Install Gitlab, HTTPS and the container registry
Posted by Gary Williams on May 22, 2018

wp-image-8700

For those of you who haven’t come across Gitlab or maybe even those of you who have but think it’s something that only developers use then I’d like to dispel that because Gitlab is a fantastic repository for scripts of all shapes and sizes. Not only that but from Gitlab 8.8 and up, it is possible to enable the Gitlab docker registry which allows Gitlab to also be a target for images created for docker. Overall, it is quite a powerful tool with more than one trick up its digital sleeve.

(more…)

Demystifying HTTPS
Posted by Gary Williams on March 15, 2018
Tags: , ,

Security Report Summary A+

In my time in IT I’ve installed certificates quite a few times on various web servers and into various applications but it’s really only in the past two years that I’ve started looking into HTTPS and the myriad of options that come with certificates which are often hidden deep into config files but yet can make the difference between a site that can be rendered vulnerable via a HTTPS downgrade attack or one that is actually secure because today, installing a cert is simply the tip of the iceberg so I thought it might be handy to go through the options that need to be set in a web servers config file in order to get A+ on both the Qualys and securityheaders.io web servers.

This blog is going to be all about the secure certificate side of things, by setting these headers you reduce the chances of certain types of probes and attacks from being successful. The server itself and whatever applications you are running on it still need to be upgraded and configured to reduce the chances of someone gaining unauthorised access to your systems.

(more…)

Configuring SharePoint 2016 App Catalog
Posted by Mikhail Rodionov on April 6, 2017

In my previous blog post, I covered SharePoint 2016 installation process, my next logical step after that was to configure SharePoint app catalog so that I can add K2 for SharePoint app and as I covered this process earlier on my personal blog, I expected this to be a small task. Indeed, I had created it following steps from my old blog post in just minutes, but, alas, I run into loads of warnings while running K2 for SharePoint AppDeployment.exe. I sorted most of them but after seeing extra warnings telling me that additional configuration is required just because I’m using HTTP instead of HTTPS I decided that it is better to re-create my app catalog using HTTPS.

App deployment configuration analysis

(more…)

HTTPS sites are threatened by a new low-cost decipher attack
Posted by Oksana Zybinskaya on March 7, 2016
Tags: , ,

TLS
A new low-cost attack that decrypts sensitive communications in neglectable time has been discovered recently. The attack works against TLS-protected communications using RSA cryptosystem which expose the key through SSLv2, which was retired two decades ago due to vulnerabilities, but still may be supported by some service due to legacy compatibility reasons or misconfigured TLS implementations.

(more…)