Apache – Restrict/Block direct IP access

Under /etc/httpd/conf.d (RHEL based OS) create a new .conf file .Change the port and add SSL certificates and keys. All the request to IP will get a 403 Forbidden error and requests to sub.example.com will get severed from the directory /var/www/api.

Listen 9443

#All request to IP will be handled in this section
<VirtualHost _default_:9443>
SSLEngine on
SSLCertificateFile /etc/ssl/certs/apache-selfsigned.crt
SSLCertificateKeyFile /etc/ssl/certs/apache-selfsigned.key
DocumentRoot /var/www/def
Redirect 403 /
UseCanonicalName Off
UserDir disabled
</VirtualHost>


#Name based requests 
<VirtualHost *:9443>
    DocumentRoot /var/www/api
    ServerName sub.example.com
    ServerAdmin admin@example.com
    SSLEngine on
    SSLCertificateFile /etc/httpd/certs/cert.pem
    SSLCertificateKeyFile /etc/httpd/certs/key.pem

    <Directory /var/www/api>
        Options -Indexes +FollowSymLinks
        AllowOverride All
    </Directory>

   ErrorLog /var/log/httpd/sub.example.com-error.log
   CustomLog /var/log/httpd/sub.example.com-access.log combined
</VirtualHost>

Useful Commands

Create a self signed certificate and key using openssl

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout key.key -out cert.crt

Specify default python version in Ubuntu

Use the command “update-alternatives” . System will use the python version which has the higher value assigned.

In the below case the command “python” resolves python2.7 and python3 resolves to python3.8

# update-alternatives --install /usr/bin/python python /usr/bin/python2.7 1
update-alternatives: using /usr/bin/python2.7 to provide /usr/bin/python (python) in auto mode
# update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.5 2
update-alternatives: using /usr/bin/python3.5 to provide /usr/bin/python3 (python3) in auto mode
# update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.8 3
update-alternatives: using /usr/bin/python3.8 to provide /usr/bin/python3 (python3) in auto mode

certbot – Create SSL / HTTPS certificate with DNS challenge

certbot -d sub.maindomain.com –manual –preferred-challenges dns certonly

PostFix disable SMTP Connections From Outside

Edit /etc/postfix/master.cf

Change the line

smtp inet n - - - - smtpd

to

127.0.0.1:smtp inet n - - - - smtpd

FTP Backup Script

#!/bin/sh
DATE=`date +%Y%m%d`
mkdir /tmp/backup
mysqldump -u root -pmypass --all-databases > /tmp/backup/alldb.sql
tar -cvzf /tmp/backup/www.tar.gz /var/www --exclude="www/backup"
tar -cvzf /tmp/backup/etc.tar.gz /etc

tar -cvf /tmp/$DATE-backup.tar /tmp/backup

ftp -n -i 10.8.0.1 <<EOF
quote USER user1
quote PASS password1
cd pbxbackup
lcd /tmp
put $DATE-backup.tar
quit
EOF

#rm -f /tmp/backup.tar
rm -rf /tmp/backup

Show hide My Computer

desk.cpl ,,5

Add motd : Ubuntu

echo -en "\033[1;33m" > /etc/motd
echo " Put your comments here.." >> /etc/motd
echo -en "\033[0m" >> /etc/motd

Esacpe from Ubuntu apt-get Error

sudo sed -i -re 's/([a-z]{2}\.)?archive.ubuntu.com|security.ubuntu.com/old-releases.ubuntu.com/g' /etc/apt/sources.list
sudo apt-get update 

Add XP to Windows 2012 R2 Domain

Open Regedit.exe in Domain Server
Navigate to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\DependOnService

Original Value: SamSS Srv2

Change to: SamSS Srv
After changing the value, restart “Server Service” on DC

Add the XP client again to Domain.

Active Directory Import Contacts

csvde -i -f contacts.csv

DN objectClass givenName telephoneNumber
CN=Shyju Kan, OU=Contacts,DC=company,DC=local contact Shyju 6511933

The CSV contents will be imported to Active Directory under OU Contacts

Excel Extract Text

=RIGHT(F2,LEN(F2)-FIND(“=”,F2))

Find and replace word in text files in a directory

sed -i -- 's/dir.cfg/dir.cfg, 000000000000-license.cfg/g' *

It searches for  the text “dir.cfg” and replaces it with “dir.cfg, 000000000000-license.cfg” in current directory.

Remove comments from a file

grep -vE ‘^#|^;|^$’ /etc/openvpn/server.conf >/root/test.conf

IPtables Enable Port 80

Edit the file  /etc/sysconfig/iptables

add the below line

 -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

Recover USB Drive

Recover USB Drive

chkdsk E: /F /R

Where is E: is the USB drive

Restore Putty  Profile

regedit /e “%userprofile%\desktop\putty-registry.reg” HKEY_CURRENT_USER\Software\Simontatham

Find Directory size in GB : Linux

du -h / | grep ^[0-9.]*G

How add AD users as RDP Users

Add a user group fro remote desktop access and add it to “Remote Desktop Users”. Then goto Group Policy Editor (gpedit.msc) and add this group to “Allow logon through remote desktop services” policy.

RDP_Group Enable_RDP

Install Telnet on Windows 7/8

pkgmgr /iu:"Telnet Client"

Access Systems Under Remote Network through SSH

[root@mylaptop ~]# ssh -N -f -L :10002:192.168.1.119:80 myserver.mine.nu

I want to access a webserver(192.168.1.119) which can not be access from outside.  But I have ssh access to a system(myserver.mine.nu) which is hosted on the same network. Run above command to create a ssh tunnel between your laptop and remote ssh server and port map 80 port from remote webserver to mylaptops 10002 port., so that you can access the remote webserver through http://mylaptop:10002 ( Or if mylatop’s ip is 192.168.1.2, access using URL http://192.168.1.2:10002).

Asterisk Call from CLI

CLI> originate DAHDI/1/4880722 extension 604@from-internal

Convert VMVARE Workstation disk to ESXi Disk

Copy the VMWARE Workstation disk to ESXi Server using vSphere Client from Configuration >> Storage>>datastore1>>Browse Database

Enable SSH from Configuration >> Security Profile >> Firellwall>>Properties

Login to ESXi server using putty.

Goto to the folder path where you copied the Workstation vmdk file. Usually it will come under /vmfs/volumes/datastore1/<newdiskfolder>

vmkfstools -i WSDISK.vmdk -d zeroedthick ESXiDISK.vmdk

Then create a new VM and add the new disk (Eg.  ESXiDISK.vmdk) to the VM and start it.

Change Windows 2008 Password Policy Made Simple

Run the command.
secedit /export /cfg c:\local.cfg
Open c:\local.cfg file with notpad and change
"PasswordComplexity = 0"
"MinimumPasswordLength = 1"
Then run the command
secedit /configure /db %windir%\security\local.sdb /cfg c:\local.cfg /areas SECURITYPOLICY

Windows simple setup file maker

Start>Run>iexpress

Rename multiple files/ Remove characters from beginning of a file name

# for f in monitor*; do mv “$f” “${f#monitor}”;done

Send a command error to file

The following command will put linux command error output to a file.

mv /tmp/dfa /record/ 3>&1 1>&2 2>&3 | tee /tmp/stderr.txt

If  /tmp/dfa does not exists you will get following line in /tmp/stderr.txt file

mv: cannot stat `/tmp/dfa’: No such file or directory

Find Text in a folder 

grep -lir “text to find” *

Steps to Reverse SSH:

 client : Is the Server which is behind nat and  you want to access it without altering firewall configuration.

 Server: Is the machine which can be accessed through WAN(internet).

  1. On the client run the following commands:
    $ mkdir -p $HOME/.ssh
    $ chmod 0700 $HOME/.ssh
    $ ssh-keygen -t dsa -f $HOME/.ssh/id_dsa -P ''

    This should result in two files, $HOME/.ssh/id_dsa (private key) and $HOME/.ssh/id_dsa.pub (public key).

  2. Copy $HOME/.ssh/id_dsa.pub to the server.
    ssh-copy-id -i ~/.ssh/id_dsa.pub user@server
    or 
    scp ~/.ssh/id_dsa.pub server:
  3. If you copy with scp in previous section then on the server run the following commands:
    $ cat id_dsa.pub >> $HOME/.ssh/authorized_keys2
    $ chmod 0600 $HOME/.ssh/authorized_keys2

    Depending on the version of OpenSSH the following commands may also be required:

    $ cat id_dsa.pub >> $HOME/.ssh/authorized_keys
    $ chmod 0600 $HOME/.ssh/authorized_keys

    An alternative is to create a link from authorized_keys2 to authorized_keys:

    $ cd $HOME/.ssh && ln -s authorized_keys2 authorized_keys
  4. On the client test the results by ssh’ing to the server:
    $ ssh -i $HOME/.ssh/id_dsa server
  5. (Optional) Add the following $HOME/.ssh/config on the client:
    Host server
             IdentityFile ~/.ssh/id_dsa

    This allows ssh access to the server without having to specify the path to the id_dsa file as an argument to ssh each time.

  6. Test the connectivity by ssh. It should not ask for password.
    ssh user@server -p 8022
  7. Put the below command in client’s /etc/rc.local
    nohup ssh -f -N -R 10000:localhost:22 user@server -p 8022
  8. To access the client run following command from the server.
    ssh user@localhost -p 10000

Unzip Multiple files with full path

#for z in *.zip; do 7za x -o/mnt/oebs/oracle/ $z;  done

If you are using command unzip use "unzip $z" instead of  "7za x -o/mnt/oebs/oracle/ $z;"
Another Option
#!/bin/bash
for zipfile in `ls /mnt/c/zipfiles/*.zip`; do unzip -o $zipfile -d /extracted/;
done
linux Find physical memory module installed in each memory slot
dmidecode --type 17
Enable x86 processors to access more than 4 GB of physical memory for Windows

Windows Server 2003 and Windows XP/2000:  To enable PAE, use the /PAE switch in the boot.ini file. To disable PAE, use the /NOPAE switch. To disable DEP, use the /EXECUTE switch.

bcdedit /set  pae ForceEnable

PAE is only used in 32 bit Windows versions. 32 GB is the limit for 64 bit Windows 2003 Standard Edition.

In 32-bit Windows running on x64-based systems, PAE also enables several advanced system and processor features, including hardware-enabled Data Execution Prevention (DEP), non-uniform memory access (NUMA), and the ability to add memory to a system while it is running (hot-add memory).

SumatraPDF: Change Background color 

C:\Program Files\SumatraPDF>SumatraPDF.exe -bg-color #999999

Bash Commands

URL : http://www.quora.com/Linux/What-are-the-useful-shortcut-keys-that-one-must-use-in-bash

I have quite a few favorites that save a ton of time in the terminal. Here are some of them:

1) Ctrl+r (reverse-i-search)
For all those times when you’ve typed a looooooong command into terminal sometime in the past, and remember only fragements of it, this is a huge timesaver. Just type Ctrl+r and type the fragement you remember, and the terminal “remembers” the command you typed. If you remember a command that was used just before or after the command you need, use Ctrl+R to find the command you remember and then scroll through your history using Ctrl+n (to move forward) or Ctrl+p (to move back). You can also use a similar command of ‘history’ to search history, but Ctrl+r, for me atleast is superior in every way.

2) !! (repeat last command)
Especially useful when running the same process over and over, !! simply performs the last command. This is especially useful when you run a command that needs root privileges, but you forgot to provide it, then you can just do sudo !! to run the same command with root priviledges

3)Ctrl+a,Ctrl+e, Alt+f, Alt+b (terminal command moverments)
These four commands are commands everyone on a terminal should learn to save endless hours spent traversing through commands to correct typos or arguments. Here’s the breakdown:
Ctrl+a : Goto beginning of command
Ctrl+e: Goto end of line
Alt+f : Move forward one word
Alt+b: Go backward one word
Protip: Mac Users, set your option key to be used as meta key ( in terminal preference) to be able to use the Alt commands

4)Ctrl+u, Ctrl+k (Deletions)
Deletion is always a matter of contention for people who’re new to the terminal. Most of them are used to the world of Ctrl+a -> Del to select and delete everything, that the terminal seems daunting. Fear not, for you can use Ctrl+u to delete everything you’ve typed out, or the nifty Ctrl+k to delete everything that comes after the current cursor position 🙂

5) TAB (Autocompletion)
This is easily the most widely used Terminal shortcut, and in many ways, the most effective. Tab is magical in it’s working, especially when working with files names abcdefg-54321-cmd-logs-journal-tabs.log, where you can just type an ‘a’ and press tab to autocomplete the filename. Traversing through folders is a breeze thanks to Tab, and the fact that it uses a very smart autocompletion scheme (eg. if you have files named abcd-1234.log and abcd-1235.log, and type ‘a’ followed by tab, it autocompletes till ‘abcd-123′, which is the common substring of both files’) makes this very useful

Ofcourse, there are many more shortcuts to learn to use, but once you learn a set of commands you’re comfortable with (and which you use often), both speed and productivity through the terminal increases exponentially. (And, superspeed alongside a green text on black terminal will get you the occasional ‘ooh, you’re just like Neo from the Matrix’ comments from people around you 😉 )
Traversing the Command
ctrl+f to go forward
ctrl+b to go backward
ctrl+a to go start of the line
ctrl+e to go end of the line
ctrl+p to go previous command
ctrl+n to go next command
ctrl+w to delete word backward
ctrl+k to delete from cursor to end of line
ctrl+d to delete letter under cursor
ctrl+l to clear the screen
ctrl+r increment search backwards, use ctrl+r to go next.
Ctrl + a : Go to the beginning of the line (Home)
Ctrl + e : Go to the end of the line ( End )
Alt + b : Back one word on Left
Alt + f : Forward one word on right

Ctrl + l : Clear the screen

Ctrl + p and Ctrl + n : walk back in history command in backward and forward respectively.

Alt + . : Use last word of previous command
Ctrl + t : swap the last two characters before the cursor. (typo)

Tab : Auto completion. [Everyone knows this 😛 ]

kill all running PHP processes you can type kill $(pidof php) to do it fast

RPM

Find the rpm of installed binary.

rpm -qf `which kinit`

How to find PCI / PCIe Slot information linux command

# dmidecode –type 9

Installing PHP from source on CentOS x86_64 (w/ apache)

Installing PHP from source is much easier than most people think. In this tutorial I will describe how to install a bare PHP build with mysql/mysqli support in addition to configuring apache to interpret PHP scripts.

Compiling PHP Source

Alright, well in order to compile the php source code you must first have gcc install (# yum install gcc). Also if you want to be able to use PHP in apache then you need to have httpd and httpd-devel packages installed. Here is how I did my install. (Please note that I used PHP 5.2.6 for my install, but this will work with just about any php version, just be sure to untar and cd into the proper directory for your version of php.)

1
2
3
4
5
6
7
8
[root@nitrogen ~]# yum install gcc-c++ httpd httpd-devel apr-devel libxml2-devel zlib zlib-devel mysql-devel openssl-devel
[root@nitrogen ~]# tar -zxvf php-5.2.6.tar.gz
[root@nitrogen ~]# cd php-5.2.6
[root@nitrogen cd php-5.2.6]# ./configure –with-config-file-path=/etc –with-config-file-scan-dir=/etc/php.d –with-apxs2 –with-libdir=lib64  –with-mysql –with-mysqli –with-zlib
[root@nitrogen cd php-5.2.6]# make clean
[root@nitrogen cd php-5.2.6]# make
[root@nitrogen cd php-5.2.6]# make install

You’re also going to want to place a php.ini into /etc/php.ini and make the /etc/php.d directory if you have not done so already.

1
2
[root@nitrogen cd php-5.2.6]# cp php.ini-recommended /etc/php.ini
[root@nitrogen cd php-5.2.6]# mkdir /etc/php.d

Installing PHP into apache

To install PHP into apache all you need to do is place the following configuration file in /etc/httpd/conf.d/php.conf.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
# /etc/httpd/conf.d/php.conf
# PHP is an HTML-embedded scripting language which attempts to make it
# easy for developers to write dynamically generated webpages
#
LoadModule php5_module modules/libphp5.so
#
# Cause the PHP interpreter to handle files with a .php extension.
#
AddHandler php5-script .php
AddType text/html .php
#
# Add index.php to the list of files that will be served as directory
# indexes.
#
DirectoryIndex index.php
#
# Uncommenting the following line to allow PHP to pretty-print .phps
# files as PHP source code:
#
#AddType application/x-httpd-php-source .phps

Finalizing our install is fairly simple, just restart apache by typing the following command and you should be good to run PHP applications for the web.

1
[root@nitrogen ~]# /sbin/service httpd restart
Tagged . Bookmark the permalink.

http://www.wolflabs.org/2008/12/08/installing-php-from-source-on-centos-x86_64-w-apache/

Reconfigure IPTables by deleting all previous rules

iptables -F
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.20.0 -m tcp --dport 22 -j ACCEPT
iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -L -n
iptables-save | sudo tee /etc/sysconfig/iptables
service iptables restart

Install Network Card Solaris 10

First run ifocnfig -a to see all the network card attached to system which has ip address.

My NIC  is  ” Intel Corporation PRO/100 VE Network Connection” installed in  Intel Pentum D 64 bit PC.

1. Use the below command to see the connected NICs.

# /usr/X11/bin/scanpci

#prtconf -pv | less

2.Download the appropriate driver file(tar file) from the other system and copy it to the solaris machine.

If you are using USB, see the previous mount article on how to  mount  USB on solaris.

3.unzip the file if it is .gz(gunzip -d) and untar it (tar -xvf) .

4.Run the commands to compile and install the driver.

% cd /…/ife-x.x.x

% rm Makefile

% ln -s Makefile.amd64_gcc Makefile

% rm obj

% ln -s amd64  obj

% /usr/ccs/bin/make

% /usr/ccs/bin/make install

% modload obj/ife

% /usr/sbin/drvconfig -i iprb

% touch /reconfigure

See the /dev directory to see the newly installed device.

# ls /dev/ip*

/dev/ip        /dev/ipf       /dev/ipnat     /dev/ipscan    /dev/ipstate

/dev/ip6       /dev/ipl       /dev/iprb      /dev/ipsecah   /dev/ipsync

/dev/ipauth    /dev/iplookup  /dev/iprb0     /dev/ipsecesp

Here /dev/iprb0  is my NIC.

Then reboot the machine.

Run the below command to get the DHCP address.

#ifconfig iprb0 auto-dhcp

# ifconfig -a

lo0: flags=2001000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL> mtu 8232 index  1

inet 127.0.0.1 netmask ff000000

iprb0: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 2

inet 192.168.20.181 netmask ffffff00 broadcast 192.168.20.255

ether 0:19:d1:67:f7:cd

If you want to add static ip run the following command.

#sys-unconfig

Other usefull commands

update_drv -a -i  ‘pci8086,1094.8086.d605’ iprb

Files

/etc/defaultdomain       Set the default NIS domain name, if any, if it changed.

/etc/defaultrouter       Set the default router’s IP address, if it changed.

/etc/hostname.le0        (or .hme0 or ?) Update if the hostname changed.

/etc/hostname6.le0       (or .hme0 or ?) Ditto, if you use IPv6.

/etc/hostname6.ip.tun0   Update if you use a IPv4/IPv6 tunnel (e.g., 6bone)

/etc/nodename            Update if the hostname changed.

/etc/nsswitch.conf       Update if your name resolution method/order changed.

/etc/resolv.conf         Update if your name servers/domain changed (DNS only).

/etc/inet/hosts          Make sure your IP address is updated or added here.

List your FQDN is first, before the short hostname.

E.g., “192.168.128.64 foo.bar.com foo”

/etc/inet/ipnodes        IPv6 version of hosts file (Solaris 8+).

/etc/inet/netmasks       Set your network number & netmask, if it changed.

/etc/inet/networks       Set your network name, if it changed.

/etc/net/ticlts/hosts    For the streams-level loopback interface.

/etc/net/ticots/hosts    For the streams-level loopback interface.

/etc/net/ticotsord/hosts For the streams-level loopback interface.

Remote Syslog Server

Enable Remote Linux Syslog Server

Syslog Client configuration
Edit /etc/syslog.conf
@192.168.1.40

service syslog reload

Here 192.168.1.40 is remote syslog server.

Syslog Server configuration

edit  /etc/sysconfig/syslog

add -r in SYSLOGD OPTIONS

SYSLOGD_OPTIONS=”-m 0 -r”

/etc/init.d/syslog  restart