369 reputation
211
bio website init.se
location Stockholm, Sweden
age 43
visits member for 2 years, 10 months
seen yesterday

I'm a unix sysadmin, working as a consultant at Init AB (www.init.se). My main focus is unix security and PKI; I work a lot with the open-source CA system EJBCA.

Previous jobs include sysadmin in charge of security related systems at a large bank, and mail servers at a largish ISP, including handling abuse and spam issues.

Email address: jenny@init.se


Aug
24
comment What certificates are needed for multi-level subdomains?
To answer your very last question - the browser will verify that the certificate matches the site you're on, and that it's issued by a trusted CA, and that it's valid at this point in time. Going from foo.com to bar.baz.foo.com won't trigger any warning, just as following a link from foo.com to bar.com won't. The browser does not care that there's a subdomain involved.
Jun
23
comment Work using net nanny
@JoelL Could be monitored - yes, absolutely. Is actively monitored - not necessarily.
Jun
23
comment Work using net nanny
And since you don't know, there's no way for anyone to answer your question. If you're using SSL, then it's less likely that someone would be able to see the contents of the page (though still not impossible, depending on their setup). Whether anyone actually does notice will depend on your company policy - which, again, nobody else can answer.
Jun
23
comment Work using net nanny
There's not enough information here to be able to give you any answer other than "maybe, but probably not".
Jun
23
comment Work using net nanny
Do you access your email using SSL or not?
May
29
comment SSH: Security of Pubkey Authentication vs Password
Yes - this question really belongs over at Information Security
May
22
comment Creating my own CA for an intranet
@André as regards EJBCA, it can be used from the command line too, so you won't have to expose the web interface. But it's an enterprise-level thing and probably overkill for your purposes (and I say this as someone who makes a living working with it).
May
21
comment How can I stop an IP from trying to use my mail server?
@sebix That question also contains answers on how to stop spam from reaching the server, e.g. by using blocklists. I agree that this question is more of a fit for Serverfault, but once it gets there it's likely to be closed as a duplicate.
May
20
comment How can I stop an IP from trying to use my mail server?
Have a look at serverfault.com/questions/419407/…
Mar
23
comment How to transform an hash into a usable password?
A number of years ago, the place where I worked had a similar app to set and get passwords for the servers. The app combined a random string (which was the same for all servers, and changed regularly) with the server's hostname and the username of the account to which the password applied. It was secure enough for our purposes, which is not to say that it would be secure enough for everyone.
Jan
5
comment how does a site know it is me even after changing ip address and clearing cookie?
Do you get the same issue if you're using your smartphone as a tether to the cellular network?
Jan
5
comment how does a site know it is me even after changing ip address and clearing cookie?
If it blocks the OP even when they're connecting through TOR, it's unlikely to be the ISP's IP range that's the issue. Of course, they may be blocking known TOR exit nodes as well.
Dec
26
comment Can I “hide” the private key, while still allowing it to be used?
I also thought of another way of keeping the authorized_keys file safe, see the edit. (And yeah, this is one question that overlaps between Information Security and Server Fault - I don't think this is the wrong place but maybe there are two right ones.)
Dec
26
comment Can I “hide” the private key, while still allowing it to be used?
The list is in the man page for sshd, under the heading Authorized Keys Format
Nov
28
comment Moving /boot to USB and Preventing booting from other USB devices (Allow boot from only one USB)
Second question: What is the purpose of disabling booting off of other USB devices? Since your disk is encrypted, those devices shouldn't be able to read it anyway, right? They could destroy the data, but not actually get at it - and if you have backups, the destruction isn't a big deal.
Nov
28
comment Moving /boot to USB and Preventing booting from other USB devices (Allow boot from only one USB)
Have you considered burning it to a CD instead and booting off of that?
Oct
6
comment Where are the anonymous/private domain validation SSL certs?
I still don't think this question fits ServerFault. You might try it at Information Security instead; with the rewording I think it could fit there.
Dec
9
comment Is it bad practice to use your real name online?
Google closed my husband's Google+ account for not believing it was in his own name just a couple of weeks ago. They graciously offered to maybe reinstate it if he'd scan his own passport and send them the scan. So I'd say that they are still closing accounts for not sounding or looking right to their very blinkered eyes.
Apr
12
comment Finding spam sending scripts?
If the scripts are called from apache, then grepping those logs might be useful.