Timmy Tin - ycTIN

Mounting a Cloud Storage Buckets as a File System on CentOS 7 Compute Engine Instances

November 20, 2016November 20, 2016 Timmy Tin Leave a comment

Problem:

I need to mount a Google Cloud Storage Buckets to file system, and grant access to the web server.

Solution:

Use the Google Cloud Storage FUSE (gcsfuse) tool to mount a Cloud Storage bucket to your Compute Engine instance.

Steps:

Assumption:

I have a bucket named yctin-bucket
I want to mount this bucket to /cloud/yctin-bucket/
I was generated the Google Service Key, and stored into /src/gcloud_service_account.json

Mounting a bucket

# create the directory
mkdir -p /cloud/yctin-bucket/

# mount the bucket with 777 permission
gcsfuse --key-file=/src/gcloud_service_account.json -o allow_other --dir-mode 777 --file-mode 777  yctin-bucket  /cloud/yctin-bucket/

# create the directory

mkdir -p /cloud/yctin-bucket/

# mount the bucket with 777 permission

gcsfuse --key-file=/src/gcloud_service_account.json -o allow_other --dir-mode 777 --file-mode 777 yctin-bucket /cloud/yctin-bucket/

To unmount the bucket

umount /cloud/yctin-bucket/

1	umount /cloud/yctin-bucket/

References:

https://cloud.google.com/compute/docs/disks/gcs-buckets
http://stackoverflow.com/questions/34779921/gcsfuse-gives-a-input-output-error-when-reading-or-writing-to-mounted-directory

Install & Setup Google Cloud SDK (gcloud command) on RHEL / CentOS 7

November 20, 2016November 20, 2016 Timmy Tin Leave a comment

Problem:

bash: gcloud: command not found

Solution:

Install & Setup Google Cloud SDK

Steps:

1. Installing SDK

sudo tee -a /etc/yum.repos.d/google-cloud-sdk.repo << EOM
[google-cloud-sdk]
name=Google Cloud SDK
baseurl=https://packages.cloud.google.com/yum/repos/cloud-sdk-el7-x86_64
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg
       https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
EOM
yum install google-cloud-sdk -y

sudo tee -a /etc/yum.repos.d/google-cloud-sdk.repo << EOM

[google-cloud-sdk]

name=Google Cloud SDK

baseurl=https://packages.cloud.google.com/yum/repos/cloud-sdk-el7-x86_64

enabled=1

gpgcheck=1

repo_gpgcheck=1

gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg

https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg

EOM

yum install google-cloud-sdk -y

Reference: https://cloud.google.com/sdk/downloads

2. Initializing Cloud SDK

gcloud init --console-only

1	gcloud init --console-only

Reference: https://cloud.google.com/sdk/docs/initializing

3. Authorizing Cloud SDK Tools

gcloud auth activate-service-account --key-file [KEY_FILE]

1	gcloud auth activate-service-account --key-file [KEY_FILE]

Reference: https://cloud.google.com/sdk/docs/authorizing

Generating an SSH Key Pair on Linux and Mac

November 2, 2016November 20, 2016 Timmy Tin Leave a comment

Short Version

ssh-keygen -t rsa

1	ssh-keygen -t rsa

Increased Security

ssh-keygen -b 4096 -t rsa

1	ssh-keygen -b 4096 -t rsa

My Favorite

ssh-keygen -b 4096 -t rsa -f <EMAIL ADDRESS> -C <EMAIL ADDRESS>

1	ssh-keygen -b 4096 -t rsa -f <EMAIL ADDRESS> -C <EMAIL ADDRESS>

How to Install MySQL 5.7 on RHEL/CentOS 7

October 22, 2016January 23, 2017 Timmy Tin Leave a comment

Basic Server Setup

# update system
sudo yum install epel-release -y
sudo yum update -y

# update system

sudo yum install epel-release -y

sudo yum update -y

# temporary switches off SELinux enforcing 
sudo setenforce 0

1 2	# temporary switches off SELinux enforcing sudo setenforce 0

# setup timezone
sudo rm /etc/localtime
sudo ln -s /usr/share/zoneinfo/Hongkong /etc/localtime

# setup ntp service
sudo yum -y install ntp
sudo ntpdate pool.ntp.org
sudo systemctl enable ntpd
sudo systemctl start ntpd

# setup timezone

sudo rm /etc/localtime

sudo ln -s /usr/share/zoneinfo/Hongkong /etc/localtime

# setup ntp service

sudo yum -y install ntp

sudo ntpdate pool.ntp.org

sudo systemctl enable ntpd

sudo systemctl start ntpd

Setup MySQL 5.7

# adding the MySQL Yum Repository
sudo rpm -Uvh http://dev.mysql.com/get/mysql57-community-release-el7-9.noarch.rpm

# setup mysql server
sudo yum install mysql-server -y
sudo systemctl enable mysqld
sudo systemctl start mysqld

# adding the MySQL Yum Repository

sudo rpm -Uvh http://dev.mysql.com/get/mysql57-community-release-el7-9.noarch.rpm

# setup mysql server

sudo yum install mysql-server -y

sudo systemctl enable mysqld

sudo systemctl start mysqld

# get temporary root password
sudo cat /var/log/mysqld.log | grep "temporary password"
# 2016-10-22T06:14:44.222048Z 1 [Note] A temporary password is 
# generated for root@localhost: [TEMPORARY ROOT PASSWORD]

# config mysql server
mysql_secure_installation

# Securing the MySQL server deployment.
# Enter password for user root: [TEMPORARY ROOT PASSWORD]
# The existing password for the user account root has expired. Please set a new password.
# New password: [NEW PASSWORD]
# Re-enter new password: [NEW PASSWORD]
# Change the password for root ? : N
# Remove anonymous users? : Y
# Disallow root login remotely? : Y
# Remove test database and access to it? : Y
# Reload privilege tables now? : Y

# get temporary root password

sudo cat /var/log/mysqld.log | grep "temporary password"

# 2016-10-22T06:14:44.222048Z 1 [Note] A temporary password is

# generated for root@localhost: [TEMPORARY ROOT PASSWORD]

# config mysql server

mysql_secure_installation

# Securing the MySQL server deployment.

# Enter password for user root: [TEMPORARY ROOT PASSWORD]

# The existing password for the user account root has expired. Please set a new password.

# New password: [NEW PASSWORD]

# Re-enter new password: [NEW PASSWORD]

# Change the password for root ? : N

# Remove anonymous users? : Y

# Disallow root login remotely? : Y

# Remove test database and access to it? : Y

# Reload privilege tables now? : Y

Setup Firewall (Optional)

# setup firewall
sudo yum install firewalld -y
sudo systemctl enable firewalld
sudo systemctl start firewalld
sudo firewall-cmd --add-service=mysql --permanent

# setup firewall

sudo yum install firewalld -y

sudo systemctl enable firewalld

sudo systemctl start firewalld

sudo firewall-cmd --add-service=mysql --permanent

Reboot after Setup

reboot

reboot

Optional Settings for MySQL 5.7

Disable MySQL Strict Mode

# disable MySQL strict mode
vi /etc/my.cnf
sql-mode=
sudo systemctl restart mysqld

# disable MySQL strict mode

vi /etc/my.cnf

sql-mode=

sudo systemctl restart mysqld

Reference: https://dev.mysql.com/doc/refman/5.7/en/sql-mode.html

Fix MySQL Password Expired

To establish a global policy such that passwords never expire.

Update /etc/my.cnf

[mysqld]
default_password_lifetime=0

1 2	[mysqld] default_password_lifetime=0

Reference: https://dev.mysql.com/doc/refman/5.7/en/password-expiration-policy.html

Convert .cer to .crt certificates for Apache/mod_ssl using OpenSSL

August 16, 2016June 24, 2018 Timmy Tin Leave a comment

Assume you have a CER is an DER encoded X.509 certificate in binary form, and you want to have a PEM-encoded X.509 Certificate file for Apache.

The following command may help:

openssl x509 -inform DER -in certfile.cer -out certfile.crt

1	openssl x509 -inform DER -in certfile.cer -out certfile.crt

Apache/mod_ssl request PEM-encoded X.509 Certificate file

Reference: http://www.modssl.org/docs/2.8/ssl_reference.html#ToC10

SSLCertificateFile

Name: SSLCertificateFile
Description: Server PEM-encoded X.509 Certificate file
Syntax: SSLCertificateFile filename
Default: None
Context: server config, virtual host
Override: Not applicable
Status: Extension
Module: mod_ssl
Compatibility: mod_ssl 2.0
This directive points to the PEM-encoded Certificate file for the server and optionally also to the corresponding RSA or DSA Private Key file for it (contained in the same file). If the contained Private Key is encrypted the Pass Phrase dialog is forced at startup time. This directive can be used up to two times (referencing different filenames) when both a RSA and a DSA based server certificate is used in parallel.

Example:
SSLCertificateFile /usr/local/apache/conf/ssl.crt/server.crt

SSLCertificateFile

Name: SSLCertificateFile

Description: Server PEM-encoded X.509 Certificate file

Syntax: SSLCertificateFile filename

Default: None

Context: server config, virtual host

Override: Not applicable

Status: Extension

Module: mod_ssl

Compatibility: mod_ssl 2.0

This directive points to the PEM-encoded Certificate file for the server and optionally also to the corresponding RSA or DSA Private Key file for it (contained in the same file). If the contained Private Key is encrypted the Pass Phrase dialog is forced at startup time. This directive can be used up to two times (referencing different filenames) when both a RSA and a DSA based server certificate is used in parallel.

Example:

SSLCertificateFile /usr/local/apache/conf/ssl.crt/server.crt