title: “jsGrid”
date: 2021-06-06T16:25:06
slug: jsgrid
Onclick event, show id from clicked column
container.jsGrid({
inserting: false,
editing: false,
sorting: false,
paging: false,
data: data,
fields: [
{name: "instrumentID", itemTemplate: function (value, item) {
return value;
}
},
],
rowClick: function (args) {
selectShare(args.item.instrumentID);
}
});
Data load:
title: “Copy a Postgres Table from one DB to another”
date: 2021-05-05T08:01:15
slug: 1669-2
Export and base64 Encode Table “replication_policy” from Database “regstry”
pg\_dump -C -a -t replication\_policy -d registry | base64 -w 0 >/tmp/table\_dump
Copy thae base64 File to the other DB and import it:
cat /tmp/table\_dump | base64 -d | psql registry
title: “AES Decode Secret with Key”
date: 2021-05-04T17:22:51
slug: aes-decode-secret-with-key
package main
import (
"crypto/aes"
"crypto/cipher"
"encoding/base64"
"errors"
"fmt"
"strings"
)
const (
// EncryptHeaderV1 ...
EncryptHeaderV1 = ""
)
func main() {
fmt.Println(decrypt("K+aZKT/MGhPdy37RIMANJU3hGd1ypZiTyUxbxdC6x3MzSN2j1d9o5QD8OxPaO/rk+VQtmkh+yFR0gQNXo1SbpaweKlwcn82N/F6bjSa0Zcs="))
}
func decrypt(secret string) (string, error) {
if len(secret) == 0 {
return "", nil
}
decrypted, err := ReversibleDecrypt(secret, "JpF2PeV2TQvPcjIi")
if err != nil {
return "", err
}
return decrypted, nil
}
func ReversibleDecrypt(str, key string) (string, error) {
if strings.HasPrefix(str, EncryptHeaderV1) {
str = str[len(EncryptHeaderV1):]
return decryptAES(str, key)
}
// fallback to base64
return decodeB64(str)
}
func decodeB64(str string) (string, error) {
cipherText, err := base64.StdEncoding.DecodeString(str)
return string(cipherText), err
}
func decryptAES(str, key string) (string, error) {
keyBytes := []byte(key)
var block cipher.Block
var cipherText []byte
var err error
if block, err = aes.NewCipher(keyBytes); err != nil {
return "", err
}
if cipherText, err = base64.StdEncoding.DecodeString(str); err != nil {
return "", err
}
if len(cipherText) < aes.BlockSize {
err = errors.New("cipherText too short")
return "", err
}
iv := cipherText[:aes.BlockSize]
cipherText = cipherText[aes.BlockSize:]
cfb := cipher.NewCFBDecrypter(block, iv)
cfb.XORKeyStream(cipherText, cipherText)
return string(cipherText), nil
}
title: “Update Harbor User to Admin”
date: 2021-05-04T09:18:52
slug: update-harbor-user-to-admin
\l
\c registry
\dt (List all Tables)
select \* from harbor\_user;
update harbor\_user set sysadmin\_flag = 't' where user\_id=4;
\q
title: “es_util”
date: 2021-04-30T13:21:53
slug: es_util
es_util –query=_cat/indices
title: “Elastic Opendistro Certs”
date: 2021-04-26T20:27:35
slug: elastic-opendistro-certs
/usr/share/elasticsearch/config
root-ca.pem
Common Name: Example Com Inc. Root CA
Organization: Example Com Inc.
Organization Unit: Example Com Inc. Root CA
Valid From: April 21, 2018
Valid To: April 18, 2028
Issuer: Example Com Inc. Root CA, Example Com Inc.
Serial Number: 1 (0x1)
esnode.pem
Common Name: node-0.example.com
Subject Alternative Names: Registered ID:1.2.3.4.5.5, node-0.example.com, localhost, IP Address:127.0.0.1
Organization: node
Organization Unit: node
Locality: test
Valid From: April 21, 2018
Valid To: April 18, 2028
Issuer: Example Com Inc. Root CA, Example Com Inc.
Serial Number: 1524368626614 (0x162eb7353b6)
kirk.pem (Client)
Common Name: kirk
Organization: client
Organization Unit: client
Locality: test
Country: de
Valid From: April 21, 2018
Valid To: April 18, 2028
Issuer: Example Com Inc. Root CA, Example Com Inc.
Serial Number: 1524368626616 (0x162eb7353b8)
Create Client Cert
openssl req -nodes -new -newkey rsa:2048 -sha256 -keyout client.key -out client.csr
openssl x509 -req -in client.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -out client.crt -days 3650 -sha256
curl -vvvk --cert client.crt --key client.key --cacert root-ca.pem https://elastic.apps.thasanger-dev-pop.noris.de/
oc create configmap elasticsearch-tls --from-file=root-ca.pem=root-ca.pem --from-file=root-ca-key.pem=root-ca-key.pem --from-file=elastic.crt=elastic.crt --from-file=elastic.key=elastic.key --from-file=client.crt=client.crt --from-file=client.key=client.key -oyaml --dry-run
title: “Secure Forward”
date: 2021-04-23T09:26:26
slug: secure-forward
Fluentd input/output plugin to forward fluentd messages over SSL with authentication.
NOTE: This plugin will not be updated anymore.
Fluentd v0.14.12 supports event forwarding via encrypted network communication. Use that feature instead of using this plugin.
This plugin makes you to be able to:
protect your data from others in transferring with SSL
with certificate signed and registered correctly/publicly
with private CA certificates generated by users
with automatically generated and self-signed certificates in vulnerable way
authenticate by shared_key check from both of client(out_secure_forward) and server(in_secure_forward)
authenticate with username / password pairs
install with gem or fluent-gem command as:
### native gem
$ gem install fluent-plugin-secure-forward
### fluentd gem
$ fluent-gem install fluent-plugin-secure-forward
To communicate over SSL with valid certificate issued from public CA, configure params below for input plugin:
secure: set yes or true
cert_path: set path of certificate file issued from CA
private_key_path: set path of private key file
private_key_passphrase: set passphrase of private key
<source>
@type secure\_forward
# bind 0.0.0.0 # default
# port 24284 # default
self\_hostname server.fqdn.example.com
shared\_key secret\_string
secure yes
cert\_path /path/for/certificate/cert.pem
private\_key\_path /path/for/certificate/key.pem
private\_key\_passphrase secret\_foo\_bar\_baz
</source>
For output plugin, specify just 2 options below:
secure: set yes or true
enable_strict_verification: specify yes or true to verify FQDN of servers (input plugin)
<match secret.data.\*\*>
@type secure\_forward
self\_hostname client.fqdn.local
shared\_key secret\_string
secure yes
enable\_strict\_verification yes
<server>
host server.fqdn.example.com # or IP
# port 24284
</server>
<server>
host 203.0.113.8 # ip address to connect
hostlabel server.fqdn.example.com # specify hostlabel for FQDN verification if ipaddress is used for host
</server>
</match>
This plugin has a simple utility command to generate private CA cert/key files just for secure-forward.
$ secure-forward-ca-generate /path/for/dir/of/certs "passphrase for private CA secret key"
This command generates ca_cert.pem and ca_key.pem on /path/for/dir/of/certs. For SSL communication with private CA, users must deploy both files for input plugins, and also must deploy ca_cert.pem for output plugins. And then, configure Fluentd with these files and the passphrase. With this configuration, server certificates are automatically generated and issued by private CA.
<source>
@type secure\_forward
# bind 0.0.0.0 # default
# port 24284 # default
self\_hostname myserver.local
shared\_key secret\_string
secure yes
ca\_cert\_path /path/for/certificate/ca\_cert.pem
ca\_private\_key\_path /path/for/certificate/ca\_key.pem
ca\_private\_key\_passphrase passphrase for private CA secret key
</source>
For output plugin, specify just 2 options below:
secure: set yes or true
enable_strict_verification: specify yes or true
<match secret.data.\*\*>
@type secure\_forward
self\_hostname myclient.local
shared\_key secret\_string
secure yes
ca\_cert\_path /path/for/certificate/ca\_cert.pem
# enable\_strict\_verification yes
<server>
host server.fqdn.example.com # or IP
# port 24284
</server>
<server>
host 203.0.113.8 # ip address to connect
hostlabel server.fqdn.example.com # specify hostlabel for FQDN verification if ipaddress is used for host
</server>
</match>
This is very dangerous and vulnerable to man-in-the-middle attacks
For just testing or data center internal communications, this plugin has a feature to communicate without any verification of certificates. Turn secure option to false to use this feature.
<source>
@type secure\_forward
self\_hostname myserver.local
shared\_key secret\_string
secure no
</source>
Configure output plugin just same way:
<match data.\*\*>
@type secure\_forward
self\_hostname myclient.local
shared\_key secret\_string
secure no
<server>
host server.fqdn.example.com # or IP
</server>
</match>
In this mode, output plugin cannot verify peer node of connections. Man-in-the-middle attackers can spoof messages from output plugins under many various situations.
Default settings:
listen 0.0.0.0:24284
bind 192.168.0.101
port 24284
allow to accept from any sources
allow to connect without authentications
use certificate automatically generated
generate_private_key_length 2048
generate_cert_country US
generate_cert_state CA
generate_cert_locality Mountain View
generate_cert_common_name SAME_WITH_SELF_HOSTNAME_PARAMETER
use TLSv1.2
Minimal configurations like below:
<source>
@type secure\_forward
shared\_key secret\_string
self\_hostname server.fqdn.local # This fqdn is used as CN (Common Name) of certificates
secure yes
# and configurations for certs
</source>
To check username/password from clients, like this:
<source>
@type secure\_forward
shared\_key secret\_string
self\_hostname server.fqdn.local
secure yes
# and configurations for certs
authentication yes # Deny clients without valid username/password
<user>
username tagomoris
password foobar012
</user>
<user>
username frsyuki
password yakiniku
</user>
</source>
To deny unknown source IP/hosts:
<source>
@type secure\_forward
shared\_key secret\_string
self\_hostname server.fqdn.local
secure yes
# and configurations for certs
allow\_anonymous\_source no # Allow to accept from nodes of <client>
<client>
host 192.168.10.30
</client>
<client>
host your.host.fqdn.local
# wildcard (ex: \*.host.fqdn.local) NOT Supported now
</client>
<client>
network 192.168.16.0/24 # network address specification
</client>
</source>
You can use both of username/password check and client check:
<source>
@type secure\_forward
shared\_key secret\_string
self\_hostname server.fqdn.local
secure yes
# and configurations for certs
allow\_anonymous\_source no # Allow to accept from nodes of <client>
authentication yes # Deny clients without valid username/password
<user>
username tagomoris
password foobar012
</user>
<user>
username frsyuki
password sukiyaki
</user>
<user>
username repeatedly
password sushi
</user>
<client>
host 192.168.10.30 # allow all users to connect from 192.168.10.30
</client>
<client>
host 192.168.10.31
users tagomoris,frsyuki # deny repeatedly from 192.168.10.31
</client>
<client>
host 192.168.10.32
shared\_key less\_secret\_string # limited shared\_key for 192.168.10.32
users repeatedly # and repatedly only
</client>
</source>
Minimal configurations like this:
<match secret.data.\*\*>
@type secure\_forward
shared\_key secret\_string
self\_hostname client.fqdn.local
secure yes
# and configurations for certs/verification
<server>
host server.fqdn.local # or IP
# port 24284
</server>
</match>
Without hostname ACL (and it’s not implemented yet), self_hostname is not checked in any state. ${hostname} placeholder is available for such cases.
<match secret.data.\*\*>
@type secure\_forward
shared\_key secret\_string
self\_hostname ${hostname}
secure yes
# and configurations for certs/verification
<server>
host server.fqdn.local # or IP
# port 24284
</server>
</match>
When specified 2 or more <server>, this plugin uses these nodes in simple round-robin order. And servers with standby yes will be selected until all of non-standby servers goes down.
If server requires username/password, set username and password in <server> section:
<match secret.data.\*\*>
@type secure\_forward
shared\_key secret\_string
self\_hostname client.fqdn.local
secure yes
# and configurations for certs/verification
<server>
host first.fqdn.local
hostlabel server.fqdn.local
username repeatedly
password sushi
</server>
<server>
host second.fqdn.local
hostlabel server.fqdn.local
username sasatatsu
password karaage
</server>
<server>
host standby.fqdn.local
hostlabel server.fqdn.local
username kzk
password hawaii
standby yes
</server>
</match>
Specify hostlabel if server (in_forward) have different hostname (self_host configuration of in_forward) from DNS name (first.fqdn.local, second.fqdn.local or standby.fqdn.local). This configuration variable will be used to check common name (CN) of certifications.
To specify keepalive timeouts, use keepalive configuration with seconds. SSL connection will be disconnected and re-connected for each 1 hour with configuration below. In Default (and with keepalive 0), connections will not be disconnected without any communication troubles. (This feature is for dns name updates, and SSL common key refreshing.)
<match secret.data.\*\*>
@type secure\_forward
shared\_key secret\_string
self\_hostname client.fqdn.local
secure yes
# and configurations for certs/verification
keepalive 3600
<server>
host server.fqdn.local # or IP
# port 24284
</server>
</match>
If you connect via Proxy, set for proxy_uri in <server> section:
<match secret.data.\*\*>
@type secure\_forward
shared\_key secret\_string
self\_hostname client.fqdn.local
secure yes
# and configurations for certs/verification
<server>
host server.fqdn.local # or IP
# port 24284
proxy\_uri http://foo.bar.local:3128
</server>
</match>
server
in_secure_forward
client
out_secure_forward
(client) connect to server
on SSL socket handshake, checks certificate and its significate (in client)
(server)
check network/domain acl (if enabled)
check client dns reverse lookup result (if enabled)
disconnect when failed
(server) send HELO
[‘HELO’, options(hash)]
options:
nonce: string as nonce: used for shared key digest (required, v0.3.2 or later)
auth: string or blank_string (string: authentication required, and its salt is this value)
keepalive: bool (allowed or not)
(client) send PING
[‘PING’, selfhostname, sharedkey_salt, sha512_hex(sharedkey_salt + selfhostname + nonce + sharedkey), username || ”, sha512_hex(auth_salt + username + password) || ”]
(server) check PING
check sharedkey
check username / password (if required)
send PONG FAILURE if failed
[‘PONG’, false, ‘reason of authentication failure’, ”, ”]
(server) send PONG
[‘PONG’, bool(authentication result), ‘reason if authentication failed’, selfhostname, sha512_hex(salt + selfhostname + nonce + sharedkey)]
(client) check PONG
check sharedkey
disconnect when failed
connection established
send data from client (until keepalive expiration)
CONSIDER RETURN ACK OR NOT
Current version has no ACKs
only supports burst transferring (same as ForwardInput/Output)
ack for each message ?
pipeline mode and one-by-one mode ?
data sequence number in keepalive session ?
title: “Create fluentd Client TLS Secret”
date: 2021-04-22T21:34:28
slug: create-fluentd-client-tls-secret
oc create secret generic elastic-client --from-file=ca-bundle.crt=root-ca.pem --from-file=tls.crt=kirk.pem --from-file=tls.key=kirk-key.pem -n openshift-logging --dry-run=client -o yaml
title: “Clusteroperator”
date: 2021-04-22T11:20:11
slug: clusteroperator
oc get clusteroperator
title: “oc command under alpine linux”
date: 2021-04-11T20:49:42
slug: oc-command-under-alpine-linux
apk add make libc6-compat