2022 Developer Survey is open! Take survey.

Questions tagged [security]

Security is not a product, but a process.

Filter by
Sorted by
Tagged with
0 votes
1 answer
17 views

Will Disabling All Non-256-bit Cipher Suites Cause An Issue?

I want to disable some risky cipher suites (especially for TLS 1.1 and 1.0) which are 128-bit, in order to achieve a more secure server in Windows. But these cipher suites may be used by some client. ...
user avatar
  • 101
0 votes
0 answers
6 views

Figure out ways to forward traffic through proxy for Home network from external 3rd party

I noticed all my traffic goes through one ip address which seems a proxy and this proxy is not set up neither by me or my provider (I contacted them on this issue). I want to figure out who and how ...
user avatar
  • 1
-1 votes
0 answers
13 views

What are appropriate permissions for developer computers taking advantage of what we learned over the last 20 years? [closed]

If you go trying to find the best way to balance security considerations against the flexibility developers require to do their jobs, regardless how carefully you try to phrase your search, all the ...
user avatar
2 votes
0 answers
44 views

Is it possible to use MTA-STS in Postfix without overriding DANE?

The SMTP MTA Strict Transport Security RFC 8461, 2 clearly states that: However, MTA-STS is designed not to interfere with DANE deployments when the two overlap; in particular, senders who implement ...
user avatar
0 votes
1 answer
13 views

Openvpn and routing for outside

I installed openvpn on my router. Everything works great. But, when the tunnel is up, my router is no longer accessible from the outside (I have a "white" dedicated address). Packets get to ...
user avatar
  • 1
-1 votes
0 answers
21 views

BIND9 installed on CentOs security points

Hope you all doing Well. Actually we are running a DNS servers on CentOs using BIND9, they are recursive/authoritative. My question is any way to filter/Stop/Limit DNS query based types like (TXT, ...
user avatar
11 votes
2 answers
3k views

What are the downsides of reboot-to-restore software in a corporate environment?

I work in a small IT department in a medium-sized enterprise (up to 200 users). Thanks to home office and our growing field workforce, it has become more challenging to supervise and manage our client ...
user avatar
-1 votes
0 answers
34 views

Is it ok for a webserver to be a member of a domain?

For security reasons, I'm moving my webserver to its own VLAN. Is it safe to keep it as a domain member (with all the right firewall rules) or should it be a standalone server?
user avatar
  • 507
0 votes
1 answer
18 views

Can I add "firewall rules" to an AWS VPN connection?

i need to connect a couple of customers to an AWS VPC via VPN. requirements: no customer may send data (or best: even "see") another customer they should only be able to "see" ...
user avatar
0 votes
0 answers
11 views

Windows 11 is not storing network credentials when accessing azure files or RDP server [migrated]

My Windows 11 machine (part of a domain) does not store network passwords/credentials. This happens when i try to connect to an azure file share (using windows explorer) or when i connect to a server ...
user avatar
0 votes
0 answers
14 views

Security Headers X-XSS-Protection issue

Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ? Header set Strict-Transport-Security "max-age=10886400; Header set X-XSS-Protection "1; ...
user avatar
-1 votes
0 answers
15 views

SmartCard PIN policy - minimum age requirement possible?

I am using a Thales Safenet IDPrime Smartcard MD930. The middleware (Safenet authentication client tools 10.8 R6) allows to set PIN policies for complexity, minimum length and maximum age. However, ...
user avatar
0 votes
0 answers
59 views

Odd TLS Error when using curl on origin server x.509

I am hoping someone can help explain what is happening in this situation.. As of now, I have a domain from google domains and I am using cloudflare for my DNS management. I am not using any TLS/SSL ...
user avatar
0 votes
0 answers
54 views

Intune managed installer blocked by WDAC

I'm trying to install applications via intune, but WDAC blocks the installers. For example: Code Integrity determined that a process ((\Device\HarddiskVolume3\Windows\System32\msiexec.exe) attempted ...
user avatar
1 vote
1 answer
35 views

Are security updates applied with `dnf update` or is it separate procedure in Linux?

I found this vulnerability with polkit. It was found in Jan 22. How does keeping Linux updated security wise works in general? If I run dnf update on CentOS9 - will it fix it? Or shall I look into ...
user avatar
0 votes
0 answers
18 views

Hosting a script from CodeCanyon on my own server. How can the original developer see my script?

I bought a PHP script on CodeCanyon from a well reviewed user and a 5-star script and installed it on my own server with the intention of modifying it for my own use (complies with the license). ...
user avatar
  • 13
0 votes
1 answer
20 views

QEMU/KVM: how to protect monitor access?

Runing QEMU/KVM with monitor: kvm ...some_parameters... -monitor unix:/my_path/my_fifo,server,nowait We can then connect using socat - UNIX-CONNECT:/my_path/my_fifo then type commands. Easy and handy. ...
user avatar
0 votes
0 answers
31 views

Postfix seems to ignore mynetworks?

I have a site, which relays automated emails from external system to pass on via authenticated SMTP of our provider. Recently the external system went haywire and started to generate hundreds of ...
user avatar
  • 533
0 votes
0 answers
9 views

Run `docker scan --login` with HTTP connect proxy

How to run docker scan --login with corporate proxy? Do I really have to install Snyk with npm? What have I tried? Register and login with Google account on https://app.snyk.io/login?cta=sign-up&...
user avatar
  • 494
0 votes
1 answer
27 views

Alert when Admin logs into Azure

I setup an Office365/Azure tenancy for a small charity I help. I am keen to setup automated reporting that sends an email when someone logs in as an admin account (i.e with a particular role or group)....
user avatar
  • 1
0 votes
1 answer
35 views

Best practices for malware scanning on Ubuntu servers in production [closed]

There are multiple malware/rootkit scanning packages for ubuntu such as clamAV, rkhunter etc. I know how to use them manually but for multiple servers in production environment I could not find a ...
user avatar
  • 1,341
0 votes
0 answers
25 views

ALB instead of Cloudfront in front of single server web app

AWS Recommends adding cloudfront in front of single server applications for security and performance see https://aws.amazon.com/blogs/networking-and-content-delivery/dynamic-whole-site-delivery-with-...
user avatar
  • 1,341
0 votes
0 answers
28 views

Apache HTTP Header - Security and Understanding

I have now read through the handbook of Apache and tips in online forums. But unfortunately I don't understand it at all. https://httpd.apache.org/docs/current/mod/mod_headers.html The optional ...
user avatar
0 votes
2 answers
22 views

How to track specific logs in Ubuntu? (CPU)

We have this EC2 instance: T2.medium, running apache, with 4 virtual hosts (4 sites). Sometimes, out of nowhere, the CPU reaches very high levels, maybe an attack. I've seen some of our wordpress ...
user avatar
3 votes
1 answer
37 views

OpenVPN server - does dropping previleges affect accessing files at runtime?

In OpenVPN's hardening article, it is recommended that the server daemon drop its privileges after startup on Linux: OpenVPN has been very carefully designed to allow root privileges to be dropped ...
user avatar
  • 165
0 votes
1 answer
32 views

pgcrypto and password hashing

I'm thinking about my choices regarding how to store passwords in Postgres. One such option is to use pgcrypto. Reading their docs, I see that their crypt and gen_salt functions do not use sha256 but ...
user avatar
0 votes
0 answers
51 views

Logging on Windows with user accounts in Protected Users group over VPN

I am planning implementation of Microsoft’s Active Directory tier administrative model, and I was wondering how to overcome the problem of system administration over VPN. One of the security ...
user avatar
-1 votes
2 answers
60 views

The Importance of Paying for SSL Certificate [closed]

Is It really compulsory to pay for ssl Certificate while setting up website? What are the advantages and disadvantages? Thank you.
user avatar
0 votes
3 answers
49 views

How to safety delete a package/software which wasn't installed via package manager

I have an old Ubuntu Linux 20 install. I recently found that I have a bunch of software that I installed before I started fully using package management and I can't remember the details of the ...
user avatar
0 votes
1 answer
26 views

How to get DDOS+WAF protection on IP/server (not domain)

I've used CloudFlare and it's great. But in this specific case we control the server IP address but we don't own the domain so can't use CloudFlare unfortunately because the domain owner isn't ready ...
user avatar
3 votes
1 answer
418 views

Why does a MS GPO option break SMB shares that use a hosts file for the machine name?

We've set "Microsoft network server: Server SPN target name validation level" to "Required from client" on our test GPO. Our test systems have some custom machine aliases in their ...
user avatar
  • 133
1 vote
1 answer
44 views

How to allow user to run only specific binaries

I'm adding user logviewer with /sbin/nologin/ and to my system. My custom service is running eg. sudo -u logviewer less --follow-name /var/log/messages. But still there are ways to run other command ...
user avatar
  • 121
0 votes
0 answers
46 views

SSL for IoT local network

How to implement the valid SSL for a local network without internet access? I am developing an IoT device that exposes its own access point and shows a web page for configurations. The webpage is ...
user avatar
  • 1
0 votes
0 answers
20 views

.httaccess broken - Too many redirects

So basically I broke the .httaccess and I dont know how to make it work again. All I wanted to remove was a dot which was showing after my domain, it had such symbols like /\ or / instead of just / in ...
user avatar
0 votes
1 answer
23 views

Is it safe to use Internet-facing RDP in combination with IP-whitelisting on Windows Firewall?

I am using a VPS that I connect to using RDP over the internet. Since I was experiencing an incessant stream of brute force attacks on the RDP, I configured the windows firewall to only allow certain ...
user avatar
0 votes
0 answers
28 views

Xen hypervisor: What does the acronym RMRR mean in "(XEN) [VT-D] It's risky to assign" ... "with shared RMRR at"? What are the risks?

I'm running Qubes-OS 4.1.0 While looking through the /var/log/xen/console/hypervisor.log I stumbled over the following messages: ... (XEN) [VT-D] It's risky to assign 0000:00:14.0 with shared RMRR at ...
user avatar
  • 609
0 votes
1 answer
69 views

Is it necessary to ban malicious IP regardless of default firewall setting being deny/reject?

I'm on Linux and using fail2ban as the ban system. So far, it has collected and banned about 150K of malicious IPs, and I'm concerned and wondering if this will gobble a fair amount of resources. As I ...
user avatar
  • 1
0 votes
0 answers
35 views

Using iptables for SSH brute force protection

10: Limit new TCP connections per second per source IP 53 /sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT 54 /sbin/iptables -A INPUT -p tcp -...
user avatar
0 votes
2 answers
103 views

block nginx connection after multiple 404 s on same tcp connection

I'd like to protect two servers against attackers who blindly probe for urls. my idea is to block requests after a certain amount of 404 status codes. I could do this with fail2ban. However one of the ...
user avatar
  • 203
0 votes
0 answers
25 views

Protect staging / pre-prod environments

I'm trying to secure some microservices environments. The problem is about distributed services, because some of them are SaaS products or in different clouds, serverless, PaaS, Kubernetes and so on.. ...
user avatar
0 votes
0 answers
18 views

pam_limits(systemd-user:session): invalid line '*hard nofile 999999999999' - skipped

I am getting these errors from journalctl: pam_limits(systemd-user:session): invalid line '*hard nofile 999999999999' - skipped pam_limits(systemd-user:session): invalid line '*soft nofile ...
user avatar
  • 1
0 votes
0 answers
22 views

Check computers on network for core isolation

Trying to find best method for checking all domain computers for core isolation being enabled. We have been slowly enabling this as new machines are deployed, but I would like to expedite the ...
user avatar
1 vote
1 answer
136 views

Why enabling _only_ TLSv1.3 is a bad idea?

I have NGINX configured to only support TLS version 1.3 However when I go to https://check-your-website.server-daten.de/ It shows the error Error creating a TLS-Connection: TLSv1.3 found, but no ...
user avatar
0 votes
2 answers
39 views

Cloud Run / Secret Manager Free Tier

I'm using Cloud Run for the backend of a project I'm working on, in part due to its generous free tier (2 million requests per month, free). But the services require some secret values (database ...
user avatar
0 votes
0 answers
22 views

Azure AD Conditional Access Policy - Require Security Key as Multifactor

I am exploring the Security options for user signin ( specifically admin signin ) to Azure Portal and other Azure App and my requirements is specifically that the user should enter the password and ...
user avatar
0 votes
0 answers
17 views

How to pass variables inside docker container to application securely?

An application inside a docker container is a required connection for external PostgreSQL DB. How can I pass variables inside the docker container for this application securely? I have in the file ...
user avatar
0 votes
1 answer
68 views

How to prevent query string accessing attempts like /?hfsagrs=XXX

I am a new site owner and do not have so much traffic, but recently my NGINX access logs are flooded with requests as shown in this picture below. I have attempted to block access with the pattern \?.*...
user avatar
18 votes
9 answers
3k views

root login or sudo user for server administration?

I'm trying to understand the technical arguments/security implications between ssh'ing with root directly, or making an auxiliary sudo user in the context of maintaining a server. To clarify, we're ...
user avatar
  • 183
0 votes
1 answer
53 views

I used ssh-keyscan to automatically allow fingerprints in production environment. whether it is good

Is there is any options to revert the mentioned action. whether it will cause any security breaches?
user avatar
  • 11
0 votes
0 answers
70 views

Can Squid be configured to block URLs that specify an IP address instead of a host name?

I have a non-transparent Squid proxy (v5 running on Ubuntu 20.04) which serves as a gateway from my private network to the internet. In the network there's a victim machine for malware analysis, and ...
user avatar
  • 101

1
2 3 4 5
135