| Start | Kontakt |
UTC=no |
# date Sun May 3 08:01:56 CEST 2009 # export TZ=Europe/London ; date Sun May 3 07:02:01 BST 2009 # export TZ=Unknown ; date Sun May 3 06:02:08 UTC 2009 (Note: UTC!) # export TZ=America/New_York ; date Sun May 3 02:02:15 EDT 2009 # export TZ=America/Los_Angeles ; date Sat May 2 23:02:20 PDT 2009 # export TZ=UTC ; date Sun May 3 06:02:24 UTC 2009 # unset TZ ; date Sun May 3 08:02:29 CEST 2009 |
UTC=no |
cd /d "%ProgramFiles%\Oracle\VirtualBox" SET port=22 SET service=ssh vboxmanage modifyvm "<VM name>" --natpf1 "%service%,tcp,,%port%,,%port%" |
uname -a Linux debian5 2.6.26-2-686 #1 SMP Mon May 11 19:00:59 UTC 2009 i686 GNU/Linux aptitude install build-essential linux-headers-2.6.26-2-686 |
aptitude update aptitude upgrade |
APT
{
Default-Release "etch";
// Options for /etc/cron.daily/apt
Periodic
{
// same as defining APT::Periodic::xyz
Update-Package-Lists 1 ;
Download-Upgradeable-Packages 1 ;
Autoclean 1 ;
};
}; |
aptitude install anacron |
aptitude install openssh-server |
mkdir ~/.ssh touch ~/.ssh/authorized_keys chmod go-w ~ ~/.ssh ~/.ssh/authorized_keys |
RSAAuthentication no PasswordAuthentication no |
aptitude install libpam-chroot |
session required pam_chroot.so |
aptitude install makejail |
chroot="/home/jail01" packages=["base-files","base-passwd","bash","sed","coreutils","ncurses-base","ncurses-bin","nano"] useDepends=1 users=["root","dumbuser"] groups=["root","dumbuser"] forceCopy=["/etc/group","/etc/passwd","/home/dumbuser","/usr/bin/scp","/usr/bin/htpasswd"] |
cd /home/jail01/dev MAKEDEV generic |
umount /home/jail01/proc rmdir /home/jail01/proc |
dumbuser /home/jail01 |
mount -o bind -t proc /proc /home/jail01/proc mount -o bind -t udev /dev /home/jail01/dev mount -o bind -t devpts /dev/pts /home/jail01/dev/pts |
/proc /home/jail01/proc proc bind /dev /home/jail01/dev udev bind /dev/pts /home/jail01/dev/pts devpts bind |
aptitude install ntp |
*filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] # Punch holes for... # --> Established connections -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # --> Loopback -A INPUT -i lo -j ACCEPT # --> ICMP -A INPUT -p icmp -j ACCEPT # Punch holes for the following services... # --> SSH -A INPUT -p tcp --dport 22 -j ACCEPT ... more services ... # As we are polite reject all other packets -A INPUT -j REJECT -A FORWARD -j REJECT COMMIT |
netstat -tupan |
hostname -f |
zcat /usr/share/doc/resolvconf/README.gz |
aptitude pwgen |
pwgen -c -n -y |
#!/bin/sh ## Info taken from http://www.webmin.com/deb.html grep "deb http://download.webmin.com/download/repository sarge contrib" /etc/apt/sources.list >/dev/null || echo "deb http://download.webmin.com/download/repository sarge contrib" >>/etc/apt/sources.list aptitude update aptitude install webmin |
#!/bin/sh ## Use this script if you don't want Webmin's automatic setup and start from scratch /etc/webmin/stop echo "Deleting /etc/webmin..." rm -rf "/etc/webmin" /usr/share/webmin/setup.sh |
aptitude install apache2 php5 openssl ca-certificates |
invoke-rc.d apache2 stop invoke-rc.d apache2 start |
a2enmod ssl |
grep "^Listen 443$" /etc/apache2/ports.conf >/dev/null || echo "Listen 443" >>/etc/apache2/ports.conf |
find /etc/ssl/private/ -type f -exec chmod u=r,go= '{}' \; |
SSLEngine On SSLCertificateFile /etc/ssl/certs/server.crt SSLCertificateKeyFile /etc/ssl/private/server.key |
cat /etc/ssl/certs/root.pem /etc/ssl/certs/class3.pem >/etc/ssl/certs/CAcert_chain.pem |
SSLCertificateChainFile /etc/ssl/certs/CAcert_chain.pem |
apache2 -t |
openssl genrsa -out /etc/ssl/private/server.key 4096 |
openssl req -new -key /etc/ssl/private/server.key -out /etc/ssl/private/server.csr |
openssl x509 -req -days 3650 -signkey /etc/ssl/private/server.key -in /etc/ssl/private/server.csr -out /etc/ssl/certs/server.crt |
[ req_distinguished_name ] #countryName = Country Name (2 letter code) ... #organizationalUnitName_default = commonName = Common Name (eg, YOUR name) commonName_max = 64 emailAddress = Email Address emailAddress_max = 64 subjectAltName = Alternative Names (e.g. DNS:www.abc.com) |
# --> Global server configuration ServerSignature EMail ServerTokens Prod <Directory /> # ONLY use FollowSymLinks HERE so everything can be accessed with Alias # But NEVER use FollowSymLinks where a domain user can create symbolic links Options FollowSymLinks MultiViews AllowOverride None Order deny,allow Deny from all ... </Directory> # preparation for Alias /webmail /usr/share/squirrelmail <Directory /usr/share/squirrelmail> ... Order allow,deny Allow from all ... </Directory> # --> Domain configuration <VirtualHost 123.45.678.90:80> ... DocumentRoot /var/www/domain/httpdocs ... <Directory /> # --> Define password and group file for all directories AuthUserFile /var/www/domain/.htpasswd AuthGroupFile /var/www/domain/.htgroup </Directory> <Directory /var/www/domain> Options -FollowSymLinks </Directory> <Directory /var/www/domain/httpdocs> Options MultiViews AllowOverride AuthConfig Options=Indexes Order allow,deny Allow from all </Directory> Alias /webmail /usr/share/squirrelmail <Location /webmail> AuthName "Protected Area" AuthType Basic require user require group Mail SSLRequireSSL </Location> ... </VirtualHost> |
aptitude install sun-java6-jre |
proftpd -t /etc/proftpd/proftpd.conf |
mkdir /root/packages chown -R root:root /root/packages chmod -R u=rwx,go= /root/packages |
#!/bin/sh
# TSS2 package homepage at http://packages.qa.debian.org/t/teamspeak-server.html
# Prepare access to newer Lenny releases
grep '^deb-src http://ftp.debian.org/debian/ lenny non-free$' /etc/apt/sources.list >/dev/null || echo 'deb-src http://ftp.debian.org/debian/ lenny non-free' >>/etc/apt/sources.list
aptitude update
# Get build-essential (to handle the package sources), then the teamspeak-server package source and its dependencies
cd /root/packages
gpg --keyserver hkp://pgpkeys.pca.dfn.de --recv-keys C1F24EA4
aptitude install build-essential
apt-get -t lenny source teamspeak-server
apt-get -t lenny build-dep teamspeak-server
# Build the package
cd teamspeak-server-2.0.23.19
RC=$?
if [ ${RC} -ne 0 ]; then exit 1; fi
#
dpkg-buildpackage
echo The signing error at the end of the "dh_builddeb" step can be ignored.
cd ..
# Install the package
dpkg --install teamspeak-server_2.0.23.19-1_i386.deb
aptitude install teamspeak-server
# Print out the generated passwords
cat /etc/teamspeak-server/passwords |
aptitude install subversion |
mkdir /var/svn chown -R :svn /var/svn chmod -R ug+ws /var/svn |
mkdir /var/svn/TestRepo chown -R :svn /var/svn/TestRepo chmod -R ug+ws /var/svn/TestRepo su -c "umask 002; svnadmin create /var/svn/TestRepo" |
svnserve --daemon --root=/var/svn/ |
aptitude install subversion-tools |
#! /bin/sh ### BEGIN INIT INFO # Provides: Subversion Repository Server Daemon # Required-Start: $local_fs $remote_fs # Required-Stop: $local_fs $remote_fs # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # # Requirements: /var/run/svnserve/ with "svn:svn" # # Short-Description: Initscript for Subversion Repository Server Daemon # Description: Written for Debian 4.0 (Etch) to start/stop Subversion Repository Server Daemon # Used skeleton script of 4.0 (Etch). # # There are some specialities: # 1. A special SVN user and group is used and stated with # "--chuid svn:svn" (start-stop-daemon). # Plus a fitting "--umask 002" (start-stop-daemon). # 2. Make sure that the SVN user can write the pid file to # the folder "/var/run/svnserve/" by setting it to "svn:svn". # Otherwise svnserve will not start. # 3. The variable definition of PIDFILE has been moved before # DAEMON_ARGS, as it is used as an argument for svnserve. ### END INIT INFO # Author: Maddes - http://www.maddes.net/ # # Do NOT "set -e" # PATH should only include /usr/* if it runs after the mountnfs.sh script PATH=/sbin:/usr/sbin:/bin:/usr/bin DESC="Subversion Repository Server Daemon" NAME=svnserve PIDFILE=/var/run/svnserve/$NAME.pid DAEMON=/usr/bin/$NAME DAEMON_ARGS="--daemon --pid-file ${PIDFILE} --root=/var/svn/" SCRIPTNAME=/etc/init.d/$NAME # Exit if the package is not installed [ -x "$DAEMON" ] || exit 0 # Read configuration variable file if it is present [ -r /etc/default/$NAME ] && . /etc/default/$NAME # Load the VERBOSE setting and other rcS variables . /lib/init/vars.sh # Define LSB log_* functions. # Depend on lsb-base (>= 3.0-6) to ensure that this file is present. . /lib/lsb/init-functions # # Function that starts the daemon/service # do_start() { # Return # 0 if daemon has been started # 1 if daemon was already running # 2 if daemon could not be started start-stop-daemon --chuid svn:svn --umask 002 --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \ || return 1 start-stop-daemon --chuid svn:svn --umask 002 --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \ $DAEMON_ARGS \ || return 2 # Add code here, if necessary, that waits for the process to be ready # to handle requests from services started subsequently which depend # on this one. As a last resort, sleep for some time. } ... the rest is unchanged ... |
(If you used my previous approach, please delete the init.d file and deactivate it with "update-rc.d -f wake_on_pci remove". It was working but not correctly implemented.)
aptitude install ethtool |
#!/bin/sh
if [ ! -x /usr/sbin/ethtool ]
then
exit 0
fi
if [ "${METHOD}" = loopback ]
then
exit 0
fi
/usr/sbin/ethtool -s $IFACE wol g |
#!/bin/sh # Enable ACPI Power Management Events (PME) for Wake-on-LAN if they are disabled # for info see # http://www.intel.com/support/network/sb/CS-000084.htm # http://www.vdr-wiki.de/wiki/index.php/WAKE_ON_LAN # http://www.debian.org/doc/debian-policy/ch-opersys.html#s-sysvinit if (grep PCI0 /proc/acpi/wakeup | grep disabled 2>&1 >> /dev/null) then echo -n PCI0 > /proc/acpi/wakeup fi |
aptitude install tcpdump |
TCPDUMPLOGPATH=/var/log
TCPDUMPLOGNAME=shutdown_on_idle_tcpdump.log
TCPDUMPLOG=${TCPDUMPLOGPATH}/${TCPDUMPLOGNAME} |
#! /bin/sh # Prerequisites: # a) TCPDUMP package # aptitude install tcpdump # # Small script needed, because redirection can not be stated as an "argument" with start-stop-daemon # # First parameter: packet filter # Second parameter: log file # # The paramter "-c 1" is used, to avoid logging everything and bringing down the machine's performance. # This script will be restarted by the CRON job, if it doesn't run anymore. exec /usr/sbin/tcpdump -l -i any -f -n -q -tttt -c 1 "$1" > "$2" |
#! /bin/sh ### BEGIN INIT INFO # Provides: tcpdump logging network traffic on the defined ports # Required-Start: $local_fs $remote_fs # Required-Stop: $local_fs $remote_fs # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: Initscript for tcpdump logging for "shutdown on idle" system # Description: Starts tcpdump in the background to log network traffic # on specified port. The log can be used to find out # if the server's services are in use or have been idle # for a long time. # tcpdump is started via a script to allow for redirecting its standard output. # # Differences to the normal Debian 4.0 "Etch" skeleton: # - configuration variable file must be there and is read after LBS log_* functions # - check if all needed variables where set in the configuration variable file # - the tcpdump log file is deleted when starting and stopping # - a symbolic link in /etc/cron.d to the cron definition in /etc/shutdown_on_idle is created/deleted on start/stop # - on starting the parameter passing has been slighlty modified, quotes where added to give the # daemon args as one parameter and a second parameter was added for the log file ### END INIT INFO # Author: Maddes - http://www.maddes.net/ # # Do NOT "set -e" # PATH should only include /usr/* if it runs after the mountnfs.sh script PATH=/sbin:/usr/sbin:/bin:/usr/bin DESC="tcpdump logging for \"shutdown on idle\" system" NAME=shutdown_on_idle_tcpdump DAEMON=/usr/local/bin/${NAME} # Logging packets for the server's IP and the ports of FTP, SSH (for SFTP/SCP), HTTP/HTTPS, Subversion DAEMON_ARGS="dst host 10.0.0.253 and ( dst port 21 or dst port 22 or dst port 80 or dst port 443 or dst port 3690 )" PIDNAME=tcpdump PIDFILE=/var/run/${NAME}.pid SCRIPTNAME=/etc/init.d/${NAME} # To check: ps xa -f | grep tcpdump # Exit if the package is not installed [ -x "$DAEMON" ] || exit 0 # Load the VERBOSE setting and other rcS variables . /lib/init/vars.sh # Define LSB log_* functions. # Depend on lsb-base (>= 3.0-6) to ensure that this file is present. . /lib/lsb/init-functions # Maddes: Always read shared configuration variable file, exit with error if it is not present or if not all needed variables are set RC=0 [ ! -r "/etc/shutdown_on_idle/${NAME}" ] && RC=1 [ ${RC} -gt 0 ] && log_daemon_msg "Missing or unreadable /etc/shutdown_on_idle/${NAME}, check the setup" $NAME [ ${RC} -gt 0 ] && [ "$VERBOSE" != no ] && log_end_msg 1 [ ${RC} -gt 0 ] && exit 1 . /etc/shutdown_on_idle/${NAME} RC=0 [ -z "${TCPDUMPLOGPATH}" ] && RC=1 [ -z "${TCPDUMPLOGNAME}" ] && RC=1 [ -z "${TCPDUMPLOG}" ] && RC=1 [ ${RC} -gt 0 ] && log_daemon_msg "TCPDUMP Variables not set in /etc/shutdown_on_idle/${NAME}, check the setup" $NAME [ ${RC} -gt 0 ] && [ "$VERBOSE" != no ] && log_end_msg 1 [ ${RC} -gt 0 ] && exit 1 # # Function that starts the daemon/service # do_start() { # Return # 0 if daemon has been started # 1 if daemon was already running # 2 if daemon could not be started start-stop-daemon --make-pidfile --background --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \ || return 1 rm -f "${TCPDUMPLOG}" start-stop-daemon --make-pidfile --background --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \ "$DAEMON_ARGS" "${TCPDUMPLOG}"\ || return 2 # Add code here, if necessary, that waits for the process to be ready # to handle requests from services started subsequently which depend # on this one. As a last resort, sleep for some time. ln -s -f /etc/shutdown_on_idle/shutdown_on_idle_cron.conf /etc/cron.d/shutdown_on_idle } # # Function that stops the daemon/service # do_stop() { rm -f /etc/cron.d/shutdown_on_idle rm -f "${TCPDUMPLOG}" # Return # 0 if daemon has been stopped # 1 if daemon was already stopped # 2 if daemon could not be stopped # other if a failure occurred start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $PIDNAME RETVAL="$?" [ "$RETVAL" = 2 ] && return 2 # Wait for children to finish too if this is a daemon that forks # and if the daemon is only ever run from this initscript. # If the above conditions are not satisfied then add some other code # that waits for the process to drop all resources that could be # needed by services started subsequently. A last resort is to # sleep for some time. start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON [ "$?" = 2 ] && return 2 # Many daemons don't delete their pidfiles when they exit. rm -f $PIDFILE return "$RETVAL" } # # Function that sends a SIGHUP to the daemon/service # do_reload() { # # If the daemon can reload its configuration without # restarting (for example, when it is sent a SIGHUP), # then implement that here. # start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $PIDNAME return 0 } ... the rest is unchanged ... |
#! /bin/sh
#
# This script checks if the server was idle for a specified time
# and if so shuts it down.
#
# A veto file will be created if a test protests against a shutdown.
# This way you can concatenate several tests (network traffic,
# logged in users, etc.) and if one says "NO shutdown", then the script
# just stops. If no test complains, then the shutdown is executed.
# Author: Maddes - http://www.maddes.net/
#
##
## Script Functions
##
function do_rm_vetofile()
{
rm -f ${VETOFILE}
}
function do_log()
{
echo `date +"%x %T"` $* >> ${LOGFILE}
}
function do_no_shutdown()
{
do_log "Not idle because of" $*
do_rm_vetofile
exit 0
}
function do_shutdown()
{
do_log "ShutDown" $*
/sbin/poweroff
exit 0
}
function do_check_vetofile()
{
[ -f ${VETOFILE} ] && do_no_shutdown $*
}
function do_break()
{
do_log "BREAK:" $*
exit 1
}
##
## Script Variables
##
# General name used for files, etc. (=script name)
NAME=shutdown_on_idle
# The veto file
VETOFILE=/var/run/${NAME}.veto
# Log file for errors and/or for testing protocol
LOGFILE=/var/log/${NAME}.log
# The tcpdump log file variables are read from a shared configuration variable file, exit with error if it is not present or if not all needed variables are set
TCPDUMPNAME=${NAME}_tcpdump
PIDFILE=/var/run/${TCPDUMPNAME}.pid
[ ! -r "/etc/shutdown_on_idle/${TCPDUMPNAME}" ] && do_break "Missing or unreadable /etc/shutdown_on_idle/${TCPDUMPNAME}, check the setup"
. /etc/shutdown_on_idle/${TCPDUMPNAME}
[ -z "${TCPDUMPLOGPATH}" ] && do_break "TCPDUMP Variables not set in /etc/shutdown_on_idle/${TCPDUMPNAME}, check the setup"
[ -z "${TCPDUMPLOGNAME}" ] && do_break "TCPDUMP Variables not set in /etc/shutdown_on_idle/${TCPDUMPNAME}, check the setup"
[ -z "${TCPDUMPLOG}" ] && do_break "TCPDUMP Variables not set in /etc/shutdown_on_idle/${TCPDUMPNAME}, check the setup"
##
## Main Script
##
## 1. Preparations
# Remove any old veto file first
do_rm_vetofile
# Handle tcpdump
# a.) Reactivate tcpdump if it has stopped since last check
if [ ! -f "${PIDFILE}" ]
then
/usr/sbin/invoke-rc.d ${TCPDUMPNAME} start
else
ps -p `cat "${PIDFILE}"` 1>/dev/null 2>&1
RC=$?
[ ${RC} -gt 0 ] && /usr/sbin/invoke-rc.d ${TCPDUMPNAME} restart;
fi
# b.) Check tcpdump log
[ ! -f "${TCPDUMPLOG}" ] && do_break "Missing ${TCPDUMPLOG}, check that corresponding init script is invoked"
## 2. Tests
# Check active users
RC=`who | wc -l`
[ ${RC} -gt 0 ] && touch ${VETOFILE}
do_check_vetofile "Active Users"
# Check network traffic
find "${TCPDUMPLOGPATH}" -name "${TCPDUMPLOGNAME}" -type f -mmin -60 -exec touch ${VETOFILE} \;
do_check_vetofile "Network Traffic"
## 3. ShutDown
do_shutdown |
# crontab fragment for "shutdown on idle" system # Check for idle every 5 minutes starting from the first minute of the hour 1-59/5 * * * * root /usr/local/bin/shutdown_on_idle |
| Top | Start | Kontakt |