Build your service using Pritunl and Lets Encrypt

Pritunl is an open source enterprise VPN platform which is used to easily build free VPN service.
It is built on the top of TLS/SSL protocol and is not easily banned by some countries. :)
However, by the default settings of its tutorial, the generated TLS certificate for Pritunl is not recognized by browsers because its certificate is not authorized by third-party CA.

To mitigate the effect, Let's Encrypt, the well-known CA, is considered as the best choice for end-users.

This post briefs how to setup Let's Encrypt's SSL certificate and setup Pritunl on Ubuntu 14.04. You can follow the following easy steps to build your own VPN service.

1. Go to Let's Encrypt and apply for a certificate by the certbot script.
2. If you are using apache, nginx or Plesk, please stop and remove it first. Otherwise, the later Pritunl will have a conflict on port 80. 
3. Follow the post of Vultr to setup Pritunl.
4. Congratulations! You have your own VPN service.  

Trouble Shotting
If your Pritunl service cannot normally start, please check Pritunl's log in /var/log/pritunl.log. If the log displays the message like "127.0.0.1:27001 connection refused", please check MongoDB's log messages in /var/log/mongodb/mongod.log. You may find the following texts in the log file:
ERROR: Insufficient free space for journal files
Please make at least 3379MB available in /var/lib/mongo/journal or use --smallfiles

It seems that the disk space is not enough for running MongoDB and it will impact the service of Pritunl. To solve this issue, please add the following configuration in the configuration file (it is generally put in /etc/mongod.conf) of MongoDB.
  mmapv1:
    smallFiles: true

Then, restart MongoDB service by the command: service mongod restart

Finally, you may normally activate the Pritunl service.

Install JDK in Debian

1. Donload jdk package from Oracle:

wget --header "Cookie: oraclelicense=accept-securebackup-cookie" http://download.oracle.com/otn-pub/java/jdk/8u40-b26/jdk-8u40-linux-x64.tar.gz

2. Setop JDK Environment
sudo sumkdir /opt/jdk
tar -zxf jdk-8u40-linux-x64.tar.gz -C /opt/jdk
update-alternatives --install /usr/bin/java java /opt/jdk/jdk1.8.0_40/bin/java 100
update-alternatives --install /usr/bin/javac javac /opt/jdk/jdk1.8.0_40/bin/javac 100

3. Check Java Environment. To check the java environment, you just use this command:

java –version

The console will prompt message like this:
java version "1.8.0_40"
Java(TM) SE Runtime Environment (build 1.8.0_40-b26)
Java HotSpot(TM) 64-Bit Server VM (build 25.40-b25, mixed mode)

If you get the following message while using java commend:
bash: /usr/bin/java: No such file or directory

This problem is due to lack of libc6-i386 package. Use the following command to install it and then java can be run.
sudo apt-get install libc6-i386

Reference
1. Digital Ocean.com , "How To Manually Install Oracle Java on a Debian or Ubuntu VPS", Digital Ocean Community. Available: [Online] https://www.digitalocean.com/community/tutorials/how-to-manually-install-oracle-java-on-a-debian-or-ubuntu-vps

Apache 2.4升級筆記

根據http://jasonpowell42.wordpress.com/2013/04/05/install-apache-2-4-4-on-centos-6-4/ ，但是安裝時要注意configure

cd /usr/src/

wget http://ftp.tc.edu.tw/pub/Apache//httpd/httpd-2.4.9.tar.gz

tar xzvf httpd-2.4.9.tar.gz

cd httpd-2.4.9

./configure --enable-so --enable-ssl --with-mpm=prefork --with-included-apr --mandir=/usr/share/man --sysconfdir=/etc/httpd

make; make install

cd /etc/httpd

rm httpd.conf

ln -s conf/httpd.conf httpd.conf

yum -y install libxml2 libxml2-devel 

cd /usr/src/

wget http://tw2.php.net/get/php-5.3.28.tar.gz/from/this/mirror

tar xzvf php-5.5.13.tar.gz

cd /usr/src/php-5.5.13

./configure --with-apxs2=/usr/local/apache2/bin/apxs --with-mysql --with-config-file-path=/etc

make

make install

libtool --finish /usr/src/php-5.5.13/libs

ln -s /usr/local/apache2/modules /etc/httpd/modules

修改/etc/init.d/httpd，將內容改為以下

apachectl=/usr/local/apache2/bin/apachectl
httpd=${HTTPD-usr/local/apache2/bin/httpd}

存檔離開。

接著 service httpd start就可以了。

請記住，若有設定過httpd.conf的話，請注意這一篇的提醒事項。

 

參考資料

1. [Linux] 重新編譯 PHP 時出現錯誤的解決方式


2. Upgrading to 2.4 from 2.2


3. How to Install Apache2.4 PHP5 and MySQL from Source on Debian Linux


4. Apache 2.4 Configure


5. Install Apache 2.4.4 on CentOS 6.4


6. Linux Commands For Shared Library Management & Debugging Problem


7. How install Apache 2.4 PHP 5.4 and MySQL 5.5.21 on Windows 7


8. [Apache] Apache 從 2.2 換至 2.4 httpd.conf 的調整筆記 (windows 環境)


9. Apache Module mod_slotmem_shm


10. Apache Module mod_access_compat


11. Apache Module mod_unixd


12. Linux Tutorial: How to Build Apache, PHP5 and MySQL From Source ( the Hard Way)


13. Linux: Set OR Change The Library Path


14. Installing Apache 2.4 and PHP 5.4 from source
    

[PHP] Be discreet to use crypt function

Recently, the PHP’s crypt function crashed in my designed new system. In fact, in my database design, the length of password field is 64. It ran fine at CentOS 5.5 with PHP 5.2.x. However, when I moved this system to Debian 7.3.0 with PHP 5.4.x, it was failed to generate the password.

In CentOS 5.5, it used MD5 as default crypt function and the php’s crypt also did (CRYPT_MD5). The MD5 hash generates 34 characters including 12 prefix salt characters like “$1$ … $”and 22 hashed characters in base64 encoding (128 digits / 6 bits_per_characters := 22 characters ), so the legnth of hashed password is enough with the field size = 64.

Unfortunately, the new operating system uses SHA512 crypt function as default crypto scheme and PHP’s crypt function also accepts the crypto scheme as default. In the default setting, the SHA512 hash function generates 102 characters including 16 prefix salt characters like “$6$…$” and 86 hashed characters in based64 encoding (512 digits / 6 bits_per_characters := 86 ). Therefore, it has no extra data length to save whole 102 characters because of the default field size is 64. Finally, the password verifier is also failed. :(

REFERENCE

1. PHP: crypt function.[Recommend]
2. Wiki: MD5
3. Linux Programmer’s Manual : Crypt (3) [Recommend]
4. What is the output length of PHP crypt()?

Install Intel I210 Driver in Debian Linux

While I am installing the Intel Ethernet I210 adaptor, I find it can not be run and it shows the following message:

Makefile:71: *** Kernel header files not in any of the expected locations.

Makefile:72: *** Install the appropriate kernel development package, e.g.

Makefile:73: *** kernel-devel, for building kernel modules and try again.  Stop.

 

It means that you don't install the kernel-headers.

Just type the following command with root account:

# apt-get  install linux-headers-$(uname -r)

 

Then follow the installation guide shown in the driver directory.

# make install

# modprobe <module name>

 

REFERENCE

1. http://askubuntu.com/questions/3576/how-to-make-usb-drive-as-local-repository

2. http://www.cyberciti.biz/faq/howto-install-kernel-headers-package/

3. http://jylin76.blogspot.tw/2011/02/cent-osintel-82566dm-2.html

I-List: Create Your Own Lists of Links

I-List is a very helpful links share platform to share your collected links.

It provides an user friendly interface to you for sharing some kind of links.

I’ve found that there are two collections which is very helpful for some people whose subjects are for studying and implementation in statistics, accounting and computer science.

1. List of Free Accounting Software : For business/accounting area.

2. List of Free Statistical Software : For statistics area.

[Linux] Autoconf, Automake

[筆記一下自己學Autoconf, Automake這一類的GNU Build Tool。]
[2013/07/14 更新：把linker 引用libraries的順序寫得更清楚一些。]

身為常常用Linux的程式設計師兼MIS人員來說，在Linux系統上面要編譯程式是很家常便飯的事情。
最常用的指令是./configure; make; make install ，筆者稱之為「大三元」。
只是如果今天角色互換，變成我們來開發程式，並且把程式以開放原始碼的方式發送出去，該怎麼做呢？
其實上述說的大三元指令，是由GNU Build System提供的aclocal, autoconf, automake幫你產生configure script file以及對應的Makefile。
由於筆者做專案需要引用curl這個library。
石頭閒言閒語部落格提供教學雖然基本，但是又不太夠用。以下便筆記一下自己在做該專案的方式，稱不上專業，若有謬誤，敬請多多包涵。

[Linux] The useage of ioctl function: some materials

This post is to note some materials for Linux ioctl function:

• ioctl: hdio
• Linux kernel map: Chapter 6.1 ioctl
• Linux Device Driver 專欄
• Linux 驅動程式的 I/O, #1: 基本概念
• Linux 驅動程式的 I/O, #3: kernel-space 與 user-space 的「I/O」
• Linux 驅動程式的 I/O, #4: fops->ioctl 實作
• Creating an Ioctl command in linux (before linux kernel 2.6.36)
• Device Drivers, Part 9: I/O Control in Linux
• 基礎 Linux Device Driver 驅動程式#9 (IOCTL)
• Example of a Variadic Function
• Linux Device Drivers Series
• 如何用C語言取得硬體資訊，如主機板序號等?
• uname - get name and information about current kernel

[Linux] Backup MySQL with BASH

I've translated my old post into English version with Italic font type.

這是一個簡單的範例程式，用來備份mysql用的。

This is a simple example program for MySQL backup.

以下假設我的MySQL使用者帳號為user，密碼為123，database名稱為db1

Assume that my MySQL account is user, password is 123 and the database name is db1.

backupmysql.sh:

=Edit the following content=

#!/bin/sh
#Program:
#      This code backup MySQL database with date.
#      Author: Allen
#History:
#      2009/1/1

#take date
date=`date +%Y%m%d`

#database name
db_name=’db1‘
db_user=‘user“
db_password=’123‘

mysqldump $db_name -u $db_user –password="$db_password" > your_backup_directory/$db_name$date.sql

=End of editing =

然後將這支bash程式權限設定為 700 (chmod 700 backupmysql.sh)。

Change permission of this back program into 700 via "chmod 700 backupmysql.sh" command.

如果你要讓它定期幫你備份的話，加入crontab就好囉。

If you want this program do backup procedure periodically, you can add it into crontab. 

例如我要讓它每七天都幫我備份的話，只要加入以下：

For example, I want to backup every 7 days, and I just add the following content via "crontab -e" command.

#Allen: Execute backupmysql.sh automatically at 1:00 for every 7 days.
0 1 */7 * * backupmysql.sh

[Apache] htaccess 入門/進階 教學資源

1. .htaccess是什麼？.htaccess幾個簡單應用
2. Apache .htaccess Guide & Tutorial
3. Apache Tutorial:.htaccess file
4. .htaccess Tutorial
5. THE Ultimate Htaccess
6. Advanced htaccess tutorial
7. more .htaccess tips and tricks
8. 8 Great Htaccess Rules To Improve Your Website
9. 用 htaccess 來擋圖片盜連並且讓 google reader 可讀
10. Ultimate Guide to htaccess and mod_rewrite
11. Mod_Rewrite and .htaccess (有詳細解說)
12. Mod_Rewrite- Hide index.php (有詳細解說)
13. Apache htaccess中的Rewritecond規則介紹
14. Extending Rules

[Linux] 適當管控Linux安全核心-selinux

PHPMailer 發不出去，查了一下log，才發現可能是SELinux作怪。
我在「適當管控Linux安全核心-selinux」這篇文章中找到以下敘述：

基於安全考量selinux 的權限層次將高於root 因此會發生某些行為模式的限制，例如 http協定精靈能否寄信，或http協定精靈中能否連接網路的控制。
其中預設透過http協定精靈能否寄信這種行為模式是不允許的 因此透過網站發送信件會發生:， 寄信卻沒收到信 追查/var/log/maillog 則出現: selinux 導致的 postfix/sendmail: fatal: chdir /var/spool/postfix Permission denied 這個並非目錄權限設定不當，而是在行為模式層次(即selinux)系統預設的安全管制。

因此，我只要把SELinux 做調整就好囉。
詳細操作方法請大家移駕到原網站，看一下原文。

[網頁撰寫] Linux, Apache, PHP, MySQL 最佳化教學資源匯整

最近接手的案子，有速度緩慢的問題。
趁機再整理一下有關Apache, PHP, MySQL系統的最佳化議題。

1. Apache 自動優化前端頁面的模組 - mod_pagespeed
2. 分離動、靜態網頁，讓伺服器做擅長的事
3. WindowsNT系統下的Apache性能優化
4. 基本優化 tuning apache 跟 tuning mysql 跟 php 效能
5. [SQL] MySQL ROW_NUMBER Simulation
6. 利用 PHP MySQL Quota-Tool 來限制 MySQL 存取空間大小
7. Apache 調整、優化方法：性能優化
8. 優化 PHP 程式的 40條建議
9. Php Memcached 快取機制配置架構
10. A HOWTO on Optimizing PHP
11. 奇怪的PHP引用效率問題

[C++] 大數運算好用的函式庫GNU MP (GMP)

GNU MP(簡稱GMP)是一個可以進行大數運算(Big number operation)的函式庫，使用C++實作，要應用此函式庫開發的話，要注意它使用LGPL3的License。
這個函式庫的出現，對於資訊安全研究領域的人員，是一大利多，可以讓開發人員輕鬆使用大數運算，進行各種資料加解密或簽章的資安技術開發。
目前最新版本是5.0.2版，筆者建議讀者可到它的官網下載，閱讀開發文件後，便可輕鬆開發程式。

參考文獻  

1. GNU MP官網
2. 酷！學園 "什麼是GMP?"
3. Multiprecision arithmetic library (64bit library)
4. 植基於橢圓曲線質數視窗化介面之質數判斷工具之設計與實現

IDL Programming Language

I've found some tutorial resources:

1. IDL Tutorial: Programming in IDL (這個好像是天文的..)
2. IDL TUTORIAL (這個好像是天文的..)
3. The IDL Astronomy User's Library (這個好像是天文的..)
4. Coyote's Guide to IDL Programming (這個好像是天文的..)
5. A GUIDE TO IDL FOR ASTRONOMERS (這個好像是天文的..)
6. RMI，Java IDL 
7. Institute for Computational Cosmology: IDL (這個好像是天文的..)

[C/C++] 用C語言控制RS232

剛好找到一些關於控制RS232的資源，先將教學紀錄起來，等有空再來寫！
1. 黃裕煒老師教的Linux RS-232程式設計
2. Serial Programming Guide for  POSIX Operating Systems (出自 Study-Area的這篇)
3. RS-232 for Linux and Win32 Library

C/C++ 在Linux上製作C static/shared/dynamic library

之前已經有一則關於library製作的貼文放在我的BBS個人板P_allen501pc的精華區內。
但是一直苦無Web版本；在偶然的機會下，我剛好找到一個有關於C static/shared/dynamic library的文章，可以跟各位好好分享：
http://www.vr.ncue.edu.tw/esa/EmbeddedSystemProgramming2010/ch09.htm
事實上，這篇教學資源出自國立彰化師範大學車輛科技研究所 黃裕煒教授所教授之2010年嵌入式系統課程，若各位對於課程有興趣，可至 http://www.vr.ncue.edu.tw/esa/EmbeddedSystemProgramming2010/ 觀賞。

Linux C socket, fork(), select(), and Pthread programming

I've finished my project about Linux socket using select(), fork(), and pthread.
There are some recommended and useful resources:
1. Programming in C UNIX System Calls and Subroutines using C
    It introduces socket, pthread, fork, and RPC(Remote Procedure Call).
2. SAS/C Library Reference: Socket Function Reference
    It provides varied functions, such as select(), htons(), send()...,etc.
3. Programming IP Socket on Linux, Part One
    It introduces how to write socket on Linux platform.
4. Linux Kernel Hacker's Guide
    It provides the methods about how to write your embedded system components, such as device driver.
5. Socket Program Design (Socket程式設計)
    It provides details of writing socket ( in Traditional-Chinese language)

線上專案管理系統：Trac

Trac是一套線上專案管理系統，支援SVN、Wiki、檔案上傳等功能。目前我已經架設完畢。把筆記記錄下來：

(1)   根據http://groups.google.com/group/trac-users/browse_thread/thread/c5edfaf35b17a61b
的報告指出，目前Trac 0.12版，對於MySQL支援度不是很夠用。

(2)   CentOS安裝FastCGI可參考http://www.cyberciti.biz/tips/rhel-centos-fedora-apache2-fastcgi-php-configuration.html 這篇的解說。

(3)   此系統之所以可安裝成功，主要參考 http://josephjiang.com/entry.php?id=360 這篇的解釋。

(4)   其他可用的參考資料：

(a)   Trac Plugin

(b)   Trac Installation Guide for 0.12

(c)    Trac with FastCGI

(d)   TracAdmin

(5)   另一套線上專案管理系統也值得推薦：Mantis ，在「這隻螳螂(Mantis) 還挺猛的 — 免費好用的 Issue Tracking 工具」有詳細的介紹。

[轉載] 自由軟體技術分享工作坊 - 網路監控系統 Nagios 台中場

agios 是一個 open source 的電腦系統與網路服務的監控軟體。它可以監控主機與服務，當異常狀況發生時，可以通知指定的聯絡人、或是以指定的通知方式來聯繫。另外也有眾多的 Plugin 可以使用。

詳細的內容時間描述與報名資訊如下：

• 對象：大專院校資訊相關系所的學生，或是對自由軟體有興趣者。( 有 Linux 系統操作經驗佳)
• 人數：約 27 人。
• 費用：全程免費。
• 平台：openSUSE 11.3
• 
  

活動網址：

http://www.openfoundry.org/tw/workshop/details/161

[Linux] 筆記：Filesystem Hierarchy Standard

由於Linux開發者眾多，如果每個人都利用自己的目錄配置來發行Linux的話，會造成很多人的困擾。因此，Filesystem Hierarchy Standard (FHS, http://www.pathname.com/fhs) 為Linux制定了一些目錄配置的標準。目的是「讓使用者可以知道哪些安裝的軟體會放到哪個目錄下」，這個概念有點像Windows中常用的C:\Program Files\ 或是C:\WINDOWS。隨著FHS的推出，多數Linux獨立開發商會遵守這個標準，讓Linux使用者能夠清楚明瞭特定的檔案放置位置。

根據FHS的檔案與目錄，有2種區分方式：

1.    可分享的(Shareable)、不可分享的(Unshareable)

─ 可分享的：可以分享給其他系統掛載使用的目錄，包含執行檔、使用者郵件、學生學號等資料，可放在網路上給其他主機掛載的目錄。

─ 不可分享的：跟機器運作有關的裝置檔案、程序資源檔，不能分享給其他機器用的。

2.    變動的(Variable)、靜態的(Static)

─ 變動的：常常改變的資料，像是使用者登錄檔、新聞群組、使用者郵件信箱等。

─ 靜態的：不常改變的資料，像是常用的函式庫、文件說明檔、程式碼、系統服務設定檔。

上述2種區分方式，可互相組合，成為一個2×2表格如下：

	可分享的 (Shareable)	不可分享的 (Unshareable)
靜態的 (Static)	/usr (軟體放置處)註1 /opt (3rd-party software)	/etc (常見設定檔放置處) /boot (開機設定檔與Kernel檔)
變動的 (Variable)	/var/mail (使用者信箱) /var/spool/news (新聞群組)	/var/run (與系統程序有關) /var/lock (程序鎖定檔，提供互斥存取用)

註1: /usr 不是使用者(User)的縮寫，而是Unix Software Resource的縮寫喔！

參考資料

1.          Linux System Administrator's Guide

2.          鳥哥的私房菜

3.          Filesystem Hierarchy Standard