All posts by Don Matteo

lebt in Zürich, ist System Engineer MCP bei A-Enterprise GmbH. Mitglied des UNBLOG Network. Author und Blogger zu den Themen, Linux und Open Source. Tutorials für Windows, VMware, Synology, Fortinet.

How to apply cURL in the Linux practice

cURL – Client for URLs Program Library and Command Line Program

cURL is a command line tool that allows you to transfer files from shell or bash scrips via protocols such as http, https, ftp, gopher, sftp, ftps or scp. cURL 1997 developed by Daniel Stenberg is very popular with website developers and is licensed under the open source MIT license.

Unique operating systems include cURL in the standard. Many Embedded Linux systems include cURL, as with Synology, cURL is also ported for Windows and is available in the 64 bit and 32 bit versions. PHP supports the cURL functions with the libcrul library.

cURL offers a wide range of applications, so websites can be remotely controlled and tested, forms can be filled out automatically, information from websites can be checked and processed into other processes. In the Linux Shell Console, the installation of wget is not mandatory, but cURL contains extensive parameters and options, and is already pre-installed.

The following are some examples of how to use cURL in the shell console, so web pages can be retrieved as follows.

$ curl http://example.com/seite.html

This reads the file page.html and outputs it on the standard output. If you want to save the file under the name mypage.html, the following command is used:

$ curl -o mysite.html http://example.com/site.html

Connections to IPv6 hosts are initialized as follows.

$ curl "http://[2001:1234:1234:1::40]/"

  The IPv6 address must be enclosed in square brackets.

View your own Internet IP address with cURL.

$ curl ipline.ch

When a URL has changed, the web page is often redirected to the new URL address, often also http to https redirects. Since cURL does not follow forwards in the standard configuration, you have to pass the parameter -L in this case.

For web pages with self-issued certificate, or outdated TLS v1.0 encryption algorithm, the -k parameter must be applied to allow insecure connections.

$ curl -k https://router.local

When a web site requests user authentication over HTTP, cURL can pass username and password, separated by a colon.

$ curl -u username:password http://www.example-shop.com/

Read the HTTP header with cURL.

$ curl --head http://www.google.com/

The –head parameter instructs cURL to give the output of the HTTP header to the default output. If you want to write the header to the header.txt file, you could do so by pipe operators in the shell, or without the support of the shell by the –dump-header parameter.

$ curl --dump-header headers.txt http://www.google.com/

The current version 7.63 supports the following protocols: DICT, FILE, FTP, FTPS, Gopher, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, POP3, POP3S, RTMP, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, Telnet and TFTP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP.

cURL’s FTP client can also interact with FTP servers.

$ curl ftp://username:password@ftp-server.com

cURL is instructed to output the index of the main directory. Username and password are passed directly with the URL. If you want to list the files subdirectory on the FTP server, it is sufficient to enter the directory to the URL:

$ curl ftp://username:password@ftp-server.com/files/

With cURL an upload is also possible, for this you pass the parameter -T followed by the file name and if necessary.dem path.

$ curl -T meineseite.html -u username:password ftp://ftp-server.com/docs/deineseite.html

Through this command, cURL copies the mypage file.html to the FTP server to the docs directory under the file names yourpage.html.

Preferably, you should use SFTP, where the file.txt is retrieved over an encrypted connection.

$ curl --ftp-ssl ftp://ftp-server.com/datei.txt

The file transfer also goes via SCP, here the file.txt transferred from the directory docs.

$ curl -u username scp://server.com/docs/datei.txt

For automated processes via scripts, the user login is not suitable, here you can authenticate with a private key.

$ curl -u username: --key ~/.ssh/id_rsa scp://server.com/~/datei.txt

The file .txt is transferred from the server’s home directory.

cURL can also be used with Server Message Block (SMB), such as MS LAN Manager and Samba.

$ curl -u "domain\username:passwd" smb://server.server.com/freigabe/datei.txt

Access to file.txt via sharing on a Samba server.

cURL can do even more, the following command line downloads a shell script file and runs it immediately, starting with a period (.).

$ . <(curl -s https://ipline.ch/echo/sysinfo.txt)

This command is executable in a Linux bash shell, system configurations and logs are read out and compiled in one file, and stored as a file under /tmp/sysinfo-*.html.

The following code sample for PHP, the result of search on Google is output with echo $result:

<?php
$cSession = curl_init(); 
curl_setopt($cSession,CURLOPT_URL,"http://www.google.com/search?q=think tank");
curl_setopt($cSession,CURLOPT_RETURNTRANSFER,true);
curl_setopt($cSession,CURLOPT_HEADER, false); 
$result=curl_exec($cSession);
curl_close($cSession);
echo $result;
?>

A look at man curl can be useful, here are all commands with examples of cURL.

curl(1) Curl Manual curl(1)

Name
       curl - transfer a URL

Synopsis
       Curl  

DESCRIPTION
       curl is a tool to transfer dat[options]a[URL...] from or to a server, using one of the supported protocols (DICT, FILE, FTP,
       FTPS, GOPHER, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, POP3, POP3S, RTMP, RTSP, SCP, SFTP, SMTP, SMTPS, TELNET
       and TFTP).  The command is designed to work without user interaction.

       curl offers a busload of useful tricks like proxy support, user authentication, FTP upload, HTTP post, SSL
       connections, cookies, file transfer resume, Metalink, and more. As you will see below, the number of features
       will make your head spin!

       curl is powered by libcurl for all transfer-related features. Lake libcurl(3) for details.

Url
       The URL syntax is protocol-dependent. You'll find a detailed description in RFC 3986.

       You can specify multiple URLs or parts of URLs by writing part sets within braces as in:

http://site. "one,two,three".com

or you can get sequences of alphanumeric series by using[] as in:

ftp://ftp.numericals.com/file.txt
[1-100]        ftp://ftp.numericals.com/file.t[001-100]xt (with leading zeros)
        ftp://ftp.letters.com/file[a-z].txt
...

cURL Online Manual
Sources Link: curl.haxx.se

Install Lets Encrypt on Linux with Apache

Install Lets Encrypt Certbot on CentOS Linux with Apache.

Let’s Encrypt is a certification authority that offers free X.509 certificates for Transport Layer Security (TLS). This tutorial explains how to perform Let’s Encrypt SSL install the ACME process with certbot and how to implement Lets Encrypt on a CentOS Linux host with Apache web server.

Assuming that the Apache web server is already installed, the domain is configured as Apache VirtualHost, and the domain is dissolvable in DNS, with an A-record in the forward zone of that domain, or a quad-A record for the server is entered for IPv6. Furthermore, the server must be accessible via port 80 for the ACME Challenge.

For installation we want to become root.

$ su -
Password:
Last login: Tue Jan 15 06:25:52 CET 2019 on pts/0

Install the EPEL repository followed by the certbot package.

$ yum -y install epel-release
$ yum -y install mod_ssl python-certbot-apache

Now restart the Apache web server.

$ systemctl restart httpd

Release the firewall for SSL with the service port 443.

$ firewall-cmd --add-service=https
$ firewall-cmd --runtime-to-permanent

Now let the certbot generate the SSL certificate.

$ certbot --apache -d mydomain.com -d www.mydomain.com

The first domain should be the base domain. In this example, it is called mydomain.com to replace it with the actual domain name.

The output of the certbot looks something like this.

certbot --apache -d mydomain.com -d www.mydomain.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for mydomain.com
Waiting for verification...
Cleaning up challenges
Resetting dropped connection: acme-v02.api.letsencrypt.org
Created to SSL vhost at /etc/httpd/conf.d/mydomain-ssl.conf
Deploying Certificate to VirtualHost /etc/httpd/conf.d/mydomain-le-ssl.conf

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number[1-2] then [enter](press 'c' to cancel): 2
Redirecting vhost in /etc/httpd/conf.d/mydomain.conf to ssl vhost in /etc/httpd/conf.d/mydomain-ssl.conf

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https://mydomain.com

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=mydomain.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/mydomain.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/mydomain.com/privkey.pem
   Your cert will expire on 2019-04-14. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot again
   with the "certonly" option. To non-interactively renew *all* of
   your certificates, run "certbot renew"
 - If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
   Donating to EFF: https://eff.org/donate-le

Finally, the Installed Lets Encrypt certificate on Linux can be tested.

$ curl -k https://mydomain.com

Get the URL in the browser and verify it with SSL Labs.

https://www.ssllabs.com/ssltest/analyze.html?d=mydomain.com

The installed Lets Encrypt certificate is valid for 90 days on the Linux. For the automatic renewal of the certificate, we create a new cron job.

$ crontab -e
 
0 0 * * 0 /usr/bin/certbot renew >> /var/log/certbot.log

The certificate is checked once a week at midnight for renewal.

Lets Encrypt Shell Access

We recommend that most people with shell access use the Certbot ACME client. It can automate certificate issuance and installation with no downtime. It also has expert modes for people who don’t want autoconfiguration. It’s easy to use, works on many operating systems, and has great documentation. Visit the Certbot site to get customized instructions for your operating system and web server.

If Certbot does not meet your needs, or you’d like to try something else, there are many more ACME clients to choose from. Once you’ve chosen ACME client software, see the documentation for that client to proceed.