snort multiple excluded SHELLCODE_PORTS - snort

I read somewhere that it wasn't possible to specify multiple ports to
exclude for shellcode is that correct? if not is the following
correct?
List of ports you want to look for SHELLCODE on.
portvar SHELLCODE_PORTS ![21,25,80,143,587,8889]
I'm using snort 2905

Try it. If Snort doesn't like the syntax, it should throwback a fatal parsing error. I believe, though, that syntax is better implemented as:
portvar SHELLCODE_PORTS [21,25,80,143,587,8889]
I.e., without the negation, and then used in a rule thus:
alert tcp any any <> any !SHELLCODE_PORTS ( ... )
You could also do:
portvar SHELLCODE_PORTS [!21,!25,!80,!143,!587,!8889]
Which should be valid syntax. Haven't tested, though. YMMV.

You want !$SHELLCODE_PORTS
You are missing the dollar sign.

Related

Test for packet NOT matching set

I'd like to write an nftables rule that matches packet fields which are NOT found in a set:
ip not ip saddr #local_networks drop
Unfortunately this gives a syntax error: "unexpected !"
Moving the 'not' to various other likely points in the statement makes no difference to error message. Is negation allowed?
In Debian 10 (nftables 0.9.0 + whatever Debian patches) this syntax works to drop packets with source IP address not in set local_networks:
ip saddr != #local_networks drop
I've examined the source code and discovered that although "!" and "not" are both syntax elements - they have lexer symbols defined for them, they are not used anywhere in the parser. I suppose I'll have to put in an enhancement request.

Meaning of hash in postfix configuration

I'm trying to configure my mail server. The MTA is postfix and in some configuration options is used hash in front of some statement.
example:
alias_maps=hash:/etc/aliases
Whay is it for?
Postfix doesn't use the flat ascii files (well, mostly, that is), but uses a "hashed" for that allows quicker lookup/retrieval.
hash/btree are BerkeleyDB-type file based "databases".
This means, that Postfix doesn't actually use the file /etc/aliases, but rather /etc/aliases.db which is in turn generated by the "postalias hash:/etc/aliases" command.
Read more about how Postfix can use all kinds of databases (LDAP, SQL, and the like) here:
http://www.postfix.org/DATABASE_README.html

htaccess redirect code: wildcard in middle of path

I have searched for an answer here but have not been able to find one that meets my precise criteria.
I would like to redirect the following url:
http://site.com/term1/9/title
to
http://site.com/term1/title
There are two additional considerations:
The "term1" above could be any word; and
The number "9" above could be any number from 1 through 100.
I would be grateful for any assistance with this.
Many thanks in advance, david
Apache RewriteRule directives use perl compatible regular expressions. This should work:
RewriteRule ^([\w\d]+)/(\d+)/(.*) $1/$3
I tested it on an htaccess tester and I got the correct result. Of course, you may need to adjust the regular expression if you expect any other characters in the first part of the address. If you really need to catch the 1-100 range, you can use a more complex regular expression instead of just \d+, in the second parentheses: [0-9]{1,2}|100.

Reaching a remote host through a gateway using Emacs and Tramp

I am attempting to edit a remote file in Emacs, and I'm having trouble getting from the documentation and previous SO questions to doing the thing I want.
I'm working remotely, from a variety of locations, and I want to edit files on server Foo. Server Foo isn't directly reachable from the Internet, but server Bar is, and Foo accepts connections from Bar. I can count on reaching Bar, and Bar can count on reaching Foo.
The Tramp documentation tells me that I need to add to Tramp's proxy list to do this, and that it should look like the following:
(add-to-list 'tramp-default-proxies-alist
("foo_host" "seanm" "/ssh:seanm#bar_host"))
However, when I try that, it doesn't work, and I get inscrutable error messages.
How can I unambiguously refer to Foo? There is no DNS server that knows how to find Foo from its hostname, and Foo's IP address is in the 10.0.0.0/8 private space. I don't want to refer to Foo by that IP address, because that risks colliding with hosts in other 10.0.0.0/8 networks I may visit. As a kludge, I added Foo to Bar's /etc/hosts file, but that didn't seem to work. Is there a better solution?
What quoting rules do I need to adhere to? The examples that I'm seeing use both "double quotes" and `tick-and-single' quotes, the latter apparently requiring double-backslash escaping. I don't understand what's going on there - it seems like there are multiple layers of parsing that this string is going to be shoved through.
While trying variations on this, I've gotten error messages that amount to "you can't use that remote-access method for that scenario." How can I set up a second proxy method that will let me do the equivalent of C-x C-f /su::/path/to/file ?
It all seems very painful compared to the previous multi-hop syntax.
Later: I was able to get the many layers of escaping right so that emacs correctly 'hears' the names of hosts. However, I can't get any hops beyond a second to work correctly, which is a very disappointing lapse in functionality.
The correct answer turned out to be modifying my SSH config with Host, HostAlias, and ProxyCommand directives.

What is a good method for inventing a command name?

We're struggling to come up with a command name for our all purpose "developer helper" tool, which we are using on our project. It's like a wrapper for our existing tools like cmake and hg. The purpose of the command is really just to make our lives easier by combining multiple commands into one (for example, publishing packages). For example, we have commands like:
do conf
do build
do install
do publish
We've considered a few ambiguous names like do (as above) and run, but obviously, do is a Linux bash command and run is pretty ambiguous.
We'd like our command to be 2 chars short, preferably - but who thinks we're asking the impossible? Is there a practical way to check the availability of command names (other than just typing them into your terminal), or is it just a case of choose one and hope nobody else will use it? Are we worrying about nothing?
Since it's a "developer helper" tool why not use hm [run|build|port|deploy|test], Help Me ...
Give it a verbose name, then let everyone alias it to whatever they want. Make sure you use the verbose name in other scripts so that it removes ambiguity.
This way, each user gets to use whatever makes sense to him/her, and the scripts are more readable and more easily searchable (for example, grepping four "our_cool_tool" will usually yield better results than grepping for "run").
How many 2-character words are useful in this context? I think you need four. With that in mind, here are some suggestions.
omni
torq
fluf
mega
spif
crnk
splt
argh
quat
drul
scud
prun
sqat
zoom
sizl
I have more if you need them.
Pick one: http://en.wikipedia.org/wiki/List_of_all_two-letter_combinations
To check the availability of command names, I suggest looking for all two-letter filenames that are in the directories in your path. You can use a script like this
for item in `echo $PATH | sed 's/:/ /g'` ; do
ls -1d $item/??
done
It won't show builtins in your shell (like "do" as you mentioned) but it's a good start.
Change ?? to ??? for three-letter files, etc.
I'm going to vote for qp (quick package?) since it's easy to pronounce, easy to type, and easy to remember where the keys are on the keyboard.
I use "asd". it's short and most developers type it without thinking
(oh, and you can always claim later that it stands for some "Advanced Script for Developers" if you need to justify yourself a few years from now)
How about fu? As in Kung Fu. It's a special purpose tool. And it's really easy to type.
I think that run is a good name, at least anybody that will download your project will know what to do. Calling it without parameters should reveal your options.
Even 'do' will do, I think you can use backquotes to run it from bash scripts.
Also remember that running the tools without parameters will tell you what options you have.
Use makefiles to do everything for you.
How about calling it something descriptive, like 'build_runner', and then just aliasing it to 'br' (or preferred acronym) in your .bashrc?
There is a really crappy tool called cleartool (part of clearcase), and people will alias it on their machine to "ct". Perhaps you can have a longer command and suggest users alias it.
It would probably be best to do something like ire_and_curses suggested, name it descriptively then alias it to a 2 letter command. If I was choosing, I would name it dev_help and alias it to dh.
I think you're worrying about nothing. Install the program as 'the-command-to-do-evertyhing-and-if-you-dont-make-your-own-alias-for-it-you-should'. I don't think that will be too long for any modern filesystems, but you might need to shorten it to 'tctdeaiydmyoafiys'. See what common aliases are used, and then change the program's name to that. In other words: don't decide, let natural selection decide for you. If you are working with a team of < 10, this should not even remotely cause any problems.
Call it devtool alias to dt
Custom tools like that I like to start with the prefix 'jj-'. I can type (with big index-finger power) 'jj ' and see all my personal commands. Also, they group together in alphabetical lists. 'J' is not a very common character for built-inc commands, but you can pick your own.
Since you want two characters, you can use just 'zz', or something starting with 'z'.
Are you sure you want to put all your functionality in one command? That might be simultaneously over-constraining and over-loading the interface a little.
do conf
do build
do install
do publish