Security is not a product, but a process.

learn more… | top users | synonyms (1)

-3
votes
0answers
15 views

Is it save to grant sysadmin right to the NT AUTHORITY\NETWORK SERVICE account?

In need to install an application requiring the NT AUTHORITY\NETWORK SERVICE to have the sysadmin right. Is it safe or should I be concern by any security flaws?
-2
votes
0answers
11 views

How to detect if a specific human accesses Windows server and manipulates the data?

I have an admin access to windows server on the local network of the company. Currently, I suspect that one of the employee tried to access the server and manipulate in the data. How can I assure for ...
-1
votes
0answers
12 views

KVM CPU features security risk or performance benefit

I need to run an untrusted VM with libvirt and KVM and need decent performance. When I run virsh capabilities to see what my CPU can provide, I get: <cpu> ...
0
votes
0answers
7 views

Looking for a tool similar to the Security Advisor plugin for WHM that can run on CentOS 7 without WHM [on hold]

The startup I'm working at is setting up some new CentOS 7 servers that will host a mobile application, and some of the data is sensitive, thus, the servers need to be secured to the best of our ...
0
votes
1answer
30 views

Does the following Apache Webserver configuration block access to all URLs except one?

I am trying to prevent access to my web site except for access to the single URL "/ws/public" that everyone is allowed to view. I am running Apache WebServer in front of an Apache Tomcat which is ...
-2
votes
1answer
23 views

Windows server Allow and deny

What is the deal with this. According to my count there are for possible permissions allow (checked) deny (checked) not allow (empty) deny (checked) allow (checked) deny( empty) allow (empty) deny ...
0
votes
0answers
34 views

Site unreachable due to attack - xmlrpc.php

Today our server was not reachable. It was returning a 502. We are running Nginx 1.10 on Ubuntu 14.04. We also use PHP7 (only, no PHP5). In the logs, we got the same error from the same client (2 ...
0
votes
0answers
10 views

activate geoip settings when certain locations detected

I have a website that is attacked from time to time by ddos attackers. Such attack can disable the webpage for days. The webpage serves for few countries so if I know about the attack, the solution is ...
0
votes
0answers
26 views

Win Server 2003, security permissions are reset by SYSTEM. Why?

I've got a Windows Server 2003 with a physical drive (let's say Z:/) It's shared within my company. In the past two days the users were complaining that they do not have access to files on that drive. ...
1
vote
0answers
15 views

Install Mod_Security for Nginx without need to recompile

I've got LEMP all setup. Now I would like to add mod_security. I tried to research but all I could find are instructions on how to recompile nginx. Is there a way to add mod_security without needing ...
1
vote
1answer
33 views

Digital signature with openssl

I am trying to sign and verify a signature using an RSA key-pair. Here is how I generate the key pair (which work fine for encryption / decryption): ssh-keygen -t rsa -f mykey -N '' -b 2048 mv ...
-2
votes
0answers
34 views

How might I give secret keys to a php web page without making them readable by the apache user?

I am developing a web site which runs on a generic LAMP stack. Consider these two PHP files /web_stuff/phpbin/secrets.php /web_stuff/public_html/index.php Apache is runs as the user www-data and ...
0
votes
1answer
51 views

Network maps, best admin practises and how them saved your ass?

I am reviewing the security of a (quite large) network. There are a some thousands switches, several hundred routers, several hundred access points, tenths of FW, IPS, and so on. PCs and servers are ...
0
votes
0answers
15 views

Zentyal - Samba Issue : A logged in user cannot access home folder

0 down vote favorite I have a very strange issue : I can login to my domain with my username/password and when i try to access my home folder (lets say \Knosos\myname ) i receive an access denied ...
1
vote
1answer
30 views

Secure AD Access

I was just trying to access and Active Directory-Server via php (ldap) to be able to use Windows credentials for a Website Login. I did this using xampp on my standard Windows connecting to a Windows ...
9
votes
1answer
91 views

Where and how is the password stored for the account associated with a Windows service?

In HKLM\SYSTEM\CurrentControlSet\Services\MY-SERVICE-NAME there is the Object Name key which contains the name of the user, but I can not find the password. I am trying to understand how DP API ...
0
votes
0answers
35 views

How do I require a sudo password on Google Compute Engine instances?

The default configuration of Google Compute Engine instances allows administrators to run all commands via sudo without specifying a password. This seems like a security weakness, because the theft of ...
1
vote
1answer
52 views

We've had a ransom-ware attack - looking for help/advice

I've recently started working in a small subsidiary of a larger international organisation. My work is on the help desk, and there's 3 developers on the team, and our boss is the manager and acting ...
0
votes
0answers
31 views

Windows File Security settings

I would like some input on a problem I am working on. The scenario is as following. I have a folder which has security settings (permissions) that are inherited. One of them is a permission entry for ...
0
votes
0answers
14 views

OpenVpn Client credentials security, key crt generation

I'm curious what is Your opinion on openvpn client crt/key security In most cases (tutorials), the clients key/crt are generated on the same openvpn server, and no one cares about the future. This is ...
1
vote
2answers
69 views

Security implications of using relative paths in the PATH enivronmental variable?

We had an audit just flag us for having relative paths inside out $PATH env variable. I am uncertain if this is truly a security concern and would like to reach out to everyone to see if this is ...
0
votes
1answer
25 views

Understanding Apache rules in <Directory> directive

I have tried reading the manual although to be honest I am still finding it hard to understand and get my head around what the Order/Allow actually does. I have the following code inside a virtual ...
0
votes
0answers
27 views

How to respond to password crack on SSH server? [duplicate]

Update: I'd already read How do I deal with a compromised server? but was hoping for advice specific to a password crack (such as using fail2ban), as well as info about whether this could be an OS ...
0
votes
1answer
32 views

What is the best way to isolate vhosts on a linux server?

Firstly, I'm wondering what is the best way to isolate Apache's vhosts from each other. I suppose this has something todo with the Linux filesystem as well, since it's not a good practise to have ...
-1
votes
0answers
30 views

Variable name seemingly resetting 'itself'

I have an issue with the web-server I use where the following server-side Javascript code: var URLs = { [...] }; Keeps changing to: var URLS = { [...] }; Which seriously breaks the webpage. I've ...
1
vote
0answers
28 views

Determine server damage - File injected possibly through ProFTPD [duplicate]

I just found a file at the /tmp/ directory named .<?php passthru($_GET['cmd']);echo 'm3rg3';?> Owner and GroupOwner are "proftpd" and "nogroup", respectively, as follows: -rw-r--r-- 1 proftpd ...
2
votes
2answers
41 views

Is it possible to encrypt a virtual machine or container so the host is not able to read any of its data? [duplicate]

I'm wondering whether it would be theoretically possible for a cloud hosting provider to run an application for a customer where the customer doesn't trust the hosting provider with the data in the ...
-2
votes
0answers
10 views

Will loading passive content in secure Iframe will show up on all browsers?

Hey we would like to move our site to HTTPS, but the main question is will our passive content that hosted on 3rd party website shown in secure iframe, Example: The page on website is using HTTPS ...
0
votes
0answers
7 views

How do I supply username and password to dovecot's fts_solr plugin?

I setup solr-tomcat with password protection (on Ubuntu 16_04) and now would like to connect fts_solr from my dovecot IMAP server. However, I cannot find a way to supply username and password in the ...
1
vote
0answers
21 views

How I can look from that script runs sendmail?

my problem is that some script in php or some other script or program is sending spam. I am not able to trace where this program runs. do the following: ps aux | grep sendmail nginx 28286 0.0 ...
1
vote
0answers
16 views

How can I prevent or launch an action if an unauthorized process create/modify a file to a specific directory?

Is it possible to prevent a file from being written or modified in a specific folder if the username and the process name is different than a specific value ? If not, is it possible to trigger an ...
1
vote
0answers
44 views

What does auditd log by default (i.e. when no rules are defined?)

I installed auditd and audispd-plugins on my Debian Jessie machine and didn't touch any configuration. I see events being written to /var/log/audit/audit.log, for example: type=LOGIN ...
3
votes
1answer
325 views

How to verify installation of ImageMagick is not vulnerable to CVE-2016-3714

CVE-2016-3714 was announced on May 3, 2016. This vulnerability unfortunately goes by the name, ImageTragick and has received some press (for example, this ArsTechnica article). Until updated ...
1
vote
0answers
37 views

should I upgrade Freenas security ?

I have a freenas server for almost a year now and this is the 3th time within the month that I've received a security email with allot of failed ssh log in attempts that aren't from me or anyone I ...
0
votes
0answers
40 views

Jenkins 2.x disable initial admin setup

we're using Jenkins as a cron server adding/starting crons via api. We created a vagrant box installing the jenkins. Since version 2.0 jenkins require to create an admin account (link) before disable ...
0
votes
1answer
27 views

Modsecurity check REQUEST_URI without query parameters

Currently, I am using Modsecurity XSS prevention, but I'm having a hard time understanding how exactly I can restrict what I'm checking for in the REQUEST_URI variable. My Example: # # -=[ XSS ...
0
votes
0answers
8 views

How can I process auditd logs on the fly using ausearch?

I want to ship off logs into centralized logging (ELK). Because of the way things are, I need to do the processing on the machine that creates the logs. How can I get each new auditd event to ...
0
votes
0answers
19 views

Tripwire security

I have installed Tripwire on a temporary server to get a feel for it. Everything seems to be working (e.g. it detects changes and sends an email report). If I understand Tripwire correctly it is ...
2
votes
1answer
40 views

How to secure configuration management server

There are many configuration management software options nowadays (Chef, Puppet, CFEngine, Ansible...) which offer an architecture with their repository on a central server and clients communicating ...
3
votes
1answer
77 views

Secure Email Settings for Email Clients & for PHPMailer

I'm trying to work out how to make my outgoing/incoming email's as secure as I can possibly make them. First of all, my domain has Wildcard OV SSL Certificates, I have copies of the .csr, .crt and ...
-1
votes
1answer
22 views

Allow run /sbin/ifconfig to user

So, I want to allow some user to execute ifconfig. I'd created a special group "if" and done user to own this group. And now I'm going to do "chown root:if ifconfig". But I think: What wrong thing ...
0
votes
0answers
29 views

Having trouble getting correct information from Motion camera streaming server for fail2ban

I have a camera running a Motion streaming server, which uses simple HTTP md5 authentication, tunneled through stunnel on the server side. I'm using like to have fail2ban limit requests just for ...
2
votes
0answers
40 views

Can't find users logged in with notty via the who command

I was curious if anyone had any ideas why when I run who and who --all, I still cannot see users logged in under notty? See below: [cbennett@lstn ~]$ who --all system boot 2016-04-25 ...
-1
votes
1answer
23 views

Setting up an ssh authentication server

I have some 30 Media Temple grid servers and I need to manage the access of 15 or so developers to those servers. Is it possible, and more importantly secure, to setup a server who's only job is to ...
1
vote
0answers
75 views

How to disable Null Session Enumeration of the DC?

I am a sysadmin for a company, and we just had a Penetration Test done on our internal network, the team discovered that it is possible to perform query\enumerate our DC (Server 2012) for information ...
0
votes
1answer
38 views

What do these logs mean? Am I attacking someone?

This night my server got put in an "anti-hack" mode where I could only use a read-only FTP to download my data. They told me that I was being a threat to the network, and that these were the logs ...
0
votes
0answers
32 views

WordPress site with no traffic; MySQL reporting 300-500 queries per second, frequently crashing

My server is running Debian 7.10 (Apache 2.2.22, MySQL 5.5.47, PHP5). It's a VPS. I've tried to summarise the issue in the title. I'm running a very small, private WordPress blog which is only ...
2
votes
1answer
46 views

openSUSE installs and VMs constantly being hacked and bricked

Sorry if this is a total newbie question, but I'm doing frontend design work for a radical political organisation and ALL my installations of Linux, be they openSUSE, Ubuntu or Fedora keep getting ...
0
votes
2answers
26 views

Is it necessary to secure TCP traffic for PHP FPM over shared private VPS network?

There are lots of recommended practices and tutorials for securing various components of a LEMP/LAMP stack when running in a cluster whose private network traffic is shared by other, potentially ...
2
votes
2answers
25 views

How much protection is provided for my remote centos vps by using certificate-only root login

I have two leased centos servers, one to run mysql for backends to the web and mail server on the other, as well as data from my android apps. I am only planning to give access to the data server if ...