drconopoima

fs.file-max = 9223372036854775807
fs.inotify.max_queued_events = 16384
fs.inotify.max_user_instances = 8192
fs.inotify.max_user_watches = 195047
fs.protected_fifos = 2
fs.protected_hardlinks = 1
fs.protected_regular = 2
fs.protected_symlinks = 1
fs.suid_dumpable = 2
fs.xfs.xfssyncd_centisecs = 3000

drconopoima

fs.file-max = 2097152
fs.inotify.max_user_watches = 524288
fs.xfs.xfssyncd_centisecs = 10000
kernel.core_pattern = /dev/null
kernel.dmesg_restrict = 1
kernel.kexec_load_disabled = 1
kernel.kptr_restrict = 2
kernel.nmi_watchdog = 0
kernel.printk = 3 3 3 3
kernel.sched_pelt_multiplier = 2

drconopoima

Mounting storage

fork of mounting-storage.md

Container Linux Configs can be used to format and attach additional filesystems to Container Linux nodes, whether such storage is provided by an underlying cloud platform, physical disk, SAN, or NAS system. This is done by specifying how partitions should be mounted in the config, and then using a systemd mount unit to mount the partition. By systemd convention, mount unit names derive from the target mount point, with interior slashes replaced by dashes, and the .mount extension appended. A unit mounting onto /var/www is thus named var-www.mount.

Mount units name the source filesystem and target mount point, and optionally the filesystem type. Systemd mounts filesystems defined in such units at boot time. The following example formats an EC2 ephemeral disk and then

drconopoima

language: rust
cache: cargo
rust:
  - stable
before_cache: |
  cargo install cargo-tarpaulin
before_script:
- rustup component add rustfmt
- rustup component add clippy
- cargo install cargo-audit

drconopoima

version: 2
jobs:
  build-and-test:
    docker:
      - image: circleci/rust
    environment:
      # Fail the build if there are warnings
      RUSTFLAGS: '-D warnings'
    steps:
      - checkout

drconopoima

name: Security audit
on:
  push:
    paths:
      - '**/Cargo.toml'
      - '**/Cargo.lock'
jobs:
  security_audit:
    runs-on: ubuntu-latest
    steps:

drconopoima

image: "rust:latest"

default:
  before_script:
    - rustc --version 
    - cargo --version

stages:
  - test

drconopoima

#!/bin/bash
mkdir ~/SSLCA/root/
cd ~/SSLCA/root/
openssl genrsa -aes256 -out rootca.key 2048
openssl req -sha256 -new -x509 -days 1826 -key rootca.key -out rootca.crt
touch certindex
echo 1000 > certserial
echo 1000 > crlnumber
echo '
[ ca ]

drconopoima

# OpenSSL Root CA configuration file
# Copy to /root/ca/openssl_root.cnf

[ ca ]
default_ca = CA_default

[ CA_default ]
# Directory and file locations.
dir               = /root/ca
certs             = $dir/certs

drconopoima

Create your CA database to keep track of signed certificates

$ mkdir private certs cnf csr crl
$ touch index.txt
$ echo 1000 > serial

Create Your OpenSSL Config File