達人手札

善惡

noreply@blogger.com (Peter Cheng) — Sun, 27 Sep 2009 07:00:00 +0000

正邪應天而生，凡天下事物皆不離萌芽、興盛、哀退、滅亡，其間可說有，可說無，是故如車輪轉，週行不殆。人起分別分善惡，賞善罰惡、揚惡懲善，人之行為所致，天地平衡為因，善無至善，惡無至惡，是故人心所至，凡天律，乃平衡也，天之縱而不顧其律也

現代人的愛情觀

noreply@blogger.com (Peter Cheng) — Thu, 21 Aug 2008 06:15:00 +0000

class love {
var $sex;
var $height;
var $weight;
var $money;
var $cup=NULL;
var $id;
var $sexfriends=0;

function love() {}

function man($height,$weight,$money,$id) {
$this- >sex="男";
$this- >height=$height;
$this- >weight=$weight;
$this- >money=$money;
$this- >id=$id;
}

function find($query) {
include_once "worldbase.class.pHp";
$_conn=new worldbase($this- >sex,$this- >height,$this- >weight,$this- >money,$this- >cup,$this- >id);
$this- >sexfriend=$conn->query($query);
}

function getsexfriends() {return $this- >sexfriends;}

function woman($height,$weight,$money,$cup,$id) {
$this- >sex="女";
$this- >height=$height;
$this- >weight=$weight;
$this- >money=$money;
$this- >cup=$cup;
$this- >id=$id;
}

function happyending() {return "Get true love";}

function badending() {return "I am single";}

function god ($height,$weight,$cup=NULL) {
if ($this- >money >66000) {
$this- >sex=$sex;
$this- >height=$height;
$this- >weight=$weight;
$this- >money-=66000;
$this- >cup=$cup;
return "show your identity";
} else return "Get out";
}
}

$a=new love();
$a- >man(156,70,200000,"normal");
$b=new love();
$b- >man(188,120,12,"normal");
$c=new love();
$c- >man(170,50,1200,"normal");
$d=new love();
$d- >man(165,62,33000,"normal");

$w=new love();
$w- >woman(170,90,200000,"G","normal");
$x=new love();
$x- >woman(155,120,18,"A","normal");
$y=new love();
$y- >woman(166,42,44000,"B","normal");
$z=new love();
$z- >woman(167,60,38000,"C","normal");

$a- >find("select woman from Taiwan where (height >150 and height<170)>36 and weight<46) and cup="E";");
$b- >find("select woman from Japan where (height >166 and height<170)>36 and weight<47) and cup="G";");
$c- >find("select woman from Taiwan where (height >166 and height<176)>36 and weight<48) and cup="F";");
$d- >find("select woman from Taiwan where (height >155 and height<165)>36 and weight<52) and cup="B";");

$w- >find("select man from USA where (height >177 and height<200)>70 and weight<90)>400000000;");
$x- >find("select man from France where (height >182 and height<198)>72 and weight<86)>700000000;");
$y- >find("select man from UK where (height >188 and height<200)>70 and weight<90)>350000000;");
$z- >find("select man from Japan where (height >180 and height<190)>70 and weight<90)>370000000;");

if (($a- >getsexfriends())<1)
($a- >god(180,70)=="Get out")? $a- >badending() : else $a- >happyending();
else $a- >happyending();
if (($b- >getsexfriends())<1)
($b- >god(180,70)=="Get out")? $b- >badending() : $b- >happyending();
else $b- >happyending();
if (($c- >getsexfriends())<1)
($c- >god(180,70)=="Get out")? $c- >badending() : $c- >happyending();
else $c- >happyending();
if (($d- >getsexfriends())<1)
($d- >god(180,70)=="Get out")? $d- >badending() : $d- >happyending();
else $d- >happyending();

if (($w- >getsexfriends())<1)
($w- >god(168,42,"C")=="Get out")? $w- >badending() : $w- >happyending();
else $w- >happyending();
if (($x- >getsexfriends())<1)
($x- >god(180,70)=="Get out")? $x- >badending() : $x- >happyending();
else $x- >happyending();
if (($y- >getsexfriends())<1)
($y- >god(180,70)=="Get out")? $y- >badending() : $y- >happyending();
else $y- >happyending();
if (($z- >getsexfriends())<1)
($z- >god(180,70)=="Get out")? $z- >badending() : $z- >happyending();
else $z- >happyending();

女人的年齡是秘密

noreply@blogger.com (Peter Cheng) — Thu, 21 Aug 2008 06:07:00 +0000

function Woman_age(CoolMan) {var age=30;return CoolMan?age-10:age+10;}

設定簡易防火牆規則

noreply@blogger.com (Peter Cheng) — Sun, 20 Jul 2008 12:45:00 +0000

環境：
Server IP：192.168.0.1

設定：

#規則初始化
iptables --flush

#隱形掃瞄攻擊防範
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A FORWARD -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -A FORWARD -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -A FORWARD -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
iptables -A FORWARD -p tcp --tcp-flags ACK,URG URG -j DROP

#非法位址篩選
iptables -A INPUT -i eth0 -s 0.0.0.0/8 -j DROP
iptables -A FORWARD -i eth0 -s 0.0.0.0/8 -j DROP
iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP
iptables -A FORWARD -i eth0 -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i lo -s 127.0.0.0/8 -j DROP
iptables -A FORWARD -i lo -s 127.0.0.0/8 -j DROP
iptables -A INPUT -i eth0 -s 169.254.0.0/16 -j DROP
iptables -A FORWARD -i eth0 -s 169.254.0.0/16 -j DROP
iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP
iptables -A FORWARD -i eth0 -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP
iptables -A FORWARD -i eth0 -s 192.168.0.0/16 -j DROP
iptables -A INPUT -i eth0 -s 192.168.2.0/24 -j DROP
iptables -A FORWARD -i eth0 -s 192.168.2.0/24 -j DROP
iptables -A INPUT -i eth0 -s 224.0.0.0/4 -j DROP
iptables -A FORWARD -i eth0 -s 224.0.0.0/4 -j DROP
iptables -A INPUT -i eth0 -s 240.0.0.0/5 -j DROP
iptables -A FORWARD -i eth0 -s 240.0.0.0/5 -j DROP
iptables -A INPUT -i eth0 -s 255.255.255.255 -j DROP
iptables -A FORWARD -i eth0 -s 255.255.255.255 -j DROP

iptables-save

架設Webmin

noreply@blogger.com (Peter Cheng) — Sun, 20 Jul 2008 03:26:00 +0000

環境：
Server IP：192.168.0.1

設定：

vi /etc/apt/sources.list

Add

deb http://download.webmin.com/download/repository sarge contrib

apt-get update
apt-get install webmin

接下來就可以透過瀏覽器進入https://192.168.0.1:10000來管理伺服器囉

架設Samba

noreply@blogger.com (Peter Cheng) — Sun, 20 Jul 2008 01:36:00 +0000

環境：
Server IP：192.168.0.1
Networks：192.168.0.0/255.255.255.0

設定：

vi /etc/samba/smb.conf

全數清空，改為以下

#======================= Global Settings =======================
[global]
log file = /var/log/samba/log.%m #記錄檔存放點
display charset = utf8 #顯示之字碼為utf-8
passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n .
socket options = TCP_NODELAY SO_SNDBUF=8192 SO_RCVBUF=8192 #Socket
obey pam restrictions = Yes
encrypt passwords = True
domain master = Yes #設為DMB
local master = Yes #設為LMB
preferred master = Yes #設為PDC
interfaces = eth0 #負責的網卡
hosts allow = 192.168.0.0/255.255.255.0 #允許的主機
passdb backend = tdbsam
passwd program = /usr/bin/passwd %u
template shell = /bin/false
wins support = true #將主機設為Wins
dns proxy = no
netbios name = teed7334.idv.tw #主機名稱
netbios aliases = teed7334.idv.tw #主機別名
server string = %h server
invalid users = root #禁止進入的使用者
dos charset = cp950
workgroup = WORKGROUP #使用的工作群組
os level = 255 #0~255，數值越大，越優先成為LMB、DMB
syslog = 0
security = user
unix charset = utf8
panic action = /usr/share/samba/panic-action %d
max log size = 1000

#======================= Share Definitions =======================

[homes] #使用者家目錄
comment = Home Directories #分享的資料夾別名
create mode = 700 #新增檔案預設權限
directory mode = 600 #新增資料夾預設權限
valid users = %S
writeable = yes #預設可寫入
public = yes #公開

[Temp] #資料暫存區
comment = Temp #分享的資料夾別名
create mode = 777 #新增檔案預設權限
directory mode = 777 #新增資料夾預設權限
writeable = yes #預設可寫入
public = yes #公開
path = /tmp #分享資料夾系統路徑

[Game] #分享資料夾
comment = Game Directories #分享的資料夾別名
create mode = 777 #新增檔案預設權限
directory mode = 777 #新增資料夾預設權限
path = /mnt/hdb/game #分享資料夾系統路徑
write list = a1,a2,a3 #分享資料夾系統路徑

/etc/init.d/samba restart

架設Bind

noreply@blogger.com (Peter Cheng) — Sat, 19 Jul 2008 15:26:00 +0000

環境：
僅設定為forward only的DNS，轉向HiNet DNS–168.95.1.1

設定：
apt-get install bind

vi /etc/bind/named.conf.options

add

forward only;
forwarders {
168.95.1.1;
};

/etc/init.d/bind restart

架設Apache2+PHP5+MySQL5

noreply@blogger.com (Peter Cheng) — Sat, 19 Jul 2008 14:11:00 +0000

設定：
apt-get install apache2.2-common apache2-utils apache2-mpm-prefork libapache2-mod-php5 php5-mysql

apt-get install mysql-server-5.0 mysql-client-5.0

針對特定MAC指定固定IP

noreply@blogger.com (Peter Cheng) — Fri, 18 Jul 2008 02:13:00 +0000

環境：
追加MAC為(00:0E:A6:2D:98:CD)成固定IP(192.168.0.2)

設定：

vi /etc/dhcpd.conf

Add

host 主機名稱 {
hardware ethernet 00:0E:A6:2D:98:CD;
fixed-address 192.168.0.2;
}

/etc/init.d/dhcp3-server restart

架設pptpd

noreply@blogger.com (Peter Cheng) — Sun, 13 Jul 2008 05:37:00 +0000

環境：
Server Domain：teed7334.idv.tw
Server IP：192.168.0.1
DNS Server IP：192.168.0.1
Wins Server IP：192.168.0.1
Networks：192.168.0.1/255.255.255.0

設定：
apt-get install pptpd

vi /etc/pptpd.conf

#localip 192.168.0.234-238,192.168.0.245
#remoteip 192.168.1.234-238,192.168.1.245

To

localip 192.168.0.1 #VPN Server 本地IP
remoteip 192.168.0.0-192.168.0.255 #VPN Client IP分配範圍

vi /etc/ppp/pptpd-options

#ms-dns 10.0.0.1
.
.
.
#ms-wins 10.0.0.3
.
.
.
#debug

To

ms-dns 192.168.0.1 #指定分配給VPN Client的DNS
.
.
.
ms-wins 192.168.0.1 #指定分配給VPN Client的WINS
.
.
.
debug #指定建立日誌檔

Add

name teed7334.idv.tw #指定VPN Server的Domain

vi /etc/ppp/chap-secrets

# Secrets for authentication using CHAP
# client server secret IP addresses

Add

#使用者名稱伺服器Domain 密碼允許連入IP
teed7334 teed7334.idv.tw teed7334 *

/etc/init.d/pptpd restart

架設vsftp

noreply@blogger.com (Peter Cheng) — Fri, 11 Jul 2008 04:26:00 +0000

環境：
Server IP：168.168.168.168

設定：
apt-get install vsftpd

vi /etc/vsftpd.conf

# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=YES
.
.
.
# Uncomment this to allow local users to log in.
#local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
#write_enable=YES
.
.
.
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
.
.
.
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format
#xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
.
.
.
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
.
.
.
# You may restrict local users to their home directories. See the FAQ for
# the possible risks in this before using chroot_local_user or
# chroot_list_enable below.
#chroot_local_user=YES

To

# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=No #不允許匿名使用者入內
.
.
.
# Uncomment this to allow local users to log in.
local_enable=YES #允許本地使用者登入
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES #允許寫入檔案
.
.
.
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
anon_upload_enable=NO #不允許匿名使用者上傳
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
anon_mkdir_write_enable=NO #不允許匿名使用者新增資料夾
.
.
.
# You may override where the log file goes if you like. The default is shown
# below.
xferlog_file=/var/log/vsftpd.log #寫入系統日誌
#
# If you want, you can have your log file in standard ftpd xferlog format
xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
data_connection_timeout=120
.
.
.
# You may fully customise the login banner string:
ftpd_banner=Welcome to blah FTP service. #FTP登入歡迎語
.
.
.
# You may restrict local users to their home directories. See the FAQ for
# the possible risks in this before using chroot_local_user or
# chroot_list_enable below.
chroot_local_user=YES #只允許使用者在自已的家目錄中

Add

force_dot_files=NO
listen_address=168.168.168.168 #指定伺服器IP
anon_max_rate=524288 #匿名使用者最大上傳速度
local_max_rate=524288 #使用者最大上傳速度

/etc/init.d/vsftpd restart

架設DHCP

noreply@blogger.com (Peter Cheng) — Fri, 11 Jul 2008 02:14:00 +0000

環境：
Server IP：192.168.0.1
Network：192.168.0.0/255.255.255.0
網卡：eth0(對外)、eth1(對內)

設定：
apt-get install dhcp3-server

vi /etc/dhcpd.conf

option domain-name "fugue.com";
option domain-name-servers toccata.fugue.com;

option subnet-mask 255.255.255.224;
default-lease-time 600;
max-lease-time 7200;
.
.
.
#authoritative;

To

interfaces=eth1; #指定那張網卡負責監測
server-name "teed7334.idv.tw"; #伺服器名稱
max-lease-time 864000;
default-lease-time 86400;
option time-offset 28800;
option netbios-name-servers 192.168.0.57; #指定WINS
option netbios-node-type 8; #指定為H-Node
option ntp-servers 192.168.0.57; #指定NTP
option time-servers 192.168.0.57;
option domain-name-servers 192.168.0.57; #指定DNS
option broadcast-address 192.168.0.255; #廣播路徑
option subnet-mask 255.255.255.0; #子網域遮罩
option routers 192.168.0.253; #指定路由器
.
.
.
authoritative; #指定為主要DHCP Server

Add

subnet 192.168.0.0 netmask 255.255.255.0 { #指定一個子網域
range 192.168.0.0 192.168.0.255; #指定DHCP IP分配範圍
}

/etc/init.d/dhcp3-server restart

架設SSH

noreply@blogger.com (Peter Cheng) — Thu, 10 Jul 2008 09:05:00 +0000

環境：
Server IP：192.168.0.1

設定：
apt-get install ssh

vi /etc/ssh/sshd_config

#ListenAddress 0.0.0.0
.
.
.
PermitRootLogin yes

To

ListenAddress 192.168.0.1 #指定開放伺服器的IP
.
.
.
PermitRootLogin no #不允許直接使用root進入(先透過一般使用者進入後下su)

Add

IgnoreUserKnownHosts no
PasswordAuthentication yes #使用密碼驗証

/etc/init.d/ssh restart

Debian目錄結構

noreply@blogger.com (Peter Cheng) — Thu, 10 Jul 2008 03:19:00 +0000

/
Debian Linux所有資料夾的最上層(好比Windows的c:\)

/bin
Debian Linux所有系統指令與shell的存放點，如ls、mkdir等等

/etc
Debian Linux所有設定檔的存放點，如apache，設定檔一般放在/etc/apache/httpd.conf，以此類推

/etc/init.d
Debian Linux開機所要載入的程式放置區

/etc/rc0.d
當系統於Runlevel 0時，所要連結的程式(對應到/etc/init.d，S出頭的是開啟，K出頭的是關閉)

/etc/rc1.d
當系統於Runlevel 1時，所要連結的程式(對應到/etc/init.d，S出頭的是開啟，K出頭的是關閉)

/etc/rc2.d
當系統於Runlevel 2時，所要連結的程式(對應到/etc/init.d，S出頭的是開啟，K出頭的是關閉)

/etc/rc3.d
當系統於Runlevel 3時，所要連結的程式(對應到/etc/init.d，S出頭的是開啟，K出頭的是關閉)

/etc/rc4.d
當系統於Runlevel 4時，所要連結的程式(對應到/etc/init.d，S出頭的是開啟，K出頭的是關閉)

/etc/rc5.d
當系統於Runlevel 5時，所要連結的程式(對應到/etc/init.d，S出頭的是開啟，K出頭的是關閉)

/etc/rc6.d
當系統於Runlevel 6時，所要連結的程式(對應到/etc/init.d，S出頭的是開啟，K出頭的是關閉)

/etc/rcS.d
當系統啟動時，所要連結的程式(對應到/etc/init.d，S出頭的是開啟，K出頭的是關閉)

/var
Debian Linux所有日誌檔的存放點，一般來說都放在/var/log中，但也有些是放在/var下面

/tmp
暫存目錄，人人都可存取，可將檔案放到/tmp中做檔案分享之用

/home
存放使用者的家目錄，用存放使用者的所有設定檔與郵件和檔案，如wm52這個使用者，家目錄就為/home/wm52

安裝Debian

noreply@blogger.com (Peter Cheng) — Thu, 10 Jul 2008 01:55:00 +0000

首先，先上Debian網站下載最新Stable版的.iso檔
http://www.debian.org/CD/http-ftp/#stable

將.iso檔燒入CD-ROM之後，到BIOS設定光碟開機，會看到此一畫面。請按下Enter

選擇安裝時所用的語言(中文–繁體)

一般標準鍵盤都是用美語

設定主機名稱

設定網域

進行磁碟分割，如果只是測試用安裝的話，可以透過【導引–使用整顆磁碟】or【導引–使用整顆磁碟並設定LVM】，但如果是要架設正式伺服器的話，建議這部份用手動安裝的

依我自已架設的伺服器而言，我會做以下分配–
/boot,jfs,128MB,主分割區,開始位置
swap,置換空間,1GB,主分割區,開始位置
/,jfs,15GB,邏輯分割區,開始位置
/var,jfs,2GB,邏輯分割區,開始位置
/tmp,jfs,2GB,邏輯分割區,開始位置
/home,jfs,(磁碟剩下的所有空間),邏輯分割區,開始位置

設定系統管理員(root)的密碼

設定一般使用者

設定一般使用者的密碼

設定鏡像站的安裝來源

如果不想用proxy就空白

如果你和我一樣是Debian的愛好者，就點是(這有助於Debian團隊的日後追蹤與維護)

點標準系統就好了(要啥我們可以自已安裝)

點是(不然會不能開機)

取出你的光碟，到BIOS設回透過硬碟開機，勇敢地進去黑暗時代吧(/bin/bash)

從Windows安裝CUPS上的印表機

noreply@blogger.com (Peter Cheng) — Thu, 22 May 2008 08:34:00 +0000

環境：
Printer Server：192.168.0.27:631
Printer：HP OfficeJet Pro K5500

設定：
開始功能表/控制台/印表機和傳真/新增印表機

(URL可從Web管理畫面進入之後，Printers類別下，點擊印表機得知)
PS.Web管理介面一般都在https://printer_server_ip:631/

架設CUPS

noreply@blogger.com (Peter Cheng) — Thu, 22 May 2008 07:54:00 +0000

環境：
Server IP：192.168.0.1

設定：
apt-get install cupsys cupsys-driver-gutenprint foomatic-db-gutenprint foomatic-filters fontconfig libtiff4 libfreetype6

vi /etc/cups/cups.conf

Listen localhost:631
.
.
.
<Location />
Order allow,deny
Allow localhost
</Location>
.
.
.
<Location /admin>
Encryption Required
Require user @SYSTEM
Order allow,deny
Allow localhost
</Location>
.
.
.
<Location /admin/conf>
AuthType Basic
Require user @SYSTEM
Order allow,deny
Allow localhost
</Location>

To

Listen 192.168.0.1:631 #指定開放伺服器的IP與連接埠
.
.
.
<Location />
Order allow,deny
Allow 192.168.0.0/255.255.255.0 #指定可連進來的IP範圍192.168.0.0~192.168.0.255
</Location>
.
.
.
<Location /admin>
AuthType Basic
Require user @SYSTEM
Order allow,deny
Allow 192.168.0.0/255.255.255.0 #指定可連進來的IP範圍192.168.0.0~192.168.0.255
</Location>
.
.
.
<Location /admin/conf>
AuthType Basic
Require user @SYSTEM
Order allow,deny
Allow 192.168.0.0/255.255.255.0
#指定可連進來的IP範圍192.168.0.0~192.168.0.255
</Location>

Add

DefaultEncryption IfRequested

/etc/init.d/cupsys restart

接下來就可以透過瀏覽器進入https://192.168.0.1:631來管理印表機囉

DNS正反解

noreply@blogger.com (Peter Cheng) — Wed, 05 Mar 2008 08:28:00 +0000

#假設正解MX是以下
host -t mx 網域名稱
MX 10 teed7334.idv.tw 168.168.168.168
MX 30 teed7334.com.tw 169.169.169.169
MX 50 teed7334.edu.tw 170.170.170.170

#那麼反解也必需是如下
host 主機IP
168.168.168.168.in-addr.arpa domain name pointer teed7334.idv.tw
169.169.169.169.in-addr.arpa domain name pointer teed7334.com.tw.
170.170.170.170.in-addr.arpa domain name pointer teed7334.edu.tw.

VPN+NAT

noreply@blogger.com (Peter Cheng) — Wed, 06 Feb 2008 09:14:00 +0000

設定：

在設置VPN之前，請先設置好NAT功能，可參考以下網址
http://teed7334.blogspot.com/2008/01/dhcpnat.html

vi /etc/init.d/nat

modprobe ppp-compress-18

vi /etc/modules

alias net-pf-47 ip_gre

Dovecot with OpenSSL

noreply@blogger.com (Peter Cheng) — Wed, 30 Jan 2008 09:28:00 +0000

先下以下指令
openssl req -new -x509 -newkey rsa:1024 -nodes -days 365 -keyout mykey.pem -out mycert.pem

將產生之mykey.pem、mycert.pem分別cp到/etc/ssl/certs/dovecot.pem與/etc/ssl/private/dovecot.pem就ok了

其中mykey.pem為私鑰，而mycert.pem為公鑰

Mail Server 副本轉寄

noreply@blogger.com (Peter Cheng) — Fri, 25 Jan 2008 16:52:00 +0000

【Server】
在/home/username/下新增一個.forward檔，內容如下
teed7334
teed7334@gmail.com

.forward可以指定要寄到那個E-Mail，當然也可以只打本機帳號寄給本機使用者

【Client】
透過Outlook、雷鳥的寄出副本功能就ok了

以上是最簡單的設定方法

架設Postfix+Dovecot+SASL With SSL/TLS

noreply@blogger.com (Peter Cheng) — Wed, 23 Jan 2008 06:43:00 +0000

環境：
Server Domain：teed7334.idv.tw

設定：
apt-get install postfix libsasl2 libsasl2-modules sasl2-bin dovecot-common dovecot-imapd dovecot-pop3d

vi /etc/postfix/main.cf

smtpd_use_tls=yes
.
.
.
myhostname = debian.localhost
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = debian.localhost, localhost.localhost, , localhost
relayhost =
mynetworks = 127.0.0.0/8
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

以上設定清空，全數改為以下
smtpd_use_tls=yes #指定smtp是否使用TLS加密
.
.
.
myhostname = teed7334.idv.tw #Mail Server的主機名稱
mydomain = teed7334.idv.tw #Mail Server的Domain
#Mail Server所認可合法的位置
mydestination = $myhostname, localhost.$mydomain, $mydomain
myorigin = $mydomain
mynetworks = teed7334.idv.tw
message_size_limit = 10240000 #單封郵件最大大小
disable_vrfy_command = yes
home_mailbox = mail/ #設定~/mail為存放Mail所在地
smtpd_sasl_auth_enable = yes #使用SASL認証
broken_sasl_auth_clients = yes #使用SASL認証Client端
smtpd_sasl_security_options = noanonymous #不允許匿名登入
#指定smtp允許的方式
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sender_restrictions = reject_unknown_sender_domain #拒絕來路不明的domain
header_checks = regexp:/etc/postfix/header_checks #郵件標頭過濾檔
body_checks = regexp:/etc/postfix/body_checks #郵件內文過濾檔
smtp_rcpt_timeout = 1200s
smtp_data_init_timeout = 480s
smtp_data_done_timeout = 2400s
smtp_quit_timeout = 1200s
smtp_connect_timeout = 120s
fallback_relay =
smtp_helo_timeout = 1200s
smtp_data_xfer_timeout = 720s
smtp_mail_timeout = 1200s
smtpd_error_sleep_time = 2s
smtpd_timeout = 600s
smtpd_client_restrictions = permit_mynetworks, reject_rbl_client cbl.abuseat.org, reject_rbl_client bl.spamcop.net, reject_rbl_client dnsbl.sorbs.net

vi /etc/postfix/master.cf

smtp inet n - - - - smtpd

To

smtp inet n - n - - smtpd

mkdir /etc/postfix/sasl
touch /etc/postfix/sasl/smtpd.conf
vi /etc/postfix/sasl/smtpd.conf

Add

log_level: 3
pwcheck_method: saslauthd
mech_list: PLAIN LOGIN

vi /etc/default/saslauthd

START=no
.
.
.
MECHANISMS="pam"

To

START=yes
.
.
.
MECHANISMS="shadow"

vi /etc/dovecot/dovecot.conf

protocols =
.
.
.
#listen = *
.
.
.
#disable_plaintext_auth = yes

To

protocols=imaps pop3s
.
.
.
listen=*
.
.
.
disable_plaintext_auth=no

chmod 755 /etc/default/saslauthd

/etc/init.d/saslauthd restart
/etc/init.d/dovecot restart
/etc/init.d/postfix restart

DHCP+NAT

noreply@blogger.com (Peter Cheng) — Wed, 23 Jan 2008 06:40:00 +0000

環境：
eth0(對外)–168.168.168.168
eth1(對內)–192.168.0.1

設定：

#!/bin/sh
echo "1" > /proc/sys/net/ipv4/ip_forward
modprobe ip_tables
modprobe ip_nat_ftp
modprobe ip_nat_irc
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_conntrack_irc
以上存成nat之後，放到/etc/init.d中，權限755
順道下這行指令：update-rc.d nat defaults 50

防火牆設定
iptables -t nat -A POSTROUTING -s 192.168.0.0/255.255.255.0 -j SNAT --to-source 168.168.168.168

APT系統常用指令

noreply@blogger.com (Peter Cheng) — Mon, 24 Dec 2007 13:33:00 +0000

套件來源 /etc/apt/sources.list

指令：
deb http://host/debian distribution section1 section2 section3
deb-src http://host/debian distribution section1 section2 section3

選擇最佳鏡像站台指令：
apt-get install netselect

語法：apt-get [options] [action] 套件名稱

[options]
-d 下載檔案
-f 完整性檢查失敗仍然繼續
-h 說明
-s 測試安裝
-u 顯示一系列要更新的套件
-y 主動回應yes [action] autoclean 清除不需要再次下載的檔案


clean 清除所有下載檔案

dist-upgrade 將系統版本升級到新版本 install 安裝套件 remove 移除套件 update 更新套件來源 upgrade 將系統內所有套件升級常用語法： apt-get --purge remove 套件名稱 #徹底移除套件，包含設定檔 apt-get -y upgrade #自動升級系統內所有套件 apt-cache search 套件名稱 #搜尋相關套件