6 月 092016
 

1,安装JDK

visualvm-and-tomcat-jvm-01

[root@localhost ~]# yum install jdk-7u80-linux-x64.rpm


[root@localhost ~]# java -version
java version "1.7.0_80"
Java(TM) SE Runtime Environment (build 1.7.0_80-b15)
Java HotSpot(TM) 64-Bit Server VM (build 24.80-b11, mixed mode)
[root@localhost ~]#

2,运行Tomcat

[root@localhost ~]# tar xzf apache-tomcat-7.0.69.tar.gz
[root@localhost ~]# mv apache-tomcat-7.0.69 /usr/local/
[root@localhost ~]# cd /usr/local/apache-tomcat-7.0.69/bin/
[root@localhost bin]# ./startup.sh
Using CATALINA_BASE: /usr/local/apache-tomcat-7.0.69
Using CATALINA_HOME: /usr/local/apache-tomcat-7.0.69
Using CATALINA_TMPDIR: /usr/local/apache-tomcat-7.0.69/temp
Using JRE_HOME: /usr
Using CLASSPATH: /usr/local/apache-tomcat-7.0.69/bin/bootstrap.jar:/usr/local/apache-tomcat-7.0.69/bin/tomcat- 
juli.jar
Tomcat started.
[root@localhost bin]#

查看端口监听

visualvm-and-tomcat-jvm-02

访问页面

visualvm-and-tomcat-jvm-03
3,使用jstatd提供监控

新建一个安全策略配置文件
进入jstatd命令所在目录

visualvm-and-tomcat-jvm-04

root@localhost bin]# vi jstatd.all.policy
grant codebase "file:${java.home}/../lib/tools.jar" {
 permission java.security.AllPermission;
};

修改本机hosts主机名及IP对应关系

[root@localhost ~]# hostname -i
127.0.0.1 127.0.0.1
[root@localhost ~]#

修改

#127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
#::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.2.95 localhost localhost.localdomain

再次确认

[root@localhost ~]# hostname -i
192.168.2.95
[root@localhost ~]#

启动jstatd服务
使用-p指定端口,默认TCP/1099
使用-J-Djava.rmi.server.logCalls=true开启日志
使用-J-Djava.rmi.server.hostname=192.168.2.95指定主机IP地址

[root@localhost ~]# cd /usr/java/jdk1.7.0_80/bin/
[root@localhost bin]# ./jstatd -J-Djava.security.policy=jstatd.all.policy -J-Djava.rmi.server.logCalls=true -p 11099

内容引用:

Using Internal RMI Registry

This example demonstrates starting jstatd with an internal RMI registry. This example assumes that no other server is bound 
to the default RMI Registry port (port 1099).
jstatd -J-Djava.security.policy=all.policy

Enabling RMI logging capabilities.

This example demonstrates starting jstatd with RMI logging capabilities enabled. This technique is useful as a 
troubleshooting aid or for monitoring server activities.
jstatd -J-Djava.security.policy=all.policy -J-Djava.rmi.server.logCalls=true

-p portPort number where the RMI registry is expected to be found, or, if not found, created if -nr is not specified.

 

使用VisualVM连接jstatd主机

visualvm-and-tomcat-jvm-05

visualvm-and-tomcat-jvm-06 visualvm-and-tomcat-jvm-07
4,使用jmx提供监控

修改catalina.sh并重启tomcat服务

XMX和XMS设置值相同,MaxPermSize和MinPermSize设置值相同,可以避免伸缩堆内存大小带来的应用程序暂停,使用户访问Web或Application时获得流畅的体验。

[root@localhost ~]# cd /usr/local/apache-tomcat-7.0.69/bin/
[root@localhost bin]# vi catalina.sh

JAVA_OPTS="-Xms256m -Xmx256m -XX:PermSize=128m -XX:MaxPermSize=128m"

CATALINA_OPTS="-Djava.rmi.server.hostname=192.168.2.95
-Dcom.sun.management.jmxremote
-Dcom.sun.management.jmxremote.port=8081
-Dcom.sun.management.jmxremote.ssl=false
-Dcom.sun.management.jmxremote.authenticate=false"

重启tomcat并确认端口监听

[root@localhost bin]# ./startup.sh
Using CATALINA_BASE: /usr/local/apache-tomcat-7.0.69
Using CATALINA_HOME: /usr/local/apache-tomcat-7.0.69
Using CATALINA_TMPDIR: /usr/local/apache-tomcat-7.0.69/temp
Using JRE_HOME: /usr
Using CLASSPATH: /usr/local/apache-tomcat-7.0.69/bin/bootstrap.jar:/usr/local/apache-tomcat-7.0.69/bin/tomcat- 
juli.jar
Tomcat started.
[root@localhost bin]# netstat -ltn |grep 8081
tcp 0 0 :::8081 :::* LISTEN
[root@localhost bin]#

使用VisualVM连接jstatd主机

visualvm-and-tomcat-jvm-08

visualvm-and-tomcat-jvm-09 visualvm-and-tomcat-jvm-10

5 月 172016
 

错误信息

Login Error

Incorrect username, password or no permission to use the Nexus User Interface.
Try again. Please login before attempting further requests.

替代密码(admin123)

f865b53623b121fd34ee5426c792e5c33af8c227

停止nexus服务

[root@maven ~]# /usr/local/nexus-2.11.4-01/bin/nexus stop
****************************************
WARNING - NOT RECOMMENDED TO RUN AS ROOT
****************************************
Stopping Nexus OSS...
Stopped Nexus OSS.
[root@maven ~]#

进入目录,修改配置文件

[root@maven ~]# cd /usr/local/sonatype-work/nexus/conf
[root@maven conf]# cp security.xml security.xml.backup
[root@maven conf]# vi security.xml

替换用户配置中<password></password>的密码

<user>
 <id>admin</id>
 <firstName>Administrator</firstName>
 <lastName>User</lastName>
 <password>f865b53623b121fd34ee5426c792e5c33af8c227</password>
 <status>active</status>
 <email>changeme@yourcompany.com</email>
</user>

重新启动nexus服务

[root@maven conf]# /usr/local/nexus-2.11.4-01/bin/nexus start
5 月 132016
 

开放http/80,https/443服务
限定ssh/22服务只能从内网10.169.138.158访问
限定udp/161端口只能从内网10.169.138.158访问

[root@localhost ~]# firewall-cmd --permanent --add-service=http
success
[root@localhost ~]# firewall-cmd --permanent --add-service=https
success
[root@localhost ~]# firewall-cmd --permanent --add-port=161/udp
success
[root@localhost ~]# firewall-cmd --permanent --remove-service=ssh
success
[root@localhost ~]# firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.169.138.158/24" service name="ssh" accept"
success
[root@localhost ~]# firewall-cmd --reload
success
[root@localhost ~]# firewall-cmd --list-all
public (default)
 interfaces:
 sources:
 services: dhcpv6-client http https
 ports: 161/udp
 masquerade: no
 forward-ports:
 icmp-blocks:
 rich rules:
 rule family="ipv4" source address="10.169.138.158/24" service name="ssh" accept
[root@localhost ~]#

[root@localhost ~]# firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.169.138.158/24" destination address="10.46.128.24/24" port port="161" protocol="udp" accept"
success
[root@localhost ~]# firewall-cmd --permanent --remove-port=161/dup
success
[root@localhost ~]# firewall-cmd --reload
success
[root@localhost ~]# firewall-cmd --list-all
public (default)
 interfaces:
 sources:
 services: dhcpv6-client http https
 ports: 
 masquerade: no
 forward-ports:
 icmp-blocks:
 rich rules:
 rule family="ipv4" source address="10.169.138.158/24" service name="ssh" accept
 rule family="ipv4" source address="10.169.138.158/24" destination address="10.46.128.24/24" port port="161" protocol="udp" accept
[root@localhost ~]#
5 月 102016
 

 

查看cp命令别名设置

查看别名

[root@localhost ~]# alias cp
alias cp='cp -i'
[root@localhost ~]#

相关参数

-R, -r, --recursive copy directories recursively
-f, --force if an existing destination file cannot be opened, remove it and try again (redundant if the -n option is used)
-i, --interactive prompt before overwrite (overrides a previous -n option)

注释相关别名配置,并重新登录用户。

[root@localhost ~]# cat ~/.bashrc
# .bashrc

# User specific aliases and functions

alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'

# Source global definitions
if [ -f /etc/bashrc ]; then
 . /etc/bashrc
fi
[root@localhost ~]#

使用\转义符号处理。

[root@localhost ~]# ls
anaconda-ks.cfg db.txt install.log install.log.syslog
[root@localhost ~]# touch abc.txt
[root@localhost ~]# ls
abc.txt anaconda-ks.cfg db.txt install.log install.log.syslog
[root@localhost ~]# \cp -rf install.log abc.txt
[root@localhost ~]# ll
total 36
-rw-r--r-- 1 root root 8835 May 10 10:12 abc.txt
-rw-------. 1 root root 1107 Nov 9 2015 anaconda-ks.cfg
-rw-r--r-- 1 root root 744 May 7 11:07 db.txt
-rw-r--r--. 1 root root 8835 Nov 9 2015 install.log
-rw-r--r--. 1 root root 3314 Nov 9 2015 install.log.syslog
[root@localhost ~]#
5 月 072016
 

查询用户和权限

mysql> select * from mysql.user\G;

mysql> select * from mysql.user where user='root' \G;

mysql> show grants for root\G;

创建用户

mysql>use mysql;

mysql>insert into mysql.user(Host,User,Password) values("localhost","test",password("1234"));

删除用户

mysql>use mysql;

mysql>Delete FROM user Where User='test' and Host='localhost';

mysql>flush privileges;

修改密码

mysql>update mysql.user set password=password('newpwd') where User="test" and Host="localhost";

mysql>flush privileges;
4 月 202016
 

Web based AJAX terminal emulator

安装EPEL源

[root@localhost ~]# yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
[root@localhost ~]# yum makecache

查看软件包描述信息

shell-in-a-box-install-and-config-01

安装shellinabox软件包

[root@localhost ~]# yum install shellinabox

查看shellinabox软件包安装路径和文件

[root@localhost ~]# rpm -lq shellinabox
/etc/rc.d/init.d/shellinaboxd
/etc/sysconfig/shellinaboxd
/usr/sbin/shellinaboxd
/usr/share/doc/shellinabox-2.19
/usr/share/doc/shellinabox-2.19/AUTHORS
/usr/share/doc/shellinabox-2.19/COPYING
/usr/share/doc/shellinabox-2.19/GPL-2
/usr/share/doc/shellinabox-2.19/NEWS
/usr/share/doc/shellinabox-2.19/README
/usr/share/doc/shellinabox-2.19/README.Fedora
/usr/share/doc/shellinabox-2.19/print-styles.css
/usr/share/doc/shellinabox-2.19/shell_in_a_box.js
/usr/share/doc/shellinabox-2.19/styles.css
/usr/share/man/man1/shellinaboxd.1.gz
/usr/share/shellinabox
/usr/share/shellinabox/color.css
/usr/share/shellinabox/monochrome.css
/usr/share/shellinabox/white-on-black.css
/var/lib/shellinabox
[root@localhost ~]#

启动服务

[root@localhost ~]# service shellinaboxd start
Starting shellinaboxd: [ OK ]
[root@localhost ~]#

查看端口监听

[root@localhost ~]# netstat -ltn |grep 4200
tcp 0 0 0.0.0.0:4200 0.0.0.0:* LISTEN
[root@localhost ~]#

新建用户并设置密码

[root@localhost ~]# useradd harveymei
[root@localhost ~]# passwd harveymei
Changing password for user harveymei.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.
[root@localhost ~]#

使用浏览器访问Shell In A Box服务,忽略证书安全提示并继续shell-in-a-box-install-and-config-02

出现登录提示符

shell-in-a-box-install-and-config-03

登录,并执行命令操作

shell-in-a-box-install-and-config-04

退出shell后,点击Connect可重新开始登录会话

shell-in-a-box-install-and-config-05

主配置文件

[root@localhost ~]# vi /etc/sysconfig/shellinaboxd

shell-in-a-box-install-and-config-06

4 月 152016
 
# Generated by iptables-save v1.4.7 on Fri Dec 25 01:45:04 2015
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [74:7304]
-A INPUT -p gre -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1723 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Fri Dec 25 01:45:04 2015
# Generated by iptables-save v1.4.7 on Fri Dec 25 01:45:04 2015
*nat
:PREROUTING ACCEPT [16:1307]
:POSTROUTING ACCEPT [2:180]
:OUTPUT ACCEPT [2:180]
-A POSTROUTING -s 10.0.192.0/24 -o eth0 -j SNAT --to-source 198.199.110.213
COMMIT
# Completed on Fri Dec 25 01:45:04 2015
4 月 132016
 

SSL 3.0

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client]
 "DisabledByDefault"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
 "Enabled"=dword:00000000

RC4

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
 "Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
 "Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
 "Enabled"=dword:00000000