Cerber's questions

Question

Is there an equivalent for ssh to sshd -T (or, for those who know, something like maven's mvn help:effective-pom) ?

I'd like to be able to see the effective configuration that will be applied to an ssh command without having to / being able to connect to the remote host

Context

I've got batches with command line arguments, user local ~/.ssh/config and global /etc/ssh/ssh_config that bring nightmare config extrapolation problems.

Eg. command is failing because global config is forcing the remote port to the wrong ssh daemon / changed the remote username / changed the remote hostname /

I've been struggling with various tutorials to hook up my /dev/ttyACM0 in a lxc container.

Basically I've tried adding the following line in my lxc config :

lxc.cgroup.devices.allow = c 166:* rwm

And the following one too (both with relative and full path) :

lxc.mount.entry = /dev/ttyACM0  dev/ttyACM0  none  bind,optional

but yet, I can't get a working configuration.

FYI on the host side the modem is working and my host shows up :

$ ll /dev/ttyACM0
crw-rw---T 1 root dialup 166, 0 janv. 29 16:47 /dev/ttyACM0

Background

During an incident on a small privative network (1 router/FW + 1 server) my server got accidentally exposed to the internet.

Fortunately it was protected by it's own UFW to allow only 1 specific traffic from a specific netrange and drop everything else on this interface.

Therefore, during the incident, it logged a lot of abnormal traffic which I've tried to categorize. I got :

• Port scan (SYN only packets)
• DNS scan (UDP to port 53)
• DNS spoofing attempt (UDP from port 53 to port > 40000)

But I also got 1 pattern that I couldn't categorize ...

Question

1. Am I right on my categorization ?
2. Do you know what kind of traffic / attack attempt would trigger my firewall to log packet with the following specifications :
   • TCP only
   • Flags : ACK (90%) or ACK+PSH (10%)
   • Mostly comming from port 8888 (70%)
   • LEN=52 WINDOW=18 (50%) ; LEN <100 (90%) and WINDOW<=20 (90%)
   • wide range of destination port above 30000

Question :

How to dump data (byte-stream) written from an application to the filesystem ? (something like tcpdump but for IO/file).

Ideally it should be able to "attach" and dump the stream while it is beeing written, without specific configuration of the application.

Context :

I have a Java application that is deployed on some servers. This app is using JCL+Log4j to log all sort of tech stuff.

On a few of them I'm experiencing a rather ... uncommon problem : frequently, log files are polluted by binary data.

Same app, same config, same hardware, same OS ... different behaviour

My logs are all here : if I process the log file with "strings" every thing is back to normal but as I have, let say 90% of binary rubbish, preprocessing the files takes a huge amount of time.

Goal :

Beeing able to figure out if the problem is inside the java app/JVM or in the OS/Hardware

I'm a big fan of Gmail's addressing features (aka '+' in address like [email protected] => [email protected]).

Unfortunately a lot of services are too dumb to validate an email addresses correctly ( like /[a-zA-Z0-9\.\-]+@.+/ ) or are aware of this feature and forbid usage of a disposable mail address.

Since I have my own domain, I'd like to setup the smallest possible MX server (without queuing if possible) that would allow routing of my own disposable mailboxes ("created" on the fly) to my gmail account (& thus benefit from Gmail other cool features).

Eg : [email protected] is to be relayed to [email protected] (disposable mailbox)

or, more practical [email protected] (sticky mailbox)

Do you have any ideas ?

Extra :

1. Id like to force usage of substring in the mail adress to prevent bruteforcing ... something like throwaway1-abc@domain, throwaway2-abc@domain, ...

   1.1 (Extra Bonus super prize) use a flexible routing pattern map :

   • *-abc@domainA => [email protected]
   • *@abc.domainB => [email protected]
   • ...

2. Server security & MX security must be ensured :

   2.1 simple & clear solution (eg. small perl / node.js script) or well established software base (Eg. postfix)

   2.2 not an open relay ...

3. Being a computer enthusiast I'm giving a close look to theses related technologies in parallel : DNSSEC, DANE, SPF, DKIM. So it would be cool to be able / to still be able to plug them in ;)

Note : This is not really a question because I already found the answer but since I didn't find it easily here I will post it so that it can benefit others.

Question : How to read a concatenated PEM file as the one used by apache/mod_ssl directive SSLCACertificateFile ?

Answer (original) (source) :

cat $file|awk 'split_after==1{n++;split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print > "cert" n ".pem"}'

This can leave an empty file if there's a blank line at the end, such as with openssl pkcs7 -outform PEM -in my-chain-file -print_certs. To prevent that, check the length of the line before printing:

cat $file|awk 'split_after==1{n++;split_after=0}
   /-----END CERTIFICATE-----/ {split_after=1}
   {if(length($0) > 0) print > "cert" n ".pem"}' 

Answer 29/03/2016 :

Following @slugchewer answer, csplit might be a clearer option with :

csplit -f cert- $file '/-----BEGIN CERTIFICATE-----/' '{*}'

I've got an ubuntu desktop within a VirtualBox machine and I've got a strange behaviour with the openssh server :

• when my user is not already connected to the server (first ssh connexion), it prompts for password even though privates keys are availiable (PuTTY + Pagent). After that first connection, if I open a secondary or a third connection it gets connected with the keys.
• If I close all connections and open a new one it prompts for the password.
• If I have let say 4 open connections and I close the first one (the one that prompted for the password), the fifth connection will be opened with the keys

Anybody already seen this ?

Thanks for the time spent helping