4
votes
7answers
927 views

will hosting provider have access to my dedicated server?

I am looking to buy a dedicated server for my web application.But I am concerned about security to my application code and who can access to my server even dedicated server.As hosting provider ...
3
votes
1answer
42 views

Microsoft Multi-factor Authentication not working with RDP

I am installing a new remote access server, where I need multi-factor authentication for RDP access (=a call back to the user's cell phone after they enter their credentials). The problem is that the ...
1
vote
2answers
82 views

Suspicious Login Success in Event Viewer

Hope you can help. We have been noticing another user's local machine creating logon entries in the event viewer of our machine. The message received is "An account was successfully logged on". The ...
0
votes
3answers
57 views

centos private key and root login

I wanted to know if it's good practice / secure to allow login as root with ppk (private key) file. (no password). This server is only for me and no one else is working on it. Thanks, Danny
1
vote
2answers
621 views

How do I list the N last successful and unsuccessful login attempts for my user when I log in with e.g. ssh on Linux?

This seems like such a basic security feature I'm surprised it's not already standard.
4
votes
2answers
884 views

Disabling the shell of user “daemon” (/bin/false)

on a Linux system there are lot's of users by default: daemon, bin, sys, games, etc. According to my /etc/passwd most of these users have a shell assigned (/bin/sh) which seems some kind of insecure ...
2
votes
1answer
2k views

How could I make a MsAccess Frontend and Mysql Backend more user aware?

I have a distributed MsAccess front-end database which uses a mysql backend. It uses the Windows System DSN ODBC connections to connect to the server. All my Linked tables refer to that ODBC ...
3
votes
1answer
96 views

Security issue with ssh on Debian server

I have setup Debian Squeeze on an old laptop to serve as a testbed. I have installed OpenSSH and edited /etc/ssh/sshd_config to use ssh keys and disallow password authentication. I am able, however, ...
-5
votes
2answers
474 views

Email Administrator on failed login

Is there a way to have the server email me when there is a failed login? I have hundreds of hacking attempts and I'd like to know as soon as it happens. Thanks! <--- Woot! I'm making progress!!!! ...
0
votes
2answers
86 views

Disable Server Login upon Updates Reboot

I have a co-located Dedicated Server running Windows 2008 R2. It is a Live server running my sites (wordpress, joomla, etc) I administer it via Remote Desktop. Everytime I do the Microsoft OS ...
2
votes
1answer
396 views

Identifying repeated, failed login attempts as Administrator on Windows network

I have a small network with a couple of Windows XP machines experiencing random reboots. When the computer restarts, it comes to the login prompt with 'admin' in the username field, even though the ...
3
votes
1answer
147 views

Staff using login details that do not belong to them, is it legal in a PCI compliant system? [closed]

I've got a current problem at work (i'm an IT manager) whereby users are logging into some of our systems using an account which is actually someone elses. We have to be PCI compliant (you should ...
0
votes
2answers
249 views

Configure user login and stored procedures permissions on SQL Server

I'm a software developer finishing a web application. The app uses the database "DB1" in my SQL Server 2008 "SQLServer_1". I would like to create a limited user that the web app will use in its ...
1
vote
3answers
638 views

MSSQL Mirroring Failover: Login failed for user

When MSSQL DB Mirroring fails over, our script won't login, fails on: Cannot open database requested by the login. The login failed. Login failed for user ... The way I can fix this is by running: ...
2
votes
5answers
2k views

How to log commands/logins in linux?

I'm feeling that some people are using the root, how i can log all commands and connections times including ips made to the server (ssh) from all users? history command is not enough
3
votes
3answers
382 views

Logins with only HTTP - are they as insecure as I'm thinking?

Recently I was thinking about how websites like gmail and amazon use HTTPS during the login process when accessing your account. This makes sense, obviously, since you're typing in your account ...
0
votes
3answers
3k views

Disable audit of Logon Logoff

I have a SBS 08 with 50 users on my domain. In Event Viewer : Windows Logs > Security, I've got nearly 300,000 events about EventID 4624 Logon, 4634 Logoff, 4776 Credential Validation, 4769 Kerberos ...
1
vote
1answer
69 views

Card Reader and Software

I am looking for a card-reader solution that includes not only the physical card-reader but a method to read/program the cards. The end goal is have to give my end users a card-reader and then an ...
1
vote
1answer
2k views

What could cause these “failed to authenticate” logs other than failed login attempts (OSX)?

I've found this in the Console logs: 10/03/10 3:53:58 PM SecurityAgent[156] User info context values set for tom 10/03/10 3:53:58 PM authorizationhost[154] Failed to authenticate user ...
8
votes
4answers
647 views

Remote Root Login

I know one of the first things you do to secure a server is disallowing remote root login. Passwords are pretty weak; what do people think of only allowing root login via ssh keys or other ...
0
votes
1answer
2k views

Configure Fail2ban to ignore local (NAT) IPs

How can I configure fail2ban to always allow attempts from the local/NAT ips (ie 192.168.1.*). I have tried putting the following entry into /etc/fail2ban/jail.conf: [DEFAULT] # "ignoreip" can be ...
0
votes
3answers
67 views

Email sent upon Login in Windows Server

Is it possible to configure in Windows Server 2008 to have an email sent to a specified address when a specific user account has successfully logged in? We want to be notified of when a particular ...
2
votes
2answers
639 views

What's the best way to get notified of a user login on Linux?

I'm currently using gentoo and have the following method of knowing when anyone logs into my server (it's really just me, but if anyone were to gain access, I'd want to know about it) 1) Use sec to ...
0
votes
2answers
875 views

Trouble getting FTP login to work in IIS6

I'm trying to setup an FTP site for one of my clients to retrieve files from my organization using IIS6. I've created the FTP site, have set to not isolate users (not necessary as FTP will be read ...
1
vote
5answers
140 views

Sharing Team Members Login Accounts

This question is probably quite subjective, but it's one that I'd like to know what others are doing. In most organizations there comes a time when a team member is out of the office on vacation, ...
2
votes
5answers
551 views

Linux: How do I disable any kinds of remote control for a certain user?

How do I disable any kinds of remote control (SSH, X, NFS, SMB, ... what else?) for a certain user? Or, asked the other way round: How do I disable remote control for all users except a certain one? ...
5
votes
5answers
3k views

Send email when anyone logs on

My CentOS/RHEL system may have been hacked, I'm not sure. But I'm playing it safe by creating a new slice from scratch. I've installed tripwire, but I'd also like to be emailed when anyone logs in. I ...
7
votes
4answers
18k views

How to configure vsftpd to allow root logins?

I'm on SLES 10.1, and trying to configure vsftpd to allow root logins. Does anyone know how to do this? So far, I have this: local_enable=YES chroot_local_user=NO userlist_enable=YES ...
5
votes
7answers
6k views

Should I use a login banner and if so, what should it say?

Are interactive login banners worth having? The general consensus is that they are, but what should the banner say? Some things that are being considered (no particular order): ownership of the ...
4
votes
4answers
3k views

How do I monitor failed logon attempts in Windows?

Is there any reliable way to monitor failed logon attempts on-the-fly in Windows XP? (well, Vista too for that matter). I need to monitor failed logon attempts programmatically which is currently ...
4
votes
3answers
200 views

Permissions for shipping SQL Server 2005 transaction logs

I'm trying to ship transaction logs from Server A to Server B. I keep getting permission denied errors when the agent tries to run because it isn't using the right credentials to connect to the backup ...
4
votes
4answers
11k views

How to display last login time when logging into a Windows server?

We have been tasked with a security requirement to display the last time a user was logged into the server upon login on our Windows 2003 and 2008 servers. This would apply to local and AD accounts. ...
14
votes
7answers
4k views

Should we disable the root user?

Should we remove the root password, disable remote login and basically require adminstrators to use sudo to perform administrative actions?
7
votes
3answers
9k views

Why won't automatic login through ssh with authorized_keys work?

I have created a private/public dsa-keypair. I've put the public key on the server in ~/.ssh/authorized_keys Everything is set up like my other server, but it seems like the server is just ...