# list directory :~$ find / -type d / /mnt /sys ... # list current directory's name :~$ find / -type d -maxdepth 0 / # list directory ans subdirectory :~$ find / -mindepth 0 -maxdepth 1 -type d / /mnt /sys ... # list subdirectory :~$ find / -mindepth 1 -maxdepth 1 -type d /mnt /sys ... # -0 print the full file name on the standard output, followed by a null character (instead of the # newline character that -print uses). This allows file names that contain newlines or other types of # white space to be correctly interpreted by programs that process the find output. This option corre‐ # sponds to the -0 option of xargs. :~$ find / -mindepth 1 -maxdepth 1 -type d -print0 //mnt/sys/etc/tmp/srv/home/usr/lost+found/run/var/proc/dev/boot/root/opt
xargs
1 2 3 4 5 6 7 8 9
# -0 Input items are terminated by a null character instead of by whitespace, and the quotes and backslash # are not special (every character is taken literally). :~$ sudo mkdir /"a b" :~$ find / -typd d | xargs chmod 755 chmod: cannot access '/a': No such file or directory chmod: cannot access 'b': No such file or directory :~$ find / -type d -print0 | xargs -0 chmod 777 :~$ ls -d */ | tr"\n""\0" | xargs -0 chmod 755 :~$ ls -F / | grep "/$" | tr"\n""\0" | xargs -0 chmod 755
#!/bin/bash for each in ./*{.jpg,.jpeg,.JPG,.JPEG,.gif} # 设定图片目录和图片格式 do s = `du -k $each | awk '{print $1}'` # 以下代码判断图片文件大小，小于10K的不加水印 if [$s -gt 10] then composite -gravity southeast -dissolve 85 watermark.jpg $each$each 2>/dev/null echo"$each: done!" //加水印 fi done exit 0
添加文字水印
1 2 3 4
# 把 shixuen.com 字符串加到 image.jpg 图片上 :~$ mogrify -font /usr/share/fonts/truetype/thai/Purisa.ttf -pointsize 15 \ -verbose -draw "fill black text 5,23 'shixuen.com' \ fill orange text 6,24 'shixuen.com' " image.jpg
dmidecode is a tool for dumping a computer’s DMI(some say SMBIOS) table contents in a human-read‐able format. This table contains a description of the system’s hardware components, as well as other useful pieces of information such as serial num‐bers and BIOS revision.
1 2 3 4 5 6 7 8 9 10
:~$ sudo dmidecode | grep -A 8 "System Information" System Information Manufacturer: Gigabyte Technology Co., Ltd. Product Name: P43-ES3G Version: Serial Number: UUID: 00000000-0000-0000-0000-00241d7c82ec Wake-up Type: Power Switch SKU Number: Family:
:~$ sudo dmidecode | grep -A 30 "BIOS Information" BIOS Information Vendor: Award Software International, Inc. Version: F10 Release Date: 08/31/2009 Address: 0xE0000 Runtime Size: 128 kB ROM Size: 1024 kB Characteristics: PCI is supported PNP is supported APM is supported BIOS is upgradeable BIOS shadowing is allowed Boot from CD is supported Selectable boot is supported EDD is supported 5.25"/360 kB floppy services are supported (int 13h) 5.25"/1.2 MB floppy services are supported (int 13h) 3.5"/720 kB floppy services are supported (int 13h) 3.5"/2.88 MB floppy services are supported (int 13h) Print screen service is supported (int 5h) 8042 keyboard services are supported (int 9h) Serial services are supported (int 14h) Printer services are supported (int 17h) CGA/mono video services are supported (int 10h) ACPI is supported USB legacy is supported LS-120 boot is supported ATAPI Zip drive boot is supported BIOS boot specification is supported Targeted content distribution is supported
hdparm provides a command line interface to various kernel interfaces supported by the Linux SATA/PATA/SAS “li‐bata” subsystem and the older IDE driver subsystem. Many newer (2008 and later) USB drive enclosures now also support “SAT” (SCSI-ATA Command Translation) and therefore may also work with hdparm. E.g. recent WD “Pass‐port” models and recent NexStar-3 enclosures. Some options may work correctly only with the latest kernels.
Installation
Install the hdparm package. For use with SCSI devices, install the sdparm package.
To get information about hard disks, run the following:
1 2 3 4 5 6 7 8 9
hdparm -I /dev/sda
/dev/sda:
ATA device, with non-removable media Model Number: ST3160815AS Serial Number: 9RXKSL0T Firmware Revision: 3.AAD ...
Power management configuration
Modern hard drives support numerous power management features, the most common ones are summarized in the following table. See man hdparm for the complete list.
Parameter
Description
-B
Set the Advanced Power Management feature. Possible values are between 1 and 255, low values mean more aggressive power management and higher values mean better performance. Values from 1 to 127 permit spin-down, whereas values from 128 to 254 do not. A value of 255 completely disables the feature.
-S
Set the standby (spindown) timeout for the drive. The timeout specifies how long to wait in idle (with no disk activity) before turning off the motor to save power. The value of 0 disables spindown, the values from 1 to 240 specify multiples of 5 seconds and values from 241 to 251 specify multiples of 30 minutes.
**-M
Set the Automatic Acoustic Management feature. Most modern hard disk drives have the ability to speed down the head movements to reduce their noise output. The possible value depends on the disk, some disks may not support this feature.
Warning: Overly aggressive power management can reduce the lifespan of hard drives due to frequent parking and spindowns.
To query current value, pass the parameter without a value. For example:
1 2 3 4
hdparm -B /dev/sda
/dev/sda: APM_level = 254
To apply different value, for example set APM to 127:
1
~$ hdparm -B 127 /dev/sda
Putting a drive to sleep directly after boot
A device which is rarely needed can be put to sleep directly at the end of the boot process. This does not work with the above udev rule because it happens too early. In order to issue the command when the boot is completed, just create a systemd service and enable it:
For some other drives, the hdparm command is acknowledged but the drive do not respect the parameters (either APM or spin down timer). This was observed with a Toshiba P300 (model HDWD120) HDD. Such drives can be spun down using hd-idle which ships with a systemd service. One need to edit /etc/conf.d/hd-idle and the HD_IDLE_OPTS value, then start and enable hd-idle.service.
Example using a 10 min idle time for /dev/sda and a 1 min idle time for /dev/disk/by-uuid/01CF0AC9AA5EAF70:
1
HD_IDLE_OPTS="-i 0 -a /dev/sda -i 600 -a /dev/disk/by-uuid/01CF0AC9AA5EAF70 -i 60"
the leading -i 0 parameter indicates that hd-idle is disabled on other drives.
# other method # smartctl --nocheck standby,[return code--default 2] :~$ smartctl --nocheck standby -i /dev/sda smartctl 6.6 2017-11-05 r4594 [x86_64-linux-4.19.0-kali5-amd64] (local build) Copyright (C) 2002-17, Bruce Allen, Christian Franke, www.smartmontools.org
Device is in STANDBY mode, exit(2) :~$ echo $? 2 :~$ smartctl --nocheck standby,0 -i /dev/sdd smartctl 6.6 2017-11-05 r4594 [x86_64-linux-4.19.0-kali5-amd64] (local build) Copyright (C) 2002-17, Bruce Allen, Christian Franke, www.smartmontools.org
Device is in STANDBY mode, exit(0) :~$ echo $? 0
hdparm.conf
This file is only valid in terminal mode and is not available in the graphical interface. In the graphical interface, the hard disk is spins up just after it has entered the spins down state.
Debian configuration file for hdparm.
This is the default configuration for hdparm for Debian. It is a rather simple script, so please follow the following guidelines :) Any line that begins with a comment is ignored - add as many as you like.
Since hdparm doesn’t use init script anymore, this configuration is mainly used by udev. Still one can re-apply settings from the config file by calling either
1
/usr/lib/pm-utils/power.d/95hdparm-apm resume
or by calling
1
DEVNAME=/dev/<disk> /lib/udev/hdparm
Example
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
# force_spindown_time----Put the drive into idle (low-power) mode, and also set the standby (spindown) timeout for the drive.Values from 1 to 240 specify multiples of 5 seconds, yielding timeouts from 5 seconds to 20 minutes. Values from 241 to 251 specify from 1 to 11 units of 30 minutes, yielding timeouts from 30 minutes to 5.5 hours. A value of 252 signifies a timeout of 21 minutes. A value of 253 sets a vendor-defined timeout period between 8 and 12 hours, and the value 254 is reserved.255 is interpreted as 21 minutes plus 15 seconds. Note that some older drives may have very different interpretations of these values.
# apm-----Possible settings range from values 1 through 127 (which permit spin-down), and values 128 through 254 (which do not permit spin-down).
Lynis - Security auditing and hardening tool, for UNIX-based systems.
Lynis is a security auditing for system based on UNIX like Linux, macOS, BSD, and others. It performs an in-depth security scan and runs on the system itself. The primary goal is to test security defenses and provide tips for further system hardening. It will also scan for general system information, vulnerable software packages, and possible configuration issues. Lynis was commonly used by system administrators and auditors to assess the security defenses of their systems. Besides the “blue team”, nowadays penetration testers also have Lynis in their toolkit.
We believe software should be simple, updated on a regular basis, and open. You should be able to trust, understand, and have the option to change the software. Many agree with us, as the software is being used by thousands every day to protect their systems.
Clone or download the project files (no compilation nor installation is required) ;
1
git clone https://github.com/CISOfy/lynis
Execute:
1
cd lynis; ./lynis audit system
If you want to run the software as root, we suggest changing the ownership of the files. Use chown -R 0:0 to recursively alter the owner and group and set it to user ID 0 (root).
arpwatch
Arpwatch keeps track for ethernet/ip address pairings. It syslogs activity and reports certain changes via email. Arpwatch uses pcap(3) to listen for arp packets on a local ethernet interface.
:~$ cat /etc/default/arpwatch.conf # Global options for arpwatch(8).
# do not use the -i, -f or -u options here, they are added automatically # Debian: don't report bogons, don't use PROMISC. ARGS="-N -p"
# if you want to add a pcap filter, uncomment and adjust the option below (you # will need spaces so adding -F to the ARGS above will cause problems). See -F # option in man 8 arpwatch for more information #PCAP_FILTER="not ether host (00:11:22:33:44:55 or 66:77:88:99:aa:bb)"
# Debian: run as `arpwatch' user. Empty this to run as root. RUNAS="arpwatch"
# when using systemd you have to enable arpwatch explicitly for each interface # you want to run it on by running: # systemctl enable arpwatch@IFACE # systemctl start arpwatch@IFACE
# For the LSB init script, enter a list of interfaces into the list below; # arpwatch will be started to listen on these interfaces. # Note: This is ignored when using systemd! # INTERFACES="eth0 eth1" INTERFACES="" :~$ sudo systemctl enable arpwatch@eth0 :~$ sudo systemctl start arpwatch@eth0 :~$ sudo systemctl enable arpwatch@wlan0 :~$ sudo systemctl start arpwatch@wlan0
# /etc/arpwatch.conf: Debian-specific way to watch multiple interfaces. # Format of this configuration file is: # #<dev1> <arpwatch options for dev1> #<dev2> <arpwatch options for dev2> #... #<devN> <arpwatch options for devN> # # You can set global options for all interfaces by editing # /etc/default/arpwatch
# For example:
#eth0 -m root #eth1 -m root #eth2 -m root
# or, if you have an MTA configured for plussed addressing: # #eth0 -m root+eth0 #eth1 -m root+eth1 #eth2 -m root+eth2
Log
1 2 3 4 5 6 7 8 9 10 11
:~$ sudo journalctl -u [arpwatch/arpwatch@eth0] -- Logs begin at Sun 2019-09-01 08:21:33 HKT, end at Sun 2019-09-01 09:13:34 HKT. -- Sep 01 08:36:00 kali systemd[1]: Starting arpwatch service on interface wlan0... Sep 01 08:36:00 kali systemd[1]: Started arpwatch service on interface wlan0. Sep 01 08:36:00 kali arpwatch[2185]: Running as uid=117 gid=121 Sep 01 08:36:00 kali arpwatch[2185]: listening on eth0 Sep 01 08:36:05 kali arpwatch[2185]: new station 192.168.0.104 xx:xx:xx:xx:xx:xx eth0 Sep 01 08:36:05 kali arpwatch[2185]: new station 192.168.0.100 xx:xx:xx:xx:xx:xx eth0 Sep 01 08:36:08 kali arpwatch[2185]: new station 192.168.0.97 xx:xx:xx:xx:xx:xx eth0 Sep 01 08:36:08 kali arpwatch[2185]: changed station 192.168.0.97 xx:xx:xx:xx:xx:xx eth0 ...
# -mhe=on|off Enables or disables file name encryption. # -p add password to zip-file :~$ 7z a -mhe -p tmp.7z /tmp/a /tmp/b Enter password (will not be echoed): Verify password (will not be echoed) :
:~$ 7z l tmp.7z Enter password (will not be echoed): :~$
set compression method
1 2
# -mx=0,1,3,5,7,9 default=5,sets level of compression :~$ 7z a -mx=0 a.7z /tmp/a
veracrypt
VeraCrypt is a free open source disk encryption software for Windows, Mac OSX and Linux. Brought to you by IDRIX and based on TrueCrypt 7.1a.