How To scp, ssh and rsync without prompting for password

Whenever you need to use scp to copy files, it asks for passwords. Same with rsync as it (by default) uses ssh as well. Usually scp and rsync commands are used to transfer or backup files between known hosts or by the same user on both the hosts. It can get really annoying the password is asked every time. I even had the idea of writing an expect script to provide the password. Of course, I didn't. Instead I browsed for a solution and found it after quite some time. There are already a couple of links out there which talk about it. I am adding to it...

Lets say you want to copy between two hosts host_src and host_desthost_src is the host where you would run the scp, ssh or rsyn command, irrespective of the direction of the file copy!

    1. host_src, run this command as the user thatscp/ssh/rsync

    $ ssh-keygen -t rsa

    This will prompt for a passphrase. Just press the enter key. It'll then generate an identification (private key) and a public key. Do not ever share the private key with anyone! ssh-keygen shows where it saved the public key. This is by default~/.ssh/id_rsa.pub:

    Your public key has been saved in <your_home_dir>/.ssh/id_rsa.pub

  1. Transfer the id_rsa.pub file to host_dest by either ftpscp, rsync or any other method.

    1. host_dest, login as the remote user which you plan to use when youscp,ssh rsync host_src.
  1. Copy the contents of id_rsa.pub to ~/.ssh/authorized_keys2

$ cat id_rsa.pub >>~/.ssh/authorized_keys2
$ chmod 700 ~/.ssh/authorized_keys2

If this file does not exists, then the above command will create it. Make sure you remove permission for others to read this file. If its a public key, why prevent others from reading this file? Probably, the owner of the key has distributed it to a few trusted users and has not placed any additional security measures to check if its really a trusted user.

  1. Note that ssh by default does not allow root to log in. This has to be explicitly enabled on host_dest. This can be done by editing /etc/ssh/sshd_config and changing the option of PermitRootLoginfrom no to yes. Don't forget to restart sshd so that it reads the modified config file. Do this only if you want to use the root login.

Well, thats it. Now you can run scp, ssh and rsync on host_src connecting to host_dest and it won't prompt for the password. Note that this will still prompt for the password if you are running the commands on host_dest connecting to host_src. You can reverse the steps above (generate the public key on host_dest and copy it to host_src) and you have a two way setup ready!

Read more...

SELinux 导致 PHP 无法使用 fsockopen 连接到 Memcached 服务器

前段时间刚刚写了一篇关于 SELinux 导致 httpd(Apache2) 无法启动 的文章,今天又碰到 SELinux 的问题了。

事情是这样的:

首先是服务器硬盘出问题了:-(,我给换了块硬盘,然后重装系统(CentOS 5.4 i386),然后安装各种程序、还原各种数据。最后一步是使用 memcache.php 来监控 Memcache 状态。然而却发现该工具无法连接上 Memcached 服务器。经检查,Memcached 服务器已经正常启动,使用 telnet 能够正常连接上去,使用 Memcached 的应用程序(PHP程序)也正常工作。查看 memcache.php 代码发现其是使用 fsockopen 来连接 Memcached 服务器,遂怀疑 Socket 扩展的问题。然而,检查发现可以在命令行中使用 fsockopen 连接到任意地址的任意端口,说明 Socket 扩展没问题。但在 httpd 中使用 fsockopen 来就只能连接本机的 80、8080、443 端口,连接其他端口均失败。

检查 httpd 的 log 也没发现任何问题。上网搜索也没发现类似问题,郁闷ing……

于是又想到是否是 SELinux 的问题。grep 了下 /var/log/audit/audit.log,发现以下线索:

[liang@www ~]$ sudo grep denied /var/log/audit/audit.log

type=AVC msg=audit(1280882021.681:780): avc:  denied  { name_connect } for  pid=3822 comm="httpd" dest=11211 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket 
type=AVC msg=audit(1280885410.800:805): avc:  denied  { name_connect } for  pid=3790 comm="httpd" dest=11211 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket

看来又是 SELinux 搞的鬼。继续检查,发现 /var/log/messages 有以下错误信息:

  1. 4 08:11:59 www setroubleshoot: SELinux is preventing the http daemon from connecting to the itself or the relay ports For complete SELinux messages. run sealert -l 23d1381f-9d4b-439a-9ad6-d52f1025f247

果然是 SELinux 引起的问题。根据提示继续检查:

[liang@www ~]$ sealert -l 23d1381f-9d4b-439a-9ad6-d52f1025f247

Summary:

SELinux is preventing the http daemon from connecting to the itself or the relay 
ports

Detailed Description:

SELinux has denied the http daemon from connecting to itself or the relay ports. 
An httpd script is trying to do a network connect to an http/ftp port. If you 
did not setup httpd to network connections, this could signal a intrusion 
attempt.

Allowing Access:

If you want httpd to connect to httpd/ftp ports you need to turn on the 
httpd_can_network_relay boolean: "setsebool -P httpd_can_network_relay=1"

The following command will allow this access:

setsebool -P httpd_can_network_relay=1

Additional Information:

Source Context                user_u:system_r:httpd_t 
Target Context                system_u:object_r:http_cache_port_t 
Target Objects                None [ tcp_socket ]

———————省略若干输出———————

错误信息说得很明了了:SELinux 阻止了 httpd 的连接。修改方式也给出来了,以 root 身份运行以下命令即可:

[liang@www ~]$ sudo /usr/sbin/setsebool -P httpd_can_network_relay=1

注意该命令成功运行后没有任何输出。要检查是否设置成功,可以查看运行 getsebool 命令或者直接查看 log:

[liang@www ~]$ /usr/sbin/getsebool httpd_can_network_relay 
httpd_can_network_relay –> on

[liang@www ~]$ sudo tail /var/log/messages

  1. 4 10:50:23 www setsebool: The httpd_can_network_relay policy boolean was changed to 1 by root

设置成功了。重新刷新下 memcache.php, 发现已经能够正常工作了。job done!

此文纯粹是工作备忘。但希望也能给碰到同样问题的朋友一点帮助。

Read more...

如何显示隐藏的chrome扩展图标

最近也不知是chrome升级的缘故,还是误操作,导致我的好几台电脑的chrome浏览器右侧的部分扩展程序的图标隐藏了,需要点“》”按钮展开,操作起来颇为不便。那怎么样重新显示被隐藏的chrome扩展图标呢?

今天偶然发现,其实解决的方法很简单,就是将鼠标放置在地址栏的最右侧,也就是加书签的五角星右侧,鼠标会变成可拖动显示,这时向左拖动展开工具栏,隐藏的扩展应用图标就重新显示了。

这个功能简单实用,我们可以通过调整扩展图标的位置,显示我们常用的图标(如switchysharp,词典),隐藏没用的图标(如ADBLOCK等)。

Read more...

Log iptables Messages to a Separate File with rsyslog

Firewall logging is very important, both to detect break-in attempts and to ensure that firewall rules are working properly. Unfortunately, it’s often difficult to predict in advance which rules and what information should be logged. Consequently, it’s common practice to err on the side of verbosity. Given the amount of traffic that any machine connected to the Internet is exposed to, it’s critical that firewall logs be separated from normal logs in order to ease monitoring. What follows are two methods to accomplish this using iptables on Linux. The first method uses traditional syslog facility/priority filtering. The second, more robust method filters based on message content with rsyslog.

The Old Way: Use a Fixed Priority for iptables

The traditional UNIX syslog service only has two ways to categorize, and consequently route, messages: facility and priority. Facilities include kernel, mail, daemon, etc. Priorities include emergency, alert, warning, debug, etc. The Linux iptables firewall runs in the kernel and therefore always has the facility set to kern. Using traditional syslog software, the only way you can separate iptables messages from other kernel messages is to set the priority on all iptables messages to something specific that hopefully isn’t used for other kernel logging.

For example, you could add something like the following to /etc/syslog.conf:

kern.=debug -/var/log/iptables.log

and specifically remove the kernel debugging messages from all other logs like so:

kern.*;kern.!=debug -/var/log/kern.log

and in each iptables logging rule use the command line option --log-level debug.

There are two distinct disadvantages to this approach. First, there’s no guarantee that other kernel components won’t use the priority you’ve set iptables to log at. There’s a real possibility that useful messages will be lost in the deluge of firewall logging. Second, this approach prevents you from actually setting meaningful priorities in your firewall logs. You might not care about random machines hammering Windows networking ports, but you definitely want to know about malformed packets reaching your server.

The New Way: Filter Based on Message Content with rsyslog

  1. rsyslog is mostly a drop-in replacement for a tradtional syslog daemon–on Linux, klogd and sysklogd. In fact, on Debian and Ubuntu, you can simply:

$ sudo apt-get install rsyslog

and if you haven’t customized /etc/syslog.conf, logging should continue to work in precisely the same way. rsyslog has been the default syslog on Red Hat/Fedora based systems for a number of versions now, but if it’s not installed:

$ sudo yum install rsyslog

Configure iptables to Use a Unique Prefix

We’ll setup rsyslog to filter based on the beginning of a message from iptables. So, for each logging rule in your firewall script, add --log-prefix "iptables: ". Most firewall builder applications can be easily configured to add a prefix to every logging rule. For example, if you’re using firehol as I am, you could add:

FIREHOL_LOG_PREFIX="firehol: "
  1. /etc/firehol/firehol.conf.
  2. /etc/rsyslog.d/iptables.conf with the following contents:

Configure rsyslog to Filter Based on Prefix

:msg, startswith, "iptables: " -/var/log/iptables.log
& ~

The first line means send all messages that start with “iptables: ” to /var/log/iptables.log. The second line means discard the messages that were matched in the previous line. The second line is of course optional, but it saves the trouble of explicitly filtering out firewall logs from subsequent syslog rules.

When I configured this on my own machines, I did notice one issue that may be a peculiarity of firehol, but it’s probably worth mentioning anyway. It seems that firehol adds an extra single quote at the beginning of log messages that needs to be matched in the rsyslog rule. For example, here’s a log message from firehol:

Apr 17 12:41:07 tick kernel: 'firehol: 'IN-internet':'IN=eth0 OUT= MAC=fe:fd:cf:c0:47:b5:00:0e:39:6f:48:00:08:00 SRC=189.137.225.191 DST=207.192.75.74 LEN=64 TOS=0x00 PREC=0x00 TTL=32 ID=5671 DF PROTO=TCP SPT=3549 DPT=5555 WINDOW=65535 RES=0x00 SYN URGP=0

Notice the extra quote after “kernel: ” and before “firehol: “. So, on my machine I configured the rsyslog filter like so:

:msg, startswith, "'firehol: " -/var/log/iptables.log
& ~

Configure iptables Log Rotation

Finally, since we’re logging to a new file, it’s useful to create a log rotation rule. Create a file /etc/logrotate.d/iptables with the following contents:

/var/log/iptables.log
{
	rotate 7
	daily
	missingok
	notifempty
	delaycompress
	compress
	postrotate
		invoke-rc.d rsyslog reload > /dev/null
	endscript
}

The preceding script tells logrotate to rotate the firewall log daily and keep logs from the past seven days.

Read more...

Force iptables to log messages to a different log file

Force iptables to log messages to a different log file

  1.  on OCTOBER 3, 2006 · 38 COMMENTS· LAST UPDATED FEBRUARY 23, 2008

According to man page:
Iptables is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also contain user defined chains.

By default, Iptables log message to a /var/log/messages file. However you can change this location. I will show you how to create a new logfile called /var/log/iptables.log. Changing or using a new file allows you to create better statistics and/or allows you to analyze the attacks.

Iptables default log file

For example, if you type the following command, it will display current iptables log from /var/log/messages file:
# tail -f /var/log/messages
Output:

Oct  4 00:44:28 debian gconfd (vivek-4435): Resolved address "xml:readonly:/etc/gconf/gconf.xml.defaults" to a read-only configuration source at position 2
Oct  4 01:14:19 debian kernel: IN=ra0 OUT= MAC=00:17:9a:0a:f6:44:00:08:5c:00:00:01:08:00 SRC=200.142.84.36 DST=192.168.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=18374 DF PROTO=TCP SPT=46040 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0
Oct  4 00:13:55 debian kernel: IN=ra0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:18:de:55:0a:56:08:00 SRC=192.168.1.30 DST=192.168.1.255LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=13461 PROTO=UDP SPT=137 DPT=137 LEN=58

Procedure to log the iptables messages to a different log file

Open your /etc/syslog.conf file:
# vi /etc/syslog.conf
Append following line
kern.warning /var/log/iptables.log
Save and close the file.

Restart the syslogd (Debian / Ubuntu Linux):# /etc/init.d/sysklogd restartOn the other hand, use following command to restart syslogd under Red Hat/Cent OS/Fedora Core Linux:# /etc/init.d/syslog restart

Now make sure you pass the log-level 4 option with log-prefix to iptables. For example:
# DROP everything and Log it
iptables -A INPUT -j LOG --log-level 4
iptables -A INPUT -j DROP

For example, drop and log all connections from IP address 64.55.11.2 to your /var/log/iptables.log file:
iptables -A INPUT -s 64.55.11.2 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix '** HACKERS **'--log-level 4
iptables -A INPUT -s 64.55.11.2 -j DROP

Where,

  • --log-level 4: Level of logging. The level # 4 is for warning.
  • --log-prefix '*** TEXT ***': Prefix log messages with the specified prefix (TEXT); up to 29 letters long, and useful for distinguishing messages in the logs.

You can now see all iptables message logged to /var/log/iptables.log file:
# tail -f /var/log/iptables.log

Updated for accuracy.

Read more...

Shell 之 column 格式化输出日志文件 整齐

最近在调整一个脚本脚本,在cygwin下,脚本输出的日志杂乱,看起来很费劲。想对输出进行排序,由于列的宽度都是不固定的,所以操作起来很吃力,怎么都调整不好。

后来找到一个命令,非常好用

 

那就是:column -t filename

先前输出的日志如下:

乱的像一团麻一样,看起来非常吃力。

使用column 之后如下:

整整齐齐,一目 了然,在脚本使用,输出也是非常清爽

Read more...
Subscribe to this RSS feed