https://lukehebert.com/category/security/Recent content in Security on Luke HebertHugoen-usThu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/basic-iptables-insert/Thu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/basic-iptables-insert/Learn how to insert iptables rules at a specific position using the -I flag, with syntax breakdown and a practical SSH example.https://lukehebert.com/post/basic-csv-authentication-to-the-api-server/Sat, 16 Aug 2025 00:00:00 +0000https://lukehebert.com/post/basic-csv-authentication-to-the-api-server/Configure HTTP basic authentication on a kubeadm-managed Kubernetes cluster using a CSV credentials file. Covers mounting the file into kube-apiserver, defining RBAC roles, and verifying access with curl.https://lukehebert.com/post/docker-and-container-capabilities/Sat, 16 Aug 2025 00:00:00 +0000https://lukehebert.com/post/docker-and-container-capabilities/An in-depth overview of Linux capabilities and how they govern privilege inside Docker containers and Kubernetes pods. Covers capability sets, file capabilities, bounding sets, securebits, and user-namespace interactions.https://lukehebert.com/post/encrypting-secrets/Sat, 16 Aug 2025 00:00:00 +0000https://lukehebert.com/post/encrypting-secrets/Kubernetes Secrets use base64 encoding rather than true encryption, so their safety depends on surrounding practices like encryption at rest and access controls. This post covers best practices, built-in protections, and alternatives like Helm Secrets or HashiCorp Vault.https://lukehebert.com/post/kubernetes-tls-check-list/Sat, 16 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-tls-check-list/A practical checklist covering X.509 certificate requirements for Kubernetes nodes, users, and the API server. Includes deployment methods, cert-manager workflows, and Extended Key Usage configuration.https://lukehebert.com/post/basic-kerberos-test-class-in-java/Wed, 14 May 2025 00:00:00 +0000https://lukehebert.com/post/basic-kerberos-test-class-in-java/A minimal Java class and JAAS configuration for testing Kerberos authentication in isolation, useful when application-level debugging is too noisy to isolate the problem.https://lukehebert.com/post/myths-about-dev-urandom/Fri, 04 Oct 2024 00:00:00 +0000https://lukehebert.com/post/myths-about-dev-urandom/A practical breakdown of the most common misconceptions about /dev/urandom and /dev/random on Linux, explaining why /dev/urandom is the correct choice for cryptographic randomness and why blocking on low entropy is a usability problem, not a security one.https://lukehebert.com/post/ldap-oid-reference-guide/Wed, 12 Jun 2024 00:00:00 +0000https://lukehebert.com/post/ldap-oid-reference-guide/A comprehensive reference table of common LDAP object identifiers (OIDs) used in schema elements, controls, and extended operations. Each entry includes the OID, its purpose, and a link to the relevant RFC or specification.https://lukehebert.com/post/working-with-multiple-content-security-policy-headers/Thu, 28 Sep 2023 00:00:00 +0000https://lukehebert.com/post/working-with-multiple-content-security-policy-headers/Multiple Content-Security-Policy headers do not combine; the most restrictive one always wins. Learn how to correctly configure CSP in nginx by consolidating directives into a single header.https://lukehebert.com/post/the-beer-drinkers-guide-to-saml-duo-security/Mon, 11 Sep 2023 00:00:00 +0000https://lukehebert.com/post/the-beer-drinkers-guide-to-saml-duo-security/A plain-English walkthrough of how SAML authentication works, using the analogy of buying a beer at a concert. Covers IdP and SP configuration, IdP-initiated vs SP-initiated flows, and practical troubleshooting steps.https://lukehebert.com/post/a-walkthrough-of-a-tls-1.3-handshake/Wed, 10 May 2023 00:00:00 +0000https://lukehebert.com/post/a-walkthrough-of-a-tls-1.3-handshake/A byte-by-byte walkthrough of a TLS 1.3 handshake using OpenSSL’s s_client, comparing each message to its TLS 1.2 counterpart. Highlights how encryption, key exchange, and extensions differ in the latest revision.https://lukehebert.com/post/palo-alto-networks-define-traffic-to-decrypt/Mon, 08 May 2023 00:00:00 +0000https://lukehebert.com/post/palo-alto-networks-define-traffic-to-decrypt/Learn how to use Decryption Policy rules in Palo Alto Networks to define which traffic to decrypt and which to exclude. This guide also covers best practices for blocking QUIC and applying strict security profiles to sensitive traffic categories.https://lukehebert.com/post/how-to-setup-and-secure-unifi-vlan/Fri, 05 May 2023 00:00:00 +0000https://lukehebert.com/post/how-to-setup-and-secure-unifi-vlan/A step-by-step guide to creating and securing VLANs in the UniFi Network Console, including firewall rules to block inter-VLAN traffic and restrict console access.https://lukehebert.com/post/id4262-the-saml-nameidentifier-user-is-of-format-urnoasisname/Tue, 29 Mar 2022 00:00:00 +0000https://lukehebert.com/post/id4262-the-saml-nameidentifier-user-is-of-format-urnoasisname/The ID4262 error occurs when a SAML NameIdentifier uses the entity format but contains an invalid URI. Two resolution steps fix the issue within your identity provider configuration.https://lukehebert.com/post/kerberos-message-stream-modified-41/Fri, 18 Feb 2022 00:00:00 +0000https://lukehebert.com/post/kerberos-message-stream-modified-41/JDK 1.8.0u242 and later introduced Kerberos referral handling per RFC 6806, which can break Active Directory name canonicalization and produce a KRB_AP_ERR_MODIFIED error. This post walks through the two configuration fixes that resolve the issue.https://lukehebert.com/post/the-following-error-occurs-when-restarting-an-apache-server/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/the-following-error-occurs-when-restarting-an-apache-server/A quick fix for the SSL Library Error 185090057 that appears when restarting Apache, caused by a malformed PEM certificate file. Learn how to validate and correct the certificate format to get your server back online.https://lukehebert.com/post/awk-scan-for-wp-login/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/awk-scan-for-wp-login/A quick awk pipeline to pull wp-login.php access attempts from web server logs and flag IPs that exceed a threshold. Useful for spotting brute-force or scanning activity against WordPress sites.https://lukehebert.com/post/decode-certificate-csr/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/decode-certificate-csr/Quick openssl commands to inspect a Certificate Signing Request and an issued X.509 certificate in human-readable form.https://lukehebert.com/post/disable-mod-sec-on-a-domain-htaccess/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/disable-mod-sec-on-a-domain-htaccess/Learn how to turn off ModSecurity for a specific domain or path using a single directive in your .htaccess file. This is useful when a legitimate request is being blocked by the WAF rules.https://lukehebert.com/post/dkim-verification-both-must-be-set-to-on/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/dkim-verification-both-must-be-set-to-on/Exim offers two DKIM-related toggles that work together to validate and enforce sender signatures. Setting both to On ensures your mail server actually checks incoming DKIM records and rejects messages that fail validation.https://lukehebert.com/post/dns-amplifcation-attack/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/dns-amplifcation-attack/A DNS amplification attack floods a victim with forged responses by exploiting open resolvers. This post walks through iptables rules and BIND hardening steps to block the attack vector.https://lukehebert.com/post/https-force-redirect/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/https-force-redirect/A quick Apache mod_rewrite snippet that forces all HTTP traffic to HTTPS, plus context on where to place it and what to watch for.https://lukehebert.com/post/ip-tables-rate-limit-apache/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/ip-tables-rate-limit-apache/A quick way to throttle inbound HTTP traffic to your Apache server using iptables, protecting it from traffic spikes and simple DoS attempts.https://lukehebert.com/post/ip-tables-rate-limit-bad-bots/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/ip-tables-rate-limit-bad-bots/Use iptables string matching and the recent module to drop connections from abusive bots that exceed a request threshold within a short window.https://lukehebert.com/post/mod-rewrite-block-bad-bot/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mod-rewrite-block-bad-bot/A quick Apache mod_rewrite snippet that returns a 403 Forbidden to any request whose User-Agent matches a bot pattern. Drop it into your .htaccess and you are done.https://lukehebert.com/post/mod-qos-tailblock/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mod-qos-tailblock/A lightweight bash script that monitors Apache error logs for repeated access-denied entries and automatically blocks offending IPs via iptables. Useful for quick-and-dirty rate-based blocking without a full WAF.https://lukehebert.com/post/nginx-non-standard-status-silent-connection-close/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/nginx-non-standard-status-silent-connection-close/Nginx status code 444 silently drops a connection without sending any HTTP response to the client. Learn when and how to use it for security and traffic management.https://lukehebert.com/post/reject-with-comment/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/reject-with-comment/A quick iptables one-liner to reject TCP traffic from a specific source IP with a TCP reset, tagged with a human-readable comment for future reference.https://lukehebert.com/post/stop-slow-loris-attacks/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/stop-slow-loris-attacks/Slow Loris attacks tie up web server sockets with trickling requests until legitimate traffic is starved. This post walks through configuring Apache mod_qos to detect and block those connections automatically.https://lukehebert.com/post/structure-of-an-iam-policy/Tue, 18 Jan 2022 00:00:00 +0000https://lukehebert.com/post/structure-of-an-iam-policy/An overview of how AWS IAM policies are structured, including the six policy types and the key elements of a policy document. Learn how to apply the principle of least privilege when defining permissions.https://lukehebert.com/post/golden-ticket-attack/Mon, 15 Nov 2021 00:00:00 +0000https://lukehebert.com/post/golden-ticket-attack/A Golden Ticket attack lets an attacker forge Kerberos tickets and impersonate any user in an Active Directory domain. Learn how the attack works and the concrete steps you can take to defend against it.https://lukehebert.com/post/resetting-ad-krbtgt-password/Fri, 05 Nov 2021 00:00:00 +0000https://lukehebert.com/post/resetting-ad-krbtgt-password/A practical guide to resetting the krbtgt account password in Active Directory, including considerations for external trusts and the Microsoft-provided reset script.https://lukehebert.com/post/kerberos-issue-tracker/Fri, 24 Sep 2021 00:00:00 +0000https://lukehebert.com/post/kerberos-issue-tracker/A quick reference for the MIT Kerberos project issue tracker, where bugs, security advisories, and feature requests for the reference Kerberos implementation are tracked and resolved.https://lukehebert.com/post/aws-arn-structure/Thu, 29 Jul 2021 00:00:00 +0000https://lukehebert.com/post/aws-arn-structure/Every AWS resource is uniquely identified by an Amazon Resource Name (ARN) used in IAM policies, API calls, and resource references. This post breaks down the standard ARN format into its individual components for easy reading and construction.https://lukehebert.com/post/debug-kerberos-gen-credentials-in-cm/Wed, 10 Feb 2021 00:00:00 +0000https://lukehebert.com/post/debug-kerberos-gen-credentials-in-cm/Learn how to enable Kerberos trace logging in Cloudera Manager’s credential generation scripts to diagnose authentication failures quickly.https://lukehebert.com/post/explain-kerberos-like-im-5/Thu, 10 Dec 2020 00:00:00 +0000https://lukehebert.com/post/explain-kerberos-like-im-5/A plain-English walkthrough of how Kerberos authentication works, using a simple analogy to make the ticket-granting process click. Perfect for anyone who has stared at a KDC diagram and felt lost.https://lukehebert.com/post/ldaps-and-unicodepwd/Tue, 01 Dec 2020 00:00:00 +0000https://lukehebert.com/post/ldaps-and-unicodepwd/LDAPS is a hard requirement when setting passwords via unicodePwd on Active Directory. Non-TLS connections are rejected by AD itself, and SASL is not a supported alternative.https://lukehebert.com/post/common-error-codes-for-active-directory-authentication-acceptsecuritycontext/Tue, 24 Nov 2020 00:00:00 +0000https://lukehebert.com/post/common-error-codes-for-active-directory-authentication-acceptsecuritycontext/A quick reference for the LDAP error codes returned during Active Directory bind operations, including what each code means and how to interpret the AcceptSecurityContext error message.https://lukehebert.com/post/cannot-find-key-of-the-appropriate-type-to-decrypt-ap-rep/Tue, 03 Nov 2020 00:00:00 +0000https://lukehebert.com/post/cannot-find-key-of-the-appropriate-type-to-decrypt-ap-rep/A troubleshooting guide for the Kerberos error ‘Cannot find key of the appropriate type to decrypt AP REP,’ covering encryption type mismatches between keytabs and Active Directory, plus practical steps to align AES and RC4 settings.https://lukehebert.com/post/what-is-the-significance-of-the-version-field-in-a-tls-1-1-clienthello-message/Tue, 04 Dec 2018 00:00:00 +0000https://lukehebert.com/post/what-is-the-significance-of-the-version-field-in-a-tls-1-1-clienthello-message/The version field in a TLS ClientHello message tells the server the highest protocol version the client supports, but it appears in three distinct places with different roles. Understanding where and how each version field is used helps troubleshoot handshake failures and interoperability issues with legacy implementations.https://lukehebert.com/post/match-a-tls-certificate-with-its-private-key/Tue, 21 Nov 2017 00:00:00 +0000https://lukehebert.com/post/match-a-tls-certificate-with-its-private-key/Lose track of which private key pairs with which certificate? Use OpenSSL to compare public key hashes and confirm the match in seconds.https://lukehebert.com/post/ldap-server-side-and-client-side-result-error-codes/Tue, 17 Oct 2017 00:00:00 +0000https://lukehebert.com/post/ldap-server-side-and-client-side-result-error-codes/A quick reference for LDAP result and error codes, covering both server-side responses and client-side indicators, including Active Directory-specific sub-codes under error 49.https://lukehebert.com/post/kerberos-encryption-type-by-number-enctype/Thu, 07 Sep 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-encryption-type-by-number-enctype/A quick reference for Kerberos enctype numbers and what they map to, so you can stop guessing which cipher a ticket is actually using.https://lukehebert.com/post/ptr-records/Tue, 05 Sep 2017 00:00:00 +0000https://lukehebert.com/post/ptr-records/A valid PTR record must resolve to a name that resolves back to the original address. Multiple PTR records for a single address break name resolution and can cause Kerberos ticket verification to fail.https://lukehebert.com/post/failure-unspecified-at-gss-api-level-mechanism-level-checksum-failed/Thu, 31 Aug 2017 00:00:00 +0000https://lukehebert.com/post/failure-unspecified-at-gss-api-level-mechanism-level-checksum-failed/A quick reference for the six most common causes of the Kerberos GSS-API checksum failure error, from wrong passwords to time skew and SPNEGO canonicalization issues.https://lukehebert.com/post/crealm-and-srealm-for-java-sun-security-krb5-realm.java-realm-detection-and-pathing/Tue, 22 Aug 2017 00:00:00 +0000https://lukehebert.com/post/crealm-and-srealm-for-java-sun-security-krb5-realm.java-realm-detection-and-pathing/A look at how Java’s built-in Kerberos implementation uses cRealm and sRealm to determine the path between client and service realms, including hierarchical traversal and capaths configuration.https://lukehebert.com/post/specified-version-of-key-is-not-available-44/Mon, 21 Aug 2017 00:00:00 +0000https://lukehebert.com/post/specified-version-of-key-is-not-available-44/Kerberos error 44 occurs when the keytab KVNO does not match the KDC database. This guide walks through diagnosing the mismatch and regenerating the keytab to restore authentication.https://lukehebert.com/post/java-sslhandshakeexception-no-cipher-suites-in-common/Mon, 21 Aug 2017 00:00:00 +0000https://lukehebert.com/post/java-sslhandshakeexception-no-cipher-suites-in-common/A common Java SSL handshake failure stems from passing a null KeyManager array when initializing the SSLContext, which silently disables all certificate-based cipher suites. This post walks through the root cause and the four most frequent triggers behind the error.https://lukehebert.com/post/handling-multiple-cns-on-a-single-certificate/Fri, 18 Aug 2017 00:00:00 +0000https://lukehebert.com/post/handling-multiple-cns-on-a-single-certificate/Multiple CNs in a certificate Subject field are deprecated and cause compatibility failures. The SAN extension is the correct way to cover multiple names on a single certificate.https://lukehebert.com/post/server-is-unwilling-to-perform-53/Wed, 16 Aug 2017 00:00:00 +0000https://lukehebert.com/post/server-is-unwilling-to-perform-53/LDAP error 53 means the destination server is refusing a password change request. This post walks through the most common Active Directory requirements and policy settings that trigger the error.https://lukehebert.com/post/server-not-found-kerberos/Wed, 16 Aug 2017 00:00:00 +0000https://lukehebert.com/post/server-not-found-kerberos/A quick troubleshooting guide for the ‘Server not found in Kerberos database’ error, covering the four most common root causes and how to verify each one.https://lukehebert.com/post/400-cannot-find-key-of-appropriate-type-to-decrypt-ap-rep/Tue, 18 Jul 2017 00:00:00 +0000https://lukehebert.com/post/400-cannot-find-key-of-appropriate-type-to-decrypt-ap-rep/A practical troubleshooting guide for the Kerberos AP REP decryption error, covering the most common causes from keytab mismatches to encryption type misconfigurations.https://lukehebert.com/post/active-directory-error-types-ad_mit-client-credentials-revoked/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/active-directory-error-types-ad_mit-client-credentials-revoked/A quick reference for diagnosing Kerberos authentication failures in Active Directory, covering the lockout state machine and the specific error codes (5be, 775, 18) that indicate revoked credentials or a locked account.https://lukehebert.com/post/alternate-krb5.conf-location/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/alternate-krb5.conf-location/Java reads its Kerberos configuration from a fixed set of paths before falling back to the system default. Setting KRB5_CONFIG lets you point a Java application at a custom krb5.conf without touching the OS-level file.https://lukehebert.com/post/check-entropy-levels-on-linux/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/check-entropy-levels-on-linux/Learn how to check and interpret the kernel entropy pool on Linux, why low entropy can slow down SSL handshakes and SSH sessions, and what to do when the pool runs dry.https://lukehebert.com/post/checking-aes-ni-availability/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/checking-aes-ni-availability/A quick reference for verifying AES-NI hardware acceleration across Java, OpenSSL, and the CPU itself. Includes benchmark commands to confirm the instruction set is actually being used.https://lukehebert.com/post/compare-knvo-in-db-and-in-keytab-these-should-match/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/compare-knvo-in-db-and-in-keytab-these-should-match/A quick two-step check to confirm the Kerberos key version number in your KDC database matches the value stored in a local keytab file. Mismatched KVNO values are a common cause of authentication failures in Hadoop and other Kerberized services.https://lukehebert.com/post/how-to-enable-kerberos-event-logging-windows/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/how-to-enable-kerberos-event-logging-windows/Kerberos authentication failures can be tricky to diagnose without detailed logging. This guide walks you through enabling Kerberos event logging on a Windows machine via the registry so you can capture authentication events in the system log.https://lukehebert.com/post/jdk-break-downs-for-web-ui-and-spengo-u92_u91_u40_u45/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/jdk-break-downs-for-web-ui-and-spengo-u92_u91_u40_u45/Specific JDK 1.8.0 builds (u40, u45, u91, u92) are known to break SPNEGO authentication and Hadoop web interfaces. This post documents the affected versions, the symptoms, and the recommended downgrade path.https://lukehebert.com/post/kerberos-cross-realm-trust/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-cross-realm-trust/Kerberos cross-realm authentication relies entirely on TGS exchanges between KDCs. Understanding the three-step ticket flow makes it easier to troubleshoot trust relationships between domains.https://lukehebert.com/post/keyctl-link-key-has-been-revoked/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/keyctl-link-key-has-been-revoked/A quick guide to diagnosing and resolving the ‘Key has been revoked’ error in the Linux kernel keyring using keyctl commands.https://lukehebert.com/post/multiple-http-principles/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/multiple-http-principles/How to verify and manage HTTP service principal names in Active Directory using ldapsearch and setspn, including a note about Centrify’s uppercase requirement.https://lukehebert.com/post/ssl-certificate-debugging-openssl-s-client/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/ssl-certificate-debugging-openssl-s-client/A practical cheat sheet of openssl s_client commands for inspecting, verifying, and troubleshooting SSL certificates in production environments.https://lukehebert.com/post/kerberos-krb-ap-err-not-us-or-bad-tgs-server-name/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-krb-ap-err-not-us-or-bad-tgs-server-name/A practical look at why the MIT krb5 KDC rejects a TGS-REQ with KRB_AP_ERR_NOT_US, including the exact validation logic and the most common root causes behind the error.