coelner/gedankensplitter
1
0
Fork 0
Code Pull Requests Releases Activity

minor

Browse Source
This commit is contained in:
coelner 2023-03-10 08:54:19 +01:00
parent fdf52868cc
commit b463b16276
2 changed files with 25 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
linux_hardening.md
View File

@ -749,14 +749,17 @@ ERC settings: `smartctl -l scterc /dev/sda` or setting `smartctl -l scterc,150,1
- https://man7.org/linux/man-pages/man8/integritysetup.8.html - https://man7.org/linux/man-pages/man8/integritysetup.8.html
## pacman based integrity check
### package manager integrity
##### pacman based integrity check
``` ```
pacutils: sudo paccheck --md5sum --quiet pacutils: sudo paccheck --md5sum --quiet
AUR: sudo check-pacman-mtree.lua -a AUR: sudo check-pacman-mtree.lua -a
``` ```
## apt based integrity check ##### apt based integrity check
<!--
```
(https://askubuntu.com/posts/891158/timeline) (https://askubuntu.com/posts/891158/timeline)
For checking the integrity of an individual file in a package against the repositories, there's no easy way short of downloading the package. The repositories typically provide these files: For checking the integrity of an individual file in a package against the repositories, there's no easy way short of downloading the package. The repositories typically provide these files:
@ -776,14 +779,19 @@ So, if you don't trust the local system:
If a `Contents` file is not available, and you don't trust the local system, have fun downloading _every_ package to see what provided the file. If a `Contents` file is not available, and you don't trust the local system, have fun downloading _every_ package to see what provided the file.
This does not scale. This does not scale.
--> ```
```
debsums --silent -a
```
``` ```
#!/usr/bin/bash #!/usr/bin/bash
sed -n '/Conffiles/,/Description/p' /var/lib/dpkg/status | grep -v Conffiles | grep -v Description | awk '{print $2 " " $1}' > dpkg_hash.md5sum sed -n '/Conffiles/,/Description/p' /var/lib/dpkg/status | grep -v Conffiles | grep -v Description | awk '{print $2 " " $1}' > dpkg_hash.md5sum
md5sum -c --quiet dpkg_hash.md5sum md5sum -c --quiet dpkg_hash.md5sum
echo $? echo $?
debsums ```
```
cd /; for sumfile in /var****/lib/dpkg/info/*.md5sums; do /usr/bin/md5sum --quiet -c "$sumfile"; done;
``` ```
At least this gets you a step in front of someone. At least this gets you a step in front of someone.

24
openwrt-selfbuild.md
View File

@ -13,7 +13,7 @@
``` ```
#### rc.local #### rc.local
``` ```
#iw phy1 set distance auto # iw phy1 set distance auto
touch /var/run/mosquitto.pid touch /var/run/mosquitto.pid
chown mosquitto:mosquitto /var/run/mosquitto.pid chown mosquitto:mosquitto /var/run/mosquitto.pid
service mosquitto start service mosquitto start
@ -44,15 +44,15 @@ config command
``` ```
#### /etc/crontabs/root #### /etc/crontabs/root
``` ```
#5 */1 * * * curl -s -f -X PUT -u "waenger@googlemail.com:e04d4a9f56cbdd8d6da7fe91119807e7fbb85dba" -d '{"ip_address": "auto"}' https://api.twodns.de/hosts/koelner.dynvpn.de 2>&1 > /dev/null # 5 */1 * * * curl -s -f -X PUT -u "waenger@googlemail.com:e04d4a9f56cbdd8d6da7fe91119807e7fbb85dba" -d '{"ip_address": "auto"}' https://api.twodns.de/hosts/koelner.dynvpn.de 2>&1 > /dev/null
5 */5 * * * curl -s -f --header "Authorization:Token 367e6bae0552cdfd133a9d222f56dcf9a79a0e99" https://update.dedyn.io/update?username=koelner.dedyn.io 2>&1 > /dev/null 5 */5 * * * curl -s -f --header "Authorization:Token 367e6bae0552cdfd133a9d222f56dcf9a79a0e99" https://update.dedyn.io/update?username=koelner.dedyn.io 2>&1 > /dev/null
# #
5 2 * * * curl -s -f --header "Authorization:Token 367e6bae0552cdfd133a9d222f56dcf9a79a0e99" https://update.dedyn.io/update?username=geekable.dedyn.io 2>&1 > /dev/null 5 2 * * * curl -s -f --header "Authorization:Token 367e6bae0552cdfd133a9d222f56dcf9a79a0e99" https://update.dedyn.io/update?username=geekable.dedyn.io 2>&1 > /dev/null
#5 */5 * * * curl -s -f --header "Authorization:Token 367e6bae0552cdfd133a9d222f56dcf9a79a0e99" https://update6.dedyn.io/update?username=koelner.dedyn.io 2>&1 > /dev/null # 5 */5 * * * curl -s -f --header "Authorization:Token 367e6bae0552cdfd133a9d222f56dcf9a79a0e99" https://update6.dedyn.io/update?username=koelner.dedyn.io 2>&1 > /dev/null
#5 */1 * * * curl -s -f --header "Authorization:Token 367e6bae0552cdfd133a9d222f56dcf9a79a0e99" https://update.dedyn.io/update?username=cloud.koelner.dedyn.io 2>&1 > /dev/null # 5 */1 * * * curl -s -f --header "Authorization:Token 367e6bae0552cdfd133a9d222f56dcf9a79a0e99" https://update.dedyn.io/update?username=cloud.koelner.dedyn.io 2>&1 > /dev/null
#5 */1 * * * curl -s -f --header "Authorization:Token 367e6bae0552cdfd133a9d222f56dcf9a79a0e99" https://update.dedyn.io/update?username=git.koelner.dedyn.io 2>&1 > /dev/null # 5 */1 * * * curl -s -f --header "Authorization:Token 367e6bae0552cdfd133a9d222f56dcf9a79a0e99" https://update.dedyn.io/update?username=git.koelner.dedyn.io 2>&1 > /dev/null
#5 */1 * * * curl -s -f --header "Authorization:Token 367e6bae0552cdfd133a9d222f56dcf9a79a0e99" https://update.dedyn.io/update?username=sync.koelner.dedyn.io 2>&1 > /dev/null # 5 */1 * * * curl -s -f --header "Authorization:Token 367e6bae0552cdfd133a9d222f56dcf9a79a0e99" https://update.dedyn.io/update?username=sync.koelner.dedyn.io 2>&1 > /dev/null
#5 */1 * * * curl -s -f --header "Authorization:Token 367e6bae0552cdfd133a9d222f56dcf9a79a0e99" https://update.dedyn.io/update?username=pyload.koelner.dedyn.io 2>&1 > /dev/null # 5 */1 * * * curl -s -f --header "Authorization:Token 367e6bae0552cdfd133a9d222f56dcf9a79a0e99" https://update.dedyn.io/update?username=pyload.koelner.dedyn.io 2>&1 > /dev/null
``` ```
#### /etc/mosquitto/mosquitto.conf #### /etc/mosquitto/mosquitto.conf
``` ```
@ -76,8 +76,8 @@ user mosquitto
``` ```
#!/bin/sh #!/bin/sh
opkgInstalled="$(opkg list-installed 2> /dev/null | wc -l)" #silencing error output opkgInstalled="$(opkg list-installed 2> /dev/null | wc -l)" # silencing error output
opkgUpgradable="$(opkg list-upgradable 2> /dev/null | wc -l)" #silencing error output opkgUpgradable="$(opkg list-upgradable 2> /dev/null | wc -l)" # silencing error output
echo "$opkgInstalled packages are installed." && echo "$opkgUpgradable packages can be upgraded." && echo echo "$opkgInstalled packages are installed." && echo "$opkgUpgradable packages can be upgraded." && echo
echo "Upgrade commands:" echo "Upgrade commands:"
@ -162,7 +162,7 @@ luci-theme-bootstrap
luci-theme-material luci-theme-material
luci-app-commands luci-app-commands
luci-app-nlbwmon luci-app-nlbwmon
luci-app-ntpc # luci-app-ntpc chrony-nts
luci-app-upnp luci-app-upnp
luci-app-wireguard luci-app-wireguard
luci-app-wol luci-app-wol
@ -180,9 +180,9 @@ kmod-nls-cp850
kmod-nls-iso8859-1 kmod-nls-iso8859-1
kmod-nls-utf8 kmod-nls-utf8
kmod-loop kmod-loop
kmod-fs-ext4 # kmod-fs-ext4
kmod-fs-vfat kmod-fs-vfat
kmod-fs-exfat # kmod-fs-exfat
kmod-usb-serial kmod-usb-serial
kmod-usb-serial-ch341 kmod-usb-serial-ch341
kmod-usb-serial-cp210x kmod-usb-serial-cp210x