SSL

Check certificate
https://www.ssllabs.com/ssltest/analyze.html
http://www.panticz.de/Check-SSL-TLS-server-encryption-support

Determine SSL certificate expiration date

openssl x509 -enddate -noout -in www.example.com.pem

List certificate domains

cat *.{crt,pem} | openssl x509 -text | grep DNS
openssl s_client -showcerts -connect www.example.com:443 | openssl x509 -text  | grep DNS

Remove password from private key

openssl rsa -in www.example.key.pass -out www.example.key

Cat / deploy certificate to remote host

ssh host1.example.com cat /root/certificates/example.com/{fullchain1.pem,privkey1.pem} | ssh ${HOST} "cat > /etc/haproxy/ssl/example.com.pem"

Get certificate information

for CERT in *.pem; do
    openssl x509 -subject -enddate -noout -in ${CERT} | paste - -
done

# show all data
openssl x509 -in cert.pem -text -noout

# show expiration date
openssl x509 -enddate -noout -in cert.pem

# show expiration date from p12 file
openssl pkcs12 -in cert1.p12 -legacy -passout pass: -passin pass: | openssl x509 -noout -enddate

# show start date
openssl x509 -startdate -noout -in cert.pem

# show containing DNS names
openssl x509 -text -noout -in fullchain.pem | grep DNS

# show Issuer
openssl x509 -text -noout -in cert.pem | grep Issuer

Show expiration date for multiple certificates

for DIR in $(find * -maxdepth 0 -type d); do
    echo -n "${DIR}: "
    eval openssl x509 -enddate -noout -in "${DIR}/cert*.pem"
done

Marge certificate

openssl dhparam -out dh_parameters.out 2048

for FILE in __example_com.crt QuoVadis_Global_SSL_ICA_G2.crt QuoVadis_Root_CA_2.crt *.key dh_parameters.out; do
    cat "${FILE}"
    echo
done | sed -e "s/\r//g" | sed '/^$/d' > _.example.com.pem

# deploy certificate
rsync --chmod=400 _.example.com.pem root@www1.example.com:/etc/haproxy/ssl/

Letsencrypt
http://www.panticz.de/letsencrypt

Test mailserver SSL
https://ssl-tools.net/mailservers/

Online certificate test
https://www.ssllabs.com/ssltest/analyze.html

Fix grub on btrfs partition 

# mount the btrfs root subvolume
mount /dev/sda1 /mnt -o subvol=/

# (optional) set the default subvolume
btrfs sub set @ /mnt

mount /proc /mnt/proc --bind
mount /dev /mnt/dev --bind
mount /sys /mnt/sys --bind

chroot /mnt

grub-install /dev/sda
update-grub /dev/sda

# activate first partition
fdisk -l /dev/sda

Squid: Compile with SSL support under Debian Wheezy / Jessie

[embed_url: https://raw.githubusercontent.com/panticz/scripts/master/compile.squid.with.ssl.support.sh]

Install packages

apt-get install logrotate
dpkg -i *.deb
apt-get install -f

Test configuration

# squid3 -v
Squid Cache: Version 3.4.8
configure options:  '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--libexecdir=${prefix}/lib/squid3' '--srcdir=.' '--disable-maintainer-mode' '--disable-dependency-tracking' '--disable-silent-rules' '--datadir=/usr/share/squid3' '--sysconfdir=/etc/squid3' '--mandir=/usr/share/man' '--enable-inline' '--disable-arch-native' '--enable-async-io=8' '--enable-storeio=ufs,aufs,diskd,rock' '--enable-removal-policies=lru,heap' '--enable-delay-pools' '--enable-cache-digests' '--enable-icap-client' '--enable-follow-x-forwarded-for' '--enable-auth-basic=DB,fake,getpwnam,LDAP,MSNT,MSNT-multi-domain,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB' '--enable-auth-digest=file,LDAP' '--enable-auth-negotiate=kerberos,wrapper' '--enable-auth-ntlm=fake,smb_lm' '--enable-external-acl-helpers=file_userip,kerberos_ldap_group,LDAP_group,session,SQL_session,unix_group,wbinfo_group' '--enable-url-rewrite-helpers=fake' '--enable-eui' '--enable-esi' '--enable-icmp' '--enable-zph-qos' '--enable-ecap' '--disable-translation' '--with-swapdir=/var/spool/squid3' '--with-logdir=/var/log/squid3' '--with-pidfile=/var/run/squid3.pid' '--with-filedescriptors=65536' '--with-large-files' '--with-default-user=proxy' '--enable-ssl' '--with-open-ssl=/etc/ssl/openssl.cnf' '--enable-linux-netfilter' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wall' 'LDFLAGS=-fPIE -pie -Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security'

Links
http://ubuntuforums.org/showthread.php?t=2171061

Ansible

Release and maintenance / latest versions
# stable
https://docs.ansible.com/ansible/latest/reference_appendices/release_and_maintenance.html#release-status
# devel
https://docs.ansible.com/ansible/devel/modules/list_of_all_modules.html

Ansible playbook repository
https://github.com/panticz/ansible

Install Ansible
http://www.panticz.de/install-ansible

Configuration
https://gist.github.com/wbcurry/f38bc6d8d1ee4a70ee2c
https://docs.ansible.com/ansible/2.4/intro_configuration.html#remote-tmp
https://docs.ansible.com/ansible/latest/reference_appendices/config.html#ansible-configuration-settings-locations
https://raw.githubusercontent.com/ansible/ansible/devel/examples/ansible.cfg

# include order
./ansible.cfg
~/.ansible.cfg
/etc/ansible/ansible.cfg

[defaults]
retry_files_enabled = False
stdout_callback = debug
bin_ansible_callbacks = True
ansible_python_interpreter = /usr/bin/python
host_key_checking = False
inventory = hosts
forks = 99
retry_files_enabled = false
roles_path = ./my_roles
pipelining = True
scp_if_ssh = True
max_fail_percentage = 0

[privilege_escalation]
become=True


cat <> ~/.bashrc
export ANSIBLE_VAULT_PASSWORD_FILE=~/.ansible/.vault_pass
export ANSIBLE_STDOUT_CALLBACK=debug
export ANSIBLE_HOST_KEY_CHECKING=false
# export ANSIBLE_DEBUG=True
# export ANSIBLE_LOG_PATH=/var/log/ansible.log
# export ANSIBLE_PYTHON_INTERPRETER=/usr/bin/python3
EOF

DISPLAY_SKIPPED_HOSTS=0

Callback plugin

# test me
nixy, dense, or debug.
export ANSIBLE_STDOUT_CALLBACK=debug

Configuration

[defaults]
log_path=/var/log/ansible.log
#stdout_callback = yaml
stdout_callback = debug
# inventory = ./inventory
host_key_checking = False
retry_files_enabled = False

[ssh_connection]
retries=999999

Ansible syntax (YAML)
http://docs.ansible.com/ansible/YAMLSyntax.html

Configuration files
http://docs.ansible.com/ansible/intro_configuration.html#host-key-checking

Icinga CLI

schedule a service check

HOST_NAME=www.example.com
SERVICE_NAME=APT
/usr/bin/printf "[%lu] SCHEDULE_FORCED_SVC_CHECK;%s;%s;%s\n" $(date +%s) "${HOST_NAME}" "${SERVICE_NAME}" $(date +%s) | tee -a "${NAGIOS_CMD_SOCKET}"

schedule a host check

NAGIOS_CMD_SOCKET=/var/lib/icinga/rw/icinga.cmd
/usr/bin/printf "[%lu] SCHEDULE_HOST_CHECK;%s;%s\n" \
                 $(date +%s) \
                 "host_name" \
                 $(date +%s) | tee -a $NAGIOS_CMD_SOCKET
curl -d "cmd_typ=7&host=www.example.com&service=APT&force_check&btnSubmit=Commit" "http://monitoring.example.com/cgi-bin/icinga/cmd.cgi" -u 'foo:bar'

Schedule downtime
https://assets.nagios.com/downloads/nagioscore/docs/externalcmds/cmdinfo.php?command_id=118

HOST=www.example.com
STARTDATE=$(date +%s)
ENDDATE=$(($(date +%s) + 7200))
printf "[%lu] SCHEDULE_HOST_DOWNTIME;${HOST};${STARTDATE};${ENDDATE};0;0;7200;rundeck;Deployment" ${STARTDATE} > /data/icinga/var/rw/icinga.cmd

Schedule downtime for specific services

IFS=$(echo -en "\n\b")
STARTDATE=$(date +%s)
ENDDATE=$(date +%s -d "next monday 12:00:00")
DURATION=$((${ENDDATE} - ${STARTDATE}))

KNOWN_ISSUES="
srv1-dev,Swap Usage
srv3-prod,Hardware
"

for ISSUE in ${KNOWN_ISSUES}; do
    HOST=$(echo ${ISSUE} | cut -d"," -f1)
    SERVICE="$(echo ${ISSUE} | cut -d"," -f2)"
    echo "HOST: ${HOST}"
    echo "SERVICE: ${SERVICE}"

    printf "[%lu] SCHEDULE_SVC_DOWNTIME;${HOST};${SERVICE};${STARTDATE};${ENDDATE};0;0;${DURATION};SysAdmin1;FixMe" ${STARTDATE} > /data/icinga/var/rw/icinga.cmd
    sleep 1
done

Links
http://www.box293.com/guides/tricks/nagios-command-pipe-and-cgis
https://icinga.com/docs/icinga1/latest/en/cgiparams.html
https://stackoverflow.com/questions/6842683/how-to-set-downtime-for-any-specific-nagios-host-for-certain-time-from-commandli

Install OpenRA (Command & Conquer Red Alert) under Ubuntu

Install openRA with snap

sudo snap install openra

Install original videos for C&C
https://github.com/OpenRA/OpenRA/wiki/Game-Content
https://cncnz.com/features/freeware-classic-command-conquer-games/

sudo snap connect openra:removable-media

sudo apt install unrar

sudo mkdir /media/openra

# C&C
wget https://files.cncnz.com/cc1_tiberian_dawn/full_game/GDI95.zip -q -P /tmp
wget https://files.cncnz.com/cc1_tiberian_dawn/full_game/NOD95.zip -q -P /tmp
wget https://files.cncnz.com/cc1_tiberian_dawn/full_game/CovertOps_ISO.zip -q -P /tmp

unzip /tmp/GDI95.zip -d /tmp/
unzip /tmp/NOD95.zip -d /tmp/
unzip /tmp/CovertOps_ISO.zip -d /tmp/

sudo mount /tmp/GDI95.iso /media/openra

openra.cnc

# Manage Content > Detect Disc or Installation > Select content > Continue

sudo umount /media/openra
sudo mount /tmp/NOD95.iso /media/openra

# Detect Disc or Installation > Select content > Continue

sudo umount /media/openra
sudo mount /tmp/covert.iso /media/openra

# Detect Disc or Installation > Select content > Continue

sudo umount /media/openra

Install original videos for RedAlert

wget https://files.cncnz.com/red_alert/full_game/RedAlert1_AlliedDisc.rar -qP /tmp/
wget https://files.cncnz.com/red_alert/full_game/RedAlert1_SovietDisc.rar -qP /tmp/

unrar x /tmp/RedAlert1_AlliedDisc.rar /tmp/
unrar x /tmp/RedAlert1_SovietDisc.rar /tmp/

sudo mount  /tmp/RedAlert1_AlliedDisc/RedAlert1_AlliedDisc/CD1_ALLIED_DISC.ISO /media/openra

opnera.ra
Manage Content > Detect Disc or Installation

sudo umount /media/openra
sudo mount  /tmp/RedAlert1_SovietDisc/RedAlert1_SovietDisc/CD2_SOVIET_DISC.ISO /media/openra

Retry

sudo umount /media/openra

rm -r /media/openra
rm -r /tmp/RedAlert1_*

Check for latest version
https://snapcraft.io/openra