su - apache -c "php /path/to/nextcloud/occ twofactorauth:disable username"
This will disable 2FA regardless of it it is enabled in the GUI. You will need to enable 2FA by running the command again, but with enable instead.
Delete the undeleteables.
I had a situation where a user had ~30Gb of data in their nextcloud trash which they could not delete. There were also files/directories in their active files that they also could not delete. No errors in the logs, just unable to delete :( The work around is to manually delete them from the server and then run the following command.
su - apache -c "php /path/to/nextcloud/occ files:scan <user>"
This removes invalid file references from the database.
Here I will show how to configure VSFTPD for basic authentication so that we have a base working daemon. Then we will build on that by implementing SSL and then virtual users.
Obviously first thing is first ;) If you haven't already, install vsftpd.
The above will tell vsftpd to not allow any anonymous connections eg mandatory login. What and where to log. What IP and port to listen on. To lock users into their home directory (defined in /etc/passwd).
The bottom 3 lines userlist_* we define so we don't grant all local users ftp access. If you answer YES to userlist_deny, the user list will deny any users listed in the file and allow everything else.
$ ftp cdstealer.com
Connected to cdstealer.com (<IP>).
220 (vsFTPd 3.0.2)
Name (cdstealer.com:user1):
530 Please login with USER and PASS.
SSL not available
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>
SSL
So let's get some encryption so we aren't transmitting plain text credentials.
Generate a self signed cert.
# openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout /etc/ssl/apache2/vsftp.pem -out /etc/ssl/apache2/vsftp.pem
Generating a 4096 bit RSA private key
..........................................................................................++
....++
writing new private key to '/etc/ssl/apache2/vsftp.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:GB
State or Province Name (full name) [Some-State]:Somewhere nice
Locality Name (eg, city) []:Leeds
Organization Name (eg, company) [Internet Widgits Pty Ltd]:cdstealer.com
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:cdstealer.com
Email Address []:
The openssl command I've used, generates a 4096bit encrypted cert (this is good) that is valid for 10 years. :)
Execute the following to remove unwanted access to the cert.
chmod 600 /etc/ssl/apache2/vsftp.pem
Add this section to your /etc/vsftpd/vsftpd.conf file.
Let's test and make sure everything is still working.
$ ftp cdstealer.com
Connected to cdstealer.com (<IP>).
220 (vsFTPd 3.0.2)
Name (cdstealer.com:user1):
234 Proceed with negotiation.
[SSL Cipher AES128-SHA]
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>
GREAT! So now we have a secure FTP service running.
In the interest of security, I'm not comfortable having system user accounts, even though we have secured things with only specific users able to ftp. I believe that standard ftp authentication does not support encryption for system users, but does for virtual users?
This is a little more involved than having standard system users :(
So, add the following to your /etc/vsftpd/vsftpd.conf file.
Here we define that virtual users get the same permissions as the ftp system user, are unable to browse outside their directory, use a PAM database for credentials and define custom settings per user.
NOTE: You may notice that the file extension is missing from the path in /etc/pam.d/vsftpd. This is intentional as PAM automatically adds the .db suffix.
You will need to add the users from the database to the access list file.
/etc/vsftpd/vsftpd.user_list
For your convenience, I've written a user management script, here :)
Define custom settings.
Create the directory which will store the configs. We defined this earlier as user_config_dir=/etc/vsftpd/virtualUsers.
mkdir /etc/vsftpd/virtualUsers
Create a user config.
vi /etc/vsftpd/virtualUsers/user1
write_enable=NO
local_root=/FTP/user1
chroot_local_user=YES
dirlist_enable=YES
download_enable=YES
Here we set the users CHROOT directory, deny write permissions and allow downloading. Options here (not all) override specific options defined in the main config.
If you get the following when logging in or listing a directory, it maybe due to the user directory not existing or not having permission.
ssl_getc: SSL_read failed -1 = 0
421 Service not available, remote server has closed connection
Login failed.
No control connection for command: Success
The following error may occur on ftp clients with vsftpd 3.0.x:
500 OOPS: priv_sock_get_cmd
This is caused by seccomp filter sanboxing, which is enabled by default on amd64. To workaround this issue, disable seccomp filter sanboxing:
Add the following line to /etc/vsftpd/vsftpd.conf.
When prompted, enter the necessary information for creating a CSR by using the conventions shown in the following table.
Note: The following characters cannot be used in the Organization Name or theOrganizational Unit: < > ~ ! @ # $ % ^ * / \ ( ) ?.,&
DN field
Explanation
Example
Common Name
The fully qualified domain name for your web server. This must be an exact match.
If you intend to secure the URL https://www.yourdomain.com, then your CSR’s common name must be www.yourdomain.com. If you plan to get a wildcard certificate, make sure to prefix your domain name with an asterisk, for example: *.domain.com.
Organization Name
The exact legal name of your organization. Do not abbreviate your organization name.
domain.com
Organizational Unit
Section of the organization.
IT
City or Locality
The city where your organization is legally located.
Wellesley Hills
State or Province
The state or province where your organization is legally located. Do not use an abbreviation.
Massachusetts
Country
The two-letter ISO abbreviation for your country.
US
Warning: Leave the challenge password blank (press Enter).
At the time of writing this, I'm using the Twentyfourteen theme which is the one I prefer. However, I wanted it to use as much of the screen estate as possible. I didn't like any other theme that had this, so I looked into modifying what I had. Here is what I did...
Step 1) Go to your site admin page.
Step 2) Go to "appearance" and select "theme"
Step 3) Select the theme you wish to change and activate.
Step 4) Go to "appearance" and select "customise"
Step 5) Click the "Additional CSS" option at the bottom of the left sidebar.
Step 6) Add the CSS sections of what you want to change.
To achieve the look I wanted, I added the following:
Want to batch download a bunch of videos in one swoop? Here's how. This also works with individual videos :)
Step 1) Install youtube-dl
# emerge -av youtube-dl
These are the packages that would be merged, in order:
Calculating dependencies... done!
[ebuild R ] net-misc/youtube-dl-2016.12.22::gentoo USE="offensive {-test}" PYTHON_TARGETS="python2_7 python3_4 (-python3_5)"
This is more of an audit thing, but sometimes it's useful to know when you did something.
If you type the command history into your shell. You get back a list of the last X number of command executed.
$ history | tail -n1
502 history | tail -n1
But by adding the following to your ~/.bashrc (local user) or /etc/bash/bashrc (all users) file, you can inject the time/date. Please see man date for the options you can use.
HISTTIMEFORMAT='%F %T '
Example
$ history | tail -n1
508 2017-01-14 11:29:58 history | tail -n1
Bash History Duplicate Removal
It's an annoyance when you execute a command consecutively many time and then have to search further back to get to the last different command. Behold! Add this to your .bashrc(local user) or /etc/bash/bashrc (all users) and no matter how many times you execute that command consecutively, it will only store the one time.
HISTCONTROL=ignoreboth
Example
user@server ~ $ vi .bashrc
user@server ~ $ vi .bashrc
user@server ~ $ vi .bashrc
user@server ~ $ vi .bashrc
user@server ~ $ history | tail -n5
508 2017-01-14 11:29:58 history | tail -n1
509 2017-01-14 11:31:36 man date
510 2017-01-14 11:32:43 history
511 2017-01-14 11:40:52 vi .bashrc
512 2017-01-14 11:42:36 history | tail -n5
Double tap exit/logoff
Accidentally logging out of a shell session or user session can be annoying. But there is hope :) Add this to your .bashrc(local user) or /etc/bash/bashrc (all users) and now you have to double tap to get out.
This one ideally needs to go into the /etc/bash/bashrc or else it would only work when closing your own shell session.
IGNOREEOF=1
Example
server ~ # Use "logout" to leave the shell.
server ~ # logout
user@server ~ $
Extract Path or File
$ export VAR=/home/me/mydir/file.c
$ echo "${VAR%/*}" /home/me/mydir
$ echo "${VAR##*/}" file.c
Cron Execution Only
Pop this at the top of a bash script.
Eg. The below is for a cronjob that is executed at reboot:
The "!senders = +whitelist_senders" line will lookup against the file you created. It will also create an empty file within the path of the first line of this section for the time based rejection. So to keep things "tidy", we'll run a cronjob every 30 mins to remove files.
Want Vim to automatically do things to new or existing files? Autocmd to the rescue! Here I will demo a very simple example that I use for when I create/edit bash/python files.
I created the directory .vim in the root of my home directory and then created the "header" files that I wanted.
$ cat .vim/python_header
:insert
#!/usr/bin/python3
################################################################################
####
#### Filename:
####
#### Purpose:
####
#### Created on:
####
#### Author:
####
#### Last Modified:
####
################################################################################
.
The first line must be :insert and the last line must be a period '.'
I then added the following lines to the .vimrc file in the root of my home directory.
