blog [AdminSysGNULinux]

blog

Table des matières

4 billet(s) pour juillet 2026

2026:
- janvier
- février
- mars
- avril
- mai
- juin
- juillet

2025:
- mars
- avril
- mai
- juin
- juillet
- août
- septembre
- octobre
- novembre
- décembre

4 billet(s) pour juillet 2026

Procédure simple augmentation de la SWAP	2026/07/17 15:49	Jean-Baptiste
Exemple git clone avec Ansible	2026/07/16 14:47	Jean-Baptiste
Windows exe - Comparaison de fichiers binaires	2026/07/16 10:25	Jean-Baptiste
Pb git	2026/07/01 17:36	Jean-Baptiste

Notes sécurité OS GNU/Linux hardening

Voir :

Voir aussi :

CIS (Center for Internet Security)
https://www.cisa.gov/
https://www.cert.ssi.gouv.fr

Vulnérabilités connues

apt-get install debsecan
debsecan

Mise à jour automatique

apt-get install unattended-upgrades

Scan intégrité fichiers

Find

Recherche de fichier SUID (4000) et SGID (2000)

find / -type f \( -perm -4000 -o -perm -2000 \)         \
        -not \(                                         \
        -wholename "/proc/*"                            \
        -o -wholename "/var/lib/docker/aufs/*"          \
        -o -wholename /usr/bin/chage                    \
        -o -wholename /usr/bin/newgrp                   \
        -o -wholename /usr/bin/passwd                   \
        -o -wholename /usr/bin/gpasswd                  \
        -o -wholename /usr/bin/expiry                   \
        -o -wholename /bin/su                           \
        -o -wholename /bin/mount                        \
        -o -wholename /bin/ping6                        \
        -o -wholename /bin/ping                         \
        -o -wholename /bin/umount                       \
        -o -wholename /sbin/unix_chkpwd                 \
        -o -wholename /usr/bin/pumount                  \
        -o -wholename /usr/bin/pmount                   \
        -o -wholename /usr/bin/sudo                     \
        -o -wholename /usr/bin/crontab                  \
        -o -wholename /usr/bin/mlocate                  \
        -o -wholename /sbin/mount.cifs                  \
        -o -wholename /bin/fusermount                   \
        -o -wholename /bin/ntfs-3g                      \
        -o -wholename /usr/lib/dbus-1.0/dbus-daemon-launch-helper \
        -o -wholename /usr/bin/at                       \
        -o -wholename /usr/lib/eject/dmcrypt-get-device \
        -o -wholename /usr/lib/utempter/utempter        \
        \)
 
        #-o -wholename /usr/bin/wall                    \
        #-o -wholename /usr/bin/chsh                    \
        #-o -wholename /usr/bin/ssh-agent               \
        #-o -wholename /usr/lib/openssh/ssh-keysign     \
        #-o -wholename /usr/bin/bsd-write               \
        #-o -wholename /usr/bin/udevil                  \
        #-o -wholename /usr/bin/chfn                    \
        #-o -wholename /usr/bin/dotlockfile             \
        #-o -wholename /usr/sbin/exim4                  \
        #-o -wholename /usr/bin/beep                    \

Supression du bit SUID

chmod u-s /usr/bin/chsh
chmod u-s /usr/bin/chfn
chmod u-s /usr/lib/openssh/ssh-keysign
chmod u-s /usr/sbin/exim4

Supression du bit SGID

chmod g-s /usr/bin/dotlockfile
chmod g-s /usr/bin/ssh-agent
chmod g-s /usr/bin/wall

Worldreadable

find / \( -type d -o -type f \)  -not \( -wholename "/proc/*" -o -wholename "/dev/*" -o -wholename "/var/lib/docker/aufs/*" \) -perm /o=w -not -perm /o=t -ls

Comptes

perl -a -F':' -ne '$HOMEUSER=$F[5] ; $CHAINE="$HOMEUSER/.ssh/authorized_keys\n" ; $CHAINE=~s|//|/| ; print $CHAINE unless /false$/ or /nologin$/' /etc/passwd

sysctl

Voir https://www.it-connect.fr/details-durcissement-sysctl-systeme-linux/

Interdire strace

echo 3 > /proc/sys/kernel/yama/ptrace_scope

Mot de passe

Lenteur à la connexion

man 3 crypt

/etc/shadow

plop1:$6$rounds=656000$P7gp1PPaN9bdjMt/$M2xJFWCpmlTS8CkYCHOnjI1TqfhIabgkJhp4HNvHHsI3NkXYJ2vZ.OVSNpOtee3sXJQcCdcZhezlQfrHZm3fE1:18369:0:99999:7::: 

plop1:$6$LCJMGXiumcpyY7nP$8t/u6oewRH.GHk94QKmN/1pZyMFCIwG4Y/JzUF/qKSVU9/U.BhG1Vm6fpYIuUaZuIJq5b6omuGJVpD9XxFisM.:18369:0:99999:7:::

https://askubuntu.com/questions/894404/how-to-increase-the-number-of-hashing-rounds-for-etc-shadow

/etc/pam.d/common-password

#password       [success=1 default=ignore]      pam_unix.so obscure sha512
password        [success=1 default=ignore]      pam_unix.so obscure sha512 rounds=656000

Voir SHA_CRYPT_MIN_ROUNDS

man pam_unix
 
sudo chpasswd -s 10000 000 -c SHA512 <<< username:password; history -c

/etc/pam.d/common-password

password        [success=1 default=ignore]      pam_unix.so obscure sha512 rounds=656000

auth required pam_tally2.so onerr=fail deny=3 unlock_time=900 root_unlock_time=900 file=/var/log/tallylog

pam_tally2 --file /var/log/tallylog --reset --user root

pam_faildelay.so
faillock --user aaronkilik --reset 
faillock --user aaronkilik
fail --reset	#clears all authentication failure records

chown root:root /boot/grub2/grub.cfg
chmod og-rwx /boot/grub2/grub.cfg

Set the following restrict parameters in /etc/ntp.conf or use /etc/systemd/timesyncd.conf (for Debian) /etc/ntp.conf

restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

Set the following restrict parameters in /etc/ntp.conf /etc/ntp.conf

restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

/etc/ntp.conf

Also, make sure /etc/ntp.conf has an NTP server specified
server <ntp-server>

Set the net.ipv4.ip_forward parameter to 0 in /etc/sysctl.conf Modify active kernel parameters to match:

/sbin/sysctl -w net.ipv4.ip_forward=0
/sbin/sysctl -w net.ipv4.route.flush=1

chown root:root /etc/cron.d
chmod og-rwx /etc/cron.d

rm /etc/at.deny
touch /etc/at.allow
chown root:root /etc/at.allow
chmod og-rwx /etc/at.allow

Edit the /etc/bashrc and /etc/profile.d/cis.sh files (and the appropriate files for any other shell supported on your system) and add the or use PAM following the UMASK parameter as shown

umask 027

Pas de version dans les fichiers suivants

/etc/motd
/etc/issue
/etc/issue.net

Service SystemD

/lib/systemd/system/wsl-pro.service

[Unit]
Description=Bridge to Ubuntu Pro agent on Windows
ConditionVirtualization=wsl
 
[Service]
Type=notify
ExecStart=/usr/libexec/wsl-pro-service -vv
Restart=always
RestartSec=2s
 
# Some daemon restrictions
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=true
PrivateDevices=yes
PrivateMounts=yes
PrivateTmp=yes
ProtectClock=yes
ProtectControlGroups=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
 
# Only permit system calls used by common system services, excluding any special purpose calls
SystemCallFilter=@system-service
 
[Install]
WantedBy=multi-user.target

Autre

apt-get install auditd

Partition dédiée pour

/var/log
/var/log/audit/

2025/03/24 15:06

brouillon, securite, debian

Notes sécurité OS GNU/Linux hardening - partitions - noexec

Voir aussi :

FS noexec - Sécurité Montage Système de fichier

nodev,nosuid,noexec,ro

echo "/var/tmp /tmp    none bind 0 0" >> /etc/fstab

/etc/apt/apt.conf.d/01PrePost

DPkg {
        Pre-Invoke  { "mount /var -o remount,exec"; "mount /tmp -o remount,exec"; "mount /var/tmp -o remount,exec" };
        Post-Invoke { "mount /var -o remount,noexec"; "mount /tmp -o remount,noexec"; "mount /var/tmp -o remount,noexec"  };
};

Pour des raisons de sécurité, il est recommandé de monter /tmp en noexec cependant Debian à besoin des droits exec lors de mise-à-jour. Voici une solution :

/etc/apt/apt.conf.d/70debconf

DPkg::Pre-Install-Pkgs {"mount -o remount,exec /tmp; /usr/sbin/dpkg-preconfigure --apt || true";};
DPkg::Post-Invoke {"mount -o remount /tmp";};

Pour plus de sécurité, on pourra monter certaines partitions avec des options particulières :

Partition	Options de montage
/	noatime,ro
/boot	noatime,nodev,nosuid,noexec,ro
/tmp	noatime,nodev,nosuid,noexec
/usr	noatime,nodev,ro
/var	noatime,nodev,nosuid,noexec
/home	noatime,nodev,nosuid noexec,usrquota,grpquota

Noatime : Pour toutes les partitions. Voir debian_noatime Nodev : Pour toutes les partitions sauf /dev Nosuid : Pour toutes les partitions sauf / et /usr Noexec : Pour /tmp et /run/shm (pour /run/shm c'est normalement le cas par défaut). Si possible aussi pour /var ro : / et /usr

# Dev
find / \( -type b -o -type c \) -not -wholename "/dev/*"
# Suid
find / -type f -perm /a+s
# Partition /run/shm ou /dev/shm. Doit-être en nosuid,nodev,noexec
mount | grep shm

A tester

/lib64/ld-linux-x86-64.so.2 /bin/echo "Plop"

2025/03/24 15:06

brouillon, securite, debian, fs

Notes seafile avec Nginx sous Debian

Voir aussi :

rclone
directive sendfile_max_chunk pour Nginx

Votre navigateur doit envoyer le “Referer” HTTP. Si besoin utiliser pour Firefox RefControl

Liens :

adduser --group --system --disabled-password seafile

apt-get install python-setuptools python-imaging

/etc/nginx/sites-available/seafile.acme.fr

server {
        listen 80;
        server_name seafile.acme.fr;
        rewrite ^ https://$server_name$request_uri? permanent;
}
 
server {
        listen 443 ssl;
        server_name seafile.acme.fr;
        ssl_certificate /etc/ssl/private/acme.crt+chain;
        ssl_certificate_key /etc/ssl/private/acme.fr.key;
 
        access_log /var/log/nginx/access_seafile_log;
        error_log /var/log/nginx/error_seafile_log;
 
        proxy_set_header X-Forwarded-For $remote_addr;
 
        location / {
                proxy_bind http://127.0.0.1:8080 ;
#                fastcgi_pass    127.0.0.1:8000;
#                fastcgi_param   HTTPS               on;
#                fastcgi_param   HTTP_SCHEME         https;
#                fastcgi_param   SCRIPT_FILENAME     $document_root$fastcgi_script_name;
#                fastcgi_param   PATH_INFO           $fastcgi_script_name;
#                fastcgi_param   SERVER_PROTOCOL     $server_protocol;
#                fastcgi_param   QUERY_STRING        $query_string;
#                fastcgi_param   REQUEST_METHOD      $request_method;
#                fastcgi_param   CONTENT_TYPE        $content_type;
#                fastcgi_param   CONTENT_LENGTH      $content_length;
#                fastcgi_param   SERVER_ADDR         $server_addr;
#                fastcgi_param   SERVER_PORT         $server_port;
#                fastcgi_param   SERVER_NAME         $server_name;
#                fastcgi_param   REMOTE_ADDR         $remote_addr;
        }
 
        location /seafhttp {
                rewrite ^/seafhttp(.*)$ $1 break;
                proxy_pass http://127.0.0.1:8082;
                #include         /etc/nginx/proxy_params;
                client_max_body_size 0;
                proxy_request_buffering off;
                proxy_connect_timeout  36000s;
                proxy_read_timeout  36000s;
                proxy_send_timeout  36000s;
        }
 
        location /media {
                root /var/www/seafile/seafile-server-latest/seahub ;
        }
}

Derrière un reverse proxy Nginx

On NGINX Reverse-proxy Server

/etc/nginx/sites-available/files2.acme.fr

server {
        listen 80;
        server_name files2.acme.fr www.files2.acme.fr;
        rewrite ^ https://$server_name$request_uri? permanent;
}
 
server {
        listen 443 ssl;
        server_name files2.acme.fr www.files2.acme.fr;
 
        ssl_certificate /etc/nginx/ssl/nginx.crt;
        ssl_certificate_key /etc/nginx/ssl/nginx.key;
        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
 
        server_tokens off;
        proxy_set_header X-Forwarded-For $remote_addr;
 
        access_log /var/log/nginx/access_seafile_log;
        error_log /var/log/nginx/error_seafile_log;
 
        client_max_body_size 0;
        #client_body_buffer_size 128k;
 
        location /seafhttp {
                rewrite ^/seafhttp(.*)$ $1 break;
                proxy_pass http://192.168.15.149:8082;
                client_max_body_size 0;
                #proxy_request_buffering off;
                proxy_connect_timeout  36000s;
                proxy_read_timeout  36000s;
                proxy_send_timeout  36000s;
 
        }
 
 
        location / {
                proxy_pass http://192.168.15.149:8000;
#                fastcgi_pass    192.168.15.149:8000;
#                fastcgi_param   HTTPS               on;
#                fastcgi_param   HTTP_SCHEME         https;
#                fastcgi_param   SCRIPT_FILENAME     $document_root$fastcgi_script_name;
#                fastcgi_param   PATH_INFO           $fastcgi_script_name;
#                fastcgi_param   SERVER_PROTOCOL    $server_protocol;
#                fastcgi_param   QUERY_STRING        $query_string;
#                fastcgi_param   REQUEST_METHOD      $request_method;
#                fastcgi_param   CONTENT_TYPE        $content_type;
#                fastcgi_param   CONTENT_LENGTH      $content_length;
#                fastcgi_param   SERVER_ADDR        $server_addr;
#                fastcgi_param   SERVER_PORT        $server_port;
#                fastcgi_param   SERVER_NAME        $server_name;
#                fastcgi_param   REMOTE_ADDR         $remote_addr;
        }
 
        location /media {
                #root /var/www/html/seafile-server-latest/seahub/ ;
                proxy_pass http://192.168.15.149:8081;
                include /etc/nginx/proxy_params;
        }
 
}

On FILE Server

/etc/nginx/sites-enabled/file2.acme.fr

server {
        listen 8081;
 
        access_log /var/log/nginx/access_seafile_log;
        error_log /var/log/nginx/error_seafile_log;
 
        server_tokens off;
 
        location /media {
                root /var/www/html/seafile-server-latest/seahub/ ;
        }
}

conf/seafile.conf

[fileserver]
port=8082
host=0.0.0.0

conf/ccnet.conf

SERVICE_URL = https://files2.acme.fr

conf/seahub_settings.py

FILE_SERVER_ROOT = 'https://files2.acme.fr/seafhttp'

su - www-data -s /bin/bash
./seafile.sh start
export SEAFILE_FASTCGI_HOST='0.0.0.0'
./seahub.sh start-fastcgi

ln -s seafile-server-5.1.1 seafile-server-latest
cd seafile-server-latest
./setup-seafile.sh

~/conf/ccnet.conf

[General]
SERVICE_URL = https://seafile.acme.fr

~/conf/seafile.conf

[fileserver]
port=8083

~/conf/seahub_settings.py

FILE_SERVER_ROOT = 'https://seafile.acme.fr/seafhttp'
 
EMAIL_USE_TLS = False
EMAIL_HOST = 'localhost'
#EMAIL_HOST_USER = 'root@acme.fr'    # username and domain
#EMAIL_HOST_PASSWORD = 'password'    # password
EMAIL_PORT = 25
#DEFAULT_FROM_EMAIL = EMAIL_HOST_USER
DEFAULT_FROM_EMAIL = 'contact@acme.fr'
#SERVER_EMAIL = EMAIL_HOST_USER
SERVER_EMAIL = 'contact@acme.fr'

./seafile.sh start
./seahub.sh start-fastcgi 8003

Clients

Liens :

2025/03/24 15:06

brouillon, web, partage, stockage, python

Notes install Seafile Apache RedHat7 Memcached MySQL/MariaDB

Install Seafile avec MySQL / MariaDB

MySQL doit être démarré

Voir :

yum install python-distribute python-imaging MySQL-python python-memcached python-ldap
 
#adduser --system seafile --shell /sbin/nologin -m
adduser --group --system --disabled-password seafile
su - seafile -s /bin/bash
 
mkdir foo1
cd foo1
wget https://bintray.com/artifact/download/seafile-org/seafile/seafile-server_5.1.2_x86-64.tar.gz
tar xvf ../seafile-server_5.1.2_x86-64.tar.gz
 
Seafile avec MySQL Voir http://manual.seafile.com/deploy/using_mysql.html
 
./setup-seafile-mysql.sh

La 1er fois lancer

./seafile.sh start

Puis (c'est à cette étape que compte admin sera crée) ./seahub.sh start <port> Site Web. Port par défaut : TCP 8000

./seahub.sh start

Arrêt

./seahub.sh stop
./seafile.sh stop

Install de memcached

Voir http://manual.seafile.com/deploy/add_memcached.html

yum install memcached
systemctl enable memcached
systemctl start memcached

seahub_settings.py

CACHES = {
    'default': {
        'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
        'LOCATION': '127.0.0.1:11211',
    }
}

Conf Apache

Voir http://manual.seafile.com/deploy/deploy_with_apache.html

/etc/httpd/conf.d/sea-foo1.conf

<VirtualHost *:80>
    ServerName www.myseafile.com
    # Use "DocumentRoot /var/www/html" for Centos/Fedora
    # Use "DocumentRoot /var/www" for Ubuntu/Debian
    DocumentRoot /var/www/html
    Alias /media  /home/seafile/foo1/seafile-server-latest/seahub/media
 
    RewriteEngine On
 
    <Location /media>
        Require all granted
    </Location>
 
    #
    # seafile fileserver
    #
    ProxyPass /seafhttp http://127.0.0.1:8082 # retry=0
    ProxyPassReverse /seafhttp http://127.0.0.1:8082
    RewriteRule ^/seafhttp - [QSA,L]
 
    # WebDAV
    # We use http proxy, since SeafDAV is incompatible with FCGI proxy in Apache 2.4.
    #
    ProxyPass /seafdav http://127.0.0.1:8080/seafdav # retry=0
    ProxyPassReverse /seafdav http://127.0.0.1:8080/seafdav
 
    #
    # seahub
    #
    SetEnvIf Request_URI . proxy-fcgi-pathinfo=unescape
    SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
    ProxyPass / fcgi://127.0.0.1:8000/ # retry=0
</VirtualHost>

./seafile.sh start
./seahub.sh start-fastcgi

Conf Webdav (Lecteur réseau)

http://manual.seafile.com/extension/webdav.html

Voir conf Apache au dessus

conf/seafdav.conf

[WEBDAV]
enabled = true
port = 8080
fastcgi = false
share_name = /seafdav

2025/03/24 15:06

brouillon, web, partage, stockage, python

Notes script bash

Voir

Voir aussi :

tinyramfs (implémentation initramfs écrite en shell POSIX

Variables

Fichier dans une variable - variable heredoc

ETCHOSTS=$(cat << 'EOF'
10.245.97.221      node1
10.245.102.221     node1b
EOF
)

Les boucles

Voir aussi :

Les commandes Xargs et Find qui peuvent être des alternatives aux boucles

For

for (( i=1; $i<=10; i=i+1 ))
do
    echo $i
done

Voir exemple avec seq ci-dessous

seq

#for i in $(seq 10)
for i in $(seq 1 10)
do
  echo $i
done

for i in {1..5}
do
  echo $i
done

seq -f "%f" 3 0.8. 6

seq -f "%g/04/2018" 10

seq -s - 8

pb curl break

fic.lst

foo
bar

plop_sleep.sh

#! /bin/bash
 
while read -r var
do
        echo $var
        timeout 1 sleep inf
done < fic.lst

plop_curl.sh

#! /bin/bash
 
while read -r var
do
        echo $var
        timeout 1 curl -s telnet://localhost:22
done < fic.lst

$ ./plop_sleep.sh
foo
bar

$ ./plop_curl.sh
foo

Contournement

plop_curl_2.sh

#! /bin/bash
 
while read -r var
do
        echo $var
        echo timeout 1 curl -s telnet://localhost:22 | bash -s --
done < fic.lst

Vraie solution

plop_curl_2.sh

#! /bin/bash
 
while read -r var
do
        echo $var
        timeout 1 curl -s telnet://localhost:22 </dev/null
done < fic.lst

Gérer les locks

flock -n /tmp/plop.lock -c /opt/plop1.sh -c /opt/plop2.sh

bash Options

Bash suid binary privilege escalation

sudo cp -p /usr/bin/bash /usr/bin/bash-backdoor
sudo chmod u+s /usr/bin/bash-backdoor
/usr/bin/bash-backdoor -p

2025/03/24 15:06

<< Billets récents | Anciens billets >>

blog.txt · Dernière modification : 2025/03/24 15:06 de 127.0.0.1