如何安裝php加解密套件 ionCube

php網站開發商為了保護自己的程式, 常常使用ionCube這個套件將程式加密,

因此咖啡偶拿到廠商的程式, 需要安裝ionCube解開執行:

1 下載並解開
wget http://downloads3.ioncube.com/loader_downloads/ioncube_loaders_lin_x86-64.tar.gz

2 複製與php對應版本之so或是dll檔案
例如php是5.6
cp ioncube_loader_lin_5.6.so /usr/lib64/php/modules/

3. php.ini新增一筆
zend_extension = /usr/lib64/php/modules/ioncube_loader_lin_5.6.so

4. 檢查是否成功

php -m

CentOS 7 安裝postfix郵件伺服器簡易步驟

本文章設定的郵件伺服器, 並不包含郵件過濾功能 , 帳號綁定windows網域 , 連線使用TLS加密連線

紅色的部份需要注意, 此外若出現 kafeiou.pw 請記得取代掉

#郵件過濾功能(mail gateway),請參考此文章

#2011年曾經寫過類似文章當時是CentOS6,應該大同小異

1. 修改 /etc/postfix/main.cf ,

###############################################################
myhostname = mail.kafeiou.pw
mydestination=/etc/postfix/local-host-names
inet_interfaces = all
# Enable IPv4, and IPv6 if supported
inet_protocols = all
mynetworks = 127.0.0.0/8,192.168.1.0/24
queue_directory = /var/spool/postfix
mail_owner = postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
unknown_local_recipient_reject_code = 550
home_mailbox = Maildir/
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man

###############################################################
smtpd_recipient_restrictions =
 permit_mynetworks,
 permit_sasl_authenticated,
 reject_non_fqdn_hostname,
 reject_non_fqdn_recipient,
 reject_unknown_sender_domain,
 reject_unknown_recipient_domain,
 reject_unauth_destination,

smtpd_client_restrictions =
 permit_sasl_authenticated,

smtpd_sender_restrictions =
 permit_mynetworks,
 reject_non_fqdn_sender,
 reject_unknown_sender_domain

###############################################################
message_size_limit = 150600000
mailbox_size_limit = 250600000
virtual_mailbox_limit = 250600000
disable_vrfy_command = yes
strict_rfc821_envelopes = yes
bounce_queue_lifetime = 1d
###############################################################
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain =
###############################################################
smtpd_helo_required = yes
smtpd_delay_reject = yes
smtpd_helo_restrictions =
 permit_mynetworks,
 permit
##############################################################
virtual_mailbox_domains =  /etc/postfix/domains
virtual_mailbox_base = /home/vmail
virtual_mailbox_maps = ldap:/etc/postfix/ldap-users.cf
# 1001 is id of user  "vmail" created in linux
virtual_uid_maps = static:1001
virtual_gid_maps = static:1001
virtual_alias_maps = hash:/etc/aliases,ldap:/etc/postfix/ldap-aliases.cf
##############################################################
recipient_bcc_maps = hash:/etc/postfix/recipient_bcc
sender_bcc_maps = hash:/etc/postfix/sender_bcc
#inet_protocols = ipv4
smtpd_tls_security_level = may
smtpd_tls_key_file = /etc/letsencrypt/live/mail.kafeiou.pw/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.kafeiou.pw/fullchain.pem
# smtpd_tls_CAfile = /etc/pki/tls/root.crt
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_tls_cache
tls_random_source = dev:/dev/urandom
tls_random_exchange_name = /var/lib/postfix/prng_exch

# 強制使用TLS
smtpd_tls_auth_only = yes
smtp_use_tls = yes
smtpd_use_tls = yes
smtp_tls_note_starttls_offer = yes

#
# Disable SSLv2, SSLv3
#
smtpd_tls_protocols = !SSLv2 !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3
smtp_tls_protocols = !SSLv2 !SSLv3
smtp_tls_mandatory_protocols = !SSLv2 !SSLv3
lmtp_tls_protocols = !SSLv2 !SSLv3
lmtp_tls_mandatory_protocols = !SSLv2 !SSLv3

dovecot_destination_recipient_limit = 1

#performance
smtpd_error_sleep_time = 0
default_process_limit = 150
qmgr_message_active_limit = 40000
qmgr_message_recipient_limit = 40000
default_destination_concurrency_limit=100
default_destination_recipient_limit=100
default_process_limit=200
smtp_mx_session_limit=100
smtpd_client_connection_count_limit=100
smtp_destination_concurrency_limit=100
maximal_backoff_time = 1000s
minimal_backoff_time = 300s

2. 修改 /etc/postfix/local-host-names , 加上主機名稱 

mail.kafeiou.pw

3. 修改  /etc/postfix/domains , 加上網域

kafeiou.pw

4.新增使用者 vmail , 並紀錄該使用者id , 並更新到 main.cf 裡面的id(可參考步驟1)

useradd vmail

5. 綁定網域帳號

裡面的 mail=%s 代表郵件紀錄在網域的mail欄位

vi /etc/postfix/ldap-users.cf

server_host = <主機ip>
search_base = ou=taipei,dc=kafeiou,dc=pw
version = 3
query_filter = (&(objectclass=*)(mail=%s))
result_attribute = samaccountname  #Account from DC
result_format = %s/Maildir/
bind = yes
bind_dn = cn=ldap,cn=Users,dc=kafeiou,dc=pw
bind_pw = <cn=ldap的密碼>

6. 綁定aliases, 網域設定群組

vi /etc/postfix/ldap-aliases.cf

server_host = <主機ip>
search_base = ou=aliases,dc=kafeiou,dc=pw
#scope = sub
query_filter = (memberOf:1.2.840.113556.1.4.1941:=CN=%s,ou=aliases,dc=kafeiou,dc=pw)
result_attribute = mail
result_format = %s
version = 3
bind = yes
bind_dn = cn=ldap,cn=Users,dc=kafeiou,dc=pw
bind_pw = <cn=ldap的密碼>

7. 取得letsencrypt, 更新步驟1相關的證書

此連結到本站能找到資源 , 記得輸入guest/guest

8. 設定收發備份

/etc/postfix/recipient_bcc  與  /etc/postfix/sender_bcc

william收發信都會備份到, public , 記得改完套用 postmap /etc/postfix/recipient_bcc  與  /etc/postfix/sender_bcc

william@kafeiou.pw  public@kafeiou.pw

9. 設定submission(TLS加密,使用587 port)

vi /etc/postfix/master.cf

submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject

10, 修改 /etc/sysconfig/saslauthd

# Directory in which to place saslauthd's listening socket, pid file, and so
# on.  This directory must already exist.
SOCKETDIR=/run/saslauthd

# Mechanism to use when checking passwords.  Run "saslauthd -v" to get a list
# of which mechanism your installation was compiled with the ablity to use.
#MECH=pam
MECH=ldap

# Additional flags to pass to saslauthd on the command line.  See saslauthd(8)
# for the list of accepted flags.
FLAGS="-O /etc/postfix/saslauthd.conf -c -r"

11. 修改 /etc/postfix/saslauthd.conf

ldap_servers: ldap://<網域伺服器IP>:389/
ldap_search_base: ou=taipei,dc=kafeiou,dc=pw
ldap_auth_method: bind
ldap_version: 3
ldap_bind_dn: cn=ldap,cn=Users,dc=kafeiou,dc=pw
ldap_bind_pw: <cn=ldap的密碼>
ldap_filter: (sAMAccountName=%u)
#ldap_filter: (mail=%u)

以上應該就能夠讓smtp 綁定網域, 以及擁有TLS(port 587)功能

» Read more

linux防毒軟體clamav啟用google Safe Browsing

偶的郵件伺服器使用postfix + amavisd-new+clamav

最近很不好意思的發現 clamav 很早以前就支援google Safe Browsing , 除了防毒外,還可以過濾掉一些不正當的連結, 作法如下:

1. 修改/etc/freshclam.conf  , 加上:

SafeBrowsing yes

2. 重啟clamav service, 或是postfix 透過amavisd不需要重啟service, 只要執行freshclam這個指令即可

安裝於linux的oracle 11g , 如何設定instance啟用方式

oracle 11g是很久的資料庫, 當時是配合鼎新tiptop 5.1 GP版本安裝, 安裝於centos 5.5 final ,
tiptop系統分成topprod, topstd , 與toptest , 但是到最後很少用到 topstd與toptest,

所以可以預設停用這兩個用不到的instance,

我們可以修改 /etc/oratab 這個檔案, 長得如下:

toptest:/u2/oracle/product/11.2.0/db_1:Y
topstd:/u2/oracle/product/11.2.0/db_1:Y
topprod:/u2/oracle/product/11.2.0/db_1:Y

請停掉database後, 把Y改成N, 以後重啟就不會啟動用不到的instance

esxi轉centos 5 到pve失敗,出現 mount could not find system /dev/root

咖啡偶最近進行一系列從esxi轉到pve的工作, 其中出現轉CentOS 5這種老舊vm失敗的狀況, 錯誤如下:

Unable to access resume device (LABEL=SWAP-hda3)

mount: could not find filesystem ‘/dev/root’

測試過很多方式, 例如改ide, sata, scsi 等方式都不行,  最後終於找到重建開機程序 initrd 的方式解決,

解決方式如下:

  1. 下載相對應大版本OS , Centos 5.x 都可以
  2. 掛載 Centos 5開機片開機, 輸入 linux rescue(救援模式)
  3. 輸入 chroot /mnt/sysimage 讓系統暫時恢復成原系統的狀態
  4. 刪除/boot/initrd-xxx.img 開機檔案 xxx代表原系統開機時的版本號碼
  5. 查詢一下 /lib/module 是否有xxx版本號碼
  6. 重建開機檔案  mkinitrd /boot/initrd-xxx.img   xxx
  7. 重開機, 卸載Centos 5開機片, ,改由原系統開機測試是否能成功

openfire企業內部即時通訊

若公司內部的訊息溝通, 須要考量資訊安全, 通常建議安裝一套企業內部即時通訊軟體,

在這裡介紹一款偶用了至少10以上的老牌開源即時通訊伺服器 - openfire

openfire支援XMPP標準通訊協定, 支援linux , window , 與 mac , 安裝也非常簡便,

能支援AD (LDAP) , 只要搭配支援 XMPP 的用戶端軟體 如 pidgin(洋涇浜) , jitsi desktop(神燈巨人) , 與 spark

咖啡偶在此強烈建議用戶端使用 jitsi desktop , 能撥打電話, 進行視訊會議, 或是分享桌面給IT人員, 非常適合小公司使用,

例如兩岸三地需要視訊會議(又不想使用 wechat , skype , line ) , 就可以自架設openfire + jitsti, 再 加上適當的攝像頭, 高感度麥克風, 就能輕鬆完成視訊需求.





,

ubuntu下使用snap安裝libreoffice

snap是ubuntu力推的一個套件管理架構, 應該是要跟傳統作業系統套件區隔開來, 以便達到不受到作業系統影響的目標吧(咦?這不就跟container很像嗎?)

先安裝 snap

sudo apt install snapd

再使用snap安裝libreoffice

sudo snap install --channel=beta libreoffice

安裝libreoffice完畢,可手動執行

/snap/bin/libreoffice

安裝libreoffice完畢,請重開機

1 2 3 ... 5