Tag Info

Hot answers tagged

6

Yes, you can use the old system. It's not less secure than firewalld (provided you write your firewall rules correctly). It also doesn't run a daemon, so it's not using a (relatively) large amount of your limited RAM.


3

Well, the obvious answer would be to compare the BIOS you have with the BIOS released by the manufacturer... of course, that only works if the BIOS released by your manufacturer doesn't contain a rookit to begin with. Failing that, you're left with a topic you could literally write several books on... or parlay into millions of dollars worth of IT security ...


3

User/permission information is cached in memory. Use 'FLUSH PRIVILEGES' after editing the user table directly, to reload it. Although you might not want to do that in this case, depending on what you are trying to achieve.


3

The answer for this is pam_time[1] [1]: http://www.linux-pam.org/Linux-PAM-html/sag-pam_time.html "pam_time". As always, be careful editing pam and back up your config.


3

In DNSSEC, the role of the root and intermediate nameservers are to provide a chain of trust until an authoritative nameserver for your zone is reached. Aside from hosting the public DS key associated with your signed zone, they have no role in NSEC3 validation. For NSEC3 to function, you need to sign your zone using an algorithm that mandates support for ...


3

Postfix doesn't use unix permission feature to limit access to postqueue. Instead it uses parameters like ' authorized_mailq_users' authorized_mailq_users (static:anyone) List of users who are authorized to view the queue. So, if you want to limit to particular user, for example: root, you can use authorized_mailq_users = static:root For ...


2

So called "dollar shares" are hidden, but automatically shared and access is granted to all local administrators of the computer. The fact that you can access it implies you are an admin on the remote machine. You cannot edit their security properties, but you can remove them. That said, you could technically delete the c$ share and recreate it as a ...


2

It means someone is connecting to ssh repeatedly. Look at your syslog (probably /var/log/auth.log). If ssh is open to the internet, this is quite common. Ensure you have good passwords set and root is not allowed to log in. You can use fail2ban and a myriad of other tools to block them automatically. You can also use iptables to limit access to networks you ...


2

The observed behaviour seems to be a bug in the debconf module. I filed a bug report. The user bcoca at github pointed out that one ca use the no_log: true directive in tasks, that set passwords, to prevent logging. This is a workaround, that worked for me.


2

Change the registry value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\ RestrictAnonymous = 2 Or, if you'd rather do it via Group Policy: Network access: Restrict anonymous access to Named Pipes and Shares = Enabled. Also you want to make sure that Network access: Let Everyone permissions apply to anonymous users is set to Disabled. ...


2

You are confusing dport and sport. For instance if you want to get back DNS replies, this : iptables -A INPUT -p udp --dport dns -j ACCEPT Should be : iptables -A INPUT -p udp --sport dns -j ACCEPT You made this mistake almost everywhere.


1

There is a chroot.exe included in Gow (Gnu On Windows)


1

Use encrypted volumes with a 3rd party encryption utility like TrueCrypt. This is the only way to prevent an admin from having access to data it should not have. It is sufficient against an honest admin, but it is not sufficient against a malicious admin, which could still install key-loggers or use remote access tools to view the volume content while a ...


1

Something I do, mainly because of my ignorance of a more elegant solution, is to manually check my Nginx logs every 4 hours and the mail server logs every 2 minutes for excessive access by individual IP's. I run a few scripts together that: Check the access.log and list off the top 10 IP's organized by how many hits they have to the server Dump the ...


1

I would check with your OpenSSL version that is installed and see if it supports those ciphers first. Try runnining the following command to see what you have installed: openssl ciphers -v I'm not sure about DHE-DSS-3DES-EDE-CBC-SHA though, I don't think it works with RSA certificates.


1

Your question is kind of vague as written, but... I have a remote server that only allows logins through a browser https request. Er. Basic or digest authentication, I assume? Or Windows integrated security, if you're using IIS? Assuming that you're just pulling down images from some kind of password-protected web server location via standard ...


1

Either you or the CA had to create a private/public key pair, before the CA signed the public key. You need the private key in order to decrypt the TLS traffic. If you created the key pair, then you have the private key file. If the CA created it, then they have it and you need to get it from them.


1

You've got Yourself a SSL certificate for your domain, I think you have exported certificate without private key. A ".cert" (or ".cer" or ".crt") file usually contains a single certificate, alone and without any wrapping (no private key, no password protection, just the certificate). Ex- Some CAs store the certificate's private key in a Private Key (.pvk) ...


1

Configure ACL for your external endpoint. Navigate to Virtual Machines >> Select VM >> Endpoints tab >> Select MySQL Endpoint >> Manage ACL >> Add ips (both private and public). For a single ip add /32 after address like xxx.xxx.xxx.xxx/32. After all permit rules, add a deny rule to 0.0.0.0/0


1

As long as the registrar allows you to add any valid DS record that you want to the delegation of your zone, the registrar will not be a factor. Some things that a registrar could do that would cause a problem is: if they do not allow you to add DS records whatsoever you simply cannot have a signed delegation at all (with DLV as a potential workaround), ...


1

As per Ansible docs: log_path If present and configured in ansible.cfg, Ansible will log information about executions at the designated location. Be sure the user running Ansible has permissions on the logfile: log_path=/var/log/ansible.log This behavior is not on by default. Note that ansible will, without this setting, record module ...


1

In general, running your own open-source cloud storage solution will be far less secure than any industry-standard service. Think of it this way, those companies have entire teams of people dedicated to nothing but securing their product, and they still make mistakes... That said, if you just want to do your best while swallowing the risk, here is some ...


1

Here's an idea: In sshd_config add the following line: AllowUsers USER1 USER3 USER3 USER4 This list should be all users you want to be allowed to ssh to the system. After the list is present restart the sshd service. Then add the following lines to roots crontab: 0 17 * * * /usr/bin/sed -i 's/^AllowUsers.*$/AllowUsers USER1 USER2/' && ...


1

Usual solution (as far as I know and certainly what I've implemented) is combination of iptables (to restrict direct access) and then providing access via reverse proxy in Apache, Nginx, your web server of choice. Web search for "securing elasticsearch" brings up plenty of relevant stuff. Depends exactly what you're tryng to do whether reverse proxy is ...



Only top voted, non community-wiki answers of a minimum length are eligible