Lenovo U410

From Geitenpad
Revision as of 10:17, 4 December 2023 by Rijk (talk | contribs) (→Disable sleep)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

Base System

Force https on Apache

Enable rewrite: 

root@paardenpad:~# a2enmod rewrite-

Create rewrite rule: 

root@paardenpad:~# cat /var/www/html/.htaccess
RewriteEngine On 
RewriteCond %{HTTPS}  !=on 
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]

Use basic auth on proxied service

https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication 

   <Location /my-service>
       Order deny,allow
       Allow from all
       Authtype Basic
       Authname "Password Required"
       AuthUserFile /etc/apache2/.htpasswd
       Require valid-user
   </Location>

Https on Apache with Let's Encrypt

  • Open port 80 on Fritz!box
  • Redirect all traffic to https
root@paardenpad:~# vim /var/www/html/.htaccess

RewriteEngine On
RewriteCond %{HTTPS}  !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
  • Install certbot
root@paardenpad:~# sudo apt-get install certbot python-certbot-apache
  • Get a certificate
root@paardenpad:~# certbot certonly --apache
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): r.oosterhoff@rijkenmiel.nl

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
No names were found in your configuration files. Please enter in your domain
name(s) (comma and/or space separated)  (Enter 'c' to cancel): paardenpad.rijkenmiel.nl
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for paardenpad.rijkenmiel.nl
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. paardenpad.rijkenmiel.nl (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://paardenpad.rijkenmiel.nl/.well-known/acme-challenge/C0cG7hhtZz0gjjm9KUkzW92acsgM0QPXCZRUzbrqAV4: Timeout during connect (likely firewall problem)

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: paardenpad.rijkenmiel.nl
   Type:   connection
   Detail: Fetching
   http://paardenpad.rijkenmiel.nl/.well-known/acme-challenge/C0cG7hhtZz0gjjm9KUkzW92acsgM0QPXCZRUzbrqAV4:
   Timeout during connect (likely firewall problem)

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
root@paardenpad:~# certbot certonly --apache
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
No names were found in your configuration files. Please enter in your domain
name(s) (comma and/or space separated)  (Enter 'c' to cancel): paardenpad.rijkenmiel.nl
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for paardenpad.rijkenmiel.nl
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/paardenpad.rijkenmiel.nl/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/paardenpad.rijkenmiel.nl/privkey.pem
   Your cert will expire on 2020-01-03. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le
  • change content of /etc/apache2/sites-enabled/paardenpad-ssl.conf
root@paardenpad:~# vim /etc/apache2/sites-enabled/paardenpad-ssl.conf

#   A self-signed (snakeoil) certificate can be created by installing
#   the ssl-cert package. See
#   /usr/share/doc/apache2/README.Debian.gz for more info.
#   If both key and certificate are stored in the same file, only the
#   SSLCertificateFile directive is needed.
SSLCertificateFile      /etc/letsencrypt/live/paardenpad.rijkenmiel.nl/fullchain.pem
SSLCertificateKeyFile  /etc/letsencrypt/live/paardenpad.rijkenmiel.nl/privkey.pem

Renew Let's Encrypt certificate on Apache

root@paardenpad:~# certbot
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
No names were found in your configuration files. Please enter in your domain
name(s) (comma and/or space separated)  (Enter 'c' to cancel): paardenpad.rijkenmiel.nl
Cert not yet due for renewal

You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry.
(ref: /etc/letsencrypt/renewal/paardenpad.rijkenmiel.nl.conf)

What would you like to do?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Attempt to reinstall this existing certificate
2: Renew & replace the cert (limit ~5 per 7 days)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Renewing an existing certificate
Created an SSL vhost at /etc/apache2/sites-available/000-default-le-ssl.conf
Deploying Certificate to VirtualHost /etc/apache2/sites-available/000-default-le-ssl.conf
Enabling available site: /etc/apache2/sites-available/000-default-le-ssl.conf

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): c

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Your existing certificate has been successfully renewed, and the new certificate
has been installed.

The new certificate covers the following domains:
https://paardenpad.rijkenmiel.nl

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=paardenpad.rijkenmiel.nl
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/paardenpad.rijkenmiel.nl/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/paardenpad.rijkenmiel.nl/privkey.pem
Your cert will expire on 2020-02-05. To obtain a new or tweaked
version of this certificate in the future, simply run certbot again
with the "certonly" option. To non-interactively renew *all* of
your certificates, run "certbot renew"
- If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
Donating to EFF:                    https://eff.org/donate-le

root@paardenpad:~# systemctl restart apache2

Fail2Ban

apt install fail2ban -y

Leave defaults intact

/etc/hosts

root@paardenpad:~# cat /etc/hosts
127.0.0.1	localhost
127.0.1.1	paardenpad.rijkenmiel.nl	paardenpad

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

192.168.2.30    server
192.168.2.29    milight
192.168.2.25    olimex
192.168.2.54    oldie
192.168.2.22    mielsbak
192.168.2.27    luke

/etc/crontab

root@paardenpad:~# cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user	command
17 *	* * *	root    cd / && run-parts --report /etc/cron.hourly
25 6	* * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6	* * 7	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6	1 * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

*/15  *  *   *   *   www-data    php -f /var/www/html/nextcloud/cron.php >/dev/null 2>&1
*     *  *   *   *   root        /root/scripts/takePicture >/dev/null 2>&1

0     2  *   *   *   rijk    mysqldump --lock-tables -u nextcloud --password='ahthuShohL1i' nextcloud > /home/rijk/Documents/Backups/nc.sql
4     2  *   *   *   rijk    mysqldump --lock-tables -u mediawiki --password='twiamfhhh' mediawiki > /home/rijk/Documents/Backups/mw.sql
10    2  *   *   *   rijk    mysqldump --lock-tables -u landisplusgyr_frontend --password='shae5Yoo' landisplusgyrjhipster > /home/rijk/Documents/Backups/lpgjh.sql
12    2  *   *   *   rijk    mysqldump --lock-tables -u churchserviceplanner --password='De0oiThee7Tochai' -h 127.0.0.1 -P 3310 churchserviceplanner > /home/rijk/Documents/Backups/csp.sql
14    2  *   *   *   rijk    mysqldump --lock-tables -u alcoholusage --password='peegee0uoSah' alcoholusage > /home/rijk/Documents/Backups/au.sql
20    2  *   *   *   root    /root/scripts/setUserRights
30    2  *   *   *   rijk    /home/rijk/scripts/createDateSymlinks.py
0     4  *   *   *   root    /root/scripts/preCacheSFPG.py >> /var/log/preCacheSFPG.log

/etc/fstab

root@paardenpad:~# cat /etc/fstab 
# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system>                          <mount point>               <type> <options>      <dump>  <pass>
/dev/mapper/paardenpad-root              /                            ext4  errors=remount-ro 0       1
/dev/mapper/paardenpad-rijk              /home/rijk                   ext4  defaults          0       2
/dev/mapper/paardenpad-miel              /var/spool/burp/miels_laptop ext4  defaults          0       2
/dev/mapper/paardenpad-var               /var                         ext4  defaults          0       2
/dev/mapper/paardenpad-virtual_machines  /var/lib/libvirt/images      ext4  defaults          0       2

/dev/mapper/paardenpad-swap none            swap    sw              0       0

/dev/sr0        /media/cdrom0   udf,iso9660 user,noauto     0       0
/dev/sdb1       /media/sdcard   vfat    discard,noatime,errors=remount-ro,gid=1000,uid=1000       0       2

/etc/exports

root@paardenpad:~# cat /etc/exports
# /etc/exports: the access control list for filesystems which may be exported
#		to NFS clients.  See exports(5).
#
# Example for NFSv2 and NFSv3:
# /srv/homes       hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)
#
# Example for NFSv4:
# /srv/nfs4        gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
# /srv/nfs4/homes  gss/krb5i(rw,sync,no_subtree_check)
#

#/home/rijk/Documents	192.168.2.36(crossmnt,rw,no_root_squash,sync,no_subtree_check) 192.168.2.50(crossmnt,rw,no_root_squash,sync,no_subtree_check) 192.168.2.41(crossmnt,rw,no_root_squash,sync,no_subtree_check)
/media/sdcard    	192.168.2.0/24(crossmnt,rw,no_root_squash,sync,no_subtree_check)

Disable sleep

https://wiki.debian.org/Suspend#Disable_suspend_and_hibernation

root@geitenpad:~# cat /etc/systemd/sleep.conf
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See systemd-sleep.conf(5) for details

[Sleep]
AllowSuspend=no
AllowHibernation=no
AllowSuspendThenHibernate=no
AllowHybridSleep=no
#SuspendMode=
#SuspendState=mem standby freeze
#HibernateMode=platform shutdown
#HibernateState=disk
#HybridSleepMode=suspend platform shutdown
#HybridSleepState=disk
#HibernateDelaySec=180min

root@geitenpad:~# cat /etc/systemd/logind.conf
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See logind.conf(5) for details.

[Login]
#NAutoVTs=6
#ReserveVT=6
#KillUserProcesses=no
#KillOnlyUsers=
#KillExcludeUsers=root
#InhibitDelayMaxSec=5
#HandlePowerKey=poweroff
#HandleSuspendKey=suspend
#HandleHibernateKey=hibernate
HandleLidSwitch=ignore
HandleLidSwitchDocked=ignore
#PowerKeyIgnoreInhibited=no
#SuspendKeyIgnoreInhibited=no
#HibernateKeyIgnoreInhibited=no
#LidSwitchIgnoreInhibited=yes
#HoldoffTimeoutSec=30s
#IdleAction=ignore
#IdleActionSec=30min
#RuntimeDirectorySize=10%
#RemoveIPC=yes
#InhibitorsMax=8192
#SessionsMax=8192
#UserTasksMax=33%
Retrieved from "https://mediawiki.geitenpad.rijkenmiel.nl/index.php?title=Lenovo_U410&oldid=72"