perso/huhuhu_config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mv stuff from tuto computer to tuto server

Browse Source
This commit is contained in:
asus
2024-06-12 15:30:20 +02:00
parent 22d3378d2a
commit c1752dfe4c
2 changed files with 116 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files

114
tutos/computer.txt
View File

@@ -297,118 +297,4 @@ find | sort | grep -ve "node_modules/" -e ".git/" | sed 's#[^/]*/#|__ #g;s#__ |#
- re-add code to move cursor on wrap text in vimrc - re-add code to move cursor on wrap text in vimrc
- add vimrc, zshrc, and screenrc in default screen windows - add vimrc, zshrc, and screenrc in default screen windows
**ecowan server :**
- list user : **cat /etc/passwd**
- change users passwd :
- **sudo passwd <username>**
- first go on root with **su**
- then change default user passwd **passwd <username>**
- be carreful that if you made a mistake in the passwd you will not be abble to connect to the server again !
- so open a new terminal window without closing this one, and try to connect with new passwd
- and now you can change root passwd too
- install some packages :
- **su**
- **apt install sudo vim git wget curl htop**
- allow connection with ssh key :
- runn this in local : **ssh-copy-id username@server_ip**
- then change ssh configuration file `/etc/ssh/sshd_config` :
- set **PubkeyAuthentication yes** to allow public key authentication
- set **PasswordAuthentication no** to disable password-based authentication
- set **ChallengeResponseAuthentication no** to disable any keyboard-interactive authentication
- restart ssh with **sudo service ssh restart**
- add user to the sudo group so it can use sudo :
- **sudo usermod -aG sudo <username>**
- then restart the ssh session by exiting ang logging again
- did not add it to the sudoers file (`visudo` then add line `huho ALL=(ALL) ALL`)
- fixed **perl: warning: Setting locale failed** :
- https://stackoverflow.com/questions/2499794/how-to-fix-a-locale-setting-warning-from-perl
- **sudo locale-gen**
- **sudo dpkg-reconfigure locales**
- then choose with SPACE BAR en_US.UTF-8 and fr_FR.UTF-8
- changed debian10 to debian11 :
- https://forum.yunohost.org/t/install-yuno-on-debian-10-13-my-hoster-does-not-support-debian-11-bullseye/23147/2
- which debian : **lsb_release -a**
- run :
- **sudo apt update**
- **sudo apt upgrade**
- **sudo apt full-upgrade**
- then change /etc/apt/sources.list file :
- replace each instance of `stretch` with `buster`
- replace each instance of `buster/updates` with `bullseye-security`
- then again :
- **sudo apt update**
- **sudo apt upgrade**
- **sudo apt full-upgrade**
- **sudo systemctl reboot**
- **sudo apt autoremove**
- prevent loosing definitively ssh connection : https://www.reddit.com/r/servers/comments/17mtlxf/how_to_set_up_a_backup_connection_to_a_server_if/
- use IPMI to access server without ssh :
- need public ip address : **curl ifconfig.me**
- need install java : **default-jdk**
- need install javaws : **icedtea-netx**
- run viewer.jnlp(...) file with **ajaws file** or by double clicking
- need to change /etc/java-11-openjdk/security/java.security file by commenting SHA1 denyafter lines
- https://unix.stackexchange.com/questions/143805/running-unsigned-javaws-code
- not line 634 "SHA1 usage SignedJAR & denyAfter 2019-01-01, \"
- but line 700 "#SHA1 denyAfter 2019-01-01, \"
- create git project (having a local git project and beeing abble to push to a remote repo) :
- on remote :
- **mkdir my_project.git** ".git" is a convention for git "bare" repository
- **cd my_project.git**
- **git init --bare** : create a bare repository (it's a repo without any content, just the commits)
- **cd hooks** : navigate to the hook folder
- **touch post-receive** : create a post-receive file
- **chmod +x post-receive** : make it executable
- inside "post-receive" file :
- https://stackoverflow.com/questions/7351551/writing-a-git-post-receive-hook-to-deal-with-a-specific-branch#answer-13057643
- create a hook that will add a worktree, which is a folder with the content of the git repo :
#!/bin/bash
TARGET="/path/to/your/destination/folder"
GIT_DIR="/path/to/your/bare/git/repository"
git --work-tree=$TARGET --git-dir=$GIT_DIR checkout -f
- on local :
- **git remote add deploy ssh://user@host:1234/path/to/bare_repo.git** : https://stackoverflow.com/questions/3596260/git-remote-add-with-other-ssh-port#answer-3596272
- 1234 is the port, not needed if 22
- on remote, inside the bare.git folder, you can change the branches :
- **git branch -a** : show the branches
- **git --work-tree=/path/to/worktree checkout <name>** : change the branch on the worktree
- if the worktree is a website, it's now the new branch that is being showed
- disable user shell access with **sudo usermod --shell /sbin/nologin <username>**
- https://unix.stackexchange.com/questions/10852/whats-the-difference-between-sbin-nologin-and-bin-false#10867
- its possible to re-enable it with **sudo usermod --shell /bin/bash <userrname>**
- to see the shell of a user : **grep <username> /etc/passwd**
- auditd :
- added rule **sudo auditctl -w /home/huho -p r -k huho_folder_access**
- **sudo systemctl restart auditd**
- **sudo ausearch -i -f /home/huho**
- **sudo ausearch --start 18/10/2023 14:05 -i -f /home/huho**
- todo :
- monitoring software (Nagios, Zabbix, Prometheus)
- ids (intrusion detection system) (Snort, Suricata)
- siem (security information and event management) (Splunk, ELK Stack, Graylog)
- remote logging
- firewall
- **ipmi / idrac6 : connect to the server as if **
- connect to ipmi (enter the ip adress of the internet connection, not the one of the server)
- in the idrac interface, go to the console and click on 'launch virtual console'
-> it will download a viewer.jnlp file
- open this file with java :
- you can use a python script that does the jobs well
- the script can be found here : **https://gist.github.com/TheJJ/2394cd76d3e2c34d02e3da1bd3e489b2?ref=blockdev.io**
- I added it to this config folder
- or you can try to open this file with java (last time I didn't succeed)
- install java 8 (it might works better with idrac6) : **sudo apt-get install openjdk-8-jre**
- install javaws : **sudo apt install icedtea-netx**
- run **javaws viewer.jnlp(blablabla)**
- i also needed to change the security file otherwise it wouldn't open the files because 'jar are not signed' :
- either do it manually : in **/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security**, change lines:
- **jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024...** to remove 'md5'
- **jdk.jar.disabledAlgorithms=MD2, RSA keySize < 1024...**
- alternatively you can have a local override, see **https://gist.github.com/xbb/4fd651c2493ad9284dbcb827dc8886d6**
- this is a tutorial, it uses a local java engine (jre) just installed in the folder, and/or a local file to override the security settings
- also, if needed to modify the java control panel, open it with : **/usr/bin/itweb-settings**

118
tutos/server.md
View File

@@ -1,8 +1,122 @@
**ecowan server :**
- list user : **cat /etc/passwd**
- change users passwd :
- **sudo passwd <username>**
- first go on root with **su**
- then change default user passwd **passwd <username>**
- be carreful that if you made a mistake in the passwd you will not be abble to connect to the server again !
- so open a new terminal window without closing this one, and try to connect with new passwd
- and now you can change root passwd too
- install some packages :
- **su**
- **apt install sudo vim git wget curl htop**
- allow connection with ssh key :
- runn this in local : **ssh-copy-id username@server_ip**
- then change ssh configuration file `/etc/ssh/sshd_config` :
- set **PubkeyAuthentication yes** to allow public key authentication
- set **PasswordAuthentication no** to disable password-based authentication
- set **ChallengeResponseAuthentication no** to disable any keyboard-interactive authentication
- restart ssh with **sudo service ssh restart**
- add user to the sudo group so it can use sudo :
- **sudo usermod -aG sudo <username>**
- then restart the ssh session by exiting ang logging again
- did not add it to the sudoers file (`visudo` then add line `huho ALL=(ALL) ALL`)
- fixed **perl: warning: Setting locale failed** :
- https://stackoverflow.com/questions/2499794/how-to-fix-a-locale-setting-warning-from-perl
- **sudo locale-gen**
- **sudo dpkg-reconfigure locales**
- then choose with SPACE BAR en_US.UTF-8 and fr_FR.UTF-8
- changed debian10 to debian11 :
- https://forum.yunohost.org/t/install-yuno-on-debian-10-13-my-hoster-does-not-support-debian-11-bullseye/23147/2
- which debian : **lsb_release -a**
- run :
- **sudo apt update**
- **sudo apt upgrade**
- **sudo apt full-upgrade**
- then change /etc/apt/sources.list file :
- replace each instance of `stretch` with `buster`
- replace each instance of `buster/updates` with `bullseye-security`
- then again :
- **sudo apt update**
- **sudo apt upgrade**
- **sudo apt full-upgrade**
- **sudo systemctl reboot**
- **sudo apt autoremove**
- prevent loosing definitively ssh connection : https://www.reddit.com/r/servers/comments/17mtlxf/how_to_set_up_a_backup_connection_to_a_server_if/
- use IPMI to access server without ssh :
- need public ip address : **curl ifconfig.me**
- need install java : **default-jdk**
- need install javaws : **icedtea-netx**
- run viewer.jnlp(...) file with **ajaws file** or by double clicking
- need to change /etc/java-11-openjdk/security/java.security file by commenting SHA1 denyafter lines
- https://unix.stackexchange.com/questions/143805/running-unsigned-javaws-code
- not line 634 "SHA1 usage SignedJAR & denyAfter 2019-01-01, \"
- but line 700 "#SHA1 denyAfter 2019-01-01, \"
- create git project (having a local git project and beeing abble to push to a remote repo) :
- on remote :
- **mkdir my_project.git** ".git" is a convention for git "bare" repository
- **cd my_project.git**
- **git init --bare** : create a bare repository (it's a repo without any content, just the commits)
- **cd hooks** : navigate to the hook folder
- **touch post-receive** : create a post-receive file
- **chmod +x post-receive** : make it executable
- inside "post-receive" file :
- https://stackoverflow.com/questions/7351551/writing-a-git-post-receive-hook-to-deal-with-a-specific-branch#answer-13057643
- create a hook that will add a worktree, which is a folder with the content of the git repo :
#!/bin/bash
TARGET="/path/to/your/destination/folder"
GIT_DIR="/path/to/your/bare/git/repository"
git --work-tree=$TARGET --git-dir=$GIT_DIR checkout -f
- on local :
- **git remote add deploy ssh://user@host:1234/path/to/bare_repo.git** : https://stackoverflow.com/questions/3596260/git-remote-add-with-other-ssh-port#answer-3596272
- 1234 is the port, not needed if 22
- on remote, inside the bare.git folder, you can change the branches :
- **git branch -a** : show the branches
- **git --work-tree=/path/to/worktree checkout <name>** : change the branch on the worktree
- if the worktree is a website, it's now the new branch that is being showed
- disable user shell access with **sudo usermod --shell /sbin/nologin <username>**
- https://unix.stackexchange.com/questions/10852/whats-the-difference-between-sbin-nologin-and-bin-false#10867
- its possible to re-enable it with **sudo usermod --shell /bin/bash <userrname>**
- to see the shell of a user : **grep <username> /etc/passwd**
- auditd :
- added rule **sudo auditctl -w /home/huho -p r -k huho_folder_access**
- **sudo systemctl restart auditd**
- **sudo ausearch -i -f /home/huho**
- **sudo ausearch --start 18/10/2023 14:05 -i -f /home/huho**
- todo :
- monitoring software (Nagios, Zabbix, Prometheus)
- ids (intrusion detection system) (Snort, Suricata)
- siem (security information and event management) (Splunk, ELK Stack, Graylog)
- remote logging
- firewall
- **ipmi / idrac6 : connect to the server as if **
- connect to ipmi (enter the ip adress of the internet connection, not the one of the server)
- in the idrac interface, go to the console and click on 'launch virtual console'
-> it will download a viewer.jnlp file
- open this file with java :
- you can use a python script that does the jobs well
- the script can be found here : **https://gist.github.com/TheJJ/2394cd76d3e2c34d02e3da1bd3e489b2?ref=blockdev.io**
- I added it to this config folder
- or you can try to open this file with java (last time I didn't succeed)
- install java 8 (it might works better with idrac6) : **sudo apt-get install openjdk-8-jre**
- install javaws : **sudo apt install icedtea-netx**
- run **javaws viewer.jnlp(blablabla)**
- i also needed to change the security file otherwise it wouldn't open the files because 'jar are not signed' :
- either do it manually : in **/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security**, change lines:
- **jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024...** to remove 'md5'
- **jdk.jar.disabledAlgorithms=MD2, RSA keySize < 1024...**
- alternatively you can have a local override, see **https://gist.github.com/xbb/4fd651c2493ad9284dbcb827dc8886d6**
- this is a tutorial, it uses a local java engine (jre) just installed in the folder, and/or a local file to override the security settings
- also, if needed to modify the java control panel, open it with : **/usr/bin/itweb-settings**
------------------------------------------------------------------------------------
## how to secure a proxmox server : ## how to secure a proxmox server :
---
### 1. Update and Patch Regularly ### 1. Update and Patch Regularly
Ensure that both Debian and Proxmox are always up to date with the latest security patches and updates. Ensure that both Debian and Proxmox are always up to date with the latest security patches and updates.
```sh ```sh