What AWS CLI Command Can You Run to List Roles with EKS Access?

Problem scenario
You want to list IAM roles that have access to EKS. You have the AWS CLI installed and jq installed. What should you do?

Solution
Run this command:

aws iam list-roles | jq -r '.Roles[] | select(.AssumeRolePolicyDocument.Statement[].Principal.Service=="eks.amazonaws.com")'

How Do You Iterate Through Two Lists of Unequal Length in Python?

Problem scenario
You want to iterate through two lists and perform some operation. The lists are not equal length. You want to iterate through them in some type of step-by-step fashion despite their lack of equality. What should you do?

Solution
Use this as an example:

list_a = [1, 2, 3]
list_b = ["dog", "cat", "rat", "chicken"]

i = 0
j = 0

while (i < len(list_a)) or (j < len(list_b)):
    if (i < len(list_a)):
        print(list_a[i])
        i += 1
    if (j < len(list_b)):
        print(list_b[j])
        j += 1

How Do You Write Python Code to Test if a Dictionary Exists?

Problem scenario
You want to test if a dictionary exists or not. You know its name if/when it exists. What do you do?

Solution

# Suggested usage: 1) run it is as it is.  
# 2) uncomment out the dictionary_name1 definition stanza. 
# Then run this program again.

#dictionary_name1 = "good_dict"

if 'dictionary_name1' in locals():
  print("IT IS IN LOCALS")
else:
  print("IT IS NOT IN LOCALS")

if 'dictionary_name1' in globals():
  print("IT IS IN GLOBALS")
else:
  print("IT IS NOT IN GLOBALS")

How Do You Install Troubleshoot the Kubernetes Error “dial tcp x.x.x.x:10248 connection refused”?

Problem scenario
You are trying to run "kubeadm init", but you get this error:

"failed with error: Get "http://localhost:10248/healthz": dial tcp 127.0.0.1:10248: connect: connection refused."

What should you do?

Solution
Is the kubelet service running? Run this: sudo systemctl status kubelet

To install the kubelet, see this posting for How Do You Install the kubelet on any type of Linux?

You may want to see this posting too. You may want to check if there is a firewall issue with this posting.

How Do You Troubleshoot the Kubernetes Error “[ERROR Port-10250]: Port 10250 is in use”?

Problem scenario
You are trying to run a kubeadm command. But you get this error:

[preflight] Running pre-flight checks
error execution phase preflight: [preflight] Some fatal errors occurred:
[ERROR Port-10250]: Port 10250 is in use
[preflight] If you know what you are doing, you can make a check non-fatal with --ignore-preflight-errors=...

What should you do?

Solution
Remove the kubelet that snap installed; this assumes that you have two installations of kubelet. Here is the command:

sudo snap remove kubelet

How Do You Troubleshoot a Python MapReduce Job That Returns “Error: java.lang.RuntimeException: PipeMapRed.waitOutputThreads(): subprocess failed with code 1”?

Problem scenario
Your Python MR (mapreduce) job is failing. You do not know why.

You may or may not get an error like this: "Error: java.lang.RuntimeException: PipeMapRed.waitOutputThreads(): subprocess failed with code 1"

Other symptoms you may experience is the MapReduce job takes a great deal of time. It seems to hang. What should you do?

Solution

  1. Determine which map .py file you are using and which reduce .py file that you are using. For this example, let's assume you are using /tmp/mapper.py and /tmp/reducer.py. Find the input file (or one input file). Let's say you are using /tmp/foobar.txt.
  2. Run a command like this: cat /tmp/foobar.txt | python3 /tmp/mapper.py

3. Did it fail with an error? Or did it run error free? If there was an error, change the syntax of mapper.py because the problem must be there. If there was no error, run a command like this:

cat /tmp/foobar.txt | python3 /tmp/mapper.py | python3 /tmp/reducer.py

If there was an error in the above command, change the syntax in reducer.py. If there was no error to the above command, use the MapReduce job on one input file at a time. Your mapper.py and reducer.py files seem good. Is the command you are using pointing to different map and reduce Python programs compared to what you think is being used?

How Do You Install SUSE when It Fails with a Kernel Error with Little Information?

Problem scenario
Linux SUSE won't install. When the installation process is happening it stops with an abortive error that exits the pretty GUI menu sequence. You get ">>> linuxrc 7.0.15 (Kernel 5.3.18-lp152.19-default) an error occurred during the installation." What should you do to install SUSE?

Possible Solution #1
Start over. When you see this window "YaST2 The system has an active network connection. Additional software is available online. Activate online repositories now?" Choose No.

Possible Solution #2

  1. Can you use Vagrant and Oracle VirtualBox? If you can use both of these, install them. Then use this Vagrantfile (some of the comments were borrowed from mwrock Vagrantfiles):
# -*- mode: ruby -*-
# vi: set ft=ruby :

# All Vagrant configuration is done below. The "2" in Vagrant.configure
# configures the configuration version (we support older styles for
# backwards compatibility). Please don't change it unless you know what
# you're doing.
Vagrant.configure("2") do |config|
  # The most common configuration options are documented and commented below.
  # For a complete reference, please see the online documentation at
  # https://docs.vagrantup.com.

  # Every Vagrant development environment requires a box. You can search for
  # boxes at https://vagrantcloud.com/search.
  config.vm.box = "toni03/opensuse-leap15"
  config.vm.box_version = "0.1"
  config.vm.provider "virtualbox"
  config.vm.network :public_network, :bridge => "enp1s0", adapter: "1"
  config.ssh.username = 'vagrant'
  config.ssh.password = 'vagrant'
  # Disable automatic box update checking. If you disable this, then
  # boxes will only be checked for updates when the user runs
  # `vagrant box outdated`. This is not recommended.
  # config.vm.box_check_update = false

  # Create a forwarded port mapping which allows access to a specific port
  # within the machine from a port on the host machine. In the example below,
  # accessing "localhost:8080" will access port 80 on the guest machine.
  # NOTE: This will enable public access to the opened port
  # config.vm.network "forwarded_port", guest: 80, host: 8080

  # Create a forwarded port mapping which allows access to a specific port
  # within the machine from a port on the host machine and only allow access
  # via 127.0.0.1 to disable public access
  # config.vm.network "forwarded_port", guest: 80, host: 8080, host_ip: "127.0.0.1"

  # Create a private network, which allows host-only access to the machine
  # using a specific IP.
  # config.vm.network "private_network", ip: "192.168.33.10"

  # Create a public network, which generally matched to bridged network.
  # Bridged networks make the machine appear as another physical device on
  # your network.
  # config.vm.network "public_network"

  # Share an additional folder to the guest VM. The first argument is
  # the path on the host to the actual folder. The second argument is
  # the path on the guest to mount the folder. And the optional third
  # argument is a set of non-required options.
  # config.vm.synced_folder "../data", "/vagrant_data"

  # Provider-specific configuration so you can fine-tune various
  # backing providers for Vagrant. These expose provider-specific options.
  # Example for VirtualBox:
  #
   config.vm.provider "virtualbox" do |vb|
  #   # Display the VirtualBox GUI when booting the machine
  #   vb.gui = true
  #
  #   # Customize the amount of memory on the VM:
     vb.memory = "1024"
   end
  #
  # View the documentation for the provider you are using for more
  # information on available options.

end

How Do You Harden a Website Application?

Problem scenario
You want to ensure you web application is protected from buffer overflows, injection attacks and other vulnerabilities that could reveal sensitive information. How do you harden a website application and follow security recommended practices?

Possible Solution #1
Endeavor to prevent injection attacks. Minify the website application by not allowing file uploads and limit POST requests to 2 MB (page 28 of Node.js Security by Liran Tal).

Possible Solution #2
Configure a global timeout for the website at 60 seconds (page 28 of Node.js Security by Liran Tal).

Possible Solution #3
This only applies if you are using JavaScript. Configure express-limiter (despite the fact that it requires Redis) to limit HTTP CRUD requests to the /login path of the URL. Such limitations should include 20 or fewer per hour from a single incoming IP address. (Both sentences were taken from page 26 of Node.js Security by Liran Tal).

Possible Solution #4
Avoid using eval() in of PHP, Perl, or JavaScript (page 60 of Node.js Security by Liran Tal). This allows an attacker to potentially issue system-level Linux commands if he/she can exploit your web application.

Possible Solution #5
Reduce data serialization as much as possible. Use programming languages with primitive data types (as opposed to pure object-oriented programming languages). The source of these two sentences was the OWASP website. Built-in data types from a pragmatic perspective can help control manipulating resources and keep your application and server secure.

Possible Solution #6
Try to use JSON instead of XML. If you must use XML, try to disable DTD processing. The source of the above two statements is this external page.

Possible Solution #7
Cleanse, filter and validate any user input before such values are used in the composition of a SQL statement (per this website).

Possible Solution #8
Ensure that code that interacts with the web application is threadsafe because penetration testing has its limitations in what it can reveal (page 427 of The Web Application Hacker's Handbook 2nd Edition). Thread safety is the isolative quality between two threads in a multi-processor environment (per MIT's website). When one thread can access memory that another thread was using independently, there is a breach to the principle of thread safety.

Possible Solution #9
View these pages if they are applicable:
What Are Some Ways to Prevent MITM Attacks or Other Session Exploitative Attacks with a Web Page That Uses JavaScript?

What Are Some Ways to Prevent XSS Attacks with a Web Page That Uses JavaScript?