Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
3answers
102 views

Possible attack on the ssh server

could be anybody so nice explain me. On my linux server in log auth.log, i've found next line: Jul 27 09:16:30 aws-ftp sshd[13186]: Bad protocol version identification 'telnet mail.softlution.com ...
-2
votes
0answers
21 views

VPS server hosting multiple sites each in a sandbox? [on hold]

I've been running a VPS for quite some time now, and I've always wondered after surviving a hacking attempt at how to have 1 VPS, run multiple sites each in it's own sandbox, so that if one site (...
-1
votes
0answers
16 views

Finding location of data centers [on hold]

I have a list of applications for which i need to find their actual data center location, we can check it manually through checkhost.net but I want to check after load blancer from where the actual ...
0
votes
0answers
29 views

Unknown ssh connections found in lsof -i has my server been compromised?

I have a Digital Ocean droplet running Ubuntu 14.04. I use it for running quick node.js tests on a publicly available server. I just logged in via SSH and did $ lsof -i to see what ports I was using. ...
0
votes
2answers
20 views

Safe to secure mysql server with private networking?

I can't figure this out, so hopefully somebody can explain to me why and what's most secure: I'm hosting a Magento webshop on a VPS at DigitalOcean, but to make things more secure I thought it would ...
3
votes
1answer
109 views

Is it safe to store shell scripts into /var/www?

I have my apache host under /var/www/html and I put few small git deploy scripts into /var/www directory for simplicity. Is www a public folder? Is it safe to store scripts in there? If so, are there ...
0
votes
0answers
6 views

Is a root kit not an exploit? [migrated]

I once referred to the bluepill rootkit from 2006 as an exploit. I was corrected and told that root kits aren't exploits. Is this true? I thought an exploit included any software that was used to ...
-1
votes
0answers
12 views

Do UDP process in netstat-ano command means being hacked? [on hold]

If yes how to stop them permanently.. I am getting these pid's for svchost.exe process whwn i check in task manager Checking for pid(process id ) again and again is not good
0
votes
0answers
14 views

AWS security group change

I modified the security group for two VMs on AWS (from one security group to another - not just editing the security rules of an existing group). The VM's are behind Amazon ELB (and using Route 53). ...
0
votes
0answers
17 views

Secure Storage Requirements in the Cloud [closed]

I'm trying to understand some low-level security requirements for a cloud based secure storage solution. Specifically, I'm interested in the following: What mode of encryption (and integrity ...
0
votes
1answer
16 views

Printer installed on terminal server 2012 only works with group “everybody”

I'm trying to restrain access to printers on my terminal server. The printers are installed directly on the server because we're using thin clients to connect, so people don't have a local default ...
2
votes
0answers
40 views

Privacy concerns with windows 10 Pro

I don't need any of the Windows 10 enterprise features but enterprise is the only one that (legitimately) allows me to turn off the CEIP (Customer Experience Improvement Program); this is the ...
0
votes
1answer
27 views

Subdomain for every customer or one domain for everyone?

I want to offer an application to customers. I see that many applications on the internet have subdomain created for every client when he is creating an account. Is this good practice in terms of ...
0
votes
1answer
27 views

Is there some project/tool for testing web server firewall quality? [closed]

Would like to have a test with different aspects of firewalls. For instance, a test that would output info on: Layer 3/4 attacks DNS amplification attacks SMURF attacks ACK attacks Layer 7 attacks ...
0
votes
0answers
13 views

Configuring nginx + Laravel to not execute any other PHP files

I have a Laravel application hosted on nginx, using a fairly standard php-fpm configuration. There should be no need to execute any other PHP files on the server, except for one specific script that ...
0
votes
1answer
38 views

Jenkins login using GitHub Authentication failed being administrator

I was setting up authentication mechanism for our organization jenkins, which had no security mechanism, "ananoumos" can do anything, delete jobs,build etc. I did Install github-oauth jenkins plugin ...
2
votes
0answers
18 views

Enforcing audit settings for all subfolders and files on NTFS

On Windows 7 I would like to enforce auditing on all subfolders and files for a specific local folder, by using the included Windows auditing features. When a user moves a file from the same NTFS ...
-1
votes
2answers
44 views

Connect to AWS EC2 SSH for public location best practice

I have recently been learning about how to set up and run a Linux server on Amazon and I have been wondering about the best practice for SSH into it from a public place. By public place I mean like a ...
0
votes
1answer
83 views

Is there some way a user with an asterisk as password in /etc/shadow but a correct login shell in /etc/passwd would be able to login via SSH?

Let's assume the following. We have a server which is accessible via SSH. There is an user in /etc/passwd who has a valid login shell (so for example /bin/bash, instead of an invalid one like /bin/...
0
votes
1answer
31 views

Getting a safe access to a computational server [closed]

Disclaimer: I'm not a sysadmin, so I might say stupid things / rely on incorrect assumptions. Feel free to correct me. I work in a startup and some time ago we bought a server for internal use for a ...
0
votes
1answer
35 views

LAMP/Apache2: How to set webhook API PHP file as public but outside of project root directory?

I have an AWS EC2 LAMP server (using Apache 2.0 and mod_php5) with a basic directory structure like this: var |-- www | `-- api_folder (NOT public) | | |-- sensitive files (NOT ...
0
votes
0answers
26 views

How secure is it to use secret directory names to share files on unix? [migrated]

There is an old trick on unix systems to allow a non-root user to "securely" share files with particular other users. mkdir share chmod 711 share #others can traverse share, but can't list its ...
2
votes
2answers
86 views

Martian sources from my public IP

These days I get some Martian packets in the kern.log: Jul 7 02:28:20 box14932 kernel: [789192.798073] IPv4: martian source XXX.XXX.XXX.XXX from 10.91.12.01, on dev eth1 Jul 7 02:28:20 box14932 ...
30
votes
7answers
8k views

Good idea? Refuse incoming emails with our own domain ending? (because they must be fake)

I have a question about our Exchange Server: Do you think it is a good idea to refuse incoming external e-mails that have our own domain in the ending? Like external eMail from fake@example.com? ...
0
votes
2answers
39 views

Powrshell Script to read the Windows Secutiry logs and filter Elevation type 196 and 1937

I have a powershell script that reads the elevation type and displays the content in powershell window. However I need to put the contents in Excel file. Please help. cls $evtLogEntries=$null $...
0
votes
0answers
18 views

Restricting SQL Server Management Studio using LogMeIn Hamachi

I have a SQL Server 2016 instance on Windows Service 2012 VM running in Azure. Currently the network security group/firewall allows for port 1433/TCP traffic so I can connect from my PC using SQL ...
0
votes
2answers
26 views

Strange characters in nginx log starting with \x

I was hacked and checking nginx logs I found several requests like this one: 169.229.3.91 - - [18/Jun/2016:09:42:19 +0000] ")\xE7\xD1?\xD6\x18.\xC0\xCE\xA3\x7FR\xEA~O$\x0BLi\x13\xA0m\xE7\xF0H4\x92\...
-2
votes
1answer
48 views

TLS auth issue: 'CompanyA@exmple.com “via” SendGrid.me' email is dropped by Exchange [closed]

Looking for clarification about what this Exchange 2007 Management Shell (Powershell) command does and how it affects TLS at the Receive Connector: ms-exch-smtp-accept-authoritative-domain-sender ...
1
vote
1answer
17 views

Apache SSL FS disable SHA1

I am using apache 2.2.15 and are about to make it as secure as possible. When I do a scan of one of my websites via the Qualys SSL Test. https://www.ssllabs.com/ssltest/analyze.html It lists me the ...
1
vote
1answer
21 views

ModSecurity duplicate anomaly logs reported instead of single

This is my second time configuring ModSecurity with the OWASP ruleset. Previously I've used version 2.2.5 of the ruleset and now on a different server 2.2.9. I'm trying to configure anomaly detection ...
0
votes
1answer
14 views

Centos 6 Require Password to Enable NIC

We are using a dedicated NIC as a port forward target to allow support access to port 22 on a CentOS 6 machine. I would like to prevent the NIC from being enabled without a password. I know I could ...
0
votes
0answers
14 views

Multi user passwordless directory specific ssh login

I am running Ubuntu 14.04 LTS. I want to allow multi user passwordless ssh login. But I want to give directory specific ssh access. For example: My home directory(server home) has two folders user1 ...
-1
votes
1answer
12 views

sendmail : closing port 25

Nmaping my server I got theses results : PORT STATE SERVICE 25/tcp filtered smtp 80/tcp open http On the server-side : netstat -lpn Proto Recv-Q Send-Q Local Address ...
0
votes
1answer
13 views

ModSecurity IIS Block Out of Country IPs by X-Forwarded-For

Problem We've had someone that has been trying to crawl our site with random, malicious urls (for about 12 hours now). Here is the log file 2016-06-29 08:17:02 10.X.X.X GET /assets/plugins/lightbox/...
1
vote
2answers
57 views

OpenStack Horizon behind reverse proxy (nginx preferred)

Current situation: I have a Triple-O OpenStack installation (Liberty) where even the "public" network is in a private environment (10.24.7.0/24 network). The only way to get access to that network is ...
-3
votes
0answers
24 views

Secure tomcat (by ip AND basic auth) [duplicate]

I have a server working with tomcat. Inside webapps i've secured one folder. This folder has basic auth to access, all this works. What i need is to protect this folder in another way. Only people can ...
0
votes
1answer
25 views

Is it safe to use only iptables for security?

I have 2 servers on different machines. First machine should send requests to second machine via tcp. Both machine have static ip addresses. Does it secure to protect this interaction between servers ...
1
vote
2answers
27 views

Securing Mail From Admins - Office 365

I'm trying to determine the best solution that allows me to assure our CEO that his Office 365 mailbox cannot be read by anyone, including myself, an admin. Obviously the mailbox is already locked ...
0
votes
1answer
23 views

AWS EC2: Secure configuration via IP access list

My company have a network with a fixed IP address/IP address range. Is it save when I configure my Security group that all traffic from this IP address will be accepted and everything else will be ...
0
votes
0answers
12 views

MYSQL error: IP address could not be resolved [duplicate]

My website is hosted with Linode, I installed webmin on Ubuntu 14.04 to manage it. Recently my database server keeps shutting down, when I look at /var/log/mysql, there are several log files in there ...
0
votes
1answer
38 views

How to make git forget my credentials

I am using GIT in windows. The repository stores my credentials and uses it for manipulating remote directory. For security reasons, I want to manually enter my credentials every time I do ...
0
votes
0answers
29 views

avoid data leak by block internet access for PCs, but allow internet access through remote desktop

In a small network(in my company), I would like to block some computers(PCs) to access the internet, so that sensitive data or files in those PCs can not be leaked. But I still need users of the PCs ...
-4
votes
2answers
50 views

Does it make sense to have a server dedicated to login? [closed]

Since the login process itself involves an expensive hash, it also makes this part of any app vulnerable to (D)DOS attacks. Is it a good idea to put the login portion of the app on it's own dedicated ...
3
votes
2answers
50 views

Does Active Directory send a user's access token across the network?

Question: does AD send a user's access token across the network? Research: The following two passages contradict themselves--given that TGTs are transmitted across the network by design. From the ...
0
votes
0answers
25 views

Web server got compromised (What to do next?) [duplicate]

My webserver got compromised (I think). The last 3 days inbound traffic spiked up to abnormal levels, in 3 days +/- 2.5TB of bandwith got used. when reading my access logs I see thousands of requests ...
1
vote
3answers
116 views

Are there any disadvantages of blocking port 80 for security reasons?

To improve security, we would like to make https access to all customer sites that we host mandantory, and guarantee this in our terms and conditions. The problem is that currently the Apache ...
0
votes
0answers
15 views

FTP file upload positive or negative file extension list

I'm setting up an FTP on IIS and I want user's to not be able to upload possible dangerous files based on file extensions. Now I'm uncertain if I should create a positive list to allow or negative ...
-1
votes
1answer
31 views

Updating Ubuntu Webserver

Our webserver is on AWS running on Ubuntu 14.04.3 LTS. When I ssh into the server I see this message. 196 packages can be updated. 123 updates are security updates. Should I update our ...
0
votes
0answers
18 views

Tracking filesystem changes in runtime

I need to have program that tracks changes made to the file e.g. when I am installing software from supplied installer instead of packages. I do not want to checksum every file in filesystem because ...
1
vote
1answer
33 views

Security of SSL certs on AWS ELBs / SSL offloading

I have some concerns about security and am wondering how AWS will store an SSL certificate deployed to an ELB. I have a wildcard SSL cert for my domain that I want to make sure doesn't persist ...