northox

$ ruby ruote_scheduler.rb
Submited at 2012-10-23 22:09:42 -0400
job.job_id: Rufus::Scheduler::EveryJob_4748540 at 2012-10-23 22:09:42 -0400job.job_id: Rufus::Scheduler::EveryJob_4748540 at 2012-10-23 22:09:42 -0400
job.job_id: Rufus::Scheduler::EveryJob_4748540 at 2012-10-23 22:09:42 -0400
job.job_id: Rufus::Scheduler::EveryJob_4748540 at 2012-10-23 22:09:42 -0400job.job_id: Rufus::Scheduler::EveryJob_4748540 at 2012-10-23 22:09:42 -0400
job.job_id: Rufus::Scheduler::EveryJob_4748540 at 2012-10-23 22:09:42 -0400job.job_id: Rufus::Scheduler::EveryJob_4748540 at 2012-10-23 22:09:42 -0400job.job_id: Rufus::Scheduler::EveryJob_4748540 at 2012-10-23 22:09:42 -0400
job.job_id: Rufus::Scheduler::EveryJob_4748540 at 2012-10-23 22:09:42 -0400job.job_id: Rufus::Scheduler::EveryJob_4748540 at 2012-10-23 22:09:42 -0400
job.job_id: Rufus::Scheduler::EveryJob_4748540 at 2012-10-23 22:09:42 -0400job.job_id: Rufus::Scheduler::EveryJob_4748540 at 2012-10-23 22:09:42 -0400
job.job_id: Rufus::Scheduler::EveryJob_4748540 at 2012

northox

#!/bin/sh
# @author: Danny Fullerton - Mantor Organization
error=0
errormakesnap=""
errorstop=""
errorstart=""

expr $1 + 0 > /dev/null 2>&1
if [ $? -ne 0 ]; then
  echo "'Number of backup' argument is not integer value." 

northox

Principle

At no point should the Nagios server be able to run arbitrary command on monitored systems (aka only non-logonable ids), i.e. no value can be dynamically pass between the client and the server. The SSH server (i.e. munin-client) must use the SSH key to define which command to execute.

Client side - Nagios server

Define per-command ssh keys - ssh-keygen.

e.g. /home/nagios/dns

#!/bin/bash
echo `ssh -i /home/nagios/.ssh/bacula_rsa -q [email protected]`

northox

Keybase proof

I hereby claim:

• I am northox on github.
• I am northox (https://keybase.io/northox) on keybase.
• I have a public key whose fingerprint is 8A70 E815 92F5 262A EEB1 7BF1 1055 33C9 CF49 C615

To claim this, I am signing this object:

northox

#!/usr/bin/env python
#
# Single click backup of QubesOS - beacause, really, there's no need to protect 
# the password in dom0. If it's ever accessed, it was already game over.
# 
# Author: Danny Fullerton - Mantor Organization
# 
# Usage
# - Mod commands accordingly, e.g. filesystem, path, drive
# - Create a file in dom0:~/.backup.pass containing your password.

northox

#!/bin/sh
path=snapshots
url=ftp://openbsd.cs.toronto.edu/pub/OpenBSD/
rel=`uname -r`
major=`echo $rel | sed 's/\..*//'`
minor=`echo $rel | sed 's/.*\.//'`

mkdir -p $path
cd $path

northox

ikev2 "inet" passive ipcomp esp \
  from 0.0.0.0/0 to 10.0.1.0/24 \
  from 10.0.0.0/24 to 10.0.1.0/24 \
  local egress peer any \
  srcid egress \
  psk "strong-password" \
  config protected-subnet 0.0.0.0/0 \
  config address 10.0.1.0/24 \
  config name-server 10.0.0.1 \
  tag IKED

northox

#!/bin/ksh
DIRPATH='/etc/bacula/bacula-dir.conf'

NOERROR='Backup missing for: '
ERROR=$NOERROR
TODAY=`date "+%v" | sed 's/-20/-/'`
OKSTATUS=`echo 'status storage=FileStorage' | bconsole | grep ${TODAY} | grep OK`
CLIENTS=`grep '^Client {' -A1 $DIRPATH | grep Name | sed -E 's/ +Name = ([a-zA-Z]+)-fd/\1/'`

for c in $CLIENTS; do

northox

#!/bin/sh
v=63
dotv=6.3
url=ftp://openbsd.cs.toronto.edu/pub/OpenBSD/
files='{man*tgz,comp*tgz,base*tgz,bsd*,INS*,SHA256.sig}'
vfiles='{man*tgz,comp*tgz,base*tgz,bsd*,INS*}'

mkdir $v
cd $v