Hi,

Please see https://www.experts-exchange.com/questions/29170630/Powershell-get-cve-score-specific-soft-version-via-cve-api.html

I could also use Docker to run on my Windows 2016 labserver and install the  CVE stuff on it: https://github.com/cve-search/cve-search

Just wonder: howto do this? When it is there, how can I scan for a CVE score, f.e. Firefox 60.1, what is its CVE score (preferrably Powershell based (run a ssh session or other options?)?

J

I am running a CentOS 7 server running Samba 4.9.1

I have a fileshare on a Win 2008 R2 (soon to be upgraded) server that I want to right to from the CentOS sever.

I have installed 'samba-clent' and 'cifs-utils'. I have added a line to [/etc/fstab] to create a mount point to a folder in the root called 'output' (i.e.  '/output') and passed credentials of a special windows user from a text file (username, password and domain).

On the Windows side I have granted the share folder 'Full control' to the windows user AND shared the folder with them.

This all works well and the two servers are now linked so that if I create a text file from CentOS in the folder '/output' it appears in the Windows share. I can list the share's contents. create folders, delete files and delete folders.

HOWEVER I when I run a shell script that runs a docker program (third-party that I can't upload) it returns 'Permission denied' when it tries to generate a database backup in that location.

The exact same setup worked under Ubuntu 16.04 so I am confused as to what is missing here.

I have even run '# semanage fcontext -a -t samba_share_t '/output(/.*)?' and then '# restorcon -v /output' to stop SELinux from blocking the Samba communication.

Questions:

1. What could I be missing ?
2. Do I need to create a Samba user just to access this share ? I didn't under Ubuntu 16.04
3. How can I further manually test the share to see if I am missing permissions

Hi Docker Experts,

I have a vendor provided docker image. Which I have it in my docker registry.

I have simple Docker File which uses this image as a BASE image.

1. Would like to copy a file from the docker image to host
2. update the copied file on the host
3. Copy updated file back to docker in the same location
4. build docker with new tag

please help

Simple Dockerifle

FROM xxxxxxxx.dkr.ecr.ap-southeast-2.amazonaws.com/busybox1

RUN echo foo > bar
COPY /tmp/test.txt /tmp/test_upd.txt

Select all Open in new window

For me even simple COPY is failing
lstat tmp/test.txt: no such file or directory

I've added the following settings in /etc/sysctl.conf  as well as
issued 'sysctl -w ...'  to make it effective as part of hardening.

My apps colleague rebooted the RHEL 7 VMs & now
the docker gave the error '503 Service Unavailable'.

How should I reverse them back: just by removing
those lines from sysctl.conf & reboot (sysctl.conf was
quite empty initially)
OR
re-issue "sysctl -w ..." with the  alternate value (ie if
it's 0, set it to 1 & if it's 1, set it to 0)?  But this doesn't
seem right as we don't know what's the default
value initially.  So how do we know what's the
initial default value before the change??


sysctl -w fs.suid_dumpable=0
sysctl -w kernel.randomize_va_space=2
sysctl -w net.ipv4.conf.default.accept_redirects=0
sysctl -w net.ipv4.conf.all.secure_redirects=0
sysctl -w net.ipv4.conf.default.secure_redirects=0
sysctl -w net.ipv4.conf.all.rp_filter=1
sysctl -w net.ipv4.conf.default.rp_filter=1
sysctl -w net.ipv4.ip_forward=0
sysctl -w net.ipv4.conf.all.send_redirects=0
sysctl -w net.ipv4.conf.default.send_redirects=0
sysctl -w net.ipv4.conf.all.accept_source_route=0
sysctl -w net.ipv4.conf.default.accept_source_route=0
sysctl -w net.ipv4.conf.all.accept_redirects=0
sysctl -w net.ipv4.conf.all.log_martians=1
sysctl -w net.ipv4.conf.default.log_martians=1
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
sysctl -w net.ipv4.tcp_syncookies=1
sysctl -w …

During hardening, found the following group or world writable files.
Any harm if I do  'chmod g-w  or o-w'  on them:

rw-rw-r--. 1 root utmp 1920 Nov 15 15:26 /run/utmp
-rw-rw-rw-. 1 root root 0 Nov  8 20:47 /sys/fs/selinux/member
-rw-rw-rw-. 1 root root 0 Nov  8 20:47 /sys/fs/selinux/user
-rw-rw-rw-. 1 root root 0 Nov  8 20:47 /sys/fs/selinux/relabel
-rw-rw-rw-. 1 root root 0 Nov  8 20:47 /sys/fs/selinux/create
-rw-rw-rw-. 1 root root 0 Nov  8 20:47 /sys/fs/selinux/access
-rw-rw-rw-. 1 root root 0 Nov  8 20:47 /sys/fs/selinux/context
--w--w--w-. 1 root root 0 Nov 12 22:18 /sys/fs/cgroup/blkio/docker/09445bf1ebac906fb92c97d9140a42710796b2dd34bb3474c71794b131f4741b/cgroup.event_control
--w--w--w-. 1 root root 0 Nov 11 18:29 /sys/fs/cgroup/blkio/docker/e760f8367ab29e50ea04629d2d1466013a0d19510052470e0617bb169993e652/cgroup.event_control
--w--w--w-. 1 root root 0 Nov  8 21:05 /sys/fs/cgroup/blkio/docker/5370fc625a376632a22e470e0d490e11a1e10ce7b142d87f5854ea258a2a5567/cgroup.event_control
--w--w--w-. 1 root root 0 Nov  8 21:05 /sys/fs/cgroup/blkio/docker/cadac22712699622cc1554a6ced7f662fdc8dd62b5793516096dea0f9d268548/cgroup.event_control
--w--w--w-. 1 root root 0 Nov  8 21:05 /sys/fs/cgroup/blkio/docker/ffd11120a3e494232e67bb4517bcf358c5d2e1690935455b37db9bcd169e9320/cgroup.event_control
--w--w--w-. 1 root root 0 Nov  8 21:05 /sys/fs/cgroup/blkio/docker/0d93b13bbc417a4d59cc89c5e28160217c844d702f80ea29bb7740df86e1ef3d/cgroup.event_control
--w--w--w-. 1 root root 0…

Hi,

I have Pihole running. Sometimes I look for something and I get
https://www.googleadservices.com/pagead/ ... then a link

but the googleadservices page is blocked and then I cannot ge to the final page.
How can I solve this?

Please advise.
J.

I recently took away users local admin privileges from all the end users computers.  The people who seem to be affected by this the most are the programmers. They have issues with running docker which needs to be run with elevated privileges (Just one example so far ).  I would be interested in hearing what other sys admins are doing with the more technical end users to let them work properly?

Thank you.

Trying to run Docker and I'm getting this error:

$ bash bin/development.sh
Building express-mongoose-es6-rest-api
Step 1/9 : FROM node:8.10.0
 ---> 41a1f5b81103
Step 2/9 : MAINTAINER Kunal Kapadia <kunalkapadia12@gmail.com>
Service 'express-mongoose-es6-rest-api' failed to build: failed to start service utility VM (createreadwrite): hcsshim::CreateComputeSystem 7be3d4b1e2c0b1026873e49e7b782f851fde4296ed082a0942ddee02bbb9f688_svm: The virtual machine could not be started because a required feature is not installed.
(extra info: {"SystemType":"container","Name":"7be3d4b1e2c0b1026873e49e7b782f851fde4296ed082a0942ddee02bbb9f688_svm","Layers":null,"HvPartition":true,"HvRuntime":{"ImagePath":"C:\\Program Files\\Linux Containers","LinuxInitrdFile":"initrd.img","LinuxKernelFile":"kernel"},"ContainerType":"linux","TerminateOnLastHandleClosed":true})

When I'm looking at that, I'm seeing what I have in bold. I'm google-ing this stuff now, but if there's anybody out there who's been down this road who can tell me what I need to do to make this work, I'm all ears!

Thanks!

Q1:
Is there any hardening guide for RHEL 8?
If there's none, can I assume it's very close to RHEL 7's hardenings?
Then I'll ask vendors to harden RHEL 8 as per CIS RHEL7's benchmark.

Q2:
We're hosting docker/microservices in an RHEL host: previously the
vendor tested using RHEL7: can I safely say it makes no difference/
impact to the services/app whether we use RHEL 7 or 8?

Q3:
at the VMs level is there any difference/impact?  The docker
instances is spinned from the various Ubuntu, Debian images,
so I'm guessing it doesn't matter which version of RHEL runs
on the VMs

i have a ubuntu lxd container (on ubuntu 18.04).
i add a domain group in visudo. and run lxc set security.priviliged true on my lxd docker.
i try to update ubuntu 16 as domain user in sudores group:
return error : sudo apt update
sudo: unable to resolve host “my-host”
sudo: no tty present and no askpass program specified.

hi,

reading this :

https://severalnines.com/blog/mariadb-maxscale-load-balancing-docker-deployment-part-1?utm_campaign=MariaDB_Campaign_JUN19&utm_content=maxscale_docker_1&utm_medium=Social_Media&utm_source=Facebook&fbclid=IwAR3pMjAyEA7qt4x9CKRHQdJah1feHuwIF_OhhRb-K6Bc_MjTDSRMJyfJzNA

what is  Docker Swarm ?

it say

"MaxScale Clustering with Docker Swarm
With Docker Swarm, we can create a group of MaxScale instances via Swarm service with more than one replica together with Swarm Configs."

so what is that ?


also in here:

https://severalnines.com/blog/mariadb-maxscale-load-balancing-docker-management-part-2

it say:

Query Rewriting
Query rewrite is a feature that, depending on the queries running against the database server, quickly allows to isolate and correct problematic queries and improve performance.

Select all Open in new window

I dont' understand what it means ?

and this one :

uery rewriting can be done via regexfilter. This filter can match or exclude incoming statements using regular expressions and replace them with another statement. Every rule is defined in its own section and include the section name in the corresponding service to activate it.

Select all Open in new window

this means if we see a bad query we use maxsale to replace any string ?

Hi,

I would like to use Piehole (or another add blocking/security enabling feature) for my home network.
My Synology NAS supports Docker, so I stumbled upon this article: http://tonylawrence.com/posts/unix/synology/free-your-synology-ports/
Not going to buy a Pie, my Synology is good enough and dont want extra hardware to buy/maintain/configure anyway.
 
I like the idea of Docker/containers since I do think it is the future, I have no Docker experience whatsoever for now. My questions:
-is Piehole the right protection tool to use or are there better (Docker) solutions?
-if I follow the procedure described, what to do then, just point my dhcp dns to the ip of Synology? Any config I can do to the Piehole? Then where?  Not clear to me.
-I also have a Synology Router mc2200 ac, can/should I combine it's security features?

Thanks for your input!
J