среда, 29 апреля 2015 г.

Move your server* to openvz container


Really simple, as usual. What you need:
1) Proxmox(or any other openvz web-frontend)
2) rsync
So basically these 6 steps:
1) Create new container (or create new config in /etc/vz/conf/)
2) Remove all the files in /var/lib/vz/private/ID/
3) Do initial rsync:
rsync -av --numeric-ids --exclude=/boot/* --exclude=/lib/modules/* --exclude=/tmp/* \
 --exclude=/etc/blkid --exclude=/etc/mtab --exclude=/etc/lvm --exclude=/etc/fstab \
 --exclude=/etc/udev --exclude=/proc/* --exclude=/sys/* --exclude=/dev/* \
root@REMOTEHOST:/ /var/lib/vz/private/ID/
4) Stop all the services on remote server(i.e. mysql, apache, etc)
5) Do second rsync:
rsync -av --delete --numeric-ids --exclude=/boot/* --exclude=/lib/modules/* --exclude=/tmp/* \
 --exclude=/etc/blkid --exclude=/etc/mtab --exclude=/etc/lvm --exclude=/etc/fstab \
 --exclude=/etc/udev --exclude=/proc/* --exclude=/sys/* --exclude=/dev/* \
root@REMOTEHOST:/ /var/lib/vz/private/ID/
6) Start your container

And you're done!
* If you're using systemd this will probably fail.

вторник, 28 апреля 2015 г.

Pad file with zeroes (or 0xFF)


So you need to add zeroes (or 0xFF) to the end of file and make resulting file be exact size.
For example, we will make 128kb file from 84kb file with 0xFF at the end.

So basically we open special device /dev/zero and getting zeroes from it. Then we change every 0x00 to 0xFF(tr). then we create 128k size file full of 0xFF(first dd invocation). Then we use dd again to replace beginning of file with our own file - breed-mt7620-reset1.bin. Then just rename our padded file to correct name. Pretty simple.
$ tr "00" "\377" < /dev/zero | dd ibs=1k count=128 of=paddedFile.bin
128+0 records in
256+0 records out
131072 bytes transferred in 0.020307 secs (6454503 bytes/sec)
$ dd if=breed-mt7620-reset1.bin of=paddedFile.bin conv=notrunc
163+1 records in
163+1 records out
83566 bytes transferred in 0.004907 secs (17029502 bytes/sec)
$ mv paddedFile.bin breed-mt7620-reset1_128k.bin
$

Uboot alternative - Breed.


Chinese developer Hackpascal released his alternative to standard routers uboot - Breed. It is universal bootloader that supports MT7620/MT7620a from MTK and AR9344 chips from Atheros. Most important features are:
  • web-interface
  • possibility of entering bootloader without using hardware button
  • telnet access to bootloader's cmdline
Telnet test:
$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
Boot and Recovery Environment for Embedded Devices
Copyright © 2015 HackPascal 
Build date 2015-04-07 [git-3bc4220]
Version 1.0 (r446)

Starting breed built-in shell

breed> help^M
Avaliable commands:
about    - About this bootloader
arp      - Display ARP table
autoboot - Detect firmware type and boot automatically
boot     - Boot firmware
btntst   - Test GPIO of buttons
dhcp     - Display DHCP leases
exit     - Exit from telnet
flash    - Flash utility
gpio     - GPIO utilities
help     - Show avaliable commands
mem      - Memory operation utilities
mii      - MII utility
net      - Network control
netstat  - Display network state
reset    - Restart device
setbrg   - Set baudrate
sysinfo  - Display system information
thread   - Display all threads
wget     - Retrieval file through HTTP

breed>
You can download this new bootloader here: http://breed.hackpascal.net/ But beware - this loader is closed source, so noone can know, what's inside of it.

Iptables change packet destination address


So you've faced this problem - you can't do anything to application and you know which host this application trying to connect. For example, your application connects to remote host 10.10.20.103, but you need it to connect to 8.8.4.4. So here's simple solution, as simple as this:
iptables -t nat -I OUTPUT --dest 10.10.20.103 -j DNAT --to-dest 8.8.4.4

вторник, 1 июля 2014 г.

Fresh u-boot images (01 july 2014) for atheros-based routers


I revised original's sources for pepe2k's u-boot mod (https://github.com/pepe2k/u-boot_mod) for atheros-bases routers and dev-boards.
And i decided to recompile fresh u-boot images for all capable routers. Here they are:

uboot_for_tp-link_tl-wr740n_v4.bin https://app.box.com/s/3pxe21ar1rsbi9b7ne1i
uboot_for_tp-link_tl-wr720n_v3_CH.bin https://app.box.com/s/epcyt2vpo435uklug5uh
uboot_for_tp-link_tl-wr710n.bin https://app.box.com/s/2q2uvhvfsnpwol5b2evb
uboot_for_tp-link_tl-wr703n.bin https://app.box.com/s/z13rrr8v8vdu70la67jn
uboot_for_tp-link_tl-mr3220_v2.bin https://app.box.com/s/v6jclan4ycu8mhphqrpf
uboot_for_tp-link_tl-mr3040.bin https://app.box.com/s/a0nw5w2hlmoz7giy8ll7
uboot_for_tp-link_tl-mr3020.bin https://app.box.com/s/yk395fpy7d2ukmd4tvgf
uboot_for_tp-link_tl-mr13u.bin https://app.box.com/s/ztfqxrdje9i36sw0edca
uboot_for_tp-link_tl-mr10u.bin https://app.box.com/s/kq1jqtb041em8uwzhfki
uboot_for_gs-oolite_v1_dev.bin https://app.box.com/s/o9blybah1xsnxt4bs0w1
uboot_for_dragino_v2_ms14.bin https://app.box.com/s/lw8cl6fzzouk6ilyxrkx
uboot_for_d-link_dir-505.bin https://app.box.com/s/fguydczy84zbahv3vtke
uboot_for_8devices_carambola2.bin https://app.box.com/s/9k2peuxxjjgb8mcxbrxb

вторник, 29 апреля 2014 г.

Your own certificate authority(CA) with EasyRSA 3.0


You always can buy certificate for your Webserver/VPN or even order free one from StartSSL. But what if you can do everything by yourself? Create your CA, create signed server certificates, create client certificates, use client ssl-certs to authorize on your servers? Sounds cool, let's do it, step by step.

Clone project from github.
# git clone https://github.com/OpenVPN/easy-rsa

Take directory from git tree and make copy of it.
# cp -a easy-rsa/easyrsa3/ test-ca/

Modify settings for fit your needs.
# cd test-ca/
# cp vars.example vars
# $EDITOR vars

(will look like this)
if [ -z "$EASYRSA_CALLER" ]; then
 echo "You appear to be sourcing an Easy-RSA 'vars' file." >&2
 echo "This is no longer necessary and is disallowed. See the section called" >&2
 echo "'How to use this file' near the top comments for more details." >&2
 return 1
fi
set_var EASYRSA "$PWD"
set_var EASYRSA_PKI  "$EASYRSA/pki"
set_var EASYRSA_DN "cn_only"
set_var EASYRSA_REQ_COUNTRY "RU"
set_var EASYRSA_REQ_PROVINCE "Moscow"
set_var EASYRSA_REQ_CITY "Moscow"
set_var EASYRSA_REQ_ORG  "OOO Roga and Kopyta"
set_var EASYRSA_REQ_EMAIL "noc@rogaandkopyta.ru"
set_var EASYRSA_REQ_OU  "Devops department"
set_var EASYRSA_KEY_SIZE 2048
set_var EASYRSA_ALGO  rsa
set_var EASYRSA_CA_EXPIRE 3650
set_var EASYRSA_CERT_EXPIRE 3650
set_var EASYRSA_CRL_DAYS 180

Init pki
# ./easyrsa init-pki

Build CA
# ./easyrsa build-ca


Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
......................+++
...................................+++
writing new private key to '/root/test-ca/pki/private/ca.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:ca.rogaandkopyta.ru

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/root/test-ca/pki/ca.crt

Create certificate sign request(csr) (WITHOUT password)

./easyrsa gen-req wildcard.rogaandkopyta.ru nopass

Note: using Easy-RSA configuration from: ./vars

Generating a 2048 bit RSA private key
...........................................+++
................................+++
writing new private key to '/root/test-ca/pki/private/wildcard.rogaandkopyta.ru.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [wildcard.rogaandkopyta.ru]:*.rogaandkopyta.ru

Keypair and certificate request completed. Your files are:
req: /root/test-ca/pki/reqs/wildcard.rogaandkopyta.ru.req
key: /root/test-ca/pki/private/wildcard.rogaandkopyta.ru.key

Sign csr and create certificate

# ./easyrsa sign-req server wildcard.rogaandkopyta.ru

Note: using Easy-RSA configuration from: ./vars

You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.

Request subject, to be signed as a server certificate for 3650 days:

subject=
    commonName                = *.rogaandkopyta.ru

Type the word 'yes' to continue, or any other input to abort.
  Confirm request details: yes
Using configuration from /root/test-ca/openssl-1.0.cnf
Enter pass phrase for /root/test-ca/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :T61STRING:'*.rogaandkopyta.ru'
Certificate is to be certified until Apr 25 13:40:38 2024 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated

Certificate created at: /root/test-ca/pki/issued/wildcard.rogaandkopyta.ru.crt

All done, your server certificate now awaits at pki/issued/wildcard.rogaandkopyta.ru.crt. Key for this certificate is at pki/private/wildcard.rogaandkopyta.ru.key
Put these two files to your web-server. If you need to access web-server via client certs, you need ca.crt too.
Example part for nginx's vhost config
 ssl on;
        server_name test.rogaandkopyta.ru;
        ssl_certificate          /etc/nginx/ssl/wildcard.rogaandkopyta.ru.crt;
        ssl_certificate_key      /etc/nginx/ssl/wildcard.rogaandkopyta.ru.key;
        #ssl_client_certificate /etc/nginx/ssl/ca.crt;
        #ssl_verify_client on;

EasyRSA 3.0 Удостоверяющий центр


Можно всегда заказать за денюшку сертификат для собственного веб- или openvpn-сервера, даже можно заказать бесплатный сертификат от StartSSL. Но ведь можно сделать всё и самостоятельно, особенно если этих самых сертификатов придется генерить очень много. Расскажу про создание своего удостоверяющего центра и создадим сертификат для веб-сервера. Поехали.

Клонируем репо с гитхаба.
# git clone https://github.com/OpenVPN/easy-rsa

Делаем копию нужной нам директории, чтобы потом можно было сделать git pull и обновиться.
# cp -a easy-rsa/easyrsa3/ test-ca/

Настраиваем под себя.
# cd test-ca/
# cp vars.example vars
# $EDITOR vars

Файл vars должен выглядеть примерно так
if [ -z "$EASYRSA_CALLER" ]; then
 echo "You appear to be sourcing an Easy-RSA 'vars' file." >&2
 echo "This is no longer necessary and is disallowed. See the section called" >&2
 echo "'How to use this file' near the top comments for more details." >&2
 return 1
fi
set_var EASYRSA "$PWD"
set_var EASYRSA_PKI  "$EASYRSA/pki"
set_var EASYRSA_DN "cn_only"
set_var EASYRSA_REQ_COUNTRY "RU"
set_var EASYRSA_REQ_PROVINCE "Moscow"
set_var EASYRSA_REQ_CITY "Moscow"
set_var EASYRSA_REQ_ORG  "OOO Roga and Kopyta"
set_var EASYRSA_REQ_EMAIL "noc@rogaandkopyta.ru"
set_var EASYRSA_REQ_OU  "Devops department"
set_var EASYRSA_KEY_SIZE 2048
set_var EASYRSA_ALGO  rsa
set_var EASYRSA_CA_EXPIRE 3650
set_var EASYRSA_CERT_EXPIRE 3650
set_var EASYRSA_CRL_DAYS 180

Инициализируем pki
# ./easyrsa init-pki

Создаем CA
# ./easyrsa ./easyrsa build-ca


Note: using Easy-RSA configuration from: ./vars
Generating a 2048 bit RSA private key
......................+++
...................................+++
writing new private key to '/root/test-ca/pki/private/ca.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:ca.rogaandkopyta.ru

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/root/test-ca/pki/ca.crt

Создадим запрос на подписывание сертификата(csr) (БЕЗ пароля)

./easyrsa gen-req wildcard.rogaandkopyta.ru nopass

Note: using Easy-RSA configuration from: ./vars

Generating a 2048 bit RSA private key
...........................................+++
................................+++
writing new private key to '/root/test-ca/pki/private/wildcard.rogaandkopyta.ru.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [wildcard.rogaandkopyta.ru]:*.rogaandkopyta.ru

Keypair and certificate request completed. Your files are:
req: /root/test-ca/pki/reqs/wildcard.rogaandkopyta.ru.req
key: /root/test-ca/pki/private/wildcard.rogaandkopyta.ru.key

Подписываем сертификат для веб-сервера

# ./easyrsa sign-req server wildcard.rogaandkopyta.ru

Note: using Easy-RSA configuration from: ./vars

You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.

Request subject, to be signed as a server certificate for 3650 days:

subject=
    commonName                = *.rogaandkopyta.ru

Type the word 'yes' to continue, or any other input to abort.
  Confirm request details: yes
Using configuration from /root/test-ca/openssl-1.0.cnf
Enter pass phrase for /root/test-ca/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :T61STRING:'*.rogaandkopyta.ru'
Certificate is to be certified until Apr 25 13:40:38 2024 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated

Certificate created at: /root/test-ca/pki/issued/wildcard.rogaandkopyta.ru.crt

Готово, сертификат для web-сервера лежит в pki/issued/wildcard.rogaandkopyta.ru.crt. Ключ к нему - pki/private/wildcard.rogaandkopyta.ru.key
Нужно закинуть эти два файла к веб-серверу. Если нужен еще и доступ по клиентским сертификатам, то понадобится еще и файлик ca.crt.
Примерный кусок конфига для nginx(проверка клиентских сертоф закомменчена)
 ssl on;
        server_name test.rogaandkopyta.ru;
        ssl_certificate          /etc/nginx/ssl/wildcard.rogaandkopyta.ru.crt;
        ssl_certificate_key      /etc/nginx/ssl/wildcard.rogaandkopyta.ru.key;
        #ssl_client_certificate /etc/nginx/ssl/ca.crt;
        #ssl_verify_client on;