Table des matières
- 2026:
- 2025:
4 billet(s) pour septembre 2026
| Notes HTTP Strict Transport Security - HSTS | 2026/09/18 11:04 | Jean-Baptiste |
| Notes GNU Linux GPU carte graphiques | 2026/09/08 15:49 | Jean-Baptiste |
| Notes GNU Linux graphique | 2026/09/08 15:42 | Jean-Baptiste |
| Notes urlencoding - passer des mots de passe en HTTPS | 2026/09/03 17:58 | Jean-Baptiste |
Notes Sonar SonarQube LDAP
Voir :
Voir aussi :
- Checkmarx - KICS
- MegaLinter
sonar/sonarqube-6.7.1/conf/sonar.properties
sonar.jdbc.username=sonar sonar.jdbc.password=P@ssw0rd sonar.jdbc.url=jdbc:postgresql://localhost/sonar # General Configuration sonar.security.realm=LDAP ldap.url=ldap://acme.local:389 ldap.bindDn=admin ldap.bindPassword=P@ssw0rd # User Configuration ldap.user.baseDn=DC=acme,DC=local ldap.user.request=(&(objectClass=user)(sAMAccountName={login})) ldap.user.realNameAttribute=cn ldap.user.emailAttribute=mail # Group Configuration #ldap.group.baseDn=ou=Groups,dc=sonarsource,dc=com #ldap.group.request=(&(objectClass=posixGroup)(memberUid={uid}))
Err
org.sonar.plugins.ldap.LdapException: Unable to retrieve details for user in <default>
NC
LdapUserMapping{baseDn=cn=users,dc=acme,dc=local, request=(&(objectClass=user)(sAMAccountName={0})), realNameAttribute=cn, emailAttribute=mail}
ldapsearch -D admin -W -h acme.local -b "DC=acme,DC=local" "(&(objectClass=user)(sAMAccountName=user))"
Service SystemD
Voir exemple_4_-systemd_appelant_un_script_sysv_init systemd_service//-_exemples
Notes socket Unix
Voir :
netstat -ln | grep mysql ss -x netstat --unix cat /proc/net/unix
Connect to an existing stream socket
nc -U /path/to/socket
Create a listening stream socket
nc -lU /path/to/socket
# lsof -U -a -p $(pidof mysqld) COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME mysqld 1766 mysql 18u unix 0xffffa0c0b6f97800 0t0 26264 /var/run/mysqld/mysqld.sock type=STREAM
sudo curl -v --unix-socket /var/run/crio/crio.sock http://localhost/info | jq
Podman
$ sudo curl -H "Content-Type: application/json" --unix-socket /var/run/docker.sock http://localhost/_ping OK
Unit socket SystemD
Notes socat
Dance, Socat Dance !
Voir aussi :
- OpenSSL Proxy http_proxy / proxytunnel
Voir également spiped :
Voir :
- netsed
Exemple
socat TCP4-LISTEN:10053,reuseaddr,fork,su=nobody TCP4:10.9.0.6:10050
Mais la bonne solution est :
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 10053 -j DNAT --to-destination 10.9.0.6:10050 iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
TUN
TUN Server
socat -d -d TCP-LISTEN:11443,reuseaddr TUN:192.168.255.1/24,up
After starting this command, socat will wait for a connection and then create a TUN pseudo network device with address 192.168.255.1; the bit number specifies the mask of the network that is pretended to be connected on this interface.
TUN Client
socat TCP:1.2.3.4:11443 TUN:192.168.255.2/24,up
This command should establish a connection to the server and create the TUN device on the client.
OpenVPN
http://serverfault.com/questions/580442/tunnel-over-http-server
OpenVPN sur le port 443
socat TCP-LISTEN:9999,bind=localhost OPENSSL:proxy.example.com:443
Socket Unix
https://www.ffdn.org/wiki/doku.php?id=documentation:openvpn:fdn
socat /var/run/openvpn.management.serveur EXEC:"echo kill foo@vpn.fdn.fr"
echo "status 3" | socat stdio /var/run/openvpn.mgmt
Tunnel SSH Over SCTP
http://0x27.me/2015/07/27/SSH-Over-SCTP.html
assuming you want the SCTP socket to listen on port 80/SCTP and sshd is on 22/TCP
socat SCTP-LISTEN:80,fork TCP:localhost:22
replace SERVER_IP with IP of listening server, and 80 with whatever port the SCTP listener is on :)
socat TCP-LISTEN:1337,fork SCTP:SERVER_IP:80
replace username and -p port value as needed…
ssh -lusername localhost -D 8080 -p 1337 #
Décapsuler HTTPS
socat TCP-LISTEN:8082,reuseaddr,pf=ip4,fork OPENSSL:192.168.51.142:443,verify=0
Autres
echo "GET hosts" | socat - TCP4:127.0.0.1:6557,crnl
socat -ls TCP4-LISTEN:443,fork,reuseaddr TCP4:10.96.0.1:443
Notes SNMPv3
Voir :
Voir aussi :
- snmp_exporter (Prometheus)
Conf serveur
Méthode 1
/var/lib/net-snmp/snmpd.conf
# rouser nagios createUser nagios SHA NagiosP@ssw0rd AES !P@ssw0rdNagios!
systemctl restart snmpd
Après redémarrage le mot de passe est chiffré dans /var/lib/net-snmp/snmpd.conf pour CentOS/RedHat ou dans /var/lib/snmp/snmpd.conf pour Debian.
Exemple :
usmUser 1 3 0x80001f87801c283d152f784a8700000000 "nagios" "nagios" NULL .1.3.6.1.6.3.10.1.1.2 0xbb07cb9c6ab1f0237b6981639b368642 .1.3.6.1.6.3.10.1.2.2 0xbb17cc9c6ab1f1347b6981639b368653 0x
Méthode 2
Install du paquet qui contient net-snmp-config
apt install libsnmp-dev
Création du premier utilisateur
systemctl stop snmpd # echo -e "newuser\nmy_password\n\n" | (net-snmp-config --create-snmpv3-user) net-snmp-config --create-snmpv3-user -a 'my_password' newuser systemctl start snmpd
Test de connexion avec l'utilisateur nouvellement crée
snmpwalk -r 2 -v 3 -a MD5 -A 'my_password' -l authNoPriv -u newuser localhost .1
Création d'un nouvelle utilisateur “nagios”
snmpusm -v 3 -u newuser -a MD5 -A 'my_password' -l authNoPriv localhost create nagios newuser
Modifier le fichier /etc/snmp/snmpd.conf et ajouter : /etc/snmp/snmpd.conf
rouser nagios auth
Redémarrer snmpd
systemctl restart snmpd
Changement du mot de passe. Par défaut l'utilisateur crée hérite du mot de passe du créateur.
snmpusm -v 3 -u nagios -a MD5 -A 'my_password' -x DES -l authNoPriv localhost passwd 'my_password' 'P@ssw0rd'
A présent il convient de remetre l'utilsateur nagios en lecture seule
/etc/snmp/snmpd.conf
rouser nagios auth
systemctl restart snmpd
Test de connexion avec l'utilisateur Nagios et le nouveau mot de passe
snmpwalk -r 2 -v 3 -a MD5 -A "P@ssw0rd" -l authNoPriv -u nagios localhost .1
UsmUser
Voir :
Conf client
apt-get install snmp
man snmp.conf
mkdir ~/.snmp/ mkdir ~/.snmp/hosts/
/.snmp/snmp.conf/.snmp/hosts/localhost.conf ou
defSecurityName nagios #defSecurityLevel authPriv defSecurityLevel authNoPriv defAuthType MD5 #defPrivType DES defAuthPassphrase P@ssw0rd #defPrivPassphrase P@ssw0rd
chmod 600 ~/.snmp/snmp.conf chmod 600 ~/.snmp/hosts/*.conf
Test
snmpwalk -r 2 -v 3 localhost .1
Pb
Err - no encryption type specified
no encryption type specified, which I need in order to know to change the key
Cela peut se produire si oublie de l'ajout rouser nagios dans /etc/snmp/snmp.conf
Notes SNMP
Voir :
Voir les traps SNMP :
MIBS :
Exemple de conf :
Serveur
RedHat
yum install net-snmp
Debian
apt-get install snmpd snmptrapd snmp-mibs-downloader
ln -s /usr/share/mibs/ /usr/share/snmp/mibs
/etc/default/snmptrapd
#export MIBS= export MIBS=ALL export MIBDIRS=/usr/share/mibs #TRAPDRUN=no TRAPDRUN=yes #TRAPDOPTS='-Lsd -p /run/snmptrapd.pid' TRAPDOPTS='-On -Lsd -p /run/snmptrapd.pid'
/etc/snmp/snmp.conf
#mibs :
service snmpd restart service snmptrapd restart
Conf
/etc/snmp/snmpd.conf
#rocommunity public localhost rocommunity public 0.0.0.0/0 #agentAddress udp:127.0.0.1:161 #agentAddress udp:161,udp6:[::1]:161 agentAddress udp:161 #includeAllDisks 1 skipNFSInHostResources 1
Exemple conf
Exemple 1 - Conf Debian
/etc/snmp/snmpd.conf
agentAddress udp:161,udp6:[::1]:161 view systemonly included .1.3.6.1.2.1.1 view systemonly included .1.3.6.1.2.1.25.1 rocommunity public rouser authOnlyUser sysLocation Sitting on the Dock of the Bay sysContact Me <me@example.org> sysServices 72 proc mountd proc ntalkd 4 proc sendmail 10 1 disk / 10000 disk /var 5% includeAllDisks 10% load 12 10 5 trapsink localhost public iquerySecName internalUser rouser internalUser defaultMonitors yes linkUpDownNotifications yes extend test1 /bin/echo Hello, world! extend-sh test2 echo Hello, world! ; echo Hi there ; exit 35 master agentx smuxpeer .1.3.6.1.4.1.674.10892.1
Exemple 2 - Conf RedHat
/etc/snmp/snmpd.conf
#com2sec notConfigUser default public com2sec mynetwork 192.168.0.0/24 public group notConfigGroup v1 notConfigUser group notConfigGroup v2c notConfigUser view centreon included .1.3.6.1 view systemview included .1.3.6.1.2.1.1 view systemview included .1.3.6.1.2.1.25.1.1 access notConfigGroup "" any noauth exact centreon none none access notConfigGroup "" any noauth exact systemview none none syslocation Unknown (edit /etc/snmp/snmpd.conf) syscontact Root <root@localhost> (configure /etc/snmp/snmp.local.conf) dontLogTCPWrappersConnects yes
cat >> /etc/snmp/snmpd.conf <<EOF view systemview included .1.3.6.1 EOF
Exemple 3 - Debian 8
Pour éviter bug timeout, car SNMP essaye de remonter les infos sur toutes les partitions qu'il trouve
systemctl disable mnt-espace_build.automount partage_install.automount partage_librairies.automount mnt-espace_build.mount partage_install.mount partage_librairies.mount systemctl stop mnt-espace_build.automount partage_install.automount partage_librairies.automount mnt-espace_build.mount partage_install.mount partage_librairies.mount
Install du paquet snmp-mibs-downloader et de sa dépendance smistrip
dpkg -i smistrip_0.4.8+dfsg2-10_all.deb snmp-mibs-downloader_1.1_all.deb
/etc/default/snmpd
export MIBS=ALL SNMPDRUN=yes SNMPDOPTS='-Lsd -Lf /dev/null -u snmp -g snmp -I -smux,mteTrigger,mteTriggerConf -p /run/snmpd.pid' export MIBDIRS=/usr/share/mibs
/etc/snmp/snmpd.conf
agentAddress udp:161,udp6:[::1]:161 rocommunity public
Exemples droit d'accès
/etc/snmp/snmpd.conf
# rouser: a SNMPv3 read-write user # arguments: user [noauth|auth|priv] [restriction_oid] rouser nagios auth
Accès en lecture et écriture à la totalité de l'arborescence
/etc/snmp/snmpd.conf
rwuser admin authpriv .1
Pb - refused smux peer: oid SNMPv2-SMI::enterprises.674.10892.1, descr Systems Management SNMP MIB Plug-in Manager
Voir :
systemctl status snmpd ● snmpd.service - Simple Network Management Protocol (SNMP) Daemon. Loaded: loaded (/usr/lib/systemd/system/snmpd.service; enabled; vendor preset: disabled) Active: active (running) since mer. 2017-06-07 11:37:03 CEST; 9s ago Main PID: 61127 (snmpd) CGroup: /system.slice/snmpd.service └─61127 /usr/sbin/snmpd -LS0-6d -f juin 07 11:37:03 8cc-offline-1 systemd[1]: Starting Simple Network Management Protocol (SNMP) Daemon.... juin 07 11:37:03 8cc-offline-1 snmpd[61127]: Turning on AgentX master support. juin 07 11:37:03 8cc-offline-1 snmpd[61127]: NET-SNMP version 5.7.2 juin 07 11:37:03 8cc-offline-1 systemd[1]: Started Simple Network Management Protocol (SNMP) Daemon.. juin 07 11:37:06 8cc-offline-1 snmpd[61127]: refused smux peer: oid SNMPv2-SMI::enterprises.674.10892.1, descr Systems Management SNMP MIB Plug-in Manager juin 07 11:37:09 8cc-offline-1 snmpd[61127]: refused smux peer: oid SNMPv2-SMI::enterprises.674.10892.1, descr Systems Management SNMP MIB Plug-in Manager juin 07 11:37:12 8cc-offline-1 snmpd[61127]: refused smux peer: oid SNMPv2-SMI::enterprises.674.10892.1, descr Systems Management SNMP MIB Plug-in Manager
Solution
Solution 1
#echo "smuxpeer .1.3.6.1.4.1.674.10892.1 P@ssw0rd" >> /etc/snmp/snmpd.conf echo "smuxpeer .1.3.6.1.4.1.674.10892.1" >> /etc/snmp/snmpd.conf systemctl restart snmpd
Solution 2
/etc/sysconfig/snmpd
# snmpd command line options # '-f' is implicitly added by snmpd systemd unit file # OPTIONS="-LS0-6d" OPTIONS="-I -smux"
systemctl restart snmpd
Pleins de message "Connection from UDP" dans les logs
/var/log/syslog
Jul 18 01:08:07 plop snmpd[3232]: Connection from UDP: [192.168.15.27]:52799->[192.168.15.32] Jul 18 01:08:34 plop snmpd[3232]: Connection from UDP: [192.168.15.22]:53386->[192.168.15.32]
Solution
Remplacer -Lsd par -LSwd
/etc/default/snmpd
#SNMPDOPTS='-Lsd -Lf /dev/null -u snmp -g snmp -I -smux -p /var/run/snmpd.pid' SNMPDOPTS='-LSwd -Lf /dev/null -u snmp -g snmp -I -smux -p /var/run/snmpd.pid'
Ou
/etc/sysconfig/snmpd
#OPTIONS="-LS0-6d -Lf /dev/null -p /var/run/snmpd.pid" OPTIONS="-LSwd -Lf /dev/null -p /var/run/snmpd.pid"
ou
/etc/snmp/snmpd.conf
dontLogTCPWrappersConnects yes
puis restart du service
Autres
usmUser a été créer après le redémarrage de SNMPd suite à la commande createUser (SNMPv3)
Voir la commande snmpusm
snmptranslate
$ snmptranslate -M+. -m +ALL -On HOST-RESOURCES-MIB::hrProcessorTable
.1.3.6.1.2.1.25.3.3
$ snmptranslate -Td .1.3.6.1.4.1.2021.11.52
UCD-SNMP-MIB::ssCpuRawSystem
...
This object may sometimes be implemented as the
combination of the 'ssCpuRawWait(54)' and
'ssCpuRawKernel(55)' counters, so care must be
taken when summing the overall raw counters."
HP
Ajoutez la ligne suivante dans /etc/snmp/snmpd.conf :
/etc/snmp/snmpd.conf
dlmod cmaX /usr/lib64/libcmaX64.so
Redémarrez les services suivants :
systemctl restart hp-snmp-agents systemctl restart snmpd
Client
Voir :
snmpwalk
Voir aussi :
- snmpget
- snmpgetnext
Use the -On option, according to man snmpcmd
#snmpwalk -v2c -c public localhost snmpwalk -v2c -On -c public localhost
Exemples :
# snmpwalk -t "$timeout" -r "$retries" # '-Cc' Use this option to ignore number not increasing error snmpwalk -v2c -c public localhost system #snmpwalk -v <laversion> -c <lacommunaute> <adresseip> <oid> snmpwalk -v 2c -c public 192.168.1.13 1.3.6.1.2.1.2.2.1.10 snmpwalk -v 3 -u usersnmp -a SHA -A 'MonMot2Passe!!' -x AES -X '!!MaPhrase2PasseAE' -l authPriv localhost
Pour afficher l'arborescence « full-text » utliser l'option -Of
snmpwalk -Of ...
ATTENTION : En production ne faites JAMAIS une requête snmpwalk sur la racine de l’arbre SNMP ou sur un noeud de haut niveau. Si vous faites cela, vous allez saturer l’agent SNMP interrogé, le réseau et votre poste. Dans le passé, vous pouviez saturer certains agents SNMP et il était nécessaire de les redémarrer voire de redémarrer l’équipement. Ce pourrait être très gênant si vous deviez demander à l’équipe réseau de redémarrer un routeur.
snmpwalk -v2c -c public 192.168.1.13
Pour debug
snmpwalk -d -DAll
snmpget
#snmpget -v <laversion> -c <lacommunaute> <adresseip> <oid> snmpget -v 2c -c public 192.168.1.13 1.3.6.1.2.1.2.2.1.10.1 OID_STORAGE_DESC=.1.3.6.1.2.1.25.2.3.1.3 OID_STORAGE_SIZE=.1.3.6.1.2.1.25.2.3.1.5 OID_STORAGE_USED=.1.3.6.1.2.1.25.2.3.1.6 snmpget -r 2 -v 3 -a MD5 -A "$PASSWD" -l authNoPriv -u nagios -Oqv localhost $OID_STORAGE_DESC.${indice} snmpget -r 2 -v 3 -a MD5 -A "$PASSWD" -l authNoPriv -u nagios -Oqv localhost $OID_STORAGE_SIZE.${indice} snmpget -r 2 -v 3 -a MD5 -A "$PASSWD" -l authNoPriv -u nagios -Oqv localhost $OID_STORAGE_USED.${indice}
Nagios check_snmp
Exemple de supervision de ports sur un switch
/usr/local/nagios/etc/objects/commands.cfg
define command{ command_name check_port_com command_line $USER1$/check_snmp -H $HOSTADDRESS$ -P3 -L authNoPriv -a MD5 -U $USER3$ -A "$USER4$" -c 1,1 -o IF-MIB::ifOperStatus.$ARG1$ }
switch.cfg
define service{ use generic-service ; Inherit values from a template host_name linksys-srw224p service_description Port 1 Link Status check_command check_snmp!-C public -o ifOperStatus.1 -r 1 -m RFC1213-MIB }
/usr/local/nagios/etc/objects/switch.cfg
define service{ use EtatPortCom hostgroup_name RouteurSwitchs service_description EtatPortCom1 check_command check_port_com!1 #event_handler trigger_etatport!1 }
Lister les utilisateurs SNMPv3
snmpwalk .1.3.6.1.6.3.15.1.2.2.1.3
Ajout d'une MIB
Voir : https://github.com/simonjj/SnmpMibs
Logs Zabbix
MIB search path: /root/.snmp/mibs:/usr/share/snmp/mibs:/usr/share/snmp/mibs/iana:/usr/share/snmp/mibs/ietf:/usr/share/mibs/site:/usr/share/snmp/mibs:/usr/share/mibs/iana:/usr/share/mibs/ietf:/usr/share/mibs/netsnmp Cannot find module (DISMAN-EVENT-MIB): At line 1 in (none)
apt-get install snmp-mibs-downloader
La MIB sera installée ici : /var/lib/snmp/mibs/ietf/DISMAN-EVENT-MIB
Commenter mibs :
/etc/snmp/snmp.conf
#mibs :
snmptranslate -Tp
Pour DISMAN-EVENT-MIB le pb est résolu
Mais il reste CPQRACK-MIB et CPQIDA-MIB
Cannot find module (CPQRACK-MIB): At line 1 in (none) Cannot find module (CPQIDA-MIB): At line 1 in (none)
git clone https://github.com/simonjj/SnmpMibs cd SnmpMibs cp CPQ* /usr/share/snmp/mibs/ chmod a+r /usr/share/snmp/mibs/CPQ*
Notes
snmpget -t 1 -r 5 -M /usr/local/share/snmp/mibs -v 1 -c public 159.217.18.10:161 cpqRackCommonEnclosureTemp tcpdump -i any -s 0 host hp-array-1.0 and port 161 -n
snmpcheck
Il existe l'ancienne version écrit en Perl et une plus récente écrit en Ruby
Il ne faut pas confondre la commande snmpcheck de Debian (paquet snmp) avec la snmpcheck de http://www.nothink.org/codes/snmpcheck
Debian
apt-get install ruby-snmp
RedHat
yum install ruby gem install snmp
wget http://www.nothink.org/codes/snmpcheck/snmpcheck-1.9.rb chmod +x snmpcheck-1.9.rb ./snmpcheck.rb
nmap -sS 192.168.56.21 snmpcheck -h snmpcheck -t 192.168.56.21
qtmib
GUI SNMP MIB Browser for Linux platforms Liens : https://sourceforge.net/projects/qtmib/
The program comes with a large number of MIBs pre-installed, anything from Cisco’s and Juniper’s to HP’s and Dell’s. You can also install your own MIBs by copying them into ~/.config/qtmib/mibs directory.