@hugovalters.bsky.socialDisable unprivileged user namespaces to shrink the kernel attack surface. Set user.max_user_namespaces=0 (plus kernel.unprivileged_userns_clone=0 on Debian/Ubuntu) so https://www.valtersit.com/vault/harden-container-runtime-by-disabling-unprivileged-user-name-f22c86/ #linux #hardening #ValtersIT
@hugovalters.bsky.socialProxmox VE 8 GPU passthrough gets cleaner with PCI resource mappings and a hookscript that rebinds the device on VM start/stop. No more raw BDF juggling. https://www.valtersit.com/vault/proxmox-ve-8-gpu-passthrough-with-pci-mapping-and-hookscript-d4d13d/ #proxmox #hookscript #ValtersIT
@hugovalters.bsky.socialBind Java's JCA/JCE to a hardware token via the SunPKCS11 provider. Config file with name, library, slot, attributes. Then KeyStore.getInstance("PKCS11") exposes the token's https://www.valtersit.com/vault/configure-java-sunpkcs11-provider-to-use-a-hardware-token-f9ff54/ #java #pkcs11 #ValtersIT
@hugovalters.bsky.socialCalico GlobalNetworkPolicy programs host eBPF/iptables via Felix to enforce a non-bypassable cluster network baseline across all namespaces.
#kubernetes #calico #ValtersIT
https://www.valtersit.com/vault/calico-global-network-policy-for-nonbypassable-cluster-basel-2d6f80/
@hugovalters.bsky.socialSalt Master gitfs backend: turn a Git repo into a live state tree, no rsync. pygit2 per remote, cache in /var/cache/salt/master/gitfs, fetch on fileserver.update. Setup https://www.valtersit.com/vault/configure-master-gitfs-backend-for-gitbacked-state-trees-9de260/ #saltstack #gitfs #ValtersIT
@hugovalters.bsky.socialDisable IPv6 RA per interface with a systemd-networkd drop-in, no base unit edits. Files in /etc/systemd/network/*.network.d/ merge after the main file, last https://www.valtersit.com/vault/dropin-override-to-disable-ipv6-router-advertisements-per-in-97ce65/ #ipv6 #systemd-networkd #ValtersIT
@hugovalters.bsky.socialMap systemd boot dependencies and detect unit cycles visually. Pipe systemd-analyze dot to Graphviz to render D-Bus relationships (Requires, Wants, After).
#systemd #linux #ValtersIT
https://www.valtersit.com/vault/generate-dependency-graphs-and-detect-cycles-with-systemdana-f39c90/
@hugovalters.bsky.socialSilence GuardDuty noise from pen-test ranges. Create a filter that auto-archives findings matching a known CIDR via https://www.valtersit.com/vault/create-guardduty-suppression-filter-for-known-pentest-cidr-r-1657d2/ #aws #guardduty #ValtersIT
@hugovalters.bsky.socialMonitor mTLS endpoints in zero-trust setups with a custom CA and client certs. This snippet wires up mutual TLS auth in blackbox exporter and tracks https://www.valtersit.com/vault/mtls-endpoint-monitoring-with-custom-ca-and-client-certifica-2cfd1e/ #blackbox #mtls #ValtersIT
@hugovalters.bsky.socialSet up the ICMP prober for high-frequency latency and packet loss monitoring via raw sockets. Captures RTT, TTL, IPv4/IPv6 stats. https://www.valtersit.com/vault/icmp-network-latency-and-packet-loss-monitoring-with-privile-b4dba5/ #blackbox #icmp #ValtersIT
@hugovalters.bsky.socialInvoke-WmiMethod leverages Win32_Process.Create over DCOM/WMI to run base64 PowerShell payloads entirely in memory, leaving zero on-disk artifacts. #wmi #powersploit #ValtersIT
https://www.valtersit.com/vault/remote-code-execution-via-invokewmimethod-with-base64-encode-e3e0ab/
@hugovalters.bsky.socialEnroll Elastic Agent 8.13+ with a service token. Generates auth tokens, writes fleet.yml, encrypts credentials, and opens a persistent gRPC channel to Fleet Server.
#elastic #fleet #ValtersIT
https://www.valtersit.com/vault/enroll-fleet-server-and-elastic-agent-with-a-service-token-159f49/
@hugovalters.bsky.socialTest production SQL safely: ProxySQL 2.5+ mirrors queries to a shadow hostgroup via mirror_hostgroup rules, responses still served from https://www.valtersit.com/vault/mirroring-production-traffic-to-staging-clusters-using-mirro-9c97a7/ #proxysql #traffic-mirroring #ValtersIT
@hugovalters.bsky.socialMonitor WSS endpoints with Blackbox Exporter: validate HTTP 101 upgrades, ping-pong frames over TLS on Ubuntu, RHEL, Debian. https://www.valtersit.com/vault/websockets-pingpong-frame-validation-over-secure-tls-56f789/ #blackbox #websockets #ValtersIT
@hugovalters.bsky.socialAudit ELF mitigations at scale. Batch-scan binaries for NX, PIE, RELRO, and Canaries by parsing program headers and symbol tables using checksec and readelf.
#checksec #hardening #ValtersIT
https://www.valtersit.com/vault/audit-binary-mitigations-at-scale-with-checksec-and-readelf--fc65d8/
@hugovalters.bsky.socialHot reload Tyk Gateway with zero downtime via REST API. Atomic router swap in memory, graceful connection drain, no dropped requests. Essential for CI/CD https://www.valtersit.com/vault/triggering-zerodowntime-hot-reload-via-tyk-gateway-rest-api-479f73/ #tyk #ci-cd #ValtersIT
@hugovalters.bsky.socialEnforce node-to-node mutual TLS for Citus on RHEL 9. Set sslmode=verify-full in node metadata so PostgreSQL/libpq validates hosts and ciphers distributed https://www.valtersit.com/vault/enforcing-strict-nodetonode-mutual-tls-encryption-for-citus--8dd8ea/ #citus #tls #ValtersIT
@hugovalters.bsky.socialEnforce mTLS at the gateway with Tyk Ingress client cert validation. Validate client TLS certs against trusted CAs, extract SANs and serial numbers into https://www.valtersit.com/vault/enforcing-ingress-client-certificate-validation-and-certific-fe6a1a/ #tyk #mtls #ValtersIT
@hugovalters.bsky.socialVelero restores fail when target clusters lack source storage classes. Fix it with a ConfigMap-driven RestoreItemAction that remaps https://www.valtersit.com/vault/storage-class-remapping-during-disaster-recovery-restores-vi-6cc65f/ #velero #storageclass #ValtersIT
@hugovalters.bsky.socialKernel slab memory filling up? slabtop and /proc/slabinfo show per-cache object counts, active objects, and total memory for inode/dentry/socket https://www.valtersit.com/vault/inspect-kernel-slab-memory-allocations-via-slabtop-and-procf-eedb6b/ #linux #kernel #ValtersIT