Tugriceri Web Notes

other ssl issue with my own ca

/root/tugriceri.com_CA/ca/
cat ca.conf
[ ca ]
default_ca = ca_default
[ ca_default ]
dir = /root/tugriceri.com_CA/ca/
certs = /root/tugriceri.com_CA/ca/
new_certs_dir = /root/tugriceri.com_CA/ca/ca.db.certs
database = /root/tugriceri.com_CA/ca/ca.db.index
serial = /root/tugriceri.com_CA/ca/ca.db.serial
RANDFILE = /root/tugriceri.com_CA/ca/ca.db.rand
certificate = /root/tugriceri.com_CA/ca/ca.crt
private_key = /root/tugriceri.com_CA/ca/ca.key
default_days = 365
default_crl_days = 30
default_md = md5
preserve = no
policy = generic_policy
[ generic_policy ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional


openssl ca -config ca.conf -notext -out one.tugriceri.com/one.tugriceri.com.cer -infiles one.tugriceri.com/one.tugriceri.com.csr

openssl x509 -req -days 365 -in one.tugriceri.com/one.tugriceri.com.csr -CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial -out one.tugriceri.com/one.tugriceri.com.cer

openssl verify -CAfile ../ca/ca.crt one.tugriceri.com.cer

Snoop with ssg

SSGW-> snoop filter ip src-ip 192.168.1.2 dst-ip 192.168.5.6
snoop filter added
SSGW-> snoop
Start Snoop, type ESC or 'snoop off' to stop, continue? [y]/n y
SSGW->
SSGW-> clear dbuf
SSGW-> get dbuf stream
...
SSGW-> snoop off

pfx to key

openssl pkcs12 -export -in my.pem -nodes -out my.pfx
openssl pkcs12 -in my.pfx -out my-nodes.key -nodes -nocerts

fast "show run"

conf#parser config cache interface #show runin privelege mode, type "term len 0" "show run" or "show start" will be faster "show run brief"

Cisco SSH Configuration

conf# username cagri privilege 15 secret cisco"creates a user in local database with privelege level 15 and encrypted password cisco"conf#ip domain-name tugriceri.com"sets a domain name for the device"conf#crypto key generate rsa"creates a rsa key. in the next step encryption bits will be asked. default is 512. 1024 is better"conf#ip ssh version 2"change the version of ssh to 2"conf#line vty 0 4"go under the virtual teletype ports"conf-line#transport input ssh"and change the login type from telnet to ssh"conf-line#login local"device will look at the local user database to log in a user"

Rsync Backup (with daemon option)

[root@srv ~]#vi /etc/xinetd.d/rsync "and change disable = yes to disable = no"
[root@srv ~]#service xinetd restart

[root@srv ~]#cat /etc/rsyncd.conf

[GFS]
path = /wwwroot/
comment = Webroot
auth users = rsync
secrets file = /etc/rsync.secrets
read only = false
list = yes
write only = false
[root@srv ~]# cat /etc/rsync.secrets
rsync:deneme

[root@backupsrv ~]# rsync -av rsync@192.168.1.1::GFS /backup/

ssh Tunnel

shell# ssh -f root@192.168.2.54 -L 7200:192.168.2.54:7200 -N

PRI Pinout

MB-M-YB-T-TB-Y-KB-K
TB-T-YB-M-MB-Y-KB-K

check: no loaded plugin implements 'check_main':

<i>check: no loaded plugin implements 'check_main': cannot scan! at</i><i> /usr/lib/perl5/site_perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm line</i><i> 164.<br /><br />vi init.pre<br /></i>loadplugin Mail::SpamAssassin::Plugin::Check<br />

Bir Asa log u

Routingfailedtolocatenexthopfor icmp from outside...

Net1 de olması gereken bir host yada network net2 de tanımlanmış ise bu log ile karşılaşılır. Host u fln silip doğru yerde tanımlarını yapmak lazım.