Defensive Security & Access Management
Hardening, MFA, least privilege, logging and incident readiness.
guys pls help I have a small VPS running a website. Looking at the logs, there are thousands of failed SSH login attempts per day from all over. Nothing seems to have gotten in, but it's unsettling. Right now I log in…
trying to SSH from Windows Terminal into the backup server and i get: Permission denied (publickey)... i added my public key to authorized keys, double checked it's the right one, even regenerated it once.. 🔥 password login is disabled so i can't get in any…
so annoyed rn were a school district and use number matching for MFA today 🤦 After hearing about push bombing attacks, Im wondering whether were as protected as we think. Users approve things without reading, and phishing kits proxy everything anyway. Whats…
hmmmm ok a remote salesperson changed their password on Monday. Since then the account locks right after a password change: we suspect something is still using the old password, but they have a laptop, a phone, a tablet and who knows what else. how do we…
so annoyed rn a remote salesperson changed their password on Monday. since then the account locks every time they open Outlook: we suspect something is still using the old password, but they have a laptop, a phone, a tablet and who knows what else, how do we…
a developer changed their password on Monday. Since then teh account locks every 15 minutes: we suspect smth is still using teh old password, but they have a laptop, a phone, a tablet and who knows what else. how do we narrow it down? Weve already asked them…
ok weird one we need to enable multi factor authentication for all staff at our small business 😭 my worry is the practical side: people getting locked out, teh support load, staff without company phones. Any advice…
long time lurker first post lol the marketing lead changed their password on Monday. Since then the account locks every time they open Outlook: we suspect something is still using teh old password, but they have a laptop, a phone, a tablet and who knows what…
im literally losing my mind here at our 30 person company, every employee has local admin rights on their laptop, and a few people have admin access to teh cloud tenant "cuz it was easier". I know this isnt great, and…
We renewed the certificate on our customer portal yesterday. On my desktop browser everything looks fine. But Android phones now fails with: The certificate isnt expired, teh name matches. Nothing else changed. Why would only some clients complain? ive…
My key works on every other server. On a new EC2 instance, from a CI job, nothing: A colleague set up teh account. They swear they pasted my key. I'm starting to suspect the server, but I don't even know where to look. It's frustrating because I can't see…
help!! we renewed the certificate on our internal API yesterday. on my desktop browser everything looks fine. but curl now fails with: the certificate isn't expired, the name matches... nothing else changed, why would only some clients complain? ive checked…
trying to SSH from WSL2 into a freshly built Ubuntu VM and i get: Permission denied (publickey). I added my public key to authorized keys, double checked its the right one, even regenerated it once... password login is disabled sooo i cant get in any other…
ugh. were a 50 person company and use number matching for MFA today. After hearing about push bombing attacks, Im wondering whether were as protected as we think. Users approve things without reading, and phishing kits proxy everything anyway. Whats a…
CI just broke. The deploy step connects to the backup server and fails with: Nothing changed in the pipeline. The key is stored as a CI secret. This used to work last week, I promise. I suspect a recent client or server update changed something, but I have…
Curious how others handled the move away from SMS codes at a place like a hospital IT department. Who got hardware keys, who stayed on app based approvals, and how did you handle lost devices? I'm also curious about what happens when someone loses their…
im literally losing my mind here we renewed teh certificate on our VPN web login yesterday 😤 on my desktop browser everything looks fine. but an older Windows server now fails with: the certificate isnt expired, teh name matches... nothing else changed. why…
im literally losing my mind here strange one, a developer gets locked out right after a password change, even on days theyre not working: The lockout policy is standard, nohting unusual. It feels like an automated attack, or a forgotten device. How can i…
ok so my key works on every other server. on our Git server, from PuTTY, nothing: A colleague set up the account. They swear they pasted my key. i'm starting to suspect teh server, but i don't even know where to look. its frustrating because i cant see…
so annoyed rn integration patrner says calls from our Java service to our customer portal fail with a certificate error: When I open teh URL in my browser its perfectly fine. Theyre blaming us, were blaming them. Whos right? i dont wanna tell them to disable…
the marketing lead changed their password on Monday. Since then teh account locks every morning at login: We suspect something is still using the old password, but they have a laptop, a phone, a tablet and who knows what else. How do we narrow it down??…
im literally losing my mind here a service desk tech changed their password on Monday. since then the account locks every time they open Outlook: we suspect something is still using the old password, but they have a laptop, a phone, a tablet and who knows…
curious how others handled the move away from hardware security keys at a place like a school district. who got hardware keys, who stayed on app based approvals, and how did you handle lost devices? im also curious about what happens when someone loses their…
ok weird one my key works on every other server. on a new EC2 instance, from a CI job, nothing: A colleague set up teh account. they swear they pasted my key. I'm satrting to suspect the server, but I don't even know where to look. it's frustrating beacuse i…
were a hospital IT department and use authenticator app codes for MFA today. after haering about push bombing attacks, Im wondering whether were as protected as we think. users approve things without reading, and phishing kits proxy everything aynway. whats…
