2019-01-21

Linux Mint 建立 L2TP VPN CLIENT

由於Linux Mint預設並沒有L2TP VPN CLIENT,因此需手動新增必要的 package才有辦法達成,以下以Linux Mint 19連線QNAP的L2TP VPN SERVER為例:

  1. 二選一,可使用strongswan或libreswan

    使用strongswan(建議,可支援一些舊加密協定):
    sudo apt-get install network-manager-l2tp-gnome network-manager-strongswan libstrongswan-standard-plugins libstrongswan-extra-plugins

    使用libreswan:
    sudo apt install network-manager-l2tp-gnome libreswan
  2. 重開機,於「網路連線」新增L2TP VPN設定
  3. 輸入gateway及帳號密碼後,還需要依照以下圖示設定:
    其中Phase 1 & phase 2 Algorithms依照安裝的為strongswan或libreswan有所不同:

    strongswan :
    Phase1: aes256-sha1-modp1024,aes128-sha1-modp2048,aes128-sha1-modp1536!
    Phase 2 : aes256-sha1,aes128-sha1!

    libreswan:
    Phase1: aes256-sha1-modp1024,aes128-sha1-modp2048,aes128-sha1-modp1536
    Phase 2 : aes256-sha1,aes128-sha1

    (3des加密目前已證實有安全性問題並被廢棄支援,大多改採用aes128或aes256)

    image.png

    QNAP或SYNOLOGY的L2TP SERVER套件通常可設定為PAP或MS-CHAPv2驗證,一般是選MS-CHAPv2較安全
  4. VPN開始連線前,可使用 sudo journalctl -f 觀看log訊息以方便除錯,連線成功後可用ipsec statusall看連線所使用的方式及資訊,像連線到qnap l2tp,會發現是使用IKEv1, aes256-sha1-modp102去連線。
  5. 若要增加 Cisco VPN,可再安裝 network-manager-vpnc-gnome

ref:
https://community.ubnt.com/t5/UniFi-Routing-Switching/L2TP-VPN-on-Ubuntu-18-04-client/td-p/2492451
https://wiki.strongswan.org/projects/strongswan/wiki/IKEv2CipherSuites

2019-01-18

macbook 藍芽作動不正常問題排除


當macbook的藍芽符號出現灰色,或者無法配對、無法找到裝置…等等奇怪的問題,可以先從軟體方面先去解決看看:


  1. 刪除 /Library/Preferences/com.apple.Bluetooth.plist 並重開機
  2. 重置NVRAM
  3. 重置SMC
  4. 開機時按住D或Option + D,執行系統檢測,看是硬體或軟體問題
  5. 若檢測出是軟體問題,開機時按住CMD+R,重新安裝系統(安裝完使用者資料及程式會保留,不用擔心)

若是硬體問題,那麼可能就得更換藍芽零件,淘寶賣價大約是台幣三四百元。
拆的時候請使用尺寸適合的十字鏍絲起子,以免造成鏍絲崩牙而無法拆裝。
安裝完後若仍無法作動(前提是更換上的藍芽零件沒有問題),那麼重複前面123的步驟應該就可正常使用。

2018-07-17

python在virtual environment (venv) 環境時,vscode pylint會報import ... not found

在python的virtual environment工作時,vscode的pylint會說找不到套件,
因此我們要vscode的「Folder Settings」去指定 venv 下的pylint路徑,而不是global的pylint,
順便把python路徑也一起修改:

(Windows)
"python.pythonPath": "${workspaceFolder}/Scripts/python.exe"
"python.linting.pylintPath": "${workspaceFolder}/Scripts/pylint.exe"

(Linux)
"python.pythonPath": "${workspaceFolder}/bin/python"
"python.linting.pylintPath": "${workspaceFolder}/bin/pylint"


因外由於 pylint 對 python 3.7的支援性不太好(沒事就在噴runtime error錯誤),
我們可以安裝 preview version的pylint來解決:

pip install pylint astroid --pre -U

或改用flake8也行:
pip install flake8

用flake8記得修改vscode設定:
"python.linting.flake8Enabled": true
"python.linting.pylintEnabled": false
"files.trimTrailingWhitespace": true

2018-07-16

Python CGI on Apache & FASTCGI on NginX

在Apache2上修改http.conf,讓Apache能以CGI執行python:
==============================================
...
LoadModule cgid_module modules/mod_cgid.so
...
<Directory "/opt/bitnami/apache2/htdocs">
...
Options FollowSymLinks MultiViews +ExecCGI
AddHandler cgi-script .py
...
</Directory>
==========================================================
若是使用bitnami LAMP stack,需再同時修改 conf/bitnami/bitnami.conf,修改設定同上
==========================================================

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

==========================================================
在NginX上修改nginx.conf,加入以下片段,以fast-cgi執行python:
==========================================================
location ~ \.py$ {
    root html;
    fastcgi_read_timeout 300;
    #fastcgi_pass 127.0.0.1:10240;
    fastcgi_pass unix:/tmp/python-fcgi.sock; #使用.sock監聽
    fastcgi_index index.py;
    fastcgi_param SCRIPT_FILENAME $request_filename;
    include fastcgi_params;
}
==========================================================
若是使用bitnami,可以新建一個 conf/bitnami/pythonfastcgi.conf,加入如上設定,並修改 conf/bitnami.conf,加入:

include "/Applications/nginxstack-1.10.1-2/nginx/conf/bitnami/pythonfastcgi.conf";
==========================================================
然後python需安裝flup,用來當做fastcgi的gateway(即符合fastcgi協定的SERVER,這樣才能溝通):
pip3 install flup

然後寫一支 wsgi.py,並啟動(以/tmp/python-fcgi.sock監聽):
==========================================================
#!/usr/local/bin/python3
#coding=utf-8

from html import escape
import sys, os
from flup.server.fcgi import WSGIServer

def app(environ, start_response):
    start_response('200 OK', [('Content-Type', 'text/html')])
    yield '<h1>FastCGI Environment</h1>'
    yield '<table>'
    for k, v in sorted(environ.items()):
        yield '<tr><th>%s</th><td>%s</td></tr>' % (escape(k), escape(v))
    yield '</table>'

if __name__ == '__main__':
    # WSGIServer(app, bindAddress=('127.0.0.1',10240)).run()
    WSGIServer(app, bindAddress='/tmp/python-fcgi.sock').run()
==========================================================
修改為執行檔並執行,再執行nginx:
chmod +x wsgi.py
./wsgi.py
systemctl start nginx

uWSGI是一個軟體專案名稱,而flup本身就是一個架構在uWSGI專案之上的server,同時支援了:
wsgi-->可支援fastcgi
uwsgi-->python web server protocol
http協定
等,因此Nginx也可以改用uwsgi(設定uwsgi_pass)去執行,可參考下面最後一個鏈結

ref:
https://httpd.apache.org/mod_fcgid/mod/mod_fcgid.html
https://httpd.apache.org/docs/2.4/howto/cgi.html
http://uwsgi-docs.readthedocs.io/en/latest/WebServers.html
https://segmentfault.com/a/1190000003993249
https://www.digitalocean.com/community/tutorials/how-to-serve-flask-applications-with-uwsgi-and-nginx-on-ubuntu-14-04

2018-05-30

TOMCAT與前端PROXY代理問題



場景:
TOMCAT開HTTP 80,前端以NGINX開HTTPS 443做代理

問題:
servlet的response.sendRidirect("...")會將相對路徑轉為絕對路徑,但轉換後scheme(http)不對

解法一:
修改server.xml的Connector,加入屬性 scheme="https",但參考tomcat的Response.java原始碼,發現如果Connector跟scheme設定的port不同時,會在sendRedirect的網址加入Connector埠號,因此必須同時設定redirectPort="443"

解法二:
修改context.xml,加入屬性 useRelativeRedirects="true",強迫sendRedirect的產生的網址為相對路徑(但可能某些舊的瀏覽器會產生問題)。

REF:
https://github.com/apache/tomcat/blob/c126b1f373751380f0070c2f890cd3554af363fd/java/org/apache/catalina/connector/Response.java
https://tomcat.apache.org/tomcat-8.5-doc/config/context.html
https://tomcat.apache.org/tomcat-8.5-doc/config/http.html

附resin解法( <resin:SetRequestSecure>):

2018-04-29

JAVA與MySQL的UTFB8MB4問題


1.升級MySQL 至少 > 5.5.3,並修改/etc/my.cnf,加入以下設定後,重開機
(JDBC預設會抓資料庫的character-set-server來做character判斷)
[client]
default-character-set = utf8mb4

[mysql]
default-character-set = utf8mb4

[mysqld]
character-set-client-handshake = FALSE
character-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci

2.修改資料table裡,將需要支援擴充字集的「欄位」改成utfbmb4_unicode_ci

3.升級 tomcat/lib裡的mysql-connector-java,至少 > 5.1.13,建議5.1.47(含)以上

4.tomcat修改context.xml,連線字串中加入
(characterEncoding=UTF8已預設相容UTF8MB4,此設定拿掉會直接讀資料庫的character-set-server,其實也沒影響)
(autoReconnect=true是為了能自動重新讀取資料庫設定,以避免讀到舊暫存設定)
useUnicode=true&amp;autoReconnect=true&amp;characterEncoding=UTF8

5.java正則表示式中,使用Pattern.compile("regex")似乎無法正常判斷unicode範圍20000 ~ 2A6D6 (42711字)及2F800 ~ 2FA1D (542字)的4 bytes字元,因此改用String.matches("regex"):
//是否全為漢字
str.matches("^[\\u4E00-\\u9FBB\\u3400-\\u4DB5\\uF900-\\uFAD9\\x{20000}-\\x{2A6D6}\\x{2F800}-\\x{2FA1D}\\(\\)]+$")

6.javascript的全漢字正則表示式:
!/^([\u4E00-\u9FBB|\u3400-\u4DB5|\uF900-\uFAD9]|[\uD800-\uDBFF][\uDC00-\uDFFF])+$/.test(STRING)

ref:
https://segmentfault.com/a/1190000000616820
http://seanlook.com/2016/10/23/mysql-utf8mb4/

CenOS上升級JRE及TOMCAT

切換為root
sudo -i

安裝tomcat9
cd /www
wget http://ftp.mirror.tw/pub/apache/tomcat/tomcat-9/v9.0.7/bin/apache-tomcat-9.0.7.tar.gz
tar zxvf apache-tomcat-9.0.7.tar.gz

新增tomcat使用者及群組
groupadd tomcat useradd -s /bin/false -g tomcat -d /www/apache-tomcat-9.0.7 tomcat

修改tomcat目錄owner及group
chwon -hR tomcat.tomcat /www/apache-tomcat-9.0.7

安裝jre
cd /usr/java
wget https://www.oracle.com/paht/to/jre/for/jdk-XXX-linux-x64.tar.gz
tar zxvf jre-XXX-linux-x64.tar.gz
alternatives --install /usr/bin/java java /usr/java/jdkXXX/jre/bin/java 300
rm latest
ln -s /usr/java/jdkXXX latest

修改jre路徑
update-alternatives --config java

移除原來jre
sudo update-alternatives --remove java /usr/java/jdk_oldXXX/jre/bin/java

重建並移除無用soft link
cd /etc/alternatives
ln -sf /usr/java/jdkXXX/jre/bin/* .
ln -sf /usr/java/jdkXXX/bin/* .
ln -sf /usr/java/jdkXXX/man/man1/* .
find -xtype l -delete

修改 /etc/profile
-----------------
...
export JAVA_HOME=/usr/java/jdkXXX
export CATALINA_HOME=/apps/tomcat-x.x.x
-----------------
source /etc/profile
java -version
echo $JAVA_HOME

修改 /etc/systemd/system/multi-user.target.wants/tomcat.service
將 jre跟tomcat路徑改掉
=====================
# Systemd unit file for tomcat
[Unit]
Description=Apache Tomcat Web Application Container
After=syslog.target network.target

[Service]
Type=forking
User=tomcat
Group=tomcat

#restart after failure
Restart=on-failure
RestartSec=5
TimeoutStartSec=60
TimeoutStopSec=60


export JAVA_HOME=/usr/java/jdk1.8.0_172
export CATALINA_HOME=/apps/tomcat-9.0.7

Environment=JAVA_HOME=/usr/java/jdk1.8.0_172
Environment=CATALINA_PID=/apps/tomcat-9.0.7/temp/tomcat.pid
Environment=CATALINA_HOME=/apps/tomcat-9.0.7
Environment=CATALINA_BASE=/apps/tomcat-9.0.7
Environment='CATALINA_OPTS=-Xms512M -Xmx4096M -server -XX:+UseParallelGC'
#Environment='JAVA_OPTS=-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom'

ExecStart=/apps/tomcat-9.0.7/bin/startup.sh
ExecStop=/apps/tomcat-9.0.7/bin/shutdown.sh
#ExecStop=/bin/kill -15 $MAINPID

[Install]
WantedBy=multi-user.target
=====================
systemctl daemon-reload

=========
找出檔案的mod number
stat --format '%a' filename

找出有+s的檔案
find . -perm -4000
find . -perm -2000

ref: