Browsed by
Tag: Security

WireGuard on Kernel 5.6. Quick start

WireGuard on Kernel 5.6. Quick start

Comments 0 Comment

Install all downloaded deb’s Reboot server/PC by command reboot After startup check the kernel version^ Test Wireguard on server Add repository for ubuntu 18.04 Make some changes to Firewall on server Simple script for generating key pairs and base cofigs for server and client Or download here: Put wg0.server as /etc/wireguard/wg0.conf on Server side and wg0.client on Client side in the same place Startup interface on machines For Android clients you can use config file as QR code

Mikrotik as OpenVPN server in 3 steps

Mikrotik as OpenVPN server in 3 steps

Comments 0 Comment

Connect to Mikrotik via SSH and start writing text below Set global VARs Make server and client CRT Create pool, profile, interface, firewall Goto menu Files in Mikrotik admin panel and download ca.crt + client.crt + client.key Then make file SomeName.ovpn with content: Put your key and crt and change host:port vars and file auth.cfg with this two files you can start client

Configure Apache for A-rating on SSLLabs

Configure Apache for A-rating on SSLLabs

Comments 0 Comment

Just add following lines to vhost.conf SSLEngine on SSLProtocol TLSv1.2 TLSv1.1 SSLProxyProtocol TLSv1.2 TLSv1.1 SSLHonorCipherOrder on SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA25

Add CA certifice from Let’s Encrypt to Java 8

Add CA certifice from Let’s Encrypt to Java 8

Comments 0 Comment

For add cert to Java 8 you need use keytool cd /tmp/ && \ curl -O https://letsencrypt.org/certs/letsencryptauthorityx1.der && \ sudo $JAVA_HOME/bin/keytool -noprompt -importcert -alias letsencryptauthorityx1 -keystore $JAVA_HOME/jre/lib/security/cacerts -file letsencryptauthorityx1.der -storepass changeit && \ curl -O https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.der && \ sudo $JAVA_HOME/bin/keytool -noprompt -importcert -alias lets-encrypt-x3-cross-signed -keystore $JAVA_HOME/jre/lib/security/cacerts -file lets-encrypt-x3-cross-signed.der -storepass changeitcd /tmp/ && \ curl -O https://letsencrypt.org/certs/letsencryptauthorityx1.der && \ sudo $JAVA_HOME/bin/keytool -noprompt -importcert -alias letsencryptauthorityx1 -keystore $JAVA_HOME/jre/lib/security/cacerts -file letsencryptauthorityx1.der -storepass changeit && \ curl -O https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.der && \ sudo $JAVA_HOME/bin/keytool -noprompt…

Read More Read More

Certificate order in Haproxy PEM file

Certificate order in Haproxy PEM file

Comments 0 Comment

For SSL in Haproxy you need to create PEM-file and put cert plus private key. But in right order —–BEGIN MY CERTIFICATE—– —–END MY CERTIFICATE—– —–BEGIN INTERMEDIATE CERTIFICATE—– —–END INTERMEDIATE CERTIFICATE—– —–BEGIN INTERMEDIATE CERTIFICATE—– —–END INTERMEDIATE CERTIFICATE—– —–BEGIN ROOT CERTIFICATE—– —–END ROOT CERTIFICATE—– —–BEGIN RSA PRIVATE KEY—– —–END RSA PRIVATE KEY———-BEGIN MY CERTIFICATE—– —–END MY CERTIFICATE—– —–BEGIN INTERMEDIATE CERTIFICATE—– —–END INTERMEDIATE CERTIFICATE—– —–BEGIN INTERMEDIATE CERTIFICATE—– —–END INTERMEDIATE CERTIFICATE—– —–BEGIN ROOT CERTIFICATE—– —–END ROOT CERTIFICATE—– —–BEGIN RSA PRIVATE KEY—– —–END RSA…

Read More Read More

Path MTU Discovery Black Hole

Path MTU Discovery Black Hole

Comments 0 Comment

Эта проблема совсем не нова. Она описана в RFC 2923 в 2000 году. Но тем не менее, продолжает встречаться с завидным упорством у многих провайдеров. А ведь именно провайдер виноват в данной ситуации: не нужно блокировать ICMP тип 3 код 4. Причем слушаться «голоса разума» ( т. е. клиентов, понимающих в чем проблема) они обычно не хотят. Решение проблемы с PMTU Не будем звонить в техподдержку, а попробуем решить проблему, исходя из собственных средств. Разработчики Linux, тоже знающие о ней,…

Read More Read More

Mysql: errno: 24 – Too many open files) (1018)

Mysql: errno: 24 – Too many open files) (1018)

Comments 0 Comment

При создании бекапа выскочина ошибка mysqldump: Couldn’t execute ‘SHOW TRIGGERS LIKE ‘logs”: Can’t read dir of ‘./mydatabase/’ (errno: 24 – Too many open files) (1018)mysqldump: Couldn’t execute ‘SHOW TRIGGERS LIKE ‘logs”: Can’t read dir of ‘./mydatabase/’ (errno: 24 – Too many open files) (1018) Хотя в limits.conf указано значение 30000 и в my.cnf open-files-limit = 20000open-files-limit = 20000 И процесс запущен с правильными параметрами /usr/sbin/mysqld –basedir=/usr –datadir=/var/lib/mysql –plugin-dir=/usr/lib64/mysql/plugin –log-error=/var/lib/mysql/error.log –open-files-limit=20000 –pid-file=/var/run/mysql.run –port=3306/usr/sbin/mysqld –basedir=/usr –datadir=/var/lib/mysql –plugin-dir=/usr/lib64/mysql/plugin –log-error=/var/lib/mysql/error.log –open-files-limit=20000 –pid-file=/var/run/mysql.run –port=3306

CentOS 7: отключить Firewalld

CentOS 7: отключить Firewalld

Comments 0 Comment

В CentOS 7 по умолчанию установлен Firewalld который блочит некоторые порты, а мне нравится стандартный iptables. займемся возвратом всего на свои метса 1. Отключаем Firewalld сервис [root@mongo12 ~]# systemctl mask firewalld[root@mongo12 ~]# systemctl mask firewalld 2. Останавливаем. [root@mongo12 ~]# systemctl stop firewalld[root@mongo12 ~]# systemctl stop firewalld 3. Установим iptables [root@mongo12 ~]# yum -y install iptables-services[root@mongo12 ~]# yum -y install iptables-services