Questions tagged [security]

For questions relating to application security and attacks against software. Please don't use this tag alone, that results in ambiguity. Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. If your question is not about a specific programming problem, please consider instead asking it at Information Security SE

Filter by
Sorted by
Tagged with
13 votes
3 answers
5k views

How dangerous might it be - and what performance gains may be had - by turning vulnerability mitigations off on non-Internet facing servers?

When a virtual machine Linux host server is non-Internet facing and is used exclusively on a LAN and is using a relatively well tested distribution like Proxmox, how dangerous would it be to turn off ...
378 votes
22 answers
67k views

How do you search for backdoors from the previous IT person?

We all know it happens. A bitter old IT guy leaves a backdoor into the system and network in order to have fun with the new guys and show the company how bad things are without him. I've never ...
0 votes
0 answers
50 views

Remove old kernels with security implications / vulnerabilities

Some scanning tools (Qualsys, Sentinel, etc) detect installed old kernels and will report them as problems if those kernel versions have vulnerabilities. Is there a way to remove them if they have ...
5 votes
2 answers
2k views

Why enabling _only_ TLSv1.3 is a bad idea?

I have NGINX configured to only support TLS version 1.3 However when I go to https://check-your-website.server-daten.de/ It shows the error Error creating a TLS-Connection: TLSv1.3 found, but no ...
-3 votes
1 answer
38 views

Making production-ready + securing a server (Ubuntu 22.04, NodeJS, nginx)

I started working for a startup as a full stack developer. The product is a SaaS that has been developed by an external company, and they take care of the hosting as well. My boss wants the app on our ...
-1 votes
1 answer
2k views

How do you protect (PHP) source code from the web host?

So, you just created the next killer app, possibly in PHP. You have done everything to keep hackers out. There is no way they can steal the code! Except for someone from the web hosting company, of ...
0 votes
2 answers
53 views

Why is https communication not working with iptables?

I'm trying to configure iptables for security settings. Basically, I set up a whitelist and tried to test it. I set the following settings to allow ssh, http, and https to my server by allowing input ...
2 votes
3 answers
772 views

How do I use apt-get to install one update at a time?

I have inherited 15 servers running Ubuntu 16.04 and need to install security updates on them all. I have been told by my manager to install them one at a time and then test the system to make sure ...
0 votes
2 answers
41 views

OpenVPN - Properly sharing keys/certificates

I enabled OpenVPN on the router at work so that we can connect to different devices like our NAS and RDP into the computers there without opening those ports to the internet. One cause of concern that ...
8 votes
2 answers
3k views

How to secure TeamCity deployment via Web Deploy service?

My team uses TeamCity for continuous integration. It will build, test and deploy web applications via Web Deploy to dev and qa web servers. The tricky part is deploying to a production web server - ...
77 votes
4 answers
293k views

How to grant network access to LocalSystem account?

How do you grant access to network resources to the LocalSystem (NT AUTHORITY\SYSTEM) account? Background When accessing the network, the LocalSystem account acts as the computer on the network: ...
2 votes
3 answers
5k views

OpenStack Horizon behind reverse proxy (nginx preferred)

Current situation: I have a Triple-O OpenStack installation (Liberty) where even the "public" network is in a private environment (10.24.7.0/24 network). The only way to get access to that network is ...
3 votes
2 answers
3k views

Why is PHP open_basedir not considered a security model

On servers doing shared web hosting, or sharing the PHP environment between different PHP applications, I usually implement a security policy that uses PHP open_basedir to restrict each user to his/...
0 votes
1 answer
5k views

Windows 10 - Shell commands for CTRL+Alt+Del not working

We have an icon with a target path of "explorer.exe shell:::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}" which pulls up Windows Security window in order for users to select change password from ...
0 votes
0 answers
33 views

Create custom SELinux policy with full access

I have a process my_process which should have access to all processes, files, ports, network traffic, etc. This process needs to work with SELinux. How can I configure the appropriate policy? I tried ...
0 votes
1 answer
9k views

Event ID 521 - Critical Logging Failure on Domain Controllers

I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm. I noticed a few weeks back that we had large volumes of this event originating from all of our domain ...
1 vote
1 answer
170 views

How to enable Kerberos authentication with a specific user when disabling RC4_HMAC_MD5 encryption type?

I have a problem and I hope some of you stumbled on the same problem and solved it. I have two accounts on a specific domain (let's say account A and account B). When I have RC4_HMAC_MD5 encryption ...
3 votes
2 answers
9k views

windows security log - failure reason startswith %%

Please help - do You have the list with descriptions of failure reasons eg. %%2313, %%2307... I've researched Net and nothing.. :( Mainly I see it in ID 4625 in Windows security logs. On http://www....
0 votes
0 answers
25 views

limit container connection on specific ip address

I just run a container on 8000:8000 my server 192.168.1.10 so if I run curl 192.168.1.10:8000 from another server (like 192.168.1.50) it will return hello-world from my API. I want to limit the ...
0 votes
1 answer
114 views

Can't stop attack on nginx server

I'm currently struggling with my Digitalocean droplet (Ubuntu 22.10) which is under some sort of attack (maybe DDOS). The server hosts a containerized application that runs on nginx. Every time I ...
0 votes
1 answer
139 views

Windows Server - many event id 4625 authentication failures

In a small network environment, we have one Windows Server with Domain Controller, DHCP and DNS. When every non-domain Windows client connects to the network, a lot of 4625 logon failure events are ...
2 votes
3 answers
34k views

Error 4673 audit failure filling security logs

I have an isolated desktop computer in my office that I run weekly security audits on. I check the logs for odd behavior then export and clear them out. The logs are filled with "Audit failure ...
0 votes
1 answer
112 views

VPS https and redirect for domain

I recently bought a vps ( apache + ubuntu) and created ssl-certificates for my domain by using acme.sh --issue --dns -d example.com -d www.example.com and got them. But for my domain I want https to ...
0 votes
1 answer
326 views

Unauthorized error when trying to get a ssl certificate with certbot

I recently bought a domain, hosting and a Ubuntu 22.04 vps, all on godaddy. The domain and hosting work, I can access the site by typing the url in. But when I try to get a ssl certificate with ...
0 votes
0 answers
55 views

Why did my Azure virtual machine reboot amid omsagent/omi activity?

A virtual machine of mine, running RHEL8 in Azure, was down for a couple minutes. Turns out it rebooted. Telemetry and logs show no issue. There were no dnf updates and no scheduled update window. ...
0 votes
1 answer
194 views

How to assign certificate to IMAP/S and SMTP/S in Exchange 2016?

Please advise me because I pull all my hair out. I have Exchange 2016 and I want to assign one officially signed-off certificate to the IMAP/S port 993/tcp and SMTP/S port 465/tcp . I went through ...
0 votes
0 answers
42 views

several tomcat apps running as user, using single java jdk installation owned by root

We administer server with java web applications: alfresco/solr running on tomcat. Up to now java jdk sources of same versions were extracted/copied in several directories next to each other, so ...
11 votes
1 answer
5k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request interface ...
2 votes
1 answer
267 views

FAPolicyD overhead slowing down a server

We have a server with the Alma Linux 9.3 OS. By default (as well as all current RHEL-like OSs) it has fapolicyd enabled. There is also an application server (WildFly/JBoss/Java) running on that server....
2 votes
2 answers
719 views

Is there a way to check if a user has specific rights?

In my application I'm using ntrights.exe, that is part of Windows Resource Kit, to grant and revoke a specific user right. For example to grant a user "Log on as a server" right, I execute using ...
3 votes
3 answers
9k views

ntrights equivalent/replacement for Server 2008

Does anyone know what or if there exists a replacement utility for the Server 2000/Server 2003 command line tool ntrights on Server 2008? More info on this utility (for those that don't know what it ...
0 votes
0 answers
21 views

Create an internal alias to external service with istio

Using istio is it possible to make an internal alias to a service outside the service mesh that was defined using a ServieEntry and control access to the external service? For example suppose I have a ...
0 votes
1 answer
75 views

Login prompt reports 4 failed login but the log shows only 1 entry

I just logged into my small homeserver and I saw this message: Last failed login: Sun Jan 14 17:08:42 CET 2024 from 192.168.1.111 on ssh:notty There were 4 failed login attempts since the last ...
1 vote
1 answer
9k views

you must have read permissions to view the properties of this object, administrators group

I think I'm having some difficulty understanding NTFS permissions. My understanding is that when possible you want to avoid assigning a specific user account to NTFS and instead use a group. So I set ...
1 vote
2 answers
1k views

Is it possible to encrypt 'data in use' in Windows Server?

Data can have 3 states (in transit, in use and at rest). I know that for Windows Server, common methods of encryption are: In Transit = IPSEC In Use = ??? At Rest = BitLocker Is it possible to ...
0 votes
1 answer
211 views

How to use LAPS client for local Active Directory on an AzureAD joined laptop to request passwords for other LAPS endpoints on local AD?

I've prepared a new laptop that is AzureAD joined, and installed the LAPS client for local Active Directory. Running the LAPS client results in the message "LDAP Server is unavailable". As ...
0 votes
2 answers
1k views

Does the server SSL certificate need to be kept private?

I understand that private key definitely does, but what about the certificate file? I also understand that the server sends (part of?) the certificate to a connecting client, but does it send the ...
0 votes
1 answer
56 views

Why would /etc/krb5.keytab change?

A half-dozen boxes out of hundreds reported a changed /etc/krb5.keytab all within a few minutes of each other on a random Saturday. No one was logged in at the time of the changes. I have asked for ...
10 votes
4 answers
8k views

Is there such a thing as a signed SSH keypair?

We are transferring files to a remote server in our application and the required method of authentication is to use SSH keys. So, I created my keypair using ssh-keygen and submitted my public key ...
0 votes
1 answer
149 views

Why would IT lock down SeIncreaseWorkingSetPrivilege?

Question: Why would anyone lock down the SeIncreaseWorkingSetPrivilege == Increase a process working set == https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-...
0 votes
0 answers
69 views

Failed to create Azure Streaming API settings with error AdvancedHunting-DeviceFileEvents_CustomCollection' is not supported

I want to export Microsoft Defender logs to a SIEM tool. I have done the following: Created a event hub namespace ns-defender Created a event hub inside the namespace eh-defender Clicked on ...
0 votes
0 answers
49 views

Domain registration email not in bailiwick to prevent in case of domain hijacking. How to do it without using personal email?

In the part II of the blog posts serie on Good practices for the registration and administration of domain portfolios, ICANN mentions these good practices: Don't use personal email for registration ...
0 votes
0 answers
17 views

Following Istio TCP Traffic authorization tutorial and getting 'connection rejected' instead of 'connection succeeded'

I'm following the Istio security authorization TCP Traffic tutorial. On step 5, Verify that sleep successfully communicates with tcp-echo on port 9002., I get a connection rejected result rather than ...
0 votes
0 answers
46 views

GPG not decrypting PGP file in cmd line / script

Using Kleopatra / GPG4win Have keys / secrets installed. Key trust is set to ultimate, validity is full, not expired. See it listed when doing gpg --list-secret-key and gpg --list-keys, everything ...
0 votes
1 answer
308 views

Docker- Giving Container access to Host's CA certs

I was wondering security wise if there was anything wrong with volume mounting the host's ca certs into a container. I.e, docker run \ -v /usr/local/share/ca-certificates:/usr/local/share/ca-...
0 votes
2 answers
683 views

Updating Expiring Keys - Azure OS Disk Encryption

Whilst day dreaming at my desk this morning, something occurred to me and I have not been able to find an answer of yet. So I am hoping someone may shine some light for me or just have a good ...
4 votes
1 answer
11k views

Azure Active Directory account auto-expiration

I need to set some user accounts in AAD to expire in some time. For example, students in the university should not be allowed to access class sharepoint site after graduation (4 years). Is their some ...
0 votes
2 answers
219 views

Windows AD getting hammered by unknown system, need to find out source

Mostly unmanaged network. Firewall at perimeter, Unifi Wifi. No other real visibility. Win SVR 2016. Event viewer shows 60k+ events of entirely event id 12294: "The SAM database was unable to ...
5 votes
2 answers
19k views

How do i completely logout of Google Cloud? `gcloud auth revoke --all` doesn't cut it

Logging out of Google Cloud seems like it should be easy. If I run: $ unset GOOGLE_APPLICATION_CREDENTIALS $ gcloud auth revoke --all Revoked credentials: - [my account] $ gcloud auth list No ...
46 votes
2 answers
74k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...

1
2 3 4 5
139