blurayne

In response to: https://blog.codecentric.de/en/2021/03/github-actions-nextgen-cicd/

GitLab CI has templates you could use. Only bad thing is they did is they way they launch their job containers (defaulting to BASH/SH interpreter and preprocessing script section). This is a bit limiting in using custom containers for integration. But you can do as well.

GitHub actions do have their action params which make them nice for for validation, also they focused more on the API but I do see actions also as way of monetizing integration which is the cloud's OpenSource business model.

And here we are with Tekton or even AWS CodePipeline which could be more seen as CloudPipeline. The questions is how a CICD becomes cloud native? And one part of the answer is integration with Cloud and Services API. That's more about the paradigm shift of the "third" wave.

Also a simple CICD became now a build platform that integrate into the layers of the cloud, mainly orchestrators and solve the problems of how artifacts and data fl

blurayne

#!/bin/bash

set -eEuo pipefail

ARCH="$(arch)"
PACKAGE_ARCH="${ARCH/x86_64/amd64}"
PACKAGE_ARCH="${PACKAGE_ARCH/aarch64/arm64}"
PACKAGE_URL=""
PACKAGE_FILE=""

blurayne

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log