Questions tagged [security]
Security is not a product, but a process.
0
votes
0answers
6 views
PowerShell JEA RoleDefinitions Trusted Domain
This one may be a bit tricky, and may not be possible. I have a PowerShell JEA endpoint configured in my DSC. It runs fine. The trouble is the users that are listed in the RoleDefinitions section of ...
0
votes
0answers
10 views
Add LimitNOFILE on haproxy init script
I want to add open files limit to HAProxy 1.8 process to 1024576. But since I use version 1.8, I cannot add LimitNOFILE to init scripts, instead of systemd file. How can I add limitNOFILE to those ...
1
vote
1answer
27 views
How to restrict RDPs to Azure VMs only via VPN?
I have:
An Azure virtual network
A Point-To-Site (P2S) Virtual Network Gateway
A subnet inside that network
A virtual machine inside the subnet
A network security group that the VM is a member of, ...
0
votes
0answers
30 views
What's the “RequestHeader unset MYHEADER early” equivalent for IIS?
I need to protect some servers against the HTTPoxy attack but on IIS. I know that on Apache based Web Servers I can do something like: "RequestHeader unset MYHEADER early", and the key operative work ...
0
votes
1answer
16 views
Where to safely store SSH/AWS/etc. keys for infrastructure provisioning from Jenkins?
I have already moved out all passwords and aws_access/secret_keys, out of the Git repositories.
Some access_keys/secret_keys have now been made available as environment variables so that the ...
0
votes
0answers
11 views
Cockpit-project integration with firewall
I have cockpit-project on my VPS (running on Ubuntu 18.04).
But still trying to figure out how to integrate it with firewalld.
I have uninstalled ufw and installed firewalld, but firewall section in ...
0
votes
0answers
7 views
Amazon Lightsail Instance Status Check Failed. How to identify the issue?
How can I identify the root cause of the instance crash on Amazon Lightsail after a status check failed.
Sometimes the same instance at 10:30 am crashes, and I can't neither login to check the logs ...
0
votes
1answer
38 views
Alternatives to white listing multiple external ip in restricted network
I have a use case where at a customer site I have to instruct the customer to white list numerous external server ip addresses. Users in the company have to be able to connect to each individual ...
1
vote
1answer
46 views
How to connect to a third party VPN from Google Cloud Platform?
Requirements
I am trying to connect to a third party VPN from my back end on Google Cloud Platform.
Since my IP has to be whitelisted by the third party, the source IP for all requests must be a ...
google-cloud-platform
3
votes
0answers
49 views
Erase GPU memory
We have Nvidia GPU cards that can be used by different users in an OpenStack environment. A first user creates a VM with access to a GPU card, then deletes the VM when done. Another user then creates ...
0
votes
0answers
28 views
Checking GPU firmware
In a solution of GPU in Cloud (with OpenStack) where the VMs can access the graphic cards via PCI-passthrough, we want to be sure no malicious person changed the firmware of the GPU from inside a VM.
...
0
votes
0answers
32 views
Timeouts on computers from same network
I am facing the following problem: I have web server setup on a machine running Debian 8. Apache, mysql the usual stuff. It is a hetzner dedicated server.
While using my computer (windows 10 ...
0
votes
0answers
36 views
How to forward syslog from Palo Alto VM-series firewall in AWS
I'm attempting to get syslog events from a Palo Alto VM-series firewall in AWS, to a SIEM syslog server that also resides in AWS.
It seems that Palo Alto has a partnership with splunk so they are ...
0
votes
0answers
31 views
How to only allow “Require all denied” in .htaccess?
We have an Apache 2.4 server. And in our VHost for a WordPress install we only allow overriding Limit, Options and FileInfo. (AllowOverride Limit Options FileInfo).
<VirtualHost *:443>
...
0
votes
0answers
19 views
I lost to access to encrypted files after update to Kaspersky Security Center 10.5.1781 and Kaspersky Endpoint Security 11.0.0.6499
I used the Kaspersky Security Center(KSC) 10.3.407 and Kaspersky Endpoint Security(KES) 10.2.4.674 in our network. I set an encryption rule to encrypt the all clients' desktops (just desktop not ...
1
vote
2answers
102 views
How do you securely retrieve the ssh host keys from a google compute engine instance?
I want to update my ~/.ssh/known_hosts with the host key information for a newly created GCE instance. But I'm not sure how to securely retrieve that information.
I thought something like
gcloud ...
0
votes
0answers
11 views
Server side security issues for a client-side only javascript application
I intend to publish a site for a javascript app. It is a simple app, all the things are done client-side, there is no need for the user to interact with the server, there will be no user user base and ...
0
votes
2answers
60 views
Custom AdminSDHolder protected objects
I have a task to remove adminCount and restore permisions inheritance for all users that are no longer member of protected groups. However there are few groups that were created by our organization ...
0
votes
1answer
76 views
Unattended-Upgrades override Allowed-Origins
I am trying to set the Unattended-Upgrade::Allowed-Origins so that it only is allowed for security updates. I would like to do this in a later config in the apt.conf.d leaving the default 50unattended-...
0
votes
1answer
39 views
What steps should I take to make sure Synology VPN Server is secure?
We we have a remote office with a Synology NAS and we would like it to connect to the home office Synology NAS. We have setup VPN Server (Synology package) on the home office NAS and enabled OpenVPN. ...
-3
votes
0answers
15 views
Protect site from server / cPanel penetrations / injections [duplicate]
A hacker penetrated my cPanel and modified files and code on my site.
I have a log report from hosting service provider. It goes like this:
.....frontend/paper_lantern/filemanager/upload-ajax.html?...
0
votes
0answers
33 views
Is there a shell which only runs scripts interactively or as an executable?
Instead of a restricted shell where, operations are forbidden, are there any largely bourne-compatible shells, or modifications thereof where the number of ways to get them to run a script has been ...
0
votes
1answer
29 views
Setting MACs setting in /etc/ssh/sshd_config on Amazon Linux
We are going through the process of hardening Amazon Linux 1 based on CIS.
Control 5.2.12 states under "Expected Values" :
The following List String value(s) X indicate the current
status of the ...
0
votes
1answer
33 views
How to protect LAN outlets against hackers and malicious people?
We have LAN outlets in conference rooms. They should be used by users from our company.
Obviously from time to time there are also visitors in those conference rooms. And they could be alone in those ...
0
votes
1answer
92 views
Azure Inbound/Outbound Port Rules Security Issue
Not so much a question as an observation on port rule security. I have a Linux VM with iptables blocking and logging everything except for the exact things I need, and I have noticed that whenever I ...
8
votes
1answer
433 views
Pointing specific users or OU's to specific DC's for logon authentication
I have around 200 users.
50 are in Asia, 50 in southern and Eastern Europe and around 100 in Western Europe.
I would like to point the 50 users who are in Asia to our DC in Asia, and currently it ...
0
votes
0answers
16 views
yum update errata up to specific version
I need to update a server up to a specific errata version.
I know that the below command will always update to the latest version.
yum --security update-minimal
I need a way to specify up to what ...
0
votes
0answers
65 views
Cookie Does Not Contain The secure and HTTPOnly Attribute
While running a Qualys Vulnerability Scan on a website which is being developed I got the following vulnerability:
Cookie Does Not Contain The "HTTPOnly" Attribute
Cookie Does Not Contain The "...
1
vote
1answer
60 views
Kubernetes PV with Block storage over internet - Secure?
I'm trying to create Persistent Volume on my k8s cluster with DigitalOcean Block storage, Using CSI driver.
It works fine, but I also wants to know that this is secure even for production.
I'm still ...
2
votes
1answer
628 views
How can I add in Apache Feature Policy Header?
I have a multimedia site which offers users to upload their own media (video,music) or embed media from sites like YouTube, Vimeo etc.
Recently, new header is being announced. I tried to add this ...
0
votes
1answer
46 views
Can you “copy” a Gemalto hardware MFA device with a virtual app?
We use the Gemalto MFA fob with AWS. It is a given that we know the fob's serial number that was provided to AWS; I presume that serial number constitutes the "secret key" and the TOTP algorithm ...
2
votes
1answer
81 views
Is it safe to expose an AWS instance ID?
Context: My company has private API that we only expose to our our employees and vendors who need access to it. That being said there are a few parts of it that don't require login to view, namely the ...
2
votes
1answer
39 views
Restrict Sysadmin Groups on Windows Server
Our sysadmins handle a multitude of tasks on servers and workstations alike. I would like them to be able to administer all servers and roles (DNS, DHCP, Remote Desktop Services) with the exception of ...
1
vote
0answers
24 views
Intel Driver & Support Assistant installs Root CA into Trusted Root CAs
The Intel Driver & Support Assistant (DSA) appears to install a Root CA certificate into the Trusted Root CAs of Windows 10 Pro. DSA was installed in 2018.
Sysinternals sigcheck reports:
Listing ...
0
votes
0answers
44 views
mysql no user login
I have the problem that someone / someone is trying to connect to my database without a user / password. Port forwording on 3306 is not active.
My SQL protocol:
@localhost when using TCP / IP
Access ...
0
votes
1answer
42 views
I get this error “Active: failed ” from the Process: 9666 ExecStart=/etc/init.d/apache2 start (code=exited, status=2)?
I was check my web server in apache2 and when I run the next command I get this error:
root@me:~# sudo systemctl status apache2
sudo: unable to resolve host me
● apache2.service - LSB: Apache2 web ...
0
votes
2answers
67 views
SSH Public Key Management for a small team
I'm setting up a deep-learning workstation in my college's lab. It's running Ubuntu Server 16.04 and I set up a SSH server in it, to control it remotely.
My task now is to make it available for my ...
-1
votes
1answer
47 views
WHM/CPanel Forensics on Linux Server [closed]
What are some potential sources of forensics related to an intrusion on WHM/CPanel on a Linux server?
I'm aware of
/var/log
/usr/local/apache/logs/
/usr/local/cpanel/logs/
/usr/local/apache/domlogs....
0
votes
1answer
76 views
Medium Risk Event - Sign-ins from unfamiliar locations
In Azure portal how do I disable the Risk Event:
Medium Risk Event - Sign-ins from unfamiliar locations?
But keep the:
Medium Risk Event - Sign-ins from anonymous IP addresses
Medium Risk Event - ...
0
votes
0answers
22 views
'All Removable Storage classes: Deny all access' and handheld USB barcode scanners
I have a question regarding the All Removable Storage classes: Deny all access Group Policy setting. We have been requested to enable it for data protection reasons however as a manufacturing ...
1
vote
0answers
27 views
Cannot login with account on RHEL 7.5 server with DISA STIG Profile enabled
This has happened several times now, and I am getting frustrated.
I don't know how it happens, but sometimes a user account gets locked out. I change their passwd, either through passwd or chpasswd. ...
0
votes
1answer
26 views
Restrict users to run 'history -d [arg]' and 'set +o history' commands
We are in the early stages of standardizing our infra. As an immediate step, we want to restrict users from manipulating the history. Have setup some restrictions for the same. But recently found that ...
0
votes
1answer
71 views
SELinux blocks tomcat web application to load Java native library (JNI) - how to configure SELinux on Centos 7?
I have a Centos 7 with Tomcat installed and tomcat user
ls -l /var/lib/tomcat
total 0
drwxrwxrwx. 5 root tomcat 84 Jul 3 13:18 webapps
SELinux is enforcing and a Java web application which tries ...
0
votes
1answer
35 views
Apache: ServerTokens and ServerSignature: security guidelines
There are a lot of sites that suggest that the following options should be set to their most reticent levels:
# /etc/apapce2/conf-available/security.conf
ServerTokens Prod
ServerSignature Off
...
0
votes
1answer
11 views
Tripwire skipping files?
TL;DR:
Question: how do I configure Tripwire to watch EVERYTHING that is below a certain path? My current config seems to only be looking at certain files / directories in a given path instead of ...
0
votes
1answer
31 views
Azure Security Center - Would the Monitoring Agent work on AWS and GCP VMs
I'm looking at Azure Security Center. I know it can be used to monitor not just VMs on Azure, but also VMs outside of Azure using an installable Monitoring Agent.
My question is whether this agent ...
0
votes
0answers
49 views
Is there any modern scalable way to do system call monitoring?
I wrote a kernel module to replace the Linux kernel service routines (e.g. system calls) with security-enforcing code, similar to SELinux or AppArmor, with the main exceptions of ruleset control on-...
-1
votes
2answers
36 views
How can I know how much Google Cloud Platform had been charged or need from me in the billing aspects?
I have an account inside GCP, and need to know exactly what GCP need from me as a charge or from my MasterCard balance so far? How can I do that as the amount it said 1.x K USD which is too high I ...
1
vote
2answers
107 views
delete a table in iptables
how do I delete a table in iptables (as opposed to a chain)?
I have some empty tables that are getting output by iptables-save even though I'm only using the 'filter' table.
For example, I'd like ...
1
vote
1answer
57 views
What is the best-practices' reasons for having several partitions for servers? [duplicate]
When I install a graphical distro for personal purpose I usually separate /boot and /home.
When I install a server I stick to /boot and / only, and depending on the project I may consider some other ...
