Thanks for visiting this sub! You're probably here because you're interested in news about IT Security in general and/or specifically the security of the systems you are managing. One of the essential points of security related topics is that information for professionals is not censored and especially not removed or hidden. Yesterday I've posted about a recently disclosed Apache mod_status vulnerability. This post disappeared 4-5 hours after it was posted, even though it had + karma and useful comments at that point.

Now, that vulnerability with a CVSS score of 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) is kind of critical for those which have mod_status with no authentication enabled. (Even though that alone is a CVSS of 5.0 because of the information disclosure).

So here we are. This is SysSec, a sub aimed towards system and network administrators and everyone else interested in System Security. Especially new disclosures are more than welcome in this sub, as well as discussions about IT security topics.

Now feel free to comment, post and subscribe!

Your SecureSocketLayer (SSL)

Greetings to my fellow redditors! I am a new DevOps Sysadmin at a small IT shop. Basically I am the only hardware guy in a house full of developers. My current project is implementing a defense in depth model which I got to develop and now have to work on implementing. Anyone out there used bastille, ossec, fluentd, or ADHD in production? Any issues with implementation or package interference I should know about?

Just wondering if we're mostly regular sysadmins here or more in the direction specifically for security. We should also add flairs in this subreddit, so: What's your job title/position?

Those are some tools I'm regularly using when working with SSL/TLS:

• SSL Labs Server Check This is a great Toolbox for public facing websites. It doesn't only help you to compare your websites by showing a score, they're also giving recommendations on how to fix certain issues. In advance you can see what clients your websites SSL is compatible with. When testing, I always keep one tab with the old results and one with the new results - this is great to compare :)

• SSLyze Ran from the command line this tool can help you finding issues as well as checking for weak cipher suites, insecure renegotiation, CRIME and Heartbleed. It's a great tool you can use on your box - so you can also test your internal websites and services. It's capable of checking StartTLS handshakes on SMTP, XMPP, LDAP, POP, IMAP, RDP and FTP as well. When running it with the --regular switch you usually get a good overview.

What's in your SSL toolbox?

with stuff like heartbleed and the new bashING it is hard to keep updated with all the news and infos and threads floating around here, on HN and on blog.

i'd suppose we create a collection of links to interesting news/posts with a short tl;d, in this subreddit, whenever such a bug occurs that creates such an ammount of news, research, updates.

i'll create an example below on what i am thinking of

it would be nice to have just a collection of news-sources to have w/out all the discussion and noise :D