Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
0answers
5 views

snort fails to run in IDS mode

I installed snort-2.9.7 from sources, and try to run it: % snort -dev -h 10.10.10.0/24 -l /var/log/snort/ -c /etc/snort/snort.conf ... "afpacket DAQ configured to inline. ERROR: Can't initialize DAQ ...
0
votes
2answers
23 views

Does Ubuntu 12.04LTS have the OpenSSL heartbleed fix?

Only OpenSSL 1.0.1f or later has the fix for the heartbleed exploit. So does Ubuntu 12.04LTS have the fix? We need to use 12.04LTS for reasons I won't go into, and we can't upgrade. According to this ...
0
votes
0answers
16 views

how do I set restrict anonymous to 2

I want to change the registry setting for restrictanonymous to "2" (HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous). I created a script to do this but noticed the setting kept on going ...
0
votes
0answers
20 views

Application-role based access with nginx?

What are some different ways to configure nginx to allow static file access based on application-defined roles that a user belongs to? (Not local system user groups or roles, just roles defined at the ...
0
votes
4answers
396 views

Permissions set to 555. How can another user modify the files? [duplicate]

I run an Ubuntu 12.04 x64 VPS with Vesta, and a site in PHP. It has been hacked several times with injected code that looks like this: <?php ...
0
votes
1answer
33 views

Apache 2.4 Restrict url to all except certain IP address in ubuntu 14.04

I know there are several Questions similar to this but none of them worked for me, Here im trying to block "example.com/phpmyadmin" to all except my public ip "a.b.c.d" and "x.x.x.x" . i have used ...
0
votes
1answer
34 views

Tools for scanning database for viruses [on hold]

I wonder if anyone knows some useful tool for scanning threats like sqlinjection, command injection in mysql databases? The db is for multiple wordpress, drupal installations. The first step obviously ...
4
votes
2answers
70 views
+50

Fixing the IIS tilde vulnerability

One of our IIS servers (IIS 7.5, Server 2008 R2) is apparently "vulnerable" to the tilde Short Filename disclosure issue. However, I'm having a hard time actually fixing the issue. So far, I've ...
1
vote
1answer
67 views

In OpenVPN, what's the risk of omitting the key-direction when using tls-auth?

In my TLS enabled OpenVPN configuration I would like to use the additional security offered by using tls-auth. The good news is, is that it works as expected. However, I have a question about the ...
0
votes
1answer
68 views

https and ssh access to OpenVPN from windows

I recently installed OpenVPN on a remote CentOS 7 web server. I am able to connect to it from a local CentOS 7 devbox by typing openvpn --config /path/to/client.ovpn. Once the connection is made, I ...
0
votes
1answer
19 views

How to I assign OWNER RIGHTS permissions to a file in Windows 7?

When I run ICACLS on a file, it returned: foobar.LDF OWNER RIGHTS:(OI)(CI)(F) BUILTIN\Administrators:(OI)(CI)(F) What securityid do I pass to icacls to assign to the generic user ...
0
votes
1answer
18 views

tacacs+ for Linux authentication/authorization using pam_tacplus

I am using TACACS+ to authenticate Linux users using pam_tacplus.so PAM module and it works without issues. I have modified the pam_tacplus module to meet some of my custom requirements. I know by ...
0
votes
0answers
10 views

give serverprincipalname read write permissions to security group members

What are the settings for the group to make the following change? I need to create a group that can be used to grant: serviceprincipalname SELF Read serviceprincipalname SELF Write to its members. ...
2
votes
1answer
40 views

Use VPS provider's kernel or maintain my own?

I've got a Debian Wheezy VM on Linode and they run it with their own kernel. As a reputable company, I'm sure they're quick to apply security patches, and all I need to do is reboot to get the new ...
0
votes
0answers
4 views

smb.conf - where do I set key and certificate for 'smb encrypt' transport encryption?

Reading smb.conf man page I can enforce encrypted smb transport; smb encrypt = mandatory. Where do I set the keys to use for the encrypted transport? I was expecting something like apache2: ...
-1
votes
0answers
11 views

apt repository signature and key verification

Is there a way to verify the integrity and authenticity of apt-get packages i.e. 1- How can I be sure that its not man-in-middle 2- is there a way to enable public key/cert verification in apt, to ...
0
votes
0answers
19 views

Is it possible to break out of a “trap 1 2 3” secured terminal session by using SIGSEGV?

The title says it mostly. I'm auditing the security of a terminal-based application on AIX, and the way you use it is to connect to it remotely through telnet, where the ".profile" of the telnet user ...
-5
votes
0answers
22 views

Server Approach to pitch to Management? [closed]

So, as a client who got hacked, I looked at myself and said "self", what did I do wrong? Your corp "help" desk is flooded with "doh" attitude every second of every day. Yet, it occurs to me, if Your ...
0
votes
1answer
22 views

snort complains on local.rules

I just installed snort-2.9.7.0 on Fedora 20, and am getting error when running: % snort -c /etc/snort/snort.conf --dump-dynamic-rules=/tmp Running in Rule Dump mode --== Initializing Snort ...
1
vote
2answers
38 views

My site is suddenly getting slammed, not legitimate traffic

I run a site with about 700 registered users. On a typical day, there are 30-50 hits. In the last three days, the traffic has increased insanely fast (according to Google Analytics). I got 7,287 hits ...
-1
votes
1answer
20 views

Compiling nginx and php

Im about to set up a basic web server based on ubuntu server 14.04 x64 with an online shop section, the server will also consist mysql, mail, and maybe other servers as well until it runs smoothly. ...
0
votes
1answer
25 views

I guess that my mail server is unprotected and spammers are using my mail server to spam myself [duplicate]

Since I switch to my own mail server (I folowed this two tutorials: https://www.linode.com/docs/email/postfix/email-with-postfix-dovecot-and-mysql and ...
2
votes
1answer
20 views

What is the best way to isolate permissions to a role, where traditionally role-based security is not implemented?

The particular example I'm pursuing here is a having a deployment officer role. Typically, this would be performed by one particular employee, but that employee can get sick, fired, go on vacation, ...
-1
votes
1answer
37 views

I see a flood of requests from Revista22

In many of the sites I am running I see in Google Analytics thousands of visits referred from a site called revista22.ro, which I don't know and which mentions nothing about any of my sites. Also, I ...
-1
votes
1answer
12 views

What are the MOST Important Things to Configure on a WAF? Specifically Barracuda Web Application Firewall

I will be hosting a web application on a cloud provider. This will be protected behind a WAF specifically Barracuda's Web Application Firewall Vx. I do not have too much experience with WAF ...
0
votes
1answer
9 views

kadmin cannot list principals “requires list privileges”

I can authenticate fine via kadmin however cannot list principals? [root@server ~]# kadmin -p admin Authenticating as principal admin with password. Password for admin@org.domain.com: kadmin: ...
1
vote
5answers
107 views

How to get an early warning to someone logging into a server

I like to be notified when someone is logged into one of my Linux servers, and also be able to find out what the location of the login attempt. How can I do this?
0
votes
0answers
12 views

Securing web application used for core business process

I am writing an application which will be used for our core business workflows (client registration and management etc). I have partners and employees who are spread across the globe, so I want to ...
3
votes
4answers
444 views

Is enabling https on a Cisco router a considerable security risk?

I would like to use Cisco's Network Assistant to manage my Cisco routers (I know there are other solutions for this, but for now I've decided to use CNA). It requires the HTTP or HTTPS service to be ...
0
votes
0answers
25 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
-6
votes
1answer
51 views

how does one report an RDP attack to Microsoft when it's happening in real time?

To my surprise, Security Event 10 was for 104.43.193.6 which is apparently a Microsoft ip address: http://ip2location.com/demo/104.43.193.6 =. Microsoft Corporation. Likely AFAIK some has leased ...
0
votes
0answers
12 views

IIS App cannot write to network share on a 2012 server, fine on a 2008 server

I have a Windows 2008 R2 web server running IIS, and the app needs to write files to a folder. None of the machines are on a domain, just a local workgroup. The app pool is running as the user ...
0
votes
1answer
24 views

Modify the Windows failed logon message

Is there a way to modify the message that the user sees following the entry of an insecure password, whilst changing/resetting their password, on Windows 7 / 2008 Server machines? Basically, the ...
-1
votes
0answers
14 views

Snort disable Syslog logging

is there a way to stop the snort deamon to log his status in syslog when it's get interrupted and startet? A snipped output can be seen here http://pastebin.com/82hy2F0x Thanks fork
-1
votes
0answers
36 views

Constant virus detections [duplicate]

My antivirus has been detecting quite a few viruses/trojans lately. Mainly Backdoor:PHP/Shell.P Backdoor:PHP/WebShell.J I have been trying to identify the source of these files with no luck so ...
-3
votes
0answers
25 views

Basic User Isolation in CentOS 6

I have been tasked with setting up a shared hosting server for our intranet for different departments. What is the best way to isolate users, while still allowing them to see all files in their ...
1
vote
2answers
32 views

Why is this server generating outbound IRC connections? [duplicate]

I noticed last night whilst checking our active sessions list on our firewall for something else, that a server was generating outbound IRC connections. Last night there was around 60 connections but ...
0
votes
1answer
45 views

Block file browsing on Windows Explorer

I have a Citrix application that open Windows Explorer from a menu. The command invoked to open Explorer is: Explorer "g:\app\folder" What happens when Explorer is opened is that it shows a window ...
-1
votes
1answer
36 views

Un-Noticed Vulnerability, I need to know if i should do anything

Possible Web-Site Vulnerability. I'm not sure if this is the right place to ask this, but I am running my own website, that is still currently being developed, but since it is 'Open as Beta' it is ...
1
vote
2answers
64 views

Copying data between AWS EC2 machines

There are times where, in order to do some debugging or perhaps a manual migration, I need to copy large chunks of data from one EC2 instance to another. When the size of the data is tiny, it's simple ...
0
votes
0answers
3 views

Securing remote access to local server behind NAT router [migrated]

I want to remotely access a Linux server in my private local LAN via HTTPS and SSH. The server ist connected to my DSL router (German Fritz!Box). As I can't directly access my server because of ...
0
votes
1answer
33 views

Safest way to allow a user to write in www directory?

I mean allowing a user to modify the web files in the server. Should I change the ownership of the www directory to a certain user, or put it in a new group and give write permission, or something ...
1
vote
0answers
19 views

WebRTC Public Kiosk Security Model

I am diving into WebRTC to make a basic one-to-one video/audio connection between two endpoints. I am now struggling to determine what would be an advisable security model in the following situation: ...
1
vote
1answer
41 views

How can a PC be protected from malware without locally installed software?

I'm looking to find a way to protect PCs, without requiring locally installed software. I thought about a device such as a Watchguard that has UTM facilities and make it a transparent proxy, in ...
1
vote
1answer
36 views

HP ProCurve Vlan Isolation

Okay, so we have an HP ProCurve Switch 2824, a Zyxel router and a bunch of 2012 R2 servers. We currently have 3 VLANs in our network: 10(Public),20(Private) and 30(Management), but we'd like to have ...
2
votes
0answers
32 views

Unable to reset IPMI cipher using ipmitool: “Parameter Data does not match” – why?

In attempting to make some Dell server BMC's more secure, I followed the recommendations given elsewhere and disabled cipher 0, using the following command (ipmitool running on the host OS, which is ...
-4
votes
1answer
35 views

Is 10 character (letters and numbers mixed) password strong enough for Internet Servers? [closed]

Assuming ssh brute force attacks. Assuming the following IPTABLES configuration: DROP tcp -- anywhere anywhere tcp dpt:ssh state NEW recent: UPDATE seconds: 120 ...
0
votes
1answer
56 views

Linux glibc versions 2.18 and older - vulnerability

Server: Red Hat Enterprise Linux Server release 5.9 (Tikanga) I came to know that Linux GNU C Library (glibc) versions prior to 2.18 are vulnerable to remote code execution via a vulnerability in the ...
2
votes
1answer
31 views

IIS network scanner protection

Is there any software tool for a Windows Server (with IIS installed), where I could set up "rules" to block incoming HTTP requests with suspicious behavior? Like, say, if someone starts scanning my ...
1
vote
8answers
2k views

No success when trying to upgrade glibc on RHEL4 due to GHOST

Due to the recent GHOST vulnerability I was trying to upgrade the glibc version on our RHEL4. The command I tried using was: rpm -Uvh glibc-2.3.4-2.57.x86_64.rpm Result was: [root@rhel4-test ~]# ...