The tag has no wiki summary.

learn more… | top users | synonyms

31
votes
3answers
2k views

What kind of network attack turns a switch into a hub?

I read an article today describing how a penetration tester was able to demonstrate creating a fake bank account with a $14 million balance. However, one paragraph describing the attack stood out: ...
13
votes
1answer
501 views

“Hostile” network in the company - please comment on a security setup

I have a little specific problem here that I want (need) to solve in a satisfactory way. My company has multiple (IPv4) networks that are controlled by our router sitting in the middle. Typical ...
9
votes
3answers
4k views

Is there danger to virtualizing a router?

I had read on a few forums about pfSense that said it was dangerous to virtualize pfSense. The reason that was stated was an attacker could use pfsense as a spring board for an attack on the ...
9
votes
1answer
1k views

Configuring WPA2-Enterprise with Freeradius

I'm trying to set up an authenticated wifi network with Freeradius. I've managed to get things working using self-signed certs etc. The problem is Windows clients need to uncheck the "Automatically ...
6
votes
4answers
883 views

How can I block outside mail FROM postmaster@mydomain.com?

A security firm has been testing my mail server and claims my Postfix daemon is an open relay. The evidence is as follows (valid public IP for mail.mydomain.com has been changed to 10.1.1.1 for ...
6
votes
2answers
326 views

For an internet-facing, all-roles-in-one Exchange server, what do I need to let through the firewall?

As the result of a recent penetration test, in which we did not fare well, it has been brought to my attention that our internet facing, all-roles-in-one, Exchange 2010 SP3 server has no firewall in ...
5
votes
2answers
284 views

Best place in network to put syslog server for DMZ hosts?

I have a firewalled router that connects to two virtual Lans. The first lan is an administration network and the second a DMZ. My virtual machines in the DMZ need to send syslog messages to a syslog ...
4
votes
2answers
187 views

How should I secure a corporate wireless network?

We are implementing a new WiFi network at my work, and I am trying to think through a design of the security for the network. Use case 1: guests. We will have a captive portal setup, guests will ...
4
votes
3answers
391 views

How to prevent a user from being able to plug an XP machine into the network

We recently had an issue where a user brought their laptop in from home and plugged it into the network, attempting to get internet access. I know on a port level I could setup MAC restrictions, but ...
3
votes
1answer
865 views

Should I dual home our webservers (DMZ/Internal network) or just do 1-to-1 NAT?

I'm setting up a rack of servers which will have 2 webservers and 10 internal servers that provide back end application support (migrating from an AWS environment). We'll have virtual machine ...
3
votes
2answers
253 views

Is Windows Server 2008R2 NAP solution for NAC (endpoint security) valuable enough to be worth the hassles?

I'm learning about Windows Server 2008 R2's NAP features. I understand what network access control (NAC) is and what role NAP plays in that, but I would like to know what limitations and problems it ...
2
votes
3answers
155 views

Is there any point securing a “guest” wifi network with WPA?

We have a guest wifi network setup on a separate VLAN, using an open connection (e.g. NO wpa/wep). A (semi-technical) customer recently complained that he wasn't happy about his traffic not being ...
2
votes
3answers
158 views

What are some topics you'd like to see covered in an 'Introduction to Network Security' book?

I'm trying to put together a list of topics in Network Security and prioritize them accordingly. A little background on the book - we are trying to gear the text towards college students, as an ...
2
votes
2answers
240 views

Hyper-V Manager - Host Access During a Catastrophe

How can I ensure that I can always have Hyper-V Manager access to a Hyper-V server, even in the event that the Active Directory Server is down (in a domain-login environment)? Background: The one ...
2
votes
2answers
456 views

Blocked connections passing through firewall. What is wrong?

In our company we have a small business router (Cisco RV082) on which we are using its standard configuration (block all incoming traffic). We also have an SMTP relay configured (using WS2008R2) so ...
2
votes
2answers
535 views

Exchange 2010 allows outside access to network files

One of our users discovered by accident he could access our network files from his smartphone while at home. No VPN needed. He was sent an email with an internal link to a network share on his ...
2
votes
1answer
141 views

How can I enforce TLS in sendmail when I don't necessarily know the hostname of the downstream MTA (only IPs)? [e.g. by recipients' domain]

I'm running SendMail 8.14 and have some custom static routes for sending to certain domains. These domains are "internal" but not managed directly by me. Here's an example of ...
2
votes
1answer
383 views

cross region security amazon ec2

At the moment, because it isn't possible to specify a security group from another region when allowing port access using amazon ec2's security groups, we have had to insert each individual IP into the ...
2
votes
2answers
149 views

Log incoming and outgoing connections on my Leased Line

I am a System Administrator at a college where we have a leased line internet connectivity and 32 Static IPs. The Local; network is running behind the Juniper Firewall. Now I would like to log all the ...
2
votes
1answer
881 views

shouldn't /etc/hosts.deny be intercepting this before it hits ssh logs?

I'm using a combination of /etc/hosts.deny and ufw on my ubuntu 10.04.04 server. Most days, I see failed ssh attempts from machines in the .com.cn domain, reported like so: Failed logins from: ...
2
votes
4answers
455 views

/etc/hosts.deny ignored in Ubuntu 14.04

I have Apache2 running on Ubuntu 14.04LTS. To begin securing network access to the machine, I want to start by blocking everything, then make specific allow statements for specific subnets to browse ...
2
votes
1answer
264 views

Disable external Java apps network-wide

According to US CERT TA13-010A, all computer users are advised to disable Java 1.7 in their browser due to arbitrary code execution risks from a zero-day Java vulnerability; however, we rely on ...
2
votes
1answer
430 views

SynFlood attack, spoofed IPs, syncookies mitigation

Due to a recent increase in SynFlood attacks on my company's systems i've been testing by Syn flooding the hosts myself to see how easy they are to disrupt, and the answer is 'quite easy'. By using a ...
2
votes
1answer
105 views

allowing forwarding on a root server, security risk?

Having a root server without iptables rules (I know this is not good, it's just temporary tho in my case), and having configuration like this (for VPN reason): echo 1 > ...
2
votes
1answer
232 views

Software to prevent daemons from binding/listening to local ports?

Having an issue with some not-so-bright developers creating daemon processes that are binding to the (not actually reserved) local ports on our Linux servers. Those ports being defined in: cat ...
2
votes
0answers
30 views

OpenVPN bad source address from client [duplicate]

Possible Duplicate: OpenVPN bad source address from client I have one problem with OpenVPN. There are a lot drops records in the openvpn log file on the server: Mon Oct 22 10:14:41 2012 ...
1
vote
2answers
754 views

How can I block a malicious port scanner currently running on my server? [duplicate]

I'm currently attempting to clean and secure a server that has pnscan running on it. This instance of pnscan was installed by an outside party most likely to use our server as part of a port scanning ...
1
vote
1answer
63 views

Does an ip catch all exist?

I'm trying to block specific ip address traffic using this: sudo iptables -A INPUT -s 192.148.10.209 -j DROP Does an ip address catch all exist where I could block all addresses on 192.148.10.* ...
1
vote
2answers
324 views

Malware scanners for apache log files

Are the any malware/security scanners out there, that can analyze apache error and access logs and tell me if I have potential risks on my server or if there is unauthorized access etc. ?
1
vote
2answers
187 views

How secure its to run the EtherApe as root?

I need to monitor network traffic and EtherApe seems to be nice graphical utility. But the Wikipedia entry says sth like this : Security: EtherApe requires root privileges to run. As such, there ...
1
vote
3answers
666 views

Securing a guest VM to give it internet access, but block access to host LAN

I have a Linux guest VM running under a Windows host. If I set the networking mode to NAT, the guest can get internet access (which I want), but can also access the hosts LAN (which I dont). For ...
1
vote
2answers
324 views

Where Can I get good certification as server admin? [closed]

I programmer without job. Where Can I get good security network certification (online ) as server admin, that will help me to get better Job? Thanks
1
vote
3answers
260 views

Why does Windows Server 2012 R2 recognize a local administrator over the network for some purposes but not others?

I have researched this at length, but cannot find a solution to the specific issue I'm getting. Evidently there are a number of similar issues that regularly cause problems for people trying to ...
1
vote
1answer
281 views

DDoS attack simulation using MININET

I´m developing some dynamic security policies using SDN, one of them consist in how the network should respond to a DDoS attack detection. So, I would like to test my policies but I'm having some ...
1
vote
1answer
263 views

How can i enter in Network Security Field [closed]

I am thinking of Entering in Network Security Field. It can be securing windows network , linux network But exactly don't ave the full picture how does that area is divided I only have the vague ...
1
vote
1answer
688 views

Network Services Write/Modify Permissions on Inetpub Folder Potiential security issues

I have an asp.net web application that runs as a Content Management system for a website. It was originally on an IIS6 Server. However the web application was recently moved to an II7 Server. After ...
1
vote
1answer
117 views

secure L2 connection

Due to some rapid changes I need to also provide vlan(s) in a new location. The topology looks like this: (main location, vlans:id=6(workstations),id=8(phones)) | my_switch01 \ \ ...
0
votes
2answers
111 views

last night, my server was doing something intensive with the hard drive

I have an ubuntu server running in my bedroom. It's connected to the internet. Last night, at 5am, it was doing some intensive i/o with the hard drive (I heard it) for like 20 minutes. I don't have ...
0
votes
1answer
66 views

Are department-wide shares a bad idea?

Let's say an organization has a department with 10-15 users who sometimes need to share files between each other. They currently have an open share, where anyone read read / write to the share. If ...
0
votes
2answers
40 views

How can I sync servers configurations

I'm looking for a way for 1 server lcoated in Switzerland (acting as a web/db server) to share/sync files like deny.hosts and iptables rules to my other server (dns/mail) located in North America in a ...
0
votes
1answer
40 views

How communication works to connect server with or without VPN [closed]

When I ssh into my companies server without using VPN, then I get then quite understandably it cannot connect. Once I log into the companies VPN, I am able to connect. Breaking my questions down: ...
0
votes
3answers
261 views

Netflow/IPfix Analyzer for network threats and anomalies

I'm evaluating various options for Netflow/IPfix based analyzers which focus on identifying security threats and anomalies. It would be highly appreciated if someone can provide a list of tools with ...
0
votes
2answers
69 views

Secure every connection between endpoints

Sometimes one has to work with software that hasn't built in security-features for non-local connections. In fact, some client-libraries are sending credentials in clear text over the wire. On the ...
0
votes
1answer
333 views

Securing windows 7 based kiosk on network

What steps should be taken to secure a kiosk running windows 7 and a proprietary application on a network? The kiosk requires the ability to make outgoing calls over port 443. I am looking for advice ...
0
votes
1answer
396 views

Can dd-wrt do a firmware autoupdate?

I need to get a new company router but am looking for a secure but low cost solution. My first idea was to get a 20€ TP-link router and flash it with DD-wrt, but the latest firmware is a year old and ...
0
votes
2answers
66 views

Enumerating Wifi devices on a network

I'm trying to monitor what devices are active in a Wifi network. This is specifically about mobile phones that connect to a Wifi-Router. While I do know how to enumerate Wifi networks in reach I would ...
0
votes
1answer
112 views

Providing root ssh access to virtual servers behind NAT? [duplicate]

We are a web hosting company. We have 4 Servers which are running OpenVZ on top of CentOS. Each of the server has around 50 containers running on top of it. We are planning to provide ssh root ...
0
votes
1answer
368 views

How to unblock exe-file and windows-help-chm-file on a mapped network drive using Windows Server 2008 Active Directory group policy?

We have a mapped drive M: in our Server 2008 R2 64 AD Domain. There is an important exe and a windows help file on the drive that all users need to access from there. How can I remove the security ...
0
votes
1answer
771 views

Where should I setup a staging environment in Amazon VPC? And testing?

I setup the production environment for my service in an Amazon VPC in Oregon: 2 availability zones 1 public subnet (including bastion, nat, and ELBs) and 3 private subnets (database, web servers and ...
0
votes
2answers
481 views

configure iptables to allow in/out bound connections from the WAN (web) and only a couple pcs on the LAN while blocking anything else

I have a Xen server with several Virtual Machines on it sitting along side normal pcs on my LAN. The VMs host content bound for web access. Httpd is one of them so lets use that as an example. I ...