Ubuntu based GNU/Linux 上的防火牆 (ufw) 基本設定

早期在 Linux 上設定防火牆多事透過 iptables 這隻程式在下規則,不過說真的,對於新手或是要求很基本的使用者來說,iptables 有些功能其實用不到,例如 nat, forward等等的, 而且語法有點複雜,我自己也是常常要邊翻 man page 、筆記邊操作,後來有了令一套全名叫作 Uncomplicated Firewall 的 ufw,意思就是簡單的、不複雜的防火牆,相對於 iptables 來說,ufw 是真的簡單很多了!ufw其實只是一個 iptables 的前端設定程式,最後的規則都還是會走 iptables ,而且比較複雜的功能還是要直接透過 iptables 才有辦法做到!如果想看 ufw 設定完的 iptables 結果只要用這個命令就可以看到了:iptables -L -n

今天來講一下 ufw 的 “基本” 使用方式,Ubuntu 14.04 有內建 ufw,Debian要自行安裝,透過 apt-get 就可以了:

$ sudo apt-get install ufw

接下來示範的操作都在 Ubuntu 14.04 上面進行,不同的系統可能會略有出入,但應該都大同小異。

ufw 預設是停用的,要啟用 ufw 的話命令如下,關鍵字分別是 enable 和 disable,也就是啟用和停用,因為需要 root 權限,所以命令前面會加上 sudo:

$ sudo ufw enable
 Firewall is active and enabled on system startup

同樣的,停用 ufw 會這樣做:

$ sudo ufw disable
 Firewall stopped and disabled on system startup

要確認 ufw 已經啟用,可以看一下 ufw 的 status:

已啟用的結果:

$ sudo ufw status
Status: active

未啟用的結果:

$ sudo ufw status
Status: inactive

那防火牆的允許跟禁止規則怎麼下呢?
關鍵字是 allow 跟 deny,allow 表示允許,deny 表示拒絕

先講怎麼設定防火牆預設行為,也就是對於沒有手動設定規則的連線該怎麼處理

比較安全的設定方式,建議把預設連入設定為 deny ,也就是沒有手動設定允許通過的連線就會被擋下來:

$ sudo ufw default deny

明確一點的指令是這樣:

$ sudo ufw default deny incoming
閱讀全文

自行架設的 BitBucket server 在 git push 遇到 RPC failed 的問題

先說 … 我個人覺得 BitBucket 不是很好用,尤其是自己架設 … 很多眉角、小問題要處理

這次的環境是 BitBucket + nginx (reverse proxy) + git https access 會遇到的問題 (基本上是版本無關)

症狀長這樣:

$ git push origin master
Counting objects: 4372, done.
Delta compression using up to 8 threads.
Compressing objects: 100% (138/138), done.
error: RPC failed; result=22, HTTP code = 413
Writing objects: 100% (147/147), 1.10 MiB | 0 bytes/s, done.
Total 147 (delta 75), reused 0 (delta 0)
fatal: The remote end hung up unexpectedly

從 http 413 的解釋 Request Entity Too Large 可以看出來是 request 太大了,我猜是 git 的 objects pack 吧

解法是調整 nginx 的 client_max_body_size,預設值是 1M,我們可以把他改為更大的值,或是改為 0 來停用大小檢查

例如:

server {
#…
client_max_body_size 1000m;
#…
}

改完之後重新啟動 nginx 就沒問題了!

我範例是把 size 調到 1000m ,因為 cdnjs 的 objects pack 已經長到 900MB 了,如果你沒有一個特別肥大臃腫的 git reposiroty,我想應該1000m已經夠用了,剛剛把linux kernel 拉下來看,objects pack 也大概是 1GB左右而已

至於要用 nginx 來做 reverse proxy 的原因,主要是 Bitbucket 安裝完後 Tomcat 預設沒辦法 bind 在 1024 以下的 port ,加上他的 https 很難設定,為了拿到 A+ 確保https 安全強度,這段還是讓 nginx 來做比較簡單一點,也許之後有空會想辦法把 static file 讓 proxy 來做 cache 提升一些速度。

Manage Virtualbox virtual machines under command line

virtualbox

VirtualBox is a very useful x86/AMD64 virtualization application, we usually use it to test different operating systems, or do some computer science related practices, or maybe we just want to slice the hardware resource for resource utilization.

I would like to run a virtualbox program on my powerful servers, and use a lightweight but not powerful computer like Chromebook to remotely connect to the virtual machines under the virtualbox, so that I don’t have to bring a heavy computer every where, I can still have multiple machines with several different systems to run different programs.

From the beginning, I use vnc server with x window via ssh tunnel to create a secure connection and then launch virtualbox, in fact, the window manager is not always needed, especially we have installed the operating system, and the system runs properly, so I wonder if is possible to control the virtual machines under command line interface, and the answer is yes, and the command line virtual is much more powerful than I thought, I guess all the tasks and configurations can be done via command line now, of course including create/clone a vm or modify a vm hardware resource, vm import/export, share folder, network interface or usb device attach/detach, etc.

Without controlling via GUI, but from command line, I don’t need to start a vncclient then connect to my vncserver, also don’t need to forward the x window to my client, that’s very helpful, and that machine can run “in the background”, in fact, under the x window by vncserver, note that virtualbox still need a x window environment with virtualbox launched(at least by virtualbox v4.3.34), by my test result, if you don’t have a GUI virtual launched, the startvm command I will talk about later will not work, it will tell you vm started successfully, but in fact not, and will return 1(exit status).

I want to share some basic and commonly used commands, to help us control a virtualbox created virtual machine, if you didn’t know that before, hope this can help you.

Command ‘virtualbox’ usually means the GUI version of VirtualBox, here, for command line, we use ‘vboxmanage’, remember, I use the “vm name” to control a version machine here, you can also use its UUID at the same place, okay, here we go:

List all the virtual machines
– vboxmanage list vms

List the running virtual machines
– vboxmanage list runningvms

List the dhcp server info
– vboxmanage list dhcpservers

Show info about a virtual machine
– vboxmanage showvminfo “vm name”

Power on a vm:
– vboxmanage startvm “vm name”

Force reset/reboot a vm:
– vboxmanage controlvm “vm name” reset

Force power off a vm(cut the power down):
– vboxmanage controlvm “vm name” poweroff

Power off a vm as “Press its power button”(acpi, send power off signal, to power off in normal process, not cut the power down):
– vboxmanage controlvm “vm name” acpipowerbutton

Make a vm sleep as “Press its power button”(acpi, send sleep signal):
– vboxmanage controlvm “vm name” acpisleepbutton

Pause a vm:
– vboxmanage controlvm “vm name” pause

Resume a paused vm:
– vboxmanage controlvm “vm name” resume

Save a vm’s state(like poweroff but all states will be saved):
– vboxmanage controlvm “vm name” savestate

Take a png image screenshot of a vm:
– vboxmanage controlvm “vm name” screenshotpng filename.png

閱讀全文

關於使用 ssh 登入系統會慢的問題 …

覺得ssh登入好慢,這也是考古題了 …

(如果剛好是UseDNS這個設定的話,還有一個是GSSAPIAuthentication)

簡單來說,Linux主機大部分使用的 ssh daemon 都是用 openssh 來提供 ssh 遠端登入服務(其他常見的還有Dropbear、Busybox),而 openssh 有一個選項叫做 UseDNS,預設是 Yes ,調為 No 之後重新啟動 ssh 服務則登入系統的過程速度就會變快不少,來看看原因:

拿 Ubuntu 14.04 LTS 來看,man sshd_config,找到 UseDNS 這段:

UseDNS Specifies whether sshd(8) should look up the remote host name and check that the resolved host name for the remote IP
address maps back to the very same IP address. The default is “yes”.

白話文,這個設定會決定 ssh 服務要不要檢查使用者的 hostname、IP 對應,但這件事情必須要 Reverse DNS 跟 PTR(Pointer) record 配合,然而一般使用者很可能沒有 IP 反解記錄,如果再加上使用的是浮動IP或甚至兩台主機都是內部的虛擬IP,這個檢查很多時候是沒太多實質意義的,所以才不如關掉,跳過這個檢查可以省去一些時間

如果你是使用 Debian / Ubuntu GNU/Linux 的話,通常是直接在這個設定檔 /etc/ssh/sshd_config 最後一行加上:

UseDNS no

存檔後重啟 ssh 服務:

[bash]$ sudo service ssh restart[/bash]

就可以了

剛好覺得你的 ssh 遠端登入慢慢卡卡的話 … 試試看吧