The tag has no wiki summary.

learn more… | top users | synonyms

6
votes
2answers
331 views

For an internet-facing, all-roles-in-one Exchange server, what do I need to let through the firewall?

As the result of a recent penetration test, in which we did not fare well, it has been brought to my attention that our internet facing, all-roles-in-one, Exchange 2010 SP3 server has no firewall in ...
1
vote
1answer
71 views

Are department-wide shares a bad idea?

Let's say an organization has a department with 10-15 users who sometimes need to share files between each other. They currently have an open share, where anyone read read / write to the share. If ...
0
votes
0answers
33 views

Server 2012 LDAP signing - “Number of simple binds performed without SSL/TLS..”

Here is our log on event 8227: Number of simple binds performed without SSL/TLS: 88 Number of Negotiate/Kerberos/NTLM/Digest binds performed without signing: 0 I have set LDAP Interace Events ...
-3
votes
1answer
63 views

Securing a LAN whose wires cross over public hallway? [closed]

I want to record video in rooms (A B C) and start/stop/monitor the recordings from (only) room D. There is a public hallway separating D from the rest, and the data is sensitive. Preliminary setup ...
1
vote
3answers
263 views

Why does Windows Server 2012 R2 recognize a local administrator over the network for some purposes but not others?

I have researched this at length, but cannot find a solution to the specific issue I'm getting. Evidently there are a number of similar issues that regularly cause problems for people trying to ...
2
votes
4answers
465 views

/etc/hosts.deny ignored in Ubuntu 14.04

I have Apache2 running on Ubuntu 14.04LTS. To begin securing network access to the machine, I want to start by blocking everything, then make specific allow statements for specific subnets to browse ...
2
votes
3answers
155 views

Is there any point securing a “guest” wifi network with WPA?

We have a guest wifi network setup on a separate VLAN, using an open connection (e.g. NO wpa/wep). A (semi-technical) customer recently complained that he wasn't happy about his traffic not being ...
0
votes
0answers
107 views

How to config Squid SSL bump to let Paloalto PA series firewall recognize App-ID

A Paloalto firewall(PA-2050,POS 4.1x) was capable of recognizing the websites which users are visiting(thru http/https) then flag them with a App-ID and apply application control on the traffic, for ...
-1
votes
1answer
111 views

Designing a secure network layout

Over the last few years I've accumulated a lot of hardware that all currently exists on a flat network. There are a number of devices: my desktop, laptop, and computers of the rest of the people I ...
2
votes
1answer
141 views

How can I enforce TLS in sendmail when I don't necessarily know the hostname of the downstream MTA (only IPs)? [e.g. by recipients' domain]

I'm running SendMail 8.14 and have some custom static routes for sending to certain domains. These domains are "internal" but not managed directly by me. Here's an example of ...
0
votes
0answers
67 views

Trouble getting started with the STEALTH monitoring package

Is anyone here familiar with the Linux-based STEALTH package (for monitoring FS integrity of client systems)? I'm trying to get started with a very simple configuration, but I'm running into trouble ...
0
votes
1answer
54 views

Reading .pcap files by CISCO ASA5515-X

I have .pcap file that already includes thousands of packets. I want to analyze these packets via CISCO ASA5515-X to observe how much of them are possible to be an attack packet (malicious). However, ...
-6
votes
1answer
616 views

In standalone Windows, safely force all apps to use AppData\Local\ instead of AppData\Roaming\ and Hardening security [closed]

In "standalone" or individual windows (vista & above: Vista, Win7, Win8, Win8.1, etc OS based) computers & tablets, which are configured to use only "TCP/IP" network component, each has ...
2
votes
1answer
434 views

SynFlood attack, spoofed IPs, syncookies mitigation

Due to a recent increase in SynFlood attacks on my company's systems i've been testing by Syn flooding the hosts myself to see how easy they are to disrupt, and the answer is 'quite easy'. By using a ...
0
votes
1answer
404 views

Can dd-wrt do a firmware autoupdate?

I need to get a new company router but am looking for a secure but low cost solution. My first idea was to get a 20€ TP-link router and flash it with DD-wrt, but the latest firmware is a year old and ...
2
votes
2answers
541 views

Exchange 2010 allows outside access to network files

One of our users discovered by accident he could access our network files from his smartphone while at home. No VPN needed. He was sent an email with an internal link to a network share on his ...
0
votes
2answers
40 views

How can I sync servers configurations

I'm looking for a way for 1 server lcoated in Switzerland (acting as a web/db server) to share/sync files like deny.hosts and iptables rules to my other server (dns/mail) located in North America in a ...
-2
votes
2answers
652 views

List of TCP & UDP ports known to be used by malware, etc [closed]

Where can I find a regularly updated, downloadable list of TCP & UDP ports that are known to be commonly used by malware, trojans, etc.? This is for import into an IT asset management system to ...
1
vote
2answers
757 views

How can I block a malicious port scanner currently running on my server? [duplicate]

I'm currently attempting to clean and secure a server that has pnscan running on it. This instance of pnscan was installed by an outside party most likely to use our server as part of a port scanning ...
0
votes
1answer
40 views

How communication works to connect server with or without VPN [closed]

When I ssh into my companies server without using VPN, then I get then quite understandably it cannot connect. Once I log into the companies VPN, I am able to connect. Breaking my questions down: ...
13
votes
1answer
501 views

“Hostile” network in the company - please comment on a security setup

I have a little specific problem here that I want (need) to solve in a satisfactory way. My company has multiple (IPv4) networks that are controlled by our router sitting in the middle. Typical ...
1
vote
1answer
282 views

DDoS attack simulation using MININET

I´m developing some dynamic security policies using SDN, one of them consist in how the network should respond to a DDoS attack detection. So, I would like to test my policies but I'm having some ...
5
votes
2answers
286 views

Best place in network to put syslog server for DMZ hosts?

I have a firewalled router that connects to two virtual Lans. The first lan is an administration network and the second a DMZ. My virtual machines in the DMZ need to send syslog messages to a syslog ...
1
vote
2answers
189 views

How secure its to run the EtherApe as root?

I need to monitor network traffic and EtherApe seems to be nice graphical utility. But the Wikipedia entry says sth like this : Security: EtherApe requires root privileges to run. As such, there ...
6
votes
4answers
883 views

How can I block outside mail FROM postmaster@mydomain.com?

A security firm has been testing my mail server and claims my Postfix daemon is an open relay. The evidence is as follows (valid public IP for mail.mydomain.com has been changed to 10.1.1.1 for ...
4
votes
3answers
391 views

How to prevent a user from being able to plug an XP machine into the network

We recently had an issue where a user brought their laptop in from home and plugged it into the network, attempting to get internet access. I know on a port level I could setup MAC restrictions, but ...
0
votes
2answers
66 views

Enumerating Wifi devices on a network

I'm trying to monitor what devices are active in a Wifi network. This is specifically about mobile phones that connect to a Wifi-Router. While I do know how to enumerate Wifi networks in reach I would ...
0
votes
1answer
113 views

Providing root ssh access to virtual servers behind NAT? [duplicate]

We are a web hosting company. We have 4 Servers which are running OpenVZ on top of CentOS. Each of the server has around 50 containers running on top of it. We are planning to provide ssh root ...
1
vote
1answer
63 views

Does an ip catch all exist?

I'm trying to block specific ip address traffic using this: sudo iptables -A INPUT -s 192.148.10.209 -j DROP Does an ip address catch all exist where I could block all addresses on 192.148.10.* ...
1
vote
3answers
668 views

Securing a guest VM to give it internet access, but block access to host LAN

I have a Linux guest VM running under a Windows host. If I set the networking mode to NAT, the guest can get internet access (which I want), but can also access the hosts LAN (which I dont). For ...
0
votes
1answer
369 views

How to unblock exe-file and windows-help-chm-file on a mapped network drive using Windows Server 2008 Active Directory group policy?

We have a mapped drive M: in our Server 2008 R2 64 AD Domain. There is an important exe and a windows help file on the drive that all users need to access from there. How can I remove the security ...
2
votes
1answer
106 views

allowing forwarding on a root server, security risk?

Having a root server without iptables rules (I know this is not good, it's just temporary tho in my case), and having configuration like this (for VPN reason): echo 1 > ...
2
votes
1answer
234 views

Software to prevent daemons from binding/listening to local ports?

Having an issue with some not-so-bright developers creating daemon processes that are binding to the (not actually reserved) local ports on our Linux servers. Those ports being defined in: cat ...
2
votes
1answer
387 views

cross region security amazon ec2

At the moment, because it isn't possible to specify a security group from another region when allowing port access using amazon ec2's security groups, we have had to insert each individual IP into the ...
31
votes
3answers
2k views

What kind of network attack turns a switch into a hub?

I read an article today describing how a penetration tester was able to demonstrate creating a fake bank account with a $14 million balance. However, one paragraph describing the attack stood out: ...
1
vote
1answer
690 views

Network Services Write/Modify Permissions on Inetpub Folder Potiential security issues

I have an asp.net web application that runs as a Content Management system for a website. It was originally on an IIS6 Server. However the web application was recently moved to an II7 Server. After ...
4
votes
2answers
187 views

How should I secure a corporate wireless network?

We are implementing a new WiFi network at my work, and I am trying to think through a design of the security for the network. Use case 1: guests. We will have a captive portal setup, guests will ...
2
votes
2answers
149 views

Log incoming and outgoing connections on my Leased Line

I am a System Administrator at a college where we have a leased line internet connectivity and 32 Static IPs. The Local; network is running behind the Juniper Firewall. Now I would like to log all the ...
0
votes
1answer
771 views

Where should I setup a staging environment in Amazon VPC? And testing?

I setup the production environment for my service in an Amazon VPC in Oregon: 2 availability zones 1 public subnet (including bastion, nat, and ELBs) and 3 private subnets (database, web servers and ...
3
votes
1answer
867 views

Should I dual home our webservers (DMZ/Internal network) or just do 1-to-1 NAT?

I'm setting up a rack of servers which will have 2 webservers and 10 internal servers that provide back end application support (migrating from an AWS environment). We'll have virtual machine ...
0
votes
2answers
482 views

configure iptables to allow in/out bound connections from the WAN (web) and only a couple pcs on the LAN while blocking anything else

I have a Xen server with several Virtual Machines on it sitting along side normal pcs on my LAN. The VMs host content bound for web access. Httpd is one of them so lets use that as an example. I ...
0
votes
3answers
262 views

Netflow/IPfix Analyzer for network threats and anomalies

I'm evaluating various options for Netflow/IPfix based analyzers which focus on identifying security threats and anomalies. It would be highly appreciated if someone can provide a list of tools with ...
0
votes
1answer
82 views

Securing a switch

I have switch (HP ProCurve 1810-24G to be exact) and it's placed in a datacenter. To secure the switch, there's a lenghty password on it. But, there's one great downside: anyone with the IP address ...
-1
votes
1answer
78 views

Securing network: Windows XP 64 bit Professional [closed]

For a small office network (e.g. 6 machines on LAN), using Windows XP 64 bit Professional as the OS on the server machine, I want to enable sharing of files on the server machine NTFS hard-drive ...
2
votes
1answer
265 views

Disable external Java apps network-wide

According to US CERT TA13-010A, all computer users are advised to disable Java 1.7 in their browser due to arbitrary code execution risks from a zero-day Java vulnerability; however, we rely on ...
0
votes
0answers
117 views

Firewall is down, but I still can't connect in from outside (Ubuntu)

I'm very confused right now. I have a server, Sahand, that I can connect from on campus too without issue. There's another server, Dena, that shares the same switch, etc.. also can connect to it. ...
2
votes
1answer
882 views

shouldn't /etc/hosts.deny be intercepting this before it hits ssh logs?

I'm using a combination of /etc/hosts.deny and ufw on my ubuntu 10.04.04 server. Most days, I see failed ssh attempts from machines in the .com.cn domain, reported like so: Failed logins from: ...
2
votes
0answers
30 views

OpenVPN bad source address from client [duplicate]

Possible Duplicate: OpenVPN bad source address from client I have one problem with OpenVPN. There are a lot drops records in the openvpn log file on the server: Mon Oct 22 10:14:41 2012 ...
2
votes
2answers
240 views

Hyper-V Manager - Host Access During a Catastrophe

How can I ensure that I can always have Hyper-V Manager access to a Hyper-V server, even in the event that the Active Directory Server is down (in a domain-login environment)? Background: The one ...
0
votes
2answers
69 views

Secure every connection between endpoints

Sometimes one has to work with software that hasn't built in security-features for non-local connections. In fact, some client-libraries are sending credentials in clear text over the wire. On the ...