2
votes
1answer
38 views

Downsides of keeping host configuration files public?

I want to keep configuration for several of my hosts in mercurial and back it up, let's say, to bitbucket. Let's say, I have taken some precautions - tuned SSH to accept only keys, tuned pam to hash ...
-1
votes
1answer
166 views

Content Security Policy Configuration Problems

I have a server running nginx and I would like to add CSP. However I'm encountering difficulties even after following numerous guides I will either get an error from nginx or they just don't work. ...
1
vote
0answers
45 views

Difference between “Security Configuration Manager” and “Security Configuration Wizard”

I want some clarifications about differences between SCW and SCM. strictly Speaking when I use SCM baseline for specific Server Role (domain controller, ftp server, ...), I get for example 200 gpo's ...
2
votes
2answers
89 views

VLAN & Communication

I'm working on a project regarding Network Security and I've come to the topic regarding VLANs. I was wondering if it is possible to set up multiple VLANs (VLAN0, 10, 20, 30) in a way that all VLANs ...
1
vote
2answers
92 views

How to configure transport CONFIDENTIAL in Apache HTTPD server?

We had only one VirtualHost in our Apache 2.2 server configuration: <VirtualHost _default_:443> Our customers want be able to put in the browser only the server name in HTTP (e.g. 10.10.0.1) ...
4
votes
3answers
135 views

What are your recommendations on storing passwords for configuration management?

I've seen many recommendations to versionize configuration management system. How do you suggest one deals with passwords that are needed for application security? Versionize them, too?
2
votes
1answer
2k views

OpenVPN daemon fails to start — starting server manually returns no output

I am setting up an openvpn server on my network for the purposes of accessing devices remotely. I have generated crts and keys with the easy-rsa scripts and have configured server.conf correctly ...
4
votes
1answer
1k views

Allow anonymous user to only view job list without browsing workspace in Jenkins

We are running a Jenkins CI. Generally we would like to provide full access to authenticated users from particular group full-read access to anonymous users block anonymous users to access certain ...
2
votes
2answers
198 views

sendmail config, making open relay

I am trying to find a sendmail.mc config that allows open relaying without username/password to any system (I am testing some code that uses SMTP). After Google'd, I could not find and it has been a ...
2
votes
2answers
2k views

OpenVPN bad source address from client

I have one problem with OpenVPN. There are a lot drops records in the openvpn log file on the server: Mon Oct 22 10:14:41 2012 us=726541 laptop/ххх:1194 MULTI: bad source address from client ...
5
votes
1answer
2k views

Custom fail2ban Filter for phpMyadmin bruteforce attempts

In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log Custom log The format of ...
0
votes
1answer
2k views

How to disable LOCAL INFILE in MySql 5.5 Ubuntu 12.04

Cannot disable LOCAL INFILE ( for security reasons ) in mysql Ver 14.14 Distrib 5.5.25a, for debian-linux-gnu (i686) using readline 6.2 on ubuntu 12.04; Here is my /etc/mysql/my.cnf [client] port ...
0
votes
1answer
1k views

Iptables: Block all countries except my own for specific port

I would like to block all IPs (CIDR 0.0.0.0/0) except for German IPs for the SSH, FTP and SMTP ports. So, the default policy for those ports should be "DROP". I have a list of all German IP ...
1
vote
1answer
42 views

Linux installation analysis

"Ending company IT Admin relationship" has a good checklist for taking over an existing IT system, but I'm wondering as it relates to Linux: What is the most effective way to assess the scope of ...
3
votes
2answers
489 views

Ubuntu scalable nginx mongodb mongdb memcached server configuration [duplicate]

I have been building a PHP web application using the following techniques in the past 2 months: PHP 5.3.4 MongoDB MySql I just got my dedicated server running Ubuntu 10.4 LTS x64 with the ...
1
vote
1answer
638 views

How to safely store proxy passwords in system-wide linux config files?

I'm working on a VM in a university environment, where several other users also have root access. Take a config file like /etc/rhsm/rhsm.conf: proxy_hostname = proxy_port = proxy_user = ...
0
votes
1answer
1k views

How do I grant a user permission to use Hadoop via Kerberos?

I've setup Hadoop to use Kerberos (following the Cloudera security guide), but it is unclear how I connect to hadoop with regular users (e.g. username=myuser). Currently I have myself ...
1
vote
4answers
3k views

Is it safe to open port 3306 in Firewall for external MySQL Connection

This may be more of a server question, but it's development related, and since I'm a developer I hope it's appropriate here. I want to connect to a MySQL DB that is hosted with an ISP using something ...
44
votes
8answers
3k views

Why would I need a firewall if my server is well configured?

I admin a handful of cloud-based (VPS) servers for the company I work for. The servers are minimal ubuntu installs that run bits of LAMP stacks / inbound data collection (rsync). The data is large ...
0
votes
1answer
438 views

problem of Configure linux password rules: password shouldn't be the reverse of previous password

I am configuring password rules in linux system(RedHat Enterprise linux 5). By google, I found that using pam_cracklib will make simple check automatically. That is, pam_cracklib will automatically ...
0
votes
3answers
889 views

Limit logins to Drupal to specific IP block

I'd like to allow anonymous from anywhere, while limiting authenticated to one or few IP blocks. Can this be done in drupal 6?
1
vote
2answers
201 views

Could anyone give me some suggestion about configure secure audit system

I'm new about configure audit system. And I have some tasks such as configure audit system to audit failed attempts to access files and programs. configure audit system to audit files and programs ...
2
votes
3answers
1k views

when to use IPSec in Windows AD domain?

As I understood the joined to Windows AD computers are always securely identified/authenticated before DC (using automatically changed computer accounts passwords). Now, I read (in non-English ...
1
vote
2answers
2k views

Steps to hardening JBoss for production use on Windows?

Looking for resources/guidance on hardening a JBoss installation on windows for production use.
2
votes
2answers
773 views

Can I disable Pam Loginuid? Can I find out options used to configure kernel?

I am getting a lot of the following types of error in my secure log on a CentOS 5.4 server: crond[10445]: pam_loginuid(crond:session): set_loginuid failed opening loginuid sshd[10473]: ...
0
votes
1answer
100 views

Junos custom-attack signature pattern syntax

I am stuck at a point with the configuration of a custom-attack signature in Junos. According to the Junos Custom Attack Definition documentation page, I can set up a custom attack based upon a ...
1
vote
1answer
181 views

Setting up a hyper-v server for a small office and how to allocate its resources

Estimated machine specifications: Dual X5550 Xeon Processor, 2.66GHz 8M Cache, hyper threading (Core i7 architecture Xeon), 24GB 1333MHz ram,8x143gb 10K RPM SAS drives in hardware raid6 array with ...
2
votes
1answer
6k views

How do I prevent the Windows 2008 logon screen from showing user account names?

When I logon to Windows 2008 via the console or via RDP it shows me the names of user accounts already created as clickable buttons. How do I prevent this and make Windows 2008 ask me for a username ...
1
vote
3answers
6k views

Firewall define program exceptions Group Policy not applying

I updated my domain's default policy to add exceptions to the Windows Firewall, under Administrative Templates < Network < Network Connection < Windows Firewall < Domain Profile I ...
2
votes
2answers
859 views

Hyper-V Server roles configuration

Continuing on with my series of beginning system administration questions currently this is what I have to work with: Dual processor 3 GHz Xeon 64-bit single core, 4 GB RAM server Domain Controller ...
0
votes
2answers
7k views

Why does my site use the IUSR account when configured for pass-through authentication?

I have an IIS7 website that is set to run in its own application pool. The application pool is configured as: Managed Pipeline Mode: Integrated Identity: I_siteuser (account is member of IIS_IUSRS) ...
35
votes
2answers
4k views

Why do I have to edit /etc/sudoers with visudo?

I've noticed that the sudoers file and cron config files act in a special way compared to other config files on Linux. They need to be edited with a special wrapper rather than any text editor. Why is ...
0
votes
3answers
2k views

Java cannot resolve DNS address from AIX: UnknownHostException

I'm having this strange error. On AIX, I can reach my server from the command line ( using ping / telnet ) But If I try using java I've got UnkownHostException This is because Java cannot somehow ...
3
votes
2answers
858 views

Wireless configuration file

Vista now appears to support automatic wireless key distribution through USB disks. To see this in action, attempt to connect to a secure access point (that you don't have a key for) and when it asks ...
2
votes
2answers
126 views

What do I have to configure on my server to increase security from default?

I am setting up a Windows 2003 machine to host a website, are there any settings that I should pay special attention to in regards to security? In other words, is there dangerous default setting I ...