andrewkroh

#%PAM-1.0

# Skip Google Authenticator for the vagrant user:
auth [success=1 default=ignore] pam_succeed_if.so user = vagrant
auth       required     pam_google_authenticator.so

auth       required     pam_unix.so
auth       required     pam_sepermit.so
auth       include      password-auth
account    required     pam_nologin.so

andrewkroh

package main

import (
	"errors"
	"log"
	"os/exec"
	"syscall"
	"unsafe"
)

andrewkroh

# Run `eval $(docker-machine env default)` to set the environment variables used below.

metricbeat.modules:
- module: docker
  metricsets: ["cpu", "info", "memory", "network", "diskio", "container"]
  hosts: ["${DOCKER_HOST}"]
  ssl:
    certificate_authority: "${DOCKER_CERT_PATH}/ca.pem"
    certificate: "${DOCKER_CERT_PATH}/cert.pem"
    key: "${DOCKER_CERT_PATH}/key.pem"

andrewkroh

#!/bin/bash -e

function setup_profile() {
  profile=$1
  cat << 'EOF' >> $profile
export GOROOT=/go1.5.1-solaris
export GOPATH=$HOME/go
export PATH=$GOPATH/bin:$GOROOT/bin:$PATH
[ ! -d "$GOPATH" ] && mkdir $GOPATH
EOF

andrewkroh

### Keybase proof

I hereby claim:

  * I am andrewkroh on github.
  * I am andrewkroh (https://keybase.io/andrewkroh) on keybase.
  * I have a public key whose fingerprint is 3244 3ADF 2BE8 47C2 B49D  729B 0558 8481 AB5B 6468

To claim this, I am signing this object:

andrewkroh

# Install openscap tool.
sudo yum install openscap-utils

# Generate report based on RedHat's scap-security-guide project (SSG).
# Requires EPEL.
sudo yum install scap-security-guide
oscap xccdf eval --profile stig-rhel6-server-upstream \
  --results /tmp/`hostname`-ssg-results.xml \
  --report /tmp/`hostname`-ssg-results.html \
  --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \

andrewkroh

{
  "@timestamp": "2018-04-08T19:29:14.461Z",
  "@metadata": {
    "beat": "auditbeat",
    "type": "doc",
    "version": "6.2.2"
  },
  "event": {
    "action": "violated-seccomp-policy",
    "module": "auditd",

andrewkroh

Generating Seccomp BPF Filters with libbseccomp in Go

// +build linux

package main

import (
	"log"
	"os"

andrewkroh

seccomp:
  default_action: errno
  syscalls:
  - names:
    - accept
    - accept4
    - arch_prctl
    - bind
    - brk
    - clone

andrewkroh

/*
 * Copyright 2011 Andrew Kroh
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software