Questions tagged [security-groups]
The security-groups tag has no usage guidance.
175
questions
0
votes
0
answers
18
views
Openstack - security group rule priority
How can I set priority to security group rules in OpenStack via API? For example, I would like to banned one output port and I would not like the user can override it by another rule.
- 19
0
votes
1
answer
121
views
Domain Controller Blocking SAMR Request
I have a software that is used for monitoring user logins. In the software it uses a SAMR request to get user groups for allowing users in an out of the machine. When the software reaches out with a ...
- 825
0
votes
0
answers
82
views
EC2 port 80 refused to connect on public IP but can connect using private IP
Question simplified
I can do curl {publicip}:4321 but not curl {publicip}:80 or curl {publicip}. But from the server's ssh, i can run curl {privateip}:80 and curl localhost:80 without any issues. And ...
0
votes
1
answer
93
views
Do firewalld rich-rules apply irrespective of the allowed services in a zone?
Context: I have firewalld running on an AWS EC2.
Goal: I want to add a rich rule to the default zone (public) that allows traffic from a certain CIDR range/IP address range/subnet over port 443 (HTTPS)...
0
votes
0
answers
76
views
Can you specify the SSM parameter store as a target in an AWS Security Group egress rule?
I would like to tightly restrict outbound network level access from groups of EC2 instances. For these instances, I need to allow access to the Parameter Store. I also need to allow access to S3. ...
0
votes
1
answer
236
views
Permission for Users group successfully modified via code, but change is not reflected in Security tab for the Users group
I have C# code (at the end) which:
Creates a file
Prints the current ACL
Gives the builtin users group "write permissions" to the previously created file
Prints the current modified ACL
...
- 89
0
votes
1
answer
71
views
FortiGate Next Gen Firewall AWS security groups
I'm new to AWS using a FortiGate in front as the gateway. Would you need to utilize the security groups, or could I make one to permit all traffic and attach it since the fortigate handles everything.
- 3
0
votes
0
answers
26
views
Issue while setting up CloudStack Advance Zone with security group
Apache CloudStack v4.17.2
I am trying to setup CloudStack Advance Zone with security groups.
I have two network bridges cloudbr0 (10.4.1.1/16) and cloudbr1 (10.6.1.1/16).
I am using cloudbr0 for ...
- 11
0
votes
0
answers
119
views
How to connect securely from Redshift serverless to federated RDS Aurora cluster schema?
I have a Redshift serverless workgroup inside a VPC, and I want to securely create a federated schema of an RDS Aurora cluster through a security group or another mechanism. The Aurora cluster is in ...
- 101
0
votes
0
answers
48
views
AWS Cloudfront front-facing for ELB Origin
Right now I'm working with Cloudfront as front-facing for the Application Load Balancer in AWS.
I attached my default Security Group (one) which has inbound rule both for HTTP and HTTPS for source 0.0....
0
votes
1
answer
1k
views
ECS containers on EC2 cannot mount EFS volumes
I have created an ECS cluster backed by an EC2 auto-scaling group and launched a service in it that uses EFS for NFS storage. The service is running in awsvpc network mode so that I'm able to control ...
- 247
1
vote
2
answers
884
views
AWS security group cross regions
I am trying to set a security group A to allow SSH access from security group B in a different region. I don't have much experience with networking in general and AWS networking.
Followed the ...
- 179
0
votes
1
answer
913
views
How do i add a security group as an inbound rule to another security group in terraform
I have a Terraform codebase which deploys a private EKS cluster, a bastion host and other AWS services. I have also added a few security groups to the in Terraform. One of the security groups allows ...
- 123
0
votes
1
answer
1k
views
How to get name of BUILTIN\Users & BUILTIN\Power Users
Is there a universal way to get the principals BUILTIN\Users or BUILTIN\Power Users (specifically retrieve the name)
The obvious answer would be that I already have the names! However, they are called ...
- 121
2
votes
1
answer
2k
views
Dynamic Mail Enabled Security Groups are being converted to Dynamic Distribution Lists
Problem: the dynamic mail-enabled security groups (DMESG) I create in EAC are being automatically converted to Dynamic distribution lists (DDL) instead.
Use Case: I am attempting to give membership ...
- 21
0
votes
0
answers
97
views
Restrict an instance access through security groups to itself on aws (Pfsense)
My intention is to create a VPN server.
So i created and configured an instance on AWS as a VPN server (Pfsense), then i added in the security groups the destination 0.0.0.0/0 of the VPN port (1194). ...
0
votes
1
answer
113
views
Does blocking all outgoing traffic on cloud instance lock me out?
I have to test an app which first downloads data, but then, can not communicate with the world for the duration of the test (so it doesn't gossip stuff).
There are ways to enforce this on the app, but ...
- 499
0
votes
0
answers
32
views
TCP communication on port not responding on different Availability Zone or Subnet
I'm a little curious and confused about this situation. We setup a monitoring instance scraping an exposed endpoint on 2 different instances. Both on same VPC, same security group, same route table ...
1
vote
1
answer
305
views
AWS Postgres database IP in security group, how to enter info to survive IP address changes?
I have an existing prod Postgres database and I would like to replicate a table to a new Postgres database. In order to get the two to be able to talk to each other, I had to edit an AWS security ...
- 131
0
votes
1
answer
418
views
Linux: How to allow outbound rules for seccurity updates
We use aws ec2 instances with the 'AWS Linux AMI 2' image.
We have a script for security updates with this code: yum update -y --security.
I want to allow only security update in outbound rules - aws ...
- 223
0
votes
1
answer
2k
views
Create a Mail-enabled security groups with Azure AD role assignment?
I would like to create a Security Group within my firm's 365 Tenant with a group email address and role assignment of "Billing administrator" - i.e. Can perform common billing related tasks ...
1
vote
1
answer
79
views
RHEL 8: Administrator vs. Auditor role
On RHEL 8, are there prepared functions, methods, processes or tools to implement administrator/operator and auditor roles in the following way:
An administrator/operator should be able to do almost ...
- 596
0
votes
0
answers
486
views
Logging on Windows with user accounts in Protected Users group over VPN
I am planning implementation of Microsoft’s Active Directory tier administrative model, and I was wondering how to overcome the problem of system administration over VPN. One of the security ...
- 243
1
vote
0
answers
619
views
Remove the default Security Group assigned by Elastic Beanstalk
I have created a Elastic Beanstalk environment and have created this .config to edit the security groups which worked. Now my EC2s are attached to the new SG and the default one.
option_settings:
- ...
- 11
0
votes
1
answer
649
views
A user activity is detected from a disabled account in Active directory
I have disabled an user in my Active Directory (terminated the account). However, I am still getting the log that Event IDs 5379 (credential manager credentials were read.), 4673 (a privileged service ...
- 3
1
vote
3
answers
8k
views
AWS - Adding multiple IPs to Security Group Inbound Rules
I need to open 20 ports for 12 IP blocks.
Do I have to manually add 240 rules in this case? I feel like there must be a way to just copy&paste the IP list to somewhere.
I googled and found it's ...
- 125
1
vote
2
answers
1k
views
Whitelist both IPv4 and IPv6 in AWS Security Group
I am setting up an SFTP server, I want to white list all the IPs in the Security Group so people can connect to it from anywhere.
At the moment I am adding 2 rules to the Inbound rules, one rule for ...
- 518
2
votes
2
answers
1k
views
Office 365 Exchange Public Folder lost SID assignment to security group folder permissions
We installed a new Exchange 2016 server and migrated all the mailboxes from the Exchange 2010 server to it.
Then we migrated all the mailboxes and public folders from MSEX2016 to Office 365, and we ...
- 225
1
vote
3
answers
488
views
How can I easily manage constantly changing public IP addresses in my many security groups
Our development environment is hosted on AWS, and is accessed by dozens of people. As people join and leave the project, or work from alternate (often temporary) locations, I find myself constantly ...
- 319
0
votes
2
answers
1k
views
Nested AD Groups RDP permission not applying to new Windows Server 2019 VM
Similar Issue with no responses: Nested AD groups working in local computer groups, but certain servers fail to allow RDP?
I am only new to this environment and the person I took this over from also ...
- 1
0
votes
0
answers
744
views
AWS ELB(classic load balancer) response is too slow and sometimes response is not coming it is showing timed out
I have EKS cluster setup in private subnet in which i'm having my microservices and for each microservice i have classic load balancer to access API. But response is having high latency and sometimes ...
- 21
11
votes
2
answers
2k
views
What is a secure and user-friendly way to provide only a few users access to web app on Amazon EC2?
Situation
We have a web app hosted on Amazon EC2. It's intended to be used only by a few users in a company.
How we're dealing with this
We share the (Elastic) IP address of the instance with the ...
- 211
3
votes
2
answers
19k
views
Why am I getting "Connection refused"?
I am running a hello-world http server on an ubuntu EC2 instance, let's say, myurl.com. I am unable to curl it from my client:
$ curl myurl.com:4296
curl: (7) Failed to connect to ...
- 139
0
votes
2
answers
1k
views
bulk removing direct access to a folder via PowerShell ACL
On a number of the servers where I work the share folder permissions have become cluttered with direct permissions for some of our techs due to them needing to take ownership. I have figured out how ...
- 1
2
votes
2
answers
541
views
Add domain users to a group of security groups via group policy
Is there a way to add domain users to a collection of security groups via group policy? We have some SSO groups that all employees share. Instead of tech support person having to manually add new user ...
- 21
3
votes
1
answer
393
views
Windows - Group Policy - Numerous Share Drives w/ Item-Level Targeting
Overview
We have been working on getting our numerous sites to map share drives for each user that needs access to their sites. We have no way of standardizing this from within their AD profile as ...
- 31
1
vote
1
answer
346
views
Why don't Windows domain machines periodically query security group membership, like other things? [closed]
When I was in lower tier support (and sometimes still), one of the most annoying sequences of events was a request for new file permissions >> add user to security group and specify in the reply ...
- 185
1
vote
2
answers
2k
views
Link a GPO to an OU or security group, Who will win?
Here's the scenario:
A GPO is linked to an OU to enable, for example, UAC setting.
However, since there are certain systems that require UAC to be disabled, there is a GPO that disables these settings....
- 11
0
votes
3
answers
3k
views
Is there a way to export all AWS Security Groups to CSV? moreover, is there a recommended way of keeping track of SR changes?
We have a relatively small dev environment in AWS with about 50 Security groups with multiple permission entries. is there a recommended way of keeping track of SR changes, Access, etc?
My manager ...
1
vote
1
answer
2k
views
How to Apply Egress rules to Default Security Group - AWS
I would like to apply port 443 outbound rule to the 'Default' security group. It worked by creating a dedicated block OutboundRule (which is commented out). Instead of creating a new block, I want to ...
- 143
2
votes
0
answers
73
views
Windows Domain Group Membership Not Promulgating Fully to Workstation
Perhaps I should ask 2 or three questions but since these are all related, here they are:
Situation: Multiple Windows 2019 Standard DCs synchronized. Windows 10 Pro workstations joined to the domain....
- 21
0
votes
1
answer
1k
views
PowerShell - Remove User/Group from Security Permissions
I have an AD group called "Admins" and it has specific members but under the Security Tab, how can I use Powershell to remove certain users/groups from the Security list and/or modify the ...
- 1
0
votes
1
answer
193
views
Adding a security group to AD user account using PowerShell
I am trying to build a PowerShell command that it will add a security group (not on Member Of) with full control permissions in AD user in order avoid doing it manually by hand. Is it possible ?
This ...
0
votes
1
answer
390
views
Looking for a good explanation of how AWS Security groups behave
I'm struggling to get my head round port ranges described by AWS Security Groups and how they behave. I'm a software developer with many years of experience writing networking software so it's ...
- 1,692
1
vote
1
answer
700
views
GPO and Security Groups in multiple domain
I have 2 forests, each with one domain with a bidirectional trust.
I have created security groups in forest A, to access folders, where I have added both users from forest A and B, the accesses are ...
- 13
0
votes
1
answer
211
views
Need of distribution groups in active directory
I know the basic purpose of security group and distribution group in active directory. The security group is used to access the network resource and distribution group is used to send distribution ...
0
votes
1
answer
2k
views
ec2 instance will not allow connections to port from within instance after opening port on security group
I have an EC2 instance on a security group that allows ports 80, 443 and 22 (tcp, inbound from 0.0.0.0/0 and ::/0); and every outbound connection (to 0.0.0.0/0 & ::/0, all tcp & udp).
I've ...
- 277
1
vote
1
answer
353
views
Active Directory - grant access rights to a user that belongs to multiple groups
I have a Windows 2012 Server with file server role.
I have users in my active directory which are defined by 3 things : country - service - role
I have about 10 countries, 10 services and 5 roles.
How ...
- 11
1
vote
1
answer
90
views
ec2 permissions to manage only firewall access
I'd like to allow some developers to manage firewall rules, specifically rules in ec2 security groups, (or some of them ideally) so that they can, eg, update their changing IP addresses to access ...
- 111
1
vote
1
answer
345
views
AWS EC2 access attempts on blocked ports
I have recently installed OSSEC on a RHEL 8 server being hosted on AWS EC2. Since then I have been receiving brute force attempts and other attempts on ports that are not open in my security group.
...
- 113