Tag Info

New answers tagged

0

You could set the share permissions to an Active Directory group, then have the infrastructure team give you delegation privileges to that group. When you need to deny access, simply edit the group membership. When you're done, restore the group membership. This solution doesn't require having any administrative access, and is much faster than editing the ...


0

You can if you like, but in reality sccm just manages a wsus service, so you'd be doing double the work. Chances are you can do the same things you're doing and perhaps more by using sccm. I'll update this later.


0

You could: Ask them to disable logging on the copy-script Ask them to share out the parent folder giving you access to the folder in question, where you can set file-system-permissions (as opposed to share-permissions) (e.g. D:\additionalFolder\yourfolder, share additionalFolder for the DBA team, and yourfolder as the current share.


1

This question is three years old but I feel it should be answered: they aren't open in the default installation; at least, not anymore. A port scan on a base installation of OpenBSD 5.5 only shows ssh: Port Scan has started… Port Scanning host: 192.168.1.29 Open TCP Port: 22 ssh Port Scan has completed… Enabling httpd and disabling pf ...


1

If you are using the PHP that is included in the official Redhat packages, then it is supported. They go out of their way to avoid the - 'want a security fix, have these incompatible changes as well' problem. Looking at the the Redhat version number and comparing with upstream is unhelpful for security issues. As it happens, the latest update for php53 was ...


1

Yes, Red Hat backports security fixes and important bug fixes to all packages they offer in their repositories until the EOL of that particular RHEL version. New major features or drastic changes are not appearing in RHEL updates.


1

ShellShock is practically a conjunction of more than one vulnerabilities of bash, and at this moment there is also malaware that exploits this vulnerability, so ShellShock can be an issue that is still open, there is a thread with updates from RedHat about this issues. Redhat recommeds the following: Run command: $ env 'x=() { :;}; echo vulnerable' ...


4

Could be a false positive - Make sure the 'echo' file does not exist from an earlier test on your bad machine, then retest. Failing that, could also be a false negative - Check you can touch a file on your good machine, then retest.


0

I had the same problem. I took a stab at creating some Python code to pull together Yum Updates and advisories from the steve-meier Errata site mentioned above (I filter it based on installed packages). In case it helps, here is the source: https://github.com/wied03/centos-package-cron


0

It still makes sense to put some ingress rules inside your docker instance to help ward off attacks, but you will have to limit outbound (Internet) access from whatever upstream router the docker image connects with. The reason for this is, if you try to block outbound access with the firewall rules inside your instance, then if the instance is compromised ...


1

Is there a solution to allow AcmeService to authenticate a user with SSPI if that user is in an external domain and there is no defined trust relationship? No. If you are constrained to working with the .NET NegotiateStream class, then you will see in the MSDN documentation for the NegotiateStream class, [MS-NNS]: The .NET NegotiateStream Protocol ...


0

Yes, uou can deploy WAP in the DMZ and your application (CRM) inside the network, you just need to make sure that the WAP server can contact the application and the ADFS server behind the firewall. There is no need to make the WAP domain joined if you are not planning on using Kerberos Constrained Delegation for backend SSO.


-2

type env x='() { :;}; echo vulnerable' bash -c "echo this is a test" and if this returns vulnerable and this is a test it means that your OSX/Linux machine is affected. Remedy is to update to the latest version of bash.


1

I think you're hoping for a place to put the cert that everyone can share. You can't do that. Each user needing to use the certificate will have to import it into her store while logged in. You may be able to script that process for the users, but the cert will have to be present in each user accounts store.


2

I wrote a CLI utility called ShellShocker to test your webserver for vulnerabilities on CGI scripts. To test your site, you'd run: python shellshocker.py <your-server-address>/<cgi-script-path> ie python shellshocker.py http://example.com/cgi-bin/possibly-vulnerable-script.cgi


3

No. WAMP out of the box does not use Cygwin, or come bundled with an implementation of bash for that matter.


67

To check for the CVE-2014-6271 vulnerability env x='() { :;}; echo vulnerable' bash -c "echo this is a test" it should NOT echo back the word vulnerable. To check for the CVE-2014-7169 vulnerability (warning: if yours fails it will make or overwrite a file called /tmp/echo that you can delete after, and need to delete before testing again ) cd /tmp; ...


13

I've been digging around the webs for a bit since I first posted this question. According the original discoverer of the bug, bash prior to the CVE-2014-6271 patch imported a function such as: foo=() { code } by replacing the equals sign with a space and interpreting it... which meant interpreting beyond the function definition was possible. The patch ...


1

You can submit your CGI URL to this online test: http://shellshock.iecra.org


2

It doesn't give you a nice clean output, but it does demonstrate the bug. With no bug, the environment variable X should be ignored, bash should run echo date, and cat should complain that there is no file called echo. Eg consider how dash behaves: me@myserver$ rm -f echo && env -i X='() { (a)=>\' dash -c 'echo date'; cat echo date cat: echo: ...


2

It's really something you will need to judge for yourself based on your knowledge of your environment and research into the vulerabilities of your environment. Basically you need to analyze the risk of someone capturing the network traffic on the subnet. If you feel the risk is low enough to not justify the performance hit, then don't use SSL. If you feel ...


30

Export a especially crafted environment variable that will be evaluated automatically by vulnerable versions of Bash: $ export testbug='() { :;}; echo VULNERABLE' Now execute a simple echo to see if Bash will evaluate the code in $testbug even though you've not used that variable yourself: $ bash -c "echo Hello" VULNERABLE Hello If it shows the ...


0

Do not accept environment variables: See this exploit that came out recently.. if you accept environment variables then you are opening up a really nasty exploit: http://seclists.org/oss-sec/2014/q3/650


2

You can configure this in main.inc.php: // add a received header to outgoing mails containing the creators IP and hostname $rcmail_config['http_received_header'] = true;


1

I found the sent-mail log file at : roundcube dir/logs/sendmail It contains a long list of sent email logs, and the IP address of the sender as well. This is exactly what I needed.


2

It is not an Exchange policy per se, but a Windows Active Directory Domain group policy. You can specify password length. You can also specify "require complex passwords" which the group policy defines as containing three of these four categories of characters: Lower case alphabet (a-z and diacriticals) Upper case alphabet (A-Z and diacriticals) Numerals ...


2

Given that there is potentially root-level malware on the loose, grab a known-good laptop (e.g. one booted from a LiveCD) and plug it into a port on the switch. Fire up some packet capturing software. Unplug cables (optionally in small groups) until the traffic of interest stops. Identify the device(s) connected to the cable(s) in question. Note that, in ...


4

Run a packet capture. Look at the ARP request in the capture. Identify the source MAC address in the ARP request. Look for the switch port tied to that that MAC address in the MAC address table of the switch. Identify the device connected to that switch port. Inspect that device.


4

https://github.com/realestate-com-au/credulous may be worth investigating. From the project description: credulous is a command line tool that manages AWS (IAM) Credentials securely. The aim is to encrypt the credentials using a user's public SSH Key so that only the user who has the corresponding private SSH key is able to see and use them. ...


4

Great question-and depending on the person answering, you will probably have a couple of routes to go. I will give you an example of what we use: Create IAM roles based on user (developer, infrastructure, security, audit, etc) -customize policy to allow or deny specific actions based on user access. Example: allow all ec2 actions for administrator. Or ...


1

I would add a two-factor authentication module, so attackers would not be able to brute force their way in (humans tend to use terribly simple passwords). One such option is Duo Security, which can push prompts out to smartphones (through a proprietary app) or send one-time passwords via text messages. It is free for up to 10 users. Another option is open ...


1

I believe AccessEnum from the SysInternals suite will do precisely what you need. http://technet.microsoft.com/en-gb/sysinternals/bb897332.aspx


0

Create a file in your nginx directory with all the required UserAgents you dont like. /etc/nginx/conf/blockuseragent.conf: if ($http_user_agent ~* ("Wordpress|w0RdPress|multipleitemsexample") ) { return 403; #Return anything you want. } In your virtual-host file add the following after the 'server {' opening block: include ...


1

This can be done on the gui also, you'll still need to remove anything referencing the LAN though. Once all this is removed, an option for 'change mode' will appear in the interface menu. warning: when this is applied, it will usually say "access denied" then auto reboot the device, but once you log back in the interfaces will have changed to routed mode.


1

It would be based on a MAC address. Basing it on a cookie would not work, as the cookie would not be presented to the access-point (etc.), but based on the DNS name of the domain they are currently viewing. It would also prevent things like email (not webmail) working. The difficult part is how to effectively present the authorisation part of the portal, ...


1

SHA-256 must be defined when writing a certificate request for your certificate authority and then certificate must be generated with SHA-256 (sometimes called SHA2). Some certificate authorities allow to choose with what hash will certificate be generated when ordering certificate and that overrides certificate request. HAProxy understands such certificates ...


0

CFEngine has the ability to track checksums for arbitrary files as well as managing the rest of your configuration. I'd assume that some of the derivative configuration management tools (like Puppet or Chef) with agents can probably also do something similar. http://cfengine.com/


0

You can have iptables match a string contained in a packet.. that string could be the user-agent header. The problem with that is that the HTTP request could span multiple packets. If that happens, it will do two things.. it will still hit your server, and it will establish the TCP connection, potentially thwarting your efforts to block the next request. ...


2

If you are using a startup script, you need to give the Domain Computers group permission in the share and NTFS permissions. Startup scripts run in the context of the SYSTEM account. Your tests that you've run manually will run in the context of whatever the logged on user is. You can test this manually by running psexec -s cmd which will launch an ...


3

Don't even think about giving the root user a blank password. If you do this, it's trivial to leverage a non-root compromise into a root compromise. Consider one of many possible scenarios: An attacker uses an unpatched vulnerability to compromise the web server or the application the web server is serving. He gets a shell running as the web server's user. ...


0

try using Windows NT offline password and registry editor http://pogostick.net/~pnh/ntpasswd/ you should be able to boot from it and remove the Duplicate account


1

What you're talking about is security through obscurity. You want a group of techs to have permission to do something, but you don't want to give them access to a big, scary console with lots of buttons that could get them into trouble if used improperly. I get it. But it's fallacious thinking because it's just a warm blanket that feels comfortable but ...


-2

In essence without this you can upload file with php code named like 'foo.jpg' to web server; then request it like http://domain.tld/foo.jpg/nonexistent.php and web server stack will mistakenly say oh; this is a PHP; I need to process this, it will fail to find foo.jpg/nonexistent.php so it will fall back to foo.jpg and process foo.jpg as php code. That is ...


4

You're right that your admins should be using individual user accounts. Shared accounts are a bad idea all around. On the Windows side the blank password idea seems pretty bad. Anyone who manages to get unprivileged local code execution on a machine will have a much easier time of escalating privileges with a blank RID 500 Administrator password, in my ...


5

Speaking from a Windows standpoint: Blank passwords can absolutely be brute-forced. Pen testers do it all the time. It seems to me that at that point a user with enough access to map a drive could replace a service executable and then restart the service remotely, for example. From a linux standpoint, anyone with a valid login would then be able to su ...


0

From http://www.nongnu.org/tiger/ "The 3.2.3 release was published in September 2008 and was mainly a bug fix release. This release incorporated all the fixes introduced in the Debian packages (a result of the help of users and developers using Tiger in that distribution), and included new features related to the handling of exotic filesystems in Linux." ...


4

It makes no difference at all if the Apache user is called www-data, apache2 or dumbo (www-data is the default on Debian derivatives, and apache2 on RedHat). Both are non-privileged (e.g. non-root) on their respective platforms, because that is what's important: The user needs to have as few permissions as possible in the rest of the system. The default ...


1

I guess the product might be Nessus.


2

According to WildCard SSL Certificate security protocols it allows only protection of first level domain which also includes your main domain such as domainname.com and domain.domainname.com. It allows unlimited sub domains security but they must be first level domains. If you want to protect your sub domain name which formats in ...


12

Yes, you will have to buy another certificate* The asterisk wildcard character * will only match 1 label in a resolved FQDN. This behavior reflects RFC 4592 Section 3.3, in its description of DNS label matching and fallback to the asterisk label. If you only need to secure a single endpoint under the .internal.mycompany.com. namespace, you don't need a ...



Top 50 recent answers are included