Tag Info

Hot answers tagged

12

Unfortunately Linux has bad implementation of urandom. You could use aes256-ctr with a random key and get several hundred megabytes of pseudo-randomness per second, if your CPU supports AES-NI (hardware acceleration). I am looking forward to urandom switching to a modern approach as well. openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom bs=128 ...


11

Rsync supports using ssh as a transport rsync -az /path/to/source username@host:/path/to/destination some older versions of rsync require you to specify ssh explicitly rsync -aze ssh /path/to/source host:/path/to/destination An alternative to using rsync is B. C. Pierce's Unison, which has similar functionality to rsync, but keeps a local index at both ...


11

Your friends might want to consider what the Chinese government might do if it finds them evading the firewall. Regimes that put up things like the Great Firewall aren't generally very understanding to people who evade their repression. Your friends have to balance the desire for private communications against the possibility of getting caught and the ...


9

The standard solution is to use use a VPN between two routers, and you adjust the routing so all LAN-to-LAN traffic crosses the VPN. Domains/Workgroups are really not related at all. A more relevant bit of information would be what type of routers both sites have, and if they can create L2TP, PPTP, or some other encrypted tunnel, or if they are running a ...


9

If you're mostly concerned with it being indexed by Google, et al., then you could use a robots.txt file. That said, if you tell robots not to index it, you're also tipping your hand to its existence. ("Ignore the man behind the curtain.") Two people so far have commented that if you put the directory in robots.txt, it becomes obvious that there's ...


9

Nobody's mentioned logging yet. If you are using plain HTTP, then any proxy / firewall device in between your server and your end user can log your URL and administrators of those devices will be able to see the "supposedly private" URL being accessed. If you want to be sure your URL won't be leaked even to intermediate devices like proxies and firewalls, ...


8

It is unlikely that it will be found, but you can't trust it. If you don't want the world to see it, put some kind of authentication on it so your friend has to at least log in. Even then, once you share it with your friend you can't be sure he hasn't leaked the secret to someone else. If you must do this, take it down once you no longer need to share it.


7

In a quick test under Ubuntu 8.04 on a Thinkpad T60p with T2500 CPU, 1GB of random data from openssl rand was 3-4X faster than /dev/urandom. That is, time cat /dev/urandom | head -c 1000000000 > /dev/null ...was around 4 minutes while... time openssl rand 1000000000 | head -c 1000000000 > /dev/null ...was just over 1 minute. Unsure if there's a ...


6

can VPN be implemented on the routers only? Can the computers on the network be configuration free? Yes. Assuming reasonable routers and a reasonable network layout. If your sites are all sharing the same IP range (i.e. they are all using 192.168.0.0/24 and therefore overlapping) then you'll have to do full NAT and things get messy. If you ...


6

Compress and encrypt the files in place, then transfer the encrypted copies using your known high speed "iPerf or regular FTP." If necessary, add an additional small file with the encryption key or keys necessary. That key file can be transferred with scp or sftp because it will be so small, the performance hit won't matter. Another alternative: Have ...


5

After reading your question, I think that what you're looking for is more along the lines of a deployment toolset rather than a development setup. Regardless of the direction you choose to go to, I think the first thing you need to do is get all the code under source control. You cannot reasonably have any reliable system for deployment without being able to ...


5

Do ironkey USB drives require special drivers? https://www.ironkey.com/ Edit: nope. From the FAQ, it doesn't require special software or drivers, apparently. Nor admin rights.


5

iptables -A INPUT -p tcp -m state --state NEW --dport 22 -m recent --name sshattack --set iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --name sshattack --rcheck --seconds 60 --hitcount 4 -j LOG --log-prefix 'SSH REJECT: ' iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --name sshattack --rcheck --seconds 60 --hitcount ...


5

You can use any X.509 client authentication certificate as long as your authentication source trusts them. Basically, you need a few things: A way to make the certificates. The easiest way to do this if you're in a Windows environment is with Active Directory Certificate Services. A way to distribute the certificates. You can do this via ...


5

I see a lot of answers saying that using random data isn't important. That's pretty much true if all you are trying to do is wipe the drive, but not so much if you are wiping it in preparation for disk encryption. If you fill a device with non-random data then place an encrypted partition on it you might run into a problem. The portion of the drive which is ...


5

If you want to erase a huge block device then I've found it more robust to use dd and the device mapper instead of output redirection of random data. The following will map /dev/sdb to /dev/mapper/deviceToBeErased en- and decrypting transparantly in between. To fill up the device on the encrypted end, zeros are copied to the plain text side of the mapper ...


4

php shouldn't matter when choosing passwords, or usernames, no programming language should have any real effect on it. I've always generated passwords for any service with pwgen -syB. For something like a databse, where you're sticking the password in a file, and won't have to actually remember it, I'd probably use pwgen -syB 10, or 20 however.


4

You might have to restore from backup. Even that would be tricky because of active directory not liking the previous database appearing on the network, though. Is this the only AD server you had? Are there backup servers? If this was JUST an AD server you might get away with rebuilding the box and re-joining it to the domain as an AD server. You also need ...


4

I have never used this, but this module that works with Catalyst 6500s claims it can do 2.5 Gb/s IPSEC on the wire. At least with Cisco routers, you can also limit what the IPSec is applied to on a IP/port pair, but seems like it might be good to encrypt everything anyways" VPN resiliency and high availability: Using innovative features, such as ...


3

You could use vsftp (very secure and fast ftp-server) and setup a "secure FTP Dropbox" the relevant config parameters are: local_enable=YES write_enable=YES nopriv_user=ftp anonymous_enable=YES anon_upload_enable=YES chown_uploads=YES chown_username=inftpadm ftp_username=inftpadm local_umask=002 anon_umask=007 file_open_mode=0666 dirlist_enable=NO ...


3

If If the folder above, i.e. ./~dehmann does not have automatic index generation turned on and there are no public HTML links or the like that reveal the URL of your secret folder then no, search engines and random visitors will not find the so-called secret folder. However, most people agree to the axiom that "Security through obscurity doesn't work". ...


3

Try FreeNAS. Don't use SAMBA, because it's a very chatty protocol, and it's not good for Internet access. If you can, put it behind a firewall (IPCop is a good choice), enabling only the protocols you need (I'd suggest FTP or SFTP over a non-standard port). If you can't here is an iptables sample config that you can use on the same box (save it to ...


3

Seems like you've covered it. We use a secure file transfer vendor - Accellion - as they provide a pretty decent all-in-one solution, that also runs on top of VMWare (they provide a complete vm image). One requirement is that everything be encrypted - so you have to get on the VPN to access the service. Once in, the vm appliance takes over, authenticates ...


3

While the "open" suggestions are great, if you're asking this question, my guess is that you're unlikely to have success implementing them. Save yourself alot of trouble and pick up two routers with VPN capabilities from a vendor like Linksys, Netgear, D-Link, or even Sonicwall. They are very easy to set up and will connect two networks together securely. ...


3

Not possible. Since your certificate is not valid for www., browser will display a warning before following any redirect you set. Go on and purchase either a separate certificate for www., or one that includes both -www. and naked domain. Note that widcard alone may not be enough - *.example.com does not cover example.com, unless example.com is also ...


2

I'm not aware of any existing item with this particular design goal. The best you will get is a DBMS with reasonably good built-in security. Most of the 'NoSQL' DBMS applications don't offer anything particularly special in security. Traditional database management systems often have quite rich security models and security on this type of system is a ...


2

You can use Kerberos. When using NFS without kerberos the security of all data in the NFS share depends on the integrity of all clients and the security of the network connections. If you use kerberos the security doesn't depend on all client machines because the server gives access to users with a valid kerberos ticket only. More (general) ...



Only top voted, non community-wiki answers of a minimum length are eligible