Tag Info

Hot answers tagged

12

How about turning this around: The workstations are in a secured LAN, Internet access is restricted with a proxy to a number of white-listed sites that developers need - like StackExchange :). Developers have admin rights on the workstations. For all other needs, they can connect to a VM and have (external) e-mail and possibly full Internet access, but no ...


4

I know of two specific vulnerabilities. There is the reflection/amplification mentioned by HÃ¥kan. And there is the possibility of zone enumeration. Reflection / amplification Reflection means attacks in which requests with a spoofed source IP are sent to a DNS server. The host being spoofed is the primary victim of the attack. The DNS server will ...


4

Assuming that the example you're pointing to is actually the one about "The site is using outdated security settings", and not "does not have public audit records", about 99.99% sure that your problem isn't CT, for several reasons: It is my understanding that only CA certificates in the system trust store are subject to CT validation; locally-managed CA ...


4

Yes, you can block/prevent/deny executables with Applocker, providing that the client OS supports Applocker.


3

There are a few (ha!) service accounts in use by SCCM. None of "daily operation" accounts needs to be a domain admin that I can remember (except perhaps during setup and AD schema extension). See the description of roles here: https://technet.microsoft.com/en-us/library/hh427337.aspx Executable installs are either performed on endpoints using the local ...


3

Using an RD Gateway is a superior solution. It should satisfy requirements of infosec as well.


3

I'm not sure you want to do that. If there is no default vhost in an apache config, the first defined vhost becomes the default. All you really need to do is have the default serve a blank page.


3

The thing that comes to mind is not actually DNSSEC specific but rather about the EDNS0 extension, which DNSSEC relies on. EDNS0 allows for larger UDP payloads and larger UDP payloads can allow for worse traffic reflection/amplification attacks. I don't know what the percentage of validating resolvers is but popular nameserver software seems be shipped ...


2

Yes, iptables will do the job. Set default policy for OUTPUT to accept: iptables -P OUTOUT ACCEPT. Allow all IPs by repeating same rule but changing source IP like: iptables -A INPUT -s ip1 -p tcp --dport 443 -j ACCEPT. Allow SSH port 22: iptables -A INPUT -s ip4 -p tcp --dport 22 -j ACCEPT. You need to deny other traffic for INPUT chain or set default ...


2

The best way to deal with a DDoS is to start as far away from your connection as possible; you want to cut off such an attack as close to the source as possible. First, find out the IP addresses being used, whois them, and talk to the ISP on the far end. They might not be able to help if they're in a foreign country, or spread all over the world, but if ...


2

Since you're going to shut down the servers, boot one of them with a live CD/USB key, mount the root filesystem and chroot into it. Then change the root password and check if there are other users presents and change their password too. Then you can reboot it, connect to the network and procede with the same procedure with the other server.


2

No need to boot up with a live cd as suggested by @Mr Shunz, since the system is working. Just restart the server, in the boot manager select to edit the boot parameters and add an 1 to the end. The system will boot in runlevel 1 with no network and the root user already logged in. Eventually disable system management programs from starting up automatically ...


2

Yes and No. You can comment out or remove the DocumentRoot directive, no problem. But that doesn't achieve much, because then it will default to the default directory PREFIX/htdocs/ where PREFIX is set when you build apache. When you have VirtualHosts set up all requests that are not handled by an explicitly configured virtual host get handled by the ...


2

The point of keeping secrets out of source code is so they don't go into source control. This is particularly useful in open source projects. When deployed, it doesn't matter if the secret's in a file or envvar. What's important is that only the OS user that your program is running as can read it. This is the default for envvars, which is convenient. Root ...


2

Is there a written company policy about who, and why any particular information is to be accessed on a networked computer, and why this particular info needs to be on a networked computer in the first place? If this is data is for this office only, why not budget a extra laptop or use an old "offline" computer that can be only accessed in the actual office? ...


1

When you get an Access is denied. [0x00000005] error, apply the following patch to the registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System create or modify 32-bit DWORD: LocalAccountTokenFilterPolicy set the value to: 1 Windows Server 2012 (64bit) To connect to Windows Server 2012, Change Permission for following ...


1

With the Z1 you could create two VLANs - one connected to the VPN and the other not. You would then create SSIDs that connect devices to each of these LANS. You could designate certain ports VPN ports, and others not, and instruct employees to connect company devices to the company SSID or ports, and their own devices to to the other SSID and ports. ...


1

Simply put, a Domain Admin can do whatever he wants to do (hence domain admin!). There is no way to block someone who has stolen domain admin credential. He can override whatever security measure you put in place.


1

Modifying Samba and/or NFS is not the proper solution here. Instead further restrict ssh access in /etc/ssh/sshd_config to those users which should have access by using AllowGroups/AllowUsers. You may also be interesting in using Match blocks, depending on your situation.


1

You could try rejecting every port other than what is required. A PPTP VPN connection uses 1723 if I recall. Then maybe port 80 for the "I agree" and whatever is needed for core networking on your OS. Everything else you could deny. Then after the VPN connects disable the firewall rule.


1

Normally passwords would go into a password file and be read as need by the transport that needs it. The example configuration should contain auth examples for both server and client connections. It is possible to configure multiple authentication methods for server authentication and/or client authentication. Exim uses two passwords files by default: ...


1

Good point. Good for you that you think about security of configs in particular. The answer is it depends (as usual). For e. g., if you have exim running in its own OpenVZ/LXC/Docker/KVM/XEN/PhysicalServer ergh... let's call it "scope", you can bother not, probably, as except root there wouldn't be anyone who could peek into this config. At contrary, if the ...


1

Yes, the blog post you linked (from 2011) appears to contain obsolete information. From the docs: If the bucket is versioning-enabled (or versioning is suspended), the Expiration action logically deletes the current version by adding a delete maker as the new current version. The NoncurrentVersionExpiration action permanently removes the noncurrent ...


1

Assuming that you can use a lifecycle policy to delete and/or archive the old versions in a way that works for you, there's no need to give your script delete permissions at all. This approach works great for me in conjunction with the AWS CLI tools. Here's what my bucket policy looks like: { "Version": "2012-10-17", "Id": "IDHERE", ...


1

Thanks for the other answers. I solved it by adding a default virtual host without any permissions. The global DocumentRoot and ServerName options must match the ones specified in the virtual host. /etc/httpd/conf/httpd.conf ... ServerName <server-ip>:80 DocumentRoot "/var/www/html" <Directory /> Order Deny,Allow Deny from all ...


1

A ping every 10 seconds really isn't going to cause any performance issues. The AWS pings are probably sent directly from Amazon (Heroku is on the Amazon AWS marketplace, so it's probably hosted by them) to keep statistics on uptime/latency/etc. If someone was probing your box it would be followed up with more invasive scans.


1

This answer will depend on using Grub and rebooting the server, but since they're Redhat servers, Grub is practically guaranteed, and it is a sure way to regain access without booting to another medium. Here goes: Initiate a reboot. When the bootloader screen pops up, spam the Escape key to stop automatically booting to the fefault kernel. Using the arrow ...


1

Fifteen IP addresses is a relatively small number. You could block those using firewall software or hardware. If he is using a VPN or proxy server service that makes it look like the source IP is from address space belonging to an entity in Belgium and you don't expect any legitimate traffic to come from there, you could block the entire address range ...


1

As the restriction we setup matches only the domain (for the sender) someone was using our server as relay with with emails where sender was forged to match anything@example.com and would so be accepted. Yes, this is caused by this restriction in smtpd_recipient_restrictions check_sender_access ldap:/etc/postfix/ldap_restricted_senders.cf You said ...


1

The answer to your question is no, there is no way within ssh to enforce regular changing pass phrases. As you're using a single account presumably all the public keys will be in a single authorised_keys file so you could invalidate keys by removing them from it. This though feels like too much effort and people could just use the same pass phrase on a ...



Only top voted, non community-wiki answers of a minimum length are eligible