New answers tagged

2

I just encountered the same phenomenon and fixed it. It is caused by the lack of required modules of Perl in the system. Try this; By using cpan or cpanm (Perl module manager), install Date::Calc like, cpanm Date::Calc Retry installation by ./install.pl of PSAD source tree.


0

What comes to my mind is signing the configuration prior to uploading it to the server by a personal private key. Every administrator would have his own. This is essentially what secrets-at-rest style solutions such do (list at the bottom), but they normally run on the master. Thomas A. Limoncelli basically argues that, yes, the master is still the SPOF ...


2

Yes, you can do this; this sort of setup is commonly referred to as a bastion host or jump host. However, when implementing any security practice, it's useful to build an explicit threat model: what attacks are you trying to protect against? A current employee from doing things they shouldn't (perhaps accidentally)? A former employee using old credentials ...


2

Any user can execute ifconfig. The problem is that usually you want ifconfig to be executed with root permissions, so that you can temporarily change your system configuration. Changing the group of the binary (and having to play with setuid) is not the way to do this. Execute visudo and add the line %if ALL=(ALL) /sbin/ifconfig to the end of the file. ...


0

Good enough. You'll have a server which can't be hacked with brute-force SSH login that's all. Your certificate can be compromised, there can be future SSH protocol vulnerabilities, your server can be hacked with some other trick, so on. Will it be more secure? Yes. Will it be absolutely secure? No.


3

This looks like your server is being used in a DNS amplification attack[1][2][3]. This means that your server is bombarding Google's DNS server with queries, so yes your server is being used to attack Google. You are not being attacked, your server has been compromised and being used to attack someone else, in this case it looks like that it is Google. ...


3

Have you considered the possibility that your local system is already infected and has a keylogger on it that records all your passwords etc.? Especially if your adversaries may be targeting you directly? I would suggest the following: Use a secure local system, for example a system booted from an officially purchased LiveCD (or just a friend you know has ...


1

SSH tunnels can be a great option to securely connect across a hostile network. We've found SSH tunnels very simple to implement and understand and more reliable, than some VPN options. Also can tunnel all sorts of things even when the native app protocol doesn't support SSL/TLS. Good to put your SSH in a bash script that will run the SSH tunnel in a loop ...


0

Regarding the credit cards: To operate with these, you've go get a license, which you won't if running in such environments, not by accident, but because of reasons you mentioned above. Regarding your question: If the private network is shared with others, I would recommend to encrypt all the traffic, via stunnel for example. (But still, it's an shared ...


0

I don't know if it's a "best practice" from the community, but Amazon recommends doing it. "We recommend that you disable Windows Firewall and control access to your instance using security group rules." (Source)


0

This may be an RTSP ALG (Application Layer Gateway) on your home hub intercepting traffic and providing a response.


3

Assuming your cert is strong, and not generated by a compromised or weak piece of software, certificate-only root login protects you against root logins from people who do not have your certificate. That's it. It does not protect you against remote access vulnerabilities or exploits, it does not protect you against someone stealing your certificate, it ...


-1

find the interface which case, your ip: ifconfig and add him to: /etc/knockd.conf example: Interface = venet0:0


0

Fail2ban scans log files for potentially malicious actions and bans the IP-addresses from which such behaviour originates. Generally Fail2Ban is then used initiate an action that will block subsequent (malicious) actions from that IP-address from recurring. To prevent getting locked out as an administrator you would normally add your own (management) ...


0

The only reason I would add fail2ban in your case would be to DROP kids trying to connect on the server indefinitely and limit the responses it serves for nothing (in the case your server does generate REJECT answers to those trying to connect). Now, you might have a good reason to whitelist IPs but on SSH is fairly secure, as long as you keep your key ...


1

In that case, I would say that fail2ban would not be required. I would really only use fail2ban when you have to expose a management service to the Internet in the hypervisor (aws) firewall. In your case, all requests except those from your IP are being dropped. One thing to note, if your IP address changes (non-static) you will have to update the aws ...


0

In addition to adding EscDomains registry keys per yagmoth555's answer, I had to set HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915\* to 1 (DWORD) for the registry settings to be applied. https://support.microsoft.com/en-gb/kb/918915 describes the problem. I ...


2

I'd first use fail2ban to watch the web server log, and any time it sees a dodgy hit, firewall that ip for the next hour or something along those lines. However that relies on having root access to your server to manipulate the firewall. There are third party services like cloudflare who can clean up your traffic before it gets to you. Their services ...


3

The article you linked provides an explanation of what rights Log on as a Service provides: The Log on as a service user right allows accounts to start network services or services that run continuously on a computer, even when no one is logged on to the console. In short, you only want to provide this right to the accounts that need it - by default, ...


1

"This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers. By default, no accounts have the privilege to log on as a service." https://technet.microsoft.com/en-us/library/cc957141.aspx Accounts that aren't in that list shouldn't be able to log in as a service, so if ...


2

# rpm -K rpm-2.3-1.i386.rpm rpm-2.3-1.i386.rpm: size pgp md5 OK From http://www.rpm.org/max-rpm/s1-rpm-checksig-using-rpm-k.html


6

This turns out to be quite a difficult problem, if you limit yourself to the single system which you're trying to validate. Fortunately, we live in the real world, where there is more than one computer! Some possibilities for verifying the binary include: Using another reference system which has the same package version of RPM installed, take a hash of ...


8

Have a look at vaultcmd.exe: There are my credential vaults on the file system. But I am not sure whether it's supported to just delete the vault from the file system, or if it'll leave the user's credential vault in a broken state. Also have a look at vaultcmd /deletecreds: vaultcmd /deletecreds:"Web Credentials" ...


1

You can set-up SSH keys to every user, so they have to use private key to get access to SFTP server. Let clients generate private and public key by themselves and let them send public key to you, so you can add it to ~/.ssh/authorized_keys file. You can generate private and public key ofcourse by yourself but that means you need to send private key to ...


1

It would actually be more secure to have a separate bastion forest for Administrative accounts and groups. You can read more about it here: Privileged Identity Management for Active Directory Domain Services (AD DS) https://technet.microsoft.com/en-us/library/mt150258.aspx Let's say you have a production forest with domain controllers in 100 ...


1

What your colleague is referring to is something that was considered an acceptable practice a very long time ago. That is no longer the case (and I'd argue it was of dubious value 15 years ago, even). Because the forest (not the domain) is where your security boundary lies, you get very limited additional security out of this setup (if any), for which you ...


1

There are separate settings under each ZoneMap key for “ESC on” and “ESC off”. If ESC is on, only those settings under the EscDomains and EscRanges subkeys are used; if ESC is off, only the settings under the Domains and Ranges subkeys are used. https://msdn.microsoft.com/en-us/library/ms537181%28v=vs.85%29.aspx As you want a machine setting, ...


1

I think your colleague is talking about a forest model that uses an empty root domain and the one or more child domains. The root domain would store just the Enterprise Admins Group, Schema Admins group as well as the Schema Master FSMO role and the Domain Naming master role. The Enterprise admins group will then have full control on the child domain. the ...


0

Try psexec with your command "WMIC /node:172.16.98.12 /user:MRT /password:11111 computersystem get totalphysicalmemory" psexec \172.16.98.12 -u MRT -p 11111 wmic computersystem get totalphysicalmemory


1

You need to add extra rules to ufw to satisfy psad. Edit following two files: sudo vi /etc/ufw/before.rules sudo vi /etc/ufw/before6.rules To both files listed above, add following lines for psad, at the very end, but before COMMIT # custom logging directives for psad -A INPUT -j LOG -A FORWARD -j LOG # don't delete the 'COMMIT' line or these rules ...


1

The first proposition means : Are SYN and FIN and RST flags at 1 ? Whatever the value of the other flags. The second proposition means: Are SYN at 1 and ACK at 0 and FIN at 1 and RST at 1 and URG at 0 and PSH at 0 ?


0

I'm following this Link and it's worked on Windows 8.1 pro. I try for Windows 10 and it's not work. Whats wrong on Windows 10?


0

MSC is a file extension for a Microsoft Management Console(MMC) file format used by Microsoft Windows and is a collection of various snap in tools to simplify administration of a computer and create automatic tasks.src MSC extension are also known as Microsoft Saved Console Files. Users can create and customize MSC files to publish a collection of tools ...


0

I have not particularly used this, but you can use an ACL to match a request header's content-length that goes over your defined limit and deny it. Like so: frontend fe bind x.x.x.x:xx ... acl overallowedsize hdr_val(content-length) ge 1024 http-request deny if !overallowedsize Ref: http://www.haproxy.org/download/1.5/doc/configuration.txt


0

Only if the administrator puts something like PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 PASS_WARN_AGE 7 In etc/login.defs


0

Remove the $ from the regex as in the log there is no end of line at that point.


-1

Enabling Intel VT makes CPU hotter, I've had a Desktop and Laptop that have had this behaviour, both with stock CPU coolers. I'm refering to Home Computers but it's the same feature. I know that AMD-V comes enabled by default, but I don't know if it makes CPU hotter.


0

You're talking about doing something to TLS that it was entirely designed to prevent. I think you understand that. Moving beyond that I think you are trying to solve the following problem: How do I protect users hat are essentially, actively attempting to get infected/compromised? If everyone at the office is unwilling to comply with IT policies like ...


0

Yes, they exist. For example, we deploy Watchguard firewalls and the T-series is a very affordable device targeted at a small office (search Google/Bing for model WGT10031-US to get an idea of pricing, I don't want this to seem like a sales pitch). All models have an HTTPS proxy that is capable of SSL/TLS inspection (termed deep packet inspection or content ...


1

No, it is not safe to configure your firewall as you indicated. Using a firewall configured using the rule in the image you linked would be a security risk because that rule effectively opens up ALL ports and all protocols. The reason your port 21 rule was not working was because FTP actually requires 2 channels to function, a command channel and a data ...


0

Microsoft posts a number of audits it has passed and a summary of results in the Trust Center. https://products.office.com/en-us/business/office-365-trust-center-welcome MS is only protecting and compliant up to where the service is enabled. Once you turn it on you are responsible for any further requirements in securing the service. While they will issue ...


0

LGTM. However, keep in mind that any permissions granted to the public role will also be granted to this user. So if it would be a serious violation to have this user gain access to the base table (or other objects in the db), you'll need to audit this periodically.


0

The solution, provided by Tim Holloway at Java Ranch, was to simply replace the manager folder in the webapps directory. There were apparently some undocumented changes made there, not sure what, which was causing our issue.


6

Remember that localhost (127.0.0.1) is the loopback interface on the system. If someone can snoop traffic on that interface, they are already on your system so you have worse problems to deal with.


1

Depending on where you get the public key file you are testing, the accepted answer may give false positive results. This is because of the behavior described in the comment by @drewbenn. Specifically, when the -e option is used with the private key file as the -f option parameter, it simply parrots (but reformats) what's in the associated public key file. ...


3

While it's prohibitively difficult to hide the version number of your SSH daemon, you can easily hide the linux version (Debian-3ubuntu4) Add the following line to /etc/ssh/sshd_config DebianBanner no And restart your SSH daemon: /etc/init.d/ssh restart or service ssh restart



Top 50 recent answers are included