ProxySQL Firewalling
In this blog post, we’ll look at ProxySQL firewalling (how to use ProxySQL as a firewall). Not long ago we had an internal discussion about security, and how to enforce a stricter set of rules to prevent malicious acts and block other undesired queries. ProxySQL came up as a possible tool that could help us in achieving what we were looking for. Last year I wrote about how to use ProxySQL to stop
10 layers of Linux container security
Containers provide an easy way to package applications and deliver them seamlessly from development to test to production. This helps ensure consistency across a variety of environments, including physical servers, virtual machines (VMs), or private or public clouds. These benefits are leading organizations to rapidly adopt containers in order to easily develop and manage the applications that add
辞書攻撃ã«ä½¿ã†å…ƒãƒã‚¿ã®è¾žæ›¸ãƒ•ã‚¡ã‚¤ãƒ« - ã‚ã°é›»åãŒè©°ã¾ã¤ã¦ã‚ã‚‹
THC-Hydraã§ã‚¢ã‚¿ãƒƒã‚¯ã‚’試ã—ã¦ã¿ã‚‹éš›ã€crunchコマンドã§ãƒªã‚¹ãƒˆã‚’作ã£ã¦ãƒ–ルートフォースも良ã„ã®ã ãŒã€ã‚„ã¯ã‚Šè¾žæ›¸æ”»æ’ƒã‚’試ã—ã¦ã¿ã‚‹ã®ãŒå¸¸å¥—手段。ã¨ãªã‚‹ã¨ã€æ¬¡ã«æ¬²ã—ããªã‚‹ã®ã¯è¾žæ›¸ãƒ•ã‚¡ã‚¤ãƒ«ã€‚ ãŠæ‰‹è»½ãªä¾‹ã§ã¯ã€Linuxã®passwdコマンドãŒåˆ©ç”¨ã—ã¦ã„ã‚‹cracklibã®ãƒ¯ãƒ¼ãƒ‰ãƒªã‚¹ãƒˆãŒè‰¯ã„。 通常ã€/usr/share/dict/linux.words ã«ã‚ã‚Šã€40万個ã»ã©ã®wordãŒè©°ã¾ã£ã¦ã„る。ã—ã‹ã—ã¾ãã€ã“れよりもã†å°‘ã—アングラãªé¦™ã‚ŠãŒã™ã‚‹è¾žæ›¸ãŒæ¬²ã—ã„(よã?)。 ã¨ã„ã†ã“ã¨ã§ã“ã“ã§ã¯ã€OpenWallãŒé…布ã—ã¦ã„る辞書ファイルを紹介ã™ã‚‹ã€‚ãªãŠå®Ÿéš›ã«hydraã§ã‚¢ã‚¿ãƒƒã‚¯ã™ã‚‹ã¨ã©ã®ãらã„ã®æ™‚é–“ãŒã‹ã‹ã‚‹ã‹ã¯ã€å‰ã®è¨˜äº‹(Kali Linuxã®hydraã§ãƒ–ルートフォースを試㙠- ã‚ã°é›»åãŒè©°ã¾ã£ã¦ã„ã‚‹)ã‚’å‚ç…§ã—ã¦ãã ã•ã„ OpenWallã¨ã¯ OpenWallã¯æœ‰åãªãƒ‘スワードクラッカ
TLSã®ãƒ€ã‚¦ãƒ³ã‚°ãƒ¬ãƒ¼ãƒ‰æ”»æ’ƒã‚’防ãSCSVã¨ã¯
2018/01/09追記 TLS1.3ã®ä»•æ§˜ã§ã¯ãƒ€ã‚¦ãƒ³ã‚°ãƒ¬ãƒ¼ãƒ‰æ”»æ’ƒå¯¾ç–ãŒç•°ãªã£ã¦ã„ã¾ã™ã€‚ TLS1.3ã‚‚ã—ãã¯TLS1.2ã«å¯¾å¿œã—ãŸã‚µãƒ¼ãƒã¯ã€ãれ以下ã®TLSãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’ãã”シーエションã™ã‚‹éš›ã¯ServerHelloã®ãƒ©ãƒ³ãƒ€ãƒ ã®ä¸‹ä½ãƒ“ットã«è¦å®šã®æ–‡å—列を挿入ã™ã‚‹æ±ºã¾ã‚Šã«ãªã‚Šã¾ã—ãŸã€‚ クライアントã¯ãƒ©ãƒ³ãƒ€ãƒ ã®ä¸‹ä½ãƒ“ットを見ã¦ãƒ€ã‚¦ãƒ³ã‚°ãƒ¬ãƒ¼ãƒ‰ã—ã¦ã„ãªã„ã‹ç¢ºèªã—ã¾ã™ 2015/04/26追記 rfc7507ã¨ã—ã¦TLSã®SCSVã¯RFCã¨ãªã‚Šã¾ã—ãŸã€‚ draft-00よりIANA Considerationsã®è¿½åŠ ã‚„ã€DTLSã«é–¢ã™ã‚‹è¨˜è¿°ãŒè¿½åŠ ã•ã‚Œã¦ã„ã¾ã™ã€‚ 2015/08/04追記 ä¸é–“者攻撃ã¨è¨€ã†è¡¨ç¾ã¯ç›—è´è¡Œç‚ºã‚’å«ã‚€æ”»æ’ƒã§ã‚ã‚‹ãŒã€ä»Šå›žã¯ç›—è´è¡Œç‚ºã«ã¤ã„ã¦ã¯å¿…è¦ãŒç„¡ã„ãŸã‚表ç¾ã‚’変更ã„ãŸã—ã¾ã—ãŸã€‚ 以上 ダウングレード攻撃 TLS通信を行ã†éš›ã€ãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯ã«å¤±æ•—ã—ãŸå ´åˆã«ãƒ—ãƒãƒˆã‚³ãƒ«ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’下
ImperialViolet - Early ChangeCipherSpec Attack
OpenSSL 1.0.1h (and others) were released today with a scary looking security advisiory and that's always an event worth looking into. (Hopefully people are practiced at updating OpenSSL now!) Update: the original reporter has a blog post up. Also, I won't, personally, be answering questions about specific Google services. (I cut this blog post together from notes that I'm writing for internal gro
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
Crypto for Go Developers
https://www.jaipa.or.jp/other/mtcs/110325_guideline.pdf
{{#tags}}- {{label}}
{{/tags}}