Skip to main content
87 votes
Accepted

Security implications of stolen .git/objects/ files

Should I worried about it? Worried? No, of course not. You should be absolutely terrified and have nightmares about this. Having stolen .git directory means the attacker have the current and past ...
ThoriumBR's user avatar
  • 54.5k
14 votes

Security implications of stolen .git/objects/ files

Worried? Maybe. Is your source code filled with holes? Then yes. But quiet honesty, you should have been worried BEFORE your source code leaked. People have this idea that they're safe because &...
Steve Sether's user avatar
  • 21.6k
11 votes
Accepted

Is it so easy to hack mongodb database?

While this is true, that is true for many applications. If the attacker already has access to the file system it is far too late to worry about your database server. In unix-type operating systems, ...
FalcoGer's user avatar
  • 392
10 votes

Why default settings are generally weaker than optimal ones?

One reason is that older algorithms are likely to have wider support. Such defaults probably ensure that the software runs on a wide variety of platforms out of the box. The software itself might also ...
Ella Rose's user avatar
  • 293
9 votes

Disabling authentication via DSA keys in OpenSSH?

EDIT: As indicated in dave_thompson_085's comment, this solution requires OpenSSH release 7.0 or newer, and will not work for OpenSSH 5.9 as requested by the original poster. Left as a reference for ...
DougC's user avatar
  • 211
7 votes

Is TLS 1.3 available and if so, how is it enabled?

This is probably not news, but since the TLS 1.3 RFC is still in DRAFT, you'll probably cause yourself compatibility headaches if you turn it on for a production server. I would guess this is exactly ...
Mike Ounsworth's user avatar
7 votes

Are there any negative consequences if you change your ssh config for a host with `UpdateHostKeys no`?

From the documentation: Additional hostkeys are only accepted if the key used to authenticate the host was already trusted or explicitly accepted by the user. This means it will not accept arbitrary ...
Steffen Ullrich's user avatar
5 votes

How to properly secure an ActiveMQ instance, and what are all of the different files for?

At the time I am answering this, this question is 2 years old, so my answer might include things that have changed from the time this was posted. Ill answer the second question first: credentials....
Art Hill's user avatar
5 votes

Is TLS 1.3 available and if so, how is it enabled?

TLS v1.3 does not exist in schannel (the Windows TLS library) yet, so it can neither be enabled, nor will it be able to cause any problems. Your app will continue to use TLS v1.2, assuming that is ...
Xander's user avatar
  • 35.8k
5 votes
Accepted

Chicken-and-egg-problem: What's the intended secure way of installing anti-virus software with online installers?

Disclosure: I work for an anti-virus vendor. First, the answer. Most vendors which I'm familiar with usually offer "full" or "offline" installers of their products. Typically they are usually more ...
George Y.'s user avatar
  • 3,534
5 votes
Accepted

Sharing the UUIDs of my Linux partitions

I am assuming you are asking whether or not a partition UUID is sensitive information. A UUID is a random value assigned to the partition of a drive. It is used to reference the drive without needing ...
forest's user avatar
  • 66.9k
5 votes

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

To clarify, the security and flexibility are gained by putting secrets into environment variables. .ENV is a convenience and, ideally, is not used in production. Many hosting services will handle ...
Schwern's user avatar
  • 1,588
5 votes

Committing encrypted passwords but not usernames

You should never be committing secrets to source code of any kind, encrypted or not. The username to authenticate into your server is probably a bit much in terms if sensitivity on its own, let alone ...
securityOrange's user avatar
5 votes
Accepted

Making sure that SSH key is NOT used anywhere but specific hosts

Yes, this configuration uses ~/.ssh/work_key for workhost.example.com only. From ssh_config(5): IdentitiesOnly Specifies that ssh(1) should only use the authentication identity files configured in ...
Esa Jokinen's user avatar
4 votes

Unrecognised and undiscoverable(?) device on home network

It occurred to me what this was after a couple of days. It was traffic being 'uploaded' to the router from the modem. I googled and sure enough Alcatel provide the modems for my broadband provider (...
spoovy's user avatar
  • 181
4 votes

Security implications of stolen .git/objects/ files

No, you should not be terribly worried, unless you did horrible no-nos like putting credentials in your source tree. So the party who accessed these files saw part of your source history. Big deal. ...
R.. GitHub STOP HELPING ICE's user avatar
4 votes
Accepted

Changing $_SERVER['REMOTE_ADDR'] remotely

The $_SERVER['REMOTE_ADDR'] can be trusted. This is the source address of the TCP connection to the server, it is not taken from headers that are sent by the client as is the case with some of the ...
mti2935's user avatar
  • 23.6k
3 votes
Accepted

Is an anonymous FTP user always a risk (even if this user doesn't have access to anything)?

That connection does not mean you have no rights, it means there was a network problem setting up the FTP data connection. Here's a thread on FileZilla's forum about similar errors. Causes range from ...
bonsaiviking's user avatar
  • 11.6k
3 votes

What are the main advantages of using LibreSSL versus OpenSSL

While the OpenSSL project was busy missing the OpenSSL 3 release date by several years, firing multiple project managers in the process, the LibreSSL developers have started to replace large swaths of ...
Farshid Ashouri's user avatar
3 votes

Looking for some sort of system wide auditing tool

I recommend OSSEC, and or (mentioned by Schroeder) Tripwire. However, I also recommend principle of least privileges. If you have your developers all using escalated privileges to do their work, I ...
munkeyoto's user avatar
  • 8,692
3 votes
Accepted

Is allow_url_fopen always a security risk?

It is a security risk in the sense, that it is incredibly tricky to get right. A small mistake you may have no idea you made could compromise you. That being said, if you do actually get it correct, ...
Peter Harmann's user avatar
3 votes

How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?

Reading your post, I think I understand your ask. You've already taken a great step of securing your credentials within a vault, but now you're concerned that the API credentials that allow you to ...
Connor Peoples's user avatar
3 votes
Accepted

Why would a hacker bother with stealing your database password?

But if somebody can steal it from those places, then s/he can already inject code into your system This premise is wrong. Especially for a config file, there are multiple ways the password could be ...
Anders's user avatar
  • 65.6k
2 votes
Accepted

Network configuration: Preventing my computer being used as a proxy?

Your question of why the forward rule doesn't work is essentially a networking question, so I'll explain using an analogy. Imagine there are three people involved in the sending of a letter - Alice, ...
tlng05's user avatar
  • 10.4k
2 votes

What is the best practice for giving Oracle DB credentials to a Java Application?

The standard that I've seen is simply use file system permissions - to do so, you need to ensure that the application is running as a dedicated user - that no other application uses that user; that ...
crovers's user avatar
  • 6,381
2 votes

Publishing proxy server IP address on github

It's probably not something devastating, but it's certainly unwise. Ignoring an attacker using it for discovery (and someone will someday), the bigger issue is storing configuration files in your SCM ...
Josh Bressers's user avatar
2 votes
Accepted

CIS recommendations - disabling ip forwarding

Is there a bigger reason to do what the recommendation says, other than to make sure the default parameter is set? Similar to configuring firewall ACLs, the best practice is to explicitly configure ...
HashHazard's user avatar
  • 5,175
2 votes

Ways to configure a router

Change your default admin password to something secure Use WPA2 for wifi access with a very long password which should be periodically changed. Set up MAC address filtering to allow only devices ...
iainpb's user avatar
  • 4,172
2 votes

Permissions for configuration file for program run as root that must be modifiable by SFTP

Assuming the only member of the sftp-user group is sftp-user, all of the permissions you have listed would be equivalent. The only users that would be able to read or write the file would be sftp-...
David's user avatar
  • 16.1k

Only top scored, non community-wiki answers of a minimum length are eligible