Nick Rose bdwarr6

Deploy your site with git securely

This gist assumes:

you have a local git repo
you have an online remote repository (github)
you have a server running Apache with git already installed

you should be able to do the same with Java, Perl, RoR, JSP etc. however you'll need to recreate the (rather simple) PHP script

iptables n'at

Source NAT

Source NAT changes the source address in IP header of a packet. It may also change the source port in the TCP/UDP headers. The typical usage is to change the a private (rfc1918) address/port into a public address/port for packets leaving your network. Available only in the POSTROUTING chain in iptables.

Syntax

iptables -t nat -A POSTROUTING -i eth1 -j SNAT --to-source 1.2.3.4[:port]

Example

You can find the MAC address for LAN1/eth0 (not the BMC MAC) via the SuperMicro IPMI interface by running the following command:

$ ipmitool -U $IPMI_USER -P $IPMI_PASS -H $IPMI_HOST raw 0x30 0x21 | tail -c 18

The eth0 MAC address will be output in this format:

00 25 90 f0 be ef

	#!/bin/bash
	#$Id: keepalivepin,v 1.2 2006/02/27 07:30:41 hmy Exp hmy $
	#use dig check the powerdns's status.
	#in the dns database,have a IN TXT RR keepalivepin.vmmatrix.net,content is "AaBbCcDdEeFf"
	# Source: http://puppet-manifest-share.googlecode.com/svn/trunk/vmx-puppet/modules/lvs/files/keepalived.dns-pin
	#
	RR=keepalivepin.vmmatrix.net
	[ $# -le 1 ]&&{ echo "usage: ${0} -h <ip>"; exit 126;}
	while getopts "h:" OPT;do
	case $OPT in

	#!/usr/bin/env bash

	# written by: Joshua Worley
	# received great help from DavidWittman here:
	# https://gist.github.com/DavidWittman/98281cdf1d32ac795b74

	# This version's improvements:
	# - allows reset, power on, or power off
	# - sanity check conditionals
	# - sends pushover alert for notification

	#!/usr/bin/env bash

	# vlan-check.sh
	#
	# Validates the VLAN configuration on an interface
	# by creating a tagged subinterface, assigning the
	# next available address, and sending a ping to the
	# provided gateway IP address.
	#
	# Supports Ubuntu and RHEL/CentOS. I think.

	#!/usr/bin/env bash

	# Retrieves the plaintext JNLP from a SuperMicro IPMI webserver
	# Usage: supermicro-java-console.sh <hostname>
	# supermicro-java-console.sh 10.1.2.34 > login.jnlp

	set -x

	HOST="$1"
	IPMI_USER=${IPMI_USER:-ADMIN}

	#!/usr/bin/env bash

	# Loads and mounts an ISO over SMB via the
	# SuperMicro IPMI web interface
	#
	# usage: supermicro-mount-iso.sh <ipmi-host> <smb-host> <path>
	# e.g.: supermicro-mount-iso.sh 10.0.0.1 10.0.0.2 '\foo\bar\windows.iso'

	set -x

	#!/usr/bin/env bash

	# Issues a reset of the SuperMicro BMC via the web interface
	#
	# usage: supermicro-bmc-reset.sh <ipmi-host>
	# e.g.: supermicro-bmc-reset.sh 10.0.0.1
	#

	set -x

	#!/usr/bin/expect -f

	# This script secures SuperMicro IPMI implementations which are vulnerable
	# to viewing the IPMI password in plaintext on port 49152. It does this by
	# using the shell available in some SuperMicro BMCs to drop traffic to port
	# 49152 in iptables.
	#
	# See http://blog.cari.net/carisirt-yet-another-bmc-vulnerability-and-some-added-extras/
	# for more details on the vulnerability.
	#