Questions tagged [network-security]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
47 views

OpenVPN "TLS Error: TLS key negotiation failed"; possible malicious access tentative

I have an Ubuntu Server with OpenVPN 2.5.5. Here is the server configuration port 1194 proto udp dev tun ca /etc/openvpn/server/ca.crt cert /etc/openvpn/server/issued/server.crt key /etc/openvpn/...
il_mix's user avatar
  • 103
0 votes
3 answers
46 views

Azure managed identity Arc enabled server and operator security

I have an Arc enabled server which is using managed identity to connect to an Azure Key Vault. The IIS hosted application is able to access the key vault without any problems, but there's a security ...
Tsk's user avatar
  • 3
0 votes
1 answer
50 views

Why I'm getting these random [UFW BLOCK] requests in my syslogs?

I just noticed large numbers of these random requests getting blocked by UFW in my ubuntu server 22.04 9:34 AM [UFW BLOCK] IN=eno1 OUT= MAC=[MY_SERVER_MAC_ADDRESS] SRC=193.254.3.18 DST=[...
Sandeep Kumar's user avatar
0 votes
1 answer
245 views

Getting random http/s requests from certain IP addresses

Stack used: ExpressJs, NodeJs, Docker, Nginx, Ubuntu 20.04 I host my backend on DigitalOcean droplet with the tech stack mentioned above. My server constantly has been targeted multiple times on ...
spatak's user avatar
  • 101
0 votes
1 answer
308 views

Windows security event ID 4769 Kerberos Error on single user Domain

I have a test lab with a single Windows Server 2019 and a single Windows 10 Pro PC that connects to it, with a single user, me. I test our own software on it and that's it. As of the past few days I ...
SKidd's user avatar
  • 61
0 votes
0 answers
18 views

Wireless SSIDs restrictions for Windows Mac Ubuntu

I am an IT Admin and we are using Symanetc EndPoint protection, through this we have restricted external USB access.Now, I need to allow only office provided wireless access points to the office ...
Ansarullah's user avatar
0 votes
0 answers
61 views

Secure external database access from AWS application

Today we have a solution whose infrastructure is entirely hosted on AWS. Among other things, there is an API (API Gateway + lambda) which communicates with a database through a VPC to VPC connection ...
Maxime Rossini's user avatar
0 votes
0 answers
29 views

Securing VPN access using the Always On Technology or 3rd party VPN clients?

I'm using Hybrid Azure AD Join for all my Windows 10 & 11 Workstations, but not for the Windows Server OS. So rather than manually deploying the 3rd Party VPN client to each workstation, can I use ...
Senior Systems Engineer's user avatar
0 votes
0 answers
227 views

Docker and Nginx Reverse Proxy Best Practices

I recently found out some basic security stuff I could implement to ensure that my VPS's are safer. I have tried to implement these but I have run into some problems. I do not know what my next steps ...
Shanah Jr Suping's user avatar
-1 votes
4 answers
360 views

What is the proper way to block entire TLDs using iptables?

With new TLDs being approved like .zip that could be extremely malicious, it seems prudent to have the ability to block entire TLDs on tap. What is the proper way to do this in iptables?
Anna's user avatar
  • 109
-4 votes
1 answer
78 views

Is there any way to access Hyper-V host from a network adapter not shared with host? [closed]

I am considering to move my firewall inside Hyper-V. There will be only one Guest OS that is connected to the virtual Switch, and the guest OS is the Firewall OS. While the second adapter at the ...
prd's user avatar
  • 608
0 votes
1 answer
364 views

Is there a way to exclude a network interface from being bound via INADDR_ANY?

In network programming, it's common to pass INADDR_ANY (or IN6ADDR_ANY) as part of the second argument to bind(), telling the networking stack that you want the socket to receive connections/traffic ...
Jeremy Friesner's user avatar
4 votes
1 answer
1k views

VPN instead of VLANs

My network have about 8 thousand user, who work in multiple buildings. There is frequent employee turnover, which currently forces changes in the configuration of vlans on the switch ports. In ...
Qmails's user avatar
  • 41
2 votes
2 answers
2k views

DigitalOcean Network Firewall allowing SSH connections on ports other than only 22

I have a droplet on DigitalOcean with IPv4 and IPv6 enabled. The droplet is behind a digital ocean network firewall with the following rules: Inbound: SSH TCP 22 All IPv4, All IPv6 HTTP TCP 80 All ...
Ouss's user avatar
  • 158
1 vote
0 answers
1k views

Wireguard VPN not making handshake

I'm facing a trouble, I have a server with Wireguard configured, with the keys generated by wg command line. I've downloaded Wireguard for windows and put the public's server key on client peer, and ...
Fabricio Franco's user avatar
1 vote
1 answer
4k views

Where does Ubuntu log TCP connections?

When doing some network security checks (on which I am an amateur) for my office PC, I discovered a few unknown tcp6 connections (with netstat -nt): Active Internet connections (w/o servers) Proto ...
trisct's user avatar
  • 113
1 vote
1 answer
593 views

Blocking SSH access from WAN side of CISCO 890 to management plane

I've been round about the houses with this one for days, i've not found a solution yet that works. I haven't found a way to block the HTTP access to the management plane either, i had to give up and ...
Owl's user avatar
  • 121
1 vote
1 answer
1k views

Chrome ignoring local dns replies

Am having a local network with about 300 devices some is domain connected and some are not I have windows server 2012r2 sith dns role Domain connected users can access local iis webpage while others ...
Mohammad Akhrass's user avatar
0 votes
2 answers
1k views

Best way o allow only 2 countries IP acces server

i have a VPS with apache2 and 3 virtual hosts, i see a lot of ips trying to accees resources that does not exist, i also see a lot of ssh incorrect users and password tying access he server, so I need ...
Diego's user avatar
  • 1
0 votes
1 answer
316 views

How many Domain Controllers might a Windows Client send LDAP Ping to when trying to locate a DC for Authentication?

I'm a cybersecurity researcher, studying netflow patterns to learn about reflective DDoS events that leverage CLDAP as a UDP reflection vector. I need to be able to distinguish between a windows ...
chad's user avatar
  • 439
0 votes
1 answer
62 views

Some ports in my IP direct to unknown server

Backgrounds I have a dedicated server(which is a desktop) running in my office. It has static IP and was running for about 5 years now with out any network problems. However, after the office had a ...
Gooday2die's user avatar
0 votes
1 answer
712 views

Access control rely on nftables, WireGuard and Reverse Path Forwarding only

I have an idea to host a web app that without built-in authentication on my server. And protect it by nftables, WireGuard and Reverse Path Forwarding only. The web server will listen to the server's ...
Waiho's user avatar
  • 23
0 votes
0 answers
604 views

When is mapUser required -

I'm not sure I understand when & why mapUser is needed. When you generate a keytab with ktpass you can map the Service Principal to a user wit mapUser. You can then kinit to the Service from an ...
Gonzalo Etse's user avatar
0 votes
1 answer
214 views

QEMU/KVM: how to protect monitor access?

Runing QEMU/KVM with monitor: kvm ...some_parameters... -monitor unix:/my_path/my_fifo,server,nowait We can then connect using socat - UNIX-CONNECT:/my_path/my_fifo then type commands. Easy and handy. ...
Gregory MOUSSAT's user avatar
0 votes
1 answer
35 views

mongo secondary node - weird log entries

I have mogodb cluster with 4 nodes, all nodes work on standard 27017 port. I found weird things in my mongod.log on a secondary node: {"t":{"$date":"2022-03-26T23:22:34.593+03:...
Antonio's user avatar
  • 169
0 votes
1 answer
158 views

How to allow outbound connections only for updates

I have a network with a number of VMs hosting applications mainly for internal use, but they are also exposed to the internet via Traefik. Because there is a chance one of them will be hacked ...
Alex's user avatar
  • 101
2 votes
2 answers
2k views

How to block .git Folder serverwide on NGINX?

I have a question about blocking the .git folders server wide on a NGINX system. At the moment I'm playing around a little with NGINX, I actually use Apache. In Apache, it's actually no problem to ...
Taoiseach's user avatar
0 votes
2 answers
1k views

Should server be hidden behind a VPN for the SSH access?

We have three server instances, Nginx/PHP, PostgreSQL, and ELK stack. My idea is that the PHP server would allow public access for ports 22, 80, and 443, ELK server would have open port 5601 for ...
djboris's user avatar
  • 101
0 votes
1 answer
154 views

IPv6 vs IPv4 available subnets - enough or too less

I read a bit about IPv6 and found that usually you get assigned a /48 prefix address. Which gives you 16 bit for subnetting. Reading further assuming that you use /64 subnets you would end up with ...
metriXc's user avatar
0 votes
1 answer
126 views

Cisco Catalyst 2960 Allow Management from Single IP Address

Our organization was recently required to use MFA for logging into our networking hardware. We're accomplishing this by using Royal Server and Royal TS, and limiting the source IP for SSH and web GUIs ...
emike09's user avatar
  • 13
0 votes
1 answer
700 views

Domain joined WAP in DMZ

To date, I've only ever used ADFS for claims aware applications. I'm now looking at using it for some non-claims aware applications. I've read that the WAP server must be domain joined for this so ...
Steve's user avatar
  • 1
0 votes
3 answers
2k views

Do network acls block inter-subnet traffic as well?

I have VMs placed in different AZs on AWS. In order to be able to do this, you need a subnet in each AZ. If I'm creating a network acl for the entire setup (ie to be associated with all subnets) do I ...
ndtreviv's user avatar
  • 113
-1 votes
1 answer
498 views

AWS network-acl blocking nginx dns resolution

I'm trying to lock down ports on my subnets, and am having a problem with an nginx instance that I'm running on ECS. Traffic comes into the system on :443 to an ELB, which routes some of it to an ...
ndtreviv's user avatar
  • 113
2 votes
0 answers
133 views

Does an IP lockout policy prevent most public RDP attacks?

My company uses RemoteApp to provide a "cloud edition" of our desktop software. The RDP port has been changed from default, and we run RDP Shield, which blocks the IP address after 5 failed ...
Kyohei Kaneko's user avatar
1 vote
0 answers
558 views

Is there a way to modify specific IP options through iptables?

In IP header there is a option 130 - specified in RFC 1108, it adds some security options for IP packet, like mandatory access control levels and categories. My task is to try to modify at least level ...
kiyama's user avatar
  • 11
0 votes
0 answers
37 views

Send command to another machine in a secure credential way

I have a question to ask you: I am creating a script to use with certbot for the renewal of certificates via DNS, everything works correctly on the same machine where BIND is also running (this ...
MrTaik's user avatar
  • 37
0 votes
1 answer
55 views

Network Mapped Drives sensitive information leakage when changing LAN networks on Windows

Assuming the following or similar setup of network drives/locations on a Windows 7+ system originally connected to a TrustedLAN: TrustedLAN Gateway: 192.168.1.1 /24 TrustedLAN Windows System IP: 192....
Fit Nerd's user avatar
  • 127
0 votes
2 answers
419 views

Security implications of directly connecting a Windows PC to ISP via Network Adapter with Ethernet cable bypassing the Router

When diagnosing Internet connection issues (slow speed for example), an ISP technician may ask a user to connect their ISP-provided Ethernet cable directly to a device (typically a Windows PC) to run ...
Fit Nerd's user avatar
  • 127
0 votes
0 answers
26 views

GLOBAL lockout of ALL external incoming access attempts

I have stripped down my /etc/services file to bare minimum (according to my awareness of what is needed) for a Linux DESKTOP configuration accessing remote services and offering no services to remote ...
Eric Marceau's user avatar
1 vote
0 answers
255 views

Location of authpriv.notice logs on Bitnami

I have a Bitnami server, Ubuntu Xenial, on AWS LightSail. I followed this tutorial to restrict SSH connections by country. This script ipfilter.sh filters IP addresses: #!/bin/bash # License: WTFPL # ...
miguelmorin's user avatar
0 votes
1 answer
3k views

Does GCP Cloud Armor support TCP load balancer? I am unable to add TCP load balancers as a Targets in Cloud Armor?

In the GCP cloud armor documentation, it is mentioned here, that it supports HTTP(S) and TCP load balancers to be configured. But I am unable to add TCP load balancer as a Target in Cloud Armor as it ...
Ravi K Mahankali's user avatar
0 votes
2 answers
3k views

netsystemsresearch.com on my internal network

It first started happening with the local network enabled printer. It printed out that netsystemsresearch.com was doing a search of all public networks. I stopped that by disabling outside connections ...
panosl's user avatar
  • 101
-5 votes
1 answer
65 views

Which mobile VPN type, of IPSec, SSL/TLS, and SSH, would be better for travelling workers? [closed]

Not too sure on the specifics of each that would make one better for travelling.
john's user avatar
  • 1
1 vote
0 answers
535 views

Do we need Fail2ban for VPN server?

we are using Ubuntu 20.04 LTS vps and running OpenVPN on it. We use certificate key to login to SSHD and the vps is not using any other program(eg. webserver etc). Would you recommend installing and ...
aboka's user avatar
  • 11
0 votes
1 answer
633 views

AWS - VPC traffic being dropped - how to debug Network ACL and security group?

I have an AWS VPC with two subnets: Public and Private. I can access the internet (via a NAT Gateway) from the public subnet, but not from the private subnet, and I can't work out what's wrong. Both ...
mdarwin's user avatar
  • 121
0 votes
1 answer
2k views

NACLs and NAT Gateways for public and private subnets

I have a VPC with 3 subnets: Public (FE layer, inbound internet access only) Protected (app layer, outbound internet access only) Private (DB layer, no internet access at all) The public subnet NACL ...
mdarwin's user avatar
  • 121
1 vote
1 answer
377 views

AWS: VPN between VPC and an external resource with IKEv2 and ESP

I need to set up a VPN tunnel between the VPC in AWS and an external server with content that I want to access securely. The idea is to use the Site-to-site VPN Connection with Virtual Private Gateway ...
george007's user avatar
  • 113
2 votes
2 answers
954 views

Apartment-wide single SSID / multiple password Wi-Fi network security concerns?

My apartment building is changing internet providers, and the new provider plans to install a network that will have a single SSID for the entire building. Each tenant will be given a unique password ...
bigreddmachine's user avatar
0 votes
1 answer
48 views

Would proxying ssh be insecure

If I would use something for remote port forwarding like ngrok, or Serveo: ssh -R 80:localhost:22 serveo.net Would this pose a treat to my security since there is a man in the middle? How would I ...
mvklingeren's user avatar
1 vote
0 answers
277 views

Install SMBv1 client on win10 without admin or compromising security? [closed]

This relates to Sending files from win10 to SMBv1 server? but it is broader. Feel free to edit/move/remove. Windows 10 update 1803 removes all functionality of SMBv1 unless explicitly set so by admin,...
bliako's user avatar
  • 157