diff --git a/Semaine_13/Jour_05/QCM-CORRIGE.pdf b/Semaine_13/Jour_05/QCM-CORRIGE.pdf new file mode 100644 index 0000000..87b3190 Binary files /dev/null and b/Semaine_13/Jour_05/QCM-CORRIGE.pdf differ diff --git a/Semaine_15/Jour_05/vigie-etudiants.zip b/Semaine_15/Jour_05/vigie-etudiants.zip new file mode 100644 index 0000000..26ed98f Binary files /dev/null and b/Semaine_15/Jour_05/vigie-etudiants.zip differ diff --git a/Semaine_15/Jour_05/vigie/.python-version b/Semaine_15/Jour_05/vigie/.python-version new file mode 100644 index 0000000..6324d40 --- /dev/null +++ b/Semaine_15/Jour_05/vigie/.python-version @@ -0,0 +1 @@ +3.14 diff --git a/Semaine_15/Jour_05/vigie/ENONCES-VIGIE.pdf b/Semaine_15/Jour_05/vigie/ENONCES-VIGIE.pdf new file mode 100644 index 0000000..3d4c6ff Binary files /dev/null and b/Semaine_15/Jour_05/vigie/ENONCES-VIGIE.pdf differ diff --git a/Semaine_15/Jour_05/vigie/README.md b/Semaine_15/Jour_05/vigie/README.md new file mode 100644 index 0000000..e69de29 diff --git a/Semaine_15/Jour_05/vigie/journaux/auth.log b/Semaine_15/Jour_05/vigie/journaux/auth.log new file mode 100644 index 0000000..de38e9a --- /dev/null +++ b/Semaine_15/Jour_05/vigie/journaux/auth.log @@ -0,0 +1,181 @@ +Oct 1 01:06:05 srv-web01 sshd[2501]: Failed password for invalid user ubuntu from 91.207.183.44 port 47063 ssh2 +Oct 1 03:19:40 srv-web01 sshd[2508]: Failed password for invalid user admin from 91.207.183.44 port 54909 ssh2 +Oct 1 04:57:12 srv-web01 sshd[2515]: Failed password for invalid user guest from 91.207.183.44 port 50329 ssh2 +Oct 1 05:06:09 srv-web01 sshd[2522]: Failed password for invalid user postgres from 91.207.183.44 port 49921 ssh2 +Oct 1 05:42:47 srv-web01 sshd[2529]: Failed password for invalid user guest from 91.207.183.44 port 46293 ssh2 +Oct 1 07:01:54 srv-web01 sshd[2536]: Failed password for invalid user root from 41.218.90.6 port 58548 ssh2 +Oct 1 07:29:16 srv-web01 sshd[2543]: Failed password for amir from 192.168.1.13 port 43965 ssh2 +Oct 1 08:02:22 srv-web01 sshd[2550]: Failed password for regis from 10.0.0.8 port 42102 ssh2 +Oct 1 10:47:49 srv-web01 sshd[2557]: Accepted password for mdupont from 192.168.1.13 port 48771 ssh2 +Oct 1 10:49:06 srv-web01 sshd[2564]: Accepted password for mdupont from 192.168.1.42 port 42310 ssh2 +Oct 1 11:02:28 srv-web01 sshd[2571]: Accepted password for amir from 192.168.1.13 port 42841 ssh2 +Oct 1 11:18:56 srv-web01 sshd[2578]: Accepted password for regis from 192.168.1.13 port 41318 ssh2 +Oct 1 11:28:03 srv-web01 sshd[2585]: Accepted password for regis from 192.168.1.13 port 53292 ssh2 +Oct 1 11:50:44 srv-web01 sshd[2592]: Accepted password for regis from 192.168.1.13 port 40177 ssh2 +Oct 1 12:47:26 srv-web01 sshd[2599]: Failed password for invalid user guest from 91.207.183.44 port 43527 ssh2 +Oct 1 12:53:03 srv-web01 sshd[2606]: Accepted password for regis from 192.168.1.13 port 46566 ssh2 +Oct 1 13:03:57 srv-web01 sshd[2613]: Failed password for invalid user ubuntu from 41.218.90.6 port 43223 ssh2 +Oct 1 13:09:47 srv-web01 sshd[2620]: Accepted password for sarah from 10.0.0.8 port 42412 ssh2 +Oct 1 14:29:29 srv-web01 sshd[2627]: Accepted password for regis from 192.168.1.13 port 42554 ssh2 +Oct 1 15:18:19 srv-web01 sshd[2634]: Failed password for sarah from 192.168.1.42 port 56895 ssh2 +Oct 1 15:54:49 srv-web01 sshd[2641]: Accepted password for mdupont from 192.168.1.42 port 41390 ssh2 +Oct 1 17:24:09 srv-web01 sshd[2648]: Failed password for invalid user admin from 41.218.90.6 port 40133 ssh2 +Oct 1 17:57:21 srv-web01 sshd[2655]: Failed password for invalid user test from 203.0.113.75 port 48209 ssh2 +Oct 1 18:05:54 srv-web01 sshd[2662]: Failed password for invalid user ubuntu from 203.0.113.75 port 56663 ssh2 +Oct 1 18:08:59 srv-web01 sshd[2669]: Accepted password for amir from 192.168.1.42 port 48719 ssh2 +Oct 1 18:13:19 srv-web01 sshd[2676]: Accepted password for mdupont from 192.168.1.42 port 58571 ssh2 +Oct 1 18:29:01 srv-web01 sshd[2683]: Accepted password for sarah from 192.168.1.57 port 47775 ssh2 +Oct 1 19:31:04 srv-web01 sshd[2690]: Accepted password for regis from 192.168.1.13 port 44229 ssh2 +Oct 1 23:43:06 srv-web01 sshd[2697]: Failed password for invalid user root from 203.0.113.75 port 40499 ssh2 +Oct 2 02:06:42 srv-web01 sshd[2704]: Failed password for invalid user pi from 203.0.113.75 port 57057 ssh2 +Oct 2 04:13:32 srv-web01 sshd[2711]: Failed password for invalid user guest from 91.207.183.44 port 44999 ssh2 +Oct 2 04:24:30 srv-web01 sshd[2718]: Failed password for invalid user guest from 41.218.90.6 port 44719 ssh2 +Oct 2 04:35:41 srv-web01 sshd[2725]: Failed password for invalid user ubuntu from 91.207.183.44 port 44205 ssh2 +Oct 2 06:12:13 srv-web01 sshd[2732]: Failed password for invalid user root from 91.207.183.44 port 58001 ssh2 +Oct 2 07:07:10 srv-web01 sshd[2739]: Failed password for mdupont from 10.0.0.8 port 59441 ssh2 +Oct 2 07:38:26 srv-web01 sshd[2746]: Accepted password for amir from 10.0.0.8 port 55160 ssh2 +Oct 2 07:49:13 srv-web01 sshd[2753]: Failed password for invalid user admin from 41.218.90.6 port 48112 ssh2 +Oct 2 08:12:15 srv-web01 sshd[2760]: Accepted password for amir from 10.0.0.8 port 59934 ssh2 +Oct 2 09:03:04 srv-web01 sshd[2767]: Accepted password for mdupont from 192.168.1.42 port 47749 ssh2 +Oct 2 09:51:51 srv-web01 sshd[2774]: Accepted password for mdupont from 192.168.1.57 port 46851 ssh2 +Oct 2 11:17:13 srv-web01 sshd[2781]: Failed password for amir from 192.168.1.13 port 52520 ssh2 +Oct 2 11:36:17 srv-web01 sshd[2788]: Failed password for invalid user postgres from 203.0.113.75 port 52729 ssh2 +Oct 2 11:36:20 srv-web01 sshd[2795]: Failed password for invalid user pi from 91.207.183.44 port 59956 ssh2 +Oct 2 11:42:42 srv-web01 sshd[2802]: Accepted password for regis from 192.168.1.13 port 49503 ssh2 +Oct 2 11:43:47 srv-web01 sshd[2809]: Accepted password for regis from 192.168.1.57 port 46443 ssh2 +Oct 2 12:41:24 srv-web01 sshd[2816]: Accepted password for regis from 10.0.0.8 port 55213 ssh2 +Oct 2 13:30:13 srv-web01 sshd[2823]: Accepted password for amir from 192.168.1.13 port 46885 ssh2 +Oct 2 15:57:58 srv-web01 sshd[2830]: Accepted password for amir from 10.0.0.8 port 54538 ssh2 +Oct 2 16:40:16 srv-web01 sshd[2837]: Failed password for invalid user root from 91.207.183.44 port 40079 ssh2 +Oct 2 16:50:36 srv-web01 sshd[2844]: Accepted password for sarah from 10.0.0.8 port 55301 ssh2 +Oct 2 17:13:21 srv-web01 sshd[2851]: Accepted password for amir from 192.168.1.57 port 44369 ssh2 +Oct 2 18:10:25 srv-web01 sshd[2858]: Accepted password for sarah from 192.168.1.57 port 42753 ssh2 +Oct 2 18:15:29 srv-web01 sshd[2865]: Failed password for invalid user guest from 41.218.90.6 port 44928 ssh2 +Oct 2 18:44:29 srv-web01 sshd[2872]: Failed password for regis from 192.168.1.13 port 49729 ssh2 +Oct 2 20:18:29 srv-web01 sshd[2879]: Accepted password for amir from 192.168.1.13 port 46174 ssh2 +Oct 2 20:40:47 srv-web01 sshd[2886]: Accepted password for mdupont from 192.168.1.13 port 47889 ssh2 +Oct 3 00:50:23 srv-web01 sshd[2893]: Failed password for invalid user ubuntu from 91.207.183.44 port 46915 ssh2 +Oct 3 02:52:59 srv-web01 sshd[2900]: Failed password for invalid user pi from 203.0.113.75 port 43090 ssh2 +Oct 3 03:34:00 srv-web01 sshd[2907]: Failed password for invalid user admin from 41.218.90.6 port 52389 ssh2 +Oct 3 04:10:02 srv-web01 sshd[2914]: Failed password for invalid user admin from 185.203.44.17 port 50513 ssh2 +Oct 3 04:10:16 srv-web01 sshd[2916]: Failed password for invalid user admin from 185.203.44.17 port 57282 ssh2 +Oct 3 04:10:30 srv-web01 sshd[2918]: Failed password for invalid user postgres from 185.203.44.17 port 54301 ssh2 +Oct 3 04:10:36 srv-web01 sshd[2920]: Failed password for invalid user oracle from 185.203.44.17 port 52623 ssh2 +Oct 3 04:10:50 srv-web01 sshd[2922]: Failed password for invalid user admin from 185.203.44.17 port 51367 ssh2 +Oct 3 04:10:56 srv-web01 sshd[2924]: Failed password for invalid user guest from 185.203.44.17 port 51379 ssh2 +Oct 3 04:11:08 srv-web01 sshd[2926]: Failed password for invalid user guest from 185.203.44.17 port 55010 ssh2 +Oct 3 04:11:19 srv-web01 sshd[2928]: Failed password for invalid user root from 185.203.44.17 port 53296 ssh2 +Oct 3 04:11:32 srv-web01 sshd[2930]: Failed password for invalid user guest from 185.203.44.17 port 55571 ssh2 +Oct 3 04:11:41 srv-web01 sshd[2932]: Failed password for invalid user test from 185.203.44.17 port 51103 ssh2 +Oct 3 04:11:53 srv-web01 sshd[2934]: Failed password for invalid user guest from 185.203.44.17 port 59739 ssh2 +Oct 3 04:12:07 srv-web01 sshd[2936]: Failed password for invalid user ubuntu from 185.203.44.17 port 59304 ssh2 +Oct 3 04:12:13 srv-web01 sshd[2938]: Failed password for invalid user oracle from 185.203.44.17 port 55632 ssh2 +Oct 3 04:12:27 srv-web01 sshd[2940]: Failed password for regis from 185.203.44.17 port 53470 ssh2 +Oct 3 04:12:37 srv-web01 sshd[2942]: Failed password for invalid user root from 185.203.44.17 port 54930 ssh2 +Oct 3 04:12:48 srv-web01 sshd[2944]: Failed password for invalid user guest from 185.203.44.17 port 50794 ssh2 +Oct 3 04:12:55 srv-web01 sshd[2946]: Failed password for invalid user root from 185.203.44.17 port 50969 ssh2 +Oct 3 04:13:06 srv-web01 sshd[2948]: Failed password for invalid user root from 185.203.44.17 port 51461 ssh2 +Oct 3 04:13:16 srv-web01 sshd[2950]: Failed password for invalid user oracle from 185.203.44.17 port 51313 ssh2 +Oct 3 04:13:21 srv-web01 sshd[2952]: Failed password for invalid user postgres from 185.203.44.17 port 59758 ssh2 +Oct 3 04:13:34 srv-web01 sshd[2954]: Failed password for invalid user root from 185.203.44.17 port 50844 ssh2 +Oct 3 04:13:40 srv-web01 sshd[2956]: Failed password for invalid user admin from 185.203.44.17 port 51076 ssh2 +Oct 3 04:13:52 srv-web01 sshd[2958]: Failed password for regis from 185.203.44.17 port 57880 ssh2 +Oct 3 04:14:03 srv-web01 sshd[2960]: Failed password for invalid user admin from 185.203.44.17 port 57136 ssh2 +Oct 3 04:14:09 srv-web01 sshd[2962]: Failed password for regis from 185.203.44.17 port 55937 ssh2 +Oct 3 04:14:14 srv-web01 sshd[2964]: Failed password for invalid user oracle from 185.203.44.17 port 52465 ssh2 +Oct 3 04:14:24 srv-web01 sshd[2966]: Failed password for invalid user test from 185.203.44.17 port 55547 ssh2 +Oct 3 04:14:30 srv-web01 sshd[2968]: Failed password for invalid user oracle from 185.203.44.17 port 57293 ssh2 +Oct 3 04:14:37 srv-web01 sshd[2970]: Failed password for invalid user guest from 185.203.44.17 port 52133 ssh2 +Oct 3 04:14:51 srv-web01 sshd[2972]: Failed password for invalid user postgres from 185.203.44.17 port 51786 ssh2 +Oct 3 04:15:00 srv-web01 sshd[2974]: Failed password for invalid user root from 185.203.44.17 port 59536 ssh2 +Oct 3 04:15:12 srv-web01 sshd[2976]: Failed password for invalid user root from 185.203.44.17 port 55421 ssh2 +Oct 3 04:15:20 srv-web01 sshd[2978]: Failed password for invalid user oracle from 185.203.44.17 port 57516 ssh2 +Oct 3 04:15:30 srv-web01 sshd[2980]: Failed password for invalid user postgres from 185.203.44.17 port 53690 ssh2 +Oct 3 04:15:40 srv-web01 sshd[2982]: Failed password for invalid user root from 185.203.44.17 port 51583 ssh2 +Oct 3 04:15:54 srv-web01 sshd[2984]: Failed password for invalid user ubuntu from 185.203.44.17 port 50699 ssh2 +Oct 3 04:16:03 srv-web01 sshd[2986]: Failed password for invalid user test from 185.203.44.17 port 53891 ssh2 +Oct 3 04:16:12 srv-web01 sshd[2988]: Failed password for invalid user root from 185.203.44.17 port 57816 ssh2 +Oct 3 04:16:20 srv-web01 sshd[2990]: Failed password for invalid user oracle from 185.203.44.17 port 59774 ssh2 +Oct 3 04:16:32 srv-web01 sshd[2992]: Failed password for invalid user pi from 185.203.44.17 port 56829 ssh2 +Oct 3 04:16:42 srv-web01 sshd[2994]: Failed password for invalid user admin from 185.203.44.17 port 52727 ssh2 +Oct 3 04:16:52 srv-web01 sshd[2996]: Failed password for invalid user ubuntu from 185.203.44.17 port 54675 ssh2 +Oct 3 04:17:01 srv-web01 sshd[2998]: Failed password for invalid user admin from 185.203.44.17 port 52609 ssh2 +Oct 3 04:17:06 srv-web01 sshd[3000]: Failed password for invalid user ubuntu from 185.203.44.17 port 58847 ssh2 +Oct 3 04:17:14 srv-web01 sshd[3002]: Failed password for invalid user root from 185.203.44.17 port 55475 ssh2 +Oct 3 04:17:20 srv-web01 sshd[3004]: Failed password for invalid user root from 185.203.44.17 port 51577 ssh2 +Oct 3 04:17:31 srv-web01 sshd[3006]: Failed password for invalid user admin from 185.203.44.17 port 50689 ssh2 +Oct 3 04:17:38 srv-web01 sshd[3008]: Failed password for invalid user root from 185.203.44.17 port 53160 ssh2 +Oct 3 04:17:49 srv-web01 sshd[3010]: Failed password for regis from 185.203.44.17 port 51708 ssh2 +Oct 3 04:18:01 srv-web01 sshd[3012]: Failed password for invalid user admin from 185.203.44.17 port 52504 ssh2 +Oct 3 04:18:12 srv-web01 sshd[3014]: Failed password for invalid user root from 185.203.44.17 port 56103 ssh2 +Oct 3 04:18:20 srv-web01 sshd[3016]: Failed password for invalid user test from 185.203.44.17 port 52153 ssh2 +Oct 3 04:18:34 srv-web01 sshd[3018]: Failed password for invalid user oracle from 185.203.44.17 port 57070 ssh2 +Oct 3 04:18:41 srv-web01 sshd[3020]: Failed password for invalid user guest from 185.203.44.17 port 59300 ssh2 +Oct 3 04:18:49 srv-web01 sshd[3022]: Failed password for invalid user oracle from 185.203.44.17 port 51066 ssh2 +Oct 3 04:19:02 srv-web01 sshd[3024]: Failed password for invalid user guest from 185.203.44.17 port 59580 ssh2 +Oct 3 04:19:10 srv-web01 sshd[3026]: Failed password for invalid user guest from 185.203.44.17 port 59046 ssh2 +Oct 3 04:19:16 srv-web01 sshd[3028]: Failed password for invalid user guest from 185.203.44.17 port 57286 ssh2 +Oct 3 04:19:25 srv-web01 sshd[3030]: Failed password for invalid user admin from 185.203.44.17 port 56238 ssh2 +Oct 3 04:19:35 srv-web01 sshd[3032]: Failed password for invalid user test from 185.203.44.17 port 56738 ssh2 +Oct 3 04:19:49 srv-web01 sshd[3034]: Failed password for invalid user oracle from 185.203.44.17 port 52070 ssh2 +Oct 3 04:19:54 srv-web01 sshd[3036]: Failed password for invalid user ubuntu from 185.203.44.17 port 55941 ssh2 +Oct 3 04:20:05 srv-web01 sshd[3038]: Failed password for invalid user pi from 185.203.44.17 port 54780 ssh2 +Oct 3 04:20:11 srv-web01 sshd[3040]: Failed password for invalid user admin from 185.203.44.17 port 50419 ssh2 +Oct 3 04:20:17 srv-web01 sshd[3042]: Failed password for invalid user pi from 185.203.44.17 port 57701 ssh2 +Oct 3 04:20:22 srv-web01 sshd[3044]: Failed password for invalid user ubuntu from 185.203.44.17 port 54327 ssh2 +Oct 3 04:20:36 srv-web01 sshd[3046]: Failed password for invalid user root from 185.203.44.17 port 59635 ssh2 +Oct 3 04:20:50 srv-web01 sshd[3048]: Failed password for invalid user test from 185.203.44.17 port 58943 ssh2 +Oct 3 04:20:57 srv-web01 sshd[3050]: Failed password for invalid user test from 185.203.44.17 port 58805 ssh2 +Oct 3 04:21:10 srv-web01 sshd[3052]: Failed password for invalid user ubuntu from 185.203.44.17 port 58562 ssh2 +Oct 3 04:21:19 srv-web01 sshd[3054]: Failed password for regis from 185.203.44.17 port 55913 ssh2 +Oct 3 04:21:30 srv-web01 sshd[3056]: Failed password for invalid user test from 185.203.44.17 port 58750 ssh2 +Oct 3 04:21:41 srv-web01 sshd[3058]: Failed password for invalid user root from 185.203.44.17 port 50151 ssh2 +Oct 3 04:21:53 srv-web01 sshd[3060]: Failed password for invalid user pi from 185.203.44.17 port 57264 ssh2 +Oct 3 04:22:02 srv-web01 sshd[3062]: Failed password for invalid user test from 185.203.44.17 port 57801 ssh2 +Oct 3 04:22:09 srv-web01 sshd[3064]: Failed password for invalid user test from 185.203.44.17 port 55263 ssh2 +Oct 3 04:22:16 srv-web01 sshd[3066]: Failed password for invalid user root from 185.203.44.17 port 54313 ssh2 +Oct 3 04:22:22 srv-web01 sshd[3068]: Failed password for invalid user admin from 185.203.44.17 port 56381 ssh2 +Oct 3 04:22:35 srv-web01 sshd[3070]: Failed password for invalid user admin from 185.203.44.17 port 57568 ssh2 +Oct 3 04:22:48 srv-web01 sshd[3072]: Failed password for invalid user guest from 185.203.44.17 port 57404 ssh2 +Oct 3 04:22:59 srv-web01 sshd[3074]: Failed password for invalid user ubuntu from 185.203.44.17 port 58813 ssh2 +Oct 3 04:23:11 srv-web01 sshd[3076]: Failed password for invalid user root from 185.203.44.17 port 57660 ssh2 +Oct 3 04:23:19 srv-web01 sshd[3078]: Failed password for invalid user guest from 185.203.44.17 port 55499 ssh2 +Oct 3 04:23:25 srv-web01 sshd[3080]: Failed password for invalid user admin from 185.203.44.17 port 51573 ssh2 +Oct 3 04:23:32 srv-web01 sshd[3082]: Failed password for invalid user pi from 185.203.44.17 port 54614 ssh2 +Oct 3 04:23:45 srv-web01 sshd[3084]: Failed password for invalid user root from 185.203.44.17 port 53935 ssh2 +Oct 3 04:23:56 srv-web01 sshd[3086]: Failed password for invalid user pi from 185.203.44.17 port 56148 ssh2 +Oct 3 04:24:08 srv-web01 sshd[3088]: Failed password for invalid user root from 185.203.44.17 port 53343 ssh2 +Oct 3 04:24:17 srv-web01 sshd[3090]: Failed password for invalid user oracle from 185.203.44.17 port 59282 ssh2 +Oct 3 04:24:29 srv-web01 sshd[3092]: Failed password for invalid user oracle from 185.203.44.17 port 56464 ssh2 +Oct 3 04:24:39 srv-web01 sshd[3094]: Failed password for invalid user admin from 185.203.44.17 port 55906 ssh2 +Oct 3 04:24:52 srv-web01 sshd[3096]: Failed password for invalid user admin from 185.203.44.17 port 54383 ssh2 +Oct 3 04:25:00 srv-web01 sshd[3098]: Failed password for invalid user test from 185.203.44.17 port 59970 ssh2 +Oct 3 04:25:07 srv-web01 sshd[3100]: Failed password for regis from 185.203.44.17 port 59741 ssh2 +Oct 3 04:25:18 srv-web01 sshd[3102]: Accepted password for regis from 185.203.44.17 port 51099 ssh2 +Oct 3 04:26:38 srv-web01 sshd[3104]: Failed password for invalid user pi from 203.0.113.75 port 57463 ssh2 +Oct 3 04:39:00 srv-web01 sshd[3111]: Failed password for invalid user root from 41.218.90.6 port 58241 ssh2 +Oct 3 07:03:45 srv-web01 sshd[3118]: Failed password for invalid user guest from 41.218.90.6 port 40784 ssh2 +Oct 3 07:31:40 srv-web01 sshd[3125]: Failed password for invalid user postgres from 41.218.90.6 port 42023 ssh2 +Oct 3 07:38:38 srv-web01 sshd[3132]: Failed password for invalid user test from 91.207.183.44 port 42114 ssh2 +Oct 3 09:18:50 srv-web01 sshd[3139]: Accepted password for regis from 192.168.1.13 port 41719 ssh2 +Oct 3 10:04:21 srv-web01 sshd[3146]: Failed password for invalid user admin from 91.207.183.44 port 44878 ssh2 +Oct 3 10:29:59 srv-web01 sshd[3153]: Failed password for invalid user root from 203.0.113.75 port 49409 ssh2 +Oct 3 10:57:13 srv-web01 sshd[3160]: Failed password for regis from 192.168.1.57 port 50901 ssh2 +Oct 3 11:29:52 srv-web01 sshd[3167]: Failed password for invalid user oracle from 91.207.183.44 port 47507 ssh2 +Oct 3 12:00:11 srv-web01 sshd[3174]: Accepted password for regis from 192.168.1.13 port 54223 ssh2 +Oct 3 13:27:20 srv-web01 sshd[3181]: Accepted password for regis from 192.168.1.42 port 46805 ssh2 +Oct 3 13:50:40 srv-web01 sshd[3188]: Accepted password for sarah from 192.168.1.13 port 50487 ssh2 +Oct 3 14:02:25 srv-web01 sshd[3195]: Accepted password for regis from 10.0.0.8 port 54400 ssh2 +Oct 3 14:46:39 srv-web01 sshd[3202]: Accepted password for mdupont from 192.168.1.42 port 50250 ssh2 +Oct 3 14:56:09 srv-web01 sshd[3209]: Accepted password for amir from 192.168.1.42 port 52323 ssh2 +Oct 3 16:00:12 srv-web01 sshd[3216]: Accepted password for mdupont from 192.168.1.57 port 40614 ssh2 +Oct 3 16:29:46 srv-web01 sshd[3223]: Accepted password for regis from 192.168.1.42 port 43179 ssh2 +Oct 3 16:38:24 srv-web01 sshd[3230]: Accepted password for mdupont from 192.168.1.42 port 42200 ssh2 +Oct 3 17:22:37 srv-web01 sshd[3237]: Failed password for amir from 192.168.1.42 port 57132 ssh2 +Oct 3 17:25:05 srv-web01 sshd[3244]: Accepted password for regis from 192.168.1.13 port 58942 ssh2 +Oct 3 18:17:22 srv-web01 sshd[3251]: Accepted password for sarah from 192.168.1.57 port 57031 ssh2 +Oct 3 18:32:03 srv-web01 sshd[3258]: Accepted password for mdupont from 10.0.0.8 port 41548 ssh2 +Oct 3 18:43:07 srv-web01 sshd[3265]: Failed password for invalid user test from 91.207.183.44 port 47667 ssh2 +Oct 3 19:45:29 srv-web01 sshd[3272]: Failed password for amir from 192.168.1.13 port 51477 ssh2 +Oct 3 20:36:38 srv-web01 sshd[3279]: Accepted password for sarah from 192.168.1.42 port 47526 ssh2 +Oct 3 20:54:14 srv-web01 sshd[3286]: Failed password for invalid user root from 91.207.183.44 port 44563 ssh2 diff --git a/Semaine_15/Jour_05/vigie/journaux/firewall.log b/Semaine_15/Jour_05/vigie/journaux/firewall.log new file mode 100644 index 0000000..40bfbb8 --- /dev/null +++ b/Semaine_15/Jour_05/vigie/journaux/firewall.log @@ -0,0 +1,183 @@ +2026-10-05 03:12:00 45.134.26.88 192.168.1.10 415 DROP +2026-10-05 03:12:02 45.134.26.88 192.168.1.10 816 DROP +2026-10-05 03:12:04 45.134.26.88 192.168.1.10 656 DROP +2026-10-05 03:12:06 45.134.26.88 192.168.1.10 328 DROP +2026-10-05 03:12:08 45.134.26.88 192.168.1.10 615 DROP +2026-10-05 03:12:10 45.134.26.88 192.168.1.10 702 DROP +2026-10-05 03:12:12 45.134.26.88 192.168.1.10 545 DROP +2026-10-05 03:12:14 45.134.26.88 192.168.1.10 547 DROP +2026-10-05 03:12:16 45.134.26.88 192.168.1.10 275 DROP +2026-10-05 03:12:18 45.134.26.88 192.168.1.10 964 DROP +2026-10-05 03:12:20 45.134.26.88 192.168.1.10 716 DROP +2026-10-05 03:12:22 45.134.26.88 192.168.1.10 572 DROP +2026-10-05 03:12:24 45.134.26.88 192.168.1.10 657 DROP +2026-10-05 03:12:26 45.134.26.88 192.168.1.10 926 DROP +2026-10-05 03:12:28 45.134.26.88 192.168.1.10 751 DROP +2026-10-05 03:12:30 45.134.26.88 192.168.1.10 337 DROP +2026-10-05 03:12:32 45.134.26.88 192.168.1.10 1020 DROP +2026-10-05 03:12:34 45.134.26.88 192.168.1.10 512 DROP +2026-10-05 03:12:36 45.134.26.88 192.168.1.10 749 DROP +2026-10-05 03:12:38 45.134.26.88 192.168.1.10 633 DROP +2026-10-05 03:12:40 45.134.26.88 192.168.1.10 641 DROP +2026-10-05 03:12:42 45.134.26.88 192.168.1.10 582 DROP +2026-10-05 03:12:44 45.134.26.88 192.168.1.10 430 DROP +2026-10-05 03:12:46 45.134.26.88 192.168.1.10 898 DROP +2026-10-05 03:12:48 45.134.26.88 192.168.1.10 403 DROP +2026-10-05 03:12:50 45.134.26.88 192.168.1.10 128 DROP +2026-10-05 03:12:52 45.134.26.88 192.168.1.10 321 DROP +2026-10-05 03:12:54 45.134.26.88 192.168.1.10 433 DROP +2026-10-05 03:12:56 45.134.26.88 192.168.1.10 434 DROP +2026-10-05 03:12:58 45.134.26.88 192.168.1.10 330 DROP +2026-10-05 03:13:00 45.134.26.88 192.168.1.10 445 DROP +2026-10-05 03:13:02 45.134.26.88 192.168.1.10 527 DROP +2026-10-05 03:13:04 45.134.26.88 192.168.1.10 46 DROP +2026-10-05 03:13:06 45.134.26.88 192.168.1.10 561 DROP +2026-10-05 03:13:08 45.134.26.88 192.168.1.10 971 DROP +2026-10-05 03:13:10 45.134.26.88 192.168.1.10 48 DROP +2026-10-05 03:13:12 45.134.26.88 192.168.1.10 213 DROP +2026-10-05 03:13:14 45.134.26.88 192.168.1.10 744 DROP +2026-10-05 03:13:16 45.134.26.88 192.168.1.10 278 DROP +2026-10-05 03:13:18 45.134.26.88 192.168.1.10 356 DROP +2026-10-05 03:13:20 45.134.26.88 192.168.1.10 308 DROP +2026-10-05 03:13:22 45.134.26.88 192.168.1.10 285 DROP +2026-10-05 03:13:24 45.134.26.88 192.168.1.10 654 DROP +2026-10-05 03:13:26 45.134.26.88 192.168.1.10 219 DROP +2026-10-05 03:13:28 45.134.26.88 192.168.1.10 743 DROP +2026-10-05 03:13:30 45.134.26.88 192.168.1.10 533 DROP +2026-10-05 03:13:32 45.134.26.88 192.168.1.10 634 DROP +2026-10-05 03:13:34 45.134.26.88 192.168.1.10 13 DROP +2026-10-05 03:13:36 45.134.26.88 192.168.1.10 198 DROP +2026-10-05 03:13:38 45.134.26.88 192.168.1.10 163 DROP +2026-10-05 03:13:40 45.134.26.88 192.168.1.10 807 DROP +2026-10-05 03:13:42 45.134.26.88 192.168.1.10 784 DROP +2026-10-05 03:13:44 45.134.26.88 192.168.1.10 1023 DROP +2026-10-05 03:13:46 45.134.26.88 192.168.1.10 167 DROP +2026-10-05 03:13:48 45.134.26.88 192.168.1.10 20 DROP +2026-10-05 03:13:50 45.134.26.88 192.168.1.10 505 DROP +2026-10-05 03:13:52 45.134.26.88 192.168.1.10 909 DROP +2026-10-05 03:13:54 45.134.26.88 192.168.1.10 155 DROP +2026-10-05 03:13:56 45.134.26.88 192.168.1.10 211 DROP +2026-10-05 03:13:58 45.134.26.88 192.168.1.10 190 DROP +2026-10-05 03:14:00 45.134.26.88 192.168.1.10 117 DROP +2026-10-05 03:14:02 45.134.26.88 192.168.1.10 386 DROP +2026-10-05 03:14:04 45.134.26.88 192.168.1.10 611 DROP +2026-10-05 03:14:06 45.134.26.88 192.168.1.10 474 DROP +2026-10-05 03:14:08 45.134.26.88 192.168.1.10 979 DROP +2026-10-05 03:14:10 45.134.26.88 192.168.1.10 334 DROP +2026-10-05 03:14:12 45.134.26.88 192.168.1.10 111 DROP +2026-10-05 03:14:14 45.134.26.88 192.168.1.10 813 DROP +2026-10-05 03:14:16 45.134.26.88 192.168.1.10 991 DROP +2026-10-05 03:14:18 45.134.26.88 192.168.1.10 100 DROP +2026-10-05 03:14:20 45.134.26.88 192.168.1.10 628 DROP +2026-10-05 03:14:22 45.134.26.88 192.168.1.10 620 DROP +2026-10-05 03:14:24 45.134.26.88 192.168.1.10 399 DROP +2026-10-05 03:14:26 45.134.26.88 192.168.1.10 424 DROP +2026-10-05 03:14:28 45.134.26.88 192.168.1.10 493 DROP +2026-10-05 03:14:30 45.134.26.88 192.168.1.10 11 DROP +2026-10-05 03:14:32 45.134.26.88 192.168.1.10 69 DROP +2026-10-05 03:14:34 45.134.26.88 192.168.1.10 331 DROP +2026-10-05 03:14:36 45.134.26.88 192.168.1.10 7 DROP +2026-10-05 03:14:38 45.134.26.88 192.168.1.10 181 DROP +2026-10-05 03:14:40 45.134.26.88 192.168.1.10 842 DROP +2026-10-05 03:14:42 45.134.26.88 192.168.1.10 811 DROP +2026-10-05 03:14:44 45.134.26.88 192.168.1.10 156 DROP +2026-10-05 03:14:46 45.134.26.88 192.168.1.10 66 DROP +2026-10-05 03:14:48 45.134.26.88 192.168.1.10 262 DROP +2026-10-05 03:14:50 45.134.26.88 192.168.1.10 993 DROP +2026-10-05 03:14:52 45.134.26.88 192.168.1.10 456 DROP +2026-10-05 03:14:54 45.134.26.88 192.168.1.10 47 DROP +2026-10-05 03:14:56 45.134.26.88 192.168.1.10 413 DROP +2026-10-05 03:14:58 45.134.26.88 192.168.1.10 629 DROP +2026-10-05 03:15:00 45.134.26.88 192.168.1.10 158 DROP +2026-10-05 03:15:02 45.134.26.88 192.168.1.10 62 DROP +2026-10-05 03:15:04 45.134.26.88 192.168.1.10 986 DROP +2026-10-05 03:15:06 45.134.26.88 192.168.1.10 385 DROP +2026-10-05 03:15:08 45.134.26.88 192.168.1.10 451 DROP +2026-10-05 03:15:10 45.134.26.88 192.168.1.10 189 DROP +2026-10-05 03:15:12 45.134.26.88 192.168.1.10 292 DROP +2026-10-05 03:15:14 45.134.26.88 192.168.1.10 805 DROP +2026-10-05 03:15:16 45.134.26.88 192.168.1.10 367 DROP +2026-10-05 03:15:18 45.134.26.88 192.168.1.10 75 DROP +2026-10-05 03:15:20 45.134.26.88 192.168.1.10 302 DROP +2026-10-05 03:15:22 45.134.26.88 192.168.1.10 54 DROP +2026-10-05 03:15:24 45.134.26.88 192.168.1.10 959 DROP +2026-10-05 03:15:26 45.134.26.88 192.168.1.10 520 DROP +2026-10-05 03:15:28 45.134.26.88 192.168.1.10 922 DROP +2026-10-05 03:15:30 45.134.26.88 192.168.1.10 790 DROP +2026-10-05 03:15:32 45.134.26.88 192.168.1.10 201 DROP +2026-10-05 03:15:34 45.134.26.88 192.168.1.10 523 DROP +2026-10-05 03:15:36 45.134.26.88 192.168.1.10 518 DROP +2026-10-05 03:15:38 45.134.26.88 192.168.1.10 594 DROP +2026-10-05 03:15:40 45.134.26.88 192.168.1.10 935 DROP +2026-10-05 03:15:42 45.134.26.88 192.168.1.10 956 DROP +2026-10-05 03:15:44 45.134.26.88 192.168.1.10 555 DROP +2026-10-05 03:15:46 45.134.26.88 192.168.1.10 655 DROP +2026-10-05 03:15:48 45.134.26.88 192.168.1.10 872 DROP +2026-10-05 03:15:50 45.134.26.88 192.168.1.10 995 DROP +2026-10-05 03:15:52 45.134.26.88 192.168.1.10 49 DROP +2026-10-05 03:15:54 45.134.26.88 192.168.1.10 857 DROP +2026-10-05 03:15:56 45.134.26.88 192.168.1.10 588 DROP +2026-10-05 03:15:58 45.134.26.88 192.168.1.10 618 DROP +2026-10-05 08:02:28 192.168.1.23 93.184.216.34 443 ACCEPT +2026-10-05 08:07:36 192.168.1.57 93.184.216.34 80 ACCEPT +2026-10-05 08:17:05 192.168.1.23 93.184.216.34 443 ACCEPT +2026-10-05 08:25:23 192.168.1.23 93.184.216.34 443 ACCEPT +2026-10-05 08:50:43 192.168.1.23 93.184.216.34 443 ACCEPT +2026-10-05 09:03:00 192.168.1.41 93.184.216.34 80 ACCEPT +2026-10-05 09:25:31 192.168.1.57 93.184.216.34 443 ACCEPT +2026-10-05 09:28:03 192.168.1.23 93.184.216.34 80 ACCEPT +2026-10-05 09:35:52 192.168.1.41 93.184.216.34 123 ACCEPT +2026-10-05 09:48:31 192.168.1.12 93.184.216.34 443 ACCEPT +2026-10-05 10:08:22 192.168.1.12 93.184.216.34 80 ACCEPT +2026-10-05 10:17:51 192.168.1.12 93.184.216.34 443 ACCEPT +2026-10-05 10:27:51 192.168.1.12 93.184.216.34 80 ACCEPT +2026-10-05 10:33:38 192.168.1.12 93.184.216.34 443 ACCEPT +2026-10-05 10:47:07 192.168.1.41 93.184.216.34 443 ACCEPT +2026-10-05 10:49:06 192.168.1.12 93.184.216.34 53 ACCEPT +2026-10-05 10:57:16 192.168.1.23 93.184.216.34 80 ACCEPT +2026-10-05 11:09:47 192.168.1.23 93.184.216.34 123 ACCEPT +2026-10-05 11:15:47 192.168.1.23 93.184.216.34 443 ACCEPT +2026-10-05 11:18:56 192.168.1.41 93.184.216.34 80 ACCEPT +2026-10-05 11:20:27 192.168.1.12 93.184.216.34 443 ACCEPT +2026-10-05 11:36:49 192.168.1.41 93.184.216.34 80 ACCEPT +2026-10-05 11:51:06 192.168.1.12 93.184.216.34 443 ACCEPT +2026-10-05 11:54:49 192.168.1.12 93.184.216.34 443 ACCEPT +2026-10-05 12:00:29 192.168.1.41 93.184.216.34 123 ACCEPT +2026-10-05 12:15:43 192.168.1.12 93.184.216.34 443 ACCEPT +2026-10-05 12:17:46 192.168.1.23 93.184.216.34 80 ACCEPT +2026-10-05 12:32:14 192.168.1.41 93.184.216.34 80 ACCEPT +2026-10-05 12:34:18 192.168.1.41 93.184.216.34 53 ACCEPT +2026-10-05 13:00:28 192.168.1.12 93.184.216.34 443 ACCEPT +2026-10-05 13:04:02 192.168.1.41 93.184.216.34 80 ACCEPT +2026-10-05 13:46:18 192.168.1.12 93.184.216.34 53 ACCEPT +2026-10-05 14:08:43 192.168.1.23 93.184.216.34 123 ACCEPT +2026-10-05 14:09:13 192.168.1.41 93.184.216.34 123 ACCEPT +2026-10-05 14:09:16 192.168.1.23 93.184.216.34 443 ACCEPT +2026-10-05 14:13:48 192.168.1.41 93.184.216.34 123 ACCEPT +2026-10-05 14:47:32 192.168.1.12 93.184.216.34 123 ACCEPT +2026-10-05 14:51:51 192.168.1.57 93.184.216.34 443 ACCEPT +2026-10-05 15:03:04 192.168.1.57 93.184.216.34 80 ACCEPT +2026-10-05 15:19:42 192.168.1.23 93.184.216.34 80 ACCEPT +2026-10-05 15:40:29 192.168.1.41 93.184.216.34 443 ACCEPT +2026-10-05 15:59:17 192.168.1.41 93.184.216.34 443 ACCEPT +2026-10-05 16:04:12 192.168.1.23 93.184.216.34 443 ACCEPT +2026-10-05 16:15:29 192.168.1.41 93.184.216.34 123 ACCEPT +2026-10-05 16:39:50 192.168.1.23 93.184.216.34 123 ACCEPT +2026-10-05 16:53:17 192.168.1.57 93.184.216.34 443 ACCEPT +2026-10-05 17:12:59 192.168.1.57 93.184.216.34 443 ACCEPT +2026-10-05 17:38:26 192.168.1.57 93.184.216.34 53 ACCEPT +2026-10-05 17:40:13 192.168.1.41 93.184.216.34 443 ACCEPT +2026-10-05 17:42:45 192.168.1.23 93.184.216.34 123 ACCEPT +2026-10-05 17:47:17 192.168.1.12 93.184.216.34 443 ACCEPT +2026-10-05 17:47:48 192.168.1.57 93.184.216.34 80 ACCEPT +2026-10-05 18:08:56 192.168.1.12 93.184.216.34 443 ACCEPT +2026-10-05 18:10:25 192.168.1.41 93.184.216.34 443 ACCEPT +2026-10-05 18:11:43 192.168.1.57 93.184.216.34 443 ACCEPT +2026-10-05 18:15:54 192.168.1.23 93.184.216.34 123 ACCEPT +2026-10-05 18:16:12 192.168.1.12 93.184.216.34 53 ACCEPT +2026-10-05 18:17:17 192.168.1.23 93.184.216.34 443 ACCEPT +2026-10-05 18:29:59 192.168.1.12 93.184.216.34 443 ACCEPT +2026-10-05 19:07:10 192.168.1.57 93.184.216.34 443 ACCEPT +2026-10-05 19:16:53 192.168.1.57 93.184.216.34 80 ACCEPT +2026-10-05 19:22:04 192.168.1.41 93.184.216.34 443 ACCEPT +2026-10-05 19:28:37 192.168.1.57 93.184.216.34 123 ACCEPT diff --git a/Semaine_15/Jour_05/vigie/journaux/web.log b/Semaine_15/Jour_05/vigie/journaux/web.log new file mode 100644 index 0000000..936b6cb --- /dev/null +++ b/Semaine_15/Jour_05/vigie/journaux/web.log @@ -0,0 +1,126 @@ +192.168.1.12 - [2026-10-05 09:02:55] "GET /produits" 200 5750 +192.168.1.12 - [2026-10-05 09:06:19] "GET /recherche?q=chaussures" 200 6476 +192.168.1.23 - [2026-10-05 09:08:57] "GET /produits?id=12" 200 8029 +192.168.1.41 - [2026-10-05 09:09:57] "GET /static/style.css" 200 5260 +192.168.1.12 - [2026-10-05 09:20:02] "GET /index.html" 200 5564 +192.168.1.41 - [2026-10-05 09:20:22] "GET /recherche?q=chaussures" 200 4076 +192.168.1.23 - [2026-10-05 09:21:13] "GET /produits?id=45" 200 1092 +192.168.1.23 - [2026-10-05 09:30:53] "GET /produits" 200 1902 +192.168.1.12 - [2026-10-05 09:35:39] "GET /produits" 200 2851 +192.168.1.41 - [2026-10-05 09:36:41] "GET /index.html" 200 4063 +192.168.1.12 - [2026-10-05 09:40:25] "GET /recherche?q=chaussures" 200 1290 +192.168.1.41 - [2026-10-05 09:42:52] "GET /contact" 200 3854 +192.168.1.12 - [2026-10-05 09:47:26] "GET /recherche?q=chaussures" 200 2063 +192.168.1.57 - [2026-10-05 09:48:45] "GET /index.html" 200 2965 +192.168.1.41 - [2026-10-05 09:57:18] "GET /index.html" 200 4118 +192.168.1.23 - [2026-10-05 10:00:09] "GET /produits?id=12" 200 2402 +192.168.1.57 - [2026-10-05 10:09:43] "GET /" 200 366 +192.168.1.41 - [2026-10-05 10:13:35] "GET /recherche?q=chaussures" 200 2483 +192.168.1.41 - [2026-10-05 10:30:22] "GET /recherche?q=chaussures" 200 6480 +192.168.1.12 - [2026-10-05 10:32:46] "GET /index.html" 200 549 +192.168.1.41 - [2026-10-05 10:38:33] "GET /static/style.css" 200 1495 +192.168.1.12 - [2026-10-05 10:51:16] "GET /produits?id=45" 200 5676 +192.168.1.23 - [2026-10-05 10:54:58] "GET /index.html" 200 6473 +192.168.1.41 - [2026-10-05 11:04:23] "GET /produits?id=45" 200 4411 +192.168.1.23 - [2026-10-05 11:13:12] "GET /produits?id=45" 200 1512 +192.168.1.23 - [2026-10-05 11:13:32] "GET /recherche?q=chaussures" 200 2799 +192.168.1.23 - [2026-10-05 11:15:57] "GET /" 200 6207 +192.168.1.12 - [2026-10-05 11:24:04] "GET /produits" 200 7045 +192.168.1.23 - [2026-10-05 11:24:30] "GET /recherche?q=chaussures" 200 2659 +192.168.1.57 - [2026-10-05 11:29:16] "GET /produits" 200 2550 +192.168.1.12 - [2026-10-05 11:30:51] "GET /contact" 200 4216 +192.168.1.41 - [2026-10-05 11:33:57] "GET /recherche?q=chaussures" 200 2364 +192.168.1.23 - [2026-10-05 11:35:54] "GET /contact" 200 3811 +192.168.1.23 - [2026-10-05 12:04:21] "GET /" 200 2739 +192.168.1.23 - [2026-10-05 12:14:41] "GET /index.html" 200 2581 +192.168.1.41 - [2026-10-05 12:15:38] "GET /produits" 200 1357 +192.168.1.12 - [2026-10-05 12:17:41] "GET /contact" 200 8428 +192.168.1.12 - [2026-10-05 12:34:00] "GET /produits?id=45" 200 2967 +192.168.1.12 - [2026-10-05 12:34:29] "GET /produits" 200 425 +192.168.1.41 - [2026-10-05 12:40:33] "GET /" 200 2090 +192.168.1.23 - [2026-10-05 12:55:23] "GET /" 200 4408 +192.168.1.41 - [2026-10-05 12:55:57] "GET /contact" 200 5676 +192.168.1.12 - [2026-10-05 12:59:37] "GET /produits?id=12" 200 2539 +192.168.1.12 - [2026-10-05 13:08:26] "GET /produits?id=45" 200 5788 +192.168.1.41 - [2026-10-05 13:29:59] "GET /index.html" 200 5004 +192.168.1.12 - [2026-10-05 13:38:43] "GET /index.html" 200 7470 +192.168.1.57 - [2026-10-05 13:43:34] "GET /produits?id=12" 200 5354 +192.168.1.57 - [2026-10-05 13:48:05] "GET /recherche?q=chaussures" 200 5310 +192.168.1.41 - [2026-10-05 13:52:59] "GET /produits?id=45" 200 1845 +192.168.1.12 - [2026-10-05 13:54:41] "GET /recherche?q=chaussures" 200 5150 +192.168.1.12 - [2026-10-05 13:57:16] "GET /contact" 200 2923 +192.168.1.57 - [2026-10-05 13:58:52] "GET /index.html" 200 3596 +192.168.1.12 - [2026-10-05 14:03:10] "GET /produits?id=45" 200 1761 +192.168.1.57 - [2026-10-05 14:04:50] "GET /recherche?q=chaussures" 200 6015 +192.168.1.12 - [2026-10-05 14:09:21] "GET /contact" 200 7593 +192.168.1.12 - [2026-10-05 14:20:15] "GET /" 200 4474 +203.0.113.199 - [2026-10-05 14:22:10] "GET /produits?id=1' OR '1'='1" 500 0 +203.0.113.199 - [2026-10-05 14:22:17] "GET /produits?id=1 UNION SELECT username,password FROM users--" 500 0 +203.0.113.199 - [2026-10-05 14:22:28] "GET /produits?id=1'; DROP TABLE users--" 500 0 +203.0.113.199 - [2026-10-05 14:22:41] "GET /recherche?q=" 500 0 +203.0.113.199 - [2026-10-05 14:22:57] "GET /recherche?q=" 500 0 +203.0.113.199 - [2026-10-05 14:23:11] "GET /admin/../../etc/passwd" 500 0 +203.0.113.199 - [2026-10-05 14:23:18] "GET /produits?id=1 AND SLEEP(5)--" 500 0 +192.168.1.41 - [2026-10-05 14:23:32] "GET /produits?id=45" 200 8325 +203.0.113.199 - [2026-10-05 14:23:34] "GET /produits?id=1' OR '1'='1" 500 0 +203.0.113.199 - [2026-10-05 14:23:50] "GET /produits?id=1 UNION SELECT username,password FROM users--" 500 0 +203.0.113.199 - [2026-10-05 14:24:03] "GET /produits?id=1'; DROP TABLE users--" 500 0 +203.0.113.199 - [2026-10-05 14:24:23] "GET /recherche?q=" 500 0 +203.0.113.199 - [2026-10-05 14:24:26] "GET /recherche?q=" 500 0 +203.0.113.199 - [2026-10-05 14:24:46] "GET /admin/../../etc/passwd" 500 0 +203.0.113.199 - [2026-10-05 14:25:01] "GET /produits?id=1 AND SLEEP(5)--" 500 0 +203.0.113.199 - [2026-10-05 14:25:06] "GET /produits?id=1' OR '1'='1" 500 0 +203.0.113.199 - [2026-10-05 14:25:22] "GET /produits?id=1 UNION SELECT username,password FROM users--" 500 0 +203.0.113.199 - [2026-10-05 14:25:33] "GET /produits?id=1'; DROP TABLE users--" 500 0 +203.0.113.199 - [2026-10-05 14:25:46] "GET /recherche?q=" 500 0 +203.0.113.199 - [2026-10-05 14:26:02] "GET /recherche?q=" 500 0 +203.0.113.199 - [2026-10-05 14:26:20] "GET /admin/../../etc/passwd" 500 0 +203.0.113.199 - [2026-10-05 14:26:24] "GET /produits?id=1 AND SLEEP(5)--" 500 0 +192.168.1.57 - [2026-10-05 14:31:45] "GET /produits?id=45" 200 920 +192.168.1.23 - [2026-10-05 14:36:04] "GET /produits?id=12" 200 3770 +192.168.1.12 - [2026-10-05 14:38:52] "GET /index.html" 200 1376 +192.168.1.12 - [2026-10-05 14:53:27] "GET /produits?id=12" 200 1030 +192.168.1.23 - [2026-10-05 14:58:58] "GET /produits" 200 6041 +192.168.1.23 - [2026-10-05 15:13:58] "GET /recherche?q=chaussures" 200 6726 +192.168.1.41 - [2026-10-05 15:14:29] "GET /static/style.css" 200 3990 +192.168.1.57 - [2026-10-05 15:16:49] "GET /produits?id=12" 200 3819 +192.168.1.41 - [2026-10-05 15:18:52] "GET /produits" 200 951 +192.168.1.23 - [2026-10-05 15:26:22] "GET /produits?id=12" 200 6315 +192.168.1.41 - [2026-10-05 15:38:50] "GET /" 200 4543 +192.168.1.41 - [2026-10-05 15:47:53] "GET /index.html" 200 1883 +192.168.1.23 - [2026-10-05 15:50:22] "GET /produits?id=12" 200 1377 +192.168.1.23 - [2026-10-05 15:50:29] "GET /static/style.css" 200 2086 +192.168.1.23 - [2026-10-05 15:53:10] "GET /static/style.css" 200 8116 +192.168.1.12 - [2026-10-05 16:06:27] "GET /" 200 3076 +192.168.1.41 - [2026-10-05 16:07:54] "GET /contact" 200 3216 +192.168.1.23 - [2026-10-05 16:08:38] "GET /produits?id=45" 200 2877 +192.168.1.23 - [2026-10-05 16:09:26] "GET /produits" 200 682 +192.168.1.41 - [2026-10-05 16:30:28] "GET /produits?id=45" 200 5562 +192.168.1.23 - [2026-10-05 16:31:46] "GET /contact" 200 1366 +192.168.1.23 - [2026-10-05 16:34:28] "GET /recherche?q=chaussures" 200 2167 +192.168.1.12 - [2026-10-05 16:51:29] "GET /produits" 200 6937 +192.168.1.23 - [2026-10-05 16:54:05] "GET /produits?id=45" 200 2008 +192.168.1.57 - [2026-10-05 17:06:53] "GET /" 200 7868 +192.168.1.23 - [2026-10-05 17:06:56] "GET /produits?id=45" 200 4914 +192.168.1.41 - [2026-10-05 17:09:10] "GET /produits" 200 4613 +192.168.1.41 - [2026-10-05 17:10:34] "GET /static/style.css" 200 6213 +192.168.1.57 - [2026-10-05 17:23:27] "GET /static/style.css" 200 2009 +192.168.1.57 - [2026-10-05 17:25:09] "GET /" 200 8209 +192.168.1.41 - [2026-10-05 17:26:28] "GET /produits" 200 8101 +192.168.1.41 - [2026-10-05 17:30:54] "GET /index.html" 200 379 +192.168.1.57 - [2026-10-05 17:33:29] "GET /produits?id=45" 200 5939 +192.168.1.12 - [2026-10-05 17:34:28] "GET /recherche?q=chaussures" 200 3899 +192.168.1.12 - [2026-10-05 17:40:16] "GET /produits" 200 3278 +192.168.1.12 - [2026-10-05 17:40:55] "GET /index.html" 200 6534 +192.168.1.57 - [2026-10-05 17:48:57] "GET /" 200 6080 +192.168.1.57 - [2026-10-05 18:13:54] "GET /produits?id=12" 200 6206 +192.168.1.57 - [2026-10-05 18:14:59] "GET /static/style.css" 200 7021 +192.168.1.57 - [2026-10-05 18:24:29] "GET /produits?id=45" 200 5032 +192.168.1.57 - [2026-10-05 18:26:24] "GET /recherche?q=chaussures" 200 2118 +192.168.1.57 - [2026-10-05 18:26:34] "GET /contact" 200 5067 +192.168.1.12 - [2026-10-05 18:30:06] "GET /static/style.css" 200 1092 +192.168.1.41 - [2026-10-05 18:34:40] "GET /contact" 200 2859 +192.168.1.23 - [2026-10-05 18:38:42] "GET /produits?id=45" 200 4797 +192.168.1.12 - [2026-10-05 18:50:13] "GET /contact" 200 3329 +192.168.1.12 - [2026-10-05 18:50:39] "GET /recherche?q=chaussures" 200 644 +192.168.1.41 - [2026-10-05 18:55:13] "GET /contact" 200 7894 diff --git a/Semaine_15/Jour_05/vigie/pyproject.toml b/Semaine_15/Jour_05/vigie/pyproject.toml new file mode 100644 index 0000000..d948960 --- /dev/null +++ b/Semaine_15/Jour_05/vigie/pyproject.toml @@ -0,0 +1,9 @@ +[project] +name = "vigie" +version = "0.1.0" +description = "Add your description here" +readme = "README.md" +requires-python = ">=3.14" +dependencies = [ + "pytest>=9.1.1", +] diff --git a/Semaine_15/Jour_05/vigie/rapport.txt b/Semaine_15/Jour_05/vigie/rapport.txt new file mode 100644 index 0000000..c5d539f --- /dev/null +++ b/Semaine_15/Jour_05/vigie/rapport.txt @@ -0,0 +1,31 @@ +5 alerte(s) + +[CRITIQUE] Attaque par force brute + Source : auth.log + Adresse : 185.203.44.17 + Horodatage : Oct 3 04:10:02 + Constat : 94 échecs d'authentification depuis cette adresse. + +[CRITIQUE] Compromission probable + Source : auth.log + Adresse : 185.203.44.17 + Horodatage : Oct 3 04:25:18 + Constat : Connexion réussie sur le compte regis après 94 échecs. + +[ELEVEE] Scan de ports + Source : firewall.log + Adresse : 45.134.26.88 + Horodatage : 2026-10-05 03:12:00 + Constat : 120 ports distincts contactés. + +[ELEVEE] Attaque applicative + Source : web.log + Adresse : 203.0.113.199 + Horodatage : 2026-10-05 14:22:10 + Constat : 21 requêtes malveillantes depuis cette adresse. + +[MOYENNE] Connexion hors horaires + Source : auth.log + Adresse : 185.203.44.17 + Horodatage : Oct 3 04:25:18 + Constat : Connexion réussie à 4 h. diff --git a/Semaine_15/Jour_05/vigie/ruff.toml b/Semaine_15/Jour_05/vigie/ruff.toml new file mode 100644 index 0000000..8c44307 --- /dev/null +++ b/Semaine_15/Jour_05/vigie/ruff.toml @@ -0,0 +1,13 @@ +# Règles de style de l'atelier Vigie. +# Garantit le même résultat de `ruff check .` chez tout le monde. + +line-length = 88 + +[lint] +select = ["E", "F", "W", "I", "UP", "B", "RET"] +ignore = ["DTZ011"] # on enseigne date.today(), pas les fuseaux horaires + +[lint.per-file-ignores] +# Dans le squelette, `collections` est importé d'avance et `ip_apres_from` +# renvoie None en attendant d'être écrite : les deux sont intentionnels. +"vigie.py" = ["F401", "RET501"] diff --git a/Semaine_15/Jour_05/vigie/test.py b/Semaine_15/Jour_05/vigie/test.py new file mode 100644 index 0000000..fb1b6b0 --- /dev/null +++ b/Semaine_15/Jour_05/vigie/test.py @@ -0,0 +1,3 @@ +import vigie + +vigie.ip_apres_from("185.203.44.17") \ No newline at end of file diff --git a/Semaine_15/Jour_05/vigie/test_vigie.py b/Semaine_15/Jour_05/vigie/test_vigie.py new file mode 100644 index 0000000..717abb0 --- /dev/null +++ b/Semaine_15/Jour_05/vigie/test_vigie.py @@ -0,0 +1,148 @@ +"""Tests de Vigie. + +Un exercice est réussi quand ses tests passent. + + pytest -v tous les tests + pytest -k exercice3 uniquement l'exercice 3 +""" + +import vigie + +AUTH = "journaux/auth.log" +FIREWALL = "journaux/firewall.log" +WEB = "journaux/web.log" + +ATTAQUANT_SSH = "185.203.44.17" +SCANNER = "45.134.26.88" +ATTAQUANT_WEB = "203.0.113.199" + + +# --- Exercice 1 ----------------------------------------------------------- + +def test_exercice1_lire_auth(): + assert len(vigie.lire(AUTH)) == 181 + + +def test_exercice1_lire_les_trois_journaux(): + assert len(vigie.lire(FIREWALL)) == 183 + assert len(vigie.lire(WEB)) == 126 + + +def test_exercice1_pas_de_retour_a_la_ligne(): + assert not vigie.lire(AUTH)[0].endswith("\n") + + +# --- Exercice 2 ----------------------------------------------------------- + +def test_exercice2_extraire_ip(): + ligne = ("Oct 3 04:10:02 srv-web01 sshd[2501]: Failed password for " + "invalid user root from 185.203.44.17 port 51234 ssh2") + assert vigie.ip_apres_from(ligne) == "185.203.44.17" + + +def test_exercice2_sans_from_renvoie_none(): + assert vigie.ip_apres_from("une ligne sans le mot attendu") is None + + +# --- Exercice 3 ----------------------------------------------------------- + +def test_exercice3_force_brute_detectee(): + alertes = vigie.regle_force_brute(vigie.lire(AUTH)) + assert len(alertes) == 1 + assert alertes[0]["ip"] == ATTAQUANT_SSH + assert alertes[0]["severite"] == "critique" + + +def test_exercice3_les_petits_bruits_sont_ignores(): + """91.207.183.44 a 17 échecs : sous le seuil, pas d'alerte.""" + alertes = vigie.regle_force_brute(vigie.lire(AUTH)) + assert "91.207.183.44" not in [a["ip"] for a in alertes] + + +def test_exercice3_le_nombre_apparait_dans_le_constat(): + alertes = vigie.regle_force_brute(vigie.lire(AUTH)) + assert "94" in alertes[0]["details"] + + +# --- Exercice 4 ----------------------------------------------------------- + +def test_exercice4_compromission_detectee(): + alertes = vigie.regle_compromission(vigie.lire(AUTH)) + assert len(alertes) == 1 + assert alertes[0]["ip"] == ATTAQUANT_SSH + assert alertes[0]["severite"] == "critique" + + +def test_exercice4_le_compte_vise_est_nomme(): + alertes = vigie.regle_compromission(vigie.lire(AUTH)) + assert "regis" in alertes[0]["details"] + + +# --- Exercice 5 ----------------------------------------------------------- + +def test_exercice5_scan_de_ports_detecte(): + alertes = vigie.regle_scan_ports(vigie.lire(FIREWALL)) + assert len(alertes) == 1 + assert alertes[0]["ip"] == SCANNER + assert "120" in alertes[0]["details"] + + +def test_exercice5_le_trafic_normal_ne_declenche_rien(): + alertes = vigie.regle_scan_ports(vigie.lire(FIREWALL)) + assert all(not a["ip"].startswith("192.168.") for a in alertes) + + +# --- Exercice 6 ----------------------------------------------------------- + +def test_exercice6_attaque_web_detectee(): + alertes = vigie.regle_attaques_web(vigie.lire(WEB)) + assert len(alertes) == 1 + assert alertes[0]["ip"] == ATTAQUANT_WEB + + +def test_exercice6_les_pages_normales_ne_declenchent_rien(): + normales = [ + '192.168.1.12 - [2026-10-05 09:02:55] "GET /produits" 200 5750', + '192.168.1.23 - [2026-10-05 09:05:11] "GET /contact" 200 1200', + ] + assert vigie.regle_attaques_web(normales) == [] + + +# --- Exercice 7 ----------------------------------------------------------- + +def test_exercice7_connexion_nocturne_detectee(): + alertes = vigie.regle_hors_horaires(vigie.lire(AUTH)) + assert len(alertes) == 1 + assert alertes[0]["severite"] == "moyenne" + + +def test_exercice7_les_connexions_de_journee_sont_ignorees(): + alertes = vigie.regle_hors_horaires(vigie.lire(AUTH)) + for a in alertes: + heure = int(a["horodatage"].split()[-1].split(":")[0]) + assert heure < vigie.HEURE_FIN_NUIT + + +# --- Exercice 8 ----------------------------------------------------------- + +def test_exercice8_toutes_les_alertes(): + assert len(vigie.analyser()) == 5 + + +def test_exercice8_triees_par_gravite(): + alertes = vigie.analyser() + rangs = [vigie.SEVERITES.index(a["severite"]) for a in alertes] + assert rangs == sorted(rangs), "les plus graves doivent venir en premier" + + +def test_exercice8_les_trois_journaux_sont_representes(): + sources = {a["source"] for a in vigie.analyser()} + assert sources == {"auth.log", "firewall.log", "web.log"} + + +def test_exercice8_rapport_ecrit(tmp_path): + chemin = tmp_path / "rapport.txt" + vigie.ecrire_rapport(vigie.analyser(), str(chemin)) + contenu = chemin.read_text(encoding="utf-8") + assert ATTAQUANT_SSH in contenu + assert len(contenu) > 200 diff --git a/Semaine_15/Jour_05/vigie/uv.lock b/Semaine_15/Jour_05/vigie/uv.lock new file mode 100644 index 0000000..3a3ac0c --- /dev/null +++ b/Semaine_15/Jour_05/vigie/uv.lock @@ -0,0 +1,75 @@ +version = 1 +revision = 3 +requires-python = ">=3.14" + +[[package]] +name = "colorama" +version = "0.4.6" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" }, +] + +[[package]] +name = "iniconfig" +version = "2.3.1" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/01/e1/2069291243c926a2ff1cd706c7f3eeb9b62144bf60f77c9fb9ff2fb26bd3/iniconfig-2.3.1.tar.gz", hash = "sha256:67f4b9c50da0dedf52af349e7749a80a9057a5031199791b906c3bb3ae878960", size = 21209, upload-time = "2026-10-06T22:48:38.076Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/56/43/4ca9e49d27a1fcf6bece6f6aec0ea46bb9112489b93d4b688fb415457bdb/iniconfig-2.3.1-py3-none-any.whl", hash = "sha256:9121e2c1fdb355232495be3194c8dfe87ccc2d5dee45947b78e68f499790d7a7", size = 7552, upload-time = "2026-10-06T22:48:36.959Z" }, +] + +[[package]] +name = "packaging" +version = "26.3" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/7d/fa/3944b40b07da9ce895c0e6303a5ab7d53da063554f534556b134a54d6093/packaging-26.3.tar.gz", hash = "sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79", size = 313412, upload-time = "2026-08-04T18:15:28.737Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/63/34/ba1c580383c9eada3711951fef0795c80b829a078d72188184bcab9dd527/packaging-26.3-py3-none-any.whl", hash = "sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c", size = 129956, upload-time = "2026-08-04T18:15:27.159Z" }, +] + +[[package]] +name = "pluggy" +version = "1.6.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/f9/e2/3e91f31a7d2b083fe6ef3fa267035b518369d9511ffab804f839851d2779/pluggy-1.6.0.tar.gz", hash = "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3", size = 69412, upload-time = "2025-05-15T12:30:07.975Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" }, +] + +[[package]] +name = "pygments" +version = "2.21.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/49/2e/ced460408999b33da6b31b0021b0f37d329e202d4169aeb164493778f25b/pygments-2.21.0.tar.gz", hash = "sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c", size = 5005329, upload-time = "2026-08-17T08:02:48.824Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/71/46/17f022dd3e953bf20a04a028a21ec746d942f8d2af30fa0f124fa0e6a684/pygments-2.21.0-py3-none-any.whl", hash = "sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9", size = 1250147, upload-time = "2026-08-17T08:02:44.912Z" }, +] + +[[package]] +name = "pytest" +version = "9.1.1" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "colorama", marker = "sys_platform == 'win32'" }, + { name = "iniconfig" }, + { name = "packaging" }, + { name = "pluggy" }, + { name = "pygments" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/e4/47/b9efed96c114afcfa3c9d3fe98a76a1d14c74a9e266d397cf6eb64be5e01/pytest-9.1.1.tar.gz", hash = "sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313", size = 1636369, upload-time = "2026-06-19T10:58:32.857Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/24/25/1de2678b631f5a49215c6c96fff41ba892b0a34df68d6d80292b1b48aa7f/pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c", size = 386536, upload-time = "2026-06-19T10:58:31.347Z" }, +] + +[[package]] +name = "vigie" +version = "0.1.0" +source = { virtual = "." } +dependencies = [ + { name = "pytest" }, +] + +[package.metadata] +requires-dist = [{ name = "pytest", specifier = ">=9.1.1" }] diff --git a/Semaine_15/Jour_05/vigie/vigie.py b/Semaine_15/Jour_05/vigie/vigie.py new file mode 100644 index 0000000..d0fcee6 --- /dev/null +++ b/Semaine_15/Jour_05/vigie/vigie.py @@ -0,0 +1,233 @@ +"""VIGIE — votre détecteur d'intrusion. + +Complétez les fonctions marquées « À FAIRE », dans l'ordre des exercices. +Aucune bibliothèque à installer : tout est dans la bibliothèque standard. + +Pour vérifier votre travail : pytest -v +Pour lancer votre détecteur : python vigie.py +""" + +import collections +from csv import Error +from operator import contains + +DOSSIER = "journaux" +AUTH_LOGS = f"{DOSSIER}/auth.log" +FIREWALL_LOGS = f"{DOSSIER}/firewall.log" +WEB_LOGS = f"{DOSSIER}/web.log" + +# Les quatre niveaux de gravité, du plus grave au moins grave. +SEVERITES = ["critique", "elevee", "moyenne", "faible"] + +# Les seuils de détection. On les sort du code pour pouvoir les ajuster +# sans toucher aux règles — et pour pouvoir les justifier. +SEUIL_ECHECS = 20 # échecs d'authentification depuis une même adresse +SEUIL_PORTS = 20 # ports distincts contactés par une même adresse +HEURE_DEBUT_NUIT = 0 # une connexion réussie entre ces deux heures +HEURE_FIN_NUIT = 5 # est considérée comme hors horaires + +# Les traces d'attaque à chercher dans les URL (exercice 6). +MOTIFS_WEB = [ + ("union select", "Injection SQL (UNION SELECT)"), + ("drop table", "Injection SQL (DROP TABLE)"), + ("' or '1'='1", "Injection SQL (OR 1=1)"), + ("sleep(", "Injection SQL temporisée"), + ("= SEUIL_ECHECS: + alertes.append({ + "source": "auth.log", "severite": "critique", + "titre": "Attaque par force brute", "ip": ip, + "details": f"{n} échecs d'authentification depuis cette adresse.", + "horodatage": premiere[ip], + }) + return alertes + +# ========================================================================== +# EXERCICE 4 — détecter une compromission +# ========================================================================== + +def regle_compromission(lignes_auth): + """Signale une connexion RÉUSSIE après une rafale d'échecs.""" + + echecs = {} + alertes = [] + for ligne in lignes_auth: + ip = ip_apres_from(ligne) + if "Failed password" in ligne: + echecs[ip] = echecs.get(ip, 0) + 1 + elif "Accepted password" in ligne and echecs.get(ip, 0) >= SEUIL_ECHECS: + mots = ligne.split() + compte = mots[mots.index("for") + 1] + alertes.append({ + "source": "auth.log", "severite": "critique", + "titre": "Compromission probable", "ip": ip, + "details": f"Connexion réussie sur le compte {compte} après " + f"{echecs[ip]} échecs.", + "horodatage": ligne[:15], + }) + return alertes + +# ========================================================================== +# EXERCICE 5 — détecter un scan de ports +# ========================================================================== + +def regle_scan_ports(lignes_firewall): + """Signale les adresses ayant contacté SEUIL_PORTS ports différents.""" + + ports = {} + premiere = {} + for ligne in lignes_firewall: + mots = ligne.split() + if mots[5] != "DROP": + continue + ip = mots[2] + ports.setdefault(ip, set()).add(mots[4]) + premiere.setdefault(ip, mots[0] + " " + mots[1]) + + alertes = [] + for ip, ensemble in ports.items(): + if len(ensemble) >= SEUIL_PORTS: + alertes.append({ + "source": "firewall.log", "severite": "elevee", + "titre": "Scan de ports", "ip": ip, + "details": f"{len(ensemble)} ports distincts contactés.", + "horodatage": premiere[ip], + }) + return alertes + +# ========================================================================== +# EXERCICE 6 — détecter les attaques applicatives +# ========================================================================== + +def regle_attaques_web(lignes_web): + """Signale les requêtes contenant une trace d'attaque.""" + + nombre = {} + premiere = {} + for ligne in lignes_web: + minuscule = ligne.lower() + if any(motif in minuscule for motif, _ in MOTIFS_WEB): + ip = ligne.split()[0] + nombre[ip] = nombre.get(ip, 0) + 1 + premiere.setdefault(ip, ligne.split("[")[1].split("]")[0]) + + alertes = [] + for ip, n in nombre.items(): + alertes.append({ + "source": "web.log", "severite": "elevee", + "titre": "Attaque applicative", "ip": ip, + "details": f"{n} requêtes malveillantes depuis cette adresse.", + "horodatage": premiere[ip], + }) + return alertes + +# ========================================================================== +# EXERCICE 7 — détecter les connexions hors horaires +# ========================================================================== + +def regle_hors_horaires(lignes_auth): + """Signale les connexions réussies entre minuit et 5 heures.""" + + alertes = [] + for ligne in lignes_auth: + if "Accepted password" not in ligne: + continue + heure = int(ligne.split()[2].split(":")[0]) + if HEURE_DEBUT_NUIT <= heure < HEURE_FIN_NUIT: + alertes.append({ + "source": "auth.log", "severite": "moyenne", + "titre": "Connexion hors horaires", "ip": ip_apres_from(ligne), + "details": f"Connexion réussie à {heure} h.", + "horodatage": ligne[:15], + }) + return alertes + +# ========================================================================== +# EXERCICE 8 — assembler le détecteur +# ========================================================================== + +def analyser(dossier=DOSSIER): + """Applique toutes les règles et renvoie les alertes, les plus graves d'abord.""" + + auth = lire(f"{dossier}/auth.log") + firewall = lire(f"{dossier}/firewall.log") + web = lire(f"{dossier}/web.log") + + alertes = (regle_force_brute(auth) + regle_compromission(auth) + + regle_hors_horaires(auth) + regle_scan_ports(firewall) + + regle_attaques_web(web)) + alertes.sort(key=lambda a: SEVERITES.index(a["severite"])) + return alertes + +def afficher(alertes): + """Affiche le rapport à l'écran.""" + + print(f"{len(alertes)} alerte(s)") + +def ecrire_rapport(alertes, chemin="rapport.txt"): + """Écrit le rapport dans un fichier, pour le joindre à un ticket.""" + + with open(chemin, "w", encoding="utf-8") as fichier: + fichier.write(f"{len(alertes)} alerte(s)\n") + for a in alertes: + fichier.write(f"\n[{a['severite'].upper()}] {a['titre']}\n" + f" Source : {a['source']}\n" + f" Adresse : {a['ip']}\n" + f" Horodatage : {a['horodatage']}\n" + f" Constat : {a['details']}\n") + +def main(): + alertes = analyser() + afficher(alertes) + ecrire_rapport(alertes) + + +if __name__ == "__main__": + main()