BossLa harmakhis971

Keycloak Admin CLI Cheat Sheet

This document provides some examples about how to use kcadm to manage a realm's configuration.

Configuring Token Exchange Permission for a Client

Enable permissions to a client

./kcadm.sh update clients/{client_id}/management/permissions -f - << EOF

PSQL

Magic words:

psql -U postgres

Some interesting flags (to see all, use -h or --help depending on your psql version):

-E: will describe the underlaying queries of the \ commands (cool for learning!)
-l: psql will list all databases and then exit (useful if the user you connect with doesn't has a default database, like at AWS RDS)

Renew GPG key

Given that your key has expired.

$ gpg --list-keys
$ gpg --edit-key KEYID

Use the expire command to set a new expire date:

iLO Remote Console

This small script lets you start iLO Java-based console from shell.

But why not HTML5?

iLO 2/3 doesn't have HTML5 console
Mounting local (from the client computer) ISOs is PAINFULLY slow via HTML5 client

TL;DR

If you just start it, it will ask you for everything:

Ubuntu-Server-Hardening

1. Secure Shared Memory

What is shared memory?

Shared memory is an efficient means of passing data between programs. Because two or more processes can use the same memory space, it has been discovered that, since shared memory is, by default, mounted as read/write, the /run/shm space can be easily exploited. That translates to a weakened state of security.

If you’re unaware, shared memory can be used in an attack against a running service. Because of this, you’ll want to secure that portion of system memory.

vault server --dev --dev-root-token-id="root" PreReq: export VAULT_ADDR=http://127.0.0.1:8200/ export VAULT_TOKEN=root

# Enable transit secrets engine
path "sys/mounts/transit" {
  capabilities = [ "create", "read", "update", "delete", "list" ]
}

# uname -a
Linux base 4.0.5-gentoo #1 SMP Wed Jul 1 02:23:16 JST 2015 x86_64 Intel(R) Xeon(R) CPU E5-2640 0 @ 2.50GHz GenuineIntel GNU/Linux

Packages

# emerge -pvq openldap openssh sssd sudo
[ebuild R ] net-nds/openldap-2.4.38-r2 USE="berkdb crypt gnutls ipv6 minimal sasl ssl syslog tcpd -cxx -debug -experimental -icu -iodbc -kerberos -odbc -overlays -perl -samba (-selinux) -slp -smbkrb5passwd" ABI_X86="(64) -32 (-x32)"

	#!/usr/bin/env python3

	"""
	Dell iDRAC client launcher for Linux, macOS and Windows.
	probably works with Dell iDRAC 6/7/8

	Downloads needed Java files and sets up port forwarding via SSH.

	example usage: ./idracclient.py -J jumphost.lol.domain srv42-serviceprocessor.lol.domain
	for more info, see ./idracclient.py --help

	# set to system default proxy
	[System.Net.WebRequest]::DefaultWebProxy = [System.Net.WebRequest]::GetSystemWebProxy()
	[System.Net.WebRequest]::DefaultWebProxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials

	# or a custom one
	[System.Net.WebRequest]::DefaultWebProxy = New-Object System.Net.WebProxy("http://localhost:8080")

	# or use username and password auth
	[System.Net.WebRequest]::DefaultWebProxy = New-Object System.Net.WebProxy("http://localhost:8080",$true)
	[System.Net.WebRequest]::DefaultWebProxy.Credentials = New-Object System.Net.NetworkCredential($user, $passwd)

	#!/bin/sh

	# SOURCES:
	# QNAP persistent smb.conf commands @ https://forum.qnap.com/viewtopic.php?t=132175
	# Socket options @ https://calomel.org/samba_optimize.html
	# Server multichannel support / AIO @ https://blog.chaospixel.com/linux/2016/09/samba-enable-smb-multichannel-support-on-linux.html
	# Min receivefile, RW raw, AIO switched aio to 16384 @ https://superuser.com/a/928126

	netbios_wrapper()
	{