Author: Lisa

Wonderful Timing

Anya and I went to the grocery store. Scott called while I was driving home and told me not to panic if I saw a bunch of police cars when I turned near the house. Umm, good to know! I certainly would have panicked. We got fiber internet installed at the farmhouse and set up our security cameras a few weeks ago. And, evidently, a couple of people decided tonight that it was a good place to break into. Scott got a motion alert & pulled up the video to see three people at the back door. And in the kitchen, front room, side room, back into the kitchen. He called the police and headed down to the farmhouse. They’d arrested three people by the time he got down there.

Genealogical Research for Our Property

We’ve tracked our property history through the recorder’s office, but I’ve discovered that the Medina library has USDA aerial photos from the 1930’s, 1950’s, 1960’s, and 1970’s (they skipped the 1940’s due to the war). There is an index image that provides the photo identifier for each rectangle — so we’d take the index photo, find our number, and then pull the detail picture.

Our property in the 1930’s!

SPIRE Setup Documentation

Overview

This setup deploys SPIRE as follows:

  • SPIRE Server on <SPIRE_SERVER_HOST>
  • SPIRE Agent on <SPIRE_AGENT_HOST>
  • Trust domain: <TRUST_DOMAIN>
  • Server/agent communication port: <SERVER_PORT>/tcp

How it works

SPIRE provides machine and workload identity.

The SPIRE Server on <SPIRE_SERVER_HOST> is the trust authority for the trust domain <TRUST_DOMAIN>.

The SPIRE Agent on <SPIRE_AGENT_HOST> attests to the server using x509pop with an X.509 certificate issued by an enterprise/internal CA.

Applications on <SPIRE_AGENT_HOST> do not talk directly to the SPIRE Server. They talk to the local SPIRE Agent over the local workload API socket <AGENT_SOCKET_PATH>.

The agent returns an X.509-SVID representing the workload identity.

Installation Instructions

  1. Install SPIRE binaries

Run on both hosts:

mkdir -p /opt/spire
cd /tmp
wget https://github.com/spiffe/spire/releases/download/v1.15.2/spire-1.15.2-linux-amd64-musl.tar.gz
tar zxf spire-1.15.2-linux-amd64-musl.tar.gz
cp -r spire-1.15.2/. /opt/spire/

On the SPIRE Server host:

ln -sf /opt/spire/bin/spire-server /usr/bin/spire-server

On the SPIRE Agent host:

ln -sf /opt/spire/bin/spire-agent /usr/bin/spire-agent

  1. Configure SPIRE Server

Create directories:

mkdir -p /opt/spire/conf
mkdir -p /opt/spire/data/server
mkdir -p /opt/spire/conf/x509pop

Place the CA bundle at:

/opt/spire/conf/x509pop/bundle.pem

Contents:

—–BEGIN CERTIFICATE—–
<REDACTED CA CERTIFICATE>
—–END CERTIFICATE—–
—–BEGIN CERTIFICATE—–
<REDACTED CA CERTIFICATE>
—–END CERTIFICATE—–
—–BEGIN CERTIFICATE—–
<REDACTED CA CERTIFICATE>
—–END CERTIFICATE—–

Create /opt/spire/conf/server.conf:

server {
bind_address = “0.0.0.0”
bind_port = “<SERVER_PORT>”
trust_domain = “<TRUST_DOMAIN>”
data_dir = “/opt/spire/data/server”
log_level = “INFO”
}

plugins {
DataStore “sql” {
plugin_data {
database_type = “sqlite3”
connection_string = “/opt/spire/data/server/datastore.sqlite3”
}
}

NodeAttestor “x509pop” {
plugin_data {
ca_bundle_path = “/opt/spire/conf/x509pop/bundle.pem”
}
}

KeyManager “memory” {
plugin_data {}
}
}

health_checks {
listener_enabled = true
bind_address = “127.0.0.1”
bind_port = “<HEALTH_PORT>”
}

Create /etc/systemd/system/spire-server.service:

[Unit]
Description=SPIRE Server
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/opt/spire/bin/spire-server run -config /opt/spire/conf/server.conf
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

Start server:

systemctl daemon-reload
systemctl enable –now spire-server
systemctl status spire-server –no-pager

Validate server:

spire-server healthcheck

  1. Configure SPIRE Agent

Create directories:

mkdir -p /opt/spire/conf
mkdir -p /opt/spire/data/agent
mkdir -p /opt/spire/sockets
mkdir -p /opt/spire/conf/x509pop

Issue a certificate through your enterprise PKI platform. Download as OpenSSL format and split CRT/KEY files. Copy the node certificate to:

/opt/spire/conf/x509pop/agent.crt

Copy the node private key to:

/opt/spire/conf/x509pop/agent.key

The private key must be unencrypted PEM.

Set permissions:

chmod 700 /opt/spire/conf/x509pop
chmod 600 /opt/spire/conf/x509pop/agent.key
chmod 644 /opt/spire/conf/x509pop/agent.crt

Create /opt/spire/conf/agent.conf:

agent {
data_dir = “/opt/spire/data/agent”
log_level = “INFO”
trust_domain = “<TRUST_DOMAIN>”
server_address = “<SPIRE_SERVER_HOST>”
server_port = “<SERVER_PORT>”
socket_path = “<AGENT_SOCKET_PATH>”
insecure_bootstrap = true
}

plugins {
KeyManager “disk” {
plugin_data {
directory = “/opt/spire/data/agent”
}
}

WorkloadAttestor “unix” {
plugin_data {}
}

NodeAttestor “x509pop” {
plugin_data {
private_key_path = “/opt/spire/conf/x509pop/agent.key”
certificate_path = “/opt/spire/conf/x509pop/agent.crt”
}
}
}

Create /etc/systemd/system/spire-agent.service:

[Unit]
Description=SPIRE Agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/opt/spire/bin/spire-agent run -config /opt/spire/conf/agent.conf
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

Start agent:

systemctl daemon-reload
systemctl enable –now spire-agent
systemctl status spire-agent –no-pager

  1. Validate x509pop agent attestation

On the SPIRE Server host:

spire-server agent list

Expected result:

  • Agent attestation type is x509pop
  • Can re-attest is true
  • Parent ID format resembles:

spiffe://<TRUST_DOMAIN>/spire/agent/x509pop/<AGENT_HASH>

  1. Create workload registration entry

Use the current x509pop agent SPIFFE ID from spire-server agent list.

On the SPIRE Server host:

spire-server entry create \
-spiffeID spiffe://<TRUST_DOMAIN>/workload/<WORKLOAD_NAME> \
-parentID spiffe://<TRUST_DOMAIN>/spire/agent/x509pop/<AGENT_HASH> \
-selector unix:uid:0

This authorizes a root-owned process on the SPIRE Agent host.

  1. Fetch workload identity on the SPIRE Agent host

/opt/spire/bin/spire-agent api fetch x509 -socketPath <AGENT_SOCKET_PATH>

Expected SPIFFE ID:

spiffe://<TRUST_DOMAIN>/workload/<WORKLOAD_NAME>

  1. Write certs to disk for testing

Create destination directory:

mkdir -p /etc/spire/svid/test
chmod 700 /etc/spire/svid/test

Write files:

/opt/spire/bin/spire-agent api fetch x509 \
-socketPath <AGENT_SOCKET_PATH> \
-write /etc/spire/svid/test

Inspect output:

ls -l /etc/spire/svid/test

openssl x509 -in /etc/spire/svid/test/svid.0.pem -text -noout

  1. Reboot persistence validation

Reboot the SPIRE Agent host.

After reboot, validate:

systemctl status spire-agent –no-pager

ls -l <AGENT_SOCKET_PATH>

/opt/spire/bin/spire-agent api fetch x509 -socketPath <AGENT_SOCKET_PATH>

Expected behavior:

  • spire-agent starts automatically
  • Workload API socket exists
  • X.509-SVID fetch succeeds
  1. Operational notes
  • Current architecture: <SPIRE_SERVER_HOST> = SPIRE Server; <SPIRE_AGENT_HOST> = SPIRE Agent
  • Current trust domain: <TRUST_DOMAIN>
  • Current server/agent path: <SPIRE_AGENT_HOST> to <SPIRE_SERVER_HOST> on TCP <SERVER_PORT>
  • Current Workload API socket: <AGENT_SOCKET_PATH>
  • Current example workload selector: unix:uid:0
  • Current example workload identity: spiffe://<TRUST_DOMAIN>/workload/<WORKLOAD_NAME>

JWT

Create JWT registration on the SPIRE Server host:

spire-server entry create \
-spiffeID spiffe://<TRUST_DOMAIN>/workload/<JWT_WORKLOAD_NAME> \
-parentID spiffe://<TRUST_DOMAIN>/spire/agent/x509pop/<AGENT_HASH> \
-selector unix:uid:0

Fetch JWT-SVID from the SPIRE Agent host:

/opt/spire/bin/spire-agent api fetch jwt \
-socketPath <AGENT_SOCKET_PATH> \
-audience <JWT_AUDIENCE> \
-spiffeID spiffe://<TRUST_DOMAIN>/workload/<JWT_WORKLOAD_NAME>

Example output:

token(spiffe://<TRUST_DOMAIN>/workload/<JWT_WORKLOAD_NAME>):
<REDACTED JWT-SVID>

bundle(spiffe://<TRUST_DOMAIN>):
<REDACTED JWKS BUNDLE>

SPIRE OIDC Discovery Provider

On the SPIRE Server host:

mkdir -p /opt/spire-extras
cd /tmp
wget https://github.com/spiffe/spire/releases/download/v1.15.2/spire-extras-1.15.2-linux-amd64-musl.tar.gz
tar zxf spire-extras-1.15.2-linux-amd64-musl.tar.gz
cp -r spire-extras-1.15.2/ /opt/spire-extras/

ln -sf /opt/spire-extras/bin/oidc-discovery-provider /usr/bin/oidc-discovery-provider
mkdir -p /opt/spire-extras/conf/oidc-discovery-provider

Create certificate and key files:

/opt/spire-extras/conf/oidc-discovery-provider/tls.crt
/opt/spire-extras/conf/oidc-discovery-provider/tls.key

Set permissions:

chmod 644 /opt/spire-extras/conf/oidc-discovery-provider/tls.crt
chmod 600 /opt/spire-extras/conf/oidc-discovery-provider/tls.key

Create /opt/spire-extras/conf/oidc-discovery-provider/oidc-discovery-provider.conf:

log_level = “INFO”

domains = [“<OIDC_DISCOVERY_DOMAIN>”]

server_api {
address = “unix://<SPIRE_SERVER_API_SOCKET>”
}

serving_cert_file {
cert_file_path = “/opt/spire-extras/conf/oidc-discovery-provider/tls.crt”
key_file_path = “/opt/spire-extras/conf/oidc-discovery-provider/tls.key”
}

Create /etc/systemd/system/spire-oidc-discovery-provider.service:

[Unit]
Description=SPIRE OIDC Discovery Provider
After=network-online.target spire-server.service
Wants=network-online.target

[Service]
Type=simple
ExecStart=/opt/spire-extras/bin/oidc-discovery-provider -config /opt/spire-extras/conf/oidc-discovery-provider/oidc-discovery-provider.conf
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

Ping Integration

PingFederate Integration Note for SPIRE JWT Validation

Purpose

Configure PingFederate to trust and validate JWTs issued from the SPIRE environment.

SPIRE issuer details

Use these values:

  • Issuer: https://<OIDC_DISCOVERY_DOMAIN>
  • OIDC discovery URL: https://<OIDC_DISCOVERY_DOMAIN>/.well-known/openid-configuration
  • JWKS URL: https://<OIDC_DISCOVERY_DOMAIN>/keys

Trust model

PingFederate should validate JWT signatures using the JWKS published by the SPIRE OIDC Discovery Provider.

Ping does not need to call the SPIRE server directly for every token validation. It should use the discovery/JWKS metadata from the OIDC Discovery Provider.

Expected JWT characteristics

Issuer

Ping should require:

iss = https://<OIDC_DISCOVERY_DOMAIN>

Audience

Recommended audience value:

<PING_AUDIENCE>

Clients requesting JWT-SVIDs from SPIRE should request them with this audience.

Subject

The workload identity will be in:

sub

Example:

spiffe://<TRUST_DOMAIN>/workload/<WORKLOAD_NAME>

This is the primary identity claim Ping should use to identify the calling workload.

Recommended validation rules in Ping

Validate:

  • JWT signature against SPIRE JWKS
  • iss matches https://<OIDC_DISCOVERY_DOMAIN>
  • aud contains <PING_AUDIENCE>
  • token is within validity window (exp, iat)
  • sub is an allowed SPIFFE ID or matches allowed policy rules

Example workload identity currently in use

Current example SPIFFE ID:

spiffe://<TRUST_DOMAIN>/workload/<WORKLOAD_NAME>

Client-side JWT retrieval model

A workload on the SPIRE Agent host should obtain its JWT from the local SPIRE agent, not from the SPIRE server directly.

Local agent socket:

<AGENT_SOCKET_PATH>

Example operational flow

  1. Workload on the SPIRE Agent host requests a JWT-SVID from the local SPIRE agent.
  2. JWT-SVID is issued with:
  • issuer = https://<OIDC_DISCOVERY_DOMAIN>
  • audience = <PING_AUDIENCE>
  • subject = workload SPIFFE ID
  1. Workload presents JWT to PingFederate.
  2. PingFederate validates the JWT using SPIRE OIDC discovery/JWKS.
  3. PingFederate maps the SPIFFE workload identity to access policy, token issuance, or downstream application authorization.

Suggested placeholder legend

| Placeholder | Meaning |
|—|—|

| <SPIRE_SERVER_HOST> | SPIRE server hostname |

| <SPIRE_AGENT_HOST> | SPIRE agent hostname |

| <TRUST_DOMAIN> | SPIRE trust domain |

| <SERVER_PORT> | SPIRE server listener port |

| <HEALTH_PORT> | Health check port |

| <AGENT_SOCKET_PATH> | Local SPIRE Agent workload API socket |

| <AGENT_HASH> | x509pop parent/agent hash |

| <WORKLOAD_NAME> | Example X.509 workload name |

| <JWT_WORKLOAD_NAME> | Example JWT workload name |

| <JWT_AUDIENCE> | JWT audience used by client |

| <PING_AUDIENCE> | Audience PingFederate validates |

| <OIDC_DISCOVERY_DOMAIN> | Public/abstracted OIDC issuer hostname |

| <SPIRE_SERVER_API_SOCKET> | SPIRE server private API socket |

 

Windows Defender Auto-Updates Fail

Windows Defender is supposed to automatically update itself. But I periodically experience these updates getting ‘stuck’. To force an update from the CLI:

cd “C:\ProgramData\Microsoft\Windows Defender\Platform”
dir
# REM cd into the latest iteration
cd 4.18.26060.3008-0
MpCmdRun.exe -removedefinitions -dynamicsignatures
MpCmdRun.exe -SignatureUpdate

  • -removedefinitions -dynamicsignatures removes only the dynamic security intelligence/signature content already present on the box. In practice, this is a rollback/flush step. It is commonly used when you want to clear bad/poisoned/cached dynamic detections.
  • -SignatureUpdate does the fetch/install step: it contacts the configured update source and downloads the current antimalware definitions/security intelligence.

If all else fails, download latest from https://www.microsoft.com/en-us/wdsi/defenderupdates and manually install it

Fedora: Disk Cleanup

Useful commands for disk cleanup …

Subfolder size excluding specific folders

[root@FVP05 ~]# du -shx --exclude=/mnt --exclude=/proc /*
0 /afs
0 /bin
312M /boot
2.1M /ca
8.0K /cacert.pem
4.0K /careq.pem
0 /certs
0 /crl
0 /dev
48M /etc
37M /home
0 /lib
0 /lib64
0 /media
0 /newcerts
0 /openhab
954M /opt
4.0K /private
457M /root
1.2M /run
120K /SampleCode
0 /sbin
0 /srv
0 /swapfile
0 /sys
227M /tmp
8.2G /usr
14G /var

List the largest n RPM installs

[root@FVP05 ~]# rpm -qa –qf ‘%{SIZE}\t%{NAME}\n’ | sort -nr | head -10

488208897 azure-cli
248737290 java-latest-openjdk-headless
238259971 glibc-all-langpacks
182326049 mesa-vulkan-drivers
147275895 llvm-libs
127750222 gcc
106627293 kernel-core
106091788 kernel-core
105915244 nvidia-gpu-firmware
105470864 kernel-modules

And clean up the journal logs

journalctl --vacuum-size=100M

 

Corporate Greed?

Corporate greed is an easy, convenient answer to why things are so expensive … but I’ve tracked profits and revenue for the global “big oil” companies for a while now. Other than Armaco, and generally Petrobras, profits are under 10% of revenue. “Record profits” seem, generally, to come from record sales. We’re not going through record high profit percentages.

Now, a company that “only” profited five billion dollars on 380b isn’t doing badly and could probably have gotten by if they only made 2 million – but that makes for an interesting study. Say oil is $100 per barrel. 380 billion dollars is 3.8 billion barrels sold (yes, I know many of these companies have other lines of business. This is a thought experiment, not a regulated financial filing). If they earned three billion dollars less that year, the price per barrel would only drop $0.79. Under 1% change. Now, if Armaco had only profited 3.4 billion last year instead of 93.4b, that would be a $20/barrel drop.

Raw data:

Company 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 2015 2014 2013 2012 2011 2010 2009 2008 2007 2006
Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B) Revenue ($B) Net profit ($B)
1. Saudi Aramco 446 93.4 481 106.2 495 121.3 604 161.1 400 110.0 230 49.0 330 88.2 356 111.1 n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a
2. PetroChina 399 21.9 409 22.9 426 22.8 481 22.2 405 14.3 280 2.3 364 10.4 356 7.9 298 3.4 244 0.9 277 5.7 371 17.4 365 20.9 348 18.2 298 20.6 216 20.6 149 15.1 155 16.5 110 18.4 86 17.9
3. Sinopec 388 4.4 428 7.0 454 8.5 493 9.9 435 9.5 305 4.8 430 8.3 437 9.2 349 7.6 291 7.0 324 5.3 459 8.8 465 10.3 457 10.1 388 9.8 283 9.3 197 8.6 209 6.8 157 7.0 131 6.4
4. ExxonMobil 334 28.8 350 33.7 345 36.0 414 55.7 286 23.0 182 -22.4 265 14.3 279 20.8 290 19.7 227 7.8 260 16.2 412 32.5 438 32.6 481 44.9 486 41.1 383 30.5 311 19.3 477 45.2 405 40.6 378 39.5
5. Shell 274 17.8 289 16.1 323 19.4 386 42.3 273 20.1 183 -21.7 352 15.8 397 23.4 312 13.0 240 4.6 272 1.9 431 14.9 460 16.4 482 26.7 484 30.8 378 20.1 285 12.5 458 26.3 356 31.3 319 25.4
6. TotalEnergies 201 13.1 214 15.8 237 21.4 284 20.5 206 16.0 140 -7.2 200 11.3 209 11.4 171 8.6 150 6.2 165 5.1 236 4.2 251 11.2 257 14.7 257 17.1 212 14.1 183 11.7 264 20.4 217 18.0 193 15.8
7. BP 189 0.1 189 0.4 210 15.2 241 -2.5 158 7.6 180 -20.3 277 4.0 299 9.4 240 3.4 183 0.1 223 -6.5 354 3.8 379 23.5 387 11.0 376 25.2 297 -3.7 246 16.6 361 21.2 274 20.8 254 22.3
8. Chevron 189 12.5 203 17.7 201 21.4 246 35.5 162 15.6 95 -5.5 147 2.9 166 14.8 142 9.2 114 -0.5 138 4.6 212 19.2 229 21.4 242 26.2 254 26.9 205 19.0 172 10.5 273 23.9 221 18.7 210 17.1
9. Rosneft 101 3.6 109 11.7 107 14.9 n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a 92 n/a 63 n/a n/a n/a n/a 11.1 n/a 6.5 n/a n/a
10. Petrobras 89 19.6 91 7.5 102 24.9 124 36.6 84 19.9 54 -1.1 77 10.2 85 7.2 89 0.1 81 -4.0 97 -10.0 144 -9.0 141 10.9 144 10.9 146 20.0 121 20.0 91 14.0 n/a n/a n/a n/a n/a n/a

Data as available. Publicly traded companies in US and Europe are far more apt to have published , audited, probably somewhat accurate data.