Category: Tips & Tricks

Secure SSH with Yubikey

https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html
  • Install OpenSSH
  • ssh-keygen -t ed25519-sk -O resident -O verify-required -C "Your Comment"

– t : Specifies the type of key to create. We are using ed25519-sk

– 0 : Specify a key/value option.

resident : Indicate that the key handle should be stored on the FIDO authenticator itself.

verify-required : Indicate that this private key should require user verification for each signature.

  • Copy public key ssh-copy-id -i ~/.ssh/id_ed25519_sk.pub user@host
  • And finally update SSH server
# Support public key cryptography (includes FIDO2)
PubkeyAuthentication yes
# Enforce User Verification
PubkeyAuthOptions verify-required
# Public keys location
AuthorizedKeysFile .ssh/authorized_keys
# Allow root only with MFA
PermitRootLogin prohibit-password
# Disable password authentication
PasswordAuthentication no
PermitEmptyPasswords no

Bash script setup basically VM

No password required with sudo

joos ALL=(ALL) NOPASSWD:ALL

Extend LVM

sudo lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv
sudo resize2fs /dev/mapper/ubuntu--vg-ubuntu--lv

Setup timezone

sudo timedatectl set-timezone Asia/Ho_Chi_Minh
sudo timedatectl set-ntp on

Docker

sudo apt-get update
sudo apt-get install ca-certificates curl gnupg
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

# Add the repository to Apt sources:
echo \
  "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update

sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo groupadd docker
sudo usermod -aG docker $USER
newgrp docker

Setup PHP

#!/bin/bash

echo 'Install requirements'

sudo apt install software-properties-common
sudo add-apt-repository ppa:ondrej/php
sudo apt update && sudo apt upgrade -y

phpVersions=('8.3')
phpExtensions=('dev' 'cli' 'mbstring' 'curl' 'intl' 'mbstring' 'xml' 'xmlrpc' 'xsl' 'yaml' 'zip' 'imagick' 'gd' 'opcache' 'memcache' 'memcached' 'mysql' 'sqlite3' 'ldap' 'bcmath' 'fpm')
phpPecls=('mongodb' 'redis' 'pcov' 'apcu')

for phpVersion in "${phpVersions[@]}"
do
  echo "Install PHP ${phpVersion} extensions"
  extensions=$(printf "php${phpVersion}-%s " "${phpExtensions[@]}")
  sudo apt install -y $extensions

  echo "Install PHP ${phpVersion} pecl extensions"
  for phpPecl in "${phpPecls[@]}"
  do
    sudo pecl -d php_suffix="${phpVersion}" install "${phpPecl}"
    sudo pecl uninstall -r "${phpPecl}"    
    sudo bash -c 'echo "extension='${phpPecl}'.so" >> /etc/php/'${phpVersion}'/cli/php.ini'
    sudo bash -c 'echo "extension='${phpPecl}'.so" >> /etc/php/'${phpVersion}'/fpm/php.ini'
  done
done

Github action – Slack notification

Here is good one package to use

https://github.com/slackapi/slack-github-action

And here is my implement

      - name: Slack Notification
        id: slack
        uses: slackapi/[email protected]
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
        with:
          # Slack channel id, channel name, or user id to post message.
          # See also: https://api.slack.com/methods/chat.postMessage#channels
          # You can pass in multiple channels to post to by providing a comma-delimited list of channel IDs.
          channel-id: 'xcrawler-github'

          # This data can be any valid JSON from a previous step in the GitHub Action
          # For posting a rich message using Block Kit
          payload: |
            {
              "attachments": [
                {
                  "blocks": [
                    {
                      "type": "header",
                      "text": {
                        "type": "plain_text",
                        "text": "Github Action",
                        "emoji": true
                      }
                    },
                    {
                      "type": "section",
                      "fields": [
                        {
                          "type": "mrkdwn",
                          "text": "*Name:*\n ${{ github.event_name }} "
                        },
                        {
                          "type": "mrkdwn",
                          "text": "*Type:*\n ${{ github.event.action }} ${{ github.event.ref_type }} ${{ github.event.ref }}"
                        }
                      ]
                    },
                    {
                      "type": "section",
                      "fields": [
                        {
                          "type": "mrkdwn",
                          "text": "*Branch:*\n ${{ github.event.pull_request.head.ref }}"
                        },
                        {
                          "type": "mrkdwn",
                          "text": "*Status:*\n `${{ job.status }}`"
                        }
                      ]
                    },
                    {
                      "type": "context",
                      "elements": [
                        {
                          "type": "mrkdwn",
                          "text": "${{ github.event.pull_request.html_url || github.event.head_commit.url }}"
                        }
                      ]
                    }
                  ]
                }
              ]
            }

Sử dụng domain riêng với iCloud – Mail

Not sure việc dùng iCloud và không có subscription sẽ support hay không.

Làm với icloud.com cho dễ nhỉ

Go to icloud.com/icloudplus, then sign in with your Apple ID.

https://support.apple.com/en-vn/guide/icloud/mm0e4339d289/icloud

Sau đó add custom domain và update 1 số records cho domain ( Nếu xài Cloudflare hoặc 1 số provider khác thì Apple sẽ authorize và làm tự động hết )

  • 2 MX records
  • 1 vài TXT records

Sau khi xong xuôi add thêm email mình cần xài <name>@domain. Và từ giờ Mail đã có thể sử dụng ( sent out ).