Utilitats i trucs

• "Require all granted"  "Order deny,allow", "Allow from all"

• a2query -v

• your_ip_address tva.com

• Running several name-based web sites on a single IP address
• Name-based hosts on more than one IP address
• ...

• non-secure virtual host
• • /etc/httpd/conf/vhosts.d/02_tva_vhost.conf
  • • NameVirtualHost *:80
<VirtualHost *:80>
  ServerName tva.com
  ServerAlias tva.com *.tva.com
  DocumentRoot /var/www/html_tva
</VirtualHost>
    • accessed from browser as:
    • • http://tva.com/
• secure virtual host
• • /etc/httpd/conf/vhosts.d/03_tva_ssl_vhost.conf
  • • <VirtualHost *:443>
  ServerName tva.com
  ServerAlias tva.com *.tva.com
  DocumentRoot /var/www/html_tva
</VirtualHost>
    • accessed from browser as:
    • • https://tva.com/

• <Directory "/var/www/html_2">
    Options -Indexes FollowSymLinks MultiViews
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>

• SetEnv VARIABLE toto_value
• test CGI to print them all

• mpm_prefork_module
• • number of childs: StartServers, MinSpareServers, MaxSpareServers, MaxClients
  • • number of requests per child: MaxRequestsPerChild

• apache_config
• • install_apache.sh
  • webapp_name.conf
• index.html
• js/
• css/
• ...

• #!/bin/bash
EXPECTED_ARGS=1
if [ $# -ne $EXPECTED_ARGS ]
then
    cat <<EOF
Usage: `basename $0` webapp_name
Example: `basename $0` hbbtv
Actions:
- copy webapp_name.conf to apache configuration directory (e.g. /etc/httpd/conf/webapps.d/)
- recursively copy .. (parent directory, except apache_config) to apache directory (e.g. /var/www/webapp_name/)
- change the owner and group of the files and directories to the right ones
The following typical OS are automatically detected:
- Red Hat, CentOS, Mageia, ...
- Debian, Ubuntu, ...
- MAC OSX (MAMP)
EOF
    exit 1
fi
webapp_name=$1
webapp_dir=/var/www/${webapp_name}
# Red Hat, CentOS, Mageia, ...
if [ -f /etc/httpd/conf/httpd.conf ]
then
    httpd_config=/etc/httpd/conf/httpd.conf
    webapp_conf_dir=/etc/httpd/conf/webapps.d/    
    grup_httpd=`grep "^Group" $httpd_config | awk '{print $2}'`
    usuari_httpd=`grep "^User" $httpd_config | awk '{print $2}'`
fi
# MAC OSX
if [ -f /Applications/MAMP/conf/apache/httpd.conf ]
then
    httpd_config=/Applications/MAMP/conf/apache/httpd.conf
    webapp_conf_dir=/Applications/MAMP/conf/apache/extra
    webapp_dir=~/sites/${webapp_name}
fi
# Debian, Ubuntu, ...
if [ -f /etc/apache2/apache2.conf ]
then
    httpd_config=/etc/apache2/apache2.conf
    webapp_conf_dir=/etc/apache2/conf.d/    
    usuari_httpd=`awk -F= '/APACHE_RUN_USER/ {print $2}' /etc/apache2/envvars`
    grup_httpd=`awk -F= '/APACHE_RUN_GROUP/ {print $2}' /etc/apache2/envvars`
fi
# còpia recursiva de la webapp
echo "copying application $webapp_name to $webapp_dir"
mkdir -p $webapp_dir
rsync -a --exclude='.git' --exclude='apache_config' .. $webapp_dir
chown ${usuari_httpd}.${grup_httpd} -R $webapp_dir
# webapp config
echo "copying config file ${webapp_name}.conf to ${webapp_conf_dir}"
cp ${webapp_name}.conf ${webapp_conf_dir}

• apachectl -l
• httpd -l

• apachectl -t
• httpd -t

• apachectl -M
• httpd -M

• LogLevel debug

• errors
• • ErrorLog "logs/error_log"
  • LogLevel debug
• access
• • TransferLog  "logs/access_log"
  • # CustomLog with format nickname
LogFormat "%h %l %u %t \"%r\" %>s %b" common
CustomLog "logs/access_log" common
  • # CustomLog with explicit format string
LogFormat "logs/access_log" "%h %l %u %t \"%r\" %>s %b"
  • # real remote ip when using AWS ELB load balancer (%a, %h give ELB ip address) LogFormat"%v %A %{X-FORWARDED-FOR}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" elb-ncsa
CustomLog "logs/access_log" elb-ncsa

• CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log vhost_combined

• "Client denied by server configuration" / 403 Forbidden
• • Apareix al navegador com a: «Forbidden You don't have permission to access / on this server.»
  • Si feu servir Apache 2.4, comproveu que feu servir la directiva "Require all granted" i no "Order deny,allow", "Allow from all"
  • Comproveu que el directori dins de la directiva <Directory ...> és el correcte
  • Comproveu els permisos Unix amb / Check Unix permissions with:
  • • namei -m /ful/path/to/index.html
• ValueError: Unable to configure handler 'logfile': [Errno 13] Permission denied: .../logfile
• • Passa amb el log de Django. settings.py:
  • • LOGGING = {
...
    'handlers': {
        'logfile': {
            'filename': PROJECT_PATH + "/logfile",
  • Solució / Solution:
  • • ...

• "http dead but subsys locked" / /usr/sbin/httpd: Symbol lookup error: /usr/lib64/libaprutil-1.so.0: Undefined symbol: apr_os_uuid_get
• • Solució / Solution
  • • Apache symbol lookup error apr_os_uuid_get
    • steps:
    • 1. yum erase libapr1
      2. yum install apr apr-util apr-util-ldap httpd httpd-tools [mod_ssl]

• Listen 8000 # can be specified in sites.d/toto.conf instead

• Listen 8000
<VirtualHost _default_:8000>

• semanage port -l | grep -w http_port_t
• semanage port -a -t http_port_t -p tcp 12345

• Listen 12345

• #!/usr/bin/perl
print "Content-type: text/html\n\n";
foreach $key (keys %ENV) {
print "$key --> $ENV{$key}<br>";
}

• # Mageia, CentOS, ... httpd_config=/etc/httpd/conf/httpd.conf
usuari_httpd=`grep "^Group" $httpd_config | awk '{print $2}'`
grup_httpd=`grep "^User" $httpd_config | awk '{print $2}'`
chmod ${usuari_httpd}.${grup_httpd} -R ...
• # Ubuntu
usuari_httpd=`awk -F= '/APACHE_RUN_USER/ {print $2}' /etc/apache2/envvars`
grup_httpd=`awk -F= '/APACHE_RUN_GROUP/ {print $2}' /etc/apache2/envvars` chmod ${usuari_httpd}.${grup_httpd} -R ...

• cd /var/www/html
• ln -s /home/user1/parent_dir/other_dir new_dir

• Alias /new_dir /home/user1/parent_dir/other_dir <Directory "/home/user1/parent_dir/other_dir">
    Options -Indexes +FollowSymLinks +MultiViews
    AllowOverride None
    # Apache 2.2:
    #Order allow,deny
    #Allow from all
    # Apache 2.4:
    Require all granted
</Directory>

• # usermod -a -G apache user1
• # chgrp apache -R /home/user1/parent_dir/
• # chmod g+x /home/user1/parent_dir/
• # chmod g+rX -R /home/user1/parent_dir/other_dir

• [cd /etc/httpd/conf/vhosts.d; cp 01_default_ssl_vhost.conf 02_hostname_ssl_vhost.conf]
• canvi de port 443 -> 8443:
• • httpd.conf (diu quins ports obre per a escoltar)
  • • Listen 8443
  • 01_default_ssl_vhost.conf (diu a quin dels ports on està escoltant fa referència)
  • • <VirtualHost _default_:8443>

• cd /etc/apache2/sites-enabled; sudo ln -s ../sites-available/default-ssl 001-default-ssl
• cd /etc/apache2/mods-enabled; sudo ln -s ../mods-available/ssl.conf .; sudo ln -s ../mods-available/ssl.load .
• canvi de port 443 -> 8443:
• • ports.conf (diu quins ports obre per a escoltar)
    • Listen 8443
  • default-ssl (diu a quin dels ports on està escoltant fa referència)
    • <VirtualHost _default_:8443>
• sudo service apache2 restart

• Creating Certificate Authorities and self-signed SSL certificates
• Secure Websites Using SSL And Certificates

1. Creeu una CA amb OpenSSL / Create a CA with OpenSSL
2. Creeu un certificat de servidor amb OpenSSL i / Create a server certificate with OpenSSL and:
   
   • mv /etc/pki/tls/newcert.pem /etc/pki/tls/certs/hostname_server.crt
   • mv /etc/pki/tls/newkey.pem /etc/pki/tls/private/tva_server.key
3. Configuració del servidor Apache / Apache server configuration:
   • /etc/hosts
   • • your_ip_address hostname
   • /etc/httpd/conf/httpd.conf
   • • LoadModule ssl_module modules/mod_ssl.so
   • cp /etc/httpd/conf/vhosts.d/01_default_ssl_vhost.conf /etc/httpd/conf/vhosts.d/02_hostname_ssl_vhost.conf
   • /etc/httpd/conf/vhosts.d/02_hostname_ssl_vhost.conf
   • • secure virtual host
     • Optional:
       DocumentRoot "/var/www/html_segur"
<Directory "/var/www/html_segur">
    Options -Indexes FollowSymLinks MultiViews
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>
     • If you are using intermediate CA certificates (Install your Certificates on Apache (OpenSSL)):
     • • SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
     • SSLCertificateFile /etc/pki/tls/certs/hostname_server.crt
     • SSLCertificateKeyFile /etc/pki/tls/private/hostname_server.key
   • to avoid entering the passphrase every boot, create an unsecure version of your key file:
   • • cd /etc/pki/tls/private; cp hostname.key hostname.key.orig; openssl rsa -in hostname.key.orig -out hostname.key; chmod 700 hostname.key
4. Configuració del client / Client configuration
   • import CA
   • connect to server:
   • • https://...
   • Si la resposta és sec_error_inadequate_key_usage:
   • • comproveu que al certificat del servidor, a keyUsage hi ha keyEncipherment
   • Si sec_error_reused_issuer_and_serial:
   • • Netegeu la memòria cau del navegador / Clean the cache on the browser
   • Si sec_error_unknown_issuer:
   • • Descarregueu el certificat de la CA i doneu-li permís per a identificar servidors www: "Confia en aquesta CA per identificar llocs web"
   • ssl_error_rx_record_too_long
   • • check /var/log/httpd/ssl_error_log
5. Accés des de client / Access from client:
   • openssl s_client -connect www.yourserver.com:443

• mv newcert.pem hostnameCert.prm; cp /etc/pki/tls/hostnameCert.prm /etc/pki/tls/certs/hostname_server.crt
• mv newkey.pem hostnameKey.pem; cp /etc/pki/tls/hostnameKey.pem /etc/pki/tls/private/hostname_server.key

• User Authentication
• Autenticación DNIe con Apache2 y PHP

1. Creeu un certificat de client amb OpenSSL / Create a client certificate with OpenSSL (client.crt)
2. Encapsuleu el certificat de client en un fitxer PKCS12 / Encapsulate client certificate into a PKCS12 file (client.p12)
3. Configuració del servidor Apache / Apache server configuration:
   • import CA certificate
   • • creat per nosaltres / created by us
     • • cp ...
     • altres / others (e.g. for DNIe)
     • • cd /etc/pki/tls/certs/
       • wget http://www.dnielectronico.es/ZIP/ACRAIZ-SHA1.zip
       • unzip ACRAIZ-SHA1.zip
       • conversion from DER to PEM:
       • • openssl x509 -in ACRAIZ-SHA1.crt -inform DER -out ACRAIZ-SHA1.crt -outform PEM
   • Host based:
   • • /etc/httpd/conf/vhosts.d/01_default_ssl_vhost.conf
     • • SSLEngine on
#CA certificate (PEM encoded) whose client certificates the server is prepared to accept
SSLCACertificateFile /etc/pki/tls/certs/ACRAIZ-SHA1.crt
SSLVerifyClient require
SSLVerifyDepth  10
     • el navegador presentarà una llista dels certificats de client disponibles, però només aquells que hagin estat emesos per la CA especificada a SSLCACertificateFile (TLS: RFC 4336 7.4.4 "Certificate request")
   • Directory-based: Authentication with a certificate:
   • • Install mod_auth_certificate (*)
     • • urpmi apache-mod_auth_certificate
     • /usr/share/doc/apache-mod_auth_certificate/README
     • config Apache ssl to require client certificate
     • /etc/httpd/conf/httpd.conf:
     • • LoadModule auth_certificate_module   /usr/lib/apache-extramodules/mod_auth_certificate.so
         <Directory "/var/www/html/protegit_c">
  CertAuthEnabled on
  AuthType Cert
  AuthName "Zona protegida (cert)"
  Require valid-user
</Directory>
     • Problems
     • • SSL connection fails on the server with SSL_ERROR_HANDSHAKE_FAILURE_ALERT (ssltap) (Mozilla ssltap))
4. Configuració de client / Client configuration:
   • Si el client es connecta amb un navegador / If the clients connects from a web browser:
   • • El client ha d'importar el fitxer .p12 a les preferències del navegador WWW / Client must import the .p12 file into the browser preferences
     • es connecta a (vegeu també / see also: PHP):
     • • https://...
   • Si el client es connecta per línia de comanda / If the client connects from command line:
   • • la CA li ha de passar el certificat de client (client_pem.crt), la clau de client (client_pem.key) i el certifcat de la CA (root_ca_pem.crt)
     • el client es connecta de forma segura:
     • • wget --certificate=client_pem.crt --private-key=client_pem.key --ca-certificate=root_ca_pem.crt https://...
   • Perquè el navegador oblidi el certificat de client amb què s'ha connectat:
   • • Eines -> Neteja l'historial recent -> Sessions actives
   • Si quan el client es connecta apareix un error del tipus ssl_error_handshake_failure_alert, pot ser que:
   • • el client no tingui instal·lat cap certificat de client (per exemple, el DNIe)
     • (el servidor no tingui el SSLCACertificate adequat)
   • Si ssl_error_unknown_ca_alert
   • • el servidor no té el SSLCACertificate adequat

• Authentication, Authorization and Access Control (htaccess,...) / Access Control (Apache 2.2)

1. Configuració del servidor Apache / Apache server configuration:
   • Install mod_auth_basic, mod_auth_digest (mod_auth_cert?)
   • • urpmi ...
   • mkdir /var/www/passwd
   • htpasswd -c /var/www/passwd/passwords user_name
   • /etc/httpd/conf/httpd.conf
   • • <Directory "/var/www/html/protegit">
  AuthType Basic
  AuthName "Zona protegida"
  # (Following line optional)
  AuthBasicProvider file
  AuthUserFile /var/www/passwd/passwords
  Require valid-user
</Directory>
   • http://server/protegit/

1. Creeu una llista de revocació (CRL amb OpenSSL / Create a revocation list (CRL) with OpenSSL
2. Configuració del servidor Apache / Apache server configuration:
   • /etc/httpd/conf/vhosts.d/02_hostname_ssl_vhost.conf
   • • SSLCARevocationFile /etc/pki/tls/crl/cacrl.pem
3. Client:
   • es connecta a:
   • • https://...
   • i rep un error del tipus ssl_error_revoked_cert_alert

• nginx version: nginx/1.10.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-4) (GCC)
built with OpenSSL 1.0.1e-fips 11 Feb 2013
TLS SNI support enabled
configure arguments: --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'

• sudo adduser --system --no-create-home --user-group -s /sbin/nologin nginx

• sudo adduser --system --no-create-home --disabled-login --disabled-password --group nginx

• ngx_http_xslt_module
  • Exemples / Examples
    • nginx-rtmp-module stats
    • arguments from queryset
    • arguments from url
      • NGINX extract last part of url
      • ...

• Error while compiling with nginx 1.15.0 #1283
• Solució / Solution
  • ./configure ... --with-cc-opt="-Wimplicit-fallthrough=0"

• Systemd
• • nginx.service
    • [Unit]
Description=The NGINX HTTP and reverse proxy server
After=syslog.target network.target remote-fs.target nss-lookup.target cloud-init.target
DefaultDependencies=no
[Service]
Type=forking
PIDFile=/run/nginx.pid
TimeoutStartSec=200s
ExecStartPre=/usr/sbin/nginx -t
PrivateTmp=true
# other exectartpre scripts
ExecStartPre=/bin/bash -c 'for script in /etc/nginx/execstartpre.d/*; do $script; done'
ExecStart=/usr/sbin/nginx
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s QUIT $MAINPID
[Install]
WantedBy=multi-user.target
  • save it to:
  • • /usr/lib/systemd/system/nginx.service

• Upstart

• /usr/local/nginx/sbin/nginx

• /usr/local/nginx/sbin/nginx -s stop

• /usr/local/nginx/sbin/nginx -s reload

• /path/to/

• ./ffstream.sh
• with ffmpeg
• • ffmpeg -loglevel verbose -re -i sintel-1024-stereo.mp4 -c copy -f flv rtmp://localhost/myapp/mystream

• ./play.sh
• ffplay -loglevel verbose "rtmp://localhost/myapp/mystream"

• http://localhost:8080/stats

• nginx.conf
• • ...
  •         location /stat.xsl {
            # you can move stat.xsl to a different location
            #root /usr/build/nginx-rtmp-module;
            root /home/cesc/src/nginx-1.7.0/nginx-rtmp-module;
        }

• PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="64"
OPTIONS=""

• ...
OPTIONS="-s '/var/run/memcached/memcached.sock' -a 0766"

• urpmi squid

• acl localnet src <client_ip>/32
http_access allow localnet

• pdftk toto.pdf burst

• pdftk 1.pdf 2.pdf cat output 12.pdf

• pdftk input.pdf multistamp footer.pdf output input_with_footer.pdf

• urpmi fastjar gcc-java
• modify Makefile.Base:
• • ... -I$(JAVALIBPATH) -I/usr/include/libgcj-4.4.3 ...
• make -f Makefile.RedHat

• Chapter 28. PAM-Based Distributed Authentication

• Samba & LDAP (SambaWiki)
• Samba and LDAP (Ubuntu)
• Tools:
• • smbldap-tools

• Chapter 18. Network File System (NFS)
• Sharing files with NFSv4 on Fedora (Server & Client configuration)
• Setting Up NFS Server And Client On CentOS 7
• yum install nfs-utils nfs-utils-lib
• firewalld
• • systemctl start firewalld.service
  • NFSv4
  • • firewall-cmd --permanent --add-service=nfs
    • firewall-cmd --permanent --add-service=rpc-bind
    • firewall-cmd --permanent --add-service=mountd
  • firewall-cmd --reload
• SELinux (in server or in client?)
• • option 1: booleans
  • • getsebool -a | grep -i nfs
    • setsebool -P <someboolean>=1 <someotherbool>=1 ...
  • option 2: policy
  • • grep rpc.statd /var/log/audit/audit.log | audit2allow -M mypol
    • semodule -i mypol.pp
• NFSv4
• • systemctl enable rpcbind.service nfs-idmapd.service nfs-server.service
  • systemctl start rpcbind.service nfs-idmapd.service nfs-server.service
  • Problemes / Problems
  • • # systemctl enable nfs-idmap.service
Failed to execute operation: No such file or directory
    • • Solució / Solution
      • • /usr/lib/systemd/system/nfs-idmapd.service
        • • [Install]
WantedBy=multi-user.target
        • systemctl enable nfs-idmapd.service
• NFSv3
• • systemctl start rpc-statd.service
  • systemctl start rpcbind nfs-lock nfs-idmap

• urpmi nfs-utils
• service nfs-server start
• firewall (shorewall) (Réseau Linux avec NFS - Mandriva) (Configuring NFS under Linux for Firewall control)
• • /etc/sysconfig/nfs-common:
  • • STATD_OPTIONS="--port 4000"
  • service nfs-common restart
  • /etc/sysconfig/nfs-server:
  • • RPCMOUNTD_OPTIONS="--port 4002"
  • service nfs-server restart
  • /etc/modprobe.conf:
  • • options lockd nlm_udpport=4001 nlm_tcpport=4001
  • reboot computer
  • open ports: 111/tcp 111/udp 2049/tcp 2049/udp 4000:4002/tcp 4000:4002/udp
  • check port attibution:
  • • rpcinfo -p

• [General]
Domain = domain.tld
[Mapping]
Nobody-User = nfsnobody
Nobody-Group = nfsnobody

• rpcbind: 172.16.11.0/255.255.255.0

• /tmp 172.16.11.0/24(no_all_squash,async,secure,no_subtree_check,ro)
• # NFSv4 (in client: mount -t nfs4 server_address:/var/toto)
/var/toto 172.16.11.0/24(rw,sync)
• # NFSv4(in client: mount -t nfs4 server_address:/)
/var/toto 172.16.11.0/24(rw,sync,fsid=0)
• # NFSv4 (in client: mount -t nfs4 server_address:/)
# exported dir /mnt/vol1 is itself a mounted drive
/mnt/vol1 172.31.0.0/16(rw,async,mountpoint=/mnt/vol1,fsid=0,no_root_squash)

• 21.6 NFS Server Configuration
• 21.7 The /etc/exports Configuration File
• Optimizing performance: Network File Systems (MythTV)

• 			optimized (suggested by MythTV)
  general options	ro, rw	read only, read and write
  	insecure	allow connections from port 1024 and higher
  	insecure_locks	allow insecure file locking
  	no_subtree_check	disable subtree checking
  	sync / async	sync write operations on request	async
  	no_wdelay	force sync of write operations immediately
  	nohide	do not hide filesystems beneath
  	mountpoint[=/mnt/xxx]	export only if mounted
  	fsid=X	set explicit filesystem ID
  	tcp / udp		udp
  user access	no_root_squash	remove map of root in client to anonymous in server (use carefully)
  	all_squash	map all users in client to anonymous in server
  	anonuid	specify uid of the anonymous user in server
  	anongid	specify gid of the anonymous group in server

• exportfs

• exportfs -rav

• exportfs -uav

• info
  • Using SMBClient to Enumerate Shares
• list
  • smbclient -L 192.168.1.1 -U ' % '
• connect
  • smbclient \\\\192.168.1.1\\samba -U ' % '
• ...

• Instal·lació / Installation
  • urpmi samba

• nmblookup WORKGROUP

• without password:
• • smbclient -L192.168.1.100 -N
  • smbclient -L192.168.1.100 -U ' % '

• /root/.smbpasswd
  • username=
    password=
• sudo mkdir /mnt/ont
• sudo mount -v -t cifs //192.168.1.1/samba /mnt/ont/ -o credentials=/root/.smbpasswd -o vers=1.0

• Solució / Solution
  • a l'ordinador que fa de client:
    • /etc/samba/smb.conf
      • [global]
client lanman auth = yes
client ntlmv2 auth = no

• No subject (Re: smbmount from Linux to an AS/400)
• wireshark
  • a byte 00 is following any single character:
    • u 00 s 00 b 00 2 00 _ 00 1 00 _ 00 1 00/7

• Solution: umount -l /mnt/directory

1. creeu els grups amb el mateix GID que al servidor:
   • # groupadd -g 8001 grup_secundari_1
   • # groupadd -g 8002 grup_secundari_2
   • ...
2. assigneu a l'usuari aquests grups secundaris:
   • # usermod -a -G grup_secundari_1 grup_secundari_2 nom_usuari
3. (opcional) si l'usuari no vol esperar a sortir i tornar a entrar, pot forçar l'actualització dels grups:
   • $ newgrp grup_secundari_1 grup_secundari_2

• service rpcbind start
• service nfs-common start

• Dolphin: network NFS

• [General]
Domain = domain.tld
[Mapping]
Nobody-User = nfsnobody
Nobody-Group = nfsnobody

• <ip-address-to-server>:/var/toto /mnt/toto nfs4 rsize=8192,wsize=8192,timeo=14,soft 0 0
• Example (generated by manual mount in CentOS 7: mount -t nfs4 192.168.1.218:/ /mnt/nfs) in /etc/mtab
• • 192.168.1.218:/ /mnt/nfs nfs4 rw,relatime,vers=4.0,rsize=262144,wsize=262144,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,clientaddr=192.168.1.236,local_lock=none,addr=192.168.1.218 0 0

• Avoid stuttering streaming from NFS shares with XBMC on the Raspberry Pi
• Optimizing performance: Network File Systems (MythTV)

• 			optimized
  general options	hard / soft	soft: not recommended when using a very busy server
  	timeo=value_seconds	default: 600
  	actimeo=value_seconds		actimeo=0
  	sync / async		async
  	intr	Makes I/O to a NFS mounted filesystem interuptable if the server is down	intr
  	nfsvers={2,3}
  	vers=4.0
  	nolock
  	noexec
  	namlen=255
  	port=num
  	rsize=num,wsize=num	default for v2,v3: 8192; default for v4: 32768 (CentOS: 262144)	rsize=32768,wsize=32768
  	sec={sys,krb5,krb5i,krb5p}
  	tcp / udp
  	proto=tcp
  	retrans=2
  	relatime
  	noatime
  user access	nosuid
  	noacl

• cat /proc/mounts

• su my_user -c "mkdir /mnt/nfs/my_dir"
• the following variant cannot be called from userdata in aws cloudformation because you cannot use sudo in it (you will have the error "sudo: sorry, you must have a tty to run sudo"):
• • sudo su - my_user -c "mkdir /mnt/nfs/my_dir"

• su nginx -s /bin/bash -c "mkdir /mnt/nfs/my_dir; chmod 777 /mnt/nfs/my_dir; chmod g+s /mnt/nfs/my_dir"

• showmount -e <remote_server_ip_address>

•  ~/.ooo3/user/template/

• .../plantilles/

• Creating a template from a document
• • Esborreu totes les transparències que no desitgeu / Remove all unwanted slides
  • Fitxer -> Plantilles -> Desa
• Creating a template using a wizard

• oowriter:
• • Assign template (current document)
  • Assign template (folder)
• ooimpresss:
• • Assign template (folder)

• si voleu modificar puntualment l'estil d'una part (p.ex. una paraula) podeu fer servir alguna d'aquestes opcions:
  • Format -> ...
  • el tipus de lletra o mida des de la barra d'eines de formatació (apareix amb: Visualitza -> Barra d'eines -> Formatació)
• per a tornar a l'estil que li tocaria:
  • (botó dret) Neteja la formatació directa
• si voleu que l'estil passi a tenir les característiques puntuals:
  • Estils -> Actualitza l'estil seleccionat

• Using the Template Management dialog
• Loading styles from a template or document (oowriter)

• A partir d'una pàgina mestra:
• • Plafó lateral dret: Pàgines mestres -> Disponibles per a ser utilitzades (les de ~/.ooo3/user/template/)
  • Si heu modificat la pàgina mestra d'una plantilla disponible, haureu de tancar i tornar a obrir l'OpenOffice perquè els canvis es recarreguin.
• Per a tenir més pàgines mestres disponibles, a partir de plantilles (Load additional slide masters):
• • Format -> Disseny de la diapositiva -> Carrega -> Les meves plantilles (potser les que ja surten no són les de ~/.ooo3/user/template/)
• Si es vol importar la pàgina mestra des d'una altra presentació, primer s'haurà de desar aquesta altra presentació com a plantilla, i després aplicar el procediment descrit en el punt anterior.

• Insereix -> Índexs i taules -> Índexs i taules -> Entrades
• • A la casella en blanc que hi ha entre «E#» i «E» poseu-hi un espai (amb el teclat)

• (menú contextual) Edita l'índex o la taula -> Entrades
• a la posició desitjada (casella en blanc), amb el botó Enllaç, incloure principi d'enllaç (LS); a la posició final, tornar a prémer el botó Enllaç per a posar un final d'enllaç (LE). El text així delimitat serà clicable.

• Visualitza -> Barra d'eines -> Formatació
• Estils de pàgina -> Primera pàgina / Per defecte

• (Estil de pàgina -> Primera pàgina / Per defecte): menú -> Modifica -> Capçalera/Peu de pàgina -> Activa

• Insereix -> Salt de pàgina
  • (click dret sobre el salt de pàgina) Edita el salt de pàgina
    •  Flux de text: Salts -> Insereix -> Amb estil de pàgina: Horitzontal

• Insereix -> Salt de pàgina
  • (click dret sobre el salt de pàgina) Edita el salt de pàgina
    • Flux de text: Salts -> Insereix -> Amb estil de pàgina: Estil de pàgina per defecte

• Eines -> Opcions -> Language settings -> Languages -> Default languages for documents -> Només per al document actual

• [seleccioneu el marc]
• menú contextual: Llegenda...

• Alineació -> Centrada
• Àncora -> Al paràgraf
• Ajusta -> Sense ajustament (Cap)

• Eines -> Opcions -> OpenOffice.org writer -> Llegenda automàtica -> Imatge de l'OpenOffice Writer -> Categoria: Figura

• Alinea els objectes -> Centrat
• Àncora -> Al paràgraf
• Ajusta -> Cap

• Insereix -> Referència creuada
  • Tipus: Figura
  • Consulteu utilitzant: Categoria i número

• ...

• Eines -> Opcions -> OpenOffice.org writer -> Llegenda automàtica -> Taula de l'OpenOffice Writer -> Categoria: Taula

• Eines -> Base de dades bibliogràfica

• Insereix -> Índexs i taules -> Entrada bibliogràfica

• Insereix -> Índex i taules -> Taula de continguts, índex o bibliografia -> Tipus: Bibliografia

• Bibliografia (botó dret) Edita l'índex -> Estils
  • seleccioneu a l'esquerra: Títol [Encapçalament de la bibliografia]
  • seleccioneu a la dreta: Encapçalament 1
  • cliqueu sobre el botó <
    • a l'esquerra ara tindreu: Títol [Encapçalament 1]

• Select hyperlink
• Edit -> Hyperlink

• Si s'han importat fletxes grosses bidireccionals des d'un MSPowerPoint, l'OpenOffice petarà quan s'intenti fer una exportació a PDF.
• Okular
• • no apareixen els enllaços
  • • assegureu-vos que esteu en mode «Visualització» (i no en «Selecció de text»)

• assegureu-vos que és el mateix directori que fa servir Firefox
  • p.ex: firefox:default (~/.mozilla/firefox/xxxxxxxx.default/)

• ...

• Fitxer > Signatures digitals > Signatures digitals...
  • Signa el document...
    • us hauria de sortir una llista dels certificats disponibles; si us surt una llista buida, verifiqueu el «Camí del certificat»
    • seleccioneu-ne un
    • assegureu-vos que és vàlid fent «Mostra el certificat...»
      • si a la pestanya «General» us diu «No s'ha pogut validar el certificat»:
        • ...
    • «Signa»
      • si el cerificat no s'havia pogut validar, us apareixerà un avís: «Com a mínim una signatura té problemes: no se n'ha pogut validar el certificat»

• Fitxer > Exporta com a PDF...
  • pestanya: Signatures digitals
    • Selecciona...

• Signatura digital / Digital signature

• Signing an ODF document
• Checking the digital signature of an ODF document
• Modifying a signed ODF document
• Exporting a document as a signed PDF
• Checking the digital signature of a PDF document
• Checking the digital signature of a PDF document
• Setting up LibreOffice to use Chromium certificates

• Draw examples: macro for automatically rename slides based on the title

• Ajusta a la vora

• seleccioneu-lo
• menú botó dret: activeu Punts

• Visualitza -> Barres d'eines -> Formatació de text
  • (clic dret sobre la barra d'eines de formatació de text) Personalitza la barra d'eines... -> Categoria: Formata -> Fontwork -> (fletxa cap a la dreta)
• Eines -> Personalitza -> Barres d'eines -> Barra d'eines: Dibuix -> Afegeix -> Formata -> Fontwork

• Seleccioneu el connector i cliqueu sobre la icona que acabeu d'afegir (Fontwork)

• poseu el 4t paràmetre a 0 per a trobar el valor exacte (no el primer que se li assembli)

• Visualitza > Salt de pàgina

• sudo update-rc.d toto defaults 90 10

• autoreconf --install
• ./configure
• make
• make install

• urpmi libpython2.6-devel
• python setup.py install

• autoreconf --install
• ./configure
• make
• make install

• sudo urpmi congruity

<svg ...
width="..."
height="..."
ViewBox="0 0 200 100">
...                  

<object type="image/svg+xml" data="figure.svg" width="40" height="20">
You cannot display SVG files.
</object>

• Mageia
  • sudo dnf install qrencode

• qrencode -t SVG -o fpm_qr.svg http://www.francescpinyol.cat/

• urpmi nautilus-dropbox (will also install dropbox package)

• urpmi gcc make lib64nautilus-devel python-docutils

• CTRL + ALT F2 to open a text console
• • $ dropbox start
• or use Gnome instead of Plasma

• kill the dropbox process
• dropbox start

• urpmi cmake lib64json-devel

1. git clone git://github.com/lloyd/yajl yajl
2. cd yajl
3. ./configure
4. cmake .
5. make
6. su; make install

1. git clone https://github.com/Grive/grive.git
2. cd grive
3. cmake .
4. make
5. su; make install

• Getting started
• ~/.emacs
• • (when (>= emacs-major-version 24)
  (require 'package)
  (add-to-list
   'package-archives
   '("melpa" . "http://melpa.org/packages/")
   t)
  (package-initialize))

• M-x list-packages

• (add-to-list 'load-path "~/.emacs.d")

• (require 'toto)

• ELPA

• M-x indent-guide-mode

• M-x package-install
• • dash

• (wrap-region-add-wrapper "{t}" "{/t}" "/")     ; hit / then region -> {t}region{/t}

• (add-to-list 'load-path "~/.emacs.d/wrap-region.el")

• M-x html-mode
• M-x wrap-region-mode
• select text
• type '/'

• install
• • ~/.emacs
  • • (require 'whitespace)
• activate
• • C-u 1 M-x whitespace-mode RET
• deactivate
• • C-u 0 M-x whitespace-mode RET

• #!/bin/bash
# defaults
output_encoding=utf-8
EXPECTED_ARGS=1
if (( $# != $EXPECTED_ARGS ))
then
    cat <<EOF
Usage: `basename $0` html_filename
Converts html_filename to ${output_encoding}, by modifying the file text encoding and setting:
  <meta content="text/html; charset=${output_encoding}" http-equiv="Content-Type">
EOF
    exit 1
fi
# parameters
input_path=$1
input_basename=$(basename ${input_path})
input_name=${input_basename%.*}
input_extension=${input_basename##*.}
input_dirname=$(dirname ${input_path})
output_basename=${input_name}.${output_encoding}.${input_extension}
output_path=${input_dirname}/${output_basename}
# get present mime-type
mime=$(file -bi ${input_path})
echo "file mime: ${mime}"
# get present text encoding charset
charset=${mime##*=}
echo "file charset: ${charset}"
if [[ $charset != $output_encoding ]]
then
    echo "converting file to $output_encoding"    
    # convert file encoding
    iconv -f ${charset} -t ${output_encoding} ${input_path} >${output_path}    
    # convert html charset
    sed -i "/<meta.*charset/ c\  <meta content=\"text/html; charset=${output_encoding}\" http-equiv=\"Content-Type\">" ${output_path}    
    # rename output file
    rm -f ${input_path}
    mv ${output_path} ${input_path}
else
    echo "file already in $output_encoding"
fi
exit 0

• function cgi-decodevar()
• echo "https%3A%2F%2Fwww.example.org%2F" | xargs python -c "import urllib, sys; print urllib.unquote(sys.argv[1])"

• urllib.quote
• urllib.unquote

• slapd-config: OLC (on-line configuration)
• • based on /etc/openldap/slapd.d/
  • Chapter 6.1.1: OpenLDAP using OLC (cn=config)
• slapd.conf (deprecated)
• • based on /etc/openldap/slapd.conf

• urpmi openldap-servers

• OpenLDAP Software 2.4 Administrator's Guide (openldap.org)
• • 2. A Quick-start guide
  • 5. Configuring slapd
• OpenLDAP server (Ubuntu)
• • User and group management
  • • sudo apt-get install ldapscripts
    • • ldapadduser
      • ldapsetpasswd
      • ldapdeleteuser
      • ldapaddusertogroup
      • ldapdeleteuserfromgroup
      • ldapmodifyuser
• Configure LDAP server (CentOS)
• LDAP (OpenLDAP): instalación y configuración (I)
• schema
• • /usr/share/openldap/schema/
• passos / steps:
• 1. slappasswd
     • {SSHA}xxxx
  2. /etc/openldap/slapd.conf
     • rootpw {SSHA}xxxx
suffix "dc=example,dc=com"
rootdn "cn=Manager,dc=example,dc=com"
  3. logs
     • /etc/openldap/slapd.conf
     • • loglevel 128
     • /etc/syslog.conf
     • • local4.* /var/log/ldap.log
     • service rsyslog restart
     • service ldap restart
  4. migració dels usuaris de sistema
     • Migrating Unix and smbpasswd Accounts to LDAP
     • Capítulo 9. Migración de usuarios y grupos Unix/Posix al directorio LDAP
     • urpmi smbldap-tools
     • cd /tmp
     • ...
     • /usr/share/doc/smbldap-tools/doc/migration_scripts/smbldap-migrate-unix-accounts -P users.passwd -S users.shadow -v -n -a
  5. configuració del sistema perquè comprovi les contrasenyes des de fitxer i des d'ldap
     • urpmi nss_ldap
     • /etc/nsswitch.conf
     • • passwd: files ldap
shadow: files ldap
group: files ldap
     • /etc/ldap.conf (base must match what is defined in server: /etc/openldap/slapd.conf)
     • • host 127.0.0.1
base dc=example,dc=com
     • /etc/ldap.secret
     • • ...
     • comprovació que la migració s'ha fet bé: la resposta a aquesta ordre hauria de donar dues línies idèntiques:
     • • # getent passwd | grep nom_usuari
  6. comproveu l'accés des del client / check access from clients
• ...

• ldapadd
• • -x: simple authentication
  • -W: prompt for password
  • -D: bind dn
• general:
• • edit general.ldif:
  • • dn: dc=example,dc=com
dc: example
objectClass: top
objectClass: domain
dn: ou=usuaris,dc=example,dc=com
ou: usuaris
objectClass: top
objectClass: organizationalUnit
dn: ou=grups,dc=example,dc=com
ou: grups
objectClass: top
objectClass: organizationalUnit
  • ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f general.ldif
• grups / groups:
• • grups.ldif (or generated by a script)
  • • dn: cn=example,ou=grups,dc=example,dc=com
objectClass: posixGroup
cn: grup1
gidNumber: 10000
  • ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f grups.ldif
• persones / people:
• • usuaris.ldif (or generated by a script)
  • • ...
objectClass: posixAccount
...
  • ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f usuaris.ldif

• urpmi openldap-clients
• usage:
• • ldapsearch -x -b 'dc=example,dc=com' '(objectclass=*)'
  • ldapsearch [-h ldap_server] -xLLL -b 'dc=example,dc=com' '(objectclass=posixGroup)' cn gidNumber

• urpmi shelldap

• urpmi smbldap-tools
• /etc/smbldap-tools/smbldap.conf
• • ...
• usage:
• • smbldap-...
  • smbldap-passwd
  • ...

• cn=Manager,dc=example,dc=com

• PAMAuthenticationViaKbdInt yes

• drakauth (urpmi drakxtools-curses) (MCC: Sistema -> Autenticació)
• [urpmi nss_ldap pam_ldap autofs nss_updatedb pam_ccreds]

• /etc/apt/sources.list
• • deb http://pulse2.mandriva.org/pub/pulse2/server/debian squeeze 1.3.1.1
  • [deb http://mds.mandriva.org/pub/mds/debian squeeze main]
• sudo apt-get update
• dpkg-reconfigure debconf
• • medium
• sudo apt-get install slapd mysql-server
• sudo apt-get install mmc-agent python-mmc-dyngroup python-mmc-imaging python-mmc-inventory python-mmc-msc python-mmc-pkgs python-mmc-pulse2 mmc-web-base mmc-web-dyngroup mmc-web-imaging mmc-web-inventory mmc-web-msc mmc-web-pkgs mmc-web-pulse2

• urpmi php-xmlrpc php-gd python-sqlalchemy python-mysql python-OpenSSL python-ldap

• dpkg-reconfigure slapd
• • DN: example.com (must match baseDN in /etc/mmc/plugins/base.ini)
• [slappasswd -s secret]
• [sudo debconf-show slapd]
• sudo apt-get install ldap-utils
• mmc-add-schema /usr/share/doc/python-mmc-base/contrib/ldap/ /etc/ldap/schema/
• sudo /etc/init.d/slapd restart

• mmc-add-schema /usr/share/doc/python-mmc-base/contrib/ldap/ /usr/share/openldap/schema/
• service slapd restart

• baseDN = dc=example, dc=com
• password = secret
• [computers]
  method = inventory

• ENABLE=yes

• mmc-agent -d

• ln -s /etc/mmc/apache/mmc.conf /etc/apache2/conf.d/
• sudo /etc/init.d/apache2 restart

• ln -s /etc/mmc/apache/mmc.conf /etc/httpd/conf.d/
• service httpd restart

• Fusion Inventory agent for Android
• • "FusionInventory agent for other platforms (Linux, Windows, ...) can also be used as a drop-in in replacement of OCSInventory agent for inventory part."

• Pulse2-Install-Debian-Lenny.pdf

• setup
• • mysql -u root -p
  • create database pulse2;
  • create database msc;
  • create database imaging;
  • create database inventory;
  • create database dyngroup;
  • create user 'mmc'@'localhost' identified by 'mmc';
  • grant all on pulse2.* to 'mmc'@'localhost';
  • grant all on msc.* to 'mmc'@'localhost';
  • grant all on imaging.* to 'mmc'@'localhost';
  • grant all on inventory.* to 'mmc'@'localhost';
  • grant all on dyngroup.* to 'mmc'@'localhost';
  • flush privileges;
• installation
• • cd /usr/share/doc/pulse2-common/contrib/
  • ./pulse2/sql/install.sh
  • ./msc/sql/install.sh
  • ./imaging/sql/install.sh
  • ./inventory/sql/install.sh
  • ./dyngroup/sql/install.sh

• /usr/local/include -> /usr/include

• urpmi zlib1-devel
• get it (one of the following):
• • svn checkout https://redbutton.svn.sourceforge.net/svnroot/redbutton/redbutton-download/trunk/ redbutton-download
  • wget http://sourceforge.net/projects/redbutton/files/current/redbutton-download-20090727.tar.gz
• make
• usage:
• • you need a channels.conf file correctly generated. The last field in each line corresponds to the service_id
  • dvbtune -f 658000 -qam 64 -gi 4 -cr AUTO -bw 8 -tm 8 && rb-download -vv
  • dvbtune -f 818000 -qam 64 -gi 4 -cr AUTO -bw 8 -tm 8 && rb-download -vv -c 35490 (TVE La1)
  • dvbtune -f 650000 -qam 64 -gi 32 -cr AUTO -bw 8 -tm 8 && rb-download -vv [-c carousel_id] service_id
  • ...

• urpmi libexpat1-devel libfreetype6-devel libffmpeg-devel libxrender1-devel libxft-devel libpng-devel
• get it:
• • svn checkout https://redbutton.svn.sourceforge.net/svnroot/redbutton/redbutton-browser/trunk/ redbutton-browser
• make

• 2401/tcp

• Local directory: BackOfficeCVS (o un altre qualsevol)
• CVS directory: BackOfficeRepository

• server_args = -i -r /var/lib/svn/repositories (-i: inetd; -r: repositories as root dir)

• chgrp -R REPO1_USERS_GROUP_NAME repo1
• add users to REPO1_USERS_GROUP_NAME:

• /var/lib/svn/repositories/repo1/conf/svnserve.conf
• • password-db = passwd_file
  • realm = etiqueta_reialme
• /var/lib/svn/repositories/repo1/conf/passwd_file
• • usuari1 = contrasenya_usuari1
  • usuari2 = ...
• to deny anonymous read access:
• • svnserve.conf
  • • anon-access = none

• LDAP
• • Subversion LDAP integration
  • SVN+LDAP+APache Access issue

• Tunneling over SSH
• client:
• • svn info svn+ssh://maquina/absolute_path/to/repo1
• NOTE: if you want to avoid the absolute path, setup client for ssh with modified ~/.ssh/authorized_keys (Step 7):
• /etc/subversion/config
• • ...

• Moving files from one SVN repository to another keeping the history
• Mirror a Subversion repository (svnsync)

• cat toto.dump | svndumpfilter3 modul_1 > modul_1.dump
• svnadmin load repo3 < modul_1.dump

• File not found: transaction '...' ...
• Solutions:
• • Subversion / Dump and loading
  • Subversion svnadmin load error "File not found transaction 0-1 path..."
  • Migrating an SVN project to different repository
  • svndumpfilter3 (python)
  • Svnadmin load from dumpfile causes “file not found error”. Help? (--relocate)

• svn add --depth=empty name_dir

• directament / directly:
• • svn propset svn:ignore dirname .
• editant-les / editing:
• • svn propedit svn:ignore . --editor-cmd emacs
• des de fitxer / from file:
• • svn propset svn:ignore -F file.txt .
  • on / where file.txt
  • • dir1
dir2

• svn pdel svn:ignore .

• svn proplist
• svn propget svn:ignore

• svn:ignore
• svn:external

• Subversive

• urpmi subversion-tools

• svnrdump dump http://server_name/repository_name/ > repository_name.dump

• svnrdump load http://new_server_name/new_repository_name/ < repository_name.dump
• Problemes / Problems:
• • svnrdump: E165006: Repository has not been enabled to accept revision propchanges;
  • Solució / Solution (*):
  • • al servidor / on server (new_server_name):
    • • cd /var/lib/svn/repositories
      • echo '#!/bin/sh' > new_repository_name/hooks/pre-revprop-change
      • chmod 755 new_repository_name/hooks/pre-revprop-change

• Host hostname
    HostName hostname
    User username
    IdentityFile ~/.ssh/id_rsa_remoteserver

• ssh-copy-id -i .ssh/id_rsa_remoteserver.pub username@remoteserver

• ~username/.ssh/authorized_keys
• • command="/path/to/svnserve -t -r /virtual/root" ssh-rsa KEY COMMENT (where /virtual/root could be, e.g. /var/lib/svn/repositories/)
• then you can access the repository with:
• • svn list svn+ssh://username@hostname/repo1

• (cd /home/cvs)
• wget http://cvs2svn.tigris.org/source/browse/*checkout*/cvs2svn/tags/2.3.0/cvs2svn-example.options
• cp cvs2svn-example.options your_file.options

• ctx.cvs_author_decoder = CVSTextDecoder(['latin1',],)
  ctx.cvs_log_decoder = CVSTextDecoder(['latin1',],)
  ctx.cvs_filename_decoder = CVSTextDecoder(['latin1',],)
• ctx.output_option = DumpfileOutputOption(
    dumpfile_path=r'toto.dump', # Name of dumpfile to create
    )

• run_options.add_project(
      'my/cvsrepo/project_a',
      trunk_path='project_a/trunk',
      branches_path='project_a/branches',
      tags_path='project_a/tags',
      symbol_transforms=[
          #...whatever...
          ],
      symbol_strategy_rules=[
          #...whatever...
          ] + global_symbol_strategy_rules,
      )

• run_options.add_project(
      'my/cvsrepo/project_b',
      trunk_path='project_a/trunk/dir_b',
      branches_path='project_a/branches/dir_b',
      tags_path='project_a/tags/dir_b',
      symbol_transforms=[
          #...whatever...
          ],
      symbol_strategy_rules=[
          #...whatever...
          ] + global_symbol_strategy_rules,
      )

• sudo yum install -y http://mirror.ghettoforge.org/distributions/gf/gf-release-latest.gf.el7.noarch.rpm
• sudo yum install -y --enablerepo=gf-plus git

• Detached HEAD

• bad response:
• • $ curl -v -I -X GET https://github.com/meetecho/janus-gateway/
* About to connect() to github.com port 443 (#0)
*   Trying 192.30.253.112...
* Connected to github.com (192.30.253.112) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -12190 (SSL_ERROR_PROTOCOL_VERSION_ALERT)
* Peer reports incompatible or unsupported protocol version.
* Closing connection 0
curl: (35) Peer reports incompatible or unsupported protocol version.
• good response:
• • $ curl -v -I -X GET https://github.com/meetecho/janus-gateway/
* About to connect() to github.com port 443 (#0)
*   Trying 192.30.253.112...
* Connected to github.com (192.30.253.112) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*       subject: CN=github.com,O="GitHub, Inc.",L=San Francisco,ST=California,C=US,postalCode=94107,STREET="88 Colin P Kelly, Jr Street",serialNumber=5157550,incorporationState=Delaware,incorporationCountry=US,businessCategory=Private Organization
*       start date: Mar 10 00:00:00 2016 GMT
*       expire date: May 17 12:00:00 2018 GMT
*       common name: github.com
*       issuer: CN=DigiCert SHA2 Extended Validation Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US
> GET /meetecho/janus-gateway/ HTTP/1.1
> User-Agent: curl/7.29.0
> Host: github.com
> Accept: */*
>
< HTTP/1.1 200 OK
...

• update nss (3.19 -> 3.28):
• • CentOS
  • • sudo yum install nss

• git config core.sharedRepository true
• chgrp unix_project_group -R /opt/git/project.git/
• find /opt/git/project.git/ -type d -exec chmod 2770 {} +
• find /opt/git/project.git/ -type f -exec chmod660 {} +

• git bundle create reponame.bundle --all

• (see: man git bundle)

• git bundle list-heads reponame.bundle

• git clone [-b master] reponame.bundle reponame_from_bundle
• git clone --bare reponame.bundle reponame_from_bundle

• first time: create a mirror and a bundle file from it
  • git clone --mirror git@some.origin/reponame.git /path/to/reponame.git
  • cd /path/to/reponame.git
  • git bundle create /path/to/backups/reponame.bundle --all
• next times (periodically): update the mirror and create a bundle file from it
  • git --git-dir /path/to/reponame.git remote update
  • cd /path/to/reponame.git
  • git bundle create /path/to/backups/reponame.bundle --all

• gitk

• gitk --all

• gitk [--all] <filename>