welcome to my blog - admin
type: channel
link: http://blog.ctfclub.cn/index.php/author/1/
description: admin
items: 环境Kubesphere安装
items: keepalived Nginx_check脚本
items: Keepalived-Redis主从实现(redis主从已经设置完成）
items: code-server部署
items: k8s安装windows
items: mac网络安全环境
items: K8S使用配置文件部署MySQL/Redis/Clickhouse/PostgresSQL
items: 通配符acme.sh的使用（以腾讯云域名为例）
items: KVM虚拟机迁移至VMWare ESXi
items: MySQL主从同步问题解决

环境Kubesphere安装
type: item
date: 2025-06-25T20:38:00+08:00
description: https://docker.aityp.com/1.sealos安装echo "deb [trusted=yes] https://apt.fury.io/labring/ /" | sudo tee /etc/apt/sources.list.d/labring.list sudo apt update sudo apt install sealos 教程：https://sealos.run/docs/k8s/quick-start/install-cli2.sealos安装k8shttps://explore.ggcr.dev/?repo=registry.k8s.iosealos run registry.cn-shanghai.aliyuncs.com/labring/kubernetes-docker:v1.24.0 sealos run registry.cn-shanghai.aliyuncs.com/labring/helm:v3.9.4 sealos run registry.cn-shanghai.aliyuncs.com/labring/calico:3.26.1 下载ingress-nginx.targithubdocker pull registry.cn-hangzhou.aliyuncs.com/google_containers/nginx-ingress-controller:v1.12.0 docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/kube-webhook-certgen:v1.5.0 ingress需要修改的文件：value.yml## nginx configuration ## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md ## global: image: # -- Registry host to pull images from. registry: registry.cn-hangzhou.aliyuncs.com ## Overrides for generated resource names # See templates/_helpers.tpl # nameOverride: # fullnameOverride: # -- Override the deployment namespace; defaults to .Release.Namespace namespaceOverride: "" ## Labels to apply to all resources ## commonLabels: {} # scmhash: abc123 # myLabel: aakkmd controller: name: controller enableAnnotationValidations: true image: ## Keep false as default for now! chroot: false # registry: registry.k8s.io image: google_containers/nginx-ingress-controller ## for backwards compatibility consider setting the full image url via the repository value below ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail ## repository: tag: "v1.12.0" #digest: sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa #digestChroot: sha256:87c88e1c38a6c8d4483c8f70b69e2cca49853bb3ec3124b9b1be648edf139af3 pullPolicy: IfNotPresent runAsNonRoot: true # -- This value must not be changed using the official image. # uid=101(…

keepalived Nginx_check脚本
type: item
date: 2025-05-19T14:50:00+08:00
description: 1.修改主机名，关闭selinux和iptablessed -i 's@SELINUX=enforcing@SELINUX=disabled@g' /etc/selinux/configsetenforce 0主从主：hostnamectl set-hostname nginx-master从hostnamectl set-hostname nginx-slave2.安装keepalived并配置网卡地址和ip地址，虚拟ip主机-yum install -y keepalivedmv /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf_bakvi /etc/keepalived/keepalived.confglobal_defs { router_id nginx-master #hostname } vrrp_script chk_nginx { script "/etc/keepalived/scripts/nginx_check.sh" interval 2 timeout 2 fall 3 } vrrp_instance nginx { state master interface ens7 //这个地址要用网卡的真实名字 virtual_router_id 167 //这个id不应该和其他的router_id冲突 priority 100 advert_int 1 authentication { #all node must same auth_type PASS auth_pass 1111 } virtual_ipaddress { 21.0.7.32 //定义虚拟IP } track_script { chk_nginx } } nginx_check.sh#!/bin/bash A=`ps -C nginx --no-header |wc -l` if [ $A -eq 0 ];then /usr/local/nginx/sbin/nginx #重启nginx if [ `ps -C nginx --no-header |wc -l` -eq 0 ];then #nginx重启失败 exit 1 else exit 0 fi else exit 0 fi

Keepalived-Redis主从实现(redis主从已经设置完成）
type: item
date: 2024-12-23T18:02:00+08:00
description: 概要：两个都要masterauth1.修改主机名，关闭selinux和iptablessed -i 's@SELINUX=enforcing@SELINUX=disabled@g' /etc/selinux/config setenforce 0主从主：hostnamectl set-hostname redis-master 从hostnamectl set-hostname redis-slave 2.安装keepalived并配置网卡地址和ip地址，虚拟ip主机-yum install -y keepalived mv /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf_bak vi /etc/keepalived/keepalived.conf global_defs { enable_script_security script_user root router_id redis2 #hostname } vrrp_script chk_redis { script "/etc/keepalived/scripts/redis_check.sh 127.0.0.1 6379 你的密码" interval 2 timeout 2 fall 3 } vrrp_instance redis { state BACKUP interface ens192 //这个地址要用网卡的真实名字 virtual_router_id 166 //这个id不应该和其他的router_id冲突 priority 100 advert_int 1 authentication { #all node must same auth_type PASS auth_pass 1111 } virtual_ipaddress { 192.168.0.18 //定义虚拟IP } track_script { chk_redis } notify_master "/etc/keepalived/scripts/redis_master.sh 另外一台机器 6379 你的密码" notify_backup "/etc/keepalived/scripts/redis_backup.sh 另外一台机器 6379 你的密码" notify_fault "/etc/keepalived/scripts/redis_fault.sh" notify_stop "/etc/keepalived/scripts/redis_stop.sh" } redis_backup.sh#!/bin/bash REDISCLI="/usr/local/bin/redis-cli " LOGFILE="/var/log/keepalived-redis-state.log" echo "[backup]" >> $LOGFILE date >> $LOGFILE echo "Run SLAVEOF cmd ..." >> $LOGFILE $REDISCLI -a $3 SLAVEOF NO ONE >> $LOGFILE 2>&1 $REDISCLI -a $3 SLAVEOF $1 $2 >> $LOGFILE 2>&1 redis_check.sh#!/bin/bash ALIVE=$(/usr/local/bin/redis-cli -h "$1" -p "$2" -a "$3" PING) LOGFILE="/var/log/keepalived-redis-check.log" echo "[CHECK]" >> $LOGFILE date >> $LOGFILE if [ $ALIVE == "PONG" ]; then : echo "Success: redis-cli -h $1 -p $2 -a $3 PING $ALIVE" >> $LOGFILE 2>&1 exit 0 else echo "Failed:redis-cli -h $1 -p $2 -a $3 PING $ALIVE " >> $LOGFILE 2>&1 exit 1 fi redis_fault.sh#!/bin/bash LOGFILE=/var/log/keepalived-redis-state.log echo "[fault]" >> $LOGFILE date >> $LOGFILE redis_master.sh#!/bin/bash REDISCLI="/usr/local/bin/redis-cli" LOGFILE="/var/log/keepalived-redis-state.log" e…

code-server部署
type: item
date: 2024-11-08T20:05:00+08:00
description: 概要： 无1.拉取code-server镜像docker pull codercom/code-server:4.93.12.进入容器安装相关软件默认密码在：~/.config/code-server/config.yaml添加华为云仓库(ubuntu)sed -i 's/deb.debian.org/mirrors.huaweicloud.com/g' /etc/apt/sources.list.d/debian.sourcesapt-get update安装gowget https://golang.google.cn/dl/go1.23.3.linux-amd64.tar.gztar -C /usr/local -zxvf go1.23.3.linux-amd64.tar.gzvim修改/etc/profile文件，在最下面加两行export GOROOT=/usr/local/goexport PATH=$PATH:$GOROOT/binsource /etc/profile设置go代理go env -w GO111MODULE=ongo env -w GOPROXY=https://mirrors.huaweicloud.com/repository/goproxy/go env -w GONOSUMDB=*安装go语言扩展包vscode执行CTRL+SHIFT+P 安装go语言 tools安装vue环境搜索功能是apt search xxxapt-get install npmapt-get install nodejs设置仓库npm config set registry https://registry.npmmirror.com安装相关包npm install vue -g npm install webpack -gnpm install webpack-cli -gnpm install @vue/cli -g如果vscode要开启转发，请修改build里面的devServer: disableHostCheck: true,安装插件*seeting.json设置生成新镜像docker ps -a | grep contianernamedocker commit $registry:$tag

k8s安装windows
type: item
date: 2024-10-21T18:44:00+08:00
description: 概要: 无github地址https://github.com/dockur/windows/blob/master/kubernetes.yml例apiVersion: v1 kind: PersistentVolumeClaim metadata: name: windows-pvc namespace: windows spec: storageClassName: nfs-tencent accessModes: - ReadWriteMany resources: requests: storage: 64Gi --- apiVersion: v1 kind: Pod metadata: name: windows namespace: windows labels: name: windows spec: terminationGracePeriodSeconds: 120 # the Kubernetes default is 30 seconds and it may be not enough containers: - name: windows image: dockurr/windows imagePullPolicy: IfNotPresent ports: - containerPort: 8006 protocol: TCP - containerPort: 3389 protocol: TCP - containerPort: 3389 protocol: UDP securityContext: privileged: true env: - name: RAM_SIZE value: 4G - name: CPU_CORES value: "2" - name: DISK_SIZE value: "64G" volumeMounts: - mountPath: /storage name: storage - mountPath: /dev/kvm name: dev-kvm volumes: - name: storage persistentVolumeClaim: claimName: windows-pvc - name: dev-kvm hostPath: path: /dev/kvm --- apiVersion: v1 kind: Service metadata: name: windows namespace: windows spec: type: NodePort selector: name: windows ports: - name: tcp-8006 protocol: TCP port: 8006 targetPort: 8006 - name: tcp-3389 protocol: TCP port: 3389 targetPort: 3389 - name: udp-3389 protocol: UDP port: 3389 targetPort: 3389

mac网络安全环境
type: item
date: 2024-10-01T02:05:00+08:00
description: 摘要： 无允许打开任何来源的应用程序sudo spctl --master-disable. 系统隐私与安全性，安全性允许任何来源sudo xattr -r -d com.apple.quarantine “图标拖进去”python使用虚拟环境python3 -m venv .cd binsource activatehomebred安装https://gitee.com/cunkai/HomebrewCN/ install:/bin/zsh -c "$(curl -fsSL https://gitee.com/cunkai/HomebrewCN/raw/master/Homebrew.sh)" uninstall:/bin/zsh -c "$(curl -fsSL https://gitee.com/cunkai/HomebrewCN/raw/master/HomebrewUninstall.sh)" JDK@21brew install openjdk@21按提示追加环境变量即可～/zshrcBurpsuiteBurpLoaderKeygen.jar.zip官网burp版本：2023-10-3-1burp suite安装完毕之后拷贝破解到 /Applications/Burp Suite Professional.app/Contents/Resources/app运行破解程序，选择激活码激活自动运行sh保存为shell"/opt/homebrew/Cellar/openjdk@21/21.0.4/libexec/openjdk.jdk/Contents/Home/bin/java" "--add-opens=java.desktop/javax.swing=ALL-UNNAMED" "--add-opens=java.base/java.lang=ALL-UNNAMED" "--add-opens=java.base/jdk.internal.org.objectweb.asm=ALL-UNNAMED" "--add-opens=java.base/jdk.internal.org.objectweb.asm.tree=ALL-UNNAMED" "--add-opens=java.base/jdk.internal.org.objectweb.asm.Opcodes=ALL-UNNAMED" "-javaagent:/Applications/Burp Suite Professional.app/Contents/Resources/app/BurpLoaderKeygen.jar" "-noverify" "-jar" "/Applications/Burp Suite Professional.app/Contents/Resources/app/burpsuite_pro.jar" python3brew install python3sqlmapbrew install sqlmapTidehttps://github.com/TideSec/TscanPlus字典https://github.com/TheKingOfDuck/fuzzDictsbakhttps://github.com/VMsec/ihoneyBakFileScan_Modify403bypasshttps://github.com/yunemse48/403bypasserurlfinderhttps://github.com/pingc0y/URLFinder

K8S使用配置文件部署MySQL/Redis/Clickhouse/PostgresSQL
type: item
date: 2024-09-20T17:25:00+08:00
description: 摘要： 无部署redis,mysql,clickhosuepath是文件夹就是对应文件夹，是文件的话，一定要用subPath指定，这样才规范1.部署MySQL创建config文件apiVersion: v1 kind: ConfigMap metadata: name: mysql-config namespace: middle data: mysql.conf: | # myconfig [mysqld] skip-host-cache skip-name-resolve datadir=/var/lib/mysql socket=/var/run/mysqld/mysqld.sock secure-file-priv=/var/lib/mysql-files user=mysql pid-file=/var/run/mysqld/mysqld.pid [client] socket=/var/run/mysqld/mysqld.sock !includedir /etc/mysql/conf.d/ 创建pvc文件apiVersion: v1 kind: PersistentVolumeClaim metadata: name: mysql-pv-claim namespace: middle spec: storageClassName: nfs-tencent accessModes: - ReadWriteMany resources: requests: storage: 0.5Gi 创建statefulsetkind: StatefulSet apiVersion: apps/v1 metadata: name: mysql-middle namespace: middle labels: k8s.kuboard.cn/name: mysql-middle spec: replicas: 1 selector: matchLabels: app: mysql template: metadata: creationTimestamp: null labels: app: mysql spec: volumes: - name: mysql-store persistentVolumeClaim: claimName: mysql-pv-claim - name: mysql-config configMap: name: mysql-config items: - key: mysql.conf path: my.cnf containers: - name: mysql image: 'docker.m.daocloud.io/mysql:8.0.36' args: - '--default-authentication-plugin=mysql_native_password' ports: - containerPort: 3306 protocol: TCP env: - name: MYSQL_ROOT_PASSWORD value: 123456 resources: limits: cpu: 50m memory: 1Gi requests: cpu: 50m memory: 1Gi volumeMounts: - name: mysql-store mountPath: /var/lib/mysql - name: mysql-config mountPath: /etc/my.cnf subPath: my.cnf imagePullPolicy: Always restartPolicy: Always创建serviceapiVersion: v1 kind: Service metadata: name: mysql namespace: middle spec: ports: - port: 3306 selector: app: mysql 2.部署Clickhouse默认密码：123456 sha256加密--- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: clickhouse-pv-claim namespace: middle spec: storageClassName: nfs-tencent accessModes: - ReadWriteMany resources: requests: storage: 0.5Gi --- apiVersion: v1 kind: ConfigMap metadata: name: clickhouse-config namespace: middle data: …

通配符acme.sh的使用（以腾讯云域名为例）
type: item
date: 2024-09-20T15:36:00+08:00
description: 1.创建API密钥https://console.cloud.tencent.com/cam/capi 2.创建的密钥导入linux变量export Tencent_SecretId="" export Tencent_SecretKey="" 3.下载acme.shcurl https://get.acme.sh | sh -s email=my@example.com cd /root/.acme.sh/ ./acme.sh --issue --dns dns_tencent -d yourdomain -d *.yourdomaintips:你可以去dns记录查询一下，TXT记录是否正确添加4.以后续签/acme.sh --issue d yourdomain -d *.yourdomain --nginx

KVM虚拟机迁移至VMWare ESXi
type: item
date: 2024-09-09T15:26:02+08:00
description: 1.查看虚拟机virsh list --all 2.查看qcow2文件virsh edit xx 3.转化qcow2文件为vmdkqemu-img convert -f qcow2 /export/kvm_images/xxx.qcow2 -O vmdk xxx.vmdk -o compat6 4.再次转化vmkfstools -i xxx.vmdk -d thin xx2.vmdk 5.进入esxi控制台注册即可（必须确保内存和CPU核心数相同）

MySQL主从同步问题解决
type: item
date: 2024-09-02T14:48:00+08:00
description: 主库解决锁表：flush tables with read lock; 备份:mysqldump -uroot -p'xxx' idmesh > /root/mysql_bak_9_2.sql 查看master状态:mysql -uroot -p'xxx' show master status; master_log_file= master_log_pos = 拷贝到从库服务器：scp /root/mysql_bak_9_2.sql root@xxx:/root/ 从库解决mysql -uroot -p'xxx' RESET REPLICA; use idmesh; source /root/mysql_bak_9_2.sql change master to master_host='XXX',master_user='XXX',master_password='XXX',master_port=3306,master_log_file='XXX',master_log_pos=XXX; 重新开始主从同步START REPLICA; 查看同步状态show slave status\G; 主库解决：解锁表unlock tables;