Questions tagged [security]
Security is not a product, but a process.
2
votes
0answers
10 views
Is there any documentation or discussions regarding capacity limits on firewalld ipsets on Linux? [on hold]
I have been using firewalld on Linux with a single ipset. It appears after exceeding a certain threshold regarding IPv4 rule count, the CPU utilization during rule updates (additions) goes through the ...
-1
votes
1answer
27 views
How do I do traceroute/tracepath without any admin privileges?
Basically, I need to "trace a packet from my computer to the host" to diagnose a network issue and I do not need any fancy additional functionality.
Redirect me to the right place if this is not the ...
1
vote
1answer
19 views
How to prevent PHP on a virtualhost/website from writing to another virtualhost's/website's directory on the same Apache server?
I want to prevent virtualhost #1 from writing or reading to virtualhost #2 without losing writing access to the www-data at all (because the applications need to write to the directory).
My current ...
-2
votes
0answers
19 views
adding corporate email to personal adroid phone . gmail is being asked to send account info to autodiscover [on hold]
I figure system admins would know... I get this message when adding my employers exchange account to my personal android cell phone.
gmail is being asked to send account info to autodiscover....
0
votes
1answer
10 views
EC2 Windows server recovery options if disconnected from domain
So, I have these Windows 2016 servers. Everything is domain joined.
They are running in Amazon EC2.
I'm doing some system hardening, using recommendations from CIS. (For reference, the PDF is titled ...
1
vote
1answer
25 views
Sign a document and verify Date of signature (openssl)
First off: openssl's options make my head spin :)
I have a file that I want to sign (foo.doc), and at some point in the future I want to prove the date/time the file was signed. How do I do this?
I ...
31
votes
2answers
5k views
Ctrl + Alt + Del prior to Windows 10 logon no longer needed?
I was running Windows 7 at work; power up the desktop pc and always had to hit Ctrl + Alt + Del before entering your username and password.
I am now running Windows 10 at work, Windows 10 ...
2
votes
0answers
25 views
Email server security [on hold]
I am writing an email server from scratch. (For learning and also eventually replace my gmail). I have no plans to send via this server (only for receiving email). My goal is to not miss any non spam ...
1
vote
1answer
26 views
Fixing Cisco Umbrella Root CA Filtering on OpenVPN
I have a personal VPN running OpenVPN 2.3.10 on ubuntu 16.04 that I installed following this guide. It has worked with a few hiccups over the last two months of intermittent use.
Yesterday, I ...
0
votes
1answer
32 views
Updating Expiring Keys - Azure OS Disk Encryption
Whilst day dreaming at my desk this morning, something occurred to me and I have not been able to find an answer of yet. So I am hoping someone may shine some light for me or just have a good ...
0
votes
1answer
15 views
Is it possible to disable in NFS showing name of shared folder?
I have NFS server 192.168.1.1 and two client servers 192.168.1.2 and 192.168.1.3. On nfs server I have one shared nfs folder
/etc/exports:
/nfsshare 192.168.1.2(rw,sync,no_root_squash,no_all_squash)
...
-1
votes
0answers
17 views
How do I create secure containers/jail for users connected to my server?
I'm creating a hacking game where real commands are ran on a server in the cloud by multiple users. Think like CTF games. I would like every user who connects to be contained within their own jail. ...
0
votes
1answer
11 views
Wildfly Cluster w/S3 Ping and IAM Instance Role?
I've successfully managed to deploy a Wildfly cluster in AWS, using the jGroups S3_Ping functionality rather than the normal broadcast method. However, all of the documentation I've seen requires me ...
0
votes
0answers
11 views
sssd certificate_verification is not working
In Ubuntu and RedHat I am using sssd to let user login through OpenLDAP Server. Users are trying to login to the sssd client using ssh and sssd in tern sending the user's credential to OpenLDAP. The ...
0
votes
1answer
58 views
Convenient way to dump Azure SQL DB database
Using geo-replication is a nice way of duplicating data but it requires the two servers to be registered on the same Azure account. That could be a potential security risk if an employee decides to ...
0
votes
1answer
26 views
iptables and limit requests per IP per minute
I'm running Debian and iptables and are trying to limit users to accept my site more than 10 times per minute.
This is my original attempt:
# Max connection in seconds
TIME_PERIOD=60
# Max ...
0
votes
0answers
23 views
Security Scan causing weird logs
So some time ago, I coded a website(PHP) and wanted to check for common web security vulnerability. I used Nessus and Burp Suite to scan for vulnerabilities in my website. The scan result showed no ...
1
vote
1answer
34 views
How to export GPG key without user interaction?
I use GPG keys to encrypt backups with duplicity, so I would like to export the key after it is generated, so I can move it to a backup location in case the server burst into flames.
Is there any way ...
0
votes
0answers
30 views
Netstat showing python services listening to multiple ports
In my search to reduce the vulnerabilities of a server, I used netstat to check which ports are listening and stumbled upon a cascade of python services listening to a large number of ports, as shown:
...
0
votes
0answers
26 views
API from internal network does not resolve from AWS Virtual Machine
I am struggling to connect and resolve an API URL on our DMZ Server
The network diagram is found below
https://imgur.com/qHhwUgK
whats done so far
My website is hosted on AWS
AWS can connect to DMZ ...
-2
votes
0answers
23 views
Can a third party intercept or view nginx access logs?
Can a third party intercept or view nginx (or any other webserver) access logs? If so, how would they do it, and if not, why not? By 3rd party, I mean someone without access to the server.
I'm ...
0
votes
0answers
39 views
Enterprise customer seems to remove or break HTTP headers
Our web application makes HTTP requests to our API hosted on the same domain as the app assets. We use JWTs for authentication (encrypted token attached in a HTTP header included with every API ...
0
votes
1answer
23 views
Ensuring SSH Idle Connection TimeOut
In response to ClientAliveInterval and ClientAliveCountMax restrictions server side, a client can choose to send null packets by setting ServerAliveInterval and ServerAliveCountMax values ...
3
votes
1answer
40 views
What happens when someone gets to know the secret key (of the web server / a CA)?
basically, I have three questions and I would be grateful for a brief explanation of the differences in the consequences of these thefts:
What happens when someone gets to know the secret key of the ...
1
vote
1answer
25 views
Revoke ex-clolaborator's access to ubuntu server
I have an ubuntu server with django website named hello running on it.
This is how I created user access here:
mkdir /hosting/hello
groupadd --system hosting
useradd --system --gid hosting --shell /...
-1
votes
2answers
58 views
Can a web server be left to work alone without constant monitoring on it?
Does a web server need to be monitored all the time even after securing it and updating it, or can i leave it to work alone after doing that ??
1
vote
1answer
12 views
Why the 'uptime' command showing the load output faster than the 'w' command
Why the 'uptime' command showing the load output faster than the 'w' command. I am unable to use the 'w' command in high load environment but the 'uptime' shows the results more faster..
0
votes
1answer
28 views
Fail2ban mail customisation
I didn't find where to customise the fail2ban mail messages, i want to change the subject.
i know i need to see the action hook like this :
action_mwl = %(banaction)s[name=%(__name__)s, port="%(...
0
votes
1answer
26 views
Configure Kibana web page (only) to require a login
I have Elasticsearch 6.4.3 and Kibana 6.4.3 installed on Debian 8 Jessie.
I've looked into X-Pack and Shield, which both seem to be mostly concerned with security within Elasticsearch, and how to ...
1
vote
1answer
40 views
Systemd PrivateTmp=true security implications
I monitor the available disk space on Ubuntu servers using Nagios Core, NRPE and check_disk.
With previous Ubuntu versions, I used to get an output similar to this:
DISK OK - free space: / 43754 MB (...
1
vote
1answer
19 views
Get internal data from an external server
I don't know if this is the right forum.
Let's say I have an SQL Server on my internal network. Let's also say I have an external web server that's not on the same network but I want it to be able to ...
20
votes
1answer
2k views
How do you check if a hard drive was encrypted with software or hardware when using BitLocker?
Due to the recent security findings in that probably most SSDs implement encryption in a completely naive and broken way, I want to check which of my BitLocker machines are using hardware encryption ...
1
vote
1answer
25 views
Analysing AWS Cloud Trail logs to get security insights
I have enabled the cloud trail logs and I get the logs to my graylog system. Now how can I do analysis on the following use cases:
What if same user is trying to login and using from different Source ...
-1
votes
1answer
35 views
Aws root user MFA - Entity does not exist
I am trying to setup MFA for my root aws user and I am presented with the following error message after I have selected Virtual MFA device
Entity does not exist One of the entities that you ...
0
votes
0answers
18 views
Redirect port 8888 on zone public to be redirected to same port on zone “external” and IP address 127.0.0.1
I've an application which is running locally on 127.0.0.1 and port 8888 in addition to openvpn which is installed and using eth1 interface
The active zones on firewall firewall-cmd:
public (...
1
vote
2answers
59 views
Good Reasons for Not Disable the Windows SMB Service by Default?
Apart from File Sharing what are good reasons to not disable the Windows SMB service by default on a corporate environment?
This protocol seems to have a lot of security vulnerabilities and been ...
-1
votes
1answer
29 views
Is it possible to assign a reserved IP to an azure web app for outbound traffic
I have 3 Azure web apps, one being an API app that makes API calls out to a client network. They need to add for security reasons one known reserved (owned exclusively) IP address. Can this be done ...
1
vote
1answer
36 views
pam_tally2 incrememts before password for su attempts
There is a similar behavior here but I believe this is a different underlying cause, or at least requires a different solution since this failure isn't due to SSH keys.
Our company is undergoing a ...
0
votes
0answers
23 views
Does bind-mounting /home in containers impose security issues?
I have some containers (systemd-nspawn) on a server. For our internal users, having their /home mounted in the containers is convenient. I wonder, however, whether this can reduce security. E.g. if an ...
0
votes
0answers
25 views
What is best practice for storing local repo managed by Bitbucket Server?
We have Bitbucket to Manage our source for Version control and Access control. My problem is the folder where all the source files are is just sitting on the 'C' drive. Is there a better/ more secure ...
0
votes
0answers
50 views
How can I be more confident that my web server is safe from outside attacks?
How can I be confident that my web server is safe from common outside attacks?
The other day I ran across Mozilla Observatory, which is a tool that gives developers an imperfect grade for the ...
2
votes
0answers
17 views
AWS ElasticSearch on private subnet - safe to have no signed url/access policy?
I have an ES cluster setup within our VPC and attached to one of our private subnets. It's also attached to a security group allowing access from particular instances. I have the following policy ...
5
votes
1answer
126 views
How to test if ssh server allows passwords?
I want to test whether or not an ssh server allows passwords and immediately close the connection without actually attempting a login.
Something like this:
allows_password=$(ssh --some-option ...
0
votes
1answer
54 views
Are Active directory DNS records being public a security concern
For particular reasons, facing situation where all Active Directory DNS records like
_ldap._tcp.pdc._msdcs.foo.com
will be public, i.e not hosted only on internal DNS.
Naturally, relying on the ...
0
votes
0answers
40 views
How do you protect SharePoint data from terminated employees?
Background:
(not required for question, but might offer some perspective)
I work for a textile design company, with 40 % of all our computers consisting of Macs. The company has approx. 250 ...
0
votes
1answer
53 views
mysql logs showing strange attempts at getting access to mysql server potentially. If so, How to determine source? [closed]
Does the below indicate a security threat? If so, how can I block it?
2018-10-25T18:54:50.549213Z 217151 [Note] Access denied for user 'root'@'localhost' (using password: YES)
2018-10-25T18:54:50....
0
votes
1answer
50 views
Testing cipher suite of Apache
While I was searching related questions, I saw this:
https://superuser.com/questions/109213/how-do-i-list-the-ssl-tls-cipher-suites-a-particular-website-offers
I tried working on the solutions ...
0
votes
0answers
22 views
How to find the origin of event 4625 in Windows Server 2008 R2 Security log?
We have Windows Server 2008 R2, to which something presumably is trying to bruteforce password for Administrator and Администратор accounts.
There are a lot of 4625 events in Security log, like this:
...
0
votes
1answer
20 views
How can I globally drop docker container capabalities?
I'd like to force all docker containers to drop particular capabilities.
But configuring docker daemon /etc/docker/daemon.json in this way fails:
{
"cap_drop": ["SYS_CHROOT", "SETFCAP", "SETPCAP"...
0
votes
1answer
75 views
Apache serving content from other domains?
I recently noticed the following messages in Apache's access log:
"GET http://api.ipify.org/ HTTP/1.1" 200 251
"GET http://boxun.com/ HTTP/1.1" 200 251
"GET http://www.epochtimes.com/ HTTP/1.1" 200 ...
