Collaborate Disseminate
I have configured my ~/.profile file(bash login shell startup file) in a way that it starts ssh-agent automatically. It doesn’t check if there is a ssh-agent already running. Are there any security related disadvantages if mu… Continue reading Are there any security related disadvantages if multiple ssh-agents are running?
I have a server where I am the only normal user and I need to have password-based authentication enabled for SSH. I have configured iptables with recent module which throttles SSH connections and root logins over SSH are disa… Continue reading Is it a good practice to make sudo ask for root password in a single-user system?
I was reading here that when passing a client_id and client_secret to an authorization server,
The parameters can only
be transmitted in the request-body and MUST NOT be included in the
request URI.
What are… Continue reading Dangers of passing Oauth 2.0 client id and client secret in the request uri
Are there anti-spam SMTP proxies(like ASSP, qpsmtpd) or e-mail spam filtering solutions in general(like SpamAssassin) out there which create for example block filters based on objects in RIR databases? If yes, then which obje… Continue reading relationship between anti-spam solutions and whois databases
I have a scenario where I have to remember a password / keyphrase, which I will not be able to recover if I forget it, for a long time (probably more than 10 years). The problem is because this password is part of a disaster … Continue reading How to choose a password that I have to remember for a long time but do not use a lot
I have a Linux-based embedded system with web-interface for management purposes. According to one security paper, this web-server has rudimentary filter against directory traversal attacks in URL parameters. So in order to bypass the “../”… Continue reading Path traversal filter bypass techniques?
I am managing a couple of VPS-es on an old platform I would like to no longer maintain. We used a widely used commercial VPS control panel to create the VPS-es in question.
The customers may access their VPS-es with root … Continue reading Should I use a VM firewall or not?
I’m implementing social login with Facebook, Twitter and Google+ on our OAuth2-secured REST API (secured using spring-security-oauth). I’d like to make sure that the following flow is secure and that I’m not introducing any s… Continue reading Social Login + OAuth2-secured REST API