VirtualTam's bookmarks

141. Manage sensitive data with Docker secrets | Docker Documentation 2018-09-27

     tags: linux/container/docker, secret, security, security/authentication, security/password, security/token

     [ permalink ]

     • https://github.com/moby/moby/issues/13490
142. Jenkins Pipeline and Google Cloud Registry 2018-09-20

     tags: cloud/gcp, continuous-integration/jenkins, linux/container/docker, linux/container/kubernetes, pipeline, registry, security/authentication, security/token

     [ permalink ]

     • https://medium.com/google-cloud/how-to-push-docker-image-to-google-container-registry-gcr-through-jenkins-job-52b9d5ce9f7f
     • https://cloud.google.com/solutions/using-jenkins-for-distributed-builds-on-compute-engine
     • https://codeascraft.com/2018/06/05/deploying-to-google-kubernetes-engine/
143. jib: Build container images for your Java applications. 2018-09-19

     tags: linux/container, linux/container/docker, programming/java, programming/java/maven, security

     [ permalink ]

     • https://cloudplatform.googleblog.com/2018/07/introducing-jib-build-java-docker-images-better.html
     • https://dzone.com/articles/building-docker-image-for-a-spring-boot-app
     • https://www.reddit.com/r/programming/comments/8xen0j/jib_google_container_tool_for_building_java/
     • https://news.ycombinator.com/item?id=17497026
144. Using Kubernetes in Jenkins (declarative?) pipelines 2018-09-14

     tags: continuous-integration/jenkins, linux/container/docker, linux/container/kubernetes, pipeline

     [ permalink ]

     Kubernetes plugin and examples:

     • https://github.com/jenkinsci/kubernetes-plugin
     • https://jenkins.io/doc/pipeline/steps/kubernetes/

     Kubernetes pipeline plugin:

     • https://github.com/jenkinsci/kubernetes-pipeline-plugin
     • https://jenkins.io/doc/pipeline/steps/kubernetes-pipeline-steps/

     Relevant issues:

     • https://issues.jenkins-ci.org/browse/JENKINS-48135 - Multiple containers in declarative pipelines
     • https://issues.jenkins-ci.org/browse/JENKINS-51353 - Request for volumes in declarative pipelines

     Persisting volumes:

     • https://kubernetes.io/docs/concepts/storage/persistent-volumes/
     • https://cloud.google.com/kubernetes-engine/docs/concepts/persistent-volumes
     • https://devopscube.com/persistent-volume-google-kubernetes-engine/
     • http://www.monkeylittle.com/blog/2017/02/08/adding-persistent-volumes-to-jenkins-with-kubernetes-volumes.html
     • https://stackoverflow.com/questions/48068973/volume-mounting-in-jenkins-on-kubernetes

     Declarative pipelines with YAML spec:

     • https://github.com/jenkinsci/kubernetes-plugin/blob/master/examples/declarative-multiple-containers.groovy
     • https://stackoverflow.com/questions/47470498/how-to-define-multiple-containers-in-declarative-pipeline

     Scripted pipelines:

     • https://www.twistlock.com/2018/07/24/jenkins-pipeline-kubernetes-building-containers-integrating-security/

     XML (!):

     • https://itnext.io/running-jenkins-builds-in-containers-458e90ff2a7b
145. The X-Windows Disaster – Don Hopkins 2018-09-10

     tags: display, graphics, network/ssh, programming/c, protocol, remote, security/authentication, unix, x11

     [ permalink ]
146. RabbitMQ - Password Hashing 2018-08-28

     tags: cryptography/hash, message-broker/rabbitmq, programming/python, security, security/authentication, security/password

     [ permalink ]

     • https://www.rabbitmq.com/passwords.html
     • https://stackoverflow.com/questions/41306350/how-to-generate-password-hash-for-rabbitmq-management-http-api
     • https://gist.github.com/christianclinton/faa1aef119a0919aeb2e
     • https://stackoverflow.com/questions/9594125/salt-and-hash-a-password-in-python
     • https://docs.python.org/3/library/hashlib.html
     • https://docs.python.org/3/library/base64.html
147. Building Docker Images for Static Go Binaries – Kelsey Hightower – Medium 2018-08-18

     tags: linux, linux/container/docker, network/transport-layer-security, programming/go

     [ permalink ]
148. Linux-Kernel Archive: [PATCH v1 0/3] WireGuard: Secure Network Tunnel 2018-08-01

     tags: linux, network/vpn, network/vpn/wireguard

     [ permalink ]

     • https://marc.info/?l=linux-netdev&m=153306429108040&w=2
     • https://marc.info/?l=linux-netdev&m=153306429908043&w=2
     • https://marc.info/?l=linux-netdev&m=153306437408074&w=2
     • https://marc.info/?l=linux-netdev&m=153306440208084&w=2
     • https://lkml.org/lkml/2017/11/10/666
     • https://www.phoronix.com/scan.php?page=news_item&px=WireGuard-Plans-November-2017
     • https://www.phoronix.com/scan.php?page=news_item&px=WireGuard-V1-Review
149. Mac OS X - Creating Launch Daemons and Agents 2018-07-30

     tags: apple/macos, continuous-integration, security, service, system, user

     [ permalink ]

     • http://nsbogan.com/mobile%20ci/2015/02/01/mobile-ci-daemon-vs-agent
     • https://stackoverflow.com/questions/16875401/daemon-vs-user-agent-convention-on-osx
     • https://superuser.com/questions/763532/logstash-agent-doesnt-run-as-a-daemon-on-mac-os-x-10-9-1#764209
150. An Overview of Cryptography | Gary C. Kessler 2018-07-25

     tags: cipher, cryptography, cryptography/certificate, cryptography/encryption, cryptography/hash, security

     [ permalink ]

     • https://www.garykessler.net/library/securityurl.html
151. Let's Encrypt with HAProxy 2018-07-25

     tags: cryptography/certficate, letsencrypt, network/http, network/http-server/haproxy, network/tcp, network/transport-layer-security

     [ permalink ]

     • https://github.com/letsencrypt/acme-spec/issues/33
     • https://coolaj86.com/articles/adventures-in-haproxy-tcp-tls-https-ssh-openvpn/
     • https://blog.chmd.fr/ssh-over-ssl-episode-4-a-haproxy-based-configuration.html
152. Keycloak - Open Source Identity and Access Management 2018-07-23

     tags: red-hat, security, security/authentication, security/authorization, single-sign-on, user

     [ permalink ]

     • https://github.com/keycloak
     • https://github.com/keycloak/keycloak
     • https://developers.redhat.com/blog/2018/03/19/sso-made-easy-keycloak-rhsso/
     • https://github.com/keycloak/keycloak-quickstarts
     • https://github.com/ibuetler/docker-keycloak-traefik-workshop
153. iptables 2018-07-04

     tags: linux, linux/iptables, network, network/firewall, network/router, sysadmin

     [ permalink ]

     Documentation:

     • https://www.netfilter.org/documentation/index.html
     • https://www.netfilter.org/documentation/HOWTO//netfilter-hacking-HOWTO.html
     • https://www.netfilter.org/documentation/HOWTO//networking-concepts-HOWTO.html
     • https://www.netfilter.org/documentation/HOWTO//NAT-HOWTO.html
     • https://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO.html
       • https://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-6.html
       • https://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-7.html

     Articles:

     • https://www.digitalocean.com/community/tutorials/how-the-iptables-firewall-works
     • https://www.digitalocean.com/community/tutorials/how-to-list-and-delete-iptables-firewall-rules
     • https://www.digitalocean.com/community/tutorials/iptables-essentials-common-firewall-rules-and-commands
     • https://www.digitalocean.com/community/tutorials/a-deep-dive-into-iptables-and-netfilter-architecture
     • https://www.digitalocean.com/community/tutorials/how-to-choose-an-effective-firewall-policy-to-secure-your-servers

     How-tos:

     • https://wiki.centos.org/HowTos/Network/IPTables
     • https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-iptables-on-ubuntu-14-04

     Routing:

     • https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html
     • https://www.frozentux.net/iptables-tutorial/images/tables_traverse.jpg
     • https://www.frozentux.net/iptables-tutorial/images/table_subtraverse.jpg
     • https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg

     RHEL Documentation:

     • https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-firewalls-common_iptables_filtering
     • https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-firewalls-forward_and_nat_rules
     • https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-firewalls-malicious_software_and_spoofed_ip_addresses
     • https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-firewalls-iptables_and_connection_tracking
     • https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-iptables
     • https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-setting_and_controlling_ip_sets_using_iptables
154. Tinc VPN 2018-07-04

     tags: configuration-management/ansible, linux, network, network/vpn, security

     [ permalink ]

     • https://www.digitalocean.com/community/tutorials/how-to-install-tinc-and-set-up-a-basic-vpn-on-ubuntu-14-04
     • https://www.digitalocean.com/community/tutorials/how-to-use-ansible-and-tinc-vpn-to-secure-your-server-infrastructure
     • https://github.com/thisismitch/ansible-tinc
155. goldfish: A HashiCorp Vault UI written with VueJS and Vault native Go API 2018-06-29

     tags: cloud, dashboard, framework/vue.js, programming/go, security/authentication

     [ permalink ]

     • https://github.com/vue-bulma/vue-admin
     • https://www.reddit.com/r/golang/comments/6bayk0/vuejs_golang_a_hashicorp_vault_ui/
156. docker_auth: Authentication server for Docker Registry 2 2018-06-26

     tags: linux/container/docker, network/ldap, network/transport-layer-security, security/authentication

     [ permalink ]

     • https://hub.docker.com/r/cesanta/docker_auth/
     • https://github.com/kwk/docker-registry-setup
     • https://docs.docker.com/registry/spec/auth/token/
157. mimikatz: A little tool to play with Windows security 2018-06-25

     tags: hack, microsoft/windows, programming/c, programming/python, security, security/password

     [ permalink ]

     • https://github.com/skelsec/pypykatz
     • http://blog.gentilkiwi.com/securite/mimikatz/overpass-the-hash
158. ldapjs 2018-06-19

     tags: network/ldap, programming/javascript, programming/node.js, security/authentication

     [ permalink ]

     • https://nodejs.org/en/blog/uncategorized/ldapjs-a-reprise-of-ldap/
159. OpenVAS - OpenVAS - Open Vulnerability Assessment System 2018-06-14

     tags: network, operating-system, security, sysadmin

     [ permalink ]
160. https - How to run Gitlab in docker container with nginx-proxy over ssl with letsencrypt securely - Stack Overflow 2018-06-11

     tags: linux/container/docker, network/http, network/http-server/nginx, network/proxy, network/transport-layer-security, source-code-management/git, source-code-management/gitlab

     [ permalink ]

     Container setup:

     • https://gist.github.com/netdesk/c1db2985b542f9916995139318e5a7ce
     • https://hub.docker.com/r/jwilder/nginx-proxy/
     • https://hub.docker.com/r/jrcs/letsencrypt-nginx-proxy-companion/

     Gitlab settings:

     • https://docs.gitlab.com/omnibus/docker/
     • https://docs.gitlab.com/ce/administration/environment_variables.html
     • https://docs.gitlab.com/omnibus/settings/ssl.html
     • https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/files/gitlab-config-template/gitlab.rb.template

     Performance considerations:

     • https://docs.gitlab.com/omnibus/settings/memory_constrained_envs.html (skip the cgroups section for Gitaly as we are already running in a container)
     • https://docs.gitlab.com/ee/update/#gitaly-omnibus-gitlab-configuration-structure-change for Gitlab 16 changes to Gitaly configuration