Main

Linux Configs

Utilities and configuration files for any Unix-like OS. ansible-configs generally uses files from here.

Go to repo

Windows Configs

PowerShell modules and scripts used to configure windows or automate tasks. Targets Windows-desktop-specific items such as Hyper-V, Windows Sandbox, WSL + USB, logging & monitoring, and more.

Go to repo

Ansible Configs

A collection of ansible roles, including example playbook and inventory files, as git submodules.

Go to repo

Ansible notes

Molecule notes

Terraform Configs

Ready to use terraform templates, and an easy to follow guide to go from installing, to deploying resources.

Go to repo

Vagrant Configs

How vagrant works; includes a sample Vagrantfile for Kali on Hyper-V and VirtualBox showing what provider settings you may want to use. Quirks of Hyper-V and how to resolve them are covered. Lastly, resources to be aware of for building a home lab are linked.

Go to repo

Packer Configs

Packer templates ready-to-use, with resources to help you learn, modify, and build upon what's here. ansible-configs is a submodule of this super project.

Go to repo

Docker Configs

Systemd-enabled Docker configuration files for molecule testing. All submodules in ansible-configs run molecule CI workflows using these.

Go to repo

Alert Service

Webhook based alerting (Slack, Discord) using cyber deception to catch malicious activity early, without noise.

Go to repo

Compliance Profile Builder

Uses ComplianceAsCode's content release files and Ansible tags to easily create, test, and apply customized profiles

Go to repo

Agent Configs

Agent configuration files to document and bootstrap workflows based on my existing codebase. Narrowly scoped agents build reusable, agent-free workflows, so they're only solving new problems.

Go to repo

Browser Configs

Browser configuration files. Documentation.

Go to repo

CWP

Certified WiFiChallenge Professional

OSCP

OffSec Certified Professional

OSWP

OffSec Wireless Professional

PNPT

Practical Network Penetration Tester

eCMAP

Certified Malware Analysis Professional

eCPPT

Certified Professional Penetration Tester

eJPT

Junior Penetration Tester

OpenSCAP Practical Usage

A complete guide to starting with OpenSCAP content focusing on Ansible.

• Install OpenSCAP
• Pull compliance profiles from GitHub/ComplianceAsCode
• Debug policies with Ansible's -C and -D options
• Apply, test, and maintain policies with Ansible tags.

Go to blog post

Linux Utils

Visualization tools with built in parsing options in color. These tools are in the base of the linux-configs repo.

check-auditd.sh Parse + search auditd

check-baseline.sh Parse aide results

check-baseline.sh rkhunter / chkrootkit in color

check-processes.sh Dump system + network process in color

check-strings.sh bstrings-like recursive string parser

Go to blog post CHECK BACK LATER!

Go to repo

VMware Kernel Module Signing

To run VMware on Linux with SecureBoot enforced, the vmmon and vmnet modules require signing to load into the kernel.

• Automates this process
• Run after each kernel update

Go to script

pfSense Administration

This guide covers CLI usage and other things like:

• Home office / lab use
• pkgs for Zeek, sudo, and more
• GUI and CLI quirks
• External storage and ZFS

Go to blog post

Deploy auditd

Installs and configures auditd to adhear to a specified policy on Debian / RedHat family systems.

• Use built in rules for PCI, STIG, OSPP
• Load your own custom rules instead
• Choose log size, number, and type
• Locks rules to prevent live modification

Go to ansible role

Go to shell script

Deploy & Manage Sysinternals

Interactive PowerShell script to load Sysinternals onto a Windows machine.

• Deploys sysmon
• Can update sysmon
• Option to use SwiftOnSecurity config
• Option to supply your own config instead
• Option to add essential monitoring tools
• Option to add entire suite (malware analysis)

Go to ps1 script

Deploy & Manage AIDE

Ansible role to deploy, run, and manage AIDE at scale

• Install AIDE (advanced intrusion detection environment)
• Initialize a database if one does not exist
• Check existing systems for integrity
• Update a database if one exists (optional)

Go to ansible role

Wireguard VPN / IDS Server

Combines and automates a number of components to monitor traffic on a wireguard interface.

• Provision with terraform
• Build with ansible
• Generates a QR code to onboard first client
• Logs minimum pcap data for Zeek
• Set retention period for pcaps

Go to ansible role

Build Tailscale Node

Automates deployment of a Tailscale node.

• Provision with terraform
• Build with ansible
• Automatically enroll the node into your Tailnet with an Ansible vault
• Logs minimum pcap data for Zeek on the tailscale0 interface

Go to ansible role

Manage OpenSSH Server on Windows

OpenSSH Server is not always available by default, and is time consuming to configure each deployment manually.

• Installs + modifies OpenSSH Server
• Enforces public key auth
• Can change the listening port
• Updates firewall rules
• Imports public keys

Go to ps1 script

Tail-EventLogs PS Module

Windows has no tail -f equivalent to visualize live Event Logs. This is especially useful in tuning and testing sysmon rules locally.

• Can tail any event log
• Filter based on Event ID
• Write to file with Tee-Object

Go to ps1 module

Windows Sandbox Configs

Detailed examples and premade .wsb files for:

• Ephemeral environment
• Development environment
• Malware analysis

The .wsb files and scripts are in the base of the windows-configs repo.

Go to repo

Connect-UsbipSSHTunnel PS Module

Convenience script to open a reverse ssh tunnel to the Windows host from WSL, giving WSL access to usbipd devices on localhost tcp/3240 without any inbound firewall rules active on the host.

Requirements:

• WSL is up to date
• usbipd is version 4.0.0 or later
• The Windows host has an ssh key that the target WSL instance will accept
• The ssh identity is loaded into Windows ssh-agent
• WSL accepts incoming ssh connections
• You can execute commands as admin (this script can run as a normal user but you need to know an admin's credentials)
• You have sudo privileges within WSL

Go to ps1 module

Customizing Shell Profiles

Use your shell prompt to track the following (and more) in real time:

• Username
• Hostname
• TTY
• Date & time
• Network interface information
• Working directory

Go to blog post