Tech – Page 5 – Ryan Schulze

API for Troy Hunts passwords list

August 14, 2017August 14, 2017RyanAPI, passwords

TL;DR version: https://github.com/ryanschulze/password-check-api

So NIST updated their recommendations on passwords/authentication a few weeks ago. And while a lot of the reporting was about how password complexity was removed in favor of password length, one point I found intriguing was the suggestion to check if a users password falls into one of these categories:

Passwords obtained from previous breach corpuses.
Dictionary words.
Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’).
Context-specific words, such as the name of the service, the username, and derivatives thereof.

Troy Hunt, the guy behind https://haveibeenpwned.com, deals with a lot of data breaches and made 320 Million passwords from breaches available (at the time of this posting) to help people with checking if passwords that were part of a data breach.

I threw together a small API that can make the data from Troy Hunt easily query-able (or any list of SHA1 hashes for that matter). This can be useful if you have multiple systems that want to query the data, or if you want the data on a separate system.

It’s nothing special, a MySQL backend, a Webserver and an API application using the Slim framework. It’s also stupid fast because there is nothing fancy or special about it. Since it uses a well documented framework it is also easy to change/extend/adjust to your specific requirements.

Bash function to run commands against ansible hosts

July 10, 2017August 14, 2017Ryanbash

I haven’t posted anything ansible related in a while, so here is a nifty little function I regularly use when I want to execute something on all (or a subset) of ansible hosts. It’s just a wrapper around ansible host -m script -a scriptname.sh but adds –tree so that the output is stored and can easily be parsed by jq

ansible_run() {
	local ansible_directory="${HOME}/svn/ansible/"
	local command=${1}
	local target=${2:-all}
	local dir="${HOME}/ansible_output/${RANDOM:0:5}"
	local startdir=
	local script=

	startdir="$(pwd)"
	script="$(mktemp)"
	mkdir -p "${dir}"
	if [[ $? -eq 0 ]] ; then
		{
			echo "#!/usr/bin/env bash"
			echo "${command}"
			echo
		} > "${script}"
		cd "${ansible_directory}" && time ansible "${target}" -m script -a "${script}" --tree "${dir}"
		rm "${script}"
		echo -e "\n${dir}\n"
	fi
	rmdir --ignore-fail-on-non-empty "${dir}"
	cd "${startdir}" || exit
}

ansible_run() {

local ansible_directory="${HOME}/svn/ansible/"

local command=${1}

local target=${2:-all}

local dir="${HOME}/ansible_output/${RANDOM:0:5}"

local startdir=

local script=

startdir="$(pwd)"

script="$(mktemp)"

mkdir -p "${dir}"

if [[ $? -eq 0 ]] ; then

{

echo "#!/usr/bin/env bash"

echo "${command}"

echo

} > "${script}"

cd "${ansible_directory}" && time ansible "${target}" -m script -a "${script}" --tree "${dir}"

rm "${script}"

echo -e "\n${dir}\n"

rmdir --ignore-fail-on-non-empty "${dir}"

cd "${startdir}" || exit

}

Usage example:

$ ansible_run "iptables -S | grep -E '^-P (INPUT|FORWARD)'"
...
/home/user/ansible_output/6599

$ cd ${HOME}/ansible_output/6599
$ jq -r .stdout ./*

$ ansible_run "iptables -S | grep -E '^-P (INPUT|FORWARD)'"

...

/home/user/ansible_output/6599

$ cd ${HOME}/ansible_output/6599

$ jq -r .stdout ./*

Keeping track of Jira issues

May 9, 2017May 9, 2017RyanJIra

A Jira search that I find useful (show tickets you created and haven’t been updated in a while) since I often have to track tickets I created across different projects. You can subscribe to searches and get an email sent with the results.

reporter = currentUser() AND updated < -90d AND resolution = Unresolved ORDER BY updatedDate DESC

Fixing Ubuntu 17.04 DNS problems

April 20, 2017February 1, 2018Ryanbash, ubuntu

I recently upgraded my Ubuntu box to 17.04.

Much to my surprise DNS starting behaving strangely, so I checked my DNS server … worked fine if I queried it directly, so I checked if DHCP was giving out the wrong DNS IP … nope, that was fine too. I checked /etc/nsswitch.conf , and that looked fine too so I checked what was ending up in /etc/resolv.conf and was surprised that it contains nameserver 127.0.0.53 instead of the “real” DNS server.

After a bit of research I found out that Ubuntu switched over to using systemd-resolved, which shoves itself between user land and the DNS servers and (at least in Ubuntu 17.04) has problems with servers that support DNSSEC. Very frustrating when you know everything is OK and worked in the past, just systemd messing with stuff and breaking it.

My workaround was to turn of DNSSEC validation. Not pretty but better than no DNS at all, until Ubuntu get’s their problems sorted out.

mkdir /etc/systemd/resolved.conf.d
printf "[Resolve]\nDNSSEC=no\n" >> /etc/systemd/resolved.conf.d/no-dnssec.conf
dpkg-reconfigure resolvconf
# Say 'yes' to 'prepare /etc/resolve.conf for dynamic updates'

mkdir /etc/systemd/resolved.conf.d

printf "[Resolve]\nDNSSEC=no\n" >> /etc/systemd/resolved.conf.d/no-dnssec.conf

dpkg-reconfigure resolvconf

# Say 'yes' to 'prepare /etc/resolve.conf for dynamic updates'

How to fetch IP ranges/entries from SPF records in bash

March 3, 2017March 29, 2017Ryanbash, SPF

Recently I needed to fetch IP ranges from SPF records. After looking at different python/ruby/perl modules I came to the conclusion that a fancy module (sometimes with wonky dependencies) was overkill just to parse a simple SPF record. So I threw together a simple bash script that is mainly just fetching the SPF record with dig and grep:

dig txt "${fqdn}"|grep -oE 'v=spf[0-9] [^"]+'

1	dig txt "${fqdn}"\|grep -oE 'v=spf[0-9] [^"]+'

It iterates through the options (it currently recognizes a, mx, ip4, ip6, include, and redirect), and then sorts the output by ipv4, then ipv6.

fetch_spf.sh ryanschulze.net
138.201.86.179
138.201.86.184
192.249.58.230
2a01:4f8:172:2270:1::102
2604:180::ef4b:4638

fetch_spf.sh ryanschulze.net

138.201.86.179

138.201.86.184

192.249.58.230

2a01:4f8:172:2270:1::102

2604:180::ef4b:4638

Download URL: fetch_spf.sh