海运的博客

Openwrt网段：192.168.1.1/24
Modem网段： 192.168.0.1/24
Openwrt下配置和Modem相连接端口IP：

#https://www.haiyun.me
ifconfig eth1.1 192.168.0.2 netmask 255.255.255.0

Iptables配置SNAT：

iptables -t nat -A POSTROUTING -d 192.168.0.1 -j MASQUERADE

iptables放行：

iptables -A INPUT -i eth1.1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth1.1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

tracert测试：

C:\Users\Administrator>tracert 192.168.0.1

通过最多 30 个跃点跟踪到 192.168.0.1 的路由

  1     1 ms     1 ms     1 ms  OpenWrt.lan [192.168.1.1]
  2  1006 ms  2723 ms     2 ms  192.168.0.1

跟踪完成。

之前有介绍在Centos5下安装kingate代理服务器，在Centos6下同样安装kingate在编译时遇到以下错误：

#https://www.haiyun.me
make[2]: *** [KDnsCache.o] Error 1
make[2]: Leaving directory `/root/workspace/proxy/kingate-2.1/src'
make[1]: *** [all] Error 2
make[1]: Leaving directory `/root/workspace/proxy/kingate-2.1/src'
make: *** [all-recursive] Error 1
make[2]: *** [mysocket.o] Error 1
make[2]: Leaving directory `/root/workspace/proxy/kingate-2.1/src'
make[1]: *** [all] Error 2
make[1]: Leaving directory `/root/workspace/proxy/kingate-2.1/src'
make: *** [all-recursive] Error 1

编辑src/KDnsCache.cpp文件，头部添加：

#include <string.h>

编辑src/mysocket.cpp头部添加

#include <malloc.h>

Puppet在同步时遇到以下错误：

notice: Run of Puppet configuration client already in progress; skipping

删除puppetdlock重试解决：

rm /var/lib/puppet/state/puppetdlock

CentOS安装所需组件：

yum -y install mercurial pam-devel

安装Google Authenticator：

#https://www.haiyun.me
wget --no-check-certificate https://google-authenticator.googlecode.com/files/libpam-google-authenticator-1.0-source.tar.bz2
tar jxvf libpam-google-authenticator-1.0-source.tar.bz2 
cd libpam-google-authenticator-1.0
make
make install

SSH登录时调用google-authenticator模块，编辑：

/etc/pam.d/sshd

第一行添加：

auth       required     pam_google_authenticator.so

修改SSH配置文件：

vim /etc/ssh/sshd_config

添加或修改以下内容：

ChallengeResponseAuthentication yes
UsePAM yes

重启SSH：

/etc/init.d/sshd restart

生成google-authenticator配置，运行：

google-authenticator 
Do you want authentication tokens to be time-based (y/n) y
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@node1.www.haiyun.me%3Fsecret%3DABEXG5K6CVB56BXY
#此网址为生成的二维码，客户端扫描
Your new secret key is: www.haiyun.me
Your verification code is 582849
Your emergency scratch codes are:
  30776626
  14200155
  80795568
  23936997
  21919909
#上面几行数字为应急码
Do you want me to update your "/root/.google_authenticator" file (y/n) y
#更新配置文件
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
#禁止一个口令多用
By default, tokens are good for 30 seconds and in order to compensate for
possible time-skew between the client and the server, we allow an extra
token before and after the current time. If you experience problems with poor
time synchronization, you can increase the window from its default
size of 1:30min to about 4min. Do you want to do so (y/n) n
#客户端与服务器时间误差
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting (y/n) y
#次数限制

Android安装google-authenticator客户端，扫描添加上方网址的二维码，以后在登录服务器时输入账号密码的同时还需输入google-authenticator即时生成的验证码才能登录。

ssh www.haiyun.me
Verification code: 
Password: 

一般服务器为安全禁止ssh下root账号登录，此时使用sftp登录管理服务器只能使用普通账号登录，给管理带来诸多不便，可以设置为特定普通SSH用户添加sudo权限，登录到sftp时可sudo切换到root权限下。
查看sftp-server执行文件目录：

cat /etc/ssh/sshd_config|grep sftp
Subsystem    sftp    /usr/libexec/openssh/sftp-server

编辑/etc/sudoers为特定用户添加执行sftp sudo权限：

#https://www.haiyun.me
user ALL=NOPASSWD:  /usr/libexec/openssh/sftp-server

后续如果登录失败日记显示：

sorry, you must have a tty to run sudo ; TTY=unknown

需在/etc/sudoers内注释此行：

#Defaults    requiretty  

sftp客户端设置登录以sudo权限执行sftp，下图以winscp为例：

sudo /usr/libexec/openssh/sftp-server

此时用winscp登录就是root权限了，对整个系统的文件都拥有生杀大权。。。