Rich Gibbs
Practical, opinionated notes on Linux server security, AWS hygiene, and indie-founder operations from Rich Gibbs.
-
Proving Inter-VLAN Routing, After Three Failures That Weren't Routing
Session 25 notes: a switch firmware with no DHCP server, NetworkManager wiping a manual address, and dnsmasq ignoring a routed VLAN. The routing was fine all along, and the TTLs proved it.
-
Moving routing to the switch meant rebuilding it
A failed tagged-uplink attempt led me to move routing onto the switch. The useful reminders are about access assumptions, destructive mode changes and unfinished tests.
-
Reading the WordPress honeypot log: POSTs first, yourself out
Notes to self on the small toolkit for reading the fake WordPress honeypot's JSONL request log: a POST-only table printer, Nmap tags, one-off sed and grep pipelines, and the traps hiding in them.
-
Keep the evidence, not just the fix
Notes to future me from the M720q build: check what a signal actually tells me, read back configuration, and keep the reason for each change.
-
Check the setup order before fighting the setup
A reminder to myself about Docker repository order, partial pastes, login permissions, and pulling migration data from the side that could connect.
-
Check which shell before trusting the result
A reminder to myself from the honeypot work: establish where a command ran, then check which process actually owns the socket.
-
A Signal That Looks Fine Is Not Proof of Function
Notes to my future self from re-reading my own command reference: the fault kept hiding behind a signal that looked fine, and the habit that cut through it was narrowing the problem by what still works.
-
Session 23: SG300-10, two VLANs, and the lockout I avoided
Session 23 notes: an SG300-10 deployed at last, two VLANs built and tested, a save command that does not exist on this image, and a Y/N prompt where N was the right answer because the change would have moved the management interface off the VLAN I was sitting on.
-
Dionaea via Docker, and Two 'No Hits' Calls the Logs Overruled
The from-source Dionaea build died on a dependency that no longer exists upstream, so this one component runs as a scoped exception to the lab's build-it-yourself rule. Then the two things I had filed as silent came apart: a WordPress decoy logging a Vite dev-server scanner population, and a mail sensor holding 456 sessions.
-
Count Every Event Type First, and Copy the Samples Before They Rotate
Roughly a week of captures across three co-located honeypot sensors, and the two mistakes in the analysis are worth more than the malware. A complete event-type histogram surfaced an upload category and a relay-abuse category that download-based greps never see, and the captured binaries had already been rotated off disk before the write-up.