | # Output: value as string or empty String if gos-state-manager is not installed | + | |
| - | # or option not set | + | |
| - | get_value () | + | |
| - | { | + | |
| - | value="" | + | |
| - | key=$1 | + | |
| - | if which gos-state-manager 1>/ | + | |
| - | then | + | |
| - | if gos-state-manager get " | + | |
| - | then | + | |
| - | value=" | + | |
| - | fi | + | |
| - | fi | + | |
| - | echo " | + | |
| - | } | + | |
| - | # Creates a restricted access copy of the access key if necessary. | + | {{: |
| - | setup_temp_access_key | + | |
| - | if [ -e " | + | |
| - | then | + | |
| - | FILE_ACCESS=`stat -c%a " | + | |
| - | fi | + | |
| - | if [ -n " | + | |
| - | then | + | |
| - | TEMP_ACCESS_KEY_DIR=`mktemp -d` | + | |
| - | TEMP_ACCESS_KEY=" | + | |
| - | cp " | + | |
| - | chmod 400 " | + | |
| - | else | + | |
| - | TEMP_ACCESS_KEY_DIR="" | + | |
| - | TEMP_ACCESS_KEY=" | + | |
| - | fi | + | |
| - | } | + | |
| - | # Deletes the read-only copy of the access key. | + | * L’utilisateur A envoie le sceau au destinataire. |
| - | cleanup_temp_access_key () { | + | |
| - | | + | |
| - | | + | |
| - | rm -rf " | + | Ce mécanisme de création de sceau est appelé **scellement**. |
| - | fi | + | |
| - | TEMP_ACCESS_KEY_DIR="" | + | |
| - | TEMP_ACCESS_KEY="" | + | |
| - | } | + | |
| - | is_feed_current () { | + | Ce mécanisme est identique au procédé utilisé par SSH lors d'une connexion |
| - | if [ -z " | + | |
| - | then | + | |
| - | log_write "Could not determine feed version." | + | |
| - | FEED_CURRENT=0 | + | |
| - | return $FEED_CURRENT | + | |
| - | fi | + | |
| - | if [ -z " | + | ===PKI=== |
| - | then | + | |
| - | log_notice "rsync not available, skipping feed version test" | + | |
| - | FEED_CURRENT=0 | + | |
| - | rm -rf $FEED_INFO_TEMP_DIR | + | |
| - | cleanup_temp_access_key | + | |
| - | return 0 | + | |
| - | fi | + | |
| - | FEED_INFO_TEMP_DIR=`mktemp -d` | + | On appelle **[[wpfr> |
| - | if [ -e $ACCESS_KEY ] | + | Les cryptosystèmes à clés publiques permettent de s'affranchir de la nécessité d'avoir recours systématiquement à un canal sécurisé pour s' |
| - | then | + | |
| - | gsmproxy=$(get_value proxy_feed | sed -r -e 's/^.*\/\///' | + | |
| - | syncport=$(get_value syncport) | + | |
| - | if [ " | + | |
| - | then | + | |
| - | PORT=" | + | |
| - | fi | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | then | + | |
| - | log_err "Could not determine credentials, | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | setup_temp_access_key | + | Ainsi, il est nécessaire d' |
| - | if [ " | + | Le tiers de confiance est une entité appelée communément autorité de certification (ou en anglais Certification authority, abrégé CA) chargée d' |
| - | then | + | |
| - | RSYNC_SSH_PROXY_CMD="" | + | |
| - | else | + | |
| - | if [ -e $OPENVAS_SYSCONF_DIR/ | + | |
| - | then | + | |
| - | RSYNC_SSH_PROXY_CMD=" | + | |
| - | else | + | |
| - | RSYNC_SSH_PROXY_CMD=" | + | |
| - | fi | + | |
| - | fi | + | |
| - | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $TEMP_ACCESS_KEY" | + | Pour ce faire, l' |
| - | if [ $? -ne 0 ] | + | Le rôle de l' |
| - | then | + | |
| - | log_err "Error: rsync failed." | + | |
| - | rm -rf " | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | else | + | |
| - | # Sleep for five seconds (a previous feed might have been synced a few seconds before) to prevent | + | |
| - | # IP blocking due to network equipment in between keeping the previous connection too long open. | + | |
| - | sleep 5 | + | |
| - | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | + | |
| - | eval " | + | |
| - | if [ $? -ne 0 ] | + | |
| - | then | + | |
| - | log_err "rsync failed, aborting synchronization." | + | |
| - | rm -rf " | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | fi | + | |
| - | FEED_VERSION_SERVER=`grep PLUGIN_SET $FEED_INFO_TEMP_DIR/ | + | * enregistrer des demandes de clés en vérifiant l'identité des demandeurs ; |
| + | * générer les paires de clés (clé privée | ||
| + | * garantir la confidentialité des clés privées correspondant aux clés publiques ; | ||
| + | * certifier l'association entre chaque utilisateurs et sa clé publique ; | ||
| + | * révoquer des clés (en cas de perte par son propriétaire, | ||
| - | if [ -z " | + | Une infrastructure à clé publique est en règle générale composée de trois entités distinctes : |
| - | then | + | |
| - | log_err "Could not determine server feed version." | + | |
| - | rm -rf $FEED_INFO_TEMP_DIR | + | |
| - | cleanup_temp_access_key | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | # Check against FEED_VERSION | + | |
| - | if [ $FEED_VERSION -lt $FEED_VERSION_SERVER ] ; then | + | |
| - | FEED_CURRENT=0 | + | |
| - | else | + | |
| - | FEED_CURRENT=1 | + | |
| - | fi | + | |
| - | # Cleanup | + | |
| - | rm -rf " | + | |
| - | cleanup_temp_access_key | + | |
| - | return $FEED_CURRENT | + | * L' |
| - | } | + | * L' |
| + | * L' | ||
| - | do_rsync_community_feed () { | + | ==Certificats X509== |
| - | # Sleep for five seconds (a previous feed might have been synced a few seconds before) to prevent | + | |
| - | # IP blocking due to network equipment in between keeping the previous connection too long open. | + | |
| - | sleep 5 | + | |
| - | log_notice " | + | |
| - | mkdir -p " | + | |
| - | eval " | + | |
| - | if [ $? -ne 0 ] ; then | + | |
| - | log_err "rsync failed." | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | # Sleep for five seconds (after the above rsync call) to prevent IP blocking due | + | |
| - | # to network equipment in between keeping the previous connection too long open. | + | |
| - | sleep 5 | + | |
| - | eval " | + | |
| - | if [ $? -ne 0 ] ; then | + | |
| - | log_err "rsync failed." | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | } | + | |
| - | sync_nvts(){ | + | Pour palier aux problèmes liés à des clefs publiques piratées, un système de certificats a été mis en place. |
| - | if [ $ENABLED -ne 1 ] | + | |
| - | then | + | |
| - | log_write "NVT synchronization is disabled, exiting." | + | |
| - | exit 0 | + | |
| - | fi | + | |
| - | if [ -e $ACCESS_KEY ] | + | Le certificat permet d’associer la clef publique à une entité ou une personne. Les certificats sont délivrés par des Organismes de Certification. |
| - | then | + | |
| - | log_write " | + | |
| - | if [ $FEED_PRESENT -eq 1 ] ; then | + | |
| - | FEEDCOUNT=`grep -E " | + | |
| - | log_write " | + | |
| - | else | + | |
| - | log_write " | + | |
| - | fi | + | |
| - | notsynced=1 | + | |
| - | retried=0 | + | |
| - | mkdir -p " | + | Les certificats sont des fichiers divisés en deux parties : |
| - | read feeduser < $ACCESS_KEY | + | |
| - | custid=`awk -F@ 'NR > 1 { exit }; { print $1 }' $ACCESS_KEY` | + | |
| - | if [ -z " | + | |
| - | then | + | |
| - | log_err "Could not determine credentials, | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | setup_temp_access_key | + | * La partie contenant les informations |
| + | * La partie contenant la signature de l' | ||
| - | while [ $notsynced -eq 1 ] | + | La structure des certificats est normalisée par le standard **[[wpfr> |
| - | do | + | |
| - | gsmproxy=$(get_value proxy_feed | sed -r -e ' | + | Elle contient |
| - | syncport=$(get_value syncport) | + | |
| - | if [ " | + | |
| - | then | + | |
| - | PORT=" | + | |
| - | fi | + | |
| - | if [ " | + | * Le nom de l' |
| - | | + | |
| - | RSYNC_SSH_PROXY_CMD="" | + | |
| - | else | + | |
| - | if [ -e $OPENVAS_SYSCONF_DIR/ | + | |
| - | RSYNC_SSH_PROXY_CMD=" | + | |
| - | else | + | |
| - | RSYNC_SSH_PROXY_CMD=" | + | |
| - | fi | + | |
| - | fi | + | |
| - | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $TEMP_ACCESS_KEY" | + | |
| - | if [ $? -ne 0 ] ; then | + | |
| - | | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $TEMP_ACCESS_KEY" | + | |
| - | if [ $? -ne 0 ] ; then | + | |
| - | | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | eval "cd \" | + | |
| - | if [ $? -ne 0 ] ; then | + | |
| - | if [ -n " | + | |
| - | then | + | |
| - | log_err "Feed integrity check failed twice, aborting synchronization." | + | |
| - | cleanup_temp_access_key | + | |
| - | exit 1 | + | |
| - | else | + | |
| - | log_write "The feed integrity check failed. This may be due to a concurrent feed update or other temporary issues." | + | |
| - | log_write " | + | |
| - | sleep 15 | + | |
| - | retried=1 | + | |
| - | fi | + | |
| - | else | + | |
| - | notsynced=0 | + | |
| - | fi | + | |
| - | done | + | |
| - | cleanup_temp_access_key | + | |
| - | log_write " | + | |
| - | get_feed_info | + | |
| - | if [ $FEED_PRESENT -eq 1 ] ; then | + | |
| - | FEEDCOUNT=`grep -E " | + | |
| - | log_write " | + | |
| - | else | + | |
| - | log_write " | + | |
| - | fi | + | |
| - | | + | |
| - | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | + | |
| - | do_rsync_community_feed | + | |
| - | fi | + | |
| - | } | + | |
| - | do_self_test () | + | Le Certificat est signé par l' |
| - | { | + | |
| - | MD5SUM_AVAIL=`command -v md5sum` | + | |
| - | if [ $? -ne 0 ] ; then | + | |
| - | SELFTEST_FAIL=1 | + | |
| - | stderr_write "The md5sum binary could not be found." | + | |
| - | fi | + | |
| - | RSYNC_AVAIL=`command -v rsync` | + | {{: |
| - | if [ $? -ne 0 ] ; then | + | |
| - | SELFTEST_FAIL=1 | + | |
| - | stderr_write "The rsync binary could not be found." | + | |
| - | fi | + | |
| - | } | + | |
| - | do_describe () | + | La vérification se passe ainsi: |
| - | { | + | |
| - | echo "This script synchronizes an NVT collection with the ' | + | |
| - | echo "The ' | + | |
| - | echo " | + | |
| - | } | + | |
| - | do_feedversion | + | {{: |
| - | if [ $FEED_PRESENT -eq 1 ] ; then | + | |
| - | echo $FEED_VERSION | + | |
| - | else | + | |
| - | stderr_write "The file containing the feed version could not be found." | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | } | + | |
| - | do_sync () | + | =====LAB #2 - Utilisation de GnuPG===== |
| - | { | + | |
| - | do_self_test | + | |
| - | if [ $SELFTEST_FAIL | + | |
| - | exit $SELFTEST_FAIL | + | |
| - | fi | + | |
| - | if [ $FEED_CURRENT -eq 1 ] | + | ====2.1 - Présentation==== |
| - | then | + | |
| - | log_write "Feed is already current, skipping synchronization." | + | |
| - | else | + | |
| - | ( | + | |
| - | chmod +660 $OPENVAS_FEED_LOCK_PATH | + | |
| - | flock -n 9 | + | |
| - | if [ $? -eq 1 ] ; then | + | |
| - | log_warning " | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | date > $OPENVAS_FEED_LOCK_PATH | + | |
| - | sync_nvts | + | |
| - | echo -n $OPENVAS_FEED_LOCK_PATH | + | |
| - | )9>> | + | |
| - | fi | + | |
| - | } | + | |
| - | do_help () { | + | **GNU Privacy Guard** permet aux utilisateurs de transférer des messages chiffrés et/ou signés. |
| - | echo "$0: Sync NVT data" | + | |
| - | echo " --describe | + | |
| - | echo " --feedcurrent | + | |
| - | echo " --feedversion | + | |
| - | echo " --help | + | |
| - | echo " --identify | + | |
| - | echo " --nvtdir dir set dir as NVT directory" | + | |
| - | echo " --selftest | + | |
| - | echo " --verbose | + | |
| - | echo " --version | + | |
| - | echo "" | + | |
| - | echo "" | + | |
| - | echo " | + | |
| - | echo " | + | |
| - | echo " | + | |
| - | echo " | + | |
| - | echo "Note that you can use standard ones as well (e.g. RSYNC_PROXY) for rsync" | + | |
| - | echo "" | + | |
| - | exit 0 | + | |
| - | } | + | |
| - | while test $# -gt 0; do | + | ====2.2 - Utilisation==== |
| - | case " | + | |
| - | --version) | + | |
| - | echo $VERSION | + | |
| - | exit 0 | + | |
| - | ;; | + | |
| - | --identify) | + | |
| - | echo " | + | |
| - | exit 0 | + | |
| - | ;; | + | |
| - | --selftest) | + | |
| - | do_self_test | + | |
| - | exit $SELFTEST_FAIL | + | |
| - | ;; | + | |
| - | --describe) | + | |
| - | do_describe | + | |
| - | exit 0 | + | |
| - | ;; | + | |
| - | --feedversion) | + | |
| - | do_feedversion | + | |
| - | exit 0 | + | |
| - | ;; | + | |
| - | --help) | + | |
| - | do_help | + | |
| - | exit 0 | + | |
| - | ;; | + | |
| - | --nvt-dir) | + | |
| - | NVT_DIR="$2" | + | |
| - | shift | + | |
| - | ;; | + | |
| - | | + | |
| - | is_feed_current | + | |
| - | exit $? | + | |
| - | ;; | + | |
| - | --verbose) | + | |
| - | RSYNC_VERBOSE=" | + | |
| - | ;; | + | |
| - | esac | + | |
| - | shift | + | |
| - | done | + | |
| - | do_sync | + | Pour initialiser %%GnuPG%%, saisissez la commande suivante |
| - | + | ||
| - | exit 0 | + | |
| - | </ | + | |
| - | + | ||
| - | Rendez le script exécutable | + | |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# gpg |
| + | gpg: directory '/ | ||
| + | gpg: keybox '/ | ||
| + | gpg: WARNING: no command supplied. | ||
| + | gpg: Go ahead and type your message ... | ||
| + | ^C | ||
| + | gpg: signal Interrupt caught ... exiting | ||
| </ | </ | ||
| - | Déplacez le script vers **/usr/sbin/** : | + | <WRAP center round important 50%> |
| + | **Important** - Notez l' | ||
| + | </ | ||
| - | < | + | Pour générer les clefs, saisissez la commande suivante |
| - | [root@centos7 ~]# mv greenbone-nvt-sync /usr/sbin | + | |
| - | mv: overwrite ‘/ | + | |
| - | </ | + | |
| - | Devenez l'utilisateur trainee et mettez à jour les modules d' | + | <WRAP center round important 50%> |
| + | **Important** - Lorsque le système vous demande une Passphrase, saisissez une valeur que n'allez **PAS** oublié. | ||
| + | </ | ||
| < | < | ||
| + | root@debian12: | ||
| + | gpg (GnuPG) 2.2.40; Copyright (C) 2022 g10 Code GmbH | ||
| + | This is free software: you are free to change and redistribute it. | ||
| + | There is NO WARRANTY, to the extent permitted by law. | ||
| - | [root@centos7 ~]# su - trainee | + | Please select what kind of key you want: |
| - | Last login: Mon Dec | + | (1) RSA and RSA (default) |
| + | (2) DSA and Elgamal | ||
| + | (3) DSA (sign only) | ||
| + | (4) RSA (sign only) | ||
| + | (14) Existing key from card | ||
| + | Your selection? | ||
| + | RSA keys may be between 1024 and 4096 bits long. | ||
| + | What keysize do you want? (3072) | ||
| + | Requested keysize is 3072 bits | ||
| + | Please specify how long the key should be valid. | ||
| + | 0 = key does not expire | ||
| + | < | ||
| + | <n>w = key expires in n weeks | ||
| + | <n>m = key expires in n months | ||
| + | <n>y = key expires in n years | ||
| + | Key is valid for? (0) | ||
| + | Key does not expire at all | ||
| + | Is this correct? (y/N) y | ||
| - | [trainee@centos7 ~]$ greenbone-nvt-sync | + | GnuPG needs to construct a user ID to identify your key. |
| - | ... | + | |
| - | Greenbone community feed server - http:// | + | |
| - | This service is hosted by Greenbone Networks - http:// | + | |
| - | + | ||
| - | All transactions are logged. | + | |
| - | + | ||
| - | If you have any questions, please use the Greenbone community portal. | + | |
| - | See https:// | + | |
| - | + | ||
| - | By using this service you agree to our terms and conditions. | + | |
| - | + | ||
| - | Only one sync per time, otherwise the source ip will be temporarily blocked. | + | |
| + | Real name: ITTRAINING | ||
| + | Email address: infos@ittraining.team | ||
| + | Comment: Test key | ||
| + | You selected this USER-ID: | ||
| + | " | ||
| - | receiving incremental file list | + | Change (N)ame, (C)omment, (E)mail or (O)kay/ |
| - | plugin_feed_info.inc | + | We need to generate a lot of random bytes. It is a good idea to perform |
| - | 330 100% 322.27kB/ | + | some other action (type on the keyboard, move the mouse, utilize the |
| + | disks) during the prime generation; this gives the random number | ||
| + | generator a better chance to gain enough entropy. | ||
| + | We need to generate a lot of random bytes. It is a good idea to perform | ||
| + | some other action | ||
| + | disks) during the prime generation; this gives the random number | ||
| + | generator a better chance | ||
| + | gpg: / | ||
| + | gpg: directory '/ | ||
| + | gpg: revocation certificate stored as '/root/ | ||
| + | public and secret key created and signed. | ||
| - | sent 57 bytes received 436 bytes 328.67 bytes/sec | + | pub |
| - | total size is 330 speedup is 0.67 | + | |
| - | [trainee@centos7 ~]$ exit | + | uid ITTRAINING (Test key) <infos@ittraining.team> |
| - | [root@centos7 ~]# | + | sub |
| </ | </ | ||
| - | <WRAP center round important 50%> | + | La liste de clefs peut être visualisée avec la commande |
| - | **Important** - En cas d' | + | |
| - | </ | + | |
| - | + | ||
| - | Déplacez les plugins vers le répertoire **/ | + | |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# gpg --list-keys |
| + | gpg: checking the trustdb | ||
| + | gpg: marginals needed: 3 completes needed: 1 trust model: pgp | ||
| + | gpg: depth: 0 valid: | ||
| + | /root/.gnupg/pubring.kbx | ||
| + | ------------------------ | ||
| + | pub | ||
| + | B6022CC107539B4036A90FAEABAD13CD27F9E686 | ||
| + | uid | ||
| + | sub | ||
| </ | </ | ||
| - | Vérifiez ensuite | + | Pour importer |
| - | + | ||
| - | < | + | |
| - | [root@centos7 ~]# ls -l / | + | |
| - | total 41280 | + | |
| - | drwxr-xr-x. | + | |
| - | drwxr-xr-x. | + | |
| - | drwxr-xr-x. | + | |
| - | drwxr-xr-x. | + | |
| - | drwxr-xr-x. | + | |
| - | drwxr-xr-x. | + | |
| - | drwxr-xr-x. | + | |
| - | drwxr-xr-x. | + | |
| - | drwxr-xr-x. | + | |
| - | drwxr-xr-x. | + | |
| - | drwxr-xr-x. 288 trainee trainee | + | |
| - | drwxr-xr-x. 215 trainee trainee | + | |
| - | drwxr-xr-x. 181 trainee trainee | + | |
| - | drwxr-xr-x. 154 trainee trainee | + | |
| - | drwxr-xr-x. 149 trainee trainee | + | |
| - | drwx------. 136 trainee trainee | + | |
| - | drwx------. 127 trainee trainee | + | |
| - | drwx------. 132 trainee trainee | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | drwx------. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | -rw-r--r--. | + | |
| - | --More-- | + | |
| - | </ | + | |
| - | + | ||
| - | Exécutez de nouveau la commande **openvas-check-setup** : | + | |
| - | + | ||
| - | < | + | |
| - | [root@centos7 ~]# openvas-check-setup | + | |
| - | ... | + | |
| - | Step 2: Checking OpenVAS Manager ... | + | |
| - | OK: OpenVAS Manager is present in version 6.0.9. | + | |
| - | ERROR: No client certificate file of OpenVAS Manager found. | + | |
| - | FIX: Run ' | + | |
| - | + | ||
| - | ERROR: Your OpenVAS-8 installation is not yet complete! | + | |
| - | ... | + | |
| - | </ | + | |
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Notez l' | + | **Important** - La commande suivante est un exemple. Ne la saisissez |
| </ | </ | ||
| - | Consultez la signification des options suggérées pour la commande **openvas-mkcert-client** : | + | # gpg --import la-clef.asc |
| - | < | + | Pour exporter sa clef publique, il convient d' |
| - | [root@centos7 ~]# openvas-mkcert-client --help | + | |
| - | / | + | |
| - | Usage: | + | |
| - | openvas-mkcert-client [OPTION...] - Create SSL client certificates for OpenVAS. | + | |
| - | + | ||
| - | Options: | + | |
| - | -h | + | |
| - | -n Run non-interactively, create certificates | + | |
| - | and register with the OpenVAS scanner | + | |
| - | -i | + | |
| - | </ | + | |
| - | + | ||
| - | Exécutez donc la commande | + | |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# gpg --export |
| - | This script will now ask you the relevant information to create the SSL client certificates for OpenVAS. | + | |
| - | Client certificates life time in days [365]: 3650 | + | root@debian12:~# cat mykey.asc |
| - | Your country (two letter code) [DE]: UK | + | -----BEGIN PGP PUBLIC KEY BLOCK----- |
| - | Your state or province name [none]: SURREY | + | |
| - | Your location (e.g. town) [Berlin]: ADDLESTONE | + | |
| - | Your organization [none]: I2TCH LIMITED | + | |
| - | Your organizational unit [none]: TRAINING | + | |
| - | ********** | + | |
| - | We are going to ask you some question for each client certificate. | + | |
| - | If some question has a default answer, you can force an empty answer by entering a single dot ' | + | mQGNBGkpk+gBDACq6M7rUNQFu/ |
| + | oV9JmFfRe4P2QG/ | ||
| + | MtIf4LlXRrTALGE5TclLWFz5a2iqRjtT8IjSPAu1M9TLUaMXtWXN6jQY1YOnjxPN | ||
| + | 3HL8bwdaY0k8icKr8JRbmEijCWo2F4t2qTtdOXuRFAImxBpX49eJR0oC5bzXZPYx | ||
| + | LbirNsEwSULIyQ71gdF5OUb0aOSiQLXLuTLAs2BnxAJ82tB/ | ||
| + | +t0eHdWzUHH4qlXuNtBXK7pEbvjqftO69PJLDp/ | ||
| + | qvRgll3fojjr91WWWqr8YTd4EiTvq9KfUyAiTOfKm8k4iRQRTJir267Fq8Mno8/ | ||
| + | My1tNeHWzCXMs3k/ | ||
| + | XTBUX/ | ||
| + | dHRyYWluaW5nLnRlYW0+iQHOBBMBCgA4FiEEtgIswQdTm0A2qQ+uq60TzSf55oYF | ||
| + | Amkpk+gCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQq60TzSf55oZEsAv+ | ||
| + | Ky14vHWjMzU1ieE+XStqGYfjfAHhaNrpkWCz6miozuh+ESifNWpJd96bzwgNLGob | ||
| + | E5mA9oja5jyAEQUGT+gEwgvkbYVe4sf4UcXPRrvDqKiEOkN5rra3kYYdhHhpiFes | ||
| + | BmwQvW2dyElNO1ee/ | ||
| + | C5kqTMRXdoWR2ZP2HLZjUstRX7d9BP/ | ||
| + | TqtAMmtp5IXalT+vKwhMu0MwUfyXyvl7ery4kxfmFtEeJQyxrdK2gihDxr0ndxBH | ||
| + | mowlIoBiGYMhUr/ | ||
| + | VBlBdhX2SlE9XJOjLq9ppV5Vr9u6ZauwEI6kBLoagjWOF3t34Gnvel8zO+H5fhhq | ||
| + | UKMOAbC0SYmLVIPNUauHYoKiJlWb+Dlr96NsPm0sYBbB047hr0evBUmkJNrulI3N | ||
| + | uQGNBGkpk+gBDADZu1B0itmBIGzxjGmUjK9UagW3HNLNVX3jn2Jwe7yl3vL/ | ||
| + | qBRydky32P4whbUSiJN71Tze9l+WOxeXGa0orKPPha/ | ||
| + | xCrS131SYjFb5dcQXoqTtUk8Wu4qoMHu/ | ||
| + | zs6azU/ | ||
| + | FIpfm95Q+wtC224wckro/ | ||
| + | IITHq92gQSAKFhwSauaPtJ++oQNRgz5vJhCg78XfyBGpwDS6P0NM5RVEz6LMhQzI | ||
| + | 4LziGmYH/ | ||
| + | CrtEjyAIQxCmEUF0vPa7X1KB+FxCpJ8mYXBZ5w1DwBN7qsOnnHZKFcaPGW8r1am6 | ||
| + | Ab25ee028mua9RkAEQEAAYkBtgQYAQoAIBYhBLYCLMEHU5tANqkPrqutE80n+eaG | ||
| + | BQJpKZPoAhsMAAoJEKutE80n+eaGCRgMAJiG7Q8oF6oMkn6Xh7kXVH2yF4CKN9/ | ||
| + | / | ||
| + | YoxDxegwlk9+gPiOMJ0+9R43IUs+jFrra1jcUpSg+1Nv2IijdPwape3HyPhYgDmZ | ||
| + | VxORrNtqBCkhtLpJO5VTiThAny+rNBHk1t1vQg4tEkCLGcOD8bsdxhACZnM0DVYY | ||
| + | rA6afeDnm7CTfVtc3QFAi2+ltYcDIrMxMF0b1VASlbU14TE6ep2Ic30ScpDJL8De | ||
| + | skhWi2/ | ||
| + | vh6kVR0MPTFjg+8khUjjrSYUzqiiK6iJDxn+m0XJvHzQTeCHQlgRrPj9HGp7isyK | ||
| + | o9Wf8fVvnksR8xc/ | ||
| + | DTh6aJal6iGcG4aXbTzwIFXHW9WipS5B4A== | ||
| + | =rrxA | ||
| + | -----END PGP PUBLIC KEY BLOCK----- | ||
| + | </ | ||
| - | ********* | + | Cette clef peut ensuite être jointe à des messages électroniques ou bien déposée sur un serveur de clefs tel http://www.keyserver.net. |
| - | Client certificates life time in days [3650]: | + | |
| - | Country (two letter code) [UK]: | + | |
| - | State or province name [SURREY]: | + | |
| - | Location (e.g. town) [ADDLESTONE]: | + | |
| - | Organization [I2TCH LIMITED]: | + | |
| - | Organization unit [TRAINING]: | + | |
| - | e-Mail []: infos@i2tch.eu | + | |
| - | Generating RSA private key, 4096 bit long modulus | + | |
| - | ....++ | + | |
| - | .......++ | + | |
| - | e is 65537 (0x10001) | + | |
| - | You are about to be asked to enter information that will be incorporated | + | |
| - | into your certificate request. | + | |
| - | What you are about to enter is what is called a Distinguished Name or a DN. | + | |
| - | There are quite a few fields but you can leave some blank | + | |
| - | For some fields there will be a default value, | + | |
| - | If you enter ' | + | |
| - | ----- | + | |
| - | Country Name (2 letter code) [DE]:State or Province Name (full name) [Some-State]: | + | |
| - | Check that the request matches the signature | + | |
| - | Signature ok | + | |
| - | The Subject' | + | |
| - | countryName | + | |
| - | stateOrProvinceName | + | |
| - | localityName | + | |
| - | organizationName | + | |
| - | organizationalUnitName: | + | |
| - | commonName | + | |
| - | emailAddress | + | |
| - | Certificate is to be certified until Jun 17 02:03:34 2028 GMT (3650 days) | + | |
| - | Write out database with 1 new entries | + | ===Signer un message=== |
| - | Data Base Updated | + | |
| - | / | + | |
| - | </ | + | |
| - | Exécutez encore une fois la commande **openvas-check-setup** | + | Créez maintenant un message à signer |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# vi message.txt |
| - | ... | + | |
| - | Step 2: Checking OpenVAS Manager ... | + | |
| - | OK: OpenVAS Manager is present in version 6.0.9. | + | |
| - | OK: OpenVAS Manager client certificate is present as / | + | |
| - | ERROR: No OpenVAS Manager database found. (Tried: / | + | |
| - | FIX: Run ' | + | |
| - | WARNING: OpenVAS Scanner is NOT running! | + | |
| - | SUGGEST: Start OpenVAS Scanner (openvassd). | + | |
| - | ERROR: Your OpenVAS-8 installation is not yet complete! | + | root@debian12:~# cat message.txt |
| - | ... | + | # ~/message.txt |
| + | Ceci est un message de test pour GnuPG | ||
| </ | </ | ||
| + | |||
| + | Pour signer ce message en format binaire, il convient d' | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Notez l' | + | **Important** - Entrez votre Passphrase quand gpg vous la demande. |
| </ | </ | ||
| - | |||
| - | Afin de générer la base de données, OpenVAS Scanner doit être en cours d' | ||
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# gpg --default-key ITTRAINING |
| - | Created symlink from / | + | gpg: using " |
| - | [root@centos7 ~]# systemctl start openvas-scanner | + | |
| - | [root@centos7 ~]# systemctl status openvas-scanner | + | |
| - | ● openvas-scanner.service - OpenVAS Scanner | + | |
| - | Loaded: loaded (/ | + | |
| - | | + | |
| - | Process: 8889 ExecStart=/ | + | |
| - | Main PID: 8890 (openvassd) | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Dec 01 16:45:47 centos7.fenestros.loc systemd[1]: Starting OpenVAS Scanner... | + | root@debian12:~# ls -l | grep message |
| - | Dec 01 16:45:47 centos7.fenestros.loc systemd[1]: Started OpenVAS Scanner. | + | -rw-r--r-- |
| - | </ | + | -rw-r--r-- 1 root root 461 Nov 28 13:28 message.txt.sig |
| - | Construisez maintenant la base de données | + | root@debian12:~# cat message.txt.sig |
| - | <code> | + | 4!, |
| - | [root@centos7 ~]# openvasmd | + | '| |
| - | Rebuilding NVT cache... done. | + | M<~,# |
| </ | </ | ||
| - | Exécutez de nouveau | + | Pour signer ce message en format ascii, il convient d' |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# |
| - | ... | + | |
| - | Step 2: Checking OpenVAS Manager ... | + | |
| - | OK: OpenVAS Manager is present in version 6.0.9. | + | |
| - | OK: OpenVAS Manager client certificate is present as / | + | |
| - | OK: OpenVAS Manager database found in / | + | |
| - | OK: Access rights for the OpenVAS Manager database are correct. | + | |
| - | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. | + | |
| - | OK: OpenVAS Manager database is at revision 146. | + | |
| - | OK: OpenVAS Manager expects database at revision 146. | + | |
| - | OK: Database schema is up to date. | + | |
| - | OK: OpenVAS Manager database contains information about 45654 NVTs. | + | |
| - | ERROR: No users found. You need to create at least one user to log in. | + | |
| - | It is recommended to have at least one user with role Admin. | + | |
| - | FIX: create a user by running ' | + | |
| - | ... | + | |
| - | </ | + | |
| - | <WRAP center round important 50%> | + | gpg: using " |
| - | **Important** - Notez l' | + | |
| - | </ | + | |
| - | Créez donc un utilisateur | + | root@debian12:~# ls -l | grep message |
| + | -rw-r--r-- 1 root root 55 Nov 28 13:28 message.txt | ||
| + | -rw-r--r-- 1 root root 691 Nov 28 13:31 message.txt.asc | ||
| + | -rw-r--r-- 1 root root 461 Nov 28 13:28 message.txt.sig | ||
| - | < | + | root@debian12:~# cat message.txt.asc |
| - | [root@centos7 | + | -----BEGIN PGP SIGNATURE----- |
| - | User created with password ' | + | |
| - | [root@centos7 ~]# openvasmd | + | iQHKBAABCgA0FiEEtgIswQdTm0A2qQ+uq60TzSf55oYFAmkplgkWHGluZm9zQGl0 |
| + | dHJhaW5pbmcudGVhbQAKCRCrrRPNJ/ | ||
| + | Ml72F9permfoLc83fj+zZfigUxZe4DHx0TslVtFhntkg+7wF1H3MmUyKOhwCXFO4 | ||
| + | ccyE9/ | ||
| + | MBVm2O4pFDXWu1+0S69YnAelElZrzoqCaqprkQCcJvekBSV2NUNPLcwcBGq966+q | ||
| + | T9bGxPtW/ | ||
| + | ZQsz2eby3oyv5KduA2emMnstQGCBq6zukYUpTgtzXB6jF1S71okiow11NsPra0m+ | ||
| + | 9CAcg3tiylnkUJEgsvfZ45uctN+2UqBNAXMgVsHGUhJtugfPzfwWpfC/ | ||
| + | g2nTttJexAGjjtw4Y0uFIYbNI0xXeH8ooh0AgQcXS5IOVH2zYs0GIdMxzRYFhRmc | ||
| + | nVRd/ | ||
| + | =2N1N | ||
| + | -----END PGP SIGNATURE----- | ||
| </ | </ | ||
| - | Exécutez encore une fois la commande | + | Pour signer ce message |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# gpg --default-key ITTRAINING --clearsign message.txt |
| - | ... | + | gpg: using " |
| - | Step 2: Checking OpenVAS Manager ... | + | File ' |
| - | OK: OpenVAS Manager is present in version 6.0.9. | + | |
| - | OK: OpenVAS Manager client certificate is present | + | |
| - | OK: OpenVAS Manager database found in / | + | |
| - | OK: Access rights | + | |
| - | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. | + | |
| - | OK: OpenVAS Manager database is at revision 146. | + | |
| - | OK: OpenVAS Manager expects database at revision 146. | + | |
| - | OK: Database schema is up to date. | + | |
| - | OK: OpenVAS Manager database contains information about 45654 NVTs. | + | |
| - | OK: At least one user exists. | + | |
| - | ERROR: No OpenVAS SCAP database found. | + | |
| - | FIX: Run a SCAP synchronization script like openvas-scapdata-sync or greenbone-scapdata-sync. | + | |
| - | ERROR: Your OpenVAS-8 installation is not yet complete! | + | root@debian12:~# ls -l | grep message |
| - | ... | + | -rw-r--r-- 1 root root 55 Nov 28 13:28 message.txt |
| - | </ | + | -rw-r--r-- 1 root root 795 Nov 28 13:33 message.txt.asc |
| + | -rw-r--r-- 1 root root 461 Nov 28 13:28 message.txt.sig | ||
| - | <WRAP center round important 50%> | + | root@debian12:~# cat message.txt.asc |
| - | **Important** - Notez l' | + | -----BEGIN PGP SIGNED MESSAGE----- |
| - | </ | + | Hash: SHA512 |
| - | La prochaine étape donc consiste à récupérer la base SCAP (Security Content Automation Protocol). | + | # ~/message.txt |
| + | Ceci est un message de test pour GnuPG | ||
| + | -----BEGIN PGP SIGNATURE----- | ||
| - | Créez le fichier **greenbone-feed-sync** | + | iQHKBAEBCgA0FiEEtgIswQdTm0A2qQ+uq60TzSf55oYFAmkplpsWHGluZm9zQGl0 |
| + | dHJhaW5pbmcudGVhbQAKCRCrrRPNJ/ | ||
| + | QzcoDIIDMF71lizXIQ4DL2GCKhO3pelEWfyofUxd1sddT2qIHIsRTULaqHPRRjOU | ||
| + | 9e/ | ||
| + | qNPNlSZ4kzim3LyASyg8SYTGfft35S1S+7bjoY7LHfJUlGuSFRtlDMlhTbrrDqhI | ||
| + | S3TL6EeNFCdEVoxCPamsAKvuk4BV8Fe2rCjQqm/ | ||
| + | i7lQkZz+IjoTqwrjboL1mPWt6DMgiBX0IWas4kxKiBeZzyDZm6HGNeeMsqnReTcR | ||
| + | TPNM9FdDmpcxYzrRbYAoWTmdhiPdD/ | ||
| + | i3yOFw/ | ||
| + | scYMCHrlrUfErpkLD1H6eFhSA4StmdZPmAA5DBA= | ||
| + | =07RM | ||
| + | -----END PGP SIGNATURE----- | ||
| + | </ | ||
| + | |||
| + | Pour vérifier la signature d'un message signé en mode ascii, il convient d' | ||
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# gpg --verify message.txt.asc |
| - | [root@centos7 ~]# cat greenbone-feed-sync | + | gpg: Signature made Fri 28 Nov 2025 01:33:31 PM CET |
| - | #!/bin/sh | + | gpg: using RSA key B6022CC107539B4036A90FAEABAD13CD27F9E686 |
| - | # Copyright (C) 2011-2020 Greenbone Networks GmbH | + | gpg: |
| - | # | + | gpg: Good signature from " |
| - | # SPDX-License-Identifier: AGPL-3.0-or-later | + | gpg: WARNING: not a detached signature; file ' |
| - | # | + | </code> |
| - | # This program is free software: you can redistribute it and/or modify | + | |
| - | # it under the terms of the GNU Affero General Public License as | + | |
| - | # published by the Free Software Foundation, either version 3 of the | + | |
| - | # License, or (at your option) any later version. | + | |
| - | # | + | |
| - | # This program is distributed in the hope that it will be useful, | + | |
| - | # but WITHOUT ANY WARRANTY; without even the implied warranty of | + | |
| - | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | + | |
| - | # GNU Affero General Public License for more details. | + | |
| - | # | + | |
| - | # You should have received a copy of the GNU Affero General Public License | + | |
| - | # along with this program. | + | |
| - | # This script synchronizes a GVM installation with the | + | <WRAP center round important 50%> |
| - | # feed data from either the Greenbone Security Feed (in | + | **Important** - Pour vérifier la signature d'un message signé en mode ascii et produit en dehors du message lui-même, il convient d' |
| - | # case a GSF access key is present) or else from the Greenbone | + | |
| - | # Community Feed. | + | |
| - | log_notice () { | + | # gpg --verify message.txt.asc message.txt |
| - | $LOG_CMD | + | </ |
| - | } | + | |
| + | ===Chiffrer un message=== | ||
| - | ########## SETTINGS | + | Pour chiffrer un message, il faut disposer de la clef publique du destinataire du message. Ce dernier utilisera ensuite sa clef privée pour déchiffrer le message. Il convient de préciser le destinataire du message, ou plus précisément la clef publique à utiliser, lors d'un chiffrement : |
| - | ########## ======== | + | |
| - | # PRIVATE_SUBDIR defines a subdirectory of the feed data directory | + | gpg --recipient < |
| - | # where files not part of the feed or database will not be deleted by rsync. | + | |
| - | if [ -z " | + | |
| - | then | + | |
| - | PRIVATE_SUBDIR=" | + | |
| - | fi | + | |
| - | # RSYNC_DELETE controls whether files which are not part of the repository will | + | * //< |
| - | # be removed from the local directory after synchronization. The default value | + | * //< |
| - | # for this setting is | + | |
| - | # "--delete --exclude feed.xml --exclude $PRIVATE_SUBDIR/" | + | |
| - | # which means that files which are not part of the feed, feed info or private | + | |
| - | # directory will be deleted. | + | |
| - | RSYNC_DELETE=" | + | |
| - | # RSYNC_SSH_OPTS contains options which should be passed to ssh for the rsync | + | Par exemple pour chiffrer un message en mode binaire, il convient de saisir la commande suivante : |
| - | # connection to the repository. | + | |
| - | RSYNC_SSH_OPTS=" | + | |
| - | # RSYNC_COMPRESS specifies the compression level to use for the rsync connection. | + | < |
| - | RSYNC_COMPRESS=" | + | root@debian12: |
| - | # PORT controls the outgoing TCP port for updates. If PAT/Port-Translation is | + | root@debian12: |
| - | # not used, this should be " | + | -rw-r--r-- 1 root root 55 Nov 28 13:28 message.txt |
| - | # the value 22 (Standard SSH) is useful. Only change if you know what you are | + | -rw-r--r-- 1 root root 795 Nov 28 13:33 message.txt.asc |
| - | # doing. | + | -rw-r--r-- 1 root root 510 Nov 28 13:35 message.txt.gpg |
| - | PORT=24 | + | -rw-r--r-- 1 root root 461 Nov 28 13:28 message.txt.sig |
| - | # SCRIPT_NAME is the name the scripts will use to identify itself and to mark | + | root@debian12: |
| - | # log messages. | + | ӛS4 |
| - | SCRIPT_NAME="greenbone-feed-sync" | + | |
| + | #0" | ||
| + | | ||
| + | 5?" | ||
| + | ^& | ||
| + | </ | ||
| - | # LOG_CMD defines the command to use for logging. To have logger log to stderr | + | Et pour chiffrer un message en mode ascii, il convient de saisir la commande suivante : |
| - | # as well as syslog, add " | + | |
| - | LOG_CMD=" | + | |
| - | # LOCK_FILE is the name of the file used to lock the feed during sync or update. | + | < |
| - | if [ -z " | + | root@debian12: |
| - | then | + | File ' |
| - | LOCK_FILE=" | + | |
| - | fi | + | |
| + | root@debian12: | ||
| + | -rw-r--r-- 1 root root 55 Nov 28 13:28 message.txt | ||
| + | -rw-r--r-- 1 root root 752 Nov 28 13:38 message.txt.asc | ||
| + | -rw-r--r-- 1 root root 510 Nov 28 13:36 message.txt.gpg | ||
| + | -rw-r--r-- 1 root root 461 Nov 28 13:28 message.txt.sig | ||
| - | ########## GLOBAL VARIABLES | + | root@debian12: |
| - | ########## ================ | + | -----BEGIN PGP MESSAGE----- |
| - | VERSION=@GVMD_VERSION@ | + | hQGMA9ObUzTZ86GvAQwAxAGoxKHBMh53+bPqHs338vhWjxAZs19aItMm+CM2pKu5 |
| + | i4euJ36o+oVfbVTcqVNh4Q8I72QTOYTRTeXRWaUtVjp055A07BtlxGPbps9GXkVv | ||
| + | 1faIs8viwHF1FHDC3Iz/ | ||
| + | ylZxPngzTOR4RDbMbkZ5OvJKXNrOOiHUSDOMmI9o9nu7sxnMiPP3NUqilN/ | ||
| + | xveV/ | ||
| + | 21umlYbcIPtw87+h9twBj7vK5FUi7j8C5QWoDoM4XERf/ | ||
| + | dTaZlgTtxM3CY7/ | ||
| + | bIlrpLbs6yqtjant1bkZ5PuNhB1bRNxrSKZUZKdEMeY5M+C0GjKskjN84+OqgjRV | ||
| + | 39GkfPDwqw/ | ||
| + | PKDwHyTKCGN3NQKOIrw9LbIXehYEdrdFwGizGUXba1EWwVs+qMsmFueoQfcvA19N | ||
| + | CJ2HPuO3qAVIDpYyX+vwdKQASbb8AMQIIksoQv7i | ||
| + | =481C | ||
| + | -----END PGP MESSAGE----- | ||
| + | </ | ||
| - | [ -r " | + | Pour décrypter un message il convient d' |
| - | if [ -z " | + | < |
| - | | + | root@debian12: |
| - | fi | + | gpg: encrypted with 3072-bit RSA key, ID D39B5334D9F3A1AF, |
| + | | ||
| + | # ~/ | ||
| + | Ceci est un message de test pour GnuPG | ||
| + | </ | ||
| - | ACCESSKEY=" | + | =====LAB #3 - Mise en place de SSH et SCP===== |
| - | # Note when running as root or restart as $DROP_USER if defined | + | ====3.1 |
| - | if [ $(id -u) -eq 0 ] | + | |
| - | then | + | |
| - | if [ -z " | + | |
| - | then | + | |
| - | log_notice " | + | |
| - | else | + | |
| - | log_notice " | + | |
| - | su --shell /bin/sh --command "$0 $*" " | + | |
| - | exit $? | + | |
| - | fi | + | |
| - | fi | + | |
| - | # Determine whether a GSF access key is present. If yes, | + | La commande **[[wpfr> |
| - | # then use the Greenbone Security Feed. Else use the | + | |
| - | # Greenbone Community Feed. | + | |
| - | if [ -e $ACCESSKEY | + | |
| - | then | + | |
| - | RESTRICTED=1 | + | |
| - | | + | |
| - | | + | |
| - | | + | * Le **client SSH** |
| + | * ssh ou scp, qui assure la connexion et le dialogue avec le serveur, | ||
| + | * La **session** qui représente la connexion courante et qui commence juste après l' | ||
| + | * Les **clefs** | ||
| + | * **Couple de clef utilisateur asymétriques** et persistantes qui assurent l' | ||
| + | * **Clef hôte asymétrique et persistante** garantissant l' | ||
| + | * **Clef serveur asymétrique et temporaire** utilisée par le protocole SSH1 qui sert au chiffrement de la clé de session, | ||
| + | * **Clef de session symétrique qui est générée aléatoirement** et qui permet le chiiffrement de la communication entre le client et le serveur. Elle est détruite en fin de session. SSH-1 utilise une seule clef tandis que SSH-2 utilise une clef par direction de la communication, | ||
| + | | ||
| - | if [ -z " | + | SSH fonctionne de la manière suivante pour la la mise en place d'un canal sécurisé: |
| - | FEED_HOME=" | + | |
| - | fi | + | |
| - | else | + | * Le client contacte le serveur sur son port 22, |
| - | | + | |
| + | * Le serveur SSH s' | ||
| + | * Sa clé hôte, | ||
| + | * Sa clé serveur, | ||
| + | * Une séquence aléatoire de huit octets à inclure dans les futures réponses du client, | ||
| + | * Une liste de méthodes de chiffrage, compression et authentification, | ||
| + | * Le client et le serveur produisent un identifiant identique, un haché MD5 long de 128 bits contenant la clé hôte, la clé serveur et la séquence aléatoire, | ||
| + | * Le client génère sa clé de session symétrique et la chiffre deux fois de suite, une fois avec la clé hôte du serveur et la deuxième fois avec la clé serveur. Le client envoie cette clé au serveur accompagnée de la séquence aléatoire et un choix d' | ||
| + | * Le serveur déchiffre la clé de session, | ||
| + | * Le client et le serveur mettent en place le canal sécurisé. | ||
| - | if [ -z " | + | ===SSH-1=== |
| - | FEED_VENDOR=" | + | |
| - | fi | + | |
| - | if [ -z " | + | SSH-1 utilise une paire de clefs de type RSA1. Il assure l' |
| - | FEED_HOME=" | + | |
| - | fi | + | |
| - | fi | + | Afin de s' |
| - | RSYNC=`command -v rsync` | + | * **Kerberos**, |
| + | * **Rhosts**, | ||
| + | * **%%RhostsRSA%%**, | ||
| + | * Par **clef asymétrique**, | ||
| + | * **TIS**, | ||
| + | * Par **mot de passe**. | ||
| - | # Current supported feed types (for --type parameter) | + | ===SSH-2=== |
| - | FEED_TYPES_SUPPORTED="CERT, SCAP or GVMD_DATA" | + | |
| - | ########## FUNCTIONS | + | SSH-2 utilise **DSA**, |
| - | ########## ========= | + | |
| - | log_debug () { | + | * **SSH-TRANS** – Transport Layer Protocol, |
| - | | + | |
| - | } | + | * **SSH-CONN** – Connection Protocol. |
| - | log_info () { | + | SSH-2 diffère de SSH-1 essentiellement dans la phase authentification. |
| - | $LOG_CMD | + | |
| - | } | + | |
| - | log_warning () { | + | Trois méthodes d' |
| - | $LOG_CMD -p daemon.warning " | + | |
| - | } | + | |
| - | log_err () { | + | * Par **clef asymétrique**, |
| - | | + | * Identique à SSH-1 sauf avec l' |
| - | } | + | * **%%RhostsRSA%%**, |
| + | * Par **mot de passe**. | ||
| - | init_feed_type () { | + | ===L' |
| - | if [ -z " | + | |
| - | then | + | |
| - | echo "No feed type given to --type parameter" | + | |
| - | log_err "No feed type given to --type parameter" | + | |
| - | exit 1 | + | |
| - | elif [ " | + | |
| - | then | + | |
| - | [ -r " | + | |
| - | FEED_TYPE_LONG=" | + | L' |
| - | FEED_DIR=" | + | |
| - | TIMESTAMP=" | + | |
| - | SCRIPT_ID=" | + | |
| - | if [ -z " | + | Avantage: |
| - | COMMUNITY_RSYNC_FEED=" | + | * Aucune configuration de clef asymétrique n'est nécessaire. |
| - | # An alternative syntax which might work if the above doesn't: | + | |
| - | # COMMUNITY_RSYNC_FEED=" | + | |
| - | else | + | |
| - | COMMUNITY_RSYNC_FEED=" | + | |
| - | fi | + | |
| - | GSF_RSYNC_PATH="/ | + | Inconvénients: |
| + | * L' | ||
| + | * Moins sécurisé qu'un système par clef asymétrique. | ||
| - | if [ -e $ACCESSKEY ]; then | + | ===L' |
| - | if [ -z " | + | |
| - | FEED_NAME=" | + | |
| - | fi | + | |
| - | else | + | |
| - | if [ -z " | + | |
| - | FEED_NAME=" | + | |
| - | fi | + | |
| - | fi | + | |
| - | elif [ " | + | |
| - | then | + | |
| - | [ -r " | + | |
| - | FEED_TYPE_LONG=" | + | * Le **client** envoie au serveur une requête d' |
| - | | + | * Le **serveur** recherche une correspondance pour ce module dans le fichier des clés autorisés **~/ |
| - | | + | |
| - | | + | |
| + | * Le **client** reçoit le challenge et le décrypte avec la partie privée de sa clé. Il combine le challenge avec l' | ||
| + | * Le **serveur** génère le même haché et le compare avec celui reçu du client. Si les deux hachés sont identiques, l' | ||
| - | if [ -z " | + | ====3.2 - Configuration du Serveur==== |
| - | COMMUNITY_RSYNC_FEED=" | + | |
| - | # An alternative syntax which might work if the above doesn' | + | |
| - | # COMMUNITY_RSYNC_FEED=" | + | |
| - | else | + | |
| - | COMMUNITY_RSYNC_FEED=" | + | |
| - | fi | + | |
| - | GSF_RSYNC_PATH=" | + | La configuration du serveur s' |
| - | if [ -e $ACCESSKEY ]; then | + | < |
| - | if [ -z " | + | root@debian12:~# cat /etc/ssh/sshd_config |
| - | FEED_NAME=" | + | |
| - | fi | + | |
| - | else | + | |
| - | if [ -z " | + | |
| - | FEED_NAME=" | + | |
| - | fi | + | |
| - | fi | + | |
| - | elif [ " | + | |
| - | then | + | |
| - | [ -r " | + | |
| - | FEED_TYPE_LONG=" | + | # This is the sshd server system-wide configuration file. See |
| - | | + | # sshd_config(5) for more information. |
| - | TIMESTAMP=" | + | |
| - | SCRIPT_ID=" | + | |
| - | if [ -z " | + | # This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games |
| - | COMMUNITY_RSYNC_FEED=" | + | |
| - | # An alternative syntax which might work if the above doesn' | + | |
| - | # COMMUNITY_RSYNC_FEED=" | + | |
| - | else | + | |
| - | COMMUNITY_RSYNC_FEED=" | + | |
| - | fi | + | |
| - | GSF_RSYNC_PATH="/ | + | # The strategy used for options in the default sshd_config shipped with |
| + | # OpenSSH is to specify options with their default value where | ||
| + | # possible, but leave them commented. | ||
| + | # default value. | ||
| - | if [ -e $ACCESSKEY ]; then | + | Include / |
| - | if [ -z " | + | |
| - | FEED_NAME=" | + | |
| - | fi | + | |
| - | else | + | |
| - | if [ -z " | + | |
| - | FEED_NAME=" | + | |
| - | fi | + | |
| - | fi | + | |
| - | else | + | |
| - | echo " | + | |
| - | log_err " | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | } | + | |
| - | write_feed_xml () { | + | #Port 22 |
| - | if [ -r $TIMESTAMP ] | + | # |
| - | | + | # |
| - | FEED_VERSION=`cat $TIMESTAMP` | + | # |
| - | else | + | |
| - | FEED_VERSION=0 | + | |
| - | fi | + | |
| - | mkdir -p $FEED_DIR | + | # |
| - | echo '< | + | # |
| - | echo "< | + | # |
| - | echo "< | + | |
| - | echo "< | + | |
| - | echo "< | + | |
| - | echo "< | + | |
| - | echo "< | + | |
| - | echo "This script synchronizes a $FEED_TYPE collection with the ' | + | |
| - | echo "The ' | + | |
| - | echo " | + | |
| - | echo "</ | + | |
| - | echo "</ | + | |
| - | } | + | |
| - | create_tmp_key () { | + | # Ciphers and keying |
| - | | + | #RekeyLimit default none |
| - | cp " | + | |
| - | TMPACCESSKEY=" | + | |
| - | chmod 400 " | + | |
| - | } | + | |
| - | remove_tmp_key () { | + | # Logging |
| - | rm -rf " | + | # |
| - | } | + | #LogLevel INFO |
| - | set_interrupt_trap () { | + | # Authentication: |
| - | trap " | + | |
| - | } | + | |
| - | handle_interrupt () { | + | # |
| - | echo " | + | # |
| - | } | + | # |
| + | # | ||
| + | # | ||
| - | do_describe () { | + | # |
| - | echo "This script synchronizes a $FEED_TYPE collection with the ' | + | |
| - | echo "The ' | + | |
| - | echo " | + | |
| - | } | + | |
| - | do_feedversion () { | + | # Expect .ssh/ |
| - | if [ -r $TIMESTAMP ]; then | + | # |
| - | cat $TIMESTAMP | + | |
| - | fi | + | |
| - | } | + | |
| - | # This function uses gos-state-manager to get information about the settings. | + | #AuthorizedPrincipalsFile none |
| - | # gos-state-manager is only available on a Greenbone OS. | + | |
| - | # If gos-state-manager is missing the settings values can not be retrieved. | + | |
| - | # | + | |
| - | # Input: option | + | |
| - | # Output: value as string or empty String if gos-state-manager is not installed | + | |
| - | # or option not set | + | |
| - | get_value () | + | |
| - | { | + | |
| - | value="" | + | |
| - | key=$1 | + | |
| - | if which gos-state-manager 1>/ | + | |
| - | then | + | |
| - | if gos-state-manager get " | + | |
| - | then | + | |
| - | value=" | + | |
| - | fi | + | |
| - | fi | + | |
| - | echo " | + | |
| - | } | + | |
| - | is_feed_current () { | + | # |
| - | if [ -r $TIMESTAMP ] | + | # |
| - | then | + | |
| - | FEED_VERSION=`cat $TIMESTAMP` | + | |
| - | fi | + | |
| - | if [ -z " | + | # For this to work you will also need host keys in / |
| - | then | + | # |
| - | | + | # Change to yes if you don't trust ~/.ssh/ |
| - | | + | # HostbasedAuthentication |
| - | | + | # |
| - | fi | + | # Don't read the user's ~/.rhosts and ~/.shosts files |
| + | # | ||
| - | FEED_INFO_TEMP_DIR=`mktemp -d` | + | # To disable tunneled clear text passwords, change to no here! |
| + | # | ||
| + | # | ||
| - | if [ -e $ACCESSKEY ] | + | # Change to yes to enable challenge-response passwords (beware issues with |
| - | then | + | # some PAM modules and threads) |
| - | read feeduser < $ACCESSKEY | + | KbdInteractiveAuthentication no |
| - | custid_at_host=`head -1 $ACCESSKEY | cut -d : -f 1` | + | |
| - | if [ -z " | + | # Kerberos options |
| - | then | + | # |
| - | | + | # |
| - | rm -rf " | + | # |
| - | exit 1 | + | # |
| - | fi | + | |
| - | gsmproxy=$(get_value proxy_feed | sed -r -e ' | + | # GSSAPI options |
| - | | + | # |
| - | if [ " | + | # |
| - | then | + | # |
| - | | + | # |
| - | fi | + | |
| - | if [ -z " | + | # Set this to ' |
| - | then | + | # and session processing. If this is enabled, PAM authentication will |
| - | | + | # be allowed through the KbdInteractiveAuthentication and |
| - | else | + | # PasswordAuthentication. |
| - | if [ -e $GVM_SYSCONF_DIR/ | + | # PAM authentication via KbdInteractiveAuthentication may bypass |
| - | | + | # the setting of "PermitRootLogin prohibit-password". |
| - | else | + | # If you just want the PAM account and session checks |
| - | RSYNC_SSH_PROXY_CMD=" | + | # PAM authentication, then enable this but set PasswordAuthentication |
| - | fi | + | # and KbdInteractiveAuthentication to ' |
| - | fi | + | UsePAM yes |
| - | create_tmp_key | + | |
| - | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $TMPACCESSKEY" | + | |
| - | if [ $? -ne 0 ] | + | |
| - | then | + | |
| - | log_err "rsync failed, aborting synchronization." | + | |
| - | rm -rf " | + | |
| - | remove_tmp_key | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | remove_tmp_key | + | |
| - | else | + | |
| - | | + | |
| - | # IP blocking due to network equipment in between keeping the previous connection too long open. | + | |
| - | sleep 5 | + | |
| - | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | + | |
| - | eval " | + | |
| - | if [ $? -ne 0 ] | + | |
| - | | + | |
| - | | + | |
| - | rm -rf " | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | fi | + | |
| - | FEED_VERSION_SERVER=`cat " | + | # |
| + | # | ||
| + | # | ||
| + | X11Forwarding yes | ||
| + | # | ||
| + | # | ||
| + | #PermitTTY yes | ||
| + | PrintMotd no | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #UseDNS no | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| - | if [ -z " | + | # no default banner path |
| - | | + | #Banner none |
| - | log_err "Could not determine server feed version." | + | |
| - | rm -rf " | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | | + | # Allow client to pass locale environment variables |
| - | if [ $FEED_VERSION -lt $FEED_VERSION_SERVER ]; then | + | AcceptEnv LANG LC_* |
| - | FEED_CURRENT=0 | + | |
| - | else | + | |
| - | FEED_CURRENT=1 | + | |
| - | fi | + | |
| - | | + | # override default of no subsystems |
| - | | + | Subsystem |
| - | return $FEED_CURRENT | + | # Example of overriding settings on a per-user basis |
| - | } | + | #Match User anoncvs |
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | </ | ||
| - | do_help () { | + | Pour ôter les lignes de commentaires dans ce fichier, utilisez la commande suivante |
| - | echo "$0: Sync feed data" | + | |
| - | if [ -e $ACCESSKEY ] | + | < |
| - | then | + | root@debian12: |
| - | echo "GSF access key found: Using Greenbone Security Feed" | + | |
| - | else | + | |
| - | echo "No GSF access key found: Using Community Feed" | + | |
| - | fi | + | |
| - | echo " --describe | + | root@debian12:/ |
| - | echo " --feedversion | + | Include / |
| - | echo " --help | + | KbdInteractiveAuthentication no |
| - | echo " --identify | + | UsePAM yes |
| - | echo " | + | X11Forwarding yes |
| - | echo " --type | + | PrintMotd no |
| - | echo " --version | + | AcceptEnv LANG LC_* |
| - | echo "" | + | Subsystem |
| - | exit 0 | + | </code> |
| - | } | + | |
| - | do_rsync_community_feed () { | + | Pour sécuriser le serveur ssh, ajoutez ou modifiez les directives suivantes |
| - | if [ -z " | + | |
| - | log_err "rsync not found!" | + | |
| - | else | + | |
| - | # Sleep for five seconds (after is_feed_current) to prevent IP blocking due to | + | |
| - | # network equipment in between keeping the previous connection too long open. | + | |
| - | sleep 5 | + | |
| - | log_notice "Using rsync: $RSYNC" | + | |
| - | log_notice " | + | |
| - | mkdir -p " | + | |
| - | eval " | + | |
| - | if [ $? -ne 0 ]; then | + | |
| - | log_err "rsync failed. Your $FEED_TYPE_LONG might be broken now." | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | fi | + | |
| - | } | + | |
| - | do_sync_community_feed () { | + | < |
| - | if [ -z " | + | AllowGroups adm |
| - | | + | Banner / |
| - | | + | HostbasedAuthentication no |
| - | exit 1 | + | IgnoreRhosts yes |
| - | else | + | LoginGraceTime 60 |
| - | | + | LogLevel INFO |
| - | | + | PermitEmptyPasswords no |
| - | fi | + | PermitRootLogin no |
| - | } | + | PrintLastLog yes |
| + | Protocol 2 | ||
| + | StrictModes yes | ||
| + | X11Forwarding no | ||
| + | </ | ||
| - | sync_feed_data(){ | + | Votre fichier ressemblera à celui-ci : |
| - | if [ -e $ACCESSKEY ] | + | |
| - | then | + | |
| - | log_notice "Found Greenbone Security Feed subscription file, trying to synchronize with Greenbone $FEED_TYPE_LONG Repository ..." | + | |
| - | notsynced=1 | + | |
| - | mkdir -p " | + | <code> |
| - | read feeduser | + | root@debian12:/ |
| - | | + | Include / |
| + | KbdInteractiveAuthentication no | ||
| + | UsePAM yes | ||
| + | PrintMotd no | ||
| + | AcceptEnv LANG LC_* | ||
| + | AllowGroups adm | ||
| + | HostbasedAuthentication no | ||
| + | IgnoreRhosts yes | ||
| + | LoginGraceTime 60 | ||
| + | LogLevel INFO | ||
| + | PermitEmptyPasswords no | ||
| + | PermitRootLogin no | ||
| + | PrintLastLog yes | ||
| + | Protocol 2 | ||
| + | StrictModes yes | ||
| + | X11Forwarding no | ||
| + | Subsystem | ||
| + | </ | ||
| - | if [ -z " | + | Mettez l' |
| - | then | + | |
| - | log_err "Could not determine credentials, | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | while [ 0 -ne " | + | < |
| - | do | + | root@debian12:/ |
| + | trainee : trainee cdrom floppy audio dip video plugdev netdev lpadmin scanner vboxusers | ||
| - | gsmproxy=$(get_value proxy_feed | sed -r -e 's/^.*\/ | + | root@debian12: |
| - | syncport=$(get_value syncport) | + | |
| - | if [ " | + | |
| - | then | + | |
| - | PORT=" | + | |
| - | fi | + | |
| - | if [ -z " | + | root@debian12: |
| - | then | + | trainee : trainee adm cdrom floppy audio dip video plugdev netdev lpadmin scanner vboxusers |
| - | RSYNC_SSH_PROXY_CMD="" | + | </code> |
| - | else | + | |
| - | if [ -e $GVM_SYSCONF_DIR/proxyauth ] && [ -r $GVM_SYSCONF_DIR/ | + | |
| - | | + | |
| - | | + | |
| - | RSYNC_SSH_PROXY_CMD=" | + | |
| - | fi | + | |
| - | fi | + | |
| - | create_tmp_key | + | |
| - | rsync -e "ssh $RSYNC_SSH_OPTS $RSYNC_SSH_PROXY_CMD -p $PORT -i $ACCESSKEY" | + | |
| - | if [ 0 -ne " | + | |
| - | log_err "rsync failed, aborting synchronization." | + | |
| - | remove_tmp_key | + | |
| - | exit 1 | + | |
| - | fi | + | |
| - | remove_tmp_key | + | |
| - | notsynced=0 | + | |
| - | done | + | |
| - | log_notice " | + | |
| - | else | + | |
| - | log_notice "No Greenbone Security Feed access key found, falling back to Greenbone Community Feed" | + | |
| - | do_sync_community_feed | + | |
| - | fi | + | |
| - | write_feed_xml | + | Renommez le fichier **/ |
| - | } | + | |
| - | do_self_test () { | + | < |
| - | if [ -z " | + | root@debian12:/ |
| - | then | + | |
| - | SELFTEST_STDERR=0 | + | |
| - | fi | + | |
| - | if [ -z " | + | root@debian12:/ |
| - | | + | </code> |
| - | if [ 0 -ne $SELFTEST_STDERR ] | + | |
| - | then | + | |
| - | echo "rsync not found (required)." | + | |
| - | fi | + | |
| - | log_err "rsync not found (required)." | + | |
| - | SELFTEST_FAIL=1 | + | |
| - | fi | + | |
| - | } | + | |
| + | Redémarrez ensuite le serveur ssh : | ||
| - | ########## START | + | < |
| - | ########## ===== | + | root@debian12:/ |
| - | while test $# -gt 0; do | + | root@debian12:/ |
| - | case " | + | ● ssh.service |
| - | "--version" | + | |
| - | if [ -z " | + | Active: active (running) since Fri 2025-11-28 15:18:55 CET; 7s ago |
| - | | + | Docs: man:sshd(8) |
| - | fi | + | man: |
| - | ;; | + | |
| - | | + | Main PID: 10883 (sshd) |
| - | | + | |
| - | | + | Memory: 1.4M |
| - | ;; | + | CPU: 28ms |
| - | " | + | |
| - | | + | └─10883 |
| - | shift | + | |
| - | ;; | + | |
| - | esac | + | |
| - | shift | + | |
| - | done | + | |
| - | init_feed_type | + | Nov 28 15:18:55 debian12 systemd[1]: Starting ssh.service - OpenBSD Secure Shell server... |
| + | Nov 28 15:18:55 debian12 sshd[10883]: | ||
| + | Nov 28 15:18:55 debian12 sshd[10883]: | ||
| + | Nov 28 15:18:55 debian12 systemd[1]: Started ssh.service - OpenBSD Secure Shell server. | ||
| + | </ | ||
| - | write_feed_xml | + | Pour générer les clefs sur le serveur saisissez la commande suivante en tant que **root**: |
| - | case " | + | <WRAP center round important 50%> |
| - | --version) | + | **Important** |
| - | echo $VERSION | + | </ |
| - | exit 0 | + | |
| - | ;; | + | |
| - | --identify) | + | |
| - | echo " | + | |
| - | exit 0 | + | |
| - | ;; | + | |
| - | --describe) | + | |
| - | do_describe | + | |
| - | exit 0 | + | |
| - | ;; | + | |
| - | --feedversion) | + | |
| - | do_feedversion | + | |
| - | exit 0 | + | |
| - | ;; | + | |
| - | --selftest) | + | |
| - | SELFTEST_FAIL=0 | + | |
| - | SELFTEST_STDERR=1 | + | |
| - | do_self_test | + | |
| - | exit $SELFTEST_FAIL | + | |
| - | ;; | + | |
| - | --feedcurrent) | + | |
| - | is_feed_current | + | |
| - | exit $? | + | |
| - | ;; | + | |
| - | esac | + | |
| - | SELFTEST_FAIL=0 | + | < |
| - | do_self_test | + | root@debian12:/ |
| - | if [ $SELFTEST_FAIL | + | Generating public/ |
| - | then | + | Enter file in which to save the key (/ |
| - | exit 1 | + | Enter passphrase (empty for no passphrase): |
| - | fi | + | Enter same passphrase again: |
| - | + | Your identification has been saved in / | |
| - | is_feed_current | + | Your public key has been saved in / |
| - | if [ $FEED_CURRENT -eq 1 ] | + | The key fingerprint |
| - | then | + | SHA256: |
| - | log_notice " | + | The key's randomart image is: |
| - | exit 0 | + | +---[DSA 1024]----+ |
| - | fi | + | | o++o.. | |
| - | ( | + | | |
| - | chmod +660 $LOCK_FILE | + | | .o++=.o |
| - | flock -n 9 | + | | o. o.+=. .| |
| - | if [ $? -eq 1 ]; then | + | | o.S+ +.=.o | |
| - | | + | | .= + =oB | |
| - | | + | | .+ +.* + | |
| - | | + | | .. .+o E| |
| - | date > $LOCK_FILE | + | | ..o .o | |
| - | | + | +----[SHA256]-----+ |
| - | | + | |
| - | ) 9>> | + | |
| - | + | ||
| - | exit 0 | + | |
| </ | </ | ||
| - | Rendez | + | <WRAP center round important 50%> |
| + | **Important** - Le chemin à indiquer pour le fichier est **/ | ||
| + | </ | ||
| + | |||
| + | Les clefs publiques générées possèdent l' | ||
| < | < | ||
| - | [root@centos7 ~]# chmod +x greenbone-feed-sync | + | root@debian12:/ |
| + | moduli | ||
| + | ssh_config | ||
| </ | </ | ||
| - | Déplacez | + | Re-démarrez ensuite |
| < | < | ||
| - | [root@centos7 ~]# mv greenbone-feed-sync /usr/sbin/ | + | root@debian12:/ |
| </ | </ | ||
| - | Créez le répertoire | + | Saisissez maintenant les commandes suivantes en tant que **trainee** : |
| - | <code> | + | <WRAP center round important 50%> |
| - | [root@centos7 ~]# mkdir / | + | **Important** |
| - | </code> | + | </WRAP> |
| - | + | ||
| - | Devenez l' | + | |
| < | < | ||
| - | [root@centos7 ~]# su - trainee | + | root@debian12:/ |
| - | Last login: Mon Dec 1 17:30:45 CET 2025 on pts/0 | + | logout |
| - | [trainee@centos7 | + | trainee@debian12:~$ ssh-keygen -t dsa |
| + | Generating public/private dsa key pair. | ||
| + | Enter file in which to save the key (/home/trainee/.ssh/ | ||
| + | Created directory '/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | SHA256: | ||
| + | The key's randomart image is: | ||
| + | +---[DSA 1024]----+ | ||
| + | | o=o**| | ||
| + | | | ||
| + | | + =+.| | ||
| + | | + o *o| | ||
| + | | S = * o =| | ||
| + | | o % + =o| | ||
| + | | = * =.=| | ||
| + | | o o *+| | ||
| + | | ..o *| | ||
| + | +----[SHA256]-----+ | ||
| - | [trainee@centos7 | + | trainee@debian12:~$ ssh-keygen |
| - | Greenbone community feed server - http://feed.community.greenbone.net/ | + | Generating public/ |
| - | This service | + | Enter file in which to save the key (/ |
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in /home/ | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint | ||
| + | SHA256: | ||
| + | The key's randomart image is: | ||
| + | +---[RSA 3072]----+ | ||
| + | | | ||
| + | |.. .+=.. | | ||
| + | |= o o + | | ||
| + | | = + . o | | ||
| + | | = .. S . o | | ||
| + | | o +o.++.+ * | | ||
| + | | + *++=+ + o | | ||
| + | | | ||
| + | | .o. | ||
| + | +----[SHA256]-----+ | ||
| - | All transactions are logged. | + | trainee@debian12: |
| + | Generating public/ | ||
| + | Enter file in which to save the key (/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in / | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | SHA256: | ||
| + | The key's randomart image is: | ||
| + | +---[ECDSA 256]---+ | ||
| + | | o | | ||
| + | | . + | | ||
| + | | + + | | ||
| + | | * = = | | ||
| + | | . + = S . | | ||
| + | | .+ +.o.. | | ||
| + | | .Eo+*.++ | ||
| + | |o +o* BO . | | ||
| + | |+B+*++oo* | ||
| + | +----[SHA256]-----+ | ||
| - | If you have any questions, please use the Greenbone community portal. | + | trainee@debian12: |
| - | See https://community.greenbone.net for details. | + | Generating public/ |
| + | Enter file in which to save the key (/ | ||
| + | Enter passphrase (empty for no passphrase): | ||
| + | Enter same passphrase again: | ||
| + | Your identification has been saved in /home/ | ||
| + | Your public key has been saved in / | ||
| + | The key fingerprint is: | ||
| + | SHA256: | ||
| + | The key's randomart image is: | ||
| + | +--[ED25519 256]--+ | ||
| + | | ....o | | ||
| + | | +.. . . | | ||
| + | |=o* | ||
| + | |oO+. + + | ||
| + | |*.=.. = S | ||
| + | |o+.+ . | ||
| + | |.=+..E. o o o | | ||
| + | |+ ++o..+ | ||
| + | | oo+ .o.. | | ||
| + | +----[SHA256]-----+ | ||
| + | </ | ||
| - | By using this service you agree to our terms and conditions. | + | <WRAP center round important 50%> |
| + | **Important** - Les clés générées seront placées dans le répertoire **~/.ssh/**. | ||
| + | </ | ||
| - | Only one sync per time, otherwise the source ip will be temporarily blocked. | + | ====3.3 - Utilisation==== |
| + | La commande ssh prend la forme suivante: | ||
| - | receiving incremental file list | + | |
| - | timestamp | + | |
| - | 13 100% | + | |
| - | sent 43 bytes received 108 bytes 100.67 bytes/sec | + | En saisissant cette commande sur votre propre machine, vous obtiendrez un résultat similaire à celle-ci : |
| - | total size is 13 speedup is 0.09 | + | |
| - | Greenbone community feed server | + | |
| - | This service is hosted by Greenbone Networks - http:// | + | |
| - | All transactions are logged. | + | < |
| + | trainee@debian12: | ||
| + | Password: fenestros | ||
| + | root@debian12: | ||
| - | If you have any questions, please use the Greenbone community portal. | + | root@debian12: |
| - | See https://community.greenbone.net for details. | + | The authenticity of host ' |
| + | ED25519 key fingerprint is SHA256:SS9CpX7JFHIB54TWQWTtyswnwaXZ/Y8Kvr6dxPtisgE. | ||
| + | This key is not known by any other names. | ||
| + | Are you sure you want to continue connecting (yes/no/ | ||
| + | Warning: Permanently added ' | ||
| + | trainee@localhost' | ||
| + | Linux debian12 6.1.0-41-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.158-1 (2025-11-09) x86_64 | ||
| - | By using this service you agree to our terms and conditions. | + | The programs included with the Debian GNU/Linux system are free software; |
| + | the exact distribution | ||
| + | individual files in / | ||
| - | Only one sync per time, otherwise | + | Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent |
| + | permitted by applicable law. | ||
| + | Last login: Thu Nov 27 17:21:12 2025 from 10.0.2.1 | ||
| + | </ | ||
| + | ====3.4 - Mise en place des clefs==== | ||
| - | receiving incremental file list | + | Il convient maintenant de se connecter sur le << |
| - | ./ | + | |
| - | COPYING | + | |
| - | 1,187 100% 1.13MB/ | + | |
| - | nvdcve-2.0-2002.xml | + | |
| - | | + | |
| - | nvdcve-2.0-2003.xml | + | |
| - | 4,744,330 100% | + | |
| - | nvdcve-2.0-2004.xml | + | |
| - | 9,416,639 100% | + | |
| - | nvdcve-2.0-2005.xml | + | |
| - | | + | |
| - | nvdcve-2.0-2006.xml | + | |
| - | | + | |
| - | nvdcve-2.0-2007.xml | + | |
| - | | + | |
| - | nvdcve-2.0-2008.xml | + | |
| - | | + | |
| - | nvdcve-2.0-2009.xml | + | |
| - | | + | |
| - | nvdcve-2.0-2010.xml | + | |
| - | | + | |
| - | nvdcve-2.0-2011.xml | + | |
| - | | + | |
| - | nvdcve-2.0-2012.xml | + | |
| - | | + | |
| - | nvdcve-2.0-2013.xml | + | |
| - | | + | |
| - | nvdcve-2.0-2014.xml | + | |
| - | | + | |
| - | nvdcve-2.0-2015.xml | + | |
| - | 124,671,234 100% 227.33MB/ | + | |
| - | nvdcve-2.0-2016.xml | + | |
| - | 161,692,009 100% 172.29MB/ | + | |
| - | nvdcve-2.0-2017.xml | + | |
| - | 189,948,654 100% 141.52MB/ | + | |
| - | nvdcve-2.0-2018.xml | + | |
| - | 210,761,959 100% 156.30MB/ | + | |
| - | nvdcve-2.0-2019.xml | + | |
| - | 265,685,784 100% 172.95MB/ | + | |
| - | nvdcve-2.0-2020.xml | + | |
| - | 294,835,369 100% 134.53MB/ | + | |
| - | nvdcve-2.0-2021.xml | + | |
| - | 442,673,740 100% 155.72MB/ | + | |
| - | nvdcve-2.0-2022.xml | + | |
| - | 743,192,055 100% 111.53MB/ | + | |
| - | nvdcve-2.0-2023.xml | + | |
| - | 599,785,077 100% | + | |
| - | nvdcve-2.0-2024.xml | + | |
| - | 922,757,332 100% | + | |
| - | nvdcve-2.0-2025.xml | + | |
| - | 480,360,705 100% 127.96MB/ | + | |
| - | official-cpe-dictionary_v2.2.xml | + | |
| - | 784,852,577 100% 251.59MB/ | + | |
| - | timestamp | + | |
| - | 13 100% | + | |
| - | sent 2,186,887 bytes received 11,127,079 bytes 117,303.67 bytes/sec | + | En saisissant cette commande, vous obtiendrez une fenêtre similaire à celle-ci : |
| - | total size is 5, | + | |
| - | [trainee@centos7 | + | < |
| + | root@debian12:~# exit | ||
| + | logout | ||
| - | [trainee@centos7 | + | trainee@debian12:~$ ssh -l trainee 127.0.0.1 |
| - | </ | + | trainee@127.0.0.1' |
| + | Linux debian12 6.1.0-41-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.158-1 (2025-11-09) x86_64 | ||
| - | <WRAP center round important 50%> | + | The programs included with the Debian GNU/Linux system are free software; |
| - | **Important** - En cas d' | + | the exact distribution terms for each program are described in the |
| - | </WRAP> | + | individual files in /usr/ |
| - | Exécutez de nouveau la commande **openvas-check-setup** | + | Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent |
| + | permitted by applicable law. | ||
| + | Last login: Fri Nov 28 15:31:58 2025 from 10.0.2.46 | ||
| - | < | + | trainee@debian12:~$ ls -la | grep .ssh |
| - | [root@centos7 | + | drwx------ |
| - | ... | + | |
| - | Step 2: Checking OpenVAS Manager ... | + | |
| - | OK: OpenVAS Manager is present in version 6.0.9. | + | |
| - | OK: OpenVAS Manager client certificate is present as / | + | |
| - | OK: OpenVAS Manager database found in / | + | |
| - | OK: Access rights for the OpenVAS Manager database are correct. | + | |
| - | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. | + | |
| - | OK: OpenVAS Manager database is at revision 146. | + | |
| - | OK: OpenVAS Manager expects database at revision 146. | + | |
| - | OK: Database schema is up to date. | + | |
| - | OK: OpenVAS Manager database contains information about 45654 NVTs. | + | |
| - | OK: At least one user exists. | + | |
| - | OK: OpenVAS SCAP database found in / | + | |
| - | ERROR: No OpenVAS CERT database found. (Tried: / | + | |
| - | FIX: Run a CERT synchronization script like openvas-certdata-sync or greenbone-certdata-sync. | + | |
| - | ERROR: Your OpenVAS-8 installation is not yet complete! | + | trainee@debian12:~$ exit |
| - | ... | + | logout |
| + | Connection to 127.0.0.1 closed. | ||
| </ | </ | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Notez l'erreur | + | **Important** - Si le dossier distant .ssh n' |
| </ | </ | ||
| - | Créez | + | Ensuite, il convient de transférer |
| < | < | ||
| - | [root@centos7 | + | trainee@debian12:~$ scp .ssh/id_ecdsa.pub trainee@127.0.0.1: |
| + | trainee@127.0.0.1' | ||
| + | id_ecdsa.pub | ||
| </ | </ | ||
| - | Exécutez la commande **openvas-certdata-sync** | + | Connectez-vous via ssh et insérer les clefs publiques restantes dans le fichier .ssh/ |
| < | < | ||
| - | [root@centos7 | + | trainee@debian12:~$ ssh -l trainee localhost |
| - | </ | + | Linux debian12 6.1.0-41-amd64 |
| - | Exécutez encore une fois la commande | + | The programs included with the Debian GNU/Linux system are free software; |
| + | the exact distribution terms for each program are described in the | ||
| + | individual files in / | ||
| - | < | + | Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent |
| - | [root@centos7 ~]# openvas-check-setup | + | permitted by applicable law. |
| - | openvas-check-setup 2.3.3 | + | Last login: Fri Nov 28 15:57:32 2025 from 127.0.0.1 |
| - | Test completeness and readiness of OpenVAS-8 | + | |
| - | (add ' | + | |
| - | if you want to check for another OpenVAS version) | + | |
| - | Please report us any non-detected problems and | + | trainee@debian12:~$ cat .ssh/id_rsa.pub >> |
| - | help us to improve this check routine: | + | |
| - | http://lists.wald.intevation.org/ | + | |
| - | Send us the log-file (/tmp/ | + | trainee@debian12: |
| - | Use the parameter --server to skip checks for client tools | + | trainee@debian12: |
| - | like GSD and OpenVAS-CLI. | + | |
| - | Step 1: Checking OpenVAS Scanner | + | trainee@debian12:~$ cat .ssh/authorized_keys |
| - | OK: OpenVAS Scanner is present in version 5.0.6. | + | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBwIXLMYJtWVgqSTqJfsFjS2ubtP+mHkC7XRU1rBWTBLYoJp8VOwtpKK1NTFSaeJhnjCvFuhYm8egqHI0gp3oBA= trainee@debian12 |
| - | OK: OpenVAS Scanner CA Certificate is present as /etc/ | + | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDcV1OmeHZlWhLumCozdg7snul5MrkzhZjiUKWNJmGBBOauOq2CgMGYWYIhjyeVeaeiezq+wSe0jO09p8a1EbvYUibJsY9FOi8JcXTpxvlcqpuawudErjSsOf6JaIlbGpwDIMzmjeubfQx9jMZzfQIW9zfTDUi2tGquR/1TQPocGmmI9JFtoMqylk4+KsIHpriMBEVD/aKiGr1wjLHR1v3er8P1o8YOd+9tZXouJxWLHIA1swrnpXt8doVWYGx0E9jWsScqI4JPTy8kb2hfWeZWqONIqgJty0kOeTt6IynOauf9fSjxOG9Y4jyTV/OvTrBrmOCabjTIVMaIOWjLIPjNKJ8+eLnv+FuKUCc9mrAjbkXaP8T3JF43ofaBgSk09S3yo6wI3XI8ZlgROLDt7xxbFKosK/tYe8uOkpladNQHq3+EhAmzsfZJIstY0tNeK7aQ2KlsH6hZkLpqHsoKdzsLhRpMuPnV7wNlrikrbcvousDdQBpnzhNaXcm2BW+jmOs= trainee@debian12 |
| - | OK: redis-server is present in version v=3.2.12. | + | ssh-dss AAAAB3NzaC1kc3MAAACBAMbFW6WkZFJ/ueao6xjxBb+wbbIhIyiH/GM6W/7ayiNmCfFlYCxw9nNAVghYJYNcP2hB+l0qZ0JYrOMUX82sXAvtYbbO1xSZWNTTrbYEyR+o2ZWlgYBDz0DYj++dLCl0zCGHOfRq2VHtCx93mCxCiw5NXNflxOuy2WoY7hawxV/RAAAAFQDURMf0f29i5or5GrE4JWlFVZbiIwAAAIBqGpwpz+uQTKpJmgiisVA1t/0MRP2YstUVnU29Nr/C7EJ3bom3wx4At/bbQEfc7iVf0pwRUSJhdTy4t2vnFWghoeoj2ALUA4QVarVr7m0TY7m8bYgAlPVBx674DDmHfUh99PTwYcrcJUJMpVd+mwVccnXGigpHhs84QvD6csmxCwAAAIAEtC/YVdYAxFUd+ScG0zrBSsPHA/cigCF5cywNeu+OZqrK2y6yiJwp9T9bCL2nvzTWeTg/2Ev7v7Zh2oNKE5/mUoTDDn22omefi9Ecxl9W6Pyi8R6PxV+8mXtjHKPVNEQyqA8tAG1VN33MMgWz5HUEdwdUrOcmrkpyXNsRzvgD6w== trainee@debian12 |
| - | OK: scanner (kb_location setting) is configured properly using the redis-server socket: | + | ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILP736HSOOTZBe6+CHy8PINQ4gb9kKB4xj0JWWZy1Wgl trainee@debian12 |
| - | OK: redis-server is running and listening on socket: | + | |
| - | OK: redis-server configuration is OK and redis-server is running. | + | |
| - | OK: NVT collection in /var/lib/openvas/plugins contains 138097 NVTs. | + | |
| - | WARNING: Signature checking of NVTs is not enabled in OpenVAS Scanner. | + | |
| - | SUGGEST: Enable signature checking (see http://www.openvas.org/trusted-nvts.html). | + | |
| - | OK: The NVT cache in /var/cache/openvas contains 138097 files for 138097 NVTs. | + | |
| - | Step 2: Checking OpenVAS Manager ... | + | |
| - | OK: OpenVAS Manager is present in version 6.0.9. | + | |
| - | OK: OpenVAS Manager client certificate is present as /etc/ | + | |
| - | OK: OpenVAS Manager database found in / | + | |
| - | OK: Access rights for the OpenVAS Manager database are correct. | + | |
| - | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. | + | |
| - | OK: OpenVAS Manager database is at revision 146. | + | |
| - | OK: OpenVAS Manager expects database at revision 146. | + | |
| - | OK: Database schema is up to date. | + | |
| - | OK: OpenVAS Manager database contains information about 138097 NVTs. | + | |
| - | OK: At least one user exists. | + | |
| - | OK: OpenVAS SCAP database found in / | + | |
| - | OK: OpenVAS CERT database found in / | + | |
| - | OK: xsltproc found. | + | |
| - | Step 3: Checking user configuration ... | + | |
| - | WARNING: Your password policy is empty. | + | |
| - | SUGGEST: Edit the / | + | |
| - | Step 4: Checking Greenbone Security Assistant (GSA) ... | + | |
| - | OK: Greenbone Security Assistant is present in version 6.0.11. | + | |
| - | Step 5: Checking OpenVAS CLI ... | + | |
| - | OK: OpenVAS CLI version 1.4.4. | + | |
| - | Step 6: Checking Greenbone Security Desktop (GSD) ... | + | |
| - | SKIP: Skipping check for Greenbone Security Desktop. | + | |
| - | Step 7: Checking if OpenVAS services are up and running ... | + | |
| - | OK: netstat found, extended checks of the OpenVAS services enabled. | + | |
| - | OK: OpenVAS Scanner is running and listening on all interfaces. | + | |
| - | OK: OpenVAS Scanner is listening on port 9391, which is the default port. | + | |
| - | ERROR: OpenVAS Manager is NOT running! | + | |
| - | FIX: Start OpenVAS Manager (openvasmd). | + | |
| - | ERROR: Greenbone Security Assistant is NOT running! | + | |
| - | FIX: Start Greenbone Security Assistant (gsad). | + | |
| - | + | ||
| - | | + | |
| - | + | ||
| - | Please follow the instructions marked with FIX above and run this | + | |
| - | script again. | + | |
| - | + | ||
| - | If you think this result is wrong, please report your observation | + | |
| - | and help us to improve this check routine: | + | |
| - | http:// | + | |
| - | Please attach the log-file (/ | + | |
| </ | </ | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Notez l'erreur **ERROR: Greenbone Security Assistant is NOT running!.** | + | **Important** - Notez que lors de la connexion au serveur, |
| </ | </ | ||
| - | Activer et démarrer OpenVAS Manager | + | ===Options de la commande=== |
| + | |||
| + | Les options de cette commande sont : | ||
| < | < | ||
| - | [root@centos7 | + | trainee@debian12:~$ ssh --help |
| - | Created symlink from / | + | unknown option -- - |
| + | usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface] | ||
| + | [-b bind_address] [-c cipher_spec] [-D [bind_address: | ||
| + | [-E log_file] [-e escape_char] [-F configfile] [-I pkcs11] | ||
| + | [-i identity_file] [-J [user@]host[: | ||
| + | [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port] | ||
| + | [-Q query_option] [-R address] [-S ctl_path] [-W host: | ||
| + | [-w local_tun[: | ||
| + | </ | ||
| - | [root@centos7 ~]# systemctl start openvas-manager | + | ====3.5 |
| - | [root@centos7 ~]# systemctl status openvas-manager | + | Le protocole SSH peut être utilisé pour sécuriser les protocoles tels telnet, pop3 etc.. En effet, on peut créer un //tunnel// SSH dans lequel passe les communications du protocole non-sécurisé. |
| - | ● openvas-manager.service - OpenVAS Manager | + | |
| - | | + | |
| - | | + | |
| - | Process: 12237 ExecStart=/usr/sbin/openvasmd $MANAGER_LISTEN $MANAGER_PORT $SCANNER_LISTEN $SCANNER_PORT $MANAGER_OTP (code=exited, | + | |
| - | Main PID: 12238 (openvasmd) | + | |
| - | | + | |
| - | | + | |
| - | Dec 02 11:51:41 centos7.fenestros.loc systemd[1]: Starting OpenVAS Manager... | + | La commande pour créer un tunnel ssh prend la forme suivante |
| - | Dec 02 11:51:41 centos7.fenestros.loc systemd[1]: Started OpenVAS Manager. | + | |
| - | </code> | + | ssh -N -f compte@< |
| - | Activer | + | Dans votre cas, vous allez créer un tunnel entre Debian 12 et CentOS 8 entre le port 15023 et le port 23 : |
| < | < | ||
| - | [root@centos7 | + | trainee@debian12:~$ su - |
| - | Created symlink from / | + | Password: fenestros |
| - | [root@centos7 | + | root@debian12:~# ssh -N -f trainee@localhost |
| - | + | ||
| - | [root@centos7 ~]# systemctl status openvas-gsa | + | |
| - | ● openvas-gsa.service - OpenVAS Greenbone Security Assistant | + | |
| - | | + | |
| - | | + | |
| - | Process: 12948 ExecStart=/ | + | |
| - | Main PID: 12949 (gsad) | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | Dec 02 11:53:08 centos7.fenestros.loc systemd[1]: Starting OpenVAS Greenbone Security Assistant... | + | |
| - | Dec 02 11:53:08 centos7.fenestros.loc systemd[1]: Started OpenVAS Greenbone Security Assistant. | + | |
| </ | </ | ||
| - | Exécutez encore une fois la commande **openvas-check-setup** | + | Installez maintenant le client et le serveur telnet dans la VM CentOS 8: |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# ssh -l trainee 10.0.2.45 |
| - | openvas-check-setup 2.3.3 | + | The authenticity |
| - | Test completeness and readiness | + | ED25519 key fingerprint is SHA256: |
| - | | + | This key is not known by any other names. |
| - | if you want to check for another OpenVAS version) | + | Are you sure you want to continue connecting (yes/ |
| + | Warning: Permanently added ' | ||
| + | trainee@10.0.2.45' | ||
| + | Activate the web console with: systemctl enable --now cockpit.socket | ||
| - | Please report us any non-detected problems and | + | Last login: Thu Nov 6 04:13:03 2025 from 10.0.2.45 |
| - | help us to improve this check routine: | + | |
| - | http://lists.wald.intevation.org/ | + | |
| - | Send us the log-file (/ | + | [trainee@centos8 ~]$ su - |
| + | Password: fenestros | ||
| - | Use the parameter --server | + | [root@centos8 ~]# dnf install telnet-server |
| - | like GSD and OpenVAS-CLI. | + | |
| - | + | ||
| - | Step 1: Checking OpenVAS Scanner ... | + | |
| - | OK: OpenVAS Scanner is present in version 5.0.6. | + | |
| - | OK: OpenVAS Scanner CA Certificate is present as / | + | |
| - | OK: redis-server is present in version v=3.2.12. | + | |
| - | OK: scanner (kb_location setting) is configured properly using the redis-server socket: / | + | |
| - | OK: redis-server is running and listening on socket: / | + | |
| - | OK: redis-server configuration is OK and redis-server is running. | + | |
| - | OK: NVT collection in / | + | |
| - | WARNING: Signature checking of NVTs is not enabled in OpenVAS Scanner. | + | |
| - | SUGGEST: Enable signature checking (see http:// | + | |
| - | OK: The NVT cache in / | + | |
| - | Step 2: Checking OpenVAS Manager ... | + | |
| - | OK: OpenVAS Manager is present in version 6.0.9. | + | |
| - | OK: OpenVAS Manager client certificate is present as / | + | |
| - | OK: OpenVAS Manager database found in / | + | |
| - | OK: Access rights for the OpenVAS Manager database are correct. | + | |
| - | OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled. | + | |
| - | OK: OpenVAS Manager database is at revision 146. | + | |
| - | OK: OpenVAS Manager expects database at revision 146. | + | |
| - | OK: Database schema is up to date. | + | |
| - | OK: OpenVAS Manager database contains information about 138097 NVTs. | + | |
| - | OK: At least one user exists. | + | |
| - | OK: OpenVAS SCAP database found in / | + | |
| - | OK: OpenVAS CERT database found in / | + | |
| - | OK: xsltproc found. | + | |
| - | Step 3: Checking user configuration ... | + | |
| - | WARNING: Your password policy is empty. | + | |
| - | SUGGEST: Edit the / | + | |
| - | Step 4: Checking Greenbone Security Assistant (GSA) ... | + | |
| - | OK: Greenbone Security Assistant is present in version 6.0.11. | + | |
| - | Step 5: Checking OpenVAS CLI ... | + | |
| - | OK: OpenVAS CLI version 1.4.4. | + | |
| - | Step 6: Checking Greenbone Security Desktop (GSD) ... | + | |
| - | SKIP: Skipping check for Greenbone Security Desktop. | + | |
| - | Step 7: Checking if OpenVAS services are up and running ... | + | |
| - | OK: netstat found, extended checks of the OpenVAS services enabled. | + | |
| - | OK: OpenVAS Scanner is running and listening on all interfaces. | + | |
| - | OK: OpenVAS Scanner is listening on port 9391, which is the default port. | + | |
| - | OK: OpenVAS Manager is running and listening on all interfaces. | + | |
| - | OK: OpenVAS Manager is listening on port 9390, which is the default port. | + | |
| - | OK: Greenbone Security Assistant is listening on port 80, which is the default port. | + | |
| - | Step 8: Checking nmap installation ... | + | |
| - | WARNING: No nmap installation found. | + | |
| - | SUGGEST: You should install nmap for comprehensive network scanning (see http:// | + | |
| - | Step 10: Checking presence of optional tools ... | + | |
| - | WARNING: Could not find pdflatex binary, the PDF report format will not work. | + | |
| - | SUGGEST: Install pdflatex. | + | |
| - | OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work. | + | |
| - | OK: rpm found, LSC credential package generation for RPM based targets is likely to work. | + | |
| - | WARNING: Could not find alien binary, LSC credential package generation for DEB based targets will not work. | + | |
| - | SUGGEST: Install alien. | + | |
| - | WARNING: Could not find makensis binary, LSC credential package generation for Microsoft Windows targets will not work. | + | |
| - | SUGGEST: Install nsis. | + | |
| - | OK: SELinux is disabled. | + | |
| - | + | ||
| - | It seems like your OpenVAS-8 installation is OK. | + | |
| - | + | ||
| - | If you think it is not OK, please report your observation | + | |
| - | and help us to improve this check routine: | + | |
| - | http:// | + | |
| - | Please attach the log-file (/ | + | |
| </ | </ | ||
| - | <WRAP center round important 50%> | + | Telnet n'est ni démarré ni activé. Il convient donc de le démarrer et de l' |
| - | **Important** - Notez les WARNINGS. | + | |
| - | </ | + | |
| - | + | ||
| - | Installez les paquets suggérés | + | |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | </code> | + | ● telnet.socket |
| + | Loaded: loaded (/usr/ | ||
| + | | ||
| + | Docs: man: | ||
| + | | ||
| + | | ||
| - | Exécutez de nouveau la commande **openvas-check-setup** : | + | [root@centos8 ~]# systemctl start telnet.socket |
| - | < | + | [root@centos8 |
| - | [root@centos7 | + | ● telnet.socket - Telnet Server Activation Socket |
| - | ... | + | Loaded: loaded (/ |
| - | Step 10: Checking presence of optional tools ... | + | Active: active (listening) since Fri 2025-11-28 09:42:52 EST; 2s ago |
| - | OK: pdflatex found. | + | Docs: man: |
| - | WARNING: PDF generation failed, most likely due to missing LaTeX packages. The PDF report format will not work. | + | Listen: [::]:23 (Stream) |
| - | | + | Accepted: 0; Connected: 0; |
| - | OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work. | + | CGroup: /system.slice/ |
| - | OK: rpm found, LSC credential package generation for RPM based targets is likely to work. | + | |
| - | OK: alien found, LSC credential package generation for DEB based targets is likely to work. | + | |
| - | | + | |
| - | | + | |
| - | OK: SELinux is disabled. | + | |
| - | It seems like your OpenVAS-8 installation is OK. | + | Nov 28 09:42:52 centos8.ittraining.loc systemd[1]: Listening on Telnet Server Activation Socket. |
| - | ... | + | |
| - | </ | + | |
| - | <WRAP center round important 50%> | + | [root@centos8 ~]# systemctl enable telnet.socket |
| - | **Important** - Notez la ligne **WARNING: PDF generation failed, most likely due to missing LaTeX packages. The PDF report format will not work.** | + | Created symlink / |
| - | </WRAP> | + | |
| - | Pour pouvoir utiliser les rapports au format PDF, installez les paquets suivants | + | [root@centos8 ~]# systemctl status telnet.socket |
| + | ● telnet.socket - Telnet Server Activation Socket | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | | ||
| + | | ||
| + | | ||
| - | < | + | Nov 28 09:42:52 centos8.ittraining.loc systemd[1]: Listening on Telnet Server Activation Socket. |
| - | [root@centos7 ~]# yum -y install texlive-collection-fontsrecommended texlive-collection-latexrecommended texlive-changepage texlive-titlesec -y | + | |
| </ | </ | ||
| - | Téléchargez ensuite | + | Arrêtez |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | [root@centos7 | + | [root@centos8 |
| + | Chain INPUT (policy ACCEPT) | ||
| + | target | ||
| - | [root@centos7 comment]# wget http:// | + | Chain FORWARD |
| - | --2025-12-02 13: | + | target |
| - | Resolving mirrors.ctan.org (mirrors.ctan.org)... 89.58.7.101, | + | |
| - | Connecting to mirrors.ctan.org (mirrors.ctan.org)|89.58.7.101|: | + | |
| - | HTTP request sent, awaiting response... 307 Temporary Redirect | + | |
| - | Location: https:// | + | |
| - | --2025-12-02 13: | + | |
| - | Resolving mirror.its.dal.ca (mirror.its.dal.ca)... 192.75.96.254 | + | |
| - | Connecting to mirror.its.dal.ca (mirror.its.dal.ca)|192.75.96.254|: | + | |
| - | HTTP request sent, awaiting response... 200 OK | + | |
| - | Length: 10197 (10.0K) [application/ | + | |
| - | Saving to: ‘comment.sty’ | + | |
| - | 100%[========================================================================================================================================================================> | + | Chain OUTPUT (policy ACCEPT) |
| + | target | ||
| + | </code> | ||
| - | 2025-12-02 13:35:43 (175 MB/s) - ‘comment.sty’ saved [10197/ | + | Connectez-vous ensuite via telnet sur CentOS 8 en utilisant le port 15023 de votre VM Debian |
| - | [root@centos7 comment]# chmod 644 comment.sty | + | < |
| + | root@debian12:~# telnet localhost 15023 | ||
| + | Trying ::1... | ||
| + | Connected to localhost. | ||
| + | Escape character is ' | ||
| - | [root@centos7 comment]# texhash | + | Kernel 4.18.0-348.7.1.el8_5.x86_64 on an x86_64 |
| - | texhash: Updating / | + | centos8 login: trainee |
| - | texhash: Updating / | + | Password: |
| - | texhash: Updating / | + | Last login: Fri Nov 28 09:45:22 from 10.0.2.46 |
| - | texhash: Updating / | + | |
| - | texhash: Updating / | + | |
| - | texhash: Done | + | |
| - | </ | + | |
| - | Exécutez une dernière fois la commande **openvas-check-setup** : | + | [trainee@centos8 ~]$ pwd |
| + | / | ||
| - | < | + | [trainee@centos8 ~]$ exit |
| - | [root@centos7 comment]# openvas-check-setup | + | logout |
| - | ... | + | Connection closed by foreign host. |
| - | Step 10: Checking presence of optional tools ... | + | root@debian12:~# |
| - | OK: pdflatex found. | + | |
| - | OK: PDF generation successful. The PDF report format is likely to work. | + | |
| - | OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work. | + | |
| - | OK: rpm found, LSC credential package generation for RPM based targets is likely to work. | + | |
| - | OK: alien found, LSC credential package generation for DEB based targets is likely to work. | + | |
| - | WARNING: Could not find makensis binary, LSC credential package generation for Microsoft Windows targets will not work. | + | |
| - | SUGGEST: Install nsis. | + | |
| - | OK: SELinux is disabled. | + | |
| - | + | ||
| - | It seems like your OpenVAS-8 installation is OK. | + | |
| - | ... | + | |
| </ | </ | ||
| <WRAP center round important 50%> | <WRAP center round important 50%> | ||
| - | **Important** - Notez la ligne **WARNING: Could not find makensis binary, LSC credential package generation for Microsoft Windows targets will not work.** | + | **Important** - Notez bien que votre communication telnet passe par le tunnel SSH. |
| </ | </ | ||
| - | Téléchargez et installez le fichier **mingw32-nsis-3.01-1.el7.x86_64.rpm** : | + | ====3.6 - SCP==== |
| - | < | + | ===Introduction=== |
| - | [root@centos7 ~]# cd ~ | + | |
| - | [root@centos7 ~]# wget ftp://ftp.icm.edu.pl/ | + | La commande **scp** est le successeur et la remplaçante de la commande **rcp** de la famille des commandes **remote**. Il permet de faire des transferts sécurisés à partir d'une machine distante |
| - | --2025-12-02 13:46: | + | |
| - | => ‘mingw32-nsis-3.01-1.el7.x86_64.rpm’ | + | |
| - | Resolving ftp.icm.edu.pl (ftp.icm.edu.pl)... 193.219.28.2, | + | |
| - | Connecting to ftp.icm.edu.pl (ftp.icm.edu.pl)|193.219.28.2|: | + | |
| - | Logging in as anonymous ... Logged in! | + | |
| - | ==> SYST ... done. ==> PWD ... done. | + | |
| - | ==> TYPE I ... done. ==> CWD (1) / | + | |
| - | ==> SIZE mingw32-nsis-3.01-1.el7.x86_64.rpm ... 1379180 | + | |
| - | ==> PASV ... done. ==> RETR mingw32-nsis-3.01-1.el7.x86_64.rpm ... done. | + | |
| - | Length: 1379180 (1.3M) (unauthoritative) | + | |
| - | 100%[========================================================================================================================================================================> | + | |
| - | 2025-12-02 13:46:28 (2.05 MB/s) - ‘mingw32-nsis-3.01-1.el7.x86_64.rpm’ saved [1379180] | + | ou vers une machine distante |
| - | [root@centos7 ~]# yum localinstall mingw32-nsis-3.01-1.el7.x86_64.rpm --nogpgcheck -y | + | $ scp / |
| - | </code> | + | |
| + | ===Utilisation=== | ||
| + | |||
| + | Nous allons maintenant utiliser **scp** pour chercher un fichier sur le << | ||
| - | Exécutez une dernière fois la commande | + | Créez le fichier |
| < | < | ||
| - | [root@centos7 | + | trainee@debian12:~$ touch /home/ |
| - | ... | + | |
| - | Step 10: Checking presence of optional tools ... | + | |
| - | OK: pdflatex found. | + | |
| - | OK: PDF generation successful. The PDF report format is likely to work. | + | |
| - | OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work. | + | |
| - | OK: rpm found, LSC credential package generation for RPM based targets is likely to work. | + | |
| - | OK: alien found, LSC credential package generation for DEB based targets is likely to work. | + | |
| - | OK: nsis found, LSC credential package generation for Microsoft Windows targets is likely to work. | + | |
| - | OK: SELinux is disabled. | + | |
| - | + | ||
| - | It seems like your OpenVAS-8 installation is OK. | + | |
| - | ... | + | |
| </ | </ | ||
| - | ===2.5 - Utilisation=== | + | Récupérez le fichier **scp_test** en utilisant scp : |
| - | Retournez à l' | + | < |
| - | Ouvrez un navigateur web dans la VM et saississez l' | + | trainee@debian12:~$ scp trainee@127.0.0.1:/ |
| - | {{ :elearning: | + | trainee@debian12:~$ ls / |
| + | / | ||
| + | </ | ||
| - | Créez une exception pour le Self Signed Certificate. Vous obtiendrez une fenêtre similaire à celle-ci: | + | =====LAB #4 - Mise en place d'un VPN avec OpenVPN===== |
| - | {{ : | + | ====4.1 - Présentation==== |
| - | Entrez le nom de votre utilisateur (fenestros) ainsi que son mot de passe (fenestros) et cliquez sur le bouton | + | **%%OpenVPN%%** : |
| - | {{ : | + | * permet à des pairs de s' |
| + | * d'une **clé privée partagée** à l'avance, | ||
| + | * de **certificats** ou, | ||
| + | * à partir de la version 2.0 et à condition que le serveur possède un certificat, de **couples de noms d' | ||
| + | * utilise de manière intensive la bibliothèque d' | ||
| + | * n'est pas compatible avec IPsec ou d' | ||
| - | Dans la boîte **Quick start**, entrez l' | + | ====Configuration commune au client |
| - | {{ :elearning: | + | Installez le paquet openvpn |
| - | <WRAP center round important 50%> | + | <code> |
| - | **Important** - Vous pouvez indiquer un réseau entier de la forme 10.0.2.0/24 | + | root@debian12: |
| - | </WRAP> | + | </code> |
| - | ===Analyse des Résultats=== | + | Naviguez au répertoire **/ |
| - | A l'issu de l' | + | < |
| + | [root@centos7 ~]# cd / | ||
| - | {{ :elearning: | + | root@debian12:/ |
| - | ainsi que les détails de celui-ci | + | root@debian12:/ |
| + | # | ||
| + | # 2048 bit OpenVPN static key | ||
| + | # | ||
| + | -----BEGIN OpenVPN Static key V1----- | ||
| + | 77b47829a9d17aacc71b05a2bfa9bcba | ||
| + | e90370cc07238a5adb74ef479e87547d | ||
| + | fc18a69c3c5307bdc1ca27c7aa6f3a35 | ||
| + | e09e815a27f50c28699be3af28decd3c | ||
| + | b319923c2fe3826c2afb41d2e0239229 | ||
| + | fee9bc33566941e09e2f905f1bcbb59a | ||
| + | 55cf8d535334ac46eda3f35be0b7e22b | ||
| + | c3261de182f7cde5cc7d756420907514 | ||
| + | 0399672d104cebee31a44ca6d89663c7 | ||
| + | 784b928e893c4d3a6e7d294e94266e1b | ||
| + | 5a98f80f797651199069902be01d2bbd | ||
| + | 94765d310f8d0466484a0e7cbf10bb98 | ||
| + | d247127aa53a6c18a6def6ed73a28b69 | ||
| + | b7d052209318057e2ccb9660fc42543b | ||
| + | d79dab314ecbc19a6b8936255c17d673 | ||
| + | fb0bdc3856a034ffc3931a7d645d6d96 | ||
| + | -----END OpenVPN Static key V1----- | ||
| + | </ | ||
| - | {{ :elearning:workbooks:centos: | + | < |
| + | root@debian12:~# scp / | ||
| + | trainee@10.0.2.45' | ||
| + | static.key 100% 636 | ||
| + | </ | ||
| - | Vous trouverez aussi une **solution** ainsi qu'une évaluation | + | ====Configuration |
| - | {{ :elearning: | + | < |
| - | {{ :elearning: | + | root@debian12:/ |
| + | trainee@10.0.2.45' | ||
| + | Activate the web console with: systemctl enable --now cockpit.socket | ||
| - | =====Les Contres-Mesures===== | + | Last login: Fri Nov 28 09:47:05 2025 from :: |
| - | Les contre-mesures consistent en la mise en place de chroot pour certains serveurs ainsi que le durcissement de la configuration de serveurs d' | + | [trainee@centos8 ~]$ su - |
| + | Password: fenestros | ||
| + | </ | ||
| - | ====LAB | + | < |
| - | + | [root@centos8 ~]# dnf install epel-release | |
| - | Le chrootage permet de séparer un utilisateur ou un utilisateur système ( et donc un serveur ) du système. | + | </ |
| - | + | ||
| - | Sous Debian 12 le binaire chroot est installé par défaut : | + | |
| < | < | ||
| - | root@debian12:~# which chroot | + | [root@centos8 |
| - | / | + | |
| </ | </ | ||
| - | |||
| - | Commencez par créer un répertoire pour l' | ||
| < | < | ||
| - | root@debian12:~# mkdir /home/prison | + | [root@centos8 |
| + | [root@centos8 ~]# ls / | ||
| + | client | ||
| </ | </ | ||
| - | Le binaire | + | Créez le fichier |
| < | < | ||
| - | root@debian12:~# mkdir /home/prison | + | [root@centos8 |
| + | [root@centos8 ~]# cat / | ||
| + | remote 10.0.2.46 | ||
| + | dev tun | ||
| + | port 1194 | ||
| + | proto udp | ||
| + | comp-lzo | ||
| + | ifconfig 10.0.0.2 10.0.0.1 | ||
| + | secret / | ||
| + | </ | ||
| - | root@debian12:~# ls -l / | + | Lancez openvpn en ligne de commande et en arrière plan en spécifiant une journalisation |
| - | -rwxr-xr-x. 1 root root 48112 Sep 20 2022 / | + | |
| - | root@debian12: | + | < |
| - | + | [root@centos8 | |
| - | root@debian12:~# ls -l /usr/sbin/chroot | + | [1] 14598 |
| - | -rwsr-sr-x. 1 root root 48112 Sep 20 2022 /usr/sbin/chroot | + | |
| </ | </ | ||
| - | Créez maintenant un script de connexion générique pour que l' | + | Vérifiez ensuite |
| < | < | ||
| - | root@debian12:~# vi /bin/chroot | + | [root@centos8 |
| - | + | udp 0 0 0.0.0.0:1194 0.0.0.0: | |
| - | root@debian12:~# cat / | + | |
| - | # | + | |
| - | exec -c / | + | |
| </ | </ | ||
| - | Rendez ce script exécutable | + | Constatez ensuite la table de routage |
| - | < | + | < |
| - | root@debian12:~# chmod +x / | + | [root@centos8 |
| + | Kernel IP routing table | ||
| + | Destination | ||
| + | default | ||
| + | 10.0.0.1 | ||
| + | 10.0.2.0 | ||
| + | 192.168.122.0 | ||
| </ | </ | ||
| - | Il est maintenant nécessaire | + | Notez la présence |
| + | |||
| + | Constatez ensuite le montage du tunnel en regardant le contenu du fichier | ||
| < | < | ||
| - | root@debian12:~# mkdir /home/prison/bin | + | [root@centos7 |
| + | </ | ||
| - | root@debian12:~# cp /bin/bash / | + | L' |
| - | root@debian12: | + | < |
| - | linux-vdso.so.1 (0x00007ffd39fcf000) | + | serveur <------------Votre réseau-------------> |
| - | libtinfo.so.6 => /lib/x86_64-linux-gnu/ | + | |
| - | libc.so.6 => /lib/x86_64-linux-gnu/ | + | |
| - | /lib64/ld-linux-x86-64.so.2 (0x00007fef08471000) | + | eth0@ifxxx eth0@ifxxx |
| - | | + | 172.yy.0.3 |
| - | root@debian12:~# mkdir /home/ | + | </file> |
| - | root@debian12: | + | ====Configuration du serveur==== |
| - | root@debian12: | + | Créez le fichier **/etc/openvpn/server/ |
| - | root@debian12: | + | < |
| + | root@debian12: | ||
| - | root@debian12: | + | root@debian12: |
| + | dev tun | ||
| + | ifconfig 10.0.0.1 10.0.0.2 | ||
| + | secret / | ||
| + | port 1194 | ||
| + | proto udp | ||
| + | user nobody | ||
| + | group nobody | ||
| + | daemon | ||
| + | comp-lzo | ||
| + | keepalive 10 60 | ||
| + | ping-timer-rem | ||
| + | persist-tun | ||
| + | persist-key | ||
| + | log /var/log/vpn | ||
| + | verb 1 | ||
| + | </code> | ||
| - | root@debian12:~# cp /bin/ls / | + | Arrêtez le service **firewalld** |
| - | root@debian12: | + | < |
| - | linux-vdso.so.1 (0x00007fff3db26000) | + | root@debian12: |
| - | libselinux.so.1 => / | + | |
| - | libc.so.6 => / | + | |
| - | libpcre2-8.so.0 => / | + | |
| - | / | + | |
| - | root@debian12: | + | root@debian12: |
| + | Chain INPUT (policy ACCEPT) | ||
| + | target | ||
| - | root@debian12: | + | Chain FORWARD (policy ACCEPT) |
| + | target | ||
| + | |||
| + | Chain OUTPUT (policy ACCEPT) | ||
| + | target | ||
| </ | </ | ||
| - | Créez maintenant le groupe chroot | + | Lancez openvpn en ligne de commande et en arrière plan en spécifiant une journalisation |
| < | < | ||
| - | root@debian12: | + | root@debian12: |
| - | + | [1] 11644 | |
| - | root@debian12: | + | |
| - | chroot: | + | |
| </ | </ | ||
| - | Créez maintenant l' | + | Vérifiez ensuite que le **socket** d' |
| < | < | ||
| - | root@debian12:~# useradd prison | + | [root@centos7 |
| + | udp 0 0 0.0.0.0: | ||
| </ | </ | ||
| - | Dernièrement, | + | Constatez ensuite la table de routage |
| - | < | + | < |
| - | root@debian12:~# chown -R prison: | + | [root@centos7 |
| + | Kernel IP routing table | ||
| + | Destination | ||
| + | 0.0.0.0 | ||
| + | 10.0.0.1 | ||
| + | 10.0.2.0 | ||
| </ | </ | ||
| - | Essayez maintenant de vous connecter | + | Constatez ensuite le montage du tunnel |
| < | < | ||
| - | root@debian12:~# su - prison | + | [root@centos7 |
| + | </ | ||
| - | bash-5.2$ pwd | + | ====Tests==== |
| - | / | + | |
| - | bash-5.2$ ls | + | ===Du client vers le serveur=== |
| - | bin lib lib64 | + | |
| - | bash-5.2$ ls -la | + | Sur le client, utilisez |
| - | total 20 | + | |
| - | drwxr-xr-x. 5 1001 1001 4096 Dec 1 13:59 . | + | |
| - | drwxr-xr-x. 5 1001 1001 4096 Dec 1 13:59 .. | + | |
| - | drwxr-xr-x. 2 1001 1001 4096 Dec 1 13:56 bin | + | |
| - | drwxr-xr-x. 3 1001 1001 4096 Dec 1 13:59 lib | + | |
| - | drwxr-xr-x. 2 1001 1001 4096 Dec 1 13:56 lib64 | + | |
| - | bash-5.2$ exit | + | < |
| - | exit | + | [root@centos6 ~]# ping -c3 10.0.0.1 |
| + | PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. | ||
| + | 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=7.62 ms | ||
| + | 64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=1.35 ms | ||
| + | 64 bytes from 10.0.0.1: icmp_seq=3 ttl=64 time=0.000 ms | ||
| - | root@debian12: | + | --- 10.0.0.1 ping statistics --- |
| + | 3 packets transmitted, | ||
| + | rtt min/ | ||
| </ | </ | ||
| - | Notez que l' | + | ===Du serveur vers le client=== |
| + | |||
| + | Sur le serveur, utilisez la commande ping pour envoyer des paquets dans le tunnel : | ||
| + | |||
| + | < | ||
| + | [root@centos7 ~]# ping -c5 10.0.0.2 | ||
| + | PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. | ||
| + | 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=2.59 ms | ||
| + | 64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=9.08 ms | ||
| + | 64 bytes from 10.0.0.2: icmp_seq=3 ttl=64 time=7.24 ms | ||
| + | 64 bytes from 10.0.0.2: icmp_seq=4 ttl=64 time=7.03 ms | ||
| + | 64 bytes from 10.0.0.2: icmp_seq=5 ttl=64 time=4.08 ms | ||
| + | |||
| + | --- 10.0.0.2 ping statistics --- | ||
| + | 5 packets transmitted, | ||
| + | rtt min/avg/max/mdev = 2.597/6.008/ | ||
| + | </ | ||
| ----- | ----- | ||
| Copyright © 2025 Hugh Norris. | Copyright © 2025 Hugh Norris. | ||
| - | |||
