cloudXabide | to the Cloud

OSX Catalina came with some rather annoying challenges: dropped support for 32-bit apps.  I don't play Steam games that much on my Mac now that I am stuck at home all the time.  So, not a big deal. implemented a bunch of "gatekeeper" security measures.  Now, typically I would say:  if you need to circumvent security ("Disable SELinux" - for example), you're probably doing it wrong.  But, the case of all the hand-holdy, lockdown stuff, it's pretty annoying.  Several things you cannot simply "accept the risk" and move on, you get constant reminders.  And it is interesting that whenever Microsoft does this sort of thing, it's widely discussed they are vilified.  Somehow, when Apple does this.. meh, just the cost of doing business. The challenges, themselves, are not the point of this post.  The point is you need to do some stuff if you expect to use Mac OSX Catalina to deploy VMware vSphere 6.7 U3 - vCenter Server Appliance. Download the ISO (...

A bunch of the following specifics are out of scope, but I am including them anyhow # System bootloader configuration bootloader --location=mbr --boot-drive=sda --append=" crashkernel=auto hpsa.hpsa_allow_any=1 hpsa.hpsa_simple_mode=1 console=tty0 console=ttyS0,9600n8" # Partition clearing information #ignoredisk --only-use=sda zerombr clearpart --all --initlabel --drives=sda,sdb,sdc # Disk partitioning information part /boot/efi --fstype="efi" --fsoptions="umask=0077,shortname=winnt" --ondisk=sda --size=256 part /boot --fstype="xfs" --ondisk=sda --size=1024 part pv.01 --fstype="lvmpv" --ondisk=sda --size=51200 --grow volgroup vg_rhel7 --pesize=4096 pv.01 logvol /              --fstype="xfs"  --size=10240 --name=root     --vgname=vg_rhel7 logvol /home          --fstype="xfs"  --size=1024  --name=home     --vgname=vg_rhel7 logvol /tmp           --fstyp...

The point of this post (at this time, anyhow) is to remind myself of the stupid issue I ran in to with the install/deploy of minishift on Fedora 31.  Totally my fault, but not exactly intuitive what I happened to have done incorrectly.  Let's roll... I had ran through the standard install docs (which were fairly generic) and the following would occur: $ minishft start ...   ...      ... -- Minishift VM will be configured with ...    Memory:    8 GB    vCPUs :    2    Disk size: 40 GB -- Starting Minishift VM .... FAIL E0118 20:17:12.659441  145997 start.go:494] Error starting the VM: Error creating new host: dial tcp: missing address. Retrying. Error starting the VM: Error creating new host: dial tcp: missing address I had install the driver using $ sudo curl -L https://github.com/docker/machine/releases/download/v0.16.2/docker-machine-Linux-x86_64 -o /usr/local/bin/docker-machine-driver-...

Update (and TL;DR:) - make sure you are using the right version of Ansible.  For whatever reason I had believed that I should be at 2.6.  Once I updated to 2.8 everything ran correctly. This is probably one of those times when my persistence coupled with OCD behavior was NOT on my side... I have spent literally weeks (elapsed) and probably days (actual) of time trying to deploy my OCP 3.11 Cluster to use Gluster for the Persistent Storage (apps and infra).  And it has failed.. and failed... and failed miserably. Started off with one hypervisor - Xeon and 96GB of memory, 2 x TB of HDD. VMs would (eventually) lock up and require hard restarts.  Hmm.. memory? So, I went and fired up my 3 x HP ML30s (each with 64GB and 1 TB of HDD) Still no love. I'm still fairly novice using Ansible and the scripts/role/playbooks/whatever they're called are actually pretty complex, not idempotent, have to be run in a specific order, etc... Huh? So - there will be a bunc...

I did a thing... I need a "complete" AWS environment to do some testing... and didn't want to botch my "personal" existing environment which owns my other domains, etc...  Anywho... at some point the following URL will be hosting something https://clouditoutloud.com

Ugh... Comcast.  This sucked particularly much as this was my first attempt to configure a VPN back to my HomeLab and therefore was not sure what options I should have *known* would work.  Anywho... Sophos SSL VPN uses 8443 by default.  I spent a few hours trying to get through the config on the Sophos and my Linux client.  Nothing was working. For giggles I changed the Sophos to use 443, and then updated my client on my Linux workstation.  And suddenly it all works.  Fowk.  Tried 8443 again.  No love. I don't want to utilize port 443 as I intend to actually host some web apps for testing.  So, I have finalized on an "alternate" port which had to be configured on both the Sophos and the Linux client. I'l be doing a better write-up about this later.  I still need to figure out how to configure all this via the Gnome Network-Manager GUI.

It had been about 10 months since I had done any "hardcore" Linux stuff and I need to get ramped up on a bunch of Red Hat technologies again - namely OCP and Satellite.  So, I decided I would use my laptop to spin-up a bunch of VMs.  I build my own "kickstart" environment using ISOs on my "KVM Host" to build the KVM Guests.  They are NAT'd using 192.168.122.0/24 address space and virbr0. I had everything setup and when I would monitor the console of the VM I was building, I would see "connection refused" when it would go to pull any content (i.e. my kickstart configuration). Initially I thought I simply had to update the "public" firewall zone. Then, I assumed I had to add the "virbr0" or "virbr0-nic0" to the zone's interfaces. Nope... Then I ran "setenforce 0" to see if SELinux was hosing it up.  Nope. chcon -Rvv --type=httpd_sys_content_t /var/www/html.  Nope (still a good measure though). ...

There is quite a bit of nuance in managing accounts in AWS.  One particular issue I see come up is with managing account lifecycles (i.e. if a person wants to have "temp" accounts to provide for people to "play" and learn).  This is simply not easily accomplished.  However, there are procedural ways to deal with this if folks need this type of functionality.  I have given it the following moniker: "account recycling" The idea is that you would have different account types: "core" accounts under the control of your master/payer account - and these do not get recycled. Long lived line of business accounts - hosting production, etc... long lived developer accounts - (still trying to work through how these would be managed) "burner" accounts - preset limits for usage, pre-determined length of time the account is available The idea of the burner account is that you would create a "pool" of accounts that could be provided ...

I put away my pitchforks for protesting Microsoft almost 2 decades ago.  At first I was in the Microsoft is the devil camp... then I started working on Solaris... and then AIX... and then Linux (SuSE) and finally Red Hat Enterprise Linux.  With each iteration along that timeline, I continued to care less and less about what was going on with Microsoft and Windows.  When Microsoft started to show up in the headlines regarding Linux compatibility, Red Hat collaboration, Open Source contributions, I was minimally apprehensive and was actually rather optimistic that times were changing and they saw the light. Today - I am about to install the Linux version of Visual Studio Code (relegating Atom IDE to be the failback). sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc sudo su -c 'echo -e "[code]\nname=Visual Studio Code\nbaseurl=https://packages.microsoft.com/yumrepos/vscode\nenabled=1\ngpgcheck=1\ngpgkey=https://packages.microsoft.com/keys/microsof...

It is unlikely that many folks will find themselves in this particular situation. I have several AWS master/payer accounts - and one of the accounts "owned" my domain (cloudxabide.com) and I wanted to manage and control that domain from a different master account. Account A - cloudxabide.com. Account B - example.com. myotherexample.com. Initiate the transfer of the domain by... (complete this later) Create Hosted Zone (cloudxabide.com) and retrieve the 4 NS entries. Then click on Registered Domains and the zone you wish to update. Under the Name servers section there should be a "Add or edit name servers" entry - click on that. Replace the existing server entries with the values you found above. Once you have completed this step, you will need to wait for an email indicating the update has occurred.  You may have to wait up to 2 days for the records to finishing traversing the Interwebs, as well. whois cloudxabide.com | grep ^Name dig +short NS clo...

As of the date that I am creating this, the (actual) details have not been released regarding the 2019 Recent breach involving a WAF exploitation and S3 exfiltration. A particular thread I had reviewed indicated that a 3rd-party WAF was exploited, which implies that it was likely to have been running on an EC2 instance.  This EC2 instance "metadata service" was then exploited by that WAF appliance software. I think there are several potential opportunities to improve the security posture.. IAM SCPs Security Groups S3 access policy defense in depth least privilege One thing that was a concern to me,;preventing access to the "metadata service" (from a host with Internet access), I would like to explore the impact of the following: iptables -A OUTPUT -m owner ! --uid-owner root -d 169.254.169.254 -j DROP I was initially surprised to learn that VPC Flow Logs do not capture the traffic destined for the instance metadata endpoint (but then realiz...

Yay! $ aws ec2 describe-subnets --region us-east-1 --query 'Subnets[*].[CidrBlock,Tags[?Key==`Name`].Value|[0]]' --output table ----------------------------------------- |            DescribeSubnets            | +-----------------+---------------------+ |  10.64.0.0/25   |  Public subnet 1    | |  10.64.2.128/25 |  Private subnet 3A  | |  10.64.1.128/25 |  Private subnet 1A  | |  10.64.1.0/25   |  Public subnet 3    | |  10.64.0.128/25 |  Public subnet 2    | |  10.64.2.0/25   |  Private subnet 2A  | +-----------------+---------------------+ WRONG WAY.... $ aws ec2 describe-subnets --region us-east-1 --query 'Subnets[*].[CidrBlock,Tags[?Key==`Name`].Value[]]' --output text ----------------------- |   DescribeSubnets   | +---------------------+ |  10...

Ugh.. this one was a serious PITA. For as long as I can recall, I have been using the following command $ sed -i -e 's/foo/bar/g' file.txt which would swap every occurrence of the word 'foo' with 'bar'. Today, I was attempting to swap 'MyCertificateARN' with a variable $CERTIFICATEARN $ sed -i 's/MyCertificateARN/${CERTIFICATEARN}/g' file.txt sed: -e expression #1, char 69: unknown option to `s' Huh? So, I tried substituting in other variables as a test, using actual text, swapping the ' with "... nothing was working correctly. I then echo'd the variable $ echo ${CERTIFICATEARN} arn:aws:acm:us-east-1:427832613400:certificate/57c534b7-4560-4610-a084-ad78d906d8df Wait.. there's a '/' in there.  After digging for quite a while, I discovered you can use whatever regex delimiter you want for the sed command. $ sed -i "s|MyCertificateARN|${CERTIFICATEARN}|g" ${OUTPUT}'' $ grep "...

I assume this is a bit of a dated set of procedures... as-in, there is probably a better way to deal with LUKS nowadays.  Also - at some point I will (hopefully) be writing a blog entry about LUKS key accessed from centralized key server. Assessment cryptsetup luksDump /dev/sda1 cryptsetup luksOpen --test-passphrase --key-slot 3 --key-file /root/.keyfile /dev/sda1 Setup # If there is already a crypttab, update it... otherwise, create a new one if [ -f /etc/crypttab ] then    sed -i -e '1i# <target name>    <source device>        <key file>    <options>' /etc/crypttab else   echo "# <target name>    <source device>        <key file>    <options> " > /etc/crypttab fi # Create a "key file" and add it to the device (interactive step) dd if=/dev/urandom of=/root/.keyfile bs=32 count=1 chmod 0400 /root/.ke...

The commonality for ANYone trying to do this, is the "TemplateDescription" == "(SO0044) - AWS Landing Zone Initiation Template".  Cool, I'll just run an "aws cloudformation list-stacks"... select the key fields, run a filter ... oh... wait.. you CAN'T apply a filter to this output.  :-(  The only filter capability that the "cloudformation" option has is for "status". At some point I hope to "the answer", but I want to document my attempt at creating a solution along the way. Here is a command to get some useful output... $ aws cloudformation list-stacks --region=us-east-1 --query "StackSummaries[].[StackName, TemplateDescription]" --output text Now... the trouble with this command, it will produce 2 outputs... what if the StackName has spaces.  Well, as it turns out, a StackName will *NOT* have spaces. "Stack name must contain only letters, numbers, dashes. Must start with a letter." That...

It's been a few months now since I transitioned away from "infrastructure" and started moving "to the cloud".  I think one ideal prevails:  it's not what you know, it's what you can learn... and use.  What I have found - Cloud makes many things easy (or seem easy)  things like H/A, fault-tolerance, message queues, geo-aware content delivery, automatic replication.... alright...  but, there is a (sometimes) a price for all of that.  Users have a LOT of power at their fingertips, and few controls.  Things can, and do, get out of hand. This post will be: just another Automated Landing Zone post.... Often referred to as "Landing Zone" and in text apps as "ALZ" - the solution is widely deployed and has become well recognized.  Now, ALZ is not service.  Instead, it is a solution that provides the framework to deploy and manage accounts in an Enterprise-grade way. It provides: controls auditing baseline networking automation remed...

As I am sorting through my online accounts and Internet presence, I had stumbled upon my Certification History for Red Hat.  Mar 03, 2000... that was *seriously* a long time ago.