Convert .p12 bundle to server certificate and key files

Seperate Private Key and Certificate file

#Generate certificates bundle file

openssl pkcs12 -nokeys -in server-cert-key-bundle.p12 -out server-ca-cert-bundle.pem

#Generate server key file.

openssl pkcs12 -nocerts -nodes -in server-cert-key-bundle.p12 -out server.key

Convert a PKCS#12 file (.pfx .p12) containing a private key and certificates to PEM

openssl pkcs12 -in keyStore.pfx -out keyStore.pem -nodes

Create a .pfx/.p12 certificate file using OpenSSL

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt

Src: https://www.sslshopper.com/article-most-common-openssl-commands.html

Share

Installer for jitsi-meet, jigasi and jibri

Found this lovely code base (that actually worked) on github, supported on a debian 10/11 or ubuntu 20+ versions-

The script (jitsi_setup.sh) can be used to install stable version of all 3 on a stand-alone server. This is simply a script version of quick-install document at https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-quickstart

It Installs below mentioned software:

nginx, prosody, jitsi-meet-prosody, jitsi-meet, jitsi-meet-web, jitsi-meet-web-config, jitsi-meet-turnserver, jicofo, jitsi-videobridge2

Below are optional, will be installed only if opted for:

jigasi (https://github.com/jitsi/jigasi)
jibri (https://github.com/jitsi/jibri)

Also has option for configuring:

  • secure domain (https://jitsi.github.io/handbook/docs/devops-guide/secure-domain)
  • jigasi authentication (find it towards the end of secure domain link)
  • transcription(Google/Vosk) (https://github.com/jitsi/jigasi#configuring-sip-and-transcription)
  • Etherpad (https://github.com/ether/etherpad-lite)

Continue reading “Installer for jitsi-meet, jigasi and jibri” »

Share

Running pfSense in a XenServer with xenguest

If you deploy pfSense on a XenServer, you may be shocked at the performance loss-specially on interface speed! But wait, there are some tweaks to make this usable.

Installing pfSense

Go ahead and setup pfSense like normal, and when you are done, perform the following tweaks. (the day till it’s tested on pfsense version 2.5.2 and xen on scp-ng 8.1)

XenServer tweaks

Find UUID for the pfSense VM you just installed.

xe vm-list

You should get something like the following

uuid ( RO) : b435d920-eb22-b45d-5058-091619ed427f
name-label ( RW): pfSense
power-state ( RO): running

uuid ( RO) : 42626f69-6185-4aa6-a125-839700f96828
name-label ( RW): Control domain on host: xenserver-000
power-state ( RO): running

We want the UUID of the instance running pfSense, b435d920-eb22-b45d-5058-091619ed427f in this case. Continue reading “Running pfSense in a XenServer with xenguest” »

Share

Build WAF with Reverse Proxy Load Balancer using Nginx

Getting Started

First, it is recommended to update and upgrade all your software packages to the latest version. You can update all of them by running the following command:

apt update -y
apt upgrade -y

Once all the packages are updated, install other required packages with the following command:

apt install g++ flex bison curl apache2-dev doxygen libyajl-dev ssdeep liblua5.2-dev libgeoip-dev libtool dh-autoreconf libcurl4-gnutls-dev libxml2 libpcre++-dev libxml2-dev git liblmdb-dev libpkgconf3 lmdb-doc pkgconf zlib1g-dev libssl-dev -y

Once you are done, you can proceed to the next step.

Install ModSecurity on Ubuntu 22.04

By default, the ModSecurity package is not included in the Ubuntu default repository. So you will need to compile it from the source.

First, download the latest version of ModSecurity with the following command:

wget https://github.com/SpiderLabs/ModSecurity/releases/download/v3.0.8/modsecurity-v3.0.8.tar.gz

Once the download is completed, extract the downloaded file with the following command:

tar -xvzf modsecurity-v3.0.8.tar.gz

Next, navigate to the extracted directory and configure it with the following command: Continue reading “Build WAF with Reverse Proxy Load Balancer using Nginx” »

Share

M3U Restream

There’s a wonderful piece of microservice node.js based restream utility, that let you re-stream from a source and also do the ffmped transcoding if you’d like. I just liked the piece!

My installed OS was Ubuntu 18.x and I used node version 12.x.

The problem

You have an IPTV provider that provides an (extended) M3U playlist file. You want to:

  • Add HTTPS encryption to the streams (and probably move the unencrypted reception offsite).
  • Transcode the streams to a lower bitrate, or convert to a uniform video or audio format.

The solution

Run this software, preferably on an offsite host. It only requires a Node installation (No NPM modules are required!). To add HTTPS support, front it with nginx (or similar). Continue reading “M3U Restream” »

Share

Install Discourse on Ubuntu 20.04

Secure the Server

Turn on automatic security updates.

$ sudo dpkg-reconfigure -plow unattended-upgrades

Setup a firewall with ufw.

$ sudo apt-get install ufw
$ sudo ufw default allow outgoing
$ sudo ufw default deny incoming
$ sudo ufw allow 22 comment 'SSH'
$ sudo ufw allow http comment 'HTTP'
$ sudo ufw allow https comment 'HTTPS'
$ sudo ufw enable

Install fail2ban to secure your server

$ sudo apt install fail2ban

Configure fail2ban to Use ufw

Copy the main configuration to avoid unexpected changes during package updates.

$ sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Edit the configuration file with your favorite text editor

$ sudo nano /etc/fail2ban/jail.local

Change the banaction and banaction_allports settings to ufw in the file /etc/fail2ban/jail.local as follows: Continue reading “Install Discourse on Ubuntu 20.04” »

Share

Cacti user creation with specific graphs permission

As an admin of cacti you can anything and everything. However, at certain times, you need to create restricted user who has access to only certain graphs of the cacti system. So here goes the steps (this is based on cacti version 1.2.21)-

From left menu select Configuration > Users

Continue reading “Cacti user creation with specific graphs permission” »

Share

Set Up a Radius Server on pfSense

Installing the Package

The pfSense 2.X package manager includes both FreeRadius and FreeRadius2 as installation options. For this example, I’m going to be using FreeRadius2 since it has some additional features not found in the previous version.

Only one version of radius can be installed on pfSense at a time. If you previously installed any radius packages, go ahead and remove them first.

The package installation will briefly interrupt traffic passing through the router as the service starts, so be careful when running the installation on a production system.

  • Open the package manager in the system menu of the web interface.
  • Click the plus symbol next to FreeRadius2 to begin the installation.
  • Click ‘Ok’ to confirm the package installation.

You cannot run both FreeRadius and FreeRadius2 on the same pfSense system. Make sure to remove one before installing the other. The setup process will automatically download and install the radius package along with all of its dependencies. The installation normally takes a couple of minutes to complete.

After it’s finished, there will be a new menu item for the package in the services menu. The FreeRadius installation normally takes a couple minutes to complete. Continue reading “Set Up a Radius Server on pfSense” »

Share

Mapping drives with Windows for Nextcloud

To map a drive using the Microsoft Windows Explorer:

  • Open Windows Explorer on your MS Windows computer.
  • Right-click on Computer entry and select Map network drive… from the drop-down menu.
  • Choose a local network drive to which you want to map Nextcloud.
  • Specify the address to your Nextcloud instance, followed by /remote.php/dav/files/USERNAME/. For example:
  • https://example.com/nextcloud/remote.php/dav/files/USERNAME/
  • Click the Finish button.

Windows Explorer maps the network drive, making your Nextcloud instance available

Note

For SSL protected servers, check Reconnect at sign-in to ensure that the mapping is persistent upon subsequent reboots. If you want to connect to the Nextcloud server as a different user, check Connect using different credentials.

Share