231,445 total views, 516 views today

Fail2ban

Posted on 2020-11-22 by hoyo

—

參考資源

—

安裝

Ununtu

1	# apt-get install fail2ban

CentOS 7

1	# yum install fail2ban

—

系統服務

例如要控管 ssh 可以這樣設定

編輯 jail.conf

1	# vi /etc/fail2ban/jail.conf

設定 sshd 區段

[sshd]

port = ssh

logpath = %(sshd_log)s

backend = %(sshd_backend)s

maxretry = 3

findtime = 30

bantime = 300

將 fail2ban 服務開啟及啟動

1	# systemctl enable --now fail2ban

—

維護

查看有作用

1	# fail2ban-client status

查看作用執行細節

1	# fail2ban-client status web

Status for the jail: web

|- Filter

| |- Currently failed: 0

| |- Total failed: 4

| `- File list: /WEBSite/login_fail.log

`- Actions

|- Currently banned: 1

|- Total banned: 1

`- Banned IP list: 192.168.0.99

解除單一 IP 封鎖

1	# fail2ban-client set sshd unbanip 172.16.1.100

解除全部封鎖

1	# fail2ban-client unban --all

—

自訂服務應用 – 以網頁登入為例

如果其他應用也要套用，例如網頁登入，那就要多費點功夫

需要自訂規則建議先使用 fail2ban-regex 指令進行模擬，如此決定 log 格式以及正規式規則

log 至少需要包含 IP 以及時間，時間最好包含時區，例如

1	192.168.0.99 2020-11-22 00:00:30 CST

使用 fail2ban-regex 驗證正規式是否可抓取 log 資料格式

# fail2ban-regex -d '%Y-%m-%d %H:%M:%S %Z' '192.168.0.99 2020-11-21 14:03:00 CST' '<ADDR> .*'

Running tests

=============

Use datepattern : Year-Month-Day 24hour:Minute:Second

Use failregex line : <ADDR> .*

Use single line : 192.168.0.99 2020-11-21 14:03:00

Results

=======

Failregex: 1 total

|- #) [# of hits] regular expression

| 1) [1] <ADDR> .*

Ignoreregex: 0 total

Date template hits:

|- [# of hits] date format

| [1] Year-Month-Day 24hour:Minute:Second

Lines: 1 lines, 0 ignored, 1 matched, 0 missed

[processed in 0.00 sec]

編輯過濾規則設定檔

1	# vi /etc/fail2ban/filter.d/hoyo-web.conf

datepattern 的百分比符號在設定檔內是連續 2 個

[Definition]

failregex = ^<ADDR> .*$

datepattern = %%Y-%%m-%%d %%H:%%M:%%S %%Z

ignoreregex =

編輯 jail.local

1 2	# vi /etc/fail2ban/jail.local

[web]

enabled = true

filter = hoyo-web

logpath = /WEBSite/login_fail.log

<span style="color: #333333; font-family: Consolas, Monaco, monospace; font-style: normal; font-weight: 300;">maxretry = 3</span>

findtime = 10

bantime = 300

再次使用 fail2ban-regex 驗證，這次使用檔案驗證

1	# fail2ban-regex ./login_fail.log /etc/fail2ban/filter.d/hoyo-web.conf

—

69 total views, no views today

MQTT – 0. 如果不是為了破壞地球，我也不會開始用

Posted on 2020-11-20 by hoyo

—

緣由

因為班班有冷氣加上台電要限制尖峰用電，需要配套需量反應的卸載機制，和上層的通訊一開始定義了 MQTT 所以才開始了解 (要不然要使用 Socket 到死的)

—

簡介

—

82 total views, no views today

MQTT – 2. 其他客戶端

Posted on 2020-11-20 by hoyo

—

參考

—

PHP Publish

PHP 的應用場景可能發生在需要從網頁發出 publish 控制需求，Hoyo 尚未在 PHP 上撰寫常駐程式

安裝，跳過 PHP 版本需求

1	> composer require php-mqtt/client --ignore-platform-reqs

程式範例

<?php

spl_autoload_register(function ($class_name) {

$load_FileName = str_replace('\\', '/', $class_name);

$file_name = __DIR__ ."/php/". $load_FileName .".php";

if ( is_file($file_name) === true ) {

require_once( $file_name );

}

});

$server = 'test.mosquitto.org';

$port = 1883;

$clientId = 'test-publisher';

$mqtt = new \PhpMqtt\Client\MQTTClient($server, $port, $clientId);

$mqtt->connect();

$mqtt->publish('aa/Get/DemandRange', 'Hello World!', 0);

$mqtt->close();

—

CLI

CLI 執行方式除了可以滿足單機執行外，讓 PHP 直接呼叫執行應該是更佳的方式，尤其是剛剛上述的 PHP Publish 效能不彰的情況

mosquitto_sub man page

因為加上了 MySQL 認證

1	# mosquitto_pub -h 172.16.1.220 -p 1883 -u emqx -P public -t aa/Get/DemandRange -m "0000"

完整範例

1	# mosquitto_pub -h 172.16.1.220 -p 8883 -u emqx -P public --cafile my_root_ca.pem --cert client.pem --key client.key -t aa/Get/DemandRange -m "0000"

-h host
-p port
-u 使用者帳號
-P 使用者密碼
–cafile SSL CA 證書檔案路徑
–cert SSL 證書檔案路徑
–key SSL Key 檔案路徑
-t Topic
-m Message

—

106 total views, 1 views today

MQTT – 1. 使用免費公開的 MQTT Broker Server 學習如何訂閱、發行(收發資料)

Posted on 2020-11-19 by hoyo

—

1	MQTT 客户端整个生命周期的行为可以概括为：建立连接、订阅主题、接收消息并处理、向指定主题发布消息、取消订阅、断开连接。

節錄： MQTT 客户端库

—

公開 MQTT Borker

ESP8266 连接到免费的公共 MQTT 服务器 – broker.emqx.io:1883
test.mosquitto.org – test.mosquitto.org:1883
Sandboxes | IoT development made simple – mqtt.eclipse.org:1883
通信猫共享MQTT服务器在线客户端 – mq.tongxinmao.com:18830

建議選擇 broker.emqx.io ，因為支援 WebSocket 可以從資料收集端直接呈現到網頁，不需要經過資料庫這類儲存媒介。實際應用也是 EMQ X Broker 才符合需求，學校專題或是個人嘗鮮可以使用 mosquitto 即可

—

程式參考

Simple Python MQTT Publish and Subscribe Example Script

以下 Python 範例程式已經根據可用 MQTT Broker 修改

程式先訂閱 house/bulb1 主題，然後發行 house/bulb1 此主題及內容

import time

import paho.mqtt.client as paho

broker = "broker.emqx.io"

# define callback

def on_message(client, userdata, message):

time.sleep(1)

print("received message =", str(message.payload.decode("utf-8")))

client = paho.Client("client-001") # create client object client1.on_publish = on_publish #assign function to callback client1.connect(broker,port) #establish connection client1.publish("house/bulb1","on")

######Bind function to callback

client.on_message = on_message

#####

print("connecting to broker ", broker)

client.connect(broker) # connect

client.loop_start() # start loop to process received messages

print("subscribing ")

client.subscribe("house/bulb1") # subscribe

print("publishing ")

client.publish("house/bulb1", "on") # publish

time.sleep(3)

client.disconnect() # disconnect

client.loop_stop() # stop loop

運作結果

connecting to broker broker.emqx.io

subscribing

publishing

received message = on

—

Topic 萬用字元

MQTT(五)SUBSCRIBE Message

finance/stock/ibm/#

finance/stock/ibm

finance/stock/ibm/closingprice

finance/stock/ibm/currentprice

finance/stock/+

/finance/stock/ibm

/finance/stock/xyz

不匹配

/finance/stock/ibm/closingprice

—

Socket VS MQTT

MQTT 要接收的資料必須自己訂閱，少了多了都有問題，Socket 要自己處理資料流
傳送時斷線 Socket 就是失敗，MQTT 根據 QoS 政策可以保證資料的送達。當 QoS 為 0 時，短暫的斷線 (拔網路線10秒) 也能成功送達
主機端須處理的程式 Socket 可以寫在 Workerman 內，MQTT 因為 Server 只是代理，所以程式必須分開，以健康度來說 MQTT 較佳；Socket 程式一致性及即時性較佳

—

144 total views, 2 views today

MQTT – 3. WebSocket

Posted on 2020-11-19 by hoyo

—

MQTT client library

—

使用公共 MQTT Borker 搭建聊天室 – Eclipse Paho JavaScript Client

<!DOCTYPE html>

<head>

<title>MQTT - WebSocket</title>

</head>

<body>

function $_GET(name) {

name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]");

var regex = new RegExp("[\\?&]" + name + "=([^&#]*)"),

results = regex.exec(location.search);

return results === null ? "" : decodeURIComponent(results[1].replace(/\+/g, " "));

}

function time() {

return Math.floor(new Date()

.getTime() / 1000);

}

function send(){

if (event.keyCode === 13) {

event.preventDefault();

event.stopPropagation();

message = new Paho.MQTT.Message('{"time":"'+ time() +'", "user":"'+ user +'", "talk":"'+$('#send').val()+'"}');

message.destinationName = "/HoyoMQTTChar/All";

client.send(message);

$('#send').val('');

}

var user = $_GET('user');

client = new Paho.MQTT.Client('broker.emqx.io', Number(8083), user);

// set callback handlers

client.onConnectionLost = onConnectionLost;

client.onMessageArrived = onMessageArrived;

// connect the client

client.connect({

onSuccess:onConnect,

userName : "hoyo",

password : "hoyo"

});

// called when the client connects

function onConnect() {

// Once a connection has been made, make a subscription and send a message.

console.log("onConnect");

client.subscribe("/HoyoMQTTChar/All");

}

// called when the client loses its connection

function onConnectionLost(r) {

if (r.errorCode !== 0) {

console.log("onConnectionLost:"+r.errorMessage);

}

// called when a message arrives

function onMessageArrived(m) {

if ( m.destinationName ==='/HoyoMQTTChar/All' ){

var j = JSON.parse(m.payloadString);

$('#chart_all').append('<div>'+ j.time +' <b>'+ j.user +'</b> : '+ j.talk +'</div>');

}

</script>

</body>

</html>

結果

—

MQTT.js

js使用mqtt的示例代码

<!DOCTYPE html>

<head>

<title>MQTT - WebSocket</title>

</head>

<body>

var options = {

//mqtt客户端的id，这里面应该还可以加上其他参数，具体看官方文档

clientId: 'mqttjs_' + Math.random().toString(16).substr(2, 8),

username: 'hoyo',

password: 'hoyo'

};

//浏览器采用websocket协议，host主机地址为192.168.0.200，端口为9001，路径为/mqtt

var client = mqtt.connect( "ws://broker.emqx.io:8083/mqtt", options ); // you add a ws:// url here

//建立连接

client.on('connect', function () {

//订阅主题 presence

client.subscribe('presence', function (err) {

if (!err) {

console.log("subscribe success!");

//发布主题presence,消息内容为Hello mqtt

client.publish('presence', 'Hello mqtt')

}else{

//打印错误

console.log(err)

}

})

});

//如果连接错误，打印错误

client.on('error', function (err) {

console.log(err);

client.end()

});

//如果client订阅主题成功，那么这里就是当接收到自己订阅主题的处理逻辑

client.on('message', function (topic, message) {

// message is Buffer,此处就是打印消息的具体内容

console.log(topic, message.toString())

})