Tag Info

Hot answers tagged

26

As others have mentioned, disabling sftp isn't anywhere near sufficient - a user with unrestricted ssh access can view any file that their account has permissions to view, can modify anything they have permission to modify, and can easily download anything they can read to their own machine. The only way to stop them from doing this is to actually restrict ...


17

Edit: In case it's not obvious, the following answer isn't intended as a secure method of prefenting SFTP from being used by anyone with shell access to the server. It's just an answer that explains how to disable it from external visibility. For a discussion about security, see answers from @cpast and @Aleksi Torhamo. If security is your focus, this answer ...


14

Do not attempt to do this with .profile because it provides no security whatsoever and restricts exactly nothing! It doesn't matter what you put in .profile, since you can bypass it by simply giving a command to run on the ssh command line, like this: ssh user@host command. You can still get normal shell access by doing ssh -t user@host bash. Disabling the ...


11

No. There is no way to prevent an admin from being an admin. You cannot simultaneously have your files encrypted in such a manner so as to keep them safe from the prying eyes of another administrator on the system, and have an application seamlessly decrypt and access those files in a way that an administrator could not also mimic. To suggest otherwise ...


8

It's an RFC thing as detailed by Apache. By default, Apache will accept requests even if they contain invalid URIs, but instead the user will be redirected to your server's main page. The CONNECT requests being refused is proper behavior. As detailed in the link above, you can manually block these requests, but there's no immediate need to.


7

Is it enough to just visit this URL in the browser and check if there is no private information being outputted? For a first level approach, yes. But that doesn't mean there are no other vulnerabilities in the code. Possible approaches would be to run a security scanner that checks for common and known vulnerabilities , a full penetration test or ...


6

No, you can't tell if anyone is eavesdropping on your mails sent through SMTP if it is done properly. Any server administrator in the path of your message (it may travel through several hops) is technically able to copy away the content without any visible traces. The idea of hiding an image reference in the HTML part of the message will only work for very ...


5

<form action="http://example.com/"> would post data insecurely, even if the page the <form> is on is itself HTTPS. Data sent in this manner can be intercepted / MITMed. For the same reasons, <form action="https://example.com/"> on a HTTP page is sent securely. However, the page the <form> is hosted on in this situation can itself be ...


5

Every email is like a plaintext postcard. The only solution to your primary problem is end-to-end encryption. Look for GPG. However, you are asking to 1) track the email on it's journey 2) find out who's reading your mails. These are 2 different questions and I have 2 discouraging answers for you. To find out the path, which the mails has taken to travel ...


5

The insider-threat problem has existed for as long as we've had IT systems, Amazon is no different. What is different is that Amazon has a single God-level account that can delete the entire infrastructure in a few clicks. The advice for AWS is the same for other things, but boils down to: Ensure separation of privilege. DBA-types should have different ...


4

I have little to contribute to the extensive technical answers but please also take note some of these: Non-technical actions: Report the incident internally. If you don't have a incident response plan already that may appear a CYA technique, but the IT department is not the only and often not even the best place to determine the business impact of a ...


4

The only way to prevent an administrator from accessing a file or files is by encrypting them with a key which the other administrator does not have. In that vein, you could look into using EFS to encrypt your Plesk files, but any permissions or access restrictions you place on the files in question can be undone by any user with administrator rights - ...


4

Unfortunately, as for as admin rights are concerned you either trust the person or you don't. You can change the NTFS permissions and ownership of the folders, but they can take ownership of the folder themselves and change the permissions, delete the folder, etc.


4

In response to your comment: Your comment is valid if the data I want to protect is some kind of business deeds with sensitive financial figures. But, consider I am doing it for a software company that wants to protect their programmers to upload their software source files to their private cloud storage (they are usually 1000+ files). and your ...


3

You should absolutely disable the ability to login as root remotely, and if at all possible also only allow login authentication to occur with the use of public/private key pairs (not password-only). Have a look through this for best-practices on how to harden SSH (although this is provided as CentOS documentation, it applies in principal to any ...


3

What are the pros and cons of keeping such local (non-domain) admin accounts on domain-joined workstations in respect to: Security There's little difference. An account with administrative privileges can destroy a machine. This is true whether we're talking about a domain or local account. Some would argue that the local Administrator account is more ...


3

Please check the free script written by the firm where one of the highly qualified folks at Security SE works: https://labs.portcullis.co.uk/tools/ssl-cipher-suite-enum/ ssl-cipher-suite-enum identifies the following common security issues relating to SSL: ...Support of key exchange algorithms that don’t support forward secrecy – or equivalently, cipher ...


3

There should be no charge for either of those things. It's a bit of a stretch to call them "resources." In the world of AWS, and in contrast to the other items on that list, those items are more like "metadata." (The same logic applies to Placement Groups.) You'll potentially need them if you launch future instances, but they aren't consuming anything ...


2

Nowadays even limiting the ICMP packets in server side can create headache on DDoS attacks. Attacks mostly done by sending huge window ICMP requests to one server and if the server is trying to respond to each of it, guess what happens? Main thing that we have a teamspeak server that gets bad packets every single day, there was few days in two months that ...


2

This problem also occurs when you must let dovecot-lda talk with postfix. On this documentation, the author suggest two solutions Make dovecot-lda setuid-root Use sudo to wrap the invocation of dovecot-lda. Option one was well explained by coincoin. The second one will be explained below. For do that, you should have dedicated user to do sudo. Let ...


2

You can achieve this in a number of ways. Integrating quite directly with what you have in your config file, you may wish to simply include a section such as the following; location ~ \.php$ { try_files index.php @error; fastcgi_pass ...; fastcgi_param SCRIPT_FILENAME /path/to$fastcgi_script_name; ... } location @error { [config of however you want ...


2

Should I install that on all of my application servers Yes. or alternatively create a new certificate and sign it with the wildcard cert That will not be possible. ... that not all of the wildcard certificates can sign others No CA will give you a certificate to sign others (at least not unless you have lots of money and a solide knowledge ...


2

Since the answer body has to be at least 30 symbols, I need to write some stuff here, even the totally dull one, though netstat -aun or even man netstat would be enough.


2

This port is used for STUN (Simple Traversal of UDP for NAT), which is used by VoIP in some cases. It is also used by the Apple FaceTime application. It could also be used by malware. You may have unauthorized or incorrectly software on the workstations in question. It is also possible your firewall is blocking legitimate traffic for one of the above ...


2

As secure as going directly to HTTPS from HTTPS? No. More secure than not redirecting? Yes. The attack vector when redirecting from HTTP to HTTPS is that a MITM could modify the redirect to redirect the user to a non HTTPS version instead (aka. SSL stripping or a HTTPS downgrade attack). Navigating directly to HTTPS (or being taken there from a HTTPS page) ...


2

I'm assuming that this means, for example, not logging in with your domain administrator credentials in order to do your daily work on your workstation. If so, you would have a "normal" user account to do your "normal" work and a domain admin account that you use specifically for domain admin activities. For your DNS admin example, same thing--there's a ...


2

I see two points in your question: "access control for the whole server": you already knows the solution, as per-directory limits can be applied with Directory directive in server-config context (so, system-wide and not related to particular virtual-host) up to "/", so server-wide, for the whole filesystem. As an example, it's common, within httpd.conf, to ...


1

Before the https got place, they are simple HTTP over TCP connections. Yes, it can be snooped, but really not easily. Maybe a little bit of dns spoofing can be usable in most such cases. A naive sloop were hard, the TCP has session id which is maybe not very long, but obstacles such tries. AFAIK in such cases the dns spoofing is a viable alternative. ...


1

Personally I use syslog-ng to forward syslogs and cacti with SNMP and syslog plugin , to achieve this functionality - this allows for prioritising/highlighting of specific event types etc, and emailing upon certain events etc. Edit: if you do go down the cacti route, you may also find the threshold plugin useful; it can be configured to notify you when ...


1

Without extra effort nothing is preventing a (dubiously determined) attacker from initiating a man-in-the-middle attack during the first key exchange and all subsequent connections. This is the same risk inherent in any key exchange over the internet. You can verify the fingerprints of both the master and the minion. On master: sudo salt-key -F On minion: ...



Only top voted, non community-wiki answers of a minimum length are eligible