craig-m-unsw

hardening Ubuntu with CIS benchmarks and ComplianceAsCode

Use Compliance As Code to create hardening profiles.

Tested from Ubuntu 20.04.5 LTS host, and Ubuntu 20.04.5 WSL on Windows 11.

If you are on MacOS you can use a Vagrant VM for a Linux DevEnv:

mkdir ubuntu2004vm && cd ubuntu2004vm 

craig-m-unsw

Native Secure Enclave backed ssh keys on MacOS

It turns out that MacOS Tahoe can generate and use secure-enclave backed SSH keys! This replaces projects like https://github.com/maxgoedjen/secretive

There is a shared library /usr/lib/ssh-keychain.dylib that traditionally has been used to add smartcard support to ssh by implementing PKCS11Provider interface. However since recently it also implements SecurityKeyProivder which supports loading keys directly from the secure enclave! SecurityKeyProvider is what is normally used to talk to FIDO2 devices (e.g. libfido2 can be used to talk to your Yubikey). However you can now use it to talk to your Secure Enclave instead!

craig-m-unsw

Create Linux password hashes from Python

Platform independent way of generating Linux compatible crypt(3) sha512 hashes ($6$ style). For use in cloud-init, preseed files, or altering /etc/shadow. Use on systems where you can't mkpasswd -m sha-512 (which gets installed from sudo apt install whois weirdly on Ubuntu/Deb systems).

setup

We can install Passlib in a virtual environment anywhere we can run Python from with a small script.

So Install Python by downloading or using a package manager (eg sudo apt-get install python3 python3-virtualenv -y).

craig-m-unsw

"""
The most atomic way to train and run inference for a GPT in pure, dependency-free Python.
This file is the complete algorithm.
Everything else is just efficiency.

@karpathy
"""

import os       # os.path.exists
import math     # math.log, math.exp

craig-m-unsw

parallels Packer (arm64)

A simple Packer + Vagrant install of Ubuntu 20.04 (Focal Fossa) LTS server for arm64, to run from my M1 Mac on Parallels Pro (17.1). Currently on MacOS Monterey.

Packer will run the ansible playbook.yml before the machine is shutdown and exported.

The installation is automated by cloud-init (which reads user-data). The file meta-data just needs to be an empty text file (you need to create this - no blank files or folders allowed in gists).

ubuntu2004/

craig-m-unsw

#!/bin/bash

# Calculates network and broadcast based on supplied ip address and netmask

# Usage: broadcast_calc.sh 192.168.0.1 255.255.255.0
# Usage: broadcast_calc.sh 192.168.0.1/24


tonum() {
    if [[ $1 =~ ([[:digit:]]+)\.([[:digit:]]+)\.([[:digit:]]+)\.([[:digit:]]+) ]]; then

craig-m-unsw

File Magic Numbers

Magic numbers are the first bits of a file which uniquely identify the type of file. This makes programming easier because complicated file structures need not be searched in order to identify the file type.

For example, a jpeg file starts with ffd8 ffe0 0010 4a46 4946 0001 0101 0047 ......JFIF.....G ffd8 shows that it's a JPEG file, and ffe0 identify a JFIF type structure. There is an ascii encoding of "JFIF" which comes after a length code, but that is not necessary in order to identify the file. The first 4 bytes do that uniquely.

This gives an ongoing list of file-type magic numbers.

Image Files

craig-m-unsw

Understanding the Memory Layout of Linux Executables

Required tools for playing around with memory:

• hexdump
• objdump
• readelf
• xxd
• gcore

craig-m-unsw

Setup a Local Only SMTP Email Server (Linux, Unix, Mac)

1 - Point localhost.com to your machine

Most of programs will not accept an email using just @localhost as domain. So, edit /etc/hosts file to make the domain localhost.com point to your machine, including this content to the file:

127.0.0.1 localhost.com

2 - Install Postfix

craig-m-unsw

Docker compose as a systemd unit

Create file /etc/systemd/system/docker-compose@.service. SystemD calling binaries using an absolute path. In my case is prefixed by /usr/local/bin, you should use paths specific for your environment.

[Unit]
Description=%i service with docker compose
PartOf=docker.service
After=docker.service