Administrateur & Développeur système UNIX/Linux

burns ~ # more /etc/conf.d/net

config_eth0="10.0.0.13 netmask 255.0.0.0 brd 10.255.255.255
fdfe:cd5e:234c:8277::4/64
"
routes_eth0="default gw 10.0.0.1"

root@skinner:~# more /etc/network/interfaces

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
    address 10.0.0.11
    netmask 255.0.0.0
    network 10.0.0.0
    broadcast 10.255.255.255
    gateway 10.0.0.1
    up ip -6 addr add fdfe:cd5e:234c:8277::8/64 dev eth0
    down ip -6 addr del fdfe:cd5e:234c:8277::8/64 dev eth0

#
# pf.conf
#

# macros
ext_if = "re0"
int_if = "lo1"

# tables
table  persist {}

# options
set block-policy drop
set skip on lo0
set limit { states 20000, frags 5000, src-nodes 2000 }

# normalization
scrub in all fragment reassemble
scrub all reassemble tcp
scrub in all random-id

#
# redirection
#

nat on $ext_if from !($ext_if) to any -> ($ext_if)

# jail dns
rdr pass on $ext_if proto tcp from any to port 53 -> 172.16.0.1 port 53
rdr pass on $ext_if proto udp from any to port 53 -> 172.16.0.1 port 53
# jail www
rdr pass on $ext_if proto tcp from any to port 80 -> 172.16.0.2 port 80
rdr pass on $ext_if proto tcp from any to port 443 -> 172.16.0.2 port 443
rdr pass on $ext_if proto tcp from any to port 2222 -> 172.16.0.2 port 22

#
# rules
#

block in log
block out log
block quick from
antispoof quick for lo0

pass quick on $int_if

pass out proto tcp all keep state
pass out proto udp all keep state

pass in on $ext_if inet proto icmp from any to any keep state
pass out on $ext_if inet proto icmp from any to any keep state

pass in on $ext_if inet6 proto icmp6 from any to any keep state
pass out on $ext_if inet6 proto icmp6 from any to any keep state

pass in on $ext_if proto tcp from any to any port 22 flags S/SA keep state \
(source-track rule, max-src-conn 4, max-src-conn-rate 4/30, \
overload  flush global)

Suite à cette article qui permet de cracker un réseau WiFi sécurisé par WPA en moins de deux heures, il convient de désactiver la fonction WPS de la LiveBox.

Exemple de configuration WiFi sur une Livebox 2 ZTE (rubrique Configuration avancée / WiFi) :

http://www.simpledns.com/private-ipv6.aspx

node1# more /etc/rc.conf

[...]
ipv6_enable="YES"
ipv6_gateway_enable="YES"
ipv6_network_interfaces="lo0 igb0 em0 vlan1 vlan101 vlan102 carp0 carp1 carp2"
ipv6_defaultrouter="::1"

ipv6_ifconfig_igb0="fdcb:9921:3552:afd6::2 prefixlen 64"
ipv6_ifconfig_em0="fdcb:9921:3552:afff::2 prefixlen 64"
ipv6_ifconfig_vlan1="fdcb:9921:3552:afd7::2 prefixlen 64"
ipv6_ifconfig_vlan101="fdcb:9921:3552:afd8::2 prefixlen 64"
ipv6_ifconfig_vlan102="fdcb:9921:3552:afd9::2 prefixlen 64"
ipv6_ifconfig_carp0="fdcb:9921:3552:afd6::1 prefixlen 64"
ipv6_ifconfig_carp1="fdcb:9921:3552:afd8::1 prefixlen 64"
ipv6_ifconfig_carp2="fdcb:9921:3552:afd9::1 prefixlen 64"
[...]
pf_enable="YES"
pf_flags=""
pf_rules="/etc/fw.conf"
pfsync_enable="YES"
pfsync_syncdev="em0"
[...]

Pour la configuration IPv4, c’est par ici.

En premier lieu, il faut installer le package iproute2 pour gérer l’adressage et le routage IPv6 grâce à la commande ip :

# emerge sys-apps/iproute2

Enfin la configuration de l’interface réseau (syntaxe pour baselayout-2) :

# more /etc/conf.d/net

config_eth0="192.168.0.1 netmask 255.255.255.0 brd 192.168.0.255
fdcb:9921:3552:afd6::4/64"

routes_eth0="default via 192.168.0.254
default via fdcb:9921:3552:afd6::1"

NE PLUS UTILISER ce paramètre système :

net.ipv4.tcp_tw_recycle = 1

OpenVPN fournit un plugin d’authentification PAM. En ajoutant le module LDAP pour PAM, il peut alors interroger la base LDAP où sont stockés les accès de chaque utilisateur se connectant au serveur VPN.

# cd /usr/ports/security/pam_ldap
# make install clean

/usr/local/etc/openvpn/openvpn.conf :

[...]
plugin /usr/local/lib/openvpn-auth-pam.so openvpn

/usr/local/etc/pam.d/openvpn :

account         required        /usr/local/lib/pam_ldap.so config=/usr/local/etc/openvpn/auth/pam_ldap.conf
auth            required        /usr/local/lib/pam_ldap.so config=/usr/local/etc/openvpn/auth/pam_ldap.conf
password        required        /usr/local/lib/pam_ldap.so config=/usr/local/etc/openvpn/auth/pam_ldap.conf
session         required        /usr/local/lib/pam_ldap.so config=/usr/local/etc/openvpn/auth/pam_ldap.conf

/usr/local/etc/openvpn/auth/pam_ldap.conf :

uri ldapi://%2Fvar%2Frun%2Fopenldap%2Fldapi/
binddn cn=proxy,dc=my,dc=domain
bindpw 123456
ldap_version 3
ssl start_tls
tls_cacert /usr/local/etc/openldap/server.crt
tls_checkpeer no
base ou=Users,dc=my,dc=domain
scope one
pam_login_attribute uid

Côté client, il faut ajouter l’option suivante au fichier de configuration :

[...]
auth-user-pass

$ wireshark -k -i <(ssh -l root server.my.domain /usr/bin/tshark -i eth0 -w - not tcp port 22)