SAST/DAST & Vulnerability Scanners

List of tools used to scan code for vulnerabilities, secrets, misconfigurations, & other security issues. Bias towards FOSS and CLI.

Tools

• Ansible security scanner
  • SAST for Ansible playbooks, roles, & collections
• Bandit
  • Find common security issues in Python code

Print tool info

declare -a tools=(nano rg curl)

for tool in "${tools[@]}"; do
    printf '\n--- %s ---\n' "$tool"
    command -v "$tool" || continue
    "$tool" --version
done

Docker Compose & Dockerfile Validation Cheatsheet

Cheatsheet for various Docker and Docker Compose commands and tools for linting and validating compose.yml and Dockerfile files.

Table of Contents

• Quick reference
• Docker Compose validation
  • Validate the Compose file
  • Render the normalized configuration

Bash Validators

IP address and URLs

#!/usr/bin/env bash

## Validate an IPv4 address.
is_valid_ip() {
    local ip="$1"

Vimium

Vimium is a browser extension that adds vim-like keybinds to control the browser.

Keybinds

Semgrep Usage

Semgrep is a lightweight static analysis tool (SAST) for many languages. You can configure the scanner using a rules file, either one you define or one of the default Semgrep rules packages.

Disable Metrics

Pass --metrics=off to a scan, or use the SEMGREP_SEND_METRICS=off environment variable to disable metrics.

Use Semgrep Default Rules

Encrypt Rclone Config

rclone can encrypt its configuration file behind a password. There are different levels of security to observe depending on the environment.

Single User Home Machine

For a machine that only has a single user, i.e. a personal device, it's secure enough to export your Rclone decryption password to the environment variable RCLONE_CONFIG_PASS. You should not do something like adding export RCLONE_CONFIG_PASS=my-rclone-secure-password to ~/.bashrc. The password should be sourced as-needed, i.e. in a script or from the CLI, and cleared on session exit.

To do this:

Chezmoi 3-Way Diff Merge

When running chezmoi merge ~/path/to/file.ext, you may encounter a warning about the files being out of date, with the option to cancel, merge, or overwrite. If you choose to merge, a 3-way diff will open, and the controls are confusing.

In the 3-column diff view, the middle column will be the "keep" file. You merge changes into the middle from either the left or the right, by selecting that column and the line you want to merge using :diffget 1

Steps:

• Ctrl-w l: Move from left pane to middle pane
• :diffget 1: Copy the differing hunk from pane/buffer 1, the left destination, into the middle source