jpawlowski

#Requires -Version 7.4
# NOTE: Microsoft.Graph.Authentication is imported explicitly below rather than via
# '#Requires -Modules'. Under PowerShell 7.5 'pwsh -File <script>' SILENTLY DISCARDS the script's
# exit code (every 'exit N' becomes process exit 0) when the script carries a '#Requires -Modules'
# directive -- which would make every validation/error 'exit 1' look like success to a scheduler or
# wrapper that checks $LASTEXITCODE/%ERRORLEVEL. An explicit Import-Module keeps the same fail-fast
# prerequisite check while preserving correct exit codes.

<#
.SYNOPSIS

jpawlowski

#!/bin/bash
#
# This Script creates the following files to be used for
# Zabbix SNMP and SNMP trap integration:
#
# /etc/snmp/snmp.conf
# /etc/snmp/snmptt.conf.VENDOR
# Symlink vendor specific MIB files from
#  $MIBS_VENDORS to $MIBS
#

jpawlowski

function Test-HmacAuthorization {
    <#
    .SYNOPSIS
    Verifies HMAC signature of incoming Azure Automation webhook requests.

    .DESCRIPTION
    Validates HMAC signature based on signed request headers (timestamp, nonce, content hash) and a shared secret.
    Supports both HMACSHA256 and HMACSHA512 algorithms.

    The shared secret is passed securely as a SecureString, converted as late as possible, and cleared from memory immediately after use.

jpawlowski

# /etc/nginx/sites-available/pdns-api
#
# `ln -s /etc/nginx/sites-available/pdns-api /etc/nginx/sites-enabled/pdns-api`

map_hash_bucket_size 128;

# --- MAPS GO HERE ---
map $http_x_api_key:$remote_addr $internal_pdns_key {
    default "";
    include /etc/powerdns/api-keys.map;

jpawlowski

#!/bin/bash
set -euo pipefail

PATH="/usr/sbin:/usr/bin:/sbin:/bin"

DATE="$(date +'%Y%m%d%H')"
DEFAULT_KEEP=24
DEFAULT_RETAIN_DAYS=7
DEFAULT_TIMEOUT="30m"
DEFAULT_SKIP_TAGS="nosnap"

jpawlowski

#!/bin/bash

# Sync Homebrew installations between Macs via Dropbox
#

BREW="/usr/local/bin/brew"

# first get local settings
echo "Reading local settings ..."
rm -f /tmp/brew-sync.*

jpawlowski

alias: tibber_api_timer
description: ""
triggers:
  - trigger: time_pattern
    hours: "0"
    minutes: "0"
    seconds: "5"
  - trigger: time_pattern
    hours: "0"
    minutes: "1"

jpawlowski

<#
.SYNOPSIS
    Create a Temporary Access Pass code for new hires that have not set up any Authentication Methods so far

.DESCRIPTION
    This script is intended to be run as an Azure Automation Runbook or as a standalone script.
    Before generating a Temporary Access Pass, the script checks if the user has set up any Authentication Methods and has reached its hire date.
    If the user has not set up any Authentication Methods, a Temporary Access Pass is created.
    Depending on the configuration, the pass is output or sent to the user's manager via email.

jpawlowski

#!/bin/bash
#
# see https://stribika.github.io/2015/01/04/secure-secure-shell.html

SSHD_VERSION=`/usr/sbin/sshd -v 2>&1 | grep OpenSSH | cut -d " " -f1 | cut -d "_" -f2 | cut -d"." -f2 | cut -d"p" -f1`
cat /etc/ssh/sshd_config | grep -v "KexAlgorithms" | grep -v "Ciphers" | grep -v "MACs" | grep -v "github.com" > /etc/ssh/sshd_config.new
cat /etc/ssh/ssh_config | grep -v "KexAlgorithms" | grep -v "Ciphers" | grep -v "MACs" | grep -v "github.com" > /etc/ssh/ssh_config.new
if [ "${SSHD_VERSION}" != "0" ]; then
	# better algorithms only available on newer OpenSSH versions
	echo "KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256" >> /etc/ssh/sshd_config.new

jpawlowski

# /etc/network/interfaces
#
auto lo
iface lo inet loopback

# device: eth0
iface eth0 inet manual

# IPv4 bridge
# (connect ONLY your firewall/router KVM instance here, this is the WAN device!)