New answers tagged

0

netdata is the way to go. I used sudo apt-get install and got a really old version, 1.9.0. The fail2ban monitoring was not already setup. Using their one-liner installation from their front page is the way to go. fail2ban is setup and monitored immediately. So cool. I'm super impressed with netdata. It's open source under GPLv3 and works with stand-alone ...


0

Agree with what joeqwerty has said above, and based on your error messages you provided above, i have found that this issue may be caused by User logon with misspelled or bad user account.For more details: 4625(F): An account failed to log on. and The Security event that has Event ID 4625 does not contain the user account name on a computer that is running ...


0

thought NTLM was disabled by default since Win Server 2008 onwards NTLMV1 protocol and the LM hash were both disabled. Is there anything I can do to prevent these log-on attempts from reaching the server? You don't want to disable authentication attempts from reaching the server. Would I be right in thinking having the necessary ports open for the ...


1

Would I be right in thinking having the necessary ports open for the Exchange Server (80,443,587) is the only reason these attempts from WAN IPs are even reaching the server? Well, yes. If you have those ports open from the internet to your Exchange server then this is what I would expect. Is there anything I can do to prevent these log-on attempts from ...


1

There should be a link somewhere like "Having trouble with authentication?" Find something like that and go through account recovery. Then remove SMS from your account and use an authenticator app or hardware key. SMS authentication is not secure, so Amazon has deprecated it and will eventually remove it.


0

Just to add to this, every article I read suggests that 1 is disabled and 0 is enabled for this EnableMulticast Value, despite the Value name suggesting it is the other way round. I did look at several articles to verify, because with a name like EnableMulticast you would expect it to be the other way round.


4

Place your desired environment variables in an access-restricted file and load it in your unit with EnvironmentFile=.


2

Use the IV_PLAT peer info and a connect script (on the server) to reject connections if they use the wrong OS (exit with non-zero) There is a bit of explanation around here : https://books.google.co.uk/books?id=_1MoDwAAQBAJ&pg=PA318&lpg=PA318&dq=openvpn+peer+info+as+environment+variable&source=bl&ots=CIue3PwB-g&sig=...


0

nowadays you might use docker-compose.yml and insert a secrets part docker-compose.yml version: "3.6" services: my_service: image: ubuntu:latest entrypoint: "wc -c /run/secrets/my_secret" secrets: - my_secret secrets: my_secret: file: ./password.txt


0

I've found this post https://aws.amazon.com/premiumsupport/knowledge-center/connect-http-https-ec2/ where you can see two limitations, one is the Security group rules and the other one is the network ACL. I've already done the config for the Security groups but not done for ACL so i did it and after a reboot of the EC2 instances it works well. Hope it helps ...


0

Audit policies are located in computer configuration -> Policies -> Windows setting -> Security settings -> Local policies -> Audit policies. I hope you find this information useful


1

Based on your edit, it might be worthwhile shooting Amazon the question. You will get an answer that we would all get most likely. If there is some inside baseball type access, most of us would not know about it. I would also assume, depending on their virtualization platform, they have some console-like access anyway. It always bothered me that they did not ...


1

Not possible that I am aware of. They have physical access, so they can do whatever they want to get in. And who knows what backdoors they have just in case they need to get in.


10

Public cloud providers usually use some form of Port Security to protect against this. This means that only traffic with the allocated IP + MAC address pair(s) will be allowed onto the network. For virtualized servers, this security is usually applied on the physical host (i.e. the one hosting the virtualized server). For bare-metal hosting, this security ...


0

The forward-dns directive seems to be what you're after. According to the docs, it simply queries the DNS for the host name and allows a client if its IP matches. As a consequence, it will only work with host names, not domain names. However, as the reverse DNS is not used, it will work with clients which use a dynamic DNS service. So you can specify ...


1

Possible explanation: there is no new account, nor was the new folder intentionally created by the attacker. The user profile of the administrator account was damaged during the attack, or by some defense or recovery measures. This has then triggered the profile repair mechanism of Windows. When Windows encounters an unrecoverable error loading the profile ...


0

Load Balancer. the LTM will be less vulnerable since it basically only the VIP and port assigned to that VIP is open to the public not the LTM itself. Also it will reduc the amount of prots you have to open from DMZ to internal network if your web app or server has to auth users (LDAP) or any other SQL functions nd so on. In this case it only port 80 or 443 ...


0

If the attacker is arriving at your system from the same IP address as legitimate users then she is abusing the system which owns that address. In that case your best bet is to identify and block her on that system. If that system is not under your control, you can motivate its owner to help you by blacklisting or ratelimiting the IP address until the ...


1

As Massimo correctly mentioned it cannot be carried out only at TCP level. If you are running your own web server blacklisting the IP definitely is an immediate prevention if the attack it targeted towards your system from an specific IP. But does it originate always from the same IP and takes certain time? If yes, sounds like an DoS (coming from a single ...


0

The other answer is correct, but specifically because you said you're using GCDS (Google Cloud Directory Sync), you can prevent this from happening by unchecking the "Force new users to change password" box in Configuration Manager > User Accounts > Additional User Attributes.


2

You can't do that at the TCP/IP level. As you correctly guessed, a firewall only cares about IP addresses and ports, it knows nothing about what a process is doing or who is running it on the client system. You need to use some other system in order to analyze traffic at the application level and block unwanted requests. Which system? It depends heavily on ...


1

Yup, that's something that the client company can configure to restrict their users from accessing SaaS apps, it's called "Tenant Restrictions". Basically, the tenants admin can choose which tenant their users can login into with their Azure AD accounts. Have fun reading: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/tenant-...


1

You can implement daemon_user and read_user with POSIX extended ACLs (getfacl, setfacl, chmod, chown). For appender_user you can use append attribute (chattr +a filename, lsattr), but this would limit for all users. Another way to implement this is to use a service that limits the access to those files. E.g. you share the files with samba and you use ...


0

There is a debian dir inside, so it looks like you might be able to build this via one of the various tools intended to do the job, for example gbp-buildpackage.


0

This one works with a regex-tester like freeformatter ^\[.*\]\s+(?<HOST>.*)\s+ This uses a named capture "(?<HOST>.*)", which for fail2ban-regex should be replaced simply by "<HOST>", if I read the documentation correctly.


Top 50 recent answers are included