New answers tagged

1

If you have an rfc1918 address (eg 192.168..) nothing in DNS will make that directly accessible from the wider Internet. Using an A record on a public domain could expose that you are running a server, and give an external party hints about your network, but it would not provide a mechanism to allow access to it. You will not be able to use ACME challenges ...


1

If you use a private IPv4 address for your Gitlab instance, it will not be visible on the Internet. For example: 192.168.1.125 However, you could set up your Internet router (or whatever it is used for) to allow external access, so you should make sure it is not set up accidentally. You then have to take care of the domain and name resolution within your ...


0

In my point of View, you double your config, Port 80 Section; You are listening on 80 for (www.)domain.com Port 443 First, you are listening on 443 for www.domain.com -- Here you are using domain.com have to be used Port 443 Second, you are listening on 443 for domain.com -- Here you have your load ---- but WHY? In my Mind you complex your config with no ...


0

There are a number of options open to you. To get a "real" certificate (i.e. one trusted by browsers by default) requires you to validate access to the domain. This is done by one of three ways: Putting a file provided by the CA on the web server which the CA checks exists and so confirms you have access to the server. This is probably the most common way, ...


1

When you have control over the clients that will connect to your servers, one appropriate solution would be to set up a self-signed internal certificate authority. What you would do in theory is to set up a root certificate which should be kept secure and offline. Based on this one you would create child CA certificates that should be used to sign the ...


0

There are two ways, as I see it: either create a so called self-signed certificate or get a free one from a service such as Let's Encrypt. Creating a self-signed certificate depends on your environment and the easiest way is to search for this on Google. For Linux and Apache, for instance, you could follow this recipe, but there are others as you will see. ...


0

Create a network security group (nsg) Bind nsg to your web server nic or subset Restrict by ip and port So much cleaner and more secure than proposed option. OR other options Is your reverse proxy a netscaler by any chance? You can use it as an rdp gateway Do you have a published Citrix or terminal services environment? You could publish an rdp ...


0

You could update DNS to a c-name record and redirect to it use an application layer load balancer like application gateway.


0

Structure Image Hello there! Based on davidgo's answer, could this structure be a good idea?


0

By default nginx won't let anyone access anything above the root directive. Anyway you might want to block access to some extensions, in which case you'll need something like this rule that denies requests to anything with those extensions: location ~* \.(zip|gz|gzip|bz2|csv|xml)$ { deny all; } Check out the nginx documentation too https://nginx.org/en/...


1

This seems not to be a security issue. Please have a look at this answer: https://stackoverflow.com/a/28010608/9361998 As a workaround (if you want to stop these request) you can ban the ip address with the following script NOTE: Be sure to run as root The theory is very simple: Read the nginx and filter the ssl handshake error Create a python script ...


1

Your domain tamamsouq.com have a DNSSEC related problem, which you can see if you go at http://dnsviz.net/d/tamamsouq.com/dnssec/ This is the first problem to address. In summary, you put a DS record at the parent zone but your nameservers do not publish any related DNSKEY record. This will make your domain as failed for any recursive nameserver checking ...


0

I researched a lot to solve a simple problem: Only allow proxy_pass if request have a specific token in the header. I tried all the answers here and nothing worked how I liked. My final solution is: location /api { proxy_http_version 1.1; if ($http_authorization != "Bearer 1234") { return 401; } proxy_pass http://app:3000/; } ...


1

Took a few minutes to work this out - the problem is a typo. The nameservers are ns1.checkerinc.net and ns2.checkersinc.net - however you put dns1.checkersinc.net and dns2.checkersinc.net. While the latter domains exist, they do not appear to be authorative servers. The solution is to log into your registrar and update the DNS records. to remove the "d" ...


0

Have a VPN from your on-prem network to your Azure network Which reverse proxy are you using? With F5 you can use an APM to limit who can access the site


2

I cannot restrict access to my web server using IP (There are other reasons of this) Security by obscurity never works. Lots of hostile entities constantly scan the internet for (vulnerable) hosts, so even if you don't publish the exact URL or IP address somewhere, it can still be found (and since you are using a public cloud, it will be found). So, ...


0

You can move in two direction: Setup up a firewall for allow outbound traffic on port 80/443 only to selected IP range Set up a Basic Authentication from the webserver. Setup a VPN: proxy your network traffic trough a VPN The second solution is password based, so every user that need to gain the access need to authenticate using user:pass (no db is ...


0

If only few people should access a server, why is it on the public Internet? Trying to hide the domain and the IP address doesn't stop automated attacks going randomly through all the public IP addresses. Information on the top secret domain name is also likely to leak. This is not a suitable approach for a critical service. Naturally you could use a ...


0

(The correct solution is for the IIS servers to stump up and pay for static IP addresses. I don't like the solution below, as it won't be "server grade" stable. I have not gone into security implications - run appropriate firewalls and/or port limits as appropriate) There are 2 parts to the solution - part one is to make the webservers "reachable" by "the ...


Top 50 recent answers are included