User Tools

Site Tools


Sidebar


Tags Cloud
start

Last updates

PlayGround

2010/05/19 01:52

mod_realip для apache 2.2.x

apache2.4

/etc/apache2/mods-enabled/remoteip.conf
  RemoteIPHeader X-Real-IP
  RemoteIPTrustedProxy 127.0.0.1

apache2.2

Не требует никакой настройки, достаточно скомпилировать и установить. При необходимости можно изменить заголовок с X-Real-IP на желаемый.

# apxs -a -i -c mod_realip.c
#include "httpd.h"
#include "http_config.h"
#include "apr_strings.h"

module AP_MODULE_DECLARE_DATA realip_module;

static int change_remote_ip(request_rec *r) {
    const char *fwdvalue;
    char *val;

    if (fwdvalue = apr_table_get(r->headers_in, "X-Real-IP")) {
        apr_array_header_t *arr = apr_array_make(r->pool, 0, sizeof(char*));
        while (*fwdvalue && (val = ap_get_token(r->pool, &fwdvalue, 1))) {
            *(char **)apr_array_push(arr) = apr_pstrdup(r->pool, val);
            if (*fwdvalue != '\0')
                ++fwdvalue;
        }
        r->connection->remote_ip = apr_pstrdup(r->connection->pool, ((char **)arr->elts)[((arr->nelts)-1)]);
        r->connection->remote_addr->sa.sin.sin_addr.s_addr = inet_addr(r->connection->remote_ip);
    }
    return DECLINED;
}

static void register_hooks(apr_pool_t *p) {
    ap_hook_post_read_request(change_remote_ip, NULL, NULL, APR_HOOK_FIRST);
}

module AP_MODULE_DECLARE_DATA realip_module = {
    STANDARD20_MODULE_STUFF,
    NULL,
    NULL,
    NULL,
    NULL,
    NULL,
    register_hooks,
};

Изменения для apache 2.4.x

# sed 's/remote_ip/client_ip/g;s/remote_addr/client_addr/g' -i mod_realip.c
2010/05/19 01:49

Патч для oops-1.5.23, решающий проблему компиляции под CentOS

oops-1.5.24-pthread-rwlock.patch
diff -Nru oops-1.5.23.orig/src/lib/rwlock/rwlock.c oops-1.5.23/src/lib/rwlock/rwlock.c
--- oops-1.5.23.orig/src/lib/rwlock/rwlock.c    2000-11-29 19:03:35.000000000 +0200
+++ oops-1.5.23/src/lib/rwlock/rwlock.c 2006-09-06 00:30:36.000000000 +0300
@@ -53,6 +53,8 @@
 #include <pthread.h>
 #include "rwlock.h"
 
+#if defined(OOPS_IMPLEMENT_RWLOCK)
+
 /* maximum number of times a read lock may be obtained */
 #define        MAX_READ_LOCKS          (INT_MAX - 1)
 
@@ -375,4 +377,6 @@
        return(0);
 }
 
+#endif /* defined(OOPS_IMPLEMENT_RWLOCK) */
+
 #endif /* _THREAD_SAFE || _PTHREADS || _REENTRANT */
diff -Nru oops-1.5.23.orig/src/lib/rwlock/rwlock.h oops-1.5.23/src/lib/rwlock/rwlock.h
--- oops-1.5.23.orig/src/lib/rwlock/rwlock.h    2003-10-06 17:15:40.000000000 +0300
+++ oops-1.5.23/src/lib/rwlock/rwlock.h 2006-09-06 00:29:46.000000000 +0300
@@ -53,6 +53,7 @@
 
 #if    !defined(PTHREAD_RWLOCK_INITIALIZER)
 #define        PTHREAD_RWLOCK_INITIALIZER      NULL
+#define OOPS_IMPLEMENT_RWLOCK 1
 
 struct pthread_rwlock {
        pthread_mutex_t lock;           /* monitor lock */
2010/04/29 10:40

Добавление вхоста в apache+nginx

FIXME Переписать этот ужас.

Только Debian. Пользователь, которому принадлежат сайты, должен быть предварительно создан.

#!/bin/bash

function read_domain
{
    if [[ -z $domain ]]; then
        echo -n "Provide domain to add: "
        read domain
    fi
}

function read_user
{
    if [[ -z $user ]]; then
        echo -n "Provide domain's owner login: "
        read user
    fi
}

function read_logs
{
    if [[ -z $logs ]]; then
        echo -n "Enable access/error logs? [y/N]: "
        read logs
    fi

    case $logs in
        y*|Y*)
            LOGS=1
        ;;
        *)
            unset $logs
        ;;
    esac
}

function init_vars
{
    #### BASE SETTINGS ####
    CLIENTS_HOME="/home/clients"
    DOMAIN_DIR="/home/clients/$user/domains/$domain"
    DOCROOT="$DOMAIN_DIR/html"
    LOGSDIR="$DOMAIN_DIR/logs"
    TMPCONFDIR="/opt/scripts/www_configs"

    # can be set as IP='111.111.111.111'
    IP=`ip route get 8.8.8.8 | head -1 | awk '{print $NF}'`

    if [[ ! -d $TMPCONFDIR ]]; then
        mkdir -p $TMPCONFDIR
    fi

    if [[ -z `id $user` ]]; then
        echo "You need to create user '$user' first!"
        exit 1
    fi

    if [[ ! -d $DOCROOT ]]; then
        mkdir -p $DOCROOT
        chown -R $user:$user $DOCROOT
    fi

		if [[ ! -d $LOGSDIR ]]; then
			mkdir -p $LOGSDIR
		fi
}

function generate_apache_vhost
{
    if [[ $logs ]]; then
        local log_block="LogLevel warn
    ErrorLog $LOGSDIR/apache_error_log
    CustomLog $LOGSDIR/apache_access_log combined"
    fi

    if [[ $domain ]] && [[ $user ]]; then

        cat > $TMPCONFDIR/apache.$domain << EOF
<VirtualHost 127.0.0.1:82>
    <IfModule mpm_itk_module>
        AssignUserId $user $user
    </IfModule>

    ServerName $domain
    ServerAlias www.$domain

    ServerAdmin $user@$domain
    DocumentRoot $DOCROOT
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>

    <Directory $DOCROOT>
        Options -Indexes FollowSymLinks MultiViews
        AllowOverride All
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ $DOCROOT/cgi-bin/
    <Directory "$DOCROOT/cgi-bin/">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    $log_block
</VirtualHost>

EOF
    fi
}

function generate_nginx_vhost
{
    if [[ $logs ]]; then
        local log_block="access_log $LOGSDIR/nginx_access_log;
      error_log $LOGSDIR/nginx_error_log;"
    fi

    if [[ $domain ]] && [[ $user ]]; then
        cat > $TMPCONFDIR/nginx.$domain << EOF
  server {
      listen      80;
      server_name $domain www.$domain;
      root $DOCROOT;
      location / {
          proxy_pass         http://127.0.0.1:82/;
          proxy_redirect     off;
          proxy_set_header   Host             \$host;
          proxy_set_header   X-Real-IP        \$remote_addr;
          proxy_set_header   X-Forwarded-For  \$proxy_add_x_forwarded_for;
          proxy_max_temp_file_size  0;
          client_max_body_size       10m;
          client_body_buffer_size    128k;
          proxy_connect_timeout      90;
          proxy_send_timeout         90;
          proxy_read_timeout         90;
          proxy_buffer_size          4k;
          proxy_buffers              4 32k;
          proxy_busy_buffers_size    64k;
          proxy_temp_file_write_size 64k;
      }

      location ~* ^.+.(jpg|gif|png|avi|mpg|zip|exe)$ {
        root $DOCROOT;
      }

      $log_block
   }
EOF
    fi
}

function generate_named_vhost
{
	serial=`/bin/date +"%Y%m%d%k"`

	cat >$TMPCONFDIR/named.$domain<< EOF
\$TTL 10800
@ IN SOA ns1.$domain. root.$domain. (
    $serial     ; serial
    10800       ; refresh
    3600        ; retry
    604800      ; expire
    3600 )      ; minimum
; NS
    IN  NS  ns1.$domain.
    IN  NS  ns2.$domain.
; MX
    IN  MX  10  mx1.$domain.
; records
ns1         IN  A   $IP
ns2         IN  A   $IP
mx1         IN  A   $IP
www         IN  A   $IP
$domain.    IN  A   $IP

EOF
}

function enable_apache_vhost
{
    if [[ -f "/etc/apache2/sites-available/${domain}.conf" ]]; then
        echo "Domain $domain already exists in /etc/apache2/sites-available/${domain}.conf"
        exit 1
    else
        cp $TMPCONFDIR/apache.$domain /etc/apache2/sites-available/${domain}.conf
        a2ensite $domain
        if [[ -z `apache2ctl configtest` ]]; then
            /etc/init.d/apache2 reload
            echo "$domain enabled!"
        else
            echo "Errors detected, please solve it manually!"
            exit 1
        fi

    fi
}

function enable_nginx_vhost
{
    if [[ -f "/etc/nginx/sites-available/$domain" ]]; then
        echo "Domain $domain already exists in /etc/nginx/sites-available/$domain"
        exit 1
    else
        cp $TMPCONFDIR/nginx.$domain /etc/nginx/sites-available/$domain
        ln -s /etc/nginx/sites-available/$domain /etc/nginx/sites-enabled/$domain
        if [[ -z `nginx -t` ]]; then
            /etc/init.d/nginx reload
            echo "$domain enabled!"
        else
            echo "Errors detected, please solve it manually!"
            exit 1
        fi

    fi
}

function enable_named_vhost
{
	[[ -d "/etc/bind/zones" ]] || mkdir -p "/etc/bind/zones"

	if [[ -f "/etc/bind/zones/$domain.conf" ]]; then
		echo "Zone $domain already exists in /etc/bind/zones/$domain.conf"
		exit 1
  else
		cp $TMPCONFDIR/named.$domain /etc/bind/zones/$domain.conf
		
		cat >>/etc/bind/named.conf.local<< EOF
zone "$domain" {
    type master;
    file "/etc/bind/zones/$domain.conf";
};

EOF

		if [[ -z `/usr/sbin/named-checkconf` && -z `/usr/sbin/named-checkzone -q $domain /etc/bind/zones/$domain.conf` ]] ; then
			/usr/sbin/rndc reload
			echo "bind9: $domain enabled"
		else
			echo "Errors detected, please solve it manually!"
			exit 1
		fi
	fi
}

function enable_logrotate
{
    if [[ ! -d "/etc/logrotate.d/vhosts" ]]; then
        mkdir -p /etc/logrotate.d/vhosts
    fi

        cat > $TMPCONFDIR/logrotate.$domain << EOF
$LOGSDIR/*_log {
    daily
    missingok
    rotate 52
    compress
    delaycompress
    notifempty
    create 0644 root root
    sharedscripts
    prerotate
        if [ -d /etc/logrotate.d/httpd-prerotate ]; then \\
            run-parts /etc/logrotate.d/httpd-prerotate; \\
        fi; \\
    endscript
    postrotate
        /etc/init.d/apache2 reload > /dev/null
        [ ! -f /var/run/nginx.pid ] || kill -USR1 `cat /var/run/nginx.pid`
    endscript
}
EOF

    if [[ $logs ]]; then
        # install logrotate
        if [[ -f "/etc/logrotate.d/vhosts/$domain" ]]; then
            echo "Domain $domain already exists in /etc/logrotate.d/vhosts/$domain"
            exit 1
        else
            cp $TMPCONFDIR/logrotate.$domain /etc/logrotate.d/vhosts/$domain
        fi
    fi
}


read_domain
read_user
read_logs

init_vars

generate_apache_vhost
generate_nginx_vhost
generate_named_vhost

enable_apache_vhost
enable_nginx_vhost
enable_named_vhost

enable_logrotate

Простейший скрипт для добавления виртхоста и днс-записи на сервер с Debian, если отсутствует панель управления. (2009 год, возможно устарело)

Необходимо предварительно создать пользователя http

#!/bin/bash

echo -n "Введите имя сайта: "
read domain

# СОЗДАНИЕ ДИРЕКТОРИИ
mkdir -p /home/http/domains/$domain/html/cgi-bin
chown -R http:http /home/http/domains/$domain/html

# СОЗДАНИЕ КОНФИГА ВИРТХОСТА ДЛЯ АПАЧА
cat >/etc/apache2/sites-available/$domain << EOF
<VirtualHost *:80>
    ServerName $domain
    ServerAlias www.$domain
    DocumentRoot /home/http/domains/$domain/html
    ErrorLog /dev/null

    ScriptAlias /cgi-bin/ "/home/http/domains/$domain/html/cgi-bin/"

    <Directory "/cgi-bin/">
        AllowOverride None
        Options None +FollowSymLinks ExecCGI
        DirectoryIndex index.pl
    </Directory>

    <Directory />
        Options All -Indexes
        AllowOverride All
    </Directory>
</VirtualHost>
EOF

# ВКЛЮЧЕНИЕ ВИРТХОСТА
/usr/sbin/a2ensite $domain
/etc/init.d/apache2 reload

# СОЗДАНИЕ ФАЙЛА ДНС-ЗОНЫ
serial=`/bin/date +"%Y%m%d%k"`
cat >/etc/bind/zones/$domain<< EOF
\$TTL 10800
@ IN SOA ns1.$domain. root.$domain. (
    $serial     ; serial
    10800       ; refresh
    3600        ; retry
    604800      ; expire
    3600 )      ; minimum
; NS
    IN  NS  ns1.$domain.
    IN  NS  ns2.$domain.
; MX
    IN  MX  10  mx1.$domain.
; records
ns1         IN  A   95.169.190.217
ns2         IN  A   95.169.191.217
www         IN  A   95.169.191.217
$domain.    IN  A   95.169.191.217
EOF

# СОЗДАНИЕ ЗАПИСИ О ДНС-ЗОНЕ
cat >>/etc/bind/named.conf.local<< EOF
zone "$domain" {
    type master;
    file "/etc/bind/zones/$domain";
};
EOF

# ВКЛЮЧЕНИЕ ЗОНЫ
/usr/sbin/rndc reload
2009/12/04 15:19

Скрипт автоподъема apache

Костыль проверяет количество чайлдов апача, если это количество меньше значения директивы MinSpareServers, то прибивает все процессы вебсервера через kill -9, чистит семафоры и стартует апач. Добавить в крон на каждую минуту.

* * * * * /opt/scripts/apache/apache_checker.sh check
# mkdir /opt/scripts/apache
#!/bin/sh

ALERTEMAIL="[email protected]"
APACHECTL=/usr/sbin/apache2ctl
SCRIPT_DIR=/opt/scripts/apache
RUNNING_PROCESSES=`ps auxww | grep -c bin/apache`;
APACHEUSER="www-data"
MinSpareServers="24"

######## [DO NOT MODIFY] ###

LOG_FILE=${SCRIPT_DIR}/status.log
DATE=`date '+%Y-%m-%d %T'`


apache_start()
{
    $APACHECTL start;
}

apache_stop()
{
    $APACHECTL stop;
    sleep 1;
    killall -9 apache httpd apache2 >/dev/null 2>&1;
}

apache_restart()
{
    apache_stop;
    sleep 1;
    apache_semclear;
    apache_start;
}

# if not running - start
apache_check()
{
    if
        [[ ${RUNNING_PROCESSES} -le $MinSpareServers ]]; then
        apache_restart;
        echo "${DATE} ALERT: `hostname -f` - apache was restarted" >> ${LOG_FILE};
        echo "${DATE} ALERT: `hostname -f` - apache was restarted" | /usr/sbin/sendmail $ALERTEMAIL;
    fi
}

# clear semaphores
apache_semclear()
{
    for i in `ipcs | grep $APACHEUSER | awk -F ' ' '{ print $2}'`
    do
        ipcrm -s $i;
    done
}

case $1 in
    start)
        apache_start;
    ;;
    stop)
        apache_stop;
    ;;
    restart)
        apache_restart;
    ;;
    check)
        apache_check;
    ;;
    semclear)
        apache_semclear;
    ;;
    *)
    echo "Script usage: $0 start | stop | restart | check | semclear";
esac
2009/05/08 12:17

Скрипт для проверки доступности вебсервера (с SMS)

Работает под debian.

# mkdir -p /opt/scripts/monitoring/active_alerts

Скрипт ложить в /opt/scripts/monitoring/checker.sh

#!/bin/bash

SCRIPT_DIR=/opt/scripts/monitoring
LOG_FILE=${SCRIPT_DIR}/status.log
PHONES="80501234567 80507654321"
CURDATE=`/bin/date +"%s"`;

function alert
{
    for i in $PHONES;
    do  
        echo "$1 $2 $3" | /usr/sbin/sendmail -fmonitoring@monitoring ${i}@sms.mysmsgate.com;
    done
}

function check
{
    cat $SCRIPT_DIR/targets |  while read ip server;
    do  
        /usr/bin/wget -T 5 --tries=3 -q -O - http://${ip}/.do_not_remove.php | grep SUCCESS >/dev/null;
        if [[ $? == 0 ]]; then
            if [[ -e $SCRIPT_DIR/active_alerts/$server ]]; then
                cat $SCRIPT_DIR/active_alerts/$server | while read startdate;
                do  
                    DATE=`/bin/date +"%F %T"`;
                    let "i =  $CURDATE - $startdate";
                    lenght=`/bin/date -u +"%T" --date=@${i}`;
                    alert "$DATE" $server "is UP, downtime is $lenght";
                    echo "$DATE" $server "is UP, downtime is $lenght" > $LOG_FILE
                    rm -f $SCRIPT_DIR/active_alerts/$server
                done
            fi
        else
            if [[ -e $SCRIPT_DIR/active_alerts/$server ]]; then
                MINUTE=`/bin/date +"%M"`
                if [[ $MINUTE == 00 ]]; then
                    cat $SCRIPT_DIR/active_alerts/$server | while read startdate;
                do  
                    DATE=`/bin/date +"%F %T"`;
                    let "i =  $CURDATE - $startdate";
                    lenght=`/bin/date -u +"%T" --date=@${i}`;
                    alert "$DATE" $server "down for $lenght";
                done
                fi
            else
                echo $CURDATE > $SCRIPT_DIR/active_alerts/$server;
                DATE=`/bin/date +"%F %T"`;
                alert "$DATE" $server "is DOWN";
                echo "$DATE" $server "is UP, downtime is $lenght" > $LOG_FILE
            
            fi
        fi
    done
}

check
2009/05/06 14:07

Парольная аутентификация в openvpn

Server Config

local <HOST IP>
port 1194
proto tcp
dev tun
ca /usr/local/etc/openvpn/ca.crt
cert /usr/local/etc/openvpn/server.crt
key /usr/local/etc/openvpn/server.key
dh /usr/local/etc/openvpn/dh1024.pem
server 192.168.78.0 255.255.255.0
ifconfig-pool-persist /usr/local/etc/openvpn/ips
push "redirect-gateway"
auth-user-pass-verify /usr/local/etc/openvpn/auth.pl via-env
client-cert-not-required
username-as-common-name
keepalive 100 120
comp-lzo
client-config-dir /usr/local/etc/openvpn/ccd
max-clients 250
persist-key
persist-tun
status /usr/local/etc/openvpn/openvpn-status.log
verb 3

Скрипт /usr/local/etc/openvpn/auth.pl

#!/usr/bin/perl

use strict;

my $passwdfile = "/usr/local/etc/openvpn/users";
my $isValidUser = 0;
my $username;
my $password;
my $thisUsername = $ENV{'username'};
my $thisPassword = $ENV{'password'};

open (PASSWORDS,"$passwdfile") or die "can't find file: $passwdfile : $!\n";

while (<PASSWORDS>) {
    ($username,$password)= split (/:/, $_);
    chomp $username;
    chomp $password;
    if ($username eq $thisUsername && $password eq $thisPassword) {
        $isValidUser = 1;
        last;
    }
}
close PASSWORDS;

if ($isValidUser == 1) {
    print "ERR\n";
    exit 1;
} else {
    print "OK\n";
    exit 0;
}

Client Config

client
dev tun
proto tcp
remote <HOST IP> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
pull
auth-user-pass
ca ca.crt
comp-lzo
verb 3

Формат файла /usr/local/etc/openvpn/users

login:password

Формат файлов в директории /usr/local/etc/openvpn/ccd

Имя файла должно полностью совпадать с login. Для нормальной работы openvpn-клиента под windows - IP шлюза и серый IP клиента должны быть из одной /30 подсети. Под linux/BSD таких ограничений нет.

ifconfig-push 192.168.78.CIENT_IP 192.168.78.VPN_GATEWAY
2008/03/18 12:29
start.txt · Last modified: 2016/09/22 01:27 by kyxap