Infrastructure Automation & Security Platform Engineering Tasks

SELECT
    logsourcename(logsourceid) AS "Log Source",
    logsourcetypename(devicetype) AS "Type",
    COUNT(*) AS "Event Count (24h)"
FROM events
WHERE INOFFENSE = FALSE
GROUP BY logsourceid, devicetype
ORDER BY "Event Count (24h)" DESC
LAST 24 HOURS

SELECT
    logsourcename(logsourceid) AS "ISE Log Source",
    devicetype AS "Device Type ID",
    COUNT(*) AS "Events"
FROM events
WHERE logsourcetypename(devicetype) ILIKE '%ISE%'
   OR logsourcename(logsourceid) ILIKE '%ISE%'
GROUP BY logsourceid, devicetype
LAST 7 DAYS

SELECT
    categoryname(category) AS "Category",
    COUNT(*) AS "Count",
    MIN(starttime) AS "First Seen",
    MAX(starttime) AS "Last Seen"
FROM events
WHERE logsourcename(logsourceid) ILIKE '%ISE%'
GROUP BY category
ORDER BY "Count" DESC
LAST 7 DAYS

SELECT
    qidname(qid) AS "Event Name",
    COUNT(*) AS "Count"
FROM events
WHERE logsourcename(logsourceid) ILIKE '%ISE%'
GROUP BY qid
ORDER BY "Count" DESC
LIMIT 50
LAST 7 DAYS

SELECT
    logsourcename(logsourceid) AS "Log Source",
    DATEFORMAT(starttime, 'yyyy-MM-dd') AS "Date",
    COUNT(*) AS "Daily Events"
FROM events
WHERE INOFFENSE = FALSE
GROUP BY logsourceid, DATEFORMAT(starttime, 'yyyy-MM-dd')
ORDER BY "Daily Events" DESC
LAST 30 DAYS

SELECT
    qidname(qid) AS "Event",
    COUNT(*) AS "Count"
FROM events
WHERE logsourcename(logsourceid) ILIKE '%ISE%'
  AND (qidname(qid) ILIKE '%authentication%'
       OR qidname(qid) ILIKE '%failed%'
       OR qidname(qid) ILIKE '%success%')
GROUP BY qid
ORDER BY "Count" DESC
LAST 7 DAYS

SELECT
    logsourcename(logsourceid) AS "Log Source",
    SUM(eventcount) AS "Total Events",
    ROUND(SUM(eventcount) / 7, 0) AS "Avg Daily"
FROM events
WHERE INOFFENSE = FALSE
GROUP BY logsourceid
ORDER BY "Total Events" DESC
LIMIT 20
LAST 7 DAYS

# Core package
sudo pacman -S gopass

# Optional integrations
sudo pacman -S gopass-jsonapi        # Browser extension support
sudo pacman -S git-credential-gopass # Git credential helper
sudo pacman -S gopass-hibp           # Have I Been Pwned integration

# Verify existing store works (backwards compatible with pass)
gopass ls

password: actual-password-here
---
username: evan.rosado@domusdigitalis.dev
email: evan.rosado@domusdigitalis.dev
url: https://service.example.com
notes: |
  Recovery codes stored in ARCANA/recovery/
  MFA enabled: Yes
  Created: 2026-02-01
totp: otpauth://totp/Service:evan?secret=BASE32SECRET&issuer=Service
tags:
  - personal
  - critical
created: 2026-02-01
modified: 2026-02-01

# Option 1: CSV export (basic)
# 1Password > Settings > Export > CSV format

# Option 2: 1PUX export (recommended - preserves structure)
# 1Password > Settings > Export > 1Password Unencrypted Export (.1pux)

# CSV import
gopass convert --from=1password /path/to/1password-export.csv

# 1PUX import (richer data)
gopass convert --from=1pux /path/to/export.1pux

# Enable auto git sync
gopass config autosync true

# Set clipboard clear timeout (seconds)
gopass config cliptimeout 45

# Enable notifications
gopass config notifications true

# Audit existing passwords
gopass audit

journalctl -f -u NetworkManager -u wpa_supplicant | grep -E "wlan0|EAP|TLS|cert|802"

# Capture identity before deleting
IDENTITY=$(nmcli -g 802-1x.identity connection show Domus-Secure-802.1X)

# Delete corrupted connection
nmcli connection delete Domus-Secure-802.1X

# Recreate with all flags (prevents GUI password prompts)
sudo nmcli connection add \
  type wifi \
  con-name "Domus-Secure-802.1X" \
  ssid "Domus-Secure" \
  wifi-sec.key-mgmt wpa-eap \
  802-1x.eap tls \
  802-1x.identity "$IDENTITY" \
  802-1x.ca-cert /etc/ssl/certs/DOMUS-ROOT-CA.pem \
  802-1x.client-cert /etc/ssl/certs/modestus-razer-eaptls.pem \
  802-1x.private-key /etc/ssl/private/modestus-razer-eaptls.key \
  802-1x.private-key-password-flags 4 \
  802-1x.ca-cert-password-flags 4

# Connect
nmcli connection up Domus-Secure-802.1X

Config: added 'key_mgmt' value 'WPA-EAP FT-EAP FT-EAP-SHA384 WPA-EAP-SHA256'
Config: added 'eap' value 'TLS'
Config: added 'ca_cert' value '/etc/ssl/certs/DOMUS-ROOT-CA.pem'
Config: added 'client_cert' value '/etc/ssl/certs/modestus-razer-eaptls.pem'
supplicant interface state: disconnected -> scanning
SME: Trying to authenticate with 78:bc:1a:36:82:cb (SSID='Domus-Secure' freq=5540 MHz)
supplicant interface state: scanning -> authenticating -> associating -> associated
CTRL-EVENT-EAP-STARTED EAP authentication started
CTRL-EVENT-EAP-METHOD EAP vendor 0 method 13 (TLS) selected
CTRL-EVENT-EAP-PEER-CERT depth=2 subject='CN=DOMUS-ROOT-CA'
CTRL-EVENT-EAP-PEER-CERT depth=1 subject='CN=DOMUS-ISSUING-CA'
CTRL-EVENT-EAP-PEER-CERT depth=0 subject='CN=ise-02.inside.domusdigitalis.dev'
CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
WPA: Key negotiation completed with 78:bc:1a:36:82:cb [PTK=CCMP GTK=CCMP]
CTRL-EVENT-CONNECTED - Connection to 78:bc:1a:36:82:cb completed
dhcp4 (wlan0): state changed new lease, address=10.50.10.103
Activation: successful, device activated.

disconnected -> scanning -> authenticating -> associating -> associated -> completed

NetworkManager.service: Failed with result 'exit-code'
Failed to read configuration: Key file contains line "nmcli connection down Domus-Secure && nmcli connection up Domus-Secure"

# Restore valid config
sudo tee /etc/NetworkManager/NetworkManager.conf << 'EOF'
[main]
plugins=keyfile

[keyfile]
unmanaged-devices=none
EOF

# Reset and start
sudo systemctl reset-failed NetworkManager
sudo systemctl start NetworkManager

interface GigabitEthernet1/0/1
 no source template DefaultWiredDot1xClosedAuth

sudo ip link set enp0s31f6 up
sudo dhcpcd enp0s31f6

nmcli connection show Domus-Secure | grep "802-1x.ca-cert"
# Output: 802-1x.ca-cert: /etc/ssl/certs/HOME-ROOT-CA.pem

# Get CA from Vault
ssh certmgr-01 "vault read -field=certificate pki/cert/ca" > /tmp/DOMUS-ROOT-CA.crt

# Deploy to client
scp /tmp/DOMUS-ROOT-CA.crt gabriel@10.50.10.107:/tmp/
ssh gabriel@10.50.10.107
sudo cp /tmp/DOMUS-ROOT-CA.crt /etc/ssl/certs/DOMUS-ROOT-CA.pem
sudo chmod 644 /etc/ssl/certs/DOMUS-ROOT-CA.pem

# Update connection
sudo nmcli connection modify Domus-Secure 802-1x.ca-cert /etc/ssl/certs/DOMUS-ROOT-CA.pem

openssl x509 -in /etc/ssl/certs/modestus-p50-eaptls.pem -noout -issuer -subject
# issuer=DC=dev, DC=domusdigitalis, DC=inside, CN=HOME-ROOT-CA
# subject=O=Domus Digitalis, OU=Endpoints, CN=modestus-p50.inside.domusdigitalis.dev

# On certmgr-01
vault operator unseal  # x3 with unseal keys
vault login

# List roles
vault list pki_int/roles
# domus-byod, domus-client, domus-server, domus-windows-machine, domus-windows-user

# Issue client cert
vault write -format=json pki_int/issue/domus-client \
  common_name="modestus-p50.inside.domusdigitalis.dev" \
  ttl="8760h" > /tmp/modestus-p50.json

# Extract components
jq -r '.data.certificate' /tmp/modestus-p50.json > /tmp/modestus-p50-eaptls.pem
jq -r '.data.private_key' /tmp/modestus-p50.json > /tmp/modestus-p50-eaptls.key

# Verify new cert
openssl x509 -in /tmp/modestus-p50-eaptls.pem -noout -subject -issuer
# subject=CN=modestus-p50.inside.domusdigitalis.dev
# issuer=CN=DOMUS-ISSUING-CA

# From workstation
scp certmgr-01:/tmp/modestus-p50-eaptls.pem /tmp/
scp certmgr-01:/tmp/modestus-p50-eaptls.key /tmp/
scp /tmp/modestus-p50-eaptls.* gabriel@10.50.10.107:/tmp/

# On Gabriel's machine
sudo cp /tmp/modestus-p50-eaptls.pem /etc/ssl/certs/
sudo cp /tmp/modestus-p50-eaptls.key /etc/ssl/private/
sudo chmod 644 /etc/ssl/certs/modestus-p50-eaptls.pem
sudo chmod 600 /etc/ssl/private/modestus-p50-eaptls.key

# Connect
nmcli connection up Domus-Secure

CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
WPA: Key negotiation completed with 78:bc:1a:36:82:cb [PTK=CCMP GTK=CCMP]
device (wlan0): Activation: successful, device activated.

LAB-3560CX-01#show access-session interface GigabitEthernet1/0/1 details
            Interface:  GigabitEthernet1/0/1
          MAC Address:  c85b.76c6.5962
         IPv4 Address:  10.50.40.100
            User-Name:  C8-5B-76-C6-59-62
               Status:  Authorized
               Domain:  DATA
       Current Policy:  PMAP_DefaultWiredDot1xClosedAuth_1X_MAB

Server Policies:
           Vlan Group:  Vlan: 40
              ACS ACL:  xACSACLx-IP-RESEARCH_ONBOARD_DACL-6967c0fb

Method status list:
      Method            State
      dot1x              Stopped
      mab                Authc Success

# Verify current interface configuration
netapi ios exec "show running-config interface GigabitEthernet1/0/1"

# Restore IBNS 2.0 template
netapi ios config \
  "interface GigabitEthernet1/0/1" \
  "description [DOT1X] User Access Port" \
  "ip arp inspection trust" \
  "source template DefaultWiredDot1xClosedAuth" \
  "spanning-tree portfast edge" \
  --save

# Verify template applied
netapi ios exec "show derived-config interface GigabitEthernet1/0/1"