首页 » 标签："后端"

CentOS7免费SSL证书及自动展期

2020-06-14 作者： Fisherworks

This post shows you how to obtain a wildcard SSL certificate for free (which values at least $50) from Let’s Encrypt on CentOS 7.x Linux, and get it setup to renew by itself with an automated script.

至于什么是SSL证书，有什么用，这里不赘述了。大致上，一个泛域名（通配符）DV证书，价值怎么也在CNY 2000/年开外，注意是按年缴费；企业型（OV）证书则更贵，年费肯定不下万。因此别嫌命令行操作不好搞，有免费午餐已然相当给力，还要啥自行车。

按规矩，周知一下，证书发行方是Let’s Encrypt。之所以能送免（bai）费（piao）证书，据说主要是全自动。证书生成、发放、展期等操作，都经shell脚本完全自动化 —— 无人工就成本低，蛮好理解；至于抢了那几家拦路收费的生意，咱也捧个人场，起码希望他们能一直坚持做下去。

证书自动获取

来一台阿里云上的CentOS7，以非root（但具备sudo权限）用户连接，先下载certbot-auto脚本，并授以执行权限。

[py27@fisher-test ~]$ wget https://dl.eff.org/certbot-auto 
--2020-06-11 22:57:34--  https://dl.eff.org/certbot-auto
正在解析主机 dl.eff.org (dl.eff.org)... 151.101.228.201, 2a04:4e42:1a::201 
正在连接 dl.eff.org ... 已连接。 
已发出HTTP 请求，正在等待回应... 200 OK
长度：79897 (78K) [application/octet-stream]
正在保存至: “certbot-auto”
 
100%[===============================>] 79,897      5.73KB/s 用时13s
 
2020-06-11 22:57:50 (6.03 KB/s) - 已保存 “certbot-auto” [79897/79897])

[py27@fisher-test ~]$ wget https://dl.eff.org/certbot-auto

--2020-06-11 22:57:34-- https://dl.eff.org/certbot-auto

正在解析主机 dl.eff.org (dl.eff.org)... 151.101.228.201, 2a04:4e42:1a::201

正在连接 dl.eff.org ... 已连接。

已发出HTTP 请求，正在等待回应... 200 OK

长度：79897 (78K) [application/octet-stream]

正在保存至: “certbot-auto”

100%[===============================>] 79,897 5.73KB/s 用时13s

2020-06-11 22:57:50 (6.03 KB/s) - 已保存 “certbot-auto” [79897/79897])

然后以手工完成“挑战”（challenge）的方式，获取泛域名（通配符）DV证书，其中挑战选择DNS，也即按脚本要求，手工在域名解析中增加TXT记录 —— 以此证明此域名归属于申请者。

[py27@fisher-test ~]$ ./certbot-auto certonly  -d *.fisher.cn --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory
Requesting to rerun ./certbot-auto with root privileges...
./certbot-auto has insecure permissions!
To learn how to fix them, visit https://community.letsencrypt.org/t/certbot-auto-deployment-best-practices/91979/
Saving debug log to /var/log/letsencrypt/letsencrypt.log（这里存放获取证书全过程日志供参考）
Plugins selected: Authenticator manual, Installer None
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for fisher.cn
 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.
 
Are you OK with your IP being logged?（作为申请数字证书的要求，是否可以记录本机IP）
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.fisher.cn with the following value:（在域名中增加TXT解析，以完成“挑战”）
 
MomldPnAKL4I8bL8FiwmqvJJdE7E97RH-ARf7PZgw88
 
Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue（此处暂停，登你的DNS，设置解析；搞定后此处回车）【注：过后可删除】
Waiting for verification...
Cleaning up challenges
 
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:（证书获取成功，存放位置如下）
   /etc/letsencrypt/live/fisher.cn/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/fisher.cn/privkey.pem
   Your cert will expire on 2020-09-11. To obtain a new or tweaked（证书过期时间，及更新方法）
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
- If you like Certbot, please consider supporting our work by:
 
   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

[py27@fisher-test ~]$ ./certbot-auto certonly -d *.fisher.cn --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory

Requesting to rerun ./certbot-auto with root privileges...

./certbot-auto has insecure permissions!

To learn how to fix them, visit https://community.letsencrypt.org/t/certbot-auto-deployment-best-practices/91979/

Saving debug log to /var/log/letsencrypt/letsencrypt.log（这里存放获取证书全过程日志供参考）

Plugins selected: Authenticator manual, Installer None

Obtaining a new certificate

Performing the following challenges:

dns-01 challenge for fisher.cn

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

NOTE: The IP of this machine will be publicly logged as having requested this

certificate. If you're running certbot in manual mode on a machine that is not

your server, please ensure you're okay with that.

Are you OK with your IP being logged?（作为申请数字证书的要求，是否可以记录本机IP）

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Please deploy a DNS TXT record under the name

_acme-challenge.fisher.cn with the following value:（在域名中增加TXT解析，以完成“挑战”）

MomldPnAKL4I8bL8FiwmqvJJdE7E97RH-ARf7PZgw88

Before continuing, verify the record is deployed.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Press Enter to Continue（此处暂停，登你的DNS，设置解析；搞定后此处回车）【注：过后可删除】

Waiting for verification...

Cleaning up challenges

IMPORTANT NOTES:

- Congratulations! Your certificate and chain have been saved at:（证书获取成功，存放位置如下）

/etc/letsencrypt/live/fisher.cn/fullchain.pem

Your key file has been saved at:

/etc/letsencrypt/live/fisher.cn/privkey.pem

Your cert will expire on 2020-09-11. To obtain a new or tweaked（证书过期时间，及更新方法）

version of this certificate in the future, simply run certbot-auto

again. To non-interactively renew *all* of your certificates, run

"certbot-auto renew"

- If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate

Donating to EFF: https://eff.org/donate-le

那么证书如何将http通信升级为https，不同的后端有不同的代码实现方式。但就目前主流做法，大家倾向于让https通信脱离开发范畴，直接配置在httpd中，比如nginx config（或者apache之类均可）：

完整阅读本篇»

基于Flask的简易webtelnet和webssh

2020-02-25 作者： Fisherworks

Chinese version README of the Github repo – flask-remote-terminal.

简而言之，一台具备多用户支持的，仅限使用telnet/ssh，访问远程固定地址的，web终端。

演示截图：

有啥稀罕的

只可访问远程地址，非本机终端
目前仅限telnet（支持十几年前老设备用）和ssh访问，代码中也可增加其他协议，但始终受控
仅限访问固定远端地址（IP/域名），代码config可配，一旦服务运行后不可更改
服务端session存储pid和fd等，用于多用户支持

参考项目

一个教学工程 pyxterm.js 作者 Chad Smith

需求如此“扭曲”，何解

通过web终端去管理一台特定的中转机，其多数端口是（在特定时间段内）代理到真正需要管理的目标机。具体需求如下：

同多数web terminal一样，浏览器即开即用，免安装
只允许访问特定地址（中转机），避免被抓肉鸡
只允许使用telnet和ssh进行连接，不可自选其他客户端命令，在此基础上允许用户自行输入用户名和端口号
只用于远程连接，在用户exit退出终端后，也无法回到shell操作提供该服务的server

完整阅读本篇»

Mysql full-text index query with SqlAlchemy

2017-11-24 作者： Fisherworks

结论：

mysql fulltext index基本可用（试了natural language mode和boolean mode），尤其在表结构比较简单的前提下
sqlalchemy自带的match关键字只能match单列的fulltext索引，多列的我们用如下办法自制 – 仅用于查询的话，完全够用
最重要的一点：数据量大时，一个query尽量只使用where match against，与其他的where some_column = ‘hello’要分开写（做成subquery）。如果写在一起，极有可能只有fulltext索引生效，而其他列的简单查询所对应的index不生效。

注册自己的Match子句

from sqlalchemy.ext.compiler import compiles
from sqlalchemy.sql.expression import ClauseElement
from sqlalchemy import literal

class Match(ClauseElement):
    def __init__(self, columns, value):
        self.columns = columns
        self.value = literal(value)

@compiles(Match)
def _match(element, compiler, **kw):
    return "MATCH (%s) AGAINST (%s)" % (
               ", ".join(compiler.process(c, **kw) for c in element.columns),
               compiler.process(element.value)
             )

query(Model).filter(Match([Model.x, Model.y], "some value")) #实施查询

from sqlalchemy.ext.compiler import compiles

from sqlalchemy.sql.expression import ClauseElement

from sqlalchemy import literal

class Match(ClauseElement):

def __init__(self, columns, value):

self.columns = columns

self.value = literal(value)

@compiles(Match)

def _match(element, compiler, **kw):

return "MATCH (%s) AGAINST (%s)" % (

", ".join(compiler.process(c, **kw) for c in element.columns),

compiler.process(element.value)

)

query(Model).filter(Match([Model.x, Model.y], "some value")) #实施查询

所有条件一起用于查询（前面1个filter不能触发已有index）

data = ErrorLog.query\
    .filter(and_(ErrorLog.devId == thisMachine.devId, 
                 ErrorLog.dateTime.between(logStart, logEnd))) \
    .filter(Match([ErrorLog.col1, ErrorLog.col2, ErrorLog.col3, ErrorLog.col4], 
                  "distributed system")) \
    .order_by(ErrorLog.dateTime.desc()) \
    .offset(offset).limit(size).all()

data = ErrorLog.query\

.filter(and_(ErrorLog.devId == thisMachine.devId,

ErrorLog.dateTime.between(logStart, logEnd))) \

.filter(Match([ErrorLog.col1, ErrorLog.col2, ErrorLog.col3, ErrorLog.col4],

"distributed system")) \

.order_by(ErrorLog.dateTime.desc()) \

.offset(offset).limit(size).all()

先做普通字段查询，join后再做fulltext检索（subquery和query各自使用自己的index）

subq = db.session.query(ErrorLog.id.label('errorLogId'))\
    .filter(and_(ErrorLog.devId == thisMachine.devId,
                 ErrorLog.dateTime.between(logStart, logEnd))) \
    .order_by(ErrorLog.dateTime.desc()) \
    .subquery()

data = ErrorLog.query.join(subq, ErrorLog.id == subq.c.errorLogId)\
    .filter(Match([ErrorLog.col1, ErrorLog.col2, ErrorLog.col3, ErrorLog.col4],
                   "distributed system")) \
    .offset(offset).limit(size).all()

subq = db.session.query(ErrorLog.id.label('errorLogId'))\

.filter(and_(ErrorLog.devId == thisMachine.devId,

ErrorLog.dateTime.between(logStart, logEnd))) \

.order_by(ErrorLog.dateTime.desc()) \

.subquery()

data = ErrorLog.query.join(subq, ErrorLog.id == subq.c.errorLogId)\

.filter(Match([ErrorLog.col1, ErrorLog.col2, ErrorLog.col3, ErrorLog.col4],

"distributed system")) \

.offset(offset).limit(size).all()

参考自：https://stackoverflow.com/questions/14971619/proper-use-of-mysql-full-text-search-with-sqlalchemy

完整阅读本篇»

CentOS7免费SSL证书及自动展期

证书自动获取

基于Flask的简易webtelnet和webssh

有啥稀罕的

参考项目

需求如此“扭曲”，何解

Mysql full-text index query with SqlAlchemy

关于Fisherworks

最近文章

功能

本站友链

实时天气

2024年十一月
一	二	三	四	五	六	日
« 10月
				1	2	3
4	5	6	7	8	9	10
11	12	13	14	15	16	17
18	19	20	21	22	23	24
25	26	27	28	29	30