Skip to content

Instantly share code, notes, and snippets.

@renier
renier / gen_cert.sh
Created October 30, 2016 08:06
Generate an SSL certificate
#!/bin/bash
DOMAIN=$(hostname -f)
export PASSPHRASE=$(head -c 500 /dev/urandom | tr -dc a-z0-9A-Z | head -c 128; echo)
subj="
C=$1
ST=$2
O=$3
localityName=$4
commonName=$DOMAIN
organizationalUnitName=$5
@renier
renier / super_harden_ubuntu.sh
Last active February 10, 2019 02:05
Super Harden Ubuntu
#!/bin/bash
# https://developer.ibm.com/answers/questions/462237/error-groot-must-be-grub-root-device-on-ubuntu/
sed -i -e 's/LABEL=cloudimg-rootfs/(hd0)/' /boot/grub/menu.lst
apt-get update > /dev/null
apt-get install unattended-upgrades -y
timeout 20m unattended-upgrade
apt-get autoremove -y
apt-get autoclean -y
@renier
renier / harden_ubuntu.sh
Last active September 8, 2017 05:56
Harden Ubuntu
#!/bin/bash
apt-get update
apt-get upgrade -y
apt-get autoremove -y
apt-get autoclean -y
apt-get install ufw -y
apt-get install denyhosts -y
# Configure firewall
@renier
renier / norequiretty.sh
Last active August 29, 2015 14:20
No requiretty
sed -i -e 's/ requiretty/ !requiretty/' /etc/sudoers
@renier
renier / mongodb_logrotate.cron
Last active December 14, 2016 09:33
Rotate and compress mongodb logs
#!/bin/bash
# To be used as a cron job weekly (or other) placed under /etc/cron.weekly
# Will use mongodb's logrotate function, but then will compress and keep at most 12 weeks worth of rotate logs.
killall -SIGUSR1 `cat /var/run/mongodb/mongod.pid`
gzip /var/log/mongodb/*20[0-9][0-9]-*-[0-9][0-9]
logs_total=`ls -tx1 /var/log/mongodb/ | egrep "20[0-9][0-9]-.*\.gz" | wc -l`
if [ "$logs_total" -gt 12 ]; then
logs_difference=`expr $logs_total - 12`
logs_to_remove=`ls -tx1 /var/log/mongodb/ | egrep "20[0-9][0-9]-.*\.gz" | tail -n $logs_difference`
for log_file in $logs_to_remove; do
@renier
renier / httparty_uses_basic_auth_creds_in_url.rb
Created November 17, 2014 19:21
Make HTTParty pick out basic auth credentials from URL
module HTTParty
module ClassMethods
private
alias_method :orig_perform_request, :perform_request
def perform_request(http_method, path, options, &block)
if path.include? '@'
options ||= {}
scheme_auth, host_uri = path.split('@')
scheme, creds = scheme_auth.split('//')
@renier
renier / oauth_understands_grape.rb
Created November 17, 2014 19:19
Make OAuth understand Grape requests
require 'oauth'
require 'oauth/request_proxy/rack_request'
module OAuth
module RequestProxy
class RackRequest
proxies Grape::Request
end
end
end
#!/bin/sh
sed -i -e '/^PermitRootLogin/d' /etc/ssh/sshd_config
echo 'PermitRootLogin without-password' >> /etc/ssh/sshd_config
service ssh restart || service sshd restart
#!ruby
if ENV['USER'] != 'root'
puts "I need to run with sudo!"
exit(1)
end
bad_rule = 'deny ip from any to any'
rule_id = nil
rules = `ipfw list`.split(/\n/)
rules.each do |rule|
@renier
renier / test.sh
Last active August 29, 2015 14:02
Document is not available right away in elasticsearch
#!/bin/sh -x
curl -w "\n" -X DELETE http://localhost:9200/testing;
curl -w "\n" -X POST http://localhost:9200/testing/group -d '{"name":"default","description":"This is the default group.","id":null}';
# This next request returns 0 hits
curl -w "\n" -X GET http://localhost:9200/testing/group/_search;
sleep 1;
# After waiting one second, this request returns the previously created document
curl -w "\n" -X GET http://localhost:9200/testing/group/_search;