Skip to main content

Questions tagged [configuration]

1. In computers and computer networks, a configuration often refers to the specific hardware and software details in terms of devices attached, capacity or capability, and exactly what the system is made up of. 2. In networks, a configuration often means the network topology. 3. In installing hardware and software, configuration is sometimes the methodical process of defining options that are provided.

Filter by
Sorted by
Tagged with
1 vote
2 answers
214 views

Is it safe to store database credentials as plain text in the configuration file?

Some services like ejabberd, nginx for authenticating using a database, and dovecot requires providing the database password as plain text in the configuration file. Is it safe to store MariaDB ...
whiteman808's user avatar
0 votes
1 answer
109 views

Is it safe to allow linking to images by URL in user-made posts?

I'm working on an imageboard website that uses the TinyIB bulletin board software. When editing the settings, I found this line: define('TINYIB_UPLOADVIAURL', false); // Allow files to be uploaded via ...
AcinonX's user avatar
  • 103
4 votes
1 answer
761 views

Making sure that SSH key is NOT used anywhere but specific hosts

I have an SSH key for work that I do NOT want to be offered by the forwarding agent anywhere but the work hosts. So I thought following ~/.ssh/config could do the trick: Host * ForwardAgent yes ...
LetMeSOThat4U's user avatar
1 vote
0 answers
173 views

What's the tradeoff of storing a connection string vs the password as a secret?

This is for an app service + database I am pushing up to Azure. I am using Key Vault + Managed Identity for the secrets. I have several connection strings in the secrets to ApplicationInsights, etc. ...
David Thielen's user avatar
0 votes
1 answer
98 views

How to store ClientID and ClientSecret in a K8 Env

I am trying integrate our service with SSO. I have generated the ClientID and ClientSecret. Is it a good security practice to store the ClientID and ClientSecret as a configmap? If not, what are the ...
warrior-oo7's user avatar
1 vote
0 answers
167 views

TPM FAPI sealing data inside /dev

I am using TPM simulator in my local VM to test FAPI API and am able to seal the important data inside directory ~/.local/share/tpm2-tss/user/keystore as per the path mentioned in config file /etc/...
chandu's user avatar
  • 161
0 votes
0 answers
105 views

Is process-based authentication more secure than username and password?

My infosec officer is campaigning the use of client process-based authentication everywhere applicable for future and existing projects. For existing projects, especially for custom applications, this ...
bluearth's user avatar
  • 131
5 votes
1 answer
2k views

Are there any negative consequences if you change your ssh config for a host with `UpdateHostKeys no`?

I recently came across a question on stackoverflow.com regarding gitlab.com and ssh config. The solution apparently is to update your ssh config with the following: Host gitlab.com UpdateHostKeys ...
Trevor Boyd Smith's user avatar
0 votes
1 answer
389 views

Intel Ethernet Driver Advanced Settings for Security/Privacy

There are some settings found on Device Manager > Ethernet Driver > Advanced Tab. Are there suggestions for any of these settings? or any suggestion to improve ethernet driver security? Adaptive ...
Quvok's user avatar
  • 1
1 vote
1 answer
594 views

What is the most up-to-date secure method for storing .ENV variables?

I am improving the security on my php website. I am not using any frameworks or cms. The credentials are currently stored in plain text in the relevant php files. While researching, I came across this ...
jdf's user avatar
  • 11
1 vote
1 answer
2k views

Changing $_SERVER['REMOTE_ADDR'] remotely

On a nginx web-server running the following config is to possible to change $_SERVER['REMOTE_ADDR'] remotely?: user www; pid /run/nginx.pid; error_log /dev/stderr info; events { ...
t40_yx's user avatar
  • 45
47 votes
3 answers
6k views

Security implications of stolen .git/objects/ files

As a security in-charge, I just noticed that one of our production web apps was attacked by some hackers. The attacker accessed the .git/objects/ files. I already modified .htaccess to make .git and ...
Rudrakshya Barman's user avatar
1 vote
1 answer
548 views

Config file contains password hashes and signature keys

First, I am a beginner in IT security. I hope my question is not too dumb. I use a program that can show a live feed from a security camera. You can import a project file, that sets up user accounts ...
pete's user avatar
  • 111
1 vote
1 answer
1k views

How to make Squid Proxy undetectable by ip-check.net? [closed]

I have setup squid proxy on a CentOs server where I set forwarded_for to delete and denied request headers on the /etc/squid/squid.conf file. However, whilst connected to the proxy, if I visit http://...
Oussama's user avatar
  • 11
0 votes
0 answers
119 views

Configuring a macbook for a specific case

I've used cleanbrowsing.org as a DNS filter, created an administrator account, logged in into that account, changed my usual (admin) account to a normal user and set the new admin account with a long ...
bokobov346's user avatar
1 vote
2 answers
1k views

Auto-login to refresh token in Burp Suite 2

I want to run an automatic scan on a web application made with Angular and JSNode. On this one I have access to different types of accounts. On ZAP OWASP I can select the POST request, it detects the ...
William's user avatar
  • 13
2 votes
1 answer
221 views

Can a router be configured from outside the local network?

My router can be configured by going to 192.168.1.1:80 when connected either by WiFi or by Ethernet cable. Can the same configuration web interface be accessed from the external interface (the public ...
RationalFragile's user avatar
1 vote
0 answers
179 views

What, if anything, are the consequences of temporarily enabling and then disabling WebRTC in Firefox?

For security and privacy purposes, it's best to keep WebRTC disabled if you aren't using it. Firefox makes this easy by simply setting media.peerconnection.enabled to false. Due to COVID-19, the use ...
End Antisemitic Hate's user avatar
1 vote
3 answers
398 views

Assigning static IP address other than 127.0.0.0/8 to loopback interface

We have the following configuration of the /etc/network/interfaces file which was setup by somebody else on this system. It has worked well by allowing other systems on LAN (and the internet) to ...
afora377's user avatar
  • 121
1 vote
1 answer
516 views

Is `SecAction` order important for an OWASP ModSecurity config file?

Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules... On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them ...
intika's user avatar
  • 111
0 votes
0 answers
229 views

Drupal 8 - Create REST API vulnerable to SQL Injection for CTF purposes

Recently I started creating a CTF challenge based on Drupal 8. I want to create a REST API parameter that will be vulnerable to SQLi. Even if this isn't something I should ask for here, I decided to ...
Com's user avatar
  • 1
0 votes
1 answer
301 views

Configuring Argon2id for Multiple Threads [duplicate]

We're using argon2-jvm to use Argon2id on our Java TCP Server. Because its argon2id instance is thread-safe, we plan to only create a single instance for the lifetime of our app and have each request ...
Floating Sunfish's user avatar
2 votes
1 answer
6k views

Argon2id Configuration

I read an article about how to use Argon2id in C# here. Below is the code they wrote (slightly edited): using System; using System.Diagnostics; using System.Linq; using System.Security.Cryptography; ...
Floating Sunfish's user avatar
1 vote
0 answers
534 views

Export IOS Certificates and Configuration Profiles

Is there anyway to export a configuration profile from an IOS device that you have root on? So I have a device with an MDM profile with login credentials for a wifi network, VPN, and email ...
AppleTechy's user avatar
2 votes
2 answers
782 views

Is it correct to assign a CVSS to a misconfiguration?

This morning, talking to a colleague, we were discussing the correction of assigning a CVSS to a bad configuration. Specifically, we were discussing whether using HTTP instead of HTTPS should have an ...
vuln newbie's user avatar
1 vote
1 answer
197 views

Why modern php web application requires to specify the application's url?

Pieces of web applications such as WordPress or moodle require to specify the URL that the user will provide in order to visit the site. For example, in moodle has the $CFG->wwwroot config ...
Dimitrios Desyllas's user avatar
0 votes
1 answer
3k views

Is it so easy to hack mongodb database?

Is it so easy to hack mongodb database? I created a mongodb database and added users. If I want to allow access only to these users I need to add the following parameters to the config file: ...
Codey's user avatar
  • 111
0 votes
1 answer
377 views

metasploit openvas plugin not connecting to OpenVAS9-Manager

I recently installed openvas9 following this guide. I can log into the web interface on port 4000 just fine, and I ran a scan on my metasploitable VM for testing, and it seems good. Now I wanted to ...
FalcoGer's user avatar
  • 392
0 votes
1 answer
264 views

Is it possible to exfiltrate a router config file to server using csrf ajax?

the curl commend used to download the file curl "http://192.168.1.1/html/management/downloadconfigfile.conf?RequestFile=/html/management/cfgfile.asp" -H "Cookie: SessionID_R3=dsadwdwqdasdwasdawd" --...
MoooonX's user avatar
  • 15
2 votes
2 answers
345 views

Committing encrypted passwords but not usernames

I’m arguing with a colleague about the security of storing encrypted password on GitHub. Our process is currently to commit a configuration file with environment variables including username and ...
gurghet's user avatar
  • 129
1 vote
1 answer
252 views

Why would a hacker bother with stealing your database password?

I read recently about whether you should store your database passwords in config files, environment variables, docker secrets, etc. But if somebody can steal it from those places, then s/he can ...
inf3rno's user avatar
  • 489
1 vote
1 answer
1k views

How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?

Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following: seal "azurekeyvault" { tenant_id = "46646709-b63e-4747-be42-516edeaf1e14" client_id = "...
Nathan Basanese's user avatar
3 votes
2 answers
5k views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
IMB's user avatar
  • 2,978
1 vote
0 answers
109 views

Kerberos Protocol Centralized Server

If a small company is expanding with various branches across the country, how would the kerberos centralized server be configured? Are the new users assigned new ticket granting servers or are they ...
boomchickawawa's user avatar
0 votes
1 answer
23k views

Which PFS Group is recommended for IPSec configuration?

I can't find much information on PFS (Perfect Forward Secrecy) Groups so I'm unsure what to suggest for a secure IPSec configuration. Any suggestions on PFS groups that aren't recommended? What is ...
ellefc's user avatar
  • 539
0 votes
1 answer
642 views

Where to save the token information?

I'm currently working on an end user Windows 10 application using the Microsoft UWP platform. Within this application the end user will be able to authenticate themselves using an oauth2 SSO service. ...
skovanden's user avatar
0 votes
2 answers
322 views

Best Source of Security Configuration Guidance

Over the years I have used a number of different sources of security configuration guidance for a spectrum of systems including for example: https://www.cisecurity.org/cis-benchmarks/ https://www....
Joe's user avatar
  • 113
1 vote
1 answer
2k views

Topology Configuration on CheckPoint

On CheckPoint firewall (R77), in the Topology config. section that is used for anti-spoofing, is it possible to configure 2 different External interfaces? I have already an interface configured as ...
Supersharp's user avatar
0 votes
1 answer
2k views

Is it ok to delete SSH configuration files? [closed]

From what I read, SSH is mainly used for remotely accessing a machine. If I don't want anyone remotely accessing my machine, nor myself included, is it ok to delete these configuration files from my ...
cubed's user avatar
  • 33
3 votes
1 answer
182 views

Securely retrieving and exposing configuration within Docker

It seems that the correct approach to supplying secrets to Docker containers is debatable. This question is the closest to mine, to which one person answered that environment variables are ok, but a ...
ps2goat's user avatar
  • 133
3 votes
1 answer
1k views

Is allow_url_fopen always a security risk?

Is allow_url_fopen always a security risk or only when you let others to insert URL? like when you want to set video stream links from your another server, and the only way to add new URL is from your ...
Zargaripour's user avatar
3 votes
1 answer
697 views

Sharing the UUIDs of my Linux partitions

I currently started using a Debian 9 server for my day-to-day tests. Because most of the time the system ends destroyed in my hands, I was thinking about doing a backup of my fstab and smb.conf on a ...
Lemon's user avatar
  • 133
0 votes
0 answers
2k views

Snort.log output as unreadable symbols

I have recently installed Snort IDS on Linux Ubuntu 16.04LTS (not server), after experimenting and testing configuration in VitualBox. After installing and successfully validating the configuration ...
user4493605's user avatar
2 votes
0 answers
136 views

What are the security implications of publishing my web server & PHP config files?

I have a web server with many virtual hosts, config files, etc. I'd like to track all of my web server & PHP config files using Git and have them hosted on a public GitHub repository, as this ...
jamieweb's user avatar
  • 435
0 votes
1 answer
413 views

Do HP ProCurve 1810G Config files have password hashes or other sensitive info?

I'm backing up some switches and I'm wondering if this config file should be kept secure. It is in binary so I do not know what it contains. What do the config files contain?
Daniel Grover's user avatar
1 vote
0 answers
7k views

Failed to connect to www.google.co.in:443 error in burp suite?

I am trying to intercept the https request, but I getting this error while searching anything in URL.it's hitting my burp, but I can't get any response after clicking forward button,it comes with this ...
Arun Kumar's user avatar
2 votes
1 answer
387 views

SSH to IP instead of to fully qualified hostname: does this reduce MITM risk?

I am applying configuration management to a VPS hosted by a VPS hosting company. Changing the hosting company is not an option, unfortunately. This VPS has the following properties: when newly-...
sampablokuper's user avatar
3 votes
2 answers
1k views

SSHguard: Does one to change any configuration for basic usage of the program?

I use Ubuntu 16.04 and I've installed SSHGuard (sudo apt-get install sshguard -y) to protect from Brute Force Attacks (BFAs) on whatever user. From reading about the program in ArchLinux wikipedia ...
Arcticooling's user avatar
2 votes
2 answers
2k views

Permissions for configuration file for program run as root that must be modifiable by SFTP

A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections. myscript uses a regexp (...
sampablokuper's user avatar
6 votes
1 answer
165 views

Why default settings are generally weaker than optimal ones?

In nearly all software (that I've used so far) that allows to set the encryption settings, default settings are kind of weak. There is always something that you should tweak to achieve better ...
user avatar