2014年7月11日金曜日

ec2-user以外のユーザでAmazon Linuxにログインする

Amazon Linuxに個別のユーザでssh接続する必要があったりするのでその手順をまとめてみます。

本来は接続元で秘密鍵と公開鍵を作成し、接続先に公開鍵を配置しますが、秘密鍵と公開鍵のペアはどこで作成してもよいので、今回は接続先のLinuxサーバ上で鍵ペアを作成し、秘密鍵を接続元PCに持ち帰る手順を記載します。

OS: Amazon Linux 2014.03 (64-bit)
putty: 0.63


■ユーザ作成
[ec2-user@ip-10-86-30-32 ~]$ sudo useradd user001
[ec2-user@ip-10-86-30-32 ~]$ sudo passwd user001

## sudo権限付与(必要に応じて)
[ec2-user@ip-10-86-30-32 ~]$ sudo visudo
--- 99行目あたりに追記 ---
## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
user001 ALL=(ALL)       ALL ←追記


■秘密鍵(id_rsa)と公開鍵(id_rsa.pub)生成
[ec2-user@ip-10-86-30-32 ~]$ su - user001
Password:
[user001@ip-10-86-30-32 ~]$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user001/.ssh/id_rsa):
Created directory '/home/user001/.ssh'.
Enter passphrase (empty for no passphrase): ←パスフレーズ入力
Enter same passphrase again: ←パスフレーズ入力
Your identification has been saved in /home/user001/.ssh/id_rsa.
Your public key has been saved in /home/user001/.ssh/id_rsa.pub.
The key fingerprint is:
c8:30:57:dc:60:cc:ae:f1:5a:32:b0:8e:11:c5:a2:bc user001@ip-10-86-30-32
The key's randomart image is:
+--[ RSA 2048]----+
|       ++o       |
|    . .o+ .      |
|    oo.+         |
|    +=+.o .      |
| . . *oS+o       |
|  o .  o o       |
|   .   o         |
|  D   .          |
|                 |
+-----------------+
[user001@ip-10-86-30-32 ~]$
.sshディレクトリのパーミッションは700で自動生成されます。

## authorized_keysに公開鍵を登録
[user001@ip-10-86-30-32 ~]$ cat .ssh/id_rsa.pub >> .ssh/authorized_keys
[user001@ip-10-86-30-32 ~]$ chmod 600 .ssh/authorized_keys
[user001@ip-10-86-30-32 ~]$ ll .ssh/
total 12
-rw------- 1 user001 user001  404 Jul 11 14:28 authorized_keys
-rw------- 1 user001 user001 1766 Jul 11 14:28 id_rsa
-rw-r--r-- 1 user001 user001  404 Jul 11 14:28 id_rsa.pub
[user001@ip-10-86-30-32 ~]$


■秘密鍵をローカルPCに保存
[user001@ip-10-86-30-32 ~]$ cat .ssh/id_rsa
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,8781E4937DE990254DE539C21439ABE1

XyHTJcMs/9BQpoctuFG4NeR8vo6yxu/XaXyy01HtobrLU+QFUMo96rZsl79DWroL
doa5RfBNKcT1/IQHuNNOrlJMJmvz7mQyN+j2tC6GPohE/ai+ytGCeWUGwkvysXBl
(中略)
xZun1TzEp9z1F19+EWmTkQzzULCY/faZK4jmnTPEMnoLYlfJQfYmwxbGaRm3v58S
+VuQ30YJsOfSUrhFG5kF0xHcepBN6AkzViYvUdc1/wf35dNlzCaw0tfeQWpcMaqQ
-----END RSA PRIVATE KEY-----
[user001@ip-10-86-30-32 ~]$
クリップボード経由でローカルPCの"C:\aws_keys\user001.pem"に保存。

## id_rsaとid_rsa.pubの削除
[user001@ip-10-86-30-32 ~]$ rm .ssh/id_rsa*
[user001@ip-10-86-30-32 ~]$ ll .ssh/
total 4
-rw------- 1 user001 user001 404 Jul 11 14:28 authorized_keys
[user001@ip-10-86-30-32 ~]$
セキュリティ的にも、作業済みで不要となった鍵は削除しておく。


■PUTTY用の鍵を生成
PUTTYGEN.EXEを利用してuser001.pem → user001.ppk を生成。




"C:\aws_keys\user001.ppk"に保存。


■user001でログイン


Using username "user001".
Authenticating with public key "imported-openssh-key"
Passphrase for key "imported-openssh-key": ←パスフレーズ入力
Last login: Sun Jul 11 15:02:20 2014

       __|  __|_  )
       _|  (     /   Amazon Linux AMI
      ___|\___|___|

https://aws.amazon.com/amazon-linux-ami/2014.03-release-notes/
9 package(s) needed for security, out of 19 available
Run "sudo yum update" to apply all updates.
[user001@ip-10-86-30-32 ~]$
ログイン成功!!


こちらの情報が何かのお役に立てましたら幸いです。サイト継続ご協力のほどお願い致します。m(_ _)m

2014年7月10日木曜日

Amazon Linux に ffmpeg をインストール

Amazon Linux に ffmpeg をインストールする手順です。
メジャーどころのコーデックを組み込むために事前準備が大変だったので
そのあたりの手順をまとめています。

OS: Amazon Linux AMI release 2014.03 (64-bit)
ffmpeg: 2.2.4


■開発ツールインストール
[root@da-svr01 ~]# yum groupinstall "Development Tools"
(以下省略)


■yumリポジトリ追加
## rpmforge
[root@da-svr01 ~]# rpm -Uhv http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el7.rf.x86_64.rpm
Retrieving http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el7.rf.x86_64.rpm
warning: /var/tmp/rpm-tmp.5VvNxx: Header V3 DSA/SHA1 Signature, key ID 6bxxx9e6: NOKEY
Preparing...                          ########################### [100%]
Updating / installing...
   1:rpmforge-release-0.5.3-1.el7.rf  ########################### [100%]
[root@da-svr01 ~]#
※デフォルトで利用することになっているので、パッケージインストール作業後は変更する。

## epel
[root@da-svr01 ~]# rpm -Uhv http://ftp-srv2.kddilabs.jp/Linux/distributions/fedora/epel/6/x86_64/epel-release-6-8.noarch.rpm
Retrieving http://ftp-srv2.kddilabs.jp/Linux/distributions/fedora/epel/6/x86_64/epel-release-6-8.noarch.rpm
warning: /var/tmp/rpm-tmp.D4D5xx: Header V3 RSA/SHA256 Signature, key ID 06xxx895: NOKEY
Preparing...                          ########################### [100%]
        package epel-release-6-8.9.amzn1.noarch (which is newer than epel-release-6-8.noarch) is already installed
[root@da-svr01 ~]#
※既にリリース済みの模様。


■関連パッケージのインストール
## その1
[root@da-svr01 ~]# yum install SDL-devel a52dec a52dec-devel alsa-lib-devel faac faac-devel faad2 faad2-devel
No package SDL-devel available.
No package a52dec available.
No package a52dec-devel available.
No package faac available.
No package faac-devel available.
No package faad2 available.
No package faad2-devel available.
=================================================================================
 Package                 Arch        Version                Repository      Size
=================================================================================
Installing:
 alsa-lib-devel          x86_64      1.0.22-3.9.amzn1       amzn-main      1.4 M

Transaction Summary
=================================================================================
Install  1 Package

## その2
[root@da-svr01 ~]# yum install freetype-devel giflib imlib2 imlib2-devel lame lame-devel libICE-devel libSM-devel
No package imlib2 available.
No package imlib2-devel available.
No package lame available.
No package lame-devel available.
=================================================================================
 Package                     Arch      Version                Repository    Size
=================================================================================
Installing:
 freetype-devel              x86_64    2.3.11-14.13.amzn1     amzn-main    410 k
 libICE-devel                x86_64    1.0.6-1.4.amzn1        amzn-main     11 k
 libSM-devel                 x86_64    1.2.1-2.6.amzn1        amzn-main     12 k
Installing for dependencies:
 xorg-x11-proto-devel        noarch    7.6-25.8.amzn1         amzn-main    304 k

Transaction Summary
=================================================================================
Install  3 Packages (+1 Dependent package)

## その3
[root@da-svr01 ~]# yum install libXau-devel libXdmcp-devel libXext-devel libXrandr-devel libXrender-devel libXt-devel
=================================================================================
 Package                  Arch       Version                 Repository     Size
=================================================================================
Installing:
 libXau-devel             x86_64     1.0.6-4.9.amzn1         amzn-main      13 k
 libXdmcp-devel           x86_64     1.1.1-3.8.amzn1         amzn-main      11 k
 libXext-devel            x86_64     1.3.1-2.8.amzn1         amzn-main      73 k
 libXrandr-devel          x86_64     1.4.0-1.6.amzn1         amzn-main      20 k
 libXrender-devel         x86_64     0.9.7-2.7.amzn1         amzn-main      15 k
 libXt-devel              x86_64     1.1.3-1.7.amzn1         amzn-main     504 k
Installing for dependencies:
 libX11-devel             x86_64     1.5.0-4.10.amzn1        amzn-main     1.0 M
 libXdmcp                 x86_64     1.1.1-3.8.amzn1         amzn-main      32 k
 libXrandr                x86_64     1.4.0-1.6.amzn1         amzn-main      38 k
 libXt                    x86_64     1.1.3-1.7.amzn1         amzn-main     206 k
 libxcb-devel             x86_64     1.8.1-1.14.amzn1        amzn-main     186 k

Transaction Summary
=================================================================================
Install  6 Packages (+5 Dependent packages)

## その4
[root@da-svr01 ~]# yum install id3tag-devel libogg libvorbis vorbis-tools mesa-libGL-devel mesa-libGLU-devel xorg-x11-proto-devel xvidcore xvidcore-devel zlib-devel
No package id3tag-devel available.
Package xorg-x11-proto-devel-7.6-25.8.amzn1.noarch already installed and latest version
No package xvidcore available.
No package xvidcore-devel available.
Package zlib-devel-1.2.7-10.17.amzn1.x86_64 already installed and latest version
=================================================================================
 Package                   Arch     Version                    Repository   Size
=================================================================================
Installing:
 libogg                    x86_64   2:1.1.4-2.1.5.amzn1        amzn-main    18 k
 libvorbis                 x86_64   1:1.2.3-4.6.amzn1          amzn-main   210 k
 mesa-libGL-devel          x86_64   9.0-0.9.30.amzn1           amzn-main   515 k
 mesa-libGLU-devel         x86_64   9.0-0.9.30.amzn1           amzn-main   112 k
 vorbis-tools              x86_64   1:1.2.0-7.6.amzn1          amzn-main   195 k
Installing for dependencies:
 flac                      x86_64   1.2.1-6.1.6.amzn1          amzn-main   292 k
 libXdamage                x86_64   1.1.3-4.7.amzn1            amzn-main    19 k
 libXdamage-devel          x86_64   1.1.3-4.7.amzn1            amzn-main   9.0 k
 libXfixes                 x86_64   5.0-3.6.amzn1              amzn-main    25 k
 libXfixes-devel           x86_64   5.0-3.6.amzn1              amzn-main    12 k
 libXxf86vm                x86_64   1.1.2-2.7.amzn1            amzn-main    23 k
 libXxf86vm-devel          x86_64   1.1.2-2.7.amzn1            amzn-main    17 k
 libao                     x86_64   0.8.8-7.1.6.amzn1          amzn-main    29 k
 libdrm                    x86_64   2.4.39-1.9.amzn1           amzn-main   133 k
 libdrm-devel              x86_64   2.4.39-1.9.amzn1           amzn-main    84 k
 libpciaccess              x86_64   0.13.1-3.10.amzn1          amzn-main    25 k
 mesa-dri-drivers          x86_64   9.0-0.9.30.amzn1           amzn-main   4.9 M
 mesa-dri-filesystem       x86_64   9.0-0.9.30.amzn1           amzn-main    46 k
 mesa-dri1-drivers         x86_64   7.11-8.6.amzn1             amzn-main   4.4 M
 mesa-libGL                x86_64   9.0-0.9.30.amzn1           amzn-main   200 k
 mesa-libGLU               x86_64   9.0-0.9.30.amzn1           amzn-main   251 k
 speex                     x86_64   1.2-0.12.rc1.1.7.amzn1     amzn-main   102 k

Transaction Summary
=================================================================================
Install  5 Packages (+17 Dependent packages)

## その5
[root@da-svr01 ~]# yum install amrnb-devel amrwb-devel libtheora theora-tools
No package amrnb-devel available.
No package amrwb-devel available.
No package libtheora available.
No package theora-tools available.
Error: Nothing to do
yumでは取得できず・・・。(T-T)

## その6
[root@da-svr01 ~]# yum install glibc ncurses-devel nasm libvpx* opencore-amr-devel
No package opencore-amr-devel available.
=================================================================================
 Package                 Arch     Version                    Repository     Size
=================================================================================
Installing:
 libvpx                  x86_64   1.2.0-1.0.amzn1            amzn-main     222 k
 libvpx-devel            x86_64   1.2.0-1.0.amzn1            amzn-main     358 k
 libvpx-utils            x86_64   1.2.0-1.0.amzn1            amzn-main      80 k
 nasm                    x86_64   2.10.07-5.6.amzn1          amzn-main     467 k
 ncurses-devel           x86_64   5.7-3.20090208.13.amzn1    amzn-main     687 k
Updating:
 glibc                   x86_64   2.17-55.84.amzn1           amzn-updates  5.6 M
Updating for dependencies:
 glibc-common            x86_64   2.17-55.84.amzn1           amzn-updates   28 M
 glibc-devel             x86_64   2.17-55.84.amzn1           amzn-updates  1.1 M
 glibc-headers           x86_64   2.17-55.84.amzn1           amzn-updates  721 k
 nss-softokn-freebl      x86_64   3.16.0-1.19.amzn1          amzn-updates  219 k

Transaction Summary
=================================================================================
Install  5 Packages
Upgrade  1 Package  (+4 Dependent packages)

## その7
[root@da-svr01 ~]# yum install yasm
=================================================================================
 Package          Arch           Version                 Repository         Size
=================================================================================
Installing:
 yasm             x86_64         1.2.0-1.2.amzn1         amzn-main         847 k

Transaction Summary
=================================================================================
Install  1 Package

■コーデックのインストール
## 基本的なコーデック
[root@da-svr01 ~]# mkdir src
[root@da-svr01 ~]# cd src
[root@da-svr01 src]# wget http://www8.mplayerhq.hu/MPlayer/releases/codecs/all-20110131.tar.bz2
[root@da-svr01 src]# bzip2 -dc all-20110131.tar.bz2 | tar xf -
[root@da-svr01 src]# mkdir /usr/local/lib/codecs/
[root@da-svr01 src]# mkdir /usr/local/lib64/codecs/
[root@da-svr01 src]# cp all-20110131/* /usr/local/lib/codecs/
[root@da-svr01 src]# cp all-20110131/* /usr/local/lib64/codecs/
[root@da-svr01 src]# chmod -R 755 /usr/local/lib/codecs/
[root@da-svr01 src]# chmod -R 755 /usr/local/lib64/codecs/

## LibOgg
[root@da-svr01 src]# wget http://downloads.xiph.org/releases/ogg/libogg-1.3.2.tar.gz
[root@da-svr01 src]# tar -zxf libogg-1.3.2.tar.gz
[root@da-svr01 src]# cd libogg-1.3.2
[root@da-svr01 libogg-1.3.2]# ./configure
[root@da-svr01 libogg-1.3.2]# make
[root@da-svr01 libogg-1.3.2]# make install

## Libvorbis
[root@da-svr01 src]# wget http://downloads.xiph.org/releases/vorbis/libvorbis-1.3.4.tar.gz
[root@da-svr01 src]# tar -zxf libvorbis-1.3.4.tar.gz
[root@da-svr01 src]# cd libvorbis-1.3.4
[root@da-svr01 libvorbis-1.3.4]# ./configure
[root@da-svr01 libvorbis-1.3.4]# make
[root@da-svr01 libvorbis-1.3.4]# make install

## Libtheora
[root@da-svr01 src]# wget http://downloads.xiph.org/releases/theora/libtheora-1.1.1.tar.gz
[root@da-svr01 src]# tar -zxf libtheora-1.1.1.tar.gz; cd libtheora-1.1.1
[root@da-svr01 libtheora-1.1.1]# ./configure
[root@da-svr01 libtheora-1.1.1]# make
[root@da-svr01 libtheora-1.1.1]# make install

## Libvpx
[root@da-svr01 src]# git clone http://git.chromium.org/webm/libvpx.git
[root@da-svr01 src]# cd libvpx/
[root@da-svr01 libvpx]# ./configure --enable-shared --extra-cflags=-fPIC
[root@da-svr01 libvpx]# make
[root@da-svr01 libvpx]# make install

## Aacenc
[root@da-svr01 src]# wget http://downloads.sourceforge.net/opencore-amr/vo-aacenc-0.1.3.tar.gz
[root@da-svr01 src]# tar -zxf vo-aacenc-0.1.3.tar.gz; cd vo-aacenc-0.1.3
[root@da-svr01 vo-aacenc-0.1.3]# ./configure --enable-shared
[root@da-svr01 vo-aacenc-0.1.3]# make
[root@da-svr01 vo-aacenc-0.1.3]# make install

## X264
[root@da-svr01 src]# git clone git://git.videolan.org/x264.git
[root@da-svr01 src]# cd x264/
[root@da-svr01 x264]# ./configure --enable-shared --extra-cflags=-fPIC --extra-asflags=-D__PIC__
[root@da-svr01 x264]# make
[root@da-svr01 x264]# make install

## libfaac
[root@da-svr01 src]# wget http://downloads.sourceforge.net/faac/faac-1.28.tar.gz
[root@da-svr01 src]# tar -zxf faac-1.28.tar.gz; cd faac-1.28
[root@da-svr01 faac-1.28]# ./bootstrap
aclocal: warning: autoconf input should be named 'configure.ac', not 'configure.in'
automake: warning: autoconf input should be named 'configure.ac', not 'configure.in'
common/mp4v2/Makefile.am:1: warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')
automake: warning: autoconf input should be named 'configure.ac', not 'configure.in'
frontend/Makefile.am:10: warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')
libfaac/Makefile.am:11: warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')
[root@da-svr01 faac-1.28]# ./configure
[root@da-svr01 faac-1.28]# make
(中略)
make[3]: *** [3gp.o] Error 1
make[3]: Leaving directory `/root/src/faac-1.28/common/mp4v2'
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory `/root/src/faac-1.28/common'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/root/src/faac-1.28'
make: *** [all] Error 2
[root@da-svr01 faac-1.28]#
エラー発生!!

バージョンを1.26にして再チャレンジ。
[root@da-svr01 src]# wget http://downloads.sourceforge.net/faac/faac-1.26.tar.gz
[root@da-svr01 src]# tar -zxf faac-1.26.tar.gz
[root@da-svr01 src]# cd faac
[root@da-svr01 faac]# ./bootstrap
[root@da-svr01 faac]# ./configure
[root@da-svr01 faac]# make
[root@da-svr01 faac]# make install

## lame
[root@da-svr01 src]# wget http://downloads.sourceforge.net/project/lame/lame/3.99/lame-3.99.5.tar.gz
[root@da-svr01 src]# tar -zxf lame-3.99.5.tar.gz; cd lame-3.99.5
[root@da-svr01 lame-3.99.5]# ./configure
[root@da-svr01 lame-3.99.5]# make
[root@da-svr01 lame-3.99.5]# make install

## libxvid
[root@da-svr01 src]# wget http://downloads.xvid.org/downloads/xvidcore-1.3.2.tar.gz
[root@da-svr01 src]# tar -zxf xvidcore-1.3.2.tar.gz
[root@da-svr01 src]# cd xvidcore/build/generic/
[root@da-svr01 generic]# ./configure
[root@da-svr01 generic]# make
[root@da-svr01 generic]# make install


■ライブラリの登録
[root@da-svr01 ~]# export LD_LIBRARY_PATH=/usr/local/lib/
[root@da-svr01 ~]# sh -c "echo /usr/local/lib > /etc/ld.so.conf.d/custom-libs.conf"
[root@da-svr01 ~]# ldconfig
[root@da-svr01 ~]#


■ffmpegのインストール
gitからインストーラを取得して現時点の安定さ新バージョンである2.2.4を指定。
オプションが多いのでconfigure用のスクリプトを準備。
[root@da-svr01 src]# git clone git://source.ffmpeg.org/ffmpeg.git
[root@da-svr01 src]# cd ffmpeg/
[root@da-svr01 ffmpeg]# ./version.sh
N-64586-g8153847
[root@da-svr01 ffmpeg]# git checkout n2.2.4
[root@da-svr01 ffmpeg]# vi configure.sh
[root@da-svr01 ffmpeg]# chmod 755 configure.sh
[root@da-svr01 ffmpeg]# cat configure.sh
./configure \
--enable-version3 \
--enable-libvpx \
--enable-libfaac \
--enable-libmp3lame \
--enable-libtheora \
--enable-libvorbis \
--enable-libx264 \
--enable-libvo-aacenc \
--enable-libxvid \
--disable-ffplay \
--enable-shared \
--enable-gpl \
--enable-postproc \
--enable-nonfree \
--enable-avfilter \
--enable-pthreads \
--extra-cflags=-fPIC
[root@da-svr01 ffmpeg]#

## configure
[root@da-svr01 ffmpeg]# ./configure.sh
install prefix            /usr/local
source path               .
C compiler                gcc
C library                 glibc
ARCH                      x86 (generic)
big-endian                no
runtime cpu detection     yes
yasm                      yes
MMX enabled               yes
(中略)
License: nonfree and unredistributable
Creating config.mak, config.h, and doc/config.texi...
[root@da-svr01 ffmpeg]#

## make
サーバスペックにもよりますが、20分くらいかかるかも。
[root@da-svr01 ffmpeg]# date
Thu Jul 10 11:18:28 JST 2014
[root@da-svr01 ffmpeg]# make
(中略)
LD      ffserver_g
CP      ffserver
STRIP   ffserver
[root@da-svr01 ffmpeg]# date
Thu Jul 10 11:30:50 JST 2014
[root@da-svr01 ffmpeg]#

## make install
[root@da-svr01 ffmpeg]# make install
INSTALL doc/ffmpeg.1
INSTALL doc/ffprobe.1
(中略)
INSTALL libavutil/ffversion.h
INSTALL libavutil/libavutil.pc
[root@da-svr01 ffmpeg]#


■バージョン確認
[root@da-svr01 ~]# ffmpeg -version
ffmpeg version 2.2.4
built on Jul 10 2014 11:30:37 with gcc 4.8.2 (GCC) 20131212 (Red Hat 4.8.2-7)
configuration: --enable-version3 --enable-libvpx --enable-libfaac --enable-libmp3lame --enable-libtheora --enable-libvorbis --enable-libx264 --enable-libvo-aacenc --enable-libxvid --disable-ffplay --enable-shared --enable-gpl --enable-postproc --enable-nonfree --enable-avfilter --enable-pthreads --extra-cflags=-fPIC
libavutil      52. 66.100 / 52. 66.100
libavcodec     55. 52.102 / 55. 52.102
libavformat    55. 33.100 / 55. 33.100
libavdevice    55. 10.100 / 55. 10.100
libavfilter     4.  2.100 /  4.  2.100
libswscale      2.  5.102 /  2.  5.102
libswresample   0. 18.100 /  0. 18.100
libpostproc    52.  3.100 / 52.  3.100
[root@da-svr01 ~]#

## インストール先
[root@da-svr01 ~]# ll /usr/local/bin/
total 3256
-rwxr-xr-x 1 root root   35968 Jul 10 10:55 faac
-rwxr-xr-x 1 root root  191768 Jul 10 11:31 ffmpeg
-rwxr-xr-x 1 root root  121528 Jul 10 11:31 ffprobe
-rwxr-xr-x 1 root root  116576 Jul 10 11:31 ffserver
-rwxr-xr-x 1 root root  485827 Jul 10 10:44 lame
-rwxr-xr-x 1 root root  518907 Jul 10 10:20 vpxdec
-rwxr-xr-x 1 root root  491710 Jul 10 10:21 vpxenc
-rwxr-xr-x 1 root root 1357069 Jul 10 10:29 x264
[root@da-svr01 ~]#


■対応フォーマット一覧
[root@da-svr01 ~]# ffmpeg -formats
ffmpeg version 2.2.4 Copyright (c) 2000-2014 the FFmpeg developers
  built on Jul 10 2014 11:30:37 with gcc 4.8.2 (GCC) 20131212 (Red Hat 4.8.2-7)
  configuration: --enable-version3 --enable-libvpx --enable-libfaac --enable-libmp3lame --enable-libtheora --enable-libvorbis --enable-libx264 --enable-libvo-aacenc --enable-libxvid --disable-ffplay --enable-shared --enable-gpl --enable-postproc --enable-nonfree --enable-avfilter --enable-pthreads --extra-cflags=-fPIC
  libavutil      52. 66.100 / 52. 66.100
  libavcodec     55. 52.102 / 55. 52.102
  libavformat    55. 33.100 / 55. 33.100
  libavdevice    55. 10.100 / 55. 10.100
  libavfilter     4.  2.100 /  4.  2.100
  libswscale      2.  5.102 /  2.  5.102
  libswresample   0. 18.100 /  0. 18.100
  libpostproc    52.  3.100 / 52.  3.100
File formats:
 D. = Demuxing supported
 .E = Muxing supported
 --
  E 3g2             3GP2 (3GPP2 file format)
  E 3gp             3GP (3GPP file format)
 D  4xm             4X Technologies
  E a64             a64 - video for Commodore 64
 D  aac             raw ADTS AAC (Advanced Audio Coding)
 DE ac3             raw AC-3
 D  act             ACT Voice file format
 D  adf             Artworx Data Format
 D  adp             ADP
  E adts            ADTS AAC (Advanced Audio Coding)
 DE adx             CRI ADX
 D  aea             MD STUDIO audio
 D  afc             AFC
 DE aiff            Audio IFF
 DE alaw            PCM A-law
 DE alsa            ALSA audio output
 DE amr             3GPP AMR
 D  anm             Deluxe Paint Animation
 D  apc             CRYO APC
 D  ape             Monkey's Audio
 D  aqtitle         AQTitle subtitles
 DE asf             ASF (Advanced / Active Streaming Format)
  E asf_stream      ASF (Advanced / Active Streaming Format)
 DE ass             SSA (SubStation Alpha) subtitle
 DE ast             AST (Audio Stream)
 DE au              Sun AU
 DE avi             AVI (Audio Video Interleaved)
  E avm2            SWF (ShockWave Flash) (AVM2)
 D  avr             AVR (Audio Visual Research)
 D  avs             AVS
 D  bethsoftvid     Bethesda Softworks VID
 D  bfi             Brute Force & Ignorance
 D  bin             Binary text
 D  bink            Bink
 DE bit             G.729 BIT file format
 D  bmv             Discworld II BMV
 D  boa             Black Ops Audio
 D  brstm           BRSTM (Binary Revolution Stream)
 D  c93             Interplay C93
 DE caf             Apple CAF (Core Audio Format)
 DE cavsvideo       raw Chinese AVS (Audio Video Standard) video
 D  cdg             CD Graphics
 D  cdxl            Commodore CDXL video
 D  concat          Virtual concatenation script
  E crc             CRC testing
 DE data            raw data
 DE daud            D-Cinema audio
 D  dfa             Chronomaster DFA
 DE dirac           raw Dirac
 DE dnxhd           raw DNxHD (SMPTE VC-3)
 D  dsicin          Delphine Software International CIN
 DE dts             raw DTS
 D  dtshd           raw DTS-HD
 DE dv              DV (Digital Video)
 D  dv1394          DV1394 A/V grab
  E dvd             MPEG-2 PS (DVD VOB)
 D  dxa             DXA
 D  ea              Electronic Arts Multimedia
 D  ea_cdata        Electronic Arts cdata
 DE eac3            raw E-AC-3
 D  epaf            Ensoniq Paris Audio File
 DE f32be           PCM 32-bit floating-point big-endian
 DE f32le           PCM 32-bit floating-point little-endian
  E f4v             F4V Adobe Flash Video
 DE f64be           PCM 64-bit floating-point big-endian
 DE f64le           PCM 64-bit floating-point little-endian
 DE fbdev           Linux framebuffer
 DE ffm             FFM (FFserver live feed)
 DE ffmetadata      FFmpeg metadata in text
 D  film_cpk        Sega FILM / CPK
 DE filmstrip       Adobe Filmstrip
 DE flac            raw FLAC
 D  flic            FLI/FLC/FLX animation
 DE flv             FLV (Flash Video)
  E framecrc        framecrc testing
  E framemd5        Per-frame MD5 testing
 D  frm             Megalux Frame
 DE g722            raw G.722
 DE g723_1          raw G.723.1
 D  g729            G.729 raw format demuxer
 DE gif             GIF Animation
 D  gsm             raw GSM
 DE gxf             GXF (General eXchange Format)
 DE h261            raw H.261
 DE h263            raw H.263
 DE h264            raw H.264 video
  E hds             HDS Muxer
 DE hevc            raw HEVC video
  E hls             Apple HTTP Live Streaming
 D  hls,applehttp   Apple HTTP Live Streaming
 D  hnm             Cryo HNM v4
 DE ico             Microsoft Windows ICO
 D  idcin           id Cinematic
 D  idf             iCE Draw File
 D  iff             IFF (Interchange File Format)
 DE ilbc            iLBC storage
 DE image2          image2 sequence
 DE image2pipe      piped image2 sequence
 D  ingenient       raw Ingenient MJPEG
 D  ipmovie         Interplay MVE
  E ipod            iPod H.264 MP4 (MPEG-4 Part 14)
 DE ircam           Berkeley/IRCAM/CARL Sound Format
  E ismv            ISMV/ISMA (Smooth Streaming)
 D  iss             Funcom ISS
 D  iv8             IndigoVision 8000 video
 DE ivf             On2 IVF
 DE jacosub         JACOsub subtitle format
 D  jv              Bitmap Brothers JV
 DE latm            LOAS/LATM
 D  lavfi           Libavfilter virtual input device
 D  lmlm4           raw lmlm4
 D  loas            LOAS AudioSyncStream
 D  lvf             LVF
 D  lxf             VR native stream (LXF)
 DE m4v             raw MPEG-4 video
  E matroska        Matroska
 D  matroska,webm   Matroska / WebM
  E md5             MD5 testing
 D  mgsts           Metal Gear Solid: The Twin Snakes
 DE microdvd        MicroDVD subtitle format
 DE mjpeg           raw MJPEG video
  E mkvtimestamp_v2 extract pts as timecode v2 format, as defined by mkvtoolnix
 DE mlp             raw MLP
 D  mm              American Laser Games MM
 DE mmf             Yamaha SMAF
  E mov             QuickTime / MOV
 D  mov,mp4,m4a,3gp,3g2,mj2 QuickTime / MOV
  E mp2             MP2 (MPEG audio layer 2)
 DE mp3             MP3 (MPEG audio layer 3)
  E mp4             MP4 (MPEG-4 Part 14)
 D  mpc             Musepack
 D  mpc8            Musepack SV8
 DE mpeg            MPEG-1 Systems / MPEG program stream
  E mpeg1video      raw MPEG-1 video
  E mpeg2video      raw MPEG-2 video
 DE mpegts          MPEG-TS (MPEG-2 Transport Stream)
 D  mpegtsraw       raw MPEG-TS (MPEG-2 Transport Stream)
 D  mpegvideo       raw MPEG video
  E mpjpeg          MIME multipart JPEG
 D  mpl2            MPL2 subtitles
 D  mpsub           MPlayer subtitles
 D  msnwctcp        MSN TCP Webcam stream
 D  mtv             MTV
 DE mulaw           PCM mu-law
 D  mv              Silicon Graphics Movie
 D  mvi             Motion Pixels MVI
 DE mxf             MXF (Material eXchange Format)
  E mxf_d10         MXF (Material eXchange Format) D-10 Mapping
 D  mxg             MxPEG clip
 D  nc              NC camera feed
 D  nistsphere      NIST SPeech HEader REsources
 D  nsv             Nullsoft Streaming Video
  E null            raw null video
 DE nut             NUT
 D  nuv             NuppelVideo
 DE ogg             Ogg
 DE oma             Sony OpenMG audio
  E opus            Opus
 DE oss             OSS (Open Sound System) playback
 D  paf             Amazing Studio Packed Animation File
 D  pjs             PJS (Phoenix Japanimation Society) subtitles
 D  pmp             Playstation Portable PMP
  E psp             PSP MP4 (MPEG-4 Part 14)
 D  psxstr          Sony Playstation STR
 D  pva             TechnoTrend PVA
 D  pvf             PVF (Portable Voice Format)
 D  qcp             QCP
 D  r3d             REDCODE R3D
 DE rawvideo        raw video
 D  realtext        RealText subtitle format
 D  redspark        RedSpark
 D  rl2             RL2
 DE rm              RealMedia
 DE roq             raw id RoQ
 D  rpl             RPL / ARMovie
 D  rsd             GameCube RSD
 DE rso             Lego Mindstorms RSO
 DE rtp             RTP output
 DE rtsp            RTSP output
 DE s16be           PCM signed 16-bit big-endian
 DE s16le           PCM signed 16-bit little-endian
 DE s24be           PCM signed 24-bit big-endian
 DE s24le           PCM signed 24-bit little-endian
 DE s32be           PCM signed 32-bit big-endian
 DE s32le           PCM signed 32-bit little-endian
 DE s8              PCM signed 8-bit
 D  sami            SAMI subtitle format
 DE sap             SAP output
 D  sbg             SBaGen binaural beats script
 D  sdp             SDP
 D  sdr2            SDR2
  E segment         segment
 D  shn             raw Shorten
 D  siff            Beam Software SIFF
 DE smjpeg          Loki SDL MJPEG
 D  smk             Smacker
  E smoothstreaming Smooth Streaming Muxer
 D  smush           LucasArts Smush
 D  sol             Sierra SOL
 DE sox             SoX native
 DE spdif           IEC 61937 (used on S/PDIF - IEC958)
  E speex           Speex
 DE srt             SubRip subtitle
  E stream_segment,ssegment streaming segment muxer
 D  subviewer       SubViewer subtitle format
 D  subviewer1      SubViewer v1 subtitle format
  E svcd            MPEG-2 PS (SVCD)
 DE swf             SWF (ShockWave Flash)
 D  tak             raw TAK
 D  tedcaptions     TED Talks captions
  E tee             Multiple muxer tee
 D  thp             THP
 D  tiertexseq      Tiertex Limited SEQ
 D  tmv             8088flex TMV
 DE truehd          raw TrueHD
 D  tta             TTA (True Audio)
 D  tty             Tele-typewriter
 D  txd             Renderware TeXture Dictionary
 DE u16be           PCM unsigned 16-bit big-endian
 DE u16le           PCM unsigned 16-bit little-endian
 DE u24be           PCM unsigned 24-bit big-endian
 DE u24le           PCM unsigned 24-bit little-endian
 DE u32be           PCM unsigned 32-bit big-endian
 DE u32le           PCM unsigned 32-bit little-endian
 DE u8              PCM unsigned 8-bit
  E uncodedframecrc uncoded framecrc testing
  E v4l2            Video4Linux2 output device
 DE vc1             raw VC-1 video
 DE vc1test         VC-1 test bitstream
  E vcd             MPEG-1 Systems / MPEG program stream (VCD)
 D  video4linux2,v4l2 Video4Linux2 device grab
 D  vivo            Vivo
 D  vmd             Sierra VMD
  E vob             MPEG-2 PS (VOB)
 D  vobsub          VobSub subtitle format
 DE voc             Creative Voice
 D  vplayer         VPlayer subtitles
 D  vqf             Nippon Telegraph and Telephone Corporation (NTT) TwinVQ
 DE w64             Sony Wave64
 DE wav             WAV / WAVE (Waveform Audio)
 D  wc3movie        Wing Commander III movie
  E webm            WebM
 DE webvtt          WebVTT subtitle
 D  wsaud           Westwood Studios audio
 D  wsvqa           Westwood Studios VQA
 DE wtv             Windows Television (WTV)
 DE wv              raw WavPack
 D  xa              Maxis XA
 D  xbin            eXtended BINary text (XBIN)
 D  xmv             Microsoft XMV
 D  xwma            Microsoft xWMA
 D  yop             Psygnosis YOP
 DE yuv4mpegpipe    YUV4MPEG pipe
[root@da-svr01 ~]#


こちらの情報が何かのお役に立てましたら幸いです。サイト継続ご協力のほどお願い致します。m(_ _)m

2014年6月22日日曜日

tshark(wiresharkのCUI)でBasic認証の安全性(危険性?)を検証

Basic認証が安全ではないと言われる所以をパケットキャプチャにより実証したい気分な方へ
tsharkをインストールしてパケットキャプチャする手順をお届けします。
Digest認証についてもどの程度安全性が確保されているのかも確認します。
Basic認証/Digest認証の設定方法は前回記事をどうぞ。

OS: CentOS 6.5 (64-bit)
TShark: 1.8.10


■tsharkインストール
CUIだけでいいので、wireshark-gnomeはインストールせず、tsharkだけインストールしたい。
[root@centos65 ~]# yum install tshark
(中略)
No package tshark available.
Error: Nothing to do
[root@cent63 ~]#
無いらしい。wiresharkでインストールすればGUIはインストールされないとのこと。


■wiresharkインストール
[root@centos65 ~]# yum install wireshark
==========================================================================
 Package            Arch          Version             Repository     Size
==========================================================================
Installing:
 wireshark          x86_64        1.8.10-7.el6_5      updates        11 M
Installing for dependencies:
 libsmi             x86_64        0.4.8-4.el6         base          2.4 M

Transaction Summary
==========================================================================
Install       2 Package(s)

## version確認
[root@centos65 ~]# tshark -v
TShark 1.8.10 (SVN Rev Unknown from unknown)

Copyright 1998-2013 Gerald Combs  and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.26.1, with libpcap, with libz 1.2.3, without POSIX
capabilities, with SMI 0.4.8, without c-ares, without ADNS, without Lua, without
Python, with GnuTLS 2.8.5, with Gcrypt 1.4.5, with MIT Kerberos, without GeoIP.

Running on Linux 2.6.32-431.el6.x86_64, with locale ja_JP.UTF-8, with libpcap
version 1.4.0, with libz 1.2.3.

Built using gcc 4.4.7 20120313 (Red Hat 4.4.7-4).
[root@centos65 ~]#


■192.168.77.149宛てのhttp通信だけをキャプチャ
[root@centos65 ~]# tshark -l host 192.168.77.149 and port http
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
  0.000000 192.168.77.1 -> 192.168.77.149 TCP 74 45248 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 SACK_PERM=1 TSval=587734266 TSecr=0 WS=4
  0.000055 192.168.77.149 -> 192.168.77.1 TCP 74 http > 45248 [SYN, ACK] Seq=0 Ack=1 Win=14480 Len=0 MSS=1460 SACK_PERM=1 TSval=13298595 TSecr=587734266 WS=128
  0.000307 192.168.77.1 -> 192.168.77.149 TCP 66 45248 > http [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSval=587734266 TSecr=13298595
  0.000338 192.168.77.1 -> 192.168.77.149 TCP 66 45248 > http [FIN, ACK] Seq=1 Ack=1 Win=5840 Len=0 TSval=587734266 TSecr=13298595
  0.000531 192.168.77.149 -> 192.168.77.1 TCP 66 http > 45248 [ACK] Seq=1 Ack=2 Win=14592 Len=0 TSval=13298596 TSecr=587734266
  0.000881 192.168.77.149 -> 192.168.77.1 TCP 66 http > 45248 [FIN, ACK] Seq=1 Ack=2 Win=14592 Len=0 TSval=13298596 TSecr=587734266
  0.001063 192.168.77.1 -> 192.168.77.149 TCP 66 45248 > http [ACK] Seq=2 Ack=2 Win=5840 Len=0 TSval=587734266 TSecr=13298596
  4.101061 192.168.77.1 -> 192.168.77.149 TCP 74 45252 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 SACK_PERM=1 TSval=587734676 TSecr=0 WS=4
  4.101095 192.168.77.149 -> 192.168.77.1 TCP 74 http > 45252 [SYN, ACK] Seq=0 Ack=1 Win=14480 Len=0 MSS=1460 SACK_PERM=1 TSval=13302696 TSecr=587734676 WS=128
  4.101334 192.168.77.1 -> 192.168.77.149 TCP 66 45252 > http [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSval=587734676 TSecr=13302696
  4.101372 192.168.77.1 -> 192.168.77.149 TCP 66 45252 > http [FIN, ACK] Seq=1 Ack=1 Win=5840 Len=0 TSval=587734676 TSecr=13302696
  4.101532 192.168.77.149 -> 192.168.77.1 TCP 66 http > 45252 [ACK] Seq=1 Ack=2 Win=14592 Len=0 TSval=13302697 TSecr=587734676
  4.101720 192.168.77.149 -> 192.168.77.1 TCP 66 http > 45252 [FIN, ACK] Seq=1 Ack=2 Win=14592 Len=0 TSval=13302697 TSecr=587734676
  4.101931 192.168.77.1 -> 192.168.77.149 TCP 66 45252 > http [ACK] Seq=2 Ack=2 Win=5840 Len=0 TSval=587734676 TSecr=13302697
^C14 packets captured
[root@centos65 ~]#
Router(192.168.77.1)からのリクエストに対して応答しているパケットをキャプチャできている。
[root@centos65 ~]# tshark -l host 192.168.77.150 and port http
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
^C0 packets captured
[root@centos65 ~]#
自サーバ(192.168.77.149)へ来るアクセスまたは、自サーバから出るアクセスについてパケットキャプチャできるが、
同一セグメントでも他サーバから他サーバへのパケットはキャプチャできない。


■Basic認証とDigest認証のパケット確認
[root@centos65 ~]# tshark -i eth0 port http -V -w packet.log
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
(以下すごい量のログが出るので省略)
上記でキャプチャしている間にPC(192.168.77.2)のブラウザから下記URLにアクセス。
あえて、ID/Passを間違えたうえでログインしてみる。

http://192.168.77.149/basic/
1回目: test/password でログイン失敗。
2回目: basic/password でログイン失敗。
3回目: basic/secret でログイン成功。

http://192.168.77.149/digest/
1回目: test/password でログイン失敗。
2回目: basic/serect でログイン失敗。
3回目: digest/secret でログイン成功。

## ログの確認
[root@centos65 ~]# tshark -r packet.log | head
Running as user "root" and group "root". This could be dangerous.
  1 0.000000000 192.168.77.2 -> 192.168.77.149 TCP 66 51701 > http [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=4 SACK_PERM=1
  2 0.000083000 192.168.77.149 -> 192.168.77.2 TCP 66 http > 51701 [SYN, ACK] Seq=0 Ack=1 Win=14600 Len=0 MSS=1460 SACK_PERM=1 WS=128
  3 0.000397000 192.168.77.2 -> 192.168.77.149 TCP 60 51701 > http [ACK] Seq=1 Ack=1 Win=65700 Len=0
  4 0.000568000 192.168.77.2 -> 192.168.77.149 HTTP 317 GET /basic/ HTTP/1.1
  5 0.000621000 192.168.77.149 -> 192.168.77.2 TCP 54 http > 51701 [ACK] Seq=1 Ack=264 Win=15744 Len=0
  6 0.001667000 192.168.77.149 -> 192.168.77.2 HTTP 782 HTTP/1.1 401 Authorization Required  (text/html)
  7 0.001905000 192.168.77.2 -> 192.168.77.149 TCP 60 51701 > http [ACK] Seq=264 Ack=729 Win=64972 Len=0
  8 0.002000000 192.168.77.149 -> 192.168.77.2 TCP 54 http > 51701 [FIN, ACK] Seq=729 Ack=264 Win=15744 Len=0
  9 0.002114000 192.168.77.2 -> 192.168.77.149 TCP 60 51701 > http [FIN, ACK] Seq=264 Ack=729 Win=64972 Len=0
 10 0.002145000 192.168.77.149 -> 192.168.77.2 TCP 54 http > 51701 [ACK] Seq=730 Ack=265 Win=15744 Len=0
[root@centos65 ~]#
※packet.logファイルはバイナリ型のため、テキストエディタでは開けない。

## ログを詳細確認してパスワードを抽出
[root@centos65 ~]# tshark -r packet.log -V | grep -A 1 "Authorization:"
Running as user "root" and group "root". This could be dangerous.
    Authorization: Basic dGVzdDpwYXNzd29yZA==\r\n
        Credentials: test:password
--
    Authorization: Basic YmFzaWM6cGFzc3dvcmQ=\r\n
        Credentials: basic:password
--
    Authorization: Basic YmFzaWM6c2VjcmV0\r\n
        Credentials: basic:secret
--
    [truncated] Authorization: Digest username="test",realm="DigestAuth",nonce="EAlztCj+BAA=758b7f794981c8331f415d6704fc2a8bb77d83e3",uri="/digest/",cnonce="4430d9ffdb985f4fabaadc433807e111",nc=00000001,algorithm=MD5,response="70f240bec66c111b
    Connection: Keep-Alive\r\n
--
    [truncated] Authorization: Digest username="basic",realm="DigestAuth",nonce="RCu8tCj+BAA=0b496b71af1ce10978af063796f7316a88b0599a",uri="/digest/",cnonce="8cdc61e16b1ed3e79e513fa766a39a14",nc=00000001,algorithm=MD5,response="60a69776af7efe3
    \r\n
--
    [truncated] Authorization: Digest username="digest",realm="DigestAuth",nonce="gkCEtSj+BAA=297f68d0b65f9c6a14eddd0898edd59f1b560a1b",uri="/digest/",cnonce="09fab2b8fd4aae62d30d94e868a5719c",nc=00000001,algorithm=MD5,response="fa704ad0f10213
    Connection: Keep-Alive\r\n
[root@centos65 ~]#
Basic認証は入力されたパスワードが丸見え…。
Digest認証はパスワードが暗号化されているため少しはマシかもしれません。
公開Webサーバに不正にtsharkが仕掛けられないことを祈ります…。


こちらの情報が何かのお役に立てましたら幸いです。サイト継続ご協力のほどお願い致します。m(_ _)m

2014年6月21日土曜日

Basic認証とDigest認証の比較

Basic認証とDigest認証を比較するために環境を作成する手順をまとめます。
パケットキャプチャによりパスワードが取得できるかできないかについては
こちらの記事でまとめたいと思います。


■安全性
Basic認証とは、ユーザ名とパスワードをBase64でエンコードしてAuthorizationヘッダを付加してサーバにリクエストする方式です。
base64エンコードは暗号化ではなくただの符号化ですので、簡単に復号できてしまいます。
一方、Digest認証はユーザ名と暗号化したパスワードを利用するため、ネットワーク上を生パスワードが流れることはありません。
サーバ側に生パスワードを保存する必要がないのもポイントです。盗聴に対してBasic認証よりかはマシと考えられます。
Digest認証はMD5などの脆弱なアルゴリズムを使用します。SSLを使用した通信の暗号化の方が、資格証明の傍受を防ぐには好ましい方法です。


■認証設定ディレクトリ準備
[root@centos65 ~]# mkdir /var/www/html/basic
[root@centos65 ~]# mkdir /var/www/html/digest
[root@centos65 ~]# echo "<h1>/var/www/html/basic/index.html</h1>" > /var/www/html/basic/index.html
[root@centos65 ~]# echo "<h1>/var/www/html/digest/index.html</h1>" > /var/www/html/digest/index.html
[root@centos65 ~]#


■htpasswdファイル準備
## Basic認証用
[root@centos65 ~]# mkdir /etc/httpd/htpasswd
[root@centos65 ~]# htpasswd -bc /etc/httpd/htpasswd/basic.htpasswd basic secret
Adding password for user basic
[root@centos65 ~]# cat /etc/httpd/htpasswd/basic.htpasswd
basic:TrttZUUoY6iEE
[root@centos65 ~]#
※"-b"はパスワードを指定するオプション。

## Digest認証用
[root@centos65 ~]# htdigest -c /etc/httpd/htpasswd/digest.htpasswd DigestAuth digest
Adding password for digest in realm DigestAuth.
New password: ←secret
Re-type new password:
[root@centos65 ~]# cat /etc/httpd/htpasswd/digest.htpasswd
digest:DigestAuth:9d5ce11731e1e06d88aaa030476b5447
[root@centos65 ~]#
realm(領域名)を指定する必要がある。今回は"DigestAuth"とした。


■認証設定ファイル準備
[root@centos65 ~]# vi /etc/httpd/conf.d/auth.conf
[root@centos65 ~]# cat /etc/httpd/conf.d/auth.conf
## for Basic Authentication
<Directory "/var/www/html/basic">
    AuthType Basic
    AuthName "Basic Authentication"
    AuthUserFile /etc/httpd/htpasswd/basic.htpasswd
    Require valid-user
</Directory>

## for Digest Authentication
<Directory "/var/www/html/digest">
    AuthType Digest
    AuthName "DigestAuth"
    AuthUserFile /etc/httpd/htpasswd/digest.htpasswd
    Require valid-user
</Directory>
[root@centos65 ~]#
Digest認証はAuthNameにrealmで指定した値を設定する必要がある。


■httpd.confにモジュールがロードされているか確認
[root@centos65 ~]# grep -e auth_basic -e auth_digest /etc/httpd/conf/httpd.conf
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule auth_digest_module modules/mod_auth_digest.so
[root@centos65 ~]#

## httpd再起動
[root@centos65 ~]# /etc/init.d/httpd restart
httpd を停止中:                                            [  OK  ]
httpd を起動中:                                            [  OK  ]
[root@centos65 ~]#


■認証確認
## Basic認証
http://192.168.77.149/basic/


## Digest認証
http://192.168.77.149/digest/

Basic認証と同じような手順および使い勝手であるので、パスワードをとりあえず暗号化できるDigest認証の方がお勧めかも。


この情報が何かのお役にたてれば幸いです。m(_ _)m

2014年6月8日日曜日

VMwareのOVFファイルをAWSへインポートする手順

VMWareESXi上で動作している仮想マシン(VM)をAWS環境にインポートする手順をまとめます。
今回インポートするVMのOSはCentOS6.5を例としています。インポートできるOSには制限があります。

1) VMWareESXi上のVMをOVFテンプレートのエクスポートでローカルPC等に保存。
2) AWSにてAmazon LinuxのEC2を作成。(Amazon EC2 API Tools がインストール済みだから)
3) 1)のOVFファイル群の中のvmdkファイルを2)で作成したEC2にFTP等でアップロード。
4) 2)のEC2にてec2-import-instanceコマンドでvmdkファイルからEC2を生成。

※keyやIDの値は実際には存在しないものに変更しています。

作業OS: Amazon Linux AMI release 2014.03
インポート対象OS: CentOS 6.5 (64-bit)



■Amazon EC2 API Tools の確認
[ec2-user@amazon-lnx ~]$ ll /opt/aws/apitools/ec2/
total 88
drwxr-xr-x 2 root root 20480 Mar 25 14:59 bin
-rw-r--r-- 1 root root   134 Jan 28 05:48 environment.sh
drwxr-xr-x 2 root root  4096 Mar 25 14:59 lib
-rw-r--r-- 1 root root  4852 Jan 28 05:48 license.txt
-rw-r--r-- 1 root root   539 Jan 28 05:48 notice.txt
-rw-r--r-- 1 root root 46468 Jan 28 05:48 THIRDPARTYLICENSE.TXT
[ec2-user@amazon-lnx ~]$
## 動作確認
[ec2-user@amazon-lnx ~]$ ec2-describe-regions -O AKIAXXXXE2DB7AVDFRE4 -W yXXXXXSKGX0mKsn8oL805DzOlR+rt56Drewi85MEmg
REGION  eu-west-1       ec2.eu-west-1.amazonaws.com
REGION  sa-east-1       ec2.sa-east-1.amazonaws.com
REGION  us-east-1       ec2.us-east-1.amazonaws.com
REGION  ap-northeast-1  ec2.ap-northeast-1.amazonaws.com
REGION  us-west-2       ec2.us-west-2.amazonaws.com
REGION  us-west-1       ec2.us-west-1.amazonaws.com
REGION  ap-southeast-1  ec2.ap-southeast-1.amazonaws.com
REGION  ap-southeast-2  ec2.ap-southeast-2.amazonaws.com
[ec2-user@amazon-lnx ~]$


■VMDKファイルを準備
※.ovfおよび.mfファイルはAWSには取込めないので不要。
[ec2-user@amazon-lnx ~]$ ll /home/ec2-user/cent65-web-disk1.vmdk
-rw-r--r-- 1 ec2-user ec2-user 1644029440 May 23 15:19 /home/ec2-user/cent65-web-disk1.vmdk
[ec2-user@amazon-lnx ~]$


■インポート用シェルスクリプト作成
[ec2-user@amazon-lnx ~]$ cat vmdk_import.sh
#!/bin/bash

ec2-import-instance \
    --region ap-northeast-1 \
    --aws-access-key AKIAXXXXE2DB7AVDFRE4 \
    --aws-secret-key yXXXXXSKGX0mKsn8oL805DzOlR+rt56Drewi85MEmg \
    --instance-type c3.large \
    --group forpublic-sg03 \
    --format VMDK \
    --architecture x86_64 \
    --platform Linux \
    --bucket cloud-bucket05 \
    --owner-akid AKIAXXXXE2DB7AVDFRE4 \
    --owner-sak yXXXXXSKGX0mKsn8oL805DzOlR+rt56Drewi85MEmg \
    --availability-zone ap-northeast-1a \
    --subnet subnet-62ac600b \
    /home/ec2-user/cent65-web-disk1.vmdk

exit 0
[ec2-user@amazon-lnx ~]$
keyはあらかじめ環境変数に設定しておけば指定する必要はありません。
セキュリティーグループを指定しても、なぜかデフォルトグループが設定されます。
インポートできるインスタンスタイプに制限があります。こちらを参考にしてください。
availability-zoneを指定しないと下記のようなエラーに陥る場合があります。
[ec2-user@amazon-lnx ~]$ ./vmdk_import.sh
Requesting volume size: 100 GB
Client.InvalidParameter: Subnet 'subnet-62ac600b' is in the availability zone 'ap-northeast-1a'.
[ec2-user@amazon-lnx ~]$


■インポート実行
[ec2-user@amazon-lnx ~]$ ./vmdk_import.sh
Requesting volume size: 100 GB
TaskType        IMPORTINSTANCE  TaskId  import-i-fg5bb5f2       ExpirationTime  2014-05-30T07:51:01Z    Status  active  StatusMessage  Pending InstanceID      i-cdee1cd4
DISKIMAGE       DiskImageFormat VMDK    DiskImageSize   1644029440      VolumeSize      100       AvailabilityZone        ap-northeast-1c        ApproximateBytesConverted       0       Status  active  StatusMessage   Pending : Downloaded 0
Creating new manifest at cloud-bucket05/106dee24-5fff-4b4d-ac72-96b759e81450/cent65-web-disk1.vmdkmanifest.xml
Uploading the manifest file
Uploading 1644029440 bytes across 157 parts
0% |--------------------------------------------------| 100%
   |==================================================|
Done
Average speed was 7.145 MBps
The disk image for import-i-fg5bb5f2 has been uploaded to Amazon S3
where it is being converted into an EC2 instance.  You may monitor the
progress of this task by running ec2-describe-conversion-tasks.  When
the task is completed, you may use ec2-delete-disk-image to remove the
image from S3.
[ec2-user@amazon-lnxw ~]$
インポート作業中にS3を確認すると、指定したバケットに10MBのファイルがVMDKファイルサイズ分作成されていく。
インポートは成功。マネージメントコンソール上に新たなEC2が表示された。


■インポートしたVMの起動
マネージメントコンソールからstartしたが、下記エラー。
Are you sure you want to start this instance?
i-cdee1cd4 (cent65-web)
Error starting instances
Invalid value 'i-cdee1cd4' for instanceId. Instance does not have a volume attached at root (/dev/sda1)
原因はEBSを準備中に起動しようとしたため。しばらく待てば起動できた。
EC2正常起動完了後は、不要となったS3上のファイルは削除しました。


この情報が何かのお役にたてれば幸いです。m(_ _)m