Fri, 05 Jul 2019 14:49:20 +0200 
To access a cheat sheet you can simply issue a plain HTTP or HTTPS request specifying the topic name in the query URL:
    curl cheat.sh/tar
    curl #^https://cheat.sh/tar

Elastic SIEM

 Wed, 26 Jun 2019 16:51:24 +0200 
#^SIEM on the Elastic Stack | Elastic SIEM
Security teams use Elastic SIEM to detect threats by analyzing events from network, host, and cloud technologies, as well as other data sources.

Elastic SIEM equips security practitioners with easy data ingestion via Beats, shareable analytics based on the Elastic Common Schema (ECS), and the ability to interact with security data using the #SIEM app in Kibana. As threats continue to evolve, so too will Elastic SIEM.

No Excuse

 Fri, 21 Jun 2019 14:42:53 +0200 
#^SQL is No Excuse to Avoid DevOps - ACM Queue
A friend recently said to me, "We can't do DevOps, we use a SQL database." I nearly fell off my chair. Such a statement is wrong on many levels.
"But you don't understand our situation!" he rebuffed. "DevOps means we'll be deploying new releases of our software more frequently! We can barely handle deployments now and we only do it a few times a year!"
I asked him about his current deployment process.

Icinga Reporting

 Mon, 17 Jun 2019 14:21:50 +0200 
Icinga Reporting – Hands On
After our initial release of Icinga Reporting for early adopters we continued our development and are happy to release v0.9.1 today. The release includes bug fixes and some minor enhancements for the usability.
 Wed, 29 May 2019 11:24:37 +0200 
#^DNS-OARC 30: Bad news for DANE | APNIC Blog
For many years the Domain Name X.509 certification system, or WebPKI, has been the weak point of Internet security. By ‘weak point’ you could as easily substitute ‘festering, rancid, underbelly’ and you would still be pretty much right on the mark! The massively distributed trust system has proved to be unmanageable in terms of integrity and there is a regular flow of stories of falsely issued certificates that have been used to perform intrusion attacks, eavesdrop on users, corrupt data and many other forms of malicious behaviours.


 Fri, 03 May 2019 00:22:33 +0200 
#^Ransomware: The key lesson Maersk learned from battling the NotPetya attack | ZDNet

Protection is important - but it's equally as important to ensure your recovery process is strong, says head of cybersecurity compliance at the shipping giant.


The Director

 Wed, 24 Apr 2019 18:37:38 +0200 
#Icinga Director is such a wonderful tool. You pay more attention to your #CMDB and IT documentation and your monitoring system syncs nicely. \o/
For sure it is no out of the box solution, you need to plan and prepare a lot beforehand, but afterwards it is so flexible and nice to use.

#^Monitoring Automation with Icinga – The Director

I’m not going to list all benefits of automating your monitoring system. If you’re here and reading this, you are most likely very aware that maintaining a large infrastructure is a big challenge.
Automating the monitoring process for a huge amount of servers, virtual machines, applications, services, private and public clouds was a main driver for us when we decided to build Icinga 2. In fact, monitoring large environments is not a new demand for us at all. We experienced this challenge in tandem with many corporations for many years. Finally, it lead us to build features like our rule based configuration, Icinga’s REST API and various modules, cookbooks, roles and playbooks for different configuration management tools.

MariaDB The Story So Far

 Thu, 14 Mar 2019 10:44:55 +0100 
#^MariaDB 10.3 » ADMIN Magazine
What lacked maturity in MariaDB 10.2 has now been sorted out in version 10.3. We look at the benefits you can reap now.


 Thu, 28 Feb 2019 14:09:39 +0100 
Interesting talk from Daniel Stenberg

#^HTTP/3 is the next coming HTTP version
by Daniel Stenberg on YouTube
 Tue, 26 Feb 2019 01:36:28 +0100 
#^BSI -  IT-Grundschutz-Kompendium - Edition 2019
Die Edition 2019 des IT-Grundschutz-Kompendiums enthält insgesamt 94 IT-Grundschutz-Bausteine. Darunter sind 14 neue IT-Grundschutz-Bausteine sowie die 80 Bausteine aus der Edition 2018. Von diesen wurden 36 Bausteine für die Edition 2019 überarbeitet. Im IT-Grundschutz-Kompendium wird an einigen Stellen auf Bausteine verwiesen, die noch nicht in der ersten oder zweiten Edition veröffentlicht sind.
 SysAdmin  GS

One API call away from Domain Admin

 Wed, 30 Jan 2019 12:21:06 +0100 
Oh this one is wonderful. I love it!

#^Abusing Exchange: One API call away from Domain Admin

In most organisations using Active Directory and Exchange, Exchange servers have such high privileges that being an Administrator on an Exchange server is enough to escalate to Domain Admin. Recently I came across a blog from the ZDI, in which they detail a way to let Exchange authenticate to attackers using NTLM over HTTP. This can be combined with an NTLM relay attack to escalate from any user with a mailbox to Domain Admin in probably 90% of the organisations I’ve seen that use Exchange. This attack is possible by default and while no patches are available at the point of writing, there are mitigations that can be applied to prevent this privilege escalation. This blog details the attack, some of the more technical details and mitigations, as well as releasing a proof-of-concept tool for this attack which I’ve dubbed “PrivExchange”.

And now imagine that agencies and governments collect such entries to IT-systems and wonder how many of them they might still know about.

CI/CD tools

 Fri, 11 Jan 2019 17:45:01 +0100 
#^7 CI/CD tools for sysadmins | Opensource.com
An easy guide to the top open source continuous integration, continuous delivery, and continuous deployment tools.

Sharing is Caring

 Fri, 21 Dec 2018 11:51:06 +0100 
#^MISP » ADMIN Magazine 48/2018
Shared Protection By Matthias Wübbeling
The Malware Information Sharing Platform lets you record and document security incidents – and share the information with users on other networks.
Cunning attackers often collaborate with others and share information about vulnerabilities. Companies, on the other hand, face hackers as lone warriors and all too often rely on traditional security technologies. But companies can also share IT security knowledge. One platform for sharing security information is the Malware Information Sharing Platform (MISP).

#^MISP - Malware Information Sharing Platform and Threat Sharing - The Open Source Threat Intelligence Platform
MISP - a threat information sharing platform - The Open Source Threat Intelligence Platform

Director v1.6.0

 Tue, 11 Dec 2018 12:23:14 +0100 
I really like Icinga Director and the new feature to work with multiple instances sounds to improve our workflow a lot.

#^Director v1.6.0 is available
Icinga Director v1.6.0 has been released with Multi-Instance Support, Configuration Baskets and improved Health Checks. We’re excited to announce new features that will help you to work more efficiently.

Reminds me I still need to commit a parse_url PropertyModifier upstream.

Fallwinde abseits der Technologie

 Fri, 07 Dec 2018 14:08:55 +0100 
#^Den Wechsel in die Cloud vorbereiten - Linux Magazin
Weil die Cloud omnipräsent ist, meinen einige Unternehmen, dass es ein Kinderspiel sei, ihre Geschäftsanwendungen zu Amazon, Google, Microsoft und Co. auszulagern. Tatsächlich lauern auf dem Weg nach oben tückische Fallwinde gerade abseits der Technologie.
Schenkt man den einschlägigen Werbeanzeigen Glauben, dann ist es kinderleicht, die Dienste von Cloudanbietern wie Amazon, Google, Microsoft & Co. zu nutzen. Zugleich suggeriert das Marketing der Firmen, der Weg in die Wolke sei völlig unkompliziert. Tatsächlich präsentiert sich der Wechsel in die Cloud häufig als mehrdimensionale Herausforderung. Der Artikel beleuchtet einige der Hürden, legt den Fokus aber auf die nicht-technische Seite.


 Wed, 05 Dec 2018 12:42:19 +0100 

#^Jenkins Security Advisory 2018-12-05
Code execution through crafted URLs
Jenkins uses the Stapler web framework for HTTP request handling. Stapler’s basic premise is that it uses reflective access to code elements matching its naming conventions. For example, any public method whose name starts with get, and that has a String, int, long, or no argument can be invoked this way on objects that are reachable through these means. As these naming conventions closely match common code patterns in Java, accessing crafted URLs could invoke methods never intended to be invoked this way.

The Art of Running Out of IPv6 Addresses

 Wed, 24 Oct 2018 00:55:53 +0200 last edited: Wed, 24 Oct 2018 00:58:41 +0200  

The Illustrated TLS Connection

 Mon, 22 Oct 2018 10:12:43 +0200 
#^The Illustrated TLS Connection: Every Byte Explained
In this demonstration a client has connected to a server, negotiated a TLS 1.2 session, sent "ping", received "pong", and then terminated the session. Click below to begin exploring. The code for this project can be found on GitHub.


 Mon, 22 Oct 2018 00:39:56 +0200 
#^Verwundbarkeitsanalyse anhand von CPE-Dictionary und CVE-Feeds

Sicherheitslücken können Cyberangriffe ermöglichen. Deswegen müssen Sicherheitsverantwortliche ständig nach Verwundbarkeiten bei der installierten Software suchen. Was sind die Herausforderungen einer solchen Verwundbarkeitsanalyse?

This is a solar-powered website, which means it sometimes goes offline

 Mon, 15 Oct 2018 00:07:23 +0200 
Low-tech Magazine refuses to assume that every problem has a high-tech solution. A simple, sensible, but nevertheless controversial message; high-tech has become the idol of our society.