add ssh article
This commit is contained in:
parent
e7122eb2d0
commit
925eaf2f9e
82
content/new_vh.rst
Normal file
82
content/new_vh.rst
Normal file
@ -0,0 +1,82 @@
|
||||
new virtual host
|
||||
################
|
||||
|
||||
:date: 2019-09-09 00:00
|
||||
:modified: 2019-09-09 00:00
|
||||
:tags: infra
|
||||
:category: documentation
|
||||
:slug: create_vh
|
||||
:authors: Ms.Leave-A-Mix
|
||||
:summary: How-To install a new virtual host to the webserver
|
||||
|
||||
This article will explain how to deploy a new service within your web server.
|
||||
The service (framadate), is hosted on the same machine than the webserver
|
||||
(nginx). You may like to create a new machine, to use the self-included
|
||||
webserver of your programming language (php, python, ruby...), as the goal of
|
||||
having one webserver is to save time by configuring only one monitoring system
|
||||
and security system for many apps.
|
||||
|
||||
-------------
|
||||
The Webserver
|
||||
-------------
|
||||
|
||||
We use NGINX as a webserver. It is modular and aimed to be as small and
|
||||
efficient as possible. Since then, it doesn't include the necessary programs to
|
||||
run your scripts. You need to have another program to launch and manages your
|
||||
processes. For our example, this will be php-fpm_. If you also use `Alpine
|
||||
Linux`_ you can follow `this tutorial
|
||||
<https://wiki.alpinelinux.org/wiki/Nginx_with_PHP#PHP7_Installation>`__.
|
||||
|
||||
------
|
||||
System
|
||||
------
|
||||
|
||||
I will use the commands with the default Alpine Linux tools, that are not like
|
||||
Debian or Arch ones. Adapt this if you use another distro.
|
||||
|
||||
I suggest that the webserver is already installed, and is working for serving
|
||||
php scripts.
|
||||
|
||||
We will create a new user that has access to the git repository of your program,
|
||||
so you can update it's code easily, without having to re-upload at each
|
||||
modification.
|
||||
|
||||
``useradd -rm www-git``
|
||||
|
||||
Create an passwordless ssh key for this user :
|
||||
|
||||
``su www-git
|
||||
ssh-keygen``
|
||||
|
||||
If you need the git authentication (i.e. because your repo is private), do as
|
||||
usual.
|
||||
|
||||
--------
|
||||
Database
|
||||
--------
|
||||
|
||||
Freepoteries uses one server to handle all database stuff. We will assume in
|
||||
this documentation that the DB software is MariaDB_ (ver. 10.1.38, debian).
|
||||
|
||||
Your DB server needs to be accessible by the webserver machine, you can test
|
||||
this on the webserver host by launching the following command :
|
||||
``nc db.server db.port``
|
||||
|
||||
If it gives you the MariaDB version, you're ok to go with this.
|
||||
|
||||
You need to have an administrator access to the MariaDB server. On the DB
|
||||
server, try this by launching the following commands :
|
||||
``mariadb -u root``
|
||||
|
||||
If this connects you to the MariaDB prompt, you're ok.
|
||||
Now, in this prompt, create the user for our app. It will own a database and all
|
||||
the rights on it.
|
||||
|
||||
``CREATE DATABASE framadate;
|
||||
CREATE USER 'framadate'@'www.freepoteries.fr' identified by '7VDYMDXJXHTC107Z61OWCVTWM';
|
||||
GRANT ALL PRIVILEGES ON framadate TO 'framadate'@'www.freepoteries.fr';``
|
||||
|
||||
|
||||
.. _php-fpm: https://php-fpm.org/
|
||||
.. _Alpine Linux: https://alpinelinux.org/
|
||||
.. _MariaDB: https://mariadb.org/
|
||||
101
content/ssh.rst
Normal file
101
content/ssh.rst
Normal file
@ -0,0 +1,101 @@
|
||||
ssh
|
||||
###
|
||||
|
||||
:date: 2019-09-09 00:00
|
||||
:modified: 2019-09-09 00:00
|
||||
:tags: ssh, admin
|
||||
:category: documentation
|
||||
:slug: ssh
|
||||
:authors: Ms.Leave-A-Mix
|
||||
:summary: SSH usage and configuration
|
||||
|
||||
`Secure SHell`_ is a very powerful way to connect to computers remotely. It has
|
||||
many uses and you may have already touched it, even without knowing it.
|
||||
|
||||
This article will brief up some of the use cases, and will explain the basics of
|
||||
some handy tips that you may use in your daily admin (no)life.
|
||||
|
||||
-------------------
|
||||
Authentication Keys
|
||||
-------------------
|
||||
|
||||
In many client-server programs, authentication is one of the major problems that
|
||||
the programmers encounters to make his software secure. The usual way to handle
|
||||
it is a login/password system. Since it's easy to code and use, many web
|
||||
services have only this way to authenticate users. This leads in the end to a
|
||||
mass usage of "bot tests", and in many cases, `Google's reCaptcha`_ usage. This
|
||||
is no solution for real-world web applications, and for task automation and time
|
||||
saving.
|
||||
|
||||
The success of SSH_ is, between many of it's advantages, to handle an other way
|
||||
to authenticate users. This is called "`Public Key Authentication`_", and you
|
||||
can read more about it's benefits by clicking on the link.
|
||||
|
||||
How-To
|
||||
------
|
||||
|
||||
This how-to will use ssh, ssh-agent, ssh-keygen, netcat and of course our
|
||||
beloved bash to show how to simply authenticate to any SSH_ or Git_ server.
|
||||
|
||||
First, we will generate a SSH_ key pair, with or without password to protect it
|
||||
:
|
||||
``ssh-keygen -f new_key``
|
||||
This command created two files : new_key and new_key.pub
|
||||
The first one is the private part of the pair, and the ".pub" one is the public
|
||||
part. We don't have to check what's inside the private key, since it's randomly
|
||||
generated bytes, an human can not read it. The public key, is like a fingerprint
|
||||
that will authenticate only and only if it matches with the private one.
|
||||
|
||||
Choose a server on which you have an user access with an SSH_ password. For
|
||||
example, "nasa.gov". We will copy the newly created public key to it, and allow
|
||||
the autentication with it.
|
||||
|
||||
``ssh-copy-id -i new_key root@nasa.gov``
|
||||
|
||||
Just enter your password, and it should be done. The program should output :
|
||||
``Number of key(s) added: 1``
|
||||
|
||||
This means that you succeeded! (You can now disable SSH password login on the remote
|
||||
server, huh)
|
||||
|
||||
SSH-Agent_ is like a keyring, it will register your keys to your session, and
|
||||
will automate the authentication process when needing them. This is how you use
|
||||
it :
|
||||
``eval $(ssh-agent)
|
||||
ssh-add ./new_key``
|
||||
|
||||
This program should output :
|
||||
``Identity added: new_key (user@hostname)``
|
||||
|
||||
We then need to add some ssh client configuration, to make it automatized.
|
||||
|
||||
``Host *.freepoteries.fr
|
||||
ForwardAgent yes
|
||||
User user
|
||||
IdentityFiles ~/new_key``
|
||||
|
||||
If you want to allow users to login directly to machines in the local network of
|
||||
your remote host (as it is done with every virtual machine of my server). You
|
||||
can also add to the options of the host :
|
||||
|
||||
``ProxyCommand ssh user@freepoteries.fr "-q0 %h %p" 2> /dev/null``
|
||||
|
||||
Save all of this in ``~/.ssh/config``.
|
||||
|
||||
Put this in your ``~/.bashrc`` if you want to make the ssh-agent run at each
|
||||
session (read `man ssh-agent` for further information):
|
||||
|
||||
``if [[ "$SSH_AGENT_PID" == "" ]]; then
|
||||
eval "$(<~/.run/ssh-agent/environment)"
|
||||
ssh-add ~/.ssh/id_rsa
|
||||
ssh-add ~/.ssh/id_rsa_ma-otec
|
||||
ssh-add ~/.ssh/id_rsa_belugaspot-msleaveamix
|
||||
fi``
|
||||
|
||||
|
||||
.. _Secure SHell: https://www.ssh.com/ssh
|
||||
.. _SSH: https://www.ssh.com/ssh
|
||||
.. _Google's reCaptcha: https://www.google.com/recaptcha
|
||||
.. _Public Key Authentication: https://www.ssh.com/ssh/public-key-authentication
|
||||
.. _Git: https://git-scm.com/
|
||||
.. _SSH-Agent: https://www.ssh.com/ssh/agent
|
||||
Loading…
Reference in New Issue
Block a user