GKE create cluster protoPayload.methodName="google.container.v1.ClusterManager.CreateCluster" All GKE cluster logs resource.type="gke_cluster" Access transparency logs logName="projects/[PROJECT_ID]/logs/cloudaudit.googleapis.com%2Faccess_transparency" OR jsonPayload.@type="type.googleapis.com/google.cloud.audit.TransparencyLog"
Nmap will list the ciphersuites of a server, and do some warning about old ones: nmap --script ssl-enum-ciphers -p 443 www.example.com
Gatekeeper/policycontroller cheat sheet. List all the constraint templates kubectl get constrainttemplates -l="configmanagement.gke.io/configmanagement=config-management" Get the status of a particular constraint, including logged violations: kubectl get k8sallowedrepos.constraints.gatekeeper.sh repo-is-gcr Get the policy controller logs: kubectl logs -n gatekeeper-system -l…
With docker changing its license and the general problem of running a super privileged daemon, I've been looking for alternatives. Here's what I've found to work. Gcrane for interacting with registries: go install github.com/google/go-containerregistry/cmd/gcrane@latest export PATH="${HOME}/go/bin:$PATH" gcrane pull ubuntu ubuntu.tar gcrane push ubuntu.tar gcr.io/my-project/ubuntu gcrane cp ubuntu…
There's quite a lot of vulnerabilities in the NVD that aren't really vulnerabilities but may show up in vulnerability scanners depending on the behavior of the scanner. Here's some examples of open vulnerabilities (pulled from a debian container that's up-to-date at the time of writing) that just aren't vulnerabilities at all: We don't ship that vulnerable script in kerberos That's how tar works…
Sadly GNOME seems to be missing (or has removed) options to disable all of the annoying stuff it's doing. To disable the stupid workspace switching animation you have to install an entire extension. I installed this one directly from github , the code is tiny, you can read it. To turn off the hotcorner that I continually accidentally hit there is apparently no longer a UI option, but running:…
Exec order is here , fact sheet summary . Good analysis from lawfare blog here . Share info on incidents (anything that impacts CIA according to 44 U.S.C. 3552(b)(2) , which could be read incredibly broadly) by amending gov contractual language. Zero trust all the things. Make a plan to adopt zero trust as defined by NIST. It's basically defense in depth plus least privilege and seems about as…
There are no logs available in the app, but there's quite a lot available from the diagnostic report API. It's in protobuf format, so someone wrote a handy little parser . go get github.com/benmanns/onhub/cmd/onhubdump ~/go/bin/onhubdump http://192.168.86.1/api/v1/diagnostic-report > logs.json $ jq 'keys' logs.json [ "commandOutputs", "fileLengths", "files", "networkConfig", "stormVersion",…
TIL about DNS CNAME "flattening" which is a cloudflare feature that allows you to put a CNAME at the domain root: something that is actually not allowed by the DNS RFC spec. Why does that matter? I was helping a nonprofit who is using a website hosting company, but the nonprofit has its own domain name. The hosting company tells them to "create a CNAME pointing at blahblah.somehosting.com" which…
This is a simple way to keep tabs on bandwidth provided by your ISP. It's also useful as a historical record to prove exactly when service got worse. The speedtest-cli is a python CLI for speedtest.net that has been dockerized by some kind folks. To get a self-appending CSV just run: /usr/bin/docker run --rm robertcsapo/speedtest --csv >> speedtest.csv Assuming you run docker passwordless…
Installing gatekeeper is easy: kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/master/deploy/gatekeeper.yaml We can see this creates configs and constrainttemplates CRDs: $ kubectl api-resources | grep gatekeeper.sh configs config.gatekeeper.sh true Config constrainttemplates templates.gatekeeper.sh false ConstraintTemplate The constraints based off the…
# Put a quote in front of the first alphabetic character on each line s!\([a-z]\)!"\1!c
Suppose you want to figure out which DNS server you're using and it is provided via DHCP. This can be surprisingly difficult. Suppose there's: Nothing in /etc/resolv.conf `dig google.com` shows your machine uses a local DNS server (local dnsmasq) /var/lib/dhcp/dhclient.leases looks...wrong I resorted to: sudo tcpdump -i eth0 -s0 -n 'udp port 53' Which is guaranteed to show you what's going on. It…
I tried two linux tools, exiv2 and exiftool. exiftool seems to be better. exiv2 View full exif data with this (the default view only gives you a summary): exiv2 -pa myimg.jpg Delete all exif data with this: exiv2 rm myimg.jpg There doesn't appear to be a way to just delete the GPS info with exiv2. exiftool Install: sudo apt-get install libimage-exiftool-perl View exif data: exiftool myimg.jpg…
Amazon lets you create a "household" to share content, but it's really not obvious how you make kindle content from the other adult turn up on your kindle. Once you have created a household you need to go into each device under your devices section in the web app . There you can click a box to "show content from [insert other adult's name]". Then when you sync your phone kindle app or your…
If you are using a Yubikey encryption scheme and want to add the key onto a new system there's a few hoops to jump through. These instructions are for Ubuntu trusty. First, get set up for using the yubikey: sudo apt-get install gnupg-agent scdaemon pcscd pcsc-tools you probably need to logout and back in. This post has extra setup , but I didn't have to do any of that, perhaps the gnome keyring…
Google found, and worked with the dnsmasq author to fix , a bunch of vulnerabilities in dnsmasq. Now everyone needs to update tons of devices, including your router. It's been a while since I updated this firmware so I had to figure it out from scratch again. AFAICT the procedure is to go find your router in the dd-wrt database . Hopefully it's supported. If it is you can go download the latest…
In this post I described how I set up gpg keys on a yubikey. Since I have multiple yubikeys for some redundancy I occasionally have to use a different one. This basically involves deleting the secret key and re-importing it from the yubikey. On OSX Open up GPG keychain and click through the scary warning to delete the secret keys. If you set it up right these are only stubs, the actual key is on…
gvm is a way to manage multiple go versions. It has some strange behaviour with go paths that I don't really understand. It essentially sets your GOPATH to a different directory for every version . You could just append your real go path , but it seems like there might be tooling that doesn't expect gopath to be a list . My solution was to: gvm install go1.8 gvm use go1.8 gvm pkgenv This pops…
A complement to the official kubectl cheat sheet . Getting kubectl There's better ways to install it for permanent use, but here's a quick way for temporary use: export PATH=/tmp:$PATH cd /tmp; curl -LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/amd64/kubectl; chmod 555 kubectl Nodes $ kubectl…
This is by no means comprehensive, it's just some things I've found useful. Get installed and auth'd : gcloud components install kubectl gcloud auth application-default login Creating a cluster with a specific version: gcloud config set compute/zone us-west1-b gcloud beta container clusters create permissions-test-cluster \ --cluster-version=1.6.1 \ --no-enable-legacy-authorization Upgrading GKE:…
Some gcloud commands I've found useful: # See config gcloud config list # Change default zone gcloud config set compute/zone us-central1-a # Copy a file, default zone gcloud compute copy-files some/file.txt cloud-machine-name:~/ # Copy a file, specifying zone for machine gcloud compute copy-files some/file.txt cloud-machine-name:~/ --zone=us-west1-a # Forward a port with ssh gcloud compute ssh…
With OS X Sierra Apple changed the ssh client key handling behavior. They aligned with OpenSSH behavior by not automatically loading passphrases from the keychain on login . More surprisingly, it now remembers your ssh key passphrase automatically by default . To disable this behavior you can add this to ~/.ssh/config: Host * UseKeyChain no As you can see in the radar report, deleting keys using…
When you are testing a new package version it's annoying to have your system management come and install the old version over the top of your test one. There's a bunch of ways to stop this , the one I tend to use on Ubuntu is: echo "package hold" | sudo dpkg --set-selections To undo the hold and go back to normal: echo "package install" | sudo dpkg --set-selections
The python version on your Ubunutu LTS may be slightly behind latest, or years behind, depending on the release cycle. Here's how to run a newer python without interfering with the system one. Note that setting an install prefix is necessary to avoid making this the default system python (which will break cinnamon-settings apps as well as possibly other things) . The prefix I chose puts it in a…