Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

For questions related to IT Security, Information Security or DevSecOps.

-1
votes
1answer
10 views

How can CaaS, PaaS, and FaaS users know if the operating system of their server environment is of the newest release?

Please consider this chart a moment; it shows the different hosting models common today: From the chart I learn that CaaS, PaaS and FaaS are three hosting-models by which a user can't control the OS ...
-1
votes
0answers
27 views

How to install and set ufw for Debian with Ansible? [on hold]

I deploy an Ansible playbook to some debian:stable machines on which I desire to update packages, install and set ufw. - name: update the apt package index i.e. apt update apt: update_cache=yes - ...
2
votes
1answer
21 views

Context of DevOps in ISO 27001 security audits

Correct me if I am wrong, ISO 27001 addresses mostly organizational and operational aspects. This sounds a little bit abstract and regulatory. On the other hand, in DevOps, if you wish DevSecOps, ...
0
votes
0answers
11 views

How to filter the ingress traffic to a docker container by changing IPtables in docker host machine

There is an apache server is started in a docker container and it acquires following IP address 172.21.0.3 The gateway IP and prefixlen is as follows 172.21.0.1/16 and the virtual interface attached ...
0
votes
2answers
24 views

Understanding and tweaking AWS policies for job functions

There are quite many possibilities to configure AWS policies; Amazon has therefore provided policies for job functions. Now is it anyhow possible to sneak into JSON code of these policies to learn in ...
0
votes
0answers
11 views

Managing IAM policies with Terraform to implement CRUD of AWS resources

Recently I have discovered this feature request for Terraform to support advanced management of AWS IAM policies, specifically to implement the CRUD (Create, Read, Update, Delete) method. In the ...
0
votes
0answers
21 views

How important is it to configure a CA for a Kubernetes cluster?

Our IT department have setup a Kubernetes cluster for our development work using kops, and we've run kube-bench on it to see what security issues need to be addressed. Currently there's a lot of ...
4
votes
2answers
75 views

Docker security risks passing secrets over environment variables

I'm new to Docker and want to put my Django web application into containers. For the last couple days I'm struggling with passing credentials safe to containers. Online there is always the hint ...
1
vote
1answer
50 views

Error during setup of clairctl for container scanning with clair

I am trying to setup clairctl to scan our application images and so wanted to install the full stack of clairctl, clair scanner & postgress database. I did the following steps: Acquired a VM ...
0
votes
0answers
54 views

how to setup authentication for kubernetes dashboard ?

how to setup authentication(username/Password) for kubernetes dashboard ? I have checked Securing the Kubernetes and Authentication using a token Token based Authentication can be done but can we ...
0
votes
0answers
22 views

MFA for Artifactory Cloud

We're using Artifactory Cloud for our artifact repository. Our compliance people now demand that logins need to be MFA. It appears to me that the only way to get MFA (it's not natively supported) is ...
1
vote
0answers
13 views

How to avoid an avalanche of images in Openshift when security patches keep coming in?

Our applications are based on tomcat, strictly speaking on tomcat base s2i image provided by RedHat. This is updated quite frequently, and we need to comply to some regulations and apply the updates. ...
2
votes
1answer
46 views

Bad practice having a single SSH gateway with access to all environments?

I have started at a new company and am in the process of locking down SSH access to be through a single SSH gateway server. My question is, should I create a separate SSH gateway server for each ...
0
votes
0answers
36 views

What are best practices to use Ansible-Vault in conjunction with k8s

Some companies seem to use ansible-vault in conjunction with k8s to ensure that sensitive content like passwords that reside in yaml file are encrypted. In order to apply this should one deploy the ...
1
vote
1answer
48 views

Possibility of container breakout compared to VM (virtual machines)

What is exactly the (higher) vulnerability at least theoretically of a container compared to VM? given, all security recommendations are implemented (like, user context is root, no host sensitive ...
0
votes
0answers
25 views

Kubernetes dashboard hardening

Given Basic Authentication is enabled for Kubernetes dashboard. Is it beneficial to provide minimal rights to the dashboard service account, and then sign in with a more unrestricted service account ...
0
votes
1answer
19 views

What are best practices for securing connections between CI and artifact managers in the cloud?

Bitbucket, github, circleci are examples of Continuous Integration and Continuous Deployment (CI/CD) tools in the cloud. In the past, a lot of companies ran all services, like CI/CD and artifact ...
1
vote
0answers
20 views

Does the Chef bash resource create history entries?

I know that using a password in the command line is a bad idea because bash commands can be recorded in history. If I run a command in the chef bash resource though, when I look up the history I don'...
2
votes
0answers
72 views

Encrypted at rest persistent volume in kubernetes?

Is there a recommended approach to using encrypted file system for persistent volumes in kubernetes? Perhaps mounting a LUKS fs disk image file ?
0
votes
0answers
17 views

Designing parameterized custom default security groups for VPCs in AWS

I plan to restrict creation and modification of security groups for my developers. Instead, provide them with a custom-made Security Groups CloudFormation template. As I create a parameterized ...
0
votes
0answers
34 views

docker lemp stack firewall and isolation

I am currently developing a web app to be run inside of a docker lemp stack. at this point, my compose file has 3 services: s_nginx, s_php, s_mariadb. there are 3 networks defined in the compose ...
2
votes
2answers
86 views

How do you know which secrets and credentials of your production services were used, and by whom/what?

The context of the question is Secrets management. As the title says, how do you know which secrets and credentials of your production services were used, and by whom/what?
1
vote
2answers
61 views

How do you change a secret that half of your production applications use right now?

The context of the question is Secrets management. As the title says, how do you change a secret that half of your production applications use right now?
7
votes
2answers
202 views

When your micro service in production needs a secret, where is the secret stored and retrieved from?

The context of the question is Secrets management. How do you manage storing and retrieving secrets for your micro service which is in production?
2
votes
0answers
45 views

Secrets management [closed]

I got three questions about secrets management: 1)When your micro service in production needs a secret, where is the secret stored and retrieved from? 2)How do you change a secret that half of your ...
4
votes
2answers
1k views

Docker MongoDB image - How to specify credentials other than in the compose file?

I'm using this docker image https://hub.docker.com/_/mongo/. That image provides a way of initializing a mongodb root database user with env variables which I can specify in the compose file as ...
3
votes
2answers
70 views

Mitigating Maven Central risks as seen from the DevSecOps perspective

AFAIK there are two official primary repositories for Maven packages (Java language): search.maven.org offered by Sonatype Inc. mvnrepository.com offered by a private person @frodriguez Now ...
0
votes
1answer
41 views

From a security perspective, to which location should one copy an app inside a docker image?

I use docker to deploy a lot of apps since a couple of years. Today I ask myself, should I copy my app to a different location in the docker image? I used to copy the file to the root, e.g. COPY . /...
3
votes
2answers
872 views

How to list security groups for the specific instance via CLI?

I'm looking for syntax like: aws ec2 describe-security-groups --instance-id i-0xyz however, the above sub-command doesn't support --instance-id parameter. I've checked and there are --filters and --...
13
votes
3answers
3k views

Where to put ansible-vault password

We are planning to use ansible vault in our project to prevent leaking passwords or keys in git. The idea is to put all our sensitive data into a plain file then encrypt this file with ansible-vault ...
1
vote
1answer
261 views

terraform chef provisioning - cannot validate certificate for 10.90.239.223 because it doesn't contain any IP SANs

While configuring the chef provisioner I am running into the following error after running 'terraform apply' chef_environment.terraform_01: Post https://10.90.239.223/organizations/mykitchen/...
3
votes
1answer
35 views

Is it possible to securely delete a file from a virtual disk in a cloud provider?

Considering that virtual hard drives are generally formatted using something like ext3 that abstracts away from the underlying block device, which in and of itself is an abstraction over the top of a ...
2
votes
1answer
153 views

Issue integrating acunetix with jenkins

The first of all, thank you for reading my question, I really appreciate it! I am trying to integrate jenkins and acunetix (a vulnerability scanner software), but it seems to be near impossible...My ...
2
votes
1answer
334 views

Real-World Validating the Integrity of a Docker Container

I'm interested in information and experiences surrounding Docker security. I'd like to understand ways that a user/client could validate the contents of an image to ensure that the packaged ...
7
votes
3answers
213 views

Running unmanaged Hardware Security Modules (HSMs) in the Cloud

I have to admit to never having asked, or been asked, the question if it is possible to have a Hardware Security Module in a public cloud, by which I mean Google, Amazon or Azure. Has anyone found ...
10
votes
2answers
1k views

Is it bad to use sudo from Jenkins?

I use Publish Over SSH plugin to deploy my apps from Jenkins to different environments. Some deployment jobs do environment preps and things like stop and restart the app server system service. Some ...
2
votes
1answer
54 views

Sharing Gems between Chef and System Ruby

I know about the chef_gem resource obv, but in the interests of good system hygiene I would like to avoid as much as possible duplication, so I would like to share Gems between the embedded Ruby ...
0
votes
1answer
84 views

Kubernetes user mode in production

Docker daemon has to run in root mode which brings up security discussions. How is this with Kubernetes daemon - can it run not as root? Note: both of these products allow you to reduce the scope ...
1
vote
1answer
298 views

What tool is able to analyze images by connecting to clair?

This clair documentation indicates that a number of tools should be able to scan images: clair-scanner reg klar clairctl analyze-local-images All of them have been tried, but none of them seems to ...
2
votes
1answer
2k views

Docker Security Scanning: How to integrate Clair with a docker private registry?

According to the following documentation it should be possible to integrate clair with a docker private registry. How to do that? Registry Integration Clair can be integrated directly into a ...
6
votes
4answers
1k views

Ansible - private git repositories - SSH agent forwarding vs copying private SSH key

I recently started playing around with Ansible and it seems very nice. I don't have much experience in DevOps stuff and never really had to handle any complex scenarios. I started creating my Ansible ...
6
votes
1answer
3k views

Running the docker daemon without root

Inspired by What are best and comprehensive practices to consider when running docker in production? , I stumbled over Why we don't let non-root users run Docker... They came up with docker run -ti ...
36
votes
5answers
2k views

What are best and comprehensive practices to consider when running docker in production?

Finally, you are so much in love with Docker that you want to move your online business-critical production systems with sensitive customer data to a Docker Swarm. Some might even already have done so....
4
votes
1answer
271 views

Docker Sign an Image with an existing Certificate

With respect to docker's security system. Is it possible to somehow get images signed by some entity that has trust from a company's CA-cert and then be able to find out who signed the image? It ...
0
votes
2answers
4k views

How do I launch Lambda in my own VPC?

The VPC configurations option in Lambda tells this: All AWS Lambda functions run securely inside a default system-managed VPC. However, you can optionally configure Lambda to access resources, ...
1
vote
1answer
54 views

What are known component intelligence tools?

What are available - free and commercial - solutions to create reports about components used in a software project (physically, set of source code repositories), with intelligence on features like ...
12
votes
5answers
950 views

How to prohibit access to internals of Docker container?

I want to deliver my app to customers in form of docker image. But it is crucial to ensure that end-user do not alter anything inside the container. User should only be able to run/stop the container ...
9
votes
3answers
1k views

Open Ports on Google Cloud Load Balancer

It seems that by default, Google Cloud load balancers expose a number of ports unecessarily. I haven't found a way to expose only 80/443 and every time I make one of their load balancers, the ...
18
votes
2answers
5k views

What Is SecOps?

First when I heard the word SecOps, I thought of it as a management approach that aims to connect security and operations teams, in much the same way that DevOps unifies developers and operations team....
7
votes
2answers
236 views

What strategies can be employed to secure sensitive data in log files?

Working in highly regulated environments data is classified in different ways depending on the sensitivity. In some cases, this is legally enforced and must be treated differently. Examples of a data ...