SweetOps #security for September, 2019

grsecurity is an extensive security enhancement to the Linux kernel that defends against a wide range of security threats through intelligent access control, memory corruption-based exploit prevention, and a host of other system hardening that generally require no configuration.

2019-09-06

Maciek Strömich

01:11:15 PM

https://exim.org/static/doc/security/CVE-2019-15846.txt

2019-09-07

Maciek Strömich

11:23:56 AM

https://www.leebutterman.com/2019/08/05/analyzing-hundreds-of-millions-of-ssl-connections.html

Let’s Encrypt makes certs for almost 30% of web domains! RC4/3DES/TLS 1.0 are still used! Certs for hundreds of years! Analyzing hundreds of millions of SSL handshakes

Looking at a dataset of 350 million ssl connections inspires some initial questions:

2019-09-10

Jonathan Le

12:15:04 AM

Anyone have experience with running Palo Alto networks firewalls at scale on AWS?

2019-09-12

Erik Osterman (Cloud Posse)

03:09:09 AM

https://smallstep.com/blog/use-ssh-certificates/

If you’re not using SSH certificates you’re doing SSH wrong attachment image

SSH has some pretty gnarly issues when it comes to usability, operability, and security. The good news is this is all easy to fix. SSH is ubiquitous. It’s the de-facto solution for remote administration of *nix systems. SSH certificate authentication makes SSH easier to use, easier to operate, and more secure.

kskewes

05:24:56 AM

How does this compare to teleport by gravitational? Looks very similar.

If you’re not using SSH certificates you’re doing SSH wrong attachment image

Erik Osterman (Cloud Posse)

05:25:21 AM

Yep. This is what teleport does (and then some!)

Erik Osterman (Cloud Posse)

05:25:36 AM

teleport adds full TTY session logging and replay which is priceless. no other solution has that.

Erik Osterman (Cloud Posse)

05:25:56 AM

@kskewes do you use teleport?

Erik Osterman (Cloud Posse)

05:26:31 AM

This article goes more into the theory of why you should do it and how you would do it with off the shelf open source software.

kskewes

05:30:25 AM

Thanks for quick reply. I only skimmed the article but it looks good whichever way one goes. I’ve been wanting to roll out teleport for a year but other projects keep leap frogging it. So not yet… :(

Erik Osterman (Cloud Posse)

05:32:53 AM

Are you on k8s?

kskewes

06:35:38 AM

Mostly. We have some bare metal with GPU that we will move to VM soon. We’re about to embark on migration to AWS from IBM.

2019-09-16

Erik Osterman (Cloud Posse)

04:17:56 PM

https://news.google.com/articles/CAIiEAhcXDko5oK2fjFI00SgqecqFQgEKg0IACoGCAowrqkBMKBFMMGBAg?hl=en-US&gl=US&ceid=US%3Aen

Google Warns LastPass Users Were Exposed To ‘Last Password’ Credential Leak attachment image

Google Project Zero security researcher reveals that the LastPass password manager could, somewhat ironically, leak the last password you used to any website you visited

Igor

08:08:07 PM

Thanks for sharing, Erik