September 2017 – 一江春水向东流

openvpn服务器防火墙设置

# sample configuration for iptables service
# # you can edit this manually or use system-config-firewall
# # please do not ask us to add additional ports/services to this default configuration
#################
#     NAT       #
#################
*nat
:PREROUTING ACCEPT [27:11935]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [598:57368]
:POSTROUTING ACCEPT [591:57092]
:DOCKER - [0:0]

#所有内网服务器通过本机上网
#-A POSTROUTING -s 10.x.x.0/24 -p tcp -j SNAT --to-source 0.x.x.x

#OpenVPN
-A POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE

#-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
#-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
#-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
COMMIT

#################
#     filter    #
#################
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
#:DOCKER - [0:0]

# 这里对已经建立连接的包直接放行，以提高iptables 效率(此条规则通常放在第一条)
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#允许ping
-A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

#本机设备放行
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
-A OUTPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT


#开放sshd服务
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

#为内网机器上网转发
#-A FORWARD -i eth0 -d 10.x.x.0/24 -j ACCEPT
#docker
#-A INPUT -m state --state NEW -m tcp -p tcp --dport 139291:461018923 -j ACCEPT
#-A FORWARD -o docker0 -j DOCKER
#-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
#-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
#-A FORWARD -i docker0 -o docker0 -j ACCEPT

#openvpn
-A INPUT -i eth0 -m state --state NEW -p tcp --dport 1194 -j ACCEPT
-A OUTPUT -p tcp --sport 1194 -m state --state ESTABLISHED -j ACCEPT
#openvpn web ui
-A INPUT -i eth0 -m state --state NEW -p tcp --dport 8080 -j ACCEPT
-A OUTPUT -p tcp --sport 8080 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o tun+ -j ACCEPT

#SMTP
#-A INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
#允许 80 443 端口，http 和 https
-A INPUT -i eth0 -m state --state NEW -p tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -m state --state NEW -p tcp --sport 80 -j ACCEPT
-A OUTPUT -p tcp --sport 80 -j ACCEPT
-A OUTPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -m state --state NEW -p tcp --dport 443 -j ACCEPT
-A INPUT -i eth0 -m state --state NEW -p tcp --sport 443 -j ACCEPT
-A OUTPUT -p tcp --sport 443 -j ACCEPT
-A OUTPUT -p tcp --dport 443 -j ACCEPT
#dns
-A OUTPUT -p udp --dport 53 -j ACCEPT
-A INPUT -p udp --sport 53 -j ACCEPT
-A INPUT -p udp --dport 53 -j ACCEPT
-A OUTPUT -p udp --sport 53 -j ACCEPT
#---ganglia的端口----
#ganglia展示web界面、解释php用的apache
-A INPUT -m state --state NEW -m tcp -p tcp --dport 81 -j ACCEPT
-A OUTPUT -p tcp --sport 81 -m state --state ESTABLISHED -j ACCEPT
#ganglia gmond的端口
-A INPUT -p tcp -m multiport --dport 8649:8652 -j ACCEPT
-A OUTPUT -p tcp -m multiport --sport 8649:8652 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dport 8649:8652 -j ACCEPT
-A OUTPUT -p udp -m multiport --sport 8649:8652 -m state --state ESTABLISHED -j ACCEPT
#falcon-agent sent
-A OUTPUT -p tcp --dport 6030 -j ACCEPT
-A OUTPUT -p tcp --dport 8433 -j ACCEPT
-A INPUT -s 10.x.x.x -p tcp --dport 1988 -j ACCEPT

#nagios的端口
#-A INPUT -p udp -m multiport --dport 5666,12489 -j ACCEPT
#-A OUTPUT -p tcp -m multiport --sport 5666:12489 -m state --state ESTABLISHED -j ACCEPT

###TCP ports for FreeIPA
#-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
#-A INPUT -m state --state NEW -m tcp -p tcp --dport 443  -j ACCEPT
#-A INPUT -m state --state NEW -m tcp -p tcp --dport 389 -j ACCEPT
#-A INPUT -m state --state NEW -m tcp -p tcp --dport 636 -j ACCEPT
#-A INPUT -m state --state NEW -m tcp -p tcp --dport 88  -j ACCEPT
#-A INPUT -m state --state NEW -m tcp -p tcp --dport 464  -j ACCEPT
#-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
###UDP ports for FreeIPA
#-A INPUT -m state --state NEW -m udp -p udp --dport 88 -j ACCEPT
#-A INPUT -m state --state NEW -m udp -p udp --dport 464 -j ACCEPT
#-A INPUT -m state --state NEW -m udp -p udp --dport 123 -j ACCEPT
#-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT
#
##nexus yum
#-A INPUT -m state --state NEW -m tcp -p tcp  --dport 8081 -j ACCEPT

#pptp
#-A INPUT -m state --state NEW -m tcp -p tcp  --dport 1723 -j ACCEPT


#处理IP碎片数量,防止攻击,允许每秒100个
-A FORWARD -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT
#允许来自外部的ping测试
#-A INPUT -p icmp --icmp-type echo-request -j ACCEPT
#禁止ping
-A INPUT -p icmp -i eth0 -j DROP
#设置ICMP包过滤,允许每秒1个包,限制触发条件是10个包
-A FORWARD -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT

##允许登录者
#sean's home
#-A INPUT -s x.x.x.x -m state --state NEW -m tcp -p tcp -j ACCEPT

####################
#DROP RULL
####################
#丢弃坏的TCP包
#-A FORWARD -p TCP ! --syn -m state --state NEW -j DROP

# Reject spoofed packets
-A INPUT -s 169.254.0.0/16 -j DROP
-A INPUT -s 172.16.0.0/12 -j DROP
-A INPUT -s 127.0.0.0/8 -j DROP

-A INPUT -s 224.0.0.0/4 -j DROP
-A INPUT -d 224.0.0.0/4 -j DROP
-A INPUT -s 240.0.0.0/5 -j DROP
-A INPUT -d 240.0.0.0/5 -j DROP
-A INPUT -s 0.0.0.0/8 -j DROP
-A INPUT -d 0.0.0.0/8 -j DROP
-A INPUT -d 239.255.255.0/24 -j DROP
-A INPUT -d 255.255.255.255 -j DROP

# Stop smurf attacks
-A INPUT -p icmp -m icmp --icmp-type address-mask-request -j DROP
-A INPUT -p icmp -m icmp --icmp-type timestamp-request -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -j DROP

# Drop all invalid packets
-A INPUT -m state --state INVALID -j DROP
#-A FORWARD -m state --state INVALID -j DROP
-A OUTPUT -m state --state INVALID -j DROP
-A INPUT -m conntrack --ctstate INVALID -j DROP
#drop 3128端口是 squid 的默认端口
-A INPUT -p tcp --dport 3128 -j DROP
# Drop excessive RST packets to avoid smurf attacks
-A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/second --limit-burst 2 -j ACCEPT

# Attempt to block portscans
# Anyone who tried to portscan us is locked out for an entire day.
-A INPUT   -m recent --name portscan --rcheck --seconds 86400 -j DROP
-A FORWARD -m recent --name portscan --rcheck --seconds 86400 -j DROP

# Once the day has passed, remove them from the portscan list
-A INPUT   -m recent --name portscan --remove
-A FORWARD -m recent --name portscan --remove

# These rules add scanners to the portscan list, and log the attempt.
-A INPUT   -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "Portscan:"
-A INPUT   -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP

-A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "Portscan:"
-A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP


#禁止其他未允许的规则访问
#-A INPUT -j REJECT --reject-with icmp-host-prohibited
#-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A INPUT -j DROP
-A OUTPUT -j DROP
-A FORWARD -j DROP

COMMIT

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

# sample configuration for iptables service

# # you can edit this manually or use system-config-firewall

# # please do not ask us to add additional ports/services to this default configuration

#################

# NAT #

#################

*nat

:PREROUTING ACCEPT [27:11935]

:INPUT ACCEPT [0:0]

:OUTPUT ACCEPT [598:57368]

:POSTROUTING ACCEPT [591:57092]

:DOCKER - [0:0]

#所有内网服务器通过本机上网

#-A POSTROUTING -s 10.x.x.0/24 -p tcp -j SNAT --to-source 0.x.x.x

#OpenVPN

-A POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE

#-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER

#-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER

#-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE

COMMIT

#################

# filter #

#################

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

#:DOCKER - [0:0]

# 这里对已经建立连接的包直接放行，以提高iptables 效率(此条规则通常放在第一条)

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#允许ping

-A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

#本机设备放行

-A INPUT -i lo -j ACCEPT

-A OUTPUT -o lo -j ACCEPT

-A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT

-A OUTPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT

#开放sshd服务

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

-A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

#为内网机器上网转发

#-A FORWARD -i eth0 -d 10.x.x.0/24 -j ACCEPT

#docker

#-A INPUT -m state --state NEW -m tcp -p tcp --dport 139291:461018923 -j ACCEPT

#-A FORWARD -o docker0 -j DOCKER

#-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

#-A FORWARD -i docker0 ! -o docker0 -j ACCEPT

#-A FORWARD -i docker0 -o docker0 -j ACCEPT

#openvpn

-A INPUT -i eth0 -m state --state NEW -p tcp --dport 1194 -j ACCEPT

-A OUTPUT -p tcp --sport 1194 -m state --state ESTABLISHED -j ACCEPT

#openvpn web ui

-A INPUT -i eth0 -m state --state NEW -p tcp --dport 8080 -j ACCEPT

-A OUTPUT -p tcp --sport 8080 -m state --state ESTABLISHED -j ACCEPT

-A INPUT -i tun+ -j ACCEPT

-A FORWARD -i tun+ -j ACCEPT

-A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT

-A OUTPUT -o tun+ -j ACCEPT

#SMTP

#-A INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT

#允许 80 443 端口，http 和 https

-A INPUT -i eth0 -m state --state NEW -p tcp --dport 80 -j ACCEPT

-A INPUT -i eth0 -m state --state NEW -p tcp --sport 80 -j ACCEPT

-A OUTPUT -p tcp --sport 80 -j ACCEPT

-A OUTPUT -p tcp --dport 80 -j ACCEPT

-A INPUT -i eth0 -m state --state NEW -p tcp --dport 443 -j ACCEPT

-A INPUT -i eth0 -m state --state NEW -p tcp --sport 443 -j ACCEPT

-A OUTPUT -p tcp --sport 443 -j ACCEPT

-A OUTPUT -p tcp --dport 443 -j ACCEPT

#dns

-A OUTPUT -p udp --dport 53 -j ACCEPT

-A INPUT -p udp --sport 53 -j ACCEPT

-A INPUT -p udp --dport 53 -j ACCEPT

-A OUTPUT -p udp --sport 53 -j ACCEPT

#---ganglia的端口----

#ganglia展示web界面、解释php用的apache

-A INPUT -m state --state NEW -m tcp -p tcp --dport 81 -j ACCEPT

-A OUTPUT -p tcp --sport 81 -m state --state ESTABLISHED -j ACCEPT

#ganglia gmond的端口

-A INPUT -p tcp -m multiport --dport 8649:8652 -j ACCEPT

-A OUTPUT -p tcp -m multiport --sport 8649:8652 -m state --state ESTABLISHED -j ACCEPT

-A INPUT -p udp -m multiport --dport 8649:8652 -j ACCEPT

-A OUTPUT -p udp -m multiport --sport 8649:8652 -m state --state ESTABLISHED -j ACCEPT

#falcon-agent sent

-A OUTPUT -p tcp --dport 6030 -j ACCEPT

-A OUTPUT -p tcp --dport 8433 -j ACCEPT

-A INPUT -s 10.x.x.x -p tcp --dport 1988 -j ACCEPT

#nagios的端口

#-A INPUT -p udp -m multiport --dport 5666,12489 -j ACCEPT

#-A OUTPUT -p tcp -m multiport --sport 5666:12489 -m state --state ESTABLISHED -j ACCEPT

###TCP ports for FreeIPA

#-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

#-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT

#-A INPUT -m state --state NEW -m tcp -p tcp --dport 389 -j ACCEPT

#-A INPUT -m state --state NEW -m tcp -p tcp --dport 636 -j ACCEPT

#-A INPUT -m state --state NEW -m tcp -p tcp --dport 88 -j ACCEPT

#-A INPUT -m state --state NEW -m tcp -p tcp --dport 464 -j ACCEPT

#-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT

###UDP ports for FreeIPA

#-A INPUT -m state --state NEW -m udp -p udp --dport 88 -j ACCEPT

#-A INPUT -m state --state NEW -m udp -p udp --dport 464 -j ACCEPT

#-A INPUT -m state --state NEW -m udp -p udp --dport 123 -j ACCEPT

#-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT

##nexus yum

#-A INPUT -m state --state NEW -m tcp -p tcp --dport 8081 -j ACCEPT

#pptp

#-A INPUT -m state --state NEW -m tcp -p tcp --dport 1723 -j ACCEPT

#处理IP碎片数量,防止攻击,允许每秒100个

-A FORWARD -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT

#允许来自外部的ping测试

#-A INPUT -p icmp --icmp-type echo-request -j ACCEPT

#禁止ping

-A INPUT -p icmp -i eth0 -j DROP

#设置ICMP包过滤,允许每秒1个包,限制触发条件是10个包

-A FORWARD -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT

##允许登录者

#sean's home

#-A INPUT -s x.x.x.x -m state --state NEW -m tcp -p tcp -j ACCEPT

####################

#DROP RULL

####################

#丢弃坏的TCP包

#-A FORWARD -p TCP ! --syn -m state --state NEW -j DROP

# Reject spoofed packets

-A INPUT -s 169.254.0.0/16 -j DROP

-A INPUT -s 172.16.0.0/12 -j DROP

-A INPUT -s 127.0.0.0/8 -j DROP

-A INPUT -s 224.0.0.0/4 -j DROP

-A INPUT -d 224.0.0.0/4 -j DROP

-A INPUT -s 240.0.0.0/5 -j DROP

-A INPUT -d 240.0.0.0/5 -j DROP

-A INPUT -s 0.0.0.0/8 -j DROP

-A INPUT -d 0.0.0.0/8 -j DROP

-A INPUT -d 239.255.255.0/24 -j DROP

-A INPUT -d 255.255.255.255 -j DROP

# Stop smurf attacks

-A INPUT -p icmp -m icmp --icmp-type address-mask-request -j DROP

-A INPUT -p icmp -m icmp --icmp-type timestamp-request -j DROP

-A INPUT -p icmp -m icmp --icmp-type 8 -j DROP

# Drop all invalid packets

-A INPUT -m state --state INVALID -j DROP

#-A FORWARD -m state --state INVALID -j DROP

-A OUTPUT -m state --state INVALID -j DROP

-A INPUT -m conntrack --ctstate INVALID -j DROP

#drop 3128端口是 squid 的默认端口

-A INPUT -p tcp --dport 3128 -j DROP

# Drop excessive RST packets to avoid smurf attacks

-A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/second --limit-burst 2 -j ACCEPT

# Attempt to block portscans

# Anyone who tried to portscan us is locked out for an entire day.

-A INPUT -m recent --name portscan --rcheck --seconds 86400 -j DROP

-A FORWARD -m recent --name portscan --rcheck --seconds 86400 -j DROP

# Once the day has passed, remove them from the portscan list

-A INPUT -m recent --name portscan --remove

-A FORWARD -m recent --name portscan --remove

# These rules add scanners to the portscan list, and log the attempt.

-A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "Portscan:"

-A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP

-A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "Portscan:"

-A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP

#禁止其他未允许的规则访问

#-A INPUT -j REJECT --reject-with icmp-host-prohibited

#-A FORWARD -j REJECT --reject-with icmp-host-prohibited

-A INPUT -j DROP

-A OUTPUT -j DROP

-A FORWARD -j DROP

COMMIT

By sean, 7 years09/28/2017 ago

centos用 yum 方式安装 nodejs 和 npm

centos用 yum 方式安装 nodejs 和 npm 要通过 yum 来安装 nodejs 和 npm 需要先给 yum 添加 epel 源，添加方法在 centos 添加epel和remi源中安装完成后,执行

yum -y install nodejs npm --enablerepo=epel

1	yum -y install nodejs npm --enablerepo=epel

注：centos 添加 epel 和 remi 源添加 epel 源 64位:

rpm -ivh http://download.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

1 2	rpm -ivh http://download.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

32位:

rpm -ivh http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm

1 2	rpm -ivh http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm

导入 key:

rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-6

1 2	rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-6

添加 remi 源

 rpm -ivh http://rpms.famillecollet.com/enterprise/remi-release-6.rpm
 rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-remi

1 2	rpm -ivh http://rpms.famillecollet.com/enterprise/remi-release-6.rpm rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-remi

问题解决： yum 安装完node版本是6.17.1，通过npm install –registry=https://registry.npm.taobao.org 安装时会报以下错误： fetchMetadata: Read more…

By sean, 7 years09/21/2017 ago

安装ipa-client错误：kinit: Clients credentials have been revoked while getting initial credentials

安装ipa-client时，遇到如下错误：

[root@log1-prod-iuap-yycloud scripts]# ipa-client-install --mkhomedir --enable-dns-updates --force-join --principal=admin --password=xxxxxx -U
Discovery was successful!
Client hostname: log1-prod-iuap-yycloud.yonyouiuap.com
Realm: YONYOUIUAP.COM
DNS Domain: yonyouiuap.com
IPA Server: freeipa4-iuap-hb2-ali.yonyouiuap.com
BaseDN: dc=yonyouiuap,dc=com

Synchronizing time with KDC...
Attempting to sync time using ntpd.  Will timeout after 15 seconds
Please make sure the following ports are opened in the firewall settings:
     TCP: 80, 88, 389
     UDP: 88 (at least one of TCP/UDP ports 88 has to be open)
Also note that following ports are necessary for ipa-client working properly after enrollment:
     TCP: 464
     UDP: 464, 123 (if NTP enabled)
Kerberos authentication failed: kinit: Clients credentials have been revoked while getting initial credentials

Installation failed. Rolling back changes.
IPA client is not configured on this system.

[root@log1-prod-iuap-yycloud scripts]# ipa-client-install --mkhomedir --enable-dns-updates --force-join --principal=admin --password=xxxxxx -U

Discovery was successful!

Client hostname: log1-prod-iuap-yycloud.yonyouiuap.com

Realm: YONYOUIUAP.COM

DNS Domain: yonyouiuap.com

IPA Server: freeipa4-iuap-hb2-ali.yonyouiuap.com

BaseDN: dc=yonyouiuap,dc=com

Synchronizing time with KDC...

Attempting to sync time using ntpd. Will timeout after 15 seconds

Please make sure the following ports are opened in the firewall settings:

TCP: 80, 88, 389

UDP: 88 (at least one of TCP/UDP ports 88 has to be open)

Also note that following ports are necessary for ipa-client working properly after enrollment:

TCP: 464

UDP: 464, 123 (if NTP enabled)

Kerberos authentication failed: kinit: Clients credentials have been revoked while getting initial credentials

Installation failed. Rolling back changes.

IPA client is not configured on this system.

执行kinit admin:

[sean@middlewaredocker1-iuap-hb2-ali ~]$ kinit admin
kinit: Clients credentials have been revoked while getting initial credentials

1 2	[sean@middlewaredocker1-iuap-hb2-ali ~]$ kinit admin kinit: Clients credentials have been revoked while getting initial credentials

去ipa server端查询：

[root@freeipa4-iuap-hb2-ali sean]# ipa user-status admin
-----------------------
Account disabled: False
-----------------------
  Server: freeipa3-iuap-hb2-ali.yonyouiuap.com
  Failed logins: 6
  Last successful authentication: 20170918090442Z
  Last failed authentication: 20170918115216Z
  Time now: 2017-09-18T12:04:36Z

  Server: freeipa1-iuap-hb2-ali.yonyouiuap.com failed: Server is unwilling to perform: Too many failed logins.

  Server: freeipa4-iuap-hb2-ali.yonyouiuap.com
  Failed logins: 0
  Last successful authentication: 20170918120436Z
  Last failed authentication: 20170918115237Z
  Time now: 2017-09-18T12:04:36Z
----------------------------
Number of entries returned 3
----------------------------

[root@freeipa4-iuap-hb2-ali sean]# ipa user-status admin

-----------------------

Account disabled: False

-----------------------

Server: freeipa3-iuap-hb2-ali.yonyouiuap.com

Failed logins: 6

Last successful authentication: 20170918090442Z

Last failed authentication: 20170918115216Z

Time now: 2017-09-18T12:04:36Z

Server: freeipa1-iuap-hb2-ali.yonyouiuap.com failed: Server is unwilling to perform: Too many failed logins.

Server: freeipa4-iuap-hb2-ali.yonyouiuap.com

Failed logins: 0

Last successful authentication: 20170918120436Z

Last failed authentication: 20170918115237Z

Time now: 2017-09-18T12:04:36Z

----------------------------

Number of entries returned 3

----------------------------

原来是尝试次数过多（默认6次）被锁了解锁一下：

----------------------------
[root@freeipa4-iuap-hb2-ali sean]# ipa user-unlock admin
------------------------
Unlocked account "admin"
------------------------
[root@freeipa4-iuap-hb2-ali sean]# ipa user-status admin
-----------------------
Account disabled: False
-----------------------
  Server: freeipa3-iuap-hb2-ali.yonyouiuap.com
  Failed logins: 0
  Last successful authentication: 20170922031611Z
  Last failed authentication: 20170918123414Z
  Time now: 2017-09-22T03:16:12Z

  Server: freeipa1-iuap-hb2-ali.yonyouiuap.com
  Failed logins: 0
  Last successful authentication: 20170922031612Z
  Last failed authentication: 20170918123627Z
  Time now: 2017-09-22T03:16:12Z

  Server: freeipa4-iuap-hb2-ali.yonyouiuap.com
  Failed logins: 0
  Last successful authentication: 20170922031611Z
  Last failed authentication: 20170918123621Z
  Time now: 2017-09-22T03:16:12Z
----------------------------
Number of entries returned 3
----------------------------

----------------------------

[root@freeipa4-iuap-hb2-ali sean]# ipa user-unlock admin

------------------------

Unlocked account "admin"

------------------------

[root@freeipa4-iuap-hb2-ali sean]# ipa user-status admin

-----------------------

Account disabled: False

-----------------------

Server: freeipa3-iuap-hb2-ali.yonyouiuap.com

Failed logins: 0

Last successful authentication: 20170922031611Z

Last failed authentication: 20170918123414Z

Time now: 2017-09-22T03:16:12Z

Server: freeipa1-iuap-hb2-ali.yonyouiuap.com

Failed logins: 0

Last successful authentication: 20170922031612Z

Last failed authentication: 20170918123627Z

Time now: 2017-09-22T03:16:12Z

Server: freeipa4-iuap-hb2-ali.yonyouiuap.com

Failed logins: 0

Last successful authentication: 20170922031611Z

Last failed authentication: 20170918123621Z

Time now: 2017-09-22T03:16:12Z

----------------------------

Number of entries returned 3

----------------------------

再次安装ipa-client，成功。

By sean, 7 years09/18/2017 ago

docker内置dnsserver工作机制环境测试环境为docker社区版本17.03。 docker容器的网络命名空间默认无法通过ip netns命令查询到，因此有两种办法。都需要通过docker inspect -f "{{.State.Pid}}" <container_id>找到容器的初始进程开始。通过ln -s /proc/<pid>/ns/net /var/run/ns/<container_id>，将命名空间暴漏在ip netns下，继续后续操作。本文就采用这种办法，好处就是可以利用容器中没有而主机上有的命令行。通过nsenter –target <pid> –mount –uts –ipc –net –pid进入容器命名空间，再执行操作。原理介绍容器的dns解析顺序容器中的DNS名称解析优先级顺序为：内置DNS服务器127.0.0.11。通过–dns等参数为容器配置的DNS服务器。 docker守护进程的–dns服务配置（默认为8.8.8.8和8.8.4.4）宿主机上的DNS设置。 docker dns server工作机制 1）一般情况下，使用docker网络的容器的dns服务器是127.0.0.11。如下图所示： 2）通过命令查看容器内的iptables规则。如下图所示：可以发现到127.0.0.11的53端口的dns请求，被转发到了43747端口。那么这个端口是被什么程序监听的呢？ 3）在容器的网络命令空间中，可以通过命令netstat -ntlp查到监听这个端口的程序，如下图所示： docker containerd进程上了，它会向内部存储做查询，返回dns的查询结果。如果容器中有netstat命令行，由于进程空间隔离的原因，直接在容器中查询监听端口时，会出现对应进程为-的输出，只能在主机上执行才可以。

By sean, 7 years ago

未分类

linux shell 编程 – 特殊符号总结

$# 传递到脚本的参数个数 $* 以一个单字符串显示所有向脚本传递的参数 $$ 脚本运行的当前进程ID号 $! 后台运行的最后一个进程的ID号 $@ 与 $* 相同，但是使用时加引号，并在引号中返回每个参数。 $- 显示Shell使用的当前选项，与set命令功能相同。 $? 显示最后命令的退出状态。0表示没有错误，其他任何值表明有错误。 $0 Shell本身的文件名 $1～$n 添加到Shell的各参数值。$1是第1参数、$2是第2参数…。 [ -f “somefile” ] ：判断是否是一个文件 [ -x “/bin/ls” ] ：判断/bin/ls是否存在并有可执行权限 [ -n “$var” ] ：判断$var变量是否有值 [ “$a” = “$b” ] ：判断$a和$b是否相等 -r file　　　　　用户可读为真 -w file　　　　　用户可写为真 -x file　　　　　用户可执行为真 -f file　　　　　文件为正规文件为真 -d file　　　　　文件为目录为真 -c file　　　　　文件为字符特殊文件为真 -b Read more…

By sean, 7 years ago

未分类

spf13-vim编辑文件颜色不高亮显示解决办法

spf13-vim编辑有些文件时颜色不高亮显示的解决办法: 方法一: 将~/.vimviews/文件夹下清空方法二: 设置一下文件类型 :set filetype=sh

By sean, 7 years09/08/2017 ago

未分类

shadowssocks出现 500 Internal Privoxy Error 错误解决

Recently， my VPS install shadowsocks and connected and throw a error 500 Internal Privoxy Error , thanks. The vps is Linode. 最近 shadowssocks 经常出现 500 Internal Privoxy Error 错误，怎么解决，谢谢。解决：关闭shadowsocks客户端，清空系统临时文件(ccleaner)，C:\Users\shang\AppData\Local/Temp https://www.bountysource.com/issues/39146684-sometimes-500-internal-privoxy-error

By sean, 7 years09/04/2017 ago