Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you may not be able to execute some actions.

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

How can you validate that registries.yaml is set properly?

A
amarantha last edited by
I've set up my /etc/rancher/k3s/registries.yaml, how can I confirm it works without doing
```
k3s kubectl run c1 --image docker.io/perl:5.30
k3s kubectl logs --follow=true c1
sleep 1
k3s kubectl delete pod c1
```
Is there a more efficient way to test registry authentication for images than having to use k3s run?
Reply Quote 0
1 Reply Last reply
C
courtlanda last edited by
The /etc/rancher/k3s/registries.yaml is read by https://devops.stackexchange.com/q/16152/18965 . You can validate it works properly with a command like this,
```
sudo k3s crictl pull     docker.io/alpine:3
sudo k3s ctr images pull docker.io/library/alpine:3
```
Reply Quote 0
1 Reply Last reply

2
Posts

0
Views

Suggested Topics

C

Swift в Authentication in the annex on sms
Software Programming • authentication swift sms token • • courtlanda

2

0
Votes

2
Posts

0
Views

I keep my application file with help. NSUserDefaults♪ Read:let preferences = NSUserDefaults.standardUserDefaults() let currentLevelKey = "currentLevel" if preferences.objectForKey(currentLevelKey) == nil { // Doesn't exist } else { let currentLevel = preferences.integerForKey(currentLevelKey) } record:let preferences = NSUserDefaults.standardUserDefaults() let currentLevelKey = "currentLevel" let currentLevel = ... preferences.setInteger(currentLevel, forKey: currentLevelKey) if !didSave { // Couldn't save (I've never seen this happen in real world testing) } https://freakycoder.com/ios-notes-28-how-to-use-userdefaults-sharedpreferences-b52becd4f858 using NSUserDefaults straight for token storageUse = memory reading (see above)The decision to open a certain screen as you rightly made it possible to be implemented through a contingent operator. Check the key in memory and if the key is in place, move on (see above)
Login form authentication logic
Security, Penetration Testing • authentication bc languagerypt • • morde

2

0
Votes

2
Posts

0
Views

J

Some attacks to think about: Tricking the failed_logins by clearing your session id. Enumerating accounts by trying to lock out existing accounts. DoSing administrative accounts by locking them out with failed login attempts. Enumerating login names with the forgotten password feature or with registration, or insecure direct object reference. Spoofing your ip address by supply a x-forwarded-for http header element. Broken session management: Session Riding (CSRF), Session Expiration, Session Fixation, Problems with Cookie Domain/Folder Scope, Storing Session ID's in plain text in the database, Insufficient entropy in session ids. Not setting the "secure" and "HTTPOnly" flags. Clickjacking. OWASP A9... Did I miss anything? YES
A

What is the proper flow for authentication?
Security, Penetration Testing • authentication authorization oauth2 openid connect • • authera

2

0
Votes

2
Posts

1
Views

K

The way you described your problem indicates, that oauth is not what you are looking for. Oauth is used to allow your users to use their credentials from a different entity (identity provider) to log in to your application and to access user data from the idp. The idp and the application that uses the idp are two different entities (e.g. two different companies). So for example: on honeypot.io i use my github username and password. Honeypot forwards me to the github idp. I log in and grant honeypot access to my user information (name email etc). The github idp forwards me to honeypot again with an access token und honeypot.io gets my user data along with the guarantee that i own that account. Honeypot will then create an account for me with my github data. If there is only one party involved (your case) you dont need an idp and no oauth. Depwnsing on the concrete use cases you might just want to allow accounts to use multiple usernames, which would be a simple array / list.
S

Benefits to client-side password hashing on top of other security mechanisms
Security, Penetration Testing • authentication passwords hash client side • • Saumya

2

0
Votes

2
Posts

0
Views

G

Besides @Sefa already providing a great read, there is a benefit in the sense that if the server is malicious and doesn't salt+hash your password (or an admin intercepts the traffic) and you are foolish enough to use the same password on many sites, salting and hashing your password client side will prevent a malicious server from stealing your password on other sites. Besides this scenario I cannot think of any use of client side hashing when combined with TLS and strong server side salted hashing on a trusted server.
E

Which server to set up for distribution of windows based application updates, patches and upgrades?
Continuous Integration and Delivery (CI, CD) • installation upgrade • • elysha

2

0
Votes

2
Posts

1
Views

I recommend Chocolatey. There are more and more companies that are adopting this. For example, if one would like to install Gradle and navigates to the installation page: Chocolatey is “the package manager for Windows”. $ choco install gradle
E

IIS client certificates: do I need client certificates mappings?
Security, Penetration Testing • authentication certificate iis • • elysha

2

0
Votes

2
Posts

0
Views

G

Under the mapping, you can map individual users to tokens which can then have permission to see things or do tasks (Admins, Personnel, Customers, etc). Without that you're just testing to see if a user has a valid certificate regardless of who he is. You can authenticate the users further using mechanisms like form authentication but the mapping can automate this task for you.
A

Use K8s Deployment Hostname In YAML Config
Continuous Integration and Delivery (CI, CD) • kubernetes • • Amritpal

2

0
Votes

2
Posts

1
Views

My idea of where the hostname was coming from was wrong. According to the docs: Every Service defined in the cluster (including the DNS server itself) is assigned a DNS name. and Currently when a pod is created, its hostname is the Pod’s metadata.name value. So the hostname is actually the name of the service. The last sentence in my question says I did not change the service in anyway. That was an unintentional lie. I did change the service name, or else selenium-hub as the hostname would have worked. Changing HUB_PORT_4444_TCP_ADDR to the .metadata.name of the service got me closer. The connection was timing out, though. I believed some of the configuration was wrong in my service yaml. So instead of using my yaml file, I created the service via: kubectl expose deployment ``` This created a service and I checked the selenium-hub and the node was finally connected. So there was an issue in my service yaml. To get the correct configuration I exported the currently working service: kubectl get svc -o yaml --export I copied the exported configuration to my service yaml file and it also worked. Here was the difference between the service yamls old yaml (copied from GitHub example above) --- apiVersion: v1 kind: Service metadata: name: selenium-hub-service labels: app: selenium-grid spec: ports: - port: 4444 targetPort: 4444 protocol: TCP ------------- [added in new config] name: port0 ------------- [deleted in new config] selector: app: selenium-hub type: NodePort ------------- [deleted in new config] sessionAffinity: None I am not sure why adding .spec.ports[0].protocol and deleting .spec.type and .spec.ports[0].name fixed the issue. If anyone could clarify in the comments I would appreciate it.
A

Where do I set that agent certificate for Puppet on Amazon Linux?
Continuous Integration and Delivery (CI, CD) • dns puppet • • Amritpal

2

0
Votes

2
Posts

1
Views

T

On the agent I needed to set the server ip set to puppet in /etc/hosts I had accidentally put it on the agents ip address and then been incorrectly assuming i'd done something wrong on the master rather than the agent. (server ip) (domian name) puppet
M

How to create Chef Package for Redhat. I have 2 rpms agents and 2 yaml files
Continuous Integration and Delivery (CI, CD) • automation chef • • meriah

2

0
Votes

2
Posts

1
Views

S

Very basic recipe exemple to install filebeat on ubuntu (I do use more or less the same approach for elasticsearch, kibana and logstash): apt_repository 'elk' do uri 'https://artifacts.elastic.co/packages/5.x/apt' distribution 'stable' components ['main'] key 'https://artifacts.elastic.co/GPG-KEY-elasticsearch' cache_rebuild true end package 'filebeat' do action :upgrade # To keep up to date with releases from elastic.co end service 'filebeat' do action [:enable, :start] end template '/etc/filebeat/filebeat.yml' do source 'filebeat.yml.erb' mode '0600' notifies :restart, 'service[filebeat]' end Basically, adding a repository, installing package, enabling and starting the service, render a config and restart the service when it changes. On ubuntu the package set the service scripts so I don't have to manage it here. The template is my default configuration using some node attributes depending on environment. See https://docs.chef.io/resource_template.html for more details on how to use them. According to your question I would strongly sugest you to follow the tutorial paths at https://learn.chef.io to grasp the basics about chef.
C

Preventing Voter Fraud on a Social Media Contest
Security, Penetration Testing • authentication web application fac languageebook oauth twitter • • courtlanda

2

0
Votes

2
Posts

0
Views

M

Rather than logging in to accounts they control, I expect voter fraud would be done by clickjacking or CSRF, harnessing the social viral power of Facebook to attract unwitting accomplices. With the prevalence lately of images on Facebook that claim that you can obtain a PS4 simply by "liking" and "sharing" an image and the sheer numbers of people who do so, I suspect it would be possible to create something similar that tricked Facebook users into signing up to your site and submitting the voting form. Another possibility is that the viral image on Facebook could tell them that they had to sign up and vote for a particular entry in your competition to win the PS4. CSRF has standard mitigation techniques involving nonces, secret keys and MACs. There are mitigation techniques for clickjacking too. Determining that someone is voting in a particular way for a separate reward is more difficult. Probably a job for an A.I. The first referrer header you see from a client may offer a clue as to their motivation. The amount of time they spend evaluating the various voting options might as well. Choose too quickly and it's probably fraud. You will probably get good data out of tracking mouse movements. These techniques would probably work for your original fear of a single person logging in to multiple accounts.
J

What's the weakness of keyed-MD5 for message authentication?
Security, Penetration Testing • authentication hash md5 hmac language • • Jolied

2

0
Votes

2
Posts

0
Views

S

The "keyed MD5" described in RFC 1828 can be summarized as follows: for key K and data D, the MAC value is MD5(K||D||K) (in the RFC, K is first padded to a length multiple of 512 bits, but it does not substantially change things here). To my knowledge, there is no known weakness to that construction, but there is not much security analysis either. HMAC has been designed to provide security when used with a hash function that relies on the Merkle–Damgård construction. It has been proven that IF the inner "compression function" of the hash function acts like a pseudorandom function family, then HMAC is secure. We do not know of any similar security proof for the "keyed hash" construction. In that sense, we believe more in the security of HMAC than in the security of the "keyed hash". If hash functions were "perfect" in a sense that relates to the notion of random oracles, then the keyed hash would be "obviously" secure, like a number of other constructions, e.g. h(K||D). This latter example falls to the length extension attack when the hash function uses the MD construction (which is the case for MD5 but also SHA-1, SHA-256...); this does not directly impact the "keyed hash" from RFC 1828, but is sufficient to demonstrate that MD-based hash functions are not perfect in the sense alluded to above, and thus security of any MAC construction cannot be simply assumed. We need some more details, and with HMAC we have these details. Some extra notes: The "length extension attack" does not contradict the classical security of the hash function, namely resistance to preimages, second preimages and collisions. In particular, SHA-256 and SHA-512 are "believed secure" and yet fall under the scope of the length extension attack. Collisions are not an issue here, and, more generally, are not an issue in constructions that use inputs unknown to the attacker (as is customary for MAC, because of the key). We know how to produce collisions for MD5 very efficiently; but we do not know how to attack HMAC/MD5 or even the "keyed MD5". (It is possible to design a contrived MAC that uses MD5 and is weak because of MD5 collisions, but that's not the case for HMAC nor for the "keyed MD5" we are discussing here.) Conversely, while collisions do not apply to HMAC, the mere existence of efficient methods to compute MD5 collisions demonstrates that the inner compression function of MD5 is not a PRF, and thus the HMAC security proof does not apply to HMAC/MD5. This is a pity since the whole point of using HMAC and not the "keyed hash" is to benefit from the security proof. Take care to note, though, that lack of security proof does not mean that attacks are possible; only that if an attack is found, then it would not contradict the generic HMAC security proof.
How can I get the first part of the API Deployment URL from inside cloud formation template?
Continuous Integration and Delivery (CI, CD) • api aws cloudformation • • Analeea

2

0
Votes

2
Posts

1
Views

R

Did you try the variable ServerlessRestApi? It works for us like this: Outputs: EncryptURL: Description: "Encrypt endpoint URL for Stage environment" Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Stage/encrypt"
A

Why can I build this image from Docker for Mac but not on Docker CE for Ubuntu?
Continuous Integration and Delivery (CI, CD) • docker dockerfile • • Anderson

2

0
Votes

2
Posts

1
Views

J

It is possible that the base image is different on each host. Can you confirm the images for php:5-fpm on each host are identical? If the image from the Mac host is older, try updating it. You may need to update the package name in the dockerfile. If you want to preserve the same behavior on your newer host, make sure you are pulling the image with the same hash or version-specific tag. It’s quite possible the newer version of the php image is on a newer version of Ubuntu. The package name may have changed between repos.
How can I use Docker Hub in Terraform?
Continuous Integration and Delivery (CI, CD) • docker terraform • • Analeea

2

0
Votes

2
Posts

1
Views

P

This can be done with docker_registry_image: data "docker_registry_image" "ubuntu" { name = "ubuntu:latest" } resource "docker_image" "ubuntu" { name = "${data.docker_registry_image.ubuntu.name}" pull_triggers = ["${data.docker_registry_image.ubuntu.sha256_digest}"] }
How can I find the INSTANCE_ID from a provisioned machine?
Continuous Integration and Delivery (CI, CD) • openstack • • emmalee

2

0
Votes

2
Posts

0
Views

P

You can find the INSTANCE_ID, by looking in this file, /var/lib/cloud/data/instance-id

How can you validate that registries.yaml is set properly?

Suggested Topics

Swift в Authentication in the annex on sms Software Programming • authentication swift sms token • • courtlanda

Login form authentication logic Security, Penetration Testing • authentication bc languagerypt • • morde

What is the proper flow for authentication? Security, Penetration Testing • authentication authorization oauth2 openid connect • • authera

Benefits to client-side password hashing on top of other security mechanisms Security, Penetration Testing • authentication passwords hash client side • • Saumya

Which server to set up for distribution of windows based application updates, patches and upgrades? Continuous Integration and Delivery (CI, CD) • installation upgrade • • elysha

IIS client certificates: do I need client certificates mappings? Security, Penetration Testing • authentication certificate iis • • elysha

Use K8s Deployment Hostname In YAML Config Continuous Integration and Delivery (CI, CD) • kubernetes • • Amritpal

Where do I set that agent certificate for Puppet on Amazon Linux? Continuous Integration and Delivery (CI, CD) • dns puppet • • Amritpal

How to create Chef Package for Redhat. I have 2 rpms agents and 2 yaml files Continuous Integration and Delivery (CI, CD) • automation chef • • meriah

Preventing Voter Fraud on a Social Media Contest Security, Penetration Testing • authentication web application fac languageebook oauth twitter • • courtlanda

What's the weakness of keyed-MD5 for message authentication? Security, Penetration Testing • authentication hash md5 hmac language • • Jolied

How can I get the first part of the API Deployment URL from inside cloud formation template? Continuous Integration and Delivery (CI, CD) • api aws cloudformation • • Analeea

Why can I build this image from Docker for Mac but not on Docker CE for Ubuntu? Continuous Integration and Delivery (CI, CD) • docker dockerfile • • Anderson

How can I use Docker Hub in Terraform? Continuous Integration and Delivery (CI, CD) • docker terraform • • Analeea

How can I find the INSTANCE_ID from a provisioned machine? Continuous Integration and Delivery (CI, CD) • openstack • • emmalee

Swift в Authentication in the annex on sms
Software Programming • authentication swift sms token • • courtlanda

Login form authentication logic
Security, Penetration Testing • authentication bc languagerypt • • morde

What is the proper flow for authentication?
Security, Penetration Testing • authentication authorization oauth2 openid connect • • authera

Benefits to client-side password hashing on top of other security mechanisms
Security, Penetration Testing • authentication passwords hash client side • • Saumya

Which server to set up for distribution of windows based application updates, patches and upgrades?
Continuous Integration and Delivery (CI, CD) • installation upgrade • • elysha

IIS client certificates: do I need client certificates mappings?
Security, Penetration Testing • authentication certificate iis • • elysha

Use K8s Deployment Hostname In YAML Config
Continuous Integration and Delivery (CI, CD) • kubernetes • • Amritpal

Where do I set that agent certificate for Puppet on Amazon Linux?
Continuous Integration and Delivery (CI, CD) • dns puppet • • Amritpal

How to create Chef Package for Redhat. I have 2 rpms agents and 2 yaml files
Continuous Integration and Delivery (CI, CD) • automation chef • • meriah

Preventing Voter Fraud on a Social Media Contest
Security, Penetration Testing • authentication web application fac languageebook oauth twitter • • courtlanda

What's the weakness of keyed-MD5 for message authentication?
Security, Penetration Testing • authentication hash md5 hmac language • • Jolied

How can I get the first part of the API Deployment URL from inside cloud formation template?
Continuous Integration and Delivery (CI, CD) • api aws cloudformation • • Analeea

Why can I build this image from Docker for Mac but not on Docker CE for Ubuntu?
Continuous Integration and Delivery (CI, CD) • docker dockerfile • • Anderson

How can I use Docker Hub in Terraform?
Continuous Integration and Delivery (CI, CD) • docker terraform • • Analeea

How can I find the INSTANCE_ID from a provisioned machine?
Continuous Integration and Delivery (CI, CD) • openstack • • emmalee