4
votes
3answers
70 views

ESXi hosted on public IP without firewall

So I've got an interesting problem. I currently rent a couple of servers from Hetzner (a German hosting provider). Each server has a soft firewall and does something like web hosting / database. I ...
3
votes
4answers
109 views

Our server hosting provider asked for our root password

I work at a company that develops and hosts a small business critical system. We have an "Elastic cloud server" from a professional hosting provider. I recently got an email from them saying that ...
-1
votes
1answer
59 views

Hosting setup for a small application with security-sensitive data

Not sure this is the right place to ask this but I'll give a shot. I've been asked to implement a system about criminality data. The data is security sensitive, in that it contains information about ...
1
vote
2answers
159 views

My hosting provider allows me to see the names of all other databases on their servers, is this bad practice? [closed]

I've got MSSQL DB functionality set up with a hosting provider, and recently logged in for the first time. When I added the connection, it then listed (apparently) every single MSSQL database on ...
1
vote
2answers
238 views

PHP web hosting: how to prevent clients to DOS/DDOS?

I'm providing a partial web hosting solution where my clients may upload and execute their own php scripts. Besides the security routine I'll have to check (off topic here) I would like to know ...
0
votes
1answer
152 views

Mounting /home as noexec [closed]

Does mounting /home with noexec really add security? All it does is disable binary execution right? So that means other scripts can still run and execute shell code into services. Run shared ...
1
vote
5answers
333 views

Supplier is trying to sell me a hardware firewall: do I need one?

As per the title, my software supplier is trying to persuade me to upgrade to a dedicated server with a hardware firewall. (We're currently on a shared Rackspace virtual host, running Ubuntu.) Our ...
1
vote
2answers
61 views

Why would a company treat its web server hardware setup as confidential? [closed]

Recently I was reading a blog post (in Russian) about a huge datacenter. Commenters asked to show shots of racks with equipment installed by customers. The authors declined saying that customers ...
0
votes
1answer
77 views

How does Dreamhost Restrict User Accounts?

Browsing around my shared hosting account on Dreamhost, I noticed that I could not create users if the name is already taken. I can cd /home/username if I created the username, but I can't cd ...
0
votes
1answer
70 views

What are “denied hosts”?

An absolutely noob question I'm sure but I get an email from my web host everyday with a list of a few denied hosts and wondered exactly what this meant. I'm guessing that its a connection refused by ...
2
votes
1answer
72 views

monitoring a network for spammers/webscripts gone bad

I am going to be setting aside some IP space so that someone can use it as co-lo space and dedicated hosting. The network will have its own cisco router and several L2 managed switches that I'll admin ...
2
votes
3answers
197 views

How to enable non sudo user access to top with all processes?

I use Ubuntu Server 10.04. I have users that normally don't have access to sudo. When this user is using top command he sees only processes for the current user. I added a line to /etc/sudoers: user ...
0
votes
1answer
180 views

Locking down a box on the Internet [closed]

I'm a developer who is looking to put a new service on the Internet. I am new to administering systems and frankly I seem a little lost at where I should start with putting something on the web. My ...
3
votes
3answers
248 views

How to secure a vps based website?

If I have a vps hosting with linux, what should I do to be sure it has platform security ? I install a server (let's say tomcat), a database server (mysql) and then I deploy my application. Should I ...
1
vote
1answer
82 views

How to secure a VM while allowing customer RDS (or equivalent) access to its desktop

We have a Windows Client/(SQL-)Server application which is normally installed at the customer's premises. We now need to provide a hosted solution, and browser-based isn't feasible in the short term. ...
0
votes
1answer
378 views

Difference between SetEnvIf and RewriteCond?

In my .htaccess file, I'm currently using RewriteCond to match the user agent of bad bots. I know that SetEnvIf can also be used to block bad bots too. The question is, what's the difference between ...
0
votes
2answers
179 views

.htaccess regular expressions for optimal performance?

In my .htaccess file I'm trying to block some bots using: RewriteCond %{HTTP_USER_AGENT} ^badbot [NC] But, I want to change these conditions to something more inclusive like: Method #1: ...
1
vote
4answers
261 views

Help! Why do blocked bots still waste bandwidth?

I've blocked a majority of bots that keep sending POST requests to my website, using .htaccess. Each time one of these bots tries to access my website it receives a 403 forbidden error message. My ...
0
votes
1answer
140 views

Script and file execution security with .htaccess

I'm trying to figure out which method I should use to control script/file execution security. I'm trying to protect against malicious file upload/execution exploits where a user could potentially ...
1
vote
2answers
296 views

.htaccess security

In my .htaccess file I've been trying to figure out if I should use: Options None which of course would disable all extra options, but I've been reading mixed opinions concerning the use of "Options ...
0
votes
2answers
48 views

Hosting part of a website under a different domain

I have a website where we want to move the admin portion to a different URL (for security purposes, according to the site owner). So, to make the admin section accessible only from this new domain ...
1
vote
1answer
54 views

How one user can access our server and copy file there

Can anyone explain how an user can access my hosting account and then upload files there. Is it because I dont change my ftp details frequenltly. Because recently I found in all my domains a sample ...
1
vote
4answers
195 views

Site hacked - any ideas of what to do, where to look?

A site I host was recently hacked. The index page had the following code added to the bottom (just above the closing body tag): <script language="javascript">document.write('<div ...
1
vote
3answers
125 views

Hosting solution for sensitive client data

We are developing a web application that will deal with highly sensitive (financial) data of clients (audience is medium to large sized businesses). Clients will be under scrutiny from regulators ...
3
votes
7answers
2k views

How do I securely execute commands as root via a web control panel?

I would like to build a very simple PHP based web based control panel to add and remove users to/from and add and remove sections to/from nginx config files on my linode vps (Ubuntu 8.04 LTS). What ...
0
votes
3answers
156 views

Setting up my own hosting

I have a Linode VPS. This means I have root access; well, I thought I'd offer a bit of shared hosting. How do you get started doing this? I'm wanting to give PHP, MySQL, and PostgreSQL. Also, I'm ...
3
votes
2answers
826 views

How to be server admin noob and manage security on Linode/SliceHost/Webbynode?

Hoping you can help! I'm considering moving a Rails app from a shared hosting provider to a dedicated server or a service like Linode, SliceHost, Webbynode, etc. where, if I understand correctly, the ...
0
votes
2answers
465 views

Windows IIS6 site authentication

I have a site running on IIS6 and I want to make it authenticate via the standard gray pop-up window. I.e. it should use Windows to authenticate. I want to make it so only one single user on the ...
3
votes
3answers
322 views

Common security issues you face as Linux (web)hosting provider

Question to users that have their own webhosting (either physical servers or are resellers): Are there any common security issues you have to deal with on your servers? Any suggestions about ...
6
votes
6answers
1k views

Is Opera Unite a security risk, and is there an easy way to block it?

Given that Opera Unite allows users to share files (music, photos, etc.) through firewalls and without a web server, it seems to be a security risk for the enterprise. An article on this at ZDNet: ...
17
votes
13answers
2k views

Reasons to not allow people into the server room

I have worked at a few hosting companies and seen two schools of thought on this Do not allow customers into the server room. The argument is basically it raises security (this news story is ...