Questions tagged [security]
Security is not a product, but a process.
0
votes
0answers
22 views
How to configure ELK on one server and Filebeat on another server?
I have 2 servers with Ubuntu 18.04 :
monitoring.example.com with ELK
www.example.com with my site in production and Filebeat
Here is the configuration of the ELK server :
https://docs.google.com/...
0
votes
2answers
20 views
“docker-compose up” as root user or non-root user?
After reading some articles I'm still not sure about what user I should use to run a docker container. Are there any security concerns when running a docker container as root user? Is it ok to run ...
1
vote
1answer
25 views
Make trusted self-signed certificate not register as “self-signed” (i.e. trusted) on private network
I'm currently implementing a private Docker Registry server with nginx configured to forward https traffic securely to the running Docker Registry (i.e. docker-compose) instance on a private network (...
-1
votes
0answers
31 views
How to protect database data from DBAs? [closed]
So we have some compliance requirements around who/what can see data in a database. Ideally we'd like it only to be usable by the service that is in question -- and the user authorized to see the data ...
0
votes
0answers
13 views
Is it possible to skip main mode for IPSec communication on Windows?
On Linux, after registered several SAs (Security Associations) between a pair of Linux host, I can create communication between those two Linux hosts, i.e, communicate with ESP packets.
But on ...
1
vote
1answer
141 views
Why SSL does not work between my 2 servers?
I have 2 servers with Ubuntu 18.04:
monitoring.example.com (with ELK on a single server)
www.example.com (with Filebeat)
on the server ELK
Create directories to store SSL certificates
$ sudo mkdir ...
3
votes
1answer
37 views
Where can I find details on selinux Booleans
I'm running an openvpn server and I want to use SELinux. When it's activated I see a few "denied" events in the logs. I've used audit2allow to create a '.te' file. My question is about these lines ...
0
votes
1answer
18 views
Set security descriptor for windows server process
I would like to add a new DACL entry to the security-descriptor of windows service process. sc sdset allows to set permissions on the service for actions like start/stop/pause, but I want to set ...
1
vote
0answers
15 views
How do install CentOS 7.6 using security profiles?
Apparently CentOS 7.3's installer had a screen where you had the option of telling Anaconda to use a particular "security profile" for the install.
Is there any way to invoke this during an install ...
1
vote
0answers
14 views
Iptables / Ip6tables - a few questions
So, i was working on my iptables.
#!/bin/bash
iptables-restore < /etc/iptables.test.rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
...
0
votes
0answers
16 views
AWS - Encrypting/Decrypting sensitive consumer data - Does my workflow look secure?
I will be using AES-256 symmetric encryption VIA Open SSL. Please have a look at my workflow and let me know if it looks secure.
Encryption workflow
1: APP will encrypt data securely using Open SSL ...
0
votes
1answer
32 views
What to do instinctively when someone tries multiple vulnerable urls
I have a Symfony site running on production. Since two weeks I noticed in the logs these attempts:
GET /nmaplowercheck1557094092
GET /evox/about
GET /HNAP1
POST /sdk
GET /.env
GET /admin//config.php
...
1
vote
1answer
43 views
Google Cloud Platform firewall allow os update
I have a Virtual Machine running inside Google Cloud. The VM running ubuntu v16. The machine is running behind firewall. The traffic to this machine is restricted - no outgoing traffic allowed from ...
google-cloud-platform
1
vote
1answer
28 views
How web-hosting providers manage to make uploading files secure?
I made a small website where people can upload their files into my server.
Every member have their own folder and they can't open or show other people directories.
Their links looks like this:
...
4
votes
0answers
54 views
Dynamically set the screen lock timeout depending on network interface
We need to configure the screen lock timeout on our laptop machines so that the inactivity time
dynamically changes according to the connection: if the laptop is directly connected to the
corporate ...
0
votes
0answers
17 views
Continuous distributed SMTP auth requests for a non-existent user - any idea what the purpose is?
I have thousands of SMTP auth requests for the same non-existent user, from IP addresses mostly in Argentina. There is rarely more than one hit per IP.
The login will never work because it's not a ...
0
votes
1answer
23 views
Which apache/httpd (root or www-data) user, who load /etc/php.ini when webserver startup?
I want to secure my php ini access right.
We know that apache/httpd master process, is owned by root. Then it spawn new child process in www-data user.
If /etc/php.ini loaded by apache as root user, ...
0
votes
1answer
65 views
Why am I unable to make OCSP Stapling work with my nginx, libressl on FreeBSD 12.0-STABLE setup?
After hours of trying I have to get help for my issue.
I am trying to get OCSP stapling to work with my setup, but am not successful in doing so.
Here is my nginx configuration, without any non-...
2
votes
0answers
29 views
Shared hosting: Apache RewriteRule [P] flag security concern
I want to setup PHP-FPM with Apache in a shared hosting environment. The recommended way is to use mod_proxy_fcgi.
Each customer has his own FPM pool, running PHP processes under his own system user. ...
1
vote
0answers
19 views
mail form api security
I am working on a static site generated with hugo and want to embed an email form without using external (commercial or possibly untrustworthy) services like formspree.io (too much of a headache in ...
0
votes
2answers
47 views
Restricting a ssh key to only allow rsync/file transfer?
I have 2 servers (A & B), and I need to rsync files from A to B as root. Allowing root ssh login is possible (PermitRootLogin without-password), but I'd like to lock it down as much as possible. I'...
0
votes
2answers
45 views
How to restrict user rights on Debian?
I have a production server, which runs an web application. Now I need to grant SSH access to a developer in order for him to work on the files of the application. He already has a chrooted sFTP access,...
-1
votes
2answers
39 views
openvpn profile for connecting to palo alto
I'm trying to make an openvpn profile to connect to palo alto vpn. I know they have globalprotect for client side to connect, but it requires license. Plus, it is my understanding that openvpn ...
0
votes
1answer
54 views
ModSecurity CRS 3 - Disable SQLi Rule For URI Pattern
I am trying to disable rule 942100 (an SQLi rule) when certain values are present in the URI, but apache won't start so something is wrong.
My attempt (in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf):...
0
votes
0answers
29 views
What email headers are useful for determining if my email account has been compromised?
I've recently received a lot of spam replies (automated replies from users, and rejections from mail servers) to a certain email address. I've taken the obvious precautions of changing passwords, and ...
1
vote
0answers
78 views
How did my server get ransomeware [duplicate]
I have a simple setup. Email server,Web server IIS running on windows 2012. The site is simple static with a contact form. No uploading capability.
Today I found it was encrypted by ransomeware ...
0
votes
0answers
41 views
Blank entries in lastb
My cloud hosted Fedora box mysteriously went down this morning, and I am wondering how paranoid I need to be. The event happened Apr 21, just after 15:00 system time.
In last -x, I can see an ...
0
votes
1answer
40 views
google-authenticator codes not working while emergency scratch codes do it right
Installing google-authenticator on a Debian behind another Debian firewall in a very restricted configuration on connectivity
(NetinVM, a virtual machine constellation inside a VM)
Installation goes ...
0
votes
1answer
61 views
How to view the history of the command “passwd <username>”
I'am looking for a way to audit the history of password change for the user root (the passwd command) for a local network server.
How i can view the date and/or the time of execution this command and ...
0
votes
0answers
15 views
Securing gitlab-runner building docker images
I want to build docker images on a gitlab-runner and therefore need some kind of access to a docker daemon from the CI job. My question in short is: How can I isolate the CI jobs from the system so ...
0
votes
0answers
39 views
Would this setup provide adequate security?
In the following scenario, I'm looking to see if I can provide adequate security as is or if there would be any tangible benefit to re-architecting things (like changing it so that the service in ...
0
votes
1answer
35 views
GPO Security setting Wired Network (IEEE 802.3) Policies
My question is regarding group policy security setting (Wired Network (IEEE 802.3) Policies). When I set this setting I cannot see any file generated to store these settings in SYSVOL\sysvol\...
0
votes
1answer
34 views
Difference Between Running as root or a Service Account With a sudoers file entry
I have an evolution of an Earlier Question.
Main Question: What are the meaningful differences between running a program as root, vs. via service account with a sudoers file entry?
I have to deploy ...
1
vote
1answer
19 views
Allow only Angular application to access Node application (Same EC2 instance)and block Node for everybody else
I have hosted both my angular(port no 4200) and node application(port no 3000) on the same EC2 instance.
Both are currently accessible to anyone.
I want to limit access to the Node application so that ...
0
votes
0answers
154 views
How to Disable diffie-hellman-group14-sha1 for opensshd
This sounds like it should be an easy process, especially for those looking at How To Disable diffie-hellman-group1-sha1 for SSH 2, yet somehow it is not.
From my /etc/ssh/sshd_config file, I have:
...
0
votes
0answers
39 views
AWS: Cross Account Access, VPC Endpoint and Preventing Presigned URLs
In an AWS Organization, we have multiple accounts, each account having its own S3 buckets. Some buckets are required to support cross-account sharing.
It is possible to write an endpoint policy that ...
-1
votes
1answer
41 views
Am I under ddos attack ? Many random requests (usually to images)
Do requests like these look like a DDOS attack ?
180.157.250.126 /9301451791bb460e8a5aec3e123884ba.jpg <<< match
180.157.250.126 /b29a2302afd6dfd918a2b7c3b6a05e31.jpg <<< match
183....
0
votes
1answer
31 views
Seeing my public IP when doing ipconfig command
A bit convoluted question, but i'll do my best to explain the situation.
I have an ISP issued router/modem. But whenever I check for my IP address on my PC, i get my public address. Furthermore, with ...
0
votes
0answers
35 views
Disable PHP stack traces in Apache logs?
I've run across an in-house PHP application which occasionally crashes during user authentication and dumps a stacktrace into /var/log/apache2/. Problem is it logs the username and pass in cleartext.
...
0
votes
1answer
52 views
validating virtual machine host automatically with fingerprint and something else
validating virtual machine host automatically with fingerprint and something else
I've been researching various methods to validate a remote ssh server (virtual machine) automatically and remotely. ...
0
votes
0answers
6 views
How to make a Azure WebApp accessible only from another WebApp
I have a 2 apps in the same AppService. One is front end app written in a JS framework and the other is an API/FuncionApp. Since the client is JS based I would prefer to not introduce code like ADAL....
0
votes
0answers
38 views
Unattended-upgrades will secure all my programs?
I'm on debian 9
If I have set my apt to automatically update with unattended-upgrades (only security updates), will I have my softwares fixed automatically, or it's not enough?
Example with:
https:/...
-1
votes
1answer
40 views
Does having a URL that contains (and displays) a port can lead to some security risks?
I have a server that contains Filemaker Server on port 80/443 and a website on port 1111.
By creating a DNS for the website, I have the url https://mydns.xx:1111/.
Showing the port is not really a ...
-1
votes
3answers
91 views
Server Permissions allowed hacker to execute scripts [closed]
I got hacked yesterday, and for some reason i think this thing I've been doing on my servers over and over might have some disadvantages, Might this question be deprecated but i need simple answer as ...
1
vote
2answers
139 views
How to patch Apache 2.4.18 on Ubuntu 16.04 LTS?
I am running Apache 2.4.18 on an 16.04 server. Is this version patched through Ubuntu apt-get upgrade? I was ready about some security issues, but the upgrade command will not upgrade Apache.
rex:~$ ...
0
votes
1answer
78 views
Dovecot Private User Login
Is it possible to set up Dovecot in such a way that I can set up a "private" username that is associated with a public email address? For instance:
Email address : email@domain.com
Login username: ...
0
votes
1answer
49 views
Implementing HTTPS - Rproxy Behind Firewall
We have a small managed infrastructure at our workplace.
The network in its simplest form:
Internet (no-ip for DNS) >> (public ip) Firewall (private ips 192.168.X.X/24(NAT)) >> Reverse Proxy >>> Web ...
0
votes
0answers
43 views
Is sudoers entry With NOPASSWD a Security Risk? If So, How Can I Address This?
I'm currently looking to roll-out a 3rd party software agent to my client's linux server infrastructure. The agent will run on startup and shutdown, and one of the pre-requisites for the agent to run ...
-1
votes
1answer
32 views
How to prevent code injection/swap for a windows service?
Heyo!
As part of our product, we have an on-premise installer on our client's servers that interacts with their database. We’re currently in the process of transforming it into a windows service. We’...
1
vote
2answers
82 views
Physical security for Servers [closed]
I work in a non-profit and we need to upgrade the physical security around our new servers and DC. We can't secure the entire room, and we can't afford to purchase a proper server rack. The workaround ...
