New answers tagged

2

This does not secure the connection between these hosts at all. It lowers the attack surface on the server side when you limit access to daemons as much as you can but it doesnt help you when it comes to connection security. If possible you should enable SSL to increase the security of the connection. If this isn't possible you might consider setting up an ...


0

You should instead look at auditing access control changes and non-owner access to mailboxes. Office 365 can do this, but only alerts on such incidents at the highest tier E5 plan today. If this is on your roadmap, then you are practically solved.


1

No one will fake your IP range to get pass a firewall. The only way to do this is easily if your app is all UDP. That said just allowing your office's IP in is the first start. You might want to expand on that as the company grows. Like does everyone in the office need access to the whole AWS VPC? If not then you are looking at site to site VPN connection ...


0

You can try: git config --global --unset core.askpass


1

As always, it depends. In theory the log on process is a one-time event and once an active session has been established the actual usage patterns of authenticated users are what really determines the load on a server. In that regard even the computational cost of calculating a hash that was deliberately selected for being slow and expensive such as PBKDF2 ...


2

No, it is not a good idea. You can rely on the per-IP and per-username login attempt rate limits which you have already implemented to ameliorate password guessing attacks anyway. You have implemented login attempt rate limits, haven't you?


1

Those descriptions are a bit vague. There are two tokens. A process Access Token, and a Kerberos token. The process token is specific to the local computer. "In Windows implementation, the application server derives the authorization data (PAC) and requests Windows OS to generate an access token." https://blogs.msdn.microsoft.com/openspecification/...


0

yellow, the information from the 2008 AD Resource kit is correct, Access tokens are created by local systems and then attached to threads that user is running. there is some very good information here: https://msdn.microsoft.com/en-us/library/windows/desktop/aa374909(v=vs.85).aspx and here https://technet.microsoft.com/en-us/library/cc783557(v=ws.10)....


-1

we solved it commenting out the Ciphers line on /etc/ssh/ssh_config


0

Some systems can store/compute entropy (password complexity) and compare them, I don't know if it's the case of PAM.


0

you can use some network sniffer tools which will pinpoint to process level which one is sending what. You can as well filter if needed. some examples: network monitor 3.4 (microsoft) outdated, but works well. fiddler ... (other most probably) Give network monitor a try and within 15 minutes you know where to look next.


4

Are there any disadvantages of blocking port 80 completely? The only disadvantage I can think of is that customers are forced to enter https:// in front of their url, instead of relying on the automatic redirect. That is exactly primary reason to leave port 80 open, user-friendliness. AFAIK most browser still default to using http:// when you enter a URL ...


3

Yes, removing the redirect will cause major issues. New customers will not know about this, nor will many crawlers that you may want to allow access to. The threat vector that you are closing off is negligible. The POST data will likely be sent in the clear as a single HTTP request, which will then trigger the redirect. However, in most cases, a POST implies ...


1

netstat -b -o lists the network connections, process and PID - you should be able to figure out which IIS worker process is doing all the port 25 connections.


6

Your "only disadvantage" is a very big one, IMO. No one I know types out https:// in URLs very often. I'd suspect 99% of normal users would just go "huh, site's down". A HTTP POST would indeed send the data unencrypted. It will also fail, because the redirect will cause it to turn into a GET. That said, there's little reason people will be making HTTP POSTs ...


1

No, I would not do it. If your system is a Web servers and everything is fine there is no benefit in upgrading from 14.04 to 16.04. Secutity updates for this release will be up to 2019 year, so stay withing 14.04 LTS. You, or someone else, can upgrade it three years later.


4

Where does that certificate ultimately persist if I put it on the ELB? The certificates are stored in IAM. They should be as secure, there, as your account credentials are, so this seems like a misplaced concern, to me, once you have this information. The ELB instances fetch the cert, chain, and private key from IAM whenever they start up or scale up. ...


2

If you cannot find the files that it is loading in your web directory, there could be a problem of someone pointing your DNS to their server in order to hijack your traffic. I would start with verifying your DNS, and after that is made sure to point to the correct place, try running a new installation of wordpress with just a default page to see if it ...


0

You have to install the virtual package for the current kernel. linux-image-extra-.* should be a dependency then. So when you have installed the generic kernel, you should have the linux-image-generic package installed. It depends on the current linux-image-extra-.* as you can see here. This is not a normal problem by the way. It should usually just work.


1

This is possible with a combination of a script, a scheduled task, and NTFS permissions. Assuming you have no sub folders and just files in a single folder, this is how to achieve it: Groups Set up a Users Group Set up an Admins Group (use the built in ones if you like) NTFS Permissions on the destination folder (I:) Read, List Folder contents, ...


0

You can put it on the same box as haproxy. It makes a lot of sense to put it there, actually. So the question becomes before or after haproxy. If you put it before, then in addition to the rules to protect your app, you will also have to put in rules to protect/allow your static assets. If you put it after, you don't have to worry about rules for your ...


1

I will agree that the situation is not ideal, but there is no threat here to your account, and informing you wouldn't be the best option. cPanel uses Apache's VirtualHost sections to determine which content is served for which request. In most cases, the IP address, port, and hostname should all match a single VirtualHost entry. However, if there is no ...


0

We have found a viable solution: Use Vault or similar to manage the actual secrets, grouped by role, with short keys to unlock each set of secrets. Automate Instance creation with something scriptable (ie: Cloudformation, Terraform, aws cli), as part of the creation script... create and populate a short-lived S3 bucket with the Vault key provide a ...


0

Yes. If you have access to a secure host X, but you need to access to vast, but potentially insecure, computing resources at Y, you can use homomorphic encryption on the data. In this way, computations can be carried out on Y, without ever leaking data from X.


0

From my experience, you're going to have some issues if you plan to do pen-testing in AWS. AWS explicitly disallows this sort of thing. I've got a NESSUS EC2 instance in AWS and AWS told me that I'm not even allowed to port scan my own network.


1

Transit encryption for SMB was introduced in version 3.0, which is what Server 2012/Windows 8 come with. (And SMB 3.0 requires Server 2012/Windows 8). So an SMB transfer between Server 2008 R2 servers would not be encrypted, and could be sniffed, yes. (As would an SMB 3.0 connection, by default - it's something you have to enable.)


0

The question you might want to ask yourself, is what is the benefit in knowing what script sent the email? Certainly you should be looking to fix your security, but the exploit is not the same thing as the vulnerability - there are multiple things an attacker might do with your system, not just sending email. So really your focus should be on fixing the ...


0

Did you check web log? Try to look process with ps to identify process which sending spam. Maybe you can catch it there. Second, maybe spammer periodically send by crontab, check every crontab in your system to identified the bogus script. –°heck one of the email with postcat to see which script tries to send them: postcat /var/spool/postfix/deferred/1/{$...


3

Blocking IP Addresses dynamically without any software First, your title makes no sense. Software must be involved in this. There's no way around that. Perhaps you meant "Any Additional Software"? Next - if these IPs are already in your UFW block log, then why do you want to block them again? UFW has already blocked them? Speaking frankly, you really ...


0

If a user is able to SSH on to server B from the "outside" and then managed to SSH over to A, the logs on Server A would show the source IP as Server B NOT the users remote IP. You would therefore not be able to tell whether the SSH session was from an internal or external user. You need to lock down external access to Server B so that only specific IP ...


0

You should be able to do this with normal NTFS permissions. I found this article. It is about 10 years old but it shows this example pretty clearly: https://technet.microsoft.com/en-us/magazine/2006.01.howitworksntfs.aspx Grant the Read & Execute and Write permissions for This folder only (selected in the Apply onto list) to the users you want to ...


2

As I see it, there's a problem that if the script is running as the user, they need to have permission to write to the I drive. You could, perhaps, have a scheduled task, running with write permissions on the I drive, that pulls the files. Perhaps they could create a file called "readytocopy.txt" or something like that. When the scheduled task finds ...


0

Why not just use iptables or even /etc/hosts.{allow,deny} to allow the address you want on Server A and then on Server B only allow Server A? Why not just whitelist the IP's you allow and deny all the rest? Another thing I find helpful is to put SSH on a non-default port. On another note, you can view /var/log/secure to see the originating IP.


5

Erm... You can't delete active files like this. You called a 64 bit powershell instance to delete a module for the 64bit shell. Powershell preloads modules (but doesn't necessarily install them) which locks the module file.


0

For me to get this to work for Archiva 2.2.0 I had to edit {archiva root}\conf\archiva.xml. There's a password section and within that is expiration where you can configure if it is enabled or not and set the number of days. Creating a password.properties did not work for me.


1

Don't use Domain admin accoutns for service accounts. if the service is compromised then your domain admin account could be as well. I would create separate user accounts for each service and give them the rights they require for their role. What Server OS are you using? there is some good advice in this blog: http://www.systemcenter.ninja/2012/05/system-...


1

Inbound options do not apply to PHPMailer. SSL on port 465 (SMTPS) has been deprecated since 1998, though Microsoft didn't seem to notice. Use SMTP+STARTTLS on port 587 instead, which is what PHPMailer does when you use SMTPSecure = 'tls' & Port = 587. Note that PHPMailer does opportunistic TLS, in that if you don't tell it to use TLS and you connect to ...


0

This would be a simple script to list the programs which a specific user is executing and then checking all the programs whether they using a specific library: USER="www-data" LIB="libcrypto" while read line; do arr=( $line ) com="${arr[0]}" # only programs with absolute paths (?) if [ "${com:0:1}" != "/" ]; then continue fi ...


0

If you have access to the executables you can use ldd /usr/bin/progname to see what libraries are linked to without requiring any elevated rights.


3

Commands that start with an exclamation mark ! escape the FTP client and are executed locally with the rights of your local user. The don't run on the server, actually they won't even reach the server, so there is nothing for vsftpd to block.


0

The easiest option is to run P as user Puser and then modify permissions of directory ~/playarea so P can access it. You could make Puser member of the group of the ~/playarea directory and if that is not an option you could use ACL in the directory with something like setfacl -R -m user:git:rwx,default:user:git:rwx ~/playarea. With that command user Puser ...



Top 50 recent answers are included