Security is not a product, but a process.

learn more… | top users | synonyms (2)

1
vote
0answers
20 views

ModSecurity phase not working?

Sorry I am very new to modsecurity (2.8). So I made my first rule to block a referrer spam with the following: SecRule REQUEST_HEADERS:Referer "buttons\-for\-website\.com" ...
-2
votes
0answers
18 views

Guides for Honeypot Security [on hold]

I'm looking for a good resource or guide on best-practices when setting up honeypots. Is there a particular book or reference that goes into more depth? I have been able to successfully deploy a ...
0
votes
3answers
21 views

aws ec2 security group and centos ip tables

I try to change the SSH port from 22 to another port (218). In AWS EC2, I shall add the rules in security group or in IP Tables? Is there any guideline/references recommended for EC2 Security ...
1
vote
3answers
253 views

Confused about what I'm seeing in my apache access log (think I might have been hacked)?

I have a VPS running CentOS. I installed apache and configured the access log. Just checked it and found some interesting traffic: VPS-Hostname MYIP MYIP - - [23/Dec/2014:16:47:20 -0500] "GET / ...
1
vote
1answer
50 views

What is the best way to block IPs from an apache2 web server?

I'm asking myself whats the best way to block certain IP Addresses (or whole blocks from countries like china, south korea) from accessing my apache2 web server. I'm aware of methods using Allow ...
-3
votes
0answers
17 views

Connect public cloud network with a private enterprise network [closed]

can you describe or provide some documentation related to the different architecture used to connect a public cloud network and a private enteprise network? Nowadays hybrid cloud is sold as a solution ...
4
votes
2answers
54 views

Website is being targeted by mail bots

I have a small website. When I perform a netstat is shows a lot of traffic from .p.mail. I think this is some kind of mail bot, trying to harvest email addresses from my website. How can I prevent ...
0
votes
1answer
29 views

Pricing of Key Pairs and Security Groups on AWS?

My free AWS account expired. I deleted all S3 and EC2 resources, but am wandering if I can leave the Key Pairs and Security Groups without having to pay for them. (My account resources look like this ...
-1
votes
1answer
56 views

How do you “prevent powerful accounts from being used on unauthorized systems”? [closed]

I was browsing through Microsoft's Best Practices for Securing Active Directory and saw the chart linked which includes some of the best practices included in the document, rated by importance. At ...
12
votes
3answers
818 views
+50

Enable SSH shell access but disable SFTP access

I've searched for a viable answer to this question, and most of the answers include advice on why to not do it. However, here's the scenario, and what makes it necessary: I have a console app, and in ...
-1
votes
1answer
67 views

Restrict shared folder access to specific computer/IP [closed]

How to configure a server [having DNS and ADS roles installed user account created/configured] to restrict its shared folder access to a specific computer in the network. Sol-1: Solution proposed ...
5
votes
2answers
48 views

Perfect Forward Secrecy (PFS) for mail servers

Perfect Forward Secrecy is an important enhancement to SSL/TLS communications, helping prevent captured SSL traffic from being decrypted even if the attacker has the private key. It's easy enough to ...
3
votes
2answers
36 views

Are redirected GET request to HTTPS secure?

This affects a lot of thank-you pages from 3rd party carts, etc. Are GET requests to HTTP that are redirect to HTTPS secure? Or, can they be snooped before the redirect takes place? Thank you
6
votes
1answer
62 views

How widely supported is forced TLS on inbound SMTP connections?

I run an MTA consisting of the standard Postfix, SpamAssassin, ClamAV, SPF/DKIM checks etc. This MTA is used for inbound email only, doesn't host any accounts and forwards any mail that passes said ...
1
vote
1answer
28 views

HTTPS posts to HTTP URL's insecure?

Have to deal with some incorrectly assigned/redirected posts from an HTTPS server to HTTP URL's. How much of a security risk are these? Are they vulnerable to something like a man-in-the-middle ...
-2
votes
0answers
13 views

WordPress Unauthenticated Shell Upload Vulnerability - wdt_upload_file [duplicate]

I have problem with my Debian server and security issue. In /var/log/apache access.log i found those errors: 46.118.159.153 - - [14/Dec/2014:13:42:25 +0100] "GET //wp-admin/admin-ajax.php HTTP/1.1" ...
0
votes
0answers
13 views

Apache2 Mod_spamhaus Whitelist

We are using Apache2 mod_spamhaus and many customers were banned using the "Post" method. There is no way to deny mod_spamhaus ban continuously our customers making false positive or ban customers ...
0
votes
1answer
28 views

Centralised log monitoring for linux servers [closed]

I've read several QA on this site about monitoring servers, but I found out, that none of them centralises all the logs I want to watch. To describe my situation: 10 linux hosts Using logwatch to ...
-1
votes
0answers
49 views

Non-standard way to access a drupal site (circumventing security)

In a Drupal installation, I have a site configured like so: DRUPAL_ROOT /sites /sites/example.com.au/ /sites/example.com.au/settings.php The web server's default site has DRUPAL_ROOT as its ...
1
vote
0answers
19 views

Why does SYSTEM “Privilege Use” event cause another program to crash?

This is an odd one that I've been trying to track down for while. I am not a server administrator, but a programmer/developer, but, sadly, at my company, I probably have the most knowledge of how to ...
1
vote
1answer
30 views

Authentication of saltmaster against salt minions

I am just getting started with salt and I am wondering how the saltmaster is being authenticated against the clients. I know that when connecting a minion the master has to accept the public key of ...
1
vote
0answers
63 views

Can I install an internet connection on a small town? What would I need? How much would it cost? [closed]

Here is the problem. 3,000 people with no internet or internet very slow. Here is what I want to do. Give them free or almost free internet based on how much money they make or have. Can I do it? ...
0
votes
1answer
23 views

Remote SCP & SSFTP access to linux server denied

This situation is a bit embarrassing but I could really use some help. I took steps to secure my linux server by carrying out the following steps: created and use a different user to use in place ...
0
votes
1answer
27 views

Using Cloud Servers and Firewall

I would like to ask if the configuration of "firewall rules eg. only allowing port 80.. when configuring a server instance on cloud services such as google cloud and amazon aws is securely equivalent ...
2
votes
0answers
22 views

Device not accepting connections from a forwarded port. Security Issue?

I am forwarding a port through to a PLC/Management unit type device for a heatpump. The device accepts local connections from the LAN on port 80. It runs a normal web site on port 80 for management. ...
-1
votes
0answers
31 views

Hiding parts of huge php project [migrated]

I have a big php project. Now I have not big developers team but we want more. So now I'm thinking about code security. Is there any possibilities to hide parts of code? For example. One team develop ...
3
votes
2answers
105 views

High number connections coming from an IP

On our corporate network we're detecting workstations opening too many connections to the IP address 75.126.196.159 (port 3478) causing the Cisco ASA Firewall 5550 to detect a "SYN Attack" and reach ...
0
votes
1answer
53 views

Enabling TLS1.0? Cannot communicate securely with peer: no connection encryption algorithms

For over a year I have been running a photo based website that allows customers to order prints, which are subsequently fulfilled by a printing company. Orders are posted in XML format to a ...
1
vote
1answer
36 views

Lockdown Mozilla Thunderbird on Windows Remote Desktop Services

I've installed Mozilla Thunderbird 31.3.0 on a Windows Server 2012 R2 which has the Remote Desktop Services role. I want to configure the Thunderbird program and set each user's email account etc and ...
-1
votes
0answers
35 views

Best practice to provide MySQL access to my users

My application collects data and stores it in a MySQL database. I want to provide read access to my users. I previously had a VPS with cPanel. I set up a read-only mysql user and distributed the ...
0
votes
1answer
134 views

nginx - deny all *.php requests except index.php for security reasons

os: CentOS 7 nginx: 1.6.2 httpd: apache 2.4.6 cms: Drupal 7 After my server was compromised I removed all from server, reinstalled OS and soft, and restored data from backup. Now I configure all ...
-3
votes
0answers
36 views

Large number of requests, high outgoing traffic [duplicate]

I have a VPS on Linode with Ubuntu 12.04 LTS on which I run my staging server (protected with basic HTTP authentication). I the recent days, I received a high number of requests from a handful of IPs ...
-1
votes
2answers
52 views

HowTo Track an E-Mail on it's voyage [closed]

Is there any way to track an E-Mail during it's "journey"? A friend of mine believes, that People the sports club he is involved with and where he has an E-Mail adress, is reading the E-Mails of all ...
-4
votes
4answers
63 views

Blocking another Win 2008 R2 admin from accesing some important folders

I have sold half my dedicated server to somebody but I dont want them accessing my web hosted Plesk files for my Wordpress website. As some of them are custom and confidential. I gave them local ...
-3
votes
0answers
34 views

Is my vps being hacked? [duplicate]

I'm on a debian vps that was rebuild from scratch a few hours ago. In ps aux I get weird entries and commands I haven't started: root 2553 0.0 0.1 3164 1616 pts/0 Ss 23:09 0:00 -bash ...
0
votes
1answer
29 views

How should a wildcard certificate be used?

I have a wildcard certificate (pfx file) and I have doubts on how to use that. Should I install that on all of my application servers or alternatively create a new certificate and sign it with the ...
2
votes
2answers
59 views

Restrict access to active directory attributes from a particular computer?

I know that some attributes in AD are classified as personal information and some are classified as public information (see the "property set" column here - ...
-6
votes
0answers
52 views

How to bring a hacker to justice? [duplicate]

One of my sites disappeared. Or to be exact httpdocs and httpsdocs were wiped out Logs showed, that the server started to generate 404 errors after this request: 89.248.172.175 - - ...
0
votes
0answers
53 views

Enabling the Internet Connection on an EC2 Windows Server 2012 Machine

I've disabled the firewall: netsh firewall set opmode disable I've made sure to accept all inbound and all outbound connections: Is there anything that I should be installing or adding on to the ...
-2
votes
2answers
54 views

Removing the Security Alert Outlook pops up for internal network domain clients - Remove security?

I have several Outlook clients on the internal network pointing to the internal DNS name of the Exchange 2010 SP1 R2 server. The name we're using is exchange2.example.local. Since new guidelines ...
1
vote
2answers
69 views

Should I sudo as root or use a public key [duplicate]

I have read a few times to disable root login and sudo as root using another user. But is using a public key as good if not better security?
0
votes
1answer
16 views

Solaris 11 / OpenSolaris - stop processes from listening?

I would like to write a script to secure Solaris 11 servers in preparation for internet access. In addition to enabling ipfilter, I would like to disable network-accessible services that are not ...
-3
votes
1answer
29 views

Data Backup from aws to other cloud storage for backups if aws account get hacked [duplicate]

We are thinking to make a backup of all our AWS data (RDS and S3) to some other cloud sources, because there is a possibility that a developer of company AWS account get hacked. The hacker could then ...
0
votes
0answers
27 views

Remove mapping drives from RDP to user from exteral network

I would like to know if you guys have a solution to my problem. I have a terminal server 2012 that can be accessed remotely after a VPN connection and from the LAN. My question is how can I create a ...
0
votes
1answer
11 views

How to stop username enumeration in Samba on Ubuntu?

I'm using Ubuntu 12.04 LTS to serve a web application to a local Windows network. A recent pen test highlighted that it was possible to enumerate local user accounts on the Samba service. I have been ...
0
votes
0answers
33 views

Server 2012 LDAP signing - “Number of simple binds performed without SSL/TLS..”

Here is our log on event 8227: Number of simple binds performed without SSL/TLS: 88 Number of Negotiate/Kerberos/NTLM/Digest binds performed without signing: 0 I have set LDAP Interace Events ...
0
votes
0answers
16 views

setting up DANE fails, error with “could not get cert chain from ssl”

I successfully setup DNSSEC and enabled it on my domain. I'd love to make use of my DANE. I created a standard self signed certificate openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem ...
0
votes
1answer
19 views

Disable Apache server signature [closed]

I've just set expose_php to off via WHM's Configure PHP and suExec. For security purposes I want to additionally hide: Apache ServerSignature/ServerTokens/PHP X-Powered-By I can't find a relevant ...
3
votes
1answer
213 views

Determine if possible successful probe is successful exploit?

A logwatch report outputted the following message. A total of 1 possible successful probes were detected (the following URLs contain strings that match one or more of a listing of strings that ...
-1
votes
0answers
18 views

Restrict access to one VPC in AWS

I am trying to restrict users to a single VPC. I went through Controlling Access to Amazon VPC Resources and came up with the following policy but it does not work. Can someone point out the errors in ...