3) Sécurité Réseau & Cyber

# nftables — squelette IPv4/IPv6
nft add table inet filter
nft 'add chain inet filter input { type filter hook input priority 0; policy drop; }'
nft add rule inet filter input ct state established,related accept
nft add rule inet filter input iif lo accept
nft add rule inet filter input ip protocol icmp accept
nft add rule inet filter input ip6 nexthdr ipv6-icmp accept
# Autoriser SSH depuis un VLAN d'admin
nft add rule inet filter input tcp dport 22 ip saddr 10.10.0.0/16 accept
# Journaliser le reste
nft add rule inet filter input log prefix "DROP " group 0 drop

# pf.conf — exemple simple
set block-policy drop
set skip on lo
block in all
pass in on egress inet proto tcp from 10.10.0.0/16 to (egress) port 22 keep state
pass out all keep state
# NAT (OpenBSD)
match out on egress from 10.10.0.0/16 to any nat-to (egress)

• Utiliser **objets** (IP, groupes, services), **zones** et règle **deny-all** finale.
• Inspection applicative (L7), AV/IPS intégrés : activer sur flux exposés seulement.
• Politique de logs : accepter/décliner avec raison; exporter vers SIEM.

# Tests connectivité
nc -vz host port
# Parcours d'une règle (Linux)
nft list ruleset | less
# Extr. logs kernel (nftables log group 0)
journalctl -k | grep DROP

# /etc/suricata/suricata.yaml (extraits)
af-packet:
  - interface: eth0
    cluster-type: cluster_flow
    cluster-id: 99
    defrag: yes
    mmap-locked: yes
detect:
  profile: medium
  sgh-mpm-context: auto
  mpm-algo: hs   # Hyperscan
outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/eve.json
      types: [ alert, dns, http, tls, flow, stats ]

# Règles (ET Open / Emerging Threats)
suricata-update
suricata-update list-sources
suricata-update enable-source et/open
systemctl restart suricata
# Perf : workers = nb CPU, RSS/NIC queues, pinning IRQs
ethtool -l eth0; ethtool -L eth0 combined 8

# Exemple d'export EVE → Logstash (pipeline)
input { file { path => "/var/log/suricata/eve.json" codec => json } }
filter { date { match => ["timestamp","ISO8601"] } }
output { elasticsearch { hosts => ["http://es:9200"] index => "suricata-%{+YYYY.MM.dd}" } }

# Sanity checks
suricata -T -c /etc/suricata/suricata.yaml -v
# Débit & drops
grep -i drop /var/log/suricata/stats.log
# Vérifier inline (NFQUEUE)
iptables -I FORWARD -j NFQUEUE --queue-num 0

# /etc/ipsec.conf — IKEv2 site-à-site (extrait)
config setup
conn s2s
  keyexchange=ikev2
  left=%defaultroute
  leftsubnet=10.10.10.0/24
  right=198.51.100.2
  rightsubnet=10.20.20.0/24
  ike=aes256-sha256-modp2048
  esp=aes256-sha256
  auto=start
# Secrets : /etc/ipsec.secrets
: PSK "VeryStrongSharedSecret"

# WireGuard — roadwarrior
wg genkey | tee server.key | wg pubkey > server.pub
ip link add wg0 type wireguard
ip addr add 10.8.0.1/24 dev wg0
wg set wg0 listen-port 51820 private-key ./server.key
wg set wg0 peer <client_pub> allowed-ips 10.8.0.2/32
ip link set wg0 up
# NAT vers Internet
nft add rule ip nat postrouting oifname "eth0" ip saddr 10.8.0.0/24 masquerade

# OpenVPN — serveur (TLS)
port 1194
proto udp
dev tun
server 10.9.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 10.9.0.1"
tls-version-min 1.2
cipher AES-256-GCM

# IPsec
ipsec statusall
tcpdump -ni any udp port 500 or 4500
# WireGuard
wg show; journalctl -u wg-quick@wg0
# OpenVPN
journalctl -u openvpn-server -e

• IdP (AAD/Okta/Keycloak) + Proxy ZTNA (Cloudflare/Zscaler/BeyondCorp).
• Connecteurs dans les VPC/VLAN pour publier les applis privées.
• Logs d’accès → SIEM; DLP/Browser isolation en option.

# Exemple (pseudo)
policy "jira" {
  subject: user in group "DEV"
  device: posture == compliant
  action: allow with SSO (OIDC) + MFA
  session: reauth 12h; idle 30m
}

• Commencer par **apps web** internes (HTTP/SSH bastion via Web-SSH) puis élargir.
• Remplacer progressivement VPN nomade « full tunnel ».

• Legacy non-web (SMB/SQL) plus complexe → passerelles spécifiques.
• Nécessite maturité IAM, MDM/EDR, classification des apps.

# nginx.conf (extrait)
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305';
ssl_prefer_server_ciphers on;
ssl_stapling on; ssl_stapling_verify on;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# Nginx — mTLS
ssl_client_certificate /etc/nginx/ca.crt;
ssl_verify_client optional;
map $ssl_client_verify $authz {
  default deny;
  SUCCESS allow;
}

# Générer une CSR & clé
openssl req -new -newkey rsa:2048 -nodes -keyout app.key -out app.csr
# Tester un serveur
openssl s_client -connect example.com:443 -servername example.com -tls1_2
# OCSP stapling check
openssl s_client -connect example.com:443 -status -tlsextdebug

# Cisco — 802.1X (extrait)
aaa new-model
aaa authentication dot1x default group radius
interface Gi1/0/10
 switchport mode access
 authentication port-control auto
 mab
 dot1x pae authenticator

# Linux — host firewall (ex: ssh/http only)
nft add table inet host
nft 'add chain inet host input { type filter hook input priority 0; policy drop; }'
nft add rule inet host input ct state established,related accept
nft add rule inet host input tcp dport {22,80,443} accept

• Cas : scan massif, brute-force SSH, exfiltration DNS, beaconing HTTP/TLS.
• Corréler IOC (threat-feeds) et comportement (baselines).

# Exemple de runbook (résumé)
1) Qualifier l'alerte (critique/impact)
2) Isoler le poste (NAC/quarantaine)
3) Bloquer IOC (RPZ/Firewall)
4) Sauvegarder artefacts (pcap/logs)
5) Corriger (patch, reset secrets)
6) Post-mortem & leçons

# SSH
PasswordAuthentication no
PermitRootLogin no
LoginGraceTime 30
# Fail2ban (extrait jail.local)
[sshd]
enabled = true
maxretry = 5
findtime = 10m
bantime = 1h

• Exposer via **reverse-proxy** (WAF) & terminator TLS plutôt que services bruts.
• Bastion SSH (audit), accès just-in-time, clés courtes, mTLS où possible.