YHL Security Blog

/etc/systemd/system/autossh.service

################################################################################
#
#
#
################################################################################
[Unit]

Description=AutoSSH tunnel service for AWX C2
After=network-online.target

[Service]
Type=simple
User=<username>
Environment="AUTOSSH_GATETIME=0"
Environment="AUTOSSH_LOGLEVEL=7"
ExecStart=/usr/bin/autossh -M 0 -N -T -q -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" awslnx001

[Install]
WantedBy=multi-user.target

config:

Host rlgway
Hostname x.x.x.x
User <username?
Port 22
IdentityFile ~/.ssh/<file>
GSSAPIAuthentication no
GSSAPIDelegateCredentials no
RemoteForward 2223 localhost:22

Saturday, April 27, 2019

Ansible to Windows via Kerberos

#####
##### krb5.keytab w. spn stored securely
#####
root@ldaptest:/home/YHL.LOC/ansible/playbooks# klist -k /etc/krb5.keytab
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
1 ansible@YHL.LOC

#####
##### krb5 klist after logged in
#####
ansible@ldaptest:~/playbooks$ klist
Ticket cache: FILE:/tmp/krb5cc_657801107_o9jMRd
Default principal: ansible@YHL.LOC

Valid starting Expires Service principal
04/27/2019 22:50:06 04/28/2019 08:50:06 krbtgt/YHL.LOC@YHL.LOC
renew until 05/04/2019 22:50:05

#####
##### ansible hosts
#####
[all]
dnsdc01.yhl.loc
dnsdc02.yhl.loc

[all:vars]
ansible_user = ansible@YHL.LOC
ansible_connection = winrm
ansible_port = 5985
ansible_winrm_transport = kerberos
#ansible_winrm_cert_validation = ignore
ansible_become = false

###
### ansible-playbook run
###
ansible@ldaptest:~/playbooks$ ansible-playbook -i hosts ipconfig.yml

PLAY [ipconfig module] *********************************************************

TASK [setup] *******************************************************************
ok: [dnsdc01.yhl.loc]
ok: [dnsdc02.yhl.loc]

TASK [run ipconfig command] ****************************************************
changed: [dnsdc01.yhl.loc]
changed: [dnsdc02.yhl.loc]

PLAY RECAP *********************************************************************
dnsdc01.yhl.loc : ok=3 changed=1 unreachable=0 failed=0
dnsdc02.yhl.loc : ok=3 changed=1 unreachable=0 failed=0

#####
##### klist post ansible run
#####
ansible@ldaptest:~/playbooks$ klist
Ticket cache: FILE:/tmp/krb5cc_657801107
Default principal: ansible@YHL.LOC

Valid starting Expires Service principal
04/27/2019 22:40:12 04/28/2019 08:40:12 krbtgt/YHL.LOC@YHL.LOC
renew until 05/04/2019 22:40:08
04/27/2019 23:02:46 04/28/2019 08:40:12 HTTP/dnsdc01.yhl.loc@YHL.LOC
renew until 05/04/2019 22:40:08
04/27/2019 23:02:46 04/28/2019 08:40:12 HTTP/dnsdc02.yhl.loc@YHL.LOC
renew until 05/04/2019 22:40:08

Tuesday, March 12, 2019

Quiet Cisco backups

Stop prompting for crap so it can be automated:

file prompt quiet

Cisco 3750 switch ssh client config

Host sw-3-1
Hostname <foo>
User <username>
Port 22
IdentityFile ~/.ssh/pubkeyfile
KexAlgorithms +diffie-hellman-group1-sha1
Ciphers +aes128-cbc

Friday, March 1, 2019

Mac OS Show Hidden Files

There are thousands of files and folders hidden away on your Mac so that you can't meddle with them. Sometimes, however, you need to to be able to see the hidden files on your Mac.

Perhaps you want to tweak something following a tip you've seen on Macworld. Maybe you're troubleshooting a problem with a program and you've been asked to delete a preference file or find a log file that will help you fix the problem. Some Mac users may want to remove some of these hidden files as they take up valuable disk space.

In this article we explain how to locate these hidden files and folders in the Finder, including the most searched-for folder: the mysterious ~/Library folder.

(If you're trying to find a Word file that's vanished, by the way, you may like to consult How to get back deleted Word files instead. You may also be able to recover lost files if you have a Time Machine backup.)

What files are hidden on a Mac?

In UNIX, hidden files are preceded by a . and won't show up in a normal file list. They could be a .htaccess file, a .bash_profile, or a .svn directory, for example. Folders like /usr, /bin, and /etc are also hidden away.

The hidden folder that users are most likely to want to access is the Library folder (~/Library). It's where your personal application-support files and, in some cases, data is stored.

Why are some files and folders hidden?

Some of these folders and files are considered too confusing or even dangerous for most users so they are hidden away. You might feel confident that you know what you're doing on your Mac, but there are plenty of Mac users who could cause damage or data loss if they were able to mess with files in the Library, for example.

Where is my Mac's Library folder?

Prior to Mac OS X Lion's release back in 2011, if you wanted to access the Library folder you could just open your Home folder and view the Library folder there. That folder is still located in Home, but it's now hidden.

You may have just looked in your Macintosh HD folder and thought you saw the Library folder, but that's not the Library folder in question. There are actually three Library folders on the Mac.

The Library folder you can see contains files that are accessible to all users but only changeable by administrators. Then there is the ~/Library folder that's located in the Home folder. The third Library folder is located in System and contains all the files that MacOS needs to run.

Spot the difference - compare these three Library folders:

How to show hidden files on a Mac: Library folder

How to view a Mac's ~/Library folder

There are three ways to easily view your hidden ~/Library/ folder.

In macOS Sierra Apple added a Finder keyboard shortcut that makes it possible to quickly show all the hidden files and folders. You just need to do the following:

Open the Finder
Go to your Macintosh HD folder (access this from Devices in the left column)
Hold down Cmd + Shift + . (dot)
All the hidden files will become visible
Hold down Cmd + Shift + . (dot) a second time to hide the files again

The easiest way to find your hidden ~/Library/ folder is to do the following:

Open Finder
Hold down Alt (Option) and choose Go from the dropdown menu bar at the top of the screen
You will see the ~/Library folder listed below the Home folder

Alternatively, you could do the following:

Open the Finder
Choose Go from the menu bar
Choose Go to Folder (or Shift + Cmd + G)
Type ~/Library into the text box and click Go

You can now see and access the contents of the ~/Library which were previously hidden from sight.

How to keep the hidden ~/Library folder visible

If you follow the second and third methods above the ~/Library will remain visible until you shut that Finder window. Next time you look it will have vanished again. If you follow the first method in Sierra the hidden files and folders will remain in view until you press Cmd + Shift + . (dot) a second time.

If you're using a pre-Sierra version of macOS, there are ways to keep the hidden ~/Library folder visible. The easiest way is to drag the hidden Library icon from the Finder window to the Finder sidebar. This will make it accessible even after you've closed the Finder.

Alternatively, make an alias to the library folder that you can access from your desktop. To make an alias of your Library folder, do the following:

Opened the ~/Library folder in the Finder
Hold down Cmd + Alt and drag the Library folder icon from the Finder window to your desktop

How to view hidden folders using Terminal

Another way to make hidden files and folders visible requires you to use Terminal.

Open Terminal
Run the following script:
$ defaults write com.apple.Finder AppleShowAllFiles true
$ killall Finder

If you want to switch it back, simply change the true to false.

Saturday, February 9, 2019

Mount Raspbian file systems

I needed to "inject" a first-boot script into the Raspbian image so I needed to "crack open" the .img file in order to add something to /etc/init/rc.local. I came across this article on how to do it: https://raspberrypi.stackexchange.com/questions/13137/how-can-i-mount-a-raspberry-pi-linux-distro-image

Here are the offsets and commands to mount up the Raspbian 2018-11-13 image:

fdisk -l 2018-11-13-raspbian-stretch.img

Disk 2018-11-13-raspbian-stretch.img: 3405 MB, 3405774848 bytes, 6651904 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: dos
Disk identifier: 0x025ce4e3

Device Boot Start End Blocks Id System
2018-11-13-raspbian-stretch.img1 8192 98045 44927 c W95 FAT32 (LBA)
2018-11-13-raspbian-stretch.img2 98304 6651903 3276800 83 Linux

512 * 8192 = 4194304
512 * 98304 = 50331648

mkdir /mnt/img
mkdir /mnt/img/one
mkdir /mnt/img/two

mount -v -o offset=4194304 -t vfat 2018-11-13-raspbian-stretch.img /mnt/img/one
mount -v -o offset=50331648 -t ext4 2018-11-13-raspbian-stretch.img /mnt/img/two