SSH到MARS后执行sslcert可重新产生ssl证书,CN必须输入MARS的域名或者IP,其它的都无所谓,这样再访问MARS的时候将证书安装到“受信任的根证书颁发机构”中,则以后访问MARS的时候就不会出现安全警告了。这样的证书是自签名的,如果想用其它CA来签名证书的话,估计只能用其它系统挂载MARS硬盘去修改/opt/janus/jboss/bin/ssl/的文件了。
分类: IT
Cisco MARS 推荐使用命令行方式升级
当前Cisco MARS版本为6.0.6.3368,通过Web界面上传csmars-6.0.7.3404.zip升级失败,升级日志中错误一会是“Upgrade package acquisition error.”,一会是“Failed to pass the version dependency test.”,根本不知道到底什么错误。
SSH登陆到MARS后,使用命令行pnupgrade ftp://192.168.1.2/csmars-6.0.7.3404.zip升级,报错则很清晰了:
[Error][check_dependency/547]: minimal allowed version(6.0.6.3368.35) > current version(6.0.6.3368.34).
最后的那个小版本号Cisco的网站上根本不标注的。从Cisco下载最新的 csmars-6.0.6.3368.zip再用pnupgrade ftp://192.168.1.2/csmars-6.0.6.3368.zip升级成功,看到输出信息真是无语啊!csmars-6.0.6.3368.zip更新了Cisco也不说明。
Upgrade………………[MARS]
From……………..[6.0.6.3368.34]
To……………….[6.0.6.3368.35]
……
Current Version……….[6.0.6.3368.34]
Package Version……….[6.0.6.3368.35]
IBM DS3000 单控制器写入缓存问题
IBM DS3000 系列磁盘阵列,在使用单控制器且刷的单控NVSRAM的情况下仍然会出现写入缓存失效的问题。查看Logical Drives配置如下:
Read cache: Enabled
Write cache: Enabled (currently suspended)
Write cache without batteries: Disabled
Write cache with mirroring: Enabled (currently suspended)
Flush write cache after (in seconds): 10.00
Dynamic cache read prefetch: Enabled
在双控制器的情况下,为了在一个控制器失效时不丢失数据,两个控制器的写缓存需互为镜像,防止丢失写缓存内容。但是在单控制器的情况下,显然是不需要写缓存镜像的,但是控制器却由于无法完成写缓存镜像因此暂停了写缓存,这会导致性能的巨大损失。使用命令“set allLogicalDrives mirrorEnabled=false;”可禁止写缓存镜像,运行后查看Logical Drives配置如下:
Read cache: Enabled
Write cache: Enabled
Write cache without batteries: Disabled
Write cache with mirroring: Disabled
Flush write cache after (in seconds): 10.00
Dynamic cache read prefetch: Enabled
ProFTPD 1.3.2升级到1.3.3后mod_ifsession mod_tls 的两点改变
mod_ifsession:Directory不能放在If…里面
1.3.2时
<IfUser yaoge>
MaxHostsPerUser 1
MaxClientsPerUser 3
<Directory /ftp>
<Limit DIRS READ WRITE>
AllowAll
</Limit>
</Directory>
</IfUser>
1.3.3需改为
<IfUser yaoge>
MaxHostsPerUser 1
MaxClientsPerUser 3
</IfUser>
<Directory /ftp>
<Limit DIRS READ WRITE>
AllowUser OR yaoge
</Limit>
</Directory>
mod_tls:需添加 TLSOptions NoSessionReuseRequired
一个比较复杂的ProFTPD配置
ProFTPD 1.3.2e的配置文件,1.3.3版本则需要进行一些修改,
ServerName “yaoge123 FTP Server”
ServerType standalone
DefaultServer on
ScoreboardFile /var/run/proftpd/proftpd.scoreboard
Port 21
UseIPv6 on
Umask 022
MaxInstances 100
MaxConnectionsPerHost 10
CommandBufferSize 512
UseReverseDNS off
IdentLookups off
ServerIdent on “Welcome to yaoge123 FTP Server”
User nobody
Group nogroup
DefaultRoot ~
AllowOverwrite off
requirevalidshell off
AllowForeignAddress on
AllowRetrieveRestart on
DirFakeUser on yaoge123
DirFakeGroup on yaoge123
DirFakeMode 0000
TimeoutLogin 30
TimeoutIdle 300
SystemLog /var/log/proftpd.log
TransferLog /var/log/xferlog
WtmpLog on
AdminControlsEngine on
AdminControlsACLs all allow user root
BanEngine on
BanControlsACLs all allow user root
BanOnEvent ClientConnectRate 10/00:01:00 01:00:00 “Stop connecting frequently”
BanTable /var/run/proftpd/ban.tab
BanLog /var/log/proftpd-ban.log
BanMessage “%a OR %u has been banned”
#AuthOrder mod_auth_file.c mod_sql.c mod_auth_unix.c
#AuthUserFile /usr/local/etc/proftpd/ftpd.passwd
#AuthGroupFile /usr/local/etc/proftpd/ftpd.group
AuthOrder mod_sql.c
SQLAuthenticate users
SQLAuthTypes crypt plaintext
SQLConnectInfo proftpd@localhost username password
SQLUserInfo users user password userid usergroupid homedir NULL
SQLLogFile /var/log/proftpd-sql.log
SQLLog PASS counter
SQLNamedQuery counter UPDATE “lastloginip=’%a’, lastlogin=now(), logincount=logincount+1 WHERE user=’%u'” users
SQLLog EXIT time_logout
SQLNamedQuery time_logout UPDATE “lastlogout=now() WHERE user=’%u'” users
SQLLog RETR,ERR_RETR download
SQLNamedQuery download UPDATE “downloadbytes=downloadbytes+%b, downloadfiles=downloadfiles+1 WHERE user=’%u'” users
SQLLog STOR,ERR_STOR,APPE,ERR_APPE,STOU,ERR_STOU upload
SQLNamedQuery upload UPDATE “uploadbytes=uploadbytes+%b, uploadfiles=uploadfiles+1 WHERE user=’%u'” users
SQLNamedQuery logincount SELECT “logincount from users where user=’%u'”
SQLNamedQuery lastlogin SELECT “lastlogin from users where user=’%u'”
SQLNamedQuery lastloginip SELECT “lastloginip from users where user=’%u'”
SQLNamedQuery downloadbytes SELECT “ROUND(downloadbytes/1048576) from users where user=’%u'”
SQLNamedQuery downloadfiles SELECT “downloadfiles from users where user=’%u'”
SQLNamedQuery uploadbytes SELECT “ROUND(uploadbytes/1048576) from users where user=’%u'”
SQLNamedQuery uploadfiles SELECT “uploadfiles from users where user=’%u'”
SQLShowInfo PASS “230” “You’ve logged on %{logincount} times”
SQLShowInfo PASS “230” “*** Last login at %{lastlogin}”
SQLShowInfo PASS “230” “*** Last login from %{lastloginip}”
SQLShowInfo PASS “230” “*** Downloaded %{downloadbytes} MB in %{downloadfiles} files”
SQLShowInfo PASS “230” “*** Uploaded %{uploadbytes} MB in %{uploadfiles} files”
<Limit SITE_CHMOD>
DenyAll
</Limit>
<Directory />
<Limit ALL>
DenyAll
</Limit>
<Limit PROT>
AllowAll
</Limit>
</Directory>
TLSEngine on
TLSLog /var/log/proftpd-tls.log
TLSProtocol SSLv23
TLSRSACertificateFile /usr/local/etc/proftpd/ftpd.cert.pem
TLSRSACertificateKeyFile /usr/local/etc/proftpd/ftpd.key.pem
TLSCACertificateFile /usr/local/etc/proftpd/ftpdca.cert.pem
TLSVerifyClient off
TLSRenegotiate required off
<Anonymous /ftp/anonymous>
User anonymous
Group anonymous
UserAlias guest anonymous
MaxClients 10
MaxClientsPerHost 1
TransferRate RETR 512
<Limit LOGIN>
Allow from 172.16.,172.20,172.21
DenyAll
</Limit>
<Limit ALL>
DenyAll
</Limit>
<Limit FEAT DIRS READ>
AllowAll
</Limit>
</Anonymous>
<IfUser OR friend1,friend2>
<Directory /ftp/friend>
<Limit FEAT DIRS READ>
AllowAll
</Limit>
</Directory>
</IfUser>
<IfUser regex @yaoge123$>
DisplayLogin .welcome.msg
MaxHostsPerUser 1
MaxClientsPerUser 3
<Directory /ftp/yaoge123>
HideFiles ^\.
<Limit FEAT DIRS READ>
AllowAll
</Limit>
</Directory>
</IfUser>
sql中的表
CREATE TABLE `users` (
`user` varchar(50) NOT NULL default ”,
`password` varchar(50) NOT NULL default ”,
`username` varchar(50) NOT NULL default ”,
`userid` int(10) unsigned NOT NULL default ‘10000’,
`usergroupid` int(10) unsigned NOT NULL default ‘10000’,
`lastloginip` varchar(22) NOT NULL default ”,
`logincount` int(16) unsigned NOT NULL default ‘0’,
`lastlogin` datetime NOT NULL default ‘0000-00-00 00:00:00’,
`lastlogout` datetime NOT NULL default ‘0000-00-00 00:00:00’,
`downloadbytes` bigint unsigned NOT NULL default ‘0’,
`downloadfiles` int unsigned NOT NULL default ‘0’,
`uploadbytes` bigint unsigned NOT NULL default ‘0’,
`uploadfiles` int unsigned NOT NULL default ‘0’,
`homedir` varchar(50) NOT NULL default ”,
`mark` varchar(10) NOT NULL default ”,
PRIMARY KEY (`userid`)
) ;
配置ProFTPD加密SSL
下载脚本 http://www.castaglia.org/openssl/contrib/cert-tool ,修改cert-tool中openssl的路径,用这个脚本调用OpenSSL自签名颁发一个证书
cert-tool --create-ca=serverca --signing-ca=self
cert-tool --create-cert=server --signing-ca=serverca.cert.pem --signing-key=serverca.key.pem
修改proftpd.conf,增加TLS配置
TLSEngine on #开启TLS
TLSLog /var/log/proftpd-tls.log #TLS日志
TLSProtocol SSLv23 #允许使用SSLv3和TLSv1
TLSRSACertificateFile /usr/local/etc/server.cert.pem #cert-tool生成的证书
TLSRSACertificateKeyFile /usr/local/etc/server.key.pem #cert-tool生成的key
TLSCACertificateFile /usr/local/etc/serverca.cert.pem #cert-tool生成的CA证书
TLSVerifyClient off #不验证客户端证书。如要启用客户端证书验证,则需要用TLSCACertificateFile这个CA来颁发客户端证书
TLSRenegotiate required off #不强制要求重协商
另外加密传输需要使用FTP命令PROT,如果Deny ALL过,需要Allow
解决 FreeBSD SSH 乱码
编辑 /etc/login.conf 增加一个language
enutf8|enutf8 Users Accounts:\
:charset=UTF-8:\
:lang=en_US.UTF-8:\
:tc=default:
vipw 编辑ssh登录的用户,在gid后面增加这个language
yaoge123:$1$***:1001:1001:enutf8:0:0:User &:/home/yaoge123:/bin/sh
Apache和ProFTPD的Order区别
Order Allow,Deny | Apache | ProFTPD |
仅匹配Allow | Allow | Allow |
仅匹配Deny | Deny | Deny |
没有匹配 | 默认Deny | 默认Allow |
匹配Allow和Deny | 最后匹配Deny | 首先匹配Allow |
Order Deny,Allow | Apache | ProFTPD |
仅匹配Allow | Allow | Allow |
仅匹配Deny | Deny | Deny |
没有匹配 | 默认Allow | 默认Deny |
匹配Allow和Deny | 最后匹配Allow | 首先匹配Deny |
参考:
http://httpd.apache.org/docs/1.3/mod/mod_access.html
http://www.proftpd.org/docs/directives/linked/config_ref_Order.html
http://www.proftpd.org/docs/howto/Limit.html
FreeBSD Tomcat 安装后注意事项
编辑 /usr/local/etc/rc.d/tomcat6
在java_command=中增加如下内容禁用IPv6
-Djava.net.preferIPv4Stack="true" \
-Djava.net.preferIPv4Address="true" \
相关版本信息:
Apache/2.2.14 (FreeBSD) mod_ssl/2.2.14 OpenSSL/0.9.8k DAV/2 PHP/5.2.12 with Suhosin-Patch mod_jk/1.2.30
javavmwrapper-2.3.4
diablo-jdk-1.6.0.07.02_8
jdk-1.6.0.3p4_14
tomcat-6.0.24
tomcat-native-1.1.20
mod_jk-ap2-1.2.30_1
SolarWinds Orion NPM 9.5 出现 Polling Engine Down
服务器启动完毕后,所有 SolarWinds 相关服务 Running ,但是NPM不记录数据,通过Web查看 Admin 中的 Polling Engines,Engine Status 为 Polling Engine Down。临时解决办法是:打开Orion Service Manager 点击 Shutdown Everything 停止所有 SolarWinds 相关服务,杀掉 NetPerfMonService.exe 进程,打开Orion Service Manager 点击 Start Everything 重新启动所有 SolarWinds 相关服务。