Securing your environment: application, server, code, and more - Engineer Man Live

Agenda TBD

Hope you enjoyed the video!

Check out this code here:

Join my Discord server to chat with me:

Check out some code on my GitHub:

Tweet me something funny on Twitter:

Say hi over at Facebook:

Sincerely,
Engineer Man

[cyberzeus]

Great video - several points:

(1) Many FWs can do much more than IP\Port based packet filtering. Deep packet inspection and stateful FWs operate more on a payload and flow basis than just the SA\DA IP\port information.

(2) AD is not the same as public\private key encryption. AD is a Microsoft implementation of an LDAP (i.e. directory) type service.

(3) It should be noted to never allow direct root access\login via any remote access method such as SSH. ALWAYS require "su" to utilize the root account AFTER you have logged into the system. Similarly, NEVER even use the root account unless logged in via an encrypted channel - NEVER NEVER NEVER cleartext channels like telnet.

(4) While I'm on it, disable telnetd (the telnet daemon) altogether. There is truly no need to have it running.

(5) The same goes for FTP\SFTP - the former should never be allowed except for very rare and one-off situations. I almost always disable FTPd and require SFTP. Any FTP client worth a damn will also support SFTP as well.

(6) Running daemons with root access is not that big a deal if the box is secure. The more important issue here is to not use the root account unless absolutely required. Use "sudo" instead. Don't believe me??? Try issuing something like "rm -f *" against an undesired location while using the root account and see what happens...

(7) Always try to use a dedicated box as your FW. While it is definitely possible to run FW services on the same server you wish to protect, doing so increases maintenance tasks and can add undesirable load to that server. Moving your FW out in front of your protected hosts helps to centralize your workload, doesn't risk overloading your protected hosts, and allows for more flexibility in terms of your security paradigm.

(8) Last, consider moving some apps to non-standard ports. For example, move SSH away from 22 and put it on 5022 (or whatever you wish). If you have webapps that do not require access via well-known ports (i.e. myphpadmin), then move those away from 443. This isn't foolproof (nothing is) but it does add to the hacker's workload - security by even partial obscurity is never a bad thing.

[MaartenVanDamme]

Very interesting content, thanks for creating these videos. Keep going.

[Alessandro-nqtm]

Amazing, really useful . Thank you engineer god ! :)

[JailerGamer]

So, there is hackerman and now, his antagonist *ENGINEER MAN*

[toobstr]

Do you have an example code of the try catch for errors you mentioned?

[yegorpl]

1.Q&A: 11:00
2. Main content: 14:12

[Vlfkfnejisjejrjtjrie]

Inlet server is a good name. I heard the term jump box or jump server as other terms.

[gandhiisback]

One mistake that I have made is forgetting that I had a key in an older testing code file. I created the new code file with the proper secret handling but accidentally uploaded my old file with the secret.

[paninomortadella]

Could you please make a video about it?

[gomo]

didnt went through cookies and ddos? cmon: )