Security is not a product, but a process.

learn more… | top users | synonyms (1)

-1
votes
0answers
7 views

GFI Languard or Nessus [on hold]

we have GFI Languard 2012 and we are looking at Nessus Manager. At a glance they both are more or less the same. Which one is better though based on below? Features Reporting Scalability If you ...
-1
votes
0answers
9 views

php disable_function recommended settings [on hold]

Looking to enhance PHP security. What is a recommended disable_functions setting for a shared hosting server with cPanel, PHP 5.5 (CloudLinux), suPHP enabled? My current setting is: ...
2
votes
1answer
17 views

Can I block a file execution with AppLocker?

We currently use a combination of a regular and an "advanced/fancy" endpoint malware protection, in the advanced malware app, I can feed a SHA256 hash of an executable into the advanced platform and ...
1
vote
1answer
24 views

Virtual web server configuration dmz

I have 2 rx300 server with Esxi and I want to use one of these as web virtual server with 2 VM running: - Mail server - WEB server for enterprise website and ecommerce. the esxi server has an iscsi ...
0
votes
0answers
18 views

How can I automate the retrieval and usage of passwords from within a script?

We have automated scripts that access certain devices and are getting the passwords for the devices from a root-read-only plain-text file. Is there some kind of architecture we can use so that we can ...
-1
votes
0answers
22 views

Universal management System abuse [duplicate]

Our ISP have told us that our machine ( universal management tool ) is being abuse. What they send us as log files was this: Jun 13 08:37:37 penfold postfix/smtpd[6176]: connect from unknown[x.x.x.x] ...
4
votes
1answer
109 views

Server2k8: Prevent membership in a group based on membership in another group

I'm revamping my company's service accounts, and we've discovered that some need to be able to log on locally, and some are OK with just logging in as a service. I've created two groups, ...
0
votes
1answer
16 views

Azure SQL - Sudden connection spike

At first: This is my first question on Serverfault. I am not sure if it fits better on Information Security. If so, please leave a comment and I will move the question. Question My company is ...
0
votes
0answers
8 views

PSAD / removed iptables block

I'm pretty new to PSAD but eagerly getting into it to have a safer installation. But some understanding is missing I've had yesterday the following notification : [psad-status] removed iptables ...
0
votes
0answers
5 views

Is it secure to do “chroot” SFTP directory without actually setting owner to be root?

I don't know if this sounds wrong, but I have a use case where I need to run a cron job and rsync the data into the SFTP file directory. Typically SFTP set up on the Internet would suggest to set the ...
0
votes
1answer
16 views

Google Apps password change not reflected across all devices

We have a paid Google Apps account and I recently changed the password for one of our users. I confirmed the password change by logging into gmail.com using the new password. The old password isn't ...
1
vote
0answers
4 views

I can installa “Ossec” on xenserver host?

I own a xenserver where the host is connected to the public ip network. I allow connections only from my static ip and deny amy other with iptables, but I can install monitoring system like Ossec ...
3
votes
1answer
38 views

Debian - Warning: Possible LKM Trojan installed

I am running chkrootkit every night on 3:04. More than 1 year it was not returning any problems but 1 month ago this warning started to appear: ======================= Checking `lkm'... ...
0
votes
1answer
23 views

What users should have access to sudo? (node, php, ftp…)

Before I begin, feel free to suggest a better title for this question. I've registered on Digitalocean and installed a LEMP stack. This is my first time configuring a server from scratch. Even though ...
9
votes
3answers
2k views

Is it really secure to connect to a server by SSH from hotels during a journey?

Is it really secure to connect to a server using SSH from hotels during a journey? Server: - CentOS 7 - Authorisation only by RSA key - password auth is denied - Non-standard port Workstation: - ...
0
votes
1answer
10 views

XSS Vulnerability with PCI RapidComply

I have a website hosted on an Apache Tomcat 7 server that uses the Authorize.net gateway and merchant services to handle payment. I recently ran a required PCI Compliance test against my website, and ...
-1
votes
0answers
14 views

Protection of information terminal running Windows OS [closed]

I need an information computer terminal to work 24/7 in a protected public area. Operating system is Windows POS Ready 7 EVAL. I need this terminal to send HTTP messages to a single IP address in the ...
6
votes
0answers
55 views
+100

Is is possible to disable Certificate Transparency (audit log checking) of certificates in Chrome?

We utilize HTTPS deep packet inspection in our firewall via a trusted root certificate in the Windows certificate store. Chrome recently pushed forward with a feature to perform additional checks on ...
0
votes
1answer
20 views

is there security risk when running tomcat7 on port 80

I have setup a server with tomcat7 running on port 80. I have googled around and found out that since port 80 is a "magic port" it needs root privileges to be bound. For this reason most comments i ...
0
votes
2answers
47 views

What IP address should I use for a device that I want to break network access to?

I have an IPMI server on a super micro motherboard that I am unable to disable. There is not even a jumper to disable this either. After seeing all of the security issues that the IPMI server they ...
0
votes
1answer
22 views

TCP Keepalive: Why does an idled ESTABLISHED connection end after 60 seconds, instead of tcp_keepalive_time?

I am investigating ways to mitigate a server against DoS-type attacks. In one scenario, I've opened several hundred TCP connections to my webserver. I do not send any data after the initial TCP ...
2
votes
2answers
29 views

Restrict access to .ssh folder over network shares

I run a small server running Ubuntu Server 14.04 and have just noticed that the .ssh folder in the users home directory is accessible via SMB and NFS. The SMB and NFS are both secured, however I ...
0
votes
1answer
16 views

Block/Prevent Adminer - Apache [duplicate]

I found out that if someone was able to hack any FTP account on my server and upload Adminer they could alter the database. I tried Google'ing a way to block or prevent Adminer from working, but got ...
0
votes
0answers
19 views

Subversion Edge Security Failure?

I've kept my Subversion Edge upgraded with the most recent binaries, whenever the latest release was I did it. I just created a new user and went to add him to the repository access rules and noticed ...
1
vote
2answers
56 views

From a technical perspective, is my data insecure when using a public VPN like SecurityKiss?

I wonder if I understand well VPN. I connected to SecurityKiss, they provide a list of TunnelBlick configs. In order you to connect their VPN. (TUnnelBlick is OpenVPN based). Am I right : your IP is ...
0
votes
2answers
14 views

How can I audit Ip adresses of users logging into system?

I have a group of servers which use Kerberos for authentication. We distribute keytabs to users but want to ensure that a user never pass their keytab to someone else. Essentially we need to audit the ...
0
votes
1answer
16 views

auditctl buffer setting - how large is this?

Within the default audit.rules file on CentOS 5, 6 and 7, the following is set: # Increase the buffers to survive stress events. # Make this bigger for busy systems -b 320 However, there is no ...
0
votes
0answers
10 views

Deny Downloading of Files unless user is Authenticated

Here a bit of a simple on for someone I think but the answer has eluded me. I would like to prevent unauthenticated users from downloading files from my secure directory (/secure/) on my IIS 7 Web ...
0
votes
0answers
20 views

Nginx Default/Welcome Page Suddenly Returns

I installed Nginx a number of months ago and deployed some code. I obviously deleted the default index.html Nginx default page. I know this for certain as PHP was not installed and so index.html was ...
0
votes
0answers
12 views

Enforcing RC4 cipher and testing enabled ciphers with openSSL

I am trying to enable and enforce RC4 cipher on apche 2.4 and I checked the http://httpd.apache.org/docs/trunk/ssl/ssl_howto.html It says RC4 cipher can be enabled in below 2 ways 1. SSLCipherSuite ...
0
votes
2answers
34 views

Add custom 'allow' policy in SELinux

I would like allow httpd to executed files from a user's home directory. From audit2allow I understand that this implies the following policy: allow httpd_t user_home_t:file execute; How do I turn ...
0
votes
3answers
46 views

Security concerns with enabling PowerShell on a production server [closed]

I work in the software development side of an ISV. We're thinking of using PowerShell for some utilities in and around the core application (which itself is ASP.NET). One of my colleagues said to me ...
0
votes
0answers
22 views

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from ...
3
votes
2answers
74 views

How worried should I be about unsecured HTTP on a “private” network?

So I've joined a new team, which develops and operates a service available on the Internet. It's aimed at B2B use rather than consumer, although anyone can sign up for a low-tier account to check it ...
1
vote
2answers
50 views

site-to-site vpn tunnel - does hardware matter? [closed]

I have been tasked with setting up 4 offices and connecting them all together so they can be on the same network. Does hardware really matter or could I build a decent machine in the low $1000's and ...
0
votes
1answer
17 views

How to manage access to nodes in a cluster?

I am about to set up a server cluster for our company's web applications. At the beginning there will be 3 hardware servers in Proxmox HA setup in a remote datacenter running about 20-30 VMs all ...
0
votes
0answers
23 views

Garbage files in public_html folder. Is this a security breach? [duplicate]

The public_html folder on my site just got uploaded with a ton of garbage html files with filenames such as vonzipper-sunglasses-men-25jh27.html and tumi-daypack-04po59.html as well as several files ...
1
vote
1answer
12 views

MS CRM: How secure is an Internet Facing Deployment (IFD)?

From a security perspective, how secure is an IFD deployment of MS CRM 2013 or CRM 2015? I know it's the recommended way to expose MS CRM to the net, but what are the vulnerabilties? Is it ...
0
votes
2answers
24 views

How to handle passwords in a script: in-memory VS on-file

I have a script that runs on a VPS in a cheap cloud provider. The scenario is: I trust my provider, but I prefer to make his life hard if he ever wants to steal my key. All the interested folders in ...
0
votes
0answers
34 views

AWS security group egress rules for S3

I manually created a new security group using the AWS CLI. I created ingress rules that allow incoming connections only from my company's public IP address using the known ports for SSH (22) and ...
0
votes
0answers
10 views

Application Virtualization Risk Through WAN / Internet

I was weighing pros and cons about the new mission critical system that through application virtualization, will allow my colleagues from 3 different countries to access it. Here are some background ...
-2
votes
1answer
21 views

Default rules in fail2ban for apache

What does default apache (apache-auth, apache-overflows, apache-noscript) fail2ban jails do? I looked into docs, but there is nothing about it. Thanks for your help!
2
votes
5answers
212 views

How to prevent remote code execution from a domain member server?

Is there a way, using a firewall, Group Policy setting, or other control, to prevent someone logged into a domain member from being able to remotely execute code on a domain controller (that they ...
0
votes
1answer
23 views

Can I use an IAM role to grant my Heroku app access to my Amazon S3 bucket?

Heroku: Using AWS S3 to Store Static Assets and File Uploads suggests using my AWS security credentials to enable my Heroku app to access my Amazon S3 bucket. However, isn't it better practice (as ...
0
votes
1answer
19 views

Does “Kerborised” NFSv4 securely protect against a malicious client spoofing the user

I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to ...
1
vote
1answer
69 views

Minimizing attack surface on fresh 2012 R2

I'm in the following situation, i will have a fresh server connected to the internet (if required with a firewall between the net and it simply droping all packets on ports other than the one my ...
2
votes
1answer
59 views

Multi-site hosting security - ensure no scripts can run as Apache user, but only as each website's user

In setting up a hosting environment with multiple sites that should be isolated from each other, I did the obvious step of having PHP be configured so it runs as the user that's associated with each ...
0
votes
1answer
34 views

Do not allow all domain users to have access to a shared folder

This should be easy, but I just don't see it. And, first, I'm a programmer wearing the hat of an IT for lack of resource where I work (small company). I need to create a folder, inside our network ...
-1
votes
0answers
21 views

Mirror Raid to Single Harddisk ACPI BIOS in the system is not fully compliant with the ACPI [migrated]

My server used to be setup as a Mirror which means the 2nd harddisk would take the image of 1st harddisk. In anycase 1st harddisk is dead, 2nd harddisk would take over. It wasn't setup by me & ...
13
votes
3answers
2k views

Wipe is very slow. Too little entropy?

I have to hand off a Laptop including its hard disc. Since it was not encrypted I wanted to wipe it at least quickly. I know this is not optimal on SSD, but I thought better than just plain readable. ...