yegorg

Building Secure Networks with Vyatta

What is Vyatta, and why do you want to use it?

• Discussion of key strenths of vyatta, and firewalls in general
• Link to the open-source VyOS version and the commercial Vyatta project
• Talk about Softlayer choices specifically -- why softlayer version is insecure / finnicky with SSL & PPTP options, limitations & cost of the Fortigate appliance

Splitting your public and private traffic

yegorg

Static OpenVPN configuration between a single pair of hosts

So you've got two boxes, separated by some kind of network that you're not in control of, and you'd like to encrypt traffic between them. You're not going to have multiple clients connecting to each other, just these two boxes.

As of OpenVPN 2, it's possible to configure the hosts in peer-to-peer mode, with static keying, meaning that the actual VPN setup is super easy:

1. Install OpenVPN (>=2) on both boxes, the standard Wheezy version is fine.
2. Generate a static key as follows: openvpn --genkey --secret /path/to/somewhere/secret.key
3. Copy the secret key to both boxes over a secure channel (e.g SSH)
4. Create /etc/openvpn/p2p.conf on both boxes as show in box1.vpn.cnf and box2.vpn.cnf below

yegorg

wget -O nginx_signing.key http://nginx.org/keys/nginx_signing.key
sudo apt-key add nginx_signing.key
echo "deb http://nginx.org/packages/mainline/ubuntu/ trusty nginx
deb-src http://nginx.org/packages/mainline/ubuntu/ trusty nginx" >> /etc/apt/sources.list
apt-get update
apt-get install nginx

yegorg

$modload imtcp
$InputTCPServerRun 10514

# $ActionQueueType LinkedList   # use asynchronous processing
# $ActionQueueFileName srvrfwd  # set file name, also enables disk mode
# $ActionResumeRetryCount -1    # infinite retries on insert failure
# $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
# *.notice			@@logserver.local:10514

auth,authpriv.*			-/var/log/auth.log

yegorg

{
  "title": "Collectd: Blackbox",
  "services": {
	"query": {
	  "list": {
		"0": {
		  "query": "plugin:\"load\"",
		  "alias": "Load",
		  "color": "#7EB26D",
		  "id": 0,

yegorg

vrrp_script chk_haproxy {
   script "killall -0 haproxy"   # verify the pid existance
   interval 2                    # check every 2 seconds
   weight 2                      # add 2 points of prio if OK
}

vrrp_instance VI_1 {
   interface eth0                # interface to monitor
   state MASTER
   virtual_router_id 51          # Assign one ID for this route

yegorg

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface

auto eth0

yegorg

#!/bin/bash
# check for iptables-persistent package and install if not already installed
script_name="iptablesrules.sh"
# change user to the account you wish to use on the remote nodes
user="root"

tee $script_name <<EOF
if apt-get -qq install iptables-persistent; then
    echo "Successfully detected iptables-persistent"
else

yegorg

Installing ELK (CentOS)

This is a short step-by-step guide on installing ElasticSearch LogStash and Kibana Stack on a CentOS environment to gather and analyze logs.

I. Install JDK

rpm -ivh https://dl.dropboxusercontent.com/u/5756075/jdk-7u45-linux-x64.rpm

yegorg

#!/bin/sh

# Some things taken from here
# https://github.com/mathiasbynens/dotfiles/blob/master/.osx

# Set the colours you can use
black='\033[0;30m'
white='\033[0;37m'
red='\033[0;31m'
green='\033[0;32m'