AdminSysGNULinux

Outils pour utilisateurs

Outils du site

Piste : • blog
blog

Table des matières

4 billet(s) pour septembre 2026

Notes HTTP Strict Transport Security - HSTS2026/09/18 11:04Jean-Baptiste
Notes GNU Linux GPU carte graphiques2026/09/08 15:49Jean-Baptiste
Notes GNU Linux graphique2026/09/08 15:42Jean-Baptiste
Notes urlencoding - passer des mots de passe en HTTPS2026/09/03 17:58Jean-Baptiste

Notes Linux capabilities sécurité caps capsh setcap

Voir : 

man 7 capabilities
capsh --print
getpcaps $$
$ dpkg -L libcap-ng-utils | grep 'bin/'
/usr/bin/captest
/usr/bin/filecap
/usr/bin/netcap
/usr/bin/pscap

Voir :

tcpdump permission pour non-root

Autoriser les utilisateur non-root à utiliser tcpdump

NOTE : il est aussi possible d'utiliser le sudoer

Source : https://askubuntu.com/questions/530920/tcpdump-permissions-problem

Add a capture group and add yourself to it: 

sudo groupadd pcap
sudo usermod -a -G pcap $USER

Next, change the group of tcpdump and set permissions: 

sudo chgrp pcap /usr/sbin/tcpdump
sudo chmod 750 /usr/sbin/tcpdump

Finally, use setcap to give tcpdump the necessary permissions: 

sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

Be careful, that this will allow everybody from the group pcap to manipulate network interfaces and read raw packets!

PAM user

Voir :

  • /etc/security/capability.conf
  • libcap

Service SystemD

Exemple

coredns.service 

[Unit]
Description=CoreDNS Server
Documentation=https://coredns.io/manual/
After=network-online.target
Wants=network-online.target
 
[Service]
User=coredns
Group=coredns
AmbientCapabilities=CAP_NET_BIND_SERVICE
Restart=always
WorkingDirectory=/etc/coredns
ExecStart=/usr/bin/coredns 
ExecReload=/usr/bin/kill -USR1 $MAINPID
 
[Install]
WantedBy=multi-user.target

Source : https://gorbe.io/posts/coredns/install/

SyncThing - syncOwnership

Source : https://docs.syncthing.net/advanced/folder-sync-ownership 

sudo chown root /usr/local/bin/syncthing
sudo chmod 755 /usr/local/bin/syncthing
sudo setcap CAP_CHOWN,CAP_FOWNER=pe /usr/local/bin/syncthing

Autres

nerdctl run -ti --rm --cap-drop=all docker.io/jess/amicontained /bin/sh
crictl inspect 6142ce06b10d6
2025/03/24 15:06
,

Notes LightDM sddm

Voir aussi :

Sur Jessie 

# dpkg -l | grep -i lightdm
ii  liblightdm-gobject-1-0                                      1.10.3-3                                          amd64        simple display manager (gobject library)
ii  lightdm                                                     1.10.3-3                                          amd64        simple display manager
ii  lightdm-gtk-greeter                                         1.8.5-2                                           amd64        simple display manager (GTK+ greeter)

Configuration

Rédéfinir lightdm comme gestionnaire de session par défaut (sur Debian / Ubuntu) 

dpkg-reconfigure lightdm

Fichier de conf

/etc/lightdm/lightdm.conf 

[SeatDefaults]
# Fermer le port TCP en écoute
xdmcp-manager = false
xserver-allow-tcp=false
 
# Forcer un environnement de bureau particulier à l ouverture de session
user-session=mate
 
# Désactiver la session invité
allow-guest=false
 
# Ouverture de session automatique
autologin-user=jean
autologin-user-timeout=0
 
# Réactiver le login (utilisateur et mot de passe)
greeter-show-manual-login=true

SDDM

Autologon 

mkdir /etc/sddm.conf.d/

/etc/sddm.conf.d/autologin.conf 

[Autologin]
User=jean
Session=lxqt
2025/03/24 15:06
, , ,

Notes libvirt

Voir :

Voir aussi :

Install

apt-get install virt-manager virtinst qemu-utils

Install Ubuntu 

virt-install --connect qemu:///system \
--name ttest02 --ram 4096 --vcpus 1 
--vnc --virt-type kvm --machine pc \
--location http://archive.ubuntu.com/ubuntu/dists/xenial/main/installer-amd64/ \
--extra-args ksdevice=link,lang=,url=http://192.168.1.5/cblr/svc/op/ks/system/ttest02,text,auto-install/enable=true,priority=critical,ipv6.disable=1 \
--arch x86_64 --os-variant virtio26 --disk path=/var/lib/libvirt/images/ttest02-disk0,size=15,format=raw \
--network bridge=br0,mac='52:54:2e:f9:98:23' \
--wait -1 --noautoconsole

Network install Debian Preseed 

virt-install \
--name ttest02\
--ram 4096  \
--location=http://ftp.us.debian.org/debian/dists/stable/main/installer-amd64/ \
--initrd-inject=/tmp/preseed.cfg \
--extra-args="console=ttyS0,115200n8 serial locale=fr_FR console-setup/ask_detect=false keyboard-configuration/layoutcode=fr hostname=virtual domain=unassigned-domain interface=auto" \
--vcpu=1 \
--vnc \
--vnclisten=0.0.0.0 \
--os-type=linux \
--os-variant=debianwheezy \
-w bridge=virbr0 \
-w bridge=br1 \
-w network=default \
--console pty,target_type=serial \
--disk format=qcow2,size=8,bus=virtio,path=/var/lib/libvirt/images/vm1.qcow2

Install ISO Debian Preseed 

virt-install \
--name vm1 \
--ram 1024 \
--cdrom /tmp/debian10ps-kvm.iso \
--vcpu=1 \
--vnc \
--vnclisten=0.0.0.0 \
--os-type=linux \
--os-variant=debiantesting \
-w bridge=virbr0 \
-w network=default \
--console pty,target_type=serial \
--disk format=qcow2,size=20,bus=virtio,path=/var/lib/libvirt/images/vm1.qcow2 \
--boot uefi \
--wait=-1 --noautoconsole

Interface d'admin

WebUI - Cockpit

Voir : 

apt-get install cockpit cockpit-machines

Console graphique VNC

Connaitre le port 

Connexion VNC
virsh dumpxml ttest02 | grep vnc

Effacement

virsh destroy ttest02
virsh undefine ttest02
virsh undefine ttest02 --nvram

Pb effacement 

virsh # undefine --remove-all-storage --delete-snapshots vmplop
error: Failed to undefine domain vmplop
error: Requested operation is not valid: cannot delete inactive domain with 1 snapshots

Solution 

snapshot-delete --metadata --current vmplop

Réseau

DHCP avec adresses statiques

Tout d'abord, recherchez les adresses MAC des machines virtuelles auxquelles vous souhaitez attribuer des adresses IP statiques: 

virsh  dumpxml  $VM_NAME | grep 'mac address'

Puis éditez le réseau 

virsh  net-list
virsh  net-edit  $NETWORK_NAME    # Probably "default"

Trouvez le <dhcp> section, restreignez la plage dynamique et ajoutez des entrées d'hôte pour vos machines virtuelles 

<dhcp>
  <range start='192.168.122.100' end='192.168.122.254'/>
  <Host mac='52:54:00:6c:3c:01' name='vm1' ip='192.168.122.11'/>
  <Host mac='52:54:00:6c:3c:02' name='vm2' ip='192.168.122.12'/>
  <Host mac='52:54:00:6c:3c:03' name='vm3' ip='192.168.122.12'/>
</dhcp>

Recharger la conf réseau 

virsh  net-destroy  $NETWORK_NAME  
virsh  net-start    $NETWORK_NAME

Source : https://www.it-swarm.dev/fr/dhcp/kvm-libvirt-comment-configurer-des-adresses-ip-dinvites-statiques-sur-lhote-de-virtualisation/960375558/

kvm host to guest connections

Source : https://wiki.libvirt.org/page/TroubleshootMacvtapHostFail

/tmp/isolated.xml 

   <network>
     <name>isolated</name>
       <ip address='192.168.254.1' netmask='255.255.255.0'>
       <dhcp>
         <range start='192.168.254.2' end='192.168.254.254' />
       </dhcp>
     </ip>
   </network>
virsh net-define /tmp/isolated.xml
virsh net-start isolated
virsh net-autostart isolated
virsh edit vm-plop
   <interface type='network'>
     <source network='isolated'/>
     <model type='virtio'/> <-- This line is optional.
   </interface>
Bridge direct
virsh dumpxml vm1 | xpath -e '/domain/devices/interface[@type="direct"]'
<interface type="direct">
      <mac address="52:54:00:c1:02:bb" />
      <source dev="eno4" mode="bridge" />
      <target dev="macvtap0" />
      <model type="virtio" />
      <alias name="net0" />
      <address type="pci" domain="0x0000" bus="0x01" slot="0x00" function="0x0" />
</interface>

Disque

redimensionnement à chaud
# virsh dumpxml vm1 | xpath -q -e "/domain/devices/disk[@type='file']/alias"
<alias name="virtio-disk0" />
<alias name="sata0-0-0" />
virsh qemu-monitor-command vm1  block_resize drive-virtio-disk0 50G --hmp
Redimensionnement à froid
# virsh dumpxml vm1 | xpath -q -e "/domain/devices/disk[@type='file']/source/@file[1]"
 file="/var/lib/libvirt/images/vm1.qcow2"
qemu-img resize /var/lib/libvirt/images/vm1.qcow2 +10G
Lister les disques et leurs tailles
for VM in $(virsh list --all | awk '/^ [0-9-]/ {print $2}');  
do 
	echo VM_NAME: "$VM";
	virsh dumpxml $VM | xpath -q -e "/domain/devices/disk[@type='file']/source/@file[1]" | sed -e 's%^ file=%%g' | tr "\n" " " | xargs du -h
 	echo --------------;
done

VM

Clone

Cloner une VM 

virt-clone --original vm1 --name vm2 --auto-clone
Virsh reload xml config file
virsh define foo.xml
Connaître l'IP d'une VM

Voir aussi : https://www.cyberciti.biz/faq/find-ip-address-of-linux-kvm-guest-virtual-machine/ 

# virsh domiflist FRANCE_ACME_POC2
Interface  Type       Source     Model       MAC
-------------------------------------------------------
macvtap2   direct     enp2s0f0   virtio      52:54:00:c8:c0:b2
vnet2      network    ACME_FRANCE_V rtl8139     52:54:00:c8:b8:03

# tcpdump -nn ether host 52:54:00:c8:c0:b2
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp2s0f0, link-type EN10MB (Ethernet), capture size 262144 bytes
21:08:36.739541 IP 192.168.98.2.80 > 192.168.219.18.50777: Flags [P.], seq 2750428795:2750428825, ack 2413241637, win 119, length 30: HTTP
21:08:36.778206 IP 192.168.98.2.80 > 192.168.219.18.50772: Flags [P.], seq 3075508646:3075508995, ack 4236506059, win 119, length 349: HTTP
21:08:36.779166 IP 192.168.219.18.50772 > 192.168.98.2.80: Flags [.], ack 349, win 251, length 0
21:08:36.893545 IP 192.168.98.2.80 > 192.168.219.18.50772: Flags [P.], seq 349:373, ack 1, win 119, length 24: HTTP
21:08:36.939877 IP 192.168.219.18.50777 > 192.168.98.2.80: Flags [.], ack 30, win 256, length 0
arp -e

Voir aussi :

  • virsh domifaddr
  • virsh net-dhcp-leases

Pb

ERROR    Guest name 'ttest02' is already in use.

Solution : Effacer ! 

virsh undefine ttest02

IOMMU PCI_Passthrough

Voir :

Pour NVidia il faut cacher le PCI_Passthrough 

	<kvm>
	<hidden state='on'/>
	</kvm>

/etc/default/grub 

#GRUB_CMDLINE_LINUX_DEFAULT="quiet"
GRUB_CMDLINE_LINUX="quiet intel_iommu=on iommu=pt pci-stub.ids=10de:1b81,10de:10f1"

Err /usr/bin/qemu-system-x86_64: No such file or directory

Error starting domain: Cannot check QEMU binary /usr/bin/qemu-system-x86_64: No such file or directory

Solution 

apt-get update
apt-get purge qemu-system-x86
apt-get install qemu-kvm
apt-get install -f
2025/03/24 15:06

Notes LibreOffice

You can even start a macro of a specific document from a command line: 

soffice path/to/test.docx macro://./standard.module1.mymacro

Export / Conversion

Voir extension : Writer2xhtml

Correction orthographique - langue française - l10n

sudo apt-get install libreoffice-l10n-fr hyphen-fr mythes-fr hunspell-fr-classical #myspell-fr

Création / Édition

Voir :

2025/03/24 15:06

Notes LetsEncrypt certbot

install 

apt-get install certbot python3-certbot-nginx
#certbot certonly --standalone --rsa-key-size 4096 -d www.acme.fr --email root@acme.fr --agree-tos --no-eff-email
 
certbot --nginx -d www.acme.fr

crontab 

0 21 * * * certbot -q renew --nginx --post-hook "systemctl reload nginx"

Lister tous les certificats gérés par let'sencrypt 

certbot certificates

Effacer / décommissionner un certificat géré par let'sencrypt 

certbot delete --cert-name old.acme.fr

OLD

Voir :

Install

Exemple 1 

git clone --depth=1 https://github.com/certbot/certbot.git
cd certbot
./certbot-auto
#./certbot-auto --standalone --rsa-key-size 4096 -d www.acme.fr --email admin@acme.fr --agree-tos --no-eff-email

Exemple 2 

wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto
./certbot-auto

Usage

Exemple 1 

/opt/letsencrypt/letsencrypt-auto --authenticator standalone --installer apache -d mondomaine.fr --pre-hook "service apache2 stop" --post-hook "service apache2 start" --renew-by-default

Exemple 2 

./certbot-auto certonly --webroot --webroot-path /srv/www/domain.tld/ --domain domain.tld --domain www.domain.tld --email mon@email.com
2025/03/24 15:06
, , ,

<< Billets récents | Anciens billets >>

blog.txt · Dernière modification : de 127.0.0.1
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki