Add doc:how to config GRUB2 password protection
This commit is contained in:
samson
parent
70e6f42e56
commit
9ab41dceea
|
|
@ -0,0 +1,67 @@
|
|||
# How to config grub2 password protection
|
||||
|
||||
## Generate hashed password for GRUB
|
||||
This example use the following char as the password: "MangGuO93,*jqvt", a combination like this is a requirement to satisfy the robustness of the password.
|
||||
```
|
||||
# grub-mkpasswd-pbkdf2
|
||||
Enter password:
|
||||
Reenter password:
|
||||
PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F5CFD948DC06B644E05531FBF9773C086B228A87033642B32D41DBE141B10D2FD0604C8ABCDD2D2D76C834297969EADC64687EB32662CB59BCA0898AD69D7FE6.C698997624F217CDCE83446E80632FF9F7AFB1A0A6AE0B5752A81392F1BAA9A44C37AF5B29D7CEE13B9DE7D1207D5FB4A173A49D1518B1492BB6D9FE45444656
|
||||
```
|
||||
It will generate a long password encrypted like this: grub.pbkdf2.sha512.10000........ Copy the complete generated code.
|
||||
|
||||
## Setting Up Password Protection
|
||||
|
||||
### Modify /etc/grub.d/10_linux
|
||||
In /etc/grub.d/10_linux, find the following line:
|
||||
```
|
||||
printf "menuentry '${title}' ${CLASS} {\n" "${os}" "${version}"
|
||||
```
|
||||
Add --users '':
|
||||
```
|
||||
printf "menuentry '${title}' ${CLASS} --users '' {\n" "${os}" "${version}"
|
||||
```
|
||||
|
||||
### Modify/etc/grub.d/30_os-prober
|
||||
To alter the /etc/grub.d/30_os-prober to add password protection to all entries:
|
||||
```
|
||||
# sed 's/--class os /--class os --users /' -i /etc/grub.d/30_os-prober
|
||||
```
|
||||
|
||||
### Add password protection to /etc/grub.d/40_header
|
||||
```
|
||||
set superusers="username"
|
||||
password_pbkdf2 username password
|
||||
```
|
||||
Obviously you should replace the words "username" with your desired user name, and the word password for the encrypted password generated in the previous step.
|
||||
The format for an encrypted password entry in /etc/grub.d/40_header would look similar to the following (shortened in the example):
|
||||
```
|
||||
set superusers="John"
|
||||
password_pbkdf2 John grub.pbkdf2.sha512.10000.F5CFD948DC06B644E05531FBF9773C086B228A87033642B32D41DBE141B10D2FD0604C8ABCDD2D2D76C834297969EADC64687EB32662CB59BCA0898AD69D7FE6.C698997624F217CDCE83446E80632FF9F7AFB1A0A6AE0B5752A81392F1BAA9A44C37AF5B29D7CEE13B9DE7D1207D5FB4A173A49D1518B1492BB6D9FE45444656
|
||||
```
|
||||
|
||||
Save the file and exit.
|
||||
|
||||
## Generate a grub2 config file
|
||||
```
|
||||
# update-grub2
|
||||
Generating grub configuration file ...
|
||||
Found linux image: /boot/vmlinuz-4.9.0-8-amd64
|
||||
Found initrd image: /boot/initrd.img-4.9.0-8-amd64
|
||||
done
|
||||
```
|
||||
|
||||
That's all, your grub2 is protected.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
If add password protection to /etc/grub.d/00_header, maybe you get an error when exec update-grub2, like this following:
|
||||
```
|
||||
# update-grub2
|
||||
/etc/grub.d/00_header :274 /etc/grub.d/00_header password_pbkdf2 not found
|
||||
```
|
||||
|
||||
Remember that the correct file to edit is 40_custom simply because other files such as grub.cfg or even 00_header are updated automatically by the system in certain circumstances, and it would make you lose those changes.
|
||||
|
||||
## Reference
|
||||
[https://help.ubuntu.com/community/Grub2/Passwords](https://help.ubuntu.com/community/Grub2/Passwords)
|
||||
|
|
@ -1,243 +0,0 @@
|
|||
# Nodejs + redis + mysql demo
|
||||
## environment
|
||||
* OS: Debian
|
||||
* Nodejs: 10.13.0
|
||||
* MySQL: 10.1.26-MariaDB-0+deb9u1
|
||||
* Redis: 5.0.1
|
||||
* Kernel: linux-image-4.12.0-grsec-evil191
|
||||
### Install packages
|
||||
|
||||
#### Install mysql
|
||||
|
||||
```
|
||||
apt install mysql-server
|
||||
```
|
||||
#### Configurate database
|
||||
|
||||
Create helloworld database
|
||||
|
||||
```
|
||||
mysql -uroot
|
||||
MariaDB [(none)]> CREATE DATABASE helloworld;
|
||||
```
|
||||
Grant proper access to the helloworld database:
|
||||
|
||||
```
|
||||
MariaDB [(none)]> GRANT ALL PRIVILEGES ON helloworld.* TO 'helloworld'@'localhost' \
|
||||
IDENTIFIED BY 'HELLOWORLD_DBPASS';
|
||||
MariaDB [(none)]> GRANT ALL PRIVILEGES ON helloworld.* TO 'helloworld'@'%' \
|
||||
IDENTIFIED BY 'HELLOWORLD_DBPASS';
|
||||
```
|
||||
|
||||
Replace HEllOWORLD_DBPASS with a suitable password.
|
||||
|
||||
|
||||
#### Install Redis
|
||||
|
||||
edit `/etc/apt/source.list` and add `stretch-backports` source
|
||||
|
||||
```
|
||||
deb http://mirrors.163.com/debian/ stretch-backports main
|
||||
deb-src http://mirrors.163.com/debian/ stretch-backports main
|
||||
```
|
||||
and update
|
||||
|
||||
```
|
||||
apt update
|
||||
```
|
||||
install the package
|
||||
```
|
||||
apt -t stretch-backports install redis-server
|
||||
```
|
||||
|
||||
#### Configurate Redis
|
||||
|
||||
modify `/etc/redis/redis.conf`, changce supervised no to
|
||||
|
||||
```
|
||||
supervised systemd
|
||||
```
|
||||
|
||||
Configuring a Redis Password
|
||||
modify /etc/redis/redis.conf you can find the
|
||||
```
|
||||
# requirepass foobared
|
||||
```
|
||||
|
||||
uncommnet it and change foobared to a suitable password
|
||||
|
||||
for example, you can gener:
|
||||
|
||||
```
|
||||
openssl rand 60 | openssl base64 -A
|
||||
|
||||
jkO663LT4SLU522cIBaMrWshaEEP+67oRGIdDV3AEpIaS7IQ9yYWP78nmruBFM2cPdxSudvrrmlZeKil
|
||||
```
|
||||
|
||||
systemctl restart redis
|
||||
|
||||
#### Install Nodejs
|
||||
|
||||
|
||||
```
|
||||
#as root
|
||||
apt install curl -y
|
||||
curl -sL https://deb.nodesource.com/setup_10.x | bash -
|
||||
apt-get install -y nodejs
|
||||
```
|
||||
|
||||
#### Install pax-bites
|
||||
|
||||
|
||||
```
|
||||
cat <<EOF > debian_auto_deploy.sh
|
||||
#!/bin/bash
|
||||
|
||||
WORKDIR=/tmp/debian-grsec-configs
|
||||
mkdir -p $WORKDIR
|
||||
cd $WORKDIR
|
||||
|
||||
echo "###########################################################################"
|
||||
echo -e "[+] \e[93mInstalling paxctl-ng/elfix...\e[0m"
|
||||
echo "----------------------------------------------"
|
||||
apt-get install -y vim libc6-dev libelf-dev libattr1-dev build-essential git
|
||||
wget https://dev.gentoo.org/%7Eblueness/elfix/elfix-0.9.2.tar.gz && tar zxvf elfix-0.9.2.tar.gz
|
||||
cd elfix-0.9.2
|
||||
|
||||
./configure --enable-ptpax --enable-xtpax --disable-tests
|
||||
make && make install
|
||||
cd $WORKDIR
|
||||
|
||||
echo "###########################################################################"
|
||||
echo -e "[+] \e[93mDeploying configs....\e[0m"
|
||||
echo "----------------------------------------------"
|
||||
|
||||
echo 'DPkg::Post-Invoke {"/bin/bash /usr/sbin/pax-bites.sh -e /etc/pax_flags_debian.config"; };' >77pax-bites
|
||||
|
||||
cp 77pax-bites /etc/apt/apt.conf.d/
|
||||
wget https://github.com/hardenedlinux/hardenedlinux_profiles/raw/master/debian/pax_flags_debian.config
|
||||
cp pax_flags_debian.config /etc/
|
||||
|
||||
echo "###########################################################################"
|
||||
echo -e "[+] \e[93mDeploying pax-bites...\e[0m"
|
||||
echo "----------------------------------------------"
|
||||
git clone https://github.com/hardenedlinux/pax-bites.git
|
||||
cp pax-bites/pax-bites.sh /usr/sbin/
|
||||
pax-bites.sh -e /etc/pax_flags_debian.config
|
||||
EOF
|
||||
```
|
||||
run command:
|
||||
|
||||
```
|
||||
bash debian_auto_deploy.sh
|
||||
```
|
||||
|
||||
after install paxctl and pax-bites
|
||||
|
||||
we should modify `/etc/pax_flags_debian.config`
|
||||
|
||||
add following content:
|
||||
|
||||
```
|
||||
# Nodejs
|
||||
/usr/bin/node;m
|
||||
```
|
||||
`-m` means `disable MPROTECT`
|
||||
|
||||
for more details you can check it from `paxctl-ng`
|
||||
|
||||
perform change
|
||||
|
||||
```
|
||||
pax-bites.sh -e /etc/pax_flags_debian.config
|
||||
```
|
||||
|
||||
|
||||
### Add new user for helloworld service
|
||||
|
||||
adduser helloworld
|
||||
|
||||
### Usage
|
||||
|
||||
Using helloworld to install the dependencies.
|
||||
|
||||
unzip the helloworld.zip
|
||||
|
||||
```
|
||||
//Installation all dependencies:
|
||||
# su helloworld
|
||||
$ unzip helloworld.zip
|
||||
$ cd helloworld
|
||||
$ npm install
|
||||
```
|
||||
|
||||
|
||||
### modify the config file locate in `config/config.js`
|
||||
|
||||
you can setup the mysql and redis
|
||||
|
||||
```
|
||||
BASE_DIR = __dirname;
|
||||
|
||||
module.exports = {
|
||||
port: 3000,
|
||||
//mysql
|
||||
mysql: {
|
||||
host: 'localhost',
|
||||
user: 'helloworld',
|
||||
password: 'HELLOWORLD_DBPASS',
|
||||
connectionLimit: 10,
|
||||
charset: 'utf8mb4',
|
||||
},
|
||||
database: 'helloworld',
|
||||
//redis
|
||||
redis: {
|
||||
tokenName: 'helloworld',
|
||||
host: '127.0.0.1',
|
||||
port: 6379,
|
||||
password: 'jkO663LT4SLU522cIBaMrWshaEEP+67oRGIdDV3AEpIaS7IQ9yYWP78nmruBFM2cPdxSudvrrmlZeKil',
|
||||
},
|
||||
}
|
||||
```
|
||||
|
||||
//Installation PM2:
|
||||
```
|
||||
# npm install pm2 -g
|
||||
```
|
||||
|
||||
```
|
||||
$ su helloworld
|
||||
$ export NODE_ENV=production && pm2 start ./app.js --name helloworld
|
||||
$ pm2 startup systemd
|
||||
|
||||
[PM2] Init System found: systemd
|
||||
[PM2] To setup the Startup Script, copy/paste the following command:
|
||||
sudo env PATH=$PATH:/usr/bin /usr/lib/node_modules/pm2/bin/pm2 startup systemd -u helloworld --hp /home/helloworld
|
||||
```
|
||||
change to root user and execute
|
||||
|
||||
```
|
||||
# env PATH=$PATH:/usr/bin /usr/lib/node_modules/pm2/bin/pm2 startup systemd -u helloworld --hp /home/helloworld
|
||||
```
|
||||
|
||||
and switch back to `helloworld` user
|
||||
|
||||
```
|
||||
$ pm2 save
|
||||
```
|
||||
now start the service
|
||||
|
||||
```
|
||||
# systemctl start pm2-helloworld
|
||||
```
|
||||
|
||||
|
||||
|
||||
Open up http://{your server ip}:3000,then you can see the helloworld page.
|
||||
|
||||
|
||||
Reference:
|
||||
https://nodejs.org/en/
|
||||
https://www.mysql.com/
|
||||
http://pm2.keymetrics.io/
|
||||
https://www.digitalocean.com/community/tutorials/how-to-set-up-a-node-js-application-for-production-on-debian-9
|
||||
Loading…
Reference in New Issue