jalogisch

#!/bin/bash

#==============================================================================
# Support Team Tooling Bootstrap Script
#==============================================================================
# One-liner bootstrap for setting up the Support Team tooling environment.
#
# Usage (from a fresh Mac):
#   /bin/bash -c "$(curl -fsSL --max-time 60 https://raw.githubusercontent.com/elastic/support/main/bootstrap-mac.sh)"
#

jalogisch

#
# INPUT - Logstash listens on port 8514 for these logs.
#

input {
  udp {
    port => "8514"
    type => "syslog-cisco"
  }
  

jalogisch

#!/bin/bash

set -e 
echo "=================================================================================================="
echo "NOTE: The script will set the Adminconsole to api-only mode (no indexer), so that"
echo "      migrations are bypassed and Adminconsole can boot for environment salvage operations."
echo "      Please run the same script with the cleanup option afterwards."
echo ""
echo "IMPORTANT: Until the cleanup script is run, adminconsole will not be able to index "
echo "           changes in the admin cluster, breaking the Deployments dashboard and "

jalogisch

export ELASTICSEARCH_IMG=docker.elastic.co/elasticsearch/elasticsearch:7.8.0
export DOMAIN="ece.internal"

docker run --rm -v "$(pwd)":/tmp/certs -w /tmp/certs $ELASTICSEARCH_IMG /usr/share/elasticsearch/bin/elasticsearch-certutil  ca \
  --pem \
  --out /tmp/certs/ca.zip

unzip ca.zip

docker run --rm -v "$(pwd)":/tmp/certs -w /tmp/certs $ELASTICSEARCH_IMG /usr/share/elasticsearch/bin/elasticsearch-certutil cert \

jalogisch

#!/usr/bin/env bash

ENV_PATH="$(dirname "$(dirname "$(which pip)")")"
SYSTEM_VIRTUALENV="$(which -a virtualenv|tail -1)"

BAD_ENV_PATHS="/usr/local"

echo "Ensure the root of the broken virtualenv:"
echo "    $ENV_PATH"

jalogisch

version: '2'

networks:
  graylog.net:

volumes:
  graylog.data.elastic:
    driver: "local"
  graylog.data.mongo:
    driver: "local"

jalogisch

{
  "name": "PiHOLE",
  "description": "Creates Information Dashboard from pihole with enriched data ( https://gist.github.com/jalogisch/922b7a3438c5c6f5b9d02557d33ab2eb )",
  "category": "DNS Intel",
  "inputs": [],
  "streams": [],
  "outputs": [],
  "dashboards": [
    {
      "title": "DNS Intel",

jalogisch

http -a admin POST https://nuci3.local.lan/graylog/api/roles < tmp.json
http: password for admin@nuci3.local.lan:
HTTP/1.1 201 Created
Connection: keep-alive
Content-Length: 206
Content-Type: application/json
Date: Tue, 15 May 2018 13:30:08 GMT
Location: http://10.10.10.100:9000/graylog/api/roles/User%20Token%20Mangement
Server: nginx/1.12.2
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload

jalogisch

// Based on java example: http://docs.oracle.com/javase/tutorial/networking/urls/readingWriting.html
// save as: URLConnectionReader.java
// compile using JDK: javac URLConnectionReader.java
// run: java -Djavax.net.ssl.trustStore=/path/to/cacerts.jks -Dhttp.proxyHost=10.0.0.100 -Dhttp.proxyPort=8800 URLConnectionReader
//      if additional debugging is needed add -Djavax.net.debug=all to the above
// good path: returns HTML
// bad path: throws an exception

import java.net.*;
import java.io.*;

jalogisch

Elasticsearch HTTPS:
- X-Pack (Elastic Kostenpflichtig)
- Search Guard (OSS & Pay Plan) https://github.com/floragunncom/search-guard
- NGINX Proxy ( https://www.elastic.co/blog/playing-http-tricks-nginx )

MongoDB TLS: 
- https://docs.mongodb.com/manual/tutorial/configure-ssl/
- Certificate based authentication is tricky but can be done

Graylog TLS: