Prajithp

# using such a setup requires `apt-get install lua-nginx-redis` under Ubuntu Trusty
# more info @ http://wiki.nginx.org/HttpLuaModule#access_by_lua

http {
  lua_package_path "/etc/nginx/include.d/?.lua;;";
  lua_socket_pool_size 100;
  lua_socket_connect_timeout 10ms;
  lua_socket_read_timeout 10ms;
  
  server {

Prajithp

Wireguard setup on Ubuntu 16.04/18.04

Install

# sudo add-apt-repository ppa:wireguard/wireguard
# sudo apt-get update
# sudo apt-get install wireguard

Generate keys

Prajithp

# NOTE
#
#
# Use sed on the instance up to replace the INSTANCE_ID and DNS_RESOLVER with the following commands
#
####################################################################################################
# Fetch the private IP for resolving DNS dynamically in nginx
# We also need to escape the `.` from it for usage in later sed
#
# DNS_RESOLVER=`grep nameserver /etc/resolv.conf | cut -d " " -f2 | sed 's/\./\\./g'`

Prajithp

#!/usr/local/bin/python

"""
Requires Boto3 and AWSCLI configured
- accepts argument of profile name that needs to be rotated
- updates config upon aws access key rotation
"""

import boto3
import argparse

Prajithp

## Meant to be scheudled on a cron/timer of 90 days (CIS Benchmark)
## The target keys need permissions to rotate themselves

import boto3
from botocore.exceptions import ClientError
import os
from datetime import datetime
import shutil
from ConfigParser import SafeConfigParser

Prajithp

oldContainers="$(docker ps -f "status=exited" | grep -E 'Exited \(.*\) [5-9] h|Exited \(.*\) \d\d h' | awk '{ print $1 }')"

echo -e -n "\nRemoving containers older than 4 hours"

if [ "$oldContainers" != "" ]; then
  echo ""
  docker rm $oldContainers
else
  echo "...none found."
fi

Prajithp

#!/usr/bin/env perl

package My::Mojo::IOLoop;

use Mojo::Base 'Mojo::IOLoop';

use Scalar::Util 'weaken';

sub client {
  my ($self, $cb) = (_instance(shift), pop);

Prajithp

Via AWS CLI using jq

(https://github.com/mwilliamson/jq.py)

aws ec2 describe-instances | jq '.Reservations[].Instances[] | select(.KeyName == "MyKey") | select(.State.Code != 48) | select(.Tags[]|select(.Key=="Name")|select(.Value=="InstanceName")) | [ .PublicIpAddress]'
 
aws ec2 describe-instances | jq '.Reservations[].Instances[] | select(.KeyName == "MyKey") | select(.State.Code != 48) | select(.Tags[]|select(.Key=="Name")|select(.Value=="InstanceName")) | [ .PublicIpAddress, (.Tags[]|select(.Key=="Name").Value)]'

aws ec2 describe-instances | jq '.Reservations[].Instances[] | select(.KeyName == "MyKey") | select(.State.Code != 48) | select(.Tags[]|select(.Key=="InventoryGroup").Value) | [ .PublicIpAddress, (.Tags[]|select(.Key=="Name").Value)]'

Prajithp

# Count total EBS based storage in AWS
aws ec2 describe-volumes | jq "[.Volumes[].Size] | add"
# Count total EBS storage with a tag filter
aws ec2 describe-volumes --filters "Name=tag:Name,Values=CloudEndure Volume qjenc" | jq "[.Volumes[].Size] | add"
# Describe instances concisely
aws ec2 describe-instances | jq '[.Reservations | .[] | .Instances | .[] | {InstanceId: .InstanceId, State: .State, SubnetId: .SubnetId, VpcId: .VpcId, Name: (.Tags[]|select(.Key=="Name")|.Value)}]'
# Wait until $instance_id is running and then immediately stop it again
aws ec2 wait instance-running --instance-id $instance_id && aws ec2 stop-instances --instance-id $instance_id

# Get 10th instance in the account

Prajithp

# AWS CLI Commands

... to support gathering data for Top 20 CSCs

Note: collection is kept separate from analysis so that the collected data can be used for multiple analaysis attempts.


## Collect inventory information: Volumes, Instances, Security Groups, Network Interfaces

aws --output json ec2 describe-volumes > volumes.json