View source for Very Windy

= lvm procedure =
  <nowiki>Die VM-Disk /dev/sda wurde vergrössert
    1. Ist Zustand prüfen
        lsblk
    2. Disk "sda" neu einlesen
        echo 1 > /sys/block/sda/device/rescan
    3. Partition vergrössern
        growpart /dev/sda 3
    4. PV überprüfen
        pvs
        4a. allenfalls physical volume vergrössern
            pvresize /dev/sda3
    5. VG überprüfen
        vgs
    6. LV vergrössern und Filesystem vergrössern
        lvresize -rL+50G /dev/mapper/system-docker
        lvextend -rl +100%FREE /dev/mapper/vm208-root</nowiki>

== git ==
<code>git submodule update --init</code> Submodule laden<br>
<code>git submodule update --init --recursive</code> Submodule laden (rekursiv)<br>
<code>git submodule update --remote</code> Submodule laden (remote)<br>
<br>
<code>git submodule update</code> Submodule aktualisieren<br>
<br>
Append information after commit:<br>
<code>git commit --amend --author "Ueli Hans<hans.ueli@uelihans.ch>"</code><br>
<br>
Temporarily store current changes and revert to latest pull:<br>
<code>git stash</code><br>
Go back to stashed changes:<br>
<code>git stash pop</code>

== openssl ==
Check CSR:<br>
<code>openssl req -in sample.csr -noout -text</code><br>
<br>
Bash to check private key against certificate (checkssl.sh):
  <nowiki>cn=files/reverseproxies/etc/haproxy/certs/www.sexybit.sh
crt="${cn:?Common Name fuer Key und Cert nicht angegebe...}.crt"
key="$cn.key"

crtmd5=$( openssl x509 -noout -modulus -in "$crt" | openssl md5 ) ; \
keymd5=$( openssl rsa  -noout -modulus -in "$key" | openssl md5 ) ; \
\
echo "crt: $crtmd5" ; echo "key: $keymd5" ; printf "Dateien: \"$crt\" & \"$key\" -- " ; \
[ "$crtmd5" = "$keymd5" ] && echo "passen zusammen  :)" || echo "passen NICHT zusammen  :("</nowiki>

== ansible ==
<code>ansible-playbook -C -D playbooks/all.yml -u $USER -t nginx</code> -C (check, dry run), -D (diff, show differences) -u <remote user> -t <tags><br>
Tags let you run only specific tagged tasks in a playbook instead of executing everything. Multiple tags can be comma-separated.<br>
Tags can be skipped with <code>--skip-tags <tags></code><br>
Tasks tagged 'always' will run no matter what tags are selected.<br>
Tasks tagged 'never' only run if explicitly requested with <code>-t never</code><br>

== ln ==
<code>ln -s ../files</code>

== curl ==
<code>curl -vvv</code> verbose verbose verbose<br>
<code>curl -v --resolve windy.verywindy.ch:443:192.168.161.1 https://windy.verywindy.ch</code> check connection with hardcoded dns<br>
<code>curl -x sexybit.sh https://apod.nasa.gov</code> check connection with proxy<br>
<code>curl -L https://apod.nasa.gov</code> follow redirects

== New Systems ==
Size: 2CPU, 2G RAM, 40G Disk<br>
VG Name: system<br>
/: 10G<br>
Swap: 4G<br>
/var-log: 4G<br>

dns: 10.8.3.74 / 10.8.3.174<br>
http://mirror.nat.srv.ch/2025/q4/ubuntu

== IPTables / firewalld ==
  <nowiki><?xml version="1.0" encoding="utf-8"?>
<direct>
  <rule ipv="ipv4" table="filter" chain="INPUT" priority="0">-p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT</rule>
  <rule ipv="ipv4" table="filter" chain="INPUT" priority="1">-p tcp --dport 21022 -m state --state NEW,ESTABLISHED -j ACCEPT</rule>
  <rule ipv="ipv4" table="filter" chain="INPUT" priority="5">-p icmp -j ACCEPT</rule>
  <rule ipv="ipv4" table="filter" chain="INPUT" priority="8">-p udp --sport 53 -j ACCEPT</rule>
  <rule ipv="ipv4" table="filter" chain="OUTPUT" priority="0">-p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT</rule>
  <rule ipv="ipv4" table="filter" chain="OUTPUT" priority="1">-p tcp --sport 21022 -m state --state ESTABLISHED -j ACCEPT</rule>
  <rule ipv="ipv4" table="filter" chain="OUTPUT" priority="5">-p icmp -j ACCEPT</rule>
  <rule ipv="ipv4" table="filter" chain="OUTPUT" priority="6">-p udp --dport 53 -j ACCEPT</rule>
  <rule ipv="ipv4" table="filter" chain="OUTPUT" priority="8">-p tcp --dport 80 -j ACCEPT</rule>
  <rule ipv="ipv4" table="filter" chain="OUTPUT" priority="9">-p tcp --dport 443 -j ACCEPT</rule>
  <rule ipv="ipv4" table="filter" chain="OUTPUT" priority="12">-p udp --dport 123 -j ACCEPT</rule>
  <rule ipv="ipv4" table="filter" chain="OUTPUT" priority="56">-p tcp --dport 5665 -j ACCEPT</rule>
  <rule ipv="ipv4" table="filter" chain="OUTPUT" priority="67">-p udp --dport 67:68 -j ACCEPT</rule>
  <rule ipv="ipv4" table="filter" chain="OUTPUT" priority="69">-m state --state ESTABLISHED,RELATED -j ACCEPT</rule>
  <rule ipv="ipv4" table="filter" chain="OUTPUT" priority="99">-j DROP</rule>
</direct></nowiki>

Show all direct rules (/etc/firewalld/direct.xml):<br>
<code>firewall-cmd --get-all-rules --direct</code>

== Clear root Password / disable root login ==
-d --delete: delete user's password<br>
-l --lock: lock user's password<br>
<code># passwd -dl root</code>

== Start new git project ==
Create blank repo without README.md<br>
Run ansible-init script (cs)<br>

== Monitoring ==
icinga-Server verbindet sich zum Agent über Port 5665.<br>
Bei Wartungen Downtime erstellen.<br>

== Wartung ==
Snapshots nach 1w löschen.

== upremote ==
<code>$HOME/scripts/</code><br>
<code>$HOME/log/</code>

= Check yo shit front to back =

== Remount /tmp without noexec flag ==
<code>mount -o remount,exec /tmp</code>

== tmux ==
Move window to other pane:<br>
  <nowiki>Ctrl + b
:move-pane -t X</nowiki>
Move window to new pane:<br>
<code>Ctrl + b !</code>

== icinga2 ==
Check available commands in Icinga Director / Commands.<br>
<br>
After editing monitoring parameters in ansible:<br>
<code>ansible-playbook -D playbooks/all.yml -t icinga2_agent:update-host</code>

== pfx/pem conversion ==
# Extract the private key (you will be prompted to enter the PFX file password and to set a password for the private key)<br>
<code>openssl pkcs12 -in your_certificate.pfx -nocerts -out private_key.key</code><br>
<br>
# Extract the CRT certificate (you will be prompted to enter the PFX file password)<br>
<code>openssl pkcs12 -in your_certificate.pfx -clcerts -nokeys -out certificate.crt</code><br>
<br>
# (Optional) Remove the password from the private key (you will be prompted to enter the password set for the private key)<br>
<code>openssl rsa -in private_key.key -out private_key_nopass.key</code><br>
<br>
Encryption of private key can be checked with <code># cat private.key</code> (first line)
<br>
Use argument <code>-legacy</code> for deprecated ciphers.<br>

Look at certificate:<br>
<code>openssl x509 -text -in /home/local/RootCAIII.crt -noout | grep 'Subject:\|Issuer:'</code>

== SFTP für Endkunden freischalten ==
Find high port on mgmt01: <code>nft list ruleset | grep target_host_ip</code><br>
Horizon Security Group Rules (mgmt-ssh-forwarding), allow ingress from client_ip<br>

== openstack cli ==
<code>export OS_CLOUD="name"</code>

== icinga2 host vars ==
<code>host_vars/host_name/icinga2.yml</code>:<br>
  <nowiki>icinga2_agent__host_vars:
  mailq:
    mailq_servertype: "sendmail"</nowiki>

== mysql ==
<code>mysql <dbname> < /home/doobiean/anUpdate.sql</code> Apply sql stuffs to <dbname> database<br>
<code>mysql -e "SHOW DATABASES" | grep 0109</code> look for databases<br>

== ansible-vault ==
<code>ansible-vault encrypt_string <string></code> encrypt <string>

== splunk ==
<code>grep -i "connected to" /opt/splunkforwarder/var/log/splunk/splunkd.log</code> Check connected servers.

== openDKIM ==
<code>chmod -R ug+x /etc/opendkim</code> If key-permissions are denied, even though they appear to be correct.

== n1 ==
<code>dig 6bit.ch +short</code><br>
<code>whois $(!!)</code>

== digiz0rt ==
=== Standard ===
DNS TXT Record, SSL Cert Business, Platform: Linux<br>
=== Special ===
UCC16: Many SANs<br>
Wildcard: Wildcard<br>

== icinga2 nginx ==
  <nowiki>vim /usr/lib/nagios/plugins/check_nginx_status.pl
use lib '/usr/lib/nagios/plugins';

chmod 755 /usr/lib/nagios/plugins/utils.pm
ln -s /usr/lib/nagios/plugins/utils.pm /usr/local/lib/nagios/plugins/utils.pm</nowiki>


== Deploy ==
<code>ansible-playbook -u $USER -b playbook-deploy.yml -l prod --extra-vars "esb_release_tag=v26.8.0 typo3_release_tag=v26.8.0" -D</code> ohne -C<br>
<br>
Redeploy bei Fehlern, etc.
<code>vim files/web/srv/*/www/{typo3,esb}/deploy</code> Version check auskommentieren<br>
<code>rm -rf /srv/*/www/{typo3,esb}/deploy/<version></code> Deployment abräumen

== SSSD ==
<code>0 1 2 6 * /usr/sbin/sss_cache -E && /usr/bin/systemctl restart sssd >> /var/log/sssd_cron.log 2>&1</code>

== SSH Fingerprintz ==

ssh-keygen -lf /home/uzer/.ssh/authorized_keys | grep <FINGERPRINT from /var/log/auth.log>


== Prose ==
When a trailing slash on source you see,<br>
Only the contents will come with me.<br>
When no trailing slash is there in sight<br>
The whole directory joins the flight.