23 Dec 2021 
Matteo Mattei 
nodejs 
Nowadays every Nodejs application should be converted to ES6 module because it brings several benefits:
- Modules may be executed any number of times, but are loaded only once, thus improving performance.
- Module scripts may be shared by multiple applications.
- Modules help identify and remove naming conflicts.
The biggest difference between standard javascript library and an ES6 module is how we include a library (which can be either within your project or external). The standard classic way is to use const library = require(‘library-name’) but with ES6 modules we have to use import library from ‘library-name’.
In order to support the import keyword you have to add the following line to the package.json of your application:
In this way you are telling npm that your application is a pure ES6 module.
Then you have to change all require(xxx) statements with import xxx from ‘yyy’. In case you want to use an external library which is not a pure ES6 module you can always include it with this syntax:
import theNameYouWant from 'official-library-name'
In case you want to use a library which is placed inside your application you can use this syntax:
import theNameYouWant from './path/to/mylibrary.js'
And mylibrary.js can export a default object with all functions like this:
import axios from 'axios';
export default {
run: function(){
console.log('run');
},
sum: function(x, y){
console.log(`Sum is ${x+y}`);
},
get: async function(){
return await axios.get('https://github.com/matteomattei/matteomattei.github.io/raw/master/public/logo_professtional.jpg');
}
}
And can be used in this way:
import mylib from './path/to/mylibrary.js'
mylib.run(); // prints 'run'
mylib.sum(2,3); // prints 'Sum is 5';
let getResult = await mylib.get();
console.log(Buffer.from(getResult.data).length); // prints the size of the image
You can also export single functions from your library like this:
import axios from 'axios';
export function run() {
console.log("run");
}
export function sum(x, y) {
console.log(`Sum is ${x + y}`);
}
export async function get() {
return await axios.get(
"https://github.com/matteomattei/matteomattei.github.io/raw/master/public/logo_professtional.jpg"
);
}
In this case you have to use it in this way:
import * as mylib from './path/to/mylibrary.js'
mylib.run(); // prints 'run'
mylib.sum(2,3); // prints 'Sum is 5';
let getResult = await mylib.get();
console.log(Buffer.from(getResult.data).length); // prints the size of the image
Otherwise you can selectively import only the function you need:
import {run, sum, get} from './path/to/mylibrary.js'
run(); // prints 'run'
sum(2,3); // prints 'Sum is 5';
let getResult = await get();
console.log(Buffer.from(getResult.data).length); // prints the size of the image
Remember:
- You have to add type: “module” to your package.json file.
- You can use await directly in your main module without a wrap of an async function.
- Your code must be implicitly strict.
26 Dec 2020 Matteo Mattei security nodejs server tcp certificates openssl In order to communicate securely between server and client it is important not only to cipher the channel but also trust both endpoints. To do this, a common practice is to do mutual authentication between client and server.
In this post I show you how to implement mutual authentication in Nodejs.
Assume we want to create a mutual authentication channel between a server running on server.aaa.com and a client running on client.bbb.com. Keep in mind the domain names because they are important in the certificates creation.
First of all we need to generate certificates. Obviously you can use certificates released by any certification authority but for the purpose of the article I am going to create self signed certificates and related CA.
Step 1: Create a working folder and setup hosts file
// AS USER
$ mkdir ~/mutual_authentication_example
$ cd ~/mutual_authentication_example
// AS ROOT
# echo '127.0.0.1 server.aaa.com' >> /etc/hosts
# echo '127.0.0.1 client.bbb.com' >> /etc/hosts
Step 2: Generate server certificates
We are going to create a Certification Authority (CA) certificate for the server with 1 year validity and the related key.
$ openssl req -new -x509 -days 365 -keyout server-ca-key.pem -out server-ca-crt.pem
Generating a RSA private key
...........................................................................................+++++
.......................................+++++
writing new private key to 'ca-key.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:IT
State or Province Name (full name) [Some-State]:Florence
Locality Name (eg, city) []:Campi Bisenzio
Organization Name (eg, company) [Internet Widgits Pty Ltd]:AAA Ltd
Organizational Unit Name (eg, section) []:DevOps
Common Name (e.g. server FQDN or YOUR name) []:aaa.com
Email Address []:info@aaa.com
The PEM pass phrase is optional. The other questions are not mandatory but it’s better if you answer all. The most important question is the Common Name which should be the server main domain (aaa.com).
Now we generate the actual server certificate which will be used in the ssl handshake. First of all we have to generate a random key (4096 bit length in our example):
$ openssl genrsa -out server-key.pem 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
.........++++
...................++++
e is 65537 (0x010001)
Then generate a Certificate Signing Request (CSR) with the key we have generated:
$ openssl req -new -sha256 -key server-key.pem -out server-csr.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:IT
State or Province Name (full name) [Some-State]:Florence
Locality Name (eg, city) []:Campi Bisenzio
Organization Name (eg, company) [Internet Widgits Pty Ltd]:AAA Ltd
Organizational Unit Name (eg, section) []:DevOps
Common Name (e.g. server FQDN or YOUR name) []:server.aaa.com
Email Address []:info@aaa.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Pay attention to the Common Name which must have the same name of the host will serve the application (server.aaa.com). As final step, generate the server certificate (validity 1 year) from the CSR previously created and sign it with the CA key:
$ openssl x509 -req -days 365 -in server-csr.pem -CA server-ca-crt.pem -CAkey server-ca-key.pem -CAcreateserial -out server-crt.pem
Signature ok
subject=C = IT, ST = Florence, L = Campi Bisenzio, O = AAA Ltd, OU = DevOps, CN = server.aaa.com, emailAddress = info@aaa.com
Getting CA Private Key
Enter pass phrase for server-ca-key.pem:
The password requested is the one inserted during CA key generation. To verify the certificate signature against the CA you can issue the following command:
$ openssl verify -CAfile server-ca-crt.pem server-crt.pem
server-crt.pem: OK
Now we have all the server certificates we need!
-rw-rw-r-- 1 matteo matteo 1440 dic 26 12:52 server-ca-crt.pem
-rw-rw-r-- 1 matteo matteo 41 dic 26 17:48 server-ca-crt.srl
-rw------- 1 matteo matteo 1854 dic 26 12:51 server-ca-key.pem
-rw-rw-r-- 1 matteo matteo 1671 dic 26 17:48 server-crt.pem
-rw-rw-r-- 1 matteo matteo 1785 dic 26 17:34 server-csr.pem
-rw------- 1 matteo matteo 3243 dic 26 17:30 server-key.pem
Step 3: Generate client certificates
Now it’s time to do the same steps for the Client. First of all create a Certification Authority (CA) certificate for the client with 1 year validity and the related key.
$ openssl req -new -x509 -days 365 -keyout client-ca-key.pem -out client-ca-crt.pem
Generating a RSA private key
..........................................................+++++
.............................................+++++
writing new private key to 'client-ca-key.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:IT
State or Province Name (full name) [Some-State]:Rome
Locality Name (eg, city) []:Rome
Organization Name (eg, company) [Internet Widgits Pty Ltd]:BBB Ltd
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:bbb.com
Email Address []:info@bbb.com
The PEM pass phrase is optional. The other questions are not mandatory but it’s better if you answer all. The most important question is the Common Name which should be the client main domain (bbb.com).
Now we generate the actual client certificate which will be used in the ssl handshake. First of all we have to generate a random key (4096 bit length in our example):
$ openssl genrsa -out client-key.pem 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
..............++++
........................................................................................++++
e is 65537 (0x010001)
Then generate a Certificate Signing Request (CSR) with the key we have generated:
$ openssl req -new -sha256 -key client-key.pem -out client-csr.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:IT
State or Province Name (full name) [Some-State]:Rome
Locality Name (eg, city) []:Rome
Organization Name (eg, company) [Internet Widgits Pty Ltd]:BBB Ltd
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:client.bbb.com
Email Address []:info@bbb.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Pay attention to the Common Name which must have the same name of the host will serve the application (client.bbb.com). As final step, generate the client certificate (validity 1 year) from the CSR previously created and sign it with the CA key:
$ openssl x509 -req -days 365 -in client-csr.pem -CA client-ca-crt.pem -CAkey client-ca-key.pem -CAcreateserial -out client-crt.pem
Signature ok
subject=C = IT, ST = Rome, L = Rome, O = BBB Ltd, CN = client.bbb.com, emailAddress = info@bbb.com
Getting CA Private Key
Enter pass phrase for client-ca-key.pem:
The password requested is the one inserted during CA key generation. To verify the certificate signature against the CA you can issue the following command:
$ openssl verify -CAfile client-ca-crt.pem client-crt.pem
client-crt.pem: OK
Now we have all the client certificates we need!
-rw-rw-r-- 1 matteo matteo 1350 dic 26 17:59 client-ca-crt.pem
-rw-rw-r-- 1 matteo matteo 41 dic 26 18:06 client-ca-crt.srl
-rw------- 1 matteo matteo 1854 dic 26 17:58 client-ca-key.pem
-rw-rw-r-- 1 matteo matteo 1586 dic 26 18:06 client-crt.pem
-rw-rw-r-- 1 matteo matteo 1712 dic 26 18:04 client-csr.pem
-rw------- 1 matteo matteo 3243 dic 26 18:03 client-key.pem
Step 4: Run the code!
Move all certificates in a folder called certs:
$ mkdir ~/mutual_authentication_example/certs
$ mv ~/mutual_authentication_example/*.pem ~/mutual_authentication_example/certs/
$ mv ~/mutual_authentication_example/*.srl ~/mutual_authentication_example/certs/
Now create a server.js application:
const fs = require("fs");
const https = require("https");
const options = {
key: fs.readFileSync(`${__dirname}/certs/server-key.pem`),
cert: fs.readFileSync(`${__dirname}/certs/server-crt.pem`),
ca: [
fs.readFileSync(`${__dirname}/certs/client-ca-crt.pem`)
],
// Requesting the client to provide a certificate, to authenticate.
requestCert: true,
// As specified as "true", so no unauthenticated traffic
// will make it to the specified route specified
rejectUnauthorized: true
};
https
.createServer(options, function(req, res) {
console.log(
new Date() +
" " +
req.connection.remoteAddress +
" " +
req.method +
" " +
req.url
);
res.writeHead(200);
res.end("OK!\n");
})
.listen(8888);
Now create a client.js application:
const fs = require("fs");
const https = require("https");
const message = { msg: "Hello!" };
const req = https.request(
{
host: "server.aaa.com",
port: 8888,
secureProtocol: "TLSv1_2_method",
key: fs.readFileSync(`${__dirname}/certs/client-key.pem`),
cert: fs.readFileSync(`${__dirname}/certs/client-crt.pem`),
ca: [
fs.readFileSync(`${__dirname}/certs/server-ca-crt.pem`)
],
path: "/",
method: "GET",
headers: {
"Content-Type": "application/json",
"Content-Length": Buffer.byteLength(JSON.stringify(message))
}
},
function(response) {
console.log("Response statusCode: ", response.statusCode);
console.log("Response headers: ", response.headers);
console.log(
"Server Host Name: " + response.connection.getPeerCertificate().subject.CN
);
if (response.statusCode !== 200) {
console.log(`Wrong status code`);
return;
}
let rawData = "";
response.on("data", function(data) {
rawData += data;
});
response.on("end", function() {
if (rawData.length > 0) {
console.log(`Received message: ${rawData}`);
}
console.log(`TLS Connection closed!`);
req.end();
return;
});
}
);
req.on("socket", function(socket) {
socket.on("secureConnect", function() {
if (socket.authorized === false) {
console.log(`SOCKET AUTH FAILED ${socket.authorizationError}`);
}
console.log("TLS Connection established successfully!");
});
socket.setTimeout(10000);
socket.on("timeout", function() {
console.log("TLS Socket Timeout!");
req.end();
return;
});
});
req.on("error", function(err) {
console.log(`TLS Socket ERROR (${err})`);
req.end();
return;
});
req.write(JSON.stringify(message));
It’s now time to test. Open a terminal and start the server:
Open another terminal and run the client:
$ node client.js
TLS Connection established successfully!
Response statusCode: 200
Response headers: {
date: 'Sat, 26 Dec 2020 17:26:13 GMT',
connection: 'close',
'transfer-encoding': 'chunked'
}
Server Host Name: server.aaa.com
Received message: OK!
TLS Connection closed!
On the first terminal (the server) will be logged a new connection:
$ node server.js
Sat Dec 26 2020 18:26:13 GMT+0100 (Central European Standard Time) ::ffff:127.0.0.1 GET /
Conclusions
Basically you have to explicitly include the CA of the server in the connection object of the client and vice versa. In this way the server will be able to verify the client certificate and the client will be able to verify the server certificate.
I hope this example can help you implementing a mutual authentication between your endpoints in your applications. You can download demo files from this GitHub repository.
24 Dec 2020 Matteo Mattei git bash shell linux Maintaining multiple git repositories might became a mess specially if you often switch from one folder to another and if you are used to work on different branches. Basically you have to type every time git branch on the terminal to make sure to work on the correct working copy.
If your OS is Linux (or MacOSx) and you have Bash installed, you can customize the Bash prompt to always show the current branch name in your working directory.
First of all type ensure your default shell is /bin/bash
matteo@barracuda ~ $ echo $SHELL
/bin/bash
Then edit ~/.bashrc file and add the following lines at the bottom:
parse_git_branch() {
git branch 2> /dev/null | sed -e '/^[^*]/d' -e 's/* \(.*\)/(\1)/'
}
PS1="\u@\h \[\e[32m\]\w \[\e[91m\]\$(parse_git_branch)\[\e[00m\]$ "
Basically we added the parse_git_branch() function which prints out the current git branch (if you are in a git project) and then reset the PS1 variable (the Bash prompt) calling the previously function.
Now you have to enable the new configuration just typing the following or doing a new login:
matteo@barracuda ~ $ . ~/.bashrc
Let’s try and see how it looks like:
matteo@barracuda ~ $ cd src/myproject
matteo@barracuda ~/src/myproject (master)$
That’s all! If you like to change colors or other PS1 parameters you can refer to the following resources:
23 Aug 2019 Matteo Mattei linux server ssh sftp If you have a linux server, openssh is almost always already present, so without any other tool you can configure a super secure SFTP chroot jail to allow your users to access the server limiting the visibility to their home directory.
Start creating a new linux system group called sftponly:
groupadd --system sftponly
We create a system group because we want an ID lower than 1000 so that every new user will take a sequential UID. Now open /etc/ssh/sshd_config and make sure to have the following lines:
PasswordAuthentication yes
ChallengeResponseAuthentication no
Now replace the line starting with Subsystem with the following:
Subsystem sftp internal-sftp
This line tells SSH to use its internal sftp subsytem to mange SFTP connections.
Now add the following lines at the bottom of the file:
Match Group sftponly
ChrootDirectory %h
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp
Basically the above section describes how to handle connections from users belonging to sftponly group. In particular we are telling SSH to chroot the users to their home directory, does not allow X11 and TCP forwarding and force to use the internal sftp interface.
After do that, restart ssh server to make the changes active:
Now the SFTP server is ready to be used but you must keep in mind some important rules otherwise it will not work!
- every user home directory must belong to root:root
- every user home directory must have 0755 permissions
- every user must belong to sftponly group
- every first level folder in user home directory must belong to ${USER}:sftponly
Let’s do an example: create a new user matteo with no login shell, assign it to sftpgroup group and set a password:
useradd --create-home --shell /usr/sbin/nologin --user-group matteo
usermod --groups sftponly matteo
passwd matteo
Assuming you want the following permissions:
mkdir /home/matteo/pics # write access by user matteo
mkdir /home/matteo/musics # write access by user matteo
mkdir /home/matteo/logs # read only access by user matteo
Configure the folders in this way:
chown root:root /home/matteo
chmod 755 /home/matteo
chown matteo:sftponly /home/matteo/pics
chown matteo:sftponly /home/matteo/musics
chown matteo:sftponly /home/matteo/logs
chmod 555 /home/matteo/logs
Now try with sftp command line client or with filezilla and test your new SFTP server. Files created from an SFTP session will belong to matteo:matteo.
As you can understand, this configuration is very useful for web servers running with PHP-FPM where every VirtualHost runs with its own user and privileges, so you can restrict the access by user with a secure SFTP connection and at the same time avoid all the problems related to the files permissions management and the configuration of a separated FTP/FTPS server.
I hope you enjoy this article. If you like it please leave a comment!
21 Aug 2019 Matteo Mattei linux server ssh rsyslog python In order to monitor SSH access we can rely on rsyslog given all SSH accesses are recorded in /var/log/auth.log. Start creating a custom rsyslog configuration /etc/rsyslog.d/90-ssh.conf with the following content:
Basically we are telling rsyslog to look for lines where the program name is sshd and the message contains the session opened for user. Every time the above condition is matched, rsyslog will call the script we are going to create passing the entire log line as parameter.
Assuming we want to receive an email with the user that have been logged, open your editor and create the file /usr/local/bin/log_access.py:
Make the file executable:
chmod +x /usr/local/bin/log_access.py
Remember to fill the SMTP data at the beginning of the script. As you can see the above script also logs all logins to /var/log/logins.log.
Feel free to do what you want in the python script, the above it’s only an example!
Now restart rsyslog and try if everything works as expected.
/etc/init.d/rsyslog restart
Let me know your work cases and if this article can help you!
