centos6.5中erlang R16B以上系统运行crypto:start()时提示crypto.so: undefined symbol: EC_GROUP_new_curve_GF2m是因为最新的libssl库去除了对一些过时算法的支持，如果程序用不到，编译前注释掉otp_src_R16B0x/lib/crypto/c_src/crypto.c第81行//# define HAVE_EC即可
centos 6.5中erlang R16B+的crypto运行问题
发表评论
分类目录归档：Linux
也谈switch…case中的变量申明
有如下程序：
switch(exp) {
case 0:
int i ;
…
break;
case 1:
…
case 2:
…
default:
…
}
编译时出错，标签后面不可以直接跟变量申明，可以这样写：
switch(exp) {
case 0:
{
int i ;
…
break;
}
case 1:
…
case 2:
…
default:
…
}
也可以这么写
switch(exp) {
int i ;
case 0:
…
break;
case 1:
…
case 2:
…
default:
…
}
还可以放到switch外面申明
int i ;
switch(exp) {
case 0:
…
break;
case 1:
…
case 2:
…
default:
…
}
在申明前写个多余的分号也行
switch(exp) {
case 0:
;
int i ;
…
break;
case 1:
…
case 2:
…
default:
…
}
linux做路由器下用iptables封qq
iptables -A FORWARD -p tcp –dport 8000 -j DROP
iptables -A FORWARD -p udp –dport 8000 -j DROP
iptables -A FORWARD -d tcpconn.tencent.com -j DROP
iptables -A FORWARD -d tcpconn4.tencent.com -j DROP
iptables -A FORWARD -d 218.17.209.23 -j DROP
iptables -A FORWARD -d tcpconn6.tencent.com -j DROP
iptables -A FORWARD -d tcpconn5.tencent.com -j DROP
iptables -A FORWARD -d tcpconn2.tencent.com -j DROP
iptables -A FORWARD -d tcpconn3.tencent.com -j DROP
iptables -A FORWARD -d http.tencent.com -j DROP
iptables -A FORWARD -d 218.17.209.42 -j DROP
iptables -A FORWARD -d http.tencent.com -j DROP
iptables -A FORWARD -d 218.17.209.42 -j DROP
iptables 实例杂锦
#/sbin/modprobe iptable_filter
#/sbin/modprobe ip_tables
#/sbin/modprobe iptable_nat
#/sbin/iptables -F -t nat
adsl拨号的转发
/sbin/iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -o ppp0 -j MASQUERADE
网卡转发
/sbin/iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -o eth0 -j MASQUERADE
封堵 tcp udp 端口, 并打开特定的端口(包括vpn转发,进入的端口)
/sbin/iptables -I INPUT -p tcp -s 172.16.0.0/24 -m multiport –dports 110,80,25,22,443,5432,3306,21,445,10101,5252,8080,8383,139,1723 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -s 172.16.0.0/24 –dport 5432 -j ACCEPT
/sbin/iptables -A INPUT -p udp -s 172.16.0.0/24 -m multiport –dports 53,111 -j ACCEPT
/sbin/iptables -A INPUT -p gre -s 172.16.0.0/24 -j ACCEPT
#/sbin/iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -s 172.16.0.0/24 -p tcp -m state –state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp -s 172.16.0.0/24 -m multiport –dports 80,110,21,25,1723,22,5252,10101,3306,443,5432,8080,2000,1935,8383 -j ACCEPT
/sbin/iptables -A FORWARD -p udp -s 172.16.0.0/24 –dport 53 -j ACCEPT
/sbin/iptables -A FORWARD -p udp -s 172.16.0.0/24 –dport 8000 -j ACCEPT
某游戏端口
#/sbin/iptables -A FORWARD -p udp -s 172.16.0.0/24 –dport 7000 -j ACCEPT
vpn 所需协议
/sbin/iptables -A FORWARD -p gre -s 172.16.0.0/24 -j ACCEPT
运行ping
/sbin/iptables -A FORWARD -p icmp -s 172.16.0.0/24 -j ACCEPT
#加这一句, ICMP应答、FTP传输、DCC等才能穿过防火墙正常工作。大部分还有一些UDP协议都依赖这个机制。不打开, bt们就不能变态了,bt软件不能穿透防火墙了, 需要进行ftp时候再打开, 限制只让 tcp 的包穿透防火墙
#/sbin/iptables -A FORWARD -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -s 172.16.0.0/24 -p tcp -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT
#封住 tcp, udp 所有端口 (应该有其他方法)
/sbin/iptables -A FORWARD -p tcp -s 172.16.0.0/24 –dport 0:65535 -j DROP
/sbin/iptables -A FORWARD -p udp -s 172.16.0.0/24 –dport 0:65535 -j DROP
/sbin/iptables -A INPUT -p tcp -s 172.16.0.0/24 –dport 0:65535 -j DROP
/sbin/iptables -A INPUT -p udp -s 172.16.0.0/24 –dport 0:65535 -j DROP
#我的ip, 不受规则限制
/sbin/iptables -I INPUT -s 172.16.0.108 -j ACCEPT
/sbin/iptables -I FORWARD -s 172.16.0.108 -j ACCEPT
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all — 172.16.0.108 anywhere
ACCEPT tcp — 172.16.0.0/24 anywhere multiport dports pop3,http,smtp,ssh,https,postgres,mysql,ftp,microsoft-ds,10101,5252,webcache,8383,netbios-ssn,1723
ACCEPT tcp — 172.16.0.0/24 anywhere state RELATED,ESTABLISHED
ACCEPT tcp — 172.16.0.0/24 anywhere tcp dpt:postgres
ACCEPT udp — 172.16.0.0/24 anywhere multiport dports domain,sunrpc
ACCEPT gre — 172.16.0.0/24 anywhere
DROP tcp — 172.16.0.0/24 anywhere tcp
DROP udp — 172.16.0.0/24 anywhere udp
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all — anywhere anywhere state NEW,RELATED,ESTABLISHED
ACCEPT all — 172.16.0.108 anywhere
ACCEPT tcp — 172.16.0.0/24 anywhere multiport dports http,pop3,ftp,smtp,1723,ssh,5252,10101,mysql,https,postgres,webcache,sieve,1935,8383
ACCEPT udp — 172.16.0.0/24 anywhere udp dpt:domain
ACCEPT udp — 172.16.0.0/24 anywhere udp dpt:8000
ACCEPT udp — 172.16.0.0/24 anywhere udp dpt:afs3-fileserver
ACCEPT gre — 172.16.0.0/24 anywhere
ACCEPT icmp — 172.16.0.0/24 anywhere
DROP tcp — 172.16.0.0/24 anywhere tcp
DROP udp — 172.16.0.0/24 anywhere udp
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
=======================================================
封ip
/sbin/iptables -A FORWARD -s 172.16.0.*** -j DROP
取消ip封闭
/sbin/iptables -D FORWARD -s 172.16.0.*** -j DROP
=======================================================
路由端口转发, 电驴为高id用户, 但是试过后,好像不行
/sbin/iptables -t nat -A PREROUTING -p udp -m udp –dport 19145 -j DNAT –to-destination 172.16.0.108:19145
/sbin/iptables -t nat -A POSTROUTING -s 172.16.0.0/16 -d 172.16.0.108 -p udp -m udp –dport 19145 -j SNAT –to-source 172.16.0.2
/sbin/iptables -t nat -A PREROUTING -p tcp -m tcp –dport 19145 -j DNAT –to-destination 172.16.0.108:19145
/sbin/iptables -t nat -A POSTROUTING -s 172.16.0.0/16 -d 172.16.0.108 -p tcp -m tcp –dport 19145 -j SNAT –to-source 172.16.0.2
#/sbin/iptables -t nat -A PREROUTING -p udp -m udp –dport 4662 -j DNAT –to-destination 172.16.0.108:4662
#/sbin/iptables -t nat -A POSTROUTING -s 172.16.0.0/16 -d 172.16.0.108 -p udp -m udp –dport 4662 -j SNAT –to-source 172.16.0.2
#/sbin/iptables -t nat -A PREROUTING -p tcp -m tcp –dport 4662 -j DNAT –to-destination 172.16.0.108:4662
#/sbin/iptables -t nat -A POSTROUTING -s 172.16.0.0/16 -d 172.16.0.108 -p tcp -m tcp –dport 4662 -j SNAT –to-source 172.16.0.2
=============================================================
###### 用mac地址封闭上网
######注意顺序问题
#/sbin/iptables -A FORWARD -m mac –mac-source 00:00:BA:A5:7D:12 -p tcp -m multiport –dports 80,110,21,25,1723,22,5252,10101,3306,443,5432,8080,2000,1935,8383 -j ACCEPT
#/sbin/iptables -A FORWARD -m mac –mac-source 00:00:BA:A5:7D:12 -p udp –dport 53 -j ACCEPT
#/sbin/iptables -A FORWARD -p icmp -j ACCEPT
######这一行保持在最后. 用iptables -L 查看
#/sbin/iptables -A FORWARD -m mac –mac-source 00:00:BA:A5:7D:12 -j DROP
nginx+php虚拟目录下支持php脚本
sudo apt-get install nginx php5-cli php5-cgi
sudo apt-get install lighttpd rcconf
sudo vim /etc/nginx/sites-available/default
location /myweb {
root /home/admin;
autoindex on;
index index.htm index.html index.php;
}
location ~ \.php$ {
root /var/www/nginx-default;
if ( $uri ~ ^/myweb/ ) {
root /home/ihefeadmin;
}
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
#fastcgi_param SCRIPT_FILENAME /var/www/nginx-default$fastcgi_script_name;
include fastcgi_params;
}
sudo vim /etc/nginx/fastcgi_params
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
spawn-fcgi -a 127.0.0.1 -p 9000 -C 10 -u www-data -f /usr/bin/php-cgi
cd /etc/init.d
cp nginx php-cgi
vim php-cgi
nginx –> php-cgi
DAEMON=/usr/bin/spawn-fcgi
DAEMON_OPTS=”-a 127.0.0.1 -p 9000 -C 10 -u www-data -f /usr/bin/php-cgi”
…
stop)
echo -n “Stopping $DESC: ”
pkill -9 php-cgi
echo “$NAME.”