AdminSysGNULinux

Outils pour utilisateurs

Outils du site

Piste : • blog
blog

Table des matières

4 billet(s) pour septembre 2026

Notes HTTP Strict Transport Security - HSTS2026/09/18 11:04Jean-Baptiste
Notes GNU Linux GPU carte graphiques2026/09/08 15:49Jean-Baptiste
Notes GNU Linux graphique2026/09/08 15:42Jean-Baptiste
Notes urlencoding - passer des mots de passe en HTTPS2026/09/03 17:58Jean-Baptiste

Notes sécurité OS GNU/Linux hardening - partitions - noexec

Voir aussi :

FS noexec - Sécurité Montage Système de fichier

nodev,nosuid,noexec,ro 

echo "/var/tmp /tmp    none bind 0 0" >> /etc/fstab

/etc/apt/apt.conf.d/01PrePost 

DPkg {
        Pre-Invoke  { "mount /var -o remount,exec"; "mount /tmp -o remount,exec"; "mount /var/tmp -o remount,exec" };
        Post-Invoke { "mount /var -o remount,noexec"; "mount /tmp -o remount,noexec"; "mount /var/tmp -o remount,noexec"  };
};

Pour des raisons de sécurité, il est recommandé de monter /tmp en noexec cependant Debian à besoin des droits exec lors de mise-à-jour. Voici une solution :

/etc/apt/apt.conf.d/70debconf 

DPkg::Pre-Install-Pkgs {"mount -o remount,exec /tmp; /usr/sbin/dpkg-preconfigure --apt || true";};
DPkg::Post-Invoke {"mount -o remount /tmp";};

Pour plus de sécurité, on pourra monter certaines partitions avec des options particulières :

Partition Options de montage
/ noatime,ro
/boot noatime,nodev,nosuid,noexec,ro
/tmp noatime,nodev,nosuid,noexec
/usr noatime,nodev,ro
/var noatime,nodev,nosuid,noexec
/home noatime,nodev,nosuid noexec,usrquota,grpquota

Noatime : Pour toutes les partitions. Voir debian_noatime Nodev : Pour toutes les partitions sauf /dev Nosuid : Pour toutes les partitions sauf / et /usr Noexec : Pour /tmp et /run/shm (pour /run/shm c'est normalement le cas par défaut). Si possible aussi pour /var ro : / et /usr 

# Dev
find / \( -type b -o -type c \) -not -wholename "/dev/*"
# Suid
find / -type f -perm /a+s
# Partition /run/shm ou /dev/shm. Doit-être en nosuid,nodev,noexec
mount | grep shm

A tester 

/lib64/ld-linux-x86-64.so.2 /bin/echo "Plop"
2025/03/24 15:06
, , ,

Notes seafile avec Nginx sous Debian

Voir aussi :

  • rclone
  • directive sendfile_max_chunk pour Nginx

Votre navigateur doit envoyer le “Referer” HTTP. Si besoin utiliser pour Firefox RefControl

Liens : 

adduser --group --system --disabled-password seafile
apt-get install python-setuptools python-imaging

/etc/nginx/sites-available/seafile.acme.fr 

server {
        listen 80;
        server_name seafile.acme.fr;
        rewrite ^ https://$server_name$request_uri? permanent;
}
 
server {
        listen 443 ssl;
        server_name seafile.acme.fr;
        ssl_certificate /etc/ssl/private/acme.crt+chain;
        ssl_certificate_key /etc/ssl/private/acme.fr.key;
 
        access_log /var/log/nginx/access_seafile_log;
        error_log /var/log/nginx/error_seafile_log;
 
        proxy_set_header X-Forwarded-For $remote_addr;
 
        location / {
                proxy_bind http://127.0.0.1:8080 ;
#                fastcgi_pass    127.0.0.1:8000;
#                fastcgi_param   HTTPS               on;
#                fastcgi_param   HTTP_SCHEME         https;
#                fastcgi_param   SCRIPT_FILENAME     $document_root$fastcgi_script_name;
#                fastcgi_param   PATH_INFO           $fastcgi_script_name;
#                fastcgi_param   SERVER_PROTOCOL     $server_protocol;
#                fastcgi_param   QUERY_STRING        $query_string;
#                fastcgi_param   REQUEST_METHOD      $request_method;
#                fastcgi_param   CONTENT_TYPE        $content_type;
#                fastcgi_param   CONTENT_LENGTH      $content_length;
#                fastcgi_param   SERVER_ADDR         $server_addr;
#                fastcgi_param   SERVER_PORT         $server_port;
#                fastcgi_param   SERVER_NAME         $server_name;
#                fastcgi_param   REMOTE_ADDR         $remote_addr;
        }
 
        location /seafhttp {
                rewrite ^/seafhttp(.*)$ $1 break;
                proxy_pass http://127.0.0.1:8082;
                #include         /etc/nginx/proxy_params;
                client_max_body_size 0;
                proxy_request_buffering off;
                proxy_connect_timeout  36000s;
                proxy_read_timeout  36000s;
                proxy_send_timeout  36000s;
        }
 
        location /media {
                root /var/www/seafile/seafile-server-latest/seahub ;
        }
}

Derrière un reverse proxy Nginx

On NGINX Reverse-proxy Server

/etc/nginx/sites-available/files2.acme.fr 

server {
        listen 80;
        server_name files2.acme.fr www.files2.acme.fr;
        rewrite ^ https://$server_name$request_uri? permanent;
}
 
server {
        listen 443 ssl;
        server_name files2.acme.fr www.files2.acme.fr;
 
        ssl_certificate /etc/nginx/ssl/nginx.crt;
        ssl_certificate_key /etc/nginx/ssl/nginx.key;
        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
 
        server_tokens off;
        proxy_set_header X-Forwarded-For $remote_addr;
 
        access_log /var/log/nginx/access_seafile_log;
        error_log /var/log/nginx/error_seafile_log;
 
        client_max_body_size 0;
        #client_body_buffer_size 128k;
 
        location /seafhttp {
                rewrite ^/seafhttp(.*)$ $1 break;
                proxy_pass http://192.168.15.149:8082;
                client_max_body_size 0;
                #proxy_request_buffering off;
                proxy_connect_timeout  36000s;
                proxy_read_timeout  36000s;
                proxy_send_timeout  36000s;
 
        }
 
 
        location / {
                proxy_pass http://192.168.15.149:8000;
#                fastcgi_pass    192.168.15.149:8000;
#                fastcgi_param   HTTPS               on;
#                fastcgi_param   HTTP_SCHEME         https;
#                fastcgi_param   SCRIPT_FILENAME     $document_root$fastcgi_script_name;
#                fastcgi_param   PATH_INFO           $fastcgi_script_name;
#                fastcgi_param   SERVER_PROTOCOL    $server_protocol;
#                fastcgi_param   QUERY_STRING        $query_string;
#                fastcgi_param   REQUEST_METHOD      $request_method;
#                fastcgi_param   CONTENT_TYPE        $content_type;
#                fastcgi_param   CONTENT_LENGTH      $content_length;
#                fastcgi_param   SERVER_ADDR        $server_addr;
#                fastcgi_param   SERVER_PORT        $server_port;
#                fastcgi_param   SERVER_NAME        $server_name;
#                fastcgi_param   REMOTE_ADDR         $remote_addr;
        }
 
        location /media {
                #root /var/www/html/seafile-server-latest/seahub/ ;
                proxy_pass http://192.168.15.149:8081;
                include /etc/nginx/proxy_params;
        }
 
}

On FILE Server

/etc/nginx/sites-enabled/file2.acme.fr 

server {
        listen 8081;
 
        access_log /var/log/nginx/access_seafile_log;
        error_log /var/log/nginx/error_seafile_log;
 
        server_tokens off;
 
        location /media {
                root /var/www/html/seafile-server-latest/seahub/ ;
        }
}

conf/seafile.conf 

[fileserver]
port=8082
host=0.0.0.0

conf/ccnet.conf 

SERVICE_URL = https://files2.acme.fr

conf/seahub_settings.py 

FILE_SERVER_ROOT = 'https://files2.acme.fr/seafhttp'
su - www-data -s /bin/bash
./seafile.sh start
export SEAFILE_FASTCGI_HOST='0.0.0.0'
./seahub.sh start-fastcgi
ln -s seafile-server-5.1.1 seafile-server-latest
cd seafile-server-latest
./setup-seafile.sh

~/conf/ccnet.conf 

[General]
SERVICE_URL = https://seafile.acme.fr

~/conf/seafile.conf 

[fileserver]
port=8083

~/conf/seahub_settings.py 

FILE_SERVER_ROOT = 'https://seafile.acme.fr/seafhttp'
 
EMAIL_USE_TLS = False
EMAIL_HOST = 'localhost'
#EMAIL_HOST_USER = 'root@acme.fr'    # username and domain
#EMAIL_HOST_PASSWORD = 'password'    # password
EMAIL_PORT = 25
#DEFAULT_FROM_EMAIL = EMAIL_HOST_USER
DEFAULT_FROM_EMAIL = 'contact@acme.fr'
#SERVER_EMAIL = EMAIL_HOST_USER
SERVER_EMAIL = 'contact@acme.fr'
./seafile.sh start
./seahub.sh start-fastcgi 8003

Clients

Liens :

2025/03/24 15:06
, , , ,

Notes install Seafile Apache RedHat7 Memcached MySQL/MariaDB

Install Seafile avec MySQL / MariaDB

MySQL doit être démarré

Voir : 

yum install python-distribute python-imaging MySQL-python python-memcached python-ldap
 
#adduser --system seafile --shell /sbin/nologin -m
adduser --group --system --disabled-password seafile
su - seafile -s /bin/bash
 
mkdir foo1
cd foo1
wget https://bintray.com/artifact/download/seafile-org/seafile/seafile-server_5.1.2_x86-64.tar.gz
tar xvf ../seafile-server_5.1.2_x86-64.tar.gz
 
Seafile avec MySQL Voir http://manual.seafile.com/deploy/using_mysql.html
 
./setup-seafile-mysql.sh

La 1er fois lancer 

./seafile.sh start

Puis (c'est à cette étape que compte admin sera crée) ./seahub.sh start <port> Site Web. Port par défaut : TCP 8000 

./seahub.sh start

Arrêt 

./seahub.sh stop
./seafile.sh stop

Install de memcached

Voir http://manual.seafile.com/deploy/add_memcached.html 

yum install memcached
systemctl enable memcached
systemctl start memcached

seahub_settings.py 

CACHES = {
    'default': {
        'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
        'LOCATION': '127.0.0.1:11211',
    }
}

Conf Apache

Voir http://manual.seafile.com/deploy/deploy_with_apache.html

/etc/httpd/conf.d/sea-foo1.conf 

<VirtualHost *:80>
    ServerName www.myseafile.com
    # Use "DocumentRoot /var/www/html" for Centos/Fedora
    # Use "DocumentRoot /var/www" for Ubuntu/Debian
    DocumentRoot /var/www/html
    Alias /media  /home/seafile/foo1/seafile-server-latest/seahub/media
 
    RewriteEngine On
 
    <Location /media>
        Require all granted
    </Location>
 
    #
    # seafile fileserver
    #
    ProxyPass /seafhttp http://127.0.0.1:8082 # retry=0
    ProxyPassReverse /seafhttp http://127.0.0.1:8082
    RewriteRule ^/seafhttp - [QSA,L]
 
    # WebDAV
    # We use http proxy, since SeafDAV is incompatible with FCGI proxy in Apache 2.4.
    #
    ProxyPass /seafdav http://127.0.0.1:8080/seafdav # retry=0
    ProxyPassReverse /seafdav http://127.0.0.1:8080/seafdav
 
    #
    # seahub
    #
    SetEnvIf Request_URI . proxy-fcgi-pathinfo=unescape
    SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
    ProxyPass / fcgi://127.0.0.1:8000/ # retry=0
</VirtualHost>
./seafile.sh start
./seahub.sh start-fastcgi

Conf Webdav (Lecteur réseau)

http://manual.seafile.com/extension/webdav.html

Voir conf Apache au dessus

conf/seafdav.conf 

[WEBDAV]
enabled = true
port = 8080
fastcgi = false
share_name = /seafdav
2025/03/24 15:06
, , , ,

Notes script bash

Voir

Voir aussi :

  • tinyramfs (implémentation initramfs écrite en shell POSIX

Variables

Fichier dans une variable - variable heredoc
ETCHOSTS=$(cat << 'EOF'
10.245.97.221      node1
10.245.102.221     node1b
EOF
)

Les boucles

Voir aussi :

For
for (( i=1; $i<=10; i=i+1 ))
do
    echo $i
done

Voir exemple avec seq ci-dessous

seq
#for i in $(seq 10)
for i in $(seq 1 10)
do
  echo $i
done
for i in {1..5}
do
  echo $i
done
seq -f "%f" 3 0.8. 6
seq -f "%g/04/2018" 10
seq -s - 8
pb curl break

fic.lst 

foo
bar

plop_sleep.sh 

#! /bin/bash
 
while read -r var
do
        echo $var
        timeout 1 sleep inf
done < fic.lst

plop_curl.sh 

#! /bin/bash
 
while read -r var
do
        echo $var
        timeout 1 curl -s telnet://localhost:22
done < fic.lst
$ ./plop_sleep.sh
foo
bar

$ ./plop_curl.sh
foo

Contournement

plop_curl_2.sh 

#! /bin/bash
 
while read -r var
do
        echo $var
        echo timeout 1 curl -s telnet://localhost:22 | bash -s --
done < fic.lst

Vraie solution

plop_curl_2.sh 

#! /bin/bash
 
while read -r var
do
        echo $var
        timeout 1 curl -s telnet://localhost:22 </dev/null
done < fic.lst
Gérer les locks
flock -n /tmp/plop.lock -c /opt/plop1.sh -c /opt/plop2.sh

bash Options

Bash suid binary privilege escalation
sudo cp -p /usr/bin/bash /usr/bin/bash-backdoor
sudo chmod u+s /usr/bin/bash-backdoor
/usr/bin/bash-backdoor -p
2025/03/24 15:06
,

Notes scp

Voir :

Voir aussi :

  • sftp

Remote to remote 

#scp -3 -P 2222 ruser1@rhost1:/rpath/1 scp://ruser2@rhost2:2222//rpath/2
 
# Chemin absolut
scp -3 scp://ruser1@rhost1:2222//rpath/1 scp://ruser2@rhost2:2222//rpath/2
 
# Chemin relatif
scp -3 scp://ruser1@rhost1:2222/rpath/1 scp://ruser2@rhost2:2222/rpath/2

Scp avec Windows 

sshpass -e scp -P 2222 administrateur@192.168.1.20:c:/Temp/plop.txt /tmp
2025/03/24 15:06
, ,

<< Billets récents | Anciens billets >>

blog.txt · Dernière modification : de 127.0.0.1
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki