Security is not a product, but a process.

learn more… | top users | synonyms (2)

-4
votes
1answer
18 views

Does a tool like ansible make it possibly to get a secure server, without knowing a lot about security?

If I modified something like this into a server similar to the one described here with a minimal set of services (what you need for ssh, basically) would it be reasonably secure? sovereign: A set ...
-2
votes
2answers
41 views

Windows 2003 Server Blocking .exe files [on hold]

I was in the process of building some windows 2003 r2 servers, and came across an issue after I teamed two nics, the nics would not team correctly due to an issue with the switch I was connected to, ...
3
votes
7answers
889 views

will hosting provider have access to my dedicated server?

I am looking to buy a dedicated server for my web application.But I am concerned about security to my application code and who can access to my server even dedicated server.As hosting provider ...
1
vote
3answers
111 views

Open SSL - Is my ubuntu really secure now after dist-upgrade?

I am running a Ubuntu 12.04 server and I just updated the server with (and rebooted afterwards) sudo apt-get dist-upgrade Now the open SSL version sais, it is build on 7 Apr 2014 what is good, but ...
1
vote
1answer
82 views

Switch the SSL provider after Heartbleed bug instead of revoking

I have a question regarding the Heartbleed problem and the SSL certificates. About Heartbleed many people say that admins should revoke their certificates and get new ones. I got my SSL certs from ...
2
votes
1answer
22 views

iptables: does a scanner knows if you DROP packets?

I know how REJECT and DROP chain works. But, as I read here REJECT vs DROP when using iptables, user Dagelf said that the server still replies with TCP SYN/ACK. Does the scanner knows that a packet ...
1
vote
1answer
29 views

unable to switch off expose_php in ubuntu 14.04 with nginx and php-fpm

According to phpinfo: Loaded Configuration File: /etc/php5/fpm/php.ini # grep expose_php /etc/php5/fpm -R /etc/php5/fpm/php.ini:expose_php = Off ...
1
vote
0answers
44 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
0
votes
0answers
28 views

Force all traffic through VPN

I am using PfSense as a firewall, with its VPN functionality. The client I use is Shrew Soft VPN client. As it is a split tunnel, is there a way I can force all traffic through the VPN connection, ...
-1
votes
1answer
35 views

Helpful linux command for do some forensic on compromised linux web server [duplicate]

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
1
vote
0answers
44 views

Routing LDAP traffic from Application server to Proxy to internet

I've included a drawing so you get an idea how it would work. (Red = LDAP connections , Blue = HTTP / AJP in the backend) Problem: We want to connect our customer application server to an LDAP of ...
0
votes
1answer
19 views

How to enable auditing for a folder only (and not anything within that folder)

I am trying to track down a process responsible for resetting ACLs on a particular folder, and ONLY that folder, not any of the 10,000 folders and files it contains. I tried going to Properties > ...
1
vote
2answers
225 views

Why can nginx access /etc/passwd? [closed]

I'm trying to setup my new VPS with my couple sites. nginx, php-fpm and other needed services installed. I setup a nginx server block(virtual hosts) for my site, and then try to create a php file ...
1
vote
1answer
58 views

Another domain points to my webserver

Somebody else has registered a name pointing to my webserver's IP address in .ma TLD. My domain foo.bar -> my ip address 1.2.3.4 Somebody defined: suspiciousdomain.ma -> my ip address 1.2.3.4 So ...
5
votes
1answer
80 views

RHEL6 Keeping 1 old kernel and security

I have my RHEL 5&6 servers set to keep 1 old kernel after updates, I do this in case I need to recover the system for any number of reasons. My question is related to security of the system when ...
1
vote
1answer
35 views

Someone tried to access a list of hundreds of standard website urls in a go, is it a cause of concern [duplicate]

I was just checking my website logs today and found that someone accessed my website for a list of hundreds of standard urls that almost every 3rd or 4th website developed on a standard platform ...
0
votes
1answer
25 views

Linux package management and security flaws

Is there a mechanism built into rpm or apt that will warn (or prevent) a user from installing a package contains a known security threat? I'm thinking of an RPM like ...
-1
votes
0answers
36 views

Where can I get a local heartbleed tester? [duplicate]

Is there a tool which can test for heartbleed vulnerability that does not require the site to be visible to the internet? Okay, that's the simple question but let me add I know full well why people ...
0
votes
0answers
28 views

How do I reset the password on a Dedicated Micros DVR? [migrated]

I have an ECO 9 Dedicated Micros DVR unit. This specific one has 9 analog video cards. Some guides suggest the username is dm and the password is web, other guides say the username is username and the ...
0
votes
0answers
24 views

Hardening of ubuntu server.How to prevent overkill checks? How to detect genuine request from attacks?

I have followed one these hardening check list tutorials where I have noticed that there fail2ban installed and denyhost at the same time. To my knowledge fail2ban does a little more than what ...
2
votes
2answers
252 views

How can I check if my embedded Linux's SSL is not affected by heartbleed, without relying on the version number?

There are a lot of embedded Linux device that are built on Linux, that are used exactly for security purposes, like gateways, if I check OpenSSL I get: openssl version -a gets -» OpenSSL 1.0.0k 5 ...
5
votes
1answer
596 views

How can I check if certificates generated with openssl are vulnerable to heartbleed

I am aware that you can show the version of openssl you are using by typing the following at the command line "openssl version". I created a certificate and a key some time ago with similar names to ...
11
votes
1answer
278 views

How do we instruct our employees to protect themselves from Heartbleed? [duplicate]

Welcome to the world after heartbleed. We've patched our servers and are replacing our SSL certificates. But just because our servers are fixed, that doesn't mean that the rest of the internet is ...
25
votes
8answers
16k views

My server is still vulnerable to heartbleed even after I update OpenSSL

I have an Ubuntu 12.04 server. I have updated the OpenSSL package in order to fix the heartbleed vulnerability. But I am still vulnerable even, even though I have restarted the web server, and even ...
0
votes
1answer
56 views

How to check if an apt mirror has the version of package I required?

Let say I want to query if openssl, 1.0.1-4ubuntu5.12 is available in the mirror, e.g. deb http://security.ubuntu.com/ubuntu precise-security main restricted Any easy command I can check?
1
vote
0answers
17 views

Using Custom or Official Cookbook [closed]

I'm evaluating whether to use the official, Chef/OpsCode cookbooks to install java, maven, etc. Here's my list of pros and cons for using a custom/hand-rolled one v. Chef cookbook. Custom Cookbook ...
52
votes
6answers
10k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
168
votes
9answers
24k views

Heartbleed: What is it and what are options to mitigate it?

This is a Canonical Question about understanding and remediating the Heartbleed security issue. What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL ...
0
votes
1answer
32 views

How to re-check SSL certificate even with exeption in browsers

My SSL certificate has expired. I created a new one for my domain but after a few days. Certificate is now online and working but there is a problem at users side. When the certificate expired, users ...
66
votes
7answers
21k views

Heartbleed: how to reliably and portably check the OpenSSL version?

I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug. ...
0
votes
1answer
26 views

Need help overriding a strict httpd.conf directory setting

Per requirements of a project I am working on, the apache httpd.conf must have the following restrictive setting as a security measure. <Directory /> Order Deny,Allow Deny from all ...
0
votes
0answers
56 views

Prevent Bruteforcing Without Use of MySQL [migrated]

I was looking into ways of preventing users from bruteforcing login scripts. I found two good ways: -Use reCaptcha -Check database before verifying user info to see how many requests the user has ...
0
votes
2answers
43 views

Can a man in the middle intercept an SSL package and duplicate it?

AFAIK, SSL will encrypt the message under secure. But I still have the concern whether or not a man in the middle can catch the package and duplicate it e.g. 1000 times
2
votes
1answer
31 views

Windows Server 2008 what is the proper way to export or backup security event log

Using WEVTUTIL.EXE to export the Windows Server 2008 Security event log, I get a permission problem (I have administrator privileges): c:> wevtutil epl security test.evtx "Failed to export log ...
1
vote
1answer
54 views

SELinux permissions for LogRotate and Apache

With the directory structure: /www/live/website1/app/ /www/live/website1/files/ /www/live/website1/logs/ Where Apache needs at least the following access: app: read-only access, but read-write is ...
0
votes
0answers
9 views

AD LDS changing password events

We've implemented AD LDS and we want to monitor password changes on it. However, the events I see doesn't provide much information. The only thing I see is this 4793 event (Security logs) The ...
1
vote
1answer
20 views

Temporary file security threat? [duplicate]

We use CentOS. We've been hacked and trying to figure out why. Looking at the /tmp folder I'm wondering if these are security threats: -rw-rw---- 1 mysql mysql 11665408 Apr 3 18:59 ...
0
votes
3answers
79 views

Have I just been under attack?

I have set up my Debian server on HP ProLiant 360 G4 yesterday. I started off with minimum services, running only SSH and Apache, all on standard ports with default configurations. About an hour ago, ...
0
votes
0answers
32 views

Tracert of a spoofed IP results in Infinite Loop

Our firewall picked up a spoofed IP address that caught my attention. When I did a tracert to the spoofed IP address I get what I think is an odd response. Tracing route to 192.168.1.7 1 1 ms ...
-1
votes
0answers
49 views

What are ways to encrypt a password inside an environment variable [migrated]

I have this file I use to set my username and password before exporting the value. #!/bin/bash echo -n "User:"; read user echo -n "Password:"; read -s password export ...
2
votes
1answer
34 views

Downsides of keeping host configuration files public?

I want to keep configuration for several of my hosts in mercurial and back it up, let's say, to bitbucket. Let's say, I have taken some precautions - tuned SSH to accept only keys, tuned pam to hash ...
0
votes
1answer
34 views

S/MIME certificate to minimize email bounce

I have a website hosted in a vps that sends informative emails to my clientes, maybe 20-40 emails per day. Since few weeks ago some sent emails are bouncing with the following error: This message ...
0
votes
0answers
19 views

Where does the biometrics domain settings change when the windows client interface is used?

To enable biometrics one would change the group policy for an OU to allow for domain login. This can be accomplished by changing settings in Group Policy on the server: Adminitrative Templates ...
-1
votes
1answer
20 views

Only allow a specific client to talk to a server

I have the following situation: have a server (ubuntu) running an application. I have a client (only the one client) requesting stuff from that server. To execute the requests, the client has to ...
1
vote
1answer
21 views

Hierarchy of Scanning Outgoing Mails on a Secure Email Gateway

Good day. Can anyone help me determine what could be the standard hierarchy of scanning outgoing mails on a secure email gateway (regardless 9f the vendor)? Should mails be scanned by policies before ...
-1
votes
3answers
91 views

Is blocking SMTP ports prevent server from sending emails?

I have a Centos server with cPanel on it. Yesterday, some hackers had successfully connected to my smpt server and sent thousand of emails from it. What I want to do is blocking every ports except ...
2
votes
1answer
34 views

fail2ban with PermitRootLogin without-password?

I tried to choose a title that cover the topic: Why should I use fail2ban (or similar programs) if I've my PermitRootLogin set to without-password? A very trusted and experienced sysadmin that I ...
0
votes
0answers
18 views

What particularly tools are useful for IDS for a beginner-junior server admin?

I am trying to make sure that I have some intrusion detection tools in place but I'm only a beginner admin and also standing in pending the time a proper admin comes in. I was reading up on IDS and ...
9
votes
1answer
59 views

Can I reasonably use SHA-256 in a DNSSEC deployment?

I know that RFC 5702 documents the use of SHA-2 in DNSSEC, and that RFC 6944 defines RSA/SHA-256 as "recommended to implement." What I'm not aware of is just how widely-implemented SHA-256 is in ...
0
votes
0answers
14 views

Can a web server be secured with just a firewall? [migrated]

I'm about to go online with my first web site, it is a small project hosted on a regular home PC running Windows 7. I want to keep the software footprint at minimum, so it only contains the operating ...