Tag Info

Hot answers tagged

5

My opinion in these cases is to port block every single port except those that are required for the server to perform it's primary purpose (http/s, ftp, sql server), and even then, restrict those ports to only certain IP blocks when possible. Don't configure any remote connectivity for these servers except for those necessary services. Then deploy a bastion ...


3

Canonically, that ESTABLISHED rule is actually RELATED,ESTABLISHED. It won't affect SSH or HTTP(S), though—the difference is that RELATED also encompasses what are technically new connections, but at related to an existing one, as in FTP data channel communications or ICMP echo replies. Overall, what you have done here is just fine.


2

I'm not 100% sure on what they mean by disabled but quite a few binaries on an average linux bistro would be linked to libwrap.so (e.g. sshd) which is a lib provided by the tcp_wrappers package. You're correct in that this won't make any difference unless there is configuration in hosts.allow or hosts.deny files.


2

Deffinitely it's not. It would result in data inconsistency. You can try to run replication; 2 instances of mysql on one server 1 master -> 1 slave; two datadirs


1

This should just be an MTA configuration issue. Configure a Postfix smarthost on both the mail1 and mail2 machines to send all mail for the relevant domains (or all mail if all they do is receive email) to webmail1. The following describes a typical Postfix configuration to achieve this, either by adding a relayhost entry to main.cf (if you want all email ...


1

Not a windows guy so i can't speak too much to WinRM specifics. the bottom line, though, is that any remote-access service like ssh or winrm has risks and benefits. From what I can tell they provide roughly analogous functionality. If they provide similar levels of AAA then you might treat them similarly in your security posture. E.g., if WinRM uses ...


1

WinRM is capable of using HTTPS transport, and if your machines are in the domain and have your enterprise certificates on them already, it should Just Work.


1

Replace your icmp rule by the following: reject icmp 10.10.10.2 any <> 10.10.10.1 any (msg:"Blocking ICMP Packet from 10.10.10.2"; sid:1000001; rev:1;) Note that there is no snort rule action called block. Use either reject or drop. For more information, see this manual page. UPDATE: I am not sure you can put more than one interface in your snort ...


1

Try to scan for existing short filenames with fsutil: fsutil 8dot3name scan /s /v E:\inetpub\wwwroot And strip them if they are found: fsutil 8dot3name strip /s /v E:\inetpub\wwwroot Also looking at the log with empty magic part (magic part: ""), I wonder could that be a bug in the POC. This line in config.xml looks like it has extra comma after ...


1

On RHEL and CentOS, authentication errors go to either /var/log/messages or /var/log secure: # cat /etc/rsyslog.conf | grep auth # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* ...


1

This is a quite old thread, nonetheless: We use two different authentication systems in-house, management of machines is done from local workstations in my team. I wrote a vars_plugin for Ansible (a rather complete implementation may be found at https://gist.github.com/mfriedenhagen/e488235d732b7becda81) which differentiates several authentication systems: ...


1

This is fixed now in recent kernels. The kernel fix references RFC 5961 section 3 which deals with the same issue.


1

Use mysql_secure_installation to remove anonymous users, test databases and also prevent remote connect using root user. http://dev.mysql.com/doc/refman/5.0/en/mysql-secure-installation.html



Only top voted, non community-wiki answers of a minimum length are eligible