there’s some kind of bug with the grub in 18.04. no matter what you put in the timeout of the grub file, it always takes 30 seconds to boot. do the below. that should get your what you want.
sudo nano /etc/default/grub
#add the below line to your Grub
GRUB_RECORDFAIL_TIMEOUT=5
Ctrl-o
Ctrl-x
sudo update-grub
sudo grub-installIf you already have a vpn set up and established, you can use the following to setup DNS forwarding for your domain from your remote site to you main site. This is done in CLI which you can access from the web UI if you want.
configure
set service dns forwarding options server=/privdomain.local/192.168.1.50
set service dns forwarding options server=/privdomain.com/192.168.1.50
commit
save
exit
The following was lifted from here:
https://www.naschenweng.info/2017/01/06/securing-ubiquiti-unifi-cloud-key-encrypt-automatic-dns-01-challenge/
I’m reposting it so i have easy access to it. This is not my work, nor did I have anything to do with it.
curl https://get.acme.sh | sh
Exit the terminal and re-open it again. We will also enable auto-upgrade for acme.sh (the –accountemail will be used for Let’s Encrypt email notifications when certs are renewed):
acme.sh --upgrade --auto-upgrade --accountemail "mynotifaction@email.com"
To automate the certificate installation, create the file /root/.acme.sh/cloudkey-renew-hook.sh – no adjustments are needed:
#!/bin/bash
# Renew-hook for ACME / Let's encrypt
echo "** Configuring new Let's Encrypt certs"
cd /etc/ssl/private
rm -f /etc/ssl/private/cert.tar /etc/ssl/private/unifi.keystore.jks /etc/ssl/private/ssl-cert-snakeoil.key /etc/ssl/private/fullchain.pem
openssl pkcs12 -export -in /etc/ssl/private/cloudkey.crt -inkey /etc/ssl/private/cloudkey.key -out /etc/ssl/private/cloudkey.p12 -name unifi -password pass:aircontrolenterprise
keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /usr/lib/unifi/data/keystore -srckeystore /etc/ssl/private/cloudkey.p12 -srcstoretype PKCS12 -srcstorepass aircontrolenterprise -alias unifi
rm -f /etc/ssl/private/cloudkey.p12
tar -cvf cert.tar *
chown root:ssl-cert /etc/ssl/private/*
chmod 640 /etc/ssl/private/*
echo "** Testing Nginx and restarting"
/usr/sbin/nginx -t
/etc/init.d/nginx restart ; /etc/init.d/unifi restart
export CF_Key="YOUR-CLOUDFLARE-API-KEY"
export CF_Email="YOUR-CLOUDFLARE-EMAIL"
acme.sh --force --issue --dns dns_cf -d unifi.naschenweng.info --pre-hook "touch /etc/ssl/private/cert.tar; tar -zcvf /root/.acme.sh/CloudKeySSL_`date +%Y-%m-%d_%H.%M.%S`.tgz /etc/ssl/private/*" --fullchainpath /etc/ssl/private/cloudkey.crt --keypath /etc/ssl/private/cloudkey.key --reloadcmd "sh /root/.acme.sh/cloudkey-renew-hook.sh"
Since the Let’s Encrypt certificate needs to be renewed every 3 months, you need to configure the auto-renew via a cronjob through crontab -e and append the following to the end of the crontab:
# m h dom mon dow
command 0 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh/" >> /var/log/letsencrypt.log
I have a client that uses adsync to sync their local active directory with their office365 azure directory. I also have multi factor authentication, via the IOS Microsoft Authenticator, enabled for the administrator account. On a Windows 10 computer, here are the steps I have to perform to change a username locally and on office365.
On a local domain controller:
Change the username in active directory. I also change the Email address on the general tab and the proxyaddress on the attributes tab (you must have advanced features under view enabled in the ADUC MMC to see this tab).
On the AzureADSync computer/server:
Run the powershell command:
Start-ADSyncSyncCycle -PolicyType delta
On a Windows 10 management computer:
Using Internet Explorer, go to https://outlook.office365.com/ecp/?rfr=Admin_o365&exsvurl=1&mkt=en-US (Exchange Admin Center under the office 365 admin portal), click on Hybrid, click on the bottom link to download and install The Exchange Online PowerShell Module (second button).
Using the new Exchange Online PowerShell Module, run the following powershell commands (the last two connects require MFA; you don’t necessarily need all of this, but i use it to make sure i can perform all the commands i need at the time)
install-msonline
install-azuread
import-module msonline
import-module azuread
connect-exopssession
connect-msolservice
Now you’re authenticated and can change the user principal names to match your local active directory changes:
set-msoluserprincipalname -userprincipalname oldupn@domain.com -newuserprincipalname newupn@domain.com
To do the same thing in the future, start the Exchange Online PowerShell Module, run the two connects and then you can run the set-msoluserprincipalname.
This help text was compiled using Ubuntu 16.04 server LTS
Install Shinobi using the online documentation
Become a super user
sudo suMake sure your distribution is up to date
apt-get update
apt-get dist-upgradeFirst change the login email address and password for the super user in super.json
Create an md5 hash of your password
echo -n 'password' | md5sumCopy the result and edit the super.json file replacing the email and password with your info.
cd /home/user/Shinboi
nano super.jsonCtrl O, Enter to Save and Ctrl X to exit
Install certbot
apt-get update
apt-get install software-properties-common
add-apt-repository ppa:certbot/certbot
apt-get update
apt-get install certbotSetup the folder structure you are going to use for certbot
cd /home/user/Shinobi
mkdir certs
cd /home/user/Shinobi/web
mkdir -p .well-known/acme-challengeGenerate the certificate
certbot certonly --webroot -w /home/user/Shinobi/web -d shinobi.website.comEdit the Shinobi super configuration file to turn on SSL
nano conf.json{
"port": 80,
"addStorage": [
{
"name": "second",
"path": "__DIR__/videos2"
}
],
"db": {
"host": "127.0.0.1",
"user": "majesticflame",
"password": "",
"database": "ccio",
"port": 3306
},
"mail": {
"service": "gmail",
"auth": {
"user": "your_email@gmail.com",
"pass": "your_password_or_app_specific_password"
}
},
"ssl": {
"key": "/etc/letsencrypt/live/website.ssl.name/privkey.pem",
"cert": "/etc/letsencrypt/live/website.ssl.name/cert.pem",
"port": 443
},
"cron": {
"key": "change_this_to_something_very_random__just_anything_other_than_this"
},
"pluginKeys": {
"Motion": "change_this_to_something_very_random____make_sure_to_match__/plugins/motion/conf.json",
"OpenCV": "change_this_to_something_very_random____make_sure_to_match__/plugins/opencv/conf.json",
"OpenALPR": "SomeOpenALPRkeySoPeopleDontMessWithYourShinobi"
}
}Ctrl O, Enter to Save and Ctrl X to exit
Edit the Shinobi configuration file to add a static reference to the .well-known folder
nano cameras.jsHit Ctrl W, type //pages followed by enter to search for //pages
make it look like the below by adding this line of text – app.use('/.well-known',express.static(__dirname + '/web/.well-known'));
////Pages
app.enable('trust proxy');
app.use('/libs',express.static(__dirname + '/web/libs'));
app.use('/.well-known',express.static(__dirname + '/web/.well-known'));
app.use(bodyParser.json());Ctrl O, Enter to save and Ctrl X to quit
Restart Shinobi
pm2 start camera.js
pm2 start cron.jsProfit
Update 2019/04/02
I had to change the ssl code in the super configuration from the below to what is already above:
"ssl": {
"key": "/home/user/Shinobi/certs/privkey.pem",
"cert": "/home/user/Shinobi/certs/cert.pem",
"port": 443
},
I also changed the certbot command from the below to the above:
certbot certonly --webroot -w /home/user/Shinobi/web -d shinobi.website.com --cert-path /home/user/Shinobi/certs --key-path /home/user/Shinobi/certs --fullchain-path /home/user/Shinobi/certs --chain-path /home/user/Shinobi/certsIf you want to set a static IP address from the command prompt in Windows, use the following command in an elevated command prompt.
netsh interface ipv4 set address “Local Area Connection” static 10.0.0.55 255.0.0.0 10.0.0.1
where “Local Area Connection” is your network adapter name as shown in the Network and Sharing Center
where 10.0.0.55 is the ip address you wish to assign
where 255.0.0.0 is the subnet mask you wish to assign
where 10.0.0.1 is the default gateway you wish to assign.
The only thing required for Windows 2012 R2 Server LDAP over SSL is a trusted certificate in the personal store for the local machine (not user) and a REBOOT.
You do not need an Active Directory Certificate Authority or a publicly trusted certificate that matches the host name in the Subject or Subject Alternative (DNS) names. What this means is that you can use a public wildcard certificate; or a private wildcard certificate as long as your domain controllers trust the authority that issued it (put the certificate in both your trusted root and personal stores for the domain controllers).
The only other thing I did was add it to the SSL binding for the default site in IIS and then REBOOT. You absolutely have to reboot.
You also have to do this on ALL of your domain controllers.
You can test by using LDP on your domain controller. Connect to the domain controller with the SSL box ticked and the port set to 3269. Just when you think it’s going to time out, it should connect. If not, REBOOT.
If anyone is still having trouble with this, I just figured out how to do it using an existing Windows certificate. In my case, we have our own internal Certification Authority, but it will work just the same with a certificate issued by GoDaddy or anyone else.
I’m assuming you already know how to export the certificate using the Certificates MMC snap-in, and that the keytool executable from your installed java package is in the path.
1) Export PFX certificate with private key and the option “Include all certificates in the certification path if possible”, using password “aircontrolenterprise” (this is important!)
2) Open a Command Prompt and go to the directory Unifi was installed to then the data directory (example: C:\Users\administrator\Ubiquiti Unifi\data)
3) Find the alias of your exported certificate by using (use the password from step 1):
keytool -list -keystore c:\path\to\pfx.pfx -storetype pkcs12
It will list the certificate starting with its alias, for example:
Keystore type: PKCS12
Keystore provider: SunJSSE
Your keystore contains 1 entry
le-webserver2003-8f6daf5b-8c89-405f-b3bb-045c58656
Certificate fingerprint (MD5): AB:3F:79:FD:F5:1E:B3:69:78:8C:1C:AC:41:B3:29:6B
The certificate alias in this case is le-webserver2003-8f6daf5b-8c89-405f-b3bb-045c58656
4) Rename the existing file called “keystore” to keystore.orig.
5) Run the following command:
keytool -importkeystore -srcstoretype pkcs12 -srcalias src-alias -srckeystore c:\path\to\pfx.pfx -keystore keystore -destalias unifi
Use the same password from step 1.
6) Start the UniFi server.
Go to start, control panel, programs and features, view installed updates. it’s under windows and ends in KB3097877.
Uninstall it. Should be installed on the 11 or 12 of 11 / 2015. reboot