解除Fail2ban

# 查出目前封鎖清單

fail2ban-client status

# 查目前封鎖項目裡的IP

fail2ban-client status sshd

# 解除項目中的IP

fail2ban-client set sshd 192.168.1.120

How to enable Encryption for MariaDB

Generate Keys

1. make keys file

# sudo su

# mkdir -p /etc/mysql/encryption

# cd /etc/mysql/encryption 

# echo "1;"$(openssl rand -hex 32) > keys

# echo "2;"$(openssl rand -hex 32) >> keys

# echo "3;"$(openssl rand -hex 32) >> keys

# echo "4;"$(openssl rand -hex 32) >> keys

2. make password file

# openssl rand -hex 128 > password_file

3. make key enc

# openssl enc -aes-256-cbc -md sha1 -pass file:password_file -in keys -out keys.enc

Updating MariaDB Configuration

create config file

# sudo vim /etc/mysql/mariadb.conf.d/encryption.cnf

Pass content

[mariadb]

## File Key Management

plugin_load_add = file_key_management

file_key_management_filename = /etc/mysql/encryption/keys.enc

file_key_management_filekey = FILE:/etc/mysql/encryption/password_file

file_key_management_encryption_algorithm = aes_cbc

## InnoDB/XtraDB Encryption Setup

innodb_default_encryption_key_id = 1

innodb_encrypt_tables = FORCE ( or ON )

innodb_encrypt_log = ON

innodb_encryption_threads = 4

## Aria Encryption Setup

aria_encrypt_tables = ON

## Temp & Log Encryption

encrypt-tmp-disk-tables = 1

encrypt-tmp-files = 1

encrypt_binlog = ON

Change Permissions

# cd /etc/mysql/

# sudo chown -R mysql:root ./encryption 

# sudo chmod 500 /etc/mysql/encryption/

# cd ./encryption

# chmod 400 keys.enc password_file 

# chmod 644 /etc/mysql/mariadb.conf.d/encryption.cnf

Restart MariaDB

# sudo service mariadb restart

Check Result

REF

https://webdock.io/en/docs/how-guides/security-guides/how-to-enable-encryption-mariadb

pfx export key and crt

Get the private .key from the .pfx certificate

openssl pkcs12 -in my_certificate.pfx -nocerts -out my_certificate-encrypted.key

Get the decrypted .key file from the encrypted private .key file

openssl rsa -in my_certificate-encrypted.key -out my_certificate.key

Get the .crt file from the .pfx file

openssl pkcs12 -in my_certificate.pfx -clcerts -nokeys -out my_certificate.crt 

REF:

https://blog.christian-schou.dk/convert-pfx-to-crt-and-key-file-with-openssl/

fdisk add LVM to CentOS

Linux Fdisk 磁碟分割及格式化

列出 partition table(s)
# fdisk -l

格式化 /dev/sdb
# fdisk /dev/sdb
# Command (m for help): n
# Command action
   e   extended
   p   primary partition (1-4)
p
# Partition number (1-4): 1
# First cylinder (1-2610, default 1): "enter"
Using default value 1
Last cylinder, +cylinders or +size{K,M,G} (1-2610, default 2610): "enter"
Using default value 2610
# Command (m for help): w

將新增實體給LVM使用
# pvcreate /dev/sdb1

查詢 VG Nname
# vgdisplay

掛載新磁區到 VG
# vgextend centos /dev/sdb1

掃描新磁區是否掛載到 VG
# pvscan

顯示目前的 LVM
# lvdisplay

選擇欲加大的 LVM 掛載新磁區
# lvextend /dev/centos/usr /dev/sdb1

重新整理 LMV 大小
# xfs_growfs /dev/centos/usr

檢查 LVM 是否已正常掛載
# df -h



ref:
https://www.rootusers.com/how-to-increase-the-size-of-a-linux-lvm-by-adding-a-new-disk/

Change Nginx UID and GID

stop nginx
stop php-fpm

usermod -u 1500 nginx
groupmod -g 1500 nginx

find / -user 998 -exec chown -h 1500 {} \;
find / -group 996 -exec chgrp -h 1500 {} \;

usermod -g 1500 nginx

start nginx
start php-fpm

假如 nginx UID/GID 未取代完成會造成錯誤

CentOS 7 Install NFS Server and Windows 10 NFS Client to Connect

CentOS

1. yum install

yum install nfs-utils

2. systemctl start and enable

systemctl enable rpcbind

systemctl enable nfs-server

systemctl start rpcbind

systemctl start nfs-server

3. create folder and change mod

mkdir /myshare

chmod 777 /myshare

4. edit /etc/exports and reload exportfs

vi /etc/exports

/myshare 192.168.124.0/24(rw,sync,no_root_squash)

exportfs -r

5. close SELiux 

vi /etc/sysconfig/selinux

SELINUX=disabled

6. add firewall rule and reload

firewall-cmd --permanent --zone public --add-service mountd

firewall-cmd --permanent --zone public --add-service rpc-bind

firewall-cmd --permanent --zone public --add-service nfs

firewall-cmd --reload

Windows 10

1. 開啟 Windwos 功能

2. 安裝 Service of NFS 全部

3. 開啟 cmd 

4. 掛載 NFS

mount -o anon \\remote_ip_address\myshare z:

move file by date

find PATH_A -type f ! -newermt 2017-01-01 -exec mv {} PATH_B \;

MariaDB Max connect

參考
https://pjstrnad.com/mariadb-raise-number-of-connections/

The issue is that you can’t have more max_connections than open_files_limit.

Indication is at the log

Changed limits: max_open_files: 1024 max_connections: 214 table_cache: 400

So you got to /etc/my.cnf and under [mysqld] add

open_files_limit=12000
max_connections=10000

But it’s not enough. Because of the systemd there are some limits in starting the mysql server – it’s already started with mysql user.

So you need to go to /etc/security/limits.conf and add

mysql soft nofile 4096
mysql hard nofile 10240

Then settings for systemd

mkdir -p /etc/systemd/system/mariadb.service.d
vi /etc/systemd/system/mariadb.service.d/limits.conf

And then enter this to to the file:

[Service]
LimitNOFILE=infinity

that worked to me. After restart of the mysql by

systemctl daemon-reload

systemctl restart mariadb

I got the connections fixed:

mysql
MariaDB [(none)]> select @@max_connections;
+-------------------+
| @@max_connections |
+-------------------+
| 10000             |
+-------------------+
MariaDB [(none)]> SHOW VARIABLES LIKE 'open%';
+------------------+-------+
| Variable_name    | Value |
+------------------+-------+
| open_files_limit | 65536 |
+------------------+-------+

That’s all.

mysql binlog too large

檢查硬碟空間
df -h

檢查資料夾大小
du -sh /home/james/*

MySQL log 太大
設定
/etc/my.cnf

只保留七天的 Log
[mysqld]
expire-logs-days=7

重啟 mysql
systemctl restart mariadb

進入 mysql
mysql -u root -p

刷新 log
FLUSH LOGS;

檢查目前 log 在哪個位置
SHOW MASTER STATUS;

清除指定時間 log
PURGE BINARY LOGS BEFORE NOW();

或清指定的 log 檔
PURGE BINARY LOGS TO 'mysql-bin.000047';

SELinux 影響 ssh with key login

如果沒有關閉 SELinux 
ssh 使用 rsa 登入時會遇到錯誤, 
上傳 key 後時要記得更新資料夾權限

restorecon -Rv /folder

就可以正常使用了

[Solve] rsync Argument list too long

因為 UNIX 有限制 ARG_MAX 大小
資料夾底下檔案太多就會出現 Argument list too long

rsync 也一樣, 所以先使用 rsync -n 來跑一次資料夾要同步的檔案, 這裡就不用下星號, 但要注意資料夾 [來源] [目的地] 的位置, 寫錯就會傳錯層級

1. use rsync dry run
rsync -n source/path desc


2. rsync source/path desc


參考文章:
https://hugepang.wordpress.com/2011/06/08/solution-bash-usrlocalbinrsync-argument-list-too-long/


http://blog.xuite.net/jyoutw/xtech/20025390-rsync%E5%8F%83%E6%95%B8%E8%A9%B3%E8%A7%A3--990209

SSH With key login Failure

假如 .ssh, authorized_keys 權限正確, 

但還是無法使用 ssh key 登入

請嘗試在 server 端下以下指令修正資料目錄位置

restorecon -FRvv ~/.ssh

在重新測試是否可順利連結

FreeBSD mount NAS

# vim /etc/fstab 
# add line
127.0.0.1:/folder /mnt/folder nfs rw 0 0

# mount -a

done~

Linux 指令 tar

tar 是壓縮/解壓縮指令

壓縮
tar -zcvf <要儲存的DIR> <要壓縮的DIR>

解壓縮
tar -zxvf <解壓縮的檔案名稱>

MySQL Check

指令
mysqlcheck
-c 檢查
-o 優化
-r 修復
-A 全部



參考網站:
http://scottlinux.com/2012/06/09/use-mysqlcheck-to-optimize-and-repair-mysql-databases/

FreeBSD 自動校時

使用"ntpdate"來幫伺服器校時

ntpdate time.stdtime.gov.tw

可以參考台灣的伺服器


只要在每台下這個指令,
就會同步時間了.

使用網頁同步資料

使用SSH, Rsync 來同步資料是相當方便的事,

但前提是要弄出來,
今天使用web執行sh再去執行ssh rsync
在主機上測sh都OK,
但用網頁測sh卻一直過不去,

主要是因為www所屬的資料夾少了.ssh/know_hosts
因為我們是用網頁來執行ssh,
所以它會以網頁所屬的帳號來執行ssh,
執行ssh會產生.ssh/know_hosts,
而www所屬的資料夾沒有是因為我們平常不會用www@B來登入對方的伺服器
所以不會有這個檔,
這時我們就要先用別的帳號登入到B,
到到這個帳號的主資料夾下找到.ssh/know_hosts
用cat指令找到B伺服器的公鑰資訊,
假如只有一行可以用cat假如有三四行可以用tail
將資訊寫到www所屬的資料夾下的 .ssh/know_hosts
這樣就可以執行網頁來同步資料囉~

PHP error_reporting

當你的程式沒問題，
資料庫也沒問題，
卻出現一堆錯誤，
又不影響網頁執行
試著到php.ini裡設定

error_reporting = E_ALL & ~E_NOTICE

它就會把不必要的錯誤訊息隱藏

Linux Rsync SSH KEY

參考文章
http://pkeck.myweb.uga.edu/ssh/

假設 A是本機, B是遠端
在A使用ssh-keygen 來產生ssh key,
將產出來的 key.pub 傳至B伺服器,
丟到B的/root/.ssh/下重新命名或是用cat加入authorized_keys

這樣就可以使用rsync ssh -i的功能了.