0
votes
1answer
32 views

Server load increases by lot of httpd request with same PID

I can see that my server load increases to more than 200-300 range. Before 1 week the maximum load was around 20-25. In top and ps -ef i can see a lot of httpd threads and the PPID of most of the ...
0
votes
1answer
36 views

How to block server's internet access and only allow LAN [closed]

I was wondering what the best way to block a server's internet access is while allowing LAN connections. Essentially, I want a server to be only accessible by LAN. What ips, ports, etc should I block? ...
0
votes
5answers
109 views

Should I change the SSH port to < 1024? [duplicate]

Many server configuration guides recommend that the SSH port should be changed to something > 1024, for obscurity and to avoid conflicts. This is interesting, because it recommends using a port < ...
1
vote
1answer
33 views

What are (if any) possible scenario whereby hacker can find multiple sites hosted in one VPS?

Let me clarify: Say that I have 10 sites hosted in one VPS host. And for some reason, one of these sites gets famous and a hacker wants to know where it is hosted, and how many other sites are hosted ...
0
votes
1answer
44 views

Should I still disable root if I disable password authentication and enable only key authentication?

I'm new to the linux world and I've been reading a few tutorials on security. I've seen some questions on StackExchange tackling this subject, but from what I've seen, none of the answers clarified ...
0
votes
2answers
49 views

Remote login terminal

I have an unusual request. I have a box - running Fedora 19 - that I'm using as a server. I have a crappy Atom netbook - also running Fedora - that isn't good for anything. I was wondering if there is ...
0
votes
0answers
36 views

Who or what is writing suspicious files in /tmp [duplicate]

Some hacker has managed to poke around enough to write files to my /tmp directory on a hardened CentOS 6 web server box. As far as I can tell they haven't succeeded in anything other than writing ...
0
votes
1answer
20 views

Interpreting ** RABHIT ** logs - Potential Attak - SYN?

I am hosting a web on a Linux - Debian Wheezy x64. Our Web Server is LiteSpeed using APF-Firewall and DDoS-Defeat Recently, we are getting logs of below sort, telling us it may be a potential ...
0
votes
0answers
32 views

Setting up muli-project web development server

I'm trying to set up a development server that will be used for several (web) projects by different teams (consisting of different people, some of which may be involved with more than one project). I ...
2
votes
1answer
153 views

sudo still ask for password when NOPASSWD is used

I read all sudo posts on serverfault, but I still cannot figure out what I'm doing wrong. Normally I finally find the solution but not this time : I want apache user to be able to execute this ...
3
votes
2answers
111 views

Use of rpm and yum for application installation in large installation environment

Our very large organization has developed a standard for hosting of applications which dictates that the application and all components on which it relies must reside in a dedicated application volume ...
0
votes
3answers
70 views

locking up a linux box on a foreign network

I have an app that runs on a Linux server and is accessed via each user's web browser. My app contains proprietary code that I need to keep secure. I want to install the app in a client's private ...
6
votes
1answer
75 views

Restricted shell for managing files and git repositories

Think about a web hosting company that wants to let users manage files and git repositories via ssh. This includes: secure copy (scp) creating, copying, moving/renaming and deleting files executing ...
20
votes
8answers
2k views

Restrict a Linux user to the files he owns

Imagine a server setup of a shared webhosting company where multiple (~100) customers have shell access to a single server. A lot of web "software" recommends to chmod files 0777. I'm nervous about ...
9
votes
2answers
341 views

How to handle security updates within Docker containers?

When deploying applications onto servers, there is typically a separation between what the application bundles with itself and what it expects from the platform (operating system and installed ...
-1
votes
1answer
65 views

How should I properly block outgoing http traffic with iptables

I'm experimenting with iptables, and I'm trying to allow all outgoing requests for HTTPS, but to block HTTP. I have the code below; Chain INPUT (policy ACCEPT) target prot opt source ...
0
votes
1answer
27 views

Fixing Apache Struts XSS vulnerability

A recent network scan revealed the following vulnerability: Apache Struts s:a / s:url Tag href Element XSS. Here is a link with more info about this vulnerability: http://osvdb.org/show/osvdb/54122 I ...
-5
votes
1answer
56 views

How much harm can a non-root user cause? [closed]

Let's say you add a user to your Linux server, and allow the user to connect over SSH with full command-line access, but do not add him to the list of sudoers. What sort of security vulnerabilities ...
2
votes
2answers
62 views

NFS client keytab: multiple machines

How should one go about setting up client-side keytab files for each client machine to access network services? My working example is NFSv4, which requires each client to have a Kerberos keytab ...
0
votes
0answers
27 views

Private, secure network between web nodes

I need to create small network of vps (linux) servers. Their main puropse is to server some data over http to clients. Each server is going to be located elsewhere in the world. I want those servers ...
-2
votes
1answer
27 views

Allow outgoing connections for DNS [closed]

I'm new to IPtables, but I am trying to setup a secure server to host a website and allow SSH. This is what I have so far: #!/bin/sh i=/sbin/iptables # Flush all rules $i -F $i -X # Setup default ...
0
votes
2answers
39 views

IPtables - Sensible and non-contradictory rules?

This is my IPtable rules for my webserver with SSH installed, i've had help to get this far. My question is, are my rules contradictory. For example, I've been recommended to use these two lines: # ...
4
votes
3answers
206 views

IPtables locking down website allowing only SSH

I have written my first IPtables rule file to try and protect my server on all ports apart from SSH and the ports needed for the web. This is what I have come up with: i=/sbin/iptables # Flush all ...
1
vote
4answers
69 views

Securing debain with fail2ban or iptables

I'm looking to secure my server. Initially my first thought was to use iptables but then I also learnt about Fail2ban. I understand that Fail2ban is based on iptables, but it has the advantages of ...
0
votes
1answer
43 views

Starting SecAstQFSFileEngine::open: No file name specified - error when starting secast

I'm receiving the below error when starting secast service secast start Starting SecAstQFSFileEngine::open: No file name specified [FAILED] Has anyone run into this issue before? I'm running CentOS ...
1
vote
2answers
130 views

Permissions to edit network configuration

We ship a virtual machine to the clients which runs a web service. Clients need to install this virtual machine on one of their hosts using an hypervisor and just need to modify the network ...
3
votes
1answer
132 views

How to deal with passwords during automated deployment? [closed]

As responsible admins we know of common weaknesses like CWE-260: Password in Configuration File http://cwe.mitre.org/data/definitions/260.html CWE-522: Insufficiently Protected Credentials ...
-1
votes
1answer
52 views

Security Recommendation [closed]

We have bunch of linux servers dedicated to do some tasks. Periodically we need to run certain commands which requires root access. So we have developed a web panel from which these administration ...
0
votes
2answers
37 views

If a web root directory has a simlink that points to a folder one-level up, does that pose a security risk?

Assuming a Linux/Unix system. Not asking about any particular server software, just wondering in general. I want to use this to include javascript libraries or things like that in multiple sites or ...
0
votes
0answers
161 views

Fixing TLS renegotiation vulnerability on Apache 2.2.3

On a RHEL 5.3 server, I have Apache version: Server version: Apache/2.2.3 Server built: Nov 12 2008 07:09:03 Server's Module Magic Number: 20051115:3 Server loaded: APR 1.2.7, APR-Util 1.2.7 ...
21
votes
8answers
4k views

How to hide a password passed as command line argument?

I'm running a software daemon that requires for certain actions to enter a passphrase to unlock some features which looks for example like that: $ darkcoind masternode start <mypassphrase> ...
0
votes
2answers
75 views

Should munin be password-protected?

We use Munin at work. There is a Munin install - which right now is open to the world. An admin doesn't think he needs to password-protect it. What's the worst that can happen? How can I convince ...
1
vote
1answer
89 views

Correct Permissions VPS /var/www

This is a repost of an "off-topic" question on stackoverflow. My scenario is: I created a user and added that user to sudoers: visudo user ALL=(ALL) ALL Then sudo adduser user www-data and ...
-2
votes
2answers
55 views

Monitor Server Logins / SSH Access? [closed]

I seem to have some suspicious activity happening on my server from time to time. Aside from changing passwords regularly, I would like to be emailed ( or logged ) each time a user accesses my ...
-5
votes
1answer
75 views

Does a tool like ansible make it possibly to get a secure server, without knowing a lot about security? [closed]

If I modified something like this into a server similar to the one described here with a minimal set of services (what you need for ssh, basically) would it be reasonably secure? sovereign: A set ...
4
votes
7answers
1k views

will hosting provider have access to my dedicated server?

I am looking to buy a dedicated server for my web application.But I am concerned about security to my application code and who can access to my server even dedicated server.As hosting provider ...
2
votes
1answer
58 views

iptables: does a scanner knows if you DROP packets?

I know how REJECT and DROP chain works. But, as I read here REJECT vs DROP when using iptables, user Dagelf said that the server still replies with TCP SYN/ACK. Does the scanner knows that a packet ...
0
votes
0answers
78 views

Force all traffic through VPN

I am using PfSense as a firewall, with its VPN functionality. The client I use is Shrew Soft VPN client. As it is a split tunnel, is there a way I can force all traffic through the VPN connection, ...
-1
votes
1answer
56 views

Helpful linux command for do some forensic on compromised linux web server [duplicate]

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
72
votes
7answers
27k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
1
vote
1answer
319 views

SELinux permissions for LogRotate and Apache

With the directory structure: /www/live/website1/app/ /www/live/website1/files/ /www/live/website1/logs/ Where Apache needs at least the following access: app: read-only access, but read-write is ...
2
votes
2answers
53 views

Downsides of keeping host configuration files public?

I want to keep configuration for several of my hosts in mercurial and back it up, let's say, to bitbucket. Let's say, I have taken some precautions - tuned SSH to accept only keys, tuned pam to hash ...
1
vote
1answer
85 views

How do I interpret aide.log change summary

In the Changed files section of /var/log/aide/aide.log there are prefixes on each line starting with f or d. These signify what aspects of the file has changed, but I can't seem to track down what ...
0
votes
1answer
41 views

Upgrading sudo rights

One my server, I've given the main user for the web server, access to /usr/bin and /tmp. I did this so that ceartain scripts could could call exim without this user needing to have full sudo rights. ...
3
votes
1answer
101 views

Apache upgrade strategy

I'm on CentOS 6.5 and Apache 2.2.15. I wanted my httpd to be up to date so I did: yum update httpd After that it is still version 2.2.15, but latest version is 2.2.22. I also see security updates ...
1
vote
2answers
48 views

Using chown: Any substantial difference between assigning ownership of the entire directory vs just the files in it? [closed]

An example: Say Apache needs to have ownership of all the files in /var/www/html to serve the pages of a website. Is there any danger in making Apache the owner of this directory (and files and ...
0
votes
2answers
78 views

McAfee anti-virus for linux server? [duplicate]

We have a CentOS server for our web startup hosted on softlayer.com. Knowing how secure Linux is even without anti-virus programs: Do I still need to install McAfee as advertised in softlayer's site ...
1
vote
1answer
57 views

TCP echo server security [closed]

I am setting up a Linux server similar to a TCP echo server and am wondering about security issues I should be concerned about. This will be a bare bones Centos/KDE server with no additional files ...
1
vote
1answer
368 views

SSL on AWS? Cert installed but still having issues

We bought an SSL certificate (From Comodo) and when I visit the page in Chrome I see the green padlock and it has the following information: Your connection to ...... is encrypted with 128-bit ...
0
votes
1answer
29 views

In sysctl.conf settings, what is the difference between 'all' & 'default'?

In context of sysctl.conf settings, what is the difference between (all vs. default) like net.ipv4.conf.all.accept_source_route & net.ipv4.conf.default.accept_source_route in sysctl settings ? ...