u/jhaar

So a 8char+ PSK is safer than a 8charUsername@realm+8charPassword+ AD credential pair? I don't think so... Also every user has different creds and change them, unlike ONE PSK on the same 10000 employees devices... 

Linux has a kernel-level module to do native CIFS (ksmbd). Samba is user-space. These vulns have nothing to do with the Samba software 

I see supporting Exchange is high up that list. Is that a good idea? I thought Microsoft was killing off the standalone product and their Cloud version was dropping EWS - ie going all proprietary 

good Mastodon thread on this - apparently the crashes are a NEW exploit: https://cyberplace.social/@GossiTheDog/117372929427365765

it's not as bad as you think... What's the real difference between "curl url | bash" and "curl -o file.exe url ; file.exe" (or .dmg, .rpm, etc) - it's the same outcome. End of the day, you are downloading something that when executed/installed on your system, has the ability to execute arbitrary scripts (see rpm prescript/postscript) - so being a package manager app makes zero difference to the threat model.

Of course if instead you did package management 100% thoroughly, then you'd PGP-sign the package, and configure the package manager to check for signatures,etc. But that becomes a "barrier to entry" as the cool kids say... (you'd have to do that for every supported platform for starters...). And at the end of the day, it's always about TRUST: so if you trust the nice random github app, then you trust it irrespective of how it's delivered. I'm not saying it can't be more secured - but worrying about compromised CDNs is not on most people's list.

(hell, even under Windows I'm STILL seeing large vendors not digitally signing their executables - and that's been possible since 1996 - that's 30 years ago...)

is there a better documentation link somewhere? I want to know what's supported compared to Okta-Verify on Mac/Windows. eg can it tell if Crowdstrike is installed, if the disk is encrypted, etc

Thanks!

Wow, I never said it's on the Internet. I said enterprise virtualization is a routine target for hackers - I would have thought it's implicit they must have already got into the internal network for such a thing to happen. That's why I think proxmox should be logging the IP address of all admin connections, not just the failed ones. My comment about firewalls was about internal firewalls (on the WAN) - we actually use firewalling to block all admin connections to vcenter/esxi/proxmox except from secured bastion hosts (aka a prevention control) AND I'm working on an independent detection control - hence my question. we want to ensure the prevention control is working

I'm well aware the weblogs contain that. You didn't read where I said expecting people to load more programs onto their hypervisors in order to pick up tiny extra pieces of information isn't a good idea - especially when other competing products do it natively

That's not the case for us. I'm in Cyber and don't actually run proxmox - that's another part of the org. But they send the syslogs to us and there's no IP address - we just see

pvedaemon[3666]: [root@pam](mailto:root@pam) successful auth for user 'monitoring@pve'

but you're right - I should have asked AI. It says the IP is only logged for failed attempts - that's pretty useless. We don't care (as much) about failed attempts - they failed - it's the successful ones that are more important. Wanna see if unexpected IPs show up. (yes, that's what firewalls are for, but defense in depth and all that)

Then don't even look at personal VPNs. Their IP addresses by definition have "poor reputation" according to all Enterprise monitoring solutions/vendors so instead focus on enterprise VPN. However, it's 2026 so that means "cloud VPN" - not the mess that is Fortinet/Cisco/etc. look at tailscale and other cloud/mesh VPN providers. 

Enterprises are globally under attack by the North Korean government hackers applying for (and getting) tech jobs under fake identities. I appreciate this is 99% an HR problem, but are there Cyber/IT detection processes known to bubble up evidence if you end up with one working for your company? (beyond "look for remote access software"). Thanks.

It's beginning to feel like the AI Bubble is getting very close to popping (although people have been saying that for >1 year, so...)

This is a good Bloomburg interview on the top: https://www.youtube.com/watch?v=zbKDmkJPVvI

I think the real problem is that modern distros are too big for vendors (Redhat/Fedora, Canoncial) to be able to properly support all the apps people want - and more importantly - will hold them legally liable if they get hacked via an infected app update... Making them snap/flatpak/etc allows vendors to push ownership back to the group/sole-developer who develops it and any legal liability is "cleanly" theirs. There's a global push to make vendors legally responsible for their software and this must be making all Linux distros nervous about their own liability for the literally thousands of wee apps that make up their distro. Such law changes are good from a consumer perspective - but the impact on open source is a pain point.

ding! And notice how the snap marketing/feature list includes how snaps are more secure because of sandboxing, and then you discover almost every snap you want to use has to be installed in "--classic" mode - which basically removes most of the protection... And currently I'm looking at reinstalling because my logs are full of apparmor=DENIED that I cannot figure out (and I've tried...) - starting to make SELinux look good(!)

Let me answer this question by pointing out how popular it is for Ransomware crews (once they hack one workstation) to hack vCenter in order to ransomware all virtual servers in one hit, bypassing all security measures within those virtuals. So it's only just a matter of time before ProxMox sees the same scale of problem. So yes, firewall off the management interfaces via whatever works for you (hell, they are Linux systems - you could always firewall them using iptables/netfilter) - limiting access down to only a few internal systems/or a management vpn/whatever

Yup, now it's "just" an issue over in post office accounting software - I think Fujitsu caused more deaths too? (13 suicides)

We just celebrated Matariki on July 10th here in New Zealand. It's a national holiday: the Maori New Year (the New Year begins when the "seven sisters"/Pleiades rises anew in NZ/Aotearoa)

Do you know why I like tea? 

Yup - just reposted today too: https://www.reddit.com/r/interesting/comments/1u1ib63/in_a_japanese_zoo_the_gorilla_kiyomasa_gets_into/

Firewall logs have real value forensically (if you can swallow the expense of logging allowed AND denied connections). But don't expect to detect actionable events unless you have a very locked down/understood environment. As others said, endpoint agents are way more useful in that space. But just to contradict myself, we actually use our firewall logs to realtime alert on unexpected outbound connections from certain IoT devices, like vcenter, esxi, etc. they can be strongly profiled. Ie make an exclusion list and then alert on everything else

I'm in Cyber and only tangentially involved with CorpIS's Intune environment, but feel your pain as it does seem pretty useless. What makes it double useless is that we are a crowdstrike customer and we/Cyber have made RTR scripts that run 4 times per day on all 300000 assets we have, and on 24x7 servers, they indeed run 4 times. So how can a non-MDM company write a better MDM than Microsoft? (/S)

it could be argued the first "nuclear event" on Earth was actually 1.7 billion years ago...