redirecting all HTTP requests to HTTPS by RedirectMatch

Apache’s Redirect directive may not help you if you are using multiple server-names if you want to redirect all HTTP requests to SSL. In this case you can use RedirectMatch directive which doesn’t have enough example on its documentation. By adding this line just below your ServerName definition in your httpd.conf, you may easily do redirection. Enjoy!

RedirectMatch “http://(.*)” “https://$1”

mod_rewrite is still a powerful alternative, so;

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

installing weblogic 12c plugins for apache 2.4.x with cluster configuration

Edit your hosts file;

[root@oracle-linux WLS-http-plugin]# more /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4 oracle-linux cluster.test.wls
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.122.189	cluster.test.wls

Install apache web server;

[root@oracle-linux ]# yum install httpd
[root@oracle-linux ]# httpd -v
Server version: Apache/2.4.6 (Red Hat)
Server built:   Jul 23 2014 04:34:53

Download Oracle WebLogic Web Server Plug-Ins 12c from Oracle website : http://www.oracle.com/technetwork/middleware/webtier/downloads/index-jsp-156711.html
Extract the downloaded archive and find (correct file according to your architecture) mod_wl_24.so and copy into /etc/httpd/modules/ folder.

Create weblogic config file for apache;

more /etc/httpd/conf.d/httpd-weblogic.conf
LoadModule weblogic_module /etc/httpd/modules/mod_wl_24.so

  WebLogicCluster cluster.test.wls:7003,cluster.test.wls:7005
  Debug ON
 # WLLogFile             /home/wls/httpd-logs/WL.log
 # WLTempDir             /tmp/
  DebugConfigInfo       On
  KeepAliveEnabled ON
  KeepAliveSecs  15



  SetHandler weblogic-handler
  WebLogicCluster cluster.test.wls:7001


#PlanExampleWeb is a cluster example application, which can be downloaded from Oracle website.

  SetHandler weblogic-handler
  WebLogicCluster cluster.test.wls:7003,cluster.test.wls:7005

Check your apache configuration with apachectl;

[root@oracle-linux ]# apachectl configtest
[Fri Oct 03 17:27:30.221327 2014] [weblogic:warn] [pid 2593] The Debug directive is ignored.  The web server log level is used instead.
Syntax OK

If everything is fine, start your httpd and connect to your weblogic console without port definition;

http://cluster.test.wls/console/login/LoginForm.jsp

Weblogic 12.1.3 silent mode installation

First of all update your linux distribution to latest version, and create user/group which is required for installation.

[root@oracle-linux ~]# yum update
[root@oracle-linux ~]# groupadd wls
[root@oracle-linux ~]# useradd -g wls wls
[root@oracle-linux ~]# passwd wls
[root@oracle-linux ~]# su - wls
-bash-4.2$ umask 027

Download Weblogic installation file from Oracle website : http://www.oracle.com/technetwork/middleware/weblogic/downloads/wls-main-097127.html
Download jdk from Oracle website : http://www.oracle.com/technetwork/java/javase/downloads/index.html

Prepare oraInst.loc;

-bash-4.2$ more /etc/oraInst.loc 
inventory_loc=/home/wls/oraInventory/
inst_group=wls

Prepare Response File;

-bash-4.2$ more response.file.rsp 
[ENGINE]
#DO NOT CHANGE THIS.
Response File Version=1.0.0.0.0
[GENERIC]
#The oracle home location. This can be an existing Oracle Home or a new Oracle Home
ORACLE_HOME=/home/wls/12.1.3.0
#Set this variable value to the Installation Type selected. e.g. WebLogic Server, Coherence, Complete with Examples.
INSTALL_TYPE=WebLogic Server
#Provide the My Oracle Support Username. If you wish to ignore Oracle Configuration Manager configuration provide empty string for user name.
MYORACLESUPPORT_USERNAME=
#Provide the My Oracle Support Password
MYORACLESUPPORT_PASSWORD=
#Set this to true if you wish to decline the security updates. Setting this to true and providing empty string for My Oracle Support username will ignore the Oracle Configuration Manager configuration
DECLINE_SECURITY_UPDATES=true
#Set this to true if My Oracle Support Password is specified
SECURITY_UPDATES_VIA_MYORACLESUPPORT=false
#Provide the Proxy Host
PROXY_HOST=
#Provide the Proxy Port
PROXY_PORT=
#Provide the Proxy Username
PROXY_USER=
#Provide the Proxy Password
PROXY_PWD=
#Type String (URL format) Indicates the OCM Repeater URL which should be of the format [scheme[Http/Https]]://[repeater host]:[repeater port]
COLLECTOR_SUPPORTHUB_URL=

Check wls user settings and edit .bash_profile;

-bash-4.2$ id
uid=1001(wls) gid=1001(wls) groups=1001(wls) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

-bash-4.2$ more .bash_profile 
export WL_HOME=/home/wls/12.1.3.0/wlserver/
export CONFIG_JVM_ARGS="-Djava.security.egd=file:/dev/./urandom"

Fix the file paths according to your system and Install Weblogic;

/usr/java/jdk1.8.0_20/bin/java -jar -d64 /home/wls/fmw_12.1.3.0.0_wls.jar -silent -invPtrLoc /etc/oraInst.loc -responseFile /home/wls/response.file.rsp

After successful installation create domain, following steps below using WLST;

-bash-4.2$ pwd
/home/wls/12.1.3.0/wlserver/common/bin
-bash-4.2$ ./commEnv.sh 
-bash-4.2$ ./wlst.sh 
Java HotSpot(TM) 64-Bit Server VM warning: ignoring option MaxPermSize=256m; support was removed in 8.0

Initializing WebLogic Scripting Tool (WLST) ...

Welcome to WebLogic Server Administration Scripting Shell

Type help() for help on available commands

wls:/offline> readTemplate('/home/wls/12.1.3.0/wlserver/common/templates/wls/wls.jar')
wls:/offline/base_domain>cd('Servers/AdminServer')
wls:/offline/base_domain/Server/AdminServer>set('ListenAddress','')
wls:/offline/base_domain/Server/AdminServer>set('ListenPort', 7001)
wls:/offline/base_domain/Server/AdminServer>create('AdminServer','SSL')
Proxy for AdminServer: Name=AdminServer, Type=SSL
wls:/offline/base_domain/Server/AdminServer>cd('SSL/AdminServer')
wls:/offline/base_domain/Server/AdminServer/SSL/AdminServer>set('Enabled', 'True')
wls:/offline/base_domain/Server/AdminServer/SSL/AdminServer>set('ListenPort', 7002)
wls:/offline/base_domain/Server/AdminServer/SSL/AdminServer>cd('/')
wls:/offline/base_domain>cd('Security/base_domain/User/weblogic')
wls:/offline/base_domain/Security/base_domain/User/weblogic>cmo.setPassword('weblogic1')
wls:/offline/base_domain/Security/base_domain/User/weblogic>setOption('OverwriteDomain', 'true')
wls:/offline/base_domain/Security/base_domain/User/weblogic>writeDomain('/home/wls/12.1.3.0/user_projects/domains/test')

closeTemplate()
exit()

After creating domain, you will have startup scripts ready. Run the scripts and follow the screen output;

 
cd ~/12.1.3.0/user_projects/domains/test/bin/
./startWebLogic.sh & 
./startNodeManager.sh &

Use your web browser to reach the admin console, after startup;
http://192.168.122.189:7001/console/

Enjoy!

my Solaris 11 notes/cheat sheet

Sorry for short explanations, maybe I will give more details later. Enjoy.

Image Packaging System:
pkg set-publisher -g http://pkg.openindiana.org/sfe sfe
pkg publisher
pkg update
pkg list
pkg history
pkg uninstall
pkg info | more

Boot environment:
beadm list
beadm activate bootEnvTest
beadm create BeName
beadm mount BeName mount-point
beadm destroy

Services:
svcadm
svcadm mark // place in maintenance state
svcadm clear // clear maintenance state
svcadm milestone // place in particular init level
svcs -a // list all services on the system
svcs -d ssh // list service dependencies
svcs -xv ssh // verbose information on service state
svcs -l ssh // displays properties of service

/var/svc/log // every service has different log file stored here

Init levels:
s,S : single user
1 : single admin user
2 : multi user without NFS svcs
3 : multi user with NFS svcs
6 : reboot
0 : shutdown

ZFS:
zpool list
zpool status
zpool history
zpool create testpool /zfstest/test1 /zfstest/test2 /zfstest/test3
zpool destroy
zpool mount

networking:
ipadm
netadm
dladm // data link availability

System Processes and Tasks:
pkg info | more // shows installed packages
prtconf -v|more //configuration information
hostname //shows host name
hostid //shows host id
services -a // shows running services
pargs PID // shows arguments of process
pgrep ApplicationName // Gives PIDs of applications running
iostat -x // IO/disk information
vmstat // virtual memory information
savecore // retrieves dumped data files like vmdump.n in savecore directory
/usr/bin/mdb //lists crash dump files
dumpadm // view/configure crash dump params
coreadm // manages core dump files

openotp RSA server certificate does NOT match server name hatası

[Thu Sep 19 13:33:14 2013] RSA server certificate CommonName (CN) `OPENOTP.cemdogan.com' does NOT match server name!?
[Thu Sep 19 13:33:14 2013] RSA server certificate CommonName (CN) `OPENOTP.cemdogan.com' does NOT match server name!?

OpenOTP uygulaması soapd.log dosyasında benzer bir hata alındığında yapılması gereken kullanılan sertifikada geçen bilgisayar ismi ile bilgisayarın gerçek isminin aynı yapılması gerekir.

-bash-3.2# vi /etc/sysconfig/network

#HOSTNAME=rcvm
HOSTNAME=OPENOTP.cemdogan.com

Yukardaki gibi değişiklik yapılıp makine yeniden başladığında sorun giderilmiş olur.
Kontrol için;

-bash-3.2# hostname
OPENOTP.cemdogan.com

squid sarg raporlarında ip yerine netbios ismi kullanmak için

Bazı durumlarda squid veya sarg IP’den bilgisayar ismini çözümleyemeyebilir ve sarg raporları IP adresleri ile oluşturulacağından karışıklık oluşur.
Sorunu gidermek için, nbtscan kullanarak WORKGROUP içinde makine adını çözümleyebiliriz.

#!/bin/bash
# 10-08-2013 Cem DOGAN
#
for i in `cat /var/log/squid/access.log|awk '{print $3}'|grep -o '[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}' |sort|uniq`
do
        echo "+++"$i"+++"
        if grep -q $i /root/sarg.ip
        then
        zatenvar=`grep $i /root/sarg.ip`
        echo $zatenvar" dosyada zaten bulunuyor"
        else
        name=`/usr/sbin/nbtscan $i |grep $i |grep -v NBT|awk '{print $2}'`
                if [ $name ]
                        then
                        echo $i":"$name>> /root/sarg.ip.tmp
                        #sort /root/sarg.ip.tmp|uniq > /root/sarg.ip
                        echo $i,$name "eklendi"
                        else
                        dhcpden=`cat /var/lib/dhcpd/dhcpd.leases |grep -A 10 $i| grep hostname| awk -F " '{print $2}'|sort|uniq`
                                if [ $dhcpden ]
                                then
                                #       echo $i":"$dhcpden>> /root/sarg.ip.tmp
                                        echo $i":"$dhcpden|tr "[:lower:]" "[:upper:]">> /root/sarg.ip.tmp

                                        echo $i":"$dhcpden
                                fi
                fi
        fi
done
sort /root/sarg.ip.tmp|uniq > /root/sarg.ip

Gün içinde topladığımız ip ve bilgisayar isimlerini sed kullanarak başka bir dosyada düzenlenmiş şekilde hazırlıyoruz.

#!/bin/bash
# 10-08-2013 Cem DOGAN
#
INPUT=/root/sarg.ip
OLDIFS=$IFS
IFS=:
[ ! -f $INPUT ] && { echo "$INPUT file not found"; exit 99; }
while read ip name
do
        params+="s/$ip/$name/g;"
done < $INPUT
IFS=$OLDIFS

params=`echo $params| sed 's/;$//'`
sed  -e "$params" /var/log/squid/access.log > /var/log/squid/access.log.sarg

Artık sarg ayarlarımızı yeni oluşturduğumuz dosyadan okuyacak şekilde yapabiliriz.

dhcpd ile lease time’ı uzun tutmak ve günlük olarak oluşturulan ip tablosunu temizlemek de gerekebilir. Gerisi size kalmış.

squid için tek eth ile kullanılabilecek iptables kuralları

squid in 3169 portundan çalıştığını düşünürsek aşağıdaki kurallar bütünü işimizi görecektir.

#!/bin/sh
# squid server IP
SQUID_SERVER=`ifconfig eth0 | sed -ne 's/.*inet addr:([^ ]*).*/1/p'`
# Interface connected to Internet
INTERNET="eth0"
# Interface connected to LAN
LAN_IN="eth0"
# Squid port
SQUID_PORT="3128"
# DO NOT MODIFY BELOW
# Clean old firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Load IPTABLES modules for NAT and IP conntrack support
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# For win xp ftp client
#modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT
# set this system as a router for Rest of LAN
iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE
iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT
# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT
#iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 443 -j DNAT --to $SQUID_SERVER:3130

# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT
#iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 3130
# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

iptables -A OUTPUT -i $INTERNET -p tcp -m multiport --dports 21,22,110,25,143,587,3169 -m state --state NEW -j ACCEPT
iptables -A INPUT -i $INTERNET -p tcp -m multiport --dports 21,22,110,25,143,587,3169 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

yum ile otomatik güncelleme

Yum ile otomatik güncelleme yapmak için yum-cron uygulamasını yüklemeliyiz.

yum install yum-cron

Sadece kontrol etme, sadece uyarma veya sadece indirme gibi seçenekleri ayarlamak için aşağıdaki dosyayı düzenliyoruz.

vi /etc/sysconfig/yum-cron

Aktif hale getirmek için;

/etc/init.d/yum-cron start
chkconfig yum-cron on

Güncellemek istemediğiniz paketler varsa, yum-cron config dosyasında belirtmek gerekir. Örnek olarak;

YUM_PARAMETER="-x perl* -x python* -x kernel*"

fail2ban kullanımı

Fail2ban, log dosyalarini inceleyerek, fazla hatalı veya başarısız islem yapan ip adresini belirli bir sure engellemek icin kullanılan uygulamadır. Tercihinize göre iptables veya tcpwrapper kullanarak DROP kurallarını otomatik olarak ekler veya kaldırır ve sizi email yoluyla bilgilendirebilir.

EPEL deposunda bulunan fail2ban’ı kurmak için

#yum install fail2ban

Varsayılan olarak /etc/fail2ban/jail.conf dosyasinda yapılandırmak istedigimiz servisin log dosyasinin bulundugu bolum duzenlenir ya da eklenir. Örnek olarak ;

[sasl-iptables]

enabled  = true
filter   = sasl
action   = iptables[name=sasl, port=smtp, protocol=tcp]
           sendmail[name=sasl, dest=email@address.com]
logpath  = /var/log/maillog

[postfix]

enabled = true
filter  = postfix
action  = iptables[name=SMTP, port=smtp, protocol=tcp]
          sendmail[name=Postfix, dest=email@address.com]
logpath = /var/log/maillog


[dovecot]
enabled = true
filter = dovecot
action = iptables-multiport[name=dovecot, port="pop3,pop3s,imap,imaps", protocol=tcp]
 	mail[name=dovecot, dest=email@address.com]
logpath = /var/log/dovecot.log 
maxretry = 20
findtime = 1200
bantime = 1200

fail2ban.conf ve jail.conf dosyalarındaki diğer ayarları düzenledikten sonra, uygulamayı başlatmanız gerekecektir.

# service fail2ban restart

Fail2ban log örneği ise aşağıdaki gibi olacaktır;

2013-03-28 04:52:35,474 fail2ban.actions: WARNING [dovecot] Ban 122.226.212.222
2013-03-28 05:12:36,194 fail2ban.actions: WARNING [dovecot] Unban 122.226.212.222
2013-03-28 05:59:13,869 fail2ban.actions: WARNING [sasl-iptables] Ban 174.50.235.244
2013-03-28 06:09:13,956 fail2ban.actions: WARNING [sasl-iptables] Unban 174.50.235.244
2013-03-28 07:15:37,082 fail2ban.actions: WARNING [postfix] Ban 5.47.155.176
2013-03-28 07:25:37,178 fail2ban.actions: WARNING [postfix] Unban 5.47.155.176

eskiyen ereg, eregi, ereg_replace fonksiyonlarını yenilemek

Php versiyonunuzu güncellediğinizde eğer çalıştırdığınız php scriptleri ereg, eregi, ereg_replace fonksiyonlarını kullanıyorsa, php sizi bu fonksiyonların eskidiğine dair uyaracaktır.

Bu fonksiyonlar yerine preg_match ve preg_replace kullanımı kısaca şöyledir;

    ereg('regexiniz', $tekst, $sonuc);
    preg_match('/regexiniz/', $tekst, $sonuc);
    eregi('regexiniz', $tekst, $sonuc);
    preg_match('/regexiniz/i', $tekst, $sonuc);
    $tekst = ereg_replace('regexiniz','yenisi', $tekst);
    $tekst = preg_replace('/regexiniz/i','yenisi', $tekst);