• How to setup L2TP over IPSec VPN server (Ubuntu 16.04 – 20.04)

    , , , , ,
    kayama

    How to setup L2TP over IPSec VPN server (Ubuntu 16.04)

    1
    apt-get install strongswan xl2tpd

    # (optional, need to check ) apt-get install ppp libgmp3-dev bison flex

    Edit /etc/ipsec.conf

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    # /etc/ipsec.conf — Openswan IPsec configuration file modified for Strongswan
    # (c) Kayama 2018
    # Add connections here
     
    conn L2TP-IPSEC
        authby=secret
        rekey=no
        keyingtries=3
        type=transport
        esp=aes128-sha1
        ike=aes128-sha-modp1024
        ikelifetime=8h
        keylife=1h
        left=XXX.XXX.XXX.XXX # your router’s external IP 
        leftprotoport=17/1701
        right=%any
        rightprotoport=17/%any
        rightsubnet=0.0.0.0/0
        auto=add
        dpddelay=30
        dpdtimeout=120
        dpdaction=clear
        #force all to be nat’ed. because of iOS
        forceencaps=yes

    Edit /etc/ipsec.secrets

    1
    2
    3
    4
    5
    # This file holds shared secrets or RSA private keys for authentication.
    # RSA private key for this host, authenticating it to any other host
    # which knows the public part.
     
    : PSK “TypeYourPassPhraseHere”

    Edit /etc/ppp/options.xl2tpd

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    require-mschap-v2
    refuse-mschap
    ms-dns 8.8.8.8
    ms-dns 8.8.4.4
    asyncmap 0
    auth
    crtscts
    idle 1800
    mtu 1410
    mru 1410
    connect-delay 5000
    lock
    hide-password
    local
    #debug
    modem
    name l2tpd
    proxyarp
    lcp-echo-interval 30
    lcp-echo-failure 4

    Edit /etc/xl2tpd/xl2tpd.conf

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    [global]
    ipsec saref = no
    debug tunnel = no
    debug avp = no
    debug network = no
    debug state = no
    access control = no
    rand source = dev
    port = 1701
    auth file = /etc/ppp/chap-secrets
     
    [lns default]
    ip range = 192.168.1.10-192.168.1.20
    local ip = 192.168.1.1
    require authentication = yes
    name = l2tp
    pass peer = yes
    ppp debug = no
    length bit = yes
    refuse pap = yes
    refuse chap = yes
    pppoptfile = /etc/ppp/options.xl2tpd

    And finally add password to the /etc/ppp/chap-secrets file

    1
    2
    3
    4
    test    l2tpd     TestTest      “*”
     
    service xl2tpd restart
    service ipsec restart

    Everything should work fine!

    Upd. 2022.01

  • lxd and adjusting size of root device

    , , ,
    kayama

    That’s normal. With LXD 2.9 and the storage pool changes, LXD stopped generating automatic «root» devices for the containers, instead relying on inheritance from the default profile.

    So in LXD < 2.9, every container had a local «root» device which you could then set properties directly on. With those LXD versions, adding a «root» device to your default profile would be entirely ignored as all containers would override it.

    In LXD > 2.9, containers don’t have any devices by default, they instead rely on inheritance. Meaning that if you want to override it, you have to add a new device to the container with the same name so that it overrides the one coming from the profiles.

    «lxc config show NAME» vs ” lxc config show –expanded NAME ” is pretty useful to see how this all works.

    © https://discuss.linuxcontainers.org/u/stgraber

  • macOs / Linux ssh autocomplete hint

    , , ,
    kayama

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    _complete_ssh_hosts ()
    {
            COMPREPLY=()
            cur=”${COMP_WORDS[COMP_CWORD]}”
            comp_ssh_hosts=`cat ~/.ssh/known_hosts | \
                            cut -f 1 -d ‘ ‘ | \
                            sed -e s/,.*//g | \
                            grep -v ^# | \
                            uniq | \
                            grep -v “\[” ;
                    cat ~/.ssh/config | \
                            grep “^Host ” | \
                            awk ‘{print $2}’
                    `
            COMPREPLY=( $(compgen -W “${comp_ssh_hosts}” — $cur))
            return 0
    }
     
    complete -F _complete_ssh_hosts ssh

  • ubuntu git install and tips

    , ,
    kayama

    # update packages

    1
    sudo apt-get update

    # install gitolite server

    1
    sudo apt-get install gitolite3

    # rename (not necessary) user gitolite3 to git

    1
    sudo usermod gitolite3 –login git

    # clone git admin dir to your home account

    1
    2
    cd ~
    git clone git@172.16.0.100:gitolite-admin

    # make changes in gitolite.conf — add new repo

    1
    2
    3
    “`repo web-app
     
        RW+     =   admin“`

    # show status

    1
    git status

    # add files to repo

    1
    git add -A .

    # commit your changes

    1
    git commit -m ‘Added new repo’

    # for use simple git push

    1
    git config –global push.default simple

    # push changes to repo

    1
    git push

    All done, your repo is ready.

    Now go to dir with your app.

    1
    cd ~/web-app/

    # initialize dir for git

    1
    git init

    # add url of «remote» repo

    1
    git remote add origin ssh://git@192.168.56.100:8822/web-app

    # check it

    1
    git remote -v

    # commit and push your repo

    1
    2
    3
    4
    5
    6
    7
    git status
     
    git add -A .
     
    git commit -m ‘Initial commit’
     
    git push –set-upstream origin master

    # clone repo on desktop

    1
    git clone ssh://git@192.168.56.100:8822/web-app

  • chroot ssh linux user

    , ,
    kayama

    /etc/ssh/sshd_config:

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    #Subsystem sftp /usr/lib/openssh/sftp-server
     
    Subsystem sftp internal-sftp
     
    Match group chrooted
     
        ChrootDirectory /www/sites
     
        X11Forwarding no
     
        AllowTcpForwarding no
     
        ForceCommand internal-sftp

    /etc/passwd:

    1
    testuser:x:1002:1002::/www/sites/testuser:/usr/lib/sftp-server