Questions tagged [security]
Security is not a product, but a process.
6,738
questions
0
votes
1
answer
17
views
Will Disabling All Non-256-bit Cipher Suites Cause An Issue?
I want to disable some risky cipher suites (especially for TLS 1.1 and 1.0) which are 128-bit, in order to achieve a more secure server in Windows. But these cipher suites may be used by some client. ...
- 101
0
votes
0
answers
6
views
Figure out ways to forward traffic through proxy for Home network from external 3rd party
I noticed all my traffic goes through one ip address which seems a proxy and this proxy is not set up neither by me or my provider (I contacted them on this issue). I want to figure out who and how ...
- 1
-1
votes
0
answers
13
views
What are appropriate permissions for developer computers taking advantage of what we learned over the last 20 years? [closed]
If you go trying to find the best way to balance security considerations against the flexibility developers require to do their jobs, regardless how carefully you try to phrase your search, all the ...
2
votes
0
answers
44
views
Is it possible to use MTA-STS in Postfix without overriding DANE?
The SMTP MTA Strict Transport Security RFC 8461, 2 clearly states that:
However, MTA-STS is designed not to interfere with DANE deployments
when the two overlap; in particular, senders who implement ...
- 42k
0
votes
1
answer
13
views
Openvpn and routing for outside
I installed openvpn on my router. Everything works great. But, when the tunnel is up, my router is no longer accessible from the outside (I have a "white" dedicated address). Packets get to ...
- 1
-1
votes
0
answers
21
views
BIND9 installed on CentOs security points
Hope you all doing Well.
Actually we are running a DNS servers on CentOs using BIND9, they are recursive/authoritative.
My question is any way to filter/Stop/Limit DNS query based types like (TXT, ...
11
votes
2
answers
3k
views
What are the downsides of reboot-to-restore software in a corporate environment?
I work in a small IT department in a medium-sized enterprise (up to 200 users). Thanks to home office and our growing field workforce, it has become more challenging to supervise and manage our client ...
- 113
-1
votes
0
answers
34
views
Is it ok for a webserver to be a member of a domain?
For security reasons, I'm moving my webserver to its own VLAN.
Is it safe to keep it as a domain member (with all the right firewall rules) or should it be a standalone server?
- 507
0
votes
1
answer
18
views
Can I add "firewall rules" to an AWS VPN connection?
i need to connect a couple of customers to an AWS VPC via VPN. requirements:
no customer may send data (or best: even "see") another customer
they should only be able to "see" ...
- 183
0
votes
0
answers
11
views
Windows 11 is not storing network credentials when accessing azure files or RDP server [migrated]
My Windows 11 machine (part of a domain) does not store network passwords/credentials. This happens when i try to connect to an azure file share (using windows explorer) or when i connect to a server ...
- 154
0
votes
0
answers
14
views
Security Headers X-XSS-Protection issue
Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ?
Header set Strict-Transport-Security "max-age=10886400;
Header set X-XSS-Protection "1; ...
- 1
-1
votes
0
answers
15
views
SmartCard PIN policy - minimum age requirement possible?
I am using a Thales Safenet IDPrime Smartcard MD930.
The middleware (Safenet authentication client tools 10.8 R6) allows to set PIN policies for complexity, minimum length and maximum age. However, ...
0
votes
0
answers
59
views
Odd TLS Error when using curl on origin server x.509
I am hoping someone can help explain what is happening in this situation..
As of now, I have a domain from google domains and I am using cloudflare for my DNS management. I am not using any TLS/SSL ...
0
votes
0
answers
54
views
Intune managed installer blocked by WDAC
I'm trying to install applications via intune, but WDAC blocks the installers. For example:
Code Integrity determined that a process
((\Device\HarddiskVolume3\Windows\System32\msiexec.exe)
attempted ...
- 1
1
vote
1
answer
35
views
Are security updates applied with `dnf update` or is it separate procedure in Linux?
I found this vulnerability with polkit. It was found in Jan 22. How does keeping Linux updated security wise works in general?
If I run dnf update on CentOS9 - will it fix it? Or shall I look into ...
- 702
0
votes
0
answers
18
views
Hosting a script from CodeCanyon on my own server. How can the original developer see my script?
I bought a PHP script on CodeCanyon from a well reviewed user and a 5-star script and installed it on my own server with the intention of modifying it for my own use (complies with the license). ...
- 13
0
votes
1
answer
20
views
QEMU/KVM: how to protect monitor access?
Runing QEMU/KVM with monitor: kvm ...some_parameters... -monitor unix:/my_path/my_fifo,server,nowait
We can then connect using socat - UNIX-CONNECT:/my_path/my_fifo then type commands.
Easy and handy.
...
- 1,727
0
votes
0
answers
31
views
Postfix seems to ignore mynetworks?
I have a site, which relays automated emails from external system to pass on via authenticated SMTP of our provider.
Recently the external system went haywire and started to generate hundreds of ...
- 533
0
votes
0
answers
9
views
Run `docker scan --login` with HTTP connect proxy
How to run docker scan --login with corporate proxy? Do I really have to install Snyk with npm?
What have I tried?
Register and login with Google account on https://app.snyk.io/login?cta=sign-up&...
- 494
0
votes
1
answer
27
views
Alert when Admin logs into Azure
I setup an Office365/Azure tenancy for a small charity I help.
I am keen to setup automated reporting that sends an email when someone logs in as an admin account (i.e with a particular role or group)....
- 1
0
votes
1
answer
35
views
Best practices for malware scanning on Ubuntu servers in production [closed]
There are multiple malware/rootkit scanning packages for ubuntu such as clamAV, rkhunter etc. I know how to use them manually but for multiple servers in production environment I could not find a ...
- 1,341
0
votes
0
answers
25
views
ALB instead of Cloudfront in front of single server web app
AWS Recommends adding cloudfront in front of single server applications for security and performance see https://aws.amazon.com/blogs/networking-and-content-delivery/dynamic-whole-site-delivery-with-...
- 1,341
0
votes
0
answers
28
views
Apache HTTP Header - Security and Understanding
I have now read through the handbook of Apache and tips in online forums. But unfortunately I don't understand it at all.
https://httpd.apache.org/docs/current/mod/mod_headers.html
The optional ...
0
votes
2
answers
22
views
How to track specific logs in Ubuntu? (CPU)
We have this EC2 instance: T2.medium, running apache, with 4 virtual hosts (4 sites).
Sometimes, out of nowhere, the CPU reaches very high levels, maybe an attack.
I've seen some of our wordpress ...
- 1
3
votes
1
answer
37
views
OpenVPN server - does dropping previleges affect accessing files at runtime?
In OpenVPN's hardening article, it is recommended that the server daemon drop its privileges after startup on Linux:
OpenVPN has been very carefully designed to allow root privileges to be dropped ...
- 165
0
votes
1
answer
32
views
pgcrypto and password hashing
I'm thinking about my choices regarding how to store passwords in Postgres.
One such option is to use pgcrypto. Reading their docs, I see that their crypt and gen_salt functions do not use sha256 but ...
0
votes
0
answers
51
views
Logging on Windows with user accounts in Protected Users group over VPN
I am planning implementation of Microsoft’s Active Directory tier administrative model, and I was wondering how to overcome the problem of system administration over VPN. One of the security ...
- 243
-1
votes
2
answers
60
views
The Importance of Paying for SSL Certificate [closed]
Is It really compulsory to pay for ssl Certificate while setting up website? What are the advantages and disadvantages?
Thank you.
0
votes
3
answers
49
views
How to safety delete a package/software which wasn't installed via package manager
I have an old Ubuntu Linux 20 install. I recently found that I have a bunch of software that I installed before I started fully using package management and I can't remember the details of the ...
- 109
0
votes
1
answer
26
views
How to get DDOS+WAF protection on IP/server (not domain)
I've used CloudFlare and it's great.
But in this specific case we control the server IP address but we don't own the domain so can't use CloudFlare unfortunately because the domain owner isn't ready ...
- 131
3
votes
1
answer
418
views
Why does a MS GPO option break SMB shares that use a hosts file for the machine name?
We've set "Microsoft network server: Server SPN target name validation level" to "Required from client" on our test GPO.
Our test systems have some custom machine aliases in their ...
- 133
1
vote
1
answer
44
views
How to allow user to run only specific binaries
I'm adding user logviewer with /sbin/nologin/ and to my system.
My custom service is running eg. sudo -u logviewer less --follow-name /var/log/messages.
But still there are ways to run other command ...
- 121
0
votes
0
answers
46
views
SSL for IoT local network
How to implement the valid SSL for a local network without internet access?
I am developing an IoT device that exposes its own access point and shows a web page for configurations. The webpage is ...
- 1
0
votes
0
answers
20
views
.httaccess broken - Too many redirects
So basically I broke the .httaccess and I dont know how to make it work again. All I wanted to remove was a dot which was showing after my domain, it had such symbols like /\ or / instead of just / in ...
0
votes
1
answer
23
views
Is it safe to use Internet-facing RDP in combination with IP-whitelisting on Windows Firewall?
I am using a VPS that I connect to using RDP over the internet. Since I was experiencing an incessant stream of brute force attacks on the RDP, I configured the windows firewall to only allow certain ...
0
votes
0
answers
28
views
Xen hypervisor: What does the acronym RMRR mean in "(XEN) [VT-D] It's risky to assign" ... "with shared RMRR at"? What are the risks?
I'm running Qubes-OS 4.1.0
While looking through the /var/log/xen/console/hypervisor.log I stumbled over the following messages:
...
(XEN) [VT-D] It's risky to assign 0000:00:14.0 with shared RMRR at ...
- 609
0
votes
1
answer
69
views
Is it necessary to ban malicious IP regardless of default firewall setting being deny/reject?
I'm on Linux and using fail2ban as the ban system. So far, it has collected and banned about 150K of malicious IPs, and I'm concerned and wondering if this will gobble a fair amount of resources. As I ...
- 1
0
votes
0
answers
35
views
Using iptables for SSH brute force protection
10: Limit new TCP connections per second per source IP
53 /sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
54 /sbin/iptables -A INPUT -p tcp -...
0
votes
2
answers
103
views
block nginx connection after multiple 404 s on same tcp connection
I'd like to protect two servers against attackers who blindly probe for urls.
my idea is to block requests after a certain amount of 404 status codes.
I could do this with fail2ban.
However one of the ...
- 203
0
votes
0
answers
25
views
Protect staging / pre-prod environments
I'm trying to secure some microservices environments. The problem is about distributed services, because some of them are SaaS products or in different clouds, serverless, PaaS, Kubernetes and so on.. ...
- 169
0
votes
0
answers
18
views
pam_limits(systemd-user:session): invalid line '*hard nofile 999999999999' - skipped
I am getting these errors from journalctl:
pam_limits(systemd-user:session): invalid line '*hard nofile 999999999999' - skipped
pam_limits(systemd-user:session): invalid line '*soft nofile ...
- 1
0
votes
0
answers
22
views
Check computers on network for core isolation
Trying to find best method for checking all domain computers for core isolation being enabled. We have been slowly enabling this as new machines are deployed, but I would like to expedite the ...
- 21
1
vote
1
answer
136
views
Why enabling _only_ TLSv1.3 is a bad idea?
I have NGINX configured to only support TLS version 1.3
However when I go to https://check-your-website.server-daten.de/
It shows the error
Error creating a TLS-Connection: TLSv1.3 found, but no ...
- 15
0
votes
2
answers
39
views
Cloud Run / Secret Manager Free Tier
I'm using Cloud Run for the backend of a project I'm working on, in part due to its generous free tier (2 million requests per month, free). But the services require some secret values (database ...
google-cloud-platform
0
votes
0
answers
22
views
Azure AD Conditional Access Policy - Require Security Key as Multifactor
I am exploring the Security options for user signin ( specifically admin signin ) to Azure Portal and other Azure App and my requirements is specifically that the user should enter the password and ...
- 101
0
votes
0
answers
17
views
How to pass variables inside docker container to application securely?
An application inside a docker container is a required connection for external PostgreSQL DB. How can I pass variables inside the docker container for this application securely? I have in the file ...
0
votes
1
answer
68
views
How to prevent query string accessing attempts like /?hfsagrs=XXX
I am a new site owner and do not have so much traffic, but recently my NGINX access logs are flooded with requests as shown in this picture below.
I have attempted to block access with the pattern \?.*...
- 15
18
votes
9
answers
3k
views
root login or sudo user for server administration?
I'm trying to understand the technical arguments/security implications between ssh'ing with root directly, or making an auxiliary sudo user in the context of maintaining a server. To clarify, we're ...
- 183
0
votes
1
answer
53
views
I used ssh-keyscan to automatically allow fingerprints in production environment. whether it is good
Is there is any options to revert the mentioned action. whether it will cause any security breaches?
- 11
0
votes
0
answers
70
views
Can Squid be configured to block URLs that specify an IP address instead of a host name?
I have a non-transparent Squid proxy (v5 running on Ubuntu 20.04) which serves as a gateway from my private network to the internet. In the network there's a victim machine for malware analysis, and ...
- 101