_Ev evanesoteric

Everything here is written according to runit in mind, please modify it according to your init(openrc/s6).

Index

Selecting the correct init
Using rEFInd
Silent GRUB
Turn off Mitigations
Disable Watchdog
Kernel Parameters
Remove Artix logo during boot
Adding Arch and third party repos

GPG - SSH setup

Generating the master key

Here we create the master key. We want only Certify capability: we use the master key only to create the subkeys, Sign - Encrypt - Authenticate capabilities will be assigned to the subkeys.

Run the following command to start the master key generation process. Select the set your own capabilities creation process (type 8)

  ▶ gpg --full-generate-key --expert

OpenWRT supports the ESPRESSObin Ultra since 2020. Official builds are available.

In thins gist I want to explain how to install the image onto the board via a USB thumb drive.

All you need

ESPRESSObin Ultra
12V 2A DC or PoE power supply
USB A to USB Micro-B cable
wired internet connection

	#!/bin/bash

	# ==============================================================================
	# REMOTE RSYNC BACKUP SCRIPT
	# ==============================================================================
	# This script backs up a user's home directory to a remote server using rsync.
	# It incorporates file logging, an execution timer, and a configurable port.
	# ==============================================================================

	# --- Configuration ---

	# Byte-compiled / optimized / DLL files
	__pycache__/
	*.py[cod]
	*$py.class

	# C extensions
	*.so

	# Distribution / packaging
	.Python

	## Identify drives and partitions
	# lsblk # List block devices in tree format
	# lsblk -f # List with filesystem information
	# blkid # Display block device attributes (UUID, filesystem type, etc.)

	# Unlock the encrypted LUKS partition
	cryptsetup open /dev/nvme0n1p1 luksroot
	# - /dev/nvme0n1p1: The encrypted partition (NVMe SSD, first partition)
	# - luksroot: Name for the decrypted device mapper (/dev/mapper/luksroot)

	#!/usr/bin/env python3
	import evdev
	import time
	import subprocess
	import sys
	import threading

	# ====================================================================
	# CONFIGURATION - MODIFY THIS SECTION FOR YOUR SETUP
	# ====================================================================

	#!/usr/bin/nft -f
	# vim:set ts=2 sw=2 et:

	flush ruleset


	# whitelist { admin, office }
	define admin = { 10.10.10.10, 172.16.0.0/16 }

	# blacklist

	#!/bin/bash
	# Detect PAM backdoors created by linux-pam-backdoor:
	# https://github.com/zephrax/linux-pam-backdoor
	#
	# Note: this will likely only work with PAM version 1.3.0.
	# ---
	# $ ./backdoor.sh -v 1.3.0 -p some_s3cr3t_p455word
	# Automatic PAM Backdoor
	# PAM Version: 1.3.0
	# Password: some_s3cr3t_p455word

	# https://github.com/nsacyber/Mitigating-Web-Shells/blob/master/LogCheck.py

	import sys
	import os.path
	import csv


	# Script will generate a list of URL that from Apache web access log that have least unique IP address or unique user-agents
	# Written for Python 3