Tagged Questions

0
votes
0answers
28 views

IIS identified a user as a user on another domain when he accessed an ASP.NET 4.0 page.

An IIS 6 Server on Windows Server 2003 has a virtual directory configured with anonymous access disabled and Integrated Windows authentication enabled. The directory in which the page exists restricts ...
1
vote
1answer
31 views

How to setup NT Challenge on Windows 2008 R2

I want to setup NT Challenge for a web application. I have read a lot of articles but still not clear how can I setup it on windows server R2. Could anyone please point me settings/Configurations to ...
0
votes
1answer
99 views

Converting the ssh key

to clone my bitbucket project,I changed the /.ssh/authorized_keys content by adding my bitbucket key and I am able to clone into my bitbucket,but after that I was not able to access my server at EC2 ...
2
votes
1answer
33 views

Does Practical NFS Authentication for RPCSEC_GSS Exist Other Than Kerberos?

Most of the reading I have done suggests that RPCSEC_GSS can be set up using Kerberos, but we don't already have a Kerberos server set up. I had read there were other auth methods like LIPKEY that ...
-1
votes
2answers
119 views

Protect access to static files with Apache & Session [closed]

/assets - file1.mp3 - file2.mp3 ... - fileX.mp3 (millions of files) So what I want to prevent is to access the content directly if the user is not logged in like ...
1
vote
2answers
46 views

Securing a remote LAMP server that uses Capistrano for Git deploys

I am deploying my Github repo to a Media Temple Grid Server using Capistrano. In order to do this, I've setup the following: Enabled logging into the remote server with SSH keys (following this ...
0
votes
0answers
142 views

JBoss EAP 6: enable authentication on native localhost management interface?

Is it possible to enable authentication on the native management interface (port 9999 in standalone mode)? I can't find out how to enable authentication on that interface. On the localhost http ...
0
votes
0answers
17 views

What's the difference between the login-for block and the security authentication failure rate commands?

What's the difference exactly? They seem to do the same thing to me except one seems to be timed. Would you ever use both?
0
votes
0answers
72 views

Multi- authentication scenario for a public internet service using Kerberos [closed]

I have a public web server which has users coming from internet (via HTTPS) and from a corporate intranet. I wish to use Kerberos authentication for the intranet users so that they would be ...
1
vote
0answers
52 views

require client certificates in IIS without requiring SSL

In IIS 7, I've created an https binding for a site, and I'd like to require client certificates for https and still keep my http endpoint. That is to say, I'd like to require client certificates for ...
2
votes
1answer
35 views

How to handle user accounts for many sites running on same server

Background to this question: I want to host multiple e-commerce sites on the same server, each with their own separate customer login application. Each site's login application needs to be secured by ...
0
votes
2answers
140 views

Google 2 factor authentication on Ec2?

I have set up google two factor authentication on my local machine. So when I do : ssh localhost I need to verify the code along with password. But when I try to connect to my Ec2 instance like so ...
0
votes
1answer
175 views

sshd_config versus authorized_keys command parameter

Background: I added OTP token authentication to my web server. I modified the /etc/ssh/sshd_config file with the ForceCommand /token/script command. Problem: I have a local Jenkins instance ...
0
votes
0answers
21 views

Cannot log in to SQL 2012 - no known login [duplicate]

Possible Duplicate: How to recover a MSSQL user's password? We recently installed SQL 2012 on one of our servers, but have been unable to log in. Another tech did the installation so I ...
0
votes
3answers
291 views

Purpose of the x509 certificate in metadata files on the IdP side (SSO structure)

In order to implement SSO, I have been working with some IdP and a Shibboleth SP install without being able to answer this question. On the IdP side I have a few metadata files that describes some ...
3
votes
4answers
594 views

OTP vs certificate based tokens

I'm currently in the process of researching options for a two-factor authentication system for our company. I'm currently investigating the pros/cons of certificate-based tokens vs. one-time-password ...
0
votes
2answers
333 views

How to allow just one user to login in special computer in Server 2003

I want to just allow one user to login to a special computer in domain. how can i do that ?
0
votes
1answer
132 views

Is this considered 2 Factor Authentication?

Trying to create a 2 Factor Authentication for users to access data remotely. Here my scenario: We have a Watchguard to VPN into the network - If we use it's internal DB to store authentication ...
5
votes
3answers
2k views

Managing service passwords with Puppet

I'm setting up my Bacula configuration in Puppet. One thing I want to do is ensure that each password field is different. My current thought is to hash the hostname with a secret value that would ...
4
votes
2answers
2k views

How to allow RDP access based on client certificate

How can I limit (RDP) access to a Windows Server not only by username/password but also with a client certificate? Imagine creating a certificate and copying this to all computers from which I want ...
11
votes
1answer
12k views

Troubleshooting Windows Authentication problems (no challenge) in IIS 7.5?

I know that there are thousands of reports of people having trouble getting Integrated Windows Authentication to work with IIS, but they all seem to lead to web pages that don't apply or solutions ...
33
votes
9answers
5k views

Why is SSH password authentication a security risk?

Most guides for OpenSSH configuration advise to disable password authentication in favor of key-based authentication. But in my opinion password authentication has a significant advantage: an ability ...
1
vote
1answer
38 views

How can I determine which users are authenticating via ftp or telnet?

I've inherited a system that has both telnet and ftp enabled. As both these send passwords in cleartext I want to disable them. But many users have never changed their ways to use sftp or ssh. And ...
3
votes
2answers
333 views

Are SSL Client Certificates well supported by all major browsers?

We're thinking of improving the authentication of some critical webpages with client certificates, but we're not sure whether it's a widely used standard. Are SSL Client Certificates well supported ...
3
votes
2answers
1k views

Network authentication + roaming home directory - which technology should I look into using?

I'm looking into software which provides a user with a single identity across multiple computers. That is, a user should have the same permissions on each computer, and the user should have access to ...
2
votes
2answers
68 views

How to structure the “authentication graph” of a group of frontend/backend servers?

I'm taking over a bunch of servers as a newbie sysadmin, which include a frontend web server, and several backend servers that hold databases that include private information of the users of the web ...
0
votes
1answer
59 views

Staging and Development Server Accessibility Restrictions

I have some staging and development web servers on cloud hosting. I do not want them to be accessible to the general public. It's easy enough to restrict access by network or authentication. The ...
0
votes
0answers
161 views

Jira: Handling multiple LDAP Organizational Units in 4.3

I'm in the process of upgrading my company's Jira instance to the latest version 4.3.4. In previous versions of Jira we've been able to intergrate with LDAP just fine, by using a baseDN in the ...
1
vote
3answers
599 views

Break-in attempts on Ubuntu VPS box [duplicate]

Possible Duplicates: Is it normal to get hundreds of break-in attempts per day? What should I do if I find someone is brute forcing my server password? I have an Ubuntu 10.04 VPS box. ...
5
votes
3answers
4k views

How to disabled password authentication for specific users in SSHD

I have read several posts regarding restricting ALL users to Key authentication ONLY, however I want to force only a single user (svn) onto Key auth only, the rest can be key or password. I read How ...
0
votes
1answer
272 views

Multi-factor authenication at ec2 and in general

I noticed aws has multi-factory authentication: http://aws.amazon.com/mfa/faqs/#How_does_AWS_MFA_work This seems to be only for when you login via the web into the web console etc. In general, could ...
2
votes
2answers
1k views

How to configure client certificate authentication in IIS

For me it is trivial to configure Tomcat for client authentication. But trying it to do it in an IIS 7 server (running in Win2008R2 Server) it seems imposible. In tomcat all I have to do is configure ...
1
vote
2answers
169 views

information about windows Basic Authentication

i've some questions about Basic Authentication in Windows Server 2008. I read that Basic Authentication send the passowrd as plain text, so it is insecure, but you can combinate it with SSL to ...
1
vote
1answer
321 views

Is giving read permissions on /etc/shadow to apache user a wise decision from security point of view?

I have to use PAM authentication for DAV SVN, but when everything is configured as specified in mod_auth_pam documentation, authentication does not work. After some research I realized, that for this ...
0
votes
0answers
107 views

What techniques are recommended to prevent a MITM attack when using a public/private key pairs (RSA)?

I currently have a group of web-services exposing interfaces to a variety of different client types and roles. Authentication is handled through a public/private key pairs (RSA) only to verify the URL ...
1
vote
3answers
454 views

What techniques are recommended to prevent a MITM attack when using a public/private key pairs (RSA)?

I currently have a group of web-services exposing interfaces to a variety of different client types and roles. Authentication is handled through a public/private key pairs (RSA) only to verify the URL ...
1
vote
2answers
416 views

How to configure mercurial access controls using apache and hgweb?

I have set up a mercurial repo to be served using apache+wsgi+hgweb on OS X. It is now completely open to anyone who stumbles upon my server on the correct port number.. How can I set it up so that ...
0
votes
1answer
289 views

How to implement strong authentication for OUTLOOK “Client”?

I’ve got a customer that is currently using Lotus Notes, and they’ll be migrating off Notes to Exchange + Outlook (for the email/messaging part) and SharePoint 2010 (for the documentation repository ...
2
votes
4answers
576 views

Two Factor Authentication on EC2

I need to host stuff for a financial institution on EC2. The bank wants complete Two Factor Authentication so Stuff like having SSH with a key with password. Something like SecureID or similar would ...
0
votes
1answer
294 views

Setting up Shibboleth to secure part of a website

I've installed the Shibboleth module for apache on Ubuntu 10.04 using aptitude to install libapache2-mod-shib2 as per ...
0
votes
2answers
529 views

How to control remote access to Sonicwall VPN beyond passwords?

I have a SonicWall TZ-210. I want an extremely easy way to limit external remote access to the VPN beyond just username and password, but I do not wish to buy/deploy a OTP appliance because that is ...
1
vote
2answers
997 views

Unable to set NTFS permissions for ApplicationPoolIdentity on Windows 2008 SP2

On Windows 2008 R2 I am able to set NTFS permissions for an application pool's synthesised ApplicationPoolIdentity account thus: ICACLS d:\websites\site1\www /grant "IIS AppPool\site1":(CI)(OI)(M) ...
8
votes
2answers
3k views

Is SSH Key Exchange more secure than password authentication?

Remote users connect to several services at our main office over the internet using SSH. The SSH password is synched with their LAN A/D account. Would having users bring a copy of an SSH key home ...
0
votes
1answer
337 views

PAM cracklib vs login.defs

If there are different parameters set for minimum password length in pam_cracklib and login.defs. Which takes precedence ? Any good docs/books about PAM ?
11
votes
2answers
2k views

The Story of secure user-authentication in squid

once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network: <the Internet> ...
0
votes
3answers
1k views

How do I disable Windows authentication on a SQL Server instance?

How do I disable Windows authentication on a SQL Server instance?
1
vote
3answers
66 views

Picking up a lot of failed authentications for various accounts

My server is getting a lot of various failed authentication attempts for various accounts. The most common one (that I've seen ) or the root account. I have since enabled Fail2Ban and ran several ...
18
votes
2answers
31k views

Howt to grant network access to LocalSystem account?

How do you grant access to network resources to the LocalSystem (NT AUTHORITY\SYSTEM) account? Background When accessing the network, the LocalSystem account acts as the computer on the network: ...
3
votes
3answers
3k views

Authenticating Windows 7 against MIT Kerberos 5

I've been wracking my brains trying to get Windows 7 authenticating against a MIT Kerberos 5 Realm (which is running on an Arch Linux server). I've done the following on the server (aka dc1): ...
6
votes
6answers
266 views

Certificate Authentication

I am currently working on deploying a website for staff to use remotely and would like to make sure it is secure. I was thinking would it be possible to set up some kind of certificate ...

1 2