3-minute fever 三分鐘熱度

Just as I was with my daily random YouTube video clips watching, I saw one of my subscribed content put up this. This is one of the content I found so far, easier for my to catch up with this vulnerability details. If you prefer read than watch video, there's another online post about the related exploit at fastly is easy to read. Based on the diagram from this article, I think (maybe naively, and maybe it could be sufficient as a mitigation plan, I don't know), having the firewall rules to deny all with allow lists would be the best mitigation option while waiting for a patch. This stop the "query ldap" path at the first phase, thus it won't have a chance to go to the second phase from this vulnerability. Anyway, this log4shell vulnerability has caught attention widely since last week. It has been a disasterous event for IT team. They need to find ways to check if the servers are impacted? Look for automated ways to detect if this log4j library exists in t...

D2 : Cloud Data Security M6 : Ensure Compliance with Regulations and Controls IT Service Management (ITSM) Management and oversight to ensure alignment between IT and business. Configuration Management Maintain information about configuration items required to deliver an IT service, including their relationship. Change Management An approach to transitioning individuals, teams, and organizations to a desired future state. Respond to acustomer's changing business requirements Respond to business and IT requests Ensure changes are recorded and evaluated Ensure the authorized changes are prioritized, planned, tested, implemented, documented and reviewed in a controlled manner Ensure all changes to configuration items are recorded in configuration management system Optimize overall business risk. Incident Management To identify, analyze, and correct hazards to prevent a future re-occurrence of an incident. Event : A change of state that has significance for the mana...

OMG! I can't believe that it's a year passed by, and I did not write up for the last 2 topics that I'd like to covered in RHCE! Those posts were prepared after I have finished and passed RHCE. Anyway, I am in preparation for another certification, CCSP. Thought of "document" my study notes in order to help me to organize my notes, and also help me to reinforce my understanding on the topics. I am going to start from Domain 2. D2 : Cloud Data Security M1 : Understand Cloud Data Life Cycle Process overview This table is to layout the possible access and allowed access by functions/actor/location. The access control requirement and design can be retrieved from this table. M2 : Understand Implication of Cloud to Enterprise Risk Risk management Risk framework Key roles associate with data management Data subject : individual who is the subject of personal data Data controller : person who determines the purpose and how to process personal data...

SELinux stands for NSA Security-Enhanced Linux. By default, the setting for SELinux is set at /etc/selinux/config. Theh default setup is permissive, which if the SELinux policy is violated, warnings will be logged rather than prohibit the service from running properly. SELinux config file content. In permissive mode, the log is captured in /var/log/audit/audit.log file. Port related Let's do a test. I set the httpd service also listen to port 1234, which is not a convention port number for httpd. When it is in permissive mode, the httpd service is successfully to restart. However, there's an entry in the audit.log file. When I set SELinux to enforcing, the service failed to start. This is the snippets of log when I get the status of httpd service. From the log in audit.log file and also the status log, port 1234 is the culprit. It should be added to related SELinux policy. I am adding the port to http_port_t as well. Now it can be successfully restarted! ...

By default, firewalld is ready installed when you setup your machine. So, nothing extra needs to be install in order to use this. Basically, there are a few default zones predefined and by default, the public zone will be set as the default zone. I got this from man firewalld. List of predefined zones, and the default zone. Basic firewall command is to allow external to access local machine services or port. To list current firewall rules. To allow a service or port. To remove the service or port from firewall rule, simply replace the add to remove . Note that, this is just a temporary allowing the service and port. After the firewalld service restarted, these rules will be gone. To make it permanent, run again the commands with additional --permanent option. Another way is, run the command with --permanent option first, then run firewall-cmd --reload . For a more complicated firewall rule setting, which uses rich language. You may set to drop or reject or accept...