Tag Info

Hot answers tagged

32

Require SSL, keep SELinux turned on, monitor the logs, and use a current PostgreSQL version. Server side Require SSL In postgresql.conf set ssl=on and make sure you have your keyfile and certfile installed appropriately (see the docs and the comments in postgresql.conf). You might need to buy a certificate from a CA if you want to have it trusted by ...


15

The additional security surface java puts into your environment is complex, and it's important not to ignore it or try to simplify it away. Firstly, there is the horrible record the JRE has for having security bugs. It's hard to point out a specific one, and this is the scary part - the bugs are overwhelmingly unspecified vulnerabilities with unspecified ...


13

Yes, you will have to buy another certificate* The asterisk wildcard character * will only match 1 label in a resolved FQDN. This behavior reflects RFC 4592 Section 3.3, in its description of DNS label matching and fallback to the asterisk label. If you only need to secure a single endpoint under the .internal.mycompany.com. namespace, you don't need a ...


6

Java applications eat up all my RAM The alternative to using RAM is wasting RAM. You can't save it for later. Java is full of vulnerabilities That doesn't really matter because you aren't going to expose the JVM to the world. I presume you aren't going to run any hostile programs, and if you are, Java is safer than most other languages. What ...


5

Speaking from a Windows standpoint: Blank passwords can absolutely be brute-forced. Pen testers do it all the time. It seems to me that at that point a user with enough access to map a drive could replace a service executable and then restart the service remotely, for example. From a linux standpoint, anyone with a valid login would then be able to su ...


4

You're right that your admins should be using individual user accounts. Shared accounts are a bad idea all around. On the Windows side the blank password idea seems pretty bad. Anyone who manages to get unprivileged local code execution on a machine will have a much easier time of escalating privileges with a blank RID 500 Administrator password, in my ...


4

It makes no difference at all if the Apache user is called www-data, apache2 or dumbo (www-data is the default on Debian derivatives, and apache2 on RedHat). Both are non-privileged (e.g. non-root) on their respective platforms, because that is what's important: The user needs to have as few permissions as possible in the rest of the system. The default ...


4

While this approach lends itself to generating bad feelings, if this is a necessary evil, I'd begin by making sure that the server is segmented from the network -- either accessible only by a few hosts in a LAN or listening only to hosts that have authenticated against a VPN (or SSH tunnel). In short, try not to let this host be low-hanging fruit. It is ...


3

Probably the number one reason is the existence of OpenBSD (which is what most of these firewalls are running). It's a free, open source, widely used operating system which is focused on security... which makes it a great OS to run on security devices.


3

Don't even think about giving the root user a blank password. If you do this, it's trivial to leverage a non-root compromise into a root compromise. Consider one of many possible scenarios: An attacker uses an unpatched vulnerability to compromise the web server or the application the web server is serving. He gets a shell running as the web server's user. ...


3

A simple extension to Craigs impressive action plan: Maybe the user is using only a relative little set of network providers (for example, his mobil network provider while moving, his cable network from home and workplace outgoing ip from work). Most network provider have many IPs, but not really many subnets. So, you can give an iptables filter, which ...


3

What you are asking for is possible. However, do to the lack of a starttls/stls command in http, it is only available to https. Non-certificate ssh-keys will not work for this purpose. A client will need their certificate (and private key) installed in their browser. The sever will need to include the following directives in addition to other standard ones ...


2

I don't know what "naming" and "security" have in common in your question. They are separate things. For naming: Don't use .local or other non-TLD's. Microsoft does not recommend it, and we start seeing new TLD's on a regular basis now. While .local has been specifically banned from being registered as a TLD, it is still very recommended to get your own ...


2

Just make a copy of chattr and use that copy to remove the immutable bit. [root@c7 bin]# ls -lh chattr;lsattr chattr -rw-r--r--. 1 root root 12K Jun 9 19:59 chattr ----i----------- chattr [root@c7 bin]# cp chattr chattr.new [root@c7 bin]# chmod a+x chattr.new [root@c7 bin]# chattr.new -i chattr [root@c7 bin]# rm -f chattr.new [root@c7 bin]# chmod a+x ...


2

You cannot make it impossible. You can make it annoying or even hard, at best. But basically it comes down to the fact that physical access IS full access. I've seen solutions where the server is psychically locked in a cage or where the usb ports are removed and HD's are locked in place with a padlock by holes drilled in the drive bay. But if someone ...


2

Almost every major Linux distro backports security patches. From that article you can see the following CVE numbers and issues. Fixed in Apache httpd 2.4.10 important: mod_cgid denial of service CVE-2014-0231 important: WinNT MPM denial of service CVE-2014-3523 moderate: mod_proxy denial of service CVE-2014-0117 moderate: mod_deflate denial of service ...


2

If you are using a startup script, you need to give the Domain Computers group permission in the share and NTFS permissions. Startup scripts run in the context of the SYSTEM account. Your tests that you've run manually will run in the context of whatever the logged on user is. You can test this manually by running psexec -s cmd which will launch an ...


2

I don't think your scenario is valid. Say an attacker will follow your 1,2,3 points and will become a different UID (user) on their own machine they have brought. And then what exactly? They have already had access to their own machine as root and using anonymous LDAP as user backend on their own system to su into a user is just as good as: useradd ...


1

While not strictly answering your question, another option may be to set a longer timestamp_timeout so you don't need to type in your password so often. This will prevent just anyone gaining admin privileges, but reducing your annoyance. From the sudoers man page: timestamp_timeout Number of minutes that can elapse before sudo will ask for a ...


1

What you're talking about is security through obscurity. You want a group of techs to have permission to do something, but you don't want to give them access to a big, scary console with lots of buttons that could get them into trouble if used improperly. I get it. But it's fallacious thinking because it's just a warm blanket that feels comfortable but ...


1

Remote sniffing with Wireshark is one alternative Running i.e. rpcapd in Server2 capturing its received traffic and you remotely running wireshark from MyHost. Of course the communication between the remote capture daemon and your Wireshark has to clear your security layer.


1

One approach is to separate the web interface from the execution layer, i.e. use the web interface as the UI and to schedule actions. Then run a second job with root privileges that polls the queue, validates and executes scheduled tasks and which reports exit status back. A slight modification to that is where instead of having the poller run independently ...


1

No, there's no way to make this work at present. ESXi only supports NFS v3.


1

I guess you would need to create an in-between HTTP proxy with all this "business logic", and only allow ElasticSearch access from the localhost. This way direct access to ES is blocked and you get to determine and enforce any policies you'd like (yay! ;) "even if I provide a custom API layer to this someone could easily bypass it": they cannot if ES only ...


1

Let me translate the current config. Whenever browser request /wp-login.php, the request only matches section location ^~ /wp-login.php, not including your php-fpm configuration. So, nginx just apply the auth_basic and then spit out the source code of wp-login.php because nginx can't parses it. The solution is adding php-fpm section like this include ...


1

You may also be interested in UDF (Universal Disk Format). See UDF OS compatibility table on Wikipedia. The only downside to UDF 2.01 is that there is no native write support for Windows XP (at least without third party utilities). However, writing with Windows 7 and later are natively supported. I recently found myself researching this very topic, and I ...


1

Hire a company to do static analysis on your program. Veracode, for example, is a company that I have used in the past for auditing code security of Java programs, specifically. Bill your admin team's charge code, obviously.


1

Explain that all other languages (or virtual machines) can be rendered insecure by the code that is deployed onto them, just as with Java. If he thinks the other platforms are inherently secure (or more secure than Java) without correctly address security, then he is delusional. Your company obviously invested in hiring a Java developer, why is the sysadmin ...


1

There are several tools that handle threat management at different levels (most of them reactive because, being an encrypted protocol, it is hard to see anything until it is written in the logs). SSH is, generally, a secure protocol on its own if configured correctly. I am usually advocating AGAINST letting SSH open to the Internet unless absolutely ...


1

Identifying the type of request and forwarding it based on that cannot be done at the TCP level. By the time your gateway need to decide which host to NAT it to, the request has not been sent yet. On the application layer, you have more possibilities. This will be protocol dependent and is only possible for some protocols. An HTTP proxy is one example doing ...



Only top voted, non community-wiki answers of a minimum length are eligible