a. login as root<\/p>\n
b. Edit the sudoers file u uusing visudo command
\nvisudo
\nEnsure the following is in the file if # is there infront of the line then remove it. Save the file hit esc key the : wq
\n## Allows people in group wheel to run all commands
\n%wheel ALL=(ALL) ALL<\/p>\n
c. Add users to wheel
\nusermod -aG wheel test
\nusermod -aG wheel test1
\nusermod -aG wheel test2.<\/p>\n
8 Fallback<\/p>\n
Time Activity Owner
\nAccess rights can be remove again by removing the user from wheel group.
\nid -nG <username> — This will list all the secondary group of the user
\nusermod \u2013G group1 group2 <username> — Keyin all the secondary groups except wheel
\nOr you can directly edit the \/etc\/group file and remove the username from the wheel group<\/p>\n
# cat \/etc\/group |grep -i wheel
\nwheel:x:10:root,test
\nvi \/etc\/group navigate to the wheel group and remove the user. Example <test><\/p>\n
Configuration of Reverse Proxy<\/p>\n
Steps for ssl<\/p>\n
FIRST TAKE a backup of apache config folder and cert.<\/p>\n
cp rmohan.com.conf rmohan.com.conf_13062017
\ncp -pR \/etc\/httpd\/conf.d\/cert \/etc\/httpd\/conf.d\/cert_13062017
\nStep 2<\/p>\n
Unzip the cert.zip
\n\/root\/cert
\nchange the file extenstion .txt to intermediate_ca.crt root_ca.crt rmohan.com_com_ee.crt
\ncopy the key file PrivateKey.key \/root\/cert
\nStep 3
\nTo combine them, run the following command in terminal:
\ncd \/root\/cert\/
\n$ cat intermediate_ca.crt root_ca.crt >> bundle.crt
\nStep 4<\/p>\n
apachectl stop<\/p>\n
Step 5<\/p>\n
copy \/root\/cert\/bundle.crt to \/etc\/httpd\/conf.d\/cert\/bundle.crt
\ncp rmohan.com_com_ee.crt \/etc\/httpd\/conf.d\/cert\/rmohan.com_com_ee.crt
\ncp PrivateKey.key \/etc\/httpd\/conf.d\/cert\/rmohan.com_com_RSA_private.key
\nSSLCACertificateFile “\/etc\/httpd\/conf.d\/cert\/bundle.crt”
\nSSLCertificateFile “\/etc\/httpd\/conf.d\/cert\/rmohan.com_com_ee.crt”
\nSSLCertificateKeyFile “\/etc\/httpd\/conf.d\/cert\/rmohan.com_com_RSA_private.key”
\nStep 6<\/p>\n
apachectl start<\/p>\n
we can use 2 methods<\/p>\n
First method<\/p>\n
How to generate x509 SHA256 hash self-signed certificate using OpenSSL<\/p>\n
openssl req -x509 -nodes -sha256 -days 365 -newkey rsa:2048 -keyout rmohan.com_com_RSA_private.key -out rmohan.com_com_ee.crt<\/p>\n
openssl x509 -noout -text -in rmohan.com_com_ee.crt
\nsecond method<\/p>\n
Create A Self-Signed SSL Certificate With OpenSSL
\nopenssl req -x509 -sha256 -newkey rsa:2048 -keyout rmohan.com_com_RSA_private.key -out rmohan.com_com_ee.crt -days 1024 -nodes
\ngenerating a 2048 bit RSA private key
\n………………………..+++
\n…………..+++
\nwriting new private key to ‘rmohan.com_com_RSA_private.key’
\n—–
\nYou are about to be asked to enter information that will be incorporated
\ninto your rmohan.com_com_RSA_private request.
\nWhat you are about to enter is what is called a Distinguished Name or a DN.
\nThere are quite a few fields but you can leave some blank
\nFor some fields there will be a default value,
\nIf you enter ‘.’, the field will be left blank.
\n—–
\nCountry Name (2 letter code) [AU]:SG
\nState or Province Name (full name) [Some-State]:Singapore
\nLocality Name (eg, city) []:Singapore
\nOrganization Name (eg, company) [Internet Widgits Pty Ltd]:Singapore Telecommunications Limited
\nOrganizational Unit Name (eg, section) []:Networks
\nCommon Name (e.g. server FQDN or YOUR name) []: smp.smart.singtel.com
\nEmail Address []:admin@singtel.com
\nopenssl req -x509 -sha256 -newkey rsa:2048 -keyout rmohan.com_com_RSA_private.key -out rmohan.com_com_ee.crt -days 1024 -nodes -subj ‘\/CN=smp.smart.singtel.com’
\nVerify sha256 hash function in self-signed x509 digital certificate<\/p>\n
openssl x509 -noout -text -in rmohan.com_com_ee.crt
\nThe Nginx front end distributes the method according to $remote_addr
\nRequirements are as follows:
\nThere are multiple servers under the domain name, is a test for a region, so that a region of the ip user only visit a server, a separate test, if no problem, all updated; problems are less affected,
\nTimely find the problem to solve the problem;<\/p>\n
Solution:
\nThe use of nginx module, in the front-end load balancing on the machine, configure the matching rules;
\nnginx configuration vhost inside, domain name below the location section, add a code
\nIf $remote_addr match ip, then forwarded to abc_test_server;
\nserver {
\nlisten 80;
\nserver_name rmohan.com;
\naccess_log \/dev\/null;
\nerror_log \/data\/logs\/error.log;<\/p>\n
location \/ {<\/p>\n
proxy_set_header Host $host;
\nproxy_set_header X-Real-IP $remote_addr;
\nproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
\nif ($remote_addr ~ “202.96.134.100”)
\n{
\nproxy_pass http:\/\/test_server;
\nbreak;
\n}
\nproxy_pass http:\/\/abc_server;
\n}
\n}<\/p>\n
#abc_test only
\nupstream test_server {
\nserver 192.168.2.10:80;<\/p>\n
}
\n#rmohan.com
\nupstream app_server {
\nserver 192.168.2.11:80;
\nserver 192.168.2.12:80;
\nserver 192.168.2.13:80;
\n}<\/p>\n
Will send an email now for the development<\/p>\n","protected":false},"excerpt":{"rendered":"
a. login as root<\/p>\n
b. Edit the sudoers file u uusing visudo command visudo Ensure the following is in the file if # is there infront of the line then remove it. Save the file hit esc key the : wq ## Allows people in group wheel to run all commands %wheel ALL=(ALL) ALL<\/p>\n
c. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/6833"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6833"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/6833\/revisions"}],"predecessor-version":[{"id":6834,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/6833\/revisions\/6834"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}