Tech notes

I have been experimenting with ZeroTier and wanted to share how I was able to setup site-to-site connectivity between a home network and AWS to avoid installing the ZT app on every system in my network. It is easier than you might think. This is a quick how-to on setting up site-to-site connectivity from a […]

I have put off learning how test-kitchen works with salt formulas for awhile. Mainly due to the multi-step setup process that can be slightly confusing if you are not accustomed to working with developer tools day to day. It became clear though that learning this workflow would be really beneficial for developing salt-formulas and other […]

RPM package creation for BRO IDS Deployments. Basically, there are two ways to install BRO. One is, download the source and compile it for your machine. The other option is to install BRO from a package. Compiling from source is a great option, which allows for customization but can become problematic when deploying BRO on […]

PF_RING is software that installs a network socket allowing for “High-speed packet capture, filtering and analysis” https://www.ntop.org/products/packet-capture/pf_ring/. It is useful in applications where capturing a lot of network traffic is a requirement such as Snort or BRO IPS/IDS deployments. When possible, I use salt to manage pf_ring deployments but manual steps are condensed from the […]

At some point while working on a Salt formula to deploy pfring, I got to a point where I wanted to set promiscuous mode on an interface automatically. I wasn’t exactly sure how to go about it on RHEL/CentOS 7. So many things have changed so I set out to do a quick google search. […]

There are many reasons why one may want to setup a home lab. For me, the reason is being able to mock up several different scenarios using different software stacks and play with hardware. If you want to setup a lab like I have, it requires ESXi as the hypervisor on physical hardware. However, you […]

Deploy Graylog using SaltStack and supporting formulas I’ve written a formula for deploying Graylog with additional Salt formulas for Elasticsearch and MongoDB, which  support a Graylog install. Currently, this has only been deployed on CentOS 7 so the Salt states are pretty specific to CentOS and RHEL based distros. There are plans to expand support […]

Content Packs for Graylog Lately, I have been working with Graylog a lot so I decided to update a few items on github and update their entries on the Graylog marketplace website. BRO content pack for Graylog The BRO IDS content pack contains pipeline rules, a stream, a dashboard displaying interesting activity, and a syslog […]

Rsync is an awesome tool that I have used extensively. However, I think it is time to explore other tools that can replace some of what rsync has been doing for so many years. I’m not saying that you should never use rsysnc. What I am saying is there are other options and in some […]

Overview As with any system running software, you are going to have to apply patches to it at some point and VMware is no different. VMware recommends customers install all security patches to maximize the protection that VMware provides. For a list of all security patches, you can go here https://my.vmware.com/group/vmware/patch#search. Login with your myvmware […]