Security

Running OSV-Scanner on this blog's own GitHub repository: the first command found nothing to scan, the second found 8 issues that mostly do not matter, and the library I most needed to fix never appeared in the report. How I set it up, how I fixed it, and where things stand.

Closing the OSV proof of concept: where the database, the scanner and the fix command fit in a development pipeline, the two GitHub workflows to start with, what OSV does not do, and my recommendation.

Proof of concept: let OSV-Scanner fix the vulnerable Node project. The safe in-place strategy fixed 7 of 50; the relax strategy fixed all 50 by changing three lines, two of them breaking upgrades. What each strategy does, why the numbers differ, and how to use it without getting burned.

Proof of concept: install OSV-Scanner v2.7.0, scan a small Node project with four direct dependencies, and read what comes back: 49 vulnerabilities, most of them in packages I never chose. Plus exit codes, JSON output and an ignore file with an expiry date.

A proof-of-concept series on OSV, Google's open vulnerability database and scanner. Part 1: the problem OSV solves, how to navigate osv.dev, how to read a vulnerability record, and the one API call worth knowing.

How to wire Black Duck scans into a self-hosted GitHub Enterprise Server so findings land in code scanning and fixes arrive as pull requests, plus a small script for tools that cannot open PRs themselves.

Decoded what the attackers planted, wrote alt text for 103 images, and started a guide to moving to Hugo.

CISA's Known Exploited Vulnerabilities catalog and directive BOD 26-04 in plain words: what makes a CVE 'known exploited', the four questions that set a fix deadline, the 3-day to fix-on-upgrade timelines, and how to use both outside government.

A six-year-old WordPress blog was compromised. What the attack looked like, and the first hours of triage.

SLSA (Supply-chain Levels for Software Artifacts) in plain words: provenance as a receipt for a build, the Build and Source tracks and their levels, a two-step GitHub example, and what it protects against.

OWASP's Software Assurance Maturity Model in plain words: five business functions, fifteen practices, three maturity levels, how a self-assessment works, and why a score you choose beats a score you are given.

The first full database dump: every one of my posts now belonged to an account registered in 1970.

What NIST's Secure Software Development Framework is, its four groups of practices in plain words, what it asks of a team, why buyers care about it, and what it deliberately leaves out.

A short introduction to MITRE ATT&CK for people who build software: how to read an ID like T1552.001, the 15 Enterprise tactics in v20 (including the new Stealth and Defense Impairment), a cheat card for each, and how developers can use it.

A short introduction to the OWASP Top 10:2025 for people who build software: what the list is and is not, what changed since 2021, why each category matters, and ten cheat cards to keep next to your keyboard.

The old WordPress site was compromised. Taking it offline was the first step.

A fake administrator, 20 plugins switched off in one second, and a hidden loader planted to stay.

21 successful logins, and the first of 55 spam posts published on my blog.

The first successful logins of the break-in. My reused password had found its way to the wrong people.

165 wrong passwords in one day. The busiest day for password guessing the old blog ever logged.

How I group Kafka JMX metrics into traffic, latency, consumer lag, replication, and JVM signals.

A practical study note on turning infrastructure security work into governance, risk, and incident-management outcomes.

Broker-level controls for a safer Kafka deployment, from service accounts and filesystems to monitoring and recovery.

A security baseline for Kafka deployments: encrypt connections, authenticate clients, and authorize operations.

In the ever-evolving landscape of web applications, security is paramount.

At a raw level Keystore and truststore are both used for managing digital certificates and keys in the context of SSL/TLS (Secure Sockets Layer/Transport Layer Security) and other security protocols.

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards established to protect cardholder data and maintain a secure environment for payment card transactions.

DAST stands for Dynamic Application Security Testing. It is a type of security testing that assesses the security of an application while it is running.

XML entity attack, also known as Billion Laughs Attack, is a type of security vulnerability that exploits the way XML parsers handle entity expansion.

X.509 certificates have become a fundamental component of secure communication on the internet. They provide authentication, encryption, and integrity for various applications and protocols.

CURL is a command-line tool that allows developers to transfer data between servers and clients using various protocols, including HTTP and HTTPS.

In Apache Kafka, trust store and keystore are essential components for ensuring secure communication between brokers, clients, and other services.

Secure Socket Layer and its successor TLS (Transport Layer Security) are cryptographic protocols that provide encryption, integrity, and authentication for network communication.

The SSL/TLS handshake is the initial communication between the client and server in a SSL/TLS connection.

PKI is the core of security for most organizations, and at its heart is a couple of keys that together allows the encryption/decryption of the traffic exchanged.

I was struggling with the mTLS configuration for zookeeper configuration and somehow no matter what I do I kept getting an error as below

To enable and configure monitoring of Java VM for any java-application using the ready-to-use JMX agent, you must set certain system properties when you start the Java VM.

A common use-case for cert-manager is requesting TLS signed certificates to secure your ingress resources.

I recently gave CISM and I believe it is easily crackable. For those who are pursuing this certification the mantra is similar (or at least the one that I followed)

Rules that run the organisation = Governance.

What is OAuth? # From the official definition It is protocol for Authorization It allows authorization flows for web applications, desktop applications, mobile apps etc.

# Standards # Standards are tactical documents that define steps or methods to accomplish the goals and overall direction defined by the security policies.

I just finished my upgrade to Safe Certification and now will be going for CISSP certification. Wish my luck guys! Some quotes # Effective security plans anticipates change, focuses on specific and achievable objectives, potential problems, and serves as the basis of decision making. Operational plans are the shortest and most frequently updated Tactical plans are mid term plans and supports strategical plans. Strategic plans are the long term plans (usually 5 years) and usually includes risk assessment. Data classification is the primary means by which data is protected based on its need for secrecy, sensitivity and confidentiality. Data classification is the process of organizing objects, subjects, items into groups of similarities (value, cost, vulnerability, risk, power, privilege) Stratify the process of organizing and securing data based on assigned labels of importance and sensitivity. Data classification also addresses how data is removed and destroyed. Security policy is used to assign responsibilities, define acceptable risks, define roles, specify audit requirements and indicate compliance. Security policy are not optional rather mandatory. Three types of security policies are regulatory, advisory and informative.

What is an identity? # Identity is the link that correlates the subject and the authentication process. Without a valid identity the system has no way of establishing who the subject is? Identity enables the subject to be identified and validated, and only once it has been established and authorized it is accountable for any actions taken in the system.

Previously I talked about files, encoding in golang. In this LTD (learn to do) I will talk about hash package in general. https://blog.samarthya.me/wps/2021/01/30/golang-encoding/ Help # https://golang.org/pkg/hash/#Hash https://golang.org/pkg/crypto/#Hash.New https://golang.org/src/crypto/crypto.go?s=364:378#L6 https://golang.org/pkg/crypto/#pkg-subdirectories Package crypto collects common cryptographic constants. — Official golang documentation const ( MD4 Hash = 1 + iota // import golang.org/x/crypto/md4 MD5 // import crypto/md5 SHA1 // import crypto/sha1 SHA224 // import crypto/sha256 SHA256 // import crypto/sha256 SHA384 // import crypto/sha512 SHA512 // import crypto/sha512 MD5SHA1 // no implementation; MD5+SHA1 used for TLS RSA RIPEMD160 // import golang.org/x/crypto/ripemd160 SHA3_224 // import golang.org/x/crypto/sha3 SHA3_256 // import golang.org/x/crypto/sha3 SHA3_384 // import golang.org/x/crypto/sha3 SHA3_512 // import golang.org/x/crypto/sha3 SHA512_224 // import crypto/sha512 SHA512_256 // import crypto/sha512 BLAKE2s_256 // import golang.org/x/crypto/blake2s BLAKE2b_256 // import golang.org/x/crypto/blake2b BLAKE2b_384 // import golang.org/x/crypto/blake2b BLAKE2b_512 // import golang.org/x/crypto/blake2b ) Let’s try out a simple MD5 hasher.

Security space is an ever evolving. It never stays stagnant; everyday you see a new exploit, a new hack. As an individual, you may have Antivirus installed on your system, Firewall - UP, ports blocked yet you are not free from threat

It is a short howto guide which shall talk about adding a LDAP realm to an Elasticsearch 7.6.2 cluster. Realms # It is a concept not alien to IDAM professionals. In simple words it is a system that allows you to authenticate and authorize an incoming request. It will define the entity USER, that may include at a bare minimum (not limited to)

In this blog we will try to setup a realm for elastic authentication. yum -y install openldap-clients openldap-servers mymachine>systemctl start slapd mymachine>systemctl enable slapd Created symlink from /etc/systemd/system/multi-user.target.wants/slapd.service to /usr/lib/systemd/system/slapd.service. mymachine>slappasswd New password: Re-enter new password: {SSHA}R5nPS+zItZsQrfsw+PIQSNnEiMpLcwLs mymachine>vi /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 975a66fa dn: olcDatabase={2}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=my-domain,dc=com olcRootDN: cn=Manager,dc=my-domain,dc=com olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub structuralObjectClass: olcHdbConfig entryUUID: 64a2a5de-3438-103a-8e85-c1c4cc3ef35f creatorsName: cn=config createTimestamp: 20200527073533Z entryCSN: 20200527073533.541185Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20200527073533Z mymachine>firewall-cmd --add-service=ldap success mymachine>vi ldaproot.ldif dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}R5nPS+zItZsQrfsw+PIQSNnEiMpLcwLs mymachine>ldapadd -Y EXTERNAL -H ldapi:/// -f ldaproot.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={0}config,cn=config" mymachine>cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG mymachine>chown -R ldap:ldap /var/lib/ldap/DB_CONFIG mymachine>systemctl restart slapd mymachine>ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=cosine,cn=schema,cn=config" mymachine>ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=nis,cn=schema,cn=config" mymachine>ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=inetorgperson,cn=schema,cn=config" vi ldapdomain.ldif dn: olcDatabase={1}monitor,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=samarthya,dc=com" read by * none dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=samarthya,dc=com dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=Manager,dc=samarthya,dc=com dn: olcDatabase={2}hdb,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}R5nPS+zItZsQrfsw+PIQSNnEiMpLcwLs dn: olcDatabase={2}hdb,cn=config changetype: modify add: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=samarthya,dc=com" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=Manager,dc=samarthya,dc=com" write by * read mymachine>ldapmodify -Y EXTERNAL -H ldapi:/// -f ldapdomain.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={1}monitor,cn=config" modifying entry "olcDatabase={2}hdb,cn=config" modifying entry "olcDatabase={2}hdb,cn=config" modifying entry "olcDatabase={2}hdb,cn=config" modifying entry "olcDatabase={2}hdb,cn=config" mymachine>vi baseldapdomain.ldif dn: dc=samarthya,dc=com objectClass: top objectClass: dcObject objectclass: organization o: samarthya com dc: samarthya dn: cn=Manager,dc=samarthya,dc=com objectClass: organizationalRole cn: Manager description: Directory Manager dn: ou=People,dc=samarthya,dc=com objectClass: organizationalUnit ou: People dn: ou=Group,dc=samarthya,dc=com objectClass: organizationalUnit ou: Group mymachine>ldapadd -x -D cn=Manager,dc=samarthya,dc=com -W -f baseldapdomain.ldif Enter LDAP Password: adding new entry "dc=samarthya,dc=com" adding new entry "cn=Manager,dc=samarthya,dc=com" adding new entry "ou=People,dc=samarthya,dc=com" adding new entry "ou=Group,dc=samarthya,dc=com" dn: cn=Manager,ou=Group,dc=samarthya,dc=com objectClass: top objectClass: posixGroup gidNumber: 1009 ldapadd -x -W -D "cn=Manager,dc=samarthya,dc=com" -f ldapgroup.ldif Enter LDAP Password: adding new entry "cn=Manager,ou=Group,dc=samarthya,dc=com" mymachine>useradd samarthya mymachine>passwd samarthya Changing password for user samarthya. mymachine>ldapadd -x -D cn=Manager,dc=samarthya,dc=com -W -f ldauser.ldif Enter LDAP Password: adding new entry "uid=samarthya,ou=People,dc=samarthya,dc=com" dn: uid=samarthya,ou=People,dc=samarthya,dc=com objectClass: top objectClass: account objectClass: posixAccount objectClass: shadowAccount cn: samarthya uid: samarthya uidNumber: 1005 gidNumber: 1005 homeDirectory: /home/samarthya userPassword: {SSHA}R5nPS+zItZsQrfsw+PIQSNnEiMpLcwLs loginShell: /bin/bash gecos: samarthya shadowLastChange: 0 shadowMax: 0 shadowWarning: 0 Installing phpLdap # yum install php-ldap php-mbstring php-pear php-xml https://www.digitalocean.com/community/tutorials/how-to-install-linux-nginx-mysql-php-lemp-stack-on-centos-7

Kibana is an effective way of managing users; but as a programmer you always need an API. It helps to integrate with other applications you are building Quick and clean way without any cosmetics > GET /_security/_authenticate HTTP/1.1 > Host: myserver.elastic.node:9200 > Authorization: Basic ABCDEFGHIJKLMNOP== > User-Agent: insomnia/7.1.1 > Accept: */* < HTTP/1.1 200 OK < content-type: application/json; charset=UTF-8 < content-length: 236 * Received 236 B chunk * Connection #2 to host myserver.elastic.node left intact GET https://myserver.elastic.node:9200/_security/_authenticate I have added basic authentication to quickly check

So continuing from the last blog where I wrote a crude version of SimpleCipher and was inclined on removing the duplicate code, here I am with the improved version. Handy links # [fmt](https://golang.org/pkg/fmt/) package [strings](https://golang.org/pkg/strings/) package. Defining types # While I compiled and unit tested code the general feeling was what can be optimized.

Hello back again, Golang is just a new syntax for me. Even though behind the scenes they developers have simplified many things, for a consumer like me writing a program is more about learning the new syntax and getting familiarized with the control and stack.

In this post I will try to enable security for the elasticsearch cluster. It would be simply penned as a sequence of steps you need to follow to enable security as part of the cluster.

Data is key to any analytics, and if it can be organized, normalized and made available for correlated analysis, the results will be more concise. Elastic.co has a SIEM UI and the XPack security pack that helps the new age security analysts.

All right, its been a busy week and finally some time at hand to write about something I have been doing.

Security is integral to every and all the tasks in a shared environment.

* Header image from Elastic.co As we move towards the micro-service/container economy where there are heaps of products available in form of applications to be downloaded & installed on primarily two platforms Android and IOS, we just cant underline the security implications enough.

I have a small problem at hand which girdles around learning Angular, with a Spring enabled Rest endpoints which uses a DB to store data and have security layer in between that should interact with a…