Categories

• Linux

  Linux Guides Anleitungen bla

  71
  Topics
  82
  Posts

  D

  Install Nginx
  On Ubuntu/Debian: sudo apt update sudo apt install nginx Configure Reverse Proxy
  Create a new file:
  /etc/nginx/sites-available/uptime server { listen 80; server_name uptime.ricardoweigel.de; location / { proxy_pass http://127.0.0.1:3001; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } }

  Enable the config:

  sudo ln -s /etc/nginx/sites-available/uptime /etc/nginx/sites-enabled/ sudo nginx -t sudo systemctl reload nginx

  Now, visiting http://uptime.ricardoweigel.de will show your service running on port 3001 without exposing the port.

  Add HTTPS with Let's Encrypt
  Use Certbot: sudo apt install certbot python3-certbot-nginx sudo certbot --nginx -d uptime.ricardoweigel.de

  It will automatically edit your config to redirect HTTP to HTTPS.

  Result:
  Users go to: https://uptime.ricardoweigel.de
  Internally forwarded to: http://127.0.0.1:3001
  Clean, professional, and secure.

• Networking

  all about Routing and Switching

  10
  Topics
  10
  Posts

  D

  With an out of the box configuration it is not possible to query SNMP or other similar services on the LAN interface address of a remote firewall running pfSense® software over a tunnel mode IPsec VPN connection.

  Fred Wright explained in a post to the m0n0wall mailing list on September 12, 2004 why this is, and it’s the same reason here.

  "Due to the way IPsec tunnels are kludged into the FreeBSD kernel, any traffic initiated by m0n0wall to go through an IPsec tunnel gets the wrong source IP (and typically doesn’t go through the tunnel at all as a result). Theoretically this shouldn’t be an issue for the server side of SNMP, but perhaps the server has a bug (well, deficiency, at least) where it doesn’t send the response out through a socket bound to the request packet. You can fake it out by adding a bogus static route to the remote end of the tunnel via the m0n0wall’s LAN IP (assuming that’s within the near-end tunnel range). A good test is to see whether you can ping something at the remote end of the tunnel (e.g. the SNMP remote) from the m0n0wall. There’s an annoying but mostly harmless side-effect to this - every LAN packet to the tunnel elicits a no-change ICMP Redirect."

  Most notably this is a problem for UDP services bound to all interfaces (*) and ICMP. In these cases, a reply uses the “closest” address to the client from the perspective of the system routing table. Without a route present matching the desired destination this results in using the IP address of the interface containing the default gateway.

  Service Binding Workaround¶
  Some services have options which make it possible to change the interface binding so that the daemon only binds to a specific interface or IP address (e.g. the IP address of the internal network on the local end of the VPN) on the firewall. The interface binding for SNMP, NTP, the DNS Forwarder, and several other services can be set in this way.

  With the daemon bound to only that specific address, that is also the only address it can use to reply, and thus it can generate the expected replies which will properly take the IPsec path back to the other end.

  Static Route Workaround
  If changing the service binding is not possible, or for full connectivity between the endpoints, use static routes to work around the situation.

  Note:
  When both endpoints must be accessed, a static route is required on each endpoint.

  Setting up a static route is done by first adding a gateway pointing to the LAN IP address of the firewall and then adding a static route using this gateway.

  efa10bee-0af6-4a67-958f-f4bc275c4fb3-image.png

  Test
  Perform a test using the address of the far side system and the local address that system is attempting to query.

  Routed IPsec (VTI)
  The previous advice in this document does not generally apply to route-based IPsec (VTI mode) since it operates in a fundamentally different way than policy-based IPsec (tunnel mode).

  With VTI mode IPsec the routing table contains proper routes back to the remote end using the VTI interfaces. Responses will utilize these routes to select the IPsec interface when looking up the path back across the tunnel.

  This may mean the remote end should query the address of the IPsec interface directly so that the responses are received from a matching address, but whether or not this is necessary depends on the service and client.

• Storage

  Storage Stuff like TrueNAS

  2
  Topics
  2
  Posts

  D

  Write Test:

  dd if=/dev/zero of=/mnt/STORAGE0801/PVE0302-BACKUP/testfile bs=4M count=10000

  Read Test:

  dd of=/dev/zero if=/mnt/STORAGE0801/PVE0302-BACKUP/testfile bs=4M count=10000
• Windows

  Fenster Anleitungen

  3
  Topics
  3
  Posts

  D

  diskpart select disk 0 list partition select partition 0 delete partition override
• Cloud

  AWS, Azure, Google Cloud etc

  3
  Topics
  3
  Posts

  D

  AWS CLI is requiered!
  The only other requirement is to have the jq tool to better handle the JSON returned by the aws command.

  apt install jq

  Script:
  update-securitygroups.sh:

  #! /bin/bash #set -x # This script finds all the security groups that have an IP range that meets the condition of affecting the defined ports and whose description has # a given keyword, and then replace that IP range by the one defined at the beginning of the script or the one obtained as the current public IP of # our Internet connection, so that we can continue accessing all servers and services protected by those security groups when our dynamic IP changes. regions='eu-west-1' description_keyword='PFSENSE0103' ports="22 80 443 10021 21000" # Get current public IP from opendns.com service my_public_ip="$(dig +short myip.opendns.com @resolver1.opendns.com)/32" if [ $? -ne 0 ];then echo "ERROR: couldn't get current public IP from opendns.com service! Aborting!" exit 2 fi # Check if /usr/local/bin/scripts/update-securitygroups.ip file already exists, otherwise create it if [ ! -f /usr/local/bin/scripts/update-securitygroups.ip ];then echo "WARNING: file update-securitygroup.ip doesn't exist! Creating a new one..." echo "${my_public_ip}" > /usr/local/bin/scripts/update-securitygroups.ip update_security_groups=1 else # Check if public ip changed my_old_public_ip="$(cat /usr/local/bin/scripts/update-securitygroups.ip)" if [ "${my_old_public_ip}" != "${my_public_ip}" ];then update_security_groups=1 echo "WARNING: current public IP ${my_public_ip} is different from old public IP ${old_public_ip}!" else update_security_groups=0 echo "INFO: current public IP ${my_public_ip} didn't change. Exiting..." exit 0 fi fi echo "INFO: updating security groups..." for region in ${regions};do for port in ${ports};do # Get all security groups that give access to given port security_group_ids=$(aws ec2 describe-security-groups --region "${region}" --filters Name=ip-permission.to-port,Values=${port} \ --query "SecurityGroups[*].[GroupId]" --output text) for security_group_id in ${security_group_ids};do # Get existing IP range that match our keyword within the security group IP permissions description my_old_public_ip=$(aws ec2 describe-security-groups --region "${region}" --group-ids "${security_group_id}" \ | jq -c '.SecurityGroups[].IpPermissions[] | select(.FromPort=='${port}' and .ToPort=='${port}') | .IpRanges[] | select(.Description=="'${description_keyword}'") | .CidrIp' | sed 's/"//g') if [ $? -eq 0 ] && [ ! -z "${my_old_public_ip}" ];then # Update IP range: first remove old IP range and then create new range with new public IP aws ec2 revoke-security-group-ingress --region "${region}" --group-id "${security_group_id}" --protocol tcp --port ${port} \ --cidr "${my_old_public_ip}" && \ aws ec2 authorize-security-group-ingress --region "${region}" --group-id "${security_group_id}" --ip-permissions \ "IpProtocol=tcp,FromPort=${port},ToPort=${port},IpRanges=[{CidrIp=${my_public_ip},Description=${description_keyword}}]" if [ $? -eq 0 ];then echo "OK: ${region} | ${security_group_id} -> replaced previous ${my_old_public_ip} IP range with current ${my_public_ip} public IP on security group $security_group_id for port ${port}" else echo "ERROR: couldn't replace previous ${my_old_public_ip} IP range with current ${my_public_ip} public IP on security group $security_group_id (${region}) for port ${port}!" fi fi done done done

  Cron Job erstellen:

  crontab -e * * * * * /bin/bash /usr/local/bin/scripts/update-securitygroups.sh

  Source: https://www.daniloaz.com/en/how-to-automatically-update-all-your-aws-ec2-security-groups-when-your-dynamic-ip-changes/

• Automation

  Ansible etc.

  10
  Topics
  10
  Posts

  D

  Step 1: Find SecureCRT Configuration Paths containing the file Global.ini
  Open SecureCRT > Options > Global Options > General > Configuration Paths

  Copy Configuration Folder and open this folder > find file Global.ini

  Step 2: Open Global.ini and change Single Instance value to 00000001
  Search for the line in Global.ini with the following text:

  .... D:"Single Instance"=00000000 ....

  Change to

  .... D:"Single Instance"=00000001 ....

  Save Global.ini file and test

• Coding

  Tolle Programme

  0
  Topics
  0
  Posts
  No new posts.