CentOS 6 更新 OpenSSL 1.1.1g

1.查看原本版本
# openssl version


2.下載安裝更新版本
# wget https://www.openssl.org/source/openssl-1.1.1g.tar.gz

# tar zxvf openssl-1.1.1g.tar.gz
# cd openssl-1.1.1g.tar.gz
# ./config --prefix=/opt/openssl --openssldir=/usr/local/ssl shared zlib
# make && make install

3.備份原始版本
# mv /usr/bin/openssl /usr/bin/openssl-1.0.1k
# mv /usr/include/openssl /usr/include/openssl-1.0.1k


4.更新版本
# ln -s /opt/openssl/bin/openssl /usr/bin/openssl
# ln -s /opt/openssl/include/openssl /usr/include/openssl
# echo "/opt/openssl/lib" > /etc/ld.so.conf.d/openssl-1.1.1g.conf
# ln -s /opt/openssl/lib/libssl.so.1.1 /usr/lib/libssl.so.1.1
# ln -s /opt/openssl/lib/libcrypto.so.1.1 /usr/lib/libcrypto.so.1.1


5.驗證

# openssl version
openssl: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory 

# ldd /usr/bin/openssl
linux-vdso.so.1 => (0x00007ffcfe9f8000)
libssl.so.1.1 => not found
libcrypto.so.1.1 => not found
libz.so.1 => /lib64/libz.so.1 (0x00007f9a51e13000)
libdl.so.2 => /lib64/libdl.so.2 (0x00007f9a51c0f000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f9a519f3000)
libc.so.6 => /lib64/libc.so.6 (0x00007f9a51625000)
/lib64/ld-linux-x86-64.so.2 (0x00007f9a52029000)

# ln -s /opt/openssl/lib/libssl.so.1.1 /lib64/libssl.so.1.1
# ln -s /opt/openssl/lib/libcrypto.so.1.1 /lib64/libcrypto.so.1.1
# openssl version
OpenSSL 1.1.1g 21 Apr 2020

cacti 0.88b 無法開啟 "Graph Management"

log 出現 [error] "PHP message: PHP Fatal error: Cannot redeclare graph() in /home/cacti/graphs.php on line 1355" while reading response header from upstream
google Cannot redeclare graph() in /home/cacti/graphs.php on line 1355" while reading response header from upstream
參考這篇文章 https://forums.cacti.net/viewtopic.php?t=46455 # yum remove graphviz graphviz-php
# service php-fpm restart

在 centos 6 上安裝 docker-io

如果在 centos 6 下直接 yum install docker 的話、是可以安裝 docker 的、但是一執行就會出現錯誤訊息
Segmentation Fault or Critical Error encountered. Dumping core and aborting

所以要改成安裝 docker-io
先安裝 epel-realease
#rpm -iUvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

可以的話先更新一次系統並且重開機
#yum update -y

安裝 docker-io
#yum install -y docker-io

啟動 docker
#service docker start

也可以設成開機自動啟動
#chkconfig docker on

yum-complete-transaction 出現錯誤 ImportError: No module named yum

又是升級 python 2.7產生的問題
Traceback (most recent call last):
File "/usr/sbin/yum-complete-transaction", line 20, in
import yum
ImportError: No module named yum

直接修改 vi /usr/sbin/yum-complete-transaction
#!/usr/bin/python -tt
改成
#!/usr/bin/python2.6 -tt
就好了

在 centos6 上面編譯 gcc 5.5.0

下載需要的檔案
wget ftp://gcc.gnu.org/pub/gcc/infrastructure/gmp-6.1.0.tar.bz2
wget ftp://gcc.gnu.org/pub/gcc/infrastructure/mpfr-3.1.4.tar.bz2
wget ftp://ftp.gnu.org/gnu/mpc/mpc-1.1.0.tar.gz
wget ftp://ftp.mirrorservice.org/sites/sourceware.org/pub/gcc/releases/gcc-5.5.0/gcc-5.5.0.tar.gz

安裝套件
sudo yum install -y epel-release
sudo yum install -y git make cmake gcc gcc-c++ libstdc++-static libmicrohttpd-devel libuv-static glibc-devel

解壓縮檔案
for i in gmp-6.1.0.tar.bz2 mpfr-3.1.4.tar.bz2 ; do bunzip2 $i ; done

for i in gmp-6.1.0.tar mpfr-3.1.4.tar ; do tar xvf $i ; done

for i in gcc-5.5.0.tar.gz mpc-1.1.0.tar.gz ; do tar zxvf $i ; done

編譯 gmp-6.1.0
cd gmp-6.1.0
./configure
make && make install

編譯 mpfr-3.1.4
cd mpfr-3.1.4
./configure
make && make install

編譯 mpc-1.1.0
cd mpc-1.1.0
./configure
make && make install

上面編譯出來後的 lib 會放在 /usr/local/lib 、 這邊做軟連結到 /usr/lib 下面
ln -s /usr/local/lib/libgmp.so.10.3.0 /usr/lib/libgmp.so.10
ln -s /usr/local/lib/libmpc.so.3.1.0 /usr/lib/libmpc.so.3
ln -s /usr/local/lib/libmpfr.so.4.1.4 /usr/lib/libmpfr.so.4

編譯 gcc-5.5.0
cd gcc-5.5.0
./configure --disable-multilib --enable-languages=c,c++
#./configure --with-mpfr=/usr/local/mpfr-3.1.4 --with-mpc=/usr/local/mpc-1.1.0 --with-gmp=/usr/local/gmp-6.1.0
make -j `grep processor /proc/cpuinfo | wc -l`
make install

在 32位元 的 CentOS 6.x 版上編譯 xmrig

更新套件
sudo yum install -y epel-release
sudo yum install -y git make cmake gcc gcc-c++ libstdc++-static libmicrohttpd-devel libuv-static

更新 gcc 版本
wget ftp://ftp.mirrorservice.org/sites/sourceware.org/pub/gcc/releases/gcc-5.5.0/gcc-5.5.0.tar.gz
tar zxvf gcc-5.5.0.tar.gz
cd gcc-5.5.0
./configure --disable-multilib --enable-languages=c,c++
make -j `grep processor /proc/cpuinfo | wc -l`
make install

更新 libuv 版本
git clone https://github.com/libuv/libuv.git
cd libuv/
sh autogen.sh
./configure
make
make install

export CC=/usr/local/bin/gcc
export CXX=/usr/local/bin/g++

編譯 xmrig
git clone https://github.com/xmrig/xmrig.git
cd xmrig
sed -i -e 's/constexpr const int kDefaultDonateLevel = 5;/constexpr const int kDefaultDonateLevel = 1;/i' /usr/local/src/xmrig/src/donate.h
mkdir build
cd build
cmake .. -DCMAKE_BUILD_TYPE=Release -DUV_LIBRARY=/usr/lib/libuv.a
make

在 CentOS 6 下使用 yum 安裝 cmake3

下載最新的 epel-release rpm
http://dl.fedoraproject.org/pub/epel/6/i386/

安裝 epel-release rpm
rpm -ivh epel-rease*rpm

安裝 cmake3
yum install cmake3

reference:https://centos.pkgs.org/6/epel-i386/cmake3-3.6.1-3.el6.i686.rpm.html

CentOS /boot 空間不足

當初安裝時腦殘、結果 /boot 只留了 100M 而以
結果 yum update 的時候就跳出下面錯誤

installing package kernel-2.6.32-696.13.2.el6.i686 needs 759KB on the /boot filesystem


[('installing package kernel-2.6.32-696.13.2.el6.i686 needs 759KB on the /boot filesystem', (9, '/boot', 777216L))]

確認一下 /boot 大小
# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 1.1T 745G 289G 73% /
tmpfs 6.9G 0 6.9G 0% /dev/shm
/dev/sda1 93M 62M 27M 70% /boot

確認一下目前使用的 kernel
# uname -r
2.6.32-696.3.2.el6.i686

確認安裝的 kernel
# rpm -qa|grep kernel|sort
abrt-addon-kerneloops-2.0.8-43.el6.centos.i686
dracut-kernel-004-409.el6_8.2.noarch
kernel-2.6.32-696.10.1.el6.i686
kernel-2.6.32-696.3.2.el6.i686
kernel-devel-2.6.32-431.el6.i686
kernel-devel-2.6.32-696.10.1.el6.i686
kernel-devel-2.6.32-696.3.2.el6.i686
kernel-firmware-2.6.32-696.10.1.el6.noarch
kernel-headers-2.6.32-696.10.1.el6.i686
libreport-plugin-kerneloops-2.0.9-33.el6.centos.i686

移除目前未使用的 kernel
rpm -e kernel-2.6.32-696.10.1.el6.i686 kernel-devel-2.6.32-696.10.1.el6.i686

這樣就可以清出空間 yum update

Linux 保存和即時顯示所有使用者的操作記錄及過程

因為某些需求、必須針對權限加強控管

因為記錄下使用者登入後的每個指令就是必須的動作

系統 centos 6.9 x64
在 /etc/profile 最後新增下面三行
export HISTORY_FILE=/var/log/command_history/$USER-$UID-`date '+%Y-%m-%d'`.log
export PROMPT_COMMAND='{ date "+%Y-%m-%d %T ##### $(who am i |awk "{print \$1\" \"\$2\" \"\$5}") #### $(history 1 | { read x cmd; echo "$cmd"; })"; } >> $HISTORY_FILE'

exec /usr/bin/script -t 2>> /var/log/command_history/$USER-$UID-`date +%Y%m%d%H%M`.date -a -f -q /var/log/command_history/$USER-$UID-`date +%Y%m%d%H%M`.log

這樣會記錄下所有使用者登入後操作的每一個命令

記錄檔存放的地方需要有其他使用者可以寫的權限
chmod 743 /var/log/command_history

第一二行：將使用者本機操作指令存到記錄檔中
第三行：利用 script 指令將使用者所有操作存到檔案中，如果用 tail -f 去存取.log檔的話，可以即時看到使用者的行為

另外 script 記錄的檔案會把含控制碼都記錄下來、可以用 less -r file.log 或是 more file.log 去看


reference:
Linux利用script命令儲存使用者操作記錄的方法
用 Script 指令來紀錄輸出及輸入

CentOS 5 yum 失敗

一開始錯誤訊息
YumRepo Error: All mirror URLs are not using ftp, http[s] or file.
Eg. Invalid release/
removing mirrorlist with no valid mirrors: //var/cache/yum/updates/mirrorlist.txt
Error: Cannot find a valid baseurl for repo: updates

修改 CentOS-Base.repo 後又出現
http://mirror.centos.org/centos/5/os/i386/repodata/repomd.xml: [Errno 14] HTTP Error 404: Not Found
Trying other mirror.
Error: Cannot retrieve repository metadata (repomd.xml) for repository: base. Please verify its path and try again

最後查到這篇

yum fails


把 CentOS-Base.repo 裡面修改成下面這樣就可以了
[base]
name=CentOS-$releasever - Base
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os
#baseurl=http://mirror.centos.org/centos/$releasever/os/$basearch/
baseurl=http://vault.centos.org/5.11/os/i386/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5

#released updates
[updates]
name=CentOS-$releasever - Updates
mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates
#baseurl=http://mirror.centos.org/centos/$releasever/updates/$basearch/
gpgcheck=1
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5

#additional packages that may be useful
[extras]
name=CentOS-$releasever - Extras
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=extras
#baseurl=http://mirror.centos.org/centos/$releasever/extras/$basearch/
baseurl=http://vault.centos.org/5.11/extras/i386/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5


好吧、CentOS 5 有機會是該淘汰了

reference:yum fails

PHP Fatal error: Class 'ZipArchive' not found 解決

環境：
CentOS 6.9
php 5.6.30 編譯版

下載 zip 模組
wget http://pecl.php.net/get/zip-1.13.5.tgz

PS.CentOS 6.x 只能使用 1.13.5 以前的版本

[root@xxxxx zip-1.13.5]# /usr/local/php/bin/phpize
[root@xxxxx zip-1.13.5]# ./configure --with-php-config=/usr/local/php/bin/php-config

[root@xxxxx zip-1.13.5]# make && make install
Installing shared extensions: /usr/local/php/lib/php/extensions/no-debug-zts-20131226/

修改 php.ini
extension = zip.so
zlib.output_compression = On

重啟 apache


reference：PHP｜Fatal error: Class 'ZipArchive' not found 解決方法

svn 轉移後出現錯誤訊息 "svn: Expected FS format between '1' and '4'; found format '6'"

舊機器是 centos 5.3
新機器是 centos 6.9 x64 ，使用 yum -y install mod_dav_svn subversion 安裝
安裝後版本為 1.6.11

將 svn 檔案轉移後、出現 "svn: Expected FS format between '1' and '4'; found format '6'"
修改 "項目/db/format" 的第一行、 6 改成 4 就沒問題了

centos 使用非 root 帳號安裝 nvm

安裝需要的程式
yum install git openssl libssl-dev curl

下載nvm
git clone https://github.com/creationix/nvm.git /opt/nvm

建立安裝目錄
mkdir /usr/local/nvm
/usr/local/node
chown root.web /usr/local/nvm
chmod 775 /usr/local/nvm

建立 /etc/profile.d/nvm.sh 給所有使用者 source 用
export NVM_DIR=/usr/local/nvm
source /opt/nvm/nvm.sh

一鍵安裝 shell script
#!/bin/bash
group0='web'

yum install -y git openssl libssl-dev curl

groupadd $group0

git clone https://github.com/creationix/nvm.git /opt/nvm

modify() {
chown -R root.$group0 /usr/local/$1
chmod -R 775 /usr/local/$1
}

for i in nvm
do
if [ -d "/usr/local/$i" ];then
modify $i
else
mkdir /usr/local/$i
modify $i
fi
done

echo 'export NVM_DIR=/usr/local/nvm
source /opt/nvm/nvm.sh' > /etc/profile.d/nvm.sh

read -p "Input a username : " user

if [ "$user" != "" ];then
usermod -G $group0 $user
else
echo "Please add user to $group0 group! "
fi


reference:Ubuntu下如何給所有用戶安裝nodejs的nvm

Google Compute Engine 使用 root 和密碼登入

先使用 ssh key 登入後、先幫root設定密碼、然後修改 /etc/sshd/sshd_config，順便修改回應比較慢的問題

1.$ sudo passwd root
2.$ su -
3.# vi /etc/sshd/sshd_config
4.# service sshd restart

42 PermitRootLogin yes

64 PasswordAuthentication yes
66 #PasswordAuthentication no

80 GSSAPIAuthentication no
81 #GSSAPIAuthentication yes

122 UseDNS no


解決 samba 錯誤訊息 "Unable to connect to CUPS server localhost" "failed to retrieve printer list: NT_STATUS_UNSUCCESSFUL"

在 Printing Options 裡面把印表機選項關閉、並且改成下面這樣
只有單純設成no還是不行的

load printers = no
cups options = raw
printing = bsd
printcap name = /dev/null

解決 centos yum 錯誤訊息 "http://mirror.centos.org/centos/6/SCL/x86_64/repodata/repomd.xml: [Errno 14] PYCURL ERROR 22 - "The requested URL returned error: 404 Not Found""

# yum remove centos-release-SCL
# yum install centos-release-scl


reference:https://www.pistolfly.com/weblog/2016/05/httpmirror-centos-orgcentos6sclx86_64repodatarepomd-xml-errno-14-pycurl-error-22-the-requested-url-returned-error-404-not-found.html

在 centos 6 下使用 nvm 安裝 node.js

nvm git 頁面 https://github.com/creationix/nvm

1.安裝 nvm
使用 curl
curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.31.0/install.sh | bash

或是 Wget:
wget -qO- https://raw.githubusercontent.com/creationix/nvm/v0.31.0/install.sh | bash

2.重新登入系統

3.使用方式
安裝最新穩定版本
#nvm install stable
安裝某版本
#nvm install 5.10
#nvm install 4.4
使用某版本
#nvm use 5.10
#nvm use 4.4
列出安裝版本
#nvm ls
移除某版本
#nvm uninstall 5.10
#nvm uninstall 4.4

在 AWS EC2 上架 pptp VPN 伺服器

系統為 centos 6.7 x86_64

1.
#yum -y install ppp iptables
#rpm -ivh http://poptop.sourceforge.net/yum/stable/packages/pptpd-1.4.0-1.el6.x86_64.rpm

2.vi /etc/ppp/options.pptpd
name pptpd
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
proxyarp
lock
nobsdcomp
novj
novjccomp
nologfd
ms-dns 8.8.8.8
ms-dns 8.8.4.4

3.vi /etc/ppp/chap-secrets
#(帳號) pptpd (密碼) *
ok1234 pptpd pwss1234 *

4.vi /etc/pptpd.conf
option /etc/ppp/options.pptpd
localip 192.168.1.254 (伺服器IP)
remoteip 192.168.1.10-20 (要配發給client端的IP)
設定檔中的 logwtmp 這行要註解掉、否則無法連線

5.vi ipt.sh 簡單的防火牆規則
#!/bin/bash
EXTIF="eth0"
INIF=""
INNET="192.168.1.0/24"
export EXTIF INIF INNET

echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
for i in /proc/sys/net/ipv4/conf/*/{rp_filter,log_martians}; do
echo "1" > $i
done
for i in /proc/sys/net/ipv4/conf/*/{accept_source_route,accept_redirects,\
send_redirects}; do
echo "0" > $i
done

#清除各個 chain 的規則、並且設定初始值
PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/sbin:/usr/local/bin; export PATH
iptables -F
iptables -X
iptables -Z
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 1723 -j ACCEPT
iptables -A INPUT -p gre -j ACCEPT

# 2. clean NAT table's rule
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT

# 3. NAT server's settings
echo "1" > /proc/sys/net/ipv4/ip_forward

#增加 iptables 轉發規則
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE

6.執行 ip.sh

7.啟動 pptp
#service pptpd start

yum 讀取不到系統版本

[root@SRV54 yum.repos.d]# yum install libnuma* glibc*
Loaded plugins: fastestmirror, security
Loading mirror speeds from cached hostfile
YumRepo Error: All mirror URLs are not using ftp, http[s] or file.
Eg. $releasever is not a valid and current release or hasnt been released yet/
removing mirrorlist with no valid mirrors: /var/cache/yum/i386/$releasever/base/mirrorlist.txt
Error: Cannot find a valid baseurl for repo: base

google 解決方法大部分都是因為無法解析網址、需要修改 /ect/resolv.conf
但是這邊是無法取得正確的 $releasever 變數
因此手動將 /etc/yum.repos.d/CentOS-Base.repo 裡面的 $releasever 改成 6 就好了（我的版本是6.5）

●vi /etc/yum.repos.d/CentOS-Base.repo
:%s/$releasever/6/g

參考文章：YumRepo Error: All mirror URLs are not using 問題解決

reverse 主機用的簡易 iptables

● ipfish.sh
#!/bin/bash
EXTIF="eth0"
INIF=""
INNET=""
export EXTIF INIF INNET

echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
for i in /proc/sys/net/ipv4/conf/*/{rp_filter,log_martians}; do
echo "1" > $i
done
for i in /proc/sys/net/ipv4/conf/*/{accept_source_route,accept_redirects,\
send_redirects}; do
echo "0" > $i
done

#清除各個 chain 的規則、並且設定初始值
PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/sbin:/usr/local/bin; export PATH
iptables -F
iptables -X
iptables -Z
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

#新增 chain work 和 pig
#work 為欲放行之IP
#pig 為欲阻擋的IP
iptables -N work
iptables -N pig

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

#進來的封包先通過 chain work 和 pig
iptables -A INPUT -j work
iptables -A INPUT -j pig

#新增 chain deny
#進來的封包一律記錄到log中、並且丟棄
iptables -N deny
iptables -A deny -j LOG --log-prefix "ipt pig : " --log-level 6
iptables -A deny -j DROP

sh /root/ipt/ipt.work
sh /root/ipt/ipt.deny

#HTTP並發數超過30的連線套用 chain deny 的規則
iptables -A INPUT -p tcp --dport 80 -m connlimit --connlimit-above 30 -j deny

#放行 80 和 443 port
iptables -A INPUT -p TCP --dport 80 -j ACCEPT
iptables -A INPUT -p TCP --dport 443 -j ACCEPT


● ipt.work
iptables -A work -s x.x.x.x/32 -j ACCEPT #要放行的 IP

● ipt.deny
iptables -A pig -s x.x.x.x/32 -j DROP #要拒絕的 IP


● log 設定
centos 6.3 後版本
/etc/rsyslog.d/ipt.conf
:msg,contains,"ipt pig : " /var/log/ipt.log
& ~
service rsyslog restart

● centos 6.3之前版本
/etc/syslog.conf
kern.=6 /var/log/ipt.log
service syslog restart