Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédente | |||
| elearning:workbooks:debian:11:sec:l109 [2025/12/04 09:27] – admin | elearning:workbooks:debian:11:sec:l109 [2025/12/04 09:32] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| - | |||
| - | OPENVPN | ||
| - | DNS et cryptographie : DNSSEC | ||
| Version : **2026.01** | Version : **2026.01** | ||
| Ligne 8: | Ligne 5: | ||
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LDF407 | + | ======LDF409 |
| - | =====Contenu du module===== | + | =====Contenu du Module===== |
| - | * **LDF407 | + | * **LDF409 |
| - | * Contenu du module | + | * Contenu du Module |
| - | * Le Problématique | + | * Présentation de Docker |
| - | * LAB #1 - Utilisation de tcpdump | + | * LAB #1 - Travailler avec Docker |
| - | * 1.1 - Utilisation | + | * 1.1 - Installer docker |
| - | * L' | + | * 1.2 - Démarrer un Conteneur |
| - | * L' | + | * 1.3 - Consulter la Liste des Conteneurs et Images |
| - | * L'option | + | * 1.4 - Rechercher une Image dans un Dépôt |
| - | * L'option | + | * 1.5 - Supprimer un Conteneur d'une Image |
| - | * L'option | + | * 1.6 - Créer une Image à partir d'un Conteneur Modifié |
| - | * 1.2 - Filtrage à l'écoute | + | * 1.7 - Supprimer une Image |
| - | * Les Contre-Mesures | + | * 1.8 - Créer un Conteneur avec un Nom Spécifique |
| - | * Introduction à la cryptologie | + | * 1.9 - Exécuter une Commande dans un Conteneur |
| - | * Définitions | + | * 1.10 - Injecter des Variables d'Environnement dans un Conteneur |
| - | * Algorithmes à clé secrète | + | * 1.11 - Modifier le Nom d' |
| - | * Le Chiffrement Symétrique | + | * 1.12 - Mapper des Ports d'un Conteneur |
| - | * Algorithmes | + | * 1.13 - Démarrer un Conteneur en mode Détaché |
| - | * Le Chiffrement Asymétrique | + | * 1.14 - Accéder aux Services d'un Conteneur de l'Extérieur |
| - | * La Clef de Session | + | * 1.15 - Arrêter et Démarrer un Conteneur |
| - | * Fonctions | + | * 1.16 - Utiliser des Signaux avec un Conteneur |
| - | * Signature Numérique | + | * 1.17 - Forcer la Suppression d'un Conteneur en cours d' |
| - | * PKI | + | * 1.18 - Utilisation Simple d'un Volume |
| - | * Certificats X509 | + | * 1.19 - Télécharger une image sans créer un conteneur |
| - | * LAB #2 - Utilisation | + | * 1.20 - S' |
| - | * 2.1 - Présentation | + | * 1.21 - Installer un logiciel dans le conteneur |
| - | * 2.2 - Installation | + | * 1.22 - Utilisation |
| - | * 2.3 - Utilisation | + | * 1.23 - Se connecter au serveur du conteneur |
| - | * Signer un message | + | * LAB #2 - Création d'un Utilisateur de Confiance pour Contrôler le Daemon Docker |
| - | * Chiffrer un message | + | * LAB #3 - Le Script docker-bench-security.sh |
| - | * LAB #3 - Mise en place de SSH et SCP | + | * LAB #4 - Sécurisation de la Configuration de l' |
| - | * 3.1 - Introduction | + | * 4.1 - [WARN] 1.2.1 - Ensure a separate partition for containers has been created |
| - | * SSH-1 | + | * 4.2 - [WARN] 1.2.3 - Ensure auditing is configured for the Docker daemon |
| - | * SSH-2 | + | * LAB #5 - Sécurisation |
| - | * L' | + | * 5.1 - [WARN] |
| - | * L' | + | * 5.2 - [WARN] |
| - | * 3.2 - Configuration du Serveur | + | * 5.3 - [WARN] |
| - | * 3.3 - Utilisation | + | * 5.4 - [WARN] |
| - | * 3.4 - Mise en place des clefs | + | * 5.5 - [WARN] 2.14 - Ensure Userland Proxy is Disabled |
| - | * 3.5 - Tunnels SSH | + | * 5.6 - [WARN] 2.17 - Ensure containers are restricted from acquiring new privileges |
| - | * 3.6 - SCP | + | * 5.7 - Le Fichier / |
| - | * Introduction | + | * LAB #6 - Sécurisation des Images |
| - | * Utilisation | + | * 6.1 - [WARN] 4.1 - Ensure a user for the container has been created |
| - | * LAB #4 - Mise en place d'un VPN avec OpenVPN | + | * 6.2 - [WARN] 4.5 - Ensure Content trust for Docker is Enabled |
| - | * Présentation | + | * 6.3 - [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images |
| - | * Configuration commune au client | + | * LAB #7 - Sécurisation du Container Runtime |
| - | * Configuration du client | + | * 7.1 - [WARN] 5.1 - Ensure AppArmor Profile is Enabled |
| - | * Configuration du serveur | + | * 7.2 - [WARN] 5.2 - Ensure SELinux security options are set, if applicable |
| - | * Tests | + | * 7.3 - [WARN] 5.10 - Ensure memory usage for container is limited |
| - | * Du client vers le serveur | + | * 7.4 - [WARN] 5.11 - Ensure CPU priority is set appropriately on the container |
| - | * Du serveur vers le client | + | * 7.5 - [WARN] 5.12 - Ensure the container' |
| + | * 7.6 - [WARN] 5.14 - Ensure ' | ||
| + | * 7.7 - [WARN] 5.25 - Ensure the container is restricted from acquiring additional privileges | ||
| + | * 7.8 - [WARN] 5.26 - Ensure container health is checked at runtime | ||
| + | * 7.9 - [WARN] 5.28 - Ensure PIDs cgroup limit is used | ||
| + | * LAB #8 - Sécurisation des Images | ||
| + | * 8.1 - DOCKER_CONTENT_TRUST | ||
| + | * 8.2 - DCT et la commande docker pull | ||
| + | * L' | ||
| + | * 8.3 - DCT et la commande docker push | ||
| + | * 8.4 - DCT et la commande docker build | ||
| + | * Créer un deuxième Repositry | ||
| + | * Supprimer une Signature | ||
| - | =====Le Problématique===== | + | =====Présentation de Docker===== |
| - | Le **sniffing** des paquets de données est possible sur un réseau utilisant une technologie de diffusion tel un réseau | + | Docker est une application de virtualisation légère qui utilise des **images** et des **conteneurs**. |
| - | | + | Une **image** est un paquet exécutable contenant tout ce qu'il est necessaire afin d' |
| - | | + | |
| - | | + | |
| - | * Pop3. | + | |
| - | Un // | + | * le code |
| + | * un runtime | ||
| + | * des bibliothèques, | ||
| + | * des variables d' | ||
| + | * des fichiers | ||
| - | | + | Un **conteneur** est une instance de l' |
| - | =====LAB #1 - Utilisation | + | Les conteneurs exécutent des applications nativement en utilisant le noyau de la machine hôte. De ce fait les performances d'un conteneur sont supérieures à celles d'une machine virtuelle qui doit passer par un hyperviseur pour accéder aux ressources de la machine hôte. |
| - | Le logiciel | + | Docker existe en deux versions |
| - | ===1.1 - Utilisation=== | + | =====LAB #1 - Travailler avec Docker===== |
| - | Installez **tcpdump** : | + | ====1.1 - Installer docker==== |
| - | < | + | Installer Docker-CE sur **votre** ordinateur |
| - | root@debian12:~# apt install tcpdump | + | |
| - | </ | + | |
| - | ==L' | + | ==Mac== |
| - | Pour écouter sur une **interface spécifique**, utilisez | + | |
| + | |||
| + | ==Linux== | ||
| + | |||
| + | * Ubuntu - voir le lien **[[https:// | ||
| + | * Debian - voir le lien **[[https:// | ||
| + | * CentOS - voir le lien **[[https:// | ||
| + | * Fedora - voir le lien **[[https:// | ||
| + | |||
| + | ==Windows 7, 8== | ||
| + | |||
| + | * Téléchargez Docker Toolbox à partir de cette page **[[https:// | ||
| + | * Fermez toutes les machines virtuelles ainsi que VirtualBox, | ||
| + | * Installez **DockerToolBox.exe** (décochez VirtualBox dans la liste de produits à installer), | ||
| + | * Exécutez Docker Toolbox et laissez | ||
| + | | ||
| + | | ||
| + | |||
| + | ==Windows 10== | ||
| + | |||
| + | * Voir le lien **[[https:// | ||
| + | |||
| + | |||
| + | ====1.2 - Démarrer un Conteneur==== | ||
| + | |||
| + | Démarrez un conteneur de l' | ||
| < | < | ||
| - | root@debian12:~# tcpdump | + | root@debian9:~# docker run hello-world |
| - | tcpdump: verbose output suppressed, use -v[v]... for full protocol decode | + | Unable to find image 'hello-world: |
| - | listening on ens18, link-type EN10MB (Ethernet), snapshot length 262144 bytes | + | latest: Pulling from library/ |
| - | 17:29:37.411395 IP 10.0.2.46.ssh > 10.0.2.1.42252: Flags [P.], seq 119569853:119570041, ack 3811519177, win 501, options [nop,nop,TS val 3553055771 ecr 1647876767], | + | 1b930d010525: |
| - | 17: | + | Digest: sha256:2557e3c07ed1e38f26e389462d03ed943586f744621577a99efb77324b0fe535 |
| - | 17: | + | Status: Downloaded newer image for hello-world: |
| - | 17:29:37.495598 IP dns.google.domain > 10.0.2.46.36881: 55995 NXDomain 0/0/0 (39) | + | |
| - | 17: | + | Hello from Docker! |
| - | 17:29:37.497464 IP dns.google.domain > 10.0.2.46.33051: | + | This message shows that your installation appears to be working correctly. |
| - | 17:29:37.497758 IP 10.0.2.46.ssh > 10.0.2.1.42252: | + | |
| - | 17: | + | To generate this message, Docker took the following steps: |
| - | 17:29: | + | |
| - | 17:29:37.598847 IP dns.google.domain > 10.0.2.46.52033: | + | |
| - | 10 packets captured | + | |
| - | 14 packets received by filter | + | 3. The Docker daemon created a new container from that image which runs the |
| - | 0 packets dropped by kernel | + | executable that produces the output you are currently reading. |
| + | 4. The Docker daemon streamed that output to the Docker client, which sent it | ||
| + | to your terminal. | ||
| + | |||
| + | To try something more ambitious, you can run an Ubuntu container with: | ||
| + | $ docker run -it ubuntu bash | ||
| + | |||
| + | Share images, automate workflows, and more with a free Docker ID: | ||
| + | https://hub.docker.com/ | ||
| + | |||
| + | For more examples and ideas, visit: | ||
| + | https://docs.docker.com/get-started/ | ||
| </ | </ | ||
| - | Notez qu' | + | <WRAP center round important> |
| + | **Important** - Notez que si l'image servant | ||
| + | </ | ||
| + | |||
| + | Démarrez un conteneur de l' | ||
| < | < | ||
| - | ... | + | root@debian9: |
| - | 10 packets captured | + | Unable to find image ' |
| - | 14 packets received by filter | + | latest: Pulling from library/ |
| - | 0 packets dropped by kernel | + | 898c46f3b1a1: |
| + | 63366dfa0a50: | ||
| + | 041d4cd74a92: | ||
| + | 6e1bee0f8701: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for ubuntu: | ||
| + | root@3a3f9bda6cbd:/# | ||
| + | bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var | ||
| + | root@3a3f9bda6cbd:/# | ||
| + | DISTRIB_ID=Ubuntu | ||
| + | DISTRIB_RELEASE=18.04 | ||
| + | DISTRIB_CODENAME=bionic | ||
| + | DISTRIB_DESCRIPTION=" | ||
| </ | </ | ||
| <WRAP center round important> | <WRAP center round important> | ||
| - | **Important** | + | **Important** |
| </ | </ | ||
| - | ==L' | + | Consulter la liste des paquets installés dans le conteneur ubuntu : |
| + | |||
| + | < | ||
| + | root@835001339e79:/# | ||
| + | Desired=Unknown/ | ||
| + | | Status=Not/ | ||
| + | |/ Err?=(none)/ | ||
| + | ||/ Name | ||
| + | +++-====================================-=======================-=======================-============================================================================= | ||
| + | ii adduser | ||
| + | ii apt 1.6.8 | ||
| + | ii base-files | ||
| + | ii base-passwd | ||
| + | ii bash | ||
| + | ii bsdutils | ||
| + | ii bzip2 1.0.6-8.1 | ||
| + | ii coreutils | ||
| + | ii dash | ||
| + | ii debconf | ||
| + | ii debianutils | ||
| + | ii diffutils | ||
| + | ii dpkg | ||
| + | ii e2fsprogs | ||
| + | ii fdisk 2.31.1-0.4ubuntu3.3 | ||
| + | ii findutils | ||
| + | ii gcc-8-base: | ||
| + | ii gpgv | ||
| + | ii grep | ||
| + | ii gzip | ||
| + | ii hostname | ||
| + | ii init-system-helpers | ||
| + | ii libacl1: | ||
| + | ii libapt-pkg5.0: | ||
| + | ii libattr1: | ||
| + | ii libaudit-common | ||
| + | ii libaudit1: | ||
| + | ii libblkid1: | ||
| + | ii libbz2-1.0: | ||
| + | ii libc-bin | ||
| + | ii libc6: | ||
| + | ii libcap-ng0: | ||
| + | ii libcom-err2: | ||
| + | ii libdb5.3: | ||
| + | ii libdebconfclient0: | ||
| + | ii libext2fs2: | ||
| + | ii libfdisk1: | ||
| + | ii libffi6: | ||
| + | ii libgcc1: | ||
| + | ii libgcrypt20: | ||
| + | ii libgmp10: | ||
| + | ii libgnutls30: | ||
| + | ii libgpg-error0: | ||
| + | ii libhogweed4: | ||
| + | ii libidn2-0: | ||
| + | ii liblz4-1: | ||
| + | ii liblzma5: | ||
| + | ii libmount1: | ||
| + | ii libncurses5: | ||
| + | ii libncursesw5: | ||
| + | ii libnettle6: | ||
| + | ii libp11-kit0: | ||
| + | ii libpam-modules: | ||
| + | ii libpam-modules-bin | ||
| + | ii libpam-runtime | ||
| + | ii libpam0g: | ||
| + | ii libpcre3: | ||
| + | ii libprocps6: | ||
| + | ii libseccomp2: | ||
| + | ii libselinux1: | ||
| + | ii libsemanage-common | ||
| + | ii libsemanage1: | ||
| + | ii libsepol1: | ||
| + | ii libsmartcols1: | ||
| + | ii libss2: | ||
| + | ii libstdc++6: | ||
| + | ii libsystemd0: | ||
| + | ii libtasn1-6: | ||
| + | ii libtinfo5: | ||
| + | ii libudev1: | ||
| + | ii libunistring2: | ||
| + | ii libuuid1: | ||
| + | ii libzstd1: | ||
| + | ii login 1: | ||
| + | ii lsb-base | ||
| + | ii mawk | ||
| + | ii mount 2.31.1-0.4ubuntu3.3 | ||
| + | ii ncurses-base | ||
| + | ii ncurses-bin | ||
| + | ii passwd | ||
| + | ii perl-base | ||
| + | ii procps | ||
| + | ii sed 4.4-2 | ||
| + | ii sensible-utils | ||
| + | ii sysvinit-utils | ||
| + | ii tar 1.29b-2ubuntu0.1 | ||
| + | ii ubuntu-keyring | ||
| + | ii util-linux | ||
| + | ii zlib1g: | ||
| + | root@835001339e79:/# | ||
| + | exit | ||
| + | root@debian9: | ||
| + | </ | ||
| - | Pour écouter sur une interface spécifique et voir le contenu en Hexadécimal, | + | Les options |
| < | < | ||
| - | root@debian12:~# tcpdump | + | root@debian9:~# docker run --help |
| - | tcpdump: verbose output suppressed, use -v[v]... for full protocol decode | + | |
| - | listening on ens18, link-type EN10MB | + | Usage: docker run [OPTIONS] IMAGE [COMMAND] [ARG...] |
| - | 17: | + | |
| - | | + | Run a command in a new container |
| - | | + | |
| - | | + | Options: |
| - | | + | |
| - | | + | -a, --attach list Attach to STDIN, STDOUT or STDERR |
| - | | + | |
| - | | + | --blkio-weight-device list Block IO weight (relative device weight) (default |
| - | | + | --cap-add list Add Linux capabilities |
| - | | + | --cap-drop list Drop Linux capabilities |
| - | | + | --cgroup-parent string |
| - | | + | --cidfile string |
| - | | + | --cpu-period int Limit CPU CFS (Completely Fair Scheduler) period |
| - | | + | --cpu-quota int Limit CPU CFS (Completely Fair Scheduler) quota |
| - | | + | --cpu-rt-period int Limit CPU real-time period in microseconds |
| - | | + | --cpu-rt-runtime int Limit CPU real-time runtime in microseconds |
| - | 17:27:24.043485 IP 10.0.2.1.42252 > 10.0.2.46.ssh: Flags [.], ack 188, win 10548, options | + | -c, --cpu-shares int CPU shares (relative weight) |
| - | | + | --cpus decimal |
| - | 0x0010: 0a00 022e a50c 0016 e32f 2a55 0720 7611 | + | --cpuset-cpus string |
| - | 0x0020: 8010 2934 1855 0000 0101 080a 6236 91bf | + | --cpuset-mems string |
| - | 0x0030: | + | |
| - | 17:27: | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | 3 packets captured | + | |
| - | 10 packets received by filter | + | |
| - | 0 packets dropped by kernel | + | --dns list Set custom DNS servers |
| + | | ||
| + | | ||
| + | --entrypoint string | ||
| + | | ||
| + | | ||
| + | --expose list Expose a port or a range of ports | ||
| + | --group-add list Add additional groups to join | ||
| + | --health-cmd string | ||
| + | --health-interval duration | ||
| + | --health-retries int | ||
| + | --health-start-period duration | ||
| + | --health-timeout duration | ||
| + | --help | ||
| + | -h, --hostname string | ||
| + | --init | ||
| + | | ||
| + | --ip string | ||
| + | --ip6 string | ||
| + | --ipc string | ||
| + | --isolation string | ||
| + | --kernel-memory bytes Kernel memory limit | ||
| + | -l, --label list Set meta data on a container | ||
| + | --label-file list Read in a line delimited file of labels | ||
| + | --link list Add link to another container | ||
| + | --link-local-ip list | ||
| + | --log-driver string | ||
| + | --log-opt list Log driver | ||
| + | | ||
| + | -m, --memory bytes | ||
| + | | ||
| + | --memory-swap bytes Swap limit equal to memory plus swap: '-1' to enable unlimited swap | ||
| + | --memory-swappiness int Tune container memory swappiness (0 to 100) (default | ||
| + | --mount mount Attach a filesystem mount to the container | ||
| + | --name string | ||
| + | --network string | ||
| + | | ||
| + | --no-healthcheck | ||
| + | --oom-kill-disable | ||
| + | --oom-score-adj int Tune host's OOM preferences (-1000 to 1000) | ||
| + | --pid string | ||
| + | --pids-limit int Tune container pids limit (set -1 for unlimited) | ||
| + | --privileged | ||
| + | | ||
| + | | ||
| + | --read-only | ||
| + | --restart string | ||
| + | --rm | ||
| + | --runtime string | ||
| + | --security-opt list Security Options | ||
| + | --shm-size bytes Size of /dev/shm | ||
| + | --sig-proxy | ||
| + | --stop-signal string | ||
| + | --stop-timeout int | ||
| + | --storage-opt list | ||
| + | --sysctl map | ||
| + | --tmpfs list Mount a tmpfs directory | ||
| + | | ||
| + | | ||
| + | -u, --user string | ||
| + | --userns string | ||
| + | --uts string | ||
| + | -v, --volume list Bind mount a volume | ||
| + | | ||
| + | | ||
| + | -w, --workdir string | ||
| </ | </ | ||
| - | ==L' | + | ====1.3 - Consulter la Liste des Conteneurs et Images==== |
| - | Pour écouter sur une interface spécifique et voir le contenu en Hexadécimal et en ASCII, utilisez | + | Pour consulter tous les conteneurs, utilisez |
| < | < | ||
| - | root@debian12:~# tcpdump | + | root@debian9:~# docker ps -a |
| - | tcpdump: verbose output suppressed, use -v[v]... for full protocol decode | + | CONTAINER ID IMAGE |
| - | listening on ens18, link-type EN10MB | + | 3a3f9bda6cbd |
| - | 13: | + | 26ef17bd115d |
| - | | + | |
| - | 0x0010: | + | |
| - | 0x0020: | + | |
| - | 0x0030: | + | |
| - | 0x0040: | + | |
| - | 0x0050: | + | |
| - | 0x0060: | + | |
| - | 0x0070: | + | |
| - | 0x0080: | + | |
| - | 0x0090: | + | |
| - | 0x00a0: | + | |
| - | 0x00b0: | + | |
| - | 0x00c0: | + | |
| - | 0x00d0: | + | |
| - | 0x00e0: | + | |
| - | 13: | + | |
| - | 0x0000: | + | |
| - | 0x0010: | + | |
| - | 0x0020: | + | |
| - | 0x0030: | + | |
| - | 13: | + | |
| - | 0x0000: | + | |
| - | 0x0010: | + | |
| - | 0x0020: | + | |
| - | 0x0030: | + | |
| - | 0x0040: | + | |
| - | 3 packets captured | + | |
| - | 10 packets received by filter | + | |
| - | 0 packets dropped by kernel | + | |
| </ | </ | ||
| - | ==L' | + | <WRAP center round important> |
| + | **Important** | ||
| + | </ | ||
| - | Pour écouter sur une interface spécifique et envoyer | + | Pour consulter |
| < | < | ||
| - | root@debian12:~# tcpdump -i ens18 -w log.dump | + | root@debian9:~# docker images |
| - | tcpdump: listening on ens18, link-type EN10MB (Ethernet), snapshot length 262144 bytes | + | REPOSITORY |
| - | ^C42 packets captured | + | ubuntu |
| - | 45 packets received by filter | + | hello-world |
| - | 0 packets dropped by kernel | + | |
| - | + | ||
| - | root@debian12: | + | |
| - | -rw-r--r-- 1 tcpdump tcpdump 25555 Nov 28 13:11 log.dump | + | |
| </ | </ | ||
| - | <WRAP center round important | + | <WRAP center round important> |
| - | **Important** - Arrêtez la sortie de la commande à l'aide des touches **^C**. | + | **Important** - Notez que chaque image est référencée par son IMAGE ID. |
| </ | </ | ||
| - | Notez que le fichier log.dump est au format **libpcap** et non au format texte. Il est donc inutile d' | + | ====1.4 - Rechercher |
| + | |||
| + | Pour rechercher une image docker dans le dépôt par défaut, utilisez la commande **docker search** : | ||
| < | < | ||
| - | root@debian12:~# file log.dump | + | root@debian9:~# docker search --filter=stars=5 centos |
| - | log.dump: pcap capture file, microsecond ts (little-endian) | + | NAME DESCRIPTION |
| + | centos | ||
| + | ansible/ | ||
| + | jdeathe/ | ||
| + | consol/ | ||
| + | imagine10255/ | ||
| + | centos/ | ||
| + | tutum/ | ||
| + | gluster/ | ||
| + | openshift/ | ||
| + | centos/ | ||
| + | centos/ | ||
| + | kinogmt/ | ||
| + | centos/ | ||
| + | centos/ | ||
| + | openshift/ | ||
| + | pivotaldata/ | ||
| + | openshift/ | ||
| </ | </ | ||
| - | ==L' | + | <WRAP center round important> |
| + | **Important** | ||
| + | </ | ||
| - | Tcpdump peut être utilisé avec un de trois modes verbose. | + | ====1.5 - Supprimer un Conteneur d'une Image==== |
| - | ^ Mode ^ Option ^ | + | Pour supprimer un conteneur d'une image, il convient d' |
| - | | Light verbose | -v | | + | |
| - | | Medium verbose | -vv | | + | |
| - | | Full verbose | -vvv | | + | |
| < | < | ||
| - | root@debian12:~# tcpdump | + | root@debian9:~# docker ps -a |
| - | tcpdump: listening on ens18, link-type EN10MB | + | CONTAINER ID IMAGE |
| - | 13: | + | 3a3f9bda6cbd |
| - | | + | 26ef17bd115d |
| - | 13: | + | root@debian9:~# docker rm wizardly_buck |
| - | | + | wizardly_buck |
| - | 13: | + | root@debian9:~# docker ps -a |
| - | | + | CONTAINER ID IMAGE |
| - | 3 packets captured | + | 26ef17bd115d |
| - | 10 packets received by filter | + | root@debian9:~# docker images |
| - | 0 packets dropped by kernel | + | REPOSITORY |
| + | ubuntu | ||
| + | hello-world | ||
| </ | </ | ||
| - | ===1.2 | + | <WRAP center round important> |
| + | **Important** | ||
| + | </ | ||
| - | Tcpdump peut effectuer du filtrage lors de l' | + | ====1.6 -Créer une Image à partir d'un Conteneur Modifié=== |
| - | Pour uniquement écouter les paquets en provenance de l'adresse IP 192.168.1.11, | + | Modifier un conteneur d'une image : |
| - | | + | < |
| + | root@debian9: | ||
| + | root@54b0dae2f3a9:/# | ||
| + | bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var | ||
| + | root@54b0dae2f3a9:/# | ||
| + | root@54b0dae2f3a9:/# | ||
| + | bin boot dev etc lib lib64 media mnt opt proc root run sbin srv sys tmp usr var | ||
| + | root@54b0dae2f3a9:/# | ||
| + | exit | ||
| + | root@debian9: | ||
| + | </ | ||
| - | Pour uniquement écouter les paquets en provenance de l' | + | <WRAP center round important> |
| + | **Important** - Notez ici la suppression du répertoire **home** dans le conteneur **54b0dae2f3a9**. | ||
| + | </ | ||
| - | # tcpdump src host 192.168.1.11 and dst host 192.168.1.2 [Entrée] | + | Consultez la différence entre le conteneur et l' |
| - | Pour uniquement écouter les paquets d'un port précis, utilisez la condition **port** | + | < |
| + | root@debian9:~# docker ps -a | ||
| + | CONTAINER ID IMAGE | ||
| + | 54b0dae2f3a9 | ||
| + | 26ef17bd115d | ||
| + | root@debian9: | ||
| + | C /root | ||
| + | A / | ||
| + | D /home | ||
| + | </ | ||
| - | # tcpdump | + | <WRAP center round important> |
| + | **Important** | ||
| + | </ | ||
| - | Pour uniquement écouter les paquets d'un protocole précis, utilisez une condition telle **ip**, **icmp**, **arp**, **rarp**, **udp** ou **tcp**: | + | Créez |
| - | | + | < |
| + | root@debian9: | ||
| + | root@92f0d4bb7967:/# | ||
| + | bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var | ||
| + | root@92f0d4bb7967:/# | ||
| + | exit | ||
| + | root@debian9: | ||
| + | </ | ||
| - | Pour uniquement écouter les paquets d'une taille inférieure à 100 octets, utilisez la condition | + | <WRAP center round important> |
| + | **Important** - Dans ce nouveau conteneur, le répertoire | ||
| + | </ | ||
| - | # tcpdump -i eth0 less 100 [Entrée] | + | Créez maintenant l' |
| - | Pour uniquement écouter les paquets d'une taille supérieure à 100 octets, utilisez la condition **great** | + | < |
| + | root@debian9:~# docker ps -a | ||
| + | CONTAINER ID IMAGE | ||
| + | 92f0d4bb7967 | ||
| + | 54b0dae2f3a9 | ||
| + | 26ef17bd115d | ||
| + | root@debian9: | ||
| + | sha256: | ||
| + | root@debian9: | ||
| + | REPOSITORY | ||
| + | ubuntu_1 | ||
| + | ubuntu | ||
| + | hello-world | ||
| + | </ | ||
| - | # tcpdump | + | ====1.7 |
| - | L' | + | Créez maintenant un conteneur à partir de la nouvelle image **ubuntu_1** |
| - | | + | < |
| + | root@debian9: | ||
| + | root@904215fb79b4:/# | ||
| + | bin boot dev etc lib lib64 media mnt opt proc root run sbin srv sys tmp usr var | ||
| + | root@904215fb79b4:/# | ||
| + | exit | ||
| + | root@debian9: | ||
| + | </ | ||
| - | ===Options de la commande=== | + | <WRAP center round important> |
| + | **Important** - Notez l' | ||
| + | </ | ||
| - | Les options | + | Essayez |
| < | < | ||
| - | root@debian12:~# tcpdump --help | + | root@debian9:~# docker rmi ubuntu_1 |
| - | tcpdump version 4.99.3 | + | Error response from daemon: conflict: unable to remove repository reference " |
| - | libpcap version 1.10.3 | + | root@debian9:~# docker ps -a |
| - | OpenSSL 3.0.17 1 Jul 2025 | + | CONTAINER ID IMAGE |
| - | Usage: tcpdump [-AbdDefhHIJKlLnNOpqStuUvxX#] [ -B size ] [ -c count ] [--count] | + | 904215fb79b4 |
| - | [ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds | + | 92f0d4bb7967 |
| - | [ -i interface ] [ --immediate-mode ] [ -j tstamptype ] | + | 54b0dae2f3a9 |
| - | [ -M secret ] [ --number ] [ --print ] [ -Q in|out|inout ] | + | 26ef17bd115d |
| - | | + | |
| - | [ -V file ] [ -w file ] [ -W filecount ] [ -y datalinktype ] | + | |
| - | [ --time-stamp-precision precision ] [ --micro ] [ --nano ] | + | |
| - | [ -z postrotate-command ] [ -Z user ] [ expression ] | + | |
| </ | </ | ||
| - | =====Les Contre-Mesures===== | + | <WRAP center round important> |
| + | **Important** | ||
| + | </ | ||
| - | Les contre-mesures incluent | + | Supprimez donc le conteneur **priceless_swirles** ainsi que l'image **ubuntu_1** : |
| - | ====Introduction à la cryptologie==== | + | < |
| + | root@debian9: | ||
| + | priceless_swirles | ||
| + | root@debian9: | ||
| + | CONTAINER ID IMAGE | ||
| + | 92f0d4bb7967 | ||
| + | 54b0dae2f3a9 | ||
| + | 26ef17bd115d | ||
| + | root@debian9: | ||
| + | Untagged: ubuntu_1: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | root@debian9: | ||
| + | REPOSITORY | ||
| + | ubuntu | ||
| + | hello-world | ||
| + | </ | ||
| - | ===Définitions=== | + | Pour pouvoir supprimer tous les conteneurs, listez-les par leur **Container ID** : |
| - | * **La Cryptologie** | + | < |
| - | * La science qui étudie les aspects scientifiques de ces techniques, c'est-à-dire qu' | + | root@debian9: |
| - | * **La Cryptanalyse** | + | 92f0d4bb7967 |
| - | * Lorsque la clef de déchiffrement n'est pas connue de l' | + | 54b0dae2f3a9 |
| - | * **La Cryptographie** | + | 26ef17bd115d |
| - | * Un terme générique désignant l' | + | </ |
| - | * **Le Décryptement ou Décryptage** | + | |
| - | * Est le fait d' | + | |
| - | {{ :redhat: | + | Supprimer toutes les conteneurs |
| - | **La Cryptographie** | + | < |
| + | root@debian9: | ||
| + | 92f0d4bb7967 | ||
| + | 54b0dae2f3a9 | ||
| + | 26ef17bd115d | ||
| + | root@debian9: | ||
| + | root@debian9: | ||
| + | </ | ||
| - | La cryptographie apporte quatre points clefs: | + | Pour supprimer un conteneur dès la fin de son exécution, utilisez l' |
| - | * La confidentialité | + | < |
| - | * consiste à rendre l' | + | root@debian9: |
| - | * L' | + | root@d123b0112fc2:/# |
| - | * consiste à déterminer si les données n'ont pas été altérées durant la communication (de manière fortuite ou intentionnelle). | + | bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var |
| - | | + | root@d123b0112fc2:/# |
| - | * consiste à assurer l' | + | exit |
| - | * La non-répudiation | + | root@debian9: |
| - | * est la garantie qu' | + | root@debian9: |
| + | </ | ||
| - | La cryptographie est basée sur l' | + | ====1.8 - Créer |
| - | * Procéder au chiffrement | + | Créez maintenant un conteneur avec un nom spécifique : |
| - | * Le résultat de cette modification (le message chiffré) est appelé cryptogramme (Ciphertext) par opposition au message initial, appelé message en clair (Plaintext) | + | |
| - | * Procéder au déchiffrement | + | |
| - | Le chiffrement se fait à l'aide d'une clef de chiffrement. Le déchiffrement nécessite | + | < |
| + | root@debian9: | ||
| + | root@04b5ab87539a:/# | ||
| + | bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var | ||
| + | root@04b5ab87539a:/# | ||
| + | exit | ||
| + | root@debian9: | ||
| + | CONTAINER ID IMAGE | ||
| + | 04b5ab87539a | ||
| + | </ | ||
| - | On distingue deux types de clefs: | + | Pour obtenir |
| - | * Les clés symétriques: | + | < |
| - | | + | root@debian9:~# docker inspect i2tch |
| - | * Les clés asymétriques: | + | [ |
| - | * des clés utilisées dans le cas du chiffrement asymétrique (aussi appelé chiffrement à clé publique). Dans ce cas, une clé différente est utilisée pour le chiffrement et pour le déchiffrement. | + | |
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | 0, | ||
| + | 0 | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | "/ | ||
| + | "/ | ||
| + | "/ | ||
| + | "/ | ||
| + | "/ | ||
| + | "/ | ||
| + | "/ | ||
| + | "/ | ||
| + | "/ | ||
| + | "/ | ||
| + | ], | ||
| + | " | ||
| + | "/ | ||
| + | "/ | ||
| + | "/ | ||
| + | "/ | ||
| + | "/ | ||
| + | ] | ||
| + | }, | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | " | ||
| + | }, | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ], | ||
| + | " | ||
| + | "/ | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | ] | ||
| + | </ | ||
| - | **Le Chiffrement par Substitution** | + | ====1.9 - Exécuter une Commande |
| - | + | ||
| - | Le chiffrement par substitution consiste à remplacer | + | |
| - | * La substitution **monoalphabétique** | + | Pour exécuter |
| - | * consiste à remplacer chaque lettre du message par une autre lettre de l' | + | |
| - | * La substitution **polyalphabétique** | + | |
| - | * consiste à utiliser une suite de chiffres monoalphabétique réutilisée périodiquement | + | |
| - | * La substitution **homophonique** | + | |
| - | * permet de faire correspondre à chaque lettre du message en clair un ensemble possible d' | + | |
| - | * La substitution de **polygrammes** | + | |
| - | * consiste à substituer un groupe de caractères (polygramme) | + | |
| - | ===Algorithmes à clé secrète=== | + | < |
| + | root@debian9: | ||
| + | PATH=/ | ||
| + | HOSTNAME=77bb110031aa | ||
| + | HOME=/root | ||
| + | root@debian9: | ||
| + | </ | ||
| - | ==Le Chiffrement Symétrique== | + | ====1.10 - Injecter des Variables d' |
| - | Ce système est aussi appelé le système à **Clef Secrète** | + | Pour injecter une ou des variables d' |
| - | Ce système consiste à effectuer une opération de chiffrement par algorithme mais comporte un inconvénient, | + | < |
| + | root@debian9: | ||
| + | root@debian9: | ||
| + | EDITOR=vim | ||
| + | HOSTNAME=ubuntudocker | ||
| + | </ | ||
| - | {{:redhat:lx04:crypto2.gif|Cette image issue de Comment Ça Marche (www.commentcamarche.net) est mise à disposition sous les termes de la licence Creative Commons. Vous pouvez copier, modifier des copies de l' | + | < |
| + | root@debian9:~# docker run --rm --env-file=env.list ubuntu env | ||
| + | PATH=/ | ||
| + | HOSTNAME=ubuntudocker | ||
| + | EDITOR=vim | ||
| + | HOME=/ | ||
| + | root@debian9: | ||
| + | </ | ||
| - | <WRAP center round important 50%> | + | ====1.11 |
| - | **Important** | + | |
| - | </ | + | |
| - | Les algorithmes de chiffrement symétrique couramment utilisés en informatique sont: | + | Pour modifier le nom d' |
| - | * **[[wpfr>Data_Encryption_Standard|Data Encryption Standard]]** (DES), | + | <code> |
| - | * **[[wpfr> | + | root@debian9: |
| - | * **[[wpfr> | + | root@ubuntudocker:/# |
| - | * **[[wpfr> | + | ubuntudocker |
| - | * **[[wpfr> | + | root@ubuntudocker:/# |
| - | * **[[wpfr>Standard_de_chiffrement_avancé|Advanced Encryption Standard]]** (AES). | + | exit |
| + | root@debian9: | ||
| + | </code> | ||
| - | ===Algorithmes à clef publique=== | + | ====1.12 - Mapper des Ports d'un Conteneur===== |
| - | ==Le Chiffrement Asymétrique== | + | Démarrer un conteneur de nginx sur le port localhost 81 : |
| - | Ce système est aussi appelé **Système à Clef Publique**. | + | < |
| + | root@debian9: | ||
| + | Unable to find image ' | ||
| + | latest: Pulling from library/ | ||
| + | 27833a3ba0a5: | ||
| + | e83729dd399a: | ||
| + | ebc6a67df66d: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for nginx: | ||
| + | ^Croot@debian9: | ||
| + | </ | ||
| - | Ce système consiste à avoir deux clefs appelées des **bi-clefs**: | + | Notez que c'est bloquant. Le fait d'avoir utiliser ^C a interrompu le processus du conteneur |
| - | | + | < |
| - | * Une clef **secrète** ou **privée** pour le déchiffrement | + | ^Croot@debian9: |
| + | CONTAINER ID IMAGE | ||
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| + | </ | ||
| - | {{: | + | ====1.13 - Démarrer un Conteneur en mode Détaché==== |
| - | * L' | + | Démarrez maintenant le conteneur |
| - | * A partir | + | |
| - | * L' | + | |
| - | Ce système est basé sur ce que l'on appelle une **fonction à trappe à sens unique** ou **one-way trap door**. | + | < |
| + | root@debian9: | ||
| + | aabb064d4b0ade1f19216b6174631fa32a2053f6aa9d59bd724ea90ce534b004 | ||
| + | root@debian9: | ||
| + | CONTAINER ID IMAGE | ||
| + | aabb064d4b0a | ||
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| + | </ | ||
| - | Il existe toutefois | + | ====1.14 - Accèder aux Services d'un Conteneur de l'Extérieur==== |
| - | Les algorithmes de chiffrement asymétrique couramment utilisés en informatique sont: | + | Installez le navigateur texte **lynx** |
| - | * **[[wpfr>Digital_Signature_Algorithm|Digital Signature Algorithm]]** (DSA) | + | <code> |
| - | | + | root@debian9: |
| + | Lecture des listes de paquets... Fait | ||
| + | Construction de l' | ||
| + | Lecture des informations d' | ||
| + | The following additional packages will be installed: | ||
| + | | ||
| + | Les NOUVEAUX paquets suivants seront installés : | ||
| + | lynx lynx-common | ||
| + | 0 mis à jour, 2 nouvellement installés, 0 à enlever et 94 non mis à jour. | ||
| + | Il est nécessaire de prendre 1 730 ko dans les archives. | ||
| + | Après cette opération, 5 590 ko d' | ||
| + | Souhaitez-vous continuer ? [O/n] o | ||
| + | Réception de:1 http:// | ||
| + | Réception de:2 http:// | ||
| + | 1 730 ko réceptionnés en 6s (283 ko/s) | ||
| + | Sélection du paquet lynx-common précédemment désélectionné. | ||
| + | (Lecture de la base de données... 113082 fichiers et répertoires déjà installés.) | ||
| + | Préparation du dépaquetage de .../ | ||
| + | Dépaquetage de lynx-common (2.8.9dev11-1) ... | ||
| + | Sélection du paquet lynx précédemment désélectionné. | ||
| + | Préparation du dépaquetage de .../ | ||
| + | Dépaquetage de lynx (2.8.9dev11-1) ... | ||
| + | Traitement des actions différées (« triggers ») pour mime-support (3.60) ... | ||
| + | Traitement des actions différées (« triggers ») pour man-db (2.7.6.1-2) ... | ||
| + | Paramétrage de lynx-common (2.8.9dev11-1) ... | ||
| + | Paramétrage de lynx (2.8.9dev11-1) ... | ||
| + | update-alternatives: | ||
| + | </ | ||
| - | ==La Clef de Session== | + | Vérifiez que nginx répond aux requetes : |
| - | Ce système est un compromis entre le système symétrique et le système asymétrique. Il permet l' | + | < |
| + | root@debian9: | ||
| + | | ||
| - | {{: | + | If you see this page, the nginx web server is successfully installed |
| + | and working. Further configuration is required. | ||
| - | Ce système fonctionne de la façon suivante : | + | For online documentation and support please refer to [1]nginx.org. |
| + | | ||
| - | * L' | + | Thank you for using nginx. |
| - | * L' | + | |
| - | * L' | + | |
| - | * L' | + | |
| - | ===Fonctions de Hachage=== | + | Références |
| - | La fonction de **hachage**, | + | 1. http:// |
| + | 2. http:// | ||
| + | </ | ||
| - | {{: | + | ====1.15 - Arrêter et Démarrer un Conteneur==== |
| - | Les deux algorithmes de hachage utilisés sont: | + | Arrêtez le conteneur nginx : |
| - | | + | < |
| - | * **[[wpfr> | + | root@debian9: |
| + | CONTAINER ID IMAGE | ||
| + | aabb064d4b0a | ||
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| + | root@debian9: | ||
| + | aabb | ||
| + | root@debian9: | ||
| + | CONTAINER ID IMAGE | ||
| + | aabb064d4b0a | ||
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| + | </ | ||
| - | Lors de son envoie, | + | Démarrez |
| - | {{:redhat:lx04:crypto6.gif|Cette image issue de Comment Ça Marche (www.commentcamarche.net) est mise à disposition sous les termes de la licence Creative Commons. Vous pouvez copier, modifier des copies de l'image, dans les conditions fixées par la licence, tant que cette note apparaît clairement.}} | + | < |
| - | + | root@debian9:~# docker start aabb | |
| - | * A la réception du message, le destinataire ou l’utilisateur B calcule le haché du message reçu et le compare avec le haché accompagnant le document. | + | aabb |
| - | * Si le message ou le haché a été falsifié durant la communication, | + | root@debian9:~# docker ps -a |
| + | CONTAINER ID IMAGE | ||
| + | aabb064d4b0a | ||
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| + | </ | ||
| - | <WRAP center round important 50%> | + | ====1.16 - Utiliser des Signaux avec un Conteneur==== |
| - | **Important** - Ce système permet de vérifier que l' | + | |
| - | </ | + | |
| - | ===Signature Numérique=== | + | Utilisez un signal pour tuer le processus du conteneur de nginx : |
| - | Pour garantir l'authentification du message l‘utilisateur A va chiffrer ou **signer** le haché à l'aide de sa clé privée. Le haché signé est appelé un **sceau**. | + | < |
| + | root@debian9: | ||
| + | aabb | ||
| + | root@debian9: | ||
| + | CONTAINER ID IMAGE | ||
| + | aabb064d4b0a | ||
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| + | </ | ||
| - | {{:redhat: | + | Redémarrez un conteneur en cours : |
| - | | + | < |
| - | * A la réception du message L’utilisateur B déchiffre le sceau avec la clé publique de l’utilisateur A. | + | root@debian9: |
| - | * Il compare le haché obtenu au haché reçu en pièce jointe. | + | aabb |
| - | + | root@debian9: | |
| - | Ce mécanisme de création de sceau est appelé **scellement**. | + | CONTAINER ID IMAGE |
| + | aabb064d4b0a | ||
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| + | root@debian9: | ||
| + | aabb | ||
| + | root@debian9: | ||
| + | CONTAINER ID IMAGE | ||
| + | aabb064d4b0a | ||
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| + | </ | ||
| - | Ce mécanisme est identique au procédé utilisé par SSH lors d'une connexion | + | ====1.17 - Forcer la Suppression |
| - | ===PKI=== | + | Supprimez un conteneur en cours d' |
| - | On appelle **[[wpfr>Public_Key_Infrastructure|PKI]]** | + | <code> |
| + | root@debian9: | ||
| + | Error response from daemon: You cannot remove a running container aabb064d4b0ade1f19216b6174631fa32a2053f6aa9d59bd724ea90ce534b004. Stop the container before attempting removal or force remove | ||
| + | root@debian9: | ||
| + | CONTAINER ID IMAGE | ||
| + | aabb064d4b0a | ||
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| + | root@debian9: | ||
| + | aabb | ||
| + | root@debian9: | ||
| + | CONTAINER ID IMAGE | ||
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| + | </ | ||
| - | Les cryptosystèmes à clés publiques permettent de s' | + | ===1.18 - Utilisation Simple |
| - | * La clé publique est bien celle de son propriétaire ; | + | Créez le fichier index.html et placez-le dans le répertoire /root/www : |
| - | * Le propriétaire de la clé est digne de confiance ; | + | |
| - | * La clé est toujours valide. | + | |
| - | Ainsi, il est nécessaire d' | + | < |
| + | root@debian9: | ||
| + | root@debian9:~# vi index.html | ||
| + | root@debian9: | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | </ | ||
| + | </ | ||
| + | root@debian9: | ||
| + | </ | ||
| - | Le tiers de confiance | + | Indiquez au conteneur que son répertoire **/ |
| - | Pour ce faire, l' | + | < |
| + | root@debian9: | ||
| + | c080793965de8a6a60db212d7e4d96de84b55352c224c054dced75b409e39bf2 | ||
| + | root@debian9: | ||
| + | Accueil du site nginx | ||
| - | Le rôle de l' | ||
| - | * enregistrer des demandes de clés en vérifiant l' | + | root@debian9: |
| - | * générer les paires de clés (clé privée | + | </code> |
| - | * garantir la confidentialité des clés privées correspondant aux clés publiques ; | + | |
| - | * certifier l' | + | |
| - | * révoquer des clés (en cas de perte par son propriétaire, | + | |
| - | Une infrastructure à clé publique est en règle générale composée | + | <WRAP center round important> |
| + | **Important** - Notez ici l' | ||
| + | </ | ||
| - | * L' | + | ====1.19 - Télécharger une image sans créer un conteneur==== |
| - | * L' | + | |
| - | * L' | + | |
| - | ==Certificats X509== | + | Téléchargez l' |
| - | Pour palier aux problèmes liés à des clefs publiques piratées, un système de certificats a été mis en place. | + | < |
| + | root@debian9: | ||
| + | Using default tag: latest | ||
| + | latest: Pulling from library/ | ||
| + | 8ba884070f61: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for centos: | ||
| + | </ | ||
| - | Le certificat permet d’associer la clef publique à une entité ou une personne. Les certificats sont délivrés par des Organismes | + | Vérifiez le contenu |
| - | Les certificats sont des fichiers divisés en deux parties | + | < |
| + | root@debian9:~# docker run -it centos bash | ||
| + | [root@86252a3f00f4 /]# cat / | ||
| + | CentOS Linux release 7.6.1810 (Core) | ||
| + | [root@86252a3f00f4 /]# rpm -qa | more | ||
| + | bind-license-9.9.4-73.el7_6.noarch | ||
| + | bash-4.2.46-31.el7.x86_64 | ||
| + | glibc-common-2.17-260.el7_6.3.x86_64 | ||
| + | nss-softokn-freebl-3.36.0-5.el7_5.x86_64 | ||
| + | filesystem-3.2-25.el7.x86_64 | ||
| + | glibc-2.17-260.el7_6.3.x86_64 | ||
| + | nspr-4.19.0-1.el7_5.x86_64 | ||
| + | popt-1.13-16.el7.x86_64 | ||
| + | libcom_err-1.42.9-13.el7.x86_64 | ||
| + | libcap-2.22-9.el7.x86_64 | ||
| + | libstdc++-4.8.5-36.el7.x86_64 | ||
| + | info-5.1-5.el7.x86_64 | ||
| + | gawk-4.0.2-4.el7_3.1.x86_64 | ||
| + | libselinux-2.5-14.1.el7.x86_64 | ||
| + | grep-2.20-3.el7.x86_64 | ||
| + | keyutils-libs-1.5.8-3.el7.x86_64 | ||
| + | libverto-0.2.5-4.el7.x86_64 | ||
| + | p11-kit-trust-0.23.5-3.el7.x86_64 | ||
| + | openssl-libs-1.0.2k-16.el7.x86_64 | ||
| + | krb5-libs-1.15.1-37.el7_6.x86_64 | ||
| + | xz-libs-5.2.2-1.el7.x86_64 | ||
| + | libdb-5.3.21-24.el7.x86_64 | ||
| + | libgpg-error-1.12-3.el7.x86_64 | ||
| + | libgcrypt-1.5.3-14.el7.x86_64 | ||
| + | lua-5.1.4-15.el7.x86_64 | ||
| + | libuuid-2.23.2-59.el7.x86_64 | ||
| + | libmount-2.23.2-59.el7.x86_64 | ||
| + | shared-mime-info-1.8-4.el7.x86_64 | ||
| + | gzip-1.5-10.el7.x86_64 | ||
| + | findutils-4.5.11-6.el7.x86_64 | ||
| + | diffutils-3.3-4.el7.x86_64 | ||
| + | expat-2.1.0-10.el7_3.x86_64 | ||
| + | audit-libs-2.8.4-4.el7.x86_64 | ||
| + | pam-1.1.8-22.el7.x86_64 | ||
| + | nss-softokn-3.36.0-5.el7_5.x86_64 | ||
| + | nss-3.36.0-7.1.el7_6.x86_64 | ||
| + | libassuan-2.1.0-3.el7.x86_64 | ||
| + | nss-tools-3.36.0-7.1.el7_6.x86_64 | ||
| + | gobject-introspection-1.56.1-1.el7.x86_64 | ||
| + | --More-- | ||
| + | </ | ||
| - | * La partie contenant les informations | + | ====1.20 - S'attacher à un conteneur en cours d' |
| - | * La partie contenant la signature de l'autorité de certification | + | |
| - | La structure des certificats est normalisée par le standard **[[wpfr> | + | Arretez |
| - | Elle contient | + | < |
| + | [root@86252a3f00f4 /]# exit | ||
| + | exit | ||
| + | root@debian9:~# docker ps -a | ||
| + | CONTAINER ID IMAGE | ||
| + | 86252a3f00f4 | ||
| + | c080793965de | ||
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| + | root@debian9: | ||
| + | 8625 | ||
| + | root@debian9: | ||
| + | [root@86252a3f00f4 /]# ls | ||
| + | anaconda-post.log | ||
| + | [root@86252a3f00f4 /]# | ||
| + | </ | ||
| - | * Le nom de l' | + | ====1.21 - Installer un logiciel dans le conteneur=== |
| - | * Le nom du propriétaire du certificat | + | |
| - | * La date de validité du certificat | + | |
| - | * L' | + | |
| - | * La clé publique du propriétaire | + | |
| - | Le Certificat est signé par l' | + | Créez le fichier **/ |
| - | {{:redhat: | + | < |
| + | [root@86252a3f00f4 /]# vi / | ||
| + | [root@86252a3f00f4 /]# cat / | ||
| + | [mongodb-org-4.2] | ||
| + | name=MongoDB Repository | ||
| + | baseurl=https:// | ||
| + | gpgcheck=1 | ||
| + | enabled=1 | ||
| + | gpgkey=https:// | ||
| + | [root@86252a3f00f4 /]# | ||
| + | </ | ||
| - | La vérification se passe ainsi: | + | Installez mongo : |
| - | {{: | + | < |
| + | [root@86252a3f00f4 /]# yum install -y mongodb-org | ||
| + | </ | ||
| - | =====LAB #2 - Utilisation de GnuPG===== | + | Démarrez mongod : |
| - | ====2.1 - Présentation==== | + | < |
| + | [root@86252a3f00f4 /]# mongod --config /etc/mongod.conf & | ||
| + | [1] 82 | ||
| + | [root@86252a3f00f4 /]# about to fork child process, waiting until server is ready for connections. | ||
| + | forked process: 84 | ||
| + | child process started successfully, | ||
| - | **GNU Privacy Guard** permet aux utilisateurs de transférer des messages chiffrés et/ou signés. | + | [1]+ Done mongod --config |
| + | [root@86252a3f00f4 /]# | ||
| + | </ | ||
| - | ====2.2 - Utilisation==== | + | Vérifiez que mongod est démarré |
| - | + | ||
| - | Pour initialiser %%GnuPG%%, saisissez la commande suivante | + | |
| < | < | ||
| - | root@debian12:~# gpg | + | [root@86252a3f00f4 /]# ps aux |
| - | gpg: directory '/ | + | USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND |
| - | gpg: keybox '/root/.gnupg/ | + | root 1 0.0 0.1 11828 2996 pts/0 Ss 16:57 0:00 bash |
| - | gpg: WARNING: no command supplied. | + | root 84 1.2 2.2 294692 46716 ? Sl 17:16 0:00 mongod --config /etc/mongod.conf |
| - | gpg: Go ahead and type your message | + | root |
| - | ^C | + | |
| - | gpg: signal Interrupt caught | + | |
| </ | </ | ||
| - | <WRAP center round important 50%> | + | Utilisez le client mongo pour se connecter au serveur |
| - | **Important** - Notez l' | + | |
| - | </ | + | |
| - | Pour générer les clefs, saisissez la commande suivante | + | < |
| + | [root@86252a3f00f4 /]# mongo | ||
| + | MongoDB shell version: 4.2.2 | ||
| + | connecting to: test | ||
| + | Welcome to the MongoDB shell. | ||
| + | For interactive help, type " | ||
| + | For more comprehensive documentation, | ||
| + | http:// | ||
| + | Questions? Try the support group | ||
| + | http:// | ||
| + | Server has startup warnings: | ||
| + | 2019-04-09T17: | ||
| + | 2019-04-09T17: | ||
| + | > | ||
| + | </ | ||
| - | <WRAP center round important 50%> | + | Sortez de mongo et du conteneur : |
| - | **Important** - Lorsque le système vous demande une Passphrase, saisissez une valeur que n' | + | |
| - | </ | + | |
| < | < | ||
| - | root@debian12:~# gpg --full-generate-key | + | > exit |
| - | gpg (GnuPG) 2.2.40; Copyright (C) 2022 g10 Code GmbH | + | bye |
| - | This is free software: you are free to change and redistribute it. | + | [root@86252a3f00f4 /]# exit |
| - | There is NO WARRANTY, to the extent permitted by law. | + | exit |
| + | root@debian9:~# | ||
| + | </ | ||
| - | Please select what kind of key you want: | + | ====1.22 - Utilisation de la commande docker commit==== |
| - | (1) RSA and RSA (default) | + | |
| - | (2) DSA and Elgamal | + | |
| - | (3) DSA (sign only) | + | |
| - | (4) RSA (sign only) | + | |
| - | (14) Existing key from card | + | |
| - | Your selection? 1 | + | |
| - | RSA keys may be between 1024 and 4096 bits long. | + | |
| - | What keysize do you want? (3072) | + | |
| - | Requested keysize is 3072 bits | + | |
| - | Please specify how long the key should be valid. | + | |
| - | 0 = key does not expire | + | |
| - | < | + | |
| - | < | + | |
| - | < | + | |
| - | < | + | |
| - | Key is valid for? (0) | + | |
| - | Key does not expire at all | + | |
| - | Is this correct? (y/N) y | + | |
| - | GnuPG needs to construct a user ID to identify your key. | + | Créez maintenant une nouvelle image à partir de votre conteneur : |
| - | Real name: ITTRAINING | + | < |
| - | Email address: infos@ittraining.team | + | root@debian9:~# docker ps -a |
| - | Comment: Test key | + | CONTAINER |
| - | You selected this USER-ID: | + | 86252a3f00f4 |
| - | "ITTRAINING | + | c080793965de |
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| + | root@debian9: | ||
| + | sha256: | ||
| + | </ | ||
| - | Change (N)ame, (C)omment, (E)mail or (O)kay/ | + | Supprimez le conteneur utilisé pour créer l'image : |
| - | We need to generate a lot of random bytes. It is a good idea to perform | + | |
| - | some other action (type on the keyboard, move the mouse, utilize the | + | |
| - | disks) during the prime generation; this gives the random number | + | |
| - | generator a better chance to gain enough entropy. | + | |
| - | We need to generate a lot of random bytes. It is a good idea to perform | + | |
| - | some other action (type on the keyboard, move the mouse, utilize the | + | |
| - | disks) during the prime generation; this gives the random number | + | |
| - | generator a better chance to gain enough entropy. | + | |
| - | gpg: / | + | |
| - | gpg: directory | + | |
| - | gpg: revocation certificate stored as '/ | + | |
| - | public and secret key created and signed. | + | |
| - | pub | + | < |
| - | B6022CC107539B4036A90FAEABAD13CD27F9E686 | + | root@debian9: |
| - | uid ITTRAINING (Test key) < | + | 8625 |
| - | sub | + | root@debian9: |
| + | CONTAINER ID IMAGE | ||
| + | c080793965de | ||
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| </ | </ | ||
| - | La liste de clefs peut être visualisée avec la commande suivante | + | Utilisez |
| < | < | ||
| - | root@debian12:~# gpg --list-keys | + | root@debian9:~# docker run -it --name mongo i2tch/ |
| - | gpg: checking the trustdb | + | [root@d20fb56a38b0 /]# ls / |
| - | gpg: marginals needed: 3 completes needed: 1 trust model: pgp | + | / |
| - | gpg: depth: 0 valid: | + | / |
| - | /root/.gnupg/pubring.kbx | + | [root@d20fb56a38b0 /]# ps aux |
| - | ------------------------ | + | USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND |
| - | pub | + | root |
| - | | + | root 15 0.0 0.1 51748 3468 pts/0 R+ |
| - | uid | + | |
| - | sub | + | |
| </ | </ | ||
| - | Pour importer la clef d'un correspondant dans sa trousse de clefs il convient d' | + | Editez le fichier / |
| - | <WRAP center round important 50%> | + | <code> |
| - | **Important** | + | [root@d20fb56a38b0 /]# echo "/ |
| - | </WRAP> | + | [root@d20fb56a38b0 |
| + | . " | ||
| + | fi | ||
| + | fi | ||
| + | done | ||
| - | # gpg --import la-clef.asc | + | unset i |
| + | unset -f pathmunge | ||
| + | fi | ||
| + | # vim: | ||
| + | / | ||
| + | </ | ||
| - | Pour exporter sa clef publique, il convient d' | + | Consultez |
| < | < | ||
| - | root@debian12:~# gpg --export | + | [root@d20fb56a38b0 /]# exit |
| + | exit | ||
| + | root@debian9:~# docker ps -a | ||
| + | CONTAINER ID IMAGE | ||
| + | d20fb56a38b0 | ||
| + | c080793965de | ||
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| + | </ | ||
| - | root@debian12:~# cat mykey.asc | + | Utilisez la commande commit pour " |
| - | -----BEGIN PGP PUBLIC KEY BLOCK----- | + | |
| - | mQGNBGkpk+gBDACq6M7rUNQFu/ | + | < |
| - | oV9JmFfRe4P2QG/mgmSaGgeO0sE5m+r2Jhif2fShjHYLd6VTSVZRyfO+NW3MDbkm | + | root@debian9: |
| - | MtIf4LlXRrTALGE5TclLWFz5a2iqRjtT8IjSPAu1M9TLUaMXtWXN6jQY1YOnjxPN | + | sha256: |
| - | 3HL8bwdaY0k8icKr8JRbmEijCWo2F4t2qTtdOXuRFAImxBpX49eJR0oC5bzXZPYx | + | |
| - | LbirNsEwSULIyQ71gdF5OUb0aOSiQLXLuTLAs2BnxAJ82tB/ | + | |
| - | +t0eHdWzUHH4qlXuNtBXK7pEbvjqftO69PJLDp/ | + | |
| - | qvRgll3fojjr91WWWqr8YTd4EiTvq9KfUyAiTOfKm8k4iRQRTJir267Fq8Mno8/ | + | |
| - | My1tNeHWzCXMs3k/ | + | |
| - | XTBUX/ | + | |
| - | dHRyYWluaW5nLnRlYW0+iQHOBBMBCgA4FiEEtgIswQdTm0A2qQ+uq60TzSf55oYF | + | |
| - | Amkpk+gCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQq60TzSf55oZEsAv+ | + | |
| - | Ky14vHWjMzU1ieE+XStqGYfjfAHhaNrpkWCz6miozuh+ESifNWpJd96bzwgNLGob | + | |
| - | E5mA9oja5jyAEQUGT+gEwgvkbYVe4sf4UcXPRrvDqKiEOkN5rra3kYYdhHhpiFes | + | |
| - | BmwQvW2dyElNO1ee/ | + | |
| - | C5kqTMRXdoWR2ZP2HLZjUstRX7d9BP/ | + | |
| - | TqtAMmtp5IXalT+vKwhMu0MwUfyXyvl7ery4kxfmFtEeJQyxrdK2gihDxr0ndxBH | + | |
| - | mowlIoBiGYMhUr/ | + | |
| - | VBlBdhX2SlE9XJOjLq9ppV5Vr9u6ZauwEI6kBLoagjWOF3t34Gnvel8zO+H5fhhq | + | |
| - | UKMOAbC0SYmLVIPNUauHYoKiJlWb+Dlr96NsPm0sYBbB047hr0evBUmkJNrulI3N | + | |
| - | uQGNBGkpk+gBDADZu1B0itmBIGzxjGmUjK9UagW3HNLNVX3jn2Jwe7yl3vL/ | + | |
| - | qBRydky32P4whbUSiJN71Tze9l+WOxeXGa0orKPPha/ | + | |
| - | xCrS131SYjFb5dcQXoqTtUk8Wu4qoMHu/ | + | |
| - | zs6azU/ | + | |
| - | FIpfm95Q+wtC224wckro/ | + | |
| - | IITHq92gQSAKFhwSauaPtJ++oQNRgz5vJhCg78XfyBGpwDS6P0NM5RVEz6LMhQzI | + | |
| - | 4LziGmYH/ | + | |
| - | CrtEjyAIQxCmEUF0vPa7X1KB+FxCpJ8mYXBZ5w1DwBN7qsOnnHZKFcaPGW8r1am6 | + | |
| - | Ab25ee028mua9RkAEQEAAYkBtgQYAQoAIBYhBLYCLMEHU5tANqkPrqutE80n+eaG | + | |
| - | BQJpKZPoAhsMAAoJEKutE80n+eaGCRgMAJiG7Q8oF6oMkn6Xh7kXVH2yF4CKN9/ | + | |
| - | / | + | |
| - | YoxDxegwlk9+gPiOMJ0+9R43IUs+jFrra1jcUpSg+1Nv2IijdPwape3HyPhYgDmZ | + | |
| - | VxORrNtqBCkhtLpJO5VTiThAny+rNBHk1t1vQg4tEkCLGcOD8bsdxhACZnM0DVYY | + | |
| - | rA6afeDnm7CTfVtc3QFAi2+ltYcDIrMxMF0b1VASlbU14TE6ep2Ic30ScpDJL8De | + | |
| - | skhWi2/ | + | |
| - | vh6kVR0MPTFjg+8khUjjrSYUzqiiK6iJDxn+m0XJvHzQTeCHQlgRrPj9HGp7isyK | + | |
| - | o9Wf8fVvnksR8xc/ | + | |
| - | DTh6aJal6iGcG4aXbTzwIFXHW9WipS5B4A== | + | |
| - | =rrxA | + | |
| - | -----END PGP PUBLIC KEY BLOCK----- | + | |
| </ | </ | ||
| - | Cette clef peut ensuite être jointe à des messages électroniques ou bien déposée sur un serveur | + | Démarrez |
| - | + | ||
| - | ===Signer un message=== | + | |
| - | + | ||
| - | Créez maintenant un message à signer | + | |
| < | < | ||
| - | root@debian12:~# vi message.txt | + | root@debian9:~# docker rm d20f |
| + | d20f | ||
| + | root@debian9: | ||
| + | CONTAINER ID IMAGE | ||
| + | c080793965de | ||
| + | 4f157e179134 | ||
| + | 04b5ab87539a | ||
| + | root@debian9: | ||
| + | [root@bcec3f27ed58 /]# about to fork child process, waiting until server is ready for connections. | ||
| + | forked process: 16 | ||
| + | child process started successfully, | ||
| - | root@debian12:~# cat message.txt | + | [1]+ Done / |
| - | # ~/message.txt | + | [root@bcec3f27ed58 /]# ps aux |
| - | Ceci est un message de test pour GnuPG | + | USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND |
| + | root | ||
| + | root 16 2.0 2.4 298788 49276 ? Sl | ||
| + | root 39 0.0 0.1 51748 3476 pts/0 R+ | ||
| + | [root@bcec3f27ed58 /]# | ||
| </ | </ | ||
| - | Pour signer ce message en format binaire, il convient d'utiliser la commande suivante : | + | ====1.23 - Se connecter au serveur du conteneur de l'extérieur==== |
| - | <WRAP center round important 50%> | + | Pour pouvoir se connecter à mongodb depuis |
| - | **Important** - Entrez votre Passphrase quand gpg vous la demande. | + | |
| - | </WRAP> | + | |
| < | < | ||
| - | root@debian12:~# gpg --default-key ITTRAINING --detach-sign message.txt | + | [root@bcec3f27ed58 /]# vi /etc/mongod.conf |
| - | gpg: using " | + | [root@bcec3f27ed58 /]# cat / |
| + | | ||
| + | </ | ||
| - | root@debian12: | + | Sortez du conteneur, re-créez une image, supprimez le conteneur utilisé et relancez de nouveau le conteneur |
| - | -rw-r--r-- 1 root root 55 Nov 28 13:28 message.txt | + | |
| - | -rw-r--r-- 1 root root 461 Nov 28 13:28 message.txt.sig | + | |
| - | root@debian12:~# cat message.txt.sig | + | < |
| + | [root@bcec3f27ed58 /]# exit | ||
| + | exit | ||
| + | root@debian9:~# docker commit mongo i2tch/ | ||
| + | sha256: | ||
| + | root@debian9: | ||
| + | mongo | ||
| + | root@debian9: | ||
| + | [root@d2ddb4f8ca8a /]# about to fork child process, waiting until server is ready for connections. | ||
| + | forked process: 16 | ||
| + | [root@d2ddb4f8ca8a /]# child process started successfully, | ||
| - | 4!, | + | [1]+ Done / |
| - | '| | + | [root@d2ddb4f8ca8a /]# |
| - | M< | + | |
| </ | </ | ||
| - | Pour signer ce message en format ascii, il convient d' | + | Dans votre machine hôte, configurez le dépôt de mongodb |
| < | < | ||
| - | root@debian12:~# | + | [root@f5b45072b831 /]# exit |
| + | root@debian9:~# | ||
| + | root@debian9: | ||
| + | root@debian9: | ||
| + | root@debian9: | ||
| + | Executing: /tmp/apt-key-gpghome.xMuszKS6JM/ | ||
| + | gpg: key 68818C72E52529D4: | ||
| + | gpg: Total number processed: 1 | ||
| + | gpg: | ||
| + | root@debian9: | ||
| + | root@debian9: | ||
| + | deb http:// | ||
| + | root@debian9: | ||
| + | root@debian9: | ||
| + | </ | ||
| - | gpg: using " | + | Cette fois, installez uniquement le client de mongodb |
| - | root@debian12:~# ls -l | grep message | + | < |
| - | -rw-r--r-- 1 root root 55 Nov 28 13:28 message.txt | + | root@debian9:~# apt-get install mongodb-org-shell |
| - | -rw-r--r-- 1 root root 691 Nov 28 13:31 message.txt.asc | + | Lecture des listes de paquets... Fait |
| - | -rw-r--r-- 1 root root 461 Nov 28 13:28 message.txt.sig | + | Construction de l' |
| - | + | Lecture des informations d' | |
| - | root@debian12:~# cat message.txt.asc | + | Les NOUVEAUX paquets suivants seront installés : |
| - | -----BEGIN PGP SIGNATURE----- | + | mongodb-org-shell |
| - | + | 0 mis à jour, 1 nouvellement installés, 0 à enlever et 95 non mis à jour. | |
| - | iQHKBAABCgA0FiEEtgIswQdTm0A2qQ+uq60TzSf55oYFAmkplgkWHGluZm9zQGl0 | + | Il est nécessaire de prendre 9 809 ko dans les archives. |
| - | dHJhaW5pbmcudGVhbQAKCRCrrRPNJ/nmhiteC/kBXVFzjOQYIzdt4ALI37gCmd7x | + | Après cette opération, 39,8 Mo d' |
| - | Ml72F9permfoLc83fj+zZfigUxZe4DHx0TslVtFhntkg+7wF1H3MmUyKOhwCXFO4 | + | Réception de:1 http://repo.mongodb.org/apt/debian stretch/mongodb-org/4.0/main amd64 mongodb-org-shell amd64 4.0.8 [9 809 kB] |
| - | ccyE9/DDJR384muuAP1q05bnXz0SHkTQaXVteCvAfHB8kzqQg04ePCBcIWK6YQVv | + | 9 809 ko réceptionnés en 7s (1 245 ko/s) |
| - | MBVm2O4pFDXWu1+0S69YnAelElZrzoqCaqprkQCcJvekBSV2NUNPLcwcBGq966+q | + | Sélection du paquet mongodb-org-shell précédemment désélectionné. |
| - | T9bGxPtW/5oTaPfFRzWwT/47ajpB66v3kEyGlc+gMpD4PFKZhLoEpgpByBWRWvhm | + | (Lecture de la base de données... 91513 fichiers et répertoires déjà installés.) |
| - | ZQsz2eby3oyv5KduA2emMnstQGCBq6zukYUpTgtzXB6jF1S71okiow11NsPra0m+ | + | Préparation du dépaquetage de .../mongodb-org-shell_4.0.8_amd64.deb ... |
| - | 9CAcg3tiylnkUJEgsvfZ45uctN+2UqBNAXMgVsHGUhJtugfPzfwWpfC/BMMdLS46 | + | Dépaquetage de mongodb-org-shell (4.0.8) ... |
| - | g2nTttJexAGjjtw4Y0uFIYbNI0xXeH8ooh0AgQcXS5IOVH2zYs0GIdMxzRYFhRmc | + | Paramétrage de mongodb-org-shell (4.0.8) ... |
| - | nVRd/ | + | Traitement des actions différées (« triggers ») pour man-db (2.7.6.1-2) ... |
| - | =2N1N | + | |
| - | -----END PGP SIGNATURE----- | + | |
| </ | </ | ||
| - | Pour signer | + | Notez qu' |
| < | < | ||
| - | root@debian12:~# gpg --default-key ITTRAINING --clearsign message.txt | + | root@debian9:~# docker inspect mongo | grep IP |
| - | gpg: using "ITTRAINING" | + | " |
| - | File ' | + | " |
| - | + | " | |
| - | root@debian12:~# ls -l | grep message | + | " |
| - | -rw-r--r-- 1 root root 55 Nov 28 13:28 message.txt | + | " |
| - | -rw-r--r-- 1 root root 795 Nov 28 13:33 message.txt.asc | + | " |
| - | -rw-r--r-- 1 root root 461 Nov 28 13:28 message.txt.sig | + | " |
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | </ | ||
| - | root@debian12: | + | Démarrez donc le conteneur et cherchez l' |
| - | -----BEGIN PGP SIGNED MESSAGE----- | + | |
| - | Hash: SHA512 | + | |
| - | # ~/ | + | < |
| - | Ceci est un message de test pour GnuPG | + | root@debian9: |
| - | -----BEGIN PGP SIGNATURE----- | + | mongo |
| - | + | root@debian9: | |
| - | iQHKBAEBCgA0FiEEtgIswQdTm0A2qQ+uq60TzSf55oYFAmkplpsWHGluZm9zQGl0 | + | " |
| - | dHJhaW5pbmcudGVhbQAKCRCrrRPNJ/ | + | " |
| - | QzcoDIIDMF71lizXIQ4DL2GCKhO3pelEWfyofUxd1sddT2qIHIsRTULaqHPRRjOU | + | " |
| - | 9e/ | + | " |
| - | qNPNlSZ4kzim3LyASyg8SYTGfft35S1S+7bjoY7LHfJUlGuSFRtlDMlhTbrrDqhI | + | " |
| - | S3TL6EeNFCdEVoxCPamsAKvuk4BV8Fe2rCjQqm/ | + | " |
| - | i7lQkZz+IjoTqwrjboL1mPWt6DMgiBX0IWas4kxKiBeZzyDZm6HGNeeMsqnReTcR | + | " |
| - | TPNM9FdDmpcxYzrRbYAoWTmdhiPdD/ | + | " |
| - | i3yOFw/ | + | " |
| - | scYMCHrlrUfErpkLD1H6eFhSA4StmdZPmAA5DBA= | + | " |
| - | =07RM | + | " |
| - | -----END PGP SIGNATURE----- | + | " |
| + | " | ||
| + | " | ||
| + | " | ||
| </ | </ | ||
| - | Pour vérifier | + | Connectez-vous maintenant à votre mongodb à partir de la machine hôte : |
| < | < | ||
| - | root@debian12:~# gpg --verify message.txt.asc | + | root@debian9:~# mongo --host 172.17.0.3 |
| - | gpg: Signature made Fri 28 Nov 2025 01:33:31 PM CET | + | MongoDB shell version v4.0.8 |
| - | gpg: using RSA key B6022CC107539B4036A90FAEABAD13CD27F9E686 | + | connecting to: mongodb:// |
| - | gpg: | + | WARNING: No implicit session: Logical Sessions are only supported on server versions 3.6 and greater. |
| - | gpg: Good signature from " | + | Implicit session: dummy session |
| - | gpg: WARNING: not a detached signature; file ' | + | MongoDB server version: 4.2.2 |
| + | WARNING: shell and server versions do not match | ||
| + | Welcome to the MongoDB shell. | ||
| + | For interactive help, type "help". | ||
| + | For more comprehensive documentation, | ||
| + | http:// | ||
| + | Questions? Try the support group | ||
| + | http:// | ||
| + | Server has startup warnings: | ||
| + | 2019-04-09T17: | ||
| + | 2019-04-09T17: | ||
| + | > | ||
| </ | </ | ||
| - | <WRAP center round important 50%> | + | =====LAB #2 - Création |
| - | **Important** | + | |
| - | # gpg --verify message.txt.asc message.txt | + | Au contraire des solutions classiques de gestion de machines virtuelles où l' |
| - | </ | + | |
| - | ===Chiffrer un message=== | + | < |
| + | root@debian9: | ||
| + | docker: | ||
| + | root@debian9: | ||
| + | root@debian9: | ||
| + | déconnexion | ||
| + | trainee@manager: | ||
| + | Got permission denied while trying to connect to the Docker daemon socket at unix:/// | ||
| + | trainee@manager: | ||
| + | trainee@manager: | ||
| + | CONTAINER ID IMAGE | ||
| + | d02c6115724c | ||
| + | trainee@manager: | ||
| + | alpine1 | ||
| + | trainee@manager: | ||
| + | a214e2df0499c97e8da25a6c9ea751ac75344c9bcd7d238f8cb8d5c777510ab9 | ||
| + | trainee@manager: | ||
| + | CONTAINER ID IMAGE | ||
| + | a214e2df0499 | ||
| + | </ | ||
| - | Pour chiffrer un message, il faut disposer de la clef publique du destinataire du message. Ce dernier utilisera ensuite sa clef privée pour déchiffrer le message. Il convient de préciser le destinataire du message, ou plus précisément la clef publique à utiliser, lors d'un chiffrement : | + | =====LAB #3 - Le Script docker-bench-security.sh===== |
| - | gpg --recipient < | + | Le **Center for Internet Security (CIS)** est une organisation indépendante à but non-lucratif qui publie des best practices dans de nombreux domaines de l' |
| - | * //< | + | Le guide est divisé en plusieurs sections : |
| - | * //< | + | |
| - | Par exemple pour chiffrer un message en mode binaire, il convient | + | * La configuration de l' |
| + | * La configuration du daemon Docker, | ||
| + | * Les fichiers | ||
| + | * Les images ainsi que les fichiers servant à la construction des images, | ||
| + | * Le container runtime, | ||
| + | * Les opérations sécuritaires relatives à Docker, | ||
| + | * La configuration de Docker Swarm. | ||
| - | < | + | Ce guide est à utiliser avec le script **Docker Benchmark Security**. |
| - | root@debian12: | + | |
| - | root@debian12: | + | Clonez le script **docker-bench-security.sh** en utilisant **git** |
| - | -rw-r--r-- 1 root root 55 Nov 28 13:28 message.txt | + | |
| - | -rw-r--r-- 1 root root 795 Nov 28 13:33 message.txt.asc | + | |
| - | -rw-r--r-- 1 root root 510 Nov 28 13:35 message.txt.gpg | + | |
| - | -rw-r--r-- 1 root root 461 Nov 28 13:28 message.txt.sig | + | |
| - | root@debian12:~# cat message.txt.gpg | + | < |
| - | ӛS4 | + | trainee@manager: |
| - | t>25H@H:x+H n֩ˁ+B.^2Zھ~~~´4sd27J | + | Mot de passe : fenestros |
| - | # | + | root@debian9:~# git clone https:// |
| - | e^4, | + | Clonage dans ' |
| - | 5?" | + | remote: Enumerating objects: 18, done. |
| - | | + | remote: Counting objects: 100% (18/18), done. |
| + | remote: Compressing objects: 100% (16/16), done. | ||
| + | remote: Total 1921 (delta | ||
| + | Réception d' | ||
| + | Résolution des deltas: 100% (1339/ | ||
| </ | </ | ||
| - | Et pour chiffrer un message en mode ascii, il convient de saisir la commande suivante | + | Exécutez maintenant le script **Docker Benchmark Security** |
| < | < | ||
| - | root@debian12:~# gpg --recipient ITTRAINING | + | root@debian9:~# cd docker-bench-security/ |
| - | File ' | + | root@debian9: |
| + | # ------------------------------------------------------------------------------ | ||
| + | # Docker Bench for Security v1.3.5 | ||
| + | # | ||
| + | # Docker, Inc. (c) 2015- | ||
| + | # | ||
| + | # Checks for dozens of common best-practices around deploying Docker containers in production. | ||
| + | # Inspired by the CIS Docker Benchmark v1.2.0. | ||
| + | # ------------------------------------------------------------------------------ | ||
| - | root@debian12:~# ls -l | grep message | + | Initializing vendredi 8 novembre 2019, 12:12:03 (UTC+0100) |
| - | -rw-r--r-- 1 root root 55 Nov 28 13:28 message.txt | + | |
| - | -rw-r--r-- 1 root root 752 Nov 28 13:38 message.txt.asc | + | |
| - | -rw-r--r-- 1 root root 510 Nov 28 13:36 message.txt.gpg | + | |
| - | -rw-r--r-- 1 root root 461 Nov 28 13:28 message.txt.sig | + | |
| - | root@debian12: | ||
| - | -----BEGIN PGP MESSAGE----- | ||
| - | hQGMA9ObUzTZ86GvAQwAxAGoxKHBMh53+bPqHs338vhWjxAZs19aItMm+CM2pKu5 | + | [INFO] 1 - Host Configuration |
| - | i4euJ36o+oVfbVTcqVNh4Q8I72QTOYTRTeXRWaUtVjp055A07BtlxGPbps9GXkVv | + | |
| - | 1faIs8viwHF1FHDC3Iz/ | + | |
| - | ylZxPngzTOR4RDbMbkZ5OvJKXNrOOiHUSDOMmI9o9nu7sxnMiPP3NUqilN/ | + | |
| - | xveV/ | + | |
| - | 21umlYbcIPtw87+h9twBj7vK5FUi7j8C5QWoDoM4XERf/ | + | |
| - | dTaZlgTtxM3CY7/ | + | |
| - | bIlrpLbs6yqtjant1bkZ5PuNhB1bRNxrSKZUZKdEMeY5M+C0GjKskjN84+OqgjRV | + | |
| - | 39GkfPDwqw/ | + | |
| - | PKDwHyTKCGN3NQKOIrw9LbIXehYEdrdFwGizGUXba1EWwVs+qMsmFueoQfcvA19N | + | |
| - | CJ2HPuO3qAVIDpYyX+vwdKQASbb8AMQIIksoQv7i | + | |
| - | =481C | + | |
| - | -----END PGP MESSAGE----- | + | |
| - | </ | + | |
| - | Pour décrypter un message il convient d' | + | [INFO] 1.1 - General Configuration |
| + | [NOTE] 1.1.1 - Ensure the container host has been Hardened | ||
| + | [INFO] 1.1.2 - Ensure Docker is up to date | ||
| + | [INFO] | ||
| + | [INFO] | ||
| - | < | + | [INFO] 1.2 - Linux Hosts Specific Configuration |
| - | root@debian12: | + | [WARN] 1.2.1 - Ensure a separate partition for containers has been created |
| - | gpg: encrypted with 3072-bit RSA key, ID D39B5334D9F3A1AF, | + | ... |
| - | " | + | |
| - | # ~/message.txt | + | |
| - | Ceci est un message de test pour GnuPG | + | |
| </ | </ | ||
| - | =====LAB #3 - Mise en place de SSH et SCP===== | + | Ce script sert à automatiser le contrôle des points précédemment cités |
| - | ====3.1 - Introduction==== | + | * **[PASS]** : Concerne les points qui n'ont pas besoin d' |
| + | * **[WARN]** : Concerne les points qui **doivent** être modifiés, | ||
| + | * **[INFO]** : Concerne les points qui doivent être passés en revue selon les besoins de votre configuration, | ||
| + | * **[NOTE]** : Vous informe d'un **best practice**. | ||
| - | La commande **[[wpfr> | + | =====LAB #4 - Sécurisation |
| - | * Le **serveur SSH** | + | Lors de l'exécution |
| - | * le démon sshd, qui s' | + | |
| - | * Le **client SSH** | + | |
| - | * ssh ou scp, qui assure la connexion et le dialogue avec le serveur, | + | |
| - | * La **session** qui représente la connexion courante et qui commence juste après l' | + | |
| - | * Les **clefs** | + | |
| - | * **Couple | + | |
| - | * **Clef hôte asymétrique et persistante** garantissant l' | + | |
| - | * **Clef serveur asymétrique et temporaire** utilisée par le protocole SSH1 qui sert au chiffrement de la clé de session, | + | |
| - | * **Clef de session symétrique | + | |
| - | * La **base | + | |
| - | SSH fonctionne de la manière suivante pour la la mise en place d'un canal sécurisé: | + | < |
| + | ... | ||
| + | [INFO] 1 - Host Configuration | ||
| - | * Le client contacte le serveur sur son port 22, | + | [INFO] 1.1 - General Configuration |
| - | * Les client et le serveur échangent leur version de SSH. En cas de non-compatibilité de versions, l'un des deux met fin au processus, | + | [NOTE] 1.1.1 - Ensure the container host has been Hardened |
| - | | + | [INFO] 1.1.2 - Ensure Docker is up to date |
| - | * Sa clé hôte, | + | [INFO] |
| - | * Sa clé serveur, | + | [INFO] |
| - | * Une séquence aléatoire de huit octets à inclure dans les futures réponses du client, | + | |
| - | * Une liste de méthodes de chiffrage, compression et authentification, | + | |
| - | | + | |
| - | * Le client génère sa clé de session symétrique et la chiffre deux fois de suite, une fois avec la clé hôte du serveur et la deuxième fois avec la clé serveur. Le client envoie cette clé au serveur accompagnée de la séquence aléatoire et un choix d' | + | |
| - | * Le serveur déchiffre la clé de session, | + | |
| - | * Le client et le serveur mettent en place le canal sécurisé. | + | |
| - | ===SSH-1=== | + | [INFO] 1.2 - Linux Hosts Specific Configuration |
| + | [WARN] | ||
| + | [INFO] 1.2.2 - Ensure only trusted users are allowed to control Docker daemon | ||
| + | [INFO] | ||
| + | [WARN] 1.2.3 - Ensure auditing is configured for the Docker daemon | ||
| + | [WARN] 1.2.4 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.2.5 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.2.6 - Ensure auditing is configured for Docker files and directories - docker.service | ||
| + | [WARN] 1.2.7 - Ensure auditing is configured for Docker files and directories - docker.socket | ||
| + | [WARN] 1.2.8 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] 1.2.9 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] | ||
| + | [INFO] 1.2.10 | ||
| + | [INFO] | ||
| + | [WARN] 1.2.11 | ||
| + | [INFO] 1.2.12 | ||
| + | [INFO] | ||
| + | ... | ||
| + | </ | ||
| - | SSH-1 utilise une paire de clefs de type RSA1. Il assure l'intégrité des données | + | Les problèmes |
| - | Afin de s' | + | ====4.1 - [WARN] 1.2.1 - Ensure a separate partition for containers has been created==== |
| - | * **Kerberos**, | + | Par défaut, tous les fichiers de Docker sont stockés dans le répertoire |
| - | | + | |
| - | * **%%RhostsRSA%%**, | + | |
| - | * Par **clef asymétrique**, | + | |
| - | | + | |
| - | * Par **mot de passe**. | + | |
| - | ===SSH-2=== | + | ====4.2 - [WARN] 1.2.3 - Ensure auditing is configured for the Docker daemon==== |
| - | SSH-2 utilise **DSA**, | + | < |
| + | [WARN] 1.2.4 | ||
| + | [WARN] 1.2.5 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.2.6 | ||
| + | [WARN] 1.2.7 - Ensure auditing is configured for Docker files and directories - docker.socket | ||
| + | [WARN] 1.2.8 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.2.11 | ||
| + | </ | ||
| - | | + | Ces avertissements sont présents parce que **auditd** n'est pas installé et parce qu'il n'y a pas de règles spécifiques au daemon Docker et ses répertoires et fichiers associés. |
| - | * **SSH-AUTH** – Authentification Protocol, | + | |
| - | * **SSH-CONN** – Connection Protocol. | + | |
| - | SSH-2 diffère de SSH-1 essentiellement dans la phase authentification. | + | Pour installer auditd, utilisez **apt-get** : |
| - | Trois méthodes d' | + | < |
| + | root@debian9:~/ | ||
| + | </ | ||
| - | | + | Modifiez ensuite le fichier |
| - | * Identique à SSH-1 sauf avec l' | + | |
| - | * **%%RhostsRSA%%**, | + | |
| - | * Par **mot de passe**. | + | |
| - | ===L' | + | < |
| + | root@debian9: | ||
| + | root@debian9: | ||
| + | ## First rule - delete all | ||
| + | -D | ||
| - | L' | + | ## Increase the buffers to survive stress events. |
| + | ## Make this bigger for busy systems | ||
| + | -b 8192 | ||
| - | Avantage: | + | ## This determine how long to wait in burst of events |
| - | * Aucune configuration de clef asymétrique n'est nécessaire. | + | --backlog_wait_time 0 |
| - | Inconvénients: | + | ## Set failure mode to syslog |
| - | * L' | + | -f 1 |
| - | * Moins sécurisé qu'un système par clef asymétrique. | + | |
| - | ===L' | + | ##Docker |
| + | -w / | ||
| + | -w / | ||
| + | -w /etc/docker -p wa | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | </ | ||
| - | * Le **client** envoie au serveur une requête d' | + | <WRAP center round important 60%> |
| - | * Le **serveur** recherche une correspondance pour ce module dans le fichier des clés autorisés **~/ | + | **Important** : L'option |
| - | * Dans le cas où une correspondance n'est pas trouvée, le serveur met fin à la communication, | + | </ |
| - | | + | |
| - | * Le **client** reçoit le challenge | + | |
| - | | + | |
| - | ====3.2 | + | Re-démarrez ensuite auditd |
| - | + | ||
| - | La configuration du serveur s' | + | |
| < | < | ||
| - | root@debian12:~# cat /etc/ssh/sshd_config | + | root@debian9:~/ |
| + | </code> | ||
| - | # This is the sshd server system-wide configuration file. See | + | Vérifiez ensuite la prise en charge des règles : |
| - | # sshd_config(5) for more information. | + | |
| - | # This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games | + | < |
| + | root@debian9: | ||
| + | ## This file is automatically generated from /etc/audit/ | ||
| + | -D | ||
| + | -b 8192 | ||
| + | -f 1 | ||
| + | --backlog_wait_time 0 | ||
| + | -w /usr/bin/docker -p wa | ||
| + | -w / | ||
| + | -w /etc/docker -p wa | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w /usr/bin/ | ||
| + | -w /usr/bin/ | ||
| + | -w /usr/bin/ | ||
| + | </ | ||
| - | # The strategy used for options in the default sshd_config shipped with | + | <WRAP center round important 60%> |
| - | # OpenSSH is to specify options with their default value where | + | **Important** - Pour plus d' |
| - | # possible, but leave them commented. | + | </ |
| - | # default value. | + | |
| - | Include / | + | Ré-exécutez le script |
| - | #Port 22 | + | < |
| - | #AddressFamily any | + | root@debian9: |
| - | # | + | ... |
| - | # | + | [PASS] 1.2.4 - Ensure auditing is configured for Docker files and directories - / |
| + | [PASS] 1.2.5 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [PASS] 1.2.6 - Ensure auditing is configured for Docker files and directories - docker.service | ||
| + | [PASS] 1.2.7 - Ensure auditing is configured for Docker files and directories - docker.socket | ||
| + | [PASS] 1.2.8 - Ensure auditing is configured for Docker files and directories - / | ||
| + | ... | ||
| + | [PASS] 1.2.11 | ||
| + | ... | ||
| + | </ | ||
| - | #HostKey / | + | =====LAB |
| - | #HostKey / | + | |
| - | #HostKey / | + | |
| - | # Ciphers and keying | + | Exécutez de nouveau le script **docker-bench-security.sh**. Vous devez obtenir un résultat similaire à ceci en ce qui concerne la sécurité de la configuration du daemon Docker : |
| - | #RekeyLimit default none | + | |
| - | # Logging | + | < |
| - | # | + | ... |
| - | # | + | [INFO] 2 - Docker daemon configuration |
| + | [WARN] 2.1 - Ensure network traffic is restricted between containers on the default bridge | ||
| + | [PASS] 2.2 - Ensure the logging level is set to ' | ||
| + | [PASS] 2.3 - Ensure Docker is allowed to make changes to iptables | ||
| + | [PASS] 2.4 - Ensure insecure registries are not used | ||
| + | [PASS] 2.5 - Ensure aufs storage driver is not used | ||
| + | [INFO] 2.6 - Ensure TLS authentication for Docker daemon is configured | ||
| + | [INFO] | ||
| + | [INFO] 2.7 - Ensure the default ulimit is configured appropriately | ||
| + | [INFO] | ||
| + | [WARN] 2.8 - Enable user namespace support | ||
| + | [PASS] 2.9 - Ensure the default cgroup usage has been confirmed | ||
| + | [PASS] 2.10 - Ensure base device size is not changed until needed | ||
| + | [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled | ||
| + | [WARN] 2.12 - Ensure centralized and remote logging is configured | ||
| + | [PASS] 2.13 - Ensure live restore is Enabled (Incompatible with swarm mode) | ||
| + | [WARN] 2.14 - Ensure Userland Proxy is Disabled | ||
| + | [PASS] 2.15 - Ensure that a daemon-wide custom seccomp profile is applied if appropriate | ||
| + | [PASS] 2.16 - Ensure that experimental features are not implemented in production | ||
| + | [WARN] 2.17 - Ensure containers are restricted from acquiring new privileges | ||
| + | ... | ||
| + | </ | ||
| - | # Authentication: | + | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. |
| - | # | + | ====5.1 |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | Par défaut Docker permet un trafic réseau sans restrictions entre des conteneurs sur le même hôte. Il est cependant possible de modifier la configuration par défaut. Pour empêcher ceci, il faut fixer la valeur de **icc** à **false**. De cette façon, docker crée des conteneurs qui peuvent communiquer entre eux **uniquement** s'il existe un lien. |
| - | # Expect .ssh/authorized_keys2 to be disregarded by default in future. | + | Pour plus d' |
| - | # | + | |
| - | # | + | ====5.2 - [WARN] 2.8 - Enable user namespace support==== |
| - | # | + | Cet avertissement nous indique que l' |
| - | # | + | |
| - | # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts | + | Pour plus d' |
| - | # | + | |
| - | # Change to yes if you don't trust ~/.ssh/known_hosts for | + | |
| - | # HostbasedAuthentication | + | |
| - | # | + | |
| - | # Don't read the user's ~/.rhosts and ~/.shosts files | + | |
| - | # | + | |
| - | # To disable tunneled clear text passwords, change to no here! | + | ====5.3 - [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled==== |
| - | # | + | |
| - | # | + | |
| - | # Change to yes to enable challenge-response passwords | + | Par défaut, Docker permet un accès sans restrictions aux daemon Docker. Il est possible de restreindre l' |
| - | # some PAM modules and threads) | + | |
| - | KbdInteractiveAuthentication no | + | |
| - | # Kerberos options | + | Pour plus d' |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # GSSAPI options | + | ====5.4 - [WARN] 2.12 - Ensure centralized and remote logging is configured==== |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # Set this to 'yes' | + | Cet avertissement indique que la configuration de rsyslog ne permet pas l'envoie des traces vers un serveur de journalisation distant. Elle indique aussi que la valeur de **log-driver** n'a pas été spécifiée. Pour activer cette configuration, |
| - | # and session processing. If this is enabled, PAM authentication will | + | |
| - | # be allowed through the KbdInteractiveAuthentication and | + | |
| - | # PasswordAuthentication. | + | |
| - | # PAM authentication via KbdInteractiveAuthentication may bypass | + | |
| - | # the setting of " | + | |
| - | # If you just want the PAM account and session checks to run without | + | |
| - | # PAM authentication, | + | |
| - | # and KbdInteractiveAuthentication to ' | + | |
| - | UsePAM yes | + | |
| - | # | + | Pour plus d' |
| - | # | + | |
| - | # | + | |
| - | X11Forwarding yes | + | |
| - | # | + | |
| - | # | + | |
| - | #PermitTTY yes | + | |
| - | PrintMotd no | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | #UseDNS no | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # no default banner path | + | ====5.5 - [WARN] 2.14 - Ensure Userland Proxy is Disabled==== |
| - | #Banner none | + | |
| - | # Allow client to pass locale environment variables | + | Il existe deux méthodes pour qu'un conteneur puisse router vers l' |
| - | AcceptEnv LANG LC_* | + | |
| - | # override default of no subsystems | + | * le mode **Hairpin NAT**, |
| - | Subsystem | + | * **Userland Proxy**. |
| - | # Example of overriding settings on a per-user basis | + | Il est préférable d' |
| - | #Match User anoncvs | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | </ | + | |
| - | Pour ôter les lignes de commentaires dans ce fichier, utilisez la commande suivante | + | Pour plus d' |
| - | < | + | ====5.6 |
| - | root@debian12: | + | |
| - | root@debian12:/ | + | Par défaut un conteneur peut obtenir une escalade de privilèges en utilisant les binaires setuid ou setgid. Pour interdire ceci il faut fixer la valeur de **no-new-privileges** à **true**. |
| - | Include / | + | |
| - | KbdInteractiveAuthentication no | + | |
| - | UsePAM yes | + | |
| - | X11Forwarding yes | + | |
| - | PrintMotd no | + | |
| - | AcceptEnv LANG LC_* | + | |
| - | Subsystem | + | |
| - | </ | + | |
| - | Pour sécuriser le serveur ssh, ajoutez ou modifiez les directives suivantes | + | Pour plus d' |
| - | < | + | ====5.7 - Le Fichier |
| - | AllowGroups adm | + | |
| - | Banner | + | |
| - | HostbasedAuthentication no | + | |
| - | IgnoreRhosts yes | + | |
| - | LoginGraceTime 60 | + | |
| - | LogLevel INFO | + | |
| - | PermitEmptyPasswords no | + | |
| - | PermitRootLogin no | + | |
| - | PrintLastLog yes | + | |
| - | Protocol 2 | + | |
| - | StrictModes yes | + | |
| - | X11Forwarding no | + | |
| - | </file> | + | |
| - | Votre fichier | + | Créez le fichier |
| < | < | ||
| - | root@debian12:/tmp# cat sshd_config | + | root@debian9:~/docker-bench-security# vi /etc/docker/daemon.json |
| - | Include | + | root@debian9: |
| - | KbdInteractiveAuthentication no | + | { |
| - | UsePAM yes | + | " |
| - | PrintMotd no | + | " |
| - | AcceptEnv LANG LC_* | + | " |
| - | AllowGroups adm | + | " |
| - | HostbasedAuthentication no | + | " |
| - | IgnoreRhosts yes | + | |
| - | LoginGraceTime 60 | + | } |
| - | LogLevel INFO | + | |
| - | PermitEmptyPasswords no | + | |
| - | PermitRootLogin no | + | |
| - | PrintLastLog yes | + | |
| - | Protocol 2 | + | |
| - | StrictModes yes | + | |
| - | X11Forwarding no | + | |
| - | Subsystem | + | |
| </ | </ | ||
| - | Mettez l' | + | Notez ici que **live-restore** est fixé à **true**. Ceci permet aux conteneurs de continuer à fonctionner même quand le daemon Docker ne fonctionne pas. Ceci est utile pendant la mise-à-jour de Docker. |
| + | |||
| + | Re-démarrez le service Docker : | ||
| < | < | ||
| - | root@debian12:/tmp# groups trainee | + | root@debian9:~/docker-bench-security# systemctl restart docker |
| - | trainee : trainee cdrom floppy audio dip video plugdev netdev lpadmin scanner vboxusers | + | </ |
| - | root@debian12:/tmp# usermod -a -G adm trainee | + | Vérifiez la présence de l' |
| - | root@debian12:/tmp# groups trainee | + | < |
| - | trainee : trainee adm cdrom floppy audio dip video plugdev netdev lpadmin scanner vboxusers | + | root@debian9:~/docker-bench-security# id dockremap |
| + | uid=116(dockremap) gid=121(dockremap) groupes=121(dockremap) | ||
| </ | </ | ||
| - | Renommez | + | Ré-exécutez |
| < | < | ||
| - | root@debian12:/tmp# mv /etc/ | + | root@debian9:~# cd docker-bench-security/ |
| - | + | root@debian9:~/docker-bench-security# ./docker-bench-security.sh | |
| - | root@debian12:/tmp# cp sshd_config | + | ... |
| + | [PASS] 2.1 - Ensure network traffic is restricted between containers on the default bridge | ||
| + | ... | ||
| + | [PASS] 2.8 - Enable user namespace support | ||
| + | ... | ||
| + | [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled | ||
| + | [PASS] 2.12 - Ensure centralized and remote logging is configured | ||
| + | ... | ||
| + | [PASS] 2.14 - Ensure Userland Proxy is Disabled | ||
| + | ... | ||
| + | [PASS] 2.17 - Ensure containers are restricted from acquiring new privileges | ||
| + | ... | ||
| </ | </ | ||
| - | Redémarrez ensuite le serveur ssh : | + | Pour plus d' |
| - | < | + | =====LAB |
| - | root@debian12:/ | + | |
| - | root@debian12:/tmp# systemctl status ssh | + | Créez le conteneur mysql : |
| - | ● ssh.service - OpenBSD Secure Shell server | + | |
| - | | + | |
| - | | + | |
| - | Docs: man: | + | |
| - | | + | |
| - | Process: 10882 ExecStartPre=/ | + | |
| - | Main PID: 10883 (sshd) | + | |
| - | Tasks: 1 (limit: 19123) | + | |
| - | | + | |
| - | CPU: 28ms | + | |
| - | | + | |
| - | | + | |
| - | Nov 28 15:18:55 debian12 systemd[1]: Starting ssh.service - OpenBSD Secure Shell server... | + | < |
| - | Nov 28 15:18:55 debian12 sshd[10883]: Server listening on 0.0.0.0 port 22. | + | root@debian9:~/ |
| - | Nov 28 15:18:55 debian12 sshd[10883]: Server listening on :: port 22. | + | Unable to find image 'mysql:latest' |
| - | Nov 28 15:18:55 debian12 systemd[1]: Started ssh.service | + | latest: Pulling from library/ |
| + | 80369df48736: Pull complete | ||
| + | e8f52315cb10: Pull complete | ||
| + | cf2189b391fc: Pull complete | ||
| + | cc98f645c682: Pull complete | ||
| + | 27a27ac83f74: Pull complete | ||
| + | fa1f04453414: Pull complete | ||
| + | d45bf7d22d33: Pull complete | ||
| + | 3dbac26e409c: Pull complete | ||
| + | 9017140fb8c1: Pull complete | ||
| + | b76dda2673ae: Pull complete | ||
| + | bea9eb46d12a: Pull complete | ||
| + | e1f050a38d0f: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for mysql: | ||
| + | 54606c03c52c5e3ec0328029d69b869d4b285fb433015576dedc8b8dd4ad0494 | ||
| + | root@debian9: | ||
| + | CONTAINER ID IMAGE | ||
| + | 54606c03c52c | ||
| </ | </ | ||
| - | Pour générer les clefs sur le serveur saisissez la commande suivante en tant que **root**: | + | Exécutez de nouveau |
| - | + | ||
| - | <WRAP center round important 50%> | + | |
| - | **Important** - Lors de la génération | + | |
| - | </ | + | |
| < | < | ||
| - | root@debian12:/tmp# ssh-keygen | + | root@debian9:~/docker-bench-security# ./docker-bench-security.sh |
| - | Generating public/ | + | ... |
| - | Enter file in which to save the key (/root/.ssh/ | + | [INFO] 4 - Container Images and Build File |
| - | Enter passphrase (empty for no passphrase): | + | [WARN] 4.1 - Ensure a user for the container |
| - | Enter same passphrase again: | + | [WARN] |
| - | Your identification | + | [NOTE] 4.2 |
| - | Your public key has been saved in / | + | [NOTE] 4.3 - Ensure that unnecessary packages are not installed in the container |
| - | The key fingerprint is: | + | [NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches |
| - | SHA256: | + | [WARN] 4.5 - Ensure Content trust for Docker is Enabled |
| - | The key's randomart image is: | + | [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images |
| - | +---[DSA 1024]----+ | + | [WARN] |
| - | | o++o.. | | + | [WARN] |
| - | | ..o+*o | | + | [INFO] 4.7 - Ensure update instructions are not use alone in the Dockerfile |
| - | | .o++=.o | | + | [INFO] |
| - | | o. o.+=. .| | + | [NOTE] 4.8 - Ensure setuid and setgid permissions are removed |
| - | | o.S+ +.=.o | | + | [PASS] 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles |
| - | | .= + =oB | | + | [NOTE] 4.10 |
| - | | .+ +.* + | | + | [NOTE] 4.11 |
| - | | .. .+o E| | + | ... |
| - | | ..o .o | | + | |
| - | +----[SHA256]-----+ | + | |
| </ | </ | ||
| - | <WRAP center round important 50%> | + | ====6.1 - [WARN] 4.1 - Ensure a user for the container has been created==== |
| - | **Important** | + | |
| - | </ | + | Les processus dans le conteneur |
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====6.2 - [WARN] 4.5 - Ensure Content trust for Docker is Enabled==== | ||
| + | |||
| + | Cette ligne indique que le support de Content trust n'a pas été activé. Content trust permet de s' | ||
| - | Les clefs publiques générées possèdent l' | + | Pour activer le Content trust, il faut positionner la valeur de la variable |
| < | < | ||
| - | root@debian12:/tmp# ls /etc/ssh | + | root@debian9:~/docker-bench-security# echo " |
| - | moduli | + | DOCKER_CONTENT_TRUST=1 |
| - | ssh_config | + | root@debian9: |
| </ | </ | ||
| - | Re-démarrez | + | Re-démarrez |
| < | < | ||
| - | root@debian12:/tmp# systemctl restart ssh | + | root@debian9:~/docker-bench-security# docker container start mysql |
| + | mysql | ||
| + | root@debian9: | ||
| + | CONTAINER ID IMAGE | ||
| + | 54606c03c52c | ||
| </ | </ | ||
| - | Saisissez maintenant les commandes suivantes en tant que **trainee** : | + | Exécutez de nouveau le script et notez le contenu |
| - | + | ||
| - | <WRAP center round important 50%> | + | |
| - | **Important** - Lors de la génération des clefs, la passphrase doit être **vide**. | + | |
| - | </ | + | |
| < | < | ||
| - | root@debian12:/tmp# exit | + | root@debian9:~/docker-bench-security# ./ |
| - | logout | + | ... |
| + | [INFO] 4 - Container Images and Build File | ||
| + | [WARN] 4.1 - Ensure a user for the container has been created | ||
| + | [WARN] | ||
| + | [NOTE] 4.2 - Ensure that containers use only trusted base images | ||
| + | [NOTE] 4.3 - Ensure that unnecessary packages are not installed in the container | ||
| + | [NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches | ||
| + | [PASS] 4.5 - Ensure Content trust for Docker is Enabled | ||
| + | [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images | ||
| + | [WARN] | ||
| + | [WARN] | ||
| + | [INFO] 4.7 - Ensure update instructions are not use alone in the Dockerfile | ||
| + | [INFO] | ||
| + | [NOTE] 4.8 - Ensure setuid and setgid permissions are removed | ||
| + | [PASS] 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles | ||
| + | [NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles | ||
| + | [NOTE] 4.11 - Ensure only verified packages are installed | ||
| + | ... | ||
| + | </ | ||
| - | trainee@debian12:~$ ssh-keygen -t dsa | + | Pour plus d' |
| - | Generating public/private dsa key pair. | + | |
| - | Enter file in which to save the key (/ | + | |
| - | Created directory '/ | + | |
| - | Enter passphrase (empty for no passphrase): | + | |
| - | Enter same passphrase again: | + | |
| - | Your identification has been saved in /home/trainee/.ssh/id_dsa | + | |
| - | Your public key has been saved in /home/ | + | |
| - | The key fingerprint is: | + | |
| - | SHA256: | + | |
| - | The key's randomart image is: | + | |
| - | +---[DSA 1024]----+ | + | |
| - | | o=o**| | + | |
| - | | | + | |
| - | | + =+.| | + | |
| - | | + o *o| | + | |
| - | | S = * o =| | + | |
| - | | o % + =o| | + | |
| - | | = * =.=| | + | |
| - | | o o *+| | + | |
| - | | ..o *| | + | |
| - | +----[SHA256]-----+ | + | |
| - | trainee@debian12: | + | ====6.3 - [WARN] 4.6 |
| - | Generating public/ | + | |
| - | Enter file in which to save the key (/ | + | |
| - | Enter passphrase (empty for no passphrase): | + | |
| - | Enter same passphrase again: | + | |
| - | Your identification has been saved in / | + | |
| - | Your public key has been saved in / | + | |
| - | The key fingerprint is: | + | |
| - | SHA256: | + | |
| - | The key's randomart image is: | + | |
| - | +---[RSA 3072]----+ | + | |
| - | | .oE=o.. | | + | |
| - | |.. .+=.. | | + | |
| - | |= o o + | | + | |
| - | | = + . o | | + | |
| - | | = .. S . o | | + | |
| - | | o +o.++.+ * | | + | |
| - | | + *++=+ + o | | + | |
| - | | | + | |
| - | | .o. | + | |
| - | +----[SHA256]-----+ | + | |
| - | trainee@debian12: | + | Quand une image est construite, il est possible d'y mettre un **HEALTHCHECK** dont le statut peut être vérifié par Docker afin de relancer le conteneur si nécessaire. |
| - | Generating public/ | + | |
| - | Enter file in which to save the key (/ | + | |
| - | Enter passphrase (empty for no passphrase): | + | |
| - | Enter same passphrase again: | + | |
| - | Your identification has been saved in / | + | |
| - | Your public key has been saved in / | + | |
| - | The key fingerprint is: | + | |
| - | SHA256: | + | |
| - | The key's randomart image is: | + | |
| - | +---[ECDSA 256]---+ | + | |
| - | | o | | + | |
| - | | . + | | + | |
| - | | + + | | + | |
| - | | * = = | | + | |
| - | | . + = S . | | + | |
| - | | .+ +.o.. | | + | |
| - | | .Eo+*.++ | | + | |
| - | |o +o* BO . | | + | |
| - | |+B+*++oo* | + | |
| - | +----[SHA256]-----+ | + | |
| - | trainee@debian12: | + | Pour mettre en place un HEALTHCHECK, |
| - | Generating public/ | + | |
| - | Enter file in which to save the key (/ | + | |
| - | Enter passphrase (empty for no passphrase): | + | |
| - | Enter same passphrase again: | + | |
| - | Your identification has been saved in / | + | |
| - | Your public key has been saved in / | + | |
| - | The key fingerprint is: | + | |
| - | SHA256: | + | |
| - | The key's randomart | + | |
| - | +--[ED25519 256]--+ | + | |
| - | | ....o | | + | |
| - | | +.. . . | | + | |
| - | |=o* | + | |
| - | |oO+. + + | + | |
| - | |*.=.. = S | + | |
| - | |o+.+ . | + | |
| - | |.=+..E. o o o | | + | |
| - | |+ ++o..+ | + | |
| - | | oo+ .o.. | | + | |
| - | +----[SHA256]-----+ | + | |
| - | </ | + | |
| - | <WRAP center round important 50%> | + | <file> |
| - | **Important** | + | HEALTHCHECK |
| - | </WRAP> | + | </file> |
| - | ====3.3 - Utilisation==== | + | Ce test permet de vérifier que le conteneur peut atteindre l'URL indiqué tous les 20 secondes et produit une erreur au bout de 3 secondes. |
| - | La commande ssh prend la forme suivante: | + | Pour plus d' |
| - | ssh -l nom_de_compte numero_ip (nom_de_machine) | + | =====LAB #7 - Sécurisation du Container Runtime===== |
| - | En saisissant cette commande sur votre propre machine, vous obtiendrez | + | Exécutez de nouveau le script **docker-bench-security.sh**, vous devez obtenir |
| < | < | ||
| - | trainee@debian12:~$ su - | + | root@debian9:~/docker-bench-security# |
| - | Password: fenestros | + | ... |
| - | root@debian12: | + | [INFO] 5 - Container Runtime |
| - | + | [WARN] 5.1 - Ensure that, if applicable, an AppArmor Profile is enabled | |
| - | root@debian12:~# ssh -l trainee localhost | + | [WARN] |
| - | The authenticity of host ' | + | [WARN] 5.2 |
| - | ED25519 key fingerprint is SHA256: | + | [WARN] |
| - | This key is not known by any other names. | + | [PASS] 5.3 - Ensure Linux Kernel Capabilities are restricted within containers |
| - | Are you sure you want to continue connecting (yes/no/[fingerprint])? yes | + | [PASS] 5.4 - Ensure that privileged containers are not used |
| - | Warning: Permanently added 'localhost' | + | [PASS] 5.5 - Ensure sensitive host system directories are not mounted on containers |
| - | trainee@localhost' | + | [PASS] 5.6 - Ensure sshd is not run within containers |
| - | Linux debian12 6.1.0-41-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.158-1 (2025-11-09) x86_64 | + | [PASS] 5.7 - Ensure privileged ports are not mapped within containers |
| - | + | [NOTE] 5.8 - Ensure that only needed ports are open on the container | |
| - | The programs included with the Debian GNU/Linux system are free software; | + | [PASS] 5.9 - Ensure the host's network namespace is not shared |
| - | the exact distribution terms for each program | + | [WARN] 5.10 - Ensure that the memory usage for containers is limited |
| - | individual files in / | + | [WARN] |
| - | + | [WARN] 5.11 - Ensure CPU priority is set appropriately on the container | |
| - | Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent | + | [WARN] |
| - | permitted by applicable law. | + | [WARN] 5.12 - Ensure that the container' |
| - | Last login: Thu Nov 27 17:21:12 2025 from 10.0.2.1 | + | [WARN] |
| + | [PASS] 5.13 - Ensure that incoming container traffic is bound to a specific host interface | ||
| + | [WARN] 5.14 | ||
| + | [WARN] | ||
| + | [PASS] 5.15 - Ensure the host's process namespace is not shared | ||
| + | [PASS] 5.16 | ||
| + | [PASS] 5.17 | ||
| + | [INFO] 5.18 | ||
| + | [INFO] | ||
| + | [PASS] 5.19 - Ensure mount propagation mode is not set to shared | ||
| + | [PASS] 5.20 - Ensure | ||
| + | [PASS] 5.21 - Ensure | ||
| + | [NOTE] 5.22 - Ensure docker exec commands | ||
| + | [NOTE] 5.23 - Ensure that docker exec commands are not used with the user=root option | ||
| + | [PASS] 5.24 - Ensure that cgroup usage is confirmed | ||
| + | [WARN] 5.25 - Ensure that the container is restricted from acquiring additional privileges | ||
| + | [WARN] | ||
| + | [WARN] 5.26 - Ensure that container health is checked at runtime | ||
| + | [WARN] | ||
| + | [INFO] 5.27 - Ensure that Docker commands always make use of the latest version of their image | ||
| + | [WARN] 5.28 - Ensure that the PIDs cgroup limit is used | ||
| + | [WARN] | ||
| + | [INFO] 5.29 - Ensure that Docker' | ||
| + | [INFO] | ||
| + | [PASS] 5.30 - Ensure that the host's user namespaces are not shared | ||
| + | [PASS] 5.31 - Ensure that the Docker socket is not mounted inside any containers | ||
| + | ... | ||
| </ | </ | ||
| - | ====3.4 - Mise en place des clefs==== | + | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. |
| - | Il convient maintenant de se connecter sur le << | + | ====7.1 - [WARN] 5.1 - Ensure AppArmor Profile is Enabled==== |
| - | En saisissant cette commande, vous obtiendrez une fenêtre similaire à celle-ci : | + | Cet avertissement est présent parce que le conteneur n' |
| - | < | + | Pour plus d' |
| - | root@debian12:~# exit | + | |
| - | logout | + | |
| - | trainee@debian12: | + | ====7.2 - [WARN] 5.2 |
| - | trainee@127.0.0.1' | + | |
| - | Linux debian12 6.1.0-41-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.158-1 (2025-11-09) x86_64 | + | |
| - | The programs included with the Debian GNU/Linux system are free software; | + | Cet avertissement est présent parce que le conteneur n' |
| - | the exact distribution terms for each program are described in the | + | |
| - | individual files in / | + | |
| - | Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent | + | Pour plus d' |
| - | permitted by applicable law. | + | |
| - | Last login: Fri Nov 28 15:31:58 2025 from 10.0.2.46 | + | |
| - | trainee@debian12: | + | ====7.3 |
| - | drwx------ 2 trainee trainee 4096 Nov 28 15:29 .ssh | + | |
| - | trainee@debian12: | + | Cet avertissement est du au fait que les conteneurs ont automatiquement accès à la totalité de la RAM de l'hôte Docker |
| - | logout | + | |
| - | Connection to 127.0.0.1 closed. | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 50%> | + | |
| - | **Important** - Si le dossier distant .ssh n' | + | |
| - | </ | + | |
| - | + | ||
| - | Ensuite, il convient de transférer le fichier local **.ssh/ | + | |
| < | < | ||
| - | trainee@debian12:~$ scp .ssh/ | + | root@debian9:~# docker run -d -p 8081:80 nginx |
| - | trainee@127.0.0.1's password: | + | b04b2a6f0dd93da21a8b7640afc319406e42868a141f90936dbcf52ab5bffb0d |
| - | id_ecdsa.pub 100% 178 | + | root@debian9:~# docker stats |
| + | CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS | ||
| + | b04b2a6f0dd9 | ||
| + | ^C | ||
| </ | </ | ||
| - | Connectez-vous via ssh et insérer les clefs publiques restantes dans le fichier .ssh/ | + | Supprimez le conteneur |
| < | < | ||
| - | trainee@debian12:~$ ssh -l trainee localhost | + | root@debian9:~# docker ps -a |
| - | Linux debian12 6.1.0-41-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.158-1 (2025-11-09) x86_64 | + | CONTAINER ID IMAGE |
| + | b04b2a6f0dd9 | ||
| + | 5b31fe1e13bc | ||
| + | 7788c67c3b69 | ||
| + | root@debian9: | ||
| + | b0 | ||
| + | root@debian9: | ||
| + | 095472e5096a57277230ff94822d9bd0ad479ad26a33cbf83ec381cdb02910e1 | ||
| + | root@debian9: | ||
| + | CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O | ||
| + | 095472e5096a | ||
| + | ^C | ||
| + | </ | ||
| - | The programs included with the Debian GNU/Linux system are free software; | + | Pour plus d' |
| - | the exact distribution terms for each program are described in the | + | |
| - | individual files in /usr/share/doc/*/copyright. | + | |
| - | Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent | + | ====7.4 - [WARN] 5.11 - Ensure CPU priority is set appropriately on the container==== |
| - | permitted by applicable law. | + | |
| - | Last login: Fri Nov 28 15:57:32 2025 from 127.0.0.1 | + | |
| - | trainee@debian12: | + | Cet avertissement est du au fait que les conteneurs ont automatiquement accès à tous les CPU de l' |
| - | trainee@debian12: | + | La valeur de cpu-shares est relative à la valeur par défaut de **1024**. Un valeur de 512 permet au conteneur d' |
| - | trainee@debian12:~$ cat .ssh/id_ed25519.pub >> | + | Pour plus d' |
| - | trainee@debian12: | + | ====7.5 - [WARN] 5.12 |
| - | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBwIXLMYJtWVgqSTqJfsFjS2ubtP+mHkC7XRU1rBWTBLYoJp8VOwtpKK1NTFSaeJhnjCvFuhYm8egqHI0gp3oBA= trainee@debian12 | + | |
| - | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDcV1OmeHZlWhLumCozdg7snul5MrkzhZjiUKWNJmGBBOauOq2CgMGYWYIhjyeVeaeiezq+wSe0jO09p8a1EbvYUibJsY9FOi8JcXTpxvlcqpuawudErjSsOf6JaIlbGpwDIMzmjeubfQx9jMZzfQIW9zfTDUi2tGquR/ | + | |
| - | ssh-dss AAAAB3NzaC1kc3MAAACBAMbFW6WkZFJ/ | + | |
| - | ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILP736HSOOTZBe6+CHy8PINQ4gb9kKB4xj0JWWZy1Wgl trainee@debian12 | + | |
| - | </ | + | |
| - | <WRAP center round important 50%> | + | Afin de minimiser |
| - | **Important** - Notez que lors de la connexion au serveur, l' | + | |
| - | </ | + | |
| - | + | ||
| - | ===Options | + | |
| - | Les options de cette commande sont : | + | Créez le fichier **write_a_file** dans le conteneur **mysql** |
| < | < | ||
| - | trainee@debian12:~$ ssh --help | + | root@debian9:~/docker-bench-security# docker container exec mysql touch / |
| - | unknown option -- - | + | |
| - | usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface] | + | |
| - | [-b bind_address] [-c cipher_spec] [-D [bind_address: | + | |
| - | [-E log_file] [-e escape_char] [-F configfile] [-I pkcs11] | + | |
| - | [-i identity_file] [-J [user@]host[: | + | |
| - | [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port] | + | |
| - | [-Q query_option] [-R address] [-S ctl_path] [-W host: | + | |
| - | [-w local_tun[: | + | |
| </ | </ | ||
| - | ====3.5 - Tunnels SSH==== | + | La Commande **docker container diff** indique les différences apportées au conteneur par rapport à l' |
| - | Le protocole SSH peut être utilisé pour sécuriser les protocoles tels telnet, pop3 etc.. En effet, on peut créer un //tunnel// SSH dans lequel passe les communications du protocole non-sécurisé. | + | < |
| + | root@debian9: | ||
| + | A / | ||
| + | C /run | ||
| + | C / | ||
| + | A / | ||
| + | A / | ||
| + | A /run/mysqld/mysqlx.sock | ||
| + | A /run/ | ||
| + | A / | ||
| + | </ | ||
| - | La commande pour créer un tunnel ssh prend la forme suivante | + | <WRAP center round important 60%> |
| + | **Important** | ||
| + | </ | ||
| - | ssh -N -f compte@< | + | Arrêtez |
| - | + | ||
| - | Dans votre cas, vous allez créer un tunnel entre Debian 12 et CentOS 8 entre le port 15023 et le port 23 : | + | |
| < | < | ||
| - | trainee@debian12:~$ su - | + | root@debian9:~/docker-bench-security# |
| - | Password: fenestros | + | mysql |
| + | root@debian9:~/ | ||
| + | mysql | ||
| + | </ | ||
| - | root@debian12:~# ssh -N -f trainee@localhost | + | Lancez un conteneur mysql en lecture seule : |
| + | |||
| + | < | ||
| + | root@debian9:~/ | ||
| + | 7788c67c3b692515f63f4659a8f40af397bfbde97485e2e40c500c16b158045b | ||
| + | root@debian9:~/ | ||
| + | CONTAINER ID IMAGE | ||
| + | 7788c67c3b69 | ||
| </ | </ | ||
| - | Installez maintenant | + | Créez |
| < | < | ||
| - | root@debian12:~# ssh -l trainee 10.0.2.45 | + | root@debian9:~/ |
| - | The authenticity of host ' | + | touch: cannot touch '/ |
| - | ED25519 key fingerprint is SHA256: | + | </ |
| - | This key is not known by any other names. | + | |
| - | Are you sure you want to continue connecting (yes/ | + | |
| - | Warning: Permanently added '10.0.2.45' | + | |
| - | trainee@10.0.2.45' | + | |
| - | Activate the web console with: systemctl enable --now cockpit.socket | + | |
| - | Last login: Thu Nov 6 04:13:03 2025 from 10.0.2.45 | + | <WRAP center round important 60%> |
| + | **Important** | ||
| + | </ | ||
| - | [trainee@centos8 ~]$ su - | + | Exécutez la commande **docker container diff** |
| - | Password: fenestros | + | |
| - | [root@centos8 | + | < |
| + | root@debian9:~/ | ||
| + | root@debian9: | ||
| </ | </ | ||
| - | Telnet n'est ni démarré ni activé. Il convient donc de le démarrer et de l' | + | <WRAP center round important 60%> |
| + | **Important** : Notez que la commande ne retourne aucune sortie. En effet le conteneur étant en lecture seule, aucun changement ne peut intervenir. | ||
| + | </ | ||
| - | < | + | ====7.6 - [WARN] 5.14 |
| - | [root@centos8 ~]# systemctl status telnet.socket | + | |
| - | ● telnet.socket | + | |
| - | | + | |
| - | | + | |
| - | Docs: man: | + | |
| - | | + | |
| - | | + | |
| - | [root@centos8 ~]# systemctl start telnet.socket | + | Cet avertissement concerne la politique de re-démarrage du conteneur. La politique **on-failure[: |
| - | [root@centos8 ~]# systemctl status telnet.socket | + | |
| - | ● telnet.socket | + | |
| - | | + | |
| - | | + | |
| - | Docs: man: | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Nov 28 09:42:52 centos8.ittraining.loc systemd[1]: Listening on Telnet Server Activation Socket. | + | Pour plus d' |
| - | [root@centos8 ~]# systemctl enable telnet.socket | + | ====7.7 - [WARN] 5.25 - Ensure the container is restricted from acquiring additional privileges==== |
| - | Created symlink / | + | |
| - | [root@centos8 ~]# systemctl status telnet.socket | + | Pour complémenter la configuration précédemment mise en place, il convient de lancer le conteneur en utilisant l' |
| - | ● telnet.socket | + | |
| - | | + | |
| - | | + | |
| - | Docs: man: | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Nov 28 09:42:52 centos8.ittraining.loc systemd[1]: Listening on Telnet Server Activation Socket. | + | # docker container run -d --name mysql --read-only --restart on-failure:5 --security-opt=" |
| - | </code> | + | |
| - | Arrêtez le service firewalld | + | Pour plus d' |
| - | < | + | ====7.8 - [WARN] 5.26 - Ensure container health is checked at runtime==== |
| - | [root@centos8 ~]# systemctl stop firewalld | + | |
| - | [root@centos8 ~]# iptables -L | + | Voir l' |
| - | Chain INPUT (policy ACCEPT) | + | |
| - | target | + | |
| - | Chain FORWARD (policy ACCEPT) | + | ====7.9 - [WARN] 5.28 - Ensure PIDs cgroup limit is used==== |
| - | target | + | |
| - | Chain OUTPUT | + | Sans l' |
| - | target | + | |
| + | < | ||
| + | root@debian9: | ||
| </ | </ | ||
| - | Connectez-vous ensuite via telnet sur CentOS 8 en utilisant | + | L' |
| < | < | ||
| - | root@debian12:~# telnet localhost 15023 | + | root@debian9:~# docker ps -a |
| - | Trying | + | CONTAINER ID IMAGE |
| - | Connected to localhost. | + | 05b11e44e595 |
| - | Escape character is '^]'. | + | ... |
| + | root@debian9: | ||
| + | 05 | ||
| + | root@debian9: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | ^C | ||
| + | </ | ||
| - | Kernel 4.18.0-348.7.1.el8_5.x86_64 on an x86_64 | + | Pour plus d' |
| - | centos8 login: trainee | + | |
| - | Password: | + | |
| - | Last login: Fri Nov 28 09:45:22 from 10.0.2.46 | + | |
| - | [trainee@centos8 ~]$ pwd | + | Supprimez maintenant tous les conteneurs déjà créées : |
| - | / | + | |
| - | [trainee@centos8 | + | < |
| - | logout | + | root@debian9:~# docker ps -a |
| - | Connection closed by foreign host. | + | CONTAINER ID IMAGE |
| - | root@debian12:~# | + | 095472e5096a |
| + | 5b31fe1e13bc | ||
| + | 7788c67c3b69 | ||
| + | root@debian9:~# docker stop 095 | ||
| + | 095 | ||
| + | root@debian9: | ||
| + | 5b31fe1e13bc | ||
| + | 7788c67c3b69 | ||
| + | 095472e5096a | ||
| + | root@debian9: | ||
| + | CONTAINER ID IMAGE | ||
| </ | </ | ||
| - | <WRAP center round important 50%> | + | Re-créez |
| - | **Important** | + | |
| - | </ | + | |
| - | ====3.6 - SCP==== | + | < |
| + | root@debian9: | ||
| + | root@debian9: | ||
| + | df54974ebc11fe357f6e8e9b0f8499aee2658af435e32a45058a1e49fcd3dc24 | ||
| + | root@debian9: | ||
| + | CONTAINER ID IMAGE | ||
| + | df54974ebc11 | ||
| + | </ | ||
| - | ===Introduction=== | + | Exécutez de nouveau le script **docker-bench-security.sh**, |
| - | La commande | + | < |
| + | root@debian9: | ||
| + | ... | ||
| + | [INFO] 5 - Container Runtime | ||
| + | [WARN] 5.1 - Ensure that, if applicable, an AppArmor Profile is enabled | ||
| + | [WARN] | ||
| + | [PASS] 5.2 - Ensure that, if applicable, SELinux security options are set | ||
| + | [PASS] 5.3 - Ensure Linux Kernel Capabilities are restricted within containers | ||
| + | [PASS] 5.4 - Ensure that privileged containers are not used | ||
| + | [PASS] 5.5 - Ensure sensitive host system directories are not mounted on containers | ||
| + | [PASS] 5.6 - Ensure sshd is not run within containers | ||
| + | [PASS] 5.7 - Ensure privileged ports are not mapped within containers | ||
| + | [NOTE] 5.8 - Ensure that only needed ports are open on the container | ||
| + | [PASS] 5.9 - Ensure the host's network namespace is not shared | ||
| + | [PASS] 5.10 - Ensure that the memory usage for containers is limited | ||
| + | [PASS] 5.11 - Ensure CPU priority is set appropriately on the container | ||
| + | [PASS] 5.12 - Ensure that the container' | ||
| + | [PASS] 5.13 - Ensure that incoming container traffic is bound to a specific host interface | ||
| + | [PASS] 5.14 - Ensure that the ' | ||
| + | [PASS] 5.15 - Ensure the host's process namespace is not shared | ||
| + | [PASS] 5.16 - Ensure the host's IPC namespace is not shared | ||
| + | [PASS] 5.17 - Ensure that host devices are not directly exposed to containers | ||
| + | [INFO] 5.18 - Ensure that the default ulimit is overwritten at runtime if needed | ||
| + | [INFO] | ||
| + | [PASS] 5.19 - Ensure mount propagation mode is not set to shared | ||
| + | [PASS] 5.20 - Ensure the host's UTS namespace is not shared | ||
| + | [PASS] 5.21 - Ensure the default seccomp profile is not Disabled | ||
| + | [NOTE] 5.22 - Ensure docker exec commands are not used with privileged option | ||
| + | [NOTE] 5.23 - Ensure that docker exec commands are not used with the user=root option | ||
| + | [PASS] 5.24 - Ensure that cgroup usage is confirmed | ||
| + | [PASS] 5.25 - Ensure that the container is restricted from acquiring additional privileges | ||
| + | [WARN] 5.26 - Ensure that container health is checked at runtime | ||
| + | [WARN] | ||
| + | [INFO] 5.27 - Ensure that Docker commands always make use of the latest version of their image | ||
| + | [PASS] 5.28 - Ensure that the PIDs cgroup limit is used | ||
| + | [INFO] 5.29 - Ensure that Docker's default bridge ' | ||
| + | [INFO] | ||
| + | [PASS] 5.30 - Ensure that the host's user namespaces are not shared | ||
| + | [PASS] 5.31 - Ensure that the Docker socket is not mounted inside any containers | ||
| + | ... | ||
| + | </ | ||
| - | $ scp compte@numero_ip(nom_de_machine):/ | + | =====LAB #8 - Sécurisation des Images avec Docker Content Trust===== |
| - | ou vers une machine distante : | + | **Docker Content Trust (DCT)** a été introduit avec Docker Engine 1.8 et Docker CS Engine 1.9.0. DCT permet la vérification de l' |
| - | $ scp /chemin_local/fichier_local compte@numero_ip(nom_de_machine): | + | DCT est utilisé par le **Docker Hub Registry** mais peut aussi être mis en place dans des Registry privés, notamment grâce à la mise en place du **[[https://www.docker.com/products/image-registry|Docker Container Registry]]** qui est inclus avec **Docker Enterprise**. |
| - | ===Utilisation=== | + | DCT est basé sur l' |
| - | Nous allons maintenant utiliser | + | Pour plus d' |
| - | Créez le fichier | + | ====8.1 - DOCKER_CONTENT_TRUST==== |
| + | |||
| + | Pour utiliser | ||
| < | < | ||
| - | trainee@debian12:~$ touch / | + | root@debian9:~# echo $DOCKER_CONTENT_TRUST |
| + | 1 | ||
| </ | </ | ||
| - | Récupérez | + | Dans le cas contraire, il faut fixer la valeur de la variable à 1 : |
| < | < | ||
| - | + | root@debian9:~# export DOCKER_CONTENT_TRUST=1 | |
| - | trainee@debian12:~$ scp trainee@127.0.0.1:/ | + | root@debian9:~# echo $DOCKER_CONTENT_TRUST |
| - | + | 1 | |
| - | trainee@debian12:~$ ls / | + | |
| - | / | + | |
| </ | </ | ||
| - | =====LAB #4 - Mise en place d'un VPN avec OpenVPN===== | + | ====8.2 - DCT et la commande docker pull==== |
| - | ====4.1 - Présentation==== | + | Afin d' |
| - | **%%OpenVPN%%** | + | < |
| + | root@debian9:~# docker login | ||
| + | Login with your Docker ID to push and pull images from Docker Hub. If you don't have a Docker ID, head over to https:// | ||
| + | Username: < | ||
| + | Password: < | ||
| + | WARNING! Your password will be stored unencrypted in / | ||
| + | Configure a credential helper to remove this warning. See | ||
| + | https:// | ||
| - | * permet à des pairs de s' | + | Login Succeeded |
| - | * d'une **clé privée partagée** à l' | + | </code> |
| - | * de **certificats** ou, | + | |
| - | * à partir de la version 2.0 et à condition que le serveur possède un certificat, de **couples de noms d' | + | |
| - | * utilise de manière intensive la bibliothèque d' | + | |
| - | * n'est pas compatible avec IPsec ou d' | + | |
| - | + | ||
| - | ====Configuration commune au client et au serveur==== | + | |
| - | Installez le paquet openvpn | + | Pour constater l' |
| < | < | ||
| - | root@debian12:~# apt install openvpn | + | root@debian9:~# docker image pull i2tch/ |
| + | Error: remote trust data does not exist for docker.io/ | ||
| </ | </ | ||
| - | Naviguez au répertoire | + | <WRAP center round important 60%> |
| + | **Important** : Notez l' | ||
| + | </ | ||
| - | < | + | Par contre, toutes les images de type **official** sont signées : |
| - | [root@centos7 ~]# cd / | + | |
| - | root@debian12:/ | + | < |
| - | + | root@debian9:~# docker image pull centos | |
| - | root@debian12:/etc/ | + | Using default tag: latest |
| - | # | + | Pull (1 of 1): centos: |
| - | # 2048 bit OpenVPN static key | + | sha256: |
| - | # | + | 729ec3a6ada3: |
| - | -----BEGIN OpenVPN Static key V1----- | + | Digest: sha256: |
| - | 77b47829a9d17aacc71b05a2bfa9bcba | + | Status: Downloaded newer image for centos@sha256: |
| - | e90370cc07238a5adb74ef479e87547d | + | Tagging centos@sha256: |
| - | fc18a69c3c5307bdc1ca27c7aa6f3a35 | + | docker.io/ |
| - | e09e815a27f50c28699be3af28decd3c | + | |
| - | b319923c2fe3826c2afb41d2e0239229 | + | |
| - | fee9bc33566941e09e2f905f1bcbb59a | + | |
| - | 55cf8d535334ac46eda3f35be0b7e22b | + | |
| - | c3261de182f7cde5cc7d756420907514 | + | |
| - | 0399672d104cebee31a44ca6d89663c7 | + | |
| - | 784b928e893c4d3a6e7d294e94266e1b | + | |
| - | 5a98f80f797651199069902be01d2bbd | + | |
| - | 94765d310f8d0466484a0e7cbf10bb98 | + | |
| - | d247127aa53a6c18a6def6ed73a28b69 | + | |
| - | b7d052209318057e2ccb9660fc42543b | + | |
| - | d79dab314ecbc19a6b8936255c17d673 | + | |
| - | fb0bdc3856a034ffc3931a7d645d6d96 | + | |
| - | -----END OpenVPN Static key V1----- | + | |
| </ | </ | ||
| + | |||
| + | Cette image est maintenant présente sur **manager.i2tch.loc** : | ||
| < | < | ||
| - | root@debian12:~# scp / | + | root@debian9:~# docker images |
| - | trainee@10.0.2.45's password: | + | REPOSITORY |
| - | static.key | + | ubuntu |
| + | nginx | ||
| + | alpine | ||
| + | mysql | ||
| + | centos | ||
| </ | </ | ||
| - | ====Configuration du client==== | + | ===L' |
| + | |||
| + | Il est aussi possible d' | ||
| < | < | ||
| - | root@debian12:/ | + | root@debian9:~# docker image pull --disable-content-trust=true i2tch/ |
| - | trainee@10.0.2.45' | + | unsigned: Pulling from i2tch/ |
| - | Activate the web console with: systemctl enable --now cockpit.socket | + | 10d70a43a9f9: Pull complete |
| + | 4f4fb700ef54: | ||
| + | 8951e3a91277: | ||
| + | d1814ff35b8b: | ||
| + | ff2a2bbf6141: | ||
| + | b7205da5c3c9: | ||
| + | 458ea241cc75: | ||
| + | 74d1c0702786: | ||
| + | c66f3692932d: | ||
| + | 9224bd1b9757: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for i2tch/ | ||
| + | docker.io/ | ||
| - | Last login: Fri Nov 28 09:47:05 2025 from ::ffff:10.0.2.46 | + | root@debian9:~# docker image ls |
| + | REPOSITORY | ||
| + | ubuntu | ||
| + | nginx | ||
| + | alpine | ||
| + | mysql | ||
| + | centos | ||
| + | i2tch/ | ||
| - | [trainee@centos8 | + | root@debian9:~# docker rmi i2tch/ |
| - | Password: fenestros | + | Untagged: i2tch/ |
| + | Untagged: i2tch/ | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256:d124781fc06a73b05a8644958397994bae668aba2f06f397fe1387c676b0d86f | ||
| </ | </ | ||
| - | < | + | ====8.3 |
| - | [root@centos8 ~]# dnf install epel-release | + | |
| - | </ | + | |
| - | < | + | Pour envoyer l' |
| - | [root@centos8 ~]# dnf install openvpn | + | |
| - | </ | + | |
| < | < | ||
| - | [root@centos8 | + | root@debian9:~# docker image tag alpine: |
| - | [root@centos8 ~]# ls / | + | |
| - | client | + | |
| </ | </ | ||
| - | Créez le fichier | + | L' |
| < | < | ||
| - | [root@centos8 | + | root@debian9:~# docker image ls |
| - | [root@centos8 ~]# cat /etc/ | + | REPOSITORY |
| - | remote 10.0.2.46 | + | ubuntu |
| - | dev tun | + | nginx latest |
| - | port 1194 | + | < |
| - | proto udp | + | alpine |
| - | comp-lzo | + | mysql latest |
| - | ifconfig 10.0.0.2 10.0.0.1 | + | centos |
| - | secret / | + | |
| </ | </ | ||
| - | Lancez openvpn | + | Lors du push vers le registry privé, il faut créer des passphrases pour **deux** clefs : |
| + | |||
| + | * la **root** key aussi connue sous le nom **offline** key (ID 192fc7e), qui est uniquement demandée la **première** fois après la mise en place de DCT lors de la création d'un **repositry**, | ||
| + | * la **repository** key aussi connue sous le nom **tagging** key (ID 168c754), utilisée pour signer l' | ||
| < | < | ||
| - | [root@centos8 | + | root@debian9:~# docker push < |
| - | [1] 14598 | + | The push refers to repository [docker.io/< |
| + | 77cae8ab23bf: | ||
| + | alpine: digest: sha256: | ||
| + | Signing and pushing trust metadata | ||
| + | You are about to create a new root signing key passphrase. This passphrase | ||
| + | will be used to protect the most sensitive key in your signing system. Please | ||
| + | choose a long, complex passphrase and be careful to keep the password and the | ||
| + | key file itself secure and backed up. It is highly recommended that you use a | ||
| + | password manager to generate the passphrase and keep it safe. There will be no | ||
| + | way to recover this key. You can find the key in your config directory. | ||
| + | Enter passphrase for new root key with ID 192fc7e: fenestros | ||
| + | Repeat passphrase for new root key with ID 192fc7e: fenestros | ||
| + | Enter passphrase for new repository key with ID 168c754: fenestros | ||
| + | Repeat passphrase for new repository key with ID 168c754: fenestros | ||
| + | Finished initializing " | ||
| + | Successfully signed docker.io/< | ||
| </ | </ | ||
| - | Vérifiez ensuite que le **socket** d' | + | Les clefs sont stockées dans le répertoire |
| < | < | ||
| - | [root@centos8 | + | root@debian9:~# ls -l ~/ |
| - | udp 0 0 0.0.0.0:1194 0.0.0.0:* | + | total 8 |
| - | </ | + | drwx------ 2 root root 4096 nov. 10 14:49 private |
| + | drwx------ 3 root root 4096 nov. 8 13:48 tuf | ||
| - | Constatez ensuite la table de routage | + | root@debian9:~# ls -l ~/ |
| + | total 8 | ||
| + | -rw------- 1 root root 447 nov. 10 14:49 168c754ea8f36ce7fbcbe2299b6d91fc0f4d594c9ed9b86916687b618d8438ac.key | ||
| + | -rw------- 1 root root 416 nov. 10 14:49 192fc7ed9543ad4bceec58886ab1d605b7433c35f7462d7343d0780d8fddf1db.key | ||
| + | root@debian9: | ||
| + | -----BEGIN ENCRYPTED PRIVATE KEY----- | ||
| + | gun: docker.io/ | ||
| + | role: targets | ||
| - | < | + | MIHuMEkGCSqGSIb3DQEFDTA8MBsGCSqGSIb3DQEFDDAOBAhm7HwR0y8FFAICCAAw |
| - | [root@centos8 | + | HQYJYIZIAWUDBAEqBBC729tU73wKHFQSbmZ1EVZaBIGgmGiFSs4lM5tElSGukl1B |
| - | Kernel IP routing table | + | HrELT9aFooFgW7oSXNLM8aFfF/ |
| - | Destination | + | 3m40g3MywHilW4rUcjoHVTTUXABGXUQ3f7h+nI15CXcZ11qRLyWbf2uywE9yYH9O |
| - | default | + | M7GLUcE+pTENJKfZAhRGBEL+LgXNfGI1aAVqaEbBDcDnKKf4Uj1Xu4oLJ7je8+nT |
| - | 10.0.0.1 | + | dg== |
| - | 10.0.2.0 | + | -----END ENCRYPTED PRIVATE KEY----- |
| - | 192.168.122.0 | + | |
| + | root@debian9:~# cat ~/ | ||
| + | -----BEGIN ENCRYPTED PRIVATE KEY----- | ||
| + | role: root | ||
| + | |||
| + | MIHuMEkGCSqGSIb3DQEFDTA8MBsGCSqGSIb3DQEFDDAOBAiAtCzEar3AhgICCAAw | ||
| + | HQYJYIZIAWUDBAEqBBAO7hHWVoqOo6xcETQQDXRdBIGgPUoLzTz07Ajx8K3D8+Vv | ||
| + | 2NUiflMYhH/ | ||
| + | V2BwSlXp7t1Cnqp/ | ||
| + | KREO8uEq3v7HcSBBqFm0+TU+92d7hVuDApPaj0lZYP+3f7H6AjUOqu6hUoK8Ck/ | ||
| + | Ig== | ||
| + | -----END ENCRYPTED PRIVATE KEY----- | ||
| </ | </ | ||
| - | Notez la présence de la route via **tun0**. | + | ====8.4 - DCT et la commande docker build==== |
| - | Constatez ensuite le montage du tunnel en regardant le contenu du fichier de journalisation **/ | + | L' |
| < | < | ||
| - | [root@centos7 | + | root@debian9:~# mkdir nottrusted |
| + | root@debian9: | ||
| + | root@debian9: | ||
| + | root@debian9: | ||
| + | FROM docker/trusttest: | ||
| + | RUN echo | ||
| </ | </ | ||
| - | L'architecture réseau sera donc la suivante | + | Lors du build de l'image **< |
| - | <file> | + | <code> |
| - | serveur | + | root@debian9: |
| - | | | | + | Sending build context to Docker daemon |
| - | | | | + | |
| - | eth0@ifxxx | + | |
| - | 172.yy.0.3 | + | |
| - | </ | + | |
| - | ====Configuration du serveur==== | + | error during connect: Post http:// |
| + | </ | ||
| - | Créez le fichier | + | L' |
| < | < | ||
| - | root@debian12:~# vi /etc/openvpn/server/server.conf | + | root@debian9:~/nottrusted# docker build --disable-content-trust -t < |
| + | Sending build context to Docker daemon | ||
| + | Step 1/2 : FROM docker/trusttest: | ||
| + | latest: Pulling from docker/trusttest | ||
| + | Image docker.io/ | ||
| + | aac0c133338d: | ||
| + | a3ed95caeb02: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for docker/ | ||
| + | | ||
| + | Step 2/2 : RUN echo | ||
| + | | ||
| - | root@debian12: | + | Removing intermediate container 694e79d3cd88 |
| - | dev tun | + | ---> 686e85ee76b8 |
| - | ifconfig 10.0.0.1 10.0.0.2 | + | Successfully built 686e85ee76b8 |
| - | secret / | + | Successfully tagged < |
| - | port 1194 | + | |
| - | proto udp | + | |
| - | user nobody | + | |
| - | group nobody | + | |
| - | daemon | + | |
| - | comp-lzo | + | |
| - | keepalive 10 60 | + | |
| - | ping-timer-rem | + | |
| - | persist-tun | + | |
| - | persist-key | + | |
| - | log /var/ | + | |
| - | verb 1 | + | |
| </ | </ | ||
| - | Arrêtez | + | Lors du push de l' |
| < | < | ||
| - | root@debian12:~# systemctl stop firewalld | + | root@debian9:~/nottrusted# docker push < |
| + | The push refers to repository [docker.io/< | ||
| + | 5f70bf18a086: | ||
| + | c22f7bc058a9: | ||
| + | nottrusted: digest: sha256: | ||
| + | Signing and pushing trust metadata | ||
| + | Enter passphrase for repository key with ID 168c754: fenestros | ||
| + | Successfully signed docker.io/< | ||
| + | </ | ||
| - | root@debian12:~# iptables -L | + | <WRAP center round important 60%> |
| - | Chain INPUT (policy ACCEPT) | + | **Important** : Notez l' |
| - | target | + | </ |
| - | Chain FORWARD (policy ACCEPT) | + | ===Créer un deuxième Repositry=== |
| - | target | + | |
| - | Chain OUTPUT (policy ACCEPT) | + | Par contre en modifiant le tag de l' |
| - | target | + | |
| - | </code> | + | |
| - | + | ||
| - | Lancez openvpn en ligne de commande et en arrière plan en spécifiant une journalisation | + | |
| < | < | ||
| - | root@debian12:~# openvpn --config | + | root@debian9:~/nottrusted# docker tag < |
| - | [1] 11644 | + | root@debian9: |
| + | REPOSITORY | ||
| + | < | ||
| + | < | ||
| + | ubuntu | ||
| + | nginx latest | ||
| + | < | ||
| + | alpine | ||
| + | mysql latest | ||
| + | centos | ||
| + | docker/ | ||
| + | |||
| + | root@debian9: | ||
| + | The push refers to repository | ||
| + | 5f70bf18a086: | ||
| + | c22f7bc058a9: | ||
| + | latest: digest: sha256: | ||
| + | Signing and pushing trust metadata | ||
| + | Enter passphrase for root key with ID 192fc7e: fenestros | ||
| + | Enter passphrase for new repository key with ID 7b13d02: fenestros | ||
| + | Repeat passphrase for new repository key with ID 7b13d02: fenestros | ||
| + | Finished initializing " | ||
| + | Successfully signed docker.io/< | ||
| </ | </ | ||
| - | Vérifiez ensuite que le **socket** d'openvpn soit ouvert | + | <WRAP center round important 60%> |
| + | **Important** : Notez la création | ||
| + | </ | ||
| + | |||
| + | La présence de cette deuxième repositry key (**7b13d02d74264624fb201e7ae13ae694286b9f761aa86adddefd0408c7234a58.key**) peut être constatée dans le répertoire **~/ | ||
| < | < | ||
| - | [root@centos7 | + | root@debian9:~/nottrusted# ls -l ~/ |
| - | udp 0 0 0.0.0.0:1194 0.0.0.0:* | + | total 12 |
| + | -rw------- 1 root root 447 nov. 10 14:49 168c754ea8f36ce7fbcbe2299b6d91fc0f4d594c9ed9b86916687b618d8438ac.key | ||
| + | -rw------- 1 root root 416 nov. 10 14:49 192fc7ed9543ad4bceec58886ab1d605b7433c35f7462d7343d0780d8fddf1db.key | ||
| + | -rw------- 1 root root 451 nov. 10 17:37 7b13d02d74264624fb201e7ae13ae694286b9f761aa86adddefd0408c7234a58.key | ||
| </ | </ | ||
| - | Constatez ensuite la table de routage | + | En inspectant les clefs des images créées, l' |
| - | < | + | < |
| - | [root@centos7 | + | root@debian9:~/ |
| - | Kernel IP routing table | + | [ |
| - | Destination | + | { |
| - | 0.0.0.0 | + | " |
| - | 10.0.0.1 | + | " |
| - | 10.0.2.0 | + | { |
| + | " | ||
| + | " | ||
| + | " | ||
| + | "Repo Admin" | ||
| + | | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | root@debian9: | ||
| + | [ | ||
| + | { | ||
| + | | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | "Repo Admin" | ||
| + | ] | ||
| + | } | ||
| + | | ||
| + | " | ||
| + | | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| </ | </ | ||
| - | Constatez ensuite le montage du tunnel en regardant le contenu du fichier de journalisation | + | <WRAP center round important 60%> |
| + | **Important** : Notez que les clefs utilisées sont les mêmes pour les deux images. | ||
| + | </ | ||
| < | < | ||
| - | [root@centos7 | + | root@debian9:~/nottrusted# docker trust inspect < |
| + | [ | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | "Repo Admin" | ||
| + | ] | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| </ | </ | ||
| - | ====Tests==== | + | <WRAP center round important 60%> |
| + | **Important** : Notez que les clefs utilisées sont différentes. | ||
| + | </ | ||
| - | ===Du client vers le serveur=== | + | ===Supprimer une Signature=== |
| - | Sur le client, utilisez | + | Dernièrement il est possible de supprimer la signature d'une image avec la commande |
| < | < | ||
| - | [root@centos6 | + | root@debian9:~# docker trust revoke < |
| - | PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. | + | Enter passphrase for repository key with ID 168c754: |
| - | 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=7.62 ms | + | Successfully deleted signature for < |
| - | 64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=1.35 ms | + | root@debian9:~# docker trust inspect < |
| - | 64 bytes from 10.0.0.1: icmp_seq=3 ttl=64 time=0.000 ms | + | [ |
| - | + | { | |
| - | --- 10.0.0.1 ping statistics --- | + | " |
| - | 3 packets transmitted, 3 received, 0% packet loss, time 2047ms | + | " |
| - | rtt min/ | + | " |
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| </ | </ | ||
| - | ===Du serveur vers le client=== | ||
| - | Sur le serveur, utilisez la commande ping pour envoyer des paquets dans le tunnel : | + | ----- |
| + | Copyright © 2025 Hugh NORRIS | ||
| - | < | ||
| - | [root@centos7 ~]# ping -c5 10.0.0.2 | ||
| - | PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. | ||
| - | 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=2.59 ms | ||
| - | 64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=9.08 ms | ||
| - | 64 bytes from 10.0.0.2: icmp_seq=3 ttl=64 time=7.24 ms | ||
| - | 64 bytes from 10.0.0.2: icmp_seq=4 ttl=64 time=7.03 ms | ||
| - | 64 bytes from 10.0.0.2: icmp_seq=5 ttl=64 time=4.08 ms | ||
| - | |||
| - | --- 10.0.0.2 ping statistics --- | ||
| - | 5 packets transmitted, | ||
| - | rtt min/ | ||
| - | </ | ||
| - | |||
| - | ----- | ||
| - | Copyright © 2025 Hugh Norris. | ||
