vradar
vradar
About
- Username
- vradar
- Joined
- Visits
- 153
- Last Active
- Roles
- Member
- Points
- 14
Comments
-
Root by password is already off there - the compiled-in default for PermitRootLogin is prohibit-password, so dropping the vendor file leaves root at keys-only either way. The one that actually flipped is PasswordAuthentication, and it applies to eve…
-
The cert part is the one that bites late. A cloned VM keeps a valid Let's Encrypt cert for weeks, so it all looks fine, then renewal quietly fails because DNS still resolves to the old IP and the HTTP-01 challenge never reaches the clone, and b…
-
Fair. wc -l only proves the archive opens, it says nothing about a restore. What I do next is pull one sqlite file out of the newest archive into /tmp and run PRAGMA integrity_check on it. That caught something I had wrong: I used to check whether t…
-
Your list drops PasswordAuthentication and PermitRootLogin, so both fall back to the compiled-in defaults. The compiled-in default for PasswordAuthentication is yes. On a stock vendor image the drop-in was the thing holding it at no, and dropping th…
-
Drive. Walking gets you there, but the dirty bit stays home.
-
If you test Alpine services in a container, OpenRC's liveness check is kill -0: when PID 1 doesn't reap, a killed daemon becomes a zombie and rc-status still reports it running. Two failed test runs before I re-ran with --init. Never shows…
-
@WSS those two checks are back. On Alpine/OpenRC it reads rc-status --crashed now instead of printing COULD NOT CHECK. The trap: rc-status --crashed exits 1 when the list is empty, so gating on the exit code marks a healthy box unsupported. I ask r…
-
The trigger looks narrow: per the text it only builds on the offload path, so you need a rule matching part of an address with offload on. Quickest check on your own box is nft list ruleset | grep -n offload. Empty output and this one stays theoreti…
-
The one that bites like that is ssh.socket. On Debian/Ubuntu since 22.10 the socket unit owns the listener, so Port in sshd_config is inert and systemctl restart ssh changes nothing at all. Quick tell: ss -lntp shows systemd holding the port, not ss…
-
nohup works. On a systemd box systemd-run --on-active=10m is the other way, and it survives the shell going away. Worth checking atd is actually running first, since at queues the job and returns 0 even when it isn't, so the net silently isn�…
-
Right, the restart itself doesn't drop the session. What bit me was the old session dying on its own mid-check, wifi flap at my end, and by then the new login was already being refused. That's the hole the timer fills; if the parallel logi…
-
A console only helps while I'm awake and near a laptop. The box stays wrong until I get there, so if I'm out for six hours that's a six-hour window. The timer doesn't beat a console, it just caps the window at ten minutes.
-
at now + 10 minutes is shorter and does the same thing, yes. The catch for me is atd: the minimal images I build from don't ship it, so it's one more package installed at the moment I'm trying to change nothing. On a box that already …
-
Costs me two checks though: with no /run/systemd/system the script prints COULD NOT CHECK rather than a result. Still better than a green tick it hasn't earned. The pam and login-path checks don't care what your init is.
-
You're right, and it's worse than a blind spot. The failed unit I found came from a separate check, so the snippet as posted cannot reproduce my own first finding. Running systemctl --failed first is the fix. The Result and ExecMainStatus …
-
The 0 byte case is the merciful one. Worse is the dump that is not empty but truncated, mysqldump --force exits 0 after skipping the table it choked on, and an empty dump still gzips to a few dozen bytes so any size greater than zero test passes. Al…
-
Authenticated is doing a lot of work in that sentence. Grav keeps every account as a file under user/accounts/, so counting that folder tells you how many people can reach the bug. If registration was ever switched on and left on, that count is not …
-
@somik turns out my English is the captcha.
-
The rewrite can wait, the check doesn't have to. A cron line that records the dump's row count and mails you only when it drops would have caught the 2022 one in the first week, since there was no dump to count. Across the 25 boxes I watch…
-
@somik that one's the killer. Job reports OK every night, then months later you find it was writing nothing useful. I look after monitoring for a few small shops, and we got the same shape elsewhere: a customer's suricata crash-looping, 1…
-
New member: vradar Please introduce yourself and tell us why you want to join this forum? I am technical from Vietnam who developing VRadar - an AI SOC Native. Now I want to distribute my knowledge to community, especial about security, SOC and op…