OS：RedHat Enterprise Linux 6.4
1. 掛載RHEL Source
# mount /dev/cdrom /mnt
2. 複製光碟內容到Local Disk
# mkdir /rhel-source
# cp -arf /mnt/. /rhel-source/.
3. 建立YUM設定檔
# vi /etc/yum.repo.d/local-source.repo
[local-source]
name=local-source
baseurl=file:///rhel-source
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
4. 安裝X Windows
# yum groupinstall "X Window System"
5. 安裝Desktop
# yum groupinstall Desktop
6. 安裝中文支援
# yum groupinstall "Chinese Support"
# vi /etc/sysconfig/i18n
LANG="en_US.UTF-8" 修改成 LANG="zh_TW.UTF-8"
7. 將開機環境修改成圖形介面
# vi /etc/inittab
id:3:initdefault: 修改成 id:5:initdefault:
8. 重新開機讓設定生效
# reboot
參考文章：
http://hi.baidu.com/kevin276/item/7426f6091a8180e7fe240d41
http://hi.baidu.com/marine_xun/item/697a999438649639326eeb6f
http://blog.zipe.idv.tw/2010/05/centosredhat.html
2013年11月25日 星期一
2011年4月27日 星期三
DenyHost
OS：CentOS 5.5
Requirements：
python2.4
DenyHosts-2.5
1. 下載DenyHosts binary distribution
wget http://sourceforge.net/projects/denyhosts/files/denyhosts/2.5/DenyHosts-2.5-python2.4.noarch.rpm/download
2. 安裝RPM
rpm -ivh DenyHosts-2.5-python2.4.noarch.rpm
3. 配置DenyHosts組態設定
cd /usr/share/denyhosts/
cp denyhosts.cfg-dist denyhosts.cfg
vi denyhosts.cfg
#SECURE_LOG=/private/var/log/system.log
...
BLOCK_SERVICE = ALL (封阻異常來源存取任何服務)
#BLOCK_SERVICE = sshd
...
ADMIN_EMAIL = webmaster@test.com (自訂管理者信箱)
SMTP_HOST = mail.test.com (自訂mail server)
SMTP_PORT = 25
SMTP_USERNAME=testuser (mail server驗證用帳號)
SMTP_PASSWORD=testpw (mail server驗證帳號用密碼)
4. 修改DenyHosts Scripts檔案內容
cp daemon-control-dist daemon-control
vi daemon-control
DENYHOSTS_BIN = "/usr/bin/denyhosts.py"
DENYHOSTS_LOCK = "/var/lock/subsys/denyhosts"
DENYHOSTS_CFG = "/usr/share/denyhosts/denyhosts.cfg"
chown root /usr/share/denyhosts/daemon-control
chmod 700 /usr/share/denyhosts/daemon-control
/usr/share/denyhosts/daemon-control start
5. 設定開機自動啟動
cd /etc/init.d/
ln -s /usr/share/denyhosts/daemon-control denyhosts
chkconfig --add denyhosts
chkconfig denyhosts on
/etc/init.d/denyhosts restart
參考文章：
http://denyhosts.sourceforge.net/
http://blog.csdn.net/qiudakun/archive/2010/11/26/6036852.aspx
http://linux-guys.blogspot.com/2011/01/denyhosts.html
Requirements：
python2.4
DenyHosts-2.5
1. 下載DenyHosts binary distribution
wget http://sourceforge.net/projects/denyhosts/files/denyhosts/2.5/DenyHosts-2.5-python2.4.noarch.rpm/download
2. 安裝RPM
rpm -ivh DenyHosts-2.5-python2.4.noarch.rpm
3. 配置DenyHosts組態設定
cd /usr/share/denyhosts/
cp denyhosts.cfg-dist denyhosts.cfg
vi denyhosts.cfg
#SECURE_LOG=/private/var/log/system.log
...
BLOCK_SERVICE = ALL (封阻異常來源存取任何服務)
#BLOCK_SERVICE = sshd
...
ADMIN_EMAIL = webmaster@test.com (自訂管理者信箱)
SMTP_HOST = mail.test.com (自訂mail server)
SMTP_PORT = 25
SMTP_USERNAME=testuser (mail server驗證用帳號)
SMTP_PASSWORD=testpw (mail server驗證帳號用密碼)
4. 修改DenyHosts Scripts檔案內容
cp daemon-control-dist daemon-control
vi daemon-control
DENYHOSTS_BIN = "/usr/bin/denyhosts.py"
DENYHOSTS_LOCK = "/var/lock/subsys/denyhosts"
DENYHOSTS_CFG = "/usr/share/denyhosts/denyhosts.cfg"
chown root /usr/share/denyhosts/daemon-control
chmod 700 /usr/share/denyhosts/daemon-control
/usr/share/denyhosts/daemon-control start
5. 設定開機自動啟動
cd /etc/init.d/
ln -s /usr/share/denyhosts/daemon-control denyhosts
chkconfig --add denyhosts
chkconfig denyhosts on
/etc/init.d/denyhosts restart
參考文章：
http://denyhosts.sourceforge.net/
http://blog.csdn.net/qiudakun/archive/2010/11/26/6036852.aspx
http://linux-guys.blogspot.com/2011/01/denyhosts.html
2011年4月15日 星期五
入侵防禦系統(IPS) - Guardian
OS：CentOS 5.5
Requirements：
Snort
Guardian
承接入侵偵測系統(IDS) - Snort一文
1. 下載Guardian
wget http://www.chaotic.org/guardian/guardian-1.7.tar.gz
2. 接壓縮Guardian
tar -zxvf guardian-1.7.tar.gz
3. 配置Guardian環境
cd guardian-1.7
cp scripts/guardian_block.sh /usr/local/bin/guardian_block.sh
cp scripts/guardian_unblock.sh /usr/local/bin/guardian_unblock.sh
cp guardian.conf /etc/
cp guardian.pl /usr/local/bin/
vi /etc/guardian.conf
AlertFile /var/log/snort/alert
touch /var/log/guardian.log
4. 啟動服務
/usr/local/bin/guardian.pl -c /etc/guardian.conf
5. 設定開機啟動
vi /etc/rc.local
/usr/local/bin/guardian.pl -c /etc/guardian.conf
參考文章：
http://www.chaotic.org/guardian/
Requirements：
Snort
Guardian
承接入侵偵測系統(IDS) - Snort一文
1. 下載Guardian
wget http://www.chaotic.org/guardian/guardian-1.7.tar.gz
2. 接壓縮Guardian
tar -zxvf guardian-1.7.tar.gz
3. 配置Guardian環境
cd guardian-1.7
cp scripts/guardian_block.sh /usr/local/bin/guardian_block.sh
cp scripts/guardian_unblock.sh /usr/local/bin/guardian_unblock.sh
cp guardian.conf /etc/
cp guardian.pl /usr/local/bin/
vi /etc/guardian.conf
AlertFile /var/log/snort/alert
touch /var/log/guardian.log
4. 啟動服務
/usr/local/bin/guardian.pl -c /etc/guardian.conf
5. 設定開機啟動
vi /etc/rc.local
/usr/local/bin/guardian.pl -c /etc/guardian.conf
參考文章：
http://www.chaotic.org/guardian/
2011年4月14日 星期四
入侵偵測系統(IDS) - Snort
OS：CentOS 5.5
Requirements：
IP：192.168.173.105/24
GW：192.168.173.1
LAN Interface
IP：192.168.211.1/24
GW：192.168.173.105
1. 安裝相依套件
yum install pcre-devel gcc gcc-c++ flex
yum install mysql-devel mysql mysql-server
2. 設置資料庫管理者帳號
/etc/init.d/mysqld restart
chkconfig mysqld on
mysqladmin -u root password '管理者密碼'
3. 下載libdnet
tar -zxvf libdnet-1.12.tgz
cd libdnet-1.12
./configure
make
make install
4. 更新libpcap
yum erace libpcap
tar -zxvf libpcap-1.1.1.tar.gz
cd libpcap-1.0.0
./configure
make
make install
5. 下載DAQ
tar -zxvf daq-0.5.tar.gz
cd daq-0.5
./configure
make
make install
6. 下載Snort以及Snort Rules
下載snort rules需註冊為snort會員才可下載
tar -zxvf snort-2.9.0.5.tar.gz
cd snort-2.9.0.5
./configure --with-mysql --enable-dynamicplugin --enable-ipv6 --enable-gre --enable-mpls --enable-targetbased --enable-decoder-preprocessor-rules --enable-ppm --enable-perfprofiling --enable-zlib --enable-active-response --enable-normalizer --enable-reload --enable-react --enable-flexresp3
make
make install
7. 配置Snort
groupadd snort
useradd -g snort snort -s /sbin/nologin
mkdir /etc/snort
cp -r etc/* /etc/snort
mkdir /var/log/snort
vi /etc/snort/snort.conf
8. 配置Snort Rules
tar -zxvf snortrules-snapshot-2904.tar.gz -C /etc/snort/
ln -s /etc/snort/so_rules/precompiled/Centos-5-4/i386/2.9.0.4 /usr/local/lib/snort_dynamicrules
vi /etc/snort/snort.conf
# Path to your rules files (this can be a relative path)
# Note for Windows users: You are advised to make this an absolute path,
# such as: c:\snort\rules
var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules
9. 測試Configuration是否配置無誤
snort -T -c /etc/snort/snort.conf
10. 將Snort偵測到的事件存入資料庫
vi /etc/snort/snort.conf
# database
output database: log, mysql, user=snort password=自訂使用者密碼 dbname=snortdb host=localhost
mysql -u root -p
mysql> create database snortdb；
mysql> use snortdb
mysql> grant all on snortdb.* to snort@localhost identified by '自訂使用者密碼'；
mysql> flush privileges；
mysql> quit
cd snort-2.9.0.5/schemas
mysql -u root -p snortdb < create_mysql
11. 測試Snort加入資料庫是否正常
snort -T -c /etc/snort/snort.conf
12. 以Deamon方式啟動Snort
/usr/local/bin/snort -d -A full -i eth0 -c /etc/snort/snort.conf -l /var/log/snort -D
-d Data
-A Alert
-i Interface
-c Configuration
-l Log file
-D Deamon
13. 設定開機啟動
vi /etc/rc.local
snort -d -A full -i eth0 -c /etc/snort/snort.conf -l /var/log/snort -D
參考文章：
http://www.snort.org/
http://zh.wikipedia.org/wiki/Snort
https://forums.snort.org/forums/snort-newbies/topics/daq_static-library-not-found
http://forum.icst.org.tw/phpbb/viewtopic.php?f=11&t=19216
Requirements：
libpcap = 1.0.0
gcc gcc-c++ pcre-devel
flex daq libdnet
mysql mysql-server mysql-devel
Interfaces：
WAN InterfaceIP：192.168.173.105/24
GW：192.168.173.1
LAN Interface
IP：192.168.211.1/24
GW：192.168.173.105
1. 安裝相依套件
yum install pcre-devel gcc gcc-c++ flex
yum install mysql-devel mysql mysql-server
2. 設置資料庫管理者帳號
/etc/init.d/mysqld restart
chkconfig mysqld on
mysqladmin -u root password '管理者密碼'
3. 下載libdnet
tar -zxvf libdnet-1.12.tgz
cd libdnet-1.12
./configure
make
make install
4. 更新libpcap
yum erace libpcap
tar -zxvf libpcap-1.1.1.tar.gz
cd libpcap-1.0.0
./configure
make
make install
5. 下載DAQ
tar -zxvf daq-0.5.tar.gz
cd daq-0.5
./configure
make
make install
6. 下載Snort以及Snort Rules
下載snort rules需註冊為snort會員才可下載
tar -zxvf snort-2.9.0.5.tar.gz
cd snort-2.9.0.5
./configure --with-mysql --enable-dynamicplugin --enable-ipv6 --enable-gre --enable-mpls --enable-targetbased --enable-decoder-preprocessor-rules --enable-ppm --enable-perfprofiling --enable-zlib --enable-active-response --enable-normalizer --enable-reload --enable-react --enable-flexresp3
make
make install
7. 配置Snort
groupadd snort
useradd -g snort snort -s /sbin/nologin
mkdir /etc/snort
cp -r etc/* /etc/snort
mkdir /var/log/snort
vi /etc/snort/snort.conf
# Setup the network addresses you are protecting
ipvar HOME_NET 192.168.211.0/24 (定義受保護的網段)
# Set up the external network addresses. Leave as "any" in most situations
ipvar EXTERNAL_NET !192.168.211.0/24 (定義監控的網段)
8. 配置Snort Rules
tar -zxvf snortrules-snapshot-2904.tar.gz -C /etc/snort/
ln -s /etc/snort/so_rules/precompiled/Centos-5-4/i386/2.9.0.4 /usr/local/lib/snort_dynamicrules
vi /etc/snort/snort.conf
# Path to your rules files (this can be a relative path)
# Note for Windows users: You are advised to make this an absolute path,
# such as: c:\snort\rules
var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules
9. 測試Configuration是否配置無誤
snort -T -c /etc/snort/snort.conf
10. 將Snort偵測到的事件存入資料庫
vi /etc/snort/snort.conf
# database
output database: log, mysql, user=snort password=自訂使用者密碼 dbname=snortdb host=localhost
mysql -u root -p
mysql> create database snortdb；
mysql> use snortdb
mysql> grant all on snortdb.* to snort@localhost identified by '自訂使用者密碼'；
mysql> flush privileges；
mysql> quit
cd snort-2.9.0.5/schemas
mysql -u root -p snortdb < create_mysql
11. 測試Snort加入資料庫是否正常
snort -T -c /etc/snort/snort.conf
12. 以Deamon方式啟動Snort
/usr/local/bin/snort -d -A full -i eth0 -c /etc/snort/snort.conf -l /var/log/snort -D
-d Data
-A Alert
-i Interface
-c Configuration
-l Log file
-D Deamon
13. 設定開機啟動
vi /etc/rc.local
snort -d -A full -i eth0 -c /etc/snort/snort.conf -l /var/log/snort -D
參考文章：
http://www.snort.org/
http://zh.wikipedia.org/wiki/Snort
https://forums.snort.org/forums/snort-newbies/topics/daq_static-library-not-found
http://forum.icst.org.tw/phpbb/viewtopic.php?f=11&t=19216
2010年12月1日 星期三
FreeRADIUS + AD 帳號驗證
今天終於完成 radius + AD 的帳號驗證
趕快記下來~
OS：CentOS 5.5
環境說明；
Domain：TEST.COM
DC：dc.test.com (192.168.173.104)
Radius：rads.test.com (192.168.173.103)
Requirment：
samba
krb5-server
freeradius2 freeradius2-utils
1. 設定主機對應IP
vi /etc/sysconfig/network
HOSTNAME=rads.test.com
vi /etc/hosts
192.168.173.104 dc.test.com
192.168.173.103 rads.test.com
2. 設定Samba作為對AD的溝通橋樑
yum install samba
vi /etc/samba/smb.conf
[global]
workgroup = test
realm = TEST.COM
netbios name = rads
security = ads
password server = dc.test.com [DC的FQDN]
winbind separator = +
idmap uid = 10000-20000 [設定網域帳號id範圍]
idmap gid = 10000-20000 [設定網域群組id範圍]
winbind enum users = yes
winbind enum groups = yes
nt acl support = yes
winbind cache time = 0
template shell = /bin/bash
template homedir = /home/%U
winbind use default domain = yes
3. 設定kerberos認證機制，AD使用kerberos認證機制
vi /etc/krb5.conf
...
[libdefaults]
default_realm = TEST.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes
[realms]
TEST.COM = {
kdc = dc.test.com:88
admin_server = dc.test.com:749
default_domain = test.com
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = TEST.COM
...
yum install krb5-server
vi /var/kerberos/krb5kdc/kdc.conf
...
[realms]
TEST.COM = {
...
4. 測試Samba與kdc是否可以正常溝通
kinit administrator@TEST.COM
5. 將Radius Server加入Domain
/etc/init.d/smb start； chkconfig smb on
net rpc join -U administrator
6. 修改系統帳號驗證
vi /etc/nsswitch.conf
passwd: files winbind
shadow: files winbind
group: files winbind
7. 檢驗是否有匯入AD帳號
/etc/init.d/winbind start； chkconfig winbind on
wbinfo -u (或是 getent passwd)
ntlm_auth --request-nt-key --domain=TEST --username=administrator --password=AD管理者密碼
8. 安裝FreeRADIUS套件
yum install freeradius2 freeradius2-utils
9. 加入ntlm_auth驗證模組至radius
vi /etc/raddb/modules/ntlm_auth
exec ntlm_auth {
wait = yes
program = "/path/to/ntlm_auth --request-nt-key --domain=TEST --username=%{mschap:User-Name} --password=%{User-Password}"
}
...
ntlm_auth
...
}
...
ntlm_auth
...
}
趕快記下來~
OS：CentOS 5.5
環境說明；
Domain：TEST.COM
DC：dc.test.com (192.168.173.104)
Radius：rads.test.com (192.168.173.103)
Requirment：
samba
krb5-server
freeradius2 freeradius2-utils
1. 設定主機對應IP
vi /etc/sysconfig/network
HOSTNAME=rads.test.com
vi /etc/hosts
192.168.173.104 dc.test.com
192.168.173.103 rads.test.com
2. 設定Samba作為對AD的溝通橋樑
yum install samba
vi /etc/samba/smb.conf
[global]
workgroup = test
realm = TEST.COM
netbios name = rads
security = ads
password server = dc.test.com [DC的FQDN]
winbind separator = +
idmap uid = 10000-20000 [設定網域帳號id範圍]
idmap gid = 10000-20000 [設定網域群組id範圍]
winbind enum users = yes
winbind enum groups = yes
nt acl support = yes
winbind cache time = 0
template shell = /bin/bash
template homedir = /home/%U
winbind use default domain = yes
3. 設定kerberos認證機制，AD使用kerberos認證機制
vi /etc/krb5.conf
...
[libdefaults]
default_realm = TEST.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes
[realms]
TEST.COM = {
kdc = dc.test.com:88
admin_server = dc.test.com:749
default_domain = test.com
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = TEST.COM
...
yum install krb5-server
vi /var/kerberos/krb5kdc/kdc.conf
...
[realms]
TEST.COM = {
...
4. 測試Samba與kdc是否可以正常溝通
kinit administrator@TEST.COM
5. 將Radius Server加入Domain
/etc/init.d/smb start； chkconfig smb on
net rpc join -U administrator
6. 修改系統帳號驗證
vi /etc/nsswitch.conf
passwd: files winbind
shadow: files winbind
group: files winbind
7. 檢驗是否有匯入AD帳號
/etc/init.d/winbind start； chkconfig winbind on
wbinfo -u (或是 getent passwd)
ntlm_auth --request-nt-key --domain=TEST --username=administrator --password=AD管理者密碼
8. 安裝FreeRADIUS套件
yum install freeradius2 freeradius2-utils
9. 加入ntlm_auth驗證模組至radius
vi /etc/raddb/modules/ntlm_auth
exec ntlm_auth {
wait = yes
program = "/path/to/ntlm_auth --request-nt-key --domain=TEST --username=%{mschap:User-Name} --password=%{User-Password}"
}
10. 修改radius驗證機制
vi /etc/
raddb/sites-enabled/default authenticate {ntlm_auth
...
}
vi /etc/raddb/sites-enabled/inner-tunnel...
ntlm_auth
...
}
11. 修改/etc/raddb/users
DEFAULT Auth-Type = ntlm_auth
12. 測試帳號驗證機制
radiusd -X
radtest user password localhost 0 testing123
2010年11月20日 星期六
FreeRADIUS帳號驗證機制整合(OpenLDAP)
OS：CentOS 5.3
1. 安裝相依套件
yum install freeradius2 freeradius2-utils freeradius2-ldap
2. 配置RADIUS使用LDAP機制
vi /etc/raddb/modules/ldap
server = "ldap.bigone.com" [ldap server位置]
identity = "cn=Manager,dc=bigone,dc=com" [ldap管理者帳號]
password = testing [ldap管理者密碼]
basedn = "ou=user,ou=login,dc=bigone,dc=com" [ldap使用者對應位置]
vi /etc/raddb/site-enabled/default
authorize {
...
# files
ldap
...
authenticate {
3. 驗證使用者帳號
radius -X
radtest ldap使用者帳號 ldap使用者密碼 127.0.0.1 0 testing123
1. 安裝相依套件
yum install freeradius2 freeradius2-utils freeradius2-ldap
2. 配置RADIUS使用LDAP機制
vi /etc/raddb/modules/ldap
server = "ldap.bigone.com" [ldap server位置]
identity = "cn=Manager,dc=bigone,dc=com" [ldap管理者帳號]
password = testing [ldap管理者密碼]
basedn = "ou=user,ou=login,dc=bigone,dc=com" [ldap使用者對應位置]
vi /etc/raddb/site-enabled/default
authorize {
...
# files
ldap
...
authenticate {
...
Auth-Type LDAP {
ldap
}
...
}3. 驗證使用者帳號
radius -X
radtest ldap使用者帳號 ldap使用者密碼 127.0.0.1 0 testing123
FreeRADIUS帳號驗證機制整合(MySQL)
OS：CentOS 5.3
1. 安裝相依套件
yum install freeradius2 freeradius2-mysql freeradius2-utils mysql mysql-server
2. 資料庫設定
/etc/init.d/mysqld start
chkconfig mysqld on
mysqladmin -u root password '管理者密碼'
3. 建立對應驗證資料庫
mysql -u root -p
create database radius;
grant all on radius.* to radius@localhost identified by 'radius';
exit
4. 建立驗證資料庫資料結構
mysql -u root -p radius < /etc/raddb/sql/mysql/schema.sql
5. 設定RADIUS使用資料庫驗證
vi /etc/raddb/sql.conf
database = "mysql"
server = "localhost"
login = "radius"
password = "radius"
radius_db = "radius"
vi /etc/raddb/radiusd.conf
$INCLUDE sql.conf
vi /etc/raddb/sites-enabled/default
authorize {
...
# files
sql
...
}
accounting {
...
sql
...
}
post-auth {
...
sql
...
}
6. 建立測試驗證使用者帳號
mysql -u root -p
INSERT INTO `radius`.`radcheck` (`id`, `username`, `attribute`, `op`, `value`) VALUES (NULL, 'test', 'Cleartext-Password', ':=', 'testing');
exit
7. 驗證使用者帳號
radius -X
radtest test testing 127.0.0.1 0 testing123
1. 安裝相依套件
yum install freeradius2 freeradius2-mysql freeradius2-utils mysql mysql-server
2. 資料庫設定
/etc/init.d/mysqld start
chkconfig mysqld on
mysqladmin -u root password '管理者密碼'
3. 建立對應驗證資料庫
mysql -u root -p
create database radius;
grant all on radius.* to radius@localhost identified by 'radius';
exit
4. 建立驗證資料庫資料結構
mysql -u root -p radius < /etc/raddb/sql/mysql/schema.sql
5. 設定RADIUS使用資料庫驗證
vi /etc/raddb/sql.conf
database = "mysql"
server = "localhost"
login = "radius"
password = "radius"
radius_db = "radius"
vi /etc/raddb/radiusd.conf
$INCLUDE sql.conf
vi /etc/raddb/sites-enabled/default
authorize {
...
# files
sql
...
}
accounting {
...
sql
...
}
post-auth {
...
sql
...
}
6. 建立測試驗證使用者帳號
mysql -u root -p
INSERT INTO `radius`.`radcheck` (`id`, `username`, `attribute`, `op`, `value`) VALUES (NULL, 'test', 'Cleartext-Password', ':=', 'testing');
exit
7. 驗證使用者帳號
radius -X
radtest test testing 127.0.0.1 0 testing123
2010年11月11日 星期四
Captive Portal - CoovaChilli
OS：CentOS 5.5
Requirment：
gcc
openssl openssl-devel
haserl
iptables
1. 安裝二片網卡
vi /etc/sysconfig/network-scripts/ifcfg-eth0 [外網卡]
DEVICE=eth0
BOOTPROTO=static
ONBOOT=yes
IPADDR=192.168.173.103
NETMASK=255.255.255.0
GATEWAY=192.168.173.1
vi /etc/sysconfig/network-scripts/ifcfg-eth1 [內網卡]
DEVICE=eth1
BOOTPROTO=static
ONBOOT=yes
IPADDR=10.1.0.1
NETMASK=255.255.255.0
GATEWAY=192.168.173.103
2. 安裝相依套件
yum install gcc openssl openssl-devel
3. 下載Haserl套件包
wget http://sourceforge.net/projects/haserl/files/haserl-devel/0.9.26/haserl-0.9.26.tar.gz/download
4. 解壓縮，編譯安裝
tar -zxvf haserl-0.9.26.tar.gz
cd haserl-0.9.26
./configure
make； make install
5. 下載Coova-Chilli套件包
cd ~
wget http://ap.coova.org/chilli/coova-chilli-1.2.5.tar.gz
6. 解壓縮，編譯安裝
tar -zxvf coova-chilli-1.2.5.tar.gz
cd coova-chilli-1.2.5
./configure --enable-miniportal --with-openssl
make； make install
7. 建置Coova-Chilli程式執行PID存放目錄
mkdir -p /usr/local/var/run
8. 修改chilli script執行檔
vi /usr/local/etc/init.d/chilli
start)
...
$(which start-stop-daemon 2>/dev/null)
stop)
...
$(which start-stop-daemon 2>/dev/null)
9. 設定開機啟動chilli
ln -s /usr/local/etc/init.d/chilli /etc/init.d/chilli
chkconfig chilli on
10. 設定chilli組態檔
cd /usr/local/etc/chilli
cp defaults config
vi config
HS_WANIF=eth0 [對外網卡]
HS_LANIF=eth1 [對內網卡]
HS_NETWORK=10.1.0.0 [內網網段]
HS_NETMASK=255.255.255.0 [內網netmask]
HS_UAMLISTEN=10.1.0.1 [內網卡IP]
HS_DNS1=168.95.1.1 [指派內往使用DNS]
HS_RADIUS=localhost [radius server]
HS_RADSECRET=testing123 [radius溝通密碼]
11. 設定Chilli主機路由
yum install iptables
12. 設定chilli server的NAT機制，並且開機啟動
vi /etc/sysctl.conf
net.ipv4.ip_forward = 1
echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -s 10.1.0.0/24 -d 192.168.173.103 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.173.103 -d 10.1.0.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.1.0.0/24 -d 192.168.173.103 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.173.103 -d 10.1.0.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.1.0.0/24 -o eth0 -j SNAT --to-source 192.168.173.103
iptables-save > nat_rule
cp nat_rule /etc/sysconfig/iptables
13. 安裝radius機制驗證
yum install freeradius2 freeradius2-utils
14. 建立使用者，驗證radius機制
vi /etc/raddb
test Cleartext-Password := "testing"
radiusd -X
radtest test testing 127.0.0.1 0 testing123
15. 使用內網主機測試
開啟瀏覽器上網，會自動導到Chiili Captive Portal驗證頁面，輸入radius上建立的帳密即可
參考文章：
http://coova.org/CoovaChilli
http://www.communig8.com/articles/78-coovachilli-test-vm-configuration-part-i-31-august-2010.html
http://www.communig8.com/articles/79-coovachilli-test-vm-configuration-part-ii-1-september-2010.html
http://www.freeradius.org
Requirment：
gcc
openssl openssl-devel
haserl
coovachilli
freeradius2 freeradius2-utilsiptables
1. 安裝二片網卡
vi /etc/sysconfig/network-scripts/ifcfg-eth0 [外網卡]
DEVICE=eth0
BOOTPROTO=static
ONBOOT=yes
IPADDR=192.168.173.103
NETMASK=255.255.255.0
GATEWAY=192.168.173.1
vi /etc/sysconfig/network-scripts/ifcfg-eth1 [內網卡]
DEVICE=eth1
BOOTPROTO=static
ONBOOT=yes
IPADDR=10.1.0.1
NETMASK=255.255.255.0
GATEWAY=192.168.173.103
2. 安裝相依套件
yum install gcc openssl openssl-devel
3. 下載Haserl套件包
wget http://sourceforge.net/projects/haserl/files/haserl-devel/0.9.26/haserl-0.9.26.tar.gz/download
4. 解壓縮，編譯安裝
tar -zxvf haserl-0.9.26.tar.gz
cd haserl-0.9.26
./configure
make； make install
5. 下載Coova-Chilli套件包
cd ~
wget http://ap.coova.org/chilli/coova-chilli-1.2.5.tar.gz
6. 解壓縮，編譯安裝
tar -zxvf coova-chilli-1.2.5.tar.gz
cd coova-chilli-1.2.5
./configure --enable-miniportal --with-openssl
make； make install
7. 建置Coova-Chilli程式執行PID存放目錄
mkdir -p /usr/local/var/run
8. 修改chilli script執行檔
vi /usr/local/etc/init.d/chilli
start)
...
$(which start-stop-daemon 2>/dev/null)
stop)
...
$(which start-stop-daemon 2>/dev/null)
9. 設定開機啟動chilli
ln -s /usr/local/etc/init.d/chilli /etc/init.d/chilli
chkconfig chilli on
10. 設定chilli組態檔
cd /usr/local/etc/chilli
cp defaults config
vi config
HS_WANIF=eth0 [對外網卡]
HS_LANIF=eth1 [對內網卡]
HS_NETWORK=10.1.0.0 [內網網段]
HS_NETMASK=255.255.255.0 [內網netmask]
HS_UAMLISTEN=10.1.0.1 [內網卡IP]
HS_DNS1=168.95.1.1 [指派內往使用DNS]
HS_RADIUS=localhost [radius server]
HS_RADSECRET=testing123 [radius溝通密碼]
11. 設定Chilli主機路由
yum install iptables
12. 設定chilli server的NAT機制，並且開機啟動
vi /etc/sysctl.conf
net.ipv4.ip_forward = 1
echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -s 10.1.0.0/24 -d 192.168.173.103 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.173.103 -d 10.1.0.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.1.0.0/24 -d 192.168.173.103 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.173.103 -d 10.1.0.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.1.0.0/24 -o eth0 -j SNAT --to-source 192.168.173.103
iptables-save > nat_rule
cp nat_rule /etc/sysconfig/iptables
13. 安裝radius機制驗證
yum install freeradius2 freeradius2-utils
14. 建立使用者，驗證radius機制
vi /etc/raddb
test Cleartext-Password := "testing"
radiusd -X
radtest test testing 127.0.0.1 0 testing123
15. 使用內網主機測試
開啟瀏覽器上網，會自動導到Chiili Captive Portal驗證頁面，輸入radius上建立的帳密即可
參考文章：
http://coova.org/CoovaChilli
http://www.communig8.com/articles/78-coovachilli-test-vm-configuration-part-i-31-august-2010.html
http://www.communig8.com/articles/79-coovachilli-test-vm-configuration-part-ii-1-september-2010.html
http://www.freeradius.org
2010年11月9日 星期二
2010年11月5日 星期五
CentOS 5 PHP5.1 to PHP 5.2
OS：CentOS 5.3
Requirments：
php
1. 新增套件庫
vi /etc/yum.repos.d/CentOS-Testing.repo
2. 貼上以下內容
[c5-testing]
name=CentOS-5 Testing
baseurl=http://dev.centos.org/centos/$releasever/testing/$basearch/
enabled=1
gpgcheck=1
gpgkey=http://dev.centos.org/centos/RPM-GPG-KEY-CentOS-testing
includepkgs=php*
3. 安裝更新後的PHP套件
yum install php
4. 檢查套件
rpm -qa | grep php
5. 從起服務讓環境生效
/etc/init.d/httpd restart
參考文章：
http://wiki.centos.org/HowTos/PHP_5.1_To_5.2
Requirments：
php
1. 新增套件庫
vi /etc/yum.repos.d/CentOS-Testing.repo
2. 貼上以下內容
[c5-testing]
name=CentOS-5 Testing
baseurl=http://dev.centos.org/centos/$releasever/testing/$basearch/
enabled=1
gpgcheck=1
gpgkey=http://dev.centos.org/centos/RPM-GPG-KEY-CentOS-testing
includepkgs=php*
3. 安裝更新後的PHP套件
yum install php
4. 檢查套件
rpm -qa | grep php
5. 從起服務讓環境生效
/etc/init.d/httpd restart
參考文章：
http://wiki.centos.org/HowTos/PHP_5.1_To_5.2
2010年10月27日 星期三
Web High Availability (HA)
今天完成了Web High Availability
以下記錄整個操作過程
OS：Fedora 13
Requirments：
heartbeat
環境配置：
虛擬IP(VIP)：192.168.249.100
Real Server 01
hostname：ha01
Interface：eth1
IP：192.168.249.11
GATEWA：192.168.249.2
Real Server 02
hostname：ha02
Interface：eth1
IP：192.168.249.12
GATEWA：192.168.249.2
1. [以下先以ha01做設定]設定主機名稱
hostname ha01(重開機會重設)
vi /etc/sysconfig/network --> HOSTNAME=ha01
2. 修改hosts檔
vi /etc/hosts
加入192.168.1.11 ha01
192.168.1.12 ha02
3. 安裝套件
yum install heartbeat httpd
4. 複製組態檔
cp /usr/share/doc/heartbeat-3.0.0/authkeys /etc/ha.d/
cp /usr/share/doc/heartbeat-3.0.0/ha.cf /etc/ha.d/
cp /usr/share/doc/heartbeat-3.0.0/haresources /etc/ha.d/
5. 修改authkeys
vi /etc/ha.d/authkeys
加入 auth 1
1 crc
6. 修改authkeys權限
chmod 600 /etc/ha.d/authkeys
7. 修改ha.cf
vi /etc/ha.d/ha.cf
logfile /var/log/ha.log
logfacility local0
keepalive 2
deadtime 30
initdead 120
bcast eth1
updport 694
auto_failback on
node ha01
node ha02
ping 192.168.249.2
respawn hacluster /usr/lib/heartbeat/ipfail
apiauth ipfail gid=haclient uid=hacluster
8. 修改haresources
vi /etc/ha.d/haresources
加入 ha01 192.168.249.100 httpd
("主server hostname" "VIP" "service1" "service2")
9. 將heartbeat設定複製到ha02
cp -r /etc/ha.d/ root@192.168.249.12:/etc/
10. 建立測試環境
echo "This is HA01" > /var/www/html/index.html [HA01]
echo "This is HA02" > /var/www/html/index.html [HA02]
11. 啟動heartbeat服務
/etc/init.d/heartbeat start
(heartbeat啟動時會自動帶起於/etc/ha.d/haresources指定的服務)
12. 用瀏覽器開http://VIP是否出現以下訊息
This is HA01
13. 關閉ha01的heartbeat服務，或是將ha01關機，顯示以下訊息
This is HA02 <-- 表示HA已設定完成~
參考文章：
http://forum.icst.org.tw/phpbb/viewtopic.php?f=10&t=17829
https://forum.icst.org.tw/phpbb/viewtopic.php?f=10&t=682&view=previous
以下記錄整個操作過程
OS：Fedora 13
Requirments：
heartbeat
環境配置：
虛擬IP(VIP)：192.168.249.100
Real Server 01
hostname：ha01
Interface：eth1
IP：192.168.249.11
GATEWA：192.168.249.2
Real Server 02
hostname：ha02
Interface：eth1
IP：192.168.249.12
GATEWA：192.168.249.2
1. [以下先以ha01做設定]設定主機名稱
hostname ha01(重開機會重設)
vi /etc/sysconfig/network --> HOSTNAME=ha01
2. 修改hosts檔
vi /etc/hosts
加入192.168.1.11 ha01
192.168.1.12 ha02
3. 安裝套件
yum install heartbeat httpd
4. 複製組態檔
cp /usr/share/doc/heartbeat-3.0.0/authkeys /etc/ha.d/
cp /usr/share/doc/heartbeat-3.0.0/ha.cf /etc/ha.d/
cp /usr/share/doc/heartbeat-3.0.0/haresources /etc/ha.d/
5. 修改authkeys
vi /etc/ha.d/authkeys
加入 auth 1
1 crc
6. 修改authkeys權限
chmod 600 /etc/ha.d/authkeys
7. 修改ha.cf
vi /etc/ha.d/ha.cf
logfile /var/log/ha.log
logfacility local0
keepalive 2
deadtime 30
initdead 120
bcast eth1
updport 694
auto_failback on
node ha01
node ha02
ping 192.168.249.2
respawn hacluster /usr/lib/heartbeat/ipfail
apiauth ipfail gid=haclient uid=hacluster
8. 修改haresources
vi /etc/ha.d/haresources
加入 ha01 192.168.249.100 httpd
("主server hostname" "VIP" "service1" "service2")
9. 將heartbeat設定複製到ha02
cp -r /etc/ha.d/ root@192.168.249.12:/etc/
10. 建立測試環境
echo "This is HA01" > /var/www/html/index.html [HA01]
echo "This is HA02" > /var/www/html/index.html [HA02]
11. 啟動heartbeat服務
/etc/init.d/heartbeat start
(heartbeat啟動時會自動帶起於/etc/ha.d/haresources指定的服務)
12. 用瀏覽器開http://VIP是否出現以下訊息
This is HA01
13. 關閉ha01的heartbeat服務，或是將ha01關機，顯示以下訊息
This is HA02 <-- 表示HA已設定完成~
參考文章：
http://forum.icst.org.tw/phpbb/viewtopic.php?f=10&t=17829
https://forum.icst.org.tw/phpbb/viewtopic.php?f=10&t=682&view=previous
訂閱：
文章 (Atom)