Questions tagged [security]

For questions relating to application security and attacks against software. Please don't use this tag alone, that results in ambiguity. Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. If your question is not about a specific programming problem, please consider instead asking it at Information Security SE

Filter by
Sorted by
Tagged with
0 votes
1 answer
19 views

How to take ownership of all contents in CSC folder?

I have files that was saved as offline files from a Synology server to the CSC folder on my computer that I would like to delete. I cannot delete the files unless I individually take ownership of ...
0 votes
0 answers
27 views

Apache HTTP Server 2.4.55 - Block IP Login

Environment: OS: Linux HTTP Server: Apache 2.4.55 I want to block website logins provided with public IP. I have shown an example of logins with URL and IP as below. I will do the blocking using ...
0 votes
1 answer
42 views

I cannot find where 0002 umask is being set on Ubuntu 20.04

My user account has a non-standard umask setting of 0002, and I cannot find the config file where this is being set. I have searched in /etc and ~/.bash* with sudo grep -iIr umask. Running umask in ...
0 votes
0 answers
21 views

PHP-FPM + Apache2 security

I have configured my server (an Ubuntu 22.04 machine) so that it is managed by Apache (v2.4.55) and php7.4-fpm. The current configuration allows every vhosts to be divided into specific php-fpm pools, ...
  • 1
0 votes
0 answers
55 views

Content-Security-Policy frame-ancestors not working

I'm running an OpenLiteSpeed server and would like to only allow webpages that start with a specific url on my site (e.g. https://example.com/video/**) to be iframed by others. (I want to allow anyone ...
  • 101
0 votes
0 answers
41 views

Adding process to cgroup returns error "write error: Invalid argument"

On Red Hat 8.7 on x86_64 I would like to restrict process to be allowed to use only 50% of CPU time. I tried to limit a process with cgroups following Red Hat tutorial Setting CPU limits to ...
  • 1
0 votes
0 answers
14 views

Security updates for linux server with only local network access

I am using Compute Engine and VPC Networks in Google Cloud Platform. I have a "classic" frontend - backend server setup inside Google Cloud with two VPC Networks which are connected trough ...
-1 votes
0 answers
12 views

SSH login with partially functioning DDNS

My ISP is offering a DDNS service which is not functioning as it should. Forward rDNS is not working and I'm trying to secure my server by denying all connection attempts via SSH, but allowing all IPs ...
  • 1
1 vote
1 answer
64 views

(copy from Stackoverflow) Google Secret Manager- allow Compute Engine to auto-renew the certificates

Below is what I've posted at stackoverflow here that is not getting attention. I hope someone here is able to guide me to find the right answer. I come with Azure background. In Azure, I could ...
  • 11
0 votes
1 answer
28 views

How to protect Jenkins from super users?

Any super user who has access to the Jenkins running on a Linux server can easily disable security authentication from config.xml file; then log in and can also decrypt sensitive passwords from ...
user avatar
0 votes
0 answers
15 views

Does it make sense to have separate buckets for each service or sub-service of the application? [closed]

I am trying to write a NodeJS backend application using Amazon S3 storage. It is a microservice based application and users can upload images, videos and documents. I wanted to know does it make sense ...
0 votes
0 answers
50 views

How to stop Windows Server 2022 successful anomymous RDP logins

I have a Windows Server 2022 server with IPBAN installed to make hacking it more difficult but in the logs occasionally I see: 2023-02-20 03:59:23.5304|WARN|IPBan|Login succeeded, address: XX.XXX.XXX....
0 votes
1 answer
20 views

Permission for Users group successfully modified via code, but change is not reflected in Security tab for the Users group

I have C# code (at the end) which: Creates a file Prints the current ACL Gives the builtin users group "write permissions" to the previously created file Prints the current modified ACL ...
  • 89
0 votes
0 answers
15 views

What is the proper way to configure Tripwire to handle automatic log rotations?

I installed tripwire by following this online documentation on a fresh ubuntu 22.x server. I followed the above documentation exactly and did not add any custom mods to either the cfg or the pol ...
0 votes
0 answers
26 views

sshd allows login with no authentication all accounts

This morning I was logging into an Ubuntu 18 machine that luckily we use for testing and is not on the Internet. When my SSH client got to the authentication point I accidentally hit 'ESC' which means ...
  • 13
0 votes
1 answer
60 views

how to SSH to Wireguard server from Windows client with active VPN connection?

I have Wireguard server on Rocky 8.7, when I connect to the server I route all client traffic through Wireguard this is quotes from setup script, of course all variables is set (and all works good) ...
1 vote
1 answer
50 views

EXSi Arg Server attack

I have a very basic question. From what I have read, it seems these unpatched servers were directly attacked remotely through the internet via port 427. So unlike other ransomware attacks, the malware ...
0 votes
1 answer
29 views

FortiGate Next Gen Firewall AWS security groups

I'm new to AWS using a FortiGate in front as the gateway. Would you need to utilize the security groups, or could I make one to permit all traffic and attach it since the fortigate handles everything.
  • 3
0 votes
0 answers
31 views

how to use PAM auth for ssh key clients?

How to unlock ssh private keys with PAM, so I can use fingerprintd module? There are many questions here discussing PAM and kerberos for sshd auth, but I can't find anything on the client side. Also, ...
  • 263
0 votes
0 answers
24 views

backup /home over sftp - root

My current task is to set up a (remote) backup (using rsync/rsnapshot) over sftp of /home (linux). Obviously some files are read only for the owner (ie -r-------; and should stay that way) so i guess ...
0 votes
2 answers
54 views

fail2ban - one IP banned multiple times by multiple jails - errors in log durin unbanning

I make few similar jails for different ports... jail names: http_https_deny, dns_deny, ftp_deny, smtp_pop3_deny, ssh_deny here firewalld and fail2ban settings for http_https_deny(other almost same, ...
1 vote
0 answers
29 views

aws guardduty some alerts won't notify on slack

I have recently setup aws guardduty with slack notification using this guide right https://medium.com/@damitj07/how-to-create-a-slack-alert-for-guardduty-49d542927529, there were a few issues with the ...
  • 119
0 votes
1 answer
39 views

Debian security release

I have noticed that there is a "security" release listed in the Debian security tracer. Some of the vulnerabilities are only fixed in the "security" release, which might be still ...
  • 129
0 votes
0 answers
12 views

Updating the `/etc.ufw/before.rules` file to allow `ufw` firewall redirection

I need to Configure My Server so that the ufw firewall running on it can redirect port 8080/TCP to port 80/TCP. From quick research, I know I can do it in Two ways; one is to run a command similar to; ...
  • 1
0 votes
1 answer
17 views

Native Authentication with Apache

Reading the CIS Benchmark documentation, I saw that a good practice is to disable mod_auth_basic and mod_auth_digest. Does Apache have some native way to perform authentication that is more modern ...
  • 235
0 votes
1 answer
16 views

Using old web application with outdated PHP version behind .htaccess folder protection

I probably need a web server with an outdated PHP Version (7.2.34) for an older HTML/PHP/MySQL based web application. Since it's for a manageable closed user group, I exceptionally considered using a ...
0 votes
1 answer
40 views

Carbon Black on AlmaLinux?

All: We've been trying to prepare for the EOL/EOS for CentOS by moving to AlmaLinux 8.7. For many of our machines, we're using Carbon Black (CB) 2.14.0 for security. But VMWare/CB support is telling ...
0 votes
0 answers
29 views

CSF Deny an IP Range Exclude specific IP on specific port

I've bunch of ips / networks added to csf.deny csf.deny 1.1.0.0/19 # do not delete However i want to allow 1.1.1.1 on port 80 and 443 with csf.allow csf.allow tcp|in|d=80|s=1.1.1.1 tcp|in|d=443|s=1.1....
  • 1
0 votes
0 answers
18 views

Is it valuable to do DNS Leak Testing directly from a firewall and not just from the client side?

I've been writing a tool that can be added as a package for pfSense, and essentially the tool allows you to perform a DNS leak test on any of the interfaces on the firewall appliance. One developer I ...
0 votes
0 answers
80 views

Using PasswordAuthentication yes in sshd config but password is not accepted during login

I tried to enable password authentication in CentOS 7 only for one user - auditor, by having this lines in my sshd.config (at the end of file): PubkeyAuthentication yes ChallengeResponseAuthentication ...
0 votes
0 answers
25 views

Multi-Prefix (CORS Header)

How can I make this so it handles both https/http? add_header Access-Control-Allow-Origin "https://sub.example.com"; What is happening, is specific resources rely on http traffic (//api....
  • 101
0 votes
1 answer
58 views

Any security reason not to use `root` user for git remote operations?

I've got some configs (docker-compose related files) which I like to store them via git on a private github repo. The configs are owned by root. Is there any reason to change the ownership of the ...
2 votes
2 answers
1k views

DigitalOcean Network Firewall allowing SSH connections on ports other than only 22

I have a droplet on DigitalOcean with IPv4 and IPv6 enabled. The droplet is behind a digital ocean network firewall with the following rules: Inbound: SSH TCP 22 All IPv4, All IPv6 HTTP TCP 80 All ...
  • 158
0 votes
1 answer
350 views

Is it safe to close the following ports in Windows Firewall for a Windows 2022 VPS web server?

I am using a Windows Server 2022 VPS as a web server to host a website only. When the VPS was first setup for me, I saw the following ports for Inbound in Windows Firewall were already enabled (the ...
0 votes
0 answers
12 views

Tools or processes to review security questions

I'm looking for a tool or process to review external customer questions or scans against our internal database of security issues stored in Azure DevOps/TFS or Loopio. We get customer scans using ...
  • 1
0 votes
2 answers
64 views

Nginx - How to return 404 if authentication headers are present?

I've got an nginx instance on the Internet that proxies an application. I would like to return 404 on any request from the Internet that attempts to authenticate to the application, as all of the ...
  • 111
1 vote
0 answers
483 views

Wireguard VPN not making handshake

I'm facing a trouble, I have a server with Wireguard configured, with the keys generated by wg command line. I've downloaded Wireguard for windows and put the public's server key on client peer, and ...
0 votes
0 answers
24 views

NGINX SSL directory and .crt and .key files permissions [duplicate]

in folder /etc/nginx/ssl/ I have public and private key for domain for wildcard SSL certificate purchased from CA and transferred as root to that folder. SSL request has made on another windows ...
  • 123
0 votes
0 answers
23 views

File and Printer Sharing disable config

I disabled the File and Printer Sharing feature over the firewall on the windows server to which my abc.com website is connected. This server only hosts website and mail. When I ping abc.com on cmd ...
-2 votes
1 answer
40 views

Windows Firewall Disabled every startup [closed]

I have an antivirus installed (Panda Antivirus) and it always worked well for me. Everytime I startup my pc I get the notifications (screenshots below) to turn Windows Firewall ON. I never had this ...
  • 3
1 vote
1 answer
5k views

Encryption type requested is not supported by the KDC

I am having intermittent issues with RDP'ing from a Windows 11 Enterprise PC to another Windows 11 Enterpise PC. Both PC's are domain joined and on the same subnet. Both PC's have a GPO applied to ...
  • 113
0 votes
1 answer
122 views

Prevent VPN client from network scanning on ocserv

I have a ocserv server for VPN on a debian11 server. One of my clients did a network scanning and service provider blocked my IP for terms of service violation. This is 2nd time that this happened and ...
  • 1
0 votes
0 answers
29 views

A certain IP keeps trying enpoints in my API such as `/.env`, `/info.php`, `/.env.production`, etc. Should I blacklist it?

I deployed my first ever internet service recently (AWS). As I expected, I started getting these "internet robots". I noticed one in particular that keeps trying the endpoints mentioned in ...
  • 101
-1 votes
1 answer
38 views

How should I design my 'public' network of an project?

I'm thinking about doing some online projects as a Developer/IT Technician, and I have some concerns regarding security. I'm unable to host my servers locally for my project and I thought why not to ...
  • 1
0 votes
1 answer
50 views

Azure Function App - Azure Defender compliance

Azure Defender on Azure has two policies for Azure Function authentication that I'm not able to implement from other azure resources that support http calls. Function apps should have Client ...
11 votes
2 answers
3k views

How dangerous might it be - and what performance gains may be had - by turning vulnerability mitigations off on non-Internet facing servers?

When a virtual machine Linux host server is non-Internet facing and is used exclusively on a LAN and is using a relatively well tested distribution like Proxmox, how dangerous would it be to turn off ...
  • 1,131
0 votes
1 answer
45 views

Enabling Cephx In cephadm depolyment

Hello i am trying to enable cephx in my ceph cluster i added this three lines to /etc/ceph/ceph.conf auth_cluster_required = cephx auth_service_required = cephx auth_client_required = cephx i didn'...
1 vote
0 answers
39 views

Disallow port forwarding to bypass VPN

We have a linux workstation that is used by a group of users via Internet. For security, users must connect to our private network by VPN and then can ssh to the workstation. The job they run on the ...
0 votes
0 answers
25 views

Store API keys for our API

I'm building an HTTP API with API gateway and want to use API keys for authentication. Since they aren't supported by HTTP APIs, I plan on verifying them manually in a Lambda function. Where would the ...
  • 11
0 votes
1 answer
108 views

How to restrict local admin from disbaling or changing firewall setttings

I have a scenario, where the member servers are not able to RDP to other member servers I have managed that using local firewall rules, but at same time the local admin should not able to disable or ...
  • 145

1
2 3 4 5
137