Skip to content

Instantly share code, notes, and snippets.

View dkrusky's full-sized avatar

Daniel Krusky dkrusky

10 followers · 3 following
View GitHub Profile
@dkrusky
dkrusky / windows-server-perfect-tls-ssl-rating-ssllabs.ps1
Last active July 7, 2016 12:26
Modified powershell script (must run as administrator) to pre-configure the box for A+ rating on ssllabs.com . Only support for TLS 1.2 is enabled due to lack of support in SCHANNEL for TLS fallback. You still need to setup HPKP, Strict-Security, and OCSP in IIS per site.
# Copyright 2014, Alexander Hass - Modified by MicroVB ( https://www.microvb.com )
# http://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12
#
# Version 1.5
# - Disabled remaining problematic ciphers that do not supply forward secrecy
# - Disabled TLS 1.0 from server SCHANNEL requests
# - Disabled TLS 1.1 from server SCHANNEL requests
# - Enabled secure renegotiation
# - Moved cipher suite and protocol variables to the top of this file to make editing easier
# - 3DES has been disabled.
@dkrusky
dkrusky / install-and-secure-linux-with-csf.sh
Last active February 28, 2020 15:54
Consolidates CSF paramaters into a single script which will download any required runtimes for your distro, detect and enable ipv6 firewall, and install and configure CSF. Tested on Debian and CentOS.
#!/bin/sh
CSF="/etc/csf/csf.conf"
# set the values as you wish them to be set in the running version of csf
RESTRICT_UI='2'
RESTRICT_SYSLOG='3'
LF_SPI='1'
TCP_IN='25,80,110,443,465,587,995,2083'
TCP_OUT='20,21,22,25,37,43,53,80,110,113,443,587,873,993,995,2086,2087,2089,2703'
UDP_IN='33434:33523'
@dkrusky
dkrusky / apache-secure-virtualhost.conf
Last active March 11, 2016 12:48
Demonstrates best practices for security in an Apache virtual host. A+ rating on ssllabs.com with good backwards compatibility.
# Enable stapling. This should only be enabled ONCE and is server-wide.
SSLUseStapling on
SSLStaplingCache "shmcb:logs/stapling_cache(128000)"
# Enable strict transport
<IfModule mod_headers.c>
Header Always set Strict-Transport-Security "max-age=15638400; preload" env=HTTPS
#Header Always set Strict-Transport-Security "max-age=15638400; includeSubdomains; preload" env=HTTPS
</IfModule>
@dkrusky
dkrusky / cpanel-strengthen-dhparams-in-dovecot.sh
Last active March 11, 2016 12:46
Set dovecot to generate 2048 bit dhparams on a cPanel/WHM box.
#!/bin/sh
# if no local config for dovecot exists, make one
if[ ! -e /var/cpanel/templates/dovecot2.2/main.local ]; then
cp /var/cpanel/templates/dovecot2.2/main.default /var/cpanel/templates/dovecot2.2/main.local
fi
# check if ssl_dh_parameters exists already. if it doesn't exist, insert it
if [ -z "$(grep "ssl_dh_parameters_length" /var/cpanel/templates/dovecot2.2/main.local)" ]; then
sed -i '/ssl = \[% ssl %\]/,/\[%- ELSE %\]/ {/\[%- ELSE %\]/i ssl_dh_parameters_length = 2048}' /var/cpanel/templates/dovecot2.2/main.local
@dkrusky
dkrusky / letsencrypt-cpanel.sh
Last active March 11, 2016 12:45
Install or update letsencrypt and generate a certificate for a cPanel user and domain, and email it to the user.
#!/bin/sh
INSTRUCTIONS="
<html>
<head>
</head>
<body>
<h3>Installation Instructions</h3>
<b>Step 1</b>
<p>Login to your cPanel account and look for the following icon and click it</p>
@dkrusky
dkrusky / getRawSecureWebsite.php
Last active March 11, 2016 12:43
Get SSL/TLS certificate details and full headers from a secure website.
<?php
$details = getRawSecureWebsite('www.google.com');
echo '<textarea>' . $details['raw'] . '</details>';
function getRawSecureWebsite( $domain ) {
$raw = '';
$headers = '';
@dkrusky
dkrusky / fixperms.sh
Created March 12, 2016 05:54
Bash file to correct web permissions. Accepts folder as a parameter, or in the absence, uses the current folder
#!/bin/sh
#mode=$1; shift
find "$@" -type f -exec chmod "0644" {} +
find "$@" -type d -exec chmod "0755" {} +
@dkrusky
dkrusky / wordpress-force-login-as-admin.php
Created March 13, 2016 23:48
Login to WordPress as administrator (or any other user) without knowing the username or password.
<?php
include('wp-config.php');
$user_id = 1; // Default admin user id. (usually the first user entered into the database)
$remember = 1; // Remember Session (14 days approx)
$secure = (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] != 'on') ? 0 : 1; // Use SSL
// Force authorization as the above user without password
wp_set_auth_cookie( $user_id, $remember, $secure );
@dkrusky
dkrusky / W.A.R. Link Checker Premium Script.js
Created May 22, 2016 10:49
@dkrusky
dkrusky / jsupdate.sh
Created January 8, 2017 06:55
Copy or Update projects from windows host to Bash on Ubuntu on Windows and set permissions
#!/bin/bash
# source folder as mount path on linux
WINPATH="/mnt/d/bash"
# destination root folder
LINPATH="/home/nodejs"
# check if <project> param received
if [ $# -ne 1 ]; then