[EN] Cleaning old systemd journal logs

Have you found that your folder is too big?

esther@Raton:~# du -hs /var/log/journal/
6,5G    /var/log/journal/

or

esther@Raton:~# du -hs /run/log/journal/
2,5G    /run/log/journal/

And have you found that once there you can't read any log messages?

esther@Raton:/var/log/journal/xxxxxxxxxxxxxxxxxxxxxxx# tail system.journal
L�8M�ތp�+2uW����.��+0OÈ�
                         �+B�ةO\@H�+ւ���|�X��+.�{EPр�+��)���ב�+o�
                                                                 �PX���+q���r�� �+"��)F���+�N��6���h�+l@����+n��Bm�B���+�{۳O�z�h�+�Z-9a���+"_�����+*(W4W8,FP�2���*�땠�OT� %$�����.fV�9P�| �J�8��8������3.��p�MESSAGE=XXXX [...]

Don't worry, that's pretty normal.

First of all, you can read your systemd journal log files just using

>  journalctl

and explore its options; some pretty useful may be
     --system                Show the system journal
     --user                  Show the user journal for the current user
  -r --reverse               Show the newest entries first
  -o --output=STRING         Change journal output mode (short, short-precise,
  -a --all                   Show all fields, including long and unprintable
     --vacuum-size=BYTES     Reduce disk usage below specified size
     --vacuum-files=INT      Leave only the specified number of journal files
     --vacuum-time=TIME      Remove journal files older than specified time


For example, for cleaning old files we have different ways using the last three options

> journalctl --vacuum-time=15d
> journalctl --vacuum-size=1G

Or you can check the live logs from a systemctl service using

> journalctl -xef -u systemctl.service

CI/CD Pipeline or how not to die being a DevOps

Source: @forrestbrazeal

[EN] How to enable telnet feature on Windows 10 system (it works with HOME edition)

Hi all!
 



Just wanted to leave a tiny little recipe to enable TELNET on Windows 10 from the command line; as a good Linux user I LOVE the command line... so... here we go!

Just need to run this command

dism /online /Enable-Feature /FeatureName: TelnetClient

from the Symbol System window and your system will do the rest



Hope that helps!

[EN] Hacking Tools cheat sheet

Hello!!!

Today I wanted to share that Hacking Tools Cheat Sheet where you can find very interesting commands and tools.

Use them wisely; you know, a great power entails a great responsibility

Source: Compass Security

[EN] MySQL/MariaDB: filtering processlist query

Haven't seen you in a while... but today I bring you something really interesting I just found out

I'm pretty sure you already know about

mysql> show processlist;

that shows you all the threads that MySQL is running for your user (or all the users if you are root) in that very moment; the problem of that query is that you can't limit or filter it at all and sometimes you need to. 

The cool part is that you can run the same query using

mysql> SELECT * FROM information_schema.processlist;

and filter it as you need!!!!

mysql> SELECT * FROM information_schema.processlist where Host='remote_host';
mysql> SELECT * FROM information_schema.processlist where User='remote_user';

That really made my day! 
And yours?

[EN] Deploying on Kubernetes...

Watched on an Slack private group

[EN] AWS - An UnauthorizedOperation and encrypted message

Have you ever tried to perform a change from the aws command-line and all you got was an error like

"An error occurred (UnauthorizedOperation) when calling the XXXXXX operation: You are not authorized to perform this operation. Encoded authorization failure message"

and an encrypted string afterwards? Well, don't panic. It's just a "normal" error, but in this case the output is encrypted for security; aws api does so becasue it throws some sensible information and they don't want anyone else but you to get it. 

How to decrypt that info? Easy; you need an allow policy on STS for the action DecodeAuthorizationMessage. If you already got permission, you don't need to create the policy, but if you need to just copy and paste it

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "sts:DecodeAuthorizationMessage",
            "Resource": "*"
        }
    ]
}

Once the policy has been applied, you can decrypt the error with

> aws sts decode-authorization-message --encoded-message Error_Message_Encrypted_String --output table

where Error_Message_Encrypted_String would be the message you got.




Hope that helps!