316 reputation
38
bio website bsd-box.net/~mikeg/blog
location New York, United States
age 32
visits member for 3 years, 2 months
seen 2 days ago

Generic sysadmin. Hack coder. Jack of all trades, master of some.


Please Note:

I expect you to read any reference material I link to in my answers. If the answer to your question is contained in said reference material and the reference source is not likely to disappear I will probably not cut and paste it onto SF unless it's really cool/interesting/obscure.
In return I promise not to link anyone to goatse or tubgirl

I expect you to think for yourself and do a little thinking (and mayhaps even some work) to solve your problems. If you aren't capable of this, please exit the profession via the door on your left.
In return I promise to do my best to aim you in the right direction, and to clarify any points you have trouble with


Dec
19
comment How does changing your password every 90 days increase security?
While competent admins are going to secure the actual shadow password file, organizations as a whole tend to be more lax about backups, particularly older backups. . . . this is why competent admins ENCRYPT THEIR BACKUPS. (It saddens me that I'm the first person to leave this comment in the 18 months since this answer was posted)
Sep
25
awarded  Commentator
Sep
25
comment What expertise is required to create an Windows intrusion report?
@Kasius It varies depending on the problem. If you suspect the system is going to self-destruct and destroy evidence then crashing it hard is sometimes better than letting it self-destruct. Conversely if the "interesting" code is only in RAM pulling the plug destroys any chance at capturing that data. (You also need to consider the observer effect when acquiring memory dumps)
Sep
13
comment CRIME - How to beat the BEAST successor?
@ThomasPornin It's worth pointing out that there doesn't seem to be away to explicitly control SSL-level compression on Apache 2.2 (at least as of 2.2.23 from today, unless I'm missing something or they didn't update docs yet).
Aug
31
awarded  Quorum
Aug
28
answered Server monitoring for security
Aug
28
comment Server monitoring for security
Security.SE does not do product and service recommendations -- I have modified your question to be a bit more toward the "What sort of threats do I look for?" angle rather than the "What software should we buy/run/install?" angle.
Aug
21
awarded  Caucus
Aug
21
awarded  Constituent
Jul
25
comment When changing a password, does it have to be completely different?
@curiousguy I can tell you from experience that users don't read that message :-) -- Sometimes you know your password is a candidate for compromise (vendor calls and says "Our password list was stolen." and hashed or not you should assume that password is out), other times you are very confident it's not (your desktop, never connected to the internet). If you're uncertain best practices dictate you assume your password is compromised.
Jul
25
comment When changing a password, does it have to be completely different?
@Celeritas If your company has a (IMHO stupid) policy that your password must be rotated every N days "just because" and you have no reason to suspect your password compromised then you can make minor changes to your password to meet the requirement. This of course assumes your password is inherently strong, and remains so if you make only minor changes. (Do however bear in mind shoulder-surfing attacks. If lots of people see you type your password a radical change occasionally is a good idea :-)
Jun
8
awarded  Constituent
Jun
8
awarded  Caucus
Apr
3
awarded  Talkative
Feb
3
comment Most secure data storage?
If you go with the dog idea you should use reprogrammed psychotic AIBOs instead of live dogs -- AIBOs can survive the halon discharge.
Jan
28
awarded  Yearling
Dec
9
comment How can PayPal spoof emails so easily to say it comes from someone else?
Best. Answer. EVER.
Aug
4
comment Is there any legal reason to save a cleartext password?
@Iszi - Jeff is correct here, it is the equivalent of a transmission in the form A: "Authenticate Bravo X-Ray 3 1 2" / B: "Bravo X-Ray 3 1 2 I Authenticate Juliet Whiskey 7 4 9". You have no idea what the challenge/response mean without the authentication cypher's key, but it's clear it's a challenge/response to authenticate the communicating party. You cannot however have the remainder of the conversation in code - that must be in-the-clear.
Apr
22
comment DNS access limitations
"how it works" is pretty basic: The server looks at your IP and selects a view, then looks at the ACL for the action you're trying to take and decides if you're allowed to do what you're asking. I'm not a Windows guy so I don't know of any good documentation for Microsoft's DNS server, but O'Reilly's "DNS and BIND" book and the BIND manual (bind9.net/manuals) both go into detail on the options I mentioned above.
Apr
22
comment PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?
+1 for having someone (e.g. knowledgeable consultant) sit with you the first time you do this