create SSH key using puttygen and connect to linux server

here will show you how to create public key and connect to Linux server.

First of all, you need to install puttygen, you can get it from http://winscp.net/download/puttygen.exe

1. Click Generate 

2. Just move around your mouse cursor inside the box until it done process

3. Copy the key and paste to your server at ./ssh/authorized_keys and save down the private key

If you want to enable password when connect using this private key, just enter password here before you click save private key. everytime you use this private key to connect to your server, it will ask for password

Now you can try connect using Putty

remember to select your private key at Connection > SSH > Auth

Troubleshoot

1. If it show error message " server refused our key"

please make sure the file at ./ssh/authorized_keys is using 700 permission

2. For other error, you can enable LogLevel DEBUG3 at /etc/ssh/sshd_config. Then monitor the log at /var/log/secure

AWS mount S3 bucket to amazon linux

Before start, please create S3 bucket first as this will be needed to mount to your EC2 instance.
There is 2 way to connect and mount S3 into your EC2. One is using user secret key and access and another is using the IAM role.


Here is the step by step to create IAM user access

1. Login to your AWS console and go to IAM section.
2. Click create a new group of users

3. create a project name

4. select Amazon S3 Full Access

5. Click Continue

6. Create a users for this if you do not have a user or add existing users. this is if you have another users to manage your AWS and limited access. If you are admin itself, just go to account and use the security key and secret key

7. confirm the details and click Continue

8. drop down and save your access key ID and secret access key

Here is the step by step for creating IAM roles

1. Click on Roles and create new role

2. Create a role name

3. Select Amazon EC2

4.  Select Amazon S3 Full Access

5. Click Continue

6. Confirm everything and create role

Now you need to create an EC2 instance, but do take note, during creating, you should be stop at this pages, and you need to select the IAM role to the one you created just now

After done create an instance, ssh into it and we start to install package needed

this is package needed for later use
# yum install kernel-devel libxml2-devel curl-devel gcc gcc-c++ pkgconfig openssl-devel subversion git -y

this is the package we will be using to install and mount
# yum install automake fuse fuse-devel -y

download down the latest s3fs-fuse package
# git clone https://github.com/s3fs-fuse/s3fs-fuse.git

configure, make, and make install
# cd s3fs-fuse
#  ./configure --prefix=/usr
# make
# make install

Now we create a folder for mounting
#  mkdir /data

If you are using IAM role, mount it using this command
# /usr/bin/s3fs <bucket name> /data -o rw,allow_other,uid=0,gid=0,default_acl=public-read,iam_role=<IAM role name>

If you are using user secretkey and access

# echo "<Access Key ID>:<Secret Access Key>" | tee -a /etc/passwd-s3fs
# chmod 640 /etc/passwd-s3fs

then mount it using this command

# /usr/bin/s3fs <Bucket Name> /data -o rw,allow_other,uid=<UID>,gid=<GID>,default_acl=public-read

After success, you can use df to show out the partition to confirm it

FTP access locked at web directory

This post will teach you how to install FTP service to your server and create users which is locked to web directories.

Install FTP services
     # yum install vsftpd

now we create user which is without home directory and remove users mailbox. Then we will update its password.
     # useradd -M ftpuser
     # rm -rf /var/spool/mail/ftpuser
     # passwd ftpuser

this will make parent directory and update it to user login directory
     # mkdir -p /var/www/html/ftpfiles
     # usermod -d /var/www/html/ftpfiles

Open and edit ftp config to lock the user at their home directory
     # vim /etc/vsftpd/vsftpd.conf

and enable " chroot_local_user=YES "

Now this ftpuser will be lock at its home directory once login and unable to access other folder

we need to enable ftpuser to upload file into it
since i locking it to web directory, i set the owner to apache

     # chown apache:apache ftpuser

now add ftpuser to belong to apache group

     # useradd -G apache ftpuser

DONE
now you can try ftp into it

note 1
add this line to force active mode

pasv_enable=NO

Setting up Postfix to relay through Google Mail

 Install postfix and required packages:

  # yum install postfix cyrus-sasl cyrus-sasl-plain cyrus-sasl-md5
  # chkconfig postfix on
  # chkconfig saslauthd on

Create SSL cert:

  # mkdir /etc/postfix/certs
  # cd /etc/postfix/certs
  # openssl dsaparam 1024 -out dsa1024.pem
  # openssl req -x509 -nodes -days 3650 -newkey dsa:dsa1024.pem -out mycert.pem -

keyout mykey.pem
  # ln -s mycert.pem CAcert.pem
  # openssl req -x509 -new -days 3650 -key mykey.pem -out mycert.pem

Create GMail authentication file:

  # vi /etc/postfix/sasl_passwd

Add the follow content:

  smtp.gmail.com username@googleapp.domain:password

Generate postfix sasl_passwd database:

  # postmap hash:/etc/postfix/sasl_passwd
  # chmod 600 /etc/postfix/sasl_passwd
  # chmod 600 /etc/postfix/sasl_passwd.db

Setting Postfix

  # vi /etc/postfix/main.cf

Edit main.cf

  inet_interfaces = all

  mydestination = localhost, $myhostname, localhost.$mydomain

  mynetworks = 172.30.10.0/24

Write the following contents to main.cf

  # SMTP relayhost
  relayhost = [smtp.gmail.com]:587
  
  ## TLS Settings
  smtp_tls_loglevel = 1
  smtp_tls_CAfile = /etc/postfix/certs/CAcert.pem
  smtp_tls_cert_file = /etc/postfix/certs/mycert.pem
  smtp_tls_key_file = /etc/postfix/certs/mykey.pem
  smtp_use_tls = yes
  smtpd_tls_CAfile = /etc/postfix/certs/CAcert.pem
  smtpd_tls_cert_file = /etc/postfix/certs/mycert.pem
  smtpd_tls_key_file = /etc/postfix/certs/mykey.pem
  smtpd_tls_received_header = yes
  smtpd_use_tls = yes
  
  # configuracion tls
  smtp_use_tls = yes
  smtp_sasl_auth_enable = yes
  smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
  smtp_sasl_security_options = noanonymous
  smtp_sasl_tls_security_options = noanonymous
  
  # alias de mapeo interno a externo
  smtp_generic_maps = hash:/etc/postfix/generic

Finally, restart postfix

  # postmap hash:/etc/postfix/generic
  # /etc/init.d/postfix restart

Credit to my senior Voo

owncloud on Centos 6

Installation

go to https://fedoraproject.org/wiki/EPEL
and install the latest epel into your centos

#  wget http://ftp.riken.jp/Linux/fedora/epel/6/i386/epel-release-6-8.noarch.rpm
#  rpm -i epel-release-6-8.noarch.rpm

Then now go to http://owncloud.org/install/
to get the latest owncloud version

# wget http://download.opensuse.org/repositories/isv:ownCloud:community/CentOS_CentOS-6/isv:ownCloud:community.repo

then now install owncloud

# yum install owncloud

-----------------------------------------------------------------------------------------------
Tweak

max upload size
edit max upload size can be done at
/var/www/html/owncloud/.htaccess
you will notice got this value inside it and you can change according to your prefrence



php_value upload_max_filesize 513M
php_value post_max_size 513M
php_value memory_limit 512M

phpmyadmin at EC2

At amazon server, after you done setup Mysql or RDS, proceed to install phpmyadmin

First you need to enable the epel repo
# vim /etc/yum.repo.d/epel.repo

enable [epel] and [epel-source]
change enabled=0
to enabled=1

save and exit

Then now install phpmyadmin and configure

# yum install phpmyadmin
# vim /etc/httpd/conf.d/phpMyAdmin.conf

change and highlight all the following

#Order Deny,Allow

#Deny from All

Edit the phpmyadmin
# vim /etc/phpMyAdmin/config.inc.php

then edit the host to where your mysql located at either at local or RDS

$cfg['Servers'][$i]['host'] = 'localhost';

Restart httpd
# /etc/init.d/httpd restart

then try to access it at
http://<your-server-IP>/phpmyadmin
the login is your database root login and password

EC2 rotate snapshot

Here is the script to auto delete those snapshot that is older than n days

Requirements

- Python

- Boto >=2.4.0

option list

-k = access key ID

-s = secret access key

-a = how many days

-d = description contain

-r = region

example

ec2-rotate-snapshot.py -k AKIAert5EYQKJBN6TASQ -s 8ka5hp9lDOPjDNOJsdfnmaHcMWAsdamoWbH4HhBj -a 5 -d "backup" -r eu-west-1

this will check snapshot that is more than 5 day and contain word "backup" in region eu-west-1 and proceed to delete

reference/source

I get this from https://bitbucket.org/romabysen/ec2-rotate-snapshots/overview

owner is Lars Hansson

so please feel free to thanks him for this wonderful script

Script start here

--------------------------------------------------------------------------------

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# :copyright: (c) 2013 by Lars Hansson.
# :license: ISC, see LICENSE for more details.
#
"""Utility for rotating EC2 snaphots"""

import os
import sys
import time
import logging
from optparse import OptionParser
import datetime
import re
import boto.ec2

DEFAULT_REGION = boto.ec2.EC2Connection.DefaultRegionName


def setup_logging(level):
    logger = logging.getLogger('ec2-rotate-snapshot')
    ch = logging.StreamHandler()
    logger.setLevel(level)
    logger.addHandler(ch)


def log_err(msg):
    logger = logging.getLogger('ec2-rotate-snapshot')
    logger.error(msg)


def log_info(msg):
    logger = logging.getLogger('ec2-rotate-snapshot')
    logger.info(msg)


def match_tags(tags, m_tags):
    if not m_tags:
        return True
    for item in m_tags:
        if item.find('=') != -1:
            (tag, value) = item.split('=')
            for k, v in tags.items():
                if k == tag and v == value:
                    return True
        else:
            if item in tags.keys():
                return True
    return False


def match_timeframe(start_time, timeframe):
    if not timeframe:
        return True
    dt_start_time = datetime.datetime.strptime(start_time, '%Y-%m-%dT%H:%M:%S.%fZ')
    (start, end) = timeframe.split('-')
    frame_start = dt_start_time.replace(hour=int(start.split(':')[0]),
                                        minute=int(start.split(':')[1]),
                                        second=0)
    frame_end = dt_start_time.replace(hour=int(end.split(':')[0]),
                                      minute=int(end.split(':')[1]),
                                      second=0)
    if frame_end < frame_start:
        frame_end = frame_end + datetime.timedelta(days=+1)
    return frame_start <= dt_start_time <= frame_end


def match_age(start_time, age):
    if not age:
        return True
    st = time.strptime(start_time, '%Y-%m-%dT%H:%M:%S.%fZ')
    at = time.gmtime(time.time() - (86400 * age))
    return st < at


def match_string(mstring, pattern):
    if not pattern:
        return True
    if not mstring:
        return False
    if re.search(pattern, mstring) is not None:
        return True
    return False


def cleanup_snapshots(pattern, opts):
    conn = boto.ec2.connect_to_region(opts.region)
    for snap in conn.get_all_snapshots(owner='self'):
        if (match_string(snap.description, pattern) and match_tags(snap.tags, opts.tag) and
            match_timeframe(snap.start_time, opts.timeframe) and
                match_age(snap.start_time, opts.age)):
            if opts.delete:
                try:
                    conn.delete_snapshot(snap.id)
                except boto.exception.EC2ResponseError:
                    # Retry deleting since sometimes random errors happen
                    try:
                        time.sleep(2)
                        conn.delete_snapshot(snap.id)
                    except boto.exception.EC2ResponseError:
                        log_err('Error! Snapshot %s not deleted' % (snap.id))
                        continue
                log_info('Snapshot deleted: %s' % (snap.id))
                time.sleep(0.5)
            else:
                log_info('Snapshot: %s, start time: %s, description: %s, tags: %s' %
                        (snap.id, snap.start_time, snap.description, snap.tags.keys()))


def handle_options():
    """Parse commandline options"""
    usage = 'Usage: %prog [options] <regular expression>'
    version = '%prog 0.1.0'
    parser = OptionParser(usage=usage, version=version)
    parser.add_option('-k', dest='key', help='AWS access key id')
    parser.add_option('-s', dest='secret', help='AWS secret access key')
    parser.add_option('-r', dest='region', help='Region. Default: %s' % (DEFAULT_REGION))
    parser.add_option('-a', dest='age', type='int', default=None,
                      help='Older than these many days')
    parser.add_option('-t', action='append', dest='tag', default=None,
                      help='Match this tag and, optionally, content')
    parser.add_option('-T', dest='timeframe', default=None,
                      help='Timeframe selector. Example: 15:30-15:45')
    parser.add_option('-d', dest='delete', action='store_true', default=False,
                      help='Actually delete instead of printing the matches')
    parser.add_option('-q', action='store_true', default=False, dest='quiet', help='Only print errors')
    (opts, args) = parser.parse_args()
    if opts.quiet:
        setup_logging(logging.ERROR)
    else:
        setup_logging(logging.INFO)
    if opts.key is not None:
        os.environ["AWS_ACCESS_KEY_ID"] = opts.key
    if opts.secret is not None:
        os.environ["AWS_SECRET_ACCESS_KEY"] = opts.secret
    if len(args) == 0:
        log_err('A regular expression is required.')
        parser.print_usage()
        sys.exit(1)
    if len(args) > 1:
        log_err('Too many regular expressions.')
        parser.print_usage()
        sys.exit(1)
    return (opts, args)


def main():
    """The main loop"""
    (opts, args) = handle_options()
    pattern = args[0]
    cleanup_snapshots(pattern, opts)

if __name__ == '__main__':
    main()