mpls

Setting up a SSL Cert from Comodo

I use Namecheap.com as a registrar, and they resale SSL Certs from a number of other companies, including Comodo.

These are the steps I went through to set up an SSL cert.

Purchase the cert

mpls

tmux shortcuts & cheatsheet

start new:

tmux

start new with session name:

tmux new -s myname

mpls

# Modify this file accordingly for your specific requirement.
# http://www.thegeekstuff.com
# 1. Delete all existing rules
iptables -F

# 2. Set default chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

mpls

# Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled.  See sysctl(8) and
# sysctl.conf(5) for more details.

# Turn on execshield
# 0 completely disables ExecShield and Address Space Layout Randomization
# 1 enables them ONLY if the application bits for these protections are set to “enable”
# 2 enables them by default, except if the application bits are set to “disable”
# 3 enables them always, whatever the application bits

mpls

#!/boot/bzImage

# Linux kernel userspace initialization code, translated to bash
# (Minus floppy disk handling, because seriously, it's 2017.)
# Not 100% accurate, but gives you a good idea of how kernel init works
# GPLv2, Copyright 2017 Hector Martin <marcan@marcan.st>
# Based on Linux 4.10-rc2.

# Note: pretend chroot is a builtin and affects the current process
# Note: kernel actually uses major/minor device numbers instead of device name

mpls

Better SSH Authorized Keys Management

A seemingly common problem that people encounter is how to handle all of your users authorized_keys file.

People struggle over management, ensuring that users only have specific keys in the authorized_keys file or even a method for expiring keys. A centralized key management system could help provide all of this functionality with a little scripting.

One piece of functionality overlooked in OpenSSH is the AuthorizedKeysCommand configuration keyword. This configuration allows you to specify a command that will run during login to retrieve a users public key file from a remote source and perform validation just as if the authorized_keys file was local.

Here is an example directory structure for a set of users with SSH public keys that can be shared out via a web server:

mpls

Better SSH Authorized Keys Management

A seemingly common problem that people encounter is how to handle all of your users authorized_keys file.

People struggle over management, ensuring that users only have specific keys in the authorized_keys file or even a method for expiring keys. A centralized key management system could help provide all of this functionality with a little scripting.

One piece of functionality overlooked in OpenSSH is the AuthorizedKeysCommand configuration keyword. This configuration allows you to specify a command that will run during login to retrieve a users public key file from a remote source and perform validation just as if the authorized_keys file was local.

Here is an example directory structure for a set of users with SSH public keys that can be shared out via a web server:

mpls

wget http://stedolan.github.io/jq/download/linux64/jq 
aws ec2 describe-instances --filters "Name=tag:Name,Values=$NAME" \
  "Name=instance-state-name,Values=running" \
  |  jq -r \
  ".Reservations[] | .Instances[] | .InstanceId" \

aws ec2 describe-volumes --filters \
  "Name=status,Values=available" \
  | jq -r ".Volumes[] | .VolumeId" \

mpls

/*

  Watch out, os.IsExist(err) != !os.IsNotExist(err)

  They are error checkers, so use them only when err != nil, and you want to handle
  specific errors in a different way!
  
  Their main purpose is to wrap around OS error messages for you, so you don't have to test
  for Windows/Unix/Mobile/other OS error messages for "file exists/directory exists" and
  "file does not exist/directory does not exist"

mpls

; /opt/janus/etc/janus/janus.plugin.streaming.cfg
; [stream-name]
; type = rtp|live|ondemand|rtsp
;        rtp = stream originated by an external tool (e.g., gstreamer or
;              ffmpeg) and sent to the plugin via RTP
;        live = local file streamed live to multiple listeners
;               (multiple listeners = same streaming context)
;        ondemand = local file streamed on-demand to a single listener
;                   (multiple listeners = different streaming contexts)
;        rtsp = stream originated by an external RTSP feed (only