The Monkey Business
Monkey Business
Convert .p12 bundle to server certificate and key files
Seperate Private Key and Certificate file
#Generate certificates bundle file
openssl pkcs12 -nokeys -in server-cert-key-bundle.p12 -out server-ca-cert-bundle.pem
#Generate server key file.
openssl pkcs12 -nocerts -nodes -in server-cert-key-bundle.p12 -out server.key
Convert a PKCS#12 file (.pfx .p12) containing a private key and certificates to PEM
openssl pkcs12 -in keyStore.pfx -out keyStore.pem -nodes
Create a .pfx/.p12 certificate file using OpenSSL
openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt
Src: https://www.sslshopper.com/article-most-common-openssl-commands.html
Installer for jitsi-meet, jigasi and jibri
Found this lovely code base (that actually worked) on github, supported on a debian 10/11 or ubuntu 20+ versions-
The script (jitsi_setup.sh) can be used to install stable version of all 3 on a stand-alone server. This is simply a script version of quick-install document at https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-quickstart
It Installs below mentioned software:
nginx, prosody, jitsi-meet-prosody, jitsi-meet, jitsi-meet-web, jitsi-meet-web-config, jitsi-meet-turnserver, jicofo, jitsi-videobridge2
Below are optional, will be installed only if opted for:
jigasi (https://github.com/jitsi/jigasi)
jibri (https://github.com/jitsi/jibri)
Also has option for configuring:
- secure domain (https://jitsi.github.io/handbook/docs/devops-guide/secure-domain)
- jigasi authentication (find it towards the end of secure domain link)
- transcription(Google/Vosk) (https://github.com/jitsi/jigasi#configuring-sip-and-transcription)
- Etherpad (https://github.com/ether/etherpad-lite)
Continue reading “Installer for jitsi-meet, jigasi and jibri” »
Mount CDROM to Pfsense
- Go to a shell.
- Make a directory to mount the CD at:
mkdir /tmp/cdrom - Mount the CD:
mount_cd9660 /dev/acd0 /tmp/cdrom or mount_cd9660 /dev/cd0 /tmp/cdrom - CD is now mounted at /tmp/cdrom. When finished unmount:
umount /tmp/cdrom
* Note: If your cdrom device is not acd0, check the bootup messages for the proper device.
Running pfSense in a XenServer with xenguest
If you deploy pfSense on a XenServer, you may be shocked at the performance loss-specially on interface speed! But wait, there are some tweaks to make this usable.
Installing pfSense
Go ahead and setup pfSense like normal, and when you are done, perform the following tweaks. (the day till it’s tested on pfsense version 2.5.2 and xen on scp-ng 8.1)
XenServer tweaks
Find UUID for the pfSense VM you just installed.
xe vm-list
You should get something like the following
uuid ( RO) : b435d920-eb22-b45d-5058-091619ed427f name-label ( RW): pfSense power-state ( RO): running uuid ( RO) : 42626f69-6185-4aa6-a125-839700f96828 name-label ( RW): Control domain on host: xenserver-000 power-state ( RO): running
We want the UUID of the instance running pfSense, b435d920-eb22-b45d-5058-091619ed427f in this case. Continue reading “Running pfSense in a XenServer with xenguest” »
Build WAF with Reverse Proxy Load Balancer using Nginx
Getting Started
First, it is recommended to update and upgrade all your software packages to the latest version. You can update all of them by running the following command:
apt update -y apt upgrade -y
Once all the packages are updated, install other required packages with the following command:
apt install g++ flex bison curl apache2-dev doxygen libyajl-dev ssdeep liblua5.2-dev libgeoip-dev libtool dh-autoreconf libcurl4-gnutls-dev libxml2 libpcre++-dev libxml2-dev git liblmdb-dev libpkgconf3 lmdb-doc pkgconf zlib1g-dev libssl-dev -y
Once you are done, you can proceed to the next step.
Install ModSecurity on Ubuntu 22.04
By default, the ModSecurity package is not included in the Ubuntu default repository. So you will need to compile it from the source.
First, download the latest version of ModSecurity with the following command:
wget https://github.com/SpiderLabs/ModSecurity/releases/download/v3.0.8/modsecurity-v3.0.8.tar.gz
Once the download is completed, extract the downloaded file with the following command:
tar -xvzf modsecurity-v3.0.8.tar.gz
Next, navigate to the extracted directory and configure it with the following command: Continue reading “Build WAF with Reverse Proxy Load Balancer using Nginx” »
M3U Restream
There’s a wonderful piece of microservice node.js based restream utility, that let you re-stream from a source and also do the ffmped transcoding if you’d like. I just liked the piece!
My installed OS was Ubuntu 18.x and I used node version 12.x.
The problem
You have an IPTV provider that provides an (extended) M3U playlist file. You want to:
- Add HTTPS encryption to the streams (and probably move the unencrypted reception offsite).
- Transcode the streams to a lower bitrate, or convert to a uniform video or audio format.
The solution
Run this software, preferably on an offsite host. It only requires a Node installation (No NPM modules are required!). To add HTTPS support, front it with nginx (or similar). Continue reading “M3U Restream” »
Install Discourse on Ubuntu 20.04
Secure the Server
Turn on automatic security updates.
$ sudo dpkg-reconfigure -plow unattended-upgrades
Setup a firewall with ufw.
$ sudo apt-get install ufw $ sudo ufw default allow outgoing $ sudo ufw default deny incoming $ sudo ufw allow 22 comment 'SSH' $ sudo ufw allow http comment 'HTTP' $ sudo ufw allow https comment 'HTTPS' $ sudo ufw enable
Install fail2ban to secure your server
$ sudo apt install fail2ban
Configure fail2ban to Use ufw
Copy the main configuration to avoid unexpected changes during package updates.
$ sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Edit the configuration file with your favorite text editor
$ sudo nano /etc/fail2ban/jail.local
Change the banaction and banaction_allports settings to ufw in the file /etc/fail2ban/jail.local as follows: Continue reading “Install Discourse on Ubuntu 20.04” »
Monitor Service Port if Down execute a Bash Script
#!/bin/bash
HOST_NAME="127.0.0.1"
HOST_PORT="1656"
if ( (exec 3<>/dev/tcp/${HOST_NAME}/${HOST_PORT}) 2> /dev/null); then
echo -e "PORT: ${HOST_PORT} | ON"
else
cd /home/rumi/my-app/ && `node service.js`
fi
exit;
Cacti user creation with specific graphs permission
As an admin of cacti you can anything and everything. However, at certain times, you need to create restricted user who has access to only certain graphs of the cacti system. So here goes the steps (this is based on cacti version 1.2.21)-
From left menu select Configuration > Users
Continue reading “Cacti user creation with specific graphs permission” »
Set Up a Radius Server on pfSense
Installing the Package
The pfSense 2.X package manager includes both FreeRadius and FreeRadius2 as installation options. For this example, I’m going to be using FreeRadius2 since it has some additional features not found in the previous version.
Only one version of radius can be installed on pfSense at a time. If you previously installed any radius packages, go ahead and remove them first.
The package installation will briefly interrupt traffic passing through the router as the service starts, so be careful when running the installation on a production system.
- Open the package manager in the system menu of the web interface.
- Click the plus symbol next to FreeRadius2 to begin the installation.
- Click ‘Ok’ to confirm the package installation.
You cannot run both FreeRadius and FreeRadius2 on the same pfSense system. Make sure to remove one before installing the other. The setup process will automatically download and install the radius package along with all of its dependencies. The installation normally takes a couple of minutes to complete.
After it’s finished, there will be a new menu item for the package in the services menu. The FreeRadius installation normally takes a couple minutes to complete. Continue reading “Set Up a Radius Server on pfSense” »
Mapping drives with Windows for Nextcloud
To map a drive using the Microsoft Windows Explorer:
- Open Windows Explorer on your MS Windows computer.
- Right-click on Computer entry and select Map network drive… from the drop-down menu.
- Choose a local network drive to which you want to map Nextcloud.
- Specify the address to your Nextcloud instance, followed by /remote.php/dav/files/USERNAME/. For example:
- https://example.com/nextcloud/remote.php/dav/files/USERNAME/
- Click the Finish button.
Windows Explorer maps the network drive, making your Nextcloud instance available
Note
For SSL protected servers, check Reconnect at sign-in to ensure that the mapping is persistent upon subsequent reboots. If you want to connect to the Nextcloud server as a different user, check Connect using different credentials.