Tag Info

Hot answers tagged

47

Don't attempt to "wipe" an SSD with tools designed for spinning magnetic hard drives. You won't actually destroy all the data, and you'll just reduce the lifetime of the SSD. Instead, use an erase tool specifically designed for SSDs, which can use the drive's internal flash erase (discard) to discard all of the blocks, including the ones you can't access. ...


21

So, regarding making an ssh connection over an explicitly untrusted connection. Assuming you already have an ~/.ssh/known_hosts entry from a previous connection, yes you should be able to connect without worrying about whatever the network is safe or not. The same goes if you have some other means of verifying the ssh host key. If you have never connected ...


10

In the second part of your question you seem to be worried about your notebook being stolen and, with it, your private-keys for your password-less SSH login to your servers. Please note that this can easily be solved (the private keys issue) by storing private keys "encrypted" with a "passphrase": they can be encrypted initially, while generating with the ...


6

There isn't built-in functionality in the product to do what you're looking for. Security groups don't have an ACL mechanism to control which members are added, only who can modify the membership. What you've got is an interesting conundrum. In the filesystem world Dynamic Access Control (DAC) could solve the problem you've got handily, but DAC-like boolean ...


5

The first part of your question is already answered by previous response. As per your second part, I would recommend to add a second factor to your ssh login using pam_google_authenticator. It is is fairly easy setup and configure on any distro. In the case where the private key you are carrying around is stolen, they can't login to your server w/ out the ...


5

Using /dev/urandom should make everything faster. I wouldn't wipe an SSD like that. SSD's usually have advanced wear leveling in place. Basically, instead of writing over the existing data, the drive writes over unused portions. It'll take a bit of time to properly scramble all the data. By that time, you would have already wore down an SSD, though it's only ...


4

What do you need to access from the domain controller? Since you have a firewall between member1 and the domain controller, you could block all access to dc1 and dc2, then put something like a read-only domain controller or a web front end on the outside of the firewall that member1 can access.


3

Depends on your budget, but I'd pick up a few Cisco ASA 5505 or 5506-x units at ~$550 each. Industry standard, reasonably easy to configure and no babysitting. If you have dynamic IPs at any of the locations, maybe a Cisco Meraki unit with Auto-VPN functionality. Substitute Cisco with Juniper, Sonicwall, whatever. But I don't advocate homebrew ...


3

I don't think this is much of a problem, with one caveat: provided the network that connects the private servers (whether virtual or physical) is switched, this isn't much of an issue. My usual mantra is that there is no such thing as security in the abstract, only threats and responses thereto, appropriate and otherwise. So what's your threat model? An ...


3

PowerShell is included and enabled by default in the last several versions of Windows Server. If the "serious customers" are using Microsoft technology, then they are almost certainly using PowerShell already, even if it's hidden behind other management GUIs, or have PowerShell present even if they aren't deliberately using it. Microsoft server software ...


3

Would either of these work? I'm concerned that if I choose a IP address like 192.168.0.0 it could cause an issue if someone was to directly connect to the port and send packets to the network address. If they have physical access to do this, you have much larger problems. The issue with choosing a random IP address is that essentially anyone will be ...


3

Anyone have any ideas? Fix the problem, not the symptom. Stop using unencrypted FTP, it's highly insecure, and take other steps to secure your system. Blocking Adminer doesn't block any of the dozens of other similar systems (in PHP and otherwise), nor does it block someone from writing custom code that also alters the database. If they get your FTP ...


2

Assuming a full-tunnel configuration, your data is protected between your computer and the VPN service, and from a web site's perspective your traffic will appear to originate with the VPN provider. However, you are now placing a lot of trust in the VPN service. They do have un-encrypted access to all of your traffic. Additionally, anyone upstream to the ...


2

Yes, you can block/prevent/deny executables with Applocker, providing that the client OS supports Applocker.


2

Not directly. Assuming your code is properly written, and written securely, and you never checked in sensitive details (passwords and keys!); then disclosing the .git folder and your source code wouldn't create any security vulnerability that wasn't there in the first place. However, having access to your source code makes it easier for an attacker to ...


2

It really all boil down on the amount of internet bandwidth you have and how much of it you want be able to use for your VPNs. Even low end firewalls (under 500/600 euros) are capable of 50+ Mb/s of AES128 encrypted bandwidth (es: Sonicwall SOHO serie). For a even lower price (maintaining good performance) you can use Mikrotik's firewall. If easy ...


2

A process needs to be run with administrator privileges in order to be vulnerable to an attack that grants arbitrary administrator code execution or shell access. The general vector is either a system process, built-in service, or third party service running as SYSTEM or with some administrator account. Update your system and applications often, and don't ...


2

So your main concern is that compromised one account cannot do anything bad to other accounts. PHP and file permissions If PHP is configured to run as different user for each domain, then your directories should set-up such that it doesn't have write access to anything outside its own domain. Then using PHP (or any other commands invoked via PHP) it can't ...


2

This is not possible. If you join a domain, the domain is allowed to sign users into existence on your computer and apply GPOs to it. GPOs can cause software to be installed from the network and modify arbitrary registry entries. Using an RODC in the enclave will protect the domain from your enclave, but it will not protect the enclave from your domain. ...


2

/dev/random generates random data by entropy collected by your system (time delays between keyboard shortcuts, network timing by measuring the packet arrivals with nanosecond precision, etc). If there is not enough entropy, this device blocks output while it collects more entropy. /dev/urandom uses aso the collected entropy, but it uses a pseudorandom ...


2

There is little difference between allowing connections to ssh from any IP and allowing connections to ssh from any IP for a given user as the user authentication has to happen after the connection - ie, after it's already let the originator connect. You certainly should be restricting direct ssh access for servers that don't need it in general regardless of ...


1

Depends on how secure you want to be. Filtering outbound traffic does increase security and decrease attack vectors, etc. Personally, I only filter outbound SMTP (no clients should be connecting to external SMTP servers) and DNS (to prevent I'll effects from malware that changes users' DNS servers to earn external host). Many orgs have much more ...


1

From a security perspective the policy is usually "everything not allowed is to be denied" and in that regard filtering on the OUTPUT chain falls under that blanket policy. The OUTPUT chain concerns outgoing TCP/IP packets and connections originating from the device running iptables and not the packets passing through the firewall. An administrator should ...


1

The only working way to have an audit trail you can trust is to work with a least privilege policy, i.e., deny access by default. If you go with sudo access, you can certainly limit what users can and can't do; but you also need to be aware of the caveats that might apply. In this case, you requirement is to grant access to a group of users to edit a ...


1

Our current, partial, solution leverages rsync --ignore-existing and forces its commandline on the server side with a (non writable) ~/.ssh/authorized_keys like this: command="rsync --server -e.Ls --ignore-existing . ." ssh-ed25519 ABCDEDFGfoobarbaz user@host more than enough to prevent casual users from downloading remote files can modify remote file if ...


1

Those permissions are being inherited from the parent folder. You'll need to remove/disable inheritance on this folder in order to change those permissions.


1

As the 'host' [broadly defined, it could be everything from a reinstallation / multiboot to an entirely different computer with an IP address you've connected to before, for instance] appears to the ssh client to have changed, it's giving you the error. It is unnecessary to switch off strict checking, nor is wholesale deletion of saved keys sensible. It is ...


1

I don't understand why the standard S/Key won't meet your requirements. Every time someone logs in, it sends them a visible "challenge" which includes the index number of the password it wants. Enough information is given to figure out which line of a printed list of one-time-passwords is being requested ...without any sort of coordination with any other ...


1

The DefaultRoot line needs to be at the end of the configuration file.


1

Other than combing through the event logs, looking for Logon Type 10 (Remote Desktop) in the Security Log, or looking at the TerminalServices channel event logs, you'll need to use third party software. In addition to TSL mentioned above, here is one other I've used with success in the past - Remote Desktop Reporter http://www.rdpsoft.com/products If you ...



Only top voted, non community-wiki answers of a minimum length are eligible