Shulou(Shulou.com)06/01 Report--

Mysql Audit tool archery

System: Centos6.8

Ip:192.168.122.150

Install Python and virtualenv

Compilation and installation

[root@www ~] # yum install wget gcc make zlib-devel openssl openssl-devel

[root@www src] # wget "https://www.python.org/ftp/python/3.6.5/Python-3.6.5.tar.xz"

[root@www src] # tar-xvf Python-3.6.5.tar.xz

[root@www src] # cd Python-3.6.5

[root@www Python-3.6.5] #. / configure prefix=/usr/local/python3

[root@www Python-3.6.5] # make & & make install

[root@www Python-3.6.5] # ln-fs / usr/local/python3/bin/python3 / usr/bin/python3

[root@www Python-3.6.5] # ln-fs / usr/local/python3/bin/pip3 / usr/bin/pip3

Virtualenv

[root@www] # pip3 install virtualenv-I https://mirrors.ustc.edu.cn/pypi/web/simple/

[root@www ~] # pip3 install-U pip

[root@www ~] # ln-fs / usr/local/python3/bin/virtualenv / usr/bin/virtualenv

Install Archery

Prepare the virtual environment

Use of compiling and installing python

[root@www] # virtualenv venv4archery-- python=python3

Switch from python running environment to virtual environment

[root@www ~] # source venv4archery/bin/activate

Install ODBC dependencies

[root@www Archery-1.5.3] # yum install unixODBC-devel-y

Download the release package and install dependent libraries

[root@www ~] # wget "https://github.com/hhyo/archery/archive/v1.5.3.tar.gz"

[root@www ~] # tar-xzvf v1.5.3.tar.gz

Installation system dependency

[root@www ~] # yum-y install gcc gcc-c++ python-devel mysql-devel openldap-devel unixODBC-devel gettext

Install dependent libraries

[root@www ~] # cd Archery-1.5.3/

[root@www Archery-1.5.3] # pip3 install-r requirements.txt-I https://mirrors.ustc.edu.cn/pypi/web/simple/

If there is an error,

Solution:

Install mysql5.7, and then install the following dependencies

[root@www Archery-1.5.3] # yum install mysql-devel-y

(venv4archery) [root@www Archery-1.5.3] # find /-name mysql_config.1.gz

/ usr/share/man/man1/mysql_config.1.gz

(venv4archery) [root@www Archery-1.5.3] # find /-name mysql_config

/ usr/bin/mysql_config

[root@www Archery-1.5.3] # pip3 install-r requirements.txt-I https://mirrors.ustc.edu.cn/pypi/web/simple/

An error is reported.

Solution:

[root@www Archery-1.5.3] # yum install openldap-y

[root@www Archery-1.5.3] # yum install openldap-clients-y

[root@www Archery-1.5.3] # yum install openldap-devel-y

[root@www Archery-1.5.3] # pip3 install-r requirements.txt-I https://mirrors.ustc.edu.cn/pypi/web/simple/

(venv4archery) [root@www Archery-1.5.3] # echo $?

0

Modify configuration

[root@www Archery-1.5.3] # vim archery/settings.py

Security modification

Modify the key information of Prpcrypt. The key is used to encrypt information such as database passwords. Currently, aes_decryptor.py is hard-coded in the code.

Basic configuration

Turn off debug mode

DEBUG = False

Set ALLOWED_HOSTS. It is recommended to restrict private network access.

ALLOWED_HOSTS = ['*']

Request size limit, which can be modified if the submission SQL statement is too large

DATA_UPLOAD_MAX_MEMORY_SIZE = 15728640

Password verification, user registration and addition of password verification rules

AUTH_PASSWORD_VALIDATORS = [

{

'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator'

}

{

'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator'

'OPTIONS': {

'min_length': 9

}

}

{

'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator'

}

{

'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator'

}

]

MySQL configuration

MySQL version 5.6 or above is recommended

MongoDB configuration

Themis audit needs to execute eval () command. Refer to configure Allow user to execute eval () command on MongoDB 3.x}.

Create a role

Use admin

Switched to db admin

Db.createRole ({role: "executeFunctions", privileges: [{resource: {anyResource: true}, actions: ["anyAction"]}], roles: []})

{

"role": "executeFunctions"

"privileges": [

{

"resource": {

"anyResource": true

}

"actions": [

"anyAction"

]

}

]

"roles": []

}

Assign roles to users

Use themis

Switched to db themis

Db.grantRolesToUser ("dbuser", [{role: "executeFunctions", db: "admin"}])

Modify configuration

MONGODB_DATABASES = {

"default": {

"NAME": 'themis', # database

"USER":'', # user name

"PASSWORD":', # password

"HOST": '127.0.0.1 databases, # Database HOST

"PORT": 27017, # database port

}

}

Django-Q configuration

Default configuration is fine, or you can modify it by referring to the django-q documentation

Q_CLUSTER = {

'name': 'archery'

'workers': 4

'500 recycle':

'timeout': 60

'compress': True

'cpu_affinity': 1

'save_limit': 0

'queue_limit': 50

'label': 'Django Q'

'django_redis': 'default'

}

Cache configuration

Cache using redis

CACHES = {

"default": {

"BACKEND": "django_redis.cache.RedisCache"

"LOCATION": "redis://127.0.0.1:6379/0", # redis://host:port/db

"OPTIONS": {

"CLIENT_CLASS": "django_redis.client.DefaultClient"

}

}

}

Mysql > create database archery default character set utf8

Query OK, 1 row affected (0.14 sec)

Mysql > grant all privileges on archery.* to root@'127.0.0.1' identified by 'abc123'

Query OK, 0 rows affected, 1 warning (0.46 sec)

Mysql > flush privileges

Query OK, 0 rows affected (0.14 sec)

Mysql > exit

Install the redisp strategy

Start preparation

Database initialization

[root@www Archery-1.5.3] # python3 manage.py makemigrations sqlpython3 manage.py migrate

[root@www Archery-1.5.3] # python3 manage.py migrate

Compile translation file

[root@www Archery-1.5.3] # python3 manage.py compilemessages

Create an administrative user

Python3 manage.py createsuperuser

(venv4archery) [root@www Archery-1.5.3] # python3 manage.py createsuperuser

Username: admin # user

Email address: # fill in your email address

Password: admin123

Password (again): admin123

Superuser created successfully.

Start Django-Q

Need to keep the background running for message push, work order execution and scheduled execution, which can be managed using supervisor

Source / opt/venv4archery/bin/activate

Python3 manage.py qcluster &

Start the service

Runserver start

Source / root/venv4archery/bin/activate

Python3 manage.py runserver 0.0.0.0 9123-insecure

Turn off the firewall, or open port 9123. The account password is the admin admin123 you just created.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.