Apt only upgrade selected packages

 apt list --upgradable | cut -d"/" -f1 > /tmp/apt

pico /tmp/apt

cat /tmp/apt | tr "\n" " "

apt install --only-upgrade <list_of_packages>

Configuring Static Routes with ip commands

As a system administrator, you can configure static routes using the ip route command.

To display the IP routing table, use the ip route command. For example:

~]$ ip route
default via 192.168.122.1 dev ens9  proto static  metric 1024
192.168.122.0/24 dev ens9  proto kernel  scope link  src 192.168.122.107
192.168.122.0/24 dev enp1s0  proto kernel  scope link  src 192.168.122.126

The ip route commands take the following form:

ip route [ add | del | change | append | replace ] destination-address

See the ip-route(8) man page for more details on the options and formats. 

 

To add a static route to a host address, in other words to a single IP address:

~]# ip route add 192.0.2.1 via 10.0.0.1 [dev interface]

where 192.0.2.1 is the IP address of the host in dotted decimal notation, 10.0.0.1 is the next hop address and interface is the exit interface leading to the next hop. 

 

To add a static route to a network, in other words to an IP address representing a range of IP addresses:

~]# ip route add 192.0.2.0/24 via 10.0.0.1 [dev interface]

where 192.0.2.0 is the IP address of the destination network in dotted decimal notation and /24 is the network prefix. The network prefix is the number of enabled bits in the subnet mask. This format of network address slash network prefix length is sometimes referred to as classless inter-domain routing (CIDR) notation.

To remove the assigned static route:

~]# ip route del 192.0.2.1

Check point block a single IP address

 

Using Suspicious Activity Monitoring (SAM)

Connect to the firewall via SSH and log into Expert mode:

expert

Run the fw sam command to block traffic to and from the target IP:
fw sam -t 0 -b -s <IP_Address>
• -t 0 sets the timeout (0 means indefinite, or specify seconds like -t 3600 for 1 hour).
• -b blocks both source and destination directions.
• -s specifies the source IP address to block. [1]

Alternatively, for high-performance accelerated drops using SecureXL, you can use the fwaccel dos deny utility: [1]

fwaccel dos deny -a <IP_Address>

fw samp block -d <IP-Address> -u <Unique-Name>

fw samp unblock -u block_bad_ip
 

Useful Check Point Commands

 

Useful Check Point Commands

Table 1. Useful CP Commands

Command	Description
cpconfig	change SIC, licenses and more
cpview -t	show top style performance counters
cphaprob stat	list the state of the high availability cluster members. Should show active and standby devices.
cphaprob -a if	display status of monitored interfaces in a cluster
cphaprob -l list	display registered cluster devices and status
cphaprob syncstat	display sync transport layer statistics
cphaprob ldstat	display sync serialization statistics
cphastop	stop a cluster member from passing traffic. Stops synchronization. (emergency only)
clusterXL_admin down –p	disable this node from cluster membership
cphaconf cluster_id get	get cluster Global ID membership
cphaconf set_ccp broadcast/multicast	set cluster mode
cplic print	license information
cpstart	start all checkpoint services
cpstat fw	show policy name, policy install time and interface table
cpstat ha	high availability state
cpstat blades	top rule hits and amount of connections
cpstat os -f all	checkpoint interface table, routing table, version, memory status, cpu load, disk space
cpstat os -f cpu	checkpoint cpu status
cpstat os -f multi_cpu	checkpoint cpu load distribution
cpstat os -f sensors	hardware environment (temperature/fan/voltage)
cpstat os -f routing	checkpoint routing table
cpstat mg -f log_server	monitor log servers performance (events/sec)
cpstat -f log_connection fw	monitor log servers settings
cpstop	stop all checkpoint services
cpwd_admin monitor_list	list processes actively monitored. Firewall should contain cpd and vpnd.
show sysenv all	show hardware sensors (fans,power supply,temp,volt)
show asset all	show serial numbers and hardware info
show route destination xx.xx.xx.xx	show routing for specific host
ip route get xx.xx.xx.xx	show routing for specific host
iclid / show cluster state	show cluster fail over history
promote_util	promote the Secondary Management server to become the Primary server
cp_conf sic init key123 norestart	reset SIC without restarting the firewall process

Useful FW Commands

Table 2. Useful FW Commands

Command	Description
fw ver	firewall version
fw ctl iflist	show interface names
fw ctl pstat	show control kernel memory and connections
fwaccel stat	show SecureXL status
fw fetch <manager IP>	get the policy from the firewall manager
fwm load <policy name> <gateway name>	compile and install a policy on the target's gateways.
fw getifs	list interfaces and IP addresses
fw log	show the content of the connections log
fw log -b "MMM DD, YYYY HH:MM:SS" "MMM DD, YYYY HH:MM:SS"	search the current log for activity between specific times
fw log -c drop	search for dropped packets in the active log; also can use accept or reject to search
fw log -f	tail the current log
fwm logexport -i <log name> -o <output name> -n -p	export an old log file on the firewall manager
fw logswitch	rotate logs
fw lslogs	list firewall logs
fw stat	firewall status, should contain the name of the policy and the relevant interfaces.
fw stat -l	show which policy is associated with which interface and package drop, accept and reject
fw tab	displays firewall tables
fw tab -s -t connections	number of connections in state table
fw tab -f -t vpn_routing -u	routing for remote vpns
fw tab -s -t userc_users	number of remote users connected (VPN)
fw tab -t xlate -x	clear all translated entries
fw unloadlocal	clear local firewall policy
fw monitor -e "accept host(10.1.1.10);"	trace the packet flow to/from the specified host
fw ctl zdebug + drop | grep 'x.x.x.x\|y.y.y.y'	Check reason of your packet being dropped

 

Checking Root Account Status

 

Checking Local Root Account Status

Run sudo passwd -S root: Look for the status letter in the output. An L means the account is locked (disabled), while a P means it has a usable password.
Check /etc/shadow directly: Run sudo getent shadow root or sudo grep root /etc/shadow. If the second field (the password hash field) starts with an ! or *, the password is locked and direct login is disabled. [1, 2]

Checking Remote SSH Root Login Status

Test the effective SSH setting: Run sudo sshd -T | grep permitrootlogin. If it outputs permitrootlogin no or prohibit-password, remote root access via password is disabled.
Inspect the configuration files: Check /etc/ssh/sshd_config and files inside /etc/ssh/sshd_config.d/ for PermitRootLogin no

Ubuntu Unsupported upgrades

 Unsupported upgrades

Sometimes do-release-upgrade isn't able to run the upgrade to the latest version and it shows an error similar to this:

An upgrade from 'eoan' to 'focal' is not supported with this tool.

If that happens, you need to download a version-specific upgrader, you can find the link at https://changelogs.ubuntu.com/meta-release.

You need to download the upgrade tool for the version you are upgrading to. For example, if you are upgrading to Ubuntu 20.04 (focal), you'll see the link on that page as follows:

UpgradeTool: http://archive.ubuntu.com/ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz

The download is an archive which contains an executable with the code name of the release. execute it to run the upgrade tool for that release. Note that the archive extracts everything in the current directory so you might want to create a directory for it to extract into:

# Downloads the upgrader, check the link above for the URL of the file for your release
wget http://archive.ubuntu.com/ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz
# Extract it into a new directory
mkdir upgrader
tar -xaf focal.tar.gz -C upgrader
cd upgrader
# Run the executable, the name changes based on the release
./focal

This executable works the same as do-release-upgrade. If you still get the error of the upgrade not being supported, you might need to make an intermediate upgrade to an earlier version.

Adicionar registro DNS windows linha de comando

 Usando o Prompt de Comando (dnscmd)Abra o Prompt de Comando como Administrador e utilize a seguinte estrutura para adicionar um registro do tipo A (endereço IP):
dnscmd . /RecordAdd <NomeDaZona> <NomeDoHost> A <EnderecoIP>
Exemplo prático: 
dnscmd . /RecordAdd meu-dominio.com meu-servidor A 192.168.1.50

O ponto . indica que você está gerenciando o servidor DNS local.
Usando o PowerShell (Add-DnsServerResourceRecordA)
Abra o Windows PowerShell como Administrador e execute o comando correspondente para a zona de pesquisa direta:
Add-DnsServerResourceRecordA -Name <NomeDoHost> -IPv4Address <EnderecoIP> -ZoneName <NomeDaZona>
Exemplo prático: Add-DnsServerResourceRecordA -Name meu-servidor -IPv4Address 192.168.1.50 -ZoneName meu-dominio.com 

SNMP Oracle Linux

 

sudo yum install net-snmp net-snmp-utils -y 

 

nano /etc/snmp/snmpd.conf 

agentAddress  udp:10.20.1.2:161
rocommunity public

systemctl restart snmpd
 

Change 'mysql_native_password' authentication

 Plugin mysql_native_password reported: ''mysql_native_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'


You can identify the affected users by running the following query in your MySQL console

SELECT user, host, plugin FROM mysql.user WHERE plugin='mysql_native_password';

Once you identify the users, update their authentication plugin using this command
ALTER USER 'user'@'location' IDENTIFIED WITH caching_sha2_password BY 'password';
FLUSH PRIVILEGES;

If your application or framework (such as an older version of PHP, Node.js, or a specific driver)
 does not support caching_sha2_password, you can use sha256_password as an alternative

Oracle linux security updates

 

- List available security packages:
dnf updateinfo list security
 

- List installed security updates:
dnf updateinfo list --installed --security

- Count available security updates (by severity):
dnf updateinfo summary
 

- Apply all available security updates:
sudo dnf update --security

- Apply a specific security advisory:
sudo dnf update --advisory=ELSA-YYYY-XXXX
 

- Update only specific package
sudo dnf upgrade openssh openssh-server openssh-clients 

NGINX - To allow a specific User-Agent from one IP address only

Step 1: Define the Map BlocksAdd this configuration inside the http {} block of your /etc/nginx/nginx.conf file. This logic evaluates the incoming User-Agent and IP address to flag unauthorized requests


http {
    # ... your existing http config ...

    # 1. Check if the User-Agent matches the restricted one
    map $http_user_agent $is_restricted_ua {
        default         0;
        "~*YourCustomUserAgent" 1; # Replace with your target User-Agent (regex matching)
    }

    # 2. Check if the client IP is NOT the authorized one
    map $remote_addr $is_unauthorized_ip {
        default        1;
        "192.168.1.50" 0; # Replace with your ONLY allowed IP address
    }

    # 3. Combine both conditions: Flag if it's the target UA AND an unauthorized IP
    map "$is_restricted_ua$is_unauthorized_ip" $block_request {
        default   0;
        "11"      1; # 1 (Restricted UA) + 1 (Unauthorized IP) = Block
    }
}



Step 2: Apply the Block RuleOpen your website's specific server configuration file (e.g., inside /etc/nginx/sites-available/) and use the combined variable to reject requests with a 403 Forbidden error.

server {
    listen 80;
    server_name yourdomain.com;

    # Place this rule globally inside the server block or inside a specific location block
    if ($block_request) {
        return 403;
    }

    location / {
        # ... your standard site configuration ...
    }
}

TLS/SSL certificate CSR

 
# CSR
openssl req -new -newkey rsa:4096 -keyout domain.key -out domain.csr


# Remove key password
openssl rsa -in encrypted.key -out decrypted.key


chain = crt + intermediary

Certificate - PEM to PKCS12

 

Convert Lets encrypt PEM to tomcat PKCS12 

openssl pkcs12 -export \ -in fullchain.pem \ -inkey privkey.pem \ -out server.p12 \ -name my-domain-alias 

Add nginx repository Ubuntu

 Add nginx repository Ubuntu

# 1. Download the NGINX signing key
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null


# 2. Add the NGINX Repository
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://nginx.org/packages/mainline/ubuntu `lsb_release -cs` nginx" | sudo tee /etc/apt/sources.list.d/nginx.list


echo -e "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900" | sudo tee /etc/apt/preferences.d/99nginx

 

Reiniciar VCenter

 

Opção 1: Pela Interface VAMI (Recomendado)

1. Acesse o portal de gerenciamento pelo endereço: https://<IP_DO_VCENTER_OU_FQDN>:5480.
2. Efetue login com as credenciais de root.
3. No menu de navegação, clique em Actions (Ações).
4. Selecione Reboot (Reiniciar). [1, 2]

Opção 2: Pelo Host ESXi

1. Acesse o VMware Host Client diretamente no host ESXi onde o vCenter está alocado.
2. Localize a máquina virtual do vCenter na lista e clique com o botão direito nela.
3. Vá em Power e selecione Reboot Guest OS.

 

Ou por SSH e comando reboot 

Export/import windows server DNS zones

You can use Export-DnsServerZone and Import-DnsServerZone. 

1. Export: Export-DnsServerZone -Name "test.com" -Filename "test.com.dns"
2. Import: Import-DnsServerZone -Name "test.com" -Filename "test.com.dns"

The file "test.com.dns" will be created in "C:\windows\system32\dns" folder

Only export dns records:

Get-DnsServerResourceRecord -ZoneName "test.com" | Export-Csv -Path "C:\temp\dns.csv" 

Import option 2:

dnscmd localhost /zoneadd teste.com /primary /file teste.com /load

Command ip examples

 
# Forcefully close a connection to a specific destination
sudo ss -K dst 192.168.1.100

# view routes
ip r
ip route

# To reject a route (block traffic to an IP)
ip route add unreachable 74.1.1.0/24
ip route del unreachable 74.1.1.0/24

  
# add route 
sudo ip route add {NETWORK/MASK} via {GATEWAYIP}
sudo ip route add {NETWORK/MASK} dev {DEVICE}
sudo ip route add default {NETWORK/MASK} dev {DEVICE}
sudo ip route add default {NETWORK/MASK} via {GATEWAYIP}

# Here is another example where I am setting up route for my VPN gateway:
ip link set dev tun0 up mtu 1500
ip addr add dev tun0 10.8.0.2/24 broadcast 10.8.0.255
ip route add 139.59.2.125/32 via 192.168.2.254
ip route add 0.0.0.0/1 via 10.8.0.1
ip route add 128.0.0.0/1 via 10.8.0.1


Edit config file such as /etc/sysconfig/network-scripts/route-eth0 on a CentOS/RHEL/Fedora Linux for interface eth0 using a text editor such as nano command or vim command:
vim /etc/sysconfig/network-scripts/route-eth0

Append the following text:
172.10.1.0/24 via 10.0.0.100 dev eth0

Save and exit (close) the file in a vim text editor. Finally, restart your network service on a CentOS/RHEL/Fedora Linux so they take effect:
systemctl restart network.service



A note about ip command and persistence static routing on a Debian/Ubuntu

Edit your /etc/network/interfaces file for say eth0:
vi /etc/network/interfaces

Update it as follows:

auto eth0
iface eth0 inet static
address 192.168.1.2
netmask 255.255.255.0
gateway 192.168.1.254
## static ip config START ##
up /sbin/ip route add 172.10.1.0/24 via 10.8.0.1 dev eth0
down /sbin/ip route delete 172.10.1.0/24 via 10.8.0.1 dev eth0
## static ip config END ##

## How to find the route used for an destination IP

The syntax is as follows:
ip route get to {IPv4_address_here}
ip route get to {IPv6_address_here}
ip route get to 172.66.43.74

Outputs indicating that 172.66.43.74 can be reached via the wg0 interface with 192.168.13.4 as source IP:

172.66.43.74 dev wg0 table 51832 src 192.168.13.4 uid 1000 
    cache 

Vimrc example

 syntax on                   " modo visual/colorido ativo
set showmode                " apresenta o modo de utilizacao atual (command/insert)
set ignorecase              " ignora case sensitive durante a busca
set ruler                   " apresenta a posicao do cursor
set showcmd                 " visualiza comandos incompletos
set smarttab                " trabalha a identacao do arquivo
set sm                      " ativar/desativar as coincidencias
set laststatus=1            " exibe a linha de status
set title                                    " habilita o titulo
set term=xterm-256color     " modo do terminal
set smartcase                        " modo de pesquisa
set incsearch               " busca incremental
set autoindent              " auto identacao
set smartindent             " identacao
set undolevels=1000         " numero maximo de restore (undo)
set number            " adiciona numero das linhas
set bg=dark
set paste
set tabstop=2
set shiftwidth=2
set expandtab
autocmd FileType yaml setlocal ai sw=1 et cuc cul

Apt error Could not get lock /var/lib/apt/lists/lock

 

sudo fuser -vik -TERM /var/lib/apt/lists/lock 

Silent gpupdate

 

Remote silent execution 

gpupdate /force /wait:0 /quiet