pedroagabreu

# create user
create role myuser login password 'somepassword';
grant connect on database events to myuser;
grant usage on schema public to myuser;

# privs on current stuff
grant select on all tables in schema public to myuser;
grant select on all sequences in schema public to myuser;
grant execute on all functions in schema public to myuser;

pedroagabreu

#!/bin/bash

# terminate instances
for i in i-aaaaaa i-bbbbbb i-cccccc ...; do aws ec2 modify-instance-attribute --instance-id $i --no-disable-api-termination; done
aws ec2 terminate-instances --instance-ids i-aaaaaa i-bbbbbb i-cccccc ...

# release elastic ips
for i in $(cat ips); do aws ec2 describe-addresses --public-ip $i |grep AllocationId |cut -d: -f2 |tr -d \"; done > eipalloc
for i in $(cat eipalloc); do aws ec2 release-address --allocation-id $i; done

pedroagabreu

# pull 2M records and drop metadata
curl -sN -XPOST 'http://localhost:9200/logstash-2015.11.04/_search' -d '{"sort": ["@timestamp"], "query": {"match": {"who": "me"}}, "from": 0, "size": 1000000}' | jq -c '.hits.hits[]._source' > output.json
curl -sN -XPOST 'http://localhost:9200/logstash-2015.11.04/_search' -d '{"sort": ["@timestamp"], "query": {"match": {"who": "me"}}, "from": 1000001, "size": 1000000}' | jq -c '.hits.hits[]._source' > output2.json

pedroagabreu

server=/mydomain.local/192.168.1.253
server=/mydomain.local/192.168.1.254

pedroagabreu

$SystemLogRateLimitInterval 5
$SystemLogRateLimitBurst 2000

pedroagabreu

description "Suricata Intrusion Detection System Daemon" 
start on runlevel [2345]
stop on runlevel [!2345]
expect fork
exec suricata -D --pidfile /var/run/suricata.pid -c /etc/suricata/suricata.yaml -i eth1

pedroagabreu

MAILTO="security@domain.tld"

55 5 * * * root ( /usr/sbin/oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules; sleep 5; kill -USR2 `pidof suricata` )

pedroagabreu

/var/log/suricata/*.log /var/log/suricata/*.json
{
    daily
    rotate 3
    missingok
    nocompress
    create
    sharedscripts
    postrotate
            /bin/kill -HUP $(pidof suricata)

pedroagabreu

# Perfect Forward Secrecy ciphers
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"
SSLHonorCipherOrder on

# Enabled protocols
SSLProtocol all -SSLv2 -SSLv3

# OCSP stapling
SSLUseStapling on
SSLStaplingResponderTimeout 5

pedroagabreu

$sfurl = 'https://webto.salesforce.com/servlet/servlet.WebToLead?encoding=UTF-8';
$sffields = array(
                        'oid' => 'someoid',
                        'lead_source' => 'my website',
                        'last_name' => urlencode($_POST['name']),
                        'company' => urlencode($_POST['organization']),
                        'email' => urlencode($_POST['email']),
                        'phone' => urlencode($_POST['phone']),
                );
foreach($sffields as $key=>$value) { $fieldstring .= $key.'='.$value.'&'; }