William Desportes williamdes

Proxmox with LVM-thin and why we should use Trim/Discard

Excerpts from the Proxmox VE Administration Guide]

LVM normally allocates blocks when you create a volume. LVM thin pools instead allocates blocks when they are written. This behaviour is called thin-provisioning, because volumes can be much larger than physically available space.

8.10.2. Trim/Discard It is good practice to run fstrim (discard) regularly on VMs and containers. This releases data blocks that the filesystem isn’t using anymore. It reduces data usage and resource load. Most modern operating systems issue such discard commands to their disks regularly. You only need to ensure that the Virtual Machines enable the disk discard option.

Creating a self-signed certificate for example.com (if you already have a certificate you can skip this step):

openssl req -x509 -newkey rsa:4096 -sha256 -days 365 -nodes \
  -keyout cert.key -out cert.crt -extensions ext  -config \
  <(echo "[req]"; 
    echo distinguished_name=req; 
    echo "[ext]";
 echo "keyUsage=critical,digitalSignature,keyEncipherment";

phpmyadmin

UTC: 2025-02-24 19:48 Nek-/choco-phpmyadmin

This file is automatically generated by the update_all.ps1 script using the AU module.

Ignored | History | Force Test | Releases

Jouons avec le phishing Paypal

Courant septembre, j'ai testé un développement qui cherche des patterns parmi (les certificats TLS venant d'être délivrés publiquement)[http://certstream.calidog.io/]. La limite de cette recherche, c'est qu'elle s'applique sur des noms de domaines et pas des URL complètes ! Il suffit de filtrer ces certificats avec le mot-clé « paypal » pour obtenir des dizaines de noms de domaines malveillants par jour, avec parfois... juste un .zip à la racine. Comme j'en ai attrapé quelques-uns (ici 16shop), c'est l'occasion de les décortiquer ;)

Comment ça marche ?

Essayons de comprendre comment les attaquants travaillent !

	#!/bin/bash

	trust="{1.1.1.1/32, 1.0.0.1/32, 8.8.8.8/32, 114.114.114.114/32, 114.114.115.115/32}"

	declare -A sets
	#sets["firehol2"]="https://iplists.firehol.org/files/firehol_level2.netset"
	sets["blocklist_net_ua"]="https://iplists.firehol.org/files/blocklist_net_ua.ipset"
	sets["firehol3"]="https://iplists.firehol.org/files/firehol_level3.netset"

	table_name="sink"

	<?php

	use Rector\Doctrine\Set\DoctrineSetList;
	use Rector\Symfony\Set\SymfonySetList;
	use Rector\Symfony\Set\SensiolabsSetList;
	use Rector\Nette\Set\NetteSetList;
	use Rector\Config\RectorConfig;
	use Rector\Php80\Rector\Class_\AnnotationToAttributeRector;
	use Rector\Php80\ValueObject\AnnotationToAttribute;

	# log4j jndi exploit CVE-2021-44228 filter
	# Save this file as /etc/fail2ban/filter.d/log4j-jndi.conf
	# then copy and uncomment the [log4j-jndi] section
	# to /etc/fail2ban/jail.local
	#
	# [email protected]
	# https://jay.gooby.org/2021/12/13/a-fail2ban-filter-for-the-log4j-cve-2021-44228
	# https://gist.github.com/jaygooby/3502143639e09bb694e9c0f3c6203949
	# Thanks to https://gist.github.com/kocour for a better regex
	#

	# TODO: Setup https://github.com/silvermine/serverless-plugin-cloudfront-lambda-edge
	sentryOriginReq:
	handler: handlers/handler.default
	lambdaAtEdge:
	distribution: AppDistribution
	eventType: origin-request
	includeBody: true
	pathPattern: /_tunnel # TODO: Choose tunnel path.

	#!/bin/sh

	# Copyright 2012 The Android Open Source Project
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#