Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 7 years ago.
Improve this question
I'm trying to devise a method to protect my HAProxy SSL certificates while at rest on disk so that if the load-balancer host gets hacked, the SSL certificates will not be sitting there ripe for the attacker to pluck.
I realize that at the very least, the certificates must be available in memory in order to be used by HAProxy to negotiate SSL connections. However, I’d like to do whatever is possible to keep the certificates secure.
How can I setup the ssl-cert directory to be protected and/or encrypted and be available to HAProxy only when it needs the information (presumably when the service is started)?
Currently I see two ways this could be achieved.
Use some sort of linux/*nix filesystem-level encryption.
This means munging the HAProxy init/upstart script to require a specific password or key file to exist on disk. This password is then used to extract the certs from an encrypted archive file (e.g. RAR or something?) into the HAProxy /etc/haproxy/certs directory. After the HAproxy service has started use srm the password/key file along with the /etc/haproxy/certs directory.
Create an external API service management layer which runs on a different (super secured) host. This service will store the certificates and orchestrate load-balancer service restarts and reloads. This service would rsync over the haproxy certs directory, restart or reload it via ssh, and then ssh … srm the certs directory to securely erase the /etc/haproxy/certs directory.
I’d appreciate feedback on these ideas, any relevant experience, or any other way this security goal can be achieved.
Additional resources:
Here is a relevant related question on SO regarding multi-ssl HAproxy.
HAProxy SSL termination documentation
Although this isn't the right forum for your question, here's an answer:
Simply protect your SSL certificates with a passphrase.
Upon starting HAProxy, your SSL Library will ask for the passphrase.
Keep in mind that you will need to type the passphrase every time you start/restart HAProxy.
Related
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 2 years ago.
Improve this question
I'm currently building an application and I want to make sure that I use HTTPS throughout the whole application. The application is a web application in Golang and I wanted to know how to get legit certificates so that my application can be secure.
I would say it depends on how the application is gonna be deployed.
Hosting the application on a VPS / private server as a systemd service ?
You could look into Certbot if you want to manage SSL renewal automatically. But still you'll need to provide the certificate into your application, or use a HTTP proxy such as NGINX to expose your application on HTTPS.
This approach would work, but can be painful as you'll need to install / manage Certbot & possibly Nginx on your server.
Another good option would be to use Traefik, it's a Proxy server with builtin Let's Encrypt support, so that you'll be able to use free SSL, automatically renewed, by just installing the service, and creating a little configuration file.
I would personally choose the external proxy approach on this one, and especially Traefik. It shouldn't be the job of you web application to manage HTTPS, but more an external proxy. So that if one day you need to scale your application, it shouldn't be painful.
Well, you have a few options. I found it easy to use ZeroSSL to get a trusted certificate, but there are many other ways to do so. You can also use Certbot, but it several dependencies to be installed.
If you are getting certificate for FQDN , you can use Letusencrypt which provides many clients support including certbot. You can find it here
https://letsencrypt.org/docs/client-options/ but please remember it wont work without fqdn.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 2 years ago.
Improve this question
If I gave my SSL certificate & private key being used on website mydomain[dot]com to some hacker, would the hacker be able to hijack / intercept the connection or misuse in any way?
Right, so basically, "What's the point of protecting an SSL certificate's private key?"
The proper name for the attack you're describing is "Man in the Middle (MitM) attack".
As the name implies, the attacker needs to be in the middle [source article for the image]:
At this point, you will open an HTTPS connection to the attacker and because they have the certificate and private key, you can't tell that you are not talking directly to the legitimate web site. The attacker then opens another HTTPS connection between themselves and the server; because they are re-transmitting your messages (including your login) the server can't tell that they are not talking directly to you. The attacker is "in the middle".
How does the attacker get in the middle? Maybe they are on the same hosting service as you and have somehow tricked the service provider to route your traffic to them. Maybe they are one of the legitimate routers on the internet. Maybe they have used techniques such as BGP Hacking to convince the legitimate routers that they have a fast route to your server. Maybe they are in the same wifi is the victim and have used ARP Spoofing to convince the victim that their laptop is the wifi router and all traffic should go through it. Lots of ways, all of which require "an extra step" in order to perform the attack.
Summary: An attacker with your SSL certificate and private key can't do anything directly, but it opens up a whole category of attacks if they also have the ability to manipulate network traffic to put themselves "in between" your site and the victim.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 7 years ago.
Improve this question
I have an AWS EC2 Ubuntu instance protected by SSH Key. I was thinking, it is secure enough, but I have received an email from Amazon, telling what my instance has been hacked and used for port scanning.
I do not have a reason not to believe Amazon security team, but I do not understand how it is possible. I only use SSH Key to login to the instance, the Key has not been exposed to the world, it only being used from my home computer.
Is there are some security holes in Ubuntu I do not aware of? Is SSH Key is secure enough?
The Instance uses default 64-bit Ubuntu image, provided by AWS. It does not host any web pages.
The default ubuntu image only allows login using SSH keys and prohibits password based logins. Unless you have changed this configuration, it is very unlikely someone got in through SSH.
While unknown vulnerabilities in Ubuntu most certainly exist, their value is very high and it is extremely unlikely that someone will waste potentially millions of dollars worth of vulnerabilities to take over your particular server.
The most likely explanation is that you are running some piece of software (most likely a web application) which is vulnerable and were compromised through it.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 2 years ago.
Improve this question
When asked to look into having authentication for my company's website, I ended up using htaccess and htpasswd. Now I'm being asked to look for a more secure solution. One scenario I was advised to look out for was sniffing. I looked around and found HTTPS seems to be the solution I'm looking for.
If the authentication is only going to be accessed by our employees and will allow them access to a database. The activity on this database should be very light. I'm under the impression no more than say... 5 queries per session, and the data retrieved would be lightweight too.
From what I've read, seems like HTTPS is what I should be betting on here. My knowledge in authentication and encryption is next to nil, so I'm wondering if there are any other options to go about secure authentication for our site.
HTTPS primarily provides:
confidentiality
integrity
authentication of the server to the client
The latter is an important measure against man-in-the-middle and impersonation attacks. Think of somebody pretending to be the server and fooling the client in submitting sensitive data like passwords.
Note that - in order to work - the server must have an SSL certificate signed by a CA recognized by the client browser. That can either be an SSL certificate obtained by a commerical CA like Verisign or a custom SSL certificate all your users must import into the certificate storage.
Bottom line, HTTPS protects you from spoofing attacks, but only if the certificates are set up correctly. Still, be sure to disable plain HTTP, otherwise an attacker may try a downgrade attack.
With HTTPS in place, you can use any of several method to authenticate the client to the server, including whatever you are using now (I guess HTTP Basic or Digest). Other options include Kerberos, the old NTLM, RADIUS, or client-side SSL certificates.
Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 11 years ago.
Improve this question
I'll be using a shared Internet connexion starting this September at my school and I was wondering about what someone sniffing traffic with Wireshark may find there. I am not planing to do this myself but I feel I ought to know more about it if I want to sometimes work on my website during class.
Basically, isn't every non-SSL website that asks you for a password and an e-mail totally unsecure to log on on a shared connexion? When you know how many people use the same password for all their web/laptop/mobile accounts, it doesn't take long to get access to someone's all private data if you manage to sniff one password and e-mail.
As for me, I am already looking at how to secure my FTP connexions, but what about my users who log through HTTP? Unless I buy a SSL certificate (which I don't want, the site's too small), they are going to get more exposed to Wireshark sniffers all over the world, right? Isn't this where login tools such as OpenID become handy for small communities, since they do provide a free encryption of passwords?
OpenID and SSL are completely unrelated. OpenID's purpose is to consolidate and give ownership of a user's identity to the user, while SSL is used to keep a user's traffic with your site secret (encrypted). You can use OpenId to keep track of the user (like Stackoverflow does) and still not use SSL for the content pages.