From 94e429f914be777770cf8094d728008a5efcf6ff Mon Sep 17 00:00:00 2001 From: Silvino Silva Date: Mon, 22 Aug 2016 21:41:57 +0100 Subject: added all core files --- core/bash.html | 153 ++++++++++++++++++++ core/conf/rc.d/net | 50 +++++++ core/conf/rc.d/wlan | 55 ++++++++ core/index.html | 82 ++++++----- core/linux.html | 116 +++++++++++++++ core/network.html | 304 ++++++++++++++++++++++++++++++++++++++++ core/prtget.html | 161 +++++++++++++++++++++ core/scripts/backup-system.sh | 26 ++++ core/scripts/iptables.sh | 319 ++++++++++++++++++++++++++++++++++++++++++ core/scripts/mkparted.sh | 9 ++ core/tar.html | 119 ++++++++++++++++ core/tmux.html | 118 ++++++++++++++++ core/vim.html | 159 +++++++++++++++++++++ tools/index.html | 101 +++++++++++++ 14 files changed, 1736 insertions(+), 36 deletions(-) create mode 100644 core/bash.html create mode 100755 core/conf/rc.d/net create mode 100755 core/conf/rc.d/wlan create mode 100644 core/linux.html create mode 100644 core/network.html create mode 100644 core/prtget.html create mode 100644 core/scripts/backup-system.sh create mode 100644 core/scripts/iptables.sh create mode 100644 core/scripts/mkparted.sh create mode 100644 core/tar.html create mode 100644 core/tmux.html create mode 100644 core/vim.html create mode 100644 tools/index.html diff --git a/core/bash.html b/core/bash.html new file mode 100644 index 0000000..ab1350d --- /dev/null +++ b/core/bash.html @@ -0,0 +1,153 @@ + + + + + 4. Bash + + + Systools Index + +

4. Bash

+ +

First create skeleton directory to place the default user + files to be copied to its home directory by + useradd command.

+ +

+        $ sudo mkdir /etc/skel
+

+ +

Just to be sure, setup bash as default;

+ +

+        $ chsh
+

+ +

Description of configuration files

+ +

~/.bash_profile: Minimal file that just load .profile and then .bashrc, + in this order.
~/.profile
+: Not specifically related to bash, such as + environment variables (PATH). Only for login shells (sh) + or graphical applications.
~/.bashrc: Related to interactive command line, such as bash + alias, editor.

+ +

4.1. Profile

+ +

Example of ~/.profile;

+ +

+        $ sudo vim /etc/skel/.profile
+

+ +

+        PATH=~/.composer/vendor/bin:${PATH}
+
+        export GPG_AGENT_INFO  # the env file does not contain the export statement
+        export SSH_AUTH_SOCK   # enable gpg-agent for ssh
+

+ +

4.2. Bash RC

+ +

Example of bashrc;

+ +

+        $ sudo vim /etc/skel/.bashrc
+

+ +

+        # If not running interactively, don't do anything
+        case $- in
+                *i*) ;;
+                *) return;;
+        esac
+
+
+        # check the window size after each command and, if necessary,
+        # update the values of LINES and COLUMNS.
+        shopt -s checkwinsize
+
+
+        # don't put duplicate lines or lines starting with space in the history.
+        # See bash(1) for more options
+        HISTCONTROL=ignoreboth
+
+        # append to the history file, don't overwrite it
+        shopt -s histappend
+
+        # for setting history length see HISTSIZE and HISTFILESIZE in bash(1)
+        HISTSIZE=1000
+        HISTFILESIZE=2000
+
+        alias tmux="tmux -2"
+
+        alias rm='rm -i'
+        #alias cp='cp -i'
+        alias mv='mv -i'
+        # Prevents accidentally clobbering files.
+        alias mkdir='mkdir -p'
+
+        alias h='history'
+        alias j='jobs -l'
+        alias which='type -a'
+        alias ..='cd ..'
+
+        # Generate a password
+        genpasswd () {
+            local l=$1
+            [ "$l" == "" ] && l=20
+            tr -dc A-Za-z0-9_ < /dev/urandom | head -c ${l} | xargs
+        }
+
+        # Git graph log
+        glog () {
+            git log --graph --abbrev-commit --decorate --date=relative --all
+        }
+
+        if [[ -z "$TMUX" ]] ;then
+            ID="`tmux ls | grep -vm1 attached | cut -d: -f1`" # get the id of a deattached session
+            if [[ -z "$ID" ]] ;then # if not available create a new one
+                tmux new-session
+            else
+                tmux attach-session -t "$ID" # if available attach to it
+            fi
+        fi
+

+ +

4.3. Bash profile

+ +

+        $ sudo vim /etc/skel/.bash_profile
+

+ +

+                #!/bin/bash
+                if [ -f ~/.profile ]; then
+                   source ~/.profile
+                fi
+
+                if [ -f ~/.bashrc ]; then
+                   source ~/.bashrc
+                fi
+

+ + + Systools Index +

+ + + + diff --git a/core/conf/rc.d/net b/core/conf/rc.d/net new file mode 100755 index 0000000..d111a25 --- /dev/null +++ b/core/conf/rc.d/net @@ -0,0 +1,50 @@ +#!/bin/sh +# +# /etc/rc.d/net: start/stop network interface +# + +# Connection type: "DHCP" or "static" +TYPE="static" + +# For "static" connections, specify your settings here: +# To see your available devices run "ip link". +DEV=enp8s0 +ADDR=192.168.1.33 +MASK=24 +GW=192.168.1.1 + +# Optional settings: +DHCPOPTS="-h $(/bin/hostname) -C resolv.conf $DEV" + +case $1 in + start) + if [ "${TYPE}" = "DHCP" ]; then + /sbin/dhcpcd ${DHCPOPTS} + else + /sbin/ip addr add ${ADDR}/${MASK} dev ${DEV} broadcast + + /sbin/ip link set ${DEV} up + /sbin/ip route add default via ${GW} + fi + ;; + stop) + if [ "${TYPE}" = "DHCP" ]; then + /usr/bin/pkill -F /var/run/dhcpcd-${DEV}.pid + + else + # /sbin/ip route del default + /sbin/ip route flush dev ${DEV} + /sbin/ip link set ${DEV} down + # /sbin/ip addr del ${ADDR}/${MASK} dev ${DEV} + /sbin/ip addr flush dev ${DEV} + fi + ;; + restart) + $0 stop + $0 start + ;; + *) + echo "Usage: $0 [start|stop|restart]" + ;; +esac + +# End of file diff --git a/core/conf/rc.d/wlan b/core/conf/rc.d/wlan new file mode 100755 index 0000000..263cf42 --- /dev/null +++ b/core/conf/rc.d/wlan @@ -0,0 +1,55 @@ +#!/bin/sh +# +# /etc/rc.d/wlan: start/stop wireless interface +# +DEV=wlp7s0 + +SSD=/sbin/start-stop-daemon +PROG_DHCP=/sbin/dhcpcd +PROG_WIFI=/usr/sbin/wpa_supplicant +PID_DHCP=/var/run/dhcpcd-${DEV}.pid +PID_WIFI=/var/run/wpa_supplicant.pid + +OPTS_DHCP="-h $(/bin/hostname) -C resolv.conf $DEV" +OPTS_WIFI="-B -P $PID_WIFI -D nl80211,wext -c /etc/wpa_supplicant.conf -i $DEV" + +print_status() { + $SSD --status --pidfile $2 + case $? in + 0) echo "$1 is running with pid $(cat $2)" ;; + 1) echo "$1 is not running but the pid file $2 exists" ;; + 3) echo "$1 is not running" ;; + 4) echo "Unable to determine the program status" ;; + esac +} + +case $1 in + start) + $SSD --start --pidfile $PID_WIFI --exec $PROG_WIFI -- $OPTS_WIFI && \ + $SSD --start --pidfile $PID_DHCP --exec $PROG_DHCP -- $OPTS_DHCP + RETVAL=$? + ;; + stop) + ( $SSD --stop --retry 10 --pidfile $PID_DHCP + $SSD --stop --retry 10 --pidfile $PID_WIFI ) + RETVAL=$? + /sbin/ip link set ${DEV} down + /sbin/ip addr flush dev ${DEV} + ;; + restart) + $0 stop + $0 start + ;; + status) + print_status $PROG_WIFI $PID_WIFI + print_status $PROG_DHCP $PID_DHCP + ;; + *) + echo "Usage: $0 [start|stop|restart|status]" + ;; +esac + +exit $RETVAL + +# End of file + diff --git a/core/index.html b/core/index.html index 631aa04..6456372 100644 --- a/core/index.html +++ b/core/index.html @@ -68,65 +68,75 @@

System Administration

System Tools

4. Network +

diff --git a/core/linux.html b/core/linux.html new file mode 100644 index 0000000..8a77980 --- /dev/null +++ b/core/linux.html @@ -0,0 +1,116 @@ + + + + + 3. Kernel Linux + + + + Systools Index +

3.6. Kernel Linux

+ +

Linux is a monolith kernel, a big one !!!.

+ +

This instructions are done + with active chroot + and inside chroot;

+ +

+       # chroot $CHROOT /bin/bash
+

+ +

3.6.1. Port Linux Libre

+ +

This will install linux-libre port + and dracut;

+ +

+        $ prt-get depinst linux-libre
+

+ +

3.6.2. Manual Install

+ +

Download Linux Source from linux libre, this ensure that kernel is free of blobs.

+ +

+        $ pkgmk -do
+

+ +

Crux iso comes with config that you can use as + a starting point.

+ +

+
+        cp ../linux-4.5.5.defconfig .config
+        $ make oldefconfig
+

+ + +

If you like graysky2 kernel_gcc_patch (download master) that adds more cpu options (FLAGS native)

+ +

+        $ unzip kernel_gcc_patch-master.zip
+

+ +

+        $ cd ~/linux-4.5.5/
+        $ patch -p1 < ../kernel_gcc_patch-master/enable_additional_cpu_optimizations_fo
+        r_gcc_v4.9+_kernel_v3.15+.patch
+        patching file arch/x86/include/asm/module.h
+        patching file arch/x86/Kconfig.cpu
+        patching file arch/x86/Makefile
+        Hunk #1 succeeded at 85 (offset -7 lines).
+        patching file arch/x86/Makefile_32.cpu
+

+ +

Gresecurity

+ +

+        patch -p1 < $SRC/grsecurity-3.1-4.5.5-201605291201.patch
+

+ +

Configure kernel according to your current kernel + hardware support run;

+ +

+        $ make localmodconfig
+

+ +

This will disable all unloaded modules, + you can use localyesconfig mark all loaded + to be built in the kernel. This example + get information about which graphic + module (driver) is in use;

+ +

+        # lspci -nnk | grep -i vga -A3 | grep 'in use'
+        Kernel driver in use: i915
+        #
+

+ + +

+        $ cd ~/linux-4.5.5/
+        $ make -j $(nproc) all
+        $ sudo make modules_install
+        $ sudo cp arch/x86/boot/bzImage /boot/vmlinuz-4.5.5
+        $ sudo cp System.map /boot/System.map-4.5.5
+

+ +

3.6.3. Manual Remove

+ +

+        $ sudo rm -r /lib/modules/4.5.5-gnu
+        $ sudo rm /boot/vmlinuz-4.5.5
+        $ sudo rm /boot/System.map-4.5.5
+

+ + Systools Index +

+ + + diff --git a/core/network.html b/core/network.html new file mode 100644 index 0000000..e8813e2 --- /dev/null +++ b/core/network.html @@ -0,0 +1,304 @@ + + + + + 2. Network + + + Core Doc Index + +

4. Network

+ +

Examples describe a network that will be configured with + two interfaces Ethernet and Wireless. Ethernet interface will + be configured as default route, wireless interface covered here + is simple alternative to Ethernet connection.

+ +

/etc/rc.d/net: Configure Ethernet interface and static or dynamic (dhcp) + connection to the router and add as default gateway.
/etc/rc.d/wlan: Configure Wireless interface, wpa_supplicant and dynamic (dhcp) + connection to router and add as default gateway.

+ +

If is first boot after install configure iptables and + one of above described scripts then proceed to upgrade your + system.

+ +

4.1. Iptables

+ +

You can use + iptables script + at boot time and iptables-save and iptables-restore tools to + configure nat and filtering;

+ +

+        # mkdir /etc/iptables
+        # cp conf/iptables.sh /etc/iptables/
+

+ +

Adjust iptables to your needs, then;

+ +

+        # cd /etc/iptables
+        # sh iptables.sh
+        # iptables-save > rules.v4
+

+ +

Copy init script, edit if you dont like to + let drop when you call stop.

+ +

+        # cp /home/user/sysdoc/conf/etc/rc.d/iptables /etc/rc.d/
+        # vim /etc/rc.d/iptables
+        # chmod +x /etc/rc.d/iptables
+

+ +

4.2. Resolver

+ +

4.3. Wpa and dhcpd

+ +

There is more information on + Wiki Wifi Start Scripts.

+ +

+        # ip link
+

+ +

+        # iwlist wlp2s0 scan
+

+ +

+        # iwconfig wlp2s0 essid NAME key s:ABCDE12345
+

+ +

+        # ip addr add 192.168.1.65 dev wlp2s0
+

+ +

4.3.1. Wpa Supplicant

+ +

Configure wpa supplicant edit;

+ +

+        # vim /etc/wpa_supplicant.conf
+

+ +

+        ctrl_interface=/var/run/wpa_supplicant
+        update_config=1
+        fast_reauth=1
+        ap_scan=1
+

+ +

+        # wpa_passphrase <ssid> <password> >> /etc/wpa_supplicant.conf
+

+ +

Now start wpa_supplicant with:

+ +

+        # wpa_supplicant -B -i wlp2s0 -c /etc/wpa_supplicant.conf
+        Successfully initialized wpa_supplicant
+

+ +

Use /etc/rc.d/wlan + init script to auto load wpa configuration and dhcp + client.

+ +

4.3.2. Wpa Cli

+ +

+        # wpa_cli
+        > status
+

+ +

+        > add_network
+        3
+

+ +

+        > set_network 3 ssid "Valcovo-Network"
+        OK
+

+ +

+        > set_network 3 psk "uber-secret-pass"
+        OK
+

+ +

+        > enable_network 3
+        OK
+

+ +

+        > list_networks
+

+ +

+        > select_network 3
+

+ +

+        > save_config
+

+ + +

4.4. Static IP

+ +

+        # ip link
+        # ip addr flush dev ${DEV}
+        # ip route flush dev ${DEV}
+

+ +

+        # ip addr add ${ADDR}/${MASK} dev ${DEV} broadcast +
+        # ip link set ${DEV} up
+        # ip route add default via ${GW}
+

+ +

4.5. Sysctl

+ +

Sysctl references + Arch TCP/IP stack hardening, + Cyberciti Nginx Hardning, + Cyberciti Security Hardening, + edit /etc/sysctl.conf;

+ +

+        #
+        # /etc/sysctl.conf: configuration for system variables, see sysctl.conf(5)
+        #
+
+        kernel.printk = 1 4 1 7
+
+        # Disable ipv6
+    net.ipv6.conf.all.disable_ipv6 = 1
+    net.ipv6.conf.default.disable_ipv6 = 1
+    net.ipv6.conf.lo.disable_ipv6 = 1
+
+        # Tuen IPv6
+        # net.ipv6.conf.default.router_solicitations = 0
+        # net.ipv6.conf.default.accept_ra_rtr_pref = 0
+        # net.ipv6.conf.default.accept_ra_pinfo = 0
+        # net.ipv6.conf.default.accept_ra_defrtr = 0
+        # net.ipv6.conf.default.autoconf = 0
+        # net.ipv6.conf.default.dad_transmits = 0
+        # net.ipv6.conf.default.max_addresses = 0
+
+        # Avoid a smurf attack
+        net.ipv4.icmp_echo_ignore_broadcasts = 1
+
+        # Turn on protection for bad icmp error messages
+        net.ipv4.icmp_ignore_bogus_error_responses = 1
+
+        # Turn on syncookies for SYN flood attack protection
+        net.ipv4.tcp_syncookies = 1
+
+    ## protect against tcp time-wait assassination hazards
+    ## drop RST packets for sockets in the time-wait state
+    ## (not widely supported outside of linux, but conforms to RFC)
+    net.ipv4.tcp_rfc1337 = 1
+
+    ## tcp timestamps
+    ## + protect against wrapping sequence numbers (at gigabit speeds)
+    ## + round trip time calculation implemented in TCP
+    ## - causes extra overhead and allows uptime detection by scanners like nmap
+    ## enable @ gigabit speeds
+    net.ipv4.tcp_timestamps = 0
+    #net.ipv4.tcp_timestamps = 1
+
+        # Turn on and log spoofed, source routed, and redirect packets
+        net.ipv4.conf.all.log_martians = 1
+        net.ipv4.conf.default.log_martians = 1
+
+    ## ignore echo broadcast requests to prevent being part of smurf attacks (default)
+    net.ipv4.icmp_echo_ignore_broadcasts = 1
+
+        # No source routed packets here
+        net.ipv4.conf.all.accept_source_route = 0
+        net.ipv4.conf.default.accept_source_route = 0
+
+    ## sets the kernels reverse path filtering mechanism to value 1(on)
+    ## will do source validation of the packet's recieved from all the interfaces on the machine
+    ## protects from attackers that are using ip spoofing methods to do harm
+        net.ipv4.conf.all.rp_filter = 1
+        net.ipv4.conf.default.rp_filter = 1
+        net.ipv6.conf.default.rp_filter = 1
+    net.ipv6.conf.all.rp_filter = 1
+
+        # Make sure no one can alter the routing tables
+        net.ipv4.conf.all.accept_redirects = 0
+        net.ipv4.conf.default.accept_redirects = 0
+        net.ipv4.conf.all.secure_redirects = 0
+        net.ipv4.conf.default.secure_redirects = 0
+
+        # Act as a router, necessary for Access Point
+        net.ipv4.ip_forward = 0
+        net.ipv4.conf.all.send_redirects = 0
+        net.ipv4.conf.default.send_redirects = 0
+
+        kernel.shmmax = 500000000
+        # Turn on execshild
+        kernel.exec-shield = 1
+        kernel.randomize_va_space = 1
+
+        # Optimization for port usefor LBs
+        # Increase system file descriptor limit
+        fs.file-max = 65535
+
+        # Allow for more PIDs (to reduce rollover problems); may break some programs 32768
+        kernel.pid_max = 65536
+
+        # Increase system IP port limits
+        net.ipv4.ip_local_port_range = 2000 65000
+
+        # Increase TCP max buffer size setable using setsockopt()
+        net.ipv4.tcp_rmem = 4096 87380 8388608
+        net.ipv4.tcp_wmem = 4096 87380 8388608
+
+        # Increase Linux auto tuning TCP buffer limits
+        # min, default, and max number of bytes to use
+        # set max to at least 4MB, or higher if you use very high BDP paths
+        # Tcp Windows etc
+        net.core.rmem_max = 8388608
+        net.core.wmem_max = 8388608
+        net.core.netdev_max_backlog = 5000
+        net.ipv4.tcp_window_scaling = 1
+
+        # End of file
+

+ +

Change to act as a router;

+ +

+    	# Act as a router, necessary for Access Point
+        net.ipv4.ip_forward = 1
+        net.ipv4.conf.all.send_redirects = 1
+        net.ipv4.conf.default.send_redirects = 1
+

+ + +

Load new settings;

+ +

+        # sysctl -p
+

+ + Systools Index +

+ + + + diff --git a/core/prtget.html b/core/prtget.html new file mode 100644 index 0000000..5d6d714 --- /dev/null +++ b/core/prtget.html @@ -0,0 +1,161 @@ + + + + + 5. Prt-get tool + + + + Core Doc Index + +

5. Prt-get tool

+ +

For more information read crux handbook: + Package management front-end: prt-get +

+ +

For more information read crux handbook: + Introduction to pkgutils.

+ +

pkgmk(8): Makes a software package. A package is an archive of + files (.pkg.tar.gz, .pkg.tar.bz2 or .pkg.tar.xz) + that can be installed using pkgadd(8).
pkgadd(8): install a software package. A package is an + archive of files (.pkg.tar.gz).
pkginfo(8): Displays information about software packages that + are installed on the system or that reside in a + particular directory.
pkgrm(8): Removes/uninstalls a previously installed software + packages.
prt-get(8): prt-get is a package management tool which + provides additional functionality to crux' package + management system. It works with the local ports tree + and is therefore fully compatible with ports(8) and + pkgmk(8)/pkgadd(8)

+ + +

Test configuration by runing prt-get as user installing + ports that are related;

+ +

+        $ prt-get depinst prt-utils prt-get-bashcompletion
+

+ +

3.1. Update System

+ +

Before build software get latest version of port collections;

+ +

+        $ sudo ports -u
+

+ +

When coming from install or there is to much updates, I prefer to + update gcc, glibc, libtool and binutils before doing a sysup;

+ +

+        $ prt-get update gcc
+        $ prt-get update glibc
+        $ prt-get update libtool
+        $ prt-get update binutils
+

+ +

Rebuild any revision dependency;

+ +

+        $ prt-get update -fr $(revdep)
+

+ +

Build and install updated versions of ports;

+ +

+        $ prt-get sysup
+

+ +

3.2. Install port and dependencies

+ +

+        $ prt-grt depinst iw
+        $ prt-get depinst gnupg
+        $ prt-get depinst shorewall
+        $ prt-get depinst logrotate
+        # samhain at this point add /etc/logrotate.d/samhain
+        $ prt-get -if depinst samhain
+        $ prt-get depinst dnsmasq
+        $ prt-get depinst tmux
+        $ prt-get depinst git
+

+ +

3.3. Activate Sysdoc ports

+ +

Clone this documentation;

+ +

+        $ git clone https://github.com/s1lvino/sysdoc.git
+

+ +

Install sysdoc port collection;

+ +

+        $ sudo cp sysdoc/ports/sysdoc.httpup /etc/ports/
+

+ +

Edit /etc/prt-get.conf to activate sysdoc collection;

+ +

+        prtdir /usr/ports/sysdoc
+        # the following line enables the user maintained contrib collection
+        prtdir /usr/ports/contrib
+

+ +

Get sysdoc ports;

+ +

+        $ sudo ports -u sysdoc
+

+ +

3.4. Show port information

+ +

+        $ prt-get info port_name
+

+ +

3.5. Show port dependencies

+ +

+        $ prt-get depends port_name
+

+ +

3.6. Print information

+ +

Example how to get ports installed from contrib. Maybe there is + a "cleaner" way to this, for now is ok;

+ +

+        prt-get printf "%p %i %n %v\n" | grep "/usr/ports/contrib yes"
+

+ + Systools Index +

+ + + diff --git a/core/scripts/backup-system.sh b/core/scripts/backup-system.sh new file mode 100644 index 0000000..3fa1ab2 --- /dev/null +++ b/core/scripts/backup-system.sh @@ -0,0 +1,26 @@ +#!/bin/sh + +echo -n "root directory you want backup (/mnt/): " +read ROOT_DIR + +echo -n "where you want to save (/home/user): " +read DEST_DIR + +echo -n "backup name (system_name): " +read BCK_NAME + +echo $DES_DIR +echo $ROOT_DIR + +tar --xattrs -zcpf $DEST_DIR/$BCK_NAME-`date '+%Y-%j-%H-%M-%S'`.tar.gz \ + --directory=$ROOT_DIR \ + --exclude=var/ports \ + --exclude=var/run \ + --exclude=usr/src \ + --exclude=mnt \ + --exclude=home \ + --exclude=dev \ + --exclude=run \ + --exclude=tmp \ + --exclude=proc \ + --exclude=sys . diff --git a/core/scripts/iptables.sh b/core/scripts/iptables.sh new file mode 100644 index 0000000..b450bb3 --- /dev/null +++ b/core/scripts/iptables.sh @@ -0,0 +1,319 @@ +#!/bin/sh + +# +# XXXXXXXXXXXXXXXXXX +# XXX Network XXX +# XXXXXXXXXXXXXXXXXX +# + +# | +# v +# +-------------+ +------------------+ +# |table: filter| <---+ | table: nat | +# |chain: INPUT | | | chain: PREROUTING| +# +-----+-------+ | +--------+---------+ +# | | | +# v | v +# [local process] | **************** +--------------+ +# | +---------+ Routing decision +------> |table: filter | +# v **************** |chain: FORWARD| +# **************** +------+-------+ +# Routing decision | +# **************** | +# | | +# v **************** | +# +-------------+ +------> Routing decision <---------------+ +# |table: nat | | **************** +# |chain: OUTPUT| | + +# +-----+-------+ | | +# | | v +# v | +-------------------+ +# +--------------+ | | table: nat | +# |table: filter | +----+ | chain: POSTROUTING| +# |chain: OUTPUT | +--------+----------+ +# +--------------+ | +# v +# XXXXXXXXXXXXXXXXXX +# XXX Network XXX +# XXXXXXXXXXXXXXXXXX +# +# iptables [-t table] {-A|-C|-D} chain rule-specification +# +# iptables [-t table] {-A|-C|-D} chain rule-specification +# +# iptables [-t table] -I chain [rulenum] rule-specification +# +# iptables [-t table] -R chain rulenum rule-specification +# +# iptables [-t table] -D chain rulenum +# +# iptables [-t table] -S [chain [rulenum]] +# +# iptables [-t table] {-F|-L|-Z} [chain [rulenum]] [options...] +# +# iptables [-t table] -N chain +# +# iptables [-t table] -X [chain] +# +# iptables [-t table] -P chain target +# +# iptables [-t table] -E old-chain-name new-chain-name +# +# rule-specification = [matches...] [target] +# +# match = -m matchname [per-match-options] +# +# +# Targets +# +# can be a user defined chain +# +# ACCEPT - accepts the packet +# DROP - drop the packet on the floor +# QUEUE - packet will be stent to queue +# RETURN - stop traversing this chain and +# resume ate the next rule in the +# previeus (calling) chain. +# +# if packet reach the end of the chain or +# a target RETURN, default policy for that +# chain is applayed. +# +# Target Extensions +# +# AUDIT +# CHECKSUM +# CLASSIFY +# DNAT +# DSCP +# LOG +# Torn on kernel logging, will print some +# some information on all matching packets. +# Log data can be read with dmesg or syslogd. +# This is a non-terminating target and a rule +# should be created with matching criteria. +# +# --log-level level +# Level of logging (numeric or see sys- +# log.conf(5) +# +# --log-prefix prefix +# Prefix log messages with specified prefix +# up to 29 chars log +# +# --log-uid +# Log the userid of the process with gener- +# ated the packet +# NFLOG +# This target pass the packet to loaded logging +# backend to log the packet. One or more userspace +# processes may subscribe to the group to receive +# the packets. +# +# ULOG +# This target provides userspace logging of maching +# packets. One or more userspace processes may then +# then subscribe to various multicast groups and +# then receive the packets. +# +# +# Commands +# +# -A, --append chain rule-specification +# -C, --check chain rule-specification +# -D, --delete chain rule-specification +# -D, --delete chain rulenum +# -I, --insert chain [rulenum] rule-specification +# -R, --replace chain rulenum rule-specification +# -L, --list [chain] +# -P, --policy chain target +# +# Parameters +# +# -p, --protocol protocol +# tcp, udp, udplite, icmp, esp, ah, sctp, all +# -s, --source address[/mask][,...] +# -d, --destination address[/mask][,...] +# -j, --jump target +# -g, --goto chain +# -i, --in-interface name +# -o, --out-interface name +# -f, --fragment +# -m, --match options module-name +# iptables can use extended packet matching +# modules. +# -c, --set-counters packets bytes + +IPT="/usr/sbin/iptables" +SPAMLIST="blockedip" +SPAMDROPMSG="BLOCKED IP DROP" +PUB_IF="wlp7s0" +#PUB_IP="192.168.1.65" +#PRIV_IF="wlp3s0" + +modprobe ip_conntrack +modprobe ip_conntrack_ftp + +echo "Stopping ipv4 firewall and deny everyone..." + +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X + +echo "Starting ipv4 firewall filter table..." + +# Set Default Rules +iptables -P INPUT DROP +iptables -P FORWARD DROP +iptables -P OUTPUT DROP + +#unlimited +$IPT -A INPUT -i lo -j ACCEPT +$IPT -A OUTPUT -o lo -j ACCEPT + +# Block sync +$IPT -A INPUT -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: " +$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP + +# Block Fragments +$IPT -A INPUT -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: " +$IPT -A INPUT -f -j DROP + +# Block bad stuff +$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP +$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP + +$IPT -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: " +$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # NULL packets + +$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP + +$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: " +$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS + +$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: " +$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans + +$IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP + +##### Add your AP rules below ###### + +#echo 1 > /proc/sys/net/ipv4/ip_forward +#$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP} +#$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -j ACCEPT +#$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -j ACCEPT + +#$IPT -A INPUT -i ${PRIV_IF} -j ACCEPT +#$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT + +##### Server rules below ###### + +#echo "Allow ICMP" +#$IPT -A INPUT -i ${PUB_IF} -p icmp --icmp-type 0 -s 192.168.0.0/12 -j ACCEPT +#$IPT -A OUTPUT -o ${PUB_IF} -p icmp --icmp-type 0 -d 192.168.0.0/12 -j ACCEPT +#$IPT -A INPUT -i ${PUB_IF} -p icmp --icmp-type 8 -s 192.168.0.0/12 -j ACCEPT +#$IPT -A OUTPUT -o ${PUB_IF} -p icmp --icmp-type 8 -d 192.168.0.0/12 -j ACCEPT + +#echo "Allow DNS Server" +#$IPT -A INPUT -i ${PUB_IF} -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT +#$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -d 192.168.0.0/16 -j ACCEPT + +#echo "Allow HTTP and HTTPS server" +#$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 443 -m state --state NEW,ESTABLISHED -s 192.168.0.0/12 -j ACCEPT +#$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 80 -m state --state NEW,ESTABLISHED -s 192.168.0.0/12 -j ACCEPT +#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 80 -m state --state NEW,ESTABLISHED -s 192.168.0.0/12 -j ACCEPT +#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 443 -m state --state NEW,ESTABLISHED -s 192.168.0.0/12 -j ACCEPT + +#echo "Allow ssh server" +#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT +#$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 22 -m state --state ESTABLISHED -j ACCEPT +#$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 22 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT + +##### Add your rules below ###### + +echo "Allow DNS Client" + +$IPT -A INPUT -i ${PUB_IF} -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT + +$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT + +echo "Allow Whois Client" + +$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 43 -m state --state ESTABLISHED -j ACCEPT +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 43 -m state --state NEW,ESTABLISHED -j ACCEPT + +echo "Allow HTTP Client" + +$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT + +echo "Allow Rsync Client" +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 873 -m state --state ESTABLISHED -j ACCEPT + +echo "Allow POP3S Client" +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT + +echo "Allow SMTPS Client" +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 465 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 465 -m state --state ESTABLISHED -j ACCEPT + +echo "Allow NTP Client" +$IPT -A OUTPUT -o ${PUB_IF} -p udp --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A INPUT -i ${PUB_IF} -p udp --sport 123 -m state --state ESTABLISHED -j ACCEPT + +$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT + +echo "Allow IRC Client" +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 6667 -m state --state NEW -j ACCEPT + +echo "Allow Active FTP Client" +$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 20 -m state --state ESTABLISHED -j ACCEPT +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT + +echo "Allow Git" +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 9418 -m state --state NEW -j ACCEPT + +echo "Allow ssh client" +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT + +#echo "Allow Passive Connections" +$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT +$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT + + +# echo "Allow FairCoin" +# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 46392 -m state --state NEW,ESTABLISHED -j ACCEPT +# $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 46392 -m state --state ESTABLISHED -j ACCEPT +# +# echo "Allow Dashcoin" +# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 29080 -m state --state NEW,ESTABLISHED -j ACCEPT +# $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 29080 -m state --state ESTABLISHED -j ACCEPT +# +# echo "Allow warzone2100" +# $IPT -A INPUT -i ${PUB_IF} -p tcp --dport 2100 -s 192.168.0.0/12 -j ACCEPT +# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 2100 -j ACCEPT +# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 2100 -j ACCEPT +# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 9990 -j ACCEPT +# +# echo "Allow wesnoth" +# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 15000 -m state --state NEW -j ACCEPT +# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 14998 -m state --state NEW -j ACCEPT + +##### END your rules ############ + +# log everything else and drop +$IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " +$IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: " +$IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " + +exit 0 diff --git a/core/scripts/mkparted.sh b/core/scripts/mkparted.sh new file mode 100644 index 0000000..b71d6b2 --- /dev/null +++ b/core/scripts/mkparted.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +DEVICE=/dev/sda + + +#parted --script /sda \ +# mklabel gpt \ +# mkpart primary 1MiB 100MiB \ +# mkpart primary 100MiB 200MiB \ diff --git a/core/tar.html b/core/tar.html new file mode 100644 index 0000000..a5dd1c4 --- /dev/null +++ b/core/tar.html @@ -0,0 +1,119 @@ + + + + + 1. Tar + + + + Systolls Index +

2. Tar

+ + +

2.1. Create Backup

+ +

Script in core/scripts/backup-system.sh use tldp + server backup + and restore + as a reference.

+ +

+        #!/bin/sh
+
+        echo -n "root directory you want backup (/mnt/): "
+        read ROOT_DIR
+
+        echo -n "where you want to save (/home/user): "
+        read DEST_DIR
+
+        echo -n "backup name (system_name): "
+        read BCK_NAME
+
+        echo $DES_DIR
+        echo $ROOT_DIR
+
+        tar --xattrs -zcpf $DEST_DIR/$BCK_NAME-`date '+%Y-%j-%H-%M-%S'`.tar.gz \
+            --directory=$ROOT_DIR \
+            --exclude=srv \
+            --exclude=var/ports \
+            --exclude=var/run \
+            --exclude=usr/src \
+            --exclude=mnt \
+            --exclude=home \
+            --exclude=dev \
+            --exclude=run \
+            --exclude=tmp \
+            --exclude=proc \
+            --exclude=sys .
+

+ +

1.2. View content of tar

+ +

List files inside tar;

+ +

+        $tar -tvf backup.tar.gz
+

+ +

To restore is better to use first t flag and then x, + this prevents any --absolute-paths problem;

+ +

+        $ tar -ztvpf full-backup-11-November-2045.tar.gz > file.lst
+

+ +

1.3. Extract content from tar

+ +

If you want to extrat to different directory;

+ +

+        $ tar xf full-backup-11-November-2045.tar.gz --directory=/mnt
+

+ +

If path is fine, extract everything;

+ +

+        $ tar --xattrs -xpvf full-backup-11-November-2045.tar.gz
+

+ +

Extract just one file;

+ +

+        $ tar --extract --file=core.tar.gz libidn#1.32-1.pkg.tar.gz
+

+ +

1.4. Add content to tar

+ +

Only uncompressed tar can append files without having + to extract and compress again.

+ +

First create a tar with all files in the current directory;

+ +

+        $ tar cpf core.tar *.tar.gz
+

+ +

List files before appending new file and after;

+ +

+        $ tar -tvf core.tar
+        $ tar --append --file=core.tar libidn#1.32-1.pkg.tar.gz
+        $ tar -tvf core.tar
+

+ +

1.5. Remove content of tar

+ +

+        $ tar -tvf core.tar
+        $ tar --delete --file=core.tar libidn#1.32-1.pkg.tar.gz
+        $ tar -tvf core.tar
+

+ + Systolls Index +

+ + diff --git a/core/tmux.html b/core/tmux.html new file mode 100644 index 0000000..a2a7d9c --- /dev/null +++ b/core/tmux.html @@ -0,0 +1,118 @@ + + + + + 6. Tmux + + + + + Systools Index +

6. Tmux

+ +

Install tmux, improves cli work efficiency;

+ +

+        $ sudo prt-get depinst tmux
+

+ +

Create skeleton configuration file for users;

+ +

+        $ sudo vim /etc/skel/.tumx.conf
+

+ +

+        set -g default-terminal "screen-256color"
+
+        set-window-option -g mode-keys vi
+
+        # Vim style
+        # copy tmux's selection buffer into the primary X selection with PREFIX+CTRL+Y
+        bind-key u run "tmux save-buffer - | xsel -ib"
+        # copy primary X selection into tmux's selection buffer with PREFIX+CTRL+P
+        bind-key e run "xsel -o | tmux load-buffer -"
+
+        bind-key -t vi-copy 'v' begin-selection
+        bind-key -t vi-copy 'y' copy-selection
+
+        set-option -g set-titles on
+        set-option -g set-titles-string '#S> #I.#P #W'
+
+        set -g visual-activity on
+        set -g monitor-activity on
+        set -g visual-bell on
+        set -g bell-action any
+
+        ## Join windows:  s,  j
+        bind-key j command-prompt -p "join pane from:"  "join-pane -s '%%'"
+        bind-key s command-prompt -p "send pane to:"  "join-pane -t '%%'"
+

+ +

Copy to your current home and start tmux;

+ +

+        $ cp /etc/skel/.tmux.conf ~/
+        $ tmux
+

+ +

Get help;

+ +

+        ctrl + b ?
+

+ +

+        key = bind-key (default ctrl + b)
+
+        Window
+        key	c   new window
+        key	" 	split-window
+        key	n	next window
+        key	p	previous window
+
+        Panes
+        key	; 	last-pane
+        key	space	next-layout
+        key	!	break-pane
+        key	{	swap pane
+        key	}	swap pane
+

+ +

6.1. Copy paste

+ +

This instructions are valid if tmux.conf file discribed + in this document is used;

+ +

+        1) enter copy mode using Control+b [
+        2) navigate to beginning of text, you want to select and hit v
+        3) move around using arrow keys to select region
+        4) when you reach end of region simply hit y to copy the region
+        5) now Control+b ] will paste the selection
+

+ +

Paste in X with xsel;

+ +

+        6) update buffer of xsel using Control+b u
+        +
+        Copy from X with xsel;
+
+        +        0) update tmux buffer Control+b e
+        
+
+        Before pasting on vim, set paste mode and then set nopaste.
+
+        Systools Index
+        
+        This is part of the SysDoc Manual.
+        Copyright (C) 2016
+        Silvino Silva.
+        See the file Gnu Free Documentation License
+        for copying conditions.
+
+    
+
diff --git a/core/vim.html b/core/vim.html
new file mode 100644
index 0000000..f09bbb8
--- /dev/null
+++ b/core/vim.html
@@ -0,0 +1,159 @@
+
+
+    
+        
+        5. Vim
+    
+    
+
+        Systools Index
+        5. Vim
+
+        <leader> with default configuration is key \, so when
+        you see <leader>-W means pressing \W
+
+        5.1. Vim RC
+
+        Read
+        "A good vimrc"
+        for more information.
+
+        
+            /usr/share/vim/vimrc
+            System wide Vim initializations.
+            ~/.vimrc
+            Your personal Vim initializations.
+        
+
+        Copy vimrc skeleton example, so that each user have a base to start
+        personalizing it;
+
+        +        $ sudo cp ~/sysdoc/conf/etc/skel/.vimrc /etc/skel/
+        $ sudo mkdir /etc/skel/.vim
+        $ sudo mkdir /etc/skel/.vim/swap
+        $ sudo mkdir /etc/skel/.vim/views
+        $ sudo mkdir /etc/skel/.vim/undodir
+        $ sudo mkdir /etc/skel/.vim/backup
+        $ wget -O wombat256mod.vim  http://www.vim.org/scripts/download_script.php?src_id=4055
+        $ mv wombat256mod.vim /usr/share/vim/colors/
+        
+
+        5.2. Color schemes
+
+        Default vimrc skeleton is configured to use wombat256mod,
+        which is installed by adduser skeleton.
+
+        5.3. Split and tab
+
+        :sp
+
+        5.4. Editing files
+
+        Modes
+
+        To enter visual block mode press ctrl-v. To insert block
+        first select area then press I, insert text normally, when
+        you pres ESC the text will be inserted on previously selected
+        area.
+
+        Come from background;
+
+        +        $ fg
+        
+
+        Moving in vim
+
+        Moving page up and page down;
+
+        
+            [Control][b]
+            Move back one full screen
+            [Control][f]
+            Move forward one full screen
+            [Control][d]
+            Move forward 1/2 screen
+            [Control][u]
+            Move back (up) 1/2 screen
+        
+
+        How to use vim
+
+        In vim you can apply predefined number of times to a operator,
+        selection or object. For example to delete the next
+        two words press: d + 2 + w. List of important operators objects,
+        selections;
+        +
+        +        operator + count + object
+        
+
+        Operator;
+
+        
+            d
+            Delete
+            c
+            Change (d + i)
+            y
+            Copy
+            v
+            Visual Select
+        
+
+        Objects;
+        
+            w
+            Word
+            s
+            Sentences
+            p
+            Paragraphs
+            t
+            Tags
+        
+
+        Selections are like objects, for example d + i + w
+        will delete "inner" word, c + a + w do the same plus
+        the space;
+
+        
+            a
+            All
+            i
+            in
+            t
+            Until
+            f
+            Find forward
+            F
+            Find backward
+        
+
+        Selection of useful combinations;
+        
+            vat
+            Select whole tag block.
+            
cit
+            Change inside tag.
+            
yat
+            Copy whole tag.
+        
+
+        5.5. Spell check
+
+        Press z= over the bad written word and select desired one.
+
+        5.6. Plugins
+
+        Systools Index
+        This is part of the SysDoc Manual.
+        Copyright (C) 2016
+        Silvino Silva.
+        See the file Gnu Free Documentation License
+        for copying conditions.
+
+    
+
diff --git a/tools/index.html b/tools/index.html
new file mode 100644
index 0000000..5fdcee3
--- /dev/null
+++ b/tools/index.html
@@ -0,0 +1,101 @@
+
+
+    
+        
+        Tools
+    
+    
+
+        Documentation Index
+        Tools
+
+        Selection of system tools that extends core documentation.

+
+        
System Administration
+        
+            Pkgutils
+            Lynx
+            Irssi
+            Wireless
+            Nmap
+            Tcpdump
+        
+
+        System Services
+        
+            
+                Storage
+                
+                    Moving partitions
+                    LVM
+                    BTRFS
+                
+            
+
+
+            
+                Syslog-ng
+                
+                    Install event log
+                    Install syslog-ng
+                    Syslog-ng RC
+                    Syslog-ng configuration
+                
+            
+            Logrotate
+            
+                Logwatch
+                
+                    Configure Logwatch
+                    Set cron task
+                
+            
+            
+                Fail2Ban
+                
+                    Configure Fail2ban
+                
+            
+        
+        Network Services
+        
+            
+                OpenSSH
+                
+                    Server
+                    Configure Server
+                    Client
+                    Reverse connection
+                
+            
+            Gitolite
+                
+                    Install Gitolite
+                    Configure Gitolite
+                    Gitolite Administration
+                    Gitolite Hooks
+                
+            
+            Postgresql
+                
+                    Install Postgresql
+                    Configure Server
+                    Create User
+                    Create Database
+                    Drop Database
+                    Drop User
+                    Psql
+                
+            
+            Nginx
+                
+                    Install Nginx
+                    Logs
+                    User Directory
+                    Certificates
+                    Nginx Configuration
+                    Laravel Server
+            
+        
+    
+
-- 
cgit 1.4.1-2-gfad0