Iksas

security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict

How to get a stack trace for each thread in a running python script

Sometimes a python script will simply hang forever with no indication of where things went wrong. Perhaps it's polling a service that will never return a value that allows the program to move forward. Here's a way to see where the program is currently stuck.

Install gdb and pyrasite

Install gdb.

# Redhat, CentOS, etc

Create a new local tunnel user to keep the .ssh/config clean

sudo useradd -g nogroup -s /bin/false -m tunnel
sudo -u tunnel mkdir -p ~tunnel/.ssh  # and copy your private key here
sudo -u tunnel nano ~tunnel/.ssh/config  # add host and key configs here and a myhostsshconf (or other name)
sudo -u tunnel ssh myhostsshconf  # just make sure to add your host to `known_hosts`

Create a new systemd service with the same name than an entry in the .ssh/config (myhostsshconf in this example)

Built-in

diskutil erasevolume HFS+ 'RAM Disk' `hdiutil attach -nobrowse -nomount ram://XXXXX`

where XXXXX is the size of the RAM disk in terms of memory blocks.

Notes:

About

I faced bandwidth issues between a WG Peer and a WG server. Download bandwidth when downloading from WG Server to WG peer was reduced significantly and upload bandwidth was practically non existent.
I found a few reddit posts that said that we need to choose the right MTU. So I wrote a script to find an optimal MTU.
Ideally I would have liked to have run all possible MTU configurations for both WG Server and WG Peer but for simplicity I choose to fix the WG Server to the original 1420 MTU and tried all MTUs from 1280 to 1500 for the WG Peer.

Testing

On WG server, I started an iperf3 server
On WG peer, I wrote a script that does the following:
- wg-quick down wg0
Edit MTU in the /etc/wireguard/wg0.conf file

	#!/usr/bin/env python
	#
	# Very basic example of using Python and IMAP to iterate over emails in a
	# gmail folder/label. This code is released into the public domain.
	#
	# RKI July 2013
	# http://www.voidynullness.net/blog/2013/07/25/gmail-email-with-python-via-imap/
	#
	import sys
	import imaplib

	# disable secure boot in the bios, in menu security

	# downlad and unzip refind-bin-0.7.8.zip

	# install refind, assuming your ESP partition is /dev/sda1 and mounted in /boot/efi
	cd refind-bin-0.7.8
	./install.sh

	# type y and go ahead
	# at that time your boot entry should look like that

	Originall From: Posted 2015-05-29 http://ubwg.net/b/full-list-of-ffmpeg-flags-and-options

	This is the complete list that’s outputted by ffmpeg when running ffmpeg -h full.

	usage: ffmpeg [options] [[infile options] -i infile]… {[outfile options] outfile}…

	Getting help:
	-h — print basic options
	-h long — print more options
	-h full — print all options (including all format and codec specific options, very long)

	#!/bin/bash

	unifi_username=USERNAME
	unifi_password='PASSWORD'
	unifi_controller=https://EXAMPLE.COM:8443
	wifi_id=YOUR_WIFI_ID
	cookie=/tmp/cookie

	curl_cmd="curl -s -S --cookie ${cookie} --cookie-jar ${cookie} --insecure "

	APT::Periodic::Update-Package-Lists "1";
	APT::Periodic::Download-Upgradeable-Packages "1";
	APT::Periodic::AutocleanInterval "3";
	APT::Periodic::Verbose "1";
	APT::Periodic::Unattended-Upgrade "1";