{"id":280,"date":"2017-06-24T12:17:09","date_gmt":"2017-06-24T10:17:09","guid":{"rendered":"http:\/\/communaute-omr.fr\/?p=280"},"modified":"2026-07-13T22:34:44","modified_gmt":"2026-07-13T20:34:44","slug":"securiser-son-serveur-dedie-proxmox-avec-iptables","status":"publish","type":"post","link":"https:\/\/communaute-omr.fr\/?p=280","title":{"rendered":"S\u00e9curiser son serveur d\u00e9di\u00e9 proxmox avec iptables"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Preambule\"><\/span>Pr\u00e9ambule<span class=\"ez-toc-section-end\"><\/span><\/h1>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"But_de_cet_article\"><\/span>But de cet article<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Dans cette article nous allons mettre en place une solution bas\u00e9e sur iptables-persistent et fail2ban afin de s\u00e9curiser notre serveur.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A la fin de l&rsquo;article :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Notre serveur h\u00f4te :\n<ul class=\"wp-block-list\">\n<li>Bloquera les diff\u00e9rentes attaques du grand internet. Il faut le reconna\u00eetre qu&rsquo;elles viennent souvent de Chine, de Russie ou d&rsquo;Inde.<\/li>\n\n\n\n<li>Fera du NAT pour permettre de se connecter aux VM via internet.<\/li>\n\n\n\n<li>Permettra aux VM de se connecter \u00e0 internet pour les mises \u00e0 jour.<\/li>\n\n\n\n<li>Permettra aux VM de communiquer entre elles.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Les VM :\n<ul class=\"wp-block-list\">\n<li>Auront acc\u00e8s \u00e0 internet.<\/li>\n\n\n\n<li>Accepteront les connexion SSH sur un pour d\u00e9di\u00e9 pour l&rsquo;administration<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<!--more-->\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Architecture_mise_en_place\"><\/span>Architecture mise en place<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Nous avons besoin :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>D&rsquo;un serveur avec\n<ul class=\"wp-block-list\">\n<li>Une IP publique<\/li>\n\n\n\n<li>Une ip locale (dans notre cas ce sera 192.168.122.1)<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Plusieurs VM avec :\n<ul class=\"wp-block-list\">\n<li>Une interface r\u00e9seau pour le r\u00e9seau local<\/li>\n\n\n\n<li>Une interface r\u00e9seau pour l&rsquo;acc\u00e8s internet<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Plan d&rsquo;adressage :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Chaque vm aura 2 IP.<\/li>\n\n\n\n<li>Le port ssh sera d\u00e9fini par l&rsquo;ip local de la VM . L&rsquo;ip 192.168.122.XXX donnera le port SSH XXX22<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;<\/p>\n\n\n\n<h1 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Premiere_configuration\"><\/span>Premi\u00e8re configuration<span class=\"ez-toc-section-end\"><\/span><\/h1>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Configuration_de_base_iptables\"><\/span>Configuration de base iptables<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\"># Vider les tables actuelles<br\/>iptables -t filter -F<br\/><br\/># Vider les r\u00f4les personnelles<br\/>iptables -t filter -X<br\/><br\/># Interdire toute connexion entrante et sortante<br\/>iptables -t filter -P INPUT DROP<br\/>iptables -t filter -P FORWARD DROP<br\/>iptables -t filter -P OUTPUT DROP<br\/><br\/># ---<br\/><br\/># Ne pas casser les connexions etablies<br\/>iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT<br\/>iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT<br\/><br\/># Autoriser loopback<br\/>iptables -t filter -A INPUT -i lo -j ACCEPT<br\/>iptables -t filter -A OUTPUT -o lo -j ACCEPT<br\/><br\/># ICMP (Ping)<br\/>iptables -t filter -A INPUT -p icmp -j ACCEPT<br\/>iptables -t filter -A OUTPUT -p icmp -j ACCEPT<br\/><br\/># ---<br\/><br\/># Autoriser les connexion ssh<br\/>iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT<br\/>iptables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT<br\/><br\/># DNS In\/Out<br\/>iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT<br\/>iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT<br\/>iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT<br\/>iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT<br\/><br\/># NTP Out<br\/>iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT<br\/><br\/># Autoriser les connexions HTTP   HTTPS <br\/>iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT<br\/>iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT<br\/>iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT<br\/>iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT<br\/>iptables -t filter -A INPUT -p tcp --dport 8443 -j ACCEPT<br\/><br\/># Autoriser les connexions \u00e0 l&#039;interface Proxmox<br\/>iptables -t filter -A INPUT -p tcp --dport 8006 -j ACCEPT<br\/>iptables -t filter -A OUTPUT -p tcp --dport 8006 -j ACCEPT<br\/><br\/># Autoriser les connexions FTP<br\/>iptables -t filter -A OUTPUT -p tcp --dport 20:21 -j ACCEPT<br\/>iptables -t filter -A INPUT -p tcp --dport 20:21 -j ACCEPT<br\/>iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT<br\/><br\/># Autoriser les connexions au serveur Mail SMTP:25<br\/>iptables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT<br\/>iptables -t filter -A OUTPUT -p tcp --dport 25 -j ACCEPT<br\/><br\/># Autoriser les connexions au serveur Mail POP3:110<br\/>iptables -t filter -A INPUT -p tcp --dport 110 -j ACCEPT<br\/>iptables -t filter -A OUTPUT -p tcp --dport 110 -j ACCEPT<br\/><br\/># Autoriser les connexions au serveur Mail IMAP:143<br\/>iptables -t filter -A INPUT -p tcp --dport 143 -j ACCEPT<br\/>iptables -t filter -A OUTPUT -p tcp --dport 143 -j ACCEPT<br\/><br\/># Autoriser les connexions au serveur Mail POP3S:995<br\/>iptables -t filter -A INPUT -p tcp --dport 995 -j ACCEPT<br\/>iptables -t filter -A OUTPUT -p tcp --dport 995 -j ACCEPT<br\/><br\/># Protection contre les flood<br\/>iptables -A FORWARD -p tcp --syn -m limit --limit 1\/second -j ACCEPT<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Installation_des_outils_complementaires\"><\/span>Installation des outils compl\u00e9mentaires<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"iptables-persistent\"><\/span>iptables-persistent<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Installation de iptables-persistent<\/h4>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">apt-get install iptables-persistent<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">A l&rsquo;installation on vous demande d&rsquo;activer ou pas IP V6.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ATTENTION : Depuis debian 8, les services sont g\u00e9r\u00e9s via systemctl et le nom du service change \u00e9galement.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">D\u00e9marrage du service iptables-persistent<\/h4>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">service netfilter-persistent start<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<h4 class=\"wp-block-heading\">Sauvegarde des r\u00e8gles iptables de base<\/h4>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">iptables-save &gt; \/etc\/iptables\/rules.v4<br\/>service netfilter-persistent restart<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;<\/p>\n\n\n\n<h1 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Autoriser_les_VM_a_acceder_a_internet\"><\/span>Autoriser les VM \u00e0 acc\u00e9der \u00e0 internet<span class=\"ez-toc-section-end\"><\/span><\/h1>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Presentation_de_la_configuration_Reseau\"><\/span>Pr\u00e9sentation de la configuration R\u00e9seau<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Afin de permettre aux VM de pouvoir communiquer avec le grand internet tout puissant :), Une interface virtuelle \u00ab\u00a0bridg\u00e9e\u00a0\u00bb sur l&rsquo;interface principale est cr\u00e9\u00e9e, comme le montre la capture ci-dessous :<\/p>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">vmbr0     Link encap:Ethernet  HWaddr 14:18:77:5f:0c:d2<br\/>          inet addr:WWW.XXX.YYY.ZZZ  Bcast:WWW.XXX.YYY.255  Mask:255.255.255.0<br\/>          inet6 addr: <br\/> Scope:Link<br\/>          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1<br\/>          RX packets:17080091 errors:0 dropped:4173 overruns:0 frame:0<br\/>          TX packets:3969016 errors:0 dropped:0 overruns:0 carrier:0<br\/>          collisions:0 txqueuelen:1000<br\/>          RX bytes:3780244041 (3.5 GiB)  TX bytes:3224313133 (3.0 GiB)<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Comme indiqu\u00e9 en pr\u00e9ambule de cet article nous souhaitons avoir un sous r\u00e9seau pour nos VM. Pour ce faire nous allons cr\u00e9er une deuxieme interface virtuelle.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Creation_dune_interface_virtuelle\"><\/span>Cr\u00e9ation d&rsquo;une interface virtuelle<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Nous allons donc ajouter dans le fichier&nbsp;<strong>\/etc\/network\/interfaces<\/strong> l&rsquo;interface vmbr1 qui permettra aux VM de communiquer avec notre serveur proxmox via le sous r\u00e9seau.<\/p>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">auto vmbr1<br\/>iface vmbr1 inet static<br\/>        address  192.168.122.1<br\/>        netmask  255.255.255.0<br\/>        bridge_ports none<br\/>        bridge_stp off<br\/>        bridge_fd 0<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Une fois le fichier \u00e0 jour il faut d\u00e9marrer notre interface nouvellement cr\u00e9er. Notre r\u00e9seau local aura donc une plage de 192.168.122.0\/32.<\/p>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">ifup vmbr1<br\/><br\/>Waiting for vmbr1 to get ready (MAXWAIT is 2 seconds).<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Comme nous avons autoris\u00e9 ICMP dans iptables, nous pouvons donc faire un ping sur notre nouvelle interface pour en v\u00e9rifier son bon fonctionnement<\/p>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">ping 192.168.122.1<br\/>PING 192.168.122.1 (192.168.122.1) 56(84) bytes of data.<br\/>64 bytes from 192.168.122.1: icmp_seq=1 ttl=64 time=0.031 ms<br\/>64 bytes from 192.168.122.1: icmp_seq=2 ttl=64 time=0.039 ms<br\/>64 bytes from 192.168.122.1: icmp_seq=3 ttl=64 time=0.045 ms<br\/>^C<br\/>--- 192.168.122.1 ping statistics ---<br\/>3 packets transmitted, 3 received, 0% packet loss, time 1998ms<br\/>rtt min\/avg\/max\/mdev = 0.031\/0.038\/0.045\/0.007 ms<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Autoriser_nos_VM_a_se_connecter_a_internet\"><\/span>Autoriser nos VM \u00e0 se connecter \u00e0 internet<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Comme expliqu\u00e9 plus haut :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>L&rsquo;ip publique, dont l&rsquo;acc\u00e8s \u00e0 internet se fait via l&rsquo;interface r\u00e9seau vmbr0<\/li>\n\n\n\n<li>L&rsquo;ip locale de notre serveur est sur l&rsquo;interface vmbr1<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">il faut donc autoriser notre plage d&rsquo;ip locale \u00e0 acc\u00e9der \u00e0 internet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Etape 1 : on autorise les entr\u00e9es et le transfert des paquets depuis l&rsquo;interface vmbr0<\/p>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">iptables -t filter -A INPUT -i vmbr0 -j ACCEPT<br\/>iptables -t filter -A FORWARD -i vmbr0 -j ACCEPT<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Etape 2 : on fait du masquerade sur les interfaces et la plage d&rsquo;adresse locale :<\/p>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">iptables -t nat -A POSTROUTING -o vmbr0 -j MASQUERADE<br\/>iptables -t nat -A POSTROUTING -o vmbr1 -j MASQUERADE<br\/>iptables -t nat -A POSTROUTING -s 192.168.122.0\/32 -o vmbr0 -j MASQUERADE<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">A partir de la nous pouvons tester un update sur une de nos VM pour contr\u00f4ler que les paquets se mettent bien \u00e0 jour.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Permettre_les_connexions_ssh_sur_les_VM_depuis_internet\"><\/span>Permettre les connexions ssh sur les VM depuis internet<span class=\"ez-toc-section-end\"><\/span><\/h1>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Les_regles_a_mettre_en_place\"><\/span>Les r\u00e8gles \u00e0 mettre en place<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Nous devons avoir un port ssh d\u00e9di\u00e9 pour chaque VM<\/li>\n\n\n\n<li>Le port d\u00e9di\u00e9 sera redirig\u00e9 vers le port ssh de la VM<\/li>\n\n\n\n<li>Le port ssh de la VM devra r\u00e9pondre sur le port d\u00e9di\u00e9 du serveur h\u00f4te<\/li>\n\n\n\n<li>L&rsquo;ip publique devra \u00eatre \u00ab\u00a0nat\u00e9e\u00a0\u00bb vers l&rsquo;ip locale de la VM<\/li>\n\n\n\n<li>Pour des raisons de commodit\u00e9 la plage r\u00e9elle des VM commencera \u00e0 100 (La raison principale est ci-dessous).<\/li>\n\n\n\n<li>Le dernier digit de l&rsquo;ip de la VM d\u00e9termine le port ssh publique de la VM\n<ul class=\"wp-block-list\">\n<li>Donc la VM ayant l&rsquo;adresse IP locale 192.168.122.<strong>100<\/strong> aura comme port ssh publique <strong>100<\/strong>22<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Mise_en_place_des_regles\"><\/span>Mise en place des r\u00e8gles<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h4 class=\"wp-block-heading\">Etape 1 : Autoriser la redirection sur le port ssh de la VM.<\/h4>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">iptables -t filter -A FORWARD -d 192.168.122.100\/32 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Etape 2 : on redirige le port ssh et l&rsquo;ip public vers le port ssh et l&rsquo;ip locale de la VM<\/h4>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">iptables -t nat -A PREROUTING -d XXX.XXX.XXX.XXX\/32 -p tcp -m tcp --dport 10022 -j DNAT --to-destination 192.168.122.100:22<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<h4 class=\"wp-block-heading\">Etape 4 : On sauve les r\u00e8gles dans iptables-persistent<\/h4>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">iptables-save &gt; \/etc\/iptables\/rules.v4<br\/>service netfilter-persistent restart<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<h4 class=\"wp-block-heading\">Etape 5 : On configure les interfaces r\u00e9seau de la VM<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Si vous n&rsquo;avais pas configurer les 2 interfaces de votre VM vous devrais le faire manuellement<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>interface eth0 en DHCP (nat vers vmbr0)<\/li>\n\n\n\n<li>interface eth1 en ipfixe (Bridge vers vmbr1)<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Etape 6 : On configure putty pour se connecter au serveur<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Les champs n\u00e9cessaires :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IP du serveur h\u00f4te<\/li>\n\n\n\n<li>port ssh publique<\/li>\n\n\n\n<li>identifiant de connexion<\/li>\n\n\n\n<li>mot de passe de connexion<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Une fois la connexion \u00e9tablie la commande ifconfig nous confirmeras que l&rsquo;interface avec l&rsquo;ip locale est bien active<\/p>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">ifconfig eth1<br\/>eth1      Link encap:Ethernet  HWaddr 22:72:12:40:BE:E0<br\/>          inet addr:192.168.122.100  Bcast:192.168.122.255  Mask:255.255.255.0<br\/>          inet6 addr: fe80::2072:12ff:fe40:bee0\/64 Scope:Link<br\/>          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1<br\/>          RX packets:326 errors:7 dropped:0 overruns:0 frame:7<br\/>          TX packets:320 errors:0 dropped:0 overruns:0 carrier:0<br\/>          collisions:0 txqueuelen:1000<br\/>          RX bytes:36856 (35.9 KiB)  TX bytes:37628 (36.7 KiB)<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<h1 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Pour_aller_plus_loin\"><\/span>Pour aller plus loin<span class=\"ez-toc-section-end\"><\/span><\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Nous venons de configurer les acc\u00e8s \u00e0 notre serveur et \u00e0 ses VM.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nous pouvons aller plus loin en se prot\u00e9geant des attaques du grand internet grace \u00e0&nbsp;<a href=\"http:\/\/communaute-omr.fr\/2017\/06\/24\/installation-et-configuration-de-fail2ban\/\">fail2ban<\/a><\/p>\n\n\n\n<h1 class=\"wp-block-heading\"><\/h1>\n","protected":false},"excerpt":{"rendered":"<p>Pr\u00e9ambule But de cet article Dans cette article nous allons mettre en place une solution bas\u00e9e sur iptables-persistent et fail2ban afin de s\u00e9curiser notre serveur. A la fin de l&rsquo;article :<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[4,20],"tags":[],"class_list":["post-280","post","type-post","status-publish","format-standard","hentry","category-linux","category-securite"],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false},"uagb_author_info":{"display_name":"admin","author_link":"https:\/\/communaute-omr.fr\/?author=1"},"uagb_comment_info":0,"uagb_excerpt":"Pr\u00e9ambule But de cet article Dans cette article nous allons mettre en place une solution bas\u00e9e sur iptables-persistent et fail2ban afin de s\u00e9curiser notre serveur. A la fin de l&rsquo;article :","_links":{"self":[{"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=\/wp\/v2\/posts\/280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=280"}],"version-history":[{"count":19,"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=\/wp\/v2\/posts\/280\/revisions"}],"predecessor-version":[{"id":1056,"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=\/wp\/v2\/posts\/280\/revisions\/1056"}],"wp:attachment":[{"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=280"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=280"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}