Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

New answers tagged

1

I looked for so long too. I figured out the answer! To check the current state : auditpol /get /subcategory:"Process Creation" This next line will make the change. It will set the process creation to Enabled. auditpol /set /subcategory:"Process Creation" Check the state again and you'll see the change. Alternatively, you could change all of the "detail ...


0

It makes little difference. The docker-compose command connects to the docker.sock, aka docker's API, to run all container commands. By default, this API is only accessible to the root user on linux, so you often see people running commands with sudo. You can configure docker to allow non-root users to access this API, just be sure you trust these users ...


1

r00tusr! I vote for always running containers as regular users. In a production system your containers won't be run as root. Even in non-production systems, the users who run your container might not be allowed to run programs as root. So I like to make them work properly as an unprivileged user, even when it's difficult. Also, there's the security ...


1

Use a certificate authority you trust to sign x509 certificates. Put the resulting cert and its key on the web server where you terminate TLS. For nginx, see the ssl_certificate directive. For docker registry, see the tls: directive. Using CA signed certs does not imply use of Let's Encrypt; neither does the inverse. Use of other PKI is possible, ...


0

You are missing the SAN record in the certificate. Generate certificate again with the following commands: basename=/etc/elk-certs/monitoring-example-com openssl req -newkey rsa:4096 -nodes -keyout $basename.key -subj "/CN=monitoring.example.com" -out $basename.csr openssl x509 -req -extfile <(printf "subjectAltName=DNS:monitoring.example.com") -...


1

The notion of an internet-facing port being "private" is somewhat dubious. Without encryption, the traffic can be sniffed. Communications between servers could be vulnerable to a man in the middle attack. There are multiple methods by which an attacker can spoof an IP address, and this might allow them to send malicious packets to either of the servers. ...


3

You can use semanage boolean --list | grep nis to find a brief description on what it does and its status. # semanage boolean -l | grep nis nis_enabled (off , off) Allow nis to enabled varnishd_connect_any (off , off) Allow varnishd to connect any You can find all the documentation here.


0

The following command works against a Windows 10 machine: wmic /user:"DOMAIN\AdminUser" /node:"computername" computersystem get totalphysicalmemory I have had issues with wmic where I have the parameters in a different order and it fails. The exact command above (substituting real values for 'DOMAIN', 'AdminUser', and 'computername') works. There is a ...


0

I'm not aware of any way to tell Windows that you want your service process, or any other process for that matter, to always be given a non-standard security descriptor. There would be no obvious sensible use for this functionality, and Microsoft generally try to avoid adding useless functionality. Perhaps you have some edge case (though I can't imagine ...


0

As commented on Security.SE: You can't. Palo Alto and OpenVPN doesn't use the same VPN protocol. They're both SSL VPNs, which is a broad family of protocols, sharing a common encryption layer. To connect to a Palo Alto VPN, you may use Openconnect which is a client that supports PA with correct configuration.


1

You will get all kinds of garbage requests on the Internet, trying to identify what your service is and maybe trying vulnerabilities. If you don't know what to do, hire someone who does. Maybe for a one time engagement to check this app and give you advice. Ideally they have experience in this particular platform, and maybe penetration testing web apps in ...


2

FreeBSD security/libressl was recently upgraded to 2.9.1. OCSP stapling has stopped working in nginx for me as well since the version change in LibreSSL, so I'm assuming there is an underlying issue in the library or nginx' interaction with it. Edit: In the meantime, Elias Ohm has analyzed this in more detail on the FreeBSD bug tracker. TL;DR: It's an nginx ...


2

Decide if you will be managing a local repo of updates. Which would allow for more control of both when updates happen and what gets Internet access. You probably want to use GCP's mirror, us-central1.gce.archive.ubuntu.com (replace us-central1 with your region). Configure firewall to allow egress from the downloading systems. IPs and not names, but a ...


1

There never was a need to use an encrypted tunnel. Previously you could set up a PKI (CA certificate and server certificates together with some amount of configuration) to configure TLS with certificates. This is still a valid option for Bareos 18.2 and it will provide encryption on all communication channels. However, previously the default has been to run ...


3

rrsync is designed to be used as a forced command for a particular key, so it should be exactly what you want. A forced command is set up using the command option for a key in an authorized keys file and is then always run whenever this key is used for authentication, no matter what command the client requested. But it has access to the requested command so ...


2

I suggests to use a different user by user on Web server (see Apache-ITK). This will allow each user to not browse all the names and go in the other users. You must think also about CPU and RAM : you will maybe forced to use a limit by user. Concerning disks, quotas are welcome. Don't forget the max execution time to not allow them to run every time ...


0

In your /etc/httpd/conf/httpd.conf, if your Listen directive is Listen 80 That's mean *:80 You have defined a couple <listener>+<servename> in your /etc/httpd/conf/httpd.conf and /etc/httpd/conf.d/default.conf which are the same : *:80 + <server-ip>. So, Apache only takes one into account. So, your vhost config is no use. Your /etc/...


-1

it is generally even worse than the three choices you provided. Most docker images are not built with package managers therefore you can't just shell into the docker image and issue an update. You will either need to rebuild or reobtain the docker image. The fact that you need to rebuild or are beholding to others to rebuild for security patches seems ...


0

sudo mount --bind /var/www/html/app /home/user/folder Give him access to be able to read and write in there. Job done.


0

To restrict logins under (Debian/Linux) OpenSSH, disable PasswordAuthentication and enable PubKeyAuthentication in your (login server's) /etc/ssh/sshd_config file. Then, for the user needing to access a shell, drop their OpenSSH pubkey into their ~/.ssh/authorized_keys file (on login server). Take care that the public key (not the private key!) is inserted ...


1

This permission change can be answered by snips from this answer You can determine which user is running PHP by running a simple script that calls the 'whoami' program installed in most Linux: <?php echo `whoami`; This gives you which user the files should have access to. Make sure that the user the PHP process is running under is the owner of php....


0

ok, kinda figured out, --verify-client-cert it's actually for setting up server side profile. it's confusing though


0

Not a hard restriction on what type of access but perhaps add a password to your key, then use an agent to add the key to your session. That way you will only have to unlock the key once in a session for password-less ssh/scp/rsync access. In the event that its stolen it has a password protecting it from being used. Create key with passphrase ssh-keygen -f ...


1

I think you can't remove the rule itself. As you can see, the id of your rule is equal what you want to remove. If you see the original rule here, you can see, there is a unique id (1001). Why don't you modify the operator and arguments, and remove the comment? Eg.: SecRule ARGS "@rx (m[inax]{2}[_\w]+)\-{3}[ade]{1,2}sc" \ "id:1001,\ phase:1,\ ...


2

Google Authenticator is time-dependent. Make sure your date/time settings, from the server and the phone, (also including their timezones) are correct.


1

Let's see if I can address your 3 questions. Assuming that your service executable file, and the .js file are located in a directory that a normal user has access to (write access), it can easily modify the .js file (to add/remove code), replace the .js file with a whole new one with the same name (overwrite the legit one) or even delete it (preventing the ...


Top 50 recent answers are included