sandip's blog

Generating Apache SSL Self-Signed Certificate

# openssl req -x509 -newkey rsa:1024 -keyout /etc/httpd/conf/ssl.key/server.key -out /etc/httpd/conf/ssl.crt/server.crt -days 9999 -nodes
# chown root:root /etc/httpd/conf/ssl.key/server.key
# chmod 400 /etc/httpd/conf/ssl.key/server.key

lftp with TLS/SSL

lftp ftp client support tls/ssl so why not use a secure connection for ftp.

$ lftp
lftp :~> set ftp:ssl-force true
lftp :~> connect ftp.domain.tld
lftp ftp.domain.tld:~> login <username>

Insist on your host to serve up ftp with tls/ssl support so all data is secured.

If using proftpd server, tls/ssl can be configured via "/etc/proftpd.conf":

<IfModule mod_tls.c>
    TLSEngine on
    TLSLog /var/log/proftpd/tls.log
    TLSProtocol TLSv1

    # Are clients required to use FTP over TLS when talking to this server?
    TLSRequired off

    # Server's certificate
    TLSRSACertificateFile /etc/pki/tls/proftpd/server.cert.pem
    TLSRSACertificateKeyFile /etc/pki/tls/proftpd/server.key.pem

    # CA the server trusts
    #TLSCACertificateFile /etc/pki/tls/proftpd/root.cert.pem

    # Authenticate clients that want to use FTP over TLS?
    TLSVerifyClient off

    # Allow SSL/TLS renegotiations when the client requests them, but
    # do not force the renegotations.  Some clients do not support
    # SSL/TLS renegotiations; when mod_tls forces a renegotiation, these
    # clients will close the data connection, or there will be a timeout
    # on an idle data connection.
    TLSRenegotiate required off

</IfModule>

The certificate can be generated to be used on the ftp server via:

# cd /etc/pki/tls/proftpd/
# openssl req -new -x509 -days 3650 -nodes -out server.cert.pem -keyout server.key.pem

Reference:

logging php errors on godaddy hosting

Godaddys' linux hosting allows for editing your own "php.ini" file and enables support for logging errors, good for debugging purposes when developing with php.

Add the below lines to php.ini in the document root, to log all errors:

error_reporting  =  E_ALL
log_errors = on
error_log = /home/content/p/a/t/pathto/html/error_log

You should also protect the php.ini and error_log file via .htaccess:

<FilesMatch "(error_log|php\.ini)$&quot;>
  Order deny,allow
  Deny from all
</FilesMatch>

Flushing iptables rules

If you need to flush your firewall iptables rules, do not do a direct `iptables --flush` from a remote machine if the default policy is set to DROP packets, you will lock yourself out.

Run the below script instead:

#!/bin/bash
# flushIptables.sh
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -F

or set the default policy to ACCEPT before flushing.

To find the default policy:

# iptables -L -n | grep policy

tar with Extended Attributes/xattrs support in RedHat 5

If using earlier versions, use "star" to backup and restore files with extended attributes. SELinux and ACLs use these Extended Attributes to store the security contexts and access control lists respectively.

Tar has now been rebuilt in RedHat 5 and added support for Extended Attributes.

--selinux Archive the SELinux attributes of the files and directories
--acls Archive the ACL attributes of files and directories
--xattrs Archive all Extended Attributes of files and directories.
This includes both SELinux and ACL attributes, as well as any other xattr.

Finding setuid and setgid files

setuid files when executed inherit the permissions of the owner of the file. So having files with setuid of root is a bad idea.

Here's how to find it and unset it.

Note:
There are some system files like at and crontab that have these bits set and is required for it to run.

# find / -perm +6000 -type f -exec ls -ld {}\; > setuid.txt &

To unset it:

# chmod a-s <file>

Build PHP with Freetype on DirectAdmin

Easy way to add freetype support on PHP, on a DirectAdmin hosting environment with Fedora as the OS, is to use the rpm versions of freetype and freetype-devel.

  1. If not installed already:
    # yum install freetype freetype-devel

  2. Edit "/usr/local/directadmin/customapache/configure.php" to include the below lines.
            --with-freetype \
        &nbsp;   --with-freetype-dir=/usr/lib \
        &nbsp;   --enable-gd-native-ttf \

    Note: /usr/lib is the path to the libttf.so .
    # rpm -ql freetype-devel | grep libttf.so

  3. Then run the build:
    # ./build clean
    # ./build php n

  4. If you need to build and update existing packages:
    # ./build clean
    # ./build update
    # ./build all

  5. Check with phpinfo to confirm.

bash code snippets

This is going to be a collection of bash code snippets:

  1. Check if the user running the script is root:
    # make sure we're running as root
    if [ `id -u` != 0 ]; then { echo "Sorry, must be root.  Exiting..."; exit; } fi
  2. Check the successful execution of previous command:
    if (( $? )); then
        &nbsp;   {
        &nbsp;    &nbsp;    &nbsp; echo "could not executed successfully";
        &nbsp;    &nbsp;    &nbsp; exit;
        &nbsp;   }
    fi;
  3. Check number of arguments:
    # Check for proper number of command line args.

    EXPECTED_ARGS=1
    E_BADARGS=65

    if [ $# -ne $EXPECTED_ARGS ]
    then
      echo "Usage: `basename $0` {arg}"
      exit $E_BADARGS
    fi
  4. Array loops:
    VALUES=("value1" "value2" "value3" "..." "valueN")

    for ((i=0; i<${#VALUES[@]}; i++))
    do
      echo ${VALUES[$i]}
    done

`yum update kernel` without removing old kernels

Edit "/etc/yum/pluginconf.d/installonlyn.conf" and change the enabled to "0" or increase the "tokeep" value to the number of versions you want to keep.

[main]
enabled=1
# this sets the number of package versions which are kept
tokeep=2

Simple serach friendly url rewrite rules

Scenario:

Example:
http://somesite.com/mydir/a
http://somesite.com/mydir/b
http://somesite.com/mydir/c
etc...

To be rewritten as:
http://somesite.com/mydir/view.php?p=a
http://somesite.com/mydir/view.php?p=b
http://somesite.com/mydir/view.php?p=c
etc...

Except:
http://somesite.com/mydir rewrite--> /mydir/home.html
http://somesite.com/mydir/home rewrite-> /mydir/home.html
http://somesite.com/mydir/about rewrite-> /mydir/about.html

Solution:

These rules should go in an .htaccess file in the "mydir" directory:

DirectoryIndex home.html
Options +FollowSymLinks
RewriteEngine on
RewriteBase /mydir/
RewriteCond %{REQUEST_URI} ^/mydir/(home|about)$
RewriteRule ^.*$ %1.html [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ view.php?p=$1 [L]

Comment