easy-rsaのcerを作る時"failed to update database TXT_DB error number 2"とか出たら、
commonName*1の値がブッキングしてるなり、不正である可能性があります。
念のため、キーの生成プロセスを最初からやれば確実です。
# cd /etc/openvpn/easy-rsa # ./clean-all # source vars # ./build-ca # ./build-key-server server # ./build-key-pkcs12 client1 # cat keys/server.crt keys/ca.crt > keys/ca_and_server.crt
*1:KEY_CN
前回の続きっぽい話です。
easyrsaと前回の構成をつかてで簡易認証キー付きAPI鯖をつくります
$ cd /etc/openvpn/easy-rsa/ $ sudo su
# mkdir /etc/nginx/easyrsa/keys # cat keys/myservername.crt keys/ca.crt > keys/server_and_ca.crt # cp keys/ca.crt /etc/nginx/easyrsa/keys # cp keys/server_and_ca.crt /etc/nginx/easyrsa/keys # cp keys/myservername.key /etc/nginx/easyrsa/keys
前の記事通り
# ls keys/ 01.pem dh2048.pem index.txt.old myservername.key server_and_ca.crt ca.crt index.txt myservername.crt serial ca.key index.txt.attr myservername.csr serial.old
# nano /etc/nginx/conf.d/ZZZ.conf
# cat /etc/nginx/conf.d/ZZZ.conf
server {
listen 443;
location / {
# Here we define the name and the contents of the WSGI variable to pass to service
uwsgi_param SSL_CLIENT_ID $ssl_client_s_dn;
include uwsgi_params;
uwsgi_pass 127.0.0.1:5000;
}
# SSL support
ssl on;
ssl_protocols SSLv3 TLSv1;
ssl_certificate easyrsa/keys/ca_and_server.crt;
ssl_certificate_key easyrsa/keys/myserver.key;
# We don't accept anyone without correct client certificate
ssl_verify_client on;
# The CA we use to verify client certificates
ssl_client_certificate easyrsa/keys/ca.crt;
}
server {
listen 80;
server_name XXX YYY;
access_log /var/log/nginx/ZZZ.vs.sakura.ne.jp.access.log;
location / {
include uwsgi_params;
uwsgi_pass unix:/var/run/uwsgi/ZZZ.vs.sakura.ne.jp.sock;
}
}# service uwsgi restart # service nginx restart
$ sudo apt install openvpn easy-rsa
$ sudo su # mkdir /etc/openvpn/easy-rsa # cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/ # cp /etc/openvpn/easy-rsa/vars /etc/openvpn/easy-rsa/vars.bak # nano /etc/openvpn/easy-rsa/vars
$ diff /etc/openvpn/easy-rsa/vars /etc/openvpn/easy-rsa/vars.bak 64,69c64,69 < export KEY_COUNTRY="JP" < export KEY_PROVINCE="TOKYO" < export KEY_CITY="Tokyo" < export KEY_ORG="Bye Bye Moore" < export KEY_EMAIL="shuzo1uec@yahoo.com" < export KEY_OU="MyOrg" --- > export KEY_COUNTRY="US" > export KEY_PROVINCE="CA" > export KEY_CITY="SanFrancisco" > export KEY_ORG="Fort-Funston" > export KEY_EMAIL="me@myhost.mydomain" > export KEY_OU="MyOrganizationalUnit"
The easyrsa toolkit is a part of OpenVPN installation. It's possible to use OpenSSL "raw" command or PyOpenSSL, but easyrsa is convenient and suitable at least at the concept stage.
$ cd /etc/openvpn/easy-rsa/ $ source vars NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys
言われた通り
# . /clean-all
秘密鍵を作ります。
# ./build-ca Generating a 2048 bit RSA private key ..............+++ ....................................................................................................................................................................+++ writing new private key to 'ca.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [JP]: State or Province Name (full name) [TOKYO]: Locality Name (eg, city) [Tokyo]: Organization Name (eg, company) [Bye Bye Moore]: Organizational Unit Name (eg, section) [MyOrg]: Common Name (eg, your name or your server's hostname) [Bye Bye Moore CA]: Name [EasyRSA]: Email Address [shuzo1uec@yahoo.com]:
鯖の立ち上げ
# ./build-key-server myservername Generating a 2048 bit RSA private key .....................+++ .......................+++ writing new private key to 'myservername.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [JP]: State or Province Name (full name) [TOKYO]: Locality Name (eg, city) [Tokyo]: Organization Name (eg, company) [Bye Bye Moore]: Organizational Unit Name (eg, section) [MyOrg]: Common Name (eg, your name or your server's hostname) [myservername]: Name [EasyRSA]: Email Address [shuzo1uec@yahoo.com]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:xxx An optional company name []:XXX Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'JP' stateOrProvinceName :PRINTABLE:'TOKYO' localityName :PRINTABLE:'Tokyo' organizationName :PRINTABLE:'Bye Bye Moore' organizationalUnitName:PRINTABLE:'MyOrg' commonName :PRINTABLE:'myservername' name :PRINTABLE:'EasyRSA' emailAddress :IA5STRING:'shuzo1uec@yahoo.com' Certificate is to be certified until Sep 4 14:57:47 2027 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
ディフィー・ヘルマン鍵共有を発行します。
# ./build-dh Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time .....................................................................+..........................+.........................................................................+..........................................................................................................................................................................................................................................................................+..............................................................................................+................................................................................................................................................+......................++*++*
実体を確認しつつ、/etc/openvpnのフォルダに突っ込みます。
# cd keys/ # cp myservername.crt myservername.key ca.crt dh2048.pem /etc/openvpn/
サンプルはこちら
Ruler Demo
<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Ruler Demo</title> <link rel="stylesheet" href="https://unpkg.com/leaflet@1.0.3/dist/leaflet.css" /> <link rel="stylesheet" href="../src/leaflet-ruler.css" /> <script src="https://unpkg.com/leaflet@1.0.0/dist/leaflet.js"></script> <script src="../src/leaflet-ruler.js"></script> <style> #map { height: 650px; } .body { background-color: gainsboro} </style> </head> <body class="body"> <div class="head"> <h1><a href="https://github.com/gokertanrisever/leaflet-ruler">leaflet-ruler</a> plugin demo</h1> </div> <div id="map"></div> <script type="text/javascript"> var map = L.map('map').setView([41.04, 29.03], 11); L.tileLayer('http://{s}.tile.osm.org/{z}/{x}/{y}.png', { attribution: '© <a href="http://osm.org/copyright">OpenStreetMap</a> contributors' }).addTo(map); L.control.ruler().addTo(map); </script> </body> </html>
穴を適当にあけます。
ここのサイズは後で調整できるので適切に。
次にネジで内経を決定。
色々規格があるので、必要なものを選びましょう。
終わると、こんな感じで
剛性グループを指定すると、別々のコンポネントを一括で移動できるようになります。
装飾のようなものから、一時的に同一で動かしたいようなモノまで色々と利用できます。
こんなの構成だったとします。
アセンブリの剛体グループを選びます
例のごとく、オブジェクトを選択する形式です。
ジョイントのアニメーションだと、旋回部だけ動きますが
モデルのアニメーションでは剛体モデルごと動きます
ジョイントの項目に剛体モデルが表示されてます。
こいつを消してあげれば良いのです。
アニメーションの例のように、剛体を指定すると一緒に動きます。
一時的に関係を切りたい場合、「抑制」をつかいます。
設定が済めば、グレーアウトします。
復旧する時も同じ手順です。
