-
Notifications
You must be signed in to change notification settings - Fork 0
/
index.xml
1750 lines (1750 loc) · 179 KB
/
index.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>moranmore's site</title><link>https://expanse.rsvp/</link><description>Recent content on moranmore's site</description><generator>Hugo -- gohugo.io</generator><language>en</language><lastBuildDate>Wed, 06 Mar 2024 16:44:32 +0800</lastBuildDate><atom:link href="https://expanse.rsvp/index.xml" rel="self" type="application/rss+xml"/><item><title>AES及几种加密模式</title><link>https://expanse.rsvp/p/aes%E5%8F%8A%E5%87%A0%E7%A7%8D%E5%8A%A0%E5%AF%86%E6%A8%A1%E5%BC%8F/</link><pubDate>Wed, 06 Mar 2024 16:44:32 +0800</pubDate><guid>https://expanse.rsvp/p/aes%E5%8F%8A%E5%87%A0%E7%A7%8D%E5%8A%A0%E5%AF%86%E6%A8%A1%E5%BC%8F/</guid><description><h1 id="前言">前言</h1>
<p>本文仅针对AES加密的模式简单总结，不涉及过多数学原理知识。</p>
<h1 id="aes加密解密">AES加密解密</h1>
<p>AES是一种对称加密方案，需要密钥与密文完成加密与解密（加密与解密采用相同的密钥），在采取不同的加密模式的时候，需要加入初始化向量（iv）。</p>
<p>AES采取的是块加密的方式，将明文按照16个字节一组，加密后输出16个字节长度的密文块。</p>
<p>想要熟练的明白AES的加密流程，最好的方式就是动手实现一边AES的加密流程。Cryptohack的对称加密教程中，提供了这个训练，如果能在不借助其他工具的情况下，手动完成AES的解密模块，有助于理解AES的解密与加密的关系。</p>
<h2 id="加密流程">加密流程</h2>
<p>AES的加密流程中有几个定义需要简单了解，分别是Subbytes、ShiftRows、Columns、Add Round key。</p>
<p>在后面的几种加密模式和针对加密模式的攻击中，大多数没有涉及到过于底层的原理，大多数与代码的设计缺陷有关系。</p>
<p>在根据CryptoHack课程中，解密是从图片下到上解密的，小方格中的也是从下到上面的流程。如果检查过后还是无法解密，可以按照搜索的视频进行检查。</p>
<h1 id="加密模式">加密模式</h1>
<p>AES的几种常见加密方案</p>
<h2 id="ecb">ECB</h2>
<p>ECB（电子密码本）模式，使用密钥对分块的明文加密，不需要初始化向量。</p>
<p>Oracle，英文指的是预言、神谕的意思，CTF中一般指的是可以通过与服务器交互的情况获取一定量信息解题的情况。</p>
<p><img src="https://expanse.rsvp/p/aes%E5%8F%8A%E5%87%A0%E7%A7%8D%E5%8A%A0%E5%AF%86%E6%A8%A1%E5%BC%8F/ECB_encryption.svg"
loading="lazy"
alt="ECB加密"
></p>
<p>解密过程</p>
<p><img src="https://expanse.rsvp/p/aes%E5%8F%8A%E5%87%A0%E7%A7%8D%E5%8A%A0%E5%AF%86%E6%A8%A1%E5%BC%8F/ECB_decryption.svg"
loading="lazy"
alt="ECB解密"
></p>
<p>ECB的一个重要特征是当明文块相同的情况下密文也是相同的（密钥不变），使用16字节的密钥加密16字节的明文。</p>
<p>举例如下 ：</p>
<p>加密<code>AAAABBBBCCCCDDDD</code>与<code>AAAABBBBCCCCDDDD</code>的密文是相同的，如果改变最后一个字母，服务端返回的结果会发生变化，而且不只是一个字节发生变化，而是整个加密的块会发生很大的变化。</p>
<h3 id="场景">场景</h3>
<p>Oracle情况下，可以通过枚举的方式来获取明文</p>
<p>服务端可以运行加密程序，返回的是加密之后的密文（发送的明文+加密的明文，CTF中可能是选手发送的一段明文+加密的flag），不会给出密钥。</p>
<p>下文中出现了两种块，“构造块”是指的用于查询的块，长度是单位块长的n倍，是16*n字节，加密的块一般指的是16个字节的单位长度。</p>
<p>构造两个相邻的块，第一个块可以是全部相同的字符，第二个块的长度比第一个块缺少一个字符。经过构造，返回的第二个密文块的最后一个字符就是flag的第一个加密字符。</p>
<p>可以通过发送<code>AAAAAAAAAAAAAAAA</code>（16个A）作为第一个块，第二个块<code>AAAAAAAAAAAAAAA</code>（15个A）作为第二个块，加密之后，flag的第一个字符会补充到第二个加密块的最后一个位置上，就会变成如下的形式<code>AAAAAAAAAAAAAAAA</code>与<code>AAAAAAAAAAAAAAAc</code>加密之后的密文，通过反复改变第一个块最后一个位置的字符，直到第一个块的密文和第二个块密文相同的时候，第一个块的最后一个字符就是flag的第一个字符。</p>
<p>构造块的长度需要满足密文所占用块的长度，当密文占用两个块，构造的块占用两个单位块长度（32bytes）。</p>
<p>具体步骤如下：</p>
<p>1，判断明文（flag）长度，如果明文的长度不超过一个字节，两个块的长度都是16字节，依次类推，构造的块长度总是16字节的2n倍（n是明文占用的块长，可以用<code>n=len(m)//16+1</code>来计算）。</p>
<p>2，与服务器进行交互，当满足每两个块的密文相同的时候，去掉每个块第一个字符，将最后一个字符（枚举成功的字符）加入到结果中。枚举的明文空间可以用<code>string</code>库中的<code>string.printable</code>，<code>table = string.printable[:-5]</code>去掉了换行符、制表符等字符（flag一般不会采用的字符）。</p>
<p>3，直到有明文特征的情况出现时，完成枚举明文（比如<code>}</code>字符出现的时候）。</p>
<h3 id="script">script</h3>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span><span class="lnt">13
</span><span class="lnt">14
</span><span class="lnt">15
</span><span class="lnt">16
</span><span class="lnt">17
</span><span class="lnt">18
</span><span class="lnt">19
</span><span class="lnt">20
</span><span class="lnt">21
</span><span class="lnt">22
</span><span class="lnt">23
</span><span class="lnt">24
</span><span class="lnt">25
</span><span class="lnt">26
</span><span class="lnt">27
</span><span class="lnt">28
</span><span class="lnt">29
</span><span class="lnt">30
</span><span class="lnt">31
</span><span class="lnt">32
</span><span class="lnt">33
</span><span class="lnt">34
</span><span class="lnt">35
</span><span class="lnt">36
</span><span class="lnt">37
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"><span class="line"><span class="cl"><span class="kn">import</span> <span class="nn">string</span>
</span></span><span class="line"><span class="cl"><span class="kn">import</span> <span class="nn">requests</span>
</span></span><span class="line"><span class="cl"><span class="k">def</span> <span class="nf">bruteSingle</span><span class="p">():</span>
</span></span><span class="line"><span class="cl"> <span class="n">lenth</span> <span class="o">=</span> <span class="mi">32</span> <span class="c1"># lenth = len(flag)//16 +1</span>
</span></span><span class="line"><span class="cl"> <span class="n">listToString</span> <span class="o">=</span> <span class="k">lambda</span> <span class="n">x</span><span class="p">:</span><span class="s1">&#39;&#39;</span><span class="o">.</span><span class="n">join</span><span class="p">([</span><span class="nb">hex</span><span class="p">(</span><span class="nb">ord</span><span class="p">(</span><span class="n">x</span><span class="p">[</span><span class="n">i</span><span class="p">]))[</span><span class="mi">2</span><span class="p">:]</span> <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">x</span><span class="p">))])</span> <span class="c1"># 匿名函数用于转换格式</span>
</span></span><span class="line"><span class="cl"> <span class="n">reponse</span> <span class="o">=</span> <span class="k">lambda</span> <span class="n">x</span><span class="p">:</span> <span class="n">requests</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="n">url</span><span class="o">=</span><span class="n">x</span><span class="p">)</span><span class="o">.</span><span class="n">text</span>
</span></span><span class="line"><span class="cl"> <span class="n">splitCiphertext</span> <span class="o">=</span> <span class="k">lambda</span> <span class="n">x</span><span class="p">:</span><span class="n">x</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s1">&#39;&#34;:&#34;&#39;</span><span class="p">)[</span><span class="mi">1</span><span class="p">][:</span><span class="o">-</span><span class="mi">2</span><span class="p">]</span>
</span></span><span class="line"><span class="cl"> <span class="n">splitString</span> <span class="o">=</span> <span class="k">lambda</span> <span class="n">x</span><span class="p">:</span> <span class="p">[</span><span class="n">x</span><span class="p">[</span><span class="n">i</span><span class="p">:</span><span class="n">i</span><span class="o">+</span><span class="mi">2</span><span class="p">]</span> <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span><span class="nb">len</span><span class="p">(</span><span class="n">x</span><span class="p">),</span><span class="mi">2</span><span class="p">)]</span>
</span></span><span class="line"><span class="cl"> <span class="n">table</span> <span class="o">=</span> <span class="n">string</span><span class="o">.</span><span class="n">printable</span><span class="p">[:</span><span class="o">-</span><span class="mi">5</span><span class="p">]</span>
</span></span><span class="line"><span class="cl"> <span class="n">table</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="n">table</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="nb">print</span><span class="p">(</span><span class="n">table</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="n">block1</span> <span class="o">=</span> <span class="p">[</span><span class="s1">&#39;a&#39;</span> <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="n">lenth</span><span class="p">)]</span>
</span></span><span class="line"><span class="cl"> <span class="n">block2</span> <span class="o">=</span> <span class="n">block1</span><span class="o">.</span><span class="n">copy</span><span class="p">()[:</span><span class="o">-</span><span class="mi">1</span><span class="p">]</span> <span class="c1"># 复制块1，并且让块2的长度小于块1，python的数组可以通过.copy() 进行复制，否则会直接在原数组上修改</span>
</span></span><span class="line"><span class="cl"> <span class="n">url</span> <span class="o">=</span> <span class="p">[</span><span class="n">flag</span><span class="p">:</span><span class="n">query</span> <span class="n">url</span><span class="p">]</span> <span class="c1"># 题目交互url</span>
</span></span><span class="line"><span class="cl"> <span class="n">flag</span> <span class="o">=</span> <span class="p">[]</span>
</span></span><span class="line"><span class="cl"> <span class="k">while</span> <span class="s1">&#39;}&#39;</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">flag</span><span class="p">:</span>
</span></span><span class="line"><span class="cl"> <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span><span class="nb">len</span><span class="p">(</span><span class="n">table</span><span class="p">)):</span>
</span></span><span class="line"><span class="cl"> <span class="n">block1</span><span class="p">[</span><span class="o">-</span><span class="mi">1</span><span class="p">]</span> <span class="o">=</span> <span class="n">table</span><span class="p">[</span><span class="n">i</span><span class="p">]</span>
</span></span><span class="line"><span class="cl"> <span class="n">block</span> <span class="o">=</span> <span class="n">block1</span> <span class="o">+</span> <span class="n">block2</span>
</span></span><span class="line"><span class="cl"> <span class="n">sendBlock</span> <span class="o">=</span> <span class="n">listToString</span><span class="p">(</span><span class="n">block</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="n">query</span> <span class="o">=</span> <span class="n">url</span> <span class="o">+</span> <span class="n">sendBlock</span>
</span></span><span class="line"><span class="cl"> <span class="n">tmpResult</span> <span class="o">=</span> <span class="n">reponse</span><span class="p">(</span><span class="n">query</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="n">tmp</span> <span class="o">=</span> <span class="n">splitCiphertext</span><span class="p">(</span><span class="n">tmpResult</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="n">tmp</span> <span class="o">=</span> <span class="n">splitString</span><span class="p">(</span><span class="n">tmp</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="k">if</span> <span class="n">tmp</span><span class="p">[:</span><span class="mi">31</span><span class="p">]</span><span class="o">==</span><span class="n">tmp</span><span class="p">[</span><span class="mi">32</span><span class="p">:</span><span class="mi">63</span><span class="p">]:</span> <span class="c1"># 判断第一个块与第二个块是否完全相同，这里的索引需要根据lenth更改</span>
</span></span><span class="line"><span class="cl"> <span class="n">flag</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">block1</span><span class="p">[</span><span class="o">-</span><span class="mi">1</span><span class="p">])</span>
</span></span><span class="line"><span class="cl"> <span class="n">block1</span> <span class="o">=</span> <span class="n">block1</span><span class="o">.</span><span class="n">copy</span><span class="p">()[</span><span class="mi">1</span><span class="p">:]</span>
</span></span><span class="line"><span class="cl"> <span class="n">block1</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="s1">&#39;&#39;</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="n">block2</span><span class="p">)</span><span class="o">!=</span><span class="mi">0</span><span class="p">:</span>
</span></span><span class="line"><span class="cl"> <span class="n">block2</span><span class="o">.</span><span class="n">pop</span><span class="p">()</span>
</span></span><span class="line"><span class="cl"> <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">&#39;New block1:</span><span class="si">{</span><span class="n">block1</span><span class="si">}</span><span class="s1">&#39;</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="k">break</span>
</span></span><span class="line"><span class="cl"> <span class="nb">print</span><span class="p">(</span><span class="n">block</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="n">res</span> <span class="o">=</span> <span class="s1">&#39;&#39;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">flag</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">&#39;FLAG:</span><span class="si">{</span><span class="n">res</span><span class="si">}</span><span class="s1">&#39;</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="nb">print</span><span class="p">(</span><span class="s1">&#39;&#39;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">flag</span><span class="p">))</span>
</span></span><span class="line"><span class="cl"><span class="n">bruteSingle</span><span class="p">()</span>
</span></span></code></pre></td></tr></table>
</div>
</div><h2 id="cbc">CBC</h2>
<p>CBC（密码分组链接模式）模式，加入了初始化向量（一个16bytes的字符串），在对第一个明文块加密的时候，先将明文与IV异或运算，再用密钥将异或的结果进行加密，得到第一个块的密文，第一个块的密文同时将与第二个明文块异或，依次进行，直到加密完成。</p>
<p>解密是加密的逆过程，对于第一个密文快，先用密钥解密密文，再把解密之后的信息与向量异或，得到第一个明文块，再利用第一个密文块与用密钥解密第二个密文块的信息进行异或，得到第二个明文块，直到解密全部结束。</p>
<p>加密过程：</p>
<p><img src="https://expanse.rsvp/p/aes%E5%8F%8A%E5%87%A0%E7%A7%8D%E5%8A%A0%E5%AF%86%E6%A8%A1%E5%BC%8F/CBC_encryption.svg"
loading="lazy"
alt="CBC解密过程"
></p>
<p>解密过程：</p>
<p><img src="https://expanse.rsvp/p/aes%E5%8F%8A%E5%87%A0%E7%A7%8D%E5%8A%A0%E5%AF%86%E6%A8%A1%E5%BC%8F/CBC_decryption.svg"
loading="lazy"
alt="CBC解密过程"
></p>
<p>在CBC的加密与解密过程中，存在一个类似中间变量的信息，如加密过程中，明文与向量异或后的结果，作为块加密的输入，可以看作新的的明文。在解密过程中，可以发现，这个过程被逆向进行，由密文被解密之后的信息，实际上可以与向量异或，得到明文。这带来了两个可以观察出来的结论，第一个就是加密解密过程中参与异或运算得到的信息才是参与加密解密的主体，第二个就是在加密与解密过程中，这个异或的结果是不容易被改变的。这两个特征更有利于后面的攻击利用的思考（攻击的过程可改变的变量可以被限制在一定的变量范围内）。</p>
<h3 id="场景-1">场景</h3>
<p>伪造cookie登录验证</p>
<p>在需要登录验证的情况下，如当下发cookie的明文为：<code>admin=False=expire{xxxxx}</code>的格式，同时向量可以自行输入的情况下，伪造向量，使得向量与中加密的中间变量异或之后得到的明文中含有<code>admin=True</code>就能完成登录。</p>
<h3 id="script-1">script</h3>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span><span class="lnt">13
</span><span class="lnt">14
</span><span class="lnt">15
</span><span class="lnt">16
</span><span class="lnt">17
</span><span class="lnt">18
</span><span class="lnt">19
</span><span class="lnt">20
</span><span class="lnt">21
</span><span class="lnt">22
</span><span class="lnt">23
</span><span class="lnt">24
</span><span class="lnt">25
</span><span class="lnt">26
</span><span class="lnt">27
</span><span class="lnt">28
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"><span class="line"><span class="cl"><span class="k">def</span> <span class="nf">get_cookie</span><span class="p">():</span>
</span></span><span class="line"><span class="cl"> <span class="n">expires_at</span> <span class="o">=</span> <span class="p">(</span><span class="n">datetime</span><span class="o">.</span><span class="n">today</span><span class="p">()</span> <span class="o">+</span> <span class="n">timedelta</span><span class="p">(</span><span class="n">days</span><span class="o">=</span><span class="mi">1</span><span class="p">))</span><span class="o">.</span><span class="n">timestamp</span><span class="p">()</span>
</span></span><span class="line"><span class="cl"> <span class="n">cookie</span> <span class="o">=</span> <span class="sa">f</span><span class="s2">&#34;admin=False;expiry=</span><span class="si">{</span><span class="n">expires_at</span><span class="si">}</span><span class="s2">&#34;</span><span class="o">.</span><span class="n">encode</span><span class="p">()</span>
</span></span><span class="line"><span class="cl"> <span class="nb">print</span><span class="p">(</span><span class="n">cookie</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="c1"># iv = os.urandom(16)</span>
</span></span><span class="line"><span class="cl"> <span class="nb">print</span><span class="p">(</span><span class="s1">&#39;iv&#39;</span><span class="p">,</span><span class="n">iv</span><span class="o">.</span><span class="n">hex</span><span class="p">())</span>
</span></span><span class="line"><span class="cl"> <span class="n">padded</span> <span class="o">=</span> <span class="n">pad</span><span class="p">(</span><span class="n">cookie</span><span class="p">,</span> <span class="mi">16</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="n">cipher</span> <span class="o">=</span> <span class="n">AES</span><span class="o">.</span><span class="n">new</span><span class="p">(</span><span class="n">KEY</span><span class="p">,</span> <span class="n">AES</span><span class="o">.</span><span class="n">MODE_CBC</span><span class="p">,</span> <span class="n">iv</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="n">encrypted</span> <span class="o">=</span> <span class="n">cipher</span><span class="o">.</span><span class="n">encrypt</span><span class="p">(</span><span class="n">padded</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="n">ciphertext</span> <span class="o">=</span> <span class="n">iv</span><span class="o">.</span><span class="n">hex</span><span class="p">()</span> <span class="o">+</span> <span class="n">encrypted</span><span class="o">.</span><span class="n">hex</span><span class="p">()</span>
</span></span><span class="line"><span class="cl"> <span class="nb">print</span><span class="p">(</span><span class="s1">&#39;ciphertext&#39;</span><span class="p">,</span><span class="n">ciphertext</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="k">return</span> <span class="n">ciphertext</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="c1"># Proof</span>
</span></span><span class="line"><span class="cl"><span class="c1"># 伪造iv</span>
</span></span><span class="line"><span class="cl"><span class="kn">from</span> <span class="nn">Crypto.Util.number</span> <span class="kn">import</span> <span class="o">*</span>
</span></span><span class="line"><span class="cl"><span class="c1"># {&#34;cookie&#34;:&#34;89d93137d13043d9ee4efaf75c2ca9a0a0f37efb466cf36ec9cf5b5a86741ff2a7af80f5f4b652c442dfb633bb5d18cb&#34;}</span>
</span></span><span class="line"><span class="cl"><span class="n">cookie</span> <span class="o">=</span> <span class="s2">&#34;d70005d58d2b81fa136d724eb00c240affd6d12e7e1e00e7235fea77f027e07e003ddfce55fd1e8fd2450759f3823917&#34;</span>
</span></span><span class="line"><span class="cl"><span class="c1"># cookie = get_cookie()</span>
</span></span><span class="line"><span class="cl"><span class="n">initiv</span><span class="o">=</span><span class="n">cookie</span><span class="p">[:</span><span class="mi">32</span><span class="p">]</span>
</span></span><span class="line"><span class="cl"><span class="nb">print</span><span class="p">(</span><span class="n">cookie</span><span class="p">[</span><span class="mi">32</span><span class="p">:])</span>
</span></span><span class="line"><span class="cl"><span class="c1"># initiv = &#39;25120708a0d45e54dde66e4a50032340&#39;</span>
</span></span><span class="line"><span class="cl"><span class="n">old</span> <span class="o">=</span> <span class="sa">b</span><span class="s1">&#39;admin=False;expi&#39;</span>
</span></span><span class="line"><span class="cl"><span class="n">realenc</span> <span class="o">=</span> <span class="n">bytes_to_long</span><span class="p">(</span><span class="n">old</span><span class="p">)</span><span class="o">^</span><span class="nb">int</span><span class="p">(</span><span class="n">initiv</span><span class="p">,</span><span class="mi">16</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"><span class="n">fak</span> <span class="o">=</span> <span class="sa">b</span><span class="s1">&#39;admin=True;eexpi&#39;</span> <span class="c1"># 构造虚假向量的时候需要注意split函数分割后的结果需要完全匹配，构造成b&#39;admin=Truee;expi&#39;分割后的第一部分为&#39;admin=Truee&#39;，不符合规则</span>
</span></span><span class="line"><span class="cl"><span class="n">fakeiv</span> <span class="o">=</span> <span class="n">bytes_to_long</span><span class="p">(</span><span class="n">fak</span><span class="p">)</span><span class="o">^</span><span class="n">realenc</span>
</span></span><span class="line"><span class="cl"><span class="nb">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">fakeiv</span><span class="p">)[</span><span class="mi">2</span><span class="p">:])</span>
</span></span><span class="line"><span class="cl"><span class="c1"># print(check_admin(cookie[32:], hex(fakeiv)[2:]))</span>
</span></span></code></pre></td></tr></table>
</div>
</div><h2 id="ctr">CTR</h2>
<p>Nonce的变化模式，当Nonce没有变化的情况下，iv经过密钥加密之后的密文不变，从而使得整个加密相当于用iv与明文进行异或，补充iv到与密文相同长度，找到十六进制再异或就行。CTR模式没有类似CBC模式的密文之间的联系，所以可以采取并行的方式进行解密。</p>
<p>加密过程：</p>
<p><img src="https://expanse.rsvp/p/aes%E5%8F%8A%E5%87%A0%E7%A7%8D%E5%8A%A0%E5%AF%86%E6%A8%A1%E5%BC%8F/CTR_encryption_2.svg"
loading="lazy"
alt="CTR_encryption"
></p>
<p>解密过程：</p>
<p><img src="https://expanse.rsvp/p/aes%E5%8F%8A%E5%87%A0%E7%A7%8D%E5%8A%A0%E5%AF%86%E6%A8%A1%E5%BC%8F/CTR_decryption_2.svg"
loading="lazy"
alt="CTR_decryption"
></p>
<h3 id="场景-2">场景</h3>
<p>图片以hex格式进行加密，按照加密解密的说明进行解密就行，需要注意的是如果win下无法打开，可以在文件管理器另存为的时候看到缩略图。</p>
<h3 id="script-2">script</h3>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span><span class="lnt">13
</span><span class="lnt">14
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"><span class="line"><span class="cl"><span class="n">enciv</span> <span class="o">=</span> <span class="n">long_to_bytes</span><span class="p">(</span><span class="nb">int</span><span class="p">(</span><span class="n">headerOfPNG</span><span class="p">,</span><span class="mi">16</span><span class="p">)</span><span class="o">^</span><span class="nb">int</span><span class="p">(</span><span class="n">a</span><span class="p">[:</span><span class="mi">32</span><span class="p">],</span><span class="mi">16</span><span class="p">))</span>
</span></span><span class="line"><span class="cl"><span class="nb">print</span><span class="p">(</span><span class="n">enciv</span><span class="o">.</span><span class="n">hex</span><span class="p">())</span>
</span></span><span class="line"><span class="cl"><span class="n">key</span> <span class="o">=</span> <span class="s1">&#39;e3f227f06fd15d34d58b897cabdef07b&#39;</span>
</span></span><span class="line"><span class="cl"><span class="c1"># hexXor = lambda x,y:</span>
</span></span><span class="line"><span class="cl"><span class="nb">print</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">a</span><span class="p">)</span><span class="o">//</span><span class="mi">32</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"><span class="n">paddingHex</span> <span class="o">=</span> <span class="k">lambda</span> <span class="n">aim</span><span class="p">,</span><span class="n">x</span><span class="p">:</span><span class="n">x</span><span class="o">*</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">aim</span><span class="p">)</span><span class="o">//</span><span class="mi">32</span><span class="p">)</span><span class="o">+</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">aim</span><span class="p">)</span><span class="o">%</span><span class="mi">32</span><span class="p">)</span><span class="o">*</span><span class="s1">&#39;00&#39;</span>
</span></span><span class="line"><span class="cl"><span class="n">hexToList</span> <span class="o">=</span> <span class="k">lambda</span> <span class="n">x</span><span class="p">:[</span><span class="nb">str</span><span class="p">(</span><span class="n">x</span><span class="p">)[</span><span class="n">i</span><span class="p">:</span><span class="n">i</span><span class="o">+</span><span class="mi">2</span><span class="p">]</span> <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span><span class="nb">len</span><span class="p">(</span><span class="n">x</span><span class="p">),</span><span class="mi">2</span><span class="p">)]</span>
</span></span><span class="line"><span class="cl"><span class="n">hexListXor</span> <span class="o">=</span> <span class="k">lambda</span> <span class="n">a</span><span class="p">,</span><span class="n">b</span><span class="p">:[</span><span class="nb">hex</span><span class="p">(</span><span class="nb">int</span><span class="p">(</span><span class="n">a</span><span class="p">[</span><span class="n">i</span><span class="p">],</span><span class="mi">16</span><span class="p">)</span><span class="o">^</span><span class="nb">int</span><span class="p">(</span><span class="n">b</span><span class="p">[</span><span class="n">i</span><span class="p">],</span><span class="mi">16</span><span class="p">))[</span><span class="mi">2</span><span class="p">:]</span><span class="o">.</span><span class="n">zfill</span><span class="p">(</span><span class="mi">2</span><span class="p">)</span> <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">a</span><span class="p">))]</span>
</span></span><span class="line"><span class="cl"><span class="nb">print</span><span class="p">(</span><span class="n">hexListXor</span><span class="p">(</span><span class="n">hexToList</span><span class="p">(</span><span class="n">a</span><span class="p">),</span><span class="n">hexToList</span><span class="p">(</span><span class="n">paddingHex</span><span class="p">(</span><span class="n">a</span><span class="p">,</span><span class="n">key</span><span class="p">))))</span>
</span></span><span class="line"><span class="cl"><span class="n">flag</span> <span class="o">=</span> <span class="s1">&#39;&#39;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">hexListXor</span><span class="p">(</span><span class="n">hexToList</span><span class="p">(</span><span class="n">a</span><span class="p">),</span><span class="n">hexToList</span><span class="p">(</span><span class="n">paddingHex</span><span class="p">(</span><span class="n">a</span><span class="p">,</span><span class="n">key</span><span class="p">))))</span>
</span></span><span class="line"><span class="cl"><span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;flag.txt&#39;</span><span class="p">,</span><span class="s1">&#39;w&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
</span></span><span class="line"><span class="cl"> <span class="n">f</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">flag</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"> <span class="n">f</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
</span></span><span class="line"><span class="cl"><span class="c1"># 以十六进制的图片，使用010editor的paste from hex进行存储为png格式即可，可使用缩略图查看</span>
</span></span></code></pre></td></tr></table>
</div>
</div><p>⚠：这里的图片无法正常打开，所以用的是缩略图， 以后有时间补充这部分。</p>
<h2 id="ofb">OFB</h2>
<p>OFB（输出反馈模式）模式是使用密钥加密初始化向量，将这个结果反复作为下一个块的初始向量，同时这个结果与对应块的明文进行异或获得对应的密文。解密过程为逆过程。</p>
<p>加密过程：</p>
<p><img src="https://expanse.rsvp/p/aes%E5%8F%8A%E5%87%A0%E7%A7%8D%E5%8A%A0%E5%AF%86%E6%A8%A1%E5%BC%8F/OFB_encryption.svg"
loading="lazy"
alt="OFB加密"
></p>
<p>解密过程：</p>
<p><img src="https://expanse.rsvp/p/aes%E5%8F%8A%E5%87%A0%E7%A7%8D%E5%8A%A0%E5%AF%86%E6%A8%A1%E5%BC%8F/OFB_decryption.svg"
loading="lazy"
alt="OFB解密"
></p>
<h3 id="场景-3">场景</h3>
<p>虽然无法得知密钥，但是由于加密最后一步是异或，只要可以构造中间变量，就能通过异或获取明文，将原始用于加密的向量作为第二次加密的向量，将密文作为第二次加密的明文，第二次加密的结果就是明文。</p>
<h3 id="script-3">script</h3>
<h1 id="参考">参考</h1>
<p>AES加密过程：https://www.youtube.com/watch?v=gP4PqVGudtg</p>
<p>CryptoHack symmetric：https://cryptohack.org/courses/symmetric/course_details/</p>
<p>维基百科：https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation</p></description></item><item><title>Headscale与tailscale简单使用体验</title><link>https://expanse.rsvp/p/headscale%E4%B8%8Etailscale%E7%AE%80%E5%8D%95%E4%BD%BF%E7%94%A8%E4%BD%93%E9%AA%8C/</link><pubDate>Sat, 30 Dec 2023 11:04:46 +0800</pubDate><guid>https://expanse.rsvp/p/headscale%E4%B8%8Etailscale%E7%AE%80%E5%8D%95%E4%BD%BF%E7%94%A8%E4%BD%93%E9%AA%8C/</guid><description><h1 id="前言">前言</h1>
<p>通过Headscale和tailscale可以实现远程组建局域网，远程访问家中资源的目的。</p>
<p>或者在A地访问B地资源较慢的时候，可以通过Headscale+tailscale组件局域网，加速访问资源。</p>
<p>Or可以让多台设备加入一个公网VPS，让不同地点的用户访问对方的本地资源等。</p>
<h1 id="准备">准备</h1>
<p>1，准备一个具有公网ip的vps，一个主机（个人设备，用于接入VPS搭建的局域网中）。</p>
<p>2，在vps上安装headscale，在主机上安装tailscale。</p>
<h1 id="安装headscale">安装Headscale</h1>
<p>按照官网的方式进行安装：https://headscale.net/running-headscale-linux/#installation</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 更新</span>
</span></span><span class="line"><span class="cl">sudo apt update
</span></span><span class="line"><span class="cl">sudo apt upgrade
</span></span><span class="line"><span class="cl"><span class="c1"># 下载安装包，注意修改flag里面的标志，这里的版本时根据repo中的最新版本修改</span>
</span></span><span class="line"><span class="cl">wget --output-document<span class="o">=</span>headscale.deb https://github.com/juanfont/headscale/releases/download/v0.22.3/<span class="o">[</span>flag:headscale_0.xx.xx_linux_amd64.deb<span class="o">]</span>
</span></span><span class="line"><span class="cl"><span class="c1"># 安装deb包</span>
</span></span><span class="line"><span class="cl">sudo dpkg --install headscale.deb
</span></span><span class="line"><span class="cl">systemctl daemon-reload <span class="c1"># 重新载入配置文件</span>
</span></span><span class="line"><span class="cl">systemctl <span class="nb">enable</span> --now headscale <span class="c1"># 开机自动启动</span>
</span></span><span class="line"><span class="cl">sudo systemctl <span class="nb">enable</span> headscale
</span></span><span class="line"><span class="cl">sudo systemctl start headscale
</span></span></code></pre></td></tr></table>
</div>
</div><p>修改配置文件内容</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 编辑配置文件</span>
</span></span><span class="line"><span class="cl">vim /etc/headscale/config.yaml
</span></span><span class="line"><span class="cl"><span class="c1"># 修改以下内容</span>
</span></span><span class="line"><span class="cl">server_url:http://<span class="o">[</span>flag:your vps public ip address<span class="o">]</span>:8080
</span></span><span class="line"><span class="cl">listen_url:0.0.0.0:8080
</span></span></code></pre></td></tr></table>
</div>
</div><div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 新建命名空间</span>
</span></span><span class="line"><span class="cl">headscale users create <span class="o">[</span>flag:namespace<span class="o">]</span> <span class="c1"># 最后参数为命名空间的名字</span>
</span></span></code></pre></td></tr></table>
</div>
</div><p>一些安装信息</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span><span class="lnt">6
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 数据库安装位置</span>
</span></span><span class="line"><span class="cl">/var/lib/headscale/db.sqlite
</span></span><span class="line"><span class="cl"><span class="c1"># 如果配置文件出错，重新下载配置文件</span>
</span></span><span class="line"><span class="cl">wget https://github.com/juanfont/headscale/raw/main/config-example.yaml -O /etc/headscale/config.yaml
</span></span><span class="line"><span class="cl"><span class="c1"># 如果报错，可能需要修改配置文件中的</span>
</span></span><span class="line"><span class="cl">unix_socket: /var/lib/headscale/headscale.sock
</span></span></code></pre></td></tr></table>
</div>
</div><h1 id="安装tailscale">安装Tailscale</h1>
<p>如果想要实现在VPS上搭建局域网用于多用户实现访问某个资源的ip看起来是一样的，需要在VPS上安装Headscale和Tailscale，即同时作为服务端和一个节点。</p>
<h2 id="linux">Linux</h2>
<p>下载客户端：https://tailscale.com/kb/1039/install-ubuntu-2004/</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.noarmor.gpg <span class="p">|</span> sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg &gt;/dev/null
</span></span><span class="line"><span class="cl">curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.tailscale-keyring.list <span class="p">|</span> sudo tee /etc/apt/sources.list.d/tailscale.list
</span></span><span class="line"><span class="cl">sudo apt-get update
</span></span><span class="line"><span class="cl">sudo apt-get install tailscale
</span></span></code></pre></td></tr></table>
</div>
</div><p>如果无法直接弹出注册的token就按照提示命令，直到弹出nodekey</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 等号后面的是安装headscale的主机，默认端口8080 回显会有..... nodekey:...</span>
</span></span><span class="line"><span class="cl">tailscale up --login-server<span class="o">=</span>http://<span class="o">[</span>flag: your vps public ip address<span class="o">]</span>:8080
</span></span><span class="line"><span class="cl"><span class="c1"># 接受注册 把nodekey按照下面的格式在安装了headscale的主机上运行bash</span>
</span></span><span class="line"><span class="cl">headscale --user <span class="o">[</span>flag:name of registed user<span class="o">]</span> nodes register --key nodekey:xxxxx
</span></span></code></pre></td></tr></table>
</div>
</div><h2 id="windows">Windows</h2>
<p>访问<code>http://[flag: your vps public ip address]:8080/windows</code>按照步骤，添加注册表，输入命令，在VPS注册节点。</p>
<h1 id="外部节点exit-node">外部节点（Exit node）</h1>
<p><a class="link" href="https://tailscale.com/kb/1103/exit-nodes/" target="_blank" rel="noopener"
>添加外部节点</a></p>
<p>将部署有headscale的机器作为外部节点，也就是将vps本机加入node的方式，实现通过外部节点访问互联网的目的（比如从局域网）。</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span><span class="lnt">6
</span><span class="lnt">7
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo tailscale <span class="nb">set</span> --exit-node <span class="o">[</span>flag: VPS hostname<span class="o">]</span>
</span></span><span class="line"><span class="cl">tailscale up --advertise-exit-node --login-server<span class="o">=</span>http://<span class="o">[</span>flag: your vps public ip address<span class="o">]</span>:8080
</span></span><span class="line"><span class="cl">sudo tailscale up --advertise-exit-node
</span></span><span class="line"><span class="cl"> <span class="c1"># 运行完上面的命令之后，在vps上查看路由</span>
</span></span><span class="line"><span class="cl">headscale routes list
</span></span><span class="line"><span class="cl"> <span class="c1"># 开启路由：标志位是上面命令现实出来的第一列参数：ID，在一个外部节点的情况下直接enable前两个路由</span>
</span></span><span class="line"><span class="cl"> headscale routes <span class="nb">enable</span> -r <span class="o">[</span>flag<span class="o">]</span>
</span></span></code></pre></td></tr></table>
</div>
</div><div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo tailscale <span class="nb">set</span> --exit-node 外部节点名称
</span></span></code></pre></td></tr></table>
</div>
</div><p>删除节点</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">headscale node delete -i
</span></span></code></pre></td></tr></table>
</div>
</div><p>如果需要将Windows机器作为内网转发的机器，需要设置Windows的转发规则，并login到server。</p>
<h1 id="更改节点">更改节点</h1>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span><span class="lnt">6
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 删除节点</span>
</span></span><span class="line"><span class="cl">headscale nodes delete <span class="o">[</span>flags<span class="o">]</span>
</span></span><span class="line"><span class="cl"><span class="c1"># x 这里指代的是第一列标志的ID序号</span>
</span></span><span class="line"><span class="cl">headscale nodes delete -i x
</span></span><span class="line"><span class="cl"><span class="c1"># 启动路由</span>
</span></span><span class="line"><span class="cl">headscale node route <span class="nb">enable</span> -a -i
</span></span></code></pre></td></tr></table>
</div>
</div><h1 id="启动代理">启动代理</h1>
<p>访问外部网络的主机上（这里是linux），如在局域网 使用exit node：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"> sudo tailscale <span class="nb">set</span> --exit-node <span class="o">[</span>flag: <span class="nb">exit</span> node <span class="o">]</span>
</span></span></code></pre></td></tr></table>
</div>
</div><h1 id="切换服务端">切换服务端</h1>
<p>windows平台先修改注册表，然后访问新的注册网址。</p>
<p>访问新的内网ip对应端口的windows，:</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">http://[flag: your vps public ip address]:8080/windows
</span></span></code></pre></td></tr></table>
</div>
</div><p>将<code>HKLM\Software\Tailscale IPN</code> 的值改为新的ip地址的值,重新用注册机器的方式注册一遍。</p>
<h1 id="headscale常用状态检测命令">Headscale常用状态检测命令</h1>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 查看所有命名空间</span>
</span></span><span class="line"><span class="cl">headscale namespace list
</span></span><span class="line"><span class="cl"><span class="c1"># 列出所有节点信息</span>
</span></span><span class="line"><span class="cl">headscale node list
</span></span><span class="line"><span class="cl"><span class="c1"># 查看部署日志</span>
</span></span><span class="line"><span class="cl">journalctl -u headscale
</span></span><span class="line"><span class="cl"><span class="c1"># 查看运行状态</span>
</span></span><span class="line"><span class="cl">systemctl status headscale
</span></span><span class="line"><span class="cl"><span class="c1"># 重启服务</span>
</span></span><span class="line"><span class="cl">service headscale restart
</span></span></code></pre></td></tr></table>
</div>
</div><h1 id="参考文章">参考文章</h1>
<p><a class="link" href="https://headscale.net/" target="_blank" rel="noopener"
>https://headscale.net/</a></p>
<p><a class="link" href="https://github.com/juanfont/headscale" target="_blank" rel="noopener"
>https://github.com/juanfont/headscale</a></p>
<p><a class="link" href="https://icloudnative.io/posts/how-to-set-up-or-migrate-headscale" target="_blank" rel="noopener"
>https://icloudnative.io/posts/how-to-set-up-or-migrate-headscale</a></p></description></item><item><title>使用Docker搭建简单静态网站</title><link>https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/</link><pubDate>Sun, 24 Dec 2023 23:18:59 +0800</pubDate><guid>https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/</guid><description><h1 id="前言">前言</h1>
<p>使用Docker+Cloudflare可以在自己的VPS服务器上搭建简易的静态网站。</p>
<p>采用的镜像为nginx镜像，同时在主机用nginx反向代理实现转发功能，使得输入域名就能访问相应的容器端口。</p>
<p>简单的说，可以通过反向代理，实现在输入不同的域名来访问主机的80端口时，将请求转发到其他的自定义端口，更容易部署和修改网站的服务。同时使用Cloudflare将解析指向自己的VPS，隐藏VPS真实IP。</p>
<p>对于原理没有特别多的解释，但是按照步骤来能实现稳定的访问。</p>
<p>在VPS上使用docker搭建简单静态网站并使用cloudflare</p>
<h1 id="dockerfile">Dockerfile</h1>
<p>静态网站只有一个主页，直接copy到html目录下就行（半年以内用docker-compose搭建复杂一点的网站）</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span><span class="lnt">6
</span><span class="lnt">7
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-dockerfile" data-lang="dockerfile"><span class="line"><span class="cl"><span class="k">FROM</span><span class="s"> nginx:latest</span><span class="err">
</span></span></span><span class="line"><span class="cl"><span class="err">
</span></span></span><span class="line"><span class="cl"><span class="err"></span><span class="k">COPY</span> index.html /usr/share/nginx/html/index.html<span class="err">
</span></span></span><span class="line"><span class="cl"><span class="err">
</span></span></span><span class="line"><span class="cl"><span class="err"></span><span class="k">EXPOSE</span><span class="s"> 80</span><span class="err">
</span></span></span><span class="line"><span class="cl"><span class="err">
</span></span></span><span class="line"><span class="cl"><span class="err"></span><span class="k">CMD</span> <span class="p">[</span><span class="s2">&#34;nginx&#34;</span><span class="p">,</span> <span class="s2">&#34;-g&#34;</span><span class="p">,</span> <span class="s2">&#34;daemon off;&#34;</span><span class="p">]</span><span class="err">
</span></span></span></code></pre></td></tr></table>
</div>
</div><h1 id="cloudflare">Cloudflare</h1>
<h2 id="dns设置">DNS设置</h2>
<p>Websites添加购买的域名</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/add-domain-1703431646656-1.png"
width="2093"
height="248"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/add-domain-1703431646656-1_hu36bdc73d61086d49c631fa2ed23cef3c_42051_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/add-domain-1703431646656-1_hu36bdc73d61086d49c631fa2ed23cef3c_42051_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="Websites选项卡"
class="gallery-image"
data-flex-grow="843"
data-flex-basis="2025px"
></p>
<p>Add a site</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/Add-a-site-1703431646658-2.png"
width="1339"
height="422"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/Add-a-site-1703431646658-2_hu8f873858be2c9db38dfb7acd007ec098_34235_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/Add-a-site-1703431646658-2_hu8f873858be2c9db38dfb7acd007ec098_34235_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="Add a site"
class="gallery-image"
data-flex-grow="317"
data-flex-basis="761px"
></p>
<p>在输入框中输入域名</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/free-plan-1703431646658-3.png"
width="1138"
height="363"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/free-plan-1703431646658-3_hu11f62a2e9324b69e5e68691630c9ae85_32031_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/free-plan-1703431646658-3_hu11f62a2e9324b69e5e68691630c9ae85_32031_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="选择计划"
class="gallery-image"
data-flex-grow="313"
data-flex-basis="752px"
></p>
<p>DNS设置</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/dns-process-1703431646658-4.png"
width="1146"
height="315"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/dns-process-1703431646658-4_hu78c0ad1a252729695f0113966e4b873e_29600_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/dns-process-1703431646658-4_hu78c0ad1a252729695f0113966e4b873e_29600_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="DNS设置流程"
class="gallery-image"
data-flex-grow="363"
data-flex-basis="873px"
></p>
<p>这里可以直接继续，然后回到域名停放服务商，更改如下配置，一般找到含有<code>nameservers</code>相关选项更改</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/remove-nameservers-1703431646658-5.png"
width="664"
height="197"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/remove-nameservers-1703431646658-5_hu0991bab1d81ed4e849724f6dc9c15a73_14895_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/remove-nameservers-1703431646658-5_hu0991bab1d81ed4e849724f6dc9c15a73_14895_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="移除记录"
class="gallery-image"
data-flex-grow="337"
data-flex-basis="808px"
></p>
<p>添加记录</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/add-record-1703431646658-6.png"
width="497"
height="61"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/add-record-1703431646658-6_hu5b12ed5c109849f678f11a27e82b3294_3198_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/add-record-1703431646658-6_hu5b12ed5c109849f678f11a27e82b3294_3198_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="添加记录"
class="gallery-image"
data-flex-grow="814"
data-flex-basis="1955px"
></p>
<p>完成</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/finish-1703431646659-10.png"
width="364"
height="147"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/finish-1703431646659-10_hu3412975a4d379893495aef65e5960629_3725_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/finish-1703431646659-10_hu3412975a4d379893495aef65e5960629_3725_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="完成DNS设置"
class="gallery-image"
data-flex-grow="247"
data-flex-basis="594px"
></p>
<p>和http、https有关的设置</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/http-config-1703431646659-7.png"
width="1025"
height="623"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/http-config-1703431646659-7_hu6f8a78434ff477d1a75fd5eae53d528a_26737_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/http-config-1703431646659-7_hu6f8a78434ff477d1a75fd5eae53d528a_26737_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="http设置"
class="gallery-image"
data-flex-grow="164"
data-flex-basis="394px"
></p>
<p>接下来就是检查设置完成状态（完成后会发送邮件）</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/check-nameservers-1703431646659-8.png"
width="706"
height="88"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/check-nameservers-1703431646659-8_hu88d8e5a4a3d9e50ceff9b118e6bd6b52_8171_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/check-nameservers-1703431646659-8_hu88d8e5a4a3d9e50ceff9b118e6bd6b52_8171_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="检测状态"
class="gallery-image"
data-flex-grow="802"
data-flex-basis="1925px"
></p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/finish-dns-1703431646659-9.png"
width="775"
height="127"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/finish-dns-1703431646659-9_hud3edb89a0d9a7b7e11d4f3bb61606e9b_13107_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/finish-dns-1703431646659-9_hud3edb89a0d9a7b7e11d4f3bb61606e9b_13107_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="完成设置DNS"
class="gallery-image"
data-flex-grow="610"
data-flex-basis="1464px"
></p>
<h2 id="修改记录">修改记录</h2>
<p>左侧DNS设置</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/point-to-server-1703431646659-11.png"
width="286"
height="216"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/point-to-server-1703431646659-11_hu4f897ae621fa163b69c97021f7b147d4_7049_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/point-to-server-1703431646659-11_hu4f897ae621fa163b69c97021f7b147d4_7049_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="DNS记录设置"
class="gallery-image"
data-flex-grow="132"
data-flex-basis="317px"
></p>
<p>修改记录，使用一条A记录指向VPS主机</p>
<h2 id="ssl-tls设置">SSL TLS设置</h2>
<p>采用Strict模式（四种模式区别主要在于是否采用加密，是否采用VPS到Cloudflare之间加密）</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/full-strict-1703431646659-12.png"
width="1187"
height="1087"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/full-strict-1703431646659-12_hua54376800dd87b23b702f55dc1c8867e_85821_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/full-strict-1703431646659-12_hua54376800dd87b23b702f55dc1c8867e_85821_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="Full模式"
class="gallery-image"
data-flex-grow="109"
data-flex-basis="262px"
></p>
<p>证书类别</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/certificate-1703431646659-14.png"
width="267"
height="203"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/certificate-1703431646659-14_hu0b7d61e33e989c58078b6026d1941925_7156_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/certificate-1703431646659-14_hu0b7d61e33e989c58078b6026d1941925_7156_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="证书类别"
class="gallery-image"
data-flex-grow="131"
data-flex-basis="315px"
></p>
<p>边缘证书：指从用户浏览器到Cloudflare之间的加密证书</p>
<p>服务端证书：指Cloudflare到VPS之间加密证书</p>
<p>边缘证书是已经设置好的，会自动续期，不需要更改这里的配置</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/edge-cert-1703431646659-15.png"
width="1204"
height="630"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/edge-cert-1703431646659-15_hue2aab44c47e4b1923930687ce25a9186_58730_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/edge-cert-1703431646659-15_hue2aab44c47e4b1923930687ce25a9186_58730_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="边缘证书"
class="gallery-image"
data-flex-grow="191"
data-flex-basis="458px"
></p>
<p>设置客户端证书</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/client-cert-1703431646659-13.png"
width="1189"
height="980"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/client-cert-1703431646659-13_hu66016e68f0c881215e06e1c084900265_56044_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/client-cert-1703431646659-13_hu66016e68f0c881215e06e1c084900265_56044_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="客户端证书"
class="gallery-image"
data-flex-grow="121"
data-flex-basis="291px"
></p>
<p>把pem格式证书存到本地</p>
<p>设置Origin Server加密（Customize encryption of traffic between your origin server and Cloudflare.）</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/origin-server-enc-1703431646659-16.png"
width="1261"
height="314"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/origin-server-enc-1703431646659-16_hu7a4a440f00d773dc9890ff6e6dc10144_25636_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/origin-server-enc-1703431646659-16_hu7a4a440f00d773dc9890ff6e6dc10144_25636_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="Origin Server"
class="gallery-image"
data-flex-grow="401"
data-flex-basis="963px"
></p>
<p>设置说明</p>
<p><img src="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/origin-server-info-1703431646659-17.png"
width="1198"
height="539"
srcset="https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/origin-server-info-1703431646659-17_huc6fd4d9a9b0066430390e4df865530bd_45204_480x0_resize_box_3.png 480w, https://expanse.rsvp/p/%E4%BD%BF%E7%94%A8docker%E6%90%AD%E5%BB%BA%E7%AE%80%E5%8D%95%E9%9D%99%E6%80%81%E7%BD%91%E7%AB%99/origin-server-info-1703431646659-17_huc6fd4d9a9b0066430390e4df865530bd_45204_1024x0_resize_box_3.png 1024w"
loading="lazy"
alt="设置说明"
class="gallery-image"
data-flex-grow="222"
data-flex-basis="533px"
></p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl"># Origin Certificate Installation
</span></span><span class="line"><span class="cl">Save the certificate and private key below to your client. To save, Click to copy and paste the contents into different files on your client, e.g. example.com.pem and example.com.key
</span></span><span class="line"><span class="cl"># Origin Certificate
</span></span><span class="line"><span class="cl"># Private key
</span></span><span class="line"><span class="cl">Copy the contents of your private key below to your web server and set file permissions such that only your http server can access it. Additionally, you can optionally encrypt this file and provide a password to decrypt it during your origin web server startup. The private key data will not be stored at Cloudflare and will no longer be accessible once the creation is complete. Please make sure you have a local copy of this key.
</span></span></code></pre></td></tr></table>
</div>
</div><h1 id="nginx反向代理">Nginx反向代理</h1>
<p>在宿主机上安装nginx</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span><span class="lnt">6
</span><span class="lnt">7
</span><span class="lnt">8
</span><span class="lnt">9
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo apt update
</span></span><span class="line"><span class="cl">sudo apt install nginx
</span></span><span class="line"><span class="cl">sudo systemctl start nginx
</span></span><span class="line"><span class="cl">sudo systemctl <span class="nb">enable</span> nginx
</span></span><span class="line"><span class="cl"><span class="c1"># after config </span>
</span></span><span class="line"><span class="cl">sudo systemctl reload nginx
</span></span><span class="line"><span class="cl">sudo systemctl restart nginx
</span></span><span class="line"><span class="cl"><span class="c1"># stop</span>
</span></span><span class="line"><span class="cl">sudo systemctl stop nginx
</span></span></code></pre></td></tr></table>
</div>
</div><p>配置文件<code>xxxx.conf</code> 存放的位置<code>/etc/nginx/sites-available/[flag].conf</code></p>
<p>这里的域名和端口都需要按照个人的需求更改<code>[flag: 说明]</code>。</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span><span class="lnt">13
</span><span class="lnt">14
</span><span class="lnt">15
</span><span class="lnt">16
</span><span class="lnt">17
</span><span class="lnt">18
</span><span class="lnt">19
</span><span class="lnt">20
</span><span class="lnt">21
</span><span class="lnt">22
</span><span class="lnt">23
</span><span class="lnt">24
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">server <span class="o">{</span>
</span></span><span class="line"><span class="cl"> listen 80<span class="p">;</span>
</span></span><span class="line"><span class="cl"> <span class="k">return</span> <span class="m">301</span> https://<span class="nv">$host$request_uri</span><span class="p">;</span>
</span></span><span class="line"><span class="cl"><span class="o">}</span>
</span></span><span class="line"><span class="cl">server <span class="o">{</span>
</span></span><span class="line"><span class="cl"> server_name <span class="o">[</span>flag:domain<span class="o">]</span><span class="p">;</span>
</span></span><span class="line"><span class="cl"> listen <span class="m">443</span> ssl http2<span class="p">;</span>
</span></span><span class="line"><span class="cl"> ssl on<span class="p">;</span>
</span></span><span class="line"><span class="cl"> ssl_session_cache builtin:1000 shared:SSL:10m<span class="p">;</span>
</span></span><span class="line"><span class="cl"> ssl_protocols TLSv1 TLSv1.1 TLSv1.2<span class="p">;</span>
</span></span><span class="line"><span class="cl"> ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4<span class="p">;</span>
</span></span><span class="line"><span class="cl"> ssl_prefer_server_ciphers on<span class="p">;</span>
</span></span><span class="line"><span class="cl"> ssl_certificate /etc/nginx/<span class="o">[</span>flag:path to store key<span class="o">]</span>/<span class="o">[</span>flag:domain<span class="o">]</span>.pem<span class="p">;</span>
</span></span><span class="line"><span class="cl"> ssl_certificate_key /etc/nginx/<span class="o">[</span>flag:path to store key<span class="o">]</span>/<span class="o">[</span>flag:domain<span class="o">]</span>.key<span class="p">;</span>
</span></span><span class="line"><span class="cl"> location / <span class="o">{</span>
</span></span><span class="line"><span class="cl"> proxy_set_header Host <span class="nv">$host</span><span class="p">;</span>
</span></span><span class="line"><span class="cl"> proxy_set_header X-Real-IP <span class="nv">$remote_addr</span><span class="p">;</span>
</span></span><span class="line"><span class="cl"> proxy_set_header X-Forwarded-For <span class="nv">$proxy_add_x_forwarded_for</span><span class="p">;</span>
</span></span><span class="line"><span class="cl"> proxy_set_header X-Forwarded-Proto <span class="nv">$scheme</span><span class="p">;</span>
</span></span><span class="line"><span class="cl"> proxy_read_timeout 90<span class="p">;</span>
</span></span><span class="line"><span class="cl"> proxy_redirect http://<span class="o">[</span>flag:host ip<span class="o">]</span>:<span class="o">[</span>flag:host port<span class="o">]</span> https://<span class="o">[</span>flag:domain<span class="o">]</span><span class="p">;</span>
</span></span><span class="line"><span class="cl"> proxy_pass http://<span class="o">[</span>flag:host ip<span class="o">]</span>:<span class="o">[</span>flag:host port<span class="o">]</span><span class="p">;</span>
</span></span><span class="line"><span class="cl"> <span class="o">}</span>
</span></span><span class="line"><span class="cl"><span class="o">}</span>
</span></span></code></pre></td></tr></table>
</div>
</div><p>软链接<code>sudo ln -s /etc/nginx/sites-available/proxy.conf /etc/nginx/sites-enabled/</code>，完成配置之后重启nginx服务。</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo nginx -s reload
</span></span><span class="line"><span class="cl">sudo systemctl reload nginx
</span></span><span class="line"><span class="cl">sudo systemctl restart nginx
</span></span></code></pre></td></tr></table>
</div>
</div><h1 id="启动">启动</h1>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span><span class="lnt">6
</span><span class="lnt">7
</span><span class="lnt">8
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 根据当前目录Dockerfile生成image</span>
</span></span><span class="line"><span class="cl">docker build -t <span class="o">[</span>flag<span class="o">]</span> .
</span></span><span class="line"><span class="cl"><span class="c1"># 运行</span>
</span></span><span class="line"><span class="cl">docker run -d -p <span class="o">[</span>flag:host port<span class="o">]</span>:80 --name <span class="o">[</span>flag:container name<span class="o">]</span> <span class="o">[</span>flag:image name<span class="o">]</span>:<span class="o">[</span>flag:image tag<span class="o">]</span>
</span></span><span class="line"><span class="cl">sudo systemctl start nginx.service
</span></span><span class="line"><span class="cl">sudo systemctl <span class="nb">enable</span> nginx.service
</span></span><span class="line"><span class="cl"><span class="c1"># 检查nginx状态</span>
</span></span><span class="line"><span class="cl">systemctl status nginx
</span></span></code></pre></td></tr></table>
</div>
</div></description></item><item><title>ssh-Keygen与密钥格式</title><link>https://expanse.rsvp/p/ssh-keygen%E4%B8%8E%E5%AF%86%E9%92%A5%E6%A0%BC%E5%BC%8F/</link><pubDate>Sun, 05 Nov 2023 16:01:57 +0800</pubDate><guid>https://expanse.rsvp/p/ssh-keygen%E4%B8%8E%E5%AF%86%E9%92%A5%E6%A0%BC%E5%BC%8F/</guid><description><p>ssh-keygen是用于生成ssh密钥对的程序，可以生成多种非对称加密（如RSA、ECC等）的密钥对，用于SSH登录认证或者其他需要使用签名的场合等等（如Github登录或仓库Actions的运行等）。</p>
<h1 id="opensslssh-keygen">openssl&amp;ssh-keygen</h1>
<h2 id="两种生成密钥对的方法">两种生成密钥对的方法</h2>
<p>使用<code>ssh-keygen </code>加对应的<a class="link" href="https://en.wikipedia.org/wiki/Ssh-keygen#Command_syntax" target="_blank" rel="noopener"
>选项参数</a>即可生成相关的密钥对，生成一个默认的密钥对只需要运行<code>ssh-keygen</code>按照提示操作（默认目录是在家目录的.ssh目录中），以下是使用参数生成的密钥对，并指定目录</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">ssh-keygen -t rsa -b <span class="m">1024</span> -C <span class="s2">&#34;&#34;</span>
</span></span></code></pre></td></tr></table>
</div>
</div><p>生成RSA密钥对(1024bits)</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">openssl genrsa -out test.key <span class="m">1024</span>
</span></span></code></pre></td></tr></table>
</div>
</div><h2 id="openssl读取私钥">openssl读取私钥</h2>
<p>使用openssl读取私钥</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">openssl rsa -in test.key -text
</span></span></code></pre></td></tr></table>
</div>
</div><h2 id="私钥结构">私钥结构</h2>
<h3 id="rsa私钥">RSA私钥</h3>
<p>一个RSA私钥的结构中包含了如下的几个部分。</p>
<ol>
<li>$\text{n}$模数</li>
<li>$\text{e}$公共指数，默认为65537</li>
<li>$\text{d}$私钥</li>
<li>$\text{p(q)}$第一个大质数</li>
<li>$\text{q(p)}$第二个大质数</li>
<li>$\text{dp}:d\pmod{p-1}$dp</li>
<li>$\text{dq}:d\pmod{q-1}$dq</li>
<li>$\text{coefficient}:q^{-1}\pmod{p}$</li>
</ol>
<h4 id="使用python读取rsa私钥">使用Python读取RSA私钥</h4>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"><span class="line"><span class="cl"><span class="kn">from</span> <span class="nn">Crypto.PublicKey</span> <span class="kn">import</span> <span class="n">RSA</span>
</span></span><span class="line"><span class="cl"><span class="kn">from</span> <span class="nn">Crypto.Util.number</span> <span class="kn">import</span> <span class="o">*</span>
</span></span><span class="line"><span class="cl"><span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s2">&#34;test.key&#34;</span><span class="p">,</span><span class="s2">&#34;rb&#34;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
</span></span><span class="line"><span class="cl"> <span class="n">content</span> <span class="o">=</span> <span class="n">f</span><span class="o">.</span><span class="n">read</span><span class="p">()</span>
</span></span><span class="line"><span class="cl"><span class="n">key</span> <span class="o">=</span> <span class="n">RSA</span><span class="o">.</span><span class="n">import_key</span><span class="p">(</span><span class="n">content</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"><span class="k">assert</span> <span class="n">isPrime</span><span class="p">(</span><span class="n">key</span><span class="o">.</span><span class="n">q</span><span class="p">)</span> <span class="ow">and</span> <span class="n">isPrime</span><span class="p">(</span><span class="n">key</span><span class="o">.</span><span class="n">p</span><span class="p">)</span> <span class="ow">and</span> <span class="n">key</span><span class="o">.</span><span class="n">p</span><span class="o">*</span><span class="n">key</span><span class="o">.</span><span class="n">q</span><span class="o">==</span><span class="n">key</span><span class="o">.</span><span class="n">n</span>
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl"><span class="nb">print</span><span class="p">(</span><span class="n">key</span><span class="o">.</span><span class="n">e</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"><span class="nb">print</span><span class="p">(</span><span class="n">key</span><span class="o">.</span><span class="n">n</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"><span class="nb">print</span><span class="p">(</span><span class="n">key</span><span class="o">.</span><span class="n">q</span><span class="p">)</span>
</span></span><span class="line"><span class="cl"><span class="nb">print</span><span class="p">(</span><span class="n">key</span><span class="o">.</span><span class="n">p</span><span class="p">)</span>
</span></span></code></pre></td></tr></table>
</div>
</div><h1 id="密钥格式">密钥格式</h1>
<p>输入的命令不同，生成的私钥内容也是有去别的，如果使用默认的<code>ssh-keygen</code>生成的私钥文件是无法通过Openssl直接读取的，如果想要通过Openssl命令读取rsa私钥文件，需要在生成的时候使用<code>openssl</code>命令。</p>
<p>这两种文件格式的开头和结尾也有区别，如果使用<code>ssh-keygen</code>命令直接创建，开头和结尾为：<code>-----BEGIN OPENSSH PRIVATE KEY-----</code>和<code>-----END OPENSSH PRIVATE KEY-----</code>此时生成的是ssh的密钥；如果使用Openssl命令并指定的加密算法创建密钥对，生成的密钥对的开头和结尾是：<code>-----BEGIN PRIVATE KEY-----</code>和<code>-----END PRIVATE KEY-----</code>,这两种密钥对形式有相似，但是并不是一样的密钥类型，无法使用<code>openssl rsa .....</code>命令读取ssh-keygen生成的ssh密钥，所以使用openssl命令读取ssh-keygen的私钥的时候无法成功。</p>
<h1 id="reference">Reference</h1>
<p><a class="link" href="https://en.wikipedia.org/wiki/OpenSSL" target="_blank" rel="noopener"
>OpenSSL - wiki</a></p>
<p><a class="link" href="https://www.openssl.org/" target="_blank" rel="noopener"
>OpenSSL - Toolkit</a></p>
<p><a class="link" href="https://en.wikipedia.org/wiki/Ssh-keygen" target="_blank" rel="noopener"
>ssh-keygen - wiki</a></p>
<p><a class="link" href="https://man.openbsd.org/OpenBSD-current/man1/ssh-keygen.1#NAME" target="_blank" rel="noopener"
>ssh-keygen manual</a></p>
<p><a class="link" href="https://security.stackexchange.com/questions/29876/what-are-the-differences-between-ssh-generated-keysssh-keygen-and-openssl-keys" target="_blank" rel="noopener"
>What are the differences between ssh generated keys(ssh-keygen) and OpenSSL keys (PEM)and what is more secure for ssh remote login?</a></p>
<p>[<a class="link" href="https://superuser.com/questions/1679344/for-valid-pem-i-get-unable-to-load-private-key-by-openssh" target="_blank" rel="noopener"
>For valid PEM I get unable to load private key by openssh</a>](<a class="link" href="https://superuser.com/questions/1679344/for-valid-pem-i-get-unable-to-load-private-key-by-openssh" target="_blank" rel="noopener"
>https://superuser.com/questions/1679344/for-valid-pem-i-get-unable-to-load-private-key-by-openssh</a>)</p>
<p><a class="link" href="https://blog.cryptohack.org/twitter-secrets" target="_blank" rel="noopener"
>RECOVERING A FULL PEM PRIVATE KEY WHEN HALF OF IT IS REDACTED</a></p>
<p><a class="link" href="https://pycryptodome.readthedocs.io/en/latest/src/public_key/rsa.html" target="_blank" rel="noopener"
>PyCryptodome - readthedocs</a></p></description></item><item><title>Mac搭建环境</title><link>https://expanse.rsvp/p/mac%E6%90%AD%E5%BB%BA%E7%8E%AF%E5%A2%83/</link><pubDate>Sun, 10 Sep 2023 17:25:39 +0800</pubDate><guid>https://expanse.rsvp/p/mac%E6%90%AD%E5%BB%BA%E7%8E%AF%E5%A2%83/</guid><description><h1 id="前言">前言</h1>
<p>本文主要记录的是CTF比赛 Crypto类中环境的搭建，根据本人的需要会随时更新文章，等不更新了就说明环境基本没什么变化了。</p>
<h1 id="系统">系统</h1>
<p>Homebrew的安装(二进制文件安装似乎不是很好用，总是报错)：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span><span class="lnt">6
</span><span class="lnt">7
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># https://brew.sh/index_zh-cn</span>
</span></span><span class="line"><span class="cl"><span class="c1"># 或者使用命令；</span>
</span></span><span class="line"><span class="cl"><span class="c1"># 访问bin：https://github.com/Homebrew/brew/releases/tag/4.1.9，使用pkg安装</span>
</span></span><span class="line"><span class="cl">/bin/bash -c <span class="s2">&#34;</span><span class="k">$(</span>curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/uninstall.sh<span class="k">)</span><span class="s2">&#34;</span> <span class="c1"># 卸载</span>
</span></span><span class="line"><span class="cl">/bin/bash -c <span class="s2">&#34;</span><span class="k">$(</span>curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh<span class="k">)</span><span class="s2">&#34;</span><span class="c1"># 安装</span>
</span></span><span class="line"><span class="cl">brew doctor
</span></span><span class="line"><span class="cl">brew cleanup
</span></span></code></pre></td></tr></table>
</div>
</div><p>go环境安装：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># https://go.dev/dl/</span>
</span></span><span class="line"><span class="cl">brew install go
</span></span></code></pre></td></tr></table>
</div>
</div><p>hugo安装：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre tabindex="0" class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span></code></pre></td>
<td class="lntd">
<pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">sudo chown -R <span class="k">$(</span>whoami<span class="k">)</span> /usr/local/opt
</span></span><span class="line"><span class="cl">chmod u+w /usr/local/opt
</span></span><span class="line"><span class="cl">brew install hugo
</span></span></code></pre></td></tr></table>
</div>
</div><h1 id="python">python</h1>