@hugovalters.bsky.socialLock down GRR's frontend with nginx mTLS: terminate TLS, verify client certs against your GRR CA, and pass the subject DN to GRR via header for admin access. Full config for nginx 1.18+ https://www.valtersit.com/vault/harden-grr-frontend-behind-nginx-with-client-cert-auth-720753/
#grr #nginx #mtls
@freya.highenergymagic.net.ap.brid.gy#duckduckfedi anyone know of a good setup for configuring #mtls with #Caddy ? I can use step-ca or openssl but they both suck shit for this, they don't have a UI, don't have automated renewal, don't have YubiKey provisioning, don't have an auth endpoint per-service so a cert can be allowed or […]
@jmm86.bsky.socialImplementing mTLS between services is a strong security measure, but overly broad RBAC for service accounts can undermine its effectiveness. Slack team admin rights can compromise all communications. #mTLS #RBACControl
@regiops.bsky.social
@hugovalters.bsky.socialMonitor mTLS endpoints in zero-trust setups with a custom CA and client certs. This snippet wires up mutual TLS auth in blackbox exporter and tracks https://www.valtersit.com/vault/mtls-endpoint-monitoring-with-custom-ca-and-client-certifica-2cfd1e/ #blackbox #mtls #ValtersIT
@hugovalters.bsky.socialEnforce mTLS at the gateway with Tyk Ingress client cert validation. Validate client TLS certs against trusted CAs, extract SANs and serial numbers into https://www.valtersit.com/vault/enforcing-ingress-client-certificate-validation-and-certific-fe6a1a/ #tyk #mtls #ValtersIT
@mustafaerbay.bsky.socialJust because traffic comes from Cloudflare doesn’t mean
#Cloudflare #Nginx #Mtls #Security
https://mustafaerbay.com.tr/en/blog/technology/ip-listesi-kimlik-degil-authenticated-origin-pulls/
@mustafaerbay.bsky.socialCloudflare IP’leriyle savaşıyorum. Üç ay boyunca sadece onların IP’lerine açtım, ama “gelen” ve “benim için gelen” aynı değil. mTLS’i açmadan önce 7 portlu, 8…
#Cloudflare #Nginx #Mtls #Security
https://mustafaerbay.com.tr/blog/technology/ip-listesi-kimlik-degil-authenticated-origin-pulls/
@pomerium.ioThe latest interactive tutorial just dropped! See mTLS-based access policies in action: authenticate machine callers, authorize by fingerprint, verify logs, revoke access, & rotate credentials without downtime. CI is the example workload.