Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
0answers
23 views

Securing communication over LAN in VPS provider

I'm curious about best practice when connecting from app to DB in a cloud provider. A quick rundown of our setup. We have 4 servers all on the same provider, in the same region running as VPS. ...
0
votes
2answers
58 views

Why do you need the awverify CNAME record for Azure?

See i.e.: How to set up CNAME to point to Azure or the text within the azure portal: Why is this necessary in the first place? Why does pointing the domain name through an A record not prove that ...
0
votes
0answers
8 views

Disable Access popup 'some files can contain viruses or othewise'

I have an ISV app that runs compiled (lulz) in microsoft access (14.0). When users open up .pdf's off the interoffice file server they get the following popup (I've tried with dns name as well): ...
1
vote
0answers
23 views

Public Key Pinning and subdomains [on hold]

Shortly I have intend to install new webserver and I'd like to secure users a little bit more. I already have domain, (virtual) server and everything else that matters when configuring a server. ...
1
vote
1answer
36 views

Many failed ssh logins even with password authentication off

There are some bots trying to ssh (hundreds per day) all my servers at digital ocean. On /etc/ssh/sshd_config I´ve set: PermitRootLogin without-password PermitEmptyPasswords no ...
-3
votes
2answers
37 views

Modifiying a server securely [closed]

I wanted to purchase a dedicated server to host my site. I am a newcomer to this and wanted to know if I hired someone to secure the server and SSH for me, will that put me at risk? Or is there an ...
0
votes
1answer
22 views

Webmin - Disallow access by IP [closed]

I have installed a Webmin instance. I can access by both domain:port and ip:port. Is there any way to restrict access to an specific domain name and disallow direct access by IP?
8
votes
2answers
63 views

How to configure a log aggregator to authenticate data?

Background: Remote log aggregation is regarded as a way to improve security. Generally, this addresses the risk that an attacker who compromises a system can edit or delete logs to frustrate forensic ...
-1
votes
1answer
14 views

winserver2012 “closed access” permissions to folder

I have some sensitive files, that should be accessed only by a small group of users. Currently the files are stored in a folder, on a WinServer 2012 machine, and will be accessed via a mapped location ...
0
votes
1answer
20 views

How to secure communication even further between server and Apple notification servers?

I have a server running by Amazon, who has notification capabilities for the user (push notifications). I have the code all working and have no question about that. To make the push working I have to ...
0
votes
1answer
32 views

How to save output from grub-md5-crypt to a file ?

I am using Cent OS 6.5 and I want to save the generated output and md5 hash from grub-md5-crypt command to a file. The grub-md5-crypt command asks us to set a password. I want the password(which I ...
3
votes
2answers
34 views

StartSSL cert doesn't work with Dovecot/OpenSMTPD

I've an issue with my StartSSL certificate. When I try to use it to activate SSL encryption on Dovecot, I get the following error in my log when a client attempt a connection to the imap server : ...
-3
votes
0answers
46 views

Linux based security for companies - how much do you do? [closed]

So if your company is mostly Unix/Linux based on the server side (but mostly Windows on the client side), how do you go about securing the network and all workstations? I assume that you have a ...
2
votes
3answers
592 views

Remote users attempting to gain access to root mysqld

I have just reviewed my syslog file and notice a TON of entries of the following: Aug 25 13:06:17 ssrv001 mysqld: 150825 13:06:17 [Warning] Access denied for user 'root'@'61.160.232.48' (using ...
0
votes
1answer
20 views

DNS queries are high for non existent records. can safely do a 0.0.0.0 wildcard record?

I have a domain and i am use dnsmadeasy for the DNS. I have noticed the queries are up in the millions each month for records i don't even have. So is it okay to do a wildcard A record such as ...
-1
votes
2answers
19 views

okay to allow any outgoing port for sending mail

I have a small app on my centos6.6 server i am running that allows the user to send an email on a custom port and I am allowing any port to be used. Is there any security risk for allowing this app to ...
0
votes
0answers
13 views

Teamviewer webclient does not use https [migrated]

Using fiddler, I noticed that the traffic generated by the teamviewer webclient is plain http. Is that a security concern given that teamviewer themselves claim that https is used?
0
votes
0answers
41 views

Applet not allowed to run

I am running a simple applet application into my mozilla firefox browser but java blocks it. I have done all changes as suggested on different different articles like adding url to ESL, security ...
-1
votes
1answer
31 views

Server 2012 R2 TCP Timestamps

We will be having some penetration testing performed shortly and looking to clean up a few things. One of these is TCP timstamps in Windows. A simiple NMAP scan shows me a guess of the TCP timestamp ...
0
votes
0answers
16 views

configure apache to use sql server authentication using password and salt

I got a web application which I want to protect using apache authentication. I found out that it uses sha1+salt to store passwords. Since auth_mysql_module is deprecated I try to use authn_dbd_module. ...
1
vote
3answers
73 views

SSH and security guidelines

I'm trying to set-up an ubuntu server (14.04 LTS) following some security guidelines. One of these guidelines suggests to disable root user and create a new user that works as an administrator using ...
1
vote
1answer
21 views

Ubuntu production server access configuration recovery options

I have a cloud based server. I followed this guide to configure its security : http://www.rubytreesoftware.com/resources/securely-setup-ubuntu-1404-server The configuration of SSH is as follows: # ...
-2
votes
3answers
65 views

Is there a GUI tool to log and view outgoing CURL requests from a Linux server? [duplicate]

I've seen several similar questions - but none that truly answer the question. So here goes: PROBLEM: A script is being run on one of our servers that is making outgoing post (and other) requests ...
2
votes
1answer
28 views

Group Policy settings for account policies disappeared

Looking for any ideas, we discovered that our group policies (default policy) was no longer applying our account policies (password age/complexity/history etc). Our DCs still had the local policy ...
0
votes
0answers
30 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
0
votes
1answer
46 views

Linux DMZ in a Windows Network

I'm a wet-behind-the-ears reluctant sysadmin, so I'm playing catch-up here. I've come across the term DMZ before, but I never looked into it until just recently. In fact I'm still not sure exactly ...
1
vote
1answer
48 views

Using a whitelist too large for an AWS VPC Security Group

I have a large list of IPs I need to whitelist for a VPC instance. I've added as many ranges as possible to the security group until I ran out of available rules. I'm adding rules for HTTP and HTTPS ...
0
votes
1answer
9 views

How to forbid access to admin URL path in Apache config by IP subnet?

I want to only allow a private IP range to be able to access the administrator panel on my site. I found an article explaining how to do it for a specific directory path, such as /var/www/admin/, ...
0
votes
1answer
45 views

Permission issue on windows server

I have logged on to a windows server 2012 R2 machine with local admin account. I was trying to save a file on the hard drive but it says that I do not have permission to save file on the disk. I have ...
0
votes
2answers
37 views

Lost all local admin rights on domain joined computer

I'm in an unusual predicament in that there is no account I can use to add local admin rights to a computer with the exception of the Administrator account - which is disabled. On a new domain I'm ...
-1
votes
0answers
14 views

secure IIS directory traversal and command exec [duplicate]

i have a IIS 7.5 webserver that an attacker upload an aspxshell on it, is there any aspect to restrict this malicious script to it's application pool folder? like php_openbasedir thanks
0
votes
1answer
16 views

Openswan L2TP setup to allow admin user access to AWS VPC

I've got an ssh bastion host, but managing the ssh whitelist is annoying, opening ssh to the world is suboptimal. I'd like to tuck a vpn server in front. Can't get openvpn to stay connected for more ...
0
votes
1answer
18 views

mitmproxy device identification

Currently am experimenting with mitmproxy. I have a setup where I can see all the traffic that is running through. I have multiple mobile devices (ios and android). I have installed the mitm ...
0
votes
1answer
44 views

How to access AD directory user which has no read permission

While doing some testing, I have accidentally revoked Read permission for "Authenticated users" on a user in AD, and now I can not grant it again, because user is "invisible". I've done the ...
2
votes
1answer
43 views

SELinux not enforcing apache write restrictions despite being enabled

Problem in a nutshell: SELinux does not protect files and directories labeled as httpd_sys_content_t from being written, deleted or changed when new/custom document root is created. I have ...
1
vote
1answer
34 views

How can I scan files (or data streams) for virus/malware before uploading them into the server and database?

How can I scan an incoming file upload (or a datastream) into a webserver and database for virus/malware? I know how (using the excellent Clam) to scan things after they have been uploaded, but I ...
2
votes
1answer
59 views

How secure is this Nginx Config? What else can I do to optimize it further? [closed]

So I recently setup a personal GitLab server and I am using the following config with full SSL. I tried my best but what else can be done to make it better? I mostly learned what I know about ...
0
votes
0answers
23 views

Patriot Act and Office 365 [migrated]

I am not sure if this question goes here as it relates to Office 365. I have a local Exchange server which has some several spam and email reception issues (Due to an expired subscription to a spam ...
0
votes
1answer
37 views

Securing outgoing emails with logs of a web server

On the web server I am going to run rkhunter, tripwire, OSSEC, fail2ban and psad. All of those applications need to be able to send emails to notify the sysadmin. Therefore, I've: sudo apt-get ...
0
votes
1answer
55 views

Setting up two WiFi networks (one public, one private) with two routers

I would like to isolate my private WiFi network from my business's public WiFi network using two routers (so that no one on the public network can access the devices on the private network). I ...
2
votes
2answers
30 views

Linux: Detecting/thwarting system modification or use of single user mode

Working through a backup solution and could use some security assistance. Please see below. The process For our editing business, we have an offsite backup server that we update nightly using rsync ...
0
votes
1answer
45 views

Disabling TLS v1.0 with SQL & RDP

How do I disable TLS 1.0 without breaking MS SQL & RDP on Windows Server 2008 R2? If I simply disable it, RDP stops working along with MS SQL. Tried googling but I can't find a solution. Is this ...
0
votes
1answer
44 views

Strange symbols in /var/log/auth.log

I just installed fail2ban after realizing that there were tenthousands of attempts to log into one of our servers over SSH. After installing fail2ban, the log bloat stopped, but I still wanted to ...
-1
votes
2answers
42 views

Preventing a user from running a script that should only be run by a CRON job?

I have a contact form on my site which uses $HTTP requests instead of reloading on the form submit. It's a really awesome feature, but it also opens up some nasty doors. My contact form sends an ...
1
vote
3answers
60 views

Allow internal DNS to be queried from the DMZ?

We have a mail gateway running in a DMZ, which is a relay for our internal mail server holding all the mail. We have come accross the need to use DNS from the DMZ to resolve names of internal services ...
0
votes
0answers
17 views

Hold F5 cause all virtual hosts crash : How to limit max process per user in SuPHP

I am hosting a VPS server with Apache2, PHP/SuPHP and MySQL (LAMP). I have many virtual hosts on that server. The problem is that when someone (that happens about 20 times a day) hold F5 on a website ...
2
votes
0answers
17 views

Windows 8 GPT Encryption [closed]

I have to run encryption for HIPAA Compliance and ran into a snag. I have a Windows 8.1 Home with GPT Based drive. It does not have Bitlocker nor TPM, and VerCrypt doesn't support GPT Partitions. ...
0
votes
1answer
18 views

java - how to limit sending email by 3rd party tools?

I have a (Win2008 R2) box running the Jenkins continuous integration server. It's a java program running as a Windows service. The command line looks like this: > "C:\Program Files ...
0
votes
0answers
125 views

sysctl: cannot stat /proc/sys/kernel/exec-shield: No such file or directory

Enable ExecShield protection - ExecShield is security Linux kernel patch to avoid worms and other problems. After Adding to /etc/sysctl kernel.exec-shield = 1 Getting this error sysctl: cannot ...
1
vote
1answer
29 views

Nginx - Redirect to different url if an image is directly access

I want to redirect users if they access the gif images directly. http://www.example.com/uploads/file.gif This should be redirected to home page or some other page. Or If the image is directly ...