Mot cach don gian de redirect destination ip address

1. Su dung tinh nang nat cua iptables
e.g. $ sudo iptables -t nat -A OUTPUT -i eth0 -d google.com -j DNAT --to-destination vnexpress.net

nhu vay thay vi ket noi den google, may tinh se ket noi den vnexpress.net

2. Cach flush table da dung de nat truoc do
- sudo iptables -t -nat -F       ---> xoa tat ca
- sudo iptables -t nat -D OUTPUT -d google.com -j DNAT --to-destination vnexpress.net

3. Redirect tren server linux dang dung
iptables -t nat -A PREROUTING -i eth0 -d 74.125.235.66 -j DNAT --to-destination 123.30.129.148

NAT vs IP Masquerade

source: http://www.bglug.ca/articles/nat_and_ip_masquerade.pdf

Sử dụng BibTex trong Latex để add references

Source: http://www.tex.ac.uk/cgi-bin/texfaq2html?label=usebibtex
1. BibTeX bibliography (đuôi file .bib), file .bib nên để cùng thư mục với file source code latex, cấu trúc file ví dụ như sau:

@article{Aggrarwal2007,
author = {V. Aggarwal and A. Feldmann and C. Scheideler},
title = {Can ISPs and P2P users cooperate for improved performance?},
journal = {ACM SIGCOMM Comput. Commun. Rev.},
volume = {37},
number = {3},
pages = {29-40},
month = {July},
year = {2007}
}


@inproceedings {Seedorf2009,
author={J. Seedorf and S.Kiesel and M.Stiemerling},
title = {Traffic localization for P2P-applications: the ALTO apprach},
booktitle = {IEEE Int. Conf. Peer-to-Peer Comput. (P2P2009)},
pages = {171-177},
month = {Sept.},
year = {2009}
}

article cho journal và inproceedings cho conferences

2. Trong file source latex cần có các lệnh cite và gọi đến bibtex

ví dụ:
~\cite{Aggarwal2007}

\bibliographystyle{plain}

\bibliography{HiephvBibAll}

--> Chú ý thay plain bằng file format của hội thảo hoặc tạp chí tương ứng

3. Dịch file source code latex

latex myfile

As LaTeX processes the file, the \bibliographystyle command writes a note of the style to the .aux file; each \cite command writes a note of the citation to the .aux file, and the \bibliography command writes a note of which .bib file is to be used, to the .aux file.

Note that, at this stage, LaTeX isn’t “resolving” any of the citations: at every \cite command, LaTeX will warn you of the undefined citation, and when the document finishes, there will be a further warning of undefined references.



4. Chạy lệnh bibtex


bibtex myfile

BibTeX will scan the .aux file; it will find which bibliography style it needs to use, and will “compile” that style; it will note the citations; it will find which bibliography files it needs, and will run through them matching citations to entries in the bibliography; and finally it will sort the entries that have been cited (if the bibliography style specifies that they should be sorted), and outputs the resulting details to a .bbl file.

5. Chạy Latex một lần nữa
you run LaTeX again. It warns, again, that each citation is (still) undefined, but when it gets to the \bibliography command, it finds a .bbl file, and reads it. As it encounters each \bibitem command in the file, it notes a definition of the citation.


6. Chạy Latex một lần nữa
you run LaTeX yet again. This time, it finds values for all the citations, in its .aux file. Other things being equal, you’re done… until you change the file.

Chú ý về các phần mềm P2P

1. PPStream cần có loa để chạy???

Khi application dectect ko có thiết bị audio nào --> sẽ không chạy cả video
2. PPTV không chỉ phụ thuộc vào peerlist --> có nhiều default server, và video traffic không phải lúc nào cũng là udp
3. SopCast: hide the peer list, thường SopCast cũng chỉ trao đổi dữ liệu với 4, hoặc 5 peers --> hơi ít
4. Zattoo chỉ hỗ trợ các host trong domain EU

Chạy framework p2p_localization

1. Di chuyển đến thư mục chứa file chạy: p2p_localization_frw
cd /home/hiephv/workspace/p2p_localization_frw/Debug

2. Chạy lệnh

./p2p_localization_frw param1 param2 param3 param4

- param1: tên cạc mạng (ví dụ: eth1)

- param2: phương pháp áp dụng
0: adding delay
1: packet loss
2: limited bandwidth

- param3: tham số tương ứng với phương pháp
+ adding delay: thì là thời gian delay (ms): ví dụ: 1000ms
+ packet loss: thì là tỷ lệ packet loss (%): ví dụ: 0.2
+ limited bandwidth: thì là băng thông tối đa cho phép

-param4: mode áp dụng
0: bi-direction (cả download và upload)
1: download only
2: upload only


ví dụ lệnh hoàn chỉnh: ./p2p_localization_frw eth1 0 500 0

Peerlist modification framework

Để chạy framework Peerlist modification

1. Đăng nhập quyền root
(Vì phải gọi nhiều hàm can thiệp đến hệ thống nên cần có quyền root)

2. Sửa lại #define để chạy với những phần mềm khác nhau
#define PPTV
#define PPStream
#define PPLive

Chú ý: hiện tại đang cài đặt 2 phương pháp
1. Peer list packet modification
2. Video request packet redirection

Để chạy theo phương pháp 1 thêm dấu comment
Chuyển #define REDIRECTION 1 --> //#define REDIRECTION 1 trong main file và trong PPStream.c file

Để chạy theo phương pháp 2, bỏ dấu comment
Chuyển //#define REDIRECTION 1 --> #define REDIRECTION 1 trong main file và trong PPStream.c file

3. Chú ý là khi dừng chương trình peer list modification giữa chừng thì mạng của máy measurement sẽ mất (do các gói tin từ eth0 sang eth1 và ngược lại đang được đẩy vào QUEUE)

4. Một vấn đề nữa là có vẻ libipq được cài từ gói iptables-dev conflict với dummynet nên nếu đang chạy peer list modification thì không insert mod cho file ipfw_mod.ko được. Và ngược lại nếu insert mod cho file ipfw_mod.ko vào trước thì không chạy được chương trình peerlist modifications nữa


Tạm thời: để chạy peer list modification, trướt hết remove ipfw_mod
lệnh: rmmod ipfw_mod

Cumulative distribution function of download time

Định nghĩa về CDF (cumulative distribution function) xem tại đây:
http://en.wikipedia.org/wiki/Cumulative_distribution_function

Nếu rời rạc hóa trục thời gian, và coi dung lượng down được tại các thời điểm là xác suất của biễn ngẫu nhiên X tại thời điểm đó thì CDF của download time sẽ phản ánh tốc độ download. CDF càng dốc đứng chứng tỏ tốc độ download càng nhanh và ngược lại

Cai dat x264 - ffmpeg - psnr-tools

2 link tham khao:
- http://ffmpeg.org/trac/ffmpeg/wiki/UbuntuCompilationGuide
- http://imedia.disi.unitn.it/QoE/

1. x264
Download:

git clone --depth 1 git://git.videolan.org/x264

(Hoac lay truc tiep tren trang videolan.org)

Cai dat:

cd x264

./configure --enable-shared 

(chu y mac dinh file configure cua x264 la disable-shared, do do khi ffmpeg goi mot so ham theo kieu lien ket dong se ko goi duoc) 

make

sudo make install (thuong duong dan mac dinh se o /usr/local/include/x264.h va /usr/local/lib/libx264*)

2. fdk-aac

Download: 

git clone --depth 1 git://github.com/mstorsjo/fdk-aac.git

(Hoac lay truc tiep o day: ftp://ftp.videolan.org/pub/x264/snapshots/last_x264.tar.bz2)

Cai dat:

autoreconf -fiv (chay lenh nay truoc vi fdk-aac chua sinh file configuration)

./configuration

make 

sudo make install

3. libvpx

Download:
git clone --depth 1 http://git.chromium.org/webm/libvpx.git

(Hoac lay truc tiep o day: http://code.google.com/p/webm/downloads/list) 

Cai dat:

./configure

make

sudo make install

4. ffmpeg

Download: Chu y can download dung goi ffmpeg for psnr-tools 

(neu lech phien ban se thieu nhieu ham ma psnr-tools goi)

wget http://imedia.disi.unitn.it/QoE/ffmpeg-for-psnrtools.tgz

tar xvfz ffmpeg-for-psnrtools.tgz 

Cai dat:

./configure --enable-gpl --enable-libfaac --enable-libfdk-aac --enable-libmp3lame \
  --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-librtmp --enable-libtheora \
  --enable-libvorbis --enable-libvpx --enable-x11grab --enable-libx264 --enable-nonfree \
  --enable-version3

--> se xuat hien ra nhieu loi trong do co loi libx264 not found; 

(Nguyen nhan la do version cua ffmpeg va x264 khong tuong ung voi nhau

Rat nhieu ham ffmpeg goi tu x264, nhung ban x264 lastest khong co hoac da sua ten ham)

Khac phuc:

b1. Mo file configure cua ffmpeg, xem ffmpeg dang require nhung thu vien nao va ham nao trong thu vien do

vd:  require  libx264 x264.h x264_encoder_open -lx264 -lm

b2. Kiem tra lai ten ham dung trong x264 dang dinh nghia

lenh: nm /usr/local/lib/libx264.a | grep x264_encoder_open

ket qua: 0000000000007b10 T x264_encoder_open_128

(Co nghia la ham nay da duoc implement trong x264 nhung ten la x264_encoder_open_128)

b3. Mo lai file configure cua ffmpeg va sua lai ham x264_encoder_open --> x264_encoder_open_128

Luc nay bien dich lai se khong con loi x264 not found nua nhung xuat hien them vo so loi khac

(Nguyen nhan mot so ham trong x264 da thay doi interface, co 2 cach khac phuc: hoac la sua code x264

hoac sua code ffmpeg; o day toi chon sua code ffmpeg vi se de sua hon)

File can sua code:

- libavcodec/libx264.c:

Doan code cu: 

if(x264_nal_encode(x4->sei, &x4->sei_size, 1, nals + i) < 0)

    return -1;

==> sua lai nhu sau: (do x264 define ham x264_nal_encode chi co 3 tham so)

x264_nal_encode(x4->sei, &x4->sei_size, nals + i);

if(nals + i < 0) return -1;

Bay gio bien dich se het loi (khong nho la minh con sua loi nao o ffmpeg nua ko :)

5. psnr-tools

download: 

git clone http://brenta.disi.unitn.it/~kiraly/PublicGits/psnr-tools.git

Cai dat: (psnr-tools khong tao bo cai theo autoconfig tool nen khong co file configure

chi can chay thang lenh make; chu y trong Makefile cuar psnr-tools co su dung bien FFDIR;

can chinh cho FFDIR tro dung den thu muc ffmpeg va x264 tren may cua minh)

make FFDIR=$PWD/../ffmpeg/ X264DIR=$PWD/../x264/ 

--> se sinh ra vo so loi

(Nguyen nhan khong hieu tai sao Makefile cua psnr-tools link thieu rat nhieu thu vien???; 

luu y Makefile ngoai thu muc psnr-tools chi goi den Makefile trong cac thu muc con

--> can phai sua Makefile cua cac thu muc con; cu the: Analyser/Makefile)

Chi thi bien dich ban dau:

LDLIBS = -lavformat -lavcodec -lavutil

sua them nhu sau:(de ra them duoc cac lib cho dung thi can bien dich, 

co loi lai tim xem ham nao khong reference duoc nam trong thu vien nao) 

LDLIBS = -lavformat -lavcodec -lavutil -lfaac -lfdk-aac -lmp3lame -lopencore-amrnb 

-lopencore-amrwb -ltheora -ltheoradec -ltheoraenc -lvorbis -lvorbisenc -lvpx -lx264 -lrtmp

Chu y: vd voi chi thi bien dich -lavformat --> ban chat trinh dich se tim thu vien 

libavformat.a (hoac khi chay chuong trinh se goi ham trong libavformat.so) 

trong mot trong cac thu muc mac dinh sau: /usr/local/lib; /usr/lib/; /lib/

--> mot so thu vien mac du da cai roi nhung nam trong /usr/lib/x86_64-linux-gnu/ 

(so di nam o day la vi cai bang apt-get install)

can duoc  copy den cac thu muc mac dinh (hoac chuan nhat la tao symbolic link)

lenh: ln ...

Luc nay make se OK

psnr-tools Makefile khong ho tro make install --> co the viet them vao make file hoac copy

bang tay nhung file chay can thiet den /usr/local/bin hoac /usr/sbin de co the chay tu bat 

ky dau

(con cap nhat...)

Intall ffmpeg with x264 encoder

https://ffmpeg.org/trac/ffmpeg/wiki/UbuntuCompilationGuide

Một số lệnh hữu hiệu trong linux

1. Lệnh tìm nội dung nào đó trong toàn bộ thư mục

$ grep [-r] "noidung" */*

2. Xem các cổng đang lắng nghe các dịch vụ

$ netstat -lnp

3. Đổi địa chỉ MAC

# ifconfig wlan0 down
# ifconfig wlan0 hw ether 00:90:CC:FB:53:9C
# ifconfig wlan0 up

..continue...

Cài đặt ubuntu based router

https://help.ubuntu.com/community/Router

Enable and disable IP forwarding ont the fly (dont need to restart computer)

echo 1 >  /etc/sys/net/ipv4/ip_forward
echo 0 >  /etc/sys/net/ipv4/ip_forward

Cài đặt eclipse IDE cho C/C++ trên linux ubuntu 10.04

0. Prerequires
- sudo apt-get install g++

1. Cài đặt eclipse IDE
sudo apt-get update
sudo apt-get install eclipse

2. Cài đặt CDT
Chạy Eclipse, chọn Help/Install new software
Click Add, sau đó nhập:
- Name: CDT
- Location: http://download.eclipse.org/tools/cdt/releases/galileo
Trong CDT main-feature chọn Eclipse C/C++

OK

P2P Peer list request

Giai đoạn khởi tạo của Sopcast

1. Kết nối đến server http://60.217.236.133/client/?350 để lấy về phần nội dung trong trang home

Cài đặt Dummynet cho linux

source: http://ubuntuforums.org/showthread.php?t=1337587
Dummynet là gói phần mềm chạy trên hệ điều hành FreeBSD. Tuy nhiên Dummynet vẫn có hỗ trợ bộ cài cho Linux và Windows

Dummynet dùng để mô phỏng việc thiết lập packet queuing, bandwidth limitation, delays, packet loss...

Cài đặt trên linux ubuntu.

1. Cần biết version kernel hiện tại của ubuntu mình đang dùng

Lệnh: uname -r

2. Có thể cần cài đặt linux-header tương ứng

Lệnh: sudo apt-get install linux-header-3.2.0-27-generic
(Chú ý thay 3.2.0-27-generic bằng version hiện tại đang cài lấy được từ lệnh uname -r ở trên)

3. download source code dummynet từ trang chủ

Lệnh: wget http://info.iet.unipi.it/~luigi/doc/20120812-ipfw3.tgz

4. Giải nén vào một thư mục nào đó

Lệnh: tar xvfz  0120812-ipfw3.tgz

5. Chuyển đến thư mục ipfw3-2012 chạy lệnh make

Lệnh: make KERNELPATH=/lib/modules/3.2.0-27-generic/build USRDIR=/usr

6. Sau khi chạy lệnh make sẽ có 2 file quan trọng được sinh ra:
+ ipfw nằm trong ./ipfw/ipfw ==> copy vào /usr/sbin
+ ipfw_mod.ko nằm trong ./ipfw-mod/ipfw_mod.ko ==> chạy lệnh insmod ipfw_mode.ko

7. Để sau khi reboot dummynet tự load thì vào file /etc/modules thêm dòng: ipfw_mod vào cuối là được

libpcap tutorial

Link to libpcap tutorial: http://www.tcpdump.org/pcap.htm

Các papers đáng lưu ý

1. Papers của prof Miyoshi
2. Msc Thesis Measurement study of the P2PTV applications Sopcast

3. Improving Traffic Locality in Bitorrent via Biased Neighbor Selection
Tư tưởng chính của paper:
- Số peers mà tracker trong bittorent trả về cho mỗi peer khi request default là 50, sau đó peer sẽ chọn maximum là 35 peer để tiến hành request dữ liệu cần download.
- Thường thì 35 peer này có thể chọn một cách random, paper propose rằng trong 35 peer này sẽ khống chế chỉ cho K peer là được chọn ngoài AS; như vậy số peer chọn trong cùng một AS sẽ là 35-K

4. Can ISP and P2P Users Cooperate for Improved Performance
5. Dissecting PPLive Sopcast TVants
6. A measurement study of PPStream

7. Locality prediction for oblivious clients
Tư tưởng chính của bài:
Sử dụng cordinate system để estimate RTT giữa hai peer với nhau từ đó giúp việc predict RTT của các peer đến các peer khác nhanh hơn và không phụ thuộc vào underlay network

Một số tool dùng cho Networking

1. Packet tracer
2. IGEN topology generator
3. Wireshark

Một số lệnh dùng cho Networking

1. Ping: sử dụng kiểm tra kết nối
- Gửi gói tin ICMP echo request
- Bên Nhận trả về ICMP echo reply
2. tracert
3. nslookup
4. netstat

Một số thuật ngữ của Networking

1. AS: autonomous system
2. ISP: Internet Service Provider
3. MTU: Kích thước đơn vị dữ liệu tối đa (maximum transmission unit): nằm trong header của gói tin IP
4. ICMP: Internet Control Message Protocol: hoạt động ở tầng mạng (IP)
- Báo lỗi gói tin không đến đích
- Thông điệp phản hồi
5. RTT: round-trip time: tổng thời gian đi và về
6. TTL: Time to live: thời gian sống của gói tin
7. IGP: interior gateway protocol (giao thức trọn đường nội vùng, bên trong AS), có thể bao gổm:
- RIP: Routing information protocol
- OSPF: Open shortest path first
- IS-IS, IGRP, EIGRP
8. EGP: Exterior gateway protocol (giao thức chọn đường liên vùng)
- BGP: border gateway protocol

                                                         (source: Ngô Hồng Sơn - HUST)

Autonomous System (Network)

AS (hệ tự trị) AS is:
- Collection of IP network, or more precisely, the routers that joining those network

• Under the same administrative authority
• Share a common routing policy (strategy)

- On internet, AS may be Internet service provider (ISP), but universities, research institutes, and private organizations also have their own ASes

- Each AS has an identify

Peer-to-peer

1. Peer-to-peer can divide into 2 types
- Structured p2p
By far the most common type of structured P2P network is the distributed hash table (DHT).  There are many system using DHT technical including  Bittorent tracker, he Kad network, the Storm botnet, YaCy, and the Coral Content Distribution Network.

- Unstructured p2p
Ex. Gnutela

Ubuntu: Cài đặt cho window buttons sang bên phải

Ubuntu khi mới cài ra sẽ có giao diện các button: minimize, maximize, close ở bên tay trái (hơi ngược so với windows). Để cài đặt lại giao diện giống Windows làm như sau:

b1. Chạy gconf-editor
b2. Mở nội dung apps/metacity/general/button_layout
b3. Thay nội dung mới: menu:minimize,maximize,close

Enable https in apache (server linux)

File cấu hình của apache  trong linux thường ở: /etc/httpd/conf
1. Copy các file *.crt; *.key, ca-bundle.crt vào các thư mục trong ssl.crt và ssl.key tương ứng

2. Chỉnh file cấu hình httpd-ssl.conf trong thư mục /etc/httpd/conf/extra/
Chú ý các mục:
- ServerName: tên server của bạn (ví dụ: localhost)
- SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt : trỏ đến file public key crt tương ứng
- SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key: trỏ đến file private key tương ứng
- SSLCACertificateFile /etc/httpd/conf/ssl.crt/ca-bundle.crt: trỏ đến file CA tương ứng

3. Chỉnh file php.ini; xem phpinfo() để biết chính xác file php.ini cần sửa (thường sẽ ở: usr/local/lib)
bỏ dấu ; hoặc thêm dòng: extension=php-openssl.dll



4. Alias một tên đến thư mục chứa web nếu cần
(ví dụ: Alias gxd /home/gxd)


5. Restart apacher service:
sudo /etc/init.d/httpd restart

RSA management

source: http://openvpn.net/index.php/open-source/documentation/miscellaneous/77-rsa-key-management.html

RSA Key Management

This is a small RSA key management package,
based on the openssl command line tool, that
can be found in the easy-rsa subdirectory
of the OpenVPN distribution.

These are reference notes.  For step
by step instructions, see the HOWTO:

http://openvpn.net/howto.html

INSTALL

1. Edit vars.
2. Set KEY_CONFIG to point to the openssl.cnf file
   included in this distribution.
3. Set KEY_DIR to point to a directory which will
   contain all keys, certificates, etc.  This
   directory need not exist, and if it does,
   it will be deleted with rm -rf, so BE
   CAREFUL how you set KEY_DIR.
4. (Optional) Edit other fields in vars
   per your site data.  You may want to
   increase KEY_SIZE to 2048 if you are
   paranoid and don't mind slower key
   processing, but certainly 1024 is
   fine for testing purposes.  KEY_SIZE
   must be compatible across both peers
   participating in a secure SSL/TLS
   connection.
5  . vars
6. ./clean-all
7. As you create certificates, keys, and
   certificate signing requests, understand that
   only .key files should be kept confidential.
   .crt and .csr files can be sent over insecure
   channels such as plaintext email.
8. You should never need to copy a .key file
   between computers.  Normally each computer
   will have its own certificate/key pair.

BUILD YOUR OWN ROOT CERTIFICATE AUTHORITY (CA) CERTIFICATE/KEY

1. ./build-ca
2. ca.crt and ca.key will be built in your KEY_DIR
   directory

BUILD AN INTERMEDIATE CERTIFICATE AUTHORITY CERTIFICATE/KEY (optional)

1. ./build-inter inter
2. inter.crt and inter.key will be built in your KEY_DIR
   directory and signed with your root certificate.

BUILD DIFFIE-HELLMAN PARAMETERS (necessary for
the server end of a SSL/TLS connection).

1. ./build-dh

BUILD A CERTIFICATE SIGNING REQUEST (If
you want to sign your certificate with a root
certificate controlled by another individual
or organization, or residing on a different machine).

1. Get ca.crt (the root certificate) from your
   certificate authority.  Though this
   transfer can be over an insecure channel, to prevent
   man-in-the-middle attacks you must confirm that
   ca.crt was not tampered with.  Large CAs solve this
   problem by hardwiring their root certificates into
   popular web browsers.  A simple way to verify a root
   CA is to call the issuer on the telephone and confirm
   that the md5sum or sha1sum signatures on the ca.crt
   files match (such as with the command: "md5sum ca.crt").
2. Choose a name for your certificate such as your computer
   name.  In our example we will use "mycert".
3. ./build-req mycert
4. You can ignore most of the fields, but set
   "Common Name" to something unique such as your
   computer's host name.  Leave all password
   fields blank, unless you want your private key
   to be protected by password.  Using a password
   is not required -- it will make your key more secure
   but also more inconvenient to use, because you will
   need to supply your password anytime the key is used.
   NOTE: if you are using a password, use ./build-req-pass
   instead of ./build-req
5. Your key will be written to $KEY_DIR/mycert.key
6. Your certificate signing request will be written to
   to $KEY_DIR/mycert.csr
7. Email mycert.csr to the individual or organization
   which controls the root certificate.  This can be
   done over an insecure channel.
8. After the .csr file is signed by the root certificate
   authority, you will receive a file mycert.crt
   (your certificate).  Place mycert.crt in your
   KEY_DIR directory.
9. The combined files of mycert.crt, mycert.key,
   and ca.crt can now be used to secure one end of
   an SSL/TLS connection.

SIGN A CERTIFICATE SIGNING REQUEST

1. ./sign-req mycert
2. mycert.crt will be built in your KEY_DIR
   directory using mycert.csr and your root CA
   file as input.

BUILD AND SIGN A CERTIFICATE SIGNING REQUEST
USING A LOCALLY INSTALLED ROOT CERTIFICATE/KEY -- this
script generates and signs a certificate in one step,
but it requires that the generated certificate and private
key files be copied to the destination host over a
secure channel.

1. ./build-key mycert (no password protection)
2. OR ./build-key-pass mycert (with password protection)
3. OR ./build-key-pkcs12 mycert (PKCS #12 format)
4. OR ./build-key-server mycert (with nsCertType=server)
5. mycert.crt and mycert.key will be built in your
   KEY_DIR directory, and mycert.crt will be signed
   by your root CA. If ./build-key-pkcs12 was used a
   mycert.p12 file will also be created including the
   private key, certificate and the ca certificate.

IMPORTANT

To avoid a possible Man-in-the-Middle attack where an authorized
client tries to connect to another client by impersonating the
server, make sure to enforce some kind of server certificate
verification by clients.  There are currently four different ways
of accomplishing this, listed in the order of preference:

(1) Build your server certificates with the build-key-server
    script.  This will designate the certificate as a
    server-only certificate by setting nsCertType=server.
    Now add the following line to your client configuration:
      
    ns-cert-type server

    This will block clients from connecting to any
    server which lacks the nsCertType=server designation
    in its certificate, even if the certificate has been
    signed by the CA which is cited in the OpenVPN configuration
    file (--ca directive).

(2) Use the --tls-remote directive on the client to
    accept/reject the server connection based on the common
    name of the server certificate.

(3) Use a --tls-verify script or plugin to accept/reject the
    server connection based on a custom test of the server
    certificate's embedded X509 subject details.

(4) Sign server certificates with one CA and client certificates
    with a different CA.  The client config "ca" directive should
    reference the server-signing CA while the server config "ca"
    directive should reference the client-signing CA.

NOTES

Show certificate fields:
  openssl x509 -in cert.crt -text

---

easy-rsa/vars

# easy-rsa parameter settings

# NOTE: If you installed from an RPM,
# don't edit this file in place in
# /usr/share/openvpn/easy-rsa --
# instead, you should copy the whole
# easy-rsa directory to another location
# (such as /etc/openvpn) so that your
# edits will not be wiped out by a future
# OpenVPN package upgrade.

# This variable should point to
# the top level of the easy-rsa
# tree.
export D=`pwd`

# This variable should point to
# the openssl.cnf file included
# with easy-rsa.
export KEY_CONFIG=$D/openssl.cnf

# Edit this variable to point to
# your soon-to-be-created key
# directory.
#
# WARNING: clean-all will do
# a rm -rf on this directory
# so make sure you define
# it correctly!
export KEY_DIR=$D/keys

# Issue rm -rf warning
echo NOTE: when you run ./clean-all, I will be doing a rm -rf on $KEY_DIR

# Increase this to 2048 if you
# are paranoid.  This will slow
# down TLS negotiation performance
# as well as the one-time DH parms
# generation process.
export KEY_SIZE=1024

# These are the default values for fields
# which will be placed in the certificate.
# Don't leave any of these fields blank.
export KEY_COUNTRY=KG
export KEY_PROVINCE=NA
export KEY_CITY=BISHKEK
export KEY_ORG="OpenVPN-TEST"
export KEY_EMAIL="me@myhost.mydomain"

---

easy-rsa/clean-all

#!/bin/sh

#
# Initialize the $KEY_DIR directory.
# Note that this script does a
# rm -rf on $KEY_DIR so be careful!
#

d=$KEY_DIR

if test $d; then
 rm -rf $d
 mkdir $d && \
 chmod go-rwx $d && \
 touch $d/index.txt && \
 echo 01 >$d/serial
else
 echo you must define KEY_DIR
fi

---

easy-rsa/build-dh

#!/bin/sh

#
# Build Diffie-Hellman parameters for the server side
# of an SSL/TLS connection.
#

if test $KEY_DIR; then
    openssl dhparam -out ${KEY_DIR}/dh${KEY_SIZE}.pem ${KEY_SIZE}
else
    echo you must define KEY_DIR
fi

---

easy-rsa/build-ca

#!/bin/sh

#
# Build a root certificate
#

if test $KEY_DIR; then
 cd $KEY_DIR && \
 openssl req -days 3650 -nodes -new -x509 -keyout ca.key -out ca.crt -config $KEY_CONFIG && \
        chmod 0600 ca.key
else
 echo you must define KEY_DIR
fi

---

easy-rsa/build-inter

#!/bin/sh

#
# Make an intermediate CA certificate/private key pair using a locally generated
# root certificate.
#

if test $# -ne 1; then
        echo "usage: build-inter <name>";
        exit 1
fi                                                                             

if test $KEY_DIR; then
 cd $KEY_DIR && \
 openssl req -days 3650 -nodes -new -keyout $1.key -out $1.csr -config $KEY_CONFIG && \
 openssl ca -extensions v3_ca -days 3650 -out $1.crt -in $1.csr -config $KEY_CONFIG
else
 echo you must define KEY_DIR
fi

---

easy-rsa/build-key

#!/bin/sh

#
# Make a certificate/private key pair using a locally generated
# root certificate.
#

if test $# -ne 1; then
        echo "usage: build-key <name>";
        exit 1
fi                                                                             

if test $KEY_DIR; then
 cd $KEY_DIR && \
 openssl req -days 3650 -nodes -new -keyout $1.key -out $1.csr -config $KEY_CONFIG && \
 openssl ca -days 3650 -out $1.crt -in $1.csr -config $KEY_CONFIG && \
 chmod 0600 $1.key
else
 echo you must define KEY_DIR
fi

---

easy-rsa/build-key-pass

#!/bin/sh

#
# Similar to build-key, but protect the private key
# with a password.
#

if test $# -ne 1; then
        echo "usage: build-key-pass <name>";
        exit 1
fi

if test $KEY_DIR; then
 cd $KEY_DIR && \
 openssl req -days 3650 -new -keyout $1.key -out $1.csr -config $KEY_CONFIG && \
 openssl ca -days 3650 -out $1.crt -in $1.csr -config $KEY_CONFIG && \
 chmod 0600 $1.key
else
 echo you must define KEY_DIR
fi

---

easy-rsa/build-req

#!/bin/sh

#
# Build a certificate signing request and private key.  Use this
# when your root certificate and key is not available locally.
#

if test $# -ne 1; then
    echo "usage: build-req <name>";
    exit 1
fi                                                                             

if test $KEY_DIR; then
    cd $KEY_DIR && \
    openssl req -days 3650 -nodes -new -keyout $1.key -out $1.csr -config $KEY_CONFIG
else
    echo you must define KEY_DIR
fi

---

easy-rsa/build-req-pass

#!/bin/sh

#
# Like build-req, but protect your private key
# with a password.
#

if test $# -ne 1; then
    echo "usage: build-req-pass <name>";
    exit 1
fi                                                                             

if test $KEY_DIR; then
    cd $KEY_DIR && \
    openssl req -days 3650 -new -keyout $1.key -out $1.csr -config $KEY_CONFIG
else
    echo you must define KEY_DIR
fi

---

easy-rsa/sign-req

#!/bin/sh

#
# Sign a certificate signing request (a .csr file)
# with a local root certificate and key.
#

if test $# -ne 1; then
        echo "usage: sign-req <name>";
        exit 1
fi                                                                             

if test $KEY_DIR; then
 cd $KEY_DIR && \
 openssl ca -days 3650 -out $1.crt -in $1.csr -config $KEY_CONFIG
else
 echo you must define KEY_DIR
fi

Encrypt password

Source: http://www.php.net/manual/en/faq.passwords.php#faq.passwords.fasthash

Safe Password Hashing

This section explains the reasons behind using hashing functions to secure passwords, as well as how to do so effectively.

1. Why should I hash passwords supplied by users of my application?
2. Why are common hashing functions such as md5 and sha1 unsuitable for passwords?
3. How should I hash my passwords, if the common hash functions are not suitable?
4. What is a salt?

Why should I hash passwords supplied by users of my application?

Password hashing is one of the most basic security considerations that must be made when designing any application that accepts passwords from users. Without hashing, any passwords that are stored in your application's database can be stolen if the database is compromised, and then immediately used to compromise not only your application, but also the accounts of your users on other services, if they do not use unique passwords.

By applying a hashing algorithm to your user's passwords before storing them in your database, you make it implausible for any attacker to determine the original password, while still being able to compare the resulting hash to the original password in the future.

It is important to note, however, that hashing passwords only protects them from being compromised in your data store, but does not necessarily protect them from being intercepted by malicious code injected into your application itself.

Why are common hashing functions such as md5() and sha1() unsuitable for passwords?

Hashing algorithms such as MD5, SHA1 and SHA256 are designed to be very fast and efficient. With modern techniques and computer equipment, it has become trivial to "brute force" the output of these algorithms, in order to determine the original input.

Because of how quickly a modern computer can "reverse" these hashing algorithms, many security professionals strongly suggest against their use for password hashing.

How should I hash my passwords, if the common hash functions are not suitable?

When hashing passwords, the two most important considerations are the computational expense, and the salt. The more computationally expensive the hashing algorithm, the longer it will take to brute force its output.

There are two functions that are bundled with PHP that can perform hashing using a specified algorithm.

The first hashing function is crypt(), which natively supports several hashing algorithms. When using this function, you are guaranteed that the algorithm you select is available, as PHP contains native implementations of each supported algorithm, in case one or more are not supported by your system.

The second hashing function is hash(), which supports many more algorithms and variants than crypt(), but does not support some algorithms thatcrypt() does. The Hash extension is bundled with PHP, but can be disabled during compile-time, so it is not guaranteed to be available, while crypt() is, being in the PHP core.

The suggested algorithm to use when hashing passwords is Blowfish, as it is significantly more computationally expensive than MD5 or SHA1, while still being scalable.

What is a salt?

A cryptographic salt is data which is applied during the hashing process in order to eliminate the possibility of the output being looked up in a list of pre-calculated pairs of hashes and their input, known as a rainbow table.

In more simple terms, a salt is a bit of additional data which makes your hashes significantly more difficult to crack. There are a number of services online which provide extensive lists of pre-computed hashes, as well as the original input for those hashes. The use of a salt makes it implausible or impossible to find the resulting hash in one of these lists.