Questions tagged [security]

For questions relating to application security and attacks against software. Please don't use this tag alone, that results in ambiguity. Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. If your question is not about a specific programming problem, please consider instead asking it at Information Security SE

Filter by
Sorted by
Tagged with
1 vote
0 answers
1k views

Wireguard VPN not making handshake

I'm facing a trouble, I have a server with Wireguard configured, with the keys generated by wg command line. I've downloaded Wireguard for windows and put the public's server key on client peer, and ...
Fabricio Franco's user avatar
-2 votes
1 answer
306 views

Windows Firewall Disabled every startup [closed]

I have an antivirus installed (Panda Antivirus) and it always worked well for me. Everytime I startup my pc I get the notifications (screenshots below) to turn Windows Firewall ON. I never had this ...
jks's user avatar
  • 3
1 vote
1 answer
11k views

Encryption type requested is not supported by the KDC

I am having intermittent issues with RDP'ing from a Windows 11 Enterprise PC to another Windows 11 Enterpise PC. Both PC's are domain joined and on the same subnet. Both PC's have a GPO applied to ...
Riguez's user avatar
  • 123
0 votes
1 answer
389 views

Prevent VPN client from network scanning on ocserv

I have a ocserv server for VPN on a debian11 server. One of my clients did a network scanning and service provider blocked my IP for terms of service violation. This is 2nd time that this happened and ...
AminMZ's user avatar
  • 13
0 votes
0 answers
57 views

A certain IP keeps trying enpoints in my API such as `/.env`, `/info.php`, `/.env.production`, etc. Should I blacklist it?

I deployed my first ever internet service recently (AWS). As I expected, I started getting these "internet robots". I noticed one in particular that keeps trying the endpoints mentioned in ...
Bersan's user avatar
  • 101
-1 votes
1 answer
40 views

How should I design my 'public' network of an project?

I'm thinking about doing some online projects as a Developer/IT Technician, and I have some concerns regarding security. I'm unable to host my servers locally for my project and I thought why not to ...
Kuezy's user avatar
  • 1
0 votes
1 answer
251 views

Azure Function App - Azure Defender compliance

Azure Defender on Azure has two policies for Azure Function authentication that I'm not able to implement from other azure resources that support http calls. Function apps should have Client ...
Jorge Rodrigues's user avatar
13 votes
3 answers
6k views

How dangerous might it be - and what performance gains may be had - by turning vulnerability mitigations off on non-Internet facing servers?

When a virtual machine Linux host server is non-Internet facing and is used exclusively on a LAN and is using a relatively well tested distribution like Proxmox, how dangerous would it be to turn off ...
ylluminate's user avatar
  • 1,197
0 votes
1 answer
120 views

Enabling Cephx In cephadm depolyment

Hello i am trying to enable cephx in my ceph cluster i added this three lines to /etc/ceph/ceph.conf auth_cluster_required = cephx auth_service_required = cephx auth_client_required = cephx i didn'...
Hoodad Tabibi's user avatar
1 vote
0 answers
81 views

Disallow port forwarding to bypass VPN

We have a linux workstation that is used by a group of users via Internet. For security, users must connect to our private network by VPN and then can ssh to the workstation. The job they run on the ...
Ruixing Wang's user avatar
0 votes
0 answers
33 views

Store API keys for our API

I'm building an HTTP API with API gateway and want to use API keys for authentication. Since they aren't supported by HTTP APIs, I plan on verifying them manually in a Lambda function. Where would the ...
Max's user avatar
  • 11
0 votes
1 answer
403 views

How to restrict local admin from disbaling or changing firewall setttings

I have a scenario, where the member servers are not able to RDP to other member servers I have managed that using local firewall rules, but at same time the local admin should not able to disable or ...
asadz's user avatar
  • 145
0 votes
1 answer
27 views

What to look for when searching for HIPAA Hosting Server? [closed]

We are looking to get a HIPAA Hosting server for one of our clients. What should we look for in such server? There are so many hosting providers who are offering the same things. How do I know which ...
meetpd's user avatar
  • 115
1 vote
1 answer
82 views

Office administrative department requesting "admin" namespace

Our system administration (technology) department manages and maintains our servers and internet systems. It uses the admin namespace. An example is [email protected] . Our company newly formed an ...
block14's user avatar
  • 111
0 votes
1 answer
371 views

NGINX Block traffic to my home IP (default new website page or first subdomain), requiring a valid domain name hosted at home

My goal: disable/drop traffic to just home IP without domain in request. Issue: Currently, if I (or anyone else) accesses my home IP via HTTP or HTTPS, it will show the first subdomain that is ...
TheNoob's user avatar
1 vote
1 answer
44 views

System architecture for storing sensitive data separately without single point of access

We're building a SaSS platform with support for integrations. Each client has multiple integrations. We'd prefer not to store these integration tokens in a centralized location, where there's a single ...
Max Hudson's user avatar
1 vote
0 answers
544 views

Is it bad idea that all user and all devices connect to one WireGuard VPN interface?

I have few knowledge for network, I need some basic advice. On my business domain, users is facility manager or system installer. There are not many users and they can have some responsibility for ...
hando han's user avatar
0 votes
1 answer
440 views

Why create a new user with sudo privilege when you are the only person manage the server?

Please share some true use cases of benefits when you are the only admin of manage VPSs, I'm just hosted my first WordPress site. A lot of guide I read online suggests creating a new user after update ...
Maxfield's user avatar
  • 103
13 votes
3 answers
4k views

Should you encrypt data between 2 servers in the cloud?

If I have several AWS EC2 and azure instances running on separate regions. I am using rabbitmq to exchange messages between them. Should I worry about adding TLS and encrypting those connections? In ...
Tono Nam's user avatar
  • 322
1 vote
0 answers
154 views

Suricata Logged my Server Reaching Out to Known Abusive IP

I recently installed Suricata as an Intrusion Detection System on my Ubuntu-22.04 server. I setup Suricata following a tutorial on digital ocean (https://www.digitalocean.com/community/tutorials/how-...
Trent's user avatar
  • 11
-1 votes
1 answer
2k views

How do you protect (PHP) source code from the web host?

So, you just created the next killer app, possibly in PHP. You have done everything to keep hackers out. There is no way they can steal the code! Except for someone from the web hosting company, of ...
Singleton's user avatar
0 votes
0 answers
445 views

Windows Event Collector receiving TCP connections but no logs

I have recently built a new WEC (Windows Event Collector). The subscription has been created, and the WEC has been added to the Group Policy which defines Windows Event Collectors. The computers are ...
Skye Davis's user avatar
0 votes
2 answers
2k views

How do allow a range of IPs in /etc/hosts.allow but deny a single IP within that range in /etc/hosts.deny?

My /etc/hosts.allow file contains: sshd: 225.73. , 164.41. My /etc/hosts.deny file contains: sshd: 225.73.24.25 , 164.41.45.63 The problem I'm facing is that if I try to SSH from 225.73.24.25 or 164....
CP3O's user avatar
  • 101
0 votes
1 answer
45 views

Running user input that's formatted in a string

I'm aware that it's strongly advised to never execute user input as code, but I'm curious if my particular situation can be vulnerable to code injection: The user provides text input in a front-end ...
Matt's user avatar
  • 105
0 votes
1 answer
276 views

Will a web server get blacklisted for port scanning?

As I understand it, port scanning is an activity that can be a precursor to malicious activity, as one of the things it is used for is to scan for open ports that one can attack. In that train of ...
John Doe's user avatar
  • 365
0 votes
1 answer
274 views

nginx append query parameter with encrypted value to a react application

I want to send the DN field from the client certificate ($ssl_client_s_dn), but I want to send it encrypted. In the question nginx append query parameter to a react application it is explained how to ...
Ximo Dante's user avatar
0 votes
1 answer
265 views

nginx remove all query parameters and add a new one to a react application

I want to discard all the query parameters and add a new one (for instance DN=$ssl_client_s_dn). The reason is to prevent the client from sending this query parameter. Replacing the value of the query ...
Ximo Dante's user avatar
1 vote
2 answers
81 views

Are there any additional security considerations to be taken into account when activating IPv6 as opposed to IPv4?

As a sysadmin, I'm fairly experienced with IPv4. As such, I feel comfortable configuring firewalls to expose servers/services to the Internet with public IPv4 addresses. I have a basic understanding ...
Heinzi's user avatar
  • 2,237
1 vote
1 answer
148 views

Is it necessary to put public and private subnet in different vpc for extra safety

Currently we put public accessible resources like ALB inside public subnet, application servers and data storages inside private subnet (different data storage, say RDS and Elasticache, have their own ...
nevets's user avatar
  • 111
1 vote
2 answers
205 views

How to find out & set policy in Window Server 2016. To search in security event viewer for users accidentally delete shared network folder?

I am trying to set GPO so that I can search user in event viewer who accidentally deleted the share drive in the network. What other event IDs list can I search so that I know which category it ...
OSS IT's user avatar
  • 25
2 votes
0 answers
37 views

Disable computer on a schedule

I'm looking for a way to disable end user access to a Windows 10 workstation during a given period, say, from 8pm to 8am. It doesn't need to be superuser-proof. It doesn't need to be reboot-proof. ...
entonio's user avatar
  • 185
1 vote
1 answer
1k views

Implement CIS Microsoft Windows Server 2019 but found conflict?

I am asked to implement CIS benchmark for Windows Server 2019 What I have in "CIS Microsoft Windows Server 2019 benchmark v1.2.1" and I found rule 2.2.9 says Ensure 'Allow log on through ...
borgliu's user avatar
  • 11
0 votes
1 answer
73 views

Consolidation of Drop-in Config File for Securing Apache httpd [duplicate]

When setting up an instance of Apache httpd (2.4) on RHEL 9, I add the following as drop-in configuration file (/etc/httpd/conf.d/12-secure.conf) in an attempt to increase security. I would also like ...
JG7's user avatar
  • 196
0 votes
1 answer
266 views

Apache way to automatic login on a folder

there is a way to configure apache2 to automatic login a user in a password protected folder ? I know that with apache someone can make a folder where a user and pass is required, so when a user enter ...
Diego's user avatar
  • 1
1 vote
0 answers
207 views

Create VPN to lock down access to admin login page

I want to limit access to my wordpress site to people who are connected to a vpn. I dont want to setup a separate VPN server as literally the only function of this vpn is to block everyone else out of ...
Kravitz's user avatar
  • 167
0 votes
1 answer
1k views

How to get list of azure container images which are affected after security scans?

I know how to get repositories, we can use az acr repository list --name myregistry. But, how to get repositories with tags that are having security/vulnerability issues after security scans using ...
Python coder's user avatar
0 votes
1 answer
112 views

Ansible security best practices for monitoring

I have several servers at home. I would like to have one computer that will monitor activity on those and notice me if something is wrong. For that reason I install ansible there. In order to have ...
Addman's user avatar
  • 109
2 votes
1 answer
1k views

Does it make sense to conceal Wireguard port? [closed]

I have a server running Wireguard. Being a security paranoid, I'm using fwknop (Firewall Knocking Operator - a glorified port knocking server) to conceal the Wireguard port. This means that whenever I ...
Pedro Abrantes's user avatar
-1 votes
1 answer
664 views

Azure Security Alert - Login from an unusual data center

Azure Security Center generates an alert for a SQL Database that someone authenticated from an "unusual datacenter". Provided IP is Microsoft owned. Hostname is nothing recognizable.
RiverHeart's user avatar
0 votes
1 answer
80 views

NFS read-only export security considerations

Almost all articles about NFS security refer to clients faking uids to access files they are not supposed to. My concerns are different. My only export is read-only and effectively public (not exposed ...
Vojtech Kane's user avatar
0 votes
2 answers
38 views

Unable to login to Outlook after adding log on to on MacBook

I am trying to add log on to host to users who are using MacBook. In windows it is working without problem because I am adding specific servers to their log on. But whenever I am trying to login to ...
Rashad Aliyev's user avatar
-1 votes
1 answer
71 views

Every day specific new port blocked request spam at firewall log

At my server firewall log I found that there is majority of blocked request to one particular port which change every day aprox., lets say 4000 out of 5000 blocked requests per day, the remaining 1000 ...
Kazz's user avatar
  • 99
2 votes
1 answer
493 views

Since S3 charges by request, couldn't a malicious hacker cause a huge AWS bill just by spamming requests?

What would stop them from doing so, against, say, a static website hosted using S3? Is there a good way to deny some requests such that one avoids getting billed for them? (Context: I want to host a ...
Asker's user avatar
  • 121
-1 votes
1 answer
27 views

Programs and tool to scan open source software for vulnerabilities?

Since my business uses a lot of open source software I was wondering if there was a way to scan for vulnerabilities in the code before we either compile it, ./configure, make etc... Or as scripting ...
Definity's user avatar
  • 137
0 votes
2 answers
91 views

Regarding a rented dedicated server, can I remove IPMI (or relevant software) access and OOB (out-of-band) access to the server?

I am trying to secure a rented, dedicated server as much as possible. In my research I found that the hosting provider is likely to have access via IPMI and OOB. Is there anyway to prevent this, or ...
almighty's user avatar
0 votes
2 answers
125 views

How to remove hosting provider's access to my dedicated servers?

I am interested in renting and setting up a dedicated server, but I would like to keep privacy and security in mind. I would prefer that the hosting provider never have direct access to the operating ...
almighty's user avatar
0 votes
1 answer
270 views

Is the approach of backuppc (or similar backup architecture) safe in principle?

I'm looking over a physical server that runs VMware and 4-6 VMs (mostly Linux but also Windows10/11). Currently I'm backuping only 2 Linux VMs (the others aren't critical), by mounting an NFS share ...
Wojciech's user avatar
0 votes
0 answers
311 views

How to block flooding "empty" connections from single IP

Right now netstat lists 200 - 4000 connections to the same IP in India. Seems like some kind of flooding attack to me. e.g: tcp 0 0 [removed] 182.65.238.[removed].in-:mysql TIME_WAIT I've ...
jan's user avatar
  • 1
1 vote
0 answers
1k views

Troubleshoot Kerberos pre-authentication failed logons

Once in a while we get a notification that an account triggered too many failed kerberos pre-authentication attempts. This event contains the username and source machine. Here is an example: Kerberos ...
MeMario's user avatar
  • 65
1 vote
1 answer
4k views

Access wireguard using hardware Authentication like yubikey

At our company we use wireguard vpn to access our cluster. In our server, we install wireguard which will add a network interface that acts as a tunnel interface. The access with this tunnel will be ...
Rabieh Fashwall's user avatar