Hello World

CentOS 升級 gcc

CentOS 7 透過 yum 升級 gcc
頂多升級到 4.8.x

因為流量異常，想要看看主要是哪邊來源和目的
所以設定  ip accounting  看看狀態
無法在 interface 上面設定很合理

啟用 gitlab 服務
root@example:/etc# gitlab-ctl start
ok: run: crond: (pid 710527) 1s
ok: run: gitaly: (pid 710535) 0s
ok: run: gitlab-workhorse: (pid 710554) 1s
ok: run: logrotate: (pid 710567) 0s
ok: run: nginx: (pid 710573) 0s
ok: run: postgresql: (pid 710585) 1s
ok: run: puma: (pid 710594) 0s
ok: run: redis: (pid 710599) 1s
ok: run: registry: (pid 710606) 0s
ok: run: sidekiq: (pid 710615) 1s

檢查 gitlab 服務
root@example:/etc# gitlab-ctl status
run: crond: (pid 710527) 15s; run: log: (pid 217758) 329321s
run: gitaly: (pid 710535) 14s; run: log: (pid 217383) 329446s
run: gitlab-workhorse: (pid 710554) 14s; run: log: (pid 217843) 329304s
run: logrotate: (pid 710567) 13s; run: log: (pid 217308) 329463s
run: nginx: (pid 710573) 13s; run: log: (pid 217859) 329299s
run: postgresql: (pid 710585) 13s; run: log: (pid 217550) 329434s
run: puma: (pid 710594) 12s; run: log: (pid 217772) 329316s
run: redis: (pid 710599) 12s; run: log: (pid 217348) 329455s
run: registry: (pid 710606) 11s; run: log: (pid 217933) 329278s
run: sidekiq: (pid 710615) 11s; run: log: (pid 217789) 329311s

停用 gitlab 服務
root@example:/etc# gitlab-ctl stop
ok: down: crond: 0s, normally up
ok: down: gitaly: 1s, normally up
ok: down: gitlab-workhorse: 0s, normally up
ok: down: logrotate: 0s, normally up
ok: down: nginx: 1s, normally up
ok: down: postgresql: 0s, normally up
ok: down: puma: 0s, normally up
ok: down: redis: 1s, normally up
ok: down: registry: 0s, normally up
ok: down: sidekiq: 0s, normally up
 

系統更新
sudo apt update
sudo apt upgrade

安裝 nginx 
sudo apt install nginx

啟動 nignx 檢查是否有錯誤
sudo systemctl start nginx 

安裝 php 及相關 extention
sudo apt install php php-cli php-fpm php-json php-pdo php-mysql php-zip php-gd  php-mbstring php-curl php-xml php-pear php-bcmath

正常狀況下，安裝完後會自動啟動
以下指令檢查是否正常啟動
systemctl status php7.4-fpm.service
ps aux | grep php

修改nginx 設定檔用來支援 php 
sudo vi /etc/nginx/sites-available/default

找到 server 區段
新增 index.php 為index 頁
        index index.php index.html index.htm index.nginx-debian.html;
如果副檔名為 php 則透過 fastcgi 執行
        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
        }

重新啟動 nginx 
sudo systemctl restart nginx 

建立一個測試檔案
cd /var/www/html/
vi test.php

<?php
    echo "Hello World";
?>

最後打開瀏覽器，網址列輸入 http://ip/test.php
如果畫面顯示 Hello World ，表示安裝設定成功

假設用 linux crontab + tar 排程備份網站資料

# tar -zcpBf /home/backup/site1.tgz /var/www/html/site1/

備份出來的檔案會包含完整的路徑
var/www/html/site1/index.php
var/www/html/site1/robots.txt
var/www/html/site1/hello.jpg

但如果只想保留相對路徑，移除完整路徑
可改用以下參數
# tar -zcpBf /home/backup/site1.tgz -C /var/www/html/ site1/
site1/index.php
site1/robots.txt
site1/hello.jpg

tar -C 參數，先 cd 到該路徑，再執行備份指令
-C, --directory=DIR
Change to DIR before performing any operations.  This option is order-sensitive, i.e. it affects all options that follow.
 

新版 ubuntu 預設沒有 netstat 工具
取而代之的是 ss 指令

如果要使用 netstat 工具
請安裝 net-tools 套件

root@example:~# netstat -na

Command 'netstat' not found, but can be installed with:

apt install net-tools

root@example:~# apt install net-tools
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  net-tools
0 upgraded, 1 newly installed, 0 to remove and 5 not upgraded.
Need to get 196 kB of archives.
After this operation, 864 kB of additional disk space will be used.
Get:1 http://tw.archive.ubuntu.com/ubuntu focal/main amd64 net-tools amd64 1.60+git20180626.aebd88e-1ubuntu1 [196 kB]
Fetched 196 kB in 1s (262 kB/s)
Selecting previously unselected package net-tools.
(Reading database ... 115357 files and directories currently installed.)
Preparing to unpack .../net-tools_1.60+git20180626.aebd88e-1ubuntu1_amd64.deb ...
Unpacking net-tools (1.60+git20180626.aebd88e-1ubuntu1) ...
Setting up net-tools (1.60+git20180626.aebd88e-1ubuntu1) ...
Processing triggers for man-db (2.9.1-1) ...
root@example:~#

假設要移動特定檔名的檔案到某個資料匣，但是因為檔案數量太多出現以下錯誤訊息

[root@example testdir]# mv test-*.log /tmp/workdir/
-bash: /usr/bin/mv: Argument list too long

可以考慮 find 配合 xargs 實現
參考語法:
[root@example testdir]# /usr/bin/find /testdir/ -type f -name 'test-*.log' | /usr/bin/xargs  -I '{}' /usr/bin/mv '{}' /tmp/workdir/

以下狀況最近常發現在 FreeBSD 用戶端要讀取使用 Let's Encrypt. 憑證的網站



$ wget https://example.xx.xx/
Resolving example.xx.xx (example.xx.xx)... xx.xx.xx.xx
Connecting to example.xx.xx (example.xx.xx)|xx.xx.xx.xx|:443... connected.
ERROR: cannot verify example.xx.xx's certificate, issued by 'CN=R3,O=Let\'s Encrypt,C=US':
  Issued certificate has expired.
To connect to example.xx.xx insecurely, use `--no-check-certificate'.

$ curl https://example.xx.xx/
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

原因是 client 的 ca root 憑證過期
以freebsd 為例，可以查看 /usr/local/etc/ssl/cert.pem

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            44:af:b0:80:d6:a3:27:ba:89:30:39:86:2e:f8:40:6b
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: O=Digital Signature Trust Co., CN=DST Root CA X3
        Validity
            Not Before: Sep 30 21:12:19 2000 GMT
            Not After : Sep 30 14:01:15 2021 GMT
        Subject: O=Digital Signature Trust Co., CN=DST Root CA X3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:

略過錯誤的解決方式:
$ wget --no-check-certificate https://example.xx.xx/
$ curl -k https://example.xx.xx/

如果是使用 apache 的 proxypass 
請在設定檔加入
SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off

重啟 apache 

發現系統出現以下錯誤訊息
Sep 30 14:12:57 s245 multipathd[601]: sda: add missing path
Sep 30 14:12:57 s245 multipathd[601]: sda: failed to get udev uid: Invalid argument
Sep 30 14:12:57 s245 multipathd[601]: sda: failed to get sysfs uid: Invalid argument
Sep 30 14:12:57 s245 multipathd[601]: sda: failed to get sgio uid: No such file or directory
Sep 30 14:13:02 s245 multipathd[601]: sda: add missing path
Sep 30 14:13:02 s245 multipathd[601]: sda: failed to get udev uid: Invalid argument
Sep 30 14:13:02 s245 multipathd[601]: sda: failed to get sysfs uid: Invalid argument
Sep 30 14:13:02 s245 multipathd[601]: sda: failed to get sgio uid: No such file or directory

解決方式
1. 將 guestos 先關機
2. 點擊 guestos 右鍵 -> 編輯設定 
3. 切換至 選項 -> 一般
4. 點擊右邊組態參數
5. 新增組態名稱和值分別為 disk.EnableUUID 及 TRUE
6. 確定，重開vm guestos



參考資料: https://ubuntuforums.org/showthread.php?t=2441797

執行 elastic search 需要有java 環境
請先確定系統環境是否已經安裝 java
$ java -version

如果沒有的話，以下步驟安裝
$ sudo apt install default-jre

設定環境變數
$ vi /etc/environment
JAVA_HOME="/usr/lib/jvm/java-11-openjdk-amd64/"

$ source /etc/environment

安裝 elastic search 步驟
$ wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
$ sudo apt-get install apt-transport-https
$ echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-6.x.list
$ sudo apt-get update && sudo apt-get install elasticsearch
 

如果你有使用 cloudflare 的cdn 功能
預設的cache 是啟用的
但是如果你目前需要頻繁更新網頁
想要看到即時的畫面，又不要不斷的清cache 

cloudflare 提供了 development mode 的功能
啟用development mode 之後的三個小時內
cloudflare 會幫你bypass 所有的cache 
直到你手動關閉或是三個小時後自動關閉

另外也提供api 可以不用登入管理介面操作

example:
取得目前 development mode 狀態
curl -X GET "https://api.cloudflare.com/client/v4/zones/YOUR-ZONE-ID/settings/development_mode" \
     -H "X-Auth-Email: user@example.com" \
     -H "X-Auth-Key: YOUR-API-KEY" \
     -H "Content-Type: application/json"

回傳
{
  "success": true,
  "errors": [],
  "messages": [],
  "result": {
    "id": "development_mode",
    "value": "off",
    "editable": true,
    "modified_on": "2014-01-01T05:20:00.12345Z",
    "time_remaining": 3600
  }
}

啟用 development mode
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/YOUR-ZONE-ID/settings/development_mode" \
     -H "X-Auth-Email: user@example.com" \
     -H "X-Auth-Key: YOUR-API-KEY" \
     -H "Content-Type: application/json" \
     --data '{"value":"on"}'

{
  "success": true,
  "errors": [],
  "messages": [],
  "result": {
    "id": "development_mode",
    "value": "on",
    "editable": true,
    "modified_on": "2014-01-01T05:20:00.12345Z",
    "time_remaining": 3600
  }
}

關閉 development mode
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/YOUR-ZONE-ID/settings/development_mode" \
     -H "X-Auth-Email: user@example.com" \
     -H "X-Auth-Key: YOUR-API-KEY" \
     -H "Content-Type: application/json" \
     --data '{"value":"off"}'

{
  "success": true,
  "errors": [],
  "messages": [],
  "result": {
    "id": "development_mode",
    "value": "off",
    "editable": true,
    "modified_on": "2014-01-01T05:20:00.12345Z",
    "time_remaining": 3600
  }
}

Zone ID 可以在 overview 的左下角取得

API Key 可以再點進 Get your API token 後取得

ubuntu 20.04 預設重開機時無法啟用 /etc/rc.local
如果要重開機後執行的話，修改方式如下

1. 在檔案的最末端加入以下三行，存檔離開
sudo vi /lib/systemd/system/rc-local.service
[Install] 
WantedBy=multi-user.target
Alias=rc-local.service

2. 建立 rc.local
sudo vi /etc/rc.local
#!/bin/sh -e

echo `date` >> /tmp/reboot.log

exit 0

3. 加入可執行權限
sudo chmod u+x /etc/rc.local

4. 設定開機啟動，並手動啟用測試
sudo systemctl enable rc-local
sudo systemctl start rc-local

5. 檢視是否已啟用
sudo systemctl status rc-local
● rc-local.service - /etc/rc.local Compatibility
     Loaded: loaded (/lib/systemd/system/rc-local.service; enabled; vendor preset: enabled)
    Drop-In: /usr/lib/systemd/system/rc-local.service.d
             └─debian.conf
     Active: active (exited) since Fri 2021-09-17 01:53:56 UTC; 3s ago
       Docs: man:systemd-rc-local-generator(8)
    Process: 989234 ExecStart=/etc/rc.local start (code=exited, status=0/SUCCESS)

Sep 17 01:53:56 example systemd[1]: Starting /etc/rc.local Compatibility...
Sep 17 01:53:56 example systemd[1]: Started /etc/rc.local Compatibility.

6. 建立連結
sudo ln -s /lib/systemd/system/rc-local.service /etc/sysstemd/system/rc-local.service

7. 重開機
sudo reboot

相關連結:  透過 crontab 實現重開機時自動執行 script
https://helloworld.pixnet.net/blog/post/48872828-%e9%80%8f%e9%81%8e-crontab-%e5%af%a6%e7%8f%be%e9%87%8d%e9%96%8b%e6%a9%9f%e6%99%82%e8%87%aa%e5%8b%95%e5%9f%b7%e8%a1%8c-script

官網上提供詳細步驟
https://about.gitlab.com/install/#ubuntu

1. 安裝相關套件
sudo apt-get update
sudo apt-get install -y curl openssh-server ca-certificates tzdata perl

如果需要寄信的話，安裝MTA
sudo apt-get install -y postfix

2. 新增package repository 並安裝
curl https://packages.gitlab.com/install/repositories/gitlab/gitlab-ee/script.deb.sh | sudo bash

EXTERNAL_URL 改成你的gitlab 網址，需要dns 查詢的到或室 /etc/hosts 有綁定ip 也可以
sudo EXTERNAL_URL="https://gitlab.example.com" apt-get install gitlab-ee

3. 透過瀏覽器登入
網址列填入 https://剛剛你設定的網址/
預設帳號: root
密碼: 系統會隨機產生並保留24小時，在 /etc/gitlab/initial_root_password 可以找到

在shell 輸入 update-alternatives --config editor
星號標示目前預設的文字編輯器
如果要改變預設的文字編輯器，僅需要在提示欄位輸入編號即可
因為我習慣vi 的操作方式，所以我選擇3 並按enter 確認

root@helloworld:~# update-alternatives --config editor
There are 4 choices for the alternative editor (providing /usr/bin/editor).

  Selection    Path                Priority   Status
------------------------------------------------------------
* 0            /bin/nano            40        auto mode
  1            /bin/ed             -100       manual mode
  2            /bin/nano            40        manual mode
  3            /usr/bin/vim.basic   30        manual mode
  4            /usr/bin/vim.tiny    15        manual mode

Press <enter> to keep the current choice[*], or type selection number: 3
update-alternatives: using /usr/bin/vim.basic to provide /usr/bin/editor (editor) in manual mode

測試預設的編輯器是否生效
root@helloworld:~# visudo

編輯 logind.conf
# vi /etc/systemd/logind.conf

找到 HandleLidSwitch 關鍵字
把前面的註解拿掉
並修改為
HandleLidSwitch=ignore

存檔離開，重開機

 

情境:
1. ubuntu server 20.04 僅提供 AP (access poing ) 存取
2. client 透過 ubuntu sever 向 core router 提出 dhcp 請求

首先確認 ubuntu 的 有線和無線網卡均可正常運作
安裝以下必要套件
# apt -y install hostapd
# apt -y install bridge-utils

編輯 hostapd 設定檔
# vi /etc/hostapd/hostapd.conf
interface=wlan0
driver=nl80211
hw_mode=g
channel=1
ieee80211d=1
country_code=TW
ieee80211n=1
wmm_enabled=1
ssid=AP-NAME
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=passwordddd
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP

# vi /etc/default/hostapd
DAEMON_CONF="/etc/hostapd/hostapd.conf"

設定 netplan
# vi /etc/netplan/00-installer-config.yaml
network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      dhcp4: no
    wlan0:
      dhcp4: no
  bridges:
    br0:
      interfaces:
        - eth0
        - wlan0
      addresses:
        - 10.10.10.247/24
      gateway4: 10.10.10.252
      nameservers:
        addresses: [10.10.10.26,8.8.8.8]

啟用 hostapd
# systemctl unmask hostapd
# systemctl start hostapd

最後找一台client 測試連線

Ubuntu Linux 20.04 網路設定由 netplan 管理
如果一開始設定是 dhcp client 的話，/etc/netplan/00-installer-config.yaml 設定類似如下

作業系統環境: ubuntu-20.04.2.0-desktop-amd64
無線網卡: 【EDIMAX 訊舟】EW-7822UAD AC1200 雙頻 長距離USB 3.0無線網路卡

1. 至官方網站下載 driver
https://www.edimax.com/edimax/download/download/data/edimax/global/download/product/wireless_adapters/wireless_adapters_ac1200_dual-band/ew-7822uad/

2. 解壓縮
# unzip EW-7822UAD_Linux_Driver_1.0.0.1.zip

3. 安裝 driver
安裝需要的套件套件
# apt-get update
# apt install net-tools make make-guile gcc

安裝驅動程式
# cd ./Linux/driver
# make && make install 

4. 重開機
# reboot

5. 檢查是否啟用
# ifconfig -a
查看是否多一個interface
 

執行 wifi up 
root@OpenWrt:/etc/config# wifi up

wifi status 觀察是否啟用，但"up": false,
root@OpenWrt:/etc/config# wifi status
{
        "radio0": {
                "up": false,
                "pending": false,
                "autostart": true,
                "disabled": false,
                "retry_setup_failed": true,
                "config": {
                        "channel": "11",
                        "hwmode": "11g",
                        "path": "pci0000:00/0000:00:14.0/usb3/3-2/3-2:1.0",
                        "htmode": "HT20"
                },
                "interfaces": [
                        {
                                "section": "default_radio0",
                                "config": {
                                        "mode": "ap",
                                        "encryption": "psk-mixed",
                                        "ifname": "wlan0",
                                        "wds": true,
                                        "ssid": "aptest",
                                        "key": "password",
                                        "network": [
                                                "lan"
                                        ],
                                        "mode": "ap"
                                }
                        }
                ]
        }
}

查看log，發現少了一個工具 ./mac80211.sh: eval: line 793: /usr/sbin/hostapd: not found
root@OpenWrt:/etc/config# logread | grep radio
Tue Aug 24 07:11:13 2021 daemon.notice netifd: radio0 (10651): command failed: Not supported (-95)
Tue Aug 24 07:11:13 2021 daemon.notice netifd: radio0 (10651): ./mac80211.sh: eval: line 793: /usr/sbin/hostapd: not found
Tue Aug 24 07:11:13 2021 daemon.notice netifd: radio0 (10651): cat: can't open '/var/run/wifi-phy0.pid': No such file or directory
Tue Aug 24 07:11:13 2021 daemon.notice netifd: radio0 (10651): WARNING (wireless_add_process): executable path /usr/sbin/hostapd does not match process  path (/proc/exe)
Tue Aug 24 07:11:13 2021 daemon.notice netifd: radio0 (10651): Command failed: Invalid argument
Tue Aug 24 07:11:13 2021 daemon.notice netifd: radio0 (10651): Device setup failed: HOSTAPD_START_FAILED
Tue Aug 24 07:11:29 2021 daemon.notice netifd: radio0 (10834): command failed: Not supported (-95)
Tue Aug 24 07:11:29 2021 daemon.notice netifd: radio0 (10834): ./mac80211.sh: eval: line 793: /usr/sbin/hostapd: not found
Tue Aug 24 07:11:29 2021 daemon.notice netifd: radio0 (10834): cat: can't open '/var/run/wifi-phy0.pid': No such file or directory
Tue Aug 24 07:11:29 2021 daemon.notice netifd: radio0 (10834): WARNING (wireless_add_process): executable path /usr/sbin/hostapd does not match process  path (/proc/exe)
Tue Aug 24 07:11:29 2021 daemon.notice netifd: radio0 (10834): Command failed: Invalid argument
Tue Aug 24 07:11:29 2021 daemon.notice netifd: radio0 (10834): Device setup failed: HOSTAPD_START_FAILED

安裝 hostapd
root@OpenWrt:/etc/config# opkg install hostapd
Installing hostapd (2019-08-08-ca8c2bd2-7) to root...
Downloading http://downloads.openwrt.org/releases/19.07.8/packages/x86_64/base/hostapd_2019-08-08-ca8c2bd2-7_x86_64.ipk
Configuring hostapd.

重新啟用 wifi
root@OpenWrt:/etc/config# wifi up

確認是否正常啟用
root@OpenWrt:/etc/config# wifi status
{
        "radio0": {
                "up": true,
                "pending": false,
                "autostart": true,
                "disabled": false,
                "retry_setup_failed": false,
                "config": {
                        "channel": "11",
                        "hwmode": "11g",
                        "path": "pci0000:00/0000:00:14.0/usb3/3-2/3-2:1.0",
                        "htmode": "HT20"
                },
                "interfaces": [
                        {
                                "section": "default_radio0",
                                "config": {
                                        "mode": "ap",
                                        "encryption": "psk-mixed",
                                        "ifname": "wlan0",
                                        "wds": true,
                                        "ssid": "aptest",
                                        "key": "password",
                                        "network": [
                                                "lan"
                                        ],
                                        "mode": "ap"
                                }
                        }
                ]
        }
}
 

1. 首先找一台linux ，並提升至 root 權限，至 https://www.finnix.org/Download 下載最新版的 iso 
目前最新版本為 122
# cd /workdir/
# wget https://www.finnix.org/releases/122/finnix-122.iso

2. 掛載 iso 檔
mkdir /mnt/finnixiso
# mount -o loop /workdir/finnix-122.iso /mnt/finnixiso
# mkdir /workdir/myfinnix-122

3. 因為mount 上來的iso 是唯讀狀態，所以我們要複製一份檔案至 /workdir/myfinnix-122
# rsync -a /mnt/finnixiso/ /workdir/myfinnix-122/

4. 解壓檔案系統
#  cd /workdir/myfinnix-122/isolinux/live
# unsquashfs filesystem.squashfs

5. 這時候可以將需要的檔案放進解壓縮出來的檔案系統
# cd squashfs-root/home/

例如，把 openwrt-19.07.8-x86-64-combined-ext4.img 放進 ./home/openwrt/
# mkdir openwrt
# cd openwrt/
# cp /path/openwrt-19.07.8-x86-64-combined-ext4.img .

6. 重新壓縮檔案系統
# cd /workdir/myfinnix-122/isolinux/live
# rm -r filesystem.squashfs
# mksquashfs squashfs-root filesystem.squashfs
#  rm -rf squashfs-root

7. 製作 iso 檔
# cd ../
# genisoimage -l -r -J -V "myfinnix-122" -b isolinux/isolinux.bin -no-emul-boot -boot-load-size 4 -boot-info-table -c isolinux/boot.cat -o ../myfinnix-122.iso ./

以上步驟即可完成客製化 finnix livecd

也可以利用 rufus 工具將客製化 iso 製作成開機 usb 隨身碟