https://blog.iphpo.com/tags/centos/Recent content in centos on 戲中話Hugozh-twherb09638@gmail.com (Herb)herb09638@gmail.com (Herb)Sun, 05 May 2019 01:00:29 +0800https://blog.iphpo.com/blog/2019/%E5%8D%87%E7%B4%9A%E7%B7%A8%E8%AD%AF-sshd-8.0-%E4%B8%A6%E7%A7%BB%E9%99%A4%E7%89%88%E6%9C%AC%E8%B3%87%E8%A8%8A/Sun, 05 May 2019 01:00:29 +0800herb09638@gmail.com (Herb)https://blog.iphpo.com/blog/2019/%E5%8D%87%E7%B4%9A%E7%B7%A8%E8%AD%AF-sshd-8.0-%E4%B8%A6%E7%A7%BB%E9%99%A4%E7%89%88%E6%9C%AC%E8%B3%87%E8%A8%8A/自己從source編譯的好處是可以隱藏版本資訊，並能即時更新到最新版本，修復各種新發現的漏洞https://blog.iphpo.com/blog/2018/04/%E5%9C%A8centos7%E4%BF%AE%E6%94%B9%E7%94%B1systemd%E6%8E%A7%E5%88%B6%E7%9A%84service%E9%96%8B%E6%AA%94%E6%95%B8%E7%9B%AE%E9%99%90%E5%88%B6-edit-open-file-limit-on-centos7-systemd/Sun, 15 Apr 2018 00:00:00 +0800herb09638@gmail.com (Herb)https://blog.iphpo.com/blog/2018/04/%E5%9C%A8centos7%E4%BF%AE%E6%94%B9%E7%94%B1systemd%E6%8E%A7%E5%88%B6%E7%9A%84service%E9%96%8B%E6%AA%94%E6%95%B8%E7%9B%AE%E9%99%90%E5%88%B6-edit-open-file-limit-on-centos7-systemd/<p>今天在解決C10K問題的時候</p> <p>發現一般Linux可以在sysctl控制開檔數目</p> <p>但是在CentOS7一直被限制在1024個而已</p> <p>不管任何修改方式都一樣</p>https://blog.iphpo.com/blog/2018/01/%E5%9C%A8-centos-7-%E5%B0%87-yum-base-repo-%E6%94%B9%E7%82%BA-hinet/Tue, 02 Jan 2018 00:00:00 +0800herb09638@gmail.com (Herb)https://blog.iphpo.com/blog/2018/01/%E5%9C%A8-centos-7-%E5%B0%87-yum-base-repo-%E6%94%B9%E7%82%BA-hinet/<p>最近在用 docker</p> <p>預設的 CentOS 7</p> <p>yum install 都超慢</p> <p>所以就找了方法把 base repo 改成 hinet</p> <p>果然速度就快多了</p> <p>首先先備份原本的base repo</p>https://blog.iphpo.com/blog/2017/11/linux-%E4%B8%8B%E7%94%A8%E5%90%8D%E7%A8%B1%E5%88%AA%E9%99%A4-process/Sun, 05 Nov 2017 00:00:00 +0800herb09638@gmail.com (Herb)https://blog.iphpo.com/blog/2017/11/linux-%E4%B8%8B%E7%94%A8%E5%90%8D%E7%A8%B1%E5%88%AA%E9%99%A4-process/<p>kill <process-id> 可刪除某個程序</p> <p>但如果他開了一堆sub-process</p> <p>要一個一個砍就很麻煩</p> <p>這時候可以用其他指令來達成</p>https://blog.iphpo.com/blog/2017/09/%E5%A6%82%E4%BD%95%E5%AF%AB-fail2ban-%E7%9A%84-filter/Sun, 24 Sep 2017 00:00:00 +0800herb09638@gmail.com (Herb)https://blog.iphpo.com/blog/2017/09/%E5%A6%82%E4%BD%95%E5%AF%AB-fail2ban-%E7%9A%84-filter/<p>如果要在Fail2ban自訂封鎖條件</p> <p>就要先寫好 filter</p> <p>並在jail裡開啟</p>https://blog.iphpo.com/blog/2017/05/%E5%B7%A5%E5%85%B7-%E6%AA%A2%E6%9F%A5%E6%AA%94%E6%A1%88%E6%98%AF%E5%90%A6%E8%A2%AB%E4%BB%BB%E6%84%8F%E8%AE%8A%E6%9B%B4-filechecker/Thu, 04 May 2017 00:00:00 +0800herb09638@gmail.com (Herb)https://blog.iphpo.com/blog/2017/05/%E5%B7%A5%E5%85%B7-%E6%AA%A2%E6%9F%A5%E6%AA%94%E6%A1%88%E6%98%AF%E5%90%A6%E8%A2%AB%E4%BB%BB%E6%84%8F%E8%AE%8A%E6%9B%B4-filechecker/<p>最近用Golang寫了一個工具</p> <p>這是很久以前就想寫的</p> <p>那時候還沒有golang</p> <p>當初的想法是</p> <p>一台Server被成功入侵</p> <p>大部分都是看Log才知道</p> <p>但一台被針對並且成功提權的機器</p> <p>是不會留下任何被入侵的Log的</p> <p>但是絕對會留下駭客下次進入的後門</p> <p>或是被置入的惡意程式</p> <p>畢竟漏洞只是一時的</p> <p>如果沒放後門等漏洞被補起來</p> <p>這台機器就不能用了</p>https://blog.iphpo.com/blog/2017/04/php-fpm%E5%A6%82%E4%BD%95%E7%94%A2%E7%94%9Fcore-dump%E6%AA%94%E6%A1%88-how-to-generate-core-dump-file-on-nginx/Sat, 08 Apr 2017 00:00:00 +0800herb09638@gmail.com (Herb)https://blog.iphpo.com/blog/2017/04/php-fpm%E5%A6%82%E4%BD%95%E7%94%A2%E7%94%9Fcore-dump%E6%AA%94%E6%A1%88-how-to-generate-core-dump-file-on-nginx/<p>這陣子裝了Jetpack plugin</p> <p>發現一直有 <a href="https://blog.iphpo.com/blog/2017/04/%E6%95%B4%E7%90%86-exited-on-signal-11-sigsegv-%E8%A7%A3%E6%B1%BA%E6%96%B9%E6%B3%95/">EXITED ON SIGNAL 11 (SIGSEGV)</a> 的問題</p> <p>改了一堆設定</p> <p>把buffer加大</p> <p>timeout加大</p> <p>都沒用</p> <p>伺服器上的php是用remi repo安裝的</p> <p>預設沒有開啟debug</p> <p>所以無法產生core dump文件</p> <p>今天心一橫</p> <p>決定自己來compile php</p>https://blog.iphpo.com/blog/2017/03/%E4%BF%AE%E6%94%B9centos-7%E7%9A%84hostname-edit-centos7-hostname/Mon, 13 Mar 2017 00:00:00 +0800herb09638@gmail.com (Herb)https://blog.iphpo.com/blog/2017/03/%E4%BF%AE%E6%94%B9centos-7%E7%9A%84hostname-edit-centos7-hostname/<p>Centos 7我發現多了很多指令</p> <p>以往都要自己修改某個檔案的方式已經過去了</p> <p>CentOS 7用指令取代腦袋(要記憶的路徑)</p> <p>也許會說指令也需要記憶</p> <p>但其實只需要記開頭就好了</p>https://blog.iphpo.com/blog/2017/03/%E5%9C%A8centos7-%E4%B8%8A-%E5%AE%89%E8%A3%9Dnginx-modsecurity%E5%BB%BA%E7%AB%8B%E5%85%8D%E8%B2%BBwaf-build-free-waf-using-nginx-and-modsecurity/Sun, 12 Mar 2017 00:00:00 +0800herb09638@gmail.com (Herb)https://blog.iphpo.com/blog/2017/03/%E5%9C%A8centos7-%E4%B8%8A-%E5%AE%89%E8%A3%9Dnginx-modsecurity%E5%BB%BA%E7%AB%8B%E5%85%8D%E8%B2%BBwaf-build-free-waf-using-nginx-and-modsecurity/<p>WAF是Web Application Firewall的縮寫</p> <p>其原理是將已知的攻擊手法，用匹配方式偵測並阻擋</p> <p>所以可以預想得到</p> <p>規則會列很多條</p> <p>也不一定全面</p> <p>只需要熟悉漏洞原理的人</p> <p>照樣可以繞過</p> <p>但有總比沒有好</p> <p>至少可以過濾掉大部分的script kiddie</p> <p>除了ModSecurity之外</p> <p>還有一個專門for nginx的WAF叫做<a href="https://github.com/nbs-system/naxsi">naxsi</a></p> <p>這個有機會也可以試用看看</p> <p>不過這次先用ModSecurity</p> <p>要把nginx跟ModSecurity結合</p> <p>必須要自己compile nginx和ModSecurity</p> <p>以下用我寫的shell script一步一步做講解</p> <p><span style="font-size: 18pt;">Step 1. 安裝compile所需套件</span></p>