Tag Info

New answers tagged

0

You cannot edit this User Rights Assignment policy because this setting is being managed by a domain-based Group Policy. In this case, the domain Group Policy setting has precedence and you are prevented from modifying the policy via Local Group Policy. To modify this policy, either: Modify the policy in the applicable domain Group Policy Object. Prevent ...


0

You can do it with a PAM module in Python. First make this new module: import crypt, spwd, syslog def auth_log(msg): """Send errors to default auth log""" syslog.openlog(facility=syslog.LOG_AUTH) syslog.syslog("SSH Attack Logged: " + msg) syslog.closelog() def check_pw(user, password): """Check the password matches local unix password on file""" ...


0

Anything to do with time you are better off putting in the script. import time start = datetime.date.today() <doing something> end = datetime.date.today() runtime=end - start output values to a log or database. Connect to your logging server over a secured connection like https making sure it is using TLS 1+ instead of SSL. Databases make ...


0

As have been pointed out, ping needs the permission to bind a raw IP socket. Traditionally setuid has been used to allow normal users to use it. However, using capabilities (POSIX 1003.1e, capabilities(7)), a minimal set of capabilities can be selectively enabled, limiting the security consequences of potential vulnerabilities. ping needs the capability ...


0

Install the uBlock Origin add-on. Go to the uBlock Origin dashboard and click on the "My filters" tab. (Alternatively, paste this into FireFox's address bar and then hit enter: chrome://ublock0/content/dashboard.html#1p-filters.html .) Add the following rule on a line by itself http://* Click the "Apply changes" button. Done!


0

My suggestion would be to use WPA2, and if you have problems switch to WPAWPA2. If the network has constantly changing devices, then you are probably fine with WPAWPA2


1

There is no IPS, ACL, etc. by default. By looking at your config, everyone from ISP interface f0/0 could reach vlan 1 if proper routing is configured. Anyway, because you don't perform any NAT, if f0/0 is connected to an ISP directly, your traffic from Vlan1 will be dropped because of the private IP addressing. Security can't be explained in a short ...


0

Taking ownership of a folder does not affect the permissions of files or folders outside that folder. Taking ownership of a folder typically would, however, affect the permissions of its contents, including any subfolders. This is because folder contents are set by default to inherit the permissions of the parent folder. Any files or folders not inside the ...


0

Simple PowerShell command to fix such files: Unblock-File -Path This essentially removes the ADS which IE slaps while downloading from other sources. Also helpful is the following script if you wish to search and remove all blocked files download in a folder: #Search and unblock all files recursively $p="C:\Download Folder\*" $c=gci -Path $p -Recurse | ...


-1

When you choose reset your PC you will have the options to "Fully clean the drive" or "Just remove my files". By picking "Fully clean my drive" it will take several hours and it will attempt to overwrite anything on the drive with zeroes, so yes it will. You have to remember there are some companies capable of restoring data from your disk but this will make ...


0

Secureboot provides a "chain-of-trust" so as to theoretically allow you to run code that has an extremely high confidence of being the exact code that was signed with a trusted key. The firmware that supports this is seeded with an x509 certificate by the manufacturer, which is embedded in the firmware. It is a somewhat clever platform, that does allow you ...


0

There are several things going on here, and I may miss some, but here goes. Security by obscurity: check your auth log some time. There are likely hundreds of root login attempts by automated scripts every day, and disallowing login by that user blocks some low hanging fruit. Legacy policies: it's not as big a deal with key-based authentication, but with ...


1

fail2ban just updates your firewall rules ("Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured."). It would be better to just configure your firewall manually to only allow connections to applications like SSH ...


2

... via FTP Client Cyberduck, It said that the connection is not secure The server (real name and certificates hidden, but was is shown shows what happened with the real server) uses a self-signed certificate which also does not match the hostname: $ openssl s_client -starttls ftp -connect ftp.example.com:21 ... Certificate chain 0 ...


3

I would venture to say that the server you are ftp'ing to is configured as described in this FileZilla wiki article. https://wiki.filezilla-project.org/FTP_over_TLS It will allow ftp over tls if the user opts on the client side. Have you tried setting you ftp client, in your case "cyber duck", to use tls? That wiki page explains how to configure some ...


0

So, weird solution was to not go through the VPC secrurity settings. Leaving my own answer in case anyone else is baffled. Also, this is specific to enabling inbound traffic for a DB. If I go via my RDB instance's "details" tab and click on the security group, a new dropdown is available for custom or "my ip" which worked. No idea why this modal dialog is ...


0

Unless you work for Facebook, you will never know the IP addresses or any other details users are using to connect/login. And even if you knew the IP address, how would that help? For example, if someone is at a coffeeshop and uses their free Wi-Fi to login to a fake account, that coffeeshop’s IP address would show up in a log. And that alone would not mean ...


0

According to the Windows Server 2012 Group Policy Reference guide: On Windows Server 2012 and Windows 8, Network Level Authentication is enforced by default. While the option to enable or disable NLA has been removed from the GUI interface, it's still configurable via the Group Policy setting Require user authentication for remote connections by using ...


2

Yes. hostapd does this. I'm 99% sure it can be configured to act as the 802.1X authenticator for a wired Ethernet interface as well, even though it's primarily considered a wireless tool.


1

In programming you can specify which file type you are searching for using the attributes of that file. Here is a good example: https://msdn.microsoft.com/en-us/library/7b748c15(v=vs.90).aspx You will simply look for files that match your desired file type (not hidden). Do keep in mind that your method of deleting will more than likely be recursive as ...


2

RFC 5746 describes a Transport Layer Security (TLS) Renegotiation Indication Extension, which is intended to protect against attackers injecting data into the connection early on and thus tricking clients and servers into communicating with each other in a manner that is vulnerable to a man in the middle attack. CVE-2009-3555 is an old (late 2009) Common ...


0

If you want to block a specific program, with a specific process name, then yes it is possible. If you want to block the "monitoring" in general, then no, it is not possible, since those information are provided by the OS's APIs.


0

I've updated to version 8.3.7.1864 (Home > Advanced Settings > About HP Client Security) and rebooted, then was able to swipe an enrolled finger again after clicking Home > Password Manager, and saw a list of logins of which the passwords can be shown by select, Edit, View, Cancel on each item. Reportedly, the latest version (8.3.12.1991, sp71565.exe (147 ...


1

The Received headers in an email only track the mail servers that an email passes through. Mail servers run software like sendmail, exim, qmail, postfix, and such. When a user access gmail, he is accessing a web site, not a mail server. The gmail web site runs some kind of mail server software and sends email. The gmail mail server becomes the first (or ...


0

I will add that when using rsync over ssh it is always a good idea to restrict which command can be run with a corresponding key: even if the private key is stolen on the central server only this command can be run on the group of others servers. You can do this with the "command=custom_script" option in the "authorized_keys" file. Just use the "rrsync" ...


1

How you do this specifically depends on what OS you use and what firewall you use. The general rule is to set your firewall to block connections by default so nothing can access the internet at all, then manually add the required rules for the VPN to work. In Windows for example, the built-in firewall rules can be changed to default block on outbound on a ...


2

The question is: Should I be worried? Does this look like an automated attack? Have you received similar input once? I get what it’s saying but are today’s servers really vulnerable to this simple thing? Also, why should it print the content of the file then? My script processes the input as a string and therefore no system file should be read ...


2

Short answer is Gatekeeper The message that you are seeing is a warning from Gatekeeper Gatekeeper is a security feature in OS X that builds on OS X's existing malware checks to help protect your Mac from malware and misbehaving apps downloaded from the Internet. For apps that are downloaded from places other than the Mac App Store, developers can ...


1

I assume you use port 22 for ssh, so if this port is open you always get these kind of login attempts. These are mostly automated scans/dictionary attacks aiming on port 22. They will hammer your server regardless if you turned root login off because these are stupid scripts. All you can and should do is secure your server and monitor it constantly. ...


0

It would take some time and effort on your part to do the set up, but if you are concerned enough about the security risk arising from automatic updates, then you can use your Firewall to block application access. This post gives you the details on how to do this for Windows 7, but most firewalls have a similar concept where you can control the inflow and ...


1

Answering to myself: Use this command to list all encrypted files on the system: cipher /u /n Use this command to display certificate info for the specified file. cipher /c <file> By default Windows uses the EFS certificate that expires latest for encrypting files and folders. The easiest way to manage EFS certificates in Windows is to use the ...


1

If you're on 10.10.5 the 2015-006 security update is not relevant, or more precisely, is already included. It's for users still on 10.10.4 or below, down as far as Mavericks, I think. "Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.4" https://support.apple.com/en-gb/HT205031 has the details of what was included in the update.


0

Virtual patches typically protect against a specific known vulnerability (i.e. they 'patch' the vulnerability) not a vulnerability class. The OWASP Core Rule Set attempts to offer broad generic remediation for entire vulnerability classes like SQL Injection and XSS. There are other available rule sets and services built around virtual patching.


0

I got around this problem by launching the install through an elevated command prompt


2

I have almost the same problem (Hackintosh + Windows). The solution I found was installing another disk controller. These can be cheap ($30) or expensive (real RAID / SAS card on PCIe bus). To the point: Install Windows on its own disk. The motherboard SATA ports are good for this. (Leave the other controller plugged in.) After Windows has been installed, ...


0

I don't own one personally, but the gist of how it works is clear. The system acts as a black box, a network infusion detector and a central hub for communication between PCs. A black box (or honey pot) is a device usually connected to a network that passively waits for connections to its systems. A normal user would never usually access the box, but ...


0

Actually, you can suppress the warn if you want. Just go to "about:config" and modify the value of "full-screen-api.approval-required" to false (is a boolean) and firefox will not warn you at all. I understand that create a 'userChrome.css' solution pointed above is a better option to who want to control the appearance, I just giving this answer to anyone ...


1

Do the opposite if you can. Do a script on the central server with all the rsync actions, and run it from that server. You will keep all the access keys on it. You can set on all client /bin/nologin as a shell to decrease the risks again. If one of the client will fall, all the others will continue to work.


0

As I have same issue with Samsung Laptop Touch Pad. I unplugged the Power Adapter and Tested on Batteries,the Touch Pad worked fine. No Issue. It is a Bad Power Adapter, as Touch Pad working fine on battery.


7

The revelation that the American and British governments have cracked SSL/TLS They haven't "cracked" it sufficiently to make it unusable. They've been abusing bugs which got fixed long ago – some of them were bugs in the individual TLS libraries, but protocols can get updates too, like how the hopelessly-broken WEP and SSLv2 were upgraded to WPA and ...


0

(I have never used UFW, but I am expert with IPTables which its based on, and UFW claims it only allows outbound connections by default - so assuming you go with this answer assumes you go with the default configuration) Turning UFW on on your box will make it so that your computer does not trust other systems on the LAN / WIFI network - which means that it ...


0

I would suggest preventing flooding of ICMP requests by using iptables instead of blocking it permanently: iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 100 -j ACCEPT


1

Just to expand on the existing answer, you'll need something like this for each macro - Sub macro1() If test() Then MsgBox ("you can use macros!") 'do stuff End If End Sub You will start all macros calling test() Function test() test = False 'Pass the user to the checking function If allowed(Environ("username")) Then test = True ...


3

You can use the environ("username") to get the user's Window's Logon ID. You can use that to determine if the macro should run or not.


0

I assume your Dell runs Windows OS. The easiest solution is to schedule a frequent regular synchronization from a drop folder of your local FTP server to the remote SFTP server. For example, with WinSCP, just schedule a regular run of the following batch-file: winscp.com /log=c:\path\sync.log /command ^ "open sftp://user:password@example.com/" ^ ...


0

I was not able to identify what process was creating this requests using the linked answer. Finally I installed Comodo Firewall. Then I was able to identify that I was regularly receiving requests over the internet to port 8888 which was my fiddler listening port. But still a problem remains, I have Dynamic IP allocated. And I am still getting this ...


1

You will not find a live distribution (that was from 1994), but can download the source used in Slackware 2.1 and compile and configure it (see link).


1

The answer is in the quotes you provided: For networks you choose to share access to, and By default, it will not share Wi-Fi passwords with anyone else. For every network you join, you’ll be asked if you want to share it with your friends/social network and there's also been an update added to the first article you quoted: ...that while ...


2

If it's shared how can I prevent it? You need to give your wireless network a new name with "_optout" somewhere in the Wi‑Fi network name (also called the SSID). Note: If you also want to opt out of Google's WiFi network mapping you will also need to include "_nomap" as well in your SSID. Recommendation Prior to upgrade to Windows 10, change ...


3

Though the safest course would be to reinstall the operating system and all applications as suggested by barlop, if you believe that your system has been compromised, I've sometimes found that using several antivirus/antispyware products will allow me to identify malware. It isn't always that one product is far superior to all others, but, instead, that the ...



Top 50 recent answers are included