jakewarren

Receive an email alert for each ssh login. The script can be extended to support other notification methods such as Slack, etc.

mkdir -p /etc/pam.scripts
chmod 0755 /etc/pam.scripts
vim /etc/pam.scripts/ssh_alert.sh

add the following script to ssh_alert.sh, modifying the variables from their default value

#!/bin/bash

jakewarren

Installation

Installation Documentation

CentOS 7

rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH

cat > /etc/yum.repos.d/wazuh.repo << EOF

jakewarren

an example logrotate configuration to rotate auditd logs.

vim /etc/logrotate.d/auditd

/var/log/audit/audit.log {
    daily
    rotate 91
    # compress the logs
	compress

jakewarren

Sourced from: https://serverfault.com/questions/211425/can-etckeeper-be-used-to-track-config-files-outside-of-etc

Create a new etckeeper script: vim /etc/etckeeper/commit.d/20mirror-outside-files

#!/bin/sh
set -e

# Based on nealmcb's + ErebusBat's script from http://serverfault.com/questions/211425/

jakewarren

#!/usr/bin/env gorun
//requires https://github.com/erning/gorun
package main

import (
	"flag"
	"fmt"
	"net/http"
)

jakewarren

Restrict the amount of CPU and memory resources that Chrome can consume.

Tested on Ubuntu 16.04/Linux Mint 18.

---

Install cgroups:

sudo apt install cgroup-bin

jakewarren

#!/bin/bash

#------     Global configuration section      ---------#

TMP_DIR=/tmp
BIN_DIR=/usr/local/bin


#------     Utility Functions      ---------#

jakewarren

# Joomla 12/14/15 RCE 0day Mitigation
# Note: Use at your own risk. The best mitigation is to patch Joomla to v3.4.6

# Apache mitigation
# 		Apply within .htaccess file

RewriteCond %{HTTP_USER_AGENT} O:[0-9]+:
RewriteRule .* - [F,L]

RewriteCond %{HTTP:X-FORWARDED-FOR} O:[0-9]+:

jakewarren

#md5 hash of most used password 123456
#ref: https://twitter.com/TekDefense/status/294556153151647744
https://github.com/search?q=e10adc3949ba59abbe56e057f20f883e&type=Code&ref=searchresults

#DB_PASSWORD
#ref: http://seclists.org/fulldisclosure/2014/Mar/343
https://github.com/search?q=define%28%22DB_PASSWORD%22&type=Code&ref=searchresults

#Possible SQL injection
#ref: http://seclists.org/fulldisclosure/2013/Jun/15

jakewarren

#!/usr/bin/env python2

# Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford (jspenguin@jspenguin.org)
# The author disclaims copyright to this source code.

# Modifed to send heartbeat requests for both TLS v1.1 and v1.2

import sys
import struct
import socket