$acl = get-acl thefile $sddl_orig = $acl.sddl $new_sddl = $sddl_orig -replace 'S-1-oldsid' 'S-1-newsid' $acl.SetSecurityDescriptorSddlForm($new_sddl) $acl | set-aclYes, this can be condensed to a single line, but as far as I can google, nobody has it:
gci | get-acl | foreach { $_.setsecuritydescriptorsddlform($_.sddl.replace('S-1-oldsid','S-1-newsid'))} | set-acl
# Systemd unit file for an SSH Tunnel service # [Service] Type=simple User=tunnel ExecStart=/usr/bin/ssh -F /home/tunnel/ssh-config-for-tunnel -vN tunnel.%i # On failure, wait 10 seconds to restart Restart=always RestartSec=10 # 20 failures within a 10 minute window marks this service as failed. StartLimitInterval=600 StartLimitBurst=20 [Unit] Description="SSH Tunnel to %i" Requires=network-online.target [Install] WantedBy=multi-user.target
ssh-keygen -t ed25519and configure the ssh-config-for-tunnel file:
# Configuration of the SSH tunnel from here to there
# Requirements:
# This file in /home/tunnel/ssh-config-for-tunnel
# Service /etc/systemd/system/ssh-tunnel@.service enabled and started
#
# Additional tunnels can be enabled as ssh-tunnel@elsewhere.service
# Special defaults for tunnels
Host *
ControlMaster no
ExitOnForwardFailure yes
IdentitiesOnly yes
#####################################################################
# Configure Tunnel:
#####################################################################
Host tunnel.myservice
### Connection:
# Private IP of ultimate destination
HostName 172.31.92.114
# Identity on the CB master
IdentityFile ~/.ssh/id_master
# Public IP of Jump 1 bastion
ProxyJump 192.168.100.142
### Tunnels:
# Take near port :18443 and send it to master's listener
LocalForward 8444 localhost:8443
# Take far port :6100 and bring it back to local listener
RemoteForward 6100 161.134.130.247:6100
# Jump configurations
Host 192.168.100.142
# Configuration for the bastion system
IdentityFile ~/.ssh/id_ed25519
ProxyJump 10.192.107.33
Host 10.192.107.33
IdentityFile ~/.ssh/id_ed25519
@echo off
REM newkernel.bat - create a python virtualenv and register it as a
REM Jupyter kernel
REM
SET /P _envname="Name of environment:"
if "%_envname%x" NEQ "x" goto :got_name
@REM else
set _envname=py-%USERNAME%-%RANDOM%
@REM fi
:got_name
C:\tools\Anaconda3\python.exe -m venv %_envname%.venv
set /P _envkern="Kernel name:"
if "%_envkern%x" NEQ "x" goto :got_kern
@REM else
set _envkern=py-%_envname%
@REM fi
:got_kern
set /P _envdesc="Kernel Description:"
if "%_envdesc%x" NEQ "x" goto :got_desc
@REM else
set _envdesc="Python (%_envname%)"
@REM fi
:got_desc
%_envname%.venv\scripts\pip install ipykernel
%_envname%.venv\scripts\python -m ipykernel install --name %_envkern% --display-name "%_envdesc%"
C:\> "\Program Files\Dell\SysMgt\rac5\racadm.exe" -r dracname.dom.ain -u root -p redacted sslcsrgen -g -f dracname.dom.ain.csr
Security Alert: Certificate is invalid - Name on Certificate is invalid or does not match site name
Continuing execution. Use -S option for racadm to stop execution on certificate-related errors.
CSR generated and downloaded from RAC successfully
C:\> certreq -submit -attrib "san:dns=dracname.dom.ain\nCertificateTemplate: WebServer" dracname.dom.ain.csr dracname.dom.ain.crt
Active Directory Enrollment Policy
{BFF41397-4CCE-41B5-AD8E-A029B2C2353B}
ldap:
RequestId: 104238
RequestId: "104238"
Certificate retrieved(Issued) Issued The certificate validity period will be shorter than the WebServer Certificate Tem
plate specifies, because the template validity period is longer than the maximum certificate validity period allowed by
the CA. Consider renewing the CA certificate, reducing the template validity period, or increasing the registry validit
y period.
C:\> "\Program Files\Dell\SysMgt\rac5\racadm.exe" -r dracname.dom.ain -u root -p redacted sslcertupload -t 1 -f dracname.dom.ain.crt
Security Alert: Certificate is invalid - Name on Certificate is invalid or does not match site name
Continuing execution. Use -S option for racadm to stop execution on certificate-related errors.
Certificate successfully uploaded to the RAC. The RAC will now
reset to enable the new certificate and may be offline temporarily.
C:\> "\Program Files\Dell\SysMgt\rac5\racadm.exe" -r dracname.dom.ain -u root -p redacted sslcertview -t 1
Serial Number : redacted
Subject Information:
Country Code (CC) : AU
State (S) : Some-State
Locality (L) : MyTown
Organization (O) : Internet Widgits Pty Ltd
Organizational Unit (OU) : World Wide Web Pty Ltd
Common Name (CN) : *.dom.ain
Issuer Information:
Common Name (CN) : AD DOM.AIN Root Trust CA
Valid From : Mar 6 16:01:02 2018 GMT
Valid To : Nov 6 15:13:19 2019 GMT
:| openssl s_client -host firstinstance -port 8443 -prexit \
-showcerts >firstinstance.crt(No, that's not an emotionless command emoticon, it's a pipe)
keytool -import -alias firstinstance -file firstinstance.crt \
-keystore paranoid.jks -storepass changeme -noprompt \ && cp paranoid.jks /opt/foo/jre/lib/security/cacerts
$ JRE_HOME=/opt/foo/jre $ JAVA_HOME=/opt/foo/jre $ /opt/foo/jre/bin/java -cp . SSLPoke firstinstance 8443 Successfully connectedIn theory, a restart of the app should have it pick up the new (single-entry) list of trusted certificates. In practice...
# apt-get install -y sysdig # sysdig proc.name=java and evt.type=open | grep cacerts & systemctl restart foo #7554308 14:25:48.107476643 3 java (6613) < open fd=22(Ah, there's the file I need to mangle for my application./opt/foo/lib/security/cacerts) name=/opt/foo/lib/security/cacerts flags=1(O_RDONLY) mode=0
[Unit]
Description=Elasticsearch 2.4.0
Documentation=http://www.elastic.co
Wants=network-online.target
After=network-online.target
[Service]
Environment=ES_HOME=/opt/elasticsearch-2.4.0
Environment=CONF_DIR=/opt/elasticsearch-2.4.0/config
Environment=DATA_DIR=/var/lib/elasticsearch
Environment=LOG_DIR=/var/log/elasticsearch
Environment=PID_DIR=/var/run/elasticsearch
EnvironmentFile=-/etc/default/elasticsearch-2.4.0
WorkingDirectory=/usr/share/elasticsearch
User=elasticsearch
Group=elasticsearch
ExecStart=/opt/elasticsearch-2.4.0/bin/elasticsearch
Some unit names reflect paths existing in the file system namespace. Example: a device unit dev-sda.device [...]So there might be something special about unit names with a dash in them? Hmm, mv elasticsearch.service elasticsearch_2.4.0.service ; systemctl daemon-reload ; service elasticsearch_2.4.0 start. By golly, that works.
iostat -xk 5 | sed -e "$(mount | awk '/ext3/{print $1"/"$3}' | awk -F/ '/dev/{printf "s/%-10s/%-10s/\n",$3,$NF}')"
Look at the mounted filesystems. If they're EXT3, grab the first and third entry (dev and mountpoint) and write out "s/sdk /oradata3 /" (spacing is important to keep the iostat columns aligned). Pass that to sed to transform the iostat output.
--Joe
CEF (if you're not aware) is a supposed standard that HP/Arcsight has for exchanging event data. I've found it described at various dead links to the arcisght.com website, or one active location at http://mita-tac.wikispaces.com/file/view/CEF+White+Paper+071709.pdf .
In theory, it has everything needed to wrap up any sort of event data into a convenient wrapper format. It's a pipe-delimited format, UTF-8 encoded, and each line indicates the CEF version (CEF:0 in all the data I have) so it's futureproof.
Except that it isn't really pipe-delimited. Sure, the first 7 columns are pipe-delimited, and have well-defined column names. And pipes embedded in the first 7 columns must be escaped with a backslash, and there's no support for quoting the value to escape the contents. But oh well, other than that, it's just a matter of looking for the first non-escaped 7 pipes.
It's the 8th column that's giving me fits, though. In order to make CEF a useful standard, everything interesting about the event is stuffed into the "Extension" field, which is made up of key=value pairs, where the keys and values are vendor-defined.
This Extension field is not pipe-delimited. It's space-separated key=value pairs. And the value can contain space characters without any protection. The only thing that's restricted in the values are \\, \=, \r, and \n. The following is a perfectly legal extension:
foo=bar baz=0This straightforwardly sets two keys (foo and baz) to their appropriate values. Another valid extension is
foo=bar anotherkey=c:\\program files\\ceci n'est pas une pipe (|) has an \= to us!\n\\ so go away baz=0This would set the same keys as above (foo and baz) plus the "anotherkey" would be set to
c:\program files\ceci n'est pas une pipe (|) has an = to us! \ so go away
So to parse the CEF record, first I need to look at the first 7 columns where the only legal escapes are \| and \\, and I get 7 nicely-named fields. Then take the rest of the line, and split it on unescaped =, look back one word from there, and that becomes the key, and everything up to the last word before the next = is the value. (I'm pretty sure that the key can not contain a space, but that's not stated in the spec)
Here's what I came up with to parse out the extension pairs. Note that I'm not a great perl optimizer, suggestions are welcome.
# Pull off thefirst keyword
(undef,$key,$extension) = split( /([^\s]+)=/, $extension, 2);
while ( $key ne "" ) {
# split returns the value, the part that matches the () in the split
# expression, and the rest of the string.
($prevval,$nextkey,$extension)=split( /([^\s\\]+)=/, $extension, 2);
($line{$key}=$prevval) =~s/\s+$//; # Store the discovered key/value pair
$key=$nextkey;
}
sudo apt-get install libpam-krb5 krb5-user kinit myusername # Check that things work sudo pam-auth-update # Tell PAM that you want both KRB and local authentication ssh localhost # Use your windows password to log inAnd then go in and change your /etc/shadow entry to lock out the password you initially set for your username, by changing the encrypted string to *KRB*.
openssl genrsa -out servername.key 2048
openssl req -new -x509 -key servername.key -out servername.csr
#
#Send off the CSR to get it signed, and pull down the intermediate CA certificates that our internal authority uses to sign.
#
openssl pkcs12 -export -in servername.cert -certfile intermediate.cert -inkey servername.key > servername.p12
#Give it a password at least 6 characters long so that Java doesn't complain
keytool -importkeystore -srckeystore servername.p12 -destkeystore servername.jks -srcstoretype pkcs12
sysctl net.ipv4.ip_local_reserved_ports=1520-1530,3200-3699,7937-8065
targen -v -d 2 target
printtarg -i SS -v -a .4 -t 300 -p 4x6 -s -m 10 target
create or replace procedure cleanup_clone
( p_vmname in varchar )
as
begin
delete from SVI_VM_NAME where NAME = p_vmname;
delete from SVI_COMPUTER_NAME where NAME = p_vmname;
delete from SVI_SC_PDISK_INFO where PARENT_ID in
(select id from SVI_SIM_CLONE where VM_NAME = p_vmname);
delete from SVI_SC_BASE_DISK_KEYS where PARENT_ID in
(select id from SVI_SIM_CLONE where VM_NAME = p_vmname);
delete from SVI_SIM_CLONE where VM_NAME = p_vmname;
commit;
end cleanup_clone;