買到國際版的Porter... Orz

帽客想說背個好一點的包包吧，加上目前在台灣Porter包還蠻多人背的，品質應該很不錯，結果上星期五跑去忠孝SOGO買了一款不便宜的Porter包(大約快六張小朋友)，沒想到這是International Porter....老實說買之前我根本沒做功課，誰知道台灣與日本Porter會有這段恩怨呢？哈～苦笑中。

我現在只期望雖品質沒日製的好(網路上大家都這麼說 Orz)，但也能讓我操個三年吧！暗藍色的顏色我還蠻喜歡的說，雖然它是International... 再次Orz.

Apple iPad announced

Apple總算是對外發表了Apple iPad平板式電腦，成為世界第一的Mobile vendor後讓我們看看iPad是否也可以很成功！

強大的awk

透過awk找出系統帳號中誰的預設shell是屬於bash，並統計有幾筆。
[root@centos bin]# awk -F: 'BEGIN{count=0};/bash/{count++}/bash/{print $1};END{print "TOTAL="count}' /etc/passwd

root

u1

u2

law

mysql

TOTAL=5

To setup IPSec in CentOS 5.4

這是一篇很精簡的設定方法，更詳細的步驟與說明建議還是至OpenSwan網站查詢。

Test Environment:

(172.17.1.100) IPSec VPN1 (10.12.95.3) ----- (10.12.95.2) IPSec VPN2 (172.17.2.100)

1. 安裝：

# yum install openswan*

2. 透過sysctl.conf修改Kernel參數：

修改Kernel相關參數，使得之後跑ipsec verify時不會出錯。

# vi /etc/sysctl.conf

*********************************************************************

# example entries for /etc/sysctl.conf

# forwarding is needed for subnet or l2tp connections

net.ipv4.ip_forward = 1

# rp_filter is stupid and cannot deal decrypted packets "appearing out of

# nowhere"

net.ipv4.conf.default.rp_filter = 0

# when using 1 interface for two networks, and in some other cases with

# NETKEY, the kernel thinks it can be clever but breaks things.

net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.default.send_redirects = 0

net.ipv4.icmp_ignore_bogus_error_responses = 1

net.ipv4.conf.all.log_martians = 0

net.ipv4.conf.default.log_martians = 0

# these are non-ipsec specific security policies you should use

net.ipv4.conf.default.accept_source_route = 0

net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.default.accept_redirects = 0

*********************************************************************

#sysctl -p

3. 套用並修改範例：

# cp/usr/share/doc/openswan-doc*/examples /etc/ipsec.d/hosttohost.conf

# vi /etc/hosttohost.conf

*********************************************************************

# sample connections

# This file is RCSID $Id: examples,v 1.5 1999/12/13 02:38:16 henry Exp $

# sample tunnel (manually or automatically keyed)

# Here we just use ESP for both encryption and authentication, which is

# the simplest and often the best method.

conn sample

# left security gateway (public-network address)

left=10.12.95.3

# next hop to reach right

#leftnexthop=10.44.55.66

# subnet behind left (omit if left end of the tunnel is just the s.g.)

leftsubnet=172.17.1.0/24

# right s.g., subnet behind it, and next hop to reach left

right=10.12.95.2

#rightnexthop=10.88.77.66

rightsubnet=172.17.2.0/24

# (manual) SPI number

#spi=0x200

# (manual) encryption/authentication algorithm and parameters to it

esp=3des-md5-96

#espenckey=[192 bits]

#espauthkey=[128 bits]

authby=secret

auto=add

*********************************************************************

4. 新增PSK:

# vi /etc/ipsec.secrets

*********************************************************************

include /etc/ipsec.d/*.secrets

10.12.95.3 10.12.95.2 : PSK "1234567890"

10.12.95.2 10.12.95.3 : PSK "1234567890"

5. 修改/etc/ipsec.conf

# vi /etc/ipsec.conf

*********************************************************************

# /etc/ipsec.conf - Openswan IPsec configuration file

#

# Manual: ipsec.conf.5

#

# Please place your own config files in /etc/ipsec.d/ ending in .conf

version 2.0 # conforms to second version of ipsec.conf specification

# basic configuration

config setup

# Debug-logging controls: "none" for (almost) none, "all" for lots.

# klipsdebug=none

# plutodebug="control parsing"

# For Red Hat Enterprise Linux and Fedora, leave protostack=netkey

protostack=netkey

nat_traversal=yes

virtual_private=

oe=off

# Enable this if you see "failed to find any available worker"

nhelpers=0

#You may put your configuration (.conf) file in the "/etc/ipsec.d/" and uncomment this.

include /etc/ipsec.d/*.conf

PS. 另外一邊的VPN gateway與以上的架設方法都一樣，只是將/etc/hosttohost.conf中的left與right的資訊對調即可。

6. 啟動IPSec:

# /etc/init.d/ipsec start

/usr/libexec/ipsec/addconn Non-fips mode set in /proc/sys/crypto/fips_enabled

ipsec_setup: Starting Openswan IPsec U2.6.21/K2.6.18-164.6.1.el5...

ipsec_setup: multiple ip addresses, using 10.12.95.3 on eth0

ipsec_setup: /usr/libexec/ipsec/addconn Non-fips mode set in /proc/sys/crypto/fips_enabled

7. 執行IPSec verify:

# ipsec verify

Checking your system to see if IPsec got installed and started correctly:

Version check and ipsec on-path [OK]

Linux Openswan U2.6.21/K2.6.18-164.6.1.el5 (netkey)

Checking for IPsec support in kernel [OK]

NETKEY detected, testing for disabled ICMP send_redirects [OK]

NETKEY detected, testing for disabled ICMP accept_redirects [OK]

Checking for RSA private key (/etc/ipsec.secrets) [OK]

Checking that pluto is running [OK]

Two or more interfaces found, checking IP forwarding [OK]

Checking NAT and MASQUERADEing [N/A]

Checking for 'ip' command [OK]

Checking for 'iptables' command [OK]

Opportunistic Encryption DNS checks:

Looking for TXT in forward dns zone: centos.example.com [MISSING]

Does the machine have at least one non-private address? [FAILED]

8. 建立IPSec tunnel:

# ipsec auto --up sample

104 "sample" #1: STATE_MAIN_I1: initiate

003 "sample" #1: received Vendor ID payload [Openswan (this version) 2.6.21 ]

003 "sample" #1: received Vendor ID payload [Dead Peer Detection]

003 "sample" #1: received Vendor ID payload [RFC 3947] method set to=109

106 "sample" #1: STATE_MAIN_I2: sent MI2, expecting MR2

003 "sample" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected

108 "sample" #1: STATE_MAIN_I3: sent MI3, expecting MR3

003 "sample" #1: received Vendor ID payload [CAN-IKEv2]

004 "sample" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp2048}

117 "sample" #2: STATE_QUICK_I1: initiate

004 "sample" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xca7bd686 <0x193e1d71 xfrm="3DES_0-HMAC_MD5" natoa="none" natd="none" dpd="">

9. 測試:

# ping 172.17.2.100 -I 172.17.1.100 -c 10

PING 172.17.2.100 (172.17.2.100) from 172.17.1.100 : 56(84) bytes of data.

64 bytes from 172.17.2.100: icmp_seq=1 ttl=64 time=1.65 ms

64 bytes from 172.17.2.100: icmp_seq=2 ttl=64 time=0.716 ms

64 bytes from 172.17.2.100: icmp_seq=3 ttl=64 time=1.16 ms

64 bytes from 172.17.2.100: icmp_seq=4 ttl=64 time=1.41 ms

64 bytes from 172.17.2.100: icmp_seq=5 ttl=64 time=1.24 ms

64 bytes from 172.17.2.100: icmp_seq=6 ttl=64 time=1.17 ms

64 bytes from 172.17.2.100: icmp_seq=7 ttl=64 time=1.52 ms

64 bytes from 172.17.2.100: icmp_seq=8 ttl=64 time=0.544 ms

64 bytes from 172.17.2.100: icmp_seq=9 ttl=64 time=0.796 ms

64 bytes from 172.17.2.100: icmp_seq=10 ttl=64 time=1.58 m

Note:

此次使用的版本分別為：

openswan-doc-2.6.21-5.el5_4.1

openswan-2.6.21-5.el5_4.1

不同的版本間，example configure file有點差異，需請注意。

To setup Socks Server in CentOS5.4

工作需求，所以去架設了Socks4/5 Server來使用，在CentOS上安裝起來很容易且配置上也沒有多大的難度，在此筆記一下。

1. 抓取ss5 tarball檔：

預設的repos似乎沒有ss5，故自己抓個tarball檔下來安裝。

wget http://softlayer.dl.sourceforge.net/project/ss5/ss5/3.7.9-1/ss5-3.7.9-1.tar.gz
tar zxvf ss5-3.7.9-1.tar.gz

2. 安裝：

[root@server2 src]# tar zxvf ss5-3.7.9-1.tar.gz

[root@server2 ss5-3.7.9]# ./configure

[root@server2 ss5-3.7.9]# make

[root@server2 ss5-3.7.9]# make install

3. 配置：

找到auth與permit並將註解取消，注意我並沒有enable使用者需做認證的機制。

[root@server2 ~]# vi /etc/opt/ss5/ss5.conf

# SHost SPort Authentication

auth 0.0.0.0/0 - -

# Auth SHost SPort DHost DPort Fixup Group Band ExpDate

permit - 0.0.0.0/0 - 0.0.0.0/0 - - - - -

4. 啟動:

[root@server2 ~]# chkconfig --add ss5

[root@server2 ~]# chkconfig ss5 on

[root@server2 ~]# /etc/init.d/ss5 start

doneting ss5... [ OK ]

[root@server2 ~]#

5. 測試：

最後可透過FireFox來測試Socks4/5.

工具->選項->進階->設定->手動設定Proxy:

SOCKS主機: x.x.x.x Port: 1080

並選擇SOCKS v4或是SOCKS v5

To implement NFSv2,NFSv3 and NFSv4

NFSv2, NFSv3與NFSv4在Linux 2.6.x的kernel上，預設都是有支援的，不同的是需要對於server或client之前下達不同的參數以區別，以下分別就不同版本的實作簡單敘述：

1. NFS v3:

Server: exportfs *:/tmp

Client: mount 192.168.0.254:/tmp /mnt/nfs

2. NFS v2:

Server: exportfs *:/tmp

Client: mount -o nfsvers=2 192.168.0.254:/tmp /mnt/nfs

3. NFS v4:

Server: exportfs -o fsid=o *:/tmp

Client: mount -t nfs4 192.168.0.254:/tmp /mnt/nfs

References:

http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/ref-guide/s1-nfs-client-config.html

http://www.centos.org/docs/5/html/Deployment_Guide-en-US/ch-nfs.html

Path MTU discovery

What's Path MTU discovery:

http://en.wikipedia.org/wiki/Path_MTU_discovery

預設Linux box是把pmtud的機制打開的，可透過以下的kernel參數檢查：

cat /proc/sys/net/ipv4/ip_no_pmtu_disc

0 代表pmtud enable (default)

1 代表pmtud disable

以下是我實驗時的環境：

Remote Server (mtu=1500) ----- (mtu=1400) Linux NAT Box (mtu=1400) ----- Client (mtu=1500)

1. 從Client往Server端送出icmp packet size大於1400bytes但小於1500bytes的包，for example 1450 bytes, DF=1

2. Linux NAT Box將會回報封包需要分片！並透過icmp unreachable包告訴Client，本機的mtu為1400bytes

opensuse:~ # ping 10.12.64.220 -s 1450

PING 10.12.64.220 (10.12.64.220) 1450(1478) bytes of data.

From 10.12.95.3: icmp_seq=1 Frag needed and DF set (mtu = 1400)

From 10.12.95.3 icmp_seq=1 Frag needed and DF set (mtu = 1400)

1458 bytes from 10.12.64.220: icmp_seq=2 ttl=63 time=2.85 ms

1458 bytes from 10.12.64.220: icmp_seq=3 ttl=63 time=4.97 ms

1458 bytes from 10.12.64.220: icmp_seq=4 ttl=63 time=3.48 ms

此後將會保持一段時間不需要detect。

[Shell script] 自動開啟或關閉 vsftpd匿名登入機制

1 #!/bin/bash

2

3 vsftp_conf="/etc/vsftpd/vsftpd.conf"

4

5 if [ -f $vsftp_conf ]; then

6 if [ $# -ne 1 ]; then

7 echo "Parameters is not allow"

8 echo "usage: $0 on or $0 off"

9 exit 1

10 fi

11

12 case "$1" in

13 on) CMD='YES';;

14 off) CMD='NO';;

15 *)

16 echo "format error!"

17 exit 1

18 ;;

19 esac

20

21 if [ $CMD = 'YES' ]; then

22 sed 's/^.*anonymous_enable=.*/anonymous_enable=YES/' $vsftp_conf > /tmp/$$.vsftpd.conf

23 mv -f /tmp/$$.vsftpd.conf $vsftp_conf

24 /etc/init.d/vsftpd restart

25 else

26 sed 's/^.*anonymous_enable=.*/anonymous_enable=NO/' $vsftp_conf > /tmp/$$.vsftpd.conf

27 mv -f /tmp/$$.vsftpd.conf $vsftp_conf

28 /etc/init.d/vsftpd restart

29 fi

30 else echo "$vsftp_conf is not exist"

31 fi

說明:

列5 先判斷/etc/vsftpd/vsftpd.conf是否存在，若不存在則回報檔案不存在。(列30)

列6 判斷所傳入的引數是否為1個，若不是則回報錯誤並結束。 (列7~10)

列12-19 使用case，判斷是on, off或是格式有誤。

列21-24 若為on則設定anonymous_enable=YES，並重新啟動vsftpd。

列25-28 若為off則設定anonymous_enable=NO，並重新啟動vsftpd。

測試:

1. 允許匿名登入:

[root@centos bin]# ./vsftpd.sh on

Shutting down vsftpd: [ OK ]

Starting vsftpd for vsftpd: [ OK ]

[root@centos bin]# ftp localhost

Connected to localhost.localdomain.

220 (vsFTPd 2.0.5)

530 Please login with USER and PASS.

530 Please login with USER and PASS.

KERBEROS_V4 rejected as an authentication type

Name (localhost:root): ftp

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp>

2. 不允許匿名登入:

[root@centos bin]# ./vsftpd.sh off

Shutting down vsftpd: [ OK ]

Starting vsftpd for vsftpd: [ OK ]

[root@centos bin]# ftp localhost

Connected to localhost.localdomain.

220 (vsFTPd 2.0.5)

530 Please login with USER and PASS.

530 Please login with USER and PASS.

KERBEROS_V4 rejected as an authentication type

Name (localhost:root): ftp

331 Please specify the password.

Password:

530 Login incorrect.

Login failed.

ftp>

References:

Linux Shell 程式設計實務 P.305

TestShell Studio

今天下午參加了派恩科技所舉辦的新世代電子與網通產品自動化測試技術研討會，見識到了QualiSystems所研發的TestShell tools其強調並不需要programming的能力就能完成自動化測試的工作，讓我印象最為深刻的就是TestShell Studio，它能結合多種網通測試設備（IXIA，SmartBits and etc)，自訂commands，遠端控制DUT，錄製Web access action等等強大的功能以加快測試的速度！AWESOME！

只要把你腦海中的想法透過滑鼠Drag-&-drop，整個測試流程就完成了！我想這對於網通廠商來說是個非常有力的測試工具，也值得每個網通QA學習。

美中不足的是......

1. 沒有提供Trial version

2. 目前似乎沒有for Linux的版本

Google Chrome for Linux and Mac OSX goes beta!

Google Chrome for Linux與Mac OSX終於出Beta版了，在Linux方面提供了Debian/Ubuntu/Fedora/OpenSUSE的deb與rpm，而在Mac OSX呢，很遺憾地PPC的user還是被遺忘了，剛好我就是PPC的user @@||

Anyway，在Linux下與Firefox V3.5.5相比，Google Chrome運行起來的確是讓我感覺到有快一點，不過目前發現到有兩個缺點:

1. 預設的中文字型不好看。

2. 即使我已經裝了Adobe flash player，還是不能播放Youtube的影片。

有興趣的人可以試用看看唷！

Google Chrome for Linux

Google Chrome for Mac OSX

emesene 1.5.1 - "awesome" bugfix edition has been released!

曾幾何時，當我從Pidgin跳槽至emesene時感覺到非常順手好用，但是唯一的缺點就是emesene常常回報對方收不到我的訊息，有時真覺得有點惱人，所以這陣子又跳回去使用Pidgin，雖然沒那麼好看但至少穩定。

Well，今天連到emesene official website發現到v1.5.1已經正式release了，並且也修正了送不出訊息的問題，好樣的重新拿回來使用！

嘿！不過目前還沒有OpenSUSE 11.2的rpm檔，先用tarball了。

How to configure mirror port on Cisco 2960G switch

碰到了就紀錄一下囉~

# monitor session 1 source interface Gi 0/11
# monitor session 1 destination interface Gi 0/10

如此一來port 10就會成為port 11的mirror port。

判斷service是否可使用TCP wrappers

在Linux系統中，針對service比較簡單的安全政策可透過TCP wrappers來做管理，但是有些service是可被TCP wrappers控管的，有些則不是，如何判斷呢？其實只要用ldd命令來查看service是否有利用到libwrap wrapper library就可以囉！以下舉幾個例子：

1. OpenSSH:
[root@centos ~]# ldd /usr/sbin/sshd | grep libwrap
libwrap.so.0 => /lib/libwrap.so.0 (0x003f9000)
2. NFS:
[root@centos ~]# ldd /usr/sbin/rpc.nfsd | grep libwrap
3. Apache:
[root@centos ~]# ldd /usr/sbin/httpd | grep libwrap

由上可知OpenSSH可由TCP wrappers託管，但是NFS與Apache則不行。（有自己的安全機制)

回憶起以前考RHEL3時是用死記的方法記下那些service可以被TCP wrappers託管，現在年紀大了記憶體不足，只好靠些小技巧來幫助。

Netifera

Netifera是一套for Linux與MAC OSX的網路環境偵測軟體，使用起來非常簡單易懂。
帽客安裝在CentOS5.4下，從安裝到使用上沒有發生什麼問題，且整體跑起來感覺很流暢！值得推薦給大家使用。

What is Netifera?

Netifera is a new modular open source platform for creating network security tools. This project provides many advantages for both security developers and researchers who want to implement new tools as well as the community of users of these tools.

Netifera website
Netifera quick guide
Download Netifera

如何透過ISO檔，更新CentOS

之前介紹過如何透過ISO檔升級OpenSUSE，身為紅帽與蜥蜴系的愛好者，當然也要介紹一下如何透過ISO檔升級CentOS(應該也可用於Redhat與Fedora)。

Step1. 建立掛載點：

# mkdir -p /mnt/iso/1

Step2. 掛載ISO檔：

# mount -o loop /mnt/nfs/CentOS-5.4*.iso /mnt/iso/1

Step3. 安裝createrepo套件：

# yum install createrepo

Step4. 產生來源repository：


# cd /mnt/iso
# createrepo .

Step5. 建立新repository設定檔：

# vi /etc/yum.repos.d/centos54.repo
[CentOS5.4 Repository]
baseurl=file:///mnt/iso
enabled=1

Step6. 準備升級：

先將原本的repos全部rename成xxx.repo.bak
# yum clean all
# yum update

成功的話就可看到下圖顯示準備更新成CentOS5.4的套件：




學習Linux CLI 的好站

想學習Linux CLI嗎？以下的網站非常值得閱讀或是當作線上工具書：

LinuxCommand
O'Reilly's Linux Command Directory
The Linux CookBook
Ols3 shell script

Also please let me know your favorite websites for learning Linux command line in the comments.

Fedora 12 即將release!

Oh.. Fedora12預計於.....2009.11.17 release (不就是今天嗎? 逃~)，太久沒注意Fedora project了，明天download下來在VirtualBox上跑看看吧。

BTW, 最近真是OS的大混戰呀! 打得激烈!

Apple MAC OSX 10.6.2 [未使用，好想用呀~哭]
CentOS 5.4 [使用中]
Ubuntu 9.10 [未使用]
OpenSUSE 11.2 [使用中]
Fedora 12 [快要出了]
Windows 7 [恩...]

升級OpenSUSE 11.1至11.2之雜記

OpenSUSE 11.2已經於11.12日正式release了，雖然說11.1目前在S10e上跑得挺順的，但是手癢的我還是決定給它升級看看，以往我會選擇重新安裝的方法來升級，反正/home是配置到另外一個partition，系統重新安裝也不會讓資料遺失，但是總覺得要重新調整到自己習慣的桌面設定太浪費時間了，於是這一次我選擇透過將software repositories指定成OpenSUSE 11.2的方法來安裝：

Step1. Yast->Software->Software Repositories->Add->Local ISO Image添加OpenSUSE11.2镜像。
Step2. 手動移除OpenSUSE 11.1的repositories
Step3. # zypper dup

遺憾的是.....我竟然在X Window幹下此等蠢事，zypper dup會將有衝突的軟件強制刪除，沒想到在Firefox開啟的狀態下，造成系統crash導致更新尚未完成！重開機後整個系統爛掉，唉！我可不能panic呀，冷靜下來進入failsafe mode重新再執行一次zypper dup，沒想到卻回報無法找到來源，原來還需要讓Kernel把loop的模組掛起來，於是便執行modprobe loop，如此一來就可以繼續升級的動作了。

沒想到升級完後，只有保留了kernel-2.6.27.37-0.1-pae而竟然沒有安裝上新的kernel-2.6.31.5-0.1-desktop，導致無法進入GNOME..... anyway透過zypper再裝上新版的kernel吧，裝上後一切搞定，可以正常進入GNOME，目前嘗試使用看看。

Update1_新增OpenSUSE 11.2的repositories:

# zypper ar http://ftp.gwdg.de/pub/linux/misc/packman/suse/11.2/ packman
# zypper ar http://download.opensuse.org/distribution/11.2/repo/oss/ opensuse11.2_oss
# zypper ar http://download.opensuse.org/distribution/11.2/repo/non-oss/opensuse_11.2_non-oss
# zypper ar http://download.opensuse.org/update/11.2/ opensuse11.2_update

Update2_安裝S10e(Broadcom Corporation BCM4312 802.11b/g)的wireless module:

# zypper in broadcom-wl*

CentOS 5.4 now is available to download!

令人喜愛的CentOS5.4正式release囉！趕緊來download.... :)

CentOS 5.4 release notice
Download site

如果已經安裝了之前的版本，則可透過以下的命令線上更新系統:

# yum list updates
# yum update

備份利器: rsnapshot

rsnapshot與我之前用rsync備份的方法比較起來看來是更加地簡單好用了，有興趣的朋友可參考以下的文章作個測試：
How To Backup Local Unix Host Using rsnapshot rsync Utility
How To Backup Remote Linux Host Using rsnapshot rsync Utility