[B! security] papiroã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

papiro id:papiro

securityã«é–¢ã™ã‚‹papiroã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (15)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

[SSH][CentOS7] ç‰¹å®šã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’å›ºå®šIPã‚¢ãƒ‰ãƒ¬ã‚¹ã‹ã‚‰ã®ã¿æŽ¥ç¶šè¨±å¯ã™ã‚‹ â€“ (ã£Â´âˆ€ï½€)ã£ ã‚ƒãƒ¼ | ä¸€æ’ƒ
è¤‡æ•°ã®æŽ¥ç¶šå…ƒã‹ã‚‰SSHæŽ¥ç¶šã‚’ã•ã›ãŸã„ã€ã‹ã¤ãã®ã†ã¡1ã¤ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¯å‹•çš„IPã‚¢ãƒ‰ãƒ¬ã‚¹ã‹ã‚‰æŽ¥ç¶šã•ã›ãªã‘ã‚Œã°ãªã‚‰ãªã„ã€ã¨ã„ã†è¦ä»¶ã¯ã‚ˆãã‚ã‚‹è©±ã§ã™ã€‚ã“ã†ã—ãŸãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãŸã‚ã«SSHã§ä½¿ç”¨ã™ã‚‹TCP/22ç•ªãƒãƒ¼ãƒˆã‚’ãƒ•ãƒ«ã‚ªãƒ¼ãƒ—ãƒ³ã«ã™ã‚‹ã®ã¯èºŠèº‡ã‚ã‚Œã‚‹ã‹ã¨æ€ã„ã¾ã™ã®ã§ã€ã“ã‚“ãªä»•çµ„ã¿ã‚’è€ƒãˆã¦ã¿ã¾ã—ãŸã€‚ ãƒ¦ãƒ¼ã‚¶ãƒ¼ã€Œhamadaã€ã¯å›ºå®šIPã‚¢ãƒ‰ãƒ¬ã‚¹ã‹ã‚‰TCP/22ã¸sshæŽ¥ç¶šã•ã›ã‚‹ ãƒ¦ãƒ¼ã‚¶ãƒ¼ã€Œnullpopopoã€ã¯å‹•çš„IPã‚¢ãƒ‰ãƒ¬ã‚¹ã‹ã‚‰TCP/12345ã¸sshæŽ¥ç¶šã•ã›ã‚‹ ä¸‹è¨˜æ‰‹é †ã‚’è¡Œã†å‰ã«ã€ã‚ã‚‰ã‹ã˜ã‚ hamada ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¨ nullpopopo ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’ useradd ã‚³ãƒžãƒ³ãƒ‰ã§ä½œæˆã—ã¦ãŠã„ã¦ãã ã•ã„ã€‚ Ansibleå¾¹åº•å…¥é–€ ã‚¯ãƒ©ã‚¦ãƒ‰æ™‚ä»£ã®æ–°ã—ã„æ§‹æˆç®¡ç†ã®å®Ÿç¾ â– sshd_config è¨å®šå¤‰æ›´ ã¾ãšã€ /etc/ssh/sshd_config ã§ 22ç•ªãƒãƒ¼ãƒˆã®ã»ã‹ã«12345ç•ªãƒãƒ¼ãƒˆã§sshdã‚’
papiro 2017/08/21
ãƒãƒ¼ãƒˆã§ãƒãƒªã‚·ãƒ¼ã‚’åˆ†ã‘ã‚‹ã¨ã„ã†è€ƒãˆæ–¹ã€‚å‚è€ƒã«ãªã‚Šã¾ã™ã€‚

ssh

unix

linux

Security
ãƒªãƒ³ã‚¯
PHPã«é–¢ã™ã‚‹HTTPOXYè„†å¼±æ€§ã®å•é¡Œã¨å¯¾å¿œæ–¹æ³• - Code Day's Night
å¤–éƒ¨ã‹ã‚‰ç°¡å˜ã«HTTP_PROXYã¨ã„ã†ç’°å¢ƒå¤‰æ•°ãŒã‚»ãƒƒãƒˆã§ãã€ã‚µãƒ¼ãƒé–“é€šä¿¡ã‚„å¤–éƒ¨ã‚µã‚¤ãƒˆã¨é€£æºã—ã¦ã„ã‚‹å ´åˆã«å½±éŸ¿ãŒã‚ã‚‹ã‹ã‚‚ã—ã‚Œãªã„è„†å¼±æ€§ã§ã™ã€‚(HTTPoxy. CVE-2016-5385) PHPã®å ´åˆã¯php-fpm, mod_php, Guzzle4ä»¥ä¸Šã‚„ã„ãã¤ã‹ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã§å½±éŸ¿ã‚ã‚Šã¾ã™ã€‚ å¯¾å¿œæ–¹æ³•ã¯ç°¡å˜ã§ã™ã€‚ Apacheå´ã§å¯¾å¿œã™ã‚‹å ´åˆã¯ã€mod_headerã‚’ä½¿ãˆã‚‹çŠ¶æ³ã§ã‚ã‚Œã°ã€confãƒ•ã‚¡ã‚¤ãƒ«ã«ä¸‹è¨˜ã®1è¡Œã‚’è¿½åŠ ã€‚ RequestHeader unset Proxy FastCGIã®å ´åˆã¯ä¸‹è¨˜ã®1è¡Œã‚’è¿½åŠ ã€‚ fastcgi_param HTTP_PROXY ""; Guzzleã¯6.2.1ã§å¯¾å¿œã•ã‚ŒãŸã‚ˆã†ã§ã™ã€‚ Release 6.2.1 release Â· guzzle/guzzle Â· GitHub ã‚³ãƒŸãƒƒãƒˆãƒã‚°ã‚’è¦‹ã‚‹ã¨ã€CLIã®æ™‚ã®ã¿ã€getenv('HTTP_PROXY
papiro 2016/07/21
ã“ã‚ŒãŒä¸€ç•ªã‚·ãƒ³ãƒ—ãƒ«ã§è‰¯ã•ãã†

HTTP

è„†å¼±æ€§

proxy

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security
ãƒªãƒ³ã‚¯
TechCrunch | Startup and Technology News
TechCrunch Daily News Every weekday and Sunday, you can get the best of TechCrunchâ€™s coverage. Startups Weekly Startups are the core of TechCrunch, so get our best coverage delivered weekly.
papiro 2015/08/06
thunderboltä½¿ã£ã¦ãªã„ãƒ»ãƒ»

mac

apple

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

Vulnerability
ãƒªãƒ³ã‚¯
ã‚·ã‚§ãƒ«ã‚¹ã‚¯ãƒªãƒ—ãƒˆã®å¹³æ–‡ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ã‚»ã‚ãƒ¥ã‚¢ã«ã™ã‚‹æ–¹æ³• - ä½™ç™½ã®æ›¸ããªãã‚Š
è¿½è¨˜: (2015/8/3) å¤§é‡ã®ã¯ã¦ãƒ–ãŒä»˜ã„ãŸã®ã§ ç¶šã ã‚’æ›¸ãã¾ã—ãŸã€‚ sshã‚’ä½¿ç”¨ã—ã¦ã„ã‚‹äººã¯æ–‡å—åˆ—ã‚’æ‰‹è»½ã«æš—å·åŒ–ãƒ»å¾©å·åŒ–ã§ãã‚‹ã¨ã„ã†è©±ã€‚ ã“ã®ãƒ†ã‚¯ãƒ‹ãƒƒã‚¯ã‚’ä½¿ãˆã°è‰²ã€…ã‚»ã‚ãƒ¥ã‚¢ã«ãªã‚‹ã®ã§ãŠã™ã™ã‚ã€‚ ä»Šå›žã¯ã‚·ã‚§ãƒ«ã‚¹ã‚¯ãƒªãƒ—ãƒˆä¸ã®å¹³æ–‡ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ã‚»ã‚ãƒ¥ã‚¢ã«ä»£æ›¿ã™ã‚‹ã€‚ å¹³æ–‡ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¯ã‚„ã‚ã‚ˆã† ã‚·ã‚§ãƒ«ã‚¹ã‚¯ãƒªãƒ—ãƒˆä¸ã§ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒå¿…è¦ã«ãªã£ãŸã¨ãã€ ã¨ã‚Šã‚ãˆãšå¹³æ–‡ã§æ›¸ã„ã¦ã—ã¾ã„ãŒã¡ã€‚ #!/bin/sh PASSWORD="hoge" ã“ã‚Œã‚’ã‚»ã‚ãƒ¥ã‚¢ã«ã—ãŸã„ã€‚ é¢å€’ãã•ã„ã®ã¯å«Œãªã®ã§ã€ãªã‚‹ã¹ãæ‰‹æŒã¡ã®ãƒ„ãƒ¼ãƒ«ã§æš—å·åŒ–ã€å¾©å·åŒ–ã—ãŸã„ã€‚ sshç”¨ã® rsa ç§˜å¯†éµã¨ã€openssl(å¤§æŠµã®ç’°å¢ƒã«å…¥ã£ã¦ã„ã‚‹)ã‚’ä½¿ã£ã¦æ”¹å–„ã—ã‚ˆã†ã€‚ ç§˜å¯†éµã®æº–å‚™ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’æš—å·åŒ–ã™ã‚‹ã«ã‚ãŸã£ã¦ã€ç§˜å¯†éµã‚’ä½¿ç”¨ã™ã‚‹ï¼Ž sshã‚’å¸¸ç”¨ã—ã¦ã„ã‚‹å ´åˆã¯ ~/.ssh/id_rsa ã¨ã„ã†ç§˜å¯†éµãŒå˜åœ¨ã™ã‚‹ã ã‚ã†ã€‚ ã‚‚ã—ç§˜å¯†éµãŒç„¡ã‘ã‚Œã°
papiro 2015/08/02
unix

shell

ssh

ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰

security

æš—å·åŒ–
ãƒªãƒ³ã‚¯
https://mrtc0.github.io/slides/ltdd-16-ssh-auth.html
papiro 2015/07/06
é›†ä¸ç®¡ç†å‡ºæ¥ãã†

ssh

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security
ãƒªãƒ³ã‚¯
BASHã®è„†å¼±æ€§ã§CGIã‚¹ã‚¯ãƒªãƒ—ãƒˆã«ã‚¢ãƒ¬ã•ã›ã¦ã¿ã¾ã—ãŸ
ç’°å¢ƒå¤‰æ•°ã«ä»•è¾¼ã¾ã‚ŒãŸã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã—ã¦ã—ã¾ã†BASHã®è„†å¼±æ€§ãŒ CGIã‚¹ã‚¯ãƒªãƒ—ãƒˆã«å½±éŸ¿ã‚’ä¸Žãˆã‚‹ã‹è©¦ã—ã¦ã¿ãŸã‚‰çµæžœã¯æ‚²æƒ¨ãªæ„Ÿã˜ã« Tweet 2014å¹´9æœˆ25æ—¥ å¶‹ç”°å¤§è²´ ã“ã®è¨˜äº‹ã¯2014å¹´ã®ã‚‚ã®ã§ã™ æœã‹ã‚‰ Bash specially-crafted environment variables code injection attack ãªã‚‹ã‚‚ã®ã§é¨’ãŽã«ãªã£ã¦ã„ãŸã®ã§ã€ã•ã£ããæ‰‹å…ƒã® Apacheã§è©¦ã—ã¦ã¿ã¾ã—ãŸã€‚ /hoge.cgiã¨ã„ã†URIã§å®Ÿè¡Œã•ã‚Œã‚‹ã‚ˆã†ã«ã€ä¸€è¡Œã®ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚’å‡ºåŠ›ã™ã‚‹ã ã‘ã® CGIã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’è¨ç½®ã—ã¾ã™ã€‚ã„ã£ã‘ã‚“ã€ãªã‚“ã®å…¥åŠ›ã‚‚ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆå´ã‹ã‚‰å—ã‘ä»˜ã‘ã¦ã„ãªã„ãŸã‚å±é™ºã®ã‚ã‚Šã‚ˆã†ã‚‚ãªãè¦‹ãˆã¾ã™ã€‚ #!/bin/sh echo "Content-type: text/plain" echo echo "Hi! I'm an ordinary CGI script w
papiro 2014/12/05
bash

è„†å¼±æ€§

security

vulnerability
ãƒªãƒ³ã‚¯
ãã“ãã“ã‚»ã‚ãƒ¥ã‚¢ãªlinuxã‚µãƒ¼ãƒãƒ¼ã‚’ä½œã‚‹ - Qiita
å…ˆæ—¥ã€Œã‚µãƒ¼ãƒãƒ¼ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è¨å®šãŒãªã«ã™ã‚Œã°ã„ã„ã‹ã‚ã‹ã‚‰ãªã„ã€ã¨ç›¸è«‡ã‚’ã†ã‘ã¾ã—ã¦ã€‚ è‡ªåˆ†ã‚‚åˆå¿ƒè€…ã®æ™‚ã©ã“ã¾ã§ã‚„ã‚Œã°ã„ã„ã‹ã‚ã‹ã‚‰ãšæ‰‹å½“ãŸã‚Šã—ã ã„ã«ã‚„ã£ã¦æ²¼ã«å…¥ã£ã¦ã„ãŸã®ã‚’æ€ã„å‡ºã—ãªãŒã‚‰è‡ªé¯–æ§‹ç¯‰ã—ãŸã¨ãã®ãƒ¡ãƒ¢ã‚’å…ƒã«ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ æ³¨æ„ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã¯ç”¨é€”ã‚„å ´åˆãªã©ã«ã‚ˆã£ã¦é•ã„ã¾ã™ã€‚ è‡ªåˆ†ã§ç†è§£ã—ãŸã†ãˆã§è‡ªå·±è²¬ä»»ã§ãŠããŒã„ã—ã¾ã™ã€‚ å¯¾è±¡èªè€… Linuxã®ã‚µãƒ¼ãƒãƒ¼ã‚’å»ºã¦æ…£ã‚Œã¦ã„ãªã„äºº Linuxã¯ã‚ã‚‹ç¨‹åº¦ã•ã‚ã‚Œã‚‹äºº(è‡ªåˆ†ã§ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã‚’å…¥ã‚ŒãŸã‚Šã€ã‚µãƒ¼ãƒ“ã‚¹ã‚’æ¢ã‚ãŸã‚Šã§ãã‚‹) ãƒ©ã‚¤ãƒ³ãƒŠãƒƒãƒ— â˜†ã¯å°Žå…¥ã®é‡è¦åº¦ã¨å°Žå…¥ã®å®¹æ˜“ã•ã‹ã‚‰å€‹äººçš„åè¦‹ã‹ã‚‰ã¤ã‘ãŸå€¤ã§ã™ã€‚ 4ã¤ä»¥ä¸ŠãŒ"æœ€ä½Žé™ã‚„ã‚‹ã“ã¨"ã ã¨æ€ã£ã¦ãã ã•ã„ã€‚ sshd
papiro 2014/11/25
ssh

Linux

security

ã‚µãƒ¼ãƒ

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è¨å®š
ãƒªãƒ³ã‚¯
ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã«è©³ã—ããªã„äººã¸ã€‚ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆå²ä¸Šæœ€æ‚ªã®OpenSSLã®è„†å¼±æ€§ã®ãƒ‹ãƒ¥ãƒ¼ã‚¹ã‚’ã‚ã‹ã‚Šã‚„ã™ãæ›¸ã„ã¦ã¿ã¾ã—ãŸã€‚ã»ã¨ã‚“ã©ã™ã¹ã¦ã®äººã«å½±éŸ¿ã—ã¾ã™ã€‚ - éžå¤©ãƒžã‚¶ãƒ¼ by B-CHAN
ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã§ä½¿ã‚ã‚Œã‚‹éµï¼ˆã‚«ã‚®ï¼‰ ã¿ãªã•ã‚“ã€ã“ã‚“ã«ã¡ã¯ï¼ ã“ã‚“ãªãƒ‹ãƒ¥ãƒ¼ã‚¹ãŒç™ºè¡¨ã•ã‚Œã€ä¸–ç•Œã«è¡æ’ƒã‚’ä¸Žãˆã¦ã„ã¾ã™ã€‚ â†“ Gmailã€YouTubeã«ã‚‚å½±éŸ¿ã€‚å£Šæ»…çš„ãªOpenSSLã®è„†å¼±æ€§ã€ã€ŒHeartbleedã€å•é¡Œã¨ã¯ Â« WIRED.jp ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿é–¢ä¿‚è€…ã¯å¤§é¨’ãŽã§ã™ãŒã€ãƒœã‚¯ãŸã¡ä¸€èˆ¬äººã¯ã©ã†ã™ã‚Œã°ã„ã„ã®ã§ã—ã‚‡ã†ã‹ï¼Ÿ ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã«è©³ã—ããªã„äººã«ã€ãªã‚‹ã¹ãã‚ã‹ã‚Šã‚„ã™ãæ›¸ã„ã¦ã¿ã¾ã™ã€‚ ã¾ãšã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®ã„ã‚ã‚“ãªã‚µãƒ¼ãƒ“ã‚¹ã‚’åˆ©ç”¨ã™ã‚‹ã«ã¯IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒå¿…è¦ã§ã™ã‚ˆãã€‚ ä¾‹ãˆã°ã€Amazonã‚„æ¥½å¤©å¸‚å ´ã§è²·ç‰©ã‚’ã™ã‚‹ã«ã¯ã€Amazonã‚„æ¥½å¤©å¸‚å ´ã®IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’å…¥åŠ›ã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚ ã©ã¡ã‚‰ã‹ãŒæ¬ ã‘ã¦ã‚‚è²·ã„ç‰©ã¯ã§ãã¾ã›ã‚“ã€‚ ã‚ãªãŸä»¥å¤–ã®ç¬¬ä¸‰è€…ãŒã‚ãªãŸã®IDã‚’çŸ¥ã£ãŸã¨ã—ã¦ã‚‚ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒã‚ã‹ã‚‰ãªã‘ã‚Œã°ã€ã‚ãªãŸã®åå‰ã§å‹æ‰‹ã«è²·ã„ç‰©ã‚’ã™ã‚‹ã“ã¨ã¯ã§ããªã„ã‚ã‘ã§ã™ã€‚ ã“ã‚Œã«ã‚ˆã£ã¦å®‰å…¨ãŒå®ˆã‚‰ã‚Œã¦ã„ã‚‹ã‚ã‘ã§
papiro 2014/10/26
OpenSSL

è„†å¼±æ€§

ssl

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security
ãƒªãƒ³ã‚¯
è‡ªå •è½ãªæŠ€è¡“è€…ã®æ—¥è¨˜ : æ§˜ã€…ãªã‚µãƒ¼ãƒãƒ¼ã®POODLE SSLv3è„†å¼±æ€§(CVE-2014-3566)å¯¾ç–ã®ã¾ã¨ã‚(æ›´æ–°3) - livedoor Blogï¼ˆãƒ–ãƒã‚°ï¼‰
åŸºæœ¬ã¯å–°ã£ã¦ã‚‹ã‹é£²ã‚“ã§ã‚‹ã‹ã§ã™ãŒã€ã‚ˆãè¶£å‘³ã§ã‚«ãƒ©ã‚ªã‚±ãƒ»PKIãƒ»ç½²åãƒ»èªè¨¼ãƒ»ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ãƒ»æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’ã‚„ã£ã¦ã„ã¾ã™ã€‚æ—…å¥½ãã€‚ãƒ†ãƒ¬ãƒ“å¥½ãã§èŠ¸èƒ½é€š ã‚‚ãã˜ 1. ã¯ã˜ã‚ã« 2. SSLv3ã‚’ç„¡åŠ¹åŒ–ã§ãã‚‹å ´åˆã®ã‚µãƒ¼ãƒãƒ¼å¯¾ç– 2.1. Apache HTTPD Server + mod_ssl 2.2. Apache HTTPD Server + mod_nss 2.3. nginx 2.4. lighttpd 2.5. Microsoft IIS 2.6. (è¨‚æ£)Apache Tomcat (Java JSSE) 2.7. Node.js 2.8. IBM HTTP Server 2.9. Amazon Web Services 2.10. ãã®ä»–ã®ã‚µãƒ¼ãƒãƒ¼ 2.11. SSLv3 ã‚’ç„¡åŠ¹åŒ–ã™ã‚‹ãƒªã‚¹ã‚¯ 2.12. OpenLDAP 3. è«¸èˆ¬ã®äº‹æƒ…ã§ SSLv3 ã‚’æœ‰åŠ¹ã«ã›ã–ã‚‹ã‚’å¾—ãªã„å ´
papiro 2014/10/18
ã‚‚ã†ã‚„ã‚ã¦ãƒ»ãƒ»ãƒ»

SSL

è„†å¼±æ€§

Apache

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

POODLE

TLS
ãƒªãƒ³ã‚¯
ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®æ ¹å¹¹ã€ŒDNSã€ã«æ ¹æœ¬çš„æ¬ é™¥ãŒè¦‹ã¤ã‹ã‚‹(dragoner) - å€‹äºº - Yahoo!ãƒ‹ãƒ¥ãƒ¼ã‚¹
ã“ã®JPRSã®ç™ºè¡¨ã«å¯¾ã—ã€ã“ã®æ¬ é™¥ã‚’ç™ºè¦‹ã—ãŸä¸äº¬å¤§å¦ã®éˆ´æœ¨å¸¸å½¦æ•™æŽˆã€å‰é‡Žå¹´ç´€æ°ã¯ã€Œå±é™ºæ€§ã‚’ã‚ˆãç†è§£ã—ã¦å¯¾ç–ã‚’ã¨ã‚‹ã«ã‚ãŸã£ã¦ååˆ†ãªæƒ…å ±ãŒå«ã¾ã‚Œã¦ã„ã‚‹ã¨ã¯ã„ãˆã¾ã›ã‚“ã€ã‚’æ‡¸å¿µã—ã€ä¸‹è¨˜ã®ãƒ–ãƒã‚°è¨˜äº‹ç‰ã§ã“ã®å•é¡Œã®å±é™ºæ€§ã‚’è¨´ãˆã¦ã„ã¾ã™ã€‚ ã“ã®å•é¡Œã¯ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®æ ¹å¹¹ã«é–¢ã‚ã‚‹ã‚‚ã®ã§ã™ãŒã€ã©ã‚“ãªå•é¡Œã‚’å•ã‚“ã§ã„ã‚‹ã®ã§ã—ã‚‡ã†ã‹ã€‚ãã‚Œã‚’ç†è§£ã™ã‚‹ãŸã‚ã«ã€ã¾ãšã¯DNSã®ä»•çµ„ã¿ã‹ã‚‰è¦‹ã¦è¡Œãã¾ã—ã‚‡ã†ã€‚ DNSã®ä»•çµ„ã¿ã¨DNSã‚ãƒ£ãƒƒã‚·ãƒ¥ã‚µãƒ¼ãƒDNSã¨ã¯ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®æ ¹å¹¹ã«é–¢ã‚ã‚‹ä»•çµ„ã¿ã§ã€ç›®çš„ã®ã‚µãƒ¼ãƒã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ç‚ºã®é‡è¦ãªå½¹å‰²ã‚’æŒã¡ã¾ã™ã€‚ç°¡å˜ã«èª¬æ˜Žã™ã‚‹ã¨ã€"http://www.example.jp"ã¨ã„ã†URLã®ã‚µã‚¤ãƒˆã‚’è¦‹ãŸã„å ´åˆã€ãã‚Œã‚’ç®¡ç†ã™ã‚‹ã‚µãƒ¼ãƒã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã®ä½æ‰€ï¼ˆIPã‚¢ãƒ‰ãƒ¬ã‚¹ï¼‰ãŒå¿…è¦ã«ãªã‚Šã¾ã™ã€‚ãã“ã§ã€DNSã‚µãƒ¼ãƒã«ä¸Šè¨˜URLã®ãƒ©ãƒ™ãƒ«ï¼ˆãƒ‰ãƒ¡ã‚¤ãƒ³ï¼‰ã«ç›¸å½“ã™ã‚‹"www.example.jp"ã‚’ç®¡ç†ã™ã‚‹ã‚µãƒ¼
papiro 2014/06/23
DNS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security
ãƒªãƒ³ã‚¯
å€‹äººæŒã¡ã‚¹ãƒžãƒ›ã®æ¥å‹™åˆ©ç”¨ã¯ã‚‚ã¯ã‚„é¿ã‘ã‚‰ã‚Œãªã„ï¼Ÿ
ä»Šã€ä¼æ¥ã®ITéƒ¨é–€ã‚’æ‚©ã¾ã›ã¦ã„ã‚‹å¤§ããªå•é¡ŒãŒã‚ã‚‹ã€‚ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ãªã©ã®ç¤¾å“¡ã®å€‹äººæŒã¡ãƒ‡ãƒã‚¤ã‚¹ã®æ¥å‹™åˆ©ç”¨ã‚’èªã‚ã‚‹ã‹ã©ã†ã‹ã¨ã„ã†å•é¡Œã ã€‚ã‚³ãƒ³ãƒ—ãƒ©ã‚¤ã‚¢ãƒ³ã‚¹ã‚’é‡è¦–ã™ã‚‹ã“ã‚Œã¾ã§ã®ITéƒ¨é–€ã®å¸¸è˜ã‹ã‚‰ã™ã‚‹ã¨â€œç¦ã˜æ‰‹â€ã¨ã‚‚è¨€ãˆã‚‹æ‰‹æ®µã ãŒã€ã“ã“ã«æ¥ã¦ç„¡è¦–ã§ããªã„ã»ã©ã®å‹•ãã«ãªã‚ã†ã¨ã—ã¦ã„ã‚‹ã€‚ ä¸€ã¤ã®ãã£ã‹ã‘ã¯æ±æ—¥æœ¬å¤§éœ‡ç½ã ã€‚éœ‡ç½ç›´å¾Œã«åœ¨å®…å‹¤å‹™ã‚’ä½™å„€ãªãã•ã‚ŒãŸä¼æ¥ã¯å¤šã„ãŒã€äº‹æ¥ã‚’ç¶™ç¶šã™ã‚‹ãŸã‚ã«å€‹äººæŒã¡ã®ãƒ‡ãƒã‚¤ã‚¹ã‹ã‚‰ã®æ¥å‹™ã®è§£ç¦ã«è¸ã¿åˆ‡ã£ãŸä¼æ¥ã‚‚ã‚ã‚‹ã€‚ä¾‹ãˆã°SAPã‚¸ãƒ£ãƒ‘ãƒ³ã¯ã€è‡ªç¤¾ã®ç«¯æœ«ç®¡ç†ãƒ„ãƒ¼ãƒ«ï¼ˆMDMï¼‰ã€ŒAfariaã€ã‚’ç”¨ã„ã¦ã€å€‹äººæŒã¡ã®ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‚„ã‚¿ãƒ–ãƒ¬ãƒƒãƒˆã‹ã‚‰æ¥å‹™ã‚’é€²ã‚ã‚‰ã‚Œã‚‹ç’°å¢ƒã‚’æ•´ãˆãŸã€‚ ç¤¾å“¡ãŒã€å€‹äººæŒã¡ã®æºå¸¯é›»è©±ã‚’ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã«åˆ‡ã‚Šæ›¿ãˆã‚‹ã‚±ãƒ¼ã‚¹ãŒå¢—ãˆã¦ã„ã‚‹ç‚¹ã‚‚ãã®èƒŒæ™¯ã«ã‚ã‚‹ã€‚ãã†ãªã‚‹ã¨å¤šãã®å ´åˆã§ä¼šç¤¾æ”¯çµ¦ã®ã‚±ãƒ¼ã‚¿ã‚¤ã‚ˆã‚Šã‚‚å€‹äººæŒã¡ã®ç«¯æœ«ã®ã»ã†ãŒé«˜æ©Ÿèƒ½ã«ãªã‚‹ã€‚ã ã£ãŸã‚‰ã€é«˜æ©Ÿèƒ½ãªå€‹äººæŒã¡ã®ç«¯æœ«ã§æ¥å‹™ã‚’
papiro 2011/07/13
å€‹äººãŒæ‰€æœ‰ã™ã‚‹ãƒ¢ãƒã‚¤ãƒ«ç«¯æœ«ã‚„ã£ã±ä½¿ã†ã‚ˆãï¼Ÿ

ä»•äº‹

Security

mobile
ãƒªãƒ³ã‚¯
ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆè£½ã®ã‚¢ãƒ³ãƒã‚¦ã‚£ãƒ«ã‚¹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢Â·Microsoft Security Essentials MOONGIFT
Microsoft Security Essentialsã¯Windowså‘ã‘ã®ãƒ•ãƒªãƒ¼ã‚¦ã‚§ã‚¢ã€‚Windowsã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ãŒæ•°å¤šãã‚ã‚Šã€Mac OSXã«ã¯æ®†ã©ãªã„ã€‚ã ã‹ã‚‰Mac OSXã¯ã‚¦ã‚£ãƒ«ã‚¹ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«å¼·ã„ã¨ã„ã†ã®ã¯é–“é•ã„ã ã€‚å˜ã«Windowsã®ã‚·ã‚§ã‚¢ãŒå¤§ãã„ãŸã‚ã€æ„‰å¿«çŠ¯ã§ã‚ã‚‹ã‚¦ã‚£ãƒ«ã‚¹ä½œè€…é”ã¯ã‚ˆã‚Šæ··ä¹±ãŒå¤§ãããªã‚‹ã§ã‚ã‚ã†æ–¹ã‚’ç‹™ã£ã¦ã„ã‚‹ã«ã™ãŽãªã„ã€‚ ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆè£½ã®ã‚¦ã‚£ãƒ«ã‚¹ã€ãƒžãƒ«ã‚¦ã‚§ã‚¢å¯¾ç– Windowsã«ã¯æ—¢ã«å¤šæ•°ã®ã‚¦ã‚£ãƒ«ã‚¹é§†é™¤ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ãŒã‚ã‚Šã€ä¼šç¤¾ã§ã¯å¤§æŠµã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã¦ã„ã‚‹ã¯ãšã ã€‚ã ãŒå€‹äººã§ã¯éŽå‰°ãªè‡ªä¿¡ã§ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã—ã¦ã„ãªã„äººã‚‚ã„ã‚‹ã€‚ãã†ã„ã†æ–¹ã«é™ã£ã¦ã‚¦ã‚£ãƒ«ã‚¹ã«æ„ŸæŸ“ã—ã¦ã—ã¾ã†ã®ã ã€‚æ—¢ã«ç„¡æ–™ã®ã‚‚ã®ã‚‚æ•°å¤šã„ãŒã€ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆãŒé–‹ç™ºã—ãŸMicrosoft Security Essentialsã¯ã‚ã‚‹æ„å‘³å®‰å¿ƒã—ã¦åˆ©ç”¨ã§ãã‚‹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã ã€‚ Microsoft Sec
papiro 2009/10/08
ã©ã‚Œã ã‘ä½¿ã„ç‰©ã«ãªã‚‹ã®ã‹ãªï¼Ÿ

microsoft

Security
ãƒªãƒ³ã‚¯
Rails 2ç³»ã™ã¹ã¦ã®ãƒ–ãƒ©ãƒ³ãƒã«è„†å¼±æ€§ã€Ruby 1.9ãƒ¦ãƒ¼ã‚¶ã¯ã‚¢ãƒƒãƒ—ã‚°ãƒ¬ãƒ¼ãƒ‰æ³¨æ„ | ã‚¨ãƒ³ã‚¿ãƒ¼ãƒ—ãƒ©ã‚¤ã‚º | ãƒžã‚¤ã‚³ãƒŸã‚¸ãƒ£ãƒ¼ãƒŠãƒ«
Ruby on Rails 4æ—¥(ç±³å›½æ™‚é–“)ã€Ruby on Railsã®2ç³»ã™ã¹ã¦ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã«XSSã®è„†å¼±æ€§ãŒã‚ã‚‹ã“ã¨ãŒRiding Rails: XSS Vulnerability in Ruby on Railsã«ãŠã„ã¦ç™ºè¡¨ã•ã‚ŒãŸã€‚ç‰¹å®šã®Unicodeæ–‡å—åˆ—ã‚’ä½¿ã£ã¦ãƒã‚§ãƒƒã‚¯ã‚’ããã‚ŠæŠœã‘ã€ä»»æ„ã®HTMLã‚’é€ã‚Šè¾¼ã¾ã‚Œã‚‹å±é™ºæ€§ãŒã‚ã‚‹ã€‚ãªãŠRuby 1.9ç³»ã§å‹•ä½œã—ã¦ã„ã‚‹ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã¯ã“ã®å½±éŸ¿ã‚’å—ã‘ãªã„ã€‚ãã‚Œãžã‚Œã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã«å¯¾ã™ã‚‹ãƒ‘ãƒƒãƒã¯æ¬¡ã®ã¨ãŠã‚Šã€‚ 2-0-CVE-2009-3009.patch - Patch for 2.0 series 2-1-CVE-2009-3009.patch - Patch for 2.1 series 2-2-CVE-2009-3009.patch - Patch for 2.2 series 2-3-CVE-2009-3009.patch - Pa
papiro 2009/09/08
ããŠå¯¾å¿œã›ãã°

Rails

Security
ãƒªãƒ³ã‚¯
019 ã‚‚ã†IDãƒ»ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®å…¥åŠ›ã¯1å›žã ã‘ï¼OSSã®Shibbolethã§ã‚·ãƒ³ã‚°ãƒ«ã‚µã‚¤ãƒ³ã‚ªãƒ³ - EC-One ãƒŠãƒ¬ãƒƒã‚¸ã‚»ãƒ³ã‚¿ãƒ¼ ãƒ¬ã‚¹ã‚ãƒ¥ãƒ¼ã‚µãƒ¼ãƒ“ã‚¹ ãƒ–ãƒã‚°
ã“ã‚“ã«ã¡ã¯ã€id:EC-Oneã®Akiã§ã™ã€‚ ä»Šå›žã¯å¤ä¼‘ã¿ã®å®¿é¡Œã®ã”ã¨ãã€ä»Šå¹´å…¥ã£ãŸã°ã‹ã‚Šã®æ–°äººFunaã•ã‚“ã«ä»Šèª¿ã¹ã¦ã„ã‚‹ã“ã¨ã‚’ã¾ã¨ã‚ã¦ã‚‚ã‚‰ã„ã¾ã—ãŸï¼ ãã‚Œã§ã¯Funaã•ã‚“ã€ã‚ˆã‚ã—ããŠé¡˜ã„ã—ã¾ã™ã€‚ ã¯ã˜ã‚ã¾ã—ã¦ã€Funaã§ã™ï¼ ã“ã‚“ã«ã¡ã¯ï¼4æœˆã«EC-Oneï¼ˆã‚¤ãƒ¼ã‚·ãƒ¼ãƒ»ãƒ¯ãƒ³ï¼‰ã¸å…¥ç¤¾ã—ã¾ã—ãŸFunaã§ã™ï¼ ä»Šå›žã¯ã€æ–°äººã®è‡ªåˆ†ãŒè¡Œã£ãŸShibbolethã®èª¿æŸ»ãƒ»å‹•ä½œç¢ºèªã«ã¤ã„ã¦ã€æ›¸ã‹ã›ã¦ã„ãŸã ã“ã†ã¨æ€ã„ã¾ã™ã€‚ Shibbolethã«ã¤ã„ã¦ Shibbolethã«ã¤ã„ã¦èª¿ã¹ã‚‹ã“ã¨ã«ãªã£ãŸãã£ã‹ã‘ã¯ã€ã¨ã‚ã‚‹ãŠå®¢æ§˜ã‹ã‚‰ã€Œè¤‡æ•°ã‚·ã‚¹ãƒ†ãƒ ã‚’ä½¿ã†éš›ã«ä½•åº¦ã‚‚ãƒã‚°ã‚¤ãƒ³ã‚’è¡Œã†ã®ã¯é¢å€’ãªã®ã§ã€ã‚·ãƒ³ã‚°ãƒ«ã‚µã‚¤ãƒ³ã‚ªãƒ³ï¼ˆSSOï¼‰ã®å°Žå…¥ã‚’æ¤œè¨Žã—ãŸã„ã€ã€Œãã®å®Ÿç¾ã«ã¯ã€ŽShibbolethã€ã‚’ä½¿ã£ã¦æ¬²ã—ã„ã€ã¨ã„ã†ã”ç›¸è«‡ã‚’é ‚ã„ãŸã“ã¨ã§ã—ãŸã€‚ ã¡ãªã¿ã«SSOã¨ã¯1ã¤ã®ã‚·ã‚¹ãƒ†ãƒ ã§ãƒã‚°ã‚¤ãƒ³èªè¨¼ã‚’ã™ã‚‹ã¨ã€ä»–ã®ã‚·ã‚¹ãƒ†ãƒ ã¯å†åº¦èªè¨¼æ‰‹ç¶šãã‚’ã›ãš
papiro 2009/09/07
UPKIãƒ™ãƒ¼ã‚¹ã®ã‚·ãƒ³ã‚°ãƒ«ã‚µã‚¤ãƒ³ã‚ªãƒ³

PKI

Security
ãƒªãƒ³ã‚¯
ç¬¬4å›žã€€UTF-8ã®å†—é•·ãªã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ | gihyo.jp
ä»Šå›žã¯ã€æ–‡å—ã‚³ãƒ¼ãƒ‰ã«é–¢é€£ã™ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®è©±é¡Œã§ã¯å¤å‚ã¨ã‚‚ã„ãˆã‚‹UTF-8ã®å†—é•·ãªã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã¨ã„ã†ãƒ†ãƒ¼ãƒžã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ UTF-8ã¨ã¯ UTF-8ã¯ã€å„æ–‡å—ã‚’1ï½ž4ãƒã‚¤ãƒˆã®å¯å¤‰é•·ã§è¡¨ç¾ã™ã‚‹Unicodeã®ç¬¦å·åŒ–æ–¹å¼ã®ã²ã¨ã¤ã§ã™ã€‚ Uï¼‹0000ã‹ã‚‰Uï¼‹007Fã®ç¯„å›²ã®æ–‡å—ã‚’0x00ã‹ã‚‰0x7Fã®1ãƒã‚¤ãƒˆã§è¡¨ç¾ã—ã¦ã„ã‚‹ãŸã‚ã€US-ASCIIã¨äº’æ›æ€§ãŒã‚ã‚‹ã€ãƒã‚¤ãƒˆåˆ—ã®é€”ä¸ã‹ã‚‰ã§ã‚‚æ–‡å—ã®å…ˆé ãƒã‚¤ãƒˆã‚’ç°¡å˜ã«æ¤œå‡ºã§ãã‚‹ã€å¤šãƒã‚¤ãƒˆæ–‡å—ã®é€”ä¸ã«0x00ã‚„0x5Cï¼ˆ\â ï¼‰â ã€0x2Fï¼ˆ/ï¼‰ãªã©ãŒç¾ã‚Œãªã„ã€ãªã©ã®ç‰¹å¾´ãŒã‚ã‚Šã¾ã™ã€‚ UTF-8ã§ã®æ–‡å—ã®ãƒ“ãƒƒãƒˆãƒ‘ã‚¿ãƒ¼ãƒ³ã¯è¡¨1ã®ã‚ˆã†ã«ãªã‚Šã¾ã™ã€‚ è¡¨1ã€€UTF-8ã§ã®ãƒ“ãƒƒãƒˆãƒ‘ã‚¿ãƒ¼ãƒ³
papiro 2009/09/07
Security

æ–‡å—ã‚³ãƒ¼ãƒ‰
ãƒªãƒ³ã‚¯
1