Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
1answer
24 views

Concealing an RDP service with a website

Is there a way (using a proxy or otherwise) to conceal an RDP service listening on port 443, such that HTTPS requests made from a browser serve a website while RDP requests connect as normal?
-1
votes
0answers
18 views

Files placed on server used for phising, how to find source / break-in [duplicate]

Appearantly my server has been used as a phishing host for attacks against PayPal. There were files placed inside different folders accross the server and the files get executed from various IPs ...
1
vote
0answers
42 views

SSH Passwords are working using IP address, but not when using the server name

We recently rebuilt one of our servers using Ubuntu 12.04 LTS and experienced something we haven't seen before. When we attempt to ssh into the box, we are able to ssh into the box if we use the ip ...
2
votes
1answer
30 views

Event ID 1158: “Remote Desktop Services accepted a connection from IP address xxx.xxx.xxx.xxx”

I have set up a home office with a local domain with just one Windows Server 2012 R2 and i have allowed port 3389 from router to my server. While knowing this is dangerous, i set it up that way in ...
1
vote
0answers
20 views

Tracing namespace mining culprit

I have a Centos 6x box with these installed: CXS + CSF + LFD. I'm trying to figure out how to effectively trace what MS is claiming namespace mining on my IP. From Microsoft: We have completed ...
-1
votes
0answers
15 views

Ghost platform compromised? [duplicate]

Digital Ocean reported that they detected Brute Force attack launched from my server. So when I did a lsof -i, I see lots of ghost user ssh2 connections. I have killed all the processes from the ...
0
votes
0answers
14 views

CentOS VPS is possibly rooted, but no tools show anything [duplicate]

I've received a notification from my VPS provider (Afterburst) that my VPS is trying to scan and bruteforce other people's servers. I know that I'm not doing this, and I know that nobody else with ...
-1
votes
1answer
31 views

How to prevent password bruteforce in web application? [on hold]

I have php web application (nginx+php-fpm). And someone try to bruteforce password. He have a lot of IPs. Also these bruteforce works like DDOS because each time web application starts and try to ...
-4
votes
0answers
126 views

How to fix LogJam vulnerability in Nginx [on hold]

Could you please post a detailed anser on how to fix LogJam vulnerability in Nginx? A checker can be found here: https://weakdh.org/sysadmin.html Thank you.
1
vote
1answer
53 views

IPtables drops all, but postfix still send emails

My iptables rules: # delete all current rules and user chains iptables -F iptables -X # global policy (target by default) iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # ...
2
votes
1answer
55 views

Is a reboot required for SSL V3 disable on Windows? - Poodle exploit

We are trying to disable SSL V3 on numerous windows servers; as a part of it , registries are being updated remotely via script. Problem is lots of reboots are required post registry change. Is there ...
-1
votes
2answers
23 views

Creating Virtual Proxy Server

I know this is not this kind of forum, but I can't find anything in google that really answers my question. Is there possible to create a Proxy server running in a Virtual Machine using only 1 ...
1
vote
1answer
36 views

how to block all requests from URLs with MSDOS device name using isapi filter cve 2007-2897

I recently had an audit report on my windows server 2008 R2 and it failed with the error/vulnerability: Microsoft asp.net ms-dos device name DoS www (443/tcp). I have not been able to find any ...
0
votes
0answers
7 views

Can I use same suricata instance for both IDS (for L3,4) and IPS (for L3,L4,L7)?

I have a interface where traffic is flowing from internet to NGINX server to application server. I want to monitor (IDS) the traffic flowing between Internet and NGINX at L3,4 and IPS the traffic ...
1
vote
1answer
48 views

Automatic unlock bitlocker to go (usb stick) on domain computer

Is there a way to automatically unlock bitlocker encrypted USB sticks on windows computers that are domain joined (8.1 Enterprise)? (e.g., based on the "BitLocker identification Field"?) The scenario ...
-2
votes
0answers
16 views

UFW deny all outgoing except to certain IP's [duplicate]

I need to secure my server by making sure it can only communicate with a certain set of IP's (both incoming and outgoing). Setting up the incoming rules is easy enough, but I can't seem to find any ...
0
votes
1answer
15 views

Is is possible to have an Admin account manage both Exchange 2013 (on prem) and Office 365?

We are in hybrid mode and a few people are asking me to create an additional account for them so they can administer O365 and use a different account for on prem exchange. After troubleshooting on my ...
0
votes
0answers
16 views

jenkins security settings on OSX revert on system reboot

I have a headless jenkins box that I have set up in another office. Previously I had installed and used the AD plugin, but something broke and it no longer can authenticate. I have uninstalled and ...
0
votes
1answer
28 views

Windows server 2008 Admin password changes after logout

I have windows server 2008 with two administrator accounts and I have a fixed IP for it. I access the server with remote desktop but every time I logout of any of the 2 admin accounts i can't login ...
11
votes
7answers
2k views

Preventing theft of data on remotely deployed servers exposed to physical access [closed]

I am trying to think of a way to secure Linux servers that are exposed to physical access. My specific platform are small form factor Linux servers on a PC Engines brand alix2d13 mother board. The ...
0
votes
0answers
18 views

Assigning random IPv6 ranges to ISPs as a security measure [migrated]

Pinging all the IPv4 address space takes about 5 hours (and can generate beautiful maps). Port-scanning doesn't take much longer and can reveal vulnerable services, such as remote administration of ...
3
votes
5answers
66 views

Should I enable automatic security updates on a Ubuntu server? [closed]

I can't seem to find an agreed answer on this anywhere, so I figured I'd ask it myself. I have five Ubuntu servers running either 12.04 or 14.04, should I enable automatic security updates on these ...
1
vote
1answer
143 views

Which “try_files” nginx directive is best for the zero-day exploit?

So far I have been using the following in the php location of my nginx config files try_files $uri $uri/ /index.php?$query_string; However, I just saw in the Wordpress Codex guide that for the ...
-1
votes
2answers
26 views

Change Mail Password, leave user system password

I have a Debian Jessie server that provides (web-)mail using postfix, dovecot and roundcube. To log-in to roundcube webmail, I have to use my system user name and password. This seems like a major ...
2
votes
0answers
61 views

Stop senseless mass-queries on DNS-server [duplicate]

I have a disturbing problem for a few weeks now ... One of my three DNS-servers (running bind9 as slave of a Plesk DNS master) is getting spammed with senseless DNS requests. The origin IPs of those ...
-3
votes
1answer
92 views

How could this hack have been possible unless the host itself was compromised? [closed]

UPDATE II: I honestly fail to see how my question is inappropriate for this site, and no one seems to want to give me a reasonable response for that, but whatevs, I solved it. Thanks to the actual ...
0
votes
1answer
79 views

CentOS vs Ubuntu Wordpress server security

I am building out a new Wordpress server for a web developer redesigning my companies website. I originally decided to go with CentOS due to stability. However it appears based on the versions of ...
0
votes
0answers
16 views

Postfix: rewrite “From” header and Sender Envelope with SASL username [duplicate]

I set up an authenticated mail server, in which a user needs an account to send mail. The SMTP username is the sender's email. The problem is that any authenticated user can send email with any from ...
0
votes
1answer
10 views

What are the Security Implications of not fully overwriting a fresh LUKS disk prior to use

I recently read this nice Howto tutorial about doing backups with whole disk encryption using LUKS. Surprisingly for me this tutorial contains as the first part of step #3 a command to overwrite the ...
-1
votes
1answer
42 views

Is it a ok wordpress file or is hack, look at this code [duplicate]

I was facing a hack My website is not hosted on a server but shared hosting, If server is hacked I cannot do anything. My Question is not about how to safeguard the server, but is the below code is ...
0
votes
0answers
32 views

Glassfish 3 unable to deactivate SSL3 for IIOP

I'm running Glassfish 3.1.2.2 and want to disable SSL3 for the IIOP ports (default 3820 and 3920). I set configs.config.server-config.iiop-service.iiop-listener.SSL.ssl.ssl3-enabled=false ...
0
votes
0answers
7 views

WiFi security using IEEE 802.1X - how secure is it? [migrated]

My company's set-up involves a single AP (TPlink) that is configured to authenticate clients using RADIUS. All works well, but: on a regular WPA/WPA2 network, once you have the PSK, you are able to ...
1
vote
2answers
36 views

OSSEC disk space usage

A few days ago I noticed that the disk of my Ubuntu server was almost full. I dug a bit and found out that the disk space was used by OSSEC, in the /var/ossec/queue/diff folder. I wanted to try ...
1
vote
1answer
65 views

Fail2ban not starting [WARNING 'findtime' not defined]

It was working fine until i added a new jail [apache-postflood]. If i remove it then it works, so whats wrong with the "findtime" ? . Here's the output: sudo fail2ban-client start WARNING 'findtime' ...
1
vote
1answer
41 views

is there a tool for windows 7 that can find which program is modifying a particular file [duplicate]

My system is infected by a malware that keeps modifying a particular configuration file. Is there a way/tool to find out which program is making change to a particular file? I am simply looking for a ...
-1
votes
0answers
85 views

How to log uploaded files with nginx?

I want to log names (with full paths) of all uploaded files. Is it possible to do this with only nginx? os: CentOS 7.1 nginx: 1.6.3 Parameters for sending files in nginx.conf: sendfile on; ...
0
votes
1answer
41 views

Allowing services to specific hosts using firewalld

Introduction On my database server (CentOS 7) I want to allow access to port 3306 (MySQL) from specific web front-ends (10.10.40.6 and 10.10.40.7 in my example). On top of that I want to allow access ...
0
votes
0answers
22 views

Security implications of wide WAN subnet

I have a server at OVH and say my public IP adress is xx.xx.xx.81 and the gateway is at xx.xx.xx.254. To reach the gateway, I need pfSense to be configured static WAN IP with xx.xx.xx.81/24, i.e. the ...
0
votes
0answers
11 views

Separate bridge for each VM?

I have been experimenting with network settings ever since I got a new dedicated server for some root-started unprivileged LXC containers a few months back and have finally arrived at what might be a ...
3
votes
1answer
27 views

How to handle vulnerability searches in IIS?

I have a web server running an ASP.NET web application on IIS 8.5. I noticed that several 404 errors were logged by the application which are not related to my application in anyway. Here are few ...
0
votes
1answer
298 views

Event 4625 Audit Failure NULL SID failed network logons

In a small environment comprised of one Windows Small Business Server 2011 server of relatively limited use (domain controller / Active Directory and DNS, Group Policy, DHCP, file server, print ...
1
vote
1answer
36 views

Secure connection errors without SSL

I have several users who are encountering messages about secure connections to the server when trying to access my website. We've had this on Mac (iphone, ipad and macbook w/ safari) & Windows ...
-6
votes
2answers
44 views

How to protect Windows Server 2008 r2 from persons, which have physical access to computer? [closed]

One server is available for other users, and we think that someone may steal passwords from it. I can not set a password on boot, because sometimes there is electricity failure, and UPS can hold it ...
0
votes
1answer
33 views

How to deny access on files to several groups easily?

Currently I'm working with permissions on files on the network with Windows Server 2012 Active Directory as follows: I set up one domain controller, on the domain controller I create users and groups. ...
0
votes
1answer
26 views

Block an http referrer on the server level

I am seeing multiple fake http referrers to several sites on my server, which for the most part doesn't bother me, except that they distort visitor stats. I have filtered the questionable domains out ...
0
votes
1answer
29 views

How to eliminate Security Warning message on EC2 Instance wizard

I've set up the AWS Free Tier, and configured a Windows Server. I took the defaults pretty much. There was 1 security group it created with 3 security rules it provided by default, and I didn't ...
1
vote
2answers
31 views

Opening outgoing ports on dedicated machine

I have a website where I have been working with another person on a game server listing site. It queries the game servers and shows information etc. Anyway upon talking to the creator of the script he ...
0
votes
0answers
73 views

Linux client for pki certificate auto enrollment from Windows CA

I just set up a Windows Server Certificate Authority. I would like to auto-enroll Ubuntu Linux computers for certificates. Can anyone share the available client options? I found this (old) technet ...
1
vote
2answers
42 views

building a SIEM, should I send logs or get them from the gathering machine?

I am working in a Linux environment, I would like to gather all the logs from the machine pool on a unique machine X. There are several log files I need to move and I am not sure about the way I ...
1
vote
1answer
36 views

Access to “Windows Security” logs for “eventlog” group

Security logs are not available for users in eventlog group. I've checked this down to security event log file. eventlog group has all permissions. Unfortunately I cannot add my user to ...