51–60 of 108 posts
> 2FA for ssh Correct me if I'm wrong, but isn't this what password-protected private key encryption is?
Earlier quoted context omitted.
Sorry for being so ignorant but can someone explain why this is so wrong?
The fact you have the private key permits access, not possession of the public key even though the public key is the one you add to the file on the server side (asymmetric cryptography). The "secure way" may also suggest that you have to keep your public key secret which is not true.
> 2FA for ssh Correct me if I'm wrong, but isn't this what password-protected private key encryption is?
Earlier quoted context omitted.
The fact you have the private key permits access, not possession of the public key even though the public key is the one you add to the file on the server side (asymmetric cryptography). The "secure way" may also suggest that you have to keep your public key secret which is not true.
I believe the statement is most charitably interpreted as the channel must be secure against modifications so that when you are attempting to put the public key in the file that some other contents aren't inserted instead.
Earlier quoted context omitted.
I believe the statement is most charitably interpreted as the channel must be secure against modifications so that when you are attempting to put the public key in the file that some other contents aren't inserted instead.
On the other hand, SSH gives you just that if you verify the fingerprint which is not mentioned in the guide. MITM-proof channel is needed if one gains any kind of shell access because then public key substitution can happen in various ways, even without the user him/herself explicitly editing the file. Furthermore, if one allows MITM when accessing shell, substituting the public key is just one of very serious secur…
Earlier quoted context omitted.
Meh, QSAs check boxes. In my experience they are not very technically capable. Some are, of course. Most are not.
Sure but the point still stands. Why should anyone trust that you, or your company, is any good at security compared to say CIS? If you have homegrown security and can show your QSA your detailed policy document and that it's a superset of CIS, STIG, NIST, etc. with documented exceptions then it'll be no problem. I avoid homegrown whenever possible because it's a rabbit hole that never ends. If you instead say CIS le…
Yes but first and foremost you don't expose ssh to all internet, it should be allowed only from known IP addresses and you should VPN to have connect to that known addresses. Section about firewall config just tells to open ssh...
Earlier quoted context omitted.
And for the masochists: https://iase.disa.mil/stigs/Pages/a-z.aspx
Crikey, look at that mess: Upgrade the version of the browser to an approved version by obtaining software from the vendor or other trusted source. Method 1: View the following registry key: HKLM\Software\Mozilla\Mozilla Firefox\CurrentVersion Method 2: Search for the firefox.exe file using the search feature of the operating system. Examine the files properties for the product version (not the file version. For Wind…
STIG itself is just a fancy check-list. Ideally, real world implementation is automated via something like OpenSCAP.
Securing ssh, 2FA for ssh, using key authentication... Yes but first and foremost you don't expose ssh to all internet, it should be allowed only from known IP addresses and you should VPN to have connect to that known addresses. Section about firewall config just tells to open ssh...
https://www.codelitt.com/blog/my-first-10-minutes-on-a-serve...