Hero Image
Nginx HTTPS with Basic Auth reverse proxy for VMware ESXi 6.5 fixed VMRC /screen

Nginx HTTPS with Basic Auth reverse proxy for VMware ESXi 6.5 fixed VMRC /screen server { listen 80; server_name esxi.hackion.com; return 301 https://$server_name$request_uri; } server { listen 443 ssl; server_name esxi.hackion.com; ssl_certificate /mycert.crt; ssl_certificate_key /mykey.key; location / { auth_basic "Restricted Content"; auth_basic_user_file /etc/nginx/.htpasswd; proxy_set_header Upgrade $http_upgrade; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Origin ''; proxy_set_header Authorization ''; #Don't pass the Nginx Basic Auth to ESXi or it will break VMRC. proxy_pass_header X-XSRF-TOKEN; proxy_pass https://esxi_server; proxy_send_timeout 300; proxy_read_timeout 300; send_timeout 300; client_max_body_size 1000m; # enables WS support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; } } server { listen 443 ssl http2; # ssl_certificate and ssl_certificate_key are required ssl_certificate /etc/letsencrypt/live/myletsencryptdomain/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/myletsencryptdomain/privkey.pem; include /etc/nginx/snippets/ssl-params.conf; # removed DH params as my ssl-params.conf specifies to only use ECDHE key exchange. server_name fqdn.extern; location / { proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_ssl_verify off; # No need on isolated LAN proxy_pass https://vcenter.ip; # esxi IP Address proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_buffering off; client_max_body_size 0; proxy_read_timeout 36000s; proxy_redirect https://fqdn.local/ https://fqdn.extern/; # read comment below # replace vcenter-hostname with your actual vcenter's hostname, and esxi with your nginx's server_name. } location /websso/SAML2 { proxy_set_header Host fqdn.local; # your actual vcenter's hostname proxy_set_header X-Real-IP $remote_addr; proxy_ssl_verify off; # No need on isolated LAN proxy_pass https://vcenter.ip; # esxi IP Address proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_buffering off; client_max_body_size 0; proxy_read_timeout 36000s; proxy_ssl_session_reuse on; proxy_redirect https://fqdn.local/ https://fqdn.extern/; # read comment below # replace vcenter-hostname with your actual vcenter's hostname, and esxi with your nginx's server_name. } }

Saturday, October 17, 2020 Read
Hero Image
Running GitHub Actions for Certain Commit Messages

Running GitHub Actions for Certain Commit Messages Now, whenever I push a wip commit or any commit that contains the word wip, it will be marked as skipped inside of GitHub actions. jobs: format: runs-on: ubuntu-latest if: "! contains(github.event.head_commit.message, 'wip')" Any commit that contains [build] will now trigger these jobs, everything else will be skipped. jobs: format: runs-on: ubuntu-latest if: "contains(github.event.head_commit.message, '[build]')"

Sunday, October 11, 2020 Read
Hero Image
Using Vagrant to Deploy Multiple VMs on vSphere

Using Vagrant to Deploy Multiple VMs on vSphere vm1 = { 'name' => "PhotonVM1", 'ip' => "192.168.5.224" } vm2 = { 'name' => "PhotonVM2", 'ip' => "192.168.5.225" } vms = [ vm1, vm2] Vagrant.configure(2) do |config| vms.each do |node| vm_name = node['name'] vm_ip = node['ip'] config.vm.define vm_name do |node_config| node_config.vm.network 'private_network', ip: "#{vm_ip}" node_config.vm.box = "dummy" node_config.vm.box_url = "./example_box/dummy.box" node_config.vm.provider :vsphere do |vsphere| vsphere.host = 'vc01.testlab.local' vsphere.compute_resource_name = 'esxi01.testlab.local' vsphere.name = vm_name vsphere.customization_spec_name = 'centos66' vsphere.template_name = 'PhotonTemplate' vsphere.user = 'administrator@vsphere.local' vsphere.password = 'password' vsphere.insecure = true end end end end

Monday, October 5, 2020 Read
Hero Image
Vagrantfile and Provider

Day 8 - Vagrantfile and Provider Day 9 - Advanced Vagrantfile(編輯中) 用以下這個範例 你只要使用 Vagrant up 加上 provider 參數，就可開啟不同來源的機器 例如我要開啟 Vsphere 的機器，我只要下 vagrant up --provider=vsphere 要開 AWS 的機器，我只要下 vagrant up --provider=aws VAGRANTFILE_API_VERSION = "2" Vagrant.configure(VAGRANTFILE_API_VERSION) do |config| # 我們定義一個 Ubuntu 的機器 # box 的需求是對於 local 的 VM 才需要的 # 所以在 provider 是 vmware_fusion 或 Virtualbox 時，才會用到這個設定 config.vm.box = "hashicorp/precise64" # vmware_fusion config.vm.provider "vmware_fusion" do |v, override| override.vm.box = "precise64_vmware" v.gui = false end # vsphere config.vm.provider :vsphere do |vsphere| # 對於私有雲及公有雲，要clone 的vm 是儲存在雲端上的 # 所以 box 使用 dummy box 來達到這個目的 vsphere.vm.box = "nkhasanov/vsphere-simple" vsphere.host = 'YOURIP' vsphere.compute_resource_name = 'YOUR DATACENTER' vsphere.resource_pool_name = 'YOUR RESOURCE POOL' vsphere.insecure = true vsphere.template_name = 'VM TEMPLATE' vsphere.name = "#{YOUR_NAME}-test-machine" vsphere.user = 'administrator' vsphere.password = '$p1unK_Lab' vsphere.vm_base_path = 'vmware_template' vsphere.linked_clone = true end # virtual box config.vm.provider "virtualbox" do |vb| vb.gui = false end # aws config.vm.provider :aws do |aws, override| # aws configurations aws.access_key_id = "#{YOUR_AWS_ACCESS_KEY_ID}" aws.secret_access_key = "#{YOUR_AWS_ACCESS_KEY}" aws.keypair_name = "#{YOUR_NAME}" aws.security_groups = "#{YOUR_NAME}" aws.instance_type = "t2.small" aws.region = "us-east-1" # ubuntu 14.04 x64 aws.ami = "ami-864d84ee" # override info override.ssh.username = "ubuntu" override.ssh.private_key_path = "#{YOUR_AWS_PRIVATE_KEY_PATH}" override.vm.synced_folder "#{YOUR_SYNC_FOLDER}", "/vagrant", type: "rsync" override.vm.box = "dimroc/awsdummy" end end LOCAL_BOXS = { "ubuntu1404x64" => "ubuntu/trusty64", "ubuntu1210x64" => "chef/ubuntu-12.10" } AWS_AMIS = { "ubuntu1404x64" => "ami-864d84ee", "ubuntu1210x64" => "ami-02df496b", "windows2012r2x64" => "ami-9ade1df2", "windows2012x64" => "ami-5ce32034", "windows2008r2x64" => "ami-2ae02342", "windows2008x64" => "ami-5e24e936", "windows2003r2x64" => "ami-b0e320d8" } VAGRANTFILE_API_VERSION = "2" Vagrant.configure(VAGRANTFILE_API_VERSION) do |config| config.vm.box = "precise64_vmware" # vmware_fusion config.vm.provider "vmware_fusion" do |v, override| override.vm.box = "precise64_vmware" v.gui = false v.vmx["memsize"] = "1024" v.vmx["numvcpus"] = "2" end # vsphere config.vm.provider :vsphere do |vsphere| vsphere.vm.box = "nkhasanov/vsphere-simple" vsphere.host = '#{}' vsphere.compute_resource_name = '#{}' # vsphere.resource_pool_name = 'YOUR RESOURCE POOL' vsphere.insecure = true vsphere.template_name = 'qasus-tw-centos7x64-01' vsphere.name = "#{YOUR_NAME}-test-machine" vsphere.user = 'administrator' vsphere.password = '#{}' vsphere.vm_base_path = 'vmware_template' vsphere.linked_clone = true end # virtual box config.vm.provider "virtualbox" do |vb| vb.gui = false vb.memory = 1024 vb.cpus = 2 end # aws config.vm.provider :aws do |aws, override| # aws configurations aws.access_key_id = "#{YOUR_AWS_ACCESS_KEY_ID}" aws.secret_access_key = "#{YOUR_AWS_ACCESS_KEY}" aws.keypair_name = "#{YOUR_NAME}" aws.security_groups = "#{YOUR_NAME}" aws.instance_type = "t2.small" aws.region = "us-east-1" # ubuntu 14.04 x64 aws.ami = "ami-864d84ee" # override info override.ssh.username = "ubuntu" override.ssh.private_key_path = "#{YOUR_AWS_PRIVATE_KEY_PATH}" override.vm.synced_folder "#{YOUR_SYNC_FOLDER}", "/vagrant", type: "rsync" override.vm.box = "dimroc/awsdummy" end # VMs (1..MAX_VM_NUMBER).each do |i| # define linux config.vm.define "l#{i}" do |node| # aws node.vm.provider :aws do |aws| aws.tags = { "Name" => "#{YOUR_NAME}-linux-#{i}" } end # local # node.vm.network "private_network", ip: "192.168.33.%d" % (i+2) node.vm.hostname = "ftan-linux-#{i}" end # define windows config.vm.define "w#{i}" do |node| node.vm.provider :aws do |aws| aws.ami = "ami-2ae02342" aws.tags = { "Name" => "#{YOUR_NAME}-windows-#{i}" } end end end # define customer YOUR_CUSTOMIZED_VM.each do |vm| config.vm.define "%s" % vm["name"] do |node| # aws node.vm.provider :aws do |aws| aws.ami = AWS_AMIS[vm["platform"]] aws.tags = { "Name" => "#{YOUR_NAME}-%s" % vm["name"] } end # vmware fusion # vmware workstation node.vm.provider :vmware_fusion do |fusion| fusion.vm.box = LOCAL_BOXS[vm["platform"]] fusion.vm.hostname = "#{YOUR_NAME}-%s" % vm["name"] end # vsphere # azure end end end

Friday, October 2, 2020 Read
Hero Image
如何設定時區與NTP服務在RHEL7/CentOS7

如何設定時區與 NTP 服務在 RHEL7/CentOS7 chrony 包含兩個程序，chronyd 是一個可以在啟動時啟動的守護進程，chronyc 是一個命令行界面程序，可用於監控 chronyd 的性能並在運行時更改各種運行參數。 注意 ntpd 和 chronyd 擇一就可，不要同時運作。 設定時區 ~# timedatectl set-timezone Asia/Taipei ~# timedatectl Local time: Tue 2018-03-27 14:13:38 CST Universal time: Tue 2018-03-27 06:13:38 UTC RTC time: Tue 2018-03-27 06:13:40 Time zone: Asia/Taipei (CST, +0800) NTP enabled: no NTP synchronized: no RTC in local TZ: no DST active: n/a 設定 chronyd # 安裝 ~# yum install -y chrony # 配置設定檔 ~# cat /etc/chrony.conf # Use public servers from the pool.ntp.org project. # Please consider joining the pool (http://www.pool.ntp.org/join.html). server 0.tw.pool.ntp.org iburst --->改成本地的伺服器 server 1.tw.pool.ntp.org iburst --->改成本地的伺服器 server 2.tw.pool.ntp.org iburst --->改成本地的伺服器 server 3.tw.pool.ntp.org iburst --->改成本地的伺服器 # 啟動服務和設為開機時啟動 ~# systemctl enable chronyd ~# systemctl start chronyd racking 參數顯示有關系統時間效能 ~# chronyc tracking Reference ID : 3DD8996B (61-216-153-107.hinet-ip.hinet.net) --->表示現在同步的時間伺服器，如果沒有id表示沒有同步 Stratum : 4 --->表示計算機有多少"跳hop" 表示本地的是第四層 Ref time (UTC) : Tue Mar 27 06:03:38 2018 --->最後一次測量的時間 System time : 0.000040356 seconds fast of NTP time --->調整系統時間 Last offset : +0.000163738 seconds RMS offset : 0.000163738 seconds Frequency : 21.384 ppm fast Residual freq : +0.000 ppm Skew : 675.319 ppm Root delay : 0.008527911 seconds Root dispersion : 0.066466033 seconds Update interval : 2.0 seconds Leap status : Normal --->Normal要顯示此值, Insert second, Delete second or Not synchronised. ~# chronyc sources -v 210 Number of sources = 4 .-- Source mode '^' = server, '=' = peer, '#' = local clock. / .- Source state '*' = current synced, '+' = combined , '-' = not combined, | / '?' = unreachable, 'x' = time may be in error, '~' = time too variable. || .- xxxx [ yyyy ] +/- zzzz || Reachability register (octal) -. | xxxx = adjusted offset, || Log2(Polling interval) --. | | yyyy = measured offset, || \ | | zzzz = estimated error. || | | \ MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^* 59-124-29-241.hinet-ip.h> 3 6 37 24 -1462us[-2363us] +/- 49ms ^+ 61-216-153-107.hinet-ip.> 3 6 37 23 -556us[ -556us] +/- 64ms ^? 59-125-122-217.hinet-ip.> 0 7 0 - +0ns[ +0ns] +/- 0ns ^- 61-216-153-105.hinet-ip.> 3 6 37 23 -280us[ -280us] +/- 64ms 看同步源頭的資訊 ~# chronyc sourcestats -v 210 Number of sources = 4 .- Number of sample points in measurement set. / .- Number of residual runs with same sign. | / .- Length of measurement set (time). | | / .- Est. clock freq error (ppm). | | | / .- Est. error in freq. | | | | / .- Est. offset. | | | | | | On the -. | | | | | | samples. \ | | | | | | | Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev ============================================================================== 59-124-29-241.hinet-ip.h> 6 5 135 -0.454 4.553 -784us 66us 61-216-153-107.hinet-ip.> 6 6 135 +4.455 19.761 +622us 247us 59-125-122-217.hinet-ip.> 0 0 0 +0.000 2000.000 +0ns 4000ms 61-216-153-105.hinet-ip.> 6 4 136 +8.965 42.440 +1250us 495us 將系統時間寫到硬體(主機板上的時間)上 ~# hwclock --systohc ~# date ; hwclock Tue Mar 27 14:07:57 CST 2018 Tue 27 Mar 2018 02:07:58 PM CST -0.938012 seconds

Tuesday, September 29, 2020 Read
Hero Image
Ansible Introduction

Getting to know Ansible. Outline Introduction Install Common modules Folder structure Conclusion Introduction 安裝部署工具、設定管理工具等 同類型工具：Chef、Puppet、SaltStack 不需要 Agent、透過 ssh Linux 有 python 即可 ( ssh port ) Win 啟用 winrm 即可 ( 5986 port ) https://docs.ansible.com/ansible/latest/user_guide/windows_winrm.html#inventory-options 資料夾結構簡單易懂、官方文件豐富易懂、模組多支援設備多、易撰寫 Install pip install ansible pip3 install ansible yum install ansible apt-get install ansible apk add ansible Common modules ping shell / command file yum systemd / service template / copy debug Common modules - ping

Saturday, September 26, 2020 Read
Hero Image
Install PowerDNS and PowerDNS-Admin on Ubuntu 22.04|20.04|18.04

Install PowerDNS and PowerDNS-Admin on Ubuntu 22.04|20.04|18.04 Master-Master PowerDNS with Galera Replication https://www.scaleway.com/en/docs/installing-powerdns-server-on-ubuntu-bionic/ Install PowerDNS $ sudo apt update $ sudo apt install mariadb-server -y $ sudo mysql -u root CREATE DATABASE powerdns; GRANT ALL ON powerdns.* TO 'powerdns'@'localhost' IDENTIFIED BY 'Str0ngPasswOrd'; FLUSH PRIVILEGES; USE powerdns; CREATE TABLE domains ( id INT AUTO_INCREMENT, name VARCHAR(255) NOT NULL, master VARCHAR(128) DEFAULT NULL, last_check INT DEFAULT NULL, type VARCHAR(6) NOT NULL, notified_serial INT UNSIGNED DEFAULT NULL, account VARCHAR(40) CHARACTER SET 'utf8' DEFAULT NULL, PRIMARY KEY (id) ) Engine=InnoDB CHARACTER SET 'latin1'; CREATE UNIQUE INDEX name_index ON domains(name); CREATE TABLE records ( id BIGINT AUTO_INCREMENT, domain_id INT DEFAULT NULL, name VARCHAR(255) DEFAULT NULL, type VARCHAR(10) DEFAULT NULL, content VARCHAR(64000) DEFAULT NULL, ttl INT DEFAULT NULL, prio INT DEFAULT NULL, change_date INT DEFAULT NULL, disabled TINYINT(1) DEFAULT 0, ordername VARCHAR(255) BINARY DEFAULT NULL, auth TINYINT(1) DEFAULT 1, PRIMARY KEY (id) ) Engine=InnoDB CHARACTER SET 'latin1'; CREATE INDEX nametype_index ON records(name,type); CREATE INDEX domain_id ON records(domain_id); CREATE INDEX ordername ON records (ordername); CREATE TABLE supermasters ( ip VARCHAR(64) NOT NULL, nameserver VARCHAR(255) NOT NULL, account VARCHAR(40) CHARACTER SET 'utf8' NOT NULL, PRIMARY KEY (ip, nameserver) ) Engine=InnoDB CHARACTER SET 'latin1'; CREATE TABLE comments ( id INT AUTO_INCREMENT, domain_id INT NOT NULL, name VARCHAR(255) NOT NULL, type VARCHAR(10) NOT NULL, modified_at INT NOT NULL, account VARCHAR(40) CHARACTER SET 'utf8' DEFAULT NULL, comment TEXT CHARACTER SET 'utf8' NOT NULL, PRIMARY KEY (id) ) Engine=InnoDB CHARACTER SET 'latin1'; CREATE INDEX comments_name_type_idx ON comments (name, type); CREATE INDEX comments_order_idx ON comments (domain_id, modified_at); CREATE TABLE domainmetadata ( id INT AUTO_INCREMENT, domain_id INT NOT NULL, kind VARCHAR(32), content TEXT, PRIMARY KEY (id) ) Engine=InnoDB CHARACTER SET 'latin1'; CREATE INDEX domainmetadata_idx ON domainmetadata (domain_id, kind); CREATE TABLE cryptokeys ( id INT AUTO_INCREMENT, domain_id INT NOT NULL, flags INT NOT NULL, active BOOL, content TEXT, PRIMARY KEY(id) ) Engine=InnoDB CHARACTER SET 'latin1'; CREATE INDEX domainidindex ON cryptokeys(domain_id); CREATE TABLE tsigkeys ( id INT AUTO_INCREMENT, name VARCHAR(255), algorithm VARCHAR(50), secret VARCHAR(255), PRIMARY KEY (id) ) Engine=InnoDB CHARACTER SET 'latin1'; CREATE UNIQUE INDEX namealgoindex ON tsigkeys(name, algorithm); $ sudo systemctl disable systemd-resolved $ sudo systemctl stop systemd-resolved $ ls -lh /etc/resolv.conf lrwxrwxrwx 1 root root 39 Jul 24 15:50 /etc/resolv.conf -> ../run/systemd/resolve/stub-resolv.conf $ sudo unlink /etc/resolv.conf $ echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf Add official PowerDNS repository for Ubuntu 22.04|20.04|18.04.

Friday, September 25, 2020 Read
Hero Image
Ubuntu 18.04 透過 netplan 設定網路卡 IP

Ubuntu 18.04 透過 netplan 設定網路卡 IP 照上面的說明看了一下 /etc/netplan 目錄，查閱一下 /etc/netplan/50-cloud-init.yaml，如下： # This file is generated from information provided by # the datasource. Changes to it will not persist across an instance. # To disable cloud-init's network configuration capabilities, write a file # /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following: # network: {config: disabled} network: ethernets: ens192: dhcp4: true ens224: dhcp4: true version: 2 看來可以關閉 cloud network，但是我其實也沒有要用 cloud-init，乾脆移除它，如下： sudo apt-get remove cloud-init 然後把 /etc/netplan/50-cloud-init.yaml 改成下面這樣： # This file is generated from information provided by # the datasource. Changes to it will not persist across an instance. # To disable cloud-init's network configuration capabilities, write a file # /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following: # network: {config: disabled} network: ethernets: ens192: addresses: [192.168.32.231/24] gateway4: 192.168.32.1 nameservers: addresses: [8.8.8.8, 8.8.4.4] dhcp4: no ens224: dhcp4: true version: 2 這幾年 yaml 深得大眾的心，設定檔就是要用 yaml 格式才是潮，解說一下上述幾個設定：

Friday, September 18, 2020 Read
Hero Image
openvpn部署之部署基於AD域認證

openvpn 部署之部署基於 AD 域認證 OpenVPN + PAM + SSSD + Active Directory https://computingforgeeks.com/install-and-configure-openvpn-server-on-rhel-centos-8/ https://www.redhat.com/en/blog/consistent-security-crypto-policies-red-hat-enterprise-linux-8 https://medium.com/jerrynotes/linux-authentication-windows-ad-without-join-domain-7963c3fd44c5 # 安裝openvpn yum install openvpn -y yum -y install openssl openssl-devel -y yum -y install lzo lzo-devel -y yum install -y libgcrypt libgpg-error libgcrypt-devel # 安裝openvpn認證插件 yum install openvpn-auth-ldap -y # 安裝easy-rsa # 由於openvpn2.3之後，在openvpn裏面剔除了easy-rsa文件，所以需要單獨安裝 yum install easy-rsa cp -rf /usr/share/easy-rsa/2.0 /etc/opevpn/ # 生成openvpn的key及證書 # 修改 `/opt/openvpn/etc/easy-rsa/2.0/vars` 參數 export KEY_COUNTRY="CN" # 國家 export KEY_PROVINCE="ZJ" # 省份 export KEY_CITY="NingBo" # 城市 export KEY_ORG="TEST-VPN" # 組織 exportKEY_EMAIL="81367070@qq.com" # 郵件 export KEY_OU="baidu" # 單位 source vars ./clean-all ./build-ca ./build-dh ./build-key-server server ./build-key client1 # 編輯openvpn服務端配置文件：`/etc/openvpn/server.conf` port 1194 proto udp dev tun ca keys/ca.crt cert keys/server.crt key keys/server.key # This file should be kept secret dh keys/dh2048.pem server 10.8.0.0 255.255.255.0 //客戶端分配的ip地址 push "route 192.168.1.0 255.255.255.0" //推送客戶端的路由 push "redirect-gateway" //修改客戶端的網關，使其直接走vpn流量 ifconfig-pool-persist ipp.txt keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log verb 3 plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so "/etc/openvpn/auth/ldap.conf" client-cert-not-required username-as-common-name log /var/log/openvpn.log # 修改openvpn-ldap-auth的配置文件 `/etc/openvpn/auth/ldap.conf` # /etc/openvpn/auth/ldap.conf <LDAP> # LDAP server URL # 更改爲 AD 服務器的 IP URL ldap://172.16.76.238:389 # Bind DN (If your LDAP server doesn't support anonymous binds) # BindDN uid=Manager,ou=People,dc=example,dc=com # 更改爲域管理的 DN, 可以通過 ldapsearch 進行查詢 # -h 的 ip 替換爲服務器 ip，-D 換爲管理員的 dn，-b 爲基礎的查詢 dn，* 爲所有 # ldapsearch -LLL -x -h 172.16.76.238 -D "administrator@xx.com" -W -b "dc=xx,dc=com" "*" BindDN "cn=administrator,cn=Users,dc=xx,dc=com" # Bind Password # Password SecretPassword # 域管理員的密碼 Password passwd # Network timeout (in seconds) Timeout 15 # Enable Start TLS TLSEnable no # Follow LDAP Referrals (anonymously) FollowReferrals no # TLS CA Certificate File # TLSCACertFile /usr/local/etc/ssl/ca.pem # TLS CA Certificate Directory # TLSCACertDir /etc/ssl/certs # Client Certificate and key # If TLS client authentication is required # TLSCertFile /usr/local/etc/ssl/client-cert.pem # TLSKeyFile /usr/local/etc/ssl/client-key.pem # Cipher Suite # The defaults are usually fine here # TLSCipherSuite ALL:!ADH:@STRENGTH </LDAP> <Authorization> # Base DN # 查詢認證的基礎 dn BaseDN "dc=boqii-inc,dc=com" # User Search Filter # SearchFilter "(&(uid=%u)(accountStatus=active))" # 其中 sAMAccountName=%u 的意思是把 sAMAccountName 的字段取值爲用戶名， # 後面 "memberof=CN=myvpn,DC=xx,DC=com" 指向要認證的 vpn 用戶組， # 這樣任何用戶使用 vpn，只要加入這個組就好了 SearchFilter "(&(sAMAccountName=%u)(memberof=CN=myvpn,DC=boqii-inc,DC=com))" # Require Group Membership RequireGroup false # Add non-group members to a PF table (disabled) # PFTable ips_vpn_users <Group> # BaseDN "ou=Groups,dc=example,dc=com" # SearchFilter "(|(cn=developers)(cn=artists))" # MemberAttribute uniqueMember # Add group members to a PF table (disabled) # PFTable ips_vpn_eng BaseDN "ou=vpn,dc=boqii-inc,dc=com" SearchFilter "(cn=openvpn)" MemberAttribute "member" </Group> </Authorization> 拷貝/etc/openvpn/key目錄下的ca.crt證書，以備客戶端使用。

Thursday, September 17, 2020 Read
Hero Image
Docker Tips: Using Docker Config

Docker Tips: Using Docker Config FROM nginx:1.13.6 COPY nginx.conf /etc/nginx/nginx.conf Using the Docker CLI, we can create a config from this configuration file, we name this config proxy. $ docker config create proxy nginx.conf mdcfnxud53ve6jgcgjkhflg0s $ docker config inspect proxy [ { "ID": "x06uaozphg9kbnf8g4az4mucn", "Version": { "Index": 2723 }, "CreatedAt": "2017-11-21T07:49:09.553666064Z", "UpdatedAt": "2017-11-21T07:49:09.553666064Z", "Spec": { "Name": "proxy", "Labels": {}, "Data": "dXNlciB3d3ctZGF0YTsKd29y...ogIgICAgIH0KICAgIH0KfQo=" } } ] Use a Config $ docker network create --driver overlay front $ docker service create --name api --network front lucj/api $ docker service create --name proxy \ --network front \ --config src=proxy,target=/etc/nginx/nginx.conf \ --port 8000:8000 \ nginx:1.13.6 Service Update When the content of a configuration needs to be modified, it’s a common pattern to create a new config (using docker config create), and then to update the service order to remove the access to the previous config, and to add the access to the new one. The service commands are--config-rm and --config-add.

Monday, September 14, 2020 Read
Hero Image
Fortigate Management Interface in HA Mode

Fortigate Management Interface in HA Mode First you activate the feature config system ha set ha-mgmt-status enable config ha-mgmt-interfaces edit 1 set interface wan2 set gateway 192.168.147.254 next end end Do not forget to set a default gateway. This interface is isolated and requires its own routing. Then you assign an individual IP address to every node in the cluster System1 config system interface edit wan2 set ip 10.11.101.101/24 set allowaccess https ping ssh snmp next end System2

Tuesday, September 8, 2020 Read
Hero Image
How to automatically resize virtual box disk with vagrant

How to automatically resize virtual box disk with vagrant Increasing Disk Space of a Linux-based Vagrant Box on Provisioning Vagrant.configure(2) do |config| config.vm.box = "centos/7" config.disksize.size = '20GB' end $ sudo parted /dev/sda resizepart 2 100% $ sudo lvextend -l +100%FREE /dev/centos/root $ sudo xfs_growfs /dev/centos/root Automate Part Vagrant.configure(2) do |config| common = <<-SCRIPT sudo parted /dev/sda resizepart 2 100% sudo pvresize /dev/sda2 sudo lvextend -l +100%FREE /dev/centos/root sudo xfs_growfs /dev/centos/root SCRIPT config.vm.define "node01" do |node1| node1.vm.hostname = "node01" node1.vm.network "private_network", ip: "192.168.56.121" config.vm.provision :shell, :inline => common end end vagrant plugin install vagrant-disksize Vagrantfile # Fail if the vagrant-disksize plugin is not installed unless Vagrant.has_plugin?("vagrant-disksize") raise 'vagrant-disksize is not installed!' end Vagrant.configure("2") do |config| config.vm.provider "virtualbox" do |vb| vb.name = "DISKEXTEND" vb.memory = 2048 vb.cpus = 2 end config.vm.define :"DISKEXTEND" do |t| end config.vm.hostname = "DISKEXTEND" config.vm.box = "bento/ubuntu-18.04" # Increase the default disk size of the bento image (64GB) to 96GB config.disksize.size = "96GB" # Run a script on provisioning the box to format the file system config.vm.provision "shell", path: "disk-extend.sh" end Provisioning Script: disk-extend.sh #!/bin/bash echo "> Installing required tools for file system management" if [ -n "$(command -v yum)" ]; then echo ">> Detected yum-based Linux" sudo yum makecache sudo yum install -y util-linux sudo yum install -y lvm2 sudo yum install -y e2fsprogs fi if [ -n "$(command -v apt-get)" ]; then echo ">> Detected apt-based Linux" sudo apt-get update -y sudo apt-get install -y fdisk sudo apt-get install -y lvm2 sudo apt-get install -y e2fsprogs fi ROOT_DISK_DEVICE="/dev/sda" ROOT_DISK_DEVICE_PART="/dev/sda1" LV_PATH=`sudo lvdisplay -c | sed -n 1p | awk -F ":" '{print $1;}'` FS_PATH=`df / | sed -n 2p | awk '{print $1;}'` ROOT_FS_SIZE=`df -h / | sed -n 2p | awk '{print $2;}'` echo "The root file system (/) has a size of $ROOT_FS_SIZE" echo "> Increasing disk size of $ROOT_DISK_DEVICE to available maximum" sudo fdisk $ROOT_DISK_DEVICE <<EOF d n p 1 2048 no w EOF sudo pvresize $ROOT_DISK_DEVICE_PART sudo lvextend -l +100%FREE $LV_PATH sudo resize2fs -p $FS_PATH ROOT_FS_SIZE=`df -h / | sed -n 2p | awk '{print $2;}'` echo "The root file system (/) has a size of $ROOT_FS_SIZE" exit 0

Tuesday, August 25, 2020 Read