Hot answers tagged

8

Have a look at vaultcmd.exe: There are my credential vaults on the file system. But I am not sure whether it's supported to just delete the vault from the file system, or if it'll leave the user's credential vault in a broken state. Also have a look at vaultcmd /deletecreds: vaultcmd /deletecreds:"Web Credentials" ...


6

This turns out to be quite a difficult problem, if you limit yourself to the single system which you're trying to validate. Fortunately, we live in the real world, where there is more than one computer! Some possibilities for verifying the binary include: Using another reference system which has the same package version of RPM installed, take a hash of ...


6

Remember that localhost (127.0.0.1) is the loopback interface on the system. If someone can snoop traffic on that interface, they are already on your system so you have worse problems to deal with.


3

Have you considered the possibility that your local system is already infected and has a keylogger on it that records all your passwords etc.? Especially if your adversaries may be targeting you directly? I would suggest the following: Use a secure local system, for example a system booted from an officially purchased LiveCD (or just a friend you know has ...


3

This looks like your server is being used in a DNS amplification attack[1][2][3]. This means that your server is bombarding Google's DNS server with queries, so yes your server is being used to attack Google. You are not being attacked, your server has been compromised and being used to attack someone else, in this case it looks like that it is Google. ...


3

Assuming your cert is strong, and not generated by a compromised or weak piece of software, certificate-only root login protects you against root logins from people who do not have your certificate. That's it. It does not protect you against remote access vulnerabilities or exploits, it does not protect you against someone stealing your certificate, it ...


3

The article you linked provides an explanation of what rights Log on as a Service provides: The Log on as a service user right allows accounts to start network services or services that run continuously on a computer, even when no one is logged on to the console. In short, you only want to provide this right to the accounts that need it - by default, ...


2

Any user can execute ifconfig. The problem is that usually you want ifconfig to be executed with root permissions, so that you can temporarily change your system configuration. Changing the group of the binary (and having to play with setuid) is not the way to do this. Execute visudo and add the line %if ALL=(ALL) /sbin/ifconfig to the end of the file. ...


2

Yes, you can do this; this sort of setup is commonly referred to as a bastion host or jump host. However, when implementing any security practice, it's useful to build an explicit threat model: what attacks are you trying to protect against? A current employee from doing things they shouldn't (perhaps accidentally)? A former employee using old credentials ...


2

# rpm -K rpm-2.3-1.i386.rpm rpm-2.3-1.i386.rpm: size pgp md5 OK From http://www.rpm.org/max-rpm/s1-rpm-checksig-using-rpm-k.html


2

I'd first use fail2ban to watch the web server log, and any time it sees a dodgy hit, firewall that ip for the next hour or something along those lines. However that relies on having root access to your server to manipulate the firewall. There are third party services like cloudflare who can clean up your traffic before it gets to you. Their services ...


2

I just encountered the same phenomenon and fixed it. It is caused by the lack of required modules of Perl in the system. Try this; By using cpan or cpanm (Perl module manager), install Date::Calc like, cpanm Date::Calc Retry installation by ./install.pl of PSAD source tree.


1

You need to add extra rules to ufw to satisfy psad. Edit following two files: sudo vi /etc/ufw/before.rules sudo vi /etc/ufw/before6.rules To both files listed above, add following lines for psad, at the very end, but before COMMIT # custom logging directives for psad -A INPUT -j LOG -A FORWARD -j LOG # don't delete the 'COMMIT' line or these rules ...


1

"This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers. By default, no accounts have the privilege to log on as a service." https://technet.microsoft.com/en-us/library/cc957141.aspx Accounts that aren't in that list shouldn't be able to log in as a service, so if ...


1

In that case, I would say that fail2ban would not be required. I would really only use fail2ban when you have to expose a management service to the Internet in the hypervisor (aws) firewall. In your case, all requests except those from your IP are being dropped. One thing to note, if your IP address changes (non-static) you will have to update the aws ...


1

No, it is not safe to configure your firewall as you indicated. Using a firewall configured using the rule in the image you linked would be a security risk because that rule effectively opens up ALL ports and all protocols. The reason your port 21 rule was not working was because FTP actually requires 2 channels to function, a command channel and a data ...


1

The first proposition means : Are SYN and FIN and RST flags at 1 ? Whatever the value of the other flags. The second proposition means: Are SYN at 1 and ACK at 0 and FIN at 1 and RST at 1 and URG at 0 and PSH at 0 ?


1

I think your colleague is talking about a forest model that uses an empty root domain and the one or more child domains. The root domain would store just the Enterprise Admins Group, Schema Admins group as well as the Schema Master FSMO role and the Domain Naming master role. The Enterprise admins group will then have full control on the child domain. the ...


1

What your colleague is referring to is something that was considered an acceptable practice a very long time ago. That is no longer the case (and I'd argue it was of dubious value 15 years ago, even). Because the forest (not the domain) is where your security boundary lies, you get very limited additional security out of this setup (if any), for which you ...


1

It would actually be more secure to have a separate bastion forest for Administrative accounts and groups. You can read more about it here: Privileged Identity Management for Active Directory Domain Services (AD DS) https://technet.microsoft.com/en-us/library/mt150258.aspx Let's say you have a production forest with domain controllers in 100 ...


1

There are separate settings under each ZoneMap key for “ESC on” and “ESC off”. If ESC is on, only those settings under the EscDomains and EscRanges subkeys are used; if ESC is off, only the settings under the Domains and Ranges subkeys are used. https://msdn.microsoft.com/en-us/library/ms537181%28v=vs.85%29.aspx As you want a machine setting, ...


1

You can set-up SSH keys to every user, so they have to use private key to get access to SFTP server. Let clients generate private and public key by themselves and let them send public key to you, so you can add it to ~/.ssh/authorized_keys file. You can generate private and public key ofcourse by yourself but that means you need to send private key to ...


1

SSH tunnels can be a great option to securely connect across a hostile network. We've found SSH tunnels very simple to implement and understand and more reliable, than some VPN options. Also can tunnel all sorts of things even when the native app protocol doesn't support SSL/TLS. Good to put your SSH in a bash script that will run the SSH tunnel in a loop ...



Only top voted, non community-wiki answers of a minimum length are eligible