All posts by ServerAdmin

PHP

Laravel whoops output – How to hide. env passwords

1 Comment

As of Laravel 5.5.13, there’s a new feature that allows you to blacklist certain variables in config/app.php under the key debug_blacklist.

When an exception is thrown, whoops will mask these values with asterisks * for each character.

To activate this feature, add the next lines inside config/app.php

...
    'debug_blacklist' => [
        '_ENV' => [
            'APP_KEY',
            'DB_PASSWORD',
            'REDIS_PASSWORD',
            'MAIL_PASSWORD',
            'PUSHER_APP_KEY',
            'PUSHER_APP_SECRET',
        ],
        '_SERVER' => [
            'APP_KEY',
            'DB_PASSWORD',
            'REDIS_PASSWORD',
            'MAIL_PASSWORD',
            'PUSHER_APP_KEY',
            'PUSHER_APP_SECRET',
        ],
        '_POST' => [
            'password',
        ],
    ],
...

Save the file and clear the config cache with

php artisan config:clear

After this, all keys added inside debug_blacklist array will be replaced with asterisks (************)

Hardware

Intel CPUs affected by Spectre & Meltdown

Leave a comment
  • Intel® Core™ i3 processor (45nm and 32nm)
  • Intel® Core™ i5 processor (45nm and 32nm)
  • Intel® Core™ i7 processor (45nm and 32nm)
  • Intel® Core™ M processor family (45nm and 32nm)
  • 2nd generation Intel® Core™ processors
  • 3rd generation Intel® Core™ processors
  • 4th generation Intel® Core™ processors
  • 5th generation Intel® Core™ processors
  • 6th generation Intel® Core™ processors
  • 7th generation Intel® Core™ processors
  • 8th generation Intel® Core™ processors
  • Intel® Core™ X-series Processor Family for Intel® X99 platforms
  • Intel® Core™ X-series Processor Family for Intel® X299 platforms
  • Intel® Xeon® processor 3400 series
  • Intel® Xeon® processor 3600 series
  • Intel® Xeon® processor 5500 series
  • Intel® Xeon® processor 5600 series
  • Intel® Xeon® processor 6500 series
  • Intel® Xeon® processor 7500 series
  • Intel® Xeon® Processor E3 Family
  • Intel® Xeon® Processor E3 v2 Family
  • Intel® Xeon® Processor E3 v3 Family
  • Intel® Xeon® Processor E3 v4 Family
  • Intel® Xeon® Processor E3 v5 Family
  • Intel® Xeon® Processor E3 v6 Family
  • Intel® Xeon® Processor E5 Family
  • Intel® Xeon® Processor E5 v2 Family
  • Intel® Xeon® Processor E5 v3 Family
  • Intel® Xeon® Processor E5 v4 Family
  • Intel® Xeon® Processor E7 Family
  • Intel® Xeon® Processor E7 v2 Family
  • Intel® Xeon® Processor E7 v3 Family
  • Intel® Xeon® Processor E7 v4 Family
  • Intel® Xeon® Processor Scalable Family
  • Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series
  • Intel® Atom™ Processor C Series
  • Intel® Atom™ Processor E Series
  • Intel® Atom™ Processor A Series
  • Intel® Atom™ Processor x3 Series
  • Intel® Atom™ Processor Z Series
  • Intel® Celeron® Processor J Series
  • Intel® Celeron® Processor N Series
  • Intel® Pentium® Processor J Series
  • Intel® Pentium® Processor N Series

Source: https://www.tweaktown.com

Mint Linux

Skype for Linux 8.13 not working

3 Comments

The latest Skype for Linux update (8.13.) seems broken on Ubuntu 14.04/Mint Linux 17.x. The application loads but all I can see is the white window with the menu.

During load, I see the application screen for a second before the center of the application window turns white again. Reinstall process didn’t help

Since official fix doesn’t exist (for now), the only solution is to remove the latest version and install the older one

sudo apt-get remove skypeforlinux
sudo apt-get install skypeforlinux=8.11.0.4

optionally you can “lock” Skype so it won’t ask for update (at least until they fix this problem)

sudo apt-mark hold skypeforlinux
Hardware, Linux

Librem 5 – A Security and Privacy Focused Phone

Leave a comment

The idea to build and use the phone OS which doesn’t rely on Apple or Google is quite old. Since the Ubuntu Edge project, there have been several attempts, but nothing which can even scratch those two giants.

The new attempt is here – The Purism project, which is seeking funds right now (link here). The idea is to build a true Linux powered smartphone that focuses on security by design and privacy protection by default.

The device will ship with GNOME Shell UI or KDE Plasma Mobile UI by default. Also, through various partnerships and development efforts in the community, the users will be able to replace it with other UIs!

Once again, here is the LINK. Pledges starts from $20 so you can support it if you like.

Tips & Tricks

There is no suitable CSPRNG installed on your system

Leave a comment

Some PHP packages may stop working after update with error message: “There is no suitable CSPRNG installed on your system”.

The reason for this that they stopped using OpenSSL and now they need access to /dev/urandom which isn’t readable by your PHP configuration.

To fix this problem, all you need to do is to add /dev/urandom to your open_base configuration which limits the files that can be accessed by PHP to the specified directory-tree (or trees).

In case you’re using php-fpm, add the “/dev/urandom” in existing php_admin_value[open_basedir] definition (or add this line if it doesn’t exist)

For example:

php_admin_value[open_basedir] = /var/www/html/domain.tld:/usr/share/php5:/usr/share/php:/tmp:/usr/share/phpmyadmin:/etc/phpmyadmin:/var/lib/phpmyadmin:/dev/random:/dev/urandom

or if you’re using mod_fcgi, inside .php-fcgi-starter script add parameter

-d open_basedir="/var/www/html/domain.tld:....:/dev/urandom"
Tips & Tricks

CentOS 6.x boot GRUB on software RAID /dev/md0

Leave a comment

If you’ve just installed CentOS 6.x on software RAID and it won’t boot from /dev/md0, don’t worry. It can be fixed.

– Insert CentOS media/DVD and boot in rescue mode (select “Rescue mode” during boot)
– Select the “start shell” option
– chroot with

chroot /mnt/sysimage

– install GRUB into /dev/md0 with

grub-install /dev/md0

– enter exit and than reboot

The other option is to enter into rescue mode and inside grub shell type the next commands:

grub> device (hd0) /dev/sda
grub> device (hd1) /dev/sdb
grub> root (hd0,0)
grub> setup (hd0)
grub> root (hd1,0)
grub> setup (hd1)
grub> quit
Java, Mint Linux, Programming

Oracle Java 8 on Ubuntu 14.04 / Mint 17.3

Leave a comment

Default “Java” version of Mint Linux 17.3 (or Ubuntu 14.04) is OpenJDK 1.7 which works fine, but some SDKs won’t install until you upgrade to 1.8 (for example Tizen IDE studio complains on OpenJDK 1.7)

Before you start, check the current version with “java -version”

java version "1.7.0_121"
OpenJDK Runtime Environment (IcedTea 2.6.8) (7u121-2.6.8-1ubuntu0.14.04.1)
OpenJDK 64-Bit Server VM (build 24.121-b00, mixed mode)

Add the PPA, update and install oracle-java8-installer

sudo apt-add-repository ppa:webupd8team/java
sudo apt-get update
sudo apt-get install oracle-java8-installer

(During the install process you’ll need to accept the Oracle terms)

Now, check again with “java -version”

java version "1.8.0_111"
Java(TM) SE Runtime Environment (build 1.8.0_111-b14)
Java HotSpot(TM) 64-Bit Server VM (build 25.111-b14, mixed mode)

In case you’re still receiving the 1.7 versions as response, install “oracle-java8-set-default” package with

sudo apt install oracle-java8-set-default

and check again.

PostgreSQL, Red Hat/CentOS, Server project

PostgreSQL on CentOS 7 – Howto

Leave a comment

In this post I’ll try to show you how to install PostgreSQL 9.6 on CentOS 7.3 which is the current versions of PostgreSQL and CentOS.

The default PostgreSQL version on CentOS 7.3 is PostgreSQL 9.2 which is still maintained, but in case you’re more for a “cutting edge” technology, try to follow the next steps

First, remove the already installed version (in case you installed the default version)

yum remove postgresql-server postgresql-contrib

Install official PostgreSQL Yum repo with

yum -y install https://download.postgresql.org/pub/repos/yum/9.6/redhat/rhel-7-x86_64/pgdg-centos96-9.6-3.noarch.rpm

which will create a new repo file /etc/yum.repos.d/pgdg-96-centos.repo with the next content

[pgdg96]
name=PostgreSQL 9.6 $releasever - $basearch
baseurl=https://download.postgresql.org/pub/repos/yum/9.6/redhat/rhel-$releasever-$basearch
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-PGDG-96
 
[pgdg96-source]
name=PostgreSQL 9.6 $releasever - $basearch - Source
failovermethod=priority
baseurl=https://download.postgresql.org/pub/repos/yum/srpms/9.6/redhat/rhel-$releasever-$basearch
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-PGDG-96
 
[pgdg96-updates-testing]
name=PostgreSQL 9.6 $releasever - $basearch
baseurl=https://download.postgresql.org/pub/repos/yum/testing/9.6/redhat/rhel-$releasever-$basearch
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-PGDG-96
 
[pgdg96-source-updates-testing]
name=PostgreSQL 9.6 $releasever - $basearch - Source
failovermethod=priority
baseurl=https://download.postgresql.org/pub/repos/yum/srpms/testing/9.6/redhat/rhel-$releasever-$basearch
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-PGDG-96

Now install PostgreSQL with

yum -y groupinstall "PostgreSQL Database Server 9.6 PGDG"

and initialize it with

/usr/pgsql-9.6/bin/postgresql96-setup initdb

Start and enable service with

systemctl start postgresql-9.6.service
systemctl enable postgresql-9.6.service

Switch to the postgres user with

su postgres -

and connect to the server (currently running only on localhost)

psql

Check the installed version with

SELECT version();

You should get something like

...
                                                 version                                                 
---------------------------------------------------------------------------------------------------------
 PostgreSQL 9.6.1 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 4.8.5 20150623 (Red Hat 4.8.5-4), 64-bit
(1 row)
....

The default PostgreSQL installation listens only on localhost so if you want to connect from the remote host you’ll need to change a few things.

Open /var/lib/pgsql/9.6/data/postgresql.conf and find the line #listen_addresses = ‘localhost’… and replace it with the listen_addresses = ‘*’

Before

#------------------------------------------------------------------------------
# CONNECTIONS AND AUTHENTICATION
#------------------------------------------------------------------------------
 
# - Connection Settings -
 
#listen_addresses = 'localhost'         # what IP address(es) to listen on;
                                        # comma-separated list of addresses;
                                        # defaults to 'localhost'; use '*' for all
                                        # (change requires restart)
#port = 5432                            # (change requires restart)
max_connections = 100                   # (change requires restart)

after

#------------------------------------------------------------------------------
# CONNECTIONS AND AUTHENTICATION
#------------------------------------------------------------------------------
 
# - Connection Settings -
 
#listen_addresses = 'localhost'         # what IP address(es) to listen on;
listen_addresses = '*'
                                        # comma-separated list of addresses;
                                        # defaults to 'localhost'; use '*' for all
                                        # (change requires restart)
#port = 5432                            # (change requires restart)
max_connections = 100                   # (change requires restart)

Now open /var/lib/pgsql/9.6/data/pg_hba.conf and add at the end

host    all             all             YOUR_CLIENT_IP_ADDRESS/32            md5

save the file and restart service with

systemctl restart postgresql-9.6.service

The last step before you test it is to change the password for postgres user with

su postgres -
 
bash-4.2$ psql
psql (9.6.1)
Type "help" for help.
 
postgres=# \password
Enter new password:
Enter it again:
postgres=# \q
exit

Now add new server in pgAdmin and test it

nginx

Nginx – redirecting with a regular expression

Leave a comment

NGINX rewrite rules are quite simple and easy to understand. They change the part or complete URL in a client request (for example in case when you want to redirect your users from http to https, to another domain/subdomain, etc)

For example, the simple redirect with code 301 (moved permanently) from olddomain.com to newdomain.com can be achieved with:

server {
    listen 80;
    listen 443 ssl;
    server_name olddomain.com www.olddomain.com;
    return 301 $scheme://www.newdomain.com$request_uri;
}

In this case, $scheme and $request_uri are nginx variables and they are used to capture and replicate the values from the original request URL ($scheme is the protocol – ‘http’ or ‘https’ and $request_uri is the portion of the URL that follows the domain name – for example ‘/getUser?id=blabla’)

Examples

To add ‘www’ before the domain:

server {
    listen 80;
    listen 443 ssl;
    server_name domain.com;
    return 301 $scheme://www.domain.com$request_uri;
}

To remove the ‘www’:

server {
    listen 80;
    listen 443 ssl;
    server_name www.domain.com;
    return 301 $scheme://domain.com$request_uri;
}

To redirect all requests which doesn’t match already defined server and location blocks to specific home page
For example subdomain whose IP address points to the server but the server doesn’t have defined server or location block for this subdomain

server {
    listen 80 default_server;
    listen 443 ssl default_server;
    server_name _;
    return 301 $scheme://www.domain.com;
}

Also, you can add $request_uri variable above.

Forcing all Requests to Use SSL/TLS

server {
    listen 80;
    server_name www.domain.com;
    return 301 https://www.domain.com$request_uri;
}

Redirecting a subdomain with a regular expression to new subdomain

server {
    listen 80;
    server_name ~^((?<subdomain>.*)\.olddomain.com)$;
    return 301 $scheme://${subdomain}.newdomain.com$request_uri;
}

Redirecting subdomain to specific dir (with a regular expression)

server {
    listen 80;
    server_name ~^((?<subdomain>.*)\.)(?<domain>[^.]+)\.(?<tld>[^.]+)$;
    return 301 $scheme://${domain}.${tld}/${subdomain};
}

Source:
https://www.nginx.com/blog/creating-nginx-rewrite-rules/
https://stackoverflow.com/questions/9578628/redirecting-a-subdomain-with-a-regular-expression-in-nginx/31037713