Windows 7 & Arch Linux U盘安装二合一

距离上次发文也一年多了, 真是时光飞逝. 这一年工作接触了很多也做了很多, 不过其实学得越多越发现自己是小白, 也不好意思写文章误导大众了><, 分享一些小经验吧.

话说最近转战Arch Linux, 不过U盘已经放了个Windows 7, 就想弄个双启动. 双启动就得给U盘重新装个引导呗, 不过折腾了半天syslinux没搞定, 启动时卡在那黑屏, 也没啥报错信息. 还是上GRUB吧. 以下是在U盘上安装GRUB并配置双启动的方法.

U盘的目录结构

由于我的U盘之前做成了Windows 7的安装盘, 所以弄成了如下的文件结构. 直接引导Windows 7的ISO谁有兴趣的话也可以尝试下.

  • Windows 7: 直接解压镜像至U盘根目录.
  • Arch Linux: 直接把ISO放于U盘/boot/isos/下.

GRUB的安装

在Ubuntu下直接用grub-install即可, 其它系统可查阅相关文档.

grub-install --boot-directory=/mnt/usb/boot /dev/sdb


其中/dev/sdb是U盘设备, 假设U盘被挂载到/mnt/usb目录下.

GRUB的配置

以下是grub.cfg, 在U盘的/boot/grub/下, 注意不要和你硬盘的/boot搞混了!

set timeout=10
set default=0

menuentry "Arch" {
 set isofile="/boot/isos/archlinux-2013.09.01-dual.iso"
 loopback loop /$isofile
 linux (loop)/arch/boot/x86_64/vmlinuz archisolabel=ARCH_201309 img_dev=/dev/disk/by-label/GSP1RMCULXF img_loop=$isofile earlymodules=loop
 initrd (loop)/arch/boot/x86_64/archiso.img
}

menuentry "Windows 7" {
 insmod part_msdos
 insmod ntfs
 insmod ntldr
 ntldr /bootmgr
}

其中Arch的引导需要指定下镜像文件所在设备的路径img_dev, 我这边是根据U盘的Label(img_dev=/dev/disk/by-label/GSP1RMCULXF)找的, 不知道有没有更好的办法.

至此从U盘启动的时候就会出现启动菜单, 当然也可以类似地加入Ubuntu等, 不过要注意的是其它发行版和Arch的ISO目录结构可能不太一样, 需要查阅下相关文档看怎么配置引导.

完结撒花><!


2014.04.16 Update

贴一个Ubuntu的配置:

menuentry "Ubuntu 13.10 Desktop amd64" {
 set isofile="/boot/isos/ubuntu-13.10-desktop-amd64.iso"
 loopback loop /$isofile
 linux (loop)/casper/vmlinuz.efi boot=casper img_dev=/dev/disk/by-label/GSP1RMCULXF iso-scan/filename=$isofile noprompt noeject
 initrd (loop)/casper/initrd.lz
}
Advertisements

Cisco IPSec VPN For Debian

最近倒腾了下OpenVPN, 发现虽然用起来比SSH速度快点但拨上去实在是太慢. 看到推上的巨巨们都在上Cisco IPSec, 索性决定也自己上一个. 倒腾了下发现配置也不是很复杂, 网上也有巨巨们十分详细的配置步骤, 只是自己在配的过程中也发现有几个地方需要特别注意下, 在此流水帐下吧.

服务端


racoon

服务端配置主要是racoon, 配置文件参考了这篇文章这篇文章, 在此非常感谢. 另外这篇关于如何兼容黑莓的文章讲得也非常清楚, 再次一并推荐下.

既然是Debian安装当然是apt-get:

apt-get install racoon

然后是几个配置文件:

# /etc/racoon/racoon.conf

path pre_shared_key “/etc/racoon/psk.txt”;
path certificate “/etc/racoon/certs”;

listen {
    isakmp SERVER.IP.ADDRESS [500];
    isakmp_natt SERVER.IP.ADDRESS [4500];
}
 
remote anonymous {
    exchange_mode aggressive, main, base;
    mode_cfg on;
    proposal_check obey;
    nat_traversal on;
    generate_policy unique;
    ike_frag on;
    passive on;
    dpd_delay 30;
     
    proposal {
        lifetime time 28800 sec;
        encryption_algorithm 3des;
        hash_algorithm md5;
        authentication_method xauth_psk_server;
        dh_group 2;
    }
}
 
sainfo anonymous {
    encryption_algorithm aes, 3des, blowfish;
    authentication_algorithm hmac_sha1, hmac_md5;
    compression_algorithm deflate;
}
 
mode_cfg {
    auth_source system;
    dns4 8.8.8.8;
    banner “/etc/racoon/motd”;
    save_passwd on;
    network4 10.12.0.100;
    netmask4 255.255.255.0;
    pool_size 100;
    pfs_group 2;
}

# /etc/racoon/psk.txt

# Group Name Group Secret
GROUP.NAME GROUP.SECRET

设置好psk.txt的权限:

chmod 600 /etc/racoon/psk.txt

# /etc/racoon/motd

# Banner
Welcome to Cisco IPSec!

Account

用户验证用的是系统的用户系统, 简单的新建一个用户即可, 为了安全性shell可设为/bin/false.

useradd -MN -b /tmp -s /bin/false USER
passwd USER

iptables

添加以下规则以开放相应端口和NAT转发.

iptables -A INPUT -p udp -–dport 500 -j ACCEPT
iptables -A INPUT -p udp –dport 4500 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.12.0.0/24 -o eth0 -j MASQUERADE
iptables -A FORWARD -s 10.12.0.0/24 -j ACCEPT

重启服务器后以上规则将失效, 持久化参见这篇文章.

ipv4 forward

# /etc/sysctl.conf

net.ipv4.ip_forward=1

修改后使用如下命令使之生效:

sysctl -p /etc/sysctl.conf

客户端


Linux

Linux可以使用vpnc作为客户端, 配置文件如下:

# /etc/vpnc/default.conf

IPSec gateway SERVER.DOMAIN/IP
IPSec ID GROUP.NAME
IPSec secret GROUP.SECRET
IKE Authmode psk
Xauth username USER.NAME
Xauth password USER.PASSWORD
NAT Traversal Mode cisco-udp

之后可以使用vpnc-connect/vpnc-disconnect连接和断开VPN.

Cisco IPSec VPN for Debian

Unsatisfied with OpenVPN’s low speed to connect, I tried to setup a Cisco IPSec VPN recently. Its awesome speed proves to be a right choice. Here are brief steps on Debian.

Server

racoon

raccon is an Internet Key Exchange (IKE) daemon for automatically keying IPsec connections. We’ll use this tool to establish our IPSec connection.

Since we are on Debian, we can simply use apt-get to install it:

apt-get install racoon 

And set its configuration files as follows:

racoon.conf

# /etc/racoon/racoon.conf

path pre_shared_key “/etc/racoon/psk.txt”;
path certificate “/etc/racoon/certs”;

listen {
    isakmp SERVER.IP.ADDRESS [500];
    isakmp_natt SERVER.IP.ADDRESS [4500];
}

remote anonymous {
    exchange_mode aggressive, main, base;
    mode_cfg on;
    proposal_check obey;
    nat_traversal on;
    generate_policy unique;
    ike_frag on;
    passive on;
    dpd_delay 30;

    proposal {
        lifetime time 28800 sec;
        encryption_algorithm 3des;
        hash_algorithm md5;
        authentication_method xauth_psk_server;
        dh_group 2;
    }
}

sainfo anonymous {
    encryption_algorithm aes, 3des, blowfish;
    authentication_algorithm hmac_sha1, hmac_md5;
    compression_algorithm deflate;
}

mode_cfg {
    auth_source system;
    dns4 8.8.8.8;
    banner “/etc/racoon/motd”;
    save_passwd on;
    network4 10.12.0.100;
    netmask4 255.255.255.0;
    pool_size 100;
    pfs_group 2;
}

psk.txt

Pre-shared key:

# /etc/racoon/psk.txt

# Group Name Group Secret
GROUP.NAME GROUP.SECRET

And set its permissions to 600:

chmod 600 /etc/racoon/psk.txt

motd

Banner:

# /etc/racoon/motd

# Banner
Welcome to Cisco IPSec!

Accounts

To make it simple, we use system’s account system to validate our users:

useradd -MN -b /tmp -s /bin/false USER
passwd USER

iptables

Add the following rules to open relative ports and enable NAT.

iptables -A INPUT -p udp -–dport 500 -j ACCEPT
iptables -A INPUT -p udp –dport 4500 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.12.0.0/24 -o eth0 -j MASQUERADE
iptables -A FORWARD -s 10.12.0.0/24 -j ACCEPT

These rules may be lost after reboot. Consult this article to avoid this.

ipv4 forward

# /etc/sysctl.conf

net.ipv4.ip_forward=1

Run this command to enable this change:

sysctl -p /etc/sysctl.conf

Client

Linux

We can use vpnc as a client on Linux. Here is an example of its config:

# /etc/vpnc/default.conf

IPSec gateway SERVER.DOMAIN/IP
IPSec ID GROUP.NAME
IPSec secret GROUP.SECRET
IKE Authmode psk
Xauth username USER.NAME
Xauth password USER.PASSWORD
NAT Traversal Mode cisco-udp

Now we can connect or disconnect to the server using vpnc-connect or vpnc-disconnect.

Reference

Thanks to these articles for great help:


PyPuzzle

前一阵子贴吧洪水泛滥, 写了个Bot过滤关键词删贴. 后来发现广告贴有改贴图的趋势, 这个过滤有压力啊. 想了想读图这种高难度还是不考虑了, 建个图片索引库然后比较相似度好了. 搜了下有现成的库libpuzzle, 不过是个C库, 而Bot是Python写的, 那就顺便包装个Extension吧, 也顺便学写下Python的C扩展, 于是就有了这个PyPuzzle. 参考了PycURL, 拿来当模板还是很不错的.

项目主页: https://github.com/ArchangelSDY/PyPuzzle

结果写完广告贴就销声匿迹了, 囧.

Tips for Crontab

  1. Add “2>&1 >> cron.log” to redirect stderr and log output. “>>” means appending while “>” means overwriting.
  2. Check the “+x” mode of the script.
  3. Check the relative path in both the script and the cron config. Cron may run in a different directory.
  4. Check the encoding of the script. Cron may run in an environment different from bash.
  5. Check the privileges related with the files used in the script.