@hugovalters.bsky.socialUse ausearch to trace execve calls tied to root escalation and setuid binaries in auditd logs on RHEL/Ubuntu. Fast, precise threat hunting. https://www.valtersit.com/vault/search-linux-audit-logs-for-unauthorized-execution-and-privi-a87b5f/ #auditd #security #ValtersIT
@hugovalters.bsky.socialDisable NFSv2/v3 and UDP, lock nfs.conf to NFSv4.2 TCP only. Shrinks kernel attack surface, drops rpcbind. Ubuntu/Debian/RHEL guide: https://www.valtersit.com/vault/disabling-legacy-nfs-protocols-and-restricting-server-to-nfs-45d194/ #linux #nfs #ValtersIT
@hugovalters.bsky.socialAudit AWS IAM for ISO 27001 A.9: Bash + AWS CLI + jq to flag access keys older than 90 days, unrotated creds, and missing MFA. Outputs a structured JSON https://www.valtersit.com/vault/aws-iam-risk-assessment-automation-for-iso-27001-a9-access-c-316b3c/ #aws #iam #ValtersIT
@hugovalters.bsky.socialProbe SMTP auth + STARTTLS with blackbox_exporter: connect to 587, read banner, EHLO, negotiate TLS, EHLO again inside the tunnel to verify AUTH. Full config https://www.valtersit.com/vault/smtp-authentication-and-starttls-capabilities-probe-f2b421/ #blackbox #smtp #ValtersIT
@hugovalters.bsky.socialBlock unsafe images at the API server. Register a ValidatingWebhookConfiguration so Aqua checks scan status, CVEs, and signatures before Pods are https://www.valtersit.com/vault/configuring-kubernetes-admission-controller-webhook-for-imag-83a7ce/ #kubernetes #aqua #ValtersIT
@hugovalters.bsky.socialHot-swap a failed GlusterFS brick and rebalance the volume layout with zero downtime. replace-brick syncs from healthy replicas; rebalance https://www.valtersit.com/vault/replacing-failed-bricks-and-rebalancing-volume-layout-nondis-6329c6/ #glusterfs #rebalance #ValtersIT
@hugovalters.bsky.socialExempt IPs from Nginx rate limits via geo + map. Empty zone key skips limiting, so trusted CIDRs pass untouched. https://www.valtersit.com/vault/dynamic-rate-limit-exemption-using-map-directives-and-cidr-w-9d12dc/ #nginx #rate-limiting #ValtersIT
@hugovalters.bsky.socialSupervisor event listeners catch PROCESS_STATE_FATAL and TICK events via stdin/stdout to automate failure handling and memory checks on https://www.valtersit.com/vault/process-failure-event-handling-via-custom-supervisor-event-l-2afb43/ #supervisor #monitoring #ValtersIT
@hugovalters.bsky.socialSet up dnsdist as a high-performance DoH frontend on port 443 with TLS termination. It speaks HTTP/2 RFC 8484, strips the HTTP layer, and forwards binary https://www.valtersit.com/vault/configure-dnsdist-as-highperformance-doh-frontend-proxy-41f112/ #dnsdist #doh #ValtersIT
@hugovalters.bsky.socialProxySQL rewrites SQL in RAM using match_pattern/replace_pattern regex rules in mysql_query_rules before queries hit backends. Zero client changes. https://www.valtersit.com/vault/implementing-realtime-sql-query-rewriting-via-match-and-repl-245c82/ #mysql #proxysql #ValtersIT
@hugovalters.bsky.socialZone.eu Cloud — Exclusive deal. Unmetered bandwidth, top-tier security, 24/7 human support. GDPR compliant. Data #VPS #ValtersIT
@hugovalters.bsky.socialGL-iNet Slate 7 Pro — 10% OFF. 1100 Mbps WireGuard VPN. MLO technology for simultaneous multi-band. 2.8-inch to #GLiNet #ValtersIT
@hugovalters.bsky.socialZima Hardware — $15 OFF. Code: VALTERSIT. x86 single-board server. Silent, fanless, ultra-low power. Perfect for Docker, N #ZimaBoard #ValtersIT
@hugovalters.bsky.socialHarden supervisord by replacing TCP ports with a local UNIX domain socket. Restrict supervisorctl access using strict POSIX permissions (chmod/chown). #supervisor #hardening #ValtersIT
https://www.valtersit.com/vault/secure-unix-socket-control-interface-with-strict-file-permis-d86b48/
@hugovalters.bsky.socialDeploy Vultr Load Balancers via API v2. Route encrypted TCP 443 directly to backend instances using SSL Passthrough and set up HTTP health checks.
#vultr #ssl #ValtersIT
https://www.valtersit.com/vault/provisioning-vultr-load-balancer-with-ssl-passthrough-via-ap-3b6141/
@hugovalters.bsky.socialDeploy Aqua Enforcer via Helm for runtime Kubernetes protection. Intercept syscalls and network traffic using eBPF-based DaemonSets. #kubernetes #aqua #ValtersIT
https://www.valtersit.com/vault/deploying-aqua-enforcer-daemonset-for-runtime-kubernetes-nod-83004a/
@hugovalters.bsky.socialAutomate Grafana Enterprise PDF reports via HTTP API. Headless browser renders dashboard panels and streams binary PDF output to your client.
#grafana #reporting #ValtersIT
https://www.valtersit.com/vault/triggering-automated-dashboard-pdf-report-generation-via-htt-a5daf9/
@hugovalters.bsky.socialAutomate PostgreSQL schema verification using pg_dump custom archives and pg_restore. Extract DDL from system catalogs for structural validation.
#postgresql #snapshot #ValtersIT
https://www.valtersit.com/vault/postgresql-schema-snapshot-and-automated-structural-verifica-7ac306/
@hugovalters.bsky.socialMonitor internal microservices & DBs behind your firewall. Deploy Checkly's Private Location Agent via Docker using secure, outbound WebSockets.
#checkly #docker #ValtersIT
https://www.valtersit.com/vault/deploy-checkly-private-location-agent-via-docker-container-b0b9ef/
@hugovalters.bsky.socialEnforce Sigstore/Cosign image signature checks in Kubernetes via Gatekeeper ExternalData by offloading validation to an external HTTP provider endpoint.
#gatekeeper #opa #ValtersIT
https://www.valtersit.com/vault/enforce-container-image-signature-verification-via-external--c95ecb/