Рубрики
Linux & Unix Security system

Add CA certifice from Let’s Encrypt to Java 8

For add cert to Java 8 you need use keytool

cd /tmp/ && \
curl -O https://letsencrypt.org/certs/letsencryptauthorityx1.der && \
sudo $JAVA_HOME/bin/keytool -noprompt -importcert -alias letsencryptauthorityx1 -keystore $JAVA_HOME/jre/lib/security/cacerts -file  letsencryptauthorityx1.der  -storepass changeit && \
curl -O https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.der && \
sudo $JAVA_HOME/bin/keytool -noprompt -importcert -alias lets-encrypt-x3-cross-signed -keystore $JAVA_HOME/jre/lib/security/cacerts -file lets-encrypt-x3-cross-signed.der -storepass changeit
Продолжить чтение “Add CA certifice from Let’s Encrypt to Java 8”
Рубрики
Linux & Unix system

Syncthing: Debian run script

syncthing
Rename syncthing.txt to syncthing
Put to /etc/init.d/
Change USER and DAEMON vars

 chmod 755 /etc/init.d/syncthing

To run Syncthing :

sudo service syncthing start

For autostart

sudo update-rc.d syncthing defaults
Рубрики
Новости

Syncthing: How to add Relay Server URI

In the docs it says that it’s one of the listen addresses now
Thanks. It works to put URI in of config.xml.
URI like : relay://:22067/?id=EGIGXJZ-F7UOIQ2-KSYNJEB-XILHWP5-TKKIVLE-U……

Рубрики
Linux & Unix Security

Certificate order in Haproxy PEM file

For SSL in Haproxy you need to create PEM-file and put cert plus private key. But in right order

-----BEGIN MY CERTIFICATE-----
-----END MY CERTIFICATE-----
-----BEGIN INTERMEDIATE CERTIFICATE-----
-----END INTERMEDIATE CERTIFICATE-----
-----BEGIN INTERMEDIATE CERTIFICATE-----
-----END INTERMEDIATE CERTIFICATE-----
-----BEGIN ROOT CERTIFICATE-----
-----END ROOT CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----
Рубрики
Новости

Java8 in Debian

For starting we need install add-apt-repository

apt-get install software-properties-common python-software-properties

Then install java8

sudo add-apt-repository ppa:webupd8team/java
sudo apt-get update
sudo apt-get install oracle-java8-installer

To automatically set up the Java 8 environment variables:

sudo apt-get install oracle-java8-set-default

or

echo "deb http://ppa.launchpad.net/webupd8team/java/ubuntu xenial main" | tee /etc/apt/sources.list.d/webupd8team-java.list
echo "deb-src http://ppa.launchpad.net/webupd8team/java/ubuntu xenial main" | tee -a /etc/apt/sources.list.d/webupd8team-java.list
apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys EEA14886
apt-get update
apt-get install oracle-java8-installer
Рубрики
Linux & Unix system

avconv: simple video converter in Linux

If you want convert video from big size to smartphone size use this Libav tool
Ubuntu:

apt-get install libav-tools

or Gentoo

USE="mp3 speex threads v4l jpeg2k aac amr cpudetection faac opus vdpau x264 webp  x265 xvid " CPU_FLAGS_X86="mmx mmxext sse sse2 sse3 sse4_1"  emerge -av libav

and command for convert

avconv -i original_video.mkv -b:v 600k -s 576x432 -strict experimental small_size.mp4
Рубрики
Linux & Unix Security system

Path MTU Discovery Black Hole

Эта проблема совсем не нова. Она описана в RFC 2923 в 2000 году. Но тем не менее, продолжает встречаться с завидным упорством у многих провайдеров. А ведь именно провайдер виноват в данной ситуации: не нужно блокировать ICMP тип 3 код 4. Причем слушаться «голоса разума» ( т. е. клиентов, понимающих в чем проблема) они обычно не хотят.

Решение проблемы с PMTU

Не будем звонить в техподдержку, а попробуем решить проблему, исходя из собственных средств.
Разработчики Linux, тоже знающие о ней, предусмотрели специальную опцию в iptables. Цитата из man iptables:

TCPMSS
This target allows to alter the MSS value of TCP SYN packets, to control the maximum size for that connection (usually limiting it to your outgoing interface’s MTU minus 40 for IPv4 or 60 for IPv6, respectively). Of course, it can only be used in conjunction with -p tcp. It is only valid in the mangle table. This target is used to overcome criminally braindead ISPs or servers which block “ICMP Fragmentation Needed” or “ICMPv6 Packet Too Big” packets. The symptoms of this problem are that everything works fine from your Linux firewall/router, but machines behind it can never exchange large packets:
1) Web browsers connect, then hang with no data received.
2) Small mail works fine, but large emails hang.
3) ssh works fine, but scp hangs after initial handshaking.
Workaround: activate this option and add a rule to your firewall configuration like:

iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Продолжить чтение “Path MTU Discovery Black Hole”
Рубрики
system web

Bind9: balancing by client ip (even/odd)

For some reason i need balancing client’s 50/50 for 2 datacenter’s
But, if client send GET request to datacenter1 (DC1) all following request need redirect to the same DC1. Only if DC1 is down – send to DC2
Simplest way – is share client’s by their ip (odd/even)
So we need two Bind9 services on one server.
First Bind9 will be answered that www.example.org is in DC1, second – in DC2
For example first named.conf:

zone "example.com" {
    type master;
    file "/etc/bind/db.example.com";
};
....

Zone:

Продолжить чтение “Bind9: balancing by client ip (even/odd)”
Рубрики
Новости

Syncthing

Syncthing replaces proprietary sync and cloud services with something open, trustworthy and decentralized. Your data is your data alone and you deserve to choose where it is stored, if it is shared with some third party and how it’s transmitted over the Internet.

Нада потестити…..

Рубрики
Новости

Запуск VNC сервера через SSH

На клиентской стороне:

ssh 10.10.10.1 -L 5900:localhost:5900 "x11vnc -display :0 -noxdamage"

После чего в VNC клиенте подключаемся к localhost:5900

Рубрики
Новости

Mysql: duplicating a table

You need to do :

CREATE TABLE newtable LIKE oldtable; 
INSERT newtable SELECT * FROM oldtable;

This creates copy of existing Mysql table with indexes