Unix : SSH server add new user’s ssh keys

You have not chosen to deploy your application to fancy web hosting services like Engineyard, Digitalocean, or Heroku then you might be willing to know how to give other developers collaborating in this project access to the server via SSH. In other words you want to let others to deploy the application via SSH (eg. Capistrano).

Well, its pretty much simpler than you have thought.  Follow the steps

  • Copy the public key of your colleague to clipboard ( Ctrl + C )
  • SSH into the server
  • If you want to use the same username for all developer (say `deployer`)
    • $ cd /home/deployer/.ssh
      $ sudo nano authorized_keys
    • Paste the SSH public key of your colleague at the end of the file
    • Save the file
    • And you are Done!
    • Now your colleague should have access to the server
  • If want a separate username for every individual
    • It would be great if you create separate user-group for deployment purposes like `deployers`
    • create a new user in that group with privileges you like
      • to give sudo access you need to update the sudoers file
      • The configuration file for sudo is /etc/sudoers
    • goto that particular user’s home directory
    • add his ssh public key to the /home/user/.ssh/authorized_keys file
      • the .ssh folder might not already be available, you can create though
      • $ mkdir /home/user/.ssh
      • copy the content using `nano or echo`  into the file
    • Now you are Done!

 

SSL Certification and Linux / Nginx

Create the SSL Certificate

We can start off by creating a directory that will be used to hold all of our SSL information. We should create this under the Nginx configuration directory:

sudo mkdir /etc/nginx/ssl

Now that we have a location to place our files, we can create the SSL key and certificate files in one motion by typing:

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt

You will be asked a series of questions. Before we go over that, let’s take a look at what is happening in the command we are issuing:

  • openssl: This is the basic command line tool for creating and managing OpenSSL certificates, keys, and other files.
  • req: This subcommand specifies that we want to use X.509 certificate signing request (CSR) management. The “X.509” is a public key infrastructure standard that SSL and TLS adheres to for its key and certificate management. We want to create a new X.509 cert, so we are using this subcommand.
  • -x509: This further modifies the previous subcommand by telling the utility that we want to make a self-signed certificate instead of generating a certificate signing request, as would normally happen.
  • -nodes: This tells OpenSSL to skip the option to secure our certificate with a passphrase. We need Nginx to be able to read the file, without user intervention, when the server starts up. A passphrase would prevent this from happening because we would have to enter it after every restart.
  • -days 365: This option sets the length of time that the certificate will be considered valid. We set it for one year here.
  • -newkey rsa:2048: This specifies that we want to generate a new certificate and a new key at the same time. We did not create the key that is required to sign the certificate in a previous step, so we need to create it along with the certificate. The rsa:2048 portion tells it to make an RSA key that is 2048 bits long.
  • -keyout: This line tells OpenSSL where to place the generated private key file that we are creating.
  • -out: This tells OpenSSL where to place the certificate that we are creating.

As we stated above, these options will create both a key file and a certificate. We will be asked a few questions about our server in order to embed the information correctly in the certificate.

Fill out the prompts appropriately. The most important line is the one that requests the Common Name (e.g. server FQDN or YOUR name). You need to enter the domain name that you want to be associated with your server. You can enter the public IP address instead if you do not have a domain name.

The entirety of the prompts will look something like this:

Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:New York
Locality Name (eg, city) []:New York City
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Bouncy Castles, Inc.
Organizational Unit Name (eg, section) []:Ministry of Water Slides
Common Name (e.g. server FQDN or YOUR name) []:your_domain.com
Email Address []:admin@your_domain.com

Both of the files you created will be placed in the /etc/nginx/ssl directory.

Wildcard certificate

In computer networking, a wildcard certificate is a public key certificate which can be used with multiple subdomains of a domain. The principal use is for securing web sites with HTTPS, but there are also applications in many other fields.

Common Name (e.g. server FQDN or YOUR name) []:*.your_domain.com
# This make the certificate also applicable to sub-domains.

Step Two — Configure Nginx to Use SSL

We have created our key and certificate files under the Nginx configuration directory. Now we just need to modify our Nginx configuration to take advantage of these by adjusting our server block files. You can learn more about Nginx server blocks in this article.

Nginx versions 0.7.14 and above (Ubuntu 14.04 ships with version 1.4.6) can enable SSL within the same server block as regular HTTP traffic. This allows us to configure access to the same site in a much more succinct manner.

Your server block may look something like this:

server {
        listen 80 default_server;
        listen [::]:80 default_server ipv6only=on;

        root /usr/share/nginx/html;
        index index.html index.htm;

        server_name your_domain.com;

        location / {
                try_files $uri $uri/ =404;
        }
}

The only thing we would need to do to get SSL working on this same server block, while still allowing regular HTTP connections, is add a these lines:

server {
        listen 80 default_server;
        listen [::]:80 default_server ipv6only=on;

        listen 443 ssl;

        root /usr/share/nginx/html;
        index index.html index.htm;

        server_name your_domain.com;
        ssl_certificate /etc/nginx/ssl/nginx.crt;
        ssl_certificate_key /etc/nginx/ssl/nginx.key;

        location / {
                try_files $uri $uri/ =404;
        }
}

When you are finished, save and close the file.

Now, all you have to do is restart Nginx to use your new settings:

sudo service nginx restart

This should reload your site configuration, now allowing it to respond to both HTTP and HTTPS (SSL) requests.

Step Three — Test your Setup

Your site should now have SSL functionality, but we should test it to make sure.

First, let’s test to make sure we can still access the site with using normal HTTP. In your web browser, go to your server’s domain name or IP address:

http://server_domain_or_IP

 

Sources

https://www.digitalocean.com/community/tutorials/how-to-create-an-ssl-certificate-on-nginx-for-ubuntu-14-04 for references

https://en.wikipedia.org/wiki/Wildcard_certificate

https://support.comodo.com/index.php?/Knowledgebase/Article/View/1/38/csr-generation-using-openssl-apache-wmod_ssl-nginx-os-x

https://sg.godaddy.com/help/what-is-a-wildcard-ssl-certificate-567

Ruby On Rails : Search kick : Elastic Search setup in Ubuntu 14.04

Coming Soon..

Resources
https://github.com/elasticsearch/elasticsearch-rails

For Searchkick
https://github.com/ankane/searchkick
https://github.com/ankane/searchkick#advanced

What you need to do to make the elasticsearch service running?
cd ~

sudo apt-get update

sudo apt-get install openjdk-7-jre-headless -y
### Check http://www.elasticsearch.org/download/ for latest version of ElasticSearch and replace wget link below
# NEW WAY / EASY WAY

wget https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-1.1.0.deb

sudo dpkg -i elasticsearch-1.1.0.deb

sudo service elasticsearch start
Product.reindex
Product.clean_indices

Ruby On Rails : Tools, Tips & Tricks to be more efficient developer

As a developer there are some techniques to be more efficient at work.

Guake terminal :

We can use OS’s terminal but it would be more efficient if we use Guake terminal. Normal configuration of Guake terminal doesnot load itself at startup. Tips reagarding Guake  terminal

> Put guake terminal at start up list in Ubuntu

– Open ‘Startup Applications’ > Click ‘Add’ > Write { Name: ‘Guake terminal’, command: ‘guake -n /path/of/your/interest/’} > click ‘Add’ > You are done!

if you want a new tab to execute a command you wish and even change the label then

guake -n ~/projects/ATS/ -r "SideKiq" -e "bundle exec sidekiq -q default -q mailer"

for more details see the following link

Change Shortcut keys

By default, the shortcut key to toggle the terminal is ‘F12’. However, we can change the shortcut key. F12 key resides on right hand side of the keyboard. If you use mouse then, you might feel uneasy to move the hand just to press F12 key. You can change the shortcut key to ‘Fn’ + Q. It depends on your preference.

Open new tab in current directory

There is a check-box option called ‘Open new tab in current directory’ in the ‘Preference’ dialog box. It means if you have changed you directory to ‘~/Download/my_app/’ and open a new tab then you can see the same path in the prompt.