All posts by cdstealer

Splunk

Splunk & Systemd

No longer required from Splunk version 7.2.2 onwards

Universal Forwarder

Copy this text into a file named "/usr/lib/systemd/system/splunkforwarder.service".

[Unit]
Description=Splunk Universal Forwarder
Wants=network.target
After=network.target

[Service]
Type=forking
RemainAfterExit=yes
ExecStart=/opt/splunkforwarder/bin/splunk start
ExecStop=/opt/splunkforwarder/bin/splunk stop
ExecReload=/opt/splunkforwarder/bin/splunk restart
StandardOutput=syslog
Restart=always

[Install]
WantedBy=multi-user.target

Next, create a symlink that systemd will use to fetch this control file.

systemctl enable splunkforwarder

That's it.  You can either reboot or run

systemctl start splunkforwarder

SearchHead, Indexer, Heavy Forwarder

Copy this text into a file named "/usr/lib/systemd/system/splunkforwarder.service".

[Unit]
Description=Splunk
Wants=network.target
After=network.target

[Service]
User=splunk
Group=splunk
Type=forking
RemainAfterExit=yes
ExecStart=/opt/splunk/bin/splunk start --answer-yes --no-prompt --accept-license
ExecStop=/opt/splunk/bin/splunk stop
ExecReload=/opt/splunk/bin/splunk restart
StandardOutput=syslog
#ExecStart=/bin/sh -c "echo never >/sys/kernel/mm/transparent_hugepage/enabled"
#ExecStart=/bin/sh -c "echo never >/sys/kernel/mm/transparent_hugepage/defrag"
#ulimit -Sn 65535
#ulimit -Hn 65535
LimitNOFILE=65535
#ulimit -Su 20480
#ulimit -Hu 20480
LimitNPROC=20480
#ulimit -Hf unlimited
#ulimit -Sf unlimited
LimitFSIZE=infinity
LimitCORE=infinity
#Restart=always

[Install]
WantedBy=multi-user.target
 If you have THP compiled into your kernel (hint: it's enabled by default), then you'll need to uncomment the two ExecStart lines

Linux

Joining video files

If you've ever downloaded several video files that made up a complete <insert description>.  There is a very simple way to join them up.

Say you had 3 files video1.avi, video2.avi & video3.avi.  Now provided they've been encoded with identical settings, just follow this process:

1) echo "file 'video1.avi'" >> list.txt
echo "file 'video2.avi'" >> list.txt
echo "file 'video3.avi;" >> list.txt

2) ffmpeg -f concat -i list.txt -c copy video.avi

That's it!

Linux

Nexus Unlock and Root/Unroot.

Original post is here.

Before beginning, you’ll want to install the Android SDK tools onto your computer so you can use tools such as fastboot and adb. Otherwise, you won’t be able to communicate with your Nexus device.  On Gentoo this is done by adding dev-util/android-tools to /etc/portage/package.keywords and then emerge -av dev-util/android-tools.

nexus4_lte_fastboot
Unlocking the Nexus device is really simply. Boot it up into fastboot mode — on the Nexus 4, this is done by holding the Power + Volume Down buttons at the same time. Once you see a screen like above, open up a command line terminal and (assuming you’re using Linux; adjust slightly as appropriate for other operating systems) type fastboot devices. If anything appears from this command, the computer recognizes the Nexus device. Then, type fastboot oem unlock, and accept the warning shown on the Nexus device by navigating with the Volume Buttons and accepting with the Power button. Congratulations, your Nexus device is now unlocked!

Rooting manually is a little tricky, because rooting the stock version of Android (the one that Google provided that originally came with the device) used to be pretty tricky. At least with a Nexus device, you just need to download a flashable CF-Auto-Root file and flash that onto the device, giving you root access. However, you’re still most likely going to need to use a custom recovery, and while you’re at it you may as well install a custom ROM onto your device (which won’t require an additional flash of CF-Auto-Root).

Unrooting your device is nearly impossible to do without flashing stock back onto your device. You’ll need to download the latest factory image from Google’s Android Developer Images site, and move the two included .img files from the .zip into a separate folder, and then open the secondary .zip and move those .img files into the same separate folder as well.

Then type the following commands into your computer while it is connected to the Nexus device:

  1. fastboot devices (to make sure that the computer sees your Nexus 4)
  2. fastboot flash bootloader bootloader_xxxx.img (Replace bootloader_xxxx.img with the actual file name)
  3. fastboot reboot-bootloader
  4. fastboot flash radio radio_xxxx.img (Replace radio_xxxx.img with the actual file name. For Android 4.3, the version should end in a .84)
  5. fastboot reboot-bootloader
  6. fastboot flash system system.img
  7. fastboot flash userdata userdata.img
  8. fastboot flash boot boot.img
  9. fastboot flash recovery recovery.img
  10. fastboot format cache (to remove any old traces of the old system)
  11. OPTIONAL: fastboot oem lock (this re-locks the bootloader to prevent future tinkering with the device, i.e. forces you to “unlock” the bootloader again and wipe the device before tinkering)
  12. fasboot reboot

Conclusion

You should now be back to a completely stock configuration for your Nexus device! Playing around with a Nexus device is a lot of fun, and it provides a great learning experience about how to tinker with Android. Above all, it can provide a lot of extra functionality (such as LTE functionality on the Nexus 4) that isn’t built into Android itself — you just have to go find it yourself.

Linux

25 Most Frequently Used Linux IPTables Rules Examples

I thought this was a very good article.  Credit to the original author.

by Ramesh Natarajan on June 14, 2011

At a first glance, IPTables rules might look cryptic.

In this article, I’ve given 25 practical IPTables rules that you can copy/paste and use it for your needs.

These examples will act as a basic templates for you to tweak these rules to suite your specific requirement.

1. Delete Existing Rules

Before you start building new set of rules, you might want to clean-up all the default rules, and existing rules. Use the iptables flush command as shown below to do this.

iptables -F
(or)
iptables --flush

2. Set Default Chain Policies

The default chain policy is ACCEPT. Change this to DROP for all INPUT, FORWARD, and OUTPUT chains as shown below.

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

When you make both INPUT, and OUTPUT chain’s default policy as DROP, for every firewall rule requirement you have, you should define two rules. i.e one for incoming and one for outgoing.

In all our examples below, we have two rules for each scenario, as we’ve set DROP as default policy for both INPUT and OUTPUT chain.

If you trust your internal users, you can omit the last line above. i.e Do not DROP all outgoing packets by default. In that case, for every firewall rule requirement you have, you just have to define only one rule. i.e define rule only for incoming, as the outgoing is ACCEPT for all packets.

Note: If you don’t know what a chain means, you should first familiarize yourself with the IPTables fundamentals.

3. Block a Specific ip-address

Before we proceed further will other examples, if you want to block a specific ip-address, you should do that first as shown below. Change the “x.x.x.x” in the following example to the specific ip-address that you like to block.

BLOCK_THIS_IP="x.x.x.x"
iptables -A INPUT -s "$BLOCK_THIS_IP" -j DROP

This is helpful when you find some strange activities from a specific ip-address in your log files, and you want to temporarily block that ip-address while you do further research.

You can also use one of the following variations, which blocks only TCP traffic on eth0 connection for this ip-address.

iptables -A INPUT -i eth0 -s "$BLOCK_THIS_IP" -j DROP
iptables -A INPUT -i eth0 -p tcp -s "$BLOCK_THIS_IP" -j DROP

4. Allow ALL Incoming SSH

The following rules allow ALL incoming ssh connections on eth0 interface.

iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

Note: If you like to understand exactly what each and every one of the arguments means, you should read How to Add IPTables Firewall Rules

5. Allow Incoming SSH only from a Sepcific Network

The following rules allow incoming ssh connections only from 192.168.100.X network.

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

In the above example, instead of /24, you can also use the full subnet mask. i.e “192.168.100.0/255.255.255.0″.

6. Allow Incoming HTTP and HTTPS

The following rules allow all incoming web traffic. i.e HTTP traffic to port 80.

iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

The following rules allow all incoming secure web traffic. i.e HTTPS traffic to port 443.

iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

7. Combine Multiple Rules Together using MultiPorts

When you are allowing incoming connections from outside world to multiple ports, instead of writing individual rules for each and every port, you can combine them together using the multiport extension as shown below.

The following example allows all incoming SSH, HTTP and HTTPS traffic.

iptables -A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport --sports 22,80,443 -m state --state ESTABLISHED -j ACCEPT

8. Allow Outgoing SSH

The following rules allow outgoing ssh connection. i.e When you ssh from inside to an outside server.

iptables -A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

Please note that this is slightly different than the incoming rule. i.e We allow both the NEW and ESTABLISHED state on the OUTPUT chain, and only ESTABLISHED state on the INPUT chain. For the incoming rule, it is vice versa.

9. Allow Outgoing SSH only to a Specific Network

The following rules allow outgoing ssh connection only to a specific network. i.e You an ssh only to 192.168.100.0/24 network from the inside.

iptables -A OUTPUT -o eth0 -p tcp -d 192.168.100.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

10. Allow Outgoing HTTPS

The following rules allow outgoing secure web traffic. This is helpful when you want to allow internet traffic for your users. On servers, these rules are also helpful when you want to use wget to download some files from outside.

iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

Note: For outgoing HTTP web traffic, add two additional rules like the above, and change 443 to 80.

11. Load Balance Incoming Web Traffic

You can also load balance your incoming web traffic using iptables firewall rules.

This uses the iptables nth extension. The following example load balances the HTTPS traffic to three different ip-address. For every 3th packet, it is load balanced to the appropriate server (using the counter 0).

iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 0 -j DNAT --to-destination 192.168.1.101:443
iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 1 -j DNAT --to-destination 192.168.1.102:443
iptables -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW -m nth --counter 0 --every 3 --packet 2 -j DNAT --to-destination 192.168.1.103:443

12. Allow Ping from Outside to Inside

The following rules allow outside users to be able to ping your servers.

iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT

13. Allow Ping from Inside to Outside

The following rules allow you to ping from inside to any of the outside servers.

iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

14. Allow Loopback Access

You should allow full loopback access on your servers. i.e access using 127.0.0.1

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

15. Allow Internal Network to External network.

On the firewall server where one ethernet card is connected to the external, and another ethernet card connected to the internal servers, use the following rules to allow internal network talk to external network.

In this example, eth1 is connected to external network (internet), and eth0 is connected to internal network (For example: 192.168.1.x).

iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

16. Allow outbound DNS

The following rules allow outgoing DNS connections.

iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT

17. Allow NIS Connections

If you are running NIS to manage your user accounts, you should allow the NIS connections. Even when the SSH connection is allowed, if you don’t allow the NIS related ypbind connections, users will not be able to login.

The NIS ports are dynamic. i.e When the ypbind starts it allocates the ports.

First do a rpcinfo -p as shown below and get the port numbers. In this example, it was using port 853 and 850.

rpcinfo -p | grep ypbind

Now allow incoming connection to the port 111, and the ports that were used by ypbind.

iptables -A INPUT -p tcp --dport 111 -j ACCEPT
iptables -A INPUT -p udp --dport 111 -j ACCEPT
iptables -A INPUT -p tcp --dport 853 -j ACCEPT
iptables -A INPUT -p udp --dport 853 -j ACCEPT
iptables -A INPUT -p tcp --dport 850 -j ACCEPT
iptables -A INPUT -p udp --dport 850 -j ACCEPT

The above will not work when you restart the ypbind, as it will have different port numbers that time.

There are two solutions to this: 1) Use static ip-address for your NIS, or 2) Use some clever shell scripting techniques to automatically grab the dynamic port number from the “rpcinfo -p” command output, and use those in the above iptables rules.

18. Allow Rsync From a Specific Network

The following rules allows rsync only from a specific network.

iptables -A INPUT -i eth0 -p tcp -s 192.168.101.0/24 --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 873 -m state --state ESTABLISHED -j ACCEPT

19. Allow MySQL connection only from a specific network

If you are running MySQL, typically you don’t want to allow direct connection from outside. In most cases, you might have web server running on the same server where the MySQL database runs.

However DBA and developers might need to login directly to the MySQL from their laptop and desktop using MySQL client. In those case, you might want to allow your internal network to talk to the MySQL directly as shown below.

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT

20. Allow Sendmail or Postfix Traffic

The following rules allow mail traffic. It may be sendmail or postfix.

iptables -A INPUT -i eth0 -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT

21. Allow IMAP and IMAPS

The following rules allow IMAP/IMAP2 traffic.

iptables -A INPUT -i eth0 -p tcp --dport 143 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 143 -m state --state ESTABLISHED -j ACCEPT

The following rules allow IMAPS traffic.

iptables -A INPUT -i eth0 -p tcp --dport 993 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 993 -m state --state ESTABLISHED -j ACCEPT

22. Allow POP3 and POP3S

The following rules allow POP3 access.

iptables -A INPUT -i eth0 -p tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT

The following rules allow POP3S access.

iptables -A INPUT -i eth0 -p tcp --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT

23. Prevent DoS Attack

The following iptables rule will help you prevent the Denial of Service (DoS) attack on your webserver.

iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

In the above example:

  • -m limit: This uses the limit iptables extension
  • –limit 25/minute: This limits only maximum of 25 connection per minute. Change this value based on your specific requirement
  • –limit-burst 100: This value indicates that the limit/minute will be enforced only after the total number of connection have reached the limit-burst level.

24. Port Forwarding

The following example routes all traffic that comes to the port 442 to 22. This means that the incoming ssh connection can come from both port 22 and 422.

iptables -t nat -A PREROUTING -p tcp -d 192.168.102.37 --dport 422 -j DNAT --to 192.168.102.37:22

If you do the above, you also need to explicitly allow incoming connection on the port 422.

iptables -A INPUT -i eth0 -p tcp --dport 422 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 422 -m state --state ESTABLISHED -j ACCEPT

25. Log Dropped Packets

You might also want to log all the dropped packets. These rules should be at the bottom.

First, create a new chain called LOGGING.

iptables -N LOGGING

Next, make sure all the remaining incoming connections jump to the LOGGING chain as shown below.

iptables -A INPUT -j LOGGING

Next, log these packets by specifying a custom “log-prefix”.

iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7

Finally, drop these packets.

iptables -A LOGGING -j DROP
Vegan

California Sunrise Smoothie

Makes approx. 700Ml

Ingredients:

300ml Unsweetened Soy Juice
6-8 Pitted Dates (frozen)
1-2 Bananas (frozen) chunks
1 Generous teaspoon of Maple Syrup
1 teaspoon Maca powder (amazon)

Method:

Bang everything in the blender and blend until smooth (approx 1 min).  The consistency should resemble a thick smoothie. 2 Bananas gives a thicker shake :)

DateNBan_round

Linux

Emergance Resume

Ever had a massive emerge package list and one package refuses to compile?  This happened to me when running an "emerge -e system". You can run an "emerge -1 <package>" upgrade/downgrade, but this won't remove it from the emerge queue.  Running "emerge --resume" will continue the queue starting with the package that failed.

Fear not, "vi /var/cache/edb/mtimedb".  Look for the package that you have just successfully emerged and remove that section from the list.

"mergelist": [
                        [
                                "ebuild",
                                "/",
                                "www-client/chromium-29.0.1547.32",
                                "merge"
                        ],

Running "emerge --resume" will now continue without trying to remerge the problematic package.

Vegan

Banana, Date & Walnut loaf.

Cuts into 10
Preparation time 25 minutes
Cooking time 1 hour 10 minutes - 1 1/4 hours

Ingredients:
400 g (13 oz) bananas, weighed with skins on
1 tablespoon lemon juice
300 g (10 oz) self-raising flour
1 teaspoon baking powder
125 g (4 oz) caster sugar (or coconut sugar)
125 g (4 oz) Soy Spread, melted (or coconut oil)
2 egg substitute
175 g (6 oz) ready-chopped dried dates
100 g (2 oz) walnut pieces

To decorate (optional):
walnut halves
banana chips

Method:
Peel then mash the bananas with the lemon juice.
Put the flour, baking powder and sugar in a mixing
bowl. Add the mashed bananas, melted butter and
egg substitute and mix together. Stir in the dates and walnut
pieces then spoon into a greased 1 kg (2 lb) loaf tin,
its base and 2 long sides also lined with oiled
greaseproof paper. Spread the surface level and
decorate the top with walnut halves and banana chips,
if using.

Bake in the centre of a preheated oven, 160 C
(325 F), gas Mark 3, for 1 hour 10 minutes - 1 1/4 hours
until well risen, the top has cracked and a skewer
inserted into the centre comes out clean. Leave to
cool for 10 minutes then loosen the edges, turn out
on to a wire rack and peel off the lining paper. Leave
to cool completely. Store in an airtight tin for up to
5 days.

Vegan

Linzer Biscuits

Makes 16
Preparation time 35 minutes
Cooking time 16 minutes

Ingredients:
50 g (2 oz) hazelnuts
225 g (7 1/2 oz) plain flour
75 g (3 oz) caster sugar
150 g (5 oz) Soy spread
Finely grated rind of 1/2 lemon
1 egg yolk substitute
4 tablespoons seedless raspberry jam
sifted icing sugar, for dusting

Method:
Grind the hazelnuts very finely in a blender or coffee
grinder. Set aside.

Put the flour and sugar in a mixing bowl or a food
processor. Add the Soy spread and rub in with your
fingertips or process until the mixture resembles fine
breadcrumbs. Stir in the ground hazelnuts and lemon
rind, then mix in the egg yolk substitute and bring the mixture
together with your hands to form a firm dough.

Knead lightly then roll out half of the dough on a
lightly floured surface until  1  cm (1/2  inch) thick. Stamp
out 5.5 cm (2 1/4 inch) circles using a fluted round
biscuit cutter. Transfer to an ungreased baking sheet.
Use a small heart or star-shaped biscuit cutter to
remove 2.5 cm ( 1  inch) hearts or stars from the
middle of half of the biscuits.

Bake the first biscuits in a preheated oven, 160 C
(350 f), Gas Mark 3, for about 8 minutes, until pale
golden brown, then repeat for the remaining dough.

Leave the biscuits to harden for 1-2 minutes then
loosen and transfer to a wire rack to cool.

Divide the Jam evenly among the centres of the whole
biscuits and spread thickly, leaving a border of biscuit
showing, Cover with the hole-cut biscuits, dust with a
little sifted icing sugar and leave to cool completely
before serving.

Vegan

Guinness Cake

Ingredients

for the cake

250ml Guinness
250g unsalted butter
75g cocoa powder
400g caster sugar
142ml sour cream
2 large eggs
1 tablespoon vanilla extract
275g plain flour
2 ½ teaspoons bicarbonate of soda

for the topping

300g cream cheese
150g icing sugar
125ml double cream (or whipping cream)

Method

  1. Preheat the oven to gas mark 4/180°C/350ºF, and butter and line a 23cm / 9 inch springform tin.
  2. Pour the Guinness into a large wide saucepan, add the butter - in spoons or slices - and heat until the butter's melted, at which time you should whisk in the cocoa and sugar. Beat the sour cream with the eggs and vanilla and then pour into the brown, buttery, beery pan and finally whisk in the flour and bicarb.
  3. Pour the cake batter into the greased and lined tin and bake for 45 minutes to an hour. Leave to cool completely in the tin on a cooling rack, as it is quite a damp cake.
  4. When the cake's cold, sit it on a flat platter or cake stand and get on with the icing. Lightly whip the cream cheese until smooth, sieve over the icing sugar and then beat them both together. Or do this in a processor, putting the unsieved icing sugar in first and blitz to remove lumps before adding the cheese.
  5. Add the cream and beat again until it makes a spreadable consistency. Ice the top of the black cake so that it resembles the frothy top of the famous pint.