Wiki sysadmin - yishan.io

df -h

tree /foo/bar

lsblk --fs

blkid

lshw <-short -sanitize>

ps -ef

ps -eo pmem,pcpu,pid,args | tail -n +2 | sort -rnk 1 | head

ps aux --sort=-%mem | awk 'NR<=11 {print $0}'

ps -eo pmem,pcpu,pid,args | tail -n +2 | sort -rnk 2 | head

ps aux --sort=-%cpu | awk 'NR<=11 {print $0}'

CTRL + Z

lsof -i :port

grep -rin <ma_chaine_de_caractere> * > /foo/bar

find . -type f -exec grep "path" '{}' \; -print | more

find / -type f -name mon_fichier

sudo netstat -ltunp

sudo netstat -ap | grep le_program

sudo netstat -an | grep ':le_port'

sudo lsof -i

sudo lsof -i :port

sudo lsof -i -a -c mon_programme

sudo lsof -i -a -u mon_user

scp <fichier à envoyer> <utilisateur>@<hôte distant>:<dossier cible>

scp -r user@<hôte distant>:/var/log/ /home/yishan
scp user@<hôte distant>:/home/user/file.txt /tmp

regedit.exe

diskmgmt.msc

devmgmt.msc

eventvmr.exe

mmsys.cpl

perfmon.msc

control userpassword

netplwiz

taskkill.exe /F /IM <nom_du_processus>

nfc /scannow

winver

dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart

docker info

docker images

docker container ps

docker pull <nom_image>

docker run <nom_image>

docker run -d -ti <nom_image>

docker exec -ti <id_conteneur> /bin/bash

docker stop <id_conteneur>

docker system prune

docker system prune -a

docker network ls

docker network prune

docker logs -f <nom_container>

sudo vim /etc/apache2/conf-available/security.conf
ServerTokens Prod
ServerSignature Off

apt-get install logwatch

apt-get install monit
systemctl enable monit
systemctl start monit
systemctl status monit

mkdir /var/certs

openssl req -new -x509 -days 365 -nodes -out /var/certs/monit.pem -keyout /var/certs/monit.pem

chmod 700 /var/certs/monit.pem

systemctl restart monit

monit -t

# rsyslog
ln -s /etc/monit/conf-available/rsyslog /etc/monit/conf-enabled/
# apache2
ln -s /etc/monit/conf-available/apache2 /etc/monit/conf-enabled/
# postfix
ln -s /etc/monit/conf-available/postfix /etc/monit/conf-enabled/
## modifier le chemin de master_bin
## kill le pid de sendmail qui écoute sur le :25
kill -9 <pid>
monit monitor postfix
# mysql
ln -s /etc/monit/conf-available/mysql /etc/monit/conf-enabled/


systemctl restart monit

apt-get install munin munin-node munin-plugins-extra libapache2-mod-fcgid libwww-perl libcache-cache-perl

a2enmod fcgid

cd /etc/munin/plugins
# Mysql
ln -s /usr/share/munin/plugins/mysql_ mysql_
ln -s /usr/share/munin/plugins/mysql_bytes mysql_bytes
ln -s /usr/share/munin/plugins/mysql_innodb mysql_innodb
ln -s /usr/share/munin/plugins/mysql_isam_space_ mysql_isam_space_
ln -s /usr/share/munin/plugins/mysql_queries mysql_queries
ln -s /usr/share/munin/plugins/mysql_slowqueries mysql_slowqueries
ln -s /usr/share/munin/plugins/mysql_threads mysql_threads
# Apache
ln -s /usr/share/munin/plugins/apache_accesses
ln -s /usr/share/munin/plugins/apache_processes
ln -s /usr/share/munin/plugins/apache_volume

vim /etc/munin/munin.conf
Décommenter :
dbdir /var/lib/munin
htmldir /var/cache/munin/www
logdir /var/log/munin
rundir /var/run/munin

changer [localhost.localhost] par [yishan.io] # a simple host tree

cd /etc/apache2/sites-available && vim munin.conf

# munin.conf
<VirtualHost *:80>
 ServerName monitoring.yishan.io
 DocumentRoot /var/cache/munin/www/
 <Directory /var/cache/munin/www/>
 Options None
 Require all granted
 DirectoryIndex index.html
 </Directory>

ErrorLog ${APACHE_LOG_DIR}/munin_error.log
 CustomLog ${APACHE_LOG_DIR}/munin_access.log combined
 LogLevel warn
</VirtualHost>

a2ensite munin.conf

systemctl restart apache2.service
service munin-node restart

htpasswd -c /etc/munin/munin-htpasswd admin

VirtualHost *:80>
 ServerName monitoring.yishan.io
 DocumentRoot /var/cache/munin/www/
 <Directory /var/cache/munin/www/>
 Options None
 AuthUserFile /etc/munin/munin-htpasswd
 AuthName "Munin"
 AuthType BASIC
 Require valid-user
 DirectoryIndex index.html
 </Directory>

ErrorLog ${APACHE_LOG_DIR}/munin_error.log
 CustomLog ${APACHE_LOG_DIR}/munin_access.log combined
 LogLevel warn
</VirtualHost>

systemctl restart apache2.service
service munin-node restart

munin-node-configure --suggest >> print

[mysql*]
env.mysqluser root

[http_loadtime]
env.target https://monsite, https://mon_autre_site, etc
env.requisites true

service munin-node restart

apt install apache2 apache2-mod-php7.0

ServerTokens Full
ServerSignature Off
Header always set X-Content-Type-Options: "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"

apt install libapache2-mod-security
cd /etc/modsecurity/ && mv modsecurity.conf-recommended modsecurity.conf
vim /etc/modsecurity/modsecurity.conf
SecRuleEngine On
SecDataDir /var/cache/modsecurity
SecServerSignature Elliot.ftw

cd /usr/share/modsecurity-crs/rules
ln -s * /etc/modsecurity/crs

cd /etc/modsecurit
vim crs-setup.con
SecGeoLookupDb /usr/share/GeoIP/GeoIP.dat
Décommenter le block request-912-DOS-protection
Décommenter le block http Argument / Upload limits
Décommenter le block Forbidden file extension

a2enmod security
a2enmod header

systemctl restart apache2.service

apt install php7.0 php7.0-mysql php7.0-curl php7.0-gd php7.0-intl php7.0-cli php7.0-cgi php7.0-imagick php7.0-imap php7.0-mcrypt php7.0-memcache php7.0-pspell php7.0-recode php7.0-snmp php7.0-sqlite php7.0-tidy php7.0-xmlrpc php7.0-xsl php7.0-imagick imagemagick libruby php7.0-memcached memcache

apt install mariadb-client mariadb-server
mysql_secure_installation

apt install phpmyadmin

apt install -t stretch-backports netdata

<VirtualHost *:80>
 RewriteEngine On
 ProxyRequests Off
 ProxyPreserveHost On

 ServerAdmin contact@yishan.io
 ServerName netdata.yishan.io

 <Proxy *>
AllowOverride AuthConfig
AuthName "Netdata"
AuthType Basic
AuthUserFile /etc/apache2/.htpasswd-netdata
Require valid-user
 AddDefaultCharset off
 Order deny,allow
 Allow from all
 </Proxy>

 ProxyPass "/" "http://localhost:19999/" connectiontimeout=5 timeout=30 keepalive=on
 ProxyPassReverse "/" "http://localhost:19999/"

 ErrorLog ${APACHE_LOG_DIR}/netdata-error.log
 CustomLog ${APACHE_LOG_DIR}/netdata-access.log combined
RewriteCond %{SERVER_NAME} =netdata.yishan.io
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

htpasswd -c /etc/apache2/.htpasswd-netdata user

iptables -t filter -A INPUT -p tcp --dport 19999 -j ACCEPT

vim /etc/init.d/phpmyadmin

#!/bin/bash

if [ "$1" = "start" ];then
  chmod 755 /usr/share/phpmyadmin
else if [ "$1" = "stop" ];then
  chmod 000 /usr/share/phpmyadmin
else
     echo "usage: phpmyadmin start | stop"
  fi
fi

exit 0

chmod + x /etc/init.d/phpmyadmin

/etc/init.d/phpmyadmin stop
# ou
/etc/init.d/phphmyadmin start

git clone "https://******.git"

git config --global user.email yishan@protonmail.com

git add "mon_fichier"
git commit -m "commentaire"

git push

git rm "mon_fichier"
git commit -m "commentaire"

git pull

sudo apt install zsh
sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"

git clone --depth=1 https://github.com/romkatv/powerlevel10k.git ${ZSH_CUSTOM:-$HOME/.oh-my-zsh/custom}/themes/powerlevel10k

git clone https://github.com/ryanoasis/nerd-fonts # on peut juste télécharger la police souhaitée
cd nerd-fonts
sudo ./install.sh Meslo

ZSH_THEME="powerlevel10k/powerlevel10k"

p10k configure

# ou

source .zshrc

#=== Plugins ===

antigen bundle git
antigen bundle pip
antigen bundle command-not-found

antigen bundle zsh-users/zsh-completions
antigen bundle zsh-users/zsh-autosuggestions
antigen bundle zsh-users/zsh-syntax-highlighting
antigen bundle zsh-users/zsh-history-substring-search
antigen bundle lukechilds/zsh-nvm

# === Antigen Apply ===
antigen apply

# === Aliases ===
#= Apt-get
alias maj='sudo apt-get update && sudo apt-get upgrade && sudo apt-get dist-upgrade'
alias up='sudo apt-get update'
alias install='sudo apt-get install'
alias autoremove='sudo apt-get autoremove'
alias autoclean='sudo apt-get autoclean'
alias cache='sudo apt-cache search'
alias vi='nvim'
alias exa='exa -abghHliS'

# === SSH === = Deprecated / the conf is now on file config folder ssh

# === BANNER /  MOTD ===
alias neo='neofetch --config off --bold off --colors 4 1 8 8 8 7'

# = Fuck
eval $(thefuck --alias fuck)

apt-get install tmux
https://github.com/tmux-plugins/tpm

tmux source-file ~/.tmux.conf

tmux split-windows

tmux split-windows -h

Tmux rename-window
Prefix + ,

tmux list-session
tmux ls

tmux kill-session -t <N° de la session>

Touche MAJ + Clic Gauche / Clic Molette

Prefix + t

Prefix + &

Prefix + %

Prefix + \"

sudo apt install neovim
mkdir .config
touch .config/init.vim

:set number
:set relativenumber
:set autoindent
:set tabstop=4
:set shiftwidth=4
:set smarttab
:set softtabstop=4
:set mouse=a
:set encoding=utf-8
:set fileencoding=utf-8

# tagbar
sudo apt install exuberant-ctags

# Tagbar
nmap <F8> :TagbarToggle<CR>
:set completeopt=preview

# colorscheme
:colorscheme jellybeans

# NerdTree
let g:NERDTreeDirArrowExpandable="+"
let g:NERDTreeDirArrowCollapsible="~"
nnoremap <C-f> :NERDTreeFocus<CR>
nnoremap <C-n> :NERDTree<CR>
nnoremap <C-t> :NERDTreeToggle<CR>

# coc-nvim

curl -sL https://deb.nodesource.com/setup_14.x | sudo -E bash -
sudo apt install nodejs npm
cd /home/cmassieu/.local/share/nvim/plugged/coc.nvim
sudo npm install -g yarn
yarn install
yarn build

sudo apt install libimage-exiftool-perl

wget https://exiftool.org/Image-ExifTool-12.52.tar.gz

tar -xzvf Image-ExifTool-12.52.tar.gz

cd Image-ExifTool-12.52

sudo perl Makefile.PL
make
sudo make install

exiftool image.jpg

exiftool -all= image.jpg

java -Xmx<max-memory> -Xms<initial-memory> -jar app.war

java -XX:+PrintFlagsFinal -version | grep -iE 'HeapSize|PermSize|ThreadStackSize'

adduser nom_utilisateur

groups <user>

gpasswd -d <user> <group>

userdel -r <user>

iptables -L

# Ex: postfix
iptables -L f2b-postfix

iptables -I INPUT -s IP_ADRESS -p tcp --dport 80,443 -j DROP

# Reinitialiser
iptables -F
iptables -t nat -F
# Tout accepter
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

/etc/init.d/firewall
chmod a+x /etc/init.d/firewall
sudo update-rc.d firewall defaults

sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing

sudo ufw delete allow ssh
sudo ufw allow 22000/tcp
sudo ufw enable

apt install fail2ban

systemctl enable fail2ban

systemctl start fail2ban

cp /etc/fail2ban/fail2ban.conf /etc/fail2ban/fail2ban.local
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

vim /etc/jail.local

bantime = 3600
findtime = 600
maxretry = 3
destemail = security@yishan.io
sender = fail2ban
action = %(action_mwl)s
# Ajout du numéro du port ssh qqui a été modifié
port = ssh,numero_du_port_ssh
# Jails mis en enabled = true
 sshd, sshd-ddos, apache-auth, apache-badbots, apache-botsearch, apache-fakegooglebot, apache-modsecurity, apache-nohome, apache-noscript, apache-overflows, apache-shellshock, courier-auth, courier-smtp, dovecot, mysqld-auth, postfix, postfix-rbl, postfix-sasl, recidive, sendmail-auth, sendmail-reject

# Jails Perso
[wordpress]
port = http,https
logpath = /var/log/apache2/wp_access.log
enabled = true

vim /etc/fail2ban/filter.d/wordpress.conf

# Fail2Ban filter for WordPress

[Definition]

failregex = <HOST> - - \[(\d{2})/\w{3}/\d{4}:\1:\1:\1 -\d{4}\] "POST /wp-login.php HTTP/1.1" 200

ignoreregex =

fail2ban-client status
fail2ban-client status <jail>

df -h

du -ah --max-depth=1 | sort -nr

du -xmhs ./* | sort -hr | head 20

du home/ -hs

du -sch *

Yaourt -S wgetpaste

# Default nick for pastes
DEFAULT_NICK=yishan
# Default service to paste to
DEFAULT_SERVICE=dpaste
# change default language for the ca and the osl services
DEFAULT_LANGUAGE_ca="bash"
DEFAULT_LANGUAGE_osl="Diff"
# change default expiration period for the ca service
DEFAULT_EXPIRATION_ca="1 day"

cat .wgetpaste.conf | wgetpaste

firewall-cmd --add-port=19999/tcp
firewall-cmd --add-port=60000-61000/udp --permanent

systemctl restart firewalld.service

mount /dev/sda1 /mnt
mount --bind /dev /mnt/dev
mount -t proc /proc /mnt/proc
mount -t sysfs /sys /mnt/sys

chroot /mnt /bin/bash

exit
umount /mnt/dev
umount /mnt/proc
umount /mnt/sys
umount /mnt

lsblk
sudo mount /dev/sda3 /mnt
sudo mount /dev/sda1 /mnt/boot/efi/
for i in /dev /dev/pts /proc /sys /run; do sudo mount -B $i /mnt$i; done
sudo cp -n /etc/resolv.conf /mnt/etc/
sudo chroot /mnt

journalctl -xn 50 -e

journalctl -xn 50 -u fail2ban.service

journalctl -b -p err -u systemd

journalctl -b -p err -n 50

sudo apt install virtualbox vagrant

# Définition de la box (image du système d'exploitation) à utiliser
Vagrant.configure("2") do |config|
    config.vm.box = "debian/bullseye64"

    # Configuration de la machine virtuelle
    config.vm.provider "virtualbox" do |vb|

    # Configuration de la mémoire et du processeur
      vb.memory = 4096
      vb.cpus = 2

    # Configuration de la carte réseau
      vb.customize ["modifyvm", :id, "--natdnshostresolver1", "on"]
      vb.customize ["modifyvm", :id, "--natdnsproxy1", "on"]

    # Ajout de mémoire vidéo
      vb.customize ["modifyvm", :id, "--vram", "256"]

    # Ajout de la prise en charge du son
      vb.customize ["modifyvm", :id, "--audio", "pulse"]

    # Ajout d'un contrôleur IDE
      #vb.customize ["storagectl", :id, "--name", "IDE Controller", "--add", "ide"]

    # Ajout d'un lecteur CD/DVD
      #vb.customize ["storageattach", :id, "--storagectl", "IDE Controller", "--port", 1, "--device", 0, "--type", "dvddrive", "--medium", "emptydrive"]
    end

    # Configuration du système d'exploitation
    config.vm.provision "bash", inline: <<-SHELL

    # Mise à jour de la liste des paquets
      apt-get update

    # Installation de KDE et des outils de développement
      apt-get install -y kde-plasma-desktop build-essential

    # Configuration du bureau KDE comme environnement par défaut
      update-alternatives --set x-session-manager /usr/bin/startplasma-x11

    # Installation de Flatpak
      apt-get install -y flatpak
      flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo

    # Installation de Lutris
      flatpak install -y flathub net.lutris.Lutris

vagrant up

vagrant ssh

vagrant halt

vagrant destroy

vagrant provision

vagrant status

cd /vmfs/volumes/volume01/yourmachine
vmkfstools -i Windows2008-tmp.vmdk  -d thin Windows2008.vmdk

#!/usr/bin/env bash

# Dépendances : screen, killall et rtorrent
### BEGIN INIT INFO
# Provides: box-rtorrent
# Required-Start: $syslog $network
# Required-Stop: $syslog $network
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start daemon at boot time
# Description: Start-Stop rtorrent user session
### END INIT INFO

## Début configuration ##
user="box"
## Fin configuration ##

rt_start() {
su --command="screen -dmS ${user}-rtorrent rtorrent" "${user}"
}

rt_stop() {
killall --user "${user}" screen
}

case "$1" in
start) echo "Starting rtorrent..."; rt_start
;;
stop) echo "Stopping rtorrent..."; rt_stop
;;
restart) echo "Restart rtorrent..."; rt_stop; sleep 1; rt_start
;;
*) echo "Usage: $0 {start|stop|restart}"; exit 1
;;
esac
exit 0