Hot answers tagged

6

This is normal. Knowing that a resource in a corporate environment exists is generally not a security problem. Don't try and "fix" this.


5

The glue records for the nameservers in use do not match the authoritative records. If we look at the tail end of dig +trace +all output, this is clearly visible: $ dig +trace +all bazar9.pk NS ; <<>> DiG 9.11.14-RedHat-9.11.14-2.fc31 <<>> +trace +all bazar9.pk NS [snip] ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, ...


4

The .local is assigned as a Special-Use Domain Name by IANA, as it's used by Multicast DNS (RFC 6762, 3). RFC 2606 specifies .test, .example, .invalid and .localhost for testing & documentation examples. Therefore, they should never be registered as official TLDs, but they do have some special purposes, as described in RFC 6761, 6. I wouldn't use .lan ...


3

Either your registrar or you misconfigured the NS records. ns1.aland.net is one of .ax authoritative nameservers: piotr@bialykiel:~$ dig @ns1.aland.net domain.ax NS ;; AUTHORITY SECTION: domain.ax. 86400 IN NS cns2076.hostgator.com. domain.ax. 86400 IN NS cns2075.hostgator.com. domain.ax. 86400 IN NS ns1.parkingcrew.net. There is ...


3

Old question, but the answers are not particularly accurate. Windows doesn't especially care whether your computer is domain joined or not. The domain join in this stage of authentication is really just a hint to tell the client what domain it maybe should try contacting if enough information isn't present. The way Kerberos auth works is it takes a look at ...


3

An entry of type: alias.example.com. CNAME canonical.example.com. means that all records for alias should be fetched from canonical. If you are looking for alias's MX record, you should retrieve canonical's MX record instead. Therefore mostly all other records for alias will be ignored. This behaviour is semantic, not technical. You can still ask for ...


3

Do like most business IT environments (https://serverfault.com/help/on-topic): Set up an internal DNS service that points your domain names at the local addresses of the services you present. Everything on your network will find the shortest path without manual management of local hosts files.


3

A domain is essentially an entry in the DNS database (e.g. ., net., example.com.). A subdomain is a domain with an additional label (e.g. org., example.net., www.example.com.). On top of this people add some semantics. So: A subdomain may indicate different services offered by an organization: e.g. example.com may offer www.example.com, smtp.example.com, ...


3

DNS is a database organized as a tree. A subdomain is a name contained within a parent name, for example meta.serverfault.com. is a subdomain of serverfault.com.. A fully qualified domain name includes the top level domain and the (zero length) root. So, www.example.com. is a FQDN. Often it is convenient to have DNS resolvers search the local domain. So ...


3

The dual question would be : how these businesses survive? An excellent question. Do your own research on the organization's business model and finances. It costs money to provide (or resell) competent name registration and DNS services. Although, it might be cheap enough relative to the rest of their hosting services to bundle it for "free". Do not-self-...


3

Perform your own message trace from the Security and Compliance center and verify that the email originated from your Office 365 tenant. Look at the sign-ins logs in Azure AD for suspicious sign-ins. Look at the Risky users, Risky sign-ins, and Risk detection logs in Azure AD and look for suspicious activity. Create a Display Name Spoofing transport rule ...


2

This will not be an easy answer as there are a lot of things to consider. But there are few key arguments within your post. .. as they want each hotel to be standalone so that when it gets sold to a new owner there is no additional work needed to be done. This is a valid point and there will be no easy way to do this in one domain. Even in one forest ...


2

As Bjoster pointed to at the end, you're now to a point where logging becomes very important. I just tried spinning an SMTP message to your test1@ account, and your server responded with a 250 (everything worked) message. Are you still having trouble receiving messages? If so, it is going to be something internal to your transport pipeline. The good news ...


2

On ASI-EX01.advsystems.com (mail.advsystems.com) I can see this error: 451 4.7.0 Temporary server error. Please try again later. PRX2 PRX errors can have multiple causes. In most cases I have seen, I found somehow conflicting or wrongly configures Transport Agents and/or Connectors. But there are other reasons. This (most probably incomplete) list should ...


2

This isolated architecture that we have inherited creates a substantial overhead for helpdesk and on-site staff First and foremost, your clients should be isolated from each other, and from you. The incurred overhead is your cost of doing business. That's what it means to be an MSP. This as presented is a bad idea. You should not attemp to create Forest/...


2

This is not currently possible. SSH does not currently support srv records. There are some proposed patches that do so, but they are not part of mainstream repositories. (You could perhaps alias sshsrv to ssh.). Presumably you're looking for something more portable than specifying Port in your local ~/.ssh/config, which could work for anything that shared ...


2

Do this instead ServerName mydomain.de ServerAlias *.mydomain.de


2

Yes, it makes sense and is a common practice I have encountered in multiple organizations. It helps in separation of production and development environments in particular when infrastructure as code is implemented. Further you need a dedicated domain name for development when you want to be able to test the configuration of proxy servers.


2

This automated config by Certbot isn't very suitable for your needs. Change HTTP to HTTPS redirection block to this one: server { listen 80; listen [::]:80; server .domain.com; return 301 https://$http_host$request_uri; } Make the following changes to your HTTPS block: use server .domain.com; instead of server domain.com; (this ...


2

The question is not easy to understand, as noted in the question comments, but it seems the issue is with DNS resolution on the client. This is most likely due to one of three reasons. Nameserver entries at your DNS registrar are wrong. If your client is using a public DNS resolver (e.g. Google, Cloudflare) they will ultimately check the nameservers ...


2

Can you do that? Yes you can. What happens? ~50% of all visitors that tries to visit your website will either visit SERVER-A or SERVER-B. It is called "Round Robin DNS". https://en.wikipedia.org/wiki/Round-robin_DNS


1

Dev people should be able to tell you where exactly it is failing but I'm going to assume its security of the folder within WindowsApps. Try to run the app with elevated rights and see if that works. If yes, then I'd say the app isn't correctly developed as users can't usually write into Program Files but can into ProgramData where any application ...


1

AD has no mechanism to distribute passwords to multiple users in policies directly. It is highly insecure. With the caveat that sharing an account/password is not a good idea you could write a script to add an account and password to a users password vault and deploy the script in AD policy for a one time run. There is a secure workflow to distribute ...


1

I am trying to go through this step by step. Almost any (sane) server software has a adress scope to listen to. If the server is configured to answer to requests only from it's own subnet (which is the default in many cases), it will not answer to requests from WAN. As long as you don't hack around with a two-sided-NAT implementation on your firewall (which ...


1

If you query a single label name, Windows appends the DNS suffixes and queries each fully-qualified name in order.


1

Theoretically, you can, but not without a lot of effort. Supposedly, you are running an HTTP/2 capable website. Detecting proxy_pass to your website can build upon the fact that these connections will always originate over HTTP/1.x and never via HTTP/2. Then you can match that up with browser capabilities. So, essentially, if you see an HTTP/2 capable ...


1

DNS setup: type name content MX @ 10 box.myDomain.com. A box x.x.x.x Then test it with https://mxtoolbox.com/


1

My interpretation of your question is that you have set up an Active Directory with internal DNS as per the requirements, and you have added the name of your website/web server to your internal DNS. However, when you attempt to find your web server externally, the name does not resolve. Is this correct? In most cases smaller setups don't present their ...


1

each hotel has its own domain ... There are no trusts between domains.. This is not a scalable AD architecture. Even if they did approve and fund it, which seems unlikely, I'm inclined to think that converting this would be beyond the organization's capability and appetite for change. When the decision was made for the current architecture, they ...


1

HSTS headers force the user agent to use HTTPS for some length of time. And yes, the browser never attempts a HTTP connection, only HTTPS. You used a domain parking service, or some other web server that sent Strict-Transport-Security. Downgrading to HTTP is specifically what this does not allow. Get TLS working correctly on your domain names. If you must ...


Only top voted, non community-wiki answers of a minimum length are eligible