Chandler: 6月 2021

2021年6月30日星期三

Fortigate SSL VPN 使用 LDAP 認證

Reference:

FortiGate 60E SSL VPN 設定 (使用LDAP驗證)

Unable To Access Hostname Over VPN

Technical Tip: How to set DNS suffix for VPN SSL and IPsec in the FortiGate configuration

新增 LDAP server

Common Name Identifier: sAMAccountName

Distinguished Name: DC=mydomain,DC=com,DC=tw

Bind Type: Regular

Username: user1@mydomain.com.tw

弱點修複 Web Server HTTP Header Internal IP Disclosure

Reference:

How to fix internal IP address or internal network name disclosure vulnerability?

Nessus 弱點報告

Web Server HTTP Header Internal IP Disclosure
Description
This may expose internal IP addresses that are usually hidden or masked behind a Network Address Translation (NAT) Firewall or proxy server.

There is a known issue with Microsoft IIS 4.0 doing this in its default configuration. This may also affect other web servers, web applications, web proxies, load balancers and through a variety of misconfigurations related to redirection.
Solution
Apply configuration suggested by vendor.
See Also
http://www.nessus.org/u?fe24f941
https://support.microsoft.com/en-us/help/218180
http://www.nessus.org/u?4eedfe2d

狀況：

這一台是Nginx reverse proxy，後面是 IIS web service。

本來以為是 IIS 的問題，但是直接對 IIS 掃描沒找到這個弱點，所以判斷是 Nginx 的問題。

解法：

在 Nginx config 設定

server_name mydomain.com
server_name_in_redirect on

restart nginx service再掃描確認已修復。

2021年6月23日星期三

Xwindow change default directory to home

Reference:

How do I change the "default working" directory of terminal applications in RHEL6 ?

GNOME Desktop :-

Use gconftool-2 to make Open in Terminal start in ~/ or $HOME instead of ~/Desktop. This can be done per-user and the global default can also be changed.
- As a user, run following command to change the behavior immediately:
Raw
```
$ gconftool-2 --set --type=bool /apps/nautilus-open-terminal/desktop_opens_home_dir true
```
- As root, run below command to set the default behavior, which will be source when new users first log in:
Raw
```
# gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.defaults --set --type=bool /apps/nautilus-open-terminal/desktop_opens_home_dir true
```