kubernetes arch chart

 

A dumb script

 It just does the job and forgive me for not having time to make it better (e.g ..at least putting the pswd in a variable!!!.) ..nah ...Im just too lazy to do it:

###Need sshpass installed , for passing over the password text

#!/bin/sh

SERVERLIST=serverlist.input
RCMD1='uptime'
RCMD2='cat /etc/passwd | grep hacker' 
while read SERVERNAME
 do
    echo "----------------------">>Remote_Exec_report.txt
    echo $SERVERNAME>>Remote_Exec_report.txt
    sshpass -p 'YourPassword'    ssh -o StrictHostKeyChecking=no -n root@$SERVERNAME $RCMD1 >>Remote_Exec_report.txt
    echo "------checking hacker user, no output expected-------">>Remote_Exec_report.txt
    sshpass -p 'YourPassword'    ssh -o StrictHostKeyChecking=no -n root@$SERVERNAME $RCMD2 >>Remote_Exec_report.txt
    echo "------Done checking-------">>Remote_Exec_report.txt
done < "$SERVERLIST"

iptables NAT

vim /etc/sysctl.conf 

net.ipv4.ip_forward = 1

sysctl -p

# iptables -t nat -P POSTROUTING DROP

# iptables -t nat -A POSTROUTING -o interfacename -j MASQUERADE

FirewallD

 Have been working on iptables for yrs and still cant get used to the more "friendly" firewalld, well, here it is the cheatsheet:

• -drop: The lowest level of trust. All incoming connections are dropped without reply and only outgoing connections are possible.
• -block: Similar to the above, but instead of simply dropping connections, incoming requests are rejected with an icmp-host-prohibited or icmp6-adm-prohibited message.
• -public: Represents public, untrusted networks. You don’t trust other computers but may allow selected incoming connections on a case-by-case basis.
• -external: External networks in the event that you are using the firewall as your gateway. It is configured for NAT masquerading so that your internal network remains private but reachable.
• -internal: The other side of the external zone, used for the internal portion of a gateway. The computers are fairly trustworthy and some additional services are available.
• -dmz: Used for computers located in a DMZ (isolated computers that will not have access to the rest of your network). Only certain incoming connections are allowed.
• -work: Used for work machines. Trust most of the computers in the network. A few more services might be allowed.
• -home: A home environment. It generally implies that you trust most of the other computers and that a few more services will be accepted.
• -trusted: Trust all of the machines in the network. The most open of the available options and should be used sparingly.

firewall-cmd --state

firewall-cmd --get-default-zone

firewall-cmd --get-active-zones

firewall-cmd --list-all

firewall-cmd --get-zones

firewall-cmd --zone=home --list-all

firewall-cmd --zone=home --list-all-zones

firewall-cmd --zone=home --change-interface=eth0

firewall-cmd --set-default-zone=home

firewall-cmd --get-services

Service Definition:

/usr/lib/firewalld/services

firewall-cmd --reload

firewall-cmd --get-services

firewall-cmd --zone=public --add-service=http

firewall-cmd --zone=public --permanent --add-service=http

firewall-cmd --zone=public --list-services

firewall-cmd --zone=public --add-port=5000/tcp

firewall-cmd --zone=public --permanent --add-port=4990-4999/udp

firewall-cmd --permanent --zone=public --remove-service=dhcpv6-client

firewall-cmd --zone=public --permanent --remove-port=443/tcp

firewall-cmd --zone=public --list-ports

firewall-cmd --runtime-to-permanent

Targets definition:

• ACCEPT: accept the packet.
• %%REJECT%%: reject the packet, returning a reject reply.
• DROP: drop the packet, returning no reply.
• default: don't do anything. The zone washes its hands of the problem, and kicks it "upstairs".

firewall-cmd --permanent --zone=public --set-target=DROP

Shell script with ps and kill

====Gotta love awk and shell!!!!======

# ps -ef | grep sshd
root      152725       1  0 Jul21 ?        00:00:46 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root      408824  152725  0 06:44 ?        00:00:00 sshd: root
root      408949  152725  0 06:44 ?        00:00:00 sshd: root
root      409031  152725  0 06:44 ?        00:00:00 sshd: root
root      409113  152725  0 06:44 ?        00:00:00 sshd: root
root      409194  152725  0 06:44 ?        00:00:00 sshd: root
root      409265  152725  0 06:44 ?        00:00:00 sshd: root
root      409266  152725  0 06:44 ?        00:00:00 sshd: root
root      409407  152725  0 06:44 ?        00:00:00 sshd: root
root      409478  152725  0 06:44 ?        00:00:00 sshd: root
root      409549  152725  0 06:45 ?        00:00:00 sshd: root
root      409630  152725  0 06:45 ?        00:00:00 sshd: root
root      409701  152725  0 06:45 ?        00:00:00 sshd: root
root      409785  152725  0 06:45 ?        00:00:00 sshd: root
root      410949  152725  0 18:56 ?        00:00:00 sshd: root@pts/0
root      411192  411077  0 19:15 pts/0    00:00:00 grep --color=auto sshd

# ps -ef | grep sshd | grep -v -e listener -e color -e pts | awk '{print $2}'

408824
408949
409031
409113
409194
409265
409266
409407
409478
409549
409630
409701
409785

# for pid in $(ps -ef | grep sshd | grep -v -e listener -e color -e pts | awk '{print $2}'); do kill -9  $pid; done

Cumulus....cumulus.....

net add interface swp11 link autoneg on

net add interface swp11 link speed 40000

ip link set dev swp3s0 up

net commit

sudo l1-show swp3s0

sudo cat /etc/lsb-release

sudo ethtool -m swp1

sudo net del interface swp3s0

sudo net add interface swp3 breakout 4x

====sometimes the breakout command doesnt work, then try to nano the ports.conf====

sudo nano /etc/cumulus/ports.conf

/etc/network/interfaces

EVE with Wireshark remote capture

 Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\capture]
@="URL:UNetLab interface capture"
"URL Protocol"=""
[HKEY_CLASSES_ROOT\capture\shell]
[HKEY_CLASSES_ROOT\capture\shell\open]
[HKEY_CLASSES_ROOT\capture\shell\open\command]
@="\"C:\\Program Files\\Wireshark\\wireshark_wrapper.bat\" %1"

======wireshark_wrapper.bat file=============

========================================================

As long as you get putty works with key, this would be easy, plink will use default putty settings(key in my case) find out the plink file from putty package, and install wireshark with sshtcpdump (ssh remote capture)

=======================================================

@ECHO OFF

SET USERNAME="root"

SET PASSWORD="blablablabla"

SET S=%1

SET S=%S:capture://=%

FOR /f "tokens=1,2 delims=/ " %%a IN ("%S%") DO SET HOST=%%a&SET INT=%%b

IF "%INT%" == "pnet0" SET FILTER=" not port 22"

ECHO "Connecting to %USERNAME%@%HOST%..."

"C:\Program Files\PuTTY\plink.exe" -ssh -pw %PASSWORD% %USERNAME%@%HOST% "tcpdump -U -i %INT% -s 0 -w -%FILTER%" | "C:\Program Files\Wireshark\Wireshark.exe" -k -i -