Sinan'ın Yeri

Centos 7 has firewalld which has many options and a new language "rich language". I was looking for deleting a rich rule syntax which I found at last at fedora project wiki . Here is a delete rich rule   firewall-cmd --zone=public --remove-rich-rule='rule family="ipv4" source address="ip adress" reject'   which is added previously to the active zone=public by the following firewall-cmd --add-rich-rule="rule family=ipv4 source address=ip_adress reject" Here is to list all rich rules at a zone firewall-cmd --zone=public --list-rich-rules  If you wish to log packets you might need a rule like this   firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="ip adress" log prefix="badboy" level="info" limit value="1/m" reject' For further information please consult to wiki and official Redhat documentation .

On Centos 7 I was struggling with fail2ban on different vm templates eg. OpenVZ and KVM. Previous post is about OpenVZ problems (not only about fail2ban) to which I could not find a solution yet. Now I would say some words about KVM instance. fail2ban 0.9.2 was running on Centos 7.1.1503 with systemd backend. I was struggling to ban failed ssh attempts with the following config options in jail.local file [DEFAULT] backend = systemd banaction = firewallcmd-ipset bantime = 3600 [sshd] enabled = true Nothing seemed to be wrong with these options and log files. But I was getting an error like this ERROR   ipset create fail2ban-sshd hash:ip timeout 3600 firewall-cmd --direct --add-rule  filter INPUT 0 -p tcp -m multiport -m set --match-set fail2ban-sshd src -j REJECT --reject-with icmp-port-unreachable -- stdout: '\x1b[91mwrong priority\nusage: --direct --add-rule { ipv4 | ipv6 | eb } \x1b[00m\n' As is easily seen, this is an error about ipset command whi...

I am having trouble with this minimal installs. Although I have heard that Centos 7 has some issues with OpenVZ minimal template, I planned to use it with some struggle. First problem I encounter is about misconfiguration of network cards in this OpenVZ template. Here is the offical bug report and here is a solution for the template. One needs to make an ethernet device up everytime after reboot if he did not have installed this patch to OpenVZ template using a command like this ifup ifcfg-venet0    or a temporary solution is adding  ARPCHECK="no" line to /etc/sysconfig/network-scripts/ifcfg-venet0:0 for my case which survives until next reboot. Second issue is about fail2ban and various system logs. Banning failed ssh attempts is a common task of a system administrator. Fail2ban seems to work in case all ssh logs are streamed to file /var/log/secure. Unfortunately in Centos 7 minimal installs ssh logs are not streamed to this file. Actually there are very f...

Lately I am in a search for converting some web pages to pdf. There are a lot of options, ways to do this. I tried a simple and working one for my case, because there are lots of mathematical symbols on the web page. As you might guess, not all of web page converters are good at math. Thanks to this post, I found an easy and powerful way. I used Chrome, but I believe this can be done with no hassle with Firefox. Both of the browsers allow saving a web page as a pdf file seamlessly. But in my case I wished to decrease web page's font size a little, to make it fancy looking. I tried zooming out options installed in browser with no help. Because as you might know, those options are futile when printing the page. I must have found a way to interfere printing progress to make font size smaller. This extension Stylish, which I wasnt aware till I read the post in stackoverflow's site, make this easy. As suggested by the poster I have added some css instructions by using Stylish. I...

I tried to install DNSCrypt on Centos 6.5. DNSCrypt is an encryption protocol/tool which makes dns queries encrypted. There are some dns servers which understand DNSCrypt eg. OpenDNS.com who innovated this protocol. The download page is http://download.dnscrypt.org/dnscrypt-proxy/ . You download source files. One needs gcc to compile them. But they do depend on another library libsodium which is included in Centos repos. Unfortunately the one in Centos repos is older, and the compilation of DNSCrypt fails. To resolve this issue, one needs to install libsodium from scratch. Download a recent tar ball from https://download.libsodium.org/libsodium/releases/ , then compile. Compilation is smooth. And after libsodium, compile DNSCrypt. To start DNSCrypt daemon, a command like this dnscrypt-proxy --daemonize -R opendns is sufficient. You also need to change /etc/resolv.conf file to include nameserver 127.0.0.1. Then to test if daemon is working, one can give dig  debug.opendns.co...

Centos has changed a lot by the newcoming member 7 of it. It is ideal to use for server environments. When installed by live cd, graphical desktop environment is installed and loaded default when booting. Because the system is changed a lot tutorials found on internet for Centos 5 or 6 are not valid for this new edition. Instead a very simple way is documented on official documentation. By the following command you find default target which is presumably graphical.target after installation   $ systemctl get-default   And then it is easily changed to console login by $ systemctl set-default multi-user.target

I was  trying to find a solution for network monitoring as a friend's request. OpenBSD is the firewall. I saw the Nfsen packages and installed to a 5.2 server. After some effort trying to understand what is going on behind, I realised that Netflow is a protocol by Cisco designed to export router traffic to outside. And OpenBSD has a support of it with pflow interface. First I made a new pflow0 interface like ifconfig pflow0 flowdst 127.0.0.1:9998 flowsrc 127.0.0.1 up Then made some configuration changesto /etc/nfsen.conf and /var/www/htdocs/nfsen/conf.php. Because Apache in OpenBSD runs in chrooted by default, if you dont make the necessary changes in these pages you got an error stating  ERROR: nfsend connect() error: Permission denied!  ERROR: nfsend - connection failed!!  ERROR: Can not initialize globals! which is because apache cant reach the communication socket which is initially  located at $PIDDIR/nfsen.comm namely /var/db/nfsen/run direc...