Kategori: Remediation Guides
How to Fix “Ensure lockout for failed password attempts is configured” with pam_faillock
Ensure lockout for failed password attempts is configured is a CIS Linux benchmark check that fails when PAM does not lock an…
DNSSEC NSEC Records (Nessus 59959): How to Stop Zone Walking with NSEC3
The Nessus finding DNSSEC NSEC Records (plugin 59959) means your signed zone answers negative queries with NSEC records. Those records link real…
DMARC Record Setup: Fixing “Ensure DMARC Records for All Exchange Online Domains Are Published”
The “Ensure DMARC Records for all Exchange Online domains are published” finding means a mail domain has no DMARC policy at _dmarc.<domain>,…
Content Security Policy Header Not Set: How to Configure CSP and Clear the Finding
A “content security policy header not set” finding means your web server returns HTML pages without a Content-Security-Policy header, so the browser…
Running Containers as Root User Should Be Avoided: How to Fix It in Docker, Kubernetes and ECS
“Running containers as root user should be avoided” is a hardening finding raised when a Kubernetes pod, Dockerfile or ECS task definition…
Ensure AIDE Is Installed: How to Fix the CIS Linux AIDE Finding
“Ensure AIDE is installed” is a CIS Benchmark check that fails when the AIDE file integrity tool is missing from a Linux…
SNMP Agent Default Community Name (public): How to Find and Fix It
The SNMP Agent Default Community Name (public) finding means a device answers SNMP requests that use the default community string “public”, which…
.env File Exposed: How to Fix “Environment Configuration File Detected”
“Environment Configuration File Detected” means a scanner fetched your application’s .env file over HTTP. A .env file exposed this way can hand…
ICMP Timestamp Request Remote Date Disclosure: How to Block ICMP Types 13 and 14
ICMP Timestamp Request Remote Date Disclosure (CVE-1999-0524, Nessus plugin 10114) means a host answers ICMP type 13 timestamp requests with its current…
How to Fix an Exposed .git Directory (Git Repository Served by Web Server)
“Git Repository Served by Web Server” means a scanner downloaded files from your site’s .git directory, which can let anyone rebuild your…