New answers tagged

1

No, for the following reason: root could patch sshd to always try root's authorized_keys file as well as its own. Of course if root's private key gets stolen you have a bad day. Don't allow that. You would be much happier if root's private key only exists in /root on the server. If someone can become root they can steal it but that's of no account because ...


0

I mostly agree with @flihp, but some "tutorials" here and there suggest to use /dev/urandom as the hardware entropy source. This is plain wrong since it will inject pseudo-random numbers into the "truly" random source, which in turn will be used to generate more pseudo-random numbers, etc. In this case I think that using rng-tools will make things worse. ...


-2

Relying on NFC for authentication makes your project's security flawed by design. NFC cards alone doesn't provide a secure way to avoid eavesdropping and replay attacks. NFC cards can be easily read/write from wider distances than expected. For the VM authentication, I would advice not to store passwords either. Explore other authentication means, such as ...


0

Typically services are co-hosted based on levels of trust. Using the military as an example, this would be like hosting all "classified" services in the same environment and "top secret" services in a separate environment. If there's a vulnerable service in one area then only that area is immediately impacted. The idea is to mitigate vertical agility during ...


1

I think you could just use the security concept of least privilege to drive these concepts. For example, I would imagine you would not want your Sharepoint admins to have access to the DC's running on the same box. The other design problem for combining multiple services on a single host is if say an Exchange exploit takes the host down then you lose all of ...


1

I would say as a generalization that bare-metal hypervisor is more secure. As with any system when you add more software you add more attack surface. So let's take any hosted hypervisor out there. Instead of just dealing with the hypervisor attack surface you also have the OS vulnerabilities to worry about.



Top 50 recent answers are included