New answers tagged

1 vote

How dangerous might it be - and what performance gains may be had - by turning vulnerability mitigations off on non-Internet facing servers?

" ... used exclusively on a LAN and is using a relatively well tested distribution like Proxmox, how dangerous would it be to turn off all vulnerability mitigations via the kernel arg mitigations=...
Rob's user avatar
  • 330
0 votes

How do you search for backdoors from the previous IT person?

Look for any unusual user accounts Look for suspicious scripts/shellscripts Utilize security tools like IDS Review system logs Scan files with AV for malware detection Check for hardware extensions ...
Yousha Aleayoub's user avatar
0 votes

Why enabling _only_ TLSv1.3 is a bad idea?

As of 13th March 2024, browser support for TLS 1.3 is 96.41%. Browser support for TLS 1.2 is 97.96% I think it is a bad idea not to support TSL 1.2, while I have just discovered www.ecb.europa.eu ...
Mladen Adamovic's user avatar
0 votes

Making production-ready + securing a server (Ubuntu 22.04, NodeJS, nginx)

This is bit difficult because to secure a server that's always depending on the security requirements of an organization. And making it production ready requires quite some experience. Having ...
Guido's user avatar
  • 61
0 votes
Accepted

Why is https communication not working with iptables?

The issue is that you don't have a rule to allow response packets from the internet to come through. That is, DNS request is sent to an internet host at UDP port 53, and its reply comes from internet ...
Tero Kilkanen's user avatar
0 votes

How do I use apt-get to install one update at a time?

To build upon @Richard's answer, a one liner to update all system packages one at a time: for x in `sudo apt list --upgradable | cut -d / -f 1`; do sudo apt --only-upgrade -y install $x && ...
rockwotj's user avatar
  • 1,351
0 votes

OpenVPN - Properly sharing keys/certificates

One cause of concern that I just noticed was the fact that the client key files have to be shared with each of the clients. If one person gets a virus and the attacker then downloads those files, they ...
vidarlo's user avatar
  • 9,092
0 votes

OpenVPN - Properly sharing keys/certificates

You could have some other form of authentication before allowing a client to establish a VPN connection, that along with something like fail2ban and ban alerts should block any unauthorized connection,...
Marco Zink's user avatar
1 vote

Why is PHP open_basedir not considered a security model

A good article on previous open_basedir bypasses is available at https://www.bencteux.fr/posts/open_basedir/ In addition, the use of open_basedir is not very efficient. It requires PHP to check each ...
Andreas Gohr's user avatar

Top 50 recent answers are included