New answers tagged

0

It seems if you add report_changes to your directories like i did it c an cause this: /home/wordpress/sites/ Report Changes OSSEC supports sending diffs when changes are made to text files on Linux and unix systems. Configuring syscheck to show diffs is simple, add report_changes="yes" to the /etc /bin,/sbin Note Report ...


0

Best way to manage printer deployment is with gpo and print management roles. To properly resolved the issue I would do the following: Delete all printers from all profiles (can be done with scripts, if they are deployed through a GPO now, it will remain there even after GPO has been removed since it was an installation) Verify all the printers are ...


1

Slight change of adams solution which doesn't break if root is logged into more than one terminals: login_info="$(who | head -n1 | cut -d'(' -f2 | cut -d')' -f1)" message="$( printf "ALERT - Root Shell Access (%s) on:\n" "$(hostname)" date echo who )" mail -s "Alert: Root Access from ${login_info}" admin <<< "${message}"


0

This is a rather broad question so this is a very broad answer: From experience managing various things in IT, creating a sub-domain for each customer will make your life easier in the future. With a few clients 1 domain will be fine, but with many clients(probably 20+) it will become very difficult to do things like implement features per customer (ie: ...


0

So the closest I have found is a compromise by creating a Debian/Ubuntu EC2 instance and then installing "katoolin" which enables you to install all the Kali distro tools.


1

I have never come across an online tool that can do all of this. Usually to ensure these tests are all compliant, you would get an external security audit team in to handle the tests and they would provide you with an idepth report of all vulnerabilities found There are also a plethora of tools you can use yourself to simulate these type of attack, such as ...


0

This is a real login. And to answer your question "how you can suddenly use a password login", It is because you simply have not disabled password authentication. If you do not require password authentication for any of your users, you should set the PasswordAuthentication flag in your sshd_config to no, as password can be keylogged or bruteforced. I ...


0

You can restart the HTTP service using net stop http and net start http. It will obvious only affect applications using it (like IIS). You will also need to restart any services depending on HTTP service and close any other process using \Device\Http\* (otherwise the service won't stop). Here's a PowerShell script to do all this. (It uses handle.exe from ...


1

Google Groups state following java -Djenkins.install.runSetupWizard=false -jar jenkins.war the -Djenkins.install.runSetupWizard=false disables the setup wizard & the admin user stuff.


1

As of April 2016, Elastic Beanstalk supports automatic platform updates: https://aws.amazon.com/about-aws/whats-new/2016/04/aws-elastic-beanstalk-introduces-managed-platform-updates/


0

Inspired by this Since in above issue, they haven't used Github Auth plugin, my jenkings config.xml had other tags, this is what I did: in my jenkin server --> JENKIN_HOME/config.xml First under --> set true for below authenticatedUserReadPermission useRepositoryPermissions authenticatedUserCreateJobPermission allowAnonymousReadPermission ...


1

SSH is encrypted, so there's no need to double encrypt by using a VPN. Even if someone's snooping on the traffic they can't get access. Make sure you authenticate using public key, which is the default in AWS Amazon Linux instances, but may take a bit more work on other distributions. If you plan to SSH in from various locations the best bet is to close it ...


2

Yes, using a VPN for ssh access to EC2 is best. Even if you're closing access from a public address after you use it, it's still a risk while it's open, especially if someone is snooping traffic on, say, a coffee shop wifi. If VPN is not an option, there are a few steps you can take to mitigate risk (you should really be doing these either way): ...


5

A * in the location of the hashed password in /etc/shadow effectively disables all password based logins as no user input will ever result in a hash value of *. But the user can still login with his/her ssh keys. The difference of using * instead of using an exclamation mark ! is that the latter indicates a locked account in PAM, which, depending on your ...


1

It could be safe It depends on your security requirements and level of risk you are willing to take. Here are some considerations/ideas SSH is fairly secure, especially when forcing key authentication. Networks provide remote access via VPNs all the time. SSH is not much different. Password encrypt your SSH keys Enable automatic security updates You ...


0

IIS best security practice is an entire discipline and you could spend months reading and learning. And you're certainly asking the correct questions. I would wax long about each of your specific topics and make explanations, but I'd just be repeating information that's already well documented. In short, if you wish to follow best practice configuration ...


0

Disable anonymous authentication and enable Windows Authentication. The client computers and the server itself will both need to be joined to the same AD domain for this to work. You then grant each AD user read/execute permissions to the web root folder (NTFS folder permissions) - the authentication is then automatic - the users will either get a 403 ...


0

In your case, php is essentially the same user as apache forks. So the user that owns the child apache processes is the user that requires access to files. The user apache runs as is configured in the apache conf file. You can verify who this user is on your running system by running: ps aux | grep http You will see a process owned by root, and a number ...


1

Edited: After a lot of comments; Changing the value of ms-exch-smtp-accept-authoritative-domain-sender is useful, as it can block too your server to serve as a active relay. It's only for your own organization. (domain listed in your Exchange's GUI as authoritative) The server act as you wanted by blocking such request, as the value make the server refuse ...


0

GMail has a setting where it allows you to send emails with a non-GMail domain provided the email address get's first verified. Your decision would block those emails. Whether or not you have users who might use this GMail feature and whether it makes sense to cater to them depends very much on the behavior within your company.


0

Simplest (but batch orientated): Use the checkpoint capability within ausearch, serialize the output into some transport mechanism (ie fold multiple records into a single line and transport via syslog and have your logstash macros break it out again) and run every N minutes. More effort: Cut code to do the above using audit-libs (start with auparse-feed(3)) ...


1

These events are coming from other capability (pam, openssh, etc) that send audit events to the auditing service. If you don't want any events, add audit=0 to the kernel command line args. If you want to know what capability that may want to use the auditing service try something like [burn@fc24 ~]$ rpm -q --whatrequires audit-libs libsemanage-2.5-2.fc24....


2

Maybe, but there are some cases you need to consider before you make such a change. 1) Does anybody in your company use any kind of external service (for example Survey Monkey, Constant Contact, etc.) to send out emails that appear to be "from" your domain? Even if they aren't doing it today, might they do it in the future? 2) Are there any an outside ...


2

You should be able to find the source by checking the MAC addresses embeded in the data "44 a8 12 41 1d 2b 13 8b 9c ab 34 89 10 00". 44:a8:12:41:1d:2b should be your interface's MAC address. 13:8b:9c:ab:34:89 should be the remote device's MAC address. Try checking your cache to see if you have any other addresses for those MAC addresses. arp -a should be ...


2

Much of the problems experienced with martian source is caused by network topography considerations. The following may need to be addressed: Router: The router may be routing through illegal addresses; make sure that the router is configured correctly. Multiple NICS: If a computer has multiple NIC cards plugged in to the same switch, then ...


-1

SPF wont cure this as the envelope could well have a proper SPF pass (i.e. spammers using compromised server) whilst they will forge the email inside the envelope. What you need is a block on your own domain email message that has an originating email server on the envelope not acceptable to you.


1

You can do this in PowerShell by updating your Receive Connector permissions to exclude Anonymous users from sending as an authoritative domain sender: Get-ReceiveConnector <identity> | Remove-AdPermission -User "NT AUTHORITY\Anonymous Logon" -ExtendedRights ms-Exch-SMTP-Accept-Authoritative-DomainSender However the problem arises when you have ...


10

Such a block is likely to reduce spam and possiblly make social engineering harder but it may also block legitimate mail. Examples include mail forwarding services, mailing lists, users with misconfigured mail clients, webapps that send mail direct from the webhost without involving your main mailserver and so-on. Dkim can mitigate this to some extent by ...


30

There is a standard for doing this already. It's called DMARC. You implement it with DKIM signing (which is a good idea to implement anyway). The high level overview is you sign every single email that leaves your domain with a DKIM header (which is good practice anyway). Then you configure DMARC to reject every email that hits your mail server, from a ...


0

Filter It the relevant part Get-EventLog -logname security | Where-Object {($_.eventid -eq 1936) -or ($_.eventid -eq 1937) -or ($_.eventid -eq 1938)} | select EventID,MachineName,EntryType,Message,InstanceId,TimeGenerated,Timecreated,UserName | fl | export-csv -path C:\logs.csv


50

Yes, if you know that email for your domain should only be coming from your own server, then you should block any email for that domain originating from a different server. Even if the sender's email client is on another host, they should be logging into your server (or whatever email server you use) to send email. Taking that a step further, you could ...


2

have you tried something like this : Get-EventLog -logname security | Where-Object {($_.eventid -eq 1936) -or ($_.eventid -eq 1937) -or ($_.eventid -eq 1938)} | export-csv -path c:\temp\events


2

This should be set by changing the SecDefaultAction defined in the modsecurity_crs_10_setup.conf file. The default is below (except changed from deny to pass for Anomaly scoring) and will log everything to both error and audit log: SecDefaultAction "phase:1,pass,log" SecDefaultAction "phase:2,pass,log" To just log this in the Audit log use the following: ...


0

I was able to solve the first issue as well. The reason for this odd behavior was caused because the reverse proxy dropped the query part of the request (everything behind the ?). This again was caused by misconfigured proxy_pass lines. The solution to this was to remove /$uri from both proxy_pass lines in the configuration file (details see http://nginx....


0

No idea about the hack, but to convert the binary you can use printf on the command line, like this: printf %b ")\xE7\xD1?\xD6\x18.\xC0\xCE\xA3\x7FR\xEA~O$\x0BLi\x13\xA0m\xE7\xF0H4\x92\xD6\xBFv\xD2\xDF3\xFCX#T\x0B\xB6\xE4XmU\xEF$\x03\xC9/\xFD\xDEf\x00\x89Prq\x1A\xB5\x13\x0CoGOn" It is still unreadable, though.


0

Here's a nifty decoder: http://ddecode.com/hexdecoder/ Not an answer... but, are you using a supported OS and is it fully patched? What are the various addon components, like Java, Nginx, database, etc, and are they fully patched? What about any other servers you have in the same domain?


1

There is a reason we refer to elevated accounts as "privileged" - there has to be some implicit level of trust you are granting Administrators as they have the ability to grant themselves access to most of your content. For "protecting mailbox data" I would enable legal hold on it, all changes to mailbox items are kept and you can't delete items, they are ...


-2

It seems clear the options dialog causes an issue, because I altered the order in which Putty negotiates the key exchange and problem solved.


1

Don't bother. See Why is HMAC-SHA1 still considered secure? Don't confuse the use of SHA1 as a certificate-signing algorithm (which is insecure) with the use of SHA1 in a cipher suite's HMAC.


1

If you have users that have root access to the machine, they can do anything they want. Any measures you put in place to prevent enabling of the NIC could be trivially worked around. So your options are: Don't give root access to users on this system. Instead, broker what privileged commands they can use with sudo. Sort out another way to disable/enable ...


0

If you are using boto3 you need to call modify_attribute and pass a list of group ids http://boto3.readthedocs.io/en/latest/reference/services/ec2.html#EC2.Instance.modify_attribute response = instance.modify_attribute(Groups=['string']) Groups (list) -- [EC2-VPC] Changes the security groups of the instance. You must specify at least one security ...


0

I was able to solve the second of the issues (error 1006) by changing some of the configuration options. As the other problem still persists I cannot confirm that the NoVNC console works from within the Horizon UI but when I call the NoVNC URL directly I get a connection and can interact with the instance. This is the working solution till now: ...


0

Your sendmail is listening ONLY on local/loopback interface (127.0.0.1). It makes sendmail unable to receive/accept connection from outside without "help" (e.g. redirects in iptables).


0

It's true what they say, nothing good ever happens after midnight. In case anyone else needs it, here is the solution: SecGeoLookupDb GeoLiteCity.dat SecRule REQUEST_HEADERS:X-FORWARDED-FOR "@geoLookup" "id:'992210',phase:1,t:none,pass,nolog" SecRule GEO:COUNTRY_CODE3 "!@streq USA" "id:'992211',phase:1,t:none,log,deny,msg:'Client IP not from USA'"


2

This does not secure the connection between these hosts at all. It lowers the attack surface on the server side when you limit access to daemons as much as you can but it doesnt help you when it comes to connection security. If possible you should enable SSL to increase the security of the connection. If this isn't possible you might consider setting up an ...


1

You should instead look at auditing access control changes and non-owner access to mailboxes. Office 365 can do this, but only alerts on such incidents at the highest tier E5 plan today. If this is on your roadmap, then you are practically solved.


1

No one will fake your IP range to get pass a firewall. The only way to do this is easily if your app is all UDP. That said just allowing your office's IP in is the first start. You might want to expand on that as the company grows. Like does everyone in the office need access to the whole AWS VPC? If not then you are looking at site to site VPN connection ...


0

You can try: git config --global --unset core.askpass


1

As always, it depends. In theory the log on process is a one-time event and once an active session has been established the actual usage patterns of authenticated users are what really determines the load on a server. In that regard even the computational cost of calculating a hash that was deliberately selected for being slow and expensive such as PBKDF2 ...


3

No, it is not a good idea. You can rely on the per-IP and per-username login attempt rate limits which you have already implemented to ameliorate password guessing attacks anyway. You have implemented login attempt rate limits, haven't you?



Top 50 recent answers are included