253 votes

How to view all ssl certificates in a bundle?

http://comments.gmane.org/gmane.comp.encryption.openssl.user/43587 suggests this one-liner: openssl crl2pkcs7 -nocrl -certfile CHAINED.pem | openssl pkcs7 -print_certs -text -noout It indeed worked ...
166 votes

Does drilling a hole into a hard drive suffice to make its data unrecoverable?

Drilling a hole in the drive enclosure which passes through all the platters will make it impossible to run the drive. Most modern HDDs don't have air inside the enclosure, and you've let what was in ...
MadHatter's user avatar
  • 79.8k
110 votes

A previous IT worker probably left some backdoors. How can I eliminate them?

The only way to be absolutely certain is to wipe every system clean and to reinstall from scratch. You will also need to audit all of the locally generated software and configurations to ensure that ...
user9517's user avatar
  • 116k
106 votes

What kinds of security vulnerabilities does providing DNSSEC expose?

DNSSEC has some risks, but they are not directly related to reflection or amplification. The EDNS0 message size expansion is a red herring in this case. Let me explain. Any exchange of packets that ...
Paul Vixie's user avatar
  • 1,164
83 votes

Are zipped EXE files harmless for Linux servers?

If they are indeed zipped Windows exe files, they should be harmless to your Linux system, unless you have something like Wine in place that could try to execute them. But if they are in your web ...
Sven's user avatar
  • 98.8k
82 votes

How to use docker secrets without a swarm cluster?

Yes, you can use secrets if you use a compose file. (You don't need to run a swarm). You use a compose file with docker-compose: there is documentation for "secrets" in a docker-compose.yml file. ...
Lindsay-Needs-Sleep's user avatar
81 votes

Why does AWS recommend against public S3 buckets?

Yes, if you know what you're doing (edit: and everyone else with access to it does, too...), you can ignore this warning. It exists because even large organizations who should know better have ...
ceejayoz's user avatar
  • 32.9k
78 votes

How to check if an RSA public / private key pair match

Depending on where you get the public key file you are testing, the accepted answer may give false positive results. This is because of the behavior described in the comment by @drewbenn. Specifically,...
twildfarmer's user avatar
64 votes

Redis (error) NOAUTH Authentication required

1. redis-cli 2. auth yourpassword 3. shutdown 4. sudo service redis_6379 start
Farid Movsumov's user avatar
64 votes

Windows XP PCs in company network

is it necessary from security point-of-view, to replace these XP-PC's with new PC's. No, it's not necessary to replace the PCs. But it is necessary to upgrade those operating systems (this may also ...
Mark Henderson's user avatar
62 votes

Are zipped EXE files harmless for Linux servers?

Since I'm able to uncompress the files on my mac I assume these are real zip files and not just something like renamed php files. While you're probably right in this case, your assumption might not ...
Ilmari Karonen's user avatar
56 votes

Prevent SSH from advertising its version number

While it's prohibitively difficult to hide the version number of your SSH daemon, you can easily hide the linux version (Debian-3ubuntu4) Add the following line to /etc/ssh/sshd_config DebianBanner ...
Harrison Powers's user avatar
54 votes

Good idea? Refuse incoming emails with our own domain ending? (because they must be fake)

Yes, if you know that email for your domain should only be coming from your own server, then you should block any email for that domain originating from a different server. Even if the sender's email ...
DKing's user avatar
  • 826
50 votes

How can I stop ansible from writing passwords to the logfiles?

To prevent a task with confidential information from being logged, in syslog or other, set no_log: true on the task: - name: secret stuff command: "echo {{secret_root_password}} | sudo su -&...
Bill Carlson's user avatar
50 votes

Linux: productive sysadmins without root (securing intellectual property)?

Everything said so far here is good stuff but there is one 'easy' non technical way that helps negates a rogue sys admin - the four eyes principle which basically requires that two sysadmins be ...
Tim Brigham's user avatar
  • 15.6k
49 votes

How do I check if Log4j is installed on my server?

Try this script to get a hint: echo "checking for log4j vulnerability..." OUTPUT="$(locate log4j|grep -v log4js)" if [ "$OUTPUT" ]; then echo "[WARNING] maybe ...
rubo77's user avatar
  • 2,499
45 votes

Does drilling a hole into a hard drive suffice to make its data unrecoverable?

The security policy for many companies is to universally physically destroy all data carriers, so plain old paper documents and prints, spinning hard disks, SSD's etc. all get shredded before they ...
HBruijn's user avatar
  • 77.4k
44 votes

Weird SSH, Server security, I might have been hacked

The ClamAV signature for Unix.Trojan.Mirai-5607459-1 is definitely too broad, so it's likely a false positive, as noted by J Rock and cayleaf. For example, any file that has all of the following ...
nomadictype's user avatar
44 votes

Why does AWS recommend against public S3 buckets?

The privacy issue featured in ceejayoz's answer is not the only problem. Reading objects from an S3 bucket has a price. You will be billed by AWS for each download from this bucket. And if you have a ...
Quentin Hayot's user avatar
42 votes

Potential hijacked SSH session & SSH best practices

The root logins are probably dangling shell sessions that once were you. Your server is also probably getting dDOS'd with all the attempted logins hammering it. Lock down SSH. Don't allow root login, ...
Spooler's user avatar
  • 7,056
41 votes

Allow linux root user mysql root access without password

For mysql 5.7+, if you set empty password for the initial setup, mysql will automatically use auth_socket as a strategy. An attempt to update password without change the strategy will have no result. ...
chaintng's user avatar
  • 519
41 votes

How can SSL be on port 110?

Port 110 is the default port for POP3, which historically is a clear text protocol but which has been extended to support STARTTLS to negotiate and upgrade to an encrypted connection over that clear ...
HBruijn's user avatar
  • 77.4k
41 votes

A previous IT worker probably left some backdoors. How can I eliminate them?

First, the most important goal of a fired sysadmin is to clean up his past, particularly if it was a departure in bad standing. If an attack on his previous system were to happen he wouldn't stand to ...
peterh's user avatar
  • 4,953
40 votes

Cannot SSH: debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY

In my case, I have no permission to lower the MTU size. And manually specifying the Cipher does not work. I am able to connect after shortening the MACs list by specifying one, e.g.: ssh -o MACs=...
Lacek's user avatar
  • 528
40 votes

Why would a university block incoming UDP traffic with destination port 53?

The logic works like this: Only authoritative DNS servers that provide records to the internet are required to be exposed. Open recursive servers that are exposed to the internet will inevitably be ...
Andrew B's user avatar
  • 32.7k
40 votes

Network printer exploited (read: hacked) to print antisemitic documents. How to fix?

This attack disproportionately affected universities because, for historical reasons, many universities use public IPv4 addresses for most or all of their network, and for academic reasons have little ...
Michael Hampton's user avatar
40 votes

Is there any reason to allow SMB over the internet?

SMB is a file sharing protocol and, as such, it is sometime left open to the internet for, well, sharing files. However, this is a very bad idea. Compared to simpler protocol as FTP or WebDAV, which ...
shodanshok's user avatar
39 votes

Why was I able to delete a file owned by root in my home directory without being root?

The permissions, content and all attributes are part of the inode. The name is in the directory entry. The permissions are not inherited recursively (except when you use default in Posix ACLs). When ...
Mircea Vutcovici's user avatar
37 votes

Redis (error) NOAUTH Authentication required

Setting the requirepass configuration directive causes the server to require password authentication with the AUTH command before sending other commands. The redis.conf file states that clearly: ...
Itamar Haber's user avatar
37 votes

How can I stop the Windows Recovery Environment being used as a back door?

You can use reagentc to disable WinRE: reagentc /disable See the Microsoft documentation for additional command-line options. When WinRE is disabled in this way, the startup menus are still ...
Harry Johnston's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible