Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [security]

For questions related to IT Security, Information Security or DevSecOps.

Filter by
Sorted by
Tagged with
1
vote
0answers
14 views

Assign Directory Read/Write Privileges to Azure Service Principal from the command line?

I am trying to provision a user in Azure Active Directory using Terraform's AzureAD provider. At the top of the azuread_user documentation, it states: NOTE: If you're authenticating using a ...
2
votes
1answer
12 views

How to verify hashes of Ansible Galaxy dependencies?

From a security perspective, I don't like the idea of relying only on Git tags, as they could be moved later. Unfortunately, I'm not aware of an official solution to enforce checks. This is the best ...
0
votes
1answer
10 views

Which compliance checking/enforcing tool should be used in Cloud Environment? ( Trubot, Saltstack) [closed]

Today it is a known thing that some cloud services may not be configured securely, this happens because of not knowing how to configure securely. This brings me to the question of "Which tools / ...
2
votes
1answer
30 views

What are the best practices for anti-virus / anti-malware when using containers?

One of the SOC 2 controls is apparently around ensuring antivirus/anti-spam/anti-malware is running on production servers. I've been googling to see if there are any recommendation/best practices for ...
2
votes
1answer
16 views

Provide customers with access to Azure Container Registry

I'm using Azure Container Registry for private Docker images. I want to let around 500 customers pull images and use the Docker V2 HTTP API to read metadata. Service Principals are one way to go ...
1
vote
1answer
12 views

Mitigating Docker Compliance Issues - Can I put everything in the `daemon.json`?

I am going through compliance tasks to harden our Docker setup and I am seeing many things like Favor using docker run with docker run --pids-limit 100 to prevent forkbombs Favor using docker run ...
0
votes
0answers
7 views

Recomendation for automated rotation of a JSON keyring?

I have a Sailsjs app that is configured to encrypt model attributes with sensitive information. This seems to use bcrypt, under the hood and leverages a JSON keyring in the configuration (...
0
votes
0answers
36 views

Per machine credentials for privileges escalation using AWX

I have an inventory with a lot of hosts in it using the same credentials, but one host needs a different approach. For the ssh connection a different user is used, after the connection is established, ...
0
votes
1answer
20 views

Securely saving AZURE_STORAGE_KEY and storage account name in Linux systems

The Azure CLI official documentation states that environmental variables can be used inside bash scripts to store AZURE_STORAGE_ACCOUNT and AZURE_STORAGE_KEY, like this: Compared to AWS CLI this ...
2
votes
1answer
24 views

Restrict user logon in Jenkins

We have been using groovy script to read the build queue state: def builder = new groovy.json.JsonBuilder() builder { queueItems(Jenkins.instance.queue.items.collect { obj -> [ id:...
0
votes
0answers
12 views

How to make sure the storage of an AWS isn't accessible without a private ssh key?

Is there a way to encrypt the EBS attached to an EC2 instance in such a way that it can't be re-attached to another EC2 instance and read by someone without the private key required to access the ...
1
vote
1answer
31 views

Are using TestContainers safe for integration tests?

I have a discussion with our DevOps about using Testcontainers for integration tests. It's a tool to bring up throw-away containers for testing. The testcontainers need a environment variable ...
2
votes
1answer
67 views

Azure Security Center with Ubuntu 19

Has anyone successfully gotten the Azure Security Center agent to work with Ubuntu 19? My omsconfig.log is full of messages like This event indicates that failure happens when LCM is trying to get ...
1
vote
0answers
169 views

Accessing TPM from inside a Docker Container

I want to implement Vault as part of the DevOps build pipeline to store all the secrets like passwords and certificates. I understand that Vault keeps the data encrypted but I have been asked me to ...
0
votes
2answers
44 views

What is the most common server permission policy for web application deployment?

I have a server with Ubuntu with a web server (Apache or Nginx) running a PHP application. The application consists of the following parts: An executable code that handles HTTP requests (say in the /...
0
votes
0answers
38 views

AWS IAM policy and reduce access to only the latest services used

I want to limit the user access to all the last services used: But I want to remove the Administrator Access privilege from the user "circleci'. I started to add policies in the user group "circleci"...
0
votes
0answers
9 views

Scanning CoreOS for CVEs

I want to scan a CoreOS iso for CVEs. How do I do this? I have scanned container images before with Clair and JFrog XRay, but I can find no resources on scanning an iso of an OS and cross referencing ...
1
vote
1answer
48 views

How can I expose port 3389 using a secure approach

Within our legacy infrastructure we need to keep port 3389 exposed so that we can remote desktop into this server (note that we can't go back and utilize IaC to prevent this). We currently restrict ...
5
votes
2answers
68 views

Securing communication between cloud VMs without private networks. Any strategy besides building own VPN? Spiped?

I am working on an application that requires a number of different services (web application + database + worker queues, XMPP server for messaging, redis, central authentication via LDAP, etc). For my ...
3
votes
1answer
58 views

How to securely pass sensitive data to EC2 Spot instances?

Right now, we only use EC2 on-demand instances, and we provision sensitive data (credentials, private keys, etc.) on the instances' EBS which are encrypted with a KMS key. My understanding is that I ...
1
vote
0answers
85 views

How to securely distribute and use Nexus credentials?

Nexus has been implemented in the company a couple of months ago. The side effect is that credentials are required to download artifacts and thus everybody that compiles the code requires a password. ...
1
vote
0answers
76 views

How to setup external service (keycloak) to protect an app in kubernetes?

I have a java application protected by keycloak (that's an standalone application for session control which runs on port 9080). Keycloak is available to world because during auth process, my app ...
1
vote
0answers
58 views

What are the security loopholes closed by introducing Istio

My application consists of four microservices. (hr, salary, stock and employee). Users of the application access the "hr" service using http. To fulfill this request the hr microservice communicates ...
1
vote
1answer
2k views

How can you pass private environment variables to FARGATE tasks specified from a Docker Compose config

I am using an existing docker-compose.yml to migrate an app to ECS. The config references several $ENV vars which I used to pass in simply as environment variables when running docker-compose up. One ...
-3
votes
1answer
293 views

How can CaaS, PaaS, and FaaS users know if the operating system of their server environment is of the newest release?

Please consider this chart a moment; it shows the different hosting models common today: From the chart I learn that CaaS, PaaS and FaaS are three hosting-models by which a user can't control the OS ...
2
votes
1answer
185 views

Context of DevOps in ISO 27001 security audits

Correct me if I am wrong, ISO 27001 addresses mostly organizational and operational aspects. This sounds a little bit abstract and regulatory. On the other hand, in DevOps, if you wish DevSecOps, ...
0
votes
2answers
38 views

Understanding and tweaking AWS policies for job functions

There are quite many possibilities to configure AWS policies; Amazon has therefore provided policies for job functions. Now is it anyhow possible to sneak into JSON code of these policies to learn in ...
4
votes
2answers
406 views

Docker security risks passing secrets over environment variables

I'm new to Docker and want to put my Django web application into containers. For the last couple days I'm struggling with passing credentials safe to containers. Online there is always the hint ...
1
vote
1answer
349 views

Error during setup of clairctl for container scanning with clair

I am trying to setup clairctl to scan our application images and so wanted to install the full stack of clairctl, clair scanner & postgress database. I did the following steps: Acquired a VM ...
1
vote
0answers
80 views

MFA for Artifactory Cloud

We're using Artifactory Cloud for our artifact repository. Our compliance people now demand that logins need to be MFA. It appears to me that the only way to get MFA (multifactor authentication, ...
1
vote
0answers
15 views

How to avoid an avalanche of images in Openshift when security patches keep coming in?

Our applications are based on tomcat, strictly speaking on tomcat base s2i image provided by RedHat. This is updated quite frequently, and we need to comply to some regulations and apply the updates. ...
2
votes
1answer
47 views

Bad practice having a single SSH gateway with access to all environments?

I have started at a new company and am in the process of locking down SSH access to be through a single SSH gateway server. My question is, should I create a separate SSH gateway server for each ...
1
vote
1answer
72 views

Possibility of container breakout compared to VM (virtual machines)

What is exactly the (higher) vulnerability at least theoretically of a container compared to VM? given, all security recommendations are implemented (like, user context is root, no host sensitive ...
0
votes
1answer
27 views

What are best practices for securing connections between CI and artifact managers in the cloud?

Bitbucket, github, circleci are examples of Continuous Integration and Continuous Deployment (CI/CD) tools in the cloud. In the past, a lot of companies ran all services, like CI/CD and artifact ...
1
vote
1answer
41 views

Does the Chef bash resource create history entries?

I know that using a password in the command line is a bad idea because bash commands can be recorded in history. If I run a command in the chef bash resource though, when I look up the history I don'...
3
votes
0answers
175 views

Encrypted at rest persistent volume in kubernetes?

Is there a recommended approach to using encrypted file system for persistent volumes in kubernetes? Perhaps mounting a LUKS fs disk image file ?
2
votes
2answers
101 views

How do you know which secrets and credentials of your production services were used, and by whom/what?

The context of the question is Secrets management. As the title says, how do you know which secrets and credentials of your production services were used, and by whom/what?
1
vote
2answers
63 views

How do you change a secret that half of your production applications use right now?

The context of the question is Secrets management. As the title says, how do you change a secret that half of your production applications use right now?
6
votes
3answers
242 views

When your micro service in production needs a secret, where is the secret stored and retrieved from?

The context of the question is Secrets management. How do you manage storing and retrieving secrets for your micro service which is in production?
4
votes
2answers
3k views

Docker MongoDB image - How to specify credentials other than in the compose file?

I'm using this docker image https://hub.docker.com/_/mongo/. That image provides a way of initializing a mongodb root database user with env variables which I can specify in the compose file as ...
3
votes
2answers
82 views

Mitigating Maven Central risks as seen from the DevSecOps perspective

AFAIK there are two official primary repositories for Maven packages (Java language): search.maven.org offered by Sonatype Inc. mvnrepository.com offered by a private person @frodriguez Now ...
0
votes
1answer
43 views

From a security perspective, to which location should one copy an app inside a docker image?

I use docker to deploy a lot of apps since a couple of years. Today I ask myself, should I copy my app to a different location in the docker image? I used to copy the file to the root, e.g. COPY . /...
3
votes
3answers
4k views

How to list security groups for the specific instance via CLI?

I'm looking for syntax like: aws ec2 describe-security-groups --instance-id i-0xyz however, the above sub-command doesn't support --instance-id parameter. I've checked and there are --filters and --...
24
votes
4answers
10k views

Where to put ansible-vault password

We are planning to use ansible vault in our project to prevent leaking passwords or keys in git. The idea is to put all our sensitive data into a plain file then encrypt this file with ansible-vault ...
1
vote
1answer
581 views

terraform chef provisioning - cannot validate certificate for 10.90.239.223 because it doesn't contain any IP SANs

While configuring the chef provisioner I am running into the following error after running 'terraform apply' chef_environment.terraform_01: Post https://10.90.239.223/organizations/mykitchen/...
3
votes
1answer
36 views

Is it possible to securely delete a file from a virtual disk in a cloud provider?

Considering that virtual hard drives are generally formatted using something like ext3 that abstracts away from the underlying block device, which in and of itself is an abstraction over the top of a ...
2
votes
1answer
287 views

Issue integrating acunetix with jenkins

The first of all, thank you for reading my question, I really appreciate it! I am trying to integrate jenkins and acunetix (a vulnerability scanner software), but it seems to be near impossible...My ...
2
votes
1answer
648 views

Real-World Validating the Integrity of a Docker Container

I'm interested in information and experiences surrounding Docker security. I'd like to understand ways that a user/client could validate the contents of an image to ensure that the packaged ...
7
votes
3answers
289 views

Running unmanaged Hardware Security Modules (HSMs) in the Cloud

I have to admit to never having asked, or been asked, the question if it is possible to have a Hardware Security Module in a public cloud, by which I mean Google, Amazon or Azure. Has anyone found ...
11
votes
2answers
3k views

Is it bad to use sudo from Jenkins?

I use Publish Over SSH plugin to deploy my apps from Jenkins to different environments. Some deployment jobs do environment preps and things like stop and restart the app server system service. Some ...