Ken Garland garlandkr

Secured HLS setup with Nginx as media server

This example is part of this article.

This is an example for an HLS delivery with basic security. Nginx compiled with nginx-rtmp-module & secure-link is used as media server. Features:

Domain filtering
Referrer filtering
Embed buster

(Note: I wrote this up quickly and without a lot of research, so there are probably inaccuracies. However, I wanted to put this out there in case it helps someone else hitting this issue. Github gists like this unfortunately don't have comment notifications, so if you want me to send me a comment, use my email [email protected] and not the comments.)

Problem: Can't use sudo command-limiting in Ansible

The ability to limit sudo users to only be able to execute certain commands doesn't work with Ansible (without a workaround).

This isn't a problem if you're running Ansible as a super-user like root, but if you are allowing others to run Ansible on your systems in order to do things like application deploys, then you need a way to limit their access to the system for basic security.

For example, a line in /etc/sudoers like this:

	# Configuration file for dircolors, a utility to help you set the
	# LS_COLORS environment variable used by GNU ls with the --color option.
	#
	# Copyright (C) 1996-2013 Free Software Foundation, Inc.
	# Copying and distribution of this file, with or without modification,
	# are permitted provided the copyright notice and this notice are preserved.
	#
	# The keywords COLOR, OPTIONS, and EIGHTBIT (honored by the
	# slackware version of dircolors) are recognized but ignored.

	################################
	# install mlnxofed driver
	################################
	download: https://www.mellanox.com/products/infiniband-drivers/linux/mlnx_ofed

	################################
	# put HCA's in IPOIB mode
	################################

	mst start # start mellanox software tools

	/*
	* Adds a team to all the repos in a Github organization. This is a tedious
	* process in the UI. You'll need a newer version of node to run this (e.g 9+)
	* because it uses async/await.
	*
	* Instructions:
	*
	* 1. Copy this file somewhere on your computer, e.g. ~/addteamrepos.js
	* 2. Fill in the uppercase variables below with the right values
	* 3. Run this file: `$ node ~/addteamrepos.js`

	--------------------------------------------------------------------------
	# ofed_info -s
	--------------------------------------------------------------------------
	Find Mellanox Adapter Type and Firmware/Driver version
	ConnectX-4 card

	# lspci \| grep Mellanox
	0a:00.0 Network controller: Mellanox Technologies MT27500 Family [ConnectX-3]
	# lspci -vv -s 0a:00.0 \| grep "Part number" -A 3
	# lspci \| grep Mellanox \| awk '{print $1}' \| xargs -i -r mstvpd {}


	root@dhcp104:~# cat /etc/update-motd.d/91-release-upgrade
	#!/bin/sh

	# if the current release is under development there won't be a new one
	if [ "$(lsb_release -sd \| cut -d' ' -f4)" = "(development" ]; then
	exit 0
	fi
	if [ -x /usr/lib/ubuntu-release-upgrader/release-upgrade-motd ]; then
	exec /usr/lib/ubuntu-release-upgrader/release-upgrade-motd

	<?xml version="1.0" encoding="UTF-8"?>

	<opml version="1.0">
	<head>
	<title>Pierre subscriptions in feedly Cloud</title>
	</head>
	<body>
	<outline text="security" title="security">
	<outline type="rss" text="Threatpost" title="Threatpost" xmlUrl="http://threatpost.com/feed" htmlUrl="https://threatpost.com"/>
	<outline type="rss" text="BleepingComputer" title="BleepingComputer" xmlUrl="http://www.bleepingcomputer.com/feed/" htmlUrl="https://www.bleepingcomputer.com/"/>

	import argparse
	import ConfigParser
	import logging
	import logging.handlers
	import os.path
	import subprocess
	import sys
	import threading
	import time
	import traceback

	# Indexes
	mongodb_indexes:
	catalog: [
	"db.serviceMetadata.createIndex({service: 1, objectId: 1},{background: true})",
	"db.program.createIndex({title:1},{background : true})" ]
	guid: [
	"db.guids.createIndex({type:1},{background:true})",
	"db.guids.createIndex({'data.peopleInfo.type':1,'data.peopleInfo.firstname':1},{background:true, sparse:true})" ]