Questions tagged [security]

For questions related to IT Security, Information Security or DevSecOps.

Filter by
Sorted by
Tagged with
1 vote
0 answers
11 views

Private certificate authority and container images

We have a internal domain name, let's say "mycompany.net" with a private CA which delivers all our internal application HTTPS certificates for this domain like "myapp.mycompany.net"...
user avatar
  • 111
0 votes
0 answers
33 views

What ports to hide for docker swarm?

I am setting up a docker swarm for production and while the documentation is great, I still struggle to figure out exactly what ports should be open/closed for different purposes. In my scenario, I am ...
user avatar
0 votes
1 answer
14 views

Is the output of "Test the function" of a Google Cloud Function saved somewhere?

I have returned the database address with username and password as the plain text output of a Cloud Function during testing. The idea was to see how the db URL looks like and where the error could be ...
user avatar
0 votes
0 answers
10 views

Tools for "scanning" container (hardening) vulnerabilities vs tools for "performing" the hardening

Container hardening is the process of fixing the vulnerabilities. CIS has published a list of container vulnerabilities which should be addressed to complete the hardening process. Q1. Are there ...
user avatar
  • 225
1 vote
1 answer
106 views

Where to get OS Hardening Scripts for CIS Hardening Standards?

CIS provides benchmarks for hardening OS on AWS CIS also provides images which meet their own benchmarks above These CIS images are available here - https://www.cisecurity.org/blog/everything-you-need-...
user avatar
  • 225
4 votes
1 answer
51 views

What are the real world benefits of RDS instance (at rest) encryption?

AWS offers at rest encryption for its RDS instances. I think this sounds nice, and it's something that comes up regularly on security reviews but I'm not sure what the real benefit is. The most likely ...
user avatar
  • 295
0 votes
0 answers
8 views

How to pass sensitive data to new gcloud compute instances?

In AWS cloud formation I have some semblance of security in that when I provision a host with some credentials. (at least it appears as a bunch of asterices on the web console). But when I use a ...
user avatar
  • 1,306
1 vote
1 answer
31 views

Common permissions for EC2 usage and VPC Security Groups in enterprise use

Context: Looking to create some software that acts as middleware to a user's AWS account, where the user will provide their cloud credentials, and have the software use their EC2 instances. Question: ...
user avatar
  • 13
1 vote
1 answer
54 views

Strategies for sharing Ansible vaults with root/administrator credentials?

Historically we've been a one man devops team and stored all our passwords in Ansible vaults - including things like domain admin passwords and root account passwords. However we're now growing and ...
user avatar
  • 111
1 vote
0 answers
13 views

HSM into cloud for windows authenticode signing - Cost benefits vs Security risks?

Our product has 4 apps (Windows, macOS, iOS & Android) with a partially combined build pipeline. 90% is run in the cloud (Android, iOS & macOS are built entirely on cloud infrastructure) but ...
user avatar
1 vote
1 answer
257 views

OIDC token invalid when put into kubeconfig

I can connect to the Kubernetes API from a container running inside the cluster with an OIDC token like so: kubectl —token $token get pod I would now like to prepare a kubeconfig such that other ...
user avatar
  • 141
5 votes
1 answer
485 views

Terraform: how do you inspect sensitive data?

In a resource of type aws_ecs_task_definition my plan has an line that looks like this: ~ container_definitions = (sensitive) # forces replacement Now in principle this could be doing anything - ...
user avatar
2 votes
1 answer
59 views

Continuous deployment strategies vs DevSecOps

How do you implement security requirements in CI/CD while taking care of security requirements? What are best practices here? Security requirements may differ, let's assume this simple level of ...
user avatar
0 votes
2 answers
121 views

Docker: Let containers communicate to each other but don't expose to internet

I was recently shocked to find out that docker writes its own iptables rules and ignores ufw bindings completely. I had blocked all ports using the ufw deny incoming command and then selectively ...
user avatar
  • 1
1 vote
1 answer
44 views

AWS Inspector "High Risk" : port open to the internet with IP whitelisting

We use AWS Inspector to identify risks with our AWS assets. Today I received a finding, with a "high" severity. The finding said that the FTP port was open to the internet. However, after ...
user avatar
  • 123
2 votes
1 answer
59 views

What are the best practices for sharing production Postgres access with developers?

We're a small SaaS startup (~10 person team; mostly engineers). We use Postgres on AWS and GCP in production. We have signed contracts with some customers that prohibit us from giving full production ...
user avatar
  • 121
1 vote
1 answer
56 views

Host credential manager and Docker runners

Imagine you have a GitLab Docker runner which you would like to pass credentials from a credential store. That is the CI/CD variable just designates the credentials profile name. Is there a way to ...
user avatar
1 vote
1 answer
82 views

TLS handshake failure

We have an ODBC Driver trying to connect through TLS , but fails. We tested using openssl with the following command and worked fine: openssl s_client -connect xxx.com:31020 the server accepts TLS 1....
user avatar
  • 121
9 votes
2 answers
1k views

Does `npm audit` add any value when using `dependabot`

Context There are multiple ways to scan projects for vulnerabilities. Dependabot can be configured to check repositories for issues, and automatically submits pull requests to resolve. NPM Audit will ...
user avatar
4 votes
1 answer
167 views

How not expose my backend

I'm studying Docker and how to properly publish my containers coding a very simple web application. It has only two containers, backend and frontend. I've published the source code here: https://...
user avatar
  • 43
2 votes
1 answer
59 views

How to protect secrets whilst enabling the ability to amend a pipeline

I'm writing a CI pipeline using GitHub Actions. The pipeline will build a Docker image, which it will then push to our Docker repository (AWS ECR). In order to talk to ECR, we'll need to provide a ...
user avatar
1 vote
1 answer
276 views

Is there a way to tell if an Azure Devops Extension is secure to use?

How do I know that an Azure Devops Extension does not do anything really bad? A company that I know of uses Microsoft's Azure Devops platform to manage its software development. Microsoft also ...
user avatar
1 vote
1 answer
90 views

How do I setup an OpenShift route that will allow both 80 and 443 traffic to my app?

I'd like to setup a route that will pass both 80 and 443 traffic to the same service in OpenShift. When I try to create a second route it errors out. I want this to be in a yaml like would be used ...
user avatar
  • 273
2 votes
1 answer
32 views

Company is worried about exposing our PII to Tableau, Can we run Tableau without exposing our data to any 3rd parties?

I'm looking to understand a bit more from the technical side about how Tableau (The company itself) works with the data that everyone is providing them. My company is looking to use Tableau as our ...
user avatar
1 vote
1 answer
41 views

Weird requests filling apache access logs [closed]

I'm running a public apache2 webserver. I'm getting a lot of this kind of requests on my webserver: 91.251.142.16 - - [07/Mar/2020:19:58:09 +0100] "\xe8\x95h\x8d\xf0\x1d\x99Q\xb8~\xb5\xbc\xa7*\x1c\...
user avatar
4 votes
3 answers
172 views

What is the Prometheus and Grafana ideal setup?

I am just wondering. If I have many environments monitored via Prometheus, what will be the best configuration? The security and efficiency are already important for on-premise installations but ...
user avatar
  • 155
3 votes
2 answers
1k views

How do I expire users credentials for Kubernetes in Azure?

I am looking for information on how to forcefully expire users credentials in Azure Kubernetes Service (AKS). The reason is to better understand Security models and protecting Kubernetes deployments ...
user avatar
0 votes
2 answers
56 views

How to run Ansible command to update imunify360 settings

How can I use Ansible to run the following CloudLinux Imunify360 commands properly on CloudLinux 7 (similar to CentOS7)? I tried different ways to "escape" the colons in the commands and it doesn't ...
user avatar
  • 27
0 votes
1 answer
42 views

Unable to connect to remote service using AWS VPC Peering

I have a question regarding some AWS infra I'm trying to build. Due to legacy constraints, I have a service running in a remote VPC that I need to access, and I have a new service I'm developing in ...
user avatar
  • 141
0 votes
1 answer
680 views

Ansible SSH best practices

What are the best practices to be followed wrt security when it comes to SSH authentication (password less, key based, etc.) when setting up Ansible in a new environment with 1000s of machines? Which ...
user avatar
1 vote
1 answer
69 views

How to create unique GPG Keys for different environments / projects

After searching and reading various documents it remains unclear to me as to an effective/straightforward manner to create/maintain multiple sets of GPG Keys. I have a project that needs unique GPG ...
user avatar
1 vote
1 answer
419 views

Assign Directory Read/Write Privileges to Azure Service Principal from the command line?

I am trying to provision a user in Azure Active Directory using Terraform's AzureAD provider. At the top of the azuread_user documentation, it states: NOTE: If you're authenticating using a ...
user avatar
2 votes
1 answer
67 views

How to verify hashes of Ansible Galaxy dependencies?

From a security perspective, I don't like the idea of relying only on Git tags, as they could be moved later. Unfortunately, I'm not aware of an official solution to enforce checks. This is the best ...
user avatar
6 votes
1 answer
4k views

What are the best practices for anti-virus / anti-malware when using containers?

One of the SOC 2 controls is apparently around ensuring antivirus/anti-spam/anti-malware is running on production servers. I've been googling to see if there are any recommendation/best practices for ...
user avatar
  • 163
3 votes
1 answer
104 views

Provide customers with access to Azure Container Registry

I'm using Azure Container Registry for private Docker images. I want to let around 500 customers pull images and use the Docker V2 HTTP API to read metadata. Service Principals are one way to go ...
user avatar
  • 153
1 vote
1 answer
190 views

Mitigating Docker Compliance Issues - Can I put everything in the `daemon.json`?

I am going through compliance tasks to harden our Docker setup and I am seeing many things like Favor using docker run with docker run --pids-limit 100 to prevent forkbombs Favor using docker run ...
user avatar
  • 1,153
1 vote
0 answers
89 views

Per machine credentials for privileges escalation using AWX [duplicate]

I have an inventory with a lot of hosts in it using the same credentials, but one host needs a different approach. For the ssh connection a different user is used, after the connection is established, ...
user avatar
0 votes
1 answer
158 views

Securely saving AZURE_STORAGE_KEY and storage account name in Linux systems

The Azure CLI official documentation states that environmental variables can be used inside bash scripts to store AZURE_STORAGE_ACCOUNT and AZURE_STORAGE_KEY, like this: Compared to AWS CLI this ...
user avatar
  • 187
2 votes
1 answer
60 views

Restrict user logon in Jenkins

We have been using groovy script to read the build queue state: def builder = new groovy.json.JsonBuilder() builder { queueItems(Jenkins.instance.queue.items.collect { obj -> [ id:...
user avatar
  • 123
1 vote
1 answer
144 views

Are using TestContainers safe for integration tests?

I have a discussion with our DevOps about using Testcontainers for integration tests. It's a tool to bring up throw-away containers for testing. The testcontainers need a environment variable ...
user avatar
2 votes
1 answer
426 views

Azure Security Center with Ubuntu 19

Has anyone successfully gotten the Azure Security Center agent to work with Ubuntu 19? My omsconfig.log is full of messages like This event indicates that failure happens when LCM is trying to get ...
user avatar
  • 1,076
2 votes
1 answer
2k views

Accessing TPM from inside a Docker Container

I want to implement Vault as part of the DevOps build pipeline to store all the secrets like passwords and certificates. I understand that Vault keeps the data encrypted but I have been asked to look ...
user avatar
  • 135
0 votes
2 answers
226 views

What is the most common server permission policy for web application deployment?

I have a server with Ubuntu with a web server (Apache or Nginx) running a PHP application. The application consists of the following parts: An executable code that handles HTTP requests (say in the /...
user avatar
  • 101
1 vote
1 answer
99 views

How can I expose port 3389 using a secure approach

Within our legacy infrastructure we need to keep port 3389 exposed so that we can remote desktop into this server (note that we can't go back and utilize IaC to prevent this). We currently restrict ...
user avatar
6 votes
2 answers
138 views

Securing communication between cloud VMs without private networks. Any strategy besides building own VPN? Spiped?

I am working on an application that requires a number of different services (web application + database + worker queues, XMPP server for messaging, redis, central authentication via LDAP, etc). For my ...
user avatar
  • 161
4 votes
1 answer
316 views

How to securely pass sensitive data to EC2 Spot instances?

Right now, we only use EC2 on-demand instances, and we provision sensitive data (credentials, private keys, etc.) on the instances' EBS which are encrypted with a KMS key. My understanding is that I ...
user avatar
  • 155
1 vote
0 answers
110 views

How to setup external service (keycloak) to protect an app in kubernetes? [closed]

I have a java application protected by keycloak (that's an standalone application for session control which runs on port 9080). Keycloak is available to world because during auth process, my app ...
user avatar
2 votes
0 answers
88 views

What security loopholes does Istio tackle?

My application consists of four microservices. (hr, salary, stock and employee). Users of the application access the "hr" service using http. To fulfill this request the hr microservice communicates ...
user avatar
  • 203
2 votes
1 answer
6k views

How can you pass private environment variables to FARGATE tasks specified from a Docker Compose config

I am using an existing docker-compose.yml to migrate an app to ECS. The config references several $ENV vars which I used to pass in simply as environment variables when running docker-compose up. One ...
user avatar
  • 229
-3 votes
2 answers
1k views

How can CaaS, PaaS, and FaaS users know if the operating system of their server environment is of the newest release?

Please consider this chart a moment; it shows the different hosting models common today: From the chart I learn that CaaS, PaaS and FaaS are three hosting-models by which a user can't control the OS ...
user avatar