C3rd

 In my case, I am moving from Windows 10 to Windows 11. It is my first to do this. I realised how easy I can move my work to another PC/Laptop or new machine.

In my old machine, I exported my Ubuntu by casting the command:

wsl --export Ubuntu E:\wsl\ubuntu.tar

It will take a while, mine was 150Gb for almost an hour. Then I shared my E:\wsl folder so I can easily access the file via network. Or you can copy it to USB drive.

Then go to your new machine or destination PC/laptop. First I unregister the existing Ubuntu I installed in my destination machine.

wsl --unregister Ubuntu

Then I need to import the Ubuntu I recently exported. Either you access the file remotely from your old machine or from the USB drive by casting the command:

mkdir $env:USERPROFILE\WSL\instances\Ubuntu

wsl --import Ubuntu $env:USERPROFILE\WSL\instances\Ubuntu \\OldMachine\wsl\ubuntu.tar --version 2

It will take a while again... Once done, I set it to default.

wsl --set-default Ubuntu

Then we need to set the user in the imported Ubuntu, by default will set to "root"

wsl ~

nano /etc/wsl.conf

Then add the following:

[user]
default=your_username

Save and exit. Restart WSL and when you use WSL, it should be your username.

Reference: https://askubuntu.com/questions/1429369/how-to-transfer-ubuntu-on-wsl-from-one-laptop-to-another

I was looking for a plugin to implement 2FA in my mail server. I found alexandregz/twofactor_gauthenticator but its quite outdated and quirky. Seems not maintained. So I forked it, the foundation is there and just need to improve it.

After few days of work, here's my improved 2FA for RoundCube webmail. Please feel free to use it and it works well with RoundCube v1.5.x

Git Repo: https://github.com/camilord/twofactor_gauthenticator

It's been a while I haven't checked my server with latest configuration with SSL stuff. When I did, I got B. So today, I make my SSL in my server great again! lol

So how I did it...

a2endmod headers

Make sure you enable the headers for the "Strict-Transport-Security"

Then next is edit your ssl.conf, currently my server is not Ubuntu 20.04LTS, not using CentOS 7.x anymore due to work related getting used to it. So in Ubuntu, the config file is located at: /etc/apache2/mods-available/ssl.conf

        #SSLCipherSuite HIGH:!aNULL
        SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !CAMELLIA !SEED !3DES !RC4 !aNULL !eNULL !LOW !MD5 !EXP !PSK !SRP !DSS"

        #SSLProtocol all -SSLv3
        SSLProtocol TLSv1.2
        SSLCompression off
        SSLHonorCipherOrder on

        SSLUseStapling          on
        SSLStaplingResponderTimeout 5
        SSLStaplingReturnResponderErrors off
        SSLStaplingCache        shmcb:/var/run/ocsp(128000)

        # Header always set Strict-Transport-Security
        Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"

So that's it, you'll get A+ for that coz I did! :) Cheers!

Implemented on my personal projects:

• prendstah.com
• zabyer.org
• kiwilist.co.nz

#!/bin/bash

cd /backup/

DATE=$(date "+%Y%m%d%H%M%S")
BACKUPNAME="jdrive_$DATE"

mkdir $BACKUPNAME

# find -mtime -1 | xargs cp -t --parents "$BACKUPNAME/"

find /jdrive/ -mmin -60 -exec cp --parents '{}' "$BACKUPNAME/" \;

tar -zcvf "ibackup/$BACKUPNAME.tar.gz" "$BACKUPNAME/"

rm -rf "$BACKUPNAME/"

# file and delete all files smaller than the specified filesize
find /backup/ibackup/ -name "*.gz" -size -500 -delete

# file and delete all files that are older than 45 days
find /backup/ibackup/ -mtime +45 -type f -exec rm -rf {} \;

SSL Test: https://www.ssllabs.com/ssltest/analyze.html?d=prendstah.com

Download [download id="40"]

postfix/smtpd[27402]: NOQUEUE: reject: RCPT from unknown[125.123.123.100]: 553 5.7.1 <user@xxx.co.nz>: Sender address rejected: not owned by user user@xxx.co.nz; from=<xxx@xxx.co.nz> to=<xxx@gmail.com> proto=ESMTP helo=<localhost>

[root@mail ~]# nano /etc/postfix/main.cf

smtpd_sender_restrictions = permit_mynetworks, reject_sender_login_mismatch, permit_sasl_authenticated

smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated

[root@mail ~]# postfix stop
postfix/postfix-script: stopping the Postfix mail system
postfix/postfix-script: waiting for the Postfix mail system to terminate
[root@mail ~]# postfix start
postfix/postfix-script: starting the Postfix mail system
[root@mail ~]#

yum -y install subversion

useradd svn
passwd svn

su svn

cd
mkdir repositories

cd repositories
svnadmin create myproject

-rw-rw-r-- 1 svn svn  229 Nov 21 16:58 README.txt
drwxrwxr-x 2 svn svn 1024 Nov 21 16:58 conf
drwxrwsr-x 6 svn svn 1024 Nov 21 16:58 db
-r--r--r-- 1 svn svn    2 Nov 21 16:58 format
drwxrwxr-x 2 svn svn 1024 Nov 21 16:58 hooks
drwxrwxr-x 2 svn svn 1024 Nov 21 16:58 locks

auth-access = write
password-db = passwd

[users]
john = foobar123

svnserve -d -r /home/svn/repositories

[root@mail lib64]# php -v
PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/lib64/php/modules/mcrypt.so' - libmcrypt.so.4: cannot open shared object file: No such file or directory in Unknown on line 0
PHP 5.3.3 (cli) (built: Feb  2 2012 23:47:49)
Copyright (c) 1997-2010 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies
    with the ionCube PHP Loader v4.0.10, Copyright (c) 2002-2011, by ionCube Ltd.

1. libmcrypt-2.5.8-4.el5.centos.x86_64.rpm
2. php-mcrypt-5.3.3-1.el6.x86_64.rpm

[root@mail ~]# rpm2cpio libmcrypt-2.5.8-4.el5.centos.x86_64.rpm | cpio -idmv
[root@mail ~]# rpm2cpio php-mcrypt-5.3.3-1.el6.x86_64.rpm | cpio -idmv

[root@mail ~]# php -v
PHP 5.3.3 (cli) (built: Feb  2 2012 23:47:49)
Copyright (c) 1997-2010 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies
    with the ionCube PHP Loader v4.0.10, Copyright (c) 2002-2011, by ionCube Ltd.
[root@mail ~]#

As we know, new outlook keeps popping up in Windows Mail where you can toggle to use the new Outlook. Which is fucked up! Windows Mail is free, you can use outlook if you have free account but you cannot use Outlook if you purchase basic subscription. So I have no choice but to use Windows Mail because I only got basic subscription.

Somehow, Windows can force install this to your system and even replace the Mail to the new Outlook. I go through to few sites which they have the same problem with me.

• https://answers.microsoft.com/en-us/outlook_com/forum/all/how-do-i-totally-delete-the-new-outlook-i-only/216889bd-1dd0-4d58-8a2a-5e290e97f3bc
• https://answers.microsoft.com/en-us/outlook_com/forum/all/how-to-remove-new-outlook-from-windows-10/7afcbf97-19c7-45bb-a15c-1ad0cbfae44d
• https://answers.microsoft.com/en-us/outlook_com/forum/all/since-i-did-try-the-new-outlook-how-do-i-eradicate/a14a9e47-cee0-4538-870a-a7acc15ae1ab

But none of them works!!!

So, here's my solution. Open your notepad, write a powershell script, copy the code below...

# power shell

# show list of apps
# Get-AppxPackage | select Name, PackageFullName | Format-List

# remove outlook
Remove-AppxPackage -allusers Microsoft.OutlookForWindows_1.2024.916.0_x64__8wekyb3d8bbwe
Get-AppxPackage -all Microsoft.OutlookForWindows_* | Remove-AppxPackage -AllUsers

then save the file as powershell script at any location you want, example: "D:\uninstall_outlook.ps1"

then open in your Windows Task Scheduler, create a task, schedule it to run every 10 minutes.

or (this is the one I used because Task Scheduler sucks!) download and use System Scheduler at https://www.splinterware.com/download/index.html -- the free version of course! System Scheduler is better doing the task than Windows Task Scheduler.

Do the same, create a task/event then in the Event tab, name the event or task. there fill up the other fields like:

• Application: powershell.exe
• Parameters: -File uninstall_outlook.ps1
• Working Dir: D:\
• State: Hidden

then go to the next tab, Schedule. Select Every hour / selected Minutes, then select every 5 minutes.

UPDATE 2024-10-14: ensure you run the system scheduler as "Administrator"

What does the powershell do?

What you did is simply create a script to uninstall outlook. So if Windows install the Outlook in the background, your script will counter which to uninstall Outlook without bothering you.

Wallah! Problem solved!

I was stuck for a while how to resize a running partition in my VM. Been searching for answers and all answers are quite long except this one:

root@silex5:~# df -h
Filesystem      Size  Used Avail Use% Mounted on
udev            3.9G     0  3.9G   0% /dev
tmpfs           798M  1.1M  797M   1% /run
/dev/sda2        49G   32G   15G  69% /
tmpfs           3.9G     0  3.9G   0% /dev/shm
tmpfs           5.0M     0  5.0M   0% /run/lock
tmpfs           3.9G     0  3.9G   0% /sys/fs/cgroup
/dev/loop0      100M  100M     0 100% /snap/core/11420
/dev/loop1       18M   18M     0 100% /snap/pdftk/9
/dev/loop2      100M  100M     0 100% /snap/core/11606
tmpfs           798M     0  798M   0% /run/user/1011

root@silex5:~# growpart /dev/sda 2
CHANGED: partition=2 start=4096 old: size=104851456 end=104855552 new: size=251654111,end=251658207

root@silex5:~# resize2fs /dev/sda2
resize2fs 1.44.1 (24-Mar-2018)
Filesystem at /dev/sda2 is mounted on /; on-line resizing required
old_desc_blocks = 7, new_desc_blocks = 15
The filesystem on /dev/sda2 is now 31456763 (4k) blocks long.

root@silex5:~# df -h
Filesystem      Size  Used Avail Use% Mounted on
udev            3.9G     0  3.9G   0% /dev
tmpfs           798M  1.1M  797M   1% /run
/dev/sda2       118G   32G   81G  29% /
tmpfs           3.9G     0  3.9G   0% /dev/shm
tmpfs           5.0M     0  5.0M   0% /run/lock
tmpfs           3.9G     0  3.9G   0% /sys/fs/cgroup
/dev/loop0      100M  100M     0 100% /snap/core/11420
/dev/loop1       18M   18M     0 100% /snap/pdftk/9
/dev/loop2      100M  100M     0 100% /snap/core/11606
tmpfs           798M     0  798M   0% /run/user/1011
root@silex5:~# reboot

Reference: https://unix.stackexchange.com/questions/137482/how-to-to-resize-an-ext4-partition-from-the-command-line

SSLProtocol all -SSLv2 -SSLv3

SSLHonorCipherOrder on

root@db1:~# apt-key adv --keyserver keys.gnupg.net --recv-keys 1C4CBDCDCD2EFD2A

# deb cdrom:[Ubuntu-Server 14.04.2 LTS _Trusty Tahr_ - Release i386 (20150218.1)]/ trusty main restricted

###### Ubuntu Main Repos
deb http://us.archive.ubuntu.com/ubuntu/ trusty main restricted universe multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ trusty main restricted universe multiverse

## Ubuntu Security Updates
deb http://security.ubuntu.com/ubuntu trusty-security main
deb-src http://security.ubuntu.com/ubuntu trusty-security main
deb http://security.ubuntu.com/ubuntu trusty-security universe
deb-src http://security.ubuntu.com/ubuntu trusty-security universe
deb http://security.ubuntu.com/ubuntu trusty-security multiverse
deb-src http://security.ubuntu.com/ubuntu trusty-security multiverse

## Uncomment the following two lines to add software from Canonical's
## 'partner' repository.
## This software is not part of Ubuntu, but is offered by Canonical and the
## respective vendors as a service to Ubuntu users.
deb http://archive.canonical.com/ubuntu trusty partner
deb-src http://archive.canonical.com/ubuntu trusty partner

## Uncomment the following two lines to add software from Ubuntu's
## 'extras' repository.
## This software is not part of Ubuntu, but is offered by third-party
## developers who want to ship their latest software.
deb http://extras.ubuntu.com/ubuntu trusty main
deb-src http://extras.ubuntu.com/ubuntu trusty main

###### Ubuntu Update Repos
deb http://us.archive.ubuntu.com/ubuntu/ trusty-security main restricted universe multiverse
deb http://us.archive.ubuntu.com/ubuntu/ trusty-updates main restricted universe multiverse
deb http://us.archive.ubuntu.com/ubuntu/ trusty-backports main restricted universe multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ trusty-security main restricted universe multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ trusty-updates main restricted universe multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ trusty-backports main restricted universe multiverse

# Percona XtraDB Cluster
deb http://repo.percona.com/apt trusty main
deb-src http://repo.percona.com/apt trusty main

root@db1:~# apt-get update

root@db1:~# apt-get install percona-server-server-5.6 percona-server-client-5.6

root@db1:~# apparmor_status

root@db1:~# apt-get remove apparmor

root@db1:~# service mysql bootstrap-pxc
 * Bootstrapping Percona XtraDB Cluster database server mysqld                       [ OK ]
root@db1:~#

root@db2:~# service mysql start
mysql start/running, process 1550
root@db2:~#

root@db2:~# service mysql restart
mysql stop/waiting
mysql start/running, process 1550
root@db2:~#

root@db1:~# mysql -u root -p -e "show status where Variable_name like '%wsrep_cluster%' OR Variable_name like '%wsrep_ready%';"
Enter password:
+--------------------------+--------------------------------------+
| Variable_name            | Value                                |
+--------------------------+--------------------------------------+
| wsrep_cluster_conf_id    | 5                                    |
| wsrep_cluster_size       | 1                                    |
| wsrep_cluster_state_uuid | 1fa1e1fc-cf8e-11e4-9664-3ea415c4a429 |
| wsrep_cluster_status     | Primary                              |
| wsrep_ready              | ON                                   |
+--------------------------+--------------------------------------+

root@db1:~# mysql -u root -p -e "show binary logs;"
Enter password:
+------------------+-----------+
| Log_name         | File_size |
+------------------+-----------+
| mysql-bin.000001 |       120 |
+------------------+-----------+

root@db2:/etc/mysql# mysql -u root -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 7
Server version: 5.6.22-72.0-56-log Percona XtraDB Cluster (GPL), Release rel72.0, Revision 978, WSREP version 25.8, wsrep_25.8.r4150

Copyright (coffee) 2009-2014 Percona LLC and/or its affiliates
Copyright (coffee) 2000, 2014, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>

<?php

$connect = mysql_connect('localhost','root','secret');

mysql_select_db('test', $connect);

// insert if table not exists...
@mysql_query("create table if not exists data_test(
 id bigint(20) unsigned not null auto_increment primary key,
 data varchar(128),
 created datetime
);");

// inject data infinitely
while (true) {
        $data = sha1(time().rand(100,99999));
        echo $data." -> ".date("j M Y g:i.s a - l\n");
        @mysql_query("INSERT INTO data_test (data,created) VALUES ('".$data."', NOW())");
}

?>

<?php

$connect = mysql_connect('localhost','root','secret');

mysql_select_db('test', $connect);

$last_id = 0;

while (true) {
        $result = mysql_query("SELECT * FROM data_test WHERE id > ".$last_id." ORDER BY id ASC");
        $max = mysql_num_rows($result);
        if ($max > 0) {
                for ($i = 0; $i < $max; $i++) {
                        echo mysql_result($result,$i,"data")." -> ".date("j M Y g:i.s a - l", strtotime(mysql_result($result,$i,"created")))."\n";
                        $last_id = mysql_result($result,$i,"id");
                }
        }
}

?>

root@db1:~# php test_percona.php

root@db2:~# php monitor_percona.php

2015-03-21 20:19:11 6613 [Warning] WSREP: Gap in state sequence. Need state transfer.
2015-03-21 20:19:11 6613 [Note] WSREP: Running: 'wsrep_sst_xtrabackup-v2 --role 'joiner' --address '192.168.9.103' --auth 'sstuser:secret' --datadir '/var/lib/mysql/' --defaults-file '/etc/mysql/my.cnf' --parent '6613'  '' '
2015-03-21 20:19:11 6613 [ERROR] execlp() failed: Permission denied
2015-03-21 20:19:11 6613 [ERROR] WSREP: Failed to read 'ready <addr>' from: wsrep_sst_xtrabackup-v2 --role 'joiner' --address '192.168.9.103' --auth 'sstuser:secret' --datadir '/var/lib/mysql/' --defaults-file '/etc/mysql/my.cnf' --parent '6613'  '' Read: '(null)'
2015-03-21 20:19:11 6613 [ERROR] WSREP: Process completed with error: wsrep_sst_xtrabackup-v2 --role 'joiner' --address '192.168.9.103' --auth 'sstuser:secret' --datadir '/var/lib/mysql/' --defaults-file '/etc/mysql/my.cnf' --parent '6613'  '' : 1 (Operation not permitted)
2015-03-21 20:19:11 6613 [ERROR] WSREP: Failed to prepare for 'xtrabackup-v2' SST. Unrecoverable.
2015-03-21 20:19:11 6613 [ERROR] Aborting

• http://www.percona.com/doc/percona-server/5.6/installation/apt_repo.html
• http://www.percona.com/doc/percona-xtradb-cluster/5.5/howtos/ubuntu_howto.html
• http://www.percona.com/doc/percona-xtrabackup/2.1/innobackupex/pit_recovery_ibk.html

nano /etc/httpd/conf.d/userdir.conf

<IfModule mod_userdir.c>
    #
    # UserDir is disabled by default since it can confirm the presence
    # of a username on the system (depending on home directory
    # permissions).
    #
    UserDir disabled
 
    #
    # To enable requests to /~user/ to serve the user's public_html
    # directory, remove the "UserDir disabled" line above, and uncomment
    # the following line instead:
    #
    UserDir public_html
 
</IfModule>
 
<Directory /home/*/public_html>
        Options Indexes Includes FollowSymLinks
         Require all granted
</Directory>

<IfModule mod_userdir.c>
    #
    # UserDir is disabled by default since it can confirm the presence
    # of a username on the system (depending on home directory
    # permissions).
    #
    #UserDir disabled
 
    #
    # To enable requests to /~user/ to serve the user's public_html
    # directory, remove the "UserDir disabled" line above, and uncomment
    # the following line instead:
    #
    UserDir public_html
 
</IfModule>
 
<Directory /home/*/public_html>
        Options Indexes Includes FollowSymLinks
         Require all granted
</Directory>

systemctl restart httpd.service

mkdir /home/prendstah/public_html
chmod 711 /home/prendstah
chown prendstah:prendstah /home/prendstah/public_html
chmod 755 /home/prendstah/public_html

setsebool -P httpd_enable_homedirs true
chcon -R -t httpd_sys_content_t /home/prendstah/public_html

root@mojo:~# apt-get install -y fortune cowsay

root@mojo:~# cd ~
root@mojo:~# nano .profile

root@mojo:~# cd ~
root@mojo:~# nano .bash_profile

PATH=$PATH:/usr/games
export PATH

root@mojo:~# cd ~
root@mojo:~# nano .bashrc

fortune | cowsay -d

/usr/games/fortune | /usr/games/cowsay -d

root@mojo: ~# nano /etc/apt/source.list

## Regular repositories
deb http://http.kali.org/kali kali main non-free contrib
deb http://security.kali.org/kali-security kali/updates main contrib non-free
## Source repositories
deb-src http://http.kali.org/kali kali main non-free contrib
deb-src http://security.kali.org/kali-security kali/updates main contrib non-free

apt-get clean
apt-get update
apt-get upgrade

• Install iRedMail
• Disable Greylisting
• Enable Catch-All
• Email Forwarder

tar -xvjf iRedMail-0.8.6.tar.bz2

cd iRedMail-0.8.6

bash iRedMail.sh

ln -s /etc/amavisd/amavisd.conf /etc/amavisd.conf

amavisd showkeys

1. http://code.google.com/p/iredmail/wiki/DNS_SPF
2. http://code.google.com/p/iredmail/wiki/DNS_DKIM

amavisd testkeys

nano /etc/policyd/cluebringer.conf

# Access Control module
[AccessControl]
enable=1

# Greylisting module
[Greylisting]
enable=1

# CheckHelo module
[CheckHelo]
enable=1

# CheckSPF module
[CheckSPF]
enable=1

# Quotas module
[Quotas]
enable=1

# Access Control module
[AccessControl]
enable=1

# Greylisting module
[Greylisting]
enable=0

# CheckHelo module
[CheckHelo]
enable=1

# CheckSPF module
[CheckSPF]
enable=1

# Quotas module
[Quotas]
enable=1

nano /etc/postfix/mysql/domain_alias_catchall_maps.cf

query       = SELECT alias.goto FROM alias,alias_domain,domain WHERE alias_domain.alias_domain='%d' AND alias.address=CONCAT('%u', '@', alias_domain.target_domain) AND alias_domain.target_domain=domain.domain AND alias.active=1 AND alias_domain.active=1 AND domain.backupmx=0

query       = SELECT alias.goto FROM alias,alias_domain,domain WHERE alias_domain.alias_domain='%d' AND (alias.address=CONCAT('%u', '@', alias_domain.target_domain) OR alias.address=CONCAT('@', alias_domain.target_domain)) AND alias_domain.target_domain=domain.domain AND alias.active=1 AND alias_domain.active=1 AND domain.backupmx=0

postfix stop

postfix start

INSERT INTO alias (address, goto, domain) VALUES ('@sample.co.nz', 'user@sample.co.nz', 'sample.co.nz');

INSERT INTO alias (address, goto, domain) VALUES ('@test.sample.co.nz', 'user@sample.co.nz', 'test.sample.co.nz');

INSERT INTO alias (address, goto, domain) VALUES ('info@sample.co.nz', 'user@sample.co.nz', 'sample.co.nz');

• http://help.dnsmadeeasy.com/record-entry/mx/

[root@server ~]# wget http://ftp.jaist.ac.jp/pub/Linux/Fedora/epel/6/i386/epel-release-6-7.noarch.rpm

[root@server ~]# rpm -ivh epel-release-6-7.noarch.rpm

[root@server nginx]# yum repolist
Loaded plugins: fastestmirror, protectbase, security
Loading mirror speeds from cached hostfile
 * base: centos.ipserverone.com
 * epel: ftp.cuhk.edu.hk
 * extras: centos.ipserverone.com
 * updates: centos.ipserverone.com
0 packages excluded due to repository protections
repo id                                                        repo name                                                                                              status
base                                                           CentOS-6 - Base                                                                                        6,294
epel                                                           Extra Packages for Enterprise Linux 6 - x86_64                                                         7,561
extras                                                         CentOS-6 - Extras                                                                                          6
nginx                                                          nginx repo                                                                                                23
updates                                                        CentOS-6 - Updates                                                                                     1,147
repolist: 15,031

[root@server ~]# yum -y install nginx

[root@server ~]# yum -y install php-pear-Net-Socket php-pear php-common php-gd php-devel php php-mbstring php-pear-Mail php-cli php-imap php-snmp php-pdo php-xml php-pear-Auth-SASL php-ldap php-pear-Net-SMTP php-mysql

[root@server ~]# yum -y install spawn-fcgi

[root@server ~]# wget http://bash.cyberciti.biz/dl/419.sh.zip
[root@server ~]# unzip 419.sh.zip
[root@server ~]# mv 419.sh /etc/init.d/php_cgi
[root@server ~]# chmod +x /etc/init.d/php_cgi

[root@server ~]# /etc/init.d/php_cgi start
[root@server ~]# netstat -tulpn | grep :9000
tcp        0      0 127.0.0.1:9000              0.0.0.0:*                   LISTEN      1843/php-cgi

[root@server nginx]# cat nginx.conf

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;

    server {
        listen 80 default_server;
        server_name .nginx.ph;
        access_log /var/log/nginx/nginx.ph_access_log;
        error_log /var/log/nginx/nginx.ph_error_log;

        index index.html index.php index.htm;

        root /home/camilord/public_html;

        location / {
           # if you're just using wordpress and don't want extra rewrites
           # then replace the word @rewrites with /index.php
           try_files $uri $uri/ @rewrites;
        }

        location @rewrites {
           # Can put some of your own rewrite rules in here
           # for example rewrite ^/~(.*)/(.*)/? /users/$1/$2 last;
           # If nothing matches we'll just send it to /index.php
           rewrite ^ /index.php last;
        }

        # This block will catch static file requests, such as images, css, js
        # The ?: prefix is a 'non-capturing' mark, meaning we do not require
        # the pattern to be captured into $1 which should help improve performance
        location ~* \.(?:ico|css|js|gif|jpe?g|png)$ {
                # Some basic cache-control for static files to be sent to the browser
                expires max;
                add_header Pragma public;
                add_header Cache-Control "public, must-revalidate, proxy-revalidate";
        }

        # remove the robots line if you want to use wordpress' virtual robots.txt
        location = /robots.txt  { access_log off; log_not_found off; }
        location = /favicon.ico { access_log off; log_not_found off; }

        # this prevents hidden files (beginning with a period) from being served
        location ~ /\.          { access_log off; log_not_found off; deny all; }

        location ~ \.php {
                fastcgi_param  QUERY_STRING       $query_string;
                fastcgi_param  REQUEST_METHOD     $request_method;
                fastcgi_param  CONTENT_TYPE       $content_type;
                fastcgi_param  CONTENT_LENGTH     $content_length;

                fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
                fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
                fastcgi_param  REQUEST_URI        $request_uri;
                fastcgi_param  DOCUMENT_URI       $document_uri;
                fastcgi_param  DOCUMENT_ROOT      $document_root;
                fastcgi_param  SERVER_PROTOCOL    $server_protocol;

                fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
                fastcgi_param  SERVER_SOFTWARE    nginx;

                fastcgi_param  REMOTE_ADDR        $remote_addr;
                fastcgi_param  REMOTE_PORT        $remote_port;
                fastcgi_param  SERVER_ADDR        $server_addr;
                fastcgi_param  SERVER_PORT        $server_port;
                fastcgi_param  SERVER_NAME        $server_name;

                fastcgi_pass 127.0.0.1:9000;
        }

       #location ~ \.php$
       #{
       #    root           html;
       #    fastcgi_pass   127.0.0.1:9000;
       #    fastcgi_index  index.php;
       #    fastcgi_param  SCRIPT_FILENAME  /usr/share/nginx/html$fastcgi_script_name;
       #    include        fastcgi_params;
       #}
    }
}

[root@server ~]# service nginx restart

1. http://www.cyberciti.biz/faq/rhel-fedora-install-configure-nginx-php5/
2. http://www.cyberciti.biz/faq/rhel-fedora-centos-linux-enable-epel-repo/
3. http://www.thegeekstuff.com/2012/06/enable-epel-repository/
4. http://ftp.jaist.ac.jp/pub/Linux/Fedora/epel/6/i386/repoview/epel-release.html
5. http://wiki.nginx.org/ServerBlockExample
6. http://kbeezie.com/view/nginx-configuration-examples/

 I have been using docker lately. I have these legacy personal projects that I can't just abandon them. Still display in my portfolio. :) Then my new projects are now using Symfony 6.4 with MySQL 8.0. It is the time that I need both MySQL v5.7 and v8.x to run side-by-side in my server. Here's my docker-compose.yaml

version: '3.1'

services:
   mysql8:
      container_name: docker_mysql8
      image: mysql:8.0
      ports:
        - 3313:3306
      restart: always
      environment:
        MYSQL_USER: user
        MYSQL_PASSWORD: xxx
        MYSQL_ROOT_PASSWORD: xxx
        MYSQL_ROOT_HOST: "%"
        MYSQL_PORT: 3306
      volumes:
        - /var/lib/mysqld8:/var/lib/mysql
      healthcheck:
        test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
        timeout: 20s
        retries: 10
      networks:
        - default
   mysql5_7:
      container_name: docker_mysql5_7
      image: mysql:5.7
      ports:
        - 3312:3306
      restart: always
      environment:
        MYSQL_USER: user
        MYSQL_PASSWORD: xxxx
        MYSQL_ROOT_PASSWORD: xxxx
        MYSQL_ROOT_HOST: "%"
        MYSQL_PORT: 3306
      volumes:
        - /var/lib/mysqld57:/var/lib/mysql
      healthcheck:
        test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
        timeout: 20s
        retries: 10
      networks:
        - default

then save it let's say at "/srv/mysql/docker-compose.yaml" and to initialise, run "docker-compose up -d"

one thing to remember though, if you want to make some changes. Never cast the command: "docker-composer down" because this will delete the data you got in the container unless you created backups.

instead, just do "docker-compose stop" to stop the container and "docker-compose start" when you want to get the container running again.

if errors encounter, simply just restart docker then cast "systemctl restart docker" then go to "/srv/mysql" and run "docker-compose up -d"

I have been using https://www.ssllabs.com/ssltest/analyze.html and today I found a script to give me report the same ssllabs.com does.

The bash script based is really good. Very helpful giving me the report I need.

https://testssl.sh/ -- You can download the script from their github.

Here's the sample report: (I can display this because its an A+ verdict)

#
# to apply this settings, you must enable apache headers first...
# e.g.: a2enmod headers
#
# headers customised by camilo3rd | 2018-03-22 ---- [start]
#
Header unset Content-Security-Policy
#Header add Content-Security-Policy "default-src 'self'"
Header add Content-Security-Policy "default-src * 'self'; img-src * 'self' data: 'unsafe-inline'; style-src * 'self' 'unsafe-inline'; script-src * 'self' 'unsafe-inline' 'unsafe-eval'; report-uri https://www.abcs.co.nz/violationReportForCSP.php;"

Header unset X-Content-Security-Policy
#Header add X-Content-Security-Policy "default-src 'self'"
Header add X-Content-Security-Policy "default-src * 'self'; img-src * 'self' data: 'unsafe-inline'; style-src * 'self' 'unsafe-inline'; script-src * 'self' 'unsafe-inline' 'unsafe-eval';"

Header unset X-WebKit-CSP
#Header add X-WebKit-CSP "default-src 'self'"
Header add  X-WebKit-CSP "default-src * 'self'; img-src * 'self' data: 'unsafe-inline'; style-src * 'self' 'unsafe-inline'; script-src * 'self' 'unsafe-inline' 'unsafe-eval';"
Header always set Referrer-Policy "same-origin"

Header set X-Content-Type-Options "nosniff"
Header set X-XSS-Protection "1; mode=block"
#Header set X-Frame-Options "DENY"
Header set X-Frame-Options SAMEORIGIN
Header set Strict-Transport-Security "max-age=631138519; includeSubDomains"
#
# headers customised by camilo3rd | 2018-03-22 ---- [end]
#

• https://developers.google.com/web/fundamentals/security/csp/
• https://content-security-policy.com/

[root@server ~]# uptime
 20:43:38 up 100 days, 19:11,  2 users,  load average: 0.00, 0.01, 0.05

Building configuration...

Current configuration : 1742 bytes
!
version 12.x
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname camilord.net
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$xxxxxxxxxxxxxxxxxxxxx0
!
no aaa new-model
!
resource policy
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.0.1 192.168.0.49
ip dhcp excluded-address 192.168.0.200 192.168.0.254
!
ip dhcp pool INTERNAL
   import all
   network 192.168.0.0 255.255.255.0
   default-router 192.168.0.1
!
!
no vlan accounting
!
!
!
!
!
interface FastEthernet0/0
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet0/0.10
 encapsulation dot1Q 10
 ip address dhcp
 ip nat outside
 no snmp trap link-status
!
interface FastEthernet0/1
 ip address 192.168.0.1 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
interface ATM0/0/0
 no ip address
 shutdown
 no atm ilmi-keepalive
 dsl operating-mode auto
!
interface Serial0/1/0
 no ip address
 shutdown
 no fair-queue
 clock rate 2000000
!
interface Serial0/1/1
 no ip address
 shutdown
 clock rate 2000000
!
ip default-gateway [YOUR_ISP_GATEWAY]
ip route 0.0.0.0 0.0.0.0 [YOUR_ISP_GATEWAY]
!
!
ip http server
no ip http secure-server
ip nat inside source list 100 interface FastEthernet0/0.10 overload
ip nat inside source static [HOME_SERVER_IP] interface FastEthernet0/0.10
!
access-list 100 remark Traffic allowed to NAT
access-list 100 permit ip 192.168.0.0 0.0.0.255 any
access-list 100 deny   ip any any
!
!
!
control-plane
!
!
banner motd ^CCAMILO3RD NETWORK: Restricted Area! Authorised Access only!^C
!
line con 0
 password xxxxxxxxxx
 login
line aux 0
line vty 0 4
 password xxxxxxxxxx
 login
!
end

Username: Admin
Password: VF-NZhg659

# cd /etc/apache2/mods-enabled/
# locate mod_rewrite
/usr/lib/apache2/modules/mod_rewrite.so
# touch rewrite.load
# nano rewrite.load

LoadModule rewrite_module /usr/lib/apache2/modules/mod_rewrite.so

[root@git helpdesk]# find /home/git/repotest.git -type d -exec chmod 775 {} +

[root@git helpdesk]# chmod 775 -R /home/git/repotest.git

1. Install Apache Development libraries by casting "yum -y install apache-devel"
2. Download "mod_cband" from http://dembol.org/blog/mod_cband/ or direct download link at http://dembol.org/downloads/cband/mod-cband-0.9.7.5.tgz

cd ~
wget http://dembol.org/downloads/cband/mod-cband-0.9.7.5.tgz
tar xzvf mod-cband-0.9.7.5.tgz
cd mod-cband-0.9.7.5
./configure
make
make install

[root@localhost ~]# cat /etc/httpd/conf/httpd.conf | grep mod_cband.so
LoadModule cband_module       /usr/lib/httpd/modules/mod_cband.so

CBandScoreFlushPeriod 1
CBandRandomPulse On

mkdir /var/www/scoreboard
chown apache:apache /var/www/scoreboard/

[root@localhost conf.d]# cat cband.com.conf
<VirtualHost *:80>
    ServerAdmin webmaster@cband.com
    DocumentRoot /home/cband.com/public_html
    ServerName cband.com
    CBandSpeed 1024 10 30
    CBandRemoteSpeed 50kb/s 3 3
    CBandLimit 500M
    CBandExceededSpeed 128 5 15
    CBandScoreboard /var/www/scoreboard
    CBandPeriod 4W
    CBandExceededURL http://cband.com/exceeded.html

    <Location /cband-status>
      SetHandler cband-status
    </Location>
    <Location /cband-status-me>
      SetHandler cband-status-me
    </Location>

    ErrorLog logs/cband.com-error_log
    CustomLog logs/cband.com-access_log common
</VirtualHost>

[root@localhost conf.d]#

1. CBandSpeed 1024 10 30 -- Overall apache performance. Max bandwidth speed is 1024bits per secs. 10 requests per secs. 30 max connections
2. CBandRemoteSpeed 50kb/s 3 3 -- Individual apache performance. Max bandwidth speed is 50kb/s, max 3 requests/s and max 3 connections
3. CBandLimit 500M -- 500MB max bandwidth limit
4. CBandExceededSpeed 128 5 15 -- Bandwidth speed limit at 128kbps, 5 request/s and max of 15 connections
5. CBandScoreboard /var/www/scoreboard -- scoreboard location
6. CBandPeriod 4W - time to refresh
7. CBandExceededURL http://cband.com/exceeded.html -- if bandwidth exceeded, redirect to the specified URL.

You can use the following units in the mod_cband directives:

Transfer speeds:

    kbps: 1024 bits per second
    Mbps: 1024*1024 bits per second
    Gbps: 1024*1024*1024 bits per second
    The default is kbps.

Transfer quotas:

    K: 1000 bytes
    M: 1000*1000 bytes
    G: 1000*1000*1000 bytes
    Ki: 1024 bytes
    Mi: 1024*1024 bytes
    Gi: 1024*1024*1024 bytes
    The default is K.

Time periods:

    S: seconds
    M: minutes
    H: hours
    D: days
    W: weeks
    The default is S.

• http://www.howtoforge.com/mod_cband_apache2_bandwidth_quota_throttling

• [download id="30"]
• http://dembol.org/downloads/cband/mod-cband-0.9.7.5.tgz