Piramide Studio NET Portorož Wordpress Blog ✅ DDLMedia 📦

Raspberry PI4

Postavitev mini serverja za pametno hišo nadzor - CybroTech Controllers oz. Robotina.si izgradnja in postavitev aplikacije za nadzor in vklapljanje komponent na daljavo (centralno gretje, klima naprave, webcam-ere, dodatne informacije za pridobivanje npr. sončne energije ali preko toplotne črpalke gretje vode preko sonca,.....itd....)

Predstavljen postopek namestitve WEB Scada - za CybroTech kontrolerje - nadzor pametne hiše preko spleta!!!

Raspberry PI4 4GB RAM 16MB GPU Minimal install Cybrotech WEB Scada - Cybrotech controllers

hostname: webscada - WEB Scada download prenos aplikacije: http://www.cybrotech.com/

Tukaj vam predstavim moj primer namestitve spletne aplikacije WEB Scada Cybrotech kontrolerji - Nadzor pametne hiše preko spleta z uporabo noip.com Dinamične Domene - DDNS (ponudnik dinamičnih imen strežnika - konvertira vaš javni IP v hostname oz. ime strežnika, ki ste ga rezervirali v nadzorni plošči noip.com (to vam pride prav pol za večje število aplikacij še posebej če imate na vašem domu IP kamere pol se vam to izplača imeti, namesto da pišete IP za kamere jim določite hoste se pravi namesto http://89.212.137.96:20202 npr. javni ip z portom za webcam spremenite v npr. http://mojakamera.ddns.net ali poglejte ostale druge poddomene oz. dinamične domene katere so brezplačne za vaše WEBCam ali spletne aplikacije karkoli!!!

Po vrsti gremo kako sem ji jaz namestu WEB Scado 2015 na raspberry PI3 oz. sedaj na Raspberry PI4 WEB Scado http://www.cybrotech.com/

Originalna navodila kako namestit WEB Scada Cybrotech controllers - Robotina.si ko ste si pobrali datoteko iz www.cybrotech.com web server app http://www.cybrotech.com/wp-content/uploads/2019/04/CyBroWebScada-v1.1.10-v2.3.0.zip to spodaj so original dokumenti kako namestit webscado na Ubuntu 64bit, stari zapiski, saj se se scada od, ker je šel glavni razvijalec pri robotina.si vija se je vse skupaj ustavilo in do dandanes niso naredili noben nov program, ki bi sledil trendom skriptnih jezikov in varnosti!!!!

--------------------------------------------------------------------------------

Installation procedure for Debian based Linux

OS install

- Install Ubuntu server version, 64bit.

- Disk partitioning:

- Ext4, mount point: /, params: default, noatime

- Ext4, mount point: /var, params: default, noatime

- Ext4, mount point: /home, params: default, noatime

- Swap

- Create default user named "solar".

- OS update:

$ sudo apt-get update

$ sudo apt-get upgrade

Software install:

$ sudo apt-get install apache2 mysql-server php5 phpmyadmin libapache2-mod-wsgi acl ssh

$ sudo apt-get install python-django python-pip python-mysqldb

$ sudo pip install pytz

Install FTP server and select it as standalone server:

$ sudo apt-get install pure-ftpd

Use FTP to copy application into user directory (/home/solar/app...).

Software configuration

- Apache

Enter command and insert following lines into Apache configuration file:

$ sudo pico /etc/apache2/apache2.conf

ServerName solarserver:80

# solar cybro web application static files directory

Alias /static/ /home/solar/app/solar_cybro/static/

Order deny,allow

Allow from all

</directory>

# solar cybro web application data directory

Alias /data/ /home/solar/app/solar_cybro/data/

Order deny,allow

Allow from all

</directory>

# location of solar cybro wsgi startup file

WSGIScriptAlias / /home/solar/app/solar_cybro/solar_cybro.wsgi

Order deny,allow

Allow from all

</directory>

- MySQL

Finetune MySQL according to the hardware configuration to gain max perfomance:

http://www.jonboy60.com/2011/03/10/mysql-tune-up-on-my-cnf/

Database installation

Browse to http://solarserver/phpmyadmin/ to start phpMyAdmin. Create database by running

the following SQL command:

CREATE DATABASE `solar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;

Change default root passwords:

SET PASSWORD FOR 'root'@'127.0.0.1' = PASSWORD('solar');

SET PASSWORD FOR 'root'@'::1' = PASSWORD('solar');

SET PASSWORD FOR 'root'@'localhost' = PASSWORD('solar');

Create default database user:

CREATE USER 'solar'@'localhost' IDENTIFIED BY 'solar';

GRANT ALL PRIVILEGES ON * . * TO 'solar'@'localhost' IDENTIFIED BY 'solar' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0;

GRANT ALL PRIVILEGES ON `solar` . * TO 'solar'@'localhost';

Basic web structure:

Download SQL dump file from http://download.solar-cybro.com/solar.sql.gz, open dbase "solar" and import file.

MySQL timezone info:

Download SQL dump file from http://download.solar-cybro.com/mysql.tzinfo.sql.gz and import file.

Solar Cybro web application

Edit /home/solar/app/solar_cybro/solar_cybro.wsgi and set paths as needed:

import os

import sys

HOME_DIR = "/home/solar"

sys.path = [

'%s/app/solar_cybro' % HOME_DIR,

'%s/app/solar_cybro/project' % HOME_DIR,

] + sys.path

from django.core.handlers.wsgi import WSGIHandler

os.environ['DJANGO_SETTINGS_MODULE'] = 'project.settings'

application = WSGIHandler()

Rename default local settings file /home/solar/app/solar_cybro/project/settings_local-default.py

to settings_local.py. Edit settings_local.py and set all relevant data (database name, user, password,

time zone, default directories...).

Edit /home/solar/app/solar_cybro/project/deploy.py and set WEB_DEPLOY = True.

Create directories:

$ mkdir /home/solar/app/solar_cybro/data/cache

$ mkdir /home/solar/app/solar_cybro/data/media

Granting Apache access to data directory

$ setfacl -m u:www-data:--x $HOME

$ setfacl -R -m u:www-data:--- $HOME/app/*

$ setfacl -R -m u:www-data:rwx $HOME/app

$ setfacl -R -m d:u:www-data:rwx $HOME/app

$ chmod g+s $HOME/app

$ setfacl -R -m d:u:solar:rwx $HOME/app

Set executable permissions

$ chmod 755 app/scgi_server/src/cybro_com_server.py

$ chmod 755 app/scgi_server/src/cybro_scgi_server.py

$ chmod 755 app/scgi_server/src/run_scgi_server.py

Autostart scgi server when machine boots:

Edit /etc/rc.local and add following line before "exit 0":

sudo -u solar /home/solar/app/scgi_server/src/run_scgi_server.py

Cron configuration

Edit /home/solar/app/scgi_server/src/run_scgi_server.py and change the shell executable in the first line to:

#!/usr/bin/python

Edit crontab:

$ crontab -e

Add following lines to automatically start scgi server and reporting engine:

*/1 * * * * /home/solar/app/scgi_server/src/run_scgi_server.py &>/dev/null

*/10 * * * * /home/solar/app/solar_cybro/project/run_create_reports.py &>/dev/null

*/2 * * * * /home/solar/app/solar_cybro/project/run_send_reports.py &>/dev/null

Restart Apache

$ sudo apachectl -k restart

#########################################################################

Navodila glavni razvijalec robotina.si (na žalost več ne razvija g. Kocijančič odlično programsko opremo za CybroTech kontrolerje oz. spletni nadzor vaše pametne hiše, saj se je razvoj pri robotina.si za WEBScado zaustavil leta 2015 in do dandanes niso naredili nič ok kao neki so naredili SCGI server port 4000 za 64bitni operacijski sistem 2019 to je vse, drugače žalostno za WEB Scado niso do dandanes razvili ali popravili (še danes ne delajo templates pri WEB Scada!!!) karkoli, žalostno za podjetje, katero se ukvarja prav z zelenimi energijami in avtomatizacijo elektro procesov v domovih - bivalnih prostorih oz. poslovnih prostorih!!!! Po mojem je podpora zelenim alternativnim virom pridobivanja energije nujna in bi mogla biti že s strani naše države podprta ne pa, da se jo zatira, kot hočejo danes, ne nič iz Kitajske vsi kontrolerji vaša pametne hiše morajo imeti vse CE oznake itd... ma to samo zato, da zaščitijo kao evropske npr. kontrolerje, saj so kitajski čeprav identični tri do štirikrat cenejši plus vsa dodatna oprema za pametne hiše so pri kitajcih tudi do 20 krat cenejši in logično zdaj zahtevajo v evropi še vse a teste za robo iz kitajske a če pogledamo vse te evropske kontrolerje za pametne hiše, vse je made in china samo da imajo Atest oz. CE oznako to vse košta!):

--------------------------------------------------------------------------------

CyBroWebScada install by Goran Kocjancic

--------------------------------------------------------------------------------

Installation procedure for Ubuntu

- OS install

- Ubuntu server version, 64bit (ubuntu-14.04.1-server-amd64.iso)

- hostname: cybroweb

- new user account:

- Full name: solar

- Username: solar

- Password: solar

- No automatic updates

- Choose software to install:

- Basic Ubuntu server

- OpenSSH server,

- all other unchecked!

- log to server as solar

- check IP

$ ifconfig

- start WinSCP

- New Site:

- Host name: IP

- username: solar

- password: solar

- Save

- Login

- start PuTTY

- Enter password: solar

Now you can copy comands and paste to PuTTY with right mouse button

- OS update:

$ sudo apt-get update

$ sudo apt-get upgrade

- Software install:

$ sudo apt-get install apache2 mysql-server php5 phpmyadmin libapache2-mod-wsgi acl ssh

- New password for theMySQL "root" user: solar

- Web server to reconfigure automatically: apache2

- Configure database with phpmyadmin with dbconfig-common? Yes

- Password of the database's administrative user: solar

- MySQL application password for phpmyadmin: solar

- Password confirmation: solar

$ sudo apt-get install python-pip python-mysqldb

$ sudo pip install django==1.3

$ sudo pip install pytz

$ sudo apt-get install python-dev python-setuptools

$ sudo apt-get install libjpeg-dev zlib1g-dev

$ sudo pip install pillow

- Copy app to /home/solar with WinSCP

- Apache set up:

$ sudo pico /etc/apache2/apache2.conf

copy below text to the end of file

--------------------------------------------------------------------------------

ServerName solarserver:80

# solar cybro web application static files directory

Alias /static/ /home/solar/app/solar_cybro/static/

Order deny,allow

Require all granted

</directory>

# solar cybro web application data directory

Alias /data/ /home/solar/app/solar_cybro/data/

Order deny,allow

Require all granted

</directory>

# location of solar cybro wsgi startup file

WSGIScriptAlias / /home/solar/app/solar_cybro/solar_cybro.wsgi

Order deny,allow

Require all granted

</directory>

--------------------------------------------------------------------------------

- MySQL Database installation

$ sudo pico /etc/php5/apache2/php.ini

change “upload_max_filesize” from 2M to 10M

$ sudo service apache2 restart

Browse to http://IP/phpmyadmin/ to start phpMyAdmin. Create database by running

the following SQL command:

--------------------------------------------------------------------------------

CREATE DATABASE `solar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;

SET PASSWORD FOR 'root'@'127.0.0.1' = PASSWORD('solar');

SET PASSWORD FOR 'root'@'::1' = PASSWORD('solar');

SET PASSWORD FOR 'root'@'localhost' = PASSWORD('solar');

CREATE USER 'solar'@'localhost' IDENTIFIED BY 'solar';

GRANT ALL PRIVILEGES ON *.* TO 'solar'@'localhost' IDENTIFIED BY 'solar' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0;

GRANT ALL PRIVILEGES ON `solar`.* TO 'solar'@'localhost';

--------------------------------------------------------------------------------

Open table "solar" and import file "solar.sql"

Open table "mysql" and import file "time_zone.sql"

- Granting Apache access to data directory

$ sudo setfacl -m u:www-data:--x $HOME

$ sudo setfacl -R -m u:www-data:--- $HOME/app/*

$ sudo setfacl -R -m u:www-data:rwx $HOME/app

$ sudo setfacl -R -m d:u:www-data:rwx $HOME/app

$ sudo chmod g+s $HOME/app

$ sudo setfacl -R -m d:u:solar:rwx $HOME/app

- Set executable permissions

$ sudo chmod 755 app/scgi_server/src/cybro_com_server.py

$ sudo chmod 755 app/scgi_server/src/cybro_scgi_server.py

$ sudo chmod 755 app/scgi_server/src/run_scgi_server.py

- Edit crontab:

$ crontab -e

Add following lines to automatically start scgi server and reporting engine:

--------------------------------------------------------------------------------

*/1 * * * * /home/solar/app/scgi_server/src/run_scgi_server.py &>/dev/null

*/10 * * * * /home/solar/app/solar_cybro/project/run_create_reports.py &>/dev/null

*/2 * * * * /home/solar/app/solar_cybro/project/run_send_reports.py &>/dev/null

--------------------------------------------------------------------------------

- Restart Apache

$ sudo service apache2 restart

- Browse to http://IP to start CyBroWebScada

Zdaj pa gremo namestitev WEB Scada na mini server 32bit arhitektura oz. procesor 32bit ARMHF (isto velja če nameščate npr. na vaš Debian server 32bit če imate samo 3.78MB rama in manj, v kolikor imate več rama za vaš server pa obvezno namestitev ×64 Bitne arhitekture oz. operacijski sistem 64Bit ne pa 32bit!!! samo v primeru, da ima vaš server več kot 4GB rama!!!

Prvo bom ustvaril račun WEBScada in sebe kot pomožni račun in za primer še ostale razvijalce programske opreme, kateri bodo imeli sudo možnost oz. root pooblastila na tem serverju (mini server Raspbian Linux 32bit - Debian 10 Buster ARMHF 32bitna arhitektura - dve variante namestitve Raspbian linux prva osnovna druga za prijatelja custom install z dodatnimi aplikacijami Webmin in Maltrail):

Hostnema: cybrotechZa začetek ko ste priklopili prvič SD oz. USB3 Disk kjer sete zapekli npr. preko aplikacije Rufus https://rufus.ie/ izberete samo iz Rapberrypi.org light image se pravi: https://downloads.raspberrypi.org/raspios_lite_armhf/images/raspios_lite_armhf-20**-**-**/20**-**-**-raspios-buster-armhf-lite.zip
## Tako zakaj sem naredil več računov, prvo ker so še drugi razvijalci v našem timu in da lahko tudi oni delajo pol spremembe direktno vseh konfiguracijskih datotek - vi si za doma naredite npr. samo en račun npr. webscada tu naj bo aplikacija nameščena in še en vaš račun, katerega lahko povežete za kronološka opravila in vse operacije, karkoli boste potrebovali npr. namestite si še email postfix in dovecot, zato da vam bo lahko webscada pošiljala različne alarme in kaj se dogaja z vašim serverjem.
sudo adduser webscadasudo passwd webscadaMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser borissudo passwd borisMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser sandisudo passwd sandiMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser igorMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer

sudo usermod -aG adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio sandisudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio sandi
sudo usermod -aG adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio webscadasudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio webscada
sudo usermod -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio borissudo usermod -aG adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio boris
### Za dodelit pooblastila skupinam vi uporabite spodnje direktive v terminalu:
sudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio webscadasudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio sandisudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio igorsudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio boris
## to so sudorji oz. root pooblastila uporabniki!!!!! to direktivo imate v raspberry pod mapo sudo nano /etc/sudoers.d/010_pi-nopasswd## Drugače pa za večje število sudo pooblastil root za račune vklopite sudo visudo in čisto na koncu kopirajte vaše uprabnike z možnostjo root pooblastila:# V terminalu vpišite spodnjo kodo:sudo visudo
##Na koncu kopirajte vse tiste, ki želite da imajo root dostop oz. sudo pooblastila:
igor ALL=(ALL) ALLigor ALL = NOPASSWD: ALL
boris ALL=(ALL) ALLboris ALL = NOPASSWD: ALL
sandi ALL=(ALL) ALLsandi ALL = NOPASSWD: ALL
webscada ALL=(ALL) ALLwebscada ALL = NOPASSWD: ALL
# Shranite

## Tukaj razervirajte oz. IP naslov, ki ste ga na vašem routerju rezervirali preko MAC naslova za en interni IP se pravi pri meni je tako server Raspberry PI4 (2019nova kopija - izboljšave in prenova skriptov, dodatne nadgradnje in funkcionalnosti) = Glavni server pi IP naslov: 192.168.1.123 ter IP Routerja oz. Svičerja je = 192.168.1.1
sudo nano /etc/dhcpcd.conf #static IP configuration - Dodajte ko ste rezervirali statični IP na vašem usmerjevalniku oz. routerju eth0, če ste priklopili vaš mini strežnik preko kabla ali če ga imate preko WiFi povezave kopirajte še WiFi IP naslov ki ste ga rezervirali na vašem routerju:## Na koncu kopirajte vaše podatke se pravi IP routerja v mojem primer je 192.168.1.1 ter IP serverja, ki je 192.168.1.123 plus za DNS domenski strežnik všišite vaše IP, ki jih ima vaš ISP oz. ponudnik dostopa do interneta:
interface eth0static ip_address=192.168.1.123/24static routers=192.168.1.1static domain_name_servers=192.168.1.1 84.255.209.79 84.255.210.79 8.8.8.8 8.8.4.4
## Če uporabljate še WiFi povezavo za dostop do Raspberry PI mini strežnika dodajte še wlan nastavitve se pravi IP routerja v tem primeru 192.168.1.1 ter IP serverja, za vašo WiFi povezavo 192.168.1.124:
interface wlan0static ip_address=192.168.1.114/24static routers=192.168.1.1static domain_name_servers=192.168.1.1 84.255.209.79 84.255.210.79 8.8.8.8 8.8.4.4## Shranite
sudo nano /etc/sudoers.d/010_pi-nopasswdwebscada ALL=(ALL) NOPASSWD: ALL###ali spremenite original nastavitev v vaš račun se pravi pi ALL=(ALL) NOPASSWD: ALL spremenite v spodaj primer enega izberite od vaših računov:sandi ALL=(ALL) NOPASSWD: ALLaliboris ALL=(ALL) NOPASSWD: ALLaliigor ALL=(ALL) NOPASSWD: ALL### Shranite in izhod
sudo nano /etc/ssh/sshd_configAllowUsers webscada igor boris sandi# Za prepoved uporabnikov na SSH dodajte spodnje direktive:DenyUsers pi uporabnik1 uporabnik2 uporabnik3### Shranite in izhod
## Komande pol za preverit požarni zid in pa za ugasnit server:sudo shutdown nowsudo iptables -L -n --line
## Izbriši uporabnika PI lahko pa ga tudi zaklenete s komando: # izbriši pi userja: sudo reboot in prijava pod drugim uporabnikom:sudo userdel -r -f pi
###Zaklene user pi / Jaz si vedno dam user pi pass pi je lažje delat!!!! ko ga ne rabiš več in ga zakleneš na serverju tako in v SSH nastavitve dodaš pi račun v deny:sudo passwd --lock pi
sudo nano /etc/ssh/sshd_configDenyUsers pi
## zbriši pija ma ne rabi dok karkoli delaš ga daš samo pod lock ma tudi če ga zbrišeš isto ti je ma je bolj praktično## ga imet račun pi in koda pi in ga samo zakleneš pol kodarkoli delaš ga --unlock in pol ko končas ga spet nazaj lock!## Jaz za svojo webscado in od prijatelja, ki gostuje za vse webscado praktično brišemo na vseh serverjih tudi za stranke račun pi, če je scada nameščena za stranko preko micro oz. mini serverja raspberry PIsudo userdel -r -f pialisudo deluser -remove-home pi

# Za varnejšo zaščito vašega SSH uporabite SSL oz. kriptirano povezavo ne z uporabniškim imenom in geslom ampak preko SSH certifikata = vklopite v ssh nastavitvah priklop na port 22 preko SSH certifikata, glej referenca: https://www.raspberrypi.org/documentation/computers/remote-access.html
ssh-keygen
sudo su - borisssh-keygensudo su - sandissh-keygensudo su - webscadassh-keygen
### Zdaj ko si naredu ssh certifikate lahko zakomentiraš sudo visudo ostale uporabnike!!!!! po želji!!!in šele zdaj daš:sudo apt update && sudo apt upgrade -y
## Obvezno tudi za kodo phpmyadmin ko nameščate dajte si eno dolgo kodo uporabite npr. password generator za linux tako da namestite v terminalu ta program: sudo apt install pwgen
# Za priklic kode npr. 32 mestna koda npr. 10 kod uporabite v terminalu spodnjo komando:pwgen -s 32 10
# Za generirat npr. 1 geselo dolžine 32 znakov v terminalu zažgite to komando npr. označite to spodaj komando in CTRL+C za kopirat in v terminalu samo kliknete na desni miškin kazalec, da se vam ta kopirana komanda prilepi v terminal:webscada@piramidestudiowebscada:~ $ pwgen -s 32 1
********************************************************phpmyadminBrhgdpqmhUcvwn9nPVz5AwKsvXBM7GRM

### Recimo za pol ko je nameščena scada si dajte vaše glavne admin račune za dostop do webscada, glede na to da nimate nobenih strank boste tu uporabili za pristop, seveda ko izklopite od webscada admin in admin geslo račun vklopite oz. ustvarite za vaš email in močno geslo:RaspberryPI4 - RaspberryPI4User
boris.perc@gmail.comUser: borisPassword: ZeloZeloMočnoGesloWEBScadaPristop
WebScada TEST PI4:sandi.poberaj@gmail.comUser: sandiPassword: ZeloZeloMočnoGesloWEBScadaPristop

## Ko ste ustvarili vaše račune in dodelili skupine vašim računom nadgradite vaš strežnik tako:sudo apt update && sudo apt upgradesudo reboot
# Zdaj se prijavite z vašim računom npr. boris ali boljše webscada, saj bomo na njemu namestili WEB Scada server za vizualizacijo in nadzor vaše pametne hiše:prijava v terminal npr. z računom webscada in geslo uporabite putty ssh client program ali pa jaz uporabljam SmartFTP ali katerikoli drugi program oz. SSH klijent ter SSH server program za dostop na vaš strežnik Raspberry PI
## Ko smo se prijavili npr. z računom webscada v vaš terminal zbrišite ali zaklenete račun pisudo apt update && sudo apt upgrade -ysudo reboot
## Zdaj gremo namestit požarni zid za vaš Raspberry pi mini strežnik:sudo iptables -Lsudo ip6tables -L
sudo nano /tmp/v4
# Generated for iptables-custom-settings by Boris Perc for WEB Scada CybroTech controllers:
*filter:OUTPUT ACCEPT [0:0]:INPUT DROP [0:0]:FORWARD ACCEPT [0:0]# Accept traffic from internal interfaces-A INPUT ! -i eth0 -j ACCEPT# Accept traffic with the ACK flag set-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT# Allow incoming data that is part of a connection we established-A INPUT -m state --state ESTABLISHED -j ACCEPT# Allow data that is related to existing connections-A INPUT -m state --state RELATED -j ACCEPT# Accept responses to DNS queries-A INPUT -p udp -m udp --dport 1024:65535 --sport 8442 -j ACCEPT# Accept responses to our pings-A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT# Accept notifications of unreachable hosts-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -j ACCEPT# Accept notifications to reduce sending speed-A INPUT -p icmp -m icmp --icmp-type source-quench -j ACCEPT# Accept notifications of lost packets-A INPUT -p icmp -m icmp --icmp-type time-exceeded -j ACCEPT# Accept notifications of protocol problems-A INPUT -p icmp -m icmp --icmp-type parameter-problem -j ACCEPT## To spodaj je odobritev več portov se pravi ftp, ssh, splet, epošta, webmin, maltrail in webscada:# Allow connections to our SSH server (Odobrite ssh, web, mail ter webmin, webscada scgi server ter maltrail server in senzor):-A INPUT -p tcp -m tcp -m multiport -j ACCEPT --dports ftp,ssh,www,https,pop3,smtp,imap,imaps,pop3s,10000,4000,8442,8338# Allow connections to our IDENT server - če uporabljate avtorizacijski strežnik dodajte to spodaj direktivo:-A INPUT -p tcp -m tcp --dport auth -j ACCEPT# Respond to pings-A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT# Protect our NFS server-A INPUT -p tcp -m tcp --dport 2049:2050 -j DROP# Protect our X11 display server-A INPUT -p tcp -m tcp --dport 6000:6063 -j DROP# Protect our X font server-A INPUT -p tcp -m tcp --dport 7000:7010 -j DROP# Allow connections to unprivileged ports-A INPUT -p tcp -m tcp --dport 1024:63353 -j ACCEPT# Accept traceroutes-A INPUT -p udp -m udp --dport 8442:65535 -j ACCEPT# Completed on Mon jul 29 12:06:00 2020 Generated for iptables-webmin-custom-settings by homecraftsoft.com on Mon jul 29 12:06:00 2020 Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0-A INPUT -i lo -j ACCEPT-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT# Reject all other inbound - default deny unless explicitly allowed policy:-A FORWARD -j REJECT-A INPUT -j REJECT# WEBMail email ports allow plus ftp and webmin plus maltrail:-A INPUT -p tcp --dport 21 -j ACCEPT-A INPUT -p tcp --dport 25 -j ACCEPT-A INPUT -p tcp --dport 465 -j ACCEPT-A INPUT -p tcp --dport 587 -j ACCEPT-A INPUT -p tcp --dport 143 -j ACCEPT-A INPUT -p tcp --dport 993 -j ACCEPT-A INPUT -p tcp --dport 110 -j ACCEPT-A INPUT -p tcp --dport 995 -j ACCEPT-A INPUT -p tcp --dport 4000 -j ACCEPT-A INPUT -p tcp --dport 8442 -j ACCEPT-A INPUT -p tcp --dport 8338 -j ACCEPT-A INPUT -p tcp --dport 10000 -j ACCEPTCOMMIT# Completed on Mon jul 29 12:06:00 2020### Shranite in izhod## Zdaj če ne uporabljate epoštnega strežnika in npr. webmin to vam priporočam za lažje nastavljanje in nadzor strežnika da namestite ter npr. Maltrail aplikacija za nadzor vašega strežnika, tudi to vam ni potrebno, saj tej zapiski so namenjeni za moj Debian 10 Buster 64bit in jaz uporabljam vse zgornje nastavitve se pravi Webmin, Maltrail, ftp in email strežnike....

sudo nano /tmp/v6
# Generated for iptables-custom-settings by Boris Perc Debian 10 Buster 64bit - homecraftsoft.com virtual host - domain perc.ddns.net
*filter:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]:INPUT DROP [0:0]# Accept traffic from internal interfaces-A INPUT ! -i eth0 -j ACCEPT# Accept traffic with the ACK flag set-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT# Allow incoming data that is part of a connection we established-A INPUT -m state --state ESTABLISHED -j ACCEPT# Allow data that is related to existing connections-A INPUT -m state --state RELATED -j ACCEPT# Accept responses to DNS queries-A INPUT -p udp -m udp --dport 1024:65535 --sport 8442 -j ACCEPT-A INPUT -p tcp -m tcp --dport auth -j ACCEPT# Respond to pings -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT Protect our NFS server-A INPUT -p tcp -m tcp --dport 2049:2050 -j DROP# Protect our X11 display server-A INPUT -p tcp -m tcp --dport 6000:6063 -j DROP# Protect our X font server-A INPUT -p tcp -m tcp --dport 7000:7010 -j DROP# Allow connections to unprivileged ports -A INPUT -p tcp -m tcp --dport 1024:63353 -j ACCEPT Accept traceroutes-A INPUT -p udp -m udp --dport 33434:33523 -j ACCEPT# Completed on Mon jul 29 12:55:21 2020 Generated for iptables-webmin-custom-settings by homecraftsoft.com on Mon jul 29 12:55:21 2020 Accept local host connections-A INPUT -i lo -j ACCEPT# Dissalow input - connections from outsite localhost-A INPUT -s ::1/128 ! -i lo -j REJECT-A INPUT -j REJECT-A FORWARD -j REJECTCOMMIT# Completed on Mon jul 29 12:55:21 2020### Shranite in izhod
## Zdaj prikličete vaše custom oz. po meni nastavitve za iptables oz. požarni zid tako (terminal izvedite spodnje dve komande):sudo iptables-restore < /tmp/v4sudo ip6tables-restore < /tmp/v6
# Zdaj namestite iptables oz. požarni zid za linux, ko se namestitev začne vsi odgovori so DA oz. YES:sudo apt-get install iptables-persistent -y
(89.212.137.96) - Za iptables poglejte zapiske ki sem jih pripravil webscada za prijatelja ko se tej zaključijo je še en postopek za namestitev webscada raspberry pi komplet še z Webmin in pa Maltrail oz. malicious trafic detection software - praktično en požarni zid, ki vam že znane serverje ki napadajo računalnike avtomatično blokirajo, poglejte si kako sem napisal fail2ban filter za maltrail, dodajte po želji direktive "suspicious, known attacker, itd....., da jih takoj vaš fail2ban požarni zid za linux blikira za vedno se pravi -1 direktiva"
sudo reboot
## Previrite, če se vam je pravilno namestil požarni zid in so zgoraj navedeni parametri aktivni tako:sudo iptables -vLsudo ip6tables -vL

# V terminalu poberite na vaš račun se pravi v tem primeru webscada user - Aplikacija se vam bo odpakirala na vaš račun se pravi webscada v /home/webscada/app/ ter vso dokumentacijo si lahko pogledate v mapi /home/webscada/doc/:# Za pobrat program izvedite spodnjo komando v terminalu se pravi ko ste prijavljeni npr. račun oz. user webscada:wget http://www.cybrotech.com/wp-content/uploads/2019/04/CyBroWebScada-v1.1.10-v2.3.0.zip# Udpakirajte prenešen program z spodnjo komando:unzip CyBroWebScada-v1.1.10-v2.3.0.zip
## Ne instaliraj SQL server preden ne uštimač prvo cel linux se pravi apache, php pol namesti potrebne module in ostalo: django, sql, phpmyadmin in skonfiguriraš kot moraš!!!
sudo apt update && sudo apt upgrade -ysudo apt-get install apache2 apache2-utils -y
sudo apt-get install apache2 -y
sudo nano /etc/apache2/apache2.conf<Directory /var/www/html/> for your web folder:“AllowOverride None” – change this to “AllowOverride ALL”# Vi samo dodajte pod direktivo <Directory /var/www/> to spodaj direktivo vam bo kasneje rabla npr. za AwStats ali kakšen drug program:<Directory /var/www/html/>        Options Indexes FollowSymLinks        AllowOverride All        Require all granted</Directory>## obvezno na koncu datoteke apache.conf dodajte ServerName localhost !!!!!!# vim: syntax=apache ts=4 sw=4 sts=4 sr noetServerName localhost
## Za privat SSL, če ne boste uporabili certbot SSL certifikat si lahko naredite privatni SSL oz. samoregistriran tako:sudo mkdir -p /etc/ssl/localcertscd /etc/ssl/localcertssudo openssl req -new -x509 -days 126800 -nodes -out /etc/ssl/localcerts/apache.pem -keyout /etc/ssl/localcerts/apache.keysudo chmod 600 /etc/ssl/localcerts/apache*
sudo nano /etc/apache2/sites-available/000-default.conf# KOPIRAJ TO NEKJE POD SNOKYOIL SSL OD RASPBIANA: ter generiraj tako vašo nov ssl certifikat za apache: sudo openssl req -new -x509 -days 3560 -nodes -out /etc/ssl/localcerts/apache.pem -keyout /etc/ssl/localcerts/apache.key# Zdaj kopirajte v 000-default.conf apache to spodnjo direktivo za vklopit ssl in zaženite v terminalu: sudo a2ensite default-ssl && sudo a2enmod sslSSLCertificateFile /etc/ssl/localcerts/apache.pemSSLCertificateKeyFile /etc/ssl/localcerts/apache.key
***************************************************************************************************Certifikati: Selfsigned - How to secure your server by Boris Perc info Debian 10 Buster 64bit:sudo mkdir -p /etc/ssl/localcertssudo openssl req -new -x509 -days 3560 -nodes -out /etc/ssl/localcerts/apache.pem -keyout /etc/ssl/localcerts/apache.keysudo chmod 600 /etc/ssl/localcerts/apache*

webscada@cybrotech:~ $ sudo mkdir -p /etc/ssl/localcertswebscada@cybrotech:~ $ sudo openssl req -new -x509 -days 1095 -nodes -out /etc/ssl/localcerts/apache.pem -keyout /etc/ssl/localcerts/apache.keyGenerating a RSA private key.................+++++.........................................+++++writing new private key to '/etc/ssl/localcerts/apache.key'-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [AU]:SIState or Province Name (full name) [Some-State]:Slovenija PortoroseLocality Name (eg, city) []:Portorose Piran ObalaOrganization Name (eg, company) [Internet Widgits Pty Ltd]:Piramide Studio HomeCraftSoft@2000Organizational Unit Name (eg, section) []:HandCrafted Software by Boris Perc PCS@1989Common Name (e.g. server FQDN or YOUR name) []:89-212-137-96.static.t-2.netEmail Address []:boris.perc@gmail.comwebscada@cybrotech:~ $ sudo chmod 600 /etc/ssl/localcerts/apache*webscada@cybrotech:~ $ cd /etc/apache2/sites-availablewebscada@cybrotech:/etc/apache2/sites-available $ dir000-default.conf default-ssl.confwebscada@cybrotech:/etc/apache2/sites-available $ sudo nano default-ssl.confwebscada@cybrotech:/etc/apache2/sites-available $
## Kopiraj nekja pod snokioil ssl od raspbianan:SSLCertificateFile /etc/ssl/localcerts/apache.pemSSLCertificateKeyFile /etc/ssl/localcerts/apache.key
# zdaj vklopi SSL in aktivirajte ssl modul za apache:sudo a2ensite default-sslsudo a2enmod ssl

***************************************************************************************************
webscada@cybrotech:~ $ sudo apt install git -yBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... NarejenoNaslednji paket je bil samodejno nameščen in ni več zahtevan:  libicu63Uporabite 'sudo apt autoremove' za njegovo odstranitev.The following additional packages will be installed:  git-man libcurl3-gnutls liberror-perlPredlagani paketi:  git-daemon-run | git-daemon-sysvinit git-doc git-el git-email git-gui gitk gitweb git-cvs  git-mediawiki git-svnNaslednji NOVI paketi bodo nameščeni:  git git-man libcurl3-gnutls liberror-perl0 nadgrajenih, 4 na novo nameščenih, 0 bo odstranjenih in 0 ne nadgrajenih.Potrebno je dobiti 6137 kB arhivov.Po tem opravilu bo porabljenega 32,9 MB dodatnega prostora.Dobi:1 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf libcurl3-gnutls armhf 7.64.0-4+deb10u1 [292 kB]Dobi:2 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf liberror-perl all 0.17027-2 [30,9 kB]Dobi:3 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf git-man all 1:2.20.1-2+deb10u3 [1620 kB]Dobi:4 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf git armhf 1:2.20.1-2+deb10u3 [4194 kB]Pridobljenih 6137 kB v 1s (5299 kB/s)Selecting previously unselected package libcurl3-gnutls:armhf.(Reading database ... 112757 files and directories currently installed.)Preparing to unpack .../libcurl3-gnutls_7.64.0-4+deb10u1_armhf.deb ...Unpacking libcurl3-gnutls:armhf (7.64.0-4+deb10u1) ...Selecting previously unselected package liberror-perl.Preparing to unpack .../liberror-perl_0.17027-2_all.deb ...Unpacking liberror-perl (0.17027-2) ...Selecting previously unselected package git-man.Preparing to unpack .../git-man_1%3a2.20.1-2+deb10u3_all.deb ...Unpacking git-man (1:2.20.1-2+deb10u3) ...Selecting previously unselected package git.Preparing to unpack .../git_1%3a2.20.1-2+deb10u3_armhf.deb ...Unpacking git (1:2.20.1-2+deb10u3) ...Setting up libcurl3-gnutls:armhf (7.64.0-4+deb10u1) ...Setting up liberror-perl (0.17027-2) ...Setting up git-man (1:2.20.1-2+deb10u3) ...Setting up git (1:2.20.1-2+deb10u3) ...Processing triggers for man-db (2.8.5-2) ...Processing triggers for libc-bin (2.28-10+rpi1) ...webscada@cybrotech:~ $ git config --global user.name "Boris"webscada@cybrotech:~ $ git config --global user.email "boris.perc@gmail.com"webscada@cybrotech:~ $ sudo apt-get install mariadb-client mariadb-server php-mysql php-mbstring -yBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... Narejenomariadb-client is already the newest version (1:10.3.25-0+deb10u1).mariadb-server is already the newest version (1:10.3.25-0+deb10u1).php-mbstring is already the newest version (2:7.4+79+0~20201020.27+debian10~1.gbp95ec92).php-mbstring je bil nastavljen na ročno nameščen.php-mysql is already the newest version (2:7.4+79+0~20201020.27+debian10~1.gbp95ec92).php-mysql je bil nastavljen na ročno nameščen.Naslednji paket je bil samodejno nameščen in ni več zahtevan:  libicu63Uporabite 'sudo apt autoremove' za njegovo odstranitev.0 nadgrajenih, 0 na novo nameščenih, 0 bo odstranjenih in 0 ne nadgrajenih.
webscada@cybrotech:~ $ sudo a2enmod rewriteModule rewrite already enabledwebscada@cybrotech:~ $ sudo mkdir -p /etc/ssl/localcertswebscada@cybrotech:~ $ sudo openssl req -new -x509 -days 1095 -nodes -out /etc/ssl/localcerts/apache.pem -keyout /etc/ssl/localcerts/apache.keyGenerating a RSA private key.................+++++.........................................+++++writing new private key to '/etc/ssl/localcerts/apache.key'-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [AU]:SIState or Province Name (full name) [Some-State]:Slovenija PortoroseLocality Name (eg, city) []:Portorose Piran ObalaOrganization Name (eg, company) [Internet Widgits Pty Ltd]:Piramide Studio HomeCraftSoft@2000Organizational Unit Name (eg, section) []:HandCrafted Software by Boris Perc PCS@1989Common Name (e.g. server FQDN or YOUR name) []:89-212-137-96.static.t-2.netEmail Address []:boris.perc@gmail.comwebscada@cybrotech:~ $ sudo chmod 600 /etc/ssl/localcerts/apache*webscada@cybrotech:~ $ cd /etc/apache2/sites-availablewebscada@cybrotech:/etc/apache2/sites-available $ dir000-default.conf default-ssl.confwebscada@cybrotech:/etc/apache2/sites-available $ sudo nano default-ssl.conf## Kopiraj to pod snokioil generalni ssl od rasbiana:SSLCertificateFile /etc/ssl/localcerts/apache.pemSSLCertificateKeyFile /etc/ssl/localcerts/apache.key
webscada@cybrotech:/etc/apache2/sites-available $ ^Cwebscada@cybrotech:/etc/apache2/sites-available $ sudo a2ensite default-sslEnabling site default-ssl.To activate the new configuration, you need to run:  systemctl reload apache2webscada@cybrotech:/etc/apache2/sites-available $ sudo systemctl reload apache2webscada@cybrotech:/etc/apache2/sites-available $ sudo a2enmod sslConsidering dependency setenvif for ssl:Module setenvif already enabledConsidering dependency mime for ssl:Module mime already enabledConsidering dependency socache_shmcb for ssl:Enabling module socache_shmcb.Enabling module ssl.See /usr/share/doc/apache2/README.Debian.gz on how to configure SSL and create self-signed certificates.To activate the new configuration, you need to run:  systemctl restart apache2webscada@cybrotech:/etc/apache2/sites-available $ suso systemctl restart apache2-bash: suso: ukaza ni mogoče najtiwebscada@cybrotech:/etc/apache2/sites-available $ sudo systemctl restart apache2webscada@cybrotech:/etc/apache2/sites-available $
***************************************************************************************************
# Namesti SSL privat - na kratko - Debian Server 64bit primer!!!sudo apt-get install apache2 opensslsudo mkdir -p /etc/ssl/localcertscd /etc/ssl/localcertssudo openssl req -new -x509 -days 1095 -nodes -out /etc/ssl/localcerts/apache.pem -keyout /etc/ssl/localcerts/apache.key

Country Name (2 letter code) [AU]:SIState or Province Name (full name) [Some-State]:Obala PrimorskaLocality Name (eg, city) []:PortorožOrganization Name (eg, company) [Internet Widgits Pty Ltd]:Piramide StudioOrganizational Unit Name (eg, section) []:HomeCraftSoftCommon Name (e.g. server FQDN or YOUR name) []:MacEmail Address []:pyramide.company@gmail.com

sudo chmod 600 /etc/ssl/localcerts/apache*
sudo a2ensite default-sslsudo a2enmod ssl
sudo systemctl reload apache2
sudo a2ensite default-sslsudo a2ensite ssl

sudo service apache2 restart
***************************************************************************************************

sudo nano /etc/apache2/apache2.conf## Na koncu kopiraj spodnjo direktivo server name je localhost!!!!!ServerName localhost
### spremenite pooblastila za skupino apache se pravi www-data za mapo /var/www/html/## To spodaj obvezno komando v terminalu za dodelit apache oz. www-data skupino za apache uporabnika se pravi www-data:sudo chown www-data:www-data /var/www/html/ -R

### povleci iz interneta ali prenesi svoje datoteke pripravljene:
wget http://www.cybrotech.com/wp-content/uploads/2019/04/CyBroWebScada-v1.1.10-v2.3.0.zip
unzip CyBroWebScada-v1.1.10-v2.3.0.zip
## Namesi php najnovejši 7.4 obvezno ker dela vse hitreje pol ko se da webmin itd... rabi!!! tudi SQL dela 4 krat hitreje zaradi njega!!!!¨!sudo apt updatesudo apt -y install lsb-release apt-transport-https ca-certificatessudo wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpgecho "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/php.listsudo apt updatesudo apt-get install php7.4 libapache2-mod-php7.4 -yphp -v
## Za podporo linux slike vsi formati:sudo apt-get install imagemagick php-imagick libmagickcore-dev -y
sudo apt-get update && sudo apt-get upgrade && sudo apt-get full-upgrade
sudo nano /etc/php/7.4/apache2/php.ini## Zdaj vi npr. za memory limit lahko date 128M ter za post in upload lahko date npr. 512M to spodaj imam jaz za moj Debian Server 64bit, ker je praktično glavni output server oz. izstopni strežnik iz mojega omrežja za vse strežnike se pravi Raspberry PI nadzor pametne hiše ter WindowsNT server za Avdio Studio strojno opremo za snemalni studio večinoma proppelerheads aplikacije kot je Reason6 in ostali strežniki za snemalni studio: max_execution_time = 60memory_limit = 512Mpost_max_size = 2048Mupload_max_filesize = 2048Mlog_errors = Onerror_log = /var/log/php/error.log
# V terminalu ustvarite mapo za napake php in dodelite pooblastila apache za to mapo:
sudo mkdir -p /var/log/phpsudo chown www-data /var/log/php

## Namestite zdaj SQL server s spodnjimi direktivami v vašem terminalu:sudo apt-get install mariadb-server mariadb-client -y

# Namestite phpmyadmin za vaš Raspbian linux 10 32bit:sudo apt-get install phpmyadmin -yphpmyadminbRjSra5JZfQRhumQCR9bnPghHBECbZZH
###Ko to narediš najnovejši phpmyadmin pol tip avtomatično popravi vse buge oz. hrošče!!!!!! samo una dva moraš popravit prej!!!!sudo nano +1963 /usr/share/php/tcpdf/tcpdf.phpsudo nano +551 /usr/share/phpmyadmin/libraries/plugin_interface.lib.php
## Popravite hrošče oz. debugizirajte ali kot mu pravimo razhroščite dve direktive z napakami:sudo nano +551 /usr/share/phpmyadmin/libraries/plugin_interface.lib.php
##Search for if ($options != null && count($options) > 0) = POIZČI SPODNJO DIREKTIVO IN DODAJ SAMO (array) kot je spodaj primer:
sudo nano +551 /usr/share/phpmyadmin/libraries/plugin_interface.lib.php## Popravite alinejo ki se glasi tako:
if ($options != null && count($options) > 0) {## spremenite tako, da izgleda tako:
if ($options != null && count((array)$options) > 0) {
## Ta debugizacija oz. razhroščevanje velja za vse verzije phpmyadmin, če ste ga namistili direktno preko repository-ja oz. baze podatkov namestljivih programov!!!!!## Drugi hrošč je ta spodaj:sudo nano +1963 /usr/share/php/tcpdf/tcpdf.phpTCPDF_FONTS::utf8Bidi(array(''), '', false, $this->isunicode, $this->CurrentFont);###popravite tako oz. debugizirate odpravite hrošča tako da izbrišete zgornje navednice array():TCPDF_FONTS::utf8Bidi(array(), '', false, $this->isunicode, $this->CurrentFont);
## Update phpmyadmin oz. nadgradnja na najnovenšo verzijo phpmyadmin tako:cd /usr/share/phpmyadmin/sudo suwget https://perc.ddns.net/downloads/phpmyadmin504.zipunzip phpmyadmin504.zip
## Zdaj ker so meni vbrizgali iz indije ransomware in so mi hoteli zakleniti SSH port pa jim ni uspelo in so namesto tega mi zaklenili vse email porte tega zgoraj ni več, vi grete na uradno stran phpmyadmin https://www.phpmyadmin.net/, poberete program ga odpakirate na vaš računalnik in pol nazaj zapakirate brez mape phpmyadmin*verzija = zapakirate nazaj z zip brez mape v katero se odpakira phpmyadmin!!!!! npr. phpmyadmin.zip

### rename oz. kopiraj config.inc.sample.php v config.inc.php in skonfiguriraj!!!!!!
root@cybrotech:/usr/share/phpmyadmin# wget https://perc.ddns.net/downloads/phpmyadmin504.zip--2020-11-07 20:55:48-- https://perc.ddns.net/downloads/phpmyadmin504.zipRazreševanje perc.ddns.net (perc.ddns.net) ...89.212.137.96Povezovanje na perc.ddns.net (perc.ddns.net)|89.212.137.96|:443 ... povezano.HTTP zahteva poslana, čakanje na odgovor ... 200 OKDolžina: 14237256 (14M) [application/zip]Shranjevanje v: `phpmyadmin504.zip'
phpmyadmin504.zip 100%[================================>] 13,58M 11,1MB/s in 1,2s
2020-11-07 20:55:50 (11,1 MB/s) - `phpmyadmin504.zip' shranjeno [14237256/14237256]
root@cybrotech:/usr/share/phpmyadmin# unzip phpmyadmin504.zipArchive: phpmyadmin504.zip  inflating: doc/html/bookmarks.html  inflating: doc/html/charts.htmlreplace doc/html/config.html? [y]es, [n]o, [A]ll, [N]one, [r]ename: A
sudo apt install php7.4 && sudo apt install libapache2-mod-php7.4 -ysudo apt install php7.4-{common,mysql,cgi,xml,xmlrpc,curl,gd,imagick,cli,dev,imap,mbstring,opcache,soap,zip,intl,bcmath} -yali tako moduli php:sudo apt install -y php7.4-fpm php7.4-mysql php7.4-dom php7.4-simplexml php-ssh2 php7.4-xml php7.4-xmlreader php7.4-curl php7.4-exif php7.4-ftp php7.4-gd php7.4-iconv php7.4-imagick php7.4-json php7.4-mbstring php7.4-posix php7.4-sockets php7.4-tokenizer
Apache/2.4.38 (Raspbian) Server at 192.168.77.122 Port 443
sudo nano /etc/apache2/mods-enabled/status.conf
<IfModule mod_status.c>        # Allow server status reports generated by mod_status,        # with the URL of http://servername/server-status        # Uncomment and change the "192.0.2.0/24" to allow access from other hosts.
        <Location /server-status>                SetHandler server-status                Require local                Require ip 192.168.1.1/24 Require ip 89.212.137.96 Require ip 93.103.113.142        </Location> ## Obvvezno apache rewrite modul uklopi!!!!!webscada@cybrotech:~ $ sudo a2enmod rewriteEnabling module rewrite.To activate the new configuration, you need to run:  systemctl restart apache2webscada@cybrotech:~ $ sudo systemctl restart apache2

## Zdaj za konec lahko webmin install po temu postopku je bojše ga avtomatiziraš u nullo!!!!WEBMin install:Uredi datoteko:sudo nano /etc/apt/sources.listDodaj na koncu spodnjo direktivo:deb https://download.webmin.com/download/repository sarge contrib
deb http://raspbian.raspberrypi.org/raspbian/ buster main contrib non-free rpi# Uncomment line below then 'apt-get update' to enable 'apt-get source'#deb-src http://raspbian.raspberrypi.org/raspbian/ buster main contrib non-free rpideb https://download.webmin.com/download/repository sarge contrib
###Yes, Sarge is an old Debian version, but this repository is updated regularly
To je isto kot debian - Vse kar maš na rasbian serverju je identično Debian:Za repository oz. source iz kje se nadgrajuje linux:apt sources.list raspbian :
Naslednje je namesti GPG key oz. ključ za nameščat nadgradnje:sudo wget http://www.webmin.com/jcameron-key.ascsudo apt-key add jcameron-key.asc
Na koncu namesti install Webmin:sudo apt updatesudo apt install webmin

sudo apt install git -y
git config --global user.name "Sandi"git config --global user.email "sandi.poberaj@gmail.com"

git config --global user.name "Mac"git config --global user.email "pyramide.company@gmail.com"
git config --global user.name "Boris"git config --global user.email "boris.perc@gmail.com"
sudo adduser webscadasudo passwd webscadaMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
# Password generator!!!!sudo apt install pwgenpwgen -s 32 1# ti generira kodo dolgo 32 mest enkrat!!! da ti ne rabi se vedno izmišljevat kode! zate
GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezela1991';
## preden narediš SQL bazo za saco in za phpmyadmin instaliraj vse to spodaj!!!!!! samo pazi php moduli se tako instalirajo:
- OS update:    $ sudo apt-get update    $ sudo apt-get upgradesudo apt-get install apache2 mariadb-server php7.4 phpmyadmin libapache2-mod-wsgi acl ssh    $ sudo apt-get install python-pip python-mysqldb $ sudo apt-get install python-django python-pip python-mysqldb    $ sudo pip install django==1.3.7    $ sudo pip install pytz    $ sudo apt-get install python-dev python-setuptools    $ sudo apt-get install libjpeg-dev zlib1g-dev    $ sudo pip install pillow

webscada@cybrotech:~ $ sudo pip install django==1.3.7Looking in indexes: https://pypi.org/simple, https://www.piwheels.org/simpleRequirement already satisfied: django==1.3.7 in /usr/local/lib/python2.7/dist-packages (1.3.7)webscada@cybrotech:~ $ sudo pip install pytzLooking in indexes: https://pypi.org/simple, https://www.piwheels.org/simpleRequirement already satisfied: pytz in /usr/local/lib/python2.7/dist-packages (2020.4)webscada@cybrotech:~ $ mkdir /home/webscada/app/solar_cybro/data/cachewebscada@cybrotech:~ $ mkdir /home/webscada/app/solar_cybro/data/mediamkdir: imenika »/home/webscada/app/solar_cybro/data/media« ni mogoče ustvariti: Datoteka že obstajawebscada@cybrotech:~ $ mkdir /home/webscada/app/solar_cybro/data/scriptswebscada@cybrotech:~ $ mkdir /home/webscada/app/solar_cybro/data/webanalizewebscada@cybrotech:~ $ setfacl -m u:www-data:--x $HOMEwebscada@cybrotech:~ $ setfacl -R -m u:www-data:--- $HOME/app/*webscada@cybrotech:~ $ setfacl -R -m u:www-data:rwx $HOME/appwebscada@cybrotech:~ $ setfacl -R -m d:u:www-data:rwx $HOME/appwebscada@cybrotech:~ $ chmod g+s $HOME/appwebscada@cybrotech:~ $ setfacl -R -m d:u:webscada:rwx $HOME/appwebscada@cybrotech:~ $ chmod 755 app/scgi_server/src/cybro_com_server.pywebscada@cybrotech:~ $ chmod 755 app/scgi_server/src/cybro_scgi_server.pywebscada@cybrotech:~ $ chmod 755 app/scgi_server/src/run_scgi_server.pywebscada@cybrotech:~ $
django-admin startproject webscadadjango-admin startproject bazasolardjango-admin startproject uporabniksolar
CREATE DATABASE `bazasolar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;CREATE USER 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS';GRANT ALL PRIVILEGES ON * . * TO 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0;GRANT ALL PRIVILEGES ON `bazasolar` . * TO 'uporabniksolar'@'localhost'; ## To obvezno preden narediš secure install sql!!!! vse pol naredi bazo tako:# TU JE CELOTNI POSTOPEK SAMO KOPIRAŠ TO IN DAŠ V SQL KO SI SE PRIKLOPU:sudo mysql_secure_installationsudo mysql --user=root --password=MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
GRANT SELECT, INSERT, UPDATE, DELETE ON pma_db.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezela1991';GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezela1991';GRANT ALL PRIVILEGES ON *.* TO 'webscada'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;CREATE DATABASE `bazasolar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;CREATE USER 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS';GRANT ALL PRIVILEGES ON * . * TO 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0; GRANT ALL PRIVILEGES ON `bazasolar` . * TO 'uporabniksolar'@'localhost';flush privileges; exit;
sudo nano /etc/php/7.4/apache2/php.inimax_execution_time = 90memory_limit = 128M post_max_size = 128Mupload_max_filesize = 128Mlog_errors = Onerror_log = /var/log/php/error.log
sudo mkdir -p /var/log/phpsudo chown www-data /var/log/php
### Terminal start za na koncu ko vse uštimaš
webscada@cybrotech:~ $ sudo nano /etc/apache2/mods-enabled/status.confwebscada@cybrotech:~ $ sudo nano /etc/apt/sources.listwebscada@cybrotech:~ $ sudo phpenmod mysqliWARNING: Module mysqli ini file doesn't exist under /etc/php/7.3/mods-availableWARNING: Module mysqli ini file doesn't exist under /etc/php/7.3/mods-availablewebscada@cybrotech:~ $ php -vPHP 7.4.12 (cli) (built: Nov 3 2020 14:31:48) ( NTS )Copyright (c) The PHP GroupZend Engine v3.4.0, Copyright (c) Zend Technologies    with Zend OPcache v7.4.12, Copyright (c), by Zend Technologieswebscada@cybrotech:~ $ sudo a2enmod rewriteEnabling module rewrite.To activate the new configuration, you need to run:  systemctl restart apache2webscada@cybrotech:~ $ sudo systemctl restart apache2webscada@cybrotech:~ $ ^Cwebscada@cybrotech:~ $ wget http://www.webmin.com/jcameron-key.asc--2020-11-07 21:45:10-- http://www.webmin.com/jcameron-key.ascRazreševanje www.webmin.com (www.webmin.com) ...216.105.38.11Povezovanje na www.webmin.com (www.webmin.com)|216.105.38.11|:80 ... povezano.HTTP zahteva poslana, čakanje na odgovor ... 301 Moved PermanentlyPoložaj: https://www.webmin.com/jcameron-key.asc [spremljanje]--2020-11-07 21:45:10-- https://www.webmin.com/jcameron-key.ascPovezovanje na www.webmin.com (www.webmin.com)|216.105.38.11|:443 ... povezano.HTTP zahteva poslana, čakanje na odgovor ... 200 OKDolžina: 1320 (1,3K) [text/plain]Shranjevanje v: `jcameron-key.asc'
jcameron-key.asc 100%[================================>] 1,29K --.-KB/s in 0s
2020-11-07 21:45:11 (8,44 MB/s) - `jcameron-key.asc' shranjeno [1320/1320]
webscada@cybrotech:~ $ sudo apt-key add jcameron-key.ascOKwebscada@cybrotech:~ $ sudo apt updateZadetek:1 https://packages.sury.org/php buster InReleaseZadetek:2 http://archive.raspberrypi.org/debian buster InReleaseZadetek:3 http://raspbian.raspberrypi.org/raspbian buster InReleasePrezr:4 https://download.webmin.com/download/repository sarge InReleaseDobi:5 https://download.webmin.com/download/repository sarge Release [16,9 kB]Dobi:6 https://download.webmin.com/download/repository sarge Release.gpg [173 B]Dobi:7 https://download.webmin.com/download/repository sarge/contrib armhf Packages [1381 B]Pridobljenih 18,4 kB v 4s (4999 B/s)Branje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... NarejenoAll packages are up to date.webscada@cybrotech:~ $ sudo apt install webminBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... NarejenoNaslednji paket je bil samodejno nameščen in ni več zahtevan:  libicu63Uporabite 'sudo apt autoremove' za njegovo odstranitev.The following additional packages will be installed:  libauthen-pam-perl libio-pty-perl libnet-ssleay-perl perl-openssl-defaultsNaslednji NOVI paketi bodo nameščeni:  libauthen-pam-perl libio-pty-perl libnet-ssleay-perl perl-openssl-defaults webmin0 nadgrajenih, 5 na novo nameščenih, 0 bo odstranjenih in 0 ne nadgrajenih.Potrebno je dobiti 29,7 MB arhivov.Po tem opravilu bo porabljenega 310 MB dodatnega prostora.Ali želite nadaljevati? [Y/n] yDobi:1 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf perl-openssl-defaults armhf 3 [6782 B]Dobi:2 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf libnet-ssleay-perl armhf 1.85-2+b1 [286 kB]Dobi:3 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf libauthen-pam-perl armhf 0.16-3+b5 [25,9 kB]Dobi:4 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf libio-pty-perl armhf 1:1.08-1.1+b4 [33,0 kB]Dobi:5 https://download.webmin.com/download/repository sarge/contrib armhf webmin all 1.960 [29,3 MB]Pridobljenih 29,7 MB v 5s (6358 kB/s)Selecting previously unselected package perl-openssl-defaults:armhf.(Reading database ... 54565 files and directories currently installed.)Preparing to unpack .../perl-openssl-defaults_3_armhf.deb ...Unpacking perl-openssl-defaults:armhf (3) ...Selecting previously unselected package libnet-ssleay-perl.Preparing to unpack .../libnet-ssleay-perl_1.85-2+b1_armhf.deb ...Unpacking libnet-ssleay-perl (1.85-2+b1) ...Selecting previously unselected package libauthen-pam-perl.Preparing to unpack .../libauthen-pam-perl_0.16-3+b5_armhf.deb ...Unpacking libauthen-pam-perl (0.16-3+b5) ...Selecting previously unselected package libio-pty-perl.Preparing to unpack .../libio-pty-perl_1%3a1.08-1.1+b4_armhf.deb ...Unpacking libio-pty-perl (1:1.08-1.1+b4) ...Selecting previously unselected package webmin.Preparing to unpack .../archives/webmin_1.960_all.deb ...Unpacking webmin (1.960) ...Setting up libio-pty-perl (1:1.08-1.1+b4) ...Setting up perl-openssl-defaults:armhf (3) ...Setting up libauthen-pam-perl (0.16-3+b5) ...Setting up libnet-ssleay-perl (1.85-2+b1) ...Setting up webmin (1.960) ...Webmin install complete. You can now login to https://cybrotech:10000/as root with your root password, or as any user who can use sudoto run commands as root.Processing triggers for man-db (2.8.5-2) ...Processing triggers for systemd (241-7~deb10u4+rpi1) ...webscada@cybrotech:~ $webscada@cybrotech:~ $ sudo apt install git -yBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... NarejenoNaslednji paket je bil samodejno nameščen in ni več zahtevan:  libicu63Uporabite 'sudo apt autoremove' za njegovo odstranitev.The following additional packages will be installed:  git-man libcurl3-gnutls liberror-perlPredlagani paketi:  git-daemon-run | git-daemon-sysvinit git-doc git-el git-email git-gui gitk gitweb git-cvs  git-mediawiki git-svnNaslednji NOVI paketi bodo nameščeni:  git git-man libcurl3-gnutls liberror-perl0 nadgrajenih, 4 na novo nameščenih, 0 bo odstranjenih in 0 ne nadgrajenih.Potrebno je dobiti 6137 kB arhivov.Po tem opravilu bo porabljenega 32,9 MB dodatnega prostora.Dobi:1 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf libcurl3-gnutls armhf 7.64.0-4+deb10u1 [292 kB]Dobi:2 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf liberror-perl all 0.17027-2 [30,9 kB]Dobi:3 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf git-man all 1:2.20.1-2+deb10u3 [1620 kB]Dobi:4 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf git armhf 1:2.20.1-2+deb10u3 [4194 kB]Pridobljenih 6137 kB v 1s (5299 kB/s)Selecting previously unselected package libcurl3-gnutls:armhf.(Reading database ... 112757 files and directories currently installed.)Preparing to unpack .../libcurl3-gnutls_7.64.0-4+deb10u1_armhf.deb ...Unpacking libcurl3-gnutls:armhf (7.64.0-4+deb10u1) ...Selecting previously unselected package liberror-perl.Preparing to unpack .../liberror-perl_0.17027-2_all.deb ...Unpacking liberror-perl (0.17027-2) ...Selecting previously unselected package git-man.Preparing to unpack .../git-man_1%3a2.20.1-2+deb10u3_all.deb ...Unpacking git-man (1:2.20.1-2+deb10u3) ...Selecting previously unselected package git.Preparing to unpack .../git_1%3a2.20.1-2+deb10u3_armhf.deb ...Unpacking git (1:2.20.1-2+deb10u3) ...Setting up libcurl3-gnutls:armhf (7.64.0-4+deb10u1) ...Setting up liberror-perl (0.17027-2) ...Setting up git-man (1:2.20.1-2+deb10u3) ...Setting up git (1:2.20.1-2+deb10u3) ...Processing triggers for man-db (2.8.5-2) ...Processing triggers for libc-bin (2.28-10+rpi1) ...webscada@cybrotech:~ $ git config --global user.name "Boris"webscada@cybrotech:~ $ git config --global user.email "boris.perc@gmail.com"webscada@cybrotech:~ $ sudo apt-get install mariadb-client mariadb-server php-mysql php-mbstring -yBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... Narejenomariadb-client is already the newest version (1:10.3.25-0+deb10u1).mariadb-server is already the newest version (1:10.3.25-0+deb10u1).php-mbstring is already the newest version (2:7.4+79+0~20201020.27+debian10~1.gbp95ec92).php-mbstring je bil nastavljen na ročno nameščen.php-mysql is already the newest version (2:7.4+79+0~20201020.27+debian10~1.gbp95ec92).php-mysql je bil nastavljen na ročno nameščen.Naslednji paket je bil samodejno nameščen in ni več zahtevan:  libicu63Uporabite 'sudo apt autoremove' za njegovo odstranitev.0 nadgrajenih, 0 na novo nameščenih, 0 bo odstranjenih in 0 ne nadgrajenih.webscada@cybrotech:~ $ sudo phpenmod mysqliWARNING: Module mysqli ini file doesn't exist under /etc/php/7.3/mods-availableWARNING: Module mysqli ini file doesn't exist under /etc/php/7.3/mods-availablewebscada@cybrotech:~ $ sudo a2enmod rewriteModule rewrite already enabledwebscada@cybrotech:~ $ sudo mkdir -p /etc/ssl/localcertswebscada@cybrotech:~ $ sudo openssl req -new -x509 -days 1095 -nodes -out /etc/ssl/localcerts/apache.pem -keyout /etc/ssl/localcerts/apache.keyGenerating a RSA private key.................+++++.........................................+++++writing new private key to '/etc/ssl/localcerts/apache.key'-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [AU]:SIState or Province Name (full name) [Some-State]:Slovenija PortoroseLocality Name (eg, city) []:Portorose Piran ObalaOrganization Name (eg, company) [Internet Widgits Pty Ltd]:Piramide Studio HomeCraftSoft@2000Organizational Unit Name (eg, section) []:HandCrafted Software by Boris Perc PCS@1989Common Name (e.g. server FQDN or YOUR name) []:89-212-137-96.static.t-2.netEmail Address []:boris.perc@gmail.comwebscada@cybrotech:~ $ sudo chmod 600 /etc/ssl/localcerts/apache*webscada@cybrotech:~ $ cd /etc/apache2/sites-availablewebscada@cybrotech:/etc/apache2/sites-available $ dir000-default.conf default-ssl.confwebscada@cybrotech:/etc/apache2/sites-available $ sudo nano default-ssl.confwebscada@cybrotech:/etc/apache2/sites-available $ ^Cwebscada@cybrotech:/etc/apache2/sites-available $ sudo a2ensite default-sslEnabling site default-ssl.To activate the new configuration, you need to run:  systemctl reload apache2webscada@cybrotech:/etc/apache2/sites-available $ sudo systemctl reload apache2webscada@cybrotech:/etc/apache2/sites-available $ sudo a2enmod sslConsidering dependency setenvif for ssl:Module setenvif already enabledConsidering dependency mime for ssl:Module mime already enabledConsidering dependency socache_shmcb for ssl:Enabling module socache_shmcb.Enabling module ssl.See /usr/share/doc/apache2/README.Debian.gz on how to configure SSL and create self-signed certificates.To activate the new configuration, you need to run:  systemctl restart apache2webscada@cybrotech:/etc/apache2/sites-available $ suso systemctl restart apache2-bash: suso: ukaza ni mogoče najtiwebscada@cybrotech:/etc/apache2/sites-available $ sudo systemctl restart apache2webscada@cybrotech:/etc/apache2/sites-available $ ^Cwebscada@cybrotech:/etc/apache2/sites-available $ cdwebscada@cybrotech:~ $ sudo apt-get updateZadetek:1 http://archive.raspberrypi.org/debian buster InReleaseZadetek:2 http://raspbian.raspberrypi.org/raspbian buster InReleaseZadetek:3 https://packages.sury.org/php buster InReleasePrezr:4 https://download.webmin.com/download/repository sarge InReleaseZadetek:5 https://download.webmin.com/download/repository sarge ReleaseBranje seznama paketov ... Narejenowebscada@cybrotech:~ $ sudo apt install php-mbstring php-zip php-gdBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... Narejenophp-gd is already the newest version (2:7.4+79+0~20201020.27+debian10~1.gbp95ec92).php-gd je bil nastavljen na ročno nameščen.php-mbstring is already the newest version (2:7.4+79+0~20201020.27+debian10~1.gbp95ec92).php-zip is already the newest version (2:7.4+79+0~20201020.27+debian10~1.gbp95ec92).php-zip je bil nastavljen na ročno nameščen.Naslednji paket je bil samodejno nameščen in ni več zahtevan:  libicu63Uporabite 'sudo apt autoremove' za njegovo odstranitev.0 nadgrajenih, 0 na novo nameščenih, 0 bo odstranjenih in 0 ne nadgrajenih.webscada@cybrotech:~ $ sudo apt install pwgenBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... NarejenoNaslednji paket je bil samodejno nameščen in ni več zahtevan:  libicu63Uporabite 'sudo apt autoremove' za njegovo odstranitev.Naslednji NOVI paketi bodo nameščeni:  pwgen0 nadgrajenih, 1 na novo nameščenih, 0 bo odstranjenih in 0 ne nadgrajenih.Potrebno je dobiti 17,1 kB arhivov.Po tem opravilu bo porabljenega 43,0 kB dodatnega prostora.Dobi:1 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf pwgen armhf 2.08-1 [17,1 kB]Pridobljenih 17,1 kB v 0s (42,1 kB/s)Selecting previously unselected package pwgen.(Reading database ... 113708 files and directories currently installed.)Preparing to unpack .../pwgen_2.08-1_armhf.deb ...Unpacking pwgen (2.08-1) ...Setting up pwgen (2.08-1) ...Processing triggers for man-db (2.8.5-2) ...webscada@cybrotech:~ $ pwgen -s 32 1ff5t9SVwcfJDF4LRyEb2bvEauQqPY1gWwebscada@cybrotech:~ $ sudo mariadb < /usr/share/phpmyadmin/sql/create_tables.sqlwebscada@cybrotech:~ $ sudo mysql_secure_installation
NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB      SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!
In order to log into MariaDB to secure it, we'll need the currentpassword for the root user. If you've just installed MariaDB, andyou haven't set the root password yet, the password will be blank,so you should just press enter here.
Enter current password for root (enter for none):OK, successfully used password, moving on...
Setting the root password ensures that nobody can log into the MariaDBroot user without the proper authorisation.
You already have a root password set, so you can safely answer 'n'.
Change the root password? [Y/n] n ... skipping.
By default, a MariaDB installation has an anonymous user, allowing anyoneto log into MariaDB without having to have a user account created forthem. This is intended only for testing, and to make the installationgo a bit smoother. You should remove them before moving into aproduction environment.
Remove anonymous users? [Y/n] y ... Success!
Normally, root should only be allowed to connect from 'localhost'. Thisensures that someone cannot guess at the root password from the network.
Disallow root login remotely? [Y/n] y ... Success!
By default, MariaDB comes with a database named 'test' that anyone canaccess. This is also intended only for testing, and should be removedbefore moving into a production environment.
Remove test database and access to it? [Y/n] y - Dropping test database... ... Success! - Removing privileges on test database... ... Success!
Reloading the privilege tables will ensure that all changes made so farwill take effect immediately.
Reload privilege tables now? [Y/n] y ... Success!
Cleaning up...
All done! If you've completed all of the above steps, your MariaDBinstallation should now be secure.
Thanks for using MariaDB!webscada@cybrotech:~ $ sudo apt-get updateZadetek:1 http://raspbian.raspberrypi.org/raspbian buster InReleaseZadetek:2 https://packages.sury.org/php buster InReleaseZadetek:3 http://archive.raspberrypi.org/debian buster InReleasePrezr:4 https://download.webmin.com/download/repository sarge InReleaseZadetek:5 https://download.webmin.com/download/repository sarge ReleaseBranje seznama paketov ... Narejenowebscada@cybrotech:~ $ sudo apt-get upgradeBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... NarejenoPreračunavanje nadgradnje ... NarejenoNaslednji paket je bil samodejno nameščen in ni več zahtevan:  libicu63Uporabite 'sudo apt autoremove' za njegovo odstranitev.0 nadgrajenih, 0 na novo nameščenih, 0 bo odstranjenih in 0 ne nadgrajenih.webscada@cybrotech:~ $ sudo apt-get install apache2 mariadb-server php7.4 phpmyadmin libapache2-mod-wsgi acl sshBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... Narejenoapache2 is already the newest version (2.4.38-3+deb10u4).mariadb-server is already the newest version (1:10.3.25-0+deb10u1).phpmyadmin is already the newest version (4:4.6.6-5).ssh is already the newest version (1:7.9p1-10+deb10u2).php7.4 is already the newest version (7.4.12-3+0~20201103.32+debian10~1.gbpa97e22).Naslednji paket je bil samodejno nameščen in ni več zahtevan:  libicu63Uporabite 'sudo apt autoremove' za njegovo odstranitev.Naslednji NOVI paketi bodo nameščeni:  acl libapache2-mod-wsgi0 nadgrajenih, 2 na novo nameščenih, 0 bo odstranjenih in 0 ne nadgrajenih.Potrebno je dobiti 142 kB arhivov.Po tem opravilu bo porabljenega 434 kB dodatnega prostora.Ali želite nadaljevati? [Y/n] yDobi:1 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf acl armhf 2.2.53-4 [56,0 kB]Dobi:2 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf libapache2-mod-wsgi armhf 4.6.5-1 [85,6 kB]Pridobljenih 142 kB v 1s (276 kB/s)Selecting previously unselected package acl.(Reading database ... 113713 files and directories currently installed.)Preparing to unpack .../acl_2.2.53-4_armhf.deb ...Unpacking acl (2.2.53-4) ...Selecting previously unselected package libapache2-mod-wsgi.Preparing to unpack .../libapache2-mod-wsgi_4.6.5-1_armhf.deb ...Unpacking libapache2-mod-wsgi (4.6.5-1) ...Setting up libapache2-mod-wsgi (4.6.5-1) ...apache2_invoke: Enable module wsgiSetting up acl (2.2.53-4) ...Processing triggers for man-db (2.8.5-2) ...webscada@cybrotech:~ $ sudo apt-get install python-pip python-mysqldbBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... Narejenopython-pip is already the newest version (18.1-5+rpt1).Naslednji paket je bil samodejno nameščen in ni več zahtevan:  libicu63Uporabite 'sudo apt autoremove' za njegovo odstranitev.Predlagani paketi:  python-egenix-mxdatetime python-mysqldb-dbgNaslednji NOVI paketi bodo nameščeni:  python-mysqldb0 nadgrajenih, 1 na novo nameščenih, 0 bo odstranjenih in 0 ne nadgrajenih.Potrebno je dobiti 56,3 kB arhivov.Po tem opravilu bo porabljenega 183 kB dodatnega prostora.Ali želite nadaljevati? [Y/n] yDobi:1 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf python-mysqldb armhf 1.3.10-2+b1 [56,3 kB]Pridobljenih 56,3 kB v 0s (207 kB/s)Selecting previously unselected package python-mysqldb.(Reading database ... 113741 files and directories currently installed.)Preparing to unpack .../python-mysqldb_1.3.10-2+b1_armhf.deb ...Unpacking python-mysqldb (1.3.10-2+b1) ...Setting up python-mysqldb (1.3.10-2+b1) ...webscada@cybrotech:~ $ sudo pip install django==1.3.7Looking in indexes: https://pypi.org/simple, https://www.piwheels.org/simpleCollecting django==1.3.7  Downloading https://files.pythonhosted.org/packages/0d/f1/fe4cf23cea3322dd8883a0510538fe916ab2023c648997976798142603ff/Django-1.3.7.tar.gz (6.5MB)    100% |████████████████████████████████| 6.5MB 61kB/sBuilding wheels for collected packages: django  Running setup.py bdist_wheel for django ... done  Stored in directory: /root/.cache/pip/wheels/df/fd/6f/7c60b5b331f27c00589cf76365e67f5abbb3f428b84b60a9d1Successfully built djangoInstalling collected packages: djangoSuccessfully installed django-1.3.7webscada@cybrotech:~ $ sudo pip install pytzLooking in indexes: https://pypi.org/simple, https://www.piwheels.org/simpleCollecting pytz  Downloading https://files.pythonhosted.org/packages/12/f8/ff09af6ff61a3efaad5f61ba5facdf17e7722c4393f7d8a66674d2dbd29f/pytz-2020.4-py2.py3-none-any.whl (509kB)    100% |████████████████████████████████| 512kB 743kB/sInstalling collected packages: pytzSuccessfully installed pytz-2020.4webscada@cybrotech:~ $ sudo apt-get install python-dev python-setuptoolsBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... Narejenopython-dev is already the newest version (2.7.16-1).python-dev je bil nastavljen na ročno nameščen.python-setuptools is already the newest version (40.8.0-1).python-setuptools je bil nastavljen na ročno nameščen.Naslednji paket je bil samodejno nameščen in ni več zahtevan:  libicu63Uporabite 'sudo apt autoremove' za njegovo odstranitev.0 nadgrajenih, 0 na novo nameščenih, 0 bo odstranjenih in 0 ne nadgrajenih.webscada@cybrotech:~ $ sudo apt-get install libjpeg-dev zlib1g-devBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... Narejenolibjpeg-dev is already the newest version (1:1.5.2-2).libjpeg-dev je bil nastavljen na ročno nameščen.zlib1g-dev is already the newest version (1:1.2.11.dfsg-1).zlib1g-dev je bil nastavljen na ročno nameščen.Naslednji paket je bil samodejno nameščen in ni več zahtevan:  libicu63Uporabite 'sudo apt autoremove' za njegovo odstranitev.0 nadgrajenih, 0 na novo nameščenih, 0 bo odstranjenih in 0 ne nadgrajenih.webscada@cybrotech:~ $ sudo pip install pillowLooking in indexes: https://pypi.org/simple, https://www.piwheels.org/simpleCollecting pillow  Downloading https://files.pythonhosted.org/packages/b3/d0/a20d8440b71adfbf133452d4f6e0fe80de2df7c2578c9b498fb812083383/Pillow-6.2.2.tar.gz (37.8MB)    100% |████████████████████████████████| 37.8MB 7.9kB/sBuilding wheels for collected packages: pillow  Running setup.py bdist_wheel for pillow ... done  Stored in directory: /root/.cache/pip/wheels/f6/0a/7c/5e6567101a10388b915c4ebf73edb849f73908ad154e9eb9bcSuccessfully built pillowInstalling collected packages: pillowSuccessfully installed pillow-6.2.2webscada@cybrotech:~ $ sudo mysql --user=root --password=MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015PrimerWelcome to the MariaDB monitor. Commands end with ; or \g.Your MariaDB connection id is 121Server version: 10.3.25-MariaDB-0+deb10u1 Raspbian 10
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> GRANT SELECT, INSERT, UPDATE, DELETE ON pma_db.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezala1991';Query OK, 0 rows affected (0.001 sec)MariaDB [(none)]> GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezala1991';Query OK, 0 rows affected (0.001 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON *.* TO 'webscada'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;Query OK, 0 rows affected (0.000 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;Query OK, 0 rows affected (0.000 sec)
MariaDB [(none)]> CREATE DATABASE `bazasolar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;Query OK, 1 row affected (0.005 sec)
MariaDB [(none)]> CREATE USER 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS';Query OK, 0 rows affected (0.001 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON * . * TO 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0;Query OK, 0 rows affected (0.001 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON `bazasolar` . * TO 'uporabniksolar'@'localhost';Query OK, 0 rows affected (0.001 sec)
MariaDB [(none)]> flush privileges;Query OK, 0 rows affected (0.001 sec)
MariaDB [(none)]> exit;Byewebscada@cybrotech:~ $

##### Terninal end

sudo mysql_secure_installationsudo mysql --user=root --password=MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
## To prvo je če hočeš menjat kodo root ma ko daš secure install te vse to vpraša prvi odgovor Y vsi drugi N#CREATE DATABASE `bazasolar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;#SET PASSWORD FOR 'root'@'127.0.0.1' = PASSWORD('MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer');#SET PASSWORD FOR 'root'@'::1' = PASSWORD('MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer');#SET PASSWORD FOR 'root'@'localhost' = PASSWORD('MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer');
## Za menjat kodo root:SET PASSWORD FOR 'root'@'127.0.0.1' = PASSWORD('MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer');SET PASSWORD FOR 'root'@'::1' = PASSWORD('MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer');SET PASSWORD FOR 'root'@'localhost' = PASSWORD('MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer');
# Ti moraš ustvarit samo bazo podtkov in userja!!!!!CREATE USER 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS';create database bazasolar;
# Če hočeš da ti phpmyadmin bezeli vse naredi to:GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezala1991';GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;
GRANT SELECT, INSERT, UPDATE, DELETE ON pma_db.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezela1991';GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezela1991';GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL ON *.* TO 'webscada'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;FLUSH PRIVILEGES;exit
# Pravilni postopek zažgeš samo te spodaj v SQL komande:CREATE DATABASE `bazasolar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;create user 'uporabniksolar'@'localhost' identified by 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS';GRANT ALL PRIVILEGES ON * . * TO 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0;GRANT ALL PRIVILEGES ON `bazasolar` . * TO 'uporabniksolar'@'localhost';flush privileges; exit;

CREATE DATABASE `bazasolar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;SET PASSWORD FOR 'root'@'127.0.0.1' = PASSWORD('MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer');SET PASSWORD FOR 'root'@'::1' = PASSWORD('MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer');SET PASSWORD FOR 'root'@'localhost' = PASSWORD('MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer');
## To kopiraš v SQL če hočeš da ti še phpmyadmin dela: https://docs.phpmyadmin.net/en/latest/config.html
GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezala1991';GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT SELECT, INSERT, UPDATE, DELETE ON <pma_db>.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezala1991';GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezala1991';GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL ON *.* TO 'webscada'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;flush privileges; exit;
# TU JE CELOTNI POSTOPEK SAMO KOPIRAŠ TO IN DAŠ V SQL KO SI SE PRIKLOPU:sudo mysql_secure_installationsudo mysql --user=root --password=MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
GRANT SELECT, INSERT, UPDATE, DELETE ON <pma_db>.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezala1991';GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezala1991';GRANT ALL PRIVILEGES ON *.* TO 'webscada'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;
CREATE DATABASE `bazasolar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;CREATE USER 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS';GRANT ALL PRIVILEGES ON * . * TO 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0; GRANT ALL PRIVILEGES ON `bazasolar` . * TO 'uporabniksolar'@'localhost';flush privileges; exit;

webscada@handcraftedsoftware:~ $ sudo mysql --user=root --password=MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer

DATABASE_ENGINE = 'mysql' # 'postgresql_psycopg2', 'postgresql', 'mysql', 'sqlite3' or 'ora$DATABASE_NAME = 'bazasolar' # Or path to database file if using sqlite3.DATABASE_USER = 'uporabniksolar' # Not used with sqlite3.DATABASE_PASSWORD = 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS' # Not used with sqlite3.DATABASE_HOST = 'localhost' # Set to empty string for localhost. Not used with sqlit$DATABASE_PORT = '3306' # Set to empty string for default. Not used with sqlite3.
sudo nano /home/webscada/app/scgi_server/src/sys_config.pysudo nano /home/webscada/app/solar_cybro/project/settings_local.py
django-admin startproject bazasolardjango-admin startproject uporabniksolardjango-admin startproject webscada

# Namesti SSL privat!!!sudo apt-get install apache2 opensslsudo mkdir -p /etc/ssl/localcertscd /etc/ssl/localcertssudo openssl req -new -x509 -days 1095 -nodes -out /etc/ssl/localcerts/apache.pem -keyout /etc/ssl/localcerts/apache.key

Country Name (2 letter code) [AU]:SIState or Province Name (full name) [Some-State]:Obala PrimorskaLocality Name (eg, city) []:PortorožOrganization Name (eg, company) [Internet Widgits Pty Ltd]:Piramide StudioOrganizational Unit Name (eg, section) []:HomeCraftSoftCommon Name (e.g. server FQDN or YOUR name) []:MacEmail Address []:pyramide.company@gmail.com

sudo chmod 600 /etc/ssl/localcerts/apache*
sudo a2ensite default-sslsudo a2enmod ssl
sudo systemctl reload apache2
sudo a2ensite default-sslsudo a2ensite ssl
sudo a2enmod ssl

sudo mysql --user=root --password=MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
Log into mysql shell
  mysql -u <user> -p
Run mysql commands to create cybro database:
  create database cybro;  use cybro;  source db_scgi_create_v303.sql
Enable zero date mode:
  SET GLOBAL sql_mode = 'NO_ZERO_IN_DATE';
Grant all privileges on a database:
  GRANT ALL ON cybro .* TO <user> IDENTIFIED BY <password>;
GRANT ALL PRIVILEGES ON `cybro` . * TO 'uporabniksolar'@'localhost';
When finished, enter dbase connection parameters to config.ini.
create database cybro;use cybro;source db_scgi_create_v303.sqlSET GLOBAL sql_mode = 'NO_ZERO_IN_DATE';GRANT ALL ON cybro .* TO `uporabniksolar` IDENTIFIED BY `efbaJSgyxGyCGQg43tSqzVdC8VygAcTS`;
GRANT ALL PRIVILEGES ON `cybro` . * TO 'uporabniksolar'@'localhost';GRANT ALL PRIVILEGES ON `cybro` . * TO 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS'
CREATE DATABASE `bazasolar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;create database bazasolar;create user 'uporabniksolar'@'localhost' identified by 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS';GRANT ALL PRIVILEGES ON * . * TO 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0;GRANT ALL PRIVILEGES ON `bazasolar` . * TO 'uporabniksolar'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezala1991';GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;
GRANT SELECT, INSERT, UPDATE, DELETE ON <pma_db>.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezala1991';GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezala1991';GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL ON *.* TO 'webscada'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL ON *.* TO 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS' WITH GRANT OPTION;

flush privileges; exit;

sudo adduser webscadasudo passwd webscadaMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
## Tako zdaj namestite ko je vse instalirano še SQL bazo podatkov za webscado in za phpmyadmin glavno bazo za uprabljat preko phpmyadmin isto kot preko terminala, logično da je boljše phpmyadmin saj imate MariaDB SQL server in client zelo lepo grafično prikazano in bolj pregledno za vse funkcije, čeprav vse to isto naredite preko terminala, ampak ja lažje da delate vse preko phpmyadmin - se pravi generirat nove baze, nove uporabnike menjavat kode za določene baze itd......
sudo mysql_secure_installation# Prvi ogdovor N oz. NE menjaj root kode za SQL pol vsi ostali odgovori so Y oz. DA zbriši vse testne sql baze in račune testne oz. anonimne za sql itd.....# Prijavi se preko terminala v SQL server tako da zažgeš spodnjo komando seveda vaša koda root za SQL!!!!sudo mysql --user=root --password=MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezala1991';GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT SELECT, INSERT, UPDATE, DELETE ON <pma_db>.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezala1991';GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezala1991';GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL ON *.* TO 'webscada'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL ON *.* TO 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS' WITH GRANT OPTION;FLUSH PRIVILEGES;exit
#CREATE DATABASE `bazasolar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;#SET PASSWORD FOR 'webscada'@'127.0.0.1' = PASSWORD('MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer');#SET PASSWORD FOR 'webscada'@'::1' = PASSWORD('MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer');#SET PASSWORD FOR 'webscada'@'localhost' = PASSWORD('MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer');
##NE DELAJ TEGA menjavanje root kode za SQL server!!! pustite uno kodo kot imate za linux sudo račun!!!!!:#SET PASSWORD FOR 'uporabniksolar'@'127.0.0.1' = PASSWORD('efbaJSgyxGyCGQg43tSqzVdC8VygAcTS');#SET PASSWORD FOR 'uporabniksolar'@'::1' = PASSWORD('efbaJSgyxGyCGQg43tSqzVdC8VygAcTS');#SET PASSWORD FOR 'uporabniksolar'@'localhost' = PASSWORD('efbaJSgyxGyCGQg43tSqzVdC8VygAcTS');#CREATE USER 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS';
CREATE DATABASE `bazasolar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;create database bazasolar;create user 'uporabniksolar'@'localhost' identified by 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS';GRANT ALL PRIVILEGES ON * . * TO 'uporabniksolar'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0;GRANT ALL PRIVILEGES ON `bazasolar` . * TO 'uporabniksolar'@'localhost';flush privileges; exit;

DATABASE_ENGINE = 'mysql' # 'postgresql_psycopg2', 'postgresql', 'mysql', 'sqlite3' or 'ora$DATABASE_NAME = 'bazasolar' # Or path to database file if using sqlite3.DATABASE_USER = 'uporabniksolar' # Not used with sqlite3.DATABASE_PASSWORD = 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS' # Not used with sqlite3.DATABASE_HOST = 'localhost' # Set to empty string for localhost. Not used with sqlit$DATABASE_PORT = '3306' # Set to empty string for default. Not used with sqlite3.
WEBSCADA SQL:DATABASE_ENGINE = 'mysql' # 'postgresql_psycopg2', 'postgresql', 'mysql', 'sqlite3' or 'ora$DATABASE_NAME = 'bazasolar' # Or path to database file if using sqlite3.DATABASE_USER = 'uporabniksolar' # Not used with sqlite3.DATABASE_PASSWORD = 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS' # Not used with sqlite3.DATABASE_HOST = 'localhost' # Set to empty string for localhost. Not used with sqlit$DATABASE_PORT = '3306' # Set to empty string for default. Not used with sqlite3.
CREATE DATABASE `solar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;CREATE USER 'webscada'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS';GRANT ALL PRIVILEGES ON * . * TO 'webscada'@'localhost' IDENTIFIED BY 'efbaJSgyxGyCGQg43tSqzVdC8VygAcTS' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0;GRANT ALL PRIVILEGES ON `solar` . * TO 'webscada'@'localhost';flush privileges; exit;
## Uvozite tiste dve sql baze ki so v vaši mapi /home/webscada/doc/ preko phpmyadmin tako da se prijavite v phpmyadmin pod vašim uporabnikom ki ste ustravili za sql in z geslom ki sta ga določili za sql npr. baza solar in uporabnik solaruporabnik, se pravi v phpmyadmin za uporanbiško ime npr. uporabniksolar in geslo ki ste ga določili za tega uporabnika in naložite tiste dve SQL baze od robotina.si solar.sql in time_zone.sql te dve baze od robotina.si uvozite v vaš sql račun uporanbika kar perko phpmyadmin ali lahko tudi preko terminala po želji!!!

Zdaj spodnji postopek je podobno kot zgornji, ki je opisan za Raspbian 10 Buster original 32bit OS - to spodaj postopek za npr. Ubuntu Server 64bit ali npr. Debian 10 Buster 64bit operacijski sistem - NE POZABIT ČE NAMEŠČATE VAŠ STREŽNIK NPR. KONVERTIRATE EN STARI RAČUNALNIK V STREŽNIK OZ. SERVER OBVEZNO ČE IMATE SAMO 4GB RAMA SI NAMESTITE 32bit OS, DRUGAČE ČE IMATE VEČ KOT 4GB RAMA NPR. 8 ALI 16GB RAMA POL OBVEZNO SI NAMESTITE 64BIT OPERACIJSKI SISTEM - UBUNTU ALI DEBIAN ALI KARKOLI DRUGEGA CENTOS, FEDORA, ITD... PO VAŠI IZBIRI OZ. TISTEGA, KATEREGA NAJBOLJE OBVLADUJETE OZ. SE NAVAJENI DELATI Z NJIM!!!!

############################################################################################################# ISTI POSTOPEK SAMO TUKAJ ŠE ZRAVEN NADGRADNJA PHPMYADMIN - WEBMIN - MALTRAIL #################################################################################################################moj osebni postopek namestitve webscada na virtualni računalnik Debian Buster 10 Linux 64bit isto kot zgoraj za raspbian linux se pravi 32bit samo tukaj predstavljeno za 64bitna arhitektura računalnika Debian/Ubuntu Server!!!

E = sandi.poberaj@gmail.comCN = sandi-webscadaOU = SandiWebScadaO = SandiWebScadaL = IzolaS = SlovenijaC = SIsudo tail /var/log/apache2/error.logsudo tail /var/log/apache2/error.log
Hostneme: cybrotech === pol greš na freenom.com in istko kot za noip.com daj si ene par domen registriraj in naredi za vsako mapo, mail, ddlenigma, scada je itak prvi host port 80 oz. prvi host var/www/html ker ti maš drugače pol narediš za enigmo ali wordpress mape npr. /var/www/ddl/ in /var/www/wp/ in ustvarjene mape in vse skripte čovnaj www-data:www-data oz. vedno greš v mapo /var/www in zažgeš: sudo chown -R www-data: . tako da ti da vse skripte in v apache in v grupo apache isto kot narediš za scado na drugi lokaciji štekaš home/ecc... isti kurac saj večina ima server apache za stranke ko kupiš gostovanje www-data oz. apache je vedno /home/uporabnik/html_docs/ ali eni majo samo html in v tej mapi pol katerakoli webappd drupal, wordpress, prestaShop, medija server, audio server, itd....sudo chown -R www-data: .
sudo chown --recursive username:groupname /home/user/website/sudo systemctl restart apache2ps aux | grep apache2
sudo find /var/www/html/ -type d -exec chmod 750 {} \;sudo find /var/www/html/ -type f -exec chmod 640 {} \;

## Primeri samo čovnanje map ali komplet ko stojiš na določeni mapi in vse poddmape dodeljenje določenemu uporabniku se pravi npr. www-data: to pomeni uporabnik in če daš . pomeni pod njegovo grupo npr. primer cd /var/www/app/ uporabiš za to mapo in vse podmape dodelit uporabnikuk in grupi npr. sandi:sandi ali če is na mapi daš da vse podmape še čovna isti uporabnik in grupa chown -R sandi: . lahko pol za loge daš točno določeno se pravi sanid:adm ali sandi:root in maš pol na uni mapi ista pooblastila kot root itd...
# čovnanje oz. dodeljenje uporabnika in grupe za določene virtual hoste apache virtual hosti za apache se nahajajo od mape www to je null mapa in pol vsako mapo ki ustraviš in čovnaš www-data:www-data pomeni virtualni host, lahko kot sem ti reku spremeniš za krajše pisanje v apache da je www-data user in www-data grupa tako apache:apache sudo nano /etc/apache2/apache2.conf User apache in Group apache da ti je lažje pisanje meni je isti kurac slepo tipkam tako da isto hitro vpišen eno ali drugo. lahko čovnaš oz. dodeliš pooblastila za določeno mapo ponavadi kot je scada ali vse apps ki jih nameščaš preko /home/uporabnik/www-data ali karkoli v tvojem primeru je home/scada/app/)Password: samo to spremeni pol vse povsod v apache glavna config se pravi: sudo chown -R www-data:www-data /var/www/html/sudo chown -R cybrotech:cybrotech /var/www/app/sudo chown -R linuxter: .sudo chown -R root: .sudo chown -R perc: .sudo chown -R mac: .sudo chown -R www-data: .
Raspberry PI4 4GB RAM 16MB GPU Minimal install Sandi WEB Scadahostname: sandiwebscada
## CPU Temp Reading and analysing log files in the RRD database formatsudo apt install sudo apt-get install rrdtool librrd-dev librrds-perlsudo apt install lm-sensors
sudo apt install rrdtool librrds-perl && sudo apt install lm-sensors python-is-python3## WEB Min prikaz temperature temp show - Raspberry PI:sudo apt install lm-sensors
$ cat /sys/class/thermal/thermal_zone0/temp39546$ vcgencmd measure_temptemp=39.0'C$ vcgencmd measure_voltsvolt=1.200V$ vcgencmd measure_clock armfrequency(45)=700072000
[~]$ cat /sys/class/thermal/thermal_zone0/type bcm2835_thermal[~]$ cat /sys/class/thermal/thermal_zone0/temp 45464[~]$ awk '{printf("\nrPI Temperature = %.1f °C\n\n",$1/1e3)}' /sys/class/thermal/thermal_zone0/temp
rPI Temperature = 44.9 °C

sudo adduser webscadasudo passwd webscadaMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser borissudo passwd borisMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser sandisudo passwd sandiMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser igorMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer

sudo adduser stranka1sudo passwd SandiWEBScada1977Slovenija
sudo adduser stranka2sudo passwd SandiWEBScada1977Slovenija
sudo adduser stranka3sudo passwd SandiWEBScada1977Slovenija
sudo adduser stranka4sudo passwd SandiWEBScada1977Slovenija
sudo adduser stranka5sudo passwd SandiWEBScada1977Slovenija

--- Dodeljenje strežnika in sql baz ter vseh serverjev in mailov samo tej uporabniki, manjaj admin password v kaj hard plus admin password nima pooblastil za dostop kot root v SQL samo naši spodnji računi lahko direkt preko phpmyadmin še lepše in boljše dodeliš pooblastila nrediš bazo in uporabnike za bazo full poenostavljeno saj zato pa je phpmyadmin da ti vizualizira sql server ti ne rabi bit v terminalu saj konckoncev je isti kurac ma tu je boljše in hitreje vse buckup, popravki itd... čiščenje tabel to isto se da preko terminala ma je cela procedura lepše preko phpmydmin in lažje isto kot webmin to je praktično nadzor celotnega serverja in delovanje vse na enem mestu, lahko delaš ja preko tereminala ma brezveze ker maš isto to v webmin in dosti bolj pregledno, odzipanje zipanje, varnostne kopije, nagalanje, ne rabiš praktično FTP serverja ma tudi on ne škodi isti kurac itak mi uporabljamo za ftp ssh skozi sftp povezavo ko se povežeš preko filezila ssh over sftp ali si namestiš proftpd in tam maš v webminu full enostavno vse ssl certifikat za prot 21 in ti je praktično isti kurac kot port 22, pazi ssh povezava je med pcji in nalaganjem bolj varna kot ftp, če pa narediš sftp oz. tls to je ssl certifikat pol ti je isti kurac kot ssh povezava na server in spreminjanje podatkov ma pazi ker tudi preko sftp lahko spreminjaš samo od userja ssh datoteke na pa vseh zato rajši uporabljaj filemanager od webmin kjre je ssh over sftp prenos podakov, kaj na macu zapakiraš karkoli phpmyadmin in ga naložiš filemanager webmin v določeno mapo in ko klikneš v webmin na ZIP ki si ga prenesu samo sudo usermod -aG adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,www-data,mail adminsudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,www-data,mail admin

sudo usermod -aG adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,www-data,mail sandisudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,www-data,mail sandi
sudo usermod -aG adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,www-data,mail borissudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,www-data,mail boris
sudo useradd -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,www-data,mail cybrotechsudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,www-data,mail cybrotech
sudo useradd -m -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,www-data,mail webscadasudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,www-data,mail webscada
# Samo to zažgi v terminalu da daš skupinam pooblstila!!!!sudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,www-data,mail cybrotechsudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,www-data,mail webscadasudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,www-data,mail sandisudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,www-data,mail boris

sudo nano /etc/sudoers.d/010_pi-nopasswdsudo nano /etc/sudoers.d/010_pi-nopasswdadmin ALL=(ALL) NOPASSWD: ALL# daš uporabnika ki ne rabi ko je prijavljen enkrat ponovno za vsak kurac vpisat kodo!! sudor!!!!sandi ALL=(ALL) NOPASSWD: ALL
## Tu daš network config kje je pi ali wlan ali eth0 - to je dobro da ti hackerji ne naredijo virtual host in izvajajo preko njega kode tu daš static ip address eth0 se previ PI kabel priklop GLAVNI pol static routers je ip routerja ponavadi 19.168.0.1 pol daš za static domain name server tvo ip routerja pol t2netdns1 in dns2 ter google dns1 in 2!!!!sudo nano /etc/dhcpcd.confinterface eth0static ip_address=192.168.1.111/24static routers=192.168.1.1static domain_name_servers=192.168.1.1 8.8.8.8 8.8.4.4 PIDNSVAŠISP1 PIDNSVAŠISP2
interface wlan0static ip_address=192.168.1.112/24static routers=192.168.1.1static domain_name_servers=192.168.1.1 8.8.8.8 8.8.4.4 PIDNSVAŠISP1 PIDNSVAŠISP2
## NPR. ČE UPORABLJATE FREENOM.COM BREZPLAČNE DOMENE!!!!static domain_name_servers=192.168.1.1 8.8.8.8 8.8.4.4 80.80.80.80 80.80.81.81

# Ti lahko daš wlan signal da je glavni čisto na koncu datoteke maš rollback opcijo in ti tu daš iz eth0 rollback na wlan0 tako da je wlan glavni!!!! Drugače če maš preko kabla pusti samo eth0 nastavitev brez wlan!!!! je boljše!!!!
84.255.209.79 84.255.210.79#fd51:42f8:caae:d92e::1#static ip6_address=fd51:42f8:caae:d92e::ff/64
# Koga pustiš v SSH!!!!sudo nano /etc/ssh/sshd_configAllowUsers cybrotech sandi boris pi admin linuxDenyUsers drevensek brkinska kajuhova vostri pergar
sudo /etc/init.d/sshd restart
# izbriši pi userja: sudo reboot in prijava pod drugim uporabnikom:###Zaklene user pi / Jaz si vedno dam user pi pass pi je lažje delat!!!! ko ga ne rabiš veš in daš server na splet lahko ga zakleneš in še v sshd conf daš DenyUsers pisudo passwd --lock pi
## zbriši pija ma ne rabi dok karkoli delaš ga daš samo pod lock ma tudi če ga sbrišeš isti kurac ma je bolj praktično## ga imet račun pi in koda pi in ga samo zakleneš pol kodarkoli delaš ga --unlock in pol ko končas ga spet nazaj lock!sudo userdel -r -f pisudo deluser -remove-home pi

# Na koncu dodaj sudorje pol ko narediš SSH certifikate za vse zakomentiraj ostale pustiš samo enega sudo oz. root pooblastila vsi ostali so lahko z!!!!
root ALL=(ALL) ALL
webscada ALL=(ALL) ALLwebscada ALL = NOPASSWD: ALL
igor ALL=(ALL) ALLigor ALL = NOPASSWD: ALL
boris ALL=(ALL) ALLboris ALL = NOPASSWD: ALL
sandi ALL=(ALL) ALLsandi ALL = NOPASSWD: ALL
#admin ALL=(ALL) ALL#admin ALL = NOPASSWD: ALL
#stranka1 ALL=(ALL) ALL#stranka1 ALL = NOPASSWD: ALL
#stranka2 ALL=(ALL) ALL#stranka2 ALL = NOPASSWD: ALL
#stranka3 ALL=(ALL) ALL#stranka3 ALL = NOPASSWD: ALL
#stranka4 ALL=(ALL) ALL#stranka4 ALL = NOPASSWD: ALL
#stranka5 ALL=(ALL) ALL#stranka5 ALL = NOPASSWD: ALL

### SSH certifikati!!! To če hočeš pol vklopi ssh certifikate v sudo nano /etc/ssh/sshd_config ## dobro jih je imet narejene če v izhodišču!# moja koda standard za SSH in SSL certifikate je 091177=== SSH ključ ni zakodiran z geslom samo ga naložiš v putty in izklopiš če hočeš password auth. in vklopiš ssh auth preko certifikata!!! me rabiš čeprav je to najbolj varno ker se nobem pol ne more prijavit v ssh dvakrat samo en je lahko z enim ssl prijavljen lahko drugi user ma nikoli isti pol tipo si namestiš za maca varovanje SSL in SSH certifikatov plus unega ki si zdaj dubu od države https://keepass.info/ si namestiš program in ti čuva je vadno prijavljeno na tvoj server to npr. če ga maš kje v ameriki s tvojim ssl ali ssh in tako ti ne more noben virus ali hacker pvevzeti port 22 oz. ssh terminal katerega koli računalnika oz. strežnika v našem primer.ssh-keygenko sem generiral ti pač nisem še dodatno kodiral za prenos z geslom itak si ga daš v svoj pc kdo ti ga bo ukradu noben!
sudo su - pissh-keygen
sudo su - sandissh-keygen
sudo su - igorssh-keygen
sudo su - borisssh-keygen
sudo su - webscadassh-keygen
sudo su - stranka1ssh-keygen
sudo su - stranka2ssh-keygen
sudo su - stranka3ssh-keygen
sudo su - stranka4ssh-keygen
sudo su - stranka5ssh-keygen

### Brez kode SSL za SSH kriptacija, če hočeš vklopit off password auth in vklopit certifikat ma ga moraš dat v putty prej, ker če ne se ne boš več mogu prijavit certifikati za vsak user so v /home/uporabnik/.ssh poglej preko webmin, ma itak vse ostale userje njim se dodeli damo grupa mail in nič več mi trije smo sudorji in pusti to so tudi sql super admin tri userji in passi, če boš spreminjal root password za uporabnika bo ostal ta pass kot root pod user name in pass ne pozabit v phpmyadmin pero ne menjavaj si sql root paswordov so ta dva čisto dovolj zaščitena za mene tebe in scado drugi ne rabijo nič.

sudo apt update && sudo apt upgradesudo reboot
sudo nano /etc/passwdsudo nano /etc/groupsudo nano /etc/shadow##################################################################################################### Zdaj delam na kartici 16GB zato bom uporabu samo 1 GB virtualne memory za rezervirat!!! ti daš 2GB + 2GBRam in obvezno GPU Ram 16MB !!!!! OBVEZNO TA VIRTUALNI RAM NAREDIŠ ČISTO NA KONCU KO MAŠ VSE INSTALIRANO IN DELUJOČE SE PRAVI KO SI INSTALIRAL MALTRAIL IN ČE MAŠ VEČ PIJEV V TVOJI MREŽI JE BOLJŠE DA INSTALIRAŠ MALTRAIL V UNO OPERACIJSKO MAPO /OPT/ NE PA TAKO KOT SEM JAZ INSTALIRAL POD SUDO RAČUN PRI MENI JE /HOME/ADMIN/ SAJ JE ISTI KURAC MA PO MOJEM JE BOLJŠE DA JE V OPERACIJSKI MAPI /OPT/ IN DODATNE NPR. USB DISKE OBVEZNO DAJ V MAPO /MNT/DISK1 ALI KARKOLI DRUZGA SE PRAVI /MNT/ MAPA TO JE GLAVNA MAPA ZA VIRTUALNE DISKE IN KJER DOLOČIŠ V LINUXU DA SE ŠTARTAJO VIRTUALNO OZ. VIRTUALNA POT DO DISKA NPR. PI SERVER JE PRI MENI TAKO KOT VSI USB DISKI SO V GLAVNI MAPI /MNT/DISK/ TO JE ZA USB3 DODATNI DISK SAMO ZA MUZIKO 64GB USB3.1 IN POL POT ZA WINDOWSNT MOJ GLAVNI SERVER ZA DELAT MUZIKO IN WEB PROGRAMI KI SEM JIH KUPU OZ. SHACKAL POBRAL KLJUČ IZ NETA ZA PROGRAME PROFI APPLE MUSIC CREATOR IN MUSIC STUDIO SOFTWARE = PROPPELERHEADS PROGRAM REASON TO SEM DOLOČU V PIJU DA JE 5 TERABAJTOV DISKA OD WINDOWSNT 5,1 SERVER VEZAN V PIJA POD /MNT/DISKNT/ IN POL ZA DRUGEGA PIJA DODATNI DISK OZ. INTERNI OD PIJA2 64GB SD KARTICA KI JE POL NA GLAVNEM PIJU1 DOLOČENA TAKO DA JE V MAPI /MNT/DISK1/ PLUS TWONKY MEDIA SERVER TO MAM STAREJŠO VERZIJO KI MI DELA 6.1 KER TE NOVE 8.0 NE MOREM POHACKAT MA JO NE MOREM DOBIT VEČ PREKO NETA TO STAREJŠO, DA BI JO DOWNLOADAL MOJA VERZIJA TWONKY MEDIA SERVER JE 6.01 ZATO ČE RABIŠ MI JAVI DA TI JO POŠLJEM Z NAVODILI KAKO NAMESTIT MEDIA SERVER TWONKY 6.1 MOJA STARA VERZIJA POBRANA LETA NAZAJ PREKO NETA ZDAJ TE NOVE SO VSE NONFREE IN TI DELA 14 DNI IN SE ZAKLENE NE ZNAM JO ODKODIRAT, DELAM NA TEMU ŠE....
# DOLOČI SI VIRTUALNO MEMORY ZA RASPBIAN LINUX OBVEZNO###Virtual Memory increase povečaj VMem za Debian linux raspbian = Swap file increasesudo swapon --showsudo fallocate -l 1G /swapfilesudo dd if=/dev/zero of=/swapfile bs=1024 count=1048576sudo chmod 600 /swapfilesudo mkswap /swapfilesudo swapon --showsudo swapon /swapfilesudo nano /etc/fstab# NA KONCU KOPIRAJ SPODNJO DIREKTIVO:# a swapfile is not a swap partition, no line here# use dphys-swapfile swap[on|off] for that/swapfile swap swap defaults 0 0
sudo swapon --showcat /proc/sys/vm/swappinessZmanjšaj možnost od 0 do 100 uporaba swap datoteke manjša številka pomeni čim manj večja ČIM večkratNpr. določi swap file da se določi na 10
sudo sysctl vm.swappiness=10sudo nano /etc/sysctl.conf# KOPIRAJ TO DIREKTIVO NA KONCU TE DATOTEKE /etc/sysctl.conf:vm.swappiness=10
###Removing a Swap File - IZBRIŠI VIRTUALNO MEMORIJOsudo swapoff -v /swapfileNext, remove the swap file entry /swapfile swap swap defaults 0 0 from the /etc/fstab file.sudo rm /swapfile

######################################################################################################
OBVEZNO IPTABLES SM PRIPRAVU TAKO GLEJ DIREKTIVE, DA ČE SI PRIJAVLJEN V KARKOLI SQL, SCADA ITD... SI ODOBREN, POL BLOKADA NA SSH, ČIM FALIŠ ITD... te direktive sem zakomentiral tako je pri meni raspbian linux nastavljen bi lahko praktično dodate preden namestite iptables persistent samo za oba ipv4 in ipv6 ko generirate npr. v tmp mapi samo *filter une direktive *nad in *mangale tega ne rabitre vam tudi jih nisem napisal za ipv4 če pa vas zanima poglejte si moj wordrpess na piramide.zapto.org ker so točne razlage kaj je nat kaj je mangale in kako se to skonfigurira!!!!!!
sudo apt update && sudo apt upgrade -ysudo reboot
sudo iptables -Lsudo ip6tables -L
sudo nano /tmp/v4
## Custom settings Raspberry pi for server and webscada apps PCSNET*filter:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]
# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that# doesn't use lo0-A INPUT -i lo -j ACCEPT-A INPUT -d 127.0.0.0/8 -j REJECT --reject-with icmp-port-unreachable# Accepts all established inbound connections-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT# Allows all outbound traffic# You could modify this to only allow certain traffic-A OUTPUT -j ACCEPT# Accept traffic from internal interfaces-A INPUT ! -i eth0 -j ACCEPT# Accept traffic with the ACK flag set-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT# Allow private network daš ip routerja in 0/24 ter pol in pol še vsak pi ki ga hočeš met povezanega# primer spodaj moje mreža trvi razpon velja za vse ipje ki mu moj dhcp server od routerja dodeli drugi je glavni pi pol winodws10 pol windowsnt in zadnji je pi test oz. je tipo test webscada ali karkoli si daš po svoje pazi razpone /24 pomeni razpon od 192.168.1.1 - do 192.168.1.255 in /32 pomeni satmo ta ip in noben razpon več!!!!## RECIMO CELOTNO VAŠE LOKALNO OMREŽJE ALI POL NASLEDNJA IP NPR. TO JE MOJ DEBIAN LINUX 192.168.1.111 POL NASLEDNJI JE 1.222 JE WINDOWSNT5.1 TER POL NASLEDNJI ip NA KONCU ŠT. 1.77 TO JE MOJ TWONKY MEDIA SERVER ZA AUDIO STUDIO NALAGANJE VTIČNIKOV, REFRENOV, FX SAMPLE, ITD... DIREKT ZA PROGRAMSKO OPREMO PROPPELERHEADS VIRTUALNI STUDIO REASON 6.... IN ZADNJI IP 1.123 TO JE RASPBERRY PI WEBSCADA PRI MENI DOMA:#-A INPUT -s 192.168.1.0/24 -j ACCEPT#-A INPUT -s 192.168.1.111/32 -j ACCEPT#-A INPUT -s 192.168.1.222/32 -j ACCEPT#-A INPUT -s 192.168.1.124/32 -j ACCEPT#-A INPUT -s 192.168.1.123/32 -j ACCEPT-A INPUT -p tcp -m tcp -m multiport -j ACCEPT --dports 22,53,80,443,110,25,143,465,587,993,995,4000,8338,8442,10000# Allows all inbound traffic from wlan0 and eth0-A INPUT -i wlan0 -j ACCEPT-A INPUT -i eth0 -j ACCEPT# Allows HTTP and HTTPS connections from anywhere (the normal ports# for websites) webmail and ssh dns# Accept responses to DNS queries UPD connedtion port ipv4 53 open all ports from 1024 to 65535-A INPUT -p udp -m udp --dport 1024:65535 --sport 53 -j ACCEPT# Accept responses to Controller queries UPD connedtion port ipv4 8442 open all ports from 1024 to 65535-A INPUT -p udp -m udp --dport 1024:65535 --sport 8442 -j ACCEPT#-A INPUT -p tcp -m state --state NEW -m multiport --dports 25,587,465#-A INPUT -p tcp -m state --state NEW -m multiport --dports 110,995#-A INPUT -p tcp -m state --state NEW -m multiport --dports 143,993-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT-A INPUT -p tcp -m tcp --dport 995 -j ACCEPT-A INPUT -p tcp -m tcp --dport 4000 -j ACCEPT-A INPUT -p tcp -m tcp --dport 8442 -j ACCEPT-A INPUT -p tcp -m tcp --dport 8338 -j ACCEPT-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT## tA PORT 20000 ZA WEBMIN USERS, ČE ŽELITE NAMESTIT MODUL WEBMIN USERS POL KASNEJE KO STE NAMESTILI WEBMIN:#-A INPUT -p tcp -m tcp --dport 20000 -j ACCEPT#-A INPUT -p tcp --dport 20000 -j ACCEPT to si namesti modul lahko za webmin za uporabnike pol maš port 20000 ma maš to urejeno z roundcube je lepše isti kurac praktično oz. podobno tam v webmin user lahko delajo še tej userji prijavlnei virtulane hoste in sebi kakšne streni ali karkoli ma ne rabi lhako pa si daš uni vtičnik webmin user gor, da lahko še preko porta 20000 vsi tej uporabniki čekirajo svoj mail in kar jim vse še dovoliš!!!!## DNS server allow če boš hotel met virtualne domene npr. tam registriraš na freenom.com eno domeno first level in pol narediš več virtualnih hostov in to tudi tam na freenom v vsako črto vpišeš mapo karkoli npr. glavna domena webscada.tk pol v free nom vpišeš v eno prazno črto mail v drugo www v tretjo karkoli sanidi itd... in pol v apache narediš virtualne hoste in na vsako poddomeno namestiš xy app npr. mail.webscada.tk drugi virtualni host port 80 servername www.webscada.tk pol tretji vhost port 80 default-conf apache vebno ddl.webscada.tk in pol za vsak vhost daš svojo mapo na serverju in tam namestiš webapp karkoli npr.servername trgovina.webscada.tk četri vost in tako nadoljuješ za vsak virtualni host lahko tam pri freenom isto kot pri noip.com registriraš različne hoste javna domena in pol pri sebidaš virtualni host *:80 mojdisk.ddns.net za server name in tam pri noip registriraš če je free mojdisk.ddns.net itd...-A INPUT -p udp -m state -m udp --dport 53 --state NEW,ESTABLISHED -j ACCEPT-A INPUT -p udp -m udp --sport 53 -j ACCEPT#-A INPUT -p icmp -j ACCEPT# Accept SQL server all other localhost servers or reg. pcs-A INPUT -p tcp -s 192.168.1.0/24 --dport 3306 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT-A OUTPUT -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT# Coder proxy server 8080 standard http and socks port 1080 standard or 8888 ecc...#-A INPUT -p tcp --dport 8080 -j ACCEPT#-A INPUT -p tcp --dport 8081 -j ACCEPT# Allows Apt-Cacher-NG Raspbian-A INPUT -p tcp --dport 3142 -j ACCEPT# Allows SSH connections# The --dport number is the same as in /etc/ssh/sshd_config-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT## komplet localnetwork za routerjem dhcp server 192.168.1.1/24 allow ssh All local network if used wifi eth0 and for eth1 use 192.168.1.0/8 all subnets and main PI server DHCP router config static fallback eth1 PI own DHCP config....#-A INPUT -p tcp -s 192.168.1.0/24 --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT#-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT-A INPUT -p tcp -m state -m tcp --dport 22 --state NEW -j ACCEPT## Allow for example your main pc to access or some your computer server to access SSH connection - TU ODKOMENTIRAJTE TA IP IN VPIŠITE VAŠ NPR. VAŠ WINDOWS10 S KATERIM SE PRIJAVLJATE NA PIJA POPRAVITE DAJTE VAŠ IP OD ROUTERJA KI GA IMATE ZA VAŠ NPR. WINDOWS10:#-A INPUT -p tcp -m tcp -s 192.168.1.222/32 --dport 22 -j ACCEPT#-A INPUT -p tcp -s 0.0.0.0/0 --dport 22 -j DROP-A INPUT -p tcp -m tcp --dport 22 -j DROP# Limit SSH abuse# The first rule records the IP address of each new attempt to access# port 22 using the recent module. The second rule checks to see if that# IP address has attempted to connect 4 or more times within the last# 60 seconds, and if not then the packet is accepted. če v 60 sekundah ne vtipkaš kode oz. kopiraš ali dostviš ssl certificat za nopass auth. te po 4 kratnem faljenju blokira za 60 sekund -- TO SI LAHKO ODKOMENTIRATE SE PRAVI BLOKADA NA SSH SERVER ČE JE 4 KRATNI POIZKUS V 60 SEKUNDAH BLOKIRAJ TA IP ZA DOLOČEN ČAS SE PRAVI 60 SEKUND!!! NPR. DOBRO ČE POSREDUJETE PORT 22 OZ. SSH SI TO POL ODKOMENTIRAJTE, DRUGAČE NE RABITE TEH PARAMETRO AMPAK NE ŠKODIJO!!!#-A INPUT -p tcp -m state --state NEW -m recent --dport 22 --set --name ssh --rsource#-A INPUT -p tcp -m state --state NEW -m recent --dport 22 ! --rcheck --seconds 60 --hitcount 4 --name ssh --rsource -j ACCEPT# Now you should read up on iptables rules and consider whether ssh access# for everyone is really desired. Most likely you will only allow access# from certain IPs.# Allows vncserver connections. Uncomment this to allow VNC. Again, this is# best restricted to certain IPs#-A INPUT -p tcp -m state --state NEW --dport 5901 -j ACCEPT# Allows RDP connections. Uncomment this to allow RDP.#-A INPUT -p tcp -m state --state NEW --dport 3389 -j ACCEPT# Allow Zeroconf connections. (Bonjour and Avahi)-A INPUT -p udp -m state --state NEW --dport 5353 -j ACCEPT# Allow ping# note that blocking other types of icmp packets is considered a bad idea# by some# remove -m icmp --icmp-type 8 from this line to allow all kinds of icmp:# https://security.stackexchange.com/questions/22711-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT# Allow response to remote ping (delete/comment this line if you don’t want to respond to ping commands)#-A INPUT -p icmp –-icmp-type echo-request -j ACCEPT# Allow connections to our IDENT server-A INPUT -p tcp -m tcp --dport auth -j ACCEPT# Respond to pings  #-A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT  ##Protect our NFS server-A INPUT -p tcp -m tcp --dport 2049:2050 -j DROP# Protect our X11 display server-A INPUT -p tcp -m tcp --dport 6000:6063 -j DROP# Protect our X font server-A INPUT -p tcp -m tcp --dport 7000:7010 -j DROP# log iptables denied calls (access via 'dmesg' command)-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7# Allow forwarded from wlan1 to permit NAT and Access Point#-A FORWARD -i wlan0 -o wlan1 -m state --state RELATED,ESTABLISHED -j ACCEPT#-A FORWARD -i wlan1 -o wlan0 -j ACCEPT# Allow forwarded from eth0 to permit NAT and Core Pi-A FORWARD -i wlan0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT-A FORWARD -i eth0 -o wlan0 -j ACCEPT# Allow forwarded from eth0 to permit NAT and Access Point-A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT-A FORWARD -i wlan0 -o eth0 -j ACCEPT-A FORWARD -m state -i eth0 --state RELATED,ESTABLISHED -j ACCEPT-A INPUT -j REJECT --reject-with icmp-port-unreachable# Reject all other inbound - default deny unless explicitly allowed policy:-A INPUT -j DROP-A FORWARD -j DROPCOMMIT
## Shrani in ustvari še direktive za ipv6 brez teh prvih nat in mangale!"!! samo *Filter do konca!!! Commit!!!!
**********************************************************************************************sudo nano /tmp/v6# Generated for iptables-custom-settings by Boris Perc for WEB Scada only!!!!*nat:PREROUTING ACCEPT [38:1868]:POSTROUTING ACCEPT [0:0]:OUTPUT ACCEPT [0:0]COMMIT
*mangle:PREROUTING ACCEPT [353:47034]:INPUT ACCEPT [353:47034]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [323:141426]:POSTROUTING ACCEPT [323:141426]COMMIT
*filter:OUTPUT ACCEPT [0:0]:INPUT DROP [0:0]:FORWARD ACCEPT [0:0]# Accept traffic from internal interfaces-A INPUT ! -i eth0 -j ACCEPT# Accept traffic with the ACK flag set-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT# Allow incoming data that is part of a connection we established-A INPUT -m state --state ESTABLISHED -j ACCEPT# Allow data that is related to existing connections-A INPUT -m state --state RELATED -j ACCEPT# Accept responses to DNS queries-A INPUT -p udp -m udp --dport 1024:65535 --sport 8442 -j ACCEPT# Accept responses to our pings#-A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT# Accept notifications of unreachable hosts-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -j ACCEPT# Accept notifications to reduce sending speed-A INPUT -p icmp -m icmp --icmp-type source-quench -j ACCEPT# Accept notifications of lost packets-A INPUT -p icmp -m icmp --icmp-type time-exceeded -j ACCEPT# Accept notifications of protocol problems-A INPUT -p icmp -m icmp --icmp-type parameter-problem -j ACCEPT# Allow connections to our SSH server-A INPUT -p tcp -m tcp -m multiport -j ACCEPT --dports ssh,www,https,pop3,smtp,imap,imaps,pop3s,10000,4000,8442# Allow connections to our IDENT server-A INPUT -p tcp -m tcp --dport auth -j ACCEPT# Respond to pings-A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT# Protect our NFS server-A INPUT -p tcp -m tcp --dport 2049:2050 -j DROP# Protect our X11 display server-A INPUT -p tcp -m tcp --dport 6000:6063 -j DROP# Protect our X font server-A INPUT -p tcp -m tcp --dport 7000:7010 -j DROP# Allow connections to unprivileged ports#-A INPUT -p tcp -m tcp --dport 1024:63353 -j ACCEPT# Accept traceroutes#-A INPUT -p udp -m udp --dport 8442:65535 -j ACCEPT# Completed on Mon jul 29 12:06:00 2020 Generated for iptables-webmin-custom-settings by homecraftsoft.com on Mon jul 29 12:06:00 2020 # Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0-A INPUT -i lo -j ACCEPT-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT-A FORWARD -j REJECT-A INPUT -j REJECT# WEBMail email ports allow email ports and scada ports-A INPUT -p tcp --dport 21 -j ACCEPT-A INPUT -p tcp --dport 25 -j ACCEPT-A INPUT -p tcp --dport 465 -j ACCEPT-A INPUT -p tcp --dport 587 -j ACCEPT-A INPUT -p tcp --dport 143 -j ACCEPT-A INPUT -p tcp --dport 993 -j ACCEPT-A INPUT -p tcp --dport 110 -j ACCEPT-A INPUT -p tcp --dport 995 -j ACCEPT-A INPUT -p tcp --dport 4000 -j ACCEPT-A INPUT -p tcp --dport 8442 -j ACCEPT-A INPUT -p tcp --dport 10000 -j ACCEPT#-A INPUT -p tcp --dport 20000 -j ACCEPT
COMMIT# Completed on Mon jul 29 12:06:00 2020

### Drugi primer iste direktive## Custom primer perc tako zaščitite ipv6 tega ne rabite razen če vam vaš ponudnik isp ponuja dostop na splet preko ipv6 protokola, ma mislim da je to v sloveniji vse še v nebulozi, bodo kmalu dodelili vsakemu uporabniku preko ipv6 svoj javni IP:
sudo nano /tmp/v6
# Generated for iptables-custom-settings by Boris Perc for WEB Scada*nat:PREROUTING ACCEPT [38:1868]:POSTROUTING ACCEPT [0:0]:OUTPUT ACCEPT [0:0]COMMIT
*mangle:PREROUTING ACCEPT [353:47034]:INPUT ACCEPT [353:47034]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [323:141426]:POSTROUTING ACCEPT [323:141426]COMMIT
*filter:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]:INPUT DROP [0:0]# Accept traffic from internal interfaces-A INPUT ! -i eth0 -j ACCEPT# Accept traffic with the ACK flag set-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT# Allow incoming data that is part of a connection we established-A INPUT -m state --state ESTABLISHED -j ACCEPT# Allow data that is related to existing connections-A INPUT -m state --state RELATED -j ACCEPT# Accept responses to DNS queries UPD connedtion Scada port ipv4 or tcp and upd 8442 open all ports from 1024 to 65535-A INPUT -p udp -m udp --dport 1024:65535 --sport 8442 -j ACCEPT-A INPUT -p tcp -m tcp --dport 1024:65535 --sport 8442 -j ACCEPT# Accept responses to our pings -A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT Accept notifications of unreachable hosts -A INPUT -p icmp -m icmp --icmp-type destination-unreachable -j ACCEPT Accept notifications to reduce sending speed -A INPUT -p icmp -m icmp --icmp-type source-quench -j ACCEPT Accept notifications of lost packets -A INPUT -p icmp -m icmp --icmp-type time-exceeded -j ACCEPT Accept notifications of protocol problems -A INPUT -p icmp -m icmp --icmp-type parameter-problem -j ACCEPT Allow connections to our SSH server -A INPUT -p tcp -m tcp -m multiport -j ACCEPT --dports ssh,www,https,pop3,smtp,imap,imaps,pop3s,10000,4000,8442 # Allow connections to our IDENT server-A INPUT -p tcp -m tcp --dport auth -j ACCEPT# Respond to pings -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT Protect our NFS server-A INPUT -p tcp -m tcp --dport 2049:2050 -j DROP# Protect our X11 display server-A INPUT -p tcp -m tcp --dport 6000:6063 -j DROP# Protect our X font server-A INPUT -p tcp -m tcp --dport 7000:7010 -j DROP# Allow connections to unprivileged ports -A INPUT -p tcp -m tcp --dport 1024:63353 -j ACCEPT Accept traceroutes-A INPUT -p udp -m udp --dport 33434:33523 -j ACCEPT# Completed on Mon jul 29 12:55:21 2020 Generated for iptables-webmin-custom-settings by homecraftsoft.com on Mon jul 29 12:55:21 2020 Accept local host connections-A INPUT -i lo -j ACCEPT# Dissalow input - connections from outsite localhost-A INPUT -s ::1/128 ! -i lo -j REJECT-A INPUT -j REJECT-A FORWARD -j REJECT
COMMIT# Completed on Mon jul 29 12:55:21 2020
### Zdaj kar si napisal zgoraj prikličeš in namestiš iptables s spodnjimi tremi komandami v terminalu:
sudo iptables-restore < /tmp/v4sudo ip6tables-restore < /tmp/v6sudo apt-get install iptables-persistent -yVsi odgovori so YES!!!
sudo reboot
# PREVERI ČE DELAJO BLOKADE IPTABLES TAKO:sudo iptables -vLsudo ip6tables -vL
## Kadar rabiš implementirat karoli v iptables samo odpri preko webmin datoteko: /etc/iptables/rules.v4
## tu je default lokacija debian raspbian buster 10 linux ko rebutaš server se aplicirajo tvoji parametri ki si jih postavu druga save lokacija trenutnih banov pa uporablja fail2ban, webmin, wordpress ssh vtičnik in cli ter če si skonfiguriraš modul fail2ban https://www.abuseipdb.com/fail2ban.html dodaš svoj api ključ, ki si ga naredu in pol vsakemu modulu pošlješ bane abuse ips oni pa tebi tipo maltrail tako da ti takoj blokira samodejno nevarna omrežja!sudo iptables-restore < /etc/iptables/rules.v4sudo ip6tables-restore < /etc/iptables/rules.v6
sudo iptables-save < /etc/iptables.up.rulessudo ip6tables-save < /etc/ip6tables.up.rules

webscada@cybrotech:~ $ sudo iptables -vLChain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination    0 0 ACCEPT all -- !eth0 any anywhere anywhere   16 2130 ACCEPT tcp -- any any anywhere anywhere tcp flags:ACK/ACK    3 370 ACCEPT all -- any any anywhere anywhere state ESTABLISHED    0 0 ACCEPT all -- any any anywhere anywhere state RELATED    1 46 ACCEPT udp -- any any anywhere anywhere udp spt:8442 dpts:1024:65535    0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-reply    0 0 ACCEPT icmp -- any any anywhere anywhere icmp destination-unreachable    0 0 ACCEPT icmp -- any any anywhere anywhere icmp source-quench    0 0 ACCEPT icmp -- any any anywhere anywhere icmp time-exceeded    0 0 ACCEPT icmp -- any any anywhere anywhere icmp parameter-problem    1 52 ACCEPT tcp -- any any anywhere anywhere tcp multiport dports ssh,http,https,pop3,smtp,imap2,imaps,pop3s,webmin,4000,8442    0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:auth    3 252 ACCEPT icmp -- any any anywhere anywhere icmp echo-request    0 0 DROP tcp -- any any anywhere anywhere tcp dpts:nfs:2050    0 0 DROP tcp -- any any anywhere anywhere tcp dpts:x11:6063    0 0 DROP tcp -- any any anywhere anywhere tcp dpts:afs3-fileserver:7010    0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpts:1024:63353    0 0 ACCEPT udp -- any any anywhere anywhere udp dpts:8442:65535    0 0 ACCEPT all -- lo any anywhere anywhere    0 0 REJECT all -- !lo any anywhere 127.0.0.0/8 reject-with icmp-port-unreachable    8 1446 REJECT all -- any any anywhere anywhere reject-with icmp-port-unreachable    0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:smtp    0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:submissions    0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:submission    0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:imap2    0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:imaps    0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:pop3    0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:pop3s    0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:4000    0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:8442    0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:webmin
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination    0 0 REJECT all -- any any anywhere anywhere reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT 38 packets, 5669 bytes) pkts bytes target prot opt in out source destinationwebscada@cybrotech:~ $ sudo ip6tables -vLChain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination    0 0 ACCEPT all !eth0 any anywhere anywhere    0 0 ACCEPT tcp any any anywhere anywhere tcp flags:ACK/ACK    0 0 ACCEPT all any any anywhere anywhere state ESTABLISHED    0 0 ACCEPT all any any anywhere anywhere state RELATED    0 0 ACCEPT udp any any anywhere anywhere udp spt:8442 dpts:1024:65535    0 0 ACCEPT tcp any any anywhere anywhere tcp dpt:auth    0 0 DROP tcp any any anywhere anywhere tcp dpts:nfs:2050    0 0 DROP tcp any any anywhere anywhere tcp dpts:x11:6063    0 0 DROP tcp any any anywhere anywhere tcp dpts:afs3-fileserver:7010    0 0 ACCEPT udp any any anywhere anywhere udp dpts:33434:33523    0 0 ACCEPT all lo any anywhere anywhere    0 0 REJECT all !lo any localhost anywhere reject-with icmp6-port-unreachable    2 378 REJECT all any any anywhere anywhere reject-with icmp6-port-unreachable
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination    0 0 REJECT all any any anywhere anywhere reject-with icmp6-port-unreachable
Chain OUTPUT (policy ACCEPT 13 packets, 1250 bytes) pkts bytes target prot opt in out source destinationwebscada@cybrotech:~ $##########################################################################################################Zdaj lahko naredimo:sudo apt-get updatesudo apt-get upgrade
sudo apt update && sudo apt upgrade -ysudo apt-get update && sudo apt-get dist-upgradesudo apt-get install build-essential libcurl4-openssl-dev zlib1g-dev
sudo apt-get update && sudo apt-get upgrade -y
## RAbi za geoip apps še developers repositorysudo apt-get install apache2 apache2-utils apache2-dev -y
## Update in upgrade dajaš če nameščaš neko novo app in ko jo instaliraš pol za naslednjo če ima app v skriptih## da za delovanje rabi še neke python ali xy module tako ti pripravi server za vsako novo svežo namnestitev programa## se ne zdrka nič stari skripti z nadgrajenimi. Saj si vidu ponavadi update pogleda na glavni raspbian vhod vse programe in pole update čekira upgrade pa pol nadgradi samo pazi sm ti reku za php ne dajaj nikoli brez številke in tudi za apache php vedno daj števliko ker če ne sm ti reku se namestijo še php73 moduli ker so od deviana glavni v repositoriju in mi rabimo te varne samo 7.4 lahko tudi 8 scada bo delala tudi na 8ki še bistveno hitreje kot na 7.4 ma usti je že vredu 74 podpira še 32bit une višje samo še 64bitno, sm testiral dela npr. wordrpess na php8 šestkrat boljše kot php74 in slabšisudo apt update && sudo apt upgrade -ysudo apt-get install mariadb-server mariadb-client -y
sudo nano /etc/apache2/apache2.conf## TU BOSTE POL NPR. DOLOČILI ZA AWSTATS VIRTUALNI HOST SE PRAVI NPR. DA STE REGISTRIRALI PREKO NOIP.COM PRIMER OD FRENDA DOMENA = sandiwebscada.ddns.net in zdaj želite AwStats da se prikažejo ko vi vtipkate npr. če ste akrivirali certbot https://sandiwebscada.ddns.net/awstats/ to si lahko pogledate na mojem serverju vse možne nastavitve različnih programov za linux ponavadi jaz osebno uporabljam največ Debian64bit 10 Buster za testirat in glavne webapps glavni strežnik output, drugače pa uporabljam za pametno hišo in vse webcam ter ostale funkcionalnsti v moji hiši je preko raspbian10buster 32bit linux, zapomnite si Ubuntu, Debian, Raspbian, Kali, BlackArch ipd... vsi tej linuxi so derivati Debian Linux!!!!!<Directory /var/www/html/> for your web folder:“AllowOverride None” – change this to “AllowOverride ALL”<Directory /var/www/html/> Options Indexes FollowSymLinks AllowOverride All Require all granted</Directory>
# čE BOSTE NAMESTILI WEBALIZER APACHE LOG ANALIZATOR ALI BOLJŠI PROGRAM JE AWSTATS, LAHKO PA IMATE KAR OBA NE ŠKODI OBA PRAKTIČNO ANALIZIRATE APACHE.LOG DATOTEKE VSE!!!!!!<Directory /var/www/webalizer/> Options Indexes FollowSymLinks AllowOverride All Require all granted</Directory>
## čE BOSTE NAMESTILI NAŠ POROGRAM NRP. DDL ENIGMA V MAPO DDL!!!!<Directory /var/www/ddl/> Options Indexes FollowSymLinks AllowOverride All Require all granted</Directory>
#Na koncu Server name localhost Piramide Studio NETServerName localhost# vim: syntax=apache ts=4 sw=4 sts=4 sr noetServerName localhost
# Perc Server - WEBAlizer settings Custom Logs for GeoIP and Databases PROGRAM WEBALIZER AND AWSTATSLogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedioCustomLog /var/log/apache2/access.log combinedio
## Enable Logging - Server access data loging for Apache - Detailed logs for administrator - GENERATE FULL DETAILED LOGS FOR YOUR SUDO ADMIN USER!!!!LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" detailedCustomLog /var/log/apache2/access.log detailed
## tUKAJ DALJE BOSTE DALI ZA WEBSCADO DIREKTIVE SE PRAVI DADAJTE POT KJER STE NAMESTILI SCADO VAŠ RAČUN KARKOLI!!!!:
# solar cybro web application static files directory                    Alias /static/ /home/cybrotech/app/solar_cybro/static/                      <directory "/home/cybrotech/app/solar_cybro/static/">                           Order deny,allow                                                        Require all granted                            </directory>                                                                                                                                    # solar cybro web application data directory                            Alias /data/ /home/cybrotech/app/solar_cybro/data/                          <directory "/home/cybrotech/app/solar_cybro/data/">                             Order deny,allow                                                        Require all granted                            </directory>                                                                                                                                    # location of solar cybro wsgi startup file                             WSGIScriptAlias / /home/cybrotech/app/solar_cybro/solar_cybro.wsgi          <directory "/home/cybrotech/app/solar_cybro/">                                  Order deny,allow                                                        Require all granted                            </directory>

-------------------------------------------------------------------------------------------
##Namesti apache in pripomočke zaradi varnosti takoj na začetku:sudo apt-get install apache2 apache2-utils -y
# Skonfiguriraj apache in dodeli pooblasitla www-data obvezno!!!sudo nano /etc/apache2/apache2.conf# Vklopi server root in mutex pa vklopi samo če imaš OS na SD kartici, če ga maš na USB disku NE oz. da uporabljaš apache preko drugega PIja v tvoji mreži zaradi SSL!!!!##Dodaš pod direktivo <Directory /var/www/> prvo stran za apache prikaz je vedno /var/www/html/ pol pa kar ti podaš mape so drugi virtualni hosti za prikaz.....!!!!!<Directory /var/www/html/> for your web folder:“AllowOverride None” – change this to “AllowOverride ALL”
<Directory /var/www/html/>        Options Indexes FollowSymLinks        AllowOverride All        Require all granted</Directory>
# Na koncu obvezno dodaj še to - Ker imaš apache v tvojem PI ne pa na drugi lokaciji to velja tudi za SQL server samo da je SQL to že nastavljeno!!!ServerName localhost
Shrani in zaženi to komando da lahko pol naredimo error strani po meri in karkoli druzga!!!sudo chown -R www-data:www-data /var/www/html/
čovnanje določenih map ki raviš vedno /var/www/ ko si na njej vse mape in podmape čovnaj tako: sudo chown -R www-dada: .sudo chown -R www-dada: .sudo chown -R cybrotech: .sudo chown -R admin: .sudo chown -R boris: .sudo chown -R sandi: .sudo chown -R root: .
Sudorja lahko pustiš samo npr. sebe pol v visudo zakomentiraš une ki nočeš da majo super admin privilegije
sudo apt update# Namesti php obvezno 7.4, ker ne bojo več delal konec leta nič za php 7.3!!!!!sudo apt update
sudo apt -y install lsb-release apt-transport-https ca-certificates
sudo wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
sudo echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/php.list
sudo apt update
sudo apt -y install php7.4 libapache2-mod-php7.4 php7.4-json php7.4-fpm php7.4-cli -y## IN OBVEZNO KADAR NAMEŠČATE MODULE PHP VEDNO DODAJTE VERZIJO V VAŠEM PRIMERU PHP7.4, KER ČE TEGA NE STORITE SE VAM BODO NAMESTILI ŠE MODULI ZA PHP7.3 PLUS PHP8.0 IN TEH MODULOV NE RABITE - VAŽNO DA UPORABLJATE PHP7.4 TO JE ZDAJ ŠE ZADNJA VERZIJA KI PODPIRA ARMHF OZ. 32BITNO ARHITEKTURO IN ZELO DOBRO OZ. VEZNO, SO POPRAVLJENI HROŠČI, MEDTEM KO JE PHP7.3 DOSTI ŠE ZA POPRAVIT OZ. BOLJŠE JE ČE SI DIREKTNO NAMESTITE ZA VAŠ RASPBIAN LINUX KATERI JE 32BITNA ARHITEKTURA PROCESORJA TAKOJ PHP7.4 OBVEZNO TAKO KO DOLOČITE REPOSITORY OZ. BAZO PODATKOV IZ KATEREGA BOSTE VLEKLI NADGRADNJE PROGRAMOV ZAŽENITE TO V TERMINALU:
sudo apt update && sudo apt -y install php7.4 libapache2-mod-php7.4 php7.4-json php7.4-fpm php7.4-cli -y

# preverite različico s to komando:php -v
# izklopi staro verzijo php in vklopi novo če maš nameščeno original staro 7.3!!!!sudo a2dismod php7.3sudo a2enmod php7.4
# Scada rabi te module php obvezno, in druge tudi ma tej so najbolj pomembni!!!sudo apt install libapache2-mod-php7.4 php7.4-json php7.4-fpm php7.4-cli -y
sudo nano /etc/php/7.4/apache2/php.ini# vpišite po želji vrednosti se pravi:max_execution_time = 60memory_limit = 512M post_max_size = 2048Mupload_max_filesize = 2048Mlog_errors = Onerror_log = /var/log/php/error.log
# Shrani in zažgi spodaj terminal da ti beleži napake php:sudo mkdir -p /var/log/phpsudo chown www-data /var/log/php

## apache status server če rabiš uklopiš tako: daj si vedno tvoj fiksni ip in moj še zraven ne škodi! plus celotno tvoje lokalno omrežje!!!sudo nano /etc/apache2/mods-enabled/status.conf<IfModule mod_status.c>        # Allow server status reports generated by mod_status,        # with the URL of http://servername/server-status        # Uncomment and change the "192.0.2.0/24" to allow access from other hosts.
        <Location /server-status>                SetHandler server-status                Require local                Require ip 192.168.77.0/24 Require ip 89.212.137.96 Require ip 93.103.113.142        </Location>

Nisem dal noip.com app za dinamične ipje to si moraš instalirat da ti bo delal malo z zamudo epoštni predal javno!!!NOIP program za čekirat če maš dinamični ip, ko namestiš daj ne da gleda tvoj ip vsake 30 sekund ampak vstavi enkrat dnevo to je 1440 pomeni 12 ur itd. dnevo daš 2880 namesto 30 ki je po defaultu in na koncu ko te vpraša če hočeš dodat še kak skript NO!!! lahko daš vsako uro naj čekira IP naslov tako boš dobival vsako uro maile.... če se ti menjava ip preko isp npr. oni neki popravljajo in ti dodelijo po nesrči v eni uri parkrat nov ip.... Daj si Fiksni IP če misliš met server logika. pol ne rabiš noben noip.com za čekirat tvoj realni ip ker ti ga dinamika vsaketolko menja še posebej čim ti ugasneš router in ga vžgeš njihov pol takoj dobiš novega. brezveze. Vsi serverji vhod ali več hodov imajo fiksne ipje nikoli dinamične.cd /usr/local/src/sudo wget http://www.no-ip.com/client/linux/noip-duc-linux.tar.gztar xf noip-duc-linux.tar.gzsudo rm noip-duc-linux.tar.gzcd noip-2.1.9-1/sudo make install
cd /etc/sudo nano rc.localsudo noip2
cd /usr/local/src/sudo wget http://www.no-ip.com/client/linux/noip-duc-linux.tar.gztar xf noip-duc-linux.tar.gzsudo rm noip-duc-linux.tar.gzcd noip-2.1.9-1/sudo make install
cd /etc/sudo nano rc.local
sudo noip2sudo shutdown -r nowsudo noip2 -S
https://my.noip.com/Your username is: boris.perc@gmail.comYour username is: borisperc2880 za update interval (30) je po defaultu ne, ker mamo fiksni ip sploh ne rabi vsake 30 sekund lahko tudi več kot 2880 se pravi 24ur po želji!!!! ti za dinamiko glje tam vsaj vsake 6 ur minimum naj čekira.

webscada@cybrotech:/usr/local/src $ sudo suroot@cybrotech:/usr/local/src# sudo wget http://www.no-ip.com/client/linux/noip-duc-linux.tar.gz--2020-11-09 10:28:30-- http://www.no-ip.com/client/linux/noip-duc-linux.tar.gzRazreševanje www.no-ip.com (www.no-ip.com) ...8.23.224.110Povezovanje na www.no-ip.com (www.no-ip.com)|8.23.224.110|:80 ... povezano.HTTP zahteva poslana, čakanje na odgovor ... 301 Moved PermanentlyPoložaj: https://www.noip.com/client/linux/noip-duc-linux.tar.gz [spremljanje]--2020-11-09 10:28:31-- https://www.noip.com/client/linux/noip-duc-linux.tar.gzRazreševanje www.noip.com (www.noip.com) ...8.23.224.107Povezovanje na www.noip.com (www.noip.com)|8.23.224.107|:443 ... povezano.HTTP zahteva poslana, čakanje na odgovor ... 200 OKDolžina: 134188 (131K) [application/x-gzip]Shranjevanje v: `noip-duc-linux.tar.gz'
noip-duc-linux.tar.gz 100%[================================>] 131,04K 200KB/s in 0,7s
2020-11-09 10:28:32 (200 KB/s) - `noip-duc-linux.tar.gz' shranjeno [134188/134188]
root@cybrotech:/usr/local/src# tar xf noip-duc-linux.tar.gzroot@cybrotech:/usr/local/src# sudo rm noip-duc-linux.tar.gzroot@cybrotech:/usr/local/src# cd noip-2.1.9-1/root@cybrotech:/usr/local/src/noip-2.1.9-1# sudo make installgcc -Wall -g -Dlinux -DPREFIX=\"/usr/local\" noip2.c -o noip2noip2.c: In function ‘dynamic_update’:noip2.c:1595:6: warning: variable ‘i’ set but not used [-Wunused-but-set-variable]  int i, x, is_group, retval, response;      ^noip2.c: In function ‘domains’:noip2.c:1826:13: warning: variable ‘x’ set but not used [-Wunused-but-set-variable]         int x;             ^noip2.c: In function ‘hosts’:noip2.c:1838:20: warning: variable ‘y’ set but not used [-Wunused-but-set-variable]         int x, y, z;                    ^noip2.c: In function ‘autoconf’:noip2.c:2538:19: warning: ‘%s’ directive writing up to 255 bytes into a region of size 247 [-Wformat-overflow=]  sprintf(line, "%s%s%s%s", USTRNG, login, PWDSTRNG, password);                   ^~ ~~~~~noip2.c:2538:2: note: ‘sprintf’ output between 16 and 526 bytes into a destination of size 256  sprintf(line, "%s%s%s%s", USTRNG, login, PWDSTRNG, password);  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~if [ ! -d /usr/local/bin ]; then mkdir -p /usr/local/bin;fiif [ ! -d /usr/local/etc ]; then mkdir -p /usr/local/etc;ficp noip2 /usr/local/bin/noip2/usr/local/bin/noip2 -C -c /tmp/no-ip2.conf
Auto configuration for Linux client of no-ip.com.
Please enter the login/email string for no-ip.com boris.perc@gmail.comPlease enter the password for user 'boris.perc@gmail.com' **********
Only one group [obala] is registered to this account.It will be used.Please enter an update interval:[30] 2880Do you wish to run something at successful update?[N] (y/N) N
New configuration file '/tmp/no-ip2.conf' created.
mv /tmp/no-ip2.conf /usr/local/etc/no-ip2.confroot@cybrotech:/usr/local/src/noip-2.1.9-1#
OBVEZNO ČE IMATE DINAMIČNI INTERNET KAR JE PO MOJI PRESOJI NAJSLABŠA VARIANTA KADAR GREDITE VAŠ ALI TUJI STREŽNIK, SAJ STREŽNIK MORA BITI NA FIKSNEM JAVNEM IPJU ALI PA IMATE SPET DODELJENE OZ. ZAKUPLJENE ENE PAR FIKSNIH IPJEV PREEKO VAŠEGA ISP OZ. INTERNETNEGA PROVIDERJA OZ. PONUDNIKA DOSTOPA DO INTERNETA!!!
## Privatni selfreg. SSL:***************************************************************************************************sudo a2enmod rewritesudo systemctl restart apache2
Certifikati: Selfsigned kot root obvezno!!! za 10 let sm uštimal daš lahko manj po želji!!!sudo mkdir -p /etc/ssl/localcertssudo openssl req -new -x509 -days 126800 -nodes -out /etc/ssl/localcerts/apache.pem -keyout /etc/ssl/localcerts/apache.keysudo chmod 600 /etc/ssl/localcerts/apache*# Extra v apache ssl enkripcija npr. za mail ali karkoli drugega da kodira apache output:sudo openssl req -new -x509 -days 126800 -nodes -out /etc/ssl/localcerts/webscada.pem -keyout /etc/ssl/localcerts/webscada.keysudo chmod 600 /etc/ssl/localcerts/webscada*
webscada@cybrotech:~ $ sudo mkdir -p /etc/ssl/localcerts
webscada@cybrotech:/usr/local/src $ cdwebscada@cybrotech:~ $ sudo mkdir -p /etc/ssl/localcertswebscada@cybrotech:~ $ cd /etc/ssl/localcertswebscada@cybrotech:/etc/ssl/localcerts $ sudo suroot@cybrotech:/etc/ssl/localcerts# sudo openssl req -new -x509 -days 3560 -nodes -out /etc/ssl/localcerts/apache.pem -keyout /etc/ssl/localcerts/apache.keyGenerating a RSA private key..+++++........................+++++writing new private key to '/etc/ssl/localcerts/apache.key'-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [AU]:SIState or Province Name (full name) [Some-State]:Obala Slovenija EULocality Name (eg, city) []:Portorose Lucija PiranOrganization Name (eg, company) [Internet Widgits Pty Ltd]:Piramide Studio HomeCraftSoft@2000Organizational Unit Name (eg, section) []:HandCrafted Software by Boris Perc PCS@1989Common Name (e.g. server FQDN or YOUR name) []:89-212-137-96.static.t-2.netEmail Address []:boris.perc@gmail.comroot@cybrotech:/etc/ssl/localcerts# sudo chmod 600 /etc/ssl/localcerts/apache*root@cybrotech:/etc/ssl/localcerts# cd /etc/apache2/sites-availableroot@cybrotech:/etc/apache2/sites-available# sudo nano default-ssl.confroot@cybrotech:/etc/apache2/sites-available# sudo a2ensite default-sslEnabling site default-ssl.To activate the new configuration, you need to run:  systemctl reload apache2root@cybrotech:/etc/apache2/sites-available# systemctl reload apache2root@cybrotech:/etc/apache2/sites-available# sudo a2enmod sslConsidering dependency setenvif for ssl:Module setenvif already enabledConsidering dependency mime for ssl:Module mime already enabledConsidering dependency socache_shmcb for ssl:Enabling module socache_shmcb.Enabling module ssl.See /usr/share/doc/apache2/README.Debian.gz on how to configure SSL and create self-signed certificates.To activate the new configuration, you need to run:  systemctl restart apache2root@cybrotech:/etc/apache2/sites-available# systemctl restart apache2root@cybrotech:/etc/apache2/sites-available#
sudo nano /etc/apache2/sites-available/default-ssl.conf
root@cybrotech:/etc/apache2/sites-available# sudo nano default-ssl.conf## Kopiraj nekja pod snokioil ssl od raspbianan:SSLCertificateFile /etc/ssl/localcerts/apache.pemSSLCertificateKeyFile /etc/ssl/localcerts/apache.key
SSLCertificateFile /etc/ssl/localcerts/webscada.pemSSLCertificateKeyFile /etc/ssl/localcerts/webscada.key
sudo a2dissite default-ssl# zdaj vklopi SSL tako:sudo a2ensite default-sslsudo a2enmod ssl
systemctl restart apache2
  systemctl reload apache2
###ModEvasive Apache 2.4sudo apt updatesudo apt install apache2-utilssudo apt install libapache2-mod-evasivesudo nano /etc/apache2/mods-enabled/evasive.confDOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
DOSEmailNotify sandi@sandiwebscada.ddns.net
DOSLogDir "/var/log/apache2/mod_evasive"
## Primer moje direktive za allow omrežja da me ne blokira mod evasive od apache za nič na svetu - to kar na koncu preden se zaključi koda vpišite vaše ipje ali kar dajte celotno vaše lokalno omrežje in je mir se pravi primer DOSWhitelist 192.168.1.* in je celotno moje omrežje za routerjem dovoljeno ga ne bo blokiral med kakršnimi koli scani ali uporabo forenzičnih aplikacij kot je kali linux ali blackarche!!!!DOSWhitelist 192.168.1.111DOSWhitelist 192.168.1.123DOSWhitelist 192.168.1.222DOSWhitelist 192.168.1.1

### Ali daš celo morežje localhost tvoj DHCP router server. je vsaka naprava v tvojem omrežju v allow cal router in vsi na njemu! Na serverju zakomentiraj moj localnetwork pusti si damo svoje ipje v allow preden daš v allow poglej napad kako izgleda: iz terminala zažgeš to:
perl /usr/share/doc/libapache2-mod-evasive/examples/test.plab -n 1000 -c 20 http://192.168.1.glavniserverzdadnjetri/
## Date npr. od vašega routerja oz. svičerja vse ipje ponavadi so ali 192.168.0.1/24 ali 192.168.1.1/24 odvisno od routerja lahko pa tudi 10.10.10.1/24 spet stvar kateri router imate!!!!!DOSWhitelist 192.168.0.*
## Ti daš tvoj ip maca ali kar celotno lokalno omrežje in vija so vsi v allow preo jaz mam točno samo določena win, pi1 pi glavni itd.... gsm in ostali v local host ne morejo bolj varno.DOSWhitelist 192.168.1.100DOSWhitelist 192.168.1.*

sudo mkdir /var/log/apache2/mod_evasivesudo chown -R www-data:www-data /var/log/apache2/mod_evasive

### Ustvari mape in čovnaj za virtualne hoste če maste večje število aplikacij na istem serverju - to vsekakor raspberry ne bo zmogel, saj je raspberry mikro serverček ponavadi samo za eno stvar oz. eno aplikacijo in ni zmožen npr. wordpress, webscada, ddlenigma, in kup drugih programov ali serverjev ne bo shajal, ampak npr. samo za webscado, webmail se pravi postfix, dovecot, roundcube bo še preveč močan!!!!!:sudo mkdir /var/www/html/sudo chown -R www-data:www-data /var/www/html/
sudo mkdir /var/www/webalizer/sudo chown -R www-data:www-data /var/www/webalizer/
sudo mkdir /var/www/ddl/sudo chown -R www-data:www-data /var/www/ddl/
sudo mkdir /var/www/sandi/sudo chown -R www-data:www-data /var/www/sandi/
sudo mkdir /var/log/named/sudo chown -R bind:bind /var/log/named/
sudo mkdir /var/log/apache2/mod_evasivesudo chown -R www-data:www-data /var/log/apache2/mod_evasive
apachectl -M | grep evasive
administracija@piramidstudionetwork:~ $ apachectl -M | grep evasive evasive20_module (shared)administracija@piramidstudionetwork:~ $ ab -n 1000 -c 20 http://192.168.77.111/This is ApacheBench, Version 2.3 <$Revision: 1843412 $>Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/Licensed to The Apache Software Foundation, http://www.apache.org/
Benchmarking 192.168.77.111 (be patient)Completed 100 requestsCompleted 200 requestsCompleted 300 requestsCompleted 400 requestsCompleted 500 requestsCompleted 600 requestsCompleted 700 requestsCompleted 800 requestsCompleted 900 requestsCompleted 1000 requestsFinished 1000 requests
# Testiraj če modul deluje v terminalu zažgi to komando:perl /usr/share/doc/libapache2-mod-evasive/examples/test.pl

sudo nano /usr/share/doc/libapache2-mod-evasive/examples/test.pl
Find the following line - najdi to linijo jo zakomentiraj ### in spodaj pod njo kopiraj drugo direktivo print $SOCKET "GET /?$_ HTTP/1.0\r\nHost: 127.0.0.1\r\n\r\n";

print $SOCKET "GET /?$_ HTTP/1.0\n\n";
Replace it with the following - zamenjaj zgornjo direktivo s to spodaj:
print $SOCKET "GET /?$_ HTTP/1.0\r\nHost: 127.0.0.1\r\n\r\n";
Save and close the file when you are finished. Then, run the script using the perl command:
perl /usr/share/doc/libapache2-mod-evasive/examples/test.pl
If everything works correctly, you should get the following output:
HTTP/1.1 403 ForbiddenHTTP/1.1 403 ForbiddenHTTP/1.1 403 ForbiddenHTTP/1.1 403 ForbiddenHTTP/1.1 403 ForbiddenHTTP/1.1 403 ForbiddenHTTP/1.1 403 ForbiddenHTTP/1.1 403 ForbiddenHTTP/1.1 403 ForbiddenHTTP/1.1 403 ForbiddenHTTP/1.1 403 ForbiddenHTTP/1.1 403 ForbiddenHTTP/1.1 403 ForbiddenHTTP/1.1 403 ForbiddenHTTP/1.1 403 ForbiddenHTTP/1.1 403 Forbidden ***************************************************************************************************#############################################################################################################Zdaj gremo namestit SQLsudo apt-get install mariadb-server mariadb-client -y
sudo apt update && sudo apt upgrade -y
##############################################################################################################Zdaj namestimo phpmyadmin
sudo apt-get install phpmyadmin -yphpmyadminbRjSra5JZfQRhumQCR9bnPghHBECbZZHrrhgdpqmhUcvwn9nPVz5AwKsvXBM7GRM

sudo nano +551 /usr/share/phpmyadmin/libraries/plugin_interface.lib.php
Search for if ($options != null && count($options) > 0)
Replace with if (! is_null($options) && count((array)$options) > 0)
sudo nano +551 /usr/share/phpmyadmin/libraries/plugin_interface.lib.phpPopravite alinejo ki se glasi tako:
if ($options != null && count($options) > 0) {spremenite tako, da izgleda tako:
if ($options != null && count((array)$options) > 0) {
## Ta debugizacija oz. razhroščevanje velja samo za php 7.4 !!!!!
sudo nano +1963 /usr/share/php/tcpdf/tcpdf.phpTCPDF_FONTS::utf8Bidi(array(''), '', false, $this->isunicode, $this->CurrentFont);###popravite tako oz. debugizirate odpravite hrošča z:TCPDF_FONTS::utf8Bidi(array(), '', false, $this->isunicode, $this->CurrentFont);
## Update phpmyadmin na najnovenši tako, ampak ga moraš skonfigurirat zaščita cooky se pravi blowfish koda 32mestno število min. zaradi varnosti:Naredi bazo podatkov za phpmyadmin tako:sudo apt updatesudo apt install php7.4-mbstring php7.4-zip php7.4-gdsudo apt install php-mbstring php-zip php-gd
## Protect phpmyadmin apache password:sudo htpasswd -c /etc/phpmyadmin/.htpasswd usernamesudo htpasswd /etc/phpmyadmin/.htpasswd additionaluser1sudo htpasswd /etc/phpmyadmin/.htpasswd additionaluser2 # Zdaj tako za ustvarit zaščito za dostop do phpmyadmin s kodo in uporabniškim imenom za prvi račun uporabite prvo direktivo -c in pot ter za vse ostale račune uporabite sudo htpasswd /etc/phpmyadmin/.htpasswd uporabnik = Enako velja kadar želite menjat za apache zaščita phpmyadmin, vpišete samo sudo htpasswd /etc/phpmyadmin/.htpasswd uporabnik in zamenjate kodo ko vaš vpraša za ta račun oz. uporabnika (ZAŠČITA APACHE ZA PHPMYADMIN!!!!!)
sudo htpasswd -c /etc/phpmyadmin/.htpasswd webscadasudo htpasswd /etc/phpmyadmin/.htpasswd sandisudo htpasswd /etc/phpmyadmin/.htpasswd borissudo htpasswd /etc/phpmyadmin/.htpasswd adminsudo htpasswd /etc/phpmyadmin/.htpasswd administratorsudo htpasswd /etc/phpmyadmin/.htpasswd webscada
Pass: MojaKodaZaZascitoPHPMyAdminDostopOZdaSEvamODPREprijavnoOkno cd /usr/share/phpmyadmin/sudo su#Naloži preko webmin filemanager iz neta pobran phpmyadmin, odpri ga in zapakiraj cel program nazaj phpmyadmin.zip brez da je v mapi phpmyadmin verzija.... in odpakiraj ga z webmin v glavno mapo /usr/share/phpmyadmin/phpmyadmin.zip Odgovori z A pomeni prepiši vse obvezno!!!! Unzip!!! Preko webmina samo klikni na zip levi miškin in izberi da odpakira, ko pa kaj rabiš pobirat log datoteke webapps pa se povežeš preko ssh over sftp protokol kak program za ssh serverje mislim da ga ima tudi filezilla ma jaz uporabljam za windows smartFTP ker mam pol vse s certifikati preko keepass program za hranit in varovat na računalniku javne certifikate tipo uni ki ga maš za firmo ali bančne kartice itd....sudo cp /usr/share/phpmyadmin/config.sample.inc.php /usr/share/phpmyadmin/config.inc.phpsudo nano /usr/share/phpmyadmin/config.inc.php##Izmisli si cooky zaščito pass bodo random zaščite uporabniških piškotkov$cfg['blowfish_secret'] = 'XzKPeQ765hMtPJDUbjCFtzAxzHJ2adv9'; /* YOU MUST FILL IN THIS FOR COOKIE AUTH! *//* User used to manipulate with storage */// $cfg['Servers'][$i]['controlhost'] = '';// $cfg['Servers'][$i]['controlport'] = '';$cfg['Servers'][$i]['controluser'] = 'pma';$cfg['Servers'][$i]['controlpass'] = 'MojaKodaZaNadgradnjePHPMyAdminINostalo';/* Storage database and tables */$cfg['Servers'][$i]['pmadb'] = 'phpmyadmin';$cfg['Servers'][$i]['bookmarktable'] = 'pma__bookmark';$cfg['Servers'][$i]['relation'] = 'pma__relation';$cfg['Servers'][$i]['table_info'] = 'pma__table_info';$cfg['Servers'][$i]['table_coords'] = 'pma__table_coords';$cfg['Servers'][$i]['pdf_pages'] = 'pma__pdf_pages';$cfg['Servers'][$i]['column_info'] = 'pma__column_info';$cfg['Servers'][$i]['history'] = 'pma__history';$cfg['Servers'][$i]['table_uiprefs'] = 'pma__table_uiprefs';$cfg['Servers'][$i]['tracking'] = 'pma__tracking';$cfg['Servers'][$i]['userconfig'] = 'pma__userconfig';$cfg['Servers'][$i]['recent'] = 'pma__recent';$cfg['Servers'][$i]['favorite'] = 'pma__favorite';$cfg['Servers'][$i]['users'] = 'pma__users';$cfg['Servers'][$i]['usergroups'] = 'pma__usergroups';$cfg['Servers'][$i]['navigationhiding'] = 'pma__navigationhiding';$cfg['Servers'][$i]['savedsearches'] = 'pma__savedsearches';$cfg['Servers'][$i]['central_columns'] = 'pma__central_columns';$cfg['Servers'][$i]['designer_settings'] = 'pma__designer_settings';$cfg['Servers'][$i]['export_templates'] = 'pma__export_templates';
// $cfg['TempDir'] = '';$cfg['TempDir'] = '/var/lib/phpmyadmin/tmp';$cfg['SaveDir'] = '/var/lib/phpmyadmin/doc';$cfg['UploadDir'] = '/var/lib/phpmyadmin/ddl';

## V terminalu ustvarite in čownajte oz. dodelite pooblastila apache serverju se pravi www-data!!!!!!!sudo mkdir /var/lib/phpmyadmin/docsudo mkdir /var/lib/phpmyadmin/ddlsudo chown -R www-data:www-data /var/lib/phpmyadmin/docsudo chown -R www-data:www-data /var/lib/phpmyadmin/ddl
Instaliraj password generator da maš pol kode vedno za karkoli tako:sudo apt install pwgenKodo generiraš npr. eno kodo od 32 mest tako:pwgen -s 32 1
To uporabljaj vedno in dajaj take kode random in vedno za vse dajaj minimum dolgo kodo 16 priporočljivo 32mest vedno tudi SQL itd... pero SQL ne sme bit !"#$ samo velike črke male in številke ne pozabit!!!!! Ko si odpakiral novo verzijo phpmyadmin v usr share phpmyadmin novo verzijo obvezno rabiš te module imet prej nameščene: sudo apt install php7.4-mbstring php7.4-zip php7.4-gdGremo dalje ko si uno gor naredu zdaj obvezno tako ko je nov program odpakiran v phpmyadmin - terminal:sudo mariadb < /usr/share/phpmyadmin/sql/create_tables.sqlsudo mariadbGRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'MojaKodaZaNadgradnjePHPMyAdminINostalo';GRANT ALL PRIVILEGES ON *.* TO 'webscada'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;exit

GRANT SELECT, INSERT, UPDATE, DELETE ON pma_db.* TO 'pma'@'localhost' IDENTIFIED BY 'MojaKodaZaNadgradnjePHPMyAdminINostalo';
# To spodaj ko ste v terminalu vstopili v SQL z komando sudo mariadb - dodelite pooblastila za phpmyadmin in uporabnika pma tako:GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'MojaKodaZaNadgradnjePHPMyAdminINostalo';
## To spodaj isto v mariadb strežniku določite še uporabnike, ki želite da imajo root pooblastila za phpmyadmin, vi si lahko date samo en račun npr. webscada ali pe še zraven vaš uporabniški račun, tako pol v phpmyadmin se prijavite z npr. uporabnik webscada in geslo ki ste ga določili za root sql!!!!!::::
GRANT ALL PRIVILEGES ON *.* TO 'igor'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL PRIVILEGES ON *.* TO 'webscada'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL PRIVILEGES ON *.* TO 'sandi'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL PRIVILEGES ON *.* TO 'boris'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;
exit

## Zdaj so samo tri računi tej ki so root koda SQL ostali nič, zdaj lahko direktno preko katerega koli zgoraj računa in z njegovo root sql kodo delaš baze kot root in generiraš uporabnike zapiraš tabele in dostop do določenih tabel ki so ključne itd itd... maš MariaDB vizualizacijo cel server in uporabnike dostop. ne znam v marioDB npr. če bi posredoval tebi določene baze sql perko spleta na tvoj xy server da zaščitim še mariou db z ssl ne znam tega nekaj sem probaval ma nič samo slike sm zjebal ker čim daš na ssl pol vse slike naložene preko nekriptiranih portov izginejo oz. so bela slika kodirano pero vse slike ki naložiš preko ssl jih vidiš pol preko ssl in čim izklopiš ssl vse slike v sql povezave ki so bile naložene preko ssl ne bodo vidne preko nessl marida. ne štekam ne znam naštimat.
sudo adduser adminsudo passwd admin

SQL Root uporabniki in gesla - super admin oz. super users: v phpmyadmin se prijaviš z eno od treh spodnjih uporabniških in njegovo kodo root sql ne rabiš menjavat kode root naj bo ista za server in sql baze:sudo adduser webscadasudo passwd webscadaMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser cybrotechsudo passwd cybrotechMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser sandisudo passwd sandiMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser borissudo passwd borisMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
root@cybrotech:/usr/share/phpmyadmin# sudo cp /usr/share/phpmyadmin/config.sample.inc.php /usr/share/phpmyadmin/config.inc.phproot@cybrotech:/usr/share/phpmyadmin# sudo nano /usr/share/phpmyadmin/config.inc.phproot@cybrotech:/usr/share/phpmyadmin# sudo mariadb < /usr/share/phpmyadmin/sql/create_tables.sqlroot@cybrotech:/usr/share/phpmyadmin# sudo mariadbWelcome to the MariaDB monitor. Commands end with ; or \g.Your MariaDB connection id is 61Server version: 10.3.25-MariaDB-0+deb10u1 Raspbian 10
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezela1991';GRANT ALL PRIVILEGES ON *.* TO 'webscada'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;Query OK, 0 rows affected (0.002 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON *.* TO 'webscada'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;Query OK, 0 rows affected (0.001 sec)
MariaDB [(none)]> exit
Zdaj imaš rešen phpmyadmin in najnovejša verzija se pravi 5.0.4 !!! ima vse not kar rabiš vklopi si pol po želji! tu vedno ZA NASTAVITVE phpmyadmin:sudo nano /usr/share/phpmyadmin/config.inc.php
***************************************************************************************************###Install ddl enigma and webmail databases ustvarite že ko ste za webscado še za roundcube baza in roundcube uporabnik in še za naš program direktni prenosi in izmenjava datotek Enigma HomeCraftSoft@2000 program je na voljoj preko github ali sourceforge!!!!:
sudo adduser webscadasudo passwd webscadaMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser percsudo passwd percpercMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser borissudo passwd borisMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser sandisudo passwd sandiMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser igorMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo passwd linuxsudo adduser linuxlinuxterMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer

phpmyadmin zaščita koda: Dajte si eno kodo, da zaščitite vstopni program phpmyadmin preko apache!!!!!!sudo htpasswd -c /etc/phpmyadmin/.htpasswd cybrotechsudo htpasswd /etc/phpmyadmin/.htpasswd webscadasudo htpasswd /etc/phpmyadmin/.htpasswd sandisudo htpasswd /etc/phpmyadmin/.htpasswd borissudo htpasswd /etc/phpmyadmin/.htpasswd adminsudo htpasswd /etc/phpmyadmin/.htpasswd webscada
Pass: MojaKodaZaZascitoPHPMyAdminDostopOZdaSEvamODPREprijavnoOkno
## Rename datoteko usr share phpmyadmin 123.htaccess v samo .htaccess in za dostop so tej gor userji plus koda je spodaj za vse enkaka to lahko spremeniš za vsakega userja posebej v terminalu kadar češ npr. sudo htpasswd /etc/phpmyadmin/.htpasswd cybrotech = koda SlovenijaMojaDezela1977 daš karkoli hočeš ti!!!!cybrotechsudo mysql_secure_installation
sudo mysql --user=root --password=SlovenijaMojaDezala1991SandiWEBScadaDDSPrimorskeSkupnostiInformacijskaTehnologijaSandiWEBScada2020WEB
create database bazaddlenigma;create user 'ddlenigma2020'@'localhost' identified by 'W3qsCk2F3e42yNEaF5E4AGN3yXDBumQN4yCMpSqEFvypQzERRFZd62TUqFkj7UVG';grant all privileges on bazaddlenigma.* to 'ddlenigma2020'@'localhost';create database epostabaza;create user 'epostauser'@'localhost' identified by 'BgHFVp3GeVe2pzEbZ5kQj7fqh3x88cUVfbpMyhE893QU9mPvh6PHbPasDFVFnAyc';grant all privileges on epostabaza.* to 'epostauser'@'localhost';flush privileges;create database roundcube;create user 'roundcube'@'localhost' identified by 'PMCDDE9kwFeXHwyeXvZyBATTqspqKXDQMm8aXvJe3aV5snNqwRQv5KZ4qy5nu3yn';grant all privileges on roundcube.* to 'roundcube'@'localhost';flush privileges;create database audiobaza;create user 'audiouser'@'localhost' identified by 'Y5FyVbmDW57Db3WJwFjsHtkBycvHkAcYxCt3KJcmRRkEYPrRuHs5XnbxwDgx5AH3';grant all privileges on audiobaza.* to 'audiouser'@'localhost';flush privileges;create database windowsnt;create user 'windowsntuser'@'localhost' identified by 'GRNY84Ht4fC8bwZsBdgNa3b84MCZzm8qXaYGmWhwMqMPmvRgk3urr6PJTntcYgc8';grant all privileges on windowsnt.* to 'ampacheuser'@'localhost';flush privileges;create database serverbaza;create user 'serveruser'@'localhost' identified by 'GZ9xpkHHdmxQNWcQVnPQxxFynRQrSWmWDZhYbuM3zjzyP767ADQDKTysMjAr8csE';grant all privileges on serverbaza.* to 'windowsntuser'@'localhost';flush privileges;create database webscadabaza;create user 'webscadauser'@'localhost' identified by 'zgHqeGMyzG9hExCEgNepg9XRhUv2jrBMc55XZFH7a7HscsEZky9B5kfa5RABnXgq';grant all privileges on webscadabaza.* to 'webscadauser'@'localhost';flush privileges;exit;
## Vse moje programe, ki sem jih razvil in jih razvijam vse od leta 2000 dalje boste dobili preko SourceForge ali GitHub, moj osebni račun ali račun skupnosti!!!Database Name: bazaddlenigmaUser Name: ddlenigma2020Password: W3qsCk2F3e42yNEaF5E4AGN3yXDBumQN4yCMpSqEFvypQzERRFZd62TUqFkj7UVGDatabase Host: localhostTable Prefix: ddlprenosi_
Database Name: epostabazaUser Name: epostauserPassword: BgHFVp3GeVe2pzEbZ5kQj7fqh3x88cUVfbpMyhE893QU9mPvh6PHbPasDFVFnAycDatabase Host: localhost
Database Name: roundcubeUser Name: roundcubePassword: PMCDDE9kwFeXHwyeXvZyBATTqspqKXDQMm8aXvJe3aV5snNqwRQv5KZ4qy5nu3ynDatabase Host: localhost
## Vse moje programe, ki sem jih razvil in jih razvijam vse od leta 2000 dalje boste dobili preko SourceForge ali GitHub, moj osebni račun ali račun skupnosti!!!Database Name: audiobazaUser Name: audiouserPassword: Y5FyVbmDW57Db3WJwFjsHtkBycvHkAcYxCt3KJcmRRkEYPrRuHs5XnbxwDgx5AH3Database Host: localhost
Database Name: windowsntUser Name: windowsntuserPassword: GRNY84Ht4fC8bwZsBdgNa3b84MCZzm8qXaYGmWhwMqMPmvRgk3urr6PJTntcYgc8Database Host: localhost
Database Name: serverbazaUser Name: serveruserPassword: GZ9xpkHHdmxQNWcQVnPQxxFynRQrSWmWDZhYbuM3zjzyP767ADQDKTysMjAr8csEDatabase Host: localhost
Database Name: webscadabazaUser Name: webscadauserPassword: zgHqeGMyzG9hExCEgNepg9XRhUv2jrBMc55XZFH7a7HscsEZky9B5kfa5RABnXgqDatabase Host: localhost
# database settingsDatabaseEngine = "mysql"DatabaseHost = "localhost"DatabaseName = "webscadabaza"DatabaseUser = "webscadauser"DatabasePassword = "zgHqeGMyzG9hExCEgNepg9XRhUv2jrBMc55XZFH7a7HscsEZky9B5kfa5RABnXgq"
Geslo WEB Scada superuser and DDLEnigma SuperUser: boris.perc@gmail.comBorisP77&JeBi-Se-U-3-PiZdE-mAtErInE-1991-PiRaMiDe-StUdIo-1989!
sandi.poberaj@gmail.comSandiP77&JeBi-Se-U-3-PiZdE-mAtErInE-1991-AsTeRiX77-IzOlA-1989!
################################################################################################################################################prijavi se v phpmyadminphpmyadminbRjSra5JZfQRhumQCR9bnPghHBECbZZH
Vidiš vse ok ker če ne je preveč bugov za popravljat ti moraš prej samo ta dva buga odpravit:
Ko to narediš najnovejši phpmyadmin pol tip avtomatično popravi vse buge oz. hrošče!!!!!! samo una dva moraš popravit prej!!!!sudo nano +1963 /usr/share/php/tcpdf/tcpdf.phpsudo nano +551 /usr/share/phpmyadmin/libraries/plugin_interface.lib.php
## Primer nadgradnje iz original repository debian ko ste dali sudo apt install phpmyadmin se vam bo stara verzija namestila za phpmyadmin zdaj jo gremo nadgradit na najnovejšo v tem primeru je že zunaj 5.1.1sudo apt install -y php7.4-mysql php7.4-dom php7.4-simplexml php-ssh2 php7.4-xml php7.4-xmlreader php7.4-curl php7.4-exif php7.4-ftp php7.4-gd php7.4-iconv php7.4-imagick php7.4-json php7.4-mbstring php7.4-posix php7.4-sockets php7.4-tokenizersudo apt install php7.4-{fpm,common,mysql,cgi,xml,xmlrpc,curl,gd,imagick,cli,dev,imap,mbstring,opcache,soap,zip,intl,bcmath} -y

sudo apt-get install phpmyadmin -ypESMaZbkcvN79kR3K4BeKtRdDNySYQSrEWUSgrXt
sudo nano +551 /usr/share/phpmyadmin/libraries/plugin_interface.lib.php
if ($options != null && count($options) > 0) {spremeni tako:if ($options != null && count((array)$options) > 0) {
sudo nano /etc/php/7.4/apache2/php.ini
sudo nano +1963 /usr/share/php/tcpdf/tcpdf.phpTCPDF_FONTS::utf8Bidi(array(''), '', false, $this->isunicode, $this->CurrentFont);###popravite tako oz. debugizirate odpravite hrošča z:TCPDF_FONTS::utf8Bidi(array(), '', false, $this->isunicode, $this->CurrentFont);
## Update phpmyadmin na najnovenši tako, ampak ga moraš skonfigurirat zaščita cooky se pravi blowfish koda 32mestno število min. zaradi varnosti:Naredi bazo podatkov za phpmyadmin tako:sudo apt updatesudo apt install php7.4-mbstring php7.4-zip php7.4-gd -y
#Primer če želite od mene probrat phpmyadmin že vse pripravljen samo pol rename oz. preimenujte datoteko 123.htaccess da vklopite apache zaščito phpmyadmin s kodo zaradi večje varnosti, in kaj majo drugi za šlatat po vešem sql serverju ma prav nič!!!!!!cd /usr/share/phpmyadmin/sudo suwget https://perc.ddns.net/downloads/phpmyadmin504.zipunzip phpmyadmin504.ziprm phpmyadmin504.zip###Odgovori z A pomeni prepiši vse obvezno!!!!

sudo cp /usr/share/phpmyadmin/config.sample.inc.php /usr/share/phpmyadmin/config.inc.phpsudo nano /usr/share/phpmyadmin/config.inc.php
$cfg['blowfish_secret'] = 'wZtv5pP7D2bh9EzWVWe5W4hAUgdGWmXU'; /* YOU MUST FILL IN THIS FOR COOKIE AUTH! *//* User used to manipulate with storage */// $cfg['Servers'][$i]['controlhost'] = '';// $cfg['Servers'][$i]['controlport'] = '';$cfg['Servers'][$i]['controluser'] = 'pma';$cfg['Servers'][$i]['controlpass'] = 'SlovenijaMojaDezela1991';/* Storage database and tables */$cfg['Servers'][$i]['pmadb'] = 'phpmyadmin';$cfg['Servers'][$i]['bookmarktable'] = 'pma__bookmark';$cfg['Servers'][$i]['relation'] = 'pma__relation';$cfg['Servers'][$i]['table_info'] = 'pma__table_info';$cfg['Servers'][$i]['table_coords'] = 'pma__table_coords';$cfg['Servers'][$i]['pdf_pages'] = 'pma__pdf_pages';$cfg['Servers'][$i]['column_info'] = 'pma__column_info';$cfg['Servers'][$i]['history'] = 'pma__history';$cfg['Servers'][$i]['table_uiprefs'] = 'pma__table_uiprefs';$cfg['Servers'][$i]['tracking'] = 'pma__tracking';$cfg['Servers'][$i]['userconfig'] = 'pma__userconfig';$cfg['Servers'][$i]['recent'] = 'pma__recent';$cfg['Servers'][$i]['favorite'] = 'pma__favorite';$cfg['Servers'][$i]['users'] = 'pma__users';$cfg['Servers'][$i]['usergroups'] = 'pma__usergroups';$cfg['Servers'][$i]['navigationhiding'] = 'pma__navigationhiding';$cfg['Servers'][$i]['savedsearches'] = 'pma__savedsearches';$cfg['Servers'][$i]['central_columns'] = 'pma__central_columns';$cfg['Servers'][$i]['designer_settings'] = 'pma__designer_settings';$cfg['Servers'][$i]['export_templates'] = 'pma__export_templates';
$cfg['TempDir'] = '/var/lib/phpmyadmin/tmp';$cfg['SaveDir'] = '/var/lib/phpmyadmin/doc';$cfg['UploadDir'] = '/var/lib/phpmyadmin/ddl';

sudo mkdir /var/lib/phpmyadmin/docsudo mkdir /var/lib/phpmyadmin/ddl
sudo chown -R www-data:www-data /var/lib/phpmyadmin/docsudo chown -R www-data:www-data /var/lib/phpmyadmin/ddl
Instaliraj password generator da maš pol kode vedno za karkoli tako:sudo apt install pwgenKodo generiraš npr. eno kodo od 32 mest tako:pwgen -s 32 1
sudo adduser webscadasudo passwd webscadaMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser percsudo passwd percpercMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser borissudo passwd borisMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser sandisudo passwd sandiMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser igorMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo passwd linuxsudo adduser linuxlinuxterMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer

GRANT SELECT, INSERT, UPDATE, DELETE ON pma_db.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezela1991';GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezela1991';
##Gremo dalje ko si uno gor naredu zdaj obvezno tako ko ste npr. preko WEBMin ali ftp serverja naložili v mapo /usr/share/phpmyadmin/ novo verzijo programa se pravi v tem primeru 5.1.1, tako gremo na phpmyadmin uradno stran poberemo najnovejšo verzijo jo odpakiramo na naš računalnik iz jo zapakiramo brez mape vse datoteke kot so v usr/share/phpmyadmin naložite ali pa preko terminala npr. poberete in odzipate phpmyadmin v npr. tmp/phpmyadmin/phpmyadmin-verzija/ to vse kopirajte v mapo user/share/phpmyadmin ali najlažje preko webmin doma zapakirate mapo phpmyadmin-verzijaXY nazaj brez te mape v npr. phpmyadmin.zip in preko filemanager odprete pot usr/share/phpmyadmin in tukaj naložite tako tools in izberite filemanager ter mapo usr/share/phpmyadmin/ in ko ste na njej kliknite File in jeziček Upload to current directory ter z desnim miškinim kazalcom ko ste naložili kliknete na phpmyadmin.zip in z desnim miškinim kazalcem v meniju izberite "Extract" ter zdaj za namestit posodobitev sledite spodaj navodilom Jaj sem delelil še računom pod npr. sql kodo to si dajte npr. vaša koda od linuxa za vsak račun ki mu hočete doteliti root pooblastila za generirat baze podatkov:## Zdaj gremo nadgradit phpmyadmin prvo namestite te module ki jih potrebuje phpmyadmin: sudo apt updatesudo apt install php7.4-mbstring php7.4-zip php7.4-gd -ysudo mariadb < /usr/share/phpmyadmin/sql/create_tables.sqlsudo mariadbGRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezela1991';GRANT SELECT, INSERT, UPDATE, DELETE ON pma_db.* TO 'pma'@'localhost' IDENTIFIED BY 'SlovenijaMojaDezela1991';GRANT ALL PRIVILEGES ON *.* TO 'cybrotech'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL PRIVILEGES ON *.* TO 'webscada'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL PRIVILEGES ON *.* TO 'linux'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL PRIVILEGES ON *.* TO 'perc'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL PRIVILEGES ON *.* TO 'sandi'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;GRANT ALL PRIVILEGES ON *.* TO 'admin'@'localhost' IDENTIFIED BY 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' WITH GRANT OPTION;
## Jaz sem dal npr. za root uporabnike sql zgoraj navedena uporabniška imena vi dajte samo vaš račun kjer je scada in npr. še en vaš račun ki želite da ima sudo oz. root pooblastila!!!!!

# Zaščita phpmyadmin z geslomsudo nano /etc/apache2/conf-available/phpmyadmin.conf# phpMyAdmin default Apache configuration
Alias /phpmyadmin /usr/share/phpmyadmin
<Directory /usr/share/phpmyadmin>    Options SymLinksIfOwnerMatch    DirectoryIndex index.php AllowOverride All    <IfModule mod_php5.c>        <IfModule mod_mime.c>            AddType application/x-httpd-php .php        </IfModule>        <FilesMatch ".+\.php$">            SetHandler application/x-httpd-php        </FilesMatch>
        php_value include_path .        php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp        php_admin_value open_basedir /usr/share/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/:/usr/share/php/php-gettext/:/usr/share/php/php-php-gettext/:/usr/share/javascript/:/usr/share/php/tcpdf/:/usr/share/doc/phpmyadmin/:/usr/share/php/phpseclib/        php_admin_value mbstring.func_overload 0    </IfModule>    <IfModule mod_php.c>        <IfModule mod_mime.c>            AddType application/x-httpd-php .php        </IfModule>        <FilesMatch ".+\.php$">            SetHandler application/x-httpd-php        </FilesMatch>
        php_value include_path .        php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp        php_admin_value open_basedir /usr/share/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/:/usr/share/php/php-gettext/:/usr/share/php/php-php-gettext/:/usr/share/javascript/:/usr/share/php/tcpdf/:/usr/share/doc/phpmyadmin/:/usr/share/php/phpseclib/        php_admin_value mbstring.func_overload 0    </IfModule>
</Directory>
# Authorize for setup<Directory /usr/share/phpmyadmin/setup>    <IfModule mod_authz_core.c>        <IfModule mod_authn_file.c>            AuthType Basic            AuthName "phpMyAdmin Setup"            AuthUserFile /etc/phpmyadmin/.htpasswd        </IfModule>        Require valid-user    </IfModule></Directory>
# Disallow web access to directories that don't need it<Directory /usr/share/phpmyadmin/templates>    Require all denied</Directory><Directory /usr/share/phpmyadmin/libraries>    Require all denied</Directory><Directory /usr/share/phpmyadmin/setup/lib>    Require all denied</Directory>
### Za vklopit zaščito tako v nastavitvah phpmyadmin dodajte samo to direktivo AllowOverride All in v usr/share/phpmyadmin/.htaccess dodajte spodaj direktive za vklop apache zaščite za dostop do webapp:sudo nano /etc/apache2/conf-available/phpmyadmin.conf<Directory /usr/share/phpmyadmin>    Options FollowSymLinks    DirectoryIndex index.php    AllowOverride All
    <IfModule mod_php5.c>    . . . sudo a2enconf phpmyadmin.confsudo systemctl reload apache2
##V terminalu generiraj geslo in uporabnike za dostop do phpmyadmin / SQL baz podatkov....sudo htpasswd -c /etc/phpmyadmin/.htpasswd cybrotechsudo htpasswd /etc/phpmyadmin/.htpasswd sandisudo htpasswd /etc/phpmyadmin/.htpasswd boris# vsi naslednji uporabniki ki jih generiraš sudo htpasswd /etc/phpmyadmin/.htpasswd uporabnikPass za vse: slovenijamojadezela1991
sudo systemctl restart apache2
# Zdaj še zaščitite z kodo vaš phpmyadmin - generiraj datoteko .htaccess in kopiraj samo spodnje direktive v njo kodo za uporabnike glej zgoraj kako si naredit za vse ostale in za sebe!!!!!!
sudo nano /etc/phpmyadmin/.htaccessAuthType BasicAuthName "Restricted Files"AuthUserFile /etc/phpmyadmin/.htpasswdRequire valid-user
# Se pravi pol generiraj kolikor hočeš uporabnikov za phpmyadmin tako - Generiraj kodo za phpmyadmin dostop:sudo htpasswd -c /usr/share/phpmyadmin/.htpasswd usernameoz.uporabnik# Vsak nadaljni user oz. uporabnik phpmyadmin zaščita apache s kodo tako:sudo htpasswd /etc/phpmyadmin/.htpasswd uporabnik2
Geslo po želji!!! jaz mam standard za vse: slovenijamojadezala1991

sudo phpenmod mysqlisudo a2enmod rewritesudo systemctl restart apache2################################################################################################################################################

### Geo ip modul za apahce
sudo apt install libapache2-mod-geoip
#aptitude install libapache2-mod-geoip
This will complete the installation
Configuring Geoip
Vklopi geo ip tako:
sudo nano /etc/apache2/mods-available/geoip.conf
<IfModule mod_geoip.c>GeoIPEnable OnGeoIPDBFile /usr/share/GeoIP/GeoIP.dat</IfModule>

Priporočljivi moduli php:sudo apt-get install php7.4 php7.4-cli php7.4-cgi php7.4-fpm php7.4-gd php7.4-mysql php7.4-imap php7.4-curl php7.4-intl php7.4-pspell php7.4-sqlite3 php7.4-tidy php7.4-xmlrpc php7.4-xsl php7.4-zip php7.4-mbstring php7.4-soap php7.4-opcache libonig5 php7.4-common php7.4-json php7.4-readline php7.4-xml
Obvezno če hočeš da linux prepoznava slike itd.. TO OBVEZNO ZARADI WEBMIN POL DA TI KAŽE SLIKE IN DA PREPOZNAVA LINUX VSE FORMATE SLIK!!!!!!sudo apt-get install php7.4-imagick libmagickcore-dev -y
To aktiviraš module za apache rewrite se pravi .htaccess parametri po izbiri kot si programiral!!!!!###sudo phpenmod mysqli To ne rebiš uklopit ker je že ko si instaliral mariaDB v starih sql si mogu zdaj ne rabi več!!!!!!sudo a2enmod rewritesudo service apache2 restartsudo service apache2 status
# To ti ne bom pisal veš na pamet že samo filtri anti DDoS atack get post in scada prijava in phpmyadmin oz. SQL zaščita preko phpmyadmin to je vse kar rabiš!sudo apt update && sudo apt upgrade -ysudo apt install fail2ban -ysudo apt install fail2ban -ysudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.localsudo nano /etc/fail2ban/jail.localenabled = truefilter = apache-badbotsls /etc/fail2ban/filter.d/## Kateri filtri so aktivni!!!!glej moja stran wordpress maš vse filtre kako se jih napiše glavni so apache-myadmin to je SQL in phpmyadmin pol scada in DDoS zaščita ter error ma ta je preveč hard čim kdorkoli zažge scan ga zaklene tako da pol ne rabiš skoraj noben filter več od apache ma jih pusti vse vklopljene za apache!!!! ala amico zdaj ti preostane samo še namestit scado tako da namesti prvo spodaj vse dependent programe oz. skripte python maria db in client maš že nameščen zdaj samo še te spodaj dodatne programe za webscada da ti dela:################################################################################################################################################Zdaj ko smo vse to gor namestili in uredili oz. naredili gremo namestit vse kar rabimo za scado tako - preden narediš secure install sql!!!!! obvezno!- OS update:    $ sudo apt-get update    $ sudo apt-get upgrade
Software install for SCADA requirement:    $ sudo apt-get install apache2 phpmyadmin libapache2-mod-wsgi acl ssh -y    $ sudo apt-get install python-django python-pip python-mysqldb -y    $ sudo pip install pytz    $ sudo apt-get install python-pip python-mysqldb    $ sudo pip install django==1.3    $ sudo apt-get install python-dev python-setuptools    $ sudo apt-get install libjpeg-dev zlib1g-dev    $ sudo pip install pillow - Apache set up:                                                                            $ sudo nano /etc/apache2/apache2.conf                                                                                      copy below text to the end of file                                       --------------------------------------------------------------------------------      Alias /static/ /home/cybrotech/app/solar_cybro/static/                      <directory "/home/cybrotech/app/solar_cybro/static/">                           Order deny,allow    Require all granted                            </directory>                                                                                                                                    # solar cybro web application data directory                            Alias /data/ /home/cybrotech/app/solar_cybro/data/                          <directory "/home/cybrotech/app/solar_cybro/data/">                             Order deny,allow    Require all granted                            </directory>                                                                                                                                    # location of solar cybro wsgi startup file                             WSGIScriptAlias / /home/cybrotech/app/solar_cybro/solar_cybro.wsgi          <directory "/home/cybrotech/app/solar_cybro/">                                  Order deny,allow    Require all granted                            </directory> --------------------------------------------------------------------------------        ServerName localhost   ##ServerName solarserver:80                                                                                                                       # solar cybro web application static files directory                    Alias /static/ /home/cybrotech/app/solar_cybro/static/                      <directory "/home/cybrotech/app/solar_cybro/static/">                           Order deny,allow                                                        Require all granted                            </directory>                                                                                                                                    # solar cybro web application data directory                            Alias /data/ /home/cybrotech/app/solar_cybro/data/                          <directory "/home/cybrotech/app/solar_cybro/data/">                             Order deny,allow                                                        Require all granted                            </directory>                                                                                                                                    # location of solar cybro wsgi startup file                             WSGIScriptAlias / /home/cybrotech/app/solar_cybro/solar_cybro.wsgi          <directory "/home/cybrotech/app/solar_cybro/">                                  Order deny,allow                                                        Require all granted                            </directory>

## Te nastavitve boste dobili če uporabljate WEBMIN kar vam zelo svetujem modul mpm prefork ali katerikoli drugi pa omejite procese delovanja serverja, da se vam ne bodo timeplot in podobne tabele ko se generirajo za različne analize in grafični prikazovalnik webscada zgodovine karkoli temperatura bojlerja, sončne celite output in poraba ter vse ostalo kar potrebujete......################ modul apache mpm prefork global settings in enega vklopi od teh treh ne vem kateri je za scado omejevalec?#### To daj ko dela wscgi server da ga omejiš ne preden instaliraš scado!!!!! te nastavitve so v apache dva pod utilsuni jeziček in najdi modul mpm prefork enega vklopi kar v webmin ne vem točno scada keterega uporabla mislim da vsakega ki ga določiš ma ne štekam zakaj je ta modul sploh. omejuješ procese ma kje php skripti ali kaj druzga???## Extra pogoji omejitve SCGI da ne dela kot norec:##
## Server-Pool Size Regulation (MPM specific)
##

# prefork MPM
# StartServers: number of server processes to start
# MinSpareServers: minimum number of server processes which are kept spare
# MaxSpareServers: maximum number of server processes which are kept spare
# MaxClients: maximum number of server processes allowed to start
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule mpm_prefork_module>
    StartServers 5
    MinSpareServers 5
    MaxSpareServers 10
    MaxClients 150
    MaxRequestsPerChild 0
</IfModule>

# worker MPM
# StartServers: initial number of server processes to start
# MinSpareThreads: minimum number of worker threads which are kept spare
# MaxSpareThreads: maximum number of worker threads which are kept spare
# ThreadLimit: ThreadsPerChild can be changed to this maximum value during a
# graceful restart. ThreadLimit can only be changed by stopping
# and starting Apache.
# ThreadsPerChild: constant number of worker threads in each server process
# MaxClients: maximum number of simultaneous client connections
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule mpm_worker_module>
    StartServers 2
    MinSpareThreads 25
    MaxSpareThreads 75
    ThreadLimit 64
    ThreadsPerChild 25
    MaxClients 150
    MaxRequestsPerChild 0
</IfModule>

# event MPM
# StartServers: initial number of server processes to start
# MinSpareThreads: minimum number of worker threads which are kept spare
# MaxSpareThreads: maximum number of worker threads which are kept spare
# ThreadsPerChild: constant number of worker threads in each server process
# MaxClients: maximum number of simultaneous client connections
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule mpm_event_module>
    StartServers 2
    MinSpareThreads 25
    MaxSpareThreads 75
    ThreadLimit 64
    ThreadsPerChild 25
    MaxClients 150
    MaxRequestsPerChild 0
</IfModule>                                                           --------------------------------------------------------------------------------      Ustvari mape ki jih rabimo se pravi za skripte npr. css in analize    Create directories:
mkdir /home/webscada/app/solar_cybro/data/cachemkdir /home/webscada/app/solar_cybro/data/mediamkdir /home/webscada/app/solar_cybro/data/scriptsmkdir /home/webscada/app/solar_cybro/data/analize
# Ustvarite si še npr. dodatne mape, kjer boste uporabili vaše javascripte npr. pri generaciji grafičnih števcev ali karkoli grafičnega, ki potrebuje praktično video oz. aktivne slikice za karkoli vklop, izklop, višina temperature grafični števec oz. termometer ipd.....
sudo mkdir /home/cybrotech/app/solar_cybro/data/cachesudo mkdir /home/cybrotech/app/solar_cybro/data/mediasudo mkdir /home/cybrotech/app/solar_cybro/data/scriptssudo mkdir /home/cybrotech/app/solar_cybro/data/analize----------------------------------------------------------------------#Perc customm install scada on port 80 virtual host webscada - to imam jaz tako nameščeno scado ker pač nočem da se izvaja v apache.conf direktno na vstopnem strežniku, saj pol ne moreš narediti drugih virtualnih hostov, zato si jaz po meni naemstim webscado v drugo lokacijo se pravi apache, postopek je isti smo pol določim npr. za eno od mojih domen v apache.conf pot se pravi /var/www/app/ in v 000-default.conf naredim virtualni host v mojem primer npr. server name je webscada.perc.ddns.net ali uporabljam freenom.com domene identično kot npr. noip.com :mkdir /var/www/app/solar_cybro/data/cachemkdir /var/www/app/solar_cybro/data/mediamkdir /var/www/app/solar_cybro/data/scriptsmkdir /var/www/app/solar_cybro/data/analize
# To za spremenit aplikaciji pooblastila da bo deloval server (obvezno sudo su root pooblastila ko izvajate takšne operacije)!!!!setfacl -m u:www-data:--x /home/cybrotech/appsetfacl -R -m u:www-data:--- /home/cybrotech/app/*setfacl -R -m u:www-data:rwx /home/cybrotech/appsetfacl -R -m d:u:www-data:rwx /home/cybrotech/appchmod g+s /home/cybrotech/appsetfacl -R -m d:u:cybrotech:rwx /home/cybrotech/app
# Obvezno spremenit pooblastila datotekam od serverja se pravi obvezno to spodaj (morate bit kot root se pravi sudo su!!!!)chmod 755 /home/cybrotech/app/scgi_server/src/cybro_com_server.pychmod 755 /home/cybrotech/app/scgi_server/src/cybro_scgi_server.pychmod 755 /home/cybrotech/app/scgi_server/src/run_scgi_server.py----------------------------------------------------------------------
#Granting Apache access to data directory - Se pravi $HOME to pomeni pri meni se pravi /home/cybrotech/ in ostalo /home/cybrotech/app/* itd....
setfacl -m u:www-data:--x $HOMEsetfacl -R -m u:www-data:--- $HOME/app/*setfacl -R -m u:www-data:rwx $HOME/appsetfacl -R -m d:u:www-data:rwx $HOME/appchmod g+s $HOME/appsetfacl -R -m d:u:cybrotech:rwx $HOME/app
## V kolikor ste namestili scado v mapo na npr. pot var/www/app!!!!! Drugače uporabitre to zgoraj se pravi /home/vašusername-kjerjescada/setfacl -m u:www-data:--x /var/wwwsetfacl -R -m u:www-data:--- /var/www/app/*setfacl -R -m u:www-data:rwx /var/www/appsetfacl -R -m d:u:www-data:rwx /var/www/appchmod g+s /var/www/appsetfacl -R -m d:u:cybrotech:rwx /var/www/app
Set executable permissions
chmod 755 app/scgi_server/src/cybro_com_server.pychmod 755 app/scgi_server/src/cybro_scgi_server.pychmod 755 app/scgi_server/src/run_scgi_server.py
/home/cybrotechsetfacl -m u:www-data:--x /home/cybrotechsetfacl -R -m u:www-data:--- /home/cybrotech/app/*setfacl -R -m u:www-data:rwx /home/cybrotech/appsetfacl -R -m d:u:www-data:rwx /home/cybrotech/appchmod g+s /home/cybrotech/appsetfacl -R -m d:u:cybrotech:rwx /home/cybrotech/app
Autostart scgi server when machine boots:
    Edit /etc/rc.local and add following line before "exit 0" uredite to datoteko etc rc.local in vpišite samo pot kjer ste vi namestili webscado!!!!: sudo nano /etc/rc.local        sudo -u cybrotech /home/cybrotech/app/scgi_server/src/run_scgi_server.py
## To date v rc.local datoteko če ste namestili scado preko virtualnega hosta če ne date vašo pot kot je zgoraj npr. pri meni sudo -u cybrotech /home/cybrotech/app/scgi_server/src/run_scgi_server.py## To za drugi način namestitve webscada preko virtualnega hosta apache!!!! sudo -u cybrotech /var/www/app/scgi_server/src/run_scgi_server.py sudo nano /home/cybrotech/app/scgi_server/src/run_scgi_server.pyCron configuration
    Edit /home/webscada/app/scgi_server/src/run_scgi_server.py and change the shell executable in the first line to:        #!/usr/bin/python
    Edit crontab:        $ crontab -e    Add following lines to automatically start scgi server and reporting engine:*/1 * * * * /home/webscada/app/scgi_server/src/run_scgi_server.py &>/dev/null*/10 * * * * /home/webscada/app/solar_cybro/project/run_create_reports.py &>/dev/null*/2 * * * * /home/webscada/app/solar_cybro/project/run_send_reports.py &>/dev/null
*/1 * * * * /home/cybrotech/app/scgi_server/src/run_scgi_server.py &>/dev/null*/10 * * * * /home/cybrotech/app/solar_cybro/project/run_create_reports.py &>/dev/null*/2 * * * * /home/cybrotech/app/solar_cybro/project/run_send_reports.py &>/dev/null
Restart Apache    $ sudo apachectl -k restart
PS za cron job če hočeš da dela to je da ti scada pošilja na mail repport oz. analize:*/10 * * * * /home/webscada/app/solar_cybro/project/run_create_reports.py &>/dev/null*/2 * * * * /home/webscada/app/solar_cybro/project/run_send_reports.py &>/dev/null
moraš uvozit to bazo podatkov to ti je za emaile repporti tudi pol maš v glavni mapi settings.local.py spremeniš smtp.server.tk če uporabljaš kot jaz poleg noip.com še freenom domene .tk, .ml, .ga,.... itd..... brezplačno lahko pa tudi tam pri freenom registrirate vašo net ali com ali org domeno brez problemov so najcenejši in zelo enostavno za uporabljat, podobno noip.com samo s to razliko da vam oni ne bodo blokirali mailov oz. nič ne bodo blokirali, priporočam pol zakup pri njih eno com domeno ali org ali net to kar rabi vaše podjetje, da ne boste na teh free domenah tk, ga, ml, ipd...... kar je free:Upgrade v114 to v115--------------------
Configure reporting mailer engines (settings_local.py):
REPORT_FROM_EMAIL = "noreply@gmail.com" # from address in e-mails sent by reporting engineREPORT_EMAIL_SUBJECT = 'CyBroWebScada Report' # subject in e-mails sent by reporting engine
Report and e-mail templates are located in /solar_cybro/project/template/report/.
#Cron process, new crontab entries for reporting and mailer engine (second and third line):# Tukaj lahko npr. če ste na račun webscada namestili tisto mapo app od robotine ali pa npr. namesto webscada pri meni doma je cybrotech za raspberry pi, ne virtualni računalnik!!!!*/5 **** /home/webscada/app/scgi_server/src/run_scgi_server.py & >/dev/null*/10 **** /home/webscada/app/solar_cybro/project/run_create_reports.py & >/dev/null*/10 **** /home/webscada/app/solar_cybro/project/run_send_reports.py & >/dev/null
# Če ste scado namestili preko virtualnega hosta se pravni npr. servername perc.myftp.org pol dajte te spodnje direktive, v kolikor je vaš app v mapi var/www/app se pravi glavnih mapah za apache vhosti, v primeru da imate kot je tu pri meni virtualni računalnik 64bit in scada nameščena na en virtualni host ne pa kot recimo primer robotina na glavni server oz. port 80 direktno, pol rabite samo npr. za dinamične ipje namestit noip.com za linux in nič drugega glede nastavitev, saj vam bo delala avtomatično scada na vaš noip.com host ki ste ga registrirali!!!!!!!!!!!*/5 **** /var/www/app/scgi_server/src/run_scgi_server.py & >/dev/null*/10 **** /var/www/app/solar_cybro/project/run_create_reports.py & >/dev/null*/10 **** /var/www/app/solar_cybro/project/run_send_reports.py & >/dev/null
## Če ste instalirali webscado pod račun cybrotech kot imam jaz pri sebi kopirajte te spodaj direktive za kronološka opravila:*/5 **** /home/cybrotech/app/scgi_server/src/run_scgi_server.py & >/dev/null*/10 **** /home/cybrotech/app/solar_cybro/project/run_create_reports.py & >/dev/null*/10 **** /home/cybrotech/app/solar_cybro/project/run_send_reports.py & >/dev/null
Make sure both python files are set as executable and user rights are set accordingly.
Dbase structure changes
a) Create new tables for generating reports (reports, subscriptions).b) Convert timestamps in measurements and alarms to UTC.
SQL script to convert from v113 to v115 is given as db_upgrade_v113_to_v115.sql.
VSE Lepo piše, ker je kocijančič res najlepše napisal vse kot mora bit drugi so vse en kurac!!!!!!
##################################################################################################################Ustvari bazo za SCADO web app:sudo adduser webscadasudo passwd webscadaMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo mysql_secure_installation#Prvi odgovor NE in vsi ostali YES obvezno!!!!! Se pravi ne menjaj Root kode za SQL server ter vsi ostali odgovori Y oz. DA za izbrišeš testne tabele in nepotrebne račune, ki so bili ustvarjeni ko ste namestili phpmyadmin se pravi sudo apt install phpmyadmin
# Prijavite se v SQL server:sudo mysql --user=root --MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer

Database Name: webscadabazaUser Name: webscadauserPassword: zgHqeGMyzG9hExCEgNepg9XRhUv2jrBMc55XZFH7a7HscsEZky9B5kfa5RABnXgqDatabase Host: localhost
## Generirajte bazo podatkov za webscado in uporabnika:::
CREATE DATABASE `bazasolar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;create user 'uporabniksolar'@'localhost' identified by '8hUV3gvba7SBwjgP8k9ceZvJSfqb58EM';GRANT ALL PRIVILEGES ON * . * TO 'uporabniksolar'@'localhost' IDENTIFIED BY '8hUV3gvba7SBwjgP8k9ceZvJSfqb58EM' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0;GRANT ALL PRIVILEGES ON `bazasolar` . * TO 'uporabniksolar'@'localhost';
## To je še dodatna baza za npr. webpošto ma lahko ustvarite kar user je roundcube in baza je roundcube ter dajte eno močno kodo pa ko boste namestili roundcube in vse vtičnike oz. plugins za njega ko vaš vpraša za kodo vpišete to ki ste ustvarili npr. roundcube baza in user roundcube + geslo naj bo dolgo uporabite password generator, ki ste si ga namestili pwgen 32 -1 in tako naredite za vse vaše sql baz in pa npr. neke dodatne račune za webapps ki rabijo sudo pooblastila, v terminalu vedno zažgite pwgen -s 32 1 se pravi to vam bo generiralo 32 mestno kodo enkrta če hočete več kod npr. 64 znakov v terminalu zažgite to komando: pwgen -s 64 10 in generiralo se vam bo 10 kod po 64 znakov!!!!!!
create user 'epostauser'@'localhost' identified by 'BgHFVp3GeVe2pzEbZ5kQj7fqh3x88cUVfbpMyhE893QU9mPvh6PHbPasDFVFnAyc';create database epostabaza;grant all privileges on epostabaza.* to 'epostauser'@'localhost';flush privileges;exit;
CREATE DATABASE `bazasolar` DEFAULT CHARACTER SET utf8 COLLATE utf8_bin;CREATE USER 'uporabniksolar'@'localhost' IDENTIFIED BY '8hUV3gvba7SBwjgP';                                                                                                                                        GRANT ALL PRIVILEGES ON * . * TO 'uporabniksolar'@'localhost' IDENTIFIED BY '8hUV3gvba7SBwjgP' WITH GRANT OPTION MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0; GRANT ALL PRIVILEGES ON `bazasolar` . * TO 'uporabniksolar'@'localhost'; flush privileges;exit;

Zdaj maš gor še za epošto če rabiš ne škodi če je viška!!!!!
sudo nano /home/webscada/app/solar_cybro/project/settings_local.py
Database Name: webscadabazaUser Name: webscadauserPassword: zgHqeGMyzG9hExCEgNepg9XRhUv2jrBMc55XZFH7a7HscsEZky9B5kfa5RABnXgqDatabase Host: localhost
DATABASE_ENGINE = 'mysql' # 'postgresql_psycopg2', 'postgresql', 'mysql', 'sqlite3' or 'ora$DATABASE_NAME = 'bazasolar' # Or path to database file if using sqlite3.DATABASE_USER = 'uporabniksolar' # Not used with sqlite3.DATABASE_PASSWORD = '8hUV3gvba7SBwjgP' # Not used with sqlite3.DATABASE_HOST = 'localhost' # Set to empty string for localhost. Not used with sqlit$DATABASE_PORT = '3306' # Set to empty string for default. Not used with sqlite3.
sudo nano /home/webscada/app/scgi_server/src/sys_config.pyWEBSCADA SQL:DATABASE_ENGINE = 'mysql' # 'postgresql_psycopg2', 'postgresql', 'mysql', 'sqlite3' or 'ora$DATABASE_NAME = 'bazasolar' # Or path to database file if using sqlite3.DATABASE_USER = 'uporabniksolar' # Not used with sqlite3.DATABASE_PASSWORD = '8hUV3gvba7SBwjgP' # Not used with sqlite3.DATABASE_HOST = 'localhost' # Set to empty string for localhost. Not used with sqlit$DATABASE_PORT = '3306' # Set to empty string for default. Not used with sqlite3.

Database Name: webscadabazaUser Name: webscadauserPassword: zgHqeGMyzG9hExCEgNepg9XRhUv2jrBMc55XZFH7a7HscsEZky9B5kfa5RABnXgqDatabase Host: localhost
sudo nano /home/webscada/app/solar_cybro/project/settings_local.pysudo nano /home/cybrotech/app/solar_cybro/project/settings_local.py
DATABASE_ENGINE = 'mysql' # 'postgresql_psycopg2', 'postgresql', 'mysql', 'sqlite3' or 'ora$DATABASE_NAME = 'webscadabaza' # Or path to database file if using sqlite3.DATABASE_USER = 'webscadauser' # Not used with sqlite3.DATABASE_PASSWORD = 'zgHqeGMyzG9hExCEgNepg9XRhUv2jrBMc55XZFH7a7HscsEZky9B5kfa5RABnXgq' # Not used with sqlite3.DATABASE_HOST = 'localhost' # Set to empty string for localhost. Not used with sqlit$DATABASE_PORT = '3306' # Set to empty string for default. Not used with sqlite3.
sudo nano /home/webscada/app/scgi_server/src/sys_config.pyWEBSCADA SQL:DATABASE_ENGINE = 'mysql' # 'postgresql_psycopg2', 'postgresql', 'mysql', 'sqlite3' or 'ora$DATABASE_NAME = 'webscadabaza' # Or path to database file if using sqlite3.DATABASE_USER = 'webscadauser' # Not used with sqlite3.DATABASE_PASSWORD = 'zgHqeGMyzG9hExCEgNepg9XRhUv2jrBMc55XZFH7a7HscsEZky9B5kfa5RABnXgq' # Not used with sqlite3.DATABASE_HOST = 'localhost' # Set to empty string for localhost. Not used with sqlit$DATABASE_PORT = '3306' # Set to empty string for default. Not used with sqlite3.

; SCGI server configuration
; This file is used to specify custom parameters for each controller. If file is empty, default values are used.

[c13108] ; controller name ('c'+serial number)Ip=193.77.189.203 ; static cybro ip address, default is empty (autodetect)Port= ; cybro UDP port, default is 8442Password=Asterix ; A-bus password, set by CyPro/Configuration/Protection, default is emptyTransactionId=False ; message transaction id, default is True, not used if password is not emptyConnectionType=WAN ; communication timeout and retry count, default is specified in sys_config.py
[c13146] ; controller name ('c'+serial number)Ip= ; static cybro ip address, default is empty (autodetect)Port= ; cybro UDP port, default is 8442Password=Asterix ; A-bus password, set by CyPro/Configuration/Protection, default is emptyTransactionId=False ; message transaction id, default is True, not used if password is not emptyConnectionType=WAN ; communication timeout and retry count, default is specified in sys_config.py
[c13164] ; controller name ('c'+serial number)Ip=213.5.116.144 ; static cybro ip address, default is empty (autodetect)Port= ; cybro UDP port, default is 8442Password=Asterix ; A-bus password, set by CyPro/Configuration/Protection, default is emptyTransactionId=False ; message transaction id, default is True, not used if password is not emptyConnectionType=WAN ; communication timeout and retry count, default is specified in sys_config.py
[c15733] ; controller name ('c'+serial number)Ip= ; static cybro ip address, default is empty (autodetect)Port= ; cybro UDP port, default is 8442Password=Asterix ; A-bus password, set by CyPro/Configuration/Protection, default is emptyTransactionId=False ; message transaction id, default is True, not used if password is not emptyConnectionType=WAN ; communication timeout and retry count, default is specified in sys_config.py
[c14057] ; controller name ('c'+serial number)Ip= ; static cybro ip address, default is empty (autodetect)Port= ; cybro UDP port, default is 8442Password=Asterix ; A-bus password, set by CyPro/Configuration/Protection, default is emptyTransactionId=False ; message transaction id, default is True, not used if password is not emptyConnectionType=WAN ; communication timeout and retry count, default is specified in sys_config.py
[c13030] ; controller name ('c'+serial number)Ip= ; static cybro ip address, default is empty (autodetect)Port= ; cybro UDP port, default is 8442Password=Asterix ; A-bus password, set by CyPro/Configuration/Protection, default is emptyTransactionId=False ; message transaction id, default is True, not used if password is not emptyConnectionType=WAN ; communication timeout and retry count, default is specified in sys_config.py
[c17643] ; controller name ('c'+serial number)Ip= ; static cybro ip address, default is empty (autodetect)Port= ; cybro UDP port, default is 8442Password=Asterix ; A-bus password, set by CyPro/Configuration/Protection, default is emptyTransactionId=False ; message transaction id, default is True, not used if password is not emptyConnectionType=WAN ; communication timeout and retry count, default is specified in sys_config.py
[c12133] ; controller name ('c'+serial number)Ip=192.168.1.116 ; static cybro ip address, default is empty (autodetect)Port= ; cybro UDP port, default is 8442Password=Asterix ; A-bus password, set by CyPro/Configuration/Protection, default is emptyTransactionId=False ; message transaction id, default is True, not used if password is not emptyConnectionType=WAN ; communication timeout and retry count, default is specified in sys_config.py
[c20332] ; controller name ('c'+serial number)Ip= ; static cybro ip address, default is empty (autodetect)Port= ; cybro UDP port, default is 8442Password=Asterix ; A-bus password, set by CyPro/Configuration/Protection, default is emptyTransactionId=False ; message transaction id, default is True, not used if password is not emptyConnectionType=WAN ; communication timeout and retry count, default is specified in sys_config.py

###################################################################################################
PHP Extensions for CMSPHP Extensions for WordPresssudo apt install -y php7.4-mysql php7.4-dom php7.4-simplexml php7.4-ssh2 php7.4-xml php7.4-xmlreader php7.4-curl php7.4-exif php7.4-ftp php7.4-gd php7.4-iconv php7.4-imagick php7.4-json php7.4-mbstring php7.4-posix php7.4-sockets php7.4-tokenizer
##Audio Video Files Server in za naš program DDL Enigma pa dodajte še sudo apt install xsendfile in za ga aktivirat to v terminalu sudo a2enmod xsendfilesudo apt-get install apache2 mariadb-server php7.4 php7.4-mbstring php7.4-gd php7.4-mcrypt php7.4-mysql php7.4-cli php7.4-curl php7.4-xml php7.4-mysql ffmpeg links git -y && sudo apt-get install composer -y
# Za aktivirat module apache - DDL enigma rabi rewrite, expires, xsendfile (tega če boste v nadzorni plošči ddl enigma oz. direktni prenosi in izmenjava datotek enigma vklopili apache modul xsendfile za hitrejše prenose preko vašega serverja npr. različna programska oprema in ali zelo velike datoteke, katere se vlečejo iz vašega strežnika masovno oz. več uporabnikov hkrati!!!!!!!
a2enmod rewritea2enmod expiresa2enmod evasivea2enmod geoipa2enmod geoip evasive expires rewritesudo a2enmod xsendfilesudo phpenmod mysqli

sudo apt update && sudo apt upgrade -ysudo apt-get install mariadb-server mariadb-client -y
sudo apt install apt-transport-https -ysudo apt install dnsutils -ysudo apt install python3sudo apt-get install git -y
sudo apt-get install php7.4-imagick libmagickcore-dev -ysudo apt-get install curl -ysudo apt-get install imagemagick -y
sudo apt install bind9 bind9utils bind9-doc bind9-host dnsutilssudo apt-get install certbot python-certbot-apache -ysudo apt-get install bind9 bind9utils bind9-doc -ysudo apt-get install dnsutils -y
sudo apt-get install build-essential libcurl4-openssl-dev zlib1g-devsudo apt-get install webalizer awstats geoip-database libclass-dbi-mysql-perl libtimedate-perl
GEOIP DEBIAN RASPBIANsudo apt-get install libapache2-mod-geoipsudo apt install libmaxminddb0 libmaxminddb-devsudo apt install libapache2-mod-geoipsudo nano /etc/apache2/mods-available/geoip.conf#Geoipmodule config<IfModule mod_geoip.c>  # For performance reasons, it's not recommended to turn GeoIP on serverwide,  # but rather only in <Location> or <Directory> blocks where it's actually  # needed. GeoIPEnable On GeoIPDBFile /usr/share/GeoIP/GeoIP.datGeoIPScanProxyHeaders OnGeoIPEnableUTF8 OnGeoIPUseLastXForwardedForIP OnGeoIPUseFirstNonPrivateXForwardedForIP On
<Location />SetEnvIf GEOIP_COUNTRY_CODE CN BlockCountrySetEnvIf GEOIP_COUNTRY_CODE IN BlockCountrySetEnvIf GEOIP_COUNTRY_CODE HK BlockCountrySetEnvIf GEOIP_COUNTRY_CODE ID BlockCountrySetEnvIf GEOIP_COUNTRY_CODE TW BlockCountrySetEnvIf GEOIP_COUNTRY_CODE ZA BlockCountrySetEnvIf GEOIP_COUNTRY_CODE VN BlockCountrySetEnvIf GEOIP_COUNTRY_CODE FM BlockCountrySetEnvIf GEOIP_COUNTRY_CODE CF BlockCountrySetEnvIf GEOIP_COUNTRY_CODE AP BlockCountrySetEnvIf GEOIP_COUNTRY_CODE AF BlockCountrySetEnvIf GEOIP_COUNTRY_CODE KP BlockCountrySetEnvIf GEOIP_COUNTRY_CODE KR BlockCountrySetEnvIf GEOIP_COUNTRY_CODE TH BlockCountry
Deny from env=BlockCountry</Location>
</IfModule>
sudo apt-get -y install libgeoip-dev geoip-bin geoip-database geoip-database-extra libgeoip1 php7.4-geoip
sudo apt-get install libgeoip-devsudo apt-get install geoip-binsudo apt-get install geoip-databasesudo apt-get install geoip-database-extrasudo apt-get install libgeoip1##sudo apt-get install php-geoipsudo apt-get install php7.4-geoip***************************************************************************************************$ sudo nano /etc/logrotate.conf
# Primer original rotacija log datotek, tukaj spodaj sem si jaz po svoje naredu za vsak log posebej svoji parametri večinoma vsi 30kilobajtov rotacija vsake štiri tedne!!!weeklyrotate 4

/etc/logrotate.conf.
sudo nano /etc/logrotate.confAppend these lines, which set the maximum size of the file, the permissions for the log, and the number of weeks. For example, you can set 4 as number of weeks the file will exist for before being refreshed rorate 4 30k:
/var/log/auth.log {    size 30k    create 0600 root root    rotate 4}
## Custom perc settings:/var/log/named/security.log {    size 30k    create 0664 bind bind    rotate 4}
/var/log/apache2/access.log {    size 30k    create 0640 root adm    rotate 4}
/var/log/apache2/error.log {    size 30k    create 0640 root adm    rotate 4}
/var/log/fail2ban.log {    size 30k    create 0640 root adm    rotate 4}
/var/log/php/error.log {    size 30k    create 0644 root root    rotate 4}
/var/log/syslog {    size 30k    create 0640 root adm    rotate 4}
/var/log/roundcube/errors {    size 30k    create 0640 www-data adm    rotate 4}
/var/log/alternatives.log {    size 30k    create 0644 root root    rotate 4}
/var/log/letsencrypt/letsencrypt.log {    size 30k    create 0644 root root    rotate 4}
/var/log/mysql/error.log {    size 30k    create 0640 mysql adm    rotate 4}
/var/log/mail.log {    size 30k    create 0640 root adm    rotate 4}

###Za izbrisat log datoteke:
If you must clear the log file, do
cp /dev/null /var/log/fileor/ali to:
echo > /var/log/file
echo > /var/log/apache2/access.log.1***************************************************************************************************sudo chown -R cybrotech:cybrotech /var/www/app/Če ste webscado npr. kot jaz namestili v drugo mapo in za to mapo določili virtualni host npr. ste šli na noip.com in tam rezervirali eno domeno za vašo scado pol samo dajte v apache.conf namesto une direktive za port 80 da prevzame scada na /home/cybrotech/ oz. vašem računu dajte to naredit preko servername = vašnoip.com domena in ta ista pot ter čownajte oz. dodelite pooblastila se pravi www-data za aplikacijo ali lahko za vaš račun ampak obvezno vse interne poti od scada popravite da se naslavlja na to mapo npr. var/www/app !!!!!!!!!!!!
sudo adduser webscadasudo passwd webscadaMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser borissudo passwd borisMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser sandisudo passwd sandiMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser igorMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
## Zdaj jaz imam ta račun oz. tega uporabnika linux samo za vse operacije beleženje kaj se dogaja na moje strežniku in pa ker je sudo račun oz. ima root pooblastila na nejga tudi vežem vse cron job oz. kronološka opravila, tako da je praktično ta račun in epoštni račun namenjen samo za pregled vseh operacij in pošiljanje epošte iz root računa strežnika direktno na ta račun linux, tako imam ločeno in pokockano vse, npr. boris račun to je moj osebni račun in na njega vežen vse operacije kaj se dogaja z spletnimi aplikacijami npr. CMS Drupal, CMS Wordpress ter CMS WEB Scada oz. od robotine.si vizualizacija in nadzor pametne hiše na daljavo!!!sudo passwd linuxsudo adduser linuxlinuxterMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer

***************************************************************************************************####apt-get --purge remove webminservice webmin stop
sudo apt-get install perl libnet-ssleay-perl openssl libauthen-pam-perl libpam-runtime libio-pty-perlsudo apt-get install perl libnet-ssleay-perl openssl libauthen-pam-perl libpam-runtime libio-pty-perl apt-show-versions python unzip -y
Open the apt sources.list file:sudo nano /etc/apt/sources.listAdd this line at the end:deb https://download.webmin.com/download/repository sarge contrib
Yes, Sarge is an old Debian version, but this repository is updated regularlyIt should look like this after the edition:apt sources.list raspbianThen you need to install the GPG key corresponding to this repository:sudo wget http://www.webmin.com/jcameron-key.ascsudo apt-key add jcameron-key.ascFinally, install Webmin:sudo apt updatesudo apt install webmin -y
sudo apt-get install git -y
##Namestitev CertBot modul za webmin - obvezno pa imejte nameščen modul certbot za apache tako:  http://cdn.acugis.com/certbot-webmin-module/certbot.wbm.gz
###Cerbot modul webmin priporočam obvezno uporabo SSL, ker s tem preprečite, da bo kdorkoli dekodiral vašo stranko ko bo bila prijalvjena v Scado!!!!sudo apt-get install certbot python-certbot-apache -y
# Dodatna aplikacija če laufate vaš server preko virtualnega pc oz. virtualnega serverja in da je 64bit npr. ubuntu ali jaz osebno debian10buster pol si naremstite še binddns server, če sigurno boste imeli v vašem omrežju npr. pri meni WindowsNT 5.1 server windows glavni server interni za strojno opremo avdio studio Stainberg ter Proppelerheads program Reason in ostali programi za strojno opremo Audio Studio Akai pro, TexasInstruments, CuBase, itd.... ostali serverji za studijsko obdelavo in snemanje elektronske glasbe!!! pol je glavni server outpu ki je Debian 10 Buster ×64Bit oz. intel Xeon zelo zelo star enojedrni procesor 3,6GHz quoder oz. štiri fizični enojedrni procesorji na plošči (zelo stara zadeva 10let in več Xeon procesor za serverje moj prvi domači server) ter pol je še mini server za aplikacije pametne hiše se pravi Raspbian10Buster linux ×32Bit oz. ARMHF procesor oz. arhitektura sistema.sudo apt-get install bind9 bind9utils bind9-doc -ysudo apt-get install dnsutils -y
http://cdn.acugis.com/certbot-webmin-module/certbot.wbm.gzhttp://www.webmin.com/download/modules/certmgr.wbm.gz
###Cerbot modul webmin modul za webmin ta dva si naložite:http://cdn.acugis.com/certbot-webmin-module/certbot.wbm.gzhttp://www.webmin.com/download/modules/certmgr.wbm.gz****************************************************************************************************a2enmod deflate expires headers rewrite

sudo apt install binutils libproj-dev

pip install pyopensslpip install -e . apt install crossbuild-essential-armhf  sudo apt-get install build-essential libcurl4-openssl-dev zlib1g-dev****************************************************************************************************## To rabi vse Maltrail za namestit!!! Za ssl obvezno še ssl se pravi sudo apt-get install python-openssl python3-openssl python-openssl-doc -y
sudo apt-get install git python3 python3-dev python3-pip libpcap-dev build-essential procps schedtoolsudo apt-get install schedtool -ysudo apt-get install git pip3 python-pcapy -ysudo pip3 install pcapy-ngsudo install pip3 pcapy-ng
## To app ne morete namestit na Raspbian linux je namenjena samo Ubuntu!!!!! python-is-python3
sudo apt-get install git python3 python3-dev python3-pip libpcap-dev build-essential procps schedtoolsudo apt-get install schedtool -ysudo apt-get install git python-pcapy -ysudo apt-get install python-openssl python3-openssl python-openssl-doc -y
sudo pip3 install pcapy-ngsudo pip3 install pyopenssl
git clone --depth 1 https://github.com/stamparm/maltrail.gitcd maltrailsudo python3 sensor.py &
Setup Maltrail Malicious Traffic Detection System on Linuxsudo apt update && sudo apt updatesudo apt install dnsutils
sudo apt-get install schedtool -ysudo apt-get install git python-pcapy -ygit clone https://github.com/stamparm/maltrail.gitcd maltrailsudo python sensor.py &
cybrotech@webscada:~ $sudo apt-get install git python3 python3-dev python3-pip python-is-python3 libpcap-dev build-essential procps schedtoolsudo pip3 install pcapy-nggit clone --depth 1 https://github.com/stamparm/maltrail.gitcd maltrailsudo python3 sensor.py

Start server on same machin:[[ -d maltrail ]] || git clone https://github.com/stamparm/maltrail.gitcd maltrailpython server.py &sudo python server.py &
# Se pravi to je moj interni ip od mini serverja raspbian 10 buster linux 32bit oz. ARMHF arhitektura!!!! (pri meni je pač virtualno Debian server 32bit, če boste delali direktno preko raspbian SD kartice, boste imeli preko njihovega original img operacijskega sistema za SD kartico ali vaš USB3.1 super hitri SSD disk 32bitno arhitekruto, ker je raspbian linux narejen samo za 32bit se pravi posledično zaznava samo 3.78GB rama, a vi GPU oz. grafičnega rama praktično ne rabite zato obvezno to zmanjšate v raspi-config pri GPU nastavitvah za količino rama vi obvezno vpišite kar najmanjšo vrednost se pravi 16 !!!!!!!!!!!curl -A "Masscan-mojtest" 192.168.1.111curl -I "Masscan-mojtest" 192.168.1.111curl -I -A "Masscan-mojtest" 192.168.1.111
curl -I -A "masscan" 192.168.1.111curl -I "masscan" 192.168.1.111curl -A "masscan" 192.168.1.111
administracija@piramidnetwork:~ $ [[ -d maltrail ]] || git clone https://github.com/stamparm/maltrail.gitadministracija@piramidnetwork:~ $ cd maltrailadministracija@piramidnetwork:~/maltrail $ python server.py &[1] 1885administracija@piramidnetwork:~/maltrail $ Maltrail (server) #v0.29.21 {https://maltrail.github.io}
[*] starting @ 14:07:42 /2021-02-11/
[i] using configuration file '/home/admin/maltrail/maltrail.conf'[i] starting HTTP server at http://192.168.1.111:8338/[^] running...

Username: admin Password: changeme!
#Fine-tune Sensor and Server configurationssudo nano /home/admin/maltrail/maltrail.conf
sudo nano /home/cybrotech/maltrail/maltrail.conf
sudo systemctl restart maltrail_sensor.servicesudo systemctl restart maltrail_server.service
sudo systemctl status maltrail_sensor.servicesudo systemctl status maltrail_server.service
#[Server]
#Listen address of (reporting) HTTP server HTTP_ADDRESS 0.0.0.0# HTTP_ADDRESS 89.212.137.96#HTTP_ADDRESS ::#HTTP_ADDRESS fe80::12c3:7bff:fe6d:cf9b%eno1
#Listen port of (reporting) HTTP server HTTP_PORT 8338#Use SSL/TLS USE_SSL false#SSL/TLS (private/cert) PEM file (e.g. openssl req -new -x509 -keyout server.pem -out server.pem -days 1023 -nodes)#SSL_PEM misc/server.pem
#User entries (username:sha256(password):UID:filter_netmask(s))#Note(s): sha256(password) can be generated on Linux with: echo -n 'password' | sha256sum | cut -d " " -f 1#UID >= 1000 have only rights to display results (Note: this moment only functionality implemented at the client side)#filter_netmask(s) is/are used to filter results USERS     admin:9ab3cd9d67bf49d01f6a2e33d0bd9bc804ddbe6ce1ff5d219c42624851db5dbc:0: # changeme!       #local:9ab3cd9d67bf49d01f6a2e33d0bd9bc804ddbe6ce1ff5d219c42624851db5dbc:1000:192.168.0.0/16 # changeme!
#To create a new password, use the command below. It should produce a string similar to the one we saw in the file. Before it, you can place any username. At the end of the password, do not forget to add parameters(:0:).
echo -n 'StrongPassword' | sha256sum | cut -d " " -f 1
05a181f00c157f70413d33701778a6ee7d2747ac18b9c0fbb8bd71a62dd7a223

echo -n 'SlovenijaMojaDezela1991' | sha256sum | cut -d " " -f 1echo -n 'SlovenijaMojaDezela1991' | sha256sum | cut -d " " -f 1d9527dbf8dof62d5d2411797233g0316ce4eb4598eb43absdeb1f8f1bc6385d6
d9527dbf8dof62d5d2411797233g0316ce4eb4598eb43absdeb1f8f1bc6385d6
echo -n 'SlovenijaMojaDezela1991' | sha256sum | cut -d " " -f 1d9527dbf8dof62d5d2411797233g0316ce4eb4598eb43absdeb1f8f1bc6385d6
# TAko kodo ko ste dobili pol vpišite tam kjer je nastavitev USERS spodaj npr. še to kodo vašo novo in lahko zakomentirate tisto original "changeme!":d9527dbf8dof62d5d2411797233g0316ce4eb4598eb43absdeb1f8f1bc6385d6:0:
#Open the same file and edit it to set the new credentialssudo nano /home/admin/maltrail/maltrail.conf###sudo nano /home/cybrotech/maltrail/maltrail.conf
#[Server]
#Listen address of (reporting) HTTP server HTTP_ADDRESS 89.212.137.96#HTTP_ADDRESS ::#HTTP_ADDRESS fe80::12c3:7bff:fe6d:cf9b%eno1
#Listen port of (reporting) HTTP server HTTP_PORT 8338
#Use SSL/TLS USE_SSL false#SSL/TLS (private/cert) PEM file (e.g. openssl req -new -x509 -keyout server.pem -out server.pem -days 9023 -nodes)#SSL_PEM misc/server.pem
cd /maltrail/misc/sudo openssl req -new -x509 -days 9025 -nodes -out /etc/ssl/localcerts/server.pem -keyout /etc/ssl/localcerts/server.key89-212-137-96.static.t-2.net/etc/ssl/localcerts/sudo chmod 600 /etc/ssl/localcerts/server*sudo chmod 600 /etc/ssl/private/cert/server*
sudo systemctl restart maltrail_sensor.servicesudo systemctl restart maltrail_server.service
sudo systemctl status maltrail_sensor.servicesudo systemctl status maltrail_server.service

#User entries (username:sha256(password):UID:filter_netmask(s))#Note(s): sha256(password) can be generated on Linux with: echo -n 'password' | sha256sum | cut -d " " -f 1#UID >= 1000 have only rights to display results (Note: this moment only functionality implemented at the client side)#filter_netmask(s) is/are used to filter results#filter_netmask(s) is/are used to filter results USERS admin:9ab3cd9d67bf49d01f6a2e33d0bd9bc804ddbe6ce1ff5d219c42624851db5dbc:0: # changeme!#local:9ab3cd9d67bf49d01f6a2e33d0bd9bc804ddbe6ce1ff5d219c42624851db5dbc:1000:192.168.0.0/16 # changeme! Admin:d9527dbf8dof62d5d2411797233g0316ce4eb4598eb43absdeb1f8f1bc6385d6:0: ## New credentials SlovenijaMojaDezela1991
#After you’ve made those changes, start and stop maltrail.[i] using configuration file '/home/administracija/maltrail/maltrail.conf'[i] starting HTTP server at http://0.0.0.0:8338/[^] running...
cd /home/administracija/maltrail/pkill -f server.py &python server.py &
#To test that everything is up and running execute the following:ping -c 1 136.161.101.53cat /var/log/maltrail/$(date +"%Y-%m-%d").log
#Also, to test the capturing of DNS traffic you can try the following:nslookup morphed.rucat /var/log/maltrail/$(date +"%Y-%m-%d").log
Username: admin Password: changeme!

sudo python sensor.py &sudo pkill -f sensor.py &Start server on same machin:[[ -d maltrail ]] || git clone https://github.com/stamparm/maltrail.gitcd maltrailsudo python server.py &
cd /home/admin/maltrail/sudo pkill -f server.py &sudo python server.py &

sudo ifconfig eth0 allmultisudo ifconfig eth0 promiscTo disable promiscuous mode, use the “-promisc” switch that drops back the network interface in normal mode.
[root@tecmint ~]# ifconfig eth0 -promisc

admin@piramidnetwork:/etc $ sudo crontab -e
### Test lahko tudi iz vašega windowsa preko command Prompt vpišite za testirat tako:## Odpri terminal okno od Windowsa kot administrator open Command Prompt in kopirajte te tri komande v njega na koncu zamenjajte vaš IP Raspberry:curl -I -A "masscan" 192.168.1.111curl -I "masscan" 192.168.1.111curl -A "masscan" 192.168.1.111

ping -c 1 136.161.101.53cat /var/log/maltrail/$(date +"%Y-%m-%d").lognslookup morphed.rucat /var/log/maltrail/$(date +"%Y-%m-%d").log
cybrotech - autostart server!!!AutoStart Maltrail maltrail sensor and server automatically at OS boot?Maltrail Malicious Traffic Detection System##Setting up the Maltrail server service##echo "Setting up the AntiMalware server service"
## V terminalu kot root zažgite te komande spodaj če ste namestili maltrail na račun cybrotech, če ne samo spremenite tam kjer je linija ## echo "ExecStart=/usr/bin/python /home/cybrotech/maltrail/sensor.py" >> /etc/systemd/system/maltrail_sensor.service dajte vašo pot do aplikacije!!!!
## V terminalu kot root zažgite te komande spodaj če ste namestili maltrail na račun cybrotech, če ne samo spremenite tam kjer je linija ## echo "ExecStart=/usr/bin/python /home/cybrotech/maltrail/server.py" >> /etc/systemd/system/maltrail_server.service to spremenite v vašo pot kjer je app!!!
echo "Setting up the Maltrail server service"echo "[Unit]" >> /etc/systemd/system/maltrail_server.serviceecho "Description=Maltrail server service" >> /etc/systemd/system/maltrail_server.serviceecho "After=network.target elasticsearch.service kibana.service" >> /etc/systemd/system/maltrail_server.serviceecho "[Service]" >> /etc/systemd/system/maltrail_server.serviceecho "Type=simple" >> /etc/systemd/system/maltrail_server.serviceecho "ExecStart=/usr/bin/python /home/cybrotech/maltrail/server.py" >> /etc/systemd/system/maltrail_server.serviceecho "Restart=on-failure" >> /etc/systemd/system/maltrail_server.serviceecho "RestartSec=30" >> /etc/systemd/system/maltrail_server.serviceecho "StandardOutput=journal" >> /etc/systemd/system/maltrail_server.serviceecho "[Install]" >> /etc/systemd/system/maltrail_server.serviceecho "WantedBy=multi-user.target" >> /etc/systemd/system/maltrail_server.service
cybrotech - auto start sensor!!! By Perc custom settings:##Setting up the Maltrail sensor service##echo "Setting up the AntiMalware sensor service"
## V terminalu kot root zažgite te komande spodaj če ste namestili maltrail na račun cybrotech, če ne samo spremenite tam kjer je linija ## echo "ExecStart=/usr/bin/python /home/cybrotech/maltrail/sensor.py" >> /etc/systemd/system/maltrail_sensor.service dajte vašo pot do aplikacije!!!!
echo "Setting up the Maltrail sensor service"echo "[Unit]" >> /etc/systemd/system/maltrail_sensor.serviceecho "Description=Maltrail sensor service" >> /etc/systemd/system/maltrail_sensor.serviceecho "After=network.target elasticsearch.service kibana.service" >> /etc/systemd/system/maltrail_sensor.serviceecho "[Service]" >> /etc/systemd/system/maltrail_sensor.serviceecho "Type=simple" >> /etc/systemd/system/maltrail_sensor.serviceecho "ExecStart=/usr/bin/python /home/cybrotech/maltrail/sensor.py" >> /etc/systemd/system/maltrail_sensor.serviceecho "Restart=on-failure" >> /etc/systemd/system/maltrail_sensor.serviceecho "RestartSec=30" >> /etc/systemd/system/maltrail_sensor.serviceecho "StandardOutput=journal" >> /etc/systemd/system/maltrail_sensor.serviceecho "[Install]" >> /etc/systemd/system/maltrail_sensor.serviceecho "WantedBy=multi-user.target" >> /etc/systemd/system/maltrail_sensor.service
# Aktiviraj auto start sensor in server za maltrail!!!!sudo systemctl enable maltrail_sensor.servicesudo systemctl enable maltrail_server.service
sudo systemctl restart maltrail_server.servicesudo systemctl start maltrail_server.servicesudo systemctl status maltrail_server.service
sudo systemctl restart maltrail_sensor.servicesudo systemctl start maltrail_sensor.servicesudo systemctl status maltrail_sensor.service
## Restart za server in senzor maltrailsudo systemctl restart maltrail_sensor.servicesudo systemctl restart maltrail_server.service
# Status za server in senzor maltrailsudo systemctl status maltrail_sensor.servicesudo systemctl status maltrail_server.service
## Pozor pri meni je v virtualnem računalniku za WEBScado nameščen MalTrail oz. malicious trafic detection program anti malware servers## nameščen pod račun cybrotech, zdaj lahko vi to isto nemstite v mapo npr. opt mapa za opcionalne aplikacije ali karkoli ali pa to storite kot sem jaz sebi namestu na moj račun sudo za webscado je pri meni cybrotech ali lahko imate npr. webscada tam kjer ste app namestili na uni račun pol tako naredite kronološka opravila za linux server da se senzor in server periodično reboot oz. zaženejo znova, ker če ne vam nabijejo virtualne memory-je 10GB takoj, če samo da vam senzor maltrail deluje porabi cca. 500MB Rama in pol če želite da vam še server se samodejno štarta in deluje v ozadju vam bo pobral cca. še on okoli 1GB RAma tako skupaj maltrail potroši cca. od 1,0GB do 1,6GB rama!!!Enkrat date v terminalu kot root kronološka opravila in drugič kot uporabnik se pravi prvo kot root: sudo crontab -e in za drugič kot uporabnik: crontab -e
sudo crontab -esensor.py (root's cronjob - ustvari kronološka opravila kot root):# m h dom mon dow command*/1 * * * * /usr/bin/pgrep -f sensor.py || /usr/bin/python /home/cybrotech/maltrail/sensor.py -c /home/cybrotech/maltrail/maltrail.conf
crontab -eserver.py (preferably non-root's user cronjob - ustvari kronološka opravila kot uporabnik)# m h dom mon dow command*/5 * * * * /usr/bin/pgrep -f server.py || /usr/bin/python /home/cybrotech/maltrail/server.py -c /home/cybrotech/maltrail/maltrail.conf
### PS Ste logično vsi uporabniki mojega omrežja opazili sami da so vse razlage tudi naših programov samo v Angleškem jeziku, saj po večini delamo z tujimi razvijalci programske opreme, kateri nam pridno pomagajo tudi pri razvoju lastne programske opreme zato pa so vse razlage na mojih strežnikih dobesedno v angleškem jeziku plus imam zelo malo slovencev, ki mi je kdarkoli kaj pomagalo razviti lastno programsko opremo!!!!## Mal trail configure your path for app maltrail where you install it (cron jobs and my personal thinking auto start of maltrail on account cybrotech - virtual Debian Buster 10 - 64Bit architecture - Virtual Computer internal IP 192.168.1.111 for vHost - Program like Paralel, VirtualBox oracle or https://www.vmware.com/ or similar virtual computer or server generator - installer, best for your security and your hardware security 110% better security):/usr/bin/pgrep -f server.py || /usr/bin/python /path/to/maltrail/server.py -c /path/to/maltrail.conf/usr/bin/pgrep -f sensor.py || /usr/bin/python /path/to/maltrail/sensor.py -c /path/to/maltrail.conf
---------------------------------------------------------------------------------------------------

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/apache-selfsigned.key -out /etc/ssl/certs/apache-selfsigned.crt

sudo nano /etc/apache2/conf-available/ssl-params.conf
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDHSSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1SSLHonorCipherOrder On# Disable preloading HSTS for now. You can use the commented out header line that includes# the "preload" directive if you understand the implications.# Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"Header always set X-Frame-Options DENYHeader always set X-Content-Type-Options nosniff# Requires Apache >= 2.4SSLCompression offSSLUseStapling onSSLStaplingCache "shmcb:logs/stapling-cache(150000)"# Requires Apache >= 2.4.11SSLSessionTickets Off

sudo cp /etc/apache2/sites-available/default-ssl.conf /etc/apache2/sites-available/default-ssl.conf.baksudo nano /etc/apache2/sites-available/default-ssl.conf
<IfModule mod_ssl.c>        <VirtualHost _default_:443>                ServerAdmin webmaster@localhost
                DocumentRoot /var/www/html
                ErrorLog ${APACHE_LOG_DIR}/error.log                CustomLog ${APACHE_LOG_DIR}/access.log combined
                SSLEngine on
                SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem                SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
                <FilesMatch "\.(cgi|shtml|phtml|php)$">                                SSLOptions +StdEnvVars                </FilesMatch>                <Directory /usr/lib/cgi-bin>                                SSLOptions +StdEnvVars                </Directory>
        </VirtualHost></IfModule>
##### tako<IfModule mod_ssl.c>        <VirtualHost _default_:443>                ServerAdmin your_email@example.com                ServerName server_domain_or_IP
                DocumentRoot /var/www/html
                ErrorLog ${APACHE_LOG_DIR}/error.log                CustomLog ${APACHE_LOG_DIR}/access.log combined
                SSLEngine on
                SSLCertificateFile /etc/ssl/certs/apache-selfsigned.crt                SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key
                <FilesMatch "\.(cgi|shtml|phtml|php)$">                                SSLOptions +StdEnvVars                </FilesMatch>                <Directory /usr/lib/cgi-bin>                                SSLOptions +StdEnvVars                </Directory>
        </VirtualHost></IfModule>

sudo nano /etc/apache2/sites-available/000-default.conf
<VirtualHost *:80>        . . .
        Redirect "/" "https://your_domain_or_IP/"
        . . .</VirtualHost>
sudo a2enmod sslsudo a2enmod headerssudo a2ensite default-ssl
sudo a2ensite default-ssl
sudo apache2ctl configtest
sudo systemctl restart apache2
https://server_domain_or_IP
----------------****************************************************************************************************sudo adduser adminsudo passwd MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer

sudo adduser linuxsudo passwd MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser cybrotechsudo passwd cybrotechMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser sandisudo passwd sandiMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser borissudo passwd borisMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser drevenseksudo passwd MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser brkinskasudo passwd MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser kajuhovasudo passwd MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser vostrisudo passwd MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser pergarsudo passwd MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser infosudo passwd MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer

sudo apt-get install telnet -y && sudo apt-get install mailutils -ysudo apt-get install postfix postfix-mysql dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd dovecot-mysql -ypcsnet.tksudo apt-get install libsasl2-2 sasl2-bin libsasl2-modules -ysudo apt install dovecot-sieve dovecot-solr dovecot-antispam -y# Chec quicket email over ssh module muttsudo apt install mutt -y
sudo dpkg-reconfigure postfix
http:// ipserverja/webmail = round cubeDatabase Name: roundcubeUser Name: roundcubePassword: Gyva5yuBp5eX9fe5EUDeAYB5N7uSPJwSDatabase Host: localhostRoot SQL pass: MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo apt-get install roundcube roundcube-plugins roundcube-plugins-extra roundcube-mysql -y
sudo dpkg-reconfigure roundcube-core
ssl://imap.localhost:993Imap Server: ssl://imap.pcsnet.tk:993imap.localhost:993Default language: set it as you wantConfigure database with dbconfig-common: yesMySQL application password for Roundcube: your Roundcube user password: Gyva5yuBp5eX9fe5EUDeAYB5N7uSPJwSDatabase administrator password: your MySQL root password: MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo dpkg-reconfigure roundcube-core

sudo service postfix restartsudo service dovecot restart
sudo maildirmake.dovecot /etc/skel/Maildirsudo maildirmake.dovecot /etc/skel/Maildir/.Draftssudo maildirmake.dovecot /etc/skel/Maildir/.Sentsudo maildirmake.dovecot /etc/skel/Maildir/.Spamsudo maildirmake.dovecot /etc/skel/Maildir/.Trashsudo maildirmake.dovecot /etc/skel/Maildir/.Templates
sudo cp -r /etc/skel/Maildir /home/linux/sudo chown -R linux:linux /home/linux/Maildirsudo chmod -R 700 /home/linux/Maildir

sudo cp -r /etc/skel/Maildir /home/cybrotech/sudo chown -R cybrotech:cybrotech /home/cybrotech/Maildirsudo chmod -R 700 /home/cybrotech/Maildir
sudo cp -r /etc/skel/Maildir /home/boris/sudo chown -R boris:boris /home/boris/Maildirsudo chmod -R 700 /home/boris/Maildir
sudo cp -r /etc/skel/Maildir /home/info/sudo chown -R info:info /home/info/Maildirsudo chmod -R 700 /home/info/Maildir
sudo cp -r /etc/skel/Maildir /home/sandi/sudo chown -R sandi:sandi /home/sandi/Maildirsudo chmod -R 700 /home/sandi/Maildir
sudo cp -r /etc/skel/Maildir /home/pergar/sudo chown -R pergar:pergar /home/pergar/Maildirsudo chmod -R 700 /home/pergar/Maildir
sudo cp -r /etc/skel/Maildir /home/vostri/sudo chown -R vostri:vostri /home/vostri/Maildirsudo chmod -R 700 /home/vostri/Maildir
sudo cp -r /etc/skel/Maildir /home/kajuhova/sudo chown -R kajuhova:kajuhova /home/kajuhova/Maildirsudo chmod -R 700 /home/kajuhova/Maildir
sudo cp -r /etc/skel/Maildir /home/brkinska/sudo chown -R brkinska:brkinska /home/brkinska/Maildirsudo chmod -R 700 /home/brkinska/Maildir
sudo cp -r /etc/skel/Maildir /home/drevensek/sudo chown -R drevensek:drevensek /home/drevensek/Maildirsudo chmod -R 700 /home/drevensek/Maildir
sudo cp -r /etc/skel/Maildir /home/webscada/sudo chown -R webscada:webscada /home/webscada/Maildirsudo chmod -R 700 /home/webscada/Maildir

sudo adduser boris mailsudo adduser sandi mailsudo adduser cybrotech mailsudo adduser brkinska mailsudo adduser drevensek mailsudo adduser kajuhova mailsudo adduser vostri mailsudo adduser pergar mailsudo adduser webscada mailsudo adduser info mail
-----------------------------------------------------------------------------------

***************************************************************************************************sudo apt-get install ssmtp -y && sudo apt-get install mailutils -y && sudo apt-get install mpack -y && sudo apt-get install telnet -y## Config file for sSMTP sendmail## The person who gets all mail for userids < 1000# Make this empty to disable rewriting.root=postmaster
# The place where the mail goes. The actual machine name is required no # MX records are consulted. Commonly mailhosts are named mail.domain.commailhub=mail
# Where will the mail seem to come from?#rewriteDomain=rewriteDomain=perc.ddns.net
# The full hostnamehostname=piramidstudionetwork
# Are users allowed to set their own From: address?# YES - Allow the user to specify their own From: address# NO - Use the system generated From: address#FromLineOverride=YESFromLineOverride=YES
sudo adduser webscadasudo passwd webscadaMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser cybrotechsudo passwd cybrotechMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser sandisudo passwd sandiMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo adduser borissudo passwd borisMojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
sudo apt-get install ssmtp -y && sudo apt-get install mailutils -y && sudo apt-get install mpack -y && sudo apt-get install telnet -ysudo apt-get install telnet -ysudo apt-get install postfix postfix-mysql dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd dovecot-mysql -ysudo apt-get install mailutils -yobala.tkpcsnet.tksudo apt-get install libsasl2-2 sasl2-bin libsasl2-modules -ysudo apt install dovecot-sieve dovecot-solr dovecot-antispam -y# Chec quicket email over ssh module muttsudo apt install mutt -y
sudo apt-get install roundcube roundcube-plugins -ysudo apt-get install roundcube roundcube-plugins roundcube-plugins-extra roundcube-mysql -ysudo dpkg-reconfigure roundcube-core
ssl://imap.localhost:993Imap Server: ssl://imap.pcsnet.tk:993imap.localhost:993Default language: set it as you wantConfigure database with dbconfig-common: yesMySQL application password for Roundcube: your Roundcube user password: Gyva5yuBp5eX9fe5EUDeAYB5N7uSPJwSDatabase administrator password: your MySQL root password: PrimorskeSkupnostiPiramideStudioWEBAplikacijeHomeCraftSoft2000SlovenijaWEBDesignBorisPerc1977Si
sudo dpkg-reconfigure roundcube-core

sudo service postfix restartsudo service dovecot restart
sudo maildirmake.dovecot /etc/skel/Maildirsudo maildirmake.dovecot /etc/skel/Maildir/.Draftssudo maildirmake.dovecot /etc/skel/Maildir/.Sentsudo maildirmake.dovecot /etc/skel/Maildir/.Spamsudo maildirmake.dovecot /etc/skel/Maildir/.Trashsudo maildirmake.dovecot /etc/skel/Maildir/.Templates
sudo cp -r /etc/skel/Maildir /home/cybrotech/sudo chown -R cybrotech:cybrotech /home/cybrotech/Maildirsudo chmod -R 700 /home/cybrotech/Maildir
sudo cp -r /etc/skel/Maildir /home/boris/sudo chown -R boris:boris /home/boris/Maildirsudo chmod -R 700 /home/boris/Maildir
sudo cp -r /etc/skel/Maildir /home/admin/sudo chown -R admin:admin /home/admin/Maildirsudo chmod -R 700 /home/admin/Maildir
sudo cp -r /etc/skel/Maildir /home/sandi/sudo chown -R sandi:sandi /home/sandi/Maildirsudo chmod -R 700 /home/sandi/Maildir
sudo adduser cybrotech mailsudo adduser admin mailsudo adduser boris mailsudo adduser sandi mail

printf '\0%s\0%s' 'webscada' 'JeBiSeU3PizdeMaterine1977PCSNetWork2020SlovenijaEU' | openssl base64
printf '\0%s\0%s' 'webscada' 'JeBiSeU3PizdeMaterine1977PCSNetWork2020SlovenijaEU' | openssl base64AHdlYnNjYWRhAE1vamFaZWxvWmVsb0Zham5Nb2NuYUtvZGFVcG9yYWJuaWthV0VCU2NhZGEyMDE1UHJpbWVy

admin@piramidnetwork:~ $ printf '\0%s\0%s' 'webscada' 'JeBiSeU3PizdeMaterine1977PCSNetWork2020SlovenijaEU' | openssl base64## Vi to kodo skupaj združite in za prijavo pred to kodo v mail server kopirajte samo auth in plant plus ta koda!!!!AUTH PLAIN AHdlYnNjYWRhAE1vamFaZWxvWmVsb0Zham5Nb2NuYUtvZGFVcG9yYWJuaWthV0VCU2NhZGEyMDE1UHJpbWVy

admin@piramidnetwork:~ $ printf '\0%s\0%s' 'webscada' 'JeBiSeU3PizdeMaterine1977PCSNetWork2020SlovenijaEU' | openssl base64AHdlYnNjYWRhAE1vamFaZWxvWmVsb0Zham5Nb2NuYUtvZGFVcG9yYWJuaWthV0VCU2NhZGEyMDE1UHJpbWVy
AUTH PLAIN AHdlYnNjYWRhAE1vamFaZWxvWmVsb0Zham5Nb2NuYUtvZGFVcG9yYWJuaWthV0VCU2NhZGEyMDE1UHJpbWVy

administracija@piramidnetwork:~ $ telnet localhost 25
administracija@piramidnetwork:~ $ telnet localhost 25Trying ::1...Trying 127.0.0.1...Connected to localhost.Escape character is '^]'.220 piramidnetwork ESMTP Postfix (PCSNETWEBMail)ehlo pcsnet.tkehlo piramidnetwork.org250-piramidnetwork250-PIPELINING250-SIZE 10240000250-VRFY250-ETRN250-STARTTLS250-AUTH PLAIN LOGIN250-ENHANCEDSTATUSCODES250-8BITMIME250-DSN250-SMTPUTF8250 CHUNKINGAUTH PLAIN AHdlYnNjYWRhAE1vamFaZWxvWmVsb0Zham5Nb2NuYUtvZGFVcG9yYWJuaWthV0VCU2NhZGEyMDE1UHJpbWVy## Za pridobit to kodo oz. ta cooky v terminalu zažgi to komando tvoj username in geslo za njega, da biš plant txt format prijave:printf '\0%s\0%s' 'webscada' 'JeBiSeU3PizdeMaterine1977PCSNetWork2020SlovenijaEU' | openssl base64
235 2.7.0 Authentication successfulmail from: administracija@pcsnet.tk250 2.1.0 Okrcpt to: linuxter@pcsnet.tkrcpt to: boris.perc@gmail.com250 2.1.5 Okdata354 End data with <CR><LF>.<CR><LF>Subject: test mailTest.250 2.0.0 Ok: queued as 8423FA108Cquit221 2.0.0 ByeConnection closed by foreign host.administracija@piramidnetwork:~ $

perc@homecraftsoft:~ $ sudo systemctl restart apache2perc@homecraftsoft:~ $ sudo apache2ctl -t

sudo adduser webscadapassword: MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer
a login pcswebmail JeBiSeU3PizdeMaterine1977PCSNetWork2020SlovenijaEUb select inboxb logout
printf '\0%s\0%s' 'webscada' 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' | openssl base64AHdlYnNjYWRhAE1vamFaZWxvWmVsb0Zham5Nb2NuYUtvZGFVcG9yYWJuaWthV0VCU2NhZGEyMDE1UHJpbWVy
## Dobiš takšno kodo in pol npr. za webmail ko te vpraša za prijavo kopiraš tako to komando se pravi
AUTH Plant AHdlYnNjYWRhAE1vamFaZWxvWmVsb0Zham5Nb2NuYUtvZGFVcG9yYWJuaWthV0VCU2NhZGEyMDE1UHJpbWVy

To stop your web server, type:
    sudo systemctl stop apache2

To start the web server when it is stopped, type:
    sudo systemctl start apache2

To stop and then start the service again, type:
    sudo systemctl restart apache2

If you are simply making configuration changes, Apache can often reload without dropping connections. To do this, use this command:
    sudo systemctl reload apache2

By default, Apache is configured to start automatically when the server boots. If this is not what you want, disable this behavior by typing:
    sudo systemctl disable apache2

To re-enable the service to start up at boot, type:
    sudo systemctl enable apache2

sudo apt-get install roundcube roundcube-plugins -ysudo apt-get install roundcube roundcube-plugins roundcube-plugins-extra roundcube-mysql -ysudo dpkg-reconfigure roundcube-core
Database Name: roundcubeUser Name: roundcubePassword: PMCDDE9kwFeXHwyeXvZyBATTqspqKXDQMm8aXvJe3aV5snNqwRQv5KZ4qy5nu3ynDatabase Host: localhost
ssl://imap.localhost:993Imap Server: ssl://imap.domain.com:993imap.localhost:993Default language: set it as you wantConfigure database with dbconfig-common: yesMySQL application password for Roundcube: your Roundcube user password: PMCDDE9kwFeXHwyeXvZyBATTqspqKXDQMm8aXvJe3aV5snNqwRQv5KZ4qy5nu3ynDatabase administrator password: your MySQL root password: SlovenijaMojaDezala1991SandiWEBScadaDDSPrimorskeSkupnostiInformacijskaTehnologijaSandiWEBScada2020WEBsudo passwd cybrotechSlovenijaMojaDezala1991SandiWEBScadaDDSPrimorskeSkupnostiInformacijskaTehnologijaSandiWEBScada2020WEB
sudo dpkg-reconfigure roundcube-core#Database name: epostabaza#User Name: epostauser#Password: koda
Database Name: roundcubeUser Name: roundcubePassword: PMCDDE9kwFeXHwyeXvZyBATTqspqKXDQMm8aXvJe3aV5snNqwRQv5KZ4qy5nu3ynDatabase Host: localhostTable Prefix: rcmail_pcs_

sudo service postfix restartsudo service dovecot restart###################################################################################################sudo apt-get update && sudo apt-get install git bc libncurses5-dev libtext-csv-xs-perl autoconf automake libtool xutils-dev iptables-dev -y
***************************************************************************************************sudo mv /etc/postfix/main.cf /etc/postfix/main.cf.bksudo nano /etc/postfix/main.cf
10. Enter the information below to the new file. Replace example.com with your domain name throughout the file. Make sure the value of smtpdtlscert_file and smtpdtlskey_file point to your SSL certificate.11. smtpd_banner = $myhostname ESMTP $mail_name12. biff = no13. append_dot_mydomain = no14. readme_directory = no15. 16. # TLS parameters17. smtp_use_tls = yes18. smtp_tls_security_level = may19. smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache20. 21. smtpd_use_tls = yes22. smtpd_tls_security_level = may23. smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache24. smtpd_tls_cert_file = /etc/letsencrypt/live/example.com/fullchain.pem25. smtpd_tls_key_file = /etc/letsencrypt/live/example.com/privkey.pem26. smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination27. 28. smtpd_sasl_auth_enable = yes29. smtpd_sasl_type = dovecot30. smtpd_sasl_path = private/auth31. 32. virtual_transport = lmtp:unix:private/dovecot-lmtp33. virtual_mailbox_domains = /etc/postfix/virtual_mailbox_domains34. 35. myhostname = mail.example.com36. myorigin = /etc/mailname37. mydestination = localhost.$mydomain, localhost38. relayhost = 39. mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/12840. mailbox_size_limit = 041. recipient_delimiter = +42. inet_interfaces = all43. inet_protocols = all44. alias_maps = hash:/etc/aliases45. alias_database = hash:/etc/aliases46. Save and close the file.
sudo apt-get install postfix
sudo nano /etc/postfix/main.cfinet_protocols = ipv4myhostname= pcsnet.tk#relayhost = smtp.t-2.netsudo service postfix restartsudo apt-get install telnet
telnet localhost 25ehlomail from: administracija@pcsnet.tkrcpt to: administracija@piramidstudiorcpt to: administracija@perc.ddns.netdataSubject: testTest.quit
sudo apt-get install mailutilsecho 'Test' | mail -s "Test mail command" administracija@perc.ddns.net
sudo nano /etc/postfix/main.cfhome_mailbox = Maildir/mailbox_command =
sudo apt-get install dovecot-common dovecot-imapdsudo maildirmake.dovecot /etc/skel/Maildirsudo maildirmake.dovecot /etc/skel/Maildir/.Draftssudo maildirmake.dovecot /etc/skel/Maildir/.Sentsudo maildirmake.dovecot /etc/skel/Maildir/.Spamsudo maildirmake.dovecot /etc/skel/Maildir/.Trashsudo maildirmake.dovecot /etc/skel/Maildir/.Templates
sudo cp -r /etc/skel/Maildir /home/pi/sudo chown -R pi:pi /home/pi/Maildirsudo chmod -R 700 /home/pi/Maildir
echo "Test" | mail -s "Test" administracija@pcsnet.tk
sudo hostname pcsnet.tk
nano /etc/postfix/main.cf
smtpd_helo_restrictions =permit_mynetworks,permit_sasl_authenticated,reject_invalid_helo_hostname,reject_non_fqdn_helo_hostname,reject_unknown_helo_hostname,check_helo_access hash:/etc/postfix/helo_access
## Tvoj statični ip javni in pol domene menjaj ne moj!!!!sudo nano /etc/postfix/helo_access# Javni ip dodaj svoj odkomentiraj tu kjer je moj javni ip in daj svojega:#89.212.137.96 REJECTwebscada.si REJECTsmtp.webscada.si REJECTmail.webscada.si REJECT
## Primer od prijatelja nastavitve email server !!! PS: Noip vam bo za free račune blokiral dohodne emaile!!!!93.103.113.142 REJECTsandiwebscada.ddns.net REJECTsmtp.sandiwebscada.ddns.net REJECTmail.sandiwebscada.ddns.net REJECT
sudo service postfix restart
sudo nano /etc/dovecot/dovecot.conflisten = *
sudo nano /etc/dovecot/conf.d/10-mail.confmail_location = maildir:~/Maildir
sudo nano /etc/dovecot/conf.d/10-master.confservice auth {unix_listener /var/spool/postfix/private/auth {mode = 0660user = postfixgroup = postfix}}
sudo nano /etc/dovecot/conf.d/10-auth.conf#disable_plaintext_auth = yesdisable_plaintext_auth = no
auth_mechanisms = plain login
sudo nano /etc/postfix/main.cfsmtpd_sasl_type = dovecotsmtpd_sasl_path = private/authsmtpd_sasl_auth_enable = yes
sudo service postfix restartsudo service dovecot restart
printf '\0%s\0%s' '[LOGIN]' '[PASSWORD]' | openssl base64
Dovecot allow us to connect with IMAP (telnet localhost 143)But we now need to enable TLS for IMAP on the port 993sudo nano /etc/dovecot/conf.d/10-master.confservice imap-login {inet_listener imap {port = 143} inet_listener imaps {port = 993ssl = yes}}
sudo nano /etc/dovecot/conf.d/10-ssl.confssl = yes
ssl_cert = </etc/dovecot/dovecot.pemssl_key = </etc/dovecot/private/dovecot.pem
###ssl_min_protocol = SSLv3, TLSv1, TLSv1.1, TLSv1.2
#ssl_protocols = SSLv3ssl_min_protocol = SSLv3
sudo service dovecot restart
openssl s_client -connect localhost:993a login pi passwordb select inbox
a login pcswebmail JeBiSeU3PizdeMaterine1977PCSNetWork2020SlovenijaEU
sudo apt-get install roundcube roundcube-plugins
Again, the installation wizard will ask you these questions about your MySQL server:• Imap Server: ssl://imap.domain.com:993• Default language: set it as you want• Configure database with dbconfig-common: yes• MySQL application password for Roundcube: your Roundcube user password• Database administrator password: your MySQL root password
sudo nano /etc/apache2/conf-enabled/roundcube.confAlias /roundcube /var/lib/roundcube
sudo dpkg-reconfigure roundcube-core
***************************************************************************************************printf '\0%s\0%s' 'webscada' 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' | openssl base64
printf '\0%s\0%s' 'webscada' 'MojaZeloZeloFajnMocnaKodaUporabnikaWEBScada2015Primer' | openssl base64AHdlYnNjYWRhAE1vamFaZWxvWmVsb0Zham5Nb2NuYUtvZGFVcG9yYWJuaWthV0VCU2NhZGEyMDE1UHJpbWVy
## Dobiš takšno kodo in pol npr. za webmail ko te vpraša za prijavo kopiraš tako to komando se pravi v mail server:AUTH Plant AHdlYnNjYWRhAE1vamFaZWxvWmVsb0Zham5Nb2NuYUtvZGFVcG9yYWJuaWthV0VCU2NhZGEyMDE1UHJpbWVy

administracija@pcsnet:~ $ sudo cp /etc/awstats/awstats.conf /etc/awstats/awstats.pcsnet.tkadministracija@pcsnet:~ $ sudo nano /etc/awstats/awstats.pcsnet.tk
***************************************************************************************************## Nekaj primerov glede apache iz spletnega mesta primorske comeze (izvirni jezik angleščina kot za vse moje članke po svetu - naši privatni strežniki)## izklop ssl spletnega virtualnega hosta port 443!!!!!sudo a2dissite default-ssl
***************************************************************************************************How to Install and Configure WEBApp on Debian 10PCSNET By Boris Updated:November 16, 2019 1 Comment 3 Mins Read
PrerequsitiesYou must have SSH with sudo privileges access to server for the Apache web server installation on Debian 10.
Install WEBApp on Debian 10First of all, Login to your Debain 10 system via SSH and update the Apt cache. Then install Apache2 HTTP server packages as below:
sudo apt updatesudo apt install apache2Manage Apache ServiceApache service is managed with systemctl command line. After installation, use the following command to check the status of Apache service.
sudo systemctl status apache2.serviceApache Service Status Debian
Here is the other commands to stop, start or restart Apache service via command line.
sudo systemctl stop apache2.servicesudo systemctl start apache2.servicesudo systemctl restart apache2.serviceTest Apache SetupYou can view the installed Apache version details using the following command.
apache2 -v
Server version: Apache/2.4.38 (Debian)Server built: 2019-10-15T19:53:42Now access your Apache server using the server’s IP address or a domain pointed to the server IP. You will see a default Apache page on web browser. It means Apache web server has successfully installed on your Debian 10 system.
Install XYWEBApps on Debian 10
Create Virtual HostsLet’s create the first virtual host on your Apache server. For the tutorial, we are using sample domain “example.com”. Here we will create a Virtual host for example.com on port 80.
Create a sample index file in a directory:
sudo mkdir -p /var/www/example.comsudo echo "hello example.com" > /var/www/example.com/index.htmlThen create Virtualhost configuration file and edit in editor:
sudo vim /etc/apache2/sites-available/example.com.confAdd the following content in configuration file. You may change the domain name as per your domain.
Apache<VirtualHost *:80>    ServerAdmin admin@example.com    DocumentRoot /var/www/example.com    ServerName example.com    ServerAlias www.example.com    <Directory /var/www/example.com>           #Allowoverride all ###Uncomment if required    </Directory>
    ErrorLog ${APACHE_LOG_DIR}/example.com_error.log    CustomLog ${APACHE_LOG_DIR}/example.com_access.log combined</VirtualHost>
<VirtualHost *:80>    ServerAdmin admin@example.com    DocumentRoot /var/www/example.com    ServerName example.com    ServerAlias www.example.com    <Directory /var/www/example.com>           #Allowoverride all ###Uncomment if required    </Directory>     ErrorLog ${APACHE_LOG_DIR}/example.com_error.log    CustomLog ${APACHE_LOG_DIR}/example.com_access.log combined</VirtualHost>Save the Virtualhost configuration file, then enable Virtualhost and reload the Apache service using the following commands:
sudo a2ensite example.comsudo systemctl reload apache2.serviceConfigure SSL VirtualHostYou can skip this step if you don’t need SSL. But the security is always the primary concert for any website.
The default Apache https listen on port 443. Make sure no other services using the same port. Now, you need to enable Apache ssl module, which is disabled by default.
sudo a2dismod ssl
sudo a2enmod sslFor the tutorial, I have followed these instructions to generate a self signed SSL certificate for our domain.
Then create a new Virtual host file and edit it:
sudo vim /etc/apache2/sites-available/example.com_ssl.confwith the following content:
Apache<VirtualHost *:443>    ServerAdmin admin@example.com    DocumentRoot /var/www/example.com     ServerName example.com    ServerAlias www.example.com     <Directory /var/www/example.com>           #Allowoverride all ###Uncomment if required    </Directory>
    SSLEngine on    SSLCertificateFile /etc/ssl/tls/certs/example.com.crt    SSLCertificateKeyFile /etc/ssl/tls/certs/example.com.key     ErrorLog ${APACHE_LOG_DIR}/example.com_ssl-error.log    CustomLog ${APACHE_LOG_DIR}/example.com_ssl-access.log combined</VirtualHost>
<VirtualHost *:443>    ServerAdmin admin@example.com    DocumentRoot /var/www/example.com     ServerName example.com    ServerAlias www.example.com     <Directory /var/www/example.com>           #Allowoverride all ###Uncomment if required    </Directory>     SSLEngine on    SSLCertificateFile /etc/ssl/tls/certs/example.com.crt    SSLCertificateKeyFile /etc/ssl/tls/certs/example.com.key     ErrorLog ${APACHE_LOG_DIR}/example.com_ssl-error.log    CustomLog ${APACHE_LOG_DIR}/example.com_ssl-access.log combined</VirtualHost>Here is three terms used to configure SSL virtualhost:
SSLEngine – Set this to “on”SSLCertificateFile – Set the path of your SSL certificateSSLCertificateKeyFile – This is the private key files used to generate SSL certificateAfter that enable the Virtualhost and reload the Apache service using the following commands:
sudo a2ensite example.com_sslsudo systemctl reload apache2.serviceSecure Apache ServerEdit the Apache security configuration file
sudo vim /etc/apache2/conf-enabled/security.confHere is the multiple security related settings. Add or Update the following settings. We are not going in detailed discriptions about it but these settings are very useful for the production servers.
ApacheServerTokens ProdServerSignature OffTraceEnable OffHeader always append X-Frame-Options SAMEORIGINHeader always set X-XSS-Protection: "1; mode=block"Header always set X-Content-Type-Options: "nosniff"Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
ServerTokens ProdServerSignature OffTraceEnable OffHeader always append X-Frame-Options SAMEORIGINHeader always set X-XSS-Protection: "1; mode=block"Header always set X-Content-Type-Options: "nosniff"Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;SecureNow edit SSL configuration file. Here you can set the server wide SSL protocol and SSLCipherSuite to use secure Cipers to serve your website.
sudo nano /etc/apache2/mods-enabled/ssl.confApacheSSLProtocol -all +TLSv1.2SSLCipherSuite HIGH:!aNULL:!MD512SSLProtocol -all +TLSv1.2SSLCipherSuite HIGH:!aNULL:!MD5After making changes restart the Apache service to apply new configuration.
sudo systemctl reload apache2.serviceConclusionAll done, You have a secured Apache server running on your Debian 10 Linux system.

sudo apt-get install telnet -y && sudo apt-get install mailutils -ysudo apt-get install postfix postfix-mysql dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd dovecot-mysql -ypcsnet.tksudo apt-get install libsasl2-2 sasl2-bin libsasl2-modules -ysudo apt install dovecot-sieve dovecot-solr dovecot-antispam -y# Chec quicket email over ssh module muttsudo apt install mutt -y
sudo dpkg-reconfigure postfix
sudo apt-get install roundcube roundcube-plugins roundcube-plugins-extra roundcube-mysql -y
sudo dpkg-reconfigure roundcube-core
Database Name: bazaddlenigmaUser Name: ddlenigma2020Password: W3qsCk2F3e42yNEaF5E4AGN3yXDBumQN4yCMpSqEFvypQzERRFZd62TUqFkj7UVGDatabase Host: localhostTable Prefix: ddlprenosi_
Database Name: epostabazaUser Name: epostauserPassword: BgHFVp3GeVe2pzEbZ5kQj7fqh3x88cUVfbpMyhE893QU9mPvh6PHbPasDFVFnAycDatabase Host: localhost
Database Name: roundcubeUser Name: roundcubePassword: PMCDDE9kwFeXHwyeXvZyBATTqspqKXDQMm8aXvJe3aV5snNqwRQv5KZ4qy5nu3ynDatabase Host: localhost
Database Name: audiobazaUser Name: audiouserPassword: Y5FyVbmDW57Db3WJwFjsHtkBycvHkAcYxCt3KJcmRRkEYPrRuHs5XnbxwDgx5AH3Database Host: localhost
Database Name: serverbazaUser Name: serveruserPassword: GZ9xpkHHdmxQNWcQVnPQxxFynRQrSWmWDZhYbuM3zjzyP767ADQDKTysMjAr8csEDatabase Host: localhost
Database Name: webscadabazaUser Name: webscadauserPassword: zgHqeGMyzG9hExCEgNepg9XRhUv2jrBMc55XZFH7a7HscsEZky9B5kfa5RABnXgqDatabase Host: localhost

***************************************************************************************************sudo apt-get install awstats apg libgeo-ipfree-perl libnet-ip-perl libnet-dns-perl liburi-perl apache2-utils***************************************************************************************************sudo apt-get install awstats apg libgeo-ipfree-perl libnet-ip-perl libnet-dns-perl liburi-perl apache2-utils
AwStats - Statistika Strežnika - Piramide Studio Net
sudo /usr/lib/cgi-bin/awstats.pl -config=perc.ddns.net -update
administracija@piramidstudionetwork:~ $ sudo rebootLinux piramidstudionetwork 5.10.17-v7l+ #1403 SMP Mon Feb 22 11:33:35 GMT 2021 armv7l
The programs included with the Debian GNU/Linux system are free software;the exact distribution terms for each program are described in theindividual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extentpermitted by applicable law.You have new mail.Last login: Wed Mar 10 22:04:44 2021 from 192.168.77.222
Wi-Fi is currently blocked by rfkill.Use raspi-config to set the country before use.
administracija@piramidstudionetwork:~ $ sudo apt updateZadetek:1 http://raspbian.raspberrypi.org/raspbian buster InReleaseZadetek:2 https://packages.sury.org/php buster InReleaseZadetek:3 http://archive.raspberrypi.org/debian buster InReleasePrezr:4 https://download.webmin.com/download/repository sarge InReleaseZadetek:5 https://download.webmin.com/download/repository sarge ReleaseBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... NarejenoAll packages are up to date.administracija@piramidstudionetwork:~ $ sudo apt-get install awstatsBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... Narejenoawstats is already the newest version (7.6+dfsg-2).Naslednji paket je bil samodejno nameščen in ni več zahtevan:  libgnutls-openssl27Uporabite 'sudo apt autoremove' za njegovo odstranitev.0 nadgrajenih, 0 na novo nameščenih, 0 bo odstranjenih in 0 ne nadgrajenih.administracija@piramidstudionetwork:~ $ sudo nano /etc/apache2/conf-available/awstats.confadministracija@piramidstudionetwork:~ $ sudo apt install awstats libgeo-ip-perl libgeo-ipfree-perlBranje seznama paketov ... NarejenoGradnja drevesa odvisnostiBranje podatkov o stanju ... Narejenoawstats is already the newest version (7.6+dfsg-2).Naslednji paket je bil samodejno nameščen in ni več zahtevan:  libgnutls-openssl27Uporabite 'sudo apt autoremove' za njegovo odstranitev.Naslednji NOVI paketi bodo nameščeni:  geoip-database-extra libgeo-ip-perl libgeo-ipfree-perl0 nadgrajenih, 3 na novo nameščenih, 0 bo odstranjenih in 0 ne nadgrajenih.Potrebno je dobiti 13,4 MB arhivov.Po tem opravilu bo porabljenega 28,5 MB dodatnega prostora.Dobi:1 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf geoip-database-extra all 20181108-1 [12,9 MB]Dobi:2 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf libgeo-ip-perl armhf 1.51-1+b1 [70,3 kB]Dobi:3 http://ftp.arnes.si/mirrors/raspbian/raspbian buster/main armhf libgeo-ipfree-perl all 1.151940-1 [458 kB]Pridobljenih 13,4 MB v 2s (7214 kB/s)Selecting previously unselected package geoip-database-extra.(Reading database ... 122355 files and directories currently installed.)Preparing to unpack .../geoip-database-extra_20181108-1_all.deb ...Unpacking geoip-database-extra (20181108-1) ...Selecting previously unselected package libgeo-ip-perl.Preparing to unpack .../libgeo-ip-perl_1.51-1+b1_armhf.deb ...Unpacking libgeo-ip-perl (1.51-1+b1) ...Selecting previously unselected package libgeo-ipfree-perl.Preparing to unpack .../libgeo-ipfree-perl_1.151940-1_all.deb ...Unpacking libgeo-ipfree-perl (1.151940-1) ...Setting up libgeo-ipfree-perl (1.151940-1) ...Setting up geoip-database-extra (20181108-1) ...Setting up libgeo-ip-perl (1.51-1+b1) ...Processing triggers for man-db (2.8.5-2) ...administracija@piramidstudionetwork:~ $ sudo nano /etc/apache2/conf-available/awstats.conf
ScriptAlias /awstats/ /usr/lib/cgi-bin/Alias /awstats-icon/ /usr/share/awstats/icon/Alias /awstatsclasses/ /usr/share/java/awstats/
<Directory "/usr/lib/cgi-bin/">    Options None    AllowOverride None    <IfModule mod_authz_core.c>        # Apache 2.4        Require local        Require ip 127.0.0.1        Require ip 89.212.137.96        Require ip 93.103.113.142        Require ip 192.168.1.1        Require ip 192.168.1.111        Require ip 192.168.1.222        Require ip 192.168.1.123        Require host 192.168.77.0/24        Require host PiramidStudioNET        Require host Cybrotech        Require host PiramidStudioEU    </IfModule>    <IfModule !mod_authz_core.c>        # Apache 2.2        Order allow,deny        Allow from 192.168.77.0/24        Allow from ::1    </IfModule></Directory>

administracija@piramidstudionetwork:~ $ sudo a2enmod cgiModule cgi already enabledadministracija@piramidstudionetwork:~ $ sudo a2enconf awstatsEnabling conf awstats.To activate the new configuration, you need to run:  systemctl reload apache2administracija@piramidstudionetwork:~ $ sudo systemctl reload apache2administracija@piramidstudionetwork:~ $ sudo cp /etc/awstats/awstats.conf /etc/awstats/awstats.perc.ddns.net.conf-bash: udo: ukaza ni mogoče najtiadministracija@piramidstudionetwork:~ $ sudo cp /etc/awstats/awstats.conf /etc/awstats/awstats.perc.ddns.net.confadministracija@piramidstudionetwork:~ $ sudo nano /etc/awstats/awstats.perc.ddns.net.confadministracija@piramidstudionetwork:~ $ sudo /usr/lib/cgi-bin/awstats.pl -config=perc.ddns.net -updatesudo /usr/lib/cgi-bin/awstats.pl -config=pcsnet.tk -updateCreate/Update database for config "/etc/awstats/awstats.perc.ddns.net.conf" by AWStats version 7.6 (build 20161204)From data in log file "/var/log/apache2/access.log"...Phase 1 : First bypass old records, searching new record...Searching new records from beginning of log file...Phase 2 : Now process new records (Flush history on disk after 20000 hosts)...Reverse DNS lookup for ::1 not available without ipv6 plugin enabled.Jumped lines in file: 0Parsed lines in file: 560 Found 0 dropped records, Found 0 comments, Found 0 blank records, Found 0 corrupted records, Found 0 old records, Found 560 new qualified records.
administracija@piramidstudionetwork:~ $ sudo suroot@piramidstudionetwork:/home/administracija# cp -r /usr/lib/cgi-bin /var/www/html/root@piramidstudionetwork:/home/administracija# chown www-data:www-data /var/www/html/cgi-bin/root@piramidstudionetwork:/home/administracija# chmod -R 755 /var/www/html/cgi-bin/root@piramidstudionetwork:/home/administracija# exitexitadministracija@piramidstudionetwork:~ $ http://piramidstudionetwork/cgi-bin/awstats.pl?config=test.com-bash: http://piramidstudionetwork/cgi-bin/awstats.pl?config=test.com: Datoteka ali imenik s tem imenom ne obstajaadministracija@piramidstudionetwork:~ $ http://192.168.1.111/cgi-bin/awstats.pl?config=test.com-bash: http://192.168.77.111/cgi-bin/awstats.pl?config=test.com: Datoteka ali imenik s tem imenom ne obstajaadministracija@piramidstudionetwork:~ $ http://perc.ddns.net/cgi-bin/awstats.pl?config=test.com-bash: http://perc.ddns.net/cgi-bin/awstats.pl?config=test.com: Datoteka ali imenik s tem imenom ne obstajaadministracija@piramidstudionetwork:~ $ sudo nano /etc/apache2/conf-available/awstats.confadministracija@piramidstudionetwork:~ $ sudo service apache2 restartadministracija@piramidstudionetwork:~ $ sudo a2enconf awstatsConf awstats already enabledadministracija@piramidstudionetwork:~ $ sudo /usr/lib/cgi-bin/awstats.pl -config=pcsnet.tk -updateCreate/Update database for config "/etc/awstats/awstats.perc.ddns.net.conf" by AWStats version 7.6 (build 20161204)From data in log file "/var/log/apache2/access.log"...Phase 1 : First bypass old records, searching new record...Direct access to last remembered record is out of file.So searching it from beginning of log file...Phase 2 : Now process new records (Flush history on disk after 20000 hosts)...Jumped lines in file: 0Parsed lines in file: 30 Found 0 dropped records, Found 0 comments, Found 0 blank records, Found 1 corrupted records, Found 0 old records, Found 29 new qualified records.administracija@piramidstudionetwork:~ $ cd /etc/crontab-bash: cd: /etc/crontab: Ni imenikadministracija@piramidstudionetwork:~ $ nano /etc/crontabadministracija@piramidstudionetwork:~ $ sudo nano /etc/crontabadministracija@piramidstudionetwork:~ $ sudo nano /etc/apache2/conf-available/awstats.confadministracija@piramidstudionetwork:~ $ sudo nano /etc/awstats/awstats.perc.ddns.net.confadministracija@piramidstudionetwork:~ $

# htpasswd -c /var/www/awstats/.htpasswd sandy
Enable awstats website:
# cd /etc/apache2/sites-available/# a2ensite awstats.conf
Test configuration:
# apachectl configtestSyntax OK
Restart Apache:
# /etc/init.d/apache2 restart
Generate Reports
# /usr/lib/cgi-bin/awstats.pl -config=apache -update# /usr/lib/cgi-bin/awstats.pl -config=apache -output -staticlink > /var/www/awstats/index.html
Generate reports automatically every hour:sudo crontab -e# crontab -l0 * * * * /usr/lib/cgi-bin/awstats.pl -config=sandiwebscada.ddns.net -update5 * * * * /usr/lib/cgi-bin/awstats.pl -config=sandiwebscada.ddns.net -output -staticlink > /var/www/html/awstats/index.html
awstats.pcsnet.tk.conf***************************************************************************************************mkdir /var/www/html/awstatsmkdir /var/www/perc/awstats
ln -s /usr/share/awstats/icon /var/www/html/awstats/iconln -s /usr/share/awstats/icon /var/www/perc/awstats/icon
sudo apt-get install awstats apache2sudo nano /etc/apache2/conf-available/awstats.conf
ScriptAlias /awstats/ /usr/lib/cgi-bin/Alias /awstats-icon/ /usr/share/awstats/icon/Alias /awstatsclasses/ /usr/share/java/awstats/
<Directory "/usr/lib/cgi-bin/">    Options None    AllowOverride None    <IfModule mod_authz_core.c>        # Apache 2.4        Require host 192.168.77.0/24    </IfModule>    <IfModule !mod_authz_core.c>        # Apache 2.2        Order allow,deny        Allow from 192.168.77.0/24        Allow from ::1    </IfModule></Directory>
sudo a2enmod cgisudo a2enconf awstatssudo cp /etc/awstats/awstats.conf /etc/awstats/awstats.perc.ddns.net.confsudo cp /etc/awstats/awstats.conf /etc/awstats/awstats.pcsnet.tk.conf
sudo /usr/lib/cgi-bin/awstats.pl -config=sandiwebscada.ddns.net -update
sudo /usr/lib/cgi-bin/awstats.pl -config=pcsnet.tk -update
https://pcsnet.tk/awstats/awstats.pl?config=pcsnet.tk

Install AWStats on DebianPosted on 14/06/2015 by Lisenet
Install AWStats< to analyse Apache log files.Installation
This article assumes that you have an Apache webserver installed and running already.
# apt-get install awstats
Configuration
Open /etc/awstats/awstats.conf for editing and change the following lines:
# This is where your Apache log goesLogFile="/var/log/apache2/access.log"
# For Apache combined logsLogFormat=1
# The main domain name used to reach the websiteSiteDomain="www.example.com"
HostAliases="localhost 127.0.0.1"DirIcons="./icon"
Create a webroot for awstats website:
# mkdir /var/www/html/awstats # ln -s /usr/share/awstats/icon /var/www/html/awstats/icon
Create a config file:
# touch /etc/apache2/sites-available/awstats.conf
Open the file above for editing and add the following lines:
<VirtualHost *:80>    ServerAdmin webmaster@example.com    ServerName awstats.example.com
    DocumentRoot /var/www/awstats    <Directory />      AuthGroupFile /dev/null      AuthType Basic      AuthUserFile /var/www/awstats/.htpasswd      AuthName "Access Restricted"      Require valid-user      AuthType Basic
      Order deny,allow      Deny from all      Allow from 10.0.0.0/8    </Directory>
    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/    <Directory "/usr/lib/cgi-bin">      AllowOverride None      Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
      Order deny,allow      Deny from all      Allow from 10.0.0.0/8    </Directory></VirtualHost>
Change the subnet above (10.0.0.0/8) to match your network configuration.
Create a new password .htpasswd file for user sandy for basic Apache authentication:
# htpasswd -c /var/www/html/awstats/.htpasswd admin
Enable awstats website:
# cd /etc/apache2/sites-available/# a2ensite awstats.conf
Test configuration:
# apachectl configtestSyntax OK
Restart Apache:
# /etc/init.d/apache2 restart
Generate Reports
/usr/lib/cgi-bin/awstats.pl -config=pecnet.tk -update/usr/lib/cgi-bin/awstats.pl -config=pecnet.tk -output -staticlink > /var/www/html/awstats/index.html
Generate reports automatically every hour:
# crontab -l0 * * * * /usr/lib/cgi-bin/awstats.pl -config=apache -update5 * * * * /usr/lib/cgi-bin/awstats.pl -config=apache -output -staticlink > /var/www/html/awstats/index.html

http://piramidestudiohost/awstats/awstats.pl?config=sandiwebscada.ddns.net***************************************************************************************************

Page updated

Google Sites

Report abuse