New answers tagged

0

Three options come to mind: Don't make the image private, and instead allow anyone to pull the image that can access the registry server. This is fairly common in environments since the image should only contain the libraries and binaries to run the application, not configuration files, secrets, or data, that would be injected at runtime or stored in a ...


0

Put the credentials in the system wide docker configuration file, /etc/docker/daemon.json.


0

This was my own fault. I didn't notice that I was trying to load prose (reference only) STIGs, instead of benchmarks. I tested with a benchmark STIG (Solaris x86), and it loaded without errors.


0

The sar command that comes with sysstat will do both. To monitor connections per second sar -n TCP 1 active/s is the outbound TCP connections passive/s is the inbound TCP connections for UDP sar -n UDP 1 To look at network throughput sar -n DEV (optionally add a 1 to monitor current per/second)


2

Given that all of the attempts to access these incorrect URLs resulted in 404 errors, the only thing you have leaked is your web server's document root. An attacker would need to know this in order to access the files you are serving, but first the attacker would have to break in somehow. And if the attacker has broken in, they can easily read your web ...


0

In one of our projects we faced a problem, that we wanted to connect to websocket on a local network from webpage, that was served from the Internet. In order to use secure web socket connection (wss://) we needed the SSL certificate, but you can't get one for local IP's. The bottomline was that we could not change client machines configuration (no /etc/...


0

We are using a Workaround Create a .bat File icacls %windir%\system32\config\*.* /inheritance:e vssadmin delete shadows /all /quiet Create a File Called Windows_10_all.mof instance of MSFT_SomFilter { Author = "Administrator@domain"; ChangeDate = "20210722135205.787000-000"; CreationDate = "20210722134746.125000-000&...


1

An OV/EV certificate would contain the O (Organization), C (Country), etc values (part of that the CA states that they have validated), all visible to any user who actually decides to look at it. In more detail, if we look at two different major branches of browsers: For Chrome (92): for EV it shows directly in the overview that pops up when you click the ...


2

I will let Troy Hunt's "Extended Validation Certificates are (Really, Really) Dead" (August 2019) answer your question. The older article has all the examples with pictures, but to summarize: The only proponents of EV seemed to be those selling it or those who didn't understand how reliance on the absence of a positive visual indicator was simply ...


2

@user3526609 gets credit for this wonderful solution, but I wanted to summarize it to make it clear for any others out there like me who hunted everywhere for this and found it buried in a comment. In short, this is how to create a CSP nonce in an .htaccess file rather than in a web application, but still be able to utilize it in the web application. You can ...


0

Just wanted to post an update and share how we end up resolving this project on our server. We have created a separate virtual host for the blog (e.g. blog.example.com). This virtual host is hosted on the local IP with a specific internal port and is not visible outside. The web folder of the blog had a separate restricted Unix user:group that has access ...


0

In my opinion, it is not only okay but really recommended to do it. You can also use the repository maintained by our own CRS developer and Debian Maintainer, Ervin, hosted at https://modsecurity.digitalwave.hu/ Regarding if it "will break your site", depends a lot on what you are hosting. There are lots of recommendations on how to begin (e.g. ...


1

As far as I can tell, it is normal for programs on Unix-like systems to open a file and then delete it. You can disable that check (DISABLE_TESTS=deleted_files) in /etc/rkhunter.conf or /etc/rkhunter.conf.local. Also as far as I can tell, it is normal for dhclient to be listening on the network. And /sbin/ is the usual location for that program. So I would ...


0

You are wrong and your CTO is right. Enforcing password changes will annoy users into evading the security. This causes obvious security flaws like: Post-it's on monitors with passwords written on them. a suffixed counter at the password (for example, password1 turns into password2 - and if you can detect that, then you've got REAL BIG problems, as you're ...


1

http://testmynids.org/uid/index.html or http://www.testmyids.ca/ can be used to test, it will raise an "Attempted Information Leak". For the reverse proxy, you can create an HTML file with the content "uid=0(root) gid=0(root) groups=0(root)" on the web server 'http://webserver1/test_ids.html' then you can use curl to download it.


0

SHOW PROCESSLIST only shows connections for the user running that command. Be sure to connect as root to get the complete list. "root" is actually more powerful than you need; there may be some other user ("admin"?) that is powerful enough. In terms of GRANT, all the 'user' needs is PROCESS. Once you get the processlist, Time will ...


2

Short answer is no, it is not secure. If you want to keep data private, you need to apply security updates regularly. Otherwise you are risking that a serious vulnerability allows accessing your private data, which will have bad consequences for the business. I suggest that you look into migrating your systems to cloud, where you don't need to worry about ...


Top 50 recent answers are included