openvpn中继服务器的心跳检测脚本

root@flea:~# cat fixnet.py

#!/usr/bin/env python

import os

if os.system("ping 8.8.8.8 -c 2 -W 5")!=0:

    os.system('''bash -c "kill `ps -eF|grep openvpn|grep upstream| awk '{ print $2 }'`"''')


在crontab文件中增加一行:

* * * * * root python /root/fixnet.py

此外改造连接上行openvpn的脚本:

root@flea:~# cat ovpn.sh

#!/bin/bash

cd ~/sweb

while true; do

    openvpn udp.upstream.ovpn

done

ssh选择优先验证方式

multiple1902@m-laptop:~$ ssh Administrator@192.168.8.32 -v
OpenSSH_5.5p1 Debian-4ubuntu5, OpenSSL 0.9.8o 01 Jun 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 192.168.8.32 [192.168.8.32] port 22.
debug1: Connection established.
debug1: identity file /home/multiple1902/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/multiple1902/.ssh/id_rsa-cert type -1
debug1: identity file /home/multiple1902/.ssh/id_dsa type 2
debug1: Checking blacklist file /usr/share/ssh/blacklist.DSA-1024
debug1: Checking blacklist file /etc/ssh/blacklist.DSA-1024
debug1: identity file /home/multiple1902/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.6
debug1: match: OpenSSH_5.6 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.5p1 Debian-4ubuntu5
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '192.168.8.32' is known and matches the RSA host key.
debug1: Found key in /home/multiple1902/.ssh/known_hosts:55
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: /home/multiple1902/.ssh/id_rsa
Connection closed by 192.168.8.32
multiple1902@m-laptop:~$ ssh Administrator@192.168.8.32 -v
OpenSSH_5.5p1 Debian-4ubuntu5, OpenSSL 0.9.8o 01 Jun 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 192.168.8.32 [192.168.8.32] port 22.
debug1: Connection established.
debug1: identity file /home/multiple1902/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/multiple1902/.ssh/id_rsa-cert type -1
debug1: identity file /home/multiple1902/.ssh/id_dsa type 2
debug1: Checking blacklist file /usr/share/ssh/blacklist.DSA-1024
debug1: Checking blacklist file /etc/ssh/blacklist.DSA-1024
debug1: identity file /home/multiple1902/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.6
debug1: match: OpenSSH_5.6 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.5p1 Debian-4ubuntu5
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '192.168.8.32' is known and matches the RSA host key.
debug1: Found key in /home/multiple1902/.ssh/known_hosts:55
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: /home/multiple1902/.ssh/id_rsa
Connection closed by 192.168.8.32
multiple1902@m-laptop:~$ ssh Administrator@192.168.8.32 -v
OpenSSH_5.5p1 Debian-4ubuntu5, OpenSSL 0.9.8o 01 Jun 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 192.168.8.32 [192.168.8.32] port 22.
debug1: Connection established.
debug1: identity file /home/multiple1902/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/multiple1902/.ssh/id_rsa-cert type -1
debug1: identity file /home/multiple1902/.ssh/id_dsa type 2
debug1: Checking blacklist file /usr/share/ssh/blacklist.DSA-1024
debug1: Checking blacklist file /etc/ssh/blacklist.DSA-1024
debug1: identity file /home/multiple1902/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.6
debug1: match: OpenSSH_5.6 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.5p1 Debian-4ubuntu5
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '192.168.8.32' is known and matches the RSA host key.
debug1: Found key in /home/multiple1902/.ssh/known_hosts:55
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: /home/multiple1902/.ssh/id_rsa
Connection closed by 192.168.8.32



multiple1902@m-laptop:~$ ssh Administrator@192.168.8.32 -v  -o PreferredAuthentications=password
OpenSSH_5.5p1 Debian-4ubuntu5, OpenSSL 0.9.8o 01 Jun 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 192.168.8.32 [192.168.8.32] port 22.
debug1: Connection established.
debug1: identity file /home/multiple1902/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/multiple1902/.ssh/id_rsa-cert type -1
debug1: identity file /home/multiple1902/.ssh/id_dsa type 2
debug1: Checking blacklist file /usr/share/ssh/blacklist.DSA-1024
debug1: Checking blacklist file /etc/ssh/blacklist.DSA-1024
debug1: identity file /home/multiple1902/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.6
debug1: match: OpenSSH_5.6 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.5p1 Debian-4ubuntu5
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '192.168.8.32' is known and matches the RSA host key.
debug1: Found key in /home/multiple1902/.ssh/known_hosts:55
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: password
Administrator@192.168.8.32's password:
debug1: Authentication succeeded (password).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = zh_CN.UTF-8
Last login: Mon May  9 21:33:00 2011 from m1902-windows-laptop

Administrator@m1902-windows-laptop ~
$ ls

使用FreeRadius配置基于ubuntu server的IPv6 OpenVPN服务器

参考：
http://bbs.chinaunix.net/archiver/tid-1649418.html
http://dozview.com/blog/an-implementation-of-openvpn-system-based-on-userpass-authentication-bandwidth-control
https://tomem.info/blog/2010/06/207
http://b.gkp.cc/2010/08/11/resolv-openvpn-linux-client-dns-issue/
http://dozview.com/blog/an-implementation-of-openvpn-system-based-on-userpass-authentication-bandwidth-control
http://wiki.freeradius.org/index.php/FAQ
http://blog.163.com/dyc_888@126/blog/static/1004433512010827111128958/

1. 准备工作
1. 安装build-essential
   apt-get install build-essential wget
2. 安装基础组件(Apache2, PHP5, MySQL5)
   sudo apt-get install apache2 php5-mysql libapache2-mod-php5 mysql-server php5-mcrypt openssl php-pear php5-gd php-DB
   期间会要求设置mysql的root账户密码
3. 此时访问phpinfo.php，php可以解析但浏览器提示下载，这是缺少MIME TYPE参数引起的。修改/etc/apache2/apache2.conf，加入
   AddType application/x-httpd-php .php
   
4. 安装phpMyAdmin
   wget http://downloads.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.3.8/phpMyAdmin-3.3.8-all-languages.tar.gz
2. 安装FreeRadius，目前源里的版本是2.1.9
   apt-get install freeradius freeradius-mysql  libgcrypt11-dev
   /*编译安装FreeRadius
   wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.1.10.tar.gz
   # 我实际操作时上面的地址超时了，我用的是下面这个：
   # wget ftp://ftp.ntua.gr/pub/net/radius/freeradius/freeradius-server-2.1.10.tar.gz
   # FreeRadius的下载页面在这里 -> http://freeradius.org/download.html
   tar -zxvf freeradius-server-2.1.10.tar.gz
   cd freeradius-server-2.1.10
   ./configure
   cp libltdl/ltdl.h src/include/ # 这步很重要
   make
   make install */这样，各种教程里提到的raddb目录就是/etc/freeradius目录。
   如果服务器有ip6的话，这里有点小问题：修改信任客户端里面的本机IP。没ip6的话直接跳到下个section吧。
   vi /etc/freeradius/clients.conf
   修改第一个ipaddr为服务器的ip4地址（不是环回，原因不知道）。这里不设置的话，后果就是radius拒绝连接。
   确认freeradius服务运行之后执行下面命令来测试：
   radtest root root帐号的密码 127.0.0.1 1812 testing123
   无ip6的服务服务器可以把这里的127.0.0.1换成localhost试试。
   如果不使用freeradius服务而是执行freeradius -X可以以debug模式执行，找出问题来。
3. 装配OpenVPN服务器
1. 下载和安装，iptable用于设置nat伪装，很重要
   apt-get install liblzo2-2 libpkcs11-helper1 openssl-blacklist openvpn-blacklist python iptables
   wget https://launchpad.net/~berni/+archive/ipv6/+files/openvpn_2.1.0-1%2Bipv6-2~intrepid_i386.deb
   dpkg -i openvpn_2.1.0-1+ipv6-2~intrepid_i386.deb
2. 配置OpenVPN服务器端，生成证书和配置文件这两部分请参考 http://d.ream.at/ipv6-vpn/
   服务器配置文件server.conf
   port 53
   proto udp6
   ……
   push “dhcp-option DNS 208.67.222.222″
   push “dhcp-option DNS 208.67.220.220″
   client-to-client
   keepalive 10 120
   comp-lzo
   persist-key
   persist-tun
   verb 3
   客户端配置文件openvpn.ovpn
   ……
   proto udp6
   remote 不加中括号的ip6地址 53
   ……
   #对于linux客户端要注意下面三行，否则无法使用推送的DNS
   script-security 2
   up /etc/openvpn/update-resolv-conf
   down /etc/openvpn/update-resolv-conf
3. 配置nat伪装，注意我这是OpenVZ主机的用法。Xen的看这里 -> http://pityonline.info/?p=1054
   iptables -t nat -A POSTROUTING -j SNAT --to-source 服务器ip4地址
   这行也要放到/etc/init.d/rc.local里面去
4. 开启路由（ip4包转发）
   echo 1 > /proc/sys/net/ipv4/ip_forward
   记得还要去修改/etc/sysctl.conf哦！
5. 完成以上步骤，客户端胜利地通过ip6用证书测试连接。
4. 在MySQL中加入供radius使用的数据库（可以进入PMA操作），导入radius的数据表结构
   mysql -uroot -p
   use radius # radius是我的数据库名称
   # 输入/etc/freeradius/sql/mysql/schema.sql文件的内容
   CREATE TABLE nas (id int(10) NOT NULL auto_increment, nasname varchar(128) NOT NULL, shortname varchar(32), type varchar(30) DEFAULT 'other', ports int(5), secret varchar(60) DEFAULT 'secret' NOT NULL, community varchar(50), description varchar(200) DEFAULT 'RADIUS Client', PRIMARY KEY (id), KEY nasname (nasname)); # 加入用于管理的nas表
   配置radius与mysql的连接：
   vi /etc/freeradius/sql.conf
   修改login、password、radius_db三个参数并且去除readclients = yes的注释。
   打开sql权限：
   vi /etc/freeradius/radiusd.conf
   在modules部分的约660行去除对“$INCLUDE sql.conf”的注释；
   vi /etc/freeradius/sites-enabled/default
   在authorize部分约159行去除sql的注释，accounting部分383行也是，session部分428行也是，post-auth部分449行也是。
   下面来个测试用户试试，在radius数据库中执行INSERT INTO radcheck (UserName, Attribute, Value) VALUES ('sqltest', 'Password', 'testpwd');FLUSH PRIVILEGES;
   启动freeradius -X之后输出了好多好乱的信息，但至少是就绪了；在另一个终端执行radtest sqltest testpwd 127.0.0.1 1812 testing123胜利。
5. 装配FreeRadius的Web后台daloRADIUS
1. 下载解压
   wget http://downloads.sourceforge.net/project/daloradius/daloradius/daloradius-0.9-8/daloradius-0.9-8.tar.gz
   tar -zxvf daloradius-0.9-8.tar.gz
   mv daloradius-0.9-8 dalo
2. 导入表，文件在contrib/db/mysql-daloradius.sql
3. 配置daloRADIUS连接数据库，文件是library/daloradius.conf.php，这个不用说的大家都会的。ip6用户注意如果你在添加mysql用户的时候限制了只允许从本机访问，这里连接又很操蛋地把你认为是外面的ip的话，不妨把数据库服务器从127.0.0.1改成::1，反正我就是这么做的。
4. 还有就是daloradius.conf.php的37行那个usergroup要改成radusergroup，进数据库，把表radusergroup复制一份叫usergroup，不然daloRADIUS后台好多页面会报错。
6. 连接OpenVPN和FreeRadius
1. 下载插件
   wget http://www.nongnu.org/radiusplugin/radiusplugin_v2.1_beta9.tar.gz
   tar zxvf radiusplugin_v2.1_beta9.tar.gz
   cd radiusplugin/
   make
   cp radiusplugin.cnf radiusplugin.so /etc/openvpn
   vi /etc/openvpn/radiusplugin.cnf
   修改sharedsecret和/etc/freeradius/clients.conf的一致，61行附近的服务器ip也别忘了改成127.0.0.1。注意默认的radiusplugin.cnf里面有两个server，你可能需要删掉其中一个。
2. 修改OpenVPN配置，具体而言是server.conf里，在server行下面加入
   client-cert-not-required
   username-as-common-name
   plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf
   auth RSA-SHA512
   cipher AES-256-CBC
3. 在客户端的openvpn.ovpn中加入
   auth-user-pass
   auth RSA-SHA512
   cipher AES-256-CBC
4. 客户端测试连接是成功的
5. 复制多份服务器端的server.conf文件，使用不同协议。注意要使用local x.x.x.x 和local xx:xx:xx:xx:xx:xx:xx:xx来指明监听

打印python的site-package路径

python -c "from distutils.sysconfig import get_python_lib; print get_python_lib()"

multiple1902@m-laptop:/lib$ python -c "from distutils.sysconfig import get_python_lib; print get_python_lib()"
/usr/lib/python2.6/dist-packages

VIM的折叠操作按键

在可折叠处（大括号中间）：
zc      折叠
zC     对所在范围内所有嵌套的折叠点进行折叠
zo      展开折叠
zO     对所在范围内所有嵌套的折叠点展开
[z       到当前打开的折叠的开始处。
]z       到当前打开的折叠的末尾处。
zj       向下移动。到达下一个折叠的开始处。关闭的折叠也被计入。
zk      向上移动到前一折叠的结束处。关闭的折叠也被计入。

http://hi.baidu.com/ganss/blog/item/39539407075c2acf7a894745.html

fcitx输入日文

感谢fcitx作者csslayer指导：）

采用 http://is.gd/3yF7DJ 5楼那个修改过的txt。用txt2mb做一下，放到~/.config/fcitx/table下面…参考http://code.google.com/p/fcitx/source/browse/data/table/erbi.conf的配置，改个名，改改里面的内容……

如果运行txt2mb提示需要安装fcitx，则安装fcitx-tools。这种情况应该是使用了ppa

其他详情： http://fcitx.github.com/handbook/code-table.html

FreeBSD加载光驱

# mount -t cd9660 /dev/acd0t01 /mnt/cdrom