Questions tagged [security]
For questions related to IT Security, Information Security or DevSecOps.
103
questions
0
votes
1
answer
194
views
How to keep packages updated and keep in pace with security updates
In a project with multiple vms that run various applications from Wordpress to Django and various other things.
Is there a way or a tool to keep track of the packages that require updates or have ...
CommunityBot
- 1
0
votes
0
answers
7
views
What is the best practice to deploy single instance with http access on GCP
What is the best practice to deploy a single instance with HTTP access on GCP?
I want to deploy an app on a single GCP instance that doesn't need to be scalable, and only needs to have HTTP access, so ...
0
votes
0
answers
19
views
how to secure Kong Admin Api?
I'm setting up the Kong gateway manager locally using Docker.
the requests will be sent to localhost:8000, and admin will be available in localhost:8002.
How can I secure these ports locally when ...
- 664
0
votes
0
answers
16
views
Secure boot on vmware workstation
We want to run a non-standard OS (not linux or windows) that boots via secure boot on VMware workstation.
We can successfully do this on virtualbox, but want to work out how to do the same in VMWare
...
- 101
0
votes
0
answers
220
views
Why is detect-secrets-hook ignoring my audit selections?
detect-secrets-hook in my pre-commit is alerting on secrets that are already marked as safe to be committed in the baseline.
I'm running detect-secrets version 1.4.0 on Python 3.11.0 on Windows 11.
To ...
2
votes
1
answer
82
views
How to avoid an avalanche of images in Openshift when security patches keep coming in?
Our applications are based on tomcat, strictly speaking on tomcat base s2i image provided by RedHat. This is updated quite frequently, and we need to comply to some regulations and apply the updates. ...
CommunityBot
- 1
0
votes
1
answer
596
views
How are containers secured with MACVLAN networks?
Containers cannot be connected both to an internal bridge and to the host network at the same time, according to this question. However, this is what I need; I want a set of containers to be connected ...
CommunityBot
- 1
1
vote
2
answers
3k
views
Where to get OS Hardening Scripts for CIS Hardening Standards?
CIS provides benchmarks for hardening OS on AWS
CIS also provides images which meet their own benchmarks above
These CIS images are available here - https://www.cisecurity.org/blog/everything-you-need-...
- 11
0
votes
0
answers
18
views
How can I add an exception to the RKE2 default security policy to allow a single pod in a namespace to run as a root user
Good afternoon.
So I have an RKE2 cluster with the security policy in place that does not allow root pods to run. I have a pod that has to run as root and have been trying to figure out how to allow ...
- 101
1
vote
1
answer
46
views
How do you add user secrets to a deployment without having them to source control?
I am developing applications that require user secrets to function. These credentials should not be stored in source control due to security concerns. Instead, they need to be manually created by the ...
- 313
0
votes
0
answers
37
views
Encrypting Kubernetes cluster's admin.conf ($KUBECONFIG) at rest
I have been concerned about leaving /etc/kubernetes/admin.conf (i.e. $KUBECONFIG) unencrypted on disk, for it essentially contains a Kubernetes cluster's root credentials, and an intruder could ...
- 141
1
vote
0
answers
36
views
Opentelemetry-operator running as root on Openshift/Kubernetes
I need this opentelemetry-operator to run as non-root on the /,
https://github.com/open-telemetry/opentelemetry-operator/blob/main/autoinstrumentation/java/Dockerfile
I need to change the permission ...
- 11
2
votes
1
answer
490
views
Should I turn off copilot for text files containing secrets?
I use VSCode and have recently started using GitHub Copilot for my projects (programming and devops related). I understand that Copilot will send parts of my text to a remote server to get suggestions ...
- 1,838
6
votes
5
answers
12k
views
How to list security groups for the specific instance via CLI?
I'm looking for syntax like:
aws ec2 describe-security-groups --instance-id i-0xyz
however, the above sub-command doesn't support --instance-id parameter.
I've checked and there are --filters and --...
- 101
13
votes
2
answers
3k
views
Does `npm audit` add any value when using `dependabot`
Context
There are multiple ways to scan projects for vulnerabilities.
Dependabot can be configured to check repositories for issues, and automatically submits pull requests to resolve.
NPM Audit will ...
- 186
0
votes
1
answer
33
views
How do you securely deploy large number of Kubernetes components in isolation?
Precursor: I am not experienced in the design of large-scale infrastructure deployments for infra applications.
The assumptions for the questions:
I have read that it is a good practice to host ...
- 291
0
votes
0
answers
20
views
How do you ensure users do not bypass Kubernetes security and interact with the Container runtimes directly?
You could have Docker and Kubernetes installed on the same host and allow the user to access both binaries. A malicious user can potentially bypass Kubernetes security (e.g. PodSecurityPolicies), by ...
0
votes
0
answers
27
views
How do you isolate Kubernetes components in a network?
When I install Kubernetes on a host, all the core components (etcd, Kube manager, scheduler) are all installed on a host by default.
Is there a use case or need to deploy Kubernetes components ...
1
vote
0
answers
35
views
Private certificate authority and container images
We have a internal domain name, let's say "mycompany.net" with a private CA which delivers all our internal application HTTPS certificates for this domain like "myapp.mycompany.net"...
- 111
0
votes
1
answer
19
views
Is the output of "Test the function" of a Google Cloud Function saved somewhere?
I have returned the database address with username and password as the plain text output of a Cloud Function during testing. The idea was to see how the db URL looks like and where the error could be ...
- 143
4
votes
1
answer
163
views
What are the real world benefits of RDS instance (at rest) encryption?
AWS offers at rest encryption for its RDS instances. I think this sounds nice, and it's something that comes up regularly on security reviews but I'm not sure what the real benefit is. The most likely ...
CommunityBot
- 1
1
vote
1
answer
93
views
Strategies for sharing Ansible vaults with root/administrator credentials?
Historically we've been a one man devops team and stored all our passwords in Ansible vaults - including things like domain admin passwords and root account passwords.
However we're now growing and ...
- 316
1
vote
1
answer
67
views
Common permissions for EC2 usage and VPC Security Groups in enterprise use
Context: Looking to create some software that acts as middleware to a user's AWS account, where the user will provide their cloud credentials, and have the software use their EC2 instances.
Question: ...
- 46
1
vote
0
answers
29
views
HSM into cloud for windows authenticode signing - Cost benefits vs Security risks?
Our product has 4 apps (Windows, macOS, iOS & Android) with a partially combined build pipeline. 90% is run in the cloud (Android, iOS & macOS are built entirely on cloud infrastructure) but ...
- 111
1
vote
1
answer
943
views
OIDC token invalid when put into kubeconfig
I can connect to the Kubernetes API from a container running inside the cluster with an OIDC token like so:
kubectl —token $token get pod
I would now like to prepare a kubeconfig such that other ...
- 141
0
votes
2
answers
514
views
Docker: Let containers communicate to each other but don't expose to internet
I was recently shocked to find out that docker writes its own iptables rules and ignores ufw bindings completely. I had blocked all ports using the ufw deny incoming command and then selectively ...
CommunityBot
- 1
4
votes
3
answers
237
views
What is the Prometheus and Grafana ideal setup?
I am just wondering. If I have many environments monitored via Prometheus, what will be the best configuration?
The security and efficiency are already important for on-premise installations but ...
- 401
3
votes
1
answer
3k
views
Accessing TPM from inside a Docker Container
I want to implement Vault as part of the DevOps build pipeline to store all the secrets like passwords and certificates. I understand that Vault keeps the data encrypted but I have been asked to look ...
- 155
5
votes
1
answer
3k
views
Terraform: how do you inspect sensitive data?
In a resource of type aws_ecs_task_definition my plan has an line that looks like this:
~ container_definitions = (sensitive) # forces replacement
Now in principle this could be doing anything - ...
- 2,171
2
votes
1
answer
64
views
Continuous deployment strategies vs DevSecOps
How do you implement security requirements in CI/CD while taking care of security requirements? What are best practices here?
Security requirements may differ, let's assume this simple level of ...
- 6,802
1
vote
1
answer
661
views
Assign Directory Read/Write Privileges to Azure Service Principal from the command line?
I am trying to provision a user in Azure Active Directory using Terraform's AzureAD provider. At the top of the azuread_user documentation, it states:
NOTE: If you're authenticating using a ...
1
vote
1
answer
107
views
AWS Inspector "High Risk" : port open to the internet with IP whitelisting
We use AWS Inspector to identify risks with our AWS assets. Today I received a finding, with a "high" severity. The finding said that the FTP port was open to the internet. However, after ...
- 3,218
26
votes
6
answers
16k
views
How to prohibit access to internals of Docker container?
I want to deliver my app to customers in form of docker image. But it is crucial to ensure that end-user do not alter anything inside the container. User should only be able to run/stop the container ...
- 381
2
votes
1
answer
116
views
What are the best practices for sharing production Postgres access with developers?
We're a small SaaS startup (~10 person team; mostly engineers).
We use Postgres on AWS and GCP in production.
We have signed contracts with some customers that prohibit us from giving full production ...
- 111
0
votes
1
answer
130
views
Unable to connect to remote service using AWS VPC Peering
I have a question regarding some AWS infra I'm trying to build. Due to legacy constraints, I have a service running in a remote VPC that I need to access, and I have a new service I'm developing in ...
CommunityBot
- 1
1
vote
1
answer
109
views
Host credential manager and Docker runners
Imagine you have a GitLab Docker runner which you would like to pass credentials from a credential store. That is the CI/CD variable just designates the credentials profile name.
Is there a way to ...
- 632
63
votes
7
answers
27k
views
How can I manage secrets in .tf and .tfstate?
I would like to use the Terraform MySQL Provider to keep a list of mysql users and grants handy for creating new test environments. The .tf and .tfstate files both seem to want to store the MySQL ...
- 101
1
vote
1
answer
181
views
TLS handshake failure
We have an ODBC Driver trying to connect through TLS , but fails.
We tested using openssl with the following command and worked fine:
openssl s_client -connect xxx.com:31020
the server accepts TLS 1....
- 121
4
votes
1
answer
610
views
How not expose my backend
I'm studying Docker and how to properly publish my containers coding a very simple web application. It has only two containers, backend and frontend. I've published the source code here: https://...
- 847
2
votes
1
answer
75
views
How to protect secrets whilst enabling the ability to amend a pipeline
I'm writing a CI pipeline using GitHub Actions.
The pipeline will build a Docker image, which it will then push to our Docker repository (AWS ECR).
In order to talk to ECR, we'll need to provide a ...
- 847
3
votes
2
answers
2k
views
How do I expire users credentials for Kubernetes in Azure?
I am looking for information on how to forcefully expire users credentials in Azure Kubernetes Service (AKS). The reason is to better understand Security models and protecting Kubernetes deployments ...
1
vote
1
answer
776
views
Is there a way to tell if an Azure Devops Extension is secure to use?
How do I know that an Azure Devops Extension does not do anything really bad?
A company that I know of uses Microsoft's Azure Devops platform to manage its software development.
Microsoft also ...
- 156
3
votes
1
answer
207
views
Provide customers with access to Azure Container Registry
I'm using Azure Container Registry for private Docker images. I want to let around 500 customers pull images and use the Docker V2 HTTP API to read metadata.
Service Principals are one way to go ...
CommunityBot
- 1
-3
votes
2
answers
2k
views
How can CaaS, PaaS, and FaaS users know if the operating system of their server environment is of the newest release?
Please consider this chart a moment; it shows the different hosting models common today:
From the chart I learn that CaaS, PaaS and FaaS are three hosting-models by which a user can't control the OS ...
- 101
2
votes
1
answer
60
views
Company is worried about exposing our PII to Tableau, Can we run Tableau without exposing our data to any 3rd parties?
I'm looking to understand a bit more from the technical side about how Tableau (The company itself) works with the data that everyone is providing them.
My company is looking to use Tableau as our ...
- 171
1
vote
1
answer
253
views
How do I setup an OpenShift route that will allow both 80 and 443 traffic to my app?
I'd like to setup a route that will pass both 80 and 443 traffic to the same service in OpenShift. When I try to create a second route it errors out. I want this to be in a yaml like would be used ...
- 353
34
votes
5
answers
24k
views
Where to put ansible-vault password
We are planning to use ansible vault in our project to prevent leaking passwords or keys in git.
The idea is to put all our sensitive data into a plain file then encrypt this file with ansible-vault ...
- 121
1
vote
1
answer
82
views
Weird requests filling apache access logs [closed]
I'm running a public apache2 webserver.
I'm getting a lot of this kind of requests on my webserver:
91.251.142.16 - - [07/Mar/2020:19:58:09 +0100] "\xe8\x95h\x8d\xf0\x1d\x99Q\xb8~\xb5\xbc\xa7*\x1c\...
- 1,460
1
vote
1
answer
136
views
How to create unique GPG Keys for different environments / projects
After searching and reading various documents it remains unclear to me as to an effective/straightforward manner to create/maintain multiple sets of GPG Keys.
I have a project that needs unique GPG ...
- 96
14
votes
4
answers
7k
views
Open Ports on Google Cloud Load Balancer
It seems that by default, Google Cloud load balancers expose a number of ports unecessarily. I haven't found a way to expose only 80/443 and every time I make one of their load balancers, the ...
CommunityBot
- 1