miscellaneoud edits
This commit is contained in:
reaction.la
parent
320f5bd962
commit
9ce5bfc939
BIN
docs/images/gpt_partitioned_linux_disk.webp
Normal file
BIN
docs/images/gpt_partitioned_linux_disk.webp
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
BIN
docs/images/msdos_linux_partition.webp
Normal file
BIN
docs/images/msdos_linux_partition.webp
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 19 KiB |
@ -445,7 +445,25 @@ environment without MSVC present.
|
||||
choco install mingw pandoc git vscode gpg4win -y
|
||||
```
|
||||
|
||||
That Cmake does not really work all that well with the MSVC environment. If we eventually take the CMake path, it will be after wc and build on MingGW, not before.
|
||||
Cmake does not really work all that well with the MSVC environment.\
|
||||
If we eventually take the CMake path, it will be after wc and build on
|
||||
MingGW, not before.
|
||||
|
||||
## vscode
|
||||
|
||||
Vscode has taken the correct path, for one always winds up with a full
|
||||
language and full program running the build from source, and they went
|
||||
with javascript. Javascript is an unworkable language that falls apart on
|
||||
any large complex program, but one can use typescript which compiles to javascript.
|
||||
|
||||
A full language is needed to govern the compile from source of a large
|
||||
complex program - and none of the ad hoc languages have proven very useful.
|
||||
|
||||
So, I now belatedly conclude the correct path is to build everthing under vscode.
|
||||
|
||||
On the other hand, the central attribute of both the makefile language and
|
||||
the cmake language is dependency scanning, and we shall have to see how
|
||||
good vscode's toolset is at this big central job.
|
||||
|
||||
## The standard Linux installer
|
||||
|
||||
|
||||
@ -1,3 +1,3 @@
|
||||
body {
|
||||
font-size: 85%;
|
||||
font-size: 100%;
|
||||
}
|
||||
|
||||
@ -15,6 +15,13 @@ that frequently strange and overcomplicated design decisions are made,
|
||||
decisions), decisions whose only apparent utility is to provide paths for
|
||||
hostile organizations to exploit subtle, complex, and unobvious security holes.
|
||||
|
||||
McAffee reported that this is a result of plants - the state plants engineers
|
||||
in nominally private organizations to create backdoors. Shortly after he
|
||||
reported this he was arrested and murdered by the US government. (To be
|
||||
precise he was arrested at the instigation of the US government, and then
|
||||
"mysteriously" murdered while in prison. Prison murders remain
|
||||
"mysterious" only if carried out by the state.)
|
||||
|
||||
These holes are often designed so that they can only be utilized efficiently
|
||||
by a huge organization with a huge datacentre that collects enormous
|
||||
numbers of hashes and enormous amounts of data, and checks enormous
|
||||
|
||||
@ -2,6 +2,29 @@
|
||||
title:
|
||||
Set up build environments
|
||||
...
|
||||
|
||||
# partitioning for linux
|
||||
|
||||
For a gpt partition table, sixteen MiB fat32 partition with boot and efi flags
|
||||
set, one gigabyte linux swap, and the rest your ext4 root file system.
|
||||
|
||||
With an efi-gpt partition table, efi handles multiboot, so if you have
|
||||
windows, going to need a biggger boot-efi partition. (grub takes a bit over
|
||||
four MiB)
|
||||
|
||||
For an ms-dos (non efi) partition table, fivehundred and twelve MIB ext4
|
||||
partition with the boot flag set, (linux uses 220 MiB) one gigabyte linux swap,
|
||||
and the rest your ext4 root file system.
|
||||
|
||||
In `gparted' an msdos partition table for a linux system should look
|
||||
something like this
|
||||
|
||||
|
||||
|
||||
And a gpt partition table for a linux system should look something like this
|
||||
|
||||
|
||||
|
||||
# Virtual Box
|
||||
|
||||
To build a cross platform application, you need to build in a cross
|
||||
@ -45,6 +68,8 @@ the OS in ways the developers did not anticipate.
|
||||
|
||||
## Setting up Debian in Virtual Box
|
||||
|
||||
### Guest Additions
|
||||
|
||||
To install guest additions on Debian:
|
||||
|
||||
```bash
|
||||
@ -65,9 +90,7 @@ system updates in the background, the system will not shut
|
||||
down correctly, and guest additions has to be reinstalled with a
|
||||
`shutdown -r`. Or copy and paste mysteriously stops working.
|
||||
|
||||
On Debian lightdm mate go to system/ control center/ Look and Feel/ Screensaver and turn off the screensaver screen lock
|
||||
|
||||
Go to go to system / control center/ Hardware/ Power Management and turn off the computer and screen sleep.
|
||||
### auto gui login
|
||||
|
||||
To set automatic login on lightdm-mate
|
||||
|
||||
@ -91,23 +114,33 @@ autologin-user=cherry
|
||||
autologin-user-timeout=0
|
||||
```
|
||||
|
||||
### grub timeout
|
||||
|
||||
```bash
|
||||
nano /etc/default/grub
|
||||
```
|
||||
|
||||
### autostart preferred programs
|
||||
|
||||
To set things to autostart on gui login under Mate and KDE Plasma create
|
||||
the directory `~/.config/autostart` and copy the appropriate `*.desktop`
|
||||
files into it from `/usr/share/applications` or
|
||||
`~/.local/share/applications`.
|
||||
|
||||
### Don't let the screen saver log you out.
|
||||
|
||||
On Debian lightdm mate go to system/ control center/ Look and Feel/ Screensaver and turn off the screensaver screen lock
|
||||
|
||||
Go to go to system / control center/ Hardware/ Power Management and turn off the computer and screen sleep.
|
||||
|
||||
### setup ssh server
|
||||
|
||||
In the shared directory, I have a copy of /etc and ~.ssh ready to roll, so I just go into the shared directory copy them over, `chmod` .ssh and reboot.
|
||||
|
||||
On the source machine
|
||||
|
||||
```bash
|
||||
scp -r .ssh «destination»:~
|
||||
scp -r etc «destination»:/
|
||||
chmod 700 ~/.ssh && chmod 600 ~/.ssh/*
|
||||
```
|
||||
|
||||
On the destination machine
|
||||
|
||||
```bash
|
||||
chmod 700 .ssh && chmod 600 .ssh/*
|
||||
```
|
||||
|
||||
I cannot do it all from within the destination machine, because linux cannot follow windows symbolic links.
|
||||
|
||||
### Set the hostname
|
||||
|
||||
check the hostname and dns domain name with
|
||||
@ -119,8 +152,9 @@ hostname && domainname -s && hostnamectl status
|
||||
And if need be, set them with
|
||||
|
||||
```bash
|
||||
domainname -b reaction.la
|
||||
hostnamectl set-hostname reaction.la
|
||||
fn=reaction.la
|
||||
domainname -b $fn
|
||||
hostnamectl set-hostname $fn
|
||||
```
|
||||
|
||||
Your /etc/hosts file should contain
|
||||
@ -152,22 +186,137 @@ ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key
|
||||
Note that visual studio remote compile requires an `ecdsa-sha2-nistp256` key on the host machine that it is remote compiling for. If it is nist, it is
|
||||
backdoored
|
||||
|
||||
### .bashrc
|
||||
|
||||
If the host has a domain name, the default in `/etc/bash.bashrc` will not display it in full at the prompt, which can lead to you being confused about which host on the internet you are commanding.
|
||||
|
||||
```bash
|
||||
nano /etc/bash.bashrc
|
||||
```
|
||||
|
||||
Change the lower case `h` in ` PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ '` to an upper case `H`
|
||||
Change the lower case `h` in `PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ '` to an upper case `H`
|
||||
|
||||
```text
|
||||
PS1='${debian_chroot:+($debian_chroot)}\u@\H:\w\$ '
|
||||
```
|
||||
|
||||
And, similarly, in two places in `etc/skel/.bashrc` Also
|
||||
I also like the bash aliases:
|
||||
|
||||
```text
|
||||
alias ll="ls -hal"
|
||||
mkcd() { mkdir -p "$1" && cd "$1"; }
|
||||
```
|
||||
|
||||
Setting them in `/etc/bash.bashrc` sets them for all users, including root. But the default `~/.bashrc` is apt to override the change of `H` for `h` in `PS1`
|
||||
|
||||
## Virtual disks
|
||||
|
||||
The first virtual disk attached to a virtual machine is `/dev/sda`, the second
|
||||
is `/dev/sdb`, and so on and so forth.
|
||||
|
||||
Be warned that the default debian setup, when it encounters multiple
|
||||
partitions that map to the same mount points is apt to make surprising and
|
||||
seemingly random decisions as to which partitions to mount to what.
|
||||
|
||||
So cheerfully attaching one linux disk to another linux system so that you
|
||||
can manipulate one system with the other may well have surprising,
|
||||
unexpected, and highly undesirable results.
|
||||
|
||||
What decisions it has in fact made are revealed by `lsblk`
|
||||
|
||||
So when you attach a foreign linux disk to another linux system, attach
|
||||
after it has booted, and detach when you are done, to ensure predictable
|
||||
and expected behavior.
|
||||
|
||||
The first partition on the first virtual disk is `/dev/sda1`, the third partition
|
||||
on the second virtual disk is `/dev/sdb3`, and so on and so forth.
|
||||
|
||||
Dynamic virtual disks in virtual box can be resized, and copied to a
|
||||
different (larger size)
|
||||
|
||||
Confusingly, the documentation and the UI does not distinguish between
|
||||
dynamic and fixed sized virtual disks - so the UI to change a fixed sized
|
||||
disks size, or to copy it to a disk of different size is there, but has
|
||||
absolutely no effect.
|
||||
|
||||
Having changed the virtual disk size in the host system, you then want to
|
||||
change the partition sizes using gparted, which requires the virtual disk to
|
||||
be attached, but not mounted, to another guest virtual machine in which
|
||||
you will run `gparted`.
|
||||
|
||||
Over time, dynamic virtual disks occupy more and more physical storage,
|
||||
because more and more sectors become non zero, even though unused.
|
||||
|
||||
You attach the virtual disk that you want to shrink to another guest OS as
|
||||
`/dev/sdb`, which is attached but not mounted, and, in the other guest OS
|
||||
`zerofree /dev/sdb1` which will zero the free space on partition 1. (And
|
||||
similarly for any other linux file system partitions)
|
||||
|
||||
You run `zerofree`, like gparted, in another in a guest OS, that is mounted
|
||||
on `/dev/sda` while the disk whose partitions you are zeroing is attached,
|
||||
but not mounted, as `/dev/sdb1`.
|
||||
|
||||
You can then shrink it in the host OS with
|
||||
|
||||
```bash
|
||||
cp -rv ~/.ssh /etc/skel
|
||||
VBoxManage modifyhd -compact thediskfile.vdi`
|
||||
```
|
||||
or make a copy that will be smaller than the original.
|
||||
|
||||
To resize a fixed sized disk you have to make a dynamic copy, then run
|
||||
gparted (on the other guest OS, you don't want to muck with a mounted
|
||||
file system using gparted, it is dangerous and broken) to shrink the
|
||||
partitions if you intend to shrink the virtual disk, resize the dynamic copy
|
||||
in the host OS, then, if you expanded the virtual disk run gparted to expand
|
||||
the partitions.
|
||||
|
||||
To modify the size of a guest operating system virtual disk, you need that
|
||||
OS not running, and two other operating systems, the host system and a
|
||||
second guest operating system. You attach, but not mount, the disk to a
|
||||
second guest operating system so that you can run zerofree and gparted in
|
||||
that guest OS.
|
||||
|
||||
And now that you have a dynamic disk that is a different size, you can
|
||||
create a fixed size copy of it using virtual media manager in the host
|
||||
system. This, however, is an impractically slow and inefficient process for
|
||||
any large disk. For a one terabyte disk, takes a couple of days, a day or
|
||||
so to initialize the new virtual disk, during which the progress meter shows
|
||||
zero progress, and another day or so to do actually the copy, during which
|
||||
the progress meter very slowly increases.
|
||||
|
||||
For big disk images, it is a whole lot faster to create a new system, attach
|
||||
the old system to it, mount the old system, and copy the files that you care about.
|
||||
|
||||
To list block devices `lsblk`.
|
||||
|
||||
To mount an attached disk, create an empty directory, normally under
|
||||
`mnt`, and `mount /dev/sdb3 /mnt/newvm`
|
||||
|
||||
For example:
|
||||
|
||||
```terminal_image
|
||||
root@example.com:~# lsblk
|
||||
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
|
||||
sda 8:0 0 24G 0 disk
|
||||
├─sda1 8:1 0 23G 0 part /
|
||||
├─sda2 8:2 0 1K 0 part
|
||||
└─sda5 8:5 0 975M 0 part [SWAP]
|
||||
sdb 8:16 0 46G 0 disk
|
||||
├─sdb1 8:17 0 36M 0 part
|
||||
├─sdb2 8:18 0 45G 0 part
|
||||
└─sdb3 8:19 0 1G 0 part
|
||||
sr0 11:0 1 484M 0 rom
|
||||
root@example.com:~# mkdir -p /mnt/sdb2
|
||||
root@example.com:~# mount /dev/sdb2 /mnt/sdb2
|
||||
root@example.com:~# ls -hal /mnt/sdb2
|
||||
drwxr-xr-x 20 root root 4.0K Dec 12 06:55 .
|
||||
drwxr-xr-x 5 root root 4.0K Dec 20 16:02 ..
|
||||
drwxr-xr-x 4 root root 4.0K Dec 12 06:27 dev
|
||||
drwxr-xr-x 119 root root 4.0K Dec 20 12:58 etc
|
||||
drwxr-xr-x 3 root root 4.0K Dec 12 06:32 home
|
||||
drwxr-xr-x 3 root root 4.0K Dec 12 06:27 media
|
||||
drwxr-xr-x 2 root root 4.0K Dec 12 06:27 mnt
|
||||
drwxr-xr-x 11 root root 4.0K Dec 12 06:27 var
|
||||
```
|
||||
|
||||
# Actual server
|
||||
@ -186,32 +335,16 @@ issue the command `visudo` and edit the sudoers file to contain the line:
|
||||
cherry ALL=(ALL) NOPASSWD:ALL
|
||||
```
|
||||
|
||||
That user can now sudo any root command, with no password login nor ssh in for root. And can also get into the root shell with `sudo su -l root`
|
||||
|
||||
On an actual server, you may want to totally disable passwords to
|
||||
accounts that have sensitive information by corrupting the shadow file
|
||||
|
||||
```bash
|
||||
usermod -L cherry
|
||||
```
|
||||
|
||||
But this tactic is very risky, because it can, due to bug in Linux, disable
|
||||
ssh public key login. And then you are really hosed. Better to use a very
|
||||
long random password, and then throw it away.
|
||||
|
||||
When an account is disabled in this manner, you cannot login at the
|
||||
terminal, and may be unable to ssh in, but you can still get into it by
|
||||
`su -l cherry` from the root account. And if you have disabled the root account,
|
||||
but have enabled passwordless sudo for one special user, you can still get
|
||||
into the root account with `sudo -s` or `sudo su -l root` But if you disable
|
||||
the root account in this manner without creating an account that can sudo
|
||||
into root passwordless, you are hosed big time. So instead, once `ssh` is
|
||||
working, give one user passwordless sudo, make sure you can ssh into that
|
||||
account, and disable password and ssh access to the root account.
|
||||
|
||||
You can always undo the deliberate corruption by setting a new password,
|
||||
providing you can somehow get into root.
|
||||
That user can now sudo any root command, with no password login nor
|
||||
ssh in for root. And can also get into the root shell with `sudo su -l root`
|
||||
|
||||
On an actual server, you may want to totally disable passwords to accounts
|
||||
that have sensitive information. Unfortunately any method for totally
|
||||
disabling passwords is likely to totally disable ssh login, because the
|
||||
people writing the software have "helpfully" decided that that is what you
|
||||
probably intended, even though it is seldom what people want, intend, or
|
||||
expect . So the nearest thing you can do is set a long, random, non
|
||||
memorable password, and forget it.
|
||||
|
||||
## never enough memory
|
||||
|
||||
@ -426,7 +559,7 @@ I make sure auto login works, which enables me to make `ssh` do all sorts of
|
||||
things, then I disable ssh password login, restrict the root login to only be
|
||||
permitted via ssh keys.
|
||||
|
||||
In order to do this, open up the SSHD config file (which is ssh daemon
|
||||
In order to do this, open up the `sshd_config` file (which is ssh daemon
|
||||
config, not ssh_config. If you edit this into the the ssh_config file
|
||||
everything goes to hell in a handbasket. ssh_config is the global
|
||||
.ssh/config file):
|
||||
@ -438,22 +571,18 @@ nano /etc/ssh/sshd_config
|
||||
Your config file should have in it
|
||||
|
||||
```default
|
||||
PubkeyAuthentication yes
|
||||
ChallengeResponseAuthentication no
|
||||
PrintMotd no
|
||||
PasswordAuthentication no
|
||||
UsePAM no
|
||||
AcceptEnv LANG LC_*
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
PermitRootLogin prohibit-password
|
||||
ChallengeResponseAuthentication no
|
||||
PasswordAuthentication no
|
||||
PubkeyAuthentication yes
|
||||
PermitTunnel yes
|
||||
X11Forwarding yes
|
||||
AllowAgentForwarding yes
|
||||
AllowTcpForwarding yes
|
||||
TCPKeepAlive yes
|
||||
AllowStreamLocalForwarding yes
|
||||
GatewayPorts yes
|
||||
PermitTunnel yes
|
||||
PermitRootLogin prohibit-password
|
||||
|
||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
ciphers chacha20-poly1305@openssh.com
|
||||
macs hmac-sha2-256-etm@openssh.com
|
||||
kexalgorithms curve25519-sha256
|
||||
@ -461,6 +590,11 @@ pubkeyacceptedkeytypes ssh-ed25519
|
||||
hostkeyalgorithms ssh-ed25519
|
||||
hostbasedacceptedkeytypes ssh-ed25519
|
||||
casignaturealgorithms ssh-ed25519
|
||||
|
||||
# no default banner path
|
||||
Banner none
|
||||
PrintMotd no
|
||||
|
||||
# Allow client to pass locale environment variables
|
||||
AcceptEnv LANG LC_*
|
||||
|
||||
@ -1765,16 +1899,16 @@ apt -qy install postfix
|
||||
```
|
||||
|
||||
Near the end of the installation process, you will be presented with a window that looks like the one in the image below:
|
||||
{width=100%}
|
||||
{width=100%}
|
||||
If `<Ok>` is not highlighted, hit tab.
|
||||
|
||||
Press `ENTER` to continue.
|
||||
The default option is **Internet Site**, which is preselected on the following screen:
|
||||
{width=100%}
|
||||
{width=100%}
|
||||
Press `ENTER` to continue.
|
||||
|
||||
After that, you’ll get another window to set the domain name of the site that is sending the email:
|
||||
{width=100%}
|
||||
{width=100%}
|
||||
The `System mail name` should be the same as the name you assigned to the server when you were creating it. When you’ve finished, press `TAB`, then `ENTER`.
|
||||
|
||||
You now have Postfix installed and are ready to modify its configuration settings.
|
||||
@ -2871,7 +3005,7 @@ when your subkey expires.
|
||||
```bash
|
||||
save
|
||||
gpg --list-keys --with-subkey-fingerprints --with-keygrip «master key»
|
||||
gpg -a --export-keys «master key»
|
||||
gpg -a --export «master key»
|
||||
gpg -a --export-secret-keys «master key»
|
||||
```
|
||||
|
||||
|
||||
@ -155,6 +155,8 @@ sudo chmod 600 /etc/wireguard/ -R
|
||||
|
||||
## Create WireGuard Server Configuration File
|
||||
|
||||
This configuration file is for two clients, one of which is a bitcoin peer for which port forwarding is provided, and to provide them a nat translated IPv4 address, and an IPv6 address on a random /112 subnet of the vpn servers /64 subnet. Adjust to taste. IPv6 is tricky.
|
||||
|
||||
Use a command-line text editor like Nano to create a WireGuard configuration file on the Debian server. `wg0` will be the network interface name.
|
||||
|
||||
```bash
|
||||
@ -165,6 +167,30 @@ Copy the following text and paste it to your configuration file. You need to use
|
||||
|
||||
The curly braces mean that you do not copy the text inside the curly braces, which is only there for example. You have to substitute your own private key (since everyone now knows this private key), and your own client public key., mutas mutandis.
|
||||
|
||||
```default
|
||||
[Interface]
|
||||
# public key = CHRh92zutofXTapxNRKxYEpxzwKhp3FfwUfRYzmGHR4=
|
||||
Address = 10.10.10.1/24, 2405:4200:f001:13f6:7ae3:6c54:61ab:0001/112
|
||||
ListenPort = 115
|
||||
PrivateKey = iOdkQoqm5oyFgnCbP5+6wMw99PxDb7pTs509BD6+AE8=
|
||||
|
||||
[Peer]
|
||||
PublicKey = rtPdw1xDwYjJnDNM2eY2waANgBV4ejhHEwjP/BysljA=
|
||||
AllowedIPs = 10.10.10.4/32, 2405:4200:f001:13f6:7ae3:6c54:61ab:0009/128
|
||||
|
||||
[Peer]
|
||||
PublicKey = YvBwFyAeL50uvRq05Lv6MSSEFGlxx+L6VlgZoWA/Ulo=
|
||||
AllowedIPs = 10.10.10.8/32, 2405:4200:f001:13f6:7ae3:6c54:61ab:0019/128
|
||||
|
||||
[Peer]
|
||||
PublicKey = XpT68TnsSMFoZ3vy/fVvayvrQjTRQ3mrM7dmyjoWJgw=
|
||||
AllowedIPs = 10.10.10.12/32, 2405:4200:f001:13f6:7ae3:6c54:61ab:0029/128
|
||||
|
||||
[Peer]
|
||||
PublicKey = f2m6KRH+GWAcCuPk/TChzD01fAr9fHFpOMbAcyo3t2U=
|
||||
AllowedIPs = 10.10.10.16/32, 2405:4200:f001:13f6:7ae3:6c54:61ab:0039/128
|
||||
```
|
||||
|
||||
```default
|
||||
[Interface]
|
||||
Address = 10.10.10.1/24
|
||||
@ -278,7 +304,7 @@ The above lines will append `-A` a rule to the end of the`POSTROUTING` chain of
|
||||
|
||||
Like your home router, it means your client system behind the nat has no open ports.
|
||||
|
||||
If you want to open some ports, for example the bitcoin port 8333 so that you can run bitcoin core
|
||||
If you want to open some ports, for example the bitcoin port 8333 so that you can run bitcoin core and the monaro ports.
|
||||
|
||||
```terminal_image
|
||||
NAT table rules
|
||||
@ -286,8 +312,11 @@ NAT table rules
|
||||
:PREROUTING ACCEPT [0:0]
|
||||
:POSTROUTING ACCEPT [0:0]
|
||||
-A POSTROUTING -o eth0 -j MASQUERADE
|
||||
-A PREROUTING -d «123.45.67.89»/32 -i eth0 -p tcp --dport 8333 -j DNAT --to-destination 10.10.10.2:8333
|
||||
-A PREROUTING -d «123.45.67.89»/32 -i eth0 -p udp --dport 8333 -j DNAT --to-destination 10.10.10.2:8333
|
||||
-A PREROUTING -d «123.45.67.89»/32 -i eth0 -p tcp --dport 8333 -j DNAT --to-destination 10.10.10.«5»:8333
|
||||
-A PREROUTING -d «123.45.67.89»/32 -i eth0 -p udp --dport 8333 -j DNAT --to-destination 10.10.10.«5»:8333
|
||||
-A PREROUTING -d «123.45.67.89»/32 -i eth0 -p tcp --dport 18080 -j DNAT --to-destination 10.10.10.«5»:18080
|
||||
-A PREROUTING -d «123.45.67.89»/32 -i eth0 -p tcp --dport 18089 -j DNAT --to-destination 10.10.10.«5»:18089
|
||||
|
||||
COMMIT
|
||||
```
|
||||
|
||||
@ -296,20 +325,28 @@ Then open the corresponding ports in ufw
|
||||
```bash
|
||||
ufw allow in 8333
|
||||
ufw enable
|
||||
ufw status verbose
|
||||
```
|
||||
|
||||
If you have made an error in `/etc/ufw/before6.rules` enable will fail.
|
||||
|
||||
If you have enabled UFW before, then you can use systemctl to restart UFW.
|
||||
|
||||
## Configure forwarding on the Server
|
||||
|
||||
### Allow routing
|
||||
|
||||
By default, UFW forbids packet forwarding. We can allow forwarding for our private network, mutas mutandis.
|
||||
|
||||
```bash
|
||||
ufw route allow in on wg0
|
||||
ufw route allow out on wg0
|
||||
ufw allow in on wg0
|
||||
ufw allow in from 10.10.10.0/24
|
||||
ufw allow in from 2405:4200:f001:13f6:7ae3:6c54:61ab:0001/112
|
||||
ufw allow «51820»/udp
|
||||
ufw allow to «2405:4200:f001:13f6:7ae3:6c54:61ab:1/112»
|
||||
ufw allow to 10.10.10.1/24
|
||||
ufw allow to 2405:4200:f001:13f6:7ae3:6c54:61ab:0001/112
|
||||
```
|
||||
|
||||
As always «...» means that this is an example value, and you need to substitute your actual value. "_Mutas mutandis_" means "changing that which should be changed", in other words, watch out for those «...» .
|
||||
@ -326,6 +363,7 @@ windows, mac, and android clients in the part that is not open.
|
||||
|
||||
`wg0` is the virtual network card that `wg0.conf` specifies. If you called it `«your name».conf` then mutatis mutandis.
|
||||
|
||||
### Enable routing
|
||||
|
||||
You just told ufw to allow your vpn clients to see each other on the internet, but allowing routing does not in itself result in any routing.
|
||||
|
||||
@ -341,6 +379,12 @@ net.ipv4.ip_forward=1
|
||||
net.ipv6.conf.all.forwarding=1
|
||||
```
|
||||
|
||||
For these changes to take effect:
|
||||
|
||||
```bash
|
||||
sysctl -p
|
||||
```
|
||||
|
||||
Now if you list the rules in the POSTROUTING chain of the NAT table by using the following command:
|
||||
|
||||
```bash
|
||||
@ -374,15 +418,26 @@ Sample output:
|
||||
```terminal_image
|
||||
:~$ systemctl status bind9
|
||||
● named.service - BIND Domain Name Server
|
||||
Loaded: loaded (/lib/systemd/system/named.service; enabled; vendor preset: enabled)
|
||||
Active: active (running) since Sun 2020-05-17 08:11:26 UTC; 37s ago
|
||||
Docs: man:named(8)
|
||||
Main PID: 13820 (named)
|
||||
Tasks: 5 (limit: 1074)
|
||||
Memory: 14.3M
|
||||
CPU: 8.709s
|
||||
CGroup: /system.slice/named.service
|
||||
└─13820 /usr/sbin/named -f -u bind
|
||||
Loaded: loaded (/lib/systemd/system/named.service; enabled; vendor preset: enabled)
|
||||
Active: active (running) since Wed 2022-09-21 20:14:33 EDT; 6min ago
|
||||
Docs: man:named(8)
|
||||
Main PID: 1079 (named)
|
||||
Tasks: 5 (limit: 1132)
|
||||
Memory: 16.7M
|
||||
CPU: 86ms
|
||||
CGroup: /system.slice/named.service
|
||||
└─1079 /usr/sbin/named -f -u bind
|
||||
|
||||
Sep 21 20:14:33 rho.la named[1079]: command channel listening on ::1#953
|
||||
Sep 21 20:14:33 rho.la named[1079]: managed-keys-zone: loaded serial 0
|
||||
Sep 21 20:14:33 rho.la named[1079]: zone 0.in-addr.arpa/IN: loaded serial 1
|
||||
Sep 21 20:14:33 rho.la named[1079]: zone 127.in-addr.arpa/IN: loaded serial 1
|
||||
Sep 21 20:14:33 rho.la named[1079]: zone 255.in-addr.arpa/IN: loaded serial 1
|
||||
Sep 21 20:14:33 rho.la named[1079]: zone localhost/IN: loaded serial 2
|
||||
Sep 21 20:14:33 rho.la named[1079]: all zones loaded
|
||||
Sep 21 20:14:33 rho.la named[1079]: running
|
||||
Sep 21 20:14:33 rho.la named[1079]: managed-keys-zone: Initializing automatic trust anchor management for zone '.'; >
|
||||
Sep 21 20:14:33 rho.la named[1079]: resolver priming query complete
|
||||
```
|
||||
|
||||
If it’s not running, start it with:
|
||||
@ -391,31 +446,74 @@ If it’s not running, start it with:
|
||||
systemctl start bind9
|
||||
```
|
||||
|
||||
Check that lookups still work:
|
||||
|
||||
```bash
|
||||
curl -6 icanhazip.com
|
||||
curl -4 icanhazip.com
|
||||
```
|
||||
|
||||
See what dns server you are in fact using
|
||||
|
||||
```bash
|
||||
dig icanhazip.com
|
||||
```
|
||||
|
||||
You will notice you are not using your own bind9
|
||||
|
||||
Edit the BIND DNS server’s configuration file.
|
||||
|
||||
```bash
|
||||
nano /etc/bind/named.conf.options
|
||||
```
|
||||
|
||||
Add the following line to allow VPN clients to send recursive DNS queries.
|
||||
Add some acls above the options block, one for your networks, and one for potential attackers.
|
||||
|
||||
```default
|
||||
allow-recursion { 127.0.0.1; 10.10.10.0/24; ::1/128; };
|
||||
```
|
||||
Add some real forwarders
|
||||
|
||||
And add allow recursion for your subnets.
|
||||
|
||||
After which it should look something like this:
|
||||
|
||||
Save and close the file.
|
||||
|
||||
```terminal_image
|
||||
:~# cat /etc/bind/named.conf.options | tail -n 9
|
||||
//========================================================================
|
||||
// If BIND logs error messages about the root key being expired,
|
||||
// you will need to update your keys. See https://www.isc.org/bind-keys
|
||||
//========================================================================
|
||||
dnssec-validation auto;
|
||||
|
||||
listen-on-v6 { any; };
|
||||
allow-recursion { 127.0.0.1; 10.10.10.0/24; ::1/128; };
|
||||
acl bogusnets {
|
||||
0.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3;
|
||||
10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16;
|
||||
};
|
||||
|
||||
acl my_net {
|
||||
127.0.0.1;
|
||||
::1;
|
||||
116.251.216.176;
|
||||
10.10.10.0/24;
|
||||
2405:4200:f001:13f6::/64;
|
||||
};
|
||||
|
||||
options {
|
||||
directory "/var/cache/bind";
|
||||
forwarders {
|
||||
2a02:6b8::feed:0ff;
|
||||
2a02:6b8:0:1::feed:0ff;
|
||||
77.88.8.8;
|
||||
77.88.8.1;
|
||||
};
|
||||
|
||||
//==========================
|
||||
// If BIND logs error messages about the
|
||||
// root key being expired,
|
||||
// you will need to update your keys.
|
||||
// See https://www.isc.org/bind-keys
|
||||
//==========================
|
||||
|
||||
dnssec-validation auto;
|
||||
|
||||
listen-on-v6 { any; };
|
||||
|
||||
allow-recursion { my_net; };
|
||||
blackhole { bogusnets; };
|
||||
};
|
||||
```
|
||||
|
||||
Then edit the `/etc/default/named` files.
|
||||
@ -439,10 +537,13 @@ Restart `bind9` for the changes to take effect.
|
||||
|
||||
```bash
|
||||
systemctl restart bind9
|
||||
systemctl status bind9
|
||||
dig -t txt -c chaos VERSION.BIND @127.0.0.1
|
||||
```
|
||||
|
||||
Your ufw firewall will allow vpn clients to access `bind9` because you earlier allowed everything from `wg0` in.
|
||||
|
||||
|
||||
## Start WireGuard on the server
|
||||
|
||||
Run the following command on the server to start WireGuard.
|
||||
|
||||
@ -5,10 +5,29 @@ title: >-
|
||||
...
|
||||
# the crisis of censorship
|
||||
|
||||
If we have a mechanism capable of securely handling arbitrary free form
|
||||
metadata about transactions, it can handle arbitrary free form information
|
||||
about anything, and people are likely to use it for information the
|
||||
government does not like. It is not only transaction data that the
|
||||
government wants to control.
|
||||
|
||||
We have a crisis of censorship.
|
||||
|
||||
Every uncensored medium of public discussion is getting the treatment.
|
||||
|
||||
In a world where truth and reality is massively suppressed, forbidden truth
|
||||
should migrate to a platform resistant to Global American Empire domination.
|
||||
|
||||
The Global American Empire is at war with truth and reality. A
|
||||
communications platform should support truth and reality, thus must be at
|
||||
war with the Global American Empire. A crypto currency needs what
|
||||
Urbit was supposed to be, its own communications and publishing
|
||||
protocol, in order that you can have transaction metadata protected, and
|
||||
thus needs its own truth and reality system. And thus it needs to be willing
|
||||
to be at war with the Global American Empire. Its developers need to
|
||||
figure on a significant probability of being arrested, murdered or forced to
|
||||
flee, as Satoshi figured.
|
||||
|
||||
We need a pseudonymous social network on which it is possible to safely
|
||||
discuss forbidden topics.
|
||||
|
||||
@ -264,6 +283,7 @@ of a million shills, scammers, and spammers.
|
||||
So, you can navigate to whole world’s public conversation through
|
||||
approved links and reply-to links – but not every spammer, scammer, and
|
||||
shill in the world can fill your feed with garbage.
|
||||
|
||||
## Algorithm and data structure for Zooko name network address
|
||||
|
||||
For this to work, the underlying structure needs to be something based on
|
||||
|
||||
Loading…
Reference in New Issue
Block a user