月度归档:2012年09月

解密喷射字符,教你DIY自己的喷射符

关于这个符号。。。。估计大家也没少见,第一次见的可能也猛一下不知所以然。其实我也是今天才后知后觉地注意到这个东西,然后就顺便把它解剖了。另外考虑到最初试图用各种关键字组合向谷歌度娘求教都未果,所以把个人研究过程和成果码出来供大家交流学习。

(注:文中为防止涉及编码被浏览器自动转换为符号,全部采用了全角字符,自行实验时需要用半角。) 继续阅读

使用密钥自动登录ssh

比对 SSH 主机公钥是否与本机获取的一致,避免中间人攻击
ssh-keygen -l -E md5 -f /etc/ssh/ssh_host_rsa_key

编辑 ssh 配置文档
sudo vi /etc/ssh/sshd_config

Protocol 2 ← 这行表示仅使用SSH2
ServerKeyBits 768 ← 如果需要可以改成 1024 ,而 puttygen.exe 默认是1024 bit
PermitRootLogin no ← 这行表示不允许用root进行登录
PermitEmptyPasswords no ← 这行表示禁止空密码进行登录
PasswordAuthentication no ← 添加这行表示不允许密码方式的登录增加安全性,按需设置

sshd -t #设置完成不要忘了 check 配置文件,使用 /usr/sbin/sshd -t 也可以

*重启 SSH 服务前建议多保留一个会话以防不测*
service sshd restart

sudo vi /etc/hosts.deny
sshd: ALL ← 添加这一行,屏蔽来自所有的SSH连接请求
sudo vi /etc/hosts.allow
sshd: 192.168.0. ← 添加这一行,只允许来自内网的SSH连接请求

下面生成公钥和私钥,在普通用户下:
ssh-keygen -t rsa ← 建立公钥与私钥
Enter file in which to save the key (/home/comet/.ssh/id_rsa): ← 钥匙的文件名,这里保持默认直接回车
Enter passphrase (empty for no passphrase): ← 输入私钥密码
Enter same passphrase again: ← 再次私钥输入密码
Your identification has been saved in /home/comet/.ssh/id_rsa ← 私钥的路径
Your public key has been saved in /home/comet/.ssh/id_rsa.pub ← 公钥的路径
cd ~/.ssh ← 进入 /home/comet/.ssh
cp id_rsa.pub authorized_keys ← 复制公钥为验证文件
chmod 400 authorized_keys ← 设置验证文件为 root 只读
复制 id_rsa 到 windows 的机器上。
使用 PUTTYGEN.EXE 转换成 putty 可以使用的。
打开 PUTTYGEN.EXE ,点击 Load,选取服务器端生成的私钥,如果上面设置了私钥密码,这里就会提示输入。修改一下 key comment,如果需要密码,可以在 key passphrase 输入并确认。
点击“Save private key”,保存为 .ppk 文件,这里是 uServer.ppk
在 putty 中使用转换后的私钥登录。
打开 putty.exe ,设置好IP,然后在 Connection – SSH – Auth 的 Private key file for authentication 中选择 uServer.ppk 。然后 open 就可以使用密钥登录而不用密码了。
如果在生成 uServer.ppk 的时候没有输入密码,那么可以在 putty.exe 的 Connection – Data 的 Auto-login username 中输入私钥的用户,那么打开 session 之后就可以自动。

参考链接
设置 SSH 通过密钥登录
SSH远程登录配置文件sshd_config详解

How to enable IPv6 on Vista & Win7

Windows Vista and Windows 7 both come equipped with dual stack IPv4/IPv6, and it can be enabled on Windows XP/SP2. On a default installation of Vista/Win7, IPv6 should already be operational. In order to fully test your IPv6 readiness, you will also need the services of a Tunnel Broker. A Tunnel Broker is a server that sits on both an IPv6 network and an IPv4 network. IPv6 packets are encapsulated inside an IPv4 packet and sent out over the IPv4 network. The server strips the IPv4 info and sends the packet on to the IPv6 server. Return packets follow the reverse route.

Vista/Win7 come equipped with the Teredo Tunnel, but it is not functional by default. To get all these working, the following services must be running:
IP Helper – Automatic Started
Windows Firewall – Automatic Started
Base Filtering Engine – Manual Started
Don’t ask me why the Firewall has to run, but Microsoft says that the Teredo Tunnel is a security risk. To the best of my knowledge, the Teredo Tunnel is the only one that will work behind a NAT router that does not support IPv6. It uses a technique similar to PPP networks, with a specific UDP port being used to maintain contact.

One of the major differences with IPv6 is that there can be multiple IP addresses. Since there is no longer a Netmask to determine if an address is on the local network, or if it has to be routed through a gateway, they have introduced something called a link-local address. If you go to the command prompt and enter the “ipconfig /all” command, you should see an address beginning with “fe80::” and ending with “%x” under the Local Area Connection. The “%x” is a random ID number assigned to the interface, and will be necessary to use at times (more on that later).

If the system only has a link-local and a Teredo tunnel IP address, the DNS will not return an IPv6 address. To overcome this limitation, we have to fool the system by adding another IPv6 address. If you are fortunate enough to have a router that supports IPv6 DHCP, one will already have been assigned to you. If not, you must manually enter it. Go to the Properties of your LAN or WiFi interface, and change it to have a static IPv6 address. The easiest solution is to use the converted IPv4 address with a netmask of 48. For example, a static IPv4 address of “192.168.1.2” converts to “2002:c0a8:102::” (192 = c0h, 168 = a8h, 1 = 01h, 2 = 02h). Don’t configure a default gateway for this address, because there isn’t one. You will also need to configure IPv6 DNS servers. You can use any that you might have access to. Both OpenDNS and Google offer free public servers:
OpenDNS: 2620:0:ccc::2 & 2620:0:ccd::2
Google: 2001:4860:4860::8888 & 2001:4860:4860::8844
I personally use one of each.

Windows will now resolve IPv6 domain names. The simplest way to test this is to ping your own computer name (find under System in the Control Panel), or another computer name on your local network that supports IPv6. It should resolve the link-local address and complete the ping. For example:
C:\>ping donna2-pc
Pinging Donna2-PC [fe80::8d22:1710:b68c:37d9%9] from fe80::a5bb:d4f:e017:e25c%9 with 32 bytes of data:
Reply from fe80::8d22:1710:b68c:37d9%9: time<1ms
Reply from fe80::8d22:1710:b68c:37d9%9: time<1ms
Reply from fe80::8d22:1710:b68c:37d9%9: time<1ms
Reply from fe80::8d22:1710:b68c:37d9%9: time<1ms
Ping statistics for fe80::8d22:1710:b68c:37d9%9:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
On one machine I had difficulty getting the ping command to use the correct interface. It wanted to use the Teredo link-local address instead of the ethernet adapter link-local address. I solved the problem by disabling the other Microsoft interface via the registry. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents
This key probably won’t exist and must be added as a REG_DWORD. The value is a bit map:
· Bit 0 Set to 1 to disable all IPv6 tunnel interfaces, including ISATAP, 6to4, and Teredo tunnels.
· Bit 1 Set to 1 to disable all 6to4-based interfaces.
· Bit 2 Set to 1 to disable all ISATAP-based interfaces.
· Bit 3 Set to 1 to disable all Teredo-based interfaces.
· Bit 4 Set to 1 to disable IPv6 over all non-tunnel interfaces, including LAN interfaces and *Point-to-Point Protocol (PPP)-based interfaces.
· Bit 5 Set to 1 to modify the default prefix policy table to prefer IPv4 to IPv6 when attempting connections.
To disable the ISATAP interface, I changed the value to 4 (bit 2).

At this point, we need to expose you to a command that has always been there, but wasn’t really used much with IPv4.
C:\>netsh int ipv6 show teredo
Teredo Parameters
———————————————
Type : client
Server Name : teredo.ipv6.microsoft.com.
Client Refresh Interval : 30 seconds
Client Port : unspecified
State : dormant
Client Type : teredo host-specific relay
Network : managed
NAT : none (global connectivity)
“Int” is short for “interface”. If the state shows as “offline”, you may have to force Teredo into accepting your NAT router. This is done using the following command:
C:\>netsh int ipv6 set teredo type=enterpriseclient
Ok.
If Teredo is now functional, then you should be able to find the interface index using the “ipconfig /all” command:
Tunnel adapter Local Area Connection* 6:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 02-00-54-55-4E-01
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:142b:a209:30f9:a279(Preferred)
Link-local IPv6 Address . . . . . : fe80::142b:a209:30f9:a279%8(Preferred)
Default Gateway . . . . . . . . . : ::
NetBIOS over Tcpip. . . . . . . . : Disabled
In the example above, the interface index is %8 for the Teredo interface. We need this number for the next command, since there is no default route to allow traffic to flow to the Internet.
C:\>netsh int ipv6 add route ::/0 interface=8
Ok.
With this last step you should now be able to access IPv6 sites such as:
C:\>ping ipv6.google.com
Pinging ipv6.l.google.com [2001:4860:b006::69] from 2001:0:4137:9e76:249b:92d7:b464:60e9 with 32 bytes of data:
Reply from 2001:4860:b006::69: time=31ms
Reply from 2001:4860:b006::69: time=31ms
Reply from 2001:4860:b006::69: time=31ms
Reply from 2001:4860:b006::69: time=31ms
Ping statistics for 2001:4860:b006::69:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 31ms, Maximum = 31ms, Average = 31ms
It may take more than one attempt to activate the interface. Then try entering http://ipv6.google.com into your browser, and it should bring up Google’s IPv6 page.

Be aware that at this point in time, Windows will always prefer IPv4 over IPv6 if both exist for a given domain. We can change that behaviour by modifying the prefixpolicies table:
C:\>netsh int ipv6 show pre
Querying active state…
Precedence Label Prefix
———- —– ——————————–
50 0 ::1/128
40 1 ::/0
30 2 2002::/16
20 3 ::/96
10 4 ::ffff:0:0/96
5 5 2001::/32
But I will leave that for you to investigate on your own.

关闭Windows7中的6to4/isatap/teredo隧道

经常看到用户抱怨在 Windows 7 操作系统的 cmd 命令提示符窗口下使用 ipconfig /all 时,会看到非常多的称之为“隧道适配器”的本地连接,而大多数用户对于隧道连接的概念并不了解。

在 Windows 7 中,系统自动配置生成了多个隧道连接,这些隧道连接的用处是用于实现 IPv4 与 IPv6 互访问而设计的。IPv6 隧道是将 IPv6 报文封装在 IPv4 报文中,让 IPv6 数据包通过使用 IPv4 地址协议的网络进行通信。对于采用隧道技术的设备来说,在隧道的入口处,将 IPv6 的数据报封装进 IPv4,IPv4 报文的源地址和目的地址分别是隧道入口和隧道出口的 IPv4 地址,而在隧道的出口处,再将 IPv6 报文取出转发到目的节点。隧道技术只要求在隧道的入口和出口处进行报文的封装修改,对其他部分没有要求,容易实现。

在 Windows 7 中,为了更好的实现 IPv4 到 IPv6 的过渡,使用了多种隧道技术。但是,对于基本上一直在使用 IPv4 的用户,多个隧道连接反而带来了一些不便,因此,这里介绍一下如何关闭 Windows 7 中自带的隧道连接。

使用 netsh 命令关闭 IPv6 隧道适配器:

netsh interface teredo set state disable

netsh interface 6to4 set state disabled

netsh interface isatap set state disabled

 

 

当我们需要使用 IPv6 网络时,只需要使用如下命令恢复 IPv6 隧道设置即可:

netsh interface teredo set state default

netsh interface 6to4 set state default

netsh interface isatap set state default

 

 

文章转自:http://marui.blog.51cto.com/1034148/380357

 

Windows7 环境下配置 Teredo 接入 IPv6

按:Teredo 是一种使用公共网关的 IPv4/IPv6 转换机制,它目前只用于直接通过 IP 地址发起连接,因此你的浏览器不会通过域名连接 IPv6,也就是说该网络配置无益于访问 IPv6 网站。如果一定要通过该方案访问 IPv6 网站,请自行于 hosts 文件中添加相关 IPv6 解析记录。

配置的网络环境:中国电信 2M ADSL 路由器拨号上网,Windows 7 64位操作系统。

以下是隧道方式(Teredo)连接 IPv6 的设置方法:

1.首先,如果你以前配置过 IPv6 的话,最好能把那些配置都还原回来。我这个方案不需要安装任何第三方软件,所以如果你安装过什么隧道软件的话,现在就可以卸掉了。如果经过以下配置,还不能配置成功的话,建议重新安装操作系统,用一个干净的系统开始配置。

2.使用管理员权限运行 cmd,打开命令行窗口。

3.根据使用路由器的方式不同,选择运行不同的命令:
netsh int ter set state client (PPPoE直拨上网选用)
netsh int ter set state enterpriseclient(通过路由器上网选用)

4.设置隧道:
netsh int teredo set state client teredo-debian.remlab.net
或者:
netsh int teredo set state enterpriseclient teredo-debian.remlab.net

5.这样就开启了 IPv6 隧道了。Cmd 中运行 ipconfig 看看,有这样的一串以 2001: 开头的 IPv6 地址的话,就说明已经配置成功了。没有的话,重启一下电脑看看。

部分Public Teredo Servers:

  • teredo.remlab.net / teredo-debian.remlab.net (France)
  • teredo.autotrans.consulintel.com (Spain)
  • teredo.ipv6.microsoft.com (USA, Redmond) (default for WindowsXP/2003/Vista/2008 OS)
  • teredo.ngix.ne.kr (South Korea)
  • teredo.managemydedi.com (USA, Chicago)
  • teredo.trex.fi (Finland)

参考资料
Windows 7,中国电信ADSL的环境下配置IPv6
Teredo tunneling

修订历史
2019-01-22:修改了标题,精简了内容,补充了 Teredo 使用提示