adduser username
passwd username
echo 'username ALL=(ALL) ALL' >> /etc/sudoers #allowes user to use sudo
su username
echo 'export PATH=$PATH:/sbin' >> ~/.bashrc #adding /sbin to my path
echo -e 'syntax on\nset number' > ~/.vimrc #this enables syntax and line numbers for vim

exit out of the system for an easy login with

asynchrounous key authentication

from the local machine:

ssh-keygen -t rsa
ssh username@remote-host mkdir -p .ssh
cat ~/.ssh/id_rsa.pub | ssh username@remote-host 'cat >> .ssh/authorized_keys2'

i had to change permissions on the remote machine for the .ssh dir like this:

chmod 700 ~/.ssh && chmod 640 ~/.ssh/authorized_keys2

the last thing i did was to change the port of ssh to something other than 22. Edit the

/etc/ssh/sshd_config

and uncomment port, also set the port to something else at the top of the file. Next change the

/etc/sysconfig/iptables

content to ACCEPT the same port (the line with -dport 22). Afterwards restart both with

sudo service iptables condrestart && sudo service sshd restart

install X and Gnome for vnc:

sudo yum groupinstall "X Window System" "GNOME Desktop Environment" && sudo yum install vnc-server

IMPORTANT: disable the NetworkManager on runlevel 3 :

sudo chkconfig --level 3 NetworkManager off

or otherwise the NetworkManager shuts down the network interface while restarting because i am on a fixed network. Read this for more information. Optional you can restart the vps for testing.

Start and stop the vncserver once so it creates a .vnc dir with the xstartup file. Start it by just typing

vncserver && vncserver -kill :1

the :1 stands for Display number one, the port for this display is 5901. The :1 and the last number of 5901 change synchronously.

i wanted gnome to be my desktop layout. If you want that too edit the

~/.vnc/xstartup

file and replace

twm &

by

exec gnome-session &

edit

/etc/sysconfig/vncservers
20  VNCSERVERS="1:nilsen31 2:robert31 3:partyplan"
21  VNCSERVERARGS[1]="-geometry 1280x700 -nolisten tcp -nohttpd -localhost "22  VNCSERVERARGS[2]="-geometry 1280x800 -nolisten tcp -nohttpd -localhost "

and uncomment the last two lines. this enables some security settings: prevent http connctions and just allows tunnels.

Change the username and display number for your needs and set the geometry settings accordingly. The array index of the

VNCSERVERARGS[x]

VNCSERVERS="1:someuser1 2:someuser2 3:someuser3"
VNCSERVERARGS[1]="-geometry 1280x700 -nolisten tcp -nohttpd -localhost "
VNCSERVERARGS[2]="-geometry 1280x800 -nolisten tcp -nohttpd -localhost "
...

stands for the display number, so change it accordingly.

turn the vncserver it on with:

sudo chkconfig vncserver on

i recommend a secure connection to your remote display. This is done by building a tunnel under the ssh connection.

Here is the quote from the ssh manual pages for the -L option: “Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side.” doing this looks like this

ssh -L 5901:localhost:5901 user@remote-host

the number before and after the hostname stands for the incoming and outgoing port. The best vnc viewer for osx is, and i tried like five of them, “chicken of the vnc”. Be sure to open the port 5901 in the iptables config file. Connect to localhost on Display 1 in the program. at my local machine i made a file called remote.sh which lets me connect quickly to the remote machine by executing it.

echo '#!/bin/bash' > remote.sh && echo 'ssh -L 5901:localhost:5901 user@remote-host -p port-number' >> remote.sh && chmod 700 remote.sh

now i just have to type ~/rem, tab(for autocompletion) and return to get in.

install java & Co

install c/c++ first:

sudo yum install compat-gcc-34 compat-gcc-34-c++ libstdc++.so.5

go to the /tmp dir and wget something from http://java.sun.com/javase/downloads/index.jsp

cd /tmp
chmod u+x downloadedFile.bin #so it can be executed
./downloadedFile.bin #execute the file
echo -e 'export JAVA_HOME=/usr/local/java/jdk\nexport PATH=$PATH:$JAVA_HOME/bin' >> ~/.bashrc #set JAVA_HOME and add it to your PATH
bash #get a new instance of the shell
java -version #check if it works.

install maven2

wget maven2 from here

tar xjvf apache-maven-2.0.9-bin.tar.bz2 #extract the archive

move the extracted folder to /usr/local/java/maven2

echo -e 'export MAVEN_HOME=/usr/local/java/maven2/\nexport PATH=$PATH:$MAVEN_HOME/bin' >> ~/.bashrc
bash #get a new instance of the bash
mvn -version #check if it works.

apache & mysql

sudo yum install mysql mysql-server mysql-devel phpMyAdmin
sudo chgrp -R mysql /var/lib/mysql  && sudo chmod -R 770 /var/lib/mysql
sudo service mysqld start && sudo chkconfig mysqld on
mysqladmin -u root password changeme #set the root password
sudo service httpd start && sudo chkconfig httpd on
chkconfig --list | grep "mysqld\|httpd" #just testing

add the ports 80 and 443 to /etc/sysconfig/iptables

-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

sudo service iptables condrestart

edit /etc/httpd/conf.d/phpMyAdmin.conf for access only on 127.0.0.1 and https.

RewriteEngine on
RewriteCond   %{SERVER_PORT}  !^443$
RewriteRule ^/phpMyAdmin(.*)$ https://%{HTTP_HOST}/phpMyAdmin$1 [L,R]

Alias /phpMyAdmin /usr/share/phpMyAdmin
<Directory /usr/share/phpMyAdmin/>
       order deny,allow
       deny from all
       allow from 127.0.0.1
</Directory>
# This directory does not require access over HTTP - taken from the original
# phpMyAdmin upstream tarball
<Directory /usr/share/phpMyAdmin/libraries>
       Order Deny,Allow
       Deny from All
       Allow from None
</Directory>

for later backup put the password for mysqldump in ~/.my.cnf
the content should look like this:

[mysqldump]
password = cleartextpwd

afterwards set the acl to 700

chmod 700 ~/.my.cnf

configure sendmail for authentication on an external smtp server

add the following line to /etc/mail/access

Authinfo:smtp.server.com "U:username" "P:password"

then run
makemap hash /etc/mail/access.db < /etc/mail/access

version control with subversion and trac

sudo yum install subversion trac mod_dav_svn mod_ssl mod_python
mkdir /var/svn && cd /var/svn
svnadmin create repository

edit the new file /etc/httpd/conf.d/subversion.conf and put this content in it:

<Location /repos>
       DAV svn
       SVNParentPath /var/svn
       # Limit write permission to list of valid users.
       AuthType Basic
       AuthName "Subversion Authorization Realm"
       AuthzSVNAccessFile /var/svn/svn.acl
       AuthUserFile /var/svn/.htpasswd
       Require valid-user
       #only SSL
       SSLRequireSSL
</Location>

generate the htpasswd file now:

htpasswd -cb /var/svn/.htpasswd username password && chmod 700 /var/svn/.htpasswd

add the svn.acl file so you have access to every repository:

echo -e '[/]\nusername =  rw' > /var/svn/svn.acl && chmod 700 /var/svn/svn.acl

i added a view only user to the .htpasswd and acl as well:

htpasswd -b /var/svn/.htpasswd view only #without -c (create flag)
echo -e '[repository:/]\nview =  r' >> /var/svn/svn.acl # >> = append to file
chown -R apache.apache /var/svn

trac:

trac-admin /var/trac/repository initenv

edit /etc/httpd/conf.d/trac.conf like this:

<Location /trac >
        SetHandler mod_python
        PythonInterpreter main_interpreter
        PythonHandler trac.web.modpython_frontend
        PythonOption TracEnvParentDir /var/trac
        PythonOption TracUriRoot /trac
</Location>
<LocationMatch "/trac/[^/]+/login">
	AuthType Basic
	AuthName "Trac"
	AuthUserFile /var/svn/.htpasswd
	SSLRequireSSL
	Require valid-user
</LocationMatch>

backup & security

get the latest packages

yum install yum-updatesd
service yum-updatesd start
chkconfig yum-updatesd on

encrypted sql dumps by cron

on the local machine (osx) download gnupg2
and install it. then go to the command line and type:

gpg2 --gen-key

transfer the public key to the remote machine:

cat ~/.gnupg/pubring.gpg | ssh username@remote-host 'cat >> ~/uidpubring.gpg'

on the remote machine:

yum install gnupg2
gpg2 --import ~/uidpubring.gpg
gpg2 --edit-key uid #uid is the username on your local machine.

in the dialog type “trust” and select “(5) ultimate”
now you can encrypt files like this:

gpg2 -r uid --encrypt confidental.zip

decrypt it with this command:

gpg2 --decrypt confidental.zip.gpg > crypto.zip #this works only with the secring.gpg

now the script for mysql:

#!/bin/bash

DATE=`date -d yesterday +%Y%m%d%H%M%S`
BAKPATH='/home/username/Documents/Backup/local/sql/'
nice -n 19 mysqldump -u dbUser -a -e --add-drop-table databasename | nice -n 19 gzip -c -9 >  ${BAKPATH}.datenbank_sqldump-${DATE}.gz_INPROGRESS
mv -f ${BAKPATH}.datenbank_sqldump-${DATE}.gz_INPROGRESS ${BAKPATH}datenbank_sqldump-${DATE}.gz
gpg2 -r uid --encrypt ${BAKPATH}datenbank_sqldump-${DATE}.gz
rm -f ${BAKPATH}datenbank_sqldump-${DATE}.gz

notice that i didn’t have to provide a password because of the ~/.my.cnf. i also added this to my cronjobs

enter the preferred command at

crontab -e

before the command put the time to execute. check the crontab man for the syntax.
the secring.gpg is very important only with this and the passphrase you can decrypt the backup.
if you loose it you can reimport it like this:

gpg2 --import Desktop/secring.gpg

the whole machine with rsync

the next command will backup the whole root partition. notice the p1122 for a different ssh port.

rsync --verbose -e ssh --rsh='ssh -p1122' --exclude "/sys" --exclude "/dev"
--exclude "/proc" --recursive --progress --times --perms --links 
username@remote-host:/ /Volumes/DOS/bak/remote-host/

to restore the backup just flip the remote and local directorys,

for example here i restore the complete www directory from my external hdd to the remote machine:

 rsync --verbose -e ssh --rsh='ssh -p1122'  --recursive --progress --times
--perms --links  /Volumes/DOS/bak/remote-host/var/www username@remote-host:/var/

i also added this to my cronjobs

enter the preferred command at

crontab -e

before the command put the time to execute. check the crontab man for the syntax.

references

• ssh rsa authentication: http://linuxproblem.org/art_9.html
• vnc http://tokyoahead.com/main/multifaq/index.php/65 http://ulyssesonline.com/2006/02/26/vncserver-on-
• fedora-core-4/ echo http://www.unix.com/shell-programming-scripting/56666-new-line-
• echo.html#post302271726 java: http://www.mjmwired.net/resources/mjm-fedora-f9.html#java
• maven: http://beans.seartipy.com/2008/10/05/installing-sun-java-se-6-maven-2-and-tomcat-55-on-fedora-
• htpasswd: http://linux.die.net/man/1/htpasswd
• sql: http://www.vbulletin-germany.com/forum/showthread.php?t=17548

Bookmark It

Hide Sites

the privileges: “insert, update, select, ALTER ROUTINE, CREATE ROUTINE, EXECUTE, File” are needed.

This script here can insert and update data in the tables via xml:

here is the format of the xml files for input:

<updates>
<update>
<field name=”UserName”>some new name</field>
<condition name=”id”>7</condition>
</update>
….
</updates>

<inserts>
<insert>
<field name=”UserName”>tttttttttttt</field>
<field name=”Value”>tttttt</field>
…
</insert>
…
</inserts>

for getting data this here is possible:

for getting the rows when somebody was online, put the parameters ‘actTime’ with the condition Value yyyy-mm-dd hh:mm and for the ‘type’ put the Value ‘getActionsInTime’, than you get something like this:

<?xml version="1.0"?>
<resultset>
<row>
<field>
<WlanUserActions>
<Action>
<AcctStartTime>2008-09-01 19:34:01</AcctStartTime>
<UserName>username</UserName>
<FramedIPAddress>10.1.0.114</FramedIPAddress>
<AcctTerminateCause>User-Request</AcctTerminateCause>
<AcctSessionTime>16731</AcctSessionTime>
<AcctStopTime>2008-09-02 00:12:52</AcctStopTime>
</Action>
....
</WlanUserActions >
</field>
</row>
</resultset>

i haven’t figured out how to get rid of the row and field tags…from a mysql command.
To get Rows from the radacct table for a specific user put ‘getActions’ as type and set the Value
for the parameter ‘UserName’.

BE WARNED THERE SOME HIGH SECURITY RISKS BY IMPLEMENTING THIS SCRIPT, I CAN NOT BE MADE RESPONSIBLE FOR ANYTHING HAPPENING BECAUSE OF THIS SCRIPT.

here

Bookmark It

Hide Sites

there is a little workaround called End Of Message:

in perl do

print << EOM;
htmlcode without escaping
EOM;

with bash you would use cat instead of print.

Bookmark It

Hide Sites

Its really simple:

alter table radcheck add column `Valid` tinyint(1) default 0 not null;

than in the /etc/freeradius/sql.conf change the variable authorize_check_query by adding `and Valid = 1` after where username = “%{SQL-User-Name}” \

in the future time you can chane then the valid to serve many purposes for example email authorization like wifidog has.

Bookmark It

Hide Sites

In my Application which i’m developing over a year now i need to access the radius database for user modifications. say simple: in my app i want to control who can access the internet.
I opend the database port 3306 by uncommenting the bindto=127.0.0.1 in /etc/mysql/my.cnf or similar, which is not very clean. A xml connection for simple crud would be better but i am under time pressure ….
With hibernate i was able to connect to the radius db besides the app database by defining another “dataSource” like this:

<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close">


 <property name="driverClassName" value="@DB-DRIVERNAME@"/>

 <property name="url" value="@DB-URL@"/>

 <property name="username" value="@DB-USERNAME@"/>

 <property name="password" value="@DB-PASSWORD@"/>

 <property name="maxActive" value="100"/>

 <property name="maxIdle" value="30"/>

 <property name="maxWait" value="1000"/>

 <property name="defaultAutoCommit" value="true"/>

 <property name="removeAbandoned" value="true"/>

 <property name="removeAbandonedTimeout" value="60"/>

</bean>
<bean id="dataSourceRadius" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close">


 <property name="driverClassName" value="com.mysql.jdbc.Driver"/>

 <property name="url" value="jdbc:mysql://x.x.x.x/radius?zeroDateTimeBehavior=convertToNull"/>

 <property name="username" value="radius"/>

 <property name="password" value="somepwd"/>

 <property name="maxActive" value="100"/>

 <property name="maxIdle" value="30"/>

 <property name="maxWait" value="1000"/>

 <property name="defaultAutoCommit" value="true"/>

 <property name="removeAbandoned" value="true"/>

 <property name="removeAbandonedTimeout" value="60"/>

</bean>

i tried to modify the hotspotlogin.cgi perl script but i’m not really getting it. AND what i hate the most of all is that html code is printed line by line, in my eyes that is sooo messy … i heared that other login pages are out there so i have to study them today. I also want to control the logout process from my app, this is a little bit tricky too i need to access the adress http://10.1.0.1:3990/logoff but with this addy i can’t say which user to log off …

Bookmark It

Hide Sites

i’m still on the radius and choova-chilli thing. I began working on a tutorial for ubuntu but with fedora i was more ahead of things but i’m not jet done.
The chilli.iptables file besides the chilli.sock file need a closer look. Tomorrow i will read about iptables which i always wanted to understand.

here is the ubuntu tutorial

Something else is not going so well, i think its the hotspotlogin.cgi page dosent encryped the password right because the freeRadius Server sais something about the passwords didn’t match.
When i try the radtest command than everything is accepted.

Bookmark It

Hide Sites

it consists of a wifi authentication system called wifidog. It is developed as open source software by canadians.
normally anyone can use it. You can logon to the hotspot without any wpa key, register at the login page and surf for free. This didn’t fit our needs because we installed it for restriced access for the customers.
Still our customers login with a wpa key. Now they will login to an open network and can only browse one site: the loginpage for authentication. Afterwards we are able to trac the time they were online nothing more.

With wifidog its really easy to disable the registration form and the email validation procedure.
The only thing which wasn’t so easy is to disable access for a resistered user.I had to write a little pgsql script which takes the username and sets the account_status of the users table to zero which stands for denied; 1 is for allowed.

I put the authentication server and the gateway server on one fedora mashine. Hopefully someday i will put the gateway on our Linksys WRT54G but its always used and people would complain about the connection interruption well someday we get anotherone.

There is something which i don’t really understand about the system. When i login as a wifi user than there are some dalays when i try to login or logout, but well it works anyway. Sometimes its confusing for the customers.

Bookmark It

Hide Sites

then

for files in *; do convert -strip -quality 80 “$files” “$files”; done

in windows do a bat file an put this into it:

@ECHO OFF
ECHO.
ECHO This is a batch file
ECHO.
FOR %%c in (C:\Users\nilsen\Pictures\*.*) DO convert -strip -quality 80 %%c %%c

Bookmark It

Hide Sites