A scientific shell - a shell blog

Use Cloud Flare Tunnel and Acces Application to securely expose to the public network

Foreword: If we engage in Home Lab, the topic we can't get around is how to expose our intranet services to the public network, and how to ensure our security. Now we can use the Zero Trust provided by our Cyberbodhisattva Cloudflare to protect our security. Demo domain: HomePage and Cloud Flare Zero Trust homepage Text: To use the Tunnel exposure service, we need to log in to the CF zero trust management platform first, and add a new tunnel. Click: Networks/Tunnels, we need to add a tunnel for our local connection to the Cloudflare Zero Trust server. Simply configure the tunnel name It will automatically jump to the tunnel page, and the non skipped Networks/Tunnels/your tunnels/config. We need to install a cloudflared program. This page has provided us with common systems, such as Linux, MacOS, Windows. You can run the copy command directly on our terminal. Next, simply configure it. Save it. When you return to the menu, you will find that the newly created Tunnel will wait for the Status to display HEALTHY to access your configured domain name. Using Acc

Memos docking Authentic

Published on 2024-04-09 | Update on 2024-04-24 | network technique | Memos • Authentik • SSO • OAuth2

Being configured: What is this? This trouble has not passed yet. After configuration: really fragrant and convenient. Please configure the application and provider used by Memos in Authentic before using this article By default, you have created an application and provider for Memos. We need to change the provider (for Memos). Click Edit Select which scopes the client can use. The client still needs to specify the range of access data. Press and hold the ctrl/command key to select multiple items. We select authenticak default OAuth Mapping: OpenID email and authenticak default OAuth Mapping: OpenID openid to change the Subject mode to user name based, and then update. Memos Configuration As of the time of sending the document, the version of Memos is v0.20.1. Memos uses the user name as the primary key. In fact, it only needs to give the username field. According to the above adjustment, now the sub is our user name field. Fill in other fields according to the screenshot of the article. Then your Memos can use Authentic to log in. Documents referencing Memos: https://www.us ...

Aikuai IPv6 firewall configuration

Published on 2024-03-01 | Update on 2024-04-09 | Ikuai • firewall • firewall • IPv6

Foreword Aikuai did not open IPv6 to block intranet devices by default. I was shocked when I found out that it had been exposed on the public network for more than a day. The worst thing is that all passwords of intranet devices are weak passwords, which scared me to immediately disconnect IPv6 access. I checked carefully that no one was able to scan and explode the intranet devices. Please ensure that your ikuai system is the latest version and log in to the ikuai web background. Security settings –>ACL rules Block all IPv6 links This operation will not block traffic in response to IPv6 Since ikuai does not support the release or blocking of ICMP protocol in 3.7.11, if you want an external network device to ping the intranet, you need to create two configurations, one is to block TCP and the other is to block UDP. If you do not want to ping the intranet, you only need to create a configuration and select any protocol. The incoming interface must be a wan interface. Since the author has only one wan interface, please check all if you have more than one, and the outgoing interface is a lan. Similarly, if you have more than one lan interface, please check all, so that our intranet devices will not expose the external network. Open the connection for the specified IPv6 Besides, you can specify the IPv6 address to be released. If you are a static IPv6, you can release the IP by yourself. But as a home broadband, it is impossible to know what the IP address will look like, or does it change every time the IP address changes

Transform home network

Published on 2024-02-08 | Update on 2024-03-13 | network technique | Ikuai • J4125

preface It has not been updated for a long time. In the winter vacation, I plan to do a lot of work on my home network. It's enough for me to replace the r2s I bought in my home for 21 years with J4125. This is my current home theme structure, where r2s soft route is used as PPPOE dialing, and two APs form a wired mesh. For J4125, I plan to use PVE+Ikuai+Debian Pain points before the text Stable: sometimes it is not a special problem for r2s, and it needs to be restarted regularly. I tried to change a lot of firmware, but it cannot solve this problem Inadequate performance: There is no problem that R2S is basically stable in the test (when scientific Internet access is not used), but it is somewhat difficult for small packet forwarding. ARM ecological problem: I know that ARM is developing well, but many old programs can only support X86 After the solution Stable: no abnormality found after 20 consecutive days of operation Performance: The J4125 is enough for my 300mbps bandwidth (full load bandwidth, CPU usage 15%~20%) Software: solved some software problems of ARM. J4125 implements PVE virtualization. Ikuai is used as the main route for PPPOE and flow control management. Debian ` ` docker runs Adguard Home DNS.

2023 Summary

Published on 2023-12-31 | Update on 2024-03-13 | summary • two thousand and twenty-three

This article should be published on 31/12/2024 In a twinkling of an eye, the 23 years are almost over. Looking back on the past year, it seems a little special, not as boring and boring as the previous years. Two years of quiet blog, blog in 23 years to bloom again. A total of 19 articles have been written in 23 years, of which 227 have been read most from Google for the new version of Spring Security configuration, followed by 205 for Java using CloudFlare Turnstile verification code. After starting blogging again, the website recorded and closed the manuscript in June 23, and harvested PV 6.52k UV 2.16k in total. Why only the data from June to December? Because I lost the data from January to May. I received an email from Google 28 days before the deadline I participated in the application software system development and won the first prize. However, I didn't leave much profound comments on this competition in my mind, because most of the contents involved are tedious and repetitive work. At the end of the 23 years, the story ended, and the people I met in the 23 years also started my first offline face-to-face journey (without narrating). The story of 24 years is about to start, and new adventures will be launched in this year. I hope that in 24 years, I can step on

TeamSpeak has been running for one year

Published on 2023-11-06 | Update on 2024-03-13 | random thoughts | TeamSpeak

Click here to wake up team speak It seems that it has not been updated for more than 21 days. Let's take a look at the screenshot of the year's operation. Emmm, survived a difficult year, and felt it was not easy. During this period, the server wanted to restart, which should be two years ago. This software carries the happy time between us. This TeamSpeak server runs on Tencent Cloud hk lightweight server, which is used to facilitate the connection and communication between me and my friends. It provides us with a pleasant communication platform, so that we can play games, discuss topics and share happy hours more easily. Our main game is Rainbow 6. If you are also a player of Rainbow 6 or interested in Rainbow 6, no one will play with you. We welcome you to join us and have fun with us.

Seal Easyconnect

Published on 2023-10-16 | Update on 2024-04-09 | network technique | easyconnect • Convinced • vpn

The starting point of the story is that it has reached the internship period and left the school. It is really difficult to write these annoying weekly notes. You must also use this Easyconnect for interviews. If you just want to search for Easyconnect but see this article, you can carefully weigh the need to download and use Easyconnect again. If you ask why not use Easyconnect. You can jump to this article or see the core of this article that I use Chat GPT to summarize. When discussing the security risks of the EasyConnect client of Shenzhen Shenxin Trust, we can simplify the description as follows: Dependency: The EasyConnect client uses some old system functions, which will cause it to fail to work on the latest version of the macOS. This is like using an old car key to open a modern car, which is no longer suitable. Root certificate problem: EasyConnect client has installed a special certificate on your computer, and the role of this certificate may not be limited to providing a better browsing experience as the official said. It's a bit like the door lock of your home being copied, and you don't know it. Self startup problem: The EasyConnect client also has a process called EasyMonitor, which starts automatically when your computer is turned on. This process has the right to monitor your every move, but you can't simply close it, otherwise

WebSocket uses SpringSecuity authentication and authentication

Published on 2023-09-10 | Update on 2024-04-09 | network technique | Spring • Java • Security • SpringSecuriy • WebSocket

At the beginning, the foreword feels that it is quite simple to authenticate. You just need to let the Headers of websocket also take authorization and add the value of token. However, websocket does not support custom headers, so it cannot. However, ws allows you to add custom parameters to the request header of Sec WebSocket Protocol, that is, you only need to add a detection for Sec WebSocket Protocol in spring security. Add the judgment of Sec WebSocket Protocol. The WSHeader here is actually Sec WebSocket Protocol. 123456789101112131415161718192021/* * * Get request token * * @ param request * @ return token */private String getToken (HttpServletRequest request) {String token=request. getHeader (header); if (StringUtils. isNotEm

Cachefly automatic certificate upload

Published on 2023-07-31 | Update on 2024-05-05 | network technique | go • Cachefly • SSL • Pagoda panel • network technique • Bug writer • CloudFlare

Foreword Since Cachefly launched the free package, as a white whoring party, I have experienced it at the first time. Foreign currency cards are required for registration, so the registration threshold is relatively high. I tried the speed. It was very good. The speed of returning home was very good. The north basically followed ntt and Russia, and the south followed hk's CN2 line. At least the pictures and static resources distributed were not a problem. But there is a very annoying problem. It does not support the automatic issuance of free certificates. I need to upload the certificate myself. Fortunately, his SSL certificate is automatically detected. That means that you uploaded a certificate that expired in August and uploaded the certificate of the domain name in July, which expired in November. The certificate will be automatically adjusted to November before the certificate expires. Recently, I learned to learn go, and I wrote a simple gadget with my skittish Kung Fu and ChatGPT. The automatic certificate upload program has been open source and put on my GitHub repository. In fact, the use mode has been written in the README file of the warehouse, so I directly took the README. Usage First, you need to https://github.com/biliblihuorong/CacheflySSLUpDate/releases The page downloads the executable file for your device. Then, create a file named config

SEO optimization of Hexo Butterfly

Published on 2023-07-20 | Update on 2024-03-13 | network technique | hexo • butterfly • SEO

The preface has not optimized seo, site map, rss subscription link, robots file before. None of them has been written, but this year I plan to restart my blog. Naturally, these changes need to be added. More than half a year ago and later, I have supplemented these things, but after reading many articles, I have to come here to sort them out. Some plug-ins Hexo generator sitemap The hexo generator baidu sitemap is dedicated to Baidu (why Baidu is so privileged 😔） Hexo submit urls to search engine The hexo generator feed generates RSS subscription links Hexo filter nopollow marks external nofollow norreferrer noopener on the appropriate outer chain effect: Prevent search engines from tracking the link, which will not directly affect the ranking of the site. Prevent linked pages from obtaining information from source pages, and increase user privacy protection. Prevent linked pages from accessing and manipulating their pages through window.opener to enhance security. Adding robots. txt to the body can be directly added to the source under the hexo project