Hot answers tagged

7

Your "only disadvantage" is a very big one, IMO. No one I know types out https:// in URLs very often. I'd suspect 99% of normal users would just go "huh, site's down". A HTTP POST would indeed send the data unencrypted. It will also fail, because the redirect will cause it to turn into a GET. That said, there's little reason people will be making HTTP POSTs ...


5

Erm... You can't delete active files like this. You called a 64 bit powershell instance to delete a module for the 64bit shell. Powershell preloads modules (but doesn't necessarily install them) which locks the module file.


5

Are there any disadvantages of blocking port 80 completely? The only disadvantage I can think of is that customers are forced to enter https:// in front of their url, instead of relying on the automatic redirect. That is exactly primary reason to leave port 80 open, user-friendliness. AFAIK most browser still default to using http:// when you enter a URL ...


4

Where does that certificate ultimately persist if I put it on the ELB? The certificates are stored in IAM. They should be as secure, there, as your account credentials are, so this seems like a misplaced concern, to me, once you have this information. The ELB instances fetch the cert, chain, and private key from IAM whenever they start up or scale up. ...


3

Yes, removing the redirect will cause major issues. New customers will not know about this, nor will many crawlers that you may want to allow access to. The threat vector that you are closing off is negligible. The POST data will likely be sent in the clear as a single HTTP request, which will then trigger the redirect. However, in most cases, a POST implies ...


3

Commands that start with an exclamation mark ! escape the FTP client and are executed locally with the rights of your local user. The don't run on the server, actually they won't even reach the server, so there is nothing for vsftpd to block.


3

Blocking IP Addresses dynamically without any software First, your title makes no sense. Software must be involved in this. There's no way around that. Perhaps you meant "Any Additional Software"? Next - if these IPs are already in your UFW block log, then why do you want to block them again? UFW has already blocked them? Speaking frankly, you really ...


2

As I see it, there's a problem that if the script is running as the user, they need to have permission to write to the I drive. You could, perhaps, have a scheduled task, running with write permissions on the I drive, that pulls the files. Perhaps they could create a file called "readytocopy.txt" or something like that. When the scheduled task finds ...


2

If you cannot find the files that it is loading in your web directory, there could be a problem of someone pointing your DNS to their server in order to hijack your traffic. I would start with verifying your DNS, and after that is made sure to point to the correct place, try running a new installation of wordpress with just a default page to see if it ...


2

No, it is not a good idea. You can rely on the per-IP and per-username login attempt rate limits which you have already implemented to ameliorate password guessing attacks anyway. You have implemented login attempt rate limits, haven't you?


2

This does not secure the connection between these hosts at all. It lowers the attack surface on the server side when you limit access to daemons as much as you can but it doesnt help you when it comes to connection security. If possible you should enable SSL to increase the security of the connection. If this isn't possible you might consider setting up an ...


1

Don't bother. See Why is HMAC-SHA1 still considered secure? Don't confuse the use of SHA1 as a certificate-signing algorithm (which is insecure) with the use of SHA1 in a cipher suite's HMAC.


1

If you have users that have root access to the machine, they can do anything they want. Any measures you put in place to prevent enabling of the NIC could be trivially worked around. So your options are: Don't give root access to users on this system. Instead, broker what privileged commands they can use with sudo. Sort out another way to disable/enable ...


1

There is a reason we refer to elevated accounts as "privileged" - there has to be some implicit level of trust you are granting Administrators as they have the ability to grant themselves access to most of your content. For "protecting mailbox data" I would enable legal hold on it, all changes to mailbox items are kept and you can't delete items, they are ...


1

You should instead look at auditing access control changes and non-owner access to mailboxes. Office 365 can do this, but only alerts on such incidents at the highest tier E5 plan today. If this is on your roadmap, then you are practically solved.


1

No one will fake your IP range to get pass a firewall. The only way to do this is easily if your app is all UDP. That said just allowing your office's IP in is the first start. You might want to expand on that as the company grows. Like does everyone in the office need access to the whole AWS VPC? If not then you are looking at site to site VPN connection ...


1

As always, it depends. In theory the log on process is a one-time event and once an active session has been established the actual usage patterns of authenticated users are what really determines the load on a server. In that regard even the computational cost of calculating a hash that was deliberately selected for being slow and expensive such as PBKDF2 ...


1

Those descriptions are a bit vague. There are two tokens. A process Access Token, and a Kerberos token. The process token is specific to the local computer. "In Windows implementation, the application server derives the authorization data (PAC) and requests Windows OS to generate an access token." https://blogs.msdn.microsoft.com/openspecification/...


1

No, I would not do it. If your system is a Web servers and everything is fine there is no benefit in upgrading from 14.04 to 16.04. Secutity updates for this release will be up to 2019 year, so stay withing 14.04 LTS. You, or someone else, can upgrade it three years later.


1

Transit encryption for SMB was introduced in version 3.0, which is what Server 2012/Windows 8 come with. (And SMB 3.0 requires Server 2012/Windows 8). So an SMB transfer between Server 2008 R2 servers would not be encrypted, and could be sniffed, yes. (As would an SMB 3.0 connection, by default - it's something you have to enable.)


1

This is possible with a combination of a script, a scheduled task, and NTFS permissions. Assuming you have no sub folders and just files in a single folder, this is how to achieve it: Groups Set up a Users Group Set up an Admins Group (use the built in ones if you like) NTFS Permissions on the destination folder (I:) Read, List Folder contents, ...


1

I will agree that the situation is not ideal, but there is no threat here to your account, and informing you wouldn't be the best option. cPanel uses Apache's VirtualHost sections to determine which content is served for which request. In most cases, the IP address, port, and hostname should all match a single VirtualHost entry. However, if there is no ...


1

Don't use Domain admin accoutns for service accounts. if the service is compromised then your domain admin account could be as well. I would create separate user accounts for each service and give them the rights they require for their role. What Server OS are you using? there is some good advice in this blog: http://www.systemcenter.ninja/2012/05/system-...


1

Inbound options do not apply to PHPMailer. SSL on port 465 (SMTPS) has been deprecated since 1998, though Microsoft didn't seem to notice. Use SMTP+STARTTLS on port 587 instead, which is what PHPMailer does when you use SMTPSecure = 'tls' & Port = 587. Note that PHPMailer does opportunistic TLS, in that if you don't tell it to use TLS and you connect to ...


1

netstat -b -o lists the network connections, process and PID - you should be able to figure out which IIS worker process is doing all the port 25 connections.



Only top voted, non community-wiki answers of a minimum length are eligible