Fred Chu » Tech http://fred.oracle1.com/weblog 一个Web开发者的博客 Tue, 31 Jan 2012 08:00:24 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Filezilla 3.5.3 连接VsFTPd TLS问题 http://fred.oracle1.com/weblog/2012/01/30/filezilla-3-5-3-%e8%bf%9e%e6%8e%a5vsftpd-tls%e9%97%ae%e9%a2%98/ http://fred.oracle1.com/weblog/2012/01/30/filezilla-3-5-3-%e8%bf%9e%e6%8e%a5vsftpd-tls%e9%97%ae%e9%a2%98/#comments Mon, 30 Jan 2012 02:48:55 +0000 Fred http://fred.oracle1.com/weblog/?p=2225 Response arg: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher

/etc/vsftpd/vsftpd.conf

ssl_ciphers=HIGH

原因是

The default is DES-CBC3-SHA which seems that is not supported anymore by FileZilla

Related Posts

]]> http://fred.oracle1.com/weblog/2012/01/30/filezilla-3-5-3-%e8%bf%9e%e6%8e%a5vsftpd-tls%e9%97%ae%e9%a2%98/feed/ 0 FreeBSD PF 防火墙简单配置 http://fred.oracle1.com/weblog/2012/01/06/freebsd-pf-%e9%98%b2%e7%81%ab%e5%a2%99%e7%ae%80%e5%8d%95%e9%85%8d%e7%bd%ae/ http://fred.oracle1.com/weblog/2012/01/06/freebsd-pf-%e9%98%b2%e7%81%ab%e5%a2%99%e7%ae%80%e5%8d%95%e9%85%8d%e7%bd%ae/#comments Fri, 06 Jan 2012 07:39:14 +0000 Fred http://fred.oracle1.com/weblog/?p=2219
1
2
3
4
5
6
oif="em0"
block in
pass out
pass in on $oif proto tcp to ($oif) port = 5631
pass in on $oif proto tcp from 192.168.0.0/24 to ($oif) port = 3128
pass in on $oif proto tcp to ($oif) port = 80

Random Posts

]]> http://fred.oracle1.com/weblog/2012/01/06/freebsd-pf-%e9%98%b2%e7%81%ab%e5%a2%99%e7%ae%80%e5%8d%95%e9%85%8d%e7%bd%ae/feed/ 0 Gentoo emerge 更新系统方法 http://fred.oracle1.com/weblog/2011/12/27/gentoo-emerge-upgrade-system-howto/ http://fred.oracle1.com/weblog/2011/12/27/gentoo-emerge-upgrade-system-howto/#comments Tue, 27 Dec 2011 11:42:23 +0000 Fred http://fred.oracle1.com/weblog/?p=2214
  • 更新Portage树
    # emerge --sync
  • 更新系统
    # emerge --update --deep --newuse world
  • 移除依赖包
    # emerge --depclean
    # revdep-rebuild

    • Related Posts

    ]]>     http://fred.oracle1.com/weblog/2011/12/27/gentoo-emerge-upgrade-system-howto/feed/ 0     小心重庆美联英语的注册金骗局 http://fred.oracle1.com/weblog/2011/12/20/meteni_com_chongqing_english_study_learning/ http://fred.oracle1.com/weblog/2011/12/20/meteni_com_chongqing_english_study_learning/#comments Tue, 20 Dec 2011 08:49:19 +0000 Fred http://fred.oracle1.com/weblog/?p=2209 上周末去重庆观音桥的美联英语咨询情况，结果被里面的要求交什么注册金，300元（因为我只带了300元）。但我第二天回来在Google、百度上搜索他们情况后发现并不是我理想中的那样。当我提到退款时，就说不能退的啦。我立马打12315电话。我说明情况之后，重庆12315的工作人员，只问了一句“他是培训机构吗?”。我说“是”。“那你打教委的电话”，“请问教委的电话是多少呢？”。“你自己打114查询啊”。

    ……

    天啊，这也叫便民？难道真把我们当便民了？当然我没有打教委的电话，说实话，我是第一次打12315在我心中一直是能够为消费者办事的电话，结果呢？我已经对这些所谓的“服务”失去信心了。以后还是小心点算了吧。

    让我们来看看一些有趣的东西吧：

    更多相关信息请看留言。

    Random Posts

    ]]>     http://fred.oracle1.com/weblog/2011/12/20/meteni_com_chongqing_english_study_learning/feed/ 7     NFS quick howto for centos 5 http://fred.oracle1.com/weblog/2011/12/16/nfs-quick-howto-for-centos-5/ http://fred.oracle1.com/weblog/2011/12/16/nfs-quick-howto-for-centos-5/#comments Fri, 16 Dec 2011 07:57:26 +0000 Fred http://fred.oracle1.com/weblog/?p=2204 NFS quick howto for centos 5

    To use nfs successfully, you have to configure the server and the client. In this example, the client is 192.168.0.3 and the server is 192.168.0.1. The folder to be shared is /home/sharing, and to be mounted to /mnt on the client

    On the server

    1. Make directory that you want to use.
      • # mkdir /home/sharing
    2. Edit /etc/exports, insert the client machine’s ip
      • # vi /etc/exports
        • Add this line:
          • /home/sharing 192.168.0.3/255.255.255.255(rw,sync)
        • Save
    3. Edit /etc/hosts.allow
      • # vi /etc/hosts.allow
        • Add this line:
          • portmap: 192.168.0.0/255.255.255.0
        • Save
    4. Start nfs and portmap
      • # /etc/init.d /nfs start
      • # /etc/init.d/portmap start
    On the client
    1. Start portmap
      • # /etc/init.d/portmap start
    2. Mount the nfs folder
      • # mount 192.168.0.1:/home/sharing /mnt
    3. Check /var/log/messages for any error that might occur
      • # tailf /var/log/messages
    4. Use mount to check if the folder is mounted properly
      • # mount 
        • This should be the output:
          • 192.168.0.1:/home/sharing on /mnt type nfs (rw,addr=192.168.0.1)
    5. Edit /etc/fstab to mount the shared folder on boot
      • # vi /etc/fstab
        • Add this line
          • 192.168.0.1:/mnt/sdb1/backup /mnt nfs rw,hard,intr 0 0
        • Save
    You can use 'man exports' to see the options available for /etc/exports

    Linux Iptables Allow NFS Clients to Access the NFS Server

    Configure NFS Services to Use Fixed Ports

    However, NFS and portmap are pretty complex protocols. Firewalling should be done at each host and at the border firewalls to protect the NFS daemons from remote
    access, since NFS servers should never be accessible from outside the organization. However, by default, the portmapper assigns each NFS service to a port dynamically at service startup time.

    Dynamic ports cannot be protected by port filtering firewalls such as iptables. First, you need to configure NFS services to use fixed ports. Open /etc/sysconfig/nfs, enter:
    # vi /etc/sysconfig/nfs
    Modify config directive as follows to set TCP/UDP unused ports:

    # TCP port rpc.lockd should listen on.
LOCKD_TCPPORT=lockd-port-number
# UDP port rpc.lockd should listen on.
LOCKD_UDPPORT=lockd-port-number
# Port rpc.mountd should listen on.
MOUNTD_PORT=mountd-port-number
# Port rquotad should listen on.
RQUOTAD_PORT=rquotad-port-number
# Port rpc.statd should listen on.
STATD_PORT=statd-port-number
# Outgoing port statd should used. The default is port is random
STATD_OUTGOING_PORT=statd-outgoing-port-numbe

    Here is sample listing from one of my production NFS server:

    LOCKD_TCPPORT=32803
LOCKD_UDPPORT=32769
MOUNTD_PORT=892
RQUOTAD_PORT=875
STATD_PORT=662
STATD_OUTGOING_PORT=2020

    Save and close the files. Restart NFS and portmap services:
    # service portmap restart
    # service nfs restart
    # service rpcsvcgssd restart

    Update /etc/sysconfig/iptables files

    Open /etc/sysconfig/iptables, enter:
    # vi /etc/sysconfig/iptables
    Add the following lines, ensuring that they appear before the final LOG and DROP lines for the RH-Firewall-1-INPUT chain:

    -A RH-Firewall-1-INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 111 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 111 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 2049 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24  -m state --state NEW -p tcp --dport 32803 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24  -m state --state NEW -p udp --dport 32769 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24  -m state --state NEW -p tcp --dport 892 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24  -m state --state NEW -p udp --dport 892 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24  -m state --state NEW -p tcp --dport 875 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24  -m state --state NEW -p udp --dport 875 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24  -m state --state NEW -p tcp --dport 662 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 662 -j ACCEP

    Save and close the file. Replace 192.168.1.0/24 with your actual LAN subnet /mask combo. You need to use static port values defined by /etc/sysconfig/nfs config file. Restart iptables service:
    # service iptables restart

     

    Related Posts

    ]]>     http://fred.oracle1.com/weblog/2011/12/16/nfs-quick-howto-for-centos-5/feed/ 0     Web应用安全分析工具 http://fred.oracle1.com/weblog/2011/10/27/web%e5%ba%94%e7%94%a8%e5%ae%89%e5%85%a8%e5%88%86%e6%9e%90%e5%b7%a5%e5%85%b7/ http://fred.oracle1.com/weblog/2011/10/27/web%e5%ba%94%e7%94%a8%e5%ae%89%e5%85%a8%e5%88%86%e6%9e%90%e5%b7%a5%e5%85%b7/#comments Thu, 27 Oct 2011 06:06:04 +0000 Fred http://fred.oracle1.com/weblog/?p=2199 http://sectools.org/web-scanners.html

     

     

     

     

    Related Posts

    ]]>     http://fred.oracle1.com/weblog/2011/10/27/web%e5%ba%94%e7%94%a8%e5%ae%89%e5%85%a8%e5%88%86%e6%9e%90%e5%b7%a5%e5%85%b7/feed/ 0     Squid 2.7 通过域名反向代理多个服务器配置 http://fred.oracle1.com/weblog/2011/10/26/squid-2-7-%e9%80%9a%e8%bf%87%e5%9f%9f%e5%90%8d%e5%8f%8d%e5%90%91%e4%bb%a3%e7%90%86%e5%a4%9a%e4%b8%aa%e6%9c%8d%e5%8a%a1%e5%99%a8%e9%85%8d%e7%bd%ae/ http://fred.oracle1.com/weblog/2011/10/26/squid-2-7-%e9%80%9a%e8%bf%87%e5%9f%9f%e5%90%8d%e5%8f%8d%e5%90%91%e4%bb%a3%e7%90%86%e5%a4%9a%e4%b8%aa%e6%9c%8d%e5%8a%a1%e5%99%a8%e9%85%8d%e7%bd%ae/#comments Wed, 26 Oct 2011 09:12:47 +0000 Fred http://fred.oracle1.com/weblog/?p=2197
    visible_hostname squid1.abc.com

    #设定squid的主机名,如无此项squid将无法启动

    http_port 80 accel vhost vport

    #设定squid为accel加速模式,vhost必须要加.否则将无法将主机头转发至后端服务器,访问时就会出现无法找到主机头的错误

    cache_peer 192.168.1.88 parent 80 0 no-query originserver name=contentchina

    cache_peer 192.168.1.88 parent 80 0 no-query originserver name=bbs

    cache_peer 192.168.1.1 parent 80 0 no-query originserver name=ihompy

    #定义不同的父节点,将节点设为no-query以及originserver说明这些节点是实际服务器

    cache_peer_domain contentchina aaa.abc.com

    cache_peer_domain bbs bbb.abc.com

    cache_peer_domain ihompy ccc.abc.com

    #设定不同域名转发到不同的cache_peer上,如果没有这项.不同域名的域名可能被分发到同一台服务器上.

    acl all src 0.0.0.0/0.0.0.0

    no_cache deny all

    http_access allow all

    #允许所有客户端访问

    cache_log /var/log/squid/cache.log

    #记录日志

    #***********ACL存取控制*************

    #acl QueryString url_regex .php?

    #***********缓冲存取控制*************

    #no_cache deny QueryString

    #不对符合QueryString的ACL内容进行缓冲

    #***********性能优化配置*************

    maximum_object_size 320010 KB

    #大于此容量的对象将不会被保存在磁盘上,默认大小是4M,如果squid服务器用于缓冲flash等大型文件,建议将此值变大.否则过大的文件在下次重启后将需要重新获取

    maximum_object_size_in_memory 100 KB

    #最大位于内存中的对象的大小,默认大小是8K,如果服务器内存很大.可以适当提高此值的大小,建议根据网站的80%图片的大小来定.或者根据WEB服务器实际存取文件中最常访问的文件大小来定制

    #***********其他可选配置*************

    #dns_nameservers 10.0.0.1 192.172.0.4

    #配置DNS服务器地址.获取后端时将从此dns获取IP地址

    #cache_mgr ggg_g@tom.com

    #在错误日志中出现的webmaster地址.

    Related Posts

    ]]>     http://fred.oracle1.com/weblog/2011/10/26/squid-2-7-%e9%80%9a%e8%bf%87%e5%9f%9f%e5%90%8d%e5%8f%8d%e5%90%91%e4%bb%a3%e7%90%86%e5%a4%9a%e4%b8%aa%e6%9c%8d%e5%8a%a1%e5%99%a8%e9%85%8d%e7%bd%ae/feed/ 0     HTML颜色图表 http://fred.oracle1.com/weblog/2011/10/20/html%e9%a2%9c%e8%89%b2%e5%9b%be%e8%a1%a8/ http://fred.oracle1.com/weblog/2011/10/20/html%e9%a2%9c%e8%89%b2%e5%9b%be%e8%a1%a8/#comments Thu, 20 Oct 2011 06:34:46 +0000 Fred http://fred.oracle1.com/weblog/?p=2195 http://fred.oracle1.com/~fred/pages/colors.html

    做网站配色的好工具。

     

     

     

     

    Related Posts

    ]]>     http://fred.oracle1.com/weblog/2011/10/20/html%e9%a2%9c%e8%89%b2%e5%9b%be%e8%a1%a8/feed/ 0     rsync 增量备份 http://fred.oracle1.com/weblog/2011/09/29/rsync-%e5%a2%9e%e9%87%8f%e5%a4%87%e4%bb%bd/ http://fred.oracle1.com/weblog/2011/09/29/rsync-%e5%a2%9e%e9%87%8f%e5%a4%87%e4%bb%bd/#comments Thu, 29 Sep 2011 06:19:30 +0000 Fred http://fred.oracle1.com/weblog/?p=2192
    1
    rsync --force --ignore-errors --delete --delete-excluded --exclude "logs/" --exclude "umslog/" 192.168.254.221::www-back /Datas/Backup/Rsync-YuKuai/app-daily --log-file=/Datas/Backup/Rsync-YuKuai/logs/`date +%Y-%m-%d`.log -azv -backup --backup-dir=/Datas/Backup/Rsync-YuKuai/app-daily-arch/`date +%Y-%m-%d`

    Random Posts

    ]]>     http://fred.oracle1.com/weblog/2011/09/29/rsync-%e5%a2%9e%e9%87%8f%e5%a4%87%e4%bb%bd/feed/ 0     thinkpad只插电源适配器会锁频 http://fred.oracle1.com/weblog/2011/09/19/thinkpad%e5%8f%aa%e6%8f%92%e7%94%b5%e6%ba%90%e9%80%82%e9%85%8d%e5%99%a8%e4%bc%9a%e9%94%81%e9%a2%91/ http://fred.oracle1.com/weblog/2011/09/19/thinkpad%e5%8f%aa%e6%8f%92%e7%94%b5%e6%ba%90%e9%80%82%e9%85%8d%e5%99%a8%e4%bc%9a%e9%94%81%e9%a2%91/#comments Mon, 19 Sep 2011 08:40:00 +0000 Fred http://fred.oracle1.com/weblog/?p=2190 在Gentoo上捣鼓 cpufreq-info 时发现只插电源适配器会锁频，可能是电源适配器只有65W 的原因。

    Related Posts

    ]]>     http://fred.oracle1.com/weblog/2011/09/19/thinkpad%e5%8f%aa%e6%8f%92%e7%94%b5%e6%ba%90%e9%80%82%e9%85%8d%e5%99%a8%e4%bc%9a%e9%94%81%e9%a2%91/feed/ 0