LXC Linux /tmp 使用 tmpfs 問題

必須注意 tmpfs 中檔案容量超過系統可正常運行的記憶體，一旦超過系統將會關機，此項風險，可讓一般帳號的使用者可以利用此關機

Librenms 增加 HTTPS

/etc/nginx/ssl 增加金鑰
 ssl_certificate /etc/nginx/ssl/nginx.crt
 ssl_certificate_key /etc/nginx/ssl/nginx.key

/etc/nginx/sites-enabled/librenms.vhost 增加 server { 中設定 
 listen 443 ssl default_server;
 listen [::]:443 ssl default_server;
 ssl_certificate /etc/nginx/ssl/nginx.crt;
 ssl_certificate_key /etc/nginx/ssl/nginx.key;

#加密方式
ssl_protocols       TLSv1.3;
ssl_ciphers         HIGH:!aNULL:!MD5;

 listen      80;
 server_name 192.168.10.240;
 root        /opt/librenms/html;
 index       index.php;

Debian 12 安裝 Proxmox backup client

wget https://enterprise.proxmox.com/debian/proxmox-release-bookworm.gpg -O /etc/apt/trusted.gpg.d/proxmox-release-bookworm.gpg

cat >/etc/apt/sources.list.d/pbs-no-subscription.list <<EOF
# Proxmox Backup Server pbs-no-subscription repository provided by proxmox.com,
# NOT recommended for production use
deb http://download.proxmox.com/debian/pbs bookworm pbs-no-subscription
EOF

apt update
apt install proxmox-backup-client

openssl 產生自我簽屬無密碼憑證

 openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 10000 -nodes

PHP 執行外部指令

<?php
echo "<pre>";

ob_implicit_flush(true);
ob_end_flush();

$cmd = "./1.sh";

$descriptorspec = array(
   0 => array("pipe", "r"),   // stdin is a pipe that the child will read from
   1 => array("pipe", "w"),   // stdout is a pipe that the child will write to
   2 => array("pipe", "w")    // stderr is a pipe that the child will write to
);

$process = proc_open($cmd, $descriptorspec, $pipes, realpath('./'), array());
if (is_resource($process)) while ($s = fgets($pipes[1])) print $s;
?>

LEAF Bridge 設定

1.編輯 /etc/network/interfaces
# Loopback interface.
auto lo
iface lo inet loopback

iface eth0 inet manual
iface eth1 inet manual

# Bridge setup
auto br0
iface br0 inet dhcp
   bridge_ports eth0 eth1

2.編輯 /etc/shorewall/interfaces
#ZONE           INTERFACE               OPTIONS
net             br0                      bridge
in      br0:eth1
out    br0:eth0

3.編輯 /etc/shorewall/zones
#ZONE           TYPE            OPTIONS         IN_OPTIONS      OUT_OPTIONS
fw              firewall
net             ipv4
in:net          bport
out:net         bport

4.編輯 /etc/shorewall/policy
#SOURCE         DEST            POLICY  LOGLEVEL        RATE    CONNLIMIT
#loc     net    ACCEPT
in          out        ACCEPT
out         in          ACCEPT
out         all         DROP          info
net     all    DROP

Authentication required. System policy prevents WiFi scans

編輯 /etc/polkit-1/localauthority/50-local.d/wifi.scan.pkla

[Allow Wifi Scan]
Identity=unix-user:*
Action=org.freedesktop.NetworkManager.wifi.scan;org.freedesktop.NetworkManager.enable-disable-wifi;org.freedesktop.NetworkManager.settings.modify.own;org.freedesktop.NetworkManager.settings.modify.system;org.freedesktop.NetworkManager.network-control

ResultAny=yes

ResultInactive=yes

ResultActive=yes