Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
0answers
14 views

Should a NAT host be separate from a Bastion host

Have a private network with servers that required SSH access. Since the instances are in a private subnet, they cannot be accessed directly via SSH and require a public Bastion host to access. ...
0
votes
1answer
25 views

“File not found” from bash script executed by Apache (CentOS)

I have a bash script that sets up a classpath for accessing a series of JARs (it's tf, the cross-platform, command line tool for Team Foundation Server). The file structure is something like: ...
1
vote
1answer
20 views

how should I configure selinux when running nginx inside docker

There's a good article in docker's documentation about security with docker : https://docs.docker.com/articles/security/ However, it's not very clear to me how root-priviledged processes in the ...
0
votes
2answers
22 views

Is PHP 5.3.3 on RHEL 6.5 receiving security fixes?

I notice that the latest PHP available on RHEL 6.5 is PHP 5.3.3. See Distrowatch and also my own check: $ php -v PHP 5.3.3 (cli) (built: Jul 15 2014 08:48:08) However, the PHP website claims that ...
0
votes
1answer
12 views

SCCM 2012 Software Update role - Can I still use WSUS?

I manage a network of about 1200 workstations and about 200 or so servers. We have migrated away from McAfee in favor of System Center Endpoint Protection for our corporate Anti-Malware solution. ...
4
votes
1answer
1k views

Why are some CentOS 5 boxes still vulnerable to ShellShock after upgrading Bash?

I have two CentOS 5.10 boxen where I have upgraded bash to the latest version. However, in one of the boxes, bash is still vulnerable to CVE-2014-7169 (I am using the test from this ServerFault ...
3
votes
1answer
81 views

How to authenticate a user from an external Windows Domain (Active Directory)

I have a service (AcmeService) running on a domain (ACME.COM) and a user running in another domain (DISNEY.COM). mickey@disney.com wants to authenticate with the AcmeService. The service knows about ...
1
vote
1answer
24 views

How can I install a client certificate for all users of a computer?

I have a PFX file (.p12) that is needed to allow access a remote web page. Double-clicking on this file and following a few prompts easily adds the certificate to a personal store, but this only works ...
-4
votes
1answer
97 views

Is WampServer on Windows vulnerable to Bash Bug / Shell Shock? [on hold]

The title says it all. I don't think Wamp is running with Cygwin but I would like to be sure of that.
1
vote
1answer
22 views

CRM 2013 Internet Facing Deployment (IFD)

For previous CRM IFDs I have placed the CRM Front End server in the DMZ along with an ADFS Proxy and allowed access from the Domain Controller to the CRM Front End through the firewall. This is ...
0
votes
0answers
24 views

Dell 5548P, MIB value for port security violation notification

Anyone have idea on MIB values(OID value) for Port security violation notification with dell 5548P switches.On Cisco its [1.3.6.1.4.1.9.9.315.0], not sure whether i can use the same for montioring ...
0
votes
1answer
19 views

MySQL via SSL on VPC private subnet

Is an SSL connection recommended when connecting to a MySQL database server via a private subnet? SSL provides encryption but SSL causes a performance hit. The MySQL database server only serves ...
11
votes
2answers
3k views

How does the updated Shellshock vulnerability test for CVE-2014-7169 work?

I understand the original test for CVE-2014-6271, which was: $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" But I'm confused by the updated test and corresponding output for ...
62
votes
6answers
37k views

How to test if my server is vulnerable to the ShellShock bug?

How can I ensure my Bash installation is not vulnerable to the ShellShock bug anymore after the updates?
0
votes
3answers
93 views
+50

Disable Windows Share Without Administrator Access

We have a folder on a windows server shared to provide access to an important application. When the application is being updated we (DBAs) change the permissions on the share to deny all access to it ...
1
vote
1answer
9 views

Sent mail/login log for roundcube webmail

Does roundcube webmail have a log for logins, or for sent mail? I searched everywhere but could only located the "error log" directory in roundcube, not one for logins or for sent mail. I'm trying to ...
1
vote
1answer
27 views

Roundcube does not add IP address information into sent emails

Usually the mail client is supposed to add IP information into emails, in order for the sender to be tracked. But when you send emails from Roundcube Webmail/0.8.4+, the IP address of the server is ...
0
votes
0answers
9 views

Rename IWAM and IUSR accounts on cloned servers

We cloned couple of servers and all of the new ones have the same name for IUSR and IWAM accounts. Now as per my understanding, these are local accounts and should be fine. Do I really have to/should ...
0
votes
2answers
81 views

Arp attack on my network

We have a small network of around 100 laptop/desktops and around 20 servers (sounds an overkill but these servers provide service for all our external contractors too) and we have recently noticed ...
0
votes
1answer
31 views

How to change password complexity for mailbox in exchange 2013

I find the default password policy in exchange pretty weak (only 6 char.). Is there a way to change this password policy ? e.g. : Minimum 1 cap, Minimum 8 letters. Thank you !
-2
votes
0answers
20 views

Microsoft Azure Internal Network Security

I happened to notice some strange connection attempts in /var/log/secure on our Microsoft Azure VM. I've also noticed that the default setting for iptables is: Chain INPUT (policy ACCEPT) ...
7
votes
2answers
124 views

Storing AWS credentials securely on a personal machine

How can I securely store AWS credentials on personal machines? In detail: Everybody in our team requires AWS security credentials for doing administrative tasks (credentials are separated by role). ...
0
votes
1answer
14 views

Detect files of folders which do not inherit permissions from their parent

Is there an easy way to find any files/folders (recursively) within a directory which do not inherit permissions from their parent. i.e. To gauge the effects of selecting "replace permissions on ...
0
votes
0answers
16 views

802.1x Log.txt log file

I have a network that have a basic PC > SWITCH > RADIUS server structure ... and i noticed that every p.c on the network have a c:\8021x folder that contain a log.txt file ... and on the log.txt i ...
0
votes
0answers
19 views

Where can I find a collection of tried and true Security Protocols? [migrated]

Just as it's a good idea not to invent your own encryption standard (unless you are an expert), I'm assuming that it's also not a good idea to invent your own security protocol. Since I'm probably ...
0
votes
1answer
39 views

Do all captive portal solutions work the same way? (cookie, vs MAC address, vs other?)

While traveling and having to interact with a number of broken captive portal implementations I've overheard other passengers having usability issues with iPads, Phones, computers depending on the ...
0
votes
1answer
37 views

Using SHA256 with SSL certificates in HAProxy

Through an article on Security Labs I read about Google deprecating SHA-1 as signature in Chrome next year. Now I want to edit our HAProxy SSL configuration to fit the new security needs. What are ...
0
votes
2answers
123 views

Nginx, ModSecurity, IP Tables blocking WordPress dos/ddos attack

For the past 14 days I have had my website being hit by millions of WordPress installs over the world which .htaccess is kind of coping with but I am trying to get something to kick them before ...
-1
votes
3answers
119 views

Security policy: servers without root/administrator password

I am considering running public web and application servers with blank root/Administrator passwords, and I'm wondering whether this might be a bad policy. I see several advantages of having no ...
-1
votes
1answer
49 views

Is the PHP option 'cgi.fix_pathinfo' really dangerous with Nginx + PHP-FPM?

There has been a lot of talking about a security issue relative to the cgi.fix_pathinfo PHP option used with Nginx (usually PHP-FPM, fast CGI). As a result, the default nginx configuration file used ...
-1
votes
1answer
26 views

Is www-data considered a non-privileged user on Apache?

Great Apache Hardening post that recommends "Run Apache from non-privileged account" because "Default apache configuration is to run as nobody or daemon." Is www-data:www-data considered a ...
0
votes
1answer
32 views

What is the name of this “security leak finder” application?

They said that there were some vulnerabilities, and then pointed these results: What is the name of this application?
0
votes
1answer
45 views

Security Auditing on Ubuntu 14.04 LTS

The Tiger security auditing tool has been a standard install in the past. However, it doesn't look like Tiger is being updated. Is Tiger still a valid security auditing tool on Ubuntu 14.04. If ...
4
votes
2answers
580 views

Do I have to buy a second wildcard certificate for a subdomain?

We already have a wildcard certificate for *.mycompany.com. Our network has hosts that are only reachable internally. All of them belong to the internal.mycompany.com subdomain. There is a private ...
18
votes
2answers
1k views

Customer wants open postgresql port, how to make that secure?

So, this is the situation. It seems, we need to have an open tcp port 5432 for the world, where a customer has access to his postgresql database. Because obvious reasons, we can't say just "no", only ...
1
vote
1answer
57 views

Is storing password hashes in plain text dangerous?

We have a server that is going to be managed through a chef cookbook. Each user for the system is configured using hashes from /etc/shadow. Can we safely store these shadow hashes in our ...
1
vote
0answers
14 views

Auditing connections using certificates

We would like to have clients connect using client certificates from a trusted (internal) issuer and then log which user connected. Unfortunately, the following limitations are preventing success: ...
0
votes
1answer
26 views

Does “Deny log on locally” effect “Allow log on through terminal services”?

I am hardening a system and i am unsure about whether or not denying log on locally but allowing log on through terminal services will work. Does deny locally override the terminal services setting?
2
votes
1answer
54 views

chattr - How to change file +i attribute without using chattr

Here`s the problem. My server got probably hacked. I would like to change a config file, but it is immutable (has the +i attribute), so I can't edit it. trying to execute a "chattr -i" on the file ...
1
vote
2answers
31 views

Ability to use SSH Key / PEM for web authentication in lieu of password protection?

I've been trying to figure out a way to lock down our dev site even more, and the idea came up that instead of using IP centric + Password protection, using something more akin to a PEM key, like I ...
-2
votes
1answer
51 views

Prevent/Stop Namespace Mining [duplicate]

Enviroment: Plesk v12, latest Windows Server 2012 SmarterMail My web hosting provider told me that someone hacked into my server a couple of weeks ago and was hitting various mail servers (Gmail, ...
-2
votes
1answer
52 views

Multiple attacks - what can I do

I experience multiple attacks on my server recently (for past several days). Types of these attacks are e.g.: Several SQL Injection methods (select/union/where/null, etc.) Brute force attacks (e.g. ...
-1
votes
1answer
35 views

Making Private Domain Marriage Public Domain Name - Revisited

I'm building a server with Windows Server 2012 and I've checked many articles on the net about "naming" your internal domain. Interestingly, most of the comments are from 2009. As we all know, times ...
0
votes
1answer
56 views

How to block spambots and about security

Is it normal to have many many lines in /var/log/kern.log about UFW block? For example: Aug 29 22:13:13 myvps kernel: [1980808.931708] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=60.173.8.240 DST=me ...
0
votes
1answer
22 views

Under what conditions in Apache installations is AddHandler application/x-httpd-php .php required?

I am a security researcher who has been running into multiple cases where file upload forms can be exploited, allowing attacker-controlled PHP code to be interpreted by the server, leading to remote ...
0
votes
2answers
48 views

IE11: Allow display of local HTML files

How can I enable Internet Explorer 11 that has Enhanced Protected Mode turned on to display local HTML files? This is very annoying also I see the security need behind this feature. Can someone ...
1
vote
0answers
46 views

Prevent user interactive logon to domain computers

I currently have a user DOMAINJOINER (located in the WIN7Support OU) which I use to deploy Windows 7 machines. This user can Create and Delete Computer Objects in the WIN7Computers OU, that's about it ...
12
votes
4answers
310 views

How to convince my Administrator that Java ON A SERVER is not insecure per se?

The Application We have a small Java application which uses some Camel routes to pick up uploaded files from a webserver, process them and send out some e-mails with the results. The server on which ...
0
votes
1answer
42 views

Completely block access to Cisco

There is Cisco Catalyst 3850 (WS-C3850-48T-E) which is managed only via management port. There are several VLANs on the switch. Also the switch works as a DHCP server. SNMP & SSH are already ...
0
votes
0answers
30 views

RHEL 5 with PHP 5.1.6 VS RHEL 6 with PHP 5.3.3: Security implications

Using only the RHEL Repositories, RHEL 5 considers PHP 5.1.6 to be up to date, and RHEL 6 considers PHP 5.3.3 to be up to date. My question is: Are security updates/patches backported so that 5.1.6 ...