Bon j'ai tout refait nikel mais j'ai le même problème à chaque fois quand je vais dans le navigateur ça veut pas alors que avec un curl ça marche je comprend pas ça.
curl -v -I https://corde.info
* About to connect() to corde.info port 443 (#0)
* Trying 91.121.209.169...
* connected
* Connected to corde.info (91.121.209.169) port 443 (#0)
* successfully set certificate verify locations:
* CAfile: none
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using ECDHE-RSA-AES128-GCM-SHA256
* Server certificate:
* subject: OU=GT88055294; OU=See www.rapidssl.com/resources/cps (c)15; OU=Domain Control Validated - RapidSSL(R); CN=corde.info
* start date: 2015-07-02 18:32:34 GMT
* expire date: 2016-06-28 03:11:53 GMT
* subjectAltName: corde.info matched
* issuer: C=US; O=GeoTrust Inc.; CN=RapidSSL SHA256 CA - G3
* SSL certificate verify ok.
> HEAD / HTTP/1.1
> User-Agent: curl/7.26.0
> Host: corde.info
> Accept: */*
>
* additional stuff not fine transfer.c:1037: 0 0
* HTTP 1.1 or later with persistent connection, pipelining supported
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Server: nginx/1.8.0
Server: nginx/1.8.0
< Date: Fri, 03 Jul 2015 21:30:49 GMT
Date: Fri, 03 Jul 2015 21:30:49 GMT
< Content-Type: text/html; charset=utf-8
Content-Type: text/html; charset=utf-8
< Content-Length: 867
Content-Length: 867
< Last-Modified: Tue, 23 Jun 2015 13:26:28 GMT
Last-Modified: Tue, 23 Jun 2015 13:26:28 GMT
< Connection: keep-alive
Connection: keep-alive
< ETag: "55895e84-363"
ETag: "55895e84-363"
< Accept-Ranges: bytes
Accept-Ranges: bytes
<
* Connection #0 to host corde.info left intact
* Closing connection #0
* SSLv3, TLS alert, Client hello (1):
je te met mon firewall au cas ou mais j'ouvre bien les ports qu'il faut donc bon
#!/bin/sh
### BEGIN INIT INFO
# Provides: myfirewall
# Required-Start: $remote_fs $syslog $network
# Required-Stop: $remote_fs $syslog $network
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: firewall initscript
# Description: Custom Firewall
### END INIT INFO
###############################################################################
# FIREWALL
###############################################################################
###############################################################################
### Initialisation des tables
###############################################################################
# Initialise la table Filter (par defaut tout les echanges sont refuses)
echo " + Initialisation de la table Filter"
iptables -t filter -F
iptables -t filter -X
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
###############################################################################
### Creation des regles de filtrages
###############################################################################
# Autorise l'interface loopback à dialoguer avec elle-meme
echo " + Regles du localhost"
iptables -t filter -A INPUT -i lo -p all -j ACCEPT
#On accepte les paquets provenant de connexions existantes.
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# On accepte les ping
echo " + Regles du ping"
iptables -A INPUT -p icmp -j ACCEPT
###############################################################################
### Sécurité
###############################################################################
# Limiter le SYN FLOOD
iptables -A FORWARD -p tcp --syn -m limit --limit 1/second -j ACCEPT
iptables -A FORWARD -p udp -m limit --limit 1/second -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/second -j ACCEPT
# Boquer le scan de port
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
###############################################################################
# Services
###############################################################################
# Autorisation du HTTP/HTTPS entrant et sortant
# HTTP + HTTPS Out
iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 4443 -j ACCEPT
# HTTP + HTTPS In
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 8443 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 4443 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 4433 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 4433 -m state --state ESTABLISHED -j ACCEPT
# Autorise l'acces au serveur SSH local
echo " + Ouverture serveur SSH"
iptables -A INPUT -p tcp --dport 1024 -j ACCEPT
# Autorise l'acces au serveur Shellinabox
echo " + Ouverture serveur SSH"
iptables -A INPUT -p tcp --dport 1200 -j ACCEPT
#Autorisation acces webmin
iptables -A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
# Autorise l'acces au VPN
echo " + Ouverture serveur VPN"
# règles obligatoires pour ouvrir déverrouiller l’accès :
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -I FORWARD -i tun0 -j ACCEPT
iptables -I FORWARD -o tun0 -j ACCEPT
iptables -I OUTPUT -o tun0 -j ACCEPT
# autres règles : Translation d'adresses
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.8.0.2/24 -o eth0 -j MASQUERADE
#Samba
iptables -A INPUT -p udp --dport 137 -j ACCEPT
iptables -A INPUT -p udp --dport 138 -j ACCEPT
iptables -A INPUT -p tcp --dport 139 -j ACCEPT
iptables -A INPUT -p tcp --dport 445 -j ACCEPT
#T411
iptables -t filter -A INPUT -p tcp --dport 56969 -j ACCEPT
# Autorise l'acces au serveur PLEX
# Plex
iptables -A INPUT -p tcp -m multiport --dports 32400,32469 -j ACCEPT
iptables -A INPUT -p udp -m multiport --dports 1900,32410,32412,32413,32414 -j ACCEPT
# Autorise l'acces a transmission
echo " + Ouverture transmission"
iptables -A INPUT -p tcp --dport 9091 -j ACCEPT
#AVAHI
iptables -A INPUT -p udp -m udp --dport 5353 -j ACCEPT
iptables -A INPUT -p tcp --dport 548 -j ACCEPT
iptables -A INPUT -p tcp --dport 0 -j ACCEPT
iptables -A INPUT -p tcp --dport 9 -j ACCEPT
#Bonjour/Zeroconf
iptables -I INPUT -p udp --dport mdns -d 224.0.0.251 -j ACCEPT
iptables -I OUTPUT -p udp --dport mdns -d 224.0.0.251 -j ACCEPT
#SLP
iptables -I INPUT -p tcp --dport slp -j ACCEPT
iptables -I OUTPUT -p tcp --dport slp -j ACCEPT
iptables -I INPUT -p udp --dport slp -j ACCEPT
iptables -I OUTPUT -p udp --dport slp -j ACCEPT
# Serveur web
echo " + Ouverture serveur HTTP"
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 943 -j ACCEPT
# Mail SMTP:25
iptables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 25 -j ACCEPT
# Mail POP3:110
iptables -t filter -A INPUT -p tcp --dport 110 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 110 -j ACCEPT
# Mail IMAP:143
iptables -t filter -A INPUT -p tcp --dport 143 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 143 -j ACCEPT
# Mail POP3S:995
iptables -t filter -A INPUT -p tcp --dport 995 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 995 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 587 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 587 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 465 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 465 -j ACCEPT
# Mumble
echo " + Ouverture serveur Mumble"
#iptables -t filter -A INPUT -p tcp --dport 64738 -j ACCEPT
#iptables -t filter -A INPUT -p udp --dport 64738 -j ACCEPT
#AFP
iptables -I INPUT -p tcp --dport afpovertcp -j ACCEPT
#AppleTalk
iptables -I INPUT -p tcp -m multiport --dport at-rtmp,at-nbp,at-echo,at-zis -j ACCEPT
iptables -I OUTPUT -p tcp -m multiport --dport at-rtmp,at-nbp,at-echo,at-zis -j ACCEPT
#DNS
iptables -A INPUT -p udp -m udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
iptables -A INPUT -i lo -s localhost -d localhost -j ACCEPT
iptables -A OUTPUT -o lo -s localhost -d localhost -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# proxy squid echo " + Ouverture du proxy squid"
iptables -I INPUT -p tcp -s 82.240.101.94 --dport 8844 -j ACCEPT
iptables -A INPUT -p tcp --dport http -j ACCEPT
echo " + ======================== SCRIPT TERMINE! ========================="
echo " + Afficher la configuration de la table filter : 'iptables -L -n -v'"
echo " + =================================================================="
Mon vhost du site test
server {
listen 80;
listen 443 ssl;
server_name corde.info;
root /var/www/html;
index index.php index.html;
charset utf-8;
ssl on;
ssl_certificate /etc/nginx/ssl/corde.info.chained.crt;
ssl_certificate_key /etc/nginx/ssl/corde.info.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES256-GCM-SHA256:AES256-GCM-SHA384:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4";
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
location / {
try_files $uri $uri/ index.php;
}
location ~* \.php$ {
include /etc/nginx/fastcgi_params;
fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}
}
et aussi nginx.conf peut être
user www-data;
worker_processes auto;
pid /run/nginx.pid;
events {
worker_connections 768;
# multi_accept on;
}
http {
##
# Basic Settings
##
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
# server_tokens off;
# server_names_hash_bucket_size 64;
# server_name_in_redirect off;
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# SSL Settings
##
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;
##
# Logging Settings
##
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
##
# Gzip Settings
##
gzip on;
gzip_disable "msie6";
# gzip_vary on;
# gzip_proxied any;
# gzip_comp_level 6;
# gzip_buffers 16 8k;
# gzip_http_version 1.1;
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
##
# nginx-naxsi config
##
# Uncomment it if you installed nginx-naxsi
##
#include /etc/nginx/naxsi_core.rules;
##
# Virtual Host Configs
##
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
server {
listen 80 default_server;
listen [::]:80 default_server ipv6only=on;
listen 443 ssl;
root /usr/share/nginx/html;
index index.html index.htm;
server_name corde.info;
ssl_certificate /etc/nginx/ssl/corde.info.chained.crt;
ssl_certificate_key /etc/nginx/ssl/corde.info.key;
location / {
try_files $uri $uri/ =404;
}
}
}
#mail {
# # See sample authentication script at:
# # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
# # auth_http localhost/auth.php;
# # pop3_capabilities "TOP" "USER";
# # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
# server {
# listen localhost:110;
# protocol pop3;
# proxy on;
# }
#
# server {
# listen localhost:143;
# protocol imap;
# proxy on;
# }
#}
