# Config de base sécurité Firewalld-SELinux-SSH-Fail2ban + scripting mises à jour de sécurité automatisées sur serveurs Linux ###### tags: `Sécurité` `ssh` `Fail2ban` `SELinux` `RHEL` <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Mise à l’heure locale, à adapter à la structure :</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:516px;height:32px;">![](https://lh6.googleusercontent.com/sP1PGOR8R0BIY7xmBSohuXMToEgQiwO2aH4DLtW6AhDmlwSgLy3cD-MoebT5NO3wswQq2VtXkaJSBMsxtYrWt3UlDVKWsCNWA72o2IAtiY8sLBqL7Uwixu138pW7IQ)</span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Contrôle:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:472px;height:118px;">![](https://lh3.googleusercontent.com/trBSEMaDDMaPHPu3dAxykaXI6jb2SY9a41ZVyGs7SuNYPR_15H1yq-dwmuxXqEY4hkPgxwS2h4G326oLvS9IXEsCw-5YLkEFZav6zistQvx_TcNgQZMtfmnqb60T6w)</span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> ## Firewalld <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Nous allons changer le port d’écoute pour le SSH, en autorisant le port que nous allons configurer sur le firewall. Pour se préserver de la casse, nous copions le fichier de configuration du firewall pour le ssh :</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:605px;height:17px;">![](https://lh3.googleusercontent.com/uHZdtRndvTBrWiG6R6jTsKPN3G6VA7dsuz50vAfpqTXZd1XfMdzqZNuZnB8J8dq3IwLGhIdwu6poTdU6y0pgUtPlyUWbDsFerPiiaHC53rptWYdtFk8X8Y-saSqxFQ)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Puis nous modifions le fichier copié:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:605px;height:20px;">![](https://lh4.googleusercontent.com/bF9iqMiUs1yoIVPmaWrv6vDQtH2hO_3SpHwe9jJFRz1LNZ-ANp0ftX0jwjJko9G_x0Ny46GYaJCfeurV0vpUQKjDGjCYltts8630Ry0m1k3arzQPEeqOymAtVnnTbg)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Et nous remplaçons le port standard 22 par un autre port:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:605px;height:145px;">![](https://lh6.googleusercontent.com/wGeCo-v_z8QbNWc7xBnRVg1X7v2GY4nq1phnC-djqLXngklJfgGM_V3Lndpw2IMaZoVXtOkMIHCkuTveZw9yOQjWTI7Pn9hTSZggdfNPrFoITzdII80gnBghgmzqGg)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Puis nous rechargeons le service firewall:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:466px;height:38px;">![](https://lh4.googleusercontent.com/E2b_WCXu-hmTeUROll7mzOAZCe6MmNeSP9hIFWXwdLMvJB__KpNnn35umAaGGFmUNumKWmVUnIZX9C5ARHz8g8HUDSr-5xydWCA7_4gdqOXhXyXS9KU1yxCjitcswQ)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">On autorise également le port 7557 dans SELinux:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:543px;height:24px;">![](https://lh4.googleusercontent.com/5W4KsP6UcPrDpqXYUc6luFSQ02gQRYtq7aGbumbO0yE97mWuG9_oYqR0NHcN01Nq1nXYONqe50b1qxSU1TzGl3tUsOAeSwPNVcfRWO40W0t7AbXXyQXNWmyoZkzIOw)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Puis nous contrôlons que cela est bien pris en compte :</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:432px;height:36px;">![](https://lh6.googleusercontent.com/OpuW3X_iJVG4ldR_93N6djGv9MLR6iLstvozixBs6Z_tKbzezJGXYZbT-_8yEED7-HTVrfG5YBZsQoW6m5BFT6bjhIAkmI19fy2EpkkKqt627eYNM7TXoLIdQt-jNg)</span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Nous voyons que le port 7557 a l’étiquette nécessaire pour être fonctionnel en SSH</span> </span></span> </span></span> ## SSH <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Si l'install de Linux a été faite sans serveur SSH, installer openssh-server, et l'activer (systemctl start ssh et enable)</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">![](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAANcAAAATCAYAAAADBJgXAAACoklEQVRoge2b2ZXDIAxFqUetqBIVokJUB8VpPrywxEY4xoeJjz7uT8jITw/EEjwhhKAjQY4a44Yowdj4jvNDTBfgOG9lugDHeSvTBTjOW5kuwHHeynQBjvNWpgtwnLcyXcAhyFGFYLqOD5D3q4ZDfVb7iwESjTEq43wt/4TxQUlYcX5ij+oDkmbxWO1vBUi8uBLVB0jKki6BmXBvI1kvholVtoti4XRRDJQ+z7hkdmPm32ZG4fL5ZaGAEkuKwaIi1K+vkX+t5ZniqvQL7fmZ/oegATDTH1WYFEb519EOJMpEjfgX86+f38gvhPQSgxAobj6tGvIXHISgGGtxHyPfx7eLK4AClMHywUeyPhAyM6rgT64MQLIkA5u+8nvL32EaUMjJuC597fyfLi4SOSiW1MGW/8RcDIYAqMzl4L/jX097jOfx+/r9PL6VXwhhLRpRYVx8Atz9+ugXZBXGYfHbxQVUVq7UxfX5SlO9FXi6uMqVhqvvVTNPNpC69Bn5P1pcQEVHbyAnz5v+n6zMMaZ87/vXbm/HR2VDXzN+R37HOeWAsnA2WYm587oW/7S4UDmKEpYz2W8VVz5YQYGurFx2/v+6uMKyylm+3vWv1X4pvulHHd/Or+eZu8Zq1RoVP6PqXOG0hK7nj+vbwjQAgFglVkttB98WF4ko58XxYWBDX0f+lr7e9jPubguXbdjxOXGEf1b73eKy4lv59T1z8fRoohoT/6i4Qjr0boc5JCnebicRJcyW7oNtF2B1YO5+M769bci1bTNP/eMHCStnB+Kr+tr5W9uanm2PxfkPGn3+g2KR/3o2GORfq70nvl1cVv+d53fm/9nkGA92CaPiHxZXz8zi/0YyD/f/p7jSsVnF9uxNnaG4/z/HdAGO81amC3CcV/IH2nmHkequVJMAAAAASUVORK5CYII=)</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">![](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAbcAAAAVCAYAAADFNKC6AAAFM0lEQVR4nO2by5HkIAxAHY9SUSS6TRIKRHEQnPaA7QbMRzbtnh6vDq9qqhhjIYR+uJefnx9dlsVxHMdxnoMHN8dxHOdxeHBzHMdxHocHN8dxHOdxeHBzHMdxHocHN8dxHOdxeHBzHMdxHsfTghsgq4SgIQQVRoUvkMn5WwCJCsGvy+E4zgTfGNyQwzXnAqQSRAkWXRZQkqCMrf9H5RA0CJllCvvcdQBQkVhF6vKPxp0+n9AfsmhYk6MQevbjHEDe9eb2fQ4gOWlv5/zXN3HZv5/l08GNhBVvNJBMacgDJaLyCeMg6Qc383uHcjlT+n3LvKPk6He48/y86/13Vr53r/839QskJ+3tnP/679iCW8wCWFmChsCKW3sv3WykdTxWMUyYTRarmxiVkYrngfZ2YTMz7mR+W2Yj/Go7hsIQkbfgg7uc2TyAufxYGEc2HlSYsrYmiSilOhBWrAW7G4IbyVo5Ur7+NNh29b8suiyglFQmIvQaS/aHMd0LUQK02cfl+U8abVd/EGUN553UeedyfHe2fhaVzb729b/Wu9n0K/u2PN85P037te9fVrkKKW8JneX9iR6vBbfJ9d/tn2bkN4wDiTJR078N/desfAP/19PfNrb73MSX7/Y9rOw79meQ78BeuSUtPSCOBwBiwHhtMCgUzvSw+cgagsT7LogCpc/MZH5AkgUU5Pz/tuCGHJRXBb/GUTkLRqsik80l5lxZgMqcjEtUOGTKrqznpsqNZN3QZA0HfXb0f6g8IR6Ofc2rDTAWfxvtY2r+M1wNbrtDX3UIpCLpnoMSszKzEuZ2ayHa7eueF5DzttFB7nz/hs8Pzk/Xfg37F/8uksEi+bizcptd/6f801X5LePbvmz7ccZ/zco38n8j/VU7Z4wNOY72MbI/k3wpWXBLI+wqVJbNAuWRs9a2GTju2eBWVnq14BYrrGK8Jle65kbmljrJWluymu1fCm5rdj37/ta7gaqG9qp2XwZTVhgm+5id37B+s36rwOugAOyVcDu4QpHYWSgyy0NlXyQjh3WMnu+cn5H9Ds+3rQq4ty05sf51jZ/wT9fl7493z/LIf83KZ/B/Y/2BcpIstq5x6vYxsD+rfCn24LZG0SSyXnHsnwhumSKSNfWNY3y47w1uYz4R3GDLzKTMot4T3Jrzn+GmO7cymAFNvAcgVkilTe2yV6puw/PtZwzOwRDcRl8Xf+zO7cr6P+Sfpva/M35/cOu939jiHOhvX0Ojamvbx8j+LtwvmoPb1sLZStC1v33eeNI7B1YJfFjQ1eDWP1Tjsj62AeobEmXP25KAUSff1pZszT1qG+Zt35jl7XMZKvup+c9w050bcsz2zT39in7TgA3VAx73jCqB0/J87/x07dewf+VXbLDecaRnbub8vkN/zfd/0D9dlX803vdv1rZk2/5H7x/5P4v+tiDU+/iu3Zbs259JvpTsg5IQotGvF39CkH2iul+ArwcfSZL2Ur2tVBpX+ju0/IOMflsqfXf+QULhgPeeNTScbXEhm1Z3hwtN2X8rt/8UAKkhf36perhMNYxbDg9hsgaD/nL9tz/46OuXTPZxfX6bI7TpDy8Ht6aTMe8PK2f20/7gqO58xs+3z0/PfvHS/gXJK6GZ8/su/fXWf69/mpe/N27zbyP/1bf/sX7b/s+qv30th6TOYh8j++vJV+Ebf+c2AyRfE7bK4r+K+acIzhTzX00O8J+COM79PC24PRVK2mV/8YebTll5eqLiOLfiwc1xHMd5HB7cHMdxnMfhwc1xHMd5Gv8A9+t1tfWOvFwAAAAASUVORK5CYII=)</span> ![](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAb0AAAAWCAYAAABUgkLdAAAFg0lEQVR4nO2bzW3sOAyA3UZaYAs5LxZYFfKWt2mChbAOFcd3kO2RZEukrXEyiXn4gACKZYrinyjP9Hg8ZJomx3Ecx/n9eNJzHMdxboMnPcdxHOc2eNJzHMdxboMnPcdxHOc2eNJzHMdxboMnPcdxHOc2/LakB4GEY5QYozAFgTeQyflZALIwwrfL4TjOBbxj0gsUzwUdQOHIgjDJNIEgR6HQ+v8gFKNERrNMcZ17H4AgAUmY9+XXxp0+X6G/QCxxLppi7NmPsyHQqrd3s2+L/76z/IB80B6Pxbd34nT8t/LVSQ+ZJFxoGIWyAinKC0IHjAJZcRrre1W5nCH9vmRerWj6Hq70n1e9/11Pylb/fVf5AfmgPR6Lb7dhSXqpKiAhjhIjSVjahLmRB5zHU9VEGIrJUjWVsnTA6nnAte3YrKQ7ldZS6TA925excsBAi1GHVc5iHgil/KEyimI8ChMW7VFkFsx1wCRhz4kuSHrIc6WK5fpzJ+7qf5pkmkAwO8kw43Ms2x8K+V6wIASbfZye/6DRdvUHSdZ4PDkcDyrbdxfrJxZe7Gtd/3O9i00/q3HL8x3/adqvff+Kky6j0JIoLO/P9HiuU9P2P4v/a/HJ6r9N+ZX4MGQfhnFAFkJsr1+Lb6PyKevvxZ9lbI3JWaxf7V89aXfs88j+rCe9rDUISMkxICWSp2GDQBVkN0YfSGLkdJ8GSZD8mZFKEZALQw1U/t+S9AJFoVmxz/EgVBj5rMBsU5GoVBIEIcrGOSkaCiXvrOeikx7yvJHZGjb67Oh/U+lCcop1zbMNUKj+NtrH0PxHOJv01kA/6xBQmPM9B0EiISLBUNqthWS3z3tkCFS2lzZyl/unPq/4T9d+DfuX/q6KxKooufKkp/mf5v9afLL6b0t+Tb5R+7CML/u2Xb8e30blM62/E392O3EUGnJs9a/Zp3l/iqSXZ9xZmKL6BSwz6V77Rwnoo0mvPhnuJb1U0VXje3Lla25Usnnw3GuP7J4OTiW9uRoffX/r3YC7BvY8HT8NpT6RmOxjdH7D+s363QWeDgKwnpzbSReqgs9CVWluThJVkbJZh/Z8x380+1X923YquCzpGfxPtXUlPln9d1d+g3zj9tEf765fi2+j8lnXrxWkWZHZajfv249in0f2x5705qyaZdozAf8rkl6hgGxNfaPQnf7apKfzFUkPlkqN66rqNUmvOf8RLrrTq5Mc4MB7ANKJqrapVfadU7rh+fYzhqBgSHpau+66k57uf31b1+PTUNJ79f1Yyz4649cnvd77jetXfHNdQ+OUp+m/bZ8H9sec9JZW0HJUnXvjx5NefqdBwpE2Czmb9PrOph//U7tgfyOS7GV7BELSybu1N1tza+3Hsn2Uqr51LkMnYGj+I1x0pxconQ7O3tlglchh17HTnuFOQrU83/Ofrv0a9q/+ag7mO5JW4jjqv7r++/7X9X9DfLL6b6+91pNv1D60cTXpm9qbbf/Q3m9av/Hjwd5HRW399+3TvD/FhywxJmeYLxQZofhUdr14nwNCQM7aVPvtqU0Vlf2OrrxI7re38neXH0JUgXnteUMjCFcXvflpcHNRyutv/dZPngM25C8vazeXtIZxi9NgyNZg0F+p//aHJn39osk+zs9vC5A2/YXTSa8ZXMz7Q0KF/bQ/dNoPOvrzbf/p2W84tX+Ry5PTiP/adNj2P4v99OKT7r8W+dvyvcI+euO2+KfFt75/6PbXW78t/q9r2RSDNv337dO4P+/4O70RIPu6sXV8/qmYfzLhDDH+FaeC/2TFcb6P35b0fiuYtd1+4g9Onfqk6gWM43wLnvQcx3Gc2+BJz3Ecx7kNnvQcx3Gc2/B4PMRxvpt//v1P/vz5v+Dz81M+Pj4cx3Fexl8JzBrx7NUHswAAAABJRU5ErkJggg==)<span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Nous allons ensuite modifier le port d’écoute pour le SSH :</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:512px;height:19px;">![](https://lh3.googleusercontent.com/GP_YG3gNMufEBcpcPpoB7SsYcNLDSN8ftmV1BlmpI1Ua1xS13Hs8BcW7aevZCoYeTeJpe0f8DVkNRH8bKcvg0QQv6_TitFATabAyRtKshulWwm9mAeqVPEScCgMvpg)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Et remplacer le port par défaut, le 22, par le port que nous avons autorisé plus haut, le 7557, en décommentant la ligne et modifiant le numéro de port d’écoute :</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:378px;height:124px;">![](https://lh6.googleusercontent.com/DaA7vVAJf21hveKRAkccD9HExWP1TOhAT1Rs8-hV6HcbYuQTrLrMbs-iObsodkWOJ3lVQkd1NM0joy0HBBgNo-PbFoQ5l8pabUzeIFUdC-r27tjp8lmq6pu3jItICQ)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Et nous relançons le service SSH:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:472px;height:21px;">![](https://lh4.googleusercontent.com/UwlW8kgAusSDG4pltlqsZCw61Um6RAO9KWib91YA0cOncUxRyHWCx6jfjgbHMFfbXZvKshESrHfUrRCJjOoR7I0LZLIw1qnhqzrg_iStfUh3R9n8w9U5Ok_HL2VXPw)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Nous tentons une connexion avec Putty via ce port:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:338px;height:288px;">![](https://lh6.googleusercontent.com/4NlA9kRWzjvd5VP35vnaao6yPZ6n2ZWlATYEHCA6St5VESxvIfFvDX9clbnTiRzjMIbSANwBHxTH2wf43nPqXdQE_CvLWtiWRvAOPJIE6MaSYJWgOlirS5KM7m0bMg)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Il faut cliquer sur Oui:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:407px;height:259px;">![](https://lh5.googleusercontent.com/PsaTJ5JD8gRDI6XSZ9a5tqVSFuyhPqmGT69sIgD8IM5Ns4SL2bCeRTz4YIgcv-YIIJ0nbSa4MAFTH4rYWKEljxZS5QhkfYkOtzxyUGpKPozNZlwz6gWFYRt81C8dug)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Nous voilà connecté en SSH via le port 7557</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:471px;height:147px;">![](https://lh6.googleusercontent.com/abZupfquKpqHMozLYkBWjKkcoNcazUpPQJGkBwSIsz0Sxp27PSDr_q3qK-cRuHQ-MZCqCGRCfwAJ5qQ5jBrauz0uVX1c219-AmLi401_33mD4QdDw75DN4Ss7ra5ow)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Alors que via le port 22, la connexion est refusée :</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:420px;height:271px;">![](https://lh3.googleusercontent.com/S_3Nb92EEkJBjBsNk8O94X9beFjitN6yFbnV4-hn9kdGyV-2g-ttDQuSqmAF3DlVUADxHbepxH176mtnu5ekuvWA5rmNAZdgM0IG4p7NggRgi8ZZJjk3DqQ0nQHR6g)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Nous allons ensuite interdire la connexion en root, dans le fichier de configuration ssh:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:453px;height:25px;">![](https://lh6.googleusercontent.com/Xvr8scr_3rdhoD4uuCY6zLwGOW5bD-HfCVyM2i6uey6Ne9UczO3VNDwc3--jzHMh8YuS1Ex97B0BCAlnJ58vGTMW46juGvfQZ6lC_gnCpX7RJxRS1tPzPchgJSVgsg)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Puis nous passons PermitRootLogin à no, et MaxAuthTries sur 3 pour bloquer la connexion après 3 tentatives de connexion infructueuses:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:207px;height:89px;">![](https://lh5.googleusercontent.com/PNjSWA7hwsh3hu7-kHYL-qE8AGUW8w9orih_ZLhCOPSbsR8jgSEqdQNMul7nEAN6JzkiuiiKk0CfrgFjOyOogxIORhszuqQwjufyZJcWpQ5Utob8da5ZlsH_fXblIw)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">On sauvegarde et relance le service :</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:483px;height:22px;">![](https://lh3.googleusercontent.com/uGzZMlPJjSE_sFHq_16vcCwC25PO_nWJo4CFhJ1LEkzK5dlhi6kXXGRPqgxpriFx_L1fZ6-A9Q8H2Xy7SLLVSZ3r53C00qYmDTnydthnHDFixDRxePeSGRcaiNQihA)</span></span> </span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Et nous tentons de nous connecter en root sur le serveur:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:402px;height:270px;">![](https://lh6.googleusercontent.com/mshRAVWSfkp2LcDIeLZ49SBxnMUduGCNw-yaoVHV3qxI-JAoFJedDLICyjxdvgXgezXKb9AjITrzxDKKSfPpOc_m8ApMLGV_ZXuAck-dinJ6HeeCeQayJFaF1QlHHA)</span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">La connexion avec le compte root est refusée, et après 3 tentatives, la session est fermée.</span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Mais avec un autre utilisateur, nous avons accès au serveur en SSH:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:529px;height:108px;">![](https://lh5.googleusercontent.com/V862gSoTzK2jt9ycMoPbqm1zUimZoya13RRQ6byCAP4JJAbaxBjHej6UTbJ-DwZsFc53Mu5oYNLmg1R5GVAHP02YFTovd2OR6q4rH4gAhTSbFx6TQnITZJXGicczhQ)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Enfin, nous allons mettre en place l’authentification avec des clés asymétriques avec le compte utilisateur martin. Nous générons une clé rsa de 4096 bits protégée par une passphrase:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"> </span><span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:426px;height:270px;">![](https://lh3.googleusercontent.com/BSGOM7wlJgT1A0O0kTv1vd_lZdWOzkeCI9yNwSYnmkRr4Or0i-ntx_wwydQXO_qfRf2jkVVBGwgZLW6uJ4li-VsVo6UyB91tqDRs0HpgmLOEC168nxv0RpLR-hfsbg)</span></span> </span></span> </span></span> <div> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> </div> <div><span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Ensuite, nous allons générer une paire de clés avec PuttyGen, protégée par une passphrase:</span></div> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:405px;height:367px;">![](https://lh4.googleusercontent.com/1svjx-zpuG9uWIl4AH0fxR3Jh-dkHxLRuUdZAtbopqdiR3eFiywFKA4QI8X48QH6ITB01M01xUeT55MOS1____nAYnkmfIYPJLPlBvFlqNj7cUHTCMrvnvMpplWz7Q)</span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">On sauvegarde la clé publique et la clé privée, puis nous copions la clé publique générée avec PuttyGen sur le serveur dans le répertoire .ssh de l'utilisateur dans un fichier nommé authorized_keys (indiqué dans le fichier sshd_config. On peut modifier le chemin ou le nom du fichier mais il faut l’indiquer dans le fichier de configuration sshd_config :</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:532px;height:22px;">![](https://lh6.googleusercontent.com/ntVdmq4h_9-QdgBey8XQnwC0d5kk8fJGaNQaDS52mNeq8mnCpJlvTBBSRnTpnqO-P9LXcDwZut4IOTohQ0JKJyDlo7pp-FE_A97JxWi7ekEGTj9L_Tb1Lm9Ixw1GZg)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Puis nous copions la clé dans ce fichier, elle doit tenir sur une ligne:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:605px;height:57px;">![](https://lh6.googleusercontent.com/ayN13QjNw09A63IOvOwKcRQ8zLfDhuvWcPsgphU5fRUZ1Fap3lxHwfaxVerMsFkW4kWdUPWRosvMjoTWJ4dZ1r0XWUoLGZUJe0s7kSxhLP3qq2muhH71ibmDX1qwaA)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Puis nous modifions les droits du répertoire .ssh de l’utilisateur pour que seul lui y ait accès :</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:413px;height:22px;">![](https://lh3.googleusercontent.com/jLirBTHfV_62o0Ah3Q0EpM87XQU2hN-OWKo9TvlCA0UVatZb-m40vJcTL50-tTATW2u18H6cb5dDDUOuIRbo7p8s5jS1Si6CBKj-yVjf0wKDrrMT8MPoSh_C3aZk8w)</span></span> </span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">On reconfigure le ssh pour ne plus autoriser les connexions via un mot de passe en décommentant la ligne PasswordAuthentication et en mettant no :</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:435px;height:41px;">![](https://lh6.googleusercontent.com/ADi58VRZm309XyZjPD8HX3N3KdB1UlgVANtvhltqNjguC0BXIxEq2-LypD2yrLDR_GwcepwOHfh1ymqaiAgwb9jF4DyJ8IVC8ySNAUYFwIAgfnm-1ijuq0PxnMJw6Q)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">On redémarre le SSH:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:566px;height:20px;">![](https://lh4.googleusercontent.com/8mtCxldN0YnJmHQfBUc3Kc03NCHh7239hkIcmpHJEH83SVSEufY4iPjQA4jsQDMfsEyFIDdZpxqyvhsu7VA25O8Sj0v9E4tGhsX0BlgNNNDfYPwXoVHo6e5fzjiXuQ)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Puis nous tentons une connexion sans clé, qui est refusée:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:437px;height:275px;">![](https://lh4.googleusercontent.com/Bty830kiEdXf02NFruisa6LOl9Yg5BicyTqcJXaGMcUK8Y4EZ1rPDRp9--N6be-4thi983SK5mLwzOj0eaMiXD3OkED6UVRfUqZyIA2_bunjo_-GhcLUBPGtiek1YQ)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Puis avec notre clé privée:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:552px;height:141px;">![](https://lh5.googleusercontent.com/Xm1THHxQ8kUUiBYH6OujPGP1utezjy6UpdGJhHbB_144fBb8oMSQ4By0bCPtMVWyj920IJ0f2yJiJJ7t7Z76uZ6ctNYFRiHFuA78F8e2vNYp30Pgus-R0spcfXUyvA)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Pour finir, nous allons créer une bannière d’accueil pour les connexions en SSH:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:456px;height:18px;">![](https://lh5.googleusercontent.com/J_QM3soFdanqclND5Y6TDtxvhjCsF6HP2ynNbBdihth3qumafaxFMrFoV-Ga2jHnw5m9xcBw036s5gucgsUHD1it8V4gv_oFQpbpS3XjavR3cw3ODj0_g-eIcsXh9g)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Et nous remplissons le fichier:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:605px;height:136px;">![](https://lh4.googleusercontent.com/4llsuROy7jHNLS1H9EQVN2cPIDOnM3lmb55uNy5Yx-TCBci19vH2UNO-Z17GVnwyMMvoAwh701E_wSNOQ4Cbsy45LHlZnGg9Zna4tqhMmDaFDlz75taAaCIlKPZ9Xw)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Puis nous allons indiquer le chemin de ce fichier dans la configuration du ssh:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:459px;height:26px;">![](https://lh4.googleusercontent.com/wF5jM0YDL6s71RjgNwcaIOqgOHjgSzroW-fKUeB1DXXDBUOosLCIm75EznzN1hhzHC_1AIdzNKm97hRN20hW6S9raLLVm3gVIyQYvrU-d_jezRMnzvPmDydhE4ckRg)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">Puis nous modifions la ligne Banner en la décommentant et en indiquant le chemin de la bannière que nous venons de créer:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:250px;height:64px;">![](https://lh3.googleusercontent.com/8BgU5N-aELPHz_h_O3fNpSxekOXeRU9_5Ewt-mvAT7zwnMcE2RjzaiDjLL-1J5-v3l6CmXkKHMGlIO7HDkkMNABIA7OW0GBHGBWmcuWXL3wGnSoEHwnhwApLqGVJ_A)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">On relance le service:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:496px;height:21px;">![](https://lh3.googleusercontent.com/cIX3FssuWXMmXvp3p0ugbyRJwtzB94veeTiX9i_s6zX7pqgjZRKel_2vO_jPRSkbXTbKxC1cur8BUOq3cy2YyCxG1faf-CXISgK4PKGIYc0iDGTn_K-km5HC38q-Mw)</span></span> </span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;">On se reconnecte en SSH, et la bannière est en place:</span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"><span style="border:none;display:inline-block;overflow:hidden;width:531px;height:291px;">![](https://lh3.googleusercontent.com/2fw7XytZLTgSSfKr52guPFgSBEmgtY1hS3IPhs5MLlx22Stvt83KuAJHke2EqWXcq037h9uAiEakoqc7fbCN07yjAV2XX_tktFzN2ASX4MkL02tPcuTCdihd3xt97g)</span></span> <span style="font-size:11pt;font-family:Calibri,sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;white-space:pre-wrap;"></span> </span></span> ## Fail2Ban Augmentation de la sécurité grâce au module Fail2ban, d’abord on config le bon dépôt, ici pour RHEL 8 : ` wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm ` ![](https://i.imgur.com/lF3R7qV.png) </span></span> </span></span> Et on peut configurer le dépôt pour pouvoir télécharger Fail2ban : ` yum install epel-release-latest-8.noarch.rpm -y ` </span></span> </span></span> On télécharge Fail2ban : ` yum install fail2ban -y ` </span></span> </span></span> On démarre et active le service au démarrage du système : ``` systemctl start fail2ban.service systemctl enable fail2ban.service ``` </span></span> </span></span> On va copier le fichier de conf : ` cat /etc/fail2ban/jail.conf /etc/fail2ban/jail.d/custom.conf ` </span></span> </span></span> Et on l’édite pour l’adapter à nos besoins : Mettre ceci dedans 5 essais avant d’être banni pour mauvais login sur une période de 10 minutes, et ban de 1 heure ## Scripting et automatisation des mises à jour de sécurité Nous allons automatiser les mises à jour de sécurité de nos systèmes. On crée un nouveau répertoire en root : ` mkdir /root/maj ` </span></span> On y crée un fichier de log pour plus tard : ` touch /root/maj/maj.log ` </span></span> Et on crée le script de mise à jour : ` nano /root/maj/maj.sh ` </span></span> Contenu du script de mise à jour de sécurité (on précise le chemin complet des modules que nous lançons, trouvables avec la commande which: voir plus bas) : ``` /usr/bin/yum update --security -y /usr/sbin/reboot ``` Exemple d'un retour de la commande "which" ![](https://i.imgur.com/51rYmVF.png) </span></span> Nous attribuons les bons droits au répertoire /maj : ` chmod 700 /root/maj -Rf ` Nous allons ensuite créer une tâche cron qui se lancera de manière périodique, à des heures non gênantes : ` [root@srv-bdd-1 ~]# crontab -e ` </span></span> Insérer des données avec vi, en tapant "i" pour INSERT, et entrer cette ligne : ` 00 00 * * 7 /bin/bash /root/maj/maj.sh > /root/maj/maj.log ` le premier 00 correspond aux minutes Le deuxième 00 correspond aux heures. ici l'éxecution se fera à 00:00 La première * correspond au jour du mois (de 1 à 31) La deuxième étoile correspond au mois (de 1, pour janvier à 12, pour décembre) Le 7 correspond au jour de la semaine (de 1, pour lundi, à 7 ou 0, pour dimanche) root correspond au compte avec lequel on va lancer la commande qui suit La commande sert à lancer le script maj.sh et à faire un retour dans le fichier maj.log Une fois la ligne insérée, faire "Echap", puis :wq pour sauvegarder et quitter l'éditeur vi. Faire les même manipulations sur les autres serveurs du même pool (Web, BDD, FTP, etc) mais en décalant l'éxecution d'une journée pour qu'il y ait toujours un serveur opérationnel, et qu'en cas de crash de serveur, nous puissons réagir. Mettre en place un environement de préprod pour tester ces mises à jour avant leur déploiement sur les serveurs de prod. Pour lister les tâches cron en cours, entrer cette ligne : ` crontab -l ` Exemple ici sur le HAProxy 1 ![](https://i.imgur.com/7az5vT9.png)