25
votes
Accepted
Should you encrypt data between 2 servers in the cloud?
Should you encrypt data between 2 servers in the cloud?
Yes.
Modern security thinking is that you don't consider your own network / datacenter as more trusted (than your WAN or the regular internet)....
- 1,791
14
votes
How dangerous might it be - and what performance gains may be had - by turning vulnerability mitigations off on non-Internet facing servers?
The Linux kernel flag mitigations=[on|off] is a single toggle to easily enable/disable all available kernel mitigations for hardware vulnerabilities as listed here https://docs.kernel.org/admin-guide/...
- 1,791
10
votes
Accepted
DigitalOcean Network Firewall allowing SSH connections on ports other than only 22
Services are listening on certain port, e.g. sshd on port 22 by default. It means that if there is ssh client request to establish connection on the port other than 22 it would not be heard by the ...
- 179
8
votes
Accepted
How to log executions of specific commands on Linux no matter where it came from?
You can use auditd and monitor file operations/system calls to remove files/directories. The rules will be something like:
-a exit,always -S unlink -S rmdir -k Remove_dir_file
Of course you can add ...
- 5,338
7
votes
DigitalOcean Network Firewall allowing SSH connections on ports other than only 22
First of all, your ssh daemon is not listening on any port but 22. So noone can connect to it on a port different from port 22. For a connection to succeed, it has to be allowed by firewall, and ...
- 6,840
6
votes
Any security reason not to use `root` user for git remote operations?
There's no reason to use git as root. There is no functionality in git that requires superuser privileges.
You should only use superuser privileges when required. Even though the risk of a ...
- 6,840
5
votes
Should you encrypt data between 2 servers in the cloud?
Depending on the stakes, one could not label "trusted" a physical network that is not physically visible end-to-end.
For a human with an average vision this amounts to a cable between two ...
- 624
4
votes
Should you encrypt data between 2 servers in the cloud?
From security point of view is reasonable to secure the connections if they leave datacenter/service provider. This can be done by adding SSL/TLS to both parties. Also you can establish mutual ...
- 5,338
4
votes
How to show a password-containing automated generated image, whose "content" is "copyable"?
Simple.
Don't do that. Don't store passwords in a MediaWiki. Don't show them on screen. Don't think that rendering text as images makes it more secure.
There are a multitude of tools which are ...
- 11.3k
4
votes
Redirect OR warn (during initial negotiation) SMTP submitters to use TLS on port 587 - leave 25 explicitly blocked by firewall for better security
Is there a way to indicate that to a requesting client/scanner/MTS server that SMTP requires TLS on port 587
Assuming MTS is a typographic error and you meant MTA.
587 is not secure SMTP, 587 is ...
- 826
3
votes
EXSi Arg Server attack
Those servers were exposed to the internet. ESXi servers should never be exposed to internet and stay behind firewall. Check for more information: https://www.bleepingcomputer.com/news/security/new-...
- 5,445
3
votes
What can you do when auditd halts the system?
auditd is a Linux thing, of course.
Your organization should decide what action is appropriate should auditd decide it is critically out of space. Some environments value watching for security or ...
- 32.1k
2
votes
How to use docker secrets without a swarm cluster?
Yes (but actually No)
No Currently Docker doesn't support config & secrets if you're not in a swarm
But the docker compose specs have configs & secrets compose specs
So How does it works ?
It ...
- 121
2
votes
Is it safe to allow any user to see the status of all services?
All your listed systemctl commands (status, is-enabled, is-active) can be invoked by any regular user, no root necessary.
You don't need sudo here.
- 23.5k
2
votes
Are there any additional security considerations to be taken into account when activating IPv6 as opposed to IPv4?
Can I use my IPv4 knowledge (and the basics mentioned above) to securely make an Internet service available to the public via IPv6
Yup, definitely.
There is, however, one major security consideration ...
- 8,700
2
votes
How dangerous might it be - and what performance gains may be had - by turning vulnerability mitigations off on non-Internet facing servers?
is the server really impossible to connect to even indirectly from outside your network?
That's the first question you should ask yourself. If the LAN can be accessed from a machine that has 2 network ...
- 141
2
votes
Accepted
Encryption type requested is not supported by the KDC
The november security updates introduced bugs in kerberos that may be the reason for this behavior. You should install the out-of-band updates on your DCs that are meant to correct those. I had ...
2
votes
fail2ban - one IP banned multiple times by multiple jails - errors in log durin unbanning
Apart from log noise, there's nothing to fix. Functionally the objective is being achieved. However I would be concerned that an unban operation was applied to any occurrence of the IP address rather ...
- 21.6k
2
votes
Accepted
I cannot find where 0002 umask is being set on Ubuntu 20.04
In Ubuntu 18.04 LTS, umask 0002 is the default for regular users.
It is defined in /etc/login.defs, but the definition is in two parts.
First, the UMASK setting determines the initial umask for both ...
- 4,488
2
votes
Hardening the security of a backup shell script of a web-server with mysql database
You could run the rsync from the NAS machine. The NAS will connect over ssh to the web server and run the rsync. In this way your web server has no access to the NAS.
- 17.9k
2
votes
Best way to handle directory/path traversal attacks on a Nginx http site
This isn't an attack, just a (likely automated) search for common files that might reside in the web root, similar to how a port scan is used to check for open ports. This is neither unusual nor ...
- 146
2
votes
Accepted
Strange attempted emails from Cron
There is nothing strange. The command check if you have /usr/sbin/anacron and if file do not exist or not executable run run-parts for daily cron. And usually cron send mail to root with the job ...
- 5,338
2
votes
Splitter switch with multiple network
Your network diagram is flawed. The way you must do it is simply by defining all the VLAN/LAN and it's the firewall on the top of the pyramid that decide, with the rule you set, what can talk over to ...
- 16.8k
2
votes
Change certificate issuer
In terms of certificate path validation, a CA is identified by the unique combination of its Subject Name and its Public Key. If you change either, it is a different certificate.
Administratively, a ...
- 4,584
2
votes
Accepted
sudo file in sudoers - why user can modify file?
The owner of the parent directory cannot edit the file, but can remove & recreate it:
Removal:
$ ls -aslh
total 8,0K
4,0K drwxr-xr-x 2 user user 4,0K 17. 7. 12:35 .
4,0K drwxr-xr-x 6 user user 4,...
- 47.4k
2
votes
Accepted
Email account to use for company domain registration account?
There is a little catch-22 when you initially register a domain example.com : often the registrar will send emails to the person doing the registration and when you use [email protected] to sign up ...
- 77.5k
2
votes
Accepted
IIS 10 - IP Address And Domain Restrictions is denying all traffic
At Edit Feature Settings... you can set the option Access to unspecified clients: to Deny and remove the lower entry.
- 854
1
vote
How to restrict local admin from disbaling or changing firewall setttings
Local Admins can, if they want, overcome all windows-internal restrictions and shutdown GPO processing. So either you trust your admins, yor you need 3rd party software to restrict that.
1
vote
What to look for when searching for HIPAA Hosting Server?
Your organization (or your client) needs a compliance person, someone who learns the regulations. And a leader in charge of developing and improving an IT security program. Customizing controls to fit ...
- 32.1k
1
vote
Office administrative department requesting "admin" namespace
Since emails are not easily reassigned, they can only get a new handle. Two mechanism to get there:
Concede that "admin" is a terribly ambiguous term because every "task" implies ...
- 9,048
Only top scored, non community-wiki answers of a minimum length are eligible