diff --git a/README.md b/README.md index 30c6e32f..0bbbce41 100644 --- a/README.md +++ b/README.md @@ -1,23 +1,59 @@ +# 关于项目 +整理日常linux教程 +目录：star -## 团队 DevOps 方案参考 +## 环境说明 +本教程主要环境在 +系统：Centos6或Centos7 - - - - - -## 初衷(Original Intention) +## 目录(Contents) -- 整理下自己所学。**但是比较随意，所以很多地方不够严谨，所以请带着批评的思维阅读。** -- 带动更多的人进入 Linux 世界，特别是做 Java 开发的人 +### 基本操作 +- [vi基本操作](star/vi/) +- [李明老师讲Linux笔记](star/Li_teacher_speak_Linux_notes/) +- [Linux内核TCP参数优化设置](star/Linux_kernel/) +- [parted分区-分区超过2T的硬盘](star/Parted_partition_2T/) +- [判断虚拟机使用的是openvz、xen、kvm](star/use_openvz_xen_kvm/) +- [Linux服务器配置SSH免密码登陆](star/SSH_no_password/) + +### LAMNP网站WEB相关 +- [Linux服务器配置SSH免密码登陆](star/CentOS_lnamp/) +- [LVS+keepalived实现负载均衡](star/LVS_keepalived/) +- [inotify+rsync文件实时同步](star/inotify_rsync/) +- [安装MYSQL并且设置主从](star/mysql_master_slave/) + + +### 基本服务 +- [Centos安装swoole](star/centos_install_swoole/) +- [Centos安装postfix-邮件服务器](star/centos_install_postfix/) +- [Centos安装postfix-git_svn版本控制软件](star/centos_install_git_svn/) +- [centos-mail发送邮件](star/centos_install_postfix/) +- [centos-samba局域网共享](star/centos_samba/) +- [GoAccess-nginx日志分析工具](star/GoAccess_ngin_log/) +- [Centos安装memcached](star/centos_install_memcached/) +- [Let's Encrypt免费SSL证书](star/Certbot_certificate/) +- [安装nagios监控服务器](star/nagios/) +- [用ab压力测试](star/pressure/) +- [squid实现正向代理和反向搭理,varnish](star/squid_varnish/) + +### 网络 +- [使用iptables来实现SNAT转发，可以让无公网IP的服务器与公网通信](star/iptables_snat/) + +### 读书笔记 +- [读书笔记-《破坏之王》](star/read_notes_king_destruction/) +- [读书笔记-【云栖公开课】网络安全课程-截图](star/read_notes_security_course/) +- [读书笔记-《Linux集群和自动化运维》](star/read_notes_automation/) +- [读书笔记-深入浅出HTTP2 -Akamai](star/read_notes_http2/) +- [linux运维需要掌握什么知识](star/linux运维需要掌握什么知识.md) + + + + + +# 原作者-judasn - Github 项目地址，欢迎 `Fork`、`Star`： -- 文章中用到的一些安装包归纳整理： - Gitbook 在线阅读地址： -- **学得越多越是明白一个人的力量是不够的，我只是起了一个引子，希望你能一起参与，真心希望！！！（鞠躬）** - -## 优秀同行推荐 - -- [Linux工具快速教程](http://linuxtools-rst.readthedocs.io/zh_CN/latest/base/index.html) +- star 在此基础上 ## 目录(Contents) @@ -41,24 +77,24 @@ - [Sed 命令](markdown-file/Sed.md) - [Linux 下常用压缩文件的解压、压缩](markdown-file/File-Extract-Compress.md) - [Yum 下载安装包及对应依赖包](markdown-file/Off-line-Yum-Install.md) -- [Zsh 入门](markdown-file/Zsh.md) -- [终端测速](markdown-file/speedtest.md) -- [日常维护](markdown-file/maintenance.md) -- [日常监控](markdown-file/monitor.md) -- [nmon 系统性能监控工具](markdown-file/Nmon.md) -- [Glances 安装和配置](markdown-file/Glances-Install-And-Settings.md) -- [SSH（Secure Shell）介绍](markdown-file/SSH.md) -- [FTP（File Transfer Protocol）介绍](markdown-file/FTP.md) -- [VPN（Virtual Private Network）介绍](markdown-file/VPN.md) -- [NFS（Network FileSystem）介绍](markdown-file/NFS.md) -- [NTP（Network Time Protocol）介绍](markdown-file/NTP.md) -- [Samba 介绍](markdown-file/Samba.md) -- [Crontab 介绍](markdown-file/Crontab.md) -- [Iptables 介绍](markdown-file/Iptables.md) -- [花生壳-安装介绍](markdown-file/Hsk-Install.md) -- [JDK 安装](markdown-file/JDK-Install.md) -- [Java bin 目录下的工具](markdown-file/Java-bin.md) -- [SVN 安装和配置](markdown-file/SVN-Install-And-Settings.md) +- [ ] [Zsh 入门](markdown-file/Zsh.md) +- [ ] [终端测速](markdown-file/speedtest.md) +- [x] [日常维护](markdown-file/maintenance.md) +- [x] [日常监控](markdown-file/monitor.md) +- [ ] [nmon 系统性能监控工具](markdown-file/Nmon.md) +- [ ] [Glances 安装和配置](markdown-file/Glances-Install-And-Settings.md) +- [x] [SSH（Secure Shell）介绍](markdown-file/SSH.md) +- [x] [（File Transfer Protocol）介绍](markdown-file/FTP.md) +- [x] [VPN（Virtual Private Network）介绍](markdown-file/VPN.md) +- [x] [NFS（Network FileSystem）介绍](markdown-file/NFS.md) +- [x] [NTP（Network Time Protocol）介绍](markdown-file/NTP.md) +- [x] [Samba 介绍](markdown-file/Samba.md) +- [x] [Crontab 介绍](markdown-file/Crontab.md) +- [x] [Iptables 介绍](markdown-file/Iptables.md) +- [x] [花生壳-安装介绍](markdown-file/Hsk-Install.md) +- [ ] [JDK 安装](markdown-file/JDK-Install.md) +- [ ] [Java bin 目录下的工具](markdown-file/Java-bin.md) +- [x] [SVN 安装和配置](markdown-file/SVN-Install-And-Settings.md) - [Tomcat 安装和配置、优化](markdown-file/Tomcat-Install-And-Settings.md) - [Jenkins 安装和配置](markdown-file/Jenkins-Install-And-Settings.md) - [Maven 安装和配置](markdown-file/Maven-Install-And-Settings.md) @@ -82,7 +118,7 @@ - [Rap 安装和配置](markdown-file/Rap-Install-And-Settings.md) - [Nginx + Keepalived 高可用](markdown-file/Nginx-Keepalived-Install-And-Settings.md) - [黑客入侵检查](markdown-file/Was-Hacked.md) -- [Shadowsocks 安装和配置](markdown-file/http://code.youmeek.com/2016/08/19/2016/08/VPS/) +- [Shadowsocks 安装和配置](http://code.youmeek.com/2016/08/19/2016/08/VPS/) - [Mycat 安装和配置](markdown-file/Mycat-Install-And-Settings.md) - [Zookeeper 安装和配置](markdown-file/Zookeeper-Install.md) - [Daemontools 工具介绍](markdown-file/Daemontools.md) @@ -142,8 +178,3 @@ |Judas.n|| |mrdear|| |fooofei|| - -## AD - -- [推荐：程序员的个性化网址导航：GitNavi.com](http://www.gitnavi.com/u/judasn/) -- [适合后端开发者的前端 React-Admin](https://github.com/satan31415/umi-admin) diff --git a/cover/background.jpg b/cover/background.jpg deleted file mode 100644 index d38983bb..00000000 Binary files a/cover/background.jpg and /dev/null differ diff --git a/cover/cover.jpg b/cover/cover.jpg deleted file mode 100644 index 59509c37..00000000 Binary files a/cover/cover.jpg and /dev/null differ diff --git a/cover/logo.png b/cover/logo.png deleted file mode 100644 index 2dd65afc..00000000 Binary files a/cover/logo.png and /dev/null differ diff --git a/markdown-file/NTP.md b/markdown-file/NTP.md index 79f61266..096f12ea 100644 --- a/markdown-file/NTP.md +++ b/markdown-file/NTP.md @@ -27,7 +27,7 @@ server 3.centos.pool.ntp.org iburst - 新增配置： -``` nginx +``` ntp1.aliyun.com ntp2.aliyun.com ntp3.aliyun.com @@ -37,6 +37,9 @@ ntp6.aliyun.com ntp7.aliyun.com ``` + + + - CentOS 6 - 重启 NTP 服务：`sudo service ntpd start` - 添加 NTP 自启动：`sudo chkconfig ntpd on` @@ -58,20 +61,22 @@ ntp7.aliyun.com - 标注 1 是默认内容，我们这里进行了注释。 - 标注 2 是新增内容，表示使用中国时间校对服务器节点地址。 -``` nginx +``` server 0.cn.pool.ntp.org server 1.cn.pool.ntp.org server 2.cn.pool.ntp.org server 3.cn.pool.ntp.org ``` + - 我的配置如下 - ``` - driftfile /var/lib/ntp/drift +``` +driftfile /var/lib/ntp/drift pidfile /var/run/ntpd.pid logfile /var/log/ntp.log +``` - +``` # Access Control Support restrict default kod nomodify notrap nopeer noquery restrict -6 default kod nomodify notrap nopeer noquery diff --git "a/star/CentOS_lnamp/CentOS\345\256\211\350\243\205lnamp\347\216\257\345\242\203\345\271\266\344\270\224\351\205\215\347\275\256.doc" "b/star/CentOS_lnamp/CentOS\345\256\211\350\243\205lnamp\347\216\257\345\242\203\345\271\266\344\270\224\351\205\215\347\275\256.doc" new file mode 100644 index 00000000..d0c5ab58 Binary files /dev/null and "b/star/CentOS_lnamp/CentOS\345\256\211\350\243\205lnamp\347\216\257\345\242\203\345\271\266\344\270\224\351\205\215\347\275\256.doc" differ diff --git a/star/GoAccess_ngin_log/readme.md b/star/GoAccess_ngin_log/readme.md new file mode 100644 index 00000000..60aec25a --- /dev/null +++ b/star/GoAccess_ngin_log/readme.md @@ -0,0 +1,206 @@ +GoAccess-nginx日志分析工具 +http://blog.csdn.net/joeyon1985/article/details/46709635 + +nginx 日志分析工具goaccess的使用以及碰到的坑 +http://blog.csdn.net/iamxiaoxiong/article/details/50527041 + +# yum -y install glib2 glib2-devel ncurses ncurses-devel GeoIP GeoIP-devel +# wget http://tar.goaccess.io/goaccess-1.2.tar.gz +# tar -xzvf goaccess-1.2.tar.gz +# cd goaccess-1.2/ +# ./configure --enable-geoip --enable-utf8 +# make && make install + + +默认配置文件在 vi /usr/local/etc/goaccess.conf + +time-format %H:%M:%S +date-format %d/%b/%Y +log-format +接下来我们测试一下。现在就需要根据nginx的日志格式来写goaccess的规则 +goaccess -f /usr/local/nginx/logs/access.log -a > /root/test/report.html + + +网络上大部分的文章和介绍都只适合没任何修改的nginx日志格式，对自定义的log format都不怎么涉及。如果你采用的自定义的nginx日志格式，那么此处就需要特别注意，一旦log-format配置不对，goaccess分析的结果会差很大。 + +以我nginx日志格式为例： +log_format main '$server_name $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for" $upstream_addr $request_time $upstream_response_time; + +按照goaccess预设的log format，这样的日志是没法分析的，所以我们需要自定义log format。 +我的log format为： +log-format %^ %h %^ %^ [%d:%t %^] “%r” %s %b “%R” “%u” “%^” %^ %T %^ + + + +$server_name ---> %h ---> 主机(客户端IP地址,IPv4和IPv6) +[$time_local] ---> [%d:%t %^] ---> 时间 +$request ---> "%r" ---> 客户机的请求,这需要具体分隔符在请求(单引号、双引号或其他)解析。如果没有,我们必须使用特殊的格式说明符的组合%m %U %H。 +$status ---> %s ---> 发送客户端的状态码 +$body_bytes_sent ---> %b ---> 给客户端返回大小 +$http_referer ---> %R ---> “Referrer”HTTP请求头 +$http_user_agent ---> "%u" ---> UA +$http_x_forwarded_for ---> +$request_time ---> %T ---> 服务请求的时间,以秒或毫秒。注意:%D将优先于%T如果都使用。 + +为了设置正确的log format，踩了不少坑，先列出来避免大家重复碰到。 +（1） log format默认是按照空格分隔日志信息的，所以，对于包含了特殊字符如空格等信息的字段，必须包含在“”里面。如字段request http_user_agent等 +（2） nginx日志格式里面，采用空格分隔，但是此处一定注意，只能用一个空格。当时我有个地方用了两个空格，直接导致goaccess结果出错。 +（3） nginx日志中的每一个字段都要和log format中的一一对应，如果log format中不需要nginx中的某一个信息，则用%^跳过该信息。 +（4） 对于nginx日志中的每一个 - log format都需要一个%^来跳过， 如果是“-”， 则用“%^” +（5） 如果nginx日志信息中有：， 则需要在log format中也显示出来。例如nginx日志中$time_local就包含了：，所以在log format的相应位置也是 [%d:%t %^] + +希望这些能帮助使用goaccess的朋友。 + + +goaccess -f log [-c][-r][-m][-h][-q][-d][-g][-a][-o csv|json][-e IP_ADDRESS][...]  + + + +2.1 自定义参数及其对应nginx的accesslog中的fromat + +%x 匹配替代time_format和date_format的设定，可以同时调用两个的全局设置（时间戳） +%t 匹配替代 time-format 的设置 +%d 匹配替代 date-forma 的设置 +%h 客户端ip $remote_addr +%r 请求方法 $request +%m 请求算法 相当于$request中的 post或get的匹配 +%U 请求的URL路径(包括任何查询字符串) 相当于$request中的 URL匹配 +%H 请求的协议 相当于$request中的 HTTP/1.1 +%s 服务端返回客户端的状态code $status +%b 返回客户端的body size $body_bytes_sent +%R refer $http_referer +%u user-agent $http_user_agent +%D 服务请求的时间，以微秒为单位 $request_time +%T 服务请求的时间，以秒为单位 $request_time +%L 服务请求的时间，以毫秒为单位 $request_time +%^ 忽略官方没有对应参数的区域 + +以上是官方给出的所有匹配参数，原版见 +http://www.goaccess.io/man + +以下是我自定义的nginx日志格式： +log_format main_zdy '$request_time - IP:$remote_addr - RealIP:$http_x_forwarded_for - [$time_local] $request - $status - $http_user_agent - $host - from:$http_referer'; +记录日志： +0.000 - IP:3.3.3.3 - RealIP:1.1.1.1, 2.2.2.2 - [28/Jul/2017:16:04:15 +0800] POST /site/index.html HTTP/1.1 - 200 - Apache-HttpClient/UNAVAILABLE (java 1.4) - www.111111111.com - from:http://www.111111111.com +0.216 - IP:4.4.4.4 - RealIP:5.5.5.5, 6.6.6.6 - [28/Jul/2017:15:53:04 +0800] GET /client/serverlist?jsonpCallback=jQuery18206177038959697163_1501228347875&gid=163&wid=196&_=1501228353156 HTTP/1.1 - 200 - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727) - www.111111111.com - from:http://www.1111111111111.com/ + +goaccess的格式： +log-format %T %^ IP:%^ %^ RealIP:~h{," } %^ [%d:%t %^] %m %U %H %^ %s %^ %u %^ %^ %^ from:%R + + + + + + +%x 一个匹配时间格式的日期和时间字段和日期格式变量。这是时使用时间戳是给定的日期和时间而不是在两个独立的变量。 +%t time字段匹配时间格式的变量。 +%d date字段匹配日期格式的变量。 +%v The服务器名称根据规范名称设置块(服务器或虚拟主机)。 +%e 用户标识的人请求文档由HTTP身份验证。 +%h host(客户端IP地址,IPv4和IPv6) +%r 请求从客户端。这需要在请求特定的分隔符(单引号、双引号等)解析。否则,结合使用等特殊格式说明符%m %U %q 和 %H解析单个字段。注意:使用 %r 得到完整的请求或 %m %U %q 和 %H形成你的请求,不同时使用。请求方法让 + +%m 请求的方法。 +%U 请求URL路径。注意:如果查询字符串在%U,没有必要使用%q。然而,如果URL路径,不包括任何查询字符串,可以使用%q和查询字符串将被附加到请求。 + +%q 查询字符串。 + +%H 请求协议。 +%s 服务器发送给客户机的状态代码。 +%b 服务器发送发送给客户端的大小。 +%R 来源 +%u 用户代理HTTP请求头。 +%D 服务请求的时间，以微秒为单位 $request_time +%T 服务请求的时间，以秒为单位 $request_time +%L 服务请求的时间，以毫秒为单位作为一个十进制数。 +%^ 忽略这个领域。 +%~ 前进通过日志字符串直到找到(!isspace)字符进行技术改造。 +~h 主机(客户端IP地址,IPv4和IPv6)在X-Forwarded-For(XFF)领域。 + +For XFF, GoAccess uses a special specifier which consists of a tilde before the host specifier, followed by the character(s) that delimit the XFF field, which are enclosed by curly braces (i.e., ~h{,"}). +For example, ~h{," } is used in order to parse "11.25.11.53, 17.68.33.17" field which is delimited by a double quote, a comma, and a space. + +XFF,GoAccess使用特殊说明符由波浪号主机之前,紧随其后的是字符(s)划入XFF字段,由花括号封闭(即~ h { })。 +例如,h ~ { }的使用是为了解析”11.25.11.53,17.68.33.17”字段由一个双引号分隔,逗号,和空间。 + + + + + + + + + +goaccess -f /root/1000.log -a > /data/wwwroot/web/test/report1.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +goaccess -f /root/www.7477.com-access1000.log -a > /data/wwwroot/web/zabbix/1111/reporta1.html + +goaccess -f /root/test.log -a > /data/wwwroot/web/zabbix/1111/reporta6.html + +goaccess -f /root/www.7477.com-access181.log -a > /data/wwwroot/web/zabbix/1111/report.html +goaccess -f /root/www.7477.com-access1000.log -a > /data/wwwroot/web/zabbix/1111/report1.html + + +goaccess -f /root/www.funet8.com-access.log -a > /data/wwwroot/web/zabbix/1111/funet1.html + + +goaccess -f /root/1000.log -a > /data/wwwroot/web/test/report1.html + + + + + + + + + + + + + + + + + + + diff --git "a/star/LVS_keepalived/192.168.1.244\345\222\214233keepalived\350\264\237\350\275\275\351\205\215\347\275\256.txt" "b/star/LVS_keepalived/192.168.1.244\345\222\214233keepalived\350\264\237\350\275\275\351\205\215\347\275\256.txt" new file mode 100644 index 00000000..a472a7c8 --- /dev/null +++ "b/star/LVS_keepalived/192.168.1.244\345\222\214233keepalived\350\264\237\350\275\275\351\205\215\347\275\256.txt" @@ -0,0 +1,154 @@ +两台服务器资料 + +192.168.1.233 +192.168.1.244 + + + + +192.168.1.244的配置： + +! Configuration File for keepalived + +global_defs { + notification_email { + linmaogan@gmail.com # 故障通知邮件地址，可以多个地址 + liuxing007xing@163.com + } + notification_email_from linmaogan@163.com # 故障发送人 + smtp_server smtp.163.com # 由163.com发送邮件 + smtp_connect_timeout 30 + + #运行Keepalived服务器的一个标识 + #发邮件时显示在邮件标题中的信息 + router_id LVS_BACKUP #BACKUP上修改为LVS_BACKUP，网上资料说这个值也需要修改，具体不详，之前我们线上的主备就一直是一样的 ^ ^还是修改一下吧！ +} + +# 监测ipvsadm进程状态，每3秒执行一次 +vrrp_script chk_ipvsadm{ + script "/data/conf/shell/chk_ipvsadm.sh" + interval 3 + weight 3 +} + +vrrp_instance VI_1 { + state MASTER + interface em1 【修改对应的网卡或eth0】 + virtual_router_id 51 + priority 100 + advert_int 1 + authentication { + auth_type PASS + auth_pass PZFKD2wSUJ3swnPN + } + virtual_ipaddress { + 192.168.1.231 + } +} + +virtual_server fwmark 80 { + delay_loop 6 + lb_algo wlc + lb_kind DR + persistence_timeout 1 + nat_mask 255.255.255.0 #网络掩码 + persistence_timeout 50 + protocol TCP + real_server 192.168.1.244 80 { + weight 5 + TCP_CHECK { + connect_timeout 3 + nb_get_retry 3 + delay_before_retry 3 + connect_port 80 #健康检查端口连接端口 + } + } + real_server 192.168.1.233 80 { + weight 5 + TCP_CHECK { + connect_timeout 3 + nb_get_retry 3 + delay_before_retry 3 + connect_port 80 #健康检查端口连接端口 + } + } +} + + + + + + + + + + + +192.168.1.233的配置： + + +! Configuration File for keepalived + +global_defs { + notification_email { + linmaogan@gmail.com # 故障通知邮件地址，可以多个地址 + liuxing007xing@163.com + } + notification_email_from linmaogan@163.com # 故障发送人 + smtp_server smtp.163.com # 由163.com发送邮件 + smtp_connect_timeout 30 + + #运行Keepalived服务器的一个标识 + #发邮件时显示在邮件标题中的信息 + router_id LVS_BACKUP #BACKUP上修改为LVS_BACKUP，网上资料说这个值也需要修改，具体不详，之前我们线上的主备就一直是一样的 ^ ^还是修改一下吧！ +} + +# 监测ipvsadm进程状态，每3秒执行一次 +vrrp_script chk_ipvsadm{ + script "/data/conf/shell/chk_ipvsadm.sh" + interval 3 + weight 3 +} + +vrrp_instance VI_1 { + state BACKUP + interface em1 【修改对应的网卡或eth0】 + virtual_router_id 51 + priority 80 + advert_int 1 + authentication { + auth_type PASS + auth_pass PZFKD2wSUJ3swnPN + } + virtual_ipaddress { + 192.168.1.231 + } +} + +virtual_server fwmark 80 { + delay_loop 6 + lb_algo wlc + lb_kind DR + persistence_timeout 1 + nat_mask 255.255.255.0 #网络掩码 + persistence_timeout 50 + protocol TCP + real_server 192.168.1.244 80 { + weight 5 + TCP_CHECK { + connect_timeout 3 + nb_get_retry 3 + delay_before_retry 3 + connect_port 80 #健康检查端口连接端口 + } + } + real_server 192.168.1.233 80 { + weight 5 + TCP_CHECK { + connect_timeout 3 + nb_get_retry 3 + delay_before_retry 3 + connect_port 80 #健康检查端口连接端口 + } + } +} \ No newline at end of file diff --git "a/star/LVS_keepalived/CentOS\345\256\211\350\243\205lvs+keepalived\350\256\260\345\275\225.doc" "b/star/LVS_keepalived/CentOS\345\256\211\350\243\205lvs+keepalived\350\256\260\345\275\225.doc" new file mode 100644 index 00000000..7ba6d3bb Binary files /dev/null and "b/star/LVS_keepalived/CentOS\345\256\211\350\243\205lvs+keepalived\350\256\260\345\275\225.doc" differ diff --git "a/star/Li_teacher_speak_Linux_notes/FTP\346\234\215\345\212\241\345\231\250\351\205\215\347\275\256.txt" "b/star/Li_teacher_speak_Linux_notes/FTP\346\234\215\345\212\241\345\231\250\351\205\215\347\275\256.txt" new file mode 100644 index 00000000..5dbfa0fe --- /dev/null +++ "b/star/Li_teacher_speak_Linux_notes/FTP\346\234\215\345\212\241\345\231\250\351\205\215\347\275\256.txt" @@ -0,0 +1,103 @@ +*************γ̴********************** +windowslinuxļ samba +FTPӦ vsftp +unixϵͳļھʹã nfs +unixϵͳļ ssh + +*************FTP÷********************** +Wu-FTPϡø +Proftpǿ +vsftpȫ١ȶ +ϵͳĬFTP + +/etc/rc.d/init.d/vsftp start +ļ/etc/vsftp/vsftpd.conf + +*********************************** +anonymous_enable=YES ¼ +xferlog_enable=YES +xferlog_std_format=YES +xferlog_file=/var/log/xferlog ϴ־ +ftpd_banner=welconme to myFTP Service ,enjoy it ûӭϢ +anon_max_rate=100000 ûʡ + +FTPûftpanonymous +룺գ䣩 +Ŀ¼ftpαûĿ¼ /var/ftp + +*************û********************** +local_enable=YES ʾûĿ¼ +write_enable=YES +local_umask=022 +local_max_rate=100000 ʡ + +رselinux + +*************ûʿ********************** +ָûܷʣûԷ: +userlist_enable=YES +userlist_deny=YES +userlist_file=/etc/vsftp.user_list + + +ָûԷʣûָͲܷʣ +userlist_enable=YES +userlist_deny=No +userlist_file=/etc/vsftp.user_list + + +*************chroot********************** +ûִchroot +chroot_local_user=YES +ָûִchroot +chroot_local_user=YES +chroot_list_enable=YES +chroot_list_file=/etc/vsftp/chroot_list + + +*************ѡ********************** +idle_session_timeout=600 Ự600Ҷϡ +max_clients=50 ܵIJΪ50 +max_per_ip=3 ÿͻΪ3 +listen_port=10011 ָDZ׼˿ڡ + + +ͻ +ftp +ftpַ +ftp> +ls 鿴ļ +cd лĿ¼ +bin ƴ䡿 +lcd лĿ¼ +get صļ +mget ضļ +put ϴļ +mput ϴļ +prompt رսģʽ +bye ˳ +open ftp +user ftpû롿 + +nmap ˿ɨ蹤 + + + + + + + + + + + + + + + + + + + + + + diff --git a/star/Li_teacher_speak_Linux_notes/Li_teacher_speak_Linux_notes.md b/star/Li_teacher_speak_Linux_notes/Li_teacher_speak_Linux_notes.md new file mode 100644 index 00000000..878b046f --- /dev/null +++ b/star/Li_teacher_speak_Linux_notes/Li_teacher_speak_Linux_notes.md @@ -0,0 +1,4 @@ +# 李明老师讲Linux + +网易云课堂笔记地址： +https://study.163.com/course/courseMain.htm?courseId=266032 diff --git "a/star/Li_teacher_speak_Linux_notes/Linux_Samba\346\234\215\345\212\241\345\231\250\351\205\215\347\275\256.txt" "b/star/Li_teacher_speak_Linux_notes/Linux_Samba\346\234\215\345\212\241\345\231\250\351\205\215\347\275\256.txt" new file mode 100644 index 00000000..24f3b404 --- /dev/null +++ "b/star/Li_teacher_speak_Linux_notes/Linux_Samba\346\234\215\345\212\241\345\231\250\351\205\215\347\275\256.txt" @@ -0,0 +1,136 @@ +*************γ̴********************** +WindowsLinuxļ-samba +FTPӦ-vsftp + +*************samba********************** +unixϵͳУsambaͨϢЭ飨SMBϵļ֮乲ļʹӡ + + /etc/rc.d/init.d/smb start +sambaػ̣ +smbd 139˿ڣTCP˿ڡ û֤ļ +nmbd 137138˿ UDP˿ڡ ͼƽ + +Ƿװsamba +rpm -qa | grep samba +װsamba +yum -y install samba samba-client + + + + + +*************samba********************** +ļ +sambaøʽ +[] +=ֵ + +# ע֣͡ + ֺעͣѡûĬֵ + +ĸöΣ +[global] ȫֻѡ +[homes] ûĿ¼ +[printers] ùӡ +[sharefiles] ļ + +*************[global] Ҫѡ********************** +workgroup = ָ +server string = +security = ָȫģʽ + shareȨ + user ȱʡƼlinux samba֤ + server ֤ + domain ֤windows +hosts allow = ָʣȣ + 1.ЩԷ hosts allow hosts deny + 2.ЩûԷ + +log file = ָ־ļλá +max log size = ָ־ļС + + +*************[homes] Ҫѡ********************** +comment = Home Directories +browseable = no ԹĿ¼ء +writable = yes noֻyesд + +*************windowsͻ˷ԼĿ¼********************** +ǽǷ +Netfilter/Iptables #iptables -F +SELinux + رSElinux + #setsebool -p samba_enable_home_dirs on + gesebool -a | grep samba + vi /etc/selinux/config ΪSELINUX=disabled + ûϵͳûû + samba֤롣 + +1.װsambaҪļ޸ + smbpasswd -a <û> + service smb restart + + windowsͻ˷sambaԴ + ʼ--롰\\ַ + +samba˲鿴ʵĿͻϢ +smbstatus +־ļ +/var/log/samba/ + +windows¡net us +ر net use * /delete /y + + +*************Samba********************** +SambaӦʵ +SambaĿ¼/softwareûjackmaryͨwindowsͻ˷ʣҾждȨޡ +1.Ŀ¼/softwareûjackmary +2.װSELinuxִûԷϵͳĿ¼ + +chcon -t samba_share_t +3.sambaļ /etc/samba/smb.conf ĩβӣ +[software] +path = /software +valid users = jack mary +writable = yes + +smbpasswd -a jack +smbpasswd -a mary +service smb restart + +1)sambaǷдȨ +2ûlinuxϵͳǷԹĿ¼дȨޡ + +Ȩ +#groupadd softadmin +#gpasswd -a jack softadmin +#gpasswd -a mary softadmin +#chgrp softadmin /software +#chmod g+w /software + +samba﷨ +# testparm + + +SambaӦʵ +һֻĿ¼/pubicе˿Ŀ¼ݡ +[pubic] +comment = Read Only Pubic +path = /pubic +writable = no + +SambaӦʵģ +ϹĿ¼ /hrÿ˶ܶдɾ˵ļ +[hr] +path = /hr +valid users = zhangsan lisi wangwu +writable = yes + +#chmod 1777 /hr + +tλ ճλ +:Ŀ¼Ȩ777 +:һļԼֻɾԼĶ +chmod o+t /tmp +chmod 1777 /tmp diff --git "a/star/Li_teacher_speak_Linux_notes/Linux\346\226\207\344\273\266\347\263\273\347\273\237\347\256\241\347\220\206.txt" "b/star/Li_teacher_speak_Linux_notes/Linux\346\226\207\344\273\266\347\263\273\347\273\237\347\256\241\347\220\206.txt" new file mode 100644 index 00000000..937bf172 --- /dev/null +++ "b/star/Li_teacher_speak_Linux_notes/Linux\346\226\207\344\273\266\347\263\273\347\273\237\347\256\241\347\220\206.txt" @@ -0,0 +1,225 @@ +*************γ̴********************** +ļϵͳ +豸 +ʽԭ + + + +*************ļϵͳ********************** + +/user/bin /bin Ŵûִе +/user/sbin /sbin ֻrootſִе +/home ûȱʡĿ¼ +/proc ļ豸ŵǰڴ澵 +/dev 豸ļ +/lib ϵͳĹ⡿ +/lost+found һЩϵͳļ + +/tmp ʱļÿûдȨޣֻС +/etc ϵͳļ +/var ̷䶯ļʼ־ļƻ +/user ⡢ֲҳȡ +/mnt ļϵͳİװ㡿 +/boot ںļԾٳļλá + + +*********************************** + +df 鿴 +du 鿴ļĿ¼С +fsck e2fsck ޸ļϵͳ +file жļ͡ + +du -h /etc/services +du -sh /etc 鿴Ŀ¼С + +file system check fsck +e2fsck +fsck -y ޸ϵͳ + + + + +*************ʹù********************** + +#mount /dev/cdrom /mnt/cdrom +#df +#cd /mnt/cdrom +#ls /mnt/cdrom + +жع +#umount /mnt/cdrom + +#eject + + +*************Ӳ̻********************** + +fdisk ַ +mkfs ļϵͳ +mount Թء +/etc/fstab дļ + +dMesg |grep sdb 鿴ӲǷʶ + + +fdisk -l +fdisk /dev/sdb* sdb* + +m ȡ +p ʾ +n · +t ıļ +d ɾ +w ˳ +q ˳ + +ļϵͳ +mkfs ʽ + +mkfs.ext3 /dev/sdb1 + +Ӵ̻ +mkdir /mnt/test +mount /dev/hda6 /mnt/test +touch /mnt/test/testfile +ls /mnt/test + +*************/etc/fstab ĺ壺********************** + +/dev/mapper/VolGroup-lv_root / ext4 defaults 1 1 +proc /proc proc defaults 0 0 + +1./ +2.ص +3.ļϵͳ +4.ȱʡ +5.Ƿ⡾0⣬1⡿ +6.˳0⣬1ȼ⣬2μ⡿ + + +*************SwapFileʵ********************** + +dd if=/dev/sda of=/dev/sdb /dev/dsaӲϵȫ/dev/sdbϡ + +dd if=/dev/zero + +1.#mkdir /var/swap + #chmod 700 /var/swap +2.#dd if=/dev/zero of=/var/swap/file.swp bs=1024 count=65536 һļС1024x64=65536 +3.#mkswap /var/swap/file.swp +4.#vi /etc/fstab + /var/swap/file.swp swap swap defaults 0 0 +5.free +6.swapon /var/swap/file.swp +7.free + + +*************ô********************** +ΪʲôҪ Է + +/test ȨΪ777 ÿûֻʹ50MС + +1. +༭/etc/fstab ļڹԼϱ־usrquota(û)grpquota(û) + +/dev/sda3 /home ext3 defaults,usrquota 1 2 +mount -o remount /home +ʱãmount -o remount,usrquota /home + +2.ݿ⣨뵥ûģʽ +quotacheck -cvuga c vʾϢuûgaз +/testaquota.user aquota.groupļ + +3. +quotaon <> ܡ +quotaon /test +quotaoff ر + +4.༭û +edquota û edquota -g û +edquota -t ÿ +޶ûļС +ƺӲ ƣ棬Ӳƣܼ +Ӳ 50M * 1024 + +û +edquota -p ģû û1 û2 +edquota -p helen user1 user2 user3 + +quota 鿴ûʹ +repquota -a Ա鿴û + + +*************ϵͳDZв********************** +ϵͳӲ + +Դ +û +Ϊƻ +еûмʱд +Ȼֺ + +*************ݽѡ********************** +Ӳ + +Ŵ +ƶ豸 +ɿٶȺͽʼ۸ + +ϵͳ + 1.ʵֶԲϵͳӦóı + 2.ϵͳԺټ򵥵ػָϵͳ + 3.Ҫ/etc /boot /var/log /usr/local + 4.һֻеϵͳݷ仯ʱŽ + +û + 1.ʵֶûļı /home + 2.ûݱ䶯Ƶ + 3.ͨݲԽ + + +*************־淶********************** + +ƣipַλ +ʱ +ݽʼ +ݵļϵͳ +ݵĿ¼ļ +ʹõı +Ա + + +*********************************** +1. +2.ݷ ro umount +3.ѹ bzip2 +4.У md5sum -c +5. GnuPG PGP ǶԳԿܣԿ˽Կ + +*************cpݾ********************** + +Ŀ¼ + cp -Rpu <Ŀ¼> <ĿĿ¼> + -p ֱĿ¼ļԡ + -u ݡ + +Զ̱ݿscp + + +*************tarݾ********************** +#tar -zcf /backup/etc_20150819.tar.gz /etc /etcĿ¼ͬʱĿ¼ +#tar -zcf backup_user_20150819.tar.gz /etc/passwd /etc/shadow /etc/group /etc/gshadow ָļбݡ +#tar -ztf backup_user_20150819.tar.gz 鿴ݰļ + tar -ztf user.tar.gz |grep passwd ָijһļ + +#tar -zxf /backup/etc_20150819.tar.gz ԭ/etcĿ¼ĬϻԭԭĿ¼ +-CָԭĿ¼ +#tar -zxf backup_user_20150819.tar.gz etc/group ָָֻļtarʾ/etcд/etc + +#tar -rf backup/etc_20150819.tar /etc/defaults/useradd /etc/login.defs /etc/defaults/useradd/etc/login.defs׷ӵ.tar +#tar -uf backup/etc_20150819.tar /etc/passwd /etc/passwdĿ¼޸Ĺ׷󵽱ļС + -r-uѡֻtarʹá + +#tar -zcf /backup/etc_$(data +%F).tar.gz /etc Ϊļʱ䡿 +#tar -zcf /backup/etc_$(data +%Y%m%d-%H%m).tar.gz /etc ա diff --git "a/star/Li_teacher_speak_Linux_notes/Linux\347\275\221\347\273\234\350\256\276\347\275\256.txt" "b/star/Li_teacher_speak_Linux_notes/Linux\347\275\221\347\273\234\350\256\276\347\275\256.txt" new file mode 100644 index 00000000..b8d34563 --- /dev/null +++ "b/star/Li_teacher_speak_Linux_notes/Linux\347\275\221\347\273\234\350\256\276\347\275\256.txt" @@ -0,0 +1,127 @@ +*************γ̴********************** +Ѱַ +Linuxļ + +TCP/IPOSI߲׼ıȽ + +HTTPFTPSMTP Ӧò +SNMPPOPTELNET <-------------- Ӧò ʾ +RIPNNTP Ự + + +TCPUDP <-------------- + +IPICMPIGMP +ARPRARP <-------------- + +EthernetATMFDDI · +X.25ISDN <-------------- + + +TCP/IP㣺 +OSI㣺 + ·㣺MAC + +*************ļѰַ********************** + ARP + <----------- HostsDNSNIS +MAC -----------> IP <-------------------> FQHNļƣ + RARP + +MACַ +·㣺 +00:0C:29:D4:B4:C7 + +ǰ24λ̱ʶʶ + +DOS ܾ񹥻 SYNFLOOD + + +TCP ɿ֣ϵطʱٶȽͣ ȫ˫ +UDP ٶȿ죬ɿԵͣQQƵվȣ + + +ȫ˫//˫ + + +www.funet8.com. + + +ARP ַЭ +arp -a 鿴arpַ +arp -d ɾarp¼ +arp -s arp̬¼ + + +/etc/hosts +IPַ + +NIS network information system ļļй +ļйҹ񡣱̭ + +DNS domain name system ϵͳ +BIND [] + +ͻ --->www.funet8.com ѯ̡ +1.DNS +л棨建棩 +2. . +-->ȥʡ.com +3.funet8.com +DNS-->ͻ + +1MACַԶӦipַеIJϵͳʵ֡ + +1ipַԶӦMACַ +clusterȺ + +һԶӦipַûipΧлͬķip + +һipԶӦ + +#ifconfig eth0 192.168.1.2 +#vi /etc/sysconfig/network-scripts/ifcfg-eth0 +IPADDR=<µipַ> +GATEWAY=192.168.1.1 ָء +BROADCAST=192.168.1.255 㲥ַ + +#vi /etc/sysconfig/network +HOSTNAME=localhost.localdomain ı + +/etc/rc.d/init.d/network start/stop/restart ֹͣ +service network restart + +/etc/services еϢ + + ˿/Э +systat 11/tcp users +systat 11/udp users + +#vi /etc/resolv.conf ָDNSַСڵ + +nameserver 114.114.114.114 +nameserver 8.8.8.8 + + +*********************************** +ifconfig 鿴˿á + ifconfig eth0 down/up + +ethtool ӡ + ethtool eth0 +arp 鿴ARPϢ + arp -a + +ping ̽Զ + ping -c 3 -s 1000 192.168.1.1 + +route ·ɱ + +traceroute 鿴·· + traceroute www.funet8.com +netstat ״̬ + netstat -an + netstat -tunpl + + + diff --git "a/star/Li_teacher_speak_Linux_notes/Linux\350\277\233\347\250\213\347\256\241\347\220\206.txt" "b/star/Li_teacher_speak_Linux_notes/Linux\350\277\233\347\250\213\347\256\241\347\220\206.txt" new file mode 100644 index 00000000..c4c08c91 --- /dev/null +++ "b/star/Li_teacher_speak_Linux_notes/Linux\350\277\233\347\250\213\347\256\241\347\220\206.txt" @@ -0,0 +1,300 @@ +*************γ̴********************** +̵ĸ +̹ +ƻ + + +*************̺ͳ********************** +1.Ǿ̬dzִеĹ̡ + +2.ͽһһӦϵһж̣һڻп˳ִ + +*************ӽ********************** +1.ӽһģӽ̵Ľ̳Ϊ +2.linuxϵͳУʹfork̡forkƸ̵ݿͶջ +3.ֹӽȻֹ + +ǰ̨ + shellʾ󣬴һӽ̣shellȴ˳Ȼ󷵻صûʾshell첽Уǰ̨Уû֮ǰִһ + +̨ + shellʾһ&shellӽдȴ˳ֱӷضûʾshellͬУں̨С̨̱Ƿǽʽġ + + + +̵״̬ 1.״̬ 2.״̬ 3.ȴ״̬ + +״̬ϸ10֡˽⣩ + + +*************鿴ûϢw********************** + +w ʾϢĺ塿 + JCPUһն˴֣նصĽִʱĵCPUʱʾ + PCPU:CPUִгķѵʱ + WHAT:ûִеIJ + load average: 0.04, 0.07, 0.02 ƽֵ + + +w+[û] 鿴ûϢ + + + +***********鿴ϵͳеĽps************************ + +ps 鿴Ϣ +ѡ + aʾûĽ + uʾûʱ + xʾûпն˵ľ + eʾн̣ûпն˵Ľ + lʽʾ + wʾʹöwмӿʾ + +ʵ + #ps 鿴ԼĽ̡ + #ps -u ps -l 鿴ԼϸϢ + #ps -le ps -aux 鿴ûִеĽ̵ϸϢ + #ps -aux --sort pid ɰִеʱPID UIDȶԽ̽ + + PID ̺š + PPID ̡ + TTY նˡ + STAT ǰ״̬ S: D:ն˵״ R״̬ Z״̬ Tֹͣ + NI ȼ + TIME ռcpuʱ䡿 + COMMAND/CMD ̵ + USER û + %CPU ռcpuʱʱİٷֱȡ + %MEM ռڴϵͳڴİٷֱȡ + +#ps -le | grep httpd + +#ps -uU www 鿴wwwûĽ̡ + +#pstree | more 鿴н״ṹϢ + +***********ɱ kill************************ + +ΪʲôҪɱ? + +÷ + kill + pid + +kill -9 ̺ ǿйرա +kill -1 ̺ ̡ + +xkill رͼγ +killall н̡ +pgrep ҽ̷š +pkill رս̡ + +#ls /proc ÿĿ¼С +#cat /proc/cpuinfo 鿴cpuϢ +#cat /proc/meminfo 鿴ڴϢ +#cat /proc/partitions Ϣ + +#pgrep httpd 鿴httpd̺š + + + +***********ȼ nicerenice************************ + +nice ָȼ + ʽnice -n command + + 磺nice -5 myprogram [ıȼΪ5 -ʾѡ] + nice --5 myprogram [ıȼΪ-5 ] + + +renice ıһеĽ̵ȼ + + ʽrenice n pid + + 磺renice -5 777 + +ȼΧȡֵΪ-2019 ȼֵԽСԽǰ + +#nice --5 /etc/rc.d/init.d/httpd start +#ps -le | grep httpd + + + +***********̨ nohup************************ + +ʹû˳½ȻִУnohupִкݿϢʹϢĬϴ浽ļnohup.out + +ʽ + nohup program & + + +nohup find / -name init* > /root/find.init & ִ̨г򣬽дָļС + + + +***********̵Ĺͻָ************************ + +Ctrl+Z ͣ + +Ctrl+C ֹ + + +̵Ļָ + +fg ָǰ̨С + +bg ظ̨С + +jobs 鿴Ľjobs + + +***********״̬ʾtop************************ + +top ״̬ʾͿƣÿԶˢһΡ + +ѡ + d:ָˢʱ + cʾжʾ + u鿴ָûĽ + h? ȡ + rýȼ + sıˢʱ + Wд~/.toprcļ + + q ˳ + + +op [-] [d] [p] [q] [c] [C] [S] [n] + +˵ +d ָÿĻϢˢ֮ʱȻûʹsı֮ +磺top -d 1 ÿһˢһΡ + +p ָͨؽIDij̵״̬ + + +qѡʹtopûκӳٵĽˢ¡óгûȨޣôtopԾܸߵȼС + +S ָۼģʽ + +s ʹtopڰȫģʽС⽫ȥDZΣա + +i ʹtopʾκû̡߽ + +c ʾжֻʾ + + + +***********ƻ************************ + +ƻ + +at ҵijһʱִһΡ +batch ҵϵͳزʱִһΡ +cron Եҵ + + +***********atĹܺ͸ʽ************************ + +ܣһ߶ָʱһΡ + +зcentos6.5 miniûԴatҪԼͨ +# yum -y install at + + +÷Ͳ +at [-fļ] ʱ +at -d or atrm ɾе +at -l or atq 鿴е + +atָʱķʽ +1.Լʱ + midnight moon teatime + hh:mm[today] + hh:mm tomorrow + hh:mm + hh:mm MM/DD/YY +2.Լʱ + now + n minutes now + 3 ninutes + now + n hours + now + n days + +ָڽ17:30ִijʱ14:30,2011111գ +ʽ£ + at 5:30pm + at 17:30 + at 17:30 today + at now + 3 hours + at now + 180 minutes + at 17:30 11.1.11 + at 17:30 1/11/11 + +#at now + 3 minutes +at> /user/bin/wall < /etc/motd ȫʹþ· + crtl+d桿 + + +finger root 鿴 + +ps -le | grep atd + +ÿһûʹat +ļ +/etc/at.allow +/etc/at.deny +ļڶΪգûʹat 2ļɾôֻrootûʹat + +***********batch************************ + +ãһ߶ϵͳؽʱһΣһ¸0.8£ŻִУ + +ʹ÷ͬat + +***********crontabʽ************************ + +ãcronҪcrontabļ +crontabʽ + carontab {-l|-r|-e} + -l listʾǰcrontab + -r ɾǰcrontab + -e editʹñ༭༭ǰcrontabļ + +crontab -e +֪ľʱϣ֪Ķ* + Сʱ ű/ + +0 4 * * * [] ÿĵִС +0 18 * * 2,5 [] ÿ25ִС +0 18 * 1-3 2,5 [] 13ÿ25ִС + +30 17 * * 1-5 /user/bin/wall < /root/read.txt һ17:30һread.txt㲥 +45 17 * * 1-5 /sbin/shutdown -h now һ17:45ػ + +*/2 12-14 * 3-6,9-12 1-5 /bin/cp -r /etc/backup/etc.2011011 2>/backup/etc.bak.err >/dev/null +ÿӣ1214 36 9-12 һ塿 + + +дע +ЩΪգ +ûҪָеļʹͨ *ʾʱ +ûʱֶζֵָ֮öż +Ӧø· +ûӦȨޡ + +ƻ񱣴棺 +/var/spool/cron/root + +/etc/cron.hourly +/etc/cron.daily +/etc/cron.weekly +/etc/cron.monthly + + +***********̴************************ +standalone УռϵͳԴӦ١ +xinetd йܣ +atd crond ƻ + + + + diff --git "a/star/Li_teacher_speak_Linux_notes/NFS\346\234\215\345\212\241\345\231\250\351\205\215\347\275\256.txt" "b/star/Li_teacher_speak_Linux_notes/NFS\346\234\215\345\212\241\345\231\250\351\205\215\347\275\256.txt" new file mode 100644 index 00000000..4517286f --- /dev/null +++ "b/star/Li_teacher_speak_Linux_notes/NFS\346\234\215\345\212\241\345\231\250\351\205\215\347\275\256.txt" @@ -0,0 +1,60 @@ +*************NFS******************* +NFS-Network File System +UNIX/Linuxϵͳͨļû԰NFSṩĹĿ¼صļĿ¼УԱļϵͳһNFSļϵͳݡ + +*************װNFS******************* +#rpm -q portmap +#rpm -qa | grep nfs 鿴ϵͳǷװNFS + +#service portmap start +#service nfs start portmapһҪNFS + +ûװnfs +#yum install nfs-utils + +service rpcbind start 6.0ϵͳportmapѾˡ +[root@bogon ~]# service nfs start +Starting NFS services: [ OK ] +Starting NFS mountd: [ OK ] +Starting NFS daemon: [ OK ] +Starting RPC idmapd: [ OK ] + +RPCǷ +NFSͨRPCRemote Procedure CallԶ̵̹ãЭʹԶ̼ϵļϵͳеRPC +#rpcinfo -p + +*************ùĿ¼******************* + +NFSĿ¼ /etc/exports +ʽĿ¼ зȨޣ + +ʵ +/pubic +/pubic + +/website 192.168.16.128(ro) +192.168.16.128ֻȨ޷/website + +exportfs Ŀ¼ʽexportfs -rv + +showmount -e 鿴NFSĿ¼ +#showmount -e 192.168.1.222 + + +#mkdir /mnt/website +#mount 192.168.1.222:/website /mnt/website nfsĹĿ¼صص㡿 +#df -h +#umount /mnt/website + +ȫԲߣھʹ + +ʱԶNFS +vi /etc/fstab +NFSĿ¼ ص ļϵͳ Ȩ Ƿ ˳ + +ʵ +192.168.1.222:/pubic /mnt/pubic nfs ro 0 0 + + + + diff --git "a/star/Li_teacher_speak_Linux_notes/linux\347\224\250\346\210\267\347\256\241\347\220\206.txt" "b/star/Li_teacher_speak_Linux_notes/linux\347\224\250\346\210\267\347\256\241\347\220\206.txt" new file mode 100644 index 00000000..74c9b500 --- /dev/null +++ "b/star/Li_teacher_speak_Linux_notes/linux\347\224\250\346\210\267\347\256\241\347\220\206.txt" @@ -0,0 +1,319 @@ +*************γ̴********************** +1.û +2.û +3.û +4.û +5.ûȨ + + +*************ļ********************** +ûϢļ /etc/passwd +ļ /etc/shadow +ûļ/etc/gshadow +ûļ + /etc/login.defs + /etc/default/useradd +ûϢļ /etc/skel +¼Ϣ /etc/motd + + +*************ûϢ********************** + +more /etc/passwd +Ϣ磺 +root:x:0:0:root:/root:/bin/bash û +shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown αû +liuxing:x:500:500::/home/liuxing:/bin/bash ͨû +7ɲ֣ +ûλUIDGIDϢĿ¼shell + +root ûû¼ϵͳʱʹõû +x 룺λ +0 UID:ûʶš +0 GIDȱʡʶš +root עûȫϢȡ +/root Ŀ¼û¼ϵͳȱʡĿ¼ +/bin/bash ûʹshellĬΪbash + +linuxûΪ + ûroot, uid=0 ޸ûUIDΪ0ͳΪԱ + ͨûUID:500-60000 + αû UID:1-499 + +αû + 1.αûϵͳͳ. + #bindaemoshutdownhaltȣκLinuxϵͳĬ϶ЩĬϵαû + #mailnewsgamesApacheftpmysqlsshdȣlinuxϵͳĽء + 2.αûͨҪ޷½ϵͳ + 3.ûĿ¼ + +useradd + +*************û********************** + +1.ÿûһû +2.ÿû԰û +3.ͬһûû鹲еȨ + +md5ܣ򲻿档볤Ȳ̶ǹ̶ġ +磺 + #echo "123456" | md5sum + + +[root@bogon ~]# more /etc/shadow +root:$6$gwEQg7v5pcwGLVv2$Zs9rQCJB9XjTrbZCCE5xoDH97DGVIsvqCnUyzvz.4RS6hDYzvDIz7mt +liuxing2:!!:16634:0:99999:7::: +û룺һ޸ʱ䣺Сʱʱʱ䣺˺ʱ䣺˺ʧЧʱ䣺ʶգ + + +һ޸ʱ䣺1970,1,1տʼ㡣 +Сʱ֮롣 +ʱ֮롣 +˺ʱ䣺3 +˺ʧЧʱ䣺˺űͣ + +ɾ/etc/shadow벿ɾͿԲҪ½ϵͳ + + pwunconv תpasswdshadow + pwconv + +ֹû + vi /etc/passwd + vi /etc/shadow + ½Ŀ¼ҸĿ¼ûȨޡ + /etc/skelļļĿ¼С + + + +*************setUIDsetGIDճλĸ********************** +setUID +Ϊʲôͨû޸룿 +setUIDһִгsetUIDȨޣûִʱ(root)ִС + +Ȩλ4755 +chmod u+s [ļ] +chmod 4755 [ļ] + +ȡsetUID +chmod u-s [ļ] +chmod 755 [ļ] + +setGID=2 +chmod g+s [ļ] + 2755 + +ճλ=1 +һȨΪ777Ŀ¼ճλÿûĿ¼´ļֻɾԼߵļ + +ճλ + chmod o+t [ļ] + chmod 17777 [ļ] + +setUID + +еļsetuid setgid +find -perm -0777 + +setUID +find / -perm -4000 -o -perm -2000 + + +*************û********************** + +adduser -D 鿴ûȱʡֵ + +u:UID +g:ȱʡûGID +G:ָû +dĿ¼ +sShell +cϢ +eָûʧЧʱ + +û +useradd -u 666 -g root G sys,apache -d /backup -s /bin/bash -c "project liuxing3" -e 20151212 jack + + + +passwd sam + +ֹû + + +*************ûɾ********************** + +û + groupadd + +groupadd -g 888 webadmin [ûwebadmingidΪ888] + +ɾ + groupdel +[] userdel + +groupmod -n apache webadmin ޸webadminΪapache + + + +*************û********************** +gpasswd ѾڳԱ + + -a ûû + -d ûɾû + -A ûԱ + -r ɾû + -R ֹûлΪ + +gpasswd -a [û] [] + +usermod ޸ûϢ + usermod -G softgroup samlee ûsamleeӵsoftgroupûС + +groups 鿴ûЩû顿 +newgrp лû顿 +grpck ûļ⡿ +chgrp ޸ļ顿 +vigr ༭/etc/groupļļ +id 鿴ûϢԼϢ + + +*************ûȨʾ********************** + +ȨûjackmaryĿ¼/softwareдȨ +groupadd softadm +usermod -G softadm jack ûjackӵsoftadm + 鿴grep softadm /etc/group + softadm:x:504:jack,mary +gpasswd -a mary softadm +chgrp softadm /software ޸ļȨޡ +chmod g+w /software + +ls -ld /software + + +*********************************** + +pwck /etc/passwdļ +vipw ༭/etc/passwdļļû޷༭ļ +id 鿴ûidϢ +finger 鿴ûϸϢcentosĬϲ֧֣yum install -y finger +su лû su - л + su - [û] л + su [û] лrootĻ /root + + +passwd -S 鿴û״̬ +# passwd -d jack ɾû롿 +Removing password for user jack. + +whow 鿴ǰ¼ûϢ + +passwd -l [û] ûl=lock ԭû/etc/shadowǰ̾ +usermod -L [û] + +passwd -u [û] ûu=unlock + +chage 趨롿 + chage -l [û] + + +wʹѡ 鿴ϵͳ¼û +-hͷļϢ +-uʾļʱ +-sʾJCPU PCPU ¼ʱ + + +*************ͣshadow********************** + +pwconv/pwunconv +grpcov/grpunconv + +system-config-users +authconfig /etc/sysconfig/authconfig + +vi /etc/sysconfig/authconfig + + +*************û********************** + +newusers ûϢļ/etc/passwdʽ + +pwunconv ȡshadow passwdܡ + +chpasswd ļ + ʽ û룩 + +pwconv дshadowļ + +ʵһ10û +һ + 1 vi user.info ûϢ + lxx1::1001:503::/home/lxx1:/bin/bash + lxx2::1002:503::/home/lxx2:/bin/bash + lxx3::1003:503::/home/lxx3:/bin/bash + lxx4::1004:503::/home/lxx4:/bin/bash + + newusers < user.info ûϢ + + 2pwunconv ȡshadow passwdܡ + + 3 vi pass.info д롿 + lxx1:liuxing + lxx2:liuxing + lxx3:liuxing + lxx4:liuxing + chpasswd < pass.info û롿 + + 4)pwconv дshadowļ + + + ʹshű-> shٽ + + +*************ûsuлroot********************** + +#groupadd sugroup +#chmod 4550 /bin/su +#chgrp sugroup /bin/su +#ls -l /bin/su +-r-sr-x--- 1 root sugroup 18360 jan 15 2015 /bin/su +趨ֻrootûsugroupеûʹsuлroot +#useradd helen +#passwd helen +#usermod -G sugroup helen + + +*************sudosu********************** + + ִsudoʱʱΪroot + й©root + ûṩ޵ʹȨ + Ȩ޾ϸ + +ļ/etc/sudoers +visudo ༭ļ +ͨûʹsudo + ʽ + û ַ=· + visudo: + lxx2 192.168.1.222=/usr/sbin/useradd + $groupname ALL=ALL + + +*************John the ripper ********************** +#tar -xzvf john-1.7.6.tar.gz +#cd john-1.7.6/run +#make +ƽûliming +#grep liming /etc/passwd > /test/liming.passwd /etc/passwd ûϢȡŵ/test/liming.passwd +#gerp liming /etc/shadow > /test/liming.shadow +#/test/john-1.6.6/run/unshadow /test/liming.passwd + /test/liming.shadow > /test/liming.john +#/test/john-1.6.6/run/john /test/liming.john + +صַhttp://www.openwall.com/john + + + + + + diff --git "a/star/Li_teacher_speak_Linux_notes/linux\350\275\257\344\273\266\345\214\205\347\256\241\347\220\206.txt" "b/star/Li_teacher_speak_Linux_notes/linux\350\275\257\344\273\266\345\214\205\347\256\241\347\220\206.txt" new file mode 100644 index 00000000..31f952a2 --- /dev/null +++ "b/star/Li_teacher_speak_Linux_notes/linux\350\275\257\344\273\266\345\214\205\347\256\241\347\220\206.txt" @@ -0,0 +1,217 @@ +*************Linux******************* + +RPM YUM +Դװ +űװShellJavaű +Debianϵ(ڰͼ)Linux + + +*************RPM******************* + +RPM + sudo-1.7.2pl-5.el5.i386.rpm + sudo + 汾ţ1.7.2pl + кţ5.el5 + Ӳƽ̨i386 + +ж +#rpm -e sudo ʹ--nodepsǿжء + + rpm -e samba ʾʧܡ + rpm -e --nodeps samba ǿжء + + +װ +rpm + +#rpm -ivh sudo-1.7.2pl-5.el5.i386.rpm + + -i װʱʾװȡ + -v ϸϢ + -h װȡ + -q 鿴Ƿװ + -qa 鿴 + + -ivhװʾװ--install--verbose--hash + -Uvh--Update + -qplгRPMڵļϢ[Query Package list] + -qpiгRPMϢ[Query Package install package(s)] + -qfָļĸRPM[Query File] + -VaУеRPMҶʧļ[View Lost] + -eɾ + -a ѯϢ + -f ѯļ + -p ѯ + -l ʾеļб + -d ʾעΪĵļб + -c ʾעΪļļб + -V У + +rpm -qf /etc/services 鿴ļڵ +rpm -qf /bin/ls + +rpm -qi \ rpm -qip ѯϢ + +rpm -ql sudo sudoװľ· + +rpm -qd ѯĵ + +rpm -qc ѯļ + +rpm -V sudo md5Уκʾľͻʾ +У + S ļС + L ļ + T ļʱ䡿 + D 豸ļ + U ļû + G ļû顿 + M ļȨޡ + + + +md5sum ļУֵ +md5sum /etc/services + + + +ع̡ +#mkdir /mnt/cdrom +#mount /dev/cdrom /mnt/cdrom #ָ + +rpm -q webmin 鿴webminǷװ + +rpm -qa | grep samba sambaص + +--excludedocs װеĵ +磺rpm -ivh --excludedocs + +--prefix PATH װָ·¡ +磺rpm -ivh --prefix=/user/local/sudo + +--test ֻвԡ + +--replacepkgs װ +磺rpm -ivh --replacepkgs + +ļͻҪװһļڰװʱװ´ + +--replacefiles ҪRPMļϢ +磺rpm -ivh --replacefiles + +δϵϵһ㰲װ֮󲻻⡣ +--nodeps ǿаװ + +rpm -Uvh + +*************RPM******************* +ļȡ +ѹļǰĿ¼ +#rpm2cpio initscipt-8.45.....i386.rpm | cpio -idv + +ѹָļǰĿ¼ +#rpm2cpio initscipt-8.45.....i386.rpm | cpio -idv ./etc/inittab + +Ҫϵͳļɾˣ޸ϵͳ + + + + + +*************YUM******************* + +yumӦõĺô +1.Զϵ +2. + +yumѡ + +yum install װ + +yum check-update + +yum update + +yum list ѯ + +yum info Ϣ + +yum remove жء + +yum -help man yum + +г +yum list | more +yum list | grep sudo + +ѯϢ +yum info sudo + + +*************Դװ************************************** +Դĺô +Ӧڴunixϵͳ +Դװɶơ +жأȹرս̣ɾļС + +Ӧþ +װproftpd + +#tar -xzvf proftpd-1.3.3d.tar.gz ѹ +#cd proftpd-1.3.3d +#./configure --prefix==/user/local/proftpd ãָװĿ¼ +#make 롿 +#make install װ + +*************űװ************************************** +Ӧþ +webmin +OpenOffice + +#tar -xzvf webmin-l.530.tar.gz +#cd webin-l.530 +#vi README +#./setup.sh + +www.webmin.com + +*************APT************************************** +Debianϵ(ڰͼ) + + apt-cache search +Ϣ apt-cache show +װ apt-get install (reinstall -f) +ɾ apt-get remove (autoremove--purge) +Դ apt-get update +Ѱװ apt-get upgrade + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git "a/star/Li_teacher_speak_Linux_notes/scp\344\270\216rsync\350\256\276\347\275\256.txt" "b/star/Li_teacher_speak_Linux_notes/scp\344\270\216rsync\350\256\276\347\275\256.txt" new file mode 100644 index 00000000..92c61230 --- /dev/null +++ "b/star/Li_teacher_speak_Linux_notes/scp\344\270\216rsync\350\256\276\347\275\256.txt" @@ -0,0 +1,112 @@ +*********************ssh********************* +1.sshԶ̵¼ secureCRT +2.sftp ļFTP +3.scp ļcp + + +[root@bogon ~]# ssh root@192.168.1.222 +1.ûֹ¼ +2.ֹroot¼centos5ûнֹ + +SSH1SSH2 +[root@bogon ~]# ssh -2 liuxing2@192.168.1.222 + +1.ֹrootԶ̵¼ +#vi /etc/ssh/sshd_config +ļеעȥ +#PermitRootLogin yes +#service sshd restart + +޸ssh˿ںţ +#vi /etc/ssh/sshd_config +޸Ķ˿ڷDZ׼˿ں +#Port 22 + +sftpԶ +[root@bogon ~]# sftp 192.168.1.222 +Connecting to 192.168.1.222... + + +*********************Զ̹SSH********************* +ļԶ +scp <ļ> <û>@Զַ:ԶĿĿ¼ +scp -r <ļ> <û>@Զַ:ԶĿĿ¼ + +Զļأ +scp <û>@Զַ:Զļ Ŀ¼ +scp -r <û>@Զַ:Զļ Ŀ¼ + +ѡ-p ԭļԡ + -r Ŀ¼ + -P ָ˿ںš +ʵ +#scp /root/1.txt liuxing2@192.168.1.222:/home/liuxing2 +#scp -r /root/ liuxing2@192.168.1.222:/home/liuxing2 + +Զ̱ +⣺һ̨/websiteļУڱݵԶ̷ϣÿȫݣһݡ +ݣͬġ + +192.168.16.155ݵlocalhost + +1.crontab -e +0 2 * * 0 /usr/bin/scp -rp webadm@192.168.16.155:website /backup/website_$(data +%F) ÿȫݡ + +һݣ +2.crontab -e +0 2 * * 1-6 /urs/bin/rsync -arHz --delete liuxing2@192.168.16.155:/website /backup + + +ڱݷԿԿݷ +ݷ֤Կ + + +*********************ԳԿ********************* +ʹͬһԿ +ƣٶȿ +ȱ㣺ԿҪ + +*********************ǶԳԿ********************* +ҲйԿܣʹʱԿһţΪԿһ˽˳УΪ˽ԿûһԿֻܵһԿܽܡ + +ƣȫԺ +ȱ㣺ٶ +ԼϢʱͨǶԳƼܺͷǶԳƼܻܽʹá + + + +һ +Կ +#ssh-keygen -t rsa +ɹԿ id_rsa.pub + + +һԿ֤Կ +#cat id_rsa.pub>>.ssh/authorized_keys ׷Ӷ +#chmod 600 .ssh/authorized_keys +#chmod 700 .ssh +ʵ֣һʲҪ롣 + +*********************rsyncӦ********************* +*ʵ +*ɾ񱣴Ŀ¼ļϵͳ +*ļȨޡʱ䡢Ӳӵ +*ļЧʸ +*ʹSSHͨ + + + +rsync +༭ļ vi /etc/xinetd.d/rsync +disable = no +xinetd service xinetd restart + +-a ļԡ +-r Ŀ¼ݹ鴦 +-H ļӲӡ +-z ļʱѹ +--progress ڴʱʾ̡ +--delete ɾĿ걸ûеļ +-e ssh ʹSSH䡿 + + diff --git "a/star/Li_teacher_speak_Linux_notes/shell\347\274\226\347\250\213.txt" "b/star/Li_teacher_speak_Linux_notes/shell\347\274\226\347\250\213.txt" new file mode 100644 index 00000000..0051c3f4 --- /dev/null +++ "b/star/Li_teacher_speak_Linux_notes/shell\347\274\226\347\250\213.txt" @@ -0,0 +1,453 @@ +*************γ̴********************** +shell﷨ +shellű +shellӦʵ + +*************һ򵥵shellű********************** +shellṹ +1.#!ִָнűshell +2.#ע +3.Ϳƽṹ + +shell +һһ +ڶ޸ļȨ + ʹchmod u+x +ִ ./example.sh sh example.sh + sh +x example.sh ʾűִеĹ̡ + +#!/bin/sh +#ԶϵͳϢ +/bin/date +%F >> /tmp/sysinfo +echo "disk info:" >> /tmp/sysinfo +/bin/df -h >> /tmp/sysinfo +echo >> /tmp/sysinfo +echo "online user:" >> /tmp/sysinfo +/user/bin/who | /bin/grep -v root >> /tmp/sysinfo +echo >> /tmp/sysinfo +echo "memory info:" >> /tmp/sysinfo +/user/bin/free -m >> /tmp/sysinfo +echo >> /tmp/sysinfo + +#write root +/user/bin/write root < /tmp/sysinfo && /bin/rm /tmp/sysinfo + +#crontab -e +#0 9 * * 1-5 script + + +*************shell********************** +shellݵһַÿȡֵķ +ʱñ + +[root@bogon ~]# echo $PATH +/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin +[root@bogon ~]# echo $LANG +en_US.UTF-8 +[root@bogon ~]# echo $SHELL +/bin/bash +[root@bogon ~]# echo $PS1 +[\u@\h \W]\$ + +ûԶ +ĸ»߿ͷĸ»ɣִСдơ +ʹñҪ$ + +NUM=100 +echo $NUM + +ź˫ŵ +#$ABC='$NAME junior' +#echo $ABC + $NAME junior +֮ԭⲻָ˱ +#unset NAME ɾ + +λñ + +ShellִûʱеĵһΪΪɳϵλȷIJΪλò +磺 +ls -l file1 file2 file3 +$0 ļ ls -l +$n ĵnֵ n=1-9 + +#!/bin/sh +#Զ +DATE ='/bin/date +%Y%m%d' +/bin/tar -cf /backup/$1.$DATE.tar $1 > /dev/null 2>> /backup/$1.bak.log +/bin/gzip /backup/$1.$DATE.tar +if[ $? -eq 0] +then + echo "$1 $DATE backup successfully">>/backup/$1.bak.log +else + echo "ERROR:failure $1 $DATE backup!">>/backup/$1.bak.log +fi +#crontab -e +#0 3 * * 2,5 script + + +*************shell********************** + +$* в +$# IJ +$$ PID +$! ִһ̨PID +$? ִһķֵ0ɹ 0ɹ + +*************shell********************** +read + Ӽ̶ݣ + read USERNAME + +expr + ͱ мпո +磺 + expr 3 + 5 + expr $var1 - 5 + expr $var1 / $var2 + expr $var3 \* 10 + +ӵexpr +expr 'expr 5 + 7'/$var4 + + +*********************************** + +ڲԱǷȣǷΪգļ͵ȡ +ʽ + test + +ԷΧΣַļ + +ַ +test str1=str2 ַǷȡ +test str1!=str2 ַǷȡ +test str1 ַǷΪա +test -n str1 ַǷΪա +test -z str1 ַǷΪա + +ԣ +test int1 -eq int2 Ƿȡ +test int1 -ge int2 int1Ƿ>=int2 + -gt + -gt С + -le Сڵ + -lt С + -ne + +ļԣ +test -d file ǷΪĿ¼ +test -f file ļǷΪļ +test -x file Ƿִ +test -r file Ƿɶ +test -w file Ƿд +test -a file Ƿ +test -s file СǷΪ0 + +testif + +if test -d $1 then + ... +fi + +д +test -d $1 ȼ [-d $1] + +жApacheǷ: +web ='/usr/bin/pgrep httpd' +if ["$web" != ""] +then + echo "the web service is running " +else + echo "the web service is NOT running" + /etc/rc.d/init.d/httpd start +fi + + +if then + +if/else + + +if 1 then + +elif 2 then + 2 +else + 3 +fi + + +-a ߼룬Ϊ桿 +-o ߼һΪ桿 + +˳ +exit䣺˳ִУҷһ룬0ʾ˳0ʾ˳ + +磺exit 0 + + +#!/bin/sh +if [ $# -ne 2 ];then + echo "not enough parameters" + exit 0 +fi +if [ $1 -eq $2 ];then + echo "$1 equals $2 ==" +elif [ $1 -lt $2 ]; then + echo "$1 littler than $2 <" +elif [ $1 -gt $2 ];then + echo "$1 greater than $2 >" +fi + + +[root@vm_web1 ~]# sh test.dayuxiaoyu 2 4 +2 littler than 4 < + +*************for...doneѭ********************** + +ʽ for in ֱ + do + + done + + +#!/bin/sh +for DAY in sunday monday tuesday wednesday thursday friday saturday +do + echo "the day is : $DAY" +done + +ɾû¼ +#!/bin/sh +#kill user logined user +username="$1" +/bin/ps aux | /bin/grep $username | /bin/awk '{ print $2 }'> /tmp/temp.pid +killid='cat /tmp/temp.pid' +for PID in $killid +do + /bin/kill -9 $PID 2>/dev/null +done + + +*************awk -F Ӧ********************** +awk -F ָ  ȡص + +ʾ +1.ϵͳUIDΪ0û + awk -F:'$3==0 {print $1}'/etc/passwd +2.ϵͳΪյû + awk -F:'length($2)==0 {print $1}'/etc/shadow + +grep ^root:x /etc/passwd + +*************select...inѭ********************** +select ѹؼеÿһƱԽķʽִdodone֮ + +select in ؼ +do + command 1 + ... ... + command n +done + +ʾ +#!/bin.sh +echo "what is your favourite OS?" + +select var in "Linux" "UNIX" "windows" "Other" +do + break +done +echo "you have select $var" + +*************case...csacѭ********************** + +case..csac䣬ʽ + + case in + ַ1) б1 + ;; + ... + ַn) бn + ;; + esac + +ʾ +#!/bin/sh +echo "*************************" +echo "please select your operation" +echo "press C to copy" +echo "press D to delete" +echo "press B to backup" +echo "*************************" +read op +case $op in + C) + echo "your selection is copy" + ;; + D) + echo "your selection is delete" + ;; + B) + echo "your selection is backup" + ;; + *) + echo "invalide selection" +esac + +*************while********************** +ִУһֱִ breakֹͣ +while䣬ʽ + + while + do + + done + +ʾ1 +#!/bin/sh +while [ -d /etc ] +do + ls -ld /etc +done + +ʾ2 +#!/bin/sh +num=1 +while [ $num -le 10 ] +do + SUM='expr $num \* $num' + echo $SUM + sum='expr $sum + 1' +done + + +û +useradd shedon +echo 123456 | passwd --stdin shedon + + +ûshellű +#!/bin/sh +echo "please input username:" +read name +echo "please input number:" +read num +n=1 +while [ $n -le $num ] +do + /usr/sbin/useradd $name$n + n='expr $n + 1' +done + +#/etc/shadow info +echo "please input the password:" +read passwd +m=1 +while [ $m -le $num ] +do + echo $passwd | /usr/bin/passwd --stdin $name$n + m='expr $m + 1' +done + + +*************until********************** +until +do + +done + +untilwhileѭͬuntilֵΪʱżִС + + +#!/bin/sh + +until [ -x /etc/inittab ] +do + /bin/ls -l /etc/inittab + exit 0 +done + + +*********************************** +ѭ breakcontinue +break ѭ +continue ѭ´ѭ + +ʵ +#!/bin/sh +echo "*************************" +echo "please select your operation" +echo "press C to copy" +echo "press D to delete" +echo "press B to backup" +echo "*************************" +read op +case $op in + C) + echo "your selection is copy" + ;; + D) + echo "your selection is delete" + ;; + B) + echo "your selection is backup" + ;; + *) + echo "invalide selection" +esac + +shiftָ ƣÿִһΣ˳һλã$#ֵ1ڷֱÿƳȥٿá + +ʵ +#!/bin/sh +if [ $# -le 0] +then + echo "not enough parameters" + exit 0 +fi +sum=0 +while [ $# -gt 0 ] +do + sum ='expr $sum + $1' + shift +done +echo $sum + +*************Ӧ********************** +Ķ壺 + (){ + + } + +ĵã() + 1 2 ... + + +*************shellű********************** + +sh -x script.sh ִнűʾб + +sh -n script.sh ű﷨Ƿд + + +ͨûִshű +1.ԽűrȨޡ +2.ԽűĿ¼rxȨޡ +޷ִű + + +*************֪ʶܽ********************** +shell̵Ļ﷨ +սϵͳдӦýű +shell̵ + + + + + + + + + diff --git "a/star/Linux_cmd/Linux\345\270\270\347\224\250\345\221\275\344\273\244\345\244\247\345\205\250.txt" "b/star/Linux_cmd/Linux\345\270\270\347\224\250\345\221\275\344\273\244\345\244\247\345\205\250.txt" new file mode 100644 index 00000000..b58e0786 --- /dev/null +++ "b/star/Linux_cmd/Linux\345\270\270\347\224\250\345\221\275\344\273\244\345\244\247\345\205\250.txt" @@ -0,0 +1,728 @@ +***************************************************************** + +1. 鿴linuxں˰汾ϵͳϢõְ취 +uname -a more /etc/issue; cat /proc/version; + +2. 鿴apacheİ汾Ϣͨyumrpmװģʹ + +rpm -qa |grep httpd 鿴 + +ͨhttpd -vѯ + +3.鿴phpİ汾Ϣͨyumrpmװģʹrpm -qa |grep php鿴 + +ͬҲʹphp -v鿴phpİ汾Ϣ + +4. 鿴mysqlİ汾Ϣͨyumװģrpmװģʹrpm -qa |grep mysql 鿴 + +Ҳʹmysql -v --help|grep Distrib鿴 + + +ҲԽmysqlȻͨselect version();status;鿴 + + + +***************************************************************** + + + + + +Linuxȫ + +1. man ϤϤṩ +eg:man ls ͿԲ鿴lsص÷ +עqctrl+c˳linux¿ʹctrl+cֹǰС + +2. ls 鿴Ŀ¼ļ*оٳһĿ¼ļ +eg: ls /usr/man +ls -l +a.dʾĿ¼(directory)һ-ʾļlʾһļ(link) +b.ʾļĿ¼Ȩ.ֱÿɶ(r)д(w)(x) + + +3. cp ļ +eg: cp filename1 filename2 //filename1filename2 +cp 1.c netseek/2.c //1.cnetseekĿ¼Ϊ2.c + + +4. rm ɾļĿ¼ +eg: rm 1.c //1.cļɾ + + +5. mv Ŀ¼߸ļ +eg: mv filename1 filename2 //filename1 Ϊfilename2 +mv qib.tgz ../qib.tgz //ƵһĿ¼ + + +6. cd ı䵱ǰĿ¼ pwd 鿴ǰĿ¼· +eg: pwd //鿴ǰĿ¼· +cd netseek //netseekĿ¼ +cd //˳ǰĿ¼ + + + +7. catmore +ijļʾͬ:catļһֱӡ moreʾ +eg; cat>1.c //Ϳ԰Ѵճ1.cļctrl+d 롣 +cat 1.c more 1.c //Բ鿴ݡ +gcc -o 1 1.c //1.c.exeļǿô롣 + + +8.chmod Ȩ޸ ÷chmod һλ8 filename +eg: chmod u+x filenmame //ֻԼУֻܶ +//uʾļˣ g ʾļļ顣 o ʾ ;r ɶw дx +chmod g+x filename //ִͬ + + +9. cleardate +clear:൱DOSµcls;date:ʾǰʱ䡣 + + +10. mount һӲ豸 +÷:mount [] Ҫص豸 +eg: mount /dev/cdrom +cd /mnt/cdrom //Ŀ¼ + + +11. su ڲ˳½£лһ˵ +÷: su -l û(ûȱʡлroot״̬) +eg:su -l netseek (лnetseekûʾ) + +12.whoamiwhereiswhichid +//whoami:ȷԼ +//whereis:ѯĿ¼ԼĵĿ¼ +//which:ѯĿ¼(whereis) +//id:ӡԼUIDԼGID(UID:ûΨһʶGID:ûΨһʶÿһûֻһΨһUID GID) +eg: whoami //ʾѵ½û +whereis bin ʾbinڵĿ¼ʾΪ/usr/local/bin +which bin + + +13. grepfind +grep:ı;find:ļĿ¼ԼȨƥ +eg: grep success * /*ҵǰĿ¼ļ溬successַļ + + +14. kill ɱijڽлѾdest״̬Ľ +eg; ps ax + + +15. passwd ÿ + + +16. history ûù +eg: history //ʾûȥʹõ + + +17. !! ִһε + + +18. mkdir +eg: mkdir netseek //netseekĿ¼ + + +19. tar ѹ +eg: tar -zxvf nmap-3.45.tgz //ѹnmap-3.45Ŀ¼ + + +20. finger ʹ߲ѯһЩʹߵ +eg: finger //鿴ûʹ +finger root //鿴root + + +ϵͳϢ +arch ʾĴܹ(1) +uname -m ʾĴܹ(2) +uname -r ʾʹõں˰汾 +dmidecode -q ʾӲϵͳ - (SMBIOS / DMI) +hdparm -i /dev/hda һ̵ļܹ +hdparm -tT /dev/sda ڴִвԶȡ +cat /proc/cpuinfo ʾCPU infoϢ +cat /proc/interrupts ʾж +cat /proc/meminfo Уڴʹ +cat /proc/swaps ʾЩswapʹ +cat /proc/version ʾں˵İ汾 +cat /proc/net/dev ʾͳ +cat /proc/mounts ʾѼصļϵͳ +lspci -tv PCI 豸 +lsusb -tv ʾ USB 豸 +date ʾϵͳ +cal 2007 ʾ2007 +date 041217002007.00 ںʱ - ʱ. +clock -w ʱ޸ı浽 BIOS + + +ػ (ϵͳĹػԼdz ) +shutdown -h now رϵͳ(1) +init 0 رϵͳ(2) +telinit 0 رϵͳ(3) +shutdown -h hours:minutes & Ԥʱرϵͳ +shutdown -c ȡԤʱرϵͳ +shutdown -r now (1) +reboot (2) +logout ע + +ƣreboot +ʹȨޣϵͳ +ʹ÷ʽreboot [-n] [-w] [-d] [-f] [-i] +˵ϵͳ runlevel Ϊ 0 6 ¿ shutdown ָ -r ȡ + +-n : ؿǰдӲ̵Ķ +-w : ؿֻǰѼ¼д /var/log/wtmp +-d : Ѽ¼д /var/log/wtmp -n -d -f : ǿؿ shutdown ָ +-i : ؿ֮ǰȰصװֹͣ + +reboot ؿ +reboot -w ؿģ⣨ֻм¼ؿ + + + + + +ļĿ¼ +cd /home '/ home' Ŀ¼' +cd .. һĿ¼ +cd ../.. Ŀ¼ +cd ˵Ŀ¼ +cd ~user1 ˵Ŀ¼ +cd - ϴڵĿ¼ +pwd ʾ· +ls 鿴Ŀ¼еļ +ls -F 鿴Ŀ¼еļ +ls -l ʾļĿ¼ϸ +ls -a ʾļ +ls *[0-9]* ʾֵļĿ¼ +tree ʾļĿ¼ɸĿ¼ʼνṹ(1) +lstree ʾļĿ¼ɸĿ¼ʼνṹ(2) +mkdir dir1 һ 'dir1' Ŀ¼' +mkdir dir1 dir2 ͬʱĿ¼ +mkdir -p /tmp/dir1/dir2 һĿ¼ +rm -f file1 ɾһ 'file1' ļ' +rmdir dir1 ɾһ 'dir1' Ŀ¼' +rm -rf dir1 ɾһ 'dir1' Ŀ¼ͬʱɾ +rm -rf dir1 dir2 ͬʱɾĿ¼ǵ +mv dir1 new_dir /ƶ һĿ¼ +cp file1 file2 һļ +cp dir/* . һĿ¼µļǰĿ¼ +cp -a /tmp/dir1 . һĿ¼ǰĿ¼ +cp -a dir1 dir2 һĿ¼ +ln -s file1 lnk1 һָļĿ¼ +ln file1 lnk1 һָļĿ¼ +touch -t 0712250000 file1 ޸һļĿ¼ʱ - (YYMMDDhhmm) +file file1 outputs the mime type of the file as text +iconv -l г֪ı +iconv -f fromEncoding -t toEncoding inputFile > outputFile creates a new from the given input file by assuming it is encoded in fromEncoding and converting it to toEncoding. +find . -maxdepth 1 -name *.jpg -print -exec convert "{}" -resize 80x60 "thumbs/{}" \; batch resize files in the current directory and send them to a thumbnails directory (requires convert from Imagemagick) + + +ļ +find / -name file1 '/' ʼļϵͳļĿ¼ +find / -user user1 û 'user1' ļĿ¼ +find /home/user1 -name \*.bin Ŀ¼ '/ home/user1' '.bin' βļ +find /usr/bin -type f -atime +100 ڹȥ100δʹùִļ +find /usr/bin -type f -mtime -10 10ڱ޸Ĺļ +find / -name \*.rpm -exec chmod 755 '{}' \; '.rpm' βļȨ +find / -xdev -name \*.rpm '.rpm' βļԹ̵ȿƶ豸 +locate \*.ps Ѱ '.ps' βļ - 'updatedb' +whereis halt ʾһļԴmanλ +which halt ʾһļִļ· + + + +һļϵͳ +mount /dev/hda2 /mnt/hda2 һhda2 - ȷĿ¼ '/ mnt/hda2' Ѿ +umount /dev/hda2 жһhda2 - ȴӹص '/ mnt/hda2' ˳ +fuser -km /mnt/hda2 豸æʱǿж +umount -n /mnt/hda2 жزд /etc/mtab ļ- ļΪֻ򵱴дʱdz +mount /dev/fd0 /mnt/floppy һ +mount /dev/cdrom /mnt/cdrom һcdromdvdrom +mount /dev/hdc /mnt/cdrecorder һcdrwdvdrom +mount /dev/hdb /mnt/cdrecorder һcdrwdvdrom +mount -o loop file.iso /mnt/cdrom һļISOļ +mount -t vfat /dev/hda5 /mnt/hda5 һWindows FAT32ļϵͳ +mount /dev/sda1 /mnt/usbdisk һusb ̻豸 +mount -t smbfs -o username=user,password=pass //WinClient/share /mnt/share һwindows繲 + + + +̿ռ +df -h ʾѾصķб +ls -lSr |more ԳߴСļĿ¼ +du -sh dir1 Ŀ¼ 'dir1' ѾʹõĴ̿ռ' +du -sk * | sort -rn СΪʾļĿ¼ĴС +rpm -q -a --qf '%10{SIZE}t%{NAME}n' | sort -k1,1n ԴСΪʾѰװrpmʹõĿռ (fedora, redhatϵͳ) +dpkg-query -W -f='${Installed-Size;10}t${Package}n' | sort -k1,1n ԴСΪʾѰװdebʹõĿռ (ubuntu, debianϵͳ) + +ض ^ + +ûȺ +groupadd group_name һû +groupdel group_name ɾһû +groupmod -n new_group_name old_group_name һû +useradd -c "Name Surname " -g admin -d /home/user1 -s /bin/bash user1 һ "admin" ûû +useradd user1 һû +userdel -r user1 ɾһû ( '-r' ųĿ¼) +usermod -c "User FTP" -g system -d /ftp/user1 -s /bin/nologin user1 ޸û +passwd ޸Ŀ +passwd user1 ޸һûĿ (ֻrootִ) +chage -E 2005-12-31 user1 ûʧЧ +pwck '/etc/passwd' ļʽ﷨Լڵû +grpck '/etc/passwd' ļʽ﷨ԼڵȺ +newgrp group_name ½һµȺԸı´ļԤȺ + +ض ^ + +ļȨ - ʹ "+" Ȩޣʹ "-" ȡ +ls -lh ʾȨ +ls /tmp | pr -T5 -W$COLUMNS ն˻ֳ5ʾ +chmod ugo+rwx directory1 Ŀ¼(u)Ⱥ(g)Լ(o)Զr д(w)ִ(x)Ȩ +chmod go-rwx directory1 ɾȺ(g)(o)Ŀ¼ĶдִȨ +chown user1 file1 ıһļ +chown -R user1 directory1 ıһĿ¼ԲͬʱıĿ¼ļ +chgrp group1 file1 ıļȺ +chown user1:group1 file1 ıһļ˺Ⱥ +find / -perm -u+s һϵͳʹSUIDƵļ +chmod u+s /bin/file1 һļ SUID λ - иļûҲͬȨ +chmod u-s /bin/file1 һļ SUIDλ +chmod g+s /home/public һĿ¼SGID λ - SUID Ŀ¼ +chmod g-s /home/public һĿ¼ SGID λ +chmod o+t /home/public һļ STIKY λ - ֻϷɾļ +chmod o-t /home/public һĿ¼ STIKY λ + +ض ^ + +ļ - ʹ "+" Ȩޣʹ "-" ȡ +chattr +a file1 ֻ׷ӷʽдļ +chattr +c file1 ļܱںԶѹ/ѹ +chattr +d file1 ڽļϵͳʱdump򽫺ļ +chattr +i file1 óɲɱļܱɾ޸ġ +chattr +s file1 һļȫɾ +chattr +S file1 һӦóļִдʹϵͳ̰޸ĵĽд +chattr +u file1 ļɾϵͳԺָɾļ +lsattr ʾ + +ض ^ + +ѹļ +bunzip2 file1.bz2 ѹһ 'file1.bz2'ļ +bzip2 file1 ѹһ 'file1' ļ +gunzip file1.gz ѹһ 'file1.gz'ļ +gzip file1 ѹһ 'file1'ļ +gzip -9 file1 ̶ѹ +rar a file1.rar test_file һ 'file1.rar' İ +rar a file1.rar file1 file2 dir1 ͬʱѹ 'file1', 'file2' ԼĿ¼ 'dir1' +rar x file1.rar ѹrar +unrar x file1.rar ѹrar +tar -cvf archive.tar file1 һѹ tarball +tar -cvf archive.tar file1 file2 dir1 һ 'file1', 'file2' Լ 'dir1'ĵļ +tar -tf archive.tar ʾһе +tar -xvf archive.tar ͷһ +tar -xvf archive.tar -C /tmp ѹͷŵ /tmpĿ¼ +tar -cvfj archive.tar.bz2 dir1 һbzip2ʽѹ +tar -xvfj archive.tar.bz2 ѹһbzip2ʽѹ +tar -cvfz archive.tar.gz dir1 һgzipʽѹ +tar -xvfz archive.tar.gz ѹһgzipʽѹ +zip file1.zip file1 һzipʽѹ +zip -r file1.zip file1 file2 dir1 ļĿ¼ͬʱѹһzipʽѹ +unzip file1.zip ѹһzipʽѹ + +ض ^ + +RPM - Fedora, Redhatϵͳ +rpm -ivh package.rpm װһrpm +rpm -ivh --nodeeps package.rpm װһrpmϵ +rpm -U package.rpm һrpmıļ +rpm -F package.rpm һȷѾװrpm +rpm -e package_name.rpm ɾһrpm +rpm -qa ʾϵͳѾװrpm +rpm -qa | grep httpd ʾа "httpd" rpm +rpm -qi package_name ȡһѰװϢ +rpm -qg "System Environment/Daemons" ʾһrpm +rpm -ql package_name ʾһѾװrpmṩļб +rpm -qc package_name ʾһѾװrpmṩļб +rpm -q package_name --whatrequires ʾһrpmϵб +rpm -q package_name --whatprovides ʾһrpmռ +rpm -q package_name --scripts ʾڰװ/ɾڼִеĽűl +rpm -q package_name --changelog ʾһrpm޸ʷ +rpm -qf /etc/httpd/conf/httpd.conf ȷļĸrpmṩ +rpm -qp package.rpm -l ʾһδװrpmṩļб +rpm --import /media/cdrom/RPM-GPG-KEY 빫Կ֤ +rpm --checksig package.rpm ȷһrpm +rpm -qa gpg-pubkey ȷѰװrpm +rpm -V package_name ļߴ硢 ɡ͡ߡȺ顢MD5Լ޸ʱ +rpm -Va ϵͳѰװrpm- Сʹ +rpm -Vp package.rpm ȷһrpmδװ +rpm2cpio package.rpm | cpio --extract --make-directories *bin* һrpmпִļ +rpm -ivh /usr/src/redhat/RPMS/`arch`/package.rpm һrpmԴ밲װһõİ +rpmbuild --rebuild package_name.src.rpm һrpmԴ빹һ rpm + +ض ^ + +YUM - Fedora, RedHatϵͳ +yum install package_name زװһrpm +yum localinstall package_name.rpm װһrpmʹԼֿΪϵ +yum update package_name.rpm µǰϵͳаװrpm +yum update package_name һrpm +yum remove package_name ɾһrpm +yum list гǰϵͳаװа +yum search package_name rpmֿѰ +yum clean packages rpmɾصİ +yum clean headers ɾͷļ +yum clean all ɾлİͷļ + +ض ^ + +DEB (Debian, Ubuntu Լϵͳ) +dpkg -i package.deb װ/һ deb +dpkg -r package_name ϵͳɾһ deb +dpkg -l ʾϵͳѾװ deb +dpkg -l | grep httpd ʾа "httpd" deb +dpkg -s package_name ѾװϵͳһϢ +dpkg -L package_name ʾϵͳѾװһdebṩļб +dpkg --contents package.deb ʾδװһṩļб +dpkg -S /bin/ping ȷļĸdebṩ + +ض ^ + +APT (Debian, Ubuntu Լϵͳ) +apt-get install package_name װ/һ deb +apt-cdrom install package_name ӹ̰װ/һ deb +apt-get update бе +apt-get upgrade Ѱװ +apt-get remove package_name ϵͳɾһdeb +apt-get check ȷֿȷ +apt-get clean ص +apt-cache search searched-package ذҪַ + +ض ^ + +鿴ļ +cat file1 ӵһֽڿʼ鿴ļ +tac file1 һпʼ鿴һļ +more file1 鿴һļ +less file1 'more' ļкһķ +head -2 file1 鿴һļǰ +tail -2 file1 鿴һļ +tail -f /var/log/messages ʵʱ鿴ӵһļе + +ض ^ + +ı +cat file1 file2 ... | command <> file1_in.txt_or_file1_out.txt general syntax for text manipulation using PIPE, STDIN and STDOUT +cat file1 | command( sed, grep, awk, grep, etc...) > result.txt ϲһļϸ˵ıдһļ +cat file1 | command( sed, grep, awk, grep, etc...) >> result.txt ϲһļϸ˵ıдһеļ +grep Aug /var/log/messages ļ '/var/log/messages'вҹؼ"Aug" +grep ^Aug /var/log/messages ļ '/var/log/messages'в"Aug"ʼĴʻ +grep [0-9] /var/log/messages ѡ '/var/log/messages' ļаֵ +grep Aug -R /var/log/* Ŀ¼ '/var/log' Ŀ¼ַ"Aug" +sed 's/stringa1/stringa2/g' example.txt example.txtļе "string1" 滻 "string2" +sed '/^$/d' example.txt example.txtļɾпհ +sed '/ *#/d; /^$/d' example.txt example.txtļɾעͺͿհ +echo 'esempio' | tr '[:lower:]' '[:upper:]' ϲµԪ +sed -e '1d' result.txt ļexample.txt ųһ +sed -n '/stringa1/p' 鿴ֻʻ "string1" +sed -e 's/ *$//' example.txt ɾÿһĿհַ +sed -e 's/stringa1//g' example.txt ĵֻɾʻ "string1" ʣȫ +sed -n '1,5p;5q' example.txt 鿴ӵһе5 +sed -n '5p;5q' example.txt 鿴5 +sed -e 's/00*/0/g' example.txt õ滻 +cat -n file1 ʾļ +cat example.txt | awk 'NR%2==1' ɾexample.txtļеż +echo a b c | awk '{print $1}' 鿴һеһ +echo a b c | awk '{print $1,$3}' 鿴һеĵһ͵ +paste file1 file2 ϲļ +paste -d '+' file1 file2 ϲļݣм"+" +sort file1 file2 ļ +sort file1 file2 | uniq ȡļIJ(ظֻһ) +sort file1 file2 | uniq -u ɾ +sort file1 file2 | uniq -d ȡļĽ(ֻͬʱļеļ) +comm -1 file1 file2 Ƚļֻɾ 'file1' +comm -2 file1 file2 Ƚļֻɾ 'file2' +comm -3 file1 file2 ȽļֻɾļеIJ + +ض ^ + + +ַúļʽת +dos2unix filedos.txt fileunix.txt һıļĸʽMSDOSתUNIX +unix2dos fileunix.txt filedos.txt һıļĸʽUNIXתMSDOS +recode ..HTML < page.txt > page.html һıļתhtml +recode -l | more ʾתʽ + +ض ^ + +ļϵͳ +badblocks -v /dev/hda1 hda1ϵĻſ +fsck /dev/hda1 ޸/hda1linuxļϵͳ +fsck.ext2 /dev/hda1 ޸/hda1ext2ļϵͳ +e2fsck /dev/hda1 ޸/hda1ext2ļϵͳ +e2fsck -j /dev/hda1 ޸/hda1ext3ļϵͳ +fsck.ext3 /dev/hda1 ޸/hda1ext3ļϵͳ +fsck.vfat /dev/hda1 ޸/hda1fatļϵͳ +fsck.msdos /dev/hda1 ޸/hda1dosļϵͳ +dosfsck /dev/hda1 ޸/hda1dosļϵͳ + +ض ^ + +ʼһļϵͳ +mkfs /dev/hda1 hda1һļϵͳ +mke2fs /dev/hda1 hda1һlinux ext2ļϵͳ +mke2fs -j /dev/hda1 hda1һlinux ext3(־)ļϵͳ +mkfs -t vfat 32 -F /dev/hda1 һ FAT32 ļϵͳ +fdformat -n /dev/fd0 ʽһ +mkswap /dev/hda3 һswapļϵͳ + +ض ^ + +SWAPļϵͳ +mkswap /dev/hda3 һswapļϵͳ +swapon /dev/hda3 һµswapļϵͳ +swapon /dev/hda2 /dev/hdb3 swap + +ض ^ + + +dump -0aj -f /tmp/home0.bak /home һ '/home' Ŀ¼ +dump -1aj -f /tmp/home0.bak /home һ '/home' Ŀ¼Ľʽ +restore -if /tmp/home0.bak ԭһʽ +rsync -rogpav --delete /home /tmp ͬߵĿ¼ +rsync -rogpav -e ssh --delete /home ip_address:/tmp ͨSSHͨrsync +rsync -az -e ssh --delete ip_addr:/home/public /home/local ͨsshѹһԶĿ¼ͬĿ¼ +rsync -az -e ssh --delete /home/local ip_addr:/home/public ͨsshѹĿ¼ͬԶĿ¼ +dd bs=1M if=/dev/hda | gzip | ssh user@ip_addr 'dd of=hda.gz' ͨsshԶִһαݱش̵IJ +dd if=/dev/sda of=/tmp/file1 ݴݵһļ +tar -Puf backup.tar /home/user ִһζ '/home/user' Ŀ¼Ľʽݲ +( cd /tmp/local/ && tar c . ) | ssh -C user@ip_addr 'cd /home/share/ && tar x -p' ͨsshԶĿ¼иһĿ¼ +( tar c /home ) | ssh -C user@ip_addr 'cd /home/backup-home && tar x -p' ͨsshԶĿ¼иһĿ¼ +tar cf - . | (cd /tmp/backup ; tar xf - ) ؽһĿ¼ƵһطԭȨ޼ +find /home/user1 -name '*.txt' | xargs cp -av --target-directory=/home/backup/ --parents һĿ¼Ҳ '.txt' βļһĿ¼ +find /var/log -name '*.log' | tar cv --files-from=- | bzip2 > log.tar.bz2 '.log' βļһbzip +dd if=/dev/hda of=/dev/fd0 bs=512 count=1 һ MBR (Master Boot Record)ݸƵ̵Ķ +dd if=/dev/fd0 of=/dev/hda bs=512 count=1 Ѿ浽̵ıлָMBR + +ض ^ + + +cdrecord -v gracetime=2 dev=/dev/cdrom -eject blank=fast -force һɸдĹ +mkisofs /dev/cdrom > cd.iso ڴϴһ̵isoļ +mkisofs /dev/cdrom | gzip > cd_iso.gz ڴϴһѹ˵Ĺisoļ +mkisofs -J -allow-leading-dots -R -V "Label CD" -iso-level 4 -o ./cd.iso data_cd һĿ¼isoļ +cdrecord -v dev=/dev/cdrom cd.iso ¼һISOļ +gzip -dc cd_iso.gz | cdrecord dev=/dev/cdrom - ¼һѹ˵ISOļ +mount -o loop cd.iso /mnt/iso һISOļ +cd-paranoia -B һCDת¼쵽 wav ļ +cd-paranoia -- "-3" һCDת¼쵽 wav ļУ-3 +cdrecord --scanbus ɨʶscsiͨ +dd if=/dev/hdc | md5sum Уһ豸md5sum룬һ CD + +ض ^ + + - ̫WIFIߣ +ifconfig eth0 ʾһ̫ +ifup eth0 һ 'eth0' 豸 +ifdown eth0 һ 'eth0' 豸 +ifconfig eth0 192.168.1.1 netmask 255.255.255.0 IPַ +ifconfig eth0 promisc 'eth0' ɻģʽ̽ݰ (sniffing) +dhclient eth0 dhcpģʽ 'eth0' +route -n show routing table +route add -net 0/0 gw IP_Gateway configura default gateway +route add -net 192.168.0.0 netmask 255.255.0.0 gw 192.168.1.1 configure static route to reach network '192.168.0.0/16' +route del 0/0 gw IP_gateway remove static route +echo "1" > /proc/sys/net/ipv4/ip_forward activate ip routing +hostname show hostname of system +host www.example.com lookup hostname to resolve name to ip address and viceversa(1) +nslookup www.example.com lookup hostname to resolve name to ip address and viceversa(2) +ip link show show link status of all interfaces +mii-tool eth0 show link status of 'eth0' +ethtool eth0 show statistics of network card 'eth0' +netstat -tup show all active network connections and their PID +netstat -tupl show all network services listening on the system and their PID +tcpdump tcp port 80 show all HTTP traffic +iwlist scan show wireless networks +iwconfig eth1 show configuration of a wireless network card +hostname show hostname +host www.example.com lookup hostname to resolve name to ip address and viceversa +nslookup www.example.com lookup hostname to resolve name to ip address and viceversa +whois www.example.com lookup on Whois database + + + + +Linux¿/رMySql Server + + Ҫ/ر/MySql Serverȵ¼Ϊroot˻һǰsudoǰ׺ + õRedHat/FedoraôͿЩ + /etc/init.d/mysqld start + رգ /etc/init.d/mysqld stop + /etc/init.d/mysqld restart + + õDebian/UbuntuͿЩ + /etc/init.d/mysql start + رգ /etc/init.d/mysql stop + /etc/init.d/mysql restart + +linux°װvim +red hatĻyum install vimubuntuĻȥ + + + + +CentOS鿴CPUڴ桢汾ϵͳϢ +һ鿴CPU + +more /proc/cpuinfo | grep "model name" + +grep "model name" /proc/cpuinfo + +Ҫĸ + +grep "model name" /proc/cpuinfo | cut -f2 -d: + + + +ôlinuxҪϤ + +鿴ڴ + +grep MemTotal /proc/meminfo + +grep MemTotal /proc/meminfo | cut -f2 -d: + +free -m |grep "Mem" | awk '{print $2}' + +鿴cpu32λ64λ + +鿴CPUλ(32 or 64) + +#getconf LONG_BIT + +#echo $HOSTTYPE + +#uname -a + +ģ鿴ǰlinuxİ汾 + +#more /etc/RedHat-release + +#cat /etc/redhat-release + +壺鿴ں˰汾 + +#uname -r + +#uname -a + +鿴ǰʱ + +date + +ߣ鿴Ӳ̺ͷ + +df -h + + + +fdisk -l + +ҲԲ鿴 + +du -sh + +ԿȫռõĿռ + +du /etc -sh + +ԿĿ¼ĴС + +ˣ鿴װ + +鿴ϵͳװʱװ + +cat -n /root/install.log + +more /root/install.log | wc -l + +鿴ѾװЩ + +rpm -qa + +rpm -qa | wc -l + +yum list installed | wc -l + +֣ͨrpmyumַʽѯİװһûҵԭ + +ţ鿴̲ + +cat /etc/sysconfig/keyboard + +cat /etc/sysconfig/keyboard | grep KEYTABLE | cut -f2 -d= + +ʮ鿴selinux + +sestatus + +sestatus | cut -f2 -d: + +cat /etc/sysconfig/selinux + +ʮһ鿴ipmacַ + +ifcfg-eth0 ļԿmacصϢ + +ifconfig + +cat /etc/sysconfig/network-scripts/ifcfg-eth0 | grep IPADDR + +cat /etc/sysconfig/network-scripts/ifcfg-eth0 | grep IPADDR | cut -f2 -d= + +ifconfig eth0 |grep "inet addr:" |awk '{print $2}'|cut -c 6- + +ifconfig | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f2 | awk '{ print $1}' + +鿴 + +cat /etc/sysconfig/network + +鿴dns + +cat /etc/nf + +ʮ鿴Ĭ + +echo $LANG $LANGUAGE + +cat /etc/sysconfig/i18n + +ʮ鿴ʱǷʹUTCʱ + +cat /etc/sysconfig/clock + +ʮģ鿴 + +hostname + +cat /etc/sysconfig/network + +޸޸ļͬʱҲhostļҲ޸ + + + +ҵ80˿nginxPIDǣ643 + +һ +ps -p PID -o rss + +[root@nagios-server libexec]# ps -p 643 -o rss +RSS +2700 + + + + cat /proc/PID/status +[root@nagios-server libexec]# cat /proc/643/status | grep RSS + + VmRSS: 2700 kB + + diff --git "a/star/Linux_cmd/linux\345\210\235\345\255\246\350\200\205\345\221\275\344\273\244\346\226\207\346\241\243.txt" "b/star/Linux_cmd/linux\345\210\235\345\255\246\350\200\205\345\221\275\344\273\244\346\226\207\346\241\243.txt" new file mode 100644 index 00000000..c78001c4 --- /dev/null +++ "b/star/Linux_cmd/linux\345\210\235\345\255\246\350\200\205\345\221\275\344\273\244\346\226\207\346\241\243.txt" @@ -0,0 +1,575 @@ +su ͬûл +pwd 鿴ǰڵĿ¼ +cd ڴһĿ¼ +eg: +cd 򿪸Ŀ¼ +cd bin 򿪸Ŀ¼µbinĿ¼ +cd bin 򿪵ǰĿ¼µbinĿ¼ +cd .. һĿ¼ +cd ../.. Ŀ¼ +cd /local/bin 򿪸Ŀ¼localĿ¼еbinĿ¼ +cd ~ ûĿ¼ +ls 鿴Ŀ¼ +ls -a ʾļĿ¼ļ +ls -l ʾļϸбʾļļ̬Ȩޡӵߡ ļСϢ +ls -t ļʱȺʾ +ls *.c ʾչΪ .cļ +ls 0?.c ʾһַΪ 0չΪ .cļ +˵lsIJ֮пո +touch һļ +rm ɾһļ +mkdir һĿ¼ +mkdir -p a/b Ŀ¼aнĿ¼b +rmdir rm -r ɾһĿ¼ +cp ļ +mv ļƶ͸ +wc 鿴ļϢ +wc -l ʾļı +wc -w ʾļ +wc -c ʾļеַ +cat ļ +cat -n 1ʼнб +more ʾļ ͬ:catļһֱӡ moreʾ +head tail 鿴ļͼ +eg: head -n5 鿴ļǰ5 +head 400b 鿴ļǰ400ֽ +tail -n5 鿴ļĺ5 +find ļ +eg: find /root *.c rootĿ¼չΪ.cļ +grep ı +eg: grep success * /*ҵǰĿ¼ļ溬successַļ +passwd ÿ +history ûù +!! ִһε +which ѯĿ¼ +kill ɱһ +killall ɱ +man Linuxϵͳб׼ĵ +info İֲ ÷maninfoͬ +reboot +halt ػ + +# uname -a 鿴ϵͳںˡ +# uname -r 鿴ϵͳںˡ +# file /sbin/init 鿴ϵͳ32λ64λ +# lsb_release -a + +ls ʾĿ¼ļ + + Ӣƣlist + ·/bin/ls + + -a ʾļļ =all + -l ϸϢʾ =long + -d 鿴Ŀ¼ļ =directory + +ļϢ + +drwxr-xr-x. 2 root root 4096 Jul 16 06:43 bin + +һĸd Ŀ¼=directory + - ļ + l ļlink Ӳӡ +û +r=read Ȩ +w=write дȨ +x=execute ִȨ + +rwx r-x r-x ÿһ֣һû + +һû ڶû û +u g others +user group +onwer + +Ӳ +:root +:root +ļС׼ȷĿ¼Сݿblock512ֽڣԵС +ʱֵʱ޸ĵʱ䡣 +ļơ + + +cd лĿ¼ + Ӣԭ⣺change directory + ·shell + ִȨޣû + $cd / лĿ¼ + $cd ../ صϼĿ¼ + $cd /bin + + +pwd ʾǰڵĹĿ¼ + + Ӣԭ⣺print working directory + ·/bin/pwd + ִȨޣû + $pwd + +touch ļ + Ӣԭ⣺touch + ·/bin/touch + ִȨޣû + ﷨touch [Ŀ¼] + +mkdir Ŀ¼ + Ӣԭ⣺make directories + ·/bin/mkdir + ִȨޣû + ﷨mkdir [Ŀ¼] + $mkdir newdir + + +cp ļĿ¼ + Ӣԭ⣺copy + ·/bin/copy + ִȨޣû + ﷨ cp -R [ԴļĿ¼] [ĿĿ¼] + -R Ŀ¼ ļҪӡ-RļĿ¼Ҫ + + +mv ƶļС + Ӣԭ⣺move + ·/bin/mv + ִȨޣû + ﷨mv [ԴļĿ¼] [ĿĿ¼] + mv file1 file2 file1Ϊfile2 + +rm ֻɾļ + Ӣԭ⣺remove + ·/bin/rm + ִȨޣû + ﷨rm -r [ļĿ¼] + -r ɾĿ¼ rmdirɾĿ¼ + rm -f filename ֱɾļҪȷϡ + rm -rf dirname ֱɾļС + + +cat ʾļݣܷҳʾļݽٵļ + Ӣԭ⣺concatenate and display files + ·/bin/cat + ִȨޣû + ﷨cat [ļ] + + cat /etc/issue + cat /etc/services + + +more ҳʾļ + ·/bin/more + ִȨޣû + ﷨more [ļ] + ո񣩻f ʾһҳ + س ʾһ + qQ ˳ + + more /etc/services + + +head 鿴ļǰС + ·/bin/head + ִȨޣû + ﷨ head -num [ļ] + + head -20 /etc/services + +tail 鿴ļС + ·/bin/tail + ִȨޣû + ﷨ tail -num [ļ] + -f ̬ʾļĩβ [־ļ] + + tail -20 /etc/services + + +ln ļ + Ӣԭ⣺link + ·/bin/ln + ִȨޣû + ﷨ ln -s [Դļ] [Ŀļ] + -s + + ӣ + ln -s /etc/issue /issue.soft + + ļȨ޶lrwxrwxrwx ȨȡԴļ ʱҲԴļͬ + + Ӳӣ + ln /etc/issue /issue.hard + + ӲӣļȨͬ + windows +ͬ ͬiڵ㡿 + ܿļϵͳɡwindows ܴcӲӵD̡ + + ls -i inode iڵ ֱʶlinuxļں˴ֱʶÿļиiڵ㡣 + + + +*********************Ȩ޴********************* + +chmod ıļĿ¼Ȩޡ + Ӣԭ⣺change the permissions mode of a file + ·/bin/chmod + ִȨޣû + ﷨ chmod [{ugo}{+-=}{rwx}] [ļĿ¼] + [mode=421] [ļĿ¼] + + chmod u() +() + g() -(ȥ) + o() =(Ȩ=) + + ʵ + chmod u+x a.txt + ֵͨķʽȨ + chmod 777 a.txt + + rӦ4wӦ2xӦ1 + + rwx r-x r-- + Ȩֵ754 + 7=4+2+1 + 5=4+0+1 + 4=4+0+0 + + ַ Ȩ ļĺ Ŀ¼ĺ + r Ȩ ɲ鿴ļ гĿ¼е + w дȨ ޸ļ Ŀ¼дɾļ + x ִȨ ִļ ԽĿ¼ + + ɾļļдȨޣļĿ¼дȨޡ + + +chown ıļĿ¼ߡ + Ӣԭ⣺change file ownership + ·/bin/chown + ִȨޣû + ﷨chown [û][ļĿ¼] + + ʵ + chown nobody filename ıļfilenameΪnobody + + chown [-R] uesrname:group filename -R ݹ޸ġ + + +chgrpıļļе顿 + Ӣԭ⣺change file group ownership + ·/bin/chgrp + ִȨޣû + ﷨chgrp [û][ļĿ¼] + + ʵchgrp adm file1 + + + +umask 鿴ĬȨޡ + umask -S + [root@vm_web1 liuxing]# umask + 0022 + [root@vm_web1 liuxing]# umask -S + u=rwx,g=rx,o=rx + + 0022˼ 0Ȩλ022ûȨλȨֵ + 777-022=755 + linuxȨ޹ȱʡļִļx + ȱʡļȨ755ȱʡļȨ-rw-r--r-- 644 + + ޸ĬȨֵ umask 027 + + + + +*********************ļ********************* + +which ʾϵͳڵĿ¼ + + ·/user/bin/which + ִȨޣû + ﷨ which [] + + ʵ which ls + +whereis ls + ʾİĵ· + + + +find ļĿ¼ + · /user/bin/find + ִȨޣû + ﷨ find [·] [ؼ] + + ʵֹڸĿ¼ + find /etc -name init ļƲҡ + find /etc -name init* + find /etc -name init?? + find / -size +204800 ļСҡ + find /home -user samlee ļ߲ңsamleeûļ + + ʱңc=changeıļ޸ a=access m-modifyļݱ޸Ĺ + 1.ctime atime mtime + 2. cminaminmmin + + find /etc -mmin -120 ʾ120֮Щļ޸Ĺ + + iڵҡ + find . -inum 16 iڵΪ16ļ + + + *ƥַ0ַ + ?ƥ䵥ַ + + -size ļдС blockݿ 512ֽ=0.5kb + + 100MB =102400KB =204800block + + С- + + ӷ + -a and߼ + -o or ߼ + ִз -exec {}\; + find ......-exec {}\; + find ..... -ok {}\; okҪѯʡ + '{}'findҵĽ\ת''ʾ + + find /etc -size +163840 -a -size -204800 etc²Ҵ80MBС100MBļ + + find /etc -name inittab -exec ls -l {}\; ļִ֮в鿴ļԡ + + + + +locate ļĿ¼ϵͳļݿ + Ӣԭ⣺list files in databases + ·/user/bin/locate + ִȨޣû + ﷨ locate [ؼ] + + ʵ + locate file + + +updatadb ļݿ⡿ + + +grep ļѰַƥв + ·/bin/grep + ִȨޣû + ﷨ grep [ִָ] [Դļ] + + ʵ grep ftp /etc/services + +ڵǰĿ¼wwwĿ¼²ļаַ"centos"ݵļǿ + find www |xargs grep "centos" + find /data/conf/sites-available |xargs grep "11558.com" + +ڵǰĿ¼wwwĿ¼²к׺Ϊ.phpļַ"dgdxs.com"ݵļǿ + find www -name "*.php" |xargs grep "centos" + + +man ðϢ + Ӣԭ⣺manual + ·/user/bin/man + ִȨޣû + ﷨ [ļ] + ʵ + man ls + man services + man 1 passwd İ + man 5 passwd ļİ + +info ðϢ + Ӣԭ⣺information + ·/user/bin/info + ִȨޣû + ﷨: info [κιؼ] + + ʵ + info ls + + +whatis apropos makewhatis ļ˵Ϣ + Ӣԭ⣺search the whatis database for strings + ·/user/bin/whatis apropos + /user/sbin/makewhatis + ִȨޣALL User , All user ,root + ﷨: whatis apropos [κιؼ] + + ʵ + whatis ls + apropos fstab + + makewhatis ݿ + + +help 鿴shellİ + + ls --help + help cd + help ls + + +*********************ѹѹ********************* + +gzip ֻѹļ + Ӣԭ⣺GUN zip + ·/bin/gzip + ִȨޣû + ﷨ gzip ѡ[ļ] + ѹļʽ .gz + + ʵ + gzip filename + + ֻѹļѹĿ¼ + ԭļ + +gunzip gzip -d ѹ + + +tar Ŀ¼ + + ·/bin/tar + ִȨޣû + ﷨ + tar ѡ[cvf][Ŀ¼] + -c .tarļ Ҫѡ + -x ѹ.tarļ + -v ʾϸϢ + -f ָѹļ Ҫѡ + -z ͬʱѹ + + ѹļʽ.tar.gz + + ʵ + tar -zcvf dir1.tar.gz dir1/ ѹļС + tar -zcvf dir1.tar.gz dir1.txt ѹļ + + tar -zxvf dir1.tar.gz ѹļ + + + +zip ѹĿ¼ļcentosûи + + ·/user/bin/zip + ִȨޣû + ﷨ + zip ѡ[-r] [ѹļʽ] + + ʵ + zip services.zip /etc/services ѹļ + zip -r test.zip /test ѹĿ¼ + +unzip ѹ + + unzip [ѹļ] + unzip test.zip + + + +bzip2ѹļѹǿ + ﷨ bzip2 ѡ [-k] [ļ] + -kѹԭļ + + ѹļʽ.bz2 + ʵ + bzip2 -k file2 + +bunzip2 ѹ + + +*********************ָͨ********************* + +write ûϢCtrl+DΪҪû¼ + ﷨ write [û] + ʵwrite samlee + + +wall û㲥Ϣ + ﷨ wall [message] [ļ] + ʵ + wall Happy New Year! + +ping ͨԡ + ﷨ ping ѡ IPַ + ʵ + ping 192.168.1.1 + Ҫעʡpacket loss + + ping -c 3 192.168.1.1 巢 + ping -s 60000 192.168.1.1 icmpС + + +ifconfig 鿴Ϣ + ﷨ifconfig ѡ[-a] [豸ʶ] + -a ʾϢ + + ʵifconfig -a + ifconfig eth0 + + + +*********************ϵͳػ********************* + +shutdown ػ + ﷨shutdown [ȴһʱػ] + ʵshutdown -h now Ϲػ + + +reboot + ﷨reboot + + +*********************shellӦü********************* + + +\ض +ܵ +ӷ +滻 + +ȫ ļ +ʷ history ûʷ !100 Ϳִе100¼ + clear ctrl+l +ɾݣ ctrl+u + + + + ʵ + alias copy=cp + alias xrm="rm -r" һϣҪ˫š + + unalias copy ɾ + +\ض + shellÿԤȶ3ļ֣012ֱӦڣ + 0STDIN׼ + 1STDOUT׼ + 2STDERR׼ + +cp -R /user /backup/user.bak 2> /bak.error >>ں׷ӡ + + +ܵ + һݸһΪһ롣 + ʹ÷ + 1|2|3....|n + ʵ + ls -l /etc | more + ls -l /etc | grep init + ls -l /etc | grep init | wc -l + +; +÷ֺżĸ˳ִС +&& +ӷǰִд߼ϵֻ&&ǰִгɹ󣬺ִܱС +|| +ǰִִд߼ϵֻ||ǰִʧִܺС + +滻 `` + һΪһIJ + ʽ 1 `2` + + ʵ + ls -l `which touch` + + \ No newline at end of file diff --git a/star/Linux_kernel/readme.md b/star/Linux_kernel/readme.md new file mode 100644 index 00000000..702f8629 --- /dev/null +++ b/star/Linux_kernel/readme.md @@ -0,0 +1,55 @@ +# Linux内核TCP参数优化设置 + +在Linux下高并发的服务器中，TCP TIME_WAIT套接字数量经常可达两三万，服务器很容易就会被拖死。不过，我们可以通过修改Linux内核参数来减少服务器的TIME_WAIT套接字数量，命令如下所示： + +nano /etc/sysctl.conf + +然后，增加以下参数： + +``` +net.ipv4.tcp_fin_timeout = 30 +net.ipv4.tcp_keepalive_time = 1800 +net.ipv4.tcp_syncookies = 1 +net.ipv4.tcp_tw_reuse = 1 +net.ipv4.tcp_tw_recycle = 1 +net.ipv4.ip_local_port_range = 1024 65000 +net.ipv4.tcp_max_syn_backlog = 8192 +net.ipv4.tcp_max_tw_buckets = 5120 +``` + + +其中： + +net.ipv4.tcp_syncookies=1表示开启SYN Cookies。当出现SYN等待队列溢出时，启用cookie来处理，可防范少量的SYN攻击。默认为0，表示关闭。 + +net.ipv4.tcp_tw_reuse=1表示开启重用。允许将TIME-WAIT套接字重新用于新的TCp连接。默认为0，表示关闭。 + +net.ipv4.tcp_tw_recycle=1表示开启TCP连接中TIME-WAIT套接字的快速回收。默认为0，表示关闭。 + +net.ipv4.tcp_fin_timeout=30表示如果套接字由本端要求关闭，这个参数决定了它保持在FIN-WAIT-2状态的时间。 + +net.ipv4.tcp_keepalive_time=1800表示当keepalive启用时，TCP发送keepalive消息的频度。默认是2小时，这里改为30分钟。 + +net.ipv4.ip_local_port_range=1024 65000表示向外连接的端口范围。默认值很小：32768～61000，改为1024～65000。 + +net.ipv4.tcp_max_syn_backlog=8192表示SYN队列的长度，默认为1024，加大队列长度为8192，可以容纳更多等待连接的网络连接数。 + +net.ipv4.tcp_max_tw_buckets=5120表示系统同时保持TIME_WAIT套接字的最大数量，如果超过这个数字，TIME_WAIT套接字将立刻被清除并打印警告信息。默认为180000，改为5120。对于Apache、Nginx等服务器，前面介绍的几个参数已经可以很好地减少TIME_WAIT套接字数量，但是对于Squid来说，效果却不大。有了此参数就可以控制TIME_WAIT套接字的最大数量，避免Squid服务器被大量的TIME_WAIT套接字拖死。 + +执行以下命令使内核配置立即生效： + +/sbin/sysctl -p + +如果是用于Apache或Nginx等的Web服务器，或Nginx的反向代理，则只需要更改以下几项即可： + +`net.ipv4.tcp_syncookies = 1` +`net.ipv4.tcp_tw_reuse = 1` +`net.ipv4.tcp_tw_recycle = 1` +`net.ipv4.ip_local_port_range = 1024 65000` + +执行以下命令使内核配置立即生效： +``` +/sbin/sysctl -p +``` + + diff --git a/star/Parted_partition_2T/readme.md b/star/Parted_partition_2T/readme.md new file mode 100644 index 00000000..b56765e7 --- /dev/null +++ b/star/Parted_partition_2T/readme.md @@ -0,0 +1,64 @@ + +# parted分区-分区超过2T的硬盘 + +fdisk工具他对分区是有大小限制的，它只能划分小于2T的磁盘。 +超过2T的磁盘： +其一是通过卷管理来实现； +其二就是通过我们今天谈到的Parted工具来实现对GPT磁盘进行分区操作。 + + #获取帮助 +``` +# parted --help +``` + + + +本地服务器有一块4T的硬盘 +``` +# parted /dev/sda + +# parted +GNU Parted 3.1 +Using /dev/sda +Welcome to GNU Parted! Type 'help' to view a list of commands. +(parted) +``` + + + + ## 安装 parted +``` +# yum install -y parted 安装 +``` + + +``` +parted -a optimal /dev/sda #对硬盘sdb进行分区 +mklabel gpt #使用GPT格式 +mkpart primary 1 -1 #建立一个主分区 +print #显示分区信息 +quit #退出 +mkfs.xfs /dev/sdb1 #格式化为xfs格式 +echo "/dev/sdb1 /opt xfs defaults 0 0" >> /etc/fstab #加入自动挂载 +mount -a #挂载分区 +df -h #查看磁盘信息 + +umount /dev/sda +``` + + + + + +【centos 7 挂载大硬盘】 +http://www.cnblogs.com/afxcn/p/5289876.html +http://blog.csdn.net/codemanship/article/details/47056673 + + + + + + + + + diff --git a/star/SSH_no_password/SSH_no_password.md b/star/SSH_no_password/SSH_no_password.md new file mode 100644 index 00000000..ffafba6d --- /dev/null +++ b/star/SSH_no_password/SSH_no_password.md @@ -0,0 +1,74 @@ +# Linux服务器配置SSH免密码登陆 + +## 系统说明 + +192.168.4.179 centos6 +192.168.4.181 centos6 +192.168.4.182 centos6 + +ssh端口： 60920 + +在三台服务器上设置www的密码 +用户www + + +在179上操作： +``` +#su -l www +$ mkdir /home/www/.ssh +$ chmod 700 /home/www/.ssh +$ ssh-keygen -t rsa -f /home/www/.ssh/id_rsa -P '' +$ ssh-copy-id "-p 60920 www@192.168.4.181" +$ ssh-copy-id "-p 60920 www@192.168.4.182" +``` + + +测试： +``` +ssh -p 60920 www@192.168.4.181 +ssh -p 60920 www@192.168.4.182 +``` + +在181上操作 +``` +# su -l www +$ ssh-keygen -t rsa -f /home/www/.ssh/id_rsa -P '' +$ ssh-copy-id "-p 60920 www@192.168.4.179" +测试登录： +ssh -p 60920 www@192.168.4.179 +``` + + + +在182上操作 +``` +# su -l www +$ ssh-keygen -t rsa -f /home/www/.ssh/id_rsa -P '' +$ ssh-copy-id "-p 60920 www@192.168.4.179" +测试登录： +ssh -p 60920 www@192.168.4.179 +``` + + + +第二种方法 +``` +# su -l www +$ mkdir /home/www/.ssh +$ chmod 700 /home/www/.ssh +$ vi /home/www/.ssh/authorized_keys 将179中的/home/www/.ssh/id_rsa.pub 写入 +$ chmod 600 /home/www/.ssh/authorized_keys +在179上测试： +ssh -p 60920 www@192.168.4.185 +``` + + + + + + + + + + + diff --git a/star/SSL_certificate/Certbot_certificate.md b/star/SSL_certificate/Certbot_certificate.md new file mode 100644 index 00000000..b33cb1fb --- /dev/null +++ b/star/SSL_certificate/Certbot_certificate.md @@ -0,0 +1,25 @@ +# 使用Certbot获取免费泛域名(通配符)证书 + +## 泛域名证书 + +``` +# git clone https://github.com/certbot/certbot +# cd certbot +# certbot certonly --preferred-challenges dns --manual -d *.funet8.com --server https://acme-v02.api.letsencrypt.org/directory +``` + +讲解下参数: + +* --preferred-challenges dns: 认证方式选择DNS, 泛域名支持DNS +* --manual: 手动模式, 这里为了简单就使用手动认证了, 下面会说自动模式的使用. +* -d *.funet8.com: 就是要申请的泛域名了 +* --server [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory): 泛域名证书是新功能, 如果要使用就得加上这个参数 + +注意这一步需要手动配置TXT记录, 在域名解析服务商添加一个泛解析就可以了, 设置好了再敲下回车. + +最后就会将生成好的证书保存到本地. + + + + +参考： https://www.jianshu.com/p/1eb7060c5ede \ No newline at end of file diff --git "a/star/SSL_certificate/Let's Encrypt\345\205\215\350\264\271SSL\350\257\201\344\271\246.pdf" "b/star/SSL_certificate/Let's Encrypt\345\205\215\350\264\271SSL\350\257\201\344\271\246.pdf" new file mode 100644 index 00000000..2d11781a Binary files /dev/null and "b/star/SSL_certificate/Let's Encrypt\345\205\215\350\264\271SSL\350\257\201\344\271\246.pdf" differ diff --git "a/star/SSL_certificate/Let\342\200\231s Encrypt \350\257\201\344\271\246\347\224\263\350\257\267\350\256\260\345\275\225.md" "b/star/SSL_certificate/Let\342\200\231s Encrypt \350\257\201\344\271\246\347\224\263\350\257\267\350\256\260\345\275\225.md" new file mode 100644 index 00000000..5a66a91c --- /dev/null +++ "b/star/SSL_certificate/Let\342\200\231s Encrypt \350\257\201\344\271\246\347\224\263\350\257\267\350\256\260\345\275\225.md" @@ -0,0 +1,103 @@ + +# Let’s Encrypt 证书申请记录 + +对于国内用户来说，可以实用与百度云、腾讯云、阿里云合作的赛门铁克签署的证书，一年免费，申请和使用都很方便。 + +## Let’s Encrypt是什么？ +免费、自动化、开放的证书签发服务 + +Let’s Encrypt的证书申请和续期都非常方便，默认的证书有效期是90天，通过cron的定时任务可以实现自动化的续期，所以，能通过自动的方式解决的问题都不是问题，这也是这次折腾起https支持的原因 + + +## 第一步 获取Certbot + +Certbot 是一个简单易用的 SSL 证书部署工具，由 EFF 开发，前身即 Let’s Encrypt 官方（Python）客户端。简单来说，certbot 就是一个简化 Let’s Encrypt 部署，和管理 Let’s Encrypt 证书的工具。certbot的开源项目在GitHub上，所以，我们的第一步，是clone certbot项目到本地： + +``` +git clone https://github.com/certbot/certbot +``` + +## 第二步 申请证书 + +现在，可以通过脚本来申请证书了，以我的域名为例： +域名需要解析到服务器中 + +``` +cd certbot +./letsencrypt-auto certonly -d ssl.funet8.com +``` + +显示：选择 +``` +1: Spin up a temporary webserver (standalone) +2: Place files in webroot directory (webroot) +- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 ##########选择 + +Enter email address (used for urgent renewal and security notices) (Enter 'c' to +cancel): funet8@163.com ##############填写邮箱 + + +``` + +## 第三步 配置证书 +申请好的证书，包含四个文件，默认会放在这里： +``` +/etc/letsencrypt/live/www.funet8.com/fullchain.pem +/etc/letsencrypt/live/www.funet8.com/privkey.pem +/etc/letsencrypt/live/www.funet8.com/cert.pem +/etc/letsencrypt/live/www.funet8.com/chain.pem +``` +有了这些证书文件，我们就可以去配置我们的Nginx了，实际上，我们用两个证书文件就行了，一个是带私钥的文件，一个是带公钥的文件。拿我的Nginx配置文件举个栗子： + +``` +server { + listen 80 default; #默认监听80的HTTP端口; + listen 443 ssl; #确保Nginx监听HTTPS的443端口 + + # SSL证书配置 + ssl_certificate /etc/letsencrypt/live/www.funet8.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/www.funet8.com/privkey.pem; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + + root /home/xiaozhou; + index index.html index.htm; + + server_name funet8.com www.funet8.com; +} +``` + +配置好之后，直接用Nginx reload配置即可。 + +## 第五步 证书的验证 + +证书配置好了，我们就可以直接用浏览器通过https地址来访问和验证证书了，比如：https://www.funet8.com +我们会看到地址栏的前面有一把小锁，嗯，咱是有证书的人了! + +## 第六步 证书的自动续期 + +最后一步，就是证书的自动续期了。Let’s Encrypt的证书，默认的有效期是90天，不过官方推荐每60天续期。到期之后，我们需要用命令来为证书续期，不过我们是懒人，这种体力活还是交给机器来完成比较合适。所以，我们可以用Linux的cron job来完成这类的任务，配置cron job，每两个月的第一天，执行下面的命令： +``` +#minute hour day month day_of_week command + +0 0 1 */2 * /letsencrypt/certbot-auto renew --post-hook "systemctl reload nginx" + +``` + +注意在cron job里面需要用绝对路径 + + + +为你的Blog快速开启https支持 +https://xiaozhou.net/be-quick-to-enable-ssl-for-your-blog-2016-07-13.html + + +申请Let's Encrypt通配符HTTPS证书 +https://my.oschina.net/kimver/blog/1634575#comment-list + +Let’s Encrypt免费泛域名证书申请教程步骤 +https://www.xxorg.com/archives/4870 + + diff --git a/star/SSL_certificate/readme.md b/star/SSL_certificate/readme.md new file mode 100644 index 00000000..b8a05aa7 --- /dev/null +++ b/star/SSL_certificate/readme.md @@ -0,0 +1,24 @@ +# http与https的区别 + +HTTP：是互联网上应用最为广泛的一种网络协议，是一个客户端和服务器端请求和应答的标准（TCP），用于从WWW服务器传输超文本到本地浏览器的传输协议，它可以使浏览器更加高效，使网络传输减少。 + +HTTPS：是以安全为目标的HTTP通道，简单讲是HTTP的安全版，即HTTP下加入SSL层，HTTPS的安全基础是SSL，因此加密的详细内容就需要SSL。 + +HTTPS和HTTP的区别主要如下： + +　　1、https协议需要到ca申请证书，一般免费证书较少，因而需要一定费用。 + +　　2、http是超文本传输协议，信息是明文传输，https则是具有安全性的ssl加密传输协议。 + +　　3、http和https使用的是完全不同的连接方式，用的端口也不一样，前者是80，后者是443。 + +　　4、http的连接很简单，是无状态的；HTTPS协议是由SSL+HTTP协议构建的可进行加密传输、身份认证的网络协议，比http协议安全。 + +https://www.cnblogs.com/wqhwe/p/5407468.html + +# 阿里云、腾讯云、百度云免费一年ssl证书 + + + + +# [使用Certbot获取免费泛域名(通配符)证书](Certbot_certificate.md) diff --git "a/star/article/DDoS\346\224\273\345\207\273\347\232\204\350\256\244\347\237\245\350\257\257\345\214\272.jpg" "b/star/article/DDoS\346\224\273\345\207\273\347\232\204\350\256\244\347\237\245\350\257\257\345\214\272.jpg" new file mode 100644 index 00000000..74ee0f11 Binary files /dev/null and "b/star/article/DDoS\346\224\273\345\207\273\347\232\204\350\256\244\347\237\245\350\257\257\345\214\272.jpg" differ diff --git "a/star/article/HTTPS \347\232\204\345\216\237\347\220\206.docx" "b/star/article/HTTPS \347\232\204\345\216\237\347\220\206.docx" new file mode 100644 index 00000000..da4cf68c Binary files /dev/null and "b/star/article/HTTPS \347\232\204\345\216\237\347\220\206.docx" differ diff --git "a/star/article/\345\210\260\345\272\225\350\257\245\344\270\215\350\257\245\344\270\212SSL\347\275\221\347\253\231\357\274\237HTTPS\347\253\231\347\202\271\346\234\211\345\223\252\344\272\233\344\274\230\347\274\272\347\202\271\357\274\237.txt" "b/star/article/\345\210\260\345\272\225\350\257\245\344\270\215\350\257\245\344\270\212SSL\347\275\221\347\253\231\357\274\237HTTPS\347\253\231\347\202\271\346\234\211\345\223\252\344\272\233\344\274\230\347\274\272\347\202\271\357\274\237.txt" new file mode 100644 index 00000000..b53070cb --- /dev/null +++ "b/star/article/\345\210\260\345\272\225\350\257\245\344\270\215\350\257\245\344\270\212SSL\347\275\221\347\253\231\357\274\237HTTPS\347\253\231\347\202\271\346\234\211\345\223\252\344\272\233\344\274\230\347\274\272\347\202\271\357\274\237.txt" @@ -0,0 +1,43 @@ +׸òSSLվHTTPSվЩȱ㣿 + +Googleٶȶȫվ֧httpsˣҲᳫվǡhttpsʱҲֺܶСվSSL֤httpsܶվҲڹУ׸òhttpshttphttpsվһЩȱ㡣 + + + +ŵ + +ȫԣHTTPSǾ԰ȫո֤Ļռ㷨֯ͬԽмʽĹHTTPSмܹȫĽ + +SEOGoogleͰٶȶ˵HTTPSܵվеߡ + +ȱ + +ӶãȻҲѵSSL֤飬Ҫ볤ڵӪվҪշѵSSL + +վٶȱһЩ֪վʹHTTPSЭʹҳļʱӳ50%10%20%ĺĵ硣⣬HTTPSЭ黹Ӱ컺棬ݿ͹ģаȫʩҲܵӰҲ˶ܵӰ졣HTTPS ӷԴռøߺַ֧ܶ࣬ÿԶվҪͶijɱ + +ܵhttpԴhttpsվ޷κhttpԴȽϲ51laͳƴ룬ȴhttpsվϣΪ51la֧httpsһЩԤ롢ѶӪQQ롢iframeⲿӵв֧httpsĵ룬޷ãվʹhttpʡ + +ܽ + +׸òhttpsվͿվˣһЩȫҪȽϸߵվվûhttpsһЩСš͵վȲõĺá + +ԣ +http://www.huoduan.com/https.html + + + + + +1ʲôSSL ֤飿 +SSL ֤ṩһڻ֤ķʽ,ʶ֤ͨ˫ݵϢļʹ SSL ֤վԱ֤ûͷϢıԣвɸġɷϡðĹܡSSL֤Ȩ֤CA䷢Entrust ȫ֪ CA йҵվʹ ssl֤顣 + +2ΪʲôҪʹ SSL֤飿 +ѾΪвȱٵһ֣ڽͷͳǣϰϽѡȻվľϢءй¶ȵȲ緸ﾯʾǣܱͬʱվٽϢȫ¶ڻϵķաͨ SSL ֤飬ѵļڲ鿴վṩһֹͨԤͨͨϢ + +3SSL֤վΪվ +ͨ SSL ֤ʶվ,վӱɰȫӡһԣͨȫܵվַ HTTPS HTTPͷгijͼ꣬ͼ꣬ʾվǰȫġSSL ֤ӽмܣʹڿ͸Ѳ鿴ˣѽԸվģӶύκλϢ + +4ɫַÿվһĿȻͨ SSL ֤鼼ַݷڵַվ֤һ㡣 + +5ɫַıɫĿΪӦթƭⱣɿͻϽļٵϷ֮ǰϣܹȡԴʶ֤ǿ SSL ֤֤֤׼Ҳø߰ȫĿӾЧվʹչ֤ǿ֤ (EVSSL) ֯ƽɫʾڸͼԣĿǰǰհԤվӦõķʽ֮һ \ No newline at end of file diff --git "a/star/article/\346\234\215\345\212\241\345\231\250\346\224\273\345\207\273\346\226\271\346\263\225.txt" "b/star/article/\346\234\215\345\212\241\345\231\250\346\224\273\345\207\273\346\226\271\346\263\225.txt" new file mode 100644 index 00000000..7824d9e2 --- /dev/null +++ "b/star/article/\346\234\215\345\212\241\345\231\250\346\224\273\345\207\273\346\226\271\346\263\225.txt" @@ -0,0 +1,175 @@ + +cc +http://baike.baidu.com/link?url=cpzqe8H3dMweD8-fuVIQzuUZLc6mCiGV0SHLUp_Mk09r-gg2YLuMYuwLiBx1lwpAp0YgeOiAOIVwscVXzDjmpa +ٶȰٿƶ壺ָ߽ܺĺϷʵDDOSαװͽУCC(ChallengeCollapsar) + +DDOS-ֲʽܾ񹥻 +https://baike.baidu.com/item/%E5%88%86%E5%B8%83%E5%BC%8F%E6%8B%92%E7%BB%9D%E6%9C%8D%E5%8A%A1%E6%94%BB%E5%87%BB?fromtitle=DDOS%E6%94%BB%E5%87%BB&fromid=177090 + +ٶȰٿƶ壺ֲʽܾ(DDoS:Distributed Denial of Service)ָڿͻ/Ϊƽ̨һĿ귢DDoSӶɱ߾ܾ񹥻ͨʹһ͵ʺŽDDoSسװһϣһ趨ʱسͨѶѾװϵϡյָʱͷÿͻ/سڼڼɰǧδС + + + + + + + + + + + +CCDDOSʲô + +ȷǣȻǹͲͬCCDDOSĶͬһͣΪǵ˼һģĵTCP/IP Эȱݡˣôǣ˵˵ǵԭ + +DDOSֳơֲʽʹ÷Ƿû·ЩݿûInternet·ºϷDDOSȾʱDOSܾ񣩸£ģͨԼ̨ӻ̨ϵĻӽԵͼûΪĿ꣬ʹĿ1ڱ̱һӽôݰ̨ͻٶȣҲܴﵽһӴǧ̨̨ӹĿ󰡣ͬˮҲ๥һ..... +[2㣺1DDOSܹܹ·Ϊ·һ̨͵ļ +2پĺúͿ죬˵һٵĻ£ǵĹЧǺԣǿ֮¸Ч] + +CCԷdzǿIPԶdzߣԭҳΪҪͣڻԼӴԹַַ̳ûΪһص㣬ģƵĹ +֪ǵĵIJֻ֮ͬ͵IJͬѣ֮£CCΪ԰ɣ +CCҪҳDDOSǽзʹݰĿ꣬Ŀ̱ +һ仰ܽ᣺CCDDOSҪ WEB ӦóȽԴĵطз󣬾ˡ + + +DDOSԭһDDOSͻ ɢ˼Ҵ򿪺 Ȼֻһ̨ԣҿҵĿͻһбֲƶ˵ĵһվͷ󣬱м̫Աҿ ÿ̨Էһ վ̱ +CCؿֻʹһ̨ Ȼôй + + + + +SYN TCP/IPЭ3ֵԭʹĽӵʵʽӣյ±бռ޷ûʡ + +SYN_RECV ָ,˱򿪺,յ˿ͻ˵SYNҷACKʱ״̬ٽһյͻ˵ACKͽESTABLISHED״̬ + +http://czmmiao.iteye.com/blog/1616837 + +netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n + + + + + +https://yq.aliyun.com/articles/55976?spm=5176.100238.goodcont.22.NbIMaH + +ضUA + +NginxΪȵվCCʱԴtailһlogļûġpingback֣Ҳ +cat /var/log/nginx/access.log | grep "verifying pingback from" > pingback_attack.log + +if ($http_user_agent ~ (WordPress|pingback) { + return 403; +} + +service nginx restart + + +Nginx򵥷CC +https://bbs.aliyun.com/read/50817.html?spm=5176.bbsr135619.0.0.WeO4xK + + + +1)IPַ +ͨվһ㲻ᳬ20ǿͨűֹIPʡ +½űͨnetstatоӣߵһIP150ͨ iptablesֹʣ +#!/bin/sh +status=`netstat -na|awk '$5 ~ /[0-9]+:[0-9]+/ {print $5}' |awk -F ":" -- '{print $1}' |sort -n|uniq -c |sort -n|tail -n 1` +NUM=`echo $status|awk '{print $1}'` +IP=`echo $status|awk '{print $2}'` +result=`echo "$NUM > 150" | bc` +if [ $result = 1 ] +then +echo IP:$IP is over $NUM, BAN IT! +/sbin/iptables -I INPUT -s $IP -j DROP +fi +crontab -eűӵcrontabÿԶУ +* * * * * /root/xxxx.sh + + + +dzηCC[Discuz̳] +http://netsecurity.51cto.com/art/201009/225560.htm + +ļ config.inc.php + +$attackevasive = 0; // ̳𣬿ɷֹķɵľܾ񹥻 + +// ɵľܾ񹥻 + +// 0=ر, 1=cookie ˢ, 2=ƴ, 4=, 8=ش⣨һηʱҪش⣩ + +// Ϊ: 1|2, 1|4, 2|8, 1|2|4... + + +Ϊ 0⵽ʱ乥ַ͹ɣʹáԳΪ 2 2|4 1|2|4| 1|2|4|8 1|2|4|8 УΪӦóѾֵסܵĹڽʬ DDOS ˣǽӷǽ֡ + +ܹ Чش? +http://netsecurity.51cto.com/art/201608/515574.htm + + + + +ɻԭͳWEB +https://bbs.aliyun.com/read/285939.html +https://bbs.aliyun.com/read/286071.html + + +ǸȫĿƽ̨ԽǿŵĶ©ԽǶࡣάһбϰֵWEBʽ +dzУűע롢SQLע롢DDoSDNSٳ֡˿©ɨ衢뱩ƽ⡢XSSCSRFȡֻһЩĹܣ + + + + +ưٶȵ֩ץȡƵʣ + +nginxngx_http_limit_req_moduleģ˰ٶ֩ץȡƵʡÿٶ֩ץȡ200Σץȡ󷵻503 +nginxã + +ȫ + +limit_req_zone $anti_spider zone=anti_spider:60m rate=200r/m; + +ijserver + +limit_req zone=anti_spider burst=5 nodelay; + if ($http_user_agent ~* "baiduspider") { + set $anti_spider $http_user_agent; + } + +˵ + ָlimit_req_zone еrate=200r/m ʾÿֻܴ200 + ָlimit_req еburst=5 ʾ󲢷Ϊ5ͬһʱֻͬʱ5 + ָlimit_req е nodelay ʾѾﵽburstֵʱʱֱӷ503 + IFжǷǰٶ֩user agentǣͶԱ$anti_spiderֵֻ԰ٶ֩ˡ + + + +繥 Ҫ +http://www.liaoxiansheng.cn/?p=445 + + + +ٳΣж󣿼ܺڿġߡֶ +http://www.iplaysoft.com/traffic-hijack-1.html +http://www.iplaysoft.com/traffic-hijack-2.html + + +DDOSڻϵŰģʹDDOSķøѡ +ôվûӦòȡĴʩЧķ?Ҿͽһ·DDoSĻ +1طʵIP +ǰ˼CDNת(ѵаٶƼ١360վʿ֡ȫ)ʽԣĻԹ߷ĶܻطʵIPʹCDNIPнʹCDNIPַ⣬ϲҲʹʵIPȫʹCDN +⣬ֹ⴫Ϣй©IPǣʹ÷ʼܣҪʼͨ(sendcloud)ͣʾIPǴIP +2֤ϵͳİȫ +Ҫȷûκ©ֹ֡ȷϵͳϰȫڷɾδʹõķ񣬹رδʹõĶ˿ڡڷеվȷµIJûаȫ© +3ڱ +ôŴݣݱҲھ޴İȫ©ڱʱҲӦöԱݽʽЧر +4ǿļʽȫ + + + + + + + + + diff --git "a/star/article/\347\224\250Linux\347\263\273\347\273\237\351\230\262\347\201\253\345\242\231\345\212\237\350\203\275\346\212\265\345\276\241\347\275\221\347\273\234\346\224\273\345\207\273.txt" "b/star/article/\347\224\250Linux\347\263\273\347\273\237\351\230\262\347\201\253\345\242\231\345\212\237\350\203\275\346\212\265\345\276\241\347\275\221\347\273\234\346\224\273\345\207\273.txt" new file mode 100644 index 00000000..1ffab91d --- /dev/null +++ "b/star/article/\347\224\250Linux\347\263\273\347\273\237\351\230\262\347\201\253\345\242\231\345\212\237\350\203\275\346\212\265\345\276\241\347\275\221\347\273\234\346\224\273\345\207\273.txt" @@ -0,0 +1,228 @@ +用Linux系统防火墙功能抵御网络攻击 + +虚拟主机服务商在运营过程中可能会受到黑客攻击，常见的攻击方式有SYN，DDOS等。 +通过更换IP，查找被攻击的站点可能避开攻击，但是中断服务的时间比较长。比较彻底 +的解决方法是添置硬件防火墙。不过，硬件防火墙价格比较昂贵。可以考虑利用Linux +系统本身提供的防火墙功能来防御。 + +1. 抵御SYN +SYN攻击是利用TCP/IP协议3次握手的原理，发送大量的建立连接的网络包，但不实际 +建立连接，最终导致被攻击服务器的网络队列被占满，无法被正常用户访问。 +Linux内核提供了若干SYN相关的配置，用命令： +sysctl -a | grep syn +看到： +net.ipv4.tcp_max_syn_backlog = 1024 +net.ipv4.tcp_syncookies = 0 +net.ipv4.tcp_synack_retries = 5 +net.ipv4.tcp_syn_retries = 5 + +tcp_max_syn_backlog是SYN队列的长度，tcp_syncookies是一个开关，是否打开SYN Cookie +功能，该功能可以防止部分SYN攻击。tcp_synack_retries和tcp_syn_retries定义SYN +的重试次数。 + +加大SYN队列长度可以容纳更多等待连接的网络连接数，打开SYN Cookie功能可以阻止部分 +SYN攻击，降低重试次数也有一定效果。 + +调整上述设置的方法是： +增加SYN队列长度到2048： +sysctl -w net.ipv4.tcp_max_syn_backlog=2048 +打开SYN COOKIE功能： +sysctl -w net.ipv4.tcp_syncookies=1 +降低重试次数： +sysctl -w net.ipv4.tcp_synack_retries=3 +sysctl -w net.ipv4.tcp_syn_retries=3 + +为了系统重启动时保持上述配置，可将上述命令加入到/etc/rc.d/rc.local文件中。 + +2. 抵御DDOS +DDOS，分布式拒绝访问攻击，是指黑客组织来自不同来源的许多主机，向常见的端口，如80， +25等发送大量连接，但这些客户端只建立连接，不是正常访问。由于一般Apache配置的接受连接 +数有限（通常为256），这些“假” 访问会把Apache占满，正常访问无法进行。 + +Linux提供了叫ipchains的防火墙工具，可以屏蔽来自特定IP或IP地址段的对特定端口的连接。 +使用ipchains抵御DDOS，就是首先通过netstat命令发现攻击来源地址，然后用ipchains命令阻断 +攻击。发现一个阻断一个。 + +*** 打开ipchains功能 +首先查看ipchains服务是否设为自动启动： +chkconfig --list ipchains +输出一般为： +ipchains 0:off 1:off 2:on 3:on 4:on 5:on 6:off +如果345列为on，说明ipchains服务已经设为自动启动 +如果没有，可以用命令： +chkconfig --add ipchains +将ipchains服务设为自动启动 +其次，察看ipchains配置文件/etc/sysconfig/ipchains是否存在。如果这一文件不存在，ipchains +即使设为自动启动，也不会生效。缺省的ipchains配置文件内容如下： + +# Firewall configuration written by lokkit +# Manual customization of this file is not recommended. +# Note: ifup-post will punch the current nameservers through the +# firewall; such entries will *not* be listed here. +:input ACCEPT +:forward ACCEPT +:output ACCEPT +-A input -s 0/0 -d 0/0 -i lo -j ACCEPT +# allow http,ftp,smtp,ssh,domain via tcp; domain via udp +-A input -p tcp -s 0/0 -d 0/0 pop3 -y -j ACCEPT +-A input -p tcp -s 0/0 -d 0/0 http -y -j ACCEPT +-A input -p tcp -s 0/0 -d 0/0 https -y -j ACCEPT +-A input -p tcp -s 0/0 -d 0/0 ftp -y -j ACCEPT +-A input -p tcp -s 0/0 -d 0/0 smtp -y -j ACCEPT +-A input -p tcp -s 0/0 -d 0/0 ssh -y -j ACCEPT +-A input -p tcp -s 0/0 -d 0/0 domain -y -j ACCEPT +-A input -p udp -s 0/0 -d 0/0 domain -j ACCEPT +# deny icmp packet +#-A input -p icmp -s 0/0 -d 0/0 -j DENY +# default rules +-A input -p tcp -s 0/0 -d 0/0 0:1023 -y -j REJECT +-A input -p tcp -s 0/0 -d 0/0 2049 -y -j REJECT +-A input -p udp -s 0/0 -d 0/0 0:1023 -j REJECT +-A input -p udp -s 0/0 -d 0/0 2049 -j REJECT +-A input -p tcp -s 0/0 -d 0/0 6000:6009 -y -j REJECT +-A input -p tcp -s 0/0 -d 0/0 7100 -y -j REJECT + +如果/etc/sysconfig/ipchains文件不存在，可以用上述内容创建之。创建之后，启动ipchains服务： +/etc/init.d/ipchains start + +*** 用netstat命令发现攻击来源 +假如说黑客攻击的是Web 80端口，察看连接80端口的客户端IP和端口，命令如下： +netstat -an -t tcp | grep ":80" | grep ESTABLISHED | awk '{printf "%s %s\n",$5,$6}' | sort +输出： +161.2.8.9:123 FIN_WAIT2 +161.2.8.9:124 FIN_WAIT2 +61.233.85.253:23656 FIN_WAIT2 +... +第一栏是客户机IP和端口，第二栏是连接状态 +如果来自同一IP的连接很多（超过50个），而且都是连续端口，就很可能是攻击。 +如果只希望察看建立的连接，用命令： +netstat -an -t tcp | grep ":80" | grep ESTABLISHED | awk '{printf "%s %s\n",$5,$6}' | sort + +*** 用ipchains阻断攻击来源 +用ipchains阻断攻击来源，有两种方法。一种是加入到/etc/sysconfig/ipchains里，然后重启动 +ipchains服务。另一种是直接用ipchains命令加。屏蔽之后，可能还需要重新启动被攻击的服务， +是已经建立的攻击连接失效 + +* 加入/etc/sysconfig/ipchains +假定要阻止的是218.202.8.151到80的连接，编辑/etc/sysconfig/ipchains文件，在:output ACCEPT +行下面加入： +-A input -s 218.202.8.151 -d 0/0 http -y -j REJECT +保存修改，重新启动ipchains： +/etc/init.d/ipchains restart +如果要阻止的是218.202.8的整个网段，加入： +-A input -s 218.202.8.0/255.255.255.0 -d 0/0 http -y -j REJECT + +* 直接用命令行 +加入/etc/sysconfig/ipchains文件并重起ipchains的方法，比较慢，而且在ipchains重起的瞬间， +可能会有部分连接钻进来。最方便的方法是直接用ipchains命令。 +假定要阻止的是218.202.8.151到80的连接，命令： +ipchains -I input 1 -p tcp -s 218.202.8.151 -d 0/0 http -y -j REJECT +如果要阻止的是218.202.8的整个网段，命令： +ipchains -I input 1 -p tcp -s 218.202.8.0/255.255.255.0 -d 0/0 http -y -j REJECT +其中，-I的意思是插入，input是规则连，1是指加入到第一个。 + +您可以编辑一个shell脚本，更方便地做这件事，命令： +vi blockit +内容： +#!/bin/sh +if [ ! -z "$1" ] ; then + echo "Blocking: $1" + ipchains -I input 1 -p tcp -s "$1" -d 0/0 http -y -j REJECT +else + echo "which ip to block?" +fi +保存，然后： +chmod 700 blockit +使用方法： +./blockit 218.202.8.151 +./blockit 218.202.8.0/255.255.255.0 + +上述命令行方法所建立的规则，在重起之后会失效，您可以用ipchains-save命令打印规则: +ipchains-save +输出： +:input ACCEPT +:forward ACCEPT +:output ACCEPT +Saving `input'. +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -i lo -j ACCEPT +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 110:110 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 80:80 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 22:22 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 88:88 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 89:89 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 90:90 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 91:91 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 8180:8180 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 443:443 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 21:21 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 25:25 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 22:22 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 53:53 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 9095:9095 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 8007:8007 -p 6 -j ACCEPT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 53:53 -p 17 -j ACCEPT +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 0:1023 -p 6 -j REJECT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 2049:2049 -p 6 -j REJECT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 0:1023 -p 17 -j REJECT +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 2049:2049 -p 17 -j REJECT +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 6000:6009 -p 6 -j REJECT -y +-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 7100:7100 -p 6 -j REJECT -y +您需要把其中的"Saving `input'."去掉，然后把其他内容保存到/etc/sysconfig/ipchains文件， +这样，下次重起之后，建立的规则能够重新生效。 + +3. 如果使用iptables +RH 8.0以上开始启用iptables替代ipchains，两者非常类似，也有差别的地方。 +* 启用iptables +如果/etc/sysconfig/下没有iptables文件，可以创建： +# Firewall configuration written by lokkit +# Manual customization of this file is not recommended. +# Note: ifup-post will punch the current nameservers through the +# firewall; such entries will *not* be listed here. +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:RH-Lokkit-0-50-INPUT - [0:0] +-A INPUT -j RH-Lokkit-0-50-INPUT +-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT +-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport ftp -j ACCEPT +-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport ssh -j ACCEPT +-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport http -j ACCEPT +-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport smtp -j ACCEPT +-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport pop3 -j ACCEPT +-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport mysql -j ACCEPT +-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2001 -j ACCEPT +-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport domain -j ACCEPT +-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport domain -j ACCEPT +-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --syn -j REJECT +-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT +-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT +-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT +-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --syn -j REJECT +-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --syn -j REJECT +COMMIT +以上配置允许了ftp, ssh, http, smtp, pop3, mysql, 2001(Prim@Hosting ACA端口)，domain端口。 + +* 启动iptables +/etc/init.d/iptables start + +* 设置iptables为自动启动 +chkconfig --level 2345 iptables on + +* 用iptables屏蔽IP +iptables -I RH-Lokkit-0-50-INPUT 1 -p tcp -m tcp -s 213.8.166.227 --dport 80 --syn -j REJECT +注意到，和ipchains的区别是： +-I 后面跟的规则名称的参数和ipchains不同，不是统一的input，而是在/etc/sysconfig/iptables里定义的那个 +多了-m tcp +指定端口的参数是--dport 80 +多了--syn参数，可以自动检测sync攻击 + +使用iptables禁止ping： +-A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 6/min --limit-burst 2 -j ACCEPT +-A INPUT -p icmp -m icmp --icmp-type 8 -j REJECT --reject-with icmp-port-unreachable + +允许某ip连接 +-I RH-Firewall-1-INPUT 1 -p tcp -m tcp -s 192.168.0.51 --syn -j ACCEPT + +转载：http://www.parallels.com.cn/support.php?x=&mod_id=2&root=77&id=38 + diff --git a/star/centos_install_dns/readme.md b/star/centos_install_dns/readme.md new file mode 100644 index 00000000..d1c121b6 --- /dev/null +++ b/star/centos_install_dns/readme.md @@ -0,0 +1,185 @@ +# 简单dns服务器搭建 + +## 一：软件安装 +``` +[root@localhost ~]# yum -y install bind* +``` + + + +## 二：修改主配置文件 +``` +[root@localhost ~]# cp /etc/named.conf /etc/named.conf.bak # 修改之前先备份一遍 +``` + +修改配置文件 +``` +[root@localhost ~]# vi /etc/named.conf + +options { + + listen-on port 53 { any; }; // 监听在主机的53端口上。any代表监听所有的主机 + directory "/var/named"; // 如果此档案底下有规范到正反解的zone file 档名时，该档名预设应该放置在哪个目录底下 + + // 下面三项是服务的相关统计信息 + + dump-file "/var/named/data/cache_dump.db"; + statistics-file "/var/named/data/named_stats.txt"; + memstatistics-file "/var/named/data/named_mem_stats.txt"; + allow-query { any; }; // 谁可以对我的DNS服务器提出查询请求。any代表任何人 + recursion yes; + dnssec-enable yes; + dnssec-validation yes; + dnssec-lookaside auto; + forwarders { // 指定上层DNS服务器 + 192.168.1.1; + }; + bindkeys-file "/etc/named.iscdlv.key"; + managed-keys-directory "/var/named/dynamic"; +}; + +logging { + + channel default_debug { + file "data/named.run"; + severity dynamic; + }; + +}; +zone "." IN { + type hint; + file "named.ca"; +}; + +include "/etc/named.rfc1912.zones"; +include "/etc/named.root.key"; +``` + + + + + + +## 三 自定义域名解析配置 +``` +[root@localhost ~]# vi /etc/named.rfc1912.zones # 比如我们要添加yumaozdy.com这个域的解析可以添加下面这一段 + +zone "yumaozdy.com" IN { // 定义要解析主域名 + type master; + file "yumaozdy.com.zone"; // 具体相关解析的配置文件保存在 /var/named/yumaozdy.com.zone 文件中 + +}; +``` + + + + + + +## 四 自定义yumaozdy.com.zone文件 +``` +[root@ns named]# vi /var/named/yumaozdy.com.zone + +$TTL 86400 +@ IN SOA ns.yumaozdy.com. root ( + 1 ; serial + 1D ; refresh + 1H ; retry + 1W ; expire + 0 ) ; minimum + +@ IN NS ns.yumaozdy.com. +ns IN A 192.168.1.219 +www IN A 192.168.1.45 +bbs IN A 192.168.1.46 +ttt IN A 192.168.1.68 + + + + +// 其中 ns.yumaozdy.com 代表当前dns服务器名称。所以 ns.yumaozdy.com 一定要解析到自己本身 + + www IN A 192.168.1.45 // 代表 www.yumaozdy.com 解析到 192.168.1.45服务器上。其他的类似 +``` + + + + + + +## 五 修改权限 +``` +[root@ns named]# chown root:named yumaozdy.com.zone # 这一步一定要做 +``` + + +## 六 重启服务 +``` +[root@dns_server named]# service named restart +``` + + + + +## 七 如果我们要追加一个域的解析。 +比如google.com 则： +``` +vi /etc/named.rfc1912.zones + +// 添加下面这段 +zone "google.com" IN { + type master; + file "google.com.zone"; +}; +``` + + +``` +[root@ns named]# cp -a yumaozdy.com.zone google.com.zone +[root@ns named]# vi google.com.zone + +$TTL 86400 +@ IN SOA ns.google.com. root ( + 1 ; serial + 1D ; refresh + 1H ; retry + 1W ; expire + 0 ) ; minimum +@ IN NS ns.google.com. +ns IN A 192.168.1.219 +www IN A 192.168.1.11 +bbs IN A 192.168.1.46 +ttt IN A 192.168.1.68 +``` + + + +``` +chkconfig named on +``` + + + +## 八、关闭selinux（略） + +## 九、添加防火墙规则 +``` +vi /etc/sysconfig/iptables + +-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT +-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT +-A INPUT -m state --state NEW -m tcp -p tcp --dport 953 -j ACCEPT + +添加规则，并且保存（注意位置） + +service iptables restart +``` + + +## 十、测试 +``` +vim /etc/resolv.conf +nameserver 192.168.1.219 +``` + + diff --git "a/star/centos_install_git_svn/SVN\346\234\215\345\212\241\345\231\250/CentOS\346\220\255\345\273\272SVN\346\234\215\345\212\241\345\231\250-192.168.1.9\344\270\212\346\220\255\345\273\272.txt" "b/star/centos_install_git_svn/SVN\346\234\215\345\212\241\345\231\250/CentOS\346\220\255\345\273\272SVN\346\234\215\345\212\241\345\231\250-192.168.1.9\344\270\212\346\220\255\345\273\272.txt" new file mode 100644 index 00000000..513bec8e --- /dev/null +++ "b/star/centos_install_git_svn/SVN\346\234\215\345\212\241\345\231\250/CentOS\346\220\255\345\273\272SVN\346\234\215\345\212\241\345\231\250-192.168.1.9\344\270\212\346\220\255\345\273\272.txt" @@ -0,0 +1,122 @@ +SVN作为新一代代码版本管理工具，有很多优点，管理方便，逻辑明确，安全性高，代码一致性高。SVN数据存储有两种方式，BDB（事务安全表类型）和FSFS（一种不需要数据库的存储系统），为了避免在服务器连接中断时锁住数据，FSFS是一种更安全也更多人使用的方式。SVN的运行方式也有两种，一种是独立服务器，另一种是借助apache服务，各有利弊，下面就介绍一下这两种方式各自的部署步骤。 + +一.作为独立服务器运行, + +1.安装subversion +[root@localhost ~]# yum -y install subversion +[root@localhost home]# mkdir -p /data/svn #创建svn目录 +[root@localhost home]# chmod -R 777 /home/svn #修改目录权限为777 +[root@localhost home]# svnadmin create /home/svn/repos #创建一个svn版本仓库repos （repos 名字自己起） +[root@localhost home]# cd /home/svn/repos/conf #进入repos版本仓库下的配置文件目录 + + + +二.设置开机启动文件 + +1.编辑/etc/rc.local： + +[root@localhost ~]# vi /etc/rc.local +文件内容如下（在touch /var/lock/subsys/local下面添加一行） + +#添加： +svnserve -d -r /data/svn + +如图： + + +三.启动SVN服务 + +1.启动svn服务，svn服务默认端口为3690，可以使用“netstat -netpl”命令查看服务启动是否成功： +[root@localhost ~]# #svnserve -d -r /home/svn + +2.添加防火墙规则，或者关闭防火墙 +[root@localhost ~]# vi /etc/sysconfig/iptables +添加以下内容： +-A INPUT -m state --state NEW -m tcp -p tcp --dport 3690 -j ACCEPT +保存后重启防火墙 +[root@localhost ~]# service iptables restart + +即可。 + +将 +svnadmin create /home/svn/gamebox +svnadmin create /home/svn/sdk + +将打包过来的文件覆盖。 + + +如果已经有svn在运行，可以换一个端口运行 +svnserve -d -r /home/svn/repos –listen-port 3391 +这样同一台服务器可以运行多个svnserve + +停止svn + +[root@zck password]# killall svnserve //停止 +[root@zck password]# svnserve -d -r /home/svn/repos // 启动 + +2.启动成功后就可以使用了 +a.建议采用TortoiseSVN， 连接地址为: svn://your server address （如果指定端口需要添加端口 :端口号 + + +测试 +SVN服务已经启动，使用客户端测试连接。 +客户端连接地址：svn://192.168.1.9 +用户名/密码： test/test + + + + +CentOS下svn迁移备份的三种方法: +http://www.centoscn.com/image-text/config/2013/1217/2242.html + +备份svn项目： +svnadmin dump /home/svn/gamebox/ > /home/svnbak/gamebox20160525 + +恢复： +svnadmin load /home/svn/gamebox/ < /home/svnbak/gamebox20160525 + +将原先服务器的配置文件备份后复制到新服务器中 +#/opt/svn/iitshare/conf目录下 +authz、passwd、svnserve.conf文件 + + + + + +新建项目： +svnadmin create /home/svn/webgame + +svnadmin create /home/svn/kmreader_iOS + + +修改配置： + +[root@zck password]# killall svnserve //停止 +[root@zck password]# svnserve -d -r /home/svn // 启动 + + +svn地址： +svn://192.168.1.9/sdk + + + + + + + + + + + + + + + + + + + +参考： +http://www.linuxidc.com/Linux/2014-01/95640.htm +http://www.jb51.net/os/RedHat/73031.html + diff --git "a/star/centos_install_git_svn/SVN\346\234\215\345\212\241\345\231\250/CentOS\346\220\255\345\273\272SVN\346\234\215\345\212\241\345\231\250.txt" "b/star/centos_install_git_svn/SVN\346\234\215\345\212\241\345\231\250/CentOS\346\220\255\345\273\272SVN\346\234\215\345\212\241\345\231\250.txt" new file mode 100644 index 00000000..71e1ef47 --- /dev/null +++ "b/star/centos_install_git_svn/SVN\346\234\215\345\212\241\345\231\250/CentOS\346\220\255\345\273\272SVN\346\234\215\345\212\241\345\231\250.txt" @@ -0,0 +1,121 @@ +SVN作为新一代代码版本管理工具，有很多优点，管理方便，逻辑明确，安全性高，代码一致性高。SVN数据存储有两种方式，BDB（事务安全表类型）和FSFS（一种不需要数据库的存储系统），为了避免在服务器连接中断时锁住数据，FSFS是一种更安全也更多人使用的方式。SVN的运行方式也有两种，一种是独立服务器，另一种是借助apache服务，各有利弊，下面就介绍一下这两种方式各自的部署步骤。 + +一.作为独立服务器运行, + +1.安装subversion +[root@localhost ~]# yum -y install subversion +[root@localhost opt]# mkdir -p /opt/svn #创建svn目录 +[root@localhost opt]# chmod -R 777 /opt/svn #修改目录权限为777 +[root@localhost opt]# svnadmin create /opt/svn/repos #创建一个svn版本仓库repos （repos 名字自己起） +[root@localhost opt]# cd /opt/svn/repos/conf #进入repos版本仓库下的配置文件目录 + +修改此目录下的三个配置文件 + +1)svnserve.conf #配置版本库信息和用户文件和用户密码文件的路径、版本库路径 + +[root@localhost ~] #vi svnserve.conf +修改一下几处： + +#anon-access = read +#auth-access = write +#password-db = passwd + +将这三行前面的 #号去掉，每行的最左边不能有空格，改成如下： + +anon-access = none #read改为none +auth-access = write +password-db = passwd +authz-db = authz + +realm = repos #改成自己的版本库 + + +如图： + + +保存退出 + +2） 修改authz 文件，创建svn组和组用户的权限 +[root@localhost ~]# vi authz + +[group] + +repos = test,test1 #创建一个repos的组，并添加2个用户test，test1 + +[/] #修改根目录下的权限 +@repos = rw #repos组用户的权限为 读写 +test = rw #test 用户的权限为读写 +* = r #其他用户的权限为只读 + +如图： + + +3）passwd 文件 创建或修改用户密码 + +[root@localhost ~]# vi passwd + +test = test #用户名test的密码为test +test1 = test1 #用户名为test2的密码为test2 + +保存退出 + +二.设置开机启动文件 + +1.编辑/etc/rc.local： + +[root@localhost ~]# vi /etc/rc.local +文件内容如下（在touch /var/lock/subsys/local下面添加一行） + +#!/bin/sh +# +# This script will be executed *after* all the other init scripts. +# You can put your own initialization stuff in here if you don't +# want to do the full Sys V style init stuff. + +touch /var/lock/subsys/local +#添加： +svnserve -d -r /opt/svn/repos + +如图： + + +三.启动SVN服务 + +1.启动svn服务，svn服务默认端口为3690，可以使用“netstat -netpl”命令查看服务启动是否成功： +[root@localhost ~]# #svnserve -d -r /opt/svn/repos + +2.添加防火墙规则，或者关闭防火墙 +[root@localhost ~]# vi /etc/sysconfig/iptables +添加以下内容： +-A INPUT -m state --state NEW -m tcp -p tcp --dport 3690 -j ACCEPT +保存后重启防火墙 +[root@localhost ~]# service iptables restart + +即可。 + +如果已经有svn在运行，可以换一个端口运行 +svnserve -d -r /opt/svn/repos –listen-port 3391 +这样同一台服务器可以运行多个svnserve + +停止svn + +[root@zck password]# killall svnserve //停止 +[root@zck password]# svnserve -d -r /opt/svn/repos // 启动 + +2.启动成功后就可以使用了 +a.建议采用TortoiseSVN， 连接地址为: svn://your server address （如果指定端口需要添加端口 :端口号 + + +测试 +SVN服务已经启动，使用客户端测试连接。 +客户端连接地址：svn://192.168.1.106 +用户名/密码： test/test + + + + + +参考： +http://www.linuxidc.com/Linux/2014-01/95640.htm +http://www.jb51.net/os/RedHat/73031.html + diff --git "a/star/centos_install_git_svn/SVN\346\234\215\345\212\241\345\231\250/restart_svn.sh" "b/star/centos_install_git_svn/SVN\346\234\215\345\212\241\345\231\250/restart_svn.sh" new file mode 100644 index 00000000..7a2382ac --- /dev/null +++ "b/star/centos_install_git_svn/SVN\346\234\215\345\212\241\345\231\250/restart_svn.sh" @@ -0,0 +1,39 @@ +#!/bin/bash + +################# +##重启svn +## svnadmin create /data/svn/kmreader_iOS +## 新增账号：cd ./conf 修改 vi svnserve.conf 和vi authz +# +# svnadmin create /data/svn/XiaoHuaLaiLe_iOS + +# vi /data/svn/XiaoHuaLaiLe_iOS/conf/svnserve.conf +#修改以下参数 +#anon-access = none #read改为none +#auth-access = write +#password-db = passwd +#authz-db = authz +# +#realm = XiaoHuaLaiLe_iOS #改成版本库名字 + +#修改authz 文件，创建svn组和组用户的权限 +#vi /data/svn/XiaoHuaLaiLe_iOS/conf/authz +# 添加： +#[groups] +#program = liuhui,chenyihai +#[/] +#@program = rw +#* = r + +#修改密码 +#vi /data/svn/XiaoHuaLaiLe_iOS/conf/passwd +# chenyihai = chenyihai7477 +# liuhui = yxkj7477 + +################ + + +pkill svnserve +svnserve -d -r /data/svn + +echo "svn RESTART Done" diff --git a/star/centos_install_git_svn/centos_install_git_svn.md b/star/centos_install_git_svn/centos_install_git_svn.md new file mode 100644 index 00000000..0fa412f7 --- /dev/null +++ b/star/centos_install_git_svn/centos_install_git_svn.md @@ -0,0 +1,56 @@ +# centos下搭建svn服务器 + +(一) 软件安装 +``` +# yum -y install subversion # 安装软件 +# mkdir -p /root/svn/version1 # 创建svn版本库目录 +``` + +(二) 单个版本库配置 +``` +1 创建版本库 [root@M1 ~]# svnadmin create /root/svn/version1/ +[root@M1 ~]# ls /root/svn/version1/ +conf db format hooks locks README.txt + +[root@M1 ~]# cd /root/svn/version1/conf/ +[root@M1 conf]# ls +authz passwd svnserve.conf +# passwd 为密码文件 authz为文件权限控制文件 svnserve.conf为svn服务配置文件 + +``` + +2 配置版本库 # 设置帐号密码 +``` + [root@M1 conf]# vi passwd +[users] +svnyumao = 123456 # 添加一个用户 # 设置权限 +[root@M1 conf]# vi authz +[groups] +yumaotest = svnyumao # 添加一个用户组并且包含上面创建的用户 [/] +@yumaotest = rw # 替version1版本库分配权限 # 设置svnserve配置 [root@M1 conf]# vi svnserve.conf +[general] +anon-access = read +auth-access = write +password-db = /root/svn/version1/conf/passwd +authz-db = /root/svn/version1/conf/authz +realm = My First Repository +``` + +3 启动svn +``` +# svnserve -d -r /root/svn/version1 + +# 尽量不要使用系统提供的 /etc/init.d/svnserve start 来启动，因为系统默认的启动脚本中没有使用 –r /svn/project参数指定一个资源。这种情况下启动的svn服务，客户端连接会提示“svn: No repository found in 'svn://192.168.31.2/project' ”这样的错误 + +``` + + +4 关闭svn +``` +[root@M1 conf]# ps -ef | grep svnserve +[root@M1 conf]# kill -9 1669 (进程号) +``` + + + +5 windows 下进行测试 直接使用TortoiseSVN 软件checkout diff --git "a/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/CentOS\345\256\211\350\243\205GitLab-\346\255\245\351\252\244\347\271\201\347\220\220.txt" "b/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/CentOS\345\256\211\350\243\205GitLab-\346\255\245\351\252\244\347\271\201\347\220\220.txt" new file mode 100644 index 00000000..8b7afdcb --- /dev/null +++ "b/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/CentOS\345\256\211\350\243\205GitLab-\346\255\245\351\252\244\347\271\201\347\220\220.txt" @@ -0,0 +1,257 @@ +CentOSװGitLab +οַ +http://www.centoscn.com/image-text/install/2015/0320/4929.html + + +1.yumԴ +ΪװٶȣyumԴΪƿԴ +[root@localhost ~]# cd /etc/yum.repos.d +[root@localhost ~]# wget -O CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-6.repo + +2.Ҫ +[root@localhost ~]# yum -y install libicu-devel patch gcc-c++ readline-devel zlib-devel libffi-devel openssl-devel make autoconf automake libtool bison libxml2-devel libxslt-devel libyaml-devel zlib-devel openssl-devel cpio expat-devel gettext-devel curl-devel perl-ExtUtils-CBuilder perl-ExtUtils-MakeMaker + +3.װGit + // 鿴ǰgit汾 +[root@localhost ~]# git --version + + // С1.7.10ж +[root@localhost ~]# yum remove git + + // µgitװ +[root@localhost ~]# wget -O git-src.zip https://github.com/git/git/archive/master.zip +[root@localhost ~]# unzip git-src.zip + + unzip޷ҵ + [root@localhost ~]# unzip git-src.zip + -bash: unzip: command not found + [root@localhost ~]# yum install -y unzip zip + +[root@localhost ~]# cd git-master/ +[root@localhost ~]# make prefix=/usr/local all +[root@localhost ~]# make prefix=/usr/local install +[root@localhost ~]# ln -fs /usr/local/bin/git* /usr/bin/ + +4.װRuby +[root@localhost ~]# mkdir /tmp/ruby && cd /tmp/ruby +[root@localhost ~]# curl --progress ftp://ftp.ruby-lang.org/pub/ruby/ruby-2.1.5.tar.gz | tar xz + ļftp://ftp.ruby-lang.org/pub/ruby/ruby-2.1.5.tar.gzϴ +[root@localhost ~]# tar -zxvf ruby-2.1.5.tar.gz +[root@localhost ~]# cd ruby-2.1.5 +[root@localhost ~]# ./configure --disable-install-rdoc +[root@localhost ~]# make && make install + +[root@localhost ~]# ln -s /usr/local/bin/ruby /usr/bin/ruby +[root@localhost ~]# ln -s /usr/local/bin/gem /usr/bin/gem +[root@localhost ~]# ln -s /usr/local/bin/bundle /usr/bin/bundle + + // ruby gemԴΪԱ +[root@localhost ~]# gem source -r https://rubygems.org/ +[root@localhost ~]# gem source -a https://ruby.taobao.org/ + gem sources --add https://ruby.taobao.org/ --remove https://rubygems.org/ + +[root@localhost ~]# gem sources -l 鿴gem +*** CURRENT SOURCES *** +https://ruby.taobao.org/ + +[root@localhost ~]# gem install bundler --no-ri --no-rdoc + + +5.װMySQLʼGitLab +[root@localhost ~]# yum install -y mysql mysql-devel mysql-server +[root@localhost ~]# /etc/init.d/mysqld start +[root@localhost ~]# chkconfig mysqld on +[root@localhost ~]# mysql + + // ¼mysqlgitabʺźݿ +mysql> CREATE USER 'gitlab'@'localhost' IDENTIFIED BY 'gitlab'; +mysql> CREATE DATABASE IF NOT EXISTS `gitlabhq_production` DEFAULT CHARACTER SET `utf8` COLLATE `utf8_unicode_ci`; +mysql> GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER ON `gitlabhq_production`.* TO 'gitlab'@'localhost'; +mysql> exit + +[root@localhost ~]# useradd git +[root@localhost ~]# su -l git + + //Ƿgitʺŵ¼ݿ +[git@localhost ~]$ mysql -u gitlab -p -D gitlabhq_production +[git@localhost ~]$ exit + +6.װRedis +[root@localhost ~]# yum -y install redis + + + [root@localhost ~]# yum -y install redis + Loaded plugins: fastestmirror + Loading mirror speeds from cached hostfile + * base: mirrors.aliyun.com + * extras: mirrors.aliyun.com + * updates: mirrors.aliyun.com + Setting up Install Process + No package redis available. + Error: Nothing to do + οhttp://www.laozuo.org/5755.html +[root@localhost ~]# wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm +[root@localhost ~]# rpm -ivh epel-release-6-8.noarch.rpm +[root@localhost ~]# yum install redis + + +[root@localhost ~]# /etc/init.d/redis start +[root@localhost ~]# chkconfig redis on +gitʺŲsudo +[root@localhost ~]# useradd --comment 'GitLab' git +[root@localhost ~]# echo "git ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers + +7.װGitLab +[root@localhost ~]# su -l git +[git@localhost ~]$ git clone https://gitlab.com/gitlab-org/gitlab-ce.git -b 7-8-stable gitlab +[git@localhost ~]$ cd /home/git/gitlab +[git@localhost ~]$ cp /home/git/gitlab/config/gitlab.yml.example /home/git/gitlab/config/gitlab.yml + + // ༭git·, gitlabhost:port +[git@localhost ~]$ vim /home/git/gitlab/config/gitlab.yml + // bin_path: /usr/local/bin/git + // host: localhost + // port: 80 + + // ļӦȨ +[git@localhost ~]$ chown -R git /home/git/gitlab/log/ +[git@localhost ~]$ chown -R git /home/git/gitlab/tmp/ +[git@localhost ~]$ chmod -R u+rwX /home/git/gitlab/log/ +[git@localhost ~]$ chmod -R u+rwX /home/git/gitlab/tmp/ + + // ҪļУԼļ +[git@localhost ~]$ mkdir /home/git/gitlab-satellites +[git@localhost ~]$ mkdir /home/git/gitlab/tmp/pids/ +[git@localhost ~]$ mkdir /home/git/gitlab/tmp/sockets/ +[git@localhost ~]$ chmod -R u+rwX /home/git/gitlab/tmp/pids/ +[git@localhost ~]$ chmod -R u+rwX /home/git/gitlab/tmp/sockets/ +[git@localhost ~]$ mkdir /home/git/gitlab/public/uploads +[git@localhost ~]$ chmod -R u+rwX /home/git/gitlab/public/uploads +[git@localhost ~]$ cp /home/git/gitlab/config/unicorn.rb.example /home/git/gitlab/config/unicorn.rb +[git@localhost ~]$ cp /home/git/gitlab/config/initializers/rack_attack.rb.example /home/git/gitlab/config/initializers/rack_attack.rb + + // ݿϢ +[git@localhost ~]$ cp /home/git/gitlab/config/database.yml.mysql /home/git/gitlab/config/database.yml +[git@localhost ~]$ vim /home/git/gitlab/config/database.yml + // production: + // username: gitlab + // password: "gitlab" + +8.װGitLab-Shell +[git@localhost ~]$ cd /home/git +[git@localhost ~]$ git clone https://gitlab.com/gitlab-org/gitlab-shell.git -b v2.6.0 +[git@localhost ~]$ cd /home/git/gitlab-shell/ +[git@localhost ~]$ cp /home/git/gitlab-shell/config.yml.example /home/git/gitlab-shell/config.yml + +// ༭ļ, gitlab_url, redis-cli, log-level... +[git@localhost ~]$ vim config.yml + // gitlab_url: "http://localhost/" + // /usr/bin/redis-cli + +// װgit-shell +[git@localhost ~]$ /home/git/gitlab-shell/bin/install + +9.װҪrubygems +[git@localhost ~]$ cd /home/git/gitlab +[git@localhost gitlab]$ bundle install --deployment --without development test postgres aws + +10.ʼݿ(GitLabر) +[git@localhost gitlab]$ bundle exec rake gitlab:setup RAILS_ENV=production + +11.װļԼ־иļ +[git@localhost ~]$ exit +[root@localhost ~]# cp /home/git/gitlab/lib/support/init.d/gitlab /etc/init.d/gitlab +[root@localhost ~]# cp /home/git/gitlab/lib/support/init.d/gitlab.default.example /etc/default/gitlab +[root@localhost ~]# cp /home/git/gitlab/lib/support/logrotate/gitlab /etc/logrotate.d/gitlab + +12.gitʺϢ +[root@localhost ~]# su -l git +[git@localhost ~]$ git config --global user.name "liuxingxing" +[git@localhost ~]$ git config --global user.email "funet8@163.com" +[git@localhost ~]$ git config --global core.autocrlf input + +13.װNginx +[git@localhost ~]$ exit +[root@localhost ~]# yum -y install nginx +[root@localhost ~]# vim /etc/nginx/nginx.conf +user root git; +worker_processes 2; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; +# GITLAB +# Maintainer: @randx +# App Version: 5.0 + +upstream gitlab { + server unix:/home/git/gitlab/tmp/sockets/gitlab.socket; +} + +server { + listen *:80 default_server; # e.g., listen 192.168.1.1:80; In most cases *:80 is a good idea + server_name YOUR_SERVER_FQDN; # e.g., server_name source.example.com; + server_tokens off; # don't show the version number, a security best practice + root /home/git/gitlab/public; + + # Set value of client_max_body_size to at least the value of git.max_size in gitlab.yml + client_max_body_size 5m; + + # individual nginx logs for this gitlab vhost + access_log /var/log/nginx/gitlab_access.log; + error_log /var/log/nginx/gitlab_error.log; + + location / { + # serve static files from defined root folder;. + # @gitlab is a named location for the upstream fallback, see below + try_files $uri $uri/index.html $uri.html @gitlab; + } + + # if a file, which is not found in the root folder is requested, + # then the proxy pass the request to the upsteam (gitlab unicorn) + location @gitlab { + proxy_read_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694 + proxy_connect_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694 + proxy_redirect off; + + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + proxy_pass http://gitlab; + } +} +} +13.Ȩޣnginx +[root@localhost ~]# nginx -t +[root@localhost ~]# chown -R git:git /var/lib/nginx/ +[root@localhost ~]# /etc/init.d/nginx start + +⵱ǰ +[root@localhost ~]# su -l git +[git@localhost ~]$ bundle exec rake gitlab:env:info RAILS_ENV=production +ȡgitlab̬Դļ +[git@localhost ~]$ bundle exec rake assets:precompile RAILS_ENV=production + +gitlab +[git@localhost ~]$ /etc/init.d/gitlab start + +[git@localhost ~]$ /etc/init.d/gitlab start +Starting both the GitLab Unicorn and Sidekiq..............................Waited 30s for the processes to write their pids, something probably went wrong. + +apache¼ +2015/12/23 19:24:10 [error] 3980#0: *1 connect() to unix:/home/git/gitlab/tmp/sockets/gitlab.socket failed (111: Connection refused) while connecting to upstream, client: 192.168.1.251, server: your_server_fqdn, request: "GET / HTTP/1.1", upstream: "http://unix:/home/git/gitlab/tmp/sockets/gitlab.socket:/", host: "192.168.1.243" + + +Ƿ + $ sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production \ No newline at end of file diff --git "a/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/Centos6\345\256\211\350\243\205gitlab-rpm\345\256\211\350\243\205\357\274\214\346\255\245\351\252\244\347\256\200\345\215\225.txt" "b/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/Centos6\345\256\211\350\243\205gitlab-rpm\345\256\211\350\243\205\357\274\214\346\255\245\351\252\244\347\256\200\345\215\225.txt" new file mode 100644 index 00000000..1d8ad0d3 --- /dev/null +++ "b/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/Centos6\345\256\211\350\243\205gitlab-rpm\345\256\211\350\243\205\357\274\214\346\255\245\351\252\244\347\256\200\345\215\225.txt" @@ -0,0 +1,144 @@ +官方参考文档： +https://about.gitlab.com/downloads/#centos6 +gitlab包RPM官方下载： +https://packages.gitlab.com/gitlab/gitlab-ce +我选择gitlab-ce-8.2.2-ce.0.el6.x86_64.rpm，可以把下载地址放到迅雷里下载，再传到服务器上 + +系统环境：centos6.5 +IP地址：192.168.1.243 +内存：至少为1G，之前虚拟机的内存只有512M，安装的时候一直报错，日了Dog了。 + +安装成功时候把内存改为512M，提示：Whoops, GitLab is taking too much time to respond. + +[root@localhost ~]# yum install -y curl openssh-server postftix cronie wget +[root@localhost ~]# yum install -y postfix +[root@localhost ~]# service postfix restart +[root@localhost ~]# chkconfig postfix on +[root@localhost ~]# lokkit -s http -s ssh +[root@localhost ~]# wget https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.rpm.sh +[root@localhost ~]# sh script.rpm.sh + +[root@localhost ~]# rz 【上传gitlab-ce-8.2.2-ce.0.el6.x86_64.rpm】 +[root@localhost ~]# yum install -y gitlab-ce-8.2.2-ce.0.el6.x86_64.rpm +[root@localhost ~]# gitlab-ctl reconfigure + +访问： +http://192.168.1.243/ + +初始密码： +Username: root +Password: 5iveL!fe + +修改初始密码。 + +就可以使用gitlab的后台创建项目和用户。 + + + +vi /opt/gitlab/embedded/service/gitlab-rails/config/gitlab.yml + + + + + +**********************2016-3-29添加*********************************************************** + +vi /opt/gitlab/embedded/service/gitlab-rails/config/gitlab.yml +GitLab安装后修改IP/域名 +cd /opt/gitlab-7.14.3-0/apps/gitlab/htdocs/config/ +vi gitlab.yml + + gitlab: + ## Web server settings + host: git.zhts.cc + port: 80 + https: false + + +2.将gitlab节点下的host改成对应的ip/域名 + +重启服务,就可以了. + + + + 更改配置后，执行如下命令（加载配置生效）： +sudo gitlab-ctl reconfigure + +服务打开、关闭、重启： +gitlab-ctl start + +gitlab-ctl stop + +gitlab-ctl restart + + + + + +gitlab的备份与恢复 + +gitlab-ctl start + +/var/opt/gitlab/ 【gitlab所有的工程目录都在】 + +/var/opt/gitlab/git-data/repositories 【版本库文件】 + +/var/opt/gitlab/backups 【默认备份目录，修改此目录】 + + + +[root@localhost ~]# mkdir /home/git_bak +[root@localhost ~]# chown git:root -R /home/git_bak/ + + +vi /opt/gitlab/embedded/service/gitlab-rails/config/gitlab.yml + ## Backup settings + backup: + path: "/var/opt/gitlab/backups" +改为： + ## Backup settings + backup: + path: "/home/git_bak" + +有的版本/etc/gitlab/gitlab.rb + + +[root@localhost ~]# gitlab-ctl restart 【重启】 + +[root@localhost ~]# /opt/gitlab/bin/gitlab-rake gitlab:backup:create 【备份git】 + + +恢复备份方法： +[root@localhost backups]# gitlab-ctl stop unicorn +[root@localhost backups]# gitlab-ctl stop sidekiq + +[root@localhost backups]# gitlab-rake gitlab:backup:restore BACKUP=1459415571 【恢复备份】 +Unpacking backup ... + +[root@localhost backups]# gitlab-ctl start + +Gitlab迁移 + +把备份文件拷贝到gitlab的备份目录下，根据上面gitlab恢复步骤即可。 + +gitlab定时自动备份 +[root@localhost backups]# vi /etc/crontab +0 2 * * * /opt/gitlab/bin/gitlab-rake gitlab:backup:create 【每天两点执行备份】 + +0 4 * * * /bin/cp -p /home/git_bak/* /home/git_bakall/ 【将备份文件复制一个到git_bakall文件夹中】 + +[root@localhost backups]# service crond restart + +参考地址： http://www.ithao123.cn/content-10080199.html + + + + + + + + + + + + \ No newline at end of file diff --git "a/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/Centos7\345\256\211\350\243\205gitlab\357\274\214rpm\345\256\211\350\243\205.md" "b/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/Centos7\345\256\211\350\243\205gitlab\357\274\214rpm\345\256\211\350\243\205.md" new file mode 100644 index 00000000..413c5fb9 --- /dev/null +++ "b/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/Centos7\345\256\211\350\243\205gitlab\357\274\214rpm\345\256\211\350\243\205.md" @@ -0,0 +1,46 @@ +Centos7安装gitlab，rpm安装 + +## 系统介绍 +官方强烈建议至少4 gb的空闲内存GitLab运行，虚拟机只有2G，测试一下是否可以安装 +``` +IP地址：192.168.0.4 +内存：2G +系统：centos7（Linux node4 3.10.0-957.1.3.el7.x86_64 #1 SMP Thu Nov 29 14:49:43 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux） +``` +### 1.安装依赖关系 +``` +yum install -y curl policycoreutils-python openssh-server +systemctl enable sshd +systemctl start sshd + +firewall-cmd --permanent --add-service=http +systemctl reload firewalld + + +``` +### 2.安装postfix邮件通知作用,此步可跳过 + +``` +yum install postfix +systemctl enable postfix +systemctl start postfix +``` +### 3.添加GitLab包存储库和安装包 +``` +curl https://packages.gitlab.com/install/repositories/gitlab/gitlab-ee/script.rpm.sh | sudo bash + +``` +接下来,安装GitLab包。改变“http://gitlab.example.com”的URL你想访问你GitLab实例。安装将自动配置和启动GitLab URL。HTTPS需要额外的配置安装。 + +``` +EXTERNAL_URL="http://gitlab.tools.7477.me" yum install -y gitlab-ee +``` +### 通过浏览器登录gitlab +``` +在你的第一次访问,将重置root密码 +在这里设置root +密码为12345678 +``` + +官方参考网址： +https://about.gitlab.com/install/#centos-7 diff --git "a/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/GitLab\344\275\277\347\224\250\344\273\213\347\273\215.pdf" "b/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/GitLab\344\275\277\347\224\250\344\273\213\347\273\215.pdf" new file mode 100644 index 00000000..6e985e7e Binary files /dev/null and "b/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/GitLab\344\275\277\347\224\250\344\273\213\347\273\215.pdf" differ diff --git "a/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/Gitolite\347\232\204\345\256\211\350\243\205.txt" "b/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/Gitolite\347\232\204\345\256\211\350\243\205.txt" new file mode 100644 index 00000000..f93f3de8 --- /dev/null +++ "b/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/Gitolite\347\232\204\345\256\211\350\243\205.txt" @@ -0,0 +1,193 @@ +Gitoliteİװ + + һ ʺ +[root@M1 ~]# lid -g sshd # 鿴ijһûеû +ִУ +[root@M1 ~]# yum -y install perl openssh git # װ +[root@M1 ~]# groupadd git +[root@M1 ~]# useradd -g git -G sshd git +[root@M1 ~]# passwd git # Ϊgitûһ + + + װGitolite +[root@M1 ~]# su -l git +[git@M1 ~]$ mkdir bin +[git@M1 ~]$ git clone https://github.com/sitaramc/gitolite.git +[git@M1 ~]$ ls +bin gitolite + +[git@M1 ~]$ ./gitolite/install -to /home/git/bin/ +[git@M1 ~]$ cd bin/ +[git@M1 bin]$ ls +commands gitolite gitolite-shell lib syntactic-sugar triggers VERSION VREF + + + + + + +[git@M1 bin]$ logout +ƶrootûΪԱ(admin)(# ϵͳеûgitoliteеûûҪֻͬҪԿӦУʹrootԿΪadmin.pubgitoliteдadminû) +[root@M1 ~]# ssh-keygen -t rsa -f /root/.ssh/id_rsa -P '' # Կ +[root@M1 ~]# cp .ssh/id_rsa.pub /tmp/admin.pub + +лgitûΪgitoliteùԱ +[root@M1 ~]# su -l git +[git@M1 ~]$ /home/git/bin/gitolite setup -pk /tmp/admin.pub gitoliteûɹԿȷͻеûgitoliteеûͨԿӦϣϵͳtest1 ʹ test2 ˽Կ滻Լ˽ԿڷΪtest2û +Initialized empty Git repository in /home/git/repositories/gitolite-admin.git/ +Initialized empty Git repository in /home/git/repositories/testing.git/ +WARNING: /home/git/.ssh missing; creating a new one + (this is normal on a brand new install) +WARNING: /home/git/.ssh/authorized_keys missing; creating a new one + (this is normal on a brand new install) +[git@M1 ~]$ ls +bin gitolite projects.list repositories + +ģ Աճ(ʱrootûͨgitûԶִֻض) +1Աclone +[root@M1 ~]# git clone git@192.168.1.106:gitolite-admin +[root@M1 gitolite-admin]# ls +conf keydir +2) ûȨ +[root@M1 gitolite-admin]# useradd -g git test123 # һtest123ͨû +test123ͨûһԿ +[root@M1 gitolite-admin]# su -l test123 +[test123@M1 ~]$ ssh-keygen -t rsa -f /home/test123/.ssh/id_rsa -P '' +лrootû +[test123@M1 ~]$ logout +test123ĹԿƵָĿ¼ +[root@M1 gitolite-admin]# cp /home/test123/.ssh/id_rsa.pub /root/gitolite-admin/keydir/test123.pub +[root@M1 gitolite-admin]# cp /home/test123/.ssh/id_rsa.pub /tmp/test123.pub +[root@M1 gitolite-admin]# su -l git + +test123֤ +[git@M1 ~]$ /home/git/bin/gitolite setup -pk /tmp/test123.pub +[git@M1 ~]$ logout + +[root@M1 gitolite-admin]# cd conf/ +[root@M1 conf]# vi /root/gitolite-admin/conf/gitolite.conf +repo gitolite-admin + RW+ = admin + +repo testing + RW+ = @all +@myGroup=admin test123 # ָûЩԱ +repo myFirstRepo # ƶضĿȨ޷ + RW+ = @myGroup +[root@M1 conf]# cd ../ +[root@M1 gitolite-admin]# git status +[root@M1 gitolite-admin]# git add * +[root@M1 gitolite-admin]# git commit -m "AddRepo:myFirstRepo;AddUser:test123" +[root@M1 gitolite-admin]# git push origin +master + +壩ͻ֤ +[root@M1 gitolite-admin]# su -l test123 +[test123@M1 ~]$ git clone git@192.168.1.106:myFirstRepo +Initialized empty Git repository in /home/test123/myFirstRepo/.git/ +warning: You appear to have cloned an empty repository. +[test123@M1 ~]$ ls +myFirstRepo + +һļύ +[test123@M1 myFirstRepo]$ touch test.txt +[test123@M1 myFirstRepo]$ git status -s +?? test.txt +[test123@M1 myFirstRepo]$ git add test.sh +fatal: pathspec 'test.sh' did not match any files +[test123@M1 myFirstRepo]$ git add test.txt +[test123@M1 myFirstRepo]$ git status -s +A test.txt +[test123@M1 myFirstRepo]$ git commit -m 'add test.txt' +[master (root-commit) ad5d619] add test.txt + Committer: test123 +Your name and email address were configured automatically based +on your username and hostname. Please check that they are accurate. +You can suppress this message by setting them explicitly: + + git config --global user.name "Your Name" + git config --global user.email you@example.com + +If the identity used for this commit is wrong, you can fix it with: + + git commit --amend --author='Your Name <'">you@example.com>' + + 0 files changed, 0 insertions(+), 0 deletions(-) + create mode 100644 test.txt +[test123@M1 myFirstRepo]$ git status -s +[test123@M1 myFirstRepo]$ git push origin master +Counting objects: 3, done. +Writing objects: 100% (3/3), 206 bytes, done. +Total 3 (delta 0), reused 0 (delta 0) +To git@192.168.1.106:myFirstRepo + * [new branch] master -> master + + ʹrootûȡ + [root@M1 myFirstRepo]# git pull +remote: Counting objects: 3, done. +remote: Total 3 (delta 0), reused 0 (delta 0) +Unpacking objects: 100% (3/3), done. +From 192.168.1.106:myFirstRepo + * [new branch] master -> origin/master +[root@M1 myFirstRepo]# ls # Կtest.txt ļ˵ɹ +test.txt + +SSH22˿ͨ + ػgitoliteʹ÷sshĬ϶˿ڣִ󣬿ͨз + + $ vim ~/.ssh/config + + + + host ${ip_of_gitolite_server} + port ${post_of_yours} + + + + + + + +ͻָԿgit + + + + ͻ˿ͨ~/.ssh/config ļָûضķضĶ˿ʹضļ +ñʾgithub.com www.github.com ʹ~/.ssh/code_github˽Կbitbucket.org www.bitbucket.orgʹ~/.ssh/code_bitbucket +Host github.com www.github.com + IdentityFile ~/.ssh/code_github +Host bitbucket.org www.bitbucket.org + IdentityFile ~/.ssh/code_bitbucket +ûƥϻû~/.ssh/configļĬ¿ͻʹ~/.ssh/id_rsa Կ + +test123ʹgitû汾ʹgitû¼gitshellԿֿ +һ ͻ +ڿͻԿһ׿ͨgitû¼ʹshellһʹshellֻʹgitصĹ +1 ʹshellԿĴ +[root@M2 ~]# groupadd git +[root@M2 ~]# useradd -g git test123 +[root@M2 ~]# su -l test123 +[test123@M2 ~]$ ssh-keygen -t rsa -f /home/test123/.ssh/id_rsa -P '' # ȴshell¼Կ +[test123@M2 ~]$ ssh-copy-id -i /home/test123/.ssh/id_rsa.pub git@gitserver +[test123@M2 ~]$ ssh git@192.168.31.2 # ֿͻûͨtest123ĬϵԿgitû¼gitservershell +[git@M1 ~]$ ls +bin gitolite projects.list repositories + +2 git汾ĵԿĴ +[test123@M2 ~]$ ssh-keygen -t rsa -f /home/test123/.ssh/test123 -P '' +[test123@M2 ~]$ scp ./.ssh/test123.pub git@192.168.31.2:/home/git/ +֤ +[git@M1 ~]$ /home/git/bin/gitolite setup -pk /home/git/test123.pub +[git@M1 ~]$ rm -f /home/git/test123.pub + +3 ͻ˸(ڿͻ˵hostsļ192.168.31.2 M1 gitserver M1 gitserver ָΪ192.168.31.2) +Host gitserver +User git +Hostname gitserver +Port 22 +IdentityFile ~/.ssh/test123 +ʹ +[test123@M2 ~]$ git clone git@gitserver:myFirstRepo ʹõľ ~/.ssh/test123Կ +ʹ +[test123@M2 myFirstRepo]$ ssh git@M1 ssh git@192.168.31.2 ʹĬϵĹԿ~/.ssh/id_rsaʹ ssh git@gitserver ʹõ ~/.ssh/test123ԿͻǸHost Port жʹĸԿļ + \ No newline at end of file diff --git "a/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/\346\233\264\346\224\271gitlab\344\273\223\345\272\223\345\255\230\345\202\250\344\275\215\347\275\256.md" "b/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/\346\233\264\346\224\271gitlab\344\273\223\345\272\223\345\255\230\345\202\250\344\275\215\347\275\256.md" new file mode 100644 index 00000000..a1382b2a --- /dev/null +++ "b/star/centos_install_git_svn/gitlab-Gitolite\346\220\255\345\273\272/\346\233\264\346\224\271gitlab\344\273\223\345\272\223\345\255\230\345\202\250\344\275\215\347\275\256.md" @@ -0,0 +1,39 @@ +更改仓库存储位置 +默认时GitLab的仓库存储位置在“/var/opt/gitlab/git-data/repositories”，在实际生产环境中显然我们不会存储在这个位置，一般都会划分一个独立的分区来存储仓库的数据，我这里规划把数据存放在“/data/git-data”目录下。 + +``` +# mkdir -pv /data/git-data +``` +更改参数 +``` +# vi /etc/gitlab/gitlab.rb +#启用git_data_dirs参数，并修改如下： + +git_data_dirs 路径 "/data/git-data" + +git_data_dirs({ + "default" => { + "path" => "/data/git-data", + "failure_count_threshold" => 10, + "failure_wait_time" => 30, + "failure_reset_time" => 1800, + "failure_timeout" => 30 + } + }) +``` + +重新编译 +``` +gitlab-ctl reconfigure #重新编译gitlab.rb文件，使用做的修改生效 +gitlab-ctl restart + +``` + + + +--------------------- +作者：lifeneedyou +来源：CSDN +原文：https://blog.csdn.net/lifeneedyou/article/details/84923122 +版权声明：本文为博主原创文章，转载请附上博文链接！ + diff --git "a/star/centos_install_git_svn/git\345\220\216\345\217\260\346\223\215\344\275\234-\346\267\273\345\212\240\347\224\250\346\210\267\346\223\215\344\275\234\347\255\211.doc" "b/star/centos_install_git_svn/git\345\220\216\345\217\260\346\223\215\344\275\234-\346\267\273\345\212\240\347\224\250\346\210\267\346\223\215\344\275\234\347\255\211.doc" new file mode 100644 index 00000000..fb119002 Binary files /dev/null and "b/star/centos_install_git_svn/git\345\220\216\345\217\260\346\223\215\344\275\234-\346\267\273\345\212\240\347\224\250\346\210\267\346\223\215\344\275\234\347\255\211.doc" differ diff --git "a/star/centos_install_git_svn/linux\346\220\255\345\273\272Git\346\234\215\345\212\241\345\231\250.txt" "b/star/centos_install_git_svn/linux\346\220\255\345\273\272Git\346\234\215\345\212\241\345\231\250.txt" new file mode 100644 index 00000000..eb644450 --- /dev/null +++ "b/star/centos_install_git_svn/linux\346\220\255\345\273\272Git\346\234\215\345\212\241\345\231\250.txt" @@ -0,0 +1,102 @@ +系统版本：centos6.x +测试IP:192.168.1.247 +ssh端口不是22，比如是2221下如何搭建git。 + +第1步：安装git并且创建git用户 +# yum install git +# useradd git +# passwd git [使用git密码拉取项目，如果不设置密码则使用密钥] + +第2步：创建证书登录(此步骤没有操作)： +收集所有需要登录的用户的公钥，就是他们自己的id_rsa.pub文件，把所有公钥导入到/home/git/.ssh/authorized_keys文件里，一行一个。 + + +第3步：创建git仓库。 +先选定一个目录作为Git仓库，假定是/home/gitxm/sample.git，在/home/gitxm目录下输入命令： + +# mkdir -p /home/gitxm/ +# cd /home/gitxm/ +# git init --bare /home/gitxm/sample.git +Initialized empty Git repository in /home/gitxm/sample.git/ + +# chown git.git -R /home/gitxm/ + +出于安全考虑，第二步创建的git用户不允许登录shell，找到类似下面的一行： + +#vi /etc/passwd +#git:x:1001:1001:,,,:/home/git:/bin/bash +改为： +git:x:1001:1001:,,,:/home/git:/usr/bin/git-shell + +现在，可以通过git clone命令克隆远程仓库了，在各自的电脑上运行： + + +使用windows中的git软件 +git@192.168.1.247:/home/gitxm/sample.git + +如果服务器的ssh端口改为其他，比如2221 +使用git或者root用户拉取： +ssh://git@192.168.1.247:2221/home/gitxm/sample.git +ssh://root@192.168.1.247:2221/home/gitxm/sample.git + +ssh://root@115.28.168.69:60920/data/gitxm/funet8_com.git + + + +使用git config --list查看已设配置 + +Git常用命令 + +git log 【历史记录】 +[root@localhost sample.git]# git log +commit 7240642edefcf0e433168caf0058386363d92892 +Author: test +Date: Thu Sep 22 17:37:43 2016 +0800 + + 2222ssss + +commit ba466f211fde7f9830d7f986c6302ad1d8051daf +Author: test +Date: Thu Sep 22 17:36:58 2016 +0800 + + 2222aaaa +。。。。 + +[root@localhost sample.git]# git log --pretty=oneline +7240642edefcf0e433168caf0058386363d92892 2222ssss +ba466f211fde7f9830d7f986c6302ad1d8051daf 2222aaaa +16c1c7a63328c3d8e3dad262d7f45314f9dd46c2 11111 +dbd9ae353f096408cb4b1cf0dd25d0c281ac2f2b 4444 +1f3fcdee1af7db98e892750d1eb01ba513cacdf2 333333 +67d22504268559ac8387169d77ae06647304d578 11111 +7d515ff1a632b9df00cb603b1ba281e35e434293 ssssffff11111 +f6b761b1e27b55a37a69a4db1de173aea22aad2d test11111 + + +git reset --hard 7240642edefcf0e433168caf0058386363d92892 + +遇到问题： +[root@localhost sample.git]# git status +fatal: This operation must be run in a work tree + +解决： +http://tanglei528.blog.163.com/blog/static/43353399201302355758482 +由于git init –bare 方法创建一个裸仓库，在该仓库无法进行任何git操作，所以抛出错误. + +解决方法：在该仓库目录下，新建文件夹，进入该文件夹，执行如下命令： +1. touch Readme +2. git init +3. git add Readme +4. git commit -m 'initial commit' Readme + + + +Git 官网学习地址: +http://blog.csdn.net/love_android_2011/article/details/12102967 + +Git常用命令： +http://www.cnblogs.com/cspku/articles/Git_cmds.html + + + + diff --git "a/star/centos_install_git_svn/svn\345\270\270\347\224\250\346\223\215\344\275\234.txt" "b/star/centos_install_git_svn/svn\345\270\270\347\224\250\346\223\215\344\275\234.txt" new file mode 100644 index 00000000..6144d4de --- /dev/null +++ "b/star/centos_install_git_svn/svn\345\270\270\347\224\250\346\223\215\344\275\234.txt" @@ -0,0 +1,146 @@ +svnò + +svnѾõ±д + + +1 µIJֿ + +svnadmin create /data/wwwroot/svn/yumao_test (ԭsvnIJֿ·/data/wwwroot/svn/) ԭ· + + + + +2 òֿ + +[root@quwenjiemi ~]# vi /data/conf/svn/authz.conf + +########1ûרsvnѧϰָǰûijԱ + +# ѧϰsvn + +yumao_test = yumao,liangchengzong + +# ѧϰsvn + +yumaotest = yumaotest + +########2 赱ǰûӦȨ + +[yumao_test:/] + +@yumao_test = rw + +@yumaotest = rw + +* = + +3 ½û ֮ǰѾ½yumao,liangchengzong ֻ½yumaotest + +[root@quwenjiemi ~]# cd /data/conf/svn/ + +[root@quwenjiemi svn]# htpasswd passwd.conf yumaotest + + + + +4 ļȨ + +֮ǰʹrootyumao_testһֿ ʹwindowsͻύʱ֣ + +svn Can't open file '/data/wwwroot/svn/yumao_test/db/txn-current-lock': Permission denied + +һ + +ʹyumao_test ĿļûΪsvn ͬ www + +[root@quwenjiemi svn] cd /data/wwwroot/svn + +[root@quwenjiemi svn] chown -R www:www yumao_test + + + + +5 ͻȡύĿв + +ͨsvn Checkout д·http://zhts.cc:8081/svn/yumao_test Ŀ ʹõyumaoһû + +Ŀ´ aa bb Ŀ¼ύ svn commit + + + + +6 yumaotest ûжaaĿ¼дȨ,ûж bbĿ¼дȨ + + + +[yumao_test:/] + +@yumao_test = rw + +@yumaotest = rw + +* = + +[yumao_test:/bb] # עbb治Ҫ/ + +@yumao_test = rw + +@yumaotest = + +* = + +yumaotestһûbbһĿ¼ûȨ + + + + +7 svn + +ҼTortoiseSVN -> Settings -> Saved Data-> Authentication Data 㡰Clear·ÿʱ򣬾ͻʾûˡ + + Խʲͬĵַû/벻ͬ⡣ + + + +8 svn ȱ + +[root@quwenjiemi svn]# svnadmin hotcopy /data/wwwroot/svn/yumao_test /data/wwwroot/svn/yumao_test2 ʵֶ԰汾yumao_test ݸƵyumao_test2 ļ + + + + +9 svn ݻָ + +[root@quwenjiemi svn]# svnadmin create /data/wwwroot/svn/yumao_test3 yumao_test3 + +[root@quwenjiemi svn]# /bin/cp -a /data/wwwroot/svn/yumao_test2/* /data/wwwroot/svn/yumao_test3/ ֱyumao_test2 еݸǾУ + + + + +10 svn ֧ϲ + +汾еϢ + +Ǵļ cc/1.html 15:37 + +(о) + + + + +11 svn ݻع + + (1) 汾ع branchtest1 (ڰ汾Ϊ huigun2) + + Ҽ - show log -> ѡbranchtest1 -Ҽ -> ѡrevert to this revision + + ָոһ汾ʹ Ҽ - show log -> huigun2 -Ҽ -> ѡrevert to this revision + + (2) һļݻع + + ԵѡijһļִͬIJ + +12 svn ȡǰ޸ + + ѡӦļ Ҽ - revert \ No newline at end of file diff --git "a/star/centos_install_memcached/Memcache\347\237\245\350\257\206\347\202\271\346\242\263\347\220\206.doc" "b/star/centos_install_memcached/Memcache\347\237\245\350\257\206\347\202\271\346\242\263\347\220\206.doc" new file mode 100644 index 00000000..b640e262 Binary files /dev/null and "b/star/centos_install_memcached/Memcache\347\237\245\350\257\206\347\202\271\346\242\263\347\220\206.doc" differ diff --git a/star/centos_install_memcached/libevent-1.4.13-stable.tar.gz b/star/centos_install_memcached/libevent-1.4.13-stable.tar.gz new file mode 100644 index 00000000..d52dc83f Binary files /dev/null and b/star/centos_install_memcached/libevent-1.4.13-stable.tar.gz differ diff --git a/star/centos_install_memcached/memcache-2.2.4.tgz b/star/centos_install_memcached/memcache-2.2.4.tgz new file mode 100644 index 00000000..fc5204eb Binary files /dev/null and b/star/centos_install_memcached/memcache-2.2.4.tgz differ diff --git a/star/centos_install_memcached/memcache-3.0.8.tgz b/star/centos_install_memcached/memcache-3.0.8.tgz new file mode 100644 index 00000000..d19742ad Binary files /dev/null and b/star/centos_install_memcached/memcache-3.0.8.tgz differ diff --git a/star/centos_install_memcached/memcached-1.4.17.tar.gz b/star/centos_install_memcached/memcached-1.4.17.tar.gz new file mode 100644 index 00000000..9d0f45af Binary files /dev/null and b/star/centos_install_memcached/memcached-1.4.17.tar.gz differ diff --git a/star/centos_install_memcached/memcachetest.php b/star/centos_install_memcached/memcachetest.php new file mode 100644 index 00000000..bad120b0 --- /dev/null +++ b/star/centos_install_memcached/memcachetest.php @@ -0,0 +1,9 @@ +connect('172.0.0.1',11211); +$mem->set('test','Hello world!',0,12); +$val = $mem->get('test'); +echo $val; +var_dump($val); \ No newline at end of file diff --git a/star/centos_install_memcached/phpinfo.php b/star/centos_install_memcached/phpinfo.php new file mode 100644 index 00000000..84f4b4b5 --- /dev/null +++ b/star/centos_install_memcached/phpinfo.php @@ -0,0 +1,2 @@ +connect('127.0.0.1',12321); +$mem->set('test','Hello world!',0,12); +$val = $mem->get('test'); +echo $val; +var_dump($val); + +``` + +ҳHello world!string(12) "Hello world!" ˵ʱphpѾ֧memcacheģ + +## +``` +vi /etc/rc.d/rc.local + # memcache + /usr/local/bin/memcached -d -m 200 -u www -p 12321 -c 256 -P /tmp/memcached.pid +``` + + +## ر memcached +``` +ps aux|grep memcached kill `cat /tmp/memcached.pid` +/usr/local/bin/memcached -d -m 200 -u www -p 12321 -c 500 -P /tmp/memcached.pid +``` + +# ڰ汾 + +## װphp-memcacheչ +``` +[root@localhost]# tar -zxvf memcache-2.2.4.tgz +[root@localhost]# cd memcache-2.2.4 +[root@localhost]# phpize # ûҵphpize Уyum -y install php-devel + +[root@localhost]#./configure --with-php-config=/usr/bin/php-config --enable-memcache +``` + + +error: memcache support requires ZLIB. Use --with-zlib-dir= to specify prefix where ZLIB include and library are located +ҪִУ +``` +yum -y install zlib-devel +``` + +``` + # ./configure --with-php-config=/usr/bin/php-config --enable-memcache +make +make test +``` + + +## 鿴ǷչĿ¼ҵ memcache.so +``` +ls /usr/lib64/php/modules/ # ҲֱӸһȥ +cp modules/memcache.so /usr/lib64/php/modules/ ߣcp /data/software/memcache-2.2.4/modules/memcache.so /usr/lib64/php/modules/ + +[root@localhost memcache-2.2.4]# make +[root@localhost memcache-2.2.4]# make test +``` + diff --git a/star/centos_install_postfix/Centos_sendmail.md b/star/centos_install_postfix/Centos_sendmail.md new file mode 100644 index 00000000..2364734a --- /dev/null +++ b/star/centos_install_postfix/Centos_sendmail.md @@ -0,0 +1,41 @@ +# Centos6.5 使用mail配合smtp发送邮件 + +安装 +``` +# yum -y install mailx +# yum -y install sendmail +# /etc/init.d/sendmail start +# chkconfig sendmail on +``` + + + +去163邮箱打开SMPT服务，并且获取授权密码 + +``` +# vi /etc/mail.rc +在底部添加： +set from="xxx@163.com" +set smtp=smtp.163.com +set smtp-auth-user=xxx@163.com +set smtp-auth-password=自己填写的授权码 +set smtp-auth=login +``` + + + + +测试发送： +``` +echo -e "你好！n我来看看你n哈哈" | mail -s "测试邮件" xxx@163.com + +echo -e "你好！n我来看看你n哈哈" | mail -s "测试邮件" funet8@163.com + +mail -s "`date +%F-%T`" funet8@163.com dovecot-new.conf +Aug 14 17:55:55 config: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:81: login_user has been replaced by service { user } +Aug 14 17:55:55 config: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:88: add auth_ prefix to all settings inside auth {} and remove the auth {} section completely + +这时我们需要在 /etc/dovecot/目录下面执行 ： + +``` +cd /etc/dovecot/ +doveconf -n > dovecot-new.conf +``` +该命令会把 dovecot.conf 转化为标准格式的配置文件 。 我们用新生成的文件 dovecot-new.conf 替换掉 dovecont.conf 即可。 + +在配置的过程中， 还有一些细节需要注意 ： + +那就是设置 默认的 MTA， 卸载掉 sendmail ， 把MTA设置为 postfix， 设置开机自动启动 postfix 和 dovecot。 + +然后用 useradd 命令添加一个用户 zhang ， 密码设置为 123456 + +启动服务： +``` +service postfix restart +service dovecot restart +service saslauthd restart +``` +下来配置 outlook， 填写 电子邮件地址为 ： zhang@funet8.com + +账号类型选择 POP3， 接收邮件服务器为 funet8.com， 发送邮件服务器也为 funet8.com + +然后用户名为 zhang， 密码为 123456 + +不出意外的话， 应该可以正常收发邮件了。 + +新邮件会保存在服务器的 /home/zhang/Maildir/new 这个目录里。 + +我这个配置比较简单， 是用的服务器本身的密码验证机制。 postfix 很强大， 可以支持多种认证方式和其他的加密方式。 + +本来想用 postfixadmin 进行web管理的， 但是那个配置起来就要更复杂一些了， 通过web的方式添加用户后， 需要在 home 目录创建对应的用户名的文件夹来保存邮件， 有相关的脚本需要执行，另外认证模式得修改为mysql认证， 配置 稍微复杂， 等下一篇文章在写 postfixadmin 相关的东西吧。 + +**Postfix 日志 connect from unknown错误** + +配置postfix， 提示如下错误： + +postfix/smtpd[29233]: connect from unknown[58.38.183.244] + +解决办法： + +关键是postfix配置文件main.cf 里的mynetworks， 修改为如下所有网段都通过就可以了。 + +mynetworks = 0.0.0.0/0 + + + diff --git "a/star/centos_install_postfix/centos\345\217\221\351\200\201\351\202\256\344\273\266.txt" "b/star/centos_install_postfix/centos\345\217\221\351\200\201\351\202\256\344\273\266.txt" new file mode 100644 index 00000000..42c34c9b --- /dev/null +++ "b/star/centos_install_postfix/centos\345\217\221\351\200\201\351\202\256\344\273\266.txt" @@ -0,0 +1,48 @@ +# yum install mailx -y +# rpm -qa|grep mail + +# yum -y install sendmail +# /etc/init.d/sendmail username3t +# chkconfig sendmail on + +1.标题为"test"内容为空的邮件，容易被邮箱服务判为垃圾邮件。 +mail -s "test" username2@163.com + + +2.以文件为内容作为邮件正文： +echo "222222222" > /root/mail1 +mail -s test username2@163.com < /root/mail1 +mail -s test2 username1@163.com,username3@163.com < /root/mail1 + +3.使用管道进行邮件发送 +echo "hello,username3...." | mail -s "hello" username3@163.com + +4.发送附件 +在linux下使用mail命令发送附件也很简单，不过首先需要安装uuencode软件包，这个程序是对二进制文件进行编码使其适合通过邮件进行发送，直接使用centos的yum源可能找不到uuencode命令的包sharutils，我这里使用了网易Yum源。 + +# yum -y install sharutils + +# uuencode /root/mail1 | mail -s "fujian" star@7477.com < /etc/passwd +【测试会卡住不动，可以收到邮件，但是附件文件被狗吃了？】 + + +5、使用外部smtp(qq的SMTP)来发送邮件 + +# vi /etc/mail.rc #文末添加以下 +set from=username1@163.com smtp=smtp.163.com +set smtp-auth-user=username1@163.com smtp-auth-password=password smtp-auth=login + +# source /etc/mail.rc 【本人测试，不需要这步即可】 +# mail -s "51cto" username3@163.com < /etc/passwd + + +from：发送的邮件地址，对方显示的发件人 +smtp：发生的外部smtp服务器的地址 +smtp-auth-user：外部smtp服务器认证的用户名 +smtp-auth-password：外部smtp服务器认证的用户密码 +smtp-auth：邮件认证的方式 + + + +http://www.centoscn.com/CentOS/help/2015/1121/6438.html + diff --git a/star/centos_install_swoole/centos_install_swoole.md b/star/centos_install_swoole/centos_install_swoole.md new file mode 100644 index 00000000..261f164c --- /dev/null +++ b/star/centos_install_swoole/centos_install_swoole.md @@ -0,0 +1,64 @@ +# centos6安装swoole + +选择版本 2.0以上的需要php7 + +服务器上使用的是php5.6 所以只能安装php1.10.3 +[swoole-1.10.3](https://github.com/swoole/swoole-src/archive/v1.10.3.tar.gz) + +两种安装方式 + +1：比较简单 +``` +pecl install swoole # 需要安装pecl工具，我虚拟机上没有安装成功 +``` + + + 2：编译安装 +``` +yum install php-devel php-pear +``` + +swoole下载地址：https://github.com/swoole/swoole-src/releases + +``` +ll /usr/lib64/php/modules/ |wc -l +cd /data/software/ + +wget https://github.com/swoole/swoole-src/archive/swoole-1.7.6-stable.tar.gz +tar -zxvf swoole-1.7.6-stable.tar.gz +cd swoole-src-swoole-1.7.6-stable +phpize +./configure +make && make install +``` +如果出现：Build complete.就表示安装成功 + +下来修改php.ini添加swoole扩展 +extension_dir = "/usr/lib64/php/modules/"这个centos里边如果是yum安装的php，扩展默认就在这个目录，可以不配置 + 添加extension=swoole.so +``` +ll /usr/lib64/php/modules/swoole.so + +vi /data/conf/php.ini +添加： +extension=swoole.so + +httpd -t +service httpd reload +``` + +编辑phpinfo文件上传： +访问： http://域名/phpinfo.php +搜索 swoole +``` +php -m |grep swoole +``` + +重启php-fpm: /etc/init.d/php-fpm restart + +在phpinfo里能到swoole就表示成功了，下边就开始愉快地使用swoole吧 + + + +https://blog.csdn.net/xueshao110/article/details/80286840 + diff --git a/star/centos_install_swoole/swoole-src-1.10.3.tar.gz b/star/centos_install_swoole/swoole-src-1.10.3.tar.gz new file mode 100644 index 00000000..89a9a22e Binary files /dev/null and b/star/centos_install_swoole/swoole-src-1.10.3.tar.gz differ diff --git a/star/centos_install_swoole/swoole-src-2.2.0.tar.gz b/star/centos_install_swoole/swoole-src-2.2.0.tar.gz new file mode 100644 index 00000000..3070ba65 Binary files /dev/null and b/star/centos_install_swoole/swoole-src-2.2.0.tar.gz differ diff --git a/star/centos_install_swoole/swoole-src-swoole-1.7.6-stable.tar.gz b/star/centos_install_swoole/swoole-src-swoole-1.7.6-stable.tar.gz new file mode 100644 index 00000000..b0eec8e2 Binary files /dev/null and b/star/centos_install_swoole/swoole-src-swoole-1.7.6-stable.tar.gz differ diff --git a/star/centos_samba/centos_samba.sh b/star/centos_samba/centos_samba.sh new file mode 100644 index 00000000..e102e65d --- /dev/null +++ b/star/centos_samba/centos_samba.sh @@ -0,0 +1,80 @@ +#!/bin/bash +############################################################ +#名字： centos_samba.sh +#功能： centos6或者7安装samba文件共享 +#作者： star +#邮件： star@funet8.com +#时间： 2019/05/24 +#Version 1.0 +#20190524修改记录： +#脚本初始化 +########################################################### + +#共享路径和密码 +Path="/data/smb" +#共享密码 +SmbUser="smb" +SmbPassward="7477" + +yum install -y samba samba-client + +function SYSTEM6(){ + chkconfig smb on + chkconfig nmb on + /etc/init.d/smb start +} +function SYSTEM7(){ + systemctl enable smb.service + systemctl enable nmb.service + systemctl start smb +} +#新建smb用户用于访问Linux共享文件 +useradd $SmbUser +#smbpasswd -a $SmbUser +echo "$SmbPassward" | passwd $SmbUser --stdin > /dev/null 2>&1 + +mkdir -p $Path +chown $SmbUser.$SmbUser -R /data/smb + +cp /etc/samba/smb.conf /etc/samba/smb.conf_bak +echo "[global] + workgroup = MYGROUP + server string = Samba Server Version %v + log file = /var/log/samba/log.%m + # max 50KB per log file, then rotate + max log size = 50 + security = user + passdb backend = tdbsam +[smb share] +comment = jishubu Directories +path = $Path +public = no +writeable = yes +browseable = yes +valid users = $SmbUser +">/etc/samba/smb.conf + +#防火墙 +iptables -A INPUT -p tcp --dport 139 -j ACCEPT +iptables -A INPUT -p tcp --dport 445 -j ACCEPT +iptables -A INPUT -p tcp --dport 137 -j ACCEPT +iptables -A INPUT -p tcp --dport 138 -j ACCEPT + +service iptables save +systemctl restart iptables.service +service iptables restart + +###################################################################### +#检查centos版本，并且执行相关函数 +version6=`more /etc/redhat-release |awk '{print substr($3,1,1)}'` +if [ $version6 = 6 ];then + echo "System is CentOS 6 !" + SYSTEM6 + service smb restart +fi +version7=`more /etc/redhat-release |awk '{print substr($4,1,1)}'` +if [ $version7 = 7 ];then + echo "System is CentOS 7 !" + SYSTEM7 + systemctl restart smb +fi \ No newline at end of file diff --git a/star/centos_samba/readme.md b/star/centos_samba/readme.md new file mode 100644 index 00000000..a7070c64 --- /dev/null +++ b/star/centos_samba/readme.md @@ -0,0 +1,192 @@ +# centos安装SAMBA与windows共享文件夹 + +Linux与Linux间通过什么共享文件呢——NFS，Windows与Windows之间呢——共享文件功能，那Windows与Linux之间通过samba。 + +``` +samba：只能在内网使用，类似于windows的网络邻居（文件共享服务） +``` + +samba两个守护进程： +smbd 【监听139端口，TCP端口】 负责用户验证和文件共享 +nmbd 【监听137和138端口 UDP端口】 负责处理浏览共享和计算机名称解析 + +## 检查是否安装samba + +``` +rpm -qa|grep samba +``` +否则，使用yum安装 +``` +# yum install samba +``` + +## 配置samba + +``` +# chkconfig smb on +# chkconfig nmb on +/etc/init.d/smb start +``` +Centos7 +``` +systemctl enable smb.service +systemctl enable nmb.service +systemctl start smb +``` + + +## 新建smb用户用于访问Linux共享文件 + +``` +# useradd smb # 新建用户 +# smbpasswd -a smb # 修改密码 + +#smbpasswd -x smb # 删除smb用户 + +``` +此时/home目录会增加一个smb的用户。该Linux用户目录将可直接共享到Windows下。若要共享其它文件，按步骤3配置文件。如果不用了，删除smb用户也是可以的， + +samba配置文件【/etc/samba/smb.conf】。 + +``` +[tmp] +comment = Tmp Directories +path = /tmp # 共享的Linux目录 +public = no # 目录不公开 +writeable = yes # 可写 +browseable = yes # 可读 +valid users = smb # 访问用户，上面新建的，也可以使用原来已有的 + +复制去掉注释 + +分配权限 +chown smb.smb -R /data2T/smb +或者： +chmod 777 -R /data2T/smb +``` + +## 让smaba通过防火墙 + +``` +编辑 /etc/sysconfig/iptables 文件 + +-A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT +-A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT +-A INPUT -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT +-A INPUT -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT + +``` +重启防火墙 +``` +# /etc/rc.d/init.d/iptables restart + +``` + +在Windows下使用Win+R开启运行窗口，输入 + +``` +\\192.168.1.6 +``` +此时使用 +``` +# smbstatus + +``` + + +CentOS 6下yum 安装Samba文件服务器 +https://www.linuxidc.com/Linux/2017-04/143046.htm + +centos与windows共享文件夹 +https://blog.csdn.net/wangzhen209/article/details/48174317 + + + +centos7 + +``` +yum -y install samba samba-client +``` + +启动samba +``` +systemctl start smb +systemctl status smb +``` +设置开机自启动 +``` +# systemctl enable smb +Created symlink from /etc/systemd/system/multi-user.target.wants/smb.service to /usr/lib/systemd/system/smb.service. +``` +## 新建smb用户用于访问Linux共享文件 + +``` +# useradd smb # 新建用户 +# smbpasswd -a smb # 修改密码 + +#smbpasswd -x smb # 删除smb用户 + +``` +创建需要共享的目录 +``` +mkdir -p /data/smb +chown smb.smb -R /data/smb +``` +samba配置文件【/etc/samba/smb.conf】。 + +``` +# cp /etc/samba/smb.conf /etc/samba/smb.conf_bak +[tmp] +comment = Tmp Directories +path = /tmp # 共享的Linux目录 +public = no # 目录不公开 +writeable = yes # 可写 +browseable = yes # 可读 +valid users = smb # 访问用户，上面新建的，也可以使用原来已有的 + +复制去掉注释 + +vi /etc/samba/smb.conf +复制以下内容： +[global] + workgroup = MYGROUP + server string = Samba Server Version %v + log file = /var/log/samba/log.%m + # max 50KB per log file, then rotate + max log size = 50 + security = user + passdb backend = tdbsam + +#============================ Share Definitions ============================== +[beijing] +comment = Tmp Directories +path = /data/smb +public = no +writeable = yes +browseable = yes +valid users = smb + +``` +重启服务 +``` +systemctl restart smb +``` +## 让smaba通过防火墙 + +``` +vi /etc/sysconfig/iptables + +-A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT +-A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT +-A INPUT -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT +-A INPUT -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT + +``` +重启防火墙服务 +``` +systemctl restart iptables +``` + + +### 阿里云服务器ECS的samba配置方法 +https://blog.csdn.net/XHG1993/article/details/78872724 diff --git "a/star/inotify_rsync/CentOS\345\256\211\350\243\205inotify\344\270\216rsync\346\226\207\344\273\266\345\220\214\346\255\245.doc" "b/star/inotify_rsync/CentOS\345\256\211\350\243\205inotify\344\270\216rsync\346\226\207\344\273\266\345\220\214\346\255\245.doc" new file mode 100644 index 00000000..e8ca2164 Binary files /dev/null and "b/star/inotify_rsync/CentOS\345\256\211\350\243\205inotify\344\270\216rsync\346\226\207\344\273\266\345\220\214\346\255\245.doc" differ diff --git a/star/inotify_rsync/inotify-tools-3.14.tar.gz b/star/inotify_rsync/inotify-tools-3.14.tar.gz new file mode 100644 index 00000000..2b0c30ff Binary files /dev/null and b/star/inotify_rsync/inotify-tools-3.14.tar.gz differ diff --git "a/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/test.sh" "b/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/test.sh" new file mode 100644 index 00000000..2e8ac7bb --- /dev/null +++ "b/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/test.sh" @@ -0,0 +1,23 @@ +#!/bin/sh +SRC=/data/wwwroot/web/test_tongbu/ #代码发布服务器目录 +DST=/data/wwwroot/web/test_tongbu/ #目标服务器目录 +IP="192.168.1.244" #目标服务器IP，多个以空格隔开 +#IP="192.168.20.7 192.168.20.3" #目标服务器IP，多个以空格隔开 +USER=www +INOTIFY_EXCLUDE="--fromfile /data/conf/shell/inotify_rsync/test_inotify_exclude.list" +RSYNC_EXCLUDE="--include-from=/data/conf/shell/inotify_rsync/test_rsync_include.list --exclude-from=/data/conf/shell/inotify_rsync/test_rsync_exclude.list" + +#test_inotify_exclude.list 【监控和忽略监控】 +#test_rsync_include.list 【同步文件夹列表】 +#test_rsync_exclude.list 【不同步文件夹列表】 + +#su - $USER +inotifywait -mrq --exclude "(.swp|.inc|.svn|.rar|.tar.gz|.gz|.txt|.zip|.bak)" -e delete,create,close_write,attrib $INOTIFY_EXCLUDE | while read D E F + do + for i in $IP + do + /usr/bin/rsync -e 'ssh -p 22' -ahqzt $RSYNC_EXCLUDE --delete $SRC $USER@$i:$DST + # echo "/usr/bin/rsync -e 'ssh -p 60920' -ahqzt $RSYNC_EXCLUDE --delete $SRC $USER@$i:$DST"; + # echo "Done---\n"; + done + done diff --git "a/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/test_inotify_exclude.list" "b/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/test_inotify_exclude.list" new file mode 100644 index 00000000..c41210ee --- /dev/null +++ "b/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/test_inotify_exclude.list" @@ -0,0 +1,6 @@ +/data/wwwroot/web/test_tongbu/a_dir +/data/wwwroot/web/test_tongbu/b_dir + + +@/data/wwwroot/web/test_tongbu/1_dir + diff --git "a/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/test_rsync_exclude.list" "b/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/test_rsync_exclude.list" new file mode 100644 index 00000000..401591a4 --- /dev/null +++ "b/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/test_rsync_exclude.list" @@ -0,0 +1,5 @@ +# 忽略所有 +/* + +a_dir/notongbu/ +b_dir/bu.txt diff --git "a/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/test_rsync_include.list" "b/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/test_rsync_include.list" new file mode 100644 index 00000000..697e1bb6 --- /dev/null +++ "b/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/test_rsync_include.list" @@ -0,0 +1,6 @@ +# 同步文件夹 +a_dir +b_dir + + + diff --git "a/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/\350\257\264\346\230\216.txt" "b/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/\350\257\264\346\230\216.txt" new file mode 100644 index 00000000..3a65d452 --- /dev/null +++ "b/star/inotify_rsync/rsync\345\222\214inotify\346\237\220\345\237\237\345\220\215\345\220\214\346\255\245\350\204\232\346\234\254\344\270\276\344\276\213/\350\257\264\346\230\216.txt" @@ -0,0 +1,13 @@ +7477.sh 为要运行网站实时同步脚本 +其中定义了要同步的网站的路径，要同步到的ip地址，哪些后缀名的文件忽略监控，同步的用户名，同步的文件列表，哪些文件不需要同步。 + +只需要把7477.sh这个文件上传到服务器上并且更改所有者为www，然后加上x的权限，运行即可 +cd /data/conf/shell/inotify_rsync/ +chown www:www 7477.sh 7477_inotify_exclude.list 7477_rsync_include.list 7477_inotify_exclude.list +chmod u+x 7477.sh +su -l www +cd /data/conf/shell/inotify_rsync/ +nohup ./7477.sh & + + +7477_inotify_exclude 中@是忽略不需要同步的文件夹。 diff --git a/star/iptables_snat/readme.md b/star/iptables_snat/readme.md new file mode 100644 index 00000000..7ed244cd --- /dev/null +++ b/star/iptables_snat/readme.md @@ -0,0 +1,69 @@ +### linux服务器局域网通过一台iptables计算机桥接上网 +最近上了两天mysql服务器，没有分配公网ip，也不需要公网IP，但是里面有些服务需要公网才能实现。这是需求：其实功能使用iptables来实现SNAT转发，可以让无公网IP的服务器与公网通信 + +服务器A，双网卡 +IP:192.168.20.178 +IP2:XX.XX.XX.XXX +服务器B，单网卡 +IP:192.168.20.200 +要实现B通过A上公网 + +#### 在A上操作 + +**1.开启其转发功能** + +``` +# vi /etc/sysctl.conf +开启转发 +net.ipv4.ip_forward=1 +# echo 1 > /proc/sys/net/ipv4/ip_forward +#sysctl -p（使之立即生效） +``` + +**2.对iptables进行规制的设置** + +``` +iptables -F #清除掉之前所有的iptables规则（生产环境谨慎使用） +iptables -P INPUT ACCEPT #允许接收数据包 +iptables -P FORWARD ACCEPT #允许发送数据包 +``` +``` +iptables -t nat -A POSTROUTING -s 192.168.20.0/24 -o em1 -j MASQUERADE #在有外部IP的网口上做NAT +service iptables save +service iptables restart +service iptables status +``` + +**3.重启网络** + +``` +/etc/init.d/network restart +``` + +#### 在服务器B上操作 + +``` +# vi /etc/sysconfig/network-scripts/ifcfg-em2 +修改： +GATEWAY=192.168.20.178 +DNS1=114.114.114.114 +重启网络： +# service network restart +``` + +再ping www.baidu.com 看能否ping通 + +### 走过的坑： + +1.在执行第二步“对iptables进行规制的设置”设置的时候，由于原服务器有iptables的规则，不能直接iptables -F +就在/etc/sysconfig/iptables 跟本地对照记录。 +删除了“-A FORWARD -j REJECT --reject-with icmp-host-prohibited ”这条记录，而找到原因的时候是在本地搭建好了， +先在本地的虚拟机实现了该功能，同样的iptables记录可以 + +2.B服务器还要配置一个DNS + + + +参考： +https://blog.csdn.net/hbhswxy2007/article/details/48462959 +https://blog.csdn.net/hiccupzhu/article/details/51073557 \ No newline at end of file diff --git "a/star/linux\350\277\220\347\273\264\351\234\200\350\246\201\346\216\214\346\217\241\344\273\200\344\271\210\347\237\245\350\257\206.md" "b/star/linux\350\277\220\347\273\264\351\234\200\350\246\201\346\216\214\346\217\241\344\273\200\344\271\210\347\237\245\350\257\206.md" new file mode 100644 index 00000000..36440179 --- /dev/null +++ "b/star/linux\350\277\220\347\273\264\351\234\200\350\246\201\346\216\214\346\217\241\344\273\200\344\271\210\347\237\245\350\257\206.md" @@ -0,0 +1,90 @@ +# linux运维需要掌握什么知识？ + +大致有六个阶段： + +## 第一阶段：Linux运维基本功 + +大致的知识点有这些： +- [x] 计算机基础 +- [x] Linux操作系统 +- [x] 网络基础 +- [x] VIM编辑器 +- [x] 系统用户与权限 +- [ ] Linux文件系统与内核 +- [x] 系统服务与进程 +- [x] MySQL数据库 +- [x] LAMP环境配置 +- [x] 开源项目实战（YUM） + +## 第二阶段：Linux运维进阶 +大致的知识点有这些： + +- [x] bind高级应用(DNS服务器） +- [x] ftp服务 +- [x] nfs服务 +- [x] samba服务 +- [x] postfix服务 +- [ ] dovecot服务（邮件服务器） +- [x] shell基础、 +- [x] ssh服务以及无密码登录 +- [x] linux系统安全（防火墙）以及日志 +- [x] linux下安装包的管理 +- [x] 压缩工具讲解、 +- [x] rsync文件同步服务、 +- [ ] 终极项目：pxe网络安装系统实战 + +## 第三阶段：Linux运维高级 +大致的知识点有这些： + +- [x] PHP及JAVA环境部署调优 +- [x] APACHE/NGINX/TOMCAT配置详解与调优 +- [x] KeepAlived+LVS高可用负载均衡服务器 +- [x] Nginx+HAProxy实现负载均衡服务器、 +- [x] Varnish/squid反向代理（介绍CDN知识与应用）、 +- [x] 分布式存储集群（FastDFS）、 +- [ ] Tomcat LB Cluster集群(加强）、 +- [ ] ZooKeeper分布式 +- [x] Zabbix监控 +- [x] ELK日志分析搭建、 +- [x] Git版本控制软件(SVN赠送） +- [x] 初级运维自动化 Saltstack Puppet（基础） +- [ ] 大型项目架构与性能调优（Nagios、Cacti、ONEAPM） +- [x] 终极项目：阿里云产品实战（ECS、RDS、LSB、安全） + +## 第四阶段：DBA阶段 + +大致的知识点有这些： + +- [x] MySQL基础操作 +- [x] MySQL高级查询 +- [x] MySQL权限管理 +- [x] MySQL备份 +- [x] 还原与数据恢复 +- [x] MySQL数据库管理工具介绍与实战 +- [x] MySQL高级（索引与优化） +- [x] MySQL主从复制与读写分离 +- [x] 数据库中间件MyCAT，Altas，Amoeba实践与对比 +- [x] Memcache技术Redis技术+集群 +- [ ] MongoDB技术+集群 +- [ ] 终极项目：超大型数据库案例实战 + +## 第五阶段：Shell编程阶段 + +大致的知识点： + +- [x] Shell编程进阶 +- [x] Shell核心应用（集成到进阶） +- [x] 正则表达式、文件操作实战（grep、sed、awk） +- [x] Shell实战（Zabbix扩展-Shell监控） + +## 第六阶段：Linux云计算阶段 + +大致的知识点： + +- [x] 虚拟化技术(kvm vmware) +- [x] SaltStack进阶 +- [x] Openstack自动化运维 +- [x] Docker实战Jenkins+MavenHadoop +- [x] 云计算 +- [x] DevOps +- [x] 项目实战：Openstack + Docker运维实战 diff --git "a/star/mysql_master_slave/CentOS\345\256\211\350\243\205MYSQL\345\271\266\344\270\224\350\256\276\347\275\256\344\270\273\344\273\216.doc" "b/star/mysql_master_slave/CentOS\345\256\211\350\243\205MYSQL\345\271\266\344\270\224\350\256\276\347\275\256\344\270\273\344\273\216.doc" new file mode 100644 index 00000000..1e324be3 Binary files /dev/null and "b/star/mysql_master_slave/CentOS\345\256\211\350\243\205MYSQL\345\271\266\344\270\224\350\256\276\347\275\256\344\270\273\344\273\216.doc" differ diff --git a/star/nagios/readme.md b/star/nagios/readme.md new file mode 100644 index 00000000..77d1550e --- /dev/null +++ b/star/nagios/readme.md @@ -0,0 +1,4 @@ +# 监控_linux下安装nagios监控服务器 + + + diff --git "a/star/nagios/\347\254\2541\346\255\245.nagios\347\232\204\345\256\211\350\243\205.txt" "b/star/nagios/\347\254\2541\346\255\245.nagios\347\232\204\345\256\211\350\243\205.txt" new file mode 100644 index 00000000..a30c7a2b --- /dev/null +++ "b/star/nagios/\347\254\2541\346\255\245.nagios\347\232\204\345\256\211\350\243\205.txt" @@ -0,0 +1,120 @@ +linux°װnagiosط-1.nagiosİװ +ķƪ +1.nagiosİװ +2.nagiosüرlocalhost +3.nagiosüԶ +4.nagiosʼԤ + + +1,ռϢԼȽм⡣ +2,ͼα֡ +3,ʼ(ţ΢ŵ) +4,ӿ + +Դļʹsnmp(simple network manage protocol)Э + +mrtg +ntop +cacti http://www.cacti.net/ + +õļnagioszabbixGangliacentreonfalconС׵ļأ + +ر360أƼص + + +һnagiosװ +ٷַ www.nagios.org + + +--ٵ· +http://nagios.sourceforge.net/docs/nagioscore/4/en/toc.html +--߰װȫ󣬻Ŀ¼ҵ +# ls /usr/local/nagios/share/docs/ + +شеķ͸صȣܡ + +صַ +https://yunpan.cn/cMdT4B4xLQHLc + b13e + +nagios-4.0.5.tar.gz # +nagios-plugins-2.0.3.tar.gz # +nrpe-2.12.tar.gz #linuxͻ˽зԶ̼ذ + +--עȺİ汾ŲһҪһ + + + +1rpmlamp(ԴlampҲԣnginxУΪnagioswebļ﷨apache﷨) +# yum install httpd* gd php* + +2,û + +# useradd nagios +# groupadd nagiosgroup +# usermod -G nagiosgroup nagios +# usermod -G nagiosgroup apache --Ҳ˵webĸûܣͰĸûҲӵ + + + +3װnagios +# tar xf nagios-4.0.5.tar.gz -C /usr/src/ +# cd /usr/src/nagios-4.0.5/ + +# ./configure --with-nagios-user=nagios --with-nagios-group=nagiosgroup + +# make all + +# make all && make install && make install-init && make install-commandmode && make install-config && make install-webconf && make install-exfoliation && make install-classicui + +# make install --װCGIűwebҳļ +# make install-init --װű/etc/init.d/nagios +# make install-commandmode --޸һЩӦĿ¼Ȩ +# make install-config --װ/usr/local/nagios/etcĿ¼ļģ棩 +# make install-webconf --װ/etc/httpd/conf.d/nagios.confļ +# make install-exfoliation --װexfoliation⣨ҲwebƤʽḲ +# make install-classicui --װclassicui⣬Ḳ + + +# ls /usr/local/nagios/ +bin etc libexec sbin share var + +#libexecĿ¼ΪգҪװŻкܶű + + +4,װnagios --ռݵijű +# tar xf /root/nagios-plugins-2.0.3.tar.gz -C /usr/src/ +# cd /usr/src/nagios-plugins-2.0.3/ + +# ./configure --with-nagios-user=nagios --with-nagios-group=nagiosgroup + +# make && make install + + + +5webɷʵ֤û +/etc/httpd/conf.d/nagios.conf ##ļѾnagiosapache֤Ҫû + +# htpasswd -c /usr/local/nagios/etc/htpasswd.users nagiosadmin ##עһ£ûһҪnagiosadminԶûͨapache֤Dz鿴nagiosʱûȨ޲鿴 +New password: +Re-type new password: +Adding password for user nagiosadmin + + +# /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg +##nagiosļȷ + + + +/etc/init.d/nagios restart +/etc/init.d/httpd restart + +##selinuxرգͼοϢ + +#ӷǽ򣬻߹رշǽ +/sbin/iptables -I INPUT -p tcp --dport 80 -j ACCEPT +/etc/rc.d/init.d/iptables save +/etc/init.d/iptables restart + +ʹ: +·http://IP/nagios \ No newline at end of file diff --git "a/star/nagios/\347\254\2542\346\255\245.nagios\351\205\215\347\275\256\347\233\221\346\216\247\346\234\254\345\234\260localhost.txt" "b/star/nagios/\347\254\2542\346\255\245.nagios\351\205\215\347\275\256\347\233\221\346\216\247\346\234\254\345\234\260localhost.txt" new file mode 100644 index 00000000..db582a50 --- /dev/null +++ "b/star/nagios/\347\254\2542\346\255\245.nagios\351\205\215\347\275\256\347\233\221\346\216\247\346\234\254\345\234\260localhost.txt" @@ -0,0 +1,259 @@ +linux°װnagiosط-2.nagiosüرlocalhost + +ķƪ +1.nagiosİװ +2.nagiosüرlocalhost +3.nagiosüԶ +4.nagiosʼԤ + +FTPmysql +ط 192.168.1.8 + +nagiosװ֮nagiosļ + +/usr/local/nagios/etc/nagios.cfg #ļ + +/usr/local/nagios/etc/objects/ #ļĿ¼ +/usr/local/nagios/etc/objects/localhost.cfg #һʾģ棬Ĭ϶˼ر8 +/usr/local/nagios/etc/objects/templates.cfg #ģ涨ļ +/usr/local/nagios/etc/objects/commands.cfg #ļ +/usr/local/nagios/etc/objects/contacts.cfg #֪ͨʽļ +/usr/local/nagios/etc/objects/timeperiods.cfg #ʱζļ + +================================================== + + +nagiosļ֮ϵʾ + +# vim /usr/local/nagios/etc/nagios.cfg +cfg_file=/usr/local/nagios/etc/objects/localhost.cfg + + +# vim /usr/local/nagios/etc/objects/localhost.cfg + +define host{ + use linux-server #ģ + host_name localhost # + alias localhost # + address 127.0.0.1 #ػIP + } + + +define hostgroup{ + hostgroup_name linux-servers + alias Linux Servers + members localhost #linux ServersֻlocalhostһԱ + } + + +8Ĭ϶ķԼشʵһΪ +define service{ + use local-service #ģ棬templates.cfg ﶨ + host_name localhost #õͬļdefine hostﶨhost_name + service_description Root Partition #webʾһ + check_command check_local_disk!20%!10%!/ #ʵfreeռС20%ͱС10critcal + } + + + + +# vim /usr/local/nagios/etc/objects/templates.cfg + + +define host{ + name linux-server + use generic-host #linuxģҲʹһgeneric-hostģ棬Ҳtemplates.cfg + check_period 24x7 #timeperiods.cfg ﶨʱ + check_interval 5 + retry_interval 1 + max_check_attempts 10 + check_command check-host-alive #commands.cfg ﶨ + notification_period workhours #֪ͨʱtimeperiods.cfgﶨ + notification_interval 120 #֪ͨ + notification_options d,u,r #֪ͨѡ + contact_groups admins #֪ͨ飬contacts.cfg ﶨ + register 0 #עᣬʾֻһģ棬ãᱻnagiosΪһ̨ + } + + + +# vim /usr/local/nagios/etc/objects/commands.cfg +define command{ + command_name check-host-alive + command_line $USER1$/check_ping -H $HOSTADDRESS$ -w 3000.0,80% -c 5000.0,100% -p 5 + } + +libexec£--helpȥ +# /usr/local/nagios/libexec/check_ping --help +# /usr/local/nagios/libexec/check_ping -H 127.0.0.1 -w 3000.0,80% -c 5000.0,100% -p 5 +PING OK - Packet loss = 0%, RTA = 0.09 ms|rta=0.088000ms;3000.000000;5000.000000;0.000000 pl=0%;80;100;0 + + +================================================== + + +ڲ鿴web棬Ĭֻlocalhost,8 + +һЩС +1httpΪɫǾ棬ҪվĿ¼һҳȥĿ¼Ϊգͻᾯ棩 +ҪһcheckŻOKҪֶcheckԵhttpұߵRe-schedule the next check of this serviceȥǿcheckOK + +2Ĭhttpsshǹر֪ͨģΪlocalhost.cfgһ notifications_enabled 0 +Ҳֶ򿪣ȥұߵenabled notifications for this service. + + +3رsshˢweb棬ûcritical. + sshԿһμƻcheckʱ䡣ȵĻұߵRe-schedule the next check of this serviceǿcheck,ˢ¾critical + + + +4,޸sshcheckʱ +# vim /usr/local/nagios/etc/objects/localhost.cfg +define service{ + use local-service #ʹõģ棬Ҫȥģʱ + host_name localhost + service_description SSH + check_command check_ssh + notifications_enabled 0 + } + +# vim /usr/local/nagios/etc/objects/templates.cfg + define service{ + name local-service + ............. + normal_check_interval 1 #ӸΪ1 + ............. + } + +# /etc/init.d/nagios reload + +ȥweb֤checkʱΪ1 + + +======================================================== + + +1Ĭ8ĻϣӼرķ ftp + +˼·裺 +1libexec/ǷмftpûУأԼ +2localhost.cfgﶨ +3command.cfgﶨ + +װFTP +yum -y install vsftpd +# /etc/init.d/vsftpd restart + +# vim /usr/local/nagios/etc/objects/localhost.cfg #һ + +define service{ + use local-service + host_name localhost + service_description FTP + check_command check_ftp!1!3 + } + + +# vim /usr/local/nagios/etc/objects/commands.cfg #һĬϾУҪӣֱӸһ + +define command{ + command_name check_ftp + command_line $USER1$/check_ftp -H $HOSTADDRESS$ -w $ARG1$ -c $ARG2$ + } + +# /etc/init.d/nagios restart + + +ϰ +1ftpΪ2121˿ڣӦμ + +# vim /etc/vsftpd/vsftpd.conf +listen_port=2121 #һ + +# /etc/init.d/vsftpd restart + +# netstat -ntlup |grep ftp + + +# vim /usr/local/nagios/etc/objects/localhost.cfg + +һ +define service{ + use local-service + host_name localhost + service_description FTP #ijFTP + check_command check_ftp_2121!1!3!2121 +#ûеģcommand.cfgĬһcheck_ftpû +#check_ftp_2121Ҫֶȥӣ!Ϊָ1ǵһ3ǵڶ2121ǵǶӦ涨-w -c -p + } + +# vim /usr/local/nagios/etc/objects/commands.cfg + +define command{ + command_name check_ftp_2121 + command_line $USER1$/check_ftp -H $HOSTADDRESS$ -w $ARG1$ -c $ARG2$ -p $ARG3$ + } + + +ֱʹüȥֹcheckһ£OK + +$USER1$/check_ftp -H $HOSTADDRESS$ -w $ARG1$ -c $ARG2$ -p $ARG3$ +# /usr/local/nagios/libexec/check_ftp -H 192.168.1.2 -w 1 -c 3 -p 2121 +FTP OK - 0.006 second response time on 192.168.1.2 port 62920 [220 Welcome to 3mu FTP service ^_^]|time=0.005893s;1.000000;3.000000;0.000000;10.000000 + +# /usr/local/nagios/libexec/check_ftp -w 1 -c 3 -p 2121 +FTP OK - 0.004 second response time on port 2121 [220-############################# +220-#]|time=0.00389s;1.000000;3.000000;0.000000;10.000000 + + +# /etc/init.d/nagios reload +reloadȥwebԿܼرftp + + +2رmysql +װmysql +yum install mysql* +mysqladmin -u root password "123" + +# vim /usr/local/nagios/etc/objects/localhost.cfg + +define service{ + use local-service + host_name localhost + service_description MYSQL + check_command check_mysql!root!123 + } + + +# vim /usr/local/nagios/etc/objects/commands.cfg +define command{ + command_name check_mysql + command_line $USER1$/check_mysql -H $HOSTADDRESS$ -u $ARG1$ -p $ARG2$ #һӦrootڶӦ123 + } + +ûļ/usr/local/nagios/libexec/check_mysql +취http://www.linuxidc.com/Linux/2011-09/44190.htm + +ٴΰװnagios +cd /usr/src/nagios-plugins-2.0.3/ +./configure --with-nagios-user=nagios --with-nagios-group=nagiosgroup +make && make install +ll /usr/local/nagios/libexec/check_mysql* + + +ֶcheckһmysqlOK +# /usr/local/nagios/libexec/check_mysql -u root -p123 +Uptime: 189 Threads: 1 Questions: 5 Slow queries: 0 Opens: 12 Flush tables: 1 Open tables: 6 Queries per second avg: 0.026 + +# /usr/local/nagios/libexec/check_mysql -u root -p123 +Uptime: 415096 Threads: 1 Questions: 9 Slow queries: 0 Opens: 15 Flush tables: 1 Open tables: 8 Queries per second avg: 0.0|Connections=7c;;; Open_files=16;;; Open_tables=8;;; Qcache_free_memory=0;;; Qcache_hits=0c;;; Qcache_inserts=0c;;; Qcache_lowmem_prunes=0c;;; Qcache_not_cached=0c;;; Qcache_queries_in_cache=0;;; Queries=9c;;; Questions=9c;;; Table_locks_waited=0c;;; Threads_connected=1;;; Threads_running=1;;; Uptime=415096c;;; + + +# /etc/init.d/nagios reload + + + + + + + diff --git "a/star/nagios/\347\254\2543\346\255\245.nagios\351\205\215\347\275\256\347\233\221\346\216\247\350\277\234\347\250\213.txt" "b/star/nagios/\347\254\2543\346\255\245.nagios\351\205\215\347\275\256\347\233\221\346\216\247\350\277\234\347\250\213.txt" new file mode 100644 index 00000000..eb5fe24f --- /dev/null +++ "b/star/nagios/\347\254\2543\346\255\245.nagios\351\205\215\347\275\256\347\233\221\346\216\247\350\277\234\347\250\213.txt" @@ -0,0 +1,270 @@ +linux°װnagiosط-3.nagiosüԶ̷ +ķƪ +1.nagiosİװ +2.nagiosüرlocalhost +3.nagiosüԶ +4.nagiosʼԤ + +ط 192.168.1.8 [¼M8] +Զ̼ػ 192.168.1.2 [¼M2] + +صķΪ˽ + +ssh,http,ftp,mysqlȡرػԶ̵Ĺ񣬶ֱ +˽Уload,users,disk usageȡر˽зֱþͺãԶ˽зҪͱض˰װnrpe + + +Զ̷ͨ񣨹񣩡ssh,http,ftpmysql + +磺ҵıضIPΪ192.168.1.2 + + +1.nagiosM8ļ192.168.1.2ļ + +# vim /usr/local/nagios/etc/nagios.cfg +cfg_file=/usr/local/nagios/etc/objects/192.168.1.2.cfg #Ӵ + + +2192.168.1.2.cfg +# cd /usr/local/nagios/etc/objects/ +# cp -a localhost.cfg 192.168.1.2.cfg + +# vim /usr/local/nagios/etc/objects/192.168.1.2.cfg +define host{ + use linux-server + host_name 192.168.1.2 #/etc/hostsӦIPûֱдIP + alias 192.168.1.2 #ʾwebϵ + address 192.168.1.2 #ʵʱIP + } +define hostgroup{ + hostgroup_name remote_linux-servers #Ҷһ飬ܺlocalhost.cfgͬͻ + alias remote_Linux-Servers + members 192.168.1.2 + } +#ǹֻдĸ +define service{ + use local-service + host_name 192.168.1.2 + service_description PING + check_command check_ping!100.0,20%!500.0,60% + } + +define service{ + use local-service + host_name 192.168.1.2 + service_description SSH + check_command check_ssh + } + +define service{ + use local-service + host_name 192.168.1.2 + service_description HTTP + check_command check_http + } + + +define service{ + use local-service + host_name 192.168.1.2 + service_description FTP + check_command check_ftp!1!3 + } + + + + +֤ļ +# /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg +# /etc/init.d/nagios reload + +================================================================== + +Զ̵˽з +һ:snmpЭ +:nrpe + + + 192.168.1.8 192.168.1.2 + nagiosض linux + check_disk + check_nrpe check_nrpe check_swap + SSLSSL check_load + + + +1nagiosϰװnrpe + +# tar xf nrpe-2.12.tar.gz -C /usr/src/ +# cd /usr/src/nrpe-2.12/ +# ./configure && make && make install + +--װ󣬾 +/usr/local/nagios/libexec/check_nrpe + + + +2check_nrpecommands.confļ +# vim /usr/local/nagios/etc/objects/commands.cfg + +define command{ + command_name check_nrpe + command_line $USER1$/check_nrpe -H $HOSTADDRESS$ -c $ARG1$ --ccommand Ҳ˵check_nrpeԵñcheck + } + + + +3nagios϶192.168.1.2ļԶ˽з + +# vim /usr/local/nagios/etc/objects/192.168.1.2.cfg + +define service{ + use local-service + host_name 192.168.1.2 + service_description Root Partition + check_command check_nrpe!check_remote_root +--check_remote_rootcheck_nrpeCҪõnagiosϵcommands.cfgDzڣںIJмӵض + } + + +define service{ + use local-service + host_name 192.168.1.2 + service_description Current Users + check_command check_nrpe!check_remote_users + } + + +define service{ + use local-service + host_name 192.168.1.2 + service_description Total Processes + check_command check_nrpe!check_remote_total_procs + } + + +define service{ + use local-service + host_name 192.168.1.2 + service_description Current Load + check_command check_nrpe!check_remote_load + } + + +define service{ + use local-service + host_name 192.168.1.2 + service_description Swap Usage + check_command check_nrpe!check_remote_swap + } + + + +# /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg +--һļȷԣOKĻöϣȲreload nagios񣬵ȱضreload + + + +============================================================== + + +ڱض192.168.1.2ϰװ + +1½û +# useradd nagios +# groupadd nagiosgroup +# usermod -G nagiosgroup nagios + + + +2װpluginsݲɼű +# tar xf nagios-plugins-2.0.3.tar.gz -C /usr/src/ +# cd /usr/src/nagios-plugins-2.0.3/ +# ./configure --with-nagios-user=nagios --with-nagios-group=nagiosgroup +# make && make install + + + +3װnrpe +# tar xf nrpe-2.12.tar.gz -C /usr/src/ +# cd /usr/src/nrpe-2.12/ +# ./configure && make && make install + +# make install-plugin --װ޸/usr/local/nagios/libexec/check_nrpeȨ,owner,group +# make install-daemon --װ޸/usr/local/nagios/bin/nrpeȨ,owner,group +# make install-daemon-config --װ޸/usr/local/nagios/etc/nrpe.cfgȨ,owner,group +# make install-xinetd --װ޸/etc/xinetd.d/nrpeȨ,owner,group + + + + +4,޸nrpeijػ̵ļ + +# vim /etc/xinetd.d/nrpe + +service nrpe +{ + flags = REUSE + socket_type = stream + port = 5666 + wait = no + user = nagios + group = nagios + server = /usr/local/nagios/bin/nrpe + server_args = -c /usr/local/nagios/etc/nrpe.cfg --inetd + log_on_failure += USERID + disable = no + only_from = 127.0.0.1 192.168.1.8 --nagiosIP +} + + +# vim /etc/services --һ +nrpe 5666/tcp # NRPE + + + +5nrpeļﶨcheckʹnagiosܵ + +# vim /usr/local/nagios/etc/nrpe.cfg + +allowed_hosts=127.0.0.1 192.168.1.8 + +command[check_remote_users]=/usr/local/nagios/libexec/check_users -w 5 -c 10 +command[check_remote_load]=/usr/local/nagios/libexec/check_load -w 15,10,5 -c 30,25,20 +command[check_remote_root]=/usr/local/nagios/libexec/check_disk -w 20% -c 10% -p /dev/sda2 --/dev/sda2DZض˵ĸҲֱӾдһ / Ϳ +command[check_remote_total_procs]=/usr/local/nagios/libexec/check_procs -w 150 -c 200 +command[check_remote_swap]=/usr/local/nagios/libexec/check_swap -w 40%% -c 20%% --ĬûеģnagiosãԼ +command[check_zombie_procs]=/usr/local/nagios/libexec/check_procs -w 5 -c 10 -s Z --ĬеģnagiosDZûмӣû + +# yum install xinetd -y + +# /etc/init.d/xinetd restart --ػ + +# netstat -ntlup |grep 5666 --ж˿ڱ +tcp 0 0 0.0.0.0:5666 0.0.0.0:* LISTEN 22120/xinetd + +÷ǽ +/sbin/iptables -I INPUT -p tcp --dport 5666 -j ACCEPT +/etc/rc.d/init.d/iptables save +/etc/init.d/iptables restart + + + +6ڱػnagios +--ڱض˲Գɹ +# /usr/local/nagios/libexec/check_users -w 5 -c 10 +USERS OK - 3 users currently logged in |users=3;5;10;0 + + +--nagiosϲԳɹ +# /usr/local/nagios/libexec/check_nrpe -H 192.168.1.2 -c check_remote_users +USERS OK - 3 users currently logged in |users=3;5;10;0 + +/usr/local/nagios/libexec/check_nrpe -H 192.168.1.2 -p 60920 -c check_remote_users +⣺CHECK_NRPE: Error - Could not complete SSL handshake. +pkill nrpe + + + +7صnagios +# /etc/init.d/nagios restart diff --git "a/star/nagios/\347\254\2544\346\255\245.nagios\351\205\215\347\275\256\351\202\256\344\273\266\346\234\215\345\212\241\345\231\250\350\256\276\347\275\256\351\242\204\350\255\246\345\222\214\345\205\266\344\273\226\350\241\245\345\205\205\351\227\256\351\242\230.txt" "b/star/nagios/\347\254\2544\346\255\245.nagios\351\205\215\347\275\256\351\202\256\344\273\266\346\234\215\345\212\241\345\231\250\350\256\276\347\275\256\351\242\204\350\255\246\345\222\214\345\205\266\344\273\226\350\241\245\345\205\205\351\227\256\351\242\230.txt" new file mode 100644 index 00000000..3fbe829b --- /dev/null +++ "b/star/nagios/\347\254\2544\346\255\245.nagios\351\205\215\347\275\256\351\202\256\344\273\266\346\234\215\345\212\241\345\231\250\350\256\276\347\275\256\351\242\204\350\255\246\345\222\214\345\205\266\344\273\226\350\241\245\345\205\205\351\227\256\351\242\230.txt" @@ -0,0 +1,273 @@ +4.nagiosʼԤ +ķƪ +1.nagiosİװ +2.nagiosüرlocalhost +3.nagiosüԶ +4.nagiosʼԤ + + +ʼ֤: + +1,ȷһΪcrital״̬ + +2,yum install postfix -y + service postfix restart + chkconfig postfix on + +3,֤nagiosϹȷmail + + +4,# vim /usr/local/nagios/etc/objects/contacts.cfg + + + + email litengllll@126.com --ijһ + +5,/etc/init.d/nagios restart + + + +ֻ֪ͨʹ139(ʼͶ֪ͨĹ) + +ֻͷˣֱӱʼⲿһ䣬ȻֻضӦappok +nagiosٷֱӶֻͻ˹ + + + +======================================================================= + + +nagiosgraph nagiosܹͼμط̬״̬Ϣ + + + +nagiosgraph-1.4.4.tar.gz + +tar xf nagiosgraph-1.4.4.tar.gz -C /usr/src +cd /usr/src/nagiosgraph-1.4.4 + + + +[root@li nagiosgraph-1.4.4]# ./install.pl --check-prereq +checking required PERL modules + Carp...1.11 + CGI...3.51 + Data::Dumper...2.124 + File::Basename...2.77 + File::Find...1.14 + MIME::Base64...3.08 + POSIX...1.17 + RRDs... ***FAIL*** --ûrrd,rhel6yum install *rrd* Ҳfail + Time::HiRes...1.9721 +checking optional PERL modules + GD...fail --ûgd,yum install *gd* Ҳܸ㶨 +checking nagios installation + found nagios at /usr/local/nagios/bin/nagios +checking web server installation + found apache at /usr/sbin/httpd + + + +װgd + +tar xf libgd-2.1.0.tar.gz -C /usr/src/ +cd /usr/src/libgd-2.1.0/ +./configure ;make ;make install +echo /usr/local/lib >> /etc/ld.so.conf +ldconfig + + + +tar xf GD-2.56.tar.gz -C /usr/src/ +cd /usr/src/GD-2.56/ +perl Build.PL +./Build +./Build install +ldconfig + + +Can't locate ExtUtils/MakeMaker.pm in @INC (@INC contains: /usr/local/lib64/perl 5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_pe rl /usr/lib64/perl5 /usr/share/perl5 .) at Makefile.PL line 3. +BEGIN failed--compilation aborted at Makefile.PL line 3. +FCGIʱ򱨴.google,ҵ,ֻаװ + +yum install perl-ExtUtils-CBuilder perl-ExtUtils-MakeMakerͿ +http://www.ttlsa.com/perl/solution-cant-locate-extutilsmakemaker-pm-in-inc/ + + + + +װrrdtool +# tar xf rrdtool-1.4.8.tar.gz -C /usr/src/ + +# cd /usr/src/rrdtool-1.4.8/ +# ./configure ;make ;make install + +# echo /opt/rrdtool-1.4.8/lib > /etc/ld.so.conf.d/rrdtools.conf + +# ldconfig + +# cd /usr/src/rrdtool-1.4.8/bindings/perl-shared +# make clean +# perl Makefile.PL && make && make install + + + + + +# cd /usr/src/nagiosgraph-1.4.4/ + +--ٴͶOK +[root@li nagiosgraph-1.4.4]# ./install.pl --check-prereq +checking required PERL modules + Carp...1.11 + CGI...3.51 + Data::Dumper...2.124 + File::Basename...2.77 + File::Find...1.14 + MIME::Base64...3.08 + POSIX...1.17 + RRDs...1.4008 + Time::HiRes...1.9721 +checking optional PERL modules + GD...2.56 +checking nagios installation + found nagios at /usr/local/nagios/bin/nagios +checking web server installation + found apache at /usr/sbin/httpd + +------------ + + +οĵ +http://www.linuxfunda.com/2013/04/02/steps-to-configure-nagiosgraph-with-nagios-core/ + + + +ʼװ +1, +[root@qianyun nagiosgraph-1.4.4]# ./install.pl --install +checking required PERL modules + Carp...1.11 + CGI...3.51 + Data::Dumper...2.124 + File::Basename...2.77 + File::Find...1.14 + MIME::Base64...3.08 + POSIX...1.17 + RRDs...1.4008 + Time::HiRes...1.9721 +checking optional PERL modules + GD...2.53 +checking nagios installation + found nagios at /usr/local/nagios/bin/nagios +checking web server installation + found apache at /usr/sbin/httpd +Destination directory (prefix)? [/usr/local/nagiosgraph] +Location of configuration files (etc-dir)? [/usr/local/nagiosgraph/etc] +Location of executables? [/usr/local/nagiosgraph/bin] +Location of CGI scripts? [/usr/local/nagiosgraph/cgi] +Location of documentation (doc-dir)? [/usr/local/nagiosgraph/doc] +Location of examples? [/usr/local/nagiosgraph/examples] +Location of CSS and JavaScript files? [/usr/local/nagiosgraph/share] +Location of utilities? [/usr/local/nagiosgraph/util] +Location of state files (var-dir)? [/usr/local/nagiosgraph/var] +Location of RRD files? [/usr/local/nagiosgraph/var/rrd] +Location of log files (log-dir)? [/usr/local/nagiosgraph/var] +Path of log file? [/usr/local/nagiosgraph/var/nagiosgraph.log] +Path of CGI log file? [/usr/local/nagiosgraph/var/nagiosgraph-cgi.log] +URL of CGI scripts? [/nagiosgraph/cgi-bin] +URL of CSS file? [/nagiosgraph/nagiosgraph.css] +URL of JavaScript file? [/nagiosgraph/nagiosgraph.js] +Path of Nagios performance data file? [/tmp/perfdata.log] +URL of Nagios CGI scripts? [/nagios/cgi-bin] +username or userid of Nagios user? [nagios] +username or userid of web server user? [apache] +Modify the Nagios configuration? [n] +Modify the Apache configuration? [n] +configuration: + ng_layout standalone + ng_prefix /usr/local/nagiosgraph + ng_etc_dir /usr/local/nagiosgraph/etc + ng_bin_dir /usr/local/nagiosgraph/bin + ng_cgi_dir /usr/local/nagiosgraph/cgi + ng_doc_dir /usr/local/nagiosgraph/doc + ng_examples_dir /usr/local/nagiosgraph/examples + ng_www_dir /usr/local/nagiosgraph/share + ng_util_dir /usr/local/nagiosgraph/util + ng_var_dir /usr/local/nagiosgraph/var + ng_rrd_dir /usr/local/nagiosgraph/var/rrd + ng_log_dir /usr/local/nagiosgraph/var + ng_log_file /usr/local/nagiosgraph/var/nagiosgraph.log + ng_cgilog_file /usr/local/nagiosgraph/var/nagiosgraph-cgi.log + ng_url /nagiosgraph + ng_cgi_url /nagiosgraph/cgi-bin + ng_css_url /nagiosgraph/nagiosgraph.css + ng_js_url /nagiosgraph/nagiosgraph.js + nagios_cgi_url /nagios/cgi-bin + nagios_perfdata_file /tmp/perfdata.log + nagios_user nagios + www_user apache + modify_nagios_config n + nagios_config_file + nagios_commands_file + modify_apache_config n + apache_config_dir + apache_config_file +Continue with this configuration? [y] + +............. + +2, +# vim /usr/local/nagios/etc/nagios.cfg --һ + +process_performance_data=1 +service_perfdata_file=/tmp/perfdata.log +service_perfdata_file_template=$LASTSERVICECHECK$||$HOSTNAME$||$SERVICEDESC$||$SERVICEOUTPUT$||$SERVICEPERFDATA$ +service_perfdata_file_mode=a +service_perfdata_file_processing_interval=30 +service_perfdata_file_processing_command=process-service-perfdata-for-nagiosgraph + + +3 +# vim /usr/local/nagios/etc/objects/commands.cfg --һΣ + +define command { +command_name process-service-perfdata-for-nagiosgraph +command_line /usr/local/nagiosgraph/bin/insert.pl +} + + +4 +# vim /etc/httpd/conf/httpd.conf --apacheincludeļ +Include /usr/local/nagiosgraph/etc/nagiosgraph-apache.conf + + +# /etc/init.d/httpd restart +# /etc/init.d/nagios restart + + +5 +http://192.168.1.8/nagiosgraph/cgi-bin/showconfig.cgi --ôҳ鿴Ϣ + +# vim /usr/local/nagios/etc/objects/templates.cfg --ģ + +define service { +name nagiosgraph +action_url /nagiosgraph/cgi-bin/show.cgi?host=$HOSTNAME$&service=$SERVICEDESC$ +register 0 +} + +6 +# vim /usr/local/nagios/etc/objects/localhost.cfg --еҪͼεļķusenagiosgraphģ棬 +define service{ + use local-service,nagiosgraph + host_name localhost + service_description PING + check_command check_ping!100.0,20%!500.0,60% + } + + +7 +# /etc/init.d/nagios restart + +http://192.168.1.8/nagios/ȥ鿴ֻᷢҪnagiosgraphģıطһͼ꣬ͼͻͼ \ No newline at end of file diff --git a/star/nginx/nginxconfig.io-funet8.com/nginx.conf b/star/nginx/nginxconfig.io-funet8.com/nginx.conf new file mode 100644 index 00000000..cf9acf0f --- /dev/null +++ b/star/nginx/nginxconfig.io-funet8.com/nginx.conf @@ -0,0 +1,54 @@ +# Generated by nginxconfig.io +# https://nginxconfig.io/?0.domain=funet8.com&0.path=%2Fdata%2Fwwwweb%2Fweb%2Fwww.funet8.com&0.non_www=false + +user www-data; +pid /run/nginx.pid; +worker_processes auto; +worker_rlimit_nofile 65535; + +events { + multi_accept on; + worker_connections 65535; +} + +http { + charset utf-8; + sendfile on; + tcp_nopush on; + tcp_nodelay on; + server_tokens off; + log_not_found off; + types_hash_max_size 2048; + client_max_body_size 16M; + + # MIME + include mime.types; + default_type application/octet-stream; + + # logging + access_log /var/log/nginx/access.log; + error_log /var/log/nginx/error.log warn; + + # SSL + ssl_session_timeout 1d; + ssl_session_cache shared:SSL:50m; + ssl_session_tickets off; + + # Diffie-Hellman parameter for DHE ciphersuites + ssl_dhparam /etc/nginx/dhparam.pem; + + # OWASP B (Broad Compatibility) configuration + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256; + ssl_prefer_server_ciphers on; + + # OCSP Stapling + ssl_stapling on; + ssl_stapling_verify on; + resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s; + resolver_timeout 2s; + + # load configs + include /etc/nginx/conf.d/*.conf; + include /etc/nginx/sites-enabled/*; +} diff --git a/star/nginx/nginxconfig.io-funet8.com/nginxconfig.io/general.conf b/star/nginx/nginxconfig.io-funet8.com/nginxconfig.io/general.conf new file mode 100644 index 00000000..75452a26 --- /dev/null +++ b/star/nginx/nginxconfig.io-funet8.com/nginxconfig.io/general.conf @@ -0,0 +1,44 @@ +# security headers +add_header X-Frame-Options "SAMEORIGIN" always; +add_header X-XSS-Protection "1; mode=block" always; +add_header X-Content-Type-Options "nosniff" always; +add_header Referrer-Policy "no-referrer-when-downgrade" always; +add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always; +add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; + +# . files +location ~ /\.(?!well-known) { + deny all; +} + +# favicon.ico +location = /favicon.ico { + log_not_found off; + access_log off; +} + +# robots.txt +location = /robots.txt { + log_not_found off; + access_log off; +} + +# assets, media +location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ { + expires 7d; + access_log off; +} + +# svg, fonts +location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ { + add_header Access-Control-Allow-Origin "*"; + expires 7d; + access_log off; +} + +# gzip +gzip on; +gzip_vary on; +gzip_proxied any; +gzip_comp_level 6; +gzip_types text/plain text/css text/xml application/json application/javascript application/xml+rss application/atom+xml image/svg+xml; diff --git a/star/nginx/nginxconfig.io-funet8.com/nginxconfig.io/letsencrypt.conf b/star/nginx/nginxconfig.io-funet8.com/nginxconfig.io/letsencrypt.conf new file mode 100644 index 00000000..b482300c --- /dev/null +++ b/star/nginx/nginxconfig.io-funet8.com/nginxconfig.io/letsencrypt.conf @@ -0,0 +1,4 @@ +# ACME-challenge +location ^~ /.well-known/acme-challenge/ { + root /var/www/_letsencrypt; +} diff --git a/star/nginx/nginxconfig.io-funet8.com/nginxconfig.io/php_fastcgi.conf b/star/nginx/nginxconfig.io-funet8.com/nginxconfig.io/php_fastcgi.conf new file mode 100644 index 00000000..0dcdca96 --- /dev/null +++ b/star/nginx/nginxconfig.io-funet8.com/nginxconfig.io/php_fastcgi.conf @@ -0,0 +1,16 @@ +# 404 +try_files $fastcgi_script_name =404; + +# default fastcgi_params +include fastcgi_params; + +# fastcgi settings +fastcgi_pass unix:/var/run/php/php7.2-fpm.sock; +fastcgi_index index.php; +fastcgi_buffers 8 16k; +fastcgi_buffer_size 32k; + +# fastcgi params +fastcgi_param DOCUMENT_ROOT $realpath_root; +fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name; +fastcgi_param PHP_ADMIN_VALUE "open_basedir=$base/:/usr/lib/php/:/tmp/"; diff --git a/star/nginx/nginxconfig.io-funet8.com/sites-available/funet8.com.conf b/star/nginx/nginxconfig.io-funet8.com/sites-available/funet8.com.conf new file mode 100644 index 00000000..1e176272 --- /dev/null +++ b/star/nginx/nginxconfig.io-funet8.com/sites-available/funet8.com.conf @@ -0,0 +1,57 @@ +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name www.funet8.com; + set $base /data/wwwweb/web/www.funet8.com; + root $base/public; + + # SSL + ssl_certificate /etc/letsencrypt/live/funet8.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/funet8.com/privkey.pem; + ssl_trusted_certificate /etc/letsencrypt/live/funet8.com/chain.pem; + + # index.php + index index.php; + + # index.php fallback + location / { + try_files $uri $uri/ /index.php?$query_string; + } + + # handle .php + location ~ \.php$ { + include nginxconfig.io/php_fastcgi.conf; + } + + include nginxconfig.io/general.conf; +} + +# non-www, subdomains redirect +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name .funet8.com; + + # SSL + ssl_certificate /etc/letsencrypt/live/funet8.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/funet8.com/privkey.pem; + ssl_trusted_certificate /etc/letsencrypt/live/funet8.com/chain.pem; + + return 301 https://www.funet8.com$request_uri; +} + +# HTTP redirect +server { + listen 80; + listen [::]:80; + + server_name .funet8.com; + + include nginxconfig.io/letsencrypt.conf; + + location / { + return 301 https://www.funet8.com$request_uri; + } +} diff --git a/star/nginx/nginxconfig.io-funet8.com/sites-enabled/funet8.com.conf b/star/nginx/nginxconfig.io-funet8.com/sites-enabled/funet8.com.conf new file mode 100644 index 00000000..30e6515a --- /dev/null +++ b/star/nginx/nginxconfig.io-funet8.com/sites-enabled/funet8.com.conf @@ -0,0 +1 @@ +../sites-available/funet8.com.conf \ No newline at end of file diff --git "a/star/nginx/nginx\344\274\230\345\214\226\345\217\202\346\225\260.txt" "b/star/nginx/nginx\344\274\230\345\214\226\345\217\202\346\225\260.txt" new file mode 100644 index 00000000..c86db73d --- /dev/null +++ "b/star/nginx/nginx\344\274\230\345\214\226\345\217\202\346\225\260.txt" @@ -0,0 +1,34 @@ +三、参数优化 +1、gzip on|off + +开启或者关闭 gzip 模块，作用域为 http, server, location。 + +2、gzip_buffers 4 32K| 4 16K + +设置系统获取几个单位的缓存用于存储gzip的压缩结果数据流，比如4 32K表示申请了4块内存，每块32K。 + +3、gzip_comp_level 1..9 + +压缩比，1~9，数值越大压缩比例越高，压缩比例越高越消耗CPU。可根据实际情况自主选择，推荐6。 + +4、gzip_min_length 200 + +设置允许压缩的页面最小字节数，建议设置成大于1k的字节数，小于1k可能会越压越大。 + +5、gzip_http_version 1.0|1.1 + +识别http协议版本（默认为1.1），主要用于判断浏览器是否支持压缩，现在绝大部分浏览器都已支持，可不做特殊设置。 + +6、gzip_proxied + +Nginx作为反向代理的时候启用，开启或者关闭后端服务器返回的结果，匹配的前提是后端服务器必须要返回包含"Via"的 header头。 + +7、gzip_types text/css + +对哪些类型的文件压缩, 默认text/html, 还可以指定对js，css,txt,xml,json等类型文件压缩。 + +8、gzip_vary on|off + +是否显示gzip压缩标志。 + +好了，大体就是上面的几个参数了，大家可以尝试下效果。 \ No newline at end of file diff --git a/star/pressure/readme.md b/star/pressure/readme.md new file mode 100644 index 00000000..fdeeb482 --- /dev/null +++ b/star/pressure/readme.md @@ -0,0 +1,144 @@ +# ab是压力测试工具 + +ab是apache自带的一个很好用的压力测试工具，当安装完apache的时候，就可以在bin下面找到ab +吞吐率：单位时间内服务器处理的请求数，通常使用 "reqs/s" (服务器每秒处理请求的数量)表示 + +ab工具的参数比较多，常用的有以下几个： +``` +-n:表示测试请求总数,默认执行一个请求 +-c:要创建的并发用户数,默认创建一个用户 +-t:等待Web服务器相应的最大时间（单位：秒），默认没有时间限制 +-k:使用Keep-Alive 特性 +``` + +![结果显示](%E7%BB%93%E6%9E%9C%E6%98%BE%E7%A4%BA.gif) + + +(一) 在windows 执行一次压力测试 +``` +C:\Documents and Settings\Administrator>ab -c10 -n 1000 http://localhost/abtest.php + +This is ApacheBench, Version 2.3 <$Revision: 655654 $> +Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/ +Licensed to The Apache Software Foundation, http://www.apache.org/ + +Benchmarking localhost (be patient) +Completed 100 requests +Completed 200 requests +Completed 300 requests +Completed 400 requests +Completed 500 requests +Completed 600 requests +Completed 700 requests +Completed 800 requests +Completed 900 requests +Completed 1000 requests +Finished 1000 requests +``` + + +Server Software: Apache/2.2.22 #表示被测试的Web服务器软件名称 +Server Hostname: localhost #表示请求的URL主机名 +Server Port: 80 #表示被测试的Web服务器软件的监听端口 + +Document Path: /abtest.php #表示请求的URL中的根绝对路径，通过该文件的后缀名，我们一般可以了解该请求的类型 +Document Length: 698 bytes #表示HTTP响应数据的正文长度 + +Concurrency Level: 10 #表示并发用户数，这是我们设置的参数之一，即-c参数中的指定 +Time taken for tests: 0.563 seconds #表示所有这些请求被处理完成所花费的总时间 +Complete requests: 1000 #表示总请求数量，这是我们设置的参数之一 +Failed requests: 1 #表示失败的请求数量，这里的失败是指请求在连接服务器、发送数据等环节发生异常，以及无响应后超时的情况。如果接收到的HTTP响应数据的头信息中含有2XX以外的状态码，则会在测试结果中显示另一个名为 “Non-2xx responses”的统计项，用于统计这部分请求数，这些请求并不算在失败的请求中。 + (Connect: 1, Receive: 0, Length: 0, Exceptions: 0) +Write errors: 0 +Total transferred: 887000 bytes # 表示所有请求的响应数据长度总和，包括每个HTTP响应数据的头信息和正文数据的长度。注意这里不包括HTTP请求数据的长度，仅仅为web服务器流向用户PC的应用层数据总长度。 +HTML transferred: 698000 bytes # 表示所有请求的响应数据中正文数据的总和，也就是减去了Total transferred中HTTP响应数据中的头信息的长度 +Requests per second: 1777.78 [#/sec] (mean) # 吞吐率，计算公式：Complete requests / Time taken for tests +Time per request: 5.625 [ms] (mean) # 用户平均请求等待时间，计算公式：Time token for tests/（Complete requests/Concurrency Level） 如果加大并发用户的数量这个等待时间相应会加长 +Time per request: 0.563 [ms] (mean, across all concurrent requests) # 服务器平均请求等待时间，计算公式：Time taken for tests/Complete requests，正好是吞吐率的倒数。也可以这么统计：Time per request/Concurrency Level +Transfer rate: 1539.93 [Kbytes/sec] received # 表示这些请求在单位时间内从服务器获取的数据长度，计算公式：Total trnasferred/ Time taken for tests，这个统计很好的说明服务器的处理能力达到极限时，其出口宽带的需求量。 + +Connection Times (ms) + min mean[+/-sd] median max +Connect: 0 0 1.2 0 16 +Processing: 0 5 7.4 0 16 +Waiting: 0 5 7.4 0 16 +Total: 0 6 7.5 0 16 + +Percentage of the requests served within a certain time (ms) # 这部分数据用于描述每个请求处理时间的分布情况，比如以上测试，80%的请求处理时间都不超过6ms，这个处理时间是指前面的Time per request，即对于单个用户而言，平均每个请求的处理时间。 + 50% 0 + 66% 16 + 75% 16 + 80% 16 + 90% 16 + 95% 16 + 98% 16 + 99% 16 + 100% 16 (longest request) + + (二) 使用长连接的一次测试 + +``` +C:\Documents and Settings\Administrator>ab -c10 -n 1000 -k http://localhost/abte +st.php +This is ApacheBench, Version 2.3 <$Revision: 655654 $> +Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/ +Licensed to The Apache Software Foundation, http://www.apache.org/ + +Benchmarking localhost (be patient) +Completed 100 requests +Completed 200 requests +Completed 300 requests +Completed 400 requests +Completed 500 requests +Completed 600 requests +Completed 700 requests +Completed 800 requests +Completed 900 requests +Completed 1000 requests +Finished 1000 requests + + +Server Software: Apache/2.2.22 +Server Hostname: localhost +Server Port: 80 + +Document Path: /abtest.php +Document Length: 698 bytes + +Concurrency Level: 10 +Time taken for tests: 0.391 seconds # 使用长连接时间明显变短 +Complete requests: 1000 +Failed requests: 0 +Write errors: 0 +Keep-Alive requests: 995 # 长连接时间 +Total transferred: 922782 bytes +HTML transferred: 698000 bytes +Requests per second: 2560.00 [#/sec] (mean) # 吞吐量明显变大 +Time per request: 3.906 [ms] (mean) +Time per request: 0.391 [ms] (mean, across all concurrent requests) +Transfer rate: 2306.95 [Kbytes/sec] received + +Connection Times (ms) + min mean[+/-sd] median max +Connect: 0 0 0.0 0 0 +Processing: 0 4 7.2 0 47 +Waiting: 0 4 7.2 0 47 +Total: 0 4 7.2 0 47 + +Percentage of the requests served within a certain time (ms) + 50% 0 + 66% 0 + 75% 0 + 80% 16 + 90% 16 + 95% 16 + 98% 16 + 99% 16 + 100% 47 (longest request) +``` + + + + +一般访问网站静态文件或页面多的时候开启Keep-Alive ，动态页面多则关闭 + diff --git "a/star/pressure/\344\275\277\347\224\250Zend Opcache\345\212\240\351\200\237\347\274\223\345\255\230PHP.txt" "b/star/pressure/\344\275\277\347\224\250Zend Opcache\345\212\240\351\200\237\347\274\223\345\255\230PHP.txt" new file mode 100644 index 00000000..a4b01d0f --- /dev/null +++ "b/star/pressure/\344\275\277\347\224\250Zend Opcache\345\212\240\351\200\237\347\274\223\345\255\230PHP.txt" @@ -0,0 +1,102 @@ +[root@localhost ~]# whereis phpize +phpize: +װphpize +[root@localhost ~]# which phpize +/usr/bin/which: no phpize in (/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin) + +[root@localhost zendopcache-7.0.3]# whereis phpize +phpize: /usr/bin/phpize /usr/share/man/man1/phpize.1.gz + + + +wget http://pecl.php.net/get/zendopcache-7.0.3.tgz +tar -zxf zendopcache-7.0.3.tgz +cd zendopcache-7.0.3 +/usr/bin/phpize +./configure --with-php-config=/usr/bin/php-config +make +make install + + +configure: error: Cannot find php-config. Please use --with-php-config=PATH +һ˵ִ ./configure ʱ --with-php-config ·µġ +: +find / -name php-config +޸Ϊ +./configure --with-php-config=/usr/local/php/bin/php-configͿԽ /usr/local/php/ php װ· +http://www.android100.org/html/201407/27/47106.html + + +[root@localhost zendopcache-7.0.3]# make install +Installing shared extensions: /usr/lib64/php/modules/ + +[root@localhost bin]# php -v +PHP 5.3.3 (cli) (built: May 10 2016 21:39:50) +Copyright (c) 1997-2010 The PHP Group +Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies + +abѹԣ +ab -n 1000 -c 400 http://www.test2.cc/php/phpinfo.php +Time taken for tests: 3.270 seconds + +ab -n 2000 -c 1000 http://www.test2.cc/php/phpinfo.php +Time taken for tests: 7.297 seconds + + + +vi /data/conf/php.ini +zend_extension = "/usr/lib64/php/modules/opcache.so" +opcache.force_restart_timeout=3600 +opcache.memory_consumption=1024 +opcache.optimization_level=1 +opcache.interned_strings_buffer=8 +opcache.max_accelerated_files=4096 +opcache.revalidate_freq=60 +opcache.fast_shutdown=1 +opcache.enable=1 +opcache.enable_cli=1 + +ǹٷƼòԸܣʹã +zend_extension = "/usr/lib64/php/modules/opcache.so" ʵд +opcache.memory_consumption=128 +opcache.interned_strings_buffer=8 +opcache.max_accelerated_files=4000 +opcache.revalidate_freq=60 +opcache.fast_shutdown=1 +opcache.enable_cli=1 + + + +[root@localhost modules]# php -v +PHP 5.3.3 (cli) (built: May 10 2016 21:39:50) +Copyright (c) 1997-2010 The PHP Group +Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies + with Zend OPcache v7.0.3, Copyright (c) 1999-2014, by Zend Technologies + +abѹԣ +ab -n 1000 -c 400 http://www.test2.cc/php/phpinfo.php +ab -n 2000 -c 1000 http://www.test2.cc/php/phpinfo.php +ʱ䲢ûԼ١Чԡ + + + +ο +http://www.x86pro.com/article/centos-64bit-nginx-php-fastcgi-opcache-mariadb +http://www.linuxde.net/2013/07/14698.html + + + + + + + + + + + + + + + + + diff --git "a/star/pressure/\347\273\223\346\236\234\346\230\276\347\244\272.gif" "b/star/pressure/\347\273\223\346\236\234\346\230\276\347\244\272.gif" new file mode 100644 index 00000000..e79a19f8 Binary files /dev/null and "b/star/pressure/\347\273\223\346\236\234\346\230\276\347\244\272.gif" differ diff --git a/star/read_notes_automation/readme.md b/star/read_notes_automation/readme.md new file mode 100644 index 00000000..51db0939 --- /dev/null +++ b/star/read_notes_automation/readme.md @@ -0,0 +1,8 @@ +# 《Linux集群和自动化运维》读书笔记 + + +《Linux集群和自动化运维》读书笔记.xmind + + +![《Linux集群和自动化运维》读书笔记](%E3%80%8ALinux%E9%9B%86%E7%BE%A4%E5%92%8C%E8%87%AA%E5%8A%A8%E5%8C%96%E8%BF%90%E7%BB%B4%E3%80%8B%E8%AF%BB%E4%B9%A6%E7%AC%94%E8%AE%B0.png) + diff --git "a/star/read_notes_automation/\343\200\212Linux\351\233\206\347\276\244\345\222\214\350\207\252\345\212\250\345\214\226\350\277\220\347\273\264\343\200\213\350\257\273\344\271\246\347\254\224\350\256\260.png" "b/star/read_notes_automation/\343\200\212Linux\351\233\206\347\276\244\345\222\214\350\207\252\345\212\250\345\214\226\350\277\220\347\273\264\343\200\213\350\257\273\344\271\246\347\254\224\350\256\260.png" new file mode 100644 index 00000000..25e19602 Binary files /dev/null and "b/star/read_notes_automation/\343\200\212Linux\351\233\206\347\276\244\345\222\214\350\207\252\345\212\250\345\214\226\350\277\220\347\273\264\343\200\213\350\257\273\344\271\246\347\254\224\350\256\260.png" differ diff --git "a/star/read_notes_automation/\343\200\212Linux\351\233\206\347\276\244\345\222\214\350\207\252\345\212\250\345\214\226\350\277\220\347\273\264\343\200\213\350\257\273\344\271\246\347\254\224\350\256\260.xmind" "b/star/read_notes_automation/\343\200\212Linux\351\233\206\347\276\244\345\222\214\350\207\252\345\212\250\345\214\226\350\277\220\347\273\264\343\200\213\350\257\273\344\271\246\347\254\224\350\256\260.xmind" new file mode 100644 index 00000000..6e7dcd8f Binary files /dev/null and "b/star/read_notes_automation/\343\200\212Linux\351\233\206\347\276\244\345\222\214\350\207\252\345\212\250\345\214\226\350\277\220\347\273\264\343\200\213\350\257\273\344\271\246\347\254\224\350\256\260.xmind" differ diff --git "a/star/read_notes_automation/\347\254\254\344\270\211\347\253\240\357\274\232\350\275\273\351\207\217\347\272\247\350\207\252\345\212\250\345\214\226\350\277\220\347\273\264\345\267\245\345\205\267Fabric/3.7.3_fabric.py" "b/star/read_notes_automation/\347\254\254\344\270\211\347\253\240\357\274\232\350\275\273\351\207\217\347\272\247\350\207\252\345\212\250\345\214\226\350\277\220\347\273\264\345\267\245\345\205\267Fabric/3.7.3_fabric.py" new file mode 100644 index 00000000..41914041 --- /dev/null +++ "b/star/read_notes_automation/\347\254\254\344\270\211\347\253\240\357\274\232\350\275\273\351\207\217\347\272\247\350\207\252\345\212\250\345\214\226\350\277\220\347\273\264\345\267\245\345\205\267Fabric/3.7.3_fabric.py" @@ -0,0 +1,18 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +from fabric.api import * +from fabric.colors import * + +env.user ="root" +env.password = "liuxing" +env.hosts =['192.168.1.6','192.168.1.9'] + +@runs_once +#多台主机只执行一次 +def local_task(): + local("hostname") + print red ("hello,world!") + +def remote_task(): + with cd("/var/log/"): + run("ls -lF |grep /$") \ No newline at end of file diff --git "a/star/read_notes_automation/\347\254\254\344\270\211\347\253\240\357\274\232\350\275\273\351\207\217\347\272\247\350\207\252\345\212\250\345\214\226\350\277\220\347\273\264\345\267\245\345\205\267Fabric/fabric_192.168.1.3_4.py" "b/star/read_notes_automation/\347\254\254\344\270\211\347\253\240\357\274\232\350\275\273\351\207\217\347\272\247\350\207\252\345\212\250\345\214\226\350\277\220\347\273\264\345\267\245\345\205\267Fabric/fabric_192.168.1.3_4.py" new file mode 100644 index 00000000..30a2a6c1 --- /dev/null +++ "b/star/read_notes_automation/\347\254\254\344\270\211\347\253\240\357\274\232\350\275\273\351\207\217\347\272\247\350\207\252\345\212\250\345\214\226\350\277\220\347\273\264\345\267\245\345\205\267Fabric/fabric_192.168.1.3_4.py" @@ -0,0 +1,15 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +from fabric.api import * +from fabric.colors import * + +env.user ="root" +env.password = "liuxing" +env.port = "61920" +env.hosts =['192.168.1.3','192.168.1.4'] + +@runs_once +#多台主机只执行一次 +def remote_task(): + with cd("/var/log/"): + run("ls -lF |grep /$") \ No newline at end of file diff --git "a/star/read_notes_http2/HTTP2.0\345\222\214HTTP1.1\345\214\272\345\210\253.png" "b/star/read_notes_http2/HTTP2.0\345\222\214HTTP1.1\345\214\272\345\210\253.png" new file mode 100644 index 00000000..e8dd3c7e Binary files /dev/null and "b/star/read_notes_http2/HTTP2.0\345\222\214HTTP1.1\345\214\272\345\210\253.png" differ diff --git a/star/read_notes_http2/readme.md b/star/read_notes_http2/readme.md new file mode 100644 index 00000000..51d22958 --- /dev/null +++ b/star/read_notes_http2/readme.md @@ -0,0 +1,6 @@ +# 深入浅出HTTP2 -Akamai + +[深入浅出HTTP2 -Akamai](深入浅出HTTP2 -Akamai.pdf) + +![HTTP2.0和HTTP1.1区别](HTTP2.0%E5%92%8CHTTP1.1%E5%8C%BA%E5%88%AB.png) + diff --git "a/star/read_notes_http2/\346\267\261\345\205\245\346\265\205\345\207\272HTTP2 -Akamai.pdf" "b/star/read_notes_http2/\346\267\261\345\205\245\346\265\205\345\207\272HTTP2 -Akamai.pdf" new file mode 100644 index 00000000..1e329bd6 Binary files /dev/null and "b/star/read_notes_http2/\346\267\261\345\205\245\346\265\205\345\207\272HTTP2 -Akamai.pdf" differ diff --git "a/star/read_notes_king_destruction/HPING-\344\275\277\347\224\250\346\226\271\346\263\225.docx" "b/star/read_notes_king_destruction/HPING-\344\275\277\347\224\250\346\226\271\346\263\225.docx" new file mode 100644 index 00000000..9473aa55 Binary files /dev/null and "b/star/read_notes_king_destruction/HPING-\344\275\277\347\224\250\346\226\271\346\263\225.docx" differ diff --git "a/star/read_notes_king_destruction/centOS\344\270\213hping3\347\232\204\345\256\211\350\243\205\344\270\216\344\275\277\347\224\250 .txt" "b/star/read_notes_king_destruction/centOS\344\270\213hping3\347\232\204\345\256\211\350\243\205\344\270\216\344\275\277\347\224\250 .txt" new file mode 100644 index 00000000..e8a186ac --- /dev/null +++ "b/star/read_notes_king_destruction/centOS\344\270\213hping3\347\232\204\345\256\211\350\243\205\344\270\216\344\275\277\347\224\250 .txt" @@ -0,0 +1,130 @@ +# wget http://www.hping.org/hping3-20051105.tar.gz +# tar -zxvf hping3-20051105.tar.gz +# cd hping3-20051105 +[root@localhost hping3-20051105]# ./configure +build byteorder.c... +create byteorder.h... +./configure: line 81: -: command not found +==> WARNING: no Tcl header files found! ###################yum -y install tcl tcl-devel +-------------------------------------- +system type: LINUX + +LIBPCAP : PCAP=-lpcap +PCAP_INCLUDE : +MANPATH : /usr/local/man +USE_TCL : +TCL_VER : +TCL_INC : +LIBTCL : -ltcl -lm -lpthread +TCLSH : + +(to modify try configure --help) +-------------------------------------- +creating Makefile... +creating dependences... +In file included from ars.h:20, + from apd.c:19: +bytesex.h:22:3: error: #error can not find the byte order for this architecture, fix bytesex.h +In file included from apd.c:19: +ars.h:190:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +ars.h:254:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +ars.h:323:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +In file included from ars.h:20, + from ars.c:24: +bytesex.h:22:3: error: #error can not find the byte order for this architecture, fix bytesex.h +In file included from ars.c:24: +ars.h:190:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +ars.h:254:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +ars.h:323:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +In file included from ars.h:20, + from arsglue.c:7: +bytesex.h:22:3: error: #error can not find the byte order for this architecture, fix bytesex.h +In file included from arsglue.c:7: +ars.h:190:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +ars.h:254:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +ars.h:323:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +In file included from ars.h:20, + from rapd.c:11: +bytesex.h:22:3: error: #error can not find the byte order for this architecture, fix bytesex.h +In file included from rapd.c:11: +ars.h:190:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +ars.h:254:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +ars.h:323:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +In file included from ars.h:20, + from split.c:11: +bytesex.h:22:3: error: #error can not find the byte order for this architecture, fix bytesex.h +In file included from split.c:11: +ars.h:190:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +ars.h:254:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +ars.h:323:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +now you can try `make' + +################################ +出现问题：ars.h:190:2: error: #error "Please, edit Makefile and add -DBYTE_ORDER_(BIG|LITTLE)_ENDIAN" +解决办法：bytesex.h 在#if defined(__i386__) \前面添加 #define BYTE_ORDER_LITTLE_ENDIAN +./configure +出现问题：bytesex.h:22:3: 错误：#error can not find the byte order for this architecture, fix bytesex.h +解决方法：在#if defined(__i386__) \后面添加||defined(__x86_64__)\ +./configure +没问题了，接着make +make +出现问题：libpcap_stuff.c:20:21: 错误：net/bpf.h：没有那个文件或目录 +解决办法： +查看一下是否安装了libpcap及libpcap-devel +rpm -qa| grep libpcap +libpcap-1.0.0-6.20091201git117cb5.el6.x86_64 +libpcap-devel-1.0.0-6.20091201git117cb5.el6.x86_64 +################################ +二者都已安装，那么就无需yum安装了，只需ln -sf /usr/include/pcap-bpf.h /usr/include/net/bpf.h +[root@localhost hping3-20051105]# make +gcc -c -O2 -Wall -DUSE_TCL -g main.c +gcc -c -O2 -Wall -DUSE_TCL -g getifname.c +....... + +[root@localhost hping3-20051105]# make strip +-rwxr-xr-x 1 root root 512497 May 5 09:31 ./hping3 +strip hping3 +-rwxr-xr-x 1 root root 137712 May 5 09:31 ./hping3 +[root@localhost hping3-20051105]# make install +cp -f hping3 /usr/sbin/ +chmod 755 /usr/sbin/hping3 +ln -s /usr/sbin/hping3 /usr/sbin/hping +ln -s /usr/sbin/hping3 /usr/sbin/hping2 + +[root@localhost ~]# hping --help +[root@localhost ~]# hping -v +hping version 3.0.0-alpha-1 ($Id: release.h,v 1.4 2004/04/09 23:38:56 antirez Exp $) +This binary is TCL scripting capable + +1.正常的ping工具 +# hping3 -1 www.baidu.com + +2.类似traceroute工具使用 +# hping3 --traceroute -V -1 www.baidu.com +# traceroute www.baidu.com + +3.端口扫描,将向指定端口发送Syn包(80端口)，本地扫描5050端口 +hping3 -V -S -p 80 -s 5050 www.baidu.com + +4.做一个路由跟踪指定端口看你的包被阻塞 +hping3 --traceroute -V -S -p 80 -s 5050 www.baidu.com + +5.发送ICMP地址掩码请求类型(17) +hping3 -c 1 -V -1 -C 17 www.baidu.com + + +端口扫描 +hping3 -I eth0 -S 192.168.1.2 -p 80 + + + +比如对目标机发起大量SYN连接，伪造源地址为192.168.10.99，并使用1000微秒的间隔发送各个SYN包。 +[root@localhost ~]# hping3 -I eth0 -a 192.168.10.99 -S 115.28.168.69 -p 80 -i u1000 +HPING 115.28.168.69 (eth0 115.28.168.69): S set, 40 headers + 0 data bytes + + + + + + + diff --git a/star/read_notes_king_destruction/hping3-20051105.tar.gz b/star/read_notes_king_destruction/hping3-20051105.tar.gz new file mode 100644 index 00000000..7799c210 Binary files /dev/null and b/star/read_notes_king_destruction/hping3-20051105.tar.gz differ diff --git a/star/read_notes_king_destruction/pic.jpg b/star/read_notes_king_destruction/pic.jpg new file mode 100644 index 00000000..18d68c59 Binary files /dev/null and b/star/read_notes_king_destruction/pic.jpg differ diff --git a/star/read_notes_king_destruction/readme.md b/star/read_notes_king_destruction/readme.md new file mode 100644 index 00000000..96c11536 --- /dev/null +++ b/star/read_notes_king_destruction/readme.md @@ -0,0 +1,10 @@ +# 《破坏之王》读书笔记 + +xmind 文件 + +《破坏之王》读书笔记图片： +![pic](pic.jpg) + +拒绝服务攻击方法分类 +![拒绝服务攻击方法分类](%E6%8B%92%E7%BB%9D%E6%9C%8D%E5%8A%A1%E6%94%BB%E5%87%BB%E6%96%B9%E6%B3%95%E5%88%86%E7%B1%BB.jpg) + diff --git "a/star/read_notes_king_destruction/\343\200\212\347\240\264\345\235\217\344\271\213\347\216\213\343\200\213\350\257\273\344\271\246\347\254\224\350\256\260.xmind" "b/star/read_notes_king_destruction/\343\200\212\347\240\264\345\235\217\344\271\213\347\216\213\343\200\213\350\257\273\344\271\246\347\254\224\350\256\260.xmind" new file mode 100644 index 00000000..041ef1d3 Binary files /dev/null and "b/star/read_notes_king_destruction/\343\200\212\347\240\264\345\235\217\344\271\213\347\216\213\343\200\213\350\257\273\344\271\246\347\254\224\350\256\260.xmind" differ diff --git "a/star/read_notes_king_destruction/\346\213\222\347\273\235\346\234\215\345\212\241\346\224\273\345\207\273\346\226\271\346\263\225\345\210\206\347\261\273.jpg" "b/star/read_notes_king_destruction/\346\213\222\347\273\235\346\234\215\345\212\241\346\224\273\345\207\273\346\226\271\346\263\225\345\210\206\347\261\273.jpg" new file mode 100644 index 00000000..bee9f886 Binary files /dev/null and "b/star/read_notes_king_destruction/\346\213\222\347\273\235\346\234\215\345\212\241\346\224\273\345\207\273\346\226\271\346\263\225\345\210\206\347\261\273.jpg" differ diff --git "a/star/read_notes_security_course/1.ddos\345\217\221\345\261\225.png" "b/star/read_notes_security_course/1.ddos\345\217\221\345\261\225.png" new file mode 100644 index 00000000..6e0974eb Binary files /dev/null and "b/star/read_notes_security_course/1.ddos\345\217\221\345\261\225.png" differ diff --git "a/star/read_notes_security_course/1.\346\212\200\346\234\257\350\203\275\345\212\233.png" "b/star/read_notes_security_course/1.\346\212\200\346\234\257\350\203\275\345\212\233.png" new file mode 100644 index 00000000..75a41e0a Binary files /dev/null and "b/star/read_notes_security_course/1.\346\212\200\346\234\257\350\203\275\345\212\233.png" differ diff --git "a/star/read_notes_security_course/1.\346\212\200\346\234\257\350\203\275\345\212\2332.png" "b/star/read_notes_security_course/1.\346\212\200\346\234\257\350\203\275\345\212\2332.png" new file mode 100644 index 00000000..2c38a1d1 Binary files /dev/null and "b/star/read_notes_security_course/1.\346\212\200\346\234\257\350\203\275\345\212\2332.png" differ diff --git "a/star/read_notes_security_course/2-DDos-TCP\346\224\273\345\207\273.png" "b/star/read_notes_security_course/2-DDos-TCP\346\224\273\345\207\273.png" new file mode 100644 index 00000000..24802215 Binary files /dev/null and "b/star/read_notes_security_course/2-DDos-TCP\346\224\273\345\207\273.png" differ diff --git "a/star/read_notes_security_course/2-SYN-FLOOD\346\224\273\345\207\273.png" "b/star/read_notes_security_course/2-SYN-FLOOD\346\224\273\345\207\273.png" new file mode 100644 index 00000000..1cfe0dc2 Binary files /dev/null and "b/star/read_notes_security_course/2-SYN-FLOOD\346\224\273\345\207\273.png" differ diff --git "a/star/read_notes_security_course/2-SYN-FLOOD\346\224\273\345\207\273\346\226\271\346\263\225-\346\234\215\345\212\241\345\231\250\347\253\257.png" "b/star/read_notes_security_course/2-SYN-FLOOD\346\224\273\345\207\273\346\226\271\346\263\225-\346\234\215\345\212\241\345\231\250\347\253\257.png" new file mode 100644 index 00000000..be710ee5 Binary files /dev/null and "b/star/read_notes_security_course/2-SYN-FLOOD\346\224\273\345\207\273\346\226\271\346\263\225-\346\234\215\345\212\241\345\231\250\347\253\257.png" differ diff --git "a/star/read_notes_security_course/2-SYN-FLOOD\346\224\273\345\207\273\346\226\271\346\263\225-\347\275\221\347\273\234\346\212\223\345\214\205.png" "b/star/read_notes_security_course/2-SYN-FLOOD\346\224\273\345\207\273\346\226\271\346\263\225-\347\275\221\347\273\234\346\212\223\345\214\205.png" new file mode 100644 index 00000000..e2c1a568 Binary files /dev/null and "b/star/read_notes_security_course/2-SYN-FLOOD\346\224\273\345\207\273\346\226\271\346\263\225-\347\275\221\347\273\234\346\212\223\345\214\205.png" differ diff --git "a/star/read_notes_security_course/2-SYN-FLOOD\351\230\262\346\212\244-cookie.png" "b/star/read_notes_security_course/2-SYN-FLOOD\351\230\262\346\212\244-cookie.png" new file mode 100644 index 00000000..90ff1fb5 Binary files /dev/null and "b/star/read_notes_security_course/2-SYN-FLOOD\351\230\262\346\212\244-cookie.png" differ diff --git a/star/read_notes_security_course/2.TCP-header.png b/star/read_notes_security_course/2.TCP-header.png new file mode 100644 index 00000000..240f9683 Binary files /dev/null and b/star/read_notes_security_course/2.TCP-header.png differ diff --git "a/star/read_notes_security_course/2.TCP-\344\270\211\346\254\241\346\217\241\346\211\213.png" "b/star/read_notes_security_course/2.TCP-\344\270\211\346\254\241\346\217\241\346\211\213.png" new file mode 100644 index 00000000..240f9683 Binary files /dev/null and "b/star/read_notes_security_course/2.TCP-\344\270\211\346\254\241\346\217\241\346\211\213.png" differ diff --git "a/star/read_notes_security_course/2.tcp-ip\345\215\217\350\256\256.png" "b/star/read_notes_security_course/2.tcp-ip\345\215\217\350\256\256.png" new file mode 100644 index 00000000..8c923192 Binary files /dev/null and "b/star/read_notes_security_course/2.tcp-ip\345\215\217\350\256\256.png" differ diff --git a/star/read_notes_security_course/3-DNS-FLOOD.png b/star/read_notes_security_course/3-DNS-FLOOD.png new file mode 100644 index 00000000..908cbecd Binary files /dev/null and b/star/read_notes_security_course/3-DNS-FLOOD.png differ diff --git "a/star/read_notes_security_course/3-DNS-FLOOD\346\210\220\344\270\272UDP\346\224\273\345\207\273\350\266\213\345\212\277.png" "b/star/read_notes_security_course/3-DNS-FLOOD\346\210\220\344\270\272UDP\346\224\273\345\207\273\350\266\213\345\212\277.png" new file mode 100644 index 00000000..7b8da5ca Binary files /dev/null and "b/star/read_notes_security_course/3-DNS-FLOOD\346\210\220\344\270\272UDP\346\224\273\345\207\273\350\266\213\345\212\277.png" differ diff --git "a/star/read_notes_security_course/3-DNS\346\212\245\346\226\207.png" "b/star/read_notes_security_course/3-DNS\346\212\245\346\226\207.png" new file mode 100644 index 00000000..18193928 Binary files /dev/null and "b/star/read_notes_security_course/3-DNS\346\212\245\346\226\207.png" differ diff --git "a/star/read_notes_security_course/3-DNS\346\224\273\345\207\273-\345\217\215\345\260\204\346\224\273\345\207\273.png" "b/star/read_notes_security_course/3-DNS\346\224\273\345\207\273-\345\217\215\345\260\204\346\224\273\345\207\273.png" new file mode 100644 index 00000000..404b5b2b Binary files /dev/null and "b/star/read_notes_security_course/3-DNS\346\224\273\345\207\273-\345\217\215\345\260\204\346\224\273\345\207\273.png" differ diff --git "a/star/read_notes_security_course/3-DNS\346\224\273\345\207\273\346\227\266\346\234\215\345\212\241\345\231\250.png" "b/star/read_notes_security_course/3-DNS\346\224\273\345\207\273\346\227\266\346\234\215\345\212\241\345\231\250.png" new file mode 100644 index 00000000..e2608982 Binary files /dev/null and "b/star/read_notes_security_course/3-DNS\346\224\273\345\207\273\346\227\266\346\234\215\345\212\241\345\231\250.png" differ diff --git "a/star/read_notes_security_course/3-DNS\347\273\223\346\236\204\345\233\276.png" "b/star/read_notes_security_course/3-DNS\347\273\223\346\236\204\345\233\276.png" new file mode 100644 index 00000000..914c2299 Binary files /dev/null and "b/star/read_notes_security_course/3-DNS\347\273\223\346\236\204\345\233\276.png" differ diff --git "a/star/read_notes_security_course/3-DNS\350\247\243\346\236\220\344\270\276\344\276\213.png" "b/star/read_notes_security_course/3-DNS\350\247\243\346\236\220\344\270\276\344\276\213.png" new file mode 100644 index 00000000..b9dccdaf Binary files /dev/null and "b/star/read_notes_security_course/3-DNS\350\247\243\346\236\220\344\270\276\344\276\213.png" differ diff --git "a/star/read_notes_security_course/3-udp\345\215\217\350\256\256.png" "b/star/read_notes_security_course/3-udp\345\215\217\350\256\256.png" new file mode 100644 index 00000000..ce1b229e Binary files /dev/null and "b/star/read_notes_security_course/3-udp\345\215\217\350\256\256.png" differ diff --git "a/star/read_notes_security_course/3-\351\222\210\345\257\271\346\216\210\346\235\203\345\237\237\346\234\215\345\212\241\345\231\250\347\232\204DDos.png" "b/star/read_notes_security_course/3-\351\222\210\345\257\271\346\216\210\346\235\203\345\237\237\346\234\215\345\212\241\345\231\250\347\232\204DDos.png" new file mode 100644 index 00000000..7dcdd232 Binary files /dev/null and "b/star/read_notes_security_course/3-\351\222\210\345\257\271\346\216\210\346\235\203\345\237\237\346\234\215\345\212\241\345\231\250\347\232\204DDos.png" differ diff --git "a/star/read_notes_security_course/4-80\345\222\214443\345\215\217\350\256\256\351\207\214\351\235\242\347\232\204\344\270\232\345\212\241\346\257\224\346\210\221\344\273\254\346\203\263\350\261\241\347\232\204\350\246\201\345\244\215\346\235\202.png" "b/star/read_notes_security_course/4-80\345\222\214443\345\215\217\350\256\256\351\207\214\351\235\242\347\232\204\344\270\232\345\212\241\346\257\224\346\210\221\344\273\254\346\203\263\350\261\241\347\232\204\350\246\201\345\244\215\346\235\202.png" new file mode 100644 index 00000000..0e8ecdc2 Binary files /dev/null and "b/star/read_notes_security_course/4-80\345\222\214443\345\215\217\350\256\256\351\207\214\351\235\242\347\232\204\344\270\232\345\212\241\346\257\224\346\210\221\344\273\254\346\203\263\350\261\241\347\232\204\350\246\201\345\244\215\346\235\202.png" differ diff --git "a/star/read_notes_security_course/4-CC\346\224\273\345\207\273-ARME-FLOOD.png" "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273-ARME-FLOOD.png" new file mode 100644 index 00000000..a386d473 Binary files /dev/null and "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273-ARME-FLOOD.png" differ diff --git "a/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\344\273\243\347\220\206\345\217\221\350\265\267http-flood.png" "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\344\273\243\347\220\206\345\217\221\350\265\267http-flood.png" new file mode 100644 index 00000000..85485841 Binary files /dev/null and "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\344\273\243\347\220\206\345\217\221\350\265\267http-flood.png" differ diff --git "a/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\344\273\243\347\220\206\345\217\221\350\265\267http-flood2.png" "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\344\273\243\347\220\206\345\217\221\350\265\267http-flood2.png" new file mode 100644 index 00000000..6593e9e6 Binary files /dev/null and "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\344\273\243\347\220\206\345\217\221\350\265\267http-flood2.png" differ diff --git "a/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\345\203\265\345\260\270\347\275\221\347\273\234\345\217\221\350\265\267\347\232\204http-flood.png" "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\345\203\265\345\260\270\347\275\221\347\273\234\345\217\221\350\265\267\347\232\204http-flood.png" new file mode 100644 index 00000000..9a53553e Binary files /dev/null and "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\345\203\265\345\260\270\347\275\221\347\273\234\345\217\221\350\265\267\347\232\204http-flood.png" differ diff --git "a/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\345\217\230\345\274\202CC\345\222\214\350\275\256\345\233\236CC.png" "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\345\217\230\345\274\202CC\345\222\214\350\275\256\345\233\236CC.png" new file mode 100644 index 00000000..82bae9ab Binary files /dev/null and "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\345\217\230\345\274\202CC\345\222\214\350\275\256\345\233\236CC.png" differ diff --git "a/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\345\276\252\347\216\257\344\270\213\350\275\275\346\226\207\344\273\266.png" "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\345\276\252\347\216\257\344\270\213\350\275\275\346\226\207\344\273\266.png" new file mode 100644 index 00000000..d4a13149 Binary files /dev/null and "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\345\276\252\347\216\257\344\270\213\350\275\275\346\226\207\344\273\266.png" differ diff --git "a/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\346\235\216\345\213\207\347\210\254\350\231\253get\350\257\267\346\261\202.png" "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\346\235\216\345\213\207\347\210\254\350\231\253get\350\257\267\346\261\202.png" new file mode 100644 index 00000000..2a671e28 Binary files /dev/null and "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273-\346\235\216\345\213\207\347\210\254\350\231\253get\350\257\267\346\261\202.png" differ diff --git "a/star/read_notes_security_course/4-CC\346\224\273\345\207\273.png" "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273.png" new file mode 100644 index 00000000..0ecf18e8 Binary files /dev/null and "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273.png" differ diff --git "a/star/read_notes_security_course/4-CC\346\224\273\345\207\273\344\270\272\344\273\200\344\271\210\351\232\276\351\230\262.png" "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273\344\270\272\344\273\200\344\271\210\351\232\276\351\230\262.png" new file mode 100644 index 00000000..59edab4d Binary files /dev/null and "b/star/read_notes_security_course/4-CC\346\224\273\345\207\273\344\270\272\344\273\200\344\271\210\351\232\276\351\230\262.png" differ diff --git a/star/read_notes_security_course/4-HTTP-flood.png b/star/read_notes_security_course/4-HTTP-flood.png new file mode 100644 index 00000000..f65163a9 Binary files /dev/null and b/star/read_notes_security_course/4-HTTP-flood.png differ diff --git "a/star/read_notes_security_course/4-HTTPS\345\215\217\350\256\256-SSL-TLS.png" "b/star/read_notes_security_course/4-HTTPS\345\215\217\350\256\256-SSL-TLS.png" new file mode 100644 index 00000000..00b523cc Binary files /dev/null and "b/star/read_notes_security_course/4-HTTPS\345\215\217\350\256\256-SSL-TLS.png" differ diff --git "a/star/read_notes_security_course/4-HTTPS\345\215\217\350\256\256.png" "b/star/read_notes_security_course/4-HTTPS\345\215\217\350\256\256.png" new file mode 100644 index 00000000..1f245e34 Binary files /dev/null and "b/star/read_notes_security_course/4-HTTPS\345\215\217\350\256\256.png" differ diff --git "a/star/read_notes_security_course/4-HTTP\345\215\217\350\256\256.png" "b/star/read_notes_security_course/4-HTTP\345\215\217\350\256\256.png" new file mode 100644 index 00000000..7e39ad15 Binary files /dev/null and "b/star/read_notes_security_course/4-HTTP\345\215\217\350\256\256.png" differ diff --git "a/star/read_notes_security_course/4-a1\344\274\240\347\273\237\345\272\224\347\224\250\345\261\202\351\230\262\346\212\244\345\216\237\347\220\206.png" "b/star/read_notes_security_course/4-a1\344\274\240\347\273\237\345\272\224\347\224\250\345\261\202\351\230\262\346\212\244\345\216\237\347\220\206.png" new file mode 100644 index 00000000..922ddbc0 Binary files /dev/null and "b/star/read_notes_security_course/4-a1\344\274\240\347\273\237\345\272\224\347\224\250\345\261\202\351\230\262\346\212\244\345\216\237\347\220\206.png" differ diff --git "a/star/read_notes_security_course/4-a2\347\247\273\345\212\250APP\351\230\262\346\212\244\351\232\276\347\202\271.png" "b/star/read_notes_security_course/4-a2\347\247\273\345\212\250APP\351\230\262\346\212\244\351\232\276\347\202\271.png" new file mode 100644 index 00000000..dcffbcf0 Binary files /dev/null and "b/star/read_notes_security_course/4-a2\347\247\273\345\212\250APP\351\230\262\346\212\244\351\232\276\347\202\271.png" differ diff --git "a/star/read_notes_security_course/4-a3HTTPS\346\224\273\345\207\273\344\273\213\347\273\215.png" "b/star/read_notes_security_course/4-a3HTTPS\346\224\273\345\207\273\344\273\213\347\273\215.png" new file mode 100644 index 00000000..58b3875e Binary files /dev/null and "b/star/read_notes_security_course/4-a3HTTPS\346\224\273\345\207\273\344\273\213\347\273\215.png" differ diff --git "a/star/read_notes_security_course/4-a4thc-ssl-dos\346\224\273\345\207\273\346\246\202\350\277\260.png" "b/star/read_notes_security_course/4-a4thc-ssl-dos\346\224\273\345\207\273\346\246\202\350\277\260.png" new file mode 100644 index 00000000..fdbdd2c3 Binary files /dev/null and "b/star/read_notes_security_course/4-a4thc-ssl-dos\346\224\273\345\207\273\346\246\202\350\277\260.png" differ diff --git a/star/read_notes_security_course/readme.md b/star/read_notes_security_course/readme.md new file mode 100644 index 00000000..d65e88e6 --- /dev/null +++ b/star/read_notes_security_course/readme.md @@ -0,0 +1,48 @@ + +# 【云栖公开课】网络安全课程-截图 +地址： +https://yq.aliyun.com/promotion/173 + +https://yq.aliyun.com/edu/lesson/play/594 + +![1.ddos发展](1.ddos%E5%8F%91%E5%B1%95.png) + +![1.技术能力](1.%E6%8A%80%E6%9C%AF%E8%83%BD%E5%8A%9B.png) + +![1.技术能力2](1.%E6%8A%80%E6%9C%AF%E8%83%BD%E5%8A%9B2.png) +![2-DDos-TCP攻击](2-DDos-TCP%E6%94%BB%E5%87%BB.png) +![2-SYN-FLOOD攻击](2-SYN-FLOOD%E6%94%BB%E5%87%BB.png) +![2-SYN-FLOOD攻击方法-服务器端](2-SYN-FLOOD%E6%94%BB%E5%87%BB%E6%96%B9%E6%B3%95-%E6%9C%8D%E5%8A%A1%E5%99%A8%E7%AB%AF.png) +![2-SYN-FLOOD攻击方法-网络抓包](2-SYN-FLOOD%E6%94%BB%E5%87%BB%E6%96%B9%E6%B3%95-%E7%BD%91%E7%BB%9C%E6%8A%93%E5%8C%85.png) +![2-SYN-FLOOD防护-cookie](2-SYN-FLOOD%E9%98%B2%E6%8A%A4-cookie.png) +![2.TCP-header](2.TCP-header.png) +![2.TCP-三次握手](2.TCP-%E4%B8%89%E6%AC%A1%E6%8F%A1%E6%89%8B.png) +![2.tcp-ip协议](2.tcp-ip%E5%8D%8F%E8%AE%AE.png) +![3-DNS-FLOOD](3-DNS-FLOOD.png) +![3-DNS-FLOOD成为UDP攻击趋势](3-DNS-FLOOD%E6%88%90%E4%B8%BAUDP%E6%94%BB%E5%87%BB%E8%B6%8B%E5%8A%BF.png) +![3-DNS报文](3-DNS%E6%8A%A5%E6%96%87.png) +![3-DNS攻击-反射攻击](3-DNS%E6%94%BB%E5%87%BB-%E5%8F%8D%E5%B0%84%E6%94%BB%E5%87%BB.png) +![3-DNS攻击时服务器](3-DNS%E6%94%BB%E5%87%BB%E6%97%B6%E6%9C%8D%E5%8A%A1%E5%99%A8.png) +![3-DNS结构图](3-DNS%E7%BB%93%E6%9E%84%E5%9B%BE.png) +![3-DNS解析举例](3-DNS%E8%A7%A3%E6%9E%90%E4%B8%BE%E4%BE%8B.png) +![3-udp协议](3-udp%E5%8D%8F%E8%AE%AE.png) +![3-针对授权域服务器的DDos](3-%E9%92%88%E5%AF%B9%E6%8E%88%E6%9D%83%E5%9F%9F%E6%9C%8D%E5%8A%A1%E5%99%A8%E7%9A%84DDos.png) +![4-80和443协议里面的业务比我们想象的要复杂](4-80%E5%92%8C443%E5%8D%8F%E8%AE%AE%E9%87%8C%E9%9D%A2%E7%9A%84%E4%B8%9A%E5%8A%A1%E6%AF%94%E6%88%91%E4%BB%AC%E6%83%B3%E8%B1%A1%E7%9A%84%E8%A6%81%E5%A4%8D%E6%9D%82.png) +![4-CC攻击-ARME-FLOOD](4-CC%E6%94%BB%E5%87%BB-ARME-FLOOD.png) +![4-CC攻击-代理发起http-flood](4-CC%E6%94%BB%E5%87%BB-%E4%BB%A3%E7%90%86%E5%8F%91%E8%B5%B7http-flood.png) +![4-CC攻击-代理发起http-flood2](4-CC%E6%94%BB%E5%87%BB-%E4%BB%A3%E7%90%86%E5%8F%91%E8%B5%B7http-flood2.png) +![4-CC攻击-僵尸网络发起的http-flood](4-CC%E6%94%BB%E5%87%BB-%E5%83%B5%E5%B0%B8%E7%BD%91%E7%BB%9C%E5%8F%91%E8%B5%B7%E7%9A%84http-flood.png) +![4-CC攻击-变异CC和轮回CC](4-CC%E6%94%BB%E5%87%BB-%E5%8F%98%E5%BC%82CC%E5%92%8C%E8%BD%AE%E5%9B%9ECC.png) +![4-CC攻击-循环下载文件](4-CC%E6%94%BB%E5%87%BB-%E5%BE%AA%E7%8E%AF%E4%B8%8B%E8%BD%BD%E6%96%87%E4%BB%B6.png) +![4-CC攻击-李勇爬虫get请求](4-CC%E6%94%BB%E5%87%BB-%E6%9D%8E%E5%8B%87%E7%88%AC%E8%99%ABget%E8%AF%B7%E6%B1%82.png) +![4-CC攻击](4-CC%E6%94%BB%E5%87%BB.png) +![4-CC攻击为什么难防](4-CC%E6%94%BB%E5%87%BB%E4%B8%BA%E4%BB%80%E4%B9%88%E9%9A%BE%E9%98%B2.png) +![4-HTTP-flood](4-HTTP-flood.png) +![4-HTTPS协议-SSL-TLS](4-HTTPS%E5%8D%8F%E8%AE%AE-SSL-TLS.png) +![4-HTTPS协议](4-HTTPS%E5%8D%8F%E8%AE%AE.png) +![4-HTTP协议](4-HTTP%E5%8D%8F%E8%AE%AE.png) +![4-a1传统应用层防护原理](4-a1%E4%BC%A0%E7%BB%9F%E5%BA%94%E7%94%A8%E5%B1%82%E9%98%B2%E6%8A%A4%E5%8E%9F%E7%90%86.png) +![4-a2移动APP防护难点](4-a2%E7%A7%BB%E5%8A%A8APP%E9%98%B2%E6%8A%A4%E9%9A%BE%E7%82%B9.png) +![4-a3HTTPS攻击介绍](4-a3HTTPS%E6%94%BB%E5%87%BB%E4%BB%8B%E7%BB%8D.png) +![4-a4thc-ssl-dos攻击概述](4-a4thc-ssl-dos%E6%94%BB%E5%87%BB%E6%A6%82%E8%BF%B0.png) + diff --git a/star/squid_varnish/readme.md b/star/squid_varnish/readme.md new file mode 100644 index 00000000..4a86cd67 --- /dev/null +++ b/star/squid_varnish/readme.md @@ -0,0 +1,7 @@ +# squid实现正向代理和反向搭理,varnish + +[1.squid实现正向代理(配置策略)](steps1.txt) + +[2.squid对WEB服务器的反向代理，实现服务器加速](steps1.txt) + +[3.varnish对WEB服务器的反向代理，实现静态文件的加速](steps1.txt) diff --git a/star/squid_varnish/steps1.txt b/star/squid_varnish/steps1.txt new file mode 100644 index 00000000..d790d891 --- /dev/null +++ b/star/squid_varnish/steps1.txt @@ -0,0 +1,275 @@ +1.squid实现局域网的正向透明代理，上网策略 + +首先看一下网络拓扑图： + +需要实现的目的： +192.168.3.x网段中的电脑可以通过squid192.168.3.250代理服务器上外网。 +192.168.1.x网段中的电脑通过squid192.168.1.250代理服务器上外网。 +并且192.168.3.x和192.168.1.x网段互通。 + + +路由器IP：192.168.1.1 +代理服务器IP1：192.168.1.250 +代理服务器IP2：192.168.3.250 +客户端IP：192.168.1.251 +客户端IP：192.168.3.6 + +安装前准备： +1、关闭SELinux + vi /etc/selinux/config + #SELINUX=enforcing #注释掉 + #SELINUXTYPE=targeted #注释掉 + SELINUX=disabled #增加 + :wq 保存，关闭。 +setenforce 0 【临时关闭（不用重启机器）】 + +2、修改主机的路由模式 +# vi /etc/sysctl.conf + net.ipv4.ip_forward = 1 #0为关闭，1为开启路由 +# sysctl -p # 使之生效 +echo '1' > /proc/sys/net/ipv4/ip_forward 【开启ip转发，立即生效】 +echo '0' > /proc/sys/net/ipv4/ip_forward 【关闭ip转发，立即生效】 + + + + +3、设置防火墙端口转发规则 + 代理服务器的ip为 +eth0:192.168.1.250 ---->网关指向路由器（192.168.1.1）DNS指向114.114.114.114。 +eth1:192.168.3.250 + +[root@localhost ~]# ifconfig | grep addr +eth0 inet addr:192.168.1.250 Bcast:192.168.1.255 Mask:255.255.255.0 +eth1 inet addr:192.168.3.250 Bcast:192.168.3.255 Mask:255.255.255.0 +[root@localhost ~]# route -n +Kernel IP routing table +Destination Gateway Genmask Flags Metric Ref Use Iface +192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 +192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 +0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0 +[root@localhost ~]# cat /etc/resolv.conf +nameserver 114.114.114.114 +[root@localhost ~]# ping www.baidu.com +PING www.a.shifen.com (14.215.177.37) 56(84) bytes of data. +64 bytes from 14.215.177.37: icmp_seq=2 ttl=55 time=9.77 ms + +这样eth0通过192.168.1.1可以上公网，局域网网络中的都通过192.168.1.250作为网关上公网。 + + +******************************************************************* +网上参考设置： +外网IP:192.168.21.160 eth0 +内网IP:192.168.237.160 eth1 + +2、设置防火墙端口转发规则 + iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 #开启端口转发功能，把内网eth1的80端口转发到外网eth0的3128端口 + iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE #开启外网eth0的NAT网络地址转换功能 + service iptables save #保存规则 + /etc/init.d/iptables restart #重启防火墙 +******************************************************************* +自己使用的配置： +外网IP:192.168.1.250 eth0 +内网IP:192.168.3.250 eth1 + +2、设置防火墙端口转发规则 +service iptables status +iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 #开启端口转发功能，把eth1的80端口转发到3128端口 +iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 #开启端口转发功能，把eth0的80端口转发到3128端口 + +iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE #开启外网eth3的NAT网络地址转换功能 +service iptables save #保存规则 +/etc/init.d/iptables restart #重启防火墙 +service iptables status + + +******************************************************************* + + +1、安装Squid +# yum install squid #安装(Squid 3.1.10) + +# chkconfig squid on #设置开机启动 + +2、配置Squid +#mkdir -p /home/squid/{cache,log,deny} +#chown squid.squid -R /home/squid/ + +#cp /etc/squid/squid.conf /etc/squid/squid.confbak #备份 +#vi /etc/squid/squid.conf #编辑文件 + http_access allow all --把deny all改民allow all + cache_dir ufs /home/squid/cache 4096 16 256 --把缓存目录这一句打开注释，并且修改100为256 + http_port 3128 transparent + + + +#限制同一IP客户端的最大连接数 +acl OverConnLimit maxconn 128 +http_access deny OverConnLimit + + +#SpeedControl限速控制，800000=800kb/s(这个值自己测的不知是否准确) +#acl all src 0.0.0.0/0.0.0.0 #这是因为在3。0版本后默认支持all了，所以不需要加acl all src 0.0.0.0/0.0.0.0，注释掉这行后正常 +delay_pools 1 +delay_class 1 1 +delay_access 1 allow all +delay_parameters 1 800000/800000 + +# DNS服务器，优先级比 '/etc/resolv.conf' 更高 +dns_nameservers 114.114.114.114 8.8.8.8 + + +squid -z #创建缓冲区目录 +squidclient -p 3128 mgr:info #运行状态信息 + +squidclient -p 3128 -h localhost mgr:info +squidclient -p 3128 -h 172.0.0.1 mgr:info + +squidclient -p 3128 -h 172.0.0.1 mgr:mem + + + +http_port 3128 transparent +cache_mem 1024 MB +cache_dir ufs /home/squid/cache 4096 16 256 +cache_effective_user squid #设置用户 +cache_effective_group squid #设置用户组 +access_log /home/squid/log/access.log #设置访问日志文件 +cache_log /home/squid/log/cache.log #设置缓存日志文件 +cache_store_log /home/squid/log/store.log #设置缓存记录文件 +visible_hostname cdn.abc.com #设置squid服务器主机名 +cache_mgr lingvven@163.com +acl all src 0.0.0.0/0.0.0.0 #设置访问控制列表，默认开启 +http_access allow all + acl client dstdomain -i www.abc.com #找到TAG: acl标签，在其最后添加下面内容 +http_access deny client #禁止所有客户机访问www.abc.com域名 + acl client131 src 192.168.237.131 #禁止IP地址为192.168.237.131的客户机访问外网 +http_access deny client131 + acl client129 dst 192.168.237.129 #禁止所有用户访问IP地址为192.168.237.129的网站 +http_access deny client129 + acl client163 url_regex -i 163.com #禁止所有用户访问域名中包含有163.com的网站 +http_access deny client163 + acl clientdate src 192.168.237.0/255.255.255.0 #禁止这个网段所有的客户机在周一到周五的18:00-21:00上网 +acl worktime time MTWHF 18:00-21:00 + http_access deny clientdate worktime + acl clientxiazai urlpath_regex -i \.mp3$ \.exe$ \.zip$ \.rar$ + http_access deny clientxiazai #禁止客户机下载*.mp3、*.exe、*.zip和*.rar类型的文件 + +service squid stop #停止 +service squid reload +/usr/sbin/squid -z #初始化cache缓存目录 +service squid start #启动 +service squid restart #重启 + +squid -z 初始化缓存空间 +squid -k shutdown 停止 +squid -k parse 配置检查 +#squid -k reconfigure 应用更改后的配置（不必重启squid） + + + +squid 里的 ACL 访问控制列表 + +acl denyip src 192.168.1.129/32 --拒绝内网的192.168.1.129/32上网 +http_access deny denyip + +acl denyip src 192.168.1.129-192.168.1.132/255.255.255.255 +http_access deny denyip + +acl vip arp 00:0C:29:79:0C:1A +http_access allow vip + +acl baddsturl2 dst 220.11.22.33 --不能访问这个外网IP的网站 +http_access deny baddsturl2 + +acl baddsturl dstdomain -i www.163.com --不能访问www.163.com和WWW.163.COM；-i参数定义大小写都匹配； 但是可以访问war.163.com或sports.163.com +http_access deny baddsturl + +acl baddsturl dstdom_regex -i 163 --这是把163以下的所有域名都禁止 ，但直接使用IP仍然是可以访问的 +http_access deny baddsturl + +acl baddsturl dstdom_regex "/etc/squid/baddsturl" --如果网址太多，可以写成一个文件，然后在这个文件里一行一个网站写上你要禁止的 +http_access deny baddsturl + +acl baddsturl3 url_regex -i baidu --拒绝访问url里有baidu这个关键字的网站 +http_access deny baddsturl3 + +acl badfile urlpath_regex -i \.mp3$ \.rmvb$ \.exe$ \.zip$ \.mp4$ \.avi$ \.rar$ +http_access deny badfile --禁止下载带有定义后缀名的文件 + +acl badipclient2 src 192.168.1.0/255.255.255.0 +acl worktime time MTWHF 9:00-17:00 +http_access deny badipclient2 worktime --拒绝192.168.1.0网段工作时间不能上网 + +acl badipclient3 src 192.168.1.128 +acl conn5 maxconn 5 +http_access deny badipclient3 conn5 --最大连接数为5 + +实现如下要求： + 1，允许周一到周五12：00-14：00和17:30-21：00和双休能上网，别的时间不能上网 + 2，禁止下载.exe .rar .mp3 .avi .rmvb .mp4后缀的文件 + 3，禁止访问qq.com,mop.com,sina.com,163.com,youku.com + 4，禁止访问网址中包含某些关键字的网站：比如 sex news movie sport game stock + 5, vip没有任何限制 + +acl lunchtime time MTWHF 12:00-14:00 +acl dinnertime time MTWHF 17:30-21:00 +acl weekend time SA 00:00-24:00 +acl badfile urlpath_regex -i \.mp3$ \.rmvb$ \.exe$ \.zip$ \.mp4$ \.avi$ \.rar$ +acl badweb dstdom_regex "/etc/squid/denywebsite" +acl badword url_regex -i sex news movie sport game stock +acl vip arp 00:0C:29:79:0C:1A + +vim /etc/squid/denywebsite +qq +sina +mop +163 +youku + +--把上面五点情况做成两种需求： +1，上课时间不能上任何网站，休息时间可以上网，但受限 +2，上课时间可以上网，但受限，休息时间可以无限制上网 +实现需求一: +http_access allow vip +http_access deny badfile +http_access deny badweb +http_access deny badword +http_access allow lunchtime +http_access allow dinnertime +http_access allow weekend +http_access deny all + +实现需求二: +http_access allow vip +http_access allow weekend +http_access allow lunchtime +http_access allow dinnertime +http_access deny badfile +http_access deny badweb +http_access deny badword +http_access allow all + + +#############缓存设置#################### +cache_mem 1024 MB #设置squid可以使用的内存大小 +cache_swap_low 90 #缓存内部对象的替换的衡量基线 +cache_swap_high 95 #缓存内部对象替换的最高程度 +maximum_object_size 32768 KB #设置squid磁盘缓存最大文件 +maximum_object_size_in_memory 1024 KB #设置squid内存缓存最大文件 +cache_replacement_policy lru #设置squid磁盘替换策略:最少近来使用（LRU），贪婪对偶大小次数（GDSF），和动态衰老最少经常使用（LFUDA) +memory_replacement_policy lru #设置squid内存替换策略:最少近来使用（LRU），贪婪对偶大小次数（GDSF），和动态衰老最少经常使用（LFUDA) +cache_dir aufs /data/squid/cache 4096MB 32 128 #设置squid磁盘缓存存放路径方式大小等cache_dir scheme directory size L1 L2 [options] + + + + +参考： + 1.配置Squid透明代理服务器，使局域网内客户机通过代理服务器上网 + http://www.osyunwei.com/archives/1204.html + + 2.CentOS 6.4下Squid代理服务器的安装与配置 + http://www.cnblogs.com/mchina/p/3812190.html + + 3.简单的squid配置与限速系统 + http://rfyiamcool.blog.51cto.com/1030776/419942 + \ No newline at end of file diff --git a/star/squid_varnish/steps2.txt b/star/squid_varnish/steps2.txt new file mode 100644 index 00000000..2739efa2 --- /dev/null +++ b/star/squid_varnish/steps2.txt @@ -0,0 +1,177 @@ +squidWEBķʵ־̬ļļ + + +1.ܹƣ +WEB IP:192.168.4.6 [¼M6] +squid IP:192.168.4.5 [¼M5] + +ͻ IP:192.168.4.250 [¼M250] + +1M6дһ򵥵web +yum install httpd* -y +echo "web" > /var/www/html/index.html +/etc/init.d/httpd restart + + + +2M4ϰװsquid +yum install squid -y + +һµļ͸ע͵ǰе + +vi /etc/squid/squid.conf + +޸һ£ +62 http_port 80 accel vhost vport + --accel ģʽ + --vhost ֧ʾڵ + --vport ֧IPͶ˿ʾڵ + + cache_peer 192.168.4.6 parent 80 0 no-query originserver name=web + + --192.168.4.6 webIP + --parent ¹ϵƽϵ + --80 ڲweb80˿ + --0 ûʹicpʾһ̨squid + --no-query ȥѯھӣ0ʹ + --originserver ʾԴʵʷ + --name=web һ֣úIJ + +cache_peer_domain web web.cluster.com --web.cluster.comweb̨Ҳ涨192.168.4.6);ж̨webĻԶ̨webͬһʵRRѭ +cache_peer_domain web 192.168.4.6 --дһͻֻͨweb.cluster.comʣټͻ˾Ϳʹ192.168.4.6 + + +59 http_access allow all + +68 cache_dir ufs /var/spool/squid 256 16 256 + + +# iptables -t nat -F + +עⲻҪapache80˿ڳͻ + + +--ڿͻ޸hosts + +ͻ˵DNSweb.cluster.comӦõõ192.168.4.5ĽﲻDNSĻֱ/etc/hostsд + +192.168.4.5 web.cluster.com + +ʹhttp://web.cluster.com + +ʹcurl -I http://web.cluster.comȥûл + +ip_forwardת +# vi /etc/sysctl.conf + net.ipv4.ip_forward = 1 #0Ϊرգ1Ϊ· +# sysctl -p # ʹ֮Ч + +رSELinuxԡ + +رշǽ +ҪǽҪӹ + +ͻ֤ +[root@localhost ~]# curl -I http://web.cluster.com/ +HTTP/1.0 200 OK +Date: Wed, 10 Aug 2016 08:06:51 GMT +Server: Apache/2.2.15 (Red Hat) +Last-Modified: Tue, 09 Aug 2016 08:17:30 GMT +ETag: "a27d1-a-5399f29fa2540" +Accept-Ranges: bytes +Content-Length: 10 +Content-Type: text/html; charset=UTF-8 +Age: 806 +X-Cache: HIT from localhost.localdomain +X-Cache-Lookup: HIT from localhost.localdomain:80 +Via: 1.0 localhost.localdomain (squid/3.1.10) +Connection: keep-alive + + + +squidδweb? + + + + +http_port 80 accel vhost vport + +cache_peer 192.168.1.128 parent 80 0 no-query originserver round-robin name=web1 +cache_peer 192.168.1.129 parent 80 0 no-query originserver round-robin name=web2 +cache_peer 192.168.1.130 parent 80 0 no-query originserver round-robin name=web3 +cache_peer 192.168.1.131 parent 80 0 no-query originserver round-robin name=web4 + +cache_peer_domain web1 web2 web.cluster.com +cache_peer_domain web3 web4 web.abc.com + + + + + + +: +squidȺ? + +ο +http://www.ibm.com/developerworks/cn/linux/l-cn-squid + + + 172.16.2.X + client + + www.abc.com + LVSDNSѭDNS + + + + 172.16.2.9 172.16.2.10 + squid1 squid2 + 192.168.1.1 192.168.1.2 + + + web1 web2 + 192.168.1.128 192.168.1.129 + +ù +һ: +webϰװhttpdͬ淽(עеĻʱһҪͬرweb1web2web1web2ʱ̫ãܻɿͻ˷ʱȷʻǷʺ̨webҲǻʧЧˣ + + +ʡ + +ڶ: +װsquid1 +# yum install squid -y +# vim /etc/squid/squid.conf +59 http_access allow all +68 cache_dir ufs /var/spool/squid 256 16 256 +62 http_port 80 accel vhost vport + +icp_port 3130 +icp_access allow all +cache_peer 192.168.1.2 sibling 80 3130 +cache_peer 192.168.1.128 parent 80 0 no-query originserver round-robin name=web1 +cache_peer 192.168.1.129 parent 80 0 no-query originserver round-robin name=web2 +cache_peer_domain web1 web2 www.abc.com + +# /etc/init.d/squid start + +: +װsquid2 +squid1ļֻҪ޸һطsiblingIP) +# yum install squid -y +# vim /etc/squid/squid.conf +cache_peer 192.168.1.1 sibling 80 3130 --IPɶԷIP + +ȻҲ +# /etc/init.d/squid start + + +IJ: +ڿͻ˲ +vim /etc/hosts --IPַģDNSעﲻʵDNSѭ,ֶָΪsquid1squid2 +172.16.2.9 www.abc.com + +vim /etc/hosts +172.16.2.10 www.abc.com + diff --git a/star/squid_varnish/steps3.txt b/star/squid_varnish/steps3.txt new file mode 100644 index 00000000..f860c226 --- /dev/null +++ b/star/squid_varnish/steps3.txt @@ -0,0 +1,539 @@ +varnishWEBķʵ־̬ļļ + +ٷվ +www.varnish-cache.org + +ڱ3̨򵥵varnishܹ + + client 192.168.1.x + | + | + 192.168.4.25049 + varnish + 192.168.4.250 + | + | + |---------------------| + web1 web2 + 192.168.4.5 192.168.4.6 + + +4.0.3汾rpm氲װ: +· +صַΪ +http://repo.varnish-cache.org/redhat/varnish-4.0/el6/x86_64/varnish/ +http://dl.fedoraproject.org/pub/epel/6Server/x86_64/ +ںɰٶȷַأ +http://pan.baidu.com/s/1hs6WguC + +ҪΪ漸 +jemalloc-3.6.0-1.el6.x86_64.rpm +varnish-4.0.3-1.el6.x86_64.rpm +varnish-libs-4.0.3-1.el6.x86_64.rpm +varnish-docs-4.0.3-1.el6.x86_64.rpm + +һvarnishһ̨web +1.װ˳ +# rpm -ivh jemalloc-3.6.0-1.el6.x86_64.rpm +# rpm -ivh varnish-4.0.3-1.el6.x86_64.rpm varnish-libs-4.0.3-1.el6.x86_64.rpm varnish-docs-4.0.3-1.el6.x86_64.rpm + +2.޸ȫvarnishrpm棩 +# vi /etc/sysconfig/varnish +66 VARNISH_LISTEN_PORT=80 --listenĶ˿ڣĬΪ6081,Ϊ80ΪҵvarnishΪǰ) +69 VARNISH_ADMIN_LISTEN_ADDRESS=127.0.0.1 --˿ڵļַĬֵ +70 VARNISH_ADMIN_LISTEN_PORT=6082 --˿ڣﱣĬֵ + + +3.rpm汾ļ +# vi /etc/varnish/default.vcl + +vcl 4.0; --4.0.3汾ҪһָΪ4.0vcl﷨ + +backend web1 { + .host = "192.168.4.5"; + .port = "80"; +} + +#/etc/init.d/varnish start + +ʹ:# varnishd -f /etc/varnish/default.vcl -a 0.0.0.0:80 -s malloc -T 127.0.0.1:6082 + +192.168.4.5һhttp +# yum install httpd* -y +# echo "web this is 192.168.4.5 index.html" > /var/www/html/index.html +# echo "this is 192.168.4.5 index.php" > /var/www/html/index.php +# /etc/init.d/httpd restart + +ڿͻϲ + +[root@localhost ~]# curl -I 192.168.1.249 +HTTP/1.1 200 OK +Date: Thu, 11 Aug 2016 06:48:43 GMT +Server: Apache/2.2.15 (Red Hat) +Last-Modified: Thu, 11 Aug 2016 06:43:00 GMT +ETag: "406fa-25-539c613ae95b2" +Content-Length: 37 +Content-Type: text/html; charset=UTF-8 +X-Varnish: 32781 32779 +Age: 94 +Via: 1.1 varnish-v4 +Connection: keep-alive +192.168.1.249򿪣192.168.4.5 + +varnish̨ͬweb + + + client 192.168.1.x + | + | + 192.168.1.249 + varnish + 192.168.4.250 + | + | + |---------------------| + web1 web2 + 192.168.4.5 192.168.4.6 + www.aaa.com www.bbb.com + +1.װ + +2.޸ļ +# vim /etc/varnish/default.vcl + +vcl 4.0; + +backend web1 { + .host = "192.168.4.5"; + .port = "80"; +} +backend web2 { + .host = "192.168.4.6"; + .port = "80"; +} + +sub vcl_recv { +if (req.http.host ~ "aaa.com$") { + set req.backend_hint = web1; + } else { + set req.backend_hint = web2; + } +} + +varnish +# /etc/init.d/varnish restart + +ڿͻ˰hosts + +192.168.1.249 www.aaa.com www.bbb.com +з www.aaa.com www.bbb.com + + + + +ʲôվз? +ʵҲ߲ +Ҫţֿ + + +1: +dnsĶ(ֱdnsɲͬip) + news.sina.com ˹šnews.sina.com/china/ --˵ûö + ˹ news.sina.com/world/ + ˹šchina.news.sina.com --˶ + ˹ world.news.sina.com + + sports.sina.com nba sports.sina.com/nba/ + nba nba.sports.sina.com + + +2: +ǰʹô(squid,varnish,apache,nginx,haproxy) +߲ͨ + + + +ʵִͬһվݷָwww.aaa.com/sports/www.aaa.com/news/ַͬweb + + client 192.168.1.x + | + | + 192.168.1.249 + varnish + 192.168.4.250 + | + | + |---------------------| + web1 web2 + 192.168.4.5 192.168.4.6 + www.aaa.com/sports/ www.aaa.com/news/ + + +vcl 4.0; + +backend web1 { + .host = "192.168.4.5"; + .port = "80"; +} +backend web2 { + .host = "192.168.4.6"; + .port = "80"; +} + +sub vcl_recv { +if (req.url ~ "^/sports/") { + set req.backend_hint = web1; + } +if (req.url ~ "^/news/") { + set req.backend_hint = web2; + } +} + + +չ:ʵֵurl·ĸط룬ļ͵ķ(룩 + +ֻҪ + +sub vcl_recv { +if (req.url ~ "\.(txt|html|css|jpg|jpeg|gif)$") { --дweb1ļ;Ϳ + set req.backend_hint = web1 ; + } else { + set req.backend_hint = web2 ; + } +} + + +:www.xxx.com/sports/µʹrr㷨ֱȸweb1web2 + + varnish + + /sports/ /news/ + + +web1 web2 web3 web4 + + + + +vcl 4.0; + +backend web1 { + .host = "192.168.4.5"; + .port = "80"; +} + +backend web2 { + .host = "192.168.4.6"; + .port = "80"; +} + +import directors; + +sub vcl_init { + new rr = directors.round_robin(); + rr.add_backend(web1); + rr.add_backend(web2); +} + + +sub vcl_recv { +if (req.url ~ "^/sports/") { + set req.backend_hint = rr.backend(); + } +if (req.url ~ "^/news/") { + set req.backend_hint = web2; + } +} + +塢̨webĽ + +vcl 4.0; + +probe backend_healthcheck { + .url = "/test.txt"; + .timeout = 0.3 s; + .window = 5; + .threshold = 3; + .initial = 3; +} + + +backend web1 { + .host = "192.168.4.5"; + .port = "80"; + .probe = backend_healthcheck; +} + +backend web2 { + .host = "192.168.4.6"; + .port = "80"; + .probe = backend_healthcheck; +} + +import directors; + +sub vcl_init { + new rr = directors.round_robin(); + rr.add_backend(web1); + rr.add_backend(web2); +} + +sub vcl_recv { +if (req.url ~ "^/sports/") { + set req.backend_hint = rr.backend(); + } +if (req.url ~ "^/news/") { + set req.backend_hint = web2; + } +} + + +==================================================================== + + +varnish + + + client ͻ + | + | + varnish Z̡С> 1M + | + | + web һ ftp Ҷ + + +pass vcl_recv pass ʱpassǰֱת˷Ȼͨvarnish +pipe pipeģʽһvcl_recvж Ҫ pipe ʱvarnishڿͻ˺ͷ֮佨һֱӵ ֮ͻ˵ֱӷ͸ƹvarnish,varnishֱӶϿ + +vcl_recv --> vcl_pipe +vcl_recv --> vcl_pass + +vcl_recv --> lookup (vcl_hash) --> vcl_miss --> vcl_fetch(vcl_backend_response) --> vcl_deliver +vcl_recv --> lookup (vcl_hash) --> vcl_hit --> vcl_deliver + + + + +ۺʵ: + +vcl 4.0; + +probe backend_healthcheck { + .url = "/test.txt"; + .timeout = 0.3 s; + .window = 5; + .threshold = 3; + .initial = 3; +} + + +backend web1 { + .host = "192.168.4.5"; + .port = "80"; + .probe = backend_healthcheck; +} + +backend web2 { + .host = "192.168.4.6"; + .port = "80"; + .probe = backend_healthcheck; +} + +import directors; + +sub vcl_init { + new rr = directors.round_robin(); + rr.add_backend(web1); + rr.add_backend(web2); +} + +acl purgers { + "127.0.0.1"; + "192.168.1.0"/24; +} + +sub vcl_recv { + if (req.method != "GET" && + req.method != "HEAD" && + req.method != "PUT" && + req.method != "POST" && + req.method != "TRACE" && + req.method != "OPTIONS" && + req.method != "PATCH" && + req.method != "DELETE") { + return (pipe); + } + if (req.method != "GET" && req.method != "HEAD") { + return (pass); + } + + + if (req.url ~ "test.txt") { + return(pass); + } + if (req.method == "PURGE") { + if (!client.ip ~ purgers) { + return(synth(405,"Method not allowed")); + } + return(hash); + } + + if (req.http.X-Forward-For) { + set req.http.X-Forward-For = req.http.X-Forward-For + "," + client.ip; + } else { + set req.http.X-Forward-For = client.ip; + } + + +if (req.http.host ~ "www.aaa.com") { + set req.backend_hint = rr.backend() ; + } else { + return(synth(404,"error domain name")); + } +} + +sub vcl_miss { + return(fetch); +} + + +sub vcl_hit { + if (req.method == "PURGE") { + unset req.http.cookie; + return(synth(200,"Purged")); + } +} + + +sub vcl_backend_response { + if (bereq.url ~ "\.(jpg|jpeg|gif|png)$") { + set beresp.ttl = 10s; + } + if (bereq.url ~ "\.(html|css|js)$") { + set beresp.ttl = 20s; + } + if (beresp.http.Set-Cookie) { + return(deliver); + } +} + + + +sub vcl_deliver { + if (obj.hits > 0) { + set resp.http.X-Cache = "@_@ HIT from " + server.ip; + } else { + set resp.http.X-Cache = "@_@ oh,god,MISS"; + } +} + + +һ + +һ⣺Ą̊́webдĽ־õÿ5һμĻôapacheÿ5ͻôһ + +ҪĻ + +# vim /etc/httpd/conf/httpd.conf +SetEnvIf Request_URI "^/test\.txt$" dontlog --һ +CustomLog logs/access_log combined env=!dontlog --ϣ¼test.txtйص־env=!dontlog + +/etc/init.d/httpd restart + + +ķܹǰvarnishsquidnginxhaproxy޹أõapacheIJ + + +Ȼ㲻ַҲдһűڻ־תǰ־Ϳ + + +# vim clear_healtycheck_log.sh +#!/bin/bash +sed -i '/test.txt/d' /var/log/httpd/access_log +kill -USR1 `cat /var/run/httpd/httpd.pid` + + +: + +ų́webʾIPǿͻ˵ʵIPvarnishIP + + +vanrishһã4.0.3ʱҪһҲԣ˵ӦĬþ + + if (req.http.X-Forward-For) { + set req.http.X-Forward-For = req.http.X-Forward-For + "," + client.ip; + } else { + set req.http.X-Forward-For = client.ip; + } + + + +Ȼںweb޸ +# vim /etc/httpd/conf/httpd.conf +LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" varnishcombined --һ䣬DZʾһ־ʽʽΪvarnishcombined + + +CustomLog logs/access_log varnishcombined env=!dontlog --޸һ䣬ԭʹõcombinedʽvarnishcombinedʽ + + +# /etc/init.d/httpd restart + +ȻʹÿͻȥʲԣapacheʾIPǿͻ˵ʵIP +һ⣺ηǵһηʣ־ŻУDZvarnishˣvarnishֱӷظͻˣԺ̨webûм¼ + + +һ +ǾDzʹúweb־ֱʹvarnish־ +/etc/init.d/varnishncsa start --varnish־ + +# cat /var/log/varnish/varnishncsa.log --־· + + + + + + + +# varnishstat --鿴һЩָ + + +============================================================= + +DNSlb ŵ:򵥷㡡ȱ:㷨һ,޽,Ҫ޸ģӣɾA¼ȫЧΪdnsԭ) + + +ܹһ: + client1 client2 + DNSѭ(lvsnginx) + + + squid1 squid2 + logo.png + + web1 web2 + + +ܹ: + + client1 client2 + DNSѭ(lvsnginx) + + + varnish1 varnish2 + logo.png + + web1 web2 + + +ܽ: +squidܹ +:squid1MISSʱȥsquid2ȡ(ԱȥdzԶwebȥȡЧʣ +:ĻЧʱvarnish + + + +varnishܹ +:squidMISSȥһ̨ȡֻȥwebȡǰһЩlb(nginx,lvs)Ľ㷨һЧ +:ĻЧʱsquid,øƸϸ + diff --git a/star/use_openvz_xen_kvm/use_openvz_xen_kvm.md b/star/use_openvz_xen_kvm/use_openvz_xen_kvm.md new file mode 100644 index 00000000..eceb4ac2 --- /dev/null +++ b/star/use_openvz_xen_kvm/use_openvz_xen_kvm.md @@ -0,0 +1,21 @@ + +# 判断虚拟机使用的是openvz、xen、kvm + +``` +wget http://people.redhat.com/~rjones/virt-what/files/virt-what-1.15.tar.gz +tar zxf virt-what-1.15.tar.gz +cd virt-what-1.15/ +./configure +make && make install +``` + +检测 +``` +# virt-what +``` + + +阿里云、腾讯云、AWS使用的是 kvm + +参考地址： +https://yq.aliyun.com/articles/293602 diff --git a/star/use_openvz_xen_kvm/virt-what-1.15.tar.gz b/star/use_openvz_xen_kvm/virt-what-1.15.tar.gz new file mode 100644 index 00000000..a0dea9ce Binary files /dev/null and b/star/use_openvz_xen_kvm/virt-what-1.15.tar.gz differ diff --git a/star/vi/readme.md b/star/vi/readme.md new file mode 100644 index 00000000..dc15e68a --- /dev/null +++ b/star/vi/readme.md @@ -0,0 +1,176 @@ +# vi基本操作 + +vi 打开文件路径 + +a 修改 + +Esc 冒号 w 保存 或者 ZZ 保存退出。 + +:wq!强行保存退出，只有文件所有者，或者是root用户。 + +:w 【保存】 + +:w /root/service.bak 【另存为】 + +搜索关键字： +Esc /关键字 回车 + +n下一个 + +shift+n 上一个 + + + +ESC 冒号 q! 不保存强制退出 + +*********************vim/vi 文本编辑器********************* +三种模式下切换 + +命令模式 : + +插入模式 a + +编辑模式 ESC + + +进入 + vi filename + +退出 + :wq + +插入模式iao + +编辑模式 i a o + +*****************插入命令************************* +插入命令 +a 【在光标后附加文本】 +A 【在本行行末附加文本】 +i 【在光标前插入文本】 +I 【在本行开始插入文本】 +o 【在光标下插入新行】 +O 【在光标上插入新行】 + + +*****************定位命令************************* + +h或方向左键 【左移一个字符】 +j或方向下 【下移一行】 +k/方向上 【向上一行】 +l/方向右键 【右边移一个字符】 +$ 【移至行尾】 +0（零） 【移至行首】 +H 【移至屏幕上端】 +M 【移至屏幕中央】 +L 【移至屏幕中下端】 +W或w 【定位到当前句子的开始位置】 +E或e 【定位到当前这句话的最后位置】 + + + +:set nu 【设置行号】 +:set nonu 【取消行号】 +gg 【到第一行】 +G 【到最后一行】 +nG或4gg 【到第n行】到第四行 +:n 【到第n行】 + + +u 【撤销上一步的操作】 +Ctrl+r 【恢复上一步被撤销的操作】 +Ctrl+b 【在文件中向上移动一页（相当于 PageUp 键）】 +Ctrl+f 【在文件中向下移动一页（相当于 PageDown 键）】 + + +*****************删除命令************************* + +x 【删除光标所在字符】 +nx 【删除光标所在处后n个字符】 +dd 【删除光标所在行，ndd删除n行】 +dG 【删除光标所在行到末尾的内容】 +D 【删除从光标所在处到行尾】 +:n1,n2d 【删除指定的行】 + +:10,20d 【删除第十行到第20行的内容】 + + + + +光标移到第一行，然后dG 【删除所有内容】 + + +*****************复制和剪切命令************************* + +yy、Y 【复制当前行】 +nyy、nY 【复制当前行一下n行】 +dd 【剪切当前行】 +ndd 【剪切当前行一下n行】 +p、P 【粘贴在当前光标所在行下活行上】 + + +*****************替换和取消************************* + +r 【取代光标所在处字符】 +R 【从光标所在处开始替换字符，按Esc结束】 +u 【取消上一步操作】 +Ctrl+r 【恢复上一步被撤销的操作】 + + +*****************搜索和替换命令************************* + +/string 【向前搜索指定字符，搜索时请忽略大小写:set ic】 +n 【搜索指定字符串的下一个出现位置】 +:%s/old/new/g 【全文替换指定字符】 +:%s/^#//g 【去掉以#注释】 +:%s/^/#/g 【在全文开头添加#】 +:n1,n2s/old/new/g 【在指定范围内替换指定字符串】 +:n1,n2s/^/#/g + +:s/str1/str2/ 【用字符串 str2 替换本行中首次出现的字符串 str1】 + +g是全局参数，如果加上这个，你文中有多少就替换多少，如果不加，就只能一个一个的替换！ + +fa（或fb） 【查询这行a字母的的地方（或b字母）】 +3fa 【在这行中查找a出现的第三个位置】 + +*****************应用实例************************* + +导入其他文件内容 + :r 文件名 + + +在vi执行命令 + :! 命令 + + +定义快捷键： + :map 快捷键 触发命令 + 实例： + :map ^P I# 【键盘按键实现^P：ctrl+v ctrl+p或者 ctrl+v+p 】 + :map ^B 0x + +连续注释： + :n1,n2s/^/#/g + :n1,n2s/^/#//g + :n1,n2s/^/\/\//g + + +替换： + :ab sammail samlee@163.com + + + + + + + + + + + + + + + + diff --git "a/star/\345\246\202\344\275\225\350\256\251gitbook\344\270\216github\344\273\223\345\272\223\345\205\263\350\201\224.md" "b/star/\345\246\202\344\275\225\350\256\251gitbook\344\270\216github\344\273\223\345\272\223\345\205\263\350\201\224.md" new file mode 100644 index 00000000..a74d134c --- /dev/null +++ "b/star/\345\246\202\344\275\225\350\256\251gitbook\344\270\216github\344\273\223\345\272\223\345\205\263\350\201\224.md" @@ -0,0 +1,3 @@ +# 如何让gitbook与github仓库关联 + +