Reputation
871
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
2 7
Newest
 Yearling
Impact
~23k people reached

  • 0 posts edited
  • 0 helpful flags
  • 21 votes cast
Jul
27
comment SELinux: how to enable write access to Joomla cache directory?
semanage fcontext -l | grep httpd
Jul
14
comment pam google authenticator can't compute location of secret file
Or, if you're cheap, you can try github.com/mricon/totp-cgi
Jul
14
answered Google authenticator / SSH: multiple shared secrets per user & sharing of shared secrets over users
Jul
14
answered What are soundd daemons, and why does nginx need the type under SELinux?
Jul
8
comment Cannot switch, ssh to specific user: su: cannot set user id: Resource temporarily unavailable?
@Utrecht well, you could have done a "ls" in /etc/security/limits.d/ and noticed that on EL-7 it's called "20-nproc.conf", which would have probably been faster than asking it here.
Dec
30
answered PAM, RADIUS, Google Authenticator and Two Factor Auth
Dec
12
awarded  Yearling
Sep
16
answered ssh tunnel through two-factor auth
Dec
12
awarded  Yearling
Oct
25
answered Tell browsers to cache until last modified date changes?
Sep
24
answered Is there an open source equivalent of Windows software restriction policies for Linux?
Sep
4
comment How to fight request spam (DDOS i guess) on CentOS server
Yes, I've used modsecurity extensively in the past. It's effective, but pretty horrible to configure (as most security tools are). Using it they way you suggest -- by counting per-IP accesses -- is not effective in a DDoS scenario. With a distributed botnet, each of the many thousands global nodes will make a handful of requests, each 5-10 minutes apart. Dumber botnets will not vary their headers, so you can filter by that (as I suggest above). Cleverer botnets will vary the headers and make their traffic pretty much indistinguishable from legitimate access.
Sep
4
comment How to fight request spam (DDOS i guess) on CentOS server
This will very likely deny legitimate requests.
Sep
4
answered How to fight request spam (DDOS i guess) on CentOS server
Sep
4
comment How to fight request spam (DDOS i guess) on CentOS server
As the OP specifically pointed out that the attacker is sending at most 2 requests from each IP, hence the first "D" in the DDoS (Distributed).
Jun
25
comment possible? radius server with active directory users and google authentication
@MoSiAc It's best if you ask this on github.com/mricon/totp-cgi/issues and we'll be glad to help you out.
Apr
9
comment selinux in enforcing mode
This is really something that few are aware of, unfortunately. There is basically a bunch of SELinux denials that occur on almost any command run and are mostly bogus denials that can be safely ignored in 99% of the cases. To prevent your audit logs from filling up with this junk, they are blanketly labeled as "don't audit these." However, when you are writing your own policy, you have to turn the "dontaudit" off in order to make sure that you are not missing anything.
Apr
5
comment Are OTP/OATH (RFC 4226) Hardware Tokens Re-seedable?
Just so you are aware, Google Authenticator PAM module has important security limitations: blog.mricon.com/2012/12/…
Mar
30
comment How to use php readfile() across partitions?
When do you say "I do not have selinux installed", what do you mean? What's the output of "sestatus"?
Feb
17
answered Force every HTTPS to one url