linux
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
linux [2018/08/22 08:45] ss_wiki_admin |
linux [2020/03/06 13:53] (current) ss_wiki_admin |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ==== Memory ==== | ||
| + | == Identify memory usage of TIME_WAIT sockets == | ||
| + | <code bash> | ||
| + | slabtop -o | grep -E ' | ||
| + | OBJS ACTIVE | ||
| + | | ||
| + | 6900 | ||
| + | </ | ||
| + | |||
| + | ==== OpenSSH ==== | ||
| + | Because SSH is incredible.\\ | ||
| + | == Tunneling == | ||
| + | <code bash> | ||
| + | # Using connect-proxy as a socks proxy (tunneling ssh over http proxy to an ssh server on port 1.2.3.4: | ||
| + | Host 1.2.3.4 | ||
| + | ProxyCommand connect-proxy -H proxy:3128 %h %p | ||
| + | Port 443 | ||
| + | User shaun | ||
| + | |||
| + | # -W can be used for raw port-forwarding on OpenSSH 5.4 and higher | ||
| + | Host internal.server | ||
| + | HostName internal.server.com | ||
| + | User shaun | ||
| + | ProxyCommand ssh shaun@intermediary.server.com -W %h:%p | ||
| + | |||
| + | # Here's the old way, with netcat | ||
| + | Host internal.server | ||
| + | HostName internal.server.com | ||
| + | User shaun | ||
| + | ProxyCommand ssh shaun@intermediary.server.com nc %h %p | ||
| + | |||
| + | # New to OpenSSH 7.3 and higher is the ProxyJump commmand, which does the same, but with multiple possible intermediaries | ||
| + | Host internal.server | ||
| + | | ||
| + | | ||
| + | User shaun | ||
| + | </ | ||
| + | |||
| + | == SSH as a VPN == | ||
| + | <code bash> | ||
| + | ssh -NTCf -w 0:0 < | ||
| + | |||
| + | # Machine A | ||
| + | ip link set tun0 up | ||
| + | ip addr add 10.0.0.100/ | ||
| + | |||
| + | # Machine B | ||
| + | ip link set tun0 up | ||
| + | ip addr add 10.0.0.200/ | ||
| + | |||
| + | # Add a route for target network on Machine B | ||
| + | ip route add 10.0.0.0/24 via 10.0.0.200 | ||
| + | |||
| + | #This allows us to send packets from Machine B to any IP address on Network A, via Machine A. | ||
| + | #To ensure that packets have a route back to Machine B add an arp entry on Machine A: | ||
| + | |||
| + | arp -sD 10.0.0.200 eth0 pub | ||
| + | |||
| + | #This sets a published arp destination for 10.0.0.200 to Machine A (proxy-ARP). | ||
| + | |||
| + | # Kernel packet forwarding must be enabled for the routing bits | ||
| + | echo 1 | sudo tee / | ||
| + | |||
| + | </ | ||
| + | |||
| + | == Copy and install public key == | ||
| + | <code bash> | ||
| + | ssh-copy-id -i .ssh/ | ||
| + | </ | ||
| + | |||
| ==== Filesystems ==== | ==== Filesystems ==== | ||
| [[xfs]]\\ | [[xfs]]\\ | ||
| - | [[ext4]] | + | [[ext4]]\\ |
| + | [[recovery]]\\ | ||
| == Get detailed memory chip information == | == Get detailed memory chip information == | ||
| Line 7: | Line 78: | ||
| dmidecode --type 17 | dmidecode --type 17 | ||
| </ | </ | ||
| - | Output: | + | Sample output: |
| <code bash> | <code bash> | ||
| # dmidecode 2.12 | # dmidecode 2.12 | ||
| Line 33: | Line 104: | ||
| Configured Clock Speed: 1066 MHz | Configured Clock Speed: 1066 MHz | ||
| </ | </ | ||
| + | |||
| + | ==== OpenSSL ==== | ||
| + | ==Convert .crt to .pem== | ||
| + | < | ||
| + | openssl x509 -in certificate.crt -out certificate.pem -outform PEM | ||
| + | </ | ||
| + | |||
| + | == View certificate and key == | ||
| + | <code bash> | ||
| + | openssl x509 -noout -text -in server.crt | ||
| + | openssl rsa -noout -text -in server.key | ||
| + | </ | ||
| + | |||
| + | == Verify certificate matches key == | ||
| + | The `modulus' | ||
| + | <code bash> | ||
| + | openssl x509 -noout -modulus -in server.crt | openssl md5 | ||
| + | openssl rsa -noout -modulus -in server.key | openssl md5 | ||
| + | </ | ||
| + | |||
| + | == Check which key or cert belongs to a CSR == | ||
| + | <code bash> | ||
| + | openssl req -noout -modulus -in server.csr | openssl md5 | ||
| + | </ | ||
| + | |||
| + | == Show local certificate details == | ||
| + | <code bash> | ||
| + | openssl s_client -showcerts -servername www.virtualhost.co.za -connect localhost: | ||
| + | </ | ||
| + | |||
| + | ==== Tcpdump ==== | ||
| + | Dump TCP Rsets | ||
| + | <code bash> | ||
| + | tcpdump -fnni bond0: | ||
| + | </ | ||
| + | |||
| + | ==== Other ==== | ||
| + | == Conceal process in ' | ||
| + | <code bash> | ||
| + | echo FakeProcName > / | ||
| + | mount -n --bind -o ro / | ||
| + | |||
| + | ps -ef | grep FakeProcName | ||
| + | </ | ||
| + | |||
| + | == speedtest == | ||
| + | <code bash> | ||
| + | curl -s https:// | ||
| + | </ | ||
| + | |||
| + | == get kernel debuginfo packages for systemtap and crash == | ||
| + | |||
| + | For Unbreakable Enterprise Kernel: | ||
| + | <code bash> | ||
| + | export DLP=" | ||
| + | wget ${DLP}/ | ||
| + | wget ${DLP}/ | ||
| + | </ | ||
| + | |||
| + | For Red Hat Compatible Kernel: | ||
| + | <code bash> | ||
| + | export DLP=" | ||
| + | wget ${DLP}/ | ||
| + | # wget ${DLP}/ | ||
| + | </ | ||
| + | |||
| + | Install | ||
| + | <code bash> | ||
| + | rpm -Uhv kernel-uek-debuginfo-4.1.12-112.14.15.el7uek.x86_64.rpm \ | ||
| + | kernel-uek-debuginfo-common-4.1.12-112.14.15.el7uek.x86_64.rpm | ||
| + | </ | ||
| + | |||
| + | == Get interrupts causing high system time == | ||
| + | < | ||
| + | sar -I XALL 1 | grep -v 0.00 | ||
| + | </ | ||
| + | |||
| + | ==== Iptables ==== | ||
| + | == icmp rate limiting == | ||
| + | <code bash> | ||
| + | iptables -A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 1/second --limit-burst 1 -j ACCEPT | ||
| + | iptables -A OUTPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 1/second --limit-burst 1 -j ACCEPT | ||
| + | </ | ||
| + | |||
| + | |||
| + | |||
| + | [[Oracle Enterprise Linux]] | ||
linux.1534927530.txt.gz · Last modified: 2019/09/16 16:10 (external edit)
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
