1. Run updates any time you can

sudo apt-get update && apt-get upgrade

2. Enable firewall protection

sudo apt-get install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
ufw allow ssh
sudo ufw enable

3. Disable nonessential services that are prone to exploitation

sudo apt-get install systemd
systemctl list-units

Recognize which services could cause potential vulnerabilities to your system. For each service:

systemctl stop <service>
systemctl disable <service>
systemctl status <service>

4. Check for listening ports

netstat -tulpn

5. Scan for malware

sudo apt-get install clamav
sudo freshclam
sudo clamscan -r --bell -i /

vaheeD

More Posts - Website

Follow Me:

Just realized that client isnt ACME2 compatible. I recommend you do the following:

zypper in socat
wget -O -  https://get.acme.sh/ | sh

Then create this script and run it. Syntax is -e some@testdomain.com -d vicidial.testdomain.com

#!/bin/bash

while getopts ":e:d:" options; do
    case "${options}" in
        e)
           EMAIL=${OPTARG} ;;
        d)
      DOMAIN=${OPTARG} ;;
        :) echo "Error: -${OPTARG} requires an argument."; exit 1;;
        *) echo "Internal error!" ; exit 1 ;;
    esac
done

if [ -z "$EMAIL" ]
then
   echo "Missing -e Email option!"
   exit 1
fi
if [ -z "$DOMAIN" ]
then
   echo "Missing -d Domain option!"
   exit 1
fi

mkdir /etc/certbot/live/$DOMAIN
/root/.acme.sh/acme.sh --issue -d $DOMAIN -w /srv/www/htdocs/ --cert-file /etc/certbot/live/$DOMAIN/cert.pem --key-file /etc/certbot/live/$DOMAIN/privkey.pem --fullchain-file /etc/certbot/live/$DOMAIN/fullchain.pem --accountemail $EMAIL

sed -i "/SSLCertificateFile/c\\\tSSLCertificateFile /etc/certbot/live/$DOMAIN/cert.pem" /etc/apache2/vhosts.d/1111-default-ssl.conf
sed -i "/SSLCertificateKeyFile/c\\\tSSLCertificateKeyFile /etc/certbot/live/$DOMAIN/privkey.pem" /etc/apache2/vhosts.d/1111-default-ssl.conf
sed -i "/SSLCACertificateFile/c\\\tSSLCACertificateFile /etc/certbot/live/$DOMAIN/fullchain.pem" /etc/apache2/vhosts.d/1111-default-ssl.conf
sed -i "/tlscertfile=/c\\tlscertfile=/etc/certbot/live/$DOMAIN/cert.pem" /etc/asterisk/http.conf
sed -i "/tlsprivatekey=/c\\tlsprivatekey=/etc/certbot/live/$DOMAIN/privkey.pem" /etc/asterisk/http.conf
/usr/sbin/rasterisk -x 'module reload http'
/sbin/service apache2 restart

echo "  If this is a telephony server you will need to modify the 'Web Socket URL'"
echo "  field for this server under the Admin --> Servers section. It will need to be"
echo "  changed to :"
echo "    wss://$DOMAIN:8089/ws"
echo
echo "  You will also need to modify the 'webRTC' template under the Admin --> Templates"
echo "  section. You want to change the following options under the "
echo "  'Template Contents' :"
echo "    dtlscertfile=/etc/certbot/live/$DOMAIN/cert.pem"
echo "    dtlsprivatekey=/etc/certbot/live/$DOMAIN/privkey.pem"

Now chmode your script and run …

vaheeD

More Posts - Website

Follow Me:

This is done by updating your server’s package index and then using the apt packaging system to pull down the files and install them on your system:

sudo apt update
sudo apt install phpmyadmin php-mbstring php-gettext

For the server selection, choose NONE.

sudo phpenmod mbstring

sudo vi /etc/nginx/conf.d/phpmyadmin.conf

Then paste this code into this file and if you want to change example.com to your domain

server {
  listen 81;
  listen [::]:81;
  server_name example.com;
  root /usr/share/phpmyadmin/;
  index index.php index.html index.htm index.nginx-debian.html;

  access_log /var/log/nginx/phpmyadmin_access.log;
  error_log /var/log/nginx/phpmyadmin_error.log;

  location / {
    try_files $uri $uri/ /index.php;
  }

  location ~ ^/(doc|sql|setup)/ {
    deny all;
  }

  location ~ \.php$ {
    fastcgi_pass unix:/run/php/php7.2-fpm.sock;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
    include snippets/fastcgi-php.conf;
  }

  location ~ /\.ht {
    deny all;
  }
}

sudo systemctl reload nginx

vaheeD

More Posts - Website

Follow Me:

As you know the default PHP version for Ubuntu 16.04 is 7.0. If you want to install a new version of PHP on 16.04 you need to use an additional PPA (as it is shown below) or you must compile it on your own.

# Add the repository 'ppa:ondrej/php'

sudo apt-get install software-properties-common
sudo add-apt-repository ppa:ondrej/php
sudo apt update

# Install PHP 7.2

sudo apt install -y php7.2 php7.2-cli libapache2-mod-php7.2
sudo apt install -y php-imagick php-gettext php-memcache php-apcu php-pear php-xml php-xmlrpc
sudo apt install -y php-memcached php-mysql php-intl php-mbstring php-curl php-gd php-imagick
sudo apt install -y php7.2-common php7.2-mysql php7.2-cgi 
sudo apt install -y php7.2-curl php7.2-zip php7.2-mbstring php7.2-xmlrpc php7.2-gd php7.2-xml php7.2-xsl
sudo apt install -y php7.2-dev php7.2-bz2 php7.2-intl php7.2-json php7.2-opcache php7.2-readline 
sudo apt install -y php7.2-imap php7.2-pspell php7.2-recode php7.2-sqlite3 php7.2-tidy php7.2-bcmath #php7.2-mcrypt

# Update the Apache's PHP version

sudo a2dismod php7.0
sudo a2enmod php7.2
sudo systemctl restart apache2.service

# Update the CLI PHP version

sudo update-alternatives --set php /usr/bin/php7.2

Now you can see PHP version

php -v
PHP 7.2.33-1+ubuntu16.04.1+deb.sury.org+1 (cli) (built: Aug  7 2020 14:43:59) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
    with Zend OPcache v7.2.33-1+ubuntu16.04.1+deb.sury.org+1, Copyright (c) 1999-2018, by Zend Technologies

vaheeD

More Posts - Website

Follow Me:


sudo add-apt-repository ppa:ubuntu-lxc/lxd-stable
sudo apt-get update
sudo apt-get install lxd
========================

iptables -t nat -A PREROUTING -p tcp --dport 9000 -j DNAT --to 10.0.3.204:9000


vaheeD

More Posts - Website

Follow Me:

Requirements:
OS Type : Ubuntu 14.04
CPU : 2 Core
RAM : 8G
Disk: 60G

First Step we need add user for configure and running devstack

sudo bash
useradd -m stack
echo "stack ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
su stack
sudo aptitude update
sudo aptitude upgrade -y
reboot


now install dependency package

sudo aptitude install build-essential htop atop vim-nox nload git -y
sudo bash
su stack
cd
git clone https://github.com/openstack-dev/devstack.git
cd devstack


now we need local configuration

vi /home/stack/devstack/local.conf


and paste configuration

[[local|localrc]]
#=================
#khoshnud@gmail.com
#=================
#Password list configuration
ADMIN_PASSWORD=nova
MYSQL_PASSWORD=nova
RABBIT_PASSWORD=nova
SERVICE_PASSWORD=$ADMIN_PASSWORD
SERVICE_TOKEN=nova
#=================
#seet UUID as keystone token which is much shorter and easier to work with.
KEYSTONE_TOKEN_FORMAT=UUID
#=================
#Swift-Object_Storage
ENABLED_SERVICES+=,s-proxy,s-object,s-container,s-account
SWIFT_HASH=66a3d6b56c1f479c8b4e70ab5c2000f5
SWIFT_REPLICAS=1
SWIFT_DATA_DIR=$DEST/data
#=================
#Ceilometer-Metering_Service
ENABLED_SERVICES+=,ceilometer-acompute,ceilometer-acentral,ceilometer-collector,ceilometer-api
ENABLED_SERVICES+=,ceilometer-alarm-notify,ceilometer-alarm-eval
#=================
#Heat-Orchestration_Service
ENABLED_SERVICES+=,heat,h-api,h-api-cfn,h-api-cw,h-eng
#=================
#Apache_fronted_for_WSGI
APACHE_ENABLED_SERVICES+=keystone,swift
#=================
#Murano
enable_plugin murano git://git.openstack.org/openstack/murano
enable_service murano-cfapi
#MURANO_APPS=io.murano.apps.apache.Tomcat,io.murano.apps.Guacamole
#MURANO_APPS=io.murano.apps.apache.Tomcat,io.murano.apps.Guacamole,io.murano.apps.HDPSandbox,io.murano.apps.RabbitMQ,io.murano.apps.TestCluster,io.murano.apps.WordPress,io.murano.apps.ZabbixAgent,io.murano.apps.ZabbixServer,io.murano.apps.linux.Git,io.murano.apps.linux.Telnet,io.murano.databases.MySql,io.murano.apps.apache.ApacheHttpServer,io.murano.apps.apache.TomcatCluster,io.murano.apps.apache.TomcatServletContainer,io.murano.apps.apache.TomcatSingle,io.murano.apps.java.HelloWorld,io.murano.apps.java.HelloWorldCluster,io.murano.apps.mongodb.MongoReplicationSet,io.murano.apps.openstack.Murano,io.murano.apps.openstack.MuranoDashboard,io.murano.apps.paas.CloudFoundry.DEAng,io.murano.apps.paas.CloudFoundry,io.murano.apps.paas.CloudFoundryUI,io.murano.apps.test.SimpleVMcluster,io.murano.databases.PostgreSql,io.murano.databases.SqlDatabase,io.murano.windows.ActiveDirectory,io.murano.windows.FailoverCluster,io.murano.windows.SqlServer,io.murano.windows.SqlServerCluster,io.murano.apps.docker.DockerStandaloneHost,io.murano.apps.SugarCRM
#=================
#Enable_Logging
LOGFILE=/opt/stack/logs/stack.sh.log
VERBOSE=True
LOG_COLOR=True
SCREEN_LOGDIR=/opt/stack/logs
#=================
#Network_Configuration
FLOATING_RANGE=192.168.25.0/27
FLAT_INTERFACE=eth0
LOGFILE=/home/stack/stack.sh.log
Q_FLOATING_ALLOCATION_POOL=start=192.168.25.10,end=192.168.25.20
PUBLIC_NETWORK_GATEWAY=192.168.25.1
#=================
#install_devstack_single_node
disable_service n-net
enable_service q-svc
enable_service q-agt
enable_service q-dhcp
enable_service q-l3
enable_service q-meta
enable_service neutron
enable_service tempest
#=================
#install_devstack_multi_node
#disable_service n-net
#enable_service q-svc
#enable_service q-agt
#enable_service q-dhcp
#enable_service q-l3
#enable_service q-meta
#enable_service neutron
#================
#Runnig_this_section_for_all_node_connected_to_controler
#ENABLED_SERVICES=n-cpu,rabbit,neutron,q-agt
#SERVICE_HOST=[IP of controller node]
#MYSQL_HOST=$SERVICE_HOST
#RABBIT_HOST=$SERVICE_HOST
#Q_HOST=$SERVICE_HOST

now go to devstack directory and run ./stack.sh

virtual machine in openstack need internet and other network activity

sudo bash
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE


Attention: never poweroff or reboot openstack server, just pause and play (Snapshot ):D

have a good day dude!

vaheeD

More Posts - Website

Follow Me:

First Step we need package manager on MAC OS

ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

Second Step Instal Qemu

brew install qemu

vaheeD

More Posts - Website

Follow Me:

You need two mikrotik for this example and many many client :D

In this case you need …
1) two mikrotik connect to the internet
2) just one interface
3) Just have IP address for connecting to internet and Default Gateway
4)Copy and past :D

Now start with MT-01

open terminal and paste…


# aug/01/2015 12:00:00 by RouterOS 6.31
# vaheeD MT-S
#Please Attention to all comment
#Secure VPN Server with
#OVPN SERVER ON PORT 10022 ** You can chenage this port to XXXXX
#SSTP SERVER ON PORT 1025 ** You can chenage this port to XXXXX
#WINBOX PORT 6600 ### SSH PORT 2221
#
/certificate
add name=ca-template common-name=myCa key-usage=key-cert-sign,crl-sign
sign ca-template name=myCa
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des,aes-128-cbc
/ip pool
add name=pool ranges=192.168.88.100-192.168.88.200
/ppp profile
set 0 dns-server=8.8.8.8,4.2.2.1 local-address=192.168.88.1 remote-address=\
pool
set 1 dns-server=8.8.8.8,4.2.2.1 local-address=192.168.88.1 \
remote-address=pool
/interface ovpn-server server
set enabled=yes \
port=10022
/interface sstp-server server
set enabled=yes port=1025
/ip address
###CHANGE PUBLIC_IP ADDRESS TO xxx.xxx.xxx.xxx
#add address=PUBLIC_IP interface=ether1
add address=192.168.88.1/24 interface=ether1 network=192.168.99.0
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4,4.2.2.1
/ip firewall mangle
/ip firewall nat
add action=masquerade chain=srcnat
###CHANGE PUBLIC_IP ADDRESS TO xxx.xxx.xxx.xxx
#add action=src-nat chain=srcnat to-addresses=PUBLIC_IP
###CHANGE DefaultGateway ADDRESS TO zzz.zzz.zzz.zzz
#/ip route
#add distance=1 gateway=DefaultGateway
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes port=2221
set winbox port=6600
set api disabled=yes
set api-ssl disabled=yes
/ppp secret
add name=ppp password=ppp
###EXPORT CA For Client ###OPTIONAL
#/certificate export-certificate myCa
#/certificate export-certificate client1 export-passphrase=xxxxxxxx
#/certificate export-certificate client2 export-passphrase=xxxxxxxx
###FINISH SCRIPT.


now paste


/interface ovpn-server server
set certificate=myca


Move to MT-02

****
now change xxx.xxx.xxx.xxx TO Public ip address MT-01
****

open terminal and paste…


# aug/01/2015 12:00:00 by RouterOS 6.31
# vaheeD MT-CS
#Please Attention to all comment
#Secure VPN Server with
#PPTP SERVER With PAP Configuration
#L2TP SERVER With PresharedKEY : 123456789
#WEB_PROXY SERVER ON PORT 9090
#SOCKS_PROXY SERVER ON PORT 10520
#WINBOX PORT 6600 ### SSH PORT 2221
#
### CHANGE xxx.xxx.xxx.xxx TO IP MT-S
:global vpnserverOUT xxx.xxx.xxx.xxx
/interface ovpn-client
add auth=md5 connect-to="$vpnserverOUT" name=\
ovpn-out1 password=ppp port=10022 user=ppp
add auth=md5 cipher=aes192 connect-to="$vpnserverOUT" name=\
ovpn-out2 password=ppp port=10022 user=ppp
add auth=md5 cipher=aes192 connect-to="$vpnserverOUT" name=\
ovpn-out3 password=ppp port=10022 user=ppp
add auth=md5 cipher=aes128 connect-to="$vpnserverOUT" name=\
ovpn-out4 password=ppp port=10022 user=ppp
add cipher=aes256 connect-to="$vpnserverOUT" name=\
ovpn-out5 password=ppp port=10022 user=ppp
add auth=md5 connect-to="$vpnserverOUT" name=\
ovpn-out6 password=ppp port=10022 user=ppp
add cipher=aes128 connect-to="$vpnserverOUT" name=\
ovpn-out7 password=ppp port=10022 user=ppp
add auth=md5 cipher=aes128 connect-to="$vpnserverOUT" name=\
ovpn-out8 password=ppp port=10022 user=ppp
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des,aes-128-cbc,aes-256-cbc \
pfs-group=none
/ip pool
add name=vpn ranges=192.168.89.100-192.168.89.200
/ppp profile
add change-tcp-mss=yes dns-server=192.168.89.1,8.8.8.8 \
local-address=192.168.89.1 name=VPN remote-address=vpn
/interface sstp-client
add connect-to="$vpnserverOUT:1025" disabled=no http-proxy=0.0.0.0:1025 name=\
sstp-out1 password=ppp pfs=yes profile=default-encryption user=ppp
add connect-to="$vpnserverOUT:1025" disabled=no http-proxy=0.0.0.0:1025 name=\
sstp-out2 password=ppp pfs=yes profile=default-encryption user=ppp
add connect-to="$vpnserverOUT:1025" disabled=no http-proxy=0.0.0.0:1025 name=\
sstp-out3 password=ppp pfs=yes profile=default-encryption user=ppp
add connect-to="$vpnserverOUT:1025" disabled=no http-proxy=0.0.0.0:1025 name=\
sstp-out4 password=ppp pfs=yes profile=default-encryption user=ppp
add connect-to="$vpnserverOUT:1025" disabled=no http-proxy=0.0.0.0:1025 name=\
sstp-out5 password=ppp pfs=yes profile=default-encryption user=ppp
add connect-to="$vpnserverOUT:1025" disabled=no http-proxy=0.0.0.0:1025 name=\
sstp-out6 password=ppp pfs=yes profile=default-encryption user=ppp
add connect-to="$vpnserverOUT:1025" disabled=no http-proxy=0.0.0.0:1025 name=\
sstp-out7 password=ppp pfs=yes profile=default-encryption user=ppp
add connect-to="$vpnserverOUT:1025" disabled=no http-proxy=0.0.0.0:1025 name=\
sstp-out8 password=ppp pfs=yes profile=default-encryption user=ppp
/interface l2tp-server server
set default-profile=VPN enabled=yes max-mru=1460 max-mtu=1460
/interface pptp-server server
set authentication=pap default-profile=VPN enabled=yes max-mru=1460 max-mtu=\
1460
/ip address
###CHANGE PUBLIC_IP ADDRESS TO xxx.xxx.xxx.xxx
#add address=PUBLIC_IP interface=ether1
add address=192.168.89.1/24 interface=ether1 network=192.168.89.0
/ip dns
set allow-remote-requests=yes cache-max-ttl=1h cache-size=8192KiB \
max-udp-packet-size=8192 servers=4.2.2.4,8.8.8.8
/ip firewall address-list
add address=192.168.0.0/16 list=local
add address=172.16.0.0/12 list=local
add address=10.0.0.0/8 list=local
/ip firewall mangle
add chain=prerouting comment=accept-internal-network dst-address-list=local
add chain=output comment=accept-internal-network dst-address-list=local
add action=mark-routing chain=prerouting new-routing-mark=VPN src-address=\
192.168.89.0/24
add action=mark-routing chain=output dst-port=80 new-routing-mark=VPN \
protocol=tcp
add action=mark-routing chain=output dst-port=443 new-routing-mark=VPN \
protocol=tcp
add action=mark-routing chain=output dst-port=53 new-routing-mark=VPN \
protocol=udp
/ip firewall nat
add action=masquerade chain=srcnat
add action=redirect chain=dstnat dst-port=53 protocol=udp to-ports=53
/ip ipsec peer
add address=0.0.0.0/0 enc-algorithm=3des exchange-mode=main-l2tp \
generate-policy=port-override local-address=0.0.0.0 secret=123456789
/ip proxy
set always-from-cache=yes anonymous=yes cache-administrator=noway! \
cache-on-disk=yes cache-path=disk1/web-proxy1 enabled=yes parent-proxy=\
0.0.0.0 port=9090 serialize-connections=yes
/ip proxy direct
add dst-address=192.168.0.0/16
add dst-address=172.16.0.0/16
add dst-address=10.10.0.0/16
add dst-host=*.ir
/ip route
add comment=OUTPUT distance=1 gateway="ovpn-out1,ovpn-out2,ovpn-out3,ovpn-out4,\
ovpn-out5,ovpn-out6,ovpn-out7,ovpn-out8,sstp-out1,sstp-out2,sstp-out3,sstp\
-out4,sstp-out5,sstp-out6,sstp-out7,sstp-out8" routing-mark=VPN
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=2221
set api disabled=yes
set winbox port=6600
/ip socks
set connection-idle-timeout=5m enabled=yes max-connections=500 port=10520
/ppp secret
add name=ppp password=ppp profile=VPN
###FINISH SCRIPT


Client Connect to MT-02 with Public IP address.

Have a GOOD Day!

vaheeD

More Posts - Website

Follow Me:

Installing the Client Program

apt-get install pptp-linux

cat <<'__EOF__' >> /etc/ppp/chap-secrets
USERNAME  PPTP  PASSWORD  *
__EOF__

cat <<'__EOF__' >> /etc/ppp/peers/pptp
pty "pptp SERVER-IP-ADDRESS --nolaunchpppd"
name USERNAME
usepeerdns
noauth
file /etc/ppp/options.pptp
ipparam pptp
__EOF__

 

Connect

pon pptp

Disconnect

poff pptp

route add -net 0.0.0.0 dev ppp0

vaheeD

More Posts - Website

Follow Me:

How Remove Older Kernel on Ubuntu and Clear /boot Partition

Just login as root user or using sudo command like …

sudo apt-get remove --purge $(dpkg -l 'linux-*' | sed '/^ii/!d;/'"$(uname -r | sed "s/\(.*\)-\([^0-9]\+\)/\1/")"'/d;s/^[^ ]* [^ ]* \([^ ]*\).*/\1/;/[0-9]/!d')

vaheeD

More Posts - Website

Follow Me: