Dns
guest@6admin.io:~$ ls ~/tags/dns
log0u7.hyperv: the second dynamic inventory, this time from the hypervisor
An Ansible collection on Galaxy that builds the inventory from Hyper-V itself: VMs queried over WinRM or PSRP, native Cacheable and Constructable mixins, state/host/tag groups and the design choices that differ from a DNS-based inventory.
A persistent volume is not durable data
After a hard power loss, PowerDNS's MySQL comes back empty. The host records are gone, nobody noticed and the only reason the story ends well is that the source of truth had survived.
The log driver that stopped the container from starting
A dirty power loss, a corrupted Swarm overlay, an internal DNS that no longer resolves and containers that refuse to start because their log driver cannot resolve a name. The anatomy of a cascade and why the real fault was elsewhere.
Your DNS zone is already an inventory: the log0u7.dns collection
An Ansible dynamic inventory built from DNS records, without zone transfers: TXT manifests, SRV records, DNS-SD (RFC 6763) and naming patterns, resolved in parallel. Plus the reverse converter that turns any inventory into a BIND zone.
Terraform creates, Ansible configures
Why IaC and configuration management do not overlap, why Terraform alone only holds in a strictly immutable model and how remote-exec is the signal that you have crossed the line.
Hardening DHCP
DHCP infrastructure hardening: snooping, controlled leases and defense against rogue servers.
Hardening DNS infrastructure
DNS infrastructure hardening: views, zone-transfer limits, DNSSEC and resolvers that do not leak.
Egress filtering, the control everyone skips
Securing outbound traffic: egress filtering, allow-lists and spotting a service talking to something it should not.
PwnMachine: the self-hosted bug bounty workstation
PwnMachine, the Docker-based pentest workstation for bug bounty, with Traefik, PowerDNS and Let's Encrypt.
OpenDNS: the free DNS
OpenDNS, the public resolvers that preceded Google DNS and Cloudflare and the question of the trusted third party.
tcpdump: frame analysis and BPF filters
Tcpdump to read the network byte by byte and BPF filters that turn a packet flood into a single question.
Nemesis: detecting a network sniffer
Detecting promiscuous-mode cards on your network, the defensive side of the packet forge.
iodine: IP-over-DNS, or the internet where only DNS passes
Iodine 0.3.1, the IPv4-over-DNS tunnel and the captive portal that only filters HTTP but resolves any name. The portal gives you DNS, therefore it gives you the internet.
dig: the Domain Information Groper, or the art of asking a name server
Dig versus nslookup, the anatomy of a DNS response read flag by flag, compared SOA records to check zone propagation and AXFR as an audit tool. The tool that would test a tunnel the following month.