Questions tagged [security]
Security is not a product, but a process.
6,571
questions
1
vote
0answers
18 views
Does an IP lockout policy prevent most public RDP attacks?
My company uses RemoteApp to provide a "cloud edition" of our desktop software.
The RDP port has been changed from default, and we run RDP Shield, which blocks the IP address after 5 failed ...
0
votes
0answers
14 views
Best way to establish and secure communication from multiple subnets to device behind firewall (DMZ, NAT, port forwarding?)
I'm looking for advice on how to best implement a DMZ on a FortiGate firewall (FG-F100), as in the proposed architecture drawing attached diagram.
The goal is to establish a security barrier between ...
4
votes
1answer
56 views
What is the difference between 'Red Hat Enterprise Linux STIG - Ver 3, Rel 3' and 'Red Hat Enterprise Linux 7 STIG Benchmark -Ver3,Rel3'
I've been assigned to STIG our current rhel7 servers and when I go to 'public.cyber.mil/stigs/downloads' to download the zip file to import into stigviewer, I see two files.
Red Hat Enterprise Linux 7 ...
-2
votes
0answers
13 views
Verify ddos attack on my gcp vm instance [closed]
I am trying to test Google cloud security in comparison to other monitoring tools i need to simulate an attack on google cloud i tried installing low orbit on my ubuntu os and input the IP address of ...
google-cloud-platform
-1
votes
0answers
22 views
what to do in case of command substitution on a linux server? [duplicate]
I have a web server (Debian). I would like to know how to protect myself in case of hacking if a hacker changes commands such as netstat, ls.
I have to make a backup of such files as ls, netstat, and ...
1
vote
1answer
25 views
Is there any way to allow a group of ip in the certain range to access my website?(Nginx)
Suppose, I want to allow access to my project for the IP falling between 192.168.1.1 and 192.168.1.40.
Nginx example:
stream {
#...
server {
listen 12345;
...
0
votes
0answers
11 views
persistently disable ping/ICMP response on Ubuntu 20.04
It was possible to add net.ipv4.icmp_echo_ignore_all = 1 to /etc/sysctl.conf and reload with sysctl -p.
This does work for me on Ubuntu 20.04.
But after a reboot, the machine responds to ICMP requests ...
0
votes
1answer
46 views
Compromised printer?
Today the office printer produced three sheets with what seems to be random characters, and in the middle a string random1random2random3random4. This raised a red flag with us. Is this something to be ...
-1
votes
0answers
8 views
How can I add an external AWS account and assign a role to that via CloudFormation?
I want to create a CloudFormation script to create a new role and assign that role to an external AWS account. I'm doing that to use that account in my security audit using Prowler (the external ...
0
votes
0answers
45 views
Is it possible to hack a server with a SSTP_DUPLEX_POST request?
How is it possible to use the method : SSTP_DUPLEX_POST and the url : /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ to hack a server ?
I have this request in my logs from a well known malicious IP ...
-2
votes
0answers
19 views
SSH fragments packets over wrong mtu
I have this configuration:
HOST-A <---> GAT-A <---> MiTM <---> GAT-B <---> HOST-B
I'm doing a security project on MTU-IPsec vulnerabilities and following this guide of Hal-...
2
votes
0answers
34 views
Facilitating arbitrary code execution on AWS Lambda
I am developing a SaaS where a user will be able to upload a custom JavaScript function that runs when an event happens. In order to preserve the integrity of the system, I am using AWS Lambda to run ...
1
vote
1answer
20 views
Get the actual username of a SSH Client that established a SSH session to a remote server
Let's say we have a user account called john on a CentOS server (192.168.1.1) and on the other side we have a user who owns this account and from time to time uses his account from different locations ...
0
votes
0answers
18 views
How can I systematically prevent misdirected email to be sent
I am working for a recruitment firm as an IT guy. as you might know recruitment firm sends and receives lots of sensitive information like resume and so on and the business requested us to come up ...
1
vote
0answers
103 views
Unknown private IP addresses tried to log in to my router's admin panel
I noticed some weird traffic in my router's admin panel logs:
2021-03-25 06:27:19 [Critical][Config-Log] Terminal:WEB(10.181.189.71),Result:Fail,Type:Login,Username:-
2021-03-25 06:27:22 [Critical][...
-1
votes
0answers
33 views
IPSec - ip xfrm add policy for only one service like FTP?
I have 2 linux machines were I am configuring IPsec.
I managed to apply the settings to encrypt and encapsulate the complete traffic with this type of policies:
Machine 1:
ip xfrm policy add src 172....
-2
votes
0answers
17 views
How can I enable users to transfer files from and to remote accessed computers while making sure confidential files on the machines are not leaked
We have some machines that contain policies to block internet to prevent data leak.
On the machines there is a folder which is highly confidential.
I blocked RDP local resource attachment as well.
Now,...
0
votes
1answer
35 views
What is the optimal way to protect my data from my VPS provider? [closed]
What is the optimal way to protect my data (db and source code) from my hosting provider?
Would using an encrypted volume, such as truecrypt, suffice? However - for my program to access data on the ...
0
votes
0answers
12 views
How to find last upload date of webapp to Azure deployment slot
I would like to know the last time the webapp code was uploaded to one of the Azure deployment slots. Is there a log of the events or should I just check the properties of the files?
I may need to ...
-2
votes
0answers
25 views
How to change user privileges from 'Y' to 'N' in MySQL Server? [migrated]
I want to change a privilege to my glpiuser from 'N' to 'Y'.
In MySQL server, what is the command to do this task?
Here's the image that display my users.
I'm using Ubuntu 20.04.1
2
votes
2answers
49 views
How to remove AdmPwd Permission from BUILTIN\Users (MS LAPS)
I've deployed MS LAPS to manage local admin passwords and all is working fine, except that non-privileged users are able to access the local admin password, in both Powershell and LAPS UI.
Running the ...
0
votes
0answers
12 views
SQL Server: allow access to databases of particular Availability Group only
Is it possible to configure clustered SQL Server in a way that allows users connected to a listener of an AlwaysOn Availability Group to access databases belonging only to this Availability Group? ...
-1
votes
0answers
18 views
Audit local Users with RDP/Admin on Azure VM's
wonder if anyone can assist.
I'm trying to audit accounts local users created on a load of virtual machines that were lifted and shifted from on-premises to Azure. I'd like have a way to iterate ...
24
votes
4answers
2k views
SSL for devices in local network
Initial question
We make devices which run a webserver and the user can control some functionality of the device by browsing directly to the IP of the device. This can be a fixed IP when a direct WiFi ...
1
vote
1answer
45 views
If all hosts on a network require password logins, why do we care if an unauthorized user accesses our network? [closed]
Assuming all devices on my network require password logins, why exactly should I care if an unauthorized user accesses my network? For example, I may have a fileshare on my network that requires a ...
1
vote
3answers
27 views
Implicitly allow requests in IIS from valid hostname
I have a few publicly accessible IIS servers and sites (personal and corporate), these hosts have own domains/subdomains, and all legit access to these https sites happen through domains.
Almost all ...
0
votes
1answer
32 views
Double call to root path “/” in a website
I'm checking my web page performance, but some strange reason it double calls to root path.
Any idea why this is happening?
Thank you.
0
votes
1answer
28 views
Port forwarding to public and allow an IP [closed]
I wanted to share my local computer's remote desktop tcp port 3389 to the internet and access to it from a remote computer when I'm not in the home.
But just sharing port to public without any ...
-1
votes
3answers
74 views
Hide server IP for user's DNS record
I am starting a web hosting service using my own server. Are there any possible ways to cover my IP address for users to point their DNS? For example, my server's IP is 12.34.46.78 but I want the user ...
0
votes
1answer
68 views
Should I create a VPN just to give two users access to a single AWS EC2 instance
I need to create a single AWS EC2 instance to share some work with a collaborator who will have ssh access. My instinct was initially to lock down the instance with a VPN in addition to ssh key ...
0
votes
1answer
25 views
How to restrict access between folders on the same virtual host
We plan to host WordPress Blog and an Ecommerce store on the same domain, so the URL's will look like this:
example.com <--- Magento Store
example.com/blog/ <--- WordPress Blog
Our main concern ...
0
votes
2answers
53 views
Where to setup SSL key files for using in Docker services
On Debian servers we're supposed to store certificates on /etc/ssl/certs dir, and key files on /etc/ssl/private dir.
The problem is SSL private key files use to be readable only by the owner. So, I'm ...
0
votes
0answers
22 views
I'd like to figure out how to setup rotating failover IPs, So when under attack it will use a different source address for web traffic
I'm simply wondering if it's possible to use multiple IPs for a piece of traffic of my choice. I want to have it setup to where it will use a different source address once the one it's currently using ...
0
votes
0answers
19 views
Shared service account across multiple non-production environments (dev, test and uat)
I understand that it is a good practice to have an isolated service accounts for the production and non-production environments but what are the risks if the same service account is used across non-...
0
votes
0answers
11 views
IIS auto IP blocking on specific patterns
I'm seeing on a server every few minutes/seconds some bots trying to do an open redirection attack I think.
Only local urls are being accepted as per documentation from Microsoft: https://docs....
0
votes
0answers
6 views
VPC serverless connector - Tag
The documentation explains that every connector has two network tags: vpc-connector and vpc-connector-"region"-"connector-name""
An egress firewall rule which filter the tag &...
0
votes
0answers
21 views
Azure DevOps Pipeline: Code scanner with notifications
We are currently using the WhiteSource Bolt task in our Azure DevOps pipeline to scan our code for known vulnerabilities. This task will produce a report on the pipeline level, plus there is also a ...
0
votes
0answers
85 views
Prevent docker container from accessing localhost
I noticed that I can access the host from a docker container by using the docker0 gateway address. For security reasons I want to block / limit this access.
I already used the following iptables rule ...
0
votes
1answer
63 views
How to fix Weak TLS 1.2 Encryption
I have a requirement to disable below weak TLS ciphers in Windows Server 2016. I tried to reasearch and it says "The Microsoft SCHANNEL team does not support directly manipulating the Group ...
1
vote
1answer
37 views
Password security of encrypted SSH private key: How to read round number or costfactor of bcrypt
Here https://security.stackexchange.com/a/52564 you can read that newer OpenSSH versions use bcrypt for protecting the keyfile. Security of bcrypt depends on the costfactor see https://security....
0
votes
0answers
26 views
nginx: Rerouting/proxy OCSP request to adifferent backend
I'd like to filter/reroute OCSP traffic from regular HTTP traffic to a different back-end. Reviewing Network Analyses of OCSP protocol, if the OCSP request is via POST, I can filter on Content-Type: ...
0
votes
1answer
12 views
SQL Server Linked Server readonly as security measure
I've got a configuration with to separate VLANs. In one of te VLANs, a Microsoft SQL server is running and doing it's thing. I'd like to read (and only read) data from this server from the second VLAN....
0
votes
1answer
100 views
Run nmap in a Docker container as a non-admin user
I'd like to run the Nmap tool in a Docker container but not with the default root user account. I already set the (hopefully) right capabilities via setcap.
Unfortunately, I get only the "...
0
votes
1answer
219 views
Found errorEE.aspx Web Shell in Exchange 2016 auth folder
So recently Microsoft published this document:
https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
They mention a web shell called errorEE.aspx and when I checked my ...
3
votes
2answers
425 views
TLS 1.3 support for Windows Server 2019
Is TLS 1.3 supported on windows server 2019?
I found a documentation from microsoft but for some reason the matrix doesn't include server 2019: https://docs.microsoft.com/en-us/windows/win32/secauthn/...
0
votes
1answer
34 views
How would I set up Debian 10 and Postfix security for a limited send-only email setup?
I (me and my wife) run a small Debian 10/Buster web server with a few websites for friends and need to set up outgoing email. I've got to the point where I can send emails from the command line (echo &...
1
vote
1answer
89 views
How to set up a secure system to allow only specific clients to access specific services on a server?
Preface
Please bear with me if I use incorrect terminology or don't express the problem too well since I'm not an expert on system administration/server maintenance. Let me know/correct me if I do so ...
21
votes
5answers
3k views
Does DKIM alone not solve the spam issue? Why do I need SPF?
FINAL EDIT : I was completely wrong about DKIM it seems, the signing domain does not have to be the same as the sender domain, thus the whole premise for my question is flawed. A lot of thanks to Paul ...
0
votes
1answer
41 views
It seems that a robot is creating a lot of user accounts on my website
I am working on an e-commerce website... there is a bot that keeps creating new users on our website... All the users belong to allmelbet.com and all of them have exactly the same first name and last ...
0
votes
1answer
301 views
Should I be concerned about attackers spraying for vulnerabilities on our webserver?
I'm running a webserver with monitoring software (Sentry.io) and I can see (failed) hits to the following endpoints:
GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
GET /console/
POST /api/...
