Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
2answers
20 views

EC2 Load balancer and wildcard/multi-domain SSL certificates

I am running three sites through one load balancer (and 2 child-application servers) One of the site's has an SSL certificate, but I'd like to add a certificate for the other two sites What is my ...
-7
votes
1answer
29 views

Put ZIP file on server for public [on hold]

I was wondering if I can upload a ZIP file to my server and then make it public by sharing the link with others For example I was thinking about an URL like this: ...
5
votes
1answer
29 views

Restricted shell for managing files and git repositories

Think about a web hosting company that wants to let users manage files and git repositories via ssh. This includes: secure copy (scp) creating, copying, moving/renaming and deleting files executing ...
14
votes
7answers
1k views

Restrict a Linux user to the files he owns

Imagine a server setup of a shared webhosting company where multiple (~100) customers have shell access to a single server. A lot of web "software" recommends to chmod files 0777. I'm nervous about ...
3
votes
3answers
54 views

Will mailing lists “break” if SPF is too restrictive?

I have recently configured my own mail server (Linux-based postfix + dovecot scenario). This is just for personal use - I have no bulk mail going out, no automatically generated mail outbound from the ...
0
votes
0answers
11 views

How to config Squid SSL bump to let Paloalto PA series firewall recognize App-ID

A Paloalto firewall(PA-2050,POS 4.1x) was capable of recognizing the websites which users are visiting(thru http/https) then flag them with a App-ID and apply application control on the traffic, for ...
-5
votes
0answers
33 views

Why minimal install of OS? [on hold]

We are working with one of our customer on Performance Tuning. During the kick off discussion with their IT team.A best practice of slimming down the operating system with minimal install and install ...
0
votes
0answers
10 views

IIS Security - prevent web script to navigate upper level

I would like to know how to prevent the web script to be able to navigate his upper level ? For instance, the web script is located at C:\Websites\Website-A and it shouldn't able to navigate to upper ...
5
votes
1answer
80 views

How to handle security updates within Docker containers?

When deploying applications onto servers, there is typically a separation between what the application bundles with itself and what it expects from the platform (operating system and installed ...
-1
votes
1answer
42 views

How should I properly block outgoing http traffic with iptables

I'm experimenting with iptables, and I'm trying to allow all outgoing requests for HTTPS, but to block HTTP. I have the code below; Chain INPUT (policy ACCEPT) target prot opt source ...
0
votes
1answer
16 views

How are the security groups injected in an image in OpenStack?

I have been using OpenStack for some time and was just wondering how the security groups are injected in an image file. I browsed on the internet but I could not find a solution.
-3
votes
1answer
47 views

Keeping your server safe [closed]

I have a typical vps server with some custom sites on it running on port 80, a mail server, I don't have a DNS server and it is a default ubuntu 12.04. I don't have any admin panel, I am doing all the ...
-3
votes
0answers
23 views

How to test connection to Google mail server? [closed]

For example, google mx records for gmail is ALT1.ASPMX.L.GOOGLE.com I've tested all common smtp ports (25, 2525, 465, 587) and does not work. Any idea?
2
votes
1answer
25 views

Preventing SecAst access from across the network

I have SecAst up and running great, and I realize that any workstation on the network can access the SecAst telnet interface. Is there a way to limit this to only my laptop? I don't want one of the ...
0
votes
1answer
10 views

Obtain an offline image of an Xserve disk

We have an Intel Xserve with Mac OS X 10.4. It seems to have been infected by a virus. We want to obtain the disk image without booting into the OS. Preferably, we would want to boot via a USB disk ...
2
votes
1answer
29 views

Robocopy Ext USB HD to Server 2008

I tried copying data from an external usb drive to my W2008 server, g:\parent_directory d:\server_shared\parent_directory. Unfortunately, I picked the "copyall" paramenter which copies over D=Data, ...
1
vote
0answers
15 views

How to resolve security warning concerning WebAdministrationProvider?

I have a new Windows Server 2012 install, and have just installed IIS. I see the following warning in the Application Log: A provider, WebAdministrationProvider, has been registered in the ...
4
votes
3answers
73 views

ESXi hosted on public IP without firewall

So I've got an interesting problem. I currently rent a couple of servers from Hetzner (a German hosting provider). Each server has a soft firewall and does something like web hosting / database. I ...
0
votes
2answers
28 views

How to restrict access to root to daemon user?

I have Apache 2.4 with PHP 5.5.14 installed on latest Debian. According to Apache security tips&tricks I've set my httpd.conf to this: <Directory /> AllowOverride none Require all ...
1
vote
0answers
11 views

Configuring Service Login Credentials with Group Policy following MS14-025

With Microsoft security bulletin MS14-025, GPMC and related tools are now patched to no longer allow the use of configuration items within Group Policy Prefs that would embed obfuscated passwords. The ...
3
votes
1answer
98 views
+50

What are the repercussions of using an EOL Cisco firewall?

I'm looking at using an ASA 5520 for the database of an ecommerce site. According to End-of-Sale and End-of-Life Announcement for the Cisco ASA 5520 Adaptive Security Appliance, this product is ...
0
votes
1answer
39 views

Failed PCI DSS Compliance

I got this from my compliance check results. To me it looks like my router is responding to their test but I'm not sure where to go . ( might be off track completely though) Description: PCI DSS ...
0
votes
0answers
23 views

Restricted logins + almost all ports closed : secure? [migrated]

Context : I plan to travel. I want to make a little cloud with my personal server. I wish I could d/l some of my files and eventually upload some files which will not be executed and the whole is ...
-1
votes
1answer
78 views

How to block incoming login attempts to postfix, pop3, imap?

We are running CentOS 6.5 with Plesk and have to send email but don't need to receive. I would like to block all incoming login attempts to postfix, pop3 and imap. I have found hints to iptables or ...
19
votes
2answers
1k views

Why should I start to replace Windows Server 2003?

Windows Server 2003 is a very good operating system from Microsoft, and we're relying on it on a daily basis. I have heard that I should replace it by something "newer" and more "modern". Why should ...
2
votes
3answers
46 views

is there a PAM module for DNSBL lookups?

I have been enumerating the remaining security concerns on one of my back-end production servers, when I came to the realization that something which could be incredibly useful was missing from my ...
1
vote
1answer
33 views

How does one achieve in Windows 7 a level of security comparable to setting a file's permissions to 0600 in Unix?

I want to store securely the file .pgpass, which contains the authentication credentials (including passwords) for client programs to be able to log in to PostgreSQL servers. The Pg documentation ...
0
votes
1answer
21 views

secast init file already exists

I'm installing SecAst on a new computer and I'm on step 2.1.7 (copying init files). I copied the first initd file, but when I copy the second one it says file already exists (and I'm overwriting the ...
0
votes
1answer
27 views

Restricting access using IP address / Network Redirection?

I have a situation where we have a web server (lets call it A) that is hosting a set of HTTP based services. Due to some client requirements, this web server is not open to the outside world but ...
0
votes
2answers
30 views

SecAst: Potential documentation issue, Ubutunu 12.04.4 LTS and the command: cp -v

To Generation D: I am writing you about what might just be a documentation issue which hopefully doesn't have significant repercussions. This is something I encountered immediately at the start on ...
0
votes
1answer
40 views

What are the minimal permissions for WMI access to processes CommandLine?

I have been trying to get a remote listing of running windows processes including their CommandLine/ExecutablePath attribute through WMI as a non-administrator domain user for a monitoring tool. I ...
1
vote
1answer
26 views

How do I find what PHP script is changing the file

I have apache installed with mod_php PHP5. I've been able to find out that apache process is changing my .htaccess and index.php files in /var/www directory. All files in this directory are owned by ...
0
votes
0answers
20 views

How to remove malware from Debian server? [duplicate]

We have one Debian server that is affected by a malware. It's adding some code to the .htaccess files in /var/www directory where all sites are stored. Here's the malicious code: RewriteEngine on ...
0
votes
2answers
49 views

Installing SecAst on AsteriskNOW with CentOS

Having some issues installing SecAst for IPS, Followed the directions up to 2.1.6 and found a way (on this forum) to install qt5-qtbase (thanks) but when I run ldd /usr/local/secast/secast the return ...
0
votes
2answers
58 views

SecAst: Failing to Ban IP ''

To Generation D: This was the setup at time this issue was observed: secast-1.0.1.0-x86_64-ub12 on Ubuntu 12.04.4 Server LTS with Asterisk 11.10.2. The following events were captured and observed in ...
0
votes
1answer
28 views

SecAst: Premature Exit in Daemon Mode

To Generation D: This is a new problem with build secast-1.0.4.0-x86_64-ub12 that didn't happen with the previous build, secast-1.0.1.0-x86_64-ub12. When secast is run as a service (service secast ...
1
vote
1answer
28 views

SecAst: Configuring Email Alerts for Google Apps Account

Requesting assistance with configuring SecAst email alerts to work with Google Apps hosted account (posting here as per request by Generation D)... We have SecAst installed on a system with a new ...
0
votes
1answer
16 views

Fixing Apache Struts XSS vulnerability

A recent network scan revealed the following vulnerability: Apache Struts s:a / s:url Tag href Element XSS. Here is a link with more info about this vulnerability: http://osvdb.org/show/osvdb/54122 I ...
-5
votes
1answer
55 views

How much harm can a non-root user cause? [closed]

Let's say you add a user to your Linux server, and allow the user to connect over SSH with full command-line access, but do not add him to the list of sudoers. What sort of security vulnerabilities ...
-1
votes
1answer
49 views

How do I disable unnecessary Windows services and test for stability?

When I configure a minimal Server (unselecting any role in SCW) I still have quite a number of (obscure) services running or set up as manual. Requirements in my project say that the Server shall ...
2
votes
1answer
31 views

Hardened compiler flags VS automatic security patches?

I noticed that a few select pieces of software in the Long Term Support repository for my Operating System, have not been compiled with PIE, or Immediate binding (for example). In the opinion of ...
0
votes
0answers
39 views

What is the workaround for WMI remote connection failure with Access Denied error when client runs with Local System account?

What is the workaround for WMI remote connection failure with Access Denied error when client runs with Local System account? I tried to run script under local system account on the client which ...
28
votes
3answers
2k views

Illegal activities prevention system (child pornography, animal cruelty, …)

It is a very sensitive topic that requires a solution from our end. I have few servers that I rent to few people. I have all legal permissions and rights to scan over the servers. I want to prevent ...
3
votes
3answers
243 views

How can I prevent the compromise of a Domain Controller on ESX stored in a unsecured location?

A client of ours has a DC that will be located in an insecure location. RODCs and separate domains/forests are not permitted by management. All the servers will be located on a VMWare ESX server. ...
-1
votes
1answer
19 views

Alerting on threshold crossing?

We are using logstash + elasticsearch + Kibana to parse, store and view our logs respectively. Now, we want a notification/alert when a threshold for a particular log or threshold for a particular ...
4
votes
3answers
48 views

Server 2008 permissions issues

We have a selection of top level folders: E:\Data1 E:\Data2 E:\Data3 The permissions are simple - the default CREATOR OWNER, SYSTEM Full Control, some security groups allowing Modify and the LOCAL ...
-2
votes
0answers
29 views

Cisco ASA 5505 ver 7.4 port forwarding

I need sone help over ASA 5505 ver 7.4. This scenario is working with two site to site vpn and working fine. All inside clients able access internet only issue is that they are not able to call means ...
2
votes
0answers
25 views

Executing WMI methods by proxy - how can I keep credentials out of the hands of users?

Management wants me to create a script/application/ancient magical artifact that allows field technicians to perform a task on our Configuration Manager server (updating collection memberships - very ...
0
votes
2answers
40 views

nginx as reverse proxy on front of Apache - protection and security

I'm just concerned whether to install Nginx WS alone or nginx as reverse proxy on front of Apache based on security and protection. If I had to choose nginx as reverse proxy on front of Apache, would ...
2
votes
2answers
41 views

Configuring sudo to not prompt for password on non-allowed commands

There is plenty of information on how to make sudo not prompt for passwords (NOPASSWD). Let's say I have user alice, and this line in my sudoers: alice ALL=(root) NOPASSWD: /bin/myadmintool This ...