Notes

# Backup my home directory to /mnt/backups
srsync-incremental /mnt/backups /home/simon

# Additional rsync arguments can be specified _after_ the target
# directory.
srsync-incremental /mnt/backups \
    --exclude /.cache --exclude /Downloads /home/simon

#!/bin/sh

# Perform incremental backups using rsync and hardlinks.
#
# Thanks to http://www.sanitarium.net/golug/rsync_backups_2010.html for the
# idea.

# Copyright (C) 2011-2017  Simon Ruderich
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

set -eu

if test "$#" -lt 2; then
    echo "Usage: $0 <backups-directory> <arguments to rsync>" >&2
    echo
    echo "Note: The target directory is the _first_ argument!" >&2
    exit 2
fi

cd "$1"
shift

# Get path to last backup directory.
dest=./
for x in backup-*; do
    test -d "$x" || continue
    dest="../$x" # relative to destination directory
done

target="backup-$(date '+%Y-%m-%d-%H-%M-%S')"
target_tmp="partial-$target"

mkdir "$target_tmp"
rsync \
    --verbose --itemize-changes --human-readable \
    --archive --acls --xattrs --hard-links --sparse --numeric-ids \
    --one-file-system \
    --link-dest="$dest" \
    "$@" "$target_tmp" \
|| {
    # Try to remove the target directory without changing the exit code. In
    # case the connection failed without transferring any files, we want to
    # remove the empty directory.
    code=$?
    rmdir "$target_tmp" 2>/dev/null || true
    exit $code
}
# --dry-run (-n) creates an empty directory. Remove it to prevent using it for
# further incremental backups (which would do a full backup).
rmdir "$target_tmp" 2>/dev/null && exit 0 || true

mv "$target_tmp" "$target"

$ apt-cache policy
Package files:
 100 /var/lib/dpkg/status
     release a=now
 500 http://ftp.de.debian.org/debian/ wheezy-updates/non-free Translation-en
 500 http://ftp.de.debian.org/debian/ wheezy-updates/main Translation-en
 500 http://ftp.de.debian.org/debian/ wheezy-updates/contrib Translation-en
 500 http://ftp.de.debian.org/debian/ wheezy-updates/non-free amd64 Packages
     release o=Debian,a=stable-updates,n=wheezy-updates,l=Debian,c=non-free
     origin ftp.de.debian.org
[...]
Pinned packages:
[...]

ISOLINUX 6.03 20141206 ETCD Copyright (C) 1994-2014 H. Peter Anvin et al

boot:

boot: rescue vga=normal fb=false --- console=ttyS1,9600n8

frontend http-frontend
    mode http
    [...]
    # len = len(IPv6 as string) + 1 + len(IPv6 as string)
    stick-table type string len 79 size 1000 expire 60s store http_req_rate(60s)
    http-request set-var-fmt(req.haproxy_sticktable_key) %[src];%[dst]
    http-request track-sc0 var(req.haproxy_sticktable_key)
    http-request deny deny_status 429 if { sc_http_req_rate(0) gt 100 }

$ echo 'show table http-frontend' | socat unix-connect:/run/haproxy/stats.sock stdio
[...]
0x557a7a8a6030: key=2001:db8:e4c0:c34b:8b7d:2d85:53ed:13d3;2001:db8:f1bf:364f:d77c:1552:67ea:be8b use=0 exp=56133 http_req_rate(60000)=42
[...]

frontend tcp-frontend
    mode tcp
    [...]
    stick-table type string len 79 size 1000 expire 60s store conn_rate(60s)
    tcp-request connection set-var-fmt(sess.haproxy_sticktable_key) %[src];%[dst]
    tcp-request connection track-sc0 var(sess.haproxy_sticktable_key)
    tcp-request connection reject if { sc_conn_rate(0) gt 100 }

Match host example.org exec "nc -4 %h 5000; nc -4 %h 7000; nc -4 %h 6000; true"

#!/sbin/iptables-restore

*filter
:INPUT   ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT  ACCEPT [0:0]

# Chains for port knocking.
:knock        - [0:0]
:knock_2nd    - [0:0]
:knock_3rd    - [0:0]
:knock_accept - [0:0]

# Thanks to http://forum.ubuntu-fr.org/viewtopic.php?pid=2518477#p2518477 for
# the port knocking rules idea.
#
# For every knocking operation there is a 5 second time frame.
#
# The knock packets are rejected (tcp-reset) here so they don't clutter the
# logs.

-A knock -m recent --rcheck --rsource --name knock_3rd --seconds 5 -j knock_accept
-A knock -m recent --rcheck --rsource --name knock_2nd --seconds 5 -j knock_3rd
-A knock -m recent --rcheck --rsource --name knock_1st --seconds 5 -j knock_2nd
# First port knocking port.
-A knock -p tcp --dport 5000 -m recent --set --rsource --name knock_1st -j REJECT --reject-with tcp-reset

# Second port knocking port.
-A knock_2nd -m recent --remove --rsource --name knock_1st
-A knock_2nd -p tcp --dport 7000 -m recent --set --rsource --name knock_2nd -j REJECT --reject-with tcp-reset

# Third port knocking port.
-A knock_3rd -m recent --remove --rsource --name knock_2nd
-A knock_3rd -p tcp --dport 6000 -m recent --set --rsource --name knock_3rd -j REJECT --reject-with tcp-reset

# Port knocking successful. Add allowed ports to this chain.
-A knock_accept -m recent --remove --rsource --name knock_3rd

# For example allow SSH.
-A knock_accept -p tcp --dport 22 -j ACCEPT

# The usual rules.
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -i lo -j ACCEPT

# Support port knocking. Ports used for port knocking cannot be used for
# other services with the current setup.
-A INPUT -p tcp -j knock

# ...

# Reject the rest. This prevents access to e.g. SSH unless port knocking is
# used.
-A INPUT -j REJECT

COMMIT

$ gnutls-cli -p 5222 --starttls --print-cert jabber.org
[...]
<?xml version='1.0' ?><stream:stream to="jabber.org" xmlns="jabber:client" xmlns:stream="http://etherx.jabber.org/streams" version="1.0">
[...]
<starttls xmlns="urn:ietf:params:xml:ns:xmpp-tls"/>
[...]

# rmmod loop
# modprobe loop max_part=63

# losetup -f </path/to/disk/image>

!~(~P | ~F | ~r <3m)

ca path-to-certs.crt
tls-remote /C=../ST=../L=../OU=/../CN=hostname

#!/bin/sh

# Provide primitive certificate pinning. It only uses the SHA-1 of the
# certificate, but it's better than nothing.

# SHA-1 fingerprints of the used certificates.
sha1_3=b8:96:31:66:c7:fe:d4:8c:73:85:3b:6f:36:23:24:b8:34:70:99:d9 # CA
sha1_2=e3:de:e9:d8:36:e4:c3:43:6f:b1:05:f1:ff:07:00:f7:0b:7d:0e:fd # sub certificate
[...]
sha1_0=72:e2:0b:a5:dc:5e:f9:ee:25:d9:69:c4:cc:fb:1e:63:73:17:dd:6d # server certificate

compare() {
    if test -n "$1" && test x"$1" != x"$2"; then
        exit 1
    fi
}

# This is crazy .. but that's how OpenVPN does the verification. This script
# is called with an increasing numbers of tls_digest_* variables set ...
compare "$tls_digest_3" "$sha1_3"
compare "$tls_digest_2" "$sha1_2"
compare "$tls_digest_1" "$sha1_1"
compare "$tls_digest_0" "$sha1_0"

exit 0

tls-verify "/path/to/this/script"

$ perf record --call-graph dwarf -F 99 -ag -- sleep 60
$ git clone https://github.com/brendangregg/FlameGraph
$ perf script --no-inline | ./stackcollapse-perf.pl > out.perf-folded
$ cat out.perf-folded | ./flamegraph.pl > perf-kernel.svg

$ python3 -m venv .venv
$ . .venv/bin/activate
$ pip3 install --upgrade pip

$ pip3 install -e .

$ pip3 install -r requirements.txt

(qemu) info block
...
ide1-cd0: [not inserted]
...

(qemu) change ide1-cd0 /path/to/iso

(qemu) eject ide1-cd0

$ dd if=/usr/lib/syslinux/mbr.bin of=/dev/<device>

$ syslinux --install /dev/<fat32 partition>

DEFAULT mboot.c32 <multiboot-elf-to-load> --- [images for multiboot..]

DEFAULT mboot.c32 system.elf --- image.bin

winsat disk -drive c

# geteltorito n10ur07w.iso >update.iso

# partx -av update.iso
# mount /dev/loop0p1 /mnt

# cp -r /mnt/FLASH /boot/efi
# cp /mnt/EFI/BOOT/BootX64.efi /boot/efi/FLASH

grub> set root=(hd0,gpt1)
grub> chainloader (hd0,gpt1)/flash/BootX64.efi
grub> boot