自签 CA

参考 https://2heng.xin/2018/12/16/your-own-ca-with-openssl/ 并修改部分参数

#!/bin/bash
openssl genrsa -out cakey.pem 2048
cat << EOF > root.conf
[ req ]
default_bits        = 2048
default_keyfile     = key.pem
default_md          = sha256
distinguished_name  = req_distinguished_name
req_extensions      = req_ext
string_mask         = nombstr
x509_extensions     = x509_ext
[ req_distinguished_name ]
countryName                 = Country Name (2 letter code)
countryName_default         = CN
stateOrProvinceName         = State or Province Name (full name)
stateOrProvinceName_default = Shanghai
localityName                = Locality Name (eg, city)
localityName_default        = Shanghai
organizationName            = Organization Name (eg, company)
organizationName_default    = Dragonfly
commonName                  = Common Name (e.g. server FQDN or YOUR name)
commonName_max              = 64
commonName_default          = Dragonfly Fake Authority CA
[ x509_ext ]
authorityKeyIdentifier = keyid,issuer
basi

Use unexported variables

The unexported variables

unexport/i.go

package unexport
var i int
func init() {
    i = 2
}

The new variables points the unexported variables

main.go

package main
import (
    "fmt"
    _ "unsafe"
    _ "unexport"
)
//go:linkname I unexport.i
var I int
func main() {
    fmt.Println(I)
}

Use unexported functions

package main
import (
    "fmt"
    "github.com/alangpierce/go-forceexport"
)
func main() {
    var timeNow func() (int64, int32)
    err := forceexport.GetFunc(&timeNow, "time.now")
    if err != nil {
        // Handle errors if you care about name possibly being invalid.
        fmt.Println(err)
    }
    // Calls the actual time.now function.
    sec, nsec := timeNow()
    fmt.Printf("%v %v", sec, nsec)
}

Tcpdump advanced filters

Original publication: 2007-10-01

Last update: 2016-02-14

Repost from https://blog.wains.be/2007/2007-10-01-tcpdump-advanced-filters/

Introduction

In this article, I will explain how to use tcpdump to:

• know if IP options are set
• find DF packets (packets which we don't want to be fragmented)
• find fragmented packets
• find datagrams with low TTL
• find particular TCP flag combinations
• find datagrams with particular data (here, packets with command MAIL from the SMTP protocol and GET command from HTTP)

Notes

I usually type tcpdump -n -i eth1 -s 1600 before my filter but I won't do that throughout the article. -n prevents DNS lookups, -i specifies the interface and -s specifies the size of the packets (default is 65536 bytes). Be careful if you use -s 0 because depending on the version, you might be capturing 64K or full-lenght packets.

All commands are typed as root.

Feel free to contact me f

Introduction

Using a firewall is as much about making intelligent policy decisions as it is about learning the syntax. Firewalls like iptables are capable of enforcing policies by interpreting rules set by the administrator. However, as an administrator, you need to know what types of rules make sense for your infrastructure.

While other guides focus on the commands needed to get up and running, in this guide, we will discuss some of the decisions you will have to make when implementing a firewall. These choices will affect how your firewall behaves, how locked down your server is, and how it will respond to various conditions that are likely to occur from time to time. We will be using iptables as an example to discuss specifics, but most of the actual decisions will be relevant regardless of the tools used.

Deciding on a Default Policy

When constructing a firewall, one of the fundamental decisions that you must make

Introduction

Iptables is a firewall that plays an essential role in network security for most Linux systems. While many iptables tutorials will teach you how to create firewall rules to secure your server, this one will focus on a different aspect of firewall management: listing and deleting rules.

In this tutorial, we will cover how to do the following iptables tasks:

• List rules
• Clear Packet and Byte Counters
• Delete rules
• Flush chains (delete all rules in a chain)
• Flush all chains and tables, delete all chains, and accept all traffic

Note: When working with firewalls, take care not to lock yourself out of your own server by blocking SSH traffic (port 22, by default). If you lose access due to your firewall settings, you may need to connect to it via the console to fix your access. Once you are connected via the console, you can change your firewall rules to allow SSH access (or allow all traffic). If your saved fir

Introduction

Iptables is the software firewall that is included with most Linux distributions by default. This cheat sheet-style guide provides a quick reference to iptables commands that will create firewall rules are useful in common, everyday scenarios. This includes iptables examples of allowing and blocking various services by port, network interface, and source IP address.

How To Use This Guide

• If you are just getting started with configuring your iptables firewall, check out our introduction to iptables
• Most of the rules that are described here assume that your iptables is set to DROP incoming traffic, through the default input policy, and you want to selectively allow traffic in
• Use whichever subsequent sections are applicable to what you are trying to achieve. Most sections are not predicated on any other, so you can use the examples below independently
• Use the Contents menu on the right side of this page (at

Reason Why

Ever get the dreaded error:

Virtual memory exhausted: Cannot allocate memory

With the first iterations of Raspberry Pi the Model A comes with 256mb of memory. While the Raspberry Pi B comes with a modest 512mb of memory. For most applications this amount of memory is actually quiet a bit. As soon as you start compiling your own binaries this amount starts to seem dismal.

Insert reason why swap on flash-based memory is bad here.

Limitations

The Raspbian distribution comes with a 100mb swapfile. This is actually a bit on the small side. A general rule of thumb is swapfile size should be about twice as much as the available RAM on the machine. In the examples below I have a Raspberry Pi B+. So the amount of swap I use is 1024mb.

Commands

We will change the configuration in the file /etc/dphys-swapfile :

sudo nano /etc/dphys-swapfile

The default value in Raspbian is:

CONF_SWAPSIZE=100

We will