Generating Apache SSL Self-Signed Certificate
Thu, 07/26/2007 - 21:59 — sandip# openssl req -x509 -newkey rsa:1024 -keyout /etc/httpd/conf/ssl.key/server .key -out /etc/httpd/conf/ssl.crt/server .crt -days 9999 -nodes
# chown root:root /etc/httpd/conf/ssl.key/server .key
# chmod 400 /etc/httpd/conf/ssl.key/server .key
lftp with TLS/SSL
Tue, 07/24/2007 - 22:52 — sandiplftp ftp client support tls/ssl so why not use a secure connection for ftp.
$ lftp
lftp :~> set ftp:ssl-force true
lftp :~> connect ftp.domain.tld
lftp ftp.domain.tld:~> login <username>
Insist on your host to serve up ftp with tls/ssl support so all data is secured.
If using proftpd server, tls/ssl can be configured via "/etc/proftpd.conf":
<IfModule mod_tls.c>
TLSEngine on
TLSLog /var/log/proftpd/tls.log
TLSProtocol TLSv1
# Are clients required to use FTP over TLS when talking to this server?
TLSRequired off
# Server's certificate
TLSRSACertificateFile /etc/pki/tls/proftpd/server.ce rt.pem
TLSRSACertificateKeyFile /etc/pki/tls/proftpd/server.ke y.pem
# CA the server trusts
#TLSCACertificateFile /etc/pki/tls/proftpd/root.cert .pem
# Authenticate clients that want to use FTP over TLS?
TLSVerifyClient off
# Allow SSL/TLS renegotiations when the client requests them, but
# do not force the renegotations. Some clients do not support
# SSL/TLS renegotiations; when mod_tls forces a renegotiation, these
# clients will close the data connection, or there will be a timeout
# on an idle data connection.
TLSRenegotiate required off
</IfModule>
The certificate can be generated to be used on the ftp server via:
# cd /etc/pki/tls/proftpd/
# openssl req -new -x509 -days 3650 -nodes -out server.cert.pem -keyout server.key.pem
Reference:
logging php errors on godaddy hosting
Fri, 07/20/2007 - 12:41 — sandipGodaddys' linux hosting allows for editing your own "php.ini" file and enables support for logging errors, good for debugging purposes when developing with php.
Add the below lines to php.ini in the document root, to log all errors:
error_reporting = E_ALL
log_errors = on
error_log = /home/content/p/a/t/pathto/htm l/error_log
You should also protect the php.ini and error_log file via .htaccess:
<FilesMatch "(error_log|php\.ini)$&qu ot;>
Order deny,allow
Deny from all
</FilesMatch>
Flushing iptables rules
Thu, 07/19/2007 - 11:17 — sandipIf you need to flush your firewall iptables rules, do not do a direct `iptables --flush` from a remote machine if the default policy is set to DROP packets, you will lock yourself out.
Run the below script instead:
#!/bin/bash
# flushIptables.sh
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -F
or set the default policy to ACCEPT before flushing.
To find the default policy:
# iptables -L -n | grep policy
tar with Extended Attributes/xattrs support in RedHat 5
Mon, 07/16/2007 - 08:45 — sandipIf using earlier versions, use "star" to backup and restore files with extended attributes. SELinux and ACLs use these Extended Attributes to store the security contexts and access control lists respectively.
Tar has now been rebuilt in RedHat 5 and added support for Extended Attributes.
--selinux Archive the SELinux attributes of the files and directories --acls Archive the ACL attributes of files and directories --xattrs Archive all Extended Attributes of files and directories. This includes both SELinux and ACL attributes, as well as any other xattr.
Finding setuid and setgid files
Sun, 07/08/2007 - 19:46 — sandipsetuid files when executed inherit the permissions of the owner of the file. So having files with setuid of root is a bad idea.
Here's how to find it and unset it.
Note:
There are some system files like at and crontab that have these bits set and is required for it to run.
# find / -perm +6000 -type f -exec ls -ld {}\; > setuid.txt &
To unset it:
# chmod a-s <file>
Build PHP with Freetype on DirectAdmin
Mon, 07/02/2007 - 11:04 — sandipEasy way to add freetype support on PHP, on a DirectAdmin hosting environment with Fedora as the OS, is to use the rpm versions of freetype and freetype-devel.
-
If not installed already:
# yum install freetype freetype-devel
Edit "/usr/local/directadmin/custom
--with-freetype \
&nbs p; --with-freetype-dir=/usr/lib \
&nbs p; --enable-gd-native-ttf \
Note: /usr/lib is the path to the libttf.so .
# rpm -ql freetype-devel | grep libttf.so
Then run the build:
# ./build clean
# ./build php n
If you need to build and update existing packages:
# ./build clean
# ./build update
# ./build all
Check with phpinfo to confirm.
bash code snippets
Thu, 06/28/2007 - 16:16 — sandipThis is going to be a collection of bash code snippets:
-
Check if the user running the script is root:
# make sure we're running as root
if [ `id -u` != 0 ]; then { echo "Sorry, must be root. Exiting..."; exit; } fi
if (( $? )); then
&nbs p; {
&nbs p; &nbs p; &nbs p; echo "could not executed successfully";
&nbs p; &nbs p; &nbs p; exit;
&nbs p; }
fi;
# Check for proper number of command line args.
EXPECTED_ARGS=1
E_BADARGS=65
if [ $# -ne $EXPECTED_ARGS ]
then
echo "Usage: `basename $0` {arg}"
exit $E_BADARGS
fi
VALUES=("value1" "value2" "value3" "..." "valueN")
for ((i=0; i<${#VALUES[@]}; i++))
do
echo ${VALUES[$i]}
done
`yum update kernel` without removing old kernels
Mon, 06/18/2007 - 13:22 — sandipEdit "/etc/yum/pluginconf.d/install
[main]
enabled=1
# this sets the number of package versions which are kept
tokeep=2
Simple serach friendly url rewrite rules
Fri, 06/15/2007 - 10:36 — sandipScenario:
Example:
http://somesite.com/mydir/a
http://somesite.com/mydir/b
http://somesite.com/mydir/c
etc...
To be rewritten as:
http://somesite.com/mydir/vie
http://somesite.com/mydir/vie
http://somesite.com/mydir/vie
etc...
Except:
http://somesite.com/mydir rewrite--> /mydir/home.html
http://somesite.com/mydir/hom
http://somesite.com/mydir/abo
Solution:
These rules should go in an .htaccess file in the "mydir" directory:
DirectoryIndex home.html
Options +FollowSymLinks
RewriteEngine on
RewriteBase /mydir/
RewriteCond %{REQUEST_URI} ^/mydir/(home|about)$
RewriteRule ^.*$ %1.html [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ view.php?p=$1 [L]