#valtersit — Public Fediverse posts

Boost Elastic SIEM with real-time threat intel: a Logstash 8.x pipeline reads Kafka events, uses translate filter against a CSV of malicious IPs, and tags hits as threat_intel_malicious. Clean enrichment, no fluff. #elastic #snippet #elastic-siem #threat-intelligence #ValtersIT

https://www.valtersit.com/vault/set-up-elastic-siem-watchlist-and-enrichment-via-logstash-wi-eee291/

Automate GraphQL endpoint fuzzing with a bash script: introspect the schema via curl, parse fields with jq, then fuzz each with malicious inputs. Works on Ubuntu 22.04, Debian 12, macOS 13. #web #snippet #graphql-fuzzing #introspection #ValtersIT

https://www.valtersit.com/vault/automated-graphql-introspection-and-field-fuzzing-with-bash-75c59a/

Keep your WireGuard VPN under control with Prometheus + Alertmanager. wg-exporter exposes handshake age, transfer rates, and peer status. Scrape every 15s, alert on stale handshakes (>5min) or high throughput. Works on Ubuntu 22.04, Debian 12, CentOS Stream 9. #wireguard #monitoring #ValtersIT

https://www.valtersit.com/vault/wireguard-with-prometheus-monitoring-and-alerting-via-wgexpo-fddd75/

Redis Connection Pooling with Lettuce and Sentinel for High Availability

This snippet demonstrates how to configure Lettuce, a Redis client for Java, to use connection pooling with Redis Sentinel for automatic failover. Internally, Lettuce uses a netty-based connection mul

#DevOps #Linux #ValtersIT

https://www.valtersit.com/vault/redis-connection-pooling-with-lettuce-and-sentinel-for-high--07a740/

Stop ARP spoofing with tshark. Detect unsolicited ARP replies via `arp.opcode == 2` and filter duplicate IPs by source MAC. Run: `tshark -i eth0 -Y "arp" -T fields -e eth.src -e arp.src.proto_ipv4`. Full breakdown inside. #wireshark #snippet #arp #spoofing #ValtersIT

https://www.valtersit.com/vault/monitor-arp-spoofing-with-ethernet-frame-filters-af0db5/

IPsec VPNs need high availability. Use Keepalived + VRRP with two strongSwan servers sharing a virtual IP for seamless failover. Health checks trigger VIP transfer on IPSec service failure. Works on Ubuntu 22.04, CentOS 9, Keepalived 2.2.7+. #ipsec #snippet #keepalived #vrrp #ValtersIT

https://www.valtersit.com/vault/ipsec-failover-with-keepalived-and-vrrp-for-high-availabilit-1bbd34/

Tired of Wazuh false positives from broad rule groups like 'syslog' or 'generic'? Query wazuh.db directly: join rules & groups tables to count per group, then tighten overly permissive ones. Works on Wazuh 4.x. #wazuh #sqlite #ValtersIT

https://www.valtersit.com/vault/detect-overly-permissive-wazuh-rule-groups-via-sqlite-query-43591c/

Lock down DNS zone transfers on Windows Server with Add-DnsServerZoneTransferPolicy. Restrict to specific secondary IPs or subnets, block all others via ServerLevelIPFilter. Supports 2016-2022. #windows #snippet #dns-zone-transfer #security-policy #ValtersIT

https://www.valtersit.com/vault/create-a-dns-zone-transfer-policy-to-restrict-secondary-serv-d12a81/

SQLMap’s --passwords flag extracts DB user hashes from mysql.user, sys.sql_logins, or pg_shadow via UNION queries. Critical for credential harvesting post-exploitation. Works on MySQL 5.x-8.x, MSSQL 2012+, PostgreSQL 9+, Oracle 11g+. #sqlmap #hashes #ValtersIT

https://www.valtersit.com/vault/enumerating-database-users-and-password-hashes-with-sqlmaps--776e69/

Enforce Kubernetes pod security with OPA Gatekeeper: deploy a ConstraintTemplate that mandates read-only root filesystems and blocks privileged containers, aligning with ISO 27001 A.9.1.2 and A.14.1.1. Apply via kubectl on K8s 1.24+ with Gatekeeper v3.11+. #iso #snippet #kubernetes #opa-gatekeeper #ValtersIT

https://www.valtersit.com/vault/kubernetes-pod-security-policy-enforcement-with-opa-gatekeep-605018/

Skip expensive shared storage for Proxmox HA. This snippet configures DRBD 9.x over ZFS for synchronous block-level replication between two nodes—writes only ack after hitting both. Works on PVE 7.x/8.x. Full config: #proxmox #drbd #ValtersIT

https://www.valtersit.com/vault/proxmox-storage-replication-with-zfs-over-drbd-for-ha-0ff16f/

Enforce S3 bucket encryption across all Terraform workspaces with custom Sentinel policies. This snippet shows how to upload a policy set via the tfe provider and attach it in minutes. Linux/macOS ready. #terraform #sentinel #policy-as-code #ValtersIT

https://www.valtersit.com/vault/implementing-custom-policy-as-code-with-sentinel-and-terrafo-874172/

Tired of unused AWS IAM roles piling up? This Python + boto3 script auto-detects roles idle for 90+ days, skips instance-profile and service-linked roles, detaches managed policies, deletes inline ones, then removes the role. Works with Python 3.9+ and AWS CLI 2.x. #security #aws #iam #ValtersIT #snippet

https://www.valtersit.com/vault/automated-aws-iam-role-cleanup-with-python-and-boto3-7b52a5/

Long-running hashcat attacks need fault tolerance. Use --session to name your run and --restore to resume exactly where it stopped, even after Ctrl+C or a power failure. Hashcat writes a restore file (e.g., session.restore) periodically, so you never lose progress. #hashcat #snippet #ValtersIT

https://www.valtersit.com/vault/using-restore-and-session-for-faulttolerant-longrunning-atta-b6ad0a/

Unlock password mutations beyond static rules: this snippet pairs hashcat’s engine with a pseudo-random rule generator, yielding 10M on-the-fly rules for leetspeak, case shifts, and suffix adds. Ideal for Ubuntu/Debian/Kali. #hashcat #snippet #rules #ValtersIT

https://www.valtersit.com/vault/rulebased-attack-with-random-rule-generator-and-markov-optim-d70109/

Hardening Windows? Query and enforce LSA Protection (RunAsPPL) via registry to block LSASS injection. Checks current value, sets to 1, meets CIS Benchmark. Works on Win 8.1+/Server 2012 R2+. #lsa #protection #registry #ValtersIT #snippet

https://www.valtersit.com/vault/query-and-enforce-lsa-protection-runasppl-via-registry-ff953b/

Passive recon with Responder: -A analyze mode listens for LLMNR, NBT-NS, and mDNS traffic without poisoning. Logs verbose name-resolution requests to map vulnerable hosts before any attack. Perfect for Kali 2024.1 and Debian 12. #responder #snippet #analyze #recon #ValtersIT

https://www.valtersit.com/vault/responder-in-analyze-mode-to-map-network-protocols-27b130/

Moving AD users to a new OU? Use Move-ADObject to relocate while preserving all group memberships—only the object's path changes. Works on Windows Server 2012 R2+ with Active Directory module. #windows #snippet #active-directory #ou-migration #ValtersIT

https://www.valtersit.com/vault/move-ad-users-to-a-new-ou-with-powershell-and-preserve-group-0d64f1/

Evade IDS with Responder's timestamp obfuscation: -J adds random jitter, -T sets custom timeout, injecting sleep intervals before name queries. Bypass simple signatures that flag immediate responses. Kali/Ubuntu ready. #responder #snippet #jitter #stealth #ValtersIT

https://www.valtersit.com/vault/responder-with-timestamp-obfuscation-and-random-jitter-7f0ca3/

Skip manual AD user creation. This PowerShell script bulk-imports users from CSV via Import-Csv, sets secure-string passwords, assigns attributes (SamAccountName, UPN, department), and adds group memberships. Works on Win Server 2012 R2-2022 with AD module. #windows #active-directory #bulk-import #ValtersIT

https://www.valtersit.com/vault/automate-ad-user-creation-from-csv-with-password-and-group-a-88d83a/

Lock down your Nginx: enforce HSTS with max-age, includeSubDomains, and preload. Browsers auto-upgrade all HTTP to HTTPS for your domain and subdomains. Works on Nginx 1.9.0+ (Ubuntu 20.04+, Debian 11+, RHEL 8+). #https #hsts #snippet #ValtersIT

https://www.valtersit.com/vault/nginx-enforce-stricttransportsecurity-with-preload-and-subdo-324d15/

Automate PCI DSS 11.3.4 ASV validation: Nmap -sV/-sC enumerates ports, pipes IP:port pairs into OpenVAS via gvm-cli, then cross-references findings. Works on Ubuntu 22.04, Debian 12, RHEL 9. #pci #asv-scan #ValtersIT

https://www.valtersit.com/vault/automated-pci-dss-1134-asv-scan-validation-with-nmap-and-ope-0ca5ca/

Boost HAProxy throughput with zero-copy forwarding. Pair multithreading to cut lock contention, CPU affinity for cache locality, and splice() syscalls to move data kernel-side. Requires HAProxy 2.0+ and Linux 4.5+. Full config: #haproxy #multithreading #zero-copy #ValtersIT

https://www.valtersit.com/vault/zerocopy-forwarding-with-multithreading-and-cpu-affinity-3f0139/

Clean up unused IAM roles with AWS CLI: this script uses Access Advisor to generate last-accessed reports, flags roles idle for 30+ days, then disables/deletes them to shrink your attack surface. Requires bash 4+, AWS CLI v2. #aws #iam #roles #snippet #ValtersIT

https://www.valtersit.com/vault/detect-and-disable-unused-iam-roles-using-access-advisor-61f9d6/

Real-time Apache log analysis with GoAccess: multi-threaded parsing, GeoIP lookups, bot detection, and JSON output for downstream processing. Works on Ubuntu 22.04, Debian 12, RHEL 9 with GoAccess 1.6+. Full command and internals: #linux #goaccess #apache #ValtersIT

https://www.valtersit.com/vault/parse-apache-access-logs-with-goaccess-for-geoip-and-bot-det-755eff/

Boost NUMA performance by pinning workloads with cgroup v2 cpuset. Write to cpuset.cpus and cpuset.mems to restrict CPU cores and memory nodes, cutting remote access latency. Critical for high-perf Linux. #linux #cpuset #numa #ValtersIT

https://www.valtersit.com/vault/configure-cpuset-for-numaaware-workload-placement-8c82cc/

Run signed PowerShell scripts via -EncodedCommand to avoid quoting issues. Snippet: create/test cert, sign with Set-AuthenticodeSignature, then execute base64-encoded. Works Win7+/Server 2008 R2+. #windows #snippet #code-signing #execution-policy #ValtersIT

https://www.valtersit.com/vault/configure-powershell-to-use-an-encoded-command-with-signed-s-db856e/

Netdata v1.30+ on Ubuntu, Debian, RHEL: wire webhook alerts to Slack & PagerDuty. Alarm engine evaluates health .conf entities, triggers HTTP POST with JSON payload (chart, value, severity) when CPU >90% for 2 min. Real-time ops visibility. Details: #netdata #alerts #webhook #ValtersIT

https://www.valtersit.com/vault/automated-alerts-via-netdatas-webhook-notifications-to-slack-503be4/

Rolling web farm updates without downtime? This composite DSC resource uses Get/Test/Set scripts to detect version drift, pull new builds from an internal feed, and trigger controlled restarts. Works on Windows Server 2016-2022. #powershell #dsc #ValtersIT

https://www.valtersit.com/vault/composite-dsc-resource-for-rolling-web-farm-updates-d18007/

Secure wildcard certs with certbot + Route53 DNS-01. Automates TXT record creation, waits for propagation, then issues for apex and all subdomains. Works on Ubuntu/Debian/Linux with AWS creds in env. #letsencrypt #snippet #wildcard #dns01 #ValtersIT

https://www.valtersit.com/vault/wildcard-certificate-issuance-with-dns01-challenge-via-route-0e7a9f/

Extract ZeroTier Identity and Programmatically Provision Nodes via Ansible

This snippet demonstrates how to read the ZeroTier identity files and inject them into an Ansible inventory, allowing automated provisioning of nodes with pre-configured identities. The identity.publi

#DevOps #Linux #ValtersIT

https://www.valtersit.com/vault/extract-zerotier-identity-and-programmatically-provision-nod-f665b9/

Mount Existing Secret into Flux HelmRelease for DB Credentials

This snippet demonstrates how to pass an existing Kubernetes secret to a HelmRelease as an environment variable, referencing the secret directly without hardcoded values. Internally, the HelmRelease u

#DevOps #Linux #ValtersIT

https://www.valtersit.com/vault/mount-existing-secret-into-flux-helmrelease-for-db-credentia-6e6e33/

Brute-Force Subdomain Fuzzing with subfinder and httpx

This command combines subfinder and httpx to brute-force subdomains by fuzzing a wordlist against a domain. Subfinder uses passive sources like DNS records and then pipes to httpx, which probes for li

#DevOps #Linux #ValtersIT

https://www.valtersit.com/vault/bruteforce-subdomain-fuzzing-with-subfinder-and-httpx-91cd61/

Fuzzing for CORS Misconfigurations with curl and Custom Script

This bash script uses curl to fuzz for CORS misconfigurations by sending requests with varying Origin headers and checking for Access-Control-Allow-Origin response. It loops through a list of origins

#DevOps #Linux #ValtersIT

https://www.valtersit.com/vault/fuzzing-for-cors-misconfigurations-with-curl-and-custom-scri-d3fc77/

Tail systemd journals live with journalctl -f. Filter by unit (-u), priority (-p), or custom fields. Uses inotify to watch binary journal key-value pairs in real-time. Works on Ubuntu 16.04+, Debian 8+, RHEL 7+, Fedora 19+. #linux #monitoring #ValtersIT

https://www.valtersit.com/vault/monitor-realtime-systemd-journal-with-journalctl-f-and-filte-ef5eae/

Monitor USB insertion events to detect data exfiltration. Use wevtutil to query System log for Event ID 20001 from Microsoft-Windows-Kernel-PnP, filtering for 'USB\VID_' hardware IDs. Outputs timestamps, device description, and serial number. #windows #snippet #usb-monitoring #dlp #ValtersIT

https://www.valtersit.com/vault/monitor-usb-device-insertion-events-for-data-exfiltration-274ac0/

Generate an AppArmor profile for your Python script with aa-genprof. It monitors syscalls, file access, and network connections during execution, prompting allow/deny decisions. Tailor confinement for sensitive data processing on Ubuntu 22.04 or Debian 12. #apparmor #python #ValtersIT

https://www.valtersit.com/vault/generate-apparmor-profile-for-custom-python-script-4e345d/

Stop SMBv1 attacks. Disable this legacy protocol via Registry to harden Windows security. Step-by-step guide with key paths and verification commands. #DevOps #Security #ValtersIT https://www.valtersit.com/vault/disable-smbv1-protocol-via-registry-181283/

Is your self-hosted network actually secure?
A brand new CVE-2026-40172 just dropped for Authentik, targeting Single Sign-On (SSO) gateways. Don't let hackers compromise your Proxmox cluster.More https://ww.valtersit.com/ #infosec #devops #proxmox #valtersit #CVE #CVEAlert #devsecops #hackers #sysadmins #sysadmin #developers