Kategori: Remediation Guides
SMTP Missing Support For STARTTLS: How to Enable STARTTLS
SMTP Missing Support For STARTTLS is a Greenbone/OpenVAS finding raised when a mail server does not accept the STARTTLS command, so messages…
Redis Server Unprotected by Password Authentication: How to Fix Nessus 100634
Redis Server Unprotected by Password Authentication (Nessus plugin 100634) means a scanner reached a Redis service, usually on TCP 6379, and could…
How to Enforce readOnlyRootFilesystem for Containers (Kubernetes, ECS, Docker)
The finding Immutable (read-only) root filesystem should be enforced for containers means a container runs without readOnlyRootFilesystem, so its processes can write…
OCSP Stapling Not Offered: How to Enable OCSP Stapling in nginx and Apache
“OCSP stapling not offered” means the HTTPS server does not attach a signed OCSP revocation response to its TLS handshake, so clients…
How to Enable MongoDB Authentication (Nessus Plugin 81777)
MongoDB Service Without Authentication Detection (Nessus plugin 81777) means a scanner reached a MongoDB server, usually on TCP 27017, and ran database…
How to Enable MFA for the AWS Root Account and IAM Users (Security Hub IAM.9, IAM.6, IAM.5)
[IAM.9] means the AWS account root user can sign in with a password but has no MFA device, and [IAM.5] flags IAM…
How to Enforce LDAP Signing on Domain Controllers (PingCastle A-DCLdapSign)
PingCastle’s “A LDAP authentication without signature enforcement was allowed” means a domain controller accepts unsigned LDAP binds, which lets an attacker relay…
How to Enable LDAP Channel Binding on Domain Controllers (LdapEnforceChannelBinding)
PingCastle’s “Channel binding is not enabled for all DC for LDAPS” means a domain controller accepts LDAPS logons without an LDAP channel…
AS-REP Roasting Mitigation: Enable Kerberos Pre-Authentication on AD Accounts
The Nessus finding “AD Starter Scan – Kerberos Pre-authentication Validation” means an Active Directory account has “Do not require Kerberos preauthentication” set,…
HSTS Missing From HTTPS Server: How to Enable Strict-Transport-Security on Apache, nginx and IIS
“HSTS missing from HTTPS server” means the web server answers HTTPS requests without a Strict-Transport-Security header, so browsers are never told to…