document/TranslateProject
2
0
Fork 0
mirror of https://github.com/LCTT/TranslateProject.git synced 2026-08-23 04:03:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #22 from LCTT/master

Browse Source 
Update Repo
This commit is contained in:
joeren
2015-09-07 14:29:44 +08:00
parent 5232f93974 f05b930ed3
commit 8cd2c0479a
14 changed files with 1820 additions and 194 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
sources/tech/20150906 Do Simple Math In Ubuntu And elementary OS With NaSC.md Normal file
View File

@@ -0,0 +1,54 @@
ictlyh Translating
Do Simple Math In Ubuntu And elementary OS With NaSC
================================================================================
![](http://itsfoss.itsfoss.netdna-cdn.com/wp-content/uploads/2015/09/Make-Math-Simpler-with-NaSC.jpg)
[NaSC][1], abbreviation Not a Soulver Clone, is a third party app developed for elementary OS. Whatever the name suggests, NaSC is heavily inspired by [Soulver][2], an OS X app for doing maths like a normal person.
elementary OS itself draws from OS X and it is not a surprise that a number of the third party apps it has got, are also inspired by OS X apps.
Coming back to NaSC, what exactly it means by “maths like a normal person “? Well, it means to write like how you think in your mind. As per the description of the app:
> “Its an app where you do maths like a normal person. It lets you type whatever you want and smartly figures out what is math and spits out an answer on the right pane. Then you can plug those answers in to future equations and if that answer changes, so does the equations its used in.”
Still not convinced? Here, take a look at this screenshot.
![](http://itsfoss.itsfoss.netdna-cdn.com/wp-content/uploads/2015/09/NaSC.png)
Now, you see what is ‘math for normal person’? Honestly, I am not a fan of such apps but it might be useful for some of you perhaps. Let’s see how can you install NaSC in elementary OS, Ubuntu and Linux Mint.
### Install NaSC in Ubuntu, elementary OS and Mint ###
There is a PPA available for installing NaSC. The PPA says ‘daily’ which could mean daily build (i.e. unstable) but in my quick test, it worked just fine.
Open a terminal and use the following commands:
sudo apt-add-repository ppa:nasc-team/daily
sudo apt-get update
sudo apt-get install nasc
Here is a screenshot of NaSC in Ubuntu 15.04:
![](http://itsfoss.itsfoss.netdna-cdn.com/wp-content/uploads/2015/09/NaSC-Ubuntu.png)
If you want to remove it, you can use the following commands:
sudo apt-get remove nasc
sudo apt-add-repository --remove ppa:nasc-team/daily
If you try it, do share your experience with it. In addition to this, you can also try [Vocal podcast app for Linux][3] from third party elementary OS apps.
--------------------------------------------------------------------------------
via: http://itsfoss.com/math-ubuntu-nasc/
作者：[Abhishek][a]
译者：[译者ID](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:http://itsfoss.com/author/abhishek/
[1]:http://parnold-x.github.io/nasc/
[2]:http://www.acqualia.com/soulver/
[3]:http://itsfoss.com/podcast-app-vocal-linux/

117
sources/tech/20150906 How To Manage Log Files With Logrotate On Ubuntu 12.10.md Normal file
View File

@@ -0,0 +1,117 @@
ictlyh Translating
How To Manage Log Files With Logrotate On Ubuntu 12.10
================================================================================
#### About Logrotate ####
Logrotate is a utility/tool that manages activities like automatic rotation, removal and compression of log files in a system. This is an excellent tool to manage your logs conserve precious disk space. By having a simple yet powerful configuration file, different parameters of logrotation can be controlled. This gives complete control over the way logs can be automatically managed and need not necessitate manual intervention.
### Prerequisites ###
As a prerequisite, we are assuming that you have gone through the article on how to set up your droplet or VPS. If not, you can find the article [here][1]. This tutorial requires you to have a VPS up and running and have you log into it.
#### Setup Logrotate ####
### Step 1—Update System and System Packages ###
Run the following command to update the package lists from apt-get and get the information on the newest versions of packages and their dependencies.
sudo apt-get update
### Step 2—Install Logrotate ###
If logrotate is not already on your VPS, install it now through apt-get.
sudo apt-get install logrotate
### Step 3 — Confirmation ###
To verify that logrotate was successfully installed, run this in the command prompt.
logrotate
Since the logrotate utility is based on configuration files, the above command will not rotate any files and will show you a brief overview of the usage and the switch options available.
### Step 4—Configure Logrotate ###
Configurations and default options for the logrotate utility are present in:
/etc/logrotate.conf
Some of the important configuration settings are : rotation-interval, log-file-size, rotation-count and compression.
Application-specific log file information (to override the defaults) are kept at:
/etc/logrotate.d/
We will have a look at a few examples to understand the concept better.
### Step 5—Example ###
An example application configuration setting would be the dpkg (Debian package management system), that is stored in /etc/logrotate.d/dpkg. One of the entries in this file would be:
/var/log/dpkg.log {
monthly
rotate 12
compress
delaycompress
missingok
notifempty
create 644 root root
}
What this means is that:
- the logrotation for dpkg monitors the /var/log/dpkg.log file and does this on a monthly basis this is the rotation interval.
- 'rotate 12' signifies that 12 days worth of logs would be kept.
- logfiles can be compressed using the gzip format by specifying 'compress' and 'delaycompress' delays the compression process till the next log rotation. 'delaycompress' will work only if 'compress' option is specified.
- 'missingok' avoids halting on any error and carries on with the next log file.
- 'notifempty' avoid log rotation if the logfile is empty.
- 'create <mode> <owner> <group>' creates a new empty file with the specified properties after log-rotation.
Though missing in the above example, 'size' is also an important setting if you want to control the sizing of the logs growing in the system.
A configuration setting of around 100MB would look like:
size 100M
Note that If both size and rotation interval are set, then size is taken as a higher priority. That is, if a configuration file has the following settings:
monthly
size 100M
then the logs are rotated once the file size reaches 100M and this need not wait for the monthly cycle.
### Step 6—Cron Job ###
You can also set the logrotation as a cron so that the manual process can be avoided and this is taken care of automatically. By specifying an entry in /etc/cron.daily/logrotate , the rotation is triggered daily.
### Step 7—Status Check and Verification ###
To verify if a particular log is indeed rotating or not and to check the last date and time of its rotation, check the /var/lib/logrotate/status file. This is a neatly formatted file that contains the log file name and the date on which it was last rotated.
cat /var/lib/logrotate/status
A few entries from this file, for example:
"/var/log/lpr.log" 2013-4-11
"/var/log/dpkg.log" 2013-4-11
"/var/log/pm-suspend.log" 2013-4-11
"/var/log/syslog" 2013-4-11
"/var/log/mail.info" 2013-4-11
"/var/log/daemon.log" 2013-4-11
"/var/log/apport.log" 2013-4-11
Congratulations! You have logrotate installed in your system. Now, change the configuration settings as per your requirements.
Try 'man logrotate' or 'logrotate -?' for more details.
--------------------------------------------------------------------------------
via: https://www.digitalocean.com/community/tutorials/how-to-manage-log-files-with-logrotate-on-ubuntu-12-10
译者：[译者ID](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[1]:https://www.digitalocean.com/community/articles/initial-server-setup-with-ubuntu-12-04

103
sources/tech/20150906 How To Set Up Your FTP Server In Linux.md Normal file
View File

@@ -0,0 +1,103 @@
translating by cvsher
How To Set Up Your FTP Server In Linux
================================================================================
![](http://itsfoss.itsfoss.netdna-cdn.com/wp-content/uploads/2015/09/Setup-FTP-Server-in-Linux.jpg)
In this lesson, I will explain to you how to Set up your FTP server. But first, let me quickly tell you what is FTP.
### What is FTP? ###
[FTP][1] is an acronym for File Transfer Protocol. As the name suggests, FTP is used to transfer files between computers on a network. You can use FTP to exchange files between computer accounts, transfer files between an account and a desktop computer, or access online software archives. Keep in mind, however, that many FTP sites are heavily used and require several attempts before connecting.
An FTP address looks a lot like an HTTP or website address except it uses the prefix ftp:// instead of http://.
### What is an FTP Server? ###
Typically, a computer with an FTP address is dedicated to receive an FTP connection. A computer dedicated to receiving an FTP connection is referred to as an FTP server or FTP site.
Now, let’s begin a special adventure. We will make FTP server to share files with friends and family. I will use [vsftpd][2] for this purpose.
VSFTPD is an FTP server software which claims to be the most secure FTP software. In fact, the first two letters in VSFTPD, stand for “very secure”. The software was built around the vulnerabilities of the FTP protocol.
Nevertheless, you should always remember that there are better solutions for secure transfer and management of files such as SFTP (uses [OpenSSH][3]). The FTP protocol is particularly useful for sharing non-sensitive data and is very reliable at that.
#### Installing VSFTPD in rpm distributions: ####
You can quickly install VSFTPD on your server through the command line interface with:
dnf -y install vsftpd
#### Installing VSFTPD in deb distributions: ####
You can quickly install VSFTPD on your server through the command line interface with:
sudo apt-get install vsftpd
#### Installing VSFTPD in Arch distribution: ####
You can quickly install VSFTPD on your server through the command line interface with:
sudo pacman -S vsftpd
#### Configuring FTP server ####
Most VSFTPD’s configuration takes place in /etc/vsftpd.conf. The file itself is well-documented, so this section only highlights some important changes you may want to make. For all available options and basic documentation see the man pages:
man vsftpd.conf
Files are served by default from /srv/ftp as per the Filesystem Hierarchy Standard.
**Enable Uploading:**
The “write_enable” flag must be set to YES in order to allow changes to the filesystem, such as uploading:
write_enable=YES
**Allow Local Users to Login:**
In order to allow users in /etc/passwd to login, the “local_enable” directive must look like this:
local_enable=YES
**Anonymous Login**
The following lines control whether anonymous users can login:
# Allow anonymous login
anonymous_enable=YES
# No password is required for an anonymous login (Optional)
no_anon_password=YES
# Maximum transfer rate for an anonymous client in Bytes/second (Optional)
anon_max_rate=30000
# Directory to be used for an anonymous login (Optional)
anon_root=/example/directory/
**Chroot Jail**
It is possible to set up a chroot environment, which prevents the user from leaving his home directory. To enable this, add/change the following lines in the configuration file:
chroot_list_enable=YES chroot_list_file=/etc/vsftpd.chroot_list
The “chroot_list_file” variable specifies the file in which the jailed users are contained to.
In the end you must restart your ftp server. Type in your command line
sudo systemctl restart vsftpd
That’s it. Your FTP server is up and running.
--------------------------------------------------------------------------------
via: http://itsfoss.com/set-ftp-server-linux/
作者：[alimiracle][a]
译者：[译者ID](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:http://itsfoss.com/author/ali/
[1]:https://en.wikipedia.org/wiki/File_Transfer_Protocol
[2]:https://security.appspot.com/vsftpd.html
[3]:http://www.openssh.com/

219
sources/tech/20150906 How to Configure OpenNMS on CentOS 7.x.md Normal file
View File

@@ -0,0 +1,219 @@
How to Configure OpenNMS on CentOS 7.x
================================================================================
Systems management and monitoring services are very important that provides information to view important systems management information that allow us to to make decisions based on this information. To make sure the network is running at its best and to minimize the network downtime we need to improve application performance. So, in this article we will make you understand the step by step procedure to setup OpenNMS in your IT infrastructure. OpenNMS is a free open source enterprise level network monitoring and management platform that provides information to allow us to make decisions in regards to future network and capacity planning.
OpenNMS designed to manage tens of thousands of devices from a single server as well as manage unlimited devices using a cluster of servers. It includes a discovery engine to automatically configure and manage network devices without operator intervention. It is written in Java and is published under the GNU General Public License. OpenNMS is known for its scalability with its main functional areas in services monitoring, data collection using SNMP and event management and notifications.
### Installing OpenNMS RPM Repository ###
We will start from the installation of OpenNMS RPM for our CentOs 7.1 operating system as its available for most of the RPM-based distributions through Yum at their official link http://yum.opennms.org/ .
![OpenNMS RPM](http://blog.linoxide.com/wp-content/uploads/2015/08/18.png)
Then open your command line interface of CentOS 7.1 and login with root credentials to run the below command with “wget” to get the required RPM.
[root@open-nms ~]# wget http://yum.opennms.org/repofiles/opennms-repo-stable-rhel7.noarch.rpm
![Download RPM](http://blog.linoxide.com/wp-content/uploads/2015/08/26.png)
Now we need to install this repository so that the OpenNMS package information could be available through yum for installation. Let’s run the command below with same root level credentials to do so.
[root@open-nms ~]# rpm -Uvh opennms-repo-stable-rhel7.noarch.rpm
![Installing RPM](http://blog.linoxide.com/wp-content/uploads/2015/08/36.png)
### Installing Prerequisite Packages for OpenNMS ###
Now before we start installation of OpenNMS, let’s make sure you’ve done the following prerequisites.
**Install JDK 7**
Its recommended that you install the latest stable Java 7 JDK from Oracle for the best performance to integrate JDK in our YUM repository as a fallback. Let’s go to the Oracle Java 7 SE JDK download page, accept the license if you agree, choose the platform and architecture. Once it has finished downloading, execute it from the command-line and then install the resulting JDK rpm.
Else run the below command to install using the Yum from the the available system repositories.
[root@open-nms ~]# yum install java-1.7.0-openjdk-1.7.0.85-2.6.1.2.el7_1
Once you have installed the Java you can confirm its installation using below command and check its installed version.
[root@open-nms ~]# java -version
![Java version](http://blog.linoxide.com/wp-content/uploads/2015/08/46.png)
**Install PostgreSQL**
Now we will install the PostgreSQL that is a must requirement to setup the database for OpenNMS. PostgreSQL is included in all of the major YUM-based distributions. To install, simply run the below command.
[root@open-nms ~]# yum install postgresql postgresql-server
![Installing Postgresql](http://blog.linoxide.com/wp-content/uploads/2015/08/55.png)
### Prepare the Database for OpenNMS ###
Once you have installed PostgreSQL, now you'll need to make sure that PostgreSQL is up and active. Let’s run the below command to first initialize the database and then start its services.
[root@open-nms ~]# /sbin/service postgresql initdb
[root@open-nms ~]# /sbin/service postgresql start
![start DB](http://blog.linoxide.com/wp-content/uploads/2015/08/64.png)
Now to confirm the status of your PostgreSQL database you can run the below command.
[root@open-nms ~]# service postgresql status
![PostgreSQL status](http://blog.linoxide.com/wp-content/uploads/2015/08/74.png)
To ensure that PostgreSQL will start after a reboot, use the “systemctl”command to enable start on bootup using below command.
[root@open-nms ~]# systemctl enable postgresql
ln -s '/usr/lib/systemd/system/postgresql.service' '/etc/systemd/system/multi-user.target.wants/postgresql.service'
### Configure PostgreSQL ###
Locate the Postgres “data” directory. Often this is located in /var/lib/pgsql/data directory and Open the postgresql.conf file in text editor and configure the following parameters as shown.
[root@open-nms ~]# vim /var/lib/pgsql/data/postgresql.conf
----------
#------------------------------------------------------------------------------
# CONNECTIONS AND AUTHENTICATION
#------------------------------------------------------------------------------
listen_addresses = 'localhost'
max_connections = 256
#------------------------------------------------------------------------------
# RESOURCE USAGE (except WAL)
#------------------------------------------------------------------------------
shared_buffers = 1024MB
**User Access to the Database**
PostgreSQL only allows you to connect if you are logged in to the local account name that matches the PostgreSQL user. Since OpenNMS runs as root, it cannot connect as a "postgres" or "opennms" user by default, so we have to change the configuration to allow user access to the database by opening the below configuration file.
[root@open-nms ~]# vim /var/lib/pgsql/data/pg_hba.conf
Update the configuration file as shown below and change the METHOD settings from "ident" to "trust"
![user access to db](http://blog.linoxide.com/wp-content/uploads/2015/08/84.png)
Write and quit the file to make saved changes and then restart PostgreSQL services.
[root@open-nms ~]# service postgresql restart
### Starting OpenNMS Installation ###
Now we are ready go with installation of OpenNMS as we have almost don with its prerequisites. Using the YUM packaging system will download and install all of the required components and their dependencies, if they are not already installed on your system.
So let's riun th belwo command to start OpenNMS installation that will pull everything you need to have a working OpenNMS, including the OpenNMS core, web UI, and a set of common plugins.
[root@open-nms ~]# yum -y install opennms
![OpenNMS Installation](http://blog.linoxide.com/wp-content/uploads/2015/08/93.png)
The above command will ends up with successful installation of OpenNMS and its derivative packages.
### Configure JAVA for OpenNMS ###
In order to integrate the default version of Java with OpenNMS we will run the below command.
[root@open-nms ~]# /opt/opennms/bin/runjava -s
![java integration](http://blog.linoxide.com/wp-content/uploads/2015/08/102.png)
### Run the OpenNMS installer ###
Now it's time to start the OpenNMS installer that will create and configure the OpenNMS database, while the same command will be used in case we want to update it to the latest version. To do so, we will run the following command.
[root@open-nms ~]# /opt/opennms/bin/install -dis
The above install command will take many options with following mechanism.
-d - to update the database
-i - to insert any default data that belongs in the database
-s - to create or update the stored procedures OpenNMS uses for certain kinds of data access
==============================================================================
OpenNMS Installer
==============================================================================
Configures PostgreSQL tables, users, and other miscellaneous settings.
DEBUG: Platform is IPv6 ready: true
- searching for libjicmp.so:
- trying to load /usr/lib64/libjicmp.so: OK
- searching for libjicmp6.so:
- trying to load /usr/lib64/libjicmp6.so: OK
- searching for libjrrd.so:
- trying to load /usr/lib64/libjrrd.so: OK
- using SQL directory... /opt/opennms/etc
- using create.sql... /opt/opennms/etc/create.sql
17:27:51.178 [Main] INFO org.opennms.core.schema.Migrator - PL/PgSQL call handler exists
17:27:51.180 [Main] INFO org.opennms.core.schema.Migrator - PL/PgSQL language exists
- checking if database "opennms" is unicode... ALREADY UNICODE
- Creating imports directory (/opt/opennms/etc/imports... OK
- Checking for old import files in /opt/opennms/etc... DONE
INFO 16/08/15 17:27:liquibase: Reading from databasechangelog
Installer completed successfully!
==============================================================================
OpenNMS Upgrader
==============================================================================
OpenNMS is currently stopped
Found upgrade task SnmpInterfaceRrdMigratorOnline
Found upgrade task KscReportsMigrator
Found upgrade task JettyConfigMigratorOffline
Found upgrade task DataCollectionConfigMigratorOffline
Processing RequisitionsMigratorOffline: Remove non-ip-snmp-primary and non-ip-interfaces from requisitions: NMS-5630, NMS-5571
- Running pre-execution phase
Backing up: /opt/opennms/etc/imports
- Running post-execution phase
Removing backup /opt/opennms/etc/datacollection.zip
Finished in 0 seconds
Upgrade completed successfully!
### Firewall configurations to Allow OpenNMS ###
Here we have to allow OpenNMS management interface port 8980 through firewall or router to access the management web interface from the remote systems. So use the following commands to do so.
[root@open-nms etc]# firewall-cmd --permanent --add-port=8980/tcp
[root@open-nms etc]# firewall-cmd --reload
### Start OpenNMS and Login to Web Interface ###
Let's start OpenNMS service and enable to it start at each bootup by using the below command.
[root@open-nms ~]#systemctl start opennms
[root@open-nms ~]#systemctl enable opennms
Once the services are up are ready to go with its web management interface. Open your web browser and access it with your server's IP address and 8980 port.
http://servers_ip:8980/
Give the username and password where as the default username and password is admin/admin.
![opennms login](http://blog.linoxide.com/wp-content/uploads/2015/08/opennms-login.png)
After successful authentication with your provided username and password you will be directed towards the the Home page of OpenNMS where you can configure the new monitoring devices/nodes/services etc.
![opennms home](http://blog.linoxide.com/wp-content/uploads/2015/08/opennms-home.png)
### Conclusion ###
Congratulations! we have successfully setup OpenNMS on CentOS 7.1. So, at the end of this tutorial, you are now able to install and configure OpenNMS with its prerequisites that included PostgreSQL and JAVA setup. So let's enjoy with the great network monitoring system with open source roots using OpenNMS that provide a bevy of features at no cost than their high-end competitors, and can scale to monitor large numbers of network nodes.
--------------------------------------------------------------------------------
via: http://linoxide.com/monitoring-2/install-configure-opennms-centos-7-x/
作者：[Kashif Siddique][a]
译者：[译者ID](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:http://linoxide.com/author/kashifs/

174
sources/tech/20150906 How to Install DNSCrypt and Unbound in Arch Linux.md Normal file
View File

@@ -0,0 +1,174 @@
How to Install DNSCrypt and Unbound in Arch Linux
================================================================================
**DNSCrypt** is a protocol that encrypt and authenticate communications between a DNS client and a DNS resolver. Prevent from DNS spoofing or man in the middle-attack. DNSCrypt are available for most operating system, including Linux, Windows, MacOSX android and iOS. And in this tutorial I'm using archlinux with kernel 4.1.
Unbound is a DNS cache server used to resolve any DNS query received. If the user requests a new query, then unbound will store it as a cache, and when the user requests the same query for the second time, then unbound would take from the cache that have been saved. This will be faster than the first request query.
And now I will try to install "DNSCrypt" to secure the dns communication, and make it faster with dns cache "Unbound".
### Step 1 - Install yaourt ###
Yaourt is one of AUR(Arch User Repository) helper that make archlinux users easy to install a program from AUR. Yaourt use same syntax as pacman, so you can install the program with yaourt. and this is easy way to install yaourt :
1. Edit the arch repository configuration file with nano or vi, stored in a file "/etc/pacman.conf".
$ nano /etc/pacman.conf
2. Add at the bottom line yaourt repository, just paste script below :
[archlinuxfr]
SigLevel = Never
Server = http://repo.archlinux.fr/$arch
3. Save it with press "Ctrl + x" and then "Y".
4. Now update the repository database and install yaourt with pacman command :
$ sudo pacman -Sy yaourt
### Step 2 - Install DNSCrypt and Unbound ###
DNSCrypt and unbound available on archlinux repository, then you can install it with pacman command :
$ sudo pacman -S dnscrypt-proxy unbound
wait it and press "Y" for proceed with installation.
### Step 3 - Install dnscrypt-autoinstall ###
Dnscrypt-autoinstall is A script for installing and automatically configuring DNSCrypt on Linux-based systems. Dnscrypt-autoinstall available in AUR(Arch User Repository), and you must use "yaourt" command to install it :
$ yaourt -S dnscrypt-autoinstall
Note :
-S = it is same as pacman -S to install a software/program.
### Step 4 - Run dnscrypt-autoinstall ###
run the command "dnscrypt-autoinstall" with root privileges to configure DNSCrypt automatically :
$ sudo dnscrypt-autoinstall
Press "Enter" for the next configuration, and then type "y" and choose the DNS provider you want to use, I'm here use DNSCrypt.eu featured with no logs and DNSSEC.
![DNSCrypt autoinstall](http://blog.linoxide.com/wp-content/uploads/2015/08/DNSCrypt-autoinstall.png)
### Step 5 - Configure DNSCrypt and Unbound ###
1. Open the dnscrypt configuration file "/etc/conf.d/dnscrypt-config" and make sure the configuration of "DNSCRYPT_LOCALIP" point to **localhost IP**, and for port configuration "DNSCRYPT_LOCALPORT" it's up to you, I`m here use port **40**.
$ nano /etc/conf.d/dnscrypt-config
DNSCRYPT_LOCALIP=127.0.0.1
DNSCRYPT_LOCALIP2=127.0.0.2
DNSCRYPT_LOCALPORT=40
![DNSCrypt Configuration](http://blog.linoxide.com/wp-content/uploads/2015/08/DNSCryptConfiguration.png)
Save and exit.
2. Now you can edit unbound configuration in "/etc/unbound/". edit the file configuration with nano editor :
$ nano /etc/unbound/unbound.conf
3. Add the following script in the end of line :
do-not-query-localhost: no
forward-zone:
name: "."
forward-addr: 127.0.0.1@40
Make sure the "**forward-addr**" port is same with "**DNSCRYPT_LOCALPORT**" configuration in DNSCrypt. You can see the I`m use port **40**.
![Unbound Configuration](http://blog.linoxide.com/wp-content/uploads/2015/08/UnboundConfiguration.png)
and then save and exit.
### Step 6 - Run DNSCrypt and Unbound, then Add to startup/Boot ###
Please run DNSCrypt and unbound with root privileges, you can run with systemctl command :
$ sudo systemctl start dnscrypt-proxy unbound
Add the service at the boot time/startup. You can do it by running "systemctl enable" :
$ sudo systemctl enable dnscrypt-proxy unbound
the command will create the symlink of the service to "/usr/lib/systemd/system/" directory.
### Step 7 - Configure resolv.conf and restart all services ###
Resolv.conf is a file used by linux to configure Domain Name Server(DNS) resolver. it is just plain-text created by administrator, so you must edit by root privileges and make it immutable/no one can edit it.
Edit it with nano editor :
$ nano /etc/resolv.conf
and add the localhost IP "**127.0.0.1**". and now make it immutable with "chattr" command :
$ chattr +i /etc/resolv.conf
Note :
If you want to edit it again, make it writable with command "chattr -i /etc/resolv.conf".
Now yo need to restart the DNSCrypt, unbound and the network :
$ sudo systemctl restart dnscrypt-proxy unbound netctl
If you see the error, check your configuration file.
### Testing ###
1. Test DNSCrypt
You can be sure that DNSCrypt had acted correctly by visiting https://dnsleaktest.com/, then click on "Standard Test" or "Extended Test" and wait the process running.
And now you can see that DNSCrypt is working with DNSCrypt.eu as your DNS provider.
![Testing DNSCrypt](http://blog.linoxide.com/wp-content/uploads/2015/08/TestingDNSCrypt.png)
And now you can see that DNSCrypt is working with DNSCrypt.eu as your DNS provider.
2. Test Unbound
Now you should ensure that the unbound is working correctly with "dig" or "drill" command.
This is the results for dig command :
$ dig linoxide.com
Now see in the results, the "Query time" is "533 msec" :
;; Query time: 533 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Aug 30 14:48:19 WIB 2015
;; MSG SIZE rcvd: 188
and try again with the same command. And you will see the "Query time" is "0 msec".
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Aug 30 14:51:05 WIB 2015
;; MSG SIZE rcvd: 188
![Unbound Test](http://blog.linoxide.com/wp-content/uploads/2015/08/UnboundTest.png)
And in the end DNSCrypt secure communications between the DNS clients and DNS resolver is working perfectly, and then Unbound make it faster if there is the same request in another time by taking the cache that have been saved.
### Conclusion ###
DNSCrypt is a protocol that can encrypt data flow between the DNS client and DNS resolver. DNSCrypt can run on various operating systems, either mobile or desktop. Choose DNS provider also includes something important, choose which provide a DNSSEC and no logs. Unbound can be used as a DNS cache, thus speeding up the resolve process resolv, because Unbound will store a request as the cache, then when a client request same query in the next time, then unbound would take from the cache that have been saved. DNSCrypt and Unbound is a powerful combination for the safety and speed.
--------------------------------------------------------------------------------
via: http://linoxide.com/tools/install-dnscrypt-unbound-archlinux/
作者：[Arul][a]
译者：[译者ID](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:http://linoxide.com/author/arulm/

113
sources/tech/20150906 How to Install QGit Viewer in Ubuntu 14.04.md Normal file
View File

@@ -0,0 +1,113 @@
How to Install QGit Viewer in Ubuntu 14.04
================================================================================
QGit is a free and Open Source GUI git viewer written on Qt and C++ by Marco Costalba. It is a better git viewer which provides us the ability to browse revisions history, view commits and patches applied to the files under a simple GUI environment. It utilizes git command line to process execute the commands and to display the output. It has some common features like to view revisions, diffs, files history, files annotation, archive tree. We can format and apply patch series with the selected commits, drag and drop commits between two instances and more with QGit Viewer. It allows us to create custom buttons with which we can add more buttons to execute a specific command when pressed using its builtin Action Builder.
Here are some easy steps on how we can compile and install QGit Viewer from its source code in Ubuntu 14.04 LTS "Trusty".
### 1. Installing QT4 Libraries ###
First of all, we'll need have QT4 Libraries installed in order to run QGit viewer in our ubuntu machine. As apt is the default package manager of ubuntu and QT4 packages is available in the official repository of ubutnu, we'll gonna install qt4-default using apt-get command as shown below.
$ sudo apt-get install qt4-default
### 2. Downloading QGit Tarball ###
After installing Qt4 libraries, we'll gonna install git so that we can clone the Git repository of QGit Viewer for Qt 4 . To do so, we'll run the following apt-get command.
$ sudo apt-get install git
Now, we'll clone the repository using git command as shown below.
$ git clone git://repo.or.cz/qgit4/redivivus.git
Cloning into 'redivivus'...
remote: Counting objects: 7128, done.
remote: Compressing objects: 100% (2671/2671), done.
remote: Total 7128 (delta 5464), reused 5711 (delta 4438)
Receiving objects: 100% (7128/7128), 2.39 MiB | 470.00 KiB/s, done.
Resolving deltas: 100% (5464/5464), done.
Checking connectivity... done.
### 3. Compiling QGit ###
After we have cloned the repository, we'll now enter into the directory named redivivus and create the makefile which we'll require to compile qgit viewer. So, to enter into the directory, we'll run the following command.
$ cd redivivus
Next, we'll run the following command in order to generate a new Makefile from qmake project file ie qgit.pro.
$ qmake qgit.pro
After the Makefile has been generated, we'll now finally compile the source codes of qgit and get the binary as output. To do so, first we'll need to install make and g++ package so that we can compile, as it is a program written in C++ .
$ sudo apt-get install make g++
Now, we'll gonna compile the codes using make command.
$ make
### 4. Installing QGit ###
As we have successfully compiled the source code of QGit viewer, now we'll surely wanna install it in our Ubuntu 14.04 machine so that we can execute it from our system. To do so, we'll run the following command.
$ sudo make install
cd src/ && make -f Makefile install
make[1]: Entering directory `/home/arun/redivivus/src'
make -f Makefile.Release install
make[2]: Entering directory `/home/arun/redivivus/src'
install -m 755 -p "../bin/qgit" "/usr/lib/x86_64-linux-gnu/qt4/bin/qgit"
strip "/usr/lib/x86_64-linux-gnu/qt4/bin/qgit"
make[2]: Leaving directory `/home/arun/redivivus/src'
make[1]: Leaving directory `/home/arun/redivivus/src'
Next, we'll need to copy the built qgit binary file from bin directory to /usr/bin/ directory so that it will be available as global command.
$ sudo cp bin/qgit /usr/bin/
### 5. Creating Desktop File ###
As we have successfully installed qgit in our Ubuntu box, we'll now go for create a desktop file so that QGit will be available under Menu or Launcher of our Desktop Environment. To do so, we'll need to create a new file named qgit.desktop under /usr/share/applications/ directory.
$ sudo nano /usr/share/applications/qgit.desktop
Then, we'll need to paste the following lines into the file.
[Desktop Entry]
Name=qgit
GenericName=git GUI viewer
Exec=qgit
Icon=qgit
Type=Application
Comment=git GUI viewer
Terminal=false
MimeType=inode/directory;
Categories=Qt;Development;RevisionControl;
After done, we'll simply save the file and exit.
### 6. Running QGit Viewer ###
After QGit is installed successfully in our Ubuntu box, we can now run it from any launcher or application menu. In order to run QGit from the terminal, we'll need to run as follows.
$ qgit
This will open the Qt4 Framework based QGit Viewer in GUI mode.
![QGit Viewer](http://blog.linoxide.com/wp-content/uploads/2015/07/qgit-viewer.png)
### Conclusion ###
QGit is really an awesome QT based git viewer. It is available on all three platforms Linux, Mac OSX and Microsoft Windows. It helps us to easily navigate to the history, revisions, branches and more from the available git repository. It reduces the need of running git command line for the common stuffs like viewing revisions, history, diff, etc as graphical interface of it makes easy to do tasks. The latest version of qgit is also available in the default repository of ubuntu which we can install using **apt-get install qgit** command. So, qgit makes our work pretty fast and easy to do with its simple GUI.
--------------------------------------------------------------------------------
via: http://linoxide.com/ubuntu-how-to/install-qgit-viewer-ubuntu-14-04/
作者：[Arun Pyasi][a]
译者：[译者ID](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:http://linoxide.com/author/arunp/

197
sources/tech/20150906 How to install Suricata intrusion detection system on Linux.md Normal file
View File

@@ -0,0 +1,197 @@
How to install Suricata intrusion detection system on Linux
================================================================================
With incessant security threats, intrusion detection system (IDS) has become one of the most critical requirements in today's data center environments. However, as more and more servers upgrade their NICs to 10GB/40GB Ethernet, it is increasingly difficult to implement compute-intensive intrusion detection on commodity hardware at line rates. One approach to scaling IDS performance is **multi-threaded IDS**, where CPU-intensive deep packet inspection workload is parallelized into multiple concurrent tasks. Such parallelized inspection can exploit multi-core hardware to scale up IDS throughput easily. Two well-known open-source efforts in this area are [Suricata][1] and [Bro][2].
In this tutorial, I am going to demonstrate **how to install and configure Suricata IDS on Linux server**.
### Install Suricata IDS on Linux ###
Let's build Suricata from the source. You first need to install several required dependencies as follows.
#### Install Dependencies on Debian, Ubuntu or Linux Mint ####
$ sudo apt-get install wget build-essential libpcre3-dev libpcre3-dbg automake autoconf libtool libpcap-dev libnet1-dev libyaml-dev zlib1g-dev libcap-ng-dev libjansson-dev
#### Install Dependencies on CentOS, Fedora or RHEL ####
$ sudo yum install wget libpcap-devel libnet-devel pcre-devel gcc-c++ automake autoconf libtool make libyaml-devel zlib-devel file-devel jansson-devel nss-devel
Once you install all required packages, go ahead and install Suricata as follows.
First, download the latest Suricata source code from [http://suricata-ids.org/download/][3], and build it. As of this writing, the latest version is 2.0.8.
$ wget http://www.openinfosecfoundation.org/download/suricata-2.0.8.tar.gz
$ tar -xvf suricata-2.0.8.tar.gz
$ cd suricata-2.0.8
$ ./configure --sysconfdir=/etc --localstatedir=/var
Here is the example output of configuration.
Suricata Configuration:
AF_PACKET support: yes
PF_RING support: no
NFQueue support: no
NFLOG support: no
IPFW support: no
DAG enabled: no
Napatech enabled: no
Unix socket enabled: yes
Detection enabled: yes
libnss support: yes
libnspr support: yes
libjansson support: yes
Prelude support: no
PCRE jit: yes
LUA support: no
libluajit: no
libgeoip: no
Non-bundled htp: no
Old barnyard2 support: no
CUDA enabled: no
Now compile and install it.
$ make
$ sudo make install
Suricata source code comes with default configuration files. Let's install these default configuration files as follows.
$ sudo make install-conf
As you know, Suricata is useless without IDS rule sets. Conveniently, the Makefile comes with IDS rule installation option. To install IDS rules, run the following command.
$ sudo make install-rules
The above rule installation command will download the current snapshot of community rulesets available from [EmergingThreats.net][4], and store them under /etc/suricata/rules.
![](https://farm1.staticflickr.com/691/20482669553_8b67632277_c.jpg)
### Configure Suricata IDS the First Time ###
Now it's time to configure Suricata. The configuration file is located at **/etc/suricata/suricata.yaml**. Open the file with a text editor for editing.
$ sudo vi /etc/suricata/suricata.yaml
Here are some basic setup for you to get started.
The "default-log-dir" keyword should point to the location of Suricata log files.
default-log-dir: /var/log/suricata/
Under "vars" section, you will find several important variables used by Suricata. "HOME_NET" should point to the local network to be inspected by Suricata. "!$HOME_NET" (assigned to EXTERNAL_NET) refers to any other networks than the local network. "XXX_PORTS" indicates the port number(s) use by different services. Note that Suricata can automatically detect HTTP traffic regardless of the port it uses. So it is not critical to specify the HTTP_PORTS variable correctly.
vars:
HOME_NET: "[192.168.122.0/24]"
EXTERNAL_NET: "!$HOME_NET"
HTTP_PORTS: "80"
SHELLCODE_PORTS: "!80"
SSH_PORTS: 22
The "host-os-policy" section is used to defend against some well-known attacks which exploit the behavior of an operating system's network stack (e.g., TCP reassembly) to evade detection. As a counter measure, modern IDS came up with so-called "target-based" inspection, where inspection engine fine-tunes its detection algorithm based on a target operating system of the traffic. Thus, if you know what OS individual local hosts are running, you can feed that information to Suricata to potentially enhance its detection rate. This is when "host-os-policy" section is used. In this example, the default IDS policy is Linux; if no OS information is known for a particular IP address, Suricata will apply Linux-based inspection. When traffic for 192.168.122.0/28 and 192.168.122.155 is captured, Suricata will apply Windows-based inspection policy.
host-os-policy:
# These are Windows machines.
windows: [192.168.122.0/28, 192.168.122.155]
bsd: []
bsd-right: []
old-linux: []
# Make the default policy Linux.
linux: [0.0.0.0/0]
old-solaris: []
solaris: ["::1"]
hpux10: []
hpux11: []
irix: []
macos: []
vista: []
windows2k3: []
Under "threading" section, you can specify CPU affinity for different Suricata threads. By default, [CPU affinity][5] is disabled ("set-cpu-affinity: no"), meaning that Suricata threads will be scheduled on any available CPU cores. By default, Suricata will create one "detect" thread for each CPU core. You can adjust this behavior by specifying "detect-thread-ratio: N". This will create N*M detect threads, where M is the total number of CPU cores on the host.
threading:
set-cpu-affinity: no
detect-thread-ratio: 1.5
With the above threading settings, Suricata will create 1.5*M detection threads, where M is the total number of CPU cores on the system.
For more information about Suricata configuration, you can read the default configuration file itself, which is heavily commented for clarity.
### Perform Intrusion Detection with Suricata ###
Now it's time to test-run Suricata. Before launching it, there's one more step to do.
When you are using pcap capture mode, it is highly recommended to turn off any packet offloead features (e.g., LRO/GRO) on the NIC which Suricata is listening on, as those features may interfere with live packet capture.
Here is how to turn off LRO/GRO on the network interface eth0:
$ sudo ethtool -K eth0 gro off lro off
Note that depending on your NIC, you may see the following warning, which you can ignore. It simply means that your NIC does not support LRO.
Cannot change large-receive-offload
Suricata supports a number of running modes. A runmode determines how different threads are used for IDS. The following command lists all [available runmodes][6].
$ sudo /usr/local/bin/suricata --list-runmodes
![](https://farm6.staticflickr.com/5730/20481140934_25080d04d7_c.jpg)
The default runmode used by Suricata is autofp (which stands for "auto flow pinned load balancing"). In this mode, packets from each distinct flow are assigned to a single detect thread. Flows are assigned to threads with the lowest number of unprocessed packets.
Finally, let's start Suricata, and see it in action.
$ sudo /usr/local/bin/suricata -c /etc/suricata/suricata.yaml -i eth0 --init-errors-fatal
![](https://farm1.staticflickr.com/701/21077552366_c577746e36_c.jpg)
In this example, we are monitoring a network interface eth0 on a 8-core system. As shown above, Suricata creates 13 packet processing threads and 3 management threads. The packet processing threads consist of one PCAP packet capture thread, and 12 detect threads (equal to 8*1.5). This means that the packets captured by one capture thread are load-balanced to 12 detect threads for IDS. The management threads are one flow manager and two counter/stats related threads.
Here is a thread-view of Suricata process (plotted by [htop][7]).
![](https://farm6.staticflickr.com/5775/20482669593_174f8f41cb_c.jpg)
Suricata detection logs are stored in /var/log/suricata directory.
$ tail -f /var/log/suricata/fast.log
----------
04/01/2015-15:47:12.559075 [**] [1:2200074:1] SURICATA TCPv4 invalid checksum [**] [Classification: (null)] [Priority: 3] {TCP} 172.16.253.158:22 -> 172.16.253.1:46997
04/01/2015-15:49:06.565901 [**] [1:2200074:1] SURICATA TCPv4 invalid checksum [**] [Classification: (null)] [Priority: 3] {TCP} 172.16.253.158:22 -> 172.16.253.1:46317
04/01/2015-15:49:06.566759 [**] [1:2200074:1] SURICATA TCPv4 invalid checksum [**] [Classification: (null)] [Priority: 3] {TCP} 172.16.253.158:22 -> 172.16.253.1:46317
For ease of import, the log is also available in JSON format:
$ tail -f /var/log/suricata/eve.json
----------
{"timestamp":"2015-04-01T15:49:06.565901","event_type":"alert","src_ip":"172.16.253.158","src_port":22,"dest_ip":"172.16.253.1","dest_port":46317,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2200074,"rev":1,"signature":"SURICATA TCPv4 invalid checksum","category":"","severity":3}}
{"timestamp":"2015-04-01T15:49:06.566759","event_type":"alert","src_ip":"172.16.253.158","src_port":22,"dest_ip":"172.16.253.1","dest_port":46317,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2200074,"rev":1,"signature":"SURICATA TCPv4 invalid checksum","category":"","severity":3}}
### Conclusion ###
In this tutorial, I demonstrated how you can set up Suricata IDS on a multi-core Linux server. Unlike single-threaded [Snort IDS][8], Suricata can easily benefit from multi-core/many-core hardware with multi-threading. There is great deal of customization in Suricata to maximize its performance and detection coverage. Suricata folks maintain [online Wiki][9] quite well, so I strongly recommend you check it out if you want to deploy Suricata in your environment.
Are you currently using Suricata? If so, feel free to share your experience.
--------------------------------------------------------------------------------
via: http://xmodulo.com/install-suricata-intrusion-detection-system-linux.html
作者：[Dan Nanni][a]
译者：[译者ID](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:http://xmodulo.com/author/nanni
[1]:http://suricata-ids.org/
[2]:https://www.bro.org/
[3]:http://suricata-ids.org/download/
[4]:http://rules.emergingthreats.net/
[5]:http://xmodulo.com/run-program-process-specific-cpu-cores-linux.html
[6]:https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Runmodes
[7]:http://ask.xmodulo.com/view-threads-process-linux.html
[8]:http://xmodulo.com/how-to-compile-and-install-snort-from-source-code-on-ubuntu.html
[9]:https://redmine.openinfosecfoundation.org/projects/suricata/wiki

73
sources/tech/20150906 Install Qmmp 0.9.0 Winamp-like Audio Player in Ubuntu.md Normal file
View File

@@ -0,0 +1,73 @@
translation by strugglingyouth
Install Qmmp 0.9.0 Winamp-like Audio Player in Ubuntu
================================================================================
![](http://ubuntuhandbook.org/wp-content/uploads/2015/01/qmmp-icon-simple.png)
Qmmp, Qt-based audio player with winamp or xmms like user interface, now is at 0.9.0 release. PPA updated for Ubuntu 15.10, Ubuntu 15.04, Ubuntu 14.04, Ubuntu 12.04 and derivatives.
Qmmp 0.9.0 is a big release with many new features, improvements and some translation updates. It added:
- audio-channel sequence converter;
- 9 channels support to equalizer;
- album artist tag support;
- asynchronous sorting;
- sorting by file modification date;
- sorting by album artist;
- multiple column support;
- feature to hide track length;
- feature to disable plugins without qmmp.pri modification (qmake only)
- feature to remember playlist scroll position;
- feature to exclude cue data files;
- feature to change user agent;
- feature to change window title;
- feature to reset fonts;
- feature to restore default shortcuts;
- default hotkey for the “Rename List” action;
- feature to disable fadeout in the gme plugin;
- Simple User Interface (QSUI) with the following changes:
- added multiple column support;
- added sorting by album artist;
- added sorting by file modification date;
- added feature to hide song length;
- added default hotkey for the “Rename List” action;
- added “Save List” action to the tab menu;
- added feature to reset fonts;
- added feature to reset shortcuts;
- improved status bar;
It also improved playlist changes notification, playlist container, sample rate converter, cmake build scripts, title formatter, ape tags support in the mpeg plugin, fileops plugin, reduced cpu usage, changed default skin (to Glare) and playlist separator.
![qmmp-090](http://ubuntuhandbook.org/wp-content/uploads/2015/09/qmmp-090.jpg)
### Install Qmmp 0.9.0 in Ubuntu: ###
New release has been made into PPA, available for all current Ubuntu releases and derivatives.
1. To add the [Qmmp PPA][1].
Open terminal from the Dash, App Launcher, or via Ctrl+Alt+T shortcut keys. When it opens, run command:
sudo add-apt-repository ppa:forkotov02/ppa
![qmmp-ppa](http://ubuntuhandbook.org/wp-content/uploads/2015/09/qmmp-ppa.jpg)
2. After adding the PPA, upgrade Qmmp player through Software Updater. Or refresh system cache and install the software via below commands:
sudo apt-get update
sudo apt-get install qmmp qmmp-plugin-pack
That’s it. Enjoy!
--------------------------------------------------------------------------------
via: http://ubuntuhandbook.org/index.php/2015/09/qmmp-0-9-0-in-ubuntu/
作者：[Ji m][a]
译者：[译者ID](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:http://ubuntuhandbook.org/index.php/about/
[1]:https://launchpad.net/~forkotov02/+archive/ubuntu/ppa

451
sources/tech/20150906 Installing NGINX and NGINX Plus With Ansible.md Normal file
View File

@@ -0,0 +1,451 @@
translation by strugglingyouth
nstalling NGINX and NGINX Plus With Ansible
================================================================================
Coming from a production operations background, I have learned to love all things related to automation. Why do something by hand if a computer can do it for you? But creating and implementing automation can be a difficult task given an ever-changing infrastructure and the various technologies surrounding your environments. This is why I love [Ansible][1]. Ansible is an open source tool for IT configuration management, deployment, and orchestration that is extremely easy to use.
One of my favorite features of Ansible is that it is completely clientless. To manage a system, a connection is made over SSH, using either [Paramiko][2] (a Python library) or native [OpenSSH][3]. Another attractive feature of Ansible is its extensive selection of modules. These modules can be used to perform some of the common tasks of a system administrator. In particular, they make Ansible a powerful tool for installing and configuring any application across multiple servers, environments, and operating systems, all from one central location.
In this tutorial I will walk you through the steps for using Ansible to install and deploy the open source [NGINX][4] software and [NGINX Plus][5], our commercial product. I’m showing deployment onto a [CentOS][6] server, but I have included details about deploying on Ubuntu servers in [Creating an Ansible Playbook for Installing NGINX and NGINX Plus on Ubuntu][7] below.
For this tutorial I will be using Ansible version 1.9.2 and performing the deployment from a server running CentOS 7.1.
$ ansible --version
ansible 1.9.2
$ cat /etc/redhat-release
CentOS Linux release 7.1.1503 (Core)
If you don’t already have Ansible, you can get instructions for installing it [at the Ansible site][8].
If you are using CentOS, installing Ansible is easy as typing the following command. If you want to compile from source or for other distributions, see the instructions at the Ansible link provided just above.
$ sudo yum install -y epel-release && sudo yum install -y ansible
Depending on your environment, some of the commands in this tutorial might require sudo privileges. The path to the files, usernames, and destination servers are all values that will be specific to your environment.
### Creating an Ansible Playbook for Installing NGINX (CentOS) ###
First we create a working directory for our NGINX deployment, along with subdirectories and deployment configuration files. I usually recommend creating the directory in your home directory and show that in all examples in this tutorial.
$ cd $HOME
$ mkdir -p ansible-nginx/tasks/
$ touch ansible-nginx/deploy.yml
$ touch ansible-nginx/tasks/install_nginx.yml
The directory structure now looks like this. You can check by using the tree command.
$ tree $HOME/ansible-nginx/
/home/kjones/ansible-nginx/
├── deploy.yml
└── tasks
└── install_nginx.yml
1 directory, 2 files
If you do not have tree installed, you can do so using the following command.
$ sudo yum install -y tree
#### Creating the Main Deployment File ####
Next we open **deploy.yml** in a text editor. I prefer vim for editing configuration files on the command line, and will use it throughout the tutorial.
$ vim $HOME/ansible-nginx/deploy.yml
The **deploy.yml** file is our main Ansible deployment file, which we’ll reference when we run the ansible‑playbook command in [Running Ansible to Deploy NGINX][9]. Within this file we specify the inventory for Ansible to use along with any other configuration files to include at runtime.
In my example I use the [include][10] module to specify a configuration file that has the steps for installing NGINX. While it is possible to create a playbook in one very large file, I recommend that you separate the steps into smaller included files to keep things organized. Sample use cases for an include are copying static content, copying configuration files, or assigning variables for a more advanced deployment with configuration logic.
Type the following lines into the file. I include the filename at the top in a comment for reference.
# ./ansible-nginx/deploy.yml
- hosts: nginx
tasks:
- include: 'tasks/install_nginx.yml'
The hosts statement tells Ansible to deploy to all servers in the **nginx** group, which is defined in **/etc/ansible/hosts**. We’ll edit this file in [Creating the List of NGINX Servers below][11].
The include statement tells Ansible to read in and execute the contents of the **install_nginx.yml** file from the **tasks** directory during deployment. The file includes the steps for downloading, installing, and starting NGINX. We’ll create this file in the next section.
#### Creating the Deployment File for NGINX ####
Now let’s save our work to **deploy.yml** and open up **install_nginx.yml** in the editor.
$ vim $HOME/ansible-nginx/tasks/install_nginx.yml
The file is going to contain the instructions – written in [YAML][12] format – for Ansible to follow when installing and configuring our NGINX deployment. Each section (step in the process) starts with a name statement (preceded by hyphen) that describes the step. The string following name: is written to stdout during the Ansible deployment and can be changed as you wish. The next line of a section in the YAML file is the module that will be used during that deployment step. In the configuration below, both the [yum][13] and [service][14] modules are used. The yum module is used to install packages on CentOS. The service module is used to manage UNIX services. The final line or lines in a section specify any parameters for the module (in the example, these lines start with name and state).
Type the following lines into the file. As with **deploy.yml**, the first line in our file is a comment that names the file for reference. The first section tells Ansible to install the **.rpm** file for CentOS 7 from the NGINX repository. This directs the package manager to install the most recent stable version of NGINX directly from NGINX. Modify the pathname as necessary for your CentOS version. A list of available packages can be found on the [open source NGINX website][15]. The next two sections tell Ansible to install the latest NGINX version using the yum module and then start NGINX using the service module.
**Note:** In the first section, the pathname to the CentOS package appears on two lines only for space reasons. Type the entire path on a single line.
# ./ansible-nginx/tasks/install_nginx.yml
- name: NGINX | Installing NGINX repo rpm
yum:
name: http://nginx.org/packages/centos/7/noarch/RPMS/nginx-release-centos-7-0.el7.ngx.noarch.rpm
- name: NGINX | Installing NGINX
yum:
name: nginx
state: latest
- name: NGINX | Starting NGINX
service:
name: nginx
state: started
#### Creating the List of NGINX Servers ####
Now that we have our Ansible deployment configuration files all set up, we need to tell Ansible exactly which servers to deploy to. We specify this in the Ansible **hosts** file I mentioned earlier. Let’s make a backup of the existing file and create a new one just for our deployment.
$ sudo mv /etc/ansible/hosts /etc/ansible/hosts.backup
$ sudo vim /etc/ansible/hosts
Type (or edit) the following lines in the file to create a group called **nginx** and list the servers to install NGINX on. You can designate servers by hostname, IP address, or in an array such as **server[1-3].domain.com**. Here I designate one server by its IP address.
# /etc/ansible/hosts
[nginx]
172.16.239.140
#### Setting Up Security ####
We are almost all set, but before deployment we need to ensure that Ansible has authorization to access our destination server over SSH.
The preferred and most secure method is to add the Ansible deployment server’s RSA SSH key to the destination server’s **authorized_keys** file, which gives Ansible unrestricted SSH permissions on the destination server. To learn more about this configuration, see [Securing OpenSSH][16] on wiki.centos.org. This way you can automate your deployments without user interaction.
Alternatively, you can request the password interactively during deployment. I strongly recommend that you use this method during testing only, because it is insecure and there is no way to track changes to a destination host’s fingerprint. If you want to do this, change the value of StrictHostKeyChecking from the default yes to no in the **/etc/ssh/ssh_config** file on each of your destination hosts. Then add the --ask-pass flag on the ansible-playbook command to have Ansible prompt for the SSH password.
Here I illustrate how to edit the **ssh_config** file to disable strict host key checking on the destination server. We manually SSH into the server to which we’ll deploy NGINX and change the value of StrictHostKeyChecking to no.
$ ssh kjones@172.16.239.140
kjones@172.16.239.140's password:***********
[kjones@nginx ]$ sudo vim /etc/ssh/ssh_config
After you make the change, save **ssh_config**, and connect to your Ansible server via SSH. The setting should look as below before you save your work.
# /etc/ssh/ssh_config
StrictHostKeyChecking no
#### Running Ansible to Deploy NGINX ####
If you have followed the steps in this tutorial, you can run the following command to have Ansible deploy NGINX. (Again, if you have set up RSA SSH key authentication, then the --ask-pass flag is not needed.) Run the command on the Ansible server with the configuration files we created above.
$ sudo ansible-playbook --ask-pass $HOME/ansible-nginx/deploy.yml
Ansible prompts for the SSH password and produces output like the following. A recap that reports failed=0 like this one indicates that deployment succeeded.
$ sudo ansible-playbook --ask-pass $HOME/ansible-nginx/deploy.yml
SSH password:
PLAY [all] ********************************************************************
GATHERING FACTS ***************************************************************
ok: [172.16.239.140]
TASK: [NGINX | Installing NGINX repo rpm] *************************************
changed: [172.16.239.140]
TASK: [NGINX | Installing NGINX] **********************************************
changed: [172.16.239.140]
TASK: [NGINX | Starting NGINX] ************************************************
changed: [172.16.239.140]
PLAY RECAP ********************************************************************
172.16.239.140 : ok=4 changed=3 unreachable=0 failed=0
If you didn’t get a successful play recap, you can try running the ansible-playbook command again with the -vvvv flag (verbose with connection debugging) to troubleshoot the deployment process.
When deployment succeeds (as it did for us on the first try), you can verify that NGINX is running on the remote server by running the following basic [cURL][17] command. Here it returns 200 OK. Success! We have successfully installed NGINX using Ansible.
$ curl -Is 172.16.239.140 | grep HTTP
HTTP/1.1 200 OK
### Creating an Ansible Playbook for Installing NGINX Plus (CentOS) ###
Now that I’ve shown you how to install the open source version of NGINX, I’ll walk you through the steps for installing NGINX Plus. This requires some additional changes to the deployment configuration and showcases some of Ansible’s other features.
#### Copying the NGINX Plus Certificate and Key to the Ansible Server ####
To install and configure NGINX Plus with Ansible, we first need to copy the key and certificate for our NGINX Plus subscription from the [NGINX Plus Customer Portal][18] to the standard location on the Ansible deployment server.
Access to the NGINX Plus Customer Portal is available for customers who have purchased NGINX Plus or are evaluating it. If you are interested in evaluating NGINX Plus, you can request a 30-day free trial [here][19]. You will receive a link to your trial certificate and key shortly after you sign up.
On a Mac or Linux host, use the [scp][20] utility as I show here. On a Microsoft Windows host, you can use [WinSCP][21]. For this tutorial, I downloaded the files to my Mac laptop, then used scp to copy them to the Ansible server. These commands place both the key and certificate in my home directory.
$ cd /path/to/nginx-repo-files/
$ scp nginx-repo.* user@destination-server:.
Next we SSH to the Ansible server, make sure the SSL directory for NGINX Plus exists, and move the files there.
$ ssh user@destination-server
$ sudo mkdir -p /etc/ssl/nginx/
$ sudo mv nginx-repo.* /etc/ssl/nginx/
Verify that your **/etc/ssl/nginx** directory contains both the certificate (**.crt**) and key (**.key**) files. You can check by using the tree command.
$ tree /etc/ssl/nginx
/etc/ssl/nginx
├── nginx-repo.crt
└── nginx-repo.key
0 directories, 2 files
If you do not have tree installed, you can do so using the following command.
$ sudo yum install -y tree
#### Creating the Ansible Directory Structure ####
The remaining steps are very similar to the ones for open source NGINX that we performed in [Creating an Ansible Playbook for Installing NGINX (CentOS)][22]. First we set up a working directory for our NGINX Plus deployment. Again I prefer creating it as a subdirectory of my home directory.
$ cd $HOME
$ mkdir -p ansible-nginx-plus/tasks/
$ touch ansible-nginx-plus/deploy.yml
$ touch ansible-nginx-plus/tasks/install_nginx_plus.yml
The directory structure now looks like this.
$ tree $HOME/ansible-nginx-plus/
/home/kjones/ansible-nginx-plus/
├── deploy.yml
└── tasks
└── install_nginx_plus.yml
1 directory, 2 files
#### Creating the Main Deployment File ####
Next we use vim to create the **deploy.yml** file as for open source NGINX.
$ vim ansible-nginx-plus/deploy.yml
The only difference from the open source NGINX deployment is that we change the name of the included file to **install_nginx_plus.yml**. As a reminder, the file tells Ansible to deploy NGINX Plus on all servers in the **nginx** group (which is defined in **/etc/ansible/hosts**), and to read in and execute the contents of the **install_nginx_plus.yml** file from the **tasks** directory during deployment.
# ./ansible-nginx-plus/deploy.yml
- hosts: nginx
tasks:
- include: 'tasks/install_nginx_plus.yml'
If you have not done so already, you also need to create the hosts file as detailed in [Creating the List of NGINX Servers][23] above.
#### Creating the Deployment File for NGINX Plus ####
Open **install_nginx_plus.yml** in a text editor. The file is going to contain the instructions for Ansible to follow when installing and configuring your NGINX Plus deployment. The commands and modules are specific to CentOS and some are unique to NGINX Plus.
$ vim ansible-nginx-plus/tasks/install_nginx_plus.yml
The first section uses the [file][24] module, telling Ansible to create the SSL directory for NGINX Plus as specified by the path and state arguments, set the ownership to root, and change the mode to 0700.
# ./ansible-nginx-plus/tasks/install_nginx_plus.yml
- name: NGINX Plus | Creating NGINX Plus ssl cert repo directory
file: path=/etc/ssl/nginx state=directory group=root mode=0700
The next two sections use the [copy][25] module to copy the NGINX Plus certificate and key from the Ansible deployment server to the NGINX Plus server during the deployment, again setting ownership to root and the mode to 0700.
- name: NGINX Plus | Copying NGINX Plus repository certificate
copy: src=/etc/ssl/nginx/nginx-repo.crt dest=/etc/ssl/nginx/nginx-repo.crt owner=root group=root mode=0700
- name: NGINX Plus | Copying NGINX Plus repository key
copy: src=/etc/ssl/nginx/nginx-repo.key dest=/etc/ssl/nginx/nginx-repo.key owner=root group=root mode=0700
Next we tell Ansible to use the [get_url][26] module to download the CA certificate from the NGINX Plus repository at the remote location specified by the url argument, put it in the directory specified by the dest argument, and set the mode to 0700.
- name: NGINX Plus | Downloading NGINX Plus CA certificate
get_url: url=https://cs.nginx.com/static/files/CA.crt dest=/etc/ssl/nginx/CA.crt mode=0700
Similarly, we tell Ansible to download the NGINX Plus repo file using the get_url module and copy it to the **/etc/yum.repos.d** directory on the NGINX Plus server.
- name: NGINX Plus | Downloading yum NGINX Plus repository
get_url: url=https://cs.nginx.com/static/files/nginx-plus-7.repo dest=/etc/yum.repos.d/nginx-plus-7.repo mode=0700
The final two name sections tell Ansible to install and start NGINX Plus using the yum and service modules.
- name: NGINX Plus | Installing NGINX Plus
yum:
name: nginx-plus
state: latest
- name: NGINX Plus | Starting NGINX Plus
service:
name: nginx
state: started
#### Running Ansible to Deploy NGINX Plus ####
After saving the **install_nginx_plus.yml** file, we run the ansible-playbook command to deploy NGINX Plus. Again here we include the --ask-pass flag to have Ansible prompt for the SSH password and pass it to each NGINX Plus server, and specify the path to the main Ansible **deploy.yml** file.
$ sudo ansible-playbook --ask-pass $HOME/ansible-nginx-plus/deploy.yml
PLAY [nginx] ******************************************************************
GATHERING FACTS ***************************************************************
ok: [172.16.239.140]
TASK: [NGINX Plus | Creating NGINX Plus ssl cert repo directory] **************
changed: [172.16.239.140]
TASK: [NGINX Plus | Copying NGINX Plus repository certificate] ****************
changed: [172.16.239.140]
TASK: [NGINX Plus | Copying NGINX Plus repository key] ************************
changed: [172.16.239.140]
TASK: [NGINX Plus | Downloading NGINX Plus CA certificate] ********************
changed: [172.16.239.140]
TASK: [NGINX Plus | Downloading yum NGINX Plus repository] ********************
changed: [172.16.239.140]
TASK: [NGINX Plus | Installing NGINX Plus] ************************************
changed: [172.16.239.140]
TASK: [NGINX Plus | Starting NGINX Plus] **************************************
changed: [172.16.239.140]
PLAY RECAP ********************************************************************
172.16.239.140 : ok=8 changed=7 unreachable=0 failed=0
The playbook recap was successful. Now we can run a quick curl command to verify that NGINX Plus is running. Great, we get 200 OK! Success! We have successfully installed NGINX Plus with Ansible.
$ curl -Is http://172.16.239.140 | grep HTTP
HTTP/1.1 200 OK
### Creating an Ansible Playbook for Installing NGINX and NGINX Plus on Ubuntu ###
The process for deploying NGINX and NGINX Plus on [Ubuntu servers][27] is pretty similar to the process on CentOS, so instead of providing step-by-step instructions I’ll show the complete deployment files and and point out the slight differences from CentOS.
First create the Ansible directory structure and the main Ansible deployment file, as for CentOS. Also create the **/etc/ansible/hosts** file as described in [Creating the List of NGINX Servers][28]. For NGINX Plus, you need to copy over the key and certificate as described in [Copying the NGINX Plus Certificate and Key to the Ansible Server][29].
Here’s the **install_nginx.yml** deployment file for open source NGINX. In the first section, we use the [apt_key][30] module to import the NGINX signing key. The next two sections use the [lineinfile][31] module to add the package URLs for Ubuntu 14.04 to the **sources.list** file. Lastly we use the [apt][32] module to update the cache and install NGINX (apt replaces the yum module we used for deploying to CentOS).
# ./ansible-nginx/tasks/install_nginx.yml
- name: NGINX | Adding NGINX signing key
apt_key: url=http://nginx.org/keys/nginx_signing.key state=present
- name: NGINX | Adding sources.list deb url for NGINX
lineinfile: dest=/etc/apt/sources.list line="deb http://nginx.org/packages/mainline/ubuntu/ trusty nginx"
- name: NGINX Plus | Adding sources.list deb-src url for NGINX
lineinfile: dest=/etc/apt/sources.list line="deb-src http://nginx.org/packages/mainline/ubuntu/ trusty nginx"
- name: NGINX | Updating apt cache
apt:
update_cache: yes
- name: NGINX | Installing NGINX
apt:
pkg: nginx
state: latest
- name: NGINX | Starting NGINX
service:
name: nginx
state: started
Here’s the **install_nginx.yml** deployment file for NGINX Plus. The first four sections set up the NGINX Plus key and certificate. Then we use the apt_key module to import the signing key as for open source NGINX, and the get_url module to download the apt configuration file for NGINX Plus. The [shell][33] module evokes a printf command that writes its output to the **nginx-plus.list** file in the **sources.list.d** directory. The final name modules are the same as for open source NGINX.
# ./ansible-nginx-plus/tasks/install_nginx_plus.yml
- name: NGINX Plus | Creating NGINX Plus ssl cert repo directory
file: path=/etc/ssl/nginx state=directory group=root mode=0700
- name: NGINX Plus | Copying NGINX Plus repository certificate
copy: src=/etc/ssl/nginx/nginx-repo.crt dest=/etc/ssl/nginx/nginx-repo.crt owner=root group=root mode=0700
- name: NGINX Plus | Copying NGINX Plus repository key
copy: src=/etc/ssl/nginx/nginx-repo.key dest=/etc/ssl/nginx/nginx-repo.key owner=root group=root mode=0700
- name: NGINX Plus | Downloading NGINX Plus CA certificate
get_url: url=https://cs.nginx.com/static/files/CA.crt dest=/etc/ssl/nginx/CA.crt mode=0700
- name: NGINX Plus | Adding NGINX Plus signing key
apt_key: url=http://nginx.org/keys/nginx_signing.key state=present
- name: NGINX Plus | Downloading Apt-Get NGINX Plus repository
get_url: url=https://cs.nginx.com/static/files/90nginx dest=/etc/apt/apt.conf.d/90nginx mode=0700
- name: NGINX Plus | Adding sources.list url for NGINX Plus
shell: printf "deb https://plus-pkgs.nginx.com/ubuntu `lsb_release -cs` nginx-plus\n" >/etc/apt/sources.list.d/nginx-plus.list
- name: NGINX Plus | Running apt-get update
apt:
update_cache: yes
- name: NGINX Plus | Installing NGINX Plus via apt-get
apt:
pkg: nginx-plus
state: latest
- name: NGINX Plus | Start NGINX Plus
service:
name: nginx
state: started
We’re now ready to run the ansible-playbook command:
$ sudo ansible-playbook --ask-pass $HOME/ansible-nginx-plus/deploy.yml
You should get a successful play recap. If you did not get a success, you can use the verbose flag to help troubleshoot your deployment as described in [Running Ansible to Deploy NGINX][34].
### Summary ###
What I demonstrated in this tutorial is just the beginning of what Ansible can do to help automate your NGINX or NGINX Plus deployment. There are many useful modules ranging from user account management to custom configuration templates. If you are interested in learning more about these, please visit the extensive [Ansible documentation][35 site.
To learn more about Ansible, come hear my talk on deploying NGINX Plus with Ansible at [NGINX.conf 2015][36], September 22–24 in San Francisco.
--------------------------------------------------------------------------------
via: https://www.nginx.com/blog/installing-nginx-nginx-plus-ansible/
作者：[Kevin Jones][a]
译者：[struggling](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:https://www.nginx.com/blog/author/kjones/
[1]:http://www.ansible.com/
[2]:http://www.paramiko.org/
[3]:http://www.openssh.com/
[4]:http://nginx.org/en/
[5]:https://www.nginx.com/products/
[6]:http://www.centos.org/
[7]:https://www.nginx.com/blog/installing-nginx-nginx-plus-ansible/#ubuntu
[8]:http://docs.ansible.com/ansible/intro_installation.html#installing-the-control-machine
[9]:https://www.nginx.com/blog/installing-nginx-nginx-plus-ansible/#deploy-nginx
[10]:http://docs.ansible.com/ansible/playbooks_roles.html#task-include-files-and-encouraging-reuse
[11]:https://www.nginx.com/blog/installing-nginx-nginx-plus-ansible/#list-nginx
[12]:http://docs.ansible.com/ansible/YAMLSyntax.html
[13]:http://docs.ansible.com/ansible/yum_module.html
[14]:http://docs.ansible.com/ansible/service_module.html
[15]:http://nginx.org/en/linux_packages.html
[16]:http://wiki.centos.org/HowTos/Network/SecuringSSH
[17]:http://curl.haxx.se/
[18]:https://cs.nginx.com/
[19]:https://www.nginx.com/#free-trial
[20]:http://linux.die.net/man/1/scp
[21]:https://winscp.net/eng/download.php
[22]:https://www.nginx.com/blog/installing-nginx-nginx-plus-ansible/#playbook-nginx
[23]:https://www.nginx.com/blog/installing-nginx-nginx-plus-ansible/#list-nginx
[24]:http://docs.ansible.com/ansible/file_module.html
[25]:http://docs.ansible.com/ansible/copy_module.html
[26]:http://docs.ansible.com/ansible/get_url_module.html
[27]:http://www.ubuntu.com/
[28]:https://www.nginx.com/blog/installing-nginx-nginx-plus-ansible/#list-nginx
[29]:https://www.nginx.com/blog/installing-nginx-nginx-plus-ansible/#copy-cert-key
[30]:http://docs.ansible.com/ansible/apt_key_module.html
[31]:http://docs.ansible.com/ansible/lineinfile_module.html
[32]:http://docs.ansible.com/ansible/apt_module.html
[33]:http://docs.ansible.com/ansible/shell_module.html
[34]:https://www.nginx.com/blog/installing-nginx-nginx-plus-ansible/#deploy-nginx
[35]:http://docs.ansible.com/
[36]:https://www.nginx.com/nginxconf/

63
sources/tech/20150906 Make Math Simple in Ubuntu or Elementary OS via NaSC.md Normal file
View File

@@ -0,0 +1,63 @@
ictlyh Translating
Make Math Simple in Ubuntu / Elementary OS via NaSC
================================================================================
![](http://ubuntuhandbook.org/wp-content/uploads/2015/09/nasc-icon.png)
NaSC (Not a Soulver Clone) is an open source software designed for Elementary OS to do arithmetics. It’s kinda similar to the Mac app [Soulver][1].
> Its an app where you do maths like a normal person. It lets you type whatever you want and smartly figures out what is math and spits out an answer on the right pane. Then you can plug those answers in to future equations and if that answer changes, so does the equations its used in.
With NaSC you can for example:
- Perform calculations with strangers you can define yourself
- Change the units and values ​​(in m cm, dollar euro …)
- Knowing the surface area of ​​a planet
- Solve of second-degree polynomial
- and more …
![nasc-eos](http://ubuntuhandbook.org/wp-content/uploads/2015/09/nasc-eos.jpg)
At the first launch, NaSC offers a tutorial that details possible features. You can later click the help icon on headerbar to get more.
![nasc-help](http://ubuntuhandbook.org/wp-content/uploads/2015/09/nasc-help.jpg)
In addition, the software allows to save your file in order to continue the work. It can be also shared on Pastebin with a defined time.
### Install NaSC in Ubuntu / Elementary OS Freya: ###
For Ubuntu 15.04, Ubuntu 15.10, Elementary OS Freya, open terminal from the Dash, App Launcher and run below commands one by one:
1. Add the [NaSC PPA][2] via command:
sudo apt-add-repository ppa:nasc-team/daily
![nasc-ppa](http://ubuntuhandbook.org/wp-content/uploads/2015/09/nasc-ppa.jpg)
2. If you’ve installed Synaptic Package Manager, search for and install `nasc` via it after clicking Reload button.
Or run below commands to update system cache and install the software:
sudo apt-get update
sudo apt-get install nasc
3. **(Optional)** To remove the software as well as NaSC, run:
sudo apt-get remove nasc && sudo add-apt-repository -r ppa:nasc-team/daily
For those who don’t want to add PPA, grab the .deb package directly from [this page][3].
--------------------------------------------------------------------------------
via: http://ubuntuhandbook.org/index.php/2015/09/make-math-simple-in-ubuntu-elementary-os-via-nasc/
作者：[Ji m][a]
译者：[译者ID](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:http://ubuntuhandbook.org/index.php/about/
[1]:http://www.acqualia.com/soulver/
[2]:https://launchpad.net/~nasc-team/+archive/ubuntu/daily/
[3]:http://ppa.launchpad.net/nasc-team/daily/ubuntu/pool/main/n/nasc/

193
sources/tech/RHCSA Series/RHCSA Series--Part 11--Firewall Essentials and Network Traffic Control Using FirewallD and Iptables.md
View File

@@ -1,193 +0,0 @@
FSSlc Translating
RHCSA Series: Firewall Essentials and Network Traffic Control Using FirewallD and Iptables – Part 11
================================================================================
In simple words, a firewall is a security system that controls the incoming and outgoing traffic in a network based on a set of predefined rules (such as the packet destination / source or type of traffic, for example).
![Control Network Traffic with FirewallD and Iptables](http://www.tecmint.com/wp-content/uploads/2015/05/Control-Network-Traffic-Using-Firewall.png)
RHCSA: Control Network Traffic with FirewallD and Iptables – Part 11
In this article we will review the basics of firewalld, the default dynamic firewall daemon in Red Hat Enterprise Linux 7, and iptables service, the legacy firewall service for Linux, with which most system and network administrators are well acquainted, and which is also available in RHEL 7.
### A Comparison Between FirewallD and Iptables ###
Under the hood, both firewalld and the iptables service talk to the netfilter framework in the kernel through the same interface, not surprisingly, the iptables command. However, as opposed to the iptables service, firewalld can change the settings during normal system operation without existing connections being lost.
Firewalld should be installed by default in your RHEL system, though it may not be running. You can verify with the following commands (firewall-config is the user interface configuration tool):
# yum info firewalld firewall-config
![Check FirewallD Information](http://www.tecmint.com/wp-content/uploads/2015/05/Check-FirewallD-Information.png)
Check FirewallD Information
and,
# systemctl status -l firewalld.service
![Check FirewallD Status](http://www.tecmint.com/wp-content/uploads/2015/05/Check-FirewallD-Status.png)
Check FirewallD Status
On the other hand, the iptables service is not included by default, but can be installed through.
# yum update && yum install iptables-services
Both daemons can be started and enabled to start on boot with the usual systemd commands:
# systemctl start firewalld.service | iptables-service.service
# systemctl enable firewalld.service | iptables-service.service
Read Also: [Useful Commands to Manage Systemd Services][1]
As for the configuration files, the iptables service uses `/etc/sysconfig/iptables` (which will not exist if the package is not installed in your system). On a RHEL 7 box used as a cluster node, this file looks as follows:
![Iptables Firewall Configuration](http://www.tecmint.com/wp-content/uploads/2015/05/Iptables-Rules.png)
Iptables Firewall Configuration
Whereas firewalld store its configuration across two directories, `/usr/lib/firewalld` and `/etc/firewalld`:
# ls /usr/lib/firewalld /etc/firewalld
![FirewallD Configuration](http://www.tecmint.com/wp-content/uploads/2015/05/Firewalld-configuration.png)
FirewallD Configuration
We will examine these configuration files further later in this article, after we add a few rules here and there. By now it will suffice to remind you that you can always find more information about both tools with.
# man firewalld.conf
# man firewall-cmd
# man iptables
Other than that, remember to take a look at [Reviewing Essential Commands & System Documentation – Part 1][2] of the current series, where I described several sources where you can get information about the packages installed on your RHEL 7 system.
### Using Iptables to Control Network Traffic ###
You may want to refer to [Configure Iptables Firewall – Part 8][3] of the Linux Foundation Certified Engineer (LFCE) series to refresh your memory about iptables internals before proceeding further. Thus, we will be able to jump in right into the examples.
**Example 1: Allowing both incoming and outgoing web traffic**
TCP ports 80 and 443 are the default ports used by the Apache web server to handle normal (HTTP) and secure (HTTPS) web traffic. You can allow incoming and outgoing web traffic through both ports on the enp0s3 interface as follows:
# iptables -A INPUT -i enp0s3 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
# iptables -A OUTPUT -o enp0s3 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
# iptables -A INPUT -i enp0s3 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
# iptables -A OUTPUT -o enp0s3 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
**Example 2: Block all (or some) incoming connections from a specific network**
There may be times when you need to block all (or some) type of traffic originating from a specific network, say 192.168.1.0/24 for example:
# iptables -I INPUT -s 192.168.1.0/24 -j DROP
will drop all packages coming from the 192.168.1.0/24 network, whereas,
# iptables -A INPUT -s 192.168.1.0/24 --dport 22 -j ACCEPT
will only allow incoming traffic through port 22.
**Example 3: Redirect incoming traffic to another destination**
If you use your RHEL 7 box not only as a software firewall, but also as the actual hardware-based one, so that it sits between two distinct networks, IP forwarding must have been already enabled in your system. If not, you need to edit `/etc/sysctl.conf` and set the value of net.ipv4.ip_forward to 1, as follows:
net.ipv4.ip_forward = 1
then save the change, close your text editor and finally run the following command to apply the change:
# sysctl -p /etc/sysctl.conf
For example, you may have a printer installed at an internal box with IP 192.168.0.10, with the CUPS service listening on port 631 (both on the print server and on your firewall). In order to forward print requests from clients on the other side of the firewall, you should add the following iptables rule:
# iptables -t nat -A PREROUTING -i enp0s3 -p tcp --dport 631 -j DNAT --to 192.168.0.10:631
Please keep in mind that iptables reads its rules sequentially, so make sure the default policies or later rules do not override those outlined in the examples above.
### Getting Started with FirewallD ###
One of the changes introduced with firewalld are zones. This concept allows to separate networks into different zones level of trust the user has decided to place on the devices and traffic within that network.
To list the active zones:
# firewall-cmd --get-active-zones
In the example below, the public zone is active, and the enp0s3 interface has been assigned to it automatically. To view all the information about a particular zone:
# firewall-cmd --zone=public --list-all
![List all FirewallD Zones](http://www.tecmint.com/wp-content/uploads/2015/05/View-FirewallD-Zones.png)
List all FirewallD Zones
Since you can read more about zones in the [RHEL 7 Security guide][4], we will only list some specific examples here.
**Example 4: Allowing services through the firewall**
To get a list of the supported services, use.
# firewall-cmd --get-services
![List All Supported Services](http://www.tecmint.com/wp-content/uploads/2015/05/List-All-Supported-Services.png)
List All Supported Services
To allow http and https web traffic through the firewall, effective immediately and on subsequent boots:
# firewall-cmd --zone=MyZone --add-service=http
# firewall-cmd --zone=MyZone --permanent --add-service=http
# firewall-cmd --zone=MyZone --add-service=https
# firewall-cmd --zone=MyZone --permanent --add-service=https
# firewall-cmd --reload
If code>–zone is omitted, the default zone (you can check with firewall-cmd –get-default-zone) is used.
To remove the rule, replace the word add with remove in the above commands.
**Example 5: IP / Port forwarding**
First off, you need to find out if masquerading is enabled for the desired zone:
# firewall-cmd --zone=MyZone --query-masquerade
In the image below, we can see that masquerading is enabled for the external zone, but not for public:
![Check Masquerading Status in Firewalld](http://www.tecmint.com/wp-content/uploads/2015/05/Check-masquerading.png)
Check Masquerading Status
You can either enable masquerading for public:
# firewall-cmd --zone=public --add-masquerade
or use masquerading in external. Here’s what we would do to replicate Example 3 with firewalld:
# firewall-cmd --zone=external --add-forward-port=port=631:proto=tcp:toport=631:toaddr=192.168.0.10
And don’t forget to reload the firewall.
You can find further examples on [Part 9][5] of the RHCSA series, where we explained how to allow or disable the ports that are usually used by a web server and a ftp server, and how to change the corresponding rule when the default port for those services are changed. In addition, you may want to refer to the firewalld wiki for further examples.
Read Also: [Useful FirewallD Examples to Configure Firewall in RHEL 7][6]
### Conclusion ###
In this article we have explained what a firewall is, what are the available services to implement one in RHEL 7, and provided a few examples that can help you get started with this task. If you have any comments, suggestions, or questions, feel free to let us know using the form below. Thank you in advance!
--------------------------------------------------------------------------------
via: http://www.tecmint.com/firewalld-vs-iptables-and-control-network-traffic-in-firewall/
作者：[Gabriel Cánepa][a]
译者：[译者ID](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:http://www.tecmint.com/author/gacanepa/
[1]:http://www.tecmint.com/manage-services-using-systemd-and-systemctl-in-linux/
[2]:http://www.tecmint.com/rhcsa-exam-reviewing-essential-commands-system-documentation/
[3]:http://www.tecmint.com/configure-iptables-firewall/
[4]:https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Firewalls.html
[5]:http://www.tecmint.com/rhcsa-series-install-and-secure-apache-web-server-and-ftp-in-rhel/
[6]:http://www.tecmint.com/firewalld-rules-for-centos-7/

4
sources/tech/RHCSA Series/RHCSA Series--Part 12--Automate RHEL 7 Installations Using 'Kickstart'.md
View File

@@ -1,3 +1,5 @@
FSSlc translating
RHCSA Series: Automate RHEL 7 Installations Using ‘Kickstart’ – Part 12
================================================================================
Linux servers are rarely standalone boxes. Whether it is in a datacenter or in a lab environment, chances are that you have had to install several machines that will interact one with another in some way. If you multiply the time that it takes to install Red Hat Enterprise Linux 7 manually on a single server by the number of boxes that you need to set up, this can lead to a rather lengthy effort that can be avoided through the use of an unattended installation tool known as kickstart.
@@ -139,4 +141,4 @@ via: http://www.tecmint.com/automatic-rhel-installations-using-kickstart/
[a]:http://www.tecmint.com/author/gacanepa/
[1]:https://access.redhat.com/labs/kickstartconfig/
[2]:http://www.tecmint.com/multiple-centos-installations-using-kickstart/
[2]:http://www.tecmint.com/multiple-centos-installations-using-kickstart/

60
translated/share/20150906 FISH--A smart and user-friendly command line shell for Linux.md Normal file
View File

@@ -0,0 +1,60 @@
FISH - Linux 的一个智能、易用的SHELL
================================================================================
FISH：友好的交互式shell。 fish 是一个用户友好的命令行shell，主要是用来进行交互式使用。shell 就是一个用来执行其他程序的程序。
### FISH 特性 ###
#### 自动建议 ####
fish 会根据你的历史输入和已经完成的命令来提供建议，方便输入，就像一个网络浏览器一样。注意了，就是Netscape Navigator 4.0!
#### 漂亮的VGA 色彩 ####
fish 原生支持term256， 它就是一个终端技术的艺术国度。 你将可以拥有一个难以置信的、256 色的shell 来使用。
#### 理智的脚本 ####
fish 是完全可以通过脚本控制的，而且它的语法又是那么的简单、干净，而且一致。你甚至不需要去重写。
#### 基于web 的配置 ####
对于少数能使用图形计算机的幸运儿， 你们可以在网页上配置你们自己的色彩方案，以及查看函数、变量和历史记录。
#### 帮助手册补全 ####
其它的shell 支持可配置的补全， 但是只有fish 可以通过自动转换你安装好的man 手册来实现补全功能。
#### 开箱即用 ####
fish 将会通过tab 补全和语法高亮是你非常愉快的使用shell， 同时不需要太多的学习或者配置。
### 在ubuntu 15.04 上安装FISH
打开终端，运行下列命令：
sudo apt-add-repository ppa:fish-shell/release-2
sudo apt-get update
sudo apt-get install fish
**使用FISH**
打开终端，运行下列命令来启动FISH：
fish
欢迎来到fish， 友好的交互式shell，输入指令help 来了解怎么使用fish。
阅读[FISH 文档][1] ，掌握使用方法。
--------------------------------------------------------------------------------
via: http://www.ubuntugeek.com/fish-a-smart-and-user-friendly-command-line-shell-for-linux.html
作者：[ruchi][a]
译者：[译者ID](https://github.com/oska874)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:http://www.ubuntugeek.com/author/ubuntufix
[1]:http://fishshell.com/docs/current/index.html#introduction

193
translated/tech/RHCSA/RHCSA Series--Part 11--Firewall Essentials and Network Traffic Control Using FirewallD and Iptables.md Normal file
View File

@@ -0,0 +1,193 @@
RHCSA 系列： 防火墙简要和使用 FirewallD 和 Iptables 来控制网络流量 – Part 11
================================================================================
简单来说，防火墙就是一个基于一系列预先定义的规则(例如流量包的目的地或来源，流量的类型等)的安全系统，它控制着一个网络中的流入和流出流量。
![使用 FirewallD 和 Iptables 来控制网络流量](http://www.tecmint.com/wp-content/uploads/2015/05/Control-Network-Traffic-Using-Firewall.png)
RHCSA: 使用 FirewallD 和 Iptables 来控制网络流量 – Part 11
在本文中，我们将回顾 firewalld 和 iptables 的基础知识。前者是 RHEL 7 中的默认动态防火墙守护进程，而后者则是针对 Linux 的传统的防火墙服务，大多数的系统和网络管理员都非常熟悉它，并且在 RHEL 7 中也可以获取到。
### FirewallD 和 Iptables 的一个比较 ###
在后台， firewalld 和 iptables 服务都通过相同的接口来与内核中的 netfilter 框架相交流，这不足为奇，即它们都通过 iptables 命令来与 netfilter 交互。然而，与 iptables 服务相反， firewalld 可以在不丢失现有连接的情况下，在正常的系统操作期间更改设定。
在默认情况下， firewalld 应该已经安装在你的 RHEL 系统中了，尽管它可能没有在运行。你可以使用下面的命令来确认(firewall-config 是用户界面配置工具)：
# yum info firewalld firewall-config
![检查 FirewallD 的信息](http://www.tecmint.com/wp-content/uploads/2015/05/Check-FirewallD-Information.png)
检查 FirewallD 的信息
以及，
# systemctl status -l firewalld.service
![检查 FirewallD 的状态](http://www.tecmint.com/wp-content/uploads/2015/05/Check-FirewallD-Status.png)
检查 FirewallD 的状态
另一方面， iptables 服务在默认情况下没有被包含在 RHEL 系统中，但可以被安装上。
# yum update && yum install iptables-services
这两个守护进程都可以使用常规的 systemd 命令来在开机时被启动和开启：
# systemctl start firewalld.service | iptables-service.service
# systemctl enable firewalld.service | iptables-service.service
另外，请阅读：[管理 Systemd 服务的实用命令][1] (注: 本文已被翻译发表，在 https://linux.cn/article-5926-1.html)
至于配置文件， iptables 服务使用 `/etc/sysconfig/iptables` 文件(假如这个软件包在你的系统中没有被安装，则这个文件将不存在)。在一个被用作集群节点的 RHEL 7 机子上，这个文件长得像这样：
![Iptables 防火墙配置文件](http://www.tecmint.com/wp-content/uploads/2015/05/Iptables-Rules.png)
Iptables 防火墙配置文件
而 firewalld 则在两个目录中存储它的配置文件，即 `/usr/lib/firewalld` 和 `/etc/firewalld`：
# ls /usr/lib/firewalld /etc/firewalld
![FirewallD 的配置文件](http://www.tecmint.com/wp-content/uploads/2015/05/Firewalld-configuration.png)
FirewallD 的配置文件
在这篇文章中后面，我们将进一步查看这些配置文件，在那之后，我们将在各处添加一些规则。
现在，是时候提醒你了，你总可以使用下面的命令来找到更多有关这两个工具的信息。
# man firewalld.conf
# man firewall-cmd
# man iptables
除了这些，记得查看一下当前系列的第一篇 [RHCSA 系列（一）: 回顾基础命令及系统文档][2](注: 本文已被翻译发表，在 https://linux.cn/article-6133-1.html )，在其中我描述了几种渠道来得到安装在你的 RHEL 7 系统上的软件包的信息。
### 使用 Iptables 来控制网络流量 ###
在进一步深入之前，或许你需要参考 Linux 基金会认证工程师(Linux Foundation Certified Engineer,LFCE) 系列中的 [配置 Iptables 防火墙 – Part 8][3] 来复习你脑中有关 iptables 的知识。
**例 1：同时允许流入和流出的网络流量**
TCP 端口 80 和 443 是 Apache web 服务器使用的用来处理常规(HTTP) 和安全(HTTPS)网络流量的默认端口。你可以像下面这样在 enp0s3 接口上允许流入和流出网络流量通过这两个端口：
# iptables -A INPUT -i enp0s3 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
# iptables -A OUTPUT -o enp0s3 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
# iptables -A INPUT -i enp0s3 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
# iptables -A OUTPUT -o enp0s3 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
**例 2：从某个特定网络中阻挡所有(或某些)流入连接**
或许有时你需要阻挡来自于某个特定网络的所有(或某些)类型的来源流量，比方说 192.168.1.0/24：
# iptables -I INPUT -s 192.168.1.0/24 -j DROP
上面的命令将丢掉所有来自 192.168.1.0/24 网络的网络包，而
# iptables -A INPUT -s 192.168.1.0/24 --dport 22 -j ACCEPT
将只允许通过端口 22 的流入流量。
**例 3：将流入流量重定向到另一个目的地**
假如你不仅使用你的 RHEL 7 机子来作为一个软件防火墙，而且还将它作为一个硬件防火墙，使得它位于两个不同的网络之间，则在你的系统 IP 转发一定已经被开启了。假如没有开启，你需要编辑 `/etc/sysctl.conf` 文件并将 `net.ipv4.ip_forward` 的值设为 1，即：
net.ipv4.ip_forward = 1
接着保存更改，关闭你的文本编辑器，并最终运行下面的命令来应用更改：
# sysctl -p /etc/sysctl.conf
例如，你可能在一个内部的机子上安装了一个打印机，它的 IP 地址为 192.168.0.10，CUPS 服务在端口 631 上进行监听(同时在你的打印服务器和你的防火墙上)。为了从防火墙另一边的客户端传递打印请求，你应该添加下面的 iptables 规则：
# iptables -t nat -A PREROUTING -i enp0s3 -p tcp --dport 631 -j DNAT --to 192.168.0.10:631
请记住 iptables 逐条地读取它的规则，所以请确保默认的策略或后面的规则不会重载上面例子中那些有下划线的规则。
### FirewallD 入门 ###
引入 firewalld 的一个改变是区域(zone) (注：翻译参考了 https://fedoraproject.org/wiki/FirewallD/zh-cn) 的概念。它允许将网路划分为拥有不同信任级别的区域，由用户决定将设备和流量放置到哪个区域。
要获取活动的区域，使用：
# firewall-cmd --get-active-zones
在下面的例子中，公用区域被激活了，并且 enp0s3 接口被自动地分配到了这个区域。要查看有关一个特定区域的所有信息，可使用：
# firewall-cmd --zone=public --list-all
![列出所有的 Firewalld 区域](http://www.tecmint.com/wp-content/uploads/2015/05/View-FirewallD-Zones.png)
列出所有的 Firewalld 区域
由于你可以在 [RHEL 7 安全指南][4] 中阅读到更多有关区域的知识，这里我们将仅列出一些特别的例子。
**例 4：允许服务通过防火墙**
要获取受支持的服务的列表，可以使用：
# firewall-cmd --get-services
![列出所有受支持的服务](http://www.tecmint.com/wp-content/uploads/2015/05/List-All-Supported-Services.png)
列出所有受支持的服务
要立刻且在随后的开机中使得 http 和 https 网络流量通过防火墙，可以这样：
# firewall-cmd --zone=MyZone --add-service=http
# firewall-cmd --zone=MyZone --permanent --add-service=http
# firewall-cmd --zone=MyZone --add-service=https
# firewall-cmd --zone=MyZone --permanent --add-service=https
# firewall-cmd --reload
假如 code>–zone 被忽略，则默认的区域(你可以使用 `firewall-cmd –get-default-zone`来查看)将会被使用。
若要移除这些规则，可以在上面的命令中将 `add` 替换为 `remove`。
**例 5：IP 转发或端口转发**
首先，你需要查看在目标区域中，伪装是否被开启：
# firewall-cmd --zone=MyZone --query-masquerade
在下面的图片中，我们可以看到对于外部区域，伪装已被开启，但对于公用区域则没有：
![在 firewalld 中查看伪装状态](http://www.tecmint.com/wp-content/uploads/2015/05/Check-masquerading.png)
查看伪装状态
你可以为公共区域开启伪装：
# firewall-cmd --zone=public --add-masquerade
或者在外部区域中使用伪装。下面是使用 firewalld 来重复例 3 中的任务所需的命令：
# firewall-cmd --zone=external --add-forward-port=port=631:proto=tcp:toport=631:toaddr=192.168.0.10
并且别忘了重新加载防火墙。
在 RHCSA 系列的 [Part 9][5] 你可以找到更深入的例子，在那篇文章中我们解释了如何允许或禁用通常被 web 服务器和 ftp 服务器使用的端口，以及在针对这两个服务所使用的默认端口被改变时，如何更改相应的规则。另外，你或许想参考 firewalld 的 wiki 来查看更深入的例子。
Read Also: [在 RHEL 7 中配置防火墙的几个实用的 firewalld 例子][6]
### 总结 ###
在这篇文章中，我们已经解释了防火墙是什么，介绍了在 RHEL 7 中用来实现防火墙的几个可用的服务，并提供了可以帮助你入门防火墙的几个例子。假如你有任何的评论，建议或问题，请随意使用下面的评论框来让我们知晓。这里就事先感谢了！
--------------------------------------------------------------------------------
via: http://www.tecmint.com/firewalld-vs-iptables-and-control-network-traffic-in-firewall/
作者：[Gabriel Cánepa][a]
译者：[FSSlc](https://github.com/FSSlc)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
[a]:http://www.tecmint.com/author/gacanepa/
[1]:http://www.tecmint.com/manage-services-using-systemd-and-systemctl-in-linux/
[2]:http://www.tecmint.com/rhcsa-exam-reviewing-essential-commands-system-documentation/
[3]:http://www.tecmint.com/configure-iptables-firewall/
[4]:https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Firewalls.html
[5]:http://www.tecmint.com/rhcsa-series-install-and-secure-apache-web-server-and-ftp-in-rhel/
[6]:http://www.tecmint.com/firewalld-rules-for-centos-7/