OpenSSL cert generation without password

# openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr
# openssl req -in server.csr -noout -text

BSD pf firewall ipsec

#vim /etc/pf.conf
pass in quick on $outside proto udp from remote-gateway to $external_carp_addr port { 500 4500 }

#
pfctl -f /etc/pf.conf


#vim /etc/ipsec.conf
ike esp from local-network/16 to remote-network/20 \
     peer remote-gateway \
     main auth hmac-sha1 enc aes-256 group modp1536 \
     quick auth hmac-sha1 enc aes-256 group modp1536 \
     srcid local-gateway psk 'secretkey'

#

ipsecctl -f /etc/ipsec.conf

#troubleshooting and monitoring
pfctl -sr
ipsecctl -sall
ipsecctl -m
tail -f /var/log/daemon

tcpdump -n -e -ttt -i pflog0

isakmpd -K


ref:
http://www.richweb.com/ipsec_between_openbsd_cisco_asa
http://littleabroad.wordpress.com/2012/03/28/ipsec-vpn-between-cisco-and-openbsd/
http://www.packetmischief.ca/openbsd-ipsec-tunnel-guide/
http://resin.csoft.net/cgi-bin/man.cgi?section=5&topic=ipsec.conf
http://wiki.mikrotik.com/wiki/Manual:IP/IPsec

Adding Linux/CentOS to Windows domain

wget http://download.beyondtrust.com/PBISO/7.5.3.1536/linux.rpm.x64/pbis-open-7.5.3.1536.linux.x86_64.rpm.sh
sh pbis-open-7.5.3.1536.linux.x86_64.rpm.sh
/opt/likewise/bin/domainjoin-cli join towncar.us mojleski
/opt/pbis/bin/update-dns

/opt/likewise/bin/lwregshell import /opt/pbis/share/config/lsassd.reg
/opt/likewise/bin/lw-ad-cache --delete-all
/opt/likewise/bin/lwconfig LoginShellTemplate /bin/bash


vim /etc/pam.d/sshd

#%PAM-1.0
auth       required     pam_sepermit.so
auth       include      password-auth
account    required     pam_access.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth
session    sufficient      pam_lsass.so



vim /etc/security/access.conf

#
+ : root : ALL
#+ : mojleski1 : ALL
+ : DOMAIN\devs : ALL

# User "john" should get access from ipv6 host address (same as above)
#+ : john : 2001:4ca0:0:101:0:0:0:1
#
# User "john" should get access from ipv6 net/mask
#+ : john : 2001:4ca0:0:101::/64
#
# All other users should be denied to get access from all sources.
- : ALL : ALL





/opt/likewise/bin/lw-ad-cache --enum-users
/opt/likewise/bin/lw-find-user-by-name username --level 2
/opt/likewise/bin/lw-find-group-by-id
id username
getent group | grep somegroup
getent passwd | grep username

CentOS CentALT repo

vim /etc/yum.repos.d/centalt.repo


[CentALT]
name=CentALT Packages for Enterprise Linux 6 - $basearch
baseurl=http://centos.alt.ru/repository/centos/6/$basearch/
enabled=0
gpgcheck=0

Format TCPdump file

tcpick -t -C -yP -r tcp.dump

SSH Socks Proxy

On the remote side, edit sshd_config and allow:
AllowTcpForwarding yes
TCPKeepAlive yes

On client run:

ssh -D 12345 user@remote-server

Now you adjust browser to use localhost socks proxy on port 12345

PostgreSQL 9.2 CentOS 6 Repository

rpm -Uvh http://yum.pgrpms.org/9.2/redhat/rhel-6-x86_64/pgdg-centos92-9.2-6.noarch.rpm

yum search postgres


After installation, include the postgres bin directory in your PATH

vim ~/.bash_profile

(append this do PATH)

:/usr/pgsql-9.2/bin

and source it