kk的blog

2020/06/22

弱掃開始

202002版的kali linux
預設的 user pwd
改成了

kali
kali

安裝openvas

sudo apt update

sudo apt install openvas

裝完後手動下

sudo openvas-setup

經過漫長的等待後會出現開好 admin這個user及一組密碼

千萬要記得複制下來

https://127.0.0.1:9392

登入後第一件事就是改時區及密碼

接下來就開始執行scan 了

看來cpu還要再給多一點用 16 個來跑差不多

問題來了

本次的弱掃報告每個 host 都出現以下的訊息

但是kali linux也沒有提供更新了

如果不能接受

就要另外想辦法了

2020/06/20

記錄一下proxmox lxc的使用情況

最近在測試 adguard
裝在lxc 上感覺效能不能
1個cpu 512M ram
每天五百萬次的query 沒問題

但測試只有上線一台
這几天proxmox要升kernel
host必須得重開
可是lxc無法在短時間 migrate 而且一定要shutdown 再 reboot
本來想說把storage搬到nfs上可以解決
migrate是加快了可是還是得 reboot
但最大的問題來了
搬到nfs後要backup時 lxc 必需要 suspend

WTF

看來還是只能使用kvm的guest來做了

2020/06/18

今天更新ocs inventory的 agent

從上一版開始就分為 x32跟x64二個版本

在處理完x32後發生以下的問題

看來是少了 visual c 的dll

把這三個檔手動補到ocs的目錄內就可以了

2020/06/11

最近二次升級完graylog後
都發生原本的log server資料吐不過來的情況
明明daemon都還在
目前的處理方式就是把log server上的rsyslog重啟
或直接重開 log server
還找不出原因

2020/06/06

因為被要求要偵測空間裡的CO2含量
所以就想用 raspberry加上一個模組來完成
另外由於是佈建在各個點
所以考量日後維護,佈線及電源的方便度
最後決定使用respberry的poe hat來供電
但卻碰到了一件超鳥的事

poe有供電但網路不會通
WTF
第一次碰到這種
查了半天
最後發現竟然是OS語系的問題
因為在安裝的第一步就是要選語系及時區和keyboard
可是時區沒法單獨選
所以我把語系選成taiwan
這樣時區也就會自動改
也因為醬
所以才造成上面的問題
如果要使用poe hat
請特別小心

https://www.raspberrypi.org/forums/viewtopic.php?t=222293

2020/06/01

https://firebog.net/

好站

2020/04/16

ubuntu 18.04 安裝 jupyter 讓遠端可以開browser使用

sudo apt install python3 python3-pip

sudo apt install python3-matplotlib (畫圖使用視需求安裝)

pip3 install jupyter

sudo apt install jupyter-core

sudo apt install jupyter-notebook

jupyter notebook --generate-config

Writing default config to: /home/user/.jupyter/jupyter_notebook_config.py

加上登入密碼

jupyter notebook password
Enter password:
Verify password:
[NotebookPasswordApp] Wrote hashed password to /home/user/.jupyter/jupyter_notebook_config.json

修改 /home/user/.jupyter/jupyter_notebook_config.py
檔案尾端加上

c = get_config()
c.NotebookApp.ip = '*'
c.NotebookApp.open_browser = False
c.NotebookApp.port = 5678
c.NotebookApp.notebook_dir = '/tmp'

啟動 jupyter

jupyter notebook

就可以在別台几器上開browser
http://server_ip:5678
http://server_ip:5678
登入

簡單記一下ipython 跟 notebook的安裝設定過程讓遠端可以存取

先安裝

sudo apt install -y ipython ipython-notebook ipython-notebook-common

產生 config file
ipython profile create nbserver

使用ipython產生密碼 hash

In [1]: from notebook.auth import passwd
In [2]: passwd()

Enter password:
Verify password:
Out[2]: 'sha1:67c9e60bb8b6:9ffede0825894254b2e042ea597d771089e11aed'

修改

/home/user/.ipython/profile_nbserver/ipython_notebook_config.py

在檔案最後加上

c = get_config()
c.NotebookApp.ip = ‘*’
c.NotebookApp.open_browser = False
c.NotebookApp.port = 5678
c.NotebookApp.password = u'sha1:67c9e60bb8b6:9ffede0825894254b2e042ea597d771089e11aed'

啟動server
ipython notebook

接下來就可以在遠方使用browser

http://server_ip:5678

登入使用了

2020/04/08

又是librenms的問題

/opt/librenms/daily.sh
出現

Fatal error: require(): Failed opening required '/opt/librenms/vendor/composer/../symfony/polyfill-mbstring/bootstrap.php' (include_path='.:/usr/share/pear:/usr/share/php') in /opt/librenms/vendor/composer/autoload_real.php on line 69
PHP Fatal error: require(): Failed opening required '/opt/librenms/vendor/composer/../symfony/polyfill-mbstring/bootstrap.php' (include_path='.:/usr/share/pear:/usr/share/php') in /opt/librenms/vendor/composer/autoload_real.php on line 69

跑一下

/opt/librenms/validate.php

[FAIL] Missing dependencies!
[FIX]:
/opt/librenms/scripts/composer_wrapper.php install --no-dev

執行 /opt/librenms/scripts/composer_wrapper.php install --no-dev

/opt/librenms/scripts/composer_wrapper.php install --no-dev
> LibreNMS\ComposerHelper::preInstall
Loading composer repositories with package information
Installing dependencies from lock file
Package operations: 3 installs, 38 updates, 0 removals
- Installing symfony/polyfill-mbstring (v1.15.0): Downloading (100%)
- Updating symfony/polyfill-intl-idn (v1.12.0 => v1.15.0): Downloading (100%)
- Updating egulias/email-validator (2.1.11 => 2.1.17): Downloading (100%)
- Updating erusev/parsedown (1.7.3 => 1.7.4): Downloading (100%)
- Updating symfony/polyfill-ctype (v1.12.0 => v1.15.0): Downloading (100%)
- Updating phpoption/phpoption (1.5.2 => 1.7.3): Downloading (100%)
- Updating vlucas/phpdotenv (v3.6.0 => v3.6.2): Downloading (100%)
- Updating symfony/css-selector (v4.4.0 => v4.4.7): Downloading (100%)
- Updating symfony/var-dumper (v4.4.0 => v4.4.7): Downloading (100%)
- Updating symfony/routing (v4.4.0 => v4.4.7): Downloading (100%)
- Updating symfony/process (v4.4.0 => v4.4.7): Downloading (100%)
- Updating symfony/polyfill-php73 (v1.12.0 => v1.15.0): Downloading (100%)
- Updating symfony/mime (v4.4.0 => v4.4.7): Downloading (100%)
- Updating symfony/http-foundation (v4.4.0 => v4.4.7): Downloading (100%)
- Updating symfony/event-dispatcher (v4.4.0 => v4.4.7): Downloading (100%)
- Updating psr/log (1.1.2 => 1.1.3): Downloading (100%)
- Updating symfony/debug (v4.4.0 => v4.4.7): Downloading (100%)
- Updating symfony/error-handler (v4.4.0 => v4.4.7): Downloading (100%)
- Updating symfony/http-kernel (v4.4.0 => v4.4.7): Downloading (100%)
- Updating symfony/finder (v4.4.0 => v4.4.7): Downloading (100%)
- Updating symfony/console (v4.4.0 => v4.4.7): Downloading (100%)
- Updating symfony/polyfill-iconv (v1.12.0 => v1.15.0): Downloading (100%)
- Updating ramsey/uuid (3.8.0 => 3.9.3): Downloading (100%)
- Updating opis/closure (3.4.1 => 3.5.1): Downloading (100%)
- Updating symfony/translation (v4.4.0 => v4.4.7): Downloading (100%)
- Updating nesbot/carbon (2.27.0 => 2.32.2): Downloading (100%)
- Updating monolog/monolog (1.25.2 => 1.25.3): Downloading (100%)
- Updating league/flysystem (1.0.57 => 1.0.66): Downloading (100%)
- Updating laravel/framework (v5.8.35 => v5.8.37): Downloading (100%)
- Updating fico7489/laravel-pivot (3.0.3 => 3.0.4): Downloading (100%)
- Updating fideloper/proxy (4.2.1 => 4.3.0): Downloading (100%)
- Updating guzzlehttp/guzzle (6.4.1 => 6.5.2): Downloading (100%)
- Updating martinlindhe/laravel-vue-i18n-generator (0.1.42 => 0.1.46): Downloading (100%)
- Installing phpseclib/phpseclib (2.0.26): Downloading (100%)
- Updating php-amqplib/php-amqplib (v2.0.2 => v2.11.1): Downloading (100%)
- Updating phpmailer/phpmailer (v6.1.3 => v6.1.5): Downloading (100%)
- Removing dnoegel/php-xdg-base-dir (0.1)
- Installing dnoegel/php-xdg-base-dir (v0.1.1): Downloading (100%)
- Updating psy/psysh (v0.9.9 => v0.9.12): Downloading (100%)
- Updating symfony/dotenv (v3.4.35 => v3.4.39): Downloading (100%)
- Updating symfony/yaml (v4.4.0 => v4.4.7): Downloading (100%)
- Installing doctrine/cache (1.10.0): Downloading (100%)
Generating optimized autoload files
Deprecation Notice: Class HTMLPurifier_Language_en_x_test located in ./vendor/ezyang/htmlpurifier/library/HTMLPurifier/Language/classes/en-x-test.php does not comply with psr-0 autoloading standard. It will not autoload anymore in Composer v2.0. in phar:///opt/librenms/composer.phar/src/Composer/Autoload/ClassMapGenerator.php:201
Deprecation Notice: Class Crypt_CHAP_MD5 located in ./vendor/dapphp/radius/lib/Pear_CHAP.php does not comply with psr-0 autoloading standard. It will not autoload anymore in Composer v2.0. in phar:///opt/librenms/composer.phar/src/Composer/Autoload/ClassMapGenerator.php:201
Deprecation Notice: Class Crypt_CHAP_MSv1 located in ./vendor/dapphp/radius/lib/Pear_CHAP.php does not comply with psr-0 autoloading standard. It will not autoload anymore in Composer v2.0. in phar:///opt/librenms/composer.phar/src/Composer/Autoload/ClassMapGenerator.php:201
Deprecation Notice: Class Crypt_CHAP_MSv2 located in ./vendor/dapphp/radius/lib/Pear_CHAP.php does not comply with psr-0 autoloading standard. It will not autoload anymore in Composer v2.0. in phar:///opt/librenms/composer.phar/src/Composer/Autoload/ClassMapGenerator.php:201
> Illuminate\Foundation\ComposerScripts::postAutoloadDump
> @php artisan package:discover --ansi
Discovered Package: darkghosthunter/larapoke
Discovered Package: fideloper/proxy
Discovered Package: laravel/laravel
Discovered Package: laravel/tinker
Discovered Package: martinlindhe/laravel-vue-i18n-generator
Discovered Package: nesbot/carbon
Discovered Package: oriceon/toastr-5-laravel
Discovered Package: spatie/laravel-cors
Discovered Package: tightenco/ziggy
Package manifest generated successfully.
26 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
> LibreNMS\ComposerHelper::postInstall
> Illuminate\Foundation\ComposerScripts::postInstall
> @php artisan vue-i18n:generate --multi-locales --format=umd

再跑一次 validate.php

[librenms@librenms ~]$ ./validate.php
====================================
Component | Version
--------- | -------
LibreNMS | 1.62-28-g5f2eab0
DB Schema | 2020_03_25_165300_add_column_to_ports (161)
PHP | 7.2.27
MySQL | 5.5.64-MariaDB
RRDTool | 1.4.8
SNMP | NET-SNMP 5.7.2
====================================

[OK] Composer Version: 1.10.1
[OK] Dependencies up-to-date.
[OK] Database connection successful
[OK] Database schema correct
[FAIL] Some folders have incorrect file permissions, this may cause issues.
[FIX]:
sudo chown -R librenms:librenms /opt/librenms
sudo setfacl -d -m g::rwx /opt/librenms/rrd /opt/librenms/logs /opt/librenms/bootstrap/cache/ /opt/librenms/storage/
sudo chmod -R ug=rwX /opt/librenms/rrd /opt/librenms/logs /opt/librenms/bootstrap/cache/ /opt/librenms/storage/
Files:
/opt/librenms/storage/framework/views/95a740c2fd790034ee55f5aee95726c8

chown -R librenms:librenms /opt/librenms
setfacl -d -m g::rwx /opt/librenms/rrd /opt/librenms/logs /opt/librenms/bootstrap/cache/ /opt/librenms/storage/
chmod -R ug=rwX /opt/librenms/rrd /opt/librenms/logs /opt/librenms/bootstrap/cache/ /opt/librenms/storage/

跑完後就ok了

2020/03/27

最近某台設備持續出現如下的訊息

Mar 25 22:52:50 192.168.250.50 128: 000124: Mar 25 22:52:50 GMT+8: %PM-4-ERR_DISABLE: storm-control error detected on Gi1/0/5, putting Gi1/0/5 in err-disable state

之前出現的原因都是因為下接的L2 switch 有loop產生
但這次在L2 swtich上都沒發現相關的log

原本的設定是 pps 500時會把port 直接關掉

storm-control broadcast level pps 500
storm-control action shutdown

先改成限制

storm-control broadcast level pps 500 150

再觀察看看

2020/03/21

之前發過一篇如何在graylog2啟用Geo的文章

升到graylog3後有些變化
以下記錄一下
首先是geoip的資料必需要先註冊才能取得
如果要自動更新需要先產生license key
產生後下載 GeoIP.conf
https://www.maxmind.com/en/accounts/current/license-key
接下來依照說明進行安裝更新

https://github.com/maxmind/geoipupdate

https://dev.maxmind.com/geoip/geoip2/geolite2/

取得資料後把 GeoLite2-City.mmdb 放在 /etc/graylog/server 裡
接下來到 sysem - configurations

勾選 enable enable 然後 save save 就好了

步驟比之前少了很多

graylog原本有解析出ip的欄位就會多了以下三個欄位

再來就可以利用解析出來的資料畫出以下的圖形了

2020/03/19

https://github.com/raryelcostasouza/pyTranscriber/

超好用的聲音轉文字軟体
有逐字稿跟上字幕需求的
大力推薦

2020/02/27

收到librenms 更新錯誤的訊息

Updating to latest codebase FAIL
error: Your local changes to the following files would be overwritten by merge:
html/js/lang/de.js
html/js/lang/en.js
html/js/lang/fr.js
html/js/lang/ru.js
html/js/lang/uk.js
html/js/lang/zh-TW.js
Please, commit your changes or stash them before you can merge.
Aborting

解決方法如下

/opt/librenms/scripts/github-remove -d

再重跑一次 daily.sh

2020/02/24

最近想拿raspberry pi 來當thin client
本來是想用spice
但mouse 一直有 lag的問題
改用rdp

raspberry用的是raspbian

碰到了開机要叫起rdesktop的問題
查了很多方法都不成功
最後記一下可行的方法

在
/etc/xdg/lxsession/LXDE-pi/autostart
最後一行加上
@lxterminal

在 /home/pi/.bashrc 最後一行加上

rdesktop -u user 10.0.0.1 -f -r sound:local -p1234

方法二

vi /home/pi/rdp.sh

rdesktop -u user 10.0.0.1 -f -r sound:local -p1234

cp /etc/xdg/lxsession/LXDE-pi/autostart /home/pi/.config/lxsession/LXDE-pi/autostart

vi /home/pi/.config/lxsession/LXDE-pi/autostart
在最後加上

@lxterminal -e '/home/pi/rdp.sh'

若win10的使用者未設定密碼
需要更改原則才能連線
而且開啟連線未登入
15秒就會自動斷線
所以建議user要設定密碼

持續測試發現一個問題
如果我把vm關掉
rdesktop會整個畫面卡住不會自己關掉

於是使用xfreerdp

xfreerdp /v:10.0.0.1 /u:user /p:1234 /cert-ignore /f

xfreerdp /v:10.0.0.1 /u:user /p:1234 /cert-ignore /f /sound

再看看有什麼問題

2020/01/08

目前在suricata設定白名單的做法

在/etc/suricata/rules新增 pass.rules
內容如下

pass ip 10.0.0.1 any -> any any (msg:"pass all traffic from 10.0.0.1"; sid:9999999;)
pass ip 10.0.0.2 any -> any any (msg:"pass all traffic from 10.0.0.2"; sid:9999998;)

修改紅字部分
注意 sid 不可重複

在 /etc/suricata/suricata.yaml 把上面的rules引用進來

systemctl restart suricata

最近几次cacti的更新都一直有問題
所以都要倒回之前的備份
手動修改後
再做一次
這次是要把
/usr/share/cacti/install/upgrades/1_2_8.php
內的這行刪掉
db_install_execute('ALTER TABLE host_snmp_cache MODIFY COLUMN snmp_index VARCHAR(255) NOT NULL default ""');

查了一下好像目前的mariadb的版本沒辦法醬操作要升版

今天先把mariadb升級
先保留php-5.4.16-46.1.el7_7.x86_64
下次cacti升級再看看有什麼問題
再來處理

新增以下檔案

/etc/yum.repos.d/mariadb.repo

內容如下

[mariadb]
name = MariaDB
baseurl = http://yum.mariadb.org/10.4/centos7-amd64
gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB
gpgcheck=1

改好後直接 yum -y update

mariadb就會直接升了

再來要 mv /etc/my.cnf /etc/my.cnf_old 不然db會起不來

接下來照文件改

Add variables in the [mysqld] section.

collation-server = utf8mb4_unicode_ci
character-set-server=utf8mb4
max_heap_table_size = 64M
tmp_table_size = 64M
join_buffer_size = 64M
innodb_file_format = Barracuda
innodb_large_prefix = 1
innodb_flush_log_at_timeout = 3
innodb_buffer_pool_size = 1GB
innodb_buffer_pool_instances = 10
# Based on what type for storage you use. The below values are for SSD drives.
# Change it if Cacti reports issues during the installation
innodb_read_io_threads = 32
innodb_write_io_threads = 16
innodb_io_capacity = 5000
innodb_io_capacity_max = 10000

db重啟就好了

再把這個補上去

ALTER TABLE host_snmp_cache MODIFY COLUMN snmp_index VARCHAR(255) NOT NULL default ""

https://www.itzgeek.com/how-tos/linux/centos-how-tos/monitor-network-using-cacti-with-centos-7-rhel-7.html

snort suricata
gryalog 的 extractor

suricata

%{WORD:source} %{WORD:UNWANTED}\[%{DATA:UNWANTED}\]: \[%{DATA:suricata_sig_id}\] %{DATA:suricata_msg} \[Classification\: %{DATA:suricata_classification}\] \[Priority\: %{DATA:suricata_priority}\] \{%{DATA:protocol}\} %{IPV4:src_ip}\:%{DATA:srcport} \-\> %{IPV4:dst_ip}\:%{DATA:dstport}$

snort

\[%{DATA:snort_sig_id}\] %{DATA:snort_msg} \[Classification\: %{DATA:snort_classification}\] \[Priority\: %{DATA:snort_priority}\] \{%{DATA:protocol}\} %{IPV4:src_ip}\:%{DATA:srcport} \-\> %{IPV4:dst_ip}\:%{DATA:dstport}$

2020/01/04

目前手边還有一台 graylog2 的 ova
因為是 ubuntu 14.04的版本
而且 elasticsearch 也EOL
之前就一直想upgrade
只是一直沒動作

因為有10T的資料
不太可能花時間去搬
目前想保留然後再架一台新的graylog3 ova

graylog2改ip要重跑 graylog-ctl reconfigure

但跑了二次跑完後就掛了

所以改用另一個方式
在graylog2上起一個output output 把資料送到 graylog3
同時保留二份
然後graylog2再慢慢砍資料
最後把graylog2 關几
把graylog3改成graylog2的ip
graylog3改ip只要重開几就好
不用再其他設定很方便

找出最舊index並刪除的 shell 如下

#!/bin/bash

i=`/usr/bin/curl -u admin:passwd 'http://10.0.0.1:9200/_cat/indices/graylog*?v'|grep close|awk '{print $2}'|sort -rn -t_ -k 2|tail -n 1`
echo $i
/usr/bin/curl -XDELETE "http://10.0.0.1:9200/$i/"

另外 graylog3 ova 使用的是 ubuntu 18.04
預設的網路設定方式是 netplan
用的實在不順
如果要改回 /etc/network/interfaces
要先安裝 ifupdown

sudo apt install ifupdown

設定好 /etc/network/interfaces

再 rm -rf /etc/netplan/*

重開几即可

2020/01/03

proxmox 預設使用 mtu 1500
在10G的環境要改為 9000
在以下檔案加上紅色的那行

/etc/network/interfaces

auto vmbr0
iface vmbr0 inet static
address 10.0.0.1
netmask 255.0.0.0
gateway 10.0.0.254
bridge_ports enp11s0
bridge_stp off
bridge_fd 0
mtu 9000

如果是在 1G 10G 混用的環境下要注意
目前發現調完後會出現無法掛載某些nfs的情況

訂閱：文章 (Atom)