Tag Info

New answers tagged

0

you can use something like this: firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp --dport 22 -j ACCEPT firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp --dport 3306 -s 192.168.1.22 -j ACCEPT


0

Ok, so it looks like you have duplicated SID's in your network If you used sysprep without generalize option or some third-party software to create "golden-image", it left initial SID intact. So, when you installed win7 on new pc's they got same SID's for each machine and now having problems authenticating computers accounts (because sid must be unique in ...


3

For Linux servers I manage these attempts using fail2ban so that it will autoban the IPs that attempt to find vulnerabilities on the web server. IIS has some free plugins (Microsoft supported) that do the same thing. These tools allow you to restricts the types of HTTP requests that IIS will process and/or temporarily ban the IPs that make those requests. ...


2

This could happen to clients if you primary domain sends a Strict-Transport-Security response header with the includeSubDomains flag. Example header: Strict-Transport-Security: max-age=31536000; includeSubDomains If this header is present with includeSubDomains, compliant clients that later access your subdomain will change all HTTP references to HTTPS ...


0

Event Log Readers builtin domain local group usually works for vanilla access using tools such as Event Viewer. You may want to check your security log (with auditing enabled) to confirm the identity that is actually failing access. In some cases, this may be the Network Service well-known identity. You may be able to add this to the Event Log Readers ...


0

The way I would do it is create a fullscreen .exe in Visual Studio, and change the post-Winlogon shell path from explorer.exe to your new .exe, under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> Shell And for any functions that explorer is responsible for, I would then start explorer.exe silently inside your program. Disabling ...


3

The ONLY option you have is to stop people being able to access it: you need to find a way to either stop physical access (IE put it in a locked cabinet, move it to a locked office etc) or make console access impossible (disable all HID access, disable all USB/PS2 ports etc)


2

Why are you using deny ACEs? You should be doing something like this: Root of the share (Authenticated Users - Read - This Folder Only) | | ----Subfolder1 (Subfolder1 Users - Read/Write - This folder and Subfolders) | | ----Subfolder2 (Subfolder2 Users - Read/Write - This folder and Subfolders) And so on. You should not be using deny ACEs regularly. In ...


0

RewriteCond and RewriteRule can also be used in server config. Something along the lines of RewriteEngine On RewriteCond %{HTTP_REFERER} ^http://(.*\.)?example\.com [NC] RewriteRule .* http://127.0.0.1 [R=301,L] in your server config should do the trick. For this to work though you have to add this to every VirtualHost you want to apply the global ...


1

I've got satisfied with the following approach to disable su (tested in Lubuntu 14.10). Open file /etc/pam.d/su. Then uncomment line: # auth required pam_wheel.so After this nobody (except users which are in 'root' group) can use su. But it is still possible to start root session using sudo su.


0

Okay, I guess 0.0.0.0/0 meant I opened the port up to the world for each port forwarded. I just edited security and chose "My IP" for each rule.


0

Normally your firewall will allow all out going traffic on all ports. The ports are actually blocked on other end/destination servers, hence your server is failing to query information. Or you need to know the port numbers of those destination servers so that you can send you query on that particular port. Unfortunately, you won't be able to query if you ...


0

I wrote a script which runs as a computer policy with administrative rights on the local workstation. It checks the last logged on user's Description in AD which a Domain Admin can set from "Active directory Users and Computers", if it contains the workstation name, the script adds the user to local admin group, if the workstation name is not in the user's ...


0

You can open one port and send queries through it to different destination ports : 127.0.0.1:50000 > 192.0.2.1:60000 127.0.0.1:50000 > 192.0.2.2:60001 You have to know which port your programm is listenning on, if it uses many ports and which protocol (TCP/UDP) Be sure that there is no another programm using it, only one per port. (Registered ...


-2

i have that establish secure connetion lag too... i look in chrome advanced parameter. scroll down to https/ssl and deleted all certificate relative to comodo (found them in the second or third tab, din't remember), never got that establish secure connection lag again hope that help


1

OSSEC does what you want, and will probably save you from largely reinventing the wheel. If you really don't want to use additional software, at least have a look at their model, how they authenticate their clients, and where and why they trust the output from processed logs.


0

If you create such an application offer both ways to your users. If a server has to actively push the log files then your user needs to install some kind of agent on his monitored server. This could be discouraged in some environments. If you pull the log files then no further installation is needed on the servers except allowing them to access the log ...


0

I had this issue when I was trying to login from a NAT instance that I set up. The NAT instance is not something I can specify (to the best of knowledge) what OS to use, and I presume that it is using AWS CentOS. Anyways, I was always being asked for a passphrase when trying to connect to an instance on my private network. Here was how i resolved it, ...


0

The pem key for that server is unique to that chef organization and node. That is how it identifies itself to the chef server and makes sure that node attributes pertain to only that node. Which is why when you change chef-orgs, you have to re-bootstrap the server. Additionally, when you try to execute using chef-client on a different box with the same ...


0

The smb.conf manual page needs to be updated! Indeed it refers to the old Samba-specific encryption mechanism that applies to SMB1 only and is done via unix extensions. This can for example be used by smbclient. But nowadays, the 'smb encrypt' options also controls the SMB-level encryption that is part of SMB version 3.0 and newer. So it is correct that ...


1

my thoughts based on my understanding: pros -- 1) easier to manage ? easier to upgrade - apply bug fixes , security patches etc. 2)save some disk space 3)saves the headache of maintaining same version for all clients: cons: 1)has network dependency 2)what if the server hosting the exe goes down ? we need to worry about redundancy 3)performance issue ...


2

Having read around this some more I have come to the following conclusions; The DH parameters Microsoft used in TLS_DHE_RSA_WITH_AES_128_GCM / TLS_DHE_RSA_WITH_AES_256_GCM are, for compatibility reasons, only 1024 bits in length and are thus considered 'weak'. The new cipher suites continue to not be present in the default cipher suite priority due to ...


0

You can use CustomLog with LogFormat (the %f flag I believe) to configure Apache to log which file was being used to serve a particular request. These requests are most likely bogus though from automated bots up to no good (e.g. trying to see if your web server is vulnerable to an exploit). See the following links: ...


1

Verify that the ESX host's domain account isn't disabled. If that's OK, try dropping the ESXi host from the domain, deleting it's computer object in the domain and add it back. Failing that, try updating your host to 5.1 or later. Version 5.1 is working perfectly for us, I don't have a 5.0 host to check.


1

Seems like a BGP update combined with default host choices¹. I had a trouble gathering data (due to a network I'd pay to upgrade) but here's what I got: The Route A2 Hosting's routes are under AS55293. You're covered by the /22 and /23 there. The ASN paths updated on April 17th, same day as your NUL attachment. From LookingGlass (enter your IP, choose ...


1

I'd recommend that you get the second NIC on the physical host connected. Use one of them for "Management" purposes of the host itself, and the other for "VM traffic". They'll probably uplink to the same place, but this at least gives you access to the host even if something goes sideways with your VMs. Once you've got that configured, you can easily do ...


0

I'm pretty sure you can accomplish this using mod_security's SecRule FILES directive. Check out http://sourceforge.net/p/mod-security/mailman/message/18919856/ or the top of https://gist.github.com/nopslider/452b652850cf359c3738 for two different examples.


-1

I am familier with vmware environment where each virtual server will be allocated with virtual NIC and vmware tools installed. virtual servers can be either be assigned with static IP or automatic as long as there is DHCP server in the same network. Apologies, I couldn't be specific to your question but I thought I would share my experience with vmware.


1

From what i know, changing BSSID is hardware related. So, unless you provide some details regarding your router, i doubt you'll get much help. Now, considering your main goal is to protect your wlan, using WPA2 with a 63 chars passphrase will do a way better job than hiding/changing SSID/BSSID.


37

Maria-DB is not a performance-enhanced MySQL version. Maria-DB is the forked MySQL version current used in the open-source space. It was forked from MySQL due to mistrust in how Oracle will behave in regard of the original MySQL code. You can see here for more information. While until version 5.1 both were more or less the same code, by 5.5 this changed ...


2

I had a firewall policy rule that was causing the pingability, ICMP echo permission hidden in a group service list and restricted to certain hosts and I didn't see it. :-0 Also had an issue getting VLAN 2 connectivity to a port on the Netgear that is tagged with that VLAN ID, but that appeared to resolve with a restart of that device. (Which wasn't clear in ...


1

Old question, but no one really answered you and I have had the same question: Where does this configuration come from? It originates from cloudinit, precisely in cc_ssh.py within /usr/lib/python2.7/dist-packages/cloudinit/config This in turn is directly dependant on the file /etc/cloud/cloud.cfg. The you find a line disable_root: true. You should be ...


-1

Ah, same thing here. I solved by disabling public access to RDP, allowing only private network connections to the server. Which is, by the way, recommended as soon as you get access to your brand new server.


1

Usual solution (as far as I know and certainly what I've implemented) is combination of iptables (to restrict direct access) and then providing access via reverse proxy in Apache, Nginx, your web server of choice. Web search for "securing elasticsearch" brings up plenty of relevant stuff. Depends exactly what you're tryng to do whether reverse proxy is ...


2

The observed behaviour seems to be a bug in the debconf module. I filed a bug report. The user bcoca at github pointed out that one ca use the no_log: true directive in tasks, that set passwords, to prevent logging. This is a workaround, that worked for me.


1

Use encrypted volumes with a 3rd party encryption utility like TrueCrypt. This is the only way to prevent an admin from having access to data it should not have. It is sufficient against an honest admin, but it is not sufficient against a malicious admin, which could still install key-loggers or use remote access tools to view the volume content while a ...


0

BitLocker only encrypts data at rest, and applies to the entire volume. If you need the folder where the data will be saved protected during normal operation while the system is up, you can use EFS and assign a certificate to the account that will be accessing the folder so that only that account will be able to access the data.


2

So called "dollar shares" are hidden, but automatically shared and access is granted to all local administrators of the computer. The fact that you can access it implies you are an admin on the remote machine. You cannot edit their security properties, but you can remove them. That said, you could technically delete the c$ share and recreate it as a ...


-1

#> iptables -I INPUT -s 66.230.160.1 -j DROP #> iptables -I INPUT -s 66.230.160.15 -j DROP


0

There are at least a couple ways you could achieve that. I've seen examples of using iptables with its string/bytes-matching functionality to look for recursive queries coming from outside, and then dropping them. I've a colleague that did that on an authoritative non-recursive server for a number of years and he said it works well. I've also seen people ...


3

Postfix doesn't use unix permission feature to limit access to postqueue. Instead it uses parameters like ' authorized_mailq_users' authorized_mailq_users (static:anyone) List of users who are authorized to view the queue. So, if you want to limit to particular user, for example: root, you can use authorized_mailq_users = static:root For ...


1

Configure ACL for your external endpoint. Navigate to Virtual Machines >> Select VM >> Endpoints tab >> Select MySQL Endpoint >> Manage ACL >> Add ips (both private and public). For a single ip add /32 after address like xxx.xxx.xxx.xxx/32. After all permit rules, add a deny rule to 0.0.0.0/0


0

If You want that MySQL listen only to localhost edit the MySQL configuration file: bind-address=127.0.0.1


1

As long as the registrar allows you to add any valid DS record that you want to the delegation of your zone, the registrar will not be a factor. Some things that a registrar could do that would cause a problem is: if they do not allow you to add DS records whatsoever you simply cannot have a signed delegation at all (with DLV as a potential workaround), ...


1

As per Ansible docs: log_path If present and configured in ansible.cfg, Ansible will log information about executions at the designated location. Be sure the user running Ansible has permissions on the logfile: log_path=/var/log/ansible.log This behavior is not on by default. Note that ansible will, without this setting, record module ...


3

In DNSSEC, the role of the root and intermediate nameservers are to provide a chain of trust until an authoritative nameserver for your zone is reached. Aside from hosting the public DS key associated with your signed zone, they have no role in NSEC3 validation. For NSEC3 to function, you need to sign your zone using an algorithm that mandates support for ...


1

In general, running your own open-source cloud storage solution will be far less secure than any industry-standard service. Think of it this way, those companies have entire teams of people dedicated to nothing but securing their product, and they still make mistakes... That said, if you just want to do your best while swallowing the risk, here is some ...


0

I'd rather use a different approach. Accept these requests, but store these in a DB to deny these straight away through a security function of your website. If a firewall is installed, make sure the firewall also blocks the IP straight for 24Hours. Identification is pretty simple: Whatever is not a regular request, is bad. That is what I do and it works ...


3

The answer for this is pam_time[1] [1]: http://www.linux-pam.org/Linux-PAM-html/sag-pam_time.html "pam_time". As always, be careful editing pam and back up your config.


1

Here's an idea: In sshd_config add the following line: AllowUsers USER1 USER3 USER3 USER4 This list should be all users you want to be allowed to ssh to the system. After the list is present restart the sshd service. Then add the following lines to roots crontab: 0 17 * * * /usr/bin/sed -i 's/^AllowUsers.*$/AllowUsers USER1 USER2/' && ...



Top 50 recent answers are included