Questions tagged [security]
For questions relating to application security and attacks against software. Please don't use this tag alone, that results in ambiguity. Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. If your question is not about a specific programming problem, please consider instead asking it at Information Security SE
6,823
questions
0
votes
1
answer
19
views
How to take ownership of all contents in CSC folder?
I have files that was saved as offline files from a Synology server to the CSC folder on my computer that I would like to delete. I cannot delete the files unless I individually take ownership of ...
0
votes
0
answers
27
views
Apache HTTP Server 2.4.55 - Block IP Login
Environment:
OS: Linux
HTTP Server: Apache 2.4.55
I want to block website logins provided with public IP. I have shown an example of logins with URL and IP as below. I will do the blocking using ...
0
votes
1
answer
42
views
I cannot find where 0002 umask is being set on Ubuntu 20.04
My user account has a non-standard umask setting of 0002, and I cannot find the config file where this is being set. I have searched in /etc and ~/.bash* with sudo grep -iIr umask. Running umask in ...
0
votes
0
answers
21
views
PHP-FPM + Apache2 security
I have configured my server (an Ubuntu 22.04 machine) so that it is managed by Apache (v2.4.55) and php7.4-fpm. The current configuration allows every vhosts to be divided into specific php-fpm pools, ...
- 1
0
votes
0
answers
55
views
Content-Security-Policy frame-ancestors not working
I'm running an OpenLiteSpeed server and would like to only allow webpages that start with a specific url on my site (e.g. https://example.com/video/**) to be iframed by others. (I want to allow anyone ...
- 101
0
votes
0
answers
41
views
Adding process to cgroup returns error "write error: Invalid argument"
On Red Hat 8.7 on x86_64 I would like to restrict process to be allowed to use only 50% of CPU time.
I tried to limit a process with cgroups following Red Hat tutorial
Setting CPU limits to ...
- 1
0
votes
0
answers
14
views
Security updates for linux server with only local network access
I am using Compute Engine and VPC Networks in Google Cloud Platform.
I have a "classic" frontend - backend server setup inside Google Cloud with two VPC Networks which are connected trough ...
google-cloud-platform
-1
votes
0
answers
12
views
SSH login with partially functioning DDNS
My ISP is offering a DDNS service which is not functioning as it should. Forward rDNS is not working and I'm trying to secure my server by denying all connection attempts via SSH, but allowing all IPs ...
- 1
1
vote
1
answer
64
views
(copy from Stackoverflow) Google Secret Manager- allow Compute Engine to auto-renew the certificates
Below is what I've posted at stackoverflow here that is not getting attention. I hope someone here is able to guide me to find the right answer.
I come with Azure background. In Azure, I could ...
0
votes
1
answer
28
views
How to protect Jenkins from super users?
Any super user who has access to the Jenkins running on a Linux server can easily disable security authentication from config.xml file; then log in and can also decrypt sensitive passwords from ...
bsd-boo
0
votes
0
answers
15
views
Does it make sense to have separate buckets for each service or sub-service of the application? [closed]
I am trying to write a NodeJS backend application using Amazon S3 storage. It is a microservice based application and users can upload images, videos and documents. I wanted to know does it make sense ...
- 327
0
votes
0
answers
50
views
How to stop Windows Server 2022 successful anomymous RDP logins
I have a Windows Server 2022 server with IPBAN installed to make hacking it more difficult but in the logs occasionally I see:
2023-02-20 03:59:23.5304|WARN|IPBan|Login succeeded, address: XX.XXX.XXX....
0
votes
1
answer
20
views
Permission for Users group successfully modified via code, but change is not reflected in Security tab for the Users group
I have C# code (at the end) which:
Creates a file
Prints the current ACL
Gives the builtin users group "write permissions" to the previously created file
Prints the current modified ACL
...
- 89
0
votes
0
answers
15
views
What is the proper way to configure Tripwire to handle automatic log rotations?
I installed tripwire by following this online documentation on a fresh ubuntu 22.x server. I followed the above documentation exactly and did not add any custom mods to either the cfg or the pol ...
0
votes
0
answers
26
views
sshd allows login with no authentication all accounts
This morning I was logging into an Ubuntu 18 machine that luckily we use for testing and is not on the Internet. When my SSH client got to the authentication point I accidentally hit 'ESC' which means ...
- 13
0
votes
1
answer
60
views
how to SSH to Wireguard server from Windows client with active VPN connection?
I have Wireguard server on Rocky 8.7, when I connect to the server I route all client traffic through Wireguard
this is quotes from setup script, of course all variables is set (and all works good)
...
1
vote
1
answer
50
views
EXSi Arg Server attack
I have a very basic question. From what I have read, it seems these unpatched servers were directly attacked remotely through the internet via port 427. So unlike other ransomware attacks, the malware ...
- 21
0
votes
1
answer
29
views
FortiGate Next Gen Firewall AWS security groups
I'm new to AWS using a FortiGate in front as the gateway. Would you need to utilize the security groups, or could I make one to permit all traffic and attach it since the fortigate handles everything.
- 3
0
votes
0
answers
31
views
how to use PAM auth for ssh key clients?
How to unlock ssh private keys with PAM, so I can use fingerprintd module?
There are many questions here discussing PAM and kerberos for sshd auth, but I can't find anything on the client side.
Also, ...
- 263
0
votes
0
answers
24
views
backup /home over sftp - root
My current task is to set up a (remote) backup (using rsync/rsnapshot) over sftp of /home (linux). Obviously some files are read only for the owner (ie -r-------; and should stay that way) so i guess ...
- 1
0
votes
2
answers
54
views
fail2ban - one IP banned multiple times by multiple jails - errors in log durin unbanning
I make few similar jails for different ports...
jail names: http_https_deny, dns_deny, ftp_deny, smtp_pop3_deny, ssh_deny
here firewalld and fail2ban settings for http_https_deny(other almost same, ...
1
vote
0
answers
29
views
aws guardduty some alerts won't notify on slack
I have recently setup aws guardduty with slack notification using this guide right https://medium.com/@damitj07/how-to-create-a-slack-alert-for-guardduty-49d542927529, there were a few issues with the ...
- 119
0
votes
1
answer
39
views
Debian security release
I have noticed that there is a "security" release listed in the Debian security tracer.
Some of the vulnerabilities are only fixed in the "security" release, which might be still ...
- 129
0
votes
0
answers
12
views
Updating the `/etc.ufw/before.rules` file to allow `ufw` firewall redirection
I need to Configure My Server so that the ufw firewall running on it can redirect port 8080/TCP to port 80/TCP. From quick research, I know I can do it in Two ways; one is to run a command similar to;
...
- 1
0
votes
1
answer
17
views
Native Authentication with Apache
Reading the CIS Benchmark documentation, I saw that a good practice is to disable mod_auth_basic and mod_auth_digest.
Does Apache have some native way to perform authentication that is more modern ...
- 235
0
votes
1
answer
16
views
Using old web application with outdated PHP version behind .htaccess folder protection
I probably need a web server with an outdated PHP Version (7.2.34) for an older HTML/PHP/MySQL based web application. Since it's for a manageable closed user group, I exceptionally considered using a ...
0
votes
1
answer
40
views
Carbon Black on AlmaLinux?
All:
We've been trying to prepare for the EOL/EOS for CentOS by moving to AlmaLinux 8.7. For many of our machines, we're using Carbon Black (CB) 2.14.0 for security. But VMWare/CB support is telling ...
0
votes
0
answers
29
views
CSF Deny an IP Range Exclude specific IP on specific port
I've bunch of ips / networks added to csf.deny
csf.deny
1.1.0.0/19 # do not delete
However i want to allow 1.1.1.1 on port 80 and 443 with csf.allow
csf.allow
tcp|in|d=80|s=1.1.1.1
tcp|in|d=443|s=1.1....
- 1
0
votes
0
answers
18
views
Is it valuable to do DNS Leak Testing directly from a firewall and not just from the client side?
I've been writing a tool that can be added as a package for pfSense, and essentially the tool allows you to perform a DNS leak test on any of the interfaces on the firewall appliance.
One developer I ...
0
votes
0
answers
80
views
Using PasswordAuthentication yes in sshd config but password is not accepted during login
I tried to enable password authentication in CentOS 7 only for one user - auditor, by having this lines in my sshd.config (at the end of file):
PubkeyAuthentication yes
ChallengeResponseAuthentication ...
0
votes
0
answers
25
views
Multi-Prefix (CORS Header)
How can I make this so it handles both https/http?
add_header Access-Control-Allow-Origin "https://sub.example.com";
What is happening, is specific resources rely on http traffic (//api....
- 101
0
votes
1
answer
58
views
Any security reason not to use `root` user for git remote operations?
I've got some configs (docker-compose related files) which I like to store them via git on a private github repo.
The configs are owned by root.
Is there any reason to change the ownership of the ...
2
votes
2
answers
1k
views
DigitalOcean Network Firewall allowing SSH connections on ports other than only 22
I have a droplet on DigitalOcean with IPv4 and IPv6 enabled. The droplet is behind a digital ocean network firewall with the following rules:
Inbound:
SSH TCP 22 All IPv4, All IPv6
HTTP TCP 80 All ...
- 158
0
votes
1
answer
350
views
Is it safe to close the following ports in Windows Firewall for a Windows 2022 VPS web server?
I am using a Windows Server 2022 VPS as a web server to host a website only. When the VPS was first setup for me, I saw the following ports for Inbound in Windows Firewall were already enabled (the ...
0
votes
0
answers
12
views
Tools or processes to review security questions
I'm looking for a tool or process to review external customer questions or scans against our internal database of security issues stored in Azure DevOps/TFS or Loopio. We get customer scans using ...
- 1
0
votes
2
answers
64
views
Nginx - How to return 404 if authentication headers are present?
I've got an nginx instance on the Internet that proxies an application. I would like to return 404 on any request from the Internet that attempts to authenticate to the application, as all of the ...
- 111
1
vote
0
answers
483
views
Wireguard VPN not making handshake
I'm facing a trouble, I have a server with Wireguard configured, with the keys generated by wg command line.
I've downloaded Wireguard for windows and put the public's server key on client peer, and ...
0
votes
0
answers
24
views
NGINX SSL directory and .crt and .key files permissions [duplicate]
in folder /etc/nginx/ssl/ I have public and private key for domain for wildcard SSL certificate purchased from CA and transferred as root to that folder. SSL request has made on another windows ...
- 123
0
votes
0
answers
23
views
File and Printer Sharing disable config
I disabled the File and Printer Sharing feature over the firewall on the windows server to which my abc.com website is connected. This server only hosts website and mail.
When I ping abc.com on cmd ...
-2
votes
1
answer
40
views
Windows Firewall Disabled every startup [closed]
I have an antivirus installed (Panda Antivirus) and it always worked well for me.
Everytime I startup my pc I get the notifications (screenshots below) to turn Windows Firewall ON.
I never had this ...
- 3
1
vote
1
answer
5k
views
Encryption type requested is not supported by the KDC
I am having intermittent issues with RDP'ing from a Windows 11 Enterprise PC to another Windows 11 Enterpise PC.
Both PC's are domain joined and on the same subnet.
Both PC's have a GPO applied to ...
- 113
0
votes
1
answer
122
views
Prevent VPN client from network scanning on ocserv
I have a ocserv server for VPN on a debian11 server.
One of my clients did a network scanning and service provider blocked my IP for terms of service violation.
This is 2nd time that this happened and ...
- 1
0
votes
0
answers
29
views
A certain IP keeps trying enpoints in my API such as `/.env`, `/info.php`, `/.env.production`, etc. Should I blacklist it?
I deployed my first ever internet service recently (AWS). As I expected, I started getting these "internet robots".
I noticed one in particular that keeps trying the endpoints mentioned in ...
- 101
-1
votes
1
answer
38
views
How should I design my 'public' network of an project?
I'm thinking about doing some online projects as a Developer/IT Technician, and I have some concerns regarding security.
I'm unable to host my servers locally for my project and I thought why not to ...
- 1
0
votes
1
answer
50
views
Azure Function App - Azure Defender compliance
Azure Defender on Azure has two policies for Azure Function authentication that I'm not able to implement from other azure resources that support http calls.
Function apps should have Client ...
11
votes
2
answers
3k
views
How dangerous might it be - and what performance gains may be had - by turning vulnerability mitigations off on non-Internet facing servers?
When a virtual machine Linux host server is non-Internet facing and is used exclusively on a LAN and is using a relatively well tested distribution like Proxmox, how dangerous would it be to turn off ...
- 1,131
0
votes
1
answer
45
views
Enabling Cephx In cephadm depolyment
Hello i am trying to enable cephx in my ceph cluster
i added this three lines to /etc/ceph/ceph.conf
auth_cluster_required = cephx
auth_service_required = cephx
auth_client_required = cephx
i didn'...
1
vote
0
answers
39
views
Disallow port forwarding to bypass VPN
We have a linux workstation that is used by a group of users via Internet. For security, users must connect to our private network by VPN and then can ssh to the workstation.
The job they run on the ...
- 11
0
votes
0
answers
25
views
Store API keys for our API
I'm building an HTTP API with API gateway and want to use API keys for authentication. Since they aren't supported by HTTP APIs, I plan on verifying them manually in a Lambda function.
Where would the ...
- 11
0
votes
1
answer
108
views
How to restrict local admin from disbaling or changing firewall setttings
I have a scenario, where the member servers are not able to RDP to other member servers I have managed that using local firewall rules, but at same time the local admin should not able to disable or ...
- 145