SE5 IdO sécurité des objets 2025/2026 b3

Création de la machine virtuelle

xen-create-image --hostname=SE5-handrian --dhcp --bridge=bridgeStudents --dir=/usr/local/xen --size=10GB --dist=daedalus --memory=1024M

Configuration VM

# This file describes the network interfaces available on your system

# and how to activate them. For more information, see interfaces(5).

# The loopback network interface

auto lo

iface lo inet loopback

# The primary network interface

auto eth0

iface eth0 inet static

       address 172.26.145.111

       netmask 255.255.255.0

       gateway 172.26.145.251

       dns-nameservers 172.26.145.251

#VLAN411

auto eth1

iface eth1 inet static

       address 172.16.11.0

       netmask 255.255.255.0  

Capbreton

#  Networking

#

dhcp        = 'dhcp'

vif         = [ 'mac=00:16:3E:1A:68:1E,bridge=bridgeStudents' ,

       'mac=00:16:3E:1A:68:1F,bridge=g3_handrian']

#

Configuration

auto Trunk.411

iface Trunk.411 inet manual

       vlan-raw-device Trunk

       up ip link set $IFACE up

       down ip link set $IFACE down

auto g3_handrian

iface g3_handrian inet manual

   bridge_ports Trunk.411

   up ip link set $IFACE up

   down ip link set $IFACE down

Sécurisation WiFi par WPA2-PSK

dot11 ssid SE5-handrian
  vlan 411
  authentication open
  authentication key-management wpa
  wpa-psk ascii 0 " "
  mbssid guest-mode
exit
interface Dot11Radio1
  encryption vlan 411 mode ciphers aes-ccm
  ssid SE5-handrian
  mbssid
  no shutdown
exit

interface Dot11Radio1.411
  encapsulation dot1Q 411
  bridge-group 11
exit

interface GigabitEthernet0.411
  encapsulation dot1Q 411
  bridge-group 11
exit

Pour vérifier : ap# sh dot11 bssid

ap#sh dot11 bssid                                                               
Interface      BSSID         Guest  SSID                                        
Dot11Radio1   04da.d2d1.4bf0  Yes  SE5-azongo                                   
Dot11Radio1   04da.d2d1.4bf1  Yes  SE5-crhanim                                  
Dot11Radio1   04da.d2d1.4bf2  Yes  SE5-handrian

Installer isc-dhcp-server dans la VM  : /etc/dhcp/dhcpd.conf

subnet 172.16.11.0 netmask 255.255.255.0 {
  range 172.16.11.100 172.16.11.200;
  option routers 172.16.11.1;
  #option routers rtr-239-0-1.example.org, rtr-239-0-2.example.org;
  option domain-name-servers 172.16.11.1;
}

dans /etc/default/isc-dhcp-server : INTERFACESv4="eth1"

dans /etc/sysctl.conf : décommenter : net.ipv4.ip_forward=1

sysctl -p /etc/sysctl.conf : pour recharger configuration sysctl.

sysctl net.ipv4.ip_forward : pour vérifier

Redirection par DNS

Modification du fichier /etc/bind/named.conf.local

//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

zone "wikipedia.org" {
        type master;
        file "/etc/bind/db.wikipedia.org";
};

Création de la zone db.wikipedia.org

$TTL    604800
@       IN      SOA     ns.wikipedia.org. admin.wikipedia.org. (
                             10         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      ns.wikipedia.org.
ns      IN      A       172.16.11.1
@       IN      A       172.16.11.1
www     IN      A       172.16.11.1

Redirection réseau

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 8080

iptables -t nat -L -n -v