Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:debian:11:sec:l110 [2025/12/02 15:36] – admin | elearning:workbooks:debian:11:sec:l110 [2025/12/04 15:41] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 5: | Ligne 5: | ||
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LDF409 | + | ======LDF410 |
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| + | |||
| + | * **LDF410 - Validation de la Formation** | ||
| + | * Contenu du Module | ||
| + | * Rappel du Programme de la Formation | ||
| + | * Évaluation de la Formation | ||
| + | * Validation des acquis | ||
| + | |||
| + | =====Rappel du Programme de la Formation===== | ||
| + | |||
| + | * **LDF400 - Administration de la Sécurité**. | ||
| + | * Contenu du Module | ||
| + | * Pré-requis | ||
| + | * Matériel | ||
| + | * Logiciels | ||
| + | * Internet | ||
| + | * Programme de la Formation | ||
| + | |||
| + | * **LDF401 - Gestion des Droits** | ||
| + | * Présentation | ||
| + | * Préparation | ||
| + | * LAB #1 - Les Droits Unix Simples | ||
| + | * 1.1 - La Modification des Droits | ||
| + | * La Commande chmod | ||
| + | * Mode Symbolique | ||
| + | * Mode Octal | ||
| + | * La Commande umask | ||
| + | * 1.2 - Modifier le propriétaire ou le groupe | ||
| + | * La Commande chown | ||
| + | * La Commande chgrp | ||
| + | * LAB #2 - Les Droits Unix Étendus | ||
| + | * 2.1 - SUID/SGID bit | ||
| + | * 2.2 - Inheritance Flag | ||
| + | * 2.3 - Sticky bit | ||
| + | * LAB #3 - Les Droits Unix Avancés | ||
| + | * 3.1 - Les ACL | ||
| + | * 3.2 - Les Attributs Étendus | ||
| + | |||
| + | * **LDF402 - Netfilter et Firewalld** | ||
| + | * Les Problématiques | ||
| + | * L'IP Spoofing | ||
| + | * Déni de Service (DoS) | ||
| + | * SYN Flooding | ||
| + | * Flood | ||
| + | * La Contre-Mesure | ||
| + | * LAB #1 - La Configuration de firewalld | ||
| + | * 1.1 - La Configuration de Base de firewalld | ||
| + | * 1.2 - La Commande firewall-cmd | ||
| + | * 1.3 - La Configuration Avancée de firewalld | ||
| + | * 1.4 - Le mode Panic de firewalld | ||
| + | |||
| + | * **LDF403 - Authentification** | ||
| + | * Le Problématique | ||
| + | * Surveillance Sécuritaire | ||
| + | * La commande last | ||
| + | * La commande lastlog | ||
| + | * La Commande lastb | ||
| + | * / | ||
| + | * Les Contre-Mesures | ||
| + | * LAB #1 - Renforcer la sécurité des comptes | ||
| + | * LAB #2 - PAM | ||
| + | * 2.1 - Configuration des modules | ||
| + | * 2.2 - Utiliser des Mots de Passe Complexes | ||
| + | * LAB #3 - Mise en place du Système de Prévention d' | ||
| + | * 3.1 - Installation | ||
| + | * 3.2 - Configuration | ||
| + | * Le répertoire / | ||
| + | * Le fichier fail2ban.conf | ||
| + | * Le répertoire / | ||
| + | * Le répertoire / | ||
| + | * 3.3 - Commandes | ||
| + | * Activer et Démarrer le Serveur | ||
| + | * Utiliser la Commande Fail2Ban-server | ||
| + | * Ajouter un Prison | ||
| + | |||
| + | * **LDF404 - Système de Fichiers** | ||
| + | * La sécurisation des systèmes de fichiers | ||
| + | * Le Fichier /etc/fstab | ||
| + | * Comprendre le fichier /etc/fstab | ||
| + | * Options de Montage | ||
| + | * Systèmes de Fichiers Chiffrés | ||
| + | * LAB #1 - Créer un Système de Fichiers Chiffré avec encryptfs | ||
| + | * LAB #2 - Créer un Système de Fichiers Chiffré avec LUKS | ||
| + | * 2.1 - Présentation | ||
| + | * 2.2 - Mise en Place | ||
| + | * 2.3 - Le fichier / | ||
| + | * 2.4 - Ajouter une deuxième Passphrase | ||
| + | * 2.5 - Supprimer une Passphrase | ||
| + | * 2.6 - Supprimer LUKS | ||
| + | * LAB #3 - Mise en place du File Integrity Checker Afick | ||
| + | * 3.1 - Présentation | ||
| + | * 3.2 - Installation | ||
| + | * 3.3 - Configuration | ||
| + | * La Section Directives | ||
| + | * La Section Alias | ||
| + | * La Section File | ||
| + | * 3.4 - Utilisation | ||
| + | * 3.5 - Automatiser Afick | ||
| + | * Root Kits | ||
| + | * Le Problématique | ||
| + | * Contre-Mesures | ||
| + | * LAB #4 - Mise en place de rkhunter | ||
| + | * 4.1 - Installation | ||
| + | * 4.2 - Utilisation | ||
| + | * 4.3 - Configuration | ||
| + | * LAB #5 - Mise en place de chkrootkit | ||
| + | * 5.1 - Installation | ||
| + | * 5.2 - Utilisation | ||
| + | * 5.3 - Configuration | ||
| + | |||
| + | * **LDF405 - System Hardening** | ||
| + | * Contenu du Module | ||
| + | * System Hardening Manuel | ||
| + | * Les compilateurs | ||
| + | * Les paquets | ||
| + | * Les démons et services | ||
| + | * Les fichiers .rhosts | ||
| + | * Les fichiers et les répertoires sans propriétaire | ||
| + | * Interdire les connexions de root via le réseau | ||
| + | * Limiter le delai d’inactivité d'une session shell | ||
| + | * Renforcer la sécurité d'init | ||
| + | * Les Distributions SysVInit | ||
| + | * Les Distributions Upstart | ||
| + | * Renforcer la sécurité du Noyau | ||
| + | * La commande sysctl | ||
| + | * LAB #1 - System Hardening à l'aide de l' | ||
| + | * 1.1 - Présentation | ||
| + | * 1.2 - Installation | ||
| + | * 1.3 - Utilisation | ||
| + | * LAB #2 - Mise en Place d'un Chroot pour isoler un utilisateur/ | ||
| + | * LAB #3 - Mise en place d' | ||
| + | * 3.1 - Présentation | ||
| + | * 3.2 - Définitions | ||
| + | * Les Profils d' | ||
| + | * Les Etats ou Modes d' | ||
| + | * 3.3 - Installation | ||
| + | * Installation des Paquets | ||
| + | * Modification de GRUB | ||
| + | * Vérification de l' | ||
| + | * LAB #4 - Travailler avec AppArmor | ||
| + | * 4.1 - Consulter la Liste des Profils Chargés | ||
| + | * La Commande aa-status | ||
| + | * 4.2 - Passer le Mode d'un Profil de Complain à Enforce | ||
| + | * La Commande aa-complain | ||
| + | * 4.3 - Passer le Mode d'un Profil d' | ||
| + | * La Commande aa-enforce | ||
| + | * 4.4 - Désactiver et Réactiver tous les Profils | ||
| + | * 4.5 - Créer un Profil | ||
| + | * La Commande aa-genprof | ||
| + | * La Commande aa-logprof | ||
| + | * 4.6 - Supprimer un Profil | ||
| + | * La Commande apparmor_parser | ||
| + | * La Commande aa-remove-unknown | ||
| + | * LAB #5 - Mise en place de SELinux pour sécuriser le serveur | ||
| + | * 5.1 - Présentation | ||
| + | * 5.2 - Définitions | ||
| + | * Security Context | ||
| + | * Domains et Types | ||
| + | * Roles | ||
| + | * Politiques de Sécurité | ||
| + | * Langage de Politiques | ||
| + | * allow | ||
| + | * type | ||
| + | * type_transition | ||
| + | * Décisions de SELinux | ||
| + | * Décisions d' | ||
| + | * Décisions de Transition | ||
| + | * 5.3 - Commandes SELinux | ||
| + | * 5.4 - Les Etats de SELinux | ||
| + | * 5.5 - Booléens | ||
| + | * LAB #6 - Travailler avec SELinux | ||
| + | * 6.1 - Copier et Déplacer des Fichiers | ||
| + | * 6.2 - Vérifier les SC des Processus | ||
| + | * 6.3 - Visualiser la SC d'un Utilisateur | ||
| + | * 6.4 - Vérifier la SC d'un fichier | ||
| + | * 6.5 - Troubleshooting SELinux | ||
| + | * La commande chcon | ||
| + | * La commande restorecon | ||
| + | * 6.6 - Le fichier / | ||
| + | * 6.7 - La commande semanage | ||
| + | * 6.8 - La commande audit2allow | ||
| + | |||
| + | * **LDF406 - Sécurité Applicative** | ||
| + | * Le Problématique | ||
| + | * Préparation | ||
| + | * Les Outils | ||
| + | * LAB #1 - Netwox | ||
| + | * 1.1 - Installation | ||
| + | * 1.2 - Utilisation | ||
| + | * 1.3 - Avertissement important | ||
| + | * LAB #2 - Greenbone Vulnerability Management (GVM) | ||
| + | * 2.1 - Présentation | ||
| + | * 2.2 - Préparation | ||
| + | * 2.3 - Installation | ||
| + | * 2.4 - Configuration | ||
| + | * 2.5 - Utilisation | ||
| + | * 2.6 - Analyse des Résultats | ||
| + | |||
| + | * **LDF407 - Balayage des Ports** | ||
| + | * Contenu du Module | ||
| + | * Le Problématique | ||
| + | * LAB #1 - Utilisation de nmap et de netcat | ||
| + | * 1.1 - nmap | ||
| + | * Installation | ||
| + | * Utilisation | ||
| + | * Fichiers de Configuration | ||
| + | * Scripts | ||
| + | * 1.2 - netcat | ||
| + | * Utilisation | ||
| + | * Les Contre-Mesures | ||
| + | * LAB #2 - Mise en place du Système de Détection d' | ||
| + | * 2.1 - Installation | ||
| + | * 2.2 - Configuration | ||
| + | * 2.3 - Utilisation | ||
| + | * LAB #3 - Mise en place du Système de Détection et de Prévention d' | ||
| + | * 3.1 - Installation | ||
| + | * 3.2 - Configuration | ||
| + | * 3.3 - Utilisation | ||
| + | |||
| + | * **LDF408 - Cryptologie** | ||
| + | * Le Problématique | ||
| + | * LAB #1 - Utilisation de tcpdump | ||
| + | * 1.1 - Utilisation | ||
| + | * L' | ||
| + | * L' | ||
| + | * L' | ||
| + | * L' | ||
| + | * L' | ||
| + | * 1.2 - Filtrage à l' | ||
| + | * Les Contre-Mesures | ||
| + | * Introduction à la cryptologie | ||
| + | * Définitions | ||
| + | * Algorithmes à clé secrète | ||
| + | * Le Chiffrement Symétrique | ||
| + | * Algorithmes à clef publique | ||
| + | * Le Chiffrement Asymétrique | ||
| + | * La Clef de Session | ||
| + | * Fonctions de Hachage | ||
| + | * Signature Numérique | ||
| + | * PKI | ||
| + | * Certificats X509 | ||
| + | * LAB #2 - Utilisation de GnuPG | ||
| + | * 2.1 - Présentation | ||
| + | * 2.2 - Installation | ||
| + | * 2.3 - Utilisation | ||
| + | * Signer un message | ||
| + | * Chiffrer un message | ||
| + | * LAB #3 - Mise en place de SSH et SCP | ||
| + | * 3.1 - Introduction | ||
| + | * SSH-1 | ||
| + | * SSH-2 | ||
| + | * L' | ||
| + | * L' | ||
| + | * 3.2 - Configuration du Serveur | ||
| + | * 3.3 - Utilisation | ||
| + | * 3.4 - Mise en place des clefs | ||
| + | * 3.5 - Tunnels SSH | ||
| + | * 3.6 - SCP | ||
| + | * Introduction | ||
| + | * Utilisation | ||
| + | * LAB #4 - Mise en place d'un VPN avec OpenVPN | ||
| + | * Présentation | ||
| + | * Configuration commune au client et au serveur | ||
| + | * Configuration du client | ||
| + | * Configuration du serveur | ||
| + | * Tests | ||
| + | * Du client vers le serveur | ||
| + | * Du serveur vers le client | ||
| * **LDF409 - Gestion de la Sécurité de Docker** | * **LDF409 - Gestion de la Sécurité de Docker** | ||
| Ligne 72: | Ligne 339: | ||
| * Supprimer une Signature | * Supprimer une Signature | ||
| - | =====Présentation de Docker===== | + | * **LDF410 |
| - | + | * Rappel | |
| - | Docker est une application de virtualisation légère qui utilise des **images** et des **conteneurs**. | + | * Évaluation |
| - | + | * Validation | |
| - | Une **image** est un paquet exécutable contenant tout ce qu'il est necessaire afin d' | + | |
| - | + | ||
| - | * le code | + | |
| - | * un runtime | + | |
| - | * des bibliothèques, | + | |
| - | * des variables d' | + | |
| - | * des fichiers de configuration | + | |
| - | + | ||
| - | Un **conteneur** est une instance de l' | + | |
| - | + | ||
| - | Les conteneurs exécutent des applications nativement en utilisant le noyau de la machine hôte. De ce fait les performances d'un conteneur sont supérieures à celles d'une machine virtuelle qui doit passer par un hyperviseur pour accéder aux ressources de la machine hôte. | + | |
| - | + | ||
| - | Docker existe en deux versions **Docker-CE** (Docker Community Edition) et **Docker-EE** (Docker Enterprise Edition). Pour consulter les différences entre les deux versions, consultez le lien **[[https:// | + | |
| - | + | ||
| - | =====LAB #1 - Travailler avec Docker===== | + | |
| - | + | ||
| - | ====1.1 - Installer docker==== | + | |
| - | + | ||
| - | Installer Docker-CE sur **votre** ordinateur : | + | |
| - | + | ||
| - | ==Mac== | + | |
| - | + | ||
| - | * Voir le lien **[[https:// | + | |
| - | + | ||
| - | ==Linux== | + | |
| - | + | ||
| - | * Ubuntu - voir le lien **[[https:// | + | |
| - | * Debian - voir le lien **[[https:// | + | |
| - | * CentOS - voir le lien **[[https:// | + | |
| - | * Fedora - voir le lien **[[https:// | + | |
| - | + | ||
| - | ==Windows 7, 8== | + | |
| - | + | ||
| - | * Téléchargez Docker Toolbox à partir de cette page **[[https:// | + | |
| - | * Fermez toutes les machines virtuelles ainsi que VirtualBox, | + | |
| - | * Installez **DockerToolBox.exe** (décochez VirtualBox dans la liste de produits à installer), | + | |
| - | * Exécutez Docker Toolbox et laissez l' | + | |
| - | * Ouvrez VirtualBox. Vous verrez une machine virtuelle Default, | + | |
| - | * Ouvrez **cmd**. | + | |
| - | + | ||
| - | ==Windows 10== | + | |
| - | + | ||
| - | * Voir le lien **[[https:// | + | |
| - | + | ||
| - | + | ||
| - | ====1.2 - Démarrer un Conteneur==== | + | |
| - | + | ||
| - | Démarrez un conteneur de l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | Unable to find image ' | + | |
| - | latest: Pulling from library/ | + | |
| - | 1b930d010525: | + | |
| - | Digest: sha256: | + | |
| - | Status: Downloaded newer image for hello-world: | + | |
| - | + | ||
| - | Hello from Docker! | + | |
| - | This message shows that your installation appears to be working correctly. | + | |
| - | + | ||
| - | To generate this message, Docker took the following steps: | + | |
| - | 1. The Docker client contacted the Docker daemon. | + | |
| - | 2. The Docker daemon pulled the " | + | |
| - | (amd64) | + | |
| - | 3. The Docker daemon created a new container from that image which runs the | + | |
| - | executable that produces the output you are currently reading. | + | |
| - | 4. The Docker daemon streamed that output to the Docker client, which sent it | + | |
| - | to your terminal. | + | |
| - | + | ||
| - | To try something more ambitious, you can run an Ubuntu container with: | + | |
| - | $ docker run -it ubuntu bash | + | |
| - | + | ||
| - | Share images, automate workflows, and more with a free Docker ID: | + | |
| - | | + | |
| - | + | ||
| - | For more examples and ideas, visit: | + | |
| - | | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - Notez que si l' | + | |
| - | </ | + | |
| - | + | ||
| - | Démarrez un conteneur de l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | Unable to find image ' | + | |
| - | latest: Pulling from library/ | + | |
| - | 898c46f3b1a1: | + | |
| - | 63366dfa0a50: | + | |
| - | 041d4cd74a92: | + | |
| - | 6e1bee0f8701: | + | |
| - | Digest: sha256: | + | |
| - | Status: Downloaded newer image for ubuntu: | + | |
| - | root@3a3f9bda6cbd:/# | + | |
| - | bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var | + | |
| - | root@3a3f9bda6cbd:/# | + | |
| - | DISTRIB_ID=Ubuntu | + | |
| - | DISTRIB_RELEASE=18.04 | + | |
| - | DISTRIB_CODENAME=bionic | + | |
| - | DISTRIB_DESCRIPTION=" | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - Notez que dans ce cas le conteneur est lancé avec comme argument **bash** qui lancera /bin/bash dans le conteneur. | + | |
| - | </ | + | |
| - | + | ||
| - | Consulter la liste des paquets installés dans le conteneur ubuntu : | + | |
| - | + | ||
| - | < | + | |
| - | root@835001339e79:/# | + | |
| - | Desired=Unknown/ | + | |
| - | | Status=Not/ | + | |
| - | |/ Err? | + | |
| - | ||/ Name | + | |
| - | +++-====================================-=======================-=======================-============================================================================= | + | |
| - | ii adduser | + | |
| - | ii apt 1.6.8 | + | |
| - | ii base-files | + | |
| - | ii base-passwd | + | |
| - | ii bash | + | |
| - | ii bsdutils | + | |
| - | ii bzip2 1.0.6-8.1 | + | |
| - | ii coreutils | + | |
| - | ii dash | + | |
| - | ii debconf | + | |
| - | ii debianutils | + | |
| - | ii diffutils | + | |
| - | ii dpkg | + | |
| - | ii e2fsprogs | + | |
| - | ii fdisk 2.31.1-0.4ubuntu3.3 | + | |
| - | ii findutils | + | |
| - | ii gcc-8-base: | + | |
| - | ii gpgv | + | |
| - | ii grep | + | |
| - | ii gzip | + | |
| - | ii hostname | + | |
| - | ii init-system-helpers | + | |
| - | ii libacl1: | + | |
| - | ii libapt-pkg5.0: | + | |
| - | ii libattr1: | + | |
| - | ii libaudit-common | + | |
| - | ii libaudit1: | + | |
| - | ii libblkid1: | + | |
| - | ii libbz2-1.0: | + | |
| - | ii libc-bin | + | |
| - | ii libc6: | + | |
| - | ii libcap-ng0: | + | |
| - | ii libcom-err2: | + | |
| - | ii libdb5.3: | + | |
| - | ii libdebconfclient0: | + | |
| - | ii libext2fs2: | + | |
| - | ii libfdisk1: | + | |
| - | ii libffi6: | + | |
| - | ii libgcc1: | + | |
| - | ii libgcrypt20: | + | |
| - | ii libgmp10: | + | |
| - | ii libgnutls30: | + | |
| - | ii libgpg-error0: | + | |
| - | ii libhogweed4: | + | |
| - | ii libidn2-0: | + | |
| - | ii liblz4-1: | + | |
| - | ii liblzma5: | + | |
| - | ii libmount1: | + | |
| - | ii libncurses5: | + | |
| - | ii libncursesw5: | + | |
| - | ii libnettle6: | + | |
| - | ii libp11-kit0: | + | |
| - | ii libpam-modules: | + | |
| - | ii libpam-modules-bin | + | |
| - | ii libpam-runtime | + | |
| - | ii libpam0g: | + | |
| - | ii libpcre3: | + | |
| - | ii libprocps6: | + | |
| - | ii libseccomp2: | + | |
| - | ii libselinux1: | + | |
| - | ii libsemanage-common | + | |
| - | ii libsemanage1: | + | |
| - | ii libsepol1: | + | |
| - | ii libsmartcols1: | + | |
| - | ii libss2: | + | |
| - | ii libstdc++6: | + | |
| - | ii libsystemd0: | + | |
| - | ii libtasn1-6: | + | |
| - | ii libtinfo5: | + | |
| - | ii libudev1: | + | |
| - | ii libunistring2: | + | |
| - | ii libuuid1: | + | |
| - | ii libzstd1: | + | |
| - | ii login 1: | + | |
| - | ii lsb-base | + | |
| - | ii mawk | + | |
| - | ii mount 2.31.1-0.4ubuntu3.3 | + | |
| - | ii ncurses-base | + | |
| - | ii ncurses-bin | + | |
| - | ii passwd | + | |
| - | ii perl-base | + | |
| - | ii procps | + | |
| - | ii sed 4.4-2 | + | |
| - | ii sensible-utils | + | |
| - | ii sysvinit-utils | + | |
| - | ii tar 1.29b-2ubuntu0.1 | + | |
| - | ii ubuntu-keyring | + | |
| - | ii util-linux | + | |
| - | ii zlib1g: | + | |
| - | root@835001339e79:/# | + | |
| - | exit | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | Les options de la commande docker run peuvent être visualisées avec la commande : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | + | ||
| - | Usage: | + | |
| - | + | ||
| - | Run a command in a new container | + | |
| - | + | ||
| - | Options: | + | |
| - | --add-host list Add a custom host-to-IP mapping (host:ip) | + | |
| - | -a, --attach list Attach to STDIN, STDOUT or STDERR | + | |
| - | --blkio-weight uint16 | + | |
| - | --blkio-weight-device list Block IO weight (relative device weight) (default []) | + | |
| - | --cap-add list Add Linux capabilities | + | |
| - | --cap-drop list Drop Linux capabilities | + | |
| - | --cgroup-parent string | + | |
| - | --cidfile string | + | |
| - | --cpu-period int Limit CPU CFS (Completely Fair Scheduler) period | + | |
| - | --cpu-quota int Limit CPU CFS (Completely Fair Scheduler) quota | + | |
| - | --cpu-rt-period int Limit CPU real-time period in microseconds | + | |
| - | --cpu-rt-runtime int Limit CPU real-time runtime in microseconds | + | |
| - | -c, --cpu-shares int CPU shares (relative weight) | + | |
| - | --cpus decimal | + | |
| - | --cpuset-cpus string | + | |
| - | --cpuset-mems string | + | |
| - | -d, --detach | + | |
| - | --detach-keys string | + | |
| - | --device list Add a host device to the container | + | |
| - | --device-cgroup-rule list Add a rule to the cgroup allowed devices list | + | |
| - | --device-read-bps list Limit read rate (bytes per second) from a device (default []) | + | |
| - | --device-read-iops list Limit read rate (IO per second) from a device (default []) | + | |
| - | --device-write-bps list Limit write rate (bytes per second) to a device (default []) | + | |
| - | --device-write-iops list Limit write rate (IO per second) to a device (default []) | + | |
| - | --disable-content-trust | + | |
| - | --dns list Set custom DNS servers | + | |
| - | --dns-option list Set DNS options | + | |
| - | --dns-search list Set custom DNS search domains | + | |
| - | --entrypoint string | + | |
| - | -e, --env list Set environment variables | + | |
| - | --env-file list Read in a file of environment variables | + | |
| - | --expose list Expose a port or a range of ports | + | |
| - | --group-add list Add additional groups to join | + | |
| - | --health-cmd string | + | |
| - | --health-interval duration | + | |
| - | --health-retries int | + | |
| - | --health-start-period duration | + | |
| - | --health-timeout duration | + | |
| - | --help | + | |
| - | -h, --hostname string | + | |
| - | --init | + | |
| - | -i, --interactive | + | |
| - | --ip string | + | |
| - | --ip6 string | + | |
| - | --ipc string | + | |
| - | --isolation string | + | |
| - | --kernel-memory bytes Kernel memory limit | + | |
| - | -l, --label list Set meta data on a container | + | |
| - | --label-file list Read in a line delimited file of labels | + | |
| - | --link list Add link to another container | + | |
| - | --link-local-ip list | + | |
| - | --log-driver string | + | |
| - | --log-opt list Log driver options | + | |
| - | --mac-address string | + | |
| - | -m, --memory bytes | + | |
| - | --memory-reservation bytes | + | |
| - | --memory-swap bytes Swap limit equal to memory plus swap: ' | + | |
| - | --memory-swappiness int Tune container memory swappiness (0 to 100) (default -1) | + | |
| - | --mount mount Attach a filesystem mount to the container | + | |
| - | --name string | + | |
| - | --network string | + | |
| - | --network-alias list Add network-scoped alias for the container | + | |
| - | --no-healthcheck | + | |
| - | --oom-kill-disable | + | |
| - | --oom-score-adj int Tune host's OOM preferences (-1000 to 1000) | + | |
| - | --pid string | + | |
| - | --pids-limit int Tune container pids limit (set -1 for unlimited) | + | |
| - | --privileged | + | |
| - | -p, --publish list | + | |
| - | -P, --publish-all | + | |
| - | --read-only | + | |
| - | --restart string | + | |
| - | --rm | + | |
| - | --runtime string | + | |
| - | --security-opt list Security Options | + | |
| - | --shm-size bytes Size of /dev/shm | + | |
| - | --sig-proxy | + | |
| - | --stop-signal string | + | |
| - | --stop-timeout int | + | |
| - | --storage-opt list | + | |
| - | --sysctl map | + | |
| - | --tmpfs list Mount a tmpfs directory | + | |
| - | -t, --tty Allocate a pseudo-TTY | + | |
| - | --ulimit ulimit | + | |
| - | -u, --user string | + | |
| - | --userns string | + | |
| - | --uts string | + | |
| - | -v, --volume list Bind mount a volume | + | |
| - | --volume-driver string | + | |
| - | --volumes-from list Mount volumes from the specified container(s) | + | |
| - | -w, --workdir string | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.3 - Consulter la Liste des Conteneurs et Images==== | + | |
| - | + | ||
| - | Pour consulter tous les conteneurs, utilisez la commande | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 3a3f9bda6cbd | + | |
| - | 26ef17bd115d | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - Notez que chaque conteneur peut être référencé par son **CONTAINER ID** ou par son **NAME**. | + | |
| - | </ | + | |
| - | + | ||
| - | Pour consulter la liste des images, utilisez la commande **docker images** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | REPOSITORY | + | |
| - | ubuntu | + | |
| - | hello-world | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - Notez que chaque image est référencée par son IMAGE ID. | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.4 - Rechercher une Image dans un Dépôt==== | + | |
| - | + | ||
| - | Pour rechercher une image docker dans le dépôt par défaut, utilisez la commande **docker search** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | NAME DESCRIPTION | + | |
| - | centos | + | |
| - | ansible/ | + | |
| - | jdeathe/ | + | |
| - | consol/ | + | |
| - | imagine10255/ | + | |
| - | centos/ | + | |
| - | tutum/ | + | |
| - | gluster/ | + | |
| - | openshift/ | + | |
| - | centos/ | + | |
| - | centos/ | + | |
| - | kinogmt/ | + | |
| - | centos/ | + | |
| - | centos/ | + | |
| - | openshift/ | + | |
| - | pivotaldata/ | + | |
| - | openshift/ | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - Notez que chaque image est référencée par la colonne NAME. Le NAME est sous le format **repository/ | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.5 - Supprimer un Conteneur d'une Image==== | + | |
| - | + | ||
| - | Pour supprimer un conteneur d'une image, il convient d' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 3a3f9bda6cbd | + | |
| - | 26ef17bd115d | + | |
| - | root@debian9: | + | |
| - | wizardly_buck | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 26ef17bd115d | + | |
| - | root@debian9: | + | |
| - | REPOSITORY | + | |
| - | ubuntu | + | |
| - | hello-world | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - Notez que dans le cas de l' | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.6 -Créer une Image à partir d'un Conteneur Modifié=== | + | |
| - | + | ||
| - | Modifier un conteneur d'une image : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@54b0dae2f3a9:/# | + | |
| - | bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var | + | |
| - | root@54b0dae2f3a9:/# | + | |
| - | root@54b0dae2f3a9:/# | + | |
| - | bin boot dev etc lib lib64 media mnt opt proc root run sbin srv sys tmp usr var | + | |
| - | root@54b0dae2f3a9:/# | + | |
| - | exit | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - Notez ici la suppression du répertoire **home** dans le conteneur **54b0dae2f3a9**. | + | |
| - | </ | + | |
| - | + | ||
| - | Consultez la différence entre le conteneur et l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 54b0dae2f3a9 | + | |
| - | 26ef17bd115d | + | |
| - | root@debian9: | + | |
| - | C /root | + | |
| - | A / | + | |
| - | D /home | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - La sortie de la commande **docker diff** comporte des lettres dont les significations sont les suivantes : C = Create, D = Delete, A = Add. | + | |
| - | </ | + | |
| - | + | ||
| - | Créez un autre conteneur à partir de l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@92f0d4bb7967:/# | + | |
| - | bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var | + | |
| - | root@92f0d4bb7967:/# | + | |
| - | exit | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - Dans ce nouveau conteneur, le répertoire **/home** est présent compte tenu du fait qu'il a été généré à partir de l' | + | |
| - | </ | + | |
| - | + | ||
| - | Créez maintenant l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 92f0d4bb7967 | + | |
| - | 54b0dae2f3a9 | + | |
| - | 26ef17bd115d | + | |
| - | root@debian9: | + | |
| - | sha256: | + | |
| - | root@debian9: | + | |
| - | REPOSITORY | + | |
| - | ubuntu_1 | + | |
| - | ubuntu | + | |
| - | hello-world | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.7 - Supprimer une Image==== | + | |
| - | + | ||
| - | Créez maintenant un conteneur à partir de la nouvelle image **ubuntu_1** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@904215fb79b4:/# | + | |
| - | bin boot dev etc lib lib64 media mnt opt proc root run sbin srv sys tmp usr var | + | |
| - | root@904215fb79b4:/# | + | |
| - | exit | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - Notez l' | + | |
| - | </ | + | |
| - | + | ||
| - | Essayez de supprimer l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | Error response from daemon: conflict: unable to remove repository reference " | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 904215fb79b4 | + | |
| - | 92f0d4bb7967 | + | |
| - | 54b0dae2f3a9 | + | |
| - | 26ef17bd115d | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - Notez qu'il n'est pas possible de supprimer l' | + | |
| - | </ | + | |
| - | + | ||
| - | Supprimez donc le conteneur **priceless_swirles** ainsi que l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | priceless_swirles | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 92f0d4bb7967 | + | |
| - | 54b0dae2f3a9 | + | |
| - | 26ef17bd115d | + | |
| - | root@debian9: | + | |
| - | Untagged: ubuntu_1: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | root@debian9: | + | |
| - | REPOSITORY | + | |
| - | ubuntu | + | |
| - | hello-world | + | |
| - | </ | + | |
| - | + | ||
| - | Pour pouvoir supprimer tous les conteneurs, listez-les par leur **Container ID** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | 92f0d4bb7967 | + | |
| - | 54b0dae2f3a9 | + | |
| - | 26ef17bd115d | + | |
| - | </ | + | |
| - | + | ||
| - | Supprimer toutes les conteneurs : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | 92f0d4bb7967 | + | |
| - | 54b0dae2f3a9 | + | |
| - | 26ef17bd115d | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | Pour supprimer un conteneur dès la fin de son exécution, utilisez l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@d123b0112fc2:/# | + | |
| - | bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var | + | |
| - | root@d123b0112fc2:/# | + | |
| - | exit | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.8 - Créer un Conteneur avec un Nom Spécifique==== | + | |
| - | + | ||
| - | Créez maintenant un conteneur avec un nom spécifique : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@04b5ab87539a:/# | + | |
| - | bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var | + | |
| - | root@04b5ab87539a:/# | + | |
| - | exit | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 04b5ab87539a | + | |
| - | </ | + | |
| - | + | ||
| - | Pour obtenir de l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | [ | + | |
| - | | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | 0, | + | |
| - | 0 | + | |
| - | ], | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | "/ | + | |
| - | "/ | + | |
| - | "/ | + | |
| - | "/ | + | |
| - | "/ | + | |
| - | "/ | + | |
| - | "/ | + | |
| - | "/ | + | |
| - | "/ | + | |
| - | "/ | + | |
| - | ], | + | |
| - | " | + | |
| - | "/ | + | |
| - | "/ | + | |
| - | "/ | + | |
| - | "/ | + | |
| - | "/ | + | |
| - | ] | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | ], | + | |
| - | " | + | |
| - | "/ | + | |
| - | ], | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | }, | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | } | + | |
| - | } | + | |
| - | } | + | |
| - | ] | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.9 - Exécuter une Commande dans un Conteneur==== | + | |
| - | + | ||
| - | Pour exécuter une commande spécifique dans un conteneur, passez la commande en argument : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | PATH=/ | + | |
| - | HOSTNAME=77bb110031aa | + | |
| - | HOME=/ | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.10 - Injecter des Variables d' | + | |
| - | + | ||
| - | Pour injecter une ou des variables d' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | EDITOR=vim | + | |
| - | HOSTNAME=ubuntudocker | + | |
| - | </ | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | PATH=/ | + | |
| - | HOSTNAME=ubuntudocker | + | |
| - | EDITOR=vim | + | |
| - | HOME=/ | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.11 - Modifier le Nom d' | + | |
| - | + | ||
| - | Pour modifier le nom d' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@ubuntudocker:/# | + | |
| - | ubuntudocker | + | |
| - | root@ubuntudocker:/# | + | |
| - | exit | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.12 - Mapper des Ports d'un Conteneur===== | + | |
| - | + | ||
| - | Démarrer un conteneur de nginx sur le port localhost 81 : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | Unable to find image ' | + | |
| - | latest: Pulling from library/ | + | |
| - | 27833a3ba0a5: | + | |
| - | e83729dd399a: | + | |
| - | ebc6a67df66d: | + | |
| - | Digest: sha256: | + | |
| - | Status: Downloaded newer image for nginx: | + | |
| - | ^Croot@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | Notez que c'est bloquant. Le fait d' | + | |
| - | + | ||
| - | < | + | |
| - | ^Croot@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.13 - Démarrer un Conteneur en mode Détaché==== | + | |
| - | + | ||
| - | Démarrez maintenant le conteneur de nginx en mode détaché grâce à l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | aabb064d4b0ade1f19216b6174631fa32a2053f6aa9d59bd724ea90ce534b004 | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | aabb064d4b0a | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.14 - Accèder aux Services d'un Conteneur de l' | + | |
| - | + | ||
| - | Installez le navigateur texte **lynx** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | Lecture des listes de paquets... Fait | + | |
| - | Construction de l' | + | |
| - | Lecture des informations d' | + | |
| - | The following additional packages will be installed: | + | |
| - | lynx-common | + | |
| - | Les NOUVEAUX paquets suivants seront installés : | + | |
| - | lynx lynx-common | + | |
| - | 0 mis à jour, 2 nouvellement installés, 0 à enlever et 94 non mis à jour. | + | |
| - | Il est nécessaire de prendre 1 730 ko dans les archives. | + | |
| - | Après cette opération, 5 590 ko d' | + | |
| - | Souhaitez-vous continuer ? [O/n] o | + | |
| - | Réception de:1 http:// | + | |
| - | Réception de:2 http:// | + | |
| - | 1 730 ko réceptionnés en 6s (283 ko/s) | + | |
| - | Sélection du paquet lynx-common précédemment désélectionné. | + | |
| - | (Lecture | + | |
| - | Préparation du dépaquetage de .../ | + | |
| - | Dépaquetage de lynx-common (2.8.9dev11-1) ... | + | |
| - | Sélection du paquet lynx précédemment désélectionné. | + | |
| - | Préparation du dépaquetage de .../ | + | |
| - | Dépaquetage de lynx (2.8.9dev11-1) ... | + | |
| - | Traitement des actions différées (« triggers ») pour mime-support (3.60) ... | + | |
| - | Traitement des actions différées (« triggers ») pour man-db (2.7.6.1-2) ... | + | |
| - | Paramétrage de lynx-common (2.8.9dev11-1) ... | + | |
| - | Paramétrage de lynx (2.8.9dev11-1) ... | + | |
| - | update-alternatives: | + | |
| - | </ | + | |
| - | + | ||
| - | Vérifiez que nginx répond aux requetes : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | | + | |
| - | + | ||
| - | If you see this page, the nginx web server is successfully installed | + | |
| - | and working. Further configuration is required. | + | |
| - | + | ||
| - | For online documentation and support please refer to [1]nginx.org. | + | |
| - | | + | |
| - | + | ||
| - | Thank you for using nginx. | + | |
| - | + | ||
| - | Références | + | |
| - | + | ||
| - | 1. http:// | + | |
| - | 2. http:// | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.15 - Arrêter et Démarrer un Conteneur==== | + | |
| - | + | ||
| - | Arrêtez le conteneur nginx : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | aabb064d4b0a | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | root@debian9: | + | |
| - | aabb | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | aabb064d4b0a | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | </ | + | |
| - | + | ||
| - | Démarrez de nouveau le conteneur de nginx : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | aabb | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | aabb064d4b0a | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.16 - Utiliser des Signaux avec un Conteneur==== | + | |
| - | + | ||
| - | Utilisez un signal pour tuer le processus du conteneur de nginx : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | aabb | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | aabb064d4b0a | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | </ | + | |
| - | + | ||
| - | Redémarrez un conteneur en cours : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | aabb | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | aabb064d4b0a | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | root@debian9: | + | |
| - | aabb | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | aabb064d4b0a | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.17 - Forcer la Suppression d'un Conteneur en cours d' | + | |
| - | + | ||
| - | Supprimez un conteneur en cours d' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | Error response from daemon: You cannot remove a running container aabb064d4b0ade1f19216b6174631fa32a2053f6aa9d59bd724ea90ce534b004. Stop the container before attempting removal or force remove | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | aabb064d4b0a | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | root@debian9: | + | |
| - | aabb | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | </ | + | |
| - | + | ||
| - | ===1.18 - Utilisation Simple d'un Volume=== | + | |
| - | + | ||
| - | Créez le fichier index.html et placez-le dans le répertoire /root/www : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | < | + | |
| - | < | + | |
| - | < | + | |
| - | </ | + | |
| - | </ | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | Indiquez au conteneur que son répertoire **/ | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | c080793965de8a6a60db212d7e4d96de84b55352c224c054dced75b409e39bf2 | + | |
| - | root@debian9: | + | |
| - | Accueil du site nginx | + | |
| - | + | ||
| - | + | ||
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** - Notez ici l' | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.19 - Télécharger une image sans créer un conteneur==== | + | |
| - | + | ||
| - | Téléchargez l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | Using default tag: latest | + | |
| - | latest: Pulling from library/ | + | |
| - | 8ba884070f61: | + | |
| - | Digest: sha256: | + | |
| - | Status: Downloaded newer image for centos: | + | |
| - | </ | + | |
| - | + | ||
| - | Vérifiez le contenu de l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | [root@86252a3f00f4 /]# cat / | + | |
| - | CentOS Linux release 7.6.1810 (Core) | + | |
| - | [root@86252a3f00f4 /]# rpm -qa | more | + | |
| - | bind-license-9.9.4-73.el7_6.noarch | + | |
| - | bash-4.2.46-31.el7.x86_64 | + | |
| - | glibc-common-2.17-260.el7_6.3.x86_64 | + | |
| - | nss-softokn-freebl-3.36.0-5.el7_5.x86_64 | + | |
| - | filesystem-3.2-25.el7.x86_64 | + | |
| - | glibc-2.17-260.el7_6.3.x86_64 | + | |
| - | nspr-4.19.0-1.el7_5.x86_64 | + | |
| - | popt-1.13-16.el7.x86_64 | + | |
| - | libcom_err-1.42.9-13.el7.x86_64 | + | |
| - | libcap-2.22-9.el7.x86_64 | + | |
| - | libstdc++-4.8.5-36.el7.x86_64 | + | |
| - | info-5.1-5.el7.x86_64 | + | |
| - | gawk-4.0.2-4.el7_3.1.x86_64 | + | |
| - | libselinux-2.5-14.1.el7.x86_64 | + | |
| - | grep-2.20-3.el7.x86_64 | + | |
| - | keyutils-libs-1.5.8-3.el7.x86_64 | + | |
| - | libverto-0.2.5-4.el7.x86_64 | + | |
| - | p11-kit-trust-0.23.5-3.el7.x86_64 | + | |
| - | openssl-libs-1.0.2k-16.el7.x86_64 | + | |
| - | krb5-libs-1.15.1-37.el7_6.x86_64 | + | |
| - | xz-libs-5.2.2-1.el7.x86_64 | + | |
| - | libdb-5.3.21-24.el7.x86_64 | + | |
| - | libgpg-error-1.12-3.el7.x86_64 | + | |
| - | libgcrypt-1.5.3-14.el7.x86_64 | + | |
| - | lua-5.1.4-15.el7.x86_64 | + | |
| - | libuuid-2.23.2-59.el7.x86_64 | + | |
| - | libmount-2.23.2-59.el7.x86_64 | + | |
| - | shared-mime-info-1.8-4.el7.x86_64 | + | |
| - | gzip-1.5-10.el7.x86_64 | + | |
| - | findutils-4.5.11-6.el7.x86_64 | + | |
| - | diffutils-3.3-4.el7.x86_64 | + | |
| - | expat-2.1.0-10.el7_3.x86_64 | + | |
| - | audit-libs-2.8.4-4.el7.x86_64 | + | |
| - | pam-1.1.8-22.el7.x86_64 | + | |
| - | nss-softokn-3.36.0-5.el7_5.x86_64 | + | |
| - | nss-3.36.0-7.1.el7_6.x86_64 | + | |
| - | libassuan-2.1.0-3.el7.x86_64 | + | |
| - | nss-tools-3.36.0-7.1.el7_6.x86_64 | + | |
| - | gobject-introspection-1.56.1-1.el7.x86_64 | + | |
| - | --More-- | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.20 - S' | + | |
| - | + | ||
| - | Arretez le conteneur. Démarrez le conteneur puis rattachez-vous au conteneur : | + | |
| - | + | ||
| - | < | + | |
| - | [root@86252a3f00f4 /]# exit | + | |
| - | exit | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 86252a3f00f4 | + | |
| - | c080793965de | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | root@debian9: | + | |
| - | 8625 | + | |
| - | root@debian9: | + | |
| - | [root@86252a3f00f4 /]# ls | + | |
| - | anaconda-post.log | + | |
| - | [root@86252a3f00f4 /]# | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.21 - Installer un logiciel dans le conteneur=== | + | |
| - | + | ||
| - | Créez le fichier **/ | + | |
| - | + | ||
| - | < | + | |
| - | [root@86252a3f00f4 /]# vi / | + | |
| - | [root@86252a3f00f4 /]# cat / | + | |
| - | [mongodb-org-4.2] | + | |
| - | name=MongoDB Repository | + | |
| - | baseurl=https:// | + | |
| - | gpgcheck=1 | + | |
| - | enabled=1 | + | |
| - | gpgkey=https:// | + | |
| - | [root@86252a3f00f4 /]# | + | |
| - | </ | + | |
| - | + | ||
| - | Installez mongo : | + | |
| - | + | ||
| - | < | + | |
| - | [root@86252a3f00f4 /]# yum install -y mongodb-org | + | |
| - | </ | + | |
| - | + | ||
| - | Démarrez mongod : | + | |
| - | + | ||
| - | < | + | |
| - | [root@86252a3f00f4 /]# mongod --config / | + | |
| - | [1] 82 | + | |
| - | [root@86252a3f00f4 /]# about to fork child process, waiting until server is ready for connections. | + | |
| - | forked process: 84 | + | |
| - | child process started successfully, | + | |
| - | + | ||
| - | [1]+ Done mongod --config / | + | |
| - | [root@86252a3f00f4 /]# | + | |
| - | </ | + | |
| - | + | ||
| - | Vérifiez que mongod est démarré : | + | |
| - | + | ||
| - | < | + | |
| - | [root@86252a3f00f4 /]# ps aux | + | |
| - | USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND | + | |
| - | root | + | |
| - | root 84 1.2 2.2 294692 46716 ? Sl | + | |
| - | root | + | |
| - | </ | + | |
| - | + | ||
| - | Utilisez le client mongo pour se connecter au serveur : | + | |
| - | + | ||
| - | < | + | |
| - | [root@86252a3f00f4 /]# mongo | + | |
| - | MongoDB shell version: 4.2.2 | + | |
| - | connecting to: test | + | |
| - | Welcome to the MongoDB shell. | + | |
| - | For interactive help, type " | + | |
| - | For more comprehensive documentation, | + | |
| - | http:// | + | |
| - | Questions? Try the support group | + | |
| - | http:// | + | |
| - | Server has startup warnings: | + | |
| - | 2019-04-09T17: | + | |
| - | 2019-04-09T17: | + | |
| - | > | + | |
| - | </ | + | |
| - | + | ||
| - | Sortez de mongo et du conteneur : | + | |
| - | + | ||
| - | < | + | |
| - | > exit | + | |
| - | bye | + | |
| - | [root@86252a3f00f4 /]# exit | + | |
| - | exit | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.22 - Utilisation | + | |
| - | + | ||
| - | Créez maintenant une nouvelle image à partir de votre conteneur : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 86252a3f00f4 | + | |
| - | c080793965de | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | root@debian9: | + | |
| - | sha256: | + | |
| - | </ | + | |
| - | + | ||
| - | Supprimez le conteneur utilisé pour créer l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | 8625 | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | c080793965de | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | </ | + | |
| - | + | ||
| - | Utilisez la nouvelle image pour lancer un conteneur nommé **mongo** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | [root@d20fb56a38b0 /]# ls / | + | |
| - | / | + | |
| - | / | + | |
| - | [root@d20fb56a38b0 /]# ps aux | + | |
| - | USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND | + | |
| - | root | + | |
| - | root 15 0.0 0.1 51748 3468 pts/0 R+ | + | |
| - | </ | + | |
| - | + | ||
| - | Editez le fichier /etc/bashrc : | + | |
| - | + | ||
| - | < | + | |
| - | [root@d20fb56a38b0 /]# echo "/ | + | |
| - | [root@d20fb56a38b0 /]# tail / | + | |
| - | . " | + | |
| - | fi | + | |
| - | fi | + | |
| - | done | + | |
| - | + | ||
| - | unset i | + | |
| - | unset -f pathmunge | + | |
| - | fi | + | |
| - | # vim: | + | |
| - | / | + | |
| - | </ | + | |
| - | + | ||
| - | Consultez la liste des conteneurs et relevez le CONTAINER ID du conteneur | + | |
| - | + | ||
| - | < | + | |
| - | [root@d20fb56a38b0 /]# exit | + | |
| - | exit | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | d20fb56a38b0 | + | |
| - | c080793965de | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | </ | + | |
| - | + | ||
| - | Utilisez la commande commit pour " | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | sha256: | + | |
| - | </ | + | |
| - | + | ||
| - | Démarrez de nouveau le conteneur pour vérifier que mongod fonctionne : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | d20f | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | c080793965de | + | |
| - | 4f157e179134 | + | |
| - | 04b5ab87539a | + | |
| - | root@debian9: | + | |
| - | [root@bcec3f27ed58 /]# about to fork child process, waiting until server is ready for connections. | + | |
| - | forked process: 16 | + | |
| - | child process started successfully, | + | |
| - | + | ||
| - | [1]+ Done / | + | |
| - | [root@bcec3f27ed58 /]# ps aux | + | |
| - | USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND | + | |
| - | root | + | |
| - | root 16 2.0 2.4 298788 49276 ? Sl | + | |
| - | root 39 0.0 0.1 51748 3476 pts/0 R+ | + | |
| - | [root@bcec3f27ed58 /]# | + | |
| - | </ | + | |
| - | + | ||
| - | ====1.23 - Se connecter au serveur du conteneur de l' | + | |
| - | + | ||
| - | Pour pouvoir se connecter à mongodb depuis la machine hôte, il convient d' | + | |
| - | + | ||
| - | < | + | |
| - | [root@bcec3f27ed58 /]# vi / | + | |
| - | [root@bcec3f27ed58 /]# cat / | + | |
| - | | + | |
| - | </ | + | |
| - | + | ||
| - | Sortez du conteneur, re-créez une image, supprimez le conteneur utilisé et relancez de nouveau le conteneur : | + | |
| - | + | ||
| - | < | + | |
| - | [root@bcec3f27ed58 /]# exit | + | |
| - | exit | + | |
| - | root@debian9: | + | |
| - | sha256: | + | |
| - | root@debian9: | + | |
| - | mongo | + | |
| - | root@debian9: | + | |
| - | [root@d2ddb4f8ca8a /]# about to fork child process, waiting until server is ready for connections. | + | |
| - | forked process: 16 | + | |
| - | [root@d2ddb4f8ca8a /]# child process started successfully, | + | |
| - | + | ||
| - | [1]+ Done / | + | |
| - | [root@d2ddb4f8ca8a /]# | + | |
| - | </ | + | |
| - | + | ||
| - | Dans votre machine hôte, configurez le dépôt de mongodb : | + | |
| - | + | ||
| - | < | + | |
| - | [root@f5b45072b831 /]# exit | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | Executing: / | + | |
| - | gpg: key 68818C72E52529D4: | + | |
| - | gpg: Total number processed: 1 | + | |
| - | gpg: | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | deb http:// | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | Cette fois, installez uniquement le client de mongodb : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | Lecture | + | |
| - | Construction de l' | + | |
| - | Lecture des informations d' | + | |
| - | Les NOUVEAUX paquets suivants seront installés : | + | |
| - | mongodb-org-shell | + | |
| - | 0 mis à jour, 1 nouvellement installés, 0 à enlever et 95 non mis à jour. | + | |
| - | Il est nécessaire de prendre 9 809 ko dans les archives. | + | |
| - | Après cette opération, 39,8 Mo d' | + | |
| - | Réception de:1 http:// | + | |
| - | 9 809 ko réceptionnés en 7s (1 245 ko/s) | + | |
| - | Sélection du paquet mongodb-org-shell précédemment désélectionné. | + | |
| - | (Lecture de la base de données... 91513 fichiers et répertoires déjà installés.) | + | |
| - | Préparation du dépaquetage de .../ | + | |
| - | Dépaquetage de mongodb-org-shell (4.0.8) ... | + | |
| - | Paramétrage de mongodb-org-shell (4.0.8) ... | + | |
| - | Traitement des actions différées (« triggers ») pour man-db (2.7.6.1-2) ... | + | |
| - | </ | + | |
| - | + | ||
| - | Notez qu'à ce stade le conteneur ne possède pas d' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | </ | + | |
| - | + | ||
| - | Démarrez donc le conteneur et cherchez l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | mongo | + | |
| - | root@debian9: | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | </ | + | |
| - | + | ||
| - | Connectez-vous maintenant à votre mongodb à partir de la machine hôte : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | MongoDB shell version v4.0.8 | + | |
| - | connecting to: mongodb:// | + | |
| - | WARNING: No implicit session: Logical Sessions are only supported on server versions 3.6 and greater. | + | |
| - | Implicit session: dummy session | + | |
| - | MongoDB server version: 4.2.2 | + | |
| - | WARNING: shell and server versions do not match | + | |
| - | Welcome to the MongoDB shell. | + | |
| - | For interactive help, type " | + | |
| - | For more comprehensive documentation, | + | |
| - | http:// | + | |
| - | Questions? Try the support group | + | |
| - | http:// | + | |
| - | Server has startup warnings: | + | |
| - | 2019-04-09T17: | + | |
| - | 2019-04-09T17: | + | |
| - | > | + | |
| - | </ | + | |
| - | + | ||
| - | =====LAB #2 - Création d'un Utilisateur de Confiance pour Contrôler le Daemon Docker===== | + | |
| - | + | ||
| - | Au contraire des solutions classiques de gestion de machines virtuelles où l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | docker: | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | déconnexion | + | |
| - | trainee@manager: | + | |
| - | Got permission denied while trying to connect to the Docker daemon socket at unix:/// | + | |
| - | trainee@manager: | + | |
| - | trainee@manager: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | d02c6115724c | + | |
| - | trainee@manager: | + | |
| - | alpine1 | + | |
| - | trainee@manager: | + | |
| - | a214e2df0499c97e8da25a6c9ea751ac75344c9bcd7d238f8cb8d5c777510ab9 | + | |
| - | trainee@manager: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | a214e2df0499 | + | |
| - | </ | + | |
| - | + | ||
| - | =====LAB #3 - Le Script docker-bench-security.sh===== | + | |
| - | + | ||
| - | Le **Center for Internet Security (CIS)** est une organisation indépendante à but non-lucratif qui publie des best practices dans de nombreux domaines de l' | + | |
| - | + | ||
| - | Le guide est divisé en plusieurs sections : | + | |
| - | + | ||
| - | * La configuration de l' | + | |
| - | * La configuration du daemon Docker, | + | |
| - | * Les fichiers de configuration du daemon Docker, | + | |
| - | * Les images ainsi que les fichiers servant à la construction des images, | + | |
| - | * Le container runtime, | + | |
| - | * Les opérations sécuritaires relatives à Docker, | + | |
| - | * La configuration de Docker Swarm. | + | |
| - | + | ||
| - | Ce guide est à utiliser avec le script **Docker Benchmark Security**. | + | |
| - | + | ||
| - | Clonez le script **docker-bench-security.sh** en utilisant **git** : | + | |
| - | + | ||
| - | < | + | |
| - | trainee@manager: | + | |
| - | Mot de passe : fenestros | + | |
| - | root@debian9: | + | |
| - | Clonage dans ' | + | |
| - | remote: Enumerating objects: 18, done. | + | |
| - | remote: Counting objects: 100% (18/18), done. | + | |
| - | remote: Compressing objects: 100% (16/16), done. | + | |
| - | remote: Total 1921 (delta 5), reused 6 (delta 2), pack-reused 1903 | + | |
| - | Réception d' | + | |
| - | Résolution des deltas: 100% (1339/ | + | |
| - | </ | + | |
| - | + | ||
| - | Exécutez maintenant le script **Docker Benchmark Security** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | # ------------------------------------------------------------------------------ | + | |
| - | # Docker Bench for Security v1.3.5 | + | |
| - | # | + | |
| - | # Docker, Inc. (c) 2015- | + | |
| - | # | + | |
| - | # Checks for dozens of common best-practices around deploying Docker containers in production. | + | |
| - | # Inspired by the CIS Docker Benchmark v1.2.0. | + | |
| - | # ------------------------------------------------------------------------------ | + | |
| - | + | ||
| - | Initializing vendredi 8 novembre 2019, 12:12:03 (UTC+0100) | + | |
| - | + | ||
| - | + | ||
| - | [INFO] 1 - Host Configuration | + | |
| - | + | ||
| - | [INFO] 1.1 - General Configuration | + | |
| - | [NOTE] 1.1.1 - Ensure the container host has been Hardened | + | |
| - | [INFO] 1.1.2 - Ensure Docker is up to date | + | |
| - | [INFO] | + | |
| - | [INFO] | + | |
| - | + | ||
| - | [INFO] 1.2 - Linux Hosts Specific Configuration | + | |
| - | [WARN] 1.2.1 - Ensure a separate partition for containers has been created | + | |
| - | ... | + | |
| - | </ | + | |
| - | + | ||
| - | Ce script sert à automatiser le contrôle des points précédemment cités et produit un rapport contenant des annotations : | + | |
| - | + | ||
| - | * **[PASS]** : Concerne les points qui n'ont pas besoin d' | + | |
| - | * **[WARN]** : Concerne les points qui **doivent** être modifiés, | + | |
| - | * **[INFO]** : Concerne les points qui doivent être passés en revue selon les besoins de votre configuration, | + | |
| - | * **[NOTE]** : Vous informe d'un **best practice**. | + | |
| - | + | ||
| - | =====LAB #4 - Sécurisation de la Configuration de l' | + | |
| - | + | ||
| - | Lors de l' | + | |
| - | + | ||
| - | < | + | |
| - | ... | + | |
| - | [INFO] 1 - Host Configuration | + | |
| - | + | ||
| - | [INFO] 1.1 - General Configuration | + | |
| - | [NOTE] 1.1.1 - Ensure the container host has been Hardened | + | |
| - | [INFO] 1.1.2 - Ensure Docker is up to date | + | |
| - | [INFO] | + | |
| - | [INFO] | + | |
| - | + | ||
| - | [INFO] 1.2 - Linux Hosts Specific Configuration | + | |
| - | [WARN] 1.2.1 - Ensure a separate partition for containers has been created | + | |
| - | [INFO] 1.2.2 - Ensure only trusted users are allowed to control Docker daemon | + | |
| - | [INFO] | + | |
| - | [WARN] 1.2.3 - Ensure auditing is configured for the Docker daemon | + | |
| - | [WARN] 1.2.4 - Ensure auditing is configured for Docker files and directories - / | + | |
| - | [WARN] 1.2.5 - Ensure auditing is configured for Docker files and directories - / | + | |
| - | [WARN] 1.2.6 - Ensure auditing is configured for Docker files and directories - docker.service | + | |
| - | [WARN] 1.2.7 - Ensure auditing is configured for Docker files and directories - docker.socket | + | |
| - | [WARN] 1.2.8 - Ensure auditing is configured for Docker files and directories - / | + | |
| - | [INFO] 1.2.9 - Ensure auditing is configured for Docker files and directories - / | + | |
| - | [INFO] | + | |
| - | [INFO] 1.2.10 | + | |
| - | [INFO] | + | |
| - | [WARN] 1.2.11 | + | |
| - | [INFO] 1.2.12 | + | |
| - | [INFO] | + | |
| - | ... | + | |
| - | </ | + | |
| - | + | ||
| - | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. | + | |
| - | + | ||
| - | ====4.1 - [WARN] 1.2.1 - Ensure a separate partition for containers has been created==== | + | |
| - | + | ||
| - | Par défaut, tous les fichiers de Docker sont stockés dans le répertoire **/ | + | |
| - | + | ||
| - | ====4.2 - [WARN] 1.2.3 - Ensure auditing is configured for the Docker daemon==== | + | |
| - | + | ||
| - | < | + | |
| - | [WARN] 1.2.4 - Ensure auditing is configured for Docker files and directories - / | + | |
| - | [WARN] 1.2.5 - Ensure auditing is configured for Docker files and directories - / | + | |
| - | [WARN] 1.2.6 - Ensure auditing is configured for Docker files and directories - docker.service | + | |
| - | [WARN] 1.2.7 - Ensure auditing is configured for Docker files and directories - docker.socket | + | |
| - | [WARN] 1.2.8 - Ensure auditing is configured for Docker files and directories - / | + | |
| - | [WARN] 1.2.11 | + | |
| - | </ | + | |
| - | + | ||
| - | Ces avertissements sont présents parce que **auditd** n'est pas installé et parce qu'il n'y a pas de règles spécifiques au daemon Docker et ses répertoires et fichiers associés. | + | |
| - | + | ||
| - | Pour installer auditd, utilisez **apt-get** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | Modifiez ensuite le fichier **/ | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | ## First rule - delete all | + | |
| - | -D | + | |
| - | + | ||
| - | ## Increase the buffers to survive stress events. | + | |
| - | ## Make this bigger for busy systems | + | |
| - | -b 8192 | + | |
| - | + | ||
| - | ## This determine how long to wait in burst of events | + | |
| - | --backlog_wait_time 0 | + | |
| - | + | ||
| - | ## Set failure mode to syslog | + | |
| - | -f 1 | + | |
| - | + | ||
| - | ##Docker | + | |
| - | -w / | + | |
| - | -w / | + | |
| - | -w /etc/docker -p wa | + | |
| - | -w / | + | |
| - | -w / | + | |
| - | -w / | + | |
| - | -w / | + | |
| - | -w / | + | |
| - | -w / | + | |
| - | -w / | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** : L' | + | |
| - | </ | + | |
| - | + | ||
| - | Re-démarrez ensuite auditd : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | Vérifiez ensuite la prise en charge des règles : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | ## This file is automatically generated from / | + | |
| - | -D | + | |
| - | -b 8192 | + | |
| - | -f 1 | + | |
| - | --backlog_wait_time 0 | + | |
| - | -w / | + | |
| - | -w / | + | |
| - | -w /etc/docker -p wa | + | |
| - | -w / | + | |
| - | -w / | + | |
| - | -w / | + | |
| - | -w / | + | |
| - | -w / | + | |
| - | -w / | + | |
| - | -w / | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** - Pour plus d' | + | |
| - | </ | + | |
| - | + | ||
| - | Ré-exécutez le script **Docker Benchmark Security** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | ... | + | |
| - | [PASS] 1.2.4 - Ensure auditing is configured for Docker files and directories - / | + | |
| - | [PASS] 1.2.5 - Ensure auditing is configured for Docker files and directories - / | + | |
| - | [PASS] 1.2.6 - Ensure auditing is configured for Docker files and directories - docker.service | + | |
| - | [PASS] 1.2.7 - Ensure auditing is configured for Docker files and directories - docker.socket | + | |
| - | [PASS] 1.2.8 - Ensure auditing is configured for Docker files and directories - / | + | |
| - | ... | + | |
| - | [PASS] 1.2.11 | + | |
| - | ... | + | |
| - | </ | + | |
| - | + | ||
| - | =====LAB #5 - Sécurisation de la Configuration du daemon Docker===== | + | |
| - | + | ||
| - | Exécutez de nouveau le script **docker-bench-security.sh**. Vous devez obtenir un résultat similaire à ceci en ce qui concerne la sécurité de la configuration du daemon Docker : | + | |
| - | + | ||
| - | < | + | |
| - | ... | + | |
| - | [INFO] 2 - Docker daemon configuration | + | |
| - | [WARN] 2.1 - Ensure network traffic is restricted between containers on the default bridge | + | |
| - | [PASS] 2.2 - Ensure the logging level is set to ' | + | |
| - | [PASS] 2.3 - Ensure Docker is allowed to make changes to iptables | + | |
| - | [PASS] 2.4 - Ensure insecure registries are not used | + | |
| - | [PASS] 2.5 - Ensure aufs storage driver is not used | + | |
| - | [INFO] 2.6 - Ensure TLS authentication for Docker daemon is configured | + | |
| - | [INFO] | + | |
| - | [INFO] 2.7 - Ensure the default ulimit is configured appropriately | + | |
| - | [INFO] | + | |
| - | [WARN] 2.8 - Enable user namespace support | + | |
| - | [PASS] 2.9 - Ensure the default cgroup usage has been confirmed | + | |
| - | [PASS] 2.10 - Ensure base device size is not changed until needed | + | |
| - | [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled | + | |
| - | [WARN] 2.12 - Ensure centralized and remote logging is configured | + | |
| - | [PASS] 2.13 - Ensure live restore is Enabled (Incompatible with swarm mode) | + | |
| - | [WARN] 2.14 - Ensure Userland Proxy is Disabled | + | |
| - | [PASS] 2.15 - Ensure that a daemon-wide custom seccomp profile is applied if appropriate | + | |
| - | [PASS] 2.16 - Ensure that experimental features are not implemented in production | + | |
| - | [WARN] 2.17 - Ensure containers are restricted from acquiring new privileges | + | |
| - | ... | + | |
| - | </ | + | |
| - | + | ||
| - | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. | + | |
| - | + | ||
| - | ====5.1 - [WARN] 2.1 - Ensure network traffic is restricted between containers on the default bridge==== | + | |
| - | + | ||
| - | Par défaut Docker permet un trafic réseau sans restrictions entre des conteneurs sur le même hôte. Il est cependant possible de modifier la configuration par défaut. Pour empêcher ceci, il faut fixer la valeur de **icc** à **false**. De cette façon, docker crée des conteneurs qui peuvent communiquer entre eux **uniquement** s'il existe un lien. | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====5.2 - [WARN] 2.8 - Enable user namespace support==== | + | |
| - | + | ||
| - | Cet avertissement nous indique que l' | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====5.3 - [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled==== | + | |
| - | + | ||
| - | Par défaut, Docker permet un accès sans restrictions aux daemon Docker. Il est possible de restreindre l' | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====5.4 - [WARN] 2.12 - Ensure centralized and remote logging is configured==== | + | |
| - | + | ||
| - | Cet avertissement indique que la configuration de rsyslog ne permet pas l' | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====5.5 - [WARN] 2.14 - Ensure Userland Proxy is Disabled==== | + | |
| - | + | ||
| - | Il existe deux méthodes pour qu'un conteneur puisse router vers l' | + | |
| - | + | ||
| - | * le mode **Hairpin NAT**, | + | |
| - | * **Userland Proxy**. | + | |
| - | + | ||
| - | Il est préférable d' | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====5.6 - [WARN] 2.17 - Ensure containers are restricted from acquiring new privileges==== | + | |
| - | + | ||
| - | Par défaut un conteneur peut obtenir une escalade de privilèges en utilisant les binaires setuid ou setgid. Pour interdire ceci il faut fixer la valeur de **no-new-privileges** à **true**. | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====5.7 - Le Fichier / | + | |
| - | + | ||
| - | Créez le fichier **/ | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | } | + | |
| - | </ | + | |
| - | + | ||
| - | Notez ici que **live-restore** est fixé à **true**. Ceci permet aux conteneurs de continuer à fonctionner même quand le daemon Docker ne fonctionne pas. Ceci est utile pendant la mise-à-jour de Docker. | + | |
| - | + | ||
| - | Re-démarrez le service Docker : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | Vérifiez la présence de l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | uid=116(dockremap) gid=121(dockremap) groupes=121(dockremap) | + | |
| - | </ | + | |
| - | + | ||
| - | Ré-exécutez le script **Docker Benchmark Security** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | ... | + | |
| - | [PASS] 2.1 - Ensure network traffic is restricted between containers on the default bridge | + | |
| - | ... | + | |
| - | [PASS] 2.8 - Enable user namespace support | + | |
| - | ... | + | |
| - | [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled | + | |
| - | [PASS] 2.12 - Ensure centralized and remote logging is configured | + | |
| - | ... | + | |
| - | [PASS] 2.14 - Ensure Userland Proxy is Disabled | + | |
| - | ... | + | |
| - | [PASS] 2.17 - Ensure containers are restricted from acquiring new privileges | + | |
| - | ... | + | |
| - | </ | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | =====LAB #6 - Sécurisation des Images et les Fichiers de Construction===== | + | |
| - | + | ||
| - | Créez le conteneur mysql : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | Unable to find image ' | + | |
| - | latest: Pulling from library/ | + | |
| - | 80369df48736: | + | |
| - | e8f52315cb10: | + | |
| - | cf2189b391fc: | + | |
| - | cc98f645c682: | + | |
| - | 27a27ac83f74: | + | |
| - | fa1f04453414: | + | |
| - | d45bf7d22d33: | + | |
| - | 3dbac26e409c: | + | |
| - | 9017140fb8c1: | + | |
| - | b76dda2673ae: | + | |
| - | bea9eb46d12a: | + | |
| - | e1f050a38d0f: | + | |
| - | Digest: sha256: | + | |
| - | Status: Downloaded newer image for mysql: | + | |
| - | 54606c03c52c5e3ec0328029d69b869d4b285fb433015576dedc8b8dd4ad0494 | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 54606c03c52c | + | |
| - | </ | + | |
| - | + | ||
| - | Exécutez de nouveau le script **docker-bench-security.sh**. Vous devez obtenir un résultat similaire à ceci en ce qui concerne la sécurité des images et les fichiers de leur construction : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | ... | + | |
| - | [INFO] 4 - Container Images and Build File | + | |
| - | [WARN] 4.1 - Ensure a user for the container has been created | + | |
| - | [WARN] | + | |
| - | [NOTE] 4.2 - Ensure that containers use only trusted base images | + | |
| - | [NOTE] 4.3 - Ensure that unnecessary packages are not installed in the container | + | |
| - | [NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches | + | |
| - | [WARN] 4.5 - Ensure Content trust for Docker is Enabled | + | |
| - | [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images | + | |
| - | [WARN] | + | |
| - | [WARN] | + | |
| - | [INFO] 4.7 - Ensure update instructions are not use alone in the Dockerfile | + | |
| - | [INFO] | + | |
| - | [NOTE] 4.8 - Ensure setuid and setgid permissions are removed | + | |
| - | [PASS] 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles | + | |
| - | [NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles | + | |
| - | [NOTE] 4.11 - Ensure only verified packages are installed | + | |
| - | ... | + | |
| - | </ | + | |
| - | + | ||
| - | ====6.1 - [WARN] 4.1 - Ensure a user for the container has been created==== | + | |
| - | + | ||
| - | Les processus dans le conteneur **root-nginx** tourne sous l'UID de root. Ceci est l' | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====6.2 - [WARN] 4.5 - Ensure Content trust for Docker is Enabled==== | + | |
| - | + | ||
| - | Cette ligne indique que le support de Content trust n'a pas été activé. Content trust permet de s' | + | |
| - | + | ||
| - | Pour activer le Content trust, il faut positionner la valeur de la variable **DOCKER_CONTENT_TRUST** à **1** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | DOCKER_CONTENT_TRUST=1 | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | Re-démarrez la machine virtuelle **Manager** et démarrez le conteneur **mysql** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | mysql | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 54606c03c52c | + | |
| - | </ | + | |
| - | + | ||
| - | Exécutez de nouveau le script et notez le contenu de la section 4 : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | ... | + | |
| - | [INFO] 4 - Container Images and Build File | + | |
| - | [WARN] 4.1 - Ensure a user for the container has been created | + | |
| - | [WARN] | + | |
| - | [NOTE] 4.2 - Ensure that containers use only trusted base images | + | |
| - | [NOTE] 4.3 - Ensure that unnecessary packages are not installed in the container | + | |
| - | [NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches | + | |
| - | [PASS] 4.5 - Ensure Content trust for Docker is Enabled | + | |
| - | [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images | + | |
| - | [WARN] | + | |
| - | [WARN] | + | |
| - | [INFO] 4.7 - Ensure update instructions are not use alone in the Dockerfile | + | |
| - | [INFO] | + | |
| - | [NOTE] 4.8 - Ensure setuid and setgid permissions are removed | + | |
| - | [PASS] 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles | + | |
| - | [NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles | + | |
| - | [NOTE] 4.11 - Ensure only verified packages are installed | + | |
| - | ... | + | |
| - | </ | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====6.3 - [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images==== | + | |
| - | + | ||
| - | Quand une image est construite, il est possible d'y mettre un **HEALTHCHECK** dont le statut peut être vérifié par Docker afin de relancer le conteneur si nécessaire. | + | |
| - | + | ||
| - | Pour mettre en place un HEALTHCHECK, | + | |
| - | + | ||
| - | < | + | |
| - | HEALTHCHECK --interval=20s --timeout=3s CMD curl -f http:// | + | |
| - | </ | + | |
| - | + | ||
| - | Ce test permet de vérifier que le conteneur peut atteindre l'URL indiqué tous les 20 secondes et produit une erreur au bout de 3 secondes. | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | =====LAB #7 - Sécurisation du Container Runtime===== | + | |
| - | + | ||
| - | Exécutez de nouveau le script **docker-bench-security.sh**, | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | ... | + | |
| - | [INFO] 5 - Container Runtime | + | |
| - | [WARN] 5.1 - Ensure that, if applicable, an AppArmor Profile is enabled | + | |
| - | [WARN] | + | |
| - | [WARN] 5.2 - Ensure that, if applicable, SELinux security options are set | + | |
| - | [WARN] | + | |
| - | [PASS] 5.3 - Ensure Linux Kernel Capabilities are restricted within containers | + | |
| - | [PASS] 5.4 - Ensure that privileged containers are not used | + | |
| - | [PASS] 5.5 - Ensure sensitive host system directories are not mounted on containers | + | |
| - | [PASS] 5.6 - Ensure sshd is not run within containers | + | |
| - | [PASS] 5.7 - Ensure privileged ports are not mapped within containers | + | |
| - | [NOTE] 5.8 - Ensure that only needed ports are open on the container | + | |
| - | [PASS] 5.9 - Ensure the host's network namespace is not shared | + | |
| - | [WARN] 5.10 - Ensure that the memory usage for containers is limited | + | |
| - | [WARN] | + | |
| - | [WARN] 5.11 - Ensure CPU priority is set appropriately on the container | + | |
| - | [WARN] | + | |
| - | [WARN] 5.12 - Ensure that the container' | + | |
| - | [WARN] | + | |
| - | [PASS] 5.13 - Ensure that incoming container traffic is bound to a specific host interface | + | |
| - | [WARN] 5.14 - Ensure that the ' | + | |
| - | [WARN] | + | |
| - | [PASS] 5.15 - Ensure the host's process namespace is not shared | + | |
| - | [PASS] 5.16 - Ensure the host's IPC namespace is not shared | + | |
| - | [PASS] 5.17 - Ensure that host devices are not directly exposed to containers | + | |
| - | [INFO] 5.18 - Ensure that the default ulimit is overwritten at runtime if needed | + | |
| - | [INFO] | + | |
| - | [PASS] 5.19 - Ensure mount propagation mode is not set to shared | + | |
| - | [PASS] 5.20 - Ensure the host's UTS namespace is not shared | + | |
| - | [PASS] 5.21 - Ensure the default seccomp profile is not Disabled | + | |
| - | [NOTE] 5.22 - Ensure docker exec commands are not used with privileged option | + | |
| - | [NOTE] 5.23 - Ensure that docker exec commands are not used with the user=root option | + | |
| - | [PASS] 5.24 - Ensure that cgroup usage is confirmed | + | |
| - | [WARN] 5.25 - Ensure that the container is restricted from acquiring additional privileges | + | |
| - | [WARN] | + | |
| - | [WARN] 5.26 - Ensure that container health is checked at runtime | + | |
| - | [WARN] | + | |
| - | [INFO] 5.27 - Ensure that Docker commands always make use of the latest version of their image | + | |
| - | [WARN] 5.28 - Ensure that the PIDs cgroup limit is used | + | |
| - | [WARN] | + | |
| - | [INFO] 5.29 - Ensure that Docker' | + | |
| - | [INFO] | + | |
| - | [PASS] 5.30 - Ensure that the host's user namespaces are not shared | + | |
| - | [PASS] 5.31 - Ensure that the Docker socket is not mounted inside any containers | + | |
| - | ... | + | |
| - | </ | + | |
| - | + | ||
| - | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. | + | |
| - | + | ||
| - | ====7.1 - [WARN] 5.1 - Ensure AppArmor Profile is Enabled==== | + | |
| - | + | ||
| - | Cet avertissement est présent parce que le conteneur n' | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====7.2 - [WARN] 5.2 - Ensure SELinux security options are set, if applicable==== | + | |
| - | + | ||
| - | Cet avertissement est présent parce que le conteneur n' | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====7.3 - [WARN] 5.10 - Ensure memory usage for container is limited==== | + | |
| - | + | ||
| - | Cet avertissement est du au fait que les conteneurs ont automatiquement accès à la totalité de la RAM de l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | b04b2a6f0dd93da21a8b7640afc319406e42868a141f90936dbcf52ab5bffb0d | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O | + | |
| - | b04b2a6f0dd9 | + | |
| - | ^C | + | |
| - | </ | + | |
| - | + | ||
| - | Supprimez le conteneur et re-créez le avec une limite de mémoire : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | b04b2a6f0dd9 | + | |
| - | 5b31fe1e13bc | + | |
| - | 7788c67c3b69 | + | |
| - | root@debian9: | + | |
| - | b0 | + | |
| - | root@debian9: | + | |
| - | 095472e5096a57277230ff94822d9bd0ad479ad26a33cbf83ec381cdb02910e1 | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O | + | |
| - | 095472e5096a | + | |
| - | ^C | + | |
| - | </ | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====7.4 - [WARN] 5.11 - Ensure CPU priority is set appropriately on the container==== | + | |
| - | + | ||
| - | Cet avertissement est du au fait que les conteneurs ont automatiquement accès à tous les CPU de l' | + | |
| - | + | ||
| - | La valeur de cpu-shares est relative à la valeur par défaut de **1024**. Un valeur de 512 permet au conteneur d' | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====7.5 - [WARN] 5.12 - Ensure the container' | + | |
| - | + | ||
| - | Afin de minimiser le risque de compromettre un conteneur par la présence de code malicieux, il est conseillé de démarrer les conteneurs en lecture seule, sauf pour les volumes qui nécessitent un accès en écriture/ | + | |
| - | + | ||
| - | Créez le fichier **write_a_file** dans le conteneur **mysql** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | La Commande **docker container diff** indique les différences apportées au conteneur par rapport à l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | A / | + | |
| - | C /run | + | |
| - | C / | + | |
| - | A / | + | |
| - | A / | + | |
| - | A / | + | |
| - | A / | + | |
| - | A / | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** : Notez que la sortie indique les changements apportés au conteneur. | + | |
| - | </ | + | |
| - | + | ||
| - | Arrêtez et supprimez le conteneur : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | mysql | + | |
| - | root@debian9: | + | |
| - | mysql | + | |
| - | </ | + | |
| - | + | ||
| - | Lancez un conteneur mysql en lecture seule : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | 7788c67c3b692515f63f4659a8f40af397bfbde97485e2e40c500c16b158045b | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 7788c67c3b69 | + | |
| - | </ | + | |
| - | + | ||
| - | Créez le fichier **write_a_file** dans le conteneur **mysql** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | touch: cannot touch '/ | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** : Notez l' | + | |
| - | </ | + | |
| - | + | ||
| - | Exécutez la commande **docker container diff** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** : Notez que la commande ne retourne aucune sortie. En effet le conteneur étant en lecture seule, aucun changement ne peut intervenir. | + | |
| - | </ | + | |
| - | + | ||
| - | ====7.6 - [WARN] 5.14 - Ensure ' | + | |
| - | + | ||
| - | Cet avertissement concerne la politique de re-démarrage du conteneur. La politique **on-failure[: | + | |
| - | + | ||
| - | # docker container run -d --name mysql --read-only --restart on-failure: | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====7.7 - [WARN] 5.25 - Ensure the container is restricted from acquiring additional privileges==== | + | |
| - | + | ||
| - | Pour complémenter la configuration précédemment mise en place, il convient de lancer le conteneur en utilisant l' | + | |
| - | + | ||
| - | # docker container run -d --name mysql --read-only --restart on-failure: | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====7.8 - [WARN] 5.26 - Ensure container health is checked at runtime==== | + | |
| - | + | ||
| - | Voir l' | + | |
| - | + | ||
| - | ====7.9 - [WARN] 5.28 - Ensure PIDs cgroup limit is used==== | + | |
| - | + | ||
| - | Sans l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | L' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 05b11e44e595 | + | |
| - | ... | + | |
| - | root@debian9: | + | |
| - | 05 | + | |
| - | root@debian9: | + | |
| - | environment: | + | |
| - | environment: | + | |
| - | environment: | + | |
| - | environment: | + | |
| - | environment: | + | |
| - | environment: | + | |
| - | ^C | + | |
| - | </ | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | Supprimez maintenant tous les conteneurs déjà créées : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | 095472e5096a | + | |
| - | 5b31fe1e13bc | + | |
| - | 7788c67c3b69 | + | |
| - | root@debian9: | + | |
| - | 095 | + | |
| - | root@debian9: | + | |
| - | 5b31fe1e13bc | + | |
| - | 7788c67c3b69 | + | |
| - | 095472e5096a | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | </ | + | |
| - | + | ||
| - | Re-créez le conteneur mysql en intégrant les points vus ci-dessus : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | df54974ebc11fe357f6e8e9b0f8499aee2658af435e32a45058a1e49fcd3dc24 | + | |
| - | root@debian9: | + | |
| - | CONTAINER ID IMAGE | + | |
| - | df54974ebc11 | + | |
| - | </ | + | |
| - | + | ||
| - | Exécutez de nouveau le script **docker-bench-security.sh**, | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | ... | + | |
| - | [INFO] 5 - Container Runtime | + | |
| - | [WARN] 5.1 - Ensure that, if applicable, an AppArmor Profile is enabled | + | |
| - | [WARN] | + | |
| - | [PASS] 5.2 - Ensure that, if applicable, SELinux security options are set | + | |
| - | [PASS] 5.3 - Ensure Linux Kernel Capabilities are restricted within containers | + | |
| - | [PASS] 5.4 - Ensure that privileged containers are not used | + | |
| - | [PASS] 5.5 - Ensure sensitive host system directories are not mounted on containers | + | |
| - | [PASS] 5.6 - Ensure sshd is not run within containers | + | |
| - | [PASS] 5.7 - Ensure privileged ports are not mapped within containers | + | |
| - | [NOTE] 5.8 - Ensure that only needed ports are open on the container | + | |
| - | [PASS] 5.9 - Ensure the host's network namespace is not shared | + | |
| - | [PASS] 5.10 - Ensure that the memory usage for containers is limited | + | |
| - | [PASS] 5.11 - Ensure CPU priority is set appropriately on the container | + | |
| - | [PASS] 5.12 - Ensure that the container' | + | |
| - | [PASS] 5.13 - Ensure that incoming container traffic is bound to a specific host interface | + | |
| - | [PASS] 5.14 - Ensure that the ' | + | |
| - | [PASS] 5.15 - Ensure the host's process namespace is not shared | + | |
| - | [PASS] 5.16 - Ensure the host's IPC namespace is not shared | + | |
| - | [PASS] 5.17 - Ensure that host devices are not directly exposed to containers | + | |
| - | [INFO] 5.18 - Ensure that the default ulimit is overwritten at runtime if needed | + | |
| - | [INFO] | + | |
| - | [PASS] 5.19 - Ensure mount propagation mode is not set to shared | + | |
| - | [PASS] 5.20 - Ensure the host's UTS namespace is not shared | + | |
| - | [PASS] 5.21 - Ensure the default seccomp profile is not Disabled | + | |
| - | [NOTE] 5.22 - Ensure docker exec commands are not used with privileged option | + | |
| - | [NOTE] 5.23 - Ensure that docker exec commands are not used with the user=root option | + | |
| - | [PASS] 5.24 - Ensure that cgroup usage is confirmed | + | |
| - | [PASS] 5.25 - Ensure that the container is restricted from acquiring additional privileges | + | |
| - | [WARN] 5.26 - Ensure that container health is checked at runtime | + | |
| - | [WARN] | + | |
| - | [INFO] 5.27 - Ensure that Docker commands always make use of the latest version of their image | + | |
| - | [PASS] 5.28 - Ensure that the PIDs cgroup limit is used | + | |
| - | [INFO] 5.29 - Ensure that Docker' | + | |
| - | [INFO] | + | |
| - | [PASS] 5.30 - Ensure that the host's user namespaces are not shared | + | |
| - | [PASS] 5.31 - Ensure that the Docker socket is not mounted inside any containers | + | |
| - | ... | + | |
| - | </ | + | |
| - | + | ||
| - | =====LAB #8 - Sécurisation des Images avec Docker Content Trust===== | + | |
| - | + | ||
| - | **Docker Content Trust (DCT)** a été introduit avec Docker Engine 1.8 et Docker CS Engine 1.9.0. DCT permet la vérification de l' | + | |
| - | + | ||
| - | DCT est utilisé par le **Docker Hub Registry** mais peut aussi être mis en place dans des Registry privés, notamment grâce à la mise en place du **[[https:// | + | |
| - | + | ||
| - | DCT est basé sur l' | + | |
| - | + | ||
| - | Pour plus d' | + | |
| - | + | ||
| - | ====8.1 - DOCKER_CONTENT_TRUST==== | + | |
| - | + | ||
| - | Pour utiliser **Docker Content Trust (DCT)**, il convient de vérifier que la valeur de la variable **DOCKER_CONTENT_TRUST** est **1** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | 1 | + | |
| - | </ | + | |
| - | + | ||
| - | Dans le cas contraire, il faut fixer la valeur de la variable à 1 : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | 1 | + | |
| - | </ | + | |
| - | + | ||
| - | ====8.2 - DCT et la commande docker pull==== | + | |
| - | + | ||
| - | Afin d' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | Login with your Docker ID to push and pull images from Docker Hub. If you don't have a Docker ID, head over to https:// | + | |
| - | Username: < | + | |
| - | Password: < | + | |
| - | WARNING! Your password will be stored unencrypted in / | + | |
| - | Configure a credential helper to remove this warning. See | + | |
| - | https:// | + | |
| - | + | ||
| - | Login Succeeded | + | |
| - | </ | + | |
| - | + | ||
| - | Pour constater l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | Error: remote trust data does not exist for docker.io/ | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** : Notez l' | + | |
| - | </ | + | |
| - | + | ||
| - | Par contre, toutes les images de type **official** sont signées : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | Using default tag: latest | + | |
| - | Pull (1 of 1): centos: | + | |
| - | sha256: | + | |
| - | 729ec3a6ada3: | + | |
| - | Digest: sha256: | + | |
| - | Status: Downloaded newer image for centos@sha256: | + | |
| - | Tagging centos@sha256: | + | |
| - | docker.io/ | + | |
| - | </ | + | |
| - | + | ||
| - | Cette image est maintenant présente sur **manager.i2tch.loc** : | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | REPOSITORY | + | |
| - | ubuntu | + | |
| - | nginx | + | |
| - | alpine | + | |
| - | mysql | + | |
| - | centos | + | |
| - | </ | + | |
| - | + | ||
| - | ===L' | + | |
| - | + | ||
| - | Il est aussi possible d' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | unsigned: Pulling from i2tch/ | + | |
| - | 10d70a43a9f9: | + | |
| - | 4f4fb700ef54: | + | |
| - | 8951e3a91277: | + | |
| - | d1814ff35b8b: | + | |
| - | ff2a2bbf6141: | + | |
| - | b7205da5c3c9: | + | |
| - | 458ea241cc75: | + | |
| - | 74d1c0702786: | + | |
| - | c66f3692932d: | + | |
| - | 9224bd1b9757: | + | |
| - | Digest: sha256: | + | |
| - | Status: Downloaded newer image for i2tch/ | + | |
| - | docker.io/ | + | |
| - | + | ||
| - | root@debian9: | + | |
| - | REPOSITORY | + | |
| - | ubuntu | + | |
| - | nginx | + | |
| - | alpine | + | |
| - | mysql | + | |
| - | centos | + | |
| - | i2tch/ | + | |
| - | + | ||
| - | root@debian9: | + | |
| - | Untagged: i2tch/ | + | |
| - | Untagged: i2tch/ | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | Deleted: sha256: | + | |
| - | </ | + | |
| - | + | ||
| - | ====8.3 - DCT et la commande docker push==== | + | |
| - | + | ||
| - | Pour envoyer l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | </ | + | |
| - | + | ||
| - | L' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | REPOSITORY | + | |
| - | ubuntu | + | |
| - | nginx latest | + | |
| - | < | + | |
| - | alpine | + | |
| - | mysql latest | + | |
| - | centos | + | |
| - | </ | + | |
| - | + | ||
| - | Lors du push vers le registry privé, il faut créer des passphrases pour **deux** clefs : | + | |
| - | + | ||
| - | * la **root** key aussi connue sous le nom **offline** key (ID 192fc7e), qui est uniquement demandée la **première** fois après la mise en place de DCT lors de la création d'un **repositry**, | + | |
| - | * la **repository** key aussi connue sous le nom **tagging** key (ID 168c754), utilisée pour signer l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | The push refers to repository [docker.io/< | + | |
| - | 77cae8ab23bf: | + | |
| - | alpine: digest: sha256: | + | |
| - | Signing and pushing trust metadata | + | |
| - | You are about to create a new root signing key passphrase. This passphrase | + | |
| - | will be used to protect the most sensitive key in your signing system. Please | + | |
| - | choose a long, complex passphrase and be careful to keep the password and the | + | |
| - | key file itself secure and backed up. It is highly recommended that you use a | + | |
| - | password manager to generate the passphrase and keep it safe. There will be no | + | |
| - | way to recover this key. You can find the key in your config directory. | + | |
| - | Enter passphrase for new root key with ID 192fc7e: fenestros | + | |
| - | Repeat passphrase for new root key with ID 192fc7e: fenestros | + | |
| - | Enter passphrase for new repository key with ID 168c754: fenestros | + | |
| - | Repeat passphrase for new repository key with ID 168c754: fenestros | + | |
| - | Finished initializing " | + | |
| - | Successfully signed docker.io/< | + | |
| - | </ | + | |
| - | + | ||
| - | Les clefs sont stockées dans le répertoire **~/ | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | total 8 | + | |
| - | drwx------ 2 root root 4096 nov. 10 14:49 private | + | |
| - | drwx------ 3 root root 4096 nov. 8 13:48 tuf | + | |
| - | + | ||
| - | root@debian9: | + | |
| - | total 8 | + | |
| - | -rw------- 1 root root 447 nov. 10 14:49 168c754ea8f36ce7fbcbe2299b6d91fc0f4d594c9ed9b86916687b618d8438ac.key | + | |
| - | -rw------- 1 root root 416 nov. 10 14:49 192fc7ed9543ad4bceec58886ab1d605b7433c35f7462d7343d0780d8fddf1db.key | + | |
| - | root@debian9: | + | |
| - | -----BEGIN ENCRYPTED PRIVATE KEY----- | + | |
| - | gun: docker.io/ | + | |
| - | role: targets | + | |
| - | + | ||
| - | MIHuMEkGCSqGSIb3DQEFDTA8MBsGCSqGSIb3DQEFDDAOBAhm7HwR0y8FFAICCAAw | + | |
| - | HQYJYIZIAWUDBAEqBBC729tU73wKHFQSbmZ1EVZaBIGgmGiFSs4lM5tElSGukl1B | + | |
| - | HrELT9aFooFgW7oSXNLM8aFfF/ | + | |
| - | 3m40g3MywHilW4rUcjoHVTTUXABGXUQ3f7h+nI15CXcZ11qRLyWbf2uywE9yYH9O | + | |
| - | M7GLUcE+pTENJKfZAhRGBEL+LgXNfGI1aAVqaEbBDcDnKKf4Uj1Xu4oLJ7je8+nT | + | |
| - | dg== | + | |
| - | -----END ENCRYPTED PRIVATE KEY----- | + | |
| - | + | ||
| - | root@debian9: | + | |
| - | -----BEGIN ENCRYPTED PRIVATE KEY----- | + | |
| - | role: root | + | |
| - | + | ||
| - | MIHuMEkGCSqGSIb3DQEFDTA8MBsGCSqGSIb3DQEFDDAOBAiAtCzEar3AhgICCAAw | + | |
| - | HQYJYIZIAWUDBAEqBBAO7hHWVoqOo6xcETQQDXRdBIGgPUoLzTz07Ajx8K3D8+Vv | + | |
| - | 2NUiflMYhH/ | + | |
| - | V2BwSlXp7t1Cnqp/ | + | |
| - | KREO8uEq3v7HcSBBqFm0+TU+92d7hVuDApPaj0lZYP+3f7H6AjUOqu6hUoK8Ck/ | + | |
| - | Ig== | + | |
| - | -----END ENCRYPTED PRIVATE KEY----- | + | |
| - | </ | + | |
| - | + | ||
| - | ====8.4 - DCT et la commande docker build==== | + | |
| - | + | ||
| - | L' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | FROM docker/ | + | |
| - | RUN echo | + | |
| - | </ | + | |
| - | + | ||
| - | Lors du build de l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | Sending build context to Docker daemon | + | |
| - | + | ||
| - | error during connect: Post http:// | + | |
| - | </ | + | |
| - | + | ||
| - | L' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | Sending build context to Docker daemon | + | |
| - | Step 1/2 : FROM docker/ | + | |
| - | latest: Pulling from docker/ | + | |
| - | Image docker.io/ | + | |
| - | aac0c133338d: | + | |
| - | a3ed95caeb02: | + | |
| - | Digest: sha256: | + | |
| - | Status: Downloaded newer image for docker/ | + | |
| - | | + | |
| - | Step 2/2 : RUN echo | + | |
| - | | + | |
| - | + | ||
| - | Removing intermediate container 694e79d3cd88 | + | |
| - | | + | |
| - | Successfully built 686e85ee76b8 | + | |
| - | Successfully tagged < | + | |
| - | </ | + | |
| - | + | ||
| - | Lors du push de l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | The push refers to repository [docker.io/< | + | |
| - | 5f70bf18a086: | + | |
| - | c22f7bc058a9: | + | |
| - | nottrusted: digest: sha256: | + | |
| - | Signing and pushing trust metadata | + | |
| - | Enter passphrase for repository key with ID 168c754: fenestros | + | |
| - | Successfully signed docker.io/< | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** : Notez l' | + | |
| - | </ | + | |
| - | + | ||
| - | ===Créer un deuxième Repositry=== | + | |
| - | + | ||
| - | Par contre en modifiant le tag de l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | root@debian9: | + | |
| - | REPOSITORY | + | |
| - | < | + | |
| - | < | + | |
| - | ubuntu | + | |
| - | nginx latest | + | |
| - | < | + | |
| - | alpine | + | |
| - | mysql latest | + | |
| - | centos | + | |
| - | docker/ | + | |
| - | + | ||
| - | root@debian9: | + | |
| - | The push refers to repository [docker.io/< | + | |
| - | 5f70bf18a086: | + | |
| - | c22f7bc058a9: | + | |
| - | latest: digest: sha256: | + | |
| - | Signing and pushing trust metadata | + | |
| - | Enter passphrase for root key with ID 192fc7e: fenestros | + | |
| - | Enter passphrase for new repository key with ID 7b13d02: fenestros | + | |
| - | Repeat passphrase for new repository key with ID 7b13d02: fenestros | + | |
| - | Finished initializing " | + | |
| - | Successfully signed docker.io/< | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** : Notez la création d'une deuxième repositry key (ID 7b13d02 au lieu de ID 168c754) lors du push de l' | + | |
| - | </ | + | |
| - | + | ||
| - | La présence de cette deuxième repositry key (**7b13d02d74264624fb201e7ae13ae694286b9f761aa86adddefd0408c7234a58.key**) peut être constatée dans le répertoire **~/ | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | total 12 | + | |
| - | -rw------- 1 root root 447 nov. 10 14:49 168c754ea8f36ce7fbcbe2299b6d91fc0f4d594c9ed9b86916687b618d8438ac.key | + | |
| - | -rw------- 1 root root 416 nov. 10 14:49 192fc7ed9543ad4bceec58886ab1d605b7433c35f7462d7343d0780d8fddf1db.key | + | |
| - | -rw------- 1 root root 451 nov. 10 17:37 7b13d02d74264624fb201e7ae13ae694286b9f761aa86adddefd0408c7234a58.key | + | |
| - | </ | + | |
| - | + | ||
| - | En inspectant les clefs des images créées, l' | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | [ | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | "Repo Admin" | + | |
| - | ] | + | |
| - | } | + | |
| - | ], | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| - | root@debian9: | + | |
| - | [ | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | "Repo Admin" | + | |
| - | ] | + | |
| - | } | + | |
| - | ], | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** : Notez que les clefs utilisées sont les mêmes pour les deux images. | + | |
| - | </ | + | |
| - | + | ||
| - | < | + | |
| - | root@debian9: | + | |
| - | [ | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | "Repo Admin" | + | |
| - | ] | + | |
| - | } | + | |
| - | ], | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 60%> | + | |
| - | **Important** : Notez que les clefs utilisées sont différentes. | + | |
| - | </ | + | |
| - | + | ||
| - | ===Supprimer une Signature=== | + | |
| - | + | ||
| - | Dernièrement il est possible de supprimer la signature d'une image avec la commande **docker trust revoke** : | + | |
| - | < | + | =====Évaluation de la Formation===== |
| - | root@debian9: | + | |
| - | Enter passphrase for repository key with ID 168c754: | + | |
| - | Successfully deleted signature for < | + | |
| - | root@debian9: | + | |
| - | [ | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | }, | + | |
| - | { | + | |
| - | " | + | |
| - | " | + | |
| - | { | + | |
| - | " | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| - | } | + | |
| - | ] | + | |
| - | </ | + | |
| + | Afin de valider votre formation, veuillez compléter l’Évaluation de la Formation ainsi que la Validation des Acquis. | ||
| ----- | ----- | ||
| - | Copyright © 2025 Hugh NORRIS | + | Copyright © 2025 Hugh Norris - Document non-contractuel. Le programme peut être modifié sans préavis. |
