Kategori: Remediation Guides
How to Fix Apache Server ETag Header Information Disclosure (Nessus 88098)
Apache Server ETag Header Information Disclosure means Apache builds the ETag header for static files from each file’s inode number as well…
How to Fix AD Accounts Whose Passwords Never Expire
AD Starter Scan – Non-Expiring Account Password (Nessus plugin 150483) means enabled Active Directory accounts carry the “Password never expires” flag, so…
How to Fix CVE-2023-46604: Apache ActiveMQ OpenWire Remote Code Execution
CVE-2023-46604 is a critical remote code execution flaw in the Java OpenWire protocol marshaller used by Apache ActiveMQ Classic. Anyone who can…
Windows Firewall Domain Firewall State On: How to Fix the CIS Finding for All Profiles
“Ensure ‘Windows Firewall: Domain: Firewall state’ is set to ‘On (recommended)'” is a CIS benchmark check that fails when policy does not…
LocalAccountTokenFilterPolicy: How to Apply UAC Restrictions to Local Accounts on Network Logons
LocalAccountTokenFilterPolicy is the registry value behind the CIS check “Apply UAC restrictions to local accounts on network logons”. When it is 1,…
EnableLUA: How to Fix ‘Run All Administrators in Admin Approval Mode’ (CIS 2.3.17.6)
EnableLUA is the registry value behind the CIS check “User Account Control: Run all administrators in Admin Approval Mode”. When it is…
Ensure sudo commands use pty: how to fix the CIS finding
Ensure sudo commands use pty is a CIS Linux benchmark check that fails when sudo is not set to run commands inside…
How to Fix “Missing Subresource Integrity” (SRI) Findings on CDN Scripts and Stylesheets
A “Missing Subresource Integrity” finding means a page loads JavaScript or CSS from another origin, typically a CDN, without an integrity attribute,…
How to Enable SQL Server Force Encryption (VA1279 and VA1220)
VA1279, “Force encryption should be enabled for TDS”, means the SQL Server instance does not force TLS on client connections, so any…
How to Fix “Ensure SELinux Is Not Disabled in Bootloader Configuration”
“Ensure SELinux is not disabled in bootloader configuration” is a CIS benchmark check that fails when a GRUB boot entry passes selinux=0…