The latest articles on DEV Community by Sp1983 (@sp1983). https://dev.to/sp1983 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F36281%2F66695e17-e8f6-4953-b245-b0516d48a232.jpeg https://dev.to/sp1983 en Sp1983 Fri, 24 Jul 2026 15:01:02 +0000 https://dev.to/sp1983/dsci-ci-with-regular-programming-languages-instead-of-yaml-5h71 https://dev.to/sp1983/dsci-ci-with-regular-programming-languages-instead-of-yaml-5h71 <p><a href="https://github.com/melezhik/DSCI" rel="noopener noreferrer">DSCI</a> is forgejo CI runner with pipelines syntax is just regular programming languages like Python or Raku:</p> <p><strong>.dsci/jobs.yaml</strong><br> </p> <div class="highlight js-code-highlight"> <pre class="highlight yaml"><code><span class="na">jobs</span><span class="pi">:</span> <span class="pi">-</span> <span class="na">id</span><span class="pi">:</span> <span class="s">job1</span> <span class="na">path</span><span class="pi">:</span> <span class="s">.</span> <span class="na">params</span><span class="pi">:</span> <span class="na">name</span><span class="pi">:</span> <span class="s2">"</span><span class="s">dsci"</span> </code></pre> </div> <p><strong>.dsci/job.py</strong><br> </p> <div class="highlight js-code-highlight"> <pre class="highlight python"><code><span class="c1">#!/usr/bin/python3 </span><span class="n">c</span> <span class="o">=</span> <span class="nf">config</span><span class="p">()</span> <span class="nf">print</span><span class="p">(</span><span class="sa">f</span><span class="sh">"</span><span class="s">hello </span><span class="si">{</span><span class="n">c</span><span class="p">[</span><span class="sh">'</span><span class="s">name</span><span class="sh">'</span><span class="p">]</span><span class="si">}</span><span class="sh">"</span><span class="p">)</span> </code></pre> </div> <p>Just drop these two files into <code>.dsci/</code> directory under the root of your repo, and that's it.</p> <p>DSCI supports many languages, so if you prefer, say Raku just have <code>job.raku</code> instead:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight perl"><code><span class="c1">#!/usr/bin/raku</span> <span class="k">my</span> <span class="nv">$c</span> <span class="o">=</span> <span class="nv">config</span><span class="p">();</span> <span class="nv">say</span><span class="p">("</span><span class="s2">hello </span><span class="si">$c</span><span class="s2">&lt;name&gt;</span><span class="p">");</span> </code></pre> </div> <p>DSCI is designed for programmers - everything which is possible in general programming languages is allowed here - passing state between jobs / tasks as regular variables, returning states from tasks, etc. It's easy, fun and flexible. Instead of messing with entangled YAML code, just use normal programming languages</p> <p>Forgejo integration.</p> <p>So far DSCI is fully <a href="https://github.com/melezhik/DSCI/blob/main/forgejo-setup.md" rel="noopener noreferrer">integrated</a> with Forgejo CI using web hooks mechanics, but in theory any web hook based CI is allowed - including GitHub, GitLab, etc ...</p> <p>That's it. Please give the project a star on <a href="https://github.com/melezhik/DSCI" rel="noopener noreferrer">https://github.com/melezhik/DSCI</a> and give it a try using installation <a href="https://github.com/melezhik/DSCI/blob/main/install.md" rel="noopener noreferrer">guide</a></p> rakulang ci forgejo devops Sp1983 Thu, 23 Jul 2026 11:09:31 +0000 https://dev.to/sp1983/dsci-ci-with-regular-programming-languages-instead-of-yaml-29kk https://dev.to/sp1983/dsci-ci-with-regular-programming-languages-instead-of-yaml-29kk <p><a href="https://github.com/melezhik/DSCI" rel="noopener noreferrer">DSCI</a> is forgejo CI runner with pipelines syntax is just regular programming languages like Python or Raku:</p> <p><strong>.dsci/jobs.yaml</strong><br> </p> <div class="highlight js-code-highlight"> <pre class="highlight yaml"><code><span class="na">jobs</span><span class="pi">:</span> <span class="pi">-</span> <span class="na">id</span><span class="pi">:</span> <span class="s">job1</span> <span class="na">path</span><span class="pi">:</span> <span class="s">.</span> <span class="na">params</span><span class="pi">:</span> <span class="na">name</span><span class="pi">:</span> <span class="s2">"</span><span class="s">dsci"</span> </code></pre> </div> <p><strong>.dsci/job.py</strong><br> </p> <div class="highlight js-code-highlight"> <pre class="highlight python"><code><span class="c1">#!/usr/bin/python3 </span><span class="n">c</span> <span class="o">=</span> <span class="nf">config</span><span class="p">()</span> <span class="nf">print</span><span class="p">(</span><span class="sa">f</span><span class="sh">"</span><span class="s">hello </span><span class="si">{</span><span class="n">c</span><span class="p">[</span><span class="sh">'</span><span class="s">name</span><span class="sh">'</span><span class="p">]</span><span class="si">}</span><span class="sh">"</span><span class="p">)</span> </code></pre> </div> <p>Just drop these two files into <code>.dsci/</code> directory under the root of your repo, and that's it.</p> <p>DSCI supports many languages, so if you prefer, say Raku just have <code>job.raku</code> instead:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight perl"><code><span class="c1">#!/usr/bin/raku</span> <span class="k">my</span> <span class="nv">$c</span> <span class="o">=</span> <span class="nv">config</span><span class="p">();</span> <span class="nv">say</span><span class="p">("</span><span class="s2">hello </span><span class="si">$c</span><span class="s2">&lt;name&gt;</span><span class="p">");</span> </code></pre> </div> <p>DSCI is designed for programmers - everything which is possible in general programming languages is allowed here - passing state between jobs / tasks as regular variables, returning states from tasks, etc. It's easy, fun and flexible. Instead of messing with entangled YAML code, just use normal programming languages</p> <p>Forgejo integration.</p> <p>So far DSCI is fully <a href="https://github.com/melezhik/DSCI/blob/main/forgejo-setup.md" rel="noopener noreferrer">integrated</a> with Forgejo CI using web hooks mechanics, but in theory any web hook based CI is allowed - including GitHub, GitLab, etc ...</p> <p>That's it. Please give the project a star on <a href="https://github.com/melezhik/DSCI" rel="noopener noreferrer">https://github.com/melezhik/DSCI</a> and give it a try using installation <a href="https://github.com/melezhik/DSCI/blob/main/install.md" rel="noopener noreferrer">guide</a></p> rakulang ci forgejo devops Sp1983 Thu, 23 Jul 2026 06:51:45 +0000 https://dev.to/sp1983/dsci-ci-with-regular-programming-languages-instead-of-yaml-42nf https://dev.to/sp1983/dsci-ci-with-regular-programming-languages-instead-of-yaml-42nf <p><a href="https://github.com/melezhik/DSCI" rel="noopener noreferrer">DSCI</a> is forgejo CI runner with pipelines syntax is just regular programming languages like Python or Raku:</p> <p><strong>.dsci/jobs.yaml</strong><br> </p> <div class="highlight js-code-highlight"> <pre class="highlight yaml"><code><span class="na">jobs</span><span class="pi">:</span> <span class="pi">-</span> <span class="na">id</span><span class="pi">:</span> <span class="s">job1</span> <span class="na">path</span><span class="pi">:</span> <span class="s">.</span> <span class="na">params</span><span class="pi">:</span> <span class="na">name</span><span class="pi">:</span> <span class="s2">"</span><span class="s">dsci"</span> </code></pre> </div> <p><strong>.dsci/job.py</strong><br> </p> <div class="highlight js-code-highlight"> <pre class="highlight python"><code><span class="c1">#!/usr/bin/python3 </span><span class="n">c</span> <span class="o">=</span> <span class="nf">config</span><span class="p">()</span> <span class="nf">print</span><span class="p">(</span><span class="sa">f</span><span class="sh">"</span><span class="s">hello </span><span class="si">{</span><span class="n">c</span><span class="p">[</span><span class="sh">'</span><span class="s">name</span><span class="sh">'</span><span class="p">]</span><span class="si">}</span><span class="sh">"</span><span class="p">)</span> </code></pre> </div> <p>Just drop these two files into <code>.dsci/</code> directory under the root of your repo, and that's it.</p> <p>DSCI supports many languages, so if you prefer, say Raku just have <code>job.raku</code> instead:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight perl"><code><span class="c1">#!/usr/bin/raku</span> <span class="k">my</span> <span class="nv">$c</span> <span class="o">=</span> <span class="nv">config</span><span class="p">();</span> <span class="nv">say</span><span class="p">("</span><span class="s2">hello </span><span class="si">$c</span><span class="s2">&lt;name&gt;</span><span class="p">");</span> </code></pre> </div> <p>DSCI is designed for programmers - everything which is possible in general programming languages is allowed here - passing state between jobs / tasks as regular variables, returning states from tasks, etc. It's easy, fun and flexible. Instead of messing with entangled YAML code, just use normal programming languages</p> <p>Forgejo integration.</p> <p>So far DSCI is fully <a href="https://github.com/melezhik/DSCI/blob/main/forgejo-setup.md" rel="noopener noreferrer">integrated</a> with Forgejo CI using web hooks mechanics, but in theory any web hook based CI is allowed - including GitHub, GitLab, etc ...</p> <p>That's it. Please give a project a star on <a href="https://github.com/melezhik/DSCI" rel="noopener noreferrer">https://github.com/melezhik/DSCI</a> and give it a try using installation <a href="https://github.com/melezhik/DSCI/blob/main/install.md" rel="noopener noreferrer">guide</a></p> rakulang ci forgejo devops Sp1983 Fri, 17 Jul 2026 12:20:10 +0000 https://dev.to/sp1983/hardening-rocky-linux-with-dtap-test-protocol-58pe https://dev.to/sp1983/hardening-rocky-linux-with-dtap-test-protocol-58pe <p><a href="https://github.com/melezhik/doubletap" rel="noopener noreferrer">DTAP</a> protocol is a lightweight testing protocol allowing to validate Linux infrastructure at ease. Here is a code example of how one can check that their Rocky Linux VM is secure enough (more Linux distributions are easy to check the same way).</p> <p>First of all check scenarios are just plain Bash</p> <p>The second thing check commands are pretty much the same as if one run them manually using old school ps/grep/exit code approach. </p> <p>That makes DTAP appealing to operation people and devops who are already familiar with Linux standard tool chain. </p> <p>So here is an example:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!/bin/bash</span> <span class="nb">export </span><span class="nv">DTAP_SESSION</span><span class="o">=</span><span class="si">$(</span><span class="nb">date</span> +%s<span class="si">)</span> <span class="nb">sudo </span>systemctl is-enabled firewalld 2&gt;&amp;1 | dtap <span class="nt">--box</span> - <span class="se">\</span> <span class="nt">--check</span> srv-enabled <span class="se">\</span> <span class="nt">--desc</span> <span class="s2">"firewalld srv is enabled"</span> <span class="nb">sudo </span>systemctl is-active firewalld 2&gt;&amp;1 | dtap <span class="nt">--box</span> - <span class="se">\</span> <span class="nt">--check</span> srv-active <span class="se">\</span> <span class="nt">--desc</span> <span class="s2">"firewalld srv is active"</span> <span class="nb">sudo </span>firewall-cmd <span class="nt">--list-all</span> | dtap <span class="se">\</span> <span class="nt">--check</span> firewall-default-deny <span class="se">\</span> <span class="nt">--box</span> - <span class="se">\</span> <span class="nt">--desc</span> <span class="s2">"firewall default policy is deny"</span> <span class="nb">sudo </span>sshd <span class="nt">-T</span> | dtap <span class="se">\</span> <span class="nt">--check</span> sshd-secure <span class="se">\</span> <span class="nt">--box</span> - <span class="se">\</span> <span class="nt">--desc</span> <span class="s2">"sshd is secure"</span> getenforce | dtap <span class="se">\</span> <span class="nt">--check</span> selinux-enabled <span class="se">\</span> <span class="nt">--box</span> - <span class="se">\</span> <span class="nt">--desc</span> <span class="s2">"selinux enabled and enforced"</span> <span class="nb">cat</span> /etc/selinux/config | dtap <span class="se">\</span> <span class="nt">--check</span> selinux-config-ok <span class="se">\</span> <span class="nt">--box</span> - <span class="se">\</span> <span class="nt">--desc</span> <span class="s2">"selinux config correct"</span> rpm <span class="nt">-q</span> lynis 2&gt;&amp;1 | dtap <span class="se">\</span> <span class="nt">--check</span> package-install-ok <span class="se">\</span> <span class="nt">--box</span> - <span class="se">\</span> <span class="nt">--params</span> <span class="nv">pm</span><span class="o">=</span>rpm <span class="se">\</span> <span class="nt">--desc</span> <span class="s2">"lynis package is installed"</span> <span class="o">(</span><span class="nb">sudo </span>lynis system audit 2&gt;&amp;1<span class="p">;</span> <span class="nb">echo</span> <span class="nv">$?</span><span class="o">)</span> | dtap <span class="se">\</span> <span class="nt">--check</span> exit-ok <span class="se">\</span> <span class="nt">--box</span> - <span class="se">\</span> <span class="nt">--desc</span> <span class="s2">"sudo lynis system audit exits OK"</span> dtap <span class="nt">--report</span> <span class="nv">ex_code</span><span class="o">=</span><span class="nv">$?</span> <span class="k">if</span> <span class="o">[[</span> ex_code <span class="nt">-eq</span> 1 <span class="o">]]</span><span class="p">;</span> <span class="k">then </span><span class="nb">echo </span>dtap <span class="nt">--report</span> <span class="nt">--details</span> <span class="nt">--failures</span> <span class="k">fi</span> </code></pre> </div> <p>Following test scenario ensures that some things are set on VM:</p> <ul> <li><p>sshd configuration is secure ( so far that means no root login is allowed and password less authentication in place, more checks will be added in the future )</p></li> <li><p>firewall service runs and has default deny all policy </p></li> <li><p>selinux is enabled </p></li> <li><p>lynis audit is installed and successfully runs on the system with no error </p></li> </ul> <p>In real life you can add mode checks, just check ready to use <a href="https://github.com/melezhik/doubletap/blob/main/checks.md" rel="noopener noreferrer">checks</a> available from DTAP distribution.</p> <p>More checks are easy to add (contribution guide coming soon), so PRs are welcome. 🤗 </p> <p>The DTAP is very lightweight and easy to install. It follows simple client/server architecture. </p> <p>Both clients and server are just go binaries, you may build them your self and install on your server, follow installation <a href="https://github.com/melezhik/doubletap/blob/main/install.md" rel="noopener noreferrer">guide</a>.</p> <p>In nutshell client would run on target VM, execute Bash commands and send output to server that executes check rules against the output and results are send back to a client machine. You are free to have one central check rules executor server and install it on the same machine where you run tests</p> <p>Check rules are powered by modern and super powerfull <a href="https://raku.org" rel="noopener noreferrer">Raku</a> language, you need to install check rules engine (Sparrow6) on a server machine. For Alpine and Rocky Linux there are native packages in place:</p> <p>Rocky Linux:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="nb">sudo </span>dnf <span class="nb">install</span> <span class="s1">'dnf-command(copr)'</span> <span class="nt">-y</span> <span class="nt">-q</span> <span class="nb">sudo </span>dnf copr <span class="nb">enable </span>grayeul/TestProj <span class="nt">-y</span> <span class="nb">sudo </span>yum <span class="nb">install </span>raku-sparrow6 <span class="nt">-y</span> <span class="nt">-q</span> </code></pre> </div> <p>Alpine:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="nb">sudo </span>apk add raku-sparrow6 </code></pre> </div> <p>In the end here is example report run for one my test machine, oops , it's not secure enough ))<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight console"><code><span class="gp">$</span><span class="w"> </span>bash examples/hardening.sh <span class="go">DTAP report session: 1784290463 === firewalld srv is enabled ...... OK firewalld srv is active ...... OK firewall default policy is deny ...... OK sshd is secure ...... FAIL selinux enabled and enforced ...... OK selinux config correct ...... OK lynis package is installed ...... FAIL sudo lynis system audit exits OK ...... FAIL DTAP report session: 1784290463 === sshd is secure ...... FAIL [report] 12:14:25 :: [sparrowtask] - run sparrow task . 12:14:25 :: [sparrowtask] - run [.], thing: . [task run: task.bash - .] [task stdout] 12:14:25 :: port 22 12:14:25 :: addressfamily any 12:14:25 :: listenaddress [::]:22 12:14:25 :: listenaddress 0.0.0.0:22 12:14:25 :: usepam yes 12:14:25 :: logingracetime 120 12:14:25 :: x11displayoffset 10 12:14:25 :: x11maxdisplays 1000 12:14:25 :: maxauthtries 6 12:14:25 :: maxsessions 10 12:14:25 :: clientaliveinterval 0 12:14:25 :: clientalivecountmax 3 12:14:25 :: requiredrsasize 2048 12:14:25 :: streamlocalbindmask 0177 12:14:25 :: permitrootlogin yes 12:14:25 :: ignorerhosts yes 12:14:25 :: ignoreuserknownhosts no 12:14:25 :: hostbasedauthentication no 12:14:25 :: hostbasedusesnamefrompacketonly no 12:14:25 :: pubkeyauthentication yes 12:14:25 :: kerberosauthentication no 12:14:25 :: kerberosorlocalpasswd yes 12:14:25 :: kerberosticketcleanup yes 12:14:25 :: kerberosuniqueccache no 12:14:25 :: kerberosusekuserok yes 12:14:25 :: gssapienablek5users no 12:14:25 :: gssapiauthentication yes 12:14:25 :: gssapicleanupcredentials no 12:14:25 :: gssapikeyexchange no 12:14:25 :: gssapistrictacceptorcheck yes 12:14:25 :: gssapistorecredentialsonrekey no 12:14:25 :: gssapikexalgorithms gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512- 12:14:25 :: passwordauthentication no 12:14:25 :: kbdinteractiveauthentication no 12:14:25 :: printmotd no 12:14:25 :: printlastlog yes 12:14:25 :: x11forwarding yes 12:14:25 :: x11uselocalhost yes 12:14:25 :: permittty yes 12:14:25 :: permituserrc yes 12:14:25 :: strictmodes yes 12:14:25 :: tcpkeepalive yes 12:14:25 :: permitemptypasswords no 12:14:25 :: compression yes 12:14:25 :: gatewayports no 12:14:25 :: usedns no 12:14:25 :: allowtcpforwarding yes 12:14:25 :: allowagentforwarding yes 12:14:25 :: disableforwarding no 12:14:25 :: allowstreamlocalforwarding yes 12:14:25 :: streamlocalbindunlink no 12:14:25 :: fingerprinthash SHA256 12:14:25 :: exposeauthinfo no 12:14:25 :: pidfile /var/run/sshd.pid 12:14:25 :: modulifile /etc/ssh/moduli 12:14:25 :: xauthlocation /usr/bin/xauth 12:14:25 :: ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr 12:14:25 :: macs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 12:14:25 :: banner none 12:14:25 :: forcecommand none 12:14:25 :: chrootdirectory none 12:14:25 :: trustedusercakeys none 12:14:25 :: revokedkeys none 12:14:25 :: securitykeyprovider internal 12:14:25 :: authorizedprincipalsfile none 12:14:25 :: versionaddendum none 12:14:25 :: authorizedkeyscommand none 12:14:25 :: authorizedkeyscommanduser none 12:14:25 :: authorizedprincipalscommand none 12:14:25 :: authorizedprincipalscommanduser none 12:14:25 :: hostkeyagent none 12:14:25 :: kexalgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512 12:14:25 :: casignaturealgorithms ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512 12:14:25 :: hostbasedacceptedalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa 12:14:25 :: hostkeyalgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com 12:14:25 :: pubkeyacceptedalgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com 12:14:25 :: loglevel INFO 12:14:25 :: syslogfacility AUTHPRIV 12:14:25 :: authorizedkeysfile .ssh/authorized_keys 12:14:25 :: hostkey /etc/ssh/ssh_host_rsa_key 12:14:25 :: hostkey /etc/ssh/ssh_host_ecdsa_key 12:14:25 :: hostkey /etc/ssh/ssh_host_ed25519_key 12:14:25 :: authenticationmethods any 12:14:25 :: subsystem sftp /usr/libexec/openssh/sftp-server 12:14:25 :: maxstartups 10:30:100 12:14:25 :: persourcemaxstartups none 12:14:25 :: persourcenetblocksize 32:128 12:14:25 :: permittunnel no 12:14:25 :: ipqos af21 cs1 12:14:25 :: rekeylimit 0 0 12:14:25 :: permitopen any 12:14:25 :: permitlisten any 12:14:25 :: permituserenvironment no 12:14:25 :: pubkeyauthoptions none [task check] </span><span class="gp">#</span><span class="w"> </span>root login should be not allowed <span class="gp">stdout match &lt;permitrootlogin no&gt;</span><span class="w"> </span>False <span class="gp">#</span><span class="w"> </span>password auth should be disabled <span class="gp">stdout match &lt;passwordauthentication no&gt;</span><span class="w"> </span>True <span class="go">================= TASK CHECK FAIL lynis package is installed ...... FAIL [report] 12:14:27 :: [sparrowtask] - run sparrow task .@pm=rpm 12:14:27 :: [sparrowtask] - run [.], thing: .@pm=rpm [task run: task.bash - .] [task stdout] 12:14:27 :: package lynis is not installed [task check] </span><span class="gp">stdout match (w) &lt;^^ \S+ $</span><span class="nv">$&gt;</span> False <span class="go">================= TASK CHECK FAIL sudo lynis system audit exits OK ...... FAIL [report] 12:14:29 :: [sparrowtask] - run sparrow task . 12:14:29 :: [sparrowtask] - run [.], thing: . [task run: task.bash - .] [task stdout] 12:14:29 :: sudo: lynis: command not found 12:14:29 :: 1 [task check] </span><span class="gp">stdout match &lt;:any:&gt;</span><span class="w"> </span>True <span class="gp">&lt;exit code found&gt;</span><span class="w"> </span>True <span class="gp">#</span><span class="w"> </span><span class="nb">exit </span>code: 1 <span class="gp">&lt;exit code == 0&gt;</span><span class="w"> </span>False <span class="go">================= TASK CHECK FAIL </span></code></pre> </div> <p>If you like the tool please give it a star on <a href="https://github.com/melezhik/doubletap" rel="noopener noreferrer">GH page</a> or just start using it. </p> <p>Thanks! 😊 🙏 😍 </p> security linux rakulang rockylinux Sp1983 Thu, 09 Jul 2026 09:33:34 +0000 https://dev.to/sp1983/linux-compliance-checks-with-sparrow-plugin-2160 https://dev.to/sp1983/linux-compliance-checks-with-sparrow-plugin-2160 <p><a href="https://sparrowhub.io" rel="noopener noreferrer">Sparrow</a> is Raku automation framework comes with useful plugins people can use to automate infrastructure. Scc plugin allows to check Linux essential configuration files for security compliance. </p> <p>—-</p> <p>Plugin latest version</p> <p><a href="https://sparrowhub.io/plugin/scc/0.000023" rel="noopener noreferrer">https://sparrowhub.io/plugin/scc/0.000023</a></p> <p>Supported checks</p> <ul> <li>sshd</li> <li>redis</li> <li>sudoers</li> <li>bind</li> <li>sysctl</li> <li>fstab</li> <li>ifconfig</li> </ul> <p>Here some example reports</p> <h2> Sysctl </h2> <div class="highlight js-code-highlight"> <pre class="highlight console"><code><span class="gp">$</span><span class="w"> </span><span class="nb">sudo </span>sysctl <span class="nt">-a</span> | s6 <span class="nt">--plg-run</span> scc@check<span class="o">=</span>sysctl <span class="go">12:24:07 :: [task] - run plg scc@check=sysctl 12:24:07 :: [task] - run [scc], thing: scc@check=sysctl [task run: task.bash - scc] [task stdout] 12:24:08 :: abi.cp15_barrier = 1 12:24:08 :: abi.setend = 1 12:24:08 :: abi.swp = 0 12:24:08 :: abi.tagged_addr_disabled = 0 12:24:08 :: debug.exception-trace = 0 12:24:08 :: dev.cdrom.autoclose = 1 12:24:08 :: dev.cdrom.autoeject = 0 12:24:08 :: dev.cdrom.check_media = 0 12:24:08 :: dev.cdrom.debug = 0 12:24:08 :: dev.cdrom.info = CD-ROM information, Id: cdrom.c 3.20 2003/12/17 12:24:08 :: dev.cdrom.info = 12:24:08 :: dev.cdrom.info = drive name: 12:24:08 :: dev.cdrom.info = drive speed: </span><span class="gp">12:24:08 :: dev.cdrom.info = drive #</span><span class="w"> </span>of slots: <span class="go">12:24:08 :: dev.cdrom.info = Can close tray: 12:24:08 :: dev.cdrom.info = Can open tray: 12:24:08 :: dev.cdrom.info = Can lock tray: 12:24:08 :: dev.cdrom.info = Can change speed: 12:24:08 :: dev.cdrom.info = Can select disk: 12:24:08 :: dev.cdrom.info = Can read multisession: 12:24:08 :: dev.cdrom.info = Can read MCN: 12:24:08 :: dev.cdrom.info = Reports media changed: 12:24:08 :: dev.cdrom.info = Can play audio: 12:24:08 :: dev.cdrom.info = Can write CD-R: 12:24:08 :: dev.cdrom.info = Can write CD-RW: 12:24:08 :: dev.cdrom.info = Can read DVD: 12:24:08 :: dev.cdrom.info = Can write DVD-R: 12:24:08 :: dev.cdrom.info = Can write DVD-RAM: 12:24:08 :: dev.cdrom.info = Can read MRW: 12:24:08 :: dev.cdrom.info = Can write MRW: 12:24:08 :: dev.cdrom.info = Can write RAM: 12:24:08 :: dev.cdrom.info = 12:24:08 :: dev.cdrom.info = 12:24:08 :: dev.cdrom.lock = 0 12:24:08 :: dev.raid.speed_limit_max = 200000 12:24:08 :: dev.raid.speed_limit_min = 1000 12:24:08 :: dev.scsi.logging_level = 68 12:24:08 :: dev.tty.ldisc_autoload = 1 12:24:08 :: dev.tty.legacy_tiocsti = 0 12:24:08 :: fs.aio-max-nr = 65536 12:24:08 :: fs.aio-nr = 0 12:24:08 :: fs.binfmt_misc.llvm-14-runtime/binfmt = enabled 12:24:08 :: fs.binfmt_misc.llvm-14-runtime/binfmt = interpreter /usr/bin/lli-14 12:24:08 :: fs.binfmt_misc.llvm-14-runtime/binfmt = flags: 12:24:08 :: fs.binfmt_misc.llvm-14-runtime/binfmt = offset 0 12:24:08 :: fs.binfmt_misc.llvm-14-runtime/binfmt = magic 4243 12:24:08 :: fs.binfmt_misc.python3/10 = enabled 12:24:08 :: fs.binfmt_misc.python3/10 = interpreter /usr/bin/python3.10 12:24:08 :: fs.binfmt_misc.python3/10 = flags: 12:24:08 :: fs.binfmt_misc.python3/10 = offset 0 12:24:08 :: fs.binfmt_misc.python3/10 = magic 6f0d0d0a 12:24:08 :: fs.binfmt_misc.status = enabled 12:24:08 :: fs.dentry-state = 409950 398351 45 0 243512 0 12:24:08 :: fs.dir-notify-enable = 1 12:24:08 :: fs.epoll.max_user_watches = 5456495 12:24:08 :: fs.fanotify.max_queued_events = 16384 12:24:08 :: fs.fanotify.max_user_groups = 128 12:24:08 :: fs.fanotify.max_user_marks = 198574 12:24:08 :: fs.file-max = 9223372036854775807 12:24:08 :: fs.file-nr = 3520 0 9223372036854775807 12:24:08 :: fs.inode-nr = 166357 412 12:24:08 :: fs.inode-state = 166357 412 0 0 0 0 0 12:24:08 :: fs.inotify.max_queued_events = 16384 12:24:08 :: fs.inotify.max_user_instances = 128 12:24:08 :: fs.inotify.max_user_watches = 186755 12:24:08 :: fs.lease-break-time = 45 12:24:08 :: fs.leases-enable = 1 12:24:08 :: fs.mount-max = 100000 12:24:08 :: fs.mqueue.msg_default = 10 12:24:08 :: fs.mqueue.msg_max = 10 12:24:08 :: fs.mqueue.msgsize_default = 8192 12:24:08 :: fs.mqueue.msgsize_max = 8192 12:24:08 :: fs.mqueue.queues_max = 256 12:24:08 :: fs.nr_open = 1048576 12:24:08 :: fs.overflowgid = 65534 12:24:08 :: fs.overflowuid = 65534 12:24:08 :: fs.pipe-max-size = 1048576 12:24:08 :: fs.pipe-user-pages-hard = 0 12:24:08 :: fs.pipe-user-pages-soft = 16384 12:24:08 :: fs.protected_fifos = 1 12:24:08 :: fs.protected_hardlinks = 1 12:24:08 :: fs.protected_regular = 2 12:24:08 :: fs.protected_symlinks = 1 12:24:08 :: fs.quota.allocated_dquots = 0 12:24:08 :: fs.quota.cache_hits = 0 12:24:08 :: fs.quota.drops = 0 12:24:08 :: fs.quota.free_dquots = 0 12:24:08 :: fs.quota.lookups = 0 12:24:08 :: fs.quota.reads = 0 12:24:08 :: fs.quota.syncs = 320 12:24:08 :: fs.quota.writes = 0 12:24:08 :: fs.suid_dumpable = 2 12:24:08 :: fs.verity.require_signatures = 0 12:24:08 :: kernel.acct = 4 2 30 12:24:08 :: kernel.apparmor_display_secid_mode = 0 12:24:08 :: kernel.apparmor_restrict_unprivileged_io_uring = 0 12:24:08 :: kernel.apparmor_restrict_unprivileged_unconfined = 0 12:24:08 :: kernel.apparmor_restrict_unprivileged_userns = 0 12:24:08 :: kernel.apparmor_restrict_unprivileged_userns_complain = 0 12:24:08 :: kernel.apparmor_restrict_unprivileged_userns_force = 0 12:24:08 :: kernel.arch = aarch64 12:24:08 :: kernel.auto_msgmni = 0 12:24:08 :: kernel.bpf_stats_enabled = 0 12:24:08 :: kernel.cad_pid = 1 12:24:08 :: kernel.cap_last_cap = 40 12:24:08 :: kernel.core_pattern = |/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -F%F -- %E 12:24:08 :: kernel.core_pipe_limit = 10 12:24:08 :: kernel.core_uses_pid = 1 12:24:08 :: kernel.ctrl-alt-del = 0 12:24:08 :: kernel.dmesg_restrict = 1 12:24:08 :: kernel.domainname = (none) 12:24:08 :: kernel.firmware_config.force_sysfs_fallback = 0 12:24:08 :: kernel.firmware_config.ignore_sysfs_fallback = 0 12:24:08 :: kernel.ftrace_dump_on_oops = 0 12:24:08 :: kernel.ftrace_enabled = 1 12:24:08 :: kernel.hardlockup_all_cpu_backtrace = 0 12:24:08 :: kernel.hardlockup_panic = 0 12:24:08 :: kernel.hostname = sparky02b 12:24:08 :: kernel.hotplug = 12:24:08 :: kernel.hung_task_all_cpu_backtrace = 0 12:24:08 :: kernel.hung_task_check_count = 4194304 12:24:08 :: kernel.hung_task_check_interval_secs = 0 12:24:08 :: kernel.hung_task_panic = 0 12:24:08 :: kernel.hung_task_timeout_secs = 120 12:24:08 :: kernel.hung_task_warnings = 10 12:24:08 :: kernel.io_uring_disabled = 0 12:24:08 :: kernel.io_uring_group = -1 12:24:08 :: kernel.kexec_load_disabled = 0 12:24:08 :: kernel.kexec_load_limit_panic = -1 12:24:08 :: kernel.kexec_load_limit_reboot = -1 12:24:08 :: kernel.keys.gc_delay = 300 12:24:08 :: kernel.keys.maxbytes = 20000 12:24:08 :: kernel.keys.maxkeys = 200 12:24:08 :: kernel.keys.persistent_keyring_expiry = 259200 12:24:08 :: kernel.keys.root_maxbytes = 25000000 12:24:08 :: kernel.keys.root_maxkeys = 1000000 12:24:08 :: kernel.kptr_restrict = 1 12:24:08 :: kernel.latencytop = 0 12:24:08 :: kernel.max_lock_depth = 1024 12:24:08 :: kernel.max_rcu_stall_to_panic = 0 12:24:08 :: kernel.modprobe = /sbin/modprobe 12:24:08 :: kernel.modules_disabled = 0 12:24:08 :: kernel.msg_next_id = -1 12:24:08 :: kernel.msgmax = 8192 12:24:08 :: kernel.msgmnb = 16384 12:24:08 :: kernel.msgmni = 32000 12:24:08 :: kernel.ngroups_max = 65536 12:24:08 :: kernel.nmi_watchdog = 0 12:24:08 :: kernel.ns_last_pid = 856760 12:24:08 :: kernel.numa_balancing = 0 12:24:08 :: kernel.numa_balancing_promote_rate_limit_MBps = 65536 12:24:08 :: kernel.oops_all_cpu_backtrace = 0 12:24:08 :: kernel.oops_limit = 10000 12:24:08 :: kernel.osrelease = 6.8.0-1050-oracle 12:24:08 :: kernel.ostype = Linux 12:24:08 :: kernel.overflowgid = 65534 12:24:08 :: kernel.overflowuid = 65534 12:24:08 :: kernel.panic = 0 12:24:08 :: kernel.panic_on_oops = 0 12:24:08 :: kernel.panic_on_rcu_stall = 0 12:24:08 :: kernel.panic_on_warn = 0 12:24:08 :: kernel.panic_print = 0 12:24:08 :: kernel.perf_cpu_time_max_percent = 25 12:24:08 :: kernel.perf_event_max_contexts_per_stack = 8 12:24:08 :: kernel.perf_event_max_sample_rate = 100000 12:24:08 :: kernel.perf_event_max_stack = 127 12:24:08 :: kernel.perf_event_mlock_kb = 516 12:24:08 :: kernel.perf_event_paranoid = 4 12:24:08 :: kernel.perf_user_access = 0 12:24:08 :: kernel.pid_max = 4194304 12:24:08 :: kernel.poweroff_cmd = /sbin/poweroff 12:24:08 :: kernel.print-fatal-signals = 0 12:24:08 :: kernel.printk = 4 4 1 7 12:24:08 :: kernel.printk_delay = 0 12:24:08 :: kernel.printk_devkmsg = on 12:24:08 :: kernel.printk_ratelimit = 5 12:24:08 :: kernel.printk_ratelimit_burst = 10 12:24:08 :: kernel.pty.max = 4096 12:24:08 :: kernel.pty.nr = 4 12:24:08 :: kernel.pty.reserve = 1024 12:24:08 :: kernel.random.boot_id = 03560fb6-eb3e-4cc2-a12c-1604610ee88a 12:24:08 :: kernel.random.entropy_avail = 256 12:24:08 :: kernel.random.poolsize = 256 12:24:08 :: kernel.random.urandom_min_reseed_secs = 60 12:24:08 :: kernel.random.uuid = bf318e69-c00e-4483-965d-eb1674fadf71 12:24:08 :: kernel.random.write_wakeup_threshold = 256 12:24:08 :: kernel.randomize_va_space = 2 12:24:08 :: kernel.real-root-dev = 0 12:24:08 :: kernel.sched_autogroup_enabled = 1 12:24:08 :: kernel.sched_cfs_bandwidth_slice_us = 5000 12:24:08 :: kernel.sched_deadline_period_max_us = 4194304 12:24:08 :: kernel.sched_deadline_period_min_us = 100 12:24:08 :: kernel.sched_rr_timeslice_ms = 100 12:24:08 :: kernel.sched_rt_period_us = 1000000 12:24:08 :: kernel.sched_rt_runtime_us = 950000 12:24:08 :: kernel.sched_schedstats = 0 12:24:08 :: kernel.sched_util_clamp_max = 1024 12:24:08 :: kernel.sched_util_clamp_min = 1024 12:24:08 :: kernel.sched_util_clamp_min_rt_default = 1024 12:24:08 :: kernel.seccomp.actions_avail = kill_process kill_thread trap errno user_notif trace log allow 12:24:08 :: kernel.seccomp.actions_logged = kill_process kill_thread trap errno user_notif trace log 12:24:08 :: kernel.sem = 32000 1024000000 500 32000 12:24:08 :: kernel.sem_next_id = -1 12:24:08 :: kernel.shm_next_id = -1 12:24:08 :: kernel.shm_rmid_forced = 0 12:24:08 :: kernel.shmall = 18446744073692774399 12:24:08 :: kernel.shmmax = 18446744073692774399 12:24:08 :: kernel.shmmni = 4096 12:24:08 :: kernel.soft_watchdog = 1 12:24:08 :: kernel.softlockup_all_cpu_backtrace = 0 12:24:08 :: kernel.softlockup_panic = 0 12:24:08 :: kernel.stack_tracer_enabled = 0 12:24:08 :: kernel.sysctl_writes_strict = 1 12:24:08 :: kernel.sysrq = 176 12:24:08 :: kernel.tainted = 0 12:24:08 :: kernel.task_delayacct = 0 12:24:08 :: kernel.threads-max = 191241 12:24:08 :: kernel.timer_migration = 1 12:24:08 :: kernel.traceoff_on_warning = 0 12:24:08 :: kernel.tracepoint_printk = 0 12:24:08 :: kernel.unprivileged_bpf_disabled = 2 12:24:08 :: kernel.unprivileged_userns_apparmor_policy = 1 12:24:08 :: kernel.unprivileged_userns_clone = 1 12:24:08 :: kernel.user_events_max = 32768 12:24:08 :: kernel.usermodehelper.bset = 4294967295 511 12:24:08 :: kernel.usermodehelper.inheritable = 4294967295 511 </span><span class="gp">12:24:08 :: kernel.version = #</span>51~22.04.1-Ubuntu SMP Tue Apr 21 04:35:38 UTC 2026 <span class="go">12:24:08 :: kernel.warn_limit = 0 12:24:08 :: kernel.watchdog = 1 12:24:08 :: kernel.watchdog_cpumask = 0-3 12:24:08 :: kernel.watchdog_thresh = 10 12:24:08 :: kernel.yama.ptrace_scope = 1 12:24:08 :: net.bridge.bridge-nf-call-arptables = 1 12:24:08 :: net.bridge.bridge-nf-call-ip6tables = 1 12:24:08 :: net.bridge.bridge-nf-call-iptables = 1 12:24:08 :: net.bridge.bridge-nf-filter-pppoe-tagged = 0 12:24:08 :: net.bridge.bridge-nf-filter-vlan-tagged = 0 12:24:08 :: net.bridge.bridge-nf-pass-vlan-input-dev = 0 12:24:08 :: net.core.bpf_jit_enable = 1 12:24:08 :: net.core.bpf_jit_harden = 0 12:24:08 :: net.core.bpf_jit_kallsyms = 1 12:24:08 :: net.core.bpf_jit_limit = 68168512962560 12:24:08 :: net.core.busy_poll = 0 12:24:08 :: net.core.busy_read = 0 12:24:08 :: net.core.default_qdisc = fq_codel 12:24:08 :: net.core.dev_weight = 64 12:24:08 :: net.core.dev_weight_rx_bias = 1 12:24:08 :: net.core.dev_weight_tx_bias = 1 12:24:08 :: net.core.devconf_inherit_init_net = 0 12:24:08 :: net.core.fb_tunnels_only_for_init_net = 0 12:24:08 :: net.core.flow_limit_cpu_bitmap = 0 12:24:08 :: net.core.flow_limit_table_len = 4096 12:24:08 :: net.core.gro_normal_batch = 8 12:24:08 :: net.core.high_order_alloc_disable = 0 12:24:08 :: net.core.max_skb_frags = 17 12:24:08 :: net.core.mem_pcpu_rsv = 256 12:24:08 :: net.core.message_burst = 10 12:24:08 :: net.core.message_cost = 5 12:24:08 :: net.core.netdev_budget = 300 12:24:08 :: net.core.netdev_budget_usecs = 2000 12:24:08 :: net.core.netdev_max_backlog = 1000 12:24:08 :: net.core.netdev_rss_key = 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 12:24:08 :: net.core.netdev_tstamp_prequeue = 1 12:24:08 :: net.core.netdev_unregister_timeout_secs = 10 12:24:08 :: net.core.optmem_max = 131072 12:24:08 :: net.core.rmem_default = 212992 12:24:08 :: net.core.rmem_max = 212992 12:24:08 :: net.core.rps_default_mask = 0 12:24:08 :: net.core.rps_sock_flow_entries = 0 12:24:08 :: net.core.skb_defer_max = 64 12:24:08 :: net.core.somaxconn = 4096 12:24:08 :: net.core.tstamp_allow_data = 1 12:24:08 :: net.core.txrehash = 1 12:24:08 :: net.core.warnings = 0 12:24:08 :: net.core.wmem_default = 212992 12:24:08 :: net.core.wmem_max = 212992 12:24:08 :: net.core.xfrm_acq_expires = 30 12:24:08 :: net.core.xfrm_aevent_etime = 10 12:24:08 :: net.core.xfrm_aevent_rseqth = 2 12:24:08 :: net.core.xfrm_larval_drop = 1 12:24:08 :: net.ipv4.cipso_cache_bucket_size = 10 12:24:08 :: net.ipv4.cipso_cache_enable = 1 12:24:08 :: net.ipv4.cipso_rbm_optfmt = 0 12:24:08 :: net.ipv4.cipso_rbm_strictvalid = 1 12:24:08 :: net.ipv4.conf.all.accept_local = 0 12:24:08 :: net.ipv4.conf.all.accept_redirects = 0 12:24:08 :: net.ipv4.conf.all.accept_source_route = 0 12:24:08 :: net.ipv4.conf.all.arp_accept = 0 12:24:08 :: net.ipv4.conf.all.arp_announce = 0 12:24:08 :: net.ipv4.conf.all.arp_evict_nocarrier = 1 12:24:08 :: net.ipv4.conf.all.arp_filter = 0 12:24:08 :: net.ipv4.conf.all.arp_ignore = 0 12:24:08 :: net.ipv4.conf.all.arp_notify = 0 12:24:08 :: net.ipv4.conf.all.bc_forwarding = 0 12:24:08 :: net.ipv4.conf.all.bootp_relay = 0 12:24:08 :: net.ipv4.conf.all.disable_policy = 0 12:24:08 :: net.ipv4.conf.all.disable_xfrm = 0 12:24:08 :: net.ipv4.conf.all.drop_gratuitous_arp = 0 12:24:08 :: net.ipv4.conf.all.drop_unicast_in_l2_multicast = 0 12:24:08 :: net.ipv4.conf.all.force_igmp_version = 0 12:24:08 :: net.ipv4.conf.all.forwarding = 1 12:24:08 :: net.ipv4.conf.all.igmpv2_unsolicited_report_interval = 10000 12:24:08 :: net.ipv4.conf.all.igmpv3_unsolicited_report_interval = 1000 12:24:08 :: net.ipv4.conf.all.ignore_routes_with_linkdown = 0 12:24:08 :: net.ipv4.conf.all.log_martians = 0 12:24:08 :: net.ipv4.conf.all.mc_forwarding = 0 12:24:08 :: net.ipv4.conf.all.medium_id = 0 12:24:08 :: net.ipv4.conf.all.promote_secondaries = 0 12:24:08 :: net.ipv4.conf.all.proxy_arp = 0 12:24:08 :: net.ipv4.conf.all.proxy_arp_pvlan = 0 12:24:08 :: net.ipv4.conf.all.route_localnet = 0 12:24:08 :: net.ipv4.conf.all.rp_filter = 2 12:24:08 :: net.ipv4.conf.all.secure_redirects = 1 12:24:08 :: net.ipv4.conf.all.send_redirects = 1 12:24:08 :: net.ipv4.conf.all.shared_media = 1 12:24:08 :: net.ipv4.conf.all.src_valid_mark = 0 12:24:08 :: net.ipv4.conf.all.tag = 0 12:24:08 :: net.ipv4.conf.default.accept_local = 0 12:24:08 :: net.ipv4.conf.default.accept_redirects = 1 12:24:08 :: net.ipv4.conf.default.accept_source_route = 0 12:24:08 :: net.ipv4.conf.default.arp_accept = 0 12:24:08 :: net.ipv4.conf.default.arp_announce = 0 12:24:08 :: net.ipv4.conf.default.arp_evict_nocarrier = 1 12:24:08 :: net.ipv4.conf.default.arp_filter = 0 12:24:08 :: net.ipv4.conf.default.arp_ignore = 0 12:24:08 :: net.ipv4.conf.default.arp_notify = 0 12:24:08 :: net.ipv4.conf.default.bc_forwarding = 0 12:24:08 :: net.ipv4.conf.default.bootp_relay = 0 12:24:08 :: net.ipv4.conf.default.disable_policy = 0 12:24:08 :: net.ipv4.conf.default.disable_xfrm = 0 12:24:08 :: net.ipv4.conf.default.drop_gratuitous_arp = 0 12:24:08 :: net.ipv4.conf.default.drop_unicast_in_l2_multicast = 0 12:24:08 :: net.ipv4.conf.default.force_igmp_version = 0 12:24:08 :: net.ipv4.conf.default.forwarding = 1 12:24:08 :: net.ipv4.conf.default.igmpv2_unsolicited_report_interval = 10000 12:24:08 :: net.ipv4.conf.default.igmpv3_unsolicited_report_interval = 1000 12:24:08 :: net.ipv4.conf.default.ignore_routes_with_linkdown = 0 12:24:08 :: net.ipv4.conf.default.log_martians = 0 12:24:08 :: net.ipv4.conf.default.mc_forwarding = 0 12:24:08 :: net.ipv4.conf.default.medium_id = 0 12:24:08 :: net.ipv4.conf.default.promote_secondaries = 1 12:24:08 :: net.ipv4.conf.default.proxy_arp = 0 12:24:08 :: net.ipv4.conf.default.proxy_arp_pvlan = 0 12:24:08 :: net.ipv4.conf.default.route_localnet = 0 12:24:08 :: net.ipv4.conf.default.rp_filter = 2 12:24:08 :: net.ipv4.conf.default.secure_redirects = 1 12:24:08 :: net.ipv4.conf.default.send_redirects = 1 12:24:08 :: net.ipv4.conf.default.shared_media = 1 12:24:08 :: net.ipv4.conf.default.src_valid_mark = 0 12:24:08 :: net.ipv4.conf.default.tag = 0 12:24:08 :: net.ipv4.conf.docker0.accept_local = 0 12:24:08 :: net.ipv4.conf.docker0.accept_redirects = 1 12:24:08 :: net.ipv4.conf.docker0.accept_source_route = 0 12:24:08 :: net.ipv4.conf.docker0.arp_accept = 0 12:24:08 :: net.ipv4.conf.docker0.arp_announce = 0 12:24:08 :: net.ipv4.conf.docker0.arp_evict_nocarrier = 1 12:24:08 :: net.ipv4.conf.docker0.arp_filter = 0 12:24:08 :: net.ipv4.conf.docker0.arp_ignore = 0 12:24:08 :: net.ipv4.conf.docker0.arp_notify = 0 12:24:08 :: net.ipv4.conf.docker0.bc_forwarding = 0 12:24:08 :: net.ipv4.conf.docker0.bootp_relay = 0 12:24:08 :: net.ipv4.conf.docker0.disable_policy = 0 12:24:08 :: net.ipv4.conf.docker0.disable_xfrm = 0 12:24:08 :: net.ipv4.conf.docker0.drop_gratuitous_arp = 0 12:24:08 :: net.ipv4.conf.docker0.drop_unicast_in_l2_multicast = 0 12:24:08 :: net.ipv4.conf.docker0.force_igmp_version = 0 12:24:08 :: net.ipv4.conf.docker0.forwarding = 1 12:24:08 :: net.ipv4.conf.docker0.igmpv2_unsolicited_report_interval = 10000 12:24:08 :: net.ipv4.conf.docker0.igmpv3_unsolicited_report_interval = 1000 12:24:08 :: net.ipv4.conf.docker0.ignore_routes_with_linkdown = 0 12:24:08 :: net.ipv4.conf.docker0.log_martians = 0 12:24:08 :: net.ipv4.conf.docker0.mc_forwarding = 0 12:24:08 :: net.ipv4.conf.docker0.medium_id = 0 12:24:08 :: net.ipv4.conf.docker0.promote_secondaries = 1 12:24:08 :: net.ipv4.conf.docker0.proxy_arp = 0 12:24:08 :: net.ipv4.conf.docker0.proxy_arp_pvlan = 0 12:24:08 :: net.ipv4.conf.docker0.route_localnet = 0 12:24:08 :: net.ipv4.conf.docker0.rp_filter = 2 12:24:08 :: net.ipv4.conf.docker0.secure_redirects = 1 12:24:08 :: net.ipv4.conf.docker0.send_redirects = 1 12:24:08 :: net.ipv4.conf.docker0.shared_media = 1 12:24:08 :: net.ipv4.conf.docker0.src_valid_mark = 0 12:24:08 :: net.ipv4.conf.docker0.tag = 0 12:24:08 :: net.ipv4.conf.enp0s3.accept_local = 0 12:24:08 :: net.ipv4.conf.enp0s3.accept_redirects = 1 12:24:08 :: net.ipv4.conf.enp0s3.accept_source_route = 0 12:24:08 :: net.ipv4.conf.enp0s3.arp_accept = 0 12:24:08 :: net.ipv4.conf.enp0s3.arp_announce = 0 12:24:08 :: net.ipv4.conf.enp0s3.arp_evict_nocarrier = 1 12:24:08 :: net.ipv4.conf.enp0s3.arp_filter = 0 12:24:08 :: net.ipv4.conf.enp0s3.arp_ignore = 0 12:24:08 :: net.ipv4.conf.enp0s3.arp_notify = 0 12:24:08 :: net.ipv4.conf.enp0s3.bc_forwarding = 0 12:24:08 :: net.ipv4.conf.enp0s3.bootp_relay = 0 12:24:08 :: net.ipv4.conf.enp0s3.disable_policy = 0 12:24:08 :: net.ipv4.conf.enp0s3.disable_xfrm = 0 12:24:08 :: net.ipv4.conf.enp0s3.drop_gratuitous_arp = 0 12:24:08 :: net.ipv4.conf.enp0s3.drop_unicast_in_l2_multicast = 0 12:24:08 :: net.ipv4.conf.enp0s3.force_igmp_version = 0 12:24:08 :: net.ipv4.conf.enp0s3.forwarding = 1 12:24:08 :: net.ipv4.conf.enp0s3.igmpv2_unsolicited_report_interval = 10000 12:24:08 :: net.ipv4.conf.enp0s3.igmpv3_unsolicited_report_interval = 1000 12:24:08 :: net.ipv4.conf.enp0s3.ignore_routes_with_linkdown = 0 12:24:08 :: net.ipv4.conf.enp0s3.log_martians = 0 12:24:08 :: net.ipv4.conf.enp0s3.mc_forwarding = 0 12:24:08 :: net.ipv4.conf.enp0s3.medium_id = 0 12:24:08 :: net.ipv4.conf.enp0s3.promote_secondaries = 1 12:24:08 :: net.ipv4.conf.enp0s3.proxy_arp = 0 12:24:08 :: net.ipv4.conf.enp0s3.proxy_arp_pvlan = 0 12:24:08 :: net.ipv4.conf.enp0s3.route_localnet = 0 12:24:08 :: net.ipv4.conf.enp0s3.rp_filter = 2 12:24:08 :: net.ipv4.conf.enp0s3.secure_redirects = 1 12:24:08 :: net.ipv4.conf.enp0s3.send_redirects = 1 12:24:08 :: net.ipv4.conf.enp0s3.shared_media = 1 12:24:08 :: net.ipv4.conf.enp0s3.src_valid_mark = 0 12:24:08 :: net.ipv4.conf.enp0s3.tag = 0 12:24:08 :: net.ipv4.conf.lo.accept_local = 0 12:24:08 :: net.ipv4.conf.lo.accept_redirects = 1 12:24:08 :: net.ipv4.conf.lo.accept_source_route = 0 12:24:08 :: net.ipv4.conf.lo.arp_accept = 0 12:24:08 :: net.ipv4.conf.lo.arp_announce = 0 12:24:08 :: net.ipv4.conf.lo.arp_evict_nocarrier = 1 12:24:08 :: net.ipv4.conf.lo.arp_filter = 0 12:24:08 :: net.ipv4.conf.lo.arp_ignore = 0 12:24:08 :: net.ipv4.conf.lo.arp_notify = 0 12:24:08 :: net.ipv4.conf.lo.bc_forwarding = 0 12:24:08 :: net.ipv4.conf.lo.bootp_relay = 0 12:24:08 :: net.ipv4.conf.lo.disable_policy = 1 12:24:08 :: net.ipv4.conf.lo.disable_xfrm = 1 12:24:08 :: net.ipv4.conf.lo.drop_gratuitous_arp = 0 12:24:08 :: net.ipv4.conf.lo.drop_unicast_in_l2_multicast = 0 12:24:08 :: net.ipv4.conf.lo.force_igmp_version = 0 12:24:08 :: net.ipv4.conf.lo.forwarding = 1 12:24:08 :: net.ipv4.conf.lo.igmpv2_unsolicited_report_interval = 10000 12:24:08 :: net.ipv4.conf.lo.igmpv3_unsolicited_report_interval = 1000 12:24:08 :: net.ipv4.conf.lo.ignore_routes_with_linkdown = 0 12:24:08 :: net.ipv4.conf.lo.log_martians = 0 12:24:08 :: net.ipv4.conf.lo.mc_forwarding = 0 12:24:08 :: net.ipv4.conf.lo.medium_id = 0 12:24:08 :: net.ipv4.conf.lo.promote_secondaries = 1 12:24:08 :: net.ipv4.conf.lo.proxy_arp = 0 12:24:08 :: net.ipv4.conf.lo.proxy_arp_pvlan = 0 12:24:08 :: net.ipv4.conf.lo.route_localnet = 0 12:24:08 :: net.ipv4.conf.lo.rp_filter = 2 12:24:08 :: net.ipv4.conf.lo.secure_redirects = 1 12:24:08 :: net.ipv4.conf.lo.send_redirects = 1 12:24:08 :: net.ipv4.conf.lo.shared_media = 1 12:24:08 :: net.ipv4.conf.lo.src_valid_mark = 0 12:24:08 :: net.ipv4.conf.lo.tag = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.accept_local = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.accept_redirects = 1 12:24:08 :: net.ipv4.conf.vethd9a62a1.accept_source_route = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.arp_accept = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.arp_announce = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.arp_evict_nocarrier = 1 12:24:08 :: net.ipv4.conf.vethd9a62a1.arp_filter = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.arp_ignore = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.arp_notify = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.bc_forwarding = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.bootp_relay = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.disable_policy = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.disable_xfrm = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.drop_gratuitous_arp = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.drop_unicast_in_l2_multicast = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.force_igmp_version = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.forwarding = 1 12:24:08 :: net.ipv4.conf.vethd9a62a1.igmpv2_unsolicited_report_interval = 10000 12:24:08 :: net.ipv4.conf.vethd9a62a1.igmpv3_unsolicited_report_interval = 1000 12:24:08 :: net.ipv4.conf.vethd9a62a1.ignore_routes_with_linkdown = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.log_martians = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.mc_forwarding = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.medium_id = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.promote_secondaries = 1 12:24:08 :: net.ipv4.conf.vethd9a62a1.proxy_arp = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.proxy_arp_pvlan = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.route_localnet = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.rp_filter = 2 12:24:08 :: net.ipv4.conf.vethd9a62a1.secure_redirects = 1 12:24:08 :: net.ipv4.conf.vethd9a62a1.send_redirects = 1 12:24:08 :: net.ipv4.conf.vethd9a62a1.shared_media = 1 12:24:08 :: net.ipv4.conf.vethd9a62a1.src_valid_mark = 0 12:24:08 :: net.ipv4.conf.vethd9a62a1.tag = 0 12:24:08 :: net.ipv4.conf.virbr0.accept_local = 0 12:24:08 :: net.ipv4.conf.virbr0.accept_redirects = 1 12:24:08 :: net.ipv4.conf.virbr0.accept_source_route = 0 12:24:08 :: net.ipv4.conf.virbr0.arp_accept = 0 12:24:08 :: net.ipv4.conf.virbr0.arp_announce = 0 12:24:08 :: net.ipv4.conf.virbr0.arp_evict_nocarrier = 1 12:24:08 :: net.ipv4.conf.virbr0.arp_filter = 0 12:24:08 :: net.ipv4.conf.virbr0.arp_ignore = 0 12:24:08 :: net.ipv4.conf.virbr0.arp_notify = 0 12:24:08 :: net.ipv4.conf.virbr0.bc_forwarding = 0 12:24:08 :: net.ipv4.conf.virbr0.bootp_relay = 0 12:24:08 :: net.ipv4.conf.virbr0.disable_policy = 0 12:24:08 :: net.ipv4.conf.virbr0.disable_xfrm = 0 12:24:08 :: net.ipv4.conf.virbr0.drop_gratuitous_arp = 0 12:24:08 :: net.ipv4.conf.virbr0.drop_unicast_in_l2_multicast = 0 12:24:08 :: net.ipv4.conf.virbr0.force_igmp_version = 0 12:24:08 :: net.ipv4.conf.virbr0.forwarding = 1 12:24:08 :: net.ipv4.conf.virbr0.igmpv2_unsolicited_report_interval = 10000 12:24:08 :: net.ipv4.conf.virbr0.igmpv3_unsolicited_report_interval = 1000 12:24:08 :: net.ipv4.conf.virbr0.ignore_routes_with_linkdown = 0 12:24:08 :: net.ipv4.conf.virbr0.log_martians = 0 12:24:08 :: net.ipv4.conf.virbr0.mc_forwarding = 0 12:24:08 :: net.ipv4.conf.virbr0.medium_id = 0 12:24:08 :: net.ipv4.conf.virbr0.promote_secondaries = 1 12:24:08 :: net.ipv4.conf.virbr0.proxy_arp = 0 12:24:08 :: net.ipv4.conf.virbr0.proxy_arp_pvlan = 0 12:24:08 :: net.ipv4.conf.virbr0.route_localnet = 0 12:24:08 :: net.ipv4.conf.virbr0.rp_filter = 2 12:24:08 :: net.ipv4.conf.virbr0.secure_redirects = 1 12:24:08 :: net.ipv4.conf.virbr0.send_redirects = 1 12:24:08 :: net.ipv4.conf.virbr0.shared_media = 1 12:24:08 :: net.ipv4.conf.virbr0.src_valid_mark = 0 12:24:08 :: net.ipv4.conf.virbr0.tag = 0 12:24:08 :: net.ipv4.fib_multipath_hash_fields = 7 12:24:08 :: net.ipv4.fib_multipath_hash_policy = 0 12:24:08 :: net.ipv4.fib_multipath_use_neigh = 0 12:24:08 :: net.ipv4.fib_notify_on_flag_change = 0 12:24:08 :: net.ipv4.fib_sync_mem = 524288 12:24:08 :: net.ipv4.fwmark_reflect = 0 12:24:08 :: net.ipv4.icmp_echo_enable_probe = 0 12:24:08 :: net.ipv4.icmp_echo_ignore_all = 0 12:24:08 :: net.ipv4.icmp_echo_ignore_broadcasts = 1 12:24:08 :: net.ipv4.icmp_errors_use_inbound_ifaddr = 0 12:24:08 :: net.ipv4.icmp_ignore_bogus_error_responses = 1 12:24:08 :: net.ipv4.icmp_msgs_burst = 50 12:24:08 :: net.ipv4.icmp_msgs_per_sec = 1000 12:24:08 :: net.ipv4.icmp_ratelimit = 1000 12:24:08 :: net.ipv4.icmp_ratemask = 6168 12:24:08 :: net.ipv4.igmp_link_local_mcast_reports = 1 12:24:08 :: net.ipv4.igmp_max_memberships = 20 12:24:08 :: net.ipv4.igmp_max_msf = 10 12:24:08 :: net.ipv4.igmp_qrv = 2 12:24:08 :: net.ipv4.inet_peer_maxttl = 600 12:24:08 :: net.ipv4.inet_peer_minttl = 120 12:24:08 :: net.ipv4.inet_peer_threshold = 65664 12:24:08 :: net.ipv4.ip_autobind_reuse = 0 12:24:08 :: net.ipv4.ip_default_ttl = 64 12:24:08 :: net.ipv4.ip_dynaddr = 0 12:24:08 :: net.ipv4.ip_early_demux = 1 12:24:08 :: net.ipv4.ip_forward = 1 12:24:08 :: net.ipv4.ip_forward_update_priority = 1 12:24:08 :: net.ipv4.ip_forward_use_pmtu = 0 12:24:08 :: net.ipv4.ip_local_port_range = 32768 60999 12:24:08 :: net.ipv4.ip_local_reserved_ports = 12:24:08 :: net.ipv4.ip_no_pmtu_disc = 0 12:24:08 :: net.ipv4.ip_nonlocal_bind = 0 12:24:08 :: net.ipv4.ip_unprivileged_port_start = 1024 12:24:08 :: net.ipv4.ipfrag_high_thresh = 4194304 12:24:08 :: net.ipv4.ipfrag_low_thresh = 3145728 12:24:08 :: net.ipv4.ipfrag_max_dist = 64 12:24:08 :: net.ipv4.ipfrag_secret_interval = 0 12:24:08 :: net.ipv4.ipfrag_time = 30 12:24:08 :: net.ipv4.neigh.default.anycast_delay = 100 12:24:08 :: net.ipv4.neigh.default.app_solicit = 0 12:24:08 :: net.ipv4.neigh.default.base_reachable_time_ms = 30000 12:24:08 :: net.ipv4.neigh.default.delay_first_probe_time = 5 12:24:08 :: net.ipv4.neigh.default.gc_interval = 30 12:24:08 :: net.ipv4.neigh.default.gc_stale_time = 60 12:24:08 :: net.ipv4.neigh.default.gc_thresh1 = 128 12:24:08 :: net.ipv4.neigh.default.gc_thresh2 = 512 12:24:08 :: net.ipv4.neigh.default.gc_thresh3 = 1024 12:24:08 :: net.ipv4.neigh.default.interval_probe_time_ms = 5000 12:24:08 :: net.ipv4.neigh.default.locktime = 100 12:24:08 :: net.ipv4.neigh.default.mcast_resolicit = 0 12:24:08 :: net.ipv4.neigh.default.mcast_solicit = 3 12:24:08 :: net.ipv4.neigh.default.proxy_delay = 80 12:24:08 :: net.ipv4.neigh.default.proxy_qlen = 64 12:24:08 :: net.ipv4.neigh.default.retrans_time_ms = 1000 12:24:08 :: net.ipv4.neigh.default.ucast_solicit = 3 12:24:08 :: net.ipv4.neigh.default.unres_qlen = 101 12:24:08 :: net.ipv4.neigh.default.unres_qlen_bytes = 212992 12:24:08 :: net.ipv4.neigh.docker0.anycast_delay = 100 12:24:08 :: net.ipv4.neigh.docker0.app_solicit = 0 12:24:08 :: net.ipv4.neigh.docker0.base_reachable_time_ms = 30000 12:24:08 :: net.ipv4.neigh.docker0.delay_first_probe_time = 5 12:24:08 :: net.ipv4.neigh.docker0.gc_stale_time = 60 12:24:08 :: net.ipv4.neigh.docker0.interval_probe_time_ms = 5000 12:24:08 :: net.ipv4.neigh.docker0.locktime = 100 12:24:08 :: net.ipv4.neigh.docker0.mcast_resolicit = 0 12:24:08 :: net.ipv4.neigh.docker0.mcast_solicit = 3 12:24:08 :: net.ipv4.neigh.docker0.proxy_delay = 80 12:24:08 :: net.ipv4.neigh.docker0.proxy_qlen = 64 12:24:08 :: net.ipv4.neigh.docker0.retrans_time_ms = 1000 12:24:08 :: net.ipv4.neigh.docker0.ucast_solicit = 3 12:24:08 :: net.ipv4.neigh.docker0.unres_qlen = 101 12:24:08 :: net.ipv4.neigh.docker0.unres_qlen_bytes = 212992 12:24:08 :: net.ipv4.neigh.enp0s3.anycast_delay = 100 12:24:08 :: net.ipv4.neigh.enp0s3.app_solicit = 0 12:24:08 :: net.ipv4.neigh.enp0s3.base_reachable_time_ms = 30000 12:24:08 :: net.ipv4.neigh.enp0s3.delay_first_probe_time = 5 12:24:08 :: net.ipv4.neigh.enp0s3.gc_stale_time = 60 12:24:08 :: net.ipv4.neigh.enp0s3.interval_probe_time_ms = 5000 12:24:08 :: net.ipv4.neigh.enp0s3.locktime = 100 12:24:08 :: net.ipv4.neigh.enp0s3.mcast_resolicit = 0 12:24:08 :: net.ipv4.neigh.enp0s3.mcast_solicit = 3 12:24:08 :: net.ipv4.neigh.enp0s3.proxy_delay = 80 12:24:08 :: net.ipv4.neigh.enp0s3.proxy_qlen = 64 12:24:08 :: net.ipv4.neigh.enp0s3.retrans_time_ms = 1000 12:24:08 :: net.ipv4.neigh.enp0s3.ucast_solicit = 3 12:24:08 :: net.ipv4.neigh.enp0s3.unres_qlen = 101 12:24:08 :: net.ipv4.neigh.enp0s3.unres_qlen_bytes = 212992 12:24:08 :: net.ipv4.neigh.lo.anycast_delay = 100 12:24:08 :: net.ipv4.neigh.lo.app_solicit = 0 12:24:08 :: net.ipv4.neigh.lo.base_reachable_time_ms = 30000 12:24:08 :: net.ipv4.neigh.lo.delay_first_probe_time = 5 12:24:08 :: net.ipv4.neigh.lo.gc_stale_time = 60 12:24:08 :: net.ipv4.neigh.lo.interval_probe_time_ms = 5000 12:24:08 :: net.ipv4.neigh.lo.locktime = 100 12:24:08 :: net.ipv4.neigh.lo.mcast_resolicit = 0 12:24:08 :: net.ipv4.neigh.lo.mcast_solicit = 3 12:24:08 :: net.ipv4.neigh.lo.proxy_delay = 80 12:24:08 :: net.ipv4.neigh.lo.proxy_qlen = 64 12:24:08 :: net.ipv4.neigh.lo.retrans_time_ms = 1000 12:24:08 :: net.ipv4.neigh.lo.ucast_solicit = 3 12:24:08 :: net.ipv4.neigh.lo.unres_qlen = 101 12:24:08 :: net.ipv4.neigh.lo.unres_qlen_bytes = 212992 12:24:08 :: net.ipv4.neigh.vethd9a62a1.anycast_delay = 100 12:24:08 :: net.ipv4.neigh.vethd9a62a1.app_solicit = 0 12:24:08 :: net.ipv4.neigh.vethd9a62a1.base_reachable_time_ms = 30000 12:24:08 :: net.ipv4.neigh.vethd9a62a1.delay_first_probe_time = 5 12:24:08 :: net.ipv4.neigh.vethd9a62a1.gc_stale_time = 60 12:24:08 :: net.ipv4.neigh.vethd9a62a1.interval_probe_time_ms = 5000 12:24:08 :: net.ipv4.neigh.vethd9a62a1.locktime = 100 12:24:08 :: net.ipv4.neigh.vethd9a62a1.mcast_resolicit = 0 12:24:08 :: net.ipv4.neigh.vethd9a62a1.mcast_solicit = 3 12:24:08 :: net.ipv4.neigh.vethd9a62a1.proxy_delay = 80 12:24:08 :: net.ipv4.neigh.vethd9a62a1.proxy_qlen = 64 12:24:08 :: net.ipv4.neigh.vethd9a62a1.retrans_time_ms = 1000 12:24:08 :: net.ipv4.neigh.vethd9a62a1.ucast_solicit = 3 12:24:08 :: net.ipv4.neigh.vethd9a62a1.unres_qlen = 101 12:24:08 :: net.ipv4.neigh.vethd9a62a1.unres_qlen_bytes = 212992 12:24:08 :: net.ipv4.neigh.virbr0.anycast_delay = 100 12:24:08 :: net.ipv4.neigh.virbr0.app_solicit = 0 12:24:08 :: net.ipv4.neigh.virbr0.base_reachable_time_ms = 30000 12:24:08 :: net.ipv4.neigh.virbr0.delay_first_probe_time = 5 12:24:08 :: net.ipv4.neigh.virbr0.gc_stale_time = 60 12:24:08 :: net.ipv4.neigh.virbr0.interval_probe_time_ms = 5000 12:24:08 :: net.ipv4.neigh.virbr0.locktime = 100 12:24:08 :: net.ipv4.neigh.virbr0.mcast_resolicit = 0 12:24:08 :: net.ipv4.neigh.virbr0.mcast_solicit = 3 12:24:08 :: net.ipv4.neigh.virbr0.proxy_delay = 80 12:24:08 :: net.ipv4.neigh.virbr0.proxy_qlen = 64 12:24:08 :: net.ipv4.neigh.virbr0.retrans_time_ms = 1000 12:24:08 :: net.ipv4.neigh.virbr0.ucast_solicit = 3 12:24:08 :: net.ipv4.neigh.virbr0.unres_qlen = 101 12:24:08 :: net.ipv4.neigh.virbr0.unres_qlen_bytes = 212992 12:24:08 :: net.ipv4.nexthop_compat_mode = 1 12:24:08 :: net.ipv4.ping_group_range = 0 2147483647 12:24:08 :: net.ipv4.raw_l3mdev_accept = 1 12:24:08 :: net.ipv4.route.error_burst = 5000 12:24:08 :: net.ipv4.route.error_cost = 1000 12:24:08 :: net.ipv4.route.gc_elasticity = 8 12:24:08 :: net.ipv4.route.gc_interval = 60 12:24:08 :: net.ipv4.route.gc_min_interval = 0 12:24:08 :: net.ipv4.route.gc_min_interval_ms = 500 12:24:08 :: net.ipv4.route.gc_thresh = -1 12:24:08 :: net.ipv4.route.gc_timeout = 300 12:24:08 :: net.ipv4.route.max_size = 2147483647 12:24:08 :: net.ipv4.route.min_adv_mss = 256 12:24:08 :: net.ipv4.route.min_pmtu = 552 12:24:08 :: net.ipv4.route.mtu_expires = 600 12:24:08 :: net.ipv4.route.redirect_load = 20 12:24:08 :: net.ipv4.route.redirect_number = 9 12:24:08 :: net.ipv4.route.redirect_silence = 20480 12:24:08 :: net.ipv4.tcp_abort_on_overflow = 0 12:24:08 :: net.ipv4.tcp_adv_win_scale = 1 12:24:08 :: net.ipv4.tcp_allowed_congestion_control = reno cubic 12:24:08 :: net.ipv4.tcp_app_win = 31 12:24:08 :: net.ipv4.tcp_autocorking = 1 12:24:08 :: net.ipv4.tcp_available_congestion_control = reno cubic 12:24:08 :: net.ipv4.tcp_available_ulp = espintcp mptcp tls 12:24:08 :: net.ipv4.tcp_backlog_ack_defer = 1 12:24:08 :: net.ipv4.tcp_base_mss = 1024 12:24:08 :: net.ipv4.tcp_challenge_ack_limit = 2147483647 12:24:08 :: net.ipv4.tcp_child_ehash_entries = 0 12:24:08 :: net.ipv4.tcp_comp_sack_delay_ns = 1000000 12:24:08 :: net.ipv4.tcp_comp_sack_nr = 44 12:24:08 :: net.ipv4.tcp_comp_sack_slack_ns = 100000 12:24:08 :: net.ipv4.tcp_congestion_control = cubic 12:24:08 :: net.ipv4.tcp_dsack = 1 12:24:08 :: net.ipv4.tcp_early_demux = 1 12:24:08 :: net.ipv4.tcp_early_retrans = 3 12:24:08 :: net.ipv4.tcp_ecn = 2 12:24:08 :: net.ipv4.tcp_ecn_fallback = 1 12:24:08 :: net.ipv4.tcp_ehash_entries = 262144 12:24:08 :: net.ipv4.tcp_fack = 0 12:24:08 :: net.ipv4.tcp_fastopen = 1 12:24:08 :: net.ipv4.tcp_fastopen_blackhole_timeout_sec = 0 12:24:08 :: net.ipv4.tcp_fastopen_key = 18c50a1b-669e94a6-55bcd76f-11216f14 12:24:08 :: net.ipv4.tcp_fin_timeout = 60 12:24:08 :: net.ipv4.tcp_frto = 2 12:24:08 :: net.ipv4.tcp_fwmark_accept = 0 12:24:08 :: net.ipv4.tcp_invalid_ratelimit = 500 12:24:08 :: net.ipv4.tcp_keepalive_intvl = 75 12:24:08 :: net.ipv4.tcp_keepalive_probes = 9 12:24:08 :: net.ipv4.tcp_keepalive_time = 7200 12:24:08 :: net.ipv4.tcp_l3mdev_accept = 0 12:24:08 :: net.ipv4.tcp_limit_output_bytes = 1048576 12:24:08 :: net.ipv4.tcp_low_latency = 0 12:24:08 :: net.ipv4.tcp_max_orphans = 131072 12:24:08 :: net.ipv4.tcp_max_reordering = 300 12:24:08 :: net.ipv4.tcp_max_syn_backlog = 2048 12:24:08 :: net.ipv4.tcp_max_tw_buckets = 131072 12:24:08 :: net.ipv4.tcp_mem = 286143 381525 572286 12:24:08 :: net.ipv4.tcp_migrate_req = 0 12:24:08 :: net.ipv4.tcp_min_rtt_wlen = 300 12:24:08 :: net.ipv4.tcp_min_snd_mss = 48 12:24:08 :: net.ipv4.tcp_min_tso_segs = 2 12:24:08 :: net.ipv4.tcp_moderate_rcvbuf = 1 12:24:08 :: net.ipv4.tcp_mtu_probe_floor = 48 12:24:08 :: net.ipv4.tcp_mtu_probing = 0 12:24:08 :: net.ipv4.tcp_no_metrics_save = 0 12:24:08 :: net.ipv4.tcp_no_ssthresh_metrics_save = 1 12:24:08 :: net.ipv4.tcp_notsent_lowat = 4294967295 12:24:08 :: net.ipv4.tcp_orphan_retries = 0 12:24:08 :: net.ipv4.tcp_pacing_ca_ratio = 120 12:24:08 :: net.ipv4.tcp_pacing_ss_ratio = 200 12:24:08 :: net.ipv4.tcp_pingpong_thresh = 1 12:24:08 :: net.ipv4.tcp_plb_cong_thresh = 128 12:24:08 :: net.ipv4.tcp_plb_enabled = 0 12:24:08 :: net.ipv4.tcp_plb_idle_rehash_rounds = 3 12:24:08 :: net.ipv4.tcp_plb_rehash_rounds = 12 12:24:08 :: net.ipv4.tcp_plb_suspend_rto_sec = 60 12:24:08 :: net.ipv4.tcp_probe_interval = 600 12:24:08 :: net.ipv4.tcp_probe_threshold = 8 12:24:08 :: net.ipv4.tcp_recovery = 1 12:24:08 :: net.ipv4.tcp_reflect_tos = 0 12:24:08 :: net.ipv4.tcp_reordering = 3 12:24:08 :: net.ipv4.tcp_retrans_collapse = 1 12:24:08 :: net.ipv4.tcp_retries1 = 3 12:24:08 :: net.ipv4.tcp_retries2 = 15 12:24:08 :: net.ipv4.tcp_rfc1337 = 0 12:24:08 :: net.ipv4.tcp_rmem = 4096 131072 6291456 12:24:08 :: net.ipv4.tcp_sack = 1 12:24:08 :: net.ipv4.tcp_shrink_window = 0 12:24:08 :: net.ipv4.tcp_slow_start_after_idle = 1 12:24:08 :: net.ipv4.tcp_stdurg = 0 12:24:08 :: net.ipv4.tcp_syn_linear_timeouts = 4 12:24:08 :: net.ipv4.tcp_syn_retries = 6 12:24:08 :: net.ipv4.tcp_synack_retries = 5 12:24:08 :: net.ipv4.tcp_syncookies = 1 12:24:08 :: net.ipv4.tcp_thin_linear_timeouts = 0 12:24:08 :: net.ipv4.tcp_timestamps = 1 12:24:08 :: net.ipv4.tcp_tso_rtt_log = 9 12:24:08 :: net.ipv4.tcp_tso_win_divisor = 3 12:24:08 :: net.ipv4.tcp_tw_reuse = 2 12:24:08 :: net.ipv4.tcp_window_scaling = 1 12:24:08 :: net.ipv4.tcp_wmem = 4096 16384 4194304 12:24:08 :: net.ipv4.tcp_workaround_signed_windows = 0 12:24:08 :: net.ipv4.udp_child_hash_entries = 0 12:24:08 :: net.ipv4.udp_early_demux = 1 12:24:08 :: net.ipv4.udp_hash_entries = 16384 12:24:08 :: net.ipv4.udp_l3mdev_accept = 0 12:24:08 :: net.ipv4.udp_mem = 572286 763050 1144572 12:24:08 :: net.ipv4.udp_rmem_min = 4096 12:24:08 :: net.ipv4.udp_wmem_min = 4096 12:24:08 :: net.ipv4.xfrm4_gc_thresh = 32768 12:24:08 :: net.ipv6.anycast_src_echo_reply = 0 12:24:08 :: net.ipv6.auto_flowlabels = 1 12:24:08 :: net.ipv6.bindv6only = 0 12:24:08 :: net.ipv6.calipso_cache_bucket_size = 10 12:24:08 :: net.ipv6.calipso_cache_enable = 1 12:24:08 :: net.ipv6.conf.all.accept_dad = 0 12:24:08 :: net.ipv6.conf.all.accept_ra = 1 12:24:08 :: net.ipv6.conf.all.accept_ra_defrtr = 1 12:24:08 :: net.ipv6.conf.all.accept_ra_from_local = 0 12:24:08 :: net.ipv6.conf.all.accept_ra_min_hop_limit = 1 12:24:08 :: net.ipv6.conf.all.accept_ra_min_lft = 0 12:24:08 :: net.ipv6.conf.all.accept_ra_mtu = 1 12:24:08 :: net.ipv6.conf.all.accept_ra_pinfo = 1 12:24:08 :: net.ipv6.conf.all.accept_ra_rt_info_max_plen = 0 12:24:08 :: net.ipv6.conf.all.accept_ra_rt_info_min_plen = 0 12:24:08 :: net.ipv6.conf.all.accept_ra_rtr_pref = 1 12:24:08 :: net.ipv6.conf.all.accept_redirects = 1 12:24:08 :: net.ipv6.conf.all.accept_source_route = 0 12:24:08 :: net.ipv6.conf.all.accept_untracked_na = 0 12:24:08 :: net.ipv6.conf.all.addr_gen_mode = 0 12:24:08 :: net.ipv6.conf.all.autoconf = 1 12:24:08 :: net.ipv6.conf.all.dad_transmits = 1 12:24:08 :: net.ipv6.conf.all.disable_ipv6 = 0 12:24:08 :: net.ipv6.conf.all.disable_policy = 0 12:24:08 :: net.ipv6.conf.all.drop_unicast_in_l2_multicast = 0 12:24:08 :: net.ipv6.conf.all.drop_unsolicited_na = 0 12:24:08 :: net.ipv6.conf.all.enhanced_dad = 1 12:24:08 :: net.ipv6.conf.all.force_mld_version = 0 12:24:08 :: net.ipv6.conf.all.force_tllao = 0 12:24:08 :: net.ipv6.conf.all.forwarding = 0 12:24:08 :: net.ipv6.conf.all.hop_limit = 64 12:24:08 :: net.ipv6.conf.all.ignore_routes_with_linkdown = 0 12:24:08 :: net.ipv6.conf.all.ioam6_enabled = 0 12:24:08 :: net.ipv6.conf.all.ioam6_id = 65535 12:24:08 :: net.ipv6.conf.all.ioam6_id_wide = 4294967295 12:24:08 :: net.ipv6.conf.all.keep_addr_on_down = 0 12:24:08 :: net.ipv6.conf.all.max_addresses = 16 12:24:08 :: net.ipv6.conf.all.max_desync_factor = 600 12:24:08 :: net.ipv6.conf.all.mc_forwarding = 0 12:24:08 :: net.ipv6.conf.all.mldv1_unsolicited_report_interval = 10000 12:24:08 :: net.ipv6.conf.all.mldv2_unsolicited_report_interval = 1000 12:24:08 :: net.ipv6.conf.all.mtu = 1280 12:24:08 :: net.ipv6.conf.all.ndisc_evict_nocarrier = 1 12:24:08 :: net.ipv6.conf.all.ndisc_notify = 0 12:24:08 :: net.ipv6.conf.all.ndisc_tclass = 0 12:24:08 :: net.ipv6.conf.all.proxy_ndp = 0 12:24:08 :: net.ipv6.conf.all.ra_defrtr_metric = 1024 12:24:08 :: net.ipv6.conf.all.ra_honor_pio_life = 0 12:24:08 :: net.ipv6.conf.all.regen_max_retry = 3 12:24:08 :: net.ipv6.conf.all.router_probe_interval = 60 12:24:08 :: net.ipv6.conf.all.router_solicitation_delay = 1 12:24:08 :: net.ipv6.conf.all.router_solicitation_interval = 4 12:24:08 :: net.ipv6.conf.all.router_solicitation_max_interval = 3600 12:24:08 :: net.ipv6.conf.all.router_solicitations = -1 12:24:08 :: net.ipv6.conf.all.rpl_seg_enabled = 0 12:24:08 :: net.ipv6.conf.all.seg6_enabled = 0 12:24:08 :: net.ipv6.conf.all.seg6_require_hmac = 0 12:24:08 :: net.ipv6.conf.all.suppress_frag_ndisc = 1 12:24:08 :: net.ipv6.conf.all.temp_prefered_lft = 86400 12:24:08 :: net.ipv6.conf.all.temp_valid_lft = 604800 12:24:08 :: net.ipv6.conf.all.use_oif_addrs_only = 0 12:24:08 :: net.ipv6.conf.all.use_tempaddr = 0 12:24:08 :: net.ipv6.conf.default.accept_dad = 1 12:24:08 :: net.ipv6.conf.default.accept_ra = 1 12:24:08 :: net.ipv6.conf.default.accept_ra_defrtr = 1 12:24:08 :: net.ipv6.conf.default.accept_ra_from_local = 0 12:24:08 :: net.ipv6.conf.default.accept_ra_min_hop_limit = 1 12:24:08 :: net.ipv6.conf.default.accept_ra_min_lft = 0 12:24:08 :: net.ipv6.conf.default.accept_ra_mtu = 1 12:24:08 :: net.ipv6.conf.default.accept_ra_pinfo = 1 12:24:08 :: net.ipv6.conf.default.accept_ra_rt_info_max_plen = 0 12:24:08 :: net.ipv6.conf.default.accept_ra_rt_info_min_plen = 0 12:24:08 :: net.ipv6.conf.default.accept_ra_rtr_pref = 1 12:24:08 :: net.ipv6.conf.default.accept_redirects = 1 12:24:08 :: net.ipv6.conf.default.accept_source_route = 0 12:24:08 :: net.ipv6.conf.default.accept_untracked_na = 0 12:24:08 :: net.ipv6.conf.default.addr_gen_mode = 0 12:24:08 :: net.ipv6.conf.default.autoconf = 1 12:24:08 :: net.ipv6.conf.default.dad_transmits = 1 12:24:08 :: net.ipv6.conf.default.disable_ipv6 = 0 12:24:08 :: net.ipv6.conf.default.disable_policy = 0 12:24:08 :: net.ipv6.conf.default.drop_unicast_in_l2_multicast = 0 12:24:08 :: net.ipv6.conf.default.drop_unsolicited_na = 0 12:24:08 :: net.ipv6.conf.default.enhanced_dad = 1 12:24:08 :: net.ipv6.conf.default.force_mld_version = 0 12:24:08 :: net.ipv6.conf.default.force_tllao = 0 12:24:08 :: net.ipv6.conf.default.forwarding = 0 12:24:08 :: net.ipv6.conf.default.hop_limit = 64 12:24:08 :: net.ipv6.conf.default.ignore_routes_with_linkdown = 0 12:24:08 :: net.ipv6.conf.default.ioam6_enabled = 0 12:24:08 :: net.ipv6.conf.default.ioam6_id = 65535 12:24:08 :: net.ipv6.conf.default.ioam6_id_wide = 4294967295 12:24:08 :: net.ipv6.conf.default.keep_addr_on_down = 0 12:24:08 :: net.ipv6.conf.default.max_addresses = 16 12:24:08 :: net.ipv6.conf.default.max_desync_factor = 600 12:24:08 :: net.ipv6.conf.default.mc_forwarding = 0 12:24:08 :: net.ipv6.conf.default.mldv1_unsolicited_report_interval = 10000 12:24:08 :: net.ipv6.conf.default.mldv2_unsolicited_report_interval = 1000 12:24:08 :: net.ipv6.conf.default.mtu = 1280 12:24:08 :: net.ipv6.conf.default.ndisc_evict_nocarrier = 1 12:24:08 :: net.ipv6.conf.default.ndisc_notify = 0 12:24:08 :: net.ipv6.conf.default.ndisc_tclass = 0 12:24:08 :: net.ipv6.conf.default.proxy_ndp = 0 12:24:08 :: net.ipv6.conf.default.ra_defrtr_metric = 1024 12:24:08 :: net.ipv6.conf.default.ra_honor_pio_life = 0 12:24:08 :: net.ipv6.conf.default.regen_max_retry = 3 12:24:08 :: net.ipv6.conf.default.router_probe_interval = 60 12:24:08 :: net.ipv6.conf.default.router_solicitation_delay = 1 12:24:08 :: net.ipv6.conf.default.router_solicitation_interval = 4 12:24:08 :: net.ipv6.conf.default.router_solicitation_max_interval = 3600 12:24:08 :: net.ipv6.conf.default.router_solicitations = -1 12:24:08 :: net.ipv6.conf.default.rpl_seg_enabled = 0 12:24:08 :: net.ipv6.conf.default.seg6_enabled = 0 12:24:08 :: net.ipv6.conf.default.seg6_require_hmac = 0 12:24:08 :: net.ipv6.conf.default.suppress_frag_ndisc = 1 12:24:08 :: net.ipv6.conf.default.temp_prefered_lft = 86400 12:24:08 :: net.ipv6.conf.default.temp_valid_lft = 604800 12:24:08 :: net.ipv6.conf.default.use_oif_addrs_only = 0 12:24:08 :: net.ipv6.conf.default.use_tempaddr = 0 12:24:08 :: net.ipv6.conf.docker0.accept_dad = 1 12:24:08 :: net.ipv6.conf.docker0.accept_ra = 0 12:24:08 :: net.ipv6.conf.docker0.accept_ra_defrtr = 1 12:24:08 :: net.ipv6.conf.docker0.accept_ra_from_local = 0 12:24:08 :: net.ipv6.conf.docker0.accept_ra_min_hop_limit = 1 12:24:08 :: net.ipv6.conf.docker0.accept_ra_min_lft = 0 12:24:08 :: net.ipv6.conf.docker0.accept_ra_mtu = 1 12:24:08 :: net.ipv6.conf.docker0.accept_ra_pinfo = 1 12:24:08 :: net.ipv6.conf.docker0.accept_ra_rt_info_max_plen = 0 12:24:08 :: net.ipv6.conf.docker0.accept_ra_rt_info_min_plen = 0 12:24:08 :: net.ipv6.conf.docker0.accept_ra_rtr_pref = 1 12:24:08 :: net.ipv6.conf.docker0.accept_redirects = 1 12:24:08 :: net.ipv6.conf.docker0.accept_source_route = 0 12:24:08 :: net.ipv6.conf.docker0.accept_untracked_na = 0 12:24:08 :: net.ipv6.conf.docker0.addr_gen_mode = 0 12:24:08 :: net.ipv6.conf.docker0.autoconf = 1 12:24:08 :: net.ipv6.conf.docker0.dad_transmits = 1 12:24:08 :: net.ipv6.conf.docker0.disable_ipv6 = 0 12:24:08 :: net.ipv6.conf.docker0.disable_policy = 0 12:24:08 :: net.ipv6.conf.docker0.drop_unicast_in_l2_multicast = 0 12:24:08 :: net.ipv6.conf.docker0.drop_unsolicited_na = 0 12:24:08 :: net.ipv6.conf.docker0.enhanced_dad = 1 12:24:08 :: net.ipv6.conf.docker0.force_mld_version = 0 12:24:08 :: net.ipv6.conf.docker0.force_tllao = 0 12:24:08 :: net.ipv6.conf.docker0.forwarding = 0 12:24:08 :: net.ipv6.conf.docker0.hop_limit = 64 12:24:08 :: net.ipv6.conf.docker0.ignore_routes_with_linkdown = 0 12:24:08 :: net.ipv6.conf.docker0.ioam6_enabled = 0 12:24:08 :: net.ipv6.conf.docker0.ioam6_id = 65535 12:24:08 :: net.ipv6.conf.docker0.ioam6_id_wide = 4294967295 12:24:08 :: net.ipv6.conf.docker0.keep_addr_on_down = 0 12:24:08 :: net.ipv6.conf.docker0.max_addresses = 16 12:24:08 :: net.ipv6.conf.docker0.max_desync_factor = 600 12:24:08 :: net.ipv6.conf.docker0.mc_forwarding = 0 12:24:08 :: net.ipv6.conf.docker0.mldv1_unsolicited_report_interval = 10000 12:24:08 :: net.ipv6.conf.docker0.mldv2_unsolicited_report_interval = 1000 12:24:08 :: net.ipv6.conf.docker0.mtu = 1500 12:24:08 :: net.ipv6.conf.docker0.ndisc_evict_nocarrier = 1 12:24:08 :: net.ipv6.conf.docker0.ndisc_notify = 0 12:24:08 :: net.ipv6.conf.docker0.ndisc_tclass = 0 12:24:08 :: net.ipv6.conf.docker0.proxy_ndp = 0 12:24:08 :: net.ipv6.conf.docker0.ra_defrtr_metric = 1024 12:24:08 :: net.ipv6.conf.docker0.ra_honor_pio_life = 0 12:24:08 :: net.ipv6.conf.docker0.regen_max_retry = 3 12:24:08 :: net.ipv6.conf.docker0.router_probe_interval = 60 12:24:08 :: net.ipv6.conf.docker0.router_solicitation_delay = 1 12:24:08 :: net.ipv6.conf.docker0.router_solicitation_interval = 4 12:24:08 :: net.ipv6.conf.docker0.router_solicitation_max_interval = 3600 12:24:08 :: net.ipv6.conf.docker0.router_solicitations = -1 12:24:08 :: net.ipv6.conf.docker0.rpl_seg_enabled = 0 12:24:08 :: net.ipv6.conf.docker0.seg6_enabled = 0 12:24:08 :: net.ipv6.conf.docker0.seg6_require_hmac = 0 12:24:08 :: net.ipv6.conf.docker0.suppress_frag_ndisc = 1 12:24:08 :: net.ipv6.conf.docker0.temp_prefered_lft = 86400 12:24:08 :: net.ipv6.conf.docker0.temp_valid_lft = 604800 12:24:08 :: net.ipv6.conf.docker0.use_oif_addrs_only = 0 12:24:08 :: net.ipv6.conf.docker0.use_tempaddr = 0 12:24:08 :: net.ipv6.conf.enp0s3.accept_dad = 1 12:24:08 :: net.ipv6.conf.enp0s3.accept_ra = 0 12:24:08 :: net.ipv6.conf.enp0s3.accept_ra_defrtr = 1 12:24:08 :: net.ipv6.conf.enp0s3.accept_ra_from_local = 0 12:24:08 :: net.ipv6.conf.enp0s3.accept_ra_min_hop_limit = 1 12:24:08 :: net.ipv6.conf.enp0s3.accept_ra_min_lft = 0 12:24:08 :: net.ipv6.conf.enp0s3.accept_ra_mtu = 1 12:24:08 :: net.ipv6.conf.enp0s3.accept_ra_pinfo = 1 12:24:08 :: net.ipv6.conf.enp0s3.accept_ra_rt_info_max_plen = 0 12:24:08 :: net.ipv6.conf.enp0s3.accept_ra_rt_info_min_plen = 0 12:24:08 :: net.ipv6.conf.enp0s3.accept_ra_rtr_pref = 1 12:24:08 :: net.ipv6.conf.enp0s3.accept_redirects = 1 12:24:08 :: net.ipv6.conf.enp0s3.accept_source_route = 0 12:24:08 :: net.ipv6.conf.enp0s3.accept_untracked_na = 0 12:24:08 :: net.ipv6.conf.enp0s3.addr_gen_mode = 0 12:24:08 :: net.ipv6.conf.enp0s3.autoconf = 1 12:24:08 :: net.ipv6.conf.enp0s3.dad_transmits = 1 12:24:08 :: net.ipv6.conf.enp0s3.disable_ipv6 = 0 12:24:08 :: net.ipv6.conf.enp0s3.disable_policy = 0 12:24:08 :: net.ipv6.conf.enp0s3.drop_unicast_in_l2_multicast = 0 12:24:08 :: net.ipv6.conf.enp0s3.drop_unsolicited_na = 0 12:24:08 :: net.ipv6.conf.enp0s3.enhanced_dad = 1 12:24:08 :: net.ipv6.conf.enp0s3.force_mld_version = 0 12:24:08 :: net.ipv6.conf.enp0s3.force_tllao = 0 12:24:08 :: net.ipv6.conf.enp0s3.forwarding = 0 12:24:08 :: net.ipv6.conf.enp0s3.hop_limit = 64 12:24:08 :: net.ipv6.conf.enp0s3.ignore_routes_with_linkdown = 0 12:24:08 :: net.ipv6.conf.enp0s3.ioam6_enabled = 0 12:24:08 :: net.ipv6.conf.enp0s3.ioam6_id = 65535 12:24:08 :: net.ipv6.conf.enp0s3.ioam6_id_wide = 4294967295 12:24:08 :: net.ipv6.conf.enp0s3.keep_addr_on_down = 0 12:24:08 :: net.ipv6.conf.enp0s3.max_addresses = 16 12:24:08 :: net.ipv6.conf.enp0s3.max_desync_factor = 600 12:24:08 :: net.ipv6.conf.enp0s3.mc_forwarding = 0 12:24:08 :: net.ipv6.conf.enp0s3.mldv1_unsolicited_report_interval = 10000 12:24:08 :: net.ipv6.conf.enp0s3.mldv2_unsolicited_report_interval = 1000 12:24:08 :: net.ipv6.conf.enp0s3.mtu = 9000 12:24:08 :: net.ipv6.conf.enp0s3.ndisc_evict_nocarrier = 1 12:24:08 :: net.ipv6.conf.enp0s3.ndisc_notify = 0 12:24:08 :: net.ipv6.conf.enp0s3.ndisc_tclass = 0 12:24:08 :: net.ipv6.conf.enp0s3.proxy_ndp = 0 12:24:08 :: net.ipv6.conf.enp0s3.ra_defrtr_metric = 1024 12:24:08 :: net.ipv6.conf.enp0s3.ra_honor_pio_life = 0 12:24:08 :: net.ipv6.conf.enp0s3.regen_max_retry = 3 12:24:08 :: net.ipv6.conf.enp0s3.router_probe_interval = 60 12:24:08 :: net.ipv6.conf.enp0s3.router_solicitation_delay = 1 12:24:08 :: net.ipv6.conf.enp0s3.router_solicitation_interval = 4 12:24:08 :: net.ipv6.conf.enp0s3.router_solicitation_max_interval = 3600 12:24:08 :: net.ipv6.conf.enp0s3.router_solicitations = -1 12:24:08 :: net.ipv6.conf.enp0s3.rpl_seg_enabled = 0 12:24:08 :: net.ipv6.conf.enp0s3.seg6_enabled = 0 12:24:08 :: net.ipv6.conf.enp0s3.seg6_require_hmac = 0 12:24:08 :: net.ipv6.conf.enp0s3.suppress_frag_ndisc = 1 12:24:08 :: net.ipv6.conf.enp0s3.temp_prefered_lft = 86400 12:24:08 :: net.ipv6.conf.enp0s3.temp_valid_lft = 604800 12:24:08 :: net.ipv6.conf.enp0s3.use_oif_addrs_only = 0 12:24:08 :: net.ipv6.conf.enp0s3.use_tempaddr = 0 12:24:08 :: net.ipv6.conf.lo.accept_dad = -1 12:24:08 :: net.ipv6.conf.lo.accept_ra = 1 12:24:08 :: net.ipv6.conf.lo.accept_ra_defrtr = 1 12:24:08 :: net.ipv6.conf.lo.accept_ra_from_local = 0 12:24:08 :: net.ipv6.conf.lo.accept_ra_min_hop_limit = 1 12:24:08 :: net.ipv6.conf.lo.accept_ra_min_lft = 0 12:24:08 :: net.ipv6.conf.lo.accept_ra_mtu = 1 12:24:08 :: net.ipv6.conf.lo.accept_ra_pinfo = 1 12:24:08 :: net.ipv6.conf.lo.accept_ra_rt_info_max_plen = 0 12:24:08 :: net.ipv6.conf.lo.accept_ra_rt_info_min_plen = 0 12:24:08 :: net.ipv6.conf.lo.accept_ra_rtr_pref = 1 12:24:08 :: net.ipv6.conf.lo.accept_redirects = 1 12:24:08 :: net.ipv6.conf.lo.accept_source_route = 0 12:24:08 :: net.ipv6.conf.lo.accept_untracked_na = 0 12:24:08 :: net.ipv6.conf.lo.addr_gen_mode = 0 12:24:08 :: net.ipv6.conf.lo.autoconf = 1 12:24:08 :: net.ipv6.conf.lo.dad_transmits = 1 12:24:08 :: net.ipv6.conf.lo.disable_ipv6 = 0 12:24:08 :: net.ipv6.conf.lo.disable_policy = 0 12:24:08 :: net.ipv6.conf.lo.drop_unicast_in_l2_multicast = 0 12:24:08 :: net.ipv6.conf.lo.drop_unsolicited_na = 0 12:24:08 :: net.ipv6.conf.lo.enhanced_dad = 1 12:24:08 :: net.ipv6.conf.lo.force_mld_version = 0 12:24:08 :: net.ipv6.conf.lo.force_tllao = 0 12:24:08 :: net.ipv6.conf.lo.forwarding = 0 12:24:08 :: net.ipv6.conf.lo.hop_limit = 64 12:24:08 :: net.ipv6.conf.lo.ignore_routes_with_linkdown = 0 12:24:08 :: net.ipv6.conf.lo.ioam6_enabled = 0 12:24:08 :: net.ipv6.conf.lo.ioam6_id = 65535 12:24:08 :: net.ipv6.conf.lo.ioam6_id_wide = 4294967295 12:24:08 :: net.ipv6.conf.lo.keep_addr_on_down = 0 12:24:08 :: net.ipv6.conf.lo.max_addresses = 16 12:24:08 :: net.ipv6.conf.lo.max_desync_factor = 600 12:24:08 :: net.ipv6.conf.lo.mc_forwarding = 0 12:24:08 :: net.ipv6.conf.lo.mldv1_unsolicited_report_interval = 10000 12:24:08 :: net.ipv6.conf.lo.mldv2_unsolicited_report_interval = 1000 12:24:08 :: net.ipv6.conf.lo.mtu = 65536 12:24:08 :: net.ipv6.conf.lo.ndisc_evict_nocarrier = 1 12:24:08 :: net.ipv6.conf.lo.ndisc_notify = 0 12:24:08 :: net.ipv6.conf.lo.ndisc_tclass = 0 12:24:08 :: net.ipv6.conf.lo.proxy_ndp = 0 12:24:08 :: net.ipv6.conf.lo.ra_defrtr_metric = 1024 12:24:08 :: net.ipv6.conf.lo.ra_honor_pio_life = 0 12:24:08 :: net.ipv6.conf.lo.regen_max_retry = 3 12:24:08 :: net.ipv6.conf.lo.router_probe_interval = 60 12:24:08 :: net.ipv6.conf.lo.router_solicitation_delay = 1 12:24:08 :: net.ipv6.conf.lo.router_solicitation_interval = 4 12:24:08 :: net.ipv6.conf.lo.router_solicitation_max_interval = 3600 12:24:08 :: net.ipv6.conf.lo.router_solicitations = -1 12:24:08 :: net.ipv6.conf.lo.rpl_seg_enabled = 0 12:24:08 :: net.ipv6.conf.lo.seg6_enabled = 0 12:24:08 :: net.ipv6.conf.lo.seg6_require_hmac = 0 12:24:08 :: net.ipv6.conf.lo.suppress_frag_ndisc = 1 12:24:08 :: net.ipv6.conf.lo.temp_prefered_lft = 86400 12:24:08 :: net.ipv6.conf.lo.temp_valid_lft = 604800 12:24:08 :: net.ipv6.conf.lo.use_oif_addrs_only = 0 12:24:08 :: net.ipv6.conf.lo.use_tempaddr = -1 12:24:08 :: net.ipv6.conf.vethd9a62a1.accept_dad = 1 12:24:08 :: net.ipv6.conf.vethd9a62a1.accept_ra = 1 12:24:08 :: net.ipv6.conf.vethd9a62a1.accept_ra_defrtr = 1 12:24:08 :: net.ipv6.conf.vethd9a62a1.accept_ra_from_local = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.accept_ra_min_hop_limit = 1 12:24:08 :: net.ipv6.conf.vethd9a62a1.accept_ra_min_lft = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.accept_ra_mtu = 1 12:24:08 :: net.ipv6.conf.vethd9a62a1.accept_ra_pinfo = 1 12:24:08 :: net.ipv6.conf.vethd9a62a1.accept_ra_rt_info_max_plen = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.accept_ra_rt_info_min_plen = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.accept_ra_rtr_pref = 1 12:24:08 :: net.ipv6.conf.vethd9a62a1.accept_redirects = 1 12:24:08 :: net.ipv6.conf.vethd9a62a1.accept_source_route = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.accept_untracked_na = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.addr_gen_mode = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.autoconf = 1 12:24:08 :: net.ipv6.conf.vethd9a62a1.dad_transmits = 1 12:24:08 :: net.ipv6.conf.vethd9a62a1.disable_ipv6 = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.disable_policy = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.drop_unicast_in_l2_multicast = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.drop_unsolicited_na = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.enhanced_dad = 1 12:24:08 :: net.ipv6.conf.vethd9a62a1.force_mld_version = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.force_tllao = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.forwarding = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.hop_limit = 64 12:24:08 :: net.ipv6.conf.vethd9a62a1.ignore_routes_with_linkdown = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.ioam6_enabled = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.ioam6_id = 65535 12:24:08 :: net.ipv6.conf.vethd9a62a1.ioam6_id_wide = 4294967295 12:24:08 :: net.ipv6.conf.vethd9a62a1.keep_addr_on_down = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.max_addresses = 16 12:24:08 :: net.ipv6.conf.vethd9a62a1.max_desync_factor = 600 12:24:08 :: net.ipv6.conf.vethd9a62a1.mc_forwarding = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.mldv1_unsolicited_report_interval = 10000 12:24:08 :: net.ipv6.conf.vethd9a62a1.mldv2_unsolicited_report_interval = 1000 12:24:08 :: net.ipv6.conf.vethd9a62a1.mtu = 1500 12:24:08 :: net.ipv6.conf.vethd9a62a1.ndisc_evict_nocarrier = 1 12:24:08 :: net.ipv6.conf.vethd9a62a1.ndisc_notify = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.ndisc_tclass = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.proxy_ndp = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.ra_defrtr_metric = 1024 12:24:08 :: net.ipv6.conf.vethd9a62a1.ra_honor_pio_life = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.regen_max_retry = 3 12:24:08 :: net.ipv6.conf.vethd9a62a1.router_probe_interval = 60 12:24:08 :: net.ipv6.conf.vethd9a62a1.router_solicitation_delay = 1 12:24:08 :: net.ipv6.conf.vethd9a62a1.router_solicitation_interval = 4 12:24:08 :: net.ipv6.conf.vethd9a62a1.router_solicitation_max_interval = 3600 12:24:08 :: net.ipv6.conf.vethd9a62a1.router_solicitations = -1 12:24:08 :: net.ipv6.conf.vethd9a62a1.rpl_seg_enabled = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.seg6_enabled = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.seg6_require_hmac = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.suppress_frag_ndisc = 1 12:24:08 :: net.ipv6.conf.vethd9a62a1.temp_prefered_lft = 86400 12:24:08 :: net.ipv6.conf.vethd9a62a1.temp_valid_lft = 604800 12:24:08 :: net.ipv6.conf.vethd9a62a1.use_oif_addrs_only = 0 12:24:08 :: net.ipv6.conf.vethd9a62a1.use_tempaddr = 0 12:24:08 :: net.ipv6.conf.virbr0.accept_dad = 1 12:24:08 :: net.ipv6.conf.virbr0.accept_ra = 0 12:24:08 :: net.ipv6.conf.virbr0.accept_ra_defrtr = 1 12:24:08 :: net.ipv6.conf.virbr0.accept_ra_from_local = 0 12:24:08 :: net.ipv6.conf.virbr0.accept_ra_min_hop_limit = 1 12:24:08 :: net.ipv6.conf.virbr0.accept_ra_min_lft = 0 12:24:08 :: net.ipv6.conf.virbr0.accept_ra_mtu = 1 12:24:08 :: net.ipv6.conf.virbr0.accept_ra_pinfo = 1 12:24:08 :: net.ipv6.conf.virbr0.accept_ra_rt_info_max_plen = 0 12:24:08 :: net.ipv6.conf.virbr0.accept_ra_rt_info_min_plen = 0 12:24:08 :: net.ipv6.conf.virbr0.accept_ra_rtr_pref = 1 12:24:08 :: net.ipv6.conf.virbr0.accept_redirects = 1 12:24:08 :: net.ipv6.conf.virbr0.accept_source_route = 0 12:24:08 :: net.ipv6.conf.virbr0.accept_untracked_na = 0 12:24:08 :: net.ipv6.conf.virbr0.addr_gen_mode = 0 12:24:08 :: net.ipv6.conf.virbr0.autoconf = 0 12:24:08 :: net.ipv6.conf.virbr0.dad_transmits = 1 12:24:08 :: net.ipv6.conf.virbr0.disable_ipv6 = 1 12:24:08 :: net.ipv6.conf.virbr0.disable_policy = 0 12:24:08 :: net.ipv6.conf.virbr0.drop_unicast_in_l2_multicast = 0 12:24:08 :: net.ipv6.conf.virbr0.drop_unsolicited_na = 0 12:24:08 :: net.ipv6.conf.virbr0.enhanced_dad = 1 12:24:08 :: net.ipv6.conf.virbr0.force_mld_version = 0 12:24:08 :: net.ipv6.conf.virbr0.force_tllao = 0 12:24:08 :: net.ipv6.conf.virbr0.forwarding = 0 12:24:08 :: net.ipv6.conf.virbr0.hop_limit = 64 12:24:08 :: net.ipv6.conf.virbr0.ignore_routes_with_linkdown = 0 12:24:08 :: net.ipv6.conf.virbr0.ioam6_enabled = 0 12:24:08 :: net.ipv6.conf.virbr0.ioam6_id = 65535 12:24:08 :: net.ipv6.conf.virbr0.ioam6_id_wide = 4294967295 12:24:08 :: net.ipv6.conf.virbr0.keep_addr_on_down = 0 12:24:08 :: net.ipv6.conf.virbr0.max_addresses = 16 12:24:08 :: net.ipv6.conf.virbr0.max_desync_factor = 600 12:24:08 :: net.ipv6.conf.virbr0.mc_forwarding = 0 12:24:08 :: net.ipv6.conf.virbr0.mldv1_unsolicited_report_interval = 10000 12:24:08 :: net.ipv6.conf.virbr0.mldv2_unsolicited_report_interval = 1000 12:24:08 :: net.ipv6.conf.virbr0.mtu = 1500 12:24:08 :: net.ipv6.conf.virbr0.ndisc_evict_nocarrier = 1 12:24:08 :: net.ipv6.conf.virbr0.ndisc_notify = 0 12:24:08 :: net.ipv6.conf.virbr0.ndisc_tclass = 0 12:24:08 :: net.ipv6.conf.virbr0.proxy_ndp = 0 12:24:08 :: net.ipv6.conf.virbr0.ra_defrtr_metric = 1024 12:24:08 :: net.ipv6.conf.virbr0.ra_honor_pio_life = 0 12:24:08 :: net.ipv6.conf.virbr0.regen_max_retry = 3 12:24:08 :: net.ipv6.conf.virbr0.router_probe_interval = 60 12:24:08 :: net.ipv6.conf.virbr0.router_solicitation_delay = 1 12:24:08 :: net.ipv6.conf.virbr0.router_solicitation_interval = 4 12:24:08 :: net.ipv6.conf.virbr0.router_solicitation_max_interval = 3600 12:24:08 :: net.ipv6.conf.virbr0.router_solicitations = -1 12:24:08 :: net.ipv6.conf.virbr0.rpl_seg_enabled = 0 12:24:08 :: net.ipv6.conf.virbr0.seg6_enabled = 0 12:24:08 :: net.ipv6.conf.virbr0.seg6_require_hmac = 0 12:24:08 :: net.ipv6.conf.virbr0.suppress_frag_ndisc = 1 12:24:08 :: net.ipv6.conf.virbr0.temp_prefered_lft = 86400 12:24:08 :: net.ipv6.conf.virbr0.temp_valid_lft = 604800 12:24:08 :: net.ipv6.conf.virbr0.use_oif_addrs_only = 0 12:24:08 :: net.ipv6.conf.virbr0.use_tempaddr = 0 12:24:08 :: net.ipv6.fib_multipath_hash_fields = 7 12:24:08 :: net.ipv6.fib_multipath_hash_policy = 0 12:24:08 :: net.ipv6.fib_notify_on_flag_change = 0 12:24:08 :: net.ipv6.flowlabel_consistency = 1 12:24:08 :: net.ipv6.flowlabel_reflect = 0 12:24:08 :: net.ipv6.flowlabel_state_ranges = 0 12:24:08 :: net.ipv6.fwmark_reflect = 0 12:24:08 :: net.ipv6.icmp.echo_ignore_all = 0 12:24:08 :: net.ipv6.icmp.echo_ignore_anycast = 0 12:24:08 :: net.ipv6.icmp.echo_ignore_multicast = 0 12:24:08 :: net.ipv6.icmp.error_anycast_as_unicast = 0 12:24:08 :: net.ipv6.icmp.ratelimit = 1000 12:24:08 :: net.ipv6.icmp.ratemask = 0-1,3-127 12:24:08 :: net.ipv6.idgen_delay = 1 12:24:08 :: net.ipv6.idgen_retries = 3 12:24:08 :: net.ipv6.ioam6_id = 16777215 12:24:08 :: net.ipv6.ioam6_id_wide = 72057594037927935 12:24:08 :: net.ipv6.ip6frag_high_thresh = 4194304 12:24:08 :: net.ipv6.ip6frag_low_thresh = 3145728 12:24:08 :: net.ipv6.ip6frag_secret_interval = 0 12:24:08 :: net.ipv6.ip6frag_time = 60 12:24:08 :: net.ipv6.ip_nonlocal_bind = 0 12:24:08 :: net.ipv6.max_dst_opts_length = 2147483647 12:24:08 :: net.ipv6.max_dst_opts_number = 8 12:24:08 :: net.ipv6.max_hbh_length = 2147483647 12:24:08 :: net.ipv6.max_hbh_opts_number = 8 12:24:08 :: net.ipv6.mld_max_msf = 64 12:24:08 :: net.ipv6.mld_qrv = 2 12:24:08 :: net.ipv6.neigh.default.anycast_delay = 100 12:24:08 :: net.ipv6.neigh.default.app_solicit = 0 12:24:08 :: net.ipv6.neigh.default.base_reachable_time_ms = 30000 12:24:08 :: net.ipv6.neigh.default.delay_first_probe_time = 5 12:24:08 :: net.ipv6.neigh.default.gc_interval = 30 12:24:08 :: net.ipv6.neigh.default.gc_stale_time = 60 12:24:08 :: net.ipv6.neigh.default.gc_thresh1 = 128 12:24:08 :: net.ipv6.neigh.default.gc_thresh2 = 512 12:24:08 :: net.ipv6.neigh.default.gc_thresh3 = 1024 12:24:08 :: net.ipv6.neigh.default.interval_probe_time_ms = 5000 12:24:08 :: net.ipv6.neigh.default.locktime = 0 12:24:08 :: net.ipv6.neigh.default.mcast_resolicit = 0 12:24:08 :: net.ipv6.neigh.default.mcast_solicit = 3 12:24:08 :: net.ipv6.neigh.default.proxy_delay = 80 12:24:08 :: net.ipv6.neigh.default.proxy_qlen = 64 12:24:08 :: net.ipv6.neigh.default.retrans_time_ms = 1000 12:24:08 :: net.ipv6.neigh.default.ucast_solicit = 3 12:24:08 :: net.ipv6.neigh.default.unres_qlen = 101 12:24:08 :: net.ipv6.neigh.default.unres_qlen_bytes = 212992 12:24:08 :: net.ipv6.neigh.docker0.anycast_delay = 100 12:24:08 :: net.ipv6.neigh.docker0.app_solicit = 0 12:24:08 :: net.ipv6.neigh.docker0.base_reachable_time_ms = 30000 12:24:08 :: net.ipv6.neigh.docker0.delay_first_probe_time = 5 12:24:08 :: net.ipv6.neigh.docker0.gc_stale_time = 60 12:24:08 :: net.ipv6.neigh.docker0.interval_probe_time_ms = 5000 12:24:08 :: net.ipv6.neigh.docker0.locktime = 0 12:24:08 :: net.ipv6.neigh.docker0.mcast_resolicit = 0 12:24:08 :: net.ipv6.neigh.docker0.mcast_solicit = 3 12:24:08 :: net.ipv6.neigh.docker0.proxy_delay = 80 12:24:08 :: net.ipv6.neigh.docker0.proxy_qlen = 64 12:24:08 :: net.ipv6.neigh.docker0.retrans_time_ms = 1000 12:24:08 :: net.ipv6.neigh.docker0.ucast_solicit = 3 12:24:08 :: net.ipv6.neigh.docker0.unres_qlen = 101 12:24:08 :: net.ipv6.neigh.docker0.unres_qlen_bytes = 212992 12:24:08 :: net.ipv6.neigh.enp0s3.anycast_delay = 100 12:24:08 :: net.ipv6.neigh.enp0s3.app_solicit = 0 12:24:08 :: net.ipv6.neigh.enp0s3.base_reachable_time_ms = 30000 12:24:08 :: net.ipv6.neigh.enp0s3.delay_first_probe_time = 5 12:24:08 :: net.ipv6.neigh.enp0s3.gc_stale_time = 60 12:24:08 :: net.ipv6.neigh.enp0s3.interval_probe_time_ms = 5000 12:24:08 :: net.ipv6.neigh.enp0s3.locktime = 0 12:24:08 :: net.ipv6.neigh.enp0s3.mcast_resolicit = 0 12:24:08 :: net.ipv6.neigh.enp0s3.mcast_solicit = 3 12:24:08 :: net.ipv6.neigh.enp0s3.proxy_delay = 80 12:24:08 :: net.ipv6.neigh.enp0s3.proxy_qlen = 64 12:24:08 :: net.ipv6.neigh.enp0s3.retrans_time_ms = 1000 12:24:08 :: net.ipv6.neigh.enp0s3.ucast_solicit = 3 12:24:08 :: net.ipv6.neigh.enp0s3.unres_qlen = 101 12:24:08 :: net.ipv6.neigh.enp0s3.unres_qlen_bytes = 212992 12:24:08 :: net.ipv6.neigh.lo.anycast_delay = 100 12:24:08 :: net.ipv6.neigh.lo.app_solicit = 0 12:24:08 :: net.ipv6.neigh.lo.base_reachable_time_ms = 30000 12:24:08 :: net.ipv6.neigh.lo.delay_first_probe_time = 5 12:24:08 :: net.ipv6.neigh.lo.gc_stale_time = 60 12:24:08 :: net.ipv6.neigh.lo.interval_probe_time_ms = 5000 12:24:08 :: net.ipv6.neigh.lo.locktime = 0 12:24:08 :: net.ipv6.neigh.lo.mcast_resolicit = 0 12:24:08 :: net.ipv6.neigh.lo.mcast_solicit = 3 12:24:08 :: net.ipv6.neigh.lo.proxy_delay = 80 12:24:08 :: net.ipv6.neigh.lo.proxy_qlen = 64 12:24:08 :: net.ipv6.neigh.lo.retrans_time_ms = 1000 12:24:08 :: net.ipv6.neigh.lo.ucast_solicit = 3 12:24:08 :: net.ipv6.neigh.lo.unres_qlen = 101 12:24:08 :: net.ipv6.neigh.lo.unres_qlen_bytes = 212992 12:24:08 :: net.ipv6.neigh.vethd9a62a1.anycast_delay = 100 12:24:08 :: net.ipv6.neigh.vethd9a62a1.app_solicit = 0 12:24:08 :: net.ipv6.neigh.vethd9a62a1.base_reachable_time_ms = 30000 12:24:08 :: net.ipv6.neigh.vethd9a62a1.delay_first_probe_time = 5 12:24:08 :: net.ipv6.neigh.vethd9a62a1.gc_stale_time = 60 12:24:08 :: net.ipv6.neigh.vethd9a62a1.interval_probe_time_ms = 5000 12:24:08 :: net.ipv6.neigh.vethd9a62a1.locktime = 0 12:24:08 :: net.ipv6.neigh.vethd9a62a1.mcast_resolicit = 0 12:24:08 :: net.ipv6.neigh.vethd9a62a1.mcast_solicit = 3 12:24:08 :: net.ipv6.neigh.vethd9a62a1.proxy_delay = 80 12:24:08 :: net.ipv6.neigh.vethd9a62a1.proxy_qlen = 64 12:24:08 :: net.ipv6.neigh.vethd9a62a1.retrans_time_ms = 1000 12:24:08 :: net.ipv6.neigh.vethd9a62a1.ucast_solicit = 3 12:24:08 :: net.ipv6.neigh.vethd9a62a1.unres_qlen = 101 12:24:08 :: net.ipv6.neigh.vethd9a62a1.unres_qlen_bytes = 212992 12:24:08 :: net.ipv6.neigh.virbr0.anycast_delay = 100 12:24:08 :: net.ipv6.neigh.virbr0.app_solicit = 0 12:24:08 :: net.ipv6.neigh.virbr0.base_reachable_time_ms = 30000 12:24:08 :: net.ipv6.neigh.virbr0.delay_first_probe_time = 5 12:24:08 :: net.ipv6.neigh.virbr0.gc_stale_time = 60 12:24:08 :: net.ipv6.neigh.virbr0.interval_probe_time_ms = 5000 12:24:08 :: net.ipv6.neigh.virbr0.locktime = 0 12:24:08 :: net.ipv6.neigh.virbr0.mcast_resolicit = 0 12:24:08 :: net.ipv6.neigh.virbr0.mcast_solicit = 3 12:24:08 :: net.ipv6.neigh.virbr0.proxy_delay = 80 12:24:08 :: net.ipv6.neigh.virbr0.proxy_qlen = 64 12:24:08 :: net.ipv6.neigh.virbr0.retrans_time_ms = 1000 12:24:08 :: net.ipv6.neigh.virbr0.ucast_solicit = 3 12:24:08 :: net.ipv6.neigh.virbr0.unres_qlen = 101 12:24:08 :: net.ipv6.neigh.virbr0.unres_qlen_bytes = 212992 12:24:08 :: net.ipv6.route.gc_elasticity = 9 12:24:08 :: net.ipv6.route.gc_interval = 30 12:24:08 :: net.ipv6.route.gc_min_interval = 0 12:24:08 :: net.ipv6.route.gc_min_interval_ms = 500 12:24:08 :: net.ipv6.route.gc_thresh = 1024 12:24:08 :: net.ipv6.route.gc_timeout = 60 12:24:08 :: net.ipv6.route.max_size = 2147483647 12:24:08 :: net.ipv6.route.min_adv_mss = 1220 12:24:08 :: net.ipv6.route.mtu_expires = 600 12:24:08 :: net.ipv6.route.skip_notify_on_dev_down = 0 12:24:08 :: net.ipv6.seg6_flowlabel = 0 12:24:08 :: net.ipv6.xfrm6_gc_thresh = 32768 12:24:08 :: net.mptcp.add_addr_timeout = 120 12:24:08 :: net.mptcp.allow_join_initial_addr_port = 1 12:24:08 :: net.mptcp.checksum_enabled = 0 12:24:08 :: net.mptcp.close_timeout = 60 12:24:08 :: net.mptcp.enabled = 1 12:24:08 :: net.mptcp.pm_type = 0 12:24:08 :: net.mptcp.scheduler = default 12:24:08 :: net.mptcp.stale_loss_cnt = 4 12:24:08 :: net.netfilter.nf_conntrack_acct = 0 12:24:08 :: net.netfilter.nf_conntrack_buckets = 262144 12:24:08 :: net.netfilter.nf_conntrack_checksum = 1 12:24:08 :: net.netfilter.nf_conntrack_count = 225 12:24:08 :: net.netfilter.nf_conntrack_dccp_loose = 1 12:24:08 :: net.netfilter.nf_conntrack_dccp_timeout_closereq = 64 12:24:08 :: net.netfilter.nf_conntrack_dccp_timeout_closing = 64 12:24:08 :: net.netfilter.nf_conntrack_dccp_timeout_open = 43200 12:24:08 :: net.netfilter.nf_conntrack_dccp_timeout_partopen = 480 12:24:08 :: net.netfilter.nf_conntrack_dccp_timeout_request = 240 12:24:08 :: net.netfilter.nf_conntrack_dccp_timeout_respond = 480 12:24:08 :: net.netfilter.nf_conntrack_dccp_timeout_timewait = 240 12:24:08 :: net.netfilter.nf_conntrack_events = 2 12:24:08 :: net.netfilter.nf_conntrack_expect_max = 4096 12:24:08 :: net.netfilter.nf_conntrack_frag6_high_thresh = 4194304 12:24:08 :: net.netfilter.nf_conntrack_frag6_low_thresh = 3145728 12:24:08 :: net.netfilter.nf_conntrack_frag6_timeout = 60 12:24:08 :: net.netfilter.nf_conntrack_generic_timeout = 600 12:24:08 :: net.netfilter.nf_conntrack_gre_timeout = 30 12:24:08 :: net.netfilter.nf_conntrack_gre_timeout_stream = 180 12:24:08 :: net.netfilter.nf_conntrack_icmp_timeout = 30 12:24:08 :: net.netfilter.nf_conntrack_icmpv6_timeout = 30 12:24:08 :: net.netfilter.nf_conntrack_log_invalid = 0 12:24:08 :: net.netfilter.nf_conntrack_max = 262144 12:24:08 :: net.netfilter.nf_conntrack_sctp_timeout_closed = 10 12:24:08 :: net.netfilter.nf_conntrack_sctp_timeout_cookie_echoed = 3 12:24:08 :: net.netfilter.nf_conntrack_sctp_timeout_cookie_wait = 3 12:24:08 :: net.netfilter.nf_conntrack_sctp_timeout_established = 210 12:24:08 :: net.netfilter.nf_conntrack_sctp_timeout_heartbeat_sent = 30 12:24:08 :: net.netfilter.nf_conntrack_sctp_timeout_shutdown_ack_sent = 3 12:24:08 :: net.netfilter.nf_conntrack_sctp_timeout_shutdown_recd = 3 12:24:08 :: net.netfilter.nf_conntrack_sctp_timeout_shutdown_sent = 3 12:24:08 :: net.netfilter.nf_conntrack_tcp_be_liberal = 0 12:24:08 :: net.netfilter.nf_conntrack_tcp_ignore_invalid_rst = 0 12:24:08 :: net.netfilter.nf_conntrack_tcp_loose = 1 12:24:08 :: net.netfilter.nf_conntrack_tcp_max_retrans = 3 12:24:08 :: net.netfilter.nf_conntrack_tcp_timeout_close = 10 12:24:08 :: net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60 12:24:08 :: net.netfilter.nf_conntrack_tcp_timeout_established = 432000 12:24:08 :: net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120 12:24:08 :: net.netfilter.nf_conntrack_tcp_timeout_last_ack = 30 12:24:08 :: net.netfilter.nf_conntrack_tcp_timeout_max_retrans = 300 12:24:08 :: net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60 12:24:08 :: net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 120 12:24:08 :: net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120 12:24:08 :: net.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300 12:24:08 :: net.netfilter.nf_conntrack_timestamp = 0 12:24:08 :: net.netfilter.nf_conntrack_udp_timeout = 30 12:24:08 :: net.netfilter.nf_conntrack_udp_timeout_stream = 120 12:24:08 :: net.netfilter.nf_flowtable_tcp_timeout = 30 12:24:08 :: net.netfilter.nf_flowtable_udp_timeout = 30 12:24:08 :: net.netfilter.nf_hooks_lwtunnel = 0 12:24:08 :: net.netfilter.nf_log.0 = NONE 12:24:08 :: net.netfilter.nf_log.1 = NONE 12:24:08 :: net.netfilter.nf_log.10 = NONE 12:24:08 :: net.netfilter.nf_log.2 = NONE 12:24:08 :: net.netfilter.nf_log.3 = NONE 12:24:08 :: net.netfilter.nf_log.4 = NONE 12:24:08 :: net.netfilter.nf_log.5 = NONE 12:24:08 :: net.netfilter.nf_log.6 = NONE 12:24:08 :: net.netfilter.nf_log.7 = NONE 12:24:08 :: net.netfilter.nf_log.8 = NONE 12:24:08 :: net.netfilter.nf_log.9 = NONE 12:24:08 :: net.netfilter.nf_log_all_netns = 0 12:24:08 :: net.nf_conntrack_max = 262144 12:24:08 :: net.unix.max_dgram_qlen = 512 12:24:08 :: sunrpc.max_resvport = 1023 12:24:08 :: sunrpc.min_resvport = 665 12:24:08 :: sunrpc.nfs_debug = 0x0000 12:24:08 :: sunrpc.nfsd_debug = 0x0000 12:24:08 :: sunrpc.nlm_debug = 0x0000 12:24:08 :: sunrpc.rpc_debug = 0x0000 12:24:08 :: sunrpc.tcp_fin_timeout = 15 12:24:08 :: sunrpc.tcp_max_slot_table_entries = 65536 12:24:08 :: sunrpc.tcp_slot_table_entries = 2 12:24:08 :: sunrpc.transports = tcp 1048576 12:24:08 :: sunrpc.transports = udp 32768 12:24:08 :: sunrpc.udp_slot_table_entries = 16 12:24:08 :: user.max_cgroup_namespaces = 95620 12:24:08 :: user.max_fanotify_groups = 128 12:24:08 :: user.max_fanotify_marks = 198574 12:24:08 :: user.max_inotify_instances = 128 12:24:08 :: user.max_inotify_watches = 186755 12:24:08 :: user.max_ipc_namespaces = 95620 12:24:08 :: user.max_mnt_namespaces = 95620 12:24:08 :: user.max_net_namespaces = 95620 12:24:08 :: user.max_pid_namespaces = 95620 12:24:08 :: user.max_time_namespaces = 95620 12:24:08 :: user.max_user_namespaces = 95620 12:24:08 :: user.max_uts_namespaces = 95620 12:24:08 :: vm.admin_reserve_kbytes = 8192 12:24:08 :: vm.compact_unevictable_allowed = 1 12:24:08 :: vm.compaction_proactiveness = 20 12:24:08 :: vm.dirty_background_bytes = 0 12:24:08 :: vm.dirty_background_ratio = 10 12:24:08 :: vm.dirty_bytes = 0 12:24:08 :: vm.dirty_expire_centisecs = 3000 12:24:08 :: vm.dirty_ratio = 20 12:24:08 :: vm.dirty_writeback_centisecs = 500 12:24:08 :: vm.dirtytime_expire_seconds = 43200 12:24:08 :: vm.extfrag_threshold = 500 12:24:08 :: vm.hugetlb_shm_group = 0 12:24:08 :: vm.laptop_mode = 0 12:24:08 :: vm.legacy_va_layout = 0 12:24:08 :: vm.lowmem_reserve_ratio = 256 256 32 0 0 12:24:08 :: vm.max_map_count = 65530 12:24:08 :: vm.memfd_noexec = 0 12:24:08 :: vm.memory_failure_early_kill = 0 12:24:08 :: vm.memory_failure_recovery = 1 12:24:08 :: vm.min_free_kbytes = 45056 12:24:08 :: vm.min_slab_ratio = 5 12:24:08 :: vm.min_unmapped_ratio = 1 12:24:08 :: vm.mmap_min_addr = 32768 12:24:08 :: vm.mmap_rnd_bits = 33 12:24:08 :: vm.mmap_rnd_compat_bits = 16 12:24:08 :: vm.nr_hugepages = 0 12:24:08 :: vm.nr_hugepages_mempolicy = 0 12:24:08 :: vm.nr_overcommit_hugepages = 0 12:24:08 :: vm.numa_stat = 1 12:24:08 :: vm.numa_zonelist_order = Node 12:24:08 :: vm.oom_dump_tasks = 1 12:24:08 :: vm.oom_kill_allocating_task = 0 12:24:08 :: vm.overcommit_kbytes = 0 12:24:08 :: vm.overcommit_memory = 0 12:24:08 :: vm.overcommit_ratio = 50 12:24:08 :: vm.page-cluster = 3 12:24:08 :: vm.page_lock_unfairness = 5 12:24:08 :: vm.panic_on_oom = 0 12:24:08 :: vm.percpu_pagelist_high_fraction = 0 12:24:08 :: vm.stat_interval = 1 12:24:08 :: vm.swappiness = 60 12:24:08 :: vm.unprivileged_userfaultfd = 0 12:24:08 :: vm.user_reserve_kbytes = 131072 12:24:08 :: vm.vfs_cache_pressure = 100 12:24:08 :: vm.watermark_boost_factor = 15000 12:24:08 :: vm.watermark_scale_factor = 10 12:24:08 :: vm.zone_reclaim_mode = 0 12:24:08 :: [task check] </span><span class="gp">#</span><span class="w"> </span>Enable TCP SYN cookies <span class="o">(</span>net.ipv4.tcp_syncookies <span class="o">=</span> 1<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* net\.ipv4\.tcp_syncookies \s* \= \s* 1 \s* $</span><span class="nv">$&gt;</span> True <span class="gp">#</span><span class="w"> </span>Disable IP forwarding <span class="o">(</span>net.ipv4.ip_forward <span class="o">=</span> 0<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* net\.ipv4\.ip_forward \s* \= \s* 0 \s* $</span><span class="nv">$&gt;</span> False <span class="gp">#</span><span class="w"> </span>Enable reverse path filtering on all interfaces - 0 is acceptable when default is 2 <span class="o">(</span>net.ipv4.conf.all.rp_filter <span class="o">=</span> 0<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* net\.ipv4\.conf\.all\.rp_filter \s* \= \s* [0|1|2] \s* $</span><span class="nv">$&gt;</span> True <span class="gp">#</span><span class="w"> </span>Enable strict reverse path filtering on default interface - must be 2 <span class="k">for </span>secure defaults <span class="o">(</span>net.ipv4.conf.default.rp_filter <span class="o">=</span> 2<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* net\.ipv4\.conf\.default\.rp_filter \s* \= \s* 2 \s* $</span><span class="nv">$&gt;</span> True <span class="gp">#</span><span class="w"> </span>Ignore ICMP redirects on all interfaces <span class="o">(</span>net.ipv4.conf.all.accept_redirects <span class="o">=</span> 0<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* net\.ipv4\.conf\.all\.accept_redirects \s* \= \s* 0 \s* $</span><span class="nv">$&gt;</span> True <span class="gp">#</span><span class="w"> </span>Ignore ICMP redirects on default interface <span class="o">(</span>net.ipv4.conf.default.accept_redirects <span class="o">=</span> 0<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* net\.ipv4\.conf\.default\.accept_redirects \s* \= \s* 0 \s* $</span><span class="nv">$&gt;</span> False <span class="gp">#</span><span class="w"> </span>Log martian packets <span class="o">(</span>net.ipv4.conf.all.log_martians <span class="o">=</span> 1<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* net\.ipv4\.conf\.all\.log_martians \s* \= \s* 1 \s* $</span><span class="nv">$&gt;</span> False <span class="gp">#</span><span class="w"> </span>Restrict access to kernel logs <span class="o">(</span>kernel.dmesg_restrict <span class="o">=</span> 1<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* kernel\.dmesg_restrict \s* \= \s* 1 \s* $</span><span class="nv">$&gt;</span> True <span class="gp">#</span><span class="w"> </span>Disable unprivileged BPF <span class="o">(</span>kernel.unprivileged_bpf_disabled <span class="o">=</span> 2<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* kernel\.unprivileged_bpf_disabled \s* \= \s* 2 \s* $</span><span class="nv">$&gt;</span> True <span class="gp">#</span><span class="w"> </span>Disable unprivileged user namespaces <span class="o">(</span>kernel.unprivileged_userns_clone <span class="o">=</span> 0<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* kernel\.unprivileged_userns_clone \s* \= \s* 0 \s* $</span><span class="nv">$&gt;</span> False <span class="gp">#</span><span class="w"> </span>Restrict ptrace scope - 1 or 2 acceptable <span class="o">(</span>kernel.yama.ptrace_scope <span class="o">=</span> 1|2<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* kernel\.yama\.ptrace_scope \s* \= \s* [1|2] \s* $</span><span class="nv">$&gt;</span> True <span class="gp">#</span><span class="w"> </span>Protect hardlinks against race conditions <span class="o">(</span>fs.protected_hardlinks <span class="o">=</span> 1<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* fs\.protected_hardlinks \s* \= \s* 1 \s* $</span><span class="nv">$&gt;</span> True <span class="gp">#</span><span class="w"> </span>Protect symlinks against race conditions <span class="o">(</span>fs.protected_symlinks <span class="o">=</span> 1<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* fs\.protected_symlinks \s* \= \s* 1 \s* $</span><span class="nv">$&gt;</span> True <span class="gp">#</span><span class="w"> </span>Protect FIFOs against opening <span class="k">in </span>sticky directories <span class="o">(</span>fs.protected_fifos <span class="o">=</span> 1<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* fs\.protected_fifos \s* \= \s* 1 \s* $</span><span class="nv">$&gt;</span> True <span class="gp">#</span><span class="w"> </span>Protect regular files against opening <span class="k">in </span>sticky directories <span class="o">(</span>fs.protected_regular <span class="o">=</span> 2<span class="o">)</span> <span class="gp">stdout match &lt;^^ \s* fs\.protected_regular \s* \= \s* 2 \s* $</span><span class="nv">$&gt;</span> True <span class="go">================= TASK CHECK FAIL </span></code></pre> </div> <h2> Sudoers </h2> <div class="highlight js-code-highlight"> <pre class="highlight console"><code><span class="gp">$</span><span class="w"> </span><span class="nb">sudo cat</span> /etc/sudoers | s6 <span class="nt">--plg-run</span> scc@check<span class="o">=</span>sudoers <span class="go">12:25:00 :: [task] - run plg scc@check=sudoers 12:25:00 :: [task] - run [scc], thing: scc@check=sudoers [task run: task.bash - scc] [task stdout] </span><span class="gp">12:25:00 :: #</span><span class="w"> </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>This file MUST be edited with the <span class="s1">'visudo'</span> <span class="nb">command </span>as root. <span class="gp">12:25:00 :: #</span><span class="w"> </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>Please consider adding <span class="nb">local </span>content <span class="k">in</span> /etc/sudoers.d/ instead of <span class="gp">12:25:00 :: #</span><span class="w"> </span>directly modifying this file. <span class="gp">12:25:00 :: #</span><span class="w"> </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>See the man page <span class="k">for </span>details on how to write a sudoers file. <span class="gp">12:25:00 :: #</span><span class="w"> </span><span class="go">12:25:00 :: Defaults env_reset 12:25:00 :: Defaults mail_badpass 12:25:00 :: Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin" 12:25:00 :: Defaults use_pty 12:25:00 :: </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>This preserves proxy settings from user environments of root <span class="gp">12:25:00 :: #</span><span class="w"> </span>equivalent <span class="nb">users</span> <span class="o">(</span>group <span class="nb">sudo</span><span class="o">)</span> <span class="gp">12:25:00 :: #</span>Defaults:%sudo env_keep +<span class="o">=</span> <span class="s2">"http_proxy https_proxy ftp_proxy all_proxy no_proxy"</span> <span class="go">12:25:00 :: </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>This allows running arbitrary commands, but so does ALL, and it means <span class="gp">12:25:00 :: #</span><span class="w"> </span>different sudoers have their choice of editor respected. <span class="gp">12:25:00 :: #</span>Defaults:%sudo env_keep +<span class="o">=</span> <span class="s2">"EDITOR"</span> <span class="go">12:25:00 :: </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>Completely harmless preservation of a user preference. <span class="gp">12:25:00 :: #</span>Defaults:%sudo env_keep +<span class="o">=</span> <span class="s2">"GREP_COLOR"</span> <span class="go">12:25:00 :: </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>While you shouldn<span class="s1">'t normally run git as root, you need to with etckeeper </span><span class="gp">12:25:00 :: #</span><span class="s1">Defaults:%sudo env_keep += "GIT_AUTHOR_* GIT_COMMITTER_*" </span><span class="go">12:25:00 :: </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>Per-user preferences<span class="p">;</span> root won<span class="s1">'t have sensible values for them. </span><span class="gp">12:25:00 :: #</span><span class="s1">Defaults:%sudo env_keep += "EMAIL DEBEMAIL DEBFULLNAME" </span><span class="go">12:25:00 :: </span><span class="gp">12:25:00 :: #</span><span class="w"> </span><span class="s2">"sudo scp"</span> or <span class="s2">"sudo rsync"</span> should be able to use your SSH agent. <span class="gp">12:25:00 :: #</span>Defaults:%sudo env_keep +<span class="o">=</span> <span class="s2">"SSH_AGENT_PID SSH_AUTH_SOCK"</span> <span class="go">12:25:00 :: </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>Ditto <span class="k">for </span>GPG agent <span class="gp">12:25:00 :: #</span>Defaults:%sudo env_keep +<span class="o">=</span> <span class="s2">"GPG_AGENT_INFO"</span> <span class="go">12:25:00 :: </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>Host <span class="nb">alias </span>specification <span class="go">12:25:00 :: </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>User <span class="nb">alias </span>specification <span class="go">12:25:00 :: </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>Cmnd <span class="nb">alias </span>specification <span class="go">12:25:00 :: </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>User privilege specification <span class="go">12:25:00 :: root ALL=(ALL:ALL) ALL 12:25:00 :: </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>Members of the admin group may gain root privileges <span class="go">12:25:00 :: %admin ALL=(ALL) ALL 12:25:00 :: </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>Allow members of group <span class="nb">sudo </span>to execute any <span class="nb">command</span> <span class="go">12:25:00 :: %sudo ALL=(ALL:ALL) ALL 12:25:00 :: </span><span class="gp">12:25:00 :: #</span><span class="w"> </span>See sudoers<span class="o">(</span>5<span class="o">)</span> <span class="k">for </span>more information on <span class="s2">"@include"</span> directives: <span class="go">12:25:00 :: 12:25:00 :: @includedir /etc/sudoers.d 12:25:00 :: [task check] </span><span class="gp">&lt;passwordless sudo is disabled&gt;</span><span class="w"> </span>True <span class="gp">&lt;Defaults requiretty is not set - unsecure tty handling&gt;</span><span class="w"> </span>False <span class="gp">&lt;Defaults env_reset is set&gt;</span><span class="w"> </span>True <span class="gp">&lt;Defaults secure_path may be insecure - "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"&gt;</span><span class="w"> </span>False <span class="gp">&lt;Defaults mail_badpass is set&gt;</span><span class="w"> </span>True <span class="gp">&lt;Defaults logfile is not configured - sudo actions not logged&gt;</span><span class="w"> </span>False <span class="gp">&lt;Defaults rootpw is not set - using user's own password&gt;</span><span class="w"> </span>True <span class="gp">&lt;Defaults insults is not enabled&gt;</span><span class="w"> </span>True <span class="gp">&lt;Defaults timestamp_timeout is not set - using default&gt;</span><span class="w"> </span>True <span class="gp">&lt;unrestricted sudo access found - ALL=(ALL) ALL&gt;</span><span class="w"> </span>False <span class="gp">&lt;no commented-out dangerous directives found&gt;</span><span class="w"> </span>True <span class="gp">&lt;Defaults lecture is not configured&gt;</span><span class="w"> </span>False <span class="go">================= TASK CHECK FAIL </span></code></pre> </div> <h2> Sshd </h2> <div class="highlight js-code-highlight"> <pre class="highlight console"><code><span class="gp">$</span><span class="w"> </span><span class="nb">sudo </span>sshd <span class="nt">-T</span> | s6 <span class="nt">--plg-run</span> scc@check<span class="o">=</span>sshd <span class="go">12:25:47 :: [task] - run plg scc@check=sshd 12:25:47 :: [task] - run [scc], thing: scc@check=sshd [task run: task.bash - scc] [task stdout] 12:25:47 :: port 22 12:25:47 :: addressfamily any 12:25:47 :: listenaddress [::]:22 12:25:47 :: listenaddress 0.0.0.0:22 12:25:47 :: usepam yes 12:25:47 :: logingracetime 120 12:25:47 :: x11displayoffset 10 12:25:47 :: maxauthtries 6 12:25:47 :: maxsessions 10 12:25:47 :: clientaliveinterval 0 12:25:47 :: clientalivecountmax 3 12:25:47 :: streamlocalbindmask 0177 12:25:47 :: permitrootlogin without-password 12:25:47 :: ignorerhosts yes 12:25:47 :: ignoreuserknownhosts no 12:25:47 :: hostbasedauthentication no 12:25:47 :: hostbasedusesnamefrompacketonly no 12:25:47 :: pubkeyauthentication yes 12:25:47 :: kerberosauthentication no 12:25:47 :: kerberosorlocalpasswd yes 12:25:47 :: kerberosticketcleanup yes 12:25:47 :: gssapiauthentication no 12:25:47 :: gssapicleanupcredentials yes 12:25:47 :: gssapikeyexchange no 12:25:47 :: gssapistrictacceptorcheck yes 12:25:47 :: gssapistorecredentialsonrekey no 12:25:47 :: gssapikexalgorithms gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- 12:25:47 :: passwordauthentication no 12:25:47 :: kbdinteractiveauthentication no 12:25:47 :: printmotd no 12:25:47 :: printlastlog yes 12:25:47 :: x11forwarding yes 12:25:47 :: x11uselocalhost yes 12:25:47 :: permittty yes 12:25:47 :: permituserrc yes 12:25:47 :: strictmodes yes 12:25:47 :: tcpkeepalive yes 12:25:47 :: permitemptypasswords no 12:25:47 :: compression yes 12:25:47 :: gatewayports no 12:25:47 :: usedns no 12:25:47 :: allowtcpforwarding yes 12:25:47 :: allowagentforwarding yes 12:25:47 :: disableforwarding no 12:25:47 :: allowstreamlocalforwarding yes 12:25:47 :: streamlocalbindunlink no 12:25:47 :: fingerprinthash SHA256 12:25:47 :: exposeauthinfo no 12:25:47 :: pidfile /run/sshd.pid 12:25:47 :: modulifile /etc/ssh/moduli 12:25:47 :: xauthlocation /usr/bin/xauth 12:25:47 :: ciphers chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com 12:25:47 :: macs umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 12:25:47 :: banner none 12:25:47 :: forcecommand none 12:25:47 :: chrootdirectory none 12:25:47 :: trustedusercakeys none 12:25:47 :: revokedkeys none 12:25:47 :: securitykeyprovider internal 12:25:47 :: authorizedprincipalsfile none 12:25:47 :: versionaddendum none 12:25:47 :: authorizedkeyscommand none 12:25:47 :: authorizedkeyscommanduser none 12:25:47 :: authorizedprincipalscommand none 12:25:47 :: authorizedprincipalscommanduser none 12:25:47 :: hostkeyagent none 12:25:47 :: kexalgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,sntrup761x25519-sha512@openssh.com,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256 12:25:47 :: casignaturealgorithms ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256 12:25:47 :: hostbasedacceptedalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256 12:25:47 :: hostkeyalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256 12:25:47 :: pubkeyacceptedalgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256 12:25:47 :: loglevel INFO 12:25:47 :: syslogfacility AUTH 12:25:47 :: authorizedkeysfile .ssh/authorized_keys .ssh/authorized_keys2 12:25:47 :: hostkey /etc/ssh/ssh_host_rsa_key 12:25:47 :: hostkey /etc/ssh/ssh_host_ecdsa_key 12:25:47 :: hostkey /etc/ssh/ssh_host_ed25519_key 12:25:47 :: acceptenv LANG 12:25:47 :: acceptenv LC_* 12:25:47 :: authenticationmethods any 12:25:47 :: subsystem sftp /usr/lib/openssh/sftp-server 12:25:47 :: maxstartups 10:30:100 12:25:47 :: persourcemaxstartups none 12:25:47 :: persourcenetblocksize 32:128 12:25:47 :: permittunnel no 12:25:47 :: ipqos lowdelay throughput 12:25:47 :: rekeylimit 0 0 12:25:47 :: permitopen any 12:25:47 :: permitlisten any 12:25:47 :: permituserenvironment no 12:25:47 :: pubkeyauthoptions none 12:25:47 :: [task check] </span><span class="gp">&lt;port is valid (22)&gt;</span><span class="w"> </span>True <span class="gp">&lt;ListenAddress found ([::]:22)&gt;</span><span class="w"> </span>True <span class="gp">&lt;PermitRootLogin not set&gt;</span><span class="w"> </span>False <span class="gp">&lt;PasswordAuthentication disabled&gt;</span><span class="w"> </span>True <span class="gp">&lt;PubkeyAuthentication enabled&gt;</span><span class="w"> </span>True <span class="gp">&lt;MaxAuthTries &lt;= 6 (6)&gt;</span><span class="w"> </span>True <span class="gp">&lt;MaxSessions &lt;= 10 (10)&gt;</span><span class="w"> </span>True <span class="gp">&lt;LoginGraceTime not found&gt;</span><span class="w"> </span>False <span class="gp">&lt;empty passwords forbidden&gt;</span><span class="w"> </span>True <span class="gp">&lt;X11Forwarding is yes&gt;</span><span class="w"> </span>False <span class="gp">&lt;ClientAliveInterval is 0 (should be &gt;</span>0<span class="o">)&gt;</span> False <span class="gp">&lt;ClientAliveCountMax 3 (&lt;=3)&gt;</span><span class="w"> </span>True <span class="gp">&lt;UseDNS disabled&gt;</span><span class="w"> </span>True <span class="gp">&lt;strong cipher present&gt;</span><span class="w"> </span>True <span class="gp">&lt;strong MAC present&gt;</span><span class="w"> </span>True <span class="gp">&lt;DH KEX found&gt;</span><span class="w"> </span>True <span class="gp">&lt;HostKey defined (/etc/ssh/ssh_host_rsa_key)&gt;</span><span class="w"> </span>True <span class="gp">&lt;SyslogFacility AUTH&gt;</span><span class="w"> </span>True <span class="gp">&lt;LogLevel INFO&gt;</span><span class="w"> </span>True <span class="gp">&lt;AllowUsers not set (open to all)&gt;</span><span class="w"> </span>False <span class="gp">&lt;AllowGroups not set&gt;</span><span class="w"> </span>False <span class="gp">&lt;sftp subsystem defined (/usr/lib/openssh/sftp-server)&gt;</span><span class="w"> </span>True <span class="gp">&lt;Banner file none&gt;</span><span class="w"> </span>True <span class="gp">&lt;neither AllowUsers nor AllowGroups is set&gt;</span><span class="w"> </span>False <span class="go">================= TASK CHECK FAIL </span></code></pre> </div> security devops linux rakulang Sp1983 Sat, 14 Feb 2026 13:11:55 +0000 https://dev.to/sp1983/dead-simple-ci-introduction-1jh6 https://dev.to/sp1983/dead-simple-ci-introduction-1jh6 <p><a href="http://deadsimpleci.sparrowhub.io/doc/README" rel="noopener noreferrer">Dsci</a> is a brand new kid on the cicd area. It allows use of general programming languages to create ci scenarios.</p> <p>——-</p> <p>Consider some imaginary case of building and deploying an application as docker container. So, logically we have two main stages:</p> <ul> <li><p>build docker image from source code </p></li> <li><p>deploy docker image using docker pull and docker run commands</p></li> </ul> <p>Let’s see how dsci could tackle such a scenario …</p> <p>——-</p> <h1> Pipeline file </h1> <p>The main concept we start with is so called ‘pipeline file’.</p> <p>It’s just yaml file containing a list of jobs to be performed. Every job is executed on isolated docker container, execution logic is always sequential - one job, by another.</p> <p>This pattern yet simple however covers the majority of use cases:</p> <p>jobs.yaml<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight yaml"><code><span class="na">jobs</span><span class="pi">:</span> <span class="pi">-</span> <span class="na">id</span><span class="pi">:</span> <span class="s">build</span> <span class="na">path</span><span class="pi">:</span> <span class="s">build/</span> <span class="pi">-</span> <span class="na">id</span><span class="pi">:</span> <span class="s">deploy</span> <span class="na">path</span><span class="pi">:</span> <span class="s">deploy/</span> </code></pre> </div> <p>Thus, every element of job list is a job, where job has some unique identifier and path to location of job file.</p> <h1> Conditional job logic </h1> <p>Usually there are some conditions when and what ci scripts are triggered. Those conditions may be based on different criteria, but usually they depend on branch names.</p> <p>Dsci utilizes a special syntax to define those rules. Let’s say we only want to deploy if source branch is main, and perform build for all branches:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight yaml"><code><span class="na">jobs</span><span class="pi">:</span> <span class="pi">-</span> <span class="na">id</span><span class="pi">:</span> <span class="s">build</span> <span class="na">path</span><span class="pi">:</span> <span class="s">build/</span> <span class="pi">-</span> <span class="na">id</span><span class="pi">:</span> <span class="s">deploy</span> <span class="na">path</span><span class="pi">:</span> <span class="s">deploy/</span> <span class="na">only</span><span class="pi">:</span> <span class="s">.&lt;ref&gt; eq "refs/heads/main"</span> </code></pre> </div> <p>Read more on job conditions on dsci documentation - <a href="https://github.com/melezhik/DSCI/blob/main/job-cond.md" rel="noopener noreferrer">https://github.com/melezhik/DSCI/blob/main/job-cond.md</a></p> <h1> Passing parameters to job </h1> <p>To pass parameters to job, just use <code>params:</code> key:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight yaml"><code><span class="na">jobs</span><span class="pi">:</span> <span class="pi">-</span> <span class="na">id</span><span class="pi">:</span> <span class="s">build</span> <span class="na">path</span><span class="pi">:</span> <span class="s">build/</span> <span class="na">params</span><span class="pi">:</span> <span class="na">foo</span><span class="pi">:</span> <span class="s">bar</span> <span class="na">version</span><span class="pi">:</span> <span class="s">0.1.0</span> <span class="pi">-</span> <span class="na">id</span><span class="pi">:</span> <span class="s">deploy</span> <span class="na">path</span><span class="pi">:</span> <span class="s">deploy/</span> </code></pre> </div> <p>Those parameters could be thought as overrides for default ones, however dsci allows more then that - pass results ( states ) from one job to another, see later.</p> <h1> Job file </h1> <p>The next important building block of the hierarchy is so called “job file” defining main job logic.</p> <p>Job file needs to be named depending on language of choice, in our example we use Bash as it usually is enough for many use cases. But using other languages is also possible. If one needs more flexibility they may chose Python or Golang</p> <p>build/task.bash<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="nv">version</span><span class="o">=</span><span class="si">$(</span>config version<span class="si">)</span> <span class="nv">tag_version</span><span class="o">=</span><span class="si">$(</span><span class="nb">date</span> +%s<span class="si">)</span>.<span class="nv">$version</span> docker build <span class="nb">.</span> <span class="nt">-t</span> app:<span class="nv">$tag_version</span> docker push repo/app:<span class="nv">$tag_version</span> </code></pre> </div> <p>In this simple example our job file is just a single task job. However if there is a need to split complex job into several tasks they may do so by using job.$ext file approach. This file needs to be named according language of choice. </p> <p>Let’s say we have three tasks - configure, build and test - incorporated into build job, we may run them one by one like this:</p> <p>build/job.py<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight python"><code><span class="c1">#!/bin/python </span><span class="nf">run_task</span><span class="p">(</span><span class="err">“</span><span class="n">configure</span><span class="err">”</span><span class="p">);</span> <span class="nf">run_task</span><span class="p">(</span><span class="err">“</span><span class="n">build</span><span class="err">”</span><span class="p">);</span> <span class="nf">run_task</span><span class="p">(</span><span class="err">“</span><span class="n">test</span><span class="err">”</span><span class="p">);</span> </code></pre> </div> <p>And if we put those tasks under build/tasks/ directory like this:</p> <p>build/tasks/configure/task.bash<br> build/tasks/build/tasks.bash<br> build/tasks/tests/task.bash</p> <p>In this case we have modular setup of our ci job. </p> <p>The neat thing about this DSL, dsci provides the same SDK for all supported programming languages.</p> <p>Read more about jobs and tasks on dsci documentation web site:</p> <ul> <li><p><a href="http://deadsimpleci.sparrowhub.io/doc/task" rel="noopener noreferrer">http://deadsimpleci.sparrowhub.io/doc/task</a></p></li> <li><p><a href="http://deadsimpleci.sparrowhub.io/doc/job" rel="noopener noreferrer">http://deadsimpleci.sparrowhub.io/doc/job</a></p></li> </ul> <h1> Passing results between jobs </h1> <p>Let’s make our last job example more realistic and return docker image tag dynamically created by build job back to deploy job. We may want to do so deploy jobs know what tag to pull before deploy. All we need is to add extra line to save the job state into internal dsci cache:</p> <p>build/task.bash<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="nv">version</span><span class="o">=</span><span class="si">$(</span>config version<span class="si">)</span> <span class="nv">tag_version</span><span class="o">=</span><span class="si">$(</span><span class="nb">date</span> +%s<span class="si">)</span>.<span class="nv">$version</span> docker build <span class="nb">.</span> <span class="nt">-t</span> app:<span class="nv">$tag_version</span> docker push repo/app:<span class="nv">$tag_version</span> update_state tag <span class="nv">$tag_version</span> </code></pre> </div> <p>update_state() is very handy function allowing to pass states between different tasks and jobs. It’s implemented for all supported languages.</p> <p>To pick up tag name in deploy job we can use already mentioned config() function:</p> <p>deploy/task.bash<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="nb">set</span> <span class="nt">-e</span> <span class="nv">tag</span><span class="o">=</span><span class="si">$(</span>config tag<span class="si">)</span> docker pull repo/app@<span class="nv">$tag</span> docker stop <span class="nt">-t</span> 1 container <span class="o">||</span> : docker run <span class="nt">-rm</span> <span class="nt">-name</span> container <span class="nt">-td</span> repo/app@<span class="nv">$tag</span> </code></pre> </div> <p>Read more about job and tasks states on dsci documentation ( the links above ^^ )</p> <h1> Secrets </h1> <p>Let’s modify build job example with pushing image to docker registry. To do a push we need to authenticate against a docker registry first. Dsci enables simple way to pass secrets to pipelines.</p> <p>This time let’s rewrite our job file on Python for convenience:</p> <p>build/job.py<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight python"><code><span class="c1">#!/bin/python </span><span class="kn">import</span> <span class="n">os</span> <span class="n">password</span> <span class="o">=</span> <span class="n">os</span><span class="p">.</span><span class="n">environ</span><span class="p">[</span><span class="sh">'</span><span class="s">password</span><span class="sh">'</span><span class="p">])</span> <span class="nf">run_task</span><span class="p">(</span><span class="err">“</span><span class="n">build</span><span class="err">”</span><span class="p">,</span> <span class="p">{</span> <span class="err">“</span><span class="n">password</span><span class="err">”</span><span class="p">:</span> <span class="n">password</span> <span class="p">})</span> </code></pre> </div> <p>And then modify build task to handle password parameter:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="nv">version</span><span class="o">=</span><span class="si">$(</span>config version<span class="si">)</span> <span class="nv">tag_version</span><span class="o">=</span><span class="si">$(</span><span class="nb">date</span> +%s<span class="si">)</span>.<span class="nv">$version</span> docker build <span class="nb">.</span> <span class="nt">-t</span> app:<span class="nv">$tag_version</span> update_state tag <span class="nv">$tag_version</span> <span class="nb">echo</span> <span class="nv">$password</span> | docker login <span class="nt">--username</span> your-username <span class="nt">--password-stdin</span> docker push repo/app:<span class="nv">$tag_version</span> </code></pre> </div> <p>As we can see secrets passed into pipelines as environment variables.</p> <p>And unlike other task and jobs parameters they never saved in job reports or cache files. </p> <p>—-</p> <h1> Deployment on localhost </h1> <p>By default dsci pipelines run inside some docker container, this fits situation when one needs run purely ci code - for example build and run some unit tests. CD part comes to play when build artifacts are ready for deploy. </p> <p>Dsci allows switch to deployment environment by using <code>localhost</code> switcher:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight yaml"><code><span class="na">jobs</span><span class="pi">:</span> <span class="pi">-</span> <span class="na">id</span><span class="pi">:</span> <span class="s">build</span> <span class="na">path</span><span class="pi">:</span> <span class="s">build/</span> <span class="na">params</span><span class="pi">:</span> <span class="na">foo</span><span class="pi">:</span> <span class="s">bar</span> <span class="na">version</span><span class="pi">:</span> <span class="s">0.1.0</span> <span class="pi">-</span> <span class="na">id</span><span class="pi">:</span> <span class="s">deploy</span> <span class="na">path</span><span class="pi">:</span> <span class="s">deploy/</span> <span class="na">localhost</span><span class="pi">:</span> <span class="kc">true</span> </code></pre> </div> <p>In that case deployment occurs on VM running dsci orchestrator and which allows to restart docker container with new image version right on VM</p> <p>——-</p> <p>That is it. </p> <p>This simple but real life example shows how easy and one can write cicd pipelines using dsci framework and how flexible it is.</p> <p>Hopefully you like it. </p> <p>—-</p> <p>For comprehensive documentation and more information please visit dsci web site - <a href="http://deadsimpleci.sparrowhub.io/doc/README" rel="noopener noreferrer">http://deadsimpleci.sparrowhub.io/doc/README</a></p> cicd pipelines forgejo Sp1983 Thu, 08 Jan 2026 12:54:15 +0000 https://dev.to/sp1983/dtap-super-simple-testing-protocol-for-infrastructure-audit-2l45 https://dev.to/sp1983/dtap-super-simple-testing-protocol-for-infrastructure-audit-2l45 <p><a href="http://doubletap.sparrowhub.io" rel="noopener noreferrer">DTAP</a> is a new testing protocol allowing to test infrastructure with just a Bash scripts. Here is a quick example, let's test that <code>/etc/dhcp/</code> directory and <code>/etc/dhcpcd.conf</code> file exists:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!/bin/bash</span> <span class="nv">session</span><span class="o">=</span><span class="si">$(</span><span class="nb">date</span> +%s<span class="si">)</span> <span class="nb">ls</span> /etc/dhcp/ 2&gt;&amp;1 | dtap <span class="nt">--box</span> - <span class="se">\</span> <span class="nt">--session</span> <span class="nv">$session</span> <span class="se">\</span> <span class="nt">--params</span> <span class="nv">path</span><span class="o">=</span>/etc/dhcp/ <span class="se">\</span> <span class="nt">--check</span> path-ok <span class="se">\</span> <span class="nt">--desc</span> <span class="s2">"dhcp/ dir"</span> <span class="nb">ls</span> /etc/dhcpcd.conf 2&gt;&amp;1 | dtap <span class="nt">--box</span> - <span class="se">\</span> <span class="nt">--session</span> <span class="nv">$session</span> <span class="se">\</span> <span class="nt">--params</span> <span class="nv">path</span><span class="o">=</span>/etc/dhcpcd.conf <span class="se">\</span> <span class="nt">--check</span> path-ok <span class="se">\</span> <span class="nt">--desc</span> <span class="s2">"dhcpcd.conf file"</span> dtap <span class="nt">--report</span> <span class="nt">--session</span> <span class="nv">$session</span> </code></pre> </div> <p>The result will be:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>DTAP report session: 1767875428 === dhcp/ dir ...... OK dhcpcd.conf file ...... OK </code></pre> </div> <p>Plain and simple</p> <p>As one can see test scripts are just plain Bash commands, no fancy YAML or even high level programming languages.</p> <p>Also DTAP follows WYSIWYG principle when we get exactly what we see, in a sense this is something we would do trying to check existence of the mentioned directory and file:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>ls /etc/dhcp/ ls /etc/dhcpcd.conf </code></pre> </div> <p>And if any errors occurr we will get exactly what we are asking for - output of <code>ls</code> command which most of the Linux users probably are familiar with:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="o">!</span>/bin/bash <span class="nb">ls</span> /etc/does-not-exist 2&gt;&amp;1 | dtap <span class="nt">--box</span> - <span class="se">\</span> <span class="nt">--session</span> <span class="nv">$session</span> <span class="se">\</span> <span class="nt">--params</span> <span class="nv">path</span><span class="o">=</span>/etc/does-not-exist <span class="se">\</span> <span class="nt">--check</span> path-ok <span class="se">\</span> <span class="nt">--desc</span> <span class="s2">"/etc/does-not-exist dir"</span> </code></pre> </div> <p>Output:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>DTAP report session: 1767875841 === /etc/does-not-exist dir ...... FAIL [report] 15:37:22 :: [sparrowtask] - run sparrow task .@path=/etc/does-not-exist 15:37:22 :: [sparrowtask] - run [.], thing: .@path=/etc/does-not-exist [task run: task.bash - .] [task stdout] 15:37:23 :: ls: cannot access '/etc/does-not-exist': No such file or directory [task check] stdout match &lt;^^ "/etc/does-not-exist" $$&gt; False ================= TASK CHECK FAIL 2 </code></pre> </div> <p>How this works?</p> <p>There are two essentials primitives in DTAP:</p> <ul> <li><p>boxes</p></li> <li><p>and - checks</p></li> </ul> <p>Box is an abstraction for everything we want to test - from web server to messages in syslog files. Boxes produces some output to be checked against check rules ( aka checks ). In the previous examples - boxe is just <code>ls</code> command which output redirected to a certain check rule via <code>--box -</code> notation ( meaning read box output from STDIN ). DTAP comes with some predefined boxes user can use them without writing any piece of code, but most of the time boxes - are something a user would write as a chain of Bash commands something likes that:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!/bin/bash</span> <span class="o">(</span> 2&gt;&amp;1 cmd1<span class="p">;</span> cmd2<span class="p">;</span> cmd3<span class="p">;</span> <span class="c"># ...</span> <span class="o">)</span> | tap <span class="nt">--box</span> - </code></pre> </div> <p>Or with a single script:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!/bin/bash</span> <span class="nb">.</span> /some/box/script.sh | tap <span class="nt">--box</span> - </code></pre> </div> <p>Checks are rules written on formal <a href="https://github.com/melezhik/Sparrow6/blob/master/documentation/taskchecks.md" rel="noopener noreferrer">DSL</a> and executed remotely on DTAP server, so users don't need to install anything, only small <a href="http://doubletap.sparrowhub.io/install" rel="noopener noreferrer">tap binary</a> written on golang that interacts with a server send output from boxes to a server and get results back. Checks DSL is based on regular expressions and is super flexible, allowing many things to do including extension by using many general programming languages. </p> <p>As an example if you look inside <a href="https://github.com/melezhik/doubletap/blob/main/checks/path-ok/task.check" rel="noopener noreferrer">path-ok</a> check that verifies file/directory existence you'll see something like this:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>generator: &lt;&lt;OK !bash echo "regexp: ^^ \"$(config path)\" \$\$" OK </code></pre> </div> <p>To list available checks just run:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>tap <span class="nt">--check_list</span> </code></pre> </div> <p>Follow double tap web site <a href="http://doubletap.sparrowhub.io/checks" rel="noopener noreferrer">documentation</a> to get details on using available checks.</p> <p>It's easy to create new checks and add them to DTAP distribution, if you are instead please let me know. There is quick start introduction into check DSL could be found <a href="https://git.resf.org/testing/sparrow_task_check_quick_start/src/branch/main" rel="noopener noreferrer">here</a></p> <p>Conclusion.</p> <p>DTAP is a new kid on the block, that allows to test infrastructure with using just a Bash yet very flexible and powerful. I encourage you to play with it, you can start with <a href="http://doubletap.sparrowhub.io/install" rel="noopener noreferrer">installation</a> guide</p> <p>Thanks for reading </p> testing inspec infrastructure devops Sp1983 Wed, 23 Jul 2025 14:30:07 +0000 https://dev.to/sp1983/raku-sparrow6-swiss-army-knife-for-alpine-linux-2ngh https://dev.to/sp1983/raku-sparrow6-swiss-army-knife-for-alpine-linux-2ngh <p><a href="https://github.com/melezhik/Sparrow6" rel="noopener noreferrer">Sparrow</a> is a Rakulang based framework that allows to automate routine tasks, the beauty of it - one can use prepacked plugins available from public Sparrow repository - <a href="https://sparrowhub.io" rel="noopener noreferrer">https://sparrowhub.io</a></p> <h2> Install Sparrow framework </h2> <p>Sparrow is installed as native Alpine package:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="nb">sudo </span>apk add <span class="se">\</span> <span class="nt">--no-cache</span> <span class="nt">--wait</span> 120 <span class="nt">-u</span> <span class="se">\</span> <span class="nt">--repository</span><span class="o">=</span>http://dl-cdn.alpinelinux.org/alpine/edge/community <span class="se">\</span> raku-sparrow6 </code></pre> </div> <p>Set up plugins repository<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="nb">export </span><span class="nv">SP6_REPO</span><span class="o">=</span>http://sparrowhub.io/repo s6 <span class="nt">--index-update</span> </code></pre> </div> <h2> Search alpine plugins </h2> <p>Sparrowhub has a lot of plugins, to limit search to Alpine related plugins:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>s6 <span class="nt">--search</span> alpine </code></pre> </div> <p>There are now not too many of them for Alpine, eventually I am going to add more, put in comments what sort of plugins one would like to see</p> <h2> Run plugin </h2> <p>To run plugin, use Sparrow cli, you can also pass parameters to a plugin. For example, to validate APKBUILD file one can use <code>apkbuild-strict</code> plugin:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>s6 <span class="nt">--plg-run</span> apkbuild-strict@path<span class="o">=</span>/path/to/apkbuild/file </code></pre> </div> <p>That way Sparrow plugins could be run from terminal or get inlined into shell scripts</p> <h2> Conclusion </h2> <p>It'd be great to hear feedback from (Alpine) users, what sort of tasks could be implemented by Sparrow</p> <h2> Credits </h2> <p>Kudos to <a href="https://pkgs.alpinelinux.org/packages?name=&amp;branch=edge&amp;repo=&amp;arch=&amp;maintainer=Celeste" rel="noopener noreferrer">Celeste</a> - Alpine maintainer for raku-sparrow6 Alpine package creation </p> sparrow rakulang alpine linux Sp1983 Thu, 30 Jan 2025 08:53:50 +0000 https://dev.to/sp1983/validating-config-files-with-raku-and-sparrow-taskcheck-dsl-1ekp https://dev.to/sp1983/validating-config-files-with-raku-and-sparrow-taskcheck-dsl-1ekp <p>In real world we have a lot of pure structured or structured in hard to parse formats configuration files:</p> <p><code>/etc/default/nginx</code>, <code>/etc/default/grub</code>, <code>logrotate.conf</code>, <code>sysctl.conf</code> - to name a few. </p> <p>In configuration management it's not only important to maintain specific configurations but also validate those changes to make it sure we don't break things.</p> <p>Sparrow - is an automation tool written on Raku that allow to make such a validation by leveraging Task::Check DSL rules which underneath are just Raku regular expressions.</p> <p>In the rest of this post we take a look at real life example.</p> <h1> Grub </h1> <p>Consider linux GRUB boot loader file <code>/etc/default/grub</code> with following configuration:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>GRUB_DEFAULT=0 #GRUB_HIDDEN_TIMEOUT=0 GRUB_HIDDEN_TIMEOUT_QUIET=true GRUB_TIMEOUT=2 GRUB_DISTRIBUTOR=`lsb_release -i -s 2&gt; /dev/null || echo Debian` GRUB_CMDLINE_LINUX_DEFAULT="rootfstype=ext4 quiet splash acpi_osi=" GRUB_CMDLINE_LINUX="" GRUB_ENABLE_CRYPTODISK=true # Uncomment to enable BadRAM filtering, modify to suit your needs # This works with Linux (no patch required) and with any kernel that obtains # the memory map information from GRUB (GNU Mach, kernel of FreeBSD ...) #GRUB_BADRAM="0x01234567,0xfefefefe,0x89abcdef,0xefefefef" # Uncomment to disable graphical terminal (grub-pc only) #GRUB_TERMINAL=console # The resolution used on graphical terminal # note that you can use only modes which your graphic card supports via VBE # you can see them in real GRUB with the command `vbeinfo' #GRUB_GFXMODE=640x480 # Uncomment if you don't want GRUB to pass "root=UUID=xxx" parameter to Linux #GRUB_DISABLE_LINUX_UUID=true # Uncomment to disable generation of recovery mode menu entries #GRUB_DISABLE_RECOVERY="true" # Uncomment to get a beep at grub start #GRUB_INIT_TUNE="480 440 1" GRUB_DISABLE_OS_PROBER="true" </code></pre> </div> <p>Though configuration format is quite simple, based on VAR=value semantics, it still allows some freedom in specification. </p> <p>For example to enable variables we could use one of many forms - <code>yes/"yes"</code>, <code>true/"true"</code> and just <code>1</code>. Another challenge is to check that some variable are disabled - they might be just commented or “switched off” via negation form, e.g. VAR=0,false,""</p> <p>As rigorous operations we want to validate a couple of things:</p> <ul> <li><p>Boot on crypted disks is supported by setting GRUB_ENABLE_CRYPTODISK to one of the values: <code>1,yes,true</code> and optional quoted form - <code>"yes","true"</code></p></li> <li><p>OS prober capability is disabled or in other words GRUB_DISABLE_OS_PROBER is not set by using any of forms - <code>1,yes,true,"yes","true"</code> </p></li> </ul> <p>Before go parsing let's create simple Raku program (Sparrow task), that dumps out configuration removing empty and commented lines, the whole output will be placed inside <code>&gt;&gt;&gt;</code>, <code>&lt;&lt;&lt;</code> markers for visibility:</p> <p>task.raku<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight perl"><code><span class="c1">#!raku</span> <span class="k">my</span> <span class="nv">$path</span> <span class="o">=</span> <span class="nv">config</span><span class="p">()</span><span class="o">&lt;</span><span class="nv">path</span><span class="o">&gt;</span><span class="p">;</span> <span class="nv">say</span> <span class="p">"</span><span class="s2">validate config {</span><span class="si">$path</span><span class="s2">} ...</span><span class="p">";</span> <span class="nv">say</span> <span class="p">"</span><span class="s2">&gt;&gt;&gt;</span><span class="p">";</span> <span class="k">my</span> <span class="nv">@out</span><span class="p">;</span> <span class="k">for</span> <span class="nv">$path</span><span class="o">.</span><span class="nv">IO</span><span class="o">.</span><span class="nv">lines</span> <span class="o">-&gt;</span> <span class="nv">$i</span> <span class="p">{</span> <span class="nv">$i</span><span class="o">.</span><span class="nb">chomp</span><span class="p">;</span> <span class="k">next</span> <span class="k">unless</span> <span class="nv">$i</span> <span class="o">~~</span> <span class="sr">/\S+/</span><span class="p">;</span> <span class="nv">@out</span><span class="o">.</span><span class="nb">push</span><span class="p">(</span><span class="nv">$i</span><span class="p">)</span> <span class="k">unless</span> <span class="nv">$i</span> <span class="o">~~</span> <span class="sr">/^ \s* '#'/</span><span class="p">;</span> <span class="p">};</span> <span class="nv">say</span> <span class="nb">sort</span><span class="p">(</span><span class="nv">@out</span><span class="p">)</span><span class="o">.</span><span class="nb">join</span><span class="p">("</span><span class="se">\n</span><span class="p">");</span> <span class="nv">say</span> <span class="p">"</span><span class="s2">&lt;&lt;&lt;</span><span class="p">";</span> </code></pre> </div> <p>Now let's write verification scenario by creating rules in Sparrow::Task::Check DSL format:</p> <p>task.check<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>note: validate config between: {'&gt;&gt;&gt;'} {'&lt;&lt;&lt;'} note: allow to boot on crypted disks regexp: ^^ \s* "GRUB_ENABLE_CRYPTODISK=" (&lt;[y 1 true]&gt; | '"true"' | '"yes"' ) note: never allow to enable os prober !regexp: ^^ \s* "GRUB_DISABLE_OS_PROBER=" (&lt;[y 1 true]&gt; | '"true"' | '"yes"' ) end: </code></pre> </div> <p>The DSL code has there major parts:</p> <ul> <li><code>between: {'&gt;&gt;&gt;'} {'&lt;&lt;&lt;'}</code></li> </ul> <p>Setting a context for a search in between <code>&gt;&gt;&gt;</code> ... <code>&lt;&lt;&lt;</code> delimiter, this is an example of so called <em>search context modifiers</em>, in this case - Range modifier. </p> <p>In other words this is precaution that we only search within specific boundaries of text output</p> <ul> <li> <code>regexp: ^^ \s* "GRUB_ENABLE_CRYPTODISK=" (&lt;[y 1 true]&gt; | '"true"' | '"yes"' )</code> </li> </ul> <p>Verifying that we have <code>GRUB_ENABLE_CRYPTODISK</code> set to one of values (y,1,true,"true","yes"). </p> <p><code>regexp:</code> marker means Raku regular expression is used for validation.</p> <ul> <li><code>note: never allow to enable os prober !regexp: ^^ \s* "GRUB_DISABLE_OS_PROBER=" (&lt;[y 1 true]&gt; | '"true"' | '"yes"' )</code></li> </ul> <p>Verifying we DON'T(*) have <code>GRUB_ENABLE_CRYPTODISK</code> set to one of values (y,1,true,"true","yes"), in other words that GRUB_ENABLE_CRYPTODISK is disabled. </p> <p>(*) <code>!</code> sign before <code>regexp:</code> marker means negation logic.</p> <p><code>Note:</code> expressions are human readable comments that are showed up in a report to help us correlate every check to business logic</p> <h1> Test report </h1> <p>Now let's run our script and get a result of test. As this is Sparrow scenario, we use <code>s6</code> - Sparrow CLI runner:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!bash</span> s6 <span class="nt">--task-run</span> .@path<span class="o">=</span>/etc/default/grub </code></pre> </div> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>14:09:20 :: [sparrowtask] - run sparrow task .@path=/etc/default/grub 14:09:20 :: [sparrowtask] - run thing . [task run: task.raku - .] [task stdout] 14:09:21 :: validate config examples/grub ... 14:09:21 :: &gt;&gt;&gt; 14:09:21 :: GRUB_CMDLINE_LINUX="" 14:09:21 :: GRUB_CMDLINE_LINUX_DEFAULT="rootfstype=ext4 quiet splash acpi_osi=" 14:09:21 :: GRUB_DEFAULT=0 14:09:21 :: GRUB_DISABLE_OS_PROBER="true" 14:09:21 :: GRUB_DISTRIBUTOR=`lsb_release -i -s 2&gt; /dev/null || echo Debian` 14:09:21 :: GRUB_ENABLE_CRYPTODISK=true 14:09:21 :: GRUB_HIDDEN_TIMEOUT_QUIET=true 14:09:21 :: GRUB_TIMEOUT=2 14:09:21 :: &lt;&lt;&lt; [task check] # validate config # allow to boot on crypted disks stdout match (r) &lt;^^ \s* "GRUB_ENABLE_CRYPTODISK=" (&lt;[y 1 true]&gt; | '"true"' | '"yes"' )&gt; True # never allow to enable os prober stdout match (r) &lt;!^^ \s* "GRUB_DISABLE_OS_PROBER=" (&lt;[y 1 true]&gt; | '"true"' | '"yes"' )&gt; False ================= TASK CHECK FAIL </code></pre> </div> <ul> <li><em>PS for colorful report please click <a href="https://pasteboard.co/grlUKxSkrGYf.jpg" rel="noopener noreferrer">here</a></em></li> </ul> <p>Expectedly we have following results:</p> <ul> <li>GRUB_ENABLE_CRYPTODISK check passed</li> <li>GRUB_DISABLE_OS_PROBER fails </li> </ul> <p>Pretty impressive results considering such a little amount of code has been written!</p> <p>Sparrow <a href="https://github.com/melezhik/Sparrow6/blob/master/documentation/taskchecks.md" rel="noopener noreferrer">Task::Check</a>s is comprehensive and super flexible tool allowing one to write validation scenarios for arbitrary data formats and complexity, check out documentation pages to know more.</p> <p>That is it. Thanks for reading </p> rakulang linux grub data Sp1983 Fri, 24 Jan 2025 09:16:01 +0000 https://dev.to/sp1983/useful-terminal-plugins-to-build-golang-code-gj0 https://dev.to/sp1983/useful-terminal-plugins-to-build-golang-code-gj0 <p>Recently, I've released 2 new Sparrow plugins to help build Golang code:</p> <ul> <li><a href="https://sparrowhub.io/plugin/go-build/0.000001" rel="noopener noreferrer">go-build</a></li> </ul> <p><em>Simple golang code builder</em></p> <ul> <li><a href="https://sparrowhub.io/plugin/go-format/0.000001" rel="noopener noreferrer">go-format</a></li> </ul> <p><em>Golang code formatter</em></p> <p>They are simple yet useful, providing two essentials tools to build Golang code in terminal:</p> <ul> <li><p>Build code</p></li> <li><p>Format code</p></li> </ul> <p>The rest of the post shows how to use the plugins</p> <h1> Installation </h1> <p>To install plugins we need to use <a href="https://github.com/melezhik/Tomtit" rel="noopener noreferrer">Tomtit</a> task runner with profiles - preset of Raku scenarios that grouped by topics:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!bash</span> <span class="nb">cd</span> /to/you/source/code tom <span class="nt">--init</span> <span class="c"># initialize Tomtit for the first time</span> tom <span class="nt">--profile</span> go <span class="c"># install go profile scenarios</span> </code></pre> </div> <p>Now once we've installed <code>go</code> profile, we have an access to <code>go-build</code> and <code>go-format</code> scenarios which are just a Raku wrappers to run mentioned plugins. Code is simple enough and editable to adjust your project specific needs</p> <p>Go-build scenario:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!bash</span> tom <span class="nt">--cat</span> go-build </code></pre> </div> <div class="highlight js-code-highlight"> <pre class="highlight perl"><code><span class="c1">#!raku</span> <span class="k">my</span> <span class="nv">$path</span> <span class="o">=</span> <span class="p">[</span> <span class="p">"</span><span class="s2">cmd/app/main.go</span><span class="p">",</span> <span class="p">"</span><span class="s2">cmd/cli/cli.go</span><span class="p">"</span> <span class="p">];</span> <span class="nv">task</span><span class="o">-</span><span class="nv">run</span> <span class="p">"</span><span class="s2">build</span><span class="p">",</span> <span class="p">"</span><span class="s2">go-build</span><span class="p">",</span> <span class="o">%</span><span class="p">(</span> <span class="p">:</span><span class="nv">$path</span><span class="p">,</span> <span class="p">);</span> </code></pre> </div> <p>Go-format scenario:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!bash</span> tom <span class="nt">--cat</span> go-format </code></pre> </div> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!bash</span> task-run <span class="s2">"go format"</span>, <span class="s2">"go-format"</span><span class="p">;</span> </code></pre> </div> <h1> Customization </h1> <p>In case of <code>go-build</code> scenario - adjust <code>path</code> array with files to build for your project specific:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!bash</span> <span class="nb">export </span><span class="nv">EDITOR</span><span class="o">=</span>nano tom <span class="nt">--edit</span> go-build </code></pre> </div> <div class="highlight js-code-highlight"> <pre class="highlight perl"><code><span class="c1">#!raku</span> <span class="k">my</span> <span class="nv">$path</span> <span class="o">=</span> <span class="p">[</span> <span class="p">"</span><span class="s2">cmd/app/app.go</span><span class="p">",</span> <span class="p">"</span><span class="s2">cmd/app2/app2.go</span><span class="p">",</span> <span class="p">];</span> <span class="c1"># the rest of the code stays the same </span> </code></pre> </div> <h1> Run </h1> <p>To run plugins - use <code>tom</code> cli runner:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>#!bash tom go-build 11:56:26 :: go build cmd/main.go 11:56:27 :: cmd/main.go </code></pre> </div> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>#!bash tom go-format 11:57:18 :: cmd/main.go </code></pre> </div> <p>That is it. </p> <p>Follow plugins <a href="https://sparrowhub.io/search?q=%27go-%27" rel="noopener noreferrer">documentation</a> to get familiar with plugins parameters.</p> <p>Thanks for reading </p> rakulang raku go Sp1983 Thu, 23 Jan 2025 20:21:22 +0000 https://dev.to/sp1983/simple-find-in-source-code-with-tomtit-and-sparrow-312 https://dev.to/sp1983/simple-find-in-source-code-with-tomtit-and-sparrow-312 <p>Recently, I've released a simple Sparrow plugin called <a href="https://sparrowhub.io/plugin/find/0.000007" rel="noopener noreferrer">find</a> to search text in source code, which is based on find and grep core linux utilities.</p> <p>The rest of the document shows how to perform search in terminal by using <a href="https://github.com/melezhik/Tomtit" rel="noopener noreferrer">Tomtit</a> task runner.</p> <h1> Installation </h1> <p>To install the plugin, we need to use Tomtit task runner with profiles - preset of Raku scenarios that grouped by topics:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!bash</span> <span class="nb">cd</span> /to/you/source/code tom <span class="nt">--init</span> <span class="c"># initialize Tomtit for the first time</span> tom <span class="nt">--profile</span> code <span class="c"># install code profile scenarios</span> </code></pre> </div> <p>Now once we've installed <code>code</code> profile scenarios (for now it's just a single one), we have an access to <code>search</code> scenario which is just a Raku wrapper to do search with <code>find</code> plugin:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!bash</span> tom <span class="nt">--cat</span> search </code></pre> </div> <div class="highlight js-code-highlight"> <pre class="highlight perl"><code><span class="c1">#!raku</span> <span class="k">my</span> <span class="nv">$ext</span> <span class="o">=</span> <span class="nv">prompt</span><span class="p">("</span><span class="s2">ext (go): </span><span class="p">");</span> <span class="nv">$ext</span> <span class="o">=</span> <span class="p">"</span><span class="s2">go</span><span class="p">"</span> <span class="k">unless</span> <span class="nv">$ext</span><span class="p">;</span> <span class="k">my</span> <span class="nv">$search1</span> <span class="o">=</span> <span class="nv">prompt</span><span class="p">("</span><span class="s2">search1: </span><span class="p">");</span> <span class="k">my</span> <span class="nv">$search2</span> <span class="o">=</span> <span class="nv">prompt</span><span class="p">("</span><span class="s2">search2: </span><span class="p">");</span> <span class="k">my</span> <span class="nv">$exclude</span> <span class="o">=</span> <span class="nv">prompt</span><span class="p">("</span><span class="s2">exclude: </span><span class="p">");</span> <span class="nv">say</span> <span class="p">"</span><span class="s2">find [</span><span class="si">$search1</span><span class="s2">] [</span><span class="si">$search2</span><span class="s2">] !</span><span class="si">$exclude</span><span class="s2"> in </span><span class="si">$ext</span><span class="p">";</span> <span class="nv">task</span><span class="o">-</span><span class="nv">run</span> <span class="p">"</span><span class="s2">find </span><span class="si">$search1</span><span class="s2"> </span><span class="si">$search2</span><span class="s2"> in </span><span class="si">$ext</span><span class="p">",</span> <span class="p">"</span><span class="s2">find</span><span class="p">",</span> <span class="o">%</span><span class="p">(</span> <span class="p">:</span><span class="nv">$ext</span><span class="p">,</span> <span class="p">:</span><span class="nv">$search1</span><span class="p">,</span> <span class="s">search2</span> <span class="o">=&gt;</span> <span class="nv">$search2</span> <span class="o">||</span> <span class="p">"",</span> <span class="s">exclude</span> <span class="o">=&gt;</span> <span class="nv">$exclude</span> <span class="o">||</span> <span class="p">"",</span> <span class="p">);</span> </code></pre> </div> <p>The logic is following:</p> <p>‘search1’ filters results out by first string and then ‘search2’ filter is applied for final results, ‘ext’ defines files extension to search.</p> <h1> Customization </h1> <p>Stub code shipped with Tomtit profile is good enough, we only need to change it a bit, to make default choice for file extenstion suitable for Raku project:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!bash</span> <span class="nb">export </span><span class="nv">EDITOR</span><span class="o">=</span>nano tom <span class="nt">--edit</span> search </code></pre> </div> <div class="highlight js-code-highlight"> <pre class="highlight perl"><code><span class="c1">#!raku</span> <span class="k">my</span> <span class="nv">$ext</span> <span class="o">=</span> <span class="nv">prompt</span><span class="p">("</span><span class="s2">ext (rakumod): </span><span class="p">");</span> <span class="nv">$ext</span> <span class="o">=</span> <span class="p">"</span><span class="s2">rakumod</span><span class="p">"</span> <span class="k">unless</span> <span class="nv">$ext</span><span class="p">;</span> <span class="c1"># ... the rest of the code is the same</span> </code></pre> </div> <h1> Search </h1> <p>Now let's search files in my <a href="https://github.com/melezhik/Tomtit" rel="noopener noreferrer">Tomtit</a> repository. Say, I want to find all exported functions.<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!bash</span> tom search </code></pre> </div> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>load configuration from /home/melezhik/projects/Tomtit/.tom/env/config.raku ext (rakumod): search1: sub search2: is export exclude: find [sub] [is export] ! in rakumod 23:09:06 :: find [sub] [is export] [!] in *.rakumod 23:09:06 :: === 23:09:06 :: find . -name *.rakumod -exec grep --color -H 'sub' {} \; | grep 'is export' 23:09:06 :: case2 23:09:06 :: ./lib/Tomtit/Completion.rakumod:sub complete () is export { 23:09:06 :: ./lib/Tomtit.rakumod:our sub check-if-init ( $dir ) is export { 23:09:06 :: ./lib/Tomtit.rakumod:our sub init ($dir) is export { 23:09:06 :: ./lib/Tomtit.rakumod:our sub load-conf () is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub tomtit-usage () is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub tomtit-help () is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub tomtit-clean ($dir) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub scenario-last ($dir) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub scenario-run ($dir,$scenario,%args?) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub scenario-remove ($dir,$scenario) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub scenario-cat ($dir,$scenario,%args?) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub scenario-edit ($dir,$scenario) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub environment-edit ($dir,$env) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub environment-list ($dir) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub environment-set ($dir,$env) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub environment-show ($dir) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub environment-cat ($dir,$env,%args?) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub scenario-doc ($dir,$scenario) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub scenario-list ($dir) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub scenario-list-print ($dir) is export { 23:09:06 :: ./lib/Tomtit.rakumod:multi sub profile-list is export { 23:09:06 :: ./lib/Tomtit.rakumod:multi sub profile-list($dir,$profile is copy) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub profile-install ($dir, $profile is copy, %args?) is export { 23:09:06 :: ./lib/Tomtit.rakumod:sub completion-install () is export { </code></pre> </div> <p>That is it. Follow plugin <a href="https://sparrowhub.io/plugin/find/0.000007" rel="noopener noreferrer">documentation</a> to get familiar with plugin parameters.</p> <p>Thanks for reading</p> search raku rakulang sparrow Sp1983 Mon, 20 Jan 2025 14:27:08 +0000 https://dev.to/sp1983/developing-a-simple-sparrow-plugin-with-raku-and-bash-51g0 https://dev.to/sp1983/developing-a-simple-sparrow-plugin-with-raku-and-bash-51g0 <p>Sparrow is very efficient in writing scripts to automate system management using Raku and Bash, in today's post I am going to show an example ...</p> <h2> Deploy configuration file and restart service upon changes </h2> <p>Let's create a simple plugin that enable / disable some configuration flags in service configuration file and if any changes occur reload a service. Format of flags in configuration file is following:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>var=true|false </code></pre> </div> <p>Here is an example of configuration file:</p> <p><code>config.txt</code><br> </p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>debug=true sentry=false tls=false </code></pre> </div> <p>Usually services are managed as systemd units, so <code>service reload</code> could be used to reload service configuration.</p> <p>——</p> <p>Let’s get started and create root folder for the plugin:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!bash</span> <span class="nb">mkdir</span> <span class="nt">-p</span> service-config-reload <span class="nb">cd </span>service-config-reload </code></pre> </div> <p>Now inside plugin root directory:</p> <p><code>hook.raku</code>:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight perl"><code><span class="c1">#!raku</span> <span class="k">my</span> <span class="nv">$cfg</span><span class="o">-</span><span class="nv">orig</span> <span class="o">=</span> <span class="nv">config</span><span class="p">()</span><span class="o">&lt;</span><span class="nv">path</span><span class="o">&gt;.</span><span class="nv">IO</span><span class="o">.</span><span class="nv">slurp</span><span class="p">();</span> <span class="k">my</span> <span class="nv">$cfg</span> <span class="o">=</span> <span class="nv">$cfg</span><span class="o">-</span><span class="nv">orig</span><span class="p">;</span> <span class="k">for</span> <span class="nv">config</span><span class="p">()</span><span class="o">&lt;</span><span class="nv">enable</span><span class="o">&gt;&lt;&gt;</span> <span class="o">-&gt;</span> <span class="nv">$f</span> <span class="p">{</span> <span class="nv">$cfg</span> <span class="o">~~</span> <span class="sr">s/&lt;?wb&gt; "$f=" \S+ /$f=true/</span><span class="p">;</span> <span class="p">}</span> <span class="k">for</span> <span class="nv">config</span><span class="p">()</span><span class="o">&lt;</span><span class="nv">disable</span><span class="o">&gt;&lt;&gt;</span> <span class="o">-&gt;</span> <span class="nv">$f</span> <span class="p">{</span> <span class="nv">$cfg</span> <span class="o">~~</span> <span class="sr">s/&lt;?wb&gt; "$f=" \S+ /$f=false/</span><span class="p">;</span> <span class="p">}</span> <span class="nv">set_stdout</span><span class="p">(</span><span class="nv">$cfg</span><span class="p">);</span> <span class="k">if</span> <span class="nv">$cfg</span> <span class="ow">ne</span> <span class="nv">$cfg</span><span class="o">-</span><span class="nv">orig</span> <span class="p">{</span> <span class="nv">set_stdout</span><span class="p">("</span><span class="s2">config changed</span><span class="p">");</span> <span class="nv">config</span><span class="p">()</span><span class="o">&lt;</span><span class="nv">path</span><span class="o">&gt;.</span><span class="nv">IO</span><span class="o">.</span><span class="nv">spurt</span><span class="p">(</span><span class="nv">$cfg</span><span class="p">);</span> <span class="nv">set_stdout</span><span class="p">("</span><span class="s2">config updated</span><span class="p">");</span> <span class="nv">run_task</span> <span class="p">"</span><span class="s2">service_restart</span><span class="p">",</span> <span class="o">%</span><span class="p">(</span> <span class="s">service</span> <span class="o">=&gt;</span> <span class="nv">config</span><span class="p">()</span><span class="o">&lt;</span><span class="nv">service</span><span class="o">&gt;</span><span class="p">,</span> <span class="s">path</span> <span class="o">=&gt;</span> <span class="nv">config</span><span class="p">()</span><span class="o">&lt;</span><span class="nv">path</span><span class="o">&gt;</span><span class="p">,</span> <span class="p">);</span> <span class="p">}</span> </code></pre> </div> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>mkdir -p tasks/service_restart/ </code></pre> </div> <p><code>tasks/service_restart/task.bash</code><br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!bash</span> <span class="nb">sudo </span>service <span class="nv">$service</span> reload </code></pre> </div> <p>In real life applications services might have a linter capability where before configuration is applied it's checked and if any error occur application of changes is terminated:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!bash</span> <span class="nb">set</span> <span class="nt">-e</span> <span class="nb">sudo</span> /usr/bin/<span class="nv">$service</span> <span class="nt">--check</span> <span class="nv">$path</span> <span class="nb">sudo </span>service <span class="nv">$service</span> reload </code></pre> </div> <h1> Publish plugin </h1> <p>Packaging scenario as a plugin will allow users to reuse it as a library.</p> <p><code>sparrow.json</code><br> </p> <div class="highlight js-code-highlight"> <pre class="highlight json"><code><span class="p">{</span><span class="w"> </span><span class="nl">"name"</span><span class="w"> </span><span class="p">:</span><span class="w"> </span><span class="s2">"service-config-reload"</span><span class="p">,</span><span class="w"> </span><span class="nl">"description"</span><span class="w"> </span><span class="p">:</span><span class="w"> </span><span class="s2">"Deploy configuration file and restart service upon changes"</span><span class="p">,</span><span class="w"> </span><span class="nl">"version"</span><span class="w"> </span><span class="p">:</span><span class="w"> </span><span class="s2">"0.0.1"</span><span class="p">,</span><span class="w"> </span><span class="nl">"category"</span><span class="w"> </span><span class="p">:</span><span class="w"> </span><span class="s2">"linux"</span><span class="p">,</span><span class="w"> </span><span class="nl">"url"</span><span class="w"> </span><span class="p">:</span><span class="w"> </span><span class="s2">"https://github.com/melezhik/sparrow-plugins/tree/master/service-config-reload"</span><span class="w"> </span><span class="p">}</span><span class="w"> </span></code></pre> </div> <p>This last command will upload plugin to local Sparrow repository (see this <a href="https://github.com/melezhik/Sparrow6/blob/master/documentation/repository.md#create-repository" rel="noopener noreferrer">doc</a> for more details)<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code><span class="c">#!bash</span> s6 <span class="nt">--upload</span> </code></pre> </div> <h2> Use of plugins </h2> <p>Anywhere in Raku scenario, just do this:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight perl"><code><span class="c1">#!raku</span> <span class="k">use</span> <span class="nn">Sparrow6::</span><span class="nv">DSL</span><span class="p">;</span> <span class="nv">task</span><span class="o">-</span><span class="nv">run</span> <span class="p">"</span><span class="s2">apply and reload</span><span class="p">",</span> <span class="p">"</span><span class="s2">service-config-reload</span><span class="p">",</span> <span class="o">%</span><span class="p">(</span> <span class="p">:</span><span class="nv">path</span><span class="o">&lt;</span><span class="nv">config</span><span class="o">.</span><span class="nv">txt</span><span class="o">&gt;</span><span class="p">,</span> <span class="p">:</span><span class="nv">service</span><span class="o">&lt;</span><span class="nv">app</span><span class="o">&gt;</span><span class="p">,</span> <span class="s">enable</span> <span class="o">=&gt;</span> <span class="o">&lt;</span><span class="nv">tls</span> <span class="nv">sentry</span><span class="o">&gt;</span><span class="p">,</span> <span class="c1"># enable TLS and use of Sentry for production</span> <span class="s">disable</span> <span class="o">=&gt;</span> <span class="o">&lt;</span><span class="nv">debug</span><span class="o">&gt;</span><span class="p">,</span> <span class="c1"># disable debug mode for production </span> <span class="p">)</span> </code></pre> </div> <p>Thanks for reading!</p> <h1> PS </h1> <p>Source code of the plugin could be found here - <a href="https://github.com/melezhik/sparrow-plugins/tree/master/service-config-reload" rel="noopener noreferrer">https://github.com/melezhik/sparrow-plugins/tree/master/service-config-reload</a></p> sparrow raku bash linux