Git brach löschen

Jens Appel

Lokaler Branch löschen:

dix@dione:~/workspace/radkarte$ git branch -d status
Deleted branch status (was 2ac4633).

Dazugehörigen Remote Branch löschen:

dix@dione:~/workspace/radkarte$ git push origin :status
To ssh://gitosis@psj-world.de:22/radkarte.git
- [deleted]         status

DynDNS mit BIND

Jens Appel
  • Key erzeugen
# dnssec-keygen -a HMAC-MD5 -b 512 -n USER home.domain.de
  • Key in  /etc/bind/named.conf.local hinzufügen
key home.domain.de. {
	algorithm HMAC-MD5;
	secret "Das secret aus dem .key file kommt hier rein";
};
  • Zonen definition anpassen
zone  "domain.de" {
        type master;
        file  "domain.de";
        allow-update {
                key home.domain.de.;
        };
};
  • Update starten
nsupdate -k Khome.leppa.de.+157+36137.private server bind.home.leppa.de zone home.leppa.de update delete login A update add login 60 A 127.0.0.1 send
  • Update Skript
#!/bin/bash

ip_old=`host dione.home.leppa.de psj-world.de | awk '/^dione/ {print $4} '`
wget http://www.heise.de/netze/tools/meine-ip-adresse/ -O /tmp/myip.html
ip=`gawk '/arget_object/ {print $3}' /tmp/myip.html  | gawk -F= '{print $4}' | gawk -F\" '{print $1}'`

rm /tmp/myip.html

if [ "c${ip}" == "c${ip_old}" ]
then
echo "Keine Aenderung bei der IP-Adresse ${ip}"
exit 0
fi

echo "Aendere ${ip_old} nach ${ip}"
nsupdate -k /root/Khome.leppa.de.+157+58516.key << EOF
server psj-world.de
zone home.leppa.de
update delete dione.home.leppa.de A
update add dione.home.leppa.de 1200 A ${ip}
update delete login.home.leppa.de A
update add login.home.leppa.de 1200 A ${ip}
show
send
EOF

Zertifikate mit certutil (Teil 2)

Jens Appel

Test CA anlegen

  1. certutil
    • Erzeugen einer Zertifikats DB für die CA
      • # mkdir -p /CA/cacertdb
# certutil -N -d /CA/cacertdb -P "ca-"
    • Selbst signiertes CA Zertifikat anlegen
      • # certutil -S -x -n "ca-cert" -s "cn=CA Certificate  certutil,ou=TEST,o=foo,l=bar,c=DE" -t  CTPu -v 120 -d /CA/cacertdb -P "ca-" -5

      5 (SSL CA) und  ‚y‘ auswählen

    • CA cert in PEM Datei exportieren
      • # certutil -L -d /CA/cacertdb -P "ca-" -n "ca-cert" -a > cacert.pem

NSS DB für Directory server anlegen

  1. certutil
    • Passwort merken
      • # certutil -N -d /var/mps/serverroot/alias -P "slapd-myhost-"

Generate Certificate Signing Request (CSR) for server cert

  1. certutil
    2. # certutil -R -s "cn=myhost.test.foo.lan,ou=TEST,o=foo.,l=bar,c=DE" -o DER.csr -d /var/mps/serverroot/alias -P   slapd-myhost-"
  2. openssl
    • erzeugen eines 2048-bit RSA private key
      • # openssl genrsa -out privkey.pem 2048
    • oder  erzeugen 2048-bit DSA private key
      • # openssl dsaparam -out DSAparam.pem 2048
# openssl gendsa -out privkey.pem DSAparam.pem
    • Zertifikats Requesr generieren
      • # openssl req -new -key privkey.pem -out PEM.csr
    • Anzeigen des Zertifikats Requests
      • # openssl req -in PEM.csr -text -pubkey

Sign CSR using Test CA

  1. certutil
    • Sign DER CSR
      • # certutil -C -c "ca-cert" -i DER.csr -o ./cert.der -v 12 -d /CA/cacertdb -P "ca-" -5
    • Sign PEM CSR
      • # certutil -C -c "ca-cert" -a -i PEM.csr -o ./cert.pem -v 12 -d /CA/cacertdb -P "ca-" -5
  1. openssl
    2. # openssl ca -policy policy_anything -cert cacert.pem -in PEM.csr -out ./cert.pem

Import signed certs into NSS DB

  1. certutil
    • Import PEM server cert
      • # certutil -A -a -n "server-cert" -i ./cert.pem -t Pu -d /var/mps/serverroot/alias -P "slapd-myhost-"
    • Import DER server cert
      • # certutil -A -n  "server-cert" -i ./cert.der -t Pu -d /var/mps/serverroot/alias -P "slapd-myhost-"
    • Import PEM CA cert
      • # certutil -A -a -n "ca-cert" -i cacert.pem -t CT -d /var/mps/serverroot/alias -P "slapd-myhost-"
    • List the contents
      • # certutil -L -d /var/mps/serverroot/alias -P "slapd-myhost-"
    • List the contents of a specific cert
      • #certutil -L -d /var/mps/serverroot/alias -P "slapd-myhost-" -n "server-cert"
  2. openssl
    • Import openssl certificates/keys into NSS DB. Convert cert, key and CA cert into pkcs12 format
      • # openssl pkcs12 -export -in cert.pem -inkey privkey.pem -certfile cacert.pem -name "MY CERTIFICATE" -out mycert.p12
    • Import it into NSS DB
      • # pk12util -i mycert.p12 -d /var/mps/serverroot/alias -P "slapd-myhost-" -v

Enable SSL

Solaris Native LDAP client side

  • Create NSS DB (Don’t enter password. Just hit return)
    • # certutil -N -d /var/ldap
# chmod 444 /var/ldap/*
# Download the Test CA certificate on the client machine into a temporary location. Ex: /var/tmp/cacert.pem
  • Add CA certificate to the NSS DB
    • # certutil -A -n "ca-cert" -i /var/tmp/cacert.pem -a -t CT -d /var/ldap
  • Verify that „myhost“ is fully qualified. Else modify /etc/hosts (and if necessary /etc/nssswitch.conf)
    • # getent hosts 11.22.33.44
11.22.33.44 myhost.test.sun.com
  • Test with ldapsearch
    • # ldapsearch -v -h myhost.test.sun.com -p 636 -Z -P /var/ldap/cert8.db -b "dc=sun,dc=com" -s base "objectclass=*"
  • Initialize Native LDAP client using profile „tls-profile“.
    • # /usr/sbin/ldapclient init -a profileName=tls-profile -a  domainname=test.sun.com -a  proxyDN=cn=proxyagent,ou=profile,dc=test,dc=sun,dc=com -a  proxyPassword=proxy 11.22.33.44