Security is not a product, but a process.

learn more… | top users | synonyms (1)

3
votes
0answers
27 views

How to configure a log aggregator to authenticate data?

Background: Remote log aggregation is regarded as a way to improve security. Generally, this addresses the risk that an attacker who compromises a system can edit or delete logs to frustrate forensic ...
-1
votes
1answer
13 views

winserver2012 “closed access” permissions to folder

I have some sensitive files, that should be accessed only by a small group of users. Currently the files are stored in a folder, on a WinServer 2012 machine, and will be accessed via a mapped location ...
0
votes
1answer
13 views

How to secure communication even further between server and Apple notification servers?

I have a server running by Amazon, who has notification capabilities for the user (push notifications). I have the code all working and have no question about that. To make the push working I have to ...
1
vote
0answers
11 views

Weird `lastb` output

Recently I got weird output from lastb on my VPS: root ssh:notty 122.10.102.42 Thu Aug 27 11:19 - 11:19 (00:00) root ssh:notty 122.10.102.42 Thu Aug 27 11:18 - 11:18 (00:00) ...
0
votes
1answer
25 views

How to save output from grub-md5-crypt to a file ?

I am using Cent OS 6.5 and I want to save the generated output and md5 hash from grub-md5-crypt command to a file. The grub-md5-crypt command asks us to set a password. I want the password(which I ...
3
votes
2answers
22 views

StartSSL cert doesn't work with Dovecot/OpenSMTPD

I've an issue with my StartSSL certificate. When I try to use it to activate SSL encryption on Dovecot, I get the following error in my log when a client attempt a connection to the imap server : ...
-2
votes
0answers
41 views

Linux based security for companies - how much do you do? [on hold]

So if your company is mostly Unix/Linux based on the server side (but mostly Windows on the client side), how do you go about securing the network and all workstations? I assume that you have a ...
2
votes
3answers
572 views

Remote users attempting to gain access to root mysqld

I have just reviewed my syslog file and notice a TON of entries of the following: Aug 25 13:06:17 ssrv001 mysqld: 150825 13:06:17 [Warning] Access denied for user 'root'@'61.160.232.48' (using ...
0
votes
1answer
17 views

DNS queries are high for non existent records. can safely do a 0.0.0.0 wildcard record?

I have a domain and i am use dnsmadeasy for the DNS. I have noticed the queries are up in the millions each month for records i don't even have. So is it okay to do a wildcard A record such as ...
-1
votes
2answers
18 views

okay to allow any outgoing port for sending mail

I have a small app on my centos6.6 server i am running that allows the user to send an email on a custom port and I am allowing any port to be used. Is there any security risk for allowing this app to ...
0
votes
0answers
13 views

Teamviewer webclient does not use https [migrated]

Using fiddler, I noticed that the traffic generated by the teamviewer webclient is plain http. Is that a security concern given that teamviewer themselves claim that https is used?
-1
votes
0answers
14 views

CVE RSS security vulnerability feed/alerts for specific software? [on hold]

I've found myself responsible for maintaining PCI compliance on our servers. I get reports from our scans and then react based on the information in the scans by applying patches or updating ...
0
votes
0answers
39 views

Applet not allowed to run

I am running a simple applet application into my mozilla firefox browser but java blocks it. I have done all changes as suggested on different different articles like adding url to ESL, security ...
-1
votes
1answer
24 views

Server 2012 R2 TCP Timestamps

We will be having some penetration testing performed shortly and looking to clean up a few things. One of these is TCP timstamps in Windows. A simiple NMAP scan shows me a guess of the TCP timestamp ...
0
votes
0answers
15 views

configure apache to use sql server authentication using password and salt

I got a web application which I want to protect using apache authentication. I found out that it uses sha1+salt to store passwords. Since auth_mysql_module is deprecated I try to use authn_dbd_module. ...
1
vote
3answers
68 views

SSH and security guidelines

I'm trying to set-up an ubuntu server (14.04 LTS) following some security guidelines. One of these guidelines suggests to disable root user and create a new user that works as an administrator using ...
0
votes
1answer
19 views

Ubuntu production server access configuration recovery options

I have a cloud based server. I followed this guide to configure its security : http://www.rubytreesoftware.com/resources/securely-setup-ubuntu-1404-server The configuration of SSH is as follows: # ...
-2
votes
3answers
58 views

Is there a GUI tool to log and view outgoing CURL requests from a Linux server? [duplicate]

I've seen several similar questions - but none that truly answer the question. So here goes: PROBLEM: A script is being run on one of our servers that is making outgoing post (and other) requests ...
2
votes
1answer
21 views

Group Policy settings for account policies disappeared

Looking for any ideas, we discovered that our group policies (default policy) was no longer applying our account policies (password age/complexity/history etc). Our DCs still had the local policy ...
0
votes
0answers
20 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
0
votes
1answer
46 views

Linux DMZ in a Windows Network

I'm a wet-behind-the-ears reluctant sysadmin, so I'm playing catch-up here. I've come across the term DMZ before, but I never looked into it until just recently. In fact I'm still not sure exactly ...
1
vote
1answer
47 views

Using a whitelist too large for an AWS VPC Security Group

I have a large list of IPs I need to whitelist for a VPC instance. I've added as many ranges as possible to the security group until I ran out of available rules. I'm adding rules for HTTP and HTTPS ...
0
votes
1answer
9 views

How to forbid access to admin URL path in Apache config by IP subnet?

I want to only allow a private IP range to be able to access the administrator panel on my site. I found an article explaining how to do it for a specific directory path, such as /var/www/admin/, ...
0
votes
1answer
39 views

Permission issue on windows server

I have logged on to a windows server 2012 R2 machine with local admin account. I was trying to save a file on the hard drive but it says that I do not have permission to save file on the disk. I have ...
0
votes
2answers
33 views

Lost all local admin rights on domain joined computer

I'm in an unusual predicament in that there is no account I can use to add local admin rights to a computer with the exception of the Administrator account - which is disabled. On a new domain I'm ...
-1
votes
0answers
14 views

secure IIS directory traversal and command exec [duplicate]

i have a IIS 7.5 webserver that an attacker upload an aspxshell on it, is there any aspect to restrict this malicious script to it's application pool folder? like php_openbasedir thanks
0
votes
0answers
11 views

Openswan L2TP setup to allow admin user access to AWS VPC

I've got an ssh bastion host, but managing the ssh whitelist is annoying, opening ssh to the world is suboptimal. I'd like to tuck a vpn server in front. Can't get openvpn to stay connected for more ...
0
votes
1answer
16 views

mitmproxy device identification

Currently am experimenting with mitmproxy. I have a setup where I can see all the traffic that is running through. I have multiple mobile devices (ios and android). I have installed the mitm ...
0
votes
1answer
40 views

How to access AD directory user which has no read permission

While doing some testing, I have accidentally revoked Read permission for "Authenticated users" on a user in AD, and now I can not grant it again, because user is "invisible". I've done the ...
2
votes
1answer
40 views

SELinux not enforcing apache write restrictions despite being enabled

Problem in a nutshell: SELinux does not protect files and directories labeled as httpd_sys_content_t from being written, deleted or changed when new/custom document root is created. I have ...
1
vote
1answer
31 views

How can I scan files (or data streams) for virus/malware before uploading them into the server and database?

How can I scan an incoming file upload (or a datastream) into a webserver and database for virus/malware? I know how (using the excellent Clam) to scan things after they have been uploaded, but I ...
2
votes
1answer
52 views

How secure is this Nginx Config? What else can I do to optimize it further? [closed]

So I recently setup a personal GitLab server and I am using the following config with full SSL. I tried my best but what else can be done to make it better? I mostly learned what I know about ...
0
votes
0answers
23 views

Patriot Act and Office 365 [migrated]

I am not sure if this question goes here as it relates to Office 365. I have a local Exchange server which has some several spam and email reception issues (Due to an expired subscription to a spam ...
0
votes
1answer
37 views

Securing outgoing emails with logs of a web server

On the web server I am going to run rkhunter, tripwire, OSSEC, fail2ban and psad. All of those applications need to be able to send emails to notify the sysadmin. Therefore, I've: sudo apt-get ...
0
votes
1answer
45 views

Setting up two WiFi networks (one public, one private) with two routers

I would like to isolate my private WiFi network from my business's public WiFi network using two routers (so that no one on the public network can access the devices on the private network). I ...
2
votes
2answers
29 views

Linux: Detecting/thwarting system modification or use of single user mode

Working through a backup solution and could use some security assistance. Please see below. The process For our editing business, we have an offsite backup server that we update nightly using rsync ...
0
votes
1answer
39 views

Disabling TLS v1.0 with SQL & RDP

How do I disable TLS 1.0 without breaking MS SQL & RDP on Windows Server 2008 R2? If I simply disable it, RDP stops working along with MS SQL. Tried googling but I can't find a solution. Is this ...
0
votes
1answer
41 views

Strange symbols in /var/log/auth.log

I just installed fail2ban after realizing that there were tenthousands of attempts to log into one of our servers over SSH. After installing fail2ban, the log bloat stopped, but I still wanted to ...
-1
votes
2answers
40 views

Preventing a user from running a script that should only be run by a CRON job?

I have a contact form on my site which uses $HTTP requests instead of reloading on the form submit. It's a really awesome feature, but it also opens up some nasty doors. My contact form sends an ...
1
vote
3answers
57 views

Allow internal DNS to be queried from the DMZ?

We have a mail gateway running in a DMZ, which is a relay for our internal mail server holding all the mail. We have come accross the need to use DNS from the DMZ to resolve names of internal services ...
0
votes
0answers
16 views

Hold F5 cause all virtual hosts crash : How to limit max process per user in SuPHP

I am hosting a VPS server with Apache2, PHP/SuPHP and MySQL (LAMP). I have many virtual hosts on that server. The problem is that when someone (that happens about 20 times a day) hold F5 on a website ...
2
votes
0answers
16 views

Windows 8 GPT Encryption [closed]

I have to run encryption for HIPAA Compliance and ran into a snag. I have a Windows 8.1 Home with GPT Based drive. It does not have Bitlocker nor TPM, and VerCrypt doesn't support GPT Partitions. ...
0
votes
1answer
15 views

java - how to limit sending email by 3rd party tools?

I have a (Win2008 R2) box running the Jenkins continuous integration server. It's a java program running as a Windows service. The command line looks like this: > "C:\Program Files ...
0
votes
0answers
99 views

sysctl: cannot stat /proc/sys/kernel/exec-shield: No such file or directory

Enable ExecShield protection - ExecShield is security Linux kernel patch to avoid worms and other problems. After Adding to /etc/sysctl kernel.exec-shield = 1 Getting this error sysctl: cannot ...
1
vote
1answer
24 views

Nginx - Redirect to different url if an image is directly access

I want to redirect users if they access the gif images directly. http://www.example.com/uploads/file.gif This should be redirected to home page or some other page. Or If the image is directly ...
2
votes
4answers
95 views

How to get 2 servers under control (Red Hat Linux)

I've got kind of a situation here. We need to get 2 servers under our control. The things we know so far: both are running linux, at least one is running Red Hat they are used as file-server, mysql ...
1
vote
1answer
31 views

nginx spam 404 errors

My server is spammed by multiples XXX domains, there is a lot of 404 errors in my logs and i can't find the solution to stop that. 2015/07/31 09:13:20 [error] 7070#0: *610 open() ...
0
votes
1answer
25 views

fwknopd on Centos 6.5

I'm getting the same error as this guy. Namely, Error: Package: 1:fwknop-server-2.6.6-1.fc21.x86_64 (/fwknop-server-2.6.6-1.fc21.x86_64) Requires: libc.so.6(GLIBC_2.15)(64bit) Error: ...
1
vote
0answers
8 views

iis 7.5 ipSecurity denyAction=NotFound causes 500 error instead of 404

I'm restricting access to certain folders in an IIS 7.5 web application based on IP address. Here is a segment from applicationHost.config: <ipSecurity allowUnlisted="false"> <add ...
4
votes
3answers
207 views

How to remove RC4 cipher from node.js https server running on Windows 2012 R2

Using ssllabs.com's scan tells me RC4 is in use. I read that RC4 should be disabled by default in Windows 2012 R2. I'm running a node.js server using https.createServer and not specifying ciphers ...