飞污熊小站
飞污熊小站
Home avatar

个人知识星球，专注于Python/Java/AI技术

【安全贴士】设置代理的时候保护个人密码

XiongNeng 发布于  收录于 网络安全

一般设置代理方式是vi /etc/profile，然后添加下面内容

1
2

export http_proxy = http://username:password@yourproxy.com:8080/
export ftp_proxy = http://username:password@yourproxy:8080/

但是这种直接在配置文件里面写自己域账号的明文密码很不安全，如果是几个人共享一台机器，其他人可以直接看到你的密码。

阅读全文
加解密安全贴士

【安全贴士】私钥分片和管道口令读取

XiongNeng 发布于  收录于 网络安全

通过一个私钥分片和管道口令读取的脚步来自动签发数字证书

私钥文件分片.sh 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

#!/bin/bash
# 私钥文件分片存储
# @author XiongNeng
# @since 2019/05/06

WORK_DIR="/home/ca/work"
key1=certs/B1BF8FF1C636C6FA.crt
key2=csr/server0.csr
key3=private/ca0.key
KEY_FILE="ca3.key"
SPLIT_PREFIX="ca3_"

split_key() {
	cd $WORK_DIR
	/bin/split $KEY_FILE -l 10 $SPLIT_PREFIX
	mv "${SPLIT_PREFIX}aa" $key1
	mv "${SPLIT_PREFIX}ab" $key2
	mv "${SPLIT_PREFIX}ac" $key3
}

merge_key() {
	cd $WORK_DIR
	cakey="/tmp/$(/bin/date +%s).key"
	/bin/cat $key1 $key2 $key3 > $cakey
	echo $cakey
}

if [[ "$#" < 1 || ("$1" != "split" && "$1" != "merge") ]]; then
    echo "Usage: ./split.sh split|merge"
    exit 1
fi

if [[ "$1" == "split" ]]; then
    split_key
else
    merge_key
fi

管道文件读取口令密钥.sh 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

#!/bin/bash
# 通过管道文件输入私钥密码，签发数字证书
# @author XiongNeng
# @since 2019/05/06

CRT="ca3.crt"
CSR="csr/server.csr"
OUT_CERT="certs/server3.crt"
WORK_DIR="/home/ca/work"
KEY_PASSWORD_FILE="${WORK_DIR}/keypass"
PROCESS_ACCOUNT="ca"

sign() {
	LOG_FILE="${WORK_DIR}/$(/bin/date +%s).log"
	# su - $PROCESS_ACCOUNT
	cd $WORK_DIR

	# 通过系统命令调用外部程序获取私钥密码
	KEY_PASSOWRD="123456"

	if [ "$KEY_PASSOWRD" = "" ];then
		echo "ERROR: cert key password is empty."
		return 1
	fi

	#创建管道文件
	# su -s /bin/sh $PROCESS_ACCOUNT -c "mkfifo ${WORK_DIR}/keypass"
	if [[ -p "${WORK_DIR}/keypass" ]]; then
	    echo "keypass pipe file exists, I will delete it"
	    rm -f "${WORK_DIR}/keypass"
	fi
	mkfifo ${WORK_DIR}/keypass
	if [ $? -ne 0 ];then
		echo "ERROR: mkfifo keypass failed."
		return 1
	fi

	#设置管道文件权限
	chown $PROCESS_ACCOUNT:$PROCESS_ACCOUNT ${WORK_DIR}/keypass
	if [ $? -ne 0 ]; then
		echo "ERROR: chown keypass failed."
		return 1
	fi

	chmod 600 ${WORK_DIR}/keypass
	if [ $? -ne 0 ]; then
		echo "ERROR: chmod keypass failed."
		return 1
	fi

	#以$PROCESS_ACCOUNT身份启动证书签名命令
	/bin/openssl x509 -req -days 3650 -CAcreateserial -CA $CRT -CAkey $1 -passin file:$KEY_PASSWORD_FILE -in $CSR -out $OUT_CERT &>${LOG_FILE} &

	#将密码写入管道文件
	echo "INFO: start echo key_password."
	echo $KEY_PASSOWRD >> ${WORK_DIR}/keypass 
	sleep 0.1

	#检查证书签发命令是否执行成功
	timeout=3
	num=0
	while [ $num -lt $timeout ]; do
		grep ":error:" ${LOG_FILE}
		if [ $? -eq 0 ]; then
			echo "Error: sign cert failed."
			return 1
		fi
		echo "sleep 1 seconds"
		sleep 1
		num=`expr $num + 1`
	done
	
	cat ${LOG_FILE}

	if [ $num -eq $timeout ]; then
		echo "Success: good luck."
	fi
	rm -f "${WORK_DIR}/keypass" ${LOG_FILE} $1
}

if [[ "$#" < 1 ]]; then
    echo "Usage: ./sign.sh /tmp/ca.key"
    exit 1
fi

sign $1
阅读全文
数字证书安全贴士