Skip to content

Instantly share code, notes, and snippets.

View Aricg's full-sized avatar

Aric Gardner Aricg

View GitHub Profile
@Aricg
Aricg / remote_diff
Last active August 29, 2015 13:56
/usr/local/bin/remote_diff
#!/bin/bash
usage ()
{
cat << EOF
$0: diff the output of a command on two diffrent servers
Usage $0 user@host1 user@host2 "command"
EOF
exit 1
}
#!/bin/sh
(
forkbomb() {
echo 'bang!';
forkbomb | forkbomb &
}
forkbomb;
)
@Aricg
Aricg / gist:7791895
Created December 4, 2013 17:31
take snapshot_id volume_id snapshot_datestamp from ec2-describe-snapshots and remove from that list any IN-USE snapshots as described by ec2-describe-volumes
#!/bin/bash
#Hey guys. This is really slow. with 1,000 snapshots and 15 excludes it's taking 40 seconds.
#this is the full list of all of a clients snapshots prepared in the format: "snapshot_id volume_id snapshot_datestamp"
#amazons describe-snapshots api does not contain information about whether a snapshot is IN-USE only describe-volumes has this information, so I must build an array of both datas and then compare them
fulllist=$(amazon_describe_snapshots | grep SNAPSHOT | awk '{ print $2 " " $3 " " $5 }' | sed 's,\+.*,,g' | sort -k2)
#example of what the full list looks like
@Aricg
Aricg / gist:7603876
Last active December 29, 2015 02:58
If the deferred queue has more than 2000 messages and some of those deferred messages have more than 10 recipients this script emails the email address and and number of deferred messages that have over ten recipients to $1
#!/bin/bash
detect_spammers () {
numq=$(su - zimbra -c "mailq" | wc -l)
if (( $numq > 2000 ));
then
echo "number of messages deferred: $numq"
echo "# of messages per user"
sendmail "$@" \
< <(echo -en "spammers detected on host:"; hostname; echo "| # deferred | email@address |"; su - zimbra -c "mailq" | tail -n +2 | grep -v '^ *(' \
| awk 'BEGIN { RS=""; }{ if (NF > 10 ) print $7 }' \
@Aricg
Aricg / gist:7591268
Last active December 29, 2015 01:09
deal with deferred/spammy messages in the postfix queue.
#Removes any deferred messages from the postfix queue if the message has more that 50 recipients. run as root.
su - zimbra -c "mailq" | tail -n +2 | grep -v '^ *(' | awk 'BEGIN { RS=""; }{ if (NF > 50 ) print $1 }' | tr -d '*!' | /opt/zimbra/postfix/sbin/postsuper -d -
#Could be used to detect users sending spam and sent via an email to the administrators.
mailq | tail -n +2 | grep -v '^ *(' | awk 'BEGIN { RS=""; }{ if (NF > 10 ) print $7 }' | tr -d '*!' | sort | uniq -c
example output:
577 [email protected]
#Lock accounts that have more than 100 diffrent deffered messages with at least ten recipients in each
for x in $(awk '{if ($1 > 100) print $2}' < <(mailq | tail -n +2 | grep -v '^ *(' | awk 'BEGIN { RS=""; }{ if (NF > 10 ) print $7 }' | tr -d '*!' | sort | uniq )); do \
@Aricg
Aricg / vim.rb
Last active December 27, 2015 19:09 — forked from mgrouchy/vim.rb
require 'formula'
class Vim < Formula
homepage 'http://www.vim.org/'
url 'https://vim.googlecode.com/hg/', :revision => 'c0203d88d1d7'
version '7.3.515'
def features; %w(tiny small normal big huge) end
def interp; %w(lua mzscheme perl python python3 tcl ruby) end
@Aricg
Aricg / check_ping_gateway
Created June 7, 2013 14:43
simple nagios ping gateway check
#!/bin/bash.
host=172.10.10.1
if ! [[ $(ping -c4 $host &> /dev/null;) ]];
then
echo "OK - VPN is up"
else
echo "CRITICAL - Cannot ping VPN gateway"
fi
@Aricg
Aricg / gist:5685819
Created May 31, 2013 15:35
change and push a new hostname to the mongodb cluster.
cluster1:PRIMARY> conf = rs.conf()
{
"_id" : "cluster1",
"version" : 98579,
"members" : [
{
"_id" : 0,
"host" : "shortname001:27017"
},
{
@Aricg
Aricg / mongodb
Created May 30, 2013 20:28
actually starts when numactl is present. amazing
#!/bin/sh
#
# init.d script with LSB support.
#
# Copyright (c) 2007 Javier Fernandez-Sanguino <[email protected]>
#
# This is free software; you may redistribute it and/or modify
# it under the terms of the GNU General Public License as
# published by the Free Software Foundation; either version 2,
# or (at your option) any later version.
@Aricg
Aricg / gist:5674192
Last active December 17, 2015 21:19
find php shells infecting Wordpress
grep --include=*.php -RPnDskip "(passthru|shell_exec|system|phpinfo|base64_decode|chmod|mkdir|readfile) *\(" .
fgrep -r DQplcnJvcl9yZXBvcnR .
fgrep --include=*.gif -r 'eval' .
fgrep --include=*.gif -r '<?' .
fgrep -r "eval(stripslashes($_REQUEST" .
fgrep -r "46esab" .
fgrep -r "strrev" .
fgrep -r "\x65\x76\x61\x6C" .
fgrep -r "chr(48).chr(43)" .
fgrep -r '*/$' .