apt install chrony

# Welcome to the chrony configuration file. See chrony.conf(5) for more
# information about usable directives.

# Include configuration files found in /etc/chrony/conf.d.
confdir /etc/chrony/conf.d

# Pools
pool ntp.ubuntu.com        iburst maxsources 4
pool 0.ubuntu.pool.ntp.org iburst maxsources 1
pool 1.ubuntu.pool.ntp.org iburst maxsources 1
pool 2.ubuntu.pool.ntp.org iburst maxsources 2

# Servers
server 0.pool.ntp.org iburst
server 1.pool.ntp.org iburst
server 2.pool.ntp.org iburst
server 3.pool.ntp.org iburst
server time.windows.com iburst
server time.apple.com iburst
server time.google.com iburst
server time.facebook.com iburst
server time.cloudflare.com iburst
server time.nist.gov iburst

# Dirs
sourcedir /run/chrony-dhcp
sourcedir /etc/chrony/sources.d
keyfile /etc/chrony/chrony.keys
driftfile /var/lib/chrony/chrony.drift
ntsdumpdir /var/lib/chrony
logdir /var/log/chrony

rtcsync
allow
clientloglimit 100000000
leapsectz right/UTC
maxupdateskew 100.0
makestep 1.0 3
fallbackdrift 16 19

# Rate limit
ratelimit interval 1 burst 16
ntsratelimit interval 3 burst 1

root@app:~# systemctl status chrony
● chrony.service - chrony, an NTP client/server
     Loaded: loaded (/lib/systemd/system/chrony.service; enabled; vendor preset: enabled)
     Active: active (running) since Fri 2024-06-07 21:59:02 UTC; 1 week 2 days ago
       Docs: man:chronyd(8)
             man:chronyc(1)
             man:chrony.conf(5)
    Process: 1060 ExecStart=/usr/lib/systemd/scripts/chronyd-starter.sh $DAEMON_OPTS (code=exited, status=0/SUCCESS)
   Main PID: 1069 (chronyd)
      Tasks: 2 (limit: 2218)
     Memory: 38.5M
        CPU: 3d 5h 36min 54.341s
     CGroup: /system.slice/chrony.service
             ├─1069 /usr/sbin/chronyd -F 1
             └─1070 /usr/sbin/chronyd -F 1

Jun 07 21:59:02 app systemd[1]: Starting chrony, an NTP client/server...
Jun 07 21:59:02 app chronyd[1069]: chronyd version 4.2 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +ASYNCDNS +NTS +SECHASH +IPV6 -DEBUG)
Jun 07 21:59:02 app chronyd[1069]: Frequency -26.534 +/- 0.179 ppm read from /var/lib/chrony/chrony.drift
Jun 07 21:59:02 app chronyd[1069]: Using right/UTC timezone to obtain leap second data
Jun 07 21:59:02 app chronyd[1069]: Loaded seccomp filter (level 1)
Jun 07 21:59:02 app systemd[1]: Started chrony, an NTP client/server.
Jun 07 21:59:13 app chronyd[1069]: Selected source 2a03:2880:ff0c::123 (time.facebook.com)
Jun 07 21:59:13 app chronyd[1069]: System clock TAI offset set to 37 seconds
Jun 12 20:32:23 app chronyd[1069]: Source 2a0f:6580:110:171::66 replaced with 2a03:2100:0:2a::3c0:2 (2.pool.ntp.org)

root@app:~# chronyc -n tracking
Reference ID    : 44A63DFF (2a03:2880:ff0c::123)
Stratum         : 2
Ref time (UTC)  : Mon Jun 17 15:34:28 2024
System time     : 0.000000002 seconds slow of NTP time
Last offset     : -0.000081798 seconds
RMS offset      : 0.000074264 seconds
Frequency       : 26.423 ppm slow
Residual freq   : -0.010 ppm
Skew            : 0.032 ppm
Root delay      : 0.014898589 seconds
Root dispersion : 0.001159322 seconds
Update interval : 1036.6 seconds
Leap status     : Normal

root@app:~# chronyc -N 'sources -a -v'

  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current best, '+' = combined, '-' = not combined,
| /             'x' = may be in error, '~' = too variable, '?' = unusable.
||                                                 .- xxxx [ yyyy ] +/- zzzz
||      Reachability register (octal) -.           |  xxxx = adjusted offset,
||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
||                                \     |          |  zzzz = estimated error.
||                                 |    |           \
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^- 0.pool.ntp.org                2   8   377   449  -6379us[-6379us] +/-   61ms
^+ 1.pool.ntp.org                3   9   377   428  -2709ns[-2709ns] +/- 8952us
^? 2.pool.ntp.org                0  10   377     -     +0ns[   +0ns] +/-    0ns
^? 3.pool.ntp.org                0  10   377     -     +0ns[   +0ns] +/-    0ns
^- time.windows.com              3  10   377  1003    +73us[-8987ns] +/-   55ms
^- time.apple.com                1  10   377   543  +1268us[+1268us] +/-   24ms
^- time.google.com               1  10   377   488  +1266us[+1266us] +/-   28ms
^* time.facebook.com             1  10   177   987    +11us[  -70us] +/- 7602us
^- time.cloudflare.com           3  10   377   894  -2859us[-2859us] +/-   36ms
^- time.nist.gov                 1  10   377   472  +5300us[+5300us] +/-   74ms
^- ntp.ubuntu.com                2  10   377   402   +428us[ +428us] +/-   31ms
^- ntp.ubuntu.com                2  10   377     4  +1540us[+1540us] +/-   32ms
^- ntp.ubuntu.com                2  10   377   853   -197us[ -197us] +/-   31ms
^- ntp.ubuntu.com                2  10   377    86   +970us[ +970us] +/-   31ms
^- 0.ubuntu.pool.ntp.org         2  10   377   958   +976us[ +976us] +/-   39ms
^- 1.ubuntu.pool.ntp.org         3   8   377    69   -863us[ -863us] +/-  121ms
^- 2.ubuntu.pool.ntp.org         3   9   377   253    +97us[  +97us] +/-   30ms
^- 2.ubuntu.pool.ntp.org         3   8   377   170  +6883us[+6883us] +/-  236ms

sudo apt install mdadm

lsblk

root@mail:/# lsblk -o NAME,SIZE,FSTYPE,TYPE,MOUNTPOINT
NAME     SIZE FSTYPE            TYPE  MOUNTPOINT
loop1   73.9M                   loop  /snap/core22/864
loop2  152.1M                   loop  /snap/lxd/26200
loop3   49.8M                   loop  /snap/snapd/18596
loop4  152.1M                   loop  /snap/lxd/26093
loop5   40.9M                   loop  /snap/snapd/20290
loop6   74.1M                   loop  /snap/core22/1033
sda    931.5G                   disk
sdb    111.8G                   disk
├─sdb1     1M                   part
└─sdb2 111.8G ext4              part  /
sdc    931.5G                   disk
sdd    931.5G                   disk

sudo mdadm --zero-superblock /dev/sd{a,c,d}

sudo mdadm --create --verbose /dev/md0 --level=0 --raid-devices=3 /dev/sd{a,c,d}

root@mail:/# cat /proc/mdstat
Personalities : [raid0] [linear] [multipath] [raid1] [raid6] [raid5] [raid4] [raid10]
md0 : active raid0 sda[2] sdd[1] sdc[0]
      2929890816 blocks super 1.2 512k chunks

unused devices: <none>

sudo mkfs.ext4 -F /dev/md0

sudo mkdir -p /mnt/data
sudo mount /dev/md0 /mnt/data

sudo mdadm --detail --scan | sudo tee -a /etc/mdadm/mdadm.conf

sudo update-initramfs -u

/dev/md0 /mnt/data ext4 defaults,nofail,discard 0 0

mdadm /dev/md0 --add /dev/sdc1

mdadm /dev/md0 --fail /dev/sda1 --remove /dev/sda1

mdadm --stop /dev/md0
mdadm --remove /dev/md0

- hosts: all
  tasks:
  - name: Run CVE-2024-3094 vulnerability check script
    shell: |
      set -eu

      echo "Checking system for CVE-2024-3094 Vulnerability..."
      echo "https://nvd.nist.gov/vuln/detail/CVE-2024-3094"

      # find path to liblzma used by sshd
      # adapted from https://www.openwall.com/lists/oss-security/2024/03/29/4
      sshd_path=$(whereis -b sshd | awk '{print $2}')
      path=$(ldd "$sshd_path" 2>/dev/null | grep -o '/.*liblzma[^ ]*' | head -1)

      if [ -z "$path" ]; then
          echo
          echo "Probably not vulnerable (liblzma not found)"
          exit
      fi

      # check for function signature
      # adapted from https://www.openwall.com/lists/oss-security/2024/03/29/4
      echo
      echo "Checking for function signature in liblzma..."
      if hexdump -ve '1/1 "%.2x"' "$path" | grep -q 'f30f1efa554889f54c89ce5389fb81e7000000804883ec28488954241848894c2410'; then
          echo "Function signature in liblzma: VULNERABLE"
      else
          echo "Function signature in liblzma: OK"
      fi

      # check xz version
      echo
      echo "Checking xz version..."
      xz_version=$(xz --version | head -n1 | awk '{print $4}')
      if [[ "$xz_version" == "5.6.0" || "$xz_version" == "5.6.1" ]]; then
          echo "xz version $xz_version: VULNERABLE"
      else
          echo "xz version $xz_version: OK"
      fi
    register: script_output

  - debug:
      var: script_output.stdout_lines

apt install -y git build-essential

git clone --recursive https://github.com/heiher/hev-socks5-server
cd hev-socks5-server
make

cp /bin/hev-socks5-server /usr/bin/hev-socks5-server
chmod +x /usr/bin/hev-socks5-server

# Main configuration for hev-socks5-server

main:
  # Worker threads
  workers: 4
  # Listen port
  port: 1080
  # Listen address (ipv4|ipv6)
  listen-address: '::'
  # Listen ipv6 only
  listen-ipv6-only: false
  # Bind source address (ipv4|ipv6)
  bind-address: '::'
  # Bind source network interface
  bind-interface: ''

auth:
  username: mertcan
  password: gokgoz

[Unit]
Description=Hev Socks5 Proxy Server
After=network.target
Wants=network-online.target

[Service]
Restart=always
Type=simple
ExecStart=/usr/bin/hev-socks5-server main.yml
Environment='TEST=test'

[Install]
WantedBy=multi-user.target

sudo cp -v hav-socks5-proxy.service /etc/systemd/system
sudo systemctl daemon-reload
sudo systemctl start hav-socks5-proxy.service
sudo systemctl enable hav-socks5-proxy.service

cd hev-socks5-server
docker build -t hev-socks5-server -f docker/Dockerfile .
docker run -d \
  --name hev-socks5-server \
  --restart always \
  --net host \
  -e PORT=1080 \
  -e AUTH="user:pass" \
  hev-socks5-server