New answers tagged

2

With fwknop deployed, anyone using nmap to look for SSHD can't even tell that it is listening - it makes no difference if they want to run a password cracker against SSHD or even if they have a 0-day exploit. I have some notes here for using fwknop. I can also ssh into containers behind NAT with no port open externally.


1

I suppose a good question would be why do you even have SSH open to the WAN, anyway? ... As others have mentioned, administering via a private network is the Holy Grail. The best approximation (and the reason I even bother to answer here) for a WAN connection is an IP wrapper or firewall ruleset that only allows SSH from a particular IP address. One such ...


6

There is a very extensive article at Wikipedia and it does not make sense to reiterate everything here. But to give you some highlights: It replaces OpenSSL on OpenBSD, OS X since 10.11 and on some other systems. It started with throwing away lots of stuff which was considered useless for the target platforms or insecure by design and it also added some ...


1

It is a bit like moving SSH to a different port. You just hide something (poorly) and that shouldn't be something to rely the security of a system on. It might throw off the attackers that really don't know what they are doing (and they will not get into ssh anyway if it is setup properly) but is useless otherwise.


7

You are basically correct. It is obfuscation. Obfuscation is not without value, but you should not rely on it. The first answer is correct, BTW, that it is good practice to host management services such as SSH on a separate network (i.e., not the internet).


39

Unless that IP address belongs to a dedicated management network which implements additional security, it is a waste of resources. Both IPs are, obviously, ending up on the same server. This means that, unless they come in through different networks (i.e. a management network that implements additional protection), there will be no difference locally ...


2

Flexible SSL does not provide end-to-end encryption. From here: you can see that the CloudFlare link to the server is unencrypted. However, as the user link to CloudFlare is, this mitigates most typical Man-In-The-Middle scenarios. For example, ranging from Mallory on the coffee shop wifi connection, to rogue employees at an ISP, all the way up to ...


0

I'm assuming that the client connects to your web server by way of HTTPS (if the client connects to the web server by HTTP, then eavesdropping or an MITM attack is trivial if you control the network that your web server is on). Assuming that it's an HTTPS connection, then if you have the private key that corresponds to the public key in the web server's SSL ...


0

One approach is to store such sensitive keys, passwords, or other credentials in a particular S3 bucket. That bucket should not be publicly accessible/available. Next, you create an IAM role which has S3 read-only access just to that bucket. Last, when launching your EC2 instance, you assign that IAM role to that instance. With this sort of approach, ...


3

You have essentially two issues in your process: providing the update and having it installed. Server Auth Firstly, yes you need to authenticate the server. This means that communication to the server must be done on a secure encrypted channel. Make sure to take the time to understand attacks on SSL so you don't use something that's expired. Ship the ...


0

It depends on how secure you need to be. For PCI, for example, you need to have two keys. The first is the data encryption key. The second is the key encryption key. You use the DEK to encrypt the data. You use the KEK to encrypt the DEK. It is not required but strongly recommended that you store the KEK in the keystore provided by your OS. Then only the ...


1

Well, the obvious question is - can the External Database access resources on the network the Internal Database is on? If the External Database is isolated from the LAN, then that means that an attacker that ends up getting not only into the External Database's records, but also to the External Database's host OS, is unable to get farther into the network. ...


0

It depends on what you mean by "storing", as well as "server". I'm going to assume for sake of answering that there are two "servers" in use now, both on the AWS cloud: MySQL server. Application server (which currently has the code with your cryptography key in it). The MySQL server has no reason to have the key, ever. The Application server I assume ...


3

There are situations where an external-facing database is used to store temporary information which is "pulled" not "pushed" through a one-way firewall connection into a larger internal database then that data is deleted from the external-facing one. The purpose for this is to reduce the number of records which can be stolen at any given time yet allowing ...


0

I'm surprised nobody mentioned bitcoin. While hashcash may have been impractical for email systems, it has proved useful in cryptocurrencies algorithms for proof of work of miners. "Hashcash is a proof-of-work system used to limit email spam and denial-of-service attacks, and more recently has become known for its use in bitcoin (and other ...


2

Can't tell if that's a typo or not. But you wrote ErrorDocument 403 'not found'. Remember that each of the various error messages corresponds to a different condition. So, for example, Error 403 is not the error that happens when someone looks for a URL that doesn't exist. Error 404 is what is transmitted in that case. If you really want to override ALL of ...


4

Try creating some custom error response pages. A plain old HTML page that just says something along the following lines: ERROR 403: You are not authorised to access this resource. It doesn't even need any formatting.


8

Notice the magic string () { :; };. They are trying to poke around and see if your server is vulnerable to the ShellShock exploit. Perl is used here to print and see if the attack succeeded. Make sure to patch and update your server. You should be safe from these kind of attacks.


1

Depends on the capabilities of your firewall, really, but first: stop doing anything that involves being logged in on port 80! If your CMS asks for username and password, and you're running over HTTP (as would be standard for port 80), your username and password would be sent in clear text between your local machine and your server. Once you're running over ...


2

Since according to the comment these files are intended this way this can not be considered a breach. A breach would only be if an attacker has installed the files there. Of course these files might increase the attack surface because they might make it easier for a potential attacker. But this can probably also be said from other programs on the machine, ...



Top 50 recent answers are included