253
votes
How to view all ssl certificates in a bundle?
http://comments.gmane.org/gmane.comp.encryption.openssl.user/43587 suggests this one-liner:
openssl crl2pkcs7 -nocrl -certfile CHAINED.pem | openssl pkcs7 -print_certs -text -noout
It indeed worked ...
166
votes
Accepted
Does drilling a hole into a hard drive suffice to make its data unrecoverable?
Drilling a hole in the drive enclosure which passes through all the platters will make it impossible to run the drive. Most modern HDDs don't have air inside the enclosure, and you've let what was in ...
- 79.8k
110
votes
A previous IT worker probably left some backdoors. How can I eliminate them?
The only way to be absolutely certain is to wipe every system clean and to reinstall from scratch. You will also need to audit all of the locally generated software and configurations to ensure that ...
- 116k
106
votes
Accepted
What kinds of security vulnerabilities does providing DNSSEC expose?
DNSSEC has some risks, but they are not directly related to reflection or amplification. The EDNS0 message size expansion is a red herring in this case. Let me explain.
Any exchange of packets that ...
- 1,164
83
votes
Accepted
Are zipped EXE files harmless for Linux servers?
If they are indeed zipped Windows exe files, they should be harmless to your Linux system, unless you have something like Wine in place that could try to execute them.
But if they are in your web ...
- 98.8k
82
votes
How to use docker secrets without a swarm cluster?
Yes, you can use secrets if you use a compose file. (You don't need to run a swarm).
You use a compose file with docker-compose: there is documentation for "secrets" in a docker-compose.yml file.
...
81
votes
Accepted
Why does AWS recommend against public S3 buckets?
Yes, if you know what you're doing (edit: and everyone else with access to it does, too...), you can ignore this warning.
It exists because even large organizations who should know better have ...
- 32.9k
78
votes
How to check if an RSA public / private key pair match
Depending on where you get the public key file you are testing, the accepted answer may give false positive results. This is because of the behavior described in the comment by @drewbenn. Specifically,...
- 891
64
votes
Redis (error) NOAUTH Authentication required
1. redis-cli
2. auth yourpassword
3. shutdown
4. sudo service redis_6379 start
- 749
64
votes
Windows XP PCs in company network
is it necessary from security point-of-view, to replace these XP-PC's with new PC's.
No, it's not necessary to replace the PCs. But it is necessary to upgrade those operating systems (this may also ...
- 68.9k
62
votes
Are zipped EXE files harmless for Linux servers?
Since I'm able to uncompress the files on my mac I assume these are real zip files and not just something like renamed php files.
While you're probably right in this case, your assumption might not ...
- 905
56
votes
Prevent SSH from advertising its version number
While it's prohibitively difficult to hide the version number of your SSH daemon, you can easily hide the linux version (Debian-3ubuntu4)
Add the following line to /etc/ssh/sshd_config
DebianBanner ...
- 661
54
votes
Good idea? Refuse incoming emails with our own domain ending? (because they must be fake)
Yes, if you know that email for your domain should only be coming from your own server, then you should block any email for that domain originating from a different server. Even if the sender's email ...
- 826
50
votes
How can I stop ansible from writing passwords to the logfiles?
To prevent a task with confidential information from being logged, in syslog or other, set no_log: true on the task:
- name: secret stuff
command: "echo {{secret_root_password}} | sudo su -&...
- 501
50
votes
Linux: productive sysadmins without root (securing intellectual property)?
Everything said so far here is good stuff but there is one 'easy' non technical way that helps negates a rogue sys admin - the four eyes principle which basically requires that two sysadmins be ...
- 15.6k
49
votes
Accepted
How do I check if Log4j is installed on my server?
Try this script to get a hint:
echo "checking for log4j vulnerability..."
OUTPUT="$(locate log4j|grep -v log4js)"
if [ "$OUTPUT" ]; then
echo "[WARNING] maybe ...
- 2,499
45
votes
Does drilling a hole into a hard drive suffice to make its data unrecoverable?
The security policy for many companies is to universally physically destroy all data carriers, so plain old paper documents and prints, spinning hard disks, SSD's etc. all get shredded before they ...
- 77.4k
44
votes
Weird SSH, Server security, I might have been hacked
The ClamAV signature for Unix.Trojan.Mirai-5607459-1 is definitely too broad, so it's likely a false positive, as noted by J Rock and cayleaf.
For example, any file that has all of the following ...
- 461
44
votes
Why does AWS recommend against public S3 buckets?
The privacy issue featured in ceejayoz's answer is not the only problem.
Reading objects from an S3 bucket has a price. You will be billed by AWS for each download from this bucket. And if you have a ...
- 553
42
votes
Accepted
Potential hijacked SSH session & SSH best practices
The root logins are probably dangling shell sessions that once were you. Your server is also probably getting dDOS'd with all the attempted logins hammering it.
Lock down SSH. Don't allow root login, ...
- 7,056
41
votes
Allow linux root user mysql root access without password
For mysql 5.7+, if you set empty password for the initial setup, mysql will automatically use auth_socket as a strategy. An attempt to update password without change the strategy will have no result. ...
- 519
41
votes
How can SSL be on port 110?
Port 110 is the default port for POP3, which historically is a clear text protocol but which has been extended to support STARTTLS to negotiate and upgrade to an encrypted connection over that clear ...
- 77.4k
41
votes
A previous IT worker probably left some backdoors. How can I eliminate them?
First, the most important goal of a fired sysadmin is to clean up his past, particularly if it was a departure in bad standing. If an attack on his previous system were to happen he wouldn't stand to ...
- 4,953
40
votes
Cannot SSH: debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
In my case, I have no permission to lower the MTU size. And manually specifying the Cipher does not work.
I am able to connect after shortening the MACs list by specifying one, e.g.:
ssh -o MACs=...
- 528
40
votes
Accepted
Why would a university block incoming UDP traffic with destination port 53?
The logic works like this:
Only authoritative DNS servers that provide records to the internet are required to be exposed.
Open recursive servers that are exposed to the internet will inevitably be ...
- 32.7k
40
votes
Accepted
Network printer exploited (read: hacked) to print antisemitic documents. How to fix?
This attack disproportionately affected universities because, for historical reasons, many universities use public IPv4 addresses for most or all of their network, and for academic reasons have little ...
- 244k
40
votes
Is there any reason to allow SMB over the internet?
SMB is a file sharing protocol and, as such, it is sometime left open to the internet for, well, sharing files.
However, this is a very bad idea. Compared to simpler protocol as FTP or WebDAV, which ...
- 48k
39
votes
Accepted
Why was I able to delete a file owned by root in my home directory without being root?
The permissions, content and all attributes are part of the inode. The name is in the directory entry. The permissions are not inherited recursively (except when you use default in Posix ACLs).
When ...
- 17.7k
37
votes
Accepted
Redis (error) NOAUTH Authentication required
Setting the requirepass configuration directive causes the server to require password authentication with the AUTH command before sending other commands. The redis.conf file states that clearly:
...
- 894
37
votes
Accepted
How can I stop the Windows Recovery Environment being used as a back door?
You can use reagentc to disable WinRE:
reagentc /disable
See the Microsoft documentation for additional command-line options.
When WinRE is disabled in this way, the startup menus are still ...
- 6,005
Only top scored, non community-wiki answers of a minimum length are eligible