Running ps inside a Debian Docker Container (Misc)

Just occassionally, you have to exec into a docker container in order to troubleshoot whatever app you're running.

A good image won't have unnecessary tools installed though, so things like ps tend to be missing.

Whilst you can install these with apt I can never remember the package name for ps so this snippet exists so that I don't have to

Read more…

Tag a specific drive when capturing usage of all drives on Windows (Telegraf)

If you've got multiple drives mounted in Windows and are monitoring usage with Telegraf, you might find you want to add a specific tag to just one drive for consumption by something in a later workflow.

For example, you might want to alert on root partitions across all servers (i.e. not just Windows boxes) so might want to add a tag to just the C: drive to mark it as a root partition

The [win_perf_counters](https://github.com/influxdata/telegraf/tree/master/plugins/inputs/win_perf_counters) input plugin supports using a Wildcard, so you can easily capture all disks, but it doesn't directly allow you to tag just a single disk within that

This snippet details how to use the Template Processor plugin to conditionally apply a tag based on the value of another tag using a Golang string template

Read more…

Grepping within a gzipped tarball (BASH)

You've got a (presumably) large tarball that you want to grep within, but don't want to extract the thing to do so

What you want to know, is which files within the archive contain a specific pattern so that you can extract just those one

This snippet details how to run grep against files within a tarball

Read more…

Use Openssl to tunnel plaintext connections over SSL/TLS (Misc)

It's not a common requirement, but sometimes you want to have something to use a plaintext connection, and then tunnel that onwards over a TLS connection.

My most common use for this is to make it easy to intercept/inspect behaviour between some software and a HTTPS endpoint controlled by someone else - if you can get the software to make a plaintext connection, you can tunnel it onwards whilst running pcaps/logging to observe the conversation

To achieve this, we

  • Create a FIFO to pass output through
  • Have netcat listen on a port of our choosing
  • Pass netcat's output into the FIFO, and read from the FIFO
  • Read the FIFO into OpenSSL's s_client to effect the tunnel
  • Have our plaintext app speak to netcat

Read more…

Use HTTP Keep-alives with the Python Requests module (Python3)

If you're wanting to make multiple requests against a server (scraping pages, calling an API, whatever) then you may want to re-use connections rather than establishing a new one for each request (incurring the overhead of a TCP 3-way and SSL handshake each time).

The requests module has support for this in it's Session module. It pools connections, so can re-use an existing connection where one is available (it can also persist auth, cookies, proxy settings etc between requests).

Read more…