Security is not a product, but a process.

learn more… | top users | synonyms (1)

2
votes
1answer
19 views

Should i use Firewalld or Iptables for Fail2ban in Centos 7?

I'm setting up Fail2ban to protect ssh, and I use firewalld, I saw a lot of people recommending to use anaction = iptables-multiport and other solutions using iptables instead of firewalld claiming ...
0
votes
1answer
16 views

Unable to reinstall fail2ban after completly removing it from Centos 7

After completely removing Fail2ban from Centos 7, I decided to reinstall it. So I run the installation(yum), and everything seems ok, no errors, But the it seems like the installation does not create ...
-1
votes
0answers
7 views

Php-fpm pools configuration for multiple websites in Centos 7

After following this tutorial for installing Lemp on Centos 7, I decided to host multiple sites on the same Virtual Server. Using Nginx i created a server block for each site, and everything worked ...
-1
votes
0answers
16 views

What application/service is expected under the URL /more?

I am seeing a lot of 'random' URLs giving 404 in my apache access logs: /favicon.ico /browserconfig.xml /robots.txt /more /a2billing /apple-touch-icon.png /apple-touch-icon-precomposed.png I ...
0
votes
1answer
31 views

Apache access log full of unauthorized and suspicious requests, how to take action

I have setup a small tiny VPS for my own website. Since it was live, I see many suspicious activity in the access.log file. When I was on a shared hosting I did not have access to this file and ...
0
votes
0answers
4 views

Tomcat 7 auth constraint role name active directory

I integrated waffle into my tomcat 7. I need to define the users in the active directory group that can visit the site, web.xml looks like: <security-constraint> <display-name>not ...
2
votes
1answer
20 views

Apache 2 no authentication from ips

I have a deployment with apache 2.2.22 server behind varnish. What I would like to accomplish is that password protect a directory with htpasswd but make this accessible for certain users coming from ...
0
votes
0answers
26 views

How http basic authentication implemented in my app will interact with IIS?

I'm working on Rails app and I was asked to do LDAP authentication. I implemented it on Ruby side via simple login form. Later my boss told me that I should implement the authentication using LDAP ...
-1
votes
0answers
11 views

OpenVPN Confusion - Server and client on one machine? [on hold]

I have searched all over the internet and tried so many things.. but I cannot seem to figure this out. I have a Raspberry Pi. I have an ethernet, but I have access to a wireless if I needed it. 1. ...
-1
votes
0answers
19 views

Audit user activity

I need to grant access to one of ours Ubuntu servers to our new freelance developer. He is a new guy for us, so we'd like to verify his activity on our server. We have to add him to sudoers, because ...
0
votes
1answer
18 views

Asterisk hacking defence: “Call setup” in tcpdump from denied IP number

I am running Asterisk 11.7 on Ubuntu for my small business. These last days someone could access the server and make all phone extensions ring in regular intervals. I would like to understand how that ...
41
votes
12answers
6k views

Linux: productive sysadmins without root (securing intellectual property)?

Is there any way to make a seasoned Linux syadmin productive without giving him full root access? This question comes from a perspective of protecting intellectual property (IP), which in my case, is ...
0
votes
2answers
26 views

How safe is IPtables whitelisting?

I am deploying some VPS and of course, security is a big concern. I read that IPtables whitelisting is the best way to safeguard your machine. So I set up the follwing : echo "Flushing rules" ...
1
vote
2answers
40 views

Central control for SSH access to AWS instances

What are some approaches or best practices for managing SSH access by many devops to many AWS instances? I'd like to have the ability to e.g. add or remove access for a user to multiple instances ...
-1
votes
0answers
7 views

How can I create separate/isolated regions on a home network? [migrated]

I currently have a flat network at home. My boradband router comes in and is connected to a switch, which supplies the Ethernet drops within the house. I also have a wireless router connected to the ...
0
votes
1answer
37 views

how to restrict access to wp-login.php by IP address on nginx

I have the following configuration for my wp site which is running on nginx 1.8.1 location ^~ /wp-login.php { allow 10.0.0.0/24; deny all; } location ~ \.php$ { try_files ...
-1
votes
0answers
4 views

How can a WiFi router recognize MAC address change of a connected device? [migrated]

My teen son and I are playing a hacking game. I've installed an WiFi router with parental controls, MAC filtering, VPN, etc. I block Internet for him, he tries to break out of the cage (for now I'm ...
0
votes
0answers
15 views

How to secure a website with Apache ModRuid2 enabled

On webservers that I have built and administer, I am able to use group permissions and ACLs to decide what access can be given to Apache. This works quite well as I can have a small number of ...
0
votes
0answers
27 views

Is it time consuming and does it require much knowledge to maintain a VPS and have it up to date against security risks? [closed]

I run my own website and want to update it and move it to a VPS, but I am worried about the security concerns, this website will be commercial and will contain valuable information so I can't risk any ...
0
votes
0answers
13 views

Configuration of VLAN for managing computers on the other side of a switch?

I have a modestly smart Cisco SG200 switch connected to our institute's Ethernet network. To this switch, I connected four Linux and Windows computers. (So, the configuration is: one network ...
2
votes
1answer
29 views

Security implications when only allowing logins via key and UsePAM setting is 'yes'?

When setting up a new server, I generally want to allow logins only via key authentification and not from the root user. Therefore, I edit the sshd_config like this: I change 'PermitRootLogin' to ...
0
votes
0answers
13 views

Why can't I disable routing/route or ndp on OmniOS? (Illumos)

I'm trying to harden this server and eliminate unused processes. I've been reviewing the output of netstat -a and see several entries under UDP and TCP with State LISTEN. I've disabled most of the ...
1
vote
1answer
22 views

Nginx config subdomain exhibiting strange behaviour

I've got two identical droplets running on digital ocean. Both running Ubuntu 14.04 with nginx, gunicorn and Django. I am trying to park a subdomain of mine onto the IP of one of the droplets. On the ...
0
votes
0answers
21 views

Windows Firewall - Block IP address

The configuration is exactly as following: I am absolutely certain that 192.168.2.6 is the correct IP address, yet the according computer remains able to access shared files. Where could I go ...
-1
votes
2answers
30 views

Do I need mutlipe certificates for mutliple services running

I did a lot of research on this but still I am confused about how many certificates I need to self-sign for each of my services running on my private server. Here is the deal: I am creating my own ...
0
votes
1answer
38 views

What type of SID ends with -0?

I have been parsing through the logs and found a random sid doing authentications against AD. It is as follows "s-1-5-21-xxxxx-xxxxx-xxxxx-0"; It cant be found in domain or forest. I want to know if ...
0
votes
1answer
19 views

How to restrict network access by user on a Windows multitenant machine?

I have a multitenant windows 2012 machine running several IIS WebSites, each running it's own application pool with its own windows user identity, and I need to restrict the all outbound network ...
0
votes
2answers
51 views

Requests made to a website with a different domain/url in log files, hacking attempt?

in one of my websites I am logging all url requests made to the server. I log that data for stats purpose to improve the website. The logs look like http://example.com/search 2016-01-12 ...
1
vote
0answers
26 views

How do audit file permissions changes over CIFS?

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders. ...
2
votes
2answers
30 views

Is it safe to change the owner of the document root?

Does it pose a security risk if I change the owner of the document root on Apache? I've been spoiled by generic website hosting providers. I'm used to SFTPing my files over to the host and hitting ...
0
votes
1answer
35 views

Can VPN authentication be used for SSH?

Can VPN authentication details be re-used for SSH access? Context: I'm looking into the feasability of having SSO to authenticate with a VPN and then be able to log into a server via SSH without ...
-2
votes
0answers
18 views

Where on windows machine is pptp password saved? [closed]

When PPTP connection is added into Windows (Win7+), there is option to save login details. There is a tool here which I confirmed to work for extracting these details from within the system. Simple ...
0
votes
2answers
36 views

Azure VM instance IP firewall

I assigned an instance-level IP address to my Azure VM. I then configured the SSH "endpoint" from the Azure portal and defined a deny-all policy. However, this policy seems to only affect the cloud ...
1
vote
1answer
46 views

Blocking suspicious IPs on firewalls - still relevant?

In interest of improving security, does it make sense to block suspicious IPs on internet facing firewalls? Does anyone know of any reliable block lists? Thanks, Mark
0
votes
1answer
33 views

Are rkhunter and chrootkit still effective linux rootkit scanners?

AFAICT neither have had much activity since the first half of 2014. Are there any other open source linux root scanners out there or reasonable commercial alternatives?
-2
votes
1answer
28 views

Prevent users from going upward from their home directories [closed]

I guess this questions has been asked a few times, but my needs are very specific, so I'll take my chance in asking. I have three users, which each have a folder in /var/share, soft linked to there ...
0
votes
0answers
28 views

Using protocol names in domain name [closed]

Is it a bad idea security-wise to name (sub-)domains based on the protocol they respond to? For example, http.example.com pointing an IP bound to a Nginx setup. amqp.example.com pointing an IP bound ...
0
votes
2answers
49 views

improving soho network security

My wife & I work from home (with two separate businesses, both in their early stages) and we have two teenage kids who represent the biggest risk. I am concerned about threats to our business data ...
0
votes
0answers
18 views

Windows CE lockdown

My company just began purchasing Windows CE 5 & 7 based devices. The only application that they need to run is Remote Desktop. I am looking for solutions to lock them down so our users cannot ...
3
votes
1answer
56 views

How convince Security auditors to change frequent password change policy?

I am a new Junior IT Manager in a small company of around 500 employees and the current policy regarding passwords has enforced password expiration within 30 days, with a password history of 5. As ...
0
votes
0answers
25 views

How to block zip files containing executable (exe, jar) using Squid?

Squid Proxy Server is blocking exe and jar files by file extensions and meme type (for http traffic). However, if exe or jar files/programs are within zip files, then it is not blocking. The ...
1
vote
2answers
109 views

sketchy nginx access log entries

There were quite a few entries as below in the nginx access log. How do I know the outcome of these scripts and if my server is compromised or no? 162.232.183.48 - - [14/Jan/2016:10:54:57 +0000] "GET ...
-4
votes
0answers
8 views

Windows server 2012 r2 : Still on log on screen [closed]

I created define users on server and assign to define group. Then, I try to log on local. The log on success but still in log on screen. My user infomation: User name : b01, b02 Group : Web(Define) ...
0
votes
0answers
15 views

Linking fail2ban with a RDBMS

I would like to maintain a highly dynamic RDBMS table that will be insert/update/deleted from from multiple hosts (a kind of global blacklist for all my servers). The table would have a couple basic ...
0
votes
0answers
8 views

Sharing VPN access to my LAN - security concern [migrated]

I recently subscribed to a VPN service (Vpnsecure.me) and I have been thinking to share it to my all LAN via my synology NAS or my raspberry PI. Before configuring my devices, I would like to know how ...
-1
votes
0answers
17 views

Joomla site hacking issue [duplicate]

I've got a joomla website that has been hacked I've received the following message for my hosting company [Received: from localhost ([127.0.0.1] helo=dedi101.cpt1.host-h.net ident=Debian-exim) by ...
1
vote
3answers
18 views

DKIM: Can I simply change the RSA key used in DKIM without changing the DKIM selector?

Can I simply change the RSA key used in DKIM (DNS TXT Record) without changing the DKIM selector or will this result in any issues? If not, what's them the purpose of the DKIM selector? BTW: 20120113 ...
1
vote
1answer
28 views

DKIM: Can I use a RSA key larger than 2048bit, i.e. 4096?

I wonder if I can simply use a 4096bit RSA key for DKIM (in DNS TXT Record). Are there any downsides (neglecting computational effort)? Maybe there are mail servers which can't handle a key this ...
0
votes
2answers
52 views

block ip with iptables ubuntu server

I am trying to block one IP with iptables in my Ubuntu server 12.04. The foreign IP is 117.16.18.95.dyna. You can take a look at the next image: I have added this ip to iptables with the next ...
0
votes
0answers
4 views

Snort wont trigger alert from tap interface eth0 [migrated]

I have snort set up on a raspberry pi running a modified Ubuntu. Between my modem and router I have a switch that mirrors all the traffic to a port that is connected to the eth0 interface on my ...