Tag Info

New answers tagged

1

Yes, anybody can set a static IP on any workstation assuming they have administrative control over it, same goes for mac addresses. IP filtering should only be one of many layers as it can be easily spoofed, and I wouldn't put too much weight on static IPs for security. An attacker would spoof one of the clients IP and MACs (can happen on any modern OS), ...


1

You can choose whatever DNS provider you want on your computer if you are granted administrative rights on it. The only purpose of the DNS request is to get the IP of a fully qualified domain name (FQDN), that is to say translate www.google.fr to some IP address. If you manage a network of machines, you might want to : completely block DNS request on ...


4

Most likely either another administrator or some of your users have set their computers to use Google's DNS service (located at IP addresses 8.8.8.8 and 8.8.4.4). It's probably nothing to worry about. If your firewall has packet capture capabilities, you can try running a capture and then opening the capture file in Wireshark to inspect the traffic and make ...


4

It is normal for external (WAN) and internal (LAN) traffic to follow different paths and for those paths to have different filtering behaviour. In most routers, even SOHO type devices, you will normally find at least 3 interfaces, WAN, LAN and WLAN. The LAN and WLAN traffic originates from within your network and devices connected in this way may have ...


1

While I'm not familiar with that particular product, it is common for routers to distinguish between their WAN and LAN interfaces. Most routers aimed at consumers or small business users expect to be managed from the LAN, so block access to management interfaces from the WAN. Packets from both the WAN and LAN traverse the INPUT chain, but the router would ...


3

For a SYN scan of the sort you are performing, nmap defines an "open" TCP port as one where a SYN packet sent by nmap elicits an ACK packet from the target system. Assuming that the firewall is configured sensibly, and that the TCP/IP stack is programmed correctly, an "open" port means that yes, the firewall is permitting connections on the given port ...


1

Yes. Although there are situations where an ostensibly open port may not mean that you can communicate with it in a meaningful way. Not necessarily, like you just said, the firewall is waiting to forward those ports. Unless you have changed the firewall to no longer be waiting for data forward, it wont close the ports. You should see errors from this in ...


2

This is a great question and one that companies often struggle with. I would say that giving the contractors VPN access generally provides more security than exposing it externally. Consider that your code repositories likely contain secrets and API keys and the like, despite policies to the contrary. If you're like most environments, compromise of your ...


4

Given that you cannot use a dedicated, isolated network for this, I would suggest a modified version of option 1: Allow access over the web with rigorous security checks. If possible authorize git users using a cryptographic key (the way github does.) This will make brute forcing attacks very difficult. Use IP filtering. That is, find out the IP ...


2

A tool like HP ArcSight can be customized very deeply, and just writing the right use cases and rules to correlate relevant events and alert on meaningful incidents, is super hard. Many organizations fail miserably implementing ArcSight. Just getting raw logs through connectors to logger and then to ESM, and then writing use cases is a project that ...


0

When creating Windows 7 firewall rules for Tor, creating rules for the unzip'd Tor software on your desktop may not work. This is because the Windows firewall doesn't work well with pathnames such as "%APPDATA%", etc, that end up in the pathname for rules when allowing the tor.exe client. So if you've got Tor unzip'd on your desktop and "any any" rules for ...


0

Since you're running Ubuntu 14.04 try using ufw to setup a firewall on your machine. ufw is designed to be a simpler interface than native iptables. See https://help.ubuntu.com/community/UFW


3

Your MAC and IP address don't help an attacker at all unless they're combined with open ports on your router, and vulnerable listening services on your machine. It's much more likely that it's a password re-use issue or similar. Did you change your machine password and Wi-Fi password? If he knows where you live and knows your WiFi password he can just sit ...


1

SSH can manage itself as a service, so shutting down a connection after X number of attempts is within its expected domain of control. Blocking an IP is a much bigger task, which is why things like fail2ban exist. SSH logs the failures, fail2ban reads those logs and then kicks off remediation, like blocking the IP at the firewall. In short, SSH cannot do ...


3

You say: If I need a bodyguard I'll have to hire someone whose muscles are much tougher than mine This mean that if you need a bodyguard, you will need someone with very specific capacities allowing him to protect you effectively. He will not need to have the same study background as you, he will not need to be able to administrate servers, he will ...



Top 50 recent answers are included