Archive

Archives pour la catégorie ‘Sécurité’

How to save rules of the iptables?

24/01/2021 Comments off
iptables-save

Saving iptables rules for reboot

On a server, iptables rules don’t reload automatically at reboot. You need to reload the rules using ax executable shell scripture a dedicated utility that will load them at the same time as the program itself, i.e. with the kernel.

Depending of the version of Linux you use, you can select different methods:

sudo su
iptables-save > /etc/iptables.rules

In /etc/network/if-pre-up.d/iptables, put:

#!/bin/sh
iptables-restore < /etc/iptables.rules
exit 0

After, in /etc/network/if-post-down.d/iptables, put:

#!/bin/sh
iptables-save -c > /etc/iptables.rules
if [ -f /etc/iptables.rules ];
       then iptables-restore < /etc/iptables.rules
fi
exit 0

After, give permission to the scripts:

sudo chmod +x /etc/network/if-post-down.d/iptables sudo chmod +x /etc/network/if-pre-up.d/iptables

Another scenario is to is to install iptables-persistent:

sudo apt-get install iptables-persistent

After it’s installed, you can save/reload iptables rules anytime:

    sudo /etc/init.d/iptables-persistent save 
    sudo /etc/init.d/iptables-persistent reload

Or if you use Ubuntu server 16.04, things are simpler:

The installation as described above works without a problem, but the two commands for saving and reloading above do not seem to work with a 16.04 server. The following commands work with that version:

    sudo netfilter-persistent save
    sudo netfilter-persistent reload
Categories: Réseau, Sécurité, Tutoriel Tags: , , ,

How to Disable Webcam / FaceTime Camera on Mac Completely

22/01/2021 Comments off

Source: osxdaily.com

Some of the more privacy conscious Mac users out there might put tape over their webcam or use apps like Oversight to detect camera activity. While either of those approaches can be satisfactory for many users (or considered totally paranoid and overboard to others), many advanced Mac users in the security community go a step further and just outright disable their Macs front-facing web camera. This article will show you how to completely deactivate the front FaceTime camera on a Mac.

 

To be clear, this aims to completely disable the software components behind the built-in camera on Macs which prevents it from being used by any application, this webcam is sometimes called the FaceTime camera or the iSight camera, or simply the front-facing camera. All modern Macs have this camera, it is located at the top of the display and embedded into the screen bezel. By disabling the Macs camera, any application that requires it’s usage will no longer function as intended because camera access will become impossible. 

This is an advanced tutorial aimed at advanced users, it is not intended for novice or casual Mac users. This approach disables the Mac built-in camera by changing system level permissions for system level files directly relating to the camera components. If you are not comfortable modifying system files using the command line with super user privileges, do not proceed.

This tutorial applies to modern versions of MacOS including Sierra and El Capitan, you will need turn off rootless temporarily so that you can make modifications to the system folder, if you’re not sure how to do that, you can learn how to disable SIP on Mac OS here. You should aways backup a Mac before making any modifications to system software. Older versions of Mac OS X that wish to disable the iSight camera can follow these instructions instead to accomplish the same effect.

How to Disable the Web Camera on Mac

This is a string of commands that will completely disable the built-in Mac camera, meaning no applications will be able to use the front-facing camera at all. This is intended for advanced users only who thoroughly understand proper syntax and command line usage. 

    1. Back up the Mac if you have not done so already, then you will need to disable SIPfirst (and yes you should re-enable it when finished)
    2. Open the Terminal app as found in /Applications/Utilities/
    3. One by one on their own line and executed separately, issue the following five command strings into the command line and authenticate:

    sudo chmod a-r /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/VDC.plugin/Contents/MacOS/VDC

    sudo chmod a-r /System/Library/PrivateFrameworks/CoreMediaIOServicesPrivate.framework/Versions/A/Resources/AVC.plugin/Contents/MacOS/AVC

    sudo chmod a-r /System/Library/QuickTime/QuickTimeUSBVDCDigitizer.component/Contents/MacOS/QuickTimeUSBVDCDigitizer

    sudo chmod a-r /Library/CoreMediaIO/Plug-Ins/DAL/AppleCamera.plugin/Contents/MacOS/AppleCamera

    sudo chmod a-r /Library/CoreMediaIO/Plug-Ins/FCP-DAL/AppleCamera.plugin/Contents/MacOS/AppleCamera

    1. Exit Terminal when complete, don’t forget to re-enable SIP on the Mac as well

    (Note you can also use chmod 200 instead of a-r if you prefer using numbers, the effect will be the same and permissions will be –w——-)

    After the Mac camera has been disabled this way, if you attempt to open FaceTime, Skype, Photo Booth, QuickTime, iMovie, or any other app which uses the built-in camera, you will get a message stating “there is no connected camera” on the Mac – which is exactly what you would want to see if you disabled the camera intentionally.

    Mac camera disabled as shown by no camera connected error message

    You should not need to reboot for the changes to take effect, though you may need to relaunch some active applications with camera access.

    How to Re-Enable the Camera on Mac

    Just as before when disabling the camera, to re-enable the Mac camera this way you will likely need to temporarily disable SIP in Mac OS before beginning. Then the commands to issue one by one are as follows:

    sudo chmod a+r /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/VDC.plugin/Contents/MacOS/VDC

    sudo chmod a+r /System/Library/PrivateFrameworks/CoreMediaIOServicesPrivate.framework/Versions/A/Resources/AVC.plugin/Contents/MacOS/AVC

    sudo chmod a+r /System/Library/QuickTime/QuickTimeUSBVDCDigitizer.component/Contents/MacOS/QuickTimeUSBVDCDigitizer

    sudo chmod a+r /Library/CoreMediaIO/Plug-Ins/DAL/AppleCamera.plugin/Contents/MacOS/AppleCamera

    sudo chmod a+r /Library/CoreMediaIO/Plug-Ins/FCP-DAL/AppleCamera.plugin/Contents/MacOS/AppleCamera

    (Note you can also use chmod 755 instead of a+r if you prefer using numbers to return to -rwxr-xr-x, the effect will be the same)

    You’ll notice the difference between the enabling and disabling commands are simply the permissions change chmod command flag – has turned into a +, indicating the file(s) have read access now whereas before they did not, which is what prevented the camera from working. 

    If this approach is insufficient for your privacy or security needs for whatever reason, you’d likely need to go a step further and actually disassemble your Mac hardware to physically disconnect any camera cables, a task which is quite advanced but undeniably the most effective approach if you want to completely disable the Mac camera and don’t ever want the Macs camera to be used.

    Why would I want to disable the Mac camera?

    Most Mac users would not want to disable their FaceTime / iSight camera. Typically only very advanced Mac users who have a specific reason to completely disable the built-in camera on their Mac would want to do this, whether they are systems administrators, security professionals, for privacy reasons, or otherwise. This is not intended for the average Mac user. If you’re an average, casual, or novice Mac user who is concerned about privacy and any possible camera shenanigans, try putting tape on your web cam, like the FBI director does, which is much lower tech and less involved, easy to reverse, and quite effective since obviously if something is obstructing the camera lens than it is not usable.

     

    Categories: Sécurité, Système, Tutoriel Tags: ,

    Comment configurer un pare-feu avec UFW sur Ubuntu 16.0

    15/01/2021 Comments off

    Introduction

    UFW, ou Pare-feu simple, est une interface iptablesqui vise à simplifier le processus de configuration d’un pare-feu. Bien iptablesqu’il s’agisse d’un outil solide et flexible, il peut être difficile pour les débutants d’apprendre à l’utiliser pour configurer correctement un pare-feu. Si vous cherchez à commencer à sécuriser votre réseau et que vous ne savez pas quel outil utiliser, UFW peut être le bon choix pour vous.

    Ce tutoriel vous montrera comment configurer un pare-feu avec UFW sur Ubuntu 16.04.

    Conditions préalables

    Pour suivre ce tutoriel, vous aurez besoin de:

    UFW est installé par défaut sur Ubuntu. S’il a été désinstallé pour une raison quelconque, vous pouvez l’installer avec sudo apt-get install ufw.

    Étape 1 – Utilisation d’IPv6 avec UFW (facultatif)

    Ce didacticiel est écrit avec IPv4 à l’esprit, mais fonctionnera pour IPv6 aussi longtemps que vous l’activez. Si votre serveur Ubuntu a activé IPv6, assurez-vous que UFW est configuré pour prendre en charge IPv6 afin qu’il gère les règles de pare-feu pour IPv6 en plus d’IPv4. Pour ce faire, ouvrez la configuration UFW avec nanoou votre éditeur préféré.

    sudo nano /etc/default/ufw

    Assurez-vous ensuite que la valeur de IPV6est yes. Ça devrait ressembler à ça:

    / etc / default / ufw extrait
    ...
IPV6=yes
...

    Enregistrez et fermez le fichier. Désormais, lorsque UFW est activé, il sera configuré pour écrire les règles de pare-feu IPv4 et IPv6. Cependant, avant d’activer UFW, nous voulons nous assurer que votre pare-feu est configuré pour vous permettre de vous connecter via SSH. Commençons par définir les politiques par défaut.

    Lire la suite…
    Categories: Réseau, Sécurité, Tutoriel Tags:

    Apache Web Server Hardening & Security Guide

    02/01/2021 Comments off

    apache security best practicesSecure Apache Web Server – Practical Guide

    1       Introduction

    The Web Server is a crucial part of web-based applications. Apache Web Server is often placed at the edge of the network hence it becomes one of the most vulnerable services to attack. Having default configuration supply many sensitive information which may help hacker to prepare for an attack the web server.

    The majority of web application attacks are through XSS, Info Leakage, Session Management and PHP Injection attacks which is due to weak programming code and failure to sanitize web application infrastructure. According to the security vendor Cenzic, 96% of tested applications have vulnerabilities. Below chart from Cenzic shows the vulnerability trend report of 2013.

    This practical guide provides you the necessary skill set to secure Apache Web Server.  In this course, we will talk about how to Harden & Secure Apache Web Server on Unix platform. Following are tested on Apache 2.4.x and I don’t see any reason it won’t work with Apache 2.2.x.

    1. This assumes you have installed Apache on UNIX platform. If not, you can go through Installation guide. You can also refer very free video about how to Install Apache, MySQL & PHP.
    2. We will call Apache installation directory /opt/apache as $Web_Server throughout this course.
    3. You are advised to take a backup of existing configuration file before any modification.

    1.1  Audience

    This is designed for Middleware Administrator, Application Support, System Analyst, or anyone working or eager to learn Hardening & Security guidelines. Fair knowledge of Apache Web Server & UNIX command is mandatory. This is seven page guide, click on Next to proceed. You may navigate through table of contents at right hand side.

     

    BONUS (Download in PDF Format): Apache HTTP Security & Hardening Guide

    Lire la suite…

    Categories: Logiciel, Sécurité, Tutoriel Tags: , ,

    Tutorial: Using VMWare ESXi and PFsense as a network firewall/router

    01/01/2021 Comments off

    vmware esxi

    Using VMWare ESXi and PFsense as a network firewall/router

    In most networks, you will have dedicated hardware to function as your “edge” (firewall/router). This is typically for the best, but there are always cases where you can’t put out that dedicated hardware. Sometimes it’s for cost reasons and sometimes it’s for complexity. In my particular case, I was installing an ESXi server in a datacenter and only had 2 amps of power to work with, of which my server took up ~1.8amps at peak load. So cost came into play and we simply couldn’t afford to put in dedicated hardware that could push enough bits. In such cases, it is possible the setup ESXi on the network edge, in a reasonably secure fashion, with PFSense acting as a firewall.

    vmware_vsphereThe most important requirement to this project is that your VMWare ESXi server has at least two network ports on it. One will be the WAN port, one will be the LAN port. Also throughout this tutorial I will use PFSense as my firewall/router OS of choice, however it is just an example that can be easily swapped out with any other virtualized firewall product. Some options include Palo Alto Networks, Fortinet, and even generic *NIX operating systems with the right forwarding/firewall setup.

    Section 1 – VMWare Setup

    Step 1 – Install & Connect to ESXi

    • You should already have ESXi setup and connected via the VSphere client on Windows.
    • It’s recommended that you static the IP address of the VMWare Management interface, if you’ve not done so already.
    • Go to Configuration > Networking
    • Rename the vSwitch interface you’re using to “LAN”
    		2015-08-25-18_23_50-esxi1
    Step 2 – Add new interface
    You want “Virtual Machine” type    		2015-08-25-18_24_15-Add-Network-Wizard
    Step 3 – Select NIC
    You want to select your unused NIC (assuming you only have two)    		2015-08-25-18_25_11-Add-Network-Wizard
    Step 4 – Name it
    This is your “WAN” interface    		2015-08-25-18_25_35-Add-Network-Wizard
    Step 5 – Confirm you’ve got two networks
    You’ll notice that we’ve got two vSwitches now. The “LAN” switch has the Management network and is connected currently. The “WAN” switch has nothing, and the adapter is disconnected.    		2015-08-25-18_26_06-VMware

    Section 2 – Virtual Machine Setup

    Step 1 – New VM2015-08-25-18_29_17-New-VM
    Step 2 – Typical Setup2015-08-25-18_29_31-Create-New-Virtual-Machine
    Step 3 – Name your VM2015-08-25-18_29_39-Create-New-Virtual-Machine
    Step 4 – Select Datastore2015-08-25-18_29_46-Create-New-Virtual-Machine
    Step 5 – OS Type
    If you’re using PFSense, select “Other” and “FreeBSD 64bit”    		2015-08-25-18_29_57-Create-New-Virtual-Machine
    Step 6 – Two NICs
    Unlike most VMs with 1 NIC, add 2 NICs to this VM.
    Make sure one adapter is on “WAN” network and one adapter is on “LAN” network.    		2015-08-25-18_30_18-Create-New-Virtual-Machine
    Step 7 – Allocated HD
    PFSense doesn’t need much space, but it should be allocated a 2:1 for swap (e.g. 4096 MB swap file for 2048 MB of RAM), plus some extra space for packages and logs may be useful.    		2015-08-25-18_30_38-Create-New-Virtual-Machine
    Step 8 – Edit before completion2015-08-25-18_30_46-Create-New-Virtual-Machine
    Step 9 – Final settings
    As this is my firewall, I want to make sure it is plenty fast. So I opted for 4 cores and 2 GB RAM. Also attach the CD drive to PFSense installer (be it datastore ISO or real USB/Optical drive).    		2015-08-25-18_31_54-pfsense-Virtual-Machine-Properties
    Step 8 – Verify Network
    Hop back to Configuration > Networking and you should see something like this. Note: various VMs are all attached to the LAN vSwitch, however only PFsense VM is attached to both WAN & LAN (just like a real firewall).    		2015-08-25-18_33_31-VMWare-Verify
    Step 9 – VM Startup
    Go to Configuration > VM Startup/Shutdown
    Click Properties    		2015-08-31-12_30_32-Store
    Step 10 – Set PFSense to first boot order
    You may have other VMs that you want to auto-start, but as this is your firewall, it should be the first to start.    		2015-08-31-12_31_05-Virtual-Machine-Startup-and-Shutdown

    Section 3 – PFSense

    Step 1 – Install PFSense
    Once you’ve installed PFSense, it will automatically configure its local interface to 192.168.1.1    		pfsense-install1
    Step 2 (Optional) – Change local network
    You can reconfigure the local network either via web interface (at the aforementioned IP: http://192.168.1.1) or command line    		pfsense-installer
    Step 3 – Configure WAN
    Again, this can be configured either via the web, or command line.    		2015-08-31-12_19_39-pfSense-Interfaces_-WAN
    Step 4 – Plug in WAN cable2015-08-19-13.59.53
    Step 5 – Test
    If you’ve got the ports configured properly (i.e. WAN hardware is WAN in VMWare and WAN in PFSense), you should be able to connect to the internet.    		2015-08-31-12_27_35-pfSense-Status_-Dashboard

    There are two big questions after building a setup like this, the first is security. Since PFSense is the host to provide an interface on the WAN, it should be the only method of ingress into your network. With no VMware management interface on the WAN, there should be no way for an outside party to access ESXi directly. I’ve used this setup successfully (and safely) before, as have others. However, you always need to balance your particular security concerns with the cost of dedicated devices.

    The second question is remote management/maintenance/failure. Managing ESXi remotely is easy, if you setup a VPN on your PFSense VM. Without that (or similar) you will not be able to remotely manage the box (by design). But what happens if there is a failure either in the VMWare hardware or the PFSense virtual machine? That’s the big failing point of this setup – you’re down. If, for whatever reason, PFsense dies – your network is offline and you cannot remotely manage it. If this hardware is installed in a dateacenter, you’d need to either get in there yourself or remote hands reboot. Something to keep in mind when balancing the cost issue. OF course, if it’s local (say you use this at home), then it’s not such a big deal.
    IMG_07121I will note that this is the setup I use in my home network, which doubles as my homelab. Having a VM for a firewall gives me a lot of flexibility, like adding an entirely separate vSwitched network for experimental VMs. I can also swap out the firewall VM for another one with next to no downtime. It also allows me to skip one more piece of hardware at home which would add to my otherwise hefty powerbill.

    Source: obviate.io

    Categories: Réseau, Sécurité, Tutoriel Tags: