Arav
/
Dwelling
1
0
Fork 0
Code Issues Packages Releases Activity

Made heading in articles into links.

This commit is contained in:
Alexander Andreev 2021-02-10 19:56:44 +04:00
parent 3f503c7a86
commit 3b54438e04
Signed by: Arav
GPG Key ID: 610DF2574456329F
5 changed files with 45 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
static/dwelling/assets/css/articles.css
View File

@ -15,6 +15,12 @@ h4 {
text-indent: 1.5rem;
margin: 1rem 0 1rem 0; }
h3 a,
h4 a { color: var(--text-color); }
h3 a:hover,
h4 a:hover { color: var(--primary-color); }
code,
pre {
font-family: 'Share Tech Mono';

6
views/dwelling/articles/nginx_recipes_and_tips.pug
View File

@ -13,10 +13,10 @@ block article
li #[a(href='#art-2') Userdir functionality like Apache's mod_userdir]
li #[a(href='#art-3') Note on how NGiNX works with HTTP headers]
h3#art-1 1. Introduction
h3#art-1 #[a(href='#art-1') 1. Introduction]
p Here I'll place recipes for implementing different functionalities and notes on webserver's behaviour.
h3#art-2 2. Userdir functionality like Apache's mod_userdir
h3#art-2 #[a(href='#art-2') 2. Userdir functionality like Apache's mod_userdir]
p Once I wanted to have a “tilde user directories” like #[code /~user/] which is more known as Apache's #[code mod_userdir] feature. I work with NGiNX so regular expressions is the way to do that.
p Nothing special in my case. I only need to keep files there, so others may get them. Thing is simple, but I took some time to realise what regexp to use here back then.
p The implementation is quite simple:
@ -28,6 +28,6 @@ block article
p Of course, you can choose whatever place for user's public directories. In my case you need to give a read and execute permissions to user's home directory and to public directories inside them to others (#[code chmod o=rX /home/user]), which may be a security concern.
p #[code autoindex on] will make an index of files that lies by URL. And, of course, you can put there an #[code index.html] file.
h3#art-3 3. Note on how NGiNX works with HTTP headers
h3#art-3 #[a(href='#art-3') 3. Note on how NGiNX works with HTTP headers]
p Let's say in #[code http] block you specified common headers like #[code X-Frame-Options], #[code X-XSS-Protection], and so on for all #[code server] directives to use. But, if you add some other header for a specific #[code server] or #[code location] block then all those headers would be dropped.
p For now the only cure for it is to place all that headers in a separate file like #[code common-headers.inc] and using #[code include] directive to include them in all the #[code server] and #[code location] blocks where additional headers are added.

8
views/dwelling/articles/rpi_root_on_external_drive.pug
View File

@ -15,14 +15,14 @@ block article
li #[a(href='#art-2-1') If you're doing a fresh install]
li #[a(href='#art-3') cmdline.txt]
h3#art-1 1. Introduction
h3#art-1 #[a(href='#art-1') 1. Introduction]
p Raspberry Pi is known for how it wears off the SD cards. Thankfully you can move the root off the SD card to an external drive and leave there just a boot partition. I'm gonna use a #[s SystemD]GNU/Linux distribution for that.
h3#art-2 2. Moving / to an external drive
h3#art-2 #[a(href='#art-2') 2. Moving / to an external drive]
p I assume that you have your drive partitioned already. Create the temporary directories for a SD card's boot and root partitions and for a drive. Mount the partitions and issue a command #[code cp -a path/to/sdcard/root/* path/to/drive]. #[code -a] stands for archive. Which recursively copies everything preserving all the attributes and links.
h3#art-2-1 2.1. If you're doing a fresh install
h3#art-2-1 #[a(href='#art-2-1') 2.1. If you're doing a fresh install]
p Then you just install it right on a drive. And then move files from #[code /boot] to a SD card's boot partition. Like that: #[code mv path/to/boot/* path/to/sdcard]. Keep in mind that the boot partition should be formatted in FAT32.
h3#art-3 3. cmdline.txt
h3#art-3 3. #[a(href='#art-3') cmdline.txt]
p In a #[code cmdline.txt.] file we need to change #[code root=] part. Now it'll look like #[code root=/dev/mmcblk0p2 rw rootwait], and we need to put our drive's root partition instead of that, e.g. #[code root=/dev/sda1 rw rootwait].

47
views/dwelling/articles/setting_up_a_mail_server.pug
View File

@ -36,19 +36,19 @@ block article
li #[a(href='#art-8-5') DKIM]
li #[a(href='#art-9') Setting up a ClamAV antivirus]
h3#art-1 1. Introduction
h3#art-1 #[a(href='#art-1') 1. Introduction]
p I use Postfix as a SMTP and Dovecot (with Pigeonhole (Sieve)) as an IMAP server. ClamAV for an antivirus. For anti-spam I use SpamAssassin. For DKIM and DMARC — OpenDKIM and OpenDMARC respectively. I could use rspamd instead of the latter three, but it doesn't work on Raspberry Pi.
p It is vital to make the DKIM, DMARC and SPF DNS records. Also, if you want your mail server to be trusted by every other mail servers then you should get a static IP-address if you don't yet. And you have to ask your ISP to edit PTR DNS record for your static IP-address to point to your domain.
p Unfortunately for me I don't have neither, and I'm afraid that even if I get the static IP-address, my ISP won't edit PTR record, because that's available only for bussiness customers.
p Server is configured in a simple way using PAM (real system users) with user's passwords and with mail stored in ~/Maildir.
h3#art-2 2. Installing
h3#art-2 #[a(href='#art-2') 2. Installing]
p You need to install following packages: #[code postfix], #[code dovecot], #[code pidgeonhole] (or could be #[code dovecot-sieve]), #[code clamav], #[code opendkim], #[code opendmarc] and #[code spamassassin].
h3#art-3 3. Postfix SMTP server
h3#art-3 #[a(href='#art-3') 3. Postfix SMTP server]
p Its configuration files are in directory #[code /etc/postfix]. First we need to work with #[code main.cf] file. Then configure services in #[code master.cf]. Also I'll show you how to make aliases for users.
h4#art-3-1 3.1. main.cf
h4#art-3-1 #[a(href='#art-3-1') 3.1. main.cf]
p Set #[code myhostname] to a hostname of a server (e.g. #[code mail.example.org]). Set #[code mydomain] to your domain name (e.g. #[code example.org]). Set #[code myorigin] to #[code $mydomain] to set origin of mail being sent from your server.
p #[code mydestination] is a list of domains that are delivered through a local transport. If server should go outside then this parameter must include #[code $mydomain] alongside names for the local machine. E.g. #[code $myhostname, localhost, $mydomain, mail.$mydomain].
p #[code local_recipient_maps] are lookup tables with all names and/or addresses of local recipients. In my case it set to #[code unix:passwd.byname $alias_maps].
@ -86,7 +86,7 @@ block article
| inet_protocols = ipv4
p Next I'll cover how to make encryption working, set up milters (mail filters (i.e. OpenDKIM and OpenDMARC)), and restrictions.
h4#art-3-2 3.2. master.cf
h4#art-3-2 #[a(href='#art-3-2') 3.2. master.cf]
p Here are all needed lines to be added or modified:
pre
| smtp inet n - n - - smtpd
@ -106,21 +106,20 @@ block article
| user=spamd argv=/bin/vendor_perl/spamc
| -e /sbin/sendmail -oi -f ${sender} ${recipient}
h4#art-3-3 3.3. User aliases
h4#art-3-3 #[a(href='#art-3-3') 3.3. User aliases]
p User aliases are in #[code aliases] file. They has a form "#[code <alias>: <username>]", e.g. #[code me: arav]. Where #[code username] may be other alias. After modifications you need to run #[code newaliases] program to update #[code aliases.db] database file.
h4#art-3-4 3.4. Starting Postfix
h4#art-3-4 #[a(href='#art-3-4') 3.4. Starting Postfix]
p To start a Postfix service on systemd-based Linux distro run #[code systemctl start postfix]. To make Postfix run on every boot run #[code systemctl enable postfix].
h3#art-4 #[a(href='#art-4') 4. Dovecot POP3/IMAP server with Sieve mail filter]
h3#art-4 4. Dovecot POP3/IMAP server with Sieve mail filter
h3#art-5 #[a(href='#art-5') 5. SpamAssassin spam filter]
h3#art-5 5. SpamAssassin spam filter
h3#art-6 6. OpenDKIM signing and verifying filter
h3#art-6 #[a(href='#art-6') 6. OpenDKIM signing and verifying filter]
p On ArchLinux OpenDKIM is unable to write in #[code /run], so I created #[code /var/spool/opendkim] directory for it.
h4#art-6-1 6.1. opendkim.conf
h4#art-6-1 #[a(href='#art-6-1') 6.1. opendkim.conf]
p Well, that's main config file
pre
| KeyTable refile:/etc/opendkim/keytable
@ -152,7 +151,7 @@ block article
p Below are logging options that tells to write in syslog.
p With #[code SoftwareHeader] set to yes OpenDKIM will be always adding "DKIM-Filter" header field.
h4#art-6-2 6.2. Generating keys
h4#art-6-2 #[a(href='#art-6-2') 6.2. Generating keys]
pre
| opendkim-genkey -r -s myselector -b 2048 -d example.com
p This command will generate a key pair stored in files "myselector.private" and "myselector.txt" for a given domain.
@ -160,7 +159,7 @@ block article
p Name of a selector is usually a #[code mail], but that's just what I use, you can choose whatever you want.
h4#art-6-3 6.3. Populating KeyTable and SigningTable
h4#art-6-3 #[a(href='#art-6-3') 6.3. Populating KeyTable and SigningTable]
p KeyTable has following structure (a line per domain):
pre
| myselector._domainkey.example.com example.com:myselector:/etc/opendkim/myselector.private
@ -168,7 +167,7 @@ block article
pre
| *@example.com myselector._domainkey.example.com
h4#art-6-4 6.4. internal-hosts file
h4#art-6-4 #[a(href='#art-6-4') 6.4. internal-hosts file]
p As stated above in this file we put hosts whose mail should be signed rather than verified. And its structure is the following:
pre
| 127.0.0.1
@ -176,10 +175,10 @@ block article
p #[code 127.0.0.1] is necessary to be there according to a manual.
h4#art-6-5 6.5. Starting OpenDKIM
h4#art-6-5 #[a(href='#art-6-5') 6.5. Starting OpenDKIM]
p #[code systemctl start opendkim] and #[code systemctl enable opendkim] to start and enable OpenDKIM service to run on OS start up if you got Poetteringed just like me. :)
h3#art-7 7. OpenDMARC email policy filter
h3#art-7 #[a(href='#art-7') 7. OpenDMARC email policy filter]
p Its configuration lies in #[code /etc/opendmarc/opendmarc.conf] and is fully documented. Here are the options I changed:
pre
| AuthservID OpenDMARC
@ -198,9 +197,9 @@ block article
p What's in a #[code Socket] option should be added to Postfix's #[code smtpd_milters] and #[code non_smtpd_milters].
p Creating DMARC DNS record covered in <a href="#art-7-4">7.4</a>.
h3#art-8 8. DNS records
h3#art-8 #[a(href='#art-8') 8. DNS records]
h4#art-8-1 8.1. MX and A/AAAA
h4#art-8-1 #[a(href='#art-8-1') 8.1. MX and A/AAAA]
p It's good to have a dedicated A (IPv4 address) or AAAA (IPv6 address) record for a mail server's hostname instead of a CNAME record so other servers won't need to do two DNS requests. Hostname is usually mail.example.org if there's just one server, you can call it whatever you want. Remind you that we set it in Postfix in #[code myhostname] parameter.
p And A record looks like this:
pre
@ -212,20 +211,20 @@ block article
p Here 10 is a priority of a record. The lower a number the higher a priority.
p A period at the end of the hostnames is necessary in DNS records.
h4#art-8-2 8.2. PTR
h4#art-8-2 #[a(href='#art-8-2') 8.2. PTR]
p PTR is a reverse DNS record that stands for pointer and is used to &ldquo;bind&rdquo; a hostname to IP-address. Mail servers looks for this record and check so this name equals to a hostname provided in EHLO. Most servers will reject your mail if your PTR looks something like 1.2.3.4.pppoe.someisp.net or not set at all.
p There are three ways to set this record: ask your hosting or internet-provider, or get your own Autonomous System (:^)).
p Example of this record:
pre
| 1 IN PTR mail.example.org.
h4#art-8-3 8.3. SPF
h4#art-8-3 #[a(href='#art-8-3') 8.3. SPF]
p SPF stands for Sender Policy Framework and in my case it looks exactly like this:
pre
| v=spf1 +a +mx -all
p So, #[code v] is a version of a protocol. #[code +a +mx] means that only servers specified in the A and MX DNS records could send email, and #[code -all] that no one else could do that.
h4#art-8-4 8.4. DMARC
h4#art-8-4 #[a(href='#art-8-4') 8.4. DMARC]
p DMARC stands for Domain-based Message Authentication Reporting and Conformance. And its DNS record could be like this one that I use:
pre
| _dmarc IN TXT "v=DMARC1; p=reject; rua=mailto:admin@example.org; ruf=mailto:admin@example.org"
@ -233,14 +232,14 @@ block article
p #[code p] is a default policy that could be set to #[code none], #[code quarantine] and #[code reject]. I chose to #[code reject] mail that comes from &laquo;me&rdquo; if there's something wrong with a origin of a message. If you could get email from subdomains then you need to set #[code sp] as well.
p #[code rua] is an address for the reports and #[code ruf] is for the forensic reports.
h4#art-8-5 8.5. DKIM
h4#art-8-5 #[a(href='#art-8-5') 8.5. DKIM]
p In 5.2 we generated a key pair for our domain and now we'll take what's inside a #[code myselector.txt] file and add it to our DNS.
p DKIM DNS record looks like this:
pre
| myselector._domainkey IN TXT ( "v=DKIMv1; k=rsa; s=email; p=&lt;public key goes here&gt;" )
p By the way, brackets are used in case a content of a record doesn't fit on one line.
h3#art-9 9. Setting up a ClamAV antivirus
h3#art-9 #[a(href='#art-9') 9. Setting up a ClamAV antivirus]
p All you need to make it work together with Postfix is to add #[code /run/clamav/milter.sock] to #[code smtpd_milters] and #[code non_smtpd_milters] options in Postfix, also make some changes in configs of ClamAV.
p In #[code clamav-milter.conf] you need the following:
pre

18
views/dwelling/articles/setting_up_a_tor_proxy_relay_hiddenserv.pug
View File

@ -21,18 +21,18 @@ block article
li #[a(href='#art-4-1') Nyx &mdash; status monitor for Tor nodes]
li #[a(href='#art-4-2') Notes]
h3#art-1 1. Introduction
h3#art-1 #[a(href='#art-1') 1. Introduction]
p In this article I'll show you how to setup your own Tor proxy (SOCKS5 and HTTP), relay, and hidden service.
h3#art-2 2. Installation
h3#art-2 #[a(href='#art-2') 2. Installation]
p Install #[code tor] package using your package manager.
p You definitely want to have control over your node and monitor it. For that purpose there is #[code nyx] tool. I'll cover it in 3.1 section.
p Any program can be passed through Tor using #[code torify] from #[code torsocks] package.
h3#art-3 3. Configuration
h3#art-3 #[a(href='#art-3') 3. Configuration]
p Tor is already bundled with a great documented #[code torrc-dist] file. You may just copy a #[code torrc-dist] file and name it as #[code torrc] and change what you need.
h4#art-3-1 3.1. Tor SOCKS/HTTP proxy
h4#art-3-1 #[a(href='#art-3-1') 3.1. Tor SOCKS/HTTP proxy]
p Here is an example of SOCKS/HTTP proxy settings:
pre
| SocksPort 192.168.0.100:9050, [ipv6 address]:9050
@ -53,7 +53,7 @@ block article
p #[code HTTPTunnelPort] enables HTTP proxy, set it to desireable IP:Port.
p There are also #[code ExcludeNodes] and #[code ExcludeExitNodes] options that are the comma separated lists of forbidden nodes. There may be placed country codes, address patterns and identity fingerprints of nodes to never use in circuits. They are looking like #[code {ru}, {??}, 123.45.*]. I recommend to leave there at least #[code {??}] to forbid misconfigured nodes or nodes of an unknown origin, especially for exit nodes.
h4#art-3-2 3.2. Tor relay
h4#art-3-2 #[a(href='#art-3-2') 3.2. Tor relay]
p Here is an example of relay settings.
pre
| ORPort 8443, [::]:8443
@ -80,7 +80,7 @@ block article
p Add #[code ExitPolicy reject *:*] to disable exit node if you don't need it. I found out that setting #[code ExitRelay] to 0 doesn't disable an exit node, so you must add rejecting policy.
p #[code AccountingMax] and #[code AccountingStart] are used to limit traffic for given period.
h4#art-3-3 3.3. Hidden service
h4#art-3-3 #[a(href='#art-3-3') 3.3. Hidden service]
p There are two mandatory options to work with: #[code HiddenServiceDir] and #[code HiddenServicePort].
p Of course, there are many other options, e.g. client authentication. But in simple case all you need are those two options above.
p Every hidden service starts with #[code HiddenServiceDir &lt;path&gt;] directory that contains public and secret keys, hostname for a hidden service and a directory called #[code authorized_clients] that stores info on all clients that are authorized to access this hidden service.
@ -92,9 +92,9 @@ block article
| HiddenServicePort 80 localhost:8201
| HiddenServicePort 25 192.168.1.160:25
h3#art-4 4. Miscellaneous
h3#art-4 #[a(href='#art-4') 4. Miscellaneous]
h4#art-4-1 4.1. Nyx &mdash; status monitor for Tor nodes
h4#art-4-1 #[a(href='#art-4-1') 4.1. Nyx &mdash; status monitor for Tor nodes]
p You have to set #[code ControlPort] option to desired port, it will listen on localhost. If you need access from outside then set it to IP:9051. Also, you need to set #[code DisableDebuggerAttachment] option to 0, otherwise you'll not be able to use nyx. At least in my case nyx cannot connect with this option being set to 1.
p Example:
pre
@ -102,7 +102,7 @@ block article
| DisableDebuggerAttachment 0
p You may install it using package manager, but guaranteed last version can be installed from Python's #[code pip] package manager (#[code pip install nyx]).
h4#art-4-2 4.2. Notes
h4#art-4-2 #[a(href='#art-4-2') 4.2. Notes]
p I hope you have a static IP-address or your IP changes once a month at least, otherwise you'll never become a guard (entry) node.
p An option #[code AvoidDiskWrites] is usefull in case you're running from SSD or SD card.
p You have to make a backup of #[code /var/lib/tor/keys] folder to save your node's cryptographic identity keys. They are used to identify your node. You can see stats on your node at #[a(href="https://metrics.torproject.org" rel="noopener noreferrer" target="_blank") metrics.torproject.org]. To find your node use what you put in #[code Nickname] parameter or a fingerprint that is shown in nyx.