@MDMarra I've expanded the scope of my job exponentially since I got here, my actual job is IS security... but since there was no way to secure... nothing, I had to build everything and learn how to do it.
@ScottPack probably not, but that is a cool product by the looks of it (never used it). it looks similar to something I've been working with some friends on.
@FalconMomot Sure, I'm always willing to look at stuff.
@FalconMomot Hell, if it's something I like well enough I'm even willing to do crazy things like file bug reports and even prototype patches. Cuz I'm awesome like that.
Once I get this unrelenting thesis out of the way I've been trying to decide on a good side project to pick up. I've got some ideas but nothing really ground breaking or full fleshed out yet.
@FalconMomot That's pretty much why I learned cobbler and puppet. We needed useful IDS and I had a nearly unlimited number of shitty computers and span ports available.
@FalconMomot I wish you the best of luck, man. I've gone through two SIEM RFPs at this point and have been in bed with both 1st and 2nd gen products. The market could stand for another shakeup.
@FalconMomot We used enVision for a number of years, and well...yeah. We've been with Nitro for a couple of years. It's a pretty dang neat product, but definitely some oddities and some pretty rough edges.
@FalconMomot If I recall qRadar was the one where we asked about alerting based on MAC address. They didn't index that field and were completely stumped. They couldn't comprehend why that would be useful.
Has anyone experienced this before? When not pushing data, pings are fine. As soon as I try downloading something or even run a speed test, the pings skyrocket into the 500ms range
I just deleted a 1TB partition from a disk volume and now I have that gap on the volume. What is the Windows (Server) way to move the other partitions so that I have continuous free space at the end of the volume?
The only reason I didn't fall for it is because I noticed that the email address I use for ebay is redirected to my gmail account, but this one is sent directly to my gmail, rather than being forwarded
@MDMarra Interesting post about mid-level admins and never taking a job you're qualified for. I'm seeing a lot of positions here that want the moon and stars of out of a mid-level position and are left open indefinitely in hopes that the right person will walk in the door.
@Wesley Yeah. 6 persons teams that they're leaving half the positions open for. Or changing the title on the description around every couple months hoping to get some action on it.
Yeah, once you're doing Real Work, I bet local admin makes all the difference in the world. I mean, who wants to have to, as a consultant, call their own help desk to get an elevated cmd/ps prompt?
All sorts of random shit, depending... Could be some menu items in Office, or IE are disabled/hidden. Might be that some ctrl+alt+del options are greyed out if you're in certain groups. Ultimately, it's all useless and adds exactly zero to the user's experience.
The funny thing is that we have a tight-assed SRP whitelist and everyone is a limited user already... There just isn't that much they can fuck up. I don't see the reason to have 5000 settings which hide/disable/remove stuff a limited user can't change.
Windows 7, installed puppet via chocolatey. Running "Start Command Prompt with Puppet", and then creating an EMPTY file "tennessee.pp", and then invoking within the prompt
puppet apply -v --debug --evaltrace --noop tennessee.pp
Just sits doing absolutely nothing. I'm not sure what other debug ...
With a litany of native tools that have a rich history and deep documentation, as well as out of the box support, you pick two non-native, unsupported, community projects to build out on. Dude must have got a bad batch of microdot.
@jscott Active Directory / GPOs are the cost of a server license, which I would assume he has if he's in a business setting. PowerShell can take care of the rest.
And msiexec if he has a package to install.
May he be so fortunate as to have packages to install that are in MSIs.
@jscott True - and that's why there's a lot of automation I never got around to for some clients. Not enough money in their bank accounts, and not enough time for me to spend pouring through some advanced books.
That's why I sub out some stuff to @RyanRies to do for me. =P
> I have the following infrastructure and would like to share things between these subnets but don't really know how to do that. (I am just a programmer)
@MichaelHampton I used to pick 3-4 answers by someone that posted something really awesome that day. Then upvote all the other good stuff in there too. That gets flagged nowadays.
@Magellan It appears that five a day is the limit, but I wouldn't do consecutive days. I've seen a really good answer by someone, or seen a lot of unloved answers (zero upvoted accepted answers, for example) and will go on a vote spree, but save it to four a day with a day or two in between.
Oddly, I had my first vote-strafing yesterday, with all the points revoked. I felt like it was a right of passage come late in life. =P
@Iain are you reading IRC? I'll try to write policy module to include a filetrans for /srv/www and check if the labeling is the right one upon dir creation
@dawud If I had that much talent I wouldn't be in front of a computer this late. =(
In fact, file server shares have been migrated to new storage for this place, rousing success... time for bed. They'll come in tomorrow morning and not know the difference. But I'll know. Oh, I'll know.
@Iain Yeah, restorecon always works, provided the right context exists in the policy, either by default or added by an admin (by means of semanage fcontext ). The tricky part is having the right context on file creation , which apparently can be done if you provide a custom policy module detailing the appropriate file transition operation. I'll try to give that a shot ASAP, as that is a very interesting point WRT understanding SELinux internals.
I doubt is as simple as writing a policy module from the audit2allow filtered AVC denials from audit.log . This has to be written from scratch gasp
Windows 7, installed puppet via chocolatey. Running "Start Command Prompt with Puppet", and then creating an EMPTY file "tennessee.pp", and then invoking within the prompt
puppet apply -v --debug --evaltrace --noop tennessee.pp
Just sits doing absolutely nothing. I'm not sure what other debug ...
