DEV Community: OpenLAB

Setting and Displaying Patroni's Max Connection Count

Doğukan Eren — Wed, 27 Sep 2023 13:21:19 +0000

Patroni configuration are mainly stored in patroni.yaml. Find the path of that yaml.

Not: Patroni configurations are primarily stored in patroni.yaml. Find the path to that YAML file.

This command lists Patroni clusters and hosts.

patronictl -c /etc/patroni.yml list

To edit PostgreSQL settings in Patroni, you can use the 'edit-config' command.

patronictl -c /etc/patroni.yaml edit-config

Modify the 'max_connections' line within 'postgresql.parameters', and create it if it does not already exist.

.
postgresql
  parameters
    max_connections: 200
.

To display the maximum monitor count, you can connect to your Patroni cluster using psql, and then run the script below to show the maximum connection count.

To query to patroni server we can use below comamnd:

psql -h <patroni_ha_ip> -U <username> -p <ha_db_port> -W

On psql

SHOW max_connections;

SELECT current_setting('max_connections');

Disabling SSL Certificate Verification for RedHat Subscriptions

Doğukan Eren — Wed, 27 Sep 2023 08:37:24 +0000

If you encounter an error during the subscription process on your RedHat systems, specifically the error message

'Unable to verify server's identity: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618),'

You can resolve it by modifying the 'insecure'
label in the rhsm.conf configuration file. Change the value from 0 to 1 using the following commands located at /etc/rhsm/rhsm.conf.

vi /etc/rhsm/rhsm.conf

Edit the insecure line 0 to 1

# Set to 1 to disable certificate validation:
insecure = 1

Ubuntu 22.04 - Using NTP and Disabling It

Rümeysa Öz — Fri, 11 Aug 2023 11:29:16 +0000

1. Configuring NTP with Netplan

Netplan is a tool used for network configuration management on Ubuntu. You can use Netplan to control the use of NTP over DHCP.

1.1. Opening the Netplan Configuration File:

The Netplan configuration file is usually found under the /etc/netplan/ directory. To edit this file, use:

sudo nano /etc/netplan/00-installer-config.yaml

1.2. Adding NTP Settings:

In the opened file, you can prevent NTP from being used over DHCP by adding the following configuration:

network:
  ethernets:
    ens18: # This should be changed according to your network adapter's name.
      renderer: networkd
      dhcp4: true
      dhcp4-overrides:
        use-ntp: false
  version: 2

Save your changes and exit the file.

2. Applying the Configuration

To apply the configuration, run the following command:

sudo netplan apply

This command will activate the changes you made.

3. Default Usage of NTP

By default, Ubuntu has DHCP set to use NTP. However, in certain situations, you may want to disable this feature.

3.1. Default Usage of NTP over DHCP:

By default in Netplan, DHCP is set to use NTP with the use-ntp: true setting. However, if you want to disable this feature, you need to set the use-ntp: false value under dhcp4-overrides. This has been shown in the configuration mentioned above.

REFERENCES:

NEXUS OSS Create PostgreSQL Repository using Apt Proxy

Doğukan Eren — Sun, 06 Aug 2023 20:32:15 +0000

Using Nexus OSS, you can create, manage, and publish your own repositories. Additionally, you can utilize the "apt proxy" feature to publish existing repository content from your server.

You can access our article on the installation of Nexus OSS from here.
You can also access our article on creating an apt repository on Nexus OSS from here.

Let's proceed with creating the Postgresql repository on Nexus OSS.

1- Log in to the Nexus OSS interface with an authorized user

After the installation, the default admin user is available, and you can find its password by using the following command:

cat /opt/sonatype/sonatype-work/nexus3/admin.password

2- Creating a Repository

a- Let's go to the "Repository" page under the "Settings" section.

b- After that, click on the "Repositories" tab under "Repository," and on the opened page, click the "Create Repository" button.

Let's proceed by selecting the "apt proxy" option from the opened page.

3- Let's configure our Postgresql Repository.

Let's enter the address of the Postgresql repository as shown below in the Remote repository field:

http://apt.postgresql.org/pub/repos/apt/

4- Let's save it.

You can save it by clicking on the Create Repository button located at the bottom.

When we navigate to the "Repositories" page, we will see the newly added repository listed. By clicking on the "Copy" button, we can access our newly created Postgresql repository on our server.

When we visit the relevant URL, the repository will appear in front of us.

Optional

Adding the new repository to Linux client machines.

If your client machine is Ubuntu 22, you can run the following command:

echo "deb [trusted=yes] http://192.168.122.100:8081/repository/hosted-postgresql-hdd/ jammy-pgdg main" > /etc/apt/sources.list.d/nexus.list

Note: If not, you can proceed by customizing the jammy-pgdg part to match your own version.

You can check if it is working by running the apt update command.

Creating openssl.conf for Windows

oz9un — Tue, 02 Nov 2021 05:14:07 +0000

In this chapter, I will explain how to create openssl.conf file with the way that Windows can process it.

Parts to be changed in the default openssl.conf:

For creating a default openssl.conf, Jamie's amazing article would be a good start point.

There are many differences between original Windows certificates and those created with using OpenSSL on Linux:

Difference 1 → Issuer:

Issuer is one of the most important field in the certificates. This must be interpreted correctly in order to make Windows accept our handcrafted certificate.

Difference between certificate created with default openssl.conf and original Windows certificate:

Solution for Difference 1:

In this part, we define the section for the req command.

We can edit default_bits, default_md parts. But most importantly, we can change how to form the DN with editing the req_distinguished_name section.

Default [ req ] part would be similar to:



[ req ]

default_bits = 2048
distinguished_name = req_distinguished_name
string_mask = utf8only
default_md = sha256
x509_extensions = v3_ca

Corresponding default [ req_distinguished_name ] :



[ req_distinguished_name ]
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
countryName                     = Country Name (2 letter code)
stateOrProvinceName             = State or Province Name
localityName                    = Locality Name
0.organizationName              = Organization Name
organizationalUnitName          = Organizational Unit Name
commonName                      = Common Name
emailAddress                    = Email Address

As you can see, there are lots of fields like countryName, stateOrProvinceName, localityName...

This is why we see lots of information in the 'Issuer' field of the certificates created with OpenSSL.

Edited [ req_distinguished_name ] should be similar to:



[ req_distinguished_name ]

1.DC = com
0.DC = company
DC = subdomain
commonName = Common Name

And user should type in that order:

As a result, we successfully created a valid issuer:

Difference 2 → Missing Fields:

Two fields, "Certificate Template Name" and "CA Version", are not available on the certificate that created with OpenSSL on Linux.

It is hard to know about which fields are precisely checked when tricking Windows to accept your handcrafted OpenSSL certificate, but I think it is a good practice to make your certificate look exactly like the original one.

Solution for Difference 2:

Firstly, define OID's at the top of our openssl.conf file:



oid_section = OIDs

[ OIDs ]

certificateTemplateName = 1.3.6.1.4.1.311.20.2
caVersion = 1.3.6.1.4.1.311.21.1

We can skip the definition of the OID's and use the OID directly, of course. But defining them first and using them as variables would be a good practice.

Secondly, create a new requirement in [ reg ], let's say v3_req :



[ req ]

default_bits = 2048
distinguished_name = req_distinguished_name
string_mask = default
default_md = sha256
x509_extensions = v3_ca
req_extensions = v3_req

Lastly, define [ v3_req ] :



[ v3_req ]

subjectKeyIdentifier = hash
basicConstraints = critical, CA:true
keyUsage = digitalSignature, cRLSign, keyCertSign
certificateTemplateName = ASN1:PRINTABLESTRING:CA
caVersion = ASN1:INTEGER:0

After that, you should create your certificate with the following parameter:



-extensions v3_req

As a result, we successfully created our certificate fields:

Final:

We have successfully created our openssl.conf!
You can view the whole openssl.conf file from: GitHub Gist

SysmonForLinux - Logging File Create Events

oz9un — Thu, 21 Oct 2021 05:33:41 +0000

In this article, I will explain how to use SysmonForLinux and how to create specific configurations to keep track of file creation events.

For further information about events and configuration options; you can visit my github repository: oz9un

Sysmon in a nutshell:

Sysmon (System Monitor) is a Windows system service that logs system activity to the Windows event log. Now, it is available for Linux too!

It was developed by Microsoft as an open source project. Even though it is doubtful to see such a contribution, I am very glad about it 🤭

File Create event:

As its name suggests, this event detects when a file is created on Linux systems.

This event can be especially useful when tracking auto-startup folders and folders where everyone has a permission to create files. Because most of the time, they are the main targets of malicious users 👹.

A normal file creation event log would looks like this:

Configuring File Create event:

By default, SysmonForLinux logs every file creation events. But we are talking about Linux. Even if you connect to a server via SSH; that results in the creation of many tmp files.

As a result, you can guess how chaotic the log file has become. This is why we don't want to log everything, especially in case of file creation event.

File Create event has 7 different description fields that we can use as filters:

You can view all description fields for each event on my github page!

When creating a configuration file (xml) for SysmonForLinux, we can use this fields as a filter.

Example scenario:

Suppose you want to keep log of the every file creation event with the following properties:

File should be created in /tmp or under /home/secret folder.
File should be created in October 2021.
File shouldn't be created with /usr/sbin/cups-browsed daemon (This printer daemon uses /tmp file quite often).

Desired configuration file should looks like that:

<!-- Event ID 11 == FileCreate. Log what we want! -->
<RuleGroup name="" groupRelation="and">
  <FileCreate onmatch="include">
    <TargetFilename condition="contains any">/home/secret/;/tmp/</TargetFilename>
    <UtcTime condition="contains">2021-10</UtcTime>
  </FileCreate>

  <FileCreate onmatch="exclude">
    <Image condition="is">/usr/sbin/cups-browsed</Image>
  </FileCreate>
</RuleGroup>

You can view the whole configuration file from: Example Scenario

Results:

To view sysmon's log file:

tail -f /var/log/syslog | sudo /opt/sysmon/sysmonLogView -X

Output:

As you can see, we successfully created a configuration file according to our properties and caught some malicious events already!

End & Contact:

This is at the end of my first post about SysmonForLinux. I plan to write much more on this subject as I find time. I would be very happy if you can give a feedback. Stay in touch!

Github: https://github.com/oz9un
Twitter: https://twitter.com/oz9un

LDAP Authentication in Golang with Bind and Search

Rıdvan Tülemen — Wed, 30 Jun 2021 19:31:52 +0000

If you are familiar with the Windows Active Directory or Samba, you may have already heard about LDAP. But if you didn't, here is the description in Wikipedia.

Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network.

Creating our project

First of all, we need to download the library:

go get github.com/go-ldap/ldap

Variables

Now, we can start using the library. Firstly, we are creating the variables to use them later(If you are going to use anonymous bind, you only need Filter):

const (
    BindUsername = "user@example.com"
    BindPassword = "password"
    FQDN         = "DC.example.com"
    BaseDN       = "cn=Configuration,dc=example,dc=com"
    Filter       = "(objectClass=*)"
)

Connect

To connect to LDAP, we can use ldap.DialURL() func. Followed function is solely created to connect to an LDAP server:

// Ldap Connection without TLS
func Connect() (*ldap.Conn, error) {
    // You can also use IP instead of FQDN
    l, err := ldap.DialURL(fmt.Sprintf("ldap://%s:389", FQDN))
    if err != nil {
        return nil, err
    }

    return l, nil
}

TLS Connect

If you need TLS Connection, you can use the function below:

// Ldap Connection with TLS
func ConnectTLS() (*ldap.Conn, error) {
    // You can also use IP instead of FQDN
    l, err := ldap.DialURL(fmt.Sprintf("ldaps://%s:636", FQDN))
    if err != nil {
        return nil, err
    }

    return l, nil
}

Anonymous Bind and Search

If you want anonymous bind in your project, you can use this function:

// Anonymous Bind and Search
func AnonymousBindAndSearch(l *ldap.Conn) (*ldap.SearchResult, error) {
    l.UnauthenticatedBind("")

    anonReq := ldap.NewSearchRequest(
        "",
        ldap.ScopeBaseObject, // you can also use ldap.ScopeWholeSubtree
        ldap.NeverDerefAliases,
        0,
        0,
        false,
        Filter,
        []string{},
        nil,
    )
    result, err := l.Search(anonReq)
    if err != nil {
        return nil, fmt.Errorf("Anonymous Bind Search Error: %s", err)
    }

    if len(result.Entries) > 0 {
        result.Entries[0].Print()
        return result, nil
    } else {
        return nil, fmt.Errorf("Couldn't fetch anonymous bind search entries")
    }
}

Bind and Search

If you prefer normal binding instead:

// Normal Bind and Search
func BindAndSearch(l *ldap.Conn) (*ldap.SearchResult, error) {
    l.Bind(BindUsername, BindPassword)

    searchReq := ldap.NewSearchRequest(
        BaseDN,
        ldap.ScopeBaseObject, // you can also use ldap.ScopeWholeSubtree
        ldap.NeverDerefAliases,
        0,
        0,
        false,
        Filter,
        []string{},
        nil,
    )
    result, err := l.Search(searchReq)
    if err != nil {
        return nil, fmt.Errorf("Search Error: %s", err)
    }

    if len(result.Entries) > 0 {
        return result, nil
    } else {
        return nil, fmt.Errorf("Couldn't fetch search entries")
    }
}

Main Func

Last of all, we need to create a main function to use these functions:

Bind and Search with TLS Connection

func main() {
    // TLS Connection
    l, err := ConnectTLS()
    if err != nil {
        log.Fatal(err)
    }
    defer l.Close()

    // Normal Bind and Search
    result, err = BindAndSearch(l)
    if err != nil {
        log.Fatal(err)
    }
    result.Entries[0].Print()
}

Anonymous Bind and Search with Non-TLS Connection

func main() {
    // Non-TLS Connection
    l, err := Connect()
    if err != nil {
        log.Fatal(err)
    }
    defer l.Close()

    // Anonymous Bind and Search
    result, err := AnonymousBindAndSearch(l)
    if err != nil {
        log.Fatal(err)
    }
    result.Entries[0].Print()
}

Conclusion

After these functions, I believe you can start using LDAP authentication, bind and search. At the end, the code should look like this:

package main

import (
    "fmt"
    "log"

    "github.com/go-ldap/ldap/v3"
)

const (
    BindUsername = "user@example.com"
    BindPassword = "password"
    FQDN         = "DC.example.com"
    BaseDN       = "cn=Configuration,dc=example,dc=com"
    Filter       = "(objectClass=*)"
)

func main() {
    // TLS Connection
    l, err := ConnectTLS()
    if err != nil {
        log.Fatal(err)
    }
    defer l.Close()

    // Non-TLS Connection
    //l, err := Connect()
    //if err != nil {
    //  log.Fatal(err)
    //}
    //defer l.Close()

    // Anonymous Bind and Search
    result, err := AnonymousBindAndSearch(l)
    if err != nil {
        log.Fatal(err)
    }
    result.Entries[0].Print()

    // Normal Bind and Search
    result, err = BindAndSearch(l)
    if err != nil {
        log.Fatal(err)
    }
    result.Entries[0].Print()
}

// Ldap Connection with TLS
func ConnectTLS() (*ldap.Conn, error) {
    // You can also use IP instead of FQDN
    l, err := ldap.DialURL(fmt.Sprintf("ldaps://%s:636", FQDN))
    if err != nil {
        return nil, err
    }

    return l, nil
}

// Ldap Connection without TLS
func Connect() (*ldap.Conn, error) {
    // You can also use IP instead of FQDN
    l, err := ldap.DialURL(fmt.Sprintf("ldap://%s:389", FQDN))
    if err != nil {
        return nil, err
    }

    return l, nil
}

// Anonymous Bind and Search
func AnonymousBindAndSearch(l *ldap.Conn) (*ldap.SearchResult, error) {
    l.UnauthenticatedBind("")

    anonReq := ldap.NewSearchRequest(
        "",
        ldap.ScopeBaseObject, // you can also use ldap.ScopeWholeSubtree
        ldap.NeverDerefAliases,
        0,
        0,
        false,
        Filter,
        []string{},
        nil,
    )
    result, err := l.Search(anonReq)
    if err != nil {
        return nil, fmt.Errorf("Anonymous Bind Search Error: %s", err)
    }

    if len(result.Entries) > 0 {
        result.Entries[0].Print()
        return result, nil
    } else {
        return nil, fmt.Errorf("Couldn't fetch anonymous bind search entries")
    }
}

// Normal Bind and Search
func BindAndSearch(l *ldap.Conn) (*ldap.SearchResult, error) {
    l.Bind(BindUsername, BindPassword)

    searchReq := ldap.NewSearchRequest(
        BaseDN,
        ldap.ScopeBaseObject, // you can also use ldap.ScopeWholeSubtree
        ldap.NeverDerefAliases,
        0,
        0,
        false,
        Filter,
        []string{},
        nil,
    )
    result, err := l.Search(searchReq)
    if err != nil {
        return nil, fmt.Errorf("Search Error: %s", err)
    }

    if len(result.Entries) > 0 {
        return result, nil
    } else {
        return nil, fmt.Errorf("Couldn't fetch search entries")
    }
}

You can also check out the gist I created.

Thank you for reading. I hope you found this article helpful.

Set Up Ruby on Rails Server on Ubuntu Server 20.04

Rıdvan Tülemen — Thu, 06 Aug 2020 14:36:50 +0000

Installation and running processes for the Rails Server we have created for the Yusufreis are as described below.

Downloading Files

Download the Server's files at first.

git clone https://github.com/starbuckr/railsserver

Then, go to the directory where our project is located and install necessary packages.

cd railsserver
sudo apt install ruby ruby-dev ruby-bundler nodejs npm libsqlite3-dev zlib1-dev
sudo npm install yarn -g
yarn install --check-files

Configuring Rails Server's Settings

If the Ruby version you are currently using is not 2.5.5, you need to change the ruby '2.5.5' line in the Gemfile. For example, if your Ruby version is 2.7.0 we need to edit it as this.

ruby '2.7.0'

After installing packages, configure Gem and database settings.

sudo bundle install
rails db:migrate

Running The Server

In order to run the server, use rails server or rails s command.

rails s

If you want to connect the server from other local machines, you need to change running ip address.

rails s -b 0.0.0.0

You can then access this server from any device connected to that network. For example, if the ip address of our Ubuntu Server machine is 192.168.1.56, you can access the server by entering the address 192.168.1.56:3000 in your browser.

How to Setup Logging Server with Rsyslog in Debian 10

Ali Orhun Akkirman — Sun, 19 Jul 2020 11:35:28 +0000

It is an important need to collect and analyze logs formed in various clients and servers in a common place. For this need, rsyslog is a very efficient tool.

I wanted to create this article because the rsyslog syntax has changed in the Debian 10 (Buster) version compared to the old debian versions (in example Debian 9).

How to Install Rsyslog Server

The package can be installed as below for rsyslog:

sudo apt install rsyslog

How to Configure Rsyslog Server

In the /etc/rsyslog.conf file, the following lines starting with the "#" sign are removed:

module(load="imudp")
input(type="imudp" port="514")

module(load="imtcp")
input(type="imtcp" port="514")

The following line can be added just below which allows you to get logs. The example shows that all devices in the 127.0.0.1 and 10.0.0.0 network can collect logs:

$AllowedSender TCP, 127.0.0.1, 10.0.0.0/24

In addition, various templates can be logged or taken as in the example below:

$template Incoming-logs,"/var/log/%HOSTNAME%/%PROGRAMNAME%.log"
*.*  ?Incoming-logs

Logs would start to be saved under a single file under /var/log if we did not make the corresponding template settings.

After making the related settings, the service is restarted by saving and checking whether there are any errors in the service:

sudo systemctl start rsyslog
sudo systemctl enable rsyslog
sudo systemctl status rsyslog

If there is no problem, syslog format logs directed from the rsyslog client from any source can be collected on the server we set up.

I will specify the relevant client settings in the next post.

Qui nescit dissimulare, nescit regnare