Linux & Open Source on Wojciech Marusiak IT Blog

Protect your Git secrets with Gitguardian

Mon, 17 Mar 2025 00:00:00 +0000

Since I started my journey with Hugo blogging platform migrating away from Wordpress several years ago I’ve been using Git more and more. It has been essential for me to save all critical work I am working on in Git. But as you are working it might happen that a secret or two might be pushed to the Git repository. I am not guilty of that but as my process of learning and mastering the technology I found out that there is a possibility to protect your Git repositories even before pushing anything to the repository. In todays post I will show you how easily it is to use GitGurardian and prevent secrets leaking to public repositories.

Luckily for us they provide free account with some nice stats.

You can take a look at the detailed pricing.

Prerequisites

As a main prerequisite is Git repository. In my case I am using GitHub so I will show you how to configure it with GitHub.

ggshield installation

At first in your local environment you need to install ggshiled. It is a CLI tool which will will do the heavy work for you.

Simply follow your operating system installation guide.

Then you need to create GitGuardian account as you will need to authenticate via CLI.

Run manual repository scan

Now as we have ggshield CLI installed we can initiate our scan.

It is as simple as running the command ggshield secret scan repo /path/to/the/repo.

Here is the result of my manual scan on one of my repositories.

You can simply run this command on all of your repositories but if you have a lot of them it might take some time to do it.

Add pre commit hooks to secure your repository

It is possible to configure a pre commit hook in your Git repository so prior commit a ggshield CLI scann will be initiated.

In order to do it you need to create a file called .pre-commit-config.yaml. In tat file add following code

repos:
  - repo: https://github.com/gitguardian/ggshield
    rev: v1.37.0
    hooks:
      - id: ggshield-push
        language_version: python3
        stages: [pre-push]

You can check if there are some changes in this code as per installation guide.

In order to add pre-commit we need to install it via Pip.

`1`	`pip install pre-commit`

Once installed and the file is created you can simply by running command.

`1`	`pre-commit install --hook-type pre-push`

If installed successfully you will receive following output pre-commit installed at .git/hooks/pre-push.

After installing pre-commit before every push of code to Git repository it will be automatically scanned with ggshield.

If everything is configured correctly your repository should be scanned prior to push.

Optional - Scan all your repositories

If you are ok with that you can grant GitGuardian permissions to scan your whole Git account. In my case I allowed this and several issues have been identified. Luckily for me all those affected repositories are private.

Summary

I hope you liked it and that this will help you to secure your Git repositories.

VMware Explore 2024 - Day 2

Tue, 05 Nov 2024 00:00:00 +0000

Alright, let’s break down Day 2 of VMware Explore in Barcelona like it’s the latest episode of your favorite show:

“Private AI: This Time It’s Personal”

Remember how VMware was talking about running AI on your own systems? They got real serious about it on Day 2. They basically said, “Forget relying on big tech companies for AI, you can do it yourself!” This is huge because it means more control and better security for your data.

c"Edge Computing: Living Life on the Edge"

VMware also showed off some cool new stuff for “edge computing.” Think of it like this: instead of all your apps living in some giant data center, they can live closer to where they’re actually being used, like in stores or factories. This makes everything faster and more efficient.

##“Tanzu: Your App’s Best Friend”

They also cdid a deep dive on Tanzu, showing how it can help you move your old apps to the cloud and build awesome new ones. Think of it as a makeover for your apps, getting them ready for the modern world.

“VMware Loves its Fans”

VMware gave a big shout-out to its user group, basically a club for VMware fans. They talked about how being part of the community can help you learn more and connect with other people who use their stuff.

In a nutshell, Day 2 was all about showing, not just telling. They gave real-world examples of how their tech can help you solve actual problems. It’s like they said, “We’re not just hype, we actually deliver!”

Optimize Your JPG and PNG Images and Use WebP Format

Wed, 06 Dec 2023 13:33:33 +0100

Image management is a crucial part of today’s Internet. We generate huge amount of images, we need to store them and it all takes place somewhere. On my blog over many Years, I produced a lot of articles, many with images. I never really bothered about the images that much. They existed and I used them on my blog. However, after moving from WordPress to a static blog generator my ultimate goal was stop using JPG or PNG file formats to improve page speed loading time, to decrease blog size and use modern image formats.

In todays blog I will show you what is WebP format and how I reduced the size of images by 5 times!

What is WebP?

WebP is a raster graphics file format developed by Google intended as a replacement for JPEG, PNG, and GIF file formats. It supports both lossy and lossless compression, as well as animation and alpha transparency.

Google announced the WebP format in September 2010, and released the first stable version of its supporting library in April 2018.

WebP format on Wikipedia

Why should you care about it?

Excellent question :) Part of it was answered in the intro section of the post. WebP is highly efficient graphical image format which with the same image quality takes less space. On Google WebP webpage you can see very nice comparison of WebP image and PNG image.

How I reduced my blog size by x5?

The answer isn’t mysterious. I simply converted all my images from JPG and PNG format into WebP. As I am using static webpage generator - Hugo and I store all my post on GitHub after testing conversion I simply replaced all JPG and PNG occurrences to WebP.

On the next picture you can see the size of folder before and after using WebP format.

How you can convert all PNG and JPG images to WebP?

You can download pre-compiled utilities and libraries from WebP website. I am using macOS so I used brew to download cweb by using command brew install cweb.

Then on macOS I used following scripts from the blog https://www.roberthorvick.com/blog/converting-images-from-png-jpg-to-webp-and-resizing:

PNG for x in $(find . -iname '*.png');do cwebp -resize 800 0 "${x}" -o "${x%%png}"webp;done
JPG for x in $(find . -iname '*.jpg');do cwebp -resize 800 0 "${x}" -o "${x%%jpg}"webp;done
JPEG for x in $(find . -iname '*.jpeg');do cwebp -resize 800 0 "${x}" -o "${x%%jpeg}"webp;done

I didn’t test it on Windows but a script from GitHub might be useful.

# Copy this file to any directory containing images & then run this script in powershell
# Get all png images in the current directory & convert it to webp format
$images = Get-ChildItem -Path (Get-Location) -Filter *.png
foreach ($image in $images) {
  $fileName = $image.DirectoryName + "\" + $image.BaseName + ".webp"
  cwebp.exe -q 80 $image.FullName -o $fileName
}

Summary

I hope you will find this post useful and you will as well benefit from the image size decrease as much as I did :)

Failed to start File System Check on vCenter Server Appliance (vCSA)

Mon, 21 Aug 2017 10:31:22 +0000

My lab hasn’t been used for a few weeks due to business in a Project. As I have a VCIX6-NV exam on this Friday I had to refresh my knowledge and prepare myself a bit before I try to pass it. I was quite surprised when I logged into the lab and it was down. After quick login to ESXi, I discovered an error on vCSA and PSC - Failed to start File System Check on /dev/dis…uuid. Today I will show you what needs to be done after such failure to recover your vCSA / PSC appliance.

Here is the error I mentioned in the headline.

Let’s fix this issue.

Open the favorite console on the appliance vCSA / PSC and type cat /run/initramfs/rdsosreport.txt.
Once the scroll finishes search for disk device /dev/sda*. In my case, it was /dev/sda3.
Now in order to fix the file system on the appliance, we must run the following command - fsck /dev/sda3.
Several times fsck will ask you to confirm various fixes (inodes, directories structure of block bitmap differences).
Once the fixes are applied reboot vCSA / PSC appliance and it should go back online without any issues.

I hope this post was informative and you were able to fix your broken vCenter Server Appliance or Platform Services Controller.

How to install Linux VMware Tools in VMware Fusion 8

Wed, 07 Oct 2015 07:00:03 +0000

I recently needed Linux Virtual Machine to manage one of the environments and I simply downloaded Linux distribution from Internet. My choice was Linux Mint 17.2 Rafaela. I like this specific distribution, because it looks nice and As you might suspect it was installed as Virtual Machine on my laptop. As I am using Mac OS X I had to use VMware Fusion.

Solution

I am using Mac OS X Yosemite with VMware Fusion 8 Professional. After I installed base operating system I wanted to install VMware Tools to use all features of operating system.

When I clicked on Virtual Machine - Install VMware Tools I immediately got error.

VMware Tools installation in Linux

In case your Linux distribution isn’t supported out of the box in VMware Fusion I will show you how to install VMware Tools anyway.

Find VMware Tools in Mac OS X

In order to find VMware Tools we can simply search for them in Terminal.

Authenticate as root in Terminal and use command below to find all files with .iso extension.

`1`	`root# find / -name *.iso`

As output you will see all iso files in your laptop.

Now what we need to do is to copy linux.iso to location on your laptop.

Simply use command below to copy it to your user Desktop.

`1`	`cp /Applications/VMware\ Fusion.app//Contents/Library/isoimages/linux.iso /Users/USERNAME/Desktop/`

Once you got it on Desktop you can simply mount ISO image to Linux Virtual Machine.

In VMware Fusion click on your Virtual Machine move to CD/DVD and select Choose Disc or Disk Image.

Select ISO we just copied.

Next step is to click Connect CD/DVD and ISO will be mounted in Virtual Machine.

We need to copy VMwareTools tar.gz file to /tmp location where we will extract it and start installer.

Execute following command to copy it to /tmp location.

`1`	`cp /media/wojcieh/VMware\ Tools/VMwareTools-10.0.0-2977863.tar.gz /tmp/`

Once we copied VMware Tools we need to extract them. Switch to /tmp folder. In order to do extract execute command below.

`1`	`tar -zxvf VMwareTools-10.0.0-2977863.tar.gz`

When command is finished simply enter vmware-tools-distrib directory.

In order to start VMware Tool installer use this command.

`1`	`./vmware-install.pl`

We will be asked if we want to proceed with installer - type yes.

Choose directory to install VMware Tools - I always go with defaults. Simply click Enter for all questions.

In the next question answer yes by pressing enter to create necessary directories.

Go with defaults and answer yes at the end.

Once more we are asked if we want to run initial pre-cofniguration scripts. Answer yes.

If you want you can enable Host-Guest folder sharing - it is totally up to you. I use this feature quite often so I selected yes.

We are asked for valid gcc path - installer detected it correctly so no need to change anything here.

Same for kernel modules - just click enter.

We can as well select if we want to use dragging and copying files between host and virtual machine.

I skipped enabling VMware automatic kernel modules and thinprint.

Once again we go with defaults and click yes.

After short while VMware Tools for Linux are installed. We just need to start them.

You can start VMware Tools by logging off, restarting X session or manually executing by typing in shell /usr/bin/vmware-user.

VMware vSphere Management Assistant 5.5 (vMA) – installation, configuration and usage

Wed, 28 May 2014 07:30:24 +0000

vMA - what is it?

VMware vSphere Management Assistant (vMA) is appliance based on Linux system which can be used as centralized management point in VMware environment. It has several tools used in VMware environment like: vCLI, resxtop, vifs or vmware-cmd. vMA after initial configuration is quite handy if you manage several hosts.

vMA - installation

In order to install vMA you have to download it from VMware website. Here is link to latest available vMA version 5.5.0 https://my.vmware.com/web/vmware/details?productId=352&downloadGroup=VMA550.

In order to deploy it we simply have to follow OVF Template deployment.

Click right mouse button on cluster (in my case) and select Deploy OVF Template.
If you downloaded it locally select Local File and point to ovf file.
Review details and click next.
Accept EULAs.
Provide name for your vMA and select desired place for it in you infrastructure.
Select desired storage placement.
Select network setup.
Click finish and wait for ovf deployment.
Summary of appliance after deployment.

vMA - configuration

After we successfully deployed vMA we need to power it on and configure it.

Hit 6 and set IP address and netmask.
Hit 2 and enter default gateway according to your network setup.
Hit 4 and provide DNS server.
Hit 3 and enter desired hostname.
Hit 1 to end configuration. Now we need to enter new password for default vMA user vi-admin.
After password change vMA will be configured and you will see following screen in console.
You can login using browser https://vMA\IP\ADDRESS:5480 where you can configure if needed vMA. You can check for updates, set time zone, or reboot vMA.

vMA - usage

As vMA acronym says - vSphere Management Assistant, we installed it to manage ESXi hosts. Before we start executing command from vMA we need to add remote host. In order to do it we use following command.

`1`	`vifp addserver esxi01.marusiak.local --authpolicy fpauth --username root --password Password`

We can verify if server was added correctly using this command.

`1`	`vifp listservers`

As you see I added my three ESXi hosts.

In order to execute commands against any of added hosts we use following command.

`1`	`vifptarget -s esxi01.marusiak.local`

As you see I am in a context of specific host and I can execute remote commands on it.

vMA - optional configuration

We have two optional configuration items which I would like to share here.

Join vMA to Active Directory - to do it first ESXi host has to be added to domain as well. You can use my post https://www.wojcieh.net/vmware-esxi-5-5-active-directory-authentication-step-by-step/ as a reference how to configure it. Once this step is finished you can join vMA in Active Directory using following command

`1`	`sudo domainjoin-cli join marusiak.local administrator`

You will be prompted with vi-admin password and later on with domain administrator user password. As it says on the screen VMware suggest to reboot vMA after joining Active Directory domain.

After reboot we can easily login to vMA using domain credentials.

**Use fastpass with vCenter **- instead of providing credentials for each ESXi server we can use vCenter with vMA. Simply add connection using following command

`1`	`vifp addserver vCenter.marusiak.local --authpolicy adauth`

After that command executes we can execute esxcli or vicfg without specifying username and password.

SteamOS on VMware Workstation

Tue, 17 Dec 2013 23:01:34 +0000

SteamOS is the first gaming Linux-based operating system. The base system draws from Debian 7, code named Debian Wheezy. More information, of course, available on website http://store.steampowered.com/livingroom/SteamOS/

I presume that you are here because you know what SteamOS is and you want to try run it as Virtual Machine in VMware Workstation on Windows. In few steps, I will show you how to do it.

Downloading and creating SteamOS ISO

In order to download SteamOS files simply click the following link.

After you download files, extract them into a folder. Now we need to create ISO file from extracted files. I used CDBurnerXP to do it.

Here is step by step guide.

Select Data Disc
Drag SteamOS extracted files into compilation
Go to Disk -> Boot Options. Select Make disc bootable and set following settings.

Select path to boot image: SteamOSInstallerbootgrubbootx64.efi
Emulation type: Hard Disk
Platform: x86-64

Change disc file system. Click Data -> Change File System and select ISO9660/ Joliet.
Click OK and go to File -> Save Compilation as ISO file and give desired ISO name.

Installing SteamOS as Virtual Machine in VMware Workstation

When ISO is completed create empty custom Virtual Machine with following settings:

Hardware Compatibility - VMware Workstation 10
Install operating system later
Guest Operating System - Linux, Debian 7 64-bit
1vCPU, 4GB RAM, 20GB Hard Disk
Edit Virtual Machine configuration file (vmx) and add entry firmware = "efi"

After you will mount ISO in Virtual Machine CD-ROM power it on.

Installation of SteamOS step by step.

Select Automated Install.
Wait for the installer - you don’t really have to do much there.
After installation reboot it.

Configuring SteamOS for full gaming experience

After installation, there are several steps to make SteamOS fully work in VMware Workstation. Here are steps which I did to play games using SteamOS.

Change root password In order to change the root password from login screen select Default Xsession. As username enter desktop with password desktop. Start Terminal and type sudo passwd root. Provide credentials for the desktop user and change the root password.
Install VMware Tools

Click on SteamOS Virtual Machine and select Install VMware Tools.

Installation is done in several steps:

Login as root
Start Terminal
copy VMware Tools tar file to home directory - cp /media/cdrom/VMwareTools* /home/steam/
extract files using command tar -zxf VMwareTools*
enter directory vmware-tools-distrib
as root execute installation script - ./vmware-install.pl
safely you can go for standard settings - just hit enter everywhere
restart SteamOS Virtual Machine so all VMware Tools drivers are loaded

If you don’t know how to install VMware Tools in Linux please follow this VMware KB guide https://www.vmware.com/support/ws5/doc/ws_newguest_tools_linux.html

Change Sound Card in the system

After VMware Tools are installed login to Default Xsession as a desktop as root. Go to System Settings and then click Sound. Go to Hardware tab and change Analog Stereo Duplex to Analog Stereo Output, turn on sound and test speakers.

Play it!

Finally, after some time you can test new shiny SteamOS. On login screen enter default SteamOS username steam and password steam and select Gnome as graphical user interface.

After login you will see Steam icon. Double click it and you will see Steam License Agreement.

Accept it and after that some updates will be downloaded before playing games.

After update you will see normal Steam application.

Login to your account and you will see games you can play. In my case it is only one game - FTL: Faster Than Light (by the way brilliant game 😉 ).

Here is proof that it is working 🙂

SteamOS iso and complete Virtual Machine

In comment one of user - rlmicrosa - prepared ISO and complete Virtual Machine. If you have any problems with creating one by yourself try what he prepared. Thanks a lot for sharing!

ISO

http://goo.gl/6MIwBP

Virtual Machine

http://goo.gl/PkBY4l

Centos 6.4 yum proxy timeout error

Thu, 25 Jul 2013 17:15:58 +0000

Today I was in the mood to do yum update on my test CentOS box. Everything started pretty normal, amount of data to download and so on. Later on data was downloading when on one package with following error:

1
2

Package name [Errno 12] Timeout on Package name:(28, 'Operation too slow. Less than 1 bytes/sec transfered the last 30 seconds')
 Trying other mirror.

My CentOS connects to network where Internet downloads are scanned using Anti-Virus gateway. Package which I was downloading was bigger than usual (about 120MB).

Solution to timeouts during package download is simply to add to /etc/yum.conf following line:

timeout=200

Turbocharge Apache with mod_pagespeed from Google

Mon, 11 Feb 2013 22:38:04 +0000

The Dream

Imagine that with just few clicks you could speed up your slow website - sounds very tempting but is it really possible? Trust me it is! Sounds like I am trying to sell magical cure for hangover or German used diesel car with 50000 km which was driven by old grandpa only to church and back.

The Reality

Reality is quite simple - Google made a really good work to implement websites performance best practices into one piece of software which is really easy to use. Of course what Google prepared is well known for all website coders and geeks. For normal people who prefer to click and forget this is very useful. You can read more about website best practices https://developers.google.com/speed/docs/insights/rules.

What to do master - teach me!

Hold your horses young padawan. Here are prerequisites you need to fulfill:

your server must have Apache 2.x installed
if you are running CentOS/Fedora (32-bit and 64-bit) or Debian/Ubuntu (32-bit and 64-bit) and you want to install RPM’s / DEB’s download them from this page https://developers.google.com/speed/docs/mod_pagespeed/download
if you prefer compiling sources follow this link https://developers.google.com/speed/docs/mod_pagespeed/build_from_source

Nonstandard httpd config files

Important notice for servers with non-standard configuration files. If for any reason your httpd config is located in different location for example in /etc/httpd/conf/httpd.conf (rather than in /etc/httpd/conf.d/)

Then you need to load mod_pagesped by modifying /etc/httpd/conf/extra/httpd-includes.conf by this: Include /etc/httpd/conf.d/pagespeed.conf

After you loaded mod_pagespeed check if it is loaded correctly (in CentOS apachectl -M) and now it is time to configure goodies.

I will share optimizations I enabled on my webserver:

#Images
    ModPagespeedEnableFilters rewrite_images
    ModPagespeedEnableFilters insert_img_dimensions
    ModPagespeedEnableFilters convert_gif_to_webp
    ModPagespeedEnableFilters convert_webp_to_progressive
    ModPagespeedEnableFilters webp_subsampling
    ModPagespeedEnableFilters recompress_webp
    ModPagespeedEnableFilters recompress_webp
    ModPagespeedEnableFilters recompress_webp
    ModPagespeedEnableFilters strip_image_color_profile
    ModPagespeedEnableFilters strip_image_meta_data
    ModPagespeedEnableFilters sprite_images
#CSS 
    ModPagespeedEnableFilters move_css_above_scripts
    ModPagespeedEnableFilters outline_css
    ModPagespeedEnableFilters rewrite_css
    ModPagespeedEnableFilters inline_css
    ModPagespeedEnableFilters combine_css
#JavaScript
    ModPagespeedEnableFilters rewrite_javascript
    ModPagespeedEnableFilters defer_javascript
    ModPagespeedEnableFilters inline_javascript
    ModPagespeedEnableFilters outline_javascript
#Cache
    ModPagespeedEnableFilters extend_cache
#Others
    ModPagespeedEnableFilters remove_quotes
    ModPagespeedEnableFilters collapse_whitespace,elide_attributes
    ModPagespeedEnableFilters remove_comments
#Domain
    ModPagespeedDomain https://www.wojcieh.net

After that overall speed of website is very fast. It is not only personal feeling but tests like Pingdom Tools, Google PageSpeed Insights, Yslow also confirm that. I hope you will at least try it - it will not harm you, it will not take long to implement - but trust me results are incredible and you will not regret it.

Documentation is located here http://code.google.com/p/modpagespeed/

Solve NTP time drift on VPS server

Sun, 27 Jan 2013 23:01:44 +0000

Recently I found that on my VPS server there is incorrect time often called time drift. As you know having correct time is very important - especially in Active Directory environments. Back to my case - I have VPS running on XEN and I reported to hosting company this issue. They replied that they will not change ntp settings for hosts but they said that I can do it by myself.

So encouraged by them (of course by not solving my ticket at all) I did small digging and I found this solution.

`1`	`echo "1" < /proc/sys/xen/independent_wallclock`

I just restarted ntpd deamon and now I am synced quite ok. I assume you configured your box as ntp client - which is of course so trivial that I will not describe it.

[root@vps]# **ntpq -p**

# remote           refid      st t when poll reach   delay   offset  jitter

+nac.oa.uj.edu.p 149.156.70.3     2 u   24   64  377   17.076  -12.822  14.582
  
*ntp.ifj.edu.pl  10.0.2.4         2 u   24   64  377   18.393  -20.868   6.604
  
histeria.pl     .INIT.          16 u    -   64    0    0.000    0.000   0.000
  
LOCAL(0)        .LOCL.          10 l   28   64  377    0.000    0.000   0.001

VMware ESXi 5.1 USB install

Thu, 10 Jan 2013 11:48:39 +0000

First blog entry this Year will be in English and about creating ESX/ESXi and Linux installers on USB sticks.

During my IT work I tried so many tools which should create bootable Linux but always there was something wrong with this or that. I tried Unetbootin, ISO2USB and others.

Today I found working tool which is called LiLi - Linux Live USB Creator. You can download it here http://www.linuxliveusb.com

I tried it with ESXi 5.1 and 4.1, Ubuntu and CentOS - in all cases installation was clean and smooth. Process of creating bootable USB was very fast and it works like a charm.

Why I even started to look for new tool? I was following VMware documentation but of course there was “small” problem. When I tried to boot it I got error related to wrong version of syslinux installed on the box I was preparing my USB (mboot.c32: not a COM32R image).

Long story short - this tool is very handy and it worked.

I recommend to use it for VMware ESXi 5.1 USB install.

Zarzadzanie hasłami w środowisku korporacyjnym

Tue, 29 May 2012 09:49:16 +0000

W dobie wszechobecnych problemów z bezpieczeństwem sami wiecie, że długie i złożone hasła są bardzo ważne.

W dzisiejszym wpisie chciałbym przedstawić Wam komercyjne rozwiązanie jakim jest produkt firmy Thycotic Secret Server.

Jak to działa?

Secret Server zainstalować można zainstalować na następujących systemach operacyjnych:

Windows Server 2003
Windows Server 2003 R2
Windows XP
Windows Server 2008 32 i 64 bitowe
Windows Server 2008 R2
Windows Vista Business / Ultimate
Windows 7 Professional / Ultimate

Do działania wykorzystywana jest baza sql oraz IIS instalowany w systemie operacyjnym. Wszystkie dane są szyfrowane algorytmem AES 256 i haszowane SHA512 - produkt spełnia również normy FIPS 140-2.

Demo

Krótkie demo produktu zobaczyć można pod tym adresem http://www.thycotic.com/secretserver_movie.html.

Czy jest to produkt dla mnie?

Produkt ten nie jest dla “zwykłego śmiertelnika” - zdecydowanie jest przeznaczony dla większych firm i korporacji. W dużych firmach gdzie administratorzy zarządzają dużą ilością serwerów dosyć często pojawia się problem haseł.

kto zna hasło do danego systemu?
kiedy ostatnio hasło było zmieniane?
złożoność hasła
znajomość haseł przez osoby niepowołane

Są to oczywiście jedynie wybrane przeze mnie zagrożenia jednak według mnie jedne z ważniejszych.

Dlaczego wybrałbym Secret Server?

Przede wszystkim polecam zapoznanie się z licencjonowaniem i zalecam wybranie edycji od wersji Professional. Wersja ta posiada integrację z Active Directory co w środowisku korporacyjnym jest niezwykle ważne (integracja z Active Directory pozwala pozbyć się lokalnych użytkowników). Bardzo ciekawie prezentuje się zarządzanie dostępem do haseł - możemy tworzyć foldery, dodawać role użytkowników do konkretnych folderów.

Kolejną z ciekawych funkcji jest możliwość uruchamiania konsoli SSH (np. PuTTY) czy RDP bezpośrednio do danego systemu z oprogramowania. Bardzo podoba mi się możliwość wymuszenia automatycznej zmiany haseł do systemów (urządzenie / system powinien mieć dostęp przez telnet lub ssh) oraz możliwość tworzenia skryptów.

Wspierane systemy do automatycznej zmiany haseł to:

Windows Local admin
Active Directory
UNIX/Linux/Mac (incl. root)
MS SQL Server
Oracle
Sybase
MySQL
VMware ESX
DSEE
Cisco
Juniper
Enterasys
WatchGuard
Check Point
Dell DRAC
HP iLO
OpenLDAP
SSH / Telnet

Przykładowa zmiana hasła na urządzeniu Cisco http://support.thycotic.com/KB/a251/heartbeat-and-remote-password-changing-for-cisco-accounts.aspx?KBSearchID=22719.

Produkt posiada również wiele innych funkcji, których nie będę wymieniał - link do wszystkich funkcji http://www.thycotic.com/products_secretserver_featurelist.html

Zachęcam Was do testów programu (bądź innych programów tego typu) gdyż może on rozwiązać wiele problemów przy niewielkim nakładzie kosztów.

Import certyfikatów SSL w Linuxie i Windowsie

Sun, 22 Apr 2012 22:10:40 +0000

Dzisiejszy wpis będzie o imporcie niezaufanych (wygenerowanych samodzielnie) certyfikatów SSL do Windowsa 7 i Ubuntu. Są to obecnie dwa najbardziej popularne systemy.

Certyfikaty SSL służą do szyfrowania danych przesyłanych pomiędzy użytkownikiem a serwerem w sieci Internet. Nie będę wnikał i opisywał co to jest certyfikat SSL a po więcej informacji zapraszam tutaj http://ssl.certum.pl/. Codziennie odwiedzamy wiele stron zabezpieczone certyfikatami SSL i jak sami wiecie część z nich posiada certyfikaty wygenerowane samodzielnie. Jak można rozpoznać takie certyfikaty?

Bardzo prosto 🙂

Chrome
Firefox
Internet Explorer

Jak sami widzicie nie jest trudno rozpoznać certyfikaty nie podpisane przez zaufane centrum autoryzujące.

Podobnie wygląda to w Ubuntu.

Jest to według mnie dobra praktyka producentów przeglądarek aby ostrzegać ZU (zwykłego użytkownika) o potencjalnym zagrożeniu. Co jednak jeżeli na 100% wiemy, że strona jest bezpieczna a ostrzeżenia o certyfikatach tylko nas denerwują?

Pokażę filmik jak zrobić to w Windows 7.

W Ubuntu / Linuxie zrobimy to inaczej. Nie będzie filmiku lecz odpowiednie komendy. Wszystkie polecenie wykonujemy oczywiście z poziomu su.

openssl s_client -connect STRONA_ZABEZPIECZONA_SSL:443 |tee STRONA_ZABEZPIECZONA
openssl x509 -inform PEM -in STRONA_ZABEZPIECZONA -text -out STRONA_ZABEZPIECZONA.pem
cp STRONA_ZABEZPIECZONA.**pem **/usr/share/ca-certificates/STRONA_ZABEZPIECZONA.crt
vi /etc/ca-certificates.conf gdzie dodajemy STRONA_ZABEZPIECZONA.crt
c_rehash
update-ca-certificates

Po wykonaniu wszystkich komend (gdzie oczywiście w miejscie STRONA_ZABEZPIECZONA_SSL należy podać adres IP albo nazwę dns strony) certyfikat powinien być dodany do systemu. Do wykonania komend w systemie potrzebna jest biblioteka openssl.

Jako działający przykład pokażę stronę z torrentami korzystającą z własnego certyfikatu SSL.

Prosty błąd w ustawieniach wordpressa i proste rozwiązanie

Sun, 20 Jun 2010 13:27:10 +0000

Jak sami pewnie wiecie bardzo duża ilość błędów spowodowana jest najczęściej przez nas samych.

Otóż dokładnie i u mnie wystąpił ten problem. Niedawno bo bodajże w maju zmieniałem coś w ustawieniach mojej strony i od tamtej pory nie mogłem dodawać nowych zdjęć do stron. Problem obszedłem jak to się mówi “na kolanko” poprzez wstawienie odnośnika z imageshack.

Dzisiaj jednak postanowiłem, że rozprawię się z problemem.

Objaw: Nie można dodawać zdjęć do wordpressa i błąd

1
2
3

Warning: is_dir() [function.is-dir]: open_basedir restriction in effect. File(/) is not within the allowed path(s): (/home/wojciehz:/usr/lib/php:/usr/php4/lib/php:/usr/local/lib/php:/usr/local/php4/lib/php:/tmp) in /home/wojciehz/public_html/marusiak/wp-includes/functions.php on line 2037

Warning: file_exists() [function.file-exists]: open_basedir restriction in effect. File(/) is not within the allowed path(s): (/home/wojciehz:/usr/lib/php:/usr/php4/lib/php:/usr/local/lib/php:/usr/local/php4/lib/php:/tmp) in /home/wojciehz/public_html/marusiak/wp-includes/functions.php on line 2028

Przyczyna i rozwiązanie: problemem było zastosowanie złej ścieżki w ustawieniach wordpressa UstawieniaMediaPrzechowuj wysłane pliki w katalogu (na przykład //images/uploads/) . Ścieżka do plików powinna wyglądać w następującej postaci: /images/uploads.

Przyczyna problemu może i błacha ale bardzo ciężko znaleźć rozwiązanie bo według różni ludzie wskazują różne przyczyny.

System nie wykrywa poprawnie pendrive – rozwiązanie problemu

Sun, 13 Jun 2010 15:52:57 +0000

W dniu dzisiejszym dostałem od kolegi na pendrive materiały do nauki. Nie byłoby w tym wydarzeniu nic szczególnego poza jednym małym faktem. Otóż kolega używa systemu firmy Apple Mac OS X i musiał sformatować mojego pendriva, który miał format plików NTFS do FAT.

Po szybkim formacie już w domu gdy przyszedłem po całkiem pracowitej niedzieli okazało się, że system nie rozpoznaje pendrive. Byłem bardzo zdziwiony bo takich problemów nie powinno być. Nie dbając zbytnio o materiały na pendrive chciałem go sformatować ale pojawił się pewien problem. Otóż podawany rozmiar przez Windowsa to 200MB co jest nieprawdą bo pendrive ma 16GB.

Na pierwszy rzut poszedł Windowsowy manager dysków - tutaj pierwsza porażka. Kolejnym krokiem była próba użycia diskpart. Niestety diskpart również nie poradził sobie z usunięciem partycji na pendrive. Mając na czarną godzinę zachowany obraz Ubuntu wrzuciłem go szybko na maszyne wirtualną i próbowałem naprawić błąd. Co prawda przy użyciu gparted udało mi się usunąć partycje jednak każda próba utworzenia nowej nie udawała się.

Byłem już trochę wkurzony bo przecież nie robiłem z pendrivem jakichś dziwnych czynności. Ale na szczęście udało się znaleźć rozwiązanie.

Rozwiązaniem problemu okazał się program HP USB Disk Storage Format Tool do ściągniecią możliwy np stąd.

Program jest bardzo prosty jednakże w 100% rozwiązuje problem.

Program ten bez żadnych ceregieli naprawił partycje na pendrive i dzięki temu dalej mogę się cieszyć swoim sprzętem.

WP-Gravatar hosting killer

Tue, 18 Mar 2008 07:18:06 +0000

Wczoraj około godziny 22, po całym dniu pracy, odbyciu spowiedzi Św, zjedzeniu obiadu (co prawda o 19 ale zawsze to obiad 😀 ) przeczytałem artykuł na www.webhosting.pl o dopieszczaniu bloga. Spodobała mi się wtyczka WP-Gravatar więc dużo się nie namyślając założyłem konto na www.mybloglog.com. Po założeniu konta jak Pan Bóg przykazał zainstalowałem plugin do wordpressa, aktywowałem go, dodałem widget i czekałem na efekty. Efekty szczerze powiedziawszy zaskoczyły nie tylko mnie ale i obsługę hosting http://o12.pl ponieważ dodany plugin spowodował nadmierne przeciążenie maszyny hostującej moją stronę. Oto zrzut ekranu przedstawiający komunikację z BOK

Jak już wcześniej pisałem na blogu www.topblogger.pl warto potestować coś na wirtualnej maszynie, tak aby później nie mieć podobnych przygód jak ja. Szkoda, że nie posiadam swojej maszyny na linuxie i stałego IP( może już niedługo TP DSL będzie na nowym mieszkaniu :> ?) bo mógłbym mieć swój własny hosting i mógłbym psuć wszystko do woli 😉

Moj pierwszy blog

Tue, 05 Dec 2006 20:00:27 +0000

Tak tak, w końcu i na mnie nadszedł czas 🙂 Mam swojego bloga