Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [configuration]

1. In computers and computer networks, a configuration often refers to the specific hardware and software details in terms of devices attached, capacity or capability, and exactly what the system is made up of. 2. In networks, a configuration often means the network topology. 3. In installing ...

0
votes
0answers
28 views

Why doesn't Burp suite show my local IP in the address dropdown? [closed]

My burpsuite can't get my local IP address. Here is the picture:
2
votes
1answer
93 views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
1
vote
0answers
34 views

Kerberos Protocol Centralized Server

If a small company is expanding with various branches across the country, how would the kerberos centralized server be configured? Are the new users assigned new ticket granting servers or are they ...
0
votes
1answer
69 views

Which PFS Group is recommended for IPSec configuration?

I can't find much information on PFS (Perfect Forward Secrecy) Groups so I'm unsure what to suggest for a secure IPSec configuration. Any suggestions on PFS groups that aren't recommended? What is ...
0
votes
1answer
52 views

Where to save the token information?

I'm currently working on an end user Windows 10 application using the Microsoft UWP platform. Within this application the end user will be able to authenticate themselves using an oauth2 SSO service. ...
0
votes
2answers
91 views

Best Source of Security Configuration Guidance

Over the years I have used a number of different sources of security configuration guidance for a spectrum of systems including for example: https://www.cisecurity.org/cis-benchmarks/ https://www....
1
vote
1answer
126 views

Topology Configuration on CheckPoint

On CheckPoint firewall (R77), in the Topology config. section that is used for anti-spoofing, is it possible to configure 2 different External interfaces? I have already an interface configured as ...
0
votes
1answer
66 views

Is it ok to delete SSH configuration files? [closed]

From what I read, SSH is mainly used for remotely accessing a machine. If I don't want anyone remotely accessing my machine, nor myself included, is it ok to delete these configuration files from my ...
1
vote
0answers
14 views

Securely retrieving and exposing configuration within Docker

It seems that the correct approach to supplying secrets to Docker containers is debatable. This question is the closest to mine, to which one person answered that environment variables are ok, but a ...
3
votes
1answer
182 views

Is allow_url_fopen always a security risk?

Is allow_url_fopen always a security risk or only when you let others to insert URL? like when you want to set video stream links from your another server, and the only way to add new URL is from your ...
2
votes
1answer
69 views

Sharing the UUIDs of my Linux partitions

I currently started using a Debian 9 server for my day-to-day tests. Because most of the time the system ends destroyed in my hands, I was thinking about doing a backup of my fstab and smb.conf on a ...
0
votes
0answers
288 views

Snort.log output as unreadable symbols

I have recently installed Snort IDS on Linux Ubuntu 16.04LTS (not server), after experimenting and testing configuration in VitualBox. After installing and successfully validating the configuration ...
1
vote
0answers
57 views

What are the security implications of publishing my web server & PHP config files?

I have a web server with many virtual hosts, config files, etc. I'd like to track all of my web server & PHP config files using Git and have them hosted on a public GitHub repository, as this ...
0
votes
1answer
45 views

Do HP ProCurve 1810G Config files have password hashes or other sensitive info?

I'm backing up some switches and I'm wondering if this config file should be kept secure. It is in binary so I do not know what it contains. What do the config files contain?
1
vote
0answers
829 views

Failed to connect to www.google.co.in:443 error in burp suite?

I am trying to intercept the https request, but I getting this error while searching anything in URL.it's hitting my burp, but I can't get any response after clicking forward button,it comes with this ...
2
votes
1answer
127 views

SSH to IP instead of to fully qualified hostname: does this reduce MITM risk?

I am applying configuration management to a VPS hosted by a VPS hosting company. Changing the hosting company is not an option, unfortunately. This VPS has the following properties: when newly-...
2
votes
2answers
339 views

SSHguard: Does one to change any configuration for basic usage of the program?

I use Ubuntu 16.04 and I've installed SSHGuard (sudo apt-get install sshguard -y) to protect from Brute Force Attacks (BFAs) on whatever user. From reading about the program in ArchLinux wikipedia ...
2
votes
2answers
368 views

Permissions for configuration file for program run as root that must be modifiable by SFTP

A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections. myscript uses a regexp (...
5
votes
1answer
85 views

Why default settings are generally weaker than optimal ones?

In nearly all software (that I've used so far) that allows to set the encryption settings, default settings are kind of weak. There is always something that you should tweak to achieve better ...
0
votes
0answers
34 views

Checklist for reviewing an application feature set from a security perspective

I would like to see if there are any checklists/frameworks, for evaluation from a security perspective pros and cons of features/configurations of new applications which are proposed to be used by ...
2
votes
2answers
210 views

Chicken-and-egg-problem: What's the intended secure way of installing anti-virus software with online installers?

In various places (notably, the English Microsoft Answers forums1), people are quick to note that a Windows machine should not get connected to the internet without any anti-virus software installed. ...
0
votes
1answer
264 views

Directory listing for icons and image folders

I am testing web application on Apache server, which allows to list directories such as https://192.168.100.00:443/icons/ and https://192.168.100.00:443/images/. This directories contains only images. ...
1
vote
0answers
54 views

Restricting user sign-in on Chrome for Business

I'm currently evaluating the configuration of Chrome for Business in a corporate environment. There is a setting which prevents users from signing into Chrome with their personal accounts. My gut ...
5
votes
2answers
8k views

Is TLS 1.3 available and if so, how is it enabled?

I have a .NET desktop application with an SQL Server 2016 Express SP1 back end running the latest cumulative update 3. I have enabled TLS 1.3 on both server (Windows Server 2012 R2) and client (...
1
vote
1answer
404 views

ASP.Net usage of the Machine.config file

In ASP.Net, the normal way of encrypting an object ( as an exmaple a user cookie in the server side ) is read the shared key located in the machine.config file. The machine config file contains ...
2
votes
3answers
593 views

Effects of CVE-2017-9445?

http://thehackernews.com/2017/06/linux-buffer-overflow-code.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9445 "that could allow remote attackers to potentially trigger a buffer ...
0
votes
0answers
69 views

Azure AppService - Configuration vulnerability - Would you also consider this as a vulnerability?

just in short. I was playing around a Azure AppService as I wanted to know how secure it is. I have discovered it is possible (using the regularly deployed application) to write to complete d:\home ...
1
vote
0answers
110 views

Force/Suggest the client to use one specific EAP method

I would like to suggest to the client which one EAP method and inner authentication to use. I'm using hostapd to create the AP. I've tried by removing some methods in the hostapd.eap_user but I ...
2
votes
0answers
365 views

Change default EAP type in hostapd [closed]

I'm trying to change the default EAP type in hostapd but I am not able to understand how to do that. Here's what I've found reading the hostapd.conf file: > # NAI Realm information > # One or ...
1
vote
0answers
255 views

how to create a CTF box and how to organize it [closed]

I want to create CTF (capture the flag) box for my assignments. I don’t have any idea about this. Can anyone help and guide me?
6
votes
2answers
215 views

Is this ISP IP address assignment issue a vulnerability?

Using a bridged router so that I can set the IP settings directly on the gateway server. We have two such routers for two different IPs (we needed a secondary IP but the ISP only provided it through a ...
0
votes
1answer
63 views

Linux runlevel configuration security

I am testing Linux configuration security checking tools recently and I downloaded a tool called lynis. One thing it checks is the default runlevel. However, even after reading some info about ...
5
votes
1answer
151 views

Unrecognised and undiscoverable(?) device on home network

I noticed yesterday that my home router (ASUS) was picking up an unrecognised device in it's traffic monitor function. This is a GUI that shows total upload/downloads by device/MAC address. So this ...
0
votes
1answer
2k views

Securing password in Java (config file and memory) [duplicate]

I have to store password to some other system in config file in my Java application (web app running on Tomcat). What are my options to protect it (both at rest and in memory)? (Hash is not an option) ...
4
votes
3answers
243 views

Ways to configure a router

I have recently got into cyber-security and I have been looking at ways to configure a router. However, the sources I have found have been on how to configure a router and not things you can do to ...
1
vote
1answer
40 views

The difference between Management and Configuration Policies

I am trying to find out the difference between management and configuration policies. Kindly, can someone elaborate that or showing an example so that I can understand each case.
0
votes
2answers
87 views

Publishing proxy server IP address on github

Is it safe to store proxy IP address and port in a shell config file on github? I see some people doing that and don't worry about it.
3
votes
0answers
126 views

Is it possible to avoid storing username and password in settings.xml in Jenkins? [closed]

In the project's source files there is settings.xml, which according to the official documentation contains the credentials of the servers jenkins needs to authenticate, but in plain text. Is there ...
3
votes
1answer
622 views

CIS recommendations - disabling ip forwarding

I am looking through the CIS recommendations for debian 8. In a CIS compliance test using nessus, I see that the test for disabling ip forwarding has failed. But when I look at the system, I can see ...
1
vote
1answer
332 views

Is an anonymous FTP user always a risk (even if this user doesn't have access to anything)?

I found some FTP servers in a network that seem to allow login with an anonymous FTP user. I confirmed this with the ftp-anon NSE script in Nmap. PORT STATE SERVICE 21/tcp open ftp |_ftp-anon: ...
9
votes
0answers
626 views

How to properly secure an ActiveMQ instance, and what are all of the different files for?

I'm trying to configure user based authentication for ActiveMQ, and I'm pretty confused about the many different files involved in this process. I've read ActiveMQ's security page, but I still have ...
4
votes
1answer
313 views

What is the best practice for giving Oracle DB credentials to a Java Application?

I have Java applications (using Spring running in Jetty Servlet containers) that need to access an Oracle database. What is the best practice for giving the DB credentials to the applications? I came ...
0
votes
0answers
57 views

sshd login obfuscation by prompting for a password although password login is disabled?

The sshd.config and fail2ban both work by blocking authentication requests over a specified path, thus notifying the attacker about the protection measures in place. Wouldn't it be more desirable to ...
0
votes
1answer
1k views

New SSL cert implementation showing errors on Android only

When testing a HTTPS URL it loads successfully from all browsers on mulitple desktop operating system. However when we test specifically from Android mobile phone we get the following results: ...
0
votes
1answer
44 views

Is there an original informaton source linking output of Qualys SSL report to settings in nginx and Apache configurations?

The online tool at Qualys for testing webserver SSL configurations, https://www.ssllabs.com/ssltest/index.html, produces a list of codeslike TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, ...
0
votes
1answer
49 views

Looking for some sort of system wide auditing tool [closed]

The title summarises it all but here's an example: You're sharing some hardware equipment with your dev colleagues, some days everything works well with it, the next day, nothing works anymore, ...
0
votes
1answer
77 views

Network configuration: Preventing my computer being used as a proxy?

I recently installed an extension for Chrome called Hola (skip to next paragraph if you know it). It calls itself a VPN, but is basically a proxy pool AFAIK. You can choose a country from a list in a ...
0
votes
0answers
253 views

Variant of OSX.pirrit

Today while working with a customer, Someone came in with a peculiar problem. They could only access websites through https, and nothing through http. I tried the regular gauntlet of fixes for network ...
1
vote
0answers
331 views

dvwa is prompting me to check config file when trying to create database

I believe I have made the proper changes to the xampp/htdocs/DVWA-1.9/config/config.inc.php file and the xampp/passwords.txt file. The passwords match, security is low, port is changed (not sure if I ...
4
votes
1answer
300 views

What are the security implications of installing an iPhone configuration profile?

What are the security risks of installing a "configuration profile" on iOS from www.vshare.com? I don't know what a configuration profile is or what it does. They are found in Settings > General > ...