Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
1answer
24 views

Is it possible to truncate packets using iptables?

The first thing on my mind when setting up a new Linux server (dedicated or VPS) is how you can increase security. I was wondering if it is possible using iptables to truncate icmp packets. If you ...
0
votes
0answers
7 views

MySQL /nonexistent home vs “No directory, logging in with HOME=/”

The preinst script in the Debian/Ubuntu packages for MySQL sets the default home directory for the MySQL server to /nonexistent, presumably as a security measure - the MySQL server has its own datadir ...
16
votes
6answers
4k views

Why would a university block incoming UDP traffic with destination port 53?

From my understanding DNS uses UDP and port 53. What undesirable things could happen if incoming UDP packets to port number 53 weren't blocked? UPDATE: Packets originate or are destined to the ...
1
vote
0answers
13 views

What are the differences between Blue coat ProxySG and Cisco Ironport?

What are the main differences between ProxySG and Cisco's Ironport Appliances? I already found out: Cisco's Ironport: - is only available as a scalable Hardware Appliance (not Virtual) - high ...
1
vote
0answers
18 views
+50

controlling access while caching video content on-site on client's network

we have many hours of video training courses that we want to deliver on-site to clients with encryption or something to control access Currently , we offer via website (eg like udacity), but some ...
2
votes
2answers
186 views

How to keep access keys safe in the event of a compromised server?

What's the best strategy to keeping access tokens secure in the event of a compromised server? Let's say I have a Linux web server to which I regularly ssh into. There is a variety of critical access ...
0
votes
0answers
17 views

Web Attack: Mass Injection Website 19 [duplicate]

I got issue at Norton web safety (attached is the image) Can please any body tell me what cause this issue?
0
votes
1answer
25 views

Windows 2003(!) Server won't boot: stuck at “applying security policy”

We have a (partly) decommissioned Windows 2003 server (of year 2000 vintage) which has been running fine until I had to turn it off for the first time in months due to a planned power outage. The ...
0
votes
0answers
23 views

ThinkServer x3550 M3: AES-NI disabled?

We are running a x3550 M3 with Ubuntu and we wanted to enable AES-NI functionality. First, we checked whether it was enabled already by executing: # grep aes /proc/cpuinfo However, no aes flags ...
-1
votes
1answer
22 views

Is it possible to authencticating/login for WPA2-Enterprise using web portal?

I just wondering is it possible using WPA2-Enterprise with authentication using web just like captive portal? If possible I think it would be really cool though the setup will take time.
-1
votes
2answers
40 views

How to install SSL certificate for Windows 8.1

I have a Windows 8.1 machine that I RDP into on a public IP (also secured by 2FA). I am getting a failing PCI scan because the default SSL cert created by Windows for RDP is using SHA1 hashing. So ...
4
votes
1answer
39 views

How can I reduce the verbosity of certain Ansible tasks to not leak passwords into syslog?

Sometimes I would like to use Ansible's lineinfile or blockinfile modules to write a password into some configuration file. If I do so, the whole line or block, password included, ends up in my ...
0
votes
0answers
14 views

Which AWS entities may have security group associated?

I'm writing a security audit tool and I would like to see all the services which have particular SG associated. At this point I found out that SG may be associated with: ec2 instance rds instance ...
-1
votes
0answers
13 views

Server Security - Stop sending spams from server [duplicate]

My server is sending spam emails because of which my IP is blocked at some servers. Can any body please suggest what security measurements should be taken? Also Norton Safe Web has analyzed my site ...
-1
votes
0answers
21 views

IPtables: block fragment type “DF” don't fragment [closed]

I'm getting some DDoS attacks and I need to block the packets with UDP flags "DF" using iptables, or another packet filtering method. I think u32 can do it, but I don't know how to check the "Don't ...
-2
votes
0answers
18 views

How to protect my site against dereferer links? [closed]

A potentially illegal website has been linking to my website for a while, so I used .htaccess to blacklist it. Now, the site has used a service called dereferer.org to prevent the referer from being ...
1
vote
1answer
32 views

Nginx serving .PHP as a download only when .php is added with arguments

Here is my current nginx config: server { server_name mydomain.example; access_log /srv/www/mydomain.example/logs/access.log; error_log /srv/www/mydomain.example/logs/error.log; root ...
2
votes
1answer
24 views

Should i use Firewalld or Iptables for Fail2ban in Centos 7?

I'm setting up Fail2ban to protect ssh, and I use firewalld, I saw a lot of people recommending to use anaction = iptables-multiport and other solutions using iptables instead of firewalld claiming ...
0
votes
1answer
19 views

Unable to reinstall fail2ban after completly removing it from Centos 7

After completely removing Fail2ban from Centos 7, I decided to reinstall it. So I run the installation(yum), and everything seems ok, no errors, But the it seems like the installation does not create ...
-1
votes
0answers
10 views

Php-fpm pools configuration for multiple websites in Centos 7

After following this tutorial for installing Lemp on Centos 7, I decided to host multiple sites on the same Virtual Server. Using Nginx i created a server block for each site, and everything worked ...
-1
votes
0answers
19 views

What application/service is expected under the URL /more?

I am seeing a lot of 'random' URLs giving 404 in my apache access logs: /favicon.ico /browserconfig.xml /robots.txt /more /a2billing /apple-touch-icon.png /apple-touch-icon-precomposed.png I ...
0
votes
1answer
42 views

Apache access log full of unauthorized and suspicious requests, how to take action

I have setup a small tiny VPS for my own website. Since it was live, I see many suspicious activity in the access.log file. When I was on a shared hosting I did not have access to this file and ...
0
votes
0answers
4 views

Tomcat 7 auth constraint role name active directory

I integrated waffle into my tomcat 7. I need to define the users in the active directory group that can visit the site, web.xml looks like: <security-constraint> <display-name>not ...
2
votes
1answer
20 views

Apache 2 no authentication from ips

I have a deployment with apache 2.2.22 server behind varnish. What I would like to accomplish is that password protect a directory with htpasswd but make this accessible for certain users coming from ...
0
votes
0answers
26 views

How http basic authentication implemented in my app will interact with IIS?

I'm working on Rails app and I was asked to do LDAP authentication. I implemented it on Ruby side via simple login form. Later my boss told me that I should implement the authentication using LDAP ...
-1
votes
0answers
21 views

Audit user activity

I need to grant access to one of ours Ubuntu servers to our new freelance developer. He is a new guy for us, so we'd like to verify his activity on our server. We have to add him to sudoers, because ...
0
votes
1answer
22 views

Asterisk hacking defence: “Call setup” in tcpdump from denied IP number

I am running Asterisk 11.7 on Ubuntu for my small business. These last days someone could access the server and make all phone extensions ring in regular intervals. I would like to understand how that ...
50
votes
13answers
7k views

Linux: productive sysadmins without root (securing intellectual property)?

Is there any way to make a seasoned Linux syadmin productive without giving him full root access? This question comes from a perspective of protecting intellectual property (IP), which in my case, is ...
0
votes
2answers
27 views

How safe is IPtables whitelisting?

I am deploying some VPS and of course, security is a big concern. I read that IPtables whitelisting is the best way to safeguard your machine. So I set up the follwing : echo "Flushing rules" ...
1
vote
2answers
44 views

Central control for SSH access to AWS instances

What are some approaches or best practices for managing SSH access by many devops to many AWS instances? I'd like to have the ability to e.g. add or remove access for a user to multiple instances ...
-1
votes
0answers
7 views

How can I create separate/isolated regions on a home network? [migrated]

I currently have a flat network at home. My boradband router comes in and is connected to a switch, which supplies the Ethernet drops within the house. I also have a wireless router connected to the ...
0
votes
1answer
39 views

how to restrict access to wp-login.php by IP address on nginx

I have the following configuration for my wp site which is running on nginx 1.8.1 location ^~ /wp-login.php { allow 10.0.0.0/24; deny all; } location ~ \.php$ { try_files ...
-1
votes
0answers
4 views

How can a WiFi router recognize MAC address change of a connected device? [migrated]

My teen son and I are playing a hacking game. I've installed an WiFi router with parental controls, MAC filtering, VPN, etc. I block Internet for him, he tries to break out of the cage (for now I'm ...
0
votes
0answers
17 views

How to secure a website with Apache ModRuid2 enabled

On webservers that I have built and administer, I am able to use group permissions and ACLs to decide what access can be given to Apache. This works quite well as I can have a small number of ...
0
votes
0answers
13 views

Configuration of VLAN for managing computers on the other side of a switch?

I have a modestly smart Cisco SG200 switch connected to our institute's Ethernet network. To this switch, I connected four Linux and Windows computers. (So, the configuration is: one network ...
2
votes
1answer
31 views

Security implications when only allowing logins via key and UsePAM setting is 'yes'?

When setting up a new server, I generally want to allow logins only via key authentification and not from the root user. Therefore, I edit the sshd_config like this: I change 'PermitRootLogin' to ...
0
votes
0answers
13 views

Why can't I disable routing/route or ndp on OmniOS? (Illumos)

I'm trying to harden this server and eliminate unused processes. I've been reviewing the output of netstat -a and see several entries under UDP and TCP with State LISTEN. I've disabled most of the ...
1
vote
1answer
22 views

Nginx config subdomain exhibiting strange behaviour

I've got two identical droplets running on digital ocean. Both running Ubuntu 14.04 with nginx, gunicorn and Django. I am trying to park a subdomain of mine onto the IP of one of the droplets. On the ...
0
votes
0answers
21 views

Windows Firewall - Block IP address

The configuration is exactly as following: I am absolutely certain that 192.168.2.6 is the correct IP address, yet the according computer remains able to access shared files. Where could I go ...
-1
votes
2answers
30 views

Do I need mutlipe certificates for mutliple services running

I did a lot of research on this but still I am confused about how many certificates I need to self-sign for each of my services running on my private server. Here is the deal: I am creating my own ...
0
votes
1answer
39 views

What type of SID ends with -0?

I have been parsing through the logs and found a random sid doing authentications against AD. It is as follows "s-1-5-21-xxxxx-xxxxx-xxxxx-0"; It cant be found in domain or forest. I want to know if ...
0
votes
1answer
21 views

How to restrict network access by user on a Windows multitenant machine?

I have a multitenant windows 2012 machine running several IIS WebSites, each running it's own application pool with its own windows user identity, and I need to restrict the all outbound network ...
0
votes
2answers
54 views

Requests made to a website with a different domain/url in log files, hacking attempt?

in one of my websites I am logging all url requests made to the server. I log that data for stats purpose to improve the website. The logs look like http://example.com/search 2016-01-12 ...
1
vote
0answers
30 views

How do audit file permissions changes over CIFS?

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders. ...
2
votes
2answers
30 views

Is it safe to change the owner of the document root?

Does it pose a security risk if I change the owner of the document root on Apache? I've been spoiled by generic website hosting providers. I'm used to SFTPing my files over to the host and hitting ...
0
votes
1answer
35 views

Can VPN authentication be used for SSH?

Can VPN authentication details be re-used for SSH access? Context: I'm looking into the feasability of having SSO to authenticate with a VPN and then be able to log into a server via SSH without ...
0
votes
2answers
39 views

Azure VM instance IP firewall

I assigned an instance-level IP address to my Azure VM. I then configured the SSH "endpoint" from the Azure portal and defined a deny-all policy. However, this policy seems to only affect the cloud ...
1
vote
1answer
47 views

Blocking suspicious IPs on firewalls - still relevant?

In interest of improving security, does it make sense to block suspicious IPs on internet facing firewalls? Does anyone know of any reliable block lists? Thanks, Mark
0
votes
1answer
40 views

Are rkhunter and chrootkit still effective linux rootkit scanners?

AFAICT neither have had much activity since the first half of 2014. Are there any other open source linux root scanners out there or reasonable commercial alternatives?
0
votes
2answers
49 views

improving soho network security

My wife & I work from home (with two separate businesses, both in their early stages) and we have two teenage kids who represent the biggest risk. I am concerned about threats to our business data ...