Tag Info

Hot answers tagged

4

If it's not needed, it should be closed. Vulnerabilities You can never be sure if there are no vulnerabilities in MySQL itself. Here is an example for a DOS attack (and it's not the only possible attack). Allowing non-ip restricted remote access to MySQL Allowing remote access to MySQL is not a vulnerability by itself, but there are scenarios where it ...


3

Without checking, I'm going to assume that your CentOS RPMs contain backported fixes which address the CVE's listed in their report. (That's how RedHat does it and CentOS is RedHat in this regard). Because of this, your packages are probably immune to issues that their banner would otherwise indicate they're vulnerable to. What you need to provide ...


3

Setup a port knock daemon which opens the firewall for some time when specific ports are "touched" in some specific order. See for more information Port knocking


1

The best way is to use SCP with SSH keys. It's some of the best encryption commonly available, designed to work without intervention, very reliable, easy to script, and extremely well documented. Set up your keys and a cron job. The only other good option is to change your application design to sync the data over an encrypted channel, such as a mysql slave ...


1

You can set the preferred authentication method in the ~/.ssh/config file for the server(s) you are trying to access. Host <hostname> PreferredAuthentications password You can set the IdentityFile parameter for other servers you are connecting to in the ~/.ssh/config so you'll both connect to them more quickly and avoid the risk of too many failed ...


1

Security is a relative concept. I cannot say if a certain configuration is safe because there is always a safer practice. As you have mentioned, using a public/private key pair is more secure but you are unwilling to sacrifice convenience for the added security. Ultimately, you need to find a balance between convenience and security that you are comfortable ...


1

John the Ripper supports cracking SSH private key passphrases. If you provide a dictionary it will be even faster. Alternatively, you can also use Phrasendrescher.


1

Taken from research!rsc: "Last week, Debian announced that in September 2006 they accidentally broke the OpenSSL pseudo-random number generator while trying to silence a Valgrind warning. One effect this had is that the ssh-keygen program installed on recent Debian systems (and Debian-derived systems like Ubuntu) could only generate 32,767 different ...


1

I don't have enough rep to comment, so I'm answering. Now as I understand this a game, certain liberties might have been take. I could be wrong is it possible that the game did the following: Installed the public key in authorized_keys The private key isn't encrypted, not requiring a password Restricted access by IP, so only local clients could ...



Only top voted, non community-wiki answers of a minimum length are eligible