Quantcast
Channel: Athmane Madjoudj blog
Viewing all 20 articles
Browse latest View live
↧

Getting anaconda log and traceback manually without scp

June 15, 2012, 5:04 pm
$
0
0

If you’re testing anaconda and you want to get log and traceback manually but you don’t have ssh server to scp, you can try:


Switch to virtual terminal: ctl-alt-F2
Run cd /tmp ; python -m SimpleHTTPServer
Browse $IP:8000
↧
Search

hydra is now available in fedora

June 15, 2012, 5:05 pm
$
0
0

I've packaged hydra (currently 7.3) for fedora 16 and 17+, you can install it using:


su -c 'yum install hydra hydra-frontend'
↧
↧

Greybird theme for Fedora

June 17, 2012, 7:44 am
$
0
0

Just to let you know that I've packaged Greybird theme (an Xfce theme from Shimmer project) for fedora 17+, after the installation and activation your Xfce desktop should look to something like this screenshot (from Xfce.org):



Installation:

yum install greybird-*

Edit:

Here's an actual screenshot of Fedora 17 Xfce with Greybird theme and elementary Dark icons:

↧

CentOS 6.3 released

July 9, 2012, 2:25 pm
↧

How to add nginx logs to logwatch reports

August 19, 2012, 3:10 am
$
0
0

If you're using nginx package from EPEL6 (uses the same log format as Apache httpd by default) and you want to have a daily report of nginx logs with logwatch, here's a way to do it (there's multiples):

Create the following files:

/etc/logwatch/conf/logfiles/nginx.conf:


LogFile = nginx/*access.log
LogFile = nginx/*access.log.1

Archive = nginx/*access.log.*.gz

# Expand the repeats (actually just removes them now)
*ExpandRepeats

# Keep only the lines in the proper date range...
*ApplyhttpDate
/etc/logwatch/conf/services/http.conf:

###########################################################################
# Configuration file for http filter 
###########################################################################

Title = "nginx"

# Which logfile group...
LogFile = nginx

# Define the log file format
#
# This is now the same as the LogFormat parameter in the configuration file
# for httpd.  Multiple instances of declared LogFormats in the httpd
# configuration file can be declared here by concatenating them with the
# '|' character.  The default, shown below, includes the Combined Log Format,
# the Common Log Format, and the default SSL log format.
#$LogFormat = "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"|%h %l %u %t \"%r\" %>s %b|%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

# The following is supported for backwards compatibility, but deprecated:
# Define the log file format
#
#   the only currently supported fields are:
#   client_ip
#   request
#   http_rc
#   bytes_transfered
#   agent
#
#$HTTP_FIELDS = "client_ip ident userid timestamp request http_rc bytes_transfered referrer agent"
#$HTTP_FORMAT = "space     space space    brace    quote   space        space       quote   quote" 
# Define the field formats
#
#   the only currently supported formats are:
#   space = space delimited field
#   quote = quoted ("..") space delimited field
#   brace = braced ([..]) space delimited field

# Flag to ignore 4xx and 5xx error messages as possible hack attempts
#
# Set flag to 1 to enable ignore
# or set to 0 to disable
$HTTP_IGNORE_ERROR_HACKS = 0

# Ignore requests
# Note - will not do ANY processing, counts, etc... just skip it and go to
# the next entry in the log file. 
# Examples:
# 1. Ignore all URLs starting with /model/ and ending with 1 to 10 digits
#   $HTTP_IGNORE_URLS = ^/model/\d{1,10}$
#
# 2. Ignore all URLs starting with /model/ and ending with 1 to 10 digits and
#   all URLS starting with /photographer and ending with 1 to 10 digits
#   $HTTP_IGNORE_URLS = ^/model/\d{1,10}$|^/photographer/\d{1,10}$
#   or simply:
#   $HTTP_IGNORE_URLS = ^/(model|photographer)/\d{1,10}$

# To ignore a range of IP addresses completely from the log analysis,
# set $HTTP_IGNORE_IPS. For example, to ignore all local IP addresses:
#
#   $HTTP_IGNORE_IPS = ^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.|^127\.
#

# The variable $HTTP_USER_DISPLAY defines which user accesses are displayed.
# The default is not to display user accesses:
$HTTP_USER_DISPLAY = 0
# To display access failures:
# $HTTP_USER_DISPLAY = "$field{http_rc} >= 400"
# To display all user accesses except "Unauthorized":
# $HTTP_USER_DISPLAY = "$field{http_rc} != 401"


# vi: shiftwidth=3 tabstop=3 et
↧
↧

mod_security 2.6.7 for el5/el6 (RHEL, CentOS)

August 25, 2012, 9:55 am
↧

mod_security core rules package for EPEL (RHEL/CentOS)

August 28, 2012, 11:30 am
↧

Some Openbox tips

September 12, 2012, 1:33 am
$
0
0

1. Add shutdown and reboot to openbox menu

Add the following lines to ~/.config/openbox/menu.xml 
<item label="Restart">
    <action name="Execute">
 <prompt>
  Are you sure you want to reboot ?
 </prompt>
 <command>dbus-send --system --print-reply --dest="org.freedesktop.ConsoleKit" /org/freedesktop/ConsoleKit/Manager org.freedesktop.ConsoleKit.Manager.Restart</command>
    </action>
</item>
<item label="Shutdown">
    <action name="Execute">
 <prompt>
  Are you sure you want to shutdown ?
 </prompt>
 <command>dbus-send --system --print-reply --dest="org.freedesktop.ConsoleKit" /org/freedesktop/ConsoleKit/Manager org.freedesktop.ConsoleKit.Manager.Stop</command>
    </action>
</item>

2. Auto-move window to a specific desktop

Add the following lines to ~/.config/openbox/rc.xml in applications section, you can get app/window proprieties using obxprop utility (included in openbox package).

<application name="App_Name">
    <desktop>2</desktop>
</application>

3.Window snapping (like in Gnome 3)

  • Win-Up: Maximize window
  • Win-Down: Minimize window
  • Win-Left: Snap window to the left side
  • Win-Right: Snap window to the right side
Add the following lines to ~/.config/openbox/rc.xml in keyboard section 


    <keybind key="W-Up">
      <action name="ToggleMaximize"/>
    </keybind>
    <keybind key="W-Down">
      <action name="ToggleMaximize"/>
    </keybind>
    <keybind key="W-Left">
      <action name="UnmaximizeFull"/>
      <action name="MoveResizeTo">
        <x>0</x>
        <y>0</y>
        <width>50%</width>
        <height>100%</height>
      </action>
      <action name="ToggleMaximizeVert"/>
    </keybind>
    <keybind key="W-Right">
      <action name="UnmaximizeFull"/>
      <action name="MoveResizeTo">
        <x>50%</x>
        <y>0</y>
        <width>50%</width>
        <height>100%</height>
      </action>
      <action name="ToggleMaximizeVert"/>
    </keybind>
↧
Search

The new fedora pastebin service is in staging

October 19, 2012, 9:44 pm
↧
↧

New mod_security and mod_security_crs packages

November 15, 2012, 2:59 am
$
0
0
I just pushed security/bugfix updates for mod_security 2.7.1-3 and mod_security_crs 2.2.6-3 packages, if you are using them please test and provide karma in bodhi.

Note: there's no packages for EPEL5 because of the old libxml2 in RHEL5/CentOS5.

Update: I've pushed an update with backported fixes (from 2.7) in EPEL5, please test. https://admin.fedoraproject.org/updates/mod_security-2.6.8-2.el5

Details:


  • Update to 2.7.1
  • Update Core rules set to 2.2.6
  • Fix build against libxml2 >= 2.9 (upstreamed)
  • Add some missing directives RHBZ #569360
  • Fix multipart/invalid part ruleset bypass issue (CVE-2012-4528) (RHBZ #867424, #867773, #867774)


↧

HEADS-UP: mod_security packages security update

April 9, 2013, 8:27 am
$
0
0
↧

HEADS-UP: Fedora/EPEL mod_security packages security update

May 28, 2013, 12:50 pm
$
0
0
↧

Nginx with mod_security support repo for Fedora 20 and EPEL 6 (RHEL 6 / CentOS 6)

December 20, 2013, 5:56 am
$
0
0

ModSecurity for Nginx is a web server module for nginx, because of nginx extensibility model (does not use dynamically loaded modules), I can't just build mod_security like the one for Apache HTTPd, nginx module must be added at compile time.

So I made a repo of a modified Nginx with mod_security support, currently only available for Fedora 20 and EPEL 6 (RHEL 6 / CentOS 6) (can extend it latter - just ask).

I'll try to track the main package version, if you have issues with this repo, email me at athmane (AT) fedora domain or ping me on IRC (athmane)

http://repos.fedorapeople.org/repos/athmane/nginx-mod_security/

Next blog post we'll see how to use Core rules set with Nginx

Edit: http://blog.madjoudj.com/2013/12/getting-started-with-modsecurity-for.html

Edit 2: I forgot to specify that ModSecurity for Nginx is a BETA quality and you should not use it in production (for instance large POST requests to backend may timeout).

↧
↧

Getting started with ModSecurity for Nginx

December 20, 2013, 7:01 am
$
0
0

This is a quick guide on how to install nginx with mod_security and enable core rules set, this setup can also be used to protect your backend servers by running nginx as reverse proxy and achieve both greater performance and security.

The initial setup:

On Fedora: 

# cd /etc/yum.repo.d/
# curl -O 'http://repos.fedorapeople.org/repos/athmane/nginx-mod_security/fedora-nginx-mod_security.repo'
On EL6: 

# cd /etc/yum.repo.d/
# curl -O 'http://repos.fedorapeople.org/repos/athmane/nginx-mod_security/epel-nginx-mod_security.repo'
Install the packages: 

# yum install nginx mod_security_crs

Make sure you get the version of nginx with mod_security (it has modsec_VERSION in release tag).

Generate mod_security rules: 

# cp  /etc/nginx/mod_security.conf  /etc/nginx/mod_security.conf.default
# cat /etc/httpd/modsecurity.d/modsecurity_crs_10_config.conf \
/etc/httpd/modsecurity.d/activated_rules/modsecurity_*.conf >> /etc/nginx/mod_security.conf
# cp /etc/httpd/modsecurity.d/activated_rules/modsecurity_*.data /etc/nginx/
NB. I'll think of a better way to handle Core rules set in nginx.

Start nginx:
On Fedora: 

# systemctl start nginx
On EL6: 

# service nginx start
↧

Official blog about CentOS 7 (news, views and reports)

December 31, 2013, 1:52 am
$
0
0

Check the new official blog about CentOS 7, if you're looking get more information about CentOS 7 build progress, tools and tests suite update or just random thoughts about CentOS 7 and RHEL7 beta

http://seven.centos.org/

↧
Search

New nginx with mod_security module builds

February 24, 2014, 7:51 am
↧

ModSecurity 2.8.0 RC1 for Apache / Nginx packages

April 3, 2014, 6:49 am
↧
↧

HEADS-UP: EPEL5 mod_security-2.6.8-5 security update is broken

April 18, 2014, 1:00 pm
$
0
0

While ago, I pushed a mod_security security update (one line patch for CVE-2013-5705) without testing it thoroughly on EL5, which turns out to be broken(httpd does not start) [1].

I usually test all packages before pushing updates, but at that time I didn't have access to my build box (which has all my test VMs)

If you're going to update mod_security on EL5 box, you should get the one from epel5-testing:
https://admin.fedoraproject.org/updates/mod_security-2.6.8-6.el5

Sorry for any inconvenience caused.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1089343

↧

HEADS-UP: mod_qos Update

October 12, 2014, 9:31 am
$
0
0

I've pushed mod_qos-11.5 into testing, I didn't want to keep 10.x because it does not support IPv6 properly.

If you happen to use mod_qos, I'd really appreciate your feedback either in Bugzilla, Bodhi, email or irc

EDIT: EPEL7 package

↧

Newer mod_security packages for EPEL (CentOS/RHEL)

February 17, 2015, 9:17 am
$
0
0

If you are looking for newer mod_security packages, I have setup a repo [1] that tracks Fedora rawhide (aka devel) packages (currently 2.9.0), I usually update it after pushing the packages to Rawhide.

It also includes packages for RHEL/CentOS 7.x (replace mod_security included in the main repo and maintained by Red Hat)

[1] https://copr.fedoraproject.org/coprs/athmane/mod_security/
↧
Viewing all 20 articles
Browse latest View live
Search