wget 錯誤:ERROR: The certificate of `url' is not trusted. 處理方式

使用wget抓檔時 如果是https，有時會出現如下錯誤：

ERROR: The certificate of `url' is not trusted.
ERROR: The certificate of `url' hasn't got a known issuer.

解決方式如下：
1.
#apt-get install ca-certificates

2.
#wget --no-check-certificate https://download/url

Debian Fail2Ban 安裝設定筆記

安裝
apt-get install fail2ban

設定檔
/etc/fail2ban/fail2ban.conf

check
logtarget = /var/log/fail2ban.log

cp jail.conf jail.local
修改jail.local內容就好， 原始檔不動
jail.local設定會覆蓋jail.conf

注意事項
ignoreip = 127.0.0.1/8 192.168.1.0/24 (空白區隔)
bantime = 600(秒)
maxretry = 10 (失敗幾次封鎖)

增加dovecot

[dovecot]
enabled = true
port = pop3,pop3s,imap,imaps
filter = dovecot
logpath = /var/log/dovecot (看實際 log檔放哪)
maxretry  = 10

/etc/fail2ban/filter.d/dovecot.conf
[Definition]
failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P\S*),.*
ignoreregex =

/etc/fail2ban/filter.d/sasl.conf

failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [A-Za-z0-9+/ ]*={0,2})?$

=========

測規則

Example1

fail2ban-regex /var/log/dovecot /etc/fail2ban/filter.d/dovecot.conf

Example2

fail2ban-regex /var/log/mail.log /etc/fail2ban/filter.d/postfix.conf

Example3

fail2ban-regex /var/log/mail.log /etc/fail2ban/filter.d/sasl.conf

Postfix main.cf 設定檔記錄

 message_size_limit = 30720000
bounce_queue_lifetime = 1d
maximal_queue_lifetime = 2d
queue_run_delay = 10s

#20220105 update

minimal_backoff_time = 10s
maximal_backoff_time = 15s

#寄出時間
maximal_queue_lifetime = 1d
#退信時間
bounce_queue_lifetime = 1d

SVN安裝備忘 svn:// port 3690 (免Apache)

安裝

aptg subversion

建立目錄

mkdir -p /svn/myproject/

svnadmin create /svn/myproject

編輯

/svn/myproject/conf/svnserv.conf

auth-access = write
password-db = passwd

authz-db = authz

編輯

/svn/myproject/conf/passwd

youraccount = yourpassword

編輯

/svn/myproject/conf/authz

[/]
youraccount = rw
* = 

備份:

svnadmin dump /path/to/project/ >/tmp/project.dump

還原:

1.先刪除 

rm /path/to/project

2.再建立 

svnadmin create /path/to/project
svnadmin load    /path/to/project < /tmp/project.dump
3.再編輯 ./conf/svnserv.conf , passwd, authz 三個設定檔

MySQL Replication Master-Slave筆記

Master(my.cnf)192.168.1.203
server-id               = 1
log_bin                 = /var/log/mysql/mysql-bin.log

binlog_format = MIXED
要同步的DB
binlog_do_db = test
binlog_do_db = test2
innodb_flush_log_at_trx_commit=1
sync_binlog=1

mysql -u root -p
新增帳號給SLAVE同步使用
mysql>GRANT REPLICATION SLAVE ON *.* TO 'rep' IDENTIFIED BY 'pass';
or
mysql -u root -p -e "GRANT REPLICATION SLAVE ON *.* TO 'rep' IDENTIFIED BY 'pass';"
先鎖定資料庫
mysql -u root -p -e "FLUSH TABLES WITH READ LOCK;"
mysql -u root -p -e "SHOW MASTER STATUS\G;"
+------------------+----------+--------------+------------------+
| File Position | Binlog_Do_DB | Binlog_Ignore_DB |
+------------------+----------+--------------+------------------+
| mysql-bin.000002 |      107 | test         |                  |
+------------------+----------+--------------+------------------+
1 row in set (0.00 sec)
記下File與Position，等下會用到
quit

匯出要同步的那個資料庫
mysqldump -uroot -p --flush-logs --opt --master-data test > test.sql

解除鎖定

mysql -u root -p -e "UNLOCK TABLES;"

此時MASTER上的工作結束。

Slave(my.cnf)192.168.1.204

server-id               = 2

要同步的DB
replicate_wild_do_table = test.%

mysql -uroot -p -e "STOP SLAVE; RESET SLAVE;"

mysql -uroot -p -e "CHANGE MASTER TO MASTER_HOST='192.168.1.204',MASTER_USER='rep',MASTER_PASSWORD='pass',
MASTER_LOG_FILE='mysql-bin.000002',MASTER_LOG_POS=107;"

mysql -uroot -p -e "START SLAVE;"

檢視MASTER的狀態
mysql -uroot -p -e "SHOW MASTER STATUS;"
+------------------+----------+--------------+------------------+
| File|Position| Binlog_Do_DB | Binlog_Ignore_DB |
+------------------+----------+--------------+------------------+
| mysql-bin.000001 |      107 |              |                  |
+------------------+----------+--------------+------------------+
1 row in set (0.00 sec)

檢視SLAVE的狀態
mysql -uroot -p -e "SHOW SLAVE STATUS\G;"
*************************** 1. row ***************************
Slave_IO_State: Waiting for master to send event
Master_Host: 192.168.1.204
Master_User: rep
Master_Port: 3306
......
Slave_IO_Running: Yes
Slave_SQL_Running: Yes
......

運作正常，此時可到MASTER上新增資料看是否立即同步至SLAVE

Debian Java-Bridge精簡安裝(免裝Tomcat) 2014

*不要再找java.so或java.dll了，那已是過時的資訊

1.安裝php

2.下載Java JDK Linux版 並安裝 可參考 Debian安裝Java JDK記錄

3.取得JavaBridge.jar,php-script.jar,php-servlet.jar (JavaBridge.war解開)

找個地方放javabridge
mkdir -p /usr/local/javabridge
cp ./javabridge/JavaBridge.jar /usr/local/javabridge/
cp ./javabridge/php-script.jar /usr/local/javabridge/

cp ./javabridge/php-servlet.jar /usr/local/javabridge/

其他jar檔放/usr/java/packages/lib/ext(會放這邊是因為預設include目錄在這)
mkdir -p /usr/java/packages/lib/ext
cp ./javabridge/other_jar_files.jar /usr/java/packages/lib/ext/

執行JavaBridge.jar
/usr/local/jdk/bin/java -jar /usr/local/javabridge/JavaBridge.jar SERVLET:8080 &

製作Debian USB安裝碟

每次要安裝Debian都要燒一片光碟來裝(新版的出很快)，所以製作一個USB安裝碟，這樣每次要安裝時只要下載後複製到USB隨身碟再裝就可以了。

另外有一些自已常用的安裝設定、script都可以一起放在隨身碟裡面，減少安裝後設定的麻煩。

系統需先安裝
#apt-get install mbr syslinux dosfstools

準備USB隨身碟(FAT16,BootFlag)
安裝mbr
#install-mbr /dev/sdX 1
#mkdosfs /dev/sdX 1
#syslinux /dev/sdX 1

mount /dev/sdX 1 /usb

把vmlinuz,initrd.gz 複製到USB根目錄
檔案從這下載：

http://ftp.debian.org/debian/dists/wheezy/main/installer-i386/current/images/hd-media/

在USB根目錄建立syslinux.cfg
default vmlunuz
append initrd=initrd.gz

再把安裝光碟ISO 檔複製到USB上
結束！


參考：Debian官方安裝文件4.3.3

Debian 安裝 Tomcat7 筆記

安裝JDK
#tar zxvf jdk-7u45-linux-i586.tar.gz
#mv jdk1.7.0_45/ /usr/local/

建立link
#ln -s /usr/local/jdk1.7.0_45/ /usr/local/jdk

編輯/etc/environment
JAVA_HOME=/usr/local/jdk
CLASSPATH=$JAVA_HOME/lib

安裝Apache,Tomcat7
#apt-get install tomcat7 apache2 install libapache2-mod-jk

編輯/etc/tomcat7/server.xml

取消 <"8009" protocol="AJP1.3" redirectPort="8443" />

編輯 /etc/libapache2-mod-jk/workers.properties

workers.tomcat_home=/usr/share/tomcat7

workers.java_home=/usr/local/jdk

worker.myworker.host=localhost

編輯 /etc/apache2/sites-enabled/000-default

Before </virtualhost> Add

JkMount /*.jsp ajp13_worker

JkMount /*.do ajp13_worker

JkUnMount /*.php ajp13_worker 

找個test.jsp來測試
收工！ 

tomcat-users.xml
<role rolename="admin"/>
<role rolename="manager"/>
<role rolename="manager-gui"/>
<role rolename="manager-script"/>
<role rolename="manager-jmx"/>
<role rolename="manager-status"/>
<user username="tomcat" password="secret" roles="manager-gui,manager-script,manager-jmx,manager-status,manager,admin"/>

ntpdate網路校時

安裝
apt-get install ntpdate

執行校時

ntpdate ntp.ntu.edu.tw
ntpdate ntp.ntu.edu.tw

13 Aug 06:48:22 ntpdate[12849]: adjust time server 140.112.2.189 offset -0.141835 sec

FTP上傳備份資料Script

將備份檔案以7zip壓縮並上傳FTP的Script，記綠一下。

backup.sh

#!/bin/bash
bd=$(date +%Y%m%d)
cd /where you want to backup/

tar pcvf - directoryname|7za a -si /bak/directoryname.${bd}.tar.7z

mysqldump -uusername -ppassword dbname > /bak/dbname.${bd}.sql
svnadmin dump /home/svn/repository/project > /bak/project.dump

cd /bak/

HOST='IP'
USER='username'
PASS='password'
ftp -ivn $HOST << EOF
user $USER $PASS
bin
put backupfilename
quit
EOF


Note:FTP常用指令

ls     查看 Server 端的目錄或檔案
pwd    查看 Server 端目前所在的目錄
cd     變更 Server 端目前的目錄
cdup   變更 Server 端目前的目錄到上一目錄
lls    查看 Local 端的目錄或檔案
lcd    變更 Local 端目前的目錄
asc    設定傳輸模式為文字檔方式
bin    設定傳輸模式為二進位檔方式
get    將 Server 端的檔案拷貝至 Local 端現在目錄下
mget   拷貝多個 Server 端的檔案至 Local 端現在目錄下
put    將 Local 端的檔案拷貝至 Server 端現在目錄下
mput   拷貝多個 Local 端的檔案至 Server 端現在目錄下
delete 刪除 Server 端的檔案
mkdir  在 Server 端建立目錄
rmdir  刪除 Server 端的目錄
!      shell 指令
!ls    查看 Local 端的目錄或檔案
prompt 變換交談模式 (on/off)，
?,help 指令使用說明
bye    結束 FTP

Samba安裝筆記

apt-get install samba

編輯/etc/samba/smb.conf
[global]
   workgroup = WORKGROUP
   display charset = UTF8
   dos charset= cp950
   unix charset= UTF8
   server string = server description
   dns proxy = no
;   name resolve order = lmhosts host wins bcast
;   interfaces = 127.0.0.0/8 eth0
;   bind interfaces only = yes
#### Debugging/Accounting ####
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d
   security = share
   encrypt passwords = true
   passdb backend = tdbsam
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = yes
#======================= Share Definitions =======================
   read only = yes
   create mask = 0700
   directory mask = 0700
   vaild users = %s

[250g1]
comment = 250g1
path = /250g1
guest ok = yes
writable = yes
share modes = yes
[250g2]
comment = 250g2
path = /250g2
guest ok = yes
writable = yes
share modes = yes

SVN安裝備忘

安裝

aptg libapache2-svn subversion

建立目錄

mkdir -p /home/svn/repository/

svnadmin create /home/svn/repository/PROJECT_NAME

設定owner

chown -R www-data.www-data /home/svn/repository/PROJECT_NAME

編輯
/etc/apache2/mods-available/dav_svn.conf
修改如下，如沒有,a2enmod dav_svn自動產生

  DAV svn
  SVNParentPath /home/svn/repository
  AuthType Basic
  AuthName "Subversion Repository"
  AuthUserFile /etc/apache2/dav_svn.passwd
  AuthzSVNAccessFile /etc/apache2/dav_svn.authz
  Require valid-user

編輯
/etc/apache2/dav_svn.authz

[PROJECT_NAME:/]
* =
user1 = rw
user2 = rw

PS:PROJECT_NAME:/目錄名

增加帳號/密碼到/etc/apache2/dav_svn.passwd
/usr/bin/htpasswd -c /etc/apache2/dav_svn.passwd user1
/usr/bin/htpasswd /etc/apache2/dav_svn.passwd user1

重新啟動apache

checkout(co)/commit(ci)/update(up)
svn co http://ip.or.domain/svn/PROJECT_NAME

備份:
svnadmin dump /path/to/project/ >/tmp/project.dump

還原:

先刪除

rm /path/to/project

再建立

svnadmin create /path/to/project
svnadmin load    /path/to/project < /tmp/project.dump
chown www-data.www-data -R /path/to/project

其他: 
唯一識別ID:(Client端應該是認這個，uuid不同應該會不能用)
 /PROJECT_NAME/db/uuid

Postfix設定白名單

1.編輯/etc/postfix/rbl_whitelist

1.2.3.4 OK
192.168.1.100 OK
mail.domain.com OK
company.domain.com OK

存檔

2.執行postmap /etc/postfix/rbl_whitelist

3.編輯/etc/postfix/main.cf

找到smtpd_recipient_restrictions
可能會是像下面這個樣子

在reject_unauth_destination之後與第一條擋信規則之前
加上check_client_access hash:/etc/postfix/rbl_whitelist

smtpd_recipient_restrictions =
 permit_mynetworks,
 permit_sasl_authenticated,
 reject_unauth_destination,
 check_client_access hash:/etc/postfix/rbl_whitelist,
 reject_rbl_client zen.spamhaus.org,
 reject_rbl_client bl.spamcop.net

4.重啟服務 /etc/init.d/postfix restart

註：這裡注意在設定參數值的時侯，一行太長，想換行記得以空白字元開頭。

LAMP安裝備忘(Linux Apache Mysql Php) on Debian

apt-get install apache2 mysql-server php5 php5-mysql

apache2設定

編輯 /etc/apache2/apache2.conf or httpd.conf
加上 EnableSendfile Off

編輯 /etc/apache2/apache2.conf
加上 ServerName 127.0.0.1

mysql設定

編輯 /etc/mysql/my.cnf
修改 bind-address = 127.0.0.1 => #bind-address = 127.0.0.1
[mysqld]之下加入(跟效能調校有關)
max_connect_errors = 1844674407370954751
connect_timeout = 20
skip-name-resolve
slave_net_timeout = 30


建帳號、新增使用者
mysql> grant all privileges on *.* to 'vega'@'localhost' identified by 'vega' with grant option;

mysql> grant all privileges on *.* to 'vega'@'%' identified by 'vega' with grant option;

mysql> GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP ON dbname.* to 'vega'@'%' identified by 'vega';

更新權限
mysql>flush privileges;

改密碼
mysql>update user set Password=PASSWORD('new_pass') where user='root';

MYSQL 5.7版已無Password欄位
update user set authentication_string=password('1111') where user='root';

看權限

SHOW GRANTS FOR 'vega'@'%';

postfix+dovecot+sasl建置設定筆記

apt-get install postfix,libsasl2-2,libsasl2-modules,sasl2-bin,dovecot-common,dovecot-imapd,dovecot-pop3d

修改/etc/postfix/main.cf
smtpd_sasl_auth_enable = yes

broken_sasl_auth_clients = yes
smtpd_client_restrictions = permit_sasl_authenticated
smtpd_sasl_security_options = noanonymous
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
 
修改/etc/postfix/master.cf
取消chroot

建立/etc/postfix/sasl/smtpd.conf
log_level:3
pwcheck_method:saslautd
mech_list:PLAIN LOGIN

修改/etc/default/saslauthd
START = yes
MECHANISMS = shadow

修改/etc/dovecot/dovecot.conf
protocols = imap pop3
listen = *
disable_plaintext_auth = no
mail_location = maildir:/home/%u/Maildir

修改目錄權限/var/run/saslauthd為755 已無法正常運作
把postfix加入sasl群組來解決這個問題

Debian關閉IPV6

之前的方法是編輯/etc/modprobe.d/aliases.conf
把alias net-pf-10 off 掉就可以了，但是現在就算改了
還是會在netstat裡面可以看到有ipv6的訊息

包括再加 alias ipv6 off
還有/etc/modprobe.d/blocklist.conf
blacklist ipv6
blacklist net-pf-10
也是沒有用

最後修改/etc/sysctl.conf
加上net.ipv6.conf.all.disable_ipv6=1


重開後，大部份的ipv6的port都不會出現了
只剩下port 22還在，不知為啥麼，至少其他port先關了，之後再看有沒有其他方法關掉.

Linux Apache 圖片無法正常顯示

今天在重新安裝Apache時發現無法正常顯示圖片
Firefox完全無法顯示，IE則是顯示一半

解決方式：
在httpd.conf或apache2.conf加上

EnableSendfile Off

伺服器沒支援這東西的話，就要關掉.

Apache2 安裝evasive模組阻檔SYN攻擊

無法查看此摘要。請 按這裡查看文章。

Debian Java-Bridge精簡安裝(免裝Tomcat)

1. 安裝JDK, 請參考安裝Java JDK
2. 下載編譯php-java-bridge

apt-get install php5-dev re2c make php-pear

取得  php-java-bridge_5.5.4.1.tar.gz

#tar zxvf php-java-bridge_5.5.4.1.tar.gz
#mv php-java-bridge_5.5.4.1 /usr/local/
#cd /usr/local/php-java-bridge_5.5.4.1
#phpize
#./configure --disable-backend --with-java=/usr/local/jdk
#make install  (/usr/lib/php5/20060613+lfs/java.so)(php-java-bridge-5.5.4.1/modules/java.so)
#cp -r php-java-bridge-5.5.4.1/server/META-INF/java /usr/share/php/  (給php用的JAVA Library)

3.取得JavaBridge.jar放到  /usr/lib/php5/20060613+lfs/JavaBridge.jar
4.設定PHP, 編輯java.ini
#vi /etc/php5/conf.d/java.ini

extension=java.so;;php_java.dll on windows
[java]
java.class.path = /usr/lib/php5/20060613+lfs/
java.library.path = /usr/lib/php5/20060613+lfs/:/usr/local/jdk/bin/
java.java_home = /usr/local/jdk/bin/
java.java = /usr/local/jdk/bin/java
java.log_level = 2

5.重啟apache2
#/etc/init.d/apache2 restart

6.檢查是否已載入
php -m
7.測試檔test.php

require_once("java/JavaBridge.inc");

require_once("java/JavaProxy.inc");
java_require("/path/to/jar/file/directory");

$str = new java("java.lang.String", "hello");
echo $str;
?>

Debian安裝VritualBox錯誤訊息

安裝VirtualBox遇到的錯誤訊息.

W: GPG error: http://download.virtualbox.org lenny Release: 由於無法取得它們的公鑰，以下簽章無法進行驗證： NO_PUBKEY 54422A4B98AB5139

解決方式如下：

# apt-key list

/etc/apt/trusted.gpg
--------------------
pub 1024D/XX2584E6 2008-04-06 [到期: 2012-05-15] ...

...

pub 1024D/6DFBCBAE 2008-07-14

uid Sun Microsystems, Inc. (xVM VirtualBox archive signing key)
sub 2048g/78A86EAF 2008-07-14

刪除有問題的key 
#apt-key del 78A86EAF
重新下載公鑰 
#wget http://download.virtualbox.org/virtualbox/debian/oracle_vbox.asc
加入公鑰
#apt-key add oracle_vbox.asc
更新update
#apt-get update