| Query - | |
| 200: // return 200 | |
| b@100: // generate 100 random chars in the body | |
| h@1k,ascii_letters=@10,digits: // 1k random chars in header name, | |
| //10 random digits in the value | |
| h"Transfer-Encoding"="chunked": // add T-E Chunked header | |
| // 100 chars in the body added the C-L header already | |
| l"data:text/html;base64,PHNjc..." // and a suspicious Location header | |
| HTTP/1.1 200 OK |
| Download page: | |
| https://wiki.smartos.org/display/DOC/Download+SmartOS | |
| USB image - 2g uncompressed: | |
| Model: Lexar USB Flash Drive (scsi) | |
| Disk /dev/sdb: 16.0GB | |
| Sector size (logical/physical): 512B/512B | |
| Partition Table: msdos | |
| Disk Flags: |
| marcin@behemoth:~$ cd ~/src && git clone https://github.com/devttys0/binwalk.git | |
| Cloning into 'binwalk'... | |
| remote: Counting objects: 6364, done. | |
| remote: Total 6364 (delta 0), reused 0 (delta 0), pack-reused 6364 | |
| Receiving objects: 100% (6364/6364), 6.97 MiB | 3.40 MiB/s, done. | |
| Resolving deltas: 100% (3664/3664), done. | |
| Checking connectivity... done. | |
| marcin@behemoth:~$ mkvirtualenv binwalk | |
| New python executable in /home/marcin/.venvs/binwalk/bin/python |
| 1) DHCP - iptables rules are not reuqired to make DHCP work. | |
| Linux kernel will not send traffic via ethernet interface untill it has an IP address assigned. DHCP client uses raw sockets to | |
| communicate with the DHCP server, which happens before Iptables have change to process the traffic. | |
| 2) iptables rule = classifier (iptable match) + action (iptables target) | |
| Chains in which rules are applied: | |
| - mangle - used to control TOS attributes, MARKs, TTL. Single table. | |
| - filter - policy decision take place here. Tables: forward (target behind firewall, input (traffic to firewall), output (return, or originating traffic). | |
| - nat - changes to src/dst IPs. Tables: |
On Twitter the other day, I was lamenting the state of OCSP stapling support on Linux servers, and got asked by several people to write-up what I think the requirements are for OCSP stapling support.
Support for keeping a long-lived (disk) cache of OCSP responses.
This should be fairly simple. Any restarting of the service shouldn't blow away previous responses that were obtained. This doesn't need to be disk, just stable - and disk is an easy stable storage for most server
| #https://geoff.greer.fm/2017/07/16/thinkpad-x62/ | |
| #!/bin/sh | |
| # Disable the NMI watchdog | |
| echo '0' > '/proc/sys/kernel/nmi_watchdog'; | |
| # Runtime power management for I2C devices | |
| for i in /sys/bus/i2c/devices/*/device/power/control ; do | |
| echo auto > ${i} |
| auto bond0 | |
| iface bond0 inet static | |
| address 10.1.10.1 | |
| netmask 255.255.255.0 | |
| hwaddress ether aa:aa:aa:aa:aa:aa # else mac can float based on what's bonded | |
| post-up ifenslave bond0 eth1 eth2 eth3 eth4 eth5 | |
| # to verify/monitor | |
| cat /proc/net/bonding/bond0 |
| Movign a bootable ISO to USB drive on OSX: | |
| - Insert the USB drive. For portability, format as FAT | |
| - The drive will mount, unmount the volume (but do not "eject") | |
| user $ sudo diskutil unmountDisk /dev/disk2 | |
| Unmount of all volumes on disk2 was successful | |
| - I need a GPT partition, in place of some junk here, so OSX formating tools will work just fine: | |
| function msa_scan_arp () { | |
| ## Discover hosts on a /24 that respond to arp requests. | |
| # Write information about hosts that responded to a file. | |
| # | |
| # ex: msa_resolve_arp 192.168.1 arp-scan.txt | |
| # yep, this is an ugly hack | |
| # arping -w should provide a qicker timeout for IPs that do not respond, but it works in a way I do not seem to understand. | |
| NET=$1; shift; | |
| FILENAME=$1; shift |
| USG and UAP - security gateway and access ponit adoption/initial config | |
| - devices want to live on 192.168.1 network. | |
| - IP address can be set through the controller, in the Networks tab, or using CLI (configure, set interfaces ethernet eth1 address 10.10.10.1/24, delete interfaces ethernet eth1 address 192.168.1.1/24, | |
| commit) | |
| - the DNS name used in the Controller tab must resolve to the right IP, else succesful adoption will requie login to the device and "mca-cli, set-inform http://controller-IP-or-resolving-fqdn):8080/inform | |
| Controller setup: | |
| -- runs fine in docker | |
| -- cloud key is convenient, but it was flakey for me. This is not expected, people have good luck with them. |