Questions tagged [security]

For questions related to IT Security, Information Security or DevSecOps.

Filter by
Sorted by
Tagged with
0
votes
0answers
7 views

why is a PHP client trying to do unauthorized REST.POST.OBJECT to my S3 bucket?

I've written a logfile analysis program for my S3 logs and I'm now looking in detail at every line. I've seen some odd behavior lately. I'm trying to figure out ...
0
votes
1answer
49 views

Docker: Let containers communicate to each other but don't expose to internet

I was recently shocked to find out that docker writes its own iptables rules and ignores ufw bindings completely. I had blocked all ports using the ufw deny incoming command and then selectively ...
1
vote
1answer
294 views

Assign Directory Read/Write Privileges to Azure Service Principal from the command line?

I am trying to provision a user in Azure Active Directory using Terraform's AzureAD provider. At the top of the azuread_user documentation, it states: NOTE: If you're authenticating using a ...
4
votes
4answers
6k views

How to list security groups for the specific instance via CLI?

I'm looking for syntax like: aws ec2 describe-security-groups --instance-id i-0xyz however, the above sub-command doesn't support --instance-id parameter. I've checked and there are --filters and --...
1
vote
1answer
22 views

AWS Inspector “High Risk” : port open to the internet with IP whitelisting

We use AWS Inspector to identify risks with our AWS assets. Today I received a finding, with a "high" severity. The finding said that the FTP port was open to the internet. However, after ...
6
votes
1answer
254 views

Does `npm audit` add any value when using `dependabot`

Context There are multiple ways to scan projects for vulnerabilities. Dependabot can be configured to check repositories for issues, and automatically submits pull requests to resolve. NPM Audit will ...
19
votes
6answers
8k views

How to prohibit access to internals of Docker container?

I want to deliver my app to customers in form of docker image. But it is crucial to ensure that end-user do not alter anything inside the container. User should only be able to run/stop the container ...
2
votes
1answer
40 views

How to avoid an avalanche of images in Openshift when security patches keep coming in?

Our applications are based on tomcat, strictly speaking on tomcat base s2i image provided by RedHat. This is updated quite frequently, and we need to comply to some regulations and apply the updates. ...
0
votes
0answers
9 views

SSO integration with DOMO from Java application

I have two application 1. Internal application 2. DOMO application (BI tool) we are planning to implement SSO. The credentials we are using for our internal application it should work for DOMO as well....
2
votes
1answer
26 views

What are the best practices for sharing production Postgres access with developers?

We're a small SaaS startup (~10 person team; mostly engineers). We use Postgres on AWS and GCP in production. We have signed contracts with some customers that prohibit us from giving full production ...
0
votes
1answer
34 views

Unable to connect to remote service using AWS VPC Peering

I have a question regarding some AWS infra I'm trying to build. Due to legacy constraints, I have a service running in a remote VPC that I need to access, and I have a new service I'm developing in ...
1
vote
1answer
37 views

Host credential manager and Docker runners

Imagine you have a GitLab Docker runner which you would like to pass credentials from a credential store. That is the CI/CD variable just designates the credentials profile name. Is there a way to ...
0
votes
0answers
7 views

Sharing {local/staging/prod} {front/back}end .env-s between multiple devs

What is a good solution for sharing {local/staging/prod} {front/back}end .envs between multiple devs? Both front and back end need environment vars for {local/staging/prod} Some developers only need ...
57
votes
7answers
23k views

How can I manage secrets in .tf and .tfstate?

I would like to use the Terraform MySQL Provider to keep a list of mysql users and grants handy for creating new test environments. The .tf and .tfstate files both seem to want to store the MySQL ...
1
vote
1answer
55 views

TLS handshake failure

We have an ODBC Driver trying to connect through TLS , but fails. We tested using openssl with the following command and worked fine: openssl s_client -connect xxx.com:31020 the server accepts TLS 1....
4
votes
1answer
93 views

How not expose my backend

I'm studying Docker and how to properly publish my containers coding a very simple web application. It has only two containers, backend and frontend. I've published the source code here: https://...
1
vote
0answers
15 views

Is it possible to share Kerbeos ticket from host system with Docker container

I'm trying to make a PoC. Host OS gets Kerberos ticket. There is a Docker container running on host OS. Docker container needs to get/hijack this ticket somehow it order to call some external services ...
1
vote
1answer
40 views

How to protect secrets whilst enabling the ability to amend a pipeline

I'm writing a CI pipeline using GitHub Actions. The pipeline will build a Docker image, which it will then push to our Docker repository (AWS ECR). In order to talk to ECR, we'll need to provide a ...
2
votes
2answers
589 views

How do I expire users credentials for Kubernetes in Azure?

I am looking for information on how to forcefully expire users credentials in Azure Kubernetes Service (AKS). The reason is to better understand Security models and protecting Kubernetes deployments ...
1
vote
1answer
97 views

Is there a way to tell if an Azure Devops Extension is secure to use?

How do I know that an Azure Devops Extension does not do anything really bad? A company that I know of uses Microsoft's Azure Devops platform to manage its software development. Microsoft also ...
3
votes
1answer
73 views

Provide customers with access to Azure Container Registry

I'm using Azure Container Registry for private Docker images. I want to let around 500 customers pull images and use the Docker V2 HTTP API to read metadata. Service Principals are one way to go ...
-3
votes
2answers
971 views

How can CaaS, PaaS, and FaaS users know if the operating system of their server environment is of the newest release?

Please consider this chart a moment; it shows the different hosting models common today: From the chart I learn that CaaS, PaaS and FaaS are three hosting-models by which a user can't control the OS ...
2
votes
1answer
31 views

Company is worried about exposing our PII to Tableau, Can we run Tableau without exposing our data to any 3rd parties?

I'm looking to understand a bit more from the technical side about how Tableau (The company itself) works with the data that everyone is providing them. My company is looking to use Tableau as our ...
1
vote
1answer
47 views

How do I setup an OpenShift route that will allow both 80 and 443 traffic to my app?

I'd like to setup a route that will pass both 80 and 443 traffic to the same service in OpenShift. When I try to create a second route it errors out. I want this to be in a yaml like would be used ...
30
votes
5answers
16k views

Where to put ansible-vault password

We are planning to use ansible vault in our project to prevent leaking passwords or keys in git. The idea is to put all our sensitive data into a plain file then encrypt this file with ansible-vault ...
1
vote
1answer
30 views

Weird requests filling apache access logs [closed]

I'm running a public apache2 webserver. I'm getting a lot of this kind of requests on my webserver: 91.251.142.16 - - [07/Mar/2020:19:58:09 +0100] "\xe8\x95h\x8d\xf0\x1d\x99Q\xb8~\xb5\xbc\xa7*\x1c\...
1
vote
1answer
32 views

How to create unique GPG Keys for different environments / projects

After searching and reading various documents it remains unclear to me as to an effective/straightforward manner to create/maintain multiple sets of GPG Keys. I have a project that needs unique GPG ...
4
votes
2answers
123 views

What is the Prometheus and Grafana ideal setup?

I am just wondering. If I have many environments monitored via Prometheus, what will be the best configuration? The security and efficiency are already important for on-premise installations but ...
12
votes
4answers
3k views

Open Ports on Google Cloud Load Balancer

It seems that by default, Google Cloud load balancers expose a number of ports unecessarily. I haven't found a way to expose only 80/443 and every time I make one of their load balancers, the ...
0
votes
2answers
50 views

How to run Ansible command to update imunify360 settings

How can I use Ansible to run the following CloudLinux Imunify360 commands properly on CloudLinux 7 (similar to CentOS7)? I tried different ways to "escape" the colons in the commands and it doesn't ...
1
vote
0answers
47 views

How to get alert for LDAP issues

I want to run some script which checks for LDAP issue, and in case it found something, it sent me alert. I thought using ssh command with some generic user, but I'm not sure what is the response I'm ...
0
votes
1answer
379 views

Ansible SSH best practices

What are the best practices to be followed wrt security when it comes to SSH authentication (password less, key based, etc.) when setting up Ansible in a new environment with 1000s of machines? Which ...
12
votes
2answers
338 views

How to storing encrypted secrets in code for a serverless.com project?

With serverless.com, the easiest way to expose a secret to an AWS Lambda function is to store it in the serverless.yml file (encrypted with KMS, for example). But committing encrypted secrets to Git ...
13
votes
2answers
4k views

How to store credentials that are required by an application?

Everyone is saying that storing credentials in version control (git) is a bad thing. So there must be other ways to store credentials which are much better. An application must receive credentials ...
2
votes
0answers
82 views

What security loopholes does Istio tackle?

My application consists of four microservices. (hr, salary, stock and employee). Users of the application access the "hr" service using http. To fulfill this request the hr microservice communicates ...
1
vote
0answers
94 views

How to setup external service (keycloak) to protect an app in kubernetes? [closed]

I have a java application protected by keycloak (that's an standalone application for session control which runs on port 9080). Keycloak is available to world because during auth process, my app ...
1
vote
0answers
62 views

Per machine credentials for privileges escalation using AWX [duplicate]

I have an inventory with a lot of hosts in it using the same credentials, but one host needs a different approach. For the ssh connection a different user is used, after the connection is established, ...
2
votes
1answer
961 views

Accessing TPM from inside a Docker Container

I want to implement Vault as part of the DevOps build pipeline to store all the secrets like passwords and certificates. I understand that Vault keeps the data encrypted but I have been asked me to ...
2
votes
1answer
43 views

How to verify hashes of Ansible Galaxy dependencies?

From a security perspective, I don't like the idea of relying only on Git tags, as they could be moved later. Unfortunately, I'm not aware of an official solution to enforce checks. This is the best ...
5
votes
1answer
2k views

What are the best practices for anti-virus / anti-malware when using containers?

One of the SOC 2 controls is apparently around ensuring antivirus/anti-spam/anti-malware is running on production servers. I've been googling to see if there are any recommendation/best practices for ...
2
votes
1answer
293 views

Azure Security Center with Ubuntu 19

Has anyone successfully gotten the Azure Security Center agent to work with Ubuntu 19? My omsconfig.log is full of messages like This event indicates that failure happens when LCM is trying to get ...
1
vote
1answer
81 views

Mitigating Docker Compliance Issues - Can I put everything in the `daemon.json`?

I am going through compliance tasks to harden our Docker setup and I am seeing many things like Favor using docker run with docker run --pids-limit 100 to prevent forkbombs Favor using docker run ...
1
vote
1answer
57 views

Does the Chef bash resource create history entries?

I know that using a password in the command line is a bad idea because bash commands can be recorded in history. If I run a command in the chef bash resource though, when I look up the history I don'...
7
votes
3answers
317 views

When your micro service in production needs a secret, where is the secret stored and retrieved from?

The context of the question is Secrets management. How do you manage storing and retrieving secrets for your micro service which is in production?
0
votes
1answer
108 views

Securely saving AZURE_STORAGE_KEY and storage account name in Linux systems

The Azure CLI official documentation states that environmental variables can be used inside bash scripts to store AZURE_STORAGE_ACCOUNT and AZURE_STORAGE_KEY, like this: Compared to AWS CLI this ...
2
votes
1answer
40 views

Restrict user logon in Jenkins

We have been using groovy script to read the build queue state: def builder = new groovy.json.JsonBuilder() builder { queueItems(Jenkins.instance.queue.items.collect { obj -> [ id:...
1
vote
1answer
88 views

Are using TestContainers safe for integration tests?

I have a discussion with our DevOps about using Testcontainers for integration tests. It's a tool to bring up throw-away containers for testing. The testcontainers need a environment variable ...
22
votes
2answers
10k views

What Is SecOps?

First when I heard the word SecOps, I thought of it as a management approach that aims to connect security and operations teams, in much the same way that DevOps unifies developers and operations team....
0
votes
2answers
84 views

What is the most common server permission policy for web application deployment?

I have a server with Ubuntu with a web server (Apache or Nginx) running a PHP application. The application consists of the following parts: An executable code that handles HTTP requests (say in the /...
1
vote
1answer
77 views

How can I expose port 3389 using a secure approach

Within our legacy infrastructure we need to keep port 3389 exposed so that we can remote desktop into this server (note that we can't go back and utilize IaC to prevent this). We currently restrict ...