Outils pour utilisateurs

Outils du site


blog

Notes fail2ban

Install

apt-get install fail2ban rsyslog

Unbanned Ip

iptable -S
iptable -L -n
#fail2ban-client set ssh unbanip 192.168.2.15
fail2ban-client set sshd unbanip 192.168.2.15

Purge quick & dirty

systemctl stop fail2ban
rm -rf /var/lib/nethserver/fail2ban/fail2ban.json
rm -rf /var/lib/fail2ban/fail2ban.sqlite3
systemctl start fail2ban
2025/03/24 15:06

Notes Etherpad

Installation

Voir

Voir aussi :

Notes : Redis a remplacer par Valkey

apt-get install --no-install-recommends supervisor
apt-get install --no-install-recommends npm
apt-get install --no-install-recommends git
apt-get install --no-install-recommends pigz git curl python libssl-dev pkg-config build-essential
 
mkdir -p /opt/etherpad
 
useradd -s /usr/sbin/nologin -r -M -d /opt/etherpad etherpad
# useradd is a low level utility for adding users. On Debian, administrators should usually use adduser(8) instead.
 
cd /opt/etherpad
su -s /bin/bash -l etherpad -c 'git clone https://github.com/ether/etherpad-lite'
 
ln -s $(which nodejs) /usr/local/bin/node

settings.json

  /*when you use NginX or another proxy/ load-balancer set this to true*/
  "trustProxy" : false,
 
  /* This is the path to the Abiword executable. Setting it to null, disables abiword.
     Abiword is needed to advanced import/export features of pads*/
  "abiword" : null,
 
  /* Users for basic authentication. is_admin = true gives access to /admin.
     If you do not uncomment this, /admin will not be available! */
 
  "users": {
    "admin": {
      "password": "P@ssw0rd",
      "is_admin": true
    },
    "user": {
      "password": "P@ssw0rd",
      "is_admin": false
    }
  },
 
  /* Default Pad behavior, users can override by changing */
  "padOptions": {
    "noColors": false,
    "showControls": true,
    "showChat": true,
    "showLineNumbers": true,
    "useMonospaceFont": false,
    "userName": false,
    "userColor": false,
    "rtl": false,
    "alwaysShowChat": false,
    "chatAndUsers": false,
    "lang": "fr-fr"
  },

A changer aussi

$ ~/etherpad-lite/bin/run.sh
[2015-09-12 17:31:58.565] [WARN] console - DirtyDB is used. This is fine for testing but not recommended for production.
apt-get install --no-install-recommends redis-server
service redis-server start

settings.json

  "dbType" : "redis",
 
 //the database specific settings
  "dbSettings" : {
      "host"        : "localhost",
      "port"        : 6379,
      "database"    : 0
  },
apt-get install --no-install-recommends abiword

settings.json

  /* This is the path to the Abiword executable. Setting it to null, disables abiword.
     Abiword is needed to advanced import/export features of pads*/
  "abiword" : "/usr/bin/abiword",

Docker

plugin

WORKDIR /src/etherpad
# Install dependencies RUN bin/installDeps.sh
RUN npm install sqlite3
# Add the settings ADD config/ /src/etherpad/
# Install plugins RUN npm install \
    ep_headings \
    ep_monospace_default \
    ep_print

https://github.com/ether/etherpad-docker

/etc/supervisor/supervisord.conf

[supervisord]
nodaemon=true
 
[unix_http_server]
file=/var/run//supervisor.sock
chmod=0700
 
[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
 
[supervisorctl]
serverurl=unix:///var/run//supervisor.sock
 
[program:redis]
user=root
command=service redis-server start
autostart=true
autorestart=true
 
 
[program:etherpad]
directory=/opt/etherpad/etherpad-lite
command=node node_modules/ep_etherpad-lite/node/server.js
user=etherpad
autostart=true
autorestart=true
docker run -d -p 9001:9001 -v /srv/docker/etherpad/redis:/var/lib/redis etherpad bash -c "service redis-server start ; su -s /bin/bash -l etherpad -c /opt/etherpad/etherpad-lite/bin/run.sh"
docker ps -a
docker commit 6417ee8095da etherpad
docker run -ti -p 9001:9001 etherpad
service redis start
su -s /bin/bash -l etherpad
~/etherpad-lite/bin/run.sh
update-rc.d redis-server defaults
service redis-server start

Pb conversion en ODT

[2015-09-12 18:19:45.935] [ERROR] console - Abiword File failed to convert [Error: Abiword died with exit code null]
Error: Abiword died with exit code null
    at module.exports (/opt/etherpad/etherpad-lite/src/node_modules/async-stacktrace/ERR.js:46:13)
    at /opt/etherpad/etherpad-lite/src/node/handler/ExportHandler.js:224:36
    at /opt/etherpad/etherpad-lite/src/node_modules/async/lib/async.js:254:17
    at /opt/etherpad/etherpad-lite/src/node_modules/async/lib/async.js:151:21
    at /opt/etherpad/etherpad-lite/src/node_modules/async/lib/async.js:251:21
    at Object.callback (/opt/etherpad/etherpad-lite/src/node_modules/async/lib/async.js:615:34)
    at stdoutCallback (/opt/etherpad/etherpad-lite/src/node/utils/Abiword.js:135:14)
    at ChildProcess.<anonymous> (/opt/etherpad/etherpad-lite/src/node/utils/Abiword.js:94:7)
    at ChildProcess.emit (events.js:98:17)
    at Process.ChildProcess._handle.onexit (child_process.js:809:12)

Démarrage automatique avec systemd

/etc/systemd/system/etherpad.service

[Unit]
Description=Etherpad container
After=docker.service
Requires=docker.service
 
[Service]
TimeoutStartSec=0
ExecStartPre=-/usr/bin/docker stop -t 2 etherpad1
ExecStartPre=-/usr/bin/docker rm -f etherpad1
ExecStart=/usr/bin/docker run -d -p 9001:9001 -v /srv/docker/etherpad/ep_fileupload/upload:/opt/etherpad/etherpad-lite/node_modules/ep_fileupload/upload -v /srv/docker/etherpad/redis:/var/lib/redis --name etherpad1 etherpad supervisord -c /etc/supervisor/supervisord.conf -n
RestartSec=20s
Type=notify
NotifyAccess=all
TimeoutStartSec=120
TimeoutStopSec=25
KillMode=process
 
[Install]
WantedBy=multi-user.target
systemctl daemon-reload
systemctl enable etherpad.service
systemctl start etherpad

Plugin

# Ajout un menu dans /admin contenant la liste des pads, date dernière modification, nombre d'utilisateur connecté au pad
ep_adminpad

# Affiche le nom de l'auteur au survol du pointeur sur le texte
ep_authornames

# Plus d'avertissement pour effacer les couleurs identifiant les auteurs
ep_clear_authorship_no_prompt

## DEPEND DE ep_page_view
# Permet de laisser des commentaires en marge de la page
ep_comments_page

# Afficher les images (passées en URL)
# MARCHE AVEC ep_fileupload
ep_previewimages

# Copier-coller des images
ep_copy_paste_images

# De pas garder les pads jamais edités
ep_delete_empty_pads

# Ajoute titre 1er niveau, 2em niveau etc...
ep_headings

# Pour faire des lignes horizontales
ep_horizontal_line

# Créer /list contenant la liste des pads
ep_padlist

# Ajoute un mode page
ep_page_view

# Insertion caractère spéciaux
ep_special_characters

# Diff
ep_timesliderdiff

# Ajout option pour désactiver le retour à la ligne automatique
ep_wrap

settings.json

// Display comments as icons, not boxes
"ep_comments_page": {
  "displayCommentAsIcon": true
},

FIXME /opt/etherpad/etherpad-lite/node_modules/ep_fileupload/upload

Script déploiement Etherpad via Docker

#! /bin/bash
 
mkdir -p /srv/docker/etherpad/ep_fileupload/upload
mkdir -p /srv/docker/etherpad/redis
chmod 777 -R /srv/docker
 
zcat etherpad.tar.gz | docker load
 
cat <<EOF >/etc/systemd/system/etherpad.service
[Unit]
Description=Etherpad container
After=docker.service
Requires=docker.service
 
[Service]
TimeoutStartSec=0
ExecStartPre=-/usr/bin/docker stop -t 2 etherpad1
ExecStartPre=-/usr/bin/docker rm -f etherpad1
ExecStart=/usr/bin/docker run -d -p 9001:9001 -v /srv/docker/etherpad/ep_fileupload/upload:/opt/etherpad/etherpad-lite/node_modules/ep_fileupload/upload -v /srv/docker/etherpad/redis:/var/lib/redis --name etherpad1 etherpad supervisord -c /etc/supervisor/supervisord.conf -n
RestartSec=20s
Type=notify
NotifyAccess=all
TimeoutStartSec=120
TimeoutStopSec=25
KillMode=process
 
[Install]
WantedBy=multi-user.target
EOF
 
systemctl daemon-reload
systemctl enable etherpad.service
systemctl start etherpad

Liste des pad (requette en base Redis)

redis-cli keys 'pad:*' |grep -Eo '^pad:[^:]+' |sed -e 's/pad://' |sort |uniq -c |sort -rn |awk '{if ($1!="2") {print $2 }}'
2025/03/24 15:06

Notes etcd

Voir aussi :

Intro

Install

Config

Droits

Exemples basiques

Lancement

etcd

Connexion

etcdctl --endpoints http://127.0.0.1:2379 get /

Put

etcdctl put greeting "Hello, etcd"

Get

ETCDCTL_API=3 etcdctl get greeting
etcdctl get foo --print-value-only
etcdctl get --prefix --rev=4 foo
etcdctl watch foo --hex
etcdctl --no-sync --peers https//plop1.lan:10835,https//plop2.lan:10836 -u username:password ls /
 
alias e='etcdctl --ca-file ~/compose_etcd.pk --no-sync --peers https://aws-us-east-1-portal10.dblayer.com:10835,https://aws-us-east-1-portal11.dblayer.com:27265 -u root:*********'
etcdctl mk x 3
etcdctl mk y 123
etcdctl ls
etcdctl get /y
etcdctl set new 6
etcdctl set d/a 4
etcdctl set d/b 5
etcdctl ls d
etcdctl rm --recursive d
 
# TTL of 5 seconds
etcdctl mk e 4 --ttl "5"
export ETCDCTL_API=3
export ETCDCTL_ENDPOINTS=$(minikube service example-etcd-cluster-client-service --url)

backup (cluster & local) Voir https://etcd.io/docs/v3.5/op-guide/recovery/

ETCDCTL_API=3 etcdctl --endpoints $ENDPOINT snapshot save snapshot.db #--cacert /etc/ssl/etcd/ca.crt --cert /etc/ssl/etcd/client.crt --key /etc/ssl/etcd/client.key

Verify the snapshot:

ETCDCTL_API=3 etcdctl --write-out=table snapshot status snapshotdb

Restore (local)

ETCDCTL_API=3 etcdctl snapshot restore snapshot.db

grpc-proxy

etcd grpc-proxy start --endpoints=infra0.example.com,infra1.example.com,infra2.example.com --listen-addr=127.0.0.1:2379

Tuning

IO

# best effort, highest priority
sudo ionice -c2 -n0 -p `pgrep etcd`

CPU

echo performance | tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

Diag

sudo chown -R etcd:etcd /var/lib/etcd
sudo systemctl start etcd

List the cluster member:

etcdctl --endpoints=http://${NODE1}:2379 member list

Client API Python

Autre

pas de type list ?

Voir https://github.com/ake-persson/etcdtool

etcd doesn't support list's, this is handled by using the index as the key:

JSON Input:

{
    "users": [
        { "username": "jblack", "first_name": "John", "last_name": "Blackbeard" },
        { "username": "ltrier", "first_name": "Lars", "last_name": "Von Trier" }
    ]
}

Result in etcd:

users/0/username: jblack
users/0/first_name: John
users/0/last_name: Blackbeard
users/1/username: ltrier
users/1/first_name: Ludwig
users/1/last_name: Von Treimer
2025/03/24 15:06

Notes Elasticsearch Logstash Kibana

Notes perso

Elasticsearch

Config

/etc/elasticsearch/jvm.options.d/mem.options

-Xms512m
-Xmx512m

Sécurité : Voir : https://www.elastic.co/guide/en/elasticsearch/reference/7.12/security-minimal-setup.html

/etc/elasticsearch/elasticsearch.yml

xpack.security.enabled: true

Attention, cette commande ne peut s’exécuter qu'une seule fois !

/usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto

Logstash

Voir aussi :

  • Filebeat
  • Fluentd
Config

Conf Java Mem

/etc/logstash/jvm.options

## JVM configuration

# Xms represents the initial size of total heap space
# Xmx represents the maximum size of total heap space

#-Xms1g
#-Xmx1g
-Xms512m
-Xmx512m

Exemple Nginx

Voir : https://www.elastic.co/guide/en/logstash/7.9/logstash-config-for-filebeat-modules.html#parsing-nginx

Note : préférer Filebeat

/etc/logstash/conf.d/nginx-exemple.conf

input {
 file {
   path => ["/var/log/nginx/access.log", "/var/log/nginx/error.log"]
   type => "nginx"
 }
}
filter {
  if [fileset][module] == "nginx" {
    if [fileset][name] == "access" {
      grok {
        match => { "message" => ["%{IPORHOST:[nginx][access][remote_ip]} - %{DATA:[nginx][access][user_name]} \[%{HTTPDATE:[nginx][access][time]}\] \"%{WORD:[nginx][access][method]} %{DATA:[nginx][access][url]} HTTP/%{NUMBER:[nginx][access][http_version]}\" %{NUMBER:[nginx][access][response_code]} %{NUMBER:[nginx][access][body_sent][bytes]} \"%{DATA:[nginx][access][referrer]}\" \"%{DATA:[nginx][access][agent]}\""] }
        remove_field => "message"
      }
      mutate {
        add_field => { "read_timestamp" => "%{@timestamp}" }
      }
      date {
        match => [ "[nginx][access][time]", "dd/MMM/YYYY:H:m:s Z" ]
        remove_field => "[nginx][access][time]"
      }
      useragent {
        source => "[nginx][access][agent]"
        target => "[nginx][access][user_agent]"
        remove_field => "[nginx][access][agent]"
      }
      geoip {
        source => "[nginx][access][remote_ip]"
        #target => "[nginx][access][geoip]"
      }
    }
    else if [fileset][name] == "error" {
      grok {
        match => { "message" => ["%{DATA:[nginx][error][time]} \[%{DATA:[nginx][error][level]}\] %{NUMBER:[nginx][error][pid]}#%{NUMBER:[nginx][error][tid]}: (\*%{NUMBER:[nginx][error][connection_id]} )?%{GREEDYDATA:[nginx][error][message]}"] }
        remove_field => "message"
      }
      mutate {
        rename => { "@timestamp" => "read_timestamp" }
      }
      date {
        match => [ "[nginx][error][time]", "YYYY/MM/dd H:m:s" ]
        remove_field => "[nginx][error][time]"
      }
    }
  }
}
output {
  elasticsearch {
    hosts => localhost
 
    #user => elastic
    #password => PassWord
 
    #manage_template => false
    #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    index => "logstash-plop-%{+YYYY.MM.dd}"
  }
#  stdout { codec => rubydebug }
}
Debug
su - logstash -s /bin/bash
 
# Validation de la conf / vérif de la syntax
/usr/share/logstash/bin/logstash --config.test_and_exit --path.settings /etc/logstash -f /etc/logstash/conf.d/plop.conf -f
 
# Debug
/usr/share/logstash/bin/logstash --debug --path.settings /etc/logstash -f /etc/logstash/conf.d/plop.conf -f
Autres

Notes en vrac

file {
	path => "/var/log/apache2/apache.log"
	start_position => "beginning"
	type => "apache"
}

elasticksearch

-p 9200-e discovery.type=single-node

Kibana

Nginx reverse proxy

/etc/nginx/sites-available/kibana.acme.fr

server {
        server_name kibana.acme.fr;
 
        root /var/www/html;
 
        location / {
                proxy_pass http://127.0.0.1:5601;
                include /etc/nginx/proxy_params;
                client_max_body_size 10M;
 
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_cache_bypass $http_upgrade;
        }
 
    access_log /var/log/nginx/kibana.acme.fr.log;
    error_log /var/log/nginx/kibana.acme.fr.err;
 
    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/kibana.acme.fr/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/kibana.acme.fr/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
 
server {
    if ($host = kibana.acme.fr) {
        return 301 https://$host$request_uri;
    } # managed by Certbot
 
 
        listen 80;
        listen [::]:80;
 
        server_name kibana.acme.fr;
    return 404; # managed by Certbot
}
Sécurité

/etc/kibana/kibana.yml

elasticsearch.username: "elastic"
/usr/share/kibana/bin/kibana-keystore create
/usr/share/kibana/bin/kibana-keystore add elasticsearch.password

Filebeat

Voir aussi fluentd

Dans certain cas, remplace Logstash

filebeat.yml

output.elasticsearch:
  hosts: ["http://localhost:9200"]
  username: "elastic" 
  password: "P@ssw0rd" 

setup.kibana:
  host: "http://localhost:5601"
filebeat modules enable system nginx
filebeat setup
filebeat -e

Il suffit de chercher des Dashboard commençant par “[Filebeat System]” et [Filebeat Nginx]“ pour avoir déjà une conf prête à l'emploi

Brouillons
filebeat setup -e \
  -E output.logstash.enabled=false \
  -E output.elasticsearch.hosts=['localhost:9200'] \
  -E output.elasticsearch.username=filebeat_internal \
  -E output.elasticsearch.password=YOUR_PASSWORD \
  -E setup.kibana.host=localhost:5601
 
 
filebeat setup -e \
        -E 'setup.template.overwrite=true' \
        -E 'setup.kibana.host="localhost:5601"' \
        -E 'output.logstash.enabled=false' \
        -E 'output.elasticsearch.hosts=["localhost:9200"]'
 
filebeat keystore create
#filebeat keystore add ES_PWD
filebeat keystore add elastic
filebeat keystore list

FIXME

2025/03/24 15:06

Notes écran tactile touch screen

Voir :

Pb écran tactile

apt-get install xinput-calibrator xinput
export DISPLAY=:0
 
ID=$(xinput list --id-only "eGalax Inc. USB TouchController")
 
SCREEN=$(xrandr 2>&1|grep -e ' connected primary' | awk '{print $1}')
 
#xinput --map-to-output 11 DVI-D-0
xinput --map-to-output $ID $SCREEN
xinput list-props "eGalax Inc. USB TouchController" |grep -e "Coordinate Transformation Matrix"
        Coordinate Transformation Matrix (155): 0.000000, 0.375000, 0.000000, -1.000000, 0.000000, 1.000000, 0.000000, 0.000000, 1.000000
xinput_calibrator -v --device "eGalax Inc. USB TouchController"

https://askubuntu.com/questions/41385/cannot-calibrate-touchscreen

Persistance

/usr/local/bin/touchscreencfg.sh

#! /bin/bash
 
export DISPLAY=:0
 
NAME=$(xinput list  --name-only |grep -i -e touch | grep -iv -e ' pen')
ID=$(xinput list --id-only "$NAME")
SCREEN=$(xrandr 2>&1 |grep -e ' connected primary' |awk '{print $1}')
/usr/bin/xinput --map-to-output $ID $SCREEN
( sleep 5 ; /usr/bin/xinput --map-to-output $ID $SCREEN ) &
chmod +x /usr/local/bin/touchscreencfg.sh

~/.xsessionrc

/usr/local/bin/touchscreencfg.sh

Pb

Pb persistance sur débranchement ou extinction de l'écran

Notes en vrac - pb débranchement retranchement extinction écran - perte orientation touchscreen

Voir :

68.624] (II) NVIDIA(0): Setting mode "DVI-D-0: nvidia-auto-select @768x1024 +0+0 {ViewPortIn=768x1024, ViewPortOut=1024x768+0+0, Rotation=270}"
modprobe evdev
modprobe usbtouchscreen usbhid
 
cat /proc/bus/input/devices
 
echo Y >  /sys/module/usbtouchscreen/parameters/swap_xy

Enable the Touchscreen in Lightdm (the login screen)

  copy ~/.config/monitors.xml to /var/lib/lightdm/.config
xinput_calibrator --device "Elo Touch Solutions Elo Touch Solutions Pcap USB Interface"  --output-type xorg.conf.d --no-timeout
Calibrating EVDEV driver for "Elo Touch Solutions Elo Touch Solutions Pcap USB Interface" id=8
        current calibration values (from XInput): min_x=0, max_x=4095 and min_y=0, max_y=4095

Doing dynamic recalibration:
        Setting calibration data: 1, 4064, -19, 4082
        --> Making the calibration permanent <--
  copy the snippet below into '/etc/X11/xorg.conf.d/99-calibration.conf' (/usr/share/X11/xorg.conf.d/ in some distro's)
Section "InputClass"
        Identifier      "calibration"
        MatchProduct    "Elo Touch Solutions Elo Touch Solutions Pcap USB Interface"
        Option  "Calibration"   "1 4064 -19 4082"
        Option  "SwapAxes"      "0"
EndSection

/etc/X11/xorg.conf.d/99-calibration.conf

Section "InputClass"
        Identifier      "calibration"
        MatchProduct    "Elo Touch Solutions Elo Touch Solutions Pcap USB Interface"
        Option  "Calibration"   "44 4061 4081 -44"
        Option  "SwapAxes"      "1"
        Option "InvertX"        "0"
        Option "InvertY"        "0"
EndSection
Matrix

https://gist.github.com/mildmojo/48e9025070a2ba40795c#file-rotate_desktop-sh-L41

https://github.com/swkim01/waveshare-dtoverlays

xinput list-props "Elo Touch Solutions Elo Touch Solutions Pcap USB Interface" |grep Matrix
        Coordinate Transformation Matrix (155): 1.000000, 0.000000, 0.000000, 0.000000, 1.000000, 0.000000, 0.000000, 0.000000, 1.000000
	
Option "TransformationMatrix" "1 0 0 0 1 0 0 0 1"
Troubleshooting
sudo apt-get install -y evtest

Notes

https://askubuntu.com/questions/253395/touchscreen-calibration-with-dual-monitors-nvidia-and-xinput

https://wiki.archlinux.org/index.php/Calibrating_Touchscreen

Do it automatically via a udev rule

Create a file something like /etc/udev/rules.d/99-acer-touch.rules with contents like this:

ENV{ID_VENDOR_ID}=="2149",ENV{ID_MODEL_ID}=="2703",ENV{WL_OUTPUT}="DVI1",ENV{LIBINPUT_CALIBRATION_MATRIX}="1 0 0  0 1 0"

LXQt

~/.config/autostart/lxqt-config-touchpad-autostart.desktop

[Desktop Entry]
Comment=Autostart touchpad settings for lxqt-config-input
Exec=lxqt-config-input --load-touchpad
Name=lxqt-config-touchpad-autostart
OnlyShowIn=LXQt
Type=Application
Version=1.0
2025/03/24 15:06
blog.txt · Dernière modification : de 127.0.0.1

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki