Pitted Knowledge of the Almighty Olive: sysadmin

Showing posts with label sysadmin. Show all posts

Mar 2, 2018

Automatically make web apps use HTTPS with Let's Encrypt, Nginx, and Docker

Make sure you have docker already installed.

Install the Nginx proxy with docker-gen


sudo docker run --name=Nginx -d \
--restart=always \
-p 80:80 -p 443:443 \
-v /data/certs:/etc/nginx/certs:ro \
-v /var/run/docker.sock:/tmp/docker.sock:ro \
-v /data/Nginx/vhost.d:/etc/nginx/vhost.d \
-v /data/Nginx/html:/usr/share/nginx/html \
--label com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy \
jwilder/nginx-proxy

Since I run portainer, start it up with the VIRTUAL_HOST and VIRTUAL_PORT environment variables so that docker-gen can pick it up. You can do this with any app you desire.


sudo docker run --name Portainer -d \
--restart=always \
-p 9000:9000 \
-v /var/run/docker.sock:/var/run/docker.sock \
-v portainer_data:/data \
-e VIRTUAL_HOST=portainer.local.network \
-e VIRTUAL_PORT=9000 \
portainer/portainer

Now to use the Let's encrypt container to make certificates for our docker containers:


sudo docker run --name=Letsencrypt -d \
--restart=always \
-v /data/certs:/etc/nginx/certs:rw \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
--volumes-from Nginx \
jrcs/letsencrypt-nginx-proxy-companion

To enable SSL for your site, set the environment variables VIRTUAL_PROTO=https, VIRTUAL_PORT=433 environment as well as the LETSENCRYPT_HOST and LETSENCRYPT_EMAIL variables so that docker-gen can pick it up. You can do this with any app you desire. You will also need to mount the certificates and keys within the SSL folder of the container for the container to use the LetsEncrypt keys.

Mar 1, 2018

Making Docker Daemon listen on network port during start-up

Took a bit of time to find the relevant documentation piece, so I thought I would outline it here for easy reference.

Option 1:

This should work for some systems, although distributions that use systemctl may have their docker.service entry overwrite this setting, so you will need to use option 2.

If not already created, create the file /etc/docker/daemon.json

Add in the following:


{
  "hosts": ["fd://", "tcp://0.0.0.0:2375"]
}

Restart docker and check the docker daemon process. It should have the additional -H flag like so:


$ sudo ps aux | grep dockerd
root     31239  0.7  0.2 1007880 72816 ?       Ssl  15:03   0:00 /usr/bin/dockerd -H fd:// -H tcp://0.0.0.0:2375

Option 2:

Edit the service by running:
```
sudo systemctl edit docker.service
```

Add the following lines:


[Service]
ExecStart=
ExecStart=/usr/bin/dockerd -H fd:// -H tcp://0.0.0.0:2375

Reload the service configuration:
```
sudo systemctl daemon-reload
```
Restart the daemon:
```
sudo systemctl restart docker.service
```
Use the last step of the previous option to test whether docker is listening on the network port

Feb 20, 2018

Fail2Ban unbanning process

Log into the target machine with Fail2Ban installed
Look at the list of banned IPs and identify the IP you wish to unban:
```
sudo iptables -L -n
```
Discover the names of the jails:
```
sudo fail2ban-client status
```

Unban the IP:

sudo fail2ban-client set ssh-iptables unbanip 123.123.123.123

Running a new GitLab Runner for private GitLab server

This guide was created in conjunction with the official tutorial.

On your Docker installation, download the Gitlab Runner container. When it is eventually run, there are two volumes that are automatically created: /etc/gitlab-runner and /home/gitlab-runner. You may choose to mount these locally on your host instead.
During the run step, make sure you mount your host's docker socket, either using the -v parameter (-v /var/run/docker.sock:/var/run/docker.sock) or your tool of preference.
Open up a shell console on the Runner container.
Run the registration process (gitlab-runner register) and follow the prompts (the details are listed in the Admin Area under Overview -> Runners)

Feb 19, 2018

Exposing your docker daemon API via network port (and getting it into Portainer)

These instructions will be targeted to Linux installations with systemd installed. In particular, I have used an Ubuntu-flavoured distro (ElementaryOS). I presume you have already installed docker onto your machine.

Stop the Docker daemon if is is already running
```
sudo systemctl stop docker.service
```
You can check the status of the service (including if it is even installed)
```
sudo systemctl status docker.service
```

Open the service configuration file

sudo nano /lib/systemd/system/docker.service

Find the line with 'ExecStart' and modify it as follows (saving it once complete):
```
ExecStart=/usr/bin/dockerd -H tcp://0.0.0.0:2375 -H fd://
```
Reload all of the daemons:
```
sudo systemctl daemon-reload
```
Start the service
```
sudo systemctl start docker.service
```
Open up your portainer installation, navigate to the 'Endpoints' menu item and then enter in the IP and port for your target computer.

Jan 25, 2018

Interacting with Docker containers

Running an interactive shell on the container:


# Your container may have /bin/sh instead
docker exec -t -i [container] /bin/bash

Running a command on an image instead (i.e not a running instance):
```
docker run -t -i [image] /bin/bash
```
Get the output of a running container (for logs etc):
```
docker attach --no-stdin [container]
```

Cleaning docker

You can use the following bash script to clean out your docker instance:


#!/bin/bash
echo "docker-clean.sh [container|image|volume|cache|data|debugbar]"
if [ "$1" == "container" ]; then
    #Cleaning containers
    docker ps --no-trunc -aqf "status=exited" | xargs docker rm
elif [ "$1" == "image" ]; then
    #Cleaning images
    docker images --no-trunc -aqf "dangling=true" | xargs docker rmi
elif [ "$1" == "volume" ]; then
    #Cleaning volumes
    docker volume ls -qf "dangling=true" | xargs docker volume rm
fi

Jul 4, 2014

Recover LVM Boot partition within a live CD (installing GRUB)

This allows you to recover the Master Boot record when a RAID 5 array fails.

Activate LVM partitions
sudo mdadm --assemble --scan
sudo vgchange -a y [name of volume group]
Mount all volumes to a single mount-point
sudo mount /dev/mapper/[volume group]/[root volume] /mnt/
sudo mount /dev/mapper/[volume group]/[usr volume] /mnt/usr/
sudo mount /dev/mapper/[volume group]/[home volume] /mnt/home/
... etc
Mount and bind directories for grub to detect the underlying hardware
sudo mount --bind /dev /mnt/dev
sudo mount --bind /dev/pts /mnt/dev/pts
sudo mount --bind /proc /mnt/proc
sudo mount --bind /sys /mnt/sys
Jump into the new mounted system
sudo chroot /mnt
Install GRUB
grub-install /dev/sda
grub-install --recheck /dev/sda
update-grub
Exit the environment and restart
exit
sudo umount /mnt/dev/pts
sudo umount /mnt/*
sudo shutdown -r now

Jul 3, 2014

Recovering a RAID 5 array

Recently had a RAID 5 array fail on me. These are the steps I took to recover the data.

NOTE! The order of the disks in /dev/sdX follows the numbering of the ports on the motherboard. So if a disk is plugged into port 0, it will show up as /dev/sda. Keep this in mind as if you remove a failed disk, it might mess up the references in the array!.

Boot up from a Live CD
Install the software RAID management software
sudo apt-get install mdadm
Make sure RAID and LVM are unmounted
sudo vgchange -a n [name of your volume group] sudo mdadm -S /dev/md0
Copy the failed disk to the new disk (in case the disk was the boot disk, you need to copy that flag across so that your system boots)
sudo sfdisk -d /dev/sdx | sudo sfdisk /dev/sdy
Check that the disks are the same
sudo fdisk -l
Mount the RAID array, and remove the failed disk
sudo mdadm --assemble --scan sudo mdadm --manage --remove /dev/sdx
Add the new disk
sudo mdadm --manage --add /dev/sdy
Watch the progress as mdadm rebuilds your RAID array
sudo cat /proc/mdstat

Nov 30, 2013

Debian and XFCE: Print Screen Key

Print Screen Key

To enable the print screen key, just head on to Application Menu > Settings > Keyboard and click on the Application Shortcuts tab.

Add a new command and in the text box enter in the following:

xfce4-screenshooter -f

Hit Ok, and the next dialogue will require you to enter in the key (or key combination) that will trigger this command (in this case, we will press the 'Prt Scr' key).

References:

https://wiki.archlinux.org/index.php/Xfce

Nov 4, 2013

Debian: Installing gitolite

Tried setting up gitolite in Debian following my earlier guide with CentOS, but it didn't work out as well because there were a few steps missing (Debian doesn't create the gitolite user automatically). These are the modified steps:

Install gitolite:
sudo apt-get install git git-core python-setuptools gitolite
Add the gitolite user (this is the user that will host the git repositories and control access):
sudo useradd gitolite
As the user who will be administrating the set-up (i.e. someone OTHER than the gitolite user), create a set of ssh keys and move them to where the gitolite user can access them:
ssh-keygencp ~/.ssh/id_rsa.pub /tmp/admin.pub
Switch to the gitolite user:
sudo su - gitolite
Run the set-up command:
gl-setup /tmp/admin.pub
As the user who will be administrating the set-up, clone the repository
git clone gitolite@[ip address]:gitolite-admin.git

You can now add in other keys and set up the configuration of gitolite.

References:

Nov 3, 2013

Debian and XFCE Dual Monitors

Open up a terminal and type in xrandr. This will output the configuration of the currently connected monitors. Identify the names of your monitors (such as HDMI2, LCD1, VGA1, CRT2 or whatever). In this example we have two monitors, HDMI1 and HDMI2.

Now type in the desired layout:

xrandr --output HDMI2 --left-of HDMI1

The monitors should now be showing your desired screen laytout. If not, play around until you have it.

To make this layout permanent, click on the Start menu > Settings > Session and Startup and then click on the Application Autostart tab. Add a new autostart item and then insert the xrandr command into the Command text field. Now if you restart your settings will be automatically loaded!

References

http://www.linuxquestions.org/questions/showthread.php?p=4658799

Oct 8, 2013

Laravel 4: Setting up and basics

This guide will go through one method of setting up a basic Laravel 4 environment. There are quick-start instructions, however in this guide we are not going to rely on a pre-installed global Composer binary.

These instructions require that you have git installed.

Installation

Clone the laravel framework repository. This contains a basic layout for an application, although composer will be required to install all the dependencies.

git clone https://github.com/laravel/laravel.git
Rename the directory to one more suited for your project

mv laravel/ [project]
Change the permissions and owner of your project

chown -R [user]:[group] [project]
Go into your project directory

cd [project]
Download a copy of composer for your project

curl -sS https://getcomposer.org/installer | php
Since composer will now handle all dependancies, we no longer need git to mirror the laravel repository. Remove it:

git remote -vgit remote rm origin
If you wish to keep the repository around, you should just rename it:

git remote rename origin laravel
Edit your composer dependencies, which are stored in composer.json. If nothing else, edit the name, description, keywords, and license fields to suit your project.
Ensure your composer.json is valid by running:

php composer.phar validate
Install all dependancies via composer

php composer.phar install
Run the in-built PHP development server to check that everything is working correctly

php artisan server

You should now be able to view your new application through http://localhost:8000/. Use the --help flag to see more configuration options.
If you make changes to your composer dependancies, just run:

php composer.phar update

Netbeans and Laravel set-up

Follow the above instructions to create a new instance of Laravel
Start a new project by clicking on File -> New Project
Select PHP -> PHP Application with existing sources
Select the sources folder as the project directory you created earlier
Set the 'Run As' configuration as PHP Built-in Web Server with the router script set to public/index.php. Note that other files (such as css and js files) stored in the public directory will not be served.

Eclipse and Laravel set-up

Ensure you have installed the PHP development extensions
Select File -> New Project -> Project
Select PHP -> PHP Project
Enter in a project name and choose the existing source folder. You can finish the settings now, or configure the project further.
I could not get the Eclipse PHP server to work, so you will have to figure that one our for yourself.

Composer overview

The command php composer.phar will list all the available commands in composer
The composer.json file will list dependencies and configuration defaults for the composer binary.
The composer.lock file is generated after you run the install or update composer command. This file will store the exact version downloaded and any local configuration.

Resources

Aug 25, 2013

Linux Mint Multiseat with keyboards & mice(Xephyr)

I must state this important fact first:

Xephyr on Ubuntu/Linux Mint does not come compiled with evdev support.

This is important because Linux uses evdev to configure most input devices like keyboards and mice. You will see lots of documentation on configuring inputs with evdev, but none of those methods will work unless you compile Xephyr from scratch and enable evdev yourself.

I downloaded and installed the following executable to make my life easier. I repeat, this method will not work unless you have a modified version of Xephyr with evdev support!

Correct drivers - make sure they are installed!

I used an older Nvidia card so the following commands got me up and running:

sudo apt-get -y xserver-xorg-video-nouveau
#
# Upgrade our system
sudo apt-get -y install ubuntu-drivers-common
sudo apt-get -y install nvidia-current nvidia-settings

If you are unsure what graphics card you have then run the following (the second line is my output; yours will probably be different):

$ lspci | grep VGA
01:00.0 VGA compatible controller: NVIDIA Corporation GT218 [GeForce 210] (rev a2)

Input devices

Determine which devices are which by running the following command (unplug devices to help to narrow down your options). The paths you see are going to help in writing up our configuration file.

$ ls -l /dev/input/by-path/
total 0
lrwxrwxrwx 1 root root 9 May 27 18:39 pci-0000:00:1d.0-usb-0:1:1.0-event-kbd -> ../event3
lrwxrwxrwx 1 root root 9 May 27 18:39 pci-0000:00:1d.0-usb-0:2:1.0-event-mouse -> ../event4
lrwxrwxrwx 1 root root 9 May 27 18:39 pci-0000:00:1d.0-usb-0:2:1.0-mouse -> ../mouse0
lrwxrwxrwx 1 root root 9 May 27 18:39 platform-i8042-serio-0-event-kbd -> ../event2
lrwxrwxrwx 1 root root 9 May 27 18:39 platform-i8042-serio-1-event-mouse -> ../event5
lrwxrwxrwx 1 root root 9 May 27 18:39 platform-i8042-serio-1-mouse -> ../mouse1

Custom Xephyr script

The custom script (save it to /usr/sbin/Xephyr.sh) will act like the glue in our multi-seat environment. It will attach input devices to our monitors and some other stuff.

#!/bin/bash
# 20060905 - josean - added get_event() function to obtain eventNN from a physical address
# Original version:
# http://en.wikibooks.org/wiki/Multiterminal_with_Xephyr
# http://www.c3sl.ufpr.br/multiterminal/howtos/Xephyr.sh
trap "" usr1
XEPHYR=/usr/local/sbin/Xephyr
get_event()
{
evento=`grep -A5 $1 /proc/bus/input/devices | grep 'H: Handlers=' | grep --only-matching -e 'event[0-9]*'`
}
args=()
while [ ! -z "$1" ]; do
if [[ "$1" == "-xauthority" ]]; then
shift
if [ ! -z "$1" ]; then
export XAUTHORITY="$1"
fi
elif [[ "$1" == "-display" ]]; then
shift
if [ ! -z "$1" ]; then
export DISPLAY="$1"
fi
elif [[ "$1" == "-kbdphys" ]]; then
shift
if [ ! -z "$1" ]; then
get_event $1
args=("${args[@]}" "-keybd")
args=("${args[@]}" "evdev,,device=/dev/input/$evento,xkbrules=evdev,xkbmodel=evdev,xkblayout=us")
fi
elif [[ "$1" == "-mousephys" ]]; then
shift
if [ ! -z "$1" ]; then
get_event $1
args=("${args[@]}" "-mouse")
args=("${args[@]}" "evdev,5,device=/dev/input/$evento")
fi
else
if ! expr match $1 'vt[0-9][0-9]*' >/dev/null; then
args=("${args[@]}" "$1")
fi
fi
shift
done
echo $XEPHYR "${args[@]}"
exec $XEPHYR "${args[@]}"

Xorg.conf settings

Edit /etc/X11/xorg.conf with something similar to the following. Please change the values to your whatever matches your system!!

############## SETTINGS#############
Section "ServerFlags" Option "DontZap" "true" Option "DontVTSwitch" "true" Option "DontZoom" "true" Option "AllowMouseOpenFail" "true" Option "AllowEmptyInput" "true" Option "AutoAddDevices" "false" Option "AutoEnableDevices" "false" Option "Xinerama" "false" Option "NoPM" "true" Option "DPM" "false" Option "BlankTime" "0" Option "StandbyTime" "0" Option "SuspendTime" "0" Option "OffTime" "0"EndSection
############## INPUTS#############
Section "InputDevice" Identifier "Keyboard1" Driver    "evdev" Option    "Device" "/dev/input/event2" Option    "Floating" "true" Option    "XkbRules" "evdev" Option    "XkbModel" "evdev" Option    "XkbLayout" "us"EndSection
Section "InputDevice" Identifier "Mouse1" Driver    "evdev" Option    "Device" "/dev/input/event5" Option    "Floating" "true" Option    "GrabDevice" "on" Option    "Protocol" "auto" Option    "Emulate3Buttons" "no" Option    "ZAxisMapping" "4 5"EndSection
Section "InputDevice" Identifier "Keyboard0" Driver    "evdev" Option    "Device" "/dev/input/event3" Option    "Floating" "true" Option    "XkbRules" "evdev" Option    "XkbModel" "evdev" Option    "XkbLayout" "us"EndSection
Section "InputDevice" Identifier "Mouse0" Driver    "evdev" Option    "Device" "/dev/input/event4" Option    "Floating" "true" Option    "GrabDevice" "on" Option    "Protocol" "auto" Option    "Emulate3Buttons" "no" Option    "ZAxisMapping" "4 5"EndSection
########### SEAT 1##########
Section "Device" Identifier "Device1" Driver    "nvidia" Vendorname "NVIDIA Corporation" BoardName "GeForce 210" Option    "DPMS" "false" Option    "UseDisplayDevice" "CRT" Option    "ProbeAllGpus" "false" Option    "NoLogo" "true" Option    "RenderAccel" "true" Screen    1EndSection
Section "Monitor" Identifier "Monitor1" VendorName "Toshiba" ModelName "Toshiba Matsushita Display Technology Co., Ltd LCD-MONITOR" Option    "DPMS" "false"EndSection
Section "Screen" Identifier "Screen1" Device    "Device1" Monitor    "Monitor1" DefaultDepth 24 Subsection "Display"    Depth 24    Modes "nvidia-auto-select" EndSubsection Option    "DPMS" "false" Option    "UseDisplayDevice" "CRT" Option    "ProbeAllGpus" "false"EndSection
############# SEAT 0############
Section "Device" Identifier "Device0" Driver    "nvidia" VendorName "NVIDIA Corporation" BoardName "GeForce 210" Option    "DPMS" "false" Option    "UseDisplayDevice" "DFP" Option    "ProbeAllGpus" "false" Option    "NoLogo" "true" Option    "RenderAccel" "true" Screen    0EndSection
Section "Monitor" Identifier "Monitor0" VendorName "Toshiba" ModelName "Toshiba Matsushita Display Technology Co., Ltd LCD-MONITOR" Option    "DPMS" "false"EndSection
Section "Screen" Identifier "Screen0" Device    "Device0" Monitor    "Monitor0" DefaultDepth 24 SubSection "Display"    Depth 24    Modes "nvidia-auto-select" EndSubsection Option    "DPMS" "false" Option    "UseDisplayDevice" "DFP" Option    "ProbeAllGpus" "false"EndSection
############## SERVERS#############
Section "ServerLayout" Identifier "multix" Screen 0 "Screen0" 0 0 Screen 1 "Screen1" 0 0EndSection

MDM configuration

The MDM is what executes everything (if it has been configured properly). Edit /etc/mdm/mdm.conf and change the Server Section to the following:

## Also note, that if you redefine a [server-foo] section, then MDM will# use the definition in this file, not the MDM System Defaults configuration# file. It is currently not possible to disable a [server-foo] section# defined in the MDM System Defaults configuration file.#
[server-Xephyr0]name=Xephyr0command=/usr/bin/X -ac -br -layout multix -audit 4 -dpmshandled=falseflexible=false
[server-Xephyr1]name=Xephyr1command=/usr/sbin/Xephyr.sh -display :0.0 -xauthority /var/lib/mdm/:0.Xauth -fullscreen -kbdphys usb-0000:00:1d.0-1/input0 -mousephys usb-0000:00:1d.0-2/input0 -verbosity 100 -audit 4 -screen 0 -dpms -retrohandled=trueflexible=false
[server-Xephyr2]name=Xephyr2command=/usr/sbin/Xephyr.sh -display :0.1 -xauthority /var/lib/mdm/:0.Xauth -fullscreen -kbdphys isa0060/serio0/input0 -mousephys isa0060/serio1/input0 -verbosity 100 -audit 4 -screen 1 -dpms -retrohandled=trueflexible=false

Resources

Aug 15, 2013

Windows Batch Script to lockdown firewall and only allow a few websites with dynamic IP addresses (nslookup)

This script was pretty much an extension of my earlier work on locking down windows. The problem is that that script only really worked for locking down static IP addresses. If you had a dynamic IP address you would have to manually change the firewall rules.

This script will delete the old firewall rules, find the new IP address of a host and create a new rule using that IP address.

@ECHO OFF
netsh advfirewall set domainprofile firewallpolicy allowinbound,allowoutbound
netsh advfirewall set privateprofile firewallpolicy allowinbound,allowoutbound
netsh advfirewall set publicprofile firewallpolicy allowinbound,allowoutbound

netsh advfirewall firewall delete rule name=all dir=out protocol=tcp remoteport=80,8080,8443,443 profile=any

for /f "tokens=1*" %%k in ('nslookup example.com.au') do (
if [%%k]==[Address:] set address=%%l
)
netsh advfirewall firewall add rule name="example" dir=out action=allow protocol=tcp remoteport=80,8080,8443,443 remoteip=%address% profile=any

for /f "tokens=1*" %%k in ('nslookup learning.com.au') do (
if [%%k]==[Address:] set address=%%l
)
netsh advfirewall firewall add rule name="learning" dir=out action=allow protocol=tcp remoteport=80,8080,8443,443 remoteip=%address% profile=any

netsh advfirewall set domainprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set privateprofile firewallpolicy blockinbound,blockoutbound
netsh advfirewall set publicprofile firewallpolicy blockinbound,blockoutbound

By saving this script somewhere secure you can create an event run by the inbuilt Windows Task Scheduler to run this script daily. This way you never have to worry about updating your firewalls when IP addresses change!

Dec 1, 2012

Migrating and transfering gitolite to a new server

I am going to assume you have already installed gitolite on two servers (if you haven't, check out my guide on installing gitolite). This post will outline how you will move your repositories from one server to your new one.

The server side

You can edit some of the configuration files stored in the home directory of the gitolite user. You only have to do this step if you have an unusual set-up; it should work fine if you did a default install.
Copy the contents of your repositories folder to the new server (except gitolite-admin; we will do this at a later stage). Use either the commands cp or scp. For instance:
scp -r repo.git/ root@192.168.0.1:/var/lib/gitolite/repositories/
Change the owner and group of the copied repositories:
chown -R gitolite:gitolite repo.git/
Clone the gitolite configuration repository on your administration machine:
git clone gitolite@192.168.0.1:gitolite-admin.git
Add the keys and configuration files from your old repository and place them into your new repository. Do a commit and then a push:
git add .
git commit -as
git push
The server is now set up and ready to use! Optional: The guide quoted that you may need to run gl-setup again once the repositories have been copied across, but I didn't need to. You may want to do that step....

The client side

To point your git repository to the new server (so you don't have to reconfigure your IDE or scripts) just run the following commands:

git remote rename origin old
git remote add origin git@192.168.0.1:repo.git
git remote -v
git remote rm old

Nov 30, 2012

Installing gitolite in CentOS 6

Gitolite is an management service that sits on top of git. It helps restrict users to certain projects (and what they can do on those projects). In this post we will install gitolite in a CentOS 6 environment.

First we need to enable the EPEL repository. You could download and install gitolite directly, but I prefer to manage everything through the package manager for auditing purposes.
wget http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-7.noarch.rpm
rpm -ivh ./epel-release-6-7.noarch.rpm
Install gitolite (it will most likely install a variety of dependencies):
yum install gitlolite
If this is a brand new gitolite installation you will need to create a public SSH key on the account you will be using to administer your gitolite installation. The creation of these keys are outside the scope of this documentation. Once the key pair has been created, copy the public version to a common place where gitolite can access it (like temp). Use the command cp or scp to acheive this.
Rename your copied public key with some sort of identifier. Gitolite uses the name of your keys to determine access.
Log in as the gitolite user:
su - gitolite
Initialize your gitolite service with the key:
gl-setup -q /tmp/user.pub
Now you can use gitolite!
ssh gitolite@192.168.0.1 info
git clone gitolite@192.168.0.1:gitolite-admin.git

Nov 29, 2012

Setting up a virtual guest on a headless CentOS 6 host

This guide assumes you have at least followed my guides for setting up the host (either my 6.2 or 6.3 version) and have set up the bridge networking interface. You optionally can see my other posts such as auditing your software installs, hardening your accounts, network hardening, services hardening and clearing out orphaned packages.

Note that if you followed my guide for services hardening you may want to turn the messagebus daemon back on. If the avahi daemon and zeroconf is disabled, you will need to edit /etc/libvirt/libvirtd.conf with the following:

mdns_adv=0

The rest of the guide should apply to virtually everyone else:

Edit /etc/libvirt/qemu.conf to allow the VNC server to listen on all ports:
vnc_listen='0.0.0.0'
Restart the libvirt daemon:
service libvirtd restart
If you don't already have one create the LVM partition that we will be our VM's hard-disk:
lvcreate -L20G -n lv_vm1 VolGroup
Poke a hole in the firewall so we can connect via VNC to the server. You can choose any port you wish, but in this case we will be using port 7601. Make sure you change the network to match your own settings! Edit /etc/sysconfig/iptables
-A INPUT -m --state NEW -s 192.168.0.0/24 -m tcp -p tcp --dport 7601 -j ACCEPT
Restart the firewall:
service iptables restart
Run the installation command:
virt-install -n vm1 -r 512 --vcpus=2 --disk path=/dev/VolGroup/lv_vm1 -c /path/to/disk.iso -v --accelerate -w bridge:br0 --vnc --vncport=7601 --noautoconsole --os-type linux --osvariant rhel6
Now use a VNC client to connect to your server by connecting to the firewall hole we created earlier. Follow through with the rest of the installation process.
To start and stop your VM just use the virsh command. The VM has been configured to use port 7601 for VNC, so you can always connect to it using that port unless you close it.
virsh start vm1

Nov 28, 2012

Bridge Networking in CentOS 6.3

Bridge networking is a useful technique to allow Virtual Guests to access your networking hardware. This guide was written in mind for CentOS 6.3 but should be applicable to other Linux versions (with modifications).

Copy the file /etc/sysconfig/networking-scripts/ifcfg-eth0 as br0
cp /etc/sysconfig/networking-scripts/ifcfg-eth0 /etc/sysconfig/networking-scripts/ifcfg-br0
Edit the file /etc/sysconfig/networking-scripts/ifcfg-eth0 and add the line:
BRIDGE=br0
You can also delete the lines:
BOOTPROTO
IPADDR
GATEWAY
DNS1
DNS2
Edit the file /etc/sysconfig/networking-scripts/ifcfg-br0 and edit the lines:
DEVICE=br0
TYPE=Bridge
You can also delete the lines:
HWADDR
UUID
Restart your network:
service network restart

References

Howtoforge.com guide to Virtualisation with KVM
Cyberciti post on KVM Bridging
The isborken blog on setting up a headless KVM

Nov 27, 2012

SSH Hardening on CentOS 6.3

This is a follow on post from my guide to installing CentOS 6.2 (or you can read my updated 6.3 version). You can see my other posts such as auditing your software installs, hardening your accounts, network hardening, services hardening and clearing out orphaned packages.

This post outlines how you can harden your SSH server.

Strengthen your IP table firewall rules by editing /etc/sysconfig/iptables and adding or changing the line (NOTE: Any old SSH rule will be using port 22; change it accordingly):
-A INPUT -m state --state NEW -s network/mask -p tcp --dport 4444 -j ACCEPT
where network/mask is replaced with your actual network and mask values i.e 10.0.0.0/24
Since SSH uses the TCP wrappers library we will need to allow the service in /etc/hosts.allow
sshd: 10.0.0.
Edit /etc/ssh/sshd_config with the following changes:
# Use Port 4444 instead of Port 22
Port 4444

# Ensure we use Protocol 2 by default
Protocol 2

# Set idle timeouts (15 minutes)
ClientAliveInterval 900
ClientAliveCountMax 0

# Disable rhost behaviour
IgnoreRhosts yes

# Do not trust other hosts
HostbasedAuthentication no

# Do not allow root logins
PermitRootLogin no

# Do not allow empty passwords
PermitEmptyPasswords no

#Disable environment alteration
PermitUserEnvironment no

#Disable X11 forwarding
X11Forwarding no

# Disable TCP forwarding
AllowTCPForwarding no

# Log level
LogLevel INFO
Restart everything

service sshd restart
service iptables restart
service network restart

References

Red Hat Linux 5 Hardening Tips - National Security Agency
Guide to the secure configuration of Red Hat Linux 5 - National Security Agency
CentOS wiki on hardening the OS
This guide from sysadminwiki
The security nut blog

Nov 23, 2012

Setting up a CentOS 6 server: Services Hardening

This is a follow on post from my guide to installing CentOS 6.2 (or you can read my updated 6.3 version). You can see my other posts such as auditing your software installs, hardening your accounts, network hardening and clearing out orphaned packages.

This guide outlines how to cut down on unnecessary services so that you have a lean and mean machine.

List all the services running on your machine with the following command:
chkconfig --list | grep :on
Go through the list and select packages to disable or remove. For instance:
chkconfig mdmonitor off
chkconfig smartd off
chkconfig messagebus off
chkconfig haldaemon off
chkconfig cups off
chkconfig atd off
chkconfig kdump off
If you do not know what a service is or does, just run:
rpm -qf /etc/init.d/<service_name>

Then run:
rpm -qi <rpm>

References

Red Hat Linux 5 Hardening Tips - National Security Agency
Guide to the secure configuration of Red Hat Linux 5 - National Security Agency
CentOS wiki on hardening the OS
This guide from sysadminwiki

Mar 2, 2018

Mar 1, 2018

Option 1:

Option 2:

Feb 20, 2018

Feb 19, 2018

Jan 25, 2018

Cleaning docker

Jul 4, 2014

Jul 3, 2014

Nov 30, 2013

Print Screen Key

References:

Nov 4, 2013

References:

Nov 3, 2013

References

Oct 8, 2013

Installation

Netbeans and Laravel set-up

Eclipse and Laravel set-up

Composer overview

Resources

Aug 25, 2013

Correct drivers - make sure they are installed!

Input devices

Custom Xephyr script

Xorg.conf settings

MDM configuration

Resources

Aug 15, 2013

Dec 1, 2012

The server side

The client side

Further Reading:

Nov 30, 2012

Further Reading:

Nov 29, 2012

Further reading

Nov 28, 2012

References

Nov 27, 2012

References

Nov 23, 2012

References